third_party/heimdal/lib/hx509/collector.c

   1 /*
   2  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "hx_locl.h"
  35
  36 struct private_key {
  37     AlgorithmIdentifier alg;
  38     hx509_private_key private_key;
  39     heim_octet_string localKeyId;
  40 };
  41
  42 struct hx509_collector {
  43     hx509_lock lock;
  44     hx509_certs unenvelop_certs;
  45     hx509_certs certs;
  46     struct {
  47         struct private_key **data;
  48         size_t len;
  49     } val;
  50 };
  51
  52
  53 HX509_LIB_FUNCTION int HX509_LIB_CALL
  54 _hx509_collector_alloc(hx509_context context, hx509_lock lock, struct hx509_collector **collector)
  55 {
  56     struct hx509_collector *c;
  57     int ret;
  58
  59     *collector = NULL;
  60
  61     c = calloc(1, sizeof(*c));
  62     if (c == NULL) {
  63         hx509_set_error_string(context, 0, ENOMEM, "out of memory");
  64         return ENOMEM;
  65     }
  66     c->lock = lock;
  67
  68     ret = hx509_certs_init(context, "MEMORY:collector-unenvelop-cert",
  69                            0,NULL, &c->unenvelop_certs);
  70     if (ret) {
  71         free(c);
  72         return ret;
  73     }
  74     c->val.data = NULL;
  75     c->val.len = 0;
  76     ret = hx509_certs_init(context, "MEMORY:collector-tmp-store",
  77                            0, NULL, &c->certs);
  78     if (ret) {
  79         hx509_certs_free(&c->unenvelop_certs);
  80         free(c);
  81         return ret;
  82     }
  83
  84     *collector = c;
  85     return 0;
  86 }
  87
  88 HX509_LIB_FUNCTION hx509_lock HX509_LIB_CALL
  89 _hx509_collector_get_lock(struct hx509_collector *c)
  90 {
  91     return c->lock;
  92 }
  93
  94
  95 HX509_LIB_FUNCTION int HX509_LIB_CALL
  96 _hx509_collector_certs_add(hx509_context context,
  97                            struct hx509_collector *c,
  98                            hx509_cert cert)
  99 {
 100     return hx509_certs_add(context, c->certs, cert);
 101 }
 102
 103 static void
 104 free_private_key(struct private_key *key)
 105 {
 106     free_AlgorithmIdentifier(&key->alg);
 107     if (key->private_key)
 108         hx509_private_key_free(&key->private_key);
 109     der_free_octet_string(&key->localKeyId);
 110     free(key);
 111 }
 112
 113 HX509_LIB_FUNCTION int HX509_LIB_CALL
 114 _hx509_collector_private_key_add(hx509_context context,
 115                                  struct hx509_collector *c,
 116                                  const AlgorithmIdentifier *alg,
 117                                  hx509_private_key private_key,
 118                                  const heim_octet_string *key_data,
 119                                  const heim_octet_string *localKeyId)
 120 {
 121     struct private_key *key;
 122     void *d;
 123     int ret;
 124
 125     key = calloc(1, sizeof(*key));
 126     if (key == NULL)
 127         return ENOMEM;
 128
 129     d = realloc(c->val.data, (c->val.len + 1) * sizeof(c->val.data[0]));
 130     if (d == NULL) {
 131         free(key);
 132         hx509_set_error_string(context, 0, ENOMEM, "Out of memory");
 133         return ENOMEM;
 134     }
 135     c->val.data = d;
 136
 137     ret = copy_AlgorithmIdentifier(alg, &key->alg);
 138     if (ret) {
 139         hx509_set_error_string(context, 0, ret, "Failed to copy "
 140                                "AlgorithmIdentifier");
 141         goto out;
 142     }
 143     if (private_key) {
 144         key->private_key = private_key;
 145     } else {
 146         ret = hx509_parse_private_key(context, alg,
 147                                        key_data->data, key_data->length,
 148                                        HX509_KEY_FORMAT_DER,
 149                                        &key->private_key);
 150         if (ret && localKeyId) {
 151             int ret2;
 152
 153             ret2 = hx509_parse_private_key(context, alg,
 154                                            localKeyId->data, localKeyId->length,
 155                                            HX509_KEY_FORMAT_PKCS8,
 156                                            &key->private_key);
 157             if (ret2 == 0)
 158                 ret = 0;
 159         }
 160         if (ret)
 161             goto out;
 162     }
 163     if (localKeyId) {
 164         ret = der_copy_octet_string(localKeyId, &key->localKeyId);
 165         if (ret) {
 166             hx509_set_error_string(context, 0, ret,
 167                                    "Failed to copy localKeyId");
 168             goto out;
 169         }
 170     } else
 171         memset(&key->localKeyId, 0, sizeof(key->localKeyId));
 172
 173     c->val.data[c->val.len] = key;
 174     c->val.len++;
 175
 176 out:
 177     if (ret)
 178         free_private_key(key);
 179
 180     return ret;
 181 }
 182
 183 static int
 184 match_localkeyid(hx509_context context,
 185                  struct private_key *value,
 186                  hx509_certs certs)
 187 {
 188     hx509_cert cert;
 189     hx509_query q;
 190     int ret;
 191
 192     if (value->localKeyId.length == 0) {
 193         hx509_set_error_string(context, 0, HX509_LOCAL_ATTRIBUTE_MISSING,
 194                                "No local key attribute on private key");
 195         return HX509_LOCAL_ATTRIBUTE_MISSING;
 196     }
 197
 198     _hx509_query_clear(&q);
 199     q.match |= HX509_QUERY_MATCH_LOCAL_KEY_ID;
 200
 201     q.local_key_id = &value->localKeyId;
 202
 203     ret = hx509_certs_find(context, certs, &q, &cert);
 204     if (ret == 0 && cert == NULL)
 205         ret = HX509_CERT_NOT_FOUND;
 206     if (ret == 0) {
 207         if (value->private_key)
 208             _hx509_cert_assign_key(cert, value->private_key);
 209         hx509_cert_free(cert);
 210     }
 211     return ret;
 212 }
 213
 214 static int
 215 match_keys(hx509_context context, struct private_key *value, hx509_certs certs)
 216 {
 217     hx509_cursor cursor;
 218     hx509_cert c;
 219     int ret, found = HX509_CERT_NOT_FOUND;
 220
 221     if (value->private_key == NULL) {
 222         hx509_set_error_string(context, 0, HX509_PRIVATE_KEY_MISSING,
 223                                "No private key to compare with");
 224         return HX509_PRIVATE_KEY_MISSING;
 225     }
 226
 227     ret = hx509_certs_start_seq(context, certs, &cursor);
 228     if (ret)
 229         return ret;
 230
 231     c = NULL;
 232     while (1) {
 233         ret = hx509_certs_next_cert(context, certs, cursor, &c);
 234         if (ret)
 235             break;
 236         if (c == NULL)
 237             break;
 238         if (_hx509_cert_private_key(c)) {
 239             hx509_cert_free(c);
 240             continue;
 241         }
 242
 243         ret = _hx509_match_keys(c, value->private_key);
 244         if (ret) {
 245             _hx509_cert_assign_key(c, value->private_key);
 246             hx509_cert_free(c);
 247             found = 0;
 248             break;
 249         }
 250         hx509_cert_free(c);
 251     }
 252
 253     hx509_certs_end_seq(context, certs, cursor);
 254
 255     if (found)
 256         hx509_clear_error_string(context);
 257
 258     return found;
 259 }
 260
 261 HX509_LIB_FUNCTION int HX509_LIB_CALL
 262 _hx509_collector_collect_certs(hx509_context context,
 263                                struct hx509_collector *c,
 264                                hx509_certs *ret_certs)
 265 {
 266     hx509_certs certs;
 267     int ret;
 268     size_t i;
 269
 270     *ret_certs = NULL;
 271
 272     ret = hx509_certs_init(context, "MEMORY:collector-store", 0, NULL, &certs);
 273     if (ret)
 274         return ret;
 275
 276     ret = hx509_certs_merge(context, certs, c->certs);
 277     if (ret) {
 278         hx509_certs_free(&certs);
 279         return ret;
 280     }
 281
 282     for (i = 0; i < c->val.len; i++) {
 283         ret = match_localkeyid(context, c->val.data[i], certs);
 284         if (ret == 0)
 285             continue;
 286         ret = match_keys(context, c->val.data[i], certs);
 287         if (ret == 0)
 288             continue;
 289     }
 290
 291     *ret_certs = certs;
 292
 293     return 0;
 294 }
 295
 296 HX509_LIB_FUNCTION int HX509_LIB_CALL
 297 _hx509_collector_collect_private_keys(hx509_context context,
 298                                       struct hx509_collector *c,
 299                                       hx509_private_key **keys)
 300 {
 301     size_t i, nkeys;
 302
 303     *keys = NULL;
 304
 305     for (i = 0, nkeys = 0; i < c->val.len; i++)
 306         if (c->val.data[i]->private_key)
 307             nkeys++;
 308
 309     *keys = calloc(nkeys + 1, sizeof(**keys));
 310     if (*keys == NULL) {
 311         hx509_set_error_string(context, 0, ENOMEM, "malloc - out of memory");
 312         return ENOMEM;
 313     }
 314
 315     for (i = 0, nkeys = 0; i < c->val.len; i++) {
 316         if (c->val.data[i]->private_key) {
 317             (*keys)[nkeys++] = c->val.data[i]->private_key;
 318             c->val.data[i]->private_key = NULL;
 319         }
 320     }
 321     (*keys)[nkeys] = NULL;
 322
 323     return 0;
 324 }
 325
 326
 327 HX509_LIB_FUNCTION void HX509_LIB_CALL
 328 _hx509_collector_free(struct hx509_collector *c)
 329 {
 330     size_t i;
 331
 332     if (c->unenvelop_certs)
 333         hx509_certs_free(&c->unenvelop_certs);
 334     if (c->certs)
 335         hx509_certs_free(&c->certs);
 336     for (i = 0; i < c->val.len; i++)
 337         free_private_key(c->val.data[i]);
 338     if (c->val.data)
 339         free(c->val.data);
 340     free(c);
 341 }