security/manager/ssl/src/nsCertOverrideService.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  *
   3  * ***** BEGIN LICENSE BLOCK *****
   4  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   5  *
   6  * The contents of this file are subject to the Mozilla Public License Version
   7  * 1.1 (the "License"); you may not use this file except in compliance with
   8  * the License. You may obtain a copy of the License at
   9  * http://www.mozilla.org/MPL/
  10  *
  11  * Software distributed under the License is distributed on an "AS IS" basis,
  12  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  13  * for the specific language governing rights and limitations under the
  14  * License.
  15  *
  16  * The Original Code is mozilla.org code.
  17  *
  18  * The Initial Developer of the Original Code is
  19  * Red Hat, Inc.
  20  * Portions created by the Initial Developer are Copyright (C) 2006
  21  * the Initial Developer. All Rights Reserved.
  22  *
  23  * Contributor(s):
  24  *   Kai Engert <kengert@redhat.com>
  25  *   Ehsan Akhgari <ehsan.akhgari@gmail.com>
  26  *
  27  * Alternatively, the contents of this file may be used under the terms of
  28  * either the GNU General Public License Version 2 or later (the "GPL"), or
  29  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  30  * in which case the provisions of the GPL or the LGPL are applicable instead
  31  * of those above. If you wish to allow use of your version of this file only
  32  * under the terms of either the GPL or the LGPL, and not to allow others to
  33  * use your version of this file under the terms of the MPL, indicate your
  34  * decision by deleting the provisions above and replace them with the notice
  35  * and other provisions required by the GPL or the LGPL. If you do not delete
  36  * the provisions above, a recipient may use your version of this file under
  37  * the terms of any one of the MPL, the GPL or the LGPL.
  38  *
  39  * ***** END LICENSE BLOCK ***** */
  40
  41 #include "nsCertOverrideService.h"
  42 #include "nsIX509Cert.h"
  43 #include "nsNSSCertificate.h"
  44 #include "nsCRT.h"
  45 #include "nsAppDirectoryServiceDefs.h"
  46 #include "nsStreamUtils.h"
  47 #include "nsNetUtil.h"
  48 #include "nsILineInputStream.h"
  49 #include "nsIObserver.h"
  50 #include "nsIObserverService.h"
  51 #include "nsISupportsPrimitives.h"
  52 #include "nsPromiseFlatString.h"
  53 #include "nsProxiedService.h"
  54 #include "nsStringBuffer.h"
  55 #include "nsAutoLock.h"
  56 #include "nsAutoPtr.h"
  57 #include "nspr.h"
  58 #include "pk11pub.h"
  59 #include "certdb.h"
  60 #include "sechash.h"
  61 #include "ssl.h" // For SSL_ClearSessionCache
  62
  63 #include "nsNSSCleaner.h"
  64 NSSCleanupAutoPtrClass(CERTCertificate, CERT_DestroyCertificate)
  65
  66 static const char kCertOverrideFileName[] = "cert_override.txt";
  67
  68 void
  69 nsCertOverride::convertBitsToString(OverrideBits ob, nsACString &str)
  70 {
  71   str.Truncate();
  72
  73   if (ob & ob_Mismatch)
  74     str.Append('M');
  75
  76   if (ob & ob_Untrusted)
  77     str.Append('U');
  78
  79   if (ob & ob_Time_error)
  80     str.Append('T');
  81 }
  82
  83 void
  84 nsCertOverride::convertStringToBits(const nsACString &str, OverrideBits &ob)
  85 {
  86   const nsPromiseFlatCString &flat = PromiseFlatCString(str);
  87   const char *walk = flat.get();
  88
  89   ob = ob_None;
  90
  91   for ( ; *walk; ++walk)
  92   {
  93     switch (*walk)
  94     {
  95       case 'm':
  96       case 'M':
  97         ob = (OverrideBits)(ob | ob_Mismatch);
  98         break;
  99
 100       case 'u':
 101       case 'U':
 102         ob = (OverrideBits)(ob | ob_Untrusted);
 103         break;
 104
 105       case 't':
 106       case 'T':
 107         ob = (OverrideBits)(ob | ob_Time_error);
 108         break;
 109
 110       default:
 111         break;
 112     }
 113   }
 114 }
 115
 116 NS_IMPL_THREADSAFE_ISUPPORTS3(nsCertOverrideService,
 117                               nsICertOverrideService,
 118                               nsIObserver,
 119                               nsISupportsWeakReference)
 120
 121 nsCertOverrideService::nsCertOverrideService()
 122 {
 123   monitor = PR_NewMonitor();
 124 }
 125
 126 nsCertOverrideService::~nsCertOverrideService()
 127 {
 128   if (monitor)
 129     PR_DestroyMonitor(monitor);
 130 }
 131
 132 nsresult
 133 nsCertOverrideService::Init()
 134 {
 135   if (!mSettingsTable.Init())
 136     return NS_ERROR_OUT_OF_MEMORY;
 137
 138   mOidTagForStoringNewHashes = SEC_OID_SHA256;
 139
 140   SECOidData *od = SECOID_FindOIDByTag(mOidTagForStoringNewHashes);
 141   if (!od)
 142     return NS_ERROR_FAILURE;
 143
 144   char *dotted_oid = CERT_GetOidString(&od->oid);
 145   if (!dotted_oid)
 146     return NS_ERROR_FAILURE;
 147
 148   mDottedOidForStoringNewHashes = dotted_oid;
 149   PR_smprintf_free(dotted_oid);
 150
 151   // cache mSettingsFile
 152   NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR, getter_AddRefs(mSettingsFile));
 153   if (mSettingsFile) {
 154     mSettingsFile->AppendNative(NS_LITERAL_CSTRING(kCertOverrideFileName));
 155   }
 156
 157   Read();
 158
 159   nsresult rv;
 160   NS_WITH_ALWAYS_PROXIED_SERVICE(nsIObserverService, mObserverService,
 161                                  "@mozilla.org/observer-service;1",
 162                                  NS_PROXY_TO_MAIN_THREAD, &rv);
 163
 164   if (mObserverService) {
 165     mObserverService->AddObserver(this, "profile-before-change", PR_TRUE);
 166     mObserverService->AddObserver(this, "profile-do-change", PR_TRUE);
 167     mObserverService->AddObserver(this, "shutdown-cleanse", PR_TRUE);
 168   }
 169
 170   return NS_OK;
 171 }
 172
 173 NS_IMETHODIMP
 174 nsCertOverrideService::Observe(nsISupports     *aSubject,
 175                                const char      *aTopic,
 176                                const PRUnichar *aData)
 177 {
 178   // check the topic
 179   if (!nsCRT::strcmp(aTopic, "profile-before-change")) {
 180     // The profile is about to change,
 181     // or is going away because the application is shutting down.
 182
 183     nsAutoMonitor lock(monitor);
 184
 185     if (!nsCRT::strcmp(aData, NS_LITERAL_STRING("shutdown-cleanse").get())) {
 186       RemoveAllFromMemory();
 187       // delete the storage file
 188       if (mSettingsFile) {
 189         mSettingsFile->Remove(PR_FALSE);
 190       }
 191     } else {
 192       RemoveAllFromMemory();
 193     }
 194
 195   } else if (!nsCRT::strcmp(aTopic, "profile-do-change")) {
 196     // The profile has already changed.
 197     // Now read from the new profile location.
 198     // we also need to update the cached file location
 199
 200     nsAutoMonitor lock(monitor);
 201
 202     nsresult rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR, getter_AddRefs(mSettingsFile));
 203     if (NS_SUCCEEDED(rv)) {
 204       mSettingsFile->AppendNative(NS_LITERAL_CSTRING(kCertOverrideFileName));
 205     }
 206     Read();
 207
 208   }
 209
 210   return NS_OK;
 211 }
 212
 213 void
 214 nsCertOverrideService::RemoveAllFromMemory()
 215 {
 216   nsAutoMonitor lock(monitor);
 217   mSettingsTable.Clear();
 218 }
 219
 220 PR_STATIC_CALLBACK(PLDHashOperator)
 221 RemoveTemporariesCallback(nsCertOverrideEntry *aEntry,
 222                           void *aArg)
 223 {
 224   if (aEntry && aEntry->mSettings.mIsTemporary) {
 225     aEntry->mSettings.mCert = nsnull;
 226     return PL_DHASH_REMOVE;
 227   }
 228
 229   return PL_DHASH_NEXT;
 230 }
 231
 232 void
 233 nsCertOverrideService::RemoveAllTemporaryOverrides()
 234 {
 235   {
 236     nsAutoMonitor lock(monitor);
 237     mSettingsTable.EnumerateEntries(RemoveTemporariesCallback, nsnull);
 238     // no need to write, as temporaries are never written to disk
 239   }
 240 }
 241
 242 nsresult
 243 nsCertOverrideService::Read()
 244 {
 245   nsAutoMonitor lock(monitor);
 246
 247   nsresult rv;
 248   nsCOMPtr<nsIInputStream> fileInputStream;
 249   rv = NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream), mSettingsFile);
 250   if (NS_FAILED(rv)) {
 251     return rv;
 252   }
 253
 254   nsCOMPtr<nsILineInputStream> lineInputStream = do_QueryInterface(fileInputStream, &rv);
 255   if (NS_FAILED(rv)) {
 256     return rv;
 257   }
 258
 259   nsCAutoString buffer;
 260   PRBool isMore = PR_TRUE;
 261   PRInt32 hostIndex = 0, algoIndex, fingerprintIndex, overrideBitsIndex, dbKeyIndex;
 262
 263   /* file format is:
 264    *
 265    * host:port \t fingerprint-algorithm \t fingerprint \t override-mask \t dbKey
 266    *
 267    *   where override-mask is a sequence of characters,
 268    *     M meaning hostname-Mismatch-override
 269    *     U meaning Untrusted-override
 270    *     T meaning Time-error-override (expired/not yet valid)
 271    *
 272    * if this format isn't respected we move onto the next line in the file.
 273    */
 274
 275   while (isMore && NS_SUCCEEDED(lineInputStream->ReadLine(buffer, &isMore))) {
 276     if (buffer.IsEmpty() || buffer.First() == '#') {
 277       continue;
 278     }
 279
 280     // this is a cheap, cheesy way of parsing a tab-delimited line into
 281     // string indexes, which can be lopped off into substrings. just for
 282     // purposes of obfuscation, it also checks that each token was found.
 283     // todo: use iterators?
 284     if ((algoIndex         = buffer.FindChar('\t', hostIndex)         + 1) == 0 ||
 285         (fingerprintIndex  = buffer.FindChar('\t', algoIndex)         + 1) == 0 ||
 286         (overrideBitsIndex = buffer.FindChar('\t', fingerprintIndex)  + 1) == 0 ||
 287         (dbKeyIndex        = buffer.FindChar('\t', overrideBitsIndex) + 1) == 0) {
 288       continue;
 289     }
 290
 291     const nsASingleFragmentCString &tmp = Substring(buffer, hostIndex, algoIndex - hostIndex - 1);
 292     const nsASingleFragmentCString &algo_string = Substring(buffer, algoIndex, fingerprintIndex - algoIndex - 1);
 293     const nsASingleFragmentCString &fingerprint = Substring(buffer, fingerprintIndex, overrideBitsIndex - fingerprintIndex - 1);
 294     const nsASingleFragmentCString &bits_string = Substring(buffer, overrideBitsIndex, dbKeyIndex - overrideBitsIndex - 1);
 295     const nsASingleFragmentCString &db_key = Substring(buffer, dbKeyIndex, buffer.Length() - dbKeyIndex);
 296
 297     nsCAutoString host(tmp);
 298     nsCertOverride::OverrideBits bits;
 299     nsCertOverride::convertStringToBits(bits_string, bits);
 300
 301     PRInt32 port;
 302     PRInt32 portIndex = host.RFindChar(':');
 303     if (portIndex == kNotFound)
 304       continue; // Ignore broken entries
 305
 306     PRInt32 portParseError;
 307     nsCAutoString portString(Substring(host, portIndex+1));
 308     port = portString.ToInteger(&portParseError);
 309     if (portParseError)
 310       continue; // Ignore broken entries
 311
 312     host.Truncate(portIndex);
 313
 314     AddEntryToList(host, port,
 315                    nsnull, // don't have the cert
 316                    PR_FALSE, // not temporary
 317                    algo_string, fingerprint, bits, db_key);
 318   }
 319
 320   return NS_OK;
 321 }
 322
 323 PR_STATIC_CALLBACK(PLDHashOperator)
 324 WriteEntryCallback(nsCertOverrideEntry *aEntry,
 325                    void *aArg)
 326 {
 327   static const char kTab[] = "\t";
 328
 329   nsIOutputStream *rawStreamPtr = (nsIOutputStream *)aArg;
 330
 331   nsresult rv;
 332
 333   if (rawStreamPtr && aEntry)
 334   {
 335     const nsCertOverride &settings = aEntry->mSettings;
 336     if (settings.mIsTemporary)
 337       return PL_DHASH_NEXT;
 338
 339     nsCAutoString bits_string;
 340     nsCertOverride::convertBitsToString(settings.mOverrideBits,
 341                                             bits_string);
 342
 343     rawStreamPtr->Write(aEntry->mHostWithPort.get(), aEntry->mHostWithPort.Length(), &rv);
 344     rawStreamPtr->Write(kTab, sizeof(kTab) - 1, &rv);
 345     rawStreamPtr->Write(settings.mFingerprintAlgOID.get(),
 346                         settings.mFingerprintAlgOID.Length(), &rv);
 347     rawStreamPtr->Write(kTab, sizeof(kTab) - 1, &rv);
 348     rawStreamPtr->Write(settings.mFingerprint.get(),
 349                         settings.mFingerprint.Length(), &rv);
 350     rawStreamPtr->Write(kTab, sizeof(kTab) - 1, &rv);
 351     rawStreamPtr->Write(bits_string.get(),
 352                         bits_string.Length(), &rv);
 353     rawStreamPtr->Write(kTab, sizeof(kTab) - 1, &rv);
 354     rawStreamPtr->Write(settings.mDBKey.get(), settings.mDBKey.Length(), &rv);
 355     rawStreamPtr->Write(NS_LINEBREAK, NS_LINEBREAK_LEN, &rv);
 356   }
 357
 358   return PL_DHASH_NEXT;
 359 }
 360
 361 nsresult
 362 nsCertOverrideService::Write()
 363 {
 364   nsAutoMonitor lock(monitor);
 365
 366   if (!mSettingsFile) {
 367     return NS_ERROR_NULL_POINTER;
 368   }
 369
 370   nsresult rv;
 371   nsCOMPtr<nsIOutputStream> fileOutputStream;
 372   rv = NS_NewSafeLocalFileOutputStream(getter_AddRefs(fileOutputStream),
 373                                        mSettingsFile,
 374                                        -1,
 375                                        0600);
 376   if (NS_FAILED(rv)) {
 377     NS_ERROR("failed to open cert_warn_settings.txt for writing");
 378     return rv;
 379   }
 380
 381   // get a buffered output stream 4096 bytes big, to optimize writes
 382   nsCOMPtr<nsIOutputStream> bufferedOutputStream;
 383   rv = NS_NewBufferedOutputStream(getter_AddRefs(bufferedOutputStream), fileOutputStream, 4096);
 384   if (NS_FAILED(rv)) {
 385     return rv;
 386   }
 387
 388   static const char kHeader[] =
 389       "# PSM Certificate Override Settings file" NS_LINEBREAK
 390       "# This is a generated file!  Do not edit." NS_LINEBREAK;
 391
 392   /* see ::Read for file format */
 393
 394   bufferedOutputStream->Write(kHeader, sizeof(kHeader) - 1, &rv);
 395
 396   nsIOutputStream *rawStreamPtr = bufferedOutputStream;
 397   mSettingsTable.EnumerateEntries(WriteEntryCallback, rawStreamPtr);
 398
 399   // All went ok. Maybe except for problems in Write(), but the stream detects
 400   // that for us
 401   nsCOMPtr<nsISafeOutputStream> safeStream = do_QueryInterface(bufferedOutputStream);
 402   NS_ASSERTION(safeStream, "expected a safe output stream!");
 403   if (safeStream) {
 404     rv = safeStream->Finish();
 405     if (NS_FAILED(rv)) {
 406       NS_WARNING("failed to save cert warn settings file! possible dataloss");
 407       return rv;
 408     }
 409   }
 410
 411   return NS_OK;
 412 }
 413
 414 static nsresult
 415 GetCertFingerprintByOidTag(CERTCertificate* nsscert,
 416                            SECOidTag aOidTag,
 417                            nsCString &fp)
 418 {
 419   unsigned int hash_len = HASH_ResultLenByOidTag(aOidTag);
 420   nsRefPtr<nsStringBuffer> fingerprint = nsStringBuffer::Alloc(hash_len);
 421   if (!fingerprint)
 422     return NS_ERROR_OUT_OF_MEMORY;
 423
 424   PK11_HashBuf(aOidTag, (unsigned char*)fingerprint->Data(),
 425                nsscert->derCert.data, nsscert->derCert.len);
 426
 427   SECItem fpItem;
 428   fpItem.data = (unsigned char*)fingerprint->Data();
 429   fpItem.len = hash_len;
 430
 431   fp.Adopt(CERT_Hexify(&fpItem, 1));
 432   return NS_OK;
 433 }
 434
 435 static nsresult
 436 GetCertFingerprintByOidTag(nsIX509Cert *aCert,
 437                            SECOidTag aOidTag,
 438                            nsCString &fp)
 439 {
 440   nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
 441   if (!cert2)
 442     return NS_ERROR_FAILURE;
 443
 444   CERTCertificate* nsscert = cert2->GetCert();
 445   if (!nsscert)
 446     return NS_ERROR_FAILURE;
 447
 448   CERTCertificateCleaner nsscertCleaner(nsscert);
 449   return GetCertFingerprintByOidTag(nsscert, aOidTag, fp);
 450 }
 451
 452 static nsresult
 453 GetCertFingerprintByDottedOidString(CERTCertificate* nsscert,
 454                                     const nsCString &dottedOid,
 455                                     nsCString &fp)
 456 {
 457   SECItem oid;
 458   oid.data = nsnull;
 459   oid.len = 0;
 460   SECStatus srv = SEC_StringToOID(nsnull, &oid,
 461                     dottedOid.get(), dottedOid.Length());
 462   if (srv != SECSuccess)
 463     return NS_ERROR_FAILURE;
 464
 465   SECOidTag oid_tag = SECOID_FindOIDTag(&oid);
 466   SECITEM_FreeItem(&oid, PR_FALSE);
 467
 468   if (oid_tag == SEC_OID_UNKNOWN)
 469     return NS_ERROR_FAILURE;
 470
 471   return GetCertFingerprintByOidTag(nsscert, oid_tag, fp);
 472 }
 473
 474 static nsresult
 475 GetCertFingerprintByDottedOidString(nsIX509Cert *aCert,
 476                                     const nsCString &dottedOid,
 477                                     nsCString &fp)
 478 {
 479   nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
 480   if (!cert2)
 481     return NS_ERROR_FAILURE;
 482
 483   CERTCertificate* nsscert = cert2->GetCert();
 484   if (!nsscert)
 485     return NS_ERROR_FAILURE;
 486
 487   CERTCertificateCleaner nsscertCleaner(nsscert);
 488   return GetCertFingerprintByDottedOidString(nsscert, dottedOid, fp);
 489 }
 490
 491 NS_IMETHODIMP
 492 nsCertOverrideService::RememberValidityOverride(const nsACString & aHostName, PRInt32 aPort,
 493                                                 nsIX509Cert *aCert,
 494                                                 PRUint32 aOverrideBits,
 495                                                 PRBool aTemporary)
 496 {
 497   NS_ENSURE_ARG_POINTER(aCert);
 498   if (aHostName.IsEmpty())
 499     return NS_ERROR_INVALID_ARG;
 500   if (aPort < -1)
 501     return NS_ERROR_INVALID_ARG;
 502
 503   nsCOMPtr<nsIX509Cert2> cert2 = do_QueryInterface(aCert);
 504   if (!cert2)
 505     return NS_ERROR_FAILURE;
 506
 507   CERTCertificate* nsscert = cert2->GetCert();
 508   if (!nsscert)
 509     return NS_ERROR_FAILURE;
 510
 511   CERTCertificateCleaner nsscertCleaner(nsscert);
 512
 513   nsCAutoString nickname;
 514   nickname = nsNSSCertificate::defaultServerNickname(nsscert);
 515   if (!aTemporary && !nickname.IsEmpty())
 516   {
 517     PK11SlotInfo *slot = PK11_GetInternalKeySlot();
 518     if (!slot)
 519       return NS_ERROR_FAILURE;
 520
 521     SECStatus srv = PK11_ImportCert(slot, nsscert, CK_INVALID_HANDLE,
 522                                     const_cast<char*>(nickname.get()), PR_FALSE);
 523     PK11_FreeSlot(slot);
 524
 525     if (srv != SECSuccess)
 526       return NS_ERROR_FAILURE;
 527   }
 528
 529   nsCAutoString fpStr;
 530   nsresult rv = GetCertFingerprintByOidTag(nsscert,
 531                   mOidTagForStoringNewHashes, fpStr);
 532   if (NS_FAILED(rv))
 533     return rv;
 534
 535   char *dbkey = NULL;
 536   rv = aCert->GetDbKey(&dbkey);
 537   if (NS_FAILED(rv) || !dbkey)
 538     return rv;
 539
 540   // change \n and \r to spaces in the possibly multi-line-base64-encoded key
 541   for (char *dbkey_walk = dbkey;
 542        *dbkey_walk;
 543       ++dbkey_walk) {
 544     char c = *dbkey_walk;
 545     if (c == '\r' || c == '\n') {
 546       *dbkey_walk = ' ';
 547     }
 548   }
 549
 550   {
 551     nsAutoMonitor lock(monitor);
 552     AddEntryToList(aHostName, aPort,
 553                    aTemporary ? aCert : nsnull,
 554                      // keep a reference to the cert for temporary overrides
 555                    aTemporary,
 556                    mDottedOidForStoringNewHashes, fpStr,
 557                    (nsCertOverride::OverrideBits)aOverrideBits,
 558                    nsDependentCString(dbkey));
 559     Write();
 560   }
 561
 562   PR_Free(dbkey);
 563   return NS_OK;
 564 }
 565
 566 NS_IMETHODIMP
 567 nsCertOverrideService::HasMatchingOverride(const nsACString & aHostName, PRInt32 aPort,
 568                                            nsIX509Cert *aCert,
 569                                            PRUint32 *aOverrideBits,
 570                                            PRBool *aIsTemporary,
 571                                            PRBool *_retval)
 572 {
 573   if (aHostName.IsEmpty())
 574     return NS_ERROR_INVALID_ARG;
 575   if (aPort < -1)
 576     return NS_ERROR_INVALID_ARG;
 577
 578   NS_ENSURE_ARG_POINTER(aCert);
 579   NS_ENSURE_ARG_POINTER(aOverrideBits);
 580   NS_ENSURE_ARG_POINTER(aIsTemporary);
 581   NS_ENSURE_ARG_POINTER(_retval);
 582   *_retval = PR_FALSE;
 583   *aOverrideBits = nsCertOverride::ob_None;
 584
 585   nsCAutoString hostPort;
 586   GetHostWithPort(aHostName, aPort, hostPort);
 587   nsCertOverride settings;
 588
 589   {
 590     nsAutoMonitor lock(monitor);
 591     nsCertOverrideEntry *entry = mSettingsTable.GetEntry(hostPort.get());
 592
 593     if (!entry)
 594       return NS_OK;
 595
 596     settings = entry->mSettings; // copy
 597   }
 598
 599   *aOverrideBits = settings.mOverrideBits;
 600   *aIsTemporary = settings.mIsTemporary;
 601
 602   nsCAutoString fpStr;
 603   nsresult rv;
 604
 605   if (settings.mFingerprintAlgOID.Equals(mDottedOidForStoringNewHashes)) {
 606     rv = GetCertFingerprintByOidTag(aCert, mOidTagForStoringNewHashes, fpStr);
 607   }
 608   else {
 609     rv = GetCertFingerprintByDottedOidString(aCert, settings.mFingerprintAlgOID, fpStr);
 610   }
 611   if (NS_FAILED(rv))
 612     return rv;
 613
 614   *_retval = settings.mFingerprint.Equals(fpStr);
 615   return NS_OK;
 616 }
 617
 618 NS_IMETHODIMP
 619 nsCertOverrideService::GetValidityOverride(const nsACString & aHostName, PRInt32 aPort,
 620                                            nsACString & aHashAlg,
 621                                            nsACString & aFingerprint,
 622                                            PRUint32 *aOverrideBits,
 623                                            PRBool *aIsTemporary,
 624                                            PRBool *_found)
 625 {
 626   NS_ENSURE_ARG_POINTER(_found);
 627   NS_ENSURE_ARG_POINTER(aIsTemporary);
 628   NS_ENSURE_ARG_POINTER(aOverrideBits);
 629   *_found = PR_FALSE;
 630   *aOverrideBits = nsCertOverride::ob_None;
 631
 632   nsCAutoString hostPort;
 633   GetHostWithPort(aHostName, aPort, hostPort);
 634   nsCertOverride settings;
 635
 636   {
 637     nsAutoMonitor lock(monitor);
 638     nsCertOverrideEntry *entry = mSettingsTable.GetEntry(hostPort.get());
 639
 640     if (entry) {
 641       *_found = PR_TRUE;
 642       settings = entry->mSettings; // copy
 643     }
 644   }
 645
 646   if (*_found) {
 647     *aOverrideBits = settings.mOverrideBits;
 648     *aIsTemporary = settings.mIsTemporary;
 649     aFingerprint = settings.mFingerprint;
 650     aHashAlg = settings.mFingerprintAlgOID;
 651   }
 652
 653   return NS_OK;
 654 }
 655
 656 nsresult
 657 nsCertOverrideService::AddEntryToList(const nsACString &aHostName, PRInt32 aPort,
 658                                       nsIX509Cert *aCert,
 659                                       const PRBool aIsTemporary,
 660                                       const nsACString &fingerprintAlgOID,
 661                                       const nsACString &fingerprint,
 662                                       nsCertOverride::OverrideBits ob,
 663                                       const nsACString &dbKey)
 664 {
 665   nsCAutoString hostPort;
 666   GetHostWithPort(aHostName, aPort, hostPort);
 667
 668   {
 669     nsAutoMonitor lock(monitor);
 670     nsCertOverrideEntry *entry = mSettingsTable.PutEntry(hostPort.get());
 671
 672     if (!entry) {
 673       NS_ERROR("can't insert a null entry!");
 674       return NS_ERROR_OUT_OF_MEMORY;
 675     }
 676
 677     entry->mHostWithPort = hostPort;
 678
 679     nsCertOverride &settings = entry->mSettings;
 680     settings.mAsciiHost = aHostName;
 681     settings.mPort = aPort;
 682     settings.mIsTemporary = aIsTemporary;
 683     settings.mFingerprintAlgOID = fingerprintAlgOID;
 684     settings.mFingerprint = fingerprint;
 685     settings.mOverrideBits = ob;
 686     settings.mDBKey = dbKey;
 687     settings.mCert = aCert;
 688   }
 689
 690   return NS_OK;
 691 }
 692
 693 NS_IMETHODIMP
 694 nsCertOverrideService::ClearValidityOverride(const nsACString & aHostName, PRInt32 aPort)
 695 {
 696   nsCAutoString hostPort;
 697   GetHostWithPort(aHostName, aPort, hostPort);
 698   {
 699     nsAutoMonitor lock(monitor);
 700     mSettingsTable.RemoveEntry(hostPort.get());
 701     Write();
 702   }
 703   SSL_ClearSessionCache();
 704   return NS_OK;
 705 }
 706
 707 NS_IMETHODIMP
 708 nsCertOverrideService::GetAllOverrideHostsWithPorts(PRUint32 *aCount,
 709                                                         PRUnichar ***aHostsWithPortsArray)
 710 {
 711   return NS_ERROR_NOT_IMPLEMENTED;
 712 }
 713
 714 static PRBool
 715 matchesDBKey(nsIX509Cert *cert, const char *match_dbkey)
 716 {
 717   char *dbkey = NULL;
 718   nsresult rv = cert->GetDbKey(&dbkey);
 719   if (NS_FAILED(rv) || !dbkey)
 720     return PR_FALSE;
 721
 722   PRBool found_mismatch = PR_FALSE;
 723   const char *key1 = dbkey;
 724   const char *key2 = match_dbkey;
 725
 726   // skip over any whitespace when comparing
 727   while (*key1 && *key2) {
 728     char c1 = *key1;
 729     char c2 = *key2;
 730
 731     switch (c1) {
 732       case ' ':
 733       case '\t':
 734       case '\n':
 735       case '\r':
 736         ++key1;
 737         continue;
 738     }
 739
 740     switch (c2) {
 741       case ' ':
 742       case '\t':
 743       case '\n':
 744       case '\r':
 745         ++key2;
 746         continue;
 747     }
 748
 749     if (c1 != c2) {
 750       found_mismatch = PR_TRUE;
 751       break;
 752     }
 753
 754     ++key1;
 755     ++key2;
 756   }
 757
 758   PR_Free(dbkey);
 759   return !found_mismatch;
 760 }
 761
 762 struct nsCertAndBoolsAndInt
 763 {
 764   nsIX509Cert *cert;
 765   PRBool aCheckTemporaries;
 766   PRBool aCheckPermanents;
 767   PRUint32 counter;
 768
 769   SECOidTag mOidTagForStoringNewHashes;
 770   nsCString mDottedOidForStoringNewHashes;
 771 };
 772
 773 PR_STATIC_CALLBACK(PLDHashOperator)
 774 FindMatchingCertCallback(nsCertOverrideEntry *aEntry,
 775                          void *aArg)
 776 {
 777   nsCertAndBoolsAndInt *cai = (nsCertAndBoolsAndInt *)aArg;
 778
 779   if (cai && aEntry)
 780   {
 781     const nsCertOverride &settings = aEntry->mSettings;
 782     PRBool still_ok = PR_TRUE;
 783
 784     if ((settings.mIsTemporary && !cai->aCheckTemporaries)
 785         ||
 786         (!settings.mIsTemporary && !cai->aCheckPermanents)) {
 787       still_ok = PR_FALSE;
 788     }
 789
 790     if (still_ok && matchesDBKey(cai->cert, settings.mDBKey.get())) {
 791       nsCAutoString cert_fingerprint;
 792       nsresult rv;
 793       if (settings.mFingerprintAlgOID.Equals(cai->mDottedOidForStoringNewHashes)) {
 794         rv = GetCertFingerprintByOidTag(cai->cert,
 795                cai->mOidTagForStoringNewHashes, cert_fingerprint);
 796       }
 797       else {
 798         rv = GetCertFingerprintByDottedOidString(cai->cert,
 799                settings.mFingerprintAlgOID, cert_fingerprint);
 800       }
 801       if (NS_SUCCEEDED(rv) &&
 802           settings.mFingerprint.Equals(cert_fingerprint)) {
 803         cai->counter++;
 804       }
 805     }
 806   }
 807
 808   return PL_DHASH_NEXT;
 809 }
 810
 811 NS_IMETHODIMP
 812 nsCertOverrideService::IsCertUsedForOverrides(nsIX509Cert *aCert,
 813                                               PRBool aCheckTemporaries,
 814                                               PRBool aCheckPermanents,
 815                                               PRUint32 *_retval)
 816 {
 817   NS_ENSURE_ARG(aCert);
 818   NS_ENSURE_ARG(_retval);
 819
 820   nsCertAndBoolsAndInt cai;
 821   cai.cert = aCert;
 822   cai.aCheckTemporaries = aCheckTemporaries;
 823   cai.aCheckPermanents = aCheckPermanents;
 824   cai.counter = 0;
 825   cai.mOidTagForStoringNewHashes = mOidTagForStoringNewHashes;
 826   cai.mDottedOidForStoringNewHashes = mDottedOidForStoringNewHashes;
 827
 828   {
 829     nsAutoMonitor lock(monitor);
 830     mSettingsTable.EnumerateEntries(FindMatchingCertCallback, &cai);
 831   }
 832   *_retval = cai.counter;
 833   return NS_OK;
 834 }
 835
 836 struct nsCertAndPointerAndCallback
 837 {
 838   nsIX509Cert *cert;
 839   void *userdata;
 840   nsCertOverrideService::CertOverrideEnumerator enumerator;
 841
 842   SECOidTag mOidTagForStoringNewHashes;
 843   nsCString mDottedOidForStoringNewHashes;
 844 };
 845
 846 PR_STATIC_CALLBACK(PLDHashOperator)
 847 EnumerateCertOverridesCallback(nsCertOverrideEntry *aEntry,
 848                                void *aArg)
 849 {
 850   nsCertAndPointerAndCallback *capac = (nsCertAndPointerAndCallback *)aArg;
 851
 852   if (capac && aEntry)
 853   {
 854     const nsCertOverride &settings = aEntry->mSettings;
 855
 856     if (!capac->cert) {
 857       (*capac->enumerator)(settings, capac->userdata);
 858     }
 859     else {
 860       if (matchesDBKey(capac->cert, settings.mDBKey.get())) {
 861         nsCAutoString cert_fingerprint;
 862         nsresult rv;
 863         if (settings.mFingerprintAlgOID.Equals(capac->mDottedOidForStoringNewHashes)) {
 864           rv = GetCertFingerprintByOidTag(capac->cert,
 865                  capac->mOidTagForStoringNewHashes, cert_fingerprint);
 866         }
 867         else {
 868           rv = GetCertFingerprintByDottedOidString(capac->cert,
 869                  settings.mFingerprintAlgOID, cert_fingerprint);
 870         }
 871         if (NS_SUCCEEDED(rv) &&
 872             settings.mFingerprint.Equals(cert_fingerprint)) {
 873           (*capac->enumerator)(settings, capac->userdata);
 874         }
 875       }
 876     }
 877   }
 878
 879   return PL_DHASH_NEXT;
 880 }
 881
 882 nsresult
 883 nsCertOverrideService::EnumerateCertOverrides(nsIX509Cert *aCert,
 884                          CertOverrideEnumerator enumerator,
 885                          void *aUserData)
 886 {
 887   nsCertAndPointerAndCallback capac;
 888   capac.cert = aCert;
 889   capac.userdata = aUserData;
 890   capac.enumerator = enumerator;
 891   capac.mOidTagForStoringNewHashes = mOidTagForStoringNewHashes;
 892   capac.mDottedOidForStoringNewHashes = mDottedOidForStoringNewHashes;
 893
 894   {
 895     nsAutoMonitor lock(monitor);
 896     mSettingsTable.EnumerateEntries(EnumerateCertOverridesCallback, &capac);
 897   }
 898   return NS_OK;
 899 }
 900
 901 void
 902 nsCertOverrideService::GetHostWithPort(const nsACString & aHostName, PRInt32 aPort, nsACString& _retval)
 903 {
 904   nsCAutoString hostPort(aHostName);
 905   if (aPort == -1)
 906     aPort = 443;
 907   hostPort.AppendLiteral(":");
 908   hostPort.AppendInt(aPort);
 909
 910   _retval.Assign(hostPort);
 911 }