Update third_party/nss to NSS 3.15.4.

nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocspresponse.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_pl_ocspresponse.c
  *
  */
 
 #include "pkix_pl_ocspresponse.h"
 
@@ skipping 323 matching lines @@
  *  If an OcspResponse_VerifyCallback "verifyFcn" is supplied, it is used to
  *  verify the Cert received from the responder as the signer. If none is
  *  supplied, the default verification function is used.
  *
  *  The contents of "request" are ignored on calls subsequent to a WOULDBLOCK
  *  return, and the caller is permitted to supply NULL.
  *
  * PARAMETERS
  *  "request"
  *      Address of the OcspRequest for which a response is desired.
+ *  "httpMethod"
+ *      GET or POST
  *  "responder"
  *      Address, if non-NULL, of the SEC_HttpClientFcn to be sent the OCSP
  *      query.
  *  "verifyFcn"
  *      Address, if non-NULL, of the OcspResponse_VerifyCallback function to be
  *      used to verify the Cert of the OCSP responder.
  *  "pNBIOContext"
  *      Address at which platform-dependent information is stored for handling
  *      of non-blocking I/O. Must be non-NULL.
  *  "pOcspResponse"
  *      The address where the created OcspResponse is stored. Must be non-NULL.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns an OcspResponse Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 pkix_pl_OcspResponse_Create(
         PKIX_PL_OcspRequest *request,
+        const char *httpMethod,
         void *responder,
         PKIX_PL_VerifyCallback verifyFcn,
         void **pNBIOContext,
         PKIX_PL_OcspResponse **pResponse,
         void *plContext)
 {
         void *nbioContext = NULL;
         PKIX_PL_OcspResponse *ocspResponse = NULL;
         const SEC_HttpClientFcn *httpClient = NULL;
         const SEC_HttpClientFcnV1 *hcv1 = NULL;
         SECStatus rv = SECFailure;
         char *location = NULL;
         char *hostname = NULL;
         char *path = NULL;
         char *responseContentType = NULL;
         PRUint16 port = 0;
         SEC_HTTP_SERVER_SESSION serverSession = NULL;
         SEC_HTTP_REQUEST_SESSION sessionRequest = NULL;
         SECItem *encodedRequest = NULL;
         PRUint16 responseCode = 0;
         char *responseData = NULL;
  
         PKIX_ENTER(OCSPRESPONSE, "pkix_pl_OcspResponse_Create");
         PKIX_NULLCHECK_TWO(pNBIOContext, pResponse);
 
+        if (!strcmp(httpMethod, "GET") && !strcmp(httpMethod, "POST")) {
+                PKIX_ERROR(PKIX_INVALIDOCSPHTTPMETHOD);
+        }
+
         nbioContext = *pNBIOContext;
         *pNBIOContext = NULL;
 
         if (nbioContext != NULL) {
 
                 ocspResponse = *pResponse;
                 PKIX_NULLCHECK_ONE(ocspResponse);
 
                 httpClient = ocspResponse->httpClient;
                 serverSession = ocspResponse->serverSession;
@@ skipping 13 matching lines @@
                 /* prepare initial message to HTTPClient */
 
                 /* Is there a default responder and is it enabled? */
                 if (responder) {
                     httpClient = (const SEC_HttpClientFcn *)responder;
                 } else {
                     httpClient = SEC_GetRegisteredHttpClient();
                 }
 
                 if (httpClient && (httpClient->version == 1)) {
+                        char *fullGetPath = NULL;
+                        const char *sessionPath = NULL;
+                        PRBool usePOST = !strcmp(httpMethod, "POST");
 
                         hcv1 = &(httpClient->fcnTable.ftable1);
 
                         PKIX_CHECK(pkix_pl_OcspRequest_GetLocation
                                 (request, &location, plContext),
                                 PKIX_OCSPREQUESTGETLOCATIONFAILED);
 
                         /* parse location -> hostname, port, path */    
                         rv = CERT_ParseURL(location, &hostname, &port, &path);
                         if (rv == SECFailure || hostname == NULL || path == NULL) {
                                 PKIX_ERROR(PKIX_URLPARSINGFAILED);
                         }
 
                         rv = (*hcv1->createSessionFcn)(hostname, port,
                                                        &serverSession);
                         if (rv != SECSuccess) {
                                 PKIX_ERROR(PKIX_OCSPSERVERERROR);
                         }       
 
-                        rv = (*hcv1->createFcn)(serverSession, "http", path,
-                                                "POST",
+                        if (usePOST) {
+                                sessionPath = path;
+                        } else {
+                                /* calculate, are we allowed to use GET? */
+                                enum { max_get_request_size = 255 }; /* defined by RFC2560 */
+                                char b64ReqBuf[max_get_request_size+1];
+                                size_t base64size;
+                                size_t slashLengthIfNeeded = 0;
+                                size_t pathLength;
+                                PRInt32 urlEncodedBufLength;
+                                size_t getURLLength;
+                                char *walkOutput = NULL;
+
+                                pathLength = strlen(path);
+                                if (path[pathLength-1] != '/') {
+                                        slashLengthIfNeeded = 1;
+                                }
+                                base64size = (((encodedRequest->len +2)/3) * 4);
+                                if (base64size > max_get_request_size) {
+                                        PKIX_ERROR(PKIX_OCSPGETREQUESTTOOBIG);
+                                }
+                                memset(b64ReqBuf, 0, sizeof(b64ReqBuf));
+                                PL_Base64Encode((const char *)encodedRequest->data, encodedRequest->len, b64ReqBuf);
+                                urlEncodedBufLength = ocsp_UrlEncodeBase64Buf(b64ReqBuf, NULL);
+                                getURLLength = pathLength + urlEncodedBufLength + slashLengthIfNeeded;
+                                fullGetPath = (char*)PORT_Alloc(getURLLength);
+                                if (!fullGetPath) {
+                                        PKIX_ERROR(PKIX_OUTOFMEMORY);
+                                }
+                                strcpy(fullGetPath, path);
+                                walkOutput = fullGetPath + pathLength;
+                                if (walkOutput > fullGetPath && slashLengthIfNeeded) {
+                                        strcpy(walkOutput, "/");
+                                        ++walkOutput;
+                                }
+                                ocsp_UrlEncodeBase64Buf(b64ReqBuf, walkOutput);
+                                sessionPath = fullGetPath;
+                        }
+
+                        rv = (*hcv1->createFcn)(serverSession, "http",
+                                                sessionPath, httpMethod,
                                                 PR_SecondsToInterval(timeout),
                                                 &sessionRequest);
+                        sessionPath = NULL;
+                        if (fullGetPath) {
+                                PORT_Free(fullGetPath);
+                                fullGetPath = NULL;
+                        }
+                        
                         if (rv != SECSuccess) {
                                 PKIX_ERROR(PKIX_OCSPSERVERERROR);
                         }       
 
-                        rv = (*hcv1->setPostDataFcn)(sessionRequest,
-                                                  (char *)encodedRequest->data,
-                                                  encodedRequest->len,
-                                                  "application/ocsp-request");
-                        if (rv != SECSuccess) {
-                                PKIX_ERROR(PKIX_OCSPSERVERERROR);
-                        }       
+                        if (usePOST) {
+                                rv = (*hcv1->setPostDataFcn)(sessionRequest,
+                                                          (char *)encodedRequest->data,
+                                                          encodedRequest->len,
+                                                          "application/ocsp-request");
+                                if (rv != SECSuccess) {
+                                        PKIX_ERROR(PKIX_OCSPSERVERERROR);
+                                }
+                        }
 
                         /* create a PKIX_PL_OcspResponse object */
                         PKIX_CHECK(PKIX_PL_Object_Alloc
                                     (PKIX_OCSPRESPONSE_TYPE,
                                     sizeof (PKIX_PL_OcspResponse),
                                     (PKIX_PL_Object **)&ocspResponse,
                                     plContext),
                                     PKIX_COULDNOTCREATEOBJECT);
 
                         PKIX_INCREF(request);
@@ skipping 321 matching lines @@
                     PORT_SetError(signature->failureReason);
                     goto cleanup;
                 }
             }
             
             response->signerCert = 
                 ocsp_GetSignerCertificate(response->handle, tbsData,
                                           signature, issuerCert);
             
             if (response->signerCert == NULL) {
-                PORT_SetError(SEC_ERROR_UNKNOWN_SIGNER);
+                if (PORT_GetError() == SEC_ERROR_UNKNOWN_CERT) {
+                    /* Make the error a little more specific. */
+                    PORT_SetError(SEC_ERROR_OCSP_INVALID_SIGNING_CERT);
+                }
                 goto cleanup;
-            }
-            
+            }            
             PKIX_CHECK( 
                 PKIX_PL_Cert_CreateFromCERTCertificate(response->signerCert,
                                                        &(response->pkixSignerCert),
                                                        plContext),
                 PKIX_CERTCREATEWITHNSSCERTFAILED);
             
             /*
              * We could mark this true at the top of this function, or
              * always below at "finish", but if the problem was just that
              * we could not find the signer's cert, leave that as if the
@@ skipping 116 matching lines @@
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns an OcspResponse Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 pkix_pl_OcspResponse_GetStatusForCert(
         PKIX_PL_OcspCertID *cid,
         PKIX_PL_OcspResponse *response,
+        PKIX_Boolean allowCachingOfFailures,
         PKIX_PL_Date *validity,
         PKIX_Boolean *pPassed,
         SECErrorCodes *pReturnCode,
         void *plContext)
 {
         PRTime time = 0;
         SECStatus rv = SECFailure;
-        SECStatus rvCache;
-        PRBool certIDWasConsumed = PR_FALSE;
+        CERTOCSPSingleResponse *single = NULL;
 
         PKIX_ENTER(OCSPRESPONSE, "pkix_pl_OcspResponse_GetStatusForCert");
         PKIX_NULLCHECK_THREE(response, pPassed, pReturnCode);
 
         /*
          * It is an error to call this function except following a successful
          * return from pkix_pl_OcspResponse_VerifySignature, which would have
          * set response->signerCert.
          */
         PKIX_NULLCHECK_TWO(response->signerCert, response->request);
         PKIX_NULLCHECK_TWO(cid, cid->certID);
 
         if (validity != NULL) {
             PKIX_Error *er = pkix_pl_Date_GetPRTime(validity, &time, plContext);
             PKIX_DECREF(er);
         }
         if (!time) {
             time = PR_Now();
         }
 
-        rv = cert_ProcessOCSPResponse(response->handle,
-                                      response->nssOCSPResponse,
-                                      cid->certID,
-                                      response->signerCert,
-                                      time,
-                                      &certIDWasConsumed,
-                                      &rvCache);
-        if (certIDWasConsumed) {
-                cid->certID = NULL;
+        rv = ocsp_GetVerifiedSingleResponseForCertID(response->handle,
+                                                     response->nssOCSPResponse,
+                                                     cid->certID, 
+                                                     response->signerCert,
+                                                     time, &single);
+        if (rv == SECSuccess) {
+                /*
+                 * Check whether the status says revoked, and if so 
+                 * how that compares to the time value passed into this routine.
+                 */
+                rv = ocsp_CertHasGoodStatus(single->certStatus, time);
+        }
+
+        if (rv == SECSuccess || allowCachingOfFailures) {
+                /* allowed to update the cache */
+                PRBool certIDWasConsumed = PR_FALSE;
+
+                if (single) {
+                        ocsp_CacheSingleResponse(cid->certID,single,
+                                                 &certIDWasConsumed);
+                } else {
+                        cert_RememberOCSPProcessingFailure(cid->certID,
+                                                           &certIDWasConsumed);
+                }
+
+                if (certIDWasConsumed) {
+                        cid->certID = NULL;
+                }
         }
 
         if (rv == SECSuccess) {
                 *pPassed = PKIX_TRUE;
                 *pReturnCode = 0;
         } else {
                 *pPassed = PKIX_FALSE;
                 *pReturnCode = PORT_GetError();
         }
 
         PKIX_RETURN(OCSPRESPONSE);
 }