Merge NSS_3_14_2_RTM.

mozilla/security/nss/lib/certhigh/certvfy.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nspr.h"
 #include "secerr.h"
 #include "secport.h"
 #include "seccomon.h"
 #include "secoid.h"
 #include "sslerr.h"
 #include "genname.h"
@@ skipping 353 matching lines @@
     int pathLengthLimit = CERT_UNLIMITED_PATH_CONSTRAINT;
     unsigned int caCertType;
     unsigned int requiredCAKeyUsage;
     unsigned int requiredFlags;
     PRArenaPool *arena = NULL;
     CERTGeneralName *namesList = NULL;
     CERTCertificate **certsList      = NULL;
     int certsListLen = 16;
     int namesCount = 0;
     PRBool subjectCertIsSelfIssued;
+    CERTCertTrust issuerTrust;
 
     if (revoked) {
         *revoked = PR_FALSE;
     }
 
     if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
                                          &requiredCAKeyUsage,
                                          &caCertType)
         != SECSuccess ) {
         PORT_Assert(0);
@@ skipping 180 matching lines @@
              * error to the user, but the user may wish to continue
              * processing, in which case we better make sure nothing
              * worse has happened... so keep cranking the loop */
             rvFinal = SECFailure;
             if (revoked) {
                 *revoked = PR_TRUE;
             }
             LOG_ERROR(log,subjectCert,count,0);
         }
 
-        if ( issuerCert->trust ) {
+        if ( CERT_GetCertTrust(issuerCert, &issuerTrust) == SECSuccess) {
             /* we have some trust info, but this does NOT imply that this
              * cert is actually trusted for any purpose.  The cert may be
              * explicitly UNtrusted.  We won't know until we examine the
              * trust bits.
              */
             unsigned int flags;
 
             if (certUsage != certUsageAnyCA &&
                 certUsage != certUsageStatusResponder) {
 
                 /*
                  * XXX This choice of trustType seems arbitrary.
                  */
                 if ( certUsage == certUsageVerifyCA ) {
                     if ( subjectCert->nsCertType & NS_CERT_TYPE_EMAIL_CA ) {
                         trustType = trustEmail;
                     } else if ( subjectCert->nsCertType & NS_CERT_TYPE_SSL_CA ) {
                         trustType = trustSSL;
                     } else {
                         trustType = trustObjectSigning;
                     }
                 }
 
-                flags = SEC_GET_TRUST_FLAGS(issuerCert->trust, trustType);
+                flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
                 if (( flags & requiredFlags ) == requiredFlags) {
                     /* we found a trusted one, so return */
                     rv = rvFinal; 
                     goto done;
                 }
                 if (flags & CERTDB_VALID_CA) {
                     validCAOverride = PR_TRUE;
                 }
                 /* is it explicitly distrusted? */
                 if ((flags & CERTDB_TERMINAL_RECORD) && 
                         ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0)) {
                     /* untrusted -- the cert is explicitly untrusted, not
                      * just that it doesn't chain to a trusted cert */
                     PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
                     LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
                 }
             } else {
                 /* Check if we have any valid trust when cheching for
                  * certUsageAnyCA or certUsageStatusResponder. */
                 for (trustType = trustSSL; trustType < trustTypeNone;
                      trustType++) {
-                    flags = SEC_GET_TRUST_FLAGS(issuerCert->trust, trustType);
+                    flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
                     if ((flags & requiredFlags) == requiredFlags) {
                         rv = rvFinal; 
                         goto done;
                     }
                     if (flags & CERTDB_VALID_CA)
                         validCAOverride = PR_TRUE;
                 }
                 /* We have 2 separate loops because we want any single trust
                  * bit to allow this usage to return trusted. Only if none of
                  * the trust bits are on do we check to see if the cert is 
                  * untrusted */
                 for (trustType = trustSSL; trustType < trustTypeNone;
                      trustType++) {
-                    flags = SEC_GET_TRUST_FLAGS(issuerCert->trust, trustType);
+                    flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
                     /* is it explicitly distrusted? */
                     if ((flags & CERTDB_TERMINAL_RECORD) && 
                         ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0)) {
                         /* untrusted -- the cert is explicitly untrusted, not
                          * just that it doesn't chain to a trusted cert */
                         PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
                         LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
                     }
                 }
             }
@@ skipping 120 matching lines @@
     CERTBasicConstraints basicConstraint;
     PRBool isca;
     PRBool validCAOverride = PR_FALSE;
     SECStatus rv;
     SECStatus rvFinal = SECSuccess;
     unsigned int flags;
     unsigned int caCertType;
     unsigned int requiredCAKeyUsage;
     unsigned int requiredFlags;
     CERTCertificate *issuerCert;
+    CERTCertTrust certTrust;
 
 
     if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
                                          &requiredCAKeyUsage,
                                          &caCertType) != SECSuccess ) {
         PORT_Assert(0);
         EXIT_IF_NOT_LOGGING(log);
         requiredCAKeyUsage = 0;
         caCertType = 0;
     }
@@ skipping 45 matching lines @@
     } else  {
         if ( basicConstraint.isCA == PR_FALSE ) {
             PORT_SetError (SEC_ERROR_CA_CERT_INVALID);
             LOG_ERROR_OR_EXIT(log,cert,0,0);
         }
 
         /* can't check path length if we don't know the previous path */
         isca = PR_TRUE;
     }
         
-    if ( cert->trust ) {
+    if ( CERT_GetCertTrust(cert, &certTrust) == SECSuccess ) {
         /* we have some trust info, but this does NOT imply that this
          * cert is actually trusted for any purpose.  The cert may be
          * explicitly UNtrusted.  We won't know until we examine the
          * trust bits.
          */
         if (certUsage == certUsageStatusResponder) {
             /* Check the special case of certUsageStatusResponder */
             issuerCert = CERT_FindCertIssuer(cert, t, certUsage);
             if (issuerCert) {
                 if (SEC_CheckCRL(handle, cert, issuerCert, t, wincx) 
                     != SECSuccess) {
                     PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE);
                     CERT_DestroyCertificate(issuerCert);
                     goto loser;
                 }
                 CERT_DestroyCertificate(issuerCert);
             }
             /* XXX We have NOT determined that this cert is trusted.
              * For years, NSS has treated this as trusted, 
              * but it seems incorrect.
              */
             rv = rvFinal; 
             goto done;
         }
 
         /*
          * check the trust params of the issuer
          */
-        flags = SEC_GET_TRUST_FLAGS(cert->trust, trustType);
+        flags = SEC_GET_TRUST_FLAGS(&certTrust, trustType);
         if ( ( flags & requiredFlags ) == requiredFlags) {
             /* we found a trusted one, so return */
             rv = rvFinal; 
             goto done;
         }
         if (flags & CERTDB_VALID_CA) {
             validCAOverride = PR_TRUE;
         }
         /* is it explicitly distrusted? */
         if ((flags & CERTDB_TERMINAL_RECORD) && 
@@ skipping 71 matching lines @@
  *   returns success if the cert is not distrusted. If the cert is
  *       trusted, then the trusted bool will be true.
  *   returns failure if the cert is distrusted. If failure, flags
  *       will return the flag bits that indicated distrust.
  */
 SECStatus
 cert_CheckLeafTrust(CERTCertificate *cert, SECCertUsage certUsage,
                     unsigned int *failedFlags, PRBool *trusted)
 {
     unsigned int flags;
+    CERTCertTrust trust;
 
     *failedFlags = 0;
     *trusted = PR_FALSE;
                         
     /* check trust flags to see if this cert is directly trusted */
-    if ( cert->trust ) { 
+    if ( CERT_GetCertTrust(cert, &trust) == SECSuccess ) { 
         switch ( certUsage ) {
           case certUsageSSLClient:
           case certUsageSSLServer:
-            flags = cert->trust->sslFlags;
+            flags = trust.sslFlags;
             
             /* is the cert directly trusted or not trusted ? */
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
                     *trusted = PR_TRUE;
                     return SECSuccess;
                 } else { /* don't trust this cert */
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             break;
           case certUsageSSLServerWithStepUp:
             /* XXX - step up certs can't be directly trusted, only distrust */
-            flags = cert->trust->sslFlags;
+            flags = trust.sslFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if (( flags & CERTDB_TRUSTED ) == 0) {  
                     /* don't trust this cert */
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             break;
           case certUsageSSLCA:
-            flags = cert->trust->sslFlags;
+            flags = trust.sslFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if (( flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA) ) == 0) {      
                     /* don't trust this cert */
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             break;
           case certUsageEmailSigner:
           case certUsageEmailRecipient:
-            flags = cert->trust->emailFlags;
+            flags = trust.emailFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
                     *trusted = PR_TRUE;
                     return SECSuccess;
                 } 
                 else { /* don't trust this cert */
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             
             break;
           case certUsageObjectSigner:
-            flags = cert->trust->objectSigningFlags;
+            flags = trust.objectSigningFlags;
 
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
                     *trusted = PR_TRUE;
                     return SECSuccess;
                 } else { /* don't trust this cert */
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             break;
           case certUsageVerifyCA:
           case certUsageStatusResponder:
-            flags = cert->trust->sslFlags;
+            flags = trust.sslFlags;
             /* is the cert directly trusted or not trusted ? */
             if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
                 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
                 *trusted = PR_TRUE;
                 return SECSuccess;
             }
-            flags = cert->trust->emailFlags;
+            flags = trust.emailFlags;
             /* is the cert directly trusted or not trusted ? */
             if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
                 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
                 *trusted = PR_TRUE;
                 return SECSuccess;
             }
-            flags = cert->trust->objectSigningFlags;
+            flags = trust.objectSigningFlags;
             /* is the cert directly trusted or not trusted ? */
             if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
                 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
                 *trusted = PR_TRUE;
                 return SECSuccess;
             }
             /* fall through to test distrust */
           case certUsageAnyCA:
           case certUsageUserCertImport:
             /* do we distrust these certs explicitly */
-            flags = cert->trust->sslFlags;
+            flags = trust.sslFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
-            flags = cert->trust->emailFlags;
+            flags = trust.emailFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             /* fall through */
           case certUsageProtectedObjectSigner:
-            flags = cert->trust->objectSigningFlags;
+            flags = trust.objectSigningFlags;
             if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is 
                                                     * authoritative */
                 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
                     *failedFlags = flags;
                     return SECFailure;
                 }
             }
             break;
         }
     }
@@ skipping 330 matching lines @@
  *      certUsageObjectSigner
  */
 
 CERTCertificate *
 CERT_FindMatchingCert(CERTCertDBHandle *handle, SECItem *derName,
                       CERTCertOwner owner, SECCertUsage usage,
                       PRBool preferTrusted, int64 validTime, PRBool validOnly)
 {
     CERTCertList *certList = NULL;
     CERTCertificate *cert = NULL;
+    CERTCertTrust certTrust;
     unsigned int requiredTrustFlags;
     SECTrustType requiredTrustType;
     unsigned int flags;
     
     PRBool lookingForCA = PR_FALSE;
     SECStatus rv;
     CERTCertListNode *node;
     CERTCertificate *saveUntrustedCA = NULL;
     
     /* if preferTrusted is set, must be a CA cert */
@@ skipping 21 matching lines @@
         
         node = CERT_LIST_HEAD(certList);
         
         while ( !CERT_LIST_END(node, certList) ) {
             cert = node->cert;
 
             /* looking for a trusted CA cert */
             if ( ( owner == certOwnerCA ) && preferTrusted &&
                 ( requiredTrustType != trustTypeNone ) ) {
 
-                if ( cert->trust == NULL ) {
+                if ( CERT_GetCertTrust(cert, &certTrust) != SECSuccess ) {
                     flags = 0;
                 } else {
-                    flags = SEC_GET_TRUST_FLAGS(cert->trust, requiredTrustType);
+                    flags = SEC_GET_TRUST_FLAGS(&certTrust, requiredTrustType);
                 }
 
                 if ( ( flags & requiredTrustFlags ) != requiredTrustFlags ) {
                     /* cert is not trusted */
                     /* if this is the first cert to get this far, then save
                      * it, so we can use it if we can't find a trusted one
                      */
                     if ( saveUntrustedCA == NULL ) {
                         saveUntrustedCA = cert;
                     }
@@ skipping 371 matching lines @@
             return chain;
         }
 
         cert = CERT_FindCertIssuer(cert, time, usage);
     }
 
     /* return partial chain */
     PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
     return chain;
 }