OLD | NEW |
1 /* This Source Code Form is subject to the terms of the Mozilla Public | 1 /* This Source Code Form is subject to the terms of the Mozilla Public |
2 * License, v. 2.0. If a copy of the MPL was not distributed with this | 2 * License, v. 2.0. If a copy of the MPL was not distributed with this |
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
4 | 4 |
5 /* | 5 /* |
6 * Implementation of OCSP services, for both client and server. | 6 * Implementation of OCSP services, for both client and server. |
7 * (XXX, really, mostly just for client right now, but intended to do both.) | 7 * (XXX, really, mostly just for client right now, but intended to do both.) |
8 * | 8 * |
9 * $Id: ocsp.c,v 1.74.2.1 2012/12/12 16:38:39 wtc%google.com Exp $ | 9 * $Id: ocsp.c,v 1.77 2013/01/23 23:05:50 kaie%kuix.de Exp $ |
10 */ | 10 */ |
11 | 11 |
12 #include "prerror.h" | 12 #include "prerror.h" |
13 #include "prprf.h" | 13 #include "prprf.h" |
14 #include "plarena.h" | 14 #include "plarena.h" |
15 #include "prnetdb.h" | 15 #include "prnetdb.h" |
16 | 16 |
17 #include "seccomon.h" | 17 #include "seccomon.h" |
18 #include "secitem.h" | 18 #include "secitem.h" |
19 #include "secoidt.h" | 19 #include "secoidt.h" |
(...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
149 #define OCSP_TRACE(msg) ocsp_Trace msg | 149 #define OCSP_TRACE(msg) ocsp_Trace msg |
150 #define OCSP_TRACE_TIME(msg, time) ocsp_dumpStringWithTime(msg, time) | 150 #define OCSP_TRACE_TIME(msg, time) ocsp_dumpStringWithTime(msg, time) |
151 #define OCSP_TRACE_CERT(cert) dumpCertificate(cert) | 151 #define OCSP_TRACE_CERT(cert) dumpCertificate(cert) |
152 #define OCSP_TRACE_CERTID(certid) dumpCertID(certid) | 152 #define OCSP_TRACE_CERTID(certid) dumpCertID(certid) |
153 | 153 |
154 #if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS) \ | 154 #if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS) \ |
155 || defined(XP_MACOSX) | 155 || defined(XP_MACOSX) |
156 #define NSS_HAVE_GETENV 1 | 156 #define NSS_HAVE_GETENV 1 |
157 #endif | 157 #endif |
158 | 158 |
159 static PRBool wantOcspTrace() | 159 static PRBool wantOcspTrace(void) |
160 { | 160 { |
161 static PRBool firstTime = PR_TRUE; | 161 static PRBool firstTime = PR_TRUE; |
162 static PRBool wantTrace = PR_FALSE; | 162 static PRBool wantTrace = PR_FALSE; |
163 | 163 |
164 #ifdef NSS_HAVE_GETENV | 164 #ifdef NSS_HAVE_GETENV |
165 if (firstTime) { | 165 if (firstTime) { |
166 char *ev = getenv("NSS_TRACE_OCSP"); | 166 char *ev = getenv("NSS_TRACE_OCSP"); |
167 if (ev && ev[0]) { | 167 if (ev && ev[0]) { |
168 wantTrace = PR_TRUE; | 168 wantTrace = PR_TRUE; |
169 } | 169 } |
(...skipping 327 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
497 PR_ExitMonitor(OCSP_Global.monitor); | 497 PR_ExitMonitor(OCSP_Global.monitor); |
498 return; | 498 return; |
499 } | 499 } |
500 OCSP_TRACE(("OCSP ocsp_MakeCacheEntryMostRecent NEW entry\n")); | 500 OCSP_TRACE(("OCSP ocsp_MakeCacheEntryMostRecent NEW entry\n")); |
501 ocsp_RemoveCacheItemFromLinkedList(cache, new_most_recent); | 501 ocsp_RemoveCacheItemFromLinkedList(cache, new_most_recent); |
502 ocsp_AddCacheItemToLinkedList(cache, new_most_recent); | 502 ocsp_AddCacheItemToLinkedList(cache, new_most_recent); |
503 PR_ExitMonitor(OCSP_Global.monitor); | 503 PR_ExitMonitor(OCSP_Global.monitor); |
504 } | 504 } |
505 | 505 |
506 static PRBool | 506 static PRBool |
507 ocsp_IsCacheDisabled() | 507 ocsp_IsCacheDisabled(void) |
508 { | 508 { |
509 /* | 509 /* |
510 * maxCacheEntries == 0 means unlimited cache entries | 510 * maxCacheEntries == 0 means unlimited cache entries |
511 * maxCacheEntries < 0 means cache is disabled | 511 * maxCacheEntries < 0 means cache is disabled |
512 */ | 512 */ |
513 PRBool retval; | 513 PRBool retval; |
514 PR_EnterMonitor(OCSP_Global.monitor); | 514 PR_EnterMonitor(OCSP_Global.monitor); |
515 retval = (OCSP_Global.maxCacheEntries < 0); | 515 retval = (OCSP_Global.maxCacheEntries < 0); |
516 PR_ExitMonitor(OCSP_Global.monitor); | 516 PR_ExitMonitor(OCSP_Global.monitor); |
517 return retval; | 517 return retval; |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
585 */ | 585 */ |
586 while (cache->numberOfEntries > | 586 while (cache->numberOfEntries > |
587 (PRUint32)OCSP_Global.maxCacheEntries) { | 587 (PRUint32)OCSP_Global.maxCacheEntries) { |
588 ocsp_RemoveCacheItem(cache, cache->LRUitem); | 588 ocsp_RemoveCacheItem(cache, cache->LRUitem); |
589 } | 589 } |
590 } | 590 } |
591 PR_ExitMonitor(OCSP_Global.monitor); | 591 PR_ExitMonitor(OCSP_Global.monitor); |
592 } | 592 } |
593 | 593 |
594 SECStatus | 594 SECStatus |
595 CERT_ClearOCSPCache() | 595 CERT_ClearOCSPCache(void) |
596 { | 596 { |
597 OCSP_TRACE(("OCSP CERT_ClearOCSPCache\n")); | 597 OCSP_TRACE(("OCSP CERT_ClearOCSPCache\n")); |
598 PR_EnterMonitor(OCSP_Global.monitor); | 598 PR_EnterMonitor(OCSP_Global.monitor); |
599 while (OCSP_Global.cache.numberOfEntries > 0) { | 599 while (OCSP_Global.cache.numberOfEntries > 0) { |
600 ocsp_RemoveCacheItem(&OCSP_Global.cache, | 600 ocsp_RemoveCacheItem(&OCSP_Global.cache, |
601 OCSP_Global.cache.LRUitem); | 601 OCSP_Global.cache.LRUitem); |
602 } | 602 } |
603 PR_ExitMonitor(OCSP_Global.monitor); | 603 PR_ExitMonitor(OCSP_Global.monitor); |
604 return SECSuccess; | 604 return SECSuccess; |
605 } | 605 } |
(...skipping 340 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
946 | 946 |
947 PR_DestroyMonitor(OCSP_Global.monitor); | 947 PR_DestroyMonitor(OCSP_Global.monitor); |
948 OCSP_Global.monitor = NULL; | 948 OCSP_Global.monitor = NULL; |
949 return SECSuccess; | 949 return SECSuccess; |
950 } | 950 } |
951 | 951 |
952 /* | 952 /* |
953 * A return value of NULL means: | 953 * A return value of NULL means: |
954 * The application did not register it's own HTTP client. | 954 * The application did not register it's own HTTP client. |
955 */ | 955 */ |
956 const SEC_HttpClientFcn *SEC_GetRegisteredHttpClient() | 956 const SEC_HttpClientFcn *SEC_GetRegisteredHttpClient(void) |
957 { | 957 { |
958 const SEC_HttpClientFcn *retval; | 958 const SEC_HttpClientFcn *retval; |
959 | 959 |
960 if (!OCSP_Global.monitor) { | 960 if (!OCSP_Global.monitor) { |
961 PORT_SetError(SEC_ERROR_NOT_INITIALIZED); | 961 PORT_SetError(SEC_ERROR_NOT_INITIALIZED); |
962 return NULL; | 962 return NULL; |
963 } | 963 } |
964 | 964 |
965 PR_EnterMonitor(OCSP_Global.monitor); | 965 PR_EnterMonitor(OCSP_Global.monitor); |
966 retval = OCSP_Global.defaultHttpClientFcn; | 966 retval = OCSP_Global.defaultHttpClientFcn; |
(...skipping 966 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1933 PORT_ArenaUnmark(arena, mark); | 1933 PORT_ArenaUnmark(arena, mark); |
1934 requestList[1] = NULL; | 1934 requestList[1] = NULL; |
1935 return requestList; | 1935 return requestList; |
1936 | 1936 |
1937 loser: | 1937 loser: |
1938 PORT_ArenaRelease(arena, mark); | 1938 PORT_ArenaRelease(arena, mark); |
1939 return NULL; | 1939 return NULL; |
1940 } | 1940 } |
1941 | 1941 |
1942 static CERTOCSPRequest * | 1942 static CERTOCSPRequest * |
1943 ocsp_prepareEmptyOCSPRequest() | 1943 ocsp_prepareEmptyOCSPRequest(void) |
1944 { | 1944 { |
1945 PRArenaPool *arena = NULL; | 1945 PRArenaPool *arena = NULL; |
1946 CERTOCSPRequest *request = NULL; | 1946 CERTOCSPRequest *request = NULL; |
1947 ocspTBSRequest *tbsRequest = NULL; | 1947 ocspTBSRequest *tbsRequest = NULL; |
1948 | 1948 |
1949 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); | 1949 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
1950 if (arena == NULL) { | 1950 if (arena == NULL) { |
1951 goto loser; | 1951 goto loser; |
1952 } | 1952 } |
1953 request = PORT_ArenaZNew(arena, CERTOCSPRequest); | 1953 request = PORT_ArenaZNew(arena, CERTOCSPRequest); |
(...skipping 2725 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
4679 *rvOcsp = SECSuccess; | 4679 *rvOcsp = SECSuccess; |
4680 } | 4680 } |
4681 *missingResponseError = cacheItem->missingResponseError; | 4681 *missingResponseError = cacheItem->missingResponseError; |
4682 } | 4682 } |
4683 } | 4683 } |
4684 PR_ExitMonitor(OCSP_Global.monitor); | 4684 PR_ExitMonitor(OCSP_Global.monitor); |
4685 return rv; | 4685 return rv; |
4686 } | 4686 } |
4687 | 4687 |
4688 PRBool | 4688 PRBool |
4689 ocsp_FetchingFailureIsVerificationFailure() | 4689 ocsp_FetchingFailureIsVerificationFailure(void) |
4690 { | 4690 { |
4691 PRBool isFailure; | 4691 PRBool isFailure; |
4692 | 4692 |
4693 PR_EnterMonitor(OCSP_Global.monitor); | 4693 PR_EnterMonitor(OCSP_Global.monitor); |
4694 isFailure = | 4694 isFailure = |
4695 OCSP_Global.ocspFailureMode == ocspMode_FailureIsVerificationFailure; | 4695 OCSP_Global.ocspFailureMode == ocspMode_FailureIsVerificationFailure; |
4696 PR_ExitMonitor(OCSP_Global.monitor); | 4696 PR_ExitMonitor(OCSP_Global.monitor); |
4697 return isFailure; | 4697 return isFailure; |
4698 } | 4698 } |
4699 | 4699 |
(...skipping 984 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
5684 case ocspResponse_tryLater: | 5684 case ocspResponse_tryLater: |
5685 PORT_SetError(SEC_ERROR_OCSP_TRY_SERVER_LATER); | 5685 PORT_SetError(SEC_ERROR_OCSP_TRY_SERVER_LATER); |
5686 break; | 5686 break; |
5687 case ocspResponse_sigRequired: | 5687 case ocspResponse_sigRequired: |
5688 /* XXX We *should* retry with a signature, if possible. */ | 5688 /* XXX We *should* retry with a signature, if possible. */ |
5689 PORT_SetError(SEC_ERROR_OCSP_REQUEST_NEEDS_SIG); | 5689 PORT_SetError(SEC_ERROR_OCSP_REQUEST_NEEDS_SIG); |
5690 break; | 5690 break; |
5691 case ocspResponse_unauthorized: | 5691 case ocspResponse_unauthorized: |
5692 PORT_SetError(SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST); | 5692 PORT_SetError(SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST); |
5693 break; | 5693 break; |
5694 case ocspResponse_other: | |
5695 case ocspResponse_unused: | 5694 case ocspResponse_unused: |
5696 default: | 5695 default: |
5697 PORT_SetError(SEC_ERROR_OCSP_UNKNOWN_RESPONSE_STATUS); | 5696 PORT_SetError(SEC_ERROR_OCSP_UNKNOWN_RESPONSE_STATUS); |
5698 break; | 5697 break; |
5699 } | 5698 } |
5700 return SECFailure; | 5699 return SECFailure; |
5701 } | 5700 } |
OLD | NEW |