Update NSS to NSS_3_15_BETA2.

nss/lib/certhigh/ocspsig.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "plarena.h"
 
 #include "seccomon.h"
 #include "secitem.h"
 #include "secasn1.h"
 #include "secder.h"
@@ skipping 337 matching lines @@
     if (!arena || revocationReason) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
     cs = ocsp_CreateCertStatus(arena, ocspCertStatus_revoked, revocationTime);
     if (!cs)
         return NULL;
     return ocsp_CreateSingleResponse(arena, id, cs, thisUpdate, nextUpdate);
 }
 
+/* responderCert == 0 means:
+ * create a response with an invalid signature (for testing purposes) */
 SECItem*
 CERT_CreateEncodedOCSPSuccessResponse(
     PLArenaPool *arena,
     CERTCertificate *responderCert,
     CERTOCSPResponderIDType responderIDType,
     PRTime producedAt,
     CERTOCSPSingleResponse **responses,
     void *wincx)
 {
     PLArenaPool *tmpArena;
     ocspResponseData *rd = NULL;
     ocspResponderID *rid = NULL;
     const SEC_ASN1Template *responderIDTemplate = NULL;
     ocspBasicOCSPResponse *br = NULL;
     ocspResponseBytes *rb = NULL;
     CERTOCSPResponse *response = NULL;
     
     SECOidTag algID;
     SECOidData *od = NULL;
     SECKEYPrivateKey *privKey = NULL;
     SECItem *result = NULL;
   
-    if (!arena || !responderCert || !responses) {
+    if (!arena || !responses) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
     if (responderIDType != ocspResponderID_byName &&
         responderIDType != ocspResponderID_byKey) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
 
     tmpArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
@@ skipping 16 matching lines @@
     if (!response)
         goto done;
     
     rd->version.data=NULL;
     rd->version.len=0;
     rd->responseExtensions = NULL;
     rd->responses = responses;
     if (DER_TimeToGeneralizedTimeArena(tmpArena, &rd->producedAt, producedAt)
             != SECSuccess)
         goto done;
-    rid->responderIDType = responderIDType;
-    if (responderIDType == ocspResponderID_byName) {
-        responderIDTemplate = ocsp_ResponderIDByNameTemplate;
-        if (CERT_CopyName(tmpArena, &rid->responderIDValue.name,
-                           &responderCert->subject) != SECSuccess)
-            goto done;
+
+    if (!responderCert) {
+        /* use invalid signature for testing purposes */
+        unsigned char dummyChar = 'd';
+        SECItem dummy;
+
+        dummy.len = 1;
+        dummy.data = &dummyChar;
+
+        /* it's easier to produdce a keyHash out of nowhere,
+         * than to produce an encoded subject,
+         * so for our dummy response we always use byKey
+         */
+        
+        rid->responderIDType = ocspResponderID_byKey;
+        if (!ocsp_DigestValue(tmpArena, SEC_OID_SHA1, &rid->responderIDValue.keyHash,
+                              &dummy))
+            goto done;
+
+        if (!SEC_ASN1EncodeItem(tmpArena, &rd->derResponderID, rid,
+                                ocsp_ResponderIDByKeyTemplate))
+            goto done;
+
+        br->tbsResponseData = rd;
+
+        if (!SEC_ASN1EncodeItem(tmpArena, &br->tbsResponseDataDER, br->tbsResponseData,
+                                ocsp_myResponseDataTemplate))
+            goto done;
+
+        br->responseSignature.derCerts = PORT_ArenaNewArray(tmpArena, SECItem*, 1);
+        if (!br->responseSignature.derCerts)
+            goto done;
+        br->responseSignature.derCerts[0] = NULL;
+
+        algID = SEC_GetSignatureAlgorithmOidTag(rsaKey, SEC_OID_SHA1);
+        if (algID == SEC_OID_UNKNOWN)
+            goto done;
+
+        /* match the regular signature code, which doesn't use the arena */
+        if (!SECITEM_AllocItem(NULL, &br->responseSignature.signature, 1))
+            goto done;
+        PORT_Memcpy(br->responseSignature.signature.data, &dummyChar, 1);
+
+        /* convert len-in-bytes to len-in-bits */
+        br->responseSignature.signature.len = br->responseSignature.signature.len << 3;
     }
     else {
-        responderIDTemplate = ocsp_ResponderIDByKeyTemplate;
-        if (!CERT_GetSPKIDigest(tmpArena, responderCert, SEC_OID_SHA1,
-                                      &rid->responderIDValue.keyHash))
-            goto done;
+        rid->responderIDType = responderIDType;
+        if (responderIDType == ocspResponderID_byName) {
+            responderIDTemplate = ocsp_ResponderIDByNameTemplate;
+            if (CERT_CopyName(tmpArena, &rid->responderIDValue.name,
+                            &responderCert->subject) != SECSuccess)
+                goto done;
+        }
+        else {
+            responderIDTemplate = ocsp_ResponderIDByKeyTemplate;
+            if (!CERT_GetSPKIDigest(tmpArena, responderCert, SEC_OID_SHA1,
+                                        &rid->responderIDValue.keyHash))
+                goto done;
+        }
+
+        if (!SEC_ASN1EncodeItem(tmpArena, &rd->derResponderID, rid,
+                responderIDTemplate))
+            goto done;
+
+        br->tbsResponseData = rd;
+
+        if (!SEC_ASN1EncodeItem(tmpArena, &br->tbsResponseDataDER, br->tbsResponseData,
+                ocsp_myResponseDataTemplate))
+            goto done;
+
+        br->responseSignature.derCerts = PORT_ArenaNewArray(tmpArena, SECItem*, 1);
+        if (!br->responseSignature.derCerts)
+            goto done;
+        br->responseSignature.derCerts[0] = NULL;
+
+        privKey = PK11_FindKeyByAnyCert(responderCert, wincx);
+        if (!privKey)
+            goto done;
+
+        algID = SEC_GetSignatureAlgorithmOidTag(privKey->keyType, SEC_OID_SHA1);
+        if (algID == SEC_OID_UNKNOWN)
+            goto done;
+
+        if (SEC_SignData(&br->responseSignature.signature,
+                            br->tbsResponseDataDER.data, br->tbsResponseDataDER.len,
+                            privKey, algID)
+                != SECSuccess)
+            goto done;
+
+        /* convert len-in-bytes to len-in-bits */
+        br->responseSignature.signature.len = br->responseSignature.signature.len << 3;
+
+        /* br->responseSignature.signature wasn't allocated from arena,
+        * we must free it when done. */
     }
 
-    if (!SEC_ASN1EncodeItem(tmpArena, &rd->derResponderID, rid,
-            responderIDTemplate))
-        goto done;
-
-    br->tbsResponseData = rd;
-    
-    if (!SEC_ASN1EncodeItem(tmpArena, &br->tbsResponseDataDER, br->tbsResponseData,
-            ocsp_myResponseDataTemplate))
-        goto done;
-
-    br->responseSignature.derCerts = PORT_ArenaNewArray(tmpArena, SECItem*, 1);
-    if (!br->responseSignature.derCerts)
-        goto done;
-    br->responseSignature.derCerts[0] = NULL;
-
-    privKey = PK11_FindKeyByAnyCert(responderCert, wincx);
-    if (!privKey)
-        goto done;
-
-    algID = SEC_GetSignatureAlgorithmOidTag(privKey->keyType, SEC_OID_SHA1);
-    if (algID == SEC_OID_UNKNOWN)
-        goto done;
-
-    if (SEC_SignData(&br->responseSignature.signature,
-                        br->tbsResponseDataDER.data, br->tbsResponseDataDER.len,
-                        privKey, algID)
-            != SECSuccess)
-        goto done;
-
-    /* convert len-in-bytes to len-in-bits */
-    br->responseSignature.signature.len = br->responseSignature.signature.len << 3;
-
-    /* br->responseSignature.signature wasn't allocated from arena,
-     * we must free it when done. */
-
     if (SECOID_SetAlgorithmID(tmpArena, &br->responseSignature.signatureAlgorithm, algID, 0)
-            != SECSuccess)
-        goto done;
+            != SECSuccess)
+        goto done;
 
     if (!SEC_ASN1EncodeItem(tmpArena, &rb->response, br,
                             ocsp_EncodeBasicOCSPResponseTemplate))
         goto done;
 
     rb->responseTypeTag = SEC_OID_PKIX_OCSP_BASIC_RESPONSE;
 
     od = SECOID_FindOIDByTag(rb->responseTypeTag);
     if (!od)
         goto done;
@@ skipping 62 matching lines @@
                                response.statusValue))
         return NULL;
 
     result = SEC_ASN1EncodeItem(arena, NULL, &response,
                                 ocsp_OCSPErrorResponseTemplate);
 
     SECITEM_FreeItem(&response.responseStatus, PR_FALSE);
 
     return result;
 }