Change SSL_PeerCertificateChain to return a CERTCertList.

net/third_party/nss/ssl/sslauth.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "cert.h"
 #include "secitem.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "pk11func.h"
 #include "ocsp.h"
@@ skipping 10 matching lines @@
                  SSL_GETPID(), fd));
         return 0;
     }
     if (ss->opt.useSecurity && ss->sec.peerCert) {
         return CERT_DupCertificate(ss->sec.peerCert);
     }
     return 0;
 }
 
 /* NEED LOCKS IN HERE.  */
-SECStatus
-SSL_PeerCertificateChain(PRFileDesc *fd, CERTCertificate **certs,
-                         unsigned int *numCerts, unsigned int maxNumCerts)
+CERTCertList *
+SSL_PeerCertificateChain(PRFileDesc *fd)
 {
     sslSocket *ss;
+    CERTCertList *chain = NULL;
     ssl3CertNode* cur;
 
     ss = ssl_FindSocket(fd);
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificateChain",
                  SSL_GETPID(), fd));
-        return SECFailure;
+        return NULL;
     }
-    if (!ss->opt.useSecurity)
-        return SECFailure;
+    if (!ss->opt.useSecurity || !ss->sec.peerCert) {
+        PORT_SetError(SSL_ERROR_NO_CERTIFICATE);

[wtc, 2013/09/27 23:49:41]

SSL_ERROR_NO_CERTIFICATE seems to be intended for the SSLv3 no_certificate alert
error. I am overloading this error code.

+        return chain;
+    }
+    chain = CERT_NewCertList();
+    if (!chain) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+    if (CERT_AddCertToListTail(chain, ss->sec.peerCert) != SECSuccess) {
+        goto loser;
+    }
+    for (cur = ss->ssl3.peerCertChain; cur; cur = cur->next) {
+        if (CERT_AddCertToListTail(chain, cur->cert) != SECSuccess) {
+            goto loser;
+        }
+    }
+    return chain;
 
-    if (ss->sec.peerCert == NULL) {
-      *numCerts = 0;
-      return SECSuccess;
-    }
-
-    *numCerts = 1;  /* for the leaf certificate */
-    if (maxNumCerts > 0)
-        certs[0] = CERT_DupCertificate(ss->sec.peerCert);
-
-    for (cur = ss->ssl3.peerCertChain; cur; cur = cur->next) {
-        if (*numCerts < maxNumCerts)
-            certs[*numCerts] = CERT_DupCertificate(cur->cert);
-        (*numCerts)++;
-    }
-
-    return SECSuccess;
+loser:
+    CERT_DestroyCertList(chain);
+    PORT_SetError(SEC_ERROR_NO_MEMORY);
+    return NULL;
 }
 
 /* NEED LOCKS IN HERE.  */
 CERTCertificate *
 SSL_LocalCertificate(PRFileDesc *fd)
 {
     sslSocket *ss;
 
     ss = ssl_FindSocket(fd);
     if (!ss) {
@@ skipping 250 matching lines @@
     hostname = ss->url;
     if (hostname && hostname[0])
         rv = CERT_VerifyCertName(ss->sec.peerCert, hostname);
     else 
         rv = SECFailure;
     if (rv != SECSuccess)
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
 
     return rv;
 }