gecko-dev/security/nss/lib/pki/pkistore.c

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef PKIM_H
#include "pkim.h"
#endif /* PKIM_H */

#ifndef PKI_H
#include "pki.h"
#endif /* PKI_H */

#ifndef NSSPKI_H
#include "nsspki.h"
#endif /* NSSPKI_H */

#ifndef BASE_H
#include "base.h"
#endif /* BASE_H */

#ifndef PKISTORE_H
#include "pkistore.h"
#endif /* PKISTORE_H */

#include "cert.h"
#include "pki3hack.h"

#include "prbit.h"

/*
 * Certificate Store
 *
 * This differs from the cache in that it is a true storage facility.  Items
 * stay in until they are explicitly removed.  It is only used by crypto
 * contexts at this time, but may be more generally useful...
 *
 */

struct nssCertificateStoreStr {
    PRBool i_alloced_arena;
    NSSArena *arena;
    PZLock *lock;
    nssHash *subject;
    nssHash *issuer_and_serial;
};

typedef struct certificate_hash_entry_str certificate_hash_entry;

struct certificate_hash_entry_str {
    NSSCertificate *cert;
    NSSTrust *trust;
    nssSMIMEProfile *profile;
};

/* forward static declarations */
static NSSCertificate *
nssCertStore_FindCertByIssuerAndSerialNumberLocked(
    nssCertificateStore *store,
    NSSDER *issuer,
    NSSDER *serial);

NSS_IMPLEMENT nssCertificateStore *
nssCertificateStore_Create(NSSArena *arenaOpt)
{
    NSSArena *arena;
    nssCertificateStore *store;
    PRBool i_alloced_arena;
    if (arenaOpt) {
        arena = arenaOpt;
        i_alloced_arena = PR_FALSE;
    } else {
        arena = nssArena_Create();
        if (!arena) {
            return NULL;
        }
        i_alloced_arena = PR_TRUE;
    }
    store = nss_ZNEW(arena, nssCertificateStore);
    if (!store) {
        goto loser;
    }
    store->lock = PZ_NewLock(nssILockOther);
    if (!store->lock) {
        goto loser;
    }
    /* Create the issuer/serial --> {cert, trust, S/MIME profile } hash */
    store->issuer_and_serial = nssHash_CreateCertificate(arena, 0);
    if (!store->issuer_and_serial) {
        goto loser;
    }
    /* Create the subject DER --> subject list hash */
    store->subject = nssHash_CreateItem(arena, 0);
    if (!store->subject) {
        goto loser;
    }
    store->arena = arena;
    store->i_alloced_arena = i_alloced_arena;
    return store;
loser:
    if (store) {
        if (store->lock) {
            PZ_DestroyLock(store->lock);
        }
        if (store->issuer_and_serial) {
            nssHash_Destroy(store->issuer_and_serial);
        }
        if (store->subject) {
            nssHash_Destroy(store->subject);
        }
    }
    if (i_alloced_arena) {
        nssArena_Destroy(arena);
    }
    return NULL;
}

extern const NSSError NSS_ERROR_BUSY;

NSS_IMPLEMENT PRStatus
nssCertificateStore_Destroy(nssCertificateStore *store)
{
    if (nssHash_Count(store->issuer_and_serial) > 0) {
        nss_SetError(NSS_ERROR_BUSY);
        return PR_FAILURE;
    }
    PZ_DestroyLock(store->lock);
    nssHash_Destroy(store->issuer_and_serial);
    nssHash_Destroy(store->subject);
    if (store->i_alloced_arena) {
        nssArena_Destroy(store->arena);
    } else {
        nss_ZFreeIf(store);
    }
    return PR_SUCCESS;
}

static PRStatus
add_certificate_entry(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    PRStatus nssrv;
    certificate_hash_entry *entry;
    entry = nss_ZNEW(cert->object.arena, certificate_hash_entry);
    if (!entry) {
        return PR_FAILURE;
    }
    entry->cert = cert;
    nssrv = nssHash_Add(store->issuer_and_serial, cert, entry);
    if (nssrv != PR_SUCCESS) {
        nss_ZFreeIf(entry);
    }
    return nssrv;
}

static PRStatus
add_subject_entry(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    PRStatus nssrv;
    nssList *subjectList;
    subjectList = (nssList *)nssHash_Lookup(store->subject, &cert->subject);
    if (subjectList) {
        /* The subject is already in, add this cert to the list */
        nssrv = nssList_AddUnique(subjectList, cert);
    } else {
        /* Create a new subject list for the subject */
        subjectList = nssList_Create(NULL, PR_FALSE);
        if (!subjectList) {
            return PR_FAILURE;
        }
        nssList_SetSortFunction(subjectList, nssCertificate_SubjectListSort);
        /* Add the cert entry to this list of subjects */
        nssrv = nssList_Add(subjectList, cert);
        if (nssrv != PR_SUCCESS) {
            return nssrv;
        }
        /* Add the subject list to the cache */
        nssrv = nssHash_Add(store->subject, &cert->subject, subjectList);
    }
    return nssrv;
}

/* declared below */
static void
remove_certificate_entry(
    nssCertificateStore *store,
    NSSCertificate *cert);

/* Caller must hold store->lock */
static PRStatus
nssCertificateStore_AddLocked(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    PRStatus nssrv = add_certificate_entry(store, cert);
    if (nssrv == PR_SUCCESS) {
        nssrv = add_subject_entry(store, cert);
        if (nssrv == PR_FAILURE) {
            remove_certificate_entry(store, cert);
        }
    }
    return nssrv;
}

NSS_IMPLEMENT NSSCertificate *
nssCertificateStore_FindOrAdd(
    nssCertificateStore *store,
    NSSCertificate *c)
{
    PRStatus nssrv;
    NSSCertificate *rvCert = NULL;

    PZ_Lock(store->lock);
    rvCert = nssCertStore_FindCertByIssuerAndSerialNumberLocked(
        store, &c->issuer, &c->serial);
    if (!rvCert) {
        nssrv = nssCertificateStore_AddLocked(store, c);
        if (PR_SUCCESS == nssrv) {
            rvCert = nssCertificate_AddRef(c);
        }
    }
    PZ_Unlock(store->lock);
    return rvCert;
}

static void
remove_certificate_entry(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    certificate_hash_entry *entry;
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry) {
        nssHash_Remove(store->issuer_and_serial, cert);
        if (entry->trust) {
            nssTrust_Destroy(entry->trust);
        }
        if (entry->profile) {
            nssSMIMEProfile_Destroy(entry->profile);
        }
        nss_ZFreeIf(entry);
    }
}

static void
remove_subject_entry(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    nssList *subjectList;
    /* Get the subject list for the cert's subject */
    subjectList = (nssList *)nssHash_Lookup(store->subject, &cert->subject);
    if (subjectList) {
        /* Remove the cert from the subject hash */
        nssList_Remove(subjectList, cert);
        nssHash_Remove(store->subject, &cert->subject);
        if (nssList_Count(subjectList) == 0) {
            nssList_Destroy(subjectList);
        } else {
            /* The cert being released may have keyed the subject entry.
             * Since there are still subject certs around, get another and
             * rekey the entry just in case.
             */
            NSSCertificate *subjectCert;
            (void)nssList_GetArray(subjectList, (void **)&subjectCert, 1);
            nssHash_Add(store->subject, &subjectCert->subject, subjectList);
        }
    }
}

NSS_IMPLEMENT void
nssCertificateStore_RemoveCertLOCKED(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    certificate_hash_entry *entry;
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry && entry->cert == cert) {
        remove_certificate_entry(store, cert);
        remove_subject_entry(store, cert);
    }
}

NSS_IMPLEMENT void
nssCertificateStore_Lock(nssCertificateStore *store, nssCertificateStoreTrace *out)
{
#ifdef DEBUG
    PORT_Assert(out);
    out->store = store;
    out->lock = store->lock;
    out->locked = PR_TRUE;
    PZ_Lock(out->lock);
#else
    PZ_Lock(store->lock);
#endif
}

NSS_IMPLEMENT void
nssCertificateStore_Unlock(
    nssCertificateStore *store, const nssCertificateStoreTrace *in,
    nssCertificateStoreTrace *out)
{
#ifdef DEBUG
    PORT_Assert(in);
    PORT_Assert(out);
    out->store = store;
    out->lock = store->lock;
    PORT_Assert(!out->locked);
    out->unlocked = PR_TRUE;

    PORT_Assert(in->store == out->store);
    PORT_Assert(in->lock == out->lock);
    PORT_Assert(in->locked);
    PORT_Assert(!in->unlocked);

    PZ_Unlock(out->lock);
#else
    PZ_Unlock(store->lock);
#endif
}

static NSSCertificate **
get_array_from_list(
    nssList *certList,
    NSSCertificate *rvOpt[],
    PRUint32 maximumOpt,
    NSSArena *arenaOpt)
{
    PRUint32 count;
    NSSCertificate **rvArray = NULL;
    count = nssList_Count(certList);
    if (count == 0) {
        return NULL;
    }
    if (maximumOpt > 0) {
        count = PR_MIN(maximumOpt, count);
    }
    if (rvOpt) {
        nssList_GetArray(certList, (void **)rvOpt, count);
    } else {
        rvArray = nss_ZNEWARRAY(arenaOpt, NSSCertificate *, count + 1);
        if (rvArray) {
            nssList_GetArray(certList, (void **)rvArray, count);
        }
    }
    return rvArray;
}

NSS_IMPLEMENT NSSCertificate **
nssCertificateStore_FindCertificatesBySubject(
    nssCertificateStore *store,
    NSSDER *subject,
    NSSCertificate *rvOpt[],
    PRUint32 maximumOpt,
    NSSArena *arenaOpt)
{
    NSSCertificate **rvArray = NULL;
    nssList *subjectList;
    PZ_Lock(store->lock);
    subjectList = (nssList *)nssHash_Lookup(store->subject, subject);
    if (subjectList) {
        nssCertificateList_AddReferences(subjectList);
        rvArray = get_array_from_list(subjectList,
                                      rvOpt, maximumOpt, arenaOpt);
    }
    PZ_Unlock(store->lock);
    return rvArray;
}

/* Because only subject indexing is implemented, all other lookups require
 * full traversal (unfortunately, PLHashTable doesn't allow you to exit
 * early from the enumeration).  The assumptions are that 1) lookups by
 * fields other than subject will be rare, and 2) the hash will not have
 * a large number of entries.  These assumptions will be tested.
 *
 * XXX
 * For NSS 3.4, it is worth consideration to do all forms of indexing,
 * because the only crypto context is global and persistent.
 */

struct nickname_template_str {
    NSSUTF8 *nickname;
    nssList *subjectList;
};

static void
match_nickname(const void *k, void *v, void *a)
{
    PRStatus nssrv;
    NSSCertificate *c;
    NSSUTF8 *nickname;
    nssList *subjectList = (nssList *)v;
    struct nickname_template_str *nt = (struct nickname_template_str *)a;
    nssrv = nssList_GetArray(subjectList, (void **)&c, 1);
    nickname = nssCertificate_GetNickname(c, NULL);
    if (nssrv == PR_SUCCESS && nickname &&
        nssUTF8_Equal(nickname, nt->nickname, &nssrv)) {
        nt->subjectList = subjectList;
    }
    nss_ZFreeIf(nickname);
}

/*
 * Find all cached certs with this label.
 */
NSS_IMPLEMENT NSSCertificate **
nssCertificateStore_FindCertificatesByNickname(
    nssCertificateStore *store,
    const NSSUTF8 *nickname,
    NSSCertificate *rvOpt[],
    PRUint32 maximumOpt,
    NSSArena *arenaOpt)
{
    NSSCertificate **rvArray = NULL;
    struct nickname_template_str nt;
    nt.nickname = (char *)nickname;
    nt.subjectList = NULL;
    PZ_Lock(store->lock);
    nssHash_Iterate(store->subject, match_nickname, &nt);
    if (nt.subjectList) {
        nssCertificateList_AddReferences(nt.subjectList);
        rvArray = get_array_from_list(nt.subjectList,
                                      rvOpt, maximumOpt, arenaOpt);
    }
    PZ_Unlock(store->lock);
    return rvArray;
}

struct email_template_str {
    NSSASCII7 *email;
    nssList *emailList;
};

static void
match_email(const void *k, void *v, void *a)
{
    PRStatus nssrv;
    NSSCertificate *c;
    nssList *subjectList = (nssList *)v;
    struct email_template_str *et = (struct email_template_str *)a;
    nssrv = nssList_GetArray(subjectList, (void **)&c, 1);
    if (nssrv == PR_SUCCESS &&
        nssUTF8_Equal(c->email, et->email, &nssrv)) {
        nssListIterator *iter = nssList_CreateIterator(subjectList);
        if (iter) {
            for (c = (NSSCertificate *)nssListIterator_Start(iter);
                 c != (NSSCertificate *)NULL;
                 c = (NSSCertificate *)nssListIterator_Next(iter)) {
                nssList_Add(et->emailList, c);
            }
            nssListIterator_Finish(iter);
            nssListIterator_Destroy(iter);
        }
    }
}

/*
 * Find all cached certs with this email address.
 */
NSS_IMPLEMENT NSSCertificate **
nssCertificateStore_FindCertificatesByEmail(
    nssCertificateStore *store,
    NSSASCII7 *email,
    NSSCertificate *rvOpt[],
    PRUint32 maximumOpt,
    NSSArena *arenaOpt)
{
    NSSCertificate **rvArray = NULL;
    struct email_template_str et;
    et.email = email;
    et.emailList = nssList_Create(NULL, PR_FALSE);
    if (!et.emailList) {
        return NULL;
    }
    PZ_Lock(store->lock);
    nssHash_Iterate(store->subject, match_email, &et);
    if (et.emailList) {
        /* get references before leaving the store's lock protection */
        nssCertificateList_AddReferences(et.emailList);
    }
    PZ_Unlock(store->lock);
    if (et.emailList) {
        rvArray = get_array_from_list(et.emailList,
                                      rvOpt, maximumOpt, arenaOpt);
        nssList_Destroy(et.emailList);
    }
    return rvArray;
}

/* Caller holds store->lock */
static NSSCertificate *
nssCertStore_FindCertByIssuerAndSerialNumberLocked(
    nssCertificateStore *store,
    NSSDER *issuer,
    NSSDER *serial)
{
    certificate_hash_entry *entry;
    NSSCertificate *rvCert = NULL;
    NSSCertificate index;

    index.issuer = *issuer;
    index.serial = *serial;
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, &index);
    if (entry) {
        rvCert = nssCertificate_AddRef(entry->cert);
    }
    return rvCert;
}

NSS_IMPLEMENT NSSCertificate *
nssCertificateStore_FindCertificateByIssuerAndSerialNumber(
    nssCertificateStore *store,
    NSSDER *issuer,
    NSSDER *serial)
{
    NSSCertificate *rvCert = NULL;

    PZ_Lock(store->lock);
    rvCert = nssCertStore_FindCertByIssuerAndSerialNumberLocked(
        store, issuer, serial);
    PZ_Unlock(store->lock);
    return rvCert;
}

NSS_IMPLEMENT NSSCertificate *
nssCertificateStore_FindCertificateByEncodedCertificate(
    nssCertificateStore *store,
    NSSDER *encoding)
{
    PRStatus nssrv = PR_FAILURE;
    NSSDER issuer, serial;
    NSSCertificate *rvCert = NULL;
    nssrv = nssPKIX509_GetIssuerAndSerialFromDER(encoding, &issuer, &serial);
    if (nssrv != PR_SUCCESS) {
        return NULL;
    }
    rvCert = nssCertificateStore_FindCertificateByIssuerAndSerialNumber(store,
                                                                        &issuer,
                                                                        &serial);
    PORT_Free(issuer.data);
    PORT_Free(serial.data);
    return rvCert;
}

NSS_EXTERN PRStatus
nssCertificateStore_AddTrust(
    nssCertificateStore *store,
    NSSTrust *trust)
{
    NSSCertificate *cert;
    certificate_hash_entry *entry;
    cert = trust->certificate;
    PZ_Lock(store->lock);
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry) {
        NSSTrust *newTrust = nssTrust_AddRef(trust);
        if (entry->trust) {
            nssTrust_Destroy(entry->trust);
        }
        entry->trust = newTrust;
    }
    PZ_Unlock(store->lock);
    return (entry) ? PR_SUCCESS : PR_FAILURE;
}

NSS_IMPLEMENT NSSTrust *
nssCertificateStore_FindTrustForCertificate(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    certificate_hash_entry *entry;
    NSSTrust *rvTrust = NULL;
    PZ_Lock(store->lock);
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry && entry->trust) {
        rvTrust = nssTrust_AddRef(entry->trust);
    }
    PZ_Unlock(store->lock);
    return rvTrust;
}

NSS_EXTERN PRStatus
nssCertificateStore_AddSMIMEProfile(
    nssCertificateStore *store,
    nssSMIMEProfile *profile)
{
    NSSCertificate *cert;
    certificate_hash_entry *entry;
    cert = profile->certificate;
    PZ_Lock(store->lock);
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry) {
        nssSMIMEProfile *newProfile = nssSMIMEProfile_AddRef(profile);
        if (entry->profile) {
            nssSMIMEProfile_Destroy(entry->profile);
        }
        entry->profile = newProfile;
    }
    PZ_Unlock(store->lock);
    return (entry) ? PR_SUCCESS : PR_FAILURE;
}

NSS_IMPLEMENT nssSMIMEProfile *
nssCertificateStore_FindSMIMEProfileForCertificate(
    nssCertificateStore *store,
    NSSCertificate *cert)
{
    certificate_hash_entry *entry;
    nssSMIMEProfile *rvProfile = NULL;
    PZ_Lock(store->lock);
    entry = (certificate_hash_entry *)
        nssHash_Lookup(store->issuer_and_serial, cert);
    if (entry && entry->profile) {
        rvProfile = nssSMIMEProfile_AddRef(entry->profile);
    }
    PZ_Unlock(store->lock);
    return rvProfile;
}

/* XXX this is also used by cache and should be somewhere else */

static PLHashNumber
nss_certificate_hash(const void *key)
{
    unsigned int i;
    PLHashNumber h;
    NSSCertificate *c = (NSSCertificate *)key;
    h = 0;
    for (i = 0; i < c->issuer.size; i++)
        h = PR_ROTATE_LEFT32(h, 4) ^ ((unsigned char *)c->issuer.data)[i];
    for (i = 0; i < c->serial.size; i++)
        h = PR_ROTATE_LEFT32(h, 4) ^ ((unsigned char *)c->serial.data)[i];
    return h;
}

static int
nss_compare_certs(const void *v1, const void *v2)
{
    PRStatus ignore;
    NSSCertificate *c1 = (NSSCertificate *)v1;
    NSSCertificate *c2 = (NSSCertificate *)v2;
    return (int)(nssItem_Equal(&c1->issuer, &c2->issuer, &ignore) &&
                 nssItem_Equal(&c1->serial, &c2->serial, &ignore));
}

NSS_IMPLEMENT nssHash *
nssHash_CreateCertificate(
    NSSArena *arenaOpt,
    PRUint32 numBuckets)
{
    return nssHash_Create(arenaOpt,
                          numBuckets,
                          nss_certificate_hash,
                          nss_compare_certs,
                          PL_CompareValues);
}

NSS_IMPLEMENT void
nssCertificateStore_DumpStoreInfo(
    nssCertificateStore *store,
    void (*cert_dump_iter)(const void *, void *, void *),
    void *arg)
{
    PZ_Lock(store->lock);
    nssHash_Iterate(store->issuer_and_serial, cert_dump_iter, arg);
    PZ_Unlock(store->lock);
}