/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
* pkix_tools.c
*
* Private Utility Functions
*
*/
#include "pkix_tools.h"
#define CACHE_ITEM_PERIOD_SECONDS (3600) /* one hour */
/*
* This cahce period is only for CertCache. A Cert from a trusted CertStore
* should be checked more frequently for update new arrival, etc.
*/
#define CACHE_TRUST_ITEM_PERIOD_SECONDS (CACHE_ITEM_PERIOD_SECONDS/10)
extern PKIX_PL_HashTable *cachedCertChainTable;
extern PKIX_PL_HashTable *cachedCertTable;
extern PKIX_PL_HashTable *cachedCrlEntryTable;
/* Following variables are used to checked cache hits - can be taken out */
extern int pkix_ccAddCount;
extern int pkix_ccLookupCount;
extern int pkix_ccRemoveCount;
extern int pkix_cAddCount;
extern int pkix_cLookupCount;
extern int pkix_cRemoveCount;
extern int pkix_ceAddCount;
extern int pkix_ceLookupCount;
#ifdef PKIX_OBJECT_LEAK_TEST
/* Following variables are used for object leak test */
char *nonNullValue = "Non Empty Value";
PKIX_Boolean noErrorState = PKIX_TRUE;
PKIX_Boolean runningLeakTest;
PKIX_Boolean errorGenerated;
PKIX_UInt32 stackPosition;
PKIX_UInt32 *fnStackInvCountArr;
char **fnStackNameArr;
PLHashTable *fnInvTable;
PKIX_UInt32 testStartFnStackPosition;
char *errorFnStackString;
#endif /* PKIX_OBJECT_LEAK_TEST */
/* --Private-Functions-------------------------------------------- */
#ifdef PKIX_OBJECT_LEAK_TEST
/*
* FUNCTION: pkix_ErrorGen_Hash
* DESCRIPTION:
*
* Hash function to be used in object leak test hash table.
*
*/
PLHashNumber PR_CALLBACK
pkix_ErrorGen_Hash (const void *key)
{
char *str = NULL;
PLHashNumber rv = (*(PRUint8*)key) << 5;
PRUint32 i, counter = 0;
PRUint8 *rvc = (PRUint8 *)&rv;
while ((str = fnStackNameArr[counter++]) != NULL) {
PRUint32 len = strlen(str);
for( i = 0; i < len; i++ ) {
rvc[ i % sizeof(rv) ] ^= *str;
str++;
}
}
return rv;
}
#endif /* PKIX_OBJECT_LEAK_TEST */
/*
* FUNCTION: pkix_IsCertSelfIssued
* DESCRIPTION:
*
* Checks whether the Cert pointed to by "cert" is self-issued and stores the
* Boolean result at "pSelfIssued". A Cert is considered self-issued if the
* Cert's issuer matches the Cert's subject. If the subject or issuer is
* not specified, a PKIX_FALSE is returned.
*
* PARAMETERS:
* "cert"
* Address of Cert used to determine whether Cert is self-issued.
* Must be non-NULL.
* "pSelfIssued"
* Address where Boolean will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_IsCertSelfIssued(
PKIX_PL_Cert *cert,
PKIX_Boolean *pSelfIssued,
void *plContext)
{
PKIX_PL_X500Name *subject = NULL;
PKIX_PL_X500Name *issuer = NULL;
PKIX_ENTER(CERT, "pkix_IsCertSelfIssued");
PKIX_NULLCHECK_TWO(cert, pSelfIssued);
PKIX_CHECK(PKIX_PL_Cert_GetSubject(cert, &subject, plContext),
PKIX_CERTGETSUBJECTFAILED);
PKIX_CHECK(PKIX_PL_Cert_GetIssuer(cert, &issuer, plContext),
PKIX_CERTGETISSUERFAILED);
if (subject == NULL || issuer == NULL) {
*pSelfIssued = PKIX_FALSE;
} else {
PKIX_CHECK(PKIX_PL_X500Name_Match
(subject, issuer, pSelfIssued, plContext),
PKIX_X500NAMEMATCHFAILED);
}
cleanup:
PKIX_DECREF(subject);
PKIX_DECREF(issuer);
PKIX_RETURN(CERT);
}
/*
* FUNCTION: pkix_Throw
* DESCRIPTION:
*
* Creates an Error using the value of "errorCode", the character array
* pointed to by "funcName", the character array pointed to by "errorText",
* and the Error pointed to by "cause" (if any), and stores it at "pError".
*
* If "cause" is not NULL and has an errorCode of "PKIX_FATAL_ERROR",
* then there is no point creating a new Error object. Rather, we simply
* store "cause" at "pError".
*
* PARAMETERS:
* "errorCode"
* Value of error code.
* "funcName"
* Address of EscASCII array representing name of function throwing error.
* Must be non-NULL.
* "errnum"
* PKIX_ERRMSGNUM of error description for new error.
* "cause"
* Address of Error representing error's cause.
* "pError"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_Throw(
PKIX_ERRORCLASS errorClass,
const char *funcName,
PKIX_ERRORCODE errorCode,
PKIX_ERRORCLASS overrideClass,
PKIX_Error *cause,
PKIX_Error **pError,
void *plContext)
{
PKIX_Error *error = NULL;
PKIX_ENTER(ERROR, "pkix_Throw");
PKIX_NULLCHECK_TWO(funcName, pError);
*pError = NULL;
#ifdef PKIX_OBJECT_LEAK_TEST
noErrorState = PKIX_TRUE;
if (pkixLog) {
#ifdef PKIX_ERROR_DESCRIPTION
PR_LOG(pkixLog, 4, ("Error in function \"%s\":\"%s\" with cause \"%s\"\n",
funcName, PKIX_ErrorText[errorCode],
(cause ? PKIX_ErrorText[cause->errCode] : "null")));
#else
PR_LOG(pkixLog, 4, ("Error in function \"%s\": error code \"%d\"\n",
funcName, errorCode));
#endif /* PKIX_ERROR_DESCRIPTION */
PORT_Assert(strcmp(funcName, "PKIX_PL_Object_DecRef"));
}
#endif /* PKIX_OBJECT_LEAK_TEST */
/* if cause has error class of PKIX_FATAL_ERROR, return immediately */
if (cause) {
if (cause->errClass == PKIX_FATAL_ERROR){
PKIX_INCREF(cause);
*pError = cause;
goto cleanup;
}
}
if (overrideClass == PKIX_FATAL_ERROR){
errorClass = overrideClass;
}
pkixTempResult = PKIX_Error_Create(errorClass, cause, NULL,
errorCode, &error, plContext);
if (!pkixTempResult) {
/* Setting plErr error code:
* get it from PORT_GetError if it is a leaf error and
* default error code does not exist(eq 0) */
if (!cause && !error->plErr) {
error->plErr = PKIX_PL_GetPLErrorCode();
}
}
*pError = error;
cleanup:
PKIX_DEBUG_EXIT(ERROR);
pkixErrorClass = 0;
#ifdef PKIX_OBJECT_LEAK_TEST
noErrorState = PKIX_FALSE;
if (runningLeakTest && fnStackNameArr) {
PR_LOG(pkixLog, 5,
("%s%*s<- %s(%d) - %s\n", (errorGenerated ? "*" : " "),
stackPosition, " ", fnStackNameArr[stackPosition],
stackPosition, myFuncName));
fnStackNameArr[stackPosition--] = NULL;
}
#endif /* PKIX_OBJECT_LEAK_TEST */
return (pkixTempResult);
}
/*
* FUNCTION: pkix_CheckTypes
* DESCRIPTION:
*
* Checks that the types of the Object pointed to by "first" and the Object
* pointed to by "second" are both equal to the value of "type". If they
* are not equal, a PKIX_Error is returned.
*
* PARAMETERS:
* "first"
* Address of first Object. Must be non-NULL.
* "second"
* Address of second Object. Must be non-NULL.
* "type"
* Value of type to check against.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CheckTypes(
PKIX_PL_Object *first,
PKIX_PL_Object *second,
PKIX_UInt32 type,
void *plContext)
{
PKIX_UInt32 firstType, secondType;
PKIX_ENTER(OBJECT, "pkix_CheckTypes");
PKIX_NULLCHECK_TWO(first, second);
PKIX_CHECK(PKIX_PL_Object_GetType(first, &firstType, plContext),
PKIX_COULDNOTGETFIRSTOBJECTTYPE);
PKIX_CHECK(PKIX_PL_Object_GetType(second, &secondType, plContext),
PKIX_COULDNOTGETSECONDOBJECTTYPE);
if ((firstType != type)||(firstType != secondType)) {
PKIX_ERROR(PKIX_OBJECTTYPESDONOTMATCH);
}
cleanup:
PKIX_RETURN(OBJECT);
}
/*
* FUNCTION: pkix_CheckType
* DESCRIPTION:
*
* Checks that the type of the Object pointed to by "object" is equal to the
* value of "type". If it is not equal, a PKIX_Error is returned.
*
* PARAMETERS:
* "object"
* Address of Object. Must be non-NULL.
* "type"
* Value of type to check against.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CheckType(
PKIX_PL_Object *object,
PKIX_UInt32 type,
void *plContext)
{
return (pkix_CheckTypes(object, object, type, plContext));
}
/*
* FUNCTION: pkix_hash
* DESCRIPTION:
*
* Computes a hash value for "length" bytes starting at the array of bytes
* pointed to by "bytes" and stores the result at "pHash".
*
* XXX To speed this up, we could probably read 32 bits at a time from
* bytes (maybe even 64 bits on some platforms)
*
* PARAMETERS:
* "bytes"
* Address of array of bytes to hash. Must be non-NULL.
* "length"
* Number of bytes to hash.
* "pHash"
* Address where object pointer will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_hash(
const unsigned char *bytes,
PKIX_UInt32 length,
PKIX_UInt32 *pHash,
void *plContext)
{
PKIX_UInt32 i;
PKIX_UInt32 hash;
PKIX_ENTER(OBJECT, "pkix_hash");
if (length != 0) {
PKIX_NULLCHECK_ONE(bytes);
}
PKIX_NULLCHECK_ONE(pHash);
hash = 0;
for (i = 0; i < length; i++) {
/* hash = 31 * hash + bytes[i]; */
hash = (hash << 5) - hash + bytes[i];
}
*pHash = hash;
PKIX_RETURN(OBJECT);
}
/*
* FUNCTION: pkix_countArray
* DESCRIPTION:
*
* Counts the number of elements in the null-terminated array of pointers
* pointed to by "array" and returns the result.
*
* PARAMETERS
* "array"
* Address of null-terminated array of pointers.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns the number of elements in the array.
*/
PKIX_UInt32
pkix_countArray(void **array)
{
PKIX_UInt32 count = 0;
if (array) {
while (*array++) {
count++;
}
}
return (count);
}
/*
* FUNCTION: pkix_duplicateImmutable
* DESCRIPTION:
*
* Convenience callback function used for duplicating immutable objects.
* Since the objects can not be modified, this function simply increments the
* reference count on the object, and returns a reference to that object.
*
* (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)
*/
PKIX_Error *
pkix_duplicateImmutable(
PKIX_PL_Object *object,
PKIX_PL_Object **pNewObject,
void *plContext)
{
PKIX_ENTER(OBJECT, "pkix_duplicateImmutable");
PKIX_NULLCHECK_TWO(object, pNewObject);
PKIX_INCREF(object);
*pNewObject = object;
cleanup:
PKIX_RETURN(OBJECT);
}
/* --String-Encoding-Conversion-Functions------------------------ */
/*
* FUNCTION: pkix_hex2i
* DESCRIPTION:
*
* Converts hexadecimal character "c" to its integer value and returns result.
*
* PARAMETERS
* "c"
* Character to convert to a hex value.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* The hexadecimal value of "c". Otherwise -1. (Unsigned 0xFFFFFFFF).
*/
PKIX_UInt32
pkix_hex2i(char c)
{
if ((c >= '0')&&(c <= '9'))
return (c-'0');
else if ((c >= 'a')&&(c <= 'f'))
return (c-'a'+10);
else if ((c >= 'A')&&(c <= 'F'))
return (c-'A'+10);
else
return ((PKIX_UInt32)(-1));
}
/*
* FUNCTION: pkix_i2hex
* DESCRIPTION:
*
* Converts integer value "digit" to its ASCII hex value
*
* PARAMETERS
* "digit"
* Value of integer to convert to ASCII hex value. Must be 0-15.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* The ASCII hexadecimal value of "digit".
*/
char
pkix_i2hex(char digit)
{
if ((digit >= 0)&&(digit <= 9))
return (digit+'0');
else if ((digit >= 0xa)&&(digit <= 0xf))
return (digit - 10 + 'a');
else
return (-1);
}
/*
* FUNCTION: pkix_isPlaintext
* DESCRIPTION:
*
* Returns whether character "c" is plaintext using EscASCII or EscASCII_Debug
* depending on the value of "debug".
*
* In EscASCII, [01, 7E] except '&' are plaintext.
* In EscASCII_Debug [20, 7E] except '&' are plaintext.
*
* PARAMETERS:
* "c"
* Character to check.
* "debug"
* Value of debug flag.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* True if "c" is plaintext.
*/
PKIX_Boolean
pkix_isPlaintext(unsigned char c, PKIX_Boolean debug) {
return ((c >= 0x01)&&(c <= 0x7E)&&(c != '&')&&(!debug || (c >= 20)));
}
/* --Cache-Functions------------------------ */
/*
* FUNCTION: pkix_CacheCertChain_Lookup
* DESCRIPTION:
*
* Look up CertChain Hash Table for a cached BuildResult based on "targetCert"
* and "anchors" as the hash keys. If there is no item to match the key,
* PKIX_FALSE is stored at "pFound". If an item is found, its cache time is
* compared to "testDate". If expired, the item is removed and PKIX_FALSE is
* stored at "pFound". Otherwise, PKIX_TRUE is stored at "pFound" and the
* BuildResult is stored at "pBuildResult".
* The hashtable is maintained in the following ways:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
* 2) A PKIX_PL_Date created with current time offset by constant
* CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
* When an item is retrieved, this date is compared against "testDate" for
* validity. If comparison indicates this item is expired, the item is
* removed from the bucket.
*
* PARAMETERS:
* "targetCert"
* Address of Target Cert as key to retrieve this CertChain. Must be
* non-NULL.
* "anchors"
* Address of PKIX_List of "anchors" is used as key to retrive CertChain.
* Must be non-NULL.
* "testDate"
* Address of PKIX_PL_Date for verifying time validity and cache validity.
* May be NULL. If testDate is NULL, this cache item will not be out-dated.
* "pFound"
* Address of PKIX_Boolean indicating valid data is found.
* Must be non-NULL.
* "pBuildResult"
* Address where BuildResult will be stored. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCertChain_Lookup(
PKIX_PL_Cert* targetCert,
PKIX_List* anchors,
PKIX_PL_Date *testDate,
PKIX_Boolean *pFound,
PKIX_BuildResult **pBuildResult,
void *plContext)
{
PKIX_List *cachedValues = NULL;
PKIX_List *cachedKeys = NULL;
PKIX_Error *cachedCertChainError = NULL;
PKIX_PL_Date *cacheValidUntilDate = NULL;
PKIX_PL_Date *validityDate = NULL;
PKIX_Int32 cmpValidTimeResult = 0;
PKIX_Int32 cmpCacheTimeResult = 0;
PKIX_ENTER(BUILD, "pkix_CacheCertChain_Lookup");
PKIX_NULLCHECK_FOUR(targetCert, anchors, pFound, pBuildResult);
*pFound = PKIX_FALSE;
/* use trust anchors and target cert as hash key */
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)targetCert,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)anchors,
plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCertChainError = PKIX_PL_HashTable_Lookup
(cachedCertChainTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object **) &cachedValues,
plContext);
pkix_ccLookupCount++;
/* retrieve data from hashed value list */
if (cachedValues != NULL && cachedCertChainError == NULL) {
PKIX_CHECK(PKIX_List_GetItem
(cachedValues,
0,
(PKIX_PL_Object **) &cacheValidUntilDate,
plContext),
PKIX_LISTGETITEMFAILED);
/* check validity time and cache age time */
PKIX_CHECK(PKIX_List_GetItem
(cachedValues,
1,
(PKIX_PL_Object **) &validityDate,
plContext),
PKIX_LISTGETITEMFAILED);
/* if testDate is not set, this cache item is not out-dated */
if (testDate) {
PKIX_CHECK(PKIX_PL_Object_Compare
((PKIX_PL_Object *)testDate,
(PKIX_PL_Object *)cacheValidUntilDate,
&cmpCacheTimeResult,
plContext),
PKIX_OBJECTCOMPARATORFAILED);
PKIX_CHECK(PKIX_PL_Object_Compare
((PKIX_PL_Object *)testDate,
(PKIX_PL_Object *)validityDate,
&cmpValidTimeResult,
plContext),
PKIX_OBJECTCOMPARATORFAILED);
}
/* certs' date are all valid and cache item is not old */
if (cmpValidTimeResult <= 0 && cmpCacheTimeResult <=0) {
PKIX_CHECK(PKIX_List_GetItem
(cachedValues,
2,
(PKIX_PL_Object **) pBuildResult,
plContext),
PKIX_LISTGETITEMFAILED);
*pFound = PKIX_TRUE;
} else {
pkix_ccRemoveCount++;
*pFound = PKIX_FALSE;
/* out-dated item, remove it from cache */
PKIX_CHECK(PKIX_PL_HashTable_Remove
(cachedCertChainTable,
(PKIX_PL_Object *) cachedKeys,
plContext),
PKIX_HASHTABLEREMOVEFAILED);
}
}
cleanup:
PKIX_DECREF(cachedValues);
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedCertChainError);
PKIX_DECREF(cacheValidUntilDate);
PKIX_DECREF(validityDate);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCertChain_Remove
* DESCRIPTION:
*
* Remove CertChain Hash Table entry based on "targetCert" and "anchors"
* as the hash keys. If there is no item to match the key, no action is
* taken.
* The hashtable is maintained in the following ways:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
* 2) A PKIX_PL_Date created with current time offset by constant
* CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
* When an item is retrieved, this date is compared against "testDate" for
* validity. If comparison indicates this item is expired, the item is
* removed from the bucket.
*
* PARAMETERS:
* "targetCert"
* Address of Target Cert as key to retrieve this CertChain. Must be
* non-NULL.
* "anchors"
* Address of PKIX_List of "anchors" is used as key to retrive CertChain.
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCertChain_Remove(
PKIX_PL_Cert* targetCert,
PKIX_List* anchors,
void *plContext)
{
PKIX_List *cachedKeys = NULL;
PKIX_ENTER(BUILD, "pkix_CacheCertChain_Remove");
PKIX_NULLCHECK_TWO(targetCert, anchors);
/* use trust anchors and target cert as hash key */
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)targetCert,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)anchors,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK_ONLY_FATAL(PKIX_PL_HashTable_Remove
(cachedCertChainTable,
(PKIX_PL_Object *) cachedKeys,
plContext),
PKIX_HASHTABLEREMOVEFAILED);
pkix_ccRemoveCount++;
cleanup:
PKIX_DECREF(cachedKeys);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCertChain_Add
* DESCRIPTION:
*
* Add a BuildResult to the CertChain Hash Table for a "buildResult" with
* "targetCert" and "anchors" as the hash keys.
* "validityDate" is the most restricted notAfter date of all Certs in
* this CertChain and is verified when this BuildChain is retrieved.
* The hashtable is maintained in the following ways:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
* 2) A PKIX_PL_Date created with current time offset by constant
* CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
* When an item is retrieved, this date is compared against "testDate" for
* validity. If comparison indicates this item is expired, the item is
* removed from the bucket.
*
* PARAMETERS:
* "targetCert"
* Address of Target Cert as key to retrieve this CertChain. Must be
* non-NULL.
* "anchors"
* Address of PKIX_List of "anchors" is used as key to retrive CertChain.
* Must be non-NULL.
* "validityDate"
* Address of PKIX_PL_Date contains the most restriced notAfter time of
* all "certs". Must be non-NULL.
* Address of PKIX_Boolean indicating valid data is found.
* Must be non-NULL.
* "buildResult"
* Address of BuildResult to be cached. Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCertChain_Add(
PKIX_PL_Cert* targetCert,
PKIX_List* anchors,
PKIX_PL_Date *validityDate,
PKIX_BuildResult *buildResult,
void *plContext)
{
PKIX_List *cachedValues = NULL;
PKIX_List *cachedKeys = NULL;
PKIX_Error *cachedCertChainError = NULL;
PKIX_PL_Date *cacheValidUntilDate = NULL;
PKIX_ENTER(BUILD, "pkix_CacheCertChain_Add");
PKIX_NULLCHECK_FOUR(targetCert, anchors, validityDate, buildResult);
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)targetCert, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)anchors, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds
(CACHE_ITEM_PERIOD_SECONDS,
&cacheValidUntilDate,
plContext),
PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedValues,
(PKIX_PL_Object *)cacheValidUntilDate,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedValues, (PKIX_PL_Object *)validityDate, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedValues, (PKIX_PL_Object *)buildResult, plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCertChainError = PKIX_PL_HashTable_Add
(cachedCertChainTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object *) cachedValues,
plContext);
pkix_ccAddCount++;
if (cachedCertChainError != NULL) {
PKIX_DEBUG("PKIX_PL_HashTable_Add for CertChain skipped: "
"entry existed\n");
}
cleanup:
PKIX_DECREF(cachedValues);
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedCertChainError);
PKIX_DECREF(cacheValidUntilDate);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCert_Lookup
* DESCRIPTION:
*
* Look up Cert Hash Table for a cached item based on "store" and Subject in
* "certSelParams" as the hash keys and returns values Certs in "pCerts".
* If there isn't an item to match the key, a PKIX_FALSE is returned at
* "pFound". The item's cache time is verified with "testDate". If out-dated,
* this item is removed and PKIX_FALSE is returned at "pFound".
* This hashtable is maintained in the following ways:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
* 2) A PKIX_PL_Date created with current time offset by constant
* CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
* If the CertStore this Cert is from is a trusted one, the cache period is
* shorter so cache can be updated more frequently.
* When an item is retrieved, this date is compared against "testDate" for
* validity. If comparison indicates this item is expired, the item is
* removed from the bucket.
*
* PARAMETERS:
* "store"
* Address of CertStore as key to retrieve this CertChain. Must be
* non-NULL.
* "certSelParams"
* Address of ComCertSelParams that its subject is used as key to retrieve
* this CertChain. Must be non-NULL.
* "testDate"
* Address of PKIX_PL_Date for verifying time cache validity.
* Must be non-NULL. If testDate is NULL, this cache item won't be out
* dated.
* "pFound"
* Address of KPKIX_Boolean indicating valid data is found.
* Must be non-NULL.
* "pCerts"
* Address PKIX_List where the CertChain will be stored. Must be no-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCert_Lookup(
PKIX_CertStore *store,
PKIX_ComCertSelParams *certSelParams,
PKIX_PL_Date *testDate,
PKIX_Boolean *pFound,
PKIX_List** pCerts,
void *plContext)
{
PKIX_PL_Cert *cert = NULL;
PKIX_List *cachedKeys = NULL;
PKIX_List *cachedValues = NULL;
PKIX_List *cachedCertList = NULL;
PKIX_List *selCertList = NULL;
PKIX_PL_X500Name *subject = NULL;
PKIX_PL_Date *invalidAfterDate = NULL;
PKIX_PL_Date *cacheValidUntilDate = NULL;
PKIX_CertSelector *certSel = NULL;
PKIX_Error *cachedCertError = NULL;
PKIX_Error *selectorError = NULL;
PKIX_CertSelector_MatchCallback selectorMatch = NULL;
PKIX_Int32 cmpValidTimeResult = PKIX_FALSE;
PKIX_Int32 cmpCacheTimeResult = 0;
PKIX_UInt32 numItems = 0;
PKIX_UInt32 i;
PKIX_ENTER(BUILD, "pkix_CacheCert_Lookup");
PKIX_NULLCHECK_TWO(store, certSelParams);
PKIX_NULLCHECK_TWO(pFound, pCerts);
*pFound = PKIX_FALSE;
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)store, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
(certSelParams, &subject, plContext),
PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
PKIX_NULLCHECK_ONE(subject);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)subject, plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCertError = PKIX_PL_HashTable_Lookup
(cachedCertTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object **) &cachedValues,
plContext);
pkix_cLookupCount++;
if (cachedValues != NULL && cachedCertError == NULL) {
PKIX_CHECK(PKIX_List_GetItem
(cachedValues,
0,
(PKIX_PL_Object **) &cacheValidUntilDate,
plContext),
PKIX_LISTGETITEMFAILED);
if (testDate) {
PKIX_CHECK(PKIX_PL_Object_Compare
((PKIX_PL_Object *)testDate,
(PKIX_PL_Object *)cacheValidUntilDate,
&cmpCacheTimeResult,
plContext),
PKIX_OBJECTCOMPARATORFAILED);
}
if (cmpCacheTimeResult <= 0) {
PKIX_CHECK(PKIX_List_GetItem
(cachedValues,
1,
(PKIX_PL_Object **) &cachedCertList,
plContext),
PKIX_LISTGETITEMFAILED);
/*
* Certs put on cache satifies only for Subject,
* user selector and ComCertSelParams to filter.
*/
PKIX_CHECK(PKIX_CertSelector_Create
(NULL, NULL, &certSel, plContext),
PKIX_CERTSELECTORCREATEFAILED);
PKIX_CHECK(PKIX_CertSelector_SetCommonCertSelectorParams
(certSel, certSelParams, plContext),
PKIX_CERTSELECTORSETCOMMONCERTSELECTORPARAMSFAILED);
PKIX_CHECK(PKIX_CertSelector_GetMatchCallback
(certSel, &selectorMatch, plContext),
PKIX_CERTSELECTORGETMATCHCALLBACKFAILED);
PKIX_CHECK(PKIX_List_Create(&selCertList, plContext),
PKIX_LISTCREATEFAILED);
/*
* If any of the Cert on the list is out-dated, invalidate
* this cache item.
*/
PKIX_CHECK(PKIX_List_GetLength
(cachedCertList, &numItems, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < numItems; i++){
PKIX_CHECK(PKIX_List_GetItem
(cachedCertList,
i,
(PKIX_PL_Object **)&cert,
plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK(PKIX_PL_Cert_GetValidityNotAfter
(cert, &invalidAfterDate, plContext),
PKIX_CERTGETVALIDITYNOTAFTERFAILED);
if (testDate) {
PKIX_CHECK(PKIX_PL_Object_Compare
((PKIX_PL_Object *)invalidAfterDate,
(PKIX_PL_Object *)testDate,
&cmpValidTimeResult,
plContext),
PKIX_OBJECTCOMPARATORFAILED);
}
if (cmpValidTimeResult < 0) {
pkix_cRemoveCount++;
*pFound = PKIX_FALSE;
/* one cert is out-dated, remove item from cache */
PKIX_CHECK(PKIX_PL_HashTable_Remove
(cachedCertTable,
(PKIX_PL_Object *) cachedKeys,
plContext),
PKIX_HASHTABLEREMOVEFAILED);
goto cleanup;
}
selectorError = selectorMatch(certSel, cert, plContext);
if (!selectorError){
/* put on the return list */
PKIX_CHECK(PKIX_List_AppendItem
(selCertList,
(PKIX_PL_Object *)cert,
plContext),
PKIX_LISTAPPENDITEMFAILED);
} else {
PKIX_DECREF(selectorError);
}
PKIX_DECREF(cert);
PKIX_DECREF(invalidAfterDate);
}
if (*pFound) {
PKIX_INCREF(selCertList);
*pCerts = selCertList;
}
} else {
pkix_cRemoveCount++;
*pFound = PKIX_FALSE;
/* cache item is out-dated, remove it from cache */
PKIX_CHECK(PKIX_PL_HashTable_Remove
(cachedCertTable,
(PKIX_PL_Object *) cachedKeys,
plContext),
PKIX_HASHTABLEREMOVEFAILED);
}
}
cleanup:
PKIX_DECREF(subject);
PKIX_DECREF(certSel);
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedValues);
PKIX_DECREF(cacheValidUntilDate);
PKIX_DECREF(cert);
PKIX_DECREF(cachedCertList);
PKIX_DECREF(selCertList);
PKIX_DECREF(invalidAfterDate);
PKIX_DECREF(cachedCertError);
PKIX_DECREF(selectorError);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCert_Add
* DESCRIPTION:
*
* Add Cert Hash Table for a cached item based on "store" and Subject in
* "certSelParams" as the hash keys and have "certs" as the key value.
* This hashtable is maintained in the following ways:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
* 2) A PKIX_PL_Date created with current time offset by constant
* CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
* If the CertStore this Cert is from is a trusted one, the cache period is
* shorter so cache can be updated more frequently.
* When an item is retrieved, this date is compared against "testDate" for
* validity. If comparison indicates this item is expired, the item is
* removed from the bucket.
*
* PARAMETERS:
* "store"
* Address of CertStore as key to retrieve this CertChain. Must be
* non-NULL.
* "certSelParams"
* Address of ComCertSelParams that its subject is used as key to retrieve
* this CertChain. Must be non-NULL.
* "certs"
* Address PKIX_List of Certs will be stored. Must be no-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCert_Add(
PKIX_CertStore *store,
PKIX_ComCertSelParams *certSelParams,
PKIX_List* certs,
void *plContext)
{
PKIX_List *cachedKeys = NULL;
PKIX_List *cachedValues = NULL;
PKIX_PL_Date *cacheValidUntilDate = NULL;
PKIX_PL_X500Name *subject = NULL;
PKIX_Error *cachedCertError = NULL;
PKIX_CertStore_CheckTrustCallback trustCallback = NULL;
PKIX_UInt32 cachePeriod = CACHE_ITEM_PERIOD_SECONDS;
PKIX_UInt32 numCerts = 0;
PKIX_ENTER(BUILD, "pkix_CacheCert_Add");
PKIX_NULLCHECK_THREE(store, certSelParams, certs);
PKIX_CHECK(PKIX_List_GetLength(certs, &numCerts,
plContext),
PKIX_LISTGETLENGTHFAILED);
if (numCerts == 0) {
/* Don't want to add an empty list. */
goto cleanup;
}
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)store, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
(certSelParams, &subject, plContext),
PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
PKIX_NULLCHECK_ONE(subject);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)subject, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_CertStore_GetTrustCallback
(store, &trustCallback, plContext),
PKIX_CERTSTOREGETTRUSTCALLBACKFAILED);
if (trustCallback) {
cachePeriod = CACHE_TRUST_ITEM_PERIOD_SECONDS;
}
PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds
(cachePeriod, &cacheValidUntilDate, plContext),
PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedValues,
(PKIX_PL_Object *)cacheValidUntilDate,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedValues,
(PKIX_PL_Object *)certs,
plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCertError = PKIX_PL_HashTable_Add
(cachedCertTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object *) cachedValues,
plContext);
pkix_cAddCount++;
if (cachedCertError != NULL) {
PKIX_DEBUG("PKIX_PL_HashTable_Add for Certs skipped: "
"entry existed\n");
}
cleanup:
PKIX_DECREF(subject);
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedValues);
PKIX_DECREF(cacheValidUntilDate);
PKIX_DECREF(cachedCertError);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCrlEntry_Lookup
* DESCRIPTION:
*
* Look up CrlEntry Hash Table for a cached item based on "store",
* "certIssuer" and "certSerialNumber" as the hash keys and returns values
* "pCrls". If there isn't an item to match the key, a PKIX_FALSE is
* returned at "pFound".
* This hashtable is maintained in the following way:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
*
* PARAMETERS:
* "store"
* Address of CertStore as key to retrieve this CertChain. Must be
* non-NULL.
* "certIssuer"
* Address of X500Name that is used as key to retrieve the CRLEntries.
* Must be non-NULL.
* "certSerialNumber"
* Address of BigInt that is used as key to retrieve the CRLEntries.
* Must be non-NULL.
* "pFound"
* Address of KPKIX_Boolean indicating valid data is found.
* Must be non-NULL.
* "pCrls"
* Address PKIX_List where the CRLEntry will be stored. Must be no-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCrlEntry_Lookup(
PKIX_CertStore *store,
PKIX_PL_X500Name *certIssuer,
PKIX_PL_BigInt *certSerialNumber,
PKIX_Boolean *pFound,
PKIX_List** pCrls,
void *plContext)
{
PKIX_List *cachedKeys = NULL;
PKIX_List *cachedCrlEntryList = NULL;
PKIX_Error *cachedCrlEntryError = NULL;
PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Lookup");
PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);
PKIX_NULLCHECK_TWO(pFound, pCrls);
*pFound = PKIX_FALSE;
/* Find CrlEntry(s) by issuer and serial number */
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)store, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)certSerialNumber,
plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCrlEntryError = PKIX_PL_HashTable_Lookup
(cachedCrlEntryTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object **) &cachedCrlEntryList,
plContext);
pkix_ceLookupCount++;
/*
* We don't need check Date to invalidate this cache item,
* the item is uniquely defined and won't be reverted. Let
* the FIFO for cleaning up.
*/
if (cachedCrlEntryList != NULL && cachedCrlEntryError == NULL ) {
PKIX_INCREF(cachedCrlEntryList);
*pCrls = cachedCrlEntryList;
*pFound = PKIX_TRUE;
} else {
*pFound = PKIX_FALSE;
}
cleanup:
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedCrlEntryList);
PKIX_DECREF(cachedCrlEntryError);
PKIX_RETURN(BUILD);
}
/*
* FUNCTION: pkix_CacheCrlEntry_Add
* DESCRIPTION:
*
* Look up CrlEntry Hash Table for a cached item based on "store",
* "certIssuer" and "certSerialNumber" as the hash keys and have "pCrls" as
* the hash value. If there isn't an item to match the key, a PKIX_FALSE is
* returned at "pFound".
* This hashtable is maintained in the following way:
* 1) When creating the hashtable, maximum bucket size can be specified (0 for
* unlimited). If items in a bucket reaches its full size, an new addition
* will trigger the removal of the old as FIFO sequence.
*
* PARAMETERS:
* "store"
* Address of CertStore as key to retrieve this CertChain. Must be
* non-NULL.
* "certIssuer"
* Address of X500Name that is used as key to retrieve the CRLEntries.
* Must be non-NULL.
* "certSerialNumber"
* Address of BigInt that is used as key to retrieve the CRLEntries.
* Must be non-NULL.
* "crls"
* Address PKIX_List where the CRLEntry is stored. Must be no-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns an Error Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CacheCrlEntry_Add(
PKIX_CertStore *store,
PKIX_PL_X500Name *certIssuer,
PKIX_PL_BigInt *certSerialNumber,
PKIX_List* crls,
void *plContext)
{
PKIX_List *cachedKeys = NULL;
PKIX_Error *cachedCrlEntryError = NULL;
PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Add");
PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);
PKIX_NULLCHECK_ONE(crls);
/* Add CrlEntry(s) by issuer and serial number */
PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)store, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(PKIX_List_AppendItem
(cachedKeys,
(PKIX_PL_Object *)certSerialNumber,
plContext),
PKIX_LISTAPPENDITEMFAILED);
cachedCrlEntryError = PKIX_PL_HashTable_Add
(cachedCrlEntryTable,
(PKIX_PL_Object *) cachedKeys,
(PKIX_PL_Object *) crls,
plContext);
pkix_ceAddCount++;
cleanup:
PKIX_DECREF(cachedKeys);
PKIX_DECREF(cachedCrlEntryError);
PKIX_RETURN(BUILD);
}
#ifdef PKIX_OBJECT_LEAK_TEST
/* TEST_START_FN and testStartFnStackPosition define at what state
* of the stack the object leak testing should begin. The condition
* in pkix_CheckForGeneratedError works the following way: do leak
* testing if at position testStartFnStackPosition in stack array
* (fnStackNameArr) we have called function TEST_START_FN.
* Note, that stack array get filled only when executing libpkix
* functions.
* */
#define TEST_START_FN "PKIX_BuildChain"
PKIX_Error*
pkix_CheckForGeneratedError(PKIX_StdVars * stdVars,
PKIX_ERRORCLASS errClass,
char * fnName,
PKIX_Boolean *errSetFlag,
void * plContext)
{
PKIX_Error *genErr = NULL;
PKIX_UInt32 pos = 0;
PKIX_UInt32 strLen = 0;
if (fnName) {
if (fnStackNameArr[testStartFnStackPosition] == NULL ||
strcmp(fnStackNameArr[testStartFnStackPosition], TEST_START_FN)
) {
/* return with out error if not with in boundary */
return NULL;
}
if (!strcmp(fnName, TEST_START_FN)) {
*errSetFlag = PKIX_TRUE;
noErrorState = PKIX_FALSE;
errorGenerated = PKIX_FALSE;
}
}
if (noErrorState || errorGenerated) return NULL;
if (fnName && (
!strcmp(fnName, "PKIX_PL_Object_DecRef") ||
!strcmp(fnName, "PKIX_PL_Object_Unlock") ||
!strcmp(fnName, "pkix_UnlockObject") ||
!strcmp(fnName, "pkix_Throw") ||
!strcmp(fnName, "pkix_trace_dump_cert") ||
!strcmp(fnName, "PKIX_PL_Free"))) {
/* do not generate error for this functions */
noErrorState = PKIX_TRUE;
*errSetFlag = PKIX_TRUE;
return NULL;
}
if (PL_HashTableLookup(fnInvTable, &fnStackInvCountArr[stackPosition - 1])) {
return NULL;
}
PL_HashTableAdd(fnInvTable, &fnStackInvCountArr[stackPosition - 1], nonNullValue);
errorGenerated = PKIX_TRUE;
noErrorState = PKIX_TRUE;
genErr = PKIX_DoThrow(stdVars, errClass, PKIX_MEMLEAKGENERATEDERROR,
errClass, plContext);
while(fnStackNameArr[pos]) {
strLen += PORT_Strlen(fnStackNameArr[pos++]) + 1;
}
strLen += 1; /* end of line. */
pos = 0;
errorFnStackString = PORT_ZAlloc(strLen);
while(fnStackNameArr[pos]) {
strcat(errorFnStackString, "/");
strcat(errorFnStackString, fnStackNameArr[pos++]);
}
noErrorState = PKIX_FALSE;
return genErr;
}
#endif /* PKIX_OBJECT_LEAK_TEST */