collector.c revision 285830
1217309Snwhitehorn/* 2217309Snwhitehorn * Copyright (c) 2004 - 2007 Kungliga Tekniska H��gskolan 3217309Snwhitehorn * (Royal Institute of Technology, Stockholm, Sweden). 4217309Snwhitehorn * All rights reserved. 5217309Snwhitehorn * 6217309Snwhitehorn * Redistribution and use in source and binary forms, with or without 7217309Snwhitehorn * modification, are permitted provided that the following conditions 8217309Snwhitehorn * are met: 9217309Snwhitehorn * 10217309Snwhitehorn * 1. Redistributions of source code must retain the above copyright 11217309Snwhitehorn * notice, this list of conditions and the following disclaimer. 12217309Snwhitehorn * 13217309Snwhitehorn * 2. Redistributions in binary form must reproduce the above copyright 14217309Snwhitehorn * notice, this list of conditions and the following disclaimer in the 15217309Snwhitehorn * documentation and/or other materials provided with the distribution. 16217309Snwhitehorn * 17217309Snwhitehorn * 3. Neither the name of the Institute nor the names of its contributors 18217309Snwhitehorn * may be used to endorse or promote products derived from this software 19217309Snwhitehorn * without specific prior written permission. 20217309Snwhitehorn * 21217309Snwhitehorn * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22217309Snwhitehorn * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23217309Snwhitehorn * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24217309Snwhitehorn * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25217309Snwhitehorn * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26217309Snwhitehorn * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27217309Snwhitehorn * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28217309Snwhitehorn * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29217309Snwhitehorn * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30217309Snwhitehorn * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31217309Snwhitehorn * SUCH DAMAGE. 32217309Snwhitehorn */ 33217309Snwhitehorn 34217309Snwhitehorn#include "hx_locl.h" 35217309Snwhitehorn 36217309Snwhitehornstruct private_key { 37217309Snwhitehorn AlgorithmIdentifier alg; 38217309Snwhitehorn hx509_private_key private_key; 39217309Snwhitehorn heim_octet_string localKeyId; 40217309Snwhitehorn}; 41217309Snwhitehorn 42217309Snwhitehornstruct hx509_collector { 43217309Snwhitehorn hx509_lock lock; 44217309Snwhitehorn hx509_certs unenvelop_certs; 45217309Snwhitehorn hx509_certs certs; 46217309Snwhitehorn struct { 47217309Snwhitehorn struct private_key **data; 48217309Snwhitehorn size_t len; 49217309Snwhitehorn } val; 50217309Snwhitehorn}; 51217309Snwhitehorn 52217309Snwhitehorn 53217309Snwhitehornint 54217309Snwhitehorn_hx509_collector_alloc(hx509_context context, hx509_lock lock, struct hx509_collector **collector) 55217309Snwhitehorn{ 56217309Snwhitehorn struct hx509_collector *c; 57217309Snwhitehorn int ret; 58217309Snwhitehorn 59217309Snwhitehorn *collector = NULL; 60217309Snwhitehorn 61217309Snwhitehorn c = calloc(1, sizeof(*c)); 62217309Snwhitehorn if (c == NULL) { 63217309Snwhitehorn hx509_set_error_string(context, 0, ENOMEM, "out of memory"); 64217309Snwhitehorn return ENOMEM; 65217309Snwhitehorn } 66217309Snwhitehorn c->lock = lock; 67217309Snwhitehorn 68217309Snwhitehorn ret = hx509_certs_init(context, "MEMORY:collector-unenvelop-cert", 69217309Snwhitehorn 0,NULL, &c->unenvelop_certs); 70217309Snwhitehorn if (ret) { 71217309Snwhitehorn free(c); 72217309Snwhitehorn return ret; 73217309Snwhitehorn } 74217309Snwhitehorn c->val.data = NULL; 75217309Snwhitehorn c->val.len = 0; 76217309Snwhitehorn ret = hx509_certs_init(context, "MEMORY:collector-tmp-store", 77217309Snwhitehorn 0, NULL, &c->certs); 78217309Snwhitehorn if (ret) { 79217309Snwhitehorn hx509_certs_free(&c->unenvelop_certs); 80217309Snwhitehorn free(c); 81217309Snwhitehorn return ret; 82217309Snwhitehorn } 83217309Snwhitehorn 84217309Snwhitehorn *collector = c; 85217309Snwhitehorn return 0; 86217309Snwhitehorn} 87217309Snwhitehorn 88217309Snwhitehornhx509_lock 89217309Snwhitehorn_hx509_collector_get_lock(struct hx509_collector *c) 90217309Snwhitehorn{ 91217309Snwhitehorn return c->lock; 92217309Snwhitehorn} 93217309Snwhitehorn 94217309Snwhitehorn 95217309Snwhitehornint 96217309Snwhitehorn_hx509_collector_certs_add(hx509_context context, 97217309Snwhitehorn struct hx509_collector *c, 98217309Snwhitehorn hx509_cert cert) 99217309Snwhitehorn{ 100217309Snwhitehorn return hx509_certs_add(context, c->certs, cert); 101217309Snwhitehorn} 102217309Snwhitehorn 103217309Snwhitehornstatic void 104217309Snwhitehornfree_private_key(struct private_key *key) 105217309Snwhitehorn{ 106217309Snwhitehorn free_AlgorithmIdentifier(&key->alg); 107217309Snwhitehorn if (key->private_key) 108217309Snwhitehorn hx509_private_key_free(&key->private_key); 109217309Snwhitehorn der_free_octet_string(&key->localKeyId); 110217309Snwhitehorn free(key); 111217309Snwhitehorn} 112217309Snwhitehorn 113217309Snwhitehornint 114217309Snwhitehorn_hx509_collector_private_key_add(hx509_context context, 115217309Snwhitehorn struct hx509_collector *c, 116217309Snwhitehorn const AlgorithmIdentifier *alg, 117217309Snwhitehorn hx509_private_key private_key, 118217309Snwhitehorn const heim_octet_string *key_data, 119217309Snwhitehorn const heim_octet_string *localKeyId) 120217309Snwhitehorn{ 121217309Snwhitehorn struct private_key *key; 122217309Snwhitehorn void *d; 123217309Snwhitehorn int ret; 124217309Snwhitehorn 125217309Snwhitehorn key = calloc(1, sizeof(*key)); 126217309Snwhitehorn if (key == NULL) 127217309Snwhitehorn return ENOMEM; 128217309Snwhitehorn 129217309Snwhitehorn d = realloc(c->val.data, (c->val.len + 1) * sizeof(c->val.data[0])); 130217309Snwhitehorn if (d == NULL) { 131217309Snwhitehorn free(key); 132217309Snwhitehorn hx509_set_error_string(context, 0, ENOMEM, "Out of memory"); 133217309Snwhitehorn return ENOMEM; 134217309Snwhitehorn } 135217309Snwhitehorn c->val.data = d; 136217309Snwhitehorn 137217309Snwhitehorn ret = copy_AlgorithmIdentifier(alg, &key->alg); 138217309Snwhitehorn if (ret) { 139217309Snwhitehorn hx509_set_error_string(context, 0, ret, "Failed to copy " 140217309Snwhitehorn "AlgorithmIdentifier"); 141217309Snwhitehorn goto out; 142217309Snwhitehorn } 143217309Snwhitehorn if (private_key) { 144217309Snwhitehorn key->private_key = private_key; 145217309Snwhitehorn } else { 146217309Snwhitehorn ret = hx509_parse_private_key(context, alg, 147217309Snwhitehorn key_data->data, key_data->length, 148217309Snwhitehorn HX509_KEY_FORMAT_DER, 149217309Snwhitehorn &key->private_key); 150217309Snwhitehorn if (ret) 151217309Snwhitehorn goto out; 152217309Snwhitehorn } 153217309Snwhitehorn if (localKeyId) { 154217309Snwhitehorn ret = der_copy_octet_string(localKeyId, &key->localKeyId); 155217309Snwhitehorn if (ret) { 156217309Snwhitehorn hx509_set_error_string(context, 0, ret, 157217309Snwhitehorn "Failed to copy localKeyId"); 158217309Snwhitehorn goto out; 159217309Snwhitehorn } 160217309Snwhitehorn } else 161217309Snwhitehorn memset(&key->localKeyId, 0, sizeof(key->localKeyId)); 162217309Snwhitehorn 163217309Snwhitehorn c->val.data[c->val.len] = key; 164217309Snwhitehorn c->val.len++; 165217309Snwhitehorn 166217309Snwhitehornout: 167217309Snwhitehorn if (ret) 168217309Snwhitehorn free_private_key(key); 169217309Snwhitehorn 170217309Snwhitehorn return ret; 171217309Snwhitehorn} 172217309Snwhitehorn 173217309Snwhitehornstatic int 174217309Snwhitehornmatch_localkeyid(hx509_context context, 175217309Snwhitehorn struct private_key *value, 176217309Snwhitehorn hx509_certs certs) 177217309Snwhitehorn{ 178217309Snwhitehorn hx509_cert cert; 179217309Snwhitehorn hx509_query q; 180217309Snwhitehorn int ret; 181217309Snwhitehorn 182217309Snwhitehorn if (value->localKeyId.length == 0) { 183217309Snwhitehorn hx509_set_error_string(context, 0, HX509_LOCAL_ATTRIBUTE_MISSING, 184217309Snwhitehorn "No local key attribute on private key"); 185217309Snwhitehorn return HX509_LOCAL_ATTRIBUTE_MISSING; 186217309Snwhitehorn } 187217309Snwhitehorn 188 _hx509_query_clear(&q); 189 q.match |= HX509_QUERY_MATCH_LOCAL_KEY_ID; 190 191 q.local_key_id = &value->localKeyId; 192 193 ret = hx509_certs_find(context, certs, &q, &cert); 194 if (ret == 0) { 195 196 if (value->private_key) 197 _hx509_cert_assign_key(cert, value->private_key); 198 hx509_cert_free(cert); 199 } 200 return ret; 201} 202 203static int 204match_keys(hx509_context context, struct private_key *value, hx509_certs certs) 205{ 206 hx509_cursor cursor; 207 hx509_cert c; 208 int ret, found = HX509_CERT_NOT_FOUND; 209 210 if (value->private_key == NULL) { 211 hx509_set_error_string(context, 0, HX509_PRIVATE_KEY_MISSING, 212 "No private key to compare with"); 213 return HX509_PRIVATE_KEY_MISSING; 214 } 215 216 ret = hx509_certs_start_seq(context, certs, &cursor); 217 if (ret) 218 return ret; 219 220 c = NULL; 221 while (1) { 222 ret = hx509_certs_next_cert(context, certs, cursor, &c); 223 if (ret) 224 break; 225 if (c == NULL) 226 break; 227 if (_hx509_cert_private_key(c)) { 228 hx509_cert_free(c); 229 continue; 230 } 231 232 ret = _hx509_match_keys(c, value->private_key); 233 if (ret) { 234 _hx509_cert_assign_key(c, value->private_key); 235 hx509_cert_free(c); 236 found = 0; 237 break; 238 } 239 hx509_cert_free(c); 240 } 241 242 hx509_certs_end_seq(context, certs, cursor); 243 244 if (found) 245 hx509_clear_error_string(context); 246 247 return found; 248} 249 250int 251_hx509_collector_collect_certs(hx509_context context, 252 struct hx509_collector *c, 253 hx509_certs *ret_certs) 254{ 255 hx509_certs certs; 256 int ret; 257 size_t i; 258 259 *ret_certs = NULL; 260 261 ret = hx509_certs_init(context, "MEMORY:collector-store", 0, NULL, &certs); 262 if (ret) 263 return ret; 264 265 ret = hx509_certs_merge(context, certs, c->certs); 266 if (ret) { 267 hx509_certs_free(&certs); 268 return ret; 269 } 270 271 for (i = 0; i < c->val.len; i++) { 272 ret = match_localkeyid(context, c->val.data[i], certs); 273 if (ret == 0) 274 continue; 275 ret = match_keys(context, c->val.data[i], certs); 276 if (ret == 0) 277 continue; 278 } 279 280 *ret_certs = certs; 281 282 return 0; 283} 284 285int 286_hx509_collector_collect_private_keys(hx509_context context, 287 struct hx509_collector *c, 288 hx509_private_key **keys) 289{ 290 size_t i, nkeys; 291 292 *keys = NULL; 293 294 for (i = 0, nkeys = 0; i < c->val.len; i++) 295 if (c->val.data[i]->private_key) 296 nkeys++; 297 298 *keys = calloc(nkeys + 1, sizeof(**keys)); 299 if (*keys == NULL) { 300 hx509_set_error_string(context, 0, ENOMEM, "malloc - out of memory"); 301 return ENOMEM; 302 } 303 304 for (i = 0, nkeys = 0; i < c->val.len; i++) { 305 if (c->val.data[i]->private_key) { 306 (*keys)[nkeys++] = c->val.data[i]->private_key; 307 c->val.data[i]->private_key = NULL; 308 } 309 } 310 (*keys)[nkeys] = NULL; 311 312 return 0; 313} 314 315 316void 317_hx509_collector_free(struct hx509_collector *c) 318{ 319 size_t i; 320 321 if (c->unenvelop_certs) 322 hx509_certs_free(&c->unenvelop_certs); 323 if (c->certs) 324 hx509_certs_free(&c->certs); 325 for (i = 0; i < c->val.len; i++) 326 free_private_key(c->val.data[i]); 327 if (c->val.data) 328 free(c->val.data); 329 free(c); 330} 331