Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 250 insertions, 0 deletions

diff --git a/security/nss/lib/ssl/authcert.c b/security/nss/lib/ssl/authcert.c
new file mode 100644
index 0000000000..3d64173b41
--- /dev/null
+++ b/security/nss/lib/ssl/authcert.c
@@ -0,0 +1,250 @@
+/*
+ * NSS utility functions
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <stdio.h>
+#include <string.h>
+#include "prerror.h"
+#include "secitem.h"
+#include "prnetdb.h"
+#include "cert.h"
+#include "nspr.h"
+#include "secder.h"
+#include "keyhi.h"
+#include "nss.h"
+#include "ssl.h"
+#include "pk11func.h" /* for PK11_ function calls */
+#include "sslimpl.h"
+
+/* convert a CERTDistNameStr to an array ascii strings.
+ * we ignore caNames which we can't convert, so n could be less than nnames
+ * n is always set, even on failure.
+ * This function allows us to use the existing CERT_FilterCertListByCANames. */
+static char **
+ssl_DistNamesToStrings(struct CERTDistNamesStr *caNames, int *n)
+{
+    char **names;
+    int i;
+    SECStatus rv;
+    PLArenaPool *arena;
+
+    *n = 0;
+    names = PORT_ZNewArray(char *, caNames->nnames);
+    if (names == NULL) {
+        return NULL;
+    }
+    arena = PORT_NewArena(2048);
+    if (arena == NULL) {
+        PORT_Free(names);
+        return NULL;
+    }
+    for (i = 0; i < caNames->nnames; ++i) {
+        CERTName dn;
+        rv = SEC_QuickDERDecodeItem(arena, &dn, SEC_ASN1_GET(CERT_NameTemplate),
+                                    caNames->names + i);
+        if (rv != SECSuccess) {
+            continue;
+        }
+        names[*n] = CERT_NameToAscii(&dn);
+        if (names[*n])
+            (*n)++;
+    }
+    PORT_FreeArena(arena, PR_FALSE);
+    return names;
+}
+
+/* free the dist names we allocated in the above function. n must be the
+ * returned n from that function. */
+static void
+ssl_FreeDistNamesStrings(char **strings, int n)
+{
+    int i;
+    for (i = 0; i < n; i++) {
+        PORT_Free(strings[i]);
+    }
+    PORT_Free(strings);
+}
+
+PRBool
+ssl_CertIsUsable(sslSocket *ss, CERTCertificate *cert)
+{
+    SECStatus rv;
+    SSLSignatureScheme scheme;
+
+    if ((ss == NULL) || (cert == NULL)) {
+        return PR_FALSE;
+    }
+    /* There are two ways of handling the old style handshake:
+     * 1) check the actual record we are using and return true,
+     *   if (!ss->ssl3.hs.hashType == handshake_hash_record  &&
+     *           ss->ssl3.hs.hashType == handshake_hash_single) {
+     *   return PR_TRUE;
+     * 2) assume if ss->ss->ssl3.hs.clientAuthSignatureSchemesLen == 0 we are using the
+     *    old handshake.
+     * There is one case where using 2 will be wrong: we somehow call this
+     * function outside the case where of out GetClientAuthData context.
+     * In that case we don't know that the 'real' peerScheme list is, so the
+     * best we can do is either always assume good or always assume bad.
+     * I think the best results is to always assume good, so we use
+     * option 2 here to handle that case as well.*/
+    if (ss->ssl3.hs.clientAuthSignatureSchemesLen == 0) {
+        return PR_TRUE;
+    }
+    if (ss->ssl3.hs.clientAuthSignatureSchemes == NULL) {
+        return PR_FALSE; /* should this really be an assert? */
+    }
+    rv = ssl_PickClientSignatureScheme(ss, cert, NULL,
+                                       ss->ssl3.hs.clientAuthSignatureSchemes,
+                                       ss->ssl3.hs.clientAuthSignatureSchemesLen,
+                                       &scheme);
+    if (rv != SECSuccess) {
+        return PR_FALSE;
+    }
+    return PR_TRUE;
+}
+
+SECStatus
+ssl_FilterClientCertListBySSLSocket(sslSocket *ss, CERTCertList *certList)
+{
+    CERTCertListNode *node;
+    CERTCertificate *cert;
+
+    if (!certList) {
+        return SECFailure;
+    }
+
+    node = CERT_LIST_HEAD(certList);
+
+    while (!CERT_LIST_END(node, certList)) {
+        cert = node->cert;
+        if (PR_TRUE != ssl_CertIsUsable(ss, cert)) {
+            /* cert doesn't match the socket criteria, remove it */
+            CERTCertListNode *freenode = node;
+            node = CERT_LIST_NEXT(node);
+            CERT_RemoveCertListNode(freenode);
+        } else {
+            /* this cert is good, go to the next cert */
+            node = CERT_LIST_NEXT(node);
+        }
+    }
+
+    return (SECSuccess);
+}
+
+/* This function can be called by the application's custom GetClientAuthHook
+ * to filter out any certs in the cert list that doesn't match the negotiated
+ * requirements of the current SSL connection.
+ */
+SECStatus
+SSL_FilterClientCertListBySocket(PRFileDesc *fd, CERTCertList *certList)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (ss == NULL) {
+        return SECFailure;
+    }
+    return ssl_FilterClientCertListBySSLSocket(ss, certList);
+}
+
+/* This function can be called by the application's custom GetClientAuthHook
+ * to determine if a single certificate matches the negotiated requirements of
+ * the current SSL connection.
+ */
+PRBool
+SSL_CertIsUsable(PRFileDesc *fd, CERTCertificate *cert)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (ss == NULL) {
+        return PR_FALSE;
+    }
+    return ssl_CertIsUsable(ss, cert);
+}
+
+/*
+ * This callback used by SSL to pull client certificate upon
+ * server request
+ */
+SECStatus
+NSS_GetClientAuthData(void *arg,
+                      PRFileDesc *fd,
+                      struct CERTDistNamesStr *caNames,
+                      struct CERTCertificateStr **pRetCert,
+                      struct SECKEYPrivateKeyStr **pRetKey)
+{
+    CERTCertificate *cert = NULL;
+    CERTCertList *certList = NULL;
+    SECKEYPrivateKey *privkey = NULL;
+    char *chosenNickName = (char *)arg; /* CONST */
+    SECStatus rv = SECFailure;
+
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss) {
+        return SECFailure;
+    }
+    void *pw_arg = SSL_RevealPinArg(fd);
+
+    /* first, handle any token authentication that may be needed */
+    if (chosenNickName && pw_arg) {
+        certList = PK11_FindCertsFromNickname(chosenNickName, pw_arg);
+        if (certList) {
+            CERT_FilterCertListForUserCerts(certList);
+            rv = CERT_FilterCertListByUsage(certList, certUsageSSLClient,
+                                            PR_FALSE);
+            if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) {
+                CERT_DestroyCertList(certList);
+                certList = NULL;
+            }
+        }
+    }
+
+    /* otherwise look through the cache based on usage
+     * if chosenNickname is set, we ignore the expiration date */
+    if (certList == NULL) {
+        certList = CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(),
+                                             certUsageSSLClient,
+                                             PR_FALSE, chosenNickName == NULL,
+                                             pw_arg);
+        if (certList == NULL) {
+            return SECFailure;
+        }
+        /* filter only the certs that meet the nickname requirements */
+        if (chosenNickName) {
+            rv = CERT_FilterCertListByNickname(certList, chosenNickName,
+                                               pw_arg);
+        } else {
+            int nnames = 0;
+            char **names = ssl_DistNamesToStrings(caNames, &nnames);
+            rv = CERT_FilterCertListByCANames(certList, nnames, names,
+                                              certUsageSSLClient);
+            ssl_FreeDistNamesStrings(names, nnames);
+        }
+        if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) {
+            CERT_DestroyCertList(certList);
+            return SECFailure;
+        }
+    }
+
+    /* now remove any certs that can't meet the connection requirements */
+    rv = ssl_FilterClientCertListBySSLSocket(ss, certList);
+    if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) {
+        // no certs left.
+        CERT_DestroyCertList(certList);
+        return SECFailure;
+    }
+
+    /* now return the top cert in the list. We've strived to make the
+     * list ordered by the most likely usable cert, so it should be the best
+     * match. */
+    cert = CERT_DupCertificate(CERT_LIST_HEAD(certList)->cert);
+    CERT_DestroyCertList(certList);
+    privkey = PK11_FindKeyByAnyCert(cert, pw_arg);
+    if (privkey == NULL) {
+        CERT_DestroyCertificate(cert);
+        return SECFailure;
+    }
+    *pRetCert = cert;
+    *pRetKey = privkey;
+    return SECSuccess;
+}