PKIFNSSCertUpdate.cpp

Go to the documentation of this file.

#include "PKIFNSSCertUpdate.h"

#include "PKIFNSSDatabase.h"
#include "ToolkitUtils.h"
#include "components.h"
#include "PKIFCacheErrors.h"
#include "Buffer.h"
#include "Certificate.h"
#include "CRL.h"
#include "Name.h"
#include "GeneralName.h"
#include "PKIFCacheException.h"
#include "GottaMatch.h"

#include "PKIFNSSConfig.h"

#include <sstream>
using namespace std;

struct PKIFNSSCertUpdateImpl
{
    CERTCertDBHandle * m_certDbHandle; //WEAK
    CPKIFNSSDatabase * m_db; //WEAK
};


CPKIFNSSCertUpdate::CPKIFNSSCertUpdate(
    const std::string & dbdir)
:m_impl(new PKIFNSSCertUpdateImpl)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSCERTUPDATE,0,this);
    m_impl->m_certDbHandle = 0;
    m_impl->m_db = 0;
    // since it doesn't make sense in SR to use NSS without a DB,
    // if no dbdir is specified, we'll use whatever is open already
    if(dbdir == "") {
        m_impl->m_db = CPKIFNSSDatabase::GetInstance();
    } else {
        // this will throw if the database has already been opened
        // with a diferent directory, as we can only have one open
        // at a time
        m_impl->m_db = CPKIFNSSDatabase::GetInstance(dbdir);
    }
}
CPKIFNSSCertUpdate::~CPKIFNSSCertUpdate(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSCERTUPDATE,0,this);
    PKIFDelete(m_impl);
    m_impl = 0;
}
void CPKIFNSSCertUpdate::AddCertificate(
                                        
    CertType certType, 
    
    const CPKIFCertificatePtr& cert)
{   
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSCERTUPDATE,0,this);
    if(0 == m_impl->m_certDbHandle)
    {
        RAISE_CACHE_EXCEPTION("CPKIFNSSCertUpdate instance not initialized.", thisComponent, COMMON_NOT_INITIALIZED, this);
    }

    SECItem siCert;
    siCert.type = siBuffer;
    CPKIFBufferPtr encoded = cert->Encoded();
    siCert.data = (unsigned char *)encoded->GetBuffer();
    siCert.len = encoded->GetLength();
    
    CERTCertificate * nssCert = 0;

    // NSS will happily overwrite trust settings on import. Check first
    // to be sure that doesn't happen.
    nssCert = CERT_FindCertByDERCert(m_impl->m_certDbHandle, &siCert);
    if(nssCert) {
        CERT_DestroyCertificate(nssCert);
        return;
    }

    SECItem * encCerts[1];
    encCerts[0] = &siCert;

    CERTCertTrust * trust = 0;

    trust = (CERTCertTrust *)PORT_ZAlloc(sizeof(CERTCertTrust));
    if(!trust) {
        RAISE_CACHE_EXCEPTION("CPKIFNSSCertUpdate unable to allocate trust structure for NSS.", thisComponent, COMMON_MEMORY_ALLOC_FAILURE, this);
    }

    // an array of CERTCertificate pointers that will hold the one decoded object
    CERTCertificate ** certs = 0;
    
    // Import certs into a temporary NSS database... an ugly way to do this, but
    // otherwise we need to pull in the whole NSS s/mime library
    SECStatus rv = CERT_ImportCerts(CERT_GetDefaultCertDB(),certUsageUserCertImport,
        1,encCerts,&certs,PR_FALSE,PR_FALSE,NULL);

    if(SECSuccess != rv) {
        // this is really no big deal...
        PORT_Free(trust);
        LOG_STRING_INFO("Unable to import Cert into NSS",TOOLKIT_SR_NSSCERTUPDATE,
            CACHE_UPDATE_FAILED,this);
        return;
    }
    nssCert = certs[0];
    // import the cert as a "valid CA" but not a trusted one
    rv = CERT_DecodeTrustString(trust,"c,c,c");
    if(rv != SECSuccess) {
        CERT_DestroyCertificate(nssCert);
        PORT_Free(certs);
        PORT_Free(trust);
        RAISE_CACHE_EXCEPTION("CPKIFNSSCertUpdate unable to allocate trust structure for NSS.", thisComponent, COMMON_MEMORY_ALLOC_FAILURE, this);
    }
    PK11SlotInfo * internalslot = PK11_GetInternalKeySlot();
    if(!internalslot) {
        CERT_DestroyCertificate(nssCert);
        PORT_Free(certs);
        PORT_Free(trust);
        LOG_STRING_INFO("Unable to access NSS internal slot",TOOLKIT_SR_NSSCERTUPDATE,
            CACHE_UPDATE_FAILED,this);
    }
    // import the cert with the subj DN as its nickname, for ease of manipulation
    // with standard NSS utilities
    rv = PK11_ImportCert(internalslot,nssCert,CK_INVALID_HANDLE,
        (char *)cert->Subject()->ToString(),PR_FALSE);

    if(SECSuccess == rv) {
        rv = CERT_ChangeCertTrust(m_impl->m_certDbHandle,nssCert,trust);
        if(SECSuccess != rv) {
            LOG_STRING_INFO("Unable to set NSS cert trust",TOOLKIT_SR_NSSCERTUPDATE,
                CACHE_UPDATE_FAILED,this);
        }
    }
    PORT_Free(trust);
    CERT_DestroyCertificate(nssCert);
    PORT_Free(certs);
    PK11_FreeSlot(internalslot);
}
void CPKIFNSSCertUpdate::Initialize(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSCERTUPDATE,0,this);
    m_impl->m_certDbHandle = CERT_GetDefaultCertDB();
}