advisor.c

安全开发库。含客户端建立ssl连接、签名、证书验证、证书发布和撤销等。编译用到nss

/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/* 
 * The contents of this file are subject to the Mozilla Public
 * License Version 1.1 (the "License"); you may not use this file
 * except in compliance with the License. You may obtain a copy of
 * the License at http://www.mozilla.org/MPL/
 * 
 * Software distributed under the License is distributed on an "AS
 * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * rights and limitations under the License.
 * 
 * The Original Code is the Netscape security libraries.
 * 
 * The Initial Developer of the Original Code is Netscape
 * Communications Corporation.  Portions created by Netscape are 
 * Copyright (C) 1994-2000 Netscape Communications Corporation.  All
 * Rights Reserved.
 * 
 * Contributor(s):
 * 
 * Alternatively, the contents of this file may be used under the
 * terms of the GNU General Public License Version 2 or later (the
 * "GPL"), in which case the provisions of the GPL are applicable 
 * instead of those above.  If you wish to allow use of your 
 * version of this file only under the terms of the GPL and not to
 * allow others to use your version of this file under the MPL,
 * indicate your decision by deleting the provisions above and
 * replace them with the notice and other provisions required by
 * the GPL.  If you do not delete the provisions above, a recipient
 * may use your version of this file under either the MPL or the
 * GPL.
 */
#ifdef XP_MAC
#include "platform.h"
#endif
#include "advisor.h"
#include "nlsutil.h"
#include "minihttp.h"
#include "p12res.h"
#include "textgen.h"
#include "sslskst.h"
#include "certlist.h"
#include "ocsp.h"
#include "prefs.h"
#include "messages.h"
#include "secerr.h"
#include "sslerr.h"

SSMStatus SSM_SetSelectedItemInfo(SSMSecurityAdvisorContext* cx);

#define SSMRESOURCE(object) (&object->super)

#define SSM_NO_INFO						"sa_no_info"
#define SSM_BROWSER_NO_SEC              "sa_browser_no_sec"
#define SSM_BROWSER_SSL                 "sa_browser_ssl"
#define SSM_BROWSER_BAD_SSL			    "sa_browser_bad_ssl"
#define SSM_MESSAGE						"sa_message"
#define SSM_MESSAGE_NOT_SIGNED			"sa_message_not_signed"
#define SSM_MESSAGE_NOT_ENCRYPTED		"sa_message_not_encrypted"
#define SSM_MESSAGE_SIGNED				"sa_message_signed"
#define SSM_MESSAGE_ENCRYPTED			"sa_message_encrypted"
#define SSM_MESSAGE_BAD_SIGNED			"sa_message_bad_signed"
#define SSM_MESSAGE_BAD_ENCRYPTED		"sa_message_bad_encrypted"

char * SSM_ConvertStringToHTMLString(char * string);
char * SSMUI_GetPKCS12Error(PRIntn error, PRBool isBackup);

SSMStatus 
SSMSecurityAdvisorContext_Create(SSMControlConnection *ctrl, 
                                 InfoSecAdvisor *info, 
                                 SSMResource **res)
{
    SSMStatus rv = PR_SUCCESS;
    SSMSecurityAdvisorContext *ct;
	int i;

    *res = NULL; /* in case we fail */
    
    ct = (SSMSecurityAdvisorContext *) 
        PR_CALLOC(sizeof(SSMSecurityAdvisorContext));
    if (!ct) 
        goto loser;

    rv = SSMResource_Init(ctrl, &ct->super, SSM_RESTYPE_SECADVISOR_CONTEXT);
    if (rv != PR_SUCCESS) 
        goto loser;
    
    /* this hash will contain list of formatted certs nickname to display */
    ct->m_certhash = NULL;
    ct->m_certsIncluded = 0;
    
    /* register us with ControlConnection */
    if (!ctrl->m_secAdvisorList) {
        ctrl->m_secAdvisorList = (SECItem *) PR_Malloc(sizeof(SECItem));
        ctrl->m_secAdvisorList->len = 0;
        ctrl->m_secAdvisorList->data = NULL;
    } 
    ctrl->m_secAdvisorList->len++;
    ctrl->m_secAdvisorList->data = (unsigned char *) PR_REALLOC(ctrl->m_secAdvisorList->data, 
                                               ctrl->m_secAdvisorList->len);
    ctrl->m_secAdvisorList->data[ ctrl->m_secAdvisorList->len - 1 ] = 
        ((SSMResource *)ct)->m_id;

    if (info) {
        ct->infoContext = info->infoContext;
        ct->resID = info->resID;
        ct->hostname = info->hostname ? strdup(info->hostname) : NULL;
		ct->senderAddr = info->senderAddr ? strdup(info->senderAddr) : NULL;
		ct->encryptedP7CInfo = info->encryptedP7CInfo;
		ct->signedP7CInfo = info->signedP7CInfo;
		ct->decodeError = info->decodeError;
		ct->verifyError = info->verifyError;
		ct->encryptthis = info->encryptthis;
		ct->signthis = info->signthis;
		ct->numRecipients = info->numRecipients;
	    if (info->numRecipients > 0) {
			ct->recipients = (char **) PR_CALLOC(sizeof(char*)*(info->numRecipients));
			if (!ct->recipients) {
				goto loser;
			}
	        for (i=0;i<info->numRecipients;i++) {
		        ct->recipients[i] = PL_strdup(info->recipients[i]);
			}
		}

        SSM_SetSelectedItemInfo(ct);
    }

    /* Create a URL for the security advisor window. */
    rv = (SSMStatus) SSM_GenerateURL(ctrl, "get", "secadvisor", 
                         &ct->super, NULL, 
                         &ct->m_width, &ct->m_height, 
                         &ct->m_url);
    if (rv != SSM_SUCCESS)
        goto loser;

    SSMSecurityAdvisorContext_Invariant(ct);

    *res = &ct->super;
    return PR_SUCCESS;

 loser:
    if (rv == PR_SUCCESS) rv = PR_FAILURE;

    if (ct) 
    {
        ct->super.m_refCount = 1; /* force destroy */
        SSM_FreeResource(&ct->super);
    }
        
    return rv;
}

char * SSMUI_GetPKCS12Error(PRIntn error, PRBool isBackup)
{
    char * responseKey;
    
    switch (error) { 
    case SSM_ERR_NO_PASSWORD:
        responseKey = "pkcs12_bad_portable_password_restore";
        break;
    case SSM_ERR_BAD_DB_PASSWORD:
        responseKey = "pkcs12_bad_db_password";
        break;
    case SSM_ERR_BAD_FILENAME:
        responseKey = "pkcs12_bad_filepath";
        break;
    case SSM_ERR_NEED_USER_INIT_DB:
        responseKey = "pkcs12_need_db_init";
        break;
    case SSM_ERR_CANNOT_DECODE:
        responseKey="pkcs12_cannot_decode";
        break;
    case SSM_PKCS12_CERT_ALREADY_EXISTS:
        responseKey="pkcs12_cert_already_exists";
        break;
    case SSM_ERR_BAD_REQUEST:
    default:
        responseKey = (isBackup) ? "pkcs12_backup_failure" : 
                                   "pkcs12_restore_failure";
    }

    return responseKey;
}

SSMStatus 
SSMSecurityAdvisorContext_Destroy(SSMResource *res, PRBool doFree)
{
    SSMSecurityAdvisorContext *ct = (SSMSecurityAdvisorContext *) res;
    PRIntn i = 0, others = 0;
    if (ct)
    {
        PR_ASSERT(SSM_IsAKindOf(res, SSM_RESTYPE_SECADVISOR_CONTEXT));
        SSMResource_Destroy(res, PR_FALSE);
        
        /* Dereference the security info object */
        if (ct->m_infoSource)
        {
            SSM_FreeResource(ct->m_infoSource);
            ct->m_infoSource = NULL;
        }

        /* Free the URL */
        PR_FREEIF(ct->m_url);

        if (ct->m_certhash)
            SSMSortedList_Destroy(ct->m_certhash);
        
        /* deregister with control connection */
        while (i < res->m_connection->m_secAdvisorList->len) {
            if (res->m_connection->m_secAdvisorList->data[i] == res->m_id)
                res->m_connection->m_secAdvisorList->data[i] = 0;
            if (res->m_connection->m_secAdvisorList->data[i])
                others ++;
            i++;
        }
        if (!others) {
            SECITEM_ZfreeItem(res->m_connection->m_secAdvisorList, PR_TRUE);
            res->m_connection->m_secAdvisorList = NULL;
        }

        /* Free if asked */
        if (doFree)
            PR_Free(ct);
    }
    return PR_SUCCESS; /* no way to fail, really */
}

void 
SSMSecurityAdvisorContext_Invariant(SSMSecurityAdvisorContext *ct)
{
    /* Check superclass. */
    SSMResource_Invariant(&ct->super);

    /* Make sure we always have a URL. */
    PR_ASSERT(ct->m_url != NULL);
}


SSMStatus 
SSMSecurityAdvisorContext_GetAttrIDs(SSMResource *res,
                                     SSMAttributeID **ids,
                                     PRIntn *count)
{
    SSMStatus rv;

    rv = SSMResource_GetAttrIDs(res, ids, count);
    if (rv != PR_SUCCESS)
        goto loser;

    *ids = (SSMAttributeID *) PR_REALLOC(*ids, (*count + 4) * sizeof(SSMAttributeID));
    if (! *ids) goto loser;

    (*ids)[*count++] = SSM_FID_SECADVISOR_URL;
    (*ids)[*count++] = SSM_FID_SECADVISOR_WIDTH;
    (*ids)[*count++] = SSM_FID_SECADVISOR_HEIGHT;
    (*ids)[*count++] = SSM_FID_CLIENT_CONTEXT;

    goto done;
 loser:
    if (rv == PR_SUCCESS) rv = PR_FAILURE;
 done:
    return rv;
}

SSMStatus 
SSMSecurityAdvisorContext_GetAttr(SSMResource *res,
                                  SSMAttributeID attrID,
                                  SSMResourceAttrType attrType,
                                  SSMAttributeValue *value)
{
    SSMStatus rv = PR_SUCCESS;
    SSMSecurityAdvisorContext *ct = (SSMSecurityAdvisorContext *) res;

    SSMSecurityAdvisorContext_Invariant(ct);

    switch(attrID)
    {
    case SSM_FID_SECADVISOR_URL:
        /* Duplicate and return the string. */
        value->type = SSM_STRING_ATTRIBUTE;
        value->u.string.len = PL_strlen(ct->m_url);
        value->u.string.data = (unsigned char *) PL_strdup(ct->m_url);
        break;
    case SSM_FID_SECADVISOR_WIDTH:
    case SSM_FID_SECADVISOR_HEIGHT:
        value->type = SSM_NUMERIC_ATTRIBUTE;
        value->u.numeric = (attrID == SSM_FID_SECADVISOR_WIDTH) ?
            ct->m_width : ct->m_height;
        break;
    case SSM_FID_CLIENT_CONTEXT:
      SSM_DEBUG("Getting security advisor client context");
      value->type = SSM_STRING_ATTRIBUTE;
      if (!(value->u.string.data = (unsigned char *) PR_Malloc(res->m_clientContext.len))) {
          goto loser;
      }
      memcpy(value->u.string.data, res->m_clientContext.data, res->m_clientContext.len);
      value->u.string.len = res->m_clientContext.len;
      break;

    default:
        rv = SSMResource_GetAttr(res,attrID,attrType,value);
        if (rv != PR_SUCCESS)
            goto loser;
    }

    goto done;
 loser:
    value->type = SSM_NO_ATTRIBUTE;
    if (rv == PR_SUCCESS)
        rv = PR_FAILURE;
 done:
    return rv;
}

SSMStatus SSMSecurityAdvisorContext_SetAttr(SSMResource *res,
                                  SSMAttributeID attrID,
                                  SSMAttributeValue *value)
{
    switch(attrID) {
    case SSM_FID_CLIENT_CONTEXT:
      SSM_DEBUG("Setting security advisor client context");
      if (value->type != SSM_STRING_ATTRIBUTE) {
          goto loser;
      }
      if (!(res->m_clientContext.data = (unsigned char *) PR_Malloc(value->u.string.len))) {
          goto loser;
      }
      memcpy(res->m_clientContext.data, value->u.string.data, value->u.string.len);
      res->m_clientContext.len = value->u.string.len;
      break;
    default:
      SSM_DEBUG("Got unknown security advisor Set Attribute Request %d\n", attrID);
      goto loser;
      break;
    }
    return PR_SUCCESS;
loser:
    return PR_FAILURE;
}


/* Preference keys used in Security Advisor JavaScript.
 * They are used to cache temporary changes the user has made.
 */
#define SSL2_SPK "enable_ssl2"
#define SSL3_SPK "enable_ssl3"
#define CLIENT_AUTH_SPK "client_auth_auto_select"
#define EMAIL_CERT_SPK "default_email_cert"
#define WARN_ENTER_SECURE_SPK "warn_entering_secure"
#define WARN_LEAVE_SECURE_SPK "warn_leaving_secure"
#define WARN_VIEW_MIXED_SPK "warn_viewing_mixed"
#define WARN_SUBMIT_INSECURE_SPK "warn_submit_insecure"
#define ENCRYPT_MAIL_SPK "mail_encrypt_outgoing_mail"
#define SIGN_MAIL_SPK "mail_crypto_sign_outgoing_mail"
#define SIGN_NEWS_SPK "mail_crypto_sign_outgoing_news"

/* maximum number of pref items that will be sent back to the client */
#define ITEMS_MAX 11


static SSMStatus SSMSecurityAdvisor_get_bool_value(HTTPRequest* req,
                                                   char* key, PRBool* value)
{
    SSMStatus rv;
    char* tmpStr = NULL;

    rv = SSM_HTTPParamValue(req, key, &tmpStr);
    if (rv != SSM_SUCCESS) {
        return rv;
    }

    if (PL_strcmp(tmpStr, "true") == 0) {
        *value = PR_TRUE;
    }
    else if (PL_strcmp(tmpStr, "false") == 0) {
        *value = PR_FALSE;
    }
    else {
        SSM_DEBUG("I don't understand the value.\n");
        return SSM_FAILURE;
    }
    return rv;
}

static SSMStatus ssm_set_pack_bool_pref(PrefSet* prefs, char* key, 
                                        PRBool value, SetPrefElement* list,
                                        PRIntn* n)
{
    SSMStatus rv;

    /* set the change to memory */
    rv = PREF_SetBoolPref(prefs, key, value);
    if (rv != PR_SUCCESS) {
        return rv;
    }

    /* pack the change */
    list[*n].key = PL_strdup(key);
    list[*n].type = BOOL_PREF;
    if (value == PR_TRUE) {
        list[*n].value = PL_strdup("true");
    }
    else {
        list[*n].value = PL_strdup("false");
    }
    (*n)++;

    return rv;