processmsg.c

安全开发库。含客户端建立ssl连接、签名、证书验证、证书发布和撤销等。编译用到nss

  
  reply.string = SSMControlConnection_GenerateKeyOldStyle(ctrl, 
                                                          request.choiceString,
                                                          request.challenge, 
                                                          request.typeString, 
                                                          request.pqgString);
  if (!reply.string) 
    goto loser;
  
  /* create reply message */
  msg->type = SSM_REPLY_OK_MESSAGE | SSM_KEYGEN_TAG | SSM_KEYGEN_DONE;
  if (CMT_EncodeMessage(SingleStringMessageTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
      goto loser;
  }
  if (!msg->len || !msg->data)
    goto loser;
  rv = SSM_SendQMessage(ctrl->m_controlOutQ, SSM_PRIORITY_NORMAL, 
		   msg->type, msg->len, (char *)msg->data, PR_TRUE);

loser:
  /* clean up */
  if (reply.string) 
    PR_Free(reply.string);
  if (request.choiceString) 
    PR_Free(request.choiceString);
  if (request.challenge)
    PR_Free(request.challenge);
  if (request.pqgString)
    PR_Free(request.pqgString);
  if (request.typeString)
    PR_Free(request.typeString);
  if (keydata)
    PR_Free(keydata);
  SSMControlConnection_RecycleItem((SECItem*)msg);
  msg = NULL;
  PR_Free(myarg);
  if (rv != SSM_SUCCESS) {
      SingleNumMessage err_reply;
      msg = (CMTItem *) PORT_ZAlloc(sizeof(CMTItem));
      SSM_DEBUG("Problems generating keys old style!\n");
      msg->type = SSM_REPLY_ERR_MESSAGE;
      err_reply.value = rv;
      CMT_EncodeMessage(SingleNumMessageTemplate, (CMTItem*)msg, &err_reply);
      SSM_SendQMessage(ctrl->m_controlOutQ, SSM_PRIORITY_NORMAL,
                       msg->type, msg->len, (char *)msg->data, PR_TRUE);
      SSMControlConnection_RecycleItem((SECItem*)msg);
  }
  
  return;
}
  
  
char ** SSM_GetKeyChoiceList(char * type, char *pqgString, int *nchoices);
  
SSMStatus 
SSMControlConnection_ProcessGetKeyChoiceList(SSMControlConnection * ctrl,
					     SECItem * msg)
{
  char * type = NULL, * pqgString = NULL, ** choices;
  PRInt32 i=0, nchoices = 0;
  GetKeyChoiceListRequest request;
  GetKeyChoiceListReply   reply;

  if (CMT_DecodeMessage(GetKeyChoiceListRequestTemplate, &request, 
                        (CMTItem*)msg) != CMTSuccess) {
      goto loser;
  }

  choices = SSM_GetKeyChoiceList(request.type, request.pqgString, &nchoices);
  if (!choices)
    goto loser;

  msg->type = (SECItemType)(SSM_REPLY_OK_MESSAGE | SSM_KEYGEN_TAG | SSM_GET_KEY_CHOICE);

  reply.nchoices = nchoices;
  reply.choices = choices;
  if (CMT_EncodeMessage(GetKeyChoiceListReplyTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
      goto loser;
  }

  /* free the result array */
  while (choices[i]) 
    PR_Free(choices[i++]);
  PR_Free(choices);
 
  return PR_SUCCESS;

loser:
  /* compose error reply */
  msg->type = (SECItemType) (SSM_REPLY_ERR_MESSAGE |  SSM_KEYGEN_TAG | SSM_GET_KEY_CHOICE);

  msg->data = NULL;
  msg->len  = 0;
  if (choices) {
    /* free the result array */
    while (choices[i])
      PR_Free(choices[i++]);
    PR_Free(choices);
  }
  return PR_FAILURE;
}

  
SSMStatus
SSMControlConnection_ProcessImportCertRequest(SSMControlConnection * ctrl,
                                              SECItem * msg)
{
  SSMResource *obj;
  SSMStatus rv;
  SingleItemMessage request;
  ImportCertReply reply;
  
  SSM_DEBUG("Got an ImportCert request.\n");
  /* Decode message */
  if (CMT_DecodeMessage(SingleItemMessageTemplate, &request, (CMTItem*)msg) != CMTSuccess) {
      goto loser;
  }
  msg->data = NULL;
  msg->len  = 0;

  /* Unpickle cert and create a resource */
  rv = SSM_UnpickleResource(&obj, SSM_RESTYPE_CERTIFICATE, ctrl, 
                            request.item.len, request.item.data);
  if (rv != PR_SUCCESS)
    goto loser;
  SSM_DEBUG("Imported cert rsrc ID %ld.\n", obj->m_id);
    /* getting this far means success, send the resource ID */
  msg->data = NULL;
  msg->len = 0;
  msg->type = (SECItemType) (SSM_CERT_ACTION | SSM_IMPORT_CERT | SSM_REPLY_OK_MESSAGE);
  reply.result = rv;
  reply.resID = obj->m_id;
  if (CMT_EncodeMessage(ImportCertReplyTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
      goto loser;
  }
  
  if (msg->data == NULL || msg->len == 0) 
	goto loser;
  PR_Free(request.item.data);
  return PR_SUCCESS;
  
  /* something went wrong, could not import cert */
loser:
  if (request.item.data) 
    PR_Free(request.item.data);
  return PR_FAILURE;

}

SSMStatus
SSMControlConnection_ProcessFindCertByNickname(SSMControlConnection *ctrl, SECItem *msg)
{
    SSMStatus rv;
    char *nickname = NULL;
    CERTCertificate *cert = NULL;
    SSMResourceID certID;
    SSMResourceCert * certRes = NULL;
    SingleStringMessage request;
    SingleNumMessage reply;

    SSM_DEBUG("Get a Find Cert By Nickname request\n");

    /* Decode the request */
    if (CMT_DecodeMessage(SingleStringMessageTemplate, &request, (CMTItem*)msg) != CMTSuccess) {
        goto loser;
    }

    /* Look for the cert in out db */
    cert = CERT_FindCertByNickname(ctrl->m_certdb, request.string); 

    /* Create a resource for this cert and get an id */
    if (cert) {
        rv = SSM_CreateResource(SSM_RESTYPE_CERTIFICATE,
                                cert,
                                ctrl,
                                &certID,
                                (SSMResource**)&certRes);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
        rv = SSM_ClientGetResourceReference(&certRes->super, &certID);
        SSM_FreeResource(&certRes->super);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
    } else {
        /* Not found. Return res id 0 */
        certID = 0;
    }

    /* Pack the reply */
    msg->data = NULL;
    msg->len = 0;
    msg->type = (SECItemType) (SSM_CERT_ACTION | SSM_FIND_BY_NICKNAME | SSM_REPLY_OK_MESSAGE);
    reply.value = certID;

    if (CMT_EncodeMessage(SingleNumMessageTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
        goto loser;
    }
    if (msg->data == NULL || msg->len == 0)  {
	    goto loser;
    }

    PR_Free(request.string);
    return PR_SUCCESS;
  
    /* something went wrong */
loser:
    if (request.string) {
        PR_Free(request.string);
    }
    return PR_FAILURE;
}

SSMStatus
SSMControlConnection_ProcessFindCertByKey(SSMControlConnection *ctrl, SECItem *msg)
{
    SSMStatus rv;
    SECItem *key = NULL;
    CERTCertificate *cert = NULL;
    SSMResourceID certID;
    SSMResourceCert * certRes = NULL;
    SingleItemMessage request;
    SingleNumMessage reply;

    SSM_DEBUG("Get a Find Cert By Key request\n");

    /* Decode the request */
    if (CMT_DecodeMessage(SingleItemMessageTemplate, &request, 
                          (CMTItem*)msg) != CMTSuccess) {
        goto loser;
    }

    /* Look for the cert in out db */
    cert = CERT_FindCertByKey(ctrl->m_certdb, (SECItem*)&request.item); 

    /* Create a resource for this cert and get an id */
    if (cert) {
        rv = SSM_CreateResource(SSM_RESTYPE_CERTIFICATE,
                                cert,
                                ctrl,
                                &certID,
                                (SSMResource**)&certRes);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
        rv = SSM_ClientGetResourceReference(&certRes->super, &certID);
        SSM_FreeResource(&certRes->super);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
    } else {
        /* Not found. Return res id 0 */
        certID = 0;
    }

    SSM_DEBUG("Returning cert resource %d\n", certID);

    /* Pack the reply */
    msg->data = NULL;
    msg->len = 0;
    msg->type = (SECItemType) (SSM_CERT_ACTION | SSM_FIND_BY_KEY | SSM_REPLY_OK_MESSAGE);
    reply.value = certID;

    if (CMT_EncodeMessage(SingleNumMessageTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
        goto loser;
    }
  
    PR_Free(request.item.data);
    return PR_SUCCESS;
  
    /* something went wrong */
loser:
    if (request.item.data) {
        PR_Free(request.item.data);
    }
    return PR_FAILURE;
}

int LDAPCertSearch (const char * rcpt_address, const char * server_name,
                    const char * baseDN, int port, int connect_type,
                    const char * certdb_path, const char * auth_dn, 
                    const char * auth_password, const char * mail_attribs,
                    const char * cert_attribs, void ** cert, int * cert_len);

SSMStatus
SSMControlConnection_ProcessFindCertByEmailAddr(SSMControlConnection *ctrl,
                                                SECItem *msg)
{
    SSMStatus rv;
    char *emailAddr = NULL;
    CERTCertificate *cert = NULL;
    SSMResourceID certID = 0;
    SSMResourceCert * certRes = NULL;
    SingleStringMessage request;
    SingleNumMessage reply;

    SSM_DEBUG("Got a Find Cert By Email Addr request\n");

    /* Decode the request */
    if (CMT_DecodeMessage(SingleStringMessageTemplate, &request, (CMTItem*)msg) != CMTSuccess) {
        goto loser;
    }

    /* Look for the cert in out db */
    cert = CERT_FindCertByEmailAddr(ctrl->m_certdb, request.string);

	/* If there is no search or the cert is not valid */
	if (!cert || (CERT_CheckCertValidTimes(cert, PR_Now(), PR_FALSE) != secCertTimeValid)) {
        char* default_server = NULL;

        /* get the default server name */
        rv = PREF_GetStringPref(ctrl->m_prefs, "ldap_2.default", 
                                &default_server);
        if (rv != SSM_SUCCESS) {
            /* if there is no default server, bail */
            goto loser;
        }

        rv = SSM_CompleteLDAPLookup(ctrl, default_server, request.string);
        if (rv != SSM_SUCCESS) {
			cert = NULL;
            goto done;
        }

        cert = CERT_FindCertByEmailAddr(ctrl->m_certdb, request.string);
	    if (cert && (CERT_CheckCertValidTimes(cert, PR_Now(), PR_FALSE) != secCertTimeValid)) {
			cert = NULL;
		}
	}

done:
	/* Create a resource for this cert and get an id */
    if (cert) {
        rv = SSM_CreateResource(SSM_RESTYPE_CERTIFICATE,
                                cert,
                                ctrl,
                                &certID,
                                (SSMResource**)&certRes);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
        rv = SSM_ClientGetResourceReference(&certRes->super, &certID);
        SSM_FreeResource(&certRes->super);
        if (rv != PR_SUCCESS) {
            goto loser;
        }
    } else {
        /* Not found. Return res id 0 */
        certID = 0;
    }

    SSM_DEBUG("Returning cert resource %d\n", certID);

    /* Pack the reply */
    msg->data = NULL;
    msg->len = 0;
    msg->type = (SECItemType) (SSM_CERT_ACTION | SSM_FIND_BY_EMAILADDR | SSM_REPLY_OK_MESSAGE);
    reply.value = certID;

    if (CMT_EncodeMessage(SingleNumMessageTemplate, (CMTItem*)msg, &reply) != CMTSuccess) {
        goto loser;
    }
    if (msg->data == NULL || msg->len == 0)  {
	    goto loser;
    }

    PR_Free(request.string);
    return PR_SUCCESS;
  
    /* something went wrong */
loser:
    if (request.string)
        PR_Free(request.string);
    return PR_FAILURE;
}

SSMStatus
SSMControlConnection_ProcessAddCertToDB(SSMControlConnection *ctrl, SECItem *msg)
{
    SSMStatus rv;
    SSMResourceCert *certRes;
    CERTCertificate *cert;
    CERTCertTrust trust;
    char *nickname = NULL;
    AddTempCertToDBRequest request;

    SSM_DEBUG("Add Cert to DB");

    /* Decode the request */
    if (CMT_DecodeMessage(AddTempCertToDBRequestTemplate, &request, (CMTItem*)msg) != CMTSuccess) {
        goto loser;
    }

    trust.sslFlags = request.sslFlags;
    trust.emailFlags = request.emailFlags;
    trust.objectSigningFlags = request.objSignFlags;

    /* Get the resource for this id */
    rv = SSMControlConnection_GetResource(ctrl, request.resID,
                                          (SSMResource**)&certRes);
    if (rv != PR_SUCCESS) {
        goto loser;
    }

    /* Get the CERTCertificate pointer for this resource */
    cert = certRes->cert;

    /* Add the certificate to the database */
    if (CERT_AddTempCertToPerm(cert, request.nickname, &trust) != SECSuccess) {
        goto loser;
    }

    /* Pack the reply */
    msg->data = NULL;
    msg->len = 0;
    msg->type = (SECItemType) (SSM_CERT_ACTION | SSM_ADD_TO_DB | SSM_REPLY_OK_MESSAGE);
  
    PR_Free(request.nickname);
    return PR_SUCCESS;

loser:
    if (request.nickname) {
        PR_Free(request.nickname);
    }
    return PR_FAILURE;
}

SSMStatus 
SSMControlConnection_ProcessDestroyCert(SSMControlConnection * ctrl, 
					SECItem * msg)