LCOV - code coverage report
Current view: top level - dirmngr - certcache.c (source / functions) Hit Total Coverage
Test: coverage.info Lines: 0 613 0.0 %
Date: 2016-11-29 15:00:56 Functions: 0 26 0.0 %

          Line data    Source code
       1             : /* certcache.c - Certificate caching
       2             :  *      Copyright (C) 2004, 2005, 2007, 2008 g10 Code GmbH
       3             :  *
       4             :  * This file is part of DirMngr.
       5             :  *
       6             :  * DirMngr is free software; you can redistribute it and/or modify
       7             :  * it under the terms of the GNU General Public License as published by
       8             :  * the Free Software Foundation; either version 2 of the License, or
       9             :  * (at your option) any later version.
      10             :  *
      11             :  * DirMngr is distributed in the hope that it will be useful,
      12             :  * but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :  * GNU General Public License for more details.
      15             :  *
      16             :  * You should have received a copy of the GNU General Public License
      17             :  * along with this program; if not, see <https://www.gnu.org/licenses/>.
      18             :  */
      19             : 
      20             : #include <config.h>
      21             : 
      22             : #include <stdio.h>
      23             : #include <stdlib.h>
      24             : #include <errno.h>
      25             : #include <assert.h>
      26             : #include <sys/types.h>
      27             : #include <dirent.h>
      28             : #include <npth.h>
      29             : 
      30             : #include "dirmngr.h"
      31             : #include "misc.h"
      32             : #include "crlfetch.h"
      33             : #include "certcache.h"
      34             : 
      35             : 
      36             : #define MAX_EXTRA_CACHED_CERTS 1000
      37             : 
      38             : /* Constants used to classify search patterns.  */
      39             : enum pattern_class
      40             :   {
      41             :     PATTERN_UNKNOWN = 0,
      42             :     PATTERN_EMAIL,
      43             :     PATTERN_EMAIL_SUBSTR,
      44             :     PATTERN_FINGERPRINT16,
      45             :     PATTERN_FINGERPRINT20,
      46             :     PATTERN_SHORT_KEYID,
      47             :     PATTERN_LONG_KEYID,
      48             :     PATTERN_SUBJECT,
      49             :     PATTERN_SERIALNO,
      50             :     PATTERN_SERIALNO_ISSUER,
      51             :     PATTERN_ISSUER,
      52             :     PATTERN_SUBSTR
      53             :   };
      54             : 
      55             : 
      56             : /* A certificate cache item.  This consists of a the KSBA cert object
      57             :    and some meta data for easier lookup.  We use a hash table to keep
      58             :    track of all items and use the (randomly distributed) first byte of
      59             :    the fingerprint directly as the hash which makes it pretty easy. */
      60             : struct cert_item_s
      61             : {
      62             :   struct cert_item_s *next; /* Next item with the same hash value. */
      63             :   ksba_cert_t cert;         /* The KSBA cert object or NULL is this is
      64             :                                not a valid item.  */
      65             :   unsigned char fpr[20];    /* The fingerprint of this object. */
      66             :   char *issuer_dn;          /* The malloced issuer DN.  */
      67             :   ksba_sexp_t sn;           /* The malloced serial number  */
      68             :   char *subject_dn;         /* The malloced subject DN - maybe NULL.  */
      69             :   struct
      70             :   {
      71             :     unsigned int loaded:1;  /* It has been explicitly loaded.  */
      72             :     unsigned int trusted:1; /* This is a trusted root certificate.  */
      73             :   } flags;
      74             : };
      75             : typedef struct cert_item_s *cert_item_t;
      76             : 
      77             : /* The actual cert cache consisting of 256 slots for items indexed by
      78             :    the first byte of the fingerprint.  */
      79             : static cert_item_t cert_cache[256];
      80             : 
      81             : /* This is the global cache_lock variable. In general locking is not
      82             :    needed but it would take extra efforts to make sure that no
      83             :    indirect use of npth functions is done, so we simply lock it
      84             :    always.  Note: We can't use static initialization, as that is not
      85             :    available through w32-pth.  */
      86             : static npth_rwlock_t cert_cache_lock;
      87             : 
      88             : /* Flag to track whether the cache has been initialized.  */
      89             : static int initialization_done;
      90             : 
      91             : /* Total number of certificates loaded during initialization and
      92             :    cached during operation.  */
      93             : static unsigned int total_loaded_certificates;
      94             : static unsigned int total_extra_certificates;
      95             : 
      96             : 
      97             : 
      98             : /* Helper to do the cache locking.  */
      99             : static void
     100           0 : init_cache_lock (void)
     101             : {
     102             :   int err;
     103             : 
     104           0 :   err = npth_rwlock_init (&cert_cache_lock, NULL);
     105           0 :   if (err)
     106           0 :     log_fatal (_("can't initialize certificate cache lock: %s\n"),
     107             :                strerror (err));
     108           0 : }
     109             : 
     110             : static void
     111           0 : acquire_cache_read_lock (void)
     112             : {
     113             :   int err;
     114             : 
     115           0 :   err = npth_rwlock_rdlock (&cert_cache_lock);
     116           0 :   if (err)
     117           0 :     log_fatal (_("can't acquire read lock on the certificate cache: %s\n"),
     118             :                strerror (err));
     119           0 : }
     120             : 
     121             : static void
     122           0 : acquire_cache_write_lock (void)
     123             : {
     124             :   int err;
     125             : 
     126           0 :   err = npth_rwlock_wrlock (&cert_cache_lock);
     127           0 :   if (err)
     128           0 :     log_fatal (_("can't acquire write lock on the certificate cache: %s\n"),
     129             :                strerror (err));
     130           0 : }
     131             : 
     132             : static void
     133           0 : release_cache_lock (void)
     134             : {
     135             :   int err;
     136             : 
     137           0 :   err = npth_rwlock_unlock (&cert_cache_lock);
     138           0 :   if (err)
     139           0 :     log_fatal (_("can't release lock on the certificate cache: %s\n"),
     140             :                strerror (err));
     141           0 : }
     142             : 
     143             : 
     144             : /* Return false if both serial numbers match.  Can't be used for
     145             :    sorting. */
     146             : static int
     147           0 : compare_serialno (ksba_sexp_t serial1, ksba_sexp_t serial2 )
     148             : {
     149           0 :   unsigned char *a = serial1;
     150           0 :   unsigned char *b = serial2;
     151           0 :   return cmp_simple_canon_sexp (a, b);
     152             : }
     153             : 
     154             : 
     155             : 
     156             : /* Return a malloced canonical S-Expression with the serial number
     157             :    converted from the hex string HEXSN.  Return NULL on memory
     158             :    error. */
     159             : ksba_sexp_t
     160           0 : hexsn_to_sexp (const char *hexsn)
     161             : {
     162             :   char *buffer, *p;
     163             :   size_t len;
     164             :   char numbuf[40];
     165             : 
     166           0 :   len = unhexify (NULL, hexsn);
     167           0 :   snprintf (numbuf, sizeof numbuf, "(%u:", (unsigned int)len);
     168           0 :   buffer = xtrymalloc (strlen (numbuf) + len + 2 );
     169           0 :   if (!buffer)
     170           0 :     return NULL;
     171           0 :   p = stpcpy (buffer, numbuf);
     172           0 :   len = unhexify (p, hexsn);
     173           0 :   p[len] = ')';
     174           0 :   p[len+1] = 0;
     175             : 
     176           0 :   return buffer;
     177             : }
     178             : 
     179             : 
     180             : /* Compute the fingerprint of the certificate CERT and put it into
     181             :    the 20 bytes large buffer DIGEST.  Return address of this buffer.  */
     182             : unsigned char *
     183           0 : cert_compute_fpr (ksba_cert_t cert, unsigned char *digest)
     184             : {
     185             :   gpg_error_t err;
     186             :   gcry_md_hd_t md;
     187             : 
     188           0 :   err = gcry_md_open (&md, GCRY_MD_SHA1, 0);
     189           0 :   if (err)
     190           0 :     log_fatal ("gcry_md_open failed: %s\n", gpg_strerror (err));
     191             : 
     192           0 :   err = ksba_cert_hash (cert, 0, HASH_FNC, md);
     193           0 :   if (err)
     194             :     {
     195           0 :       log_error ("oops: ksba_cert_hash failed: %s\n", gpg_strerror (err));
     196           0 :       memset (digest, 0xff, 20); /* Use a dummy value. */
     197             :     }
     198             :   else
     199             :     {
     200           0 :       gcry_md_final (md);
     201           0 :       memcpy (digest, gcry_md_read (md, GCRY_MD_SHA1), 20);
     202             :     }
     203           0 :   gcry_md_close (md);
     204           0 :   return digest;
     205             : }
     206             : 
     207             : 
     208             : /* Cleanup one slot.  This releases all resourses but keeps the actual
     209             :    slot in the cache marked for reuse. */
     210             : static void
     211           0 : clean_cache_slot (cert_item_t ci)
     212             : {
     213             :   ksba_cert_t cert;
     214             : 
     215           0 :   if (!ci->cert)
     216           0 :     return; /* Already cleaned.  */
     217             : 
     218           0 :   ksba_free (ci->sn);
     219           0 :   ci->sn = NULL;
     220           0 :   ksba_free (ci->issuer_dn);
     221           0 :   ci->issuer_dn = NULL;
     222           0 :   ksba_free (ci->subject_dn);
     223           0 :   ci->subject_dn = NULL;
     224           0 :   cert = ci->cert;
     225           0 :   ci->cert = NULL;
     226             : 
     227           0 :   ksba_cert_release (cert);
     228             : }
     229             : 
     230             : 
     231             : /* Put the certificate CERT into the cache.  It is assumed that the
     232             :    cache is locked while this function is called. If FPR_BUFFER is not
     233             :    NULL the fingerprint of the certificate will be stored there.
     234             :    FPR_BUFFER neds to point to a buffer of at least 20 bytes. The
     235             :    fingerprint will be stored on success or when the function returns
     236             :    gpg_err_code(GPG_ERR_DUP_VALUE). */
     237             : static gpg_error_t
     238           0 : put_cert (ksba_cert_t cert, int is_loaded, int is_trusted, void *fpr_buffer)
     239             : {
     240             :   unsigned char help_fpr_buffer[20], *fpr;
     241             :   cert_item_t ci;
     242             : 
     243           0 :   fpr = fpr_buffer? fpr_buffer : &help_fpr_buffer;
     244             : 
     245             :   /* If we already reached the caching limit, drop a couple of certs
     246             :      from the cache.  Our dropping strategy is simple: We keep a
     247             :      static index counter and use this to start looking for
     248             :      certificates, then we drop 5 percent of the oldest certificates
     249             :      starting at that index.  For a large cache this is a fair way of
     250             :      removing items. An LRU strategy would be better of course.
     251             :      Because we append new entries to the head of the list and we want
     252             :      to remove old ones first, we need to do this from the tail.  The
     253             :      implementation is not very efficient but compared to the long
     254             :      time it takes to retrieve a certifciate from an external resource
     255             :      it seems to be reasonable. */
     256           0 :   if (!is_loaded && total_extra_certificates >= MAX_EXTRA_CACHED_CERTS)
     257             :     {
     258             :       static int idx;
     259             :       cert_item_t ci_mark;
     260             :       int i;
     261             :       unsigned int drop_count;
     262             : 
     263           0 :       drop_count = MAX_EXTRA_CACHED_CERTS / 20;
     264           0 :       if (drop_count < 2)
     265           0 :         drop_count = 2;
     266             : 
     267           0 :       log_info (_("dropping %u certificates from the cache\n"), drop_count);
     268           0 :       assert (idx < 256);
     269           0 :       for (i=idx; drop_count; i = ((i+1)%256))
     270             :         {
     271           0 :           ci_mark = NULL;
     272           0 :           for (ci = cert_cache[i]; ci; ci = ci->next)
     273           0 :             if (ci->cert && !ci->flags.loaded)
     274           0 :               ci_mark = ci;
     275           0 :           if (ci_mark)
     276             :             {
     277           0 :               clean_cache_slot (ci_mark);
     278           0 :               drop_count--;
     279           0 :               total_extra_certificates--;
     280             :             }
     281             :         }
     282           0 :       if (i==idx)
     283           0 :         idx++;
     284             :       else
     285           0 :         idx = i;
     286           0 :       idx %= 256;
     287             :     }
     288             : 
     289           0 :   cert_compute_fpr (cert, fpr);
     290           0 :   for (ci=cert_cache[*fpr]; ci; ci = ci->next)
     291           0 :     if (ci->cert && !memcmp (ci->fpr, fpr, 20))
     292           0 :       return gpg_error (GPG_ERR_DUP_VALUE);
     293             :   /* Try to reuse an existing entry.  */
     294           0 :   for (ci=cert_cache[*fpr]; ci; ci = ci->next)
     295           0 :     if (!ci->cert)
     296           0 :       break;
     297           0 :   if (!ci)
     298             :     { /* No: Create a new entry.  */
     299           0 :       ci = xtrycalloc (1, sizeof *ci);
     300           0 :       if (!ci)
     301           0 :         return gpg_error_from_errno (errno);
     302           0 :       ci->next = cert_cache[*fpr];
     303           0 :       cert_cache[*fpr] = ci;
     304             :     }
     305             :   else
     306           0 :     memset (&ci->flags, 0, sizeof ci->flags);
     307             : 
     308           0 :   ksba_cert_ref (cert);
     309           0 :   ci->cert = cert;
     310           0 :   memcpy (ci->fpr, fpr, 20);
     311           0 :   ci->sn = ksba_cert_get_serial (cert);
     312           0 :   ci->issuer_dn = ksba_cert_get_issuer (cert, 0);
     313           0 :   if (!ci->issuer_dn || !ci->sn)
     314             :     {
     315           0 :       clean_cache_slot (ci);
     316           0 :       return gpg_error (GPG_ERR_INV_CERT_OBJ);
     317             :     }
     318           0 :   ci->subject_dn = ksba_cert_get_subject (cert, 0);
     319           0 :   ci->flags.loaded  = !!is_loaded;
     320           0 :   ci->flags.trusted = !!is_trusted;
     321             : 
     322           0 :   if (is_loaded)
     323           0 :     total_loaded_certificates++;
     324             :   else
     325           0 :     total_extra_certificates++;
     326             : 
     327           0 :   return 0;
     328             : }
     329             : 
     330             : 
     331             : /* Load certificates from the directory DIRNAME.  All certificates
     332             :    matching the pattern "*.crt" or "*.der"  are loaded.  We assume that
     333             :    certificates are DER encoded and not PEM encapsulated. The cache
     334             :    should be in a locked state when calling this function.  */
     335             : static gpg_error_t
     336           0 : load_certs_from_dir (const char *dirname, int are_trusted)
     337             : {
     338             :   gpg_error_t err;
     339             :   DIR *dir;
     340             :   struct dirent *ep;
     341             :   char *p;
     342             :   size_t n;
     343             :   estream_t fp;
     344             :   ksba_reader_t reader;
     345             :   ksba_cert_t cert;
     346           0 :   char *fname = NULL;
     347             : 
     348           0 :   dir = opendir (dirname);
     349           0 :   if (!dir)
     350             :     {
     351           0 :       return 0; /* We do not consider this a severe error.  */
     352             :     }
     353             : 
     354           0 :   while ( (ep=readdir (dir)) )
     355             :     {
     356           0 :       p = ep->d_name;
     357           0 :       if (*p == '.' || !*p)
     358           0 :         continue; /* Skip any hidden files and invalid entries.  */
     359           0 :       n = strlen (p);
     360           0 :       if ( n < 5 || (strcmp (p+n-4,".crt") && strcmp (p+n-4,".der")))
     361           0 :         continue; /* Not the desired "*.crt" or "*.der" pattern.  */
     362             : 
     363           0 :       xfree (fname);
     364           0 :       fname = make_filename (dirname, p, NULL);
     365           0 :       fp = es_fopen (fname, "rb");
     366           0 :       if (!fp)
     367             :         {
     368           0 :           log_error (_("can't open '%s': %s\n"),
     369           0 :                      fname, strerror (errno));
     370           0 :           continue;
     371             :         }
     372             : 
     373           0 :       err = create_estream_ksba_reader (&reader, fp);
     374           0 :       if (err)
     375             :         {
     376           0 :           es_fclose (fp);
     377           0 :           continue;
     378             :         }
     379             : 
     380           0 :       err = ksba_cert_new (&cert);
     381           0 :       if (!err)
     382           0 :         err = ksba_cert_read_der (cert, reader);
     383           0 :       ksba_reader_release (reader);
     384           0 :       es_fclose (fp);
     385           0 :       if (err)
     386             :         {
     387           0 :           log_error (_("can't parse certificate '%s': %s\n"),
     388             :                      fname, gpg_strerror (err));
     389           0 :           ksba_cert_release (cert);
     390           0 :           continue;
     391             :         }
     392             : 
     393           0 :       err = put_cert (cert, 1, are_trusted, NULL);
     394           0 :       if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
     395           0 :         log_info (_("certificate '%s' already cached\n"), fname);
     396           0 :       else if (!err)
     397             :         {
     398           0 :           if (are_trusted)
     399           0 :             log_info (_("trusted certificate '%s' loaded\n"), fname);
     400             :           else
     401           0 :             log_info (_("certificate '%s' loaded\n"), fname);
     402           0 :           if (opt.verbose)
     403             :             {
     404           0 :               p = get_fingerprint_hexstring_colon (cert);
     405           0 :               log_info (_("  SHA1 fingerprint = %s\n"), p);
     406           0 :               xfree (p);
     407             : 
     408           0 :               cert_log_name (_("   issuer ="), cert);
     409           0 :               cert_log_subject (_("  subject ="), cert);
     410             :             }
     411             :         }
     412             :       else
     413           0 :         log_error (_("error loading certificate '%s': %s\n"),
     414             :                      fname, gpg_strerror (err));
     415           0 :       ksba_cert_release (cert);
     416             :     }
     417             : 
     418           0 :   xfree (fname);
     419           0 :   closedir (dir);
     420           0 :   return 0;
     421             : }
     422             : 
     423             : 
     424             : /* Initialize the certificate cache if not yet done.  */
     425             : void
     426           0 : cert_cache_init (void)
     427             : {
     428             :   char *dname;
     429             : 
     430           0 :   if (initialization_done)
     431           0 :     return;
     432           0 :   init_cache_lock ();
     433           0 :   acquire_cache_write_lock ();
     434             : 
     435           0 :   dname = make_filename (gnupg_sysconfdir (), "trusted-certs", NULL);
     436           0 :   load_certs_from_dir (dname, 1);
     437           0 :   xfree (dname);
     438             : 
     439           0 :   dname = make_filename (gnupg_sysconfdir (), "extra-certs", NULL);
     440           0 :   load_certs_from_dir (dname, 0);
     441           0 :   xfree (dname);
     442             : 
     443           0 :   initialization_done = 1;
     444           0 :   release_cache_lock ();
     445             : 
     446           0 :   cert_cache_print_stats ();
     447             : }
     448             : 
     449             : /* Deinitialize the certificate cache.  With FULL set to true even the
     450             :    unused certificate slots are released. */
     451             : void
     452           0 : cert_cache_deinit (int full)
     453             : {
     454             :   cert_item_t ci, ci2;
     455             :   int i;
     456             : 
     457           0 :   if (!initialization_done)
     458           0 :     return;
     459             : 
     460           0 :   acquire_cache_write_lock ();
     461             : 
     462           0 :   for (i=0; i < 256; i++)
     463           0 :     for (ci=cert_cache[i]; ci; ci = ci->next)
     464           0 :       clean_cache_slot (ci);
     465             : 
     466           0 :   if (full)
     467             :     {
     468           0 :       for (i=0; i < 256; i++)
     469             :         {
     470           0 :           for (ci=cert_cache[i]; ci; ci = ci2)
     471             :             {
     472           0 :               ci2 = ci->next;
     473           0 :               xfree (ci);
     474             :             }
     475           0 :           cert_cache[i] = NULL;
     476             :         }
     477             :     }
     478             : 
     479           0 :   total_loaded_certificates = 0;
     480           0 :   total_extra_certificates = 0;
     481           0 :   initialization_done = 0;
     482           0 :   release_cache_lock ();
     483             : }
     484             : 
     485             : /* Print some statistics to the log file.  */
     486             : void
     487           0 : cert_cache_print_stats (void)
     488             : {
     489           0 :   log_info (_("permanently loaded certificates: %u\n"),
     490             :             total_loaded_certificates);
     491           0 :   log_info (_("    runtime cached certificates: %u\n"),
     492             :             total_extra_certificates);
     493           0 : }
     494             : 
     495             : 
     496             : /* Put CERT into the certificate cache.  */
     497             : gpg_error_t
     498           0 : cache_cert (ksba_cert_t cert)
     499             : {
     500             :   gpg_error_t err;
     501             : 
     502           0 :   acquire_cache_write_lock ();
     503           0 :   err = put_cert (cert, 0, 0, NULL);
     504           0 :   release_cache_lock ();
     505           0 :   if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
     506           0 :     log_info (_("certificate already cached\n"));
     507           0 :   else if (!err)
     508           0 :     log_info (_("certificate cached\n"));
     509             :   else
     510           0 :     log_error (_("error caching certificate: %s\n"), gpg_strerror (err));
     511           0 :   return err;
     512             : }
     513             : 
     514             : 
     515             : /* Put CERT into the certificate cache and store the fingerprint of
     516             :    the certificate into FPR_BUFFER.  If the certificate is already in
     517             :    the cache do not print a warning; just store the
     518             :    fingerprint. FPR_BUFFER needs to be at least 20 bytes. */
     519             : gpg_error_t
     520           0 : cache_cert_silent (ksba_cert_t cert, void *fpr_buffer)
     521             : {
     522             :   gpg_error_t err;
     523             : 
     524           0 :   acquire_cache_write_lock ();
     525           0 :   err = put_cert (cert, 0, 0, fpr_buffer);
     526           0 :   release_cache_lock ();
     527           0 :   if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
     528           0 :     err = 0;
     529           0 :   if (err)
     530           0 :     log_error (_("error caching certificate: %s\n"), gpg_strerror (err));
     531           0 :   return err;
     532             : }
     533             : 
     534             : 
     535             : 
     536             : /* Return a certificate object for the given fingerprint.  FPR is
     537             :    expected to be a 20 byte binary SHA-1 fingerprint.  If no matching
     538             :    certificate is available in the cache NULL is returned.  The caller
     539             :    must release a returned certificate.  Note that although we are
     540             :    using reference counting the caller should not just compare the
     541             :    pointers to check for identical certificates. */
     542             : ksba_cert_t
     543           0 : get_cert_byfpr (const unsigned char *fpr)
     544             : {
     545             :   cert_item_t ci;
     546             : 
     547           0 :   acquire_cache_read_lock ();
     548           0 :   for (ci=cert_cache[*fpr]; ci; ci = ci->next)
     549           0 :     if (ci->cert && !memcmp (ci->fpr, fpr, 20))
     550             :       {
     551           0 :         ksba_cert_ref (ci->cert);
     552           0 :         release_cache_lock ();
     553           0 :         return ci->cert;
     554             :       }
     555             : 
     556           0 :   release_cache_lock ();
     557           0 :   return NULL;
     558             : }
     559             : 
     560             : /* Return a certificate object for the given fingerprint.  STRING is
     561             :    expected to be a SHA-1 fingerprint in standard hex notation with or
     562             :    without colons.  If no matching certificate is available in the
     563             :    cache NULL is returned.  The caller must release a returned
     564             :    certificate.  Note that although we are using reference counting
     565             :    the caller should not just compare the pointers to check for
     566             :    identical certificates. */
     567             : ksba_cert_t
     568           0 : get_cert_byhexfpr (const char *string)
     569             : {
     570             :   unsigned char fpr[20];
     571             :   const char *s;
     572             :   int i;
     573             : 
     574           0 :   if (strchr (string, ':'))
     575             :     {
     576           0 :       for (s=string,i=0; i < 20 && hexdigitp (s) && hexdigitp(s+1);)
     577             :         {
     578           0 :           if (s[2] && s[2] != ':')
     579           0 :             break; /* Invalid string. */
     580           0 :           fpr[i++] = xtoi_2 (s);
     581           0 :           s += 2;
     582           0 :           if (i!= 20 && *s == ':')
     583           0 :             s++;
     584             :         }
     585             :     }
     586             :   else
     587             :     {
     588           0 :       for (s=string,i=0; i < 20 && hexdigitp (s) && hexdigitp(s+1); s+=2 )
     589           0 :         fpr[i++] = xtoi_2 (s);
     590             :     }
     591           0 :   if (i!=20 || *s)
     592             :     {
     593           0 :       log_error (_("invalid SHA1 fingerprint string '%s'\n"), string);
     594           0 :       return NULL;
     595             :     }
     596             : 
     597           0 :   return get_cert_byfpr (fpr);
     598             : }
     599             : 
     600             : 
     601             : 
     602             : /* Return the certificate matching ISSUER_DN and SERIALNO.  */
     603             : ksba_cert_t
     604           0 : get_cert_bysn (const char *issuer_dn, ksba_sexp_t serialno)
     605             : {
     606             :   /* Simple and inefficient implementation.   fixme! */
     607             :   cert_item_t ci;
     608             :   int i;
     609             : 
     610           0 :   acquire_cache_read_lock ();
     611           0 :   for (i=0; i < 256; i++)
     612             :     {
     613           0 :       for (ci=cert_cache[i]; ci; ci = ci->next)
     614           0 :         if (ci->cert && !strcmp (ci->issuer_dn, issuer_dn)
     615           0 :             && !compare_serialno (ci->sn, serialno))
     616             :           {
     617           0 :             ksba_cert_ref (ci->cert);
     618           0 :             release_cache_lock ();
     619           0 :             return ci->cert;
     620             :           }
     621             :     }
     622             : 
     623           0 :   release_cache_lock ();
     624           0 :   return NULL;
     625             : }
     626             : 
     627             : 
     628             : /* Return the certificate matching ISSUER_DN.  SEQ should initially be
     629             :    set to 0 and bumped up to get the next issuer with that DN. */
     630             : ksba_cert_t
     631           0 : get_cert_byissuer (const char *issuer_dn, unsigned int seq)
     632             : {
     633             :   /* Simple and very inefficient implementation and API.  fixme! */
     634             :   cert_item_t ci;
     635             :   int i;
     636             : 
     637           0 :   acquire_cache_read_lock ();
     638           0 :   for (i=0; i < 256; i++)
     639             :     {
     640           0 :       for (ci=cert_cache[i]; ci; ci = ci->next)
     641           0 :         if (ci->cert && !strcmp (ci->issuer_dn, issuer_dn))
     642           0 :           if (!seq--)
     643             :             {
     644           0 :               ksba_cert_ref (ci->cert);
     645           0 :               release_cache_lock ();
     646           0 :               return ci->cert;
     647             :             }
     648             :     }
     649             : 
     650           0 :   release_cache_lock ();
     651           0 :   return NULL;
     652             : }
     653             : 
     654             : 
     655             : /* Return the certificate matching SUBJECT_DN.  SEQ should initially be
     656             :    set to 0 and bumped up to get the next subject with that DN. */
     657             : ksba_cert_t
     658           0 : get_cert_bysubject (const char *subject_dn, unsigned int seq)
     659             : {
     660             :   /* Simple and very inefficient implementation and API.  fixme! */
     661             :   cert_item_t ci;
     662             :   int i;
     663             : 
     664           0 :   if (!subject_dn)
     665           0 :     return NULL;
     666             : 
     667           0 :   acquire_cache_read_lock ();
     668           0 :   for (i=0; i < 256; i++)
     669             :     {
     670           0 :       for (ci=cert_cache[i]; ci; ci = ci->next)
     671           0 :         if (ci->cert && ci->subject_dn
     672           0 :             && !strcmp (ci->subject_dn, subject_dn))
     673           0 :           if (!seq--)
     674             :             {
     675           0 :               ksba_cert_ref (ci->cert);
     676           0 :               release_cache_lock ();
     677           0 :               return ci->cert;
     678             :             }
     679             :     }
     680             : 
     681           0 :   release_cache_lock ();
     682           0 :   return NULL;
     683             : }
     684             : 
     685             : 
     686             : 
     687             : /* Return a value describing the the class of PATTERN.  The offset of
     688             :    the actual string to be used for the comparison is stored at
     689             :    R_OFFSET.  The offset of the serialnumer is stored at R_SN_OFFSET. */
     690             : static enum pattern_class
     691           0 : classify_pattern (const char *pattern, size_t *r_offset, size_t *r_sn_offset)
     692             : {
     693             :   enum pattern_class result;
     694             :   const char *s;
     695           0 :   int hexprefix = 0;
     696             :   int hexlength;
     697             : 
     698           0 :   *r_offset = *r_sn_offset = 0;
     699             : 
     700             :   /* Skip leading spaces. */
     701           0 :   for(s = pattern; *s && spacep (s); s++ )
     702             :     ;
     703             : 
     704           0 :   switch (*s)
     705             :     {
     706             :     case 0:  /* Empty string is an error. */
     707           0 :       result = PATTERN_UNKNOWN;
     708           0 :       break;
     709             : 
     710             :     case '.': /* An email address, compare from end.  */
     711           0 :       result = PATTERN_UNKNOWN;  /* Not implemented.  */
     712           0 :       break;
     713             : 
     714             :     case '<': /* An email address.  */
     715           0 :       result = PATTERN_EMAIL;
     716           0 :       s++;
     717           0 :       break;
     718             : 
     719             :     case '@': /* Part of an email address.  */
     720           0 :       result = PATTERN_EMAIL_SUBSTR;
     721           0 :       s++;
     722           0 :       break;
     723             : 
     724             :     case '=':  /* Exact compare. */
     725           0 :       result = PATTERN_UNKNOWN; /* Does not make sense for X.509.  */
     726           0 :       break;
     727             : 
     728             :     case '*':  /* Case insensitive substring search.  */
     729           0 :       result = PATTERN_SUBSTR;
     730           0 :       s++;
     731           0 :       break;
     732             : 
     733             :     case '+':  /* Compare individual words. */
     734           0 :       result = PATTERN_UNKNOWN;  /* Not implemented.  */
     735           0 :       break;
     736             : 
     737             :     case '/': /* Subject's DN. */
     738           0 :       s++;
     739           0 :       if (!*s || spacep (s))
     740           0 :         result = PATTERN_UNKNOWN; /* No DN or prefixed with a space. */
     741             :       else
     742           0 :         result = PATTERN_SUBJECT;
     743           0 :       break;
     744             : 
     745             :     case '#': /* Serial number or issuer DN. */
     746             :       {
     747             :         const char *si;
     748             : 
     749           0 :         s++;
     750           0 :         if ( *s == '/')
     751             :           {
     752             :             /* An issuer's DN is indicated by "#/" */
     753           0 :             s++;
     754           0 :             if (!*s || spacep (s))
     755           0 :               result = PATTERN_UNKNOWN; /* No DN or prefixed with a space. */
     756             :             else
     757           0 :               result = PATTERN_ISSUER;
     758             :           }
     759             :         else
     760             :           { /* Serialnumber + optional issuer ID. */
     761           0 :             for (si=s; *si && *si != '/'; si++)
     762           0 :               if (!strchr("01234567890abcdefABCDEF", *si))
     763           0 :                 break;
     764           0 :             if (*si && *si != '/')
     765           0 :               result = PATTERN_UNKNOWN; /* Invalid digit in serial number. */
     766             :             else
     767             :               {
     768           0 :                 *r_sn_offset = s - pattern;
     769           0 :                 if (!*si)
     770           0 :                   result = PATTERN_SERIALNO;
     771             :                 else
     772             :                   {
     773           0 :                     s = si+1;
     774           0 :                     if (!*s || spacep (s))
     775           0 :                       result = PATTERN_UNKNOWN; /* No DN or prefixed
     776             :                                                    with a space. */
     777             :                     else
     778           0 :                       result = PATTERN_SERIALNO_ISSUER;
     779             :                   }
     780             :               }
     781             :           }
     782             :       }
     783           0 :       break;
     784             : 
     785             :     case ':': /* Unified fingerprint. */
     786             :       {
     787             :         const char *se, *si;
     788             :         int i;
     789             : 
     790           0 :         se = strchr (++s, ':');
     791           0 :         if (!se)
     792           0 :           result = PATTERN_UNKNOWN;
     793             :         else
     794             :           {
     795           0 :             for (i=0, si=s; si < se; si++, i++ )
     796           0 :               if (!strchr("01234567890abcdefABCDEF", *si))
     797           0 :                 break;
     798           0 :             if ( si < se )
     799           0 :               result = PATTERN_UNKNOWN; /* Invalid digit. */
     800           0 :             else if (i == 32)
     801           0 :               result = PATTERN_FINGERPRINT16;
     802           0 :             else if (i == 40)
     803           0 :               result = PATTERN_FINGERPRINT20;
     804             :             else
     805           0 :               result = PATTERN_UNKNOWN; /* Invalid length for a fingerprint. */
     806             :           }
     807             :       }
     808           0 :       break;
     809             : 
     810             :     case '&': /* Keygrip. */
     811           0 :       result = PATTERN_UNKNOWN;  /* Not implemented.  */
     812           0 :       break;
     813             : 
     814             :     default:
     815           0 :       if (s[0] == '0' && s[1] == 'x')
     816             :         {
     817           0 :           hexprefix = 1;
     818           0 :           s += 2;
     819             :         }
     820             : 
     821           0 :       hexlength = strspn(s, "0123456789abcdefABCDEF");
     822             : 
     823             :       /* Check if a hexadecimal number is terminated by EOS or blank. */
     824           0 :       if (hexlength && s[hexlength] && !spacep (s+hexlength))
     825             :         {
     826             :           /* If the "0x" prefix is used a correct termination is required. */
     827           0 :           if (hexprefix)
     828             :             {
     829           0 :               result = PATTERN_UNKNOWN;
     830           0 :               break; /* switch */
     831             :             }
     832           0 :           hexlength = 0;  /* Not a hex number.  */
     833             :         }
     834             : 
     835           0 :       if (hexlength == 8 || (!hexprefix && hexlength == 9 && *s == '0'))
     836             :         {
     837           0 :           if (hexlength == 9)
     838           0 :             s++;
     839           0 :           result = PATTERN_SHORT_KEYID;
     840             :         }
     841           0 :       else if (hexlength == 16 || (!hexprefix && hexlength == 17 && *s == '0'))
     842             :         {
     843           0 :           if (hexlength == 17)
     844           0 :             s++;
     845           0 :           result = PATTERN_LONG_KEYID;
     846             :         }
     847           0 :       else if (hexlength == 32 || (!hexprefix && hexlength == 33 && *s == '0'))
     848             :         {
     849           0 :           if (hexlength == 33)
     850           0 :             s++;
     851           0 :           result = PATTERN_FINGERPRINT16;
     852             :         }
     853           0 :       else if (hexlength == 40 || (!hexprefix && hexlength == 41 && *s == '0'))
     854             :         {
     855           0 :           if (hexlength == 41)
     856           0 :             s++;
     857           0 :           result = PATTERN_FINGERPRINT20;
     858             :         }
     859           0 :       else if (!hexprefix)
     860             :         {
     861             :           /* The fingerprints used with X.509 are often delimited by
     862             :              colons, so we try to single this case out. */
     863           0 :           result = PATTERN_UNKNOWN;
     864           0 :           hexlength = strspn (s, ":0123456789abcdefABCDEF");
     865           0 :           if (hexlength == 59 && (!s[hexlength] || spacep (s+hexlength)))
     866             :             {
     867             :               int i, c;
     868             : 
     869           0 :               for (i=0; i < 20; i++, s += 3)
     870             :                 {
     871           0 :                   c = hextobyte(s);
     872           0 :                   if (c == -1 || (i < 19 && s[2] != ':'))
     873             :                     break;
     874             :                 }
     875           0 :               if (i == 20)
     876           0 :                 result = PATTERN_FINGERPRINT20;
     877             :             }
     878           0 :           if (result == PATTERN_UNKNOWN) /* Default to substring match. */
     879             :             {
     880           0 :               result = PATTERN_SUBSTR;
     881             :             }
     882             :         }
     883             :       else /* A hex number with a prefix but with a wrong length.  */
     884           0 :         result = PATTERN_UNKNOWN;
     885             :     }
     886             : 
     887           0 :   if (result != PATTERN_UNKNOWN)
     888           0 :     *r_offset = s - pattern;
     889           0 :   return result;
     890             : }
     891             : 
     892             : 
     893             : 
     894             : /* Given PATTERN, which is a string as used by GnuPG to specify a
     895             :    certificate, return all matching certificates by calling the
     896             :    supplied function RETFNC.  */
     897             : gpg_error_t
     898           0 : get_certs_bypattern (const char *pattern,
     899             :                      gpg_error_t (*retfnc)(void*,ksba_cert_t),
     900             :                      void *retfnc_data)
     901             : {
     902           0 :   gpg_error_t err = GPG_ERR_BUG;
     903             :   enum pattern_class class;
     904             :   size_t offset, sn_offset;
     905             :   const char *hexserialno;
     906           0 :   ksba_sexp_t serialno = NULL;
     907           0 :   ksba_cert_t cert = NULL;
     908             :   unsigned int seq;
     909             : 
     910           0 :   if (!pattern || !retfnc)
     911           0 :     return gpg_error (GPG_ERR_INV_ARG);
     912             : 
     913           0 :   class = classify_pattern (pattern, &offset, &sn_offset);
     914           0 :   hexserialno = pattern + sn_offset;
     915           0 :   pattern += offset;
     916           0 :   switch (class)
     917             :     {
     918             :     case PATTERN_UNKNOWN:
     919           0 :       err = gpg_error (GPG_ERR_INV_NAME);
     920           0 :       break;
     921             : 
     922             :     case PATTERN_FINGERPRINT20:
     923           0 :       cert = get_cert_byhexfpr (pattern);
     924           0 :       err = cert? 0 : gpg_error (GPG_ERR_NOT_FOUND);
     925           0 :       break;
     926             : 
     927             :     case PATTERN_SERIALNO_ISSUER:
     928           0 :       serialno = hexsn_to_sexp (hexserialno);
     929           0 :       if (!serialno)
     930           0 :         err = gpg_error_from_syserror ();
     931             :       else
     932             :         {
     933           0 :           cert = get_cert_bysn (pattern, serialno);
     934           0 :           err = cert? 0 : gpg_error (GPG_ERR_NOT_FOUND);
     935             :         }
     936           0 :       break;
     937             : 
     938             :     case PATTERN_ISSUER:
     939           0 :       for (seq=0,err=0; !err && (cert = get_cert_byissuer (pattern, seq)); seq++)
     940             :         {
     941           0 :           err = retfnc (retfnc_data, cert);
     942           0 :           ksba_cert_release (cert);
     943           0 :           cert = NULL;
     944             :         }
     945           0 :       if (!err && !seq)
     946           0 :         err = gpg_error (GPG_ERR_NOT_FOUND);
     947           0 :       break;
     948             : 
     949             :     case PATTERN_SUBJECT:
     950           0 :       for (seq=0,err=0; !err && (cert = get_cert_bysubject (pattern, seq));seq++)
     951             :         {
     952           0 :           err = retfnc (retfnc_data, cert);
     953           0 :           ksba_cert_release (cert);
     954           0 :           cert = NULL;
     955             :         }
     956           0 :       if (!err && !seq)
     957           0 :         err = gpg_error (GPG_ERR_NOT_FOUND);
     958           0 :       break;
     959             : 
     960             :     case PATTERN_EMAIL:
     961             :     case PATTERN_EMAIL_SUBSTR:
     962             :     case PATTERN_FINGERPRINT16:
     963             :     case PATTERN_SHORT_KEYID:
     964             :     case PATTERN_LONG_KEYID:
     965             :     case PATTERN_SUBSTR:
     966             :     case PATTERN_SERIALNO:
     967             :       /* Not supported.  */
     968           0 :       err = gpg_error (GPG_ERR_INV_NAME);
     969             :     }
     970             : 
     971             : 
     972           0 :   if (!err && cert)
     973           0 :     err = retfnc (retfnc_data, cert);
     974           0 :   ksba_cert_release (cert);
     975           0 :   xfree (serialno);
     976           0 :   return err;
     977             : }
     978             : 
     979             : 
     980             : 
     981             : 
     982             : 
     983             : /* Return the certificate matching ISSUER_DN and SERIALNO; if it is
     984             :    not already in the cache, try to find it from other resources.  */
     985             : ksba_cert_t
     986           0 : find_cert_bysn (ctrl_t ctrl, const char *issuer_dn, ksba_sexp_t serialno)
     987             : {
     988             :   gpg_error_t err;
     989             :   ksba_cert_t cert;
     990           0 :   cert_fetch_context_t context = NULL;
     991             :   char *hexsn, *buf;
     992             : 
     993             :   /* First check whether it has already been cached.  */
     994           0 :   cert = get_cert_bysn (issuer_dn, serialno);
     995           0 :   if (cert)
     996           0 :     return cert;
     997             : 
     998             :   /* Ask back to the service requester to return the certificate.
     999             :      This is because we can assume that he already used the
    1000             :      certificate while checking for the CRL. */
    1001           0 :   hexsn = serial_hex (serialno);
    1002           0 :   if (!hexsn)
    1003             :     {
    1004           0 :       log_error ("serial_hex() failed\n");
    1005           0 :       return NULL;
    1006             :     }
    1007           0 :   buf = xtrymalloc (1 + strlen (hexsn) + 1 + strlen (issuer_dn) + 1);
    1008           0 :   if (!buf)
    1009             :     {
    1010           0 :       log_error ("can't allocate enough memory: %s\n", strerror (errno));
    1011           0 :       xfree (hexsn);
    1012           0 :       return NULL;
    1013             :     }
    1014           0 :   strcpy (stpcpy (stpcpy (stpcpy (buf, "#"), hexsn),"/"), issuer_dn);
    1015           0 :   xfree (hexsn);
    1016           0 :   cert = get_cert_local (ctrl, buf);
    1017           0 :   xfree (buf);
    1018           0 :   if (cert)
    1019             :     {
    1020           0 :       cache_cert (cert);
    1021           0 :       return cert; /* Done. */
    1022             :     }
    1023             : 
    1024           0 :   if (DBG_LOOKUP)
    1025           0 :     log_debug ("find_cert_bysn: certificate not returned by caller"
    1026             :                " - doing lookup\n");
    1027             : 
    1028             :   /* Retrieve the certificate from external resources. */
    1029           0 :   while (!cert)
    1030             :     {
    1031             :       ksba_sexp_t sn;
    1032             :       char *issdn;
    1033             : 
    1034           0 :       if (!context)
    1035             :         {
    1036           0 :           err = ca_cert_fetch (ctrl, &context, issuer_dn);
    1037           0 :           if (err)
    1038             :             {
    1039           0 :               log_error (_("error fetching certificate by S/N: %s\n"),
    1040             :                          gpg_strerror (err));
    1041           0 :               break;
    1042             :             }
    1043             :         }
    1044             : 
    1045           0 :       err = fetch_next_ksba_cert (context, &cert);
    1046           0 :       if (err)
    1047             :         {
    1048           0 :           log_error (_("error fetching certificate by S/N: %s\n"),
    1049             :                      gpg_strerror (err) );
    1050           0 :           break;
    1051             :         }
    1052             : 
    1053           0 :       issdn = ksba_cert_get_issuer (cert, 0);
    1054           0 :       if (strcmp (issuer_dn, issdn))
    1055             :         {
    1056           0 :           log_debug ("find_cert_bysn: Ooops: issuer DN does not match\n");
    1057           0 :           ksba_cert_release (cert);
    1058           0 :           cert = NULL;
    1059           0 :           ksba_free (issdn);
    1060           0 :           break;
    1061             :         }
    1062             : 
    1063           0 :       sn = ksba_cert_get_serial (cert);
    1064             : 
    1065           0 :       if (DBG_LOOKUP)
    1066             :         {
    1067           0 :           log_debug ("   considering certificate (#");
    1068           0 :           dump_serial (sn);
    1069           0 :           log_printf ("/");
    1070           0 :           dump_string (issdn);
    1071           0 :           log_printf (")\n");
    1072             :         }
    1073             : 
    1074           0 :       if (!compare_serialno (serialno, sn))
    1075             :         {
    1076           0 :           ksba_free (sn);
    1077           0 :           ksba_free (issdn);
    1078           0 :           cache_cert (cert);
    1079           0 :           if (DBG_LOOKUP)
    1080           0 :             log_debug ("   found\n");
    1081           0 :           break; /* Ready.  */
    1082             :         }
    1083             : 
    1084           0 :       ksba_free (sn);
    1085           0 :       ksba_free (issdn);
    1086           0 :       ksba_cert_release (cert);
    1087           0 :       cert = NULL;
    1088             :     }
    1089             : 
    1090           0 :   end_cert_fetch (context);
    1091           0 :   return cert;
    1092             : }
    1093             : 
    1094             : 
    1095             : /* Return the certificate matching SUBJECT_DN and (if not NULL)
    1096             :    KEYID. If it is not already in the cache, try to find it from other
    1097             :    resources.  Note, that the external search does not work for user
    1098             :    certificates because the LDAP lookup is on the caCertificate
    1099             :    attribute. For our purposes this is just fine.  */
    1100             : ksba_cert_t
    1101           0 : find_cert_bysubject (ctrl_t ctrl, const char *subject_dn, ksba_sexp_t keyid)
    1102             : {
    1103             :   gpg_error_t err;
    1104             :   int seq;
    1105           0 :   ksba_cert_t cert = NULL;
    1106           0 :   cert_fetch_context_t context = NULL;
    1107             :   ksba_sexp_t subj;
    1108             : 
    1109             :   /* If we have certificates from an OCSP request we first try to use
    1110             :      them.  This is because these certificates will really be the
    1111             :      required ones and thus even in the case that they can't be
    1112             :      uniquely located by the following code we can use them.  This is
    1113             :      for example required by Telesec certificates where a keyId is
    1114             :      used but the issuer certificate comes without a subject keyId! */
    1115           0 :   if (ctrl->ocsp_certs && subject_dn)
    1116             :     {
    1117             :       cert_item_t ci;
    1118             :       cert_ref_t cr;
    1119             :       int i;
    1120             : 
    1121             :       /* For efficiency reasons we won't use get_cert_bysubject here. */
    1122           0 :       acquire_cache_read_lock ();
    1123           0 :       for (i=0; i < 256; i++)
    1124           0 :         for (ci=cert_cache[i]; ci; ci = ci->next)
    1125           0 :           if (ci->cert && ci->subject_dn
    1126           0 :               && !strcmp (ci->subject_dn, subject_dn))
    1127           0 :             for (cr=ctrl->ocsp_certs; cr; cr = cr->next)
    1128           0 :               if (!memcmp (ci->fpr, cr->fpr, 20))
    1129             :                 {
    1130           0 :                   ksba_cert_ref (ci->cert);
    1131           0 :                   release_cache_lock ();
    1132           0 :                   return ci->cert; /* We use this certificate. */
    1133             :                 }
    1134           0 :       release_cache_lock ();
    1135           0 :       if (DBG_LOOKUP)
    1136           0 :         log_debug ("find_cert_bysubject: certificate not in ocsp_certs\n");
    1137             :     }
    1138             : 
    1139             : 
    1140             :   /* First we check whether the certificate is cached.  */
    1141           0 :   for (seq=0; (cert = get_cert_bysubject (subject_dn, seq)); seq++)
    1142             :     {
    1143           0 :       if (!keyid)
    1144           0 :         break; /* No keyid requested, so return the first one found. */
    1145           0 :       if (!ksba_cert_get_subj_key_id (cert, NULL, &subj)
    1146           0 :           && !cmp_simple_canon_sexp (keyid, subj))
    1147             :         {
    1148           0 :           xfree (subj);
    1149           0 :           break; /* Found matching cert. */
    1150             :         }
    1151           0 :       xfree (subj);
    1152           0 :       ksba_cert_release (cert);
    1153             :     }
    1154           0 :   if (cert)
    1155           0 :     return cert; /* Done.  */
    1156             : 
    1157           0 :   if (DBG_LOOKUP)
    1158           0 :     log_debug ("find_cert_bysubject: certificate not in cache\n");
    1159             : 
    1160             :   /* Ask back to the service requester to return the certificate.
    1161             :      This is because we can assume that he already used the
    1162             :      certificate while checking for the CRL. */
    1163           0 :   if (keyid)
    1164           0 :     cert = get_cert_local_ski (ctrl, subject_dn, keyid);
    1165             :   else
    1166             :     {
    1167             :       /* In contrast to get_cert_local_ski, get_cert_local uses any
    1168             :          passed pattern, so we need to make sure that an exact subject
    1169             :          search is done. */
    1170             :       char *buf;
    1171             : 
    1172           0 :       buf = xtrymalloc (1 + strlen (subject_dn) + 1);
    1173           0 :       if (!buf)
    1174             :         {
    1175           0 :           log_error ("can't allocate enough memory: %s\n", strerror (errno));
    1176           0 :           return NULL;
    1177             :         }
    1178           0 :       strcpy (stpcpy (buf, "/"), subject_dn);
    1179           0 :       cert = get_cert_local (ctrl, buf);
    1180           0 :       xfree (buf);
    1181             :     }
    1182           0 :   if (cert)
    1183             :     {
    1184           0 :       cache_cert (cert);
    1185           0 :       return cert; /* Done. */
    1186             :     }
    1187             : 
    1188           0 :   if (DBG_LOOKUP)
    1189           0 :     log_debug ("find_cert_bysubject: certificate not returned by caller"
    1190             :                " - doing lookup\n");
    1191             : 
    1192             :   /* Locate the certificate using external resources. */
    1193           0 :   while (!cert)
    1194             :     {
    1195             :       char *subjdn;
    1196             : 
    1197           0 :       if (!context)
    1198             :         {
    1199           0 :           err = ca_cert_fetch (ctrl, &context, subject_dn);
    1200           0 :           if (err)
    1201             :             {
    1202           0 :               log_error (_("error fetching certificate by subject: %s\n"),
    1203             :                          gpg_strerror (err));
    1204           0 :               break;
    1205             :             }
    1206             :         }
    1207             : 
    1208           0 :       err = fetch_next_ksba_cert (context, &cert);
    1209           0 :       if (err)
    1210             :         {
    1211           0 :           log_error (_("error fetching certificate by subject: %s\n"),
    1212             :                      gpg_strerror (err) );
    1213           0 :           break;
    1214             :         }
    1215             : 
    1216           0 :       subjdn = ksba_cert_get_subject (cert, 0);
    1217           0 :       if (strcmp (subject_dn, subjdn))
    1218             :         {
    1219           0 :           log_info ("find_cert_bysubject: subject DN does not match\n");
    1220           0 :           ksba_cert_release (cert);
    1221           0 :           cert = NULL;
    1222           0 :           ksba_free (subjdn);
    1223           0 :           continue;
    1224             :         }
    1225             : 
    1226             : 
    1227           0 :       if (DBG_LOOKUP)
    1228             :         {
    1229           0 :           log_debug ("   considering certificate (/");
    1230           0 :           dump_string (subjdn);
    1231           0 :           log_printf (")\n");
    1232             :         }
    1233           0 :       ksba_free (subjdn);
    1234             : 
    1235             :       /* If no key ID has been provided, we return the first match.  */
    1236           0 :       if (!keyid)
    1237             :         {
    1238           0 :           cache_cert (cert);
    1239           0 :           if (DBG_LOOKUP)
    1240           0 :             log_debug ("   found\n");
    1241           0 :           break; /* Ready.  */
    1242             :         }
    1243             : 
    1244             :       /* With the key ID given we need to compare it.  */
    1245           0 :       if (!ksba_cert_get_subj_key_id (cert, NULL, &subj))
    1246             :         {
    1247           0 :           if (!cmp_simple_canon_sexp (keyid, subj))
    1248             :             {
    1249           0 :               ksba_free (subj);
    1250           0 :               cache_cert (cert);
    1251           0 :               if (DBG_LOOKUP)
    1252           0 :                 log_debug ("   found\n");
    1253           0 :               break; /* Ready.  */
    1254             :             }
    1255             :         }
    1256             : 
    1257           0 :       ksba_free (subj);
    1258           0 :       ksba_cert_release (cert);
    1259           0 :       cert = NULL;
    1260             :     }
    1261             : 
    1262           0 :   end_cert_fetch (context);
    1263           0 :   return cert;
    1264             : }
    1265             : 
    1266             : 
    1267             : 
    1268             : /* Return 0 if the certificate is a trusted certificate. Returns
    1269             :    GPG_ERR_NOT_TRUSTED if it is not trusted or other error codes in
    1270             :    case of systems errors. */
    1271             : gpg_error_t
    1272           0 : is_trusted_cert (ksba_cert_t cert)
    1273             : {
    1274             :   unsigned char fpr[20];
    1275             :   cert_item_t ci;
    1276             : 
    1277           0 :   cert_compute_fpr (cert, fpr);
    1278             : 
    1279           0 :   acquire_cache_read_lock ();
    1280           0 :   for (ci=cert_cache[*fpr]; ci; ci = ci->next)
    1281           0 :     if (ci->cert && !memcmp (ci->fpr, fpr, 20))
    1282             :       {
    1283           0 :         if (ci->flags.trusted)
    1284             :           {
    1285           0 :             release_cache_lock ();
    1286           0 :             return 0; /* Yes, it is trusted. */
    1287             :           }
    1288           0 :         break;
    1289             :       }
    1290             : 
    1291           0 :   release_cache_lock ();
    1292           0 :   return gpg_error (GPG_ERR_NOT_TRUSTED);
    1293             : }
    1294             : 
    1295             : 
    1296             : 
    1297             : /* Given the certificate CERT locate the issuer for this certificate
    1298             :    and return it at R_CERT.  Returns 0 on success or
    1299             :    GPG_ERR_NOT_FOUND.  */
    1300             : gpg_error_t
    1301           0 : find_issuing_cert (ctrl_t ctrl, ksba_cert_t cert, ksba_cert_t *r_cert)
    1302             : {
    1303             :   gpg_error_t err;
    1304             :   char *issuer_dn;
    1305           0 :   ksba_cert_t issuer_cert = NULL;
    1306             :   ksba_name_t authid;
    1307             :   ksba_sexp_t authidno;
    1308             :   ksba_sexp_t keyid;
    1309             : 
    1310           0 :   *r_cert = NULL;
    1311             : 
    1312           0 :   issuer_dn = ksba_cert_get_issuer (cert, 0);
    1313           0 :   if (!issuer_dn)
    1314             :     {
    1315           0 :       log_error (_("no issuer found in certificate\n"));
    1316           0 :       err = gpg_error (GPG_ERR_BAD_CERT);
    1317           0 :       goto leave;
    1318             :     }
    1319             : 
    1320             :   /* First we need to check whether we can return that certificate
    1321             :      using the authorithyKeyIdentifier.  */
    1322           0 :   err = ksba_cert_get_auth_key_id (cert, &keyid, &authid, &authidno);
    1323           0 :   if (err)
    1324             :     {
    1325           0 :       log_info (_("error getting authorityKeyIdentifier: %s\n"),
    1326             :                 gpg_strerror (err));
    1327             :     }
    1328             :   else
    1329             :     {
    1330           0 :       const char *s = ksba_name_enum (authid, 0);
    1331           0 :       if (s && *authidno)
    1332             :         {
    1333           0 :           issuer_cert = find_cert_bysn (ctrl, s, authidno);
    1334             :         }
    1335           0 :       if (!issuer_cert && keyid)
    1336             :         {
    1337             :           /* Not found by issuer+s/n.  Now that we have an AKI
    1338             :              keyIdentifier look for a certificate with a matching
    1339             :              SKI. */
    1340           0 :           issuer_cert = find_cert_bysubject (ctrl, issuer_dn, keyid);
    1341             :         }
    1342             :       /* Print a note so that the user does not feel too helpless when
    1343             :          an issuer certificate was found and gpgsm prints BAD
    1344             :          signature because it is not the correct one. */
    1345           0 :       if (!issuer_cert)
    1346             :         {
    1347           0 :           log_info ("issuer certificate ");
    1348           0 :           if (keyid)
    1349             :             {
    1350           0 :               log_printf ("{");
    1351           0 :               dump_serial (keyid);
    1352           0 :               log_printf ("} ");
    1353             :             }
    1354           0 :           if (authidno)
    1355             :             {
    1356           0 :               log_printf ("(#");
    1357           0 :               dump_serial (authidno);
    1358           0 :               log_printf ("/");
    1359           0 :               dump_string (s);
    1360           0 :               log_printf (") ");
    1361             :             }
    1362           0 :           log_printf ("not found using authorityKeyIdentifier\n");
    1363             :         }
    1364           0 :       ksba_name_release (authid);
    1365           0 :       xfree (authidno);
    1366           0 :       xfree (keyid);
    1367             :     }
    1368             : 
    1369             :   /* If this did not work, try just with the issuer's name and assume
    1370             :      that there is only one such certificate.  We only look into our
    1371             :      cache then. */
    1372           0 :   if (err || !issuer_cert)
    1373             :     {
    1374           0 :       issuer_cert = get_cert_bysubject (issuer_dn, 0);
    1375           0 :       if (issuer_cert)
    1376           0 :         err = 0;
    1377             :     }
    1378             : 
    1379             :  leave:
    1380           0 :   if (!err && !issuer_cert)
    1381           0 :     err = gpg_error (GPG_ERR_NOT_FOUND);
    1382             : 
    1383           0 :   xfree (issuer_dn);
    1384             : 
    1385           0 :   if (err)
    1386           0 :     ksba_cert_release (issuer_cert);
    1387             :   else
    1388           0 :     *r_cert = issuer_cert;
    1389             : 
    1390           0 :   return err;
    1391             : }

Generated by: LCOV version 1.11