Line data    Source code

       1             : /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
       2             : /* vim: set ts=8 sts=2 et sw=2 tw=80: */
       3             : /* This Source Code Form is subject to the terms of the Mozilla Public
       4             :  * License, v. 2.0. If a copy of the MPL was not distributed with this
       5             :  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
       6             : 
       7             : #include "OCSPVerificationTrustDomain.h"
       8             : 
       9             : using namespace mozilla;
      10             : using namespace mozilla::pkix;
      11             : 
      12             : namespace mozilla { namespace psm {
      13             : 
      14           0 : OCSPVerificationTrustDomain::OCSPVerificationTrustDomain(
      15           0 :   NSSCertDBTrustDomain& certDBTrustDomain)
      16           0 :   : mCertDBTrustDomain(certDBTrustDomain)
      17             : {
      18           0 : }
      19             : 
      20             : Result
      21           0 : OCSPVerificationTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA,
      22             :                                           const CertPolicyId& policy,
      23             :                                           Input candidateCertDER,
      24             :                                   /*out*/ TrustLevel& trustLevel)
      25             : {
      26           0 :   return mCertDBTrustDomain.GetCertTrust(endEntityOrCA, policy,
      27           0 :                                          candidateCertDER, trustLevel);
      28             : }
      29             : 
      30             : 
      31             : Result
      32           0 : OCSPVerificationTrustDomain::FindIssuer(Input, IssuerChecker&, Time)
      33             : {
      34             :   // We do not expect this to be called for OCSP signers
      35           0 :   return Result::FATAL_ERROR_LIBRARY_FAILURE;
      36             : }
      37             : 
      38             : Result
      39           0 : OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time,
      40             :                                           const CertPolicyId&)
      41             : {
      42             :   // We do not expect this to be called for OCSP signers
      43           0 :   return Result::FATAL_ERROR_LIBRARY_FAILURE;
      44             : }
      45             : 
      46             : Result
      47           0 : OCSPVerificationTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&,
      48             :                                              Time, Duration, const Input*,
      49             :                                              const Input*)
      50             : {
      51             :   // We do not expect this to be called for OCSP signers
      52           0 :   return Result::FATAL_ERROR_LIBRARY_FAILURE;
      53             : }
      54             : 
      55             : Result
      56           0 : OCSPVerificationTrustDomain::CheckSignatureDigestAlgorithm(
      57             :   DigestAlgorithm aAlg, EndEntityOrCA aEEOrCA, Time notBefore)
      58             : {
      59             :   // The reason for wrapping the NSSCertDBTrustDomain in an
      60             :   // OCSPVerificationTrustDomain is to allow us to bypass the weaker signature
      61             :   // algorithm check - thus all allowable signature digest algorithms should
      62             :   // always be accepted. This is only needed while we gather telemetry on SHA-1.
      63           0 :   return Success;
      64             : }
      65             : 
      66             : Result
      67           0 : OCSPVerificationTrustDomain::CheckRSAPublicKeyModulusSizeInBits(
      68             :   EndEntityOrCA aEEOrCA, unsigned int aModulusSizeInBits)
      69             : {
      70           0 :   return mCertDBTrustDomain.
      71           0 :       CheckRSAPublicKeyModulusSizeInBits(aEEOrCA, aModulusSizeInBits);
      72             : }
      73             : 
      74             : Result
      75           0 : OCSPVerificationTrustDomain::VerifyRSAPKCS1SignedDigest(
      76             :   const SignedDigest& aSignedDigest, Input aSubjectPublicKeyInfo)
      77             : {
      78           0 :   return mCertDBTrustDomain.VerifyRSAPKCS1SignedDigest(aSignedDigest,
      79           0 :                                                        aSubjectPublicKeyInfo);
      80             : }
      81             : 
      82             : Result
      83           0 : OCSPVerificationTrustDomain::CheckECDSACurveIsAcceptable(
      84             :   EndEntityOrCA aEEOrCA, NamedCurve aCurve)
      85             : {
      86           0 :   return mCertDBTrustDomain.CheckECDSACurveIsAcceptable(aEEOrCA, aCurve);
      87             : }
      88             : 
      89             : Result
      90           0 : OCSPVerificationTrustDomain::VerifyECDSASignedDigest(
      91             :   const SignedDigest& aSignedDigest, Input aSubjectPublicKeyInfo)
      92             : {
      93           0 :   return mCertDBTrustDomain.VerifyECDSASignedDigest(aSignedDigest,
      94           0 :                                                     aSubjectPublicKeyInfo);
      95             : }
      96             : 
      97             : Result
      98           0 : OCSPVerificationTrustDomain::CheckValidityIsAcceptable(
      99             :   Time notBefore, Time notAfter, EndEntityOrCA endEntityOrCA,
     100             :   KeyPurposeId keyPurpose)
     101             : {
     102           0 :   return mCertDBTrustDomain.CheckValidityIsAcceptable(notBefore, notAfter,
     103             :                                                       endEntityOrCA,
     104           0 :                                                       keyPurpose);
     105             : }
     106             : 
     107             : Result
     108           0 : OCSPVerificationTrustDomain::NetscapeStepUpMatchesServerAuth(Time notBefore,
     109             :                                                      /*out*/ bool& matches)
     110             : {
     111           0 :   return mCertDBTrustDomain.NetscapeStepUpMatchesServerAuth(notBefore, matches);
     112             : }
     113             : 
     114             : void
     115           0 : OCSPVerificationTrustDomain::NoteAuxiliaryExtension(
     116             :   AuxiliaryExtension extension, Input extensionData)
     117             : {
     118           0 :   mCertDBTrustDomain.NoteAuxiliaryExtension(extension, extensionData);
     119           0 : }
     120             : 
     121             : Result
     122           0 : OCSPVerificationTrustDomain::DigestBuf(
     123             :   Input item, DigestAlgorithm digestAlg,
     124             :   /*out*/ uint8_t* digestBuf, size_t digestBufLen)
     125             : {
     126           0 :   return mCertDBTrustDomain.DigestBuf(item, digestAlg, digestBuf, digestBufLen);
     127             : }
     128             : 
     129             : } } // namespace mozilla::psm