modules/trust-prompt/e-asn1-object.c

   1 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
   2 /* The following is the mozilla license blurb, as the bodies some of
   3  * these functions were derived from the mozilla source. */
   4 /*
   5  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   6  *
   7  * The contents of this file are subject to the Mozilla Public License Version
   8  * 1.1 (the "License"); you may not use this file except in compliance with
   9  * the License. You may obtain a copy of the License at
  10  * http://www.mozilla.org/MPL/
  11  *
  12  * Software distributed under the License is distributed on an "AS IS" basis,
  13  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  14  * for the specific language governing rights and limitations under the
  15  * License.
  16  *
  17  * The Original Code is the Netscape security libraries.
  18  *
  19  * The Initial Developer of the Original Code is
  20  * Netscape Communications Corporation.
  21  * Portions created by the Initial Developer are Copyright (C) 1994-2000
  22  * the Initial Developer. All Rights Reserved.
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either the GNU General Public License Version 2 or later (the "GPL"), or
  26  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  */
  36
  37 /*
  38  * Author: Chris Toshok (toshok@ximian.com)
  39  *
  40  * Copyright (C) 1999-2008 Novell, Inc. (www.novell.com)
  41  */
  42
  43 #ifdef HAVE_CONFIG_H
  44 #include <config.h>
  45 #endif
  46
  47 #include <glib/gi18n.h>
  48
  49 #include "e-asn1-object.h"
  50
  51 #include "pk11func.h"
  52 #include "certdb.h"
  53 #include "hasht.h"
  54
  55 #define E_ASN1_OBJECT_GET_PRIVATE(obj) \
  56         (G_TYPE_INSTANCE_GET_PRIVATE \
  57         ((obj), E_TYPE_ASN1_OBJECT, EASN1ObjectPrivate))
  58
  59 struct _EASN1ObjectPrivate {
  60         PRUint32 tag;
  61         PRUint32 type;
  62         gboolean valid_container;
  63
  64         GList *children;
  65
  66         gchar *display_name;
  67         gchar *value;
  68
  69         gchar *data;
  70         guint data_len;
  71 };
  72
  73 G_DEFINE_TYPE (EASN1Object, e_asn1_object, G_TYPE_OBJECT)
  74
  75 static gboolean
  76 get_int_value (SECItem *versionItem,
  77                gulong *version)
  78 {
  79         SECStatus srv;
  80         srv = SEC_ASN1DecodeInteger (versionItem,version);
  81         if (srv != SECSuccess) {
  82                 g_warning ("could not decode version of cert");
  83                 return FALSE;
  84         }
  85         return TRUE;
  86 }
  87
  88 static gboolean
  89 process_version (SECItem *versionItem,
  90                  EASN1Object **retItem)
  91 {
  92         EASN1Object *item = e_asn1_object_new ();
  93         gulong version;
  94
  95         e_asn1_object_set_display_name (item, _("Version"));
  96
  97         /* Now to figure out what version this certificate is. */
  98
  99         if (versionItem->data) {
 100                 if (!get_int_value (versionItem, &version))
 101                         return FALSE;
 102         } else {
 103                 /* If there is no version present in the cert, then rfc2459
 104                  * says we default to v1 (0) */
 105                 version = 0;
 106         }
 107
 108         switch (version) {
 109         case 0:
 110                 e_asn1_object_set_display_value (item, _("Version 1"));
 111                 break;
 112         case 1:
 113                 e_asn1_object_set_display_value (item, _("Version 2"));
 114                 break;
 115         case 2:
 116                 e_asn1_object_set_display_value (item, _("Version 3"));
 117                 break;
 118         default:
 119                 g_warning ("Bad value for cert version");
 120                 return FALSE;
 121         }
 122
 123         *retItem = item;
 124         return TRUE;
 125 }
 126
 127 static gboolean
 128 process_serial_number_der (SECItem *serialItem,
 129                            EASN1Object **retItem)
 130 {
 131         gchar *serialNumber;
 132         EASN1Object *item = e_asn1_object_new ();
 133
 134         e_asn1_object_set_display_name (item, _("Serial Number"));
 135
 136         serialNumber = CERT_Hexify (serialItem, 1);
 137
 138         e_asn1_object_set_display_value (item, serialNumber);
 139         PORT_Free (serialNumber); /* XXX the right free to use? */
 140
 141         *retItem = item;
 142         return TRUE;
 143 }
 144
 145 static gboolean
 146 get_default_oid_format (SECItem *oid,
 147                         gchar **text)
 148 {
 149         GString *str;
 150         gulong val = oid->data[0];
 151         guint ii = val % 40;
 152
 153         val /= 40;
 154
 155         str = g_string_new ("");
 156         g_string_append_printf (str, "%lu %u ", val, ii);
 157
 158         val = 0;
 159         for (ii = 1; ii < oid->len; ii++) {
 160                 /* In this loop, we have to parse a DER formatted
 161                  * If the first bit is a 1, then the integer is
 162                  * represented by more than one byte.  If the
 163                  * first bit is set then we continue on and add
 164                  * the values of the later bytes until we get
 165                  * a byte without the first bit set.
 166                 */
 167                 gulong jj;
 168
 169                 jj = oid->data[ii];
 170                 val = (val << 7) | (jj & 0x7f);
 171                 if (jj & 0x80)
 172                         continue;
 173                 g_string_append_printf (str, "%lu ", val);
 174
 175                 val = 0;
 176   }
 177
 178   *text = g_string_free (str, FALSE);
 179
 180   return TRUE;
 181 }
 182
 183 static gboolean
 184 get_oid_text (SECItem *oid,
 185               gchar **text)
 186 {
 187         SECOidTag oidTag = SECOID_FindOIDTag (oid);
 188         gchar *temp;
 189
 190         switch (oidTag) {
 191         case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION:
 192                 *text = g_strdup (_("PKCS #1 MD2 With RSA Encryption"));
 193                 break;
 194         case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION:
 195                 *text = g_strdup (_("PKCS #1 MD5 With RSA Encryption"));
 196                 break;
 197         case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION:
 198                 *text = g_strdup (_("PKCS #1 SHA-1 With RSA Encryption"));
 199                 break;
 200         case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION:
 201                 *text = g_strdup (_("PKCS #1 SHA-256 With RSA Encryption"));
 202                 break;
 203         case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION:
 204                 *text = g_strdup (_("PKCS #1 SHA-384 With RSA Encryption"));
 205                 break;
 206         case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:
 207                 *text = g_strdup (_("PKCS #1 SHA-512 With RSA Encryption"));
 208                 break;
 209         case SEC_OID_AVA_COUNTRY_NAME:
 210                 *text = g_strdup ("C");
 211                 break;
 212         case SEC_OID_AVA_COMMON_NAME:
 213                 *text = g_strdup ("CN");
 214                 break;
 215         case SEC_OID_AVA_ORGANIZATIONAL_UNIT_NAME:
 216                 *text = g_strdup ("OU");
 217                 break;
 218         case SEC_OID_AVA_ORGANIZATION_NAME:
 219                 *text = g_strdup ("O");
 220                 break;
 221         case SEC_OID_AVA_LOCALITY:
 222                 *text = g_strdup ("L");
 223                 break;
 224         case SEC_OID_AVA_DN_QUALIFIER:
 225                 *text = g_strdup ("DN");
 226                 break;
 227         case SEC_OID_AVA_DC:
 228                 *text = g_strdup ("DC");
 229                 break;
 230         case SEC_OID_AVA_STATE_OR_PROVINCE:
 231                 *text = g_strdup ("ST");
 232                 break;
 233         case SEC_OID_PKCS1_RSA_ENCRYPTION:
 234                 *text = g_strdup (_("PKCS #1 RSA Encryption"));
 235                 break;
 236         case SEC_OID_X509_KEY_USAGE:
 237                 *text = g_strdup (_("Certificate Key Usage"));
 238                 break;
 239         case SEC_OID_NS_CERT_EXT_CERT_TYPE:
 240                 *text = g_strdup (_("Netscape Certificate Type"));
 241                 break;
 242         case SEC_OID_X509_AUTH_KEY_ID:
 243                 *text = g_strdup (_("Certificate Authority Key Identifier"));
 244                 break;
 245         case SEC_OID_RFC1274_UID:
 246                 *text = g_strdup ("UID");
 247                 break;
 248         case SEC_OID_PKCS9_EMAIL_ADDRESS:
 249                 *text = g_strdup ("E");
 250                 break;
 251         default:
 252                 if (!get_default_oid_format (oid, &temp))
 253                         return FALSE;
 254
 255                 *text = g_strdup_printf (_("Object Identifier (%s)"), temp);
 256                 g_free (temp);
 257
 258                 break;
 259         }
 260         return TRUE;
 261 }
 262
 263 static gboolean
 264 process_raw_bytes (SECItem *data,
 265                    gchar **text)
 266 {
 267         /* This function is used to display some DER bytes
 268          * that we have not added support for decoding.
 269          * It prints the value of the byte out into a
 270          * string that can later be displayed as a byte
 271          * string.  We place a new line after 24 bytes
 272          * to break up extermaly long sequence of bytes.
 273         */
 274         GString *str = g_string_new ("");
 275         PRUint32 i;
 276
 277         for (i = 0; i < data->len; i++) {
 278                 g_string_append_printf (str, "%02x ", data->data[i]);
 279                 if ((i + 1) % 16 == 0) {
 280                         g_string_append (str, "\n");
 281                 }
 282         }
 283         *text = g_string_free (str, FALSE);
 284         return TRUE;
 285 }
 286
 287 static gboolean
 288 process_sec_algorithm_id (SECAlgorithmID *algID,
 289                           EASN1Object **retSequence)
 290 {
 291         EASN1Object *sequence = e_asn1_object_new ();
 292         gchar *text = NULL;
 293
 294         *retSequence = NULL;
 295
 296         get_oid_text (&algID->algorithm, &text);
 297
 298         if (!algID->parameters.len ||
 299                 algID->parameters.data[0] == E_ASN1_OBJECT_TYPE_NULL) {
 300                 e_asn1_object_set_display_value (sequence, text);
 301                 e_asn1_object_set_valid_container (sequence, FALSE);
 302         } else {
 303                 EASN1Object *subitem;
 304
 305                 subitem = e_asn1_object_new ();
 306                 e_asn1_object_set_display_name (subitem, _("Algorithm Identifier"));
 307                 e_asn1_object_set_display_value (subitem, text);
 308                 e_asn1_object_append_child (sequence, subitem);
 309                 g_object_unref (subitem);
 310
 311                 g_free (text);
 312
 313                 subitem = e_asn1_object_new ();
 314                 e_asn1_object_set_display_name (subitem, _("Algorithm Parameters"));
 315                 process_raw_bytes (&algID->parameters, &text);
 316                 e_asn1_object_set_display_value (subitem, text);
 317                 e_asn1_object_append_child (sequence, subitem);
 318                 g_object_unref (subitem);
 319         }
 320
 321         g_free (text);
 322         *retSequence = sequence;
 323         return TRUE;
 324 }
 325
 326 static gboolean
 327 process_subject_public_key_info (CERTSubjectPublicKeyInfo *spki,
 328                                  EASN1Object *parentSequence)
 329 {
 330         EASN1Object *spkiSequence = e_asn1_object_new ();
 331         EASN1Object *sequenceItem;
 332         EASN1Object *printableItem;
 333         SECItem data;
 334         gchar *text = NULL;
 335
 336         e_asn1_object_set_display_name (spkiSequence, _("Subject Public Key Info"));
 337
 338         if (!process_sec_algorithm_id (&spki->algorithm, &sequenceItem))
 339                 return FALSE;
 340
 341         e_asn1_object_set_display_name (sequenceItem, _("Subject Public Key Algorithm"));
 342
 343         e_asn1_object_append_child (spkiSequence, sequenceItem);
 344
 345         /* The subjectPublicKey field is encoded as a bit string.
 346          * ProcessRawBytes expects the lenght to be in bytes, so
 347          * let's convert the lenght into a temporary SECItem.
 348         */
 349         data.data = spki->subjectPublicKey.data;
 350         data.len  = spki->subjectPublicKey.len / 8;
 351
 352         process_raw_bytes (&data, &text);
 353         printableItem = e_asn1_object_new ();
 354
 355         e_asn1_object_set_display_value (printableItem, text);
 356         e_asn1_object_set_display_name (printableItem, _("Subject's Public Key"));
 357         e_asn1_object_append_child (spkiSequence, printableItem);
 358         g_object_unref (printableItem);
 359         g_free (text);
 360
 361         e_asn1_object_append_child (parentSequence, spkiSequence);
 362         g_object_unref (spkiSequence);
 363
 364         return TRUE;
 365 }
 366
 367 static gboolean
 368 process_ns_cert_type_extensions (SECItem *extData,
 369                                  GString *text)
 370 {
 371         SECItem decoded;
 372         guchar nsCertType;
 373
 374         decoded.data = NULL;
 375         decoded.len  = 0;
 376         if (SECSuccess != SEC_ASN1DecodeItem (NULL, &decoded,
 377                                              SEC_ASN1_GET (SEC_BitStringTemplate), extData)) {
 378                 g_string_append (text, _("Error: Unable to process extension"));
 379                 return TRUE;
 380         }
 381
 382         nsCertType = decoded.data[0];
 383
 384         PORT_Free (decoded.data); /* XXX right free? */
 385
 386         if (nsCertType & NS_CERT_TYPE_SSL_CLIENT) {
 387                 g_string_append (text, _("SSL Client Certificate"));
 388                 g_string_append (text, "\n");
 389         }
 390         if (nsCertType & NS_CERT_TYPE_SSL_SERVER) {
 391                 g_string_append (text, _("SSL Server Certificate"));
 392                 g_string_append (text, "\n");
 393         }
 394         if (nsCertType & NS_CERT_TYPE_EMAIL) {
 395                 g_string_append (text, _("Email"));
 396                 g_string_append (text, "\n");
 397         }
 398         if (nsCertType & NS_CERT_TYPE_OBJECT_SIGNING) {
 399                 g_string_append (text, _("Object Signer"));
 400                 g_string_append (text, "\n");
 401         }
 402         if (nsCertType & NS_CERT_TYPE_SSL_CA) {
 403                 g_string_append (text, _("SSL Certificate Authority"));
 404                 g_string_append (text, "\n");
 405         }
 406         if (nsCertType & NS_CERT_TYPE_EMAIL_CA) {
 407                 g_string_append (text, _("Email Certificate Authority"));
 408                 g_string_append (text, "\n");
 409         }
 410         if (nsCertType & NS_CERT_TYPE_OBJECT_SIGNING_CA) {
 411                 g_string_append (text, _("Object Signer"));
 412                 g_string_append (text, "\n");
 413         }
 414         return TRUE;
 415 }
 416
 417 static gboolean
 418 process_key_usage_extensions (SECItem *extData,
 419                               GString *text)
 420 {
 421         SECItem decoded;
 422         guchar keyUsage;
 423
 424         decoded.data = NULL;
 425         decoded.len  = 0;
 426         if (SECSuccess != SEC_ASN1DecodeItem (NULL, &decoded,
 427                                              SEC_ASN1_GET (SEC_BitStringTemplate), extData)) {
 428                 g_string_append (text, _("Error: Unable to process extension"));
 429                 return TRUE;
 430         }
 431
 432         keyUsage = decoded.data[0];
 433         PORT_Free (decoded.data); /* XXX right free? */
 434
 435         if (keyUsage & KU_DIGITAL_SIGNATURE) {
 436                 g_string_append (text, _("Signing"));
 437                 g_string_append (text, "\n");
 438         }
 439         if (keyUsage & KU_NON_REPUDIATION) {
 440                 g_string_append (text, _("Non-repudiation"));
 441                 g_string_append (text, "\n");
 442         }
 443         if (keyUsage & KU_KEY_ENCIPHERMENT) {
 444                 g_string_append (text, _("Key Encipherment"));
 445                 g_string_append (text, "\n");
 446         }
 447         if (keyUsage & KU_DATA_ENCIPHERMENT) {
 448                 g_string_append (text, _("Data Encipherment"));
 449                 g_string_append (text, "\n");
 450         }
 451         if (keyUsage & KU_KEY_AGREEMENT) {
 452                 g_string_append (text, _("Key Agreement"));
 453                 g_string_append (text, "\n");
 454         }
 455         if (keyUsage & KU_KEY_CERT_SIGN) {
 456                 g_string_append (text, _("Certificate Signer"));
 457                 g_string_append (text, "\n");
 458         }
 459         if (keyUsage & KU_CRL_SIGN) {
 460                 g_string_append (text, _("CRL Signer"));
 461                 g_string_append (text, "\n");
 462         }
 463
 464         return TRUE;
 465 }
 466
 467 static gboolean
 468 process_extension_data (SECOidTag oidTag,
 469                         SECItem *extData,
 470                         GString *str)
 471 {
 472         gboolean rv;
 473         switch (oidTag) {
 474         case SEC_OID_NS_CERT_EXT_CERT_TYPE:
 475                 rv = process_ns_cert_type_extensions (extData, str);
 476                 break;
 477         case SEC_OID_X509_KEY_USAGE:
 478                 rv = process_key_usage_extensions (extData, str);
 479                 break;
 480         default: {
 481                 gchar *text;
 482                 rv = process_raw_bytes (extData, &text);
 483                 g_string_append (str, text);
 484                 g_free (text);
 485                 break;
 486         }
 487         }
 488         return rv;
 489 }
 490
 491 static gboolean
 492 process_single_extension (CERTCertExtension *extension,
 493                           EASN1Object **retExtension)
 494 {
 495         GString *str = g_string_new ("");
 496         gchar *text;
 497         EASN1Object *extensionItem;
 498         SECOidTag oidTag = SECOID_FindOIDTag (&extension->id);
 499
 500         get_oid_text (&extension->id, &text);
 501
 502         extensionItem = e_asn1_object_new ();
 503
 504         e_asn1_object_set_display_name (extensionItem, text);
 505         g_free (text);
 506
 507         if (extension->critical.data != NULL) {
 508                 if (extension->critical.data[0]) {
 509                         g_string_append (str, _("Critical"));
 510                 } else {
 511                         g_string_append (str, _("Not Critical"));
 512                 }
 513         } else {
 514                 g_string_append (str, _("Not Critical"));
 515         }
 516         g_string_append (str, "\n");
 517         if (!process_extension_data (oidTag, &extension->value, str)) {
 518                 g_string_free (str, TRUE);
 519                 return FALSE;
 520         }
 521
 522         e_asn1_object_set_display_value (extensionItem, str->str);
 523         g_string_free (str, TRUE);
 524         *retExtension = extensionItem;
 525         return TRUE;
 526 }
 527
 528 static gboolean
 529 process_extensions (CERTCertExtension **extensions,
 530                     EASN1Object *parentSequence)
 531 {
 532         EASN1Object *extensionSequence = e_asn1_object_new ();
 533         PRInt32 i;
 534
 535         e_asn1_object_set_display_name (extensionSequence, _("Extensions"));
 536
 537         for (i = 0; extensions[i] != NULL; i++) {
 538                 EASN1Object *newExtension;
 539
 540                 if (!process_single_extension (extensions[i],
 541                                                &newExtension))
 542                         return FALSE;
 543
 544                 e_asn1_object_append_child (extensionSequence, newExtension);
 545         }
 546         e_asn1_object_append_child (parentSequence, extensionSequence);
 547         return TRUE;
 548 }
 549
 550 static gboolean
 551 process_name (CERTName *name,
 552               gchar **value)
 553 {
 554         CERTRDN ** rdns;
 555         CERTRDN ** rdn;
 556         CERTAVA ** avas;
 557         CERTAVA * ava;
 558         SECItem *decodeItem = NULL;
 559         GString *final_string = g_string_new ("");
 560
 561         gchar *type;
 562         GString *avavalue;
 563         gchar *temp;
 564         CERTRDN **lastRdn;
 565
 566         rdns = name->rdns;
 567
 568         /* find last RDN */
 569         lastRdn = rdns;
 570         while (*lastRdn) lastRdn++;
 571
 572         /* The above whille loop will put us at the last member
 573          * of the array which is a NULL pointer.  So let's back
 574          * up one spot so that we have the last non-NULL entry in
 575          * the array in preparation for traversing the
 576          * RDN's (Relative Distinguished Name) in reverse order.
 577          */
 578         lastRdn--;
 579
 580         /*
 581          * Loop over name contents in _reverse_ RDN order appending to string
 582          * When building the Ascii string, NSS loops over these entries in
 583          * reverse order, so I will as well.  The difference is that NSS
 584          * will always place them in a one line string separated by commas,
 585          * where I want each entry on a single line.  I can't just use a comma
 586          * as my delimitter because it is a valid character to have in the
 587          * value portion of the AVA and could cause trouble when parsing.
 588          */
 589         for (rdn = lastRdn; rdn >= rdns; rdn--) {
 590                 avas = (*rdn)->avas;
 591                 while ((ava = *avas++) != 0) {
 592                         if (!get_oid_text (&ava->type, &type))
 593                                 return FALSE;
 594
 595                         /* This function returns a string in UTF8 format. */
 596                         decodeItem = CERT_DecodeAVAValue (&ava->value);
 597                         if (!decodeItem) {
 598                                 g_free (type);
 599                                 return FALSE;
 600                         }
 601
 602                         avavalue = g_string_new_len (
 603                                 (gchar *) decodeItem->data, decodeItem->len);
 604
 605                         SECITEM_FreeItem (decodeItem, PR_TRUE);
 606
 607                         /* Translators: This string is used in Certificate
 608                          * details for fields like Issuer or Subject, which
 609                          * shows the field name on the left and its respective
 610                          * value on the right, both as stored in the
 611                          * certificate itself.  You probably do not need to
 612                          * change this string, unless changing the order of
 613                          * name and value.  As a result example:
 614                          * "OU = VeriSign Trust Network" */
 615                         temp = g_strdup_printf (_("%s = %s"), type, avavalue->str);
 616
 617                         g_string_append (final_string, temp);
 618                         g_string_append (final_string, "\n");
 619                         g_string_free (avavalue, TRUE);
 620                         g_free (temp);
 621                         g_free (type);
 622                 }
 623         }
 624         *value = g_string_free (final_string, FALSE);
 625         return TRUE;
 626 }
 627
 628 static gboolean
 629 create_tbs_certificate_asn1_struct (CERTCertificate *cert,
 630                                     EASN1Object **seq)
 631 {
 632         /*
 633         **   TBSCertificate  ::=  SEQUENCE  {
 634         **        version         [0]  EXPLICIT Version DEFAULT v1,
 635         **        serialNumber         CertificateSerialNumber,
 636         **        signature            AlgorithmIdentifier,
 637         **        issuer               Name,
 638         **        validity             Validity,
 639         **        subject              Name,
 640         **        subjectPublicKeyInfo SubjectPublicKeyInfo,
 641         **        issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
 642         **                             -- If present, version shall be v2 or v3
 643         **        subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
 644         **                             -- If present, version shall be v2 or v3
 645         **        extensions      [3]  EXPLICIT Extensions OPTIONAL
 646         **                             -- If present, version shall be v3
 647         **        }
 648         **
 649         ** This is the ASN1 structure we should be dealing with at this point.
 650         ** The code in this method will assert this is the structure we're dealing
 651         ** and then add more user friendly text for that field.
 652         */
 653         EASN1Object *sequence = e_asn1_object_new ();
 654         gchar *text;
 655         EASN1Object *subitem;
 656         SECItem data;
 657
 658         e_asn1_object_set_display_name (sequence, _("Certificate"));
 659
 660         if (!process_version (&cert->version, &subitem))
 661                 return FALSE;
 662         e_asn1_object_append_child (sequence, subitem);
 663         g_object_unref (subitem);
 664
 665         if (!process_serial_number_der (&cert->serialNumber, &subitem))
 666                 return FALSE;
 667         e_asn1_object_append_child (sequence, subitem);
 668         g_object_unref (subitem);
 669
 670         if (!process_sec_algorithm_id (&cert->signature, &subitem))
 671                 return FALSE;
 672         e_asn1_object_set_display_name (subitem, _("Certificate Signature Algorithm"));
 673         e_asn1_object_append_child (sequence, subitem);
 674         g_object_unref (subitem);
 675
 676         process_name (&cert->issuer, &text);
 677         subitem = e_asn1_object_new ();
 678         e_asn1_object_set_display_value (subitem, text);
 679         g_free (text);
 680
 681         e_asn1_object_set_display_name (subitem, _("Issuer"));
 682         e_asn1_object_append_child (sequence, subitem);
 683         g_object_unref (subitem);
 684
 685 #ifdef notyet
 686         nsCOMPtr < nsIASN1Sequence> validitySequence = new nsNSSASN1Sequence ();
 687         nssComponent->GetPIPNSSBundleString (NS_LITERAL_STRING ("CertDumpValidity").get (),
 688                                             text);
 689         validitySequence->SetDisplayName (text);
 690         asn1Objects->AppendElement (validitySequence, PR_FALSE);
 691         nssComponent->GetPIPNSSBundleString (NS_LITERAL_STRING ("CertDumpNotBefore").get (),
 692                                             text);
 693         nsCOMPtr < nsIX509CertValidity> validityData;
 694         GetValidity (getter_AddRefs (validityData));
 695         PRTime notBefore, notAfter;
 696
 697         validityData->GetNotBefore (&notBefore);
 698         validityData->GetNotAfter (&notAfter);
 699         validityData = 0;
 700         rv = ProcessTime (notBefore, text.get (), validitySequence);
 701         if (NS_FAILED (rv))
 702                 return rv;
 703
 704         nssComponent->GetPIPNSSBundleString (NS_LITERAL_STRING ("CertDumpNotAfter").get (),
 705                                             text);
 706         rv = ProcessTime (notAfter, text.get (), validitySequence);
 707         if (NS_FAILED (rv))
 708                 return rv;
 709 #endif
 710
 711         subitem = e_asn1_object_new ();
 712         e_asn1_object_set_display_name (subitem, _("Subject"));
 713
 714         process_name (&cert->subject, &text);
 715         e_asn1_object_set_display_value (subitem, text);
 716         g_free (text);
 717         e_asn1_object_append_child (sequence, subitem);
 718         g_object_unref (subitem);
 719
 720         if (!process_subject_public_key_info (&cert->subjectPublicKeyInfo, sequence))
 721                 return FALSE;
 722
 723         /* Is there an issuerUniqueID? */
 724         if (cert->issuerID.data) {
 725                 /* The issuerID is encoded as a bit string.
 726                  * The function ProcessRawBytes expects the
 727                  * length to be in bytes, so let's convert the
 728                  * length in a temporary SECItem
 729                 */
 730                 data.data = cert->issuerID.data;
 731                 data.len  = cert->issuerID.len / 8;
 732
 733                 subitem = e_asn1_object_new ();
 734
 735                 e_asn1_object_set_display_name (subitem, _("Issuer Unique ID"));
 736                 process_raw_bytes (&data, &text);
 737                 e_asn1_object_set_display_value (subitem, text);
 738                 g_free (text);
 739
 740                 e_asn1_object_append_child (sequence, subitem);
 741         }
 742
 743         if (cert->subjectID.data) {
 744                 /* The subjectID is encoded as a bit string.
 745                  * The function ProcessRawBytes expects the
 746                  * length to be in bytes, so let's convert the
 747                  * length in a temporary SECItem
 748                 */
 749                 data.data = cert->issuerID.data;
 750                 data.len  = cert->issuerID.len / 8;
 751
 752                 subitem = e_asn1_object_new ();
 753
 754                 e_asn1_object_set_display_name (subitem, _("Subject Unique ID"));
 755                 process_raw_bytes (&data, &text);
 756                 e_asn1_object_set_display_value (subitem, text);
 757                 g_free (text);
 758
 759                 e_asn1_object_append_child (sequence, subitem);
 760         }
 761         if (cert->extensions) {
 762                 if (!process_extensions (cert->extensions, sequence))
 763                         return FALSE;
 764         }
 765
 766         *seq = sequence;
 767
 768         return TRUE;
 769 }
 770
 771 static gboolean
 772 fill_asn1_from_cert (EASN1Object *asn1,
 773                      CERTCertificate *cert)
 774 {
 775         EASN1Object *sequence;
 776         SECItem temp;
 777         gchar *text;
 778
 779         g_return_val_if_fail (asn1 != NULL, FALSE);
 780         g_return_val_if_fail (cert != NULL, FALSE);
 781
 782         if (cert->nickname) {
 783                 e_asn1_object_set_display_name (asn1, cert->nickname);
 784         } else {
 785                 gchar *str;
 786
 787                 str = CERT_GetCommonName (&cert->subject);
 788                 if (str) {
 789                         e_asn1_object_set_display_name (asn1, str);
 790                         PORT_Free (str);
 791                 } else {
 792                         e_asn1_object_set_display_name (asn1, cert->subjectName);
 793                 }
 794         }
 795
 796         /* This sequence will be contain the tbsCertificate, signatureAlgorithm,
 797          * and signatureValue. */
 798
 799         if (!create_tbs_certificate_asn1_struct (cert, &sequence))
 800                 return FALSE;
 801         e_asn1_object_append_child (asn1, sequence);
 802         g_object_unref (sequence);
 803
 804         if (!process_sec_algorithm_id (&cert->signatureWrap.signatureAlgorithm, &sequence))
 805                 return FALSE;
 806         e_asn1_object_set_display_name (
 807                 sequence, _("Certificate Signature Algorithm"));
 808         e_asn1_object_append_child (asn1, sequence);
 809         g_object_unref (sequence);
 810
 811         sequence = e_asn1_object_new ();
 812         e_asn1_object_set_display_name (
 813                 sequence, _("Certificate Signature Value"));
 814
 815         /* The signatureWrap is encoded as a bit string.
 816          * The function ProcessRawBytes expects the
 817          * length to be in bytes, so let's convert the
 818          * length in a temporary SECItem */
 819         temp.data = cert->signatureWrap.signature.data;
 820         temp.len  = cert->signatureWrap.signature.len / 8;
 821         process_raw_bytes (&temp, &text);
 822         e_asn1_object_set_display_value (sequence, text);
 823         e_asn1_object_append_child (asn1, sequence);
 824         g_free (text);
 825
 826         return TRUE;
 827 }
 828
 829 static void
 830 e_asn1_object_finalize (GObject *object)
 831 {
 832         EASN1ObjectPrivate *priv;
 833
 834         priv = E_ASN1_OBJECT_GET_PRIVATE (object);
 835
 836         g_free (priv->display_name);
 837         g_free (priv->value);
 838
 839         g_list_free_full (priv->children, (GDestroyNotify) g_object_unref);
 840
 841         /* Chain up to parent's finalize() method. */
 842         G_OBJECT_CLASS (e_asn1_object_parent_class)->finalize (object);
 843 }
 844
 845 static void
 846 e_asn1_object_class_init (EASN1ObjectClass *class)
 847 {
 848         GObjectClass *object_class;
 849
 850         g_type_class_add_private (class, sizeof (EASN1ObjectPrivate));
 851
 852         object_class = G_OBJECT_CLASS (class);
 853         object_class->finalize = e_asn1_object_finalize;
 854 }
 855
 856 static void
 857 e_asn1_object_init (EASN1Object *asn1)
 858 {
 859         asn1->priv = E_ASN1_OBJECT_GET_PRIVATE (asn1);
 860
 861         asn1->priv->valid_container = TRUE;
 862 }
 863
 864 EASN1Object *
 865 e_asn1_object_new (void)
 866 {
 867         return E_ASN1_OBJECT (g_object_new (E_TYPE_ASN1_OBJECT, NULL));
 868 }
 869
 870 EASN1Object *
 871 e_asn1_object_new_from_cert (CERTCertificate *cert)
 872 {
 873         EASN1Object *asn1;
 874
 875         g_return_val_if_fail (cert != NULL, NULL);
 876
 877         asn1 = e_asn1_object_new ();
 878         if (!fill_asn1_from_cert (asn1, cert)) {
 879                 g_object_unref (asn1);
 880                 return NULL;
 881         }
 882
 883         return asn1;
 884 }
 885
 886 void
 887 e_asn1_object_set_valid_container (EASN1Object *obj,
 888                                    gboolean flag)
 889 {
 890         obj->priv->valid_container = flag;
 891 }
 892
 893 gboolean
 894 e_asn1_object_is_valid_container (EASN1Object *obj)
 895 {
 896         return obj->priv->valid_container;
 897 }
 898
 899 PRUint32
 900 e_asn1_object_get_asn1_type (EASN1Object *obj)
 901 {
 902         return obj->priv->type;
 903 }
 904
 905 PRUint32
 906 e_asn1_object_get_asn1_tag (EASN1Object *obj)
 907 {
 908         return obj->priv->tag;
 909 }
 910
 911 GList *
 912 e_asn1_object_get_children (EASN1Object *obj)
 913 {
 914         GList *children = g_list_copy (obj->priv->children);
 915
 916         g_list_foreach (children, (GFunc) g_object_ref, NULL);
 917
 918         return children;
 919 }
 920
 921 void
 922 e_asn1_object_append_child (EASN1Object *parent,
 923                             EASN1Object *child)
 924 {
 925         parent->priv->children = g_list_append (
 926                 parent->priv->children, g_object_ref (child));
 927 }
 928
 929 void
 930 e_asn1_object_set_display_name (EASN1Object *obj,
 931                                 const gchar *name)
 932 {
 933         g_free (obj->priv->display_name);
 934         obj->priv->display_name = g_strdup (name);
 935 }
 936
 937 const gchar *
 938 e_asn1_object_get_display_name (EASN1Object *obj)
 939 {
 940         return obj->priv->display_name;
 941 }
 942
 943 void
 944 e_asn1_object_set_display_value (EASN1Object *obj,
 945                                  const gchar *value)
 946 {
 947         g_free (obj->priv->value);
 948         obj->priv->value = g_strdup (value);
 949 }
 950
 951 const gchar *
 952 e_asn1_object_get_display_value (EASN1Object *obj)
 953 {
 954         return obj->priv->value;
 955 }
 956
 957 void
 958 e_asn1_object_get_data (EASN1Object *obj,
 959                         gchar **data,
 960                         guint32 *len)
 961 {
 962         *data = obj->priv->data;
 963         *len = obj->priv->data_len;
 964 }