libkmf/common/certgetsetop.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <stdio.h>
#include <link.h>
#include <fcntl.h>
#include <ctype.h>
#include <sys/param.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <ber_der.h>
#include <kmfapiP.h>
#include <libgen.h>
#include <cryptoutil.h>

KMF_RETURN
copy_data(KMF_DATA *dst, KMF_DATA *src)
{
	KMF_RETURN ret = KMF_OK;

	if (dst == NULL || src == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	dst->Data = malloc(src->Length);
	if (dst->Data == NULL)
		return (KMF_ERR_MEMORY);

	dst->Length = src->Length;
	(void) memcpy(dst->Data, src->Data, src->Length);

	return (ret);
}

KMF_RETURN
copy_extension_data(KMF_X509_EXTENSION *dstext,
	KMF_X509_EXTENSION *srcext)
{
	KMF_RETURN ret = KMF_OK;

	if (dstext == NULL || srcext == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(dstext, 0, sizeof (KMF_X509_EXTENSION));

	ret = copy_data(&dstext->extnId, &srcext->extnId);
	if (ret != KMF_OK)
		goto cleanup;

	dstext->extnId.Length = srcext->extnId.Length;
	dstext->critical = srcext->critical;
	dstext->format = srcext->format;

	ret = copy_data(&dstext->BERvalue, &srcext->BERvalue);
	if (ret != KMF_OK)
		goto cleanup;

	dstext->value.tagAndValue = malloc(sizeof (KMF_X509EXT_TAGandVALUE));
	if (dstext->value.tagAndValue == NULL) {
		ret = KMF_ERR_MEMORY;
		goto cleanup;
	}
	(void) memset(dstext->value.tagAndValue, 0,
	    sizeof (KMF_X509EXT_TAGandVALUE));

	ret = copy_data(&dstext->value.tagAndValue->value,
	    &srcext->value.tagAndValue->value);
	if (ret != KMF_OK)
		goto cleanup;

	dstext->value.tagAndValue->type = srcext->value.tagAndValue->type;

cleanup:
	if (ret != KMF_OK) {
		if (dstext->extnId.Data != NULL)
			kmf_free_data(&dstext->extnId);

		if (dstext->BERvalue.Data != NULL)
			kmf_free_data(&dstext->BERvalue);

		if (dstext->value.tagAndValue->value.Data == NULL)
			kmf_free_data(&dstext->value.tagAndValue->value);
	}

	return (ret);
}

/*
 * Given a block of DER encoded X.509 certificate data and
 * an OID for the desired extension, this routine will
 * parse the cert data and return the data associated with
 * the extension if it is found.
 *
 * RETURNS:
 *   KMF_OK - if extension found and copied OK.
 *   KMF_ERR_EXTENSION_NOT_FOUND - extension not found.
 *   parsing and memory allocation errors are also possible.
 */
KMF_RETURN
kmf_get_cert_extn(const KMF_DATA *certdata,
	KMF_OID *extoid, KMF_X509_EXTENSION *extdata)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_CERTIFICATE *cert = NULL;
	KMF_X509_EXTENSION *eptr = NULL;
	int i, found = 0;

	if (certdata == NULL || extoid == NULL || extdata == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	ret = DerDecodeSignedCertificate(certdata, &cert);
	if (ret != KMF_OK)
		return (ret);

	if (cert->certificate.extensions.numberOfExtensions == 0) {
		goto end;
	}

	(void) memset((void *)extdata, 0, sizeof (KMF_X509_EXTENSION));
	for (i = 0; !found &&
	    i < cert->certificate.extensions.numberOfExtensions;
	    i++) {
		eptr = &cert->certificate.extensions.extensions[i];
		if (IsEqualOid(extoid, &eptr->extnId)) {
			ret = copy_extension_data(extdata, eptr);
			found++;
		}
	}
end:
	if (!found)
		ret = KMF_ERR_EXTENSION_NOT_FOUND;

	if (cert != NULL) {
		kmf_free_signed_cert(cert);
		free(cert);
	}

	return (ret);
}

/*
 * Given a block of DER encoded X.509 certificate data and
 * a "crit/non-crit/all" flag, search the extensions and
 * return the OIDs for critical, non-critical or all extensions.
 *
 * RETURNS:
 *   KMF_OK - if extension found and copied OK.
 *   parsing and memory allocation errors are also possible.
 *
 *   OIDlist - array of KMF_OID records, allocated
 *             by this function.
 *   NumOIDs - number of critical extensions found.
 */
KMF_RETURN
kmf_get_cert_extns(const KMF_DATA *certdata, KMF_FLAG_CERT_EXTN flag,
	KMF_X509_EXTENSION **extlist, int *nextns)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_CERTIFICATE *cert;
	KMF_X509_EXTENSION *eptr, *elist;
	int i;

	if (certdata == NULL || extlist == NULL || nextns == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	if (flag < KMF_ALL_EXTNS || flag > KMF_NONCRITICAL_EXTNS)
		return (KMF_ERR_BAD_PARAMETER);

	*nextns = 0;
	*extlist = elist = NULL;
	ret = DerDecodeSignedCertificate(certdata, &cert);
	if (ret != KMF_OK)
		return (ret);

	if (cert->certificate.extensions.numberOfExtensions == 0)
		return (KMF_ERR_EXTENSION_NOT_FOUND);

	for (i = 0; i < cert->certificate.extensions.numberOfExtensions;
	    i++) {
		eptr = &cert->certificate.extensions.extensions[i];

		if (flag == KMF_CRITICAL_EXTNS && eptr->critical == 0)
			continue;
		else if (flag == KMF_NONCRITICAL_EXTNS && eptr->critical != 0)
			continue;

		(*nextns)++;
		elist = realloc(elist, sizeof (KMF_X509_EXTENSION) *
		    (*nextns));
		if (elist == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}

		ret = copy_extension_data(&elist[(*nextns) - 1], eptr);
		if (ret != KMF_OK)
			goto end;
	}

end:
	kmf_free_signed_cert(cert);
	free(cert);
	if (ret != KMF_OK) {
		if (elist != NULL) {
			free(elist);
			elist = NULL;
		}
		*nextns = 0;
	}

	/*
	 * If the flag is not all, then it is possible that we did not find
	 * any critical or non_critical extensions.  When that happened,
	 * return KMF_ERR_EXTENSION_NOT_FOUND.
	 */
	if (flag != KMF_ALL_EXTNS && ret == KMF_OK && *nextns == 0)
		ret = KMF_ERR_EXTENSION_NOT_FOUND;

	*extlist = elist;
	return (ret);
}

/*
 * If the given certificate data (X.509 DER encoded data)
 * contains the Key Usage extension, parse that
 * data and return it in the KMF_X509EXT_BASICCONSTRAINTS
 * record.
 *
 * RETURNS:
 *  KMF_OK - success
 *  KMF_ERR_BAD_PARAMETER - input data was bad.
 *  KMF_ERR_EXTENSION_NOT_FOUND - extension not found.
 */
KMF_RETURN
kmf_get_cert_ku(const KMF_DATA *certdata,
	KMF_X509EXT_KEY_USAGE *keyusage)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;

	if (certdata == NULL || keyusage == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (extn));
	/*
	 * Check standard KeyUsage bits
	 */
	ret = kmf_get_cert_extn(certdata, (KMF_OID *)&KMFOID_KeyUsage, &extn);

	if (ret != KMF_OK) {
		goto end;
	}
	keyusage->critical = (extn.critical != 0);
	if (extn.value.tagAndValue->value.Length > 1) {
		keyusage->KeyUsageBits =
		    extn.value.tagAndValue->value.Data[1] << 8;
	} else  {
		keyusage->KeyUsageBits = extn.value.tagAndValue->value.Data[0];
	}
end:
	kmf_free_extn(&extn);
	return (ret);
}

KMF_BOOL
is_eku_present(KMF_X509EXT_EKU *ekuptr, KMF_OID *ekuoid)
{
	int i;

	if (ekuptr == NULL || ekuoid == NULL)
		return (0);

	for (i = 0; i < ekuptr->nEKUs; i++)
		if (IsEqualOid(&ekuptr->keyPurposeIdList[i], ekuoid))
			return (1);

	return (0);
}

KMF_RETURN
parse_eku_data(const KMF_DATA *asn1data, KMF_X509EXT_EKU *ekuptr)
{
	KMF_RETURN ret = KMF_OK;
	BerElement *asn1 = NULL;
	BerValue exdata;
	KMF_OID oid;
	char *end = NULL;
	ber_len_t size;

	/*
	 * Decode the ASN.1 data for the extension.
	 */
	exdata.bv_val = (char *)asn1data->Data;
	exdata.bv_len = asn1data->Length;

	if ((asn1 = kmfder_init(&exdata)) == NULL) {
		ret = KMF_ERR_MEMORY;
		goto end;
	}

	/*
	 * certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
	 */
	if (kmfber_first_element(asn1, &size, &end) != BER_OBJECT_IDENTIFIER) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto end;
	}

	/*
	 * Count the number of EKU OIDs and store in
	 * the array.
	 */
	while (kmfber_next_element(asn1, &size, end) ==
	    BER_OBJECT_IDENTIFIER) {

		/* Skip over the CONSTRUCTED SET tag */
		if (kmfber_scanf(asn1, "D", &oid) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
		ekuptr->nEKUs++;
		ekuptr->keyPurposeIdList = realloc(ekuptr->keyPurposeIdList,
		    ekuptr->nEKUs * sizeof (KMF_OID));
		if (ekuptr->keyPurposeIdList == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}
		ekuptr->keyPurposeIdList[ekuptr->nEKUs - 1] = oid;
	}

end:
	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	if (ret != KMF_OK) {
		if (ekuptr->keyPurposeIdList != NULL) {
			free_keyidlist(ekuptr->keyPurposeIdList, ekuptr->nEKUs);
			ekuptr->keyPurposeIdList = NULL;
			ekuptr->critical = 0;
		}
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_eku(const KMF_DATA *certdata,
	KMF_X509EXT_EKU *ekuptr)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;

	if (certdata == NULL || ekuptr == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (KMF_X509_EXTENSION));

	ekuptr->nEKUs = 0;
	ekuptr->keyPurposeIdList = NULL;
	ekuptr->critical = 0;

	ret = kmf_get_cert_extn(certdata,
	    (KMF_OID *)&KMFOID_ExtendedKeyUsage, &extn);

	if (ret != KMF_OK) {
		goto end;
	}

	ret = parse_eku_data(&extn.BERvalue, ekuptr);

end:
	kmf_free_extn(&extn);

	return (ret);
}

/*
 * If the given certificate data (X.509 DER encoded data)
 * contains the Basic Constraints extension, parse that
 * data and return it in the KMF_X509EXT_BASICCONSTRAINTS
 * record.
 *
 * RETURNS:
 *  KMF_OK - success
 *  KMF_ERR_BAD_PARAMETER - input data was bad.
 *  KMF_ERR_EXTENSION_NOT_FOUND - extension not found.
 */
KMF_RETURN
kmf_get_cert_basic_constraint(const KMF_DATA *certdata,
	KMF_BOOL *critical, KMF_X509EXT_BASICCONSTRAINTS *constraint)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	BerElement *asn1 = NULL;
	BerValue exdata;
	ber_len_t size;
	char *end = NULL;
	int tag;

	if (certdata == NULL || constraint == NULL || critical == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (KMF_X509_EXTENSION));
	ret = kmf_get_cert_extn(certdata,
	    (KMF_OID *)&KMFOID_BasicConstraints, &extn);

	if (ret != KMF_OK) {
		goto end;
	}

	*critical = (extn.critical != 0);

	exdata.bv_val = (char *)extn.value.tagAndValue->value.Data;
	exdata.bv_len = extn.value.tagAndValue->value.Length;

	if ((asn1 = kmfder_init(&exdata)) == NULL) {
		ret = KMF_ERR_MEMORY;
		goto end;
	}

	if (kmfber_scanf(asn1, "b", &constraint->cA) == KMFBER_DEFAULT) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto end;
	}
	constraint->pathLenConstraintPresent = KMF_FALSE;

	tag = kmfber_next_element(asn1, &size, end);
	if (tag == BER_INTEGER) {
		if (kmfber_scanf(asn1, "i",
		    &constraint->pathLenConstraint) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
		constraint->pathLenConstraintPresent = KMF_TRUE;
	}
end:
	kmf_free_extn(&extn);
	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	return (ret);
}

static KMF_X509EXT_POLICYQUALIFIERINFO *
get_pqinfo(BerElement *asn1)
{
	KMF_X509EXT_POLICYQUALIFIERINFO *pqinfo = NULL;
	KMF_RETURN ret = KMF_OK;
	int tag;
	ber_len_t size;
	char *end = NULL;

	/*
	 * Policy Qualifiers may be a list of sequences.
	 *
	 * PolicyInformation ::= SEQUENCE {
	 * 	policyIdentifier   CertPolicyId,
	 * 	policyQualifiers   SEQUENCE SIZE (1..MAX) OF
	 *			PolicyQualifierInfo OPTIONAL
	 * }
	 *
	 * PolicyQualifierInfo ::= SEQUENCE {
	 *	policyQualifierId  PolicyQualifierId,
	 *	qualifier	  ANY DEFINED BY policyQualifierId
	 * }
	 */


	/*
	 * We already got the CertPolicyId, we just need to
	 * find all of the policyQualifiers in the set.
	 *
	 * Mark the first element of the SEQUENCE and reset the end ptr
	 * so the ber/der code knows when to stop looking.
	 */
	if ((tag = kmfber_first_element(asn1, &size, &end)) !=
	    BER_CONSTRUCTED_SEQUENCE) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto end;
	}
	/* We found a sequence, loop until done */
	while ((tag = kmfber_next_element(asn1, &size, end)) ==
	    BER_CONSTRUCTED_SEQUENCE) {

		/* Skip over the CONSTRUCTED SET tag */
		if (kmfber_scanf(asn1, "T", &tag) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
		/*
		 * Allocate memory for the Policy Qualifier Info
		 */
		pqinfo = malloc(sizeof (KMF_X509EXT_POLICYQUALIFIERINFO));
		if (pqinfo == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}
		(void) memset((void *)pqinfo, 0,
		    sizeof (KMF_X509EXT_POLICYQUALIFIERINFO));
		/*
		 * Read the PolicyQualifier OID
		 */
		if (kmfber_scanf(asn1, "D",
		    &pqinfo->policyQualifierId) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
		/*
		 * The OID of the policyQualifierId determines what
		 * sort of data comes next.
		 */
		if (IsEqualOid(&pqinfo->policyQualifierId,
		    (KMF_OID *)&KMFOID_PKIX_PQ_CPSuri)) {
			/*
			 * CPS uri must be an IA5STRING
			 */
			if (kmfber_scanf(asn1, "tl", &tag, &size) ==
			    KMFBER_DEFAULT || tag != BER_IA5STRING ||
			    size == 0) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}
			if ((pqinfo->value.Data = malloc(size)) == NULL) {
				ret = KMF_ERR_MEMORY;
				goto end;
			}
			if (kmfber_scanf(asn1, "s", pqinfo->value.Data,
			    &pqinfo->value.Length) == KMFBER_DEFAULT) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}
		} else if (IsEqualOid(&pqinfo->policyQualifierId,
		    (KMF_OID *)&KMFOID_PKIX_PQ_Unotice)) {
			if (kmfber_scanf(asn1, "tl", &tag, &size) ==
			    KMFBER_DEFAULT ||
			    tag != BER_CONSTRUCTED_SEQUENCE) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}
			/*
			 * For now, just copy the while UserNotice ASN.1
			 * blob into the pqinfo data record.
			 * TBD - parse it into individual fields.
			 */
			if ((pqinfo->value.Data = malloc(size)) == NULL) {
				ret = KMF_ERR_MEMORY;
				goto end;
			}
			if (kmfber_scanf(asn1, "s", pqinfo->value.Data,
			    &pqinfo->value.Length) == KMFBER_DEFAULT) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}
		} else {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
	}
end:
	if (ret != KMF_OK) {
		if (pqinfo != NULL) {
			kmf_free_data(&pqinfo->value);
			kmf_free_data(&pqinfo->policyQualifierId);
			free(pqinfo);
			pqinfo = NULL;
		}
	}
	return (pqinfo);
}

/*
 * If the given certificate data (X.509 DER encoded data)
 * contains the Certificate Policies extension, parse that
 * data and return it in the KMF_X509EXT_CERT_POLICIES
 * record.
 *
 * RETURNS:
 *  KMF_OK - success
 *  KMF_ERR_BAD_PARAMETER - input data was bad.
 *  KMF_ERR_EXTENSION_NOT_FOUND - extension not found.
 *  parsing and memory allocation errors are also possible.
 */
KMF_RETURN
kmf_get_cert_policies(const KMF_DATA *certdata,
	KMF_BOOL *critical, KMF_X509EXT_CERT_POLICIES *extptr)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	KMF_X509EXT_POLICYINFO	*pinfo;
	KMF_X509EXT_POLICYQUALIFIERINFO *pqinfo;
	BerElement *asn1 = NULL;
	BerValue exdata;
	ber_len_t size;
	char *end = NULL;
	int tag;

	if (certdata == NULL || critical == NULL || extptr == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (extn));
	ret = kmf_get_cert_extn(certdata,
	    (KMF_OID *)&KMFOID_CertificatePolicies, &extn);

	if (ret != KMF_OK) {
		goto end;
	}

	*critical = (extn.critical != 0);

	/*
	 * Decode the ASN.1 data for the extension.
	 */
	exdata.bv_val = (char *)extn.BERvalue.Data;
	exdata.bv_len = extn.BERvalue.Length;

	(void) memset((void *)extptr, 0, sizeof (KMF_X509EXT_CERT_POLICIES));

	if ((asn1 = kmfder_init(&exdata)) == NULL) {
		ret = KMF_ERR_MEMORY;
		goto end;
	}

	/*
	 * certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
	 */
	if ((tag = kmfber_first_element(asn1, &size, &end)) !=
	    BER_CONSTRUCTED_SEQUENCE) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto end;
	}

	/*
	 * Collect all of the PolicyInformation SEQUENCES
	 *
	 * PolicyInformation ::= SEQUENCE {
	 * 	policyIdentifier   CertPolicyId,
	 * 	policyQualifiers   SEQUENCE SIZE (1..MAX) OF
	 *			PolicyQualifierInfo OPTIONAL
	 * }
	 *
	 * Loop over the SEQUENCES of PolicyInfo
	 */
	while ((tag = kmfber_next_element(asn1, &size, end)) ==
	    BER_CONSTRUCTED_SEQUENCE) {

		/* Skip over the CONSTRUCTED SET tag */
		if (kmfber_scanf(asn1, "T", &tag) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}

		pinfo = malloc(sizeof (KMF_X509EXT_POLICYINFO));
		if (pinfo == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}
		(void) memset((void *)pinfo, 0,
		    sizeof (KMF_X509EXT_POLICYINFO));
		/*
		 * Decode the PolicyInformation SEQUENCE
		 */
		if ((tag = kmfber_scanf(asn1, "D",
		    &pinfo->policyIdentifier)) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}
		/*
		 * Gather all of the associated PolicyQualifierInfo recs
		 */
		pqinfo = get_pqinfo(asn1);
		if (pqinfo != NULL) {
			int cnt =
			    pinfo->policyQualifiers.numberOfPolicyQualifiers;
			cnt++;
			pinfo->policyQualifiers.policyQualifier = realloc(
			    pinfo->policyQualifiers.policyQualifier,
			    cnt * sizeof (KMF_X509EXT_POLICYQUALIFIERINFO));
			if (pinfo->policyQualifiers.policyQualifier == NULL) {
				ret = KMF_ERR_MEMORY;
				goto end;
			}
			pinfo->policyQualifiers.numberOfPolicyQualifiers = cnt;
			pinfo->policyQualifiers.policyQualifier[cnt-1] =
			    *pqinfo;

			free(pqinfo);
		}
		extptr->numberOfPolicyInfo++;
		extptr->policyInfo = realloc(extptr->policyInfo,
		    extptr->numberOfPolicyInfo *
		    sizeof (KMF_X509EXT_POLICYINFO));
		if (extptr->policyInfo == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}
		extptr->policyInfo[extptr->numberOfPolicyInfo-1] = *pinfo;
		free(pinfo);
	}


end:
	kmf_free_extn(&extn);
	if (asn1 != NULL)
		kmfber_free(asn1, 1);
	return (ret);
}

/*
 * If the given certificate data (X.509 DER encoded data)
 * contains the Authority Information Access extension, parse that
 * data and return it in the KMF_X509EXT_AUTHINFOACCESS
 * record.
 *
 * RETURNS:
 *  KMF_OK - success
 *  KMF_ERR_BAD_PARAMETER - input data was bad.
 *  KMF_ERR_EXTENSION_NOT_FOUND - extension not found.
 */
KMF_RETURN
kmf_get_cert_auth_info_access(const KMF_DATA *certdata,
	KMF_X509EXT_AUTHINFOACCESS *aia)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	BerElement *asn1 = NULL;
	BerValue exdata;
	ber_len_t size;
	char *end = NULL;
	int tag;
	KMF_X509EXT_ACCESSDESC *access_info = NULL;

	if (certdata == NULL || aia == NULL) {
		return (KMF_ERR_BAD_PARAMETER);
	}

	(void) memset(&extn, 0, sizeof (KMF_X509_EXTENSION));
	ret = kmf_get_cert_extn(certdata,
	    (KMF_OID *)&KMFOID_AuthorityInfoAccess, &extn);

	if (ret != KMF_OK) {
		goto end;
	}

	/*
	 * Decode the ASN.1 data for the extension.
	 */
	exdata.bv_val = (char *)extn.BERvalue.Data;
	exdata.bv_len = extn.BERvalue.Length;

	(void) memset((void *)aia, 0, sizeof (KMF_X509EXT_AUTHINFOACCESS));

	if ((asn1 = kmfder_init(&exdata)) == NULL) {
		ret = KMF_ERR_MEMORY;
		goto end;
	}

	/*
	 * AuthorityInfoAccessSyntax  ::=
	 *	SEQUENCE SIZE (1..MAX) OF AccessDescription
	 */
	if ((tag = kmfber_first_element(asn1, &size, &end)) !=
	    BER_CONSTRUCTED_SEQUENCE) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto end;
	}

	/*
	 * AccessDescription  ::=  SEQUENCE {
	 *	accessMethod	OBJECT IDENTIFIER,
	 *	accessLocation	GeneralName  }
	 */
	while ((tag = kmfber_next_element(asn1, &size, end)) ==
	    BER_CONSTRUCTED_SEQUENCE) {

		/* Skip over the CONSTRUCTED SET tag */
		if (kmfber_scanf(asn1, "T", &tag) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}

		access_info = malloc(sizeof (KMF_X509EXT_ACCESSDESC));
		if (access_info == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}

		(void) memset((void *)access_info, 0,
		    sizeof (KMF_X509EXT_ACCESSDESC));

		/*
		 * Read the AccessMethod OID
		 */
		if (kmfber_scanf(asn1, "D",
		    &access_info->AccessMethod) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}

		/*
		 * The OID of the AccessMethod determines what
		 * sort of data comes next.
		 */
		if (IsEqualOid(&access_info->AccessMethod,
		    (KMF_OID *)&KMFOID_PkixAdOcsp)) {
			if (kmfber_scanf(asn1, "tl", &tag, &size) ==
			    KMFBER_DEFAULT || size == 0) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}

			/*
			 * OCSP uri must be an IA5STRING or a GENNAME_URI
			 * with an implicit tag.
			 */
			if (tag != BER_IA5STRING &&
			    tag != (0x80 | GENNAME_URI)) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}

			if ((access_info->AccessLocation.Data =
			    malloc(size)) == NULL) {
				ret = KMF_ERR_MEMORY;
				goto end;
			}

			if (kmfber_scanf(asn1, "s",
			    access_info->AccessLocation.Data,
			    &access_info->AccessLocation.Length) ==
			    KMFBER_DEFAULT) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto end;
			}
		} else if (IsEqualOid(&access_info->AccessMethod,
		    (KMF_OID *)&KMFOID_PkixAdCaIssuers)) {
			/* will be supported later with PKIX */
			free(access_info);
			access_info = NULL;
			continue;
		} else {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto end;
		}

		aia->numberOfAccessDescription++;
		aia->AccessDesc = realloc(aia->AccessDesc,
		    aia->numberOfAccessDescription *
		    sizeof (KMF_X509EXT_ACCESSDESC));

		if (aia->AccessDesc == NULL) {
			ret = KMF_ERR_MEMORY;
			goto end;
		}

		aia->AccessDesc[aia->numberOfAccessDescription-1] =
		    *access_info;
		free(access_info);
		access_info = NULL;
	}

end:
	kmf_free_extn(&extn);
	if (access_info != NULL)
		free(access_info);
	if (asn1 != NULL)
		kmfber_free(asn1, 1);
	return (ret);

}

/*
 * This function parses the name portion of a der-encoded distribution point
 * returns it in the KMF_CRL_DIST_POINT record.
 *
 * The "DistributionPointName" syntax is
 *
 *   DistributionPointName ::= CHOICE {
 *	fullName                [0]     GeneralNames,
 *	nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
 *
 *   GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GerneralName
 *
 * Note: for phase 1, we support fullName only.
 */
static KMF_RETURN
parse_dp_name(char *dp_der_code, int dp_der_size, KMF_CRL_DIST_POINT *dp)
{
	KMF_RETURN ret = KMF_OK;
	char *url = NULL;
	BerElement *asn1 = NULL;
	BerValue ber_data;
	ber_len_t size;
	char *end = NULL;
	int tag;
	KMF_GENERALNAMES *fullname;

	if (dp_der_code == NULL || dp_der_size == 0 || dp == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	ber_data.bv_val = dp_der_code;
	ber_data.bv_len = dp_der_size;
	if ((asn1 = kmfder_init(&ber_data)) == NULL)
		return (KMF_ERR_BAD_CERT_FORMAT);

	tag = kmfber_first_element(asn1, &size, &end);
	if (tag != 0xA0 && tag != 0xA1) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto out;
	}

	if (tag == 0xA0) { /* fullName */
		dp->type = DP_GENERAL_NAME;

		fullname = &(dp->name.full_name);
		fullname->number = 0;

		/* Skip over the explicit tag and size */
		(void) kmfber_scanf(asn1, "T", &tag);

		tag = kmfber_next_element(asn1, &size, end);
		while (tag != KMFBER_DEFAULT &&
		    tag != KMFBER_END_OF_SEQORSET) {

			if (kmfber_scanf(asn1, "tl", &tag, &size) ==
			    KMFBER_DEFAULT || size == 0) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto out;
			}

			/* For phase 1, we are interested in a URI name only */
			if (tag != (0x80 | GENNAME_URI)) {
				tag = kmfber_next_element(asn1, &size, end);
				continue;
			}

			if ((url = malloc(size)) == NULL) {
				ret = KMF_ERR_MEMORY;
				goto out;
			}

			/* Skip type and len, then read url and save it. */
			if (kmfber_read(asn1, url, 2) != 2) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto out;
			}

			if (kmfber_read(asn1, url, size) !=
			    (ber_slen_t)size) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				goto out;
			}

			fullname->number++;
			fullname->namelist = realloc(fullname->namelist,
			    fullname->number * sizeof (KMF_GENERALNAME));
			if (fullname->namelist == NULL) {
				ret = KMF_ERR_MEMORY;
				goto out;
			}

			fullname->namelist[fullname->number - 1].choice =
			    GENNAME_URI;
			fullname->namelist[fullname->number - 1].name.Length =
			    size;
			fullname->namelist[fullname->number - 1].name.Data =
			    (unsigned char *)url;

			/* next */
			tag = kmfber_next_element(asn1, &size, end);
		}

	} else if (tag == 0xA1) {
		/* "nameRelativeToCRLIssuer" is not supported at phase 1. */
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto out;
	}

out:
	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	if (ret != KMF_OK) {
		free_dp_name(dp);
	}

	if (ret == KMF_OK && fullname->number == 0) {
		ret = KMF_ERR_EXTENSION_NOT_FOUND;
		if (url != NULL)
			free(url);
	}

	return (ret);
}

/*
 * This function retrieves the CRL Distribution Points extension data from
 * a DER encoded certificate if it contains this extension, parses the
 * extension data, and returns it in the KMF_X509EXT_CRLDISTPOINTS record.
 */
KMF_RETURN
kmf_get_cert_crl_dist_pts(const KMF_DATA *certdata,
	KMF_X509EXT_CRLDISTPOINTS *crl_dps)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	BerElement *asn1 = NULL;
	BerValue exdata;
	ber_len_t size;
	char *end = NULL;
	int tag;
	KMF_CRL_DIST_POINT *dp = NULL;
	int i;

	if (certdata == NULL || crl_dps == NULL) {
		return (KMF_ERR_BAD_PARAMETER);
	}

	/* Get the ASN.1 data for this extension. */
	(void) memset(&extn, 0, sizeof (KMF_X509_EXTENSION));
	ret = kmf_get_cert_extn(certdata,
	    (KMF_OID *)&KMFOID_CrlDistributionPoints, &extn);
	if (ret != KMF_OK) {
		return (ret);
	}

	/*
	 * Decode the CRLDistributionPoints ASN.1 data. The Syntax for
	 * CRLDistributionPoints is
	 *
	 * CRLDistributionPoints ::=
	 *	SEQUENCE SIZE (1..MAX) OF DistributionPoint
	 *
	 * DistributionPoint ::= SEQUENCE {
	 *	distributionPoint	[0]	DistributionPointName OPTIONAL,
	 *	reasons			[1]	ReasonFlags OPTIONAL,
	 *	cRLIssuer		[2]	GeneralNames OPTIONAL }
	 */

	exdata.bv_val = (char *)extn.BERvalue.Data;
	exdata.bv_len = extn.BERvalue.Length;
	if ((asn1 = kmfder_init(&exdata)) == NULL) {
		ret = KMF_ERR_MEMORY;
		goto out;
	}

	if ((tag = kmfber_first_element(asn1, &size, &end)) !=
	    BER_CONSTRUCTED_SEQUENCE) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
		goto out;
	}

	(void) memset((void *)crl_dps, 0, sizeof (KMF_X509EXT_CRLDISTPOINTS));

	while ((tag = kmfber_next_element(asn1, &size, end)) ==
	    BER_CONSTRUCTED_SEQUENCE) {
		boolean_t has_name = B_FALSE;
		boolean_t has_issuer = B_FALSE;

		/* Skip over the CONSTRUCTED SET tag */
		if (kmfber_scanf(asn1, "T", &tag) == KMFBER_DEFAULT) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			goto out;
		}

		tag = kmfber_next_element(asn1, &size, end);
		if (tag != 0xA0 && tag != 0xA1 && tag != 0xA2)
			goto out;

		if ((dp = malloc(sizeof (KMF_CRL_DIST_POINT))) == NULL) {
			ret = KMF_ERR_MEMORY;
			goto out;
		}
		(void) memset((void *)dp, 0, sizeof (KMF_CRL_DIST_POINT));

		if (tag == 0xA0) { /* distributionPoint Name */
			char *name_der;
			int name_size = size + 2;

			if ((name_der = malloc(name_size)) == NULL) {
				ret = KMF_ERR_MEMORY;
				free(dp);
				dp = NULL;
				goto out;
			}

			if (kmfber_read(asn1, name_der, name_size) !=
			    (ber_slen_t)(name_size)) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				free(name_der);
				free(dp);
				dp = NULL;
				goto out;
			}
			has_name = B_TRUE;

			ret = parse_dp_name(name_der, name_size, dp);
			free(name_der);
			if (ret != KMF_OK) {
				free(dp);
				dp = NULL;
				goto out;
			}

			/* next field */
			tag = kmfber_next_element(asn1, &size, end);
		}

		if (tag == 0XA1) { /* reasons */
			char *bit_string;
			int len;

			if (kmfber_scanf(asn1, "B", &bit_string, &len) !=
			    BER_BIT_STRING) {
				ret = KMF_ERR_BAD_CERT_FORMAT;
				free(dp);
				dp = NULL;
				goto out;
			}

			dp->reasons.Length = len / 8;
			if ((dp->reasons.Data = malloc(dp->reasons.Length)) ==
			    NULL) {
				ret = KMF_ERR_MEMORY;
				free(dp);
				dp = NULL;
				goto out;
			}
			(void) memcpy(dp->reasons.Data, (uchar_t *)bit_string,
			    dp->reasons.Length);

			/* next field */
			tag = kmfber_next_element(asn1, &size, end);
		}

		if (tag == 0XA2) { /* cRLIssuer */
			char *issuer_der = NULL;
			int issuer_size;

			/* For cRLIssuer, read the data only at phase 1 */
			issuer_size = size + 2;
			issuer_der = malloc(issuer_size);
			if (issuer_der == NULL) {
				ret = KMF_ERR_MEMORY;
				free(dp);
				dp = NULL;
				goto out;
			}

			if (kmfber_read(asn1, issuer_der, issuer_size) !=
			    (ber_slen_t)(issuer_size)) {
				free(issuer_der);
				ret = KMF_ERR_BAD_CERT_FORMAT;
				free(dp);
				dp = NULL;
				goto out;
			}

			has_issuer = B_TRUE;
			free(issuer_der);
		}

		/* A distribution point cannot have a "reasons" field only. */
		if (has_name == B_FALSE && has_issuer == B_FALSE) {
			ret = KMF_ERR_BAD_CERT_FORMAT;
			free_dp(dp);
			free(dp);
			dp = NULL;
			goto out;
		}

		/*
		 * Although it is legal that a distributioon point contains
		 * a cRLIssuer field only, with or without "reasons", we will
		 * skip it if the name field is not presented for phase 1.
		 */
		if (has_name == B_FALSE) {
			free_dp(dp);
		} else {
			crl_dps->number++;
			crl_dps->dplist = realloc(crl_dps->dplist,
			    crl_dps->number * sizeof (KMF_CRL_DIST_POINT));
			if (crl_dps->dplist == NULL) {
				ret = KMF_ERR_MEMORY;
				free_dp(dp);
				free(dp);
				dp = NULL;
				goto out;
			}
			crl_dps->dplist[crl_dps->number - 1] = *dp;
			/* free the dp itself since we just used its contents */
		}
		if (dp != NULL) {
			free(dp);
			dp = NULL;
		}
	}

out:
	kmf_free_extn(&extn);

	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	if (ret != KMF_OK) {
		for (i = 0; i < crl_dps->number; i++)
			free_dp(&(crl_dps->dplist[i]));
		free(crl_dps->dplist);
	}

	if (ret == KMF_OK && crl_dps->number == 0) {
		ret = KMF_ERR_BAD_CERT_FORMAT;
	}

	return (ret);
}

static KMF_RETURN
KMF_CertGetPrintable(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
	KMF_PRINTABLE_ITEM flag, char *resultStr)
{
	KMF_PLUGIN *plugin;
	KMF_RETURN (*getPrintableFn)(void *, const KMF_DATA *,
	    KMF_PRINTABLE_ITEM, char *);
	KMF_RETURN ret;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || resultStr == NULL) {
		return (KMF_ERR_BAD_PARAMETER);
	}

	/*
	 * This framework function is actually implemented in the openssl
	 * plugin library, so we find the function address and call it.
	 */
	plugin = FindPlugin(handle, KMF_KEYSTORE_OPENSSL);
	if (plugin == NULL || plugin->dldesc == NULL) {
		return (KMF_ERR_PLUGIN_NOTFOUND);
	}

	getPrintableFn = (KMF_RETURN(*)())dlsym(plugin->dldesc,
	    "OpenSSL_CertGetPrintable");
	if (getPrintableFn == NULL) {
		return (KMF_ERR_FUNCTION_NOT_FOUND);
	}

	return (getPrintableFn(handle, SignedCert, flag, resultStr));
}

KMF_RETURN
kmf_get_cert_version_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_VERSION,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}


KMF_RETURN
kmf_get_cert_subject_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_SUBJECT,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);

}

KMF_RETURN
kmf_get_cert_issuer_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_ISSUER,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_serial_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_SERIALNUM,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_start_date_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_NOTBEFORE,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_end_date_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
	char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_NOTAFTER,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_pubkey_alg_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_PUBKEY_ALG,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_sig_alg_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_SIGNATURE_ALG,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_pubkey_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_PUBKEY_DATA,
	    tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_email_str(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
	char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (SignedCert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, SignedCert, KMF_CERT_EMAIL, tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

/*
 * Given a certificate (DER Encoded data) and a KMF
 * extension identifier constant (e.g. KMF_X509_EXT_*),
 * return a human readable interpretation of the
 * extension data.
 *
 * The string will be a maximum of KMF_CERT_PRINTABLE_LEN
 * bytes long.  The string is allocated locally and
 * must be freed by the caller.
 */
KMF_RETURN
kmf_get_cert_extn_str(KMF_HANDLE_T handle, const KMF_DATA *cert,
	KMF_PRINTABLE_ITEM extension, char **result)
{
	KMF_RETURN ret;
	char *tmpstr;

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (cert == NULL || result == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	tmpstr = malloc(KMF_CERT_PRINTABLE_LEN);
	if (tmpstr == NULL)
		return (KMF_ERR_MEMORY);
	(void) memset(tmpstr, 0, KMF_CERT_PRINTABLE_LEN);

	ret = KMF_CertGetPrintable(handle, cert, extension, tmpstr);

	if (ret == KMF_OK) {
		*result = tmpstr;
	} else {
		free(tmpstr);
		*result = NULL;
	}

	return (ret);
}

KMF_RETURN
kmf_get_cert_id_data(const KMF_DATA *SignedCert, KMF_DATA *ID)
{
	KMF_RETURN ret;
	KMF_X509_CERTIFICATE *cert = NULL;

	if (SignedCert == NULL || ID == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	ret = DerDecodeSignedCertificate(SignedCert, &cert);
	if (ret != KMF_OK)
		return (ret);

	ret = GetIDFromSPKI(&cert->certificate.subjectPublicKeyInfo, ID);

	kmf_free_signed_cert(cert);
	free(cert);
	return (ret);
}

KMF_RETURN
kmf_get_cert_id_str(const KMF_DATA *SignedCert,	char **idstr)
{
	KMF_RETURN ret;
	KMF_DATA ID = {NULL, 0};
	char tmpstr[256];
	int i;

	if (SignedCert == NULL || idstr == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	ret = kmf_get_cert_id_data(SignedCert, &ID);
	if (ret != KMF_OK) {
		kmf_free_data(&ID);
		return (ret);
	}

	(void) memset(tmpstr, 0, sizeof (tmpstr));
	for (i = 0; i < ID.Length; i++) {
		int len = strlen(tmpstr);
		(void) snprintf(&tmpstr[len], sizeof (tmpstr) -  len,
		    "%02x", (uchar_t)ID.Data[i]);
		if ((i+1) < ID.Length)
			(void) strcat(tmpstr, ":");
	}
	*idstr = strdup(tmpstr);
	if ((*idstr) == NULL)
		ret = KMF_ERR_MEMORY;

	kmf_free_data(&ID);

	return (ret);
}


/*
 * This function gets the time_t values of the notbefore and notafter dates
 * from a der-encoded certificate.
 */
KMF_RETURN
kmf_get_cert_validity(const KMF_DATA *cert, time_t *not_before,
    time_t *not_after)
{
	KMF_RETURN rv = KMF_OK;
	KMF_X509_CERTIFICATE *certData = NULL;
	struct tm tm_tmp;
	time_t t_notbefore;
	time_t t_notafter;
	unsigned char *not_before_str;
	unsigned char *not_after_str;

	if (cert == NULL || not_before == NULL || not_after == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	rv = DerDecodeSignedCertificate(cert, &certData);
	if (rv != KMF_OK)
		return (rv);

	/* Get notBefore */
	not_before_str = certData->certificate.validity.notBefore.time.Data;
	if (strptime((const char *)not_before_str, "%y %m %d %H %M %S",
	    &tm_tmp) == NULL) {
		rv = KMF_ERR_VALIDITY_PERIOD;
		goto out;
	}

	errno = 0;
	if (((t_notbefore = mktime(&tm_tmp)) == (time_t)(-1)) &&
	    errno == EOVERFLOW) {
		rv = KMF_ERR_VALIDITY_PERIOD;
		goto out;
	}
	*not_before = t_notbefore;

	/* Get notAfter */
	not_after_str = certData->certificate.validity.notAfter.time.Data;
	if (strptime((const char *)not_after_str, "%y %m %d %H %M %S",
	    &tm_tmp) == NULL) {
		rv = KMF_ERR_VALIDITY_PERIOD;
		goto out;
	}

	errno = 0;
	if (((t_notafter = mktime(&tm_tmp)) == (time_t)(-1)) &&
	    errno == EOVERFLOW) {
		rv = KMF_ERR_VALIDITY_PERIOD;
		goto out;
	}
	*not_after = t_notafter;

out:
	if (certData != NULL) {
		kmf_free_signed_cert(certData);
		free(certData);
	}

	return (rv);
}

KMF_RETURN
kmf_set_cert_pubkey(KMF_HANDLE_T handle,
	KMF_KEY_HANDLE *KMFKey,
	KMF_X509_CERTIFICATE *Cert)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_SPKI *spki_ptr;
	KMF_PLUGIN *plugin;
	KMF_DATA KeyData = {NULL, 0};

	CLEAR_ERROR(handle, ret);
	if (ret != KMF_OK)
		return (ret);

	if (KMFKey == NULL || Cert == NULL) {
		return (KMF_ERR_BAD_PARAMETER);
	}

	/* The keystore must extract the pubkey data */
	plugin = FindPlugin(handle, KMFKey->kstype);
	if (plugin != NULL && plugin->funclist->EncodePubkeyData != NULL) {
		ret = plugin->funclist->EncodePubkeyData(handle,
		    KMFKey, &KeyData);
	} else {
		return (KMF_ERR_PLUGIN_NOTFOUND);
	}

	spki_ptr = &Cert->certificate.subjectPublicKeyInfo;

	if (KeyData.Data != NULL) {
		ret = DerDecodeSPKI(&KeyData, spki_ptr);
		free(KeyData.Data);
	}

	return (ret);
}

KMF_RETURN
kmf_set_cert_subject(KMF_X509_CERTIFICATE *CertData,
	KMF_X509_NAME *subject_name_ptr)
{

	KMF_RETURN rv = KMF_OK;
	KMF_X509_NAME *temp_name_ptr = NULL;

	if (CertData != NULL && subject_name_ptr != NULL) {
		rv = CopyRDN(subject_name_ptr, &temp_name_ptr);
		if (rv == KMF_OK) {
			CertData->certificate.subject = *temp_name_ptr;
		}
	} else {
		return (KMF_ERR_BAD_PARAMETER);
	}
	return (rv);
}

KMF_RETURN
set_key_usage_extension(KMF_X509_EXTENSIONS *extns,
	int critical, uint32_t bits)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	BerElement *asn1 = NULL;
	BerValue *extdata;
	int bitlen, i;
	uint16_t kubits = (uint16_t)(bits & 0x0000ffff);

	if (extns == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (extn));
	ret = copy_data(&extn.extnId, (KMF_OID *)&KMFOID_KeyUsage);
	if (ret != KMF_OK)
		return (ret);
	extn.critical = critical;
	extn.format = KMF_X509_DATAFORMAT_ENCODED;

	for (i = 7; i <= 15 && !(kubits & (1 << i)); i++)
		/* empty body */
		;

	bitlen = 16 - i;

	if ((asn1 = kmfder_alloc()) == NULL)
		return (KMF_ERR_MEMORY);

	kubits = htons(kubits);
	if (kmfber_printf(asn1, "B", (char *)&kubits, bitlen) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}
	if (kmfber_flatten(asn1, &extdata) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	extn.BERvalue.Data = (uchar_t *)extdata->bv_val;
	extn.BERvalue.Length = extdata->bv_len;

	free(extdata);

	ret = add_an_extension(extns, &extn);
	if (ret != KMF_OK) {
		free(extn.BERvalue.Data);
	}
out:
	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	return (ret);
}

KMF_RETURN
kmf_set_cert_ku(KMF_X509_CERTIFICATE *CertData,
	int critical, uint16_t kubits)
{
	KMF_RETURN ret = KMF_OK;

	if (CertData == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	ret = set_key_usage_extension(&CertData->certificate.extensions,
	    critical, kubits);

	return (ret);
}

KMF_RETURN
kmf_set_cert_issuer(KMF_X509_CERTIFICATE *CertData,
	KMF_X509_NAME *issuer_name_ptr)
{

	KMF_RETURN rv = KMF_OK;
	KMF_X509_NAME *temp_name_ptr = NULL;

	if (CertData != NULL && issuer_name_ptr != NULL) {
		rv = CopyRDN(issuer_name_ptr, &temp_name_ptr);
		if (rv == KMF_OK) {
			CertData->certificate.issuer = *temp_name_ptr;
		}
	} else {
		return (KMF_ERR_BAD_PARAMETER);
	}

	return (rv);
}

KMF_RETURN
kmf_set_cert_sig_alg(KMF_X509_CERTIFICATE *CertData,
	KMF_ALGORITHM_INDEX sigAlg)
{
	KMF_OID	*alg;

	if (CertData == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	alg = x509_algid_to_algoid(sigAlg);

	if (alg != NULL) {
		(void) copy_data((KMF_DATA *)
		    &CertData->certificate.signature.algorithm,
		    (KMF_DATA *)alg);
		(void) copy_data(&CertData->certificate.signature.parameters,
		    &CertData->certificate.subjectPublicKeyInfo.algorithm.
		    parameters);

		(void) copy_data(
		    &CertData->signature.algorithmIdentifier.algorithm,
		    &CertData->certificate.signature.algorithm);
		(void) copy_data(
		    &CertData->signature.algorithmIdentifier.parameters,
		    &CertData->certificate.signature.parameters);
	} else {
		return (KMF_ERR_BAD_PARAMETER);
	}

	return (KMF_OK);
}

KMF_RETURN
kmf_set_cert_validity(KMF_X509_CERTIFICATE *CertData,
	time_t notBefore, uint32_t delta)
{
	time_t		clock;
	struct tm	*gmt;
	char 		szNotBefore[256];
	char		szNotAfter[256];

	if (CertData == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	/* Set up validity fields */
	if (notBefore == NULL)
		clock = time(NULL);
	else
		clock = notBefore;

	gmt = gmtime(&clock);  /* valid starting today */

	/* Build the format in 2 parts so SCCS doesn't get confused */
	(void) strftime(szNotBefore, sizeof (szNotBefore),
	    "%y%m%d%H" "%M00Z", gmt);

	CertData->certificate.validity.notBefore.timeType = BER_UTCTIME;
	CertData->certificate.validity.notBefore.time.Length =
	    strlen((char *)szNotBefore);
	CertData->certificate.validity.notBefore.time.Data =
	    (uchar_t *)strdup(szNotBefore);

	clock += delta;
	gmt = gmtime(&clock);

	/* Build the format in 2 parts so SCCS doesn't get confused */
	(void) strftime(szNotAfter, sizeof (szNotAfter),
	    "%y%m%d%H" "%M00Z", gmt);

	CertData->certificate.validity.notAfter.timeType = BER_UTCTIME;
	CertData->certificate.validity.notAfter.time.Length =
	    strlen((char *)szNotAfter);
	CertData->certificate.validity.notAfter.time.Data =
	    (uchar_t *)strdup(szNotAfter);

	return (KMF_OK);
}

/*
 * Utility routine to set Integer values in the Certificate template
 * for things like serialNumber and Version. The data structure
 * expects pointers, not literal values, so we must allocate
 * and copy here.  Don't use memory from the stack since this data
 * is freed later and that would be bad.
 */
KMF_RETURN
set_integer(KMF_DATA *data, void *value, int length)
{
	if (data == NULL || value == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	data->Data = malloc(length);
	if (data->Data == NULL)
		return (KMF_ERR_MEMORY);

	data->Length = length;
	(void) memcpy((void *)data->Data, (const void *)value, length);

	return (KMF_OK);
}

static KMF_RETURN
set_bigint(KMF_BIGINT *data, KMF_BIGINT *bigint)
{
	if (data == NULL || bigint == NULL || bigint->len == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	data->val = malloc(bigint->len);
	if (data->val == NULL)
		return (KMF_ERR_MEMORY);

	data->len = bigint->len;

	(void) memcpy((void *)data->val, bigint->val, bigint->len);

	return (KMF_OK);

}

KMF_RETURN
kmf_set_cert_serial(KMF_X509_CERTIFICATE *CertData,
	KMF_BIGINT *serno)
{
	if (CertData == NULL || serno == NULL || serno->len == 0)
		return (KMF_ERR_BAD_PARAMETER);
	return (set_bigint(&CertData->certificate.serialNumber, serno));
}

KMF_RETURN
kmf_set_cert_version(KMF_X509_CERTIFICATE *CertData,
	uint32_t version)
{
	if (CertData == NULL)
		return (KMF_ERR_BAD_PARAMETER);
	/*
	 * From RFC 3280:
	 * Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
	 */
	if (version != 0 && version != 1 && version != 2)
		return (KMF_ERR_BAD_PARAMETER);
	return (set_integer(&CertData->certificate.version, (void *)&version,
	    sizeof (uint32_t)));
}

KMF_RETURN
kmf_set_cert_issuer_altname(KMF_X509_CERTIFICATE *CertData,
	int critical,
	KMF_GENERALNAMECHOICES nametype,
	char *namedata)
{
	if (CertData == NULL || namedata == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	return (kmf_set_altname(&CertData->certificate.extensions,
	    (KMF_OID *)&KMFOID_IssuerAltName, critical, nametype, namedata));
}

KMF_RETURN
kmf_set_cert_subject_altname(KMF_X509_CERTIFICATE *CertData,
	int critical,
	KMF_GENERALNAMECHOICES nametype,
	char *namedata)
{
	if (CertData == NULL || namedata == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	return (kmf_set_altname(&CertData->certificate.extensions,
	    (KMF_OID *)&KMFOID_SubjectAltName, critical, nametype, namedata));
}

KMF_RETURN
kmf_add_cert_eku(KMF_X509_CERTIFICATE *CertData, KMF_OID *ekuOID,
	int critical)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION *foundextn;
	KMF_X509_EXTENSION newextn;
	BerElement *asn1 = NULL;
	BerValue *extdata = NULL;
	char *olddata = NULL;
	size_t oldsize = 0;
	KMF_X509EXT_EKU ekudata;

	if (CertData == NULL || ekuOID == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&ekudata, 0, sizeof (KMF_X509EXT_EKU));
	(void) memset(&newextn, 0, sizeof (newextn));

	foundextn = FindExtn(&CertData->certificate.extensions,
	    (KMF_OID *)&KMFOID_ExtendedKeyUsage);
	if (foundextn != NULL) {
		ret = GetSequenceContents((char *)foundextn->BERvalue.Data,
		    foundextn->BERvalue.Length,	&olddata, &oldsize);
		if (ret != KMF_OK)
			goto out;

		/*
		 * If the EKU is already in the cert, then just return OK.
		 */
		ret = parse_eku_data(&foundextn->BERvalue, &ekudata);
		if (ret == KMF_OK) {
			if (is_eku_present(&ekudata, ekuOID)) {
				goto out;
			}
		}
	}
	if ((asn1 = kmfder_alloc()) == NULL)
		return (KMF_ERR_MEMORY);

	if (kmfber_printf(asn1, "{") == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	/* Write the old extension data first */
	if (olddata != NULL && oldsize > 0) {
		if (kmfber_write(asn1, olddata, oldsize, 0) == -1) {
			ret = KMF_ERR_ENCODING;
			goto out;
		}
	}

	/* Append this EKU OID and close the sequence */
	if (kmfber_printf(asn1, "D}", ekuOID) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	if (kmfber_flatten(asn1, &extdata) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	/*
	 * If we are just adding to an existing list of EKU OIDs,
	 * just replace the BER data associated with the found extension.
	 */
	if (foundextn != NULL) {
		free(foundextn->BERvalue.Data);
		foundextn->critical = critical;
		foundextn->BERvalue.Data = (uchar_t *)extdata->bv_val;
		foundextn->BERvalue.Length = extdata->bv_len;
	} else {
		ret = copy_data(&newextn.extnId,
		    (KMF_DATA *)&KMFOID_ExtendedKeyUsage);
		if (ret != KMF_OK)
			goto out;
		newextn.critical = critical;
		newextn.format = KMF_X509_DATAFORMAT_ENCODED;
		newextn.BERvalue.Data = (uchar_t *)extdata->bv_val;
		newextn.BERvalue.Length = extdata->bv_len;
		ret = kmf_set_cert_extn(CertData, &newextn);
		if (ret != KMF_OK)
			free(newextn.BERvalue.Data);
	}

out:
	kmf_free_eku(&ekudata);
	if (extdata != NULL)
		free(extdata);

	if (olddata != NULL)
		free(olddata);

	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	if (ret != KMF_OK)
		kmf_free_data(&newextn.extnId);

	return (ret);
}

KMF_RETURN
kmf_set_cert_extn(KMF_X509_CERTIFICATE *CertData,
	KMF_X509_EXTENSION *extn)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSIONS *exts;

	if (CertData == NULL || extn == NULL)
		return (KMF_ERR_BAD_PARAMETER);

	exts = &CertData->certificate.extensions;

	ret = add_an_extension(exts, extn);

	return (ret);
}

KMF_RETURN
kmf_set_cert_basic_constraint(KMF_X509_CERTIFICATE *CertData,
	KMF_BOOL critical, KMF_X509EXT_BASICCONSTRAINTS *constraint)
{
	KMF_RETURN ret = KMF_OK;
	KMF_X509_EXTENSION extn;
	BerElement *asn1 = NULL;
	BerValue *extdata;

	if ((CertData == NULL) || (constraint == NULL))
		return (KMF_ERR_BAD_PARAMETER);

	(void) memset(&extn, 0, sizeof (extn));
	ret = copy_data(&extn.extnId, (KMF_OID *)&KMFOID_BasicConstraints);
	if (ret != KMF_OK)
		return (ret);
	extn.critical = critical;
	extn.format = KMF_X509_DATAFORMAT_ENCODED;

	if ((asn1 = kmfder_alloc()) == NULL)
		return (KMF_ERR_MEMORY);

	if (kmfber_printf(asn1, "{") == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	if (kmfber_printf(asn1, "b", constraint->cA) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	if (constraint->pathLenConstraintPresent) {
		/* Write the pathLenConstraint value */
		if (kmfber_printf(asn1, "i",
		    constraint->pathLenConstraint) == -1) {
			ret = KMF_ERR_ENCODING;
			goto out;
		}
	}

	if (kmfber_printf(asn1, "}") == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	if (kmfber_flatten(asn1, &extdata) == -1) {
		ret = KMF_ERR_ENCODING;
		goto out;
	}

	extn.BERvalue.Data = (uchar_t *)extdata->bv_val;
	extn.BERvalue.Length = extdata->bv_len;

	free(extdata);
	ret = kmf_set_cert_extn(CertData, &extn);
	if (ret != KMF_OK) {
		free(extn.BERvalue.Data);
	}

out:
	if (asn1 != NULL)
		kmfber_free(asn1, 1);

	return (ret);
}


/*
 * Phase 1 APIs still needed to maintain compat with elfsign.
 */
KMF_RETURN
KMF_GetCertSubjectNameString(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	return (kmf_get_cert_subject_str(handle, SignedCert, result));
}

KMF_RETURN
KMF_GetCertIssuerNameString(KMF_HANDLE_T handle, const KMF_DATA *SignedCert,
    char **result)
{
	return (kmf_get_cert_issuer_str(handle, SignedCert, result));
}

KMF_RETURN
KMF_GetCertIDString(const KMF_DATA *SignedCert,	char **idstr)
{
	return (kmf_get_cert_id_str(SignedCert, idstr));
}