BasicChecksUtils.h File Reference

Detailed Description

Subsystem: Certification Path Processing (PKIFPATH)

Module: Miscellaneous

Id: BasicChecksUtils.h 10000 2009-05-28 13:59:19Z cwallace

#include "PKIFdll.h"
#include <bitset>
#include <vector>
#include "CIssuerDomainMappingList.h"
#include "RowDoesContainPolicyInSet.h"
#include "RowDoesNotContainPolicyInSet.h"
#include "MatchesPolicy.h"

Include dependency graph for BasicChecksUtils.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

FD_LIST_PTR (CPKIFGeneralSubtree)

FD_SMART_PTR (CPKIFPolicyInformationSet)

FD_SMART_PTR (CPKIFPolicyMappings)

FD_SMART_PTR (CPKIFCertificate)

FD_SMART_PTR (CPKIFCertificateNodeListWithSourceInfo)

FD_LIST_PTR (CPKIFNameAndKeyWithScore)

FD_LIST_PTR (CPKIFPolicyInformation)

FD_LIST_PTR (CPKIFCertificateSource)

void CAC_API FindErrorAndSetOnResults (const CPKIFCertificatePath &path, CPKIFPathValidationResults &results)

void CAC_API IntersectSubtrees (CPKIFGeneralSubtreeListPtr &authSetCondensed, CPKIFGeneralSubtreeListPtr &initSet, CPKIFGeneralSubtreeListPtr &userSet)

bool CheckNameConstraints (CPKIFCertificatePtr &curCert, CPKIFGeneralSubtreeListPtr &permSubtrees, CPKIFGeneralSubtreeListPtr &exclSubtrees, bool permSubtreesHasBeenSet)

bool CAC_API PathSigChecker (const CPKIFCertificatePath &path, IPKIFCryptoRawOperations *crypto, IPKIFCryptoMisc *cryptoMisc, CPKIFPathValidationResults &results)

bool IsEmpty (CPKIFCertificateNodeListWithSourceInfoPtr &node)

bool IsEmptyNameAndKey (CPKIFNameAndKeyWithScoreListPtr &node)

bool IsNullCertificateSourceList (CPKIFCertificateSourceListPtr &node)

bool RowContainsAnyPolicy (const CPKIFPolicyInformationListPtr &test)

void CAC_API IntersectSets (CPKIFPolicyInformationListPtr &authSetCondensed, CPKIFPolicyInformationListPtr &initSet, CPKIFPolicyInformationListPtr &userSet)

void AddPoliciesToAuthSet (const CPKIFPolicyInformationSetPtr &certPols, const std::bitset< 3 > &indicators, std::vector< CPKIFPolicyInformationListPtr > &authSet, bool isSelfIssued, bool isIntermediate)

void ProcessPolicyMapping (const CPKIFPolicyMappingsPtr &policyMappings, const std::bitset< 3 > &indicators, std::vector< CPKIFPolicyInformationListPtr > &authSet)

Function Documentation

void AddPoliciesToAuthSet	(	const CPKIFPolicyInformationSetPtr &	certPols,
		const std::bitset< 3 > &	indicators,
		vector< CPKIFPolicyInformationListPtr > &	authSet,
		bool	isSelfIssued,
		bool	isIntermediate
	)

Interface: Subsystem

This is a helper function that adds policies to an authority set

Returns:: None

Parameters:

certPols	[in] A referece to a smaart pointer to CPKIFPolicyInformationSet object which contains policies that will be added
indicators	[in] Indicators
authSet	[in/out] A vector of CPKIFPolicyInformationListPtr objects to which policies will be added
isSelfIssued	[in] Boolean value which indicates if certificate is self issued
isIntermediate	[in] Boolean value which indicates if certificate is an intermidiate

Definition at line 293 of file BasicChecksUtils.cpp.

References CPKIFPathSettings::ANY_POLICY, DumpPolicySet(), RowContainsAnyPolicy(), RowDoesNotContainPolicyInSet::SetPolicySet(), and GottaMatch< T >::SetRHS().

Referenced by CPKIFPathBasicChecks2::DoChecks().

bool CheckNameConstraints	(	CPKIFCertificatePtr &	curCert,
		CPKIFGeneralSubtreeListPtr &	permSubtrees,
		CPKIFGeneralSubtreeListPtr &	exclSubtrees,
		bool	permSubtreesHasBeenSet
	)

Interface: Subsystem

This is a helper function checks name constraints

Returns:: True if name constraints check is passes, false otherwise

Parameters:

curCert	[in] A reference to a pointer to CPKIFCertificate containing the current certificate
permSubtrees	[in] A reference to a pointer to CPKIFGeneralSubtreeList which contains permited subtrees
exclSubtrees	[in] A reference to a pointer to CPKIFGeneralSubtreeList which contains excluded subtrees
permSubtreesHasBeenSet	[in] Boolean value which indicates if permited subtrees have been set

Definition at line 670 of file BasicChecksUtils.cpp.

References IsInSubtree().

Referenced by CPKIFPathBasicChecks2::DoChecks().

FD_LIST_PTR ( CPKIFCertificateSource )

FD_LIST_PTR ( CPKIFPolicyInformation )

FD_LIST_PTR ( CPKIFNameAndKeyWithScore )

FD_LIST_PTR ( CPKIFGeneralSubtree )

FD_SMART_PTR ( CPKIFCertificateNodeListWithSourceInfo )

FD_SMART_PTR ( CPKIFCertificate )

FD_SMART_PTR ( CPKIFPolicyMappings )

FD_SMART_PTR ( CPKIFPolicyInformationSet )

void CAC_API FindErrorAndSetOnResults	(	const CPKIFCertificatePath &	path,
		CPKIFPathValidationResults &	results
	)

Interface: External

This function iterates through the certificate path and looks for certificates for which the DiagnosticCode is non-zero, which indicates a validation errors. It sets a reference to the errant certificate b invoking the SetCertificate and SetCertStatus functions on the results object, and if necessary adjusts the most severe revocation status property. It will return the first error found. If no certificate with a non-zero diagnostic code is found, the function returns and the results object is unchanged.

Returns:: None

Parameters:

path	[in] Reference to a CPKIFCertificatePath object to examine for validation errors
results	[out] Reference to a CPKIFPathValidationResults object containing an indicating of the validation error, if a validation error was found

Definition at line 1013 of file BasicChecksUtils.cpp.

References CPKIFCertificatePath::GetPath(), CPKIFPathValidationResults::GetRevocationStatusMostSevere(), REVOKED, CPKIFPathValidationResults::SetCertificate(), CPKIFPathValidationResults::SetCertStatus(), and CPKIFPathValidationResults::SetRevocationStatusMostSevere().

Referenced by CPKIFPathValidator2::ValidatePath().

void CAC_API IntersectSets	(	CPKIFPolicyInformationListPtr &	authSetCondensed,
		CPKIFPolicyInformationListPtr &	initSet,
		CPKIFPolicyInformationListPtr &	userSet
	)

Interface: Subsystem

This function determines the intersection of the authority constrained policy set and the initial policy set.

Returns:: None

Parameters:

authSetCondensed	[in] authority constrainted set.
initSet	[in] Initial policy set.
userSet	[out] The intersection of the above sets.

Definition at line 473 of file BasicChecksUtils.cpp.

References MatchesPolicy::SetPolicyToMatch().

Referenced by CPKIFPathBasicChecks2::DoChecks(), and CPKIFPathValidator2::ValidatePath().

void CAC_API IntersectSubtrees	(	CPKIFGeneralSubtreeListPtr &	fromExtension,
		CPKIFGeneralSubtreeListPtr &	curTrees,
		CPKIFGeneralSubtreeListPtr &	newSet
	)

Interface: Subsystem

This is a helper function that outputs intersecting GeneralSubtrees

Returns:: None

Parameters:

fromExtension	[in] A reference to a pointer to CPKIFGeneralSubtreeList object
curTrees	[in] A reference to a pointer to CPKIFGeneralSubtreeList object
newSet	[out] A reference to a pointer to CPKIFGeneralSubtreeList object

Definition at line 511 of file BasicChecksUtils.cpp.

References SubtreeMatch::SetRHS().

Referenced by CPKIFPathBasicChecks2::DoChecks(), and CPKIFPathValidator2::ValidatePath().

bool IsEmpty ( CPKIFCertificateNodeListWithSourceInfoPtr & node )

Interface: Subsystem

This is a helper function that checks if node is empty

Returns:: True if node if empty, false otherwise

Definition at line 698 of file BasicChecksUtils.cpp.

bool IsEmptyNameAndKey ( CPKIFNameAndKeyWithScoreListPtr & node )

Interface: Subsystem

This is a helper function that checks if nameAndKey list is empty

Returns:: True if node if empty, false otherwise

Parameters:

node

[in] A reference to a smart pointer to CPKIFNameAndKeyWithScoreList

Definition at line 709 of file BasicChecksUtils.cpp.

bool IsNullCertificateSourceList ( CPKIFCertificateSourceListPtr & node )

Interface: Subsystem

This is a predicate function determines if a certificate source list is NULL.

Returns:: True if node parameter is empty, false otherwise

Definition at line 722 of file BasicChecksUtils.cpp.

bool CAC_API PathSigChecker	(	const CPKIFCertificatePath &	path,
		IPKIFCryptoRawOperations *	crypto,
		IPKIFCryptoMisc *	cryptoMisc,
		CPKIFPathValidationResults &	results
	)

Interface: External

This is a utility function that walks a constructed path and validates all the certificates in that path. If the validation was successful the function returns true, if not it returns false.

Returns:: If the validation was successful the function returns true, if not it returns false.

Exceptions:

	CPKIFPathException(COMMON_INVALID_INPUT)
	CPKIFPathException(PATH_TRUST_ROOT_NOT_SET)
	CPKIFPathException(COMMON_UNSUPPORTED_ALG)

XXX*** Added untill NSS supports public keys

Parameters:

path	[in] A smart pointer to a CPKIFCertificatePath object.
crypto	[in] A pointer to IPKIFCryptoRawOperations colleague object.
cryptoMisc	[in] A pointer to IPKIFCryptoMisc colleague object.
results	[in] A reference to CPKIFPathValidationResults object.

Definition at line 850 of file BasicChecksUtils.cpp.

References _GetHashOfToBeSignedCert(), COMMON_INVALID_INPUT, COMMON_UNSUPPORTED_ALG, GetAlgClass(), GetCACHashAlg(), CPKIFCertificatePath::GetPath(), CPKIFCertificatePath::GetTrustRoot(), MAXHASH, PATH_SIGNATURE_VERIFICATION_FAILED, PATH_TRUST_ROOT_NOT_SET, RAISE_PATH_EXCEPTION, CPKIFPathValidationResults::SetCertificate(), CPKIFKeyMaterial::SetCertificate(), CPKIFPathValidationResults::SetCertSignaturesVerified(), CPKIFKeyMaterial::SetSubjectPublicKeyInfo(), CPKIFKeyMaterial::SetWorkingParameters(), CPKIFPathValidationResults::SetWorkingParams(), PKIFCRYPTO::SHA1, TOOLKIT_PATH_CRL_CHECKER, TOOLKIT_PATH_VALIDATOR, and IPKIFCryptoRawOperations::Verify().

Referenced by CPKIFPathValidator2::ValidatePath().

void ProcessPolicyMapping	(	const CPKIFPolicyMappingsPtr &	policyMappings,
		const std::bitset< 3 > &	indicators,
		vector< CPKIFPolicyInformationListPtr > &	authSet
	)

Interface: Subsystem

This is a helper function that processes Policy mapping

process any policy mappings extension by, for each mapping identified in the extension, locate all rows in the authorities-constrained-policy-set table whose [path-depth] column entry is equal to the issuer domain policy value in the extension and delete the row.

Returns:: True if set contains any policy, false otherwise

Exceptions:

CPKIFPathException(COMMON_INVALID_INPUT)

Parameters:

policyMappings	[in] A reference to a smart pointer to CPKIFPolicyMappings object
indicators	[in] Indicators
authSet	[in] Authorities constrained policy set

Definition at line 127 of file BasicChecksUtils.cpp.

References CIssuerDomainMappingList::AddMapping(), COMMON_INVALID_INPUT, DumpPolicySet(), CIssuerDomainMappingList::GetList(), CPKIFPathSettings::POLICY_MAPPING, RowDoesContainPolicyInSet::SetPolicySet(), and TOOLKIT_PATH_VALIDATOR.

Referenced by CPKIFPathBasicChecks2::DoChecks().

bool RowContainsAnyPolicy ( const CPKIFPolicyInformationListPtr & test )

Interface: Subsystem

This is a helper function that checks if poilicy set has any policy then return true

Returns:: True if set contains any policy, false otherwise

Parameters:

test

[in] A reference to a smart pointer to CPKIFPolicyInformationList

Definition at line 104 of file BasicChecksUtils.cpp.

References g_anyPolicy.

Referenced by AddPoliciesToAuthSet().


Functions
	FD_LIST_PTR (CPKIFGeneralSubtree)
	FD_SMART_PTR (CPKIFPolicyInformationSet)
	FD_SMART_PTR (CPKIFPolicyMappings)
	FD_SMART_PTR (CPKIFCertificate)
	FD_SMART_PTR (CPKIFCertificateNodeListWithSourceInfo)
	FD_LIST_PTR (CPKIFNameAndKeyWithScore)
	FD_LIST_PTR (CPKIFPolicyInformation)
	FD_LIST_PTR (CPKIFCertificateSource)
void CAC_API	FindErrorAndSetOnResults (const CPKIFCertificatePath &path, CPKIFPathValidationResults &results)
void CAC_API	IntersectSubtrees (CPKIFGeneralSubtreeListPtr &authSetCondensed, CPKIFGeneralSubtreeListPtr &initSet, CPKIFGeneralSubtreeListPtr &userSet)
bool	CheckNameConstraints (CPKIFCertificatePtr &curCert, CPKIFGeneralSubtreeListPtr &permSubtrees, CPKIFGeneralSubtreeListPtr &exclSubtrees, bool permSubtreesHasBeenSet)
bool CAC_API	PathSigChecker (const CPKIFCertificatePath &path, IPKIFCryptoRawOperations crypto, IPKIFCryptoMisc cryptoMisc, CPKIFPathValidationResults &results)
bool	IsEmpty (CPKIFCertificateNodeListWithSourceInfoPtr &node)
bool	IsEmptyNameAndKey (CPKIFNameAndKeyWithScoreListPtr &node)
bool	IsNullCertificateSourceList (CPKIFCertificateSourceListPtr &node)
bool	RowContainsAnyPolicy (const CPKIFPolicyInformationListPtr &test)
void CAC_API	IntersectSets (CPKIFPolicyInformationListPtr &authSetCondensed, CPKIFPolicyInformationListPtr &initSet, CPKIFPolicyInformationListPtr &userSet)
void	AddPoliciesToAuthSet (const CPKIFPolicyInformationSetPtr &certPols, const std::bitset< 3 > &indicators, std::vector< CPKIFPolicyInformationListPtr > &authSet, bool isSelfIssued, bool isIntermediate)
void	ProcessPolicyMapping (const CPKIFPolicyMappingsPtr &policyMappings, const std::bitset< 3 > &indicators, std::vector< CPKIFPolicyInformationListPtr > &authSet)