BuilderUtils.cpp

Go to the documentation of this file.

#include "BuilderUtils.h"
#include "PKIFPathBasicChecks2.h"
#include "ToolkitUtils.h"
#include "PKIFPathException.h"
#include "PKIFFuncStorage.h"
#include "PKIFCryptUtils.h"
#include "IPKIFCryptoRaw.h"
#include "PKIFX509Extensions2.h"

#include "AuthorityKeyIdentifier.h"
#include "SubjectKeyIdentifier.h"
#include "PKIFPathSettings.h"
#include "BasicConstraints.h"
#include "PolicyMappings.h"
#include "PolicyInformationSet.h"
#include "AuthorityKeyIdentifier.h"
#include "Certificate.h"
#include "KeyUsage.h"
#include "ExtendedKeyUsage.h"
#include "PathResults.h"
#include "CertificateNodeListWithSourceInfo.h"
#include "NodeNotInNodeListAndNotIgnoredAndIssuedBy.h"
#include "OID.h"
#include "GottaMatch.h"
#include "PolicyInformation.h"
#include "IssuedBy.h"
#include "IgnoreNotIssuedByOp.h"
#include "PKIFCertificateNodeEntry.h"
#include "Name.h"
#include "OID.h"
#include "PKIFCertificatePath.h"
#include "IPKIFTrustAnchor.h"
#include "PKIFReversePathState.h"
#include "PKIFNameAndKeyWithScore.h"

#include <vector>
using namespace std;

//implemented in CACDefaultScoring
extern bool SomeMatch(CPKIFPolicyInformationSetPtr& fromCert, CPKIFPolicyInformationSetPtr& fromPrevCert, CPKIFPolicyMappingsPtr& policyMappings);
extern bool SomeMatch(CPKIFPolicyInformationSetPtr& fromCert, CPKIFPolicyInformationListPtr& polsFromPrevCert, CPKIFPolicyMappingsPtr& policyMappings);
bool KeyIDsMatch(CPKIFAuthorityKeyIdentifierPtr& akid, CPKIFCertificatePtr& curCert);
bool CheckPolicies(
    CPKIFCertificatePtr& subjectCert, 
    CPKIFCertificatePtr& issuerCert, 
    CPKIFPathSettingsPtr& settings)
{
    CPKIFPolicyInformationListPtr initPolSet;
    settings->GetInitialPolicySet(initPolSet);
    //if(initPolSet->empty()) return true;
    //Added 8/1/2005 Armen
    if(initPolSet->empty())   
          return true;  
     else  
     {  
          CPKIFPolicyInformationList::iterator pos;  
          CPKIFPolicyInformationList::iterator end = initPolSet->end();  
          for(pos = initPolSet->begin(); pos != end; ++pos)  
          {  
               if(*g_anyPolicy == *(*pos))  
                    return true;  
          }  
     }

    CPKIFPolicyInformationSetPtr cpsFromIssuerCert = issuerCert->GetExtension<CPKIFPolicyInformationSet>();
    if(cpsFromIssuerCert != (CPKIFPolicyInformationSet*)NULL)
    {
//      if(!SomeMatch(cpsFromIssuerCert, initPolSet)) return false;

        CPKIFPolicyInformationSetPtr cpsFromSubCert = subjectCert->GetExtension<CPKIFPolicyInformationSet>();
        CPKIFPolicyMappingsPtr policyMappings = issuerCert->GetExtension<CPKIFPolicyMappings>();
        if(!SomeMatch(cpsFromIssuerCert, cpsFromSubCert, policyMappings)) 
            return false;
        else 
            return true;
    }
    else
        return true; // no policies == NULL intersection //Changed from return false on 8/1/2005 Armen
}
bool CheckKIDsAndSignatures(
    CPKIFCertificatePtr& subjectCert, 
    CPKIFCertificatePtr& issuerCert)
{
    CPKIFAuthorityKeyIdentifierPtr akid = subjectCert->GetExtension<CPKIFAuthorityKeyIdentifier>();
    if(KeyIDsMatch(akid, issuerCert))
        return true;
    else
    {
        IPKIFCryptoRaw * raw = GetPlatformCryptoRaw();
        bool sigVerified = false;
        try
        {
            sigVerified = raw->VerifyCertificate(*issuerCert, *subjectCert);
        }
        catch(...)
        {
        }
        return sigVerified;
    }
}


//walks a cert node list and clears the ignore flag on each entry
//removed export declarations 8/18/2004
void ClearAllIgnore(
    CPKIFCertificateNodeListWithSourceInfoPtr& tablePos)
{
    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = tablePos->end();
    for(pos = tablePos->begin(); pos != end; ++pos)
        (*pos)->ClearIgnore();
}
void ClearAllIgnore(
    CPKIFNameAndKeyWithScoreListPtr& tablePos)
{
    CPKIFNameAndKeyWithScoreList::iterator pos;
    CPKIFNameAndKeyWithScoreList::iterator end = tablePos->end();
    for(pos = tablePos->begin(); pos != end; ++pos)
        (*pos)->ClearIgnore();
}

//returns true if all nodes in a node list are set to ignore - false otherwise
//bool AllAreSetToIgnore(CPKIFCertificateNodeListWithSourceInfoPtr& tablePos)
//{
//  CPKIFCertificateNodeList::iterator pos;
//  CPKIFCertificateNodeList::iterator end = tablePos->end();
//  for(pos = tablePos->begin(); pos != end; ++pos)
//  {
//      if(false == (*pos)->GetIgnore())
//          return false;
//  }
//
//  return true;
//}


bool SetNextToIgnore(
    CPKIFCertificateNodeListWithSourceInfoPtr& tablePos)
{
    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = tablePos->end();
    bool set = false;
    for(pos = tablePos->begin(); pos != end; ++pos)
    {
        if(set)
        {
            if(false == (*pos)->GetIgnore() && false == (*pos)->GetHardIgnore())
                return false;
        }
        else if(false == (*pos)->GetIgnore() && false == (*pos)->GetHardIgnore())
        {
            (*pos)->SetIgnore();
            set = true;
        }
    }

    return true; //need to advance the row
}

bool SetNextToIgnore(
    CPKIFNameAndKeyWithScoreListPtr& tablePos)
{
    CPKIFNameAndKeyWithScoreList::iterator pos;
    CPKIFNameAndKeyWithScoreList::iterator end = tablePos->end();
    bool set = false;
    for(pos = tablePos->begin(); pos != end; ++pos)
    {
        if(set)
        {
            if(false == (*pos)->GetIgnore())
                return false;
        }
        else if(false == (*pos)->GetIgnore())
        {
            (*pos)->SetIgnore();
            set = true;
        }
    }

    return true; //need to advance the row
}

void RemoveAllIssuedBy(
    CPKIFCertificateNodeListWithSourceInfoPtr& pos,
    CPKIFNamePtr& prevName)
{
    IssuedBy issuedBy;
    issuedBy.SetRHS(prevName);
    CPKIFCertificateNodeList::iterator end;
    end = remove_if(pos->begin(), pos->end(), issuedBy);
    pos->erase(end, pos->end());
}

void RemoveAllIssuedBy(
    CPKIFNameAndKeyWithScoreListPtr& pos,
    CPKIFNamePtr& prevName)
{
    IssuedByNameAndKey issuedBy;
    issuedBy.SetRHS(prevName);
    CPKIFNameAndKeyWithScoreList::iterator end;
    end = remove_if(pos->begin(), pos->end(), issuedBy);
    pos->erase(end, pos->end());
}

void RemoveAllIssuedTo(
    CPKIFNameAndKeyWithScoreListPtr& pos,
    CPKIFNamePtr& prevName)
{
    IssuedTo issuedTo;
    issuedTo.SetRHS(prevName);
    CPKIFNameAndKeyWithScoreList::iterator end;
    end = remove_if(pos->begin(), pos->end(), issuedTo);
    pos->erase(end, pos->end());
}

//removed export declarations 8/18/2004
void IgnoreNotIssuedBy(
    CPKIFCertificateNodeListWithSourceInfoPtr& pos, 
    CPKIFNamePtr& issuerName)
{
    IgnoreNotIssuedByOp ignoreNotIssuedBy;
    ignoreNotIssuedBy.SetRHS(issuerName);
    transform(pos->begin(), pos->end(), pos->begin(), ignoreNotIssuedBy);
}
void IgnoreNotIssuedBy(
    CPKIFNameAndKeyWithScoreListPtr& pos, 
    CPKIFNamePtr& issuerName)
{
    IgnoreNotIssuedByOp ignoreNotIssuedBy;
    ignoreNotIssuedBy.SetRHS(issuerName);
    transform(pos->begin(), pos->end(), pos->begin(), ignoreNotIssuedBy);
}
//the function name says it all (now also checks signatures, where KIDs miss, and policies)
CPKIFCertificateNodeEntryPtr GetFirstNonIgnoredNodeNotAlreadyInPathIssuedBy(
    CPKIFCertificateNodeListWithSourceInfoPtr& pos, 
    CPKIFCertificateNodeList& builtPath, 
    IPKIFNameAndKey* issuer,
    CPKIFPathSettingsPtr& settings)
{
    CPKIFCertificateNodeEntryPtr tmp;
    if(!builtPath.empty())
    {
        //if the path is not empty then we must factor the path into our search
        //first, set up the predicate object with the path and the issuer
        NodeNotInNodeListAndNotIgnoredAndIssuedBy n;
        n.SetNodeList(&builtPath);
        n.SetPathSettings(settings);
        n.SetIssuer(dynamic_cast<IPKIFNameAndKey*>(&(*issuer)));

        //next get iterators that bound the node list
        CPKIFCertificateNodeList::iterator pathPos = pos->begin();
        CPKIFCertificateNodeList::iterator pathEnd = pos->end();

        //then invoke find_if using the predicate - if the returned value
        //is not the end of the node list then return it (i.e. it points
        //to the first non-ignored node issued by issuer that isn't in builtPath)
        CPKIFCertificateNodeList::iterator retPos = find_if(pathPos, pathEnd, n);
        if(retPos != pathEnd)
            tmp = *retPos;
    }
    else if(!pos->empty())
    {
        CPKIFNamePtr issuerName = issuer->GetSubjectName();

        //if the path is empty and the node list is not empty then we search 
        //for the first non-ignored node in the list and return it
        CPKIFCertificateNodeList::iterator pathPos = pos->begin();
        CPKIFCertificateNodeList::iterator pathEnd = pos->end();
        for(pathPos = pos->begin(); pathPos != pathEnd; ++pathPos)
        {
            if(!(*pathPos)->GetIgnore() && *issuerName == *(*pathPos)->GetCert()->Issuer())
            {
                tmp = *pathPos;
                break;
            }
        }
    }

    //return our findings (possibly empty)
    return tmp;
}
CPKIFNameAndKeyWithScorePtr GetFirstNonIgnoredNodeNotAlreadyInPathIssuedBy(
    CPKIFNameAndKeyWithScoreListPtr& pos, 
    CPKIFNameAndKeyWithScoreList& builtPath, 
    IPKIFNameAndKeyPtr& issuer,
    CPKIFPathSettingsPtr& settings)
{
    CPKIFNameAndKeyWithScorePtr tmp;
    if(!builtPath.empty())
    {
        //if the path is not empty then we must factor the path into our search
        //first, set up the predicate object with the path and the issuer
        NodeNotInNodeListAndNotIgnoredAndIssuedBy n;
        n.SetNodeList(&builtPath);
        n.SetPathSettings(settings);
        n.SetIssuer(dynamic_cast<IPKIFNameAndKey*>(&(*issuer)));

        //next get iterators that bound the node list
        CPKIFNameAndKeyWithScoreList::iterator pathPos = pos->begin();
        CPKIFNameAndKeyWithScoreList::iterator pathEnd = pos->end();

        //then invoke find_if using the predicate - if the returned value
        //is not the end of the node list then return it (i.e. it points
        //to the first non-ignored node issued by issuer that isn't in builtPath)
        CPKIFNameAndKeyWithScoreList::iterator retPos = find_if(pathPos, pathEnd, n);
        if(retPos != pathEnd)
            tmp = *retPos;
    }
    else if(!pos->empty())
    {
        CPKIFNamePtr issuerName = issuer->GetSubjectName();

        //if the path is empty and the node list is not empty then we search 
        //for the first non-ignored node in the list and return it
        CPKIFNameAndKeyWithScoreList::iterator pathPos = pos->begin();
        CPKIFNameAndKeyWithScoreList::iterator pathEnd = pos->end();
        for(pathPos = pos->begin(); pathPos != pathEnd; ++pathPos)
        {
            if(!(*pathPos)->GetIgnore() && *issuerName == *(*pathPos)->GetNameAndKey()->GetIssuerName())
            {
                tmp = *pathPos;
                break;
            }
        }
    }

    //return our findings (possibly empty)
    return tmp;
}

//#ifdef _DEBUG_PATH
#include <iostream>
#include <fstream>
ofstream g_pathTableLogFile;
void DumpTable( 
    vector<CPKIFCertificateNodeListWithSourceInfoPtr>& table, const char * title)
{
    try
    {
        if(!g_pathTableLogFile.is_open())
        {
            g_pathTableLogFile.open("_DEBUG_PATH_TABLE_Log.txt", ios::out);
        }

        g_pathTableLogFile << endl << "Dumping table from " << title << endl;

        vector<CPKIFCertificateNodeListWithSourceInfoPtr>::iterator pos;
        vector<CPKIFCertificateNodeListWithSourceInfoPtr>::iterator end = table.end();
        int rowNum = 0;
        for(pos = table.begin(); pos != end; ++pos)
        {
            g_pathTableLogFile << "Dumping row #" << ++rowNum << endl;
            if(!(*pos)->empty())
                g_pathTableLogFile << "Subject: " << (*pos)->front()->GetCert()->Subject()->ToString() << endl;
            else
                g_pathTableLogFile << "Subject: EMPTY ROW" << endl;

            CPKIFCertificateNodeListWithSourceInfo::iterator rowPos;
            CPKIFCertificateNodeListWithSourceInfo::iterator rowEnd = (*pos)->end();
            for(rowPos = (*pos)->begin(); rowPos != rowEnd; ++rowPos)
            {
                g_pathTableLogFile << "\t" << (*rowPos)->GetCert()->Issuer()->ToString();
                g_pathTableLogFile << "\t" << (*rowPos)->GetCert()->SerialNumber();
                if((*rowPos)->GetIgnore())
                    g_pathTableLogFile << "\t" << "IGNORED" << endl;
                else if((*rowPos)->GetHardIgnore())
                    g_pathTableLogFile << "\t" << "HARD IGNORED" << endl;
                else
                    g_pathTableLogFile << endl;
            }
        }
    }
    catch(CPKIFException& pe)
    {
        cout << "CPKIFException in DumpTable: " << pe.print() << endl;
    }
    catch(std::exception& se)
    {
        cout << "std::exception in DumpTable: " << se.what() << endl;
    }
    catch(...)
    {
        cout << "Unknown error in DumpTable" << endl;
    }
}

void anythingGoes(
    const CPKIFCertificateNodeEntryPtr& certNode, 
    CPKIFPathValidationResults& results,
    CertificateType type)
{
    CPKIFCertificatePtr curCert = certNode->GetCert();
    if(curCert)
    {
        std::vector<CPKIFX509ExtensionPtr> exts;
        CPKIFX509ExtensionMediator2 * mediator = CPKIFX509ExtensionMediator2::GetInstance();
        curCert->GetExtensions(mediator, exts);

        std::vector<CPKIFX509ExtensionPtr>::iterator pos;
        std::vector<CPKIFX509ExtensionPtr>::iterator end = exts.end();
        for(pos = exts.begin(); pos != end; ++pos)
        {
            certNode->MarkExtensionAsProcessed(*pos);
        }
    }
}

CPKIFOIDPtr g_entuOid;

//#endif
bool PathOK(
    CPKIFCertificateNodeList& builtPath, 
    IPKIFTrustAnchorPtr& curRoot, 
    CPKIFPathSettingsPtr& settings, 
    CPKIFPathValidationResults& tmpResults)
{
    CPKIFCertificatePath tmpPath;
    tmpPath.SetPathSettings(settings);
    tmpPath.SetTrustRoot(curRoot);
    tmpPath.SetPath(builtPath);
    CPKIFFuncStoragePtr pfs(new CPKIFFuncStorage(anythingGoes));
    try
    {
        if(CPKIFPathBasicChecks2::DoChecks(tmpPath, tmpResults, pfs))
        {
            bool retVal = true;

            //fail on key identifier mismatches when the subject certificate is self-issued
            //or when the entrust version ext is present
            CPKIFSubjectKeyIdentifierPtr skid = curRoot->GetKeyIdentifier();

            bool prevCertSelfIssued = true;
            bool curCertSelfIssued = false;
            bool prevHadEntuExt = false;
            CPKIFCertificatePtr curCert;
            CPKIFCertificateNodeList::iterator pos;
            CPKIFCertificateNodeList::iterator end = builtPath.end();
            for(pos = builtPath.begin(); pos != end; ++pos)
            {
                curCert = (*pos)->GetCert();

                if(skid)
                {
                    if(!g_entuOid)
                    {
                        CPKIFOIDPtr entuOid(new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113533.7.65.0"))));
                        g_entuOid = entuOid;
                    }

                    CPKIFAuthorityKeyIdentifierPtr akid = curCert->GetExtension<CPKIFAuthorityKeyIdentifier>();
                    CPKIFX509ExtensionPtr entuExt;
                    curCert->GetExtensionByOID(*g_entuOid, entuExt);
                    curCertSelfIssued = curCert->IsSelfIssued();
                    if(akid  && akid->KeyIDPresent() && (prevHadEntuExt || prevCertSelfIssued || curCertSelfIssued))
                    {
                        CPKIFBufferPtr akidKeyID = akid->KeyIdentifier();
                        CPKIFBufferPtr skidKeyID = skid->KeyIdentifier();
                        if(akidKeyID != (CPKIFBuffer*)NULL && skidKeyID != (CPKIFBuffer*)NULL)
                        {
                            if(!(*akidKeyID == *skidKeyID))
                                retVal = false;
                        }
                    }
                    if(entuExt)
                        prevHadEntuExt = true;
                    else
                        prevHadEntuExt = false;
                }

                skid = curCert->GetExtension<CPKIFSubjectKeyIdentifier>();
                prevCertSelfIssued = curCertSelfIssued;
            }

            return retVal;
        }
        else
            return false;
    }
    catch(CPKIFException&)
    {
        return false;
    }
}