CACCertificate.cpp

Go to the documentation of this file.

#include "Certificate.h"
#include "AlgorithmIdentifier.h"
#include "Name.h"
#include "Validity.h"
#include "SubjectPublicKeyInfo.h"
#include "PKIFCryptUtils.h"

#include "PKIFX509Extensions2.h"
#include "IPKIFCryptoRaw.h"
#include "ExtensionsMatch.h"
#include "PKIFException.h"
#include "ASN1Helper.h"
#include "Buffer.h"
#include "PKIFTime.h"
#include "PKIFCommonErrors.h"
#include "PKIFBase64.h"
#include "BasicConstraints.h"

#include "PKIX1Explicit88.h"
#include "PKIX1Implicit88.h"

#include <vector>
using namespace std;

struct CPKIFCertificateImpl
{
    CPKIFCertificateImpl ();
  void populateExtensionsVector();
  
  // added 2/24/2005
  void ClearContent();
  
  CPKIFBufferPtr m_rawCert;
  CPKIFASNWrapper<CACX509V3Certificate> m_signedCert;
  CPKIFAlgorithmIdentifierPtr m_signatureAlgFromSignedMacro;
  std::vector<CPKIFX509ExtensionPtr> m_exts;
  
  // non-primitive cert members
  CPKIFAlgorithmIdentifierPtr m_signatureAlg;
  CPKIFNamePtr m_issuer;
  CPKIFValidityPtr m_validity;
  CPKIFNamePtr m_subject;
  CPKIFSubjectPublicKeyInfoPtr m_subjectPublicKeyInfo;
  
  // added these 8/27/2004
  bool m_bSelfSigned;
  bool m_bSelfSignedSet;
  bool m_bSelfIssued;
  bool m_bSelfIssuedSet;

  // pointer back to the certificate class
  CPKIFCertificate * m_this;
};
CPKIFCertificateImpl::CPKIFCertificateImpl ()
: m_signedCert(BEREncCACX509V3Certificate, BERDecCACX509V3Certificate)
{
}

void CPKIFCertificateImpl::populateExtensionsVector()
{
    if(NULL == m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    //if we've already populated the extensions vector then return
    if(!m_exts.empty())
        return;

    //if there are no extensions then return
    if(0 == m_signedCert->tbsCertificate.m.extensionsPresent)
    {
        m_exts.clear();
        return;
    }

    // get the one and only extension mediator, with any additions an app might
    // have made
    CPKIFX509ExtensionMediator2 * mediator = CPKIFX509ExtensionMediator2::GetInstance();
    m_this->IPKIFHasExtensions::GetExtensions (mediator, m_exts);
}

//added 2/24/2005
void CPKIFCertificateImpl::ClearContent()
{
    CPKIFBufferPtr tmpBuf;
    m_rawCert = tmpBuf;
    
    m_exts.clear();

    CPKIFAlgorithmIdentifierPtr tmpAlg;
    m_signatureAlg = tmpAlg;

    CPKIFNamePtr tmpIss;
    m_issuer = tmpIss;
    CPKIFValidityPtr tmpVal;
    m_validity = tmpVal;
    CPKIFNamePtr tmpSub;
    m_subject = tmpSub;
    CPKIFSubjectPublicKeyInfoPtr tmpSPKI;
    m_subjectPublicKeyInfo = tmpSPKI;

    m_bSelfSigned = false;
    m_bSelfSignedSet = false;
    m_bSelfIssued = false;
    m_bSelfIssuedSet = false;
}


//void CPKIFCertificate::GetExtensions (vector<CPKIFX509ExtensionPtr>& ext) 
//{
//  m_impl->populateExtensionsVector();
//  ext = m_impl->m_exts;
//}

CPKIFCertificate::CPKIFCertificate(void)
  :m_impl (new CPKIFCertificateImpl)
{
  //m_impl->m_signedCert(BEREncCACX509V3Certificate, BERDecCACX509V3Certificate);
  m_impl->m_bSelfSigned = false; //has no meaning unless set = true
  m_impl->m_bSelfSignedSet = false;
  m_impl->m_bSelfIssued = false;//has no meaning unless set = true
  m_impl->m_bSelfIssuedSet = false;
  m_impl->m_this = this;
}
CPKIFCertificate::~CPKIFCertificate(void)
{
    if(m_impl)
    {   
        delete m_impl;
        m_impl = 0;
    }
}
bool CPKIFCertificate::IsSelfIssued() const
{
    if(!m_impl->m_bSelfIssuedSet)
    {
        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_bSelfIssuedSet = true;
        nonConstCert->m_impl->m_bSelfIssued = (*Subject() == *Issuer());
    }

    return m_impl->m_bSelfIssued;
}
bool CPKIFCertificate::IsSelfSigned() const
{
    if(!m_impl->m_bSelfSignedSet)
    {
        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_bSelfSignedSet = true;
        IPKIFCryptoRaw* raw = GetPlatformCryptoRaw();
        if(raw)
        {
            nonConstCert->m_impl->m_bSelfSigned = raw->VerifyCertificate(*this, *this);
        }
    }

    return m_impl->m_bSelfSigned;
}
CPKIFBufferPtr CPKIFCertificate::Encoded() const 
{
    return m_impl->m_rawCert;
}

void CPKIFCertificate::Decode(
    const unsigned char* cert, 
    int certLen)
{
    try 
    {
        m_impl->ClearContent();
        CPKIFBufferPtr tmp(new CPKIFBuffer(cert, certLen));
        m_impl->m_rawCert = tmp;
        m_impl->m_signedCert.Decode(m_impl->m_rawCert->GetBuffer(), m_impl->m_rawCert->GetLength());

    } 
    catch ( ... ) 
    {

        m_impl->ClearContent();
        unsigned char * decoded = NULL;
        unsigned long decodedLen;
        bool b = PEMDecode_l((char *)cert, certLen, &decoded, &decodedLen);
        if(b)
        {
            try
            {
                m_impl->ClearContent();
                CPKIFBufferPtr tmp2(new CPKIFBuffer(decoded, decodedLen));
                m_impl->m_rawCert = tmp2;
                m_impl->m_signedCert.InitContext();
                m_impl->m_signedCert.Decode(m_impl->m_rawCert->GetBuffer(), m_impl->m_rawCert->GetLength());

                if(NULL != decoded)
                    delete[] decoded;

            }catch(...)
            {
                if(NULL != decoded)
                    delete[] decoded;
                m_impl->ClearContent();
                throw;
            }
        }
        else
        {
            if(NULL != decoded)
                delete[] decoded;
            m_impl->ClearContent();
            throw;
        }
    }

    //Added a call to Version() to make sure certificae contains an acceptable version
    Version();
}
int CPKIFCertificate::Version() const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(!m_impl->m_signedCert->tbsCertificate.m.versionPresent)
        return 1;

    switch( m_impl->m_signedCert->tbsCertificate.version ) 
    {
        case CACX509V3AFv1:
            return 1;
            break;
        case CACX509V3AFv2:
            return 2;
            break;
        case CACX509V3AFv3:
            return 3;
            break;
        default:
            throw CPKIFException(TOOLKIT_ASN, COMMON_UNSUPPORTED_VERSION, "Unsupported certificate version");
        break;
    }
}
const char* CPKIFCertificate::SerialNumber() const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    return m_impl->m_signedCert->tbsCertificate.serialNumber; 
}
CPKIFAlgorithmIdentifierPtr CPKIFCertificate::TBSSignatureAlgorithm() const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_signatureAlg == (CPKIFAlgorithmIdentifier*)NULL)
    {

        CPKIFOIDPtr algOID(new CPKIFOID(m_impl->m_signedCert->tbsCertificate.signature.algorithm.subid,
                                    m_impl->m_signedCert->tbsCertificate.signature.algorithm.numids));
        
        CPKIFBufferPtr paramBuf;
        if(m_impl->m_signedCert->tbsCertificate.signature.m.parametersPresent)
        {
            paramBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_signedCert->tbsCertificate.signature.parameters.data,
                                m_impl->m_signedCert->tbsCertificate.signature.parameters.numocts));
        
        
        }
        
        CPKIFAlgorithmIdentifierPtr tmpRef(new CPKIFAlgorithmIdentifier(algOID, paramBuf)); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_signatureAlg = tmpRef;
    }

    return m_impl->m_signatureAlg;
}
CPKIFAlgorithmIdentifierPtr CPKIFCertificate::SignatureAlgorithm( ) const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_signatureAlgFromSignedMacro == (CPKIFAlgorithmIdentifier*)NULL)
    {

        CPKIFOIDPtr algOID(new CPKIFOID(m_impl->m_signedCert->signatureAlgorithm.algorithm.subid,
                                    m_impl->m_signedCert->signatureAlgorithm.algorithm.numids));
        
        CPKIFBufferPtr paramBuf;
        if(m_impl->m_signedCert->signatureAlgorithm.m.parametersPresent)
        {
            paramBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_signedCert->signatureAlgorithm.parameters.data,
                                m_impl->m_signedCert->signatureAlgorithm.parameters.numocts));
        
        
        }
        
        CPKIFAlgorithmIdentifierPtr tmpRef(new CPKIFAlgorithmIdentifier(algOID, paramBuf)); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_signatureAlgFromSignedMacro = tmpRef;
    }

    return m_impl->m_signatureAlgFromSignedMacro;
}
CPKIFSubjectPublicKeyInfoPtr CPKIFCertificate::SubjectPublicKeyInfo( ) const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_subjectPublicKeyInfo == (CPKIFSubjectPublicKeyInfo*)NULL)
    {
        
        CPKIFOIDPtr algOID(new CPKIFOID(m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.algorithm.algorithm.subid,
                                    m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.algorithm.algorithm.numids));
        
        CPKIFBufferPtr paramBuf;
        if(m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.algorithm.m.parametersPresent)
        {
            paramBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.algorithm.parameters.data,
                                m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.algorithm.parameters.numocts));
        
        
        }
        
        CPKIFAlgorithmIdentifierPtr tmpAlgID(new CPKIFAlgorithmIdentifier(algOID, paramBuf));

        CPKIFBufferPtr tempBuffer(new CPKIFBuffer(m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.data,
                            m_impl->m_signedCert->tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.numbits/8));

        CPKIFSubjectPublicKeyInfo* tmpSPKI = new CPKIFSubjectPublicKeyInfo(tmpAlgID, tempBuffer);
        CPKIFSubjectPublicKeyInfoPtr tmpRef(tmpSPKI); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_subjectPublicKeyInfo = tmpRef;
    }

    return m_impl->m_subjectPublicKeyInfo;
}
CPKIFNamePtr CPKIFCertificate::Issuer( ) const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_issuer == (CPKIFName*)NULL)
    {
        CACASNWRAPPER_CREATE(CACX509V3Name, objPDU2);
        ASN1OpenType* data1 = objPDU2.Encode(&(m_impl->m_signedCert->tbsCertificate.issuer));
        CPKIFBufferPtr tmpBuf;
        if (data1 != NULL)
        {
             tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
            delete data1;
        }
        //CPKIFName* tmpName = new CPKIFName(m_impl->m_signedCert->tbsCertificate.issuer);
        CPKIFName* tmpName = new CPKIFName(tmpBuf);
        CPKIFNamePtr tmpRef(tmpName); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_issuer = tmpRef;
    }

    return m_impl->m_issuer;
}
CPKIFNamePtr CPKIFCertificate::Subject( ) const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_subject == (CPKIFName*)NULL)
    {
        CACASNWRAPPER_CREATE(CACX509V3Name, objPDU2);
        ASN1OpenType* data1 = objPDU2.Encode(&(m_impl->m_signedCert->tbsCertificate.subject));
        CPKIFBufferPtr tmpBuf;
        if (data1 != NULL)
        {   
             tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
            delete data1;
        }
        //CPKIFName* tmpName = new CPKIFName(m_impl->m_signedCert->tbsCertificate.subject);
        CPKIFName* tmpName = new CPKIFName(tmpBuf);
        CPKIFNamePtr tmpRef(tmpName); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_subject = tmpRef;
    }

    return m_impl->m_subject;
}
CPKIFValidityPtr CPKIFCertificate::Validity( ) const
{
    if(NULL == m_impl->m_signedCert.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a certificate object prior to parsing a certificate.");

    if(m_impl->m_validity == (CPKIFValidity*)NULL)
    {
        CPKIFTimePtr notBefore;
        if(m_impl->m_signedCert->tbsCertificate.validity.notBefore.t == T_CACX509V3Time_utcTime)
        {
            notBefore = CPKIFTimePtr(new CPKIFTime(m_impl->m_signedCert->tbsCertificate.validity.notBefore.u.utcTime,
                            UTCTIME));
        }
        else
        {
            notBefore = CPKIFTimePtr(new CPKIFTime(m_impl->m_signedCert->tbsCertificate.validity.notBefore.u.generalTime,
                            GENERALIZEDTIME));
        }

        CPKIFTimePtr notAfter;
        if(m_impl->m_signedCert->tbsCertificate.validity.notAfter.t == T_CACX509V3Time_utcTime)
        {
            notAfter = CPKIFTimePtr(new CPKIFTime(m_impl->m_signedCert->tbsCertificate.validity.notAfter.u.utcTime,
                            UTCTIME));
        }
        else
        {
            notAfter = CPKIFTimePtr(new CPKIFTime(m_impl->m_signedCert->tbsCertificate.validity.notAfter.u.generalTime,
                            GENERALIZEDTIME));
        }
        
            
        CPKIFValidity* tmpName = new CPKIFValidity(notBefore, notAfter);
        CPKIFValidityPtr tmpRef(tmpName); 

        CPKIFCertificate* nonConstCert = const_cast<CPKIFCertificate*>(this);
        nonConstCert->m_impl->m_validity = tmpRef;
    }

    return m_impl->m_validity;
}


//this function is for use when retrieving an extension for which no proper class exists
void CPKIFCertificate::GetExtensionByOID(
    const CPKIFOID& oid,
    CPKIFX509ExtensionPtr& ref)
{
    if(m_impl->m_exts.empty() && (NULL != m_impl->m_signedCert.data() && m_impl->m_signedCert->tbsCertificate.m.extensionsPresent && 0 != m_impl->m_signedCert->tbsCertificate.extensions.count))
        m_impl->populateExtensionsVector();

    vector<CPKIFX509ExtensionPtr>::iterator pos;
    vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        if(oid == (*pos)->oid())
        {
            ref = *pos;
            return;
        }
    }       
}
bool CPKIFCertificate::AreThereAnyUnprocessedCriticalExtensions(
    std::vector<CPKIFX509ExtensionPtr>& processedExts)
{
    // XXX TODO: commenting this out for the moment; we really need to make it true.
    /*if(processedExts.size() > m_impl->m_exts.size())
    {
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT,
            "More extensions were processed than are present in the certificate.");
    }*/
    std::vector<CPKIFX509ExtensionPtr>::iterator pos;
    std::vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    std::vector<CPKIFX509ExtensionPtr>::iterator processedEnd = processedExts.end();
    ExtensionsMatch em;
    size_t count = processedExts.size();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        em.SetRHS(*pos);
        if((*pos)->isCritical() && processedEnd == find_if(processedExts.begin(), processedExts.end(), em))
            return true;
    }

    return false;
}
bool CPKIFCertificate::operator==(
    const CPKIFCertificate& rhs) const
{
    if(*m_impl->m_rawCert == *rhs.Encoded())
        return true;
    else
    {
        const char* lhsSN = SerialNumber();
        const char* rhsSN = rhs.SerialNumber();
        //reviewed 4/24 - added strlen check
        if(strlen(lhsSN) != strlen(rhsSN) || 0 != stricmp(lhsSN, rhsSN))
            return false;
        else
            return *Issuer() == *rhs.Issuer();
    }
}
CPKIFBufferPtr CPKIFCertificate::Signature() const
{
    CPKIFBufferPtr tmp(new CPKIFBuffer(m_impl->m_signedCert->signature.data, m_impl->m_signedCert->signature.numbits/8));
    return tmp;
}

void CPKIFCertificate::GetEncodedExtensions (
    CPKIFBufferPtr& buf) 
{
    try 
    {
        if (m_impl->m_signedCert->tbsCertificate.m.extensionsPresent)
        {
            CACASNWRAPPER_CREATE(CACX509V3Extensions, extsWrapper);
            ASN1OpenType *data = extsWrapper.Encode (&m_impl->m_signedCert->tbsCertificate.extensions);
            CPKIFBufferPtr tmp(new CPKIFBuffer(data->data, data->numocts));
            buf = tmp;
            delete data;
            return;
        }
    }
    catch (... /*CPKIFException& e*/)
    {
        // How do we want to handle the exception?
    }

    CPKIFBufferPtr nullExt;
    buf = nullExt;
}
CPKIFNamePtr CPKIFCertificate::GetSubjectName() const
{
    return Subject();
}
CPKIFBufferPtr CPKIFCertificate::GetKey() const
{
    CPKIFSubjectPublicKeyInfoPtr spki = SubjectPublicKeyInfo();
    if(spki != (CPKIFSubjectPublicKeyInfo*)NULL)
        return spki->rawKey();
    else
    {
        CPKIFBufferPtr bp;
        return bp;
    }
}
CPKIFNamePtr CPKIFCertificate::GetIssuerName() const
{
    return Issuer();
}
CPKIFSubjectPublicKeyInfoPtr CPKIFCertificate::GetSubjectPublicKeyInfo() const
{
    return SubjectPublicKeyInfo();
}

bool CAC_API IsCaCertificate(CPKIFCertificatePtr& cert)
{
    if(cert)
    {
        try
        {
            CPKIFBasicConstraintsPtr bc = cert->GetExtension<CPKIFBasicConstraints>();
            if(bc && bc->isCA())
                return true;
        }
        catch(...)
        {
        }
    }

    return false;
}