CRL.cpp

Go to the documentation of this file.

#include "CRL.h"
#include "CRLEntry.h"
#include "ASN1Helper.h"
#include "Certificate.h"
#include "Buffer.h"
#include "Name.h"
#include "PKIFTime.h"
#include "AlgorithmIdentifier.h"
#include "ExtensionsMatch.h"
#include "PKIFException.h"
#include "PKIFX509Extensions2.h"
#include "IssuingDistributionPoint.h"
#include "CertificateIssuer.h"
#include "GeneralName.h"
#include "PKIFBase64.h"

#include "PKIFCommonErrors.h"

using namespace std;

struct CPKIFCRLImpl
{
  CPKIFCRLImpl ();
  //added 2/24/2005
  void ClearContent();
  
  void populateExtensionsVector();

  void PopulateEntryMap();
  
  CPKIFBufferPtr m_rawCRL;
  CPKIFASNWrapper<CACX509V3CertificateList> m_signedCRL;
  std::vector<CPKIFX509ExtensionPtr> m_exts;
  std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > > m_vector;
  CPKIFNamePtr m_issuer;
  CPKIFTimePtr m_nextUpdate;
  CPKIFTimePtr m_thisUpdate;
  CPKIFAlgorithmIdentifierPtr m_sigAlg;
  CPKIFCRL * m_this;
};

void CPKIFCRLImpl::PopulateEntryMap()
{
    if(!m_vector.empty())
        return;

    if( m_signedCRL->tbsCertList.m.revokedCertificatesPresent )
    {

        bool isIndirect = false;
        CPKIFIssuingDistributionPointPtr idp = m_this->GetExtension<CPKIFIssuingDistributionPoint>();
        if(idp != (CPKIFIssuingDistributionPoint*)NULL)
        {
            isIndirect = idp->IndirectCRL();
        }
        CPKIFNamePtr actIssDN;
        
        DListNode* cur = m_signedCRL->tbsCertList.revokedCertificates.head;
        CACX509V3RevokedCerts* curData = NULL;
        while(NULL != cur)
        {
            ASN1OpenType * ot = (ASN1OpenType *) cur->data;
            CPKIFCRLEntryPtr ce(new CPKIFCRLEntry(CPKIFBufferPtr(new CPKIFBuffer(ot->data,ot->numocts))));

            CPKIFCertificateIssuerPtr ci;
            ci = ce->GetExtension<CPKIFCertificateIssuer>();
            if(ci != (CPKIFCertificateIssuer*)NULL)
            {
                CPKIFGeneralNameList genNames;
                ci->CertificateIssuer(genNames);

                CPKIFNamePtr emptyDN;
                actIssDN = emptyDN;

                CPKIFGeneralNameList::iterator pos;
                CPKIFGeneralNameList::iterator end = genNames.end();
                for(pos = genNames.begin(); pos != end; ++pos)
                {
                    if((*pos)->GetType() == CPKIFGeneralName::DIRECTORYNAME)
                    {
                        actIssDN = (*pos)->directoryName();
                    }
                }

                if(actIssDN == (CPKIFName*)NULL)
                    throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "A CRL entry contained an unsupported non-DN CertificateIssuer extension.");
            }
            else
            {
                if(actIssDN == (CPKIFName*)NULL)
                    actIssDN = m_this->Issuer();
            }

            bool found = false;
            std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > >::iterator pos;
            std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > >::iterator end = m_vector.end();
            for(pos = m_vector.begin(); pos != end; ++pos)
            {

                if(*(*pos).first ==  *actIssDN)
                {
                    //(*pos).second.insert( make_pair( ce->SerialNumber(), ce ) );
                    (*pos).second.insert( make_pair( string(ce->SerialNumber()), ce ) );
                    found = true;
                }

            }   
            if(!found)
            {
                std::map<std::string, CPKIFCRLEntryPtr> tmpMap;
                //tmpMap.insert( make_pair( ce->SerialNumber(), ce ) );
                tmpMap.insert( make_pair( string(ce->SerialNumber()), ce ) );
                m_vector.push_back(make_pair( actIssDN, tmpMap ));
            }

            //m_crlEntryMap.insert( make_pair( ce->SerialNumber(), ce ) );

            cur = cur->next;
        }
    }
}

CPKIFCRLImpl::CPKIFCRLImpl ():m_signedCRL(BEREncCACX509V3CertificateList, BERDecCACX509V3CertificateList)
{
}

//added 2/24/2005
void CPKIFCRLImpl::ClearContent()
{
    CPKIFBufferPtr tmpBuf;
    m_rawCRL = tmpBuf;

    m_exts.clear();

    CPKIFNamePtr tmpIss;
    m_issuer = tmpIss;
    CPKIFTimePtr tmpNext;
    m_nextUpdate = tmpNext;
    CPKIFTimePtr tmpThis;
    m_thisUpdate = tmpThis;
    CPKIFAlgorithmIdentifierPtr tmpSig;
    m_sigAlg = tmpSig;
}


void CPKIFCRLImpl::populateExtensionsVector()
{
    if(NULL == m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    //if we've already populated the extensions vector then return
    if(!m_exts.empty())
        return;

    //if there are no extensions then return
    if(!m_signedCRL->tbsCertList.m.crlExtensionsPresent)
    {
        m_exts.clear();
        return;
    }

    // get the one and only extension mediator, with any additions an app might
    // have made
    CPKIFX509ExtensionMediator2 * mediator = CPKIFX509ExtensionMediator2::GetInstance();
    m_this->IPKIFHasExtensions::GetExtensions (mediator, m_exts);
}


void CPKIFCRL::GetExtensionByOID(
    const CPKIFOID& oid,
    CPKIFX509ExtensionPtr& ref)
{
    if(m_impl->m_exts.empty() && m_impl->m_signedCRL->tbsCertList.m.crlExtensionsPresent)
        m_impl->populateExtensionsVector();

    vector<CPKIFX509ExtensionPtr>::iterator pos;
    vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        if(oid == (*pos)->oid())
        {
            ref = *pos;
            return;
        }
    }       
}
void CPKIFCRL::GetEncodedExtensions (
    CPKIFBufferPtr& buf) 
{
    try 
    {
        if (m_impl->m_signedCRL->tbsCertList.m.crlExtensionsPresent)
        {
            CACASNWRAPPER_CREATE(CACX509V3Extensions, extsWrapper);
            ASN1OpenType *data = extsWrapper.Encode (&m_impl->m_signedCRL->tbsCertList.crlExtensions);
            CPKIFBufferPtr tmp(new CPKIFBuffer(data->data, data->numocts));
            buf = tmp;
            delete data;
            return;
        }
    }
    catch (... /*CPKIFException& e*/)
    {
        // How do we want to handle the exception?
    }

    CPKIFBufferPtr nullExt;
    buf = nullExt;
}

CPKIFCRL::CPKIFCRL(void): m_impl (new CPKIFCRLImpl)
{
    m_impl->m_this = this;
}
CPKIFCRL::~CPKIFCRL(void)
{
    if(m_impl)
    {
        delete m_impl;
        m_impl = 0;
    }
}


void CPKIFCRL::Decode(
    const unsigned char* cert, 
    int certLen)
{
    try 
    {
        m_impl->ClearContent();
        CPKIFBufferPtr tmp(new CPKIFBuffer(cert, certLen));
        m_impl->m_rawCRL = tmp;
        m_impl->m_signedCRL.Decode(m_impl->m_rawCRL->GetBuffer(), m_impl->m_rawCRL->GetLength());
        m_impl->populateExtensionsVector();

    } 
    catch ( CPKIFException& ) //changed from std::exception 6/4/2004
    {
        m_impl->ClearContent();
        unsigned char * decoded = NULL;
        unsigned long decodedLen;
        bool b = PEMDecode_l((char *)cert, certLen, &decoded, &decodedLen);
        if(b)
        {
            try
            {
                m_impl->ClearContent();
                CPKIFBufferPtr tmp2(new CPKIFBuffer(decoded, decodedLen));
                m_impl->m_rawCRL = tmp2;
                m_impl->m_signedCRL.InitContext();
                m_impl->m_signedCRL.Decode(m_impl->m_rawCRL->GetBuffer(), m_impl->m_rawCRL->GetLength());
                m_impl->populateExtensionsVector();
                if(NULL != decoded)
                    delete[] decoded;

            }catch(...)
            {
                if(NULL != decoded)
                    delete[] decoded;
                m_impl->ClearContent();
                throw;
            }
        }
        else
        {
            if(NULL != decoded)
                    delete[] decoded;
            m_impl->ClearContent();
            throw;
        }
    }

    //Added a call to Version() to make sure crl contains an acceptable version
    Version();
}

int CPKIFCRL::Version() const
{
    if(NULL == m_impl->m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    //added 5/3/2004
    if(!m_impl->m_signedCRL->tbsCertList.m.versionPresent)
        return 1;

    switch( m_impl->m_signedCRL->tbsCertList.version ) 
    {
        case CACX509V3AFv1:
            return 1;
            break;
        case CACX509V3AFv2:
            return 2;
            break;
        case CACX509V3AFv3:
            return 3;
            break;
        default:
            throw CPKIFException(TOOLKIT_ASN, COMMON_UNSUPPORTED_VERSION, "Unsupported CRL version.");
        break;
    }
}
CPKIFNamePtr CPKIFCRL::Issuer( ) const
{
    if(NULL == m_impl->m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    if(m_impl->m_issuer == (CPKIFName*)NULL)
    {
        CACASNWRAPPER_CREATE(CACX509V3Name, objPDU2);
        ASN1OpenType* data1 = objPDU2.Encode(&(m_impl->m_signedCRL->tbsCertList.issuer));
        CPKIFBufferPtr tmpBuf;
        if (data1 != NULL)
        {
             tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
            delete data1;
        }
        //CPKIFName* tmpName = new CPKIFName(m_impl->m_signedCRL->tbsCertList.issuer);
        CPKIFName* tmpName = new CPKIFName(tmpBuf);
        CPKIFNamePtr tmpRef(tmpName); 

        CPKIFCRL* nonConstCert = const_cast<CPKIFCRL*>(this);
        nonConstCert->m_impl->m_issuer = tmpRef;
    }

    return m_impl->m_issuer;
}
CPKIFBufferPtr CPKIFCRL::Encoded() const 
{
    return m_impl->m_rawCRL;
}
bool CPKIFCRL::CertOnThisCRL(
    const CPKIFCertificatePtr& cert, 
    CPKIFCRLEntryPtr& crlEntry)
{
    if(!m_impl->m_signedCRL->tbsCertList.m.revokedCertificatesPresent)
        return false;

    m_impl->PopulateEntryMap();

    const char* serNum = cert->SerialNumber();
    CPKIFNamePtr issDN = cert->Issuer();
    CPKIFNamePtr actIssDN;

    //added 8/26/2004
    bool isIndirect = false;
    CPKIFIssuingDistributionPointPtr idp = GetExtension<CPKIFIssuingDistributionPoint>();
    if(idp != (CPKIFIssuingDistributionPoint*)NULL)
    {
        isIndirect = idp->IndirectCRL();
    }
    if(!isIndirect)
        actIssDN = Issuer();

    //DListNode* cur = m_impl->m_signedCRL->tbsCertList.revokedCertificates.head;
    //CACX509V3RevokedCerts* curData = NULL;
    //while(NULL != cur)
    //{
        //ASN1OpenType * ot = (ASN1OpenType *) cur->data;
        //CPKIFCRLEntryPtr ce(new CPKIFCRLEntry(CPKIFBufferPtr(new CPKIFBuffer(ot->data,ot->numocts))));

    std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > >::iterator pos;
    std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > >::iterator end = m_impl->m_vector.end();
    for(pos = m_impl->m_vector.begin(); pos != end; ++pos)
    {
        map<string,CPKIFCRLEntryPtr>::iterator iter = (*pos).second.find(serNum);
        if( iter == (*pos).second.end() ) 
        {
            //return false;
            continue;
        }

        CPKIFCRLEntryPtr ce = iter->second;
        //reviewed 4/24 - added strlen check
        const char* tmpSNFromEntry = ce->SerialNumber();
        if(strlen(serNum) == strlen(tmpSNFromEntry) && 0 == stricmp(serNum, tmpSNFromEntry) && (!isIndirect || *(*pos).first == *issDN))
        {
            crlEntry = ce;
            return true;
        }
        //CPKIFCRLEntryPtr ce = iter->second;
        //if(isIndirect)
        //{
        //  CPKIFCertificateIssuerPtr ci;
        //  ci = ce->GetExtension<CPKIFCertificateIssuer>();
        //  if(ci != (CPKIFCertificateIssuer*)NULL)
        //  {
        //      CPKIFGeneralNameList genNames;
        //      ci->CertificateIssuer(genNames);

        //      CPKIFNamePtr emptyDN;
        //      actIssDN = emptyDN;

        //      CPKIFGeneralNameList::iterator pos;
        //      CPKIFGeneralNameList::iterator end = genNames.end();
        //      for(pos = genNames.begin(); pos != end; ++pos)
        //      {
        //          if((*pos)->GetType() == CPKIFGeneralName::DIRECTORYNAME)
        //          {
        //              actIssDN = (*pos)->directoryName();
        //          }
        //      }

        //      if(actIssDN == (CPKIFName*)NULL)
        //          throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "A CRL entry contained an unsupported non-DN CertificateIssuer extension.");
        //  }
        //  else
        //  {
        //      if(actIssDN == (CPKIFName*)NULL)
        //          actIssDN = Issuer();
        //  }
        //}

        //const char* tmpSNFromEntry = ce->SerialNumber();
        //if(strlen(serNum) == strlen(tmpSNFromEntry) && 0 == stricmp(serNum, tmpSNFromEntry) && (!isIndirect || *actIssDN == *issDN))
        //{
        //  crlEntry = ce;
        //  return true;
        //}
    }

    //  cur = cur->next;
    //}

    return false;
}
CPKIFBufferPtr CPKIFCRL::Signature() const
{
    CPKIFBufferPtr tmp(new CPKIFBuffer(m_impl->m_signedCRL->signature.data, m_impl->m_signedCRL->signature.numbits/8));
    return tmp;
}
CPKIFTimePtr CPKIFCRL::NextUpdate( ) const
{
    if(NULL == m_impl->m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    if(m_impl->m_nextUpdate == (CPKIFTime*)NULL && m_impl->m_signedCRL->tbsCertList.m.nextUpdatePresent)
    {
        CPKIFTime* tmpTime = NULL;
        if(m_impl->m_signedCRL->tbsCertList.nextUpdate.t == T_CACX509V3Time_utcTime)
        {
            tmpTime = new CPKIFTime(m_impl->m_signedCRL->tbsCertList.nextUpdate.u.utcTime, UTCTIME);
        }
        else
        {
            tmpTime = new CPKIFTime(m_impl->m_signedCRL->tbsCertList.nextUpdate.u.generalTime, GENERALIZEDTIME);
        }
        CPKIFTimePtr tmpRef(tmpTime); 

        CPKIFCRL* nonConstCert = const_cast<CPKIFCRL*>(this);
        nonConstCert->m_impl->m_nextUpdate = tmpRef;
    }

    return m_impl->m_nextUpdate;
}
CPKIFTimePtr CPKIFCRL::ThisUpdate( ) const
{
    if(NULL == m_impl->m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    if(m_impl->m_thisUpdate == (CPKIFTime*)NULL)
    {
        CPKIFTime* tmpTime = NULL;
        if(m_impl->m_signedCRL->tbsCertList.thisUpdate.t == T_CACX509V3Time_utcTime)
        {
            tmpTime = new CPKIFTime(m_impl->m_signedCRL->tbsCertList.thisUpdate.u.utcTime, UTCTIME);
        }
        else
        {
            tmpTime = new CPKIFTime(m_impl->m_signedCRL->tbsCertList.thisUpdate.u.generalTime, GENERALIZEDTIME);
        }
        CPKIFTimePtr tmpRef(tmpTime); 

        CPKIFCRL* nonConstCert = const_cast<CPKIFCRL*>(this);
        nonConstCert->m_impl->m_thisUpdate = tmpRef;
    }

    return m_impl->m_thisUpdate;
}
CPKIFAlgorithmIdentifierPtr CPKIFCRL::SignatureAlgorithm( ) const
{
    if(NULL == m_impl->m_signedCRL.data())
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "Attempted to read data from a CRL object prior to parsing a CRL.");

    if(m_impl->m_sigAlg == (CPKIFAlgorithmIdentifier*)NULL)
    {

        CPKIFOIDPtr algOID(new CPKIFOID(m_impl->m_signedCRL->signatureAlgorithm.algorithm.subid,
                                    m_impl->m_signedCRL->signatureAlgorithm.algorithm.numids));

        CPKIFBufferPtr paramBuf;
        if(m_impl->m_signedCRL->signatureAlgorithm.m.parametersPresent)
        {
                paramBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_signedCRL->signatureAlgorithm.parameters.data,
                                m_impl->m_signedCRL->signatureAlgorithm.parameters.numocts));
        
        }

        CPKIFAlgorithmIdentifierPtr tmpRef(new CPKIFAlgorithmIdentifier(algOID, paramBuf));  

        CPKIFCRL* nonConstCert = const_cast<CPKIFCRL*>(this);
        nonConstCert->m_impl->m_sigAlg = tmpRef;
    }

    return m_impl->m_sigAlg;
}
bool CPKIFCRL::AreThereAnyUnprocessedCriticalExtensions(
    std::vector<CPKIFX509ExtensionPtr>& processedExts)
{
    // XXX TODO: commenting this out for now. it needs to be made true.
    /*if(processedExts.size() > m_impl->m_exts.size())
    {
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT,
            "More extensions were processed than are present in the CRL.");
    }*/
    std::vector<CPKIFX509ExtensionPtr>::iterator pos;
    std::vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    std::vector<CPKIFX509ExtensionPtr>::iterator processedEnd = processedExts.end();
    ExtensionsMatch em;
    size_t count = processedExts.size();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        em.SetRHS(*pos);
        if((*pos)->isCritical() && processedEnd == find_if(processedExts.begin(), processedExts.end(), em))
            return true;
    }

    return false;
}
bool CPKIFCRL::operator==(const CPKIFCRL& rhs) const
{
    return *this->Encoded() == *rhs.Encoded();
}


std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > > CPKIFCRL::GetCRLEntryMap()
{
    return m_impl->m_vector;
}

void CPKIFCRL::PopulateEntryMap()
{
    m_impl->PopulateEntryMap();
}