CapiCRL.cpp

Go to the documentation of this file.

#include "CRL.h"
#include "CapiCRL.h"
#include "CRLEntry.h"
#include "ASN1Helper.h"
#include "Certificate.h"
#include "Buffer.h"
#include "Name.h"
#include "PKIFTime.h"
#include "AlgorithmIdentifier.h"
#include "ExtensionsMatch.h"
#include "PKIFException.h"
#include "PKIFX509Extensions2.h"
#include "IssuingDistributionPoint.h"
#include "CertificateIssuer.h"
#include "GeneralName.h"
#include "PKIFBase64.h"
#include <sstream>
#include "PKIFCommonErrors.h"
#include "ToolkitUtils.h"

using namespace std;
using namespace boost;

struct CPKIFCapiCRLImpl
{
  CPKIFCapiCRLImpl();
 
  //added 2/24/2005
  void ClearContent();
  
  void populateExtensionsVector();
  
  CPKIFBufferPtr m_rawCRL;
  //CPKIFASNWrapper<CACX509V3CertificateList> m_signedCRL;
  std::vector<CPKIFX509ExtensionPtr> m_exts;
  std::vector<pair<CPKIFNamePtr, std::map<std::string, CPKIFCRLEntryPtr> > > m_vector;
  CPKIFNamePtr m_issuer;
  CPKIFTimePtr m_nextUpdate;
  CPKIFTimePtr m_thisUpdate;
  CPKIFAlgorithmIdentifierPtr m_sigAlg;
  CPKIFCapiCRL * m_this;

  CPKIFBufferPtr m_signature;

  PCCRL_CONTEXT m_crl;
};

CPKIFCapiCRLImpl::CPKIFCapiCRLImpl ()
{
    m_crl = NULL;
}

//added 2/24/2005
void CPKIFCapiCRLImpl::ClearContent()
{
    CPKIFBufferPtr tmpBuf;
    m_rawCRL = tmpBuf;

    m_exts.clear();

    CPKIFNamePtr tmpIss;
    m_issuer = tmpIss;
    CPKIFTimePtr tmpNext;
    m_nextUpdate = tmpNext;
    CPKIFTimePtr tmpThis;
    m_thisUpdate = tmpThis;
    CPKIFAlgorithmIdentifierPtr tmpSig;
    m_sigAlg = tmpSig;
}


void CPKIFCapiCRLImpl::populateExtensionsVector()
{
    //if we've already populated the extensions vector then return
    if(!m_exts.empty())
        return;

    //if there are no extensions then return
    if(0 == m_crl->pCrlInfo->cExtension)
    {
        m_exts.clear();
        return;
    }

    // get the one and only extension mediator, with any additions an app might
    // have made
    CPKIFX509ExtensionMediator2 * mediator = CPKIFX509ExtensionMediator2::GetInstance();
    m_this->IPKIFHasExtensions::GetExtensions (mediator, m_exts);
}


void CPKIFCapiCRL::GetExtensionByOID(
    const CPKIFOID& oid,
    CPKIFX509ExtensionPtr& ref)
{
    if(m_impl->m_exts.empty() && m_impl->m_crl->pCrlInfo->cExtension)
        m_impl->populateExtensionsVector();

    vector<CPKIFX509ExtensionPtr>::iterator pos;
    vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        if(oid == (*pos)->oid())
        {
            ref = *pos;
            return;
        }
    }       
}
void CPKIFCapiCRL::GetEncodedExtensions (
    CPKIFBufferPtr& buf) 
{
    try 
    {
        HRESULT hr= S_OK;
        if(m_impl->m_crl->pCrlInfo->cExtension)
        {
            _CERT_EXTENSIONS ce;
            ce.cExtension = m_impl->m_crl->pCrlInfo->cExtension;
            ce.rgExtension = m_impl->m_crl->pCrlInfo->rgExtension;
            unsigned char* pvEncoded = NULL;
            DWORD pcbEncoded = 0;
            CryptEncodeObjectEx(X509_ASN_ENCODING, X509_EXTENSIONS, &ce, 0, NULL, NULL, &pcbEncoded);
            pvEncoded = new unsigned char[pcbEncoded];
            if(CryptEncodeObjectEx(X509_ASN_ENCODING, X509_EXTENSIONS, &ce, 0, NULL, pvEncoded, &pcbEncoded))
            {
                CPKIFBufferPtr encodedExtensions(new CPKIFBuffer(pvEncoded, pcbEncoded));
                buf = encodedExtensions;
                delete[] pvEncoded;
                return;
            }
            else
            {
                delete[] pvEncoded;
                hr = GetLastError();
            }
        }
    }
    catch (... /*CPKIFException& e*/)
    {
        // How do we want to handle the exception?
    }

    CPKIFBufferPtr nullExt;
    buf = nullExt;
}

CPKIFCapiCRL::CPKIFCapiCRL(void): m_impl (new CPKIFCapiCRLImpl)
{
    m_impl->m_this = this;
}
CPKIFCapiCRL::~CPKIFCapiCRL(void)
{
    if(m_impl)
    {
        if(m_impl->m_crl)
        {
            CertFreeCRLContext(m_impl->m_crl);
            m_impl->m_crl = NULL;
        }

        delete m_impl;
        m_impl = 0;
    }
}


void CPKIFCapiCRL::Decode(
    const unsigned char* cert, 
    int certLen)
{
    throw std::exception("CPKIFCapiCRL::Decode has not been implemented.");
}

int CPKIFCapiCRL::Version() const
{
    switch( m_impl->m_crl->pCrlInfo->dwVersion ) 
    {
        case CRL_V1:
            return 1;
            break;
        case CRL_V2:
            return 2;
            break;
        default:
            throw CPKIFException(TOOLKIT_ASN, COMMON_UNSUPPORTED_VERSION, "Unsupported CRL version.");
    }
}
CPKIFNamePtr CPKIFCapiCRL::Issuer( ) const
{
    if(m_impl->m_issuer == (CPKIFName*)NULL)
    {
        CPKIFBufferPtr tmpBuf;
        tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_crl->pCrlInfo->Issuer.pbData, m_impl->m_crl->pCrlInfo->Issuer.cbData));

        CPKIFName* tmpName = new CPKIFName(tmpBuf);
        CPKIFNamePtr tmpRef(tmpName); 

        CPKIFCapiCRL* nonConstCert = const_cast<CPKIFCapiCRL*>(this);
        nonConstCert->m_impl->m_issuer = tmpRef;
    }

    return m_impl->m_issuer;
}
CPKIFBufferPtr CPKIFCapiCRL::Encoded() const 
{
    if(!m_impl->m_rawCRL)
    {
        CPKIFBufferPtr tmp(new CPKIFBuffer(m_impl->m_crl->pbCrlEncoded, m_impl->m_crl->cbCrlEncoded));
        m_impl->m_rawCRL = tmp;
    }
    return m_impl->m_rawCRL;
}

bool CPKIFCapiCRL::CertOnThisCRL(
    const CPKIFCertificatePtr& cert, 
    CPKIFCRLEntryPtr& crlEntry)
{
    PCCERT_CONTEXT certCtx = NULL;

    if(cert == (CPKIFCertificate*)NULL)
    {
        throw CPKIFException(TOOLKIT_ASN_SUBCOMPONENT, COMMON_INVALID_INPUT, "NULL certificate passed to CertOnThisCRL.");
    }

    certCtx = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert->Encoded()->GetBuffer(), cert->Encoded()->GetLength());
    if(NULL == certCtx)
    {
        std::ostringstream os;
        os << "Failed to parse certificate passed to CertOnThisCRL.  CertCreateCertificateContext failed: " << GetLastError();
        throw CPKIFException(TOOLKIT_ASN_SUBCOMPONENT, COMMON_INVALID_INPUT, os.str().c_str());
    }

    PCRL_ENTRY pCrlEntry = NULL;
    if(CertFindCertificateInCRL(certCtx, m_impl->m_crl, 0, 0, &pCrlEntry))
    {
        if(pCrlEntry)
        {
            CPKIFCapiCRLEntryPtr capiCRLEntry(new CPKIFCapiCRLEntry(pCrlEntry));
            CPKIFCRLEntryPtr rv = dynamic_pointer_cast<CPKIFCRLEntry, CPKIFCapiCRLEntry>(capiCRLEntry);
            crlEntry = rv;
            return true;
        }
        else
            return false;
    }
    else
    {
        throw std::exception("Failed to search CRL");
    }
}
CPKIFBufferPtr CPKIFCapiCRL::Signature() const
{
    if(m_impl->m_signature == (CPKIFBuffer*)NULL)
    {
        CACASNWRAPPER_CREATE(CACX509V3CertificateList, objPDU);
        CACX509V3CertificateList* tc = objPDU.Decode(m_impl->m_crl->pbCrlEncoded, m_impl->m_crl->cbCrlEncoded);

        CPKIFBufferPtr tmp(new CPKIFBuffer(tc->signature.data, tc->signature.numbits/8));
        CPKIFCapiCRL* nonConstCert = const_cast<CPKIFCapiCRL*>(this);
        nonConstCert->m_impl->m_signature = tmp;
    }
    return m_impl->m_signature;
}
CPKIFTimePtr CPKIFCapiCRL::NextUpdate( ) const
{
    if(m_impl->m_nextUpdate == (CPKIFTime*)NULL)
    {
        unsigned char* pvEncoded = NULL;
        DWORD pcbEncoded = 0;
        CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_crl->pCrlInfo->NextUpdate, 0, NULL, NULL, &pcbEncoded);
        pvEncoded = new unsigned char[pcbEncoded];
        if(CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_crl->pCrlInfo->NextUpdate, 0, NULL, pvEncoded, &pcbEncoded))
        {
            CACASNWRAPPER_CREATE(CACX509V3Time, objPDU);
            CACX509V3Time* time = objPDU.Decode(pvEncoded, pcbEncoded);
            delete[] pvEncoded;

            CPKIFTime* tmpTime = NULL;
            if(time->t == T_CACX509V3Time_utcTime)
            {
                tmpTime = new CPKIFTime(time->u.utcTime, UTCTIME);
            }
            else
            {
                tmpTime = new CPKIFTime(time->u.generalTime, GENERALIZEDTIME);
            }
            CPKIFTimePtr tmpRef(tmpTime); 

            CPKIFCapiCRL* nonConstCert = const_cast<CPKIFCapiCRL*>(this);
            nonConstCert->m_impl->m_nextUpdate = tmpRef;
        }
        else
        {
            delete[] pvEncoded;
            HRESULT hr = GetLastError();
        }
    }

    return m_impl->m_nextUpdate;
}
CPKIFTimePtr CPKIFCapiCRL::ThisUpdate( ) const
{
    if(m_impl->m_thisUpdate == (CPKIFTime*)NULL)
    {
        unsigned char* pvEncoded = NULL;
        DWORD pcbEncoded = 0;
        CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_crl->pCrlInfo->ThisUpdate, 0, NULL, pvEncoded, &pcbEncoded);
        pvEncoded = new unsigned char[pcbEncoded];
        if(CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_crl->pCrlInfo->ThisUpdate, 0, NULL, pvEncoded, &pcbEncoded))
        {
            CACASNWRAPPER_CREATE(CACX509V3Time, objPDU);
            CACX509V3Time* time = objPDU.Decode(pvEncoded, pcbEncoded);
            delete[] pvEncoded;

            CPKIFTime* tmpTime = NULL;
            if(time->t == T_CACX509V3Time_utcTime)
            {
                tmpTime = new CPKIFTime(time->u.utcTime, UTCTIME);
            }
            else
            {
                tmpTime = new CPKIFTime(time->u.generalTime, GENERALIZEDTIME);
            }
            CPKIFTimePtr tmpRef(tmpTime); 

            CPKIFCapiCRL* nonConstCert = const_cast<CPKIFCapiCRL*>(this);
            nonConstCert->m_impl->m_thisUpdate = tmpRef;
        }
        else
        {
            delete[] pvEncoded;
            HRESULT hr = GetLastError();
        }
    }

    return m_impl->m_thisUpdate;
}
CPKIFAlgorithmIdentifierPtr CPKIFCapiCRL::SignatureAlgorithm( ) const
{
    if(m_impl->m_sigAlg == (CPKIFAlgorithmIdentifier*)NULL)
    {
        CPKIFOIDPtr algOID(new CPKIFOID(m_impl->m_crl->pCrlInfo->SignatureAlgorithm.pszObjId));

        CPKIFBufferPtr paramBuf;
        if(m_impl->m_crl->pCrlInfo->SignatureAlgorithm.Parameters.cbData)
        {
                paramBuf = CPKIFBufferPtr(new CPKIFBuffer(m_impl->m_crl->pCrlInfo->SignatureAlgorithm.Parameters.pbData,
                                m_impl->m_crl->pCrlInfo->SignatureAlgorithm.Parameters.cbData));
        
        }

        CPKIFAlgorithmIdentifierPtr tmpRef(new CPKIFAlgorithmIdentifier(algOID, paramBuf));  

        CPKIFCapiCRL* nonConstCert = const_cast<CPKIFCapiCRL*>(this);
        nonConstCert->m_impl->m_sigAlg = tmpRef;
    }

    return m_impl->m_sigAlg;
}
bool CPKIFCapiCRL::AreThereAnyUnprocessedCriticalExtensions(
    std::vector<CPKIFX509ExtensionPtr>& processedExts)
{
    std::vector<CPKIFX509ExtensionPtr>::iterator pos;
    std::vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    std::vector<CPKIFX509ExtensionPtr>::iterator processedEnd = processedExts.end();
    ExtensionsMatch em;
    size_t count = processedExts.size();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        em.SetRHS(*pos);
        if((*pos)->isCritical() && processedEnd == find_if(processedExts.begin(), processedExts.end(), em))
            return true;
    }

    return false;
}
bool CPKIFCapiCRL::operator==(const CPKIFCRL& rhs) const
{
    return *this->Encoded() == *rhs.Encoded();
}

void CPKIFCapiCRL::SetCRL(PCCRL_CONTEXT crl)
{
    m_impl->m_crl = crl;
}

struct CPKIFCapiCRLEntryImpl
{
  CPKIFCapiCRLEntryImpl();
 
  void ClearContent();
  
  void populateExtensionsVector();
  
  CPKIFBufferPtr m_rawCRL;
  //CPKIFASNWrapper<CACX509V3CertificateList> m_signedCRL;
  std::vector<CPKIFX509ExtensionPtr> m_exts;
  CPKIFTimePtr m_revocationDate;
  CPKIFBufferPtr m_serialNumber; //buffer holds ASCII Hex serial number
  CPKIFCapiCRLEntry * m_this;
  PCRL_ENTRY m_crlEntry;
};

CPKIFCapiCRLEntryImpl::CPKIFCapiCRLEntryImpl()
{
    m_this = NULL;
    m_crlEntry = NULL;
}

void CPKIFCapiCRLEntryImpl::ClearContent()
{
}

void CPKIFCapiCRLEntryImpl::populateExtensionsVector()
{
    //if we've already populated the extensions vector then return
    if(!m_exts.empty())
        return;

    //if there are no extensions then return
    if(0 == m_crlEntry->cExtension)
    {
        m_exts.clear();
        return;
    }

    // get the one and only extension mediator, with any additions an app might
    // have made
    CPKIFX509ExtensionMediator2 * mediator = CPKIFX509ExtensionMediator2::GetInstance();
    m_this->IPKIFHasExtensions::GetExtensions (mediator, m_exts);
}

CPKIFCapiCRLEntry::CPKIFCapiCRLEntry(PCRL_ENTRY crlEntry) : m_impl(new CPKIFCapiCRLEntryImpl)
{
    m_impl->m_this = this;
    m_impl->m_crlEntry = crlEntry;
}

CPKIFCapiCRLEntry::~CPKIFCapiCRLEntry()
{
}

bool CPKIFCapiCRLEntry::AreThereAnyUnprocessedCriticalExtensions(std::vector<CPKIFX509ExtensionPtr>& processedExts)
{
    std::vector<CPKIFX509ExtensionPtr>::iterator pos;
    std::vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    std::vector<CPKIFX509ExtensionPtr>::iterator processedEnd = processedExts.end();
    ExtensionsMatch em;
    size_t count = processedExts.size();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        em.SetRHS(*pos);
        if((*pos)->isCritical() && processedEnd == find_if(processedExts.begin(), processedExts.end(), em))
            return true;
    }

    return false;
}

void CPKIFCapiCRLEntry::GetEncodedExtensions (CPKIFBufferPtr& buf)
{
    try 
    {
        HRESULT hr= S_OK;
        if(m_impl->m_crlEntry->cExtension)
        {
            _CERT_EXTENSIONS ce;
            ce.cExtension = m_impl->m_crlEntry->cExtension;
            ce.rgExtension = m_impl->m_crlEntry->rgExtension;
            unsigned char* pvEncoded = NULL;
            DWORD pcbEncoded = 0;
            CryptEncodeObjectEx(X509_ASN_ENCODING, X509_EXTENSIONS, &ce, 0, NULL, NULL, &pcbEncoded);
            pvEncoded = new unsigned char[pcbEncoded];
            if(CryptEncodeObjectEx(X509_ASN_ENCODING, X509_EXTENSIONS, &ce, 0, NULL, pvEncoded, &pcbEncoded))
            {
                CPKIFBufferPtr encodedExtensions(new CPKIFBuffer(pvEncoded, pcbEncoded));
                buf = encodedExtensions;
                delete[] pvEncoded;
                return;
            }
            else
            {
                delete[] pvEncoded;
                hr = GetLastError();
            }
        }
    }
    catch (... /*CPKIFException& e*/)
    {
        // How do we want to handle the exception?
    }

    CPKIFBufferPtr nullExt;
    buf = nullExt;
}

void CPKIFCapiCRLEntry::GetExtensionByOID(const CPKIFOID& oid, CPKIFX509ExtensionPtr& ref)
{
    if(m_impl->m_exts.empty() && m_impl->m_crlEntry->cExtension)
        m_impl->populateExtensionsVector();

    vector<CPKIFX509ExtensionPtr>::iterator pos;
    vector<CPKIFX509ExtensionPtr>::iterator end = m_impl->m_exts.end();
    for(pos = m_impl->m_exts.begin(); pos != end; ++pos)
    {
        if(oid == (*pos)->oid())
        {
            ref = *pos;
            return;
        }
    }       
}

const char* CPKIFCapiCRLEntry::SerialNumber() const
{
    if(m_impl->m_serialNumber == (CPKIFBuffer*)NULL)
    {
        CPKIFBufferPtr tmp(new CPKIFBuffer);
        int len = (m_impl->m_crlEntry->SerialNumber.cbData * 2) + 3;
        unsigned char* tmpBuf = tmp->AllocateBuffer(len - 1);
        memset(tmpBuf, 0x00, len);
        tmpBuf[0] = '0';
        tmpBuf[1] = 'x';
        btoa((char*)m_impl->m_crlEntry->SerialNumber.pbData, (char*)tmpBuf+2, m_impl->m_crlEntry->SerialNumber.cbData);

        CPKIFCapiCRLEntry* nonConst = const_cast<CPKIFCapiCRLEntry*>(this);
        nonConst->m_impl->m_serialNumber = tmp;
    }
    return (char*)m_impl->m_serialNumber->GetBuffer();
}

const CPKIFTimePtr CPKIFCapiCRLEntry::RevocationDate() const
{
    if(m_impl->m_revocationDate == (CPKIFTime*)NULL)
    {
        unsigned char* pvEncoded = NULL;
        DWORD pcbEncoded = 0;
        CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_revocationDate, 0, NULL, pvEncoded, &pcbEncoded);
        pvEncoded = new unsigned char[pcbEncoded];
        if(CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CHOICE_OF_TIME, &m_impl->m_revocationDate, 0, NULL, pvEncoded, &pcbEncoded))
        {
            CACASNWRAPPER_CREATE(CACX509V3Time, objPDU);
            CACX509V3Time* time = objPDU.Decode(pvEncoded, pcbEncoded);
            delete[] pvEncoded;

            CPKIFTime* tmpTime = NULL;
            if(time->t == T_CACX509V3Time_utcTime)
            {
                tmpTime = new CPKIFTime(time->u.utcTime, UTCTIME);
            }
            else
            {
                tmpTime = new CPKIFTime(time->u.generalTime, GENERALIZEDTIME);
            }
            CPKIFTimePtr tmpRef(tmpTime); 

            CPKIFCapiCRLEntry* nonConst = const_cast<CPKIFCapiCRLEntry*>(this);
            nonConst->m_impl->m_revocationDate = tmpRef;
        }
        else
        {
            delete[] pvEncoded;
            HRESULT hr = GetLastError();
        }
    }

    return m_impl->m_revocationDate;
}