CertStatusCache.cpp

Go to the documentation of this file.

#include "pkif.h"
#include "CertStatusCache.h"
#include "PKIFCryptUtils.h"
#include "RevocationSource.h"
#include "PKIFErrors.h"

#include <vector>
#include <map>

#include <boost/shared_ptr.hpp>
#include <boost/numeric/conversion/cast.hpp>
using namespace boost;
using namespace std;


class CPKIFCertStatusCacheEntry
{
public:
    CPKIFCertStatusCacheEntry()
    {
    }

    bool operator==(const CPKIFCertStatusCacheEntry& rhs) const
    {
        if(!m_target || !rhs.m_target)
            return false;
        else
            return *m_target == *rhs.m_target;
    }

    unsigned long m_ticksAtEntry;
    CPKIFTimePtr m_timeAtEntry;

    CPKIFCertificatePtr m_target;
    CPKIFCertificatePtr m_issuer;
    RevocationStatus m_revStatus;
    CPKIFCertStatusPtr m_certStatus;
};
DECLARE_SMART_POINTERS(CPKIFCertStatusCacheEntry);
typedef std::vector<CPKIFCertStatusCacheEntryPtr, PKIFAlloc<CPKIFCertStatusCacheEntryPtr> > CPKIFCertStatusCacheEntryList;
DECLARE_SMART_POINTERS(CPKIFCertStatusCacheEntryList);

class CacheMatch
{
public:
    bool operator()(const CPKIFCertStatusCacheEntryPtr& t)
    {
        if(!(*t->m_target == *m_target))
            return false;

        return *t->m_issuer == *m_issuer;       
    }
    void SetRHS(const CPKIFCertificatePtr& target, const CPKIFCertificatePtr& issuer) 
    {
        m_target = target;
        m_issuer = issuer;
    }
private:
    CPKIFCertificatePtr m_target;
    CPKIFCertificatePtr m_issuer;
};
class IsOld
{
public:
    IsOld(unsigned long l)
    {
        m_maxAge = l;
    }
    bool operator()(const CPKIFCertStatusCacheEntryPtr& t)
    {
        unsigned long curTicks = GetTickCount();
        if(t->m_ticksAtEntry < (curTicks - m_maxAge))
            return true;

        if(!t->m_certStatus)
            return false;

        RevocationSourceList rsl;
        t->m_certStatus->GetRevocationSources(rsl);

        CPKIFTimePtr curTime = CPKIFTime::CurrentTime();
        RevocationSourceList::iterator rslPos;
        RevocationSourceList::iterator rslEnd = rsl.end();
        int count = 0;
        for(rslPos = rsl.begin(), count = 1; rslPos != rslEnd; ++rslPos, ++count)
        {
            IPKIFRevSourceInfoPtr rsip = (*rslPos)->m_sourceInfo;
            if(rsip)
            {
                switch((*rslPos)->m_sourceType)
                {
                case REVSOURCE_CRL:
                    {
                        CPKIFCRLInfoPtr crlInfo = RevInfoCast<CPKIFCRLInfo>(rsip);
                        CPKIFCRLList crls;
                        crlInfo->GetCRLs(crls);
        
                        CPKIFCRLList::iterator crlPos;
                        CPKIFCRLList::iterator crlEnd = crls.end();
                        int crlCount = 1;
                        for(crlPos = crls.begin(); crlPos != crlEnd; ++crlPos, ++crlCount)
                        {
                            CPKIFTimePtr nextUpdate = (*crlPos)->NextUpdate();
                            if(nextUpdate != (CPKIFTime*)NULL && *nextUpdate < *curTime)
                            {
                                return true;
                            }
                        }
                    }
                    break;
                case REVSOURCE_OCSP:
                    {
                        CPKIFOCSPInfoPtr ocspInfo = RevInfoCast<CPKIFOCSPInfo>(rsip);

                        if(ocspInfo != (CPKIFOCSPInfo*)NULL)
                        {
                            CPKIFSingleResponsePtr singleResponse = ocspInfo->GetSingleResponse();
                            if(singleResponse != (CPKIFSingleResponse*)NULL)
                            {
                                CPKIFTimePtr nextUpdate = singleResponse->GetNextUpdate();
                                if(nextUpdate != (CPKIFTime*)NULL && *nextUpdate < *curTime)
                                {
                                    return true;
                                }
                            }
                        }
                    }
                    break;
                }
            }
        }
        return false;
    }
private:
    long m_maxAge;
    IsOld();
};

struct CertStatusCacheImpl 
{
private:
    //std::map<std::string, CPKIFCertStatusCacheEntryPtr> m_cache;
    std::vector<CPKIFCertStatusCacheEntryPtr> m_cache;

public:
    unsigned long m_lastCleanOperation;
    double m_percentToRemove;
    unsigned long m_maxCacheAgeInMilliseconds;
    int m_maxCacheSize;
    bool m_bCacheCaCertsOnly;
    long m_purgeFrequencyInMilliseconds;

    CertStatusCacheImpl()
    {
        m_lastCleanOperation = GetTickCount();
        m_percentToRemove = .1;
        m_maxCacheAgeInMilliseconds = 8640000; //1 day
        m_maxCacheSize = 1000;
        m_purgeFrequencyInMilliseconds = 360000; //1 hour
        m_bCacheCaCertsOnly = false;
    }

    void CleanCacheIfNecessary();
    void RemoveOutOfDateStuff();
    void RemoveNPercentOfStuff();

    CPKIFCertStatusCacheEntryPtr GetCertStatus(const CPKIFCertificatePtr& target, const CPKIFCertificatePtr& issuer);
    void PutCertStatus(CPKIFCertStatusCacheEntryPtr& csc);
    bool CacheIsEmpty()
    {
        return m_cache.empty();
    }
};
CPKIFCertStatusCacheEntryPtr CertStatusCacheImpl::GetCertStatus(
    const CPKIFCertificatePtr& target,
    const CPKIFCertificatePtr& issuer)
{
    std::vector<CPKIFCertStatusCacheEntryPtr>::iterator foundObject;

    CacheMatch cm;
    cm.SetRHS(target, issuer);

    foundObject = find_if(m_cache.begin(), m_cache.end(), cm);
    if(foundObject != m_cache.end())
    {
        return *foundObject;
    }
    else
    {
        CPKIFCertStatusCacheEntryPtr empty;
        return empty;
    }
}
void CertStatusCacheImpl::PutCertStatus(
    CPKIFCertStatusCacheEntryPtr& csc)
{
    if(!csc)
        return;

    CacheMatch cm;
    cm.SetRHS(csc->m_target, csc->m_issuer);

    std::vector<CPKIFCertStatusCacheEntryPtr>::iterator newEnd;
    newEnd = remove_if(m_cache.begin(), m_cache.end(), cm);
    m_cache.erase(newEnd, m_cache.end());
    m_cache.push_back(csc);
}
void CertStatusCacheImpl::RemoveOutOfDateStuff()
{
    IsOld io(m_maxCacheAgeInMilliseconds);
    std::vector<CPKIFCertStatusCacheEntryPtr>::iterator newEnd;
    newEnd = remove_if(m_cache.begin(), m_cache.end(), io);
    m_cache.erase(newEnd, m_cache.end());
}
void CertStatusCacheImpl::RemoveNPercentOfStuff()
{
    try {
        int numToRemove = boost::numeric_cast<int,double>(m_cache.size() * m_percentToRemove);
        int numToKeep = boost::numeric_cast<int,size_t>(m_cache.size() - numToRemove);
        sort(m_cache.begin(), m_cache.end());

        m_cache.erase(m_cache.begin()+ numToKeep, m_cache.end());
    } catch(boost::numeric::bad_numeric_cast &) {
        // XXX *** WARNING: eating a potential exception because it
        // doesn't look reasonable to throw from here.
        // The potential exception is very unlikely, and there is less
        // downside to eating it than leaving code as it was before
    }
}
void CertStatusCacheImpl::CleanCacheIfNecessary()
{
    unsigned long curTicks = GetTickCount();
    unsigned long diff = curTicks - m_lastCleanOperation;
    try {
        if(diff > m_purgeFrequencyInMilliseconds || m_cache.size() > boost::numeric_cast<size_t,int>(m_maxCacheSize))
        {
            //remove stuff that's out of date
            RemoveOutOfDateStuff();

            if(m_cache.size() > boost::numeric_cast<size_t,int>(m_maxCacheSize))
            {
                //remove oldest n% of entries
                RemoveNPercentOfStuff();
            }

            m_lastCleanOperation = GetTickCount();
        }
    }catch(boost::numeric::bad_numeric_cast &){
        // XXX *** WARNING: eating an exception here. it doesn't
        // look reasonable for this to throw, though, and the
        // checked cast is still better than before.
    }
}


CPKIFCertStatusCache::CPKIFCertStatusCache() : m_impl(new CertStatusCacheImpl)
{
}

CPKIFCertStatusCache::~CPKIFCertStatusCache()
{
    if(m_impl)
        delete m_impl;
}
CPKIFBufferPtr GetThumbprintForSubjectAndIssuerPair(
    const CPKIFCertificatePtr& target,
    const CPKIFCertificatePtr& issuer)
{
    CPKIFBufferPtr empty;
    if(!target || !issuer)
        return empty;

    IPKIFCryptoMisc* misc = GetPlatformCryptoMisc();
    if(NULL == misc)
        return empty;

    unsigned char sha1Buffer[20];
    int length = 20;
    try
    {
        CPKIFBufferPtr encTarget = target->Encoded();
        CPKIFBufferPtr encIssuer = issuer->Encoded();

        IPKIFHashContext* hash = misc->HashInit(PKIFCRYPTO::SHA1);
        misc->HashUpdate(hash, (unsigned char*)encTarget->GetBuffer(), encTarget->GetLength());
        misc->HashUpdate(hash, (unsigned char*)encIssuer->GetBuffer(), encIssuer->GetLength());
        misc->HashFinal(hash, sha1Buffer, &length);
        delete hash;
    }
    catch(...)
    {
        return empty;
    }

    CPKIFBufferPtr newBuf(new CPKIFBuffer);
    unsigned char* asciiVal = newBuf->AllocateBuffer(41);
    btoa((char*)sha1Buffer, (char*)asciiVal, 20);
    return newBuf;
}

void CPKIFCertStatusCache::PutObject(
    const CPKIFCertificatePtr& targetCert, 
    const CPKIFCertificatePtr& issuersCert, 
    RevocationStatus& status, 
    CPKIFCertStatusPtr& certStatus)
{
    if(!targetCert || !issuersCert)
        return;

    if(m_impl->m_bCacheCaCertsOnly)
    {
        //try/catch not needed - extensions have already been handled by this point
        CPKIFBasicConstraintsPtr basicConstraints = targetCert->GetExtension<CPKIFBasicConstraints>();
        if(basicConstraints != (CPKIFBasicConstraints*)NULL)
        {
            if(!basicConstraints->isCA())
                return;
        }
    }

    //this may result in replacement but that will refresh the entry time so it seems OK (and could update the status)
    CPKIFCertStatusCacheEntryPtr cacheEntry(new CPKIFCertStatusCacheEntry);
    cacheEntry->m_target = targetCert;
    cacheEntry->m_issuer = issuersCert;
    cacheEntry->m_revStatus = status;
    cacheEntry->m_certStatus = certStatus;
    cacheEntry->m_ticksAtEntry = GetTickCount();
    cacheEntry->m_timeAtEntry = CPKIFTime::CurrentTime();
    m_impl->PutCertStatus(cacheEntry);
}
void CPKIFCertStatusCache::SetMaxCacheAge(
    unsigned long maxAgeInMilliseconds)
{
    m_impl->m_maxCacheAgeInMilliseconds = maxAgeInMilliseconds;
}
long CPKIFCertStatusCache::GetMaxCacheAge() const
{
    return m_impl->m_maxCacheAgeInMilliseconds;
}
void CPKIFCertStatusCache::SetMaxCacheSize(
    int count)
{
    m_impl->m_maxCacheSize = count;
}
int CPKIFCertStatusCache::GetMaxCacheSize() const
{
    return m_impl->m_maxCacheSize;
}
void CPKIFCertStatusCache::SetCacheCaCertsOnly(
    bool bCacheCaCertsOnly)
{
    m_impl->m_bCacheCaCertsOnly = bCacheCaCertsOnly;
}
bool CPKIFCertStatusCache::GetCacheCaCertsOnly() const
{
    return m_impl->m_bCacheCaCertsOnly;
}
void CPKIFCertStatusCache::SetPurgeFrequency(
    int minTimeBetweenPurgesInSeconds)
{
    m_impl->m_purgeFrequencyInMilliseconds = minTimeBetweenPurgesInSeconds*1000;
}
int CPKIFCertStatusCache::GetPurgeFrequency() const
{
    return m_impl->m_purgeFrequencyInMilliseconds/1000;
}

//IPKIFColleague functions
void CPKIFCertStatusCache::Initialize()
{
}

//IPKIFRevocationStatus functions
bool CPKIFCertStatusCache::CheckStatus(
    const CPKIFCertificatePtr& targetCert, 
    const CPKIFCertificatePtr& issuersCert, 
    RevocationStatus& status, 
    CPKIFCertStatusPtr& certStatus)
{
    if(!targetCert || !issuersCert)
        return false;

    m_impl->CleanCacheIfNecessary();
    CPKIFCertStatusCacheEntryPtr cacheEntry = m_impl->GetCertStatus(targetCert, issuersCert);
    if(cacheEntry)
    {
        status = cacheEntry->m_revStatus;
        certStatus = cacheEntry->m_certStatus;

        return true;
    }
    else 
        return false;
}
bool CPKIFCertStatusCache::CheckStatusPath(
    CPKIFCertificatePath& path, 
    RevocationStatus& status)
{
    if(m_impl->CacheIsEmpty())
        return false;

    m_impl->CleanCacheIfNecessary();

    //initialize the outbound low-water revocation status
    status = NOT_CHECKED;

    //get certs from path
    CPKIFCertificateNodeList certNodeList;
    path.GetPath(certNodeList);

    //variables used in the following loop
    bool statusSet = false;                     //iterator to indicate if status has been set
    CPKIFCertificatePtr curCert, issuersCert;   //pointers to relevant certs
    CPKIFCertStatusPtr curCertStatus;           //pointer to cert status object for current cert
    RevocationStatus rStatus = NOT_CHECKED, pathStatus = NOT_CHECKED;                   //revocation status of current cert

    CPKIFPathSettingsPtr settings;
    path.GetPathSettings(settings);

    //get the trust root from the path
    IPKIFTrustAnchorPtr ta;
    CPKIFCertificatePtr rootCert;
    path.GetTrustRoot(ta);
    CPKIFTrustRootPtr tr = dynamic_pointer_cast<CPKIFTrustRoot, IPKIFTrustAnchor>(ta);
    if(tr) 
        tr->GetCert(issuersCert);

    if(!issuersCert)
        return false;

    //iterate over all certs in the path and invoke the CheckStatusInternal function
    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = certNodeList.end();
    for(pos = certNodeList.begin(); pos != end; ++pos)
    {
        //initialize loop variables for this iteration
        //issuersCert = curCert;
        curCert = (*pos)->GetCert();
        curCertStatus = (*pos)->GetStatus();

        if(NOT_CHECKED != curCertStatus->GetRevocationStatus())
        {
            statusSet = true;
            pathStatus = min(pathStatus, curCertStatus->GetRevocationStatus());

            issuersCert = curCert;
            continue;
        }
        rStatus = NOT_CHECKED;

        //see if there's an entry in the revocation status cache for this cert/issuer pair
        CPKIFCertStatusCacheEntryPtr cacheEntry = m_impl->GetCertStatus(curCert, issuersCert);
        if(cacheEntry)
        {
            //update the overall status for the path to the low water mark
            if(!statusSet)
            {
                //avoid latching on NOT_CHECKED
                pathStatus = cacheEntry->m_revStatus;
                statusSet = true;
            }
            else
                pathStatus = min(pathStatus, cacheEntry->m_revStatus);

            RevocationSourceList rsl;
            cacheEntry->m_certStatus->GetRevocationSources(rsl);
            RevocationSourceList::iterator rslBegin = rsl.begin();
            RevocationSourceList::iterator ii;
            for(ii = rsl.begin(); ii != rsl.end(); ++ii)
            {
                IPKIFRevSourceInfoPtr rsip = (*ii)->m_sourceInfo;
                curCertStatus->AddRevocationSource((*ii)->m_sourceType, rsip, (*ii)->m_status, (*ii)->m_errorCode);
            }

            curCertStatus->SetRevocationStatus(cacheEntry->m_revStatus);
            if(REVOKED == cacheEntry->m_revStatus)
                curCertStatus->SetDiagnosticCode(PATH_CERT_REVOKED);
            else if (NOT_CHECKED == cacheEntry->m_revStatus)
                curCertStatus->SetDiagnosticCode(PATH_CERT_REVOCATION_STATUS_NOT_DETERMINED);
            else
                curCertStatus->SetDiagnosticCode(0);
        }
        else
        {
            //need to adjust path status down to NOT_CHECKED (but leave alone if already less than that)
            pathStatus = min(pathStatus, NOT_CHECKED);
            statusSet = true;
        }

        issuersCert = curCert;
    }

    status = pathStatus;
    return status != NOT_CHECKED;
}
void CPKIFCertStatusCache::PutObjectsInPath(
    CPKIFCertificatePath& path)
{
    //variables used in the following loop
    CPKIFCertificatePtr curCert, issuersCert;   //pointers to relevant certs
    CPKIFCertStatusPtr curCertStatus;           //pointer to cert status object for current cert

    //get the trust root from the path
    IPKIFTrustAnchorPtr ta;
    CPKIFCertificatePtr rootCert;
    path.GetTrustRoot(ta);
    CPKIFTrustRootPtr tr = dynamic_pointer_cast<CPKIFTrustRoot, IPKIFTrustAnchor>(ta);
    if(tr) 
        tr->GetCert(issuersCert);

    if(!issuersCert)
        return;

    //get certs from path
    CPKIFCertificateNodeList certNodeList;
    path.GetPath(certNodeList);

    //iterate over all certs in the path and invoke the CheckStatusInternal function
    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = certNodeList.end();
    for(pos = certNodeList.begin(); pos != end; ++pos)
    {
        //initialize loop variables for this iteration
        //issuersCert = curCert;
        curCert = (*pos)->GetCert();
        curCertStatus = (*pos)->GetStatus();

        RevocationStatus rs = curCertStatus->GetRevocationStatus();
        PutObject(curCert, issuersCert, rs, curCertStatus);

        issuersCert = curCert;
    }
}