GeneralSubtree.cpp

Go to the documentation of this file.

#include "GeneralSubtree.h"
#include "GeneralName.h"
#include "Name.h"
#include "ASN1Helper.h"

#include "PKIX1Implicit88.h"
#include "PKIX1Explicit88.h"

#include "components.h"
#include "PKIFException.h"

#include "boost/regex.hpp"
#include "boost/algorithm/string.hpp"
#include "boost/numeric/conversion/cast.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;

#include <string>
#include <sstream>
using namespace std;

/*
!"#$%&'*+-/0123456789=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ^_`abcdefghijklmnopqrstuvwxyz{|}~
*/
static bool emailre_init = false;
static const char * emailpat = "([\\w\\d!\"#$%&'*+-/=?@^_`{|}~]+)@([\\w\\d!\"#$%&'*+-/=?@^_`{|}~]+\\.)([\\w\\d!\"#$%&'*+-/=?@^_`{|}~]+)(\\.[\\w\\d!\"#$%&'*+-/=?@^_`{|}~]+)*";
static boost::regex emailre;

static bool escapere_init = false;
static const char * escapepat = "\\.";
static const char * escapeformat = "\\\\.";
static boost::regex escapere;

static bool urire_init = false;
// straight from rfc 2396
static const char * uripat = "^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?";
static boost::regex urire;
static const char * portpat = "(.*):(\\d+)?$";
static boost::regex portre;

static bool erdnre_init = false;
static const char * erdnpat = "^e=(.*)$";
static boost::regex erdnre;

static std::string getHost(const std::string & uri)
{
    if(!urire_init) {
        urire.assign(uripat,boost::regex_constants::perl);
        portre.assign(portpat,boost::regex_constants::perl);
        urire_init = true;
    }
    boost::smatch what;
    std::string rv("");
    bool found = boost::regex_match(uri,what,urire);
    if(found){
        rv.assign(what[4].first,what[4].second);
        boost::smatch pm;
        // this could probably be done with a single expression.
        // I was unable to concoct such an expression.
        found = boost::regex_match(rv,pm,portre);
        if(found) {
            rv.assign(pm[1].first,pm[1].second);
        }
    }
    return rv;
}

static std::string escapeDots(const std::string & inpat)
{
    if(!escapere_init) {
        escapere.assign(escapepat,boost::regex_constants::perl);
        escapere_init = true;
    }
    ostringstream os;
    ostream_iterator<char> oi(os);
    boost::regex_replace(oi,inpat.begin(),inpat.end(),escapere,escapeformat,
        boost::match_default | boost::format_all);
    return os.str();
}

static bool isEmail(
    const std::string & addr)
{
    if(!emailre_init) {
        emailre.assign(emailpat,boost::regex_constants::perl);
        emailre_init = true;
    }
    boost::smatch what;
    bool found = boost::regex_search(addr,what,emailre);
    if(!found)
    {
        if(!urire_init) {
            urire.assign(uripat,boost::regex_constants::perl);
            portre.assign(portpat,boost::regex_constants::perl);
            urire_init = true;
        }
        boost::smatch what;
        found = boost::regex_match(addr,what,urire);
    }
    return found;
}


struct CPKIFGeneralSubtreeImpl
{
    CPKIFGeneralNamePtr m_base;
    int m_nMin;
    int m_nMax;
    bool m_empty;
    
    CPKIFGeneralSubtree::MatchState DNSNameIsInSubtree(const char * name);
    CPKIFGeneralSubtree::MatchState IPAddressIsInSubtree(const CPKIFBufferPtr & name);
    CPKIFGeneralSubtree::MatchState RFC822NameIsInSubtree(const char * name);
    CPKIFGeneralSubtree::MatchState URINameIsInSubtree(const char * name);

};

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtreeImpl::DNSNameIsInSubtree(const char * name)
{
    if(CPKIFGeneralName::DNSNAME != m_base->GetType()) return CPKIFGeneralSubtree::NOT_APPLICABLE;
    if(m_empty) return CPKIFGeneralSubtree::NO_MATCH;
    /* DNS name restrictions are expressed as host.example.com.  Any DNS
    name that can be constructed by simply adding subdomains to the left
    hand side of the name satisfies the name constraint.  For example,
    www.host.example.com would satisfy the constraint but
    host1.example.com would not. */

    string base(m_base->dnsName());
    string cand(name);
    
    // DNS name restrictions are case insensitive.
    boost::regex_constants::syntax_option_type reflags = 
        boost::regex_constants::perl | boost::regex_constants::icase;

    ostringstream patstream;
    patstream << base << "$";
    string pattern = escapeDots(patstream.str());
    boost::regex re;
    boost::smatch what;
    
    re.assign(pattern,reflags);
    bool found = boost::regex_search(cand,what,re);
    
    // if the constraint was not found at the end of the candidate name,
    // no match
    if(!found) return CPKIFGeneralSubtree::NO_MATCH;

    // if there was an exact match, the restriction is satisfied
    if(cand.length() == base.length()) return CPKIFGeneralSubtree::MATCH;

    // if the character just before the match is a period, than the candidate
    // is a subdomain of the restriction
    int pos;
    try {
        pos = numeric_cast<int>(what.position());
    }catch(bad_numeric_cast &) {
        throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered abusively long dns name");
    }
    if(pos && cand[pos-1] == '.') return CPKIFGeneralSubtree::MATCH;

    return CPKIFGeneralSubtree::NO_MATCH;
}

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtreeImpl::IPAddressIsInSubtree(const CPKIFBufferPtr & name)
{
    if(CPKIFGeneralName::IPADDRESS != m_base->GetType()) return CPKIFGeneralSubtree::NOT_APPLICABLE;
    if(m_empty) return CPKIFGeneralSubtree::NO_MATCH;
    /* The syntax of iPAddress MUST be as described in section 4.2.1.6 with
    the following additions specifically for Name Constraints.  For IPv4
    addresses, the ipAddress field of GeneralName MUST contain eight (8)
    octets, encoded in the style of RFC 1519 (CIDR) to represent an
    address range [RFC 1519].  For IPv6 addresses, the ipAddress field
    MUST contain 32 octets similarly encoded.  For example, a name
    constraint for "class C" subnet 10.9.8.0 is represented as the octets
    0A 09 08 00 FF FF FF 00, representing the CIDR notation
    10.9.8.0/255.255.255.0. */

    CPKIFBufferPtr base = m_base->ipAddress();
    unsigned int baselen = base->GetLength();
    unsigned int addrlen = baselen/2;
    // make sure the two addresses are comparable
    if(name->GetLength() != addrlen) return CPKIFGeneralSubtree::NO_MATCH;
    // only support IPv4 and IPv6 address + mask
    if(baselen != 32 && baselen != 8) throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered malformed iPAddress");
    
    CPKIFBufferPtr test(new CPKIFBuffer(*name));
    const unsigned char * baseBuf = base->GetBuffer();
    const unsigned char * maskBuf = baseBuf + addrlen;
    unsigned char * testBuf = const_cast<unsigned char *>(test->GetBuffer());
    // apply the subnet mask to the candidate address
    for(unsigned int i = 0; i < addrlen; i++)
    {
        testBuf[i] &= maskBuf[i];
    }
    // if the network numbers are now the same, the restriction is met
    if(!memcmp(baseBuf,testBuf,addrlen)) {
        return CPKIFGeneralSubtree::MATCH;
    }   
    return CPKIFGeneralSubtree::NO_MATCH;
}

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtreeImpl::RFC822NameIsInSubtree(const char * name)
{
    if(CPKIFGeneralName::RFC822 != m_base->GetType()) return CPKIFGeneralSubtree::NOT_APPLICABLE;
    if(m_empty) return CPKIFGeneralSubtree::NO_MATCH;
    /* A name constraint for Internet mail addresses MAY specify a
    particular mailbox, all addresses at a particular host, or all
    mailboxes in a domain.  To indicate a particular mailbox, the
    constraint is the complete mail address.  For example,
    "root@example.com" indicates the root mailbox on the host
    "example.com".  To indicate all Internet mail addresses on a
    particular host, the constraint is specified as the host name.  For
    example, the constraint "example.com" is satisfied by any mail
    address at the host "example.com".  To specify any address within a
    domain, the constraint is specified with a leading period (as with
    URIs).  For example, ".example.com" indicates all the Internet mail
    addresses in the domain "example.com", but not Internet mail
    addresses on the host "example.com".*/

    string base(m_base->rfc822Name());
    string cand(name);

    // if the candidate name does not appear to be an email address,
    // this test makes no sense
    if(!isEmail(cand)) {
        throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered malformed rfc822Name");
    }
    
    // rfc822name restrictions are case insensitive.
    boost::regex_constants::syntax_option_type reflags = 
        boost::regex_constants::perl | boost::regex_constants::icase;

    ostringstream patstream;
    patstream << base << "$";
    string pattern = escapeDots(patstream.str());
    boost::regex re;
    boost::smatch what;

    re.assign(pattern,reflags);
    bool found = boost::regex_search(cand,what,re);

    // if the constraint was not found at the end of the candidate name,
    // no match
    if(!found) return CPKIFGeneralSubtree::NO_MATCH;

    // if the base name is a full address, the only way the
    // constraint can be satisfied is with a full match
    if(isEmail(base)) { 
        if(cand.length() == base.length()) return CPKIFGeneralSubtree::MATCH;
    }

    int pos;
    try {
        pos = numeric_cast<int>(what.position());
    }catch(bad_numeric_cast &) {
        throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered abusively long dns name");
    }
    // if the base was just a host name, the candidate address
    // must be on that host
    if(base[0] != '.') {
        if(pos && (cand[pos-1] == '@')) {
            return CPKIFGeneralSubtree::MATCH;
        }
    } else {
        // if the base indicated subdomains, make sure the candidate
        // was on a subdomain (so, e.g. foo@.bar.com doesn't pass)
        if(pos && (cand[pos-1]!='@')) {
            return CPKIFGeneralSubtree::MATCH;
        }
    }

    return CPKIFGeneralSubtree::NO_MATCH;
}

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtreeImpl::URINameIsInSubtree(const char * name)
{
    if(CPKIFGeneralName::URI != m_base->GetType()) return CPKIFGeneralSubtree::NOT_APPLICABLE;
    if(m_empty) return CPKIFGeneralSubtree::NO_MATCH;
    /* For URIs, the constraint applies to the host part of the name.  The
    constraint MAY specify a host or a domain.  Examples would be
    "host.example.com";  and ".example.com".  When the the constraint
    begins with a period, it MAY be expanded with one or more subdomains.
    That is, the constraint ".example.com" is satisfied by both
    host.example.com and my.host.example.com.  However, the constraint
    ".example.com" is not satisfied by "example.com".  When the
    constraint does not begin with a period, it specifies a host. */
    string base(m_base->uri());
    string cand(name);
    cand = getHost(cand);
    if(cand == ""){
        throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered malformed uriName");
    }

    // once the host is extracted from the URI, it's the same logic
    // as a DNS name restriction, bar the leading period.
    // DNS name restrictions are case insensitive.
    boost::regex_constants::syntax_option_type reflags = 
        boost::regex_constants::perl | boost::regex_constants::icase;

    ostringstream patstream;
    patstream << base << "$";
    string pattern = escapeDots(patstream.str());
    boost::regex re;
    boost::smatch what;
    
    re.assign(pattern,reflags);
    bool found = boost::regex_search(cand,what,re);
    
    // if the constraint was not found at the end of the candidate name,
    // no match
    if(!found) return CPKIFGeneralSubtree::NO_MATCH;

    // if there was an exact match, the restriction is satisfied
    if(cand.length() == base.length()) return CPKIFGeneralSubtree::MATCH;

    // if the character just before the match is a period, than the candidate
    // is a subdomain of the restriction
    int pos;
    try {
        pos = numeric_cast<int>(what.position());
    }catch(bad_numeric_cast &) {
        throw CPKIFException(TOOLKIT_ASN, ASN1_DECODE_ERROR, "encountered abusively long dns name");
    }
    if(pos && cand[pos] == '.') return CPKIFGeneralSubtree::MATCH;

    return CPKIFGeneralSubtree::NO_MATCH;
}


CPKIFGeneralSubtree::CPKIFGeneralSubtree()
  :m_impl (new CPKIFGeneralSubtreeImpl)
{
    m_impl->m_nMax = -1;
    m_impl->m_nMin = -1;
    CPKIFGeneralNamePtr tmpGN;
    m_impl->m_base = tmpGN;
    m_impl->m_empty = false;
}
CPKIFGeneralSubtree::CPKIFGeneralSubtree(
    const CPKIFBufferPtr& genSubtree)
  :m_impl (new CPKIFGeneralSubtreeImpl)
{
    m_impl->m_empty = false;
    CACASNWRAPPER_CREATE(CACX509V3GeneralSubtree, objPDU);
    objPDU.Decode(genSubtree->GetBuffer(), genSubtree->GetLength());

    CACASNWRAPPER_CREATE(CACX509V3GeneralName, objPDU2);
    ASN1OpenType* data1 = objPDU2.Encode(&(objPDU->base));
    CPKIFBufferPtr tmpBuf;
    if (data1 != NULL)
    {
         tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
        delete data1;
    }
    //CPKIFGeneralNamePtr tmpGN(new CPKIFGeneralName(objPDU->base));
    CPKIFGeneralNamePtr tmpGN(new CPKIFGeneralName(tmpBuf));

    m_impl->m_base = tmpGN;

    if(objPDU->m.maximumPresent)
        m_impl->m_nMax = objPDU->maximum;
    else
        m_impl->m_nMax = -1;

    m_impl->m_nMin = objPDU->minimum;
}


CPKIFGeneralSubtree::~CPKIFGeneralSubtree()
{
    if(m_impl)
    {
        delete m_impl;
        m_impl = 0;
    }
}

CPKIFGeneralNamePtr CPKIFGeneralSubtree::GetBase() const 
{
    return m_impl->m_base;
}
int CPKIFGeneralSubtree::GetMin() const 
{
    return m_impl->m_nMin;
}
int CPKIFGeneralSubtree::GetMax() const 
{
    return m_impl->m_nMax;
}

void CPKIFGeneralSubtree::SetBase(CPKIFGeneralNamePtr gn) 
{
    m_impl->m_base = gn;
}
void CPKIFGeneralSubtree::SetMin(int n) 
{
    m_impl->m_nMin = n;
}
void CPKIFGeneralSubtree::SetMax(int n) 
{
    m_impl->m_nMax = n;
}

bool CPKIFGeneralSubtree::operator==(
    const CPKIFGeneralSubtree& rhs)
{
    if(!(*m_impl->m_base == *rhs.m_impl->m_base))
        return false;

    if(m_impl->m_nMin != rhs.m_impl->m_nMin)
        return false;

    if(m_impl->m_nMax != rhs.m_impl->m_nMax)
        return false;

    // this is only to be used by ShallowCopied pointers...
    // don't consider it when testing equivalence
    /*if(m_impl->m_empty != rhs.m_impl->m_empty)
        return false;*/

    return true;
}

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtree::IsInSubtree(
    const CPKIFNamePtr& subject)const 
{
    // since these can now be constructed and set by apps, make sure
    // fields are initialized before use
    if(!m_impl->m_base || -1 == m_impl->m_nMin)
        throw CPKIFException(TOOLKIT_ASN,COMMON_NOT_INITIALIZED,"An attempt was made to use an uninitialized GeneralSubtree");
    if(!subject)
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "CPKIFGeneralSubtree::IsInSubtree called with an invalid CPKIFName object");
    
    switch(m_impl->m_base->GetType()) {
        case CPKIFGeneralName::DIRECTORYNAME:
            {
                // the empty check needs to go inside the cases because
                // RFC822NAME won't always apply
                if(m_impl->m_empty) return CPKIFGeneralSubtree::NO_MATCH;
                CPKIFNamePtr subtreeName = m_impl->m_base->directoryName();
                if(!subtreeName->DescendedFrom(*subject) && !(*subtreeName == *subject))
                    return NO_MATCH;

                int diff = subject->RDNCount() - subtreeName->RDNCount();
                if(-1 != m_impl->m_nMin && diff < m_impl->m_nMin)
                    return NO_MATCH;

                if(-1 != m_impl->m_nMax && diff > m_impl->m_nMax)
                    return NO_MATCH;

                return MATCH;
                break;
            }
        /* only rfc822Name and directoryName need to be handled in this function,
            other forms are not checked inside DNs. */
        case CPKIFGeneralName::RFC822:
            {
                if(!erdnre_init) {
                    erdnre.assign(erdnpat,boost::regex_constants::perl);
                    erdnre_init = true;
                }
                vector<string>rdns;
                subject->GetRDNs(rdns);
                vector<string>::iterator end = rdns.end();
                vector<string>::iterator pos;
                CPKIFGeneralSubtree::MatchState emailState = NOT_APPLICABLE;
                // step through rdn components looking for email addresses.
                // all found email addresses must fall within the subtree
                // for the restriction to be satisfied
                for(pos = rdns.begin(); 
                    emailState != NO_MATCH && pos != end;
                    ++pos) 
                {
                    boost::smatch what;
                    bool found = boost::regex_match((*pos),what,erdnre);
                    if(found) {
                        // the empty check only applies here if an email address
                        // is found
                        if(m_impl->m_empty) return CPKIFGeneralSubtree::NO_MATCH;
                        string email;
                        email.assign(what[1].first,what[1].second);
                        CPKIFGeneralSubtree::MatchState tmpState = m_impl->RFC822NameIsInSubtree(email.c_str());
                        if(emailState == NOT_APPLICABLE)
                            emailState = tmpState;
                    }

                }
                return emailState;
                break;
            }

        default:
            throw CPKIFException(TOOLKIT_ASN, -1, "Unsupported name form");
            break;
    }
    return NO_MATCH;
}

CPKIFGeneralSubtree::MatchState CPKIFGeneralSubtree::IsInSubtree(
    const CPKIFGeneralNamePtr & name
    )const 
{
    // since these can now be constructed and set by apps, make sure
    // fields are initialized before use
    if(!m_impl->m_base || -1 == m_impl->m_nMin)
        throw CPKIFException(TOOLKIT_ASN,COMMON_NOT_INITIALIZED,"An attempt was made to use an uninitialized GeneralSubtree");
    if(!name)
        throw CPKIFException(TOOLKIT_X509_ASN, COMMON_INVALID_INPUT, "CPKIFGeneralSubtree::IsInSubtree called with an invalid CPKIFGeneralName object"); 

    if(name->GetType() != m_impl->m_base->GetType())
        return NOT_APPLICABLE;

    switch(name->GetType())
    {
    case CPKIFGeneralName::DIRECTORYNAME:
        return IsInSubtree(name->directoryName());
        break;
    case CPKIFGeneralName::DNSNAME:
        return m_impl->DNSNameIsInSubtree(name->dnsName());
        break;
    case CPKIFGeneralName::IPADDRESS:
        return m_impl->IPAddressIsInSubtree(name->ipAddress());
        break;
    case CPKIFGeneralName::RFC822:
        return m_impl->RFC822NameIsInSubtree(name->rfc822Name());
        break;
    case CPKIFGeneralName::URI:
        return m_impl->URINameIsInSubtree(name->uri());
        break;
    default:
        throw CPKIFException(TOOLKIT_ASN,-1,"Unsupported name form");
    }
    return NO_MATCH;
}

bool CPKIFGeneralSubtree::IsSupported(
    CPKIFGeneralName::GENNAMETYPE type)
{
    switch(type)
    {
    case CPKIFGeneralName::DIRECTORYNAME:
    case CPKIFGeneralName::DNSNAME:
    case CPKIFGeneralName::IPADDRESS:
    case CPKIFGeneralName::RFC822:
    case CPKIFGeneralName::URI:
        return true;
        break;
    default:
        break;
    }
    return false;
}

void CPKIFGeneralSubtree::SetEmpty() 
{
    m_impl->m_empty = true;
}

CPKIFGeneralSubtree * CPKIFGeneralSubtree::ShallowCopy()
{
    CPKIFGeneralSubtree * tmp = new CPKIFGeneralSubtree();
    tmp->m_impl->m_base = m_impl->m_base;
    tmp->m_impl->m_nMax = m_impl->m_nMax;
    tmp->m_impl->m_nMin = m_impl->m_nMin;
    tmp->m_impl->m_empty = m_impl->m_empty;
    return tmp;
}