IPKIFScvpClient.cpp

Go to the documentation of this file.

//PKIFSCVP includes
#include "IPKIFScvpClient.h"
#include "PKIFSCVP_OIDs.h"
#include "ValPolRequest.h"
#include "ValPolResponse.h"

//PKIF includes
#include "Certificate.h"
#include "components.h"
#include "GeneralSubtree.h"
#include "Name.h"
#include "PKIFErrors.h"
#include "PKIFException.h"
#include "ToolkitUtils.h"

//PKIFCMS includes
#include "ContentInfo.h"
#include "EncapsulatedContentInfo.h"
#include "SignedData.h"

//PKIFERS includes
#include "EvidenceRecordVerifier.h"
#include "EvidenceRecordBundle.h"

#include <iterator>

struct PKIFScvpClientImpl
{
    PKIFScvpClientImpl()
    {
        m_bGenerateNonce = false;
        m_bRequireNonceMatch = true;
        m_bRequireSignedDPD = false;
        m_bFetchWhenLoading = true;
    }

    bool CheckNamespaces(const CPKIFCertificatePtr& cert);

    //HTTP URL to which requests are posted
    std::string m_url;

    //credential used to sign outbound requests
    CPKIFCredentialPtr m_cred;

    //list of wantBacks that are included in a CVRequest
    CPKIFOIDListPtr m_wantBacks;

    //evidence record verifier
    CPKIFEvidenceRecordVerifierPtr m_erv;

    //instruction that determines is a request includes a nonce
    bool m_bGenerateNonce;

    //instruction that determines if a nonce match is required
    bool m_bRequireNonceMatch;

    //instruction that determines if DPD requests require a signature
    bool m_bRequireSignedDPD;

    IPKIFMediatorPtr m_mediator;

    //path settings that are used to verify signed SCVP responses
    CPKIFPathSettingsPtr m_settings;

    //path settings that are used to customize the val pol stuff in CVRequests
    CPKIFPathSettingsPtr m_settingsForValPol;

    //namespace/get namespaces that determine if the colleague is consulted during path processing
    CPKIFGeneralSubtreeList m_namespaces;

    //ContentInfo containing a SignedData that encapsulates a val pol response
    CPKIFContentInfoPtr m_valPol;

    //ValPolResponse retrieved from m_valPol following successful verification
    CPKIFValPolResponsePtr m_parsedValPol;

    //instruction that determines if a validation policy is retrieved when loading the SCVP client
    bool m_bFetchWhenLoading;

    //want backs collected during a path processing operation
    CPKIFReplyWantBack_ExtDataHandlerPtr m_wantBacksFromResponse;

    CPKIFOIDPtr m_valPolOid;
};

bool PKIFScvpClientImpl::CheckNamespaces(const CPKIFCertificatePtr& cert)
{
    if(cert == (CPKIFCertificate*)NULL)
        return false;

    CPKIFNamePtr subjectName = cert->GetSubjectName();
    CPKIFGeneralSubtreeList::iterator pos;
    CPKIFGeneralSubtreeList::iterator end = m_namespaces.end();
    for(pos = m_namespaces.begin(); pos != end; ++pos)
    {
        if(CPKIFGeneralSubtree::MATCH == (*pos)->IsInSubtree(subjectName))
            return true;
    }

    //if we get here then either it's not a match (cause the list isn't empty)
    //or it is a match (cause the list is empty).  when the list is empty, we
    //accept all comers.
    return m_namespaces.empty();
}


IPKIFScvpClient::IPKIFScvpClient(void) : m_impl(new PKIFScvpClientImpl)
{
}

IPKIFScvpClient::~IPKIFScvpClient(void)
{
    if(m_impl)
        delete m_impl;
}

bool IPKIFScvpClient::CheckNamespaces(const CPKIFCertificatePtr& cert)
{
    return m_impl->CheckNamespaces(cert);
}

void IPKIFScvpClient::SetResponderUrl(const char* url)
{
    m_impl->m_url = url;
}

const char* IPKIFScvpClient::GetResponderUrl() const
{
    return m_impl->m_url.c_str();
}

void IPKIFScvpClient::SetSigningCredential(CPKIFCredentialPtr& cred)
{   
    m_impl->m_cred = cred;
}

CPKIFCredentialPtr IPKIFScvpClient::GetSigningCredential() const
{
    return m_impl->m_cred;
}

void IPKIFScvpClient::SetWantBacks(CPKIFOIDListPtr& wantBack)
{
    CPKIFOIDListPtr tmp(new CPKIFOIDList);
    m_impl->m_wantBacks = tmp;
    if(wantBack && !wantBack->empty())
        copy(wantBack->begin(),wantBack->end(), back_inserter(*tmp)); 
}

CPKIFOIDListPtr IPKIFScvpClient::GetWantBacks() const
{
    return m_impl->m_wantBacks;
}

void IPKIFScvpClient::SetEvidenceRecordVerifier(CPKIFEvidenceRecordVerifierPtr& erv)
{
    m_impl->m_erv = erv;
}

CPKIFEvidenceRecordVerifierPtr IPKIFScvpClient::GetEvidenceRecordVerifier() const
{
    return m_impl->m_erv;
}

void IPKIFScvpClient::SetGenerateNonce(bool b)
{
    m_impl->m_bGenerateNonce = b;
}

bool IPKIFScvpClient::GetGenerateNonce() const
{
    return m_impl->m_bGenerateNonce;
}

void IPKIFScvpClient::SetRequireNonceMatch(bool bRequireNonceMatch)
{
    m_impl->m_bRequireNonceMatch = bRequireNonceMatch;
}

bool IPKIFScvpClient::GetRequireNonceMatch()
{
    return m_impl->m_bRequireNonceMatch;
}

void IPKIFScvpClient::SetRequireSignedDPD(bool b)
{
    m_impl->m_bRequireSignedDPD = b;
}

bool IPKIFScvpClient::GetRequireSignedDPD() const
{
    return m_impl->m_bRequireSignedDPD;
}

void IPKIFScvpClient::SetMediator(IPKIFMediatorPtr& m)
{
    m_impl->m_mediator = m;
}

IPKIFMediatorPtr IPKIFScvpClient::GetMediator() const
{
    return m_impl->m_mediator;
}

void IPKIFScvpClient::SetPathSettings(CPKIFPathSettingsPtr& settings)
{
    m_impl->m_settings = settings;
}

CPKIFPathSettingsPtr IPKIFScvpClient::GetPathSettings() const
{
    return m_impl->m_settings;
}

void IPKIFScvpClient::SetPathSettingsForValPol(CPKIFPathSettingsPtr& settings)
{
    m_impl->m_settingsForValPol = settings;
}

CPKIFPathSettingsPtr IPKIFScvpClient::GetPathSettingsForValPol() const
{
    return m_impl->m_settingsForValPol;
}

void IPKIFScvpClient::SetFetchValPolWhenLoading(bool b)
{
    m_impl->m_bFetchWhenLoading = b;
}

bool IPKIFScvpClient::GetFetchValPolWhenLoading() const
{
    return m_impl->m_bFetchWhenLoading;
}

void IPKIFScvpClient::AddNamespace(CPKIFGeneralSubtreePtr& name)
{
    if(name == (CPKIFGeneralSubtree*)NULL)
        return;

    m_impl->m_namespaces.push_back(name);
}

CPKIFGeneralSubtreeList IPKIFScvpClient::GetNamespaces()
{
    return m_impl->m_namespaces;
}

void IPKIFScvpClient::SetValPol(CPKIFContentInfoPtr& vp)
{
    m_impl->m_valPol = vp;

    //clear the parsed val pol response, if any
    CPKIFValPolResponsePtr empty;
    m_impl->m_parsedValPol = empty;
}

CPKIFContentInfoPtr IPKIFScvpClient::GetValPol() const
{
    return m_impl->m_valPol;
}

CPKIFOIDPtr IPKIFScvpClient::GetValidationPolicy() const
{
    return m_impl->m_valPolOid;
}
void IPKIFScvpClient::SetValidationPolicy(CPKIFOIDPtr& valPol)
{
    m_impl->m_valPolOid = valPol;
}

CPKIFValPolResponsePtr IPKIFScvpClient::VerifyValPol()
{
    if(!m_impl->m_valPol || !m_impl->m_mediator)
        throw CPKIFException(TOOLKIT_SCVP_SUBCOMPONENT, COMMON_INVALID_INPUT, "Either SetValPol or SetMediator has not been called prior to VerifyValPol.");

    if(!m_impl->m_parsedValPol)
    {
        CPKIFOIDPtr contentType = m_impl->m_valPol->GetContentType();
        if(!contentType || (*g_signedData != *contentType))
            throw CPKIFException(TOOLKIT_SCVP_SUBCOMPONENT, COMMON_INVALID_INPUT, "Unexpected ValPol contents.  SignedData not present.");

        CPKIFBufferPtr content = m_impl->m_valPol->GetContent();

        CPKIFSignedData sd;
        sd.Decode(content);

        sd.AddMediator(m_impl->m_mediator);

        if(m_impl->m_settings)
            sd.SetPathSettings(m_impl->m_settings);

        CMSVerificationStatus status;
        if(!sd.Verify(0, status))
            throw CPKIFException(TOOLKIT_SCVP_SUBCOMPONENT, COMMON_INVALID_INPUT, "ValPol verification failed.");

        CPKIFEncapsulatedContentInfoPtr ecip = sd.GetEncapsulatedContent();
        CPKIFOIDPtr ecipOid = ecip->GetOID();
        if(!ecipOid || (*g_id_ct_scvp_valPolResponse != *ecipOid))
            throw CPKIFException(TOOLKIT_SCVP_SUBCOMPONENT, COMMON_INVALID_INPUT, "Unexpected ValPol contents.  ValPolRepsonse not present.");

        CPKIFBufferPtr ecipBuf = ecip->GetContent();
        CPKIFValPolResponsePtr vp(new CPKIFValPolResponse);
        vp->Decode(ecipBuf);
        m_impl->m_parsedValPol = vp;
    }

    return m_impl->m_parsedValPol;
}

CPKIFContentInfoPtr IPKIFScvpClient::FetchValPol()
{
    //create a new val pol request object
    CPKIFValPolRequest vr;

    //declare a buffer to catch the val pol response
    CPKIFBufferPtr encValPolResponse;

    //clear any previously set val pol response
    CPKIFContentInfoPtr emptyCI;
    SetValPol(emptyCI);

    //read the current nonce instruction and pass it to the val pol req
    vr.SetGenerateNonce(GetGenerateNonce());

    //encode it...
    CPKIFBufferPtr encVR = vr.Encode();

    //then pack it in a ContentInfo...
    CPKIFContentInfo ci;
    ci.SetContent(encVR);
    ci.SetContentType(g_id_ct_scvp_valPolRequest);

    //encode that then...
    CPKIFBufferPtr encReq = ci.Encode();

    //post...
    if(PostRequestURL(encReq, encValPolResponse, GetResponderUrl(), PKIF_SCVP_VAL_POL)) 
    {
        CPKIFContentInfoPtr ci(new CPKIFContentInfo);
        ci->Decode(encValPolResponse);
        SetValPol(ci);
    }

    return GetValPol();
}
void IPKIFScvpClient::SetWantBacksFromResponse(CPKIFReplyWantBack_ExtDataHandlerPtr& wantBacks)
{
    m_impl->m_wantBacksFromResponse = wantBacks;
}


CPKIFReplyWantBack_ExtDataHandlerPtr IPKIFScvpClient::GetWantBacksFromResponse() const
{
    return m_impl->m_wantBacksFromResponse;
}