OCSPRequest.cpp

Go to the documentation of this file.

#include "OCSPRequest.h"
#include "TBSRequest.h"
#include "Buffer.h"
#include "PKIFCredential.h"
#include "GeneralName.h"
#include "PKIFOCSPMemoryHelper.h"
#include "AlgorithmIdentifier.h"
#include "Certificate.h"

#include "ASN1Helper.h"
#include "OCSP.h"

#include "IPKIFHashContext.h"
#include "IPKIFCryptoMisc.h"
#include "IPKIFCryptoKeyID.h"

#include "OCSPException.h"
#include "ToolkitUtils.h"
#include "PKIFMediators.h"
#include "PKIFX509Extensions2.h"
#include "SubjectPublicKeyInfo.h"
#include "PKIFCommonErrors.h"
using namespace std;

struct CPKIFOCSPRequestImpl
{
    CPKIFOCSPRequest* m_parent;
    CPKIFOCSPRequestImpl ()
    {
        m_parent = NULL;
    }
    CPKIFOCSPRequestImpl (CPKIFOCSPRequest  *p) 
    {
        m_parent = p;
    }
    //member for building
    CPKIFTBSRequestPtr m_tbsRequest;

    //member for decoding
    CPKIFASNWrapper<OCSPRequest>* m_ocspReq;

    void ClearAllMembers();
    void MakeReq();
    void FreeReq();

    //member to maintain state when calling Set functions
    void CallingAllGets();

    CPKIFCredentialPtr m_cred;
    IPKIFMediator* m_mediator;
};

CPKIFOCSPRequest::CPKIFOCSPRequest()
    :m_impl (new CPKIFOCSPRequestImpl)
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::CPKIFOCSPRequest()", TOOLKIT_OCSP_ASN, 0, this);

    m_impl->m_parent = this;
    m_impl->m_ocspReq = NULL;
    m_impl->m_mediator = NULL;
}
CPKIFOCSPRequest::~CPKIFOCSPRequest()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::~CPKIFOCSPRequest()", TOOLKIT_OCSP_ASN, 0, this);

    if(NULL != m_impl->m_ocspReq)
        delete m_impl->m_ocspReq;

    delete m_impl;
    m_impl = NULL;
}
void CPKIFOCSPRequestImpl::ClearAllMembers()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::ClearAllMembers()", TOOLKIT_OCSP_ASN, 0, this);

    CPKIFTBSRequestPtr tmpReq;
    m_tbsRequest = tmpReq;

    FreeReq();
}
void CPKIFOCSPRequestImpl::CallingAllGets()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::CallingAllGets()", TOOLKIT_OCSP_ASN, 0, this);

    m_parent->GetRequest();
    FreeReq();
}
void CPKIFOCSPRequestImpl::MakeReq()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::MakeReq()", TOOLKIT_OCSP_ASN, 0, this);

    FreeReq();
    m_ocspReq = new CPKIFASNWrapper<OCSPRequest>( BEREncOCSPRequest, BERDecOCSPRequest );
}
void CPKIFOCSPRequestImpl::FreeReq()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::FreeReq()", TOOLKIT_OCSP_ASN, 0, this);

    if(NULL != m_ocspReq)
        delete m_ocspReq;
    m_ocspReq = NULL;
}

//tbsRequest
CPKIFTBSRequestPtr CPKIFOCSPRequest::GetRequest() const
{
    if(m_impl->m_tbsRequest == (CPKIFTBSRequest*)NULL && NULL != m_impl->m_ocspReq)
    {
        LOG_STRING_DEBUG("CPKIFOCSPRequest::GetRequest()", TOOLKIT_OCSP_ASN, 0, this);

        CPKIFASNWrapper<TBSRequest> tbsReq(BEREncTBSRequest, BERDecTBSRequest);
        tbsReq.Decode((*m_impl->m_ocspReq)->tbsRequest.data, (*m_impl->m_ocspReq)->tbsRequest.numocts);
        //CPKIFTBSRequest* tmpReq = new CPKIFTBSRequest(*tbsReq.data());
        CPKIFBufferPtr buffPtr(new CPKIFBuffer((*m_impl->m_ocspReq)->tbsRequest.data, (*m_impl->m_ocspReq)->tbsRequest.numocts));
        CPKIFTBSRequest* tmpReq = new CPKIFTBSRequest(buffPtr);
        CPKIFTBSRequestPtr tmpRef(tmpReq); 

        CPKIFOCSPRequest* nonConst = const_cast<CPKIFOCSPRequest*>(this);
        nonConst->m_impl->m_tbsRequest = tmpRef;
    }

    return m_impl->m_tbsRequest;
}

//the cred parameter is ignored because this version of PKIF does not support
//generation of signed OCSP requests
void CPKIFOCSPRequest::SetRequest(
    CPKIFTBSRequestPtr& request,
    CPKIFCredentialPtr& cred, 
    IPKIFMediator* m)
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::SetRequest(CPKIFTBSRequestPtr& request, CPKIFCredential* cred)", TOOLKIT_OCSP_ASN, 0, this);

    m_impl->CallingAllGets();
    m_impl->m_tbsRequest = request;
    m_impl->m_cred = cred;
    m_impl->m_mediator = m;
}
CPKIFBufferPtr CPKIFOCSPRequest::Encode()
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::Encode()", TOOLKIT_OCSP_ASN, 0, this);

    //first encode the tbs structure
    
    if(m_impl->m_mediator && m_impl->m_cred != (CPKIFCredential*)NULL)
    {   
        CPKIFGeneralNamePtr genName(new CPKIFGeneralName(m_impl->m_cred->GetCertificate()->Subject()));
        m_impl->m_tbsRequest->SetRequestorName(genName);
    }
    CPKIFBufferPtr tbs = m_impl->m_tbsRequest->Encode();

    PKIFOCSPMemoryHelper mhOCSPRequest;
    mhOCSPRequest.pRequest = new OCSPRequest;
    memset(mhOCSPRequest.pRequest, 0, sizeof(OCSPRequest));

    mhOCSPRequest.pRequest->tbsRequest.data = tbs->GetBuffer();
    mhOCSPRequest.pRequest->tbsRequest.numocts = tbs->GetLength();

    if(m_impl->m_mediator && m_impl->m_cred != (CPKIFCredential*)NULL)
    {
        IPKIFCryptoKeyIDOperations* cm = m_impl->m_mediator->GetMediator<IPKIFCryptoKeyIDOperations>();
        IPKIFCryptoMisc* cMisc = m_impl->m_mediator->GetMediator<IPKIFCryptoMisc>();

        if(cm && cMisc)
        {
            unsigned char sha1Hash[PKIFCRYPTO::SHA1];
            int sha1HashLen = PKIFCRYPTO::SHA1;
            IPKIFHashContext* hash = cMisc->HashInit(PKIFCRYPTO::SHA1);
            try
            {
                if(hash)
                {
                    cMisc->HashUpdate(hash, (unsigned char*)mhOCSPRequest.pRequest->tbsRequest.data, mhOCSPRequest.pRequest->tbsRequest.numocts);
                    cMisc->HashFinal(hash, sha1Hash, &sha1HashLen);
                    delete hash; hash = NULL;
                }

                unsigned char sig[500]; memset(sig, 0, 500);
                int nSigLen = 500;
                cm->Sign(*m_impl->m_cred, sha1Hash, sha1HashLen, sig, &nSigLen, PKIFCRYPTO::SHA1);

                mhOCSPRequest.pRequest->m.optionalSignaturePresent = 1;
                mhOCSPRequest.pRequest->optionalSignature.signature.data = new unsigned char[nSigLen];
                mhOCSPRequest.pRequest->optionalSignature.signature.numbits = nSigLen*8;
                memcpy((void*)mhOCSPRequest.pRequest->optionalSignature.signature.data, sig, nSigLen);

                CPKIFCertificatePtr cert = m_impl->m_cred->GetCertificate();
                CPKIFAlgorithmIdentifierPtr certAlg = cert->SubjectPublicKeyInfo()->alg();
                CPKIFOID dsaWithSha1("1.2.840.10040.4.3");
                if(*(certAlg->oid()) == *g_dsa)     
                {
                    CPKIFStringPtr str(new std::string(dsaWithSha1.ToString())); 
                    ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
                    //CopyOID(&mhOCSPRequest.pRequest->optionalSignature.signatureAlgorithm.algorithm, dsaWithSha1.raw());
                    CopyOID(&mhOCSPRequest.pRequest->optionalSignature.signatureAlgorithm.algorithm, tmpOid);
                    if(tmpOid)
                        delete tmpOid;
                }
                else
                {
                    CPKIFStringPtr str(new std::string(g_sha1WithRSAEncryption->ToString()));
                    ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
                    //CopyOID(&mhOCSPRequest.pRequest->optionalSignature.signatureAlgorithm.algorithm, g_sha1WithRSAEncryption->raw());
                    CopyOID(&mhOCSPRequest.pRequest->optionalSignature.signatureAlgorithm.algorithm, tmpOid);
                    if(tmpOid)
                        delete tmpOid;
                }
                mhOCSPRequest.pRequest->optionalSignature.m.certsPresent = 1;
                mhOCSPRequest.pRequest->optionalSignature.certs.head = new DListNode;
                mhOCSPRequest.pRequest->optionalSignature.certs.tail = mhOCSPRequest.pRequest->optionalSignature.certs.head;
                mhOCSPRequest.pRequest->optionalSignature.certs.head->next = NULL;
                mhOCSPRequest.pRequest->optionalSignature.certs.head->prev = NULL;
                ASN1OpenType* c = new ASN1OpenType;
                CPKIFBufferPtr encCert = cert->Encoded();
                c->data = encCert->GetBuffer();
                c->numocts = encCert->GetLength();
                mhOCSPRequest.pRequest->optionalSignature.certs.head->data = c;
                mhOCSPRequest.pRequest->optionalSignature.certs.count = 1;
            }
            catch(CPKIFException&)
            {
                if(NULL != hash)
                    delete hash;

                //if signature generation fails, attempt without a signature
            }
        }
    }

    CACASNWRAPPER_CREATE(OCSPRequest, objPDU);
    ASN1OpenType* data1 = objPDU.Encode(mhOCSPRequest.pRequest);

    if (data1 != NULL )
    {
      CPKIFBufferPtr tmp(new CPKIFBuffer(data1->data, data1->numocts));
      delete data1;
      return tmp;
    }
    else
    {
      CPKIFBufferPtr tmp(new CPKIFBuffer());
      delete data1;
      return tmp;
    }
}
void CPKIFOCSPRequest::Decode(
    CPKIFBufferPtr& msg)
{
    LOG_STRING_DEBUG("CPKIFOCSPRequest::Decode(CPKIFBufferPtr& msg)", TOOLKIT_OCSP_ASN, 0, this);

    m_impl->ClearAllMembers();

    //if the input is empty - fail now
    if(msg == (CPKIFBuffer*)NULL || 0 == msg->GetLength())
    {
        throw CPKIFOCSPException(TOOLKIT_OCSP_ASN, COMMON_INVALID_INPUT);
    }

    m_impl->MakeReq();

    try
    {
        //otherwise try to parse it into the m_tsr member
        (*m_impl->m_ocspReq).Decode(msg->GetBuffer(), msg->GetLength());
    }
    catch(CPKIFException&)
    {
        //delete e;
        //changed error code 3/2/2004
        throw CPKIFOCSPException(TOOLKIT_OCSP_ASN, ASN1_DECODE_ERROR);
    }
}