PKIFCRLDPRetrieval.cpp

Go to the documentation of this file.

#include "PKIFdll.h"

#include "IPKIFColleague.h"
#include "PKIFCRLDPRetrieval.h"
#include "LDAP_URL_Header.h"

#include "Buffer.h"
#include "GeneralName.h"
#include "AuthorityInfoAccess.h"
#include "SubjectInfoAccess.h"
#include "ToolkitUtils.h"

#include "CRLDistributionPoint.h"
#include "CRLDistributionPoints.h"
#include "DistributionPointName.h"
#include "AccessDescription.h"
#include "IssuerAltName.h"
#include "Certificate.h"
#include "GottaMatch.h"
#include "CRL.h"
#include "PKIFHttpCrlNode.h"
#include "PKIFLdapCrlNode.h"

#include "ASN1Helper.h"
#include "CryptographicMessageSyntax2004.h"

//#define _DEBUG_URI_DUMP 1
#ifdef _DEBUG_URI_DUMP
#include <fstream>
extern ofstream g_uriLogFile;
#endif

struct CPKIFCRLDPRetrievalImpl
{
    CPKIFOIDPtr m_oid;
    CPKIFBufferList m_content;
};

CPKIFCRLDPRetrieval::CPKIFCRLDPRetrieval(void)
    :m_impl (new CPKIFCRLDPRetrievalImpl)
{
    LOG_STRING_DEBUG("CPKIFCRLDPRetrieval::CPKIFCRLDPRetrieval(void)", TOOLKIT_OCSP_CHECKER, 0, this);
}
CPKIFCRLDPRetrieval::~CPKIFCRLDPRetrieval(void)
{
    LOG_STRING_DEBUG("CPKIFCRLDPRetrieval::~CPKIFCRLDPRetrieval(void)", TOOLKIT_OCSP_CHECKER, 0, this);

    delete m_impl;
    m_impl = NULL;
}

void CPKIFCRLDPRetrieval::Initialize(void) 
{
}

bool RetrieveCRLGivenHTTPURL(
    const char* url, 
    CPKIFCRLList& crlList)
{
    LOG_STRING_DEBUG("RetrieveCRLGivenHTTPURL(const char* url, CPKIFCRLList& crlList)", TOOLKIT_OCSP_CHECKER, 0, NULL);

    if(NULL == url || 0 == strlen(url))
        return false;

    bool allIsWell = false;
    try
    {

#ifdef _DEBUG_URI_DUMP
    if(!g_uriLogFile.is_open())
    {
        g_uriLogFile.open("_DEBUG_URI_DUMP_URILog.txt", ios::out);
    }
    DWORD __ticks = GetTickCount();
#endif

        CPKIFBufferPtr crlBuf;
        GetRequest(url, crlBuf);

#ifdef _DEBUG_URI_DUMP
    g_uriLogFile << GetTickCount() - __ticks << " milliseconds elapsed retrieving from " << url << endl; 
#endif

        if(!crlBuf)     
            return false;

        //if no cache entry was found - create a CRL object and add it to the cache using the URL gen name as the dp
        //bad_alloc caught by catch(...)
        CPKIFCRLPtr crl(new CPKIFCRL());
        try
        {
            crl->Decode(crlBuf->GetBuffer(), crlBuf->GetLength());

            GottaMatch<CPKIFCRLPtr> gm;
            gm.SetRHS(crl);
            if(crlList.end() == find_if(crlList.begin(), crlList.end(), gm))
                crlList.push_back(crl);
            allIsWell = true;
        }
        catch(CPKIFException&)
        {
            //delete e;
            //XXX-DEFER attempt base64 decode?
        }
    }
    catch(...)
    {
        allIsWell = false;
    }

    return allIsWell;
}

void GetCertsfromP7(
    CPKIFBufferPtr& buf, 
    CPKIFCertificateList& certList)
{

    if(buf == (CPKIFBuffer*)NULL)
        return; //do nothing

    try
    {
        CACASNWRAPPER_CREATE(CACCMSContentInfo, contentInfo);
        CACASNWRAPPER_CREATE(CACCMSSignedData, signedData);

        contentInfo.Decode(buf->GetBuffer(), buf->GetLength());
        signedData.Decode(contentInfo->content);

        if(!signedData->m.certificatesPresent || 0 >= signedData->certificates.count)
            return;

        DListNode* iter = signedData->certificates.head;
        while(NULL != iter)
        {
            // signedData->certificates is a list of CertificateChoices, not
            // a list of certificates.
            //ASN1OpenType* cert = (ASN1OpenType*)iter->data;
            CACCMSCertificateChoices* curChoice = (CACCMSCertificateChoices*)iter->data;
            if(T_CACCMSCertificateChoices_certificate != curChoice->t)
            {
                iter = iter->next;
                continue;
            }
            ASN1OpenType* cert = (ASN1OpenType*)curChoice->u.certificate;

            try
            {
                CPKIFCertificatePtr newCert(new CPKIFCertificate());
                newCert->Decode(cert->data, cert->numocts);
                certList.push_back(newCert);
            }
            catch(CPKIFException&)
            {
                //don't bother the caller with malformed certs
            }
            catch(std::bad_alloc& ba)
            {
                //empty the list
                certList.clear();
                throw ba;
            }
    
            iter = iter->next;
        }
    }
    catch(CPKIFException&)
    {
        //carry on
    }

/*  try
    {
        CPKIFContentInfo ci;
        ci.Decode(buf->GetBuffer(), buf->GetLength());

        CPKIFOIDPtr type = ci.GetContentType();
        if(type != NULL && *type == *g_signedData)
        {
            CPKIFBufferPtr content = ci.GetContent();
            if(content == NULL)
                return;

            CPKIFSignedData sd;
            sd.Decode(content);

            CPKIFCertificateList cl;
            sd.GetCertificates(cl);

            copy(cl.begin(), cl.end(), back_inserter(certList));
        }
    }
    catch(CPKIFException&)
    {
        //carry on
    }
*/
}

bool CAC_API RetrieveCertGivenHTTPURL(
    const char* url, 
    CPKIFCertificateNodeList& certNodeList)
{
    LOG_STRING_DEBUG("RetrieveCertGivenHTTPURL(const char* url, CPKIFCertificateNodeList& certNodeList)", TOOLKIT_OCSP_CHECKER, 0, NULL);

    if(NULL == url || 0 == strlen(url))
        return false;

    bool allIsWell = false;
    try
    {
#ifdef _DEBUG_URI_DUMP
    if(!g_uriLogFile.is_open())
    {
        g_uriLogFile.open("_DEBUG_URI_DUMP_URILog.txt", ios::out);
    }
    DWORD __ticks = GetTickCount();
#endif

        std::string strUrl = url;
        CPKIFBufferPtr certBuf;
        GetRequest(url, certBuf);

#ifdef _DEBUG_URI_DUMP
    g_uriLogFile << GetTickCount() - __ticks << " milliseconds elapsed retrieving from " << url << endl; 
#endif

        if(!certBuf || !certBuf->GetBuffer() || 0 >= certBuf->GetLength())
            return false;

        //if no cache entry was found - create a cert object and add it to the cache using the URL gen name as the dp
        //bad_alloc caught by catch(...)
        CPKIFCertificatePtr cert(new CPKIFCertificate());
        try
        {
            cert->Decode(certBuf->GetBuffer(), certBuf->GetLength());

            CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry(cert));
            GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
            gm.SetRHS(certNode);
            if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
            {
                certNode->AddSource(strUrl);
                certNode->SetSource(REMOTE);
                certNodeList.push_back(certNode);
            }
            allIsWell = true;
        }
        catch(CPKIFException&)
        {
            //delete e;
            //XXX-DEFER attempt base64 decode?

            //parse as a P7 blob if possible
            CPKIFCertificateList certList;
            GetCertsfromP7(certBuf, certList);  

            CPKIFCertificateList::iterator pos;
            CPKIFCertificateList::iterator end = certList.end();
            for(pos = certList.begin(); pos != end; ++pos)
            {
                CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry(*pos));
                GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
                gm.SetRHS(certNode);
                if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
                {
                    certNode->AddSource(strUrl);
                    certNode->SetSource(REMOTE);
                    certNodeList.push_back(certNode);
                }
            }
        }
    }
    catch(...)
    {
        allIsWell = false;
    }

    return allIsWell;
}

void CAC_API GetCertsFromIssuerAltName(
    CPKIFCertificate& cert, 
    CPKIFCertificateNodeList& certNodeList, 
    PKIInfoSource source,
    PathBuildingDirection pbd)
{
    LOG_STRING_DEBUG("GetCertsFromIssuerAltName(const CPKIFCertificatePtr& cert, CPKIFCertificateNodeList& certNodeList, PKIInfoSource source)", TOOLKIT_OCSP_CHECKER, 0, NULL);

    if(LOCAL == source)
        return;

    //Added AIA code 6/3/2004

    CPKIFCertificateNodeList certsFromIAN;
    CPKIFGeneralNameList genNames;

    if(PBD_FORWARD == pbd)
    {
        CPKIFIssuerAltNamePtr ian;
        CPKIFAuthorityInfoAccessPtr aia;

        //see if the cert has an issuer alt name - if it does not the return
        try
        {
            ian = cert.GetExtension<CPKIFIssuerAltName>();
            aia = cert.GetExtension<CPKIFAuthorityInfoAccess>();
            if(ian == (CPKIFIssuerAltNamePtr*)NULL && aia == (CPKIFAuthorityInfoAccess*)NULL)
                return;
        }
        catch(...)
        {
            //one of these extensions is busted.  just return
            return;
        }

        if(ian != (CPKIFIssuerAltNamePtr*)NULL)
        {
            ian->GeneralNames(genNames);
        }

        if(aia != (CPKIFAuthorityInfoAccess*)NULL)
        {
            CPKIFAccessDescriptionListPtr adl = aia->GetAccessDescriptions();
            CPKIFAccessDescriptionList::iterator aPos;
            CPKIFAccessDescriptionList::iterator aEnd = adl->end();
            for(aPos = adl->begin(); aPos != aEnd; ++aPos)
            {
                CPKIFOIDPtr aOID = (*aPos)->AccessMethod();
                if(aOID != (CPKIFOID*)NULL && *aOID == *g_aiaCAIssuer)
                {
                    CPKIFGeneralNamePtr aGN = (*aPos)->AccessLocation();
                    genNames.push_back(aGN);
                }
            }
        }
    }
    else
    {
        CPKIFSubjectInfoAccessPtr sia;
        try
        {
            sia = cert.GetExtension<CPKIFSubjectInfoAccess>();
            if(sia == (CPKIFSubjectInfoAccess*)NULL)
                return;
        }
        catch(...)
        {
            //one of these extensions is busted.  just return
            return;
        }

        if(sia != (CPKIFSubjectInfoAccess*)NULL)
        {
            CPKIFAccessDescriptionListPtr adl = sia->GetAccessDescriptions();
            CPKIFAccessDescriptionList::iterator aPos;
            CPKIFAccessDescriptionList::iterator aEnd = adl->end();
            for(aPos = adl->begin(); aPos != aEnd; ++aPos)
            {
                CPKIFOIDPtr aOID = (*aPos)->AccessMethod();
                if(aOID != (CPKIFOID*)NULL && *aOID == *g_aiaCARepository)
                {
                    CPKIFGeneralNamePtr aGN = (*aPos)->AccessLocation();
                    genNames.push_back(aGN);
                }
            }
        }
    }

    CPKIFGeneralNameList::iterator gnPos;
    CPKIFGeneralNameList::iterator gnEnd = genNames.end();
    for(gnPos = genNames.begin(); gnPos != gnEnd; ++gnPos)
    {
        //in search of any URI entries.
        const char* url = (*gnPos)->uri();
        if(url != NULL)
        {
            std::string urlStr = url;
            if(0 == urlStr.find("ldap"))
            {
                //else try LDAP - if that fails just continue
                GetCertfromLDAPURL((char*)url, certsFromIAN, pbd);
            }
            else if(0 == urlStr.find("http"))
            {
                //if a URL entry if found grab the CRL
                RetrieveCertGivenHTTPURL(url, certsFromIAN);
            }
        }
    }

    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = certsFromIAN.end();
    for(pos = certsFromIAN.begin(); pos != end; ++pos)
    {
        GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
        gm.SetRHS(*pos);
        if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
        {
            (*pos)->SetSource(REMOTE);
            certNodeList.push_back(*pos);
        }
    }
}

void CPKIFCRLDPRetrieval::GetCRLs(
    const CPKIFCertificatePtr& cert,
    CPKIFCRLList& crlList,
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCRLDPRetrieval::GetCRLs(const CPKIFCertificatePtr& cert, CPKIFCRLList& crlList, PKIInfoSource source)", TOOLKIT_OCSP_CHECKER, 0, this);

    //don't respond to requests for locally stored CRLs
    if(LOCAL == source)
        return;

    //see if the cert has a CRL DP - if it does not the return
    CPKIFCRLDistributionPointsPtr crlDPs = cert->GetExtension<CPKIFCRLDistributionPoints>();
    if(crlDPs == (CPKIFCRLDistributionPoints*)NULL)
        return;

    //see if there are any DPs
    CPKIFCRLDistributionPointListPtr dps = crlDPs->DPs();
    if(dps == (CPKIFCRLDistributionPointList*)NULL)
        return;

    //iterate over the DPs
    CPKIFCRLDistributionPointList::iterator pos;
    CPKIFCRLDistributionPointList::iterator end = dps->end();
    for(pos = dps->begin(); pos != end; ++pos)
    {
        CPKIFDistributionPointNamePtr dp = (*pos)->DistributionPoint();
        if(dp != (CPKIFDistributionPointName*)NULL)
        {
            //get any full names...
            CPKIFGeneralNameList gns;
            dp->FullName(gns);
            
            //and iterate over them...
            CPKIFGeneralNameList::iterator gnPos;
            CPKIFGeneralNameList::iterator gnEnd = gns.end();
            for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
            {
                //in search of any URI entries.
                const char* url = (*gnPos)->uri();
                if(url != NULL)
                {
                    std::string urlStr = url;
                    if(0 == urlStr.find("http"))
                    {
                        //if a URL entry if found grab the CRL
                        RetrieveCRLGivenHTTPURL(url, crlList);
                    }
                    else
                    {
                        //else try LDAP - if that fails just continue
                        GetCRLfromLDAPURL(url, crlList);
                    }
                }
            }
        }

        //get any full names from crlIssuer (added 12/3/2003)
        CPKIFGeneralNameList gns;
        (*pos)->CRLIssuer(gns);
        
        //and iterate over them...
        CPKIFGeneralNameList::iterator gnPos;
        CPKIFGeneralNameList::iterator gnEnd = gns.end();
        for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
        {
            //in search of any URI entries.
            const char* url = (*gnPos)->uri();
            if(url != NULL)
            {
                std::string urlStr = url;
                if(0 == urlStr.find("http"))
                {
                    //if a URL entry if found grab the CRL
                    RetrieveCRLGivenHTTPURL(url, crlList);
                }
                else
                {
                    //else try LDAP - if that fails just continue
                    GetCRLfromLDAPURL(url, crlList);
                }
            }
        }

    }
}
void CPKIFCRLDPRetrieval::GetCRLSources(
    const CPKIFCertificatePtr& cert,
    CPKIFCrlSourceList& crlNodeList, 
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCRLDPRetrieval::GetCRLs(const CPKIFCertificatePtr& cert, CPKIFCRLList& crlList, PKIInfoSource source)", TOOLKIT_OCSP_CHECKER, 0, this);

    //don't respond to requests for locally stored CRLs
    if(LOCAL == source)
        return;

    //see if the cert has a CRL DP - if it does not the return
    CPKIFCRLDistributionPointsPtr crlDPs = cert->GetExtension<CPKIFCRLDistributionPoints>();
    if(crlDPs == (CPKIFCRLDistributionPoints*)NULL)
        return;

    //see if there are any DPs
    CPKIFCRLDistributionPointListPtr dps = crlDPs->DPs();
    if(dps == (CPKIFCRLDistributionPointList*)NULL)
        return;

    //iterate over the DPs
    CPKIFCRLDistributionPointList::iterator pos;
    CPKIFCRLDistributionPointList::iterator end = dps->end();
    for(pos = dps->begin(); pos != end; ++pos)
    {
        CPKIFDistributionPointNamePtr dp = (*pos)->DistributionPoint();
        if(dp != (CPKIFDistributionPointName*)NULL)
        {
            //get any full names...
            CPKIFGeneralNameList gns;
            dp->FullName(gns);
            
            //and iterate over them...
            CPKIFGeneralNameList::iterator gnPos;
            CPKIFGeneralNameList::iterator gnEnd = gns.end();
            for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
            {
                //in search of any URI entries.
                const char* url = (*gnPos)->uri();
                if(url != NULL)
                {
                    std::string urlStr = url;
                    if(0 == urlStr.find("http"))
                    {
                        if(!UriAlreadyInList(crlNodeList, urlStr))
                        {
                            CPKIFHttpCrlNodePtr httpCrlNode(new CPKIFHttpCrlNode);
                            httpCrlNode->AddSource(urlStr);
                            crlNodeList.push_back(httpCrlNode);
                        }
                    }
                    else if(0 == urlStr.find("ldap"))
                    {
                        if(!UriAlreadyInList(crlNodeList, urlStr))
                        {
                            CPKIFLdapCrlNodePtr ldapCrlNode(new CPKIFLdapCrlNode);
                            ldapCrlNode->AddSource(urlStr);
                            crlNodeList.push_back(ldapCrlNode);
                        }
                    }
                }
            }
        }

        //get any full names from crlIssuer (added 12/3/2003)
        CPKIFGeneralNameList gns;
        (*pos)->CRLIssuer(gns);
        
        //and iterate over them...
        CPKIFGeneralNameList::iterator gnPos;
        CPKIFGeneralNameList::iterator gnEnd = gns.end();
        for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
        {
            //in search of any URI entries.
            const char* url = (*gnPos)->uri();
            if(url != NULL)
            {
                std::string urlStr = url;
                if(0 == urlStr.find("http"))
                {
                    if(!UriAlreadyInList(crlNodeList, urlStr))
                    {
                        CPKIFHttpCrlNodePtr httpCrlNode(new CPKIFHttpCrlNode);
                        httpCrlNode->AddSource(urlStr);
                        crlNodeList.push_back(httpCrlNode);
                    }
                }
                else if(0 == urlStr.find("ldap"))
                {
                    if(!UriAlreadyInList(crlNodeList, urlStr))
                    {
                        CPKIFLdapCrlNodePtr ldapCrlNode(new CPKIFLdapCrlNode);
                        ldapCrlNode->AddSource(urlStr);
                        crlNodeList.push_back(ldapCrlNode);
                    }
                }
            }
        }

    }
}