PKIFNSSRepository.cpp

Go to the documentation of this file.

#include "PKIFNSSRepository.h"
#include "PKIFNSSHelper.h"

#include "PKIFNSSDatabase.h"
#include "PKIFNSSErrors.h"
#include "ToolkitUtils.h"
#include "components.h"
#include "PKIFCacheErrors.h"
#include "Buffer.h"
#include "Certificate.h"
#include "CRL.h"
#include "Name.h"
#include "PKIFTrustRoot.h"
#include "PKIFCacheException.h"
#include "GottaMatch.h"

#include "IPKIFSearchCriteria.h"
#include "KeyIDBasedSearch.h"
#include "NameBasedSearch.h"
#include "IssuerNameAndSerialNumberBasedSearch.h"

#include "PKIFNSSConfig.h"

#include "boost/numeric/conversion/cast.hpp"
#include "boost/numeric/conversion/bounds.hpp"
#include "boost/limits.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;

#include <sstream>
using namespace std;

struct PKIFNSSRepositoryImpl
{
    CERTCertDBHandle * m_certDbHandle;
    CPKIFNSSDatabase * m_db;
};

// throws if this is a different database than the one that's open
CPKIFNSSRepository::CPKIFNSSRepository(
    const std::string & dbdir)
:m_impl(new PKIFNSSRepositoryImpl)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    m_impl->m_certDbHandle = 0;
    m_impl->m_db = 0;
    // since it doesn't make since in SR to use NSS without a DB,
    // if no dbdir is specified, we'll use what's open already
    if(dbdir == "") {
        m_impl->m_db = CPKIFNSSDatabase::GetInstance();
    } else {
        // this will throw if the database has already been opened
        // with a diferent directory, as we can only have one open
        // at a time
        m_impl->m_db = CPKIFNSSDatabase::GetInstance(dbdir);
    }
}
CPKIFNSSRepository::~CPKIFNSSRepository(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    PKIFDelete(m_impl);
    m_impl = 0;
}
void CPKIFNSSRepository::GetCertificates(
    const CPKIFNamePtr& subDN, 
    CPKIFCertificateList& certList, 
    PKIInfoSource source)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    if(0 == m_impl->m_certDbHandle)
    {
        RAISE_CACHE_EXCEPTION("CPKIFNSSRepository instance not initialized.", thisComponent, COMMON_NOT_INITIALIZED, this)
    }
    if(source == REMOTE) return;
    CERTCertList *certs = 0;
    SECItem nameItem;
    nameItem.type = siBuffer;
    
    CPKIFBufferPtr encName = subDN->Encoded();
    nameItem.data = (unsigned char *)encName->GetBuffer();
    nameItem.len = encName->GetLength();
    
    // get all certs in the NSS database with the specified subject name
    certs = CERT_CreateSubjectCertList(0,m_impl->m_certDbHandle,&nameItem,
        PR_Now(),PR_FALSE);

    // fast search failed. try the slow search
#if 0
    if(!certs) {
        CERTCertificate * found = CERT_FindCertByNameString(m_impl->m_certDbHandle,subDN->string());
        if(found) {
            certs = CERT_CertListFromCert(found);
        }
    }
#endif

    if(!certs) {
        return;
    }

    CERTCertListNode *node = CERT_LIST_HEAD(certs);
    while(!CERT_LIST_END(node,certs)) {
        CERTCertificate * foundCert = node->cert;
        CPKIFCertificatePtr tmpCert(new CPKIFCertificate());
        try {
            tmpCert->Decode(foundCert->derCert.data, foundCert->derCert.len);
        }catch(CPKIFException &){
            //ignore parse failure
            std::ostringstream os;
            os << "Failed to parse certificate from NSS store searching for certificates issued to: " << subDN->ToString();
            LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this);
        }
        GottaMatch<CPKIFCertificatePtr> gm;
        gm.SetRHS(tmpCert);
        if(certList.end() == find_if(certList.begin(), certList.end(), gm)) {
            certList.push_back(tmpCert);
        }
        node = CERT_LIST_NEXT(node);
    }
    CERT_DestroyCertList(certs);
}
void CPKIFNSSRepository::GetCRLs(
    const CPKIFCertificatePtr& cert, 
    CPKIFCRLList& crlList, 
    PKIInfoSource source)
{
    // as far as I can tell, NSS is only going to give out one CRL
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    if(0 == m_impl->m_certDbHandle)
    {
        RAISE_CACHE_EXCEPTION("CPKIFNSSRepository instance not initialized.", thisComponent, COMMON_NOT_INITIALIZED, this)
    }
    if(source == REMOTE) return;
    // even though NSS exports the appealingly named SEC_FindCrlByDERCert, I don't believe
    // anyone uses that and it looks like despite the name it might not work the way it
    // sounds like it should. NSS uses the issuer name as the db key anyway...
    CERTSignedCrl *crl = 0;
    SECItem derIssName;
    CPKIFBufferPtr tmpIssName = cert->Issuer()->Encoded();
    derIssName.type = siBuffer;
    derIssName.data = (unsigned char *)tmpIssName->GetBuffer();
    derIssName.len = tmpIssName->GetLength();
    crl  = SEC_FindCrlByName(m_impl->m_certDbHandle,&derIssName,SEC_CRL_TYPE);
    if(!crl) {
        return;
    }
    CPKIFCRLPtr tmpCRL(new CPKIFCRL());
    try {
        tmpCRL->Decode(crl->derCrl->data,crl->derCrl->len);
    }catch(CPKIFException &){
            std::ostringstream os;
            os << "Failed to parse CRL from NSS store searching for CRLs issued for: " << cert->Issuer()->ToString();
            LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this);
    }
    SEC_DestroyCrl(crl);
    GottaMatch<CPKIFCRLPtr> gm;
    gm.SetRHS(tmpCRL);
    if(crlList.end() == find_if(crlList.begin(), crlList.end(), gm)) {
        crlList.push_back(tmpCRL);
    }
}
void CPKIFNSSRepository::Initialize(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    if(!CPKIFNSSHelper::NSSAvaliable()) {
        RAISE_CACHE_EXCEPTION("NSS could not be loaded.",thisComponent,PKIFNSS_INIT_FAILED,this);
    }
    m_impl->m_certDbHandle = CERT_GetDefaultCertDB();
}


void CPKIFNSSRepository::FindCertificates(
    IPKIFSearchCriteria* searchCriteria,
    CPKIFCertificateList& certList,
    PKIInfoSource source)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSREPOSITORY,0,this);
    if(0 == m_impl->m_certDbHandle)
    {
        RAISE_CACHE_EXCEPTION("CPKIFNSSRepository instance not initialized.", thisComponent, COMMON_NOT_INITIALIZED, this)
    }
    if(source == REMOTE) return;
    CERTCertificate * found = 0;
    SECItem nameItem;


    switch(searchCriteria->GetSearchType())
    {
    case ALLCERTS:
        break;
    case ISSUERNAME:
        break;
    case SUBJECTNAME:
        {
            nameItem.type = siBuffer;

            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);
            CPKIFBufferPtr encName = nbs->GetName()->Encoded();
            nameItem.data = (unsigned char *)encName->GetBuffer();
            nameItem.len = encName->GetLength();
            if(0 != nameItem.data)
            {   
                found = CERT_FindCertByName(m_impl->m_certDbHandle,&nameItem);

            }
            else
                return;
        }
        break;
    case ISSUERSERIAL:
        {
            CERTIssuerAndSN issuerSN;
            CPKIFIssuerNameAndSerialNumberBasedSearch* inasnbs = dynamic_cast<CPKIFIssuerNameAndSerialNumberBasedSearch*>(searchCriteria);
            CPKIFNamePtr issuerName = inasnbs->GetIssuerName();
            CPKIFBufferPtr encName = issuerName->Encoded();
            issuerSN.derIssuer.data = (unsigned char *)encName->GetBuffer();
            issuerSN.derIssuer.len = encName->GetLength();
            issuerSN.derIssuer.type = siBuffer;

            const char* sn = inasnbs->GetSerialNumber();

            size_t len = strlen(sn) - 2;
            unsigned int iLen = 0;
            if(len > boost::numeric::bounds<unsigned int>::highest())
            {
                throw CPKIFCacheException(TOOLKIT_SR_CAPIUSERREPOSITORY, COMMON_INVALID_INPUT, "Serial number too big.");
            }
            else
                iLen = numeric_cast<unsigned int>(len);

            unsigned char* binSN = new unsigned char[iLen];
            atob((char*)binSN, (char*)sn+2, &iLen);
            //ReverseBytes(binSN, iLen);
            issuerSN.serialNumber.data = binSN;
            issuerSN.serialNumber.len = iLen;
            issuerSN.serialNumber.type = siBuffer;


            if(0 != issuerSN.serialNumber.data && issuerSN.derIssuer.data)
            {   
                found = CERT_FindCertByIssuerAndSN(m_impl->m_certDbHandle,&issuerSN);
            }
            else
                return;
            break;
        }
    case KEYID:
        {
            CPKIFKeyIDBasedSearch* kidbs = dynamic_cast<CPKIFKeyIDBasedSearch*>(searchCriteria);
            if(!kidbs)
                return;

            CPKIFBufferPtr kid = kidbs->GetKeyID();
            nameItem.data = (unsigned char *)kid->GetBuffer();
            nameItem.len = kid->GetLength();
            if(0 != nameItem.data)
            {   
                found = CERT_FindCertBySubjectKeyID(m_impl->m_certDbHandle,&nameItem);

            }
            else
                return;
            break;
        }
    default:
        return;
    };

    if(!found) {
        return;
    }


    CPKIFCertificatePtr tmpCert(new CPKIFCertificate());
    try {
        tmpCert->Decode(found->derCert.data, found->derCert.len);
    }catch(CPKIFException &){
        //ignore parse failure
        std::ostringstream os;
        os << "Failed to parse certificate from NSS store.";
        LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this);
    }
    GottaMatch<CPKIFCertificatePtr> gm;
    gm.SetRHS(tmpCert);
    if(certList.end() == find_if(certList.begin(), certList.end(), gm)) {
        certList.push_back(tmpCert);
    }
}