PKIFNSSTrustStore.cpp

Go to the documentation of this file.

#include "PKIFNSSTrustStore.h"

#include "PKIFNSSDatabase.h"
#include "ToolkitUtils.h"
#include "components.h"
#include "PKIFCacheErrors.h"
#include "Buffer.h"
#include "Certificate.h"
#include "Name.h"
#include "PKIFTrustRoot.h"
#include "PKIFCacheException.h"

#include "PKIFNSSConfig.h"

#include <sstream>
using namespace std;

struct PKIFNSSTrustStoreImpl
{
    CERTCertDBHandle * m_certDbHandle;
    CPKIFNSSDatabase * m_db;
};

CPKIFNSSTrustStore::CPKIFNSSTrustStore(const std::string & dbdir)
:m_impl(new PKIFNSSTrustStoreImpl)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSTRUSTSTORE,0,this);
    m_impl->m_certDbHandle = 0;
    m_impl->m_db = 0;
    // since it doesn't make since in SR to use NSS without a DB,
    // if no dbdir is specified, we'll use what's open already
    if(dbdir == "") {
        m_impl->m_db = CPKIFNSSDatabase::GetInstance();
    } else {
        // this will throw if the database has already been opened
        // with a diferent directory, as we can only have one open
        // at a time
        m_impl->m_db = CPKIFNSSDatabase::GetInstance(dbdir);
    }
}
CPKIFNSSTrustStore::~CPKIFNSSTrustStore(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSTRUSTSTORE,0,this);
    PKIFDelete(m_impl);
    m_impl = 0;
}

bool CPKIFNSSTrustStore::GetTrustRoots(const CPKIFNamePtr& subDN, IPKIFTrustAnchorList& root)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSTRUSTSTORE,0,this);
    if(0 == m_impl->m_certDbHandle)
    {
        RAISE_CACHE_EXCEPTION("CPKIFNSSTrustStore instance not initialized.", thisComponent, COMMON_NOT_INITIALIZED, this)
    }

    const size_t origSize = root.size();
    CERTCertList *certs = 0;
    SECItem nameItem;
    nameItem.type = siBuffer;
    
    CPKIFBufferPtr encName = subDN->Encoded();
    nameItem.data = (unsigned char *)encName->GetBuffer();
    nameItem.len = encName->GetLength();
    
    // get all certs in the NSS database with the specified subject name
    certs = CERT_CreateSubjectCertList(0,m_impl->m_certDbHandle,&nameItem,
        PR_Now(),PR_FALSE);

    if(!certs) {
        return false;
    }

    CERTCertListNode *node = CERT_LIST_HEAD(certs);
    while(!CERT_LIST_END(node,certs)) {
        CERTCertificate * foundCert = node->cert;
        CERTCertTrust nssTrust;
        memset(&nssTrust,0x00,sizeof(CERTCertTrust));
        SECStatus rv = CERT_GetCertTrust(foundCert,&nssTrust);
        if(SECSuccess != rv) {
            ostringstream os;
            os << "NSS Trust store colleague: Unable to read NSS trust status for certificate issued to ";
            os << subDN->ToString();
            LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_ENTRY_BAD, this);
        }
        // if the cert has been marked trusted, return it.
        // we make no application-based distinction here, so the different classes
        // of trust are irrelevant to us
        if( (nssTrust.emailFlags & CERTDB_TRUSTED_CA) ||
            (nssTrust.objectSigningFlags & CERTDB_TRUSTED_CA) ||
            (nssTrust.sslFlags & CERTDB_TRUSTED_CA)
            )
        {
            CPKIFCertificatePtr tmpCert(new CPKIFCertificate());
            try {
                tmpCert->Decode(foundCert->derCert.data, foundCert->derCert.len);
            }catch(CPKIFException &){
                //ignore parse failure
                std::ostringstream os;
                os << "Failed to parse certificate from NSS store searching for certificates issued to: " << subDN->ToString();
                LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this);
            }
            CPKIFTrustRootPtr tmpRoot(new CPKIFTrustRoot());
            tmpRoot->SetCert(tmpCert);
            root.push_back(tmpRoot);
        }
        node = CERT_LIST_NEXT(node);
    }
    CERT_DestroyCertList(certs);
    // return true if we've added to the list
    return (origSize != root.size());
}
void CPKIFNSSTrustStore::Initialize(void)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_SR_NSSTRUSTSTORE,0,this);
    m_impl->m_certDbHandle = CERT_GetDefaultCertDB();
}