PKIFScvpPathBuildAndValidate.cpp

Go to the documentation of this file.

#include "PKIFScvpPathBuildAndValidate.h"
#include "pkif.h"
#include "PKIFSCVP.h"
#include "private/SCVPUtils.h"
#include "PKIFCMS.h"
#include "PKIFERS.h"

#include "IPKIFExtHandlerData.h"

using namespace std;

struct CPKIFScvpPathBuildAndValidateImpl
{
};

CPKIFScvpPathBuildAndValidate::CPKIFScvpPathBuildAndValidate(void)
{
}

CPKIFScvpPathBuildAndValidate::~CPKIFScvpPathBuildAndValidate(void)
{
}

void CPKIFScvpPathBuildAndValidate::Initialize()
{
}

bool CPKIFScvpPathBuildAndValidate::BuildAndValidatePath(
    CPKIFCertificatePath& path,
    CPKIFPathValidationResults& results)
{
    CPKIFCertificatePtr targetCert;
    path.GetTarget(targetCert);

    if(!targetCert || !CheckNamespaces(targetCert))
        return false;

    CPKIFCVRequestPtr cvr(new CPKIFCVRequest);  

    CPKIFQueryPtr query = MakeQueryForPath(path, g_id_stc_build_status_checked_pkc_path, this);

    cvr->SetQuery(query);
    cvr->SetGenerateNonce(GetGenerateNonce());

    //declare variables that will be used to prepare a ContentInfo. 
    CPKIFBufferPtr contents = cvr->Encode();
    CPKIFOIDPtr contentType = g_id_ct_scvp_certValRequest;

    CPKIFCredentialPtr cred = GetSigningCredential();
    if(cred)
    {
        CPKIFSignedData sd;
        CPKIFEncapsulatedContentInfoPtr ecip(new CPKIFEncapsulatedContentInfo);
        ecip->SetOID(contentType);
        ecip->SetContent(contents);

        CPKIFSignerInfoPtr si(new CPKIFSignerInfo);
        si->SetCredential(cred);

        IPKIFScvpClient* thisAsScvpClient = dynamic_cast<IPKIFScvpClient*>(this);

        sd.SetEncapsulatedContent(ecip);
        IPKIFMediatorPtr tmpMed = thisAsScvpClient->GetMediator();
        sd.AddMediator(tmpMed);
        sd.AddSignerInfo(si);
        CPKIFCertificatePtr tmpCert = cred->GetCertificate();
        sd.AddCertificate(tmpCert);

        contents = sd.Encode();

        contentType = g_signedData;
    }

    CPKIFContentInfo ci;
    ci.SetContent(contents);
    ci.SetContentType(contentType);

    CPKIFBufferPtr encRequest = ci.Encode();
    CPKIFBufferPtr resp;
    const char* url = GetResponderUrl();
    if(PostRequestURL(encRequest, resp, url, PKIF_SCVP))
    {
        CPKIFCVResponsePtr parsedResponse;

        //VerifyResponseSignature parses the response, checks the status, checks the nonce (if necessary) 
        //and verifies the signature (if necessary)
        if(!VerifyResponseSignature(resp, this, cvr, false, parsedResponse))
        {
            //if everything checked by VerifyResponseSignature checks out, proceed by getting
            //the list of replyObjects
            CPKIFCertReplyListPtr replyObjects;
            parsedResponse->GetReplyObjects(replyObjects);

            //get the target cert from the path so we can find the correct reply object
            CPKIFCertificatePtr targetCert;
            path.GetTarget(targetCert);
            
            CPKIFCertReplyPtr replyObject = GetReplyObject(replyObjects, targetCert);
            if(replyObject)
            {
                //we found a reply object, get its status.  this will determine what sort of processing is required
                int replyStatus = replyObject->GetReplyStatus();
                if(0 == replyStatus)
                {
                    //sanity check the replyChecks and the valErrors.  the former should be all
                    //successful and the latter should be absent.
                    if(!MakeSureReplyChecksAreSuccessfulAndValErrorsAreAbsent(replyObject))
                        return false; //this response was busted, ignore it and let next colleague take a shot

                    //the response status indicates success
                    results.SetBasicChecksSuccessfullyPerformed(true);
                    results.SetCertSignaturesVerified(true);
                    results.SetRevocationStatusMostSevere(NOT_REVOKED);
                }
                else
                {
                    results.SetBasicChecksSuccessfullyPerformed(false);
                    results.SetCertSignaturesVerified(false);
                    results.SetRevocationStatusMostSevere(NOT_CHECKED);

                    //need to step through the replyChecks
                    CPKIFReplyCheckListPtr replyChecks;
                    replyObject->GetReplyChecks(replyChecks);

                    if(replyChecks)
                    {
                        CPKIFReplyCheckList::iterator rcPos;
                        CPKIFReplyCheckList::iterator rcEnd = replyChecks->end();
                        for(rcPos = replyChecks->begin(); rcPos != rcEnd; ++rcPos)
                        {
                            CPKIFOIDPtr rcPosOid = (*rcPos)->GetCheck();
                            int rcPosStatus = (*rcPos)->GetStatus();
                            if(*g_id_stc_build_pkc_path == *rcPosOid)
                            {
                                //expect the status to be 1, but don't need to do anything in this case
                            }
                            else if(*g_id_stc_build_valid_pkc_path == *rcPosOid)
                            {
                                //expect the status to be 1, but don't need to do anything in this case
                            }
                            else if(*g_id_stc_build_status_checked_pkc_path == *rcPosOid)
                            {
                                //if the status is greater than 1, then a valid path was found but the revocation
                                //info was not available for one reason or another
                                if(1 < rcPosStatus)
                                {
                                    results.SetBasicChecksSuccessfullyPerformed(true);
                                    results.SetCertSignaturesVerified(true);
                                }
                            }
                        }
                    }

                    //get validation errors (though without a wantBack we don't have anywhere good to put them)
                    CPKIFOIDListPtr valErrors;
                    replyObject->GetValErrors(valErrors);
                    if(valErrors)
                    {
                        CPKIFOIDList::iterator vePos;
                        CPKIFOIDList::iterator veEnd = valErrors->end();
                        for(vePos = valErrors->begin(); vePos != veEnd; ++vePos)
                        {                           
                            if(*g_id_bvae_expired == *vePos)
                            {
                            }
                            else if(*g_id_bvae_not_yet_valid == *vePos)
                            {
                            }
                            else if(*g_id_bvae_wrongTrustAnchor == *vePos)
                            {
                            }
                            else if(*g_id_bvae_noValidCertPath == *vePos)
                            {
                            }
                            else if(*g_id_bvae_revocked == *vePos)
                            {
                            }
                            else if(*g_id_bvae_invalidKeyPurpose == *vePos)
                            {
                            }
                            else if(*g_id_bvae_invalidKeyUsage == *vePos)
                            {
                            }
                            else if(*g_id_bvae_invalidKeyCertPolicy == *vePos)
                            {
                            }
                        }
                    }
                }// else (corresponding to if(0 == replyStatus))

                //collect information from the wantBacks (the spec indicates these will only be in 
                //successful replies, but....
                CPKIFReplyWantBackListPtr replyWantBackList;
                replyObject->GetReplyWantBacks(replyWantBackList);

                CPKIFReplyWantBack_ExtDataHandlerPtr emptyWantBacks;
                SetWantBacksFromResponse(emptyWantBacks);
                if(replyWantBackList)
                {
                    //There are only two types of wantBacks that we support: best cert path and revocation info.
                    //The revocation info type needs to be processed first.  Thus, collect these two below and process
                    //them after both are in hand.
                    CPKIFBufferPtr bestCertPathWB, revInfoWB, partialPathWB;
                    CPKIFBufferPtr bestCertPathWB_ER, revInfoWB_ER, partialPathWB_ER, pkcCertWB_ER, ersAllWB_ER;                    

                    CPKIFReplyWantBack_ExtDataHandlerPtr edh(new CPKIFReplyWantBack_ExtDataHandler);
                    edh->m_scvpResponder = GetResponderUrl();

                    CPKIFReplyWantBackList::iterator pos;
                    CPKIFReplyWantBackList::iterator end = replyWantBackList->end();
                    for(pos = replyWantBackList->begin(); pos != end; ++pos)
                    {
                        std::pair<CPKIFReplyWantBackPtr, vector<SeqResultsPtr> > pair;
                        pair.first = *pos;
                        edh->m_wantBacks.push_back(pair);

                        CPKIFOIDPtr posOid = (*pos)->GetWB();
                        if(*g_id_swb_pkc_best_cert_path == *posOid)
                        {
                            bestCertPathWB = (*pos)->GetValue();
                        }
                        else if(*g_id_swb_pkc_revocation_info == *posOid)
                        {
                            revInfoWB = (*pos)->GetValue();
                        }
                        else if(*g_id_swb_pkc_public_key_info == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_relayed_responses == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_all_cert_paths == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_ee_revocation_info == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_CAs_revocation_info == *posOid)
                        {
                            //Not supported                         
                        }
                        else if(*g_idSwbPartialCertPath == *posOid)
                        {
                            partialPathWB = (*pos)->GetValue();
                        }
                        else if(*g_idSwbErsPkcCert == *posOid)
                        {
                            pkcCertWB_ER = (*pos)->GetValue();
                        }
                        else if(*g_idSwbErsBestCertPath == *posOid)
                        {
                            bestCertPathWB_ER = (*pos)->GetValue();
                        }
                        else if(*g_idSwbErsPartialCertPath == *posOid)
                        {
                            partialPathWB_ER = (*pos)->GetValue();
                        }
                        else if(*g_idSwbErsRevocationInfo == *posOid)
                        {
                            revInfoWB_ER = (*pos)->GetValue();
                        }
                        else if(*g_idSwbErsAll == *posOid)
                        {
                            ersAllWB_ER = (*pos)->GetValue();
                        }
                    }

                    if(!edh->m_wantBacks.empty())
                    {
                        IPKIFExtHandlerDataPtr iEdh = boost::dynamic_pointer_cast<IPKIFExtHandlerData, CPKIFReplyWantBack_ExtDataHandler>(edh);
                        results.SetExtHandlerData("PKIFSCVP_WantBacks", iEdh);

                        SetWantBacksFromResponse(edh);
                    }

                    if(bestCertPathWB && bestCertPathWB_ER)
                    {
                        VerifyCertPathWB_ER(bestCertPathWB, bestCertPathWB_ER, path, this);
                    }
                    if(partialPathWB && partialPathWB_ER)
                    {
                        VerifyPartialPathWB_ER(partialPathWB, partialPathWB_ER, path, this);
                    }
                    if(revInfoWB && revInfoWB_ER)
                    {
                        VerifyRevInfoWB_ER(revInfoWB, revInfoWB_ER, path, this);
                    }
                    if(pkcCertWB_ER)
                    {
                        CPKIFCertificatePtr targetCertWB;
                        CPKIFCertReferencePtr certRef = replyObject->GetCertRef();
                        if(CERTREFERENCES_PKC == certRef->GetCertRefType())
                        {
                            CPKIFPKCReferencePtr pkcCertRef = certRef->GetPKC();
                            if(REFERENCETYPE_CERT == pkcCertRef->GetRefType())
                                targetCertWB = pkcCertRef->GetCert();
                        }

                        if(targetCertWB)
                            VerifyPKCCertWB_ER(targetCertWB, pkcCertWB_ER, path, this);
                    }

                    if(bestCertPathWB)
                    {
                        CertPathWantBackToResultsAndStores(bestCertPathWB, revInfoWB, path, this, results, this);
                        IPKIFTrustAnchorPtr ta;
                        path.GetTrustRoot(ta);
                        if(ta)
                        {
                            results.SetTrustAnchor(ta);
                        }
                    }
                }
                return true;
            }//if(replyObject)                                                  - If any of these three fail, return false
        }//if(!VerifyResponseSignature(resp, this, cvr, false, parsedResponse)) - and let next colleague try to fulfill
    }//if(PostRequestURL(encRequest, resp, url, PKIF_SCVP))                     - the request.

    return false;
}