PKIFScvpPathBuild.cpp

Go to the documentation of this file.

#include "PKIFScvpPathBuild.h"
#include "pkif.h"
#include "PKIFSCVP.h"
#include "private/SCVPUtils.h"
#include "private/ScvpState.h"
#include "PKIFCMS.h"

using namespace std;

struct CPKIFScvpPathBuildImpl
{
    bool m_bValidatedDpd;
};

CPKIFScvpPathBuild::CPKIFScvpPathBuild(void) : m_impl(new CPKIFScvpPathBuildImpl)
{
    m_impl->m_bValidatedDpd = false;
}

CPKIFScvpPathBuild::~CPKIFScvpPathBuild(void)
{
    if(m_impl)delete m_impl;
}

void CPKIFScvpPathBuild::Initialize()
{
}

void CPKIFScvpPathBuild::SetUseValidPkcPathCertCheck(bool b)
{
    m_impl->m_bValidatedDpd = b;
}

bool CPKIFScvpPathBuild::GetUseValidPkcPathCertCheck() const
{
    return m_impl->m_bValidatedDpd;
}

bool CPKIFScvpPathBuild::BuildPath(
    CPKIFCertificatePath& path)
{
    CPKIFCertificatePtr targetCert;
    path.GetTarget(targetCert);

    if(!targetCert || !CheckNamespaces(targetCert))
        return false;

    //prepare state - first check to see if state was passed in and if it belongs to us
    CPKIFCertificatePathStatePtr state;
    CPKIFScvpState* scvpState = NULL;
    path.GetState(state);

    //if there was state - see if we can cast it to a type that this builder uses
    //if(state != (CPKIFScvpState*)NULL)
    //  scvpState = dynamic_cast<CPKIFScvpState* >(&(*state));

    //if there was no state or the cast failed create a new state and put it in the path
    if(NULL == state)
    {
        //allocate the new state... (throw bad_alloc)
        scvpState = new CPKIFScvpState;     

        //store it in the path
        CPKIFCertificatePathStatePtr tmpState(scvpState);
        path.SetState(tmpState);
    }
    else
        return false;

    CPKIFCVRequestPtr cvr(new CPKIFCVRequest);  

    CPKIFQueryPtr query;
    
    if(!m_impl->m_bValidatedDpd)
        query = MakeQueryForPath(path, g_id_stc_build_pkc_path, this);
    else
        query = MakeQueryForPath(path, g_id_stc_build_valid_pkc_path, this);

    cvr->SetQuery(query);
    cvr->SetGenerateNonce(GetGenerateNonce());

    //declare variables that will be used to prepare a ContentInfo. 
    CPKIFBufferPtr contents = cvr->Encode();
    CPKIFOIDPtr contentType = g_id_ct_scvp_certValRequest;

    CPKIFCredentialPtr cred = GetSigningCredential();
    if(cred)
    {
        CPKIFSignedData sd;
        CPKIFEncapsulatedContentInfoPtr ecip(new CPKIFEncapsulatedContentInfo);
        ecip->SetOID(contentType);
        ecip->SetContent(contents);

        CPKIFSignerInfoPtr si(new CPKIFSignerInfo);
        si->SetCredential(cred);

        IPKIFScvpClient* thisAsScvpClient = dynamic_cast<IPKIFScvpClient*>(this);

        sd.SetEncapsulatedContent(ecip);
        IPKIFMediatorPtr tmpMed = thisAsScvpClient->GetMediator();
        sd.AddMediator(tmpMed);
        sd.AddSignerInfo(si);
        CPKIFCertificatePtr tmpCert = cred->GetCertificate();
        sd.AddCertificate(tmpCert);

        contents = sd.Encode();

        contentType = g_signedData;
    }

    CPKIFContentInfo ci;
    ci.SetContent(contents);
    ci.SetContentType(contentType);

    CPKIFBufferPtr encRequest = ci.Encode();
    CPKIFBufferPtr resp;
    const char* url = GetResponderUrl();
    if(PostRequestURL(encRequest, resp, url, PKIF_SCVP)) 
    {
        CPKIFCVResponsePtr parsedResponse;

        //VerifyResponseSignature parses the response, checks the status, checks the nonce (if necessary) 
        //and verifies the signature (if necessary)
        if(!VerifyResponseSignature(resp, this, cvr, true, parsedResponse))
        {
            //if everything checked by VerifyResponseSignature checks out, proceed by getting
            //the list of replyObjects
            CPKIFCertReplyListPtr replyObjects;
            parsedResponse->GetReplyObjects(replyObjects);

            //get the target cert from the path so we can find the correct reply object
            CPKIFCertificatePtr targetCert;
            path.GetTarget(targetCert);
            
            CPKIFCertReplyPtr replyObject = GetReplyObject(replyObjects, targetCert);
            if(replyObject)
            {
                //we found a reply object, get its status.  this will determine what sort of processing is required
                int replyStatus = replyObject->GetReplyStatus();
                if(0 == replyStatus)
                {
                    //sanity check the replyChecks and the valErrors.  the former should be all
                    //successful and the latter should be absent.
                    if(!MakeSureReplyChecksAreSuccessfulAndValErrorsAreAbsent(replyObject))
                        return false; //this response was busted, ignore it and let next colleague take a shot
                }

                //collect information from the wantBacks (the spec indicates these will only be in 
                //successful replies, but....
                CPKIFReplyWantBackListPtr replyWantBackList;
                replyObject->GetReplyWantBacks(replyWantBackList);

                CPKIFReplyWantBack_ExtDataHandlerPtr emptyWantBacks;
                SetWantBacksFromResponse(emptyWantBacks);
                if(replyWantBackList)
                {
                    //There are only two types of wantBacks that we support: best cert path and revocation info.
                    //The revocation info type needs to be processed first.  Thus, collect these two below and process
                    //them after both are in hand.
                    CPKIFBufferPtr bestCertPathWB, revInfoWB;

                    CPKIFReplyWantBack_ExtDataHandlerPtr edh(new CPKIFReplyWantBack_ExtDataHandler);
                    edh->m_scvpResponder = GetResponderUrl();

                    CPKIFReplyWantBackList::iterator pos;
                    CPKIFReplyWantBackList::iterator end = replyWantBackList->end();
                    for(pos = replyWantBackList->begin(); pos != end; ++pos)
                    {
                        std::pair<CPKIFReplyWantBackPtr, vector<SeqResultsPtr> > pair;
                        pair.first = *pos;
                        edh->m_wantBacks.push_back(pair);

                        CPKIFOIDPtr posOid = (*pos)->GetWB();
                        if(*g_id_swb_pkc_best_cert_path == *posOid)
                        {
                            bestCertPathWB = (*pos)->GetValue();
                        }
                        else if(*g_id_swb_pkc_revocation_info == *posOid)
                        {
                            revInfoWB = (*pos)->GetValue();
                        }
                        else if(*g_id_swb_pkc_public_key_info == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_relayed_responses == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_cert == *posOid)
                        {
                            //Not supported (don't need since this API always passed in the cert)
                        }
                        else if(*g_id_swb_pkc_all_cert_paths == *posOid)
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_ee_revocation_info == *posOid) 
                        {
                            //Not supported
                        }
                        else if(*g_id_swb_pkc_CAs_revocation_info == *posOid)
                        {
                            //Not supported
                        }
                    }

                    if(!edh->m_wantBacks.empty())
                    {
                        SetWantBacksFromResponse(edh);
                    }

                    if(revInfoWB)
                    {
                        StickCrlsFromWantBackInCrlStore(revInfoWB, this, this);
                    }

                    if(bestCertPathWB)
                    {
                        return CertPathWantBackToResultsAndStoresForDpd(bestCertPathWB, revInfoWB, path, this, this);
                    }
                }
            }//if(replyObject)                                                  - If any of these three fail, return false
        }//if(!VerifyResponseSignature(resp, this, cvr, false, parsedResponse)) - and let next colleague try to fulfill
    }//if(PostRequestURL(encRequest, resp, url, PKIF_SCVP))                     - the request.

    return false;
}