PKIFXSECKeyInfoResolver.cpp

Go to the documentation of this file.

#include "PKIFXSECKeyInfoResolver.h"
#include "PKIFXSECCrypto.h"
#include "PKIFXSECCryptoX509.h"
#include "PKIFXSECCryptoKeyDSA.h"
#include "PKIFXSECCryptoKeyRSA.h"

#include <xsec/dsig/DSIGKeyInfoX509.hpp>
#include <xsec/enc/XSCrypt/XSCryptCryptoBase64.hpp>
#include <xsec/enc/XSECCryptoException.hpp>
#include <xsec/enc/XSECCryptoUtils.hpp>
#include <xsec/framework/XSECError.hpp>

#include <xercesc/util/Janitor.hpp>
XERCES_CPP_NAMESPACE_USE;

struct PKIFXSECKeyInfoResolverImpl
{
    IPKIFMediatorPtr m_med;
    CPKIFPathSettingsPtr m_ps;
    CPKIFFuncStoragePtr m_checker;
    IPKIFXSECNotificationCallback * m_cb;
    CPKIFCertificatePathPtr m_lastPath;
    CPKIFPathValidationResultsPtr m_lastPVR;
};

// These need to be defined explicitly.

IPKIFXSECNotificationCallback::IPKIFXSECNotificationCallback() {}
IPKIFXSECNotificationCallback::~IPKIFXSECNotificationCallback() {}

void xmlKeyUsageChecker_Any(
    const CPKIFCertificateNodeEntryPtr& certNode,
    CPKIFPathValidationResults& results,
    CertificateType type)
{
    if(EE == type)
    {
        CPKIFCertificatePtr curCert = certNode->GetCert();
        CPKIFKeyUsagePtr keyUsage = curCert->GetExtension<CPKIFKeyUsage>();
        if(keyUsage != (CPKIFKeyUsage*)NULL)
        {
            CPKIFX509ExtensionPtr keyUsage2 = keyUsage;
            certNode->MarkExtensionAsProcessed(keyUsage2);
        }
    }
}


PKIFXSECKeyInfoResolver::PKIFXSECKeyInfoResolver(
    IPKIFMediatorPtr & med,
    CPKIFPathSettingsPtr & ps,
    CPKIFFuncStoragePtr & kuChecker
    )
:m_impl(new PKIFXSECKeyInfoResolverImpl())
{
    m_impl->m_med = med;
    m_impl->m_ps = ps;
    m_impl->m_checker = kuChecker;
    m_impl->m_cb = 0;
}

PKIFXSECKeyInfoResolver::~PKIFXSECKeyInfoResolver()
{
    if(m_impl) {
        delete m_impl;
        m_impl = 0;
    }
}

XSECCryptoKey * PKIFXSECKeyInfoResolver::resolveKey(
    DSIGKeyInfoList * lst)
{
    XSECCryptoKey * ret = 0;

    IPKIFPathBuild * pb = m_impl->m_med->GetMediator<IPKIFPathBuild>();
    IPKIFPathValidate * pv = m_impl->m_med->GetMediator<IPKIFPathValidate>();
    if(!m_impl->m_checker) {
        m_impl->m_checker = CPKIFFuncStoragePtr(new CPKIFFuncStorage(xmlKeyUsageChecker_Any));
    }
    
    if(!pb || !pv) return 0;

    DSIGKeyInfoList::size_type sz = lst->getSize();

    for (DSIGKeyInfoList::size_type i = 0; i < sz; ++i) {

        switch (lst->item(i)->getKeyInfoType()) {
                case (DSIGKeyInfo::KEYINFO_X509) :
                {
                    ret = NULL;
                    const XMLCh * x509Str;

                    // this is just being used as a convenient way to get the certificate into
                    // the right format
                    PKIFXSECCryptoX509 * x509 = new PKIFXSECCryptoX509();
                    x509->SetMediator(m_impl->m_med);
                    Janitor<PKIFXSECCryptoX509> j_x509(x509);
                    // get the base64-encoded certificate
                    x509Str = ((DSIGKeyInfoX509 *) lst->item(i))->getCertificateItem(0);
                    if (x509Str != 0) {
                        safeBuffer transX509(XMLString::transcode(x509Str));
                        // decode it
                        x509->loadX509Base64Bin(transX509.rawCharBuffer(), (unsigned int) strlen(transX509.rawCharBuffer()));
                        // get the DER back
                        transX509 = x509->getDEREncodingSB();

                        // now build and validate the path
                        CPKIFCertificatePtr cert(new CPKIFCertificate());
                        cert->Decode(transX509.rawBuffer(), transX509.sbRawBufferSize());
                        CPKIFPathValidationResultsPtr emptyres;
                        m_impl->m_lastPVR = emptyres;
                        m_impl->m_lastPath = CPKIFCertificatePathPtr(new CPKIFCertificatePath());
                        m_impl->m_lastPath->SetTarget(cert);
                        
                        if(m_impl->m_ps) m_impl->m_lastPath->SetPathSettings(m_impl->m_ps);
                        bool goodCert = false;
                        while(pb->BuildPath(*m_impl->m_lastPath) && !goodCert) {
                            m_impl->m_lastPVR = CPKIFPathValidationResultsPtr(new CPKIFPathValidationResults());
                            if(pv->ValidatePath(*m_impl->m_lastPath,*m_impl->m_lastPVR,m_impl->m_checker))
                            {
                                CPKIFPathSettingsPtr tmpPS;
                                m_impl->m_lastPath->GetPathSettings(tmpPS);
                                if(tmpPS->GetCheckRevocationStatus()) {
                                    // if the caller wanted revocation status make sure it's not revoked
                                    if(NOT_REVOKED != m_impl->m_lastPVR->GetRevocationStatusMostSevere()) break;
                                } else {
                                    // else just make sure there was no REVOKED result and the path is otherwise
                                    // valid
                                    if(NOT_CHECKED > m_impl->m_lastPVR->GetRevocationStatusMostSevere()) break;
                                    if(!m_impl->m_lastPVR->GetBasicChecksSuccessfullyPerformed() || 
                                        !m_impl->m_lastPVR->GetCertSignaturesVerified()) break;
                                }
                                // if we haven't broken out by now, it's good
                                goodCert = m_impl->m_lastPVR->PathSuccessfullyValidated();

                            }
                        }
                        if(m_impl->m_cb) {
                            bool acceptPKIF = (*(m_impl->m_cb))(m_impl->m_lastPath,
                                        m_impl->m_lastPVR,goodCert);
                            if(!acceptPKIF) goodCert = !goodCert;
                        }
                        if(goodCert) {
                            CPKIFKeyMaterialPtr km(new CPKIFKeyMaterial());
                            CPKIFBufferPtr pecert = cert->Encoded();
                            km->SetCertificate(pecert->GetBuffer(), pecert->GetLength());
                            CPKIFAlgorithmIdentifierPtr params = m_impl->m_lastPVR->GetWorkingParams();
                            if(params) {
                                km->SetWorkingParameters(params);
                            }
                            // need to do this instead of clonePublicKey()
                            // to make sure inherited parameters come through if needed
                            switch(x509->getPublicKeyType()) {
                                case XSECCryptoKey::KEY_RSA_PUBLIC:
                                    {
                                        PKIFXSECCryptoKeyRSA * rsaKey = new PKIFXSECCryptoKeyRSA();
                                        rsaKey->SetMediator(m_impl->m_med);
                                        rsaKey->SetKeyMaterial(km);
                                        ret = rsaKey;
                                        break;
                                    }
                                case XSECCryptoKey::KEY_DSA_PUBLIC:
                                    {
                                        PKIFXSECCryptoKeyDSA * dsaKey = new PKIFXSECCryptoKeyDSA();
                                        dsaKey->SetMediator(m_impl->m_med);
                                        dsaKey->SetKeyMaterial(km);
                                        ret = dsaKey;
                                        break;
                                    }
                            }
                        }
                    }

                    if (ret != NULL)
                        return ret;
                
                }
                break;
            default:
                // The PKIF resolver can only do anything with certificates. 
                // this structure is a little funky but here in case we want to
                // expand PKIFXML processing to non-cert keys.
                // For now, Use the default resolver for other cases
                break;
        }
    }
    return ret;
}

XSECKeyInfoResolver * PKIFXSECKeyInfoResolver::clone(void) const
{
    PKIFXSECKeyInfoResolver * rv = new PKIFXSECKeyInfoResolver(m_impl->m_med, m_impl->m_ps, m_impl->m_checker);
    rv->m_impl->m_cb = m_impl->m_cb;
    return rv;
}

void PKIFXSECKeyInfoResolver::SetCallback(IPKIFXSECNotificationCallback * cb)
{
    m_impl->m_cb = cb;
}