SimpleRootStore.cpp

Go to the documentation of this file.

#include "pkif.h"
#include "GottaMatch.h"

#include <sstream>

#include "boost/thread/recursive_mutex.hpp"
using boost::dynamic_pointer_cast;

struct SimpleRootStoreImpl
{
    SimpleRootStoreImpl ():m_me()
    {
    };
    IPKIFTrustAnchorList m_trustList;
    boost::recursive_mutex m_me;

    //IPKIFCertSearch support
    void GetAllCertificates(IPKIFNameAndKeyList& keyList);
    void GetCertificatesBySubjectName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByIssuerName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByIssuerAndSerial(CPKIFNamePtr& n, const char* serial, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByKeyIdentifier(CPKIFBufferPtr& keyId, IPKIFNameAndKeyList& keyList);

};

void SimpleRootStoreImpl::GetAllCertificates(IPKIFNameAndKeyList& keyList)
{
    if(!m_trustList.empty())
    {
        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_trustList.end();
        for(pos = m_trustList.begin(); pos != end; ++pos)
        {
            keyList.push_back(*pos);
        }
    }
}
void SimpleRootStoreImpl::GetCertificatesBySubjectName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList)
{
    if(!m_trustList.empty())
    {
        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_trustList.end();
        for(pos = m_trustList.begin(); pos != end; ++pos)
        {
            if(*n == *(*pos)->GetSubjectName())
                keyList.push_back(*pos);
        }
    }
}
void SimpleRootStoreImpl::GetCertificatesByIssuerName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList)
{
    if(!m_trustList.empty())
    {
        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_trustList.end();
        for(pos = m_trustList.begin(); pos != end; ++pos)
        {
            if(*n == *(*pos)->GetIssuerName())
                keyList.push_back(*pos);
        }
    }
}
void SimpleRootStoreImpl::GetCertificatesByIssuerAndSerial(CPKIFNamePtr& n, const char* serial, IPKIFNameAndKeyList& keyList)
{
    if(!m_trustList.empty())
    {
        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_trustList.end();
        for(pos = m_trustList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCertificate();
            if(cert && ((*n == *cert->GetIssuerName()) && 0 == stricmp(serial, cert->SerialNumber())))
                keyList.push_back(*pos);
        }
    }
}
void SimpleRootStoreImpl::GetCertificatesByKeyIdentifier(CPKIFBufferPtr& keyId, IPKIFNameAndKeyList& keyList)
{
    if(!m_trustList.empty())
    {
        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_trustList.end();
        for(pos = m_trustList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCertificate();
            CPKIFBufferPtr kidFromCert;
            if(cert)
            {
                CPKIFSubjectKeyIdentifierPtr skid = cert->GetExtension<CPKIFSubjectKeyIdentifier>();
                if(skid)
                    kidFromCert = skid->KeyIdentifier();
            }
            else
            {
                IPKIFTrustAnchorPtr ta = dynamic_pointer_cast<IPKIFTrustAnchor, IPKIFNameAndKey>(*pos);
                if(ta)
                {
                    CPKIFSubjectKeyIdentifierPtr skid = ta->GetKeyIdentifier();
                    if(skid)
                        kidFromCert = skid->KeyIdentifier();
                }
            }
            if(kidFromCert && (*keyId == *kidFromCert))
                keyList.push_back(*pos);
        }
    }
}


CAC_API SimpleRootStore* MakeSimpleRootStore()
{
    return new SimpleRootStore();
}

CAC_API void FreeSimpleRootStore(
    SimpleRootStore* s)
{
    if(s)
    {
        delete s;
    }
}


SimpleRootStore::SimpleRootStore(void)
    :m_impl (new SimpleRootStoreImpl)
{
    LOG_STRING_DEBUG("SimpleRootStore::SimpleRootStore(void)", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);
}
SimpleRootStore::~SimpleRootStore(void)
{
    LOG_STRING_DEBUG("SimpleRootStore::~SimpleRootStore(void)", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);

    delete m_impl;
    m_impl = NULL;
}

//IPKIFColleague functions
void SimpleRootStore::Initialize(void)
{
    LOG_STRING_DEBUG("SimpleRootStore::Initialize(void)", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);
}

void SimpleRootStore::Clear()
{
    LOG_STRING_DEBUG("SimpleRootStore::Clear()", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    LOG_STRING_DEBUG("Emptying SimpleRootStore instance", thisComponent, 0, this);

    m_impl->m_trustList.clear();
}


bool SimpleRootStore::GetTrustRoots(const CPKIFNamePtr& subDN, IPKIFTrustAnchorList& trustList)
{
    LOG_STRING_DEBUG("SimpleRootStore::GetTrustRoots(const CPKIFNamePtr& subDN, IPKIFTrustAnchorList& trustList)", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    const size_t origSize = trustList.size();

    //changed operation of this function to return all trust anchors when a NULL subDN is passed
    if(subDN == (CPKIFName*)NULL)
    {
        copy(m_impl->m_trustList.begin(), m_impl->m_trustList.end(), back_inserter(trustList));
        return origSize < trustList.size();
    }
    else
    {
#ifdef _DEBUG
        const char* subNameToFindString = NULL;
        if(subDN)
            subNameToFindString = subDN->ToString();
#endif

        IPKIFTrustAnchorList::iterator pos;
        IPKIFTrustAnchorList::iterator end = m_impl->m_trustList.end();
        for(pos = m_impl->m_trustList.begin(); pos != end; ++pos)
        {
            CPKIFNamePtr subjectNameFromTA = (*pos)->GetSubjectName();

#ifdef _DEBUG
            const char* subNameString = NULL;
            if(subjectNameFromTA)
                subNameString = subjectNameFromTA->ToString();
#endif

            GottaMatch<IPKIFTrustAnchorPtr> gm;
            gm.SetRHS(*pos);

            if(subjectNameFromTA && *subDN == *subjectNameFromTA && trustList.end() == find_if(trustList.begin(), trustList.end(), gm))
                trustList.push_back(*pos);
        }

        if(origSize != trustList.size())
        {
            std::string logStr = "Found one or more trusted certificates with subject name ";
            logStr.append(subDN->ToString());
            LOG_STRING_DEBUG(logStr.c_str(), thisComponent, 0, NULL);
            return true;
        }
        else
        {
            std::string logStr = "Failed to find a trusted certificate with subject name ";
            logStr.append(subDN->ToString());
            LOG_STRING_DEBUG(logStr.c_str(), thisComponent, 0, NULL);
            return false;
        }
    }
}

//Unlike the cert store equivalent, this class simply pushes certs into the vector
//and does not screen for duplicates.  Since the trust store is not updated automatically
//like the cert store, it shouldn't matter.  
void SimpleRootStore::AddTrustRoot(const IPKIFTrustAnchorPtr& cert)
{
    LOG_STRING_DEBUG("SimpleRootStore::AddTrustRoot(const CPKIFTrustRootPtr& cert)", TOOLKIT_SR_SIMPLEROOTSTORE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    GottaMatch<IPKIFTrustAnchorPtr> gm;
    gm.SetRHS(cert);

    //avoid growing the cache with duplicates
    if(m_impl->m_trustList.end() == find_if(m_impl->m_trustList.begin(), m_impl->m_trustList.end(), gm))
    {
        m_impl->m_trustList.push_back(cert);

        std::ostringstream os;
        os << "Successfully added trust anchor to SimpleRootStore instance.  Size =  " << m_impl->m_trustList.size() << " after addition.";
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this)
    }
}
void SimpleRootStore::GetTrustRoots(
    IPKIFTrustAnchorList& v)
{
    IPKIFTrustAnchorList::iterator pos;
    IPKIFTrustAnchorList::iterator end = m_impl->m_trustList.end();
    for(pos = m_impl->m_trustList.begin(); pos != end; ++pos)
    {
        v.push_back(*pos);
    }
}

void SimpleRootStore::FindCertificates(IPKIFSearchCriteria* searchCriteria, CPKIFCertificateList& certList, PKIInfoSource source)
{
    if(!searchCriteria)
        return;

    IPKIFNameAndKeyList keyList;
    FindKeys(searchCriteria, keyList, source);

    IPKIFNameAndKeyList::iterator pos;
    IPKIFNameAndKeyList::iterator end = keyList.end();
    for(pos = keyList.begin(); pos != end; ++pos)
    {
        CPKIFCertificatePtr cert = dynamic_pointer_cast<CPKIFCertificate, IPKIFNameAndKey>(*pos);
        if(cert)
            certList.push_back(cert);
    }
}

void SimpleRootStore::FindKeys(IPKIFSearchCriteria* searchCriteria, IPKIFNameAndKeyList& keyList, PKIInfoSource source)
{
    if(!searchCriteria)
        return;

    switch(searchCriteria->GetSearchType())
    {
    case ALLCERTS:
        m_impl->GetAllCertificates(keyList);
        break;
    case ISSUERNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = nbs->GetName();
            m_impl->GetCertificatesBySubjectName(tmpName, keyList);
        }
        break;
    case SUBJECTNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = nbs->GetName();
            m_impl->GetCertificatesByIssuerName(tmpName, keyList);
        }
        break;
    case ISSUERSERIAL:
        {
            CPKIFIssuerNameAndSerialNumberBasedSearch* inasnbs = dynamic_cast<CPKIFIssuerNameAndSerialNumberBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = inasnbs->GetIssuerName();
            m_impl->GetCertificatesByIssuerAndSerial(tmpName, inasnbs->GetSerialNumber(), keyList);
            break;
        }
    case KEYID:
        {
            CPKIFKeyIDBasedSearch* kidbs = dynamic_cast<CPKIFKeyIDBasedSearch*>(searchCriteria);
            if(!kidbs)
                return;

            CPKIFBufferPtr kid = kidbs->GetKeyID();
            m_impl->GetCertificatesByKeyIdentifier(kid, keyList);
            break;
        }
    default:
        return;
    };
}