Convert from NULL macro to nullptr.

[shibboleth/xmltooling.git] / xmltooling / security / impl / ExplicitKeyTrustEngine.cpp

diff --git a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
index 7646bc5..09ee002 100644 (file)
--- a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
+++ b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2007 Internet2
+ *  Copyright 2001-2010 Internet2
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,35 +21,39 @@
  */
 
 #include "internal.h"
+#include "logging.h"
 #include "security/Credential.h"
 #include "security/CredentialCriteria.h"
 #include "security/CredentialResolver.h"
 #include "security/OpenSSLTrustEngine.h"
+#include "security/SignatureTrustEngine.h"
+#include "signature/Signature.h"
 #include "signature/SignatureValidator.h"
 #include "util/NDC.h"
 
-#include <log4cpp/Category.hh>
 #include <xercesc/util/XMLUniDefs.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
 
 using namespace xmlsignature;
+using namespace xmltooling::logging;
 using namespace xmltooling;
-using namespace log4cpp;
 using namespace std;
 
+using xercesc::DOMElement;
+
 namespace xmltooling {
-    class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public OpenSSLTrustEngine
+    class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public SignatureTrustEngine, public OpenSSLTrustEngine
     {
     public:
-        ExplicitKeyTrustEngine(const DOMElement* e) : OpenSSLTrustEngine(e) {}
+        ExplicitKeyTrustEngine(const DOMElement* e) : TrustEngine(e) {}
         virtual ~ExplicitKeyTrustEngine() {}
 
         virtual bool validate(
             Signature& sig,
             const CredentialResolver& credResolver,
-            CredentialCriteria* criteria=NULL
+            CredentialCriteria* criteria=nullptr
             ) const;
         virtual bool validate(
             const XMLCh* sigAlgorithm,
@@ -58,19 +62,19 @@ namespace xmltooling {
             const char* in,
             unsigned int in_len,
             const CredentialResolver& credResolver,
-            CredentialCriteria* criteria=NULL
+            CredentialCriteria* criteria=nullptr
             ) const;
         virtual bool validate(
             XSECCryptoX509* certEE,
             const vector<XSECCryptoX509*>& certChain,
             const CredentialResolver& credResolver,
-            CredentialCriteria* criteria=NULL
+            CredentialCriteria* criteria=nullptr
             ) const;
         virtual bool validate(
             X509* certEE,
             STACK_OF(X509)* certChain,
             const CredentialResolver& credResolver,
-            CredentialCriteria* criteria=NULL
+            CredentialCriteria* criteria=nullptr
             ) const;
     };
 
@@ -89,22 +93,22 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
 
     vector<const Credential*> credentials;
     if (criteria) {
-        criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        criteria->setSignature(sig);
+        criteria->setUsage(Credential::SIGNING_CREDENTIAL);
+        criteria->setSignature(sig, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        cc.setSignature(sig);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
+        cc.setSignature(sig, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate signature, no credentials available from peer");
+        log.debug("unable to validate signature, no credentials available from peer");
         return false;
     }
     
@@ -122,7 +126,7 @@ bool ExplicitKeyTrustEngine::validate(
         }
     }
 
-    log.error("no peer credentials validated the signature");
+    log.debug("no peer credentials validated the signature");
     return false;
 }
 
@@ -139,22 +143,24 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
     
     vector<const Credential*> credentials;
     if (criteria) {
-        criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        criteria->setKeyInfo(keyInfo);
+        criteria->setUsage(Credential::SIGNING_CREDENTIAL);
+        criteria->setKeyInfo(keyInfo, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
+        criteria->setXMLAlgorithm(sigAlgorithm);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        cc.setKeyInfo(keyInfo);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
+        cc.setKeyInfo(keyInfo, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
+        cc.setXMLAlgorithm(sigAlgorithm);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate signature, no credentials available from peer");
+        log.debug("unable to validate signature, no credentials available from peer");
         return false;
     }
     
@@ -175,7 +181,7 @@ bool ExplicitKeyTrustEngine::validate(
         }
     }
 
-    log.error("no peer credentials validated the signature");
+    log.debug("no peer credentials validated the signature");
     return false;
 }
 
@@ -190,15 +196,15 @@ bool ExplicitKeyTrustEngine::validate(
         NDC ndc("validate");
 #endif
     if (!certEE) {
-        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine").error("unable to validate, end-entity certificate was null");
+        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE).error("unable to validate, end-entity certificate was null");
         return false;
     }
     else if (certEE->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
-        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine").error("only the OpenSSL XSEC provider is supported");
+        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE).error("only the OpenSSL XSEC provider is supported");
         return false;
     }
 
-    return validate(static_cast<OpenSSLCryptoX509*>(certEE)->getOpenSSLX509(), NULL, credResolver, criteria);
+    return validate(static_cast<OpenSSLCryptoX509*>(certEE)->getOpenSSLX509(), nullptr, credResolver, criteria);
 }
 
 bool ExplicitKeyTrustEngine::validate(
@@ -211,7 +217,7 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
     
     if (!certEE) {
         log.error("unable to validate, end-entity certificate was null");
@@ -220,17 +226,17 @@ bool ExplicitKeyTrustEngine::validate(
 
     vector<const Credential*> credentials;
     if (criteria) {
-        if (criteria->getUsage()==CredentialCriteria::UNSPECIFIED_CREDENTIAL)
-            criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+        if (criteria->getUsage()==Credential::UNSPECIFIED_CREDENTIAL)
+            criteria->setUsage(Credential::SIGNING_CREDENTIAL);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate certificate, no credentials available from peer");
+        log.debug("unable to validate certificate, no credentials available from peer");
         return false;
     }
 
@@ -241,7 +247,6 @@ bool ExplicitKeyTrustEngine::validate(
     for (vector<const Credential*>::const_iterator c=credentials.begin(); c!=credentials.end(); ++c) {
         XSECCryptoKey* key = (*c)->getPublicKey();
         if (key) {
-            log.debug("checking if peer key matches end-entity certificate");
             if (key->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
                 log.error("only the OpenSSL XSEC provider is supported");
                 continue;