X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=xmltooling%2Fsecurity%2Fimpl%2FChainingTrustEngine.cpp;h=fbde4a58991c550270ff0c78cebdc6bfd75ccb33;hb=b23c5dab38620c14e0c3277c840994a11175d59b;hp=eda259c4d572fb07ba8c81af55f2d885cf1576f4;hpb=851b777a3cbe82a6c300afab781db3549e44a279;p=shibboleth%2Fcpp-xmltooling.git diff --git a/xmltooling/security/impl/ChainingTrustEngine.cpp b/xmltooling/security/impl/ChainingTrustEngine.cpp index eda259c..fbde4a5 100644 --- a/xmltooling/security/impl/ChainingTrustEngine.cpp +++ b/xmltooling/security/impl/ChainingTrustEngine.cpp @@ -1,38 +1,49 @@ -/* - * Copyright 2001-2007 Internet2 - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at +/** + * Licensed to the University Corporation for Advanced Internet + * Development, Inc. (UCAID) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for + * additional information regarding copyright ownership. + * + * UCAID licenses this file to you under the Apache License, + * Version 2.0 (the "License"); you may not use this file except + * in compliance with the License. You may obtain a copy of the + * License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * http://www.apache.org/licenses/LICENSE-2.0 * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, + * either express or implied. See the License for the specific + * language governing permissions and limitations under the License. */ /** * ChainingTrustEngine.cpp * - * TrustEngine that uses multiple engines in sequence. + * OpenSSLTrustEngine that uses multiple engines in sequence. */ #include "internal.h" #include "exceptions.h" +#include "logging.h" #include "security/ChainingTrustEngine.h" +#include "security/CredentialCriteria.h" #include "util/XMLHelper.h" -#include +#include +#include #include using namespace xmlsignature; +using namespace xmltooling::logging; using namespace xmltooling; -using namespace log4cpp; +using namespace boost::lambda; +using namespace boost; using namespace std; +using xercesc::DOMElement; + namespace xmltooling { TrustEngine* XMLTOOL_DLLLOCAL ChainingTrustEngineFactory(const DOMElement* const & e) { @@ -41,27 +52,18 @@ namespace xmltooling { }; static const XMLCh _TrustEngine[] = UNICODE_LITERAL_11(T,r,u,s,t,E,n,g,i,n,e); -static const XMLCh type[] = UNICODE_LITERAL_4(t,y,p,e); +static const XMLCh _type[] = UNICODE_LITERAL_4(t,y,p,e); -ChainingTrustEngine::ChainingTrustEngine(const DOMElement* e) : TrustEngine(e) { - Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."CHAINING_TRUSTENGINE); - e = e ? XMLHelper::getFirstChildElement(e, _TrustEngine) : NULL; +ChainingTrustEngine::ChainingTrustEngine(const DOMElement* e) : TrustEngine(e) +{ + Category& log=Category::getInstance(XMLTOOLING_LOGCAT ".TrustEngine." CHAINING_TRUSTENGINE); + e = e ? XMLHelper::getFirstChildElement(e, _TrustEngine) : nullptr; while (e) { try { - auto_ptr_char temp(e->getAttributeNS(NULL,type)); - if (temp.get() && *temp.get()) { - log.info("building TrustEngine of type %s", temp.get()); - TrustEngine* engine = XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(temp.get(), e); - m_engines.push_back(engine); - SignatureTrustEngine* sig = dynamic_cast(engine); - if (sig) - m_sigEngines.push_back(sig); - X509TrustEngine* x509 = dynamic_cast(engine); - if (x509) - m_x509Engines.push_back(x509); - OpenSSLTrustEngine* ossl = dynamic_cast(engine); - if (ossl) - m_osslEngines.push_back(ossl); + string t = XMLHelper::getAttrString(e, nullptr, _type); + if (!t.empty()) { + log.info("building TrustEngine of type %s", t.c_str()); + addTrustEngine(XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(t.c_str(), e)); } } catch (exception& ex) { @@ -71,15 +73,68 @@ ChainingTrustEngine::ChainingTrustEngine(const DOMElement* e) : TrustEngine(e) { } } -ChainingTrustEngine::~ChainingTrustEngine() { - for_each(m_engines.begin(), m_engines.end(), xmltooling::cleanup()); +ChainingTrustEngine::~ChainingTrustEngine() +{ +} + +void ChainingTrustEngine::addTrustEngine(TrustEngine* newEngine) +{ + m_engines.push_back(newEngine); + SignatureTrustEngine* sig = dynamic_cast(newEngine); + if (sig) + m_sigEngines.push_back(sig); + X509TrustEngine* x509 = dynamic_cast(newEngine); + if (x509) + m_x509Engines.push_back(x509); + OpenSSLTrustEngine* ossl = dynamic_cast(newEngine); + if (ossl) + m_osslEngines.push_back(ossl); +} + +TrustEngine* ChainingTrustEngine::removeTrustEngine(TrustEngine* oldEngine) +{ + ptr_vector::iterator i = + find_if(m_engines.begin(), m_engines.end(), (&_1 == oldEngine)); + if (i != m_engines.end()) { + SignatureTrustEngine* sig = dynamic_cast(oldEngine); + if (sig) { + ptr_vector::iterator s = + find_if(m_sigEngines.begin(), m_sigEngines.end(), (&_1 == sig)); + if (s != m_sigEngines.end()) + m_sigEngines.erase(s); + } + + X509TrustEngine* x509 = dynamic_cast(oldEngine); + if (x509) { + ptr_vector::iterator x = + find_if(m_x509Engines.begin(), m_x509Engines.end(), (&_1 == x509)); + if (x != m_x509Engines.end()) + m_x509Engines.erase(x); + } + + OpenSSLTrustEngine* ossl = dynamic_cast(oldEngine); + if (ossl) { + ptr_vector::iterator o = + find_if(m_osslEngines.begin(), m_osslEngines.end(), (&_1 == ossl)); + if (o != m_osslEngines.end()) + m_osslEngines.erase(o); + } + + return (m_engines.release(i)).release(); + } + return nullptr; } bool ChainingTrustEngine::validate(Signature& sig, const CredentialResolver& credResolver, CredentialCriteria* criteria) const { - for (vector::const_iterator i=m_sigEngines.begin(); i!=m_sigEngines.end(); ++i) { - if ((*i)->validate(sig,credResolver,criteria)) + unsigned int usage = criteria ? criteria->getUsage() : 0; + for (ptr_vector::const_iterator i=m_sigEngines.begin(); i!=m_sigEngines.end(); ++i) { + if (i->validate(sig,credResolver,criteria)) return true; + if (criteria) { + criteria->reset(); + criteria->setUsage(usage); + } } return false; } @@ -94,9 +149,14 @@ bool ChainingTrustEngine::validate( CredentialCriteria* criteria ) const { - for (vector::const_iterator i=m_sigEngines.begin(); i!=m_sigEngines.end(); ++i) { - if ((*i)->validate(sigAlgorithm, sig, keyInfo, in, in_len, credResolver, criteria)) + unsigned int usage = criteria ? criteria->getUsage() : 0; + for (ptr_vector::const_iterator i=m_sigEngines.begin(); i!=m_sigEngines.end(); ++i) { + if (i->validate(sigAlgorithm, sig, keyInfo, in, in_len, credResolver, criteria)) return true; + if (criteria) { + criteria->reset(); + criteria->setUsage(usage); + } } return false; } @@ -108,9 +168,14 @@ bool ChainingTrustEngine::validate( CredentialCriteria* criteria ) const { - for (vector::const_iterator i=m_x509Engines.begin(); i!=m_x509Engines.end(); ++i) { - if ((*i)->validate(certEE,certChain,credResolver,criteria)) + unsigned int usage = criteria ? criteria->getUsage() : 0; + for (ptr_vector::const_iterator i=m_x509Engines.begin(); i!=m_x509Engines.end(); ++i) { + if (i->validate(certEE,certChain,credResolver,criteria)) return true; + if (criteria) { + criteria->reset(); + criteria->setUsage(usage); + } } return false; } @@ -122,9 +187,14 @@ bool ChainingTrustEngine::validate( CredentialCriteria* criteria ) const { - for (vector::const_iterator i=m_osslEngines.begin(); i!=m_osslEngines.end(); ++i) { - if ((*i)->validate(certEE,certChain,credResolver,criteria)) + unsigned int usage = criteria ? criteria->getUsage() : 0; + for (ptr_vector::const_iterator i=m_osslEngines.begin(); i!=m_osslEngines.end(); ++i) { + if (i->validate(certEE,certChain,credResolver,criteria)) return true; + if (criteria) { + criteria->reset(); + criteria->setUsage(usage); + } } return false; }