Reducing header overuse, non-inlining selected methods (CPPOST-35).

[shibboleth/cpp-xmltooling.git] / xmltooling / security / impl / ExplicitKeyTrustEngine.cpp

diff --git a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
index 7646bc5..21af839 100644 (file)
--- a/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
+++ b/xmltooling/security/impl/ExplicitKeyTrustEngine.cpp
@@ -21,29 +21,33 @@
  */
 
 #include "internal.h"
+#include "logging.h"
 #include "security/Credential.h"
 #include "security/CredentialCriteria.h"
 #include "security/CredentialResolver.h"
 #include "security/OpenSSLTrustEngine.h"
+#include "security/SignatureTrustEngine.h"
+#include "signature/Signature.h"
 #include "signature/SignatureValidator.h"
 #include "util/NDC.h"
 
-#include <log4cpp/Category.hh>
 #include <xercesc/util/XMLUniDefs.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.hpp>
 #include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
 
 using namespace xmlsignature;
+using namespace xmltooling::logging;
 using namespace xmltooling;
-using namespace log4cpp;
 using namespace std;
 
+using xercesc::DOMElement;
+
 namespace xmltooling {
-    class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public OpenSSLTrustEngine
+    class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public SignatureTrustEngine, public OpenSSLTrustEngine
     {
     public:
-        ExplicitKeyTrustEngine(const DOMElement* e) : OpenSSLTrustEngine(e) {}
+        ExplicitKeyTrustEngine(const DOMElement* e) : TrustEngine(e) {}
         virtual ~ExplicitKeyTrustEngine() {}
 
         virtual bool validate(
@@ -89,22 +93,22 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
 
     vector<const Credential*> credentials;
     if (criteria) {
-        criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        criteria->setSignature(sig);
+        criteria->setUsage(Credential::SIGNING_CREDENTIAL);
+        criteria->setSignature(sig, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        cc.setSignature(sig);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
+        cc.setSignature(sig, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate signature, no credentials available from peer");
+        log.debug("unable to validate signature, no credentials available from peer");
         return false;
     }
     
@@ -122,7 +126,7 @@ bool ExplicitKeyTrustEngine::validate(
         }
     }
 
-    log.error("no peer credentials validated the signature");
+    log.debug("no peer credentials validated the signature");
     return false;
 }
 
@@ -139,22 +143,24 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
     
     vector<const Credential*> credentials;
     if (criteria) {
-        criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        criteria->setKeyInfo(keyInfo);
+        criteria->setUsage(Credential::SIGNING_CREDENTIAL);
+        criteria->setKeyInfo(keyInfo, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
+        criteria->setXMLAlgorithm(sigAlgorithm);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
-        cc.setKeyInfo(keyInfo);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
+        cc.setKeyInfo(keyInfo, CredentialCriteria::KEYINFO_EXTRACTION_KEY);
+        cc.setXMLAlgorithm(sigAlgorithm);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate signature, no credentials available from peer");
+        log.debug("unable to validate signature, no credentials available from peer");
         return false;
     }
     
@@ -175,7 +181,7 @@ bool ExplicitKeyTrustEngine::validate(
         }
     }
 
-    log.error("no peer credentials validated the signature");
+    log.debug("no peer credentials validated the signature");
     return false;
 }
 
@@ -190,11 +196,11 @@ bool ExplicitKeyTrustEngine::validate(
         NDC ndc("validate");
 #endif
     if (!certEE) {
-        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine").error("unable to validate, end-entity certificate was null");
+        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE).error("unable to validate, end-entity certificate was null");
         return false;
     }
     else if (certEE->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
-        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine").error("only the OpenSSL XSEC provider is supported");
+        Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE).error("only the OpenSSL XSEC provider is supported");
         return false;
     }
 
@@ -211,7 +217,7 @@ bool ExplicitKeyTrustEngine::validate(
 #ifdef _DEBUG
     NDC ndc("validate");
 #endif
-    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+    Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine."EXPLICIT_KEY_TRUSTENGINE);
     
     if (!certEE) {
         log.error("unable to validate, end-entity certificate was null");
@@ -220,17 +226,17 @@ bool ExplicitKeyTrustEngine::validate(
 
     vector<const Credential*> credentials;
     if (criteria) {
-        if (criteria->getUsage()==CredentialCriteria::UNSPECIFIED_CREDENTIAL)
-            criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+        if (criteria->getUsage()==Credential::UNSPECIFIED_CREDENTIAL)
+            criteria->setUsage(Credential::SIGNING_CREDENTIAL);
         credResolver.resolve(credentials,criteria);
     }
     else {
         CredentialCriteria cc;
-        cc.setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+        cc.setUsage(Credential::SIGNING_CREDENTIAL);
         credResolver.resolve(credentials,&cc);
     }
     if (credentials.empty()) {
-        log.warn("unable to validate certificate, no credentials available from peer");
+        log.debug("unable to validate certificate, no credentials available from peer");
         return false;
     }
 
@@ -241,7 +247,6 @@ bool ExplicitKeyTrustEngine::validate(
     for (vector<const Credential*>::const_iterator c=credentials.begin(); c!=credentials.end(); ++c) {
         XSECCryptoKey* key = (*c)->getPublicKey();
         if (key) {
-            log.debug("checking if peer key matches end-entity certificate");
             if (key->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
                 log.error("only the OpenSSL XSEC provider is supported");
                 continue;