-/*\r
- * Copyright 2001-2005 Internet2\r
- * \r
- * Licensed under the Apache License, Version 2.0 (the "License");\r
- * you may not use this file except in compliance with the License.\r
- * You may obtain a copy of the License at\r
- *\r
- * http://www.apache.org/licenses/LICENSE-2.0\r
- *\r
- * Unless required by applicable law or agreed to in writing, software\r
- * distributed under the License is distributed on an "AS IS" BASIS,\r
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
- * See the License for the specific language governing permissions and\r
- * limitations under the License.\r
- */\r
-\r
-/**\r
- * ExplicitKeyTrustEngine.cpp\r
- * \r
- * TrustEngine based on explicit knowledge of peer key information.\r
- */\r
-\r
-#include "internal.h"\r
-#include "security/X509TrustEngine.h"\r
-#include "signature/SignatureValidator.h"\r
-#include "util/NDC.h"\r
-\r
-#include <log4cpp/Category.hh>\r
-#include <xercesc/util/XMLUniDefs.hpp>\r
-#include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>\r
-\r
-using namespace xmlsignature;\r
-using namespace xmltooling;\r
-using namespace log4cpp;\r
-using namespace std;\r
-\r
-namespace xmltooling {\r
- class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public X509TrustEngine\r
- {\r
- public:\r
- ExplicitKeyTrustEngine(const DOMElement* e) : X509TrustEngine(e) {}\r
- virtual ~ExplicitKeyTrustEngine() {}\r
-\r
- virtual bool validate(\r
- Signature& sig,\r
- TrustEngine::KeyInfoIterator& keyInfoSource,\r
- const KeyResolver* keyResolver=NULL\r
- ) const;\r
- virtual bool validate(\r
- XSECCryptoX509* certEE,\r
- const vector<XSECCryptoX509*>& certChain,\r
- TrustEngine::KeyInfoIterator& keyInfoSource,\r
- bool checkName=true,\r
- const KeyResolver* keyResolver=NULL\r
- ) const;\r
- };\r
-\r
- TrustEngine* XMLTOOL_DLLLOCAL ExplicitKeyTrustEngineFactory(const DOMElement* const & e)\r
- {\r
- return new ExplicitKeyTrustEngine(e);\r
- }\r
-};\r
-\r
-bool ExplicitKeyTrustEngine::validate(\r
- Signature& sig,\r
- TrustEngine::KeyInfoIterator& keyInfoSource,\r
- const KeyResolver* keyResolver\r
- ) const\r
-{\r
-#ifdef _DEBUG\r
- NDC ndc("validate");\r
-#endif\r
- Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");\r
- \r
- if (!keyInfoSource.hasNext()) {\r
- log.warn("unable to validate signature, no key information available for peer");\r
- return false;\r
- }\r
- \r
- log.debug("attempting to validate signature with the key information for peer");\r
- SignatureValidator sigValidator;\r
- while (keyInfoSource.hasNext()) {\r
- XSECCryptoKey* key = (keyResolver ? keyResolver : m_keyResolver)->resolveKey(keyInfoSource.next());\r
- if (key) {\r
- log.debug("attempting to validate signature with public key...");\r
- try {\r
- sigValidator.setKey(key); // key now owned by validator\r
- sigValidator.validate(&sig);\r
- log.info("signature validated with public key");\r
- return true;\r
- }\r
- catch (ValidationException& e) {\r
- if (log.isDebugEnabled()) {\r
- log.debug("public key did not validate signature: %s", e.what());\r
- }\r
- }\r
- }\r
- else {\r
- log.debug("key information does not resolve to a public key, skipping it");\r
- }\r
- }\r
-\r
- log.error("no peer key information validated the signature");\r
- return false;\r
-}\r
-\r
-bool ExplicitKeyTrustEngine::validate(\r
- XSECCryptoX509* certEE,\r
- const vector<XSECCryptoX509*>& certChain,\r
- TrustEngine::KeyInfoIterator& keyInfoSource,\r
- bool checkName,\r
- const KeyResolver* keyResolver\r
- ) const\r
-{\r
-#ifdef _DEBUG\r
- NDC ndc("validate");\r
-#endif\r
- Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");\r
- \r
- if (!certEE) {\r
- log.error("unable to validate, end-entity certificate was null");\r
- return false;\r
- }\r
- else if (certEE->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {\r
- log.error("only the OpenSSL XSEC provider is supported");\r
- return false;\r
- }\r
- else if (!keyInfoSource.hasNext()) {\r
- log.warn("unable to validate, no key information available for peer");\r
- return false;\r
- }\r
-\r
- // The new "basic" trust implementation relies solely on certificates living within the\r
- // role interface to verify the EE certificate.\r
-\r
- log.debug("attempting to match key information from peer with end-entity certificate");\r
- while (keyInfoSource.hasNext()) {\r
- KeyResolver::ResolvedCertificates resolvedCerts;\r
- if (0 == (keyResolver ? keyResolver : m_keyResolver)->resolveCertificates(keyInfoSource.next(),resolvedCerts)) {\r
- log.debug("key information does not resolve to a certificate, skipping it");\r
- continue;\r
- }\r
-\r
- log.debug("checking if certificates contained within key information match end-entity certificate");\r
- if (resolvedCerts.v().front()->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {\r
- log.error("only the OpenSSL XSEC provider is supported");\r
- continue;\r
- }\r
- else if (!X509_cmp(static_cast<OpenSSLCryptoX509*>(certEE)->getOpenSSLX509(),static_cast<OpenSSLCryptoX509*>(resolvedCerts.v().front())->getOpenSSLX509())) {\r
- log.info("end-entity certificate matches certificate from peer key information");\r
- return true;\r
- }\r
- }\r
-\r
- log.debug("no certificates within this peer's key information matched the given end-entity certificate");\r
- return false;\r
-}\r
+/*
+ * Copyright 2001-2005 Internet2
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * ExplicitKeyTrustEngine.cpp
+ *
+ * TrustEngine based on explicit knowledge of peer key information.
+ */
+
+#include "internal.h"
+#include "security/X509TrustEngine.h"
+#include "signature/SignatureValidator.h"
+#include "util/NDC.h"
+
+#include <log4cpp/Category.hh>
+#include <xercesc/util/XMLUniDefs.hpp>
+#include <xsec/enc/OpenSSL/OpenSSLCryptoX509.hpp>
+
+using namespace xmlsignature;
+using namespace xmltooling;
+using namespace log4cpp;
+using namespace std;
+
+namespace xmltooling {
+ class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public X509TrustEngine
+ {
+ public:
+ ExplicitKeyTrustEngine(const DOMElement* e) : X509TrustEngine(e) {}
+ virtual ~ExplicitKeyTrustEngine() {}
+
+ virtual bool validate(
+ Signature& sig,
+ TrustEngine::KeyInfoIterator& keyInfoSource,
+ const KeyResolver* keyResolver=NULL
+ ) const;
+ virtual bool validate(
+ XSECCryptoX509* certEE,
+ const vector<XSECCryptoX509*>& certChain,
+ TrustEngine::KeyInfoIterator& keyInfoSource,
+ bool checkName=true,
+ const KeyResolver* keyResolver=NULL
+ ) const;
+ };
+
+ TrustEngine* XMLTOOL_DLLLOCAL ExplicitKeyTrustEngineFactory(const DOMElement* const & e)
+ {
+ return new ExplicitKeyTrustEngine(e);
+ }
+};
+
+bool ExplicitKeyTrustEngine::validate(
+ Signature& sig,
+ TrustEngine::KeyInfoIterator& keyInfoSource,
+ const KeyResolver* keyResolver
+ ) const
+{
+#ifdef _DEBUG
+ NDC ndc("validate");
+#endif
+ Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+
+ if (!keyInfoSource.hasNext()) {
+ log.warn("unable to validate signature, no key information available for peer");
+ return false;
+ }
+
+ log.debug("attempting to validate signature with the key information for peer");
+ SignatureValidator sigValidator;
+ while (keyInfoSource.hasNext()) {
+ XSECCryptoKey* key = (keyResolver ? keyResolver : m_keyResolver)->resolveKey(keyInfoSource.next());
+ if (key) {
+ log.debug("attempting to validate signature with public key...");
+ try {
+ sigValidator.setKey(key); // key now owned by validator
+ sigValidator.validate(&sig);
+ log.info("signature validated with public key");
+ return true;
+ }
+ catch (ValidationException& e) {
+ if (log.isDebugEnabled()) {
+ log.debug("public key did not validate signature: %s", e.what());
+ }
+ }
+ }
+ else {
+ log.debug("key information does not resolve to a public key, skipping it");
+ }
+ }
+
+ log.error("no peer key information validated the signature");
+ return false;
+}
+
+bool ExplicitKeyTrustEngine::validate(
+ XSECCryptoX509* certEE,
+ const vector<XSECCryptoX509*>& certChain,
+ TrustEngine::KeyInfoIterator& keyInfoSource,
+ bool checkName,
+ const KeyResolver* keyResolver
+ ) const
+{
+#ifdef _DEBUG
+ NDC ndc("validate");
+#endif
+ Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
+
+ if (!certEE) {
+ log.error("unable to validate, end-entity certificate was null");
+ return false;
+ }
+ else if (certEE->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
+ log.error("only the OpenSSL XSEC provider is supported");
+ return false;
+ }
+ else if (!keyInfoSource.hasNext()) {
+ log.warn("unable to validate, no key information available for peer");
+ return false;
+ }
+
+ // The new "basic" trust implementation relies solely on certificates living within the
+ // role interface to verify the EE certificate.
+
+ log.debug("attempting to match key information from peer with end-entity certificate");
+ while (keyInfoSource.hasNext()) {
+ KeyResolver::ResolvedCertificates resolvedCerts;
+ if (0 == (keyResolver ? keyResolver : m_keyResolver)->resolveCertificates(keyInfoSource.next(),resolvedCerts)) {
+ log.debug("key information does not resolve to a certificate, skipping it");
+ continue;
+ }
+
+ log.debug("checking if certificates contained within key information match end-entity certificate");
+ if (resolvedCerts.v().front()->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {
+ log.error("only the OpenSSL XSEC provider is supported");
+ continue;
+ }
+ else if (!X509_cmp(static_cast<OpenSSLCryptoX509*>(certEE)->getOpenSSLX509(),static_cast<OpenSSLCryptoX509*>(resolvedCerts.v().front())->getOpenSSLX509())) {
+ log.info("end-entity certificate matches certificate from peer key information");
+ return true;
+ }
+ }
+
+ log.debug("no certificates within this peer's key information matched the given end-entity certificate");
+ return false;
+}
projects / shibboleth / cpp-xmltooling.git / blobdiff