Add user-supplied key names to filesystem resolver.

[shibboleth/cpp-xmltooling.git] / xmltooling / security / impl / FilesystemCredentialResolver.cpp

diff --git a/xmltooling/security/impl/FilesystemCredentialResolver.cpp b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
index a790bd7..12f4395 100644 (file)
--- a/xmltooling/security/impl/FilesystemCredentialResolver.cpp
+++ b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
@@ -70,11 +70,15 @@ namespace xmltooling {
     public:
         FilesystemCredential(FilesystemCredentialResolver* resolver, XSECCryptoKey* key, const std::vector<XSECCryptoX509*>& xseccerts)
                 : BasicX509Credential(key, xseccerts), m_resolver(resolver) {
+            if (!m_xseccerts.empty())
+                extractNames(m_xseccerts.front(), m_keyNames);
             initKeyInfo();
         }
         virtual ~FilesystemCredential() {
         }
 
+        void addKeyNames(const DOMElement* e);
+
         void attach(SSL_CTX* ctx) const;
     
     private:
@@ -98,13 +102,13 @@ namespace xmltooling {
         void unlock() {}
         
         const Credential* resolve(const CredentialCriteria* criteria=NULL) const {
-            return matches(criteria) ? m_credential : NULL;
+            return (criteria ? (criteria->matches(*m_credential) ? m_credential : NULL) : m_credential);
         }
 
         virtual vector<const Credential*>::size_type resolve(
             vector<const Credential*>& results, const CredentialCriteria* criteria=NULL
             ) const {
-            if (matches(criteria)) {
+            if (!criteria || criteria->matches(*m_credential)) {
                 results.push_back(m_credential);
                 return 1;
             }
@@ -115,28 +119,6 @@ namespace xmltooling {
 
     private:
         XSECCryptoKey* loadKey();
-        bool matches(const CredentialCriteria* criteria) const {
-            bool match = true;
-            if (criteria) {
-                const char* alg = criteria->getKeyAlgorithm();
-                if (alg && *alg) {
-                    const char* alg2 = m_credential->getAlgorithm();
-                    if (alg2 && *alg2)
-                        match = XMLString::equals(alg,alg2);
-                }
-                if (match && criteria->getKeySize()>0 && m_credential->getKeySize()>0)
-                    match = (criteria->getKeySize() == m_credential->getKeySize());
-                if (match && m_credential->getPublicKey()) {
-                    // See if we have to match a specific key.
-                    auto_ptr<Credential> cred(
-                        XMLToolingConfig::getConfig().getKeyInfoResolver()->resolve(*criteria,Credential::RESOLVE_KEYS)
-                        );
-                    if (cred.get())
-                        match = cred->isEqual(*(m_credential->getPublicKey()));
-                }
-            }
-            return match;
-        }
         
         enum format_t { PEM=SSL_FILETYPE_PEM, DER=SSL_FILETYPE_ASN1, _PKCS12, UNKNOWN };
     
@@ -154,14 +136,15 @@ namespace xmltooling {
     {
         return new FilesystemCredentialResolver(e);
     }
-};
 
-static const XMLCh CAPath[] =           UNICODE_LITERAL_6(C,A,P,a,t,h);
-static const XMLCh Certificate[] =      UNICODE_LITERAL_11(C,e,r,t,i,f,i,c,a,t,e);
-static const XMLCh format[] =           UNICODE_LITERAL_6(f,o,r,m,a,t);
-static const XMLCh Key[] =              UNICODE_LITERAL_3(K,e,y);
-static const XMLCh password[] =         UNICODE_LITERAL_8(p,a,s,s,w,o,r,d);
-static const XMLCh Path[] =             UNICODE_LITERAL_4(P,a,t,h);
+    static const XMLCh CAPath[] =           UNICODE_LITERAL_6(C,A,P,a,t,h);
+    static const XMLCh Certificate[] =      UNICODE_LITERAL_11(C,e,r,t,i,f,i,c,a,t,e);
+    static const XMLCh format[] =           UNICODE_LITERAL_6(f,o,r,m,a,t);
+    static const XMLCh Key[] =              UNICODE_LITERAL_3(K,e,y);
+    static const XMLCh Name[] =             UNICODE_LITERAL_4(N,a,m,e);
+    static const XMLCh password[] =         UNICODE_LITERAL_8(p,a,s,s,w,o,r,d);
+    static const XMLCh Path[] =             UNICODE_LITERAL_4(P,a,t,h);
+};
 
 FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e) : m_credential(NULL)
 {
@@ -180,20 +163,20 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
     BIO* in = NULL;
     
     // Move to Key
-    e=XMLHelper::getFirstChildElement(root,Key);
-    if (e) {
+    const DOMElement* keynode=XMLHelper::getFirstChildElement(root,Key);
+    if (keynode) {
 
         // Get raw format attrib value, but defer processing til later since may need to 
         // determine format dynamically, and we need the Path for that.
-        format_xml=e->getAttributeNS(NULL,format);
+        format_xml=keynode->getAttributeNS(NULL,format);
             
-        const XMLCh* password_xml=e->getAttributeNS(NULL,password);
+        const XMLCh* password_xml=keynode->getAttributeNS(NULL,password);
         if (password_xml) {
             auto_ptr_char kp(password_xml);
             m_keypass=kp.get();
         }
         
-        e=XMLHelper::getFirstChildElement(e,Path);
+        e=XMLHelper::getFirstChildElement(keynode,Path);
         if (e && e->hasChildNodes()) {
             const XMLCh* s=e->getFirstChild()->getNodeValue();
             auto_ptr_char kpath(s);
@@ -250,11 +233,12 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
     e=XMLHelper::getFirstChildElement(root,Certificate);
     if (!e) {
         m_credential = new FilesystemCredential(this,key,xseccerts);
+        m_credential->addKeyNames(keynode);
         return;
     }
     auto_ptr_char certpass(e->getAttributeNS(NULL,password));
     
-    DOMElement* ep=XMLHelper::getFirstChildElement(e,Path);
+    const DOMElement* ep=XMLHelper::getFirstChildElement(e,Path);
     if (!ep || !ep->hasChildNodes()) {
         log.error("Path element missing inside Certificate element or is empty");
         delete key;
@@ -335,7 +319,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
             throw XMLSecurityException("FilesystemCredentialResolver unable to load any certificate(s)");
 
         // Load any extra CA files.
-        DOMElement* extra=XMLHelper::getFirstChildElement(e,CAPath);
+        const DOMElement* extra=XMLHelper::getFirstChildElement(e,CAPath);
         while (extra) {
             if (!extra->hasChildNodes()) {
                 log.warn("skipping empty CAPath element");
@@ -413,6 +397,7 @@ FilesystemCredentialResolver::FilesystemCredentialResolver(const DOMElement* e)
     if (!key && !xseccerts.empty())
         key = xseccerts.front()->clonePublicKey();
     m_credential = new FilesystemCredential(this, key, xseccerts);
+    m_credential->addKeyNames(keynode);
 }
 
 XSECCryptoKey* FilesystemCredentialResolver::loadKey()
@@ -623,6 +608,19 @@ void FilesystemCredentialResolver::attach(SSL_CTX* ctx) const
     }
 }
 
+void FilesystemCredential::addKeyNames(const DOMElement* e)
+{
+    e = XMLHelper::getFirstChildElement(e, Name);
+    while (e) {
+        if (e->hasChildNodes()) {
+            auto_ptr_char n(e->getFirstChild()->getNodeValue());
+            if (n.get() && *n.get())
+                m_keyNames.insert(n.get());
+        }
+        e = XMLHelper::getNextSiblingElement(e, Name);
+    }
+}
+
 void FilesystemCredential::attach(SSL_CTX* ctx) const
 {
     return m_resolver->attach(ctx);