Reducing header overuse, non-inlining selected methods (CPPOST-35).

[shibboleth/cpp-xmltooling.git] / xmltooling / security / impl / FilesystemCredentialResolver.cpp

diff --git a/xmltooling/security/impl/FilesystemCredentialResolver.cpp b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
index d9bcd86..d7dd073 100644 (file)
--- a/xmltooling/security/impl/FilesystemCredentialResolver.cpp
+++ b/xmltooling/security/impl/FilesystemCredentialResolver.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2008 Internet2
+ *  Copyright 2001-2009 Internet2
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 /**
  * FilesystemCredentialResolver.cpp
  *
- * Supplies credentials from local files
+ * Supplies credentials from local files.
  */
 
 #include "internal.h"
@@ -28,10 +28,13 @@
 #include "security/KeyInfoResolver.h"
 #include "security/OpenSSLCredential.h"
 #include "security/SecurityHelper.h"
+#include "security/XSECCryptoX509CRL.h"
 #include "util/NDC.h"
 #include "util/PathResolver.h"
+#include "util/Threads.h"
 #include "util/XMLHelper.h"
 
+#include <algorithm>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <openssl/pkcs12.h>
@@ -43,6 +46,10 @@ using namespace xmltooling::logging;
 using namespace xmltooling;
 using namespace std;
 
+using xercesc::DOMElement;
+using xercesc::chLatin_f;
+using xercesc::chDigit_0;
+
 namespace xmltooling {
 
     // The ManagedResource classes handle memory management, loading of the files
@@ -551,6 +558,13 @@ FilesystemCredentialResolver::~FilesystemCredentialResolver()
 
 Credential* FilesystemCredentialResolver::getCredential()
 {
+    // First, verify that the key and certificate match.
+    if (m_key.key && !m_certs.empty()) {
+        auto_ptr<XSECCryptoKey> temp(m_certs.front().certs.front()->clonePublicKey());
+        if (!SecurityHelper::matches(*m_key.key, *temp.get()))
+            throw XMLSecurityException("FilesystemCredentialResolver given mismatched key/certificate, check for consistency.");
+    }
+
     // We (unfortunately) need to duplicate all the objects and put them in one set of arrays
     // in order to create the credential wrapper.
     FilesystemCredential* credential=NULL;