+/*\r
+ * Copyright 2001-2005 Internet2\r
+ * \r
+ * Licensed under the Apache License, Version 2.0 (the "License");\r
+ * you may not use this file except in compliance with the License.\r
+ * You may obtain a copy of the License at\r
+ *\r
+ * http://www.apache.org/licenses/LICENSE-2.0\r
+ *\r
+ * Unless required by applicable law or agreed to in writing, software\r
+ * distributed under the License is distributed on an "AS IS" BASIS,\r
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
+ * See the License for the specific language governing permissions and\r
+ * limitations under the License.\r
+ */\r
+\r
+/**\r
+ * ExplicitKeyTrustEngine.cpp\r
+ * \r
+ * TrustEngine based on explicit knowledge of peer key information.\r
+ */\r
+\r
+#include "internal.h"\r
+#include "security/X509TrustEngine.h"\r
+#include "signature/SignatureValidator.h"\r
+#include "util/NDC.h"\r
+\r
+#include <log4cpp/Category.hh>\r
+#include <xercesc/util/XMLUniDefs.hpp>\r
+#include <xsec/enc/openssl/OpenSSLCryptoX509.hpp>\r
+\r
+using namespace xmlsignature;\r
+using namespace xmltooling;\r
+using namespace log4cpp;\r
+using namespace std;\r
+\r
+namespace xmltooling {\r
+ class XMLTOOL_DLLLOCAL ExplicitKeyTrustEngine : public X509TrustEngine\r
+ {\r
+ public:\r
+ ExplicitKeyTrustEngine(const DOMElement* e) : X509TrustEngine(e) {}\r
+ virtual ~ExplicitKeyTrustEngine() {}\r
+\r
+ virtual bool validate(\r
+ Signature& sig,\r
+ TrustEngine::KeyInfoIterator& keyInfoSource,\r
+ const KeyResolver* keyResolver=NULL\r
+ );\r
+ virtual bool validate(\r
+ XSECCryptoX509* certEE,\r
+ const vector<XSECCryptoX509*>& certChain,\r
+ TrustEngine::KeyInfoIterator& keyInfoSource,\r
+ bool checkName=true,\r
+ const KeyResolver* keyResolver=NULL\r
+ );\r
+\r
+ private:\r
+ };\r
+\r
+ TrustEngine* XMLTOOL_DLLLOCAL ExplicitKeyTrustEngineFactory(const DOMElement* const & e)\r
+ {\r
+ return new ExplicitKeyTrustEngine(e);\r
+ }\r
+};\r
+\r
+bool ExplicitKeyTrustEngine::validate(\r
+ Signature& sig,\r
+ TrustEngine::KeyInfoIterator& keyInfoSource,\r
+ const KeyResolver* keyResolver\r
+ )\r
+{\r
+#ifdef _DEBUG\r
+ NDC ndc("validate");\r
+#endif\r
+ Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");\r
+ \r
+ if (!keyInfoSource.hasNext()) {\r
+ log.warn("unable to validate signature, no key information available for peer");\r
+ return false;\r
+ }\r
+ \r
+ log.debug("attempting to validate signature with the key information for peer");\r
+ SignatureValidator sigValidator;\r
+ while (keyInfoSource.hasNext()) {\r
+ XSECCryptoKey* key = (keyResolver ? keyResolver : m_keyResolver)->resolveKey(keyInfoSource.next());\r
+ if (key) {\r
+ log.debug("attempting to validate signature with public key...");\r
+ try {\r
+ sigValidator.setKey(key); // key now owned by validator\r
+ sigValidator.validate(&sig);\r
+ log.info("signature validated with public key");\r
+ return true;\r
+ }\r
+ catch (ValidationException& e) {\r
+ if (log.isDebugEnabled()) {\r
+ log.debug("public key did not validate signature: %s", e.what());\r
+ }\r
+ }\r
+ }\r
+ else {\r
+ log.debug("key information does not resolve to a public key, skipping it");\r
+ }\r
+ }\r
+\r
+ log.error("no peer key information validated the signature");\r
+ return false;\r
+}\r
+\r
+bool ExplicitKeyTrustEngine::validate(\r
+ XSECCryptoX509* certEE,\r
+ const vector<XSECCryptoX509*>& certChain,\r
+ TrustEngine::KeyInfoIterator& keyInfoSource,\r
+ bool checkName,\r
+ const KeyResolver* keyResolver\r
+ )\r
+{\r
+#ifdef _DEBUG\r
+ NDC ndc("validate");\r
+#endif\r
+ Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");\r
+ \r
+ if (!certEE) {\r
+ log.error("unable to validate, end-entity certificate was null");\r
+ return false;\r
+ }\r
+ else if (certEE->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {\r
+ log.error("only the OpenSSL XSEC provider is supported");\r
+ return false;\r
+ }\r
+ else if (!keyInfoSource.hasNext()) {\r
+ log.warn("unable to validate, no key information available for peer");\r
+ return false;\r
+ }\r
+\r
+ // The new "basic" trust implementation relies solely on certificates living within the\r
+ // role interface to verify the EE certificate.\r
+\r
+ log.debug("attempting to match key information from peer with end-entity certificate");\r
+ vector<XSECCryptoX509*> resolvedCerts;\r
+ while (keyInfoSource.hasNext()) {\r
+ resolvedCerts.clear();\r
+ if (0 == (keyResolver ? keyResolver : m_keyResolver)->resolveCertificates(keyInfoSource.next(),resolvedCerts)) {\r
+ log.debug("key information does not resolve to a certificate, skipping it");\r
+ continue;\r
+ }\r
+\r
+ log.debug("checking if certificates contained within key information match end-entity certificate");\r
+ if (resolvedCerts.front()->getProviderName()!=DSIGConstants::s_unicodeStrPROVOpenSSL) {\r
+ log.error("only the OpenSSL XSEC provider is supported");\r
+ continue;\r
+ }\r
+ else if (!X509_cmp(static_cast<OpenSSLCryptoX509*>(certEE)->getOpenSSLX509(),static_cast<OpenSSLCryptoX509*>(resolvedCerts.front())->getOpenSSLX509())) {\r
+ log.info("end-entity certificate matches certificate from peer key information");\r
+ return true;\r
+ }\r
+ }\r
+\r
+ log.debug("no certificates within this peer's key information matched the given end-entity certificate");\r
+ return false;\r
+}\r