XrdCryptogsiX509Chain Class Reference

#include <XrdCryptogsiX509Chain.hh>

Inheritance diagram for XrdCryptogsiX509Chain:

Collaboration diagram for XrdCryptogsiX509Chain:

Public Member Functions
	XrdCryptogsiX509Chain (XrdCryptogsiX509Chain *c, XrdCryptoFactory *f=0)
	XrdCryptogsiX509Chain (XrdCryptoX509 *c=0, XrdCryptoFactory *f=0)
virtual	~XrdCryptogsiX509Chain ()
bool	Verify (EX509ChainErr &e, x509ChainVerifyOpt_t *vopt=0)
Public Member Functions inherited from XrdCryptoX509Chain
	XrdCryptoX509Chain (XrdCryptoX509 *c=0)
	XrdCryptoX509Chain (XrdCryptoX509Chain *ch)
virtual	~XrdCryptoX509Chain ()
XrdCryptoX509 *	Begin ()
const char *	CAhash ()
const char *	CAname ()
bool	CheckCA (bool checkselfsigned=1)
virtual int	CheckValidity (bool outatfirst=1, int when=0)
void	Cleanup (bool keepCA=0)
void	Dump ()
const char *	EEChash ()
const char *	EECname ()
XrdCryptoX509 *	EffCA () const
XrdCryptoX509 *	End () const
void	InsertAfter (XrdCryptoX509 *c, XrdCryptoX509 *cp)
const char *	LastError () const
XrdCryptoX509 *	Next ()
void	PushBack (XrdCryptoX509 *c)
void	PutInFront (XrdCryptoX509 *c)
void	Remove (XrdCryptoX509 *c)
virtual int	Reorder ()
XrdCryptoX509 *	SearchByIssuer (const char *issuer, ESearchMode mode=kExact)
XrdCryptoX509 *	SearchBySubject (const char *subject, ESearchMode mode=kExact)
void	SetStatusCA (ECAStatus st)
int	Size () const
ECAStatus	StatusCA () const
const char *	X509ChainError (EX509ChainErr e)

Additional Inherited Members
Public Types inherited from XrdCryptoX509Chain
enum	ECAStatus {   kUnknown = 0 ,   kAbsent ,   kInvalid ,   kValid }
enum	EX509ChainErr {   kNone = 0 ,   kInconsistent ,   kTooMany ,   kNoCA ,   kNoCertificate ,   kInvalidType ,   kInvalidNames ,   kRevoked ,   kExpired ,   kMissingExtension ,   kVerifyFail ,   kInvalidSign ,   kCANotAutoSigned ,   kNoEEC ,   kTooManyEEC ,   kInvalidProxy }
Protected Member Functions inherited from XrdCryptoX509Chain
XrdCryptoX509ChainNode *	Find (XrdCryptoX509 *c)
XrdCryptoX509ChainNode *	FindIssuer (const char *issuer, ESearchMode mode=kExact, XrdCryptoX509ChainNode **p=0)
XrdCryptoX509ChainNode *	FindSubject (const char *subject, ESearchMode mode=kExact, XrdCryptoX509ChainNode **p=0)
void	SetEffectiveCA ()
bool	Verify (EX509ChainErr &e, const char *msg, XrdCryptoX509::EX509Type type, int when, XrdCryptoX509 *xcer, XrdCryptoX509 *xsig, XrdCryptoX509Crl *crl=0)
Protected Attributes inherited from XrdCryptoX509Chain
XrdCryptoX509ChainNode *	begin
XrdOucString	cahash
XrdOucString	caname
XrdCryptoX509ChainNode *	current
XrdOucString	eechash
XrdOucString	eecname
XrdCryptoX509ChainNode *	effca
XrdCryptoX509ChainNode *	end
XrdOucString	lastError
XrdCryptoX509ChainNode *	previous
int	size
ECAStatus	statusCA

Detailed Description

Definition at line 50 of file XrdCryptogsiX509Chain.hh.

Constructor & Destructor Documentation

XrdCryptogsiX509Chain() [1/2]

XrdCryptogsiX509Chain::XrdCryptogsiX509Chain ( XrdCryptoX509 *  c = 0, XrdCryptoFactory *  f = 0  )

inline

Definition at line 53 of file XrdCryptogsiX509Chain.hh.

                                                  : XrdCryptoX509Chain(c), cfact(f) { }

XrdCryptogsiX509Chain() [2/2]

XrdCryptogsiX509Chain::XrdCryptogsiX509Chain ( XrdCryptogsiX509Chain *  c, XrdCryptoFactory *  f = 0  )

inline

Definition at line 55 of file XrdCryptogsiX509Chain.hh.

                                                  : XrdCryptoX509Chain(c), cfact(f) { }

~XrdCryptogsiX509Chain()

virtual XrdCryptogsiX509Chain::~XrdCryptogsiX509Chain ( )

inlinevirtual

Definition at line 57 of file XrdCryptogsiX509Chain.hh.

{ }

Member Function Documentation

Verify()

bool XrdCryptogsiX509Chain::Verify ( EX509ChainErr &  e, x509ChainVerifyOpt_t *  vopt = 0  )

virtual

Reimplemented from XrdCryptoX509Chain.

Definition at line 45 of file XrdCryptogsiX509Chain.cc.

{
   // Verify the chain
   EPNAME("X509Chain::Verify");
   errcode = kNone; 
 
   // There must be at least a CA and a { EEC or subCA }. 
   if (size < 2) {
      DEBUG("Nothing to verify (size: "<<size<<")");
      return 0;
   }
   if (QTRACE(Dump)) { Dump(); }
 
   //
   // Reorder if needed
   if (Reorder() != 0) {
      errcode = kInconsistent;
      lastError = ":";
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   //
   // Verification options
   int opt  = (vopt) ? vopt->opt : 0;
   int when = (vopt) ? vopt->when : (int)time(0);
   int plen = (vopt) ? vopt->pathlen : -1;
   XrdCryptoX509Crl *crl = (vopt) ? vopt->crl : 0;
 
   //
   // Global path depth length consistency check
   if (plen > -1 && plen < size) {
      errcode = kTooMany;
      lastError = "checking path depth: ";
      lastError += X509ChainError(errcode);
   }
 
   //
   // Check the first certificate: it MUST be of CA type, valid,
   // self-signed
   XrdCryptoX509ChainNode *node = begin;
   XrdCryptoX509 *xcer = node->Cert();      // Certificate under exam
   XrdCryptoX509 *xsig = xcer;              // Signing certificate
   if (statusCA == kUnknown) {
      if (!XrdCryptoX509Chain::Verify(errcode, "CA: ",
                                      XrdCryptoX509::kCA, when, xcer, xsig))
         return 0;
      statusCA = kValid;
   } else if (statusCA == kAbsent || statusCA == kInvalid) {
      errcode = kNoCA;
      lastError = X509ChainError(errcode);
      return 0;
   }
 
   //
   // Update the max path depth len
   if (plen > -1)
      plen -= 1;
   //
   // Check sub-CA's certificate, if any
   while (node->Next() && node->Next()->Cert()->type == XrdCryptoX509::kCA) {
      xsig = xcer;
      node = node->Next();
      xcer = node->Cert();
      if (!XrdCryptoX509Chain::Verify(errcode, "Sub-CA: ",
                                      XrdCryptoX509::kCA,
                                      when, xcer, xsig, crl))
         return 0;
      //
      // Update the max path depth len
      if (plen > -1)
         plen -= 1;
   }
 
   //
   // If subCA verification case we are done
   if (opt & kOptsCheckSubCA) return 1;
 
   //
   // Check the end-point entity certificate
   if (!node->Next() ||  // We expect somethign else if not in subCA checking mode
       (node->Next() && node->Next()->Cert()->type != XrdCryptoX509::kEEC)) {
      errcode = kNoEEC;
      lastError = X509ChainError(errcode);
      return 0;
   }
 
   //
   // Check the end-point entity certificate
   xsig = xcer;
   node = node->Next();
   xcer = node->Cert();
   if (!XrdCryptoX509Chain::Verify(errcode, "EEC: ",
                                   XrdCryptoX509::kUnknown,
                                   when, xcer, xsig, crl))
      return 0;
   //
   // Update the max path depth len
   if (plen > -1)
      plen -= 1;
 
   //
   // Only one end-point entity certificate
   if (node->Next() && node->Next()->Cert()->type == XrdCryptoX509::kEEC) {
      errcode = kTooManyEEC;
      lastError = X509ChainError(errcode);
      return 0;
   }
 
   //
   // There are proxy certificates
   xsig = xcer;
   node = node->Next();
   while (node && (plen == -1 || plen > 0)) {
 
      // Attache to certificate
      xcer = node->Cert();
 
      //
      // Must be a recognized proxy certificate
      if (xcer && xcer->type != XrdCryptoX509::kProxy) {
         errcode = kInvalidProxy;
         lastError = X509ChainError(errcode);
         return 0;
      }
 
      // Proxy subject name must follow some rules
      if (!SubjectOK(errcode, xcer))
         return 0;
 
      // Check if ProxyCertInfo extension is there (required by RFC3820)
      int pxplen = -1; bool b;
      if (opt & kOptsRfc3820) {
         const void *extdata = xcer->GetExtension(gsiProxyCertInfo_OID);
         if (!extdata) extdata = xcer->GetExtension(gsiProxyCertInfo_OLD_OID);
         if (!extdata || !cfact || !(cfact && (*(cfact->ProxyCertInfo()))(extdata, pxplen, &b))) {
            errcode = kMissingExtension;
            lastError = "rfc3820: ";
            lastError += X509ChainError(errcode);
            return 0;
         }
      }
      // Update plen, if needed
      if (plen == -1) {
         plen = (pxplen > -1) ? pxplen : plen;
      } else {
         plen--;
         // Aply stricter rules if required
         plen = (pxplen > -1 && pxplen < plen) ? pxplen : plen;
      }
 
      // Standard verification
      if (!XrdCryptoX509Chain::Verify(errcode, "Proxy: ",
                                      XrdCryptoX509::kProxy, when, xcer, xsig))
         return 0;
 
      // Get next
      xsig = xcer;
      node = node->Next();
   }
 
   // We are done (successfully!)
   return 1;
}

References XrdCryptoX509Chain::begin, XrdCryptoX509ChainNode::Cert(), x509ChainVerifyOpt_t::crl, DEBUG, XrdCryptoX509Chain::Dump(), EPNAME, XrdCryptoX509::GetExtension(), gsiProxyCertInfo_OID, gsiProxyCertInfo_OLD_OID, XrdCryptoX509Chain::kAbsent, XrdCryptoX509::kCA, XrdCryptoX509::kEEC, XrdCryptoX509Chain::kInconsistent, XrdCryptoX509Chain::kInvalid, XrdCryptoX509Chain::kInvalidProxy, XrdCryptoX509Chain::kMissingExtension, XrdCryptoX509Chain::kNoCA, XrdCryptoX509Chain::kNoEEC, XrdCryptoX509Chain::kNone, kOptsCheckSubCA, kOptsRfc3820, XrdCryptoX509::kProxy, XrdCryptoX509Chain::kTooMany, XrdCryptoX509Chain::kTooManyEEC, XrdCryptoX509::kUnknown, XrdCryptoX509Chain::kUnknown, XrdCryptoX509Chain::kValid, XrdCryptoX509Chain::lastError, XrdCryptoX509ChainNode::Next(), x509ChainVerifyOpt_t::opt, x509ChainVerifyOpt_t::pathlen, XrdCryptoFactory::ProxyCertInfo(), QTRACE, XrdCryptoX509Chain::Reorder(), XrdCryptoX509Chain::size, XrdCryptoX509Chain::statusCA, XrdCryptoX509::type, XrdCryptoX509Chain::Verify(), x509ChainVerifyOpt_t::when, and XrdCryptoX509Chain::X509ChainError().

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

---

The documentation for this class was generated from the following files:

• XrdCryptogsiX509Chain.hh
• XrdCryptogsiX509Chain.cc