XrdCryptoX509Chain Class Reference

#include <XrdCryptoX509Chain.hh>

Inheritance diagram for XrdCryptoX509Chain:

Collaboration diagram for XrdCryptoX509Chain:

Public Types
enum	ECAStatus {   kUnknown = 0 ,   kAbsent ,   kInvalid ,   kValid }
enum	EX509ChainErr {   kNone = 0 ,   kInconsistent ,   kTooMany ,   kNoCA ,   kNoCertificate ,   kInvalidType ,   kInvalidNames ,   kRevoked ,   kExpired ,   kMissingExtension ,   kVerifyFail ,   kInvalidSign ,   kCANotAutoSigned ,   kNoEEC ,   kTooManyEEC ,   kInvalidProxy }

Public Member Functions
	XrdCryptoX509Chain (XrdCryptoX509 *c=0)
	XrdCryptoX509Chain (XrdCryptoX509Chain *ch)
virtual	~XrdCryptoX509Chain ()
XrdCryptoX509 *	Begin ()
const char *	CAhash ()
const char *	CAname ()
bool	CheckCA (bool checkselfsigned=1)
virtual int	CheckValidity (bool outatfirst=1, int when=0)
void	Cleanup (bool keepCA=0)
void	Dump ()
const char *	EEChash ()
const char *	EECname ()
XrdCryptoX509 *	EffCA () const
XrdCryptoX509 *	End () const
void	InsertAfter (XrdCryptoX509 *c, XrdCryptoX509 *cp)
const char *	LastError () const
XrdCryptoX509 *	Next ()
void	PushBack (XrdCryptoX509 *c)
void	PutInFront (XrdCryptoX509 *c)
void	Remove (XrdCryptoX509 *c)
virtual int	Reorder ()
XrdCryptoX509 *	SearchByIssuer (const char *issuer, ESearchMode mode=kExact)
XrdCryptoX509 *	SearchBySubject (const char *subject, ESearchMode mode=kExact)
void	SetStatusCA (ECAStatus st)
int	Size () const
ECAStatus	StatusCA () const
virtual bool	Verify (EX509ChainErr &e, x509ChainVerifyOpt_t *vopt=0)
const char *	X509ChainError (EX509ChainErr e)

Protected Member Functions
XrdCryptoX509ChainNode *	Find (XrdCryptoX509 *c)
XrdCryptoX509ChainNode *	FindIssuer (const char *issuer, ESearchMode mode=kExact, XrdCryptoX509ChainNode **p=0)
XrdCryptoX509ChainNode *	FindSubject (const char *subject, ESearchMode mode=kExact, XrdCryptoX509ChainNode **p=0)
void	SetEffectiveCA ()
bool	Verify (EX509ChainErr &e, const char *msg, XrdCryptoX509::EX509Type type, int when, XrdCryptoX509 *xcer, XrdCryptoX509 *xsig, XrdCryptoX509Crl *crl=0)

Protected Attributes
XrdCryptoX509ChainNode *	begin
XrdOucString	cahash
XrdOucString	caname
XrdCryptoX509ChainNode *	current
XrdOucString	eechash
XrdOucString	eecname
XrdCryptoX509ChainNode *	effca
XrdCryptoX509ChainNode *	end
XrdOucString	lastError
XrdCryptoX509ChainNode *	previous
int	size
ECAStatus	statusCA

Detailed Description

Definition at line 80 of file XrdCryptoX509Chain.hh.

Member Enumeration Documentation

ECAStatus

enum XrdCryptoX509Chain::ECAStatus

Enumerator
kUnknown
kAbsent
kInvalid
kValid

Definition at line 90 of file XrdCryptoX509Chain.hh.

{ kUnknown = 0, kAbsent, kInvalid, kValid};

EX509ChainErr

enum XrdCryptoX509Chain::EX509ChainErr

Enumerator
kNone
kInconsistent
kTooMany
kNoCA
kNoCertificate
kInvalidType
kInvalidNames
kRevoked
kExpired
kMissingExtension
kVerifyFail
kInvalidSign
kCANotAutoSigned
kNoEEC
kTooManyEEC
kInvalidProxy

Definition at line 93 of file XrdCryptoX509Chain.hh.

                      { kNone = 0, kInconsistent, kTooMany, kNoCA,
                        kNoCertificate, kInvalidType, kInvalidNames,
                        kRevoked, kExpired, kMissingExtension,
                        kVerifyFail, kInvalidSign, kCANotAutoSigned,
                        kNoEEC, kTooManyEEC, kInvalidProxy };

Constructor & Destructor Documentation

XrdCryptoX509Chain() [1/2]

XrdCryptoX509Chain::XrdCryptoX509Chain

(

XrdCryptoX509 *

c = 0

)

Definition at line 66 of file XrdCryptoX509Chain.cc.

{
   // Constructor
 
   previous = 0;
   current = 0;
   begin = 0;
   end = 0;
   effca = 0;
   size = 0; 
   lastError = "";
   caname = "";
   eecname = "";
   cahash = "";
   eechash = "";
   statusCA = kUnknown;
 
   if (c) {
      XrdCryptoX509ChainNode *f = new XrdCryptoX509ChainNode(c,0);
      current = begin = end = f;
      size++;
      //
      // If CA verify it and save result
      if (c->type == XrdCryptoX509::kCA) {
         caname = c->Subject();
         cahash = c->SubjectHash();
         EX509ChainErr ecode = kNone;
         if (!Verify(ecode, "CA: ",XrdCryptoX509::kCA, 0, c, c))
            statusCA = kInvalid;
         else
            statusCA = kValid;
      }
      // Search for the effective CA 
      SetEffectiveCA();
   }
} 

References begin, cahash, caname, current, eechash, eecname, effca, end, XrdCryptoX509::kCA, kInvalid, kNone, kUnknown, kValid, lastError, previous, SetEffectiveCA(), size, statusCA, XrdCryptoX509::Subject(), XrdCryptoX509::SubjectHash(), XrdCryptoX509::type, and Verify().

Here is the call graph for this function:

XrdCryptoX509Chain() [2/2]

XrdCryptoX509Chain::XrdCryptoX509Chain

(

XrdCryptoX509Chain *

ch

)

Definition at line 104 of file XrdCryptoX509Chain.cc.

{
   // Copy constructor
 
   previous = 0;
   current = 0;
   begin = 0;
   end = 0;
   effca = 0;
   size = 0; 
   lastError = ch->LastError();
   caname = ch->CAname();
   eecname = ch->EECname();
   cahash = ch->CAhash();
   eechash = ch->EEChash();
   statusCA = ch->StatusCA(); 
 
   XrdCryptoX509 *c = ch->Begin();
   while (c) {
      XrdCryptoX509ChainNode *nc = new XrdCryptoX509ChainNode(c,0);
      if (!begin)
         begin = nc;
      if (end)
         end->SetNext(nc);
      end = nc;
      if (c == ch->EffCA()) effca = nc;
      size++;
      // Go to Next
      c = ch->Next();
   }
}

References Begin(), begin, CAhash(), cahash, CAname(), caname, current, EEChash(), eechash, EECname(), eecname, EffCA(), effca, end, LastError(), lastError, Next(), previous, XrdCryptoX509ChainNode::SetNext(), size, StatusCA(), and statusCA.

Here is the call graph for this function:

~XrdCryptoX509Chain()

XrdCryptoX509Chain::~XrdCryptoX509Chain ( )

virtual

Definition at line 137 of file XrdCryptoX509Chain.cc.

{
   // Destructor
 
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *c = begin;
   while (c) {
      n = c->Next();
      delete (c);
      c = n;
   }
}

References begin, and XrdCryptoX509ChainNode::Next().

Here is the call graph for this function:

Member Function Documentation

Begin()

XrdCryptoX509 * XrdCryptoX509Chain::Begin

(

)

Definition at line 380 of file XrdCryptoX509Chain.cc.

{ 
   // Iterator functionality: init
 
   previous = 0;
   current = begin;
   if (current)
      return current->Cert();
   return (XrdCryptoX509 *)0;
}

References begin, XrdCryptoX509ChainNode::Cert(), current, and previous.

Referenced by XrdCryptoX509Chain(), XrdSecProtocolgsi::getCredentials(), main(), XrdVomsFun::VOMSFun(), XrdCryptosslX509ExportChain(), XrdCryptosslX509ParseBucket(), XrdCryptosslX509ParseFile(), and XrdCryptosslX509VerifyChain().

Here is the call graph for this function:

Here is the caller graph for this function:

CAhash()

const char * XrdCryptoX509Chain::CAhash

(

)

Definition at line 891 of file XrdCryptoX509Chain.cc.

{
   // Return the subject name hash of the CA in the chain
   EPNAME("X509Chain::CAhash");
 
   // If we do not have it already, try extraction
   if (cahash.length() <= 0 && statusCA == kUnknown) {
 
      if (!CheckCA()) {
         DEBUG("CA not found in chain");
         return (const char *)0;
      }
   }
 
   // return what we have
   return (cahash.length() > 0) ? cahash.c_str() : (const char *)0;
}

References XrdOucString::c_str(), cahash, CheckCA(), DEBUG, EPNAME, kUnknown, XrdOucString::length(), and statusCA.

Referenced by XrdCryptoX509Chain().

Here is the call graph for this function:

Here is the caller graph for this function:

CAname()

const char * XrdCryptoX509Chain::CAname

(

)

Definition at line 845 of file XrdCryptoX509Chain.cc.

{
   // Return subject name of the CA in the chain
   EPNAME("X509Chain::CAname");
 
   // If we do not have it already, try extraction
   if (caname.length() <= 0 && statusCA == kUnknown) {
 
      if (!CheckCA()) {
         DEBUG("CA not found in chain");
         return (const char *)0;
      }
   }
 
   // return what we have
   return (caname.length() > 0) ? caname.c_str() : (const char *)0;
}

References XrdOucString::c_str(), caname, CheckCA(), DEBUG, EPNAME, kUnknown, XrdOucString::length(), and statusCA.

Referenced by XrdCryptoX509Chain(), and Dump().

Here is the call graph for this function:

Here is the caller graph for this function:

CheckCA()

bool XrdCryptoX509Chain::CheckCA

(

bool

checkselfsigned = 1

)

Definition at line 183 of file XrdCryptoX509Chain.cc.

{
   // Search the list for a valid CA and set it at top.
   // Search stops when a valid CA is found; an invalid CA is flagged.
   // A second CA is always ignored.
   // Signature check failures are accepted if 'checkselfsigned' is false.
   // Return 1 if found, 0 otherwise; lastError is filled with the reason of
   // failure, if any.
 
   XrdCryptoX509 *xc = 0;
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *c = begin;
   XrdCryptoX509ChainNode *p = 0;
   lastError = "";
   while (c) {
      n = c->Next();
      xc = c->Cert();
      if (xc && xc->type == XrdCryptoX509::kCA) {
         caname = xc->Subject();
         cahash = xc->SubjectHash();
         EX509ChainErr ecode = kNone;
         bool CAok = Verify(ecode, "CA: ",XrdCryptoX509::kCA, 0, xc, xc);
         if (!CAok && (ecode != kVerifyFail || checkselfsigned)) {
            statusCA = kInvalid;
            lastError += X509ChainError(ecode);
         } else {
            statusCA = kValid;
            if (p) {
               // Move at top
               p->SetNext(c->Next());
               c->SetNext(begin);
               if (end == c) end = p;
               begin = c;
            }
            return 1;
         }
      }
      p = c;  // Previous node
      c = n;
   }
 
   // Found nothing
   return 0;
}

References begin, cahash, caname, XrdCryptoX509ChainNode::Cert(), end, XrdCryptoX509::kCA, kInvalid, kNone, kValid, kVerifyFail, lastError, XrdCryptoX509ChainNode::Next(), XrdCryptoX509ChainNode::SetNext(), statusCA, XrdCryptoX509::Subject(), XrdCryptoX509::SubjectHash(), XrdCryptoX509::type, Verify(), and X509ChainError().

Referenced by CAhash(), CAname(), and Verify().

Here is the call graph for this function:

Here is the caller graph for this function:

CheckValidity()

int XrdCryptoX509Chain::CheckValidity ( bool  outatfirst = 1, int  when = 0  )

virtual

Definition at line 747 of file XrdCryptoX509Chain.cc.

{
   // Check validity at 'when' of certificates in the chain and return
   // the number of invalid certificates.
   // If 'outatfirst' return after the first invalid has been
   // found.
   EPNAME("X509Chain::CheckValidity");
   int ninv = 0;
 
   // Do nothing if empty 
   if (size < 1) {
      DEBUG("Nothing to verify (size: "<<size<<")");
      return ninv;
   }
 
   // Loop over the certificates
   XrdCryptoX509ChainNode *nc = begin;
   while (nc) {
      //
      XrdCryptoX509 *c = nc->Cert();
      if (c) {
         if (!(c->IsValid(when))) {
            ninv++;
            DEBUG("invalid certificate found");
            if (outatfirst)
               return ninv;
         }
      } else {
         ninv++;
         DEBUG("found node without certificate");
         if (outatfirst)
            return ninv;
      }
      // Get next      
      nc = nc->Next();
   }
 
   // We are done
   return ninv;
}

References begin, XrdCryptoX509ChainNode::Cert(), DEBUG, EPNAME, XrdCryptoX509::IsValid(), XrdCryptoX509ChainNode::Next(), and size.

Referenced by GetCACheck(), and QueryProxyCheck().

Here is the call graph for this function:

Here is the caller graph for this function:

Cleanup()

void XrdCryptoX509Chain::Cleanup

(

bool

keepCA = 0

)

Definition at line 151 of file XrdCryptoX509Chain.cc.

{
   // Destructs content of nodes AND their content
   // If keepCA is true, the top CA is kept
 
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *c = begin;
   while (c) {
      n = c->Next();
      if (c->Cert() &&
         (!keepCA || (c->Cert()->type != XrdCryptoX509::kCA)))
         delete (c->Cert());
      delete (c);
      c = n;
   }
 
   // Reset
   previous = 0;
   current = 0;
   begin = 0;
   end = 0;
   effca = 0;
   size = 0; 
   lastError = "";
   caname = "";
   eecname = "";
   cahash = "";
   eechash = "";
   statusCA = kUnknown;
}

References begin, cahash, caname, XrdCryptoX509ChainNode::Cert(), current, eechash, eecname, effca, end, XrdCryptoX509::kCA, kUnknown, lastError, XrdCryptoX509ChainNode::Next(), previous, size, statusCA, and XrdCryptoX509::type.

Referenced by gsiHSVars::~gsiHSVars(), and XrdSecProtocolgsi::Delete().

Here is the call graph for this function:

Here is the caller graph for this function:

Dump()

void XrdCryptoX509Chain::Dump

(

)

Definition at line 523 of file XrdCryptoX509Chain.cc.

{
   // Dump content
   EPNAME("X509Chain::Dump");
 
   LOCDUMP("//------------------Dumping X509 chain content ------------------//");
   LOCDUMP("//");
   LOCDUMP("// Chain instance: "<<this);
   LOCDUMP("//");
   LOCDUMP("// Number of certificates: "<<Size());
   LOCDUMP("//");
   if (CAname()) {
      LOCDUMP("// CA:  "<<CAname());
   } else {
      LOCDUMP("// CA: absent");
   }
   if (EECname()) {
      LOCDUMP("// EEC:  "<<EECname());
   } else {
      LOCDUMP("// EEC: absent");
   }
   LOCDUMP("//");
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *c = begin;
   while (c) {
      n = c->Next();
      if (c->Cert()) {
         LOCDUMP("// Issuer: "<<c->Cert()->IssuerHash()<<
               " Subject: "<<c->Cert()->SubjectHash()<<
                  " Type: "<<c->Cert()->Type());
      }
      c = n;
   }
   LOCDUMP("//");
   LOCDUMP("//---------------------------- END ------------------------------//")
}

References begin, CAname(), XrdCryptoX509ChainNode::Cert(), EECname(), EPNAME, XrdCryptoX509::IssuerHash(), LOCDUMP, XrdCryptoX509ChainNode::Next(), Size(), XrdCryptoX509::SubjectHash(), and XrdCryptoX509::Type().

Referenced by main(), and XrdCryptogsiX509Chain::Verify().

Here is the call graph for this function:

Here is the caller graph for this function:

EEChash()

const char * XrdCryptoX509Chain::EEChash

(

)

Definition at line 910 of file XrdCryptoX509Chain.cc.

{
   // Return the subject name hash of the EEC in the chain
   EPNAME("X509Chain::EEChash");
 
   // If we do not have it already, try extraction
   if (eechash.length() <= 0) {
 
      XrdCryptoX509ChainNode *c = begin;
      while (c) {
         if (c->Cert()->type == XrdCryptoX509::kEEC) {
            eechash = c->Cert()->SubjectHash();
            break;
         }
         c = c->Next();
      }
      if (eechash.length() <= 0) {
         DEBUG("EEC not found in chain");
         return (const char *)0;
      }
   }
 
   // return what we have
   return (eechash.length() > 0) ? eechash.c_str() : (const char *)0;
}

References begin, XrdOucString::c_str(), XrdCryptoX509ChainNode::Cert(), DEBUG, eechash, EPNAME, XrdCryptoX509::kEEC, XrdOucString::length(), XrdCryptoX509ChainNode::Next(), XrdCryptoX509::SubjectHash(), and XrdCryptoX509::type.

Referenced by XrdCryptoX509Chain(), and XrdSecProtocolgsi::Authenticate().

Here is the call graph for this function:

Here is the caller graph for this function:

EECname()

const char * XrdCryptoX509Chain::EECname

(

)

Definition at line 864 of file XrdCryptoX509Chain.cc.

{
   // Return subject name of the EEC in the chain
   EPNAME("X509Chain::EECname");
 
   // If we do not have it already, try extraction
   if (eecname.length() <= 0) {
 
      XrdCryptoX509ChainNode *c = begin;
      while (c) {
         if (c->Cert()->type == XrdCryptoX509::kEEC) {
            eecname = c->Cert()->Subject();
            break;
         }
         c = c->Next();
      }
      if (eecname.length() <= 0) {
         DEBUG("EEC not found in chain");
         return (const char *)0;
      }
   }
 
   // return what we have
   return (eecname.length() > 0) ? eecname.c_str() : (const char *)0;
}

References begin, XrdOucString::c_str(), XrdCryptoX509ChainNode::Cert(), DEBUG, eecname, EPNAME, XrdCryptoX509::kEEC, XrdOucString::length(), XrdCryptoX509ChainNode::Next(), XrdCryptoX509::Subject(), and XrdCryptoX509::type.

Referenced by XrdCryptoX509Chain(), XrdSecProtocolgsi::Authenticate(), and Dump().

Here is the call graph for this function:

Here is the caller graph for this function:

EffCA()

XrdCryptoX509* XrdCryptoX509Chain::EffCA ( ) const

inline

Definition at line 114 of file XrdCryptoX509Chain.hh.

{ return effca ? effca->Cert() : (XrdCryptoX509 *)0; }

References XrdCryptoX509ChainNode::Cert(), and effca.

Referenced by XrdCryptoX509Chain().

Here is the call graph for this function:

Here is the caller graph for this function:

End()

XrdCryptoX509* XrdCryptoX509Chain::End ( ) const

inline

Definition at line 108 of file XrdCryptoX509Chain.hh.

{ return end->Cert(); }

References XrdCryptoX509ChainNode::Cert(), and end.

Referenced by XrdSecProtocolgsi::Authenticate(), main(), XrdVomsFun::VOMSFun(), XrdCryptosslX509ChainToFile(), XrdCryptosslX509ExportChain(), and XrdSecgsiAuthzKey().

Here is the call graph for this function:

Here is the caller graph for this function:

Find()

XrdCryptoX509ChainNode * XrdCryptoX509Chain::Find ( XrdCryptoX509 *  c )

protected

Definition at line 237 of file XrdCryptoX509Chain.cc.

{
   // Find node containing bucket b
 
   XrdCryptoX509ChainNode *nd = begin;
   for (; nd; nd = nd->Next()) {
      if (nd->Cert() == c)
         return nd;
   }
   return (XrdCryptoX509ChainNode *)0;
}

References begin, XrdCryptoX509ChainNode::Cert(), and XrdCryptoX509ChainNode::Next().

Referenced by InsertAfter(), PushBack(), and PutInFront().

Here is the call graph for this function:

Here is the caller graph for this function:

FindIssuer()

XrdCryptoX509ChainNode * XrdCryptoX509Chain::FindIssuer ( const char *  issuer, ESearchMode  mode = kExact, XrdCryptoX509ChainNode **  p = 0  )

protected

Definition at line 433 of file XrdCryptoX509Chain.cc.

{ 
   // Return first chain node with certificate having issuer
   // Match according to mode.
 
   // Make sure we got something to compare
   if (!issuer) 
      return (XrdCryptoX509ChainNode *)0;
 
   XrdCryptoX509ChainNode *cp = 0;
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *cn = begin;
   XrdCryptoX509 *c = 0;
   while (cn) {
      n = cn->Next();
      c = cn->Cert();
      if(c) {
        const char *pi = c->Issuer();
        if (pi) {
           if (mode == kExact) {
              if (!strcmp(pi, issuer))
                 break;
           } else if (mode == kBegin) {
              if (strstr(pi, issuer) == c->Issuer())
                 break;
           } else if (mode == kEnd) {
              int ibeg = strlen(pi) - strlen(issuer);
              if (!strcmp(pi + ibeg, issuer))
                 break;
           }
        }
      }
      c = 0;
      cp = cn;  // previous
      cn = n;
   }
   // return previous, if requested
   if (prev)
      *prev = (cn) ? cp : 0;
 
   // We are done
   return ((cn) ? cn : (XrdCryptoX509ChainNode *)0);
}

References begin, XrdCryptoX509ChainNode::Cert(), XrdCryptoX509::Issuer(), and XrdCryptoX509ChainNode::Next().

Referenced by SearchByIssuer().

Here is the call graph for this function:

Here is the caller graph for this function:

FindSubject()

XrdCryptoX509ChainNode * XrdCryptoX509Chain::FindSubject ( const char *  subject, ESearchMode  mode = kExact, XrdCryptoX509ChainNode **  p = 0  )

protected

Definition at line 479 of file XrdCryptoX509Chain.cc.

{ 
   // Return first chain node with certificate having subject
   // Match according to mode.
 
   // Make sure we got something to compare
   if (!subject) 
      return (XrdCryptoX509ChainNode *)0;
 
   XrdCryptoX509ChainNode *cp = 0;
   XrdCryptoX509ChainNode *n = 0;
   XrdCryptoX509ChainNode *cn = begin;
   XrdCryptoX509 *c = 0;
   while (cn) {
      n = cn->Next();
      c = cn->Cert();
      const char *ps = c ? c->Subject() : 0;
      if (c && ps) {
         if (mode == kExact) {
            if (!strcmp(ps, subject))
               break;
         } else if (mode == kBegin) {
            if (strstr(ps, subject) == ps)
               break;
         } else if (mode == kEnd) {
            int sbeg = strlen(ps) - strlen(subject);
            if (!strcmp(ps + sbeg, subject))
               break;
         }
      }
      c = 0;
      cp = cn;  // previous
      cn = n;
   }
   // return previous, if requested
   if (prev)
      *prev = (cn) ? cp : 0;
 
   // We are done
   return ((cn) ? cn : (XrdCryptoX509ChainNode *)0);
}

References begin, XrdCryptoX509ChainNode::Cert(), XrdCryptoX509ChainNode::Next(), and XrdCryptoX509::Subject().

Referenced by Reorder(), and SearchBySubject().

Here is the call graph for this function:

Here is the caller graph for this function:

InsertAfter()

void XrdCryptoX509Chain::InsertAfter	(	XrdCryptoX509 *	c,
		XrdCryptoX509 *	cp
	)

Definition at line 268 of file XrdCryptoX509Chain.cc.

{
   // Add or move certificate 'c' after certificate 'cp'; if 'cp' is not
   // in the list, push-back
 
   XrdCryptoX509ChainNode *nc = Find(c);
   XrdCryptoX509ChainNode *ncp = Find(cp);
   if (ncp) {
      // Create a new node, if not there
      if (!nc) {
         nc = new XrdCryptoX509ChainNode(c,ncp->Next());
         size++;
      }
      // Update pointers
      ncp->SetNext(nc);
      if (end == ncp)
         end = nc;
 
   } else {
      // Reference certificate not in the list
      // If new, add in last position; otherwise leave it where it is
      if (!nc)
         PushBack(c);
   }
 
   // Search for the effective CA (the last one, in case of subCAs)
   SetEffectiveCA();
}

References end, Find(), XrdCryptoX509ChainNode::Next(), PushBack(), SetEffectiveCA(), XrdCryptoX509ChainNode::SetNext(), and size.

Here is the call graph for this function:

LastError()

const char* XrdCryptoX509Chain::LastError ( ) const

inline

Definition at line 101 of file XrdCryptoX509Chain.hh.

{ return lastError.c_str(); }

References XrdOucString::c_str(), and lastError.

Referenced by XrdCryptoX509Chain(), and main().

Here is the call graph for this function:

Here is the caller graph for this function:

Next()

XrdCryptoX509 * XrdCryptoX509Chain::Next

(

)

Definition at line 392 of file XrdCryptoX509Chain.cc.

{ 
   // Iterator functionality: get next
 
   previous = current;
   if (current) {
      current = current->Next();
      if (current)
         return current->Cert();
   }
   return (XrdCryptoX509 *)0;
}

References XrdCryptoX509ChainNode::Cert(), current, XrdCryptoX509ChainNode::Next(), and previous.

Referenced by XrdCryptoX509Chain(), XrdSecProtocolgsi::getCredentials(), XrdVomsFun::VOMSFun(), XrdCryptosslX509ParseBucket(), XrdCryptosslX509ParseFile(), and XrdCryptosslX509VerifyChain().

Here is the call graph for this function:

Here is the caller graph for this function:

PushBack()

void XrdCryptoX509Chain::PushBack

(

XrdCryptoX509 *

c

)

Definition at line 298 of file XrdCryptoX509Chain.cc.

{
   // Add at the end of the list
   // Check to avoid duplicates
 
   if (!Find(c)) {
      XrdCryptoX509ChainNode *nc = new XrdCryptoX509ChainNode(c,0);
      if (!begin)
         begin = nc;
      if (end)
         end->SetNext(nc);
      end = nc;
      size++;
   } else if (c) {
      delete c;
   }
 
   // Search for the effective CA (the last one, in case of subCAs)
   SetEffectiveCA();
}

References begin, end, Find(), SetEffectiveCA(), XrdCryptoX509ChainNode::SetNext(), and size.

Referenced by InsertAfter(), main(), XrdCryptosslX509ParseBucket(), XrdCryptosslX509ParseFile(), and XrdCryptosslX509ParseStack().

Here is the call graph for this function:

Here is the caller graph for this function:

PutInFront()

void XrdCryptoX509Chain::PutInFront

(

XrdCryptoX509 *

c

)

Definition at line 250 of file XrdCryptoX509Chain.cc.

{
   // Add at the beginning of the list
   // Check to avoid duplicates
 
   if (!Find(c)) {
      XrdCryptoX509ChainNode *nc = new XrdCryptoX509ChainNode(c,begin);
      begin = nc;
      if (!end)
         end = nc;
      size++;
   }
 
   // Search for the effective CA (the last one, in case of subCAs)
   SetEffectiveCA();
}

References begin, end, Find(), SetEffectiveCA(), and size.

Here is the call graph for this function:

Remove()

void XrdCryptoX509Chain::Remove

(

XrdCryptoX509 *

c

)

Definition at line 320 of file XrdCryptoX509Chain.cc.

{
   // Remove node containing bucket b
 
   XrdCryptoX509ChainNode *curr = current;
   XrdCryptoX509ChainNode *prev = previous;
 
   if (!curr || curr->Cert() != c || (prev && curr != prev->Next())) {
      // We need first to find the address
      curr = begin;
      prev = 0;
      for (; curr; curr = curr->Next()) {
         if (curr->Cert() == c)
            break;
         prev = curr;
      }
   }
 
   // The certificate is not in the list
   if (!curr)
      return;
 
   //
   // If this was the top CA update the related information
   if (c->type == XrdCryptoX509::kCA && curr == begin) {
      // There may be other CAs in the chain, but we will
      // check when needed
      statusCA = kUnknown;
      caname = "";
      cahash = "";
   }
 
   // Now we have all the information to remove
   if (prev) {
      if (curr != end) {
         current  = curr->Next();
         prev->SetNext(current);
         previous = prev;
      } else {
         end = prev;
         previous = end;
         current = 0;
         prev->SetNext(current);
      }
   } else if (curr == begin) {
      // First buffer
      current  = curr->Next();
      begin = current;
      previous = 0;
   }
 
   // Cleanup and update size
   delete curr;
   size--;
 
   // Search for the effective CA (the last one, in case of subCAs)
   SetEffectiveCA();
}

References begin, cahash, caname, XrdCryptoX509ChainNode::Cert(), current, end, XrdCryptoX509::kCA, kUnknown, XrdCryptoX509ChainNode::Next(), previous, SetEffectiveCA(), XrdCryptoX509ChainNode::SetNext(), size, statusCA, and XrdCryptoX509::type.

Here is the call graph for this function:

Reorder()

int XrdCryptoX509Chain::Reorder ( )

virtual

Definition at line 561 of file XrdCryptoX509Chain.cc.

{ 
   // Reorder certificates in such a way that certificate n is the
   // issuer of certificate n+1 .
   // Return -1 if inconsistencies are found.
   EPNAME("X509Chain::Reorder");
 
   if (size < 2) {
      DEBUG("Nothing to reorder (size: "<<size<<")");
      // Search for the effective CA (the last one, in case of subCAs)
      SetEffectiveCA();
      return 0;
   }
 
   // Loop over the certificates
   XrdCryptoX509ChainNode *nc = 0, *np = 0, *nn = 0, *nr = 0, *npp = 0;
 
   // Look for the first one, if needed
   nr = begin;
   np = nr;
   while (nr) {
      //
      if (!(nn = FindSubject(nr->Cert()->Issuer(),kExact,&npp)) ||
            nn == nr)
         break;
      np = nr;
      nr = nr->Next();
   }
 
   // Move it in first position if not yet there
   if (nr && nr != begin) {
      np->SetNext(nr->Next()); // short cut old position
      nr->SetNext(begin);      // set our next to present begin
      if (end == nr)           // Update end
         end = np;
      begin = nr;              // set us as begin
      // Flag if not CA: we do not check validity here
      if (nr->Cert()->type != XrdCryptoX509::kCA) {
         statusCA = kAbsent;
      } else if (caname.length() <= 0) {
         // Set the CA properties only if not done already to avoid overwriting
         // the result of previous analysis
         caname = nr->Cert()->Subject();
         cahash = nr->Cert()->SubjectHash();
         statusCA = kUnknown;
      }
   }
 
   int left = size-1;
   np = begin;
   while (np) {
      if (np->Cert()) {
         const char *pi = np->Cert()->Subject();
         // Set the EEC name, if not yet done
         if (np->Cert()->type == XrdCryptoX509::kEEC && eecname.length() <= 0) {
            eecname = pi;
            eechash = np->Cert()->SubjectHash();
         }
         npp = np;
         nc = np->Next();
         while (nc) {
            if (nc->Cert() && !strcmp(pi, nc->Cert()->Issuer())) {
               left--;
               if (npp != np) {
                  npp->SetNext(nc->Next()); // drop child from previous pos
                  nc->SetNext(np->Next());  // set child next as our present
                  np->SetNext(nc);          // set our next as child
                  if (nc == end)
                     end = npp;
               }
               break;
            }
            npp = nc;
            nc = nc->Next();
         }
      }
      np = np->Next();
   }
 
   // Search for the effective CA (the last one, in case of subCAs)
   SetEffectiveCA();
 
   // Check consistency
   if (left > 0) {
      DEBUG("Inconsistency found: "<<left<<
            " certificates could not be correctly enchained!");
      return -1;
   }
 
   // We are done
   return 0;
} 

References begin, cahash, caname, XrdCryptoX509ChainNode::Cert(), DEBUG, eechash, eecname, end, EPNAME, FindSubject(), XrdCryptoX509::Issuer(), kAbsent, XrdCryptoX509::kCA, XrdCryptoX509::kEEC, kUnknown, XrdOucString::length(), XrdCryptoX509ChainNode::Next(), SetEffectiveCA(), XrdCryptoX509ChainNode::SetNext(), size, statusCA, and XrdCryptoX509::Subject().

Referenced by main(), XrdCryptogsiX509Chain::Verify(), Verify(), XrdCryptosslX509ChainToFile(), XrdCryptosslX509ExportChain(), XrdCryptosslX509ParseStack(), and XrdSecgsiAuthzKey().

Here is the call graph for this function:

Here is the caller graph for this function:

SearchByIssuer()

XrdCryptoX509 * XrdCryptoX509Chain::SearchByIssuer	(	const char *	issuer,
		ESearchMode	mode = kExact
	)

Definition at line 406 of file XrdCryptoX509Chain.cc.

{ 
   // Return first certificate in the chain with issuer
   // Match according to mode.
 
   XrdCryptoX509ChainNode *cn = FindIssuer(issuer, mode);
 
   // We are done
   return ((cn) ? cn->Cert() : (XrdCryptoX509 *)0);
}

References XrdCryptoX509ChainNode::Cert(), and FindIssuer().

Here is the call graph for this function:

SearchBySubject()

XrdCryptoX509 * XrdCryptoX509Chain::SearchBySubject	(	const char *	subject,
		ESearchMode	mode = kExact
	)

Definition at line 419 of file XrdCryptoX509Chain.cc.

{ 
   // Return first certificate in the chain with subject
   // Match according to mode.
 
   XrdCryptoX509ChainNode *cn = FindSubject(subject, mode);
 
   // We are done
   return ((cn) ? cn->Cert() : (XrdCryptoX509 *)0);
 
}

References XrdCryptoX509ChainNode::Cert(), and FindSubject().

Referenced by XrdCryptosslX509ChainToFile(), and XrdCryptosslX509ExportChain().

Here is the call graph for this function:

Here is the caller graph for this function:

SetEffectiveCA()

void XrdCryptoX509Chain::SetEffectiveCA ( )

protected

Definition at line 655 of file XrdCryptoX509Chain.cc.

{
   // Search for the effective CA (the last one, in case of subCAs)
   effca = 0; caname = ""; cahash = "";
 
   XrdCryptoX509ChainNode *np = begin;
   while (np) {
      if (np->Cert()) {
         if (np->Cert()->type == XrdCryptoX509::kCA) {
            if (!effca || (effca &&
                          !(strcmp(effca->Cert()->SubjectHash(),
                                   np->Cert()->IssuerHash())))) effca = np;
         }
      }
      np = np->Next();
   }
   if (effca && effca->Cert()) {
      caname = effca->Cert()->Subject();
      cahash = effca->Cert()->SubjectHash();
   }
}

References begin, cahash, caname, XrdCryptoX509ChainNode::Cert(), effca, XrdCryptoX509::IssuerHash(), XrdCryptoX509::kCA, XrdCryptoX509ChainNode::Next(), XrdCryptoX509::Subject(), XrdCryptoX509::SubjectHash(), and XrdCryptoX509::type.

Referenced by XrdCryptoX509Chain(), InsertAfter(), PushBack(), PutInFront(), Remove(), and Reorder().

Here is the call graph for this function:

Here is the caller graph for this function:

SetStatusCA()

void XrdCryptoX509Chain::SetStatusCA ( ECAStatus  st )

inline

Definition at line 123 of file XrdCryptoX509Chain.hh.

{ statusCA = st; }

References statusCA.

Size()

int XrdCryptoX509Chain::Size ( ) const

inline

Definition at line 107 of file XrdCryptoX509Chain.hh.

{ return size; }

References size.

Referenced by Dump(), XrdCryptosslX509ExportChain(), XrdCryptosslX509ParseBucket(), XrdCryptosslX509ParseFile(), and XrdCryptosslX509VerifyChain().

Here is the caller graph for this function:

StatusCA()

ECAStatus XrdCryptoX509Chain::StatusCA ( ) const

inline

Definition at line 109 of file XrdCryptoX509Chain.hh.

{ return statusCA; }

References statusCA.

Referenced by XrdCryptoX509Chain().

Here is the caller graph for this function:

Verify() [1/2]

bool XrdCryptoX509Chain::Verify ( EX509ChainErr &  e, const char *  msg, XrdCryptoX509::EX509Type  type, int  when, XrdCryptoX509 *  xcer, XrdCryptoX509 *  xsig, XrdCryptoX509Crl *  crl = 0  )

protected

Definition at line 789 of file XrdCryptoX509Chain.cc.

{
   // Internal verification method
 
   // Certificate must be defined
   if (!xcer) {
      errcode = kNoCertificate;
      lastError = msg;
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   // Type should be the one expected
   if (type != XrdCryptoX509::kUnknown && xcer->type != type) {
      errcode = kInvalidType;
      lastError = msg;
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   // Must not be revoked (check only if required)
   if (crl) {
      // Get certificate serial number
      XrdOucString sn = xcer->SerialNumberString();
      if (crl->IsRevoked(sn.c_str(), when)) {
         errcode = kRevoked;
         lastError = msg;
         lastError += X509ChainError(errcode);
         return 0;
      }
   }
 
   // Check validity in time
   if (when >= 0 && !(xcer->IsValid(when))) {
      errcode = kExpired;
      lastError = msg;
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   // Check signature
   if (!xsig || !(xcer->Verify(xsig))) {
      errcode = kVerifyFail;
      lastError = msg;
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   // We are done
   return 1;
}

References XrdOucString::c_str(), XrdCryptoX509Crl::IsRevoked(), XrdCryptoX509::IsValid(), kExpired, kInvalidType, kNoCertificate, kRevoked, XrdCryptoX509::kUnknown, kVerifyFail, lastError, XrdCryptoX509::SerialNumberString(), XrdCryptoX509::type, XrdCryptoX509::Verify(), and X509ChainError().

Here is the call graph for this function:

Verify() [2/2]

bool XrdCryptoX509Chain::Verify ( EX509ChainErr &  e, x509ChainVerifyOpt_t *  vopt = 0  )

virtual

Reimplemented in XrdCryptogsiX509Chain.

Definition at line 678 of file XrdCryptoX509Chain.cc.

{
   // Verify cross signatures of the chain
   EPNAME("X509Chain::Verify");
   errcode = kNone; 
 
   // Do nothing if empty 
   if (size < 1) {
      DEBUG("Nothing to verify (size: "<<size<<")");
      return 0;
   }
 
   //
   // Reorder if needed
   if (Reorder() != 0) {
      errcode = kInconsistent;
      lastError = ":";
      lastError += X509ChainError(errcode);
      return 0;
   }
 
   //
   // Verification options
   int when = (vopt) ? vopt->when : (int)time(0);
   int plen = (vopt) ? vopt->pathlen : -1;
   bool chkss = (vopt) ? (vopt->opt & kOptsCheckSelfSigned) : 1;
 
   //
   // Global path depth length consistency check
   if (plen > -1 && plen < size) {
      errcode = kTooMany;
      lastError = "checking path depth: ";
      lastError += X509ChainError(errcode);
   }
 
   //
   // Check the first certificate: it MUST be of CA type, valid,
   // self-signed
   if (!CheckCA(chkss)) {
      errcode = kNoCA;
      lastError = X509ChainError(errcode);
      return 0;
   }
 
   //
   // Analyse the rest
   XrdCryptoX509ChainNode *node = begin;
   XrdCryptoX509 *xsig = node->Cert();    // Signing certificate
   XrdCryptoX509 *xcer = 0;               // Certificate under exam
   node = node->Next();
   while (node) {
 
      // Attache to certificate
      xcer = node->Cert();
 
      // Standard verification
      if (!Verify(errcode, "cert: ", XrdCryptoX509::kUnknown, when, xcer, xsig))
         return 0;
 
      // Get next
      xsig = xcer;
      node = node->Next();
   }
 
   // We are done (successfully!)
   return 1;
}

References begin, XrdCryptoX509ChainNode::Cert(), CheckCA(), DEBUG, EPNAME, kInconsistent, kNoCA, kNone, kOptsCheckSelfSigned, kTooMany, XrdCryptoX509::kUnknown, lastError, XrdCryptoX509ChainNode::Next(), x509ChainVerifyOpt_t::opt, x509ChainVerifyOpt_t::pathlen, Reorder(), size, x509ChainVerifyOpt_t::when, and X509ChainError().

Referenced by XrdCryptoX509Chain(), CheckCA(), main(), and XrdCryptogsiX509Chain::Verify().

Here is the call graph for this function:

Here is the caller graph for this function:

X509ChainError()

const char * XrdCryptoX509Chain::X509ChainError

(

EX509ChainErr

e

)

Definition at line 229 of file XrdCryptoX509Chain.cc.

{
   // Return error string
 
   return X509ChainErrStr[e];
}

References X509ChainErrStr.

Referenced by CheckCA(), XrdCryptogsiX509Chain::Verify(), and Verify().

Here is the caller graph for this function:

Member Data Documentation

begin

XrdCryptoX509ChainNode* XrdCryptoX509Chain::begin

protected

Definition at line 147 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), ~XrdCryptoX509Chain(), Begin(), CheckCA(), CheckValidity(), Cleanup(), Dump(), EEChash(), EECname(), Find(), FindIssuer(), FindSubject(), PushBack(), PutInFront(), Remove(), Reorder(), SetEffectiveCA(), XrdCryptogsiX509Chain::Verify(), and Verify().

cahash

XrdOucString XrdCryptoX509Chain::cahash

protected

Definition at line 156 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CAhash(), CheckCA(), Cleanup(), Remove(), Reorder(), and SetEffectiveCA().

caname

XrdOucString XrdCryptoX509Chain::caname

protected

Definition at line 154 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CAname(), CheckCA(), Cleanup(), Remove(), Reorder(), and SetEffectiveCA().

current

XrdCryptoX509ChainNode* XrdCryptoX509Chain::current

protected

Definition at line 148 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), Begin(), Cleanup(), Next(), and Remove().

eechash

XrdOucString XrdCryptoX509Chain::eechash

protected

Definition at line 157 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), Cleanup(), EEChash(), and Reorder().

eecname

XrdOucString XrdCryptoX509Chain::eecname

protected

Definition at line 155 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), Cleanup(), EECname(), and Reorder().

effca

XrdCryptoX509ChainNode* XrdCryptoX509Chain::effca

protected

Definition at line 151 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), Cleanup(), EffCA(), and SetEffectiveCA().

end

XrdCryptoX509ChainNode* XrdCryptoX509Chain::end

protected

Definition at line 149 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CheckCA(), Cleanup(), End(), InsertAfter(), PushBack(), PutInFront(), Remove(), and Reorder().

lastError

XrdOucString XrdCryptoX509Chain::lastError

protected

Definition at line 153 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CheckCA(), Cleanup(), LastError(), XrdCryptogsiX509Chain::Verify(), and Verify().

previous

XrdCryptoX509ChainNode* XrdCryptoX509Chain::previous

protected

Definition at line 150 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), Begin(), Cleanup(), Next(), and Remove().

size

int XrdCryptoX509Chain::size

protected

Definition at line 152 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CheckValidity(), Cleanup(), InsertAfter(), PushBack(), PutInFront(), Remove(), Reorder(), Size(), XrdCryptogsiX509Chain::Verify(), and Verify().

statusCA

ECAStatus XrdCryptoX509Chain::statusCA

protected

Definition at line 158 of file XrdCryptoX509Chain.hh.

Referenced by XrdCryptoX509Chain(), CAhash(), CAname(), CheckCA(), Cleanup(), Remove(), Reorder(), SetStatusCA(), StatusCA(), and XrdCryptogsiX509Chain::Verify().

---

The documentation for this class was generated from the following files:

• XrdCryptoX509Chain.hh
• XrdCryptoX509Chain.cc