|
1 /* |
|
2 * Copyright (c) 2002-2004 Nokia Corporation and/or its subsidiary(-ies). |
|
3 * All rights reserved. |
|
4 * This component and the accompanying materials are made available |
|
5 * under the terms of "Eclipse Public License v1.0" |
|
6 * which accompanies this distribution, and is available |
|
7 * at the URL "http://www.eclipse.org/legal/epl-v10.html". |
|
8 * |
|
9 * Initial Contributors: |
|
10 * Nokia Corporation - initial contribution. |
|
11 * |
|
12 * Contributors: |
|
13 * |
|
14 * Description: Implementation of policymanagement components |
|
15 * |
|
16 */ |
|
17 |
|
18 |
|
19 // INCLUDE FILES |
|
20 |
|
21 #include "TrustedSession.h" |
|
22 #include "XACMLconstants.h" |
|
23 #include "PolicyEngineServer.h" |
|
24 #include "PolicyParser.h" |
|
25 #include "elements.h" |
|
26 #include "DataTypes.h" |
|
27 #include "debug.h" |
|
28 #include "ErrorCodes.h" |
|
29 |
|
30 #include <x509cert.h> |
|
31 #include <imcvcodc.h> |
|
32 |
|
33 |
|
34 |
|
35 const TChar KCASNDelimeter = '-'; |
|
36 _LIT( KSecureIdString, "SECUREID"); |
|
37 |
|
38 |
|
39 CTrustedSession::CTrustedSession() |
|
40 : iSessionTrust( EFalse) |
|
41 { |
|
42 } |
|
43 |
|
44 // ----------------------------------------------------------------------------- |
|
45 // CTrustedSession::~CTrustedSession() |
|
46 // ----------------------------------------------------------------------------- |
|
47 // |
|
48 |
|
49 CTrustedSession::~CTrustedSession() |
|
50 { |
|
51 delete iCASN; |
|
52 } |
|
53 |
|
54 |
|
55 |
|
56 // ----------------------------------------------------------------------------- |
|
57 // CTrustedSession::NewL() |
|
58 // ----------------------------------------------------------------------------- |
|
59 // |
|
60 |
|
61 CTrustedSession * CTrustedSession::NewL() |
|
62 { |
|
63 CTrustedSession * self = new(ELeave) CTrustedSession(); |
|
64 return self; |
|
65 } |
|
66 |
|
67 // ----------------------------------------------------------------------------- |
|
68 // CTrustedSession::IsSessionCertificated() |
|
69 // ----------------------------------------------------------------------------- |
|
70 // |
|
71 void CTrustedSession::MakeSessionTrustL( const RMessage2& aMessage) |
|
72 { |
|
73 RDEBUG( "Policy Engine: Creating session trust"); |
|
74 |
|
75 if ( iSessionTrust ) |
|
76 { |
|
77 User::Leave( KErrAlreadyExists); |
|
78 } |
|
79 |
|
80 //Read certificate info to member |
|
81 TPckg<TCertInfo> certInfoPack( iSessionCertInfo); |
|
82 aMessage.ReadL(0, certInfoPack, 0); |
|
83 |
|
84 //turn session trust on |
|
85 iSessionTrust = ETrue; |
|
86 |
|
87 RDEBUG( "Policy Engine: Session trust created"); |
|
88 |
|
89 } |
|
90 |
|
91 |
|
92 // ----------------------------------------------------------------------------- |
|
93 // CTrustedSession::IsSessionCertificated() |
|
94 // ----------------------------------------------------------------------------- |
|
95 // |
|
96 void CTrustedSession::RemoveSessionTrust() |
|
97 { |
|
98 iSessionTrust = EFalse; |
|
99 delete iCASN; |
|
100 iCASN = NULL; |
|
101 } |
|
102 |
|
103 |
|
104 // ----------------------------------------------------------------------------- |
|
105 // CTrustedSession::IsSessionCertificated() |
|
106 // ----------------------------------------------------------------------------- |
|
107 // |
|
108 TCertInfo& CTrustedSession::SessionCertificate() |
|
109 { |
|
110 return iSessionCertInfo; |
|
111 } |
|
112 |
|
113 |
|
114 |
|
115 // ----------------------------------------------------------------------------- |
|
116 // CTrustedSession::IsSessionCertificated() |
|
117 // ----------------------------------------------------------------------------- |
|
118 // |
|
119 |
|
120 TBool CTrustedSession::CertificatedSession() const |
|
121 { |
|
122 return iSessionTrust; |
|
123 } |
|
124 |
|
125 |
|
126 |
|
127 |
|
128 // ----------------------------------------------------------------------------- |
|
129 // CTrustedSession::CASNForSessionL() |
|
130 // ----------------------------------------------------------------------------- |
|
131 // |
|
132 |
|
133 const TDesC8& CTrustedSession::CASNForSessionL() |
|
134 { |
|
135 RDEBUG("PolicyEngineServer: CTrustedSession::CASNForSession"); |
|
136 |
|
137 if ( !iCASN ) |
|
138 { |
|
139 iCASN = CCertificateMaps::CasnForCertInfoL( iSessionCertInfo ); |
|
140 } |
|
141 |
|
142 RDEBUG8_2("PolicyEngineServer: Session CASN: %S", iCASN); |
|
143 return *iCASN; |
|
144 } |
|
145 |
|
146 // ----------------------------------------------------------------------------- |
|
147 // CTrustedSession::GetMappedTargetTrustedSubjectL() |
|
148 // ----------------------------------------------------------------------------- |
|
149 // |
|
150 void CTrustedSession::GetMappedTargetTrustedSubjectL( |
|
151 RPointerArray<HBufC8>& aTargetTrustedMappedSubjectArray, |
|
152 CElementBase * aElement, TBool aUseEditedItems ) |
|
153 { |
|
154 RElementArray attributes; |
|
155 CleanupClosePushL( attributes ); |
|
156 aElement->FindAttributesL( ESubjectMatch, attributes ); |
|
157 |
|
158 for( TInt i(0); i < attributes.Count(); i++ ) |
|
159 { |
|
160 CMatchObject * matchObject = (CMatchObject*)attributes[ i ]; |
|
161 TElementReserver reserver( matchObject ); |
|
162 CPolicyStorage::PolicyStorage()->CheckElementL( matchObject ); |
|
163 |
|
164 //get attribute ids |
|
165 TDesC8& subjectAtt = matchObject->AttributeDesignator()->GetAttributeid(); |
|
166 TDesC8& value = matchObject->AttributeValue()->Data()->Value(); |
|
167 |
|
168 if( subjectAtt == PolicyEngineXACML::KCertificateMapped ) |
|
169 { |
|
170 //Create new subject info |
|
171 CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo(); |
|
172 CleanupStack::PushL( tempInfo ); |
|
173 |
|
174 //create suject info for it |
|
175 CCertificateMaps::CreateSubjectInfoL( tempInfo, value ); |
|
176 |
|
177 //Search corresponding subject info from certificate storage |
|
178 HBufC8* casn = tempInfo->iCASN->AllocL(); |
|
179 CleanupStack::PushL( casn ); |
|
180 // do not delete info object |
|
181 CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( *casn, aUseEditedItems ); |
|
182 |
|
183 if( info ) |
|
184 { |
|
185 HBufC8* temp = info->iCASN->AllocL(); |
|
186 aTargetTrustedMappedSubjectArray.Append( temp ); |
|
187 } |
|
188 |
|
189 CleanupStack::PopAndDestroy( casn ); |
|
190 CleanupStack::PopAndDestroy( tempInfo ); |
|
191 } |
|
192 } |
|
193 |
|
194 CleanupStack::PopAndDestroy( &attributes ); |
|
195 } |
|
196 |
|
197 // ----------------------------------------------------------------------------- |
|
198 // CTrustedSession::GetTargetTrustedSubjectL() |
|
199 // ----------------------------------------------------------------------------- |
|
200 // |
|
201 HBufC8* CTrustedSession::GetTargetTrustedSubjectL( |
|
202 CElementBase * aElement, TBool aUseEditedItems ) |
|
203 { |
|
204 //find alias for certificate, find policy subjects |
|
205 RElementArray attributes; |
|
206 CleanupClosePushL( attributes ); |
|
207 aElement->FindAttributesL( ESubjectMatch, attributes ); |
|
208 |
|
209 HBufC8* retVal = 0; |
|
210 |
|
211 for( TInt i(0); i < attributes.Count(); i++ ) |
|
212 { |
|
213 CMatchObject * matchObject = (CMatchObject*)attributes[ i ]; |
|
214 TElementReserver reserver( matchObject ); |
|
215 CPolicyStorage::PolicyStorage()->CheckElementL( matchObject ); |
|
216 |
|
217 //get attribute ids |
|
218 TDesC8& subjectAtt = matchObject->AttributeDesignator()->GetAttributeid(); |
|
219 TDesC8& value = matchObject->AttributeValue()->Data()->Value(); |
|
220 |
|
221 //tempvalue contain trusted subject value (CASN or alias) |
|
222 HBufC8* tempValue = 0; |
|
223 |
|
224 if( subjectAtt == PolicyEngineXACML::KCertificate ) |
|
225 { |
|
226 //Create new subject info |
|
227 CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo(); |
|
228 CleanupStack::PushL( tempInfo); |
|
229 |
|
230 //create suject info for it |
|
231 CCertificateMaps::CreateSubjectInfoL( tempInfo, value); |
|
232 |
|
233 //Search corresponding subject info from certificate storage |
|
234 tempValue = tempInfo->iCASN->AllocL(); |
|
235 |
|
236 CleanupStack::PopAndDestroy( tempInfo ); |
|
237 } |
|
238 else if( subjectAtt == PolicyLanguage::Constants::AutoCertificate ) |
|
239 { |
|
240 //Create new subject info |
|
241 CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo(); |
|
242 CleanupStack::PushL( tempInfo ); |
|
243 |
|
244 TCertInfo certInfo; |
|
245 TPckg<TCertInfo> pck( certInfo ); |
|
246 |
|
247 TImCodecB64 base64; |
|
248 User::LeaveIfError( base64.Decode( value, pck ) ); |
|
249 |
|
250 //create suject info for it |
|
251 CCertificateMaps::CreateSubjectInfoL( tempInfo, certInfo ); |
|
252 |
|
253 //Search corresponding subject info from certificate storage |
|
254 tempValue = tempInfo->iCASN->AllocL(); |
|
255 |
|
256 CleanupStack::PopAndDestroy( tempInfo ); |
|
257 } |
|
258 else if( subjectAtt == PolicyEngineXACML::KTrustedSubject) |
|
259 { |
|
260 tempValue = value.AllocL(); |
|
261 } |
|
262 |
|
263 //evaluate temp value |
|
264 if( tempValue ) |
|
265 { |
|
266 //Search corresponding subject info from certificate storage |
|
267 CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( *tempValue, aUseEditedItems ); |
|
268 |
|
269 //if corresponding info found, realloc tempvalue with info->iCASN value |
|
270 if( info ) |
|
271 { |
|
272 delete tempValue; |
|
273 tempValue = NULL; |
|
274 tempValue = info->iCASN->AllocL(); |
|
275 } |
|
276 |
|
277 if( retVal ) |
|
278 { |
|
279 //if retVal already exists and temp value doesn't match, break, delete buffers and set null to retval |
|
280 if ( *retVal != *tempValue ) |
|
281 { |
|
282 delete retVal; |
|
283 retVal = 0; |
|
284 break; |
|
285 } |
|
286 } |
|
287 else |
|
288 { |
|
289 //if retVal is not exist yet, create new one |
|
290 retVal = tempValue->AllocL(); |
|
291 } |
|
292 |
|
293 delete tempValue; |
|
294 } |
|
295 } |
|
296 |
|
297 CleanupStack::PopAndDestroy( &attributes ); |
|
298 return retVal; |
|
299 } |
|
300 |
|
301 |
|
302 |
|
303 // ----------------------------------------------------------------------------- |
|
304 // CTrustedSession::IsCertificateMappingValidL() |
|
305 // ----------------------------------------------------------------------------- |
|
306 // |
|
307 |
|
308 TBool CTrustedSession::IsCertificateMappingValidL( CElementBase * aElement) |
|
309 { |
|
310 //element is parsed and must be valid |
|
311 __ASSERT_ALWAYS ( aElement, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt)); |
|
312 |
|
313 //element type must be rule |
|
314 if ( aElement->ElementType() != ERule) |
|
315 { |
|
316 return EFalse; |
|
317 } |
|
318 |
|
319 |
|
320 |
|
321 CTarget * target = ((CRule*)aElement)->GetTarget(); |
|
322 if ( !target) |
|
323 { |
|
324 return EFalse; |
|
325 } |
|
326 |
|
327 //Mapping rule target contains allways one CSubjects element |
|
328 if ( target->SubElementType( 0, 1) != ESubjects ) |
|
329 { |
|
330 return EFalse; |
|
331 } |
|
332 |
|
333 CSubjects * subjects = (CSubjects*)target->Element(0); |
|
334 |
|
335 //Mapping subjects contains allways one CSubject element |
|
336 if ( subjects->SubElementType( 0, 1) != ESubject ) |
|
337 { |
|
338 return EFalse; |
|
339 } |
|
340 |
|
341 CSubject * subject = (CSubject*)subjects->Element(0); |
|
342 |
|
343 //element type should be subjectmatch in all cases! |
|
344 if ( subject->SubElementType( 0, 2) != ESubjectMatch || |
|
345 subject->SubElementType( 1) != ESubjectMatch ) |
|
346 { |
|
347 return EFalse; |
|
348 } |
|
349 |
|
350 |
|
351 //Get match objects |
|
352 CMatchObject* subject1 = (CMatchObject*) subject->Element(0); |
|
353 CMatchObject* subject2 = (CMatchObject*) subject->Element(1); |
|
354 |
|
355 //get attribute ids |
|
356 TDesC8& subjectAtt1 = subject1->AttributeDesignator()->GetAttributeid(); |
|
357 TDesC8& subjectAtt2 = subject2->AttributeDesignator()->GetAttributeid(); |
|
358 |
|
359 //certificate -> alias mapping |
|
360 if ( subjectAtt1 == PolicyEngineXACML::KCertificate && subjectAtt2 == PolicyEngineXACML::KAliasId) |
|
361 { |
|
362 CPolicyEngineServer::CertificateMaps()->BringUpToDateL(); |
|
363 |
|
364 //Check that new alias is not already exist |
|
365 if ( CPolicyEngineServer::CertificateMaps()->IsAliasExistL( subject2->AttributeValue()->Data()->Value())) |
|
366 { |
|
367 return EFalse; |
|
368 } |
|
369 |
|
370 TDesC8& certificateValue = subject1->AttributeValue()->Data()->Value(); |
|
371 |
|
372 //Leaves if certificate is not valid, otherwise just delete certificate |
|
373 CX509Certificate * cert = CCertificateMaps::ParseCertificateL( certificateValue); |
|
374 delete cert; |
|
375 |
|
376 return ETrue; |
|
377 } |
|
378 |
|
379 //certificate -> new certificate (certificate ) |
|
380 if ( subjectAtt1 == PolicyEngineXACML::KCertificate && subjectAtt2 == PolicyEngineXACML::KCertificateMapped) |
|
381 { |
|
382 TDesC8& certificateValue = subject1->AttributeValue()->Data()->Value(); |
|
383 TDesC8& certificateValueMapped = subject2->AttributeValue()->Data()->Value(); |
|
384 |
|
385 //Leaves if certificate is not valid, otherwise just delete certificate |
|
386 CX509Certificate * cert = CCertificateMaps::ParseCertificateL( certificateValue); |
|
387 delete cert; |
|
388 CX509Certificate * certMapped = CCertificateMaps::ParseCertificateL( certificateValueMapped); |
|
389 delete certMapped; |
|
390 |
|
391 |
|
392 return ETrue; |
|
393 } |
|
394 |
|
395 return EFalse; |
|
396 } |
|
397 |
|
398 // ----------------------------------------------------------------------------- |
|
399 // CTrustedSession::AddCertificateMappingL() |
|
400 // ----------------------------------------------------------------------------- |
|
401 // |
|
402 CElementBase* CTrustedSession::CreateCertificateMappingL( const TDesC8& aAlias ) |
|
403 { |
|
404 using namespace PolicyLanguage::Constants; |
|
405 using namespace PolicyLanguage::NativeLanguage; |
|
406 |
|
407 //Check that alias is valid (not allready exists) |
|
408 if ( CPolicyEngineServer::CertificateMaps()->IsAliasExistL( aAlias)) |
|
409 { |
|
410 return 0; |
|
411 } |
|
412 |
|
413 //Ensures that CASN is valid... |
|
414 CASNForSessionL(); |
|
415 |
|
416 //Create new mapping policy |
|
417 //first create id for new rule, format is auto_certificate+CASN |
|
418 HBufC8 * extId = HBufC8::NewLC( AutoCertificateLength + iCASN->Length() + 1); |
|
419 TPtr8 extIdPtr = extId->Des(); |
|
420 |
|
421 extIdPtr.Append( AutoCertificate); |
|
422 extIdPtr.Append( '_'); |
|
423 extIdPtr.Append( *iCASN); |
|
424 |
|
425 ReplaceIllegalCharacters( extIdPtr ); |
|
426 |
|
427 //Check id |
|
428 if ( !CPolicyStorage::PolicyStorage()->IsRealIdValidL( extIdPtr)) |
|
429 { |
|
430 CleanupStack::PopAndDestroy( extId); |
|
431 return 0; |
|
432 } |
|
433 |
|
434 //and assign rule to element |
|
435 CRule *rule = CRule::NewL(); |
|
436 |
|
437 CleanupStack::PushL( rule); |
|
438 rule->SetRuleIdL( extIdPtr); |
|
439 rule->SetEffectL( Rule::Permit); |
|
440 |
|
441 //target |
|
442 CTarget * target = CTarget::NewL(); |
|
443 CleanupStack::PushL( target); |
|
444 rule->AddElementL( 0, target); |
|
445 CleanupStack::Pop( target); |
|
446 |
|
447 //subjects |
|
448 CSubjects * subjects = CSubjects::NewL(); |
|
449 CleanupStack::PushL( subjects ); |
|
450 target->AddElementL( 0, subjects); |
|
451 CleanupStack::Pop( subjects ); |
|
452 |
|
453 //subject |
|
454 CSubject * subject = CSubject::NewL(); |
|
455 CleanupStack::PushL( subject ); |
|
456 subjects->AddToElementListL( subject , ETrue); |
|
457 CleanupStack::Pop( subject ); |
|
458 |
|
459 |
|
460 //first subjectmatch |
|
461 CMatchObject * match = new (ELeave) CMatchObject( ESubjectMatch); |
|
462 subject->AddToElementListL( match, ETrue); |
|
463 |
|
464 match->AddAttributeL( 0, MatchObject::MatchId, |
|
465 Functions::FunctionStringEqualId); |
|
466 |
|
467 //designator and value for certificate |
|
468 CSubjectAttributeDesignator * designator = CSubjectAttributeDesignator::NewL(); |
|
469 match->AddElementL( 0, designator); |
|
470 designator->AddAttributeL( 0, AttributeDesignators::AttributeId, AutoCertificate); |
|
471 designator->AddAttributeL( 0, AttributeDesignators::DataType, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType); |
|
472 |
|
473 //serialize TCertInfo and decode it to base64 format |
|
474 TPckg<TCertInfo> pck( iSessionCertInfo); |
|
475 TImCodecB64 base64; |
|
476 HBufC8 * base64coded = HBufC8::NewLC( pck.Length() * 3); |
|
477 TPtr8 base64Ptr = base64coded->Des(); |
|
478 User::LeaveIfError( base64.Encode( pck, base64Ptr)); |
|
479 |
|
480 CAttributeValue * aliasValue = CAttributeValue::NewL( base64Ptr, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType); |
|
481 CleanupStack::PopAndDestroy( base64coded); |
|
482 |
|
483 match->AddElementL( 0, aliasValue); |
|
484 |
|
485 //second subjectmatch |
|
486 match = new (ELeave) CMatchObject( ESubjectMatch); |
|
487 subject->AddToElementListL( match, ETrue); |
|
488 |
|
489 match->AddAttributeL( 0, MatchObject::MatchId, |
|
490 Functions::FunctionStringEqualId); |
|
491 |
|
492 |
|
493 //designator and value for alias |
|
494 designator = CSubjectAttributeDesignator::NewL(); |
|
495 match->AddElementL( 0, designator); |
|
496 designator->AddAttributeL( 0, AttributeDesignators::AttributeId, PolicyEngineXACML::KAliasId); |
|
497 designator->AddAttributeL( 0, AttributeDesignators::DataType, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType); |
|
498 |
|
499 aliasValue = CAttributeValue::NewL( aAlias, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType); |
|
500 match->AddElementL( 0, aliasValue); |
|
501 |
|
502 |
|
503 //Destroy objects.... |
|
504 CleanupStack::Pop( rule); |
|
505 CleanupStack::PopAndDestroy( extId); |
|
506 |
|
507 |
|
508 return rule; |
|
509 } |
|
510 |
|
511 |
|
512 void CTrustedSession::ReplaceIllegalCharacters( TPtr8& aData ) |
|
513 { |
|
514 RDEBUG("CTrustedSession::ReplaceIllegalCharacters()"); |
|
515 |
|
516 TChar char1('/'); |
|
517 TBuf8<10> buf; |
|
518 buf.Append( _L("_") ); |
|
519 for(TInt i = 0;;i++) |
|
520 { |
|
521 TInt index = aData.Locate( char1 ); |
|
522 if( index > KErrNotFound ) |
|
523 { |
|
524 aData.Replace( index, 1, buf ); |
|
525 } |
|
526 else |
|
527 { |
|
528 break; |
|
529 } |
|
530 } |
|
531 |
|
532 } |
|
533 |
|
534 // ----------------------------------------------------------------------------- |
|
535 // CTrustedSession::CommonNameForSubject() |
|
536 // ----------------------------------------------------------------------------- |
|
537 // |
|
538 |
|
539 const TDesC8& CTrustedSession::CommonNameForSubjectL( const TDesC8& aTrustedSubject, TBool aUseEditedItems ) |
|
540 { |
|
541 RDEBUG("PolicyEngineServer: CTrustedSession::CommonNameForSubjectL"); |
|
542 |
|
543 //ensures that iCASN is valid |
|
544 CASNForSessionL(); |
|
545 |
|
546 if ( aTrustedSubject == *iCASN ) |
|
547 { |
|
548 return iSessionCertInfo.iSubjectDNInfo.iCommonName; |
|
549 } |
|
550 |
|
551 CPolicyEngineServer::CertificateMaps()->BringUpToDateL(); |
|
552 CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( aTrustedSubject, aUseEditedItems); |
|
553 |
|
554 |
|
555 if (info) |
|
556 { |
|
557 return *info->iSubject; |
|
558 } |
|
559 |
|
560 return KNullDesC8; |
|
561 } |
|
562 |
|
563 // ----------------------------------------------------------------------------- |
|
564 // CTrustedSession::FingerPrintForSubject() |
|
565 // ----------------------------------------------------------------------------- |
|
566 // |
|
567 |
|
568 |
|
569 const TDesC8& CTrustedSession::FingerPrintForSubjectL( const TDesC8& aTrustedSubject, TBool aUseEditedItems) |
|
570 { |
|
571 RDEBUG("PolicyEngineServer: CTrustedSession::CommonNameForSubjectL"); |
|
572 |
|
573 //ensures that iCASN is valid |
|
574 CASNForSessionL(); |
|
575 |
|
576 if ( aTrustedSubject == *iCASN ) |
|
577 { |
|
578 //get finger print |
|
579 iFingerPrint.Zero(); |
|
580 |
|
581 //convert fingerprint to plain text |
|
582 for ( TInt i(0); i < iSessionCertInfo.iFingerprint.Length(); i++) |
|
583 { |
|
584 iFingerPrint.AppendNum( iSessionCertInfo.iFingerprint[i], EHex); |
|
585 } |
|
586 |
|
587 return iFingerPrint; |
|
588 } |
|
589 |
|
590 CPolicyEngineServer::CertificateMaps()->BringUpToDateL(); |
|
591 CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( aTrustedSubject, aUseEditedItems); |
|
592 |
|
593 if (info) |
|
594 { |
|
595 return *info->iFingerPrint; |
|
596 } |
|
597 |
|
598 return KNullDesC8; |
|
599 } |
|
600 |
|
601 |
|
602 |
|
603 // ----------------------------------------------------------------------------- |
|
604 // CTrustedSession::AddSessionSIDL() |
|
605 // ----------------------------------------------------------------------------- |
|
606 // |
|
607 |
|
608 void CTrustedSession::AddSessionSIDL( TUid aSecirityUID) |
|
609 { |
|
610 //add SECUREID start mark |
|
611 iSessionSID.Zero(); |
|
612 iSessionSID.Append( KSecureIdString); |
|
613 iSessionSID.Append( aSecirityUID.Name()); |
|
614 iSessionSID.UpperCase(); |
|
615 |
|
616 } |
|
617 |
|
618 |
|
619 // ----------------------------------------------------------------------------- |
|
620 // CTrustedSession::SIDForSession() |
|
621 // ----------------------------------------------------------------------------- |
|
622 // |
|
623 |
|
624 const TDesC8& CTrustedSession::SIDForSession() |
|
625 { |
|
626 return iSessionSID; |
|
627 } |
|
628 |
|
629 |
|
630 // ----------------------------------------------------------------------------- |
|
631 // CTrustedSession::CertMatchL() |
|
632 // ----------------------------------------------------------------------------- |
|
633 // |
|
634 TBool CTrustedSession::CertMatchL( const TDesC8& aTrustedSubject1, const TDesC8& aTrustedSubject2, TBool /*aUseEditedItems*/ ) |
|
635 { |
|
636 TBool subjectMatch = EFalse; |
|
637 |
|
638 CCertificateMaps * maps = CPolicyEngineServer::CertificateMaps(); |
|
639 maps->BringUpToDateL(); |
|
640 |
|
641 |
|
642 //find subject info for asubject |
|
643 for ( TInt i = 0; i < maps->iCerts.Count(); i++) |
|
644 { |
|
645 CCertificateMaps::CSubjectInfo* info = maps->iCerts[i]; |
|
646 |
|
647 |
|
648 if ( info->Match( aTrustedSubject1, ETrue) && info->Match( aTrustedSubject2, ETrue)) |
|
649 { |
|
650 //subject1 and subject2 are same instance!! |
|
651 subjectMatch = ETrue; |
|
652 break; |
|
653 } |
|
654 |
|
655 } |
|
656 |
|
657 return subjectMatch; |
|
658 } |
|
659 |
|
660 // ----------------------------------------------------------------------------- |
|
661 // CTrustedSession::RoleMatchL() |
|
662 // ----------------------------------------------------------------------------- |
|
663 // |
|
664 TBool CTrustedSession::RoleMatchL( const TDesC8& aTrustedSubject, const TDesC8& aRole, TBool aUseEditedItems ) |
|
665 { |
|
666 //find subject info for asubject |
|
667 CCertificateMaps * cerMaps = CPolicyEngineServer::CertificateMaps(); |
|
668 cerMaps->BringUpToDateL(); |
|
669 |
|
670 TBool validRole = EFalse; |
|
671 |
|
672 for ( TInt i(0); i < cerMaps->iCerts.Count(); i++) |
|
673 { |
|
674 CCertificateMaps::CSubjectInfo* info = cerMaps->iCerts[i]; |
|
675 |
|
676 if ( !CCertificateMaps::EvaluateElementValidity( aUseEditedItems, info->iState)) |
|
677 { |
|
678 continue; |
|
679 } |
|
680 |
|
681 if ( info->Match( aTrustedSubject, ETrue) && info->RoleMatchL( aRole)) |
|
682 { |
|
683 //aRole is valid role for aTrustedSubject!! |
|
684 validRole = ETrue; |
|
685 break; |
|
686 } |
|
687 } |
|
688 |
|
689 |
|
690 return validRole; |
|
691 } |
|
692 |
|
693 |
|
694 // ----------------------------------------------------------------------------- |
|
695 // CCertificateMaps::CRolesInfo::CRolesInfo() |
|
696 // ----------------------------------------------------------------------------- |
|
697 // |
|
698 CCertificateMaps::CRolesInfo::CRolesInfo() |
|
699 { |
|
700 } |
|
701 |
|
702 |
|
703 // ----------------------------------------------------------------------------- |
|
704 // CCertificateMaps::CRolesInfo::~CRolesInfo() |
|
705 // ----------------------------------------------------------------------------- |
|
706 // |
|
707 CCertificateMaps::CRolesInfo::~CRolesInfo() |
|
708 { |
|
709 delete iRole; |
|
710 } |
|
711 |
|
712 |
|
713 // ----------------------------------------------------------------------------- |
|
714 // CCertificateMaps::CRolesInfo::NewL() |
|
715 // ----------------------------------------------------------------------------- |
|
716 // |
|
717 CCertificateMaps::CRolesInfo* CCertificateMaps::CRolesInfo::NewL( const TDesC8& aRole, TElementState aState) |
|
718 { |
|
719 CRolesInfo * self = new (ELeave) CRolesInfo(); |
|
720 |
|
721 self->iRole = aRole.AllocL(); |
|
722 self->iState = aState; |
|
723 |
|
724 return self; |
|
725 } |
|
726 |
|
727 // ----------------------------------------------------------------------------- |
|
728 // CCertificateMaps::CSubjectInfo::CSubjectInfo() |
|
729 // ----------------------------------------------------------------------------- |
|
730 // |
|
731 |
|
732 CCertificateMaps::CSubjectInfo::CSubjectInfo() |
|
733 { |
|
734 } |
|
735 |
|
736 // ----------------------------------------------------------------------------- |
|
737 // CCertificateMaps::CSubjectInfo::~CSubjectInfo() |
|
738 // ----------------------------------------------------------------------------- |
|
739 // |
|
740 |
|
741 CCertificateMaps::CSubjectInfo::~CSubjectInfo() |
|
742 { |
|
743 delete iCASN; |
|
744 delete iMappedToCert; |
|
745 delete iAlias; |
|
746 delete iSubject; |
|
747 delete iFingerPrint; |
|
748 iRoles.ResetAndDestroy(); |
|
749 iRoles.Close(); |
|
750 } |
|
751 |
|
752 // ----------------------------------------------------------------------------- |
|
753 // CCertificateMaps::CSubjectInfo::~CSubjectInfo() |
|
754 // ----------------------------------------------------------------------------- |
|
755 // |
|
756 TBool CCertificateMaps::CSubjectInfo::RoleMatchL( const TDesC8& aRole) |
|
757 { |
|
758 TBool retVal = EFalse; |
|
759 |
|
760 //find roles from this subject match |
|
761 for ( TInt i(0); i < iRoles.Count(); i++) |
|
762 { |
|
763 CRolesInfo * info = iRoles[i]; |
|
764 |
|
765 if ( aRole.CompareF( *info->iRole) == 0) |
|
766 { |
|
767 retVal = ETrue; |
|
768 break; |
|
769 } |
|
770 } |
|
771 |
|
772 //and if needed check also mappedtoinfo |
|
773 if ( !retVal && iMappedToInfo) |
|
774 { |
|
775 retVal = iMappedToInfo->RoleMatchL( aRole); |
|
776 } |
|
777 |
|
778 return retVal; |
|
779 } |
|
780 |
|
781 // ----------------------------------------------------------------------------- |
|
782 // CCertificateMaps::CSubjectInfo::~CSubjectInfo() |
|
783 // ----------------------------------------------------------------------------- |
|
784 // |
|
785 TBool CCertificateMaps::CSubjectInfo::Match( const TDesC8& aTrustedSubject, TBool aCheckMappedCertificates) |
|
786 { |
|
787 //Check CASN |
|
788 if ( iCASN ) |
|
789 { |
|
790 if ( aTrustedSubject.CompareF( *iCASN) == 0 ) |
|
791 { |
|
792 return ETrue; |
|
793 } |
|
794 } |
|
795 |
|
796 //Check alias |
|
797 if ( iAlias ) |
|
798 { |
|
799 if ( aTrustedSubject.CompareF( *iAlias ) == 0) |
|
800 { |
|
801 return ETrue; |
|
802 } |
|
803 } |
|
804 |
|
805 if ( aCheckMappedCertificates && iMappedToInfo ) |
|
806 { |
|
807 return iMappedToInfo->Match( aTrustedSubject, ETrue); |
|
808 } |
|
809 |
|
810 return EFalse; |
|
811 } |
|
812 |
|
813 |
|
814 TRole CCertificateMaps::CSubjectInfo::CertificateRoleL( TBool aUseEditedItems ) |
|
815 { |
|
816 TPtr8 ptr = iFingerPrint->Des(); |
|
817 RDEBUG8_2("CSubjectInfo::CertificateRoleL() (fingerprint: %S)", &ptr ); |
|
818 |
|
819 TRole retVal( ENoRole ); |
|
820 |
|
821 RDEBUG8_2(" -> this certificate has %d roles", iRoles.Count() ); |
|
822 for( TInt j(0); iRoles.Count(); j++ ) |
|
823 { |
|
824 CRolesInfo* role = iRoles[ j ]; |
|
825 |
|
826 //accept only elements which are committed... |
|
827 if( !EvaluateElementValidity( aUseEditedItems, role->iState ) ) |
|
828 { |
|
829 RDEBUG(" -> found invalid element from CRolesInfo"); |
|
830 continue; |
|
831 } |
|
832 |
|
833 if( *role->iRole == PolicyEngineXACML::KRoleCorporate ) |
|
834 { |
|
835 RDEBUG(" -> found KRoleCorporate"); |
|
836 retVal = ECorporateRole; |
|
837 break; |
|
838 } |
|
839 } |
|
840 |
|
841 if( ( retVal == ENoRole ) && iMappedToInfo ) |
|
842 { |
|
843 RDEBUG(" -> -> searching KRoleCorporate from certificate mappings recursively .. "); |
|
844 retVal = iMappedToInfo->CertificateRoleL( aUseEditedItems ); |
|
845 RDEBUG(" <- <- searching KRoleCorporate from certificate mappings recursively .. DONE"); |
|
846 } |
|
847 else if( ( retVal == ENoRole ) && !iMappedToInfo ) |
|
848 { |
|
849 RDEBUG(" -> not mapped - can not search recursively"); |
|
850 } |
|
851 |
|
852 return retVal; |
|
853 } |
|
854 |
|
855 |
|
856 // ----------------------------------------------------------------------------- |
|
857 // CCertificateMaps::CCertificateMaps() |
|
858 // ----------------------------------------------------------------------------- |
|
859 // |
|
860 CCertificateMaps::CCertificateMaps() |
|
861 { |
|
862 iPolicyStorage = CPolicyStorage::PolicyStorage(); |
|
863 iMapsUpToDate = EFalse; |
|
864 } |
|
865 |
|
866 // ----------------------------------------------------------------------------- |
|
867 // CCertificateMaps::~CCertificateMaps() |
|
868 // ----------------------------------------------------------------------------- |
|
869 // |
|
870 CCertificateMaps::~CCertificateMaps() |
|
871 { |
|
872 iCerts.ResetAndDestroy(); |
|
873 iCerts.Close(); |
|
874 } |
|
875 |
|
876 CCertificateMaps* CCertificateMaps::NewL() |
|
877 { |
|
878 CCertificateMaps* self = new (ELeave) CCertificateMaps(); |
|
879 |
|
880 CleanupStack::PushL( self); |
|
881 CleanupStack::Pop( self); |
|
882 |
|
883 return self; |
|
884 } |
|
885 |
|
886 // ----------------------------------------------------------------------------- |
|
887 // CCertificateMaps::LoadCertificateMaps() |
|
888 // ----------------------------------------------------------------------------- |
|
889 // |
|
890 |
|
891 void CCertificateMaps::LoadCertificateMapsL() |
|
892 { |
|
893 RDEBUG("CCertificateMaps::LoadCertificateMaps"); |
|
894 |
|
895 iCerts.ResetAndDestroy(); |
|
896 |
|
897 using namespace PolicyLanguage::Constants; |
|
898 using namespace PolicyEngineXACML; |
|
899 |
|
900 //get Certificate mapping policy from storage (get also edited elements) |
|
901 CElementBase * aliasPolicy = iPolicyStorage->GetEditableElementL( CertMappingPolicy); |
|
902 |
|
903 //if eleemnt is not valid |
|
904 if ( !aliasPolicy) |
|
905 { |
|
906 return; |
|
907 } |
|
908 |
|
909 //reserve and load element |
|
910 TElementReserver certReserver( aliasPolicy); |
|
911 iPolicyStorage->CheckElementL( aliasPolicy); |
|
912 |
|
913 //find alias for certificate, find policy subjects |
|
914 RElementArray attributes; |
|
915 CleanupClosePushL( attributes); |
|
916 aliasPolicy->FindAttributesL( ESubject, attributes); |
|
917 |
|
918 |
|
919 for ( TInt i = 0; i < attributes.Count(); i++) |
|
920 { |
|
921 CElementBase * element = attributes[i]; |
|
922 |
|
923 //only two subjectmatch allowed |
|
924 if ( element->ElementType() == ESubject && element->ElementCount() == 2 ) |
|
925 { |
|
926 //element type should be subjectmatch in all cases! |
|
927 __ASSERT_ALWAYS ( element->Element(0)->ElementType() == ESubjectMatch, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt)); |
|
928 __ASSERT_ALWAYS ( element->Element(1)->ElementType() == ESubjectMatch, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt)); |
|
929 |
|
930 //Get match objects, reserve and load them |
|
931 CMatchObject* subject1 = (CMatchObject*) element->Element(0); |
|
932 CMatchObject* subject2 = (CMatchObject*) element->Element(1); |
|
933 |
|
934 TElementReserver reserver1( subject1); |
|
935 TElementReserver reserver2( subject2); |
|
936 iPolicyStorage->CheckElementL( subject1); |
|
937 iPolicyStorage->CheckElementL( subject2); |
|
938 |
|
939 //get attribute ids |
|
940 TDesC8& subjectAtt1 = subject1->AttributeDesignator()->GetAttributeid(); |
|
941 TDesC8& subjectAtt2 = subject2->AttributeDesignator()->GetAttributeid(); |
|
942 |
|
943 //Create new subject info |
|
944 CSubjectInfo* info = new (ELeave) CSubjectInfo(); |
|
945 CleanupStack::PushL( info); |
|
946 |
|
947 //set committed state flag |
|
948 info->iState = element->iElementState; |
|
949 |
|
950 //certificate -> alias mapping |
|
951 if ( subjectAtt1 == KCertificate && subjectAtt2 == KAliasId) |
|
952 { |
|
953 RDEBUG("PolicyEngineServer: Certificate mapped to Alias"); |
|
954 |
|
955 //get attribute value and parse certificate |
|
956 TDesC8& binaryCert = subject1->AttributeValue()->Data()->Value(); |
|
957 |
|
958 //create suject info for it |
|
959 CreateSubjectInfoL( info, binaryCert); |
|
960 |
|
961 TDesC8& alias = subject2->AttributeValue()->Data()->Value(); |
|
962 info->iAlias = alias.AllocL(); |
|
963 |
|
964 RDEBUG8_3("PolicyEngineServer: Certificate mapped: %S -> %S", info->iCASN, info->iAlias); |
|
965 |
|
966 iCerts.AppendL( info); |
|
967 CleanupStack::Pop( info); |
|
968 } |
|
969 else if ( subjectAtt1 == KCertificate && subjectAtt2 == KCertificateMapped) |
|
970 { |
|
971 RDEBUG("PolicyEngineServer: Certificate mapped to new certificate"); |
|
972 |
|
973 //get attribute values.... |
|
974 TDesC8& binaryOldCert = subject1->AttributeValue()->Data()->Value(); |
|
975 TDesC8& binaryNewCert = subject2->AttributeValue()->Data()->Value(); |
|
976 |
|
977 //create subject info for new certificate mapping |
|
978 CreateSubjectInfoL( info, binaryNewCert); |
|
979 |
|
980 //create subject info for mapped certificate |
|
981 CSubjectInfo* mappingInfo = new (ELeave) CSubjectInfo(); |
|
982 CleanupStack::PushL( mappingInfo); |
|
983 CreateSubjectInfoL( mappingInfo, binaryOldCert); |
|
984 |
|
985 //add the mapping info to new certificate |
|
986 info->iMappedToCert = mappingInfo->iCASN->AllocL(); |
|
987 CleanupStack::PopAndDestroy( mappingInfo); |
|
988 |
|
989 iCerts.AppendL( info); |
|
990 CleanupStack::Pop( info); |
|
991 } |
|
992 else if ( subjectAtt1 == AutoCertificate && subjectAtt2 == KAliasId) |
|
993 { |
|
994 RDEBUG("PolicyEngineServer: Certificate mapped to Alias"); |
|
995 |
|
996 //get attribute value and parse certificate info ( base64 -> serialization -> TCertInfo) |
|
997 TDesC8& binaryCert = subject1->AttributeValue()->Data()->Value(); |
|
998 |
|
999 TCertInfo certInfo; |
|
1000 TPckg<TCertInfo> pck( certInfo); |
|
1001 |
|
1002 TImCodecB64 base64; |
|
1003 User::LeaveIfError( base64.Decode( binaryCert, pck)); |
|
1004 |
|
1005 //create suject info for it |
|
1006 CreateSubjectInfoL( info, certInfo); |
|
1007 |
|
1008 TDesC8& alias = subject2->AttributeValue()->Data()->Value(); |
|
1009 info->iAlias = alias.AllocL(); |
|
1010 |
|
1011 RDEBUG8_3("PolicyEngineServer: Certificate mapped: %S -> %S", info->iCASN, info->iAlias); |
|
1012 |
|
1013 iCerts.AppendL( info); |
|
1014 CleanupStack::Pop( info); |
|
1015 |
|
1016 } |
|
1017 else |
|
1018 { |
|
1019 CleanupStack::PopAndDestroy( info); |
|
1020 } |
|
1021 |
|
1022 reserver2.Release(); |
|
1023 reserver1.Release(); |
|
1024 |
|
1025 } |
|
1026 } |
|
1027 |
|
1028 CleanupStack::PopAndDestroy( &attributes); //attribute list |
|
1029 certReserver.Release(); |
|
1030 |
|
1031 //Create pointer reference mapping instead of name mapping in certificate->certificate mapping table |
|
1032 for ( TInt i(0); i < iCerts.Count(); i++) |
|
1033 { |
|
1034 //find all CSubjectInfos which include certificate to certificate mapping |
|
1035 CSubjectInfo * infoi = iCerts[i]; |
|
1036 |
|
1037 if ( infoi->iMappedToCert ) |
|
1038 { |
|
1039 //find corresponding certificate |
|
1040 for ( TInt j(0); j < iCerts.Count(); j++) |
|
1041 { |
|
1042 CSubjectInfo * infoj = iCerts[j]; |
|
1043 |
|
1044 if ( *infoj->iCASN == *infoi->iMappedToCert) |
|
1045 { |
|
1046 //add reference mapping.... |
|
1047 RDEBUG(" -> added certificate reference mapping"); |
|
1048 infoi->iMappedToInfo = infoj; |
|
1049 break; |
|
1050 } |
|
1051 } |
|
1052 } |
|
1053 } |
|
1054 |
|
1055 //get roles mapping policy from storage |
|
1056 CElementBase * rolesPolicy = iPolicyStorage->GetEditableElementL( RolesMappingPolicy); |
|
1057 |
|
1058 //if eleemnt is not valid |
|
1059 if ( !rolesPolicy) |
|
1060 { |
|
1061 return; |
|
1062 } |
|
1063 |
|
1064 //reserve and load element |
|
1065 TElementReserver rolesReserver( rolesPolicy); |
|
1066 iPolicyStorage->CheckElementL( rolesPolicy); |
|
1067 |
|
1068 //find roles for certificate, find policy subjects |
|
1069 RElementArray roleattributes; |
|
1070 CleanupClosePushL( roleattributes); |
|
1071 rolesPolicy->FindAttributesL( ESubject, roleattributes); |
|
1072 |
|
1073 for ( TInt i = 0; i < roleattributes.Count(); i++) |
|
1074 { |
|
1075 CElementBase * element = roleattributes[i]; |
|
1076 |
|
1077 //only two subjectmatch allowed |
|
1078 if ( element->ElementType() == ESubject && element->ElementCount() == 2 ) |
|
1079 { |
|
1080 //element type should be subjectmatch in all cases! |
|
1081 __ASSERT_ALWAYS ( element->Element(0)->ElementType() == ESubjectMatch, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt)); |
|
1082 __ASSERT_ALWAYS ( element->Element(1)->ElementType() == ESubjectMatch, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt)); |
|
1083 |
|
1084 //get and reserve elements |
|
1085 CMatchObject* subject1 = (CMatchObject*)element->Element(0); |
|
1086 CMatchObject* subject2 = (CMatchObject*)element->Element(1); |
|
1087 |
|
1088 TElementReserver reserver1( subject1); |
|
1089 TElementReserver reserver2( subject2); |
|
1090 iPolicyStorage->CheckElementL( subject1); |
|
1091 iPolicyStorage->CheckElementL( subject2); |
|
1092 |
|
1093 |
|
1094 //check that reloes mapping is correct |
|
1095 if ( subject1->AttributeDesignator()->GetAttributeid() == KTrustedSubject && |
|
1096 subject2->AttributeDesignator()->GetAttributeid() == KRoleId ) |
|
1097 { |
|
1098 //map roles to certificate |
|
1099 AddRolesToCertL( subject2->AttributeValue()->Data()->Value(), |
|
1100 subject1->AttributeValue()->Data()->Value(), element->iElementState); |
|
1101 } |
|
1102 |
|
1103 reserver2.Release(); |
|
1104 reserver1.Release(); |
|
1105 |
|
1106 } |
|
1107 } |
|
1108 |
|
1109 CleanupStack::PopAndDestroy( &roleattributes); //attribute list |
|
1110 |
|
1111 rolesReserver.Release(); |
|
1112 } |
|
1113 |
|
1114 |
|
1115 void CCertificateMaps::BringUpToDateL() |
|
1116 { |
|
1117 if ( !iMapsUpToDate) |
|
1118 { |
|
1119 LoadCertificateMapsL(); |
|
1120 iMapsUpToDate = ETrue; |
|
1121 } |
|
1122 } |
|
1123 |
|
1124 |
|
1125 // ----------------------------------------------------------------------------- |
|
1126 // CCertificateMaps::NewMappingsAvailable() |
|
1127 // ----------------------------------------------------------------------------- |
|
1128 // |
|
1129 |
|
1130 void CCertificateMaps::NewMappingsAvailable() |
|
1131 { |
|
1132 iMapsUpToDate = EFalse; |
|
1133 } |
|
1134 |
|
1135 |
|
1136 // ----------------------------------------------------------------------------- |
|
1137 // CCertificateMaps::IsAliasExist() |
|
1138 // ----------------------------------------------------------------------------- |
|
1139 // |
|
1140 TBool CCertificateMaps::IsAliasExistL( const TDesC8& aAlias) |
|
1141 { |
|
1142 BringUpToDateL(); |
|
1143 |
|
1144 //find subject info for aAlias (if info exist also alias exist) |
|
1145 for ( TInt i = 0; i < iCerts.Count(); i++) |
|
1146 { |
|
1147 CSubjectInfo * info = iCerts[i]; |
|
1148 |
|
1149 //if alias match |
|
1150 if ( info->iAlias) |
|
1151 { |
|
1152 if ( aAlias == *info->iAlias) |
|
1153 return ETrue; |
|
1154 } |
|
1155 } |
|
1156 |
|
1157 return EFalse; |
|
1158 } |
|
1159 |
|
1160 |
|
1161 // ----------------------------------------------------------------------------- |
|
1162 // CCertificateMaps::CertificateRoleL() |
|
1163 // ----------------------------------------------------------------------------- |
|
1164 // |
|
1165 TRole CCertificateMaps::CertificateRoleL( const TCertInfo& aCertInfo, TBool aUseEditedItems) |
|
1166 { |
|
1167 RDEBUG("CCertificateMaps::CertificateRoleL()"); |
|
1168 BringUpToDateL(); |
|
1169 |
|
1170 HBufC8* buf = CasnForCertInfoL( aCertInfo ); |
|
1171 TRole retVal = ENoRole; |
|
1172 |
|
1173 //find subject info for aAlias (if info exist also alias exist) |
|
1174 RDEBUG_2("CCertificateMaps::CertificateRoleL() - checking %d certificates", iCerts.Count() ); |
|
1175 for( TInt i = 0; i < iCerts.Count(); i++) |
|
1176 { |
|
1177 // CSubjectInfo contains list of roles that are owned by the certificate |
|
1178 CSubjectInfo* info = iCerts[ i ]; |
|
1179 |
|
1180 //accept only elements which are committed... |
|
1181 if( !EvaluateElementValidity( aUseEditedItems, info->iState ) ) |
|
1182 { |
|
1183 RDEBUG(" -> found invalid element"); |
|
1184 continue; |
|
1185 } |
|
1186 |
|
1187 //if alias match |
|
1188 if( info->iCASN->CompareF( *buf ) == 0 ) |
|
1189 { |
|
1190 RDEBUG(" -> CASN comparison match"); |
|
1191 // recursive check if there is a mapping (e.g. cert_to_cert policy) |
|
1192 retVal = info->CertificateRoleL( aUseEditedItems ); |
|
1193 if( retVal != ENoRole ) |
|
1194 { |
|
1195 break; |
|
1196 } |
|
1197 } |
|
1198 else |
|
1199 { |
|
1200 RDEBUG(" -> CASN did not match!"); |
|
1201 } |
|
1202 } |
|
1203 |
|
1204 if( retVal == ECorporateRole ) |
|
1205 { |
|
1206 RDEBUG(" -> found ECorporateRole"); |
|
1207 } |
|
1208 else |
|
1209 { |
|
1210 RDEBUG(" -> no role found!"); |
|
1211 } |
|
1212 |
|
1213 delete buf; |
|
1214 return retVal; |
|
1215 } |
|
1216 |
|
1217 |
|
1218 |
|
1219 // ----------------------------------------------------------------------------- |
|
1220 // CCertificateMaps::FindSubjectL() |
|
1221 // ----------------------------------------------------------------------------- |
|
1222 // |
|
1223 |
|
1224 CCertificateMaps::CSubjectInfo* CCertificateMaps::FindSubjectL( const TDesC8& aTrustedSubject, TBool aUseEditedItems) |
|
1225 { |
|
1226 CSubjectInfo * info = NULL; |
|
1227 |
|
1228 BringUpToDateL(); |
|
1229 |
|
1230 //find subject info for asubject |
|
1231 for ( TInt i = 0; i < iCerts.Count(); i++) |
|
1232 { |
|
1233 info = iCerts[i]; |
|
1234 |
|
1235 if ( !EvaluateElementValidity( aUseEditedItems, info->iState)) |
|
1236 { |
|
1237 continue; |
|
1238 } |
|
1239 |
|
1240 |
|
1241 if ( info->Match( aTrustedSubject, EFalse)) |
|
1242 { |
|
1243 return info; |
|
1244 } |
|
1245 } |
|
1246 |
|
1247 return NULL; |
|
1248 } |
|
1249 |
|
1250 |
|
1251 // ----------------------------------------------------------------------------- |
|
1252 // CCertificateMaps::AddRolesToCertL() |
|
1253 // ----------------------------------------------------------------------------- |
|
1254 // |
|
1255 |
|
1256 void CCertificateMaps::AddRolesToCertL( const TDesC8& aRole, const TDesC8& aSubject, TElementState aElementState) |
|
1257 { |
|
1258 RDEBUG("CCertificateMaps::AddRolesToCertL"); |
|
1259 RDEBUG(" -> "); |
|
1260 |
|
1261 for( TInt i = 0; i < iCerts.Count(); i++) |
|
1262 { |
|
1263 CSubjectInfo * info = iCerts[i]; |
|
1264 |
|
1265 //if CASN match |
|
1266 if( info->iCASN ) |
|
1267 { |
|
1268 if( aSubject == *info->iCASN ) |
|
1269 { |
|
1270 RDEBUG8_3("PolicyEngineServer: Role mapped: %S -> %S", &aSubject, &aRole ); |
|
1271 info->iRoles.AppendL( CRolesInfo::NewL( aRole, aElementState ) ); |
|
1272 break; |
|
1273 } |
|
1274 } |
|
1275 |
|
1276 //if alias match |
|
1277 if( info->iAlias ) |
|
1278 { |
|
1279 if ( aSubject == *info->iAlias) |
|
1280 { |
|
1281 RDEBUG8_3("PolicyEngineServer: Role mapped: %S -> %S", &aSubject, &aRole ); |
|
1282 info->iRoles.AppendL( CRolesInfo::NewL( aRole, aElementState ) ); |
|
1283 break; |
|
1284 } |
|
1285 } |
|
1286 } |
|
1287 } |
|
1288 |
|
1289 |
|
1290 HBufC8* CCertificateMaps::CasnForCertInfoL( const TCertInfo& aCertInfo) |
|
1291 { |
|
1292 TInt certLength = aCertInfo.iIssuerDNInfo.iCountry.Length(); |
|
1293 certLength += aCertInfo.iIssuerDNInfo.iOrganizationUnit.Length(); |
|
1294 certLength += aCertInfo.iIssuerDNInfo.iOrganization.Length(); |
|
1295 certLength += aCertInfo.iIssuerDNInfo.iCommonName.Length(); |
|
1296 certLength += aCertInfo.iSerialNo.Length() * 2; |
|
1297 certLength += aCertInfo.iFingerprint.Length() * 2; |
|
1298 |
|
1299 HBufC8* casn = HBufC8::NewL( certLength + 5 ); |
|
1300 TPtr8 ptr = casn->Des(); |
|
1301 |
|
1302 if ( aCertInfo.iIssuerDNInfo.iCommonName.Length()) |
|
1303 { |
|
1304 ptr.Append( aCertInfo.iIssuerDNInfo.iCommonName); |
|
1305 ptr.Append( KCASNDelimeter); |
|
1306 } |
|
1307 |
|
1308 if ( aCertInfo.iIssuerDNInfo.iOrganization.Length()) |
|
1309 { |
|
1310 ptr.Append( aCertInfo.iIssuerDNInfo.iOrganization); |
|
1311 ptr.Append( KCASNDelimeter); |
|
1312 } |
|
1313 |
|
1314 if ( aCertInfo.iIssuerDNInfo.iOrganizationUnit.Length()) |
|
1315 { |
|
1316 ptr.Append( aCertInfo.iIssuerDNInfo.iOrganizationUnit); |
|
1317 ptr.Append( KCASNDelimeter); |
|
1318 } |
|
1319 |
|
1320 if ( aCertInfo.iIssuerDNInfo.iCountry.Length()) |
|
1321 { |
|
1322 ptr.Append( aCertInfo.iIssuerDNInfo.iCountry); |
|
1323 ptr.Append( KCASNDelimeter); |
|
1324 } |
|
1325 |
|
1326 if ( aCertInfo.iSerialNo.Length()) |
|
1327 { |
|
1328 TInt serialLength = aCertInfo.iSerialNo.Length(); |
|
1329 TPtr8 serialNum( (unsigned char *)(ptr.Ptr() + ptr.Length()), serialLength * 2, serialLength * 2); |
|
1330 |
|
1331 //convert fingerprint to plain text |
|
1332 for ( TInt i(0); i < aCertInfo.iSerialNo.Length(); i++) |
|
1333 { |
|
1334 ptr.AppendNumFixedWidth( aCertInfo.iSerialNo[i], EHex, 2); |
|
1335 } |
|
1336 |
|
1337 serialNum.UpperCase(); |
|
1338 ptr.Append( KCASNDelimeter); |
|
1339 } |
|
1340 |
|
1341 if ( aCertInfo.iFingerprint.Length()) |
|
1342 { |
|
1343 HBufC8* fingerPrint = HBufC8::NewLC( aCertInfo.iFingerprint.Length() * 2); |
|
1344 TPtr8 fingerPrintPtr = fingerPrint->Des(); |
|
1345 CreateFingerPrint( fingerPrintPtr, aCertInfo); |
|
1346 ptr.Append( fingerPrintPtr); |
|
1347 CleanupStack::PopAndDestroy( fingerPrint); |
|
1348 } |
|
1349 |
|
1350 |
|
1351 return casn; |
|
1352 } |
|
1353 |
|
1354 |
|
1355 // ----------------------------------------------------------------------------- |
|
1356 // CCertificateMaps::CreateFingerPrint() |
|
1357 // ----------------------------------------------------------------------------- |
|
1358 // |
|
1359 |
|
1360 void CCertificateMaps::CreateFingerPrint( TDes8& aFingerPrint, const TCertInfo& aCertInfo) |
|
1361 { |
|
1362 //convert fingerprint to plain text |
|
1363 for ( TInt i(0); i < aCertInfo.iFingerprint.Length(); i++) |
|
1364 { |
|
1365 TBuf8<2> hexBuf; |
|
1366 hexBuf.AppendNumFixedWidth( aCertInfo.iFingerprint[i], EHex, 2); |
|
1367 hexBuf.UpperCase(); |
|
1368 |
|
1369 aFingerPrint.Append(hexBuf); |
|
1370 } |
|
1371 } |
|
1372 |
|
1373 |
|
1374 |
|
1375 // ----------------------------------------------------------------------------- |
|
1376 // CCertificateMaps::CreateSubjectInfoL() |
|
1377 // ----------------------------------------------------------------------------- |
|
1378 // |
|
1379 |
|
1380 void CCertificateMaps::CreateSubjectInfoL( CSubjectInfo * aInfo, const TCertInfo& aCertInfo) |
|
1381 { |
|
1382 aInfo->iCASN = CasnForCertInfoL( aCertInfo); |
|
1383 aInfo->iSubject = aCertInfo.iSubjectDNInfo.iCommonName.AllocL(); |
|
1384 |
|
1385 aInfo->iFingerPrint = HBufC8::NewL( aCertInfo.iFingerprint.Length() * 2); |
|
1386 TPtr8 ptr = aInfo->iFingerPrint->Des(); |
|
1387 CreateFingerPrint( ptr, aCertInfo); |
|
1388 } |
|
1389 |
|
1390 |
|
1391 |
|
1392 // ----------------------------------------------------------------------------- |
|
1393 // CCertificateMaps::CreateSubjectInfoL() |
|
1394 // ----------------------------------------------------------------------------- |
|
1395 // |
|
1396 |
|
1397 void CCertificateMaps::CreateSubjectInfoL( CSubjectInfo * aInfo, const TDesC8& aCertificate) |
|
1398 { |
|
1399 //parse certificate |
|
1400 CX509Certificate * cert = ParseCertificateL( aCertificate); |
|
1401 CleanupStack::PushL( cert); |
|
1402 |
|
1403 //parse subject info part (CASN, issued to) |
|
1404 ParseSubjectInfoL( aInfo, cert); |
|
1405 |
|
1406 //destroy certificate |
|
1407 CleanupStack::PopAndDestroy( cert); |
|
1408 } |
|
1409 |
|
1410 // ----------------------------------------------------------------------------- |
|
1411 // CCertificateMaps::ParseCertificateL() |
|
1412 // ----------------------------------------------------------------------------- |
|
1413 // |
|
1414 CX509Certificate* CCertificateMaps::ParseCertificateL( const TDesC8& aCertificate) |
|
1415 { |
|
1416 RDEBUG("PolicyEngineServer: Certificate parsing"); |
|
1417 |
|
1418 TPtrC8 certPtr = aCertificate; |
|
1419 CX509Certificate* returnValue = 0; |
|
1420 |
|
1421 //if value contains CData marks it is binary coded, otherwise base64 coded |
|
1422 if ( ParserUtility::ContainsCDataField( certPtr) ) |
|
1423 { |
|
1424 RDEBUG("PolicyEngineServer: Binary format certificate detected, remove CDATA marks..."); |
|
1425 //remove cdata marks and create subject info |
|
1426 ParserUtility::RemoveCDataMarksL( certPtr); |
|
1427 RDEBUG_2("PolicyEngineServer: Binary format:", &aCertificate); |
|
1428 |
|
1429 #ifdef _DEBUG // |
|
1430 TPtrC8 debugPtr = aCertificate; |
|
1431 while ( debugPtr.Length()) |
|
1432 { |
|
1433 TInt size = 100; |
|
1434 if ( debugPtr.Length() < 100 ) size = debugPtr.Length(); |
|
1435 |
|
1436 TPtrC8 temp = debugPtr.Left( size); |
|
1437 debugPtr.Set( debugPtr.Mid( size)); |
|
1438 RDEBUG_2("%S", &temp); |
|
1439 } |
|
1440 #endif //#ifdef __DEBUG |
|
1441 returnValue = CX509Certificate::NewL( certPtr); |
|
1442 } |
|
1443 else |
|
1444 { |
|
1445 RDEBUG("PolicyEngineServer: BASE64 format certificate detected, convert to binary format"); |
|
1446 RDEBUG("PolicyEngineServer: BASE64 format:"); |
|
1447 #ifdef _DEBUG |
|
1448 TPtrC8 debugPtr = aCertificate; |
|
1449 while ( debugPtr.Length()) |
|
1450 { |
|
1451 TInt size = 64; |
|
1452 if ( debugPtr.Length() < 64 ) size = debugPtr.Length(); |
|
1453 |
|
1454 TPtrC8 temp = debugPtr.Left( size); |
|
1455 debugPtr.Set( debugPtr.Mid( size)); |
|
1456 RDEBUG_2("%S", &temp); |
|
1457 } |
|
1458 #endif //#ifdef __DEBUG |
|
1459 //convert base64 coding to binary format |
|
1460 TImCodecB64 base64; |
|
1461 |
|
1462 HBufC8 * base64Cert = HBufC8::NewLC( certPtr.Length()); |
|
1463 TPtr8 base64Ptr = base64Cert->Des(); |
|
1464 User::LeaveIfError( base64.Decode( certPtr, base64Ptr)); |
|
1465 |
|
1466 RDEBUG("PolicyEngineServer: Converting...."); |
|
1467 RDEBUG_2("PolicyEngineServer: Binary format (size %d bytes):", base64Ptr.Length()); |
|
1468 |
|
1469 #ifdef _DEBUG |
|
1470 debugPtr.Set( base64Ptr); |
|
1471 while ( debugPtr.Length()) |
|
1472 { |
|
1473 TInt size = 100; |
|
1474 if ( debugPtr.Length() < 100 ) size = debugPtr.Length(); |
|
1475 |
|
1476 TPtrC8 temp = debugPtr.Left( size); |
|
1477 debugPtr.Set( debugPtr.Mid( size)); |
|
1478 RDEBUG_2("%S", &temp); |
|
1479 } |
|
1480 #endif //#ifdef __DEBUG |
|
1481 |
|
1482 returnValue = CX509Certificate::NewL( base64Ptr); |
|
1483 CleanupStack::PopAndDestroy( base64Cert); |
|
1484 } |
|
1485 |
|
1486 |
|
1487 RDEBUG("PolicyEngineServer: Certificate Ok!"); |
|
1488 return returnValue; |
|
1489 } |
|
1490 |
|
1491 |
|
1492 // ----------------------------------------------------------------------------- |
|
1493 // CCertificateMaps::ParseSubjectInfo() |
|
1494 // ----------------------------------------------------------------------------- |
|
1495 // |
|
1496 |
|
1497 void CCertificateMaps::ParseSubjectInfoL( CSubjectInfo* aInfo, CX509Certificate* aCertificate) |
|
1498 { |
|
1499 RDEBUG("PolicyEngineServer: CTrustedSession::ParseSubjectInfoL"); |
|
1500 |
|
1501 |
|
1502 //Parse distinguished name for subject (DN) |
|
1503 aInfo->iSubject = ParseDNL( &aCertificate->SubjectName(), ETrue); |
|
1504 RDEBUG8_2("PolicyEngineServer: Certificate subject: %S", aInfo->iSubject); |
|
1505 |
|
1506 //Parse issuer distinguished name(DN) |
|
1507 HBufC8* ca = ParseDNL( &aCertificate->IssuerName(), EFalse); |
|
1508 |
|
1509 //get serial number |
|
1510 TBuf<64> serialNo; |
|
1511 TPtrC8 serialPtr = aCertificate->SerialNumber(); |
|
1512 |
|
1513 //convert serial no to plain text |
|
1514 for ( TInt i(0); i < serialPtr.Length(); i++) |
|
1515 { |
|
1516 serialNo.AppendNumFixedWidth( serialPtr[i], EHex, 2); |
|
1517 } |
|
1518 |
|
1519 serialNo.UpperCase(); |
|
1520 |
|
1521 //get finger print |
|
1522 TBuf8<40> fingerPrint; |
|
1523 TPtrC8 fingerPtr = aCertificate->Fingerprint(); |
|
1524 |
|
1525 //convert fingerprint to plain text |
|
1526 for ( TInt i(0); i < fingerPtr.Length(); i++) |
|
1527 { |
|
1528 fingerPrint.AppendNumFixedWidth( fingerPtr[i], EHex, 2); |
|
1529 } |
|
1530 |
|
1531 fingerPrint.UpperCase(); |
|
1532 aInfo->iFingerPrint = fingerPrint.AllocL(); |
|
1533 |
|
1534 //joint issuer DN and Serial number (issuer DN + serial number + fingerprint + two delimeters= CASN) |
|
1535 ca = ca->ReAllocL( ca->Length() + serialNo.Length() + fingerPrint.Length() + 2); |
|
1536 TPtr8 caPtr = ca->Des(); |
|
1537 caPtr.Append( serialNo); |
|
1538 caPtr.Append( KCASNDelimeter); |
|
1539 caPtr.Append( fingerPrint); |
|
1540 |
|
1541 aInfo->iCASN = ca; |
|
1542 |
|
1543 RDEBUG8_2("PolicyEngineServer: Certificate fingerprint: %S", aInfo->iFingerPrint); |
|
1544 RDEBUG8_2("PolicyEngineServer: Certificate CASN: %S", ca); |
|
1545 |
|
1546 } |
|
1547 |
|
1548 // ----------------------------------------------------------------------------- |
|
1549 // CCertificateMaps::ParseDNL() |
|
1550 // ----------------------------------------------------------------------------- |
|
1551 // |
|
1552 |
|
1553 HBufC8* CCertificateMaps::ParseDNL( const CX500DistinguishedName * aDN, TBool aOnlyCommonName) |
|
1554 { |
|
1555 // DN country string |
|
1556 TBuf8<4> country; |
|
1557 // DN organisation unit |
|
1558 TBuf8<64> organizationUnit; |
|
1559 // DN orginasation |
|
1560 TBuf8<64> organization; |
|
1561 // DN common name |
|
1562 TBuf8<64> commonName; |
|
1563 // DN locality |
|
1564 TBuf8<128> locality; |
|
1565 |
|
1566 TDes8* destination=NULL; |
|
1567 TBool found = EFalse; |
|
1568 |
|
1569 for ( TInt i(0); i < aDN->Count(); i++) |
|
1570 { |
|
1571 found = EFalse; |
|
1572 const CX520AttributeTypeAndValue& attribute = aDN->Element(i); |
|
1573 |
|
1574 found = ETrue; |
|
1575 if (!attribute.Type().Compare(KX520CountryName)) |
|
1576 { |
|
1577 destination = &country; |
|
1578 } |
|
1579 else if(!attribute.Type().Compare(KX520OrganizationalUnitName)) |
|
1580 { |
|
1581 destination = &organizationUnit; |
|
1582 } |
|
1583 else if(!attribute.Type().Compare(KX520OrganizationName)) |
|
1584 { |
|
1585 destination = &organization; |
|
1586 } |
|
1587 else if(!attribute.Type().Compare(KX520CommonName)) |
|
1588 { |
|
1589 destination = &commonName; |
|
1590 } |
|
1591 else if(!attribute.Type().Compare(KX520LocalityName)) |
|
1592 { |
|
1593 destination = &locality; |
|
1594 } |
|
1595 else |
|
1596 { |
|
1597 found = EFalse; |
|
1598 } |
|
1599 |
|
1600 if ( found ) |
|
1601 { |
|
1602 HBufC* value = attribute.ValueL(); |
|
1603 if ( value ) |
|
1604 { |
|
1605 destination->Copy( *value); |
|
1606 } |
|
1607 |
|
1608 delete value; |
|
1609 } |
|
1610 } |
|
1611 |
|
1612 HBufC8* retVal = NULL; |
|
1613 |
|
1614 if ( aOnlyCommonName) |
|
1615 { |
|
1616 //parse common name |
|
1617 if ( commonName.Length()) |
|
1618 { |
|
1619 retVal = commonName.AllocL(); |
|
1620 } |
|
1621 } |
|
1622 else |
|
1623 { |
|
1624 //create buffer for CA part |
|
1625 TInt size = commonName.Length() + organization.Length() + organizationUnit.Length() + country.Length(); |
|
1626 retVal = HBufC8::NewL( size + 4); |
|
1627 TPtr8 caPtr = retVal->Des(); |
|
1628 |
|
1629 if ( commonName.Length()) |
|
1630 { |
|
1631 caPtr.Append( commonName); |
|
1632 caPtr.Append( KCASNDelimeter); |
|
1633 } |
|
1634 |
|
1635 if ( organization.Length()) |
|
1636 { |
|
1637 caPtr.Append( organization); |
|
1638 caPtr.Append( KCASNDelimeter); |
|
1639 } |
|
1640 |
|
1641 if ( organizationUnit.Length()) |
|
1642 { |
|
1643 caPtr.Append( organizationUnit); |
|
1644 caPtr.Append( KCASNDelimeter); |
|
1645 } |
|
1646 |
|
1647 if ( country.Length()) |
|
1648 { |
|
1649 caPtr.Append( country); |
|
1650 caPtr.Append( KCASNDelimeter); |
|
1651 } |
|
1652 } |
|
1653 |
|
1654 return retVal; |
|
1655 } |
|
1656 |
|
1657 |
|
1658 // ----------------------------------------------------------------------------- |
|
1659 // CCertificateMaps::ParseDNL() |
|
1660 // ----------------------------------------------------------------------------- |
|
1661 // |
|
1662 TBool CCertificateMaps::EvaluateElementValidity( const TBool aUseEditedElements, const TElementState aState) |
|
1663 { |
|
1664 if ( aUseEditedElements) |
|
1665 { |
|
1666 //accept only elements which are committed... |
|
1667 if ( aState == EDepricated || aState == EDeletedEditableElement) |
|
1668 { |
|
1669 return EFalse; |
|
1670 } |
|
1671 } |
|
1672 else |
|
1673 { |
|
1674 //ignore removed and depricated elements if not committed elements are in use |
|
1675 if ( aState == EEditedElement || aState == EDeletedEditableElement || aState == EDepricated || aState == ENewElement) |
|
1676 { |
|
1677 return EFalse; |
|
1678 } |
|
1679 } |
|
1680 |
|
1681 return ETrue; |
|
1682 } |
|
1683 |
|
1684 |