|
1 /* |
|
2 * Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies). |
|
3 * All rights reserved. |
|
4 * This component and the accompanying materials are made available |
|
5 * under the terms of the License "Eclipse Public License v1.0" |
|
6 * which accompanies this distribution, and is available |
|
7 * at the URL "http://www.eclipse.org/legal/epl-v10.html". |
|
8 * |
|
9 * Initial Contributors: |
|
10 * Nokia Corporation - initial contribution. |
|
11 * |
|
12 * Contributors: |
|
13 * |
|
14 * Description: |
|
15 * TPKIXConstraint and TPKIXPolicyConstraint implementations |
|
16 * |
|
17 */ |
|
18 |
|
19 |
|
20 |
|
21 |
|
22 /** |
|
23 @file |
|
24 @internalTechnology |
|
25 */ |
|
26 |
|
27 #if !defined (__PKIXCONS_H__) |
|
28 #define __PKIXCONS_H__ |
|
29 |
|
30 #include <e32std.h> |
|
31 #include <x509cert.h> |
|
32 #include <x509certchain.h> |
|
33 #include <x509certext.h> |
|
34 #include <x509gn.h> |
|
35 #include <pkixcertchain.h> |
|
36 #include "pkixcertstate.h" |
|
37 |
|
38 class TPKIXConstraint |
|
39 { |
|
40 protected: |
|
41 TPKIXConstraint(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult); |
|
42 void Remove(CArrayPtrFlat<CX509CertExtension>& aCriticalExtensions, const TDesC& aOID); |
|
43 CPKIXValidationState& iState; |
|
44 CPKIXValidationResultBase& iResult; |
|
45 }; |
|
46 |
|
47 /* |
|
48 Certificate policies are processed in the following way: |
|
49 |
|
50 Inputs: |
|
51 ------ |
|
52 user-constrained policy set: set of policies deemed acceptable to client of PKIXCert (relying party) |
|
53 |
|
54 Variables: |
|
55 --------- |
|
56 UP: user-constrained-policy set: initialised by user, or set to empty (='any-policy', since empty is not a sensible value) |
|
57 AP: authority-constrained policy set: set of policies deemed acceptable to issuing authority, initialised to 'any-policy' |
|
58 MP: mapped policy set: set of mapped policies, initialised to empty |
|
59 explicit policy: integer indicating position of first certificate in path where explicit policy ID is required. |
|
60 intialised to n+1 where n=length of chain |
|
61 policy mapping: integer indicating position of last certificate in path where policy mapping is allowed |
|
62 intialised to n+1 where n=length of chain |
|
63 |
|
64 Processing: |
|
65 ---------- |
|
66 For each certificate in chain, where certificate is at i in the chain (root being 1, ee cert being n): |
|
67 |
|
68 -if explicit policy <= i, a policy ID in cert shall be in UP |
|
69 -if policy mapping <= i, policy may not be mapped |
|
70 -if the cert doesn't contain a policy extension, then: |
|
71 -if AP = any, AP is unchanged |
|
72 -else AP is set to empty |
|
73 -if the cert contains a policy extension then |
|
74 -AP is set to the intersection of AP and CP |
|
75 -any mapped policies occurring in CP are added to AP |
|
76 |
|
77 -if we can do mapping, then |
|
78 -if AP = any then |
|
79 -all the 'subject' policies are added to MP |
|
80 -for all mapped policies, if the 'issuer' policy is in UP then the 'subject' policy is added to UP |
|
81 -if AP != any then |
|
82 -for all mapped policies, |
|
83 -if the issuer policy is in AP then |
|
84 -the subject policy is added to MP |
|
85 -if the issuer policy is in UP then the subject policy is added to UP |
|
86 |
|
87 At the end of the chain, |
|
88 -if UP = any then we pass |
|
89 -if UP != any then |
|
90 -if AP = any then we fail |
|
91 -otherwise we intersect AP and UP; if the result is empty then we fail |
|
92 |
|
93 It is not entirely clear that this is a faithful implementation of the algorithm described in RFC 2459 |
|
94 section 6.1, because the spec is a little ambiguous here. Additionally, this section of the spec is |
|
95 currently undergoing revision (true as of 12 April 2000). So when it's finished being revised, the code |
|
96 here should be revised to reflect the spec. |
|
97 |
|
98 However, for the test vectors that I have at this time this appears to give sensible results. |
|
99 |
|
100 */ |
|
101 |
|
102 class TPKIXPolicyConstraint : public TPKIXConstraint |
|
103 { |
|
104 public: |
|
105 TPKIXPolicyConstraint(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult); |
|
106 void CheckCertPoliciesL(const CX509Certificate& aCert); |
|
107 void UpdatePolicyConstraintsL(const CX509Certificate& aCert); |
|
108 void FinishPolicyCheckL(); |
|
109 private: |
|
110 void IntersectCertPoliciesL(const CX509CertPoliciesExt& aPolicyExt); |
|
111 void UpdateConstraint(const TX509PolicyConstraint& aConstraint, TInt& aCountdown); |
|
112 CArrayPtrFlat<CX509CertPolicyInfo>* IntersectionLC( const CArrayPtrFlat<CX509CertPolicyInfo>& aFirst, |
|
113 const CArrayPtrFlat<CX509CertPolicyInfo>& aSecond); |
|
114 TBool PolicyIsPresentL( const CArrayPtrFlat<CX509CertPolicyInfo>& aPolicies, |
|
115 const CArrayPtr<HBufC>& aAcceptablePolicies); |
|
116 static void CleanupPolicyInfoArray(TAny* aPolicies); |
|
117 }; |
|
118 |
|
119 class TPKIXNameConstraint : public TPKIXConstraint |
|
120 { |
|
121 public: |
|
122 TPKIXNameConstraint(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult); |
|
123 void CheckNameConstraintsL( const CX509Certificate& aCert); |
|
124 void UpdateNameConstraintsL(const CX509Certificate& aCert); |
|
125 private: |
|
126 TBool NameIsPresentL(const CX500DistinguishedName& aSubject, |
|
127 const CArrayPtrFlat<CX500DistinguishedName>& aSubtrees); |
|
128 TBool NameIsPresent(const CX509DomainName& aSubject, |
|
129 const CArrayPtrFlat<CX509DomainName>& aSubtrees); |
|
130 TBool NameIsPresent(const CX509IPAddress& aSubject, |
|
131 const CArrayPtrFlat<CX509IPSubnetMask>& aSubtrees); |
|
132 }; |
|
133 |
|
134 class TPKIXBasicConstraint : public TPKIXConstraint |
|
135 { |
|
136 public: |
|
137 TPKIXBasicConstraint(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult); |
|
138 void CheckCertSubjectTypeL(const CX509Certificate& aCert); |
|
139 void UpdatePathLengthConstraintsL(const CX509Certificate& aCert); |
|
140 private: |
|
141 }; |
|
142 |
|
143 class TPKIXKeyUsageConstraint : public TPKIXConstraint |
|
144 { |
|
145 public: |
|
146 TPKIXKeyUsageConstraint(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult); |
|
147 void CheckKeyUsageL(const CX509Certificate& aCert); |
|
148 private: |
|
149 }; |
|
150 |
|
151 #endif |