[cpp-xmltooling COMMIT] in /branches/REL_1/xmltooling/security: AbstractPKIXTrustEngine.h impl/AbstractPKIXTrustEngin...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Aug 11 19:56:02 2011
New Revision: 899

URL: http://svn.shibboleth.net/view/cpp-xmltooling?rev=899&view=rev
Log:
https://issues.shibboleth.net/jira/browse/CPPXT-78

Modified:
    branches/REL_1/xmltooling/security/AbstractPKIXTrustEngine.h
    branches/REL_1/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp

Modified: branches/REL_1/xmltooling/security/AbstractPKIXTrustEngine.h
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/security/AbstractPKIXTrustEngine.h?rev=899&r1=898&r2=899&view=diff
==============================================================================
--- branches/REL_1/xmltooling/security/AbstractPKIXTrustEngine.h (original)
+++ branches/REL_1/xmltooling/security/AbstractPKIXTrustEngine.h Thu Aug 11 19:56:02 2011
@@ -31,6 +31,7 @@
 #include <xmltooling/security/OpenSSLTrustEngine.h>
 #include <xmltooling/security/SignatureTrustEngine.h>
 
+#include <set>
 #include <string>
 
 namespace xmltooling {
@@ -51,24 +52,41 @@
          * 
          * <ul>
          *  <li>checkRevocation attribute (off, entityOnly, fullChain)
+         *  <li>policyMappingInhibit attribute (boolean)
+         *  <li>anyPolicyInhibit attribute (boolean)
+         *  <li>&lt;TrustedName&gt; element (zero or more)
+         *  <li>&lt;PolicyOID&gt; element (zero or more)
          * </ul>
          * 
          * @param e DOM to supply configuration for provider
          */
         AbstractPKIXTrustEngine(const xercesc::DOMElement* e=nullptr);
 
-		/** Controls revocation checking, currently limited to CRLs and supports "off", "entityOnly", "fullChain". */
-		std::string m_checkRevocation;
+        /** Controls revocation checking, currently limited to CRLs and supports "off", "entityOnly", "fullChain". */
+        std::string m_checkRevocation;
 
         /** Deprecated option, equivalent to checkRevocation="fullChain". */
         bool m_fullCRLChain;
-        
+
+        /** Disable policy mapping when applying PKIX policy checking. */
+        bool m_policyMappingInhibit;
+
+        /** Disallow the anyPolicy OID (2.5.29.32.0) when applying PKIX policy checking. */
+        bool m_anyPolicyInhibit;
+
+        /** A list of acceptable policy OIDs (explicit policy checking). */
+        std::set<std::string> m_policyOIDs;
+
+        /** A list of trusted names (subject DNs / CN attributes / subjectAltName entries). */
+        std::set<std::string> m_trustedNames;
+
         /**
          * Checks that either the name of the peer with the given credentials or the names
          * of the credentials match the subject or subject alternate names of the certificate.
+         * Alternatively explicit trusted names can be supplied statically via configuration.
          * 
          * @param certEE        the credential for the entity to validate
-         * @param credResolver  source of credentials
+         * @param credResolver  source of trusted credentials
          * @param criteria      criteria for selecting credentials, including the peer name
          * 
          * @return true the name check succeeds, false if not

Modified: branches/REL_1/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp?rev=899&r1=898&r2=899&view=diff
==============================================================================
--- branches/REL_1/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp (original)
+++ branches/REL_1/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp Thu Aug 11 19:56:02 2011
@@ -257,9 +257,12 @@
         X509* EE,
         STACK_OF(X509)* untrusted,
         AbstractPKIXTrustEngine::PKIXValidationInfoIterator* pkixInfo,
-		bool useCRL,
+        bool useCRL,
         bool fullCRLChain,
-        const vector<XSECCryptoX509CRL*>* inlineCRLs=nullptr
+        const vector<XSECCryptoX509CRL*>* inlineCRLs=nullptr,
+        bool policyMappingInhibit=false,
+        bool anyPolicyInhibit=false,
+        const set<string>* policyOIDs=nullptr
         )
     {
         Category& log=Category::getInstance(XMLTOOLING_LOGCAT".TrustEngine");
@@ -272,6 +275,62 @@
         if (!store) {
             log_openssl();
             return false;
+        }
+
+        // PKIX policy checking (cf. RFCs 3280/5280 section 6)
+        if (policyMappingInhibit || anyPolicyInhibit || (policyOIDs && !policyOIDs->empty())) {
+#if (OPENSSL_VERSION_NUMBER < 0x00908000L)
+            log.error("PKIX policy checking option is configured, but OpenSSL version is less than 0.9.8");
+            X509_STORE_free(store);
+            return false;
+#else
+            unsigned long pflags = 0;
+            X509_VERIFY_PARAM *vpm = X509_VERIFY_PARAM_new();
+            if (!vpm) {
+                log_openssl();
+                X509_STORE_free(store);
+                return false;
+            }
+
+            // populate the "user-initial-policy-set" input variable
+            if (policyOIDs && !policyOIDs->empty()) {

[... 141 lines stripped ...]