XrdCryptosslX509Crl Class Reference

#include <XrdCryptosslX509Crl.hh>

Inheritance diagram for XrdCryptosslX509Crl:

Collaboration diagram for XrdCryptosslX509Crl:

Public Member Functions
	XrdCryptosslX509Crl (const char *crlf, int opt=0)
	XrdCryptosslX509Crl (FILE *, const char *crlf)
	XrdCryptosslX509Crl (XrdCryptoX509 *cacert)
virtual	~XrdCryptosslX509Crl ()
void	Dump ()
bool	hasCriticalExtension ()
bool	IsRevoked (const char *sernum, int when=0)
bool	IsRevoked (int serialnumber, int when=0)
const char *	Issuer ()
const char *	IssuerHash (int)
bool	IsValid ()
time_t	LastUpdate ()
time_t	NextUpdate ()
XrdCryptoX509Crldata	Opaque ()
const char *	ParentFile ()
bool	ToFile (FILE *fh)
bool	Verify (XrdCryptoX509 *ref)
Public Member Functions inherited from XrdCryptoX509Crl
	XrdCryptoX509Crl ()
virtual	~XrdCryptoX509Crl ()
virtual bool	IsExpired (int when=0)
const char *	IssuerHash ()

Detailed Description

Definition at line 50 of file XrdCryptosslX509Crl.hh.

Constructor & Destructor Documentation

XrdCryptosslX509Crl() [1/3]

XrdCryptosslX509Crl::XrdCryptosslX509Crl	(	const char *	crlf,
		int	opt = 0 )

Definition at line 58 of file XrdCryptosslX509Crl.cc.

                 : XrdCryptoX509Crl()
{
   // Constructor certificate from file 'cf'.
   EPNAME("X509Crl::XrdCryptosslX509Crl_file");
 
   // Make sure file name is defined;
   if (opt == 0) {
      if (Init(cf) != 0) {
         DEBUG("could not initialize the CRL from "<<cf);
         return;
      }
   } else {
      if (InitFromURI(cf, 0) != 0) {
         DEBUG("could not initialize the CRL from URI"<<cf);
         return;
      }
   }
}

References XrdCryptoX509Crl::XrdCryptoX509Crl(), DEBUG, and EPNAME.

Here is the call graph for this function:

XrdCryptosslX509Crl() [2/3]

XrdCryptosslX509Crl::XrdCryptosslX509Crl	(	FILE *	fc,
		const char *	crlf )

Definition at line 79 of file XrdCryptosslX509Crl.cc.

{
   // Constructe CRL from a FILE handle `fc` with (assumed) filename `cf`.
   EPNAME("X509Crl::XrdCryptosslX509Crl_file");
 
   if (Init(fc, cf)) {
      DEBUG("could not initialize the CRL from " << cf);
      return;
   }
}

References DEBUG, and EPNAME.

XrdCryptosslX509Crl() [3/3]

XrdCryptosslX509Crl::XrdCryptosslX509Crl

(

XrdCryptoX509 *

cacert

)

Definition at line 91 of file XrdCryptosslX509Crl.cc.

                 : XrdCryptoX509Crl()
{
   // Constructor certificate from CA certificate 'cacert'. This constructor
   // extracts the information about the location of the CRL cerificate from the
   // CA certificate extension 'crlDistributionPoints', downloads the file and
   // loads it in the cache
   EPNAME("X509Crl::XrdCryptosslX509Crl_CA");
 
   // The CA certificate must be defined
   if (!cacert || cacert->type != XrdCryptoX509::kCA) {
      DEBUG("the CA certificate is undefined or not CA! ("<<cacert<<")");
      return;
   }
 
   // Get the extension
   X509_EXTENSION *crlext = (X509_EXTENSION *) cacert->GetExtension("crlDistributionPoints");
   if (!crlext) {
      DEBUG("extension 'crlDistributionPoints' not found in the CA certificate");
      return;
   }
 
   // Bio for exporting the extension
   BIO *bext = BIO_new(BIO_s_mem());
   ASN1_OBJECT *obj = X509_EXTENSION_get_object(crlext);
   i2a_ASN1_OBJECT(bext, obj);
   X509V3_EXT_print(bext, crlext, 0, 4);
   // data length
   char *cbio = 0;
   int lbio = (int) BIO_get_mem_data(bext, &cbio);
   char *buf = (char *) malloc(lbio+1);
   // Read key from BIO to buf
   memcpy(buf, cbio, lbio);
   buf[lbio] = 0;
   BIO_free(bext);
   // Save it
   XrdOucString uris(buf);
   free(buf);
 
   DEBUG("URI string: "<< uris);
 
   XrdOucString uri;
   int from = 0;
   while ((from = uris.tokenize(uri, from, ' ')) != -1) {
      if (uri.beginswith("URI:")) {
         uri.replace("URI:","");
         uri.replace("\n","");
         if (InitFromURI(uri.c_str(), cacert->SubjectHash()) == 0) {
            crluri = uri;
            // We are done
            break;
         }
      }
   }
}

References XrdCryptoX509Crl::XrdCryptoX509Crl(), XrdOucString::beginswith(), XrdOucString::c_str(), DEBUG, EPNAME, XrdCryptoX509::GetExtension(), XrdCryptoX509::kCA, XrdOucString::replace(), XrdCryptoX509::SubjectHash(), XrdOucString::tokenize(), and XrdCryptoX509::type.

Here is the call graph for this function:

~XrdCryptosslX509Crl()

XrdCryptosslX509Crl::~XrdCryptosslX509Crl ( )

virtual

Definition at line 148 of file XrdCryptosslX509Crl.cc.

{
   // Destructor
 
   // Cleanup CRL
   if (crl)
      X509_CRL_free(crl);
}

Member Function Documentation

Dump()

void XrdCryptosslX509Crl::Dump ( )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 686 of file XrdCryptosslX509Crl.cc.

{
   // Dump content
   EPNAME("X509Crl::Dump");
 
   // Time strings
   struct tm tst;
   char stbeg[256] = {0};
   time_t tbeg = LastUpdate();
   localtime_r(&tbeg,&tst);
   asctime_r(&tst,stbeg);
   stbeg[strlen(stbeg)-1] = 0;
   char stend[256] = {0};
   time_t tend = NextUpdate();
   localtime_r(&tend,&tst);
   asctime_r(&tst,stend);
   stend[strlen(stend)-1] = 0;
 
   PRINT("+++++++++++++++ X509 CRL dump +++++++++++++++++++++++");
   PRINT("+");
   PRINT("+ File:    "<<ParentFile());
   PRINT("+");
   PRINT("+ Issuer:  "<<Issuer());
   PRINT("+ Issuer hash:  "<<IssuerHash(0));
   PRINT("+");
   if (IsExpired()) {
      PRINT("+ Validity: (expired!)");
   } else {
      PRINT("+ Validity:");
   }
   PRINT("+ LastUpdate:  "<<tbeg<<" UTC - "<<stbeg);
   PRINT("+ NextUpdate:  "<<tend<<" UTC - "<<stend);
   PRINT("+");
   PRINT("+ Number of revoked certificates: "<<nrevoked);
   PRINT("+");
   PRINT("+++++++++++++++++++++++++++++++++++++++++++++++++");
}

References EPNAME, XrdCryptoX509Crl::IsExpired(), Issuer(), XrdCryptoX509Crl::IssuerHash(), LastUpdate(), NextUpdate(), ParentFile(), and PRINT.

Here is the call graph for this function:

hasCriticalExtension()

bool XrdCryptosslX509Crl::hasCriticalExtension

(

)

Definition at line 385 of file XrdCryptosslX509Crl.cc.

                                               {
  // If the X509_CRL_get_ext_by_critical() function returns -1, no critical extension
  // has been found
  return X509_CRL_get_ext_by_critical(crl,1,-1) != -1;
}

IsRevoked() [1/2]

bool XrdCryptosslX509Crl::IsRevoked ( const char * sernum, int when = 0 )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 648 of file XrdCryptosslX509Crl.cc.

{
   // Check if certificate with 'sernum' is in the
   // list of revocated certificates
   EPNAME("IsRevoked");
 
   // Reference time
   int now = (when > 0) ? when : time(0);
 
   // Warn if CRL should be updated
   if (now > NextUpdate()) {
      DEBUG("WARNING: CRL is expired: you should download the updated one");
   }
 
   // We must have something to check against
   if (nrevoked <= 0) {
      DEBUG("No certificate in the list");
      return 0;
   }
 
   // Look into the cache
   bool revoked = false;
   XrdSutCacheEntry *cent = cache.Get((const char *)sernum);
   if (cent) {
      // Check the revocation time
      if (cent->status == kCE_ok && now > cent->mtime) {
         DEBUG("certificate "<<sernum<<" has been revoked");
         revoked = true;
      }
      cent->rwmtx.UnLock();
   }
   if (revoked) return 1;
 
   // Certificate not revoked
   return 0;
}

References DEBUG, EPNAME, kCE_ok, XrdSutCacheEntry::mtime, NextUpdate(), XrdSutCacheEntry::rwmtx, XrdSutCacheEntry::status, and XrdSysRWLock::UnLock().

Here is the call graph for this function:

IsRevoked() [2/2]

bool XrdCryptosslX509Crl::IsRevoked ( int serialnumber, int when = 0 )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 587 of file XrdCryptosslX509Crl.cc.

{
   // Check if certificate with serialnumber is in the
   // list of revocated certificates
   EPNAME("IsRevoked");
 
   // Reference time
   int now = (when > 0) ? when : time(0);
 
   // Warn if CRL should be updated
   if (now > NextUpdate()) {
      DEBUG("WARNING: CRL is expired: you should download the updated one");
   }
 
   // We must have something to check against
   if (nrevoked <= 0) {
      DEBUG("No certificate in the list");
      return 0;
   }
 
   // A serial number is never negative
   if (serialnumber < 0) {
      DEBUG("invalid serial number: "<<serialnumber);
      return 0;
   }
 
   // Ok, build the tag: the cache is keyed with the serial number in the
   // format produced by BN_bn2hex(), i.e. upper case with an even number
   // of digits, so we must use the same format here
   BIGNUM *bn = BN_new();
   if (!bn) {
      DEBUG("could not allocate a big number");
      return 0;
   }
   BN_set_word(bn, (BN_ULONG)serialnumber);
   char *tagser = BN_bn2hex(bn);
   BN_free(bn);
   if (!tagser) {
      DEBUG("could not format the serial number");
      return 0;
   }
 
   // Look into the cache
   bool revoked = false;
   XrdSutCacheEntry *cent = cache.Get((const char *)tagser);
   if (cent) {
      // Check the revocation time
      if (cent->status == kCE_ok && now > cent->mtime) {
         DEBUG("certificate "<<tagser<<" has been revoked");
         revoked = true;
      }
      cent->rwmtx.UnLock();
   }
   OPENSSL_free(tagser);
   if (revoked) return 1;
 
   // Certificate not revoked
   return 0;
}

References DEBUG, EPNAME, kCE_ok, XrdSutCacheEntry::mtime, NextUpdate(), XrdSutCacheEntry::rwmtx, XrdSutCacheEntry::status, and XrdSysRWLock::UnLock().

Here is the call graph for this function:

Issuer()

const char * XrdCryptosslX509Crl::Issuer ( )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 498 of file XrdCryptosslX509Crl.cc.

{
   // Return issuer name
   EPNAME("X509Crl::Issuer");
 
   // If we do not have it already, try extraction
   if (issuer.length() <= 0) {
 
      // Make sure we have a CRL
      if (!crl) {
         DEBUG("WARNING: no CRL available - cannot extract issuer name");
         return (const char *)0;
      }
 
      // Extract issuer name
      XrdCryptosslNameOneLine(X509_CRL_get_issuer(crl), issuer);
   }
 
   // return what we have
   return (issuer.length() > 0) ? issuer.c_str() : (const char *)0;
}

References DEBUG, EPNAME, and XrdCryptosslNameOneLine().

Referenced by Dump().

Here is the call graph for this function:

Here is the caller graph for this function:

IssuerHash()

const char * XrdCryptosslX509Crl::IssuerHash ( int alg )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 521 of file XrdCryptosslX509Crl.cc.

{
   // Return hash of issuer name
   // Use default algorithm (X509_NAME_hash) for alg = 0, old algorithm
   // (for v>=1.0.0) when alg = 1
   EPNAME("X509::IssuerHash");
 
#if (OPENSSL_VERSION_NUMBER >= 0x10000000L && !defined(__APPLE__))
   if (alg == 1) {
      // md5 based
      if (issueroldhash.length() <= 0) {
         // Make sure we have a certificate
         if (crl) {
            char chash[30] = {0};
            snprintf(chash, sizeof(chash),
                     "%08lx.0",X509_NAME_hash_old(X509_CRL_get_issuer(crl)));
            issueroldhash = chash;
         } else {
            DEBUG("WARNING: no certificate available - cannot extract issuer hash (md5)");
         }
      }
      // return what we have
      return (issueroldhash.length() > 0) ? issueroldhash.c_str() : (const char *)0;
   }
#else
   if (alg == 1) { }
#endif
 
   // If we do not have it already, try extraction
   if (issuerhash.length() <= 0) {
 
      // Make sure we have a certificate
      if (crl) {
         char chash[30] = {0};
         snprintf(chash, sizeof(chash),
                  "%08lx.0",X509_NAME_hash(X509_CRL_get_issuer(crl)));
         issuerhash = chash;
      } else {
         DEBUG("WARNING: no certificate available - cannot extract issuer hash (default)");
      }
   }
 
   // return what we have
   return (issuerhash.length() > 0) ? issuerhash.c_str() : (const char *)0;
}

References DEBUG, and EPNAME.

IsValid()

bool XrdCryptosslX509Crl::IsValid ( )

inlinevirtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 59 of file XrdCryptosslX509Crl.hh.

{ return (crl != 0); }

LastUpdate()

time_t XrdCryptosslX509Crl::LastUpdate ( )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 466 of file XrdCryptosslX509Crl.cc.

{
   // Time of last update
 
   // If we do not have it already, try extraction
   if (lastupdate < 0) {
      // Make sure we have a CRL
      if (crl)
         // Extract UTC time in secs from Epoch
         lastupdate = XrdCryptosslASN1toUTC(X509_CRL_get0_lastUpdate(crl));
   }
   // return what we have
   return lastupdate;
}

References X509_CRL_get0_lastUpdate, and XrdCryptosslASN1toUTC().

Referenced by Dump().

Here is the call graph for this function:

Here is the caller graph for this function:

NextUpdate()

time_t XrdCryptosslX509Crl::NextUpdate ( )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 482 of file XrdCryptosslX509Crl.cc.

{
   // Time of next update
 
   // If we do not have it already, try extraction
   if (nextupdate < 0) {
      // Make sure we have a CRL
      if (crl)
         // Extract UTC time in secs from Epoch
         nextupdate = XrdCryptosslASN1toUTC(X509_CRL_get0_nextUpdate(crl));
   }
   // return what we have
   return nextupdate;
}

References X509_CRL_get0_nextUpdate, and XrdCryptosslASN1toUTC().

Referenced by Dump(), IsRevoked(), and IsRevoked().

Here is the call graph for this function:

Here is the caller graph for this function:

Opaque()

XrdCryptoX509Crldata XrdCryptosslX509Crl::Opaque ( )

inlinevirtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 62 of file XrdCryptosslX509Crl.hh.

{ return (XrdCryptoX509Crldata)crl; }

ParentFile()

const char * XrdCryptosslX509Crl::ParentFile ( )

inlinevirtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 66 of file XrdCryptosslX509Crl.hh.

{ return (const char *)(srcfile.c_str()); }

Referenced by Dump().

Here is the caller graph for this function:

ToFile()

bool XrdCryptosslX509Crl::ToFile

(

FILE *

fh

)

Definition at line 329 of file XrdCryptosslX509Crl.cc.

{
   // Write the CRL's contents to a file in the PEM format.
   EPNAME("ToFile");
 
   if (!crl) {
      DEBUG("CRL object invalid; cannot write to a file");
      return false;
   }
 
   if (PEM_write_X509_CRL(fh, crl) == 0) {
      DEBUG("Unable to write CRL to file");
      return false;
   }
 
   //
   // Notify
   DEBUG("CRL successfully written to file");
 
   return true;
}

References DEBUG, and EPNAME.

Verify()

bool XrdCryptosslX509Crl::Verify ( XrdCryptoX509 * ref )

virtual

Reimplemented from XrdCryptoX509Crl.

Definition at line 568 of file XrdCryptosslX509Crl.cc.

{
   // Verify certificate signature with pub key of ref cert
 
   // We must have been initialized
   if (!crl)
      return 0;
 
   // We must have something to check with
   X509 *r = ref ? (X509 *)(ref->Opaque()) : 0;
   EVP_PKEY *rk = r ? X509_get_pubkey(r) : 0;
   if (!rk)
      return 0;
 
   // Ok: we can verify
   return (X509_CRL_verify(crl, rk) > 0);
}

References XrdCryptoX509::Opaque().

Here is the call graph for this function:

---

The documentation for this class was generated from the following files:

• XrdCryptosslX509Crl.hh
• XrdCryptosslX509Crl.cc