XrdCryptosslX509 Class Reference

#include <XrdCryptosslX509.hh>

Inheritance diagram for XrdCryptosslX509:

Collaboration diagram for XrdCryptosslX509:

Public Member Functions
	XrdCryptosslX509 (const char *cf, const char *kf=0)
	XrdCryptosslX509 (X509 *cert)
	XrdCryptosslX509 (XrdSutBucket *bck)
virtual	~XrdCryptosslX509 ()
int	BitStrength ()
int	DumpExtensions (bool dumpunknown=0)
XrdSutBucket *	Export ()
XrdCryptoX509data	GetExtension (const char *oid)
const char *	Issuer ()
const char *	IssuerHash (int=0)
virtual bool	MatchesSAN (const char *, bool &)
time_t	NotAfter ()
time_t	NotBefore ()
XrdCryptoX509data	Opaque ()
const char *	ParentFile ()
XrdCryptoRSA *	PKI ()
const char *	ProxyType () const
kXR_int64	SerialNumber ()
XrdOucString	SerialNumberString ()
void	SetPKI (XrdCryptoX509data pki)
const char *	Subject ()
const char *	SubjectHash (int=0)
bool	Verify (XrdCryptoX509 *ref)
Public Member Functions inherited from XrdCryptoX509
	XrdCryptoX509 ()
virtual	~XrdCryptoX509 ()
virtual void	Dump ()
virtual bool	IsExpired (int when=0)
const char *	IssuerHash ()
virtual bool	IsValid (int when=0)
const char *	SubjectHash ()
const char *	Type (EX509Type t=kUnknown) const

Additional Inherited Members
Public Types inherited from XrdCryptoX509
enum	EX509Type {   kUnknown = -1 ,   kCA = 0 ,   kEEC = 1 ,   kProxy = 2 }
Static Public Member Functions inherited from XrdCryptoX509
static bool	MatchHostnames (const char *match_pattern, const char *fqdn)
Public Attributes inherited from XrdCryptoX509
EX509Type	type

Detailed Description

Definition at line 48 of file XrdCryptosslX509.hh.

Constructor & Destructor Documentation

XrdCryptosslX509() [1/3]

XrdCryptosslX509::XrdCryptosslX509	(	const char *	cf,
		const char *	kf = 0
	)

Definition at line 66 of file XrdCryptosslX509.cc.

                 : XrdCryptoX509()
{
   // Constructor certificate from file 'cf'. If 'kf' is defined,
   // complete the key of the certificate with the private key in kf.
   EPNAME("X509::XrdCryptosslX509_file");
 
   // Init private members
   cert = 0;        // The certificate object
   notbefore = -1;  // begin-validity time in secs since Epoch
   notafter = -1;   // end-validity time in secs since Epoch
   subject = "";    // subject;
   issuer = "";     // issuer;
   subjecthash = ""; // hash of subject;
   issuerhash = "";  // hash of issuer;
   subjectoldhash = ""; // hash of subject (md5 algorithm);
   issueroldhash = "";  // hash of issuer (md5 algorithm);
   srcfile = "";    // source file;
   bucket = 0;      // bucket for serialization
   pki = 0;         // PKI of the certificate
   pxytype = 0;    // Proxy sub-type
 
   // Make sure file name is defined;
   if (!cf) {
      DEBUG("file name undefined");
      return;
   }
   // Make sure file exists;
   struct stat st;
   int fd = open(cf, O_RDONLY);
 
   if (fd == -1) {
      if (errno == ENOENT) {
         DEBUG("file "<<cf<<" does not exist - do nothing");
      } else {
         DEBUG("cannot open file "<<cf<<" (errno: "<<errno<<")");
      }
      return;
   }
 
   if (fstat(fd, &st) != 0) {
      DEBUG("cannot stat file "<<cf<<" (errno: "<<errno<<")");
      close(fd);
      return;
   }
   //
   // Open file in read mode
   FILE *fc = fdopen(fd, "r");
   if (!fc) {
      DEBUG("cannot fdopen file "<<cf<<" (errno: "<<errno<<")");
      close(fd);
      return;
   }
   //
   // Read the content:
   if (!PEM_read_X509(fc, &cert, 0, 0)) {
      DEBUG("Unable to load certificate from file");
      return;
   } else {
      DEBUG("certificate successfully loaded");
   }
   //
   // Close the file
   fclose(fc);
   //
   // Save source file name
   srcfile = cf;
 
   // Init some of the private members (the others upon need)
   Subject();
   Issuer();
   CertType();
 
   // Get the public key
   EVP_PKEY *evpp = 0;
   // Read the private key file, if specified
   if (kf) {
      int fd = open(kf, O_RDONLY);
      if (fd == -1) {
         DEBUG("cannot open file "<<kf<<" (errno: "<<errno<<")");
         return;
      }
      if (fstat(fd, &st) == -1) {
         DEBUG("cannot stat private key file "<<kf<<" (errno:"<<errno<<")");
         close(fd);
         return;
      }
      if (!S_ISREG(st.st_mode) || S_ISDIR(st.st_mode) ||
            (st.st_mode & (S_IROTH | S_IWOTH)) != 0 ||
            (st.st_mode & (S_IWGRP)) != 0) {
         DEBUG("private key file "<<kf<<" has wrong permissions "<<
               (st.st_mode & 0777) << " (should be at most 0640)");
         close(fd);
         return;
      }
      // Open file in read mode
      FILE *fk = fdopen(fd, "r");
      if (!fk) {
         DEBUG("cannot open file "<<kf<<" (errno: "<<errno<<")");
         close(fd);
         return;
      }
      // This call fills the full key, i.e. also the public part (not really documented, though)
      if ((evpp = PEM_read_PrivateKey(fk,0,0,0))) {
         DEBUG("RSA key completed ");
         // Test consistency
         auto tmprsa = std::make_unique<XrdCryptosslRSA>(evpp, 1);
         if (tmprsa->status == XrdCryptoRSA::kComplete) {
            // Save it in pki
            pki = tmprsa.release();
         }
      } else {
         DEBUG("cannot read the key from file");
      }
      // Close the file
      fclose(fk);
   }
   // If there were no private key or we did not manage to import it
   // init pki with the partial key
   if (!pki)
      pki = new XrdCryptosslRSA(X509_get_pubkey(cert), 0);
}

References close, DEBUG, EPNAME, fclose(), fstat, Issuer(), XrdCryptoRSA::kComplete, open, stat, and Subject().

Here is the call graph for this function:

XrdCryptosslX509() [2/3]

XrdCryptosslX509::XrdCryptosslX509

(

XrdSutBucket *

bck

)

Definition at line 190 of file XrdCryptosslX509.cc.

                                                     : XrdCryptoX509()
{
   // Constructor certificate from BIO 'bcer'
   EPNAME("X509::XrdCryptosslX509_bio");
 
   // Init private members
   cert = 0;        // The certificate object
   notbefore = -1;  // begin-validity time in secs since Epoch
   notafter = -1;   // end-validity time in secs since Epoch
   subject = "";    // subject;
   issuer = "";     // issuer;
   subjecthash = ""; // hash of subject;
   issuerhash = "";  // hash of issuer;
   subjectoldhash = ""; // hash of subject (md5 algorithm);
   issueroldhash = "";  // hash of issuer (md5 algorithm);
   srcfile = "";    // source file;
   bucket = 0;      // bucket for serialization
   pki = 0;         // PKI of the certificate
   pxytype = 0;    // Proxy sub-type
 
   // Make sure we got something;
   if (!buck) {
      DEBUG("got undefined opaque buffer");
      return;
   }
 
   //
   // Create a bio_mem to store the certificates
   BIO *bmem = BIO_new(BIO_s_mem());
   if (!bmem) {
      DEBUG("unable to create BIO for memory operations");
      return; 
   }
 
   // Write data to BIO
   int nw = BIO_write(bmem,(const void *)(buck->buffer),buck->size);
   if (nw != buck->size) {
      DEBUG("problems writing data to memory BIO (nw: "<<nw<<")");
      return; 
   }
 
   // Get certificate from BIO
   if (!(cert = PEM_read_bio_X509(bmem,0,0,0))) {
      DEBUG("unable to read certificate to memory BIO");
      return;
   }
   //
   // Free BIO
   BIO_free(bmem);
 
   //
   // Init some of the private members (the others upon need)
   Subject();
   Issuer();
   CertType();
 
   // Get the public key
   EVP_PKEY *evpp = X509_get_pubkey(cert);
   //
   if (evpp) {
      // init pki with the partial key
      if (!pki)
         pki = new XrdCryptosslRSA(evpp, 0);
   } else {
      DEBUG("could not access the public key");
   }
}

References XrdSutBucket::buffer, DEBUG, EPNAME, Issuer(), XrdSutBucket::size, and Subject().

Here is the call graph for this function:

XrdCryptosslX509() [3/3]

XrdCryptosslX509::XrdCryptosslX509

(

X509 *

cert

)

Definition at line 259 of file XrdCryptosslX509.cc.

                                           : XrdCryptoX509()
{
   // Constructor: import X509 object
   EPNAME("X509::XrdCryptosslX509_x509");
 
   // Init private members
   cert = 0;        // The certificate object
   notbefore = -1;  // begin-validity time in secs since Epoch
   notafter = -1;   // end-validity time in secs since Epoch
   subject = "";    // subject;
   issuer = "";     // issuer;
   subjecthash = ""; // hash of subject;
   issuerhash = "";  // hash of issuer;
   subjectoldhash = ""; // hash of subject (md5 algorithm);
   issueroldhash = "";  // hash of issuer (md5 algorithm);
   srcfile = "";    // source file;
   bucket = 0;      // bucket for serialization
   pki = 0;         // PKI of the certificate
   pxytype = 0;    // Proxy sub-type
 
   // Make sure we got something;
   if (!xc) {
      DEBUG("got undefined X509 object");
      return;
   }
 
   // Set certificate
   cert = xc;
 
   //
   // Init some of the private members (the others upon need)
   Subject();
   Issuer();
   CertType();
 
   // Get the public key
   EVP_PKEY *evpp = X509_get_pubkey(cert);
   //
   if (evpp) {
      // init pki with the partial key
      if (!pki)
         pki = new XrdCryptosslRSA(evpp, 0);
   } else {
      DEBUG("could not access the public key");
   }
}

References DEBUG, EPNAME, Issuer(), and Subject().

Here is the call graph for this function:

~XrdCryptosslX509()

XrdCryptosslX509::~XrdCryptosslX509 ( )

virtual

Definition at line 307 of file XrdCryptosslX509.cc.

{
   // Destructor
 
   // Cleanup certificate
   if (cert) X509_free(cert);
   // Cleanup key
   if (pki) delete pki;
}

Member Function Documentation

BitStrength()

int XrdCryptosslX509::BitStrength ( )

inlinevirtual

Reimplemented from XrdCryptoX509.

Definition at line 77 of file XrdCryptosslX509.hh.

{ return ((cert) ? EVP_PKEY_bits(X509_get_pubkey(cert)) : -1);}

DumpExtensions()

int XrdCryptosslX509::DumpExtensions ( bool  dumpunknown = 0 )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 806 of file XrdCryptosslX509.cc.

{
   // Dump our extensions, if any
   // Returns -1 on failure, 0 on success 
   EPNAME("DumpExtensions");
 
   int rc = -1;
   // Point to the cerificate
   X509 *xpi = (X509 *) Opaque();
 
   // Make sure we got the right inputs
   if (!xpi) {
      PRINT("we are empty! Do nothing");
      return rc;
   }
 
   rc = 1;
   // Go through the extensions
   X509_EXTENSION *xpiext = 0;
   int npiext = X509_get_ext_count(xpi);
   PRINT("found "<<npiext<<" extensions ");
   int i = 0;
   for (i = 0; i< npiext; i++) {
      xpiext = X509_get_ext(xpi, i);
      char s[256];
      OBJ_obj2txt(s, sizeof(s), X509_EXTENSION_get_object(xpiext), 1);
      int crit = X509_EXTENSION_get_critical(xpiext);
      // Notify what we found
      PRINT(i << ": found extension '"<<s<<"', critical: " << crit);
      // Dump its content
      rc = 0;
      const unsigned char *pp = (const unsigned char *) X509_EXTENSION_get_data(xpiext)->data;
      long length = X509_EXTENSION_get_data(xpiext)->length;
      int ret = FillUnknownExt(&pp, length, dumpunknown);
      PRINT("ret: " << ret);
   }
 
   // Done
   return rc;
}

References EPNAME, Opaque(), and PRINT.

Here is the call graph for this function:

Export()

XrdSutBucket * XrdCryptosslX509::Export ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 716 of file XrdCryptosslX509.cc.

{
   // Export in form of bucket
   EPNAME("X509::Export");
 
   // If we have already done it, return the previous result
   if (bucket) {
      DEBUG("serialization already performed:"
            " return previous result ("<<bucket->size<<" bytes)");
      return bucket;
   }
 
   // Make sure we got something to export
   if (!cert) {
      DEBUG("certificate is not initialized");
      return 0;
   }
 
   //
   // Now we create a bio_mem to serialize the certificate
   BIO *bmem = BIO_new(BIO_s_mem());
   if (!bmem) {
      DEBUG("unable to create BIO for memory operations");
      return 0;
   }
 
   // Write certificate to BIO
   if (!PEM_write_bio_X509(bmem, cert)) {
      DEBUG("unable to write certificate to memory BIO");
      return 0;
   }
 
   // Extract pointer to BIO data and length of segment
   char *bdata = 0;  
   int blen = BIO_get_mem_data(bmem, &bdata);
   DEBUG("BIO data: "<<blen<<" bytes at 0x"<<(int *)bdata);
 
   // create the bucket now
   bucket = new XrdSutBucket(0,0,kXRS_x509);
   if (bucket) {
      // Fill bucket
      bucket->SetBuf(bdata, blen);
      DEBUG("result of serialization: "<<bucket->size<<" bytes");
   } else {
      DEBUG("unable to create bucket for serialized format");
      BIO_free(bmem);
      return 0;
   }
   //
   // Free BIO
   BIO_free(bmem);
   //
   // We are done
   return bucket;
}

References DEBUG, EPNAME, kXRS_x509, XrdSutBucket::SetBuf(), and XrdSutBucket::size.

Here is the call graph for this function:

GetExtension()

XrdCryptoX509data XrdCryptosslX509::GetExtension ( const char *  oid )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 653 of file XrdCryptosslX509.cc.

{
   // Return pointer to extension with OID oid, if any, in
   // opaque form
   EPNAME("X509::GetExtension");
   XrdCryptoX509data ext = 0;
 
   // Make sure we got something to look for
   if (!oid) {
      DEBUG("OID string not defined");
      return ext;
   }
 
   // Make sure we got something to look for
   if (!cert) {
      DEBUG("certificate is not initialized");
      return ext;
   }
 
   // Are there any extension?
   int numext = X509_get_ext_count(cert);
   if (numext <= 0) {
      DEBUG("certificate has got no extensions");
      return ext;
   }
   DEBUG("certificate has "<<numext<<" extensions");
 
   // If the string is the Standard Name of a known extension check
   // searche the corresponding NID
   int nid = OBJ_sn2nid(oid);
   bool usenid = (nid > 0);
 
   // Loop to identify the one we would like
   int i = 0;
   X509_EXTENSION *wext = 0;
   for (i = 0; i< numext; i++) {
      wext = X509_get_ext(cert, i);
      if (usenid) {
         int enid = OBJ_obj2nid(X509_EXTENSION_get_object(wext));
         if (enid == nid)
            break;
      } else {
         // Try matching of the text
         char s[256];
         OBJ_obj2txt(s, sizeof(s), X509_EXTENSION_get_object(wext), 1);
         if (!strcmp(s, oid)) 
            break;
      }
      // Do not free the extension: its owned by the certificate
      wext = 0;
   }
 
   // We are done if nothing was found
   if (!wext) {
      DEBUG("Extension "<<oid<<" not found"); 
      return ext;
   }
 
   // We are done
   return (XrdCryptoX509data)wext;
}

References DEBUG, and EPNAME.

Issuer()

const char * XrdCryptosslX509::Issuer ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 508 of file XrdCryptosslX509.cc.

{
   // Return issuer name
   EPNAME("X509::Issuer");
 
   // If we do not have it already, try extraction
   if (issuer.length() <= 0) {
 
      // Make sure we have a certificate
      if (!cert) {
         DEBUG("WARNING: no certificate available - cannot extract issuer name");
         return (const char *)0;
      }
 
      // Extract issuer name
      XrdCryptosslNameOneLine(X509_get_issuer_name(cert), issuer);
   }
 
   // return what we have
   return (issuer.length() > 0) ? issuer.c_str() : (const char *)0;
}

References XrdOucString::c_str(), DEBUG, EPNAME, XrdOucString::length(), and XrdCryptosslNameOneLine().

Referenced by XrdCryptosslX509().

Here is the call graph for this function:

Here is the caller graph for this function:

IssuerHash()

const char * XrdCryptosslX509::IssuerHash ( int  alg = 0 )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 531 of file XrdCryptosslX509.cc.

{
   // Return hash of issuer name
   // Use default algorithm (X509_NAME_hash) for alg = 0, old algorithm
   // (for v>=1.0.0) when alg = 1
   EPNAME("X509::IssuerHash");
 
   if (alg == 1) {
      // md5 based
      if (issueroldhash.length() <= 0) {
         // Make sure we have a certificate
         if (cert) {
            char chash[30] = {0};
            snprintf(chash, sizeof(chash),
                     "%08lx.0",X509_NAME_hash_old(X509_get_issuer_name(cert)));
            issueroldhash = chash;
         } else {
            DEBUG("WARNING: no certificate available - cannot extract issuer hash (md5)");
         }
      }
      // return what we have
      return (issueroldhash.length() > 0) ? issueroldhash.c_str() : (const char *)0;
   }
 
   // If we do not have it already, try extraction
   if (issuerhash.length() <= 0) {
 
      // Make sure we have a certificate
      if (cert) {
         char chash[30] = {0};
         snprintf(chash, sizeof(chash),
                  "%08lx.0",X509_NAME_hash(X509_get_issuer_name(cert)));
         issuerhash = chash;
      } else {
         DEBUG("WARNING: no certificate available - cannot extract issuer hash (default)");
      }
   }
 
   // return what we have
   return (issuerhash.length() > 0) ? issuerhash.c_str() : (const char *)0;
}

References XrdOucString::c_str(), DEBUG, EPNAME, and XrdOucString::length().

Here is the call graph for this function:

MatchesSAN()

bool XrdCryptosslX509::MatchesSAN ( const char *  fqdn, bool &  hasSAN  )

virtual

Implements XrdCryptoX509.

Definition at line 1111 of file XrdCryptosslX509.cc.

{
   EPNAME("MatchesSAN");
 
   // Statically allocated array for hostname lengths.  RFC1035 limits
   // valid lengths to 255 characters.
   char san_fqdn[256];
 
   // Assume we have no SAN extension. Failure may allow the caller to try
   // using the common name before giving up.
   hasSAN = false;
 
   GENERAL_NAMES *gens = static_cast<GENERAL_NAMES *>(X509_get_ext_d2i(cert,
      NID_subject_alt_name, NULL, NULL));
   if (!gens)
      return false;
 
   // Only an EEC is usable as a host certificate.
   if (type != kEEC)
      return false;
 
   // All failures are under the notion that we have a SAN extension.
   hasSAN = true;
 
   if (!fqdn)
      return false;
 
   bool success = false;
   for (int idx = 0; idx < sk_GENERAL_NAME_num(gens); idx++) {
      GENERAL_NAME *gen;
      ASN1_STRING *cstr;
      gen = sk_GENERAL_NAME_value(gens, idx);
      if (gen->type != GEN_DNS)
         continue;
      cstr = gen->d.dNSName;
      if (ASN1_STRING_type(cstr) != V_ASN1_IA5STRING)
         continue;
      int san_fqdn_len = ASN1_STRING_length(cstr);
      if (san_fqdn_len > 255)
         continue;
      memcpy(san_fqdn, ASN1_STRING_get0_data(cstr), san_fqdn_len);
      san_fqdn[san_fqdn_len] = '\0';
      if (strlen(san_fqdn) != static_cast<size_t>(san_fqdn_len)) // Avoid embedded null's.
         continue;
      DEBUG("Comparing SAN " << san_fqdn << " with " << fqdn);
      if (MatchHostnames(san_fqdn, fqdn)) {
         DEBUG("SAN " << san_fqdn << " matches with " << fqdn);
         success = true;
         break;
      }
   }
   sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
   return success;
}

References DEBUG, EPNAME, XrdCryptoX509::kEEC, XrdCryptoX509::MatchHostnames(), and XrdCryptoX509::type.

Here is the call graph for this function:

NotAfter()

time_t XrdCryptosslX509::NotAfter ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 469 of file XrdCryptosslX509.cc.

{
   // End-validity time in secs since Epoch
 
   // If we do not have it already, try extraction
   if (notafter < 0) {
      // Make sure we have a certificate
      if (cert)
         // Extract UTC time in secs from Epoch
         notafter = XrdCryptosslASN1toUTC(X509_get_notAfter(cert));
   }
   // return what we have
   return notafter;
}

References XrdCryptosslASN1toUTC().

Here is the call graph for this function:

NotBefore()

time_t XrdCryptosslX509::NotBefore ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 453 of file XrdCryptosslX509.cc.

{
   // Begin-validity time in secs since Epoch
 
   // If we do not have it already, try extraction
   if (notbefore < 0) {
      // Make sure we have a certificate
      if (cert)
         // Extract UTC time in secs from Epoch
         notbefore = XrdCryptosslASN1toUTC(X509_get_notBefore(cert));
   }
   // return what we have
   return notbefore;
}

References XrdCryptosslASN1toUTC().

Here is the call graph for this function:

Opaque()

XrdCryptoX509data XrdCryptosslX509::Opaque ( )

inlinevirtual

Reimplemented from XrdCryptoX509.

Definition at line 58 of file XrdCryptosslX509.hh.

{ return (XrdCryptoX509data)cert; }

Referenced by DumpExtensions().

Here is the caller graph for this function:

ParentFile()

const char* XrdCryptosslX509::ParentFile ( )

inlinevirtual

Reimplemented from XrdCryptoX509.

Definition at line 71 of file XrdCryptosslX509.hh.

{ return (const char *)(srcfile.c_str()); }

References XrdOucString::c_str().

Here is the call graph for this function:

PKI()

XrdCryptoRSA* XrdCryptosslX509::PKI ( )

inlinevirtual

Reimplemented from XrdCryptoX509.

Definition at line 64 of file XrdCryptosslX509.hh.

{ return pki; }

ProxyType()

const char* XrdCryptosslX509::ProxyType ( ) const

inlinevirtual

Reimplemented from XrdCryptoX509.

Definition at line 74 of file XrdCryptosslX509.hh.

{ return cpxytype[pxytype]; }

SerialNumber()

kXR_int64 XrdCryptosslX509::SerialNumber ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 617 of file XrdCryptosslX509.cc.

{
   // Return serial number as a kXR_int64
 
   kXR_int64 sernum = -1;
   if (cert && X509_get_serialNumber(cert)) {
      BIGNUM *bn = BN_new();
      ASN1_INTEGER_to_BN(X509_get_serialNumber(cert), bn);
      char *sn = BN_bn2dec(bn);
      sernum = strtoll(sn, 0, 10);
      BN_free(bn);
      OPENSSL_free(sn);
   }
 
   return sernum;
}

SerialNumberString()

XrdOucString XrdCryptosslX509::SerialNumberString ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 635 of file XrdCryptosslX509.cc.

{
   // Return serial number as a hex string
 
   XrdOucString sernum;
   if (cert && X509_get_serialNumber(cert)) {
      BIGNUM *bn = BN_new();
      ASN1_INTEGER_to_BN(X509_get_serialNumber(cert), bn);
      char *sn = BN_bn2hex(bn);
      sernum = sn;
      BN_free(bn);
      OPENSSL_free(sn);
   }
 
   return sernum;
}

SetPKI()

void XrdCryptosslX509::SetPKI ( XrdCryptoX509data  pki )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 428 of file XrdCryptosslX509.cc.

{
   // SetPKI:
   // if newpki is null does nothing
   // if newpki contains a consistent private & public key we take ownership
   //   so that this->PKI()->status will be kComplete.
   // otherwise, newpki is not consistent:
   // if the previous PKI() was null or was already kComplete it is and reset
   //   so that this->PKI()->status will be kInvalid.
 
   if (!newpki) return;
 
   auto tmprsa = std::make_unique<XrdCryptosslRSA>((EVP_PKEY*)newpki, 1);
   if (!pki || pki->status == XrdCryptoRSA::kComplete ||
       tmprsa->status == XrdCryptoRSA::kComplete) {
      // Cleanup any existing key first
      if (pki)
         delete pki;
 
      // Set PKI
      pki = tmprsa.release();
   }
}

References XrdCryptoRSA::kComplete, and XrdCryptoRSA::status.

Subject()

const char * XrdCryptosslX509::Subject ( )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 485 of file XrdCryptosslX509.cc.

{
   // Return subject name
   EPNAME("X509::Subject");
 
   // If we do not have it already, try extraction
   if (subject.length() <= 0) {
 
      // Make sure we have a certificate
      if (!cert) {
         DEBUG("WARNING: no certificate available - cannot extract subject name");
         return (const char *)0;
      }
 
      // Extract subject name
      XrdCryptosslNameOneLine(X509_get_subject_name(cert), subject);
   }
 
   // return what we have
   return (subject.length() > 0) ? subject.c_str() : (const char *)0;
}

References XrdOucString::c_str(), DEBUG, EPNAME, XrdOucString::length(), and XrdCryptosslNameOneLine().

Referenced by XrdCryptosslX509().

Here is the call graph for this function:

Here is the caller graph for this function:

SubjectHash()

const char * XrdCryptosslX509::SubjectHash ( int  alg = 0 )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 574 of file XrdCryptosslX509.cc.

{
   // Return hash of subject name
   // Use default algorithm (X509_NAME_hash) for alg = 0, old algorithm
   // (for v>=1.0.0) when alg = 1
   EPNAME("X509::SubjectHash");
 
   if (alg == 1) {
      // md5 based
      if (subjectoldhash.length() <= 0) {
         // Make sure we have a certificate
         if (cert) {
            char chash[30] = {0};
            snprintf(chash, sizeof(chash),
                     "%08lx.0",X509_NAME_hash_old(X509_get_subject_name(cert)));
            subjectoldhash = chash;
         } else {
            DEBUG("WARNING: no certificate available - cannot extract subject hash (md5)");
         }
      }
      // return what we have
      return (subjectoldhash.length() > 0) ? subjectoldhash.c_str() : (const char *)0;
   }
 
   // If we do not have it already, try extraction
   if (subjecthash.length() <= 0) {
 
      // Make sure we have a certificate
      if (cert) {
         char chash[30] = {0};
         snprintf(chash, sizeof(chash),
                  "%08lx.0",X509_NAME_hash(X509_get_subject_name(cert)));
         subjecthash = chash;
      } else {
         DEBUG("WARNING: no certificate available - cannot extract subject hash (default)");
      }
   }
 
   // return what we have
   return (subjecthash.length() > 0) ? subjecthash.c_str() : (const char *)0;
}

References XrdOucString::c_str(), DEBUG, EPNAME, and XrdOucString::length().

Here is the call graph for this function:

Verify()

bool XrdCryptosslX509::Verify ( XrdCryptoX509 *  ref )

virtual

Reimplemented from XrdCryptoX509.

Definition at line 773 of file XrdCryptosslX509.cc.

{
   // Verify certificate signature with pub key of ref cert
   EPNAME("X509::Verify");
 
   // We must have been initialized
   if (!cert)
      return 0;
 
   // We must have something to check with
   X509 *r = ref ? (X509 *)(ref->Opaque()) : 0;
   EVP_PKEY *rk = r ? X509_get_pubkey(r) : 0;
   if (!rk)
      return 0;
 
   // Ok: we can verify
   int rc = X509_verify(cert, rk);
   EVP_PKEY_free(rk);
   if (rc <= 0) {
      if (rc == 0) {
         // Signatures are not OK
         DEBUG("signature not OK");
      } else {
         // General failure
         DEBUG("could not verify signature");
      }
      return 0;
   }
   // Success
   return 1;
}

References DEBUG, EPNAME, and XrdCryptoX509::Opaque().

Here is the call graph for this function:

---

The documentation for this class was generated from the following files:

• XrdCryptosslX509.hh
• XrdCryptosslX509.cc