TAO::SSLIOP::CredentialsAcquirer Class Reference

SSLIOP-specific SecurityLevel3::CredentialsAcquirer implementation. More...

#include <SSLIOP_CredentialsAcquirer.h>

Inheritance diagram for TAO::SSLIOP::CredentialsAcquirer:

[legend]Collaboration diagram for TAO::SSLIOP::CredentialsAcquirer:

[legend]List of all members.

Public Member Functions
	CredentialsAcquirer (TAO::SL3::CredentialsCurator_ptr curator, const CORBA::Any &acquisition_arguments)
	Constructor.
SecurityLevel3::CredentialsAcquirer Methods
Methods required by the SecurityLevel3::CredentialsAcquirer interface.
virtual char *	acquisition_method (void)
virtual SecurityLevel3::AcquisitionStatus	current_status ()
virtual CORBA::ULong	nth_iteration (void)
virtual CORBA::Any *	get_continuation_data (void)
virtual SecurityLevel3::AcquisitionStatus	continue_acquisition (const CORBA::Any &acquisition_arguments)
virtual SecurityLevel3::OwnCredentials_ptr	get_credentials (CORBA::Boolean on_list)
virtual void	destroy (void)
Protected Member Functions
	~CredentialsAcquirer (void)
	Destructor.
Private Member Functions
void	check_validity (void)
Static Private Member Functions
::X509 *	make_X509 (const ::SSLIOP::File &certificate)
	Create an OpenSSL X.509 certificate data structure.
::EVP_PKEY *	make_EVP_PKEY (const ::SSLIOP::File &key)
	Create an OpenSSL EVP_PKEY key data structure.
Private Attributes
TAO_SYNCH_MUTEX	lock_
	Lock used for synchronization.
TAO::SL3::CredentialsCurator_var	curator_
	Reference to the TAO CredentialsCurator implementation.
const CORBA::Any &	acquisition_arguments_
	SSLIOP-specific credentials acquisition arguments.
bool	destroyed_

---

Detailed Description

SSLIOP-specific SecurityLevel3::CredentialsAcquirer implementation.

This class generates SSLIOP-specific credentials.

Definition at line 61 of file SSLIOP_CredentialsAcquirer.h.

---

Constructor & Destructor Documentation

TAO_BEGIN_VERSIONED_NAMESPACE_DECL TAO::SSLIOP::CredentialsAcquirer::CredentialsAcquirer	(	TAO::SL3::CredentialsCurator_ptr	curator,
		const CORBA::Any &	acquisition_arguments
	)

Constructor.

Definition at line 78 of file SSLIOP_CredentialsAcquirer.cpp.

  : lock_ (),
    curator_ (TAO::SL3::CredentialsCurator::_duplicate (curator)),
    acquisition_arguments_ (acquisition_arguments),
    destroyed_ (false)
{
}

TAO::SSLIOP::CredentialsAcquirer::~CredentialsAcquirer

(

void

)

[protected]

Destructor.

Protected destructor to enforce proper memory management through the reference counting mechanism.

Definition at line 88 of file SSLIOP_CredentialsAcquirer.cpp.

{
}

---

Member Function Documentation

char * TAO::SSLIOP::CredentialsAcquirer::acquisition_method

(

void

)

[virtual]

Definition at line 93 of file SSLIOP_CredentialsAcquirer.cpp.

References check_validity(), and CORBA::string_dup().

{
  this->check_validity ();

  return CORBA::string_dup ("SL3TLS");
}

void TAO::SSLIOP::CredentialsAcquirer::check_validity

(

void

)

[private]

Verify that this CredentialsAcquirer object is still valid, i.e. hasn't been destroyed.

Definition at line 200 of file SSLIOP_CredentialsAcquirer.cpp.

References ACE_GUARD, and TAO_SYNCH_MUTEX.

Referenced by acquisition_method(), current_status(), destroy(), get_credentials(), and nth_iteration().

{
  ACE_GUARD (TAO_SYNCH_MUTEX,
             guard,
             this->lock_);

  if (this->destroyed_)
    throw CORBA::BAD_INV_ORDER ();
}

SecurityLevel3::AcquisitionStatus TAO::SSLIOP::CredentialsAcquirer::continue_acquisition

(

const CORBA::Any &

acquisition_arguments

)

[virtual]

Definition at line 126 of file SSLIOP_CredentialsAcquirer.cpp.

{
  // SSL/TLS credentials acquisition does generate continuation data.
  throw CORBA::BAD_INV_ORDER ();
}

SecurityLevel3::AcquisitionStatus TAO::SSLIOP::CredentialsAcquirer::current_status

(

)

[virtual]

Definition at line 101 of file SSLIOP_CredentialsAcquirer.cpp.

References check_validity().

{
  this->check_validity ();

  return SecurityLevel3::AQST_Succeeded;  // @@ Really?
}

void TAO::SSLIOP::CredentialsAcquirer::destroy

(

void

)

[virtual]

Definition at line 182 of file SSLIOP_CredentialsAcquirer.cpp.

References ACE_GUARD, check_validity(), destroyed_, and TAO_SYNCH_MUTEX.

Referenced by get_credentials().

{
  this->check_validity ();

  ACE_GUARD (TAO_SYNCH_MUTEX,
             guard,
             this->lock_);

  if (!this->destroyed_)
    {
      this->destroyed_ = true;

      // Release our reference to the CredentialsCurator.
      (void) this->curator_.out ();
    }
}

CORBA::Any * TAO::SSLIOP::CredentialsAcquirer::get_continuation_data

(

void

)

[virtual]

Definition at line 119 of file SSLIOP_CredentialsAcquirer.cpp.

{
  // SSL/TLS credentials acquisition does generate continuation data.
  throw CORBA::BAD_INV_ORDER ();
}

SecurityLevel3::OwnCredentials_ptr TAO::SSLIOP::CredentialsAcquirer::get_credentials

(

CORBA::Boolean

on_list

)

[virtual]

Definition at line 134 of file SSLIOP_CredentialsAcquirer.cpp.

References ACE_DEBUG, ACE_NEW_THROW_EX, ACE_TEXT(), check_validity(), curator_, destroy(), TAO::SSLIOP::OpenSSL_st_var< T >::in(), LM_ERROR, make_EVP_PKEY(), make_X509(), and TAO_debug_level.

{
  this->check_validity ();

  ::SSLIOP::AuthData *data = 0;

  if (!(this->acquisition_arguments_ >>= data))
    throw CORBA::BAD_PARAM ();

  TAO::SSLIOP::X509_var x509 = this->make_X509 (data->certificate);

  if (x509.in () == 0)
    throw CORBA::BAD_PARAM ();

  TAO::SSLIOP::EVP_PKEY_var evp = this->make_EVP_PKEY (data->key);

  if (evp.in () == 0)
    throw CORBA::BAD_PARAM ();

  // Verify that the private key is consistent with the certificate.
  if (::X509_check_private_key (x509.in (), evp.in ()) != 1)
    {
      if (TAO_debug_level > 0)
        ACE_DEBUG ((LM_ERROR,
                    ACE_TEXT ("(%P|%t) ERROR: Private key is not ")
                    ACE_TEXT ("consistent with X.509 certificate")));

      throw CORBA::BAD_PARAM ();
    }

  TAO::SSLIOP::OwnCredentials * creds = 0;
  ACE_NEW_THROW_EX (creds,
                    TAO::SSLIOP::OwnCredentials (x509.in (), evp.in ()),
                    CORBA::NO_MEMORY ());

  SecurityLevel3::OwnCredentials_var credentials = creds;

  if (on_list)
    {
      this->curator_->_tao_add_own_credentials (creds);
    }

  this->destroy ();

  return credentials._retn ();
}

EVP_PKEY * TAO::SSLIOP::CredentialsAcquirer::make_EVP_PKEY

(

const ::SSLIOP::File &

key

)

[static, private]

Create an OpenSSL EVP_PKEY key data structure.

Definition at line 287 of file SSLIOP_CredentialsAcquirer.cpp.

References ACE_ERROR, ACE_TEXT(), SSLIOP::ASN1, ACE_OS::fclose(), ACE_OS::fopen(), LM_ERROR, TAO_debug_level, and TAO_SSLIOP_PASSWORD_CALLBACK_NAME.

Referenced by get_credentials().

{
  // No password is used or needed when reading ASN.1 encoded
  // private keys.

  const char *filename = key.filename.in ();

  if (filename == 0)
    return 0;

  FILE *fp = 0;
  ::EVP_PKEY *evp = 0;

  if (key.type == ::SSLIOP::ASN1)
    {
      // ASN.1/DER encoded private key

      // No password is used or needed when reading ASN.1 encoded
      // private keys.

      const char *filename = key.filename.in ();

      if (filename == 0)
        return 0;

      fp = ACE_OS::fopen (filename, "rb");

      if (fp == 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("(%P|%t) SSLIOP::CredentialsAcquirer::make_EVP_PKEY ")
                        ACE_TEXT ("- %p\n"),
                        ACE_TEXT ("fopen")));

          return 0;
        }

      // Read ASN.1 / DER encoded private key from a file, and convert
      // it to OpenSSL's internal private key format.
      evp = ::d2i_PrivateKey_fp (fp, 0);
    }
  else
    {
      // PEM encoded private key

      fp = ACE_OS::fopen (filename, "r");

      if (fp == 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("(%P|%t) SSLIOP::CredentialsAcquirer::make_EVP_PKEY ")
                        ACE_TEXT ("- %p\n"),
                        ACE_TEXT ("fopen")));

          return 0;
        }

      const char *password = key.password.in ();

      // Read PEM encoded private key from a file, and convert it to
      // OpenSSL's internal private key format.
      evp = PEM_read_PrivateKey (fp,
                                 0,
                                 TAO_SSLIOP_PASSWORD_CALLBACK_NAME,
                                 const_cast<char *> (password));
    }

  (void) ACE_OS::fclose (fp);

  if (evp == 0 && TAO_debug_level > 0)
    ACE_SSL_Context::report_error ();

  return evp;
}

X509 * TAO::SSLIOP::CredentialsAcquirer::make_X509

(

const ::SSLIOP::File &

certificate

)

[static, private]

Create an OpenSSL X.509 certificate data structure.

Definition at line 211 of file SSLIOP_CredentialsAcquirer.cpp.

References ACE_ERROR, ACE_TEXT(), SSLIOP::ASN1, ACE_OS::fclose(), ACE_OS::fopen(), LM_ERROR, TAO_debug_level, and TAO_SSLIOP_PASSWORD_CALLBACK_NAME.

Referenced by get_credentials().

{
  // No password is used or needed when reading ASN.1 encoded
  // certificates.

  const char *filename = certificate.filename.in ();

  if (filename == 0)
    return 0;

  FILE *fp = 0;
  ::X509 *x = 0;

  if (certificate.type == ::SSLIOP::ASN1)
    {
      // ASN.1/DER encoded certificate

      // No password is used or needed when reading ASN.1 encoded
      // certificates.

      const char *filename = certificate.filename.in ();

      if (filename == 0)
        return 0;

      fp = ACE_OS::fopen (filename, "rb");

      if (fp == 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("(%P|%t) SSLIOP::CredentialsAcquirer::make_X509 - %p\n"),
                        ACE_TEXT ("fopen")));

          return 0;
        }

      // Read ASN.1 / DER encoded X.509 certificate from a file, and
      // convert it to OpenSSL's internal X.509 format.
      x = ::d2i_X509_fp (fp, 0);
    }
  else
    {
      // PEM encoded certificate

      fp = ACE_OS::fopen (filename, "r");

      if (fp == 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("(%P|%t) SSLIOP::CredentialsAcquirer::make_X509 - %p\n"),
                        ACE_TEXT ("fopen")));

          return 0;
        }

      const char *password = certificate.password.in ();

      // Read PEM encoded X.509 certificate from a file, and convert
      // it to OpenSSL's internal X.509 format.
      x = PEM_read_X509 (fp,
                         0,
                         TAO_SSLIOP_PASSWORD_CALLBACK_NAME,
                         const_cast<char *> (password));
    }

  (void) ACE_OS::fclose (fp);

  if (x == 0 && TAO_debug_level > 0)
    ACE_SSL_Context::report_error ();

  return x;
}

CORBA::ULong TAO::SSLIOP::CredentialsAcquirer::nth_iteration

(

void

)

[virtual]

Definition at line 109 of file SSLIOP_CredentialsAcquirer.cpp.

References check_validity().

{
  this->check_validity ();

  // SSL/TLS credentials is single-step process from the point-of-view
  // of the caller.
  return 1;
}

---

Member Data Documentation

const CORBA::Any& TAO::SSLIOP::CredentialsAcquirer::acquisition_arguments_ [private]

SSLIOP-specific credentials acquisition arguments.

Definition at line 125 of file SSLIOP_CredentialsAcquirer.h.

TAO::SL3::CredentialsCurator_var TAO::SSLIOP::CredentialsAcquirer::curator_ [private]

Reference to the TAO CredentialsCurator implementation.

Definition at line 122 of file SSLIOP_CredentialsAcquirer.h.

Referenced by get_credentials().

bool TAO::SSLIOP::CredentialsAcquirer::destroyed_ [private]

Has this CredentialsAcquirer object completed credentials acquisition or been explicitly destroyed?

Definition at line 129 of file SSLIOP_CredentialsAcquirer.h.

Referenced by destroy().

TAO_SYNCH_MUTEX TAO::SSLIOP::CredentialsAcquirer::lock_ [private]

Lock used for synchronization.

Definition at line 119 of file SSLIOP_CredentialsAcquirer.h.

---

The documentation for this class was generated from the following files:

• SSLIOP_CredentialsAcquirer.h
• SSLIOP_CredentialsAcquirer.cpp

---