TAO::SSLIOP_Credentials

TAO::SSLIOP_Credentials Class Reference

SSLIOP-specific implementation of the SecurityLevel3::Credentials interface. More...

#include <SSLIOP_Credentials.h>

Inheritance diagram for TAO::SSLIOP_Credentials:

Inheritance graph
[legend]
Collaboration diagram for TAO::SSLIOP_Credentials:

Collaboration graph
[legend]
List of all members.

Public Types

typedef SSLIOP::Credentials_ptr _ptr_type
typedef SSLIOP::Credentials_var _var_type
typedef SSLIOP::Credentials_out _out_type

Public Member Functions

 SSLIOP_Credentials (::X509 *cert,::EVP_PKEY *evp)
 Constructor.
::EVP_PKEY * evp (void)
 Return a pointer to the underlying private key.
bool operator== (const SSLIOP_Credentials &rhs)
CORBA::ULong hash (void) const
SecurityLevel3::Credentials Methods
Methods required by the SecurityLevel3::Credentials interface.

virtual char * creds_id (void)
virtual SecurityLevel3::CredentialsType creds_type (void)=0
virtual SecurityLevel3::CredentialsUsage creds_usage ()
virtual TimeBase::UtcT expiry_time (void)
virtual SecurityLevel3::CredentialsState creds_state ()
virtual char * add_relinquished_listener (SecurityLevel3::RelinquishedCredentialsListener_ptr listener)
virtual void remove_relinquished_listener (const char *id)
SecurityLevel3::Credentials Methods
::X509 * x509 (void)
 Return a pointer to the underlying X.509 certificate.

Static Public Member Functions

static SSLIOP::Credentials_ptr _duplicate (SSLIOP::Credentials_ptr obj)
static SSLIOP::Credentials_ptr _narrow (CORBA::Object_ptr obj)
static SSLIOP::Credentials_ptr _nil (void)

Protected Member Functions

 ~SSLIOP_Credentials (void)
 Destructor.

Protected Attributes

SSLIOP::X509_var x509_
SSLIOP::EVP_PKEY_var evp_
CORBA::String_var id_
 Credentials Identifier.
SecurityLevel3::CredentialsUsage creds_usage_
 The intended usage of the Credentials.
TimeBase::UtcT expiry_time_
 The time these Credentials expire.
SecurityLevel3::CredentialsState creds_state_
 The validity of the Credentials.

Detailed Description

SSLIOP-specific implementation of the SecurityLevel3::Credentials interface.

This class encapsulates the X.509 certificate associated with a given a principal.

Note:
Why is this class not the TAO::SSLIOP namespace? Because brain damaged MSVC++ 6 cannot call a base class constructor of class declared in a namespace that is more than one level deep in a sub-class base member initializer list.

Definition at line 58 of file SSLIOP_Credentials.h.

Member Typedef Documentation

typedef SSLIOP::Credentials_out TAO::SSLIOP_Credentials::_out_type

Reimplemented from CORBA::LocalObject.

Definition at line 65 of file SSLIOP_Credentials.h.

typedef SSLIOP::Credentials_ptr TAO::SSLIOP_Credentials::_ptr_type

Reimplemented from CORBA::LocalObject.

Definition at line 63 of file SSLIOP_Credentials.h.

typedef SSLIOP::Credentials_var TAO::SSLIOP_Credentials::_var_type

Reimplemented from CORBA::LocalObject.

Definition at line 64 of file SSLIOP_Credentials.h.

Constructor & Destructor Documentation

TAO_BEGIN_VERSIONED_NAMESPACE_DECL TAO::SSLIOP_Credentials::SSLIOP_Credentials ( ::X509 *  cert,
::EVP_PKEY *  evp 
)

Constructor.

Definition at line 19 of file SSLIOP_Credentials.cpp.

References ACE_SIZEOF_LONG_LONG, ACE_UINT64_LITERAL, ACE_String_Base< CHAR >::c_str(), expiry_time_, id_, SSLIOP_Credentials(), and CORBA::string_dup().

Referenced by SSLIOP_Credentials().

00020   : x509_ (TAO::SSLIOP::OpenSSL_traits< ::X509 >::_duplicate (cert)),
00021     evp_ (TAO::SSLIOP::OpenSSL_traits< ::EVP_PKEY >::_duplicate (evp)),
00022     id_ (),
00023     creds_usage_ (SecurityLevel3::CU_Indefinite),
00024     expiry_time_ (),
00025     creds_state_ (SecurityLevel3::CS_Invalid)
00026 {
00027   ::X509 *x = cert;
00028 
00029   if (x != 0)
00030     {
00031       // We use the X.509 certificate's serial number as the
00032       // credentials Id.
00033       BIGNUM * bn = ASN1_INTEGER_to_BN (::X509_get_serialNumber (x), 0);
00034       if (BN_is_zero (bn))
00035         this->id_ = CORBA::string_dup ("X509: 00");
00036       else
00037         {
00038           char * id = BN_bn2hex (bn);
00039 
00040           ACE_CString s =
00041             ACE_CString ("X509: ")
00042             + ACE_CString (const_cast<const char *> (id));
00043 
00044           this->id_ = CORBA::string_dup (s.c_str ());
00045 
00046 #ifdef OPENSSL_free
00047           OPENSSL_free (id);
00048 #else
00049           // Older versions of OpenSSL didn't define the OpenSSL
00050           // macro.
00051           CRYPTO_free (id);
00052 #endif  /* OPENSSL_free */
00053         }
00054       BN_free (bn);
00055 
00056       // -------------------------------------------
00057 
00058       TimeBase::UtcT & t = this->expiry_time_;
00059 
00060       const ASN1_TIME * exp = X509_get_notAfter (x);
00061 
00062       if (exp->length > ACE_SIZEOF_LONG_LONG)
00063         {
00064           // @@ Will this ever happen?
00065 
00066           // Overflow!
00067           t.time = ACE_UINT64_LITERAL (0xffffffffffffffff);
00068         }
00069       else
00070         {
00071           t.time = 0;
00072           for (int i = 0; i < exp->length; ++i)
00073             {
00074               t.time <<= 8;
00075               t.time |= (unsigned char) exp->data[i];
00076             }
00077         }
00078     }
00079 }

TAO::SSLIOP_Credentials::~SSLIOP_Credentials ( void   )  [protected]

Destructor.

Protected destructor to enforce proper memory management through the reference counting mechanism.

Definition at line 81 of file SSLIOP_Credentials.cpp.

References ~SSLIOP_Credentials().

Referenced by ~SSLIOP_Credentials().

00082 {
00083 }

Member Function Documentation

static SSLIOP::Credentials_ptr TAO::SSLIOP_Credentials::_duplicate ( SSLIOP::Credentials_ptr  obj  )  [static]

TAO::SSLIOP::Credentials_ptr TAO::SSLIOP_Credentials::_narrow ( CORBA::Object_ptr  obj  )  [static]

Reimplemented from CORBA::LocalObject.

Definition at line 200 of file SSLIOP_Credentials.cpp.

References TAO::SSLIOP::_duplicate(), and _narrow().

Referenced by _narrow().

00201 {
00202   return  TAO::SSLIOP_Credentials::_duplicate (
00203               dynamic_cast<TAO::SSLIOP_Credentials *> (obj));
00204 }

static SSLIOP::Credentials_ptr TAO::SSLIOP_Credentials::_nil ( void   )  [inline, static]

Reimplemented from CORBA::LocalObject.

Definition at line 122 of file SSLIOP_Credentials.h.

00123       {
00124         return (SSLIOP::Credentials_ptr) 0;
00125       }

char * TAO::SSLIOP_Credentials::add_relinquished_listener ( SecurityLevel3::RelinquishedCredentialsListener_ptr  listener  )  [virtual]

Definition at line 148 of file SSLIOP_Credentials.cpp.

References add_relinquished_listener().

Referenced by add_relinquished_listener().

00150 {
00151   throw CORBA::NO_IMPLEMENT ();
00152 }

char * TAO::SSLIOP_Credentials::creds_id ( void   )  [virtual]

Definition at line 86 of file SSLIOP_Credentials.cpp.

References creds_id(), and CORBA::string_dup().

Referenced by creds_id().

00087 {
00088   return CORBA::string_dup (this->id_.in ());
00089 }

SecurityLevel3::CredentialsState TAO::SSLIOP_Credentials::creds_state (  )  [virtual]

Definition at line 104 of file SSLIOP_Credentials.cpp.

References creds_state(), creds_state_, and x509_.

Referenced by creds_state().

00105 {
00106   const ::X509 *x = this->x509_.in ();
00107 
00108   // The pointer to the underlying X509 structure should only be zero
00109   // if destroy() was called on this Credentials object.
00110   if (x == 0)
00111     throw CORBA::BAD_OPERATION ();
00112 
00113   if (this->creds_state_ == SecurityLevel3::CS_Valid)
00114     {
00115       // Make sure the X.509 certificate is still valid.
00116 
00117       const int after_status =
00118         ::X509_cmp_current_time (X509_get_notAfter (x));
00119 
00120       if (after_status == 0)
00121         {
00122           // Error in certificate's "not after" field.
00123           throw CORBA::BAD_PARAM ();
00124         }
00125       else if (after_status > 0)     // Certificate has expired.
00126         this->creds_state_ = SecurityLevel3::CS_Expired;
00127     }
00128   else if (this->creds_state_ == SecurityLevel3::CS_Invalid)
00129     {
00130       // Check if the X.509 certificate has become valid.
00131 
00132       const int before_status =
00133         ::X509_cmp_current_time (X509_get_notBefore (x));
00134 
00135       if (before_status == 0)
00136         {
00137           // Error in certificate's "not before" field.
00138           throw CORBA::BAD_PARAM ();
00139         }
00140       else if (before_status < 0)     // Certificate is now valid.
00141         this->creds_state_ = SecurityLevel3::CS_Valid;
00142     }
00143 
00144   return this->creds_state_;
00145 }

virtual SecurityLevel3::CredentialsType TAO::SSLIOP_Credentials::creds_type ( void   )  [pure virtual]

Referenced by operator==().

SecurityLevel3::CredentialsUsage TAO::SSLIOP_Credentials::creds_usage (  )  [virtual]

Definition at line 92 of file SSLIOP_Credentials.cpp.

References creds_usage().

Referenced by creds_usage().

00093 {
00094   return SecurityLevel3::CU_Indefinite;
00095 }

ACE_INLINE::EVP_PKEY * TAO::SSLIOP_Credentials::evp ( void   ) 

Return a pointer to the underlying private key.

Returns:
Non-zero value if private key is used.
Note:
Caller owns the returned object. Use a TAO::SSLIOP::EVP_PKEY_var.

Definition at line 15 of file SSLIOP_Credentials.inl.

References TAO::SSLIOP::_duplicate(), and evp().

Referenced by evp().

00016 {
00017   return
00018     TAO::SSLIOP::OpenSSL_traits< ::EVP_PKEY >::_duplicate (this->evp_.in ());
00019 }

TimeBase::UtcT TAO::SSLIOP_Credentials::expiry_time ( void   )  [virtual]

Definition at line 98 of file SSLIOP_Credentials.cpp.

References expiry_time(), and expiry_time_.

Referenced by expiry_time().

00099 {
00100   return this->expiry_time_;
00101 }

CORBA::ULong TAO::SSLIOP_Credentials::hash ( void   )  const

Definition at line 192 of file SSLIOP_Credentials.cpp.

References hash(), x509(), and x509_.

Referenced by hash().

00193 {
00194   ::X509 * x509 = this->x509_.in ();
00195 
00196   return (x509 == 0 ? 0 : ::X509_issuer_name_hash (x509));
00197 }

bool TAO::SSLIOP_Credentials::operator== ( const SSLIOP_Credentials &  rhs  ) 

Definition at line 161 of file SSLIOP_Credentials.cpp.

References creds_type(), creds_usage_, and x509_.

00162 {
00163   ::X509 * xa = this->x509_.in ();
00164   ::X509 * xb = rhs.x509_.in ();
00165   // EVP_PKEY *ea = this->evp_.in ();
00166   // EVP_PKEY *eb = rhs.evp_.in ();
00167 
00168   // No need for a full blown ACE_TRY/CATCH block.
00169 
00170   const SecurityLevel3::CredentialsType lct =
00171     this->creds_type ();
00172 
00173   const SecurityLevel3::CredentialsType rct =
00174     const_cast<TAO::SSLIOP_Credentials &> (rhs).creds_type ();
00175 
00176   // Don't bother check the creds_id and expiry_time attributes.  They
00177   // are checked implicitly by the below X509_cmp() call.
00178   //
00179   // Additionally, the creds_state attribute is not included in the
00180   // check since it is not considered important when distinguishing
00181   // between two Credentials.
00182 
00183   return
00184     lct == rct
00185     && this->creds_usage_ == rhs.creds_usage_
00186     && ((xa == xb) || (xa != 0 && xb != 0 && ::X509_cmp (xa, xb) == 0))
00187 //     && ((ea == eb) || (ea != 0 && eb != 0 && ::EVP_PKEY_cmp (ea, eb) == 0))
00188     ;
00189 }

void TAO::SSLIOP_Credentials::remove_relinquished_listener ( const char *  id  )  [virtual]

Definition at line 155 of file SSLIOP_Credentials.cpp.

References remove_relinquished_listener().

Referenced by remove_relinquished_listener().

00156 {
00157   throw CORBA::NO_IMPLEMENT ();
00158 }

TAO_BEGIN_VERSIONED_NAMESPACE_DECL ACE_INLINE::X509 * TAO::SSLIOP_Credentials::x509 ( void   ) 

Return a pointer to the underlying X.509 certificate.

Note:
Caller owns the returned object. Use a TAO::SSLIOP::X509_var.

Definition at line 8 of file SSLIOP_Credentials.inl.

References TAO::SSLIOP::_duplicate(), and x509().

Referenced by hash(), and x509().

00009 {
00010   return
00011     TAO::SSLIOP::OpenSSL_traits< ::X509 >::_duplicate (this->x509_.in ());
00012 }

Member Data Documentation

SecurityLevel3::CredentialsState TAO::SSLIOP_Credentials::creds_state_ [protected]

The validity of the Credentials.

Definition at line 158 of file SSLIOP_Credentials.h.

Referenced by creds_state().

SecurityLevel3::CredentialsUsage TAO::SSLIOP_Credentials::creds_usage_ [protected]

The intended usage of the Credentials.

Definition at line 152 of file SSLIOP_Credentials.h.

Referenced by operator==().

SSLIOP::EVP_PKEY_var TAO::SSLIOP_Credentials::evp_ [protected]

Reference to the private key associated with the X.509 certificate.

Definition at line 146 of file SSLIOP_Credentials.h.

TimeBase::UtcT TAO::SSLIOP_Credentials::expiry_time_ [protected]

The time these Credentials expire.

Definition at line 155 of file SSLIOP_Credentials.h.

Referenced by expiry_time(), and SSLIOP_Credentials().

CORBA::String_var TAO::SSLIOP_Credentials::id_ [protected]

Credentials Identifier.

Definition at line 149 of file SSLIOP_Credentials.h.

Referenced by SSLIOP_Credentials().

SSLIOP::X509_var TAO::SSLIOP_Credentials::x509_ [protected]

Reference to the X.509 certificate associated with this SSLIOP Credentials object.

Definition at line 142 of file SSLIOP_Credentials.h.

Referenced by creds_state(), hash(), and operator==().

The documentation for this class was generated from the following files:
Generated on Tue Feb 2 17:48:55 2010 for TAO_SSLIOP by  doxygen 1.4.7