blob: 97f796c9077c7e39d64a431d5440add880f5e3dc [file] [log] [blame]
Alexander Afanasyevc169a812014-05-20 20:37:29 -04001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
Yingdi Yu6ac97982014-01-30 14:49:21 -08002/**
Alexander Afanasyevc169a812014-05-20 20:37:29 -04003 * Copyright (c) 2013-2014 Regents of the University of California.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07004 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07006 *
Alexander Afanasyevc169a812014-05-20 20:37:29 -04007 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -070020 *
21 * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
Yingdi Yu6ac97982014-01-30 14:49:21 -080022 */
23
Alexander Afanasyeve2dcdfd2014-02-07 15:53:28 -080024#include "common.hpp"
25
Yingdi Yu6ac97982014-01-30 14:49:21 -080026#include "validator-regex.hpp"
27#include "signature-sha256-with-rsa.hpp"
28#include "certificate-cache-ttl.hpp"
29
Yingdi Yufc40d872014-02-18 12:56:04 -080030namespace ndn {
Yingdi Yu6ac97982014-01-30 14:49:21 -080031
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070032const shared_ptr<CertificateCache> ValidatorRegex::DEFAULT_CERTIFICATE_CACHE;
Yingdi Yu6ac97982014-01-30 14:49:21 -080033
Yingdi Yu96e64062014-04-15 19:57:33 -070034ValidatorRegex::ValidatorRegex(Face& face,
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070035 shared_ptr<CertificateCache> certificateCache,
36 const int stepLimit)
Yingdi Yu6ac97982014-01-30 14:49:21 -080037 : Validator(face)
38 , m_stepLimit(stepLimit)
39 , m_certificateCache(certificateCache)
40{
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070041 if (!static_cast<bool>(m_certificateCache))
Alexander Afanasyevb67090a2014-04-29 22:31:01 -070042 m_certificateCache = make_shared<CertificateCacheTtl>(ref(m_face.getIoService()));
Yingdi Yu96e64062014-04-15 19:57:33 -070043}
44
Yingdi Yu6ac97982014-01-30 14:49:21 -080045void
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070046ValidatorRegex::onCertificateValidated(const shared_ptr<const Data>& signCertificate,
47 const shared_ptr<const Data>& data,
48 const OnDataValidated& onValidated,
49 const OnDataValidationFailed& onValidationFailed)
Yingdi Yu6ac97982014-01-30 14:49:21 -080050{
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070051 shared_ptr<IdentityCertificate> certificate =
Alexander Afanasyevf73f0632014-05-12 18:02:37 -070052 make_shared<IdentityCertificate>(*signCertificate);
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070053
54 if (!certificate->isTooLate() && !certificate->isTooEarly())
Yingdi Yu6ac97982014-01-30 14:49:21 -080055 {
56 m_certificateCache->insertCertificate(certificate);
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070057
58 if (verifySignature(*data, certificate->getPublicKeyInfo()))
Yingdi Yu40587c02014-02-21 16:40:48 -080059 return onValidated(data);
60 else
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070061 return onValidationFailed(data,
62 "Cannot verify signature: " +
63 data->getName().toUri());
Yingdi Yu6ac97982014-01-30 14:49:21 -080064 }
65 else
66 {
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070067 return onValidationFailed(data,
68 "Signing certificate " +
69 signCertificate->getName().toUri() +
70 " is no longer valid.");
Yingdi Yu6ac97982014-01-30 14:49:21 -080071 }
72}
73
74void
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070075ValidatorRegex::onCertificateValidationFailed(const shared_ptr<const Data>& signCertificate,
Yingdi Yu5ec0ee32014-06-24 16:26:09 -070076 const std::string& failureInfo,
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070077 const shared_ptr<const Data>& data,
78 const OnDataValidationFailed& onValidationFailed)
79{
80 onValidationFailed(data, failureInfo);
81}
Yingdi Yu6ac97982014-01-30 14:49:21 -080082
83void
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070084ValidatorRegex::checkPolicy(const Data& data,
Yingdi Yu4b8c6a22014-04-15 23:00:54 -070085 int nSteps,
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070086 const OnDataValidated& onValidated,
87 const OnDataValidationFailed& onValidationFailed,
Yingdi Yu5ec0ee32014-06-24 16:26:09 -070088 std::vector<shared_ptr<ValidationRequest> >& nextSteps)
Yingdi Yu6ac97982014-01-30 14:49:21 -080089{
Yingdi Yu4b8c6a22014-04-15 23:00:54 -070090 if (m_stepLimit == nSteps)
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070091 return onValidationFailed(data.shared_from_this(),
92 "Maximum steps of validation reached: " +
93 data.getName().toUri());
Yingdi Yu40587c02014-02-21 16:40:48 -080094
Yingdi Yu48e8c0c2014-03-19 12:01:55 -070095 for (RuleList::iterator it = m_mustFailVerify.begin();
96 it != m_mustFailVerify.end();
97 it++)
98 if ((*it)->satisfy(data))
Yingdi Yu40587c02014-02-21 16:40:48 -080099 return onValidationFailed(data.shared_from_this(),
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700100 "Comply with mustFail policy: " +
101 data.getName().toUri());
Yingdi Yu6ac97982014-01-30 14:49:21 -0800102
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700103 for (RuleList::iterator it = m_verifyPolicies.begin();
104 it != m_verifyPolicies.end();
105 it++)
Yingdi Yu6ac97982014-01-30 14:49:21 -0800106 {
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700107 if ((*it)->satisfy(data))
Yingdi Yu6ac97982014-01-30 14:49:21 -0800108 {
Yingdi Yu40587c02014-02-21 16:40:48 -0800109 try
110 {
Yingdi Yu4a557052014-07-09 16:40:37 -0700111 if (!data.getSignature().hasKeyLocator())
112 return onValidationFailed(data.shared_from_this(),
113 "Key Locator is missing in Data packet: " +
114 data.getName().toUri());
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700115
Yingdi Yu4a557052014-07-09 16:40:37 -0700116 const KeyLocator& keyLocator = data.getSignature().getKeyLocator();
117 if (keyLocator.getType() != KeyLocator::KeyLocator_Name)
118 return onValidationFailed(data.shared_from_this(),
119 "Key Locator is not a name: " +
120 data.getName().toUri());
121
122
123 const Name& keyLocatorName = keyLocator.getName();
Yingdi Yu40587c02014-02-21 16:40:48 -0800124 shared_ptr<const Certificate> trustedCert;
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700125 if (m_trustAnchors.end() == m_trustAnchors.find(keyLocatorName))
Yingdi Yu40587c02014-02-21 16:40:48 -0800126 trustedCert = m_certificateCache->getCertificate(keyLocatorName);
Yingdi Yu6ac97982014-01-30 14:49:21 -0800127 else
Yingdi Yu40587c02014-02-21 16:40:48 -0800128 trustedCert = m_trustAnchors[keyLocatorName];
Yingdi Yu6ac97982014-01-30 14:49:21 -0800129
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700130 if (static_cast<bool>(trustedCert))
131 {
Yingdi Yu4a557052014-07-09 16:40:37 -0700132 if (verifySignature(data, data.getSignature(), trustedCert->getPublicKeyInfo()))
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700133 return onValidated(data.shared_from_this());
134 else
135 return onValidationFailed(data.shared_from_this(),
136 "Cannot verify signature: " +
137 data.getName().toUri());
138 }
139 else
140 {
Alexander Afanasyevfc7d33a2014-05-12 18:04:51 -0700141 // KeyLocator is not a trust anchor
142
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700143 OnDataValidated onKeyValidated =
144 bind(&ValidatorRegex::onCertificateValidated, this, _1,
145 data.shared_from_this(), onValidated, onValidationFailed);
Yingdi Yu40587c02014-02-21 16:40:48 -0800146
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700147 OnDataValidationFailed onKeyValidationFailed =
148 bind(&ValidatorRegex::onCertificateValidationFailed, this, _1, _2,
149 data.shared_from_this(), onValidationFailed);
150
Yingdi Yu4a557052014-07-09 16:40:37 -0700151 Interest interest(keyLocatorName);
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700152 shared_ptr<ValidationRequest> nextStep =
Alexander Afanasyevf73f0632014-05-12 18:02:37 -0700153 make_shared<ValidationRequest>(interest,
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700154 onKeyValidated,
155 onKeyValidationFailed,
156 3,
Yingdi Yu4b8c6a22014-04-15 23:00:54 -0700157 nSteps + 1);
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700158
159 nextSteps.push_back(nextStep);
160
161 return;
162 }
Yingdi Yu6ac97982014-01-30 14:49:21 -0800163 }
Yingdi Yu5ec0ee32014-06-24 16:26:09 -0700164 catch (Tlv::Error& e)
165 {
166 return onValidationFailed(data.shared_from_this(),
167 "Cannot decode signature");
168 }
Alexander Afanasyev2a7f7202014-04-23 14:25:29 -0700169 catch (KeyLocator::Error& e)
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700170 {
171 return onValidationFailed(data.shared_from_this(),
172 "Key Locator is not a name: " +
173 data.getName().toUri());
Yingdi Yu40587c02014-02-21 16:40:48 -0800174 }
Yingdi Yu6ac97982014-01-30 14:49:21 -0800175 }
176 }
177
Yingdi Yu48e8c0c2014-03-19 12:01:55 -0700178 return onValidationFailed(data.shared_from_this(),
Yingdi Yu40587c02014-02-21 16:40:48 -0800179 "No policy found for data: " + data.getName().toUri());
Yingdi Yu6ac97982014-01-30 14:49:21 -0800180}
181
Yingdi Yufc40d872014-02-18 12:56:04 -0800182} // namespace ndn