update challenge modules aginst spec
Change-Id: Ibcfe851a77df1854f417d60cd48a66f8213aedc6
diff --git a/src/challenge-modules/challenge-credential.cpp b/src/challenge-modules/challenge-credential.cpp
index 7102434..cf429b5 100644
--- a/src/challenge-modules/challenge-credential.cpp
+++ b/src/challenge-modules/challenge-credential.cpp
@@ -20,6 +20,8 @@
#include "challenge-credential.hpp"
#include <iostream>
#include <ndn-cxx/security/verification-helpers.hpp>
+#include <ndn-cxx/security/signing-helpers.hpp>
+#include <ndn-cxx/security/transform/public-key.hpp>
#include <ndn-cxx/util/io.hpp>
namespace ndn {
@@ -32,7 +34,7 @@
const std::string ChallengeCredential::PARAMETER_KEY_PROOF_OF_PRIVATE_KEY = "proof-of-private-key";
ChallengeCredential::ChallengeCredential(const std::string& configPath)
- : ChallengeModule("Credential")
+ : ChallengeModule("Credential", 1, time::seconds(1))
{
if (configPath.empty()) {
m_configFile = std::string(SYSCONFDIR) + "/ndncert/challenge-credential.conf";
@@ -80,12 +82,14 @@
if (m_trustAnchors.empty()) {
parseConfigFile();
}
- shared_ptr<security::v2::Certificate> selfSigned, credential;
- auto& elements = params.elements();
+ shared_ptr<security::v2::Certificate> credential;
+ const uint8_t* signature;
+ size_t signatureLen;
+ const auto& elements = params.elements();
for (size_t i = 0; i < elements.size(); i++) {
if (elements[i].type() == tlv_parameter_key) {
if (readString(elements[i]) == PARAMETER_KEY_CREDENTIAL_CERT) {
- std::istringstream ss(readString(params.elements()[i + 1]));
+ std::istringstream ss(readString(elements[i + 1]));
credential = io::load<security::v2::Certificate>(ss);
if (credential == nullptr) {
_LOG_ERROR("Cannot load challenge parameter: credential");
@@ -93,26 +97,21 @@
}
}
else if (readString(elements[i]) == PARAMETER_KEY_PROOF_OF_PRIVATE_KEY) {
- std::istringstream ss(readString(params.elements()[i + 1]));
- selfSigned = io::load<security::v2::Certificate>(ss);
- if (selfSigned == nullptr) {
- _LOG_ERROR("Cannot load challenge parameter: proof of private key");
- return returnWithError(request, ErrorCode::INVALID_PARAMETER, "Cannot load challenge parameter: proof of private key.");
- }
- }
- else {
- continue;
+ signature = elements[i + 1].value();
+ signatureLen = elements[i + 1].value_size();
}
}
}
// verify the credential and the self-signed cert
Name signingKeyName = credential->getSignature().getKeyLocator().getName();
+ security::transform::PublicKey key;
+ const auto& pubKeyBuffer = credential->getPublicKey();
+ key.loadPkcs8(pubKeyBuffer.data(), pubKeyBuffer.size());
for (auto anchor : m_trustAnchors) {
if (anchor.getKeyName() == signingKeyName) {
if (security::verifySignature(*credential, anchor) &&
- security::verifySignature(*selfSigned, *credential) &&
- readString(selfSigned->getContent()) == request.m_requestId) {
+ security::verifySignature((uint8_t*)request.m_requestId.c_str(), request.m_requestId.size(), signature, signatureLen, key)) {
return returnWithSuccess(request);
}
}
@@ -130,11 +129,9 @@
if (status == Status::BEFORE_CHALLENGE) {
result.push_back(std::make_tuple(PARAMETER_KEY_CREDENTIAL_CERT, "Please provide the certificate issued by a trusted CA."));
result.push_back(std::make_tuple(PARAMETER_KEY_PROOF_OF_PRIVATE_KEY, "Please sign a Data packet with request ID as the content."));
+ return result;
}
- else {
- BOOST_THROW_EXCEPTION(std::runtime_error("Unexpected status or challenge status."));
- }
- return result;
+ BOOST_THROW_EXCEPTION(std::runtime_error("Unexpected status or challenge status."));
}
Block
@@ -150,11 +147,16 @@
for (const auto& item : params) {
if (std::get<0>(item) == PARAMETER_KEY_CREDENTIAL_CERT) {
request.push_back(makeStringBlock(tlv_parameter_key, PARAMETER_KEY_CREDENTIAL_CERT));
- request.push_back(makeStringBlock(tlv_parameter_value, std::get<1>(item)));
+ Block valueBlock = makeEmptyBlock(tlv_parameter_value);
+ auto& certTlvStr = std::get<1>(item);
+ valueBlock.push_back(Block((uint8_t*)certTlvStr.c_str(), certTlvStr.size()));
+ request.push_back(valueBlock);
}
else if (std::get<0>(item) == PARAMETER_KEY_PROOF_OF_PRIVATE_KEY) {
request.push_back(makeStringBlock(tlv_parameter_key, PARAMETER_KEY_PROOF_OF_PRIVATE_KEY));
- request.push_back(makeStringBlock(tlv_parameter_value, std::get<1>(item)));
+ auto& sigTlvStr = std::get<1>(item);
+ Block valueBlock = makeBinaryBlock(tlv_parameter_value, (uint8_t*)sigTlvStr.c_str(), sigTlvStr.size());
+ request.push_back(valueBlock);
}
else {
BOOST_THROW_EXCEPTION(std::runtime_error("Wrong parameter provided."));
@@ -167,5 +169,26 @@
request.encode();
return request;
}
+
+void
+ChallengeCredential::fulfillParameters(std::vector<std::tuple<std::string, std::string>>& params,
+ KeyChain& keyChain, const Name& issuedCertName, const std::string& requestId)
+{
+ auto& pib = keyChain.getPib();
+ auto id = pib.getIdentity(security::v2::extractIdentityFromCertName(issuedCertName));
+ auto issuedCert = id.getKey(security::v2::extractKeyNameFromCertName(issuedCertName)).getCertificate(issuedCertName);
+ auto issuedCertTlv = issuedCert.wireEncode();
+ auto signatureTlv = keyChain.sign((uint8_t*)requestId.c_str(), requestId.length(), security::signingByCertificate(issuedCertName));
+ for (auto& item : params) {
+ if (std::get<0>(item) == PARAMETER_KEY_CREDENTIAL_CERT) {
+ std::get<1>(item) = std::string((char*)issuedCertTlv.wire(), issuedCertTlv.size());
+ }
+ else if (std::get<0>(item) == PARAMETER_KEY_PROOF_OF_PRIVATE_KEY) {
+ std::get<1>(item) = std::string((char*)signatureTlv.value(), signatureTlv.value_size());
+ }
+ }
+ return;
+}
+
} // namespace ndncert
} // namespace ndn