tokentransport.c

voltage 公司提供的一个开发Ibe的工具包

{
  int status ;
  unsigned int districtNameLen, index;
  VoltTransportCtx *transCtx = (VoltTransportCtx *)transportCtx;
  VoltDelegatedTransCtx *localCtx = (VoltDelegatedTransCtx *)(transCtx->localCtx);  
  VoltIdentityObject *obj = (VoltIdentityObject *)identity;
  VoltCertRequestObject *certReq = (VoltCertRequestObject *)certRequest;
  VoltCertObject *certObj = (VoltCertObject *)signingCert;  
  VoltKeyObject *priKey = (VoltKeyObject *)ibePriKey;  
  VoltDistrictObject *distObj;
  VoltLibCtx *libCtx = (VoltLibCtx *)(obj->voltObject.libraryCtx);
  unsigned char *temp;
  Asn1P10Request *asnCertReq = (Asn1P10Request *)0;
  mIcServerObject *icServer = (mIcServerObject *)0;
  char *component = "VCOM/3.0.0.0";
  char *policyServer = (char *)0;
  unsigned char *secret = (unsigned char *)0;
  unsigned char *distQualName = (unsigned char *)0;
  unsigned int secretLen, tokenLen ;  
  unsigned char *token = (unsigned char *)0;
  VtVoltageAuthTokenInfo tokenInfo;
  VoltSurrenderCtx *surrCtx = (VoltSurrenderCtx *)0;
  VOLT_DECLARE_ERROR_TYPE (errorType)
  VOLT_DECLARE_FNCT_LINE (fnctLine)

  do
  {
    /* This transport function performs network access. Check the no net
     * access bit in the libCtx->flags field to make sure the caller
     * allows it.
     */
    VOLT_SET_ERROR_TYPE (errorType, VT_ERROR_TYPE_PRIMARY)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VT_ERROR_UNKNOWN_DISTRICT;
    if ((libCtx->flags & VOLT_LIB_CTX_NO_NETWORK_ACCESS) != 0)
      break;

    /* This provider will always make a private key request, 
     *  Cert request is optional. If the caller doesn't want to store
     *  any of the private key or cert received in the response.
     *  Then there is No point in making the request itself.  
     */
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VT_ERROR_INVALID_PROVIDER_USE;
    if ( (ibePriKey == (VtKeyObject)0) && (signingCert == (VtCertObject)0) )
      break;

    /* If we have a cert object make sure we have the Cert request too. 
     *  The opposite is not true though. We can pass a cert request but
     *  pass a null cert object if we just want to ignore the 
     *  cert received in the response.
     */
    VOLT_SET_FNCT_LINE (fnctLine)
    if ( (certReq == (VoltCertRequestObject *)0) &&
         (certObj != (VoltCertObject *)0) )
      break;

    /* One of the keys may already contain data (it was in storage, the
     * other was not). So clear the private key data or the pub key cert.
     */
    if (priKey != (VoltKeyObject *)0)
    {
      if (priKey->keyData != (Pointer)0)
      {
        if (priKey->KeyDataDestroy != (VCtxDestroy)0)
        {
          priKey->KeyDataDestroy ((Pointer)priKey, priKey->keyData);
          priKey->keyData = (Pointer)0;
          priKey->KeyDataDestroy = (VCtxDestroy)0;
          priKey->keyType = 0;
        }
      }
    }

    if (certObj != (VoltCertObject *)0) 
    {
      VtDestroyKeyObject (&(certObj->pubKey));
      if (certObj->certificate.data != (unsigned char *)0)
      {
        libCtx = (VoltLibCtx *)(certObj->voltObject.libraryCtx);
        Z2Free (certObj->certificate.data);
        certObj->certificate.data = (unsigned char *)0;
        certObj->certificate.len = 0;
        libCtx = (VoltLibCtx *)(transCtx->voltObject.libraryCtx);
      }
    }  

    if ( ((transCtx->voltObject.objectType & VOLT_OBJECT_TYPE_SURRENDER) != 0) &&
      (transCtx->voltObject.surrenderCtx != (Pointer)0) )
    {
      surrCtx = (VoltSurrenderCtx *)(transCtx->voltObject.surrenderCtx);
      surrCtx->surrenderInfo.callingFlag = VT_SURRENDER_FNCT_IBE_KEY_DOWNLOAD;
      surrCtx->surrenderInfo.callCount = 2;
      surrCtx->surrenderInfo.callNumber = 1;
      VOLT_SET_FNCT_LINE (fnctLine)
      status = surrCtx->Surrender (
        surrCtx->libraryCtx, surrCtx->appData, &(surrCtx->surrenderInfo));
      if (status != 0)
        break;
    }

    /* If the incoming identity object does not contain the encoded
     * identity, get it now.
     */
    VOLT_SET_ERROR_TYPE (errorType, 0)
    if (obj->encoding.data == (unsigned char *)0)
    {
      VOLT_SET_FNCT_LINE (fnctLine)
        status = VtEncodeIdentity (
        identity, VT_ENCODE_IBCS_2_V_DISTRICT, policyCtx,
        storageCtx, transportCtx, (unsigned char *)0, 0, &index);
      if (status == 0)
        status = VT_ERROR_GENERAL;
      if (status != VT_ERROR_BUFFER_TOO_SMALL)
        break;
    }

    /* Get the district parameters.
     */
    VOLT_SET_ERROR_TYPE (errorType, 0)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VtDetermineDistrict (
      identity, policyCtx, storageCtx, transportCtx,
      (unsigned char *)0, 0, &districtNameLen);
    if (status == 0)
      status = VT_ERROR_INVALID_INPUT;
    if (status != VT_ERROR_BUFFER_TOO_SMALL)
      break;

    VOLT_SET_FNCT_LINE (fnctLine)
    status = VtObtainIBEParams (
      obj->district, policyCtx, storageCtx, transportCtx);
    if (status != 0)
      break;

    distQualName = obj->district->qualDistrictName.data;

    /* currently only * is supported as regular expression
     */
    VOLT_SET_FNCT_LINE (fnctLine)
    status = getDistrictSecretAlloc (
      transCtx, distQualName, "*", &secret, &secretLen);
    if (status != 0)
      break;

    /* Get the policy server extension out of the district.
     * Run through all the extensions, search for the one with the OID
     * we want.
     */
    distObj = (VoltDistrictObject *)(obj->district);
    status = VtGetDistrictParam (
      obj->district, VtDistrictParamPolicyServer, (Pointer *)&policyServer);
    if (status != 0)
      break;

    /* Create the icServer object.
     */
    VOLT_SET_ERROR_TYPE (errorType, 0)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = mIcServerCreateObject (
      (VtLibCtx)libCtx, localCtx->defCtx.DoHttp, localCtx->defCtx.uiHandle,
      localCtx->defCtx.trustStore, transCtx->timeout, &icServer);
    if (status != 0)
      break;

    /* We need the cert request in X509_REQ form.
     */
    if (certReq != (VoltCertRequestObject *)0 ) 
    {
      VOLT_SET_ERROR_TYPE (errorType, VT_ERROR_TYPE_PRIMARY)
      VOLT_SET_FNCT_LINE (fnctLine)
      status = VT_ERROR_MEMORY;
      asnCertReq = Asn1P10Request_new ();
      if (asnCertReq == (Asn1P10Request *)0)
        break;

      VOLT_SET_FNCT_LINE (fnctLine)
      status = VT_ERROR_INVALID_ENCODING;
      temp = certReq->certRequest.data;
      d2i_Asn1P10Request (&asnCertReq, &temp, certReq->certRequest.len);
      if (asnCertReq == (Asn1P10Request *)0)
        break;
    }

    /* Create auth tokens based on the secret, identity and district
     * to send in the key request.
     */    
    tokenInfo.sharedSecret.data = secret;
    tokenInfo.sharedSecret.len = secretLen;
    tokenInfo.policyCtx = policyCtx;
    tokenInfo.storageCtx = storageCtx;
    tokenInfo.transportCtx = transportCtx;
    VOLT_SET_ERROR_TYPE (errorType, 0)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VtConstructAuthToken (
      identity, VtAuthTokenImplVoltage, (Pointer)&tokenInfo, 
      (unsigned char *)0, 0, &tokenLen);  
    if (status != VT_ERROR_BUFFER_TOO_SMALL)
      break;  

    VOLT_SET_ERROR_TYPE (errorType, VT_ERROR_TYPE_PRIMARY)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VT_ERROR_MEMORY;
    token = (unsigned char *)Z2Malloc (tokenLen, VOLT_MEMORY_SENSITIVE);
    if (token == (unsigned char *)0 )
      break;

    VOLT_SET_ERROR_TYPE (errorType, 0)
    VOLT_SET_FNCT_LINE (fnctLine)
    status = VtConstructAuthToken (
      identity, VtAuthTokenImplVoltage, (Pointer)&tokenInfo, 
      token, tokenLen, &tokenLen);  
    if (status != 0)
      break;
    
    /* Fill in the fields of the serverRequestData.
     */
    icServer->uiHandle = localCtx->defCtx.uiHandle;    

    /* The server is the policy server.
     */
    icServer->serverRequestData.server = policyServer;
    icServer->serverRequestData.components = component;    
    icServer->serverRequestData.authTokens = (char **)&token,
    icServer->serverRequestData.authTokensCount = 1;
    icServer->serverRequestData.id = obj->encoding.data;
    icServer->serverRequestData.idLen = obj->encoding.len;
    icServer->serverRequestData.request = asnCertReq;

    /* This call downloads the info.
     */
    VOLT_SET_FNCT_LINE (fnctLine)    
    status = mIcServerRequest (icServer, obj, transCtx);
    if (status != 0)
      break;

    /* If we completed the download, one more call to surrender.
     */
    if (surrCtx != (VoltSurrenderCtx *)0)
    {
      surrCtx->surrenderInfo.callingFlag = VT_SURRENDER_FNCT_IBE_KEY_DOWNLOAD;
      surrCtx->surrenderInfo.callCount = 2;
      surrCtx->surrenderInfo.callNumber = 2;
      VOLT_SET_ERROR_TYPE (errorType, VT_ERROR_TYPE_PRIMARY)
      VOLT_SET_FNCT_LINE (fnctLine)
      status = surrCtx->Surrender (
        surrCtx->libraryCtx, surrCtx->appData, &(surrCtx->surrenderInfo));
      if (status != 0)
        break;
    }

    /* Extract the private key and cert from the ServerResponse struct.
    *  If any of these objects are NULL it means caller is not interested
    *  in receiving that value.      
    */
    if (ibePriKey != (VtKeyObject) 0 )
    {
      VOLT_SET_FNCT_LINE (fnctLine)
      status = VoltSetPrivateKeyObject (
        libCtx, distObj->paramObj, obj->encoding.data, obj->encoding.len,
        icServer->serverResponseData.privateKey,
        (unsigned int)(icServer->serverResponseData.privateKeyLen), ibePriKey);
      if (status != 0)
        break;
    }

    if (signingCert != (VtCertObject)0) 
    {
      VOLT_SET_FNCT_LINE (fnctLine)
      status = VoltSetCertObject (
        libCtx, icServer->serverResponseData.asn1Cert, signingCert);
      if (status != 0)
        break;
    }

  } while (0);

  if (token != (unsigned char *)0)
    Z2Free (token);
  if (asnCertReq != (Asn1P10Request *)0)
    Asn1P10Request_free (asnCertReq);
  if (secret != (unsigned char *)0 )
    Z2Free (secret);
  if (policyServer != (char *)0)
    Z2Free (policyServer);

  if (icServer != (mIcServerObject *)0)
  {
    /* Null the fields we took care of explicitly in this routine.
     */
    icServer->serverRequestData.server = (char *)0;
    icServer->serverRequestData.authTokens = (char **)0;
    icServer->serverRequestData.authTokensCount = 0;
    icServer->serverRequestData.id = (unsigned char *)0;
    icServer->serverRequestData.idLen = 0;
    icServer->serverRequestData.request = (Asn1P10Request *)0;
    mIcServerDestroyObject (&icServer);
  }

  VOLT_LOG_ERROR_COMPARE (
    status, (VtLibCtx)libCtx, status, errorType, fnctLine,
    "VoltTokenDownloadKeyAndCert", (char *)0)

  return (status);
}

static int getDistrictSecretAlloc (
   VoltTransportCtx *transCtx, 
   unsigned char *distQualName, 
   unsigned char *email,
   unsigned char **secret,
   unsigned int *outLen
   )
{
  int status;
  unsigned int i, districtLen1, districtLen2, secretLen, numSecrets;
  VoltDelegatedTransCtx *localCtx =
    (VoltDelegatedTransCtx *)(transCtx->localCtx);
  VtTransportDelegatedInfo **secretList =
    (VtTransportDelegatedInfo **)(localCtx->secretList);
  VoltLibCtx *libCtx = (VoltLibCtx *)(transCtx->voltObject.libraryCtx); 
  VtTransportDelegatedInfo *secretItem = (VtTransportDelegatedInfo *)0;
  unsigned char *sharedSecret = (unsigned char *)0;
  VOLT_DECLARE_FNCT_LINE (fnctLine)

  numSecrets = localCtx->numSecrets;

  /* Currently we ignore the emails and assume that one district has only
   * one secret for all emails. This code will be updated later to handle
   * multiple secrets per district
   */
  districtLen1 = Z2Strlen (distQualName);

  for (i = 0; i < numSecrets; i++)
  {
    secretItem = secretList[i];
    districtLen2 = Z2Strlen (secretItem->qualDistName);
    if (districtLen1 != districtLen2)
      continue;

    if (Z2Memcmp (
      distQualName , secretItem->qualDistName, districtLen1) == 0)
    {
      VOLT_SET_FNCT_LINE (fnctLine)
      status = VT_ERROR_MEMORY;
      secretLen = secretItem->sharedSecret.len;
      sharedSecret = (unsigned char *) Z2Malloc (
        secretLen + 1, VOLT_MEMORY_SENSITIVE);
      if (sharedSecret == (unsigned char *) 0 )
        break;
      Z2Memcpy (sharedSecret, secretItem->sharedSecret.data, secretLen);
      *secret = sharedSecret;
      *outLen = secretLen;

      status = 0;
      break;
    }
  }

  VOLT_SET_FNCT_LINE (fnctLine)
  if (i >= numSecrets)
    status = VT_ERROR_NO_DISTRICT_SECRET;

  if (status == 0)
    return (0);

  if (sharedSecret != (unsigned char *)0)
    Z2Free (sharedSecret);

  VOLT_LOG_ERROR (
    (VtLibCtx)libCtx, status, VT_ERROR_TYPE_PRIMARY, fnctLine,
    "getDistrictSecretAlloc", (char *)0)

  return (status);
}

void LocalTokenTransCtxDestroy (
   Pointer obj,
   Pointer ctx
   )
{
  VoltObject *voltObj = (VoltObject *)obj;
  VoltLibCtx *libCtx = (VoltLibCtx *)(voltObj->libraryCtx);
  VoltDelegatedTransCtx *localCtx = (VoltDelegatedTransCtx *)ctx;
  unsigned int numSecrets, i;
  VtTransportDelegatedInfo *transInfo = (VtTransportDelegatedInfo *)0;

  if ( (obj == (Pointer)0) || (ctx == (Pointer)0) )
    return;
  
  numSecrets = localCtx->numSecrets ;

  for (i= 0 ; i < numSecrets; i++)
  {
    transInfo = localCtx->secretList[i];
    if (transInfo->qualDistName != (unsigned char *)0 )
      Z2Free (transInfo->qualDistName);
    if (transInfo->regExp != (unsigned char *)0 )
      Z2Free (transInfo->regExp);
    if (transInfo->sharedSecret.data != (unsigned char *)0 )
      Z2Free (transInfo->sharedSecret.data);

    Z2Free (transInfo);
  }

  if (localCtx->secretList != (VtTransportDelegatedInfo **) 0)
    Z2Free (localCtx->secretList);

  Z2Free (ctx);
}