Validate the peer's certificate list, from root to peer (last to first)
| 258 | |
| 259 | // Validate the peer's certificate list, from root to peer (last to first) |
| 260 | int CertManager::Validate() |
| 261 | { |
| 262 | CertList::reverse_iterator last = peerList_.rbegin(); |
| 263 | size_t count = peerList_.size(); |
| 264 | |
| 265 | while ( count > 1 ) { |
| 266 | TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length()); |
| 267 | TaoCrypt::CertDecoder cert(source, true, &signers_, verifyNone_); |
| 268 | |
| 269 | if (int err = cert.GetError().What()) |
| 270 | return err; |
| 271 | |
| 272 | const TaoCrypt::PublicKey& key = cert.GetPublicKey(); |
| 273 | signers_.push_back(NEW_YS TaoCrypt::Signer(key.GetKey(), key.size(), |
| 274 | cert.GetCommonName(), cert.GetHash())); |
| 275 | ++last; |
| 276 | --count; |
| 277 | } |
| 278 | |
| 279 | if (count) { |
| 280 | // peer's is at the front |
| 281 | TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length()); |
| 282 | TaoCrypt::CertDecoder cert(source, true, &signers_, verifyNone_); |
| 283 | |
| 284 | int err = cert.GetError().What(); |
| 285 | if ( err && err != TaoCrypt::SIG_OTHER_E) |
| 286 | return err; |
| 287 | |
| 288 | uint sz = cert.GetPublicKey().size(); |
| 289 | peerPublicKey_.allocate(sz); |
| 290 | peerPublicKey_.assign(cert.GetPublicKey().GetKey(), sz); |
| 291 | |
| 292 | if (cert.GetKeyType() == TaoCrypt::RSAk) |
| 293 | peerKeyType_ = rsa_sa_algo; |
| 294 | else |
| 295 | peerKeyType_ = dsa_sa_algo; |
| 296 | |
| 297 | size_t iSz = strlen(cert.GetIssuer()) + 1; |
| 298 | size_t sSz = strlen(cert.GetCommonName()) + 1; |
| 299 | ASN1_STRING beforeDate, afterDate; |
| 300 | beforeDate.data= (unsigned char *) cert.GetBeforeDate(); |
| 301 | beforeDate.type= cert.GetBeforeDateType(); |
| 302 | beforeDate.length= strlen((char *) beforeDate.data) + 1; |
| 303 | afterDate.data= (unsigned char *) cert.GetAfterDate(); |
| 304 | afterDate.type= cert.GetAfterDateType(); |
| 305 | afterDate.length= strlen((char *) afterDate.data) + 1; |
| 306 | peerX509_ = NEW_YS X509(cert.GetIssuer(), iSz, cert.GetCommonName(), |
| 307 | sSz, &beforeDate, &afterDate); |
| 308 | |
| 309 | if (err == TaoCrypt::SIG_OTHER_E && verifyCallback_) { |
| 310 | X509_STORE_CTX store; |
| 311 | store.error = err; |
| 312 | store.error_depth = static_cast<int>(count) - 1; |
| 313 | store.current_cert = peerX509_; |
| 314 | |
| 315 | int ok = verifyCallback_(0, &store); |
| 316 | if (ok) return 0; |
| 317 | } |
no test coverage detected