Moved certificate code into 'vmime::net::security::cert' namespace.

6 files changed, 13 insertions, 503 deletions

diff --git a/src/net/service.cpp b/src/net/service.cpp
index 8dde675a..6b1c34f3 100644
--- a/src/net/service.cpp
+++ b/src/net/service.cpp
@@ -29,7 +29,7 @@
 #endif // VMIME_HAVE_SASL_SUPPORT
 
 #if VMIME_HAVE_TLS_SUPPORT
-	#include "vmime/net/tls/defaultCertificateVerifier.hpp"
+	#include "vmime/security/cert/defaultCertificateVerifier.hpp"
 #endif // VMIME_HAVE_TLS_SUPPORT
 
 
@@ -53,7 +53,7 @@ service::service(ref <session> sess, const serviceInfos& /* infos */,
 	}
 
 #if VMIME_HAVE_TLS_SUPPORT
-	m_certVerifier = vmime::create <tls::defaultCertificateVerifier>();
+	m_certVerifier = vmime::create <security::cert::defaultCertificateVerifier>();
 #endif // VMIME_HAVE_TLS_SUPPORT
 
 	m_socketFactory = platformDependant::getHandler()->getSocketFactory();
@@ -97,13 +97,13 @@ void service::setAuthenticator(ref <security::authenticator> auth)
 
 #if VMIME_HAVE_TLS_SUPPORT
 
-void service::setCertificateVerifier(ref <tls::certificateVerifier> cv)
+void service::setCertificateVerifier(ref <security::cert::certificateVerifier> cv)
 {
 	m_certVerifier = cv;
 }
 
 
-ref <tls::certificateVerifier> service::getCertificateVerifier()
+ref <security::cert::certificateVerifier> service::getCertificateVerifier()
 {
 	return m_certVerifier;
 }
diff --git a/src/net/tls/TLSSession.cpp b/src/net/tls/TLSSession.cpp
index fb84714c..caa63d0a 100644
--- a/src/net/tls/TLSSession.cpp
+++ b/src/net/tls/TLSSession.cpp
@@ -91,7 +91,7 @@ static TLSGlobal g_gnutlsGlobal;
 
 
 
-TLSSession::TLSSession(ref <certificateVerifier> cv)
+TLSSession::TLSSession(ref <security::cert::certificateVerifier> cv)
 	: m_certVerifier(cv)
 {
 	int res;
@@ -212,7 +212,7 @@ ref <TLSSocket> TLSSession::getSocket(ref <socket> sok)
 }
 
 
-ref <tls::certificateVerifier> TLSSession::getCertificateVerifier()
+ref <security::cert::certificateVerifier> TLSSession::getCertificateVerifier()
 {
 	return m_certVerifier;
 }
diff --git a/src/net/tls/TLSSocket.cpp b/src/net/tls/TLSSocket.cpp
index ebf3214b..93066b98 100644
--- a/src/net/tls/TLSSocket.cpp
+++ b/src/net/tls/TLSSocket.cpp
@@ -29,7 +29,7 @@
 
 #include "vmime/platformDependant.hpp"
 
-#include "vmime/net/tls/X509Certificate.hpp"
+#include "vmime/security/cert/X509Certificate.hpp"
 
 
 namespace vmime {
@@ -185,7 +185,7 @@ void TLSSocket::handshake(ref <timeoutHandler> toHandler)
 	m_toHandler = NULL;
 
 	// Verify server's certificate(s)
-	ref <certificateChain> certs = getPeerCertificates();
+	ref <security::cert::certificateChain> certs = getPeerCertificates();
 
 	if (certs == NULL)
 		throw exceptions::tls_exception("No peer certificate.");
@@ -280,7 +280,7 @@ ssize_t TLSSocket::gnutlsPullFunc
 }
 
 
-ref <certificateChain> TLSSocket::getPeerCertificates()
+ref <security::cert::certificateChain> TLSSocket::getPeerCertificates()
 {
 	unsigned int certCount = 0;
 	const gnutls_datum* rawData = gnutls_certificate_get_peers
@@ -304,7 +304,7 @@ ref <certificateChain> TLSSocket::getPeerCertificates()
 
 	if (res >= 1)
 	{
-		std::vector <ref <certificate> > certs;
+		std::vector <ref <security::cert::certificate> > certs;
 		bool error = false;
 
 		count = static_cast <unsigned int>(res);
@@ -321,8 +321,8 @@ ref <certificateChain> TLSSocket::getPeerCertificates()
 			gnutls_x509_crt_export(x509Certs[i],
 				GNUTLS_X509_FMT_DER, data, &dataSize);
 
-			ref <X509Certificate> cert =
-				X509Certificate::import(data, dataSize);
+			ref <security::cert::X509Certificate> cert =
+				security::cert::X509Certificate::import(data, dataSize);
 
 			if (cert != NULL)
 				certs.push_back(cert);
@@ -339,7 +339,7 @@ ref <certificateChain> TLSSocket::getPeerCertificates()
 		if (error)
 			return NULL;
 
-		return vmime::create <certificateChain>(certs);
+		return vmime::create <security::cert::certificateChain>(certs);
 	}
 
 	delete [] x509Certs;
diff --git a/src/net/tls/X509Certificate.cpp b/src/net/tls/X509Certificate.cpp
deleted file mode 100644
index cfb52a1d..00000000
--- a/src/net/tls/X509Certificate.cpp
+++ /dev/null
@@ -1,273 +0,0 @@
-//
-// VMime library (http://www.vmime.org)
-// Copyright (C) 2002-2005 Vincent Richard <[email protected]>
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License as
-// published by the Free Software Foundation; either version 2 of
-// the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-//
-// Linking this library statically or dynamically with other modules is making
-// a combined work based on this library.  Thus, the terms and conditions of
-// the GNU General Public License cover the whole combination.
-//
-
-#include <gnutls/gnutls.h>
-#include <gnutls/x509.h>
-
-#include <ctime>
-
-#include "vmime/net/tls/X509Certificate.hpp"
-
-
-namespace vmime {
-namespace net {
-namespace tls {
-
-
-#ifndef VMIME_BUILDING_DOC
-
-struct X509CertificateInternalData
-{
-	X509CertificateInternalData()
-	{
-		gnutls_x509_crt_init(&cert);
-	}
-
-	~X509CertificateInternalData()
-	{
-		gnutls_x509_crt_deinit(cert);
-	}
-
-
-	gnutls_x509_crt cert;
-};
-
-#endif // VMIME_BUILDING_DOC
-
-
-X509Certificate::X509Certificate()
-	: m_data(new X509CertificateInternalData)
-{
-}
-
-
-X509Certificate::X509Certificate(const X509Certificate&)
-	: certificate(), m_data(NULL)
-{
-	// Not used
-}
-
-
-X509Certificate::~X509Certificate()
-{
-	delete m_data;
-}
-
-
-// static
-ref <X509Certificate> X509Certificate::import(utility::inputStream& is)
-{
-	byteArray bytes;
-	utility::stream::value_type chunk[4096];
-
-	while (!is.eof())
-	{
-		const int len = is.read(chunk, sizeof(chunk));
-		bytes.insert(bytes.end(), chunk, chunk + len);
-	}
-
-	return import(&bytes[0], bytes.size());
-}
-
-
-// static
-ref <X509Certificate> X509Certificate::import
-	(const byte* data, const unsigned int length)
-{
-	ref <X509Certificate> cert = vmime::create <X509Certificate>();
-
-	gnutls_datum buffer;
-	buffer.data = const_cast <byte*>(data);
-	buffer.size = length;
-
-	// Try DER format
-	if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_DER) >= 0)
-		return cert;
-
-	// Try PEM format
-	if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_PEM) >= 0)
-		return cert;
-
-	return NULL;
-}
-
-
-void X509Certificate::write
-	(utility::outputStream& os, const Format format) const
-{
-	size_t dataSize = 0;
-	gnutls_x509_crt_fmt fmt = GNUTLS_X509_FMT_DER;
-
-	switch (format)
-	{
-	case FORMAT_DER: fmt = GNUTLS_X509_FMT_DER; break;
-	case FORMAT_PEM: fmt = GNUTLS_X509_FMT_PEM; break;
-	}
-
-	gnutls_x509_crt_export(m_data->cert, fmt, NULL, &dataSize);
-
-	byte* data = new byte[dataSize];
-
-	gnutls_x509_crt_export(m_data->cert, fmt, data, &dataSize);
-
-	try
-	{
-		os.write(reinterpret_cast <utility::stream::value_type*>(data), dataSize);
-	}
-	catch (...)
-	{
-		delete [] data;
-		throw;
-	}
-}
-
-
-const byteArray X509Certificate::getSerialNumber() const
-{
-	char serial[64];
-	size_t serialSize = sizeof(serial);
-
-	gnutls_x509_crt_get_serial(m_data->cert, serial, &serialSize);
-
-	return byteArray(serial, serial + serialSize);
-}
-
-
-const bool X509Certificate::checkIssuer
-	(ref <const X509Certificate> issuer) const
-{
-	return (gnutls_x509_crt_check_issuer
-			(m_data->cert, issuer->m_data->cert) >= 1);
-}
-
-
-const bool X509Certificate::verify(ref <const X509Certificate> caCert) const
-{
-	unsigned int verify = 0;
-
-	const int res = gnutls_x509_crt_verify
-		(m_data->cert, &(caCert->m_data->cert), 1,
-		 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT,
-		 &verify);
-
-	return (res == 0 && verify == 0);
-}
-
-
-const datetime X509Certificate::getActivationDate() const
-{
-	const time_t t = gnutls_x509_crt_get_activation_time(m_data->cert);
-	return datetime(t);
-}
-
-
-const datetime X509Certificate::getExpirationDate() const
-{
-	const time_t t = gnutls_x509_crt_get_expiration_time(m_data->cert);
-	return datetime(t);
-}
-
-
-const byteArray X509Certificate::getFingerprint(const DigestAlgorithm algo) const
-{
-	gnutls_digest_algorithm galgo;
-
-	switch (algo)
-	{
-	case DIGEST_MD5:
-
-		galgo = GNUTLS_DIG_MD5;
-		break;
-
-	default:
-	case DIGEST_SHA1:
-
-		galgo = GNUTLS_DIG_SHA;
-		break;
-	}
-
-	size_t bufferSize = 0;
-	gnutls_x509_crt_get_fingerprint
-		(m_data->cert, galgo, NULL, &bufferSize);
-
-	byte* buffer = new byte[bufferSize];
-
-	if (gnutls_x509_crt_get_fingerprint
-		(m_data->cert, galgo, buffer, &bufferSize) == 0)
-	{
-		byteArray res;
-		res.insert(res.end(), buffer, buffer + bufferSize);
-
-		delete [] buffer;
-
-		return res;
-	}
-
-	delete [] buffer;
-
-	return byteArray();
-}
-
-
-const byteArray X509Certificate::getEncoded() const
-{
-	byteArray bytes;
-	utility::outputStreamByteArrayAdapter os(bytes);
-
-	write(os, FORMAT_DER);
-
-	return bytes;
-}
-
-
-const string X509Certificate::getType() const
-{
-	return "X.509";
-}
-
-
-const int X509Certificate::getVersion() const
-{
-	return gnutls_x509_crt_get_version(m_data->cert);
-}
-
-
-const bool X509Certificate::equals(ref <const certificate> other) const
-{
-	ref <const X509Certificate> otherX509 =
-		other.dynamicCast <const X509Certificate>();
-
-	if (!otherX509)
-		return false;
-
-	const byteArray fp1 = getFingerprint(DIGEST_MD5);
-	const byteArray fp2 = otherX509->getFingerprint(DIGEST_MD5);
-
-	return fp1 == fp2;
-}
-
-
-} // tls
-} // net
-} // vmime
-
diff --git a/src/net/tls/certificateChain.cpp b/src/net/tls/certificateChain.cpp
deleted file mode 100644
index 52855cc2..00000000
--- a/src/net/tls/certificateChain.cpp
+++ /dev/null
@@ -1,53 +0,0 @@
-//
-// VMime library (http://www.vmime.org)
-// Copyright (C) 2002-2005 Vincent Richard <[email protected]>
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License as
-// published by the Free Software Foundation; either version 2 of
-// the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-//
-// Linking this library statically or dynamically with other modules is making
-// a combined work based on this library.  Thus, the terms and conditions of
-// the GNU General Public License cover the whole combination.
-//
-
-#include "vmime/net/tls/certificateChain.hpp"
-
-
-namespace vmime {
-namespace net {
-namespace tls {
-
-
-certificateChain::certificateChain(const std::vector <ref <certificate> >& certs)
-	: m_certs(certs)
-{
-}
-
-
-const unsigned int certificateChain::getCount() const
-{
-	return static_cast <unsigned int>(m_certs.size());
-}
-
-
-ref <certificate> certificateChain::getAt(const unsigned int index)
-{
-	return m_certs[index];
-}
-
-
-} // tls
-} // net
-} // vmime
-
diff --git a/src/net/tls/defaultCertificateVerifier.cpp b/src/net/tls/defaultCertificateVerifier.cpp
deleted file mode 100644
index de0c6e45..00000000
--- a/src/net/tls/defaultCertificateVerifier.cpp
+++ /dev/null
@@ -1,164 +0,0 @@
-//
-// VMime library (http://www.vmime.org)
-// Copyright (C) 2002-2005 Vincent Richard <[email protected]>
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License as
-// published by the Free Software Foundation; either version 2 of
-// the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-//
-// Linking this library statically or dynamically with other modules is making
-// a combined work based on this library.  Thus, the terms and conditions of
-// the GNU General Public License cover the whole combination.
-//
-
-#include "vmime/net/tls/defaultCertificateVerifier.hpp"
-
-#include "vmime/net/tls/X509Certificate.hpp"
-
-#include "vmime/exception.hpp"
-
-
-namespace vmime {
-namespace net {
-namespace tls {
-
-
-defaultCertificateVerifier::defaultCertificateVerifier()
-{
-}
-
-
-defaultCertificateVerifier::~defaultCertificateVerifier()
-{
-}
-
-
-defaultCertificateVerifier::defaultCertificateVerifier(const defaultCertificateVerifier&)
-	: certificateVerifier()
-{
-	// Not used
-}
-
-
-void defaultCertificateVerifier::verify(ref <certificateChain> chain)
-{
-	if (chain->getCount() == 0)
-		return;
-
-	const string type = chain->getAt(0)->getType();
-
-	if (type == "X.509")
-		verifyX509(chain);
-	else
-		throw exceptions::unsupported_certificate_type(type);
-}
-
-
-void defaultCertificateVerifier::verifyX509(ref <certificateChain> chain)
-{
-	// For every certificate in the chain, verify that the certificate
-	// has been issued by the next certificate in the chain
-	if (chain->getCount() >= 2)
-	{
-		for (unsigned int i = 0 ; i < chain->getCount() - 1 ; ++i)
-		{
-			ref <X509Certificate> cert =
-				chain->getAt(i).dynamicCast <X509Certificate>();
-
-			ref <X509Certificate> next =
-				chain->getAt(i + 1).dynamicCast <X509Certificate>();
-
-			if (!cert->checkIssuer(next))
-			{
-				throw exceptions::certificate_verification_exception
-					("Subject/issuer verification failed.");
-			}
-		}
-	}
-
-	// For every certificate in the chain, verify that the certificate
-	// is valid at the current time
-	const datetime now = datetime::now();
-
-	for (unsigned int i = 0 ; i < chain->getCount() ; ++i)
-	{
-		ref <X509Certificate> cert =
-			chain->getAt(i).dynamicCast <X509Certificate>();
-
-		const datetime begin = cert->getActivationDate();
-		const datetime end = cert->getExpirationDate();
-
-		if (now < begin || now > end)
-		{
-			throw exceptions::certificate_verification_exception
-				("Validity date check failed.");
-		}
-	}
-
-	// Check whether the certificate can be trusted
-
-	// -- First, verify that the the last certificate in the chain was
-	// -- issued by a third-party that we trust
-	ref <X509Certificate> lastCert =
-		chain->getAt(chain->getCount() - 1).dynamicCast <X509Certificate>();
-
-	bool trusted = false;
-
-	for (unsigned int i = 0 ; !trusted && i < m_x509RootCAs.size() ; ++i)
-	{
-		ref <X509Certificate> rootCa = m_x509RootCAs[i];
-
-		if (lastCert->verify(rootCa))
-			trusted = true;
-	}
-
-	// -- Next, if the issuer certificate cannot be verified against
-	// -- root CAs, compare the subject's certificate against the
-	// -- trusted certificates
-	ref <X509Certificate> firstCert =
-		chain->getAt(0).dynamicCast <X509Certificate>();
-
-	for (unsigned int i = 0 ; !trusted && i < m_x509TrustedCerts.size() ; ++i)
-	{
-		ref <X509Certificate> cert = m_x509TrustedCerts[i];
-
-		if (firstCert->equals(cert))
-			trusted = true;
-	}
-
-	if (!trusted)
-	{
-		throw exceptions::certificate_verification_exception
-			("Cannot verify certificate against trusted certificates.");
-	}
-}
-
-
-void defaultCertificateVerifier::setX509RootCAs
-	(const std::vector <ref <X509Certificate> >& caCerts)
-{
-	m_x509RootCAs = caCerts;
-}
-
-
-void defaultCertificateVerifier::setX509TrustedCerts
-	(const std::vector <ref <X509Certificate> >& trustedCerts)
-{
-	m_x509TrustedCerts = trustedCerts;
-}
-
-
-} // tls
-} // net
-} // vmime
-