229 lines
6.9 KiB
Plaintext
229 lines
6.9 KiB
Plaintext
|
================================================================================
|
|||
|
|
Data Structures
|
|||
|
|
================================================================================
|
|||
|
|
|
|||
|
|
Certificate Object
|
|||
|
|
|
|||
|
|
This is the main object for caching of trust information for a certificate. It
|
|||
|
|
contains information which will be used to build the chain context. This data
|
|||
|
|
is specified as follows:
|
|||
|
|
|
|||
|
|
Certificate Object Identifier (MD5 hash of issuer and serial no.)
|
|||
|
|
|
|||
|
|
Certificate Context
|
|||
|
|
|
|||
|
|
Pre calculated Trust Status Bits
|
|||
|
|
|
|||
|
|
CERT_TRUST_IS_SELF_SIGNED
|
|||
|
|
CERT_TRUST_IS_IN_ROOT_STORE
|
|||
|
|
CERT_TRUST_HAS_EXACT_MATCH_ISSUER
|
|||
|
|
|
|||
|
|
CERT_TRUST_IS_SIGNATURE_VALID (if it is self-signed)
|
|||
|
|
|
|||
|
|
Enhanced Key Usage (merged and sorted)
|
|||
|
|
|
|||
|
|
Issuer Certificate Objects (list)
|
|||
|
|
|
|||
|
|
CERT_TRUST_IS_SIGNATURE_VALID for each issuer
|
|||
|
|
CERT_TRUST_IS_TIME_NESTED for each issuer
|
|||
|
|
|
|||
|
|
CERT_TRUST_IS_SIGNATURE_VALID for issuer simple chain
|
|||
|
|
CERT_TRUST_IS_TIME_NESTED For issuer simple chain
|
|||
|
|
|
|||
|
|
Trust List Entry Objects (LRU bounded list)
|
|||
|
|
|
|||
|
|
Revocation Entry Object
|
|||
|
|
|
|||
|
|
Construction of a Certificate Object given a certificate context is as follows:
|
|||
|
|
|
|||
|
|
Certificate Object Identifier is calculated
|
|||
|
|
|
|||
|
|
Certificate Context is duplicated
|
|||
|
|
|
|||
|
|
If the subject name and issuer name are equal then
|
|||
|
|
CERT_TRUST_IS_SELF_SIGNED is set
|
|||
|
|
|
|||
|
|
If it is in the root store then
|
|||
|
|
CERT_TRUST_IS_IN_ROOT_STORE is set
|
|||
|
|
|
|||
|
|
If it has the Authority Key Identifier extension then
|
|||
|
|
CERT_TRUST_HAS_EXACT_MATCH_ISSUER is set
|
|||
|
|
|
|||
|
|
Enhanced Key Usage is calculated based on extensions and properties.
|
|||
|
|
|
|||
|
|
Initialize Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
If !CERT_TRUST_IS_SELF_SIGNED then
|
|||
|
|
If CERT_TRUST_HAS_EXACT_MATCH_ISSUER then
|
|||
|
|
FindExactMatchIssuersInEngine
|
|||
|
|
RetrieveExactMatchIssuersByUrl
|
|||
|
|
Otherwise
|
|||
|
|
FindNameMatchIssuersInEngine
|
|||
|
|
|
|||
|
|
Trust List Entry Objects is set to NULL
|
|||
|
|
|
|||
|
|
Revocation Entry Object is set to NULL
|
|||
|
|
|
|||
|
|
FindExactMatchIssuersInEngine
|
|||
|
|
|
|||
|
|
Check Certificate Object Cache for objects which match the given issuer
|
|||
|
|
and serial no. ( certificate object identifier )
|
|||
|
|
|
|||
|
|
Add them to the Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
Check configured stores for certificates which have the same Issuer
|
|||
|
|
and Serial No. and for each certificate
|
|||
|
|
|
|||
|
|
If not found by hash in the Certificate Object Cache then
|
|||
|
|
Create Certificate Object
|
|||
|
|
Add to the Certificate Object Cache
|
|||
|
|
Add to the Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
RetrieveExactMatchIssuersByUrl
|
|||
|
|
|
|||
|
|
Retrieve the certificate using the encoded URL
|
|||
|
|
|
|||
|
|
Check the Certificate Object Cache for object matching the certificate
|
|||
|
|
hash
|
|||
|
|
|
|||
|
|
If not found by hash then
|
|||
|
|
Create Certificate Object
|
|||
|
|
Add to the Certificate Object Cache
|
|||
|
|
Add to Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
FindNameMatchIssuersInEngine
|
|||
|
|
|
|||
|
|
Get the issuer name from the certificate context in the certificate
|
|||
|
|
object
|
|||
|
|
|
|||
|
|
Check the Certificate Object Cache for objects whose subject name
|
|||
|
|
match the issuer name retrieved
|
|||
|
|
|
|||
|
|
Add them to the Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
Check configured stores for certificates whose subject name match
|
|||
|
|
the issuer name retrieved and for each certificate
|
|||
|
|
|
|||
|
|
If not found by hash in the Certificate Object Cache then
|
|||
|
|
Create Certificate Object
|
|||
|
|
Add to the Certificate Object Cache
|
|||
|
|
Add to the Issuer Certificate Objects list
|
|||
|
|
|
|||
|
|
GetIssuer
|
|||
|
|
|
|||
|
|
Given a set of parameters (time, usage, additional store) determine
|
|||
|
|
the best issuer certificate object from the issuer certificate object
|
|||
|
|
list
|
|||
|
|
|
|||
|
|
Assign values for the various characteristics given here in order of
|
|||
|
|
importance:
|
|||
|
|
|
|||
|
|
Simple Chain Signature Validity
|
|||
|
|
Single Issuer Signature Validity
|
|||
|
|
Usage
|
|||
|
|
Time Validity
|
|||
|
|
Simple Chain Time Nesting
|
|||
|
|
Single Issuer Time Nesting
|
|||
|
|
|
|||
|
|
If the Issuer Certificate Objects list is NULL and
|
|||
|
|
!CERT_TRUST_IS_SELF_SIGNED then
|
|||
|
|
Initialize the Issuer Certificate Objects list from the
|
|||
|
|
additional store
|
|||
|
|
|
|||
|
|
Search the list for the best issuer using a calculated quality value
|
|||
|
|
|
|||
|
|
Certificate Object Cache
|
|||
|
|
|
|||
|
|
This is an LRU maintained cache of certificate object references keyed by the
|
|||
|
|
following:
|
|||
|
|
|
|||
|
|
Certificate Object Identifier
|
|||
|
|
|
|||
|
|
Subject Name
|
|||
|
|
|
|||
|
|
Issuer Name
|
|||
|
|
|
|||
|
|
Certificate Hash (MD5)
|
|||
|
|
|
|||
|
|
Trust List Entry Object
|
|||
|
|
|
|||
|
|
This object represents a certificate's entry in a trust list. The information
|
|||
|
|
contained is as follows:
|
|||
|
|
|
|||
|
|
Trust List Object
|
|||
|
|
|
|||
|
|
CTL Entry
|
|||
|
|
|
|||
|
|
Trust List Object
|
|||
|
|
|
|||
|
|
This object represents a CTL and wraps the CTL context. It also caches
|
|||
|
|
certificate object references which are in this CTL and have been seen by
|
|||
|
|
this chain engine. The information contained is as follows:
|
|||
|
|
|
|||
|
|
Trust List Identifier
|
|||
|
|
|
|||
|
|
Enhanced Key Usage
|
|||
|
|
|
|||
|
|
CTL Context
|
|||
|
|
|
|||
|
|
CTL Subject Certificate Objects (LRU bounded list)
|
|||
|
|
|
|||
|
|
CTL Signer Certificate Object
|
|||
|
|
|
|||
|
|
Trust List Object Cache
|
|||
|
|
|
|||
|
|
This is a cache of trust list object references keyed by the following:
|
|||
|
|
|
|||
|
|
Trust List Identifier
|
|||
|
|
|
|||
|
|
Trust List Usage (Individual usages are separated)
|
|||
|
|
|
|||
|
|
The cache is initialized from the "trust" store at creation of the chain engine
|
|||
|
|
and updated when the store changes.
|
|||
|
|
|
|||
|
|
Revocation Entry Object
|
|||
|
|
|
|||
|
|
This object represents a certificate's current revocation state. The
|
|||
|
|
information contained is as follows:
|
|||
|
|
|
|||
|
|
Revocation List Object
|
|||
|
|
|
|||
|
|
CRL Entry
|
|||
|
|
|
|||
|
|
Revocation List Object
|
|||
|
|
|
|||
|
|
This object represents a CRL and wraps the CRL context. It also caches
|
|||
|
|
certificate object references which are in this CRL and have been seen by
|
|||
|
|
this chain engine. The information contained is as follows:
|
|||
|
|
|
|||
|
|
Revocation List Origin Identifier
|
|||
|
|
|
|||
|
|
CRL context
|
|||
|
|
|
|||
|
|
CRL Entry Certificate Objects (list)
|
|||
|
|
|
|||
|
|
CRL Issuer Certificate Object
|
|||
|
|
|
|||
|
|
Revocation List Object Cache
|
|||
|
|
|
|||
|
|
This is an LRU maintained cache of revocation object references keyed by the
|
|||
|
|
revocation list origin identifier
|
|||
|
|
|
|||
|
|
================================================================================
|
|||
|
|
Algorithms
|
|||
|
|
================================================================================
|
|||
|
|
|
|||
|
|
CertGetCertificateChain
|
|||
|
|
|
|||
|
|
Find end cert in certificate object cache and if not found create a
|
|||
|
|
temporary certificate object
|
|||
|
|
|
|||
|
|
Make the end certificate object the current certificate object and until
|
|||
|
|
there are no more current objects do the following:
|
|||
|
|
|
|||
|
|
Add the current object to the current simple chain
|
|||
|
|
|
|||
|
|
Get the issuer of the current object
|
|||
|
|
|
|||
|
|
|
|||
|
|
|