Add certificate domain: TIZEN_REVOKED

Change-Id: Id6abd58be078c0bc6cbe2c70ea8ffc5e63b9dd68
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2e5bdd4..7cae406 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -40,6 +40,7 @@ SET(CA_CERTS_PATH ${TZ_SYS_RO_SHARE}/ca-certificates)
 ADD_DEFINITIONS("-DTZ_SYS_CA_CERTS_TIZEN=\"${CA_CERTS_PATH}/tizen\"")
 ADD_DEFINITIONS("-DFINGERPRINT_LIST_PATH=\"${CA_CERTS_PATH}/fingerprint/fingerprint_list.xml\"")
 ADD_DEFINITIONS("-DFINGERPRINT_LIST_EXT_PATH=\"${CA_CERTS_PATH}/fingerprint/fingerprint_list_ext.xml\"")
+ADD_DEFINITIONS("-DFINGERPRINT_LIST_RW_PATH=\"${FINGERPRINT_LIST_RW_PATH}\"")
 ADD_DEFINITIONS("-DFINGERPRINT_LIST_SCHEMA_PATH=\"${CA_CERTS_PATH}/fingerprint/fingerprint_list.xsd\"")
 
 CONFIGURE_FILE(cert-svc-vcore.pc.in cert-svc-vcore.pc @ONLY)

diff --git a/packaging/cert-svc.spec b/packaging/cert-svc.spec
index fa7870b..fc7a937 100644 (file)
--- a/packaging/cert-svc.spec
+++ b/packaging/cert-svc.spec
@@ -24,6 +24,7 @@ BuildRequires: pkgconfig(libsystemd-journal)
 BuildRequires: pkgconfig(sqlite3)
 BuildRequires: ca-certificates
 BuildRequires: ca-certificates-devel
+BuildRequires: ca-certificates-tizen-devel
 Requires: ca-certificates
 Requires: ca-certificates-tizen
 Requires: security-config
@@ -97,6 +98,7 @@ export FFLAGS="$FFLAGS -DTIZEN_EMULATOR_MODE"
          -DTZ_SYS_CA_CERTS=%TZ_SYS_CA_CERTS \
          -DTZ_SYS_CA_CERTS_ORIG=%TZ_SYS_CA_CERTS_ORIG \
          -DTZ_SYS_CA_BUNDLE=%TZ_SYS_CA_BUNDLE \
+         -DFINGERPRINT_LIST_RW_PATH=%TZ_SYS_REVOKED_CERTS_FINGERPRINTS_RUNTIME \
          -DCERT_SVC_PATH=%CERT_SVC_PATH \
          -DCERT_SVC_RO_PATH=%CERT_SVC_RO_PATH \
          -DCERT_SVC_DB=%CERT_SVC_DB \

diff --git a/vcore/dpl/core/src/assert.cpp b/vcore/dpl/core/src/assert.cpp
index d0c935f..6e02192 100644 (file)
--- a/vcore/dpl/core/src/assert.cpp
+++ b/vcore/dpl/core/src/assert.cpp
@@ -32,22 +32,16 @@ void AssertProc(const char *condition,
                                int line,
                                const char *function)
 {
-#define INTERNAL_LOG(message)          \
-       do {                                   \
-               std::ostringstream platformLog;    \
-               platformLog << message;            \
-               LogDebug("" << platformLog.str()); \
-       } while (0)
        // Try to log failed assertion to log system
        Try {
-               INTERNAL_LOG("########################################################################");
-               INTERNAL_LOG("###                      DPL assertion failed!                       ###");
-               INTERNAL_LOG("########################################################################");
-               INTERNAL_LOG("### Condition: " << condition);
-               INTERNAL_LOG("### File: " << file);
-               INTERNAL_LOG("### Line: " << line);
-               INTERNAL_LOG("### Function: " << function);
-               INTERNAL_LOG("########################################################################");
+               LogError("########################################################################");
+               LogError("###                      DPL assertion failed!                       ###");
+               LogError("########################################################################");
+               LogError("### Condition: " << condition);
+               LogError("### File: " << file);
+               LogError("### Line: " << line);
+               LogError("### Function: " << function);
+               LogError("########################################################################");
        } catch (Exception) {
                // Just ignore possible double errors
        }

diff --git a/vcore/vcore/CertStoreType.cpp b/vcore/vcore/CertStoreType.cpp
index 84e83c2..dbabf21 100644 (file)
--- a/vcore/vcore/CertStoreType.cpp
+++ b/vcore/vcore/CertStoreType.cpp
@@ -78,6 +78,9 @@ std::string Set::typeToString() const
        if (m_certificateStorage & TIZEN_STORE)
                ret += "TIZEN_STORE ";
 
+       if (m_certificateStorage & TIZEN_REVOKED)
+               ret += "TIZEN_REVOKED ";
+
        if (m_certificateStorage & VIS_PUBLIC)
                ret += "VIS_PUBLIC ";
 

diff --git a/vcore/vcore/CertStoreType.h b/vcore/vcore/CertStoreType.h
index 7a36bb0..ea01f7b 100644 (file)
--- a/vcore/vcore/CertStoreType.h
+++ b/vcore/vcore/CertStoreType.h
@@ -36,6 +36,7 @@ const Type TIZEN_DEVELOPER = 1;
 const Type TIZEN_TEST = 1 << 1;
 const Type TIZEN_VERIFY = 1 << 2;
 const Type TIZEN_STORE = 1 << 3;
+const Type TIZEN_REVOKED = 1 << 4;
 // RootCA's visibility level : public
 const Type VIS_PUBLIC = 1 << 6;
 // RootCA's visibility level : partner

diff --git a/vcore/vcore/CertificateConfigReader.cpp b/vcore/vcore/CertificateConfigReader.cpp
index 4a67369..856641f 100644 (file)
--- a/vcore/vcore/CertificateConfigReader.cpp
+++ b/vcore/vcore/CertificateConfigReader.cpp
@@ -38,6 +38,7 @@ const std::string TOKEN_VALUE_TIZEN_DEVELOPER = "tizen-developer";
 const std::string TOKEN_VALUE_TIZEN_TEST = "tizen-test";
 const std::string TOKEN_VALUE_TIZEN_VERIFY = "tizen-verify";
 const std::string TOKEN_VALUE_TIZEN_STORE = "tizen-store";
+const std::string TOKEN_VALUE_TIZEN_REVOKED = "tizen-revoked";
 const std::string TOKEN_VALUE_VISIBILITY_PUBLIC = "tizen-public";
 const std::string TOKEN_VALUE_VISIBILITY_PARTNER = "tizen-partner";
 const std::string TOKEN_VALUE_VISIBILITY_PLATFORM = "tizen-platform";
@@ -122,6 +123,8 @@ void CertificateConfigReader::tokenCertificateDomain(CertificateIdentifier &)
                m_certificateDomain = CertStoreId::TIZEN_VERIFY;
        } else if (name == TOKEN_VALUE_TIZEN_STORE) {
                m_certificateDomain = CertStoreId::TIZEN_STORE;
+       } else if (name == TOKEN_VALUE_TIZEN_REVOKED) {
+               m_certificateDomain = CertStoreId::TIZEN_REVOKED;
        } else if (name == TOKEN_VALUE_VISIBILITY_PUBLIC) {
                m_certificateDomain = CertStoreId::VIS_PUBLIC;
        } else if (name == TOKEN_VALUE_VISIBILITY_PARTNER) {

diff --git a/vcore/vcore/SignatureValidator.cpp b/vcore/vcore/SignatureValidator.cpp
index b5fc25c..1007f95 100644 (file)
--- a/vcore/vcore/SignatureValidator.cpp
+++ b/vcore/vcore/SignatureValidator.cpp
@@ -282,6 +282,15 @@ VCerr SignatureValidator::Impl::preStep(void)
        if (result != E_SIG_NONE)
                return result;
 
+       for (const auto &certptr : m_data.getCertList()) {
+               auto storeIdSet = createCertificateIdentifier().find(certptr);
+               if (!storeIdSet.contains(TIZEN_REVOKED))
+                       continue;
+
+               LogInfo("Revoked certificate: " << certptr->getOneLine());
+               return E_SIG_REVOKED;
+       }
+
        // Get Identifier from fingerprint original, extention file.
        LogDebug("Start to check certificate domain.");
        auto certificatePtr = m_data.getCertList().back();

diff --git a/vcore/vcore/ValidatorFactories.cpp b/vcore/vcore/ValidatorFactories.cpp
index 4318f6b..79c0e1c 100644 (file)
--- a/vcore/vcore/ValidatorFactories.cpp
+++ b/vcore/vcore/ValidatorFactories.cpp
@@ -37,29 +37,34 @@ const CertificateIdentifier &createCertificateIdentifier()
        static CertificateIdentifier certificateIdentifier;
        static bool initialized = false;
 
-       if (!initialized) {
-               std::string file(FINGERPRINT_LIST_PATH);
-               std::string schema(FINGERPRINT_LIST_SCHEMA_PATH);
-               LogDebug("File with fingerprint list is : " << file);
-               LogDebug("File with fingerprint list schema is : " << schema);
-               // Read the fingerprint original list.
-               CertificateConfigReader reader;
-               reader.initialize(file, schema);
-               reader.read(certificateIdentifier);
+       if (initialized)
+               return certificateIdentifier;
 
-               // Check the fingerprint extention list exist.
-               if (std::ifstream(FINGERPRINT_LIST_EXT_PATH)) {
-                       std::string extFile(FINGERPRINT_LIST_EXT_PATH);
-                       LogDebug("Exist fingerprint extention file, add it.");
-                       // Read the fingerprint extention list.
-                       CertificateConfigReader extReader;
-                       extReader.initialize(extFile, schema);
-                       extReader.read(certificateIdentifier);
-               }
+       std::string file(FINGERPRINT_LIST_PATH);
+       std::string schema(FINGERPRINT_LIST_SCHEMA_PATH);
+       LogDebug("File with fingerprint list is : " << file);
+       LogDebug("File with fingerprint list schema is : " << schema);
+       // Read the fingerprint original list.
+       CertificateConfigReader reader;
+       reader.initialize(file, schema);
+       reader.read(certificateIdentifier);
 
-               initialized = true;
+       if (std::ifstream(FINGERPRINT_LIST_EXT_PATH)) {
+               LogInfo(FINGERPRINT_LIST_EXT_PATH << " exist, add it.");
+               CertificateConfigReader exReader;
+               exReader.initialize(FINGERPRINT_LIST_EXT_PATH, schema);
+               exReader.read(certificateIdentifier);
        }
 
+       if (std::ifstream(FINGERPRINT_LIST_RW_PATH)) {
+               LogInfo(FINGERPRINT_LIST_RW_PATH << " exist, add it.");
+               CertificateConfigReader rwReader;
+               rwReader.initialize(FINGERPRINT_LIST_RW_PATH, schema);
+               rwReader.read(certificateIdentifier);
+       }
+
+       initialized = true;
+
        return certificateIdentifier;
 }