Shrink ocsp.h to a single free function

Change-Id: I36188ddfa3c0678a1a53fad6b4048cfaa6e9afdb

diff --git a/src/manager/service/ocsp-logic.cpp b/src/manager/service/ocsp-logic.cpp
index 051ba23..df5fc5e 100644 (file)
--- a/src/manager/service/ocsp-logic.cpp
+++ b/src/manager/service/ocsp-logic.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2014 - 2020 Samsung Electronics Co., Ltd All Rights Reserved
+ *  Copyright (c) 2014-2020 Samsung Electronics Co., Ltd. All rights reserved
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -82,7 +82,6 @@ RawBuffer OCSPLogic::ocspCheck(int msgId, const RawBufferVector &rawChain,
                                                           bool allowed)
 {
        CertificateImplVector certChain;
-       OCSPModule ocsp;
        int retCode = CKM_API_SUCCESS;
        int ocspStatus = CKM_API_OCSP_STATUS_INTERNAL_ERROR;
 
@@ -111,7 +110,7 @@ RawBuffer OCSPLogic::ocspCheck(int msgId, const RawBufferVector &rawChain,
        }
 
        if (retCode == CKM_API_SUCCESS)
-               ocspStatus = ocsp.verify(certChain);
+               ocspStatus = ocspVerify(certChain);
 
        return SerializeMessage(msgId, retCode, ocspStatus);
 }

diff --git a/src/manager/service/ocsp.cpp b/src/manager/service/ocsp.cpp
index 0bf71a9..b0ae883 100644 (file)
--- a/src/manager/service/ocsp.cpp
+++ b/src/manager/service/ocsp.cpp
@@ -32,7 +32,6 @@
 #include <string.h>
 #include <stdio.h>
 #include <dpl/log/log.h>
-#include <certificate-impl.h>
 #include <openssl_utils.h>
 #include <ckm/ckm-error.h>
 #include <vconf.h>
@@ -76,74 +75,7 @@ void BIO_write_and_free(BIO *bio)
        BIO_free_all(bio);
 }
 
-} // namespace anonymous
-
-OCSPModule::OCSPModule()
-{
-       // Do nothing.
-}
-
-OCSPModule::~OCSPModule()
-{
-       // Do nothing.
-}
-
-int OCSPModule::verify(const CertificateImplVector &certificateChain)
-{
-       bool unsupported =
-               false; // ocsp is unsupported in certificate in chain (except root CA)
-
-       // create trusted store
-       X509_STACK_PTR trustedCerts = create_x509_stack();
-
-       // skip first 2 certificates
-       for (auto it = certificateChain.cbegin() + 2; it < certificateChain.cend();
-                       it++) {
-               if (it->empty()) {
-                       LogError("Error. Broken certificate chain.");
-                       return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
-               }
-
-               sk_X509_push(trustedCerts.get(), it->getX509());
-       }
-
-       for (int i = 0; i < static_cast<int>(certificateChain.size()) - 1;
-                       i++) {// except root certificate
-               if (certificateChain[i].empty() || certificateChain[i + 1].empty()) {
-                       LogError("Error. Broken certificate chain.");
-                       return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
-               }
-
-               X509 *cert   = certificateChain[i].getX509();
-               X509 *issuer = certificateChain[i + 1].getX509();
-
-               std::string url = certificateChain[i].getOCSPURL();
-
-               if (url.empty()) {
-                       LogError("Certificate in certchain[" << i <<
-                                        "] does not provide OCSP extension.");
-                       unsupported = true;
-                       continue;
-               }
-
-               int result = ocsp_verify(cert, issuer, trustedCerts.get(), url);
-               // remove first element from trustedCerts store
-               sk_X509_delete(trustedCerts.get(), 0);
-
-               if (result != CKM_API_OCSP_STATUS_GOOD) {
-                       LogError("Fail to OCSP certification check. Errorcode=[" << result <<
-                                        "], on certChain[" << i << "]");
-                       return result;
-               }
-       }
-
-       if (unsupported)
-               return CKM_API_OCSP_STATUS_UNSUPPORTED;
-
-       return CKM_API_OCSP_STATUS_GOOD;
-}
-
-int OCSPModule::ocsp_verify(X509 *cert, X509 *issuer,
+int ocspDoVerify(X509 *cert, X509 *issuer,
                                                        STACK_OF(X509) *trustedCerts, const std::string &constUrl)
 {
        OCSP_REQUEST *req = NULL;
@@ -504,5 +436,62 @@ int OCSPModule::ocsp_verify(X509 *cert, X509 *issuer,
        }
 }
 
+} // namespace anonymous
+
+int ocspVerify(const CertificateImplVector &certificateChain)
+{
+       bool unsupported =
+               false; // ocsp is unsupported in certificate in chain (except root CA)
+
+       // create trusted store
+       X509_STACK_PTR trustedCerts = create_x509_stack();
+
+       // skip first 2 certificates
+       for (auto it = certificateChain.cbegin() + 2; it < certificateChain.cend();
+                       it++) {
+               if (it->empty()) {
+                       LogError("Error. Broken certificate chain.");
+                       return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
+               }
+
+               sk_X509_push(trustedCerts.get(), it->getX509());
+       }
+
+       for (int i = 0; i < static_cast<int>(certificateChain.size()) - 1;
+                       i++) {// except root certificate
+               if (certificateChain[i].empty() || certificateChain[i + 1].empty()) {
+                       LogError("Error. Broken certificate chain.");
+                       return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
+               }
+
+               X509 *cert   = certificateChain[i].getX509();
+               X509 *issuer = certificateChain[i + 1].getX509();
+
+               std::string url = certificateChain[i].getOCSPURL();
+
+               if (url.empty()) {
+                       LogError("Certificate in certchain[" << i <<
+                                        "] does not provide OCSP extension.");
+                       unsupported = true;
+                       continue;
+               }
+
+               int result = ocspDoVerify(cert, issuer, trustedCerts.get(), url);
+               // remove first element from trustedCerts store
+               sk_X509_delete(trustedCerts.get(), 0);
+
+               if (result != CKM_API_OCSP_STATUS_GOOD) {
+                       LogError("Fail to OCSP certification check. Errorcode=[" << result <<
+                                        "], on certChain[" << i << "]");
+                       return result;
+               }
+       }
+
+       if (unsupported)
+               return CKM_API_OCSP_STATUS_UNSUPPORTED;
+
+       return CKM_API_OCSP_STATUS_GOOD;
+}
+
 } // namespace CKM
 

diff --git a/src/manager/service/ocsp.h b/src/manager/service/ocsp.h
index e04b28c..8766ef5 100644 (file)
--- a/src/manager/service/ocsp.h
+++ b/src/manager/service/ocsp.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2014 Samsung Electronics Co.
+ *  Copyright (c) 2014-2020 Samsung Electronics Co., Ltd. All rights reserved
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -21,26 +21,13 @@
  */
 #pragma once
 
-#include <openssl/x509v3.h>
-#include <ckm/ckm-type.h>
 #include <certificate-impl.h>
-#include <dpl/exception.h>
 
 namespace CKM {
 
-class OCSPModule {
-public:
-       OCSPModule();
-       virtual ~OCSPModule();
-
-       // all error code from project will be defined in public client api
-       // OK, UNKNOWN, REVOKED, NO_NETWORK, TIMEOUT
-       int verify(const CertificateImplVector &certificateChain);
-
-private:
-       int ocsp_verify(X509 *cert, X509 *issuer, STACK_OF(X509) *trustedCerts,
-                                       const std::string &url);
-};
+// all error code from project will be defined in public client api
+// OK, UNKNOWN, REVOKED, NO_NETWORK, TIMEOUT
+int ocspVerify(const CertificateImplVector &certificateChain);
 
 } // namespace CKM