key-chain.hpp

/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
#ifndef NDN_KEY_CHAIN_HPP
#define NDN_KEY_CHAIN_HPP

#include <map>
#include <stdexcept>
#include "../data.hpp"
#include "../interest.hpp"
#include "../face.hpp"
#include "identity/identity-manager.hpp"
#include "policy/validation-request.hpp"
#include "pib/pib.hpp"
#include "pib/pib.hpp"
#include "tpm/tpm.hpp"
#include "signing-info.hpp"
#include "key-params.hpp"
#include "safe-bag.hpp"

namespace ndn {

class PolicyManager;
class ConfigFile;

class KeyChain {
public:
  class Error : public std::runtime_error
  {
  public:
    Error(const std::string& what)
    : std::runtime_error(what)
    {
    }
  };

  class InvalidSigningInfoError : public Error
  {
  public:
    InvalidSigningInfoError(const std::string& what)
    : Error(what)
    {
    }
  };

  class LocatorMismatchError : public Error
  {
  public:
    LocatorMismatchError(const std::string& what)
    : Error(what)
    {
    }
  };

  typedef func_lib::function<ptr_lib::shared_ptr<PibImpl>
    (const std::string& location)> MakePibImpl;

  typedef func_lib::function<ptr_lib::shared_ptr<TpmBackEnd>
    (const std::string& location)> MakeTpmBackEnd;

  KeyChain
    (const std::string& pibLocator, const std::string& tpmLocator,
     bool allowReset = false);

  KeyChain
    (const ptr_lib::shared_ptr<PibImpl>& pibImpl,
     const ptr_lib::shared_ptr<TpmBackEnd>& tpmBackEnd,
     const ptr_lib::shared_ptr<PolicyManager>& policyManager =
       ptr_lib::shared_ptr<PolicyManager>());

  KeyChain
    (const ptr_lib::shared_ptr<IdentityManager>& identityManager,
     const ptr_lib::shared_ptr<PolicyManager>& policyManager);

  KeyChain(const ptr_lib::shared_ptr<IdentityManager>& identityManager);

  KeyChain();

  Pib&
  getPib()
  {
    if (isSecurityV1_)
      throw Error("getPib is not supported for security v1");

    return *pib_;
  }

  Tpm&
  getTpm()
  {
    if (isSecurityV1_)
      throw Error("getTpm is not supported for security v1");

    return *tpm_;
  }

  bool
  getIsSecurityV1() const { return isSecurityV1_; }

  // Identity management

  ptr_lib::shared_ptr<PibIdentity>
  createIdentityV2
    (const Name& identityName, const KeyParams& params = getDefaultKeyParams());

  void
  deleteIdentity(PibIdentity& identity);

  void
  setDefaultIdentity(PibIdentity& identity);

  // Key management

  ptr_lib::shared_ptr<PibKey>
  createKey
    (PibIdentity& identity, const KeyParams& params = getDefaultKeyParams());

  void
  deleteKey(PibIdentity& identity, PibKey& key);

  void
  setDefaultKey(PibIdentity& identity, PibKey& key);

  // Certificate management

  void
  addCertificate(PibKey& key, const CertificateV2& certificate);

  void
  deleteCertificate(PibKey& key, const Name& certificateName);

  void
  setDefaultCertificate(PibKey& key, const CertificateV2& certificate);

  // Signing

  void
  sign(Data& data, const SigningInfo& params,
       WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  void
  sign(Data& data, WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (isSecurityV1_) {
      identityManager_->signByCertificate
        (data, prepareDefaultCertificateName(), wireFormat);
      return;
    }

    sign(data, getDefaultSigningInfo(), wireFormat);
  }

  void
  sign(Interest& interest, const SigningInfo& params,
       WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  void
  sign(Interest& interest,
       WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (isSecurityV1_) {
      identityManager_->signInterestByCertificate
        (interest, prepareDefaultCertificateName(), wireFormat);
      return;
    }

    sign(interest, getDefaultSigningInfo(), wireFormat);
  }

  Blob
  sign(const uint8_t* buffer, size_t bufferLength,
       const SigningInfo& params = getDefaultSigningInfo());

  ptr_lib::shared_ptr<CertificateV2>
  selfSign
    (ptr_lib::shared_ptr<PibKey>& key,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  // Import and export

  // TODO: exportSafeBag

  void
  importSafeBag
    (const SafeBag& safeBag, const uint8_t* password = 0,
     size_t passwordLength = 0);

  // PIB & TPM backend registry

  static void
  registerPibBackend(const std::string& scheme, const MakePibImpl& makePibImpl)
  {
    getPibFactories()[scheme] = makePibImpl;
  }

  static void
  registerTpmBackend
    (const std::string& scheme, const MakeTpmBackEnd& makeTpmBackEnd)
  {
    getTpmFactories()[scheme] = makeTpmBackEnd;
  }

  // Security v1 methods

  /*****************************************
   *          Identity Management          *
   *****************************************/

  Name
  createIdentityAndCertificate
    (const Name& identityName, const KeyParams& params = getDefaultKeyParams())
  {
    if (!isSecurityV1_) {
      ptr_lib::shared_ptr<PibIdentity> identity = createIdentityV2
        (identityName, params);
      return identity->getDefaultKey()->getDefaultCertificate()->getName();
    }

    return identityManager_->createIdentityAndCertificate(identityName, params);
  }

  Name
  DEPRECATED_IN_NDN_CPP createIdentity
    (const Name& identityName, const KeyParams& params = getDefaultKeyParams())
  {
    return IdentityCertificate::certificateNameToPublicKeyName
      (createIdentityAndCertificate(identityName, params));
  }

  void
  deleteIdentity(const Name& identityName)
  {
    if (!isSecurityV1_) {
      try {
        deleteIdentity(*pib_->getIdentity(identityName));
      } catch (const Pib::Error& ex) {
      }
      return;
    }

    identityManager_->deleteIdentity(identityName);
  }

  Name
  getDefaultIdentity()
  {
    if (!isSecurityV1_)
      return pib_->getDefaultIdentity()->getName();

    return identityManager_->getDefaultIdentity();
  }

  Name
  getDefaultCertificateName()
  {
    if (!isSecurityV1_)
      return pib_->getDefaultIdentity()->getDefaultKey()->getDefaultCertificate()
        ->getName();

    return identityManager_->getDefaultCertificateName();
  }

  Name
  generateRSAKeyPair(const Name& identityName, bool isKsk = false, int keySize = 2048)
  {
    if (!isSecurityV1_)
      throw Error
        ("generateRSAKeyPair is not supported for security v2. Use createIdentityV2.");

    return identityManager_->generateRSAKeyPair(identityName, isKsk, keySize);
  }

  Name
  generateEcdsaKeyPair(const Name& identityName, bool isKsk = false, int keySize = 256)
  {
    if (!isSecurityV1_)
      throw Error
        ("generateEcdsaKeyPair is not supported for security v2. Use createIdentityV2.");

    return identityManager_->generateEcdsaKeyPair(identityName, isKsk, keySize);
  }

  void
  setDefaultKeyForIdentity(const Name& keyName, const Name& identityNameCheck = Name())
  {
    if (!isSecurityV1_)
      throw Error
        ("setDefaultKeyForIdentity is not supported for security v2. Use getPib() methods.");

    return identityManager_->setDefaultKeyForIdentity(keyName, identityNameCheck);
  }

  Name
  generateRSAKeyPairAsDefault(const Name& identityName, bool isKsk = false, int keySize = 2048)
  {
    if (!isSecurityV1_)
      throw Error
        ("generateRSAKeyPairAsDefault is not supported for security v2. Use createIdentityV2.");

    return identityManager_->generateRSAKeyPairAsDefault(identityName, isKsk, keySize);
  }

  Name
  generateEcdsaKeyPairAsDefault(const Name& identityName, bool isKsk = false, int keySize = 256)
  {
    if (!isSecurityV1_)
      throw Error
        ("generateEcdsaKeyPairAsDefault is not supported for security v2. Use createIdentityV2.");

    return identityManager_->generateEcdsaKeyPairAsDefault(identityName, isKsk, keySize);
  }

  Blob
  createSigningRequest(const Name& keyName)
  {
    if (!isSecurityV1_)
      return pib_->getIdentity(PibKey::extractIdentityFromKeyName(keyName))
        ->getKey(keyName)->getPublicKey();

    return identityManager_->getPublicKey(keyName)->getKeyDer();
  }

  void
  installIdentityCertificate(const IdentityCertificate& certificate)
  {
    if (!isSecurityV1_)
      throw Error
        ("installIdentityCertificate is not supported for security v2. Use getPib() methods.");

    identityManager_->addCertificate(certificate);
  }

  void
  setDefaultCertificateForKey(const IdentityCertificate& certificate)
  {
    if (!isSecurityV1_)
      throw Error
        ("setDefaultCertificateForKey is not supported for security v2. Use getPib() methods.");

    identityManager_->setDefaultCertificateForKey(certificate);
  }

  ptr_lib::shared_ptr<IdentityCertificate>
  getCertificate(const Name& certificateName)
  {
    if (!isSecurityV1_)
      throw Error
        ("getCertificate is not supported for security v2. Use getPib() methods.");

    return identityManager_->getCertificate(certificateName);
  }

  ptr_lib::shared_ptr<IdentityCertificate>
  DEPRECATED_IN_NDN_CPP getIdentityCertificate(const Name& certificateName)
  {
    if (!isSecurityV1_)
      throw Error
        ("getIdentityCertificate is not supported for security v2. Use getPib() methods.");

    return identityManager_->getCertificate(certificateName);
  }

  void
  revokeKey(const Name & keyName)
  {
    //TODO: Implement
  }

  void
  revokeCertificate(const Name & certificateName)
  {
    //TODO: Implement
  }

  const ptr_lib::shared_ptr<IdentityManager>&
  getIdentityManager()
  {
    if (!isSecurityV1_)
      throw Error("getIdentityManager is not supported for security v2");

    return identityManager_;
  }

  /*****************************************
   *           Policy Management           *
   *****************************************/

  const ptr_lib::shared_ptr<PolicyManager>&
  getPolicyManager() { return policyManager_; }

  /*****************************************
   *              Sign/Verify              *
   *****************************************/

  void
  sign(Data& data, const Name& certificateName,
       WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (!isSecurityV1_) {
      SigningInfo signingInfo;
      signingInfo.setSigningCertificateName(certificateName);
      sign(data, signingInfo, wireFormat);
      return;
    }

    identityManager_->signByCertificate(data, certificateName, wireFormat);
  }

  void
  sign
    (Interest& interest, const Name& certificateName,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (!isSecurityV1_) {
      SigningInfo signingInfo;
      signingInfo.setSigningCertificateName(certificateName);
      sign(interest, signingInfo, wireFormat);
      return;
    }

    identityManager_->signInterestByCertificate
      (interest, certificateName, wireFormat);
  }

  ptr_lib::shared_ptr<Signature>
  sign(const uint8_t* buffer, size_t bufferLength, const Name& certificateName)
  {
    if (!isSecurityV1_)
      throw Error
        ("sign(buffer, certificateName) is not supported for security v2. Use sign with SigningInfo.");

    return identityManager_->signByCertificate
      (buffer, bufferLength, certificateName);
  }

  ptr_lib::shared_ptr<Signature>
  sign(const std::vector<uint8_t>& buffer, const Name& certificateName)
  {
    return sign(&buffer[0], buffer.size(), certificateName);
  }

  void
  signByIdentity(Data& data, const Name& identityName = Name(), WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  ptr_lib::shared_ptr<Signature>
  signByIdentity(const uint8_t* buffer, size_t bufferLength, const Name& identityName);

  ptr_lib::shared_ptr<Signature>
  signByIdentity(const std::vector<uint8_t>& buffer, const Name& identityName)
  {
    return signByIdentity(&buffer[0], buffer.size(), identityName);
  }

  void
  signWithSha256
    (Data& data, WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (!isSecurityV1_) {
      SigningInfo signingInfo;
      signingInfo.setSha256Signing();
      sign(data, signingInfo, wireFormat);
      return;
    }

    identityManager_->signWithSha256(data, wireFormat);
  }

  void
  signWithSha256
    (Interest& interest, WireFormat& wireFormat = *WireFormat::getDefaultWireFormat())
  {
    if (!isSecurityV1_) {
      SigningInfo signingInfo;
      signingInfo.setSha256Signing();
      sign(interest, signingInfo, wireFormat);
      return;
    }

    identityManager_->signInterestWithSha256(interest, wireFormat);
  }

  void
  verifyData
    (const ptr_lib::shared_ptr<Data>& data, const OnVerified& onVerified,
     const OnDataValidationFailed& onValidationFailed, int stepCount = 0);

  void
  DEPRECATED_IN_NDN_CPP verifyData
    (const ptr_lib::shared_ptr<Data>& data, const OnVerified& onVerified,
     const OnVerifyFailed& onVerifyFailed, int stepCount = 0);

  void
  verifyInterest
    (const ptr_lib::shared_ptr<Interest>& interest,
     const OnVerifiedInterest& onVerified,
     const OnInterestValidationFailed& onValidationFailed, int stepCount = 0,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  void
  DEPRECATED_IN_NDN_CPP verifyInterest
    (const ptr_lib::shared_ptr<Interest>& interest,
     const OnVerifiedInterest& onVerified,
     const OnVerifyInterestFailed& onVerifyFailed, int stepCount = 0,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  void
  setFace(Face* face) { face_ = face; }

  static void
  signWithHmacWithSha256
    (Data& data, const Blob& key,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  static void
  signWithHmacWithSha256
    (Interest& interest, const Blob& key, const Name& keyName,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  static bool
  verifyDataWithHmacWithSha256
    (const Data& data, const Blob& key,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  static bool
  verifyInterestWithHmacWithSha256
    (const Interest& interest, const Blob& key,
     WireFormat& wireFormat = *WireFormat::getDefaultWireFormat());

  static const KeyParams&
  getDefaultKeyParams();

  static const RsaKeyParams DEPRECATED_IN_NDN_CPP DEFAULT_KEY_PARAMS;

private:
  friend class CommandInterestSigner;

  void
  construct
    (const std::string& pibLocator, const std::string& tpmLocator,
     bool allowReset);

  static std::map<std::string, MakePibImpl>&
  getPibFactories();

  static std::map<std::string, MakeTpmBackEnd>&
  getTpmFactories();

  static void
  parseLocatorUri
    (const std::string& uri, std::string& scheme, std::string& location);

  static void
  parseAndCheckPibLocator
    (const std::string& pibLocator, std::string& pibScheme,
     std::string& pibLocation);

  static void
  parseAndCheckTpmLocator
    (const std::string& tpmLocator, std::string& tpmScheme,
     std::string& tpmLocation);

  static std::string
  getDefaultPibScheme();

  static std::string
  getDefaultTpmScheme();

  static ptr_lib::shared_ptr<Pib>
  createPib(const std::string& pibLocator);

  static ptr_lib::shared_ptr<Tpm>
  createTpm(const std::string& tpmLocator);

  static std::string
  getDefaultPibLocator(ConfigFile& config);

  static std::string
  getDefaultTpmLocator(ConfigFile& config);

  ptr_lib::shared_ptr<Signature>
  prepareSignatureInfo(const SigningInfo& params, Name& keyName);

  Blob
  sign(const uint8_t* buffer, size_t bufferLength, const Name& keyName,
       DigestAlgorithm digestAlgorithm) const;

  static const SigningInfo&
  getDefaultSigningInfo();

  // Private security v1 methods

  void
  onCertificateData
    (const ptr_lib::shared_ptr<const Interest> &interest, const ptr_lib::shared_ptr<Data> &data, ptr_lib::shared_ptr<ValidationRequest> nextStep);

  void
  onCertificateInterestTimeout
    (const ptr_lib::shared_ptr<const Interest> &interest, int retry,
     const OnDataValidationFailed& onValidationFailed,
     const ptr_lib::shared_ptr<Data> &data,
     ptr_lib::shared_ptr<ValidationRequest> nextStep);

  void
  onCertificateInterestTimeoutForVerifyInterest
    (const ptr_lib::shared_ptr<const Interest> &interest, int retry,
     const OnInterestValidationFailed& onValidationFailed,
     const ptr_lib::shared_ptr<Interest>& originalInterest,
     ptr_lib::shared_ptr<ValidationRequest> nextStep);

  Name
  prepareDefaultCertificateName();

  void
  setDefaultCertificate();

  bool isSecurityV1_;
  ptr_lib::shared_ptr<IdentityManager> identityManager_; // for security v1
  ptr_lib::shared_ptr<PolicyManager> policyManager_;     // for security v1
  Face* face_; // for security v1

  ptr_lib::shared_ptr<Pib> pib_;
  ptr_lib::shared_ptr<Tpm> tpm_;

  static std::string* defaultPibLocator_;
  static std::string* defaultTpmLocator_;
  static std::map<std::string, MakePibImpl>* pibFactories_;
  static std::map<std::string, MakeTpmBackEnd>* tpmFactories_;
  static SigningInfo* defaultSigningInfo_;
  static KeyParams* defaultKeyParams_;
};

}

#endif