SUPPORT-8941. Добавлено получение названия и типа провайдера из конфигурационного файла (проверка ЭП маркера доступа)
This commit is contained in:
alashkova
parent
2517eb1a34
commit
051b555c61
5 changed files with 42 additions and 25 deletions
|
|
@ -26,6 +26,10 @@ static const char* ACCEPTABLE_CONTENT_TYPE = "text/plain";
|
|||
typedef struct verify_service_s {
|
||||
const verify_conf_t *conf;
|
||||
|
||||
cryptopro_context_t cryptopro_ctx;
|
||||
|
||||
timer_context_t timer_ctx;
|
||||
|
||||
} verify_service_t;
|
||||
|
||||
|
||||
|
|
@ -41,7 +45,7 @@ typedef struct fcgi_verify_request_s {
|
|||
static fcgi_request_handler_pt fcgi_request_finalize_handler(fcgi_handler_status_t status);
|
||||
static void fcgi_verify_request_clear(fcgi_verify_request_t *req_info);
|
||||
static fcgi_handler_status_t verify_jwt_sign(fcgi_verify_request_t* req_info,
|
||||
const verify_service_t *ctx);
|
||||
verify_service_t *ctx);
|
||||
|
||||
|
||||
int
|
||||
|
|
@ -102,7 +106,7 @@ verify_conf_clear(verify_conf_t *conf)
|
|||
}
|
||||
|
||||
HVerify
|
||||
verify_service_create(const verify_conf_t *conf)
|
||||
verify_service_create(const verify_conf_t *conf, const main_conf_t *main_conf)
|
||||
{
|
||||
LOG_TRACE("verify_service_create enter");
|
||||
|
||||
|
|
@ -114,6 +118,15 @@ verify_service_create(const verify_conf_t *conf)
|
|||
|
||||
hverify->conf = conf;
|
||||
|
||||
init_timers(&hverify->timer_ctx);
|
||||
|
||||
cryptopro_context_set(&hverify->cryptopro_ctx,
|
||||
NULL,
|
||||
NULL,
|
||||
main_conf->cp_name,
|
||||
main_conf->cp_type,
|
||||
&hverify->timer_ctx);
|
||||
|
||||
LOG_TRACE("verify_service_create exit");
|
||||
return (HVerify)hverify;
|
||||
|
||||
|
|
@ -246,9 +259,9 @@ fcgi_verify_request_clear(fcgi_verify_request_t *req_info)
|
|||
}
|
||||
|
||||
static int
|
||||
verify_sign_using_thumbprint_list(const string_list_t* thumbprint_list, const str_t* alg,
|
||||
const str_t* header_payload, const str_t* sign,
|
||||
bool* is_verified, char** verify_error)
|
||||
verify_sign_using_thumbprint_list(cryptopro_context_t *ctx, const string_list_t* thumbprint_list,
|
||||
const str_t* alg, const str_t* header_payload,
|
||||
const str_t* sign, bool* is_verified, char** verify_error)
|
||||
{
|
||||
int rc = -1;
|
||||
|
||||
|
|
@ -263,7 +276,9 @@ verify_sign_using_thumbprint_list(const string_list_t* thumbprint_list, const st
|
|||
|
||||
LOG_DEBUG("Try to verify jwt using cert with thumbprint '%s'...", cert_thumbprint);
|
||||
|
||||
rc = cryptopro_verify(&thumbprint, alg, header_payload, sign, is_verified, verify_error);
|
||||
ctx->cert_thumbprint = &thumbprint;
|
||||
|
||||
rc = cryptopro_verify(ctx, alg, header_payload, sign, is_verified, verify_error);
|
||||
if (rc) {
|
||||
LOG_ERROR("cryptopro_verify() failed for cert with thumbprint '%s'", cert_thumbprint);
|
||||
}
|
||||
|
|
@ -282,7 +297,7 @@ verify_sign_using_thumbprint_list(const string_list_t* thumbprint_list, const st
|
|||
}
|
||||
|
||||
static fcgi_handler_status_t
|
||||
verify_jwt_sign(fcgi_verify_request_t* req_info, const verify_service_t *ctx)
|
||||
verify_jwt_sign(fcgi_verify_request_t* req_info, verify_service_t *ctx)
|
||||
{
|
||||
LOG_TRACE("verify_jwt_sign enter");
|
||||
|
||||
|
|
@ -329,7 +344,8 @@ verify_jwt_sign(fcgi_verify_request_t* req_info, const verify_service_t *ctx)
|
|||
goto error;
|
||||
}
|
||||
|
||||
if (verify_sign_using_thumbprint_list(&ctx->conf->esia_cert_thumbprint_list, &alg,
|
||||
if (verify_sign_using_thumbprint_list(&ctx->cryptopro_ctx,
|
||||
&ctx->conf->esia_cert_thumbprint_list, &alg,
|
||||
&header_payload, &sign, &is_verified,
|
||||
&req_info->verify_error)) {
|
||||
goto error;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
#ifndef SERVICE_VERIFY_H_INCLUDED
|
||||
#define SERVICE_VERIFY_H_INCLUDED
|
||||
|
||||
#include "main_conf.h"
|
||||
#include "fcgisrv/fcgi_server.h"
|
||||
|
||||
#include "utils/conf_file_context.h"
|
||||
|
|
@ -18,7 +19,7 @@ typedef struct verify_conf_s {
|
|||
int verify_conf_load(verify_conf_t *conf, const conf_file_context_t conf_file);
|
||||
void verify_conf_clear(verify_conf_t *conf);
|
||||
|
||||
HVerify verify_service_create(const verify_conf_t *conf);
|
||||
HVerify verify_service_create(const verify_conf_t *conf, const main_conf_t *main_conf);
|
||||
void verify_service_free(HVerify hverify);
|
||||
|
||||
fcgi_handler_status_t fcgi_verify_handler(FCGX_Request* request, void* ctx);
|
||||
|
|
|
|||
|
|
@ -251,7 +251,7 @@ init_services(service_manager_t* services, const service_manager_conf_t* service
|
|||
}
|
||||
|
||||
/* verify service */
|
||||
services->hverify = verify_service_create(&services_cf->verify_cf);
|
||||
services->hverify = verify_service_create(&services_cf->verify_cf, &services_cf->main_cf);
|
||||
if (services->hverify == NULL) {
|
||||
goto error;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -673,7 +673,7 @@ get_verify_error(char** verify_error)
|
|||
}
|
||||
|
||||
int
|
||||
cryptopro_verify(const str_t* cert_thumbprint, const str_t* alg, const str_t* data,
|
||||
cryptopro_verify(cryptopro_context_t *ctx, const str_t* alg, const str_t* data,
|
||||
const str_t* sign, bool* is_verified, char** verify_error)
|
||||
{
|
||||
int rc = -1;
|
||||
|
|
@ -684,13 +684,10 @@ cryptopro_verify(const str_t* cert_thumbprint, const str_t* alg, const str_t* da
|
|||
HCRYPTKEY hPubKey = 0;
|
||||
str_t sign_reversed = str_t_null;
|
||||
ALG_ID alg_id;
|
||||
timer_context_t timer_ctx = {};
|
||||
|
||||
init_timers(&timer_ctx);
|
||||
|
||||
LOG_TRACE("cryptopro_verify enter");
|
||||
|
||||
timer_on_cryptopro_verify_enter(&timer_ctx);
|
||||
timer_on_cryptopro_verify_enter(ctx->timer_ctx);
|
||||
|
||||
*is_verified = false;
|
||||
|
||||
|
|
@ -707,22 +704,25 @@ cryptopro_verify(const str_t* cert_thumbprint, const str_t* alg, const str_t* da
|
|||
goto exit;
|
||||
}
|
||||
|
||||
certificate = get_cert_by_thumbprint(hStoreHandle, cert_thumbprint);
|
||||
certificate = get_cert_by_thumbprint(hStoreHandle, ctx->cert_thumbprint);
|
||||
if (certificate == NULL) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
timer_on_verify_cert_chain_enter(&timer_ctx);
|
||||
timer_on_verify_cert_chain_enter(ctx->timer_ctx);
|
||||
|
||||
if (!verify_cert_chain(certificate, &timer_ctx)) {
|
||||
if (!verify_cert_chain(certificate, ctx->timer_ctx)) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
timer_on_verify_cert_chain_exit(&timer_ctx);
|
||||
timer_on_verify_cert_chain_exit(ctx->timer_ctx);
|
||||
|
||||
if (!cp_function_list.CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_GOST_2012_256,
|
||||
LOG_DEBUG("provider: '%s', prov_type: %u", ctx->provider, ctx->prov_type);
|
||||
|
||||
if (!cp_function_list.CryptAcquireContext(&hCryptProv, NULL, ctx->provider, ctx->prov_type,
|
||||
CRYPT_VERIFYCONTEXT)) {
|
||||
LOG_ERROR("CryptAcquireContext() failed");
|
||||
LOG_ERROR("CryptAcquireContext() failed. provider: '%s', prov_type: %u",
|
||||
ctx->provider, ctx->prov_type);
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -757,7 +757,7 @@ cryptopro_verify(const str_t* cert_thumbprint, const str_t* alg, const str_t* da
|
|||
goto exit;
|
||||
}
|
||||
LOG_WARN("%s, cert_thumbprint: %.*s", *verify_error,
|
||||
(int) cert_thumbprint->len, cert_thumbprint->data);
|
||||
(int) ctx->cert_thumbprint->len, ctx->cert_thumbprint->data);
|
||||
}
|
||||
|
||||
exit:
|
||||
|
|
@ -802,8 +802,8 @@ exit:
|
|||
cp_function_list.GetLastError());
|
||||
}
|
||||
|
||||
timer_on_cryptopro_verify_exit(&timer_ctx);
|
||||
timer_log_verify(&timer_ctx);
|
||||
timer_on_cryptopro_verify_exit(ctx->timer_ctx);
|
||||
timer_log_verify(ctx->timer_ctx);
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ void close_signer_cert(cryptopro_context_t *ctx);
|
|||
|
||||
int cryptopro_sign(const cryptopro_context_t *ctx, const str_t *data, /*out*/ str_t *sign);
|
||||
|
||||
int cryptopro_verify(const str_t* cert_thumbprint, const str_t* alg, const str_t *data,
|
||||
int cryptopro_verify(cryptopro_context_t *сtx, const str_t* alg, const str_t *data,
|
||||
const str_t *sign, bool* is_verified, char** verify_error);
|
||||
|
||||
int cryptopro_gen_random(const cryptopro_context_t *ctx, unsigned char* data, size_t len);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue