From 658ccc3e85487f9f24ff3b5926e60d6cce7f42e0 Mon Sep 17 00:00:00 2001
From: Roxie Linden <roxie@lindenlab.com>
Date: Wed, 7 Apr 2010 11:08:04 -0700
Subject: Re-insert backed out SLE checkin so we can fix it

---
 indra/newview/llsecapi.h | 493 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 493 insertions(+)
 create mode 100644 indra/newview/llsecapi.h

(limited to 'indra/newview/llsecapi.h')

diff --git a/indra/newview/llsecapi.h b/indra/newview/llsecapi.h
new file mode 100644
index 0000000000..5211dc2699
--- /dev/null
+++ b/indra/newview/llsecapi.h
@@ -0,0 +1,493 @@
+/** 
+ * @file llsecapi.h
+ * @brief Security API for services such as certificate handling
+ * secure local storage, etc.
+ *
+ * $LicenseInfo:firstyear=2009&license=viewergpl$
+ * 
+ * Copyright (c) 2009, Linden Research, Inc.
+ * 
+ * Second Life Viewer Source Code
+ * The source code in this file ("Source Code") is provided by Linden Lab
+ * to you under the terms of the GNU General Public License, version 2.0
+ * ("GPL"), unless you have obtained a separate licensing agreement
+ * ("Other License"), formally executed by you and Linden Lab.  Terms of
+ * the GPL can be found in doc/GPL-license.txt in this distribution, or
+ * online at http://secondlife.com/developers/opensource/gplv2
+ * 
+ * There are special exceptions to the terms and conditions of the GPL as
+ * it is applied to this Source Code. View the full text of the exception
+ * in the file doc/FLOSS-exception.txt in this software distribution, or
+ * online at http://secondlife.com/developers/opensource/flossexception
+ * 
+ * By copying, modifying or distributing this software, you acknowledge
+ * that you have read and understood your obligations described above,
+ * and agree to abide by those obligations.
+ * 
+ * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
+ * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
+ * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
+ */
+
+#ifndef LLSECAPI_H
+#define LLSECAPI_H
+#include <vector>
+#include <openssl/x509.h>
+#include <ostream>
+
+#ifdef LL_WINDOWS
+#pragma warning(disable:4250)
+#endif // LL_WINDOWS
+
+// All error handling is via exceptions.
+
+
+#define CERT_SUBJECT_NAME "subject_name"
+#define CERT_ISSUER_NAME "issuer_name"
+#define CERT_NAME_CN "commonName"
+		
+#define CERT_SUBJECT_NAME_STRING "subject_name_string"
+#define CERT_ISSUER_NAME_STRING "issuer_name_string"
+		
+#define CERT_SERIAL_NUMBER "serial_number"
+		
+#define CERT_VALID_FROM "valid_from"
+#define CERT_VALID_TO "valid_to"
+#define CERT_SHA1_DIGEST "sha1_digest"
+#define CERT_MD5_DIGEST "md5_digest"
+#define CERT_HOSTNAME "hostname"
+#define CERT_BASIC_CONSTRAINTS "basicConstraints"
+#define CERT_BASIC_CONSTRAINTS_CA "CA"
+#define CERT_BASIC_CONSTRAINTS_PATHLEN "pathLen"
+
+#define CERT_KEY_USAGE "keyUsage"
+#define CERT_KU_DIGITAL_SIGNATURE    "digitalSignature"
+#define CERT_KU_NON_REPUDIATION      "nonRepudiation"
+#define CERT_KU_KEY_ENCIPHERMENT     "keyEncipherment"
+#define CERT_KU_DATA_ENCIPHERMENT    "dataEncipherment"
+#define CERT_KU_KEY_AGREEMENT        "keyAgreement"
+#define CERT_KU_CERT_SIGN        "certSigning"
+#define CERT_KU_CRL_SIGN             "crlSigning"
+#define CERT_KU_ENCIPHER_ONLY        "encipherOnly"
+#define CERT_KU_DECIPHER_ONLY        "decipherOnly"
+
+#define BASIC_SECHANDLER "BASIC_SECHANDLER"
+#define CERT_VALIDATION_DATE "validation_date"
+
+#define CERT_EXTENDED_KEY_USAGE "extendedKeyUsage"
+#define CERT_EKU_SERVER_AUTH SN_server_auth
+
+#define CERT_SUBJECT_KEY_IDENTFIER "subjectKeyIdentifier"
+#define CERT_AUTHORITY_KEY_IDENTIFIER "authorityKeyIdentifier"
+#define CERT_AUTHORITY_KEY_IDENTIFIER_ID "authorityKeyIdentifierId"
+#define CERT_AUTHORITY_KEY_IDENTIFIER_NAME "authorityKeyIdentifierName"
+#define CERT_AUTHORITY_KEY_IDENTIFIER_SERIAL "authorityKeyIdentifierSerial"
+
+// validate the current time lies within 
+// the validation period of the cert
+#define VALIDATION_POLICY_TIME 1
+
+// validate that the CA, or some cert in the chain
+// lies within the certificate store
+#define VALIDATION_POLICY_TRUSTED 2
+
+// validate that the subject name of
+// the cert contains the passed in hostname
+// or validates against the hostname
+#define VALIDATION_POLICY_HOSTNAME 4
+
+
+// validate that the cert contains the SSL EKU
+#define VALIDATION_POLICY_SSL_KU 8
+
+// validate that the cert contains the SSL EKU
+#define VALIDATION_POLICY_CA_KU 16
+
+#define VALIDATION_POLICY_CA_BASIC_CONSTRAINTS 32
+
+// validate that the cert is correct for SSL
+#define VALIDATION_POLICY_SSL (VALIDATION_POLICY_TIME | \
+                               VALIDATION_POLICY_HOSTNAME | \
+                               VALIDATION_POLICY_TRUSTED | \
+                               VALIDATION_POLICY_SSL_KU | \
+                               VALIDATION_POLICY_CA_BASIC_CONSTRAINTS | \
+                               VALIDATION_POLICY_CA_KU)
+
+
+
+
+
+
+class LLProtectedDataException
+{
+public:
+	LLProtectedDataException(const char *msg) 
+	{
+		LL_WARNS("SECAPI") << "Protected Data Error: " << (std::string)msg << LL_ENDL;
+		mMsg = (std::string)msg;
+	}
+	std::string getMessage() { return mMsg; }
+protected:
+	std::string mMsg;
+};
+
+// class LLCertificate
+// parent class providing an interface for certifiate.
+// LLCertificates are considered unmodifiable
+// Certificates are pulled out of stores, or created via
+// factory calls
+class LLCertificate : public LLRefCount
+{
+	LOG_CLASS(LLCertificate);
+public:
+	LLCertificate() {}
+	
+	virtual ~LLCertificate() {}
+	
+	// return a PEM encoded certificate.  The encoding
+	// includes the -----BEGIN CERTIFICATE----- and end certificate elements
+	virtual std::string getPem() const=0; 
+	
+	// return a DER encoded certificate
+	virtual std::vector<U8> getBinary() const=0;  
+	
+	// return an LLSD object containing information about the certificate
+	// such as its name, signature, expiry time, serial number
+	virtual LLSD getLLSD() const=0; 
+	
+	// return an openSSL X509 struct for the certificate
+	virtual X509* getOpenSSLX509() const=0;
+
+};
+
+// class LLCertificateVector
+// base class for a list of certificates.
+
+
+class LLCertificateVector : public LLRefCount
+{
+	
+public:
+	
+	LLCertificateVector() {};
+	virtual ~LLCertificateVector() {};
+	
+	// base iterator implementation class, providing
+	// the functionality needed for the iterator class.
+	class iterator_impl : public LLRefCount
+	{
+	public:
+		iterator_impl() {};
+		virtual ~iterator_impl() {};
+		virtual void seek(bool incr)=0;
+		virtual LLPointer<iterator_impl> clone() const=0;
+		virtual bool equals(const LLPointer<iterator_impl>& _iter) const=0;
+		virtual LLPointer<LLCertificate> get()=0;
+	};
+	
+	// iterator class
+	class iterator
+	{
+	public:
+		iterator(LLPointer<iterator_impl> impl) : mImpl(impl) {}
+		iterator() : mImpl(NULL) {}
+		iterator(const iterator& _iter) {mImpl = _iter.mImpl->clone(); }
+		~iterator() {}
+		iterator& operator++() { if(mImpl.notNull()) mImpl->seek(true); return *this;}
+		iterator& operator--() { if(mImpl.notNull()) mImpl->seek(false); return *this;}
+		
+		iterator operator++(int) { iterator result = *this; if(mImpl.notNull()) mImpl->seek(true); return result;}
+		iterator operator--(int) { iterator result = *this; if(mImpl.notNull()) mImpl->seek(false); return result;}
+		LLPointer<LLCertificate> operator*() { return mImpl->get(); }		
+		
+		LLPointer<iterator_impl> mImpl;
+	protected:
+		friend bool operator==(const LLCertificateVector::iterator& _lhs, const LLCertificateVector::iterator& _rhs);
+		bool equals(const iterator& _iter) const { return mImpl->equals(_iter.mImpl); }
+	};
+	
+	// numeric indexer
+	virtual LLPointer<LLCertificate> operator[](int)=0;
+	
+	// Iteration
+	virtual iterator begin()=0;
+	
+	virtual iterator end()=0;
+	
+	// find a cert given params
+	virtual iterator find(const LLSD& params) =0;
+	
+	// return the number of certs in the store
+	virtual int size() const = 0;	
+	
+	// append the cert to the store.  if a copy of the cert already exists in the store, it is removed first
+	virtual void  add(LLPointer<LLCertificate> cert)=0;
+	
+	// insert the cert to the store.  if a copy of the cert already exists in the store, it is removed first
+	virtual void  insert(iterator location, LLPointer<LLCertificate> cert)=0;	
+	
+	// remove a certificate from the store
+	virtual LLPointer<LLCertificate> erase(iterator cert)=0;	
+};
+
+
+// class LLCertificateStore
+// represents a store of certificates, typically a store of root CA
+// certificates.  The store can be persisted, and can be used to validate
+// a cert chain
+//
+class LLCertificateStore : virtual public LLCertificateVector
+{
+	
+public:
+	
+	LLCertificateStore() {}
+	virtual ~LLCertificateStore() {}
+	
+	// persist the store
+	virtual void save()=0;
+	
+	// return the store id
+	virtual std::string storeId() const=0;
+};
+
+// class LLCertificateChain
+// Class representing a chain of certificates in order, with the 
+// first element being the child cert.
+class LLCertificateChain : virtual public LLCertificateVector
+{	
+
+public:
+	LLCertificateChain() {}
+	
+	virtual ~LLCertificateChain() {}
+
+	// validate a certificate chain given the params.
+	// Will throw exceptions on error
+	
+	virtual void validate(int validation_policy,
+						  LLPointer<LLCertificateStore> ca_store,
+						  const LLSD& validation_params) =0;
+};
+
+
+
+
+inline
+bool operator==(const LLCertificateVector::iterator& _lhs, const LLCertificateVector::iterator& _rhs)
+{
+	return _lhs.equals(_rhs);
+}
+inline
+bool operator!=(const LLCertificateVector::iterator& _lhs, const LLCertificateVector::iterator& _rhs)
+{
+	return !(_lhs == _rhs);
+}
+
+
+//
+// LLCredential - interface for credentials providing the following functionality:
+// * persistance of credential information based on grid (for saving username/password)
+// * serialization to an OGP identifier/authenticator pair
+// 
+class LLCredential  : public LLRefCount
+{
+public:
+	
+	LLCredential() {}
+	
+	LLCredential(const std::string& grid)
+	{
+		mGrid = grid;
+		mIdentifier = LLSD::emptyMap();
+		mAuthenticator = LLSD::emptyMap();
+	}
+	
+	virtual ~LLCredential() {}
+	
+	virtual void setCredentialData(const LLSD& identifier, const LLSD& authenticator) 
+	{ 
+		mIdentifier = identifier;
+		mAuthenticator = authenticator;
+	}
+	virtual LLSD getIdentifier() { return mIdentifier; }
+	virtual LLSD getAuthenticator() { return mAuthenticator; }
+	virtual LLSD getLoginParams();
+	virtual std::string getGrid() { return mGrid; }
+	
+
+	virtual void clearAuthenticator() { mAuthenticator = LLSD(); } 
+	virtual std::string userID() const { return std::string("unknown");}
+	virtual std::string asString() const { return std::string("unknown");}
+	operator std::string() const { return asString(); }
+protected:
+	LLSD mIdentifier;
+	LLSD mAuthenticator;
+	std::string mGrid;
+};
+
+std::ostream& operator <<(std::ostream& s, const LLCredential& cred);
+
+
+// All error handling is via exceptions.
+
+class LLCertException
+{
+public:
+	LLCertException(LLPointer<LLCertificate> cert, const char* msg)
+	{
+
+		mCert = cert;
+
+		LL_WARNS("SECAPI") << "Certificate Error: " << (std::string)msg << LL_ENDL;
+		mMsg = (std::string)msg;
+	}
+	LLPointer<LLCertificate> getCert() { return mCert; }
+	std::string getMessage() { return mMsg; }
+protected:
+	LLPointer<LLCertificate> mCert;
+	std::string mMsg;
+};
+
+class LLInvalidCertificate : public LLCertException
+{
+public:
+	LLInvalidCertificate(LLPointer<LLCertificate> cert) : LLCertException(cert, "CertInvalid")
+	{
+	}
+protected:
+};
+
+class LLCertValidationTrustException : public LLCertException
+{
+public:
+	LLCertValidationTrustException(LLPointer<LLCertificate> cert) : LLCertException(cert, "CertUntrusted")
+	{
+	}
+protected:
+};
+
+class LLCertValidationHostnameException : public LLCertException
+{
+public:
+	LLCertValidationHostnameException(std::string hostname,
+									  LLPointer<LLCertificate> cert) : LLCertException(cert, "CertInvalidHostname")
+	{
+		mHostname = hostname;
+	}
+	
+	std::string getHostname() { return mHostname; }
+protected:
+	std::string mHostname;
+};
+
+class LLCertValidationExpirationException : public LLCertException
+{
+public:
+	LLCertValidationExpirationException(LLPointer<LLCertificate> cert,
+										LLDate current_time) : LLCertException(cert, "CertExpired")
+	{
+		mTime = current_time;
+	}
+	LLDate GetTime() { return mTime; }
+protected:
+	LLDate mTime;
+};
+
+class LLCertKeyUsageValidationException : public LLCertException
+{
+public:
+	LLCertKeyUsageValidationException(LLPointer<LLCertificate> cert) : LLCertException(cert, "CertKeyUsage")
+	{
+	}
+protected:
+};
+
+class LLCertBasicConstraintsValidationException : public LLCertException
+{
+public:
+	LLCertBasicConstraintsValidationException(LLPointer<LLCertificate> cert) : LLCertException(cert, "CertBasicConstraints")
+	{
+	}
+protected:
+};
+
+class LLCertValidationInvalidSignatureException : public LLCertException
+{
+public:
+	LLCertValidationInvalidSignatureException(LLPointer<LLCertificate> cert) : LLCertException(cert, "CertInvalidSignature")
+	{
+	}
+protected:
+};
+
+// LLSecAPIHandler Class
+// Interface handler class for the various security storage handlers.
+class LLSecAPIHandler : public LLRefCount
+{
+public:
+	
+	
+	LLSecAPIHandler() {}
+	virtual ~LLSecAPIHandler() {}
+	
+	// initialize the SecAPIHandler
+	virtual void init() {};
+	
+	// instantiate a certificate from a pem string
+	virtual LLPointer<LLCertificate> getCertificate(const std::string& pem_cert)=0;
+	
+	
+	
+	// instiate a certificate from an openssl X509 structure
+	virtual LLPointer<LLCertificate> getCertificate(X509* openssl_cert)=0;
+	
+	// instantiate a chain from an X509_STORE_CTX
+	virtual LLPointer<LLCertificateChain> getCertificateChain(const X509_STORE_CTX* chain)=0;
+	
+	// instantiate a cert store given it's id.  if a persisted version
+	// exists, it'll be loaded.  If not, one will be created (but not
+	// persisted)
+	virtual LLPointer<LLCertificateStore> getCertificateStore(const std::string& store_id)=0;
+	
+	// persist data in a protected store
+	virtual void setProtectedData(const std::string& data_type,
+								  const std::string& data_id,
+								  const LLSD& data)=0;
+	
+	// retrieve protected data
+	virtual LLSD getProtectedData(const std::string& data_type,
+								  const std::string& data_id)=0;
+	
+	// delete a protected data item from the store
+	virtual void deleteProtectedData(const std::string& data_type,
+									 const std::string& data_id)=0;
+	
+	virtual LLPointer<LLCredential> createCredential(const std::string& grid,
+													 const LLSD& identifier, 
+													 const LLSD& authenticator)=0;
+	
+	virtual LLPointer<LLCredential> loadCredential(const std::string& grid)=0;
+	
+	virtual void saveCredential(LLPointer<LLCredential> cred, bool save_authenticator)=0;
+	
+	virtual void deleteCredential(LLPointer<LLCredential> cred)=0;
+	
+};
+
+void initializeSecHandler();
+				
+// retrieve a security api depending on the api type
+LLPointer<LLSecAPIHandler> getSecHandler(const std::string& handler_type);
+
+void registerSecHandler(const std::string& handler_type, 
+						LLPointer<LLSecAPIHandler>& handler);
+
+extern LLPointer<LLSecAPIHandler> gSecAPIHandler;
+
+
+int secapiSSLCertVerifyCallback(X509_STORE_CTX *ctx, void *param);
+
+
+#endif // LL_SECAPI_H
-- 
cgit v1.3


From 5e727964dbd6d5e55dd3a0921e8e1f0f77a99747 Mon Sep 17 00:00:00 2001
From: Roxie Linden <roxie@lindenlab.com>
Date: Thu, 22 Apr 2010 15:09:34 -0700
Subject: DEV-49332 - cryptic error message when typing in single username when
 logging into maingrid. Needs to be changed when IE is checked in, of course.

Now we check the expected credential formats for a given grid against the
format that is typed in, and throw an error if it's invalid.
---
 indra/newview/llpanellogin.cpp                     | 42 ++++++++++++++---
 indra/newview/llpanellogin.h                       |  2 +-
 indra/newview/llsecapi.cpp                         | 52 +++++++++++++++++-----
 indra/newview/llsecapi.h                           |  6 +++
 indra/newview/llstartup.cpp                        |  2 +-
 indra/newview/llviewernetwork.cpp                  | 18 ++++++--
 indra/newview/llviewernetwork.h                    |  6 +--
 .../newview/skins/default/xui/en/notifications.xml |  8 ++++
 indra/newview/tests/lllogininstance_test.cpp       |  7 +++
 indra/newview/tests/llviewernetwork_test.cpp       | 10 ++---
 10 files changed, 122 insertions(+), 31 deletions(-)

(limited to 'indra/newview/llsecapi.h')

diff --git a/indra/newview/llpanellogin.cpp b/indra/newview/llpanellogin.cpp
index 22fb70de73..63fe7bfa91 100644
--- a/indra/newview/llpanellogin.cpp
+++ b/indra/newview/llpanellogin.cpp
@@ -571,7 +571,7 @@ void LLPanelLogin::setFields(LLPointer<LLCredential> credential,
 
 // static
 void LLPanelLogin::getFields(LLPointer<LLCredential>& credential,
-							 BOOL remember)
+							 BOOL& remember)
 {
 	if (!sInstance)
 	{
@@ -603,14 +603,14 @@ void LLPanelLogin::getFields(LLPointer<LLCredential>& credential,
 	{
 		LL_INFOS2("Credentials", "Authentication") << "account: " << username << LL_ENDL;
 		// single username, so this is a 'clear' identifier
-		identifier["type"] = "account";
+		identifier["type"] = CRED_IDENTIFIER_TYPE_ACCOUNT;
 		identifier["account_name"] = username;
 		
 		if (LLPanelLogin::sInstance->mPasswordModified)
 		{
 			authenticator = LLSD::emptyMap();
 			// password is plaintext
-			authenticator["type"] = "clear";
+			authenticator["type"] = CRED_AUTHENTICATOR_TYPE_CLEAR;
 			authenticator["secret"] = password;
 		}
 	}
@@ -618,14 +618,14 @@ void LLPanelLogin::getFields(LLPointer<LLCredential>& credential,
 	{
 		LL_INFOS2("Credentials", "Authentication") << "agent: " << username << LL_ENDL;
 		// traditional firstname / lastname
-		identifier["type"] = "agent";
+		identifier["type"] = CRED_IDENTIFIER_TYPE_AGENT;
 		identifier["first_name"] = username.substr(0, separator_index);
 		identifier["last_name"] = username.substr(separator_index+1, username.npos);
 		
 		if (LLPanelLogin::sInstance->mPasswordModified)
 		{
 			authenticator = LLSD::emptyMap();
-			authenticator["type"] = "hash";
+			authenticator["type"] = CRED_AUTHENTICATOR_TYPE_HASH;
 			authenticator["algorithm"] = "md5";
 			LLMD5 pass((const U8 *)password.c_str());
 			char md5pass[33];               /* Flawfinder: ignore */
@@ -978,14 +978,42 @@ void LLPanelLogin::onClickConnect(void *)
 		}
 		updateStartSLURL();
 		std::string username = sInstance->childGetText("username_edit");
+
+		
 		if(username.empty())
 		{
+			// user must type in something into the username field
 			LLNotificationsUtil::add("MustHaveAccountToLogIn");
 		}
 		else
 		{
-			// has both first and last name typed
-			sInstance->mCallback(0, sInstance->mCallbackData);
+			LLPointer<LLCredential> cred;
+			BOOL remember;
+			getFields(cred, remember);
+			std::string identifier_type;
+			cred->identifierType(identifier_type);
+			LLSD allowed_credential_types;
+			LLGridManager::getInstance()->getLoginIdentifierTypes(allowed_credential_types);
+			
+			// check the typed in credential type against the credential types expected by the server.
+			for(LLSD::array_iterator i = allowed_credential_types.beginArray();
+				i != allowed_credential_types.endArray();
+				i++)
+			{
+				
+				if(i->asString() == identifier_type)
+				{
+					// yay correct credential type
+					sInstance->mCallback(0, sInstance->mCallbackData);
+					return;
+				}
+			}
+			
+			// Right now, maingrid is the only thing that is picky about
+			// credential format, as it doesn't yet allow account (single username)
+			// format creds.  - Rox.  James, we wanna fix the message when we change
+			// this.
+			LLNotificationsUtil::add("InvalidCredentialFormat");			
 		}
 	}
 }
diff --git a/indra/newview/llpanellogin.h b/indra/newview/llpanellogin.h
index bca051691b..aa6884ea97 100644
--- a/indra/newview/llpanellogin.h
+++ b/indra/newview/llpanellogin.h
@@ -69,7 +69,7 @@ public:
 
 	static void setFields(LLPointer<LLCredential> credential, BOOL remember);
 
-	static void getFields(LLPointer<LLCredential>& credential, BOOL remember);
+	static void getFields(LLPointer<LLCredential>& credential, BOOL& remember);
 
 	static BOOL isGridComboDirty();
 	static BOOL areCredentialFieldsDirty();
diff --git a/indra/newview/llsecapi.cpp b/indra/newview/llsecapi.cpp
index ba343f5387..b3e96298d2 100644
--- a/indra/newview/llsecapi.cpp
+++ b/indra/newview/llsecapi.cpp
@@ -143,19 +143,51 @@ int secapiSSLCertVerifyCallback(X509_STORE_CTX *ctx, void *param)
 LLSD LLCredential::getLoginParams()
 {
 	LLSD result = LLSD::emptyMap();
-	if (mIdentifier["type"].asString() == "agent")
+	try 
 	{
-		// legacy credential
-		result["passwd"] = "$1$" + mAuthenticator["secret"].asString();
-		result["first"] = mIdentifier["first_name"];
-		result["last"] = mIdentifier["last_name"];
-	
+		if (mIdentifier["type"].asString() == "agent")
+		{
+			// legacy credential
+			result["passwd"] = "$1$" + mAuthenticator["secret"].asString();
+			result["first"] = mIdentifier["first_name"];
+			result["last"] = mIdentifier["last_name"];
+		
+		}
+		else if (mIdentifier["type"].asString() == "account")
+		{
+			result["username"] = mIdentifier["account_name"];
+			result["passwd"] = mAuthenticator["secret"];
+										
+		}
 	}
-	else if (mIdentifier["type"].asString() == "account")
+	catch (...)
 	{
-		result["username"] = mIdentifier["account_name"];
-		result["passwd"] = mAuthenticator["secret"];
-                                    
+		// we could have corrupt data, so simply return a null login param if so
+		LL_WARNS("AppInit") << "Invalid credential" << LL_ENDL;
 	}
 	return result;
 }
+
+void LLCredential::identifierType(std::string &idType)
+{
+	if(mIdentifier.has("type"))
+	{
+		idType = mIdentifier["type"].asString();
+	}
+	else {
+		idType = std::string();
+		
+	}
+}
+
+void LLCredential::authenticatorType(std::string &idType)
+{
+	if(mAuthenticator.has("type"))
+	{
+		idType = mAuthenticator["type"].asString();
+	}
+	else {
+		idType = std::string();
+		
+	}
+}
\ No newline at end of file
diff --git a/indra/newview/llsecapi.h b/indra/newview/llsecapi.h
index 5211dc2699..59a1e1eff0 100644
--- a/indra/newview/llsecapi.h
+++ b/indra/newview/llsecapi.h
@@ -286,6 +286,10 @@ bool operator!=(const LLCertificateVector::iterator& _lhs, const LLCertificateVe
 }
 
 
+#define CRED_IDENTIFIER_TYPE_ACCOUNT "account"
+#define CRED_IDENTIFIER_TYPE_AGENT "agent"
+#define CRED_AUTHENTICATOR_TYPE_CLEAR "clear"
+#define CRED_AUTHENTICATOR_TYPE_HASH   "hash"
 //
 // LLCredential - interface for credentials providing the following functionality:
 // * persistance of credential information based on grid (for saving username/password)
@@ -312,7 +316,9 @@ public:
 		mAuthenticator = authenticator;
 	}
 	virtual LLSD getIdentifier() { return mIdentifier; }
+	virtual void identifierType(std::string& idType);
 	virtual LLSD getAuthenticator() { return mAuthenticator; }
+	virtual void authenticatorType(std::string& authType);
 	virtual LLSD getLoginParams();
 	virtual std::string getGrid() { return mGrid; }
 	
diff --git a/indra/newview/llstartup.cpp b/indra/newview/llstartup.cpp
index eee92ac413..8e2097762a 100644
--- a/indra/newview/llstartup.cpp
+++ b/indra/newview/llstartup.cpp
@@ -799,7 +799,7 @@ bool idle_startup()
 		gViewerWindow->moveProgressViewToFront();
 
 		//reset the values that could have come in from a slurl
-		// DEV-42215: Make sure they're not empty -- gFirstname and gLastname
+		// DEV-42215: Make sure they're not empty -- gUserCredential
 		// might already have been set from gSavedSettings, and it's too bad
 		// to overwrite valid values with empty strings.
 
diff --git a/indra/newview/llviewernetwork.cpp b/indra/newview/llviewernetwork.cpp
index 2673ba4e17..a160572f7a 100644
--- a/indra/newview/llviewernetwork.cpp
+++ b/indra/newview/llviewernetwork.cpp
@@ -35,6 +35,7 @@
 #include "llviewernetwork.h"
 #include "llviewercontrol.h"
 #include "llsdserialize.h"
+#include "llsecapi.h"
 #include "llweb.h"
 
                                                             
@@ -92,7 +93,7 @@ void LLGridManager::initialize(const std::string& grid_file)
 	
 
 
-  	addSystemGrid("Secondlife.com (Agni)",                                                                                             
+  	addSystemGrid("Agni",                                                                                             
 				  MAINGRID,                                               
 				  "https://login.agni.lindenlab.com/cgi-bin/login.cgi",                    
 				  "https://secondlife.com/helpers/",     
@@ -361,7 +362,17 @@ void LLGridManager::addGrid(LLSD& grid_data)
 		if (!grid_data.has(GRID_HELPER_URI_VALUE)) 
 		{
 			grid_data[GRID_HELPER_URI_VALUE] = std::string("https://") + grid + "/helpers/";
-		}		
+		}
+		
+		if (!grid_data.has(GRID_LOGIN_IDENTIFIER_TYPES))
+		{
+			// non system grids and grids that haven't already been configured with values
+			// get both types of credentials.
+			grid_data[GRID_LOGIN_IDENTIFIER_TYPES] = LLSD::emptyArray();
+			grid_data[GRID_LOGIN_IDENTIFIER_TYPES].append(CRED_IDENTIFIER_TYPE_AGENT);
+			grid_data[GRID_LOGIN_IDENTIFIER_TYPES].append(CRED_IDENTIFIER_TYPE_ACCOUNT);
+		}
+		
 		LL_INFOS("GridManager") << "ADDING: " << grid << LL_ENDL;
 		mGridList[grid] = grid_data;		
 	}
@@ -384,7 +395,8 @@ void LLGridManager::addSystemGrid(const std::string& label,
 	grid[GRID_LOGIN_URI_VALUE].append(login);
 	grid[GRID_LOGIN_PAGE_VALUE] = login_page;
 	grid[GRID_IS_SYSTEM_GRID_VALUE] = TRUE;
-	grid[GRID_LOGIN_CREDENTIAL_PAGE_TYPE_VALUE] = GRID_LOGIN_CREDENTIAL_PAGE_TYPE_AGENT;
+	grid[GRID_LOGIN_IDENTIFIER_TYPES] = LLSD::emptyArray();
+	grid[GRID_LOGIN_IDENTIFIER_TYPES].append(CRED_IDENTIFIER_TYPE_AGENT);
 	
 	grid[GRID_APP_SLURL_BASE] = SYSTEM_GRID_APP_SLURL_BASE;
 	if (login_id.empty())
diff --git a/indra/newview/llviewernetwork.h b/indra/newview/llviewernetwork.h
index 46f21bf20f..0271e7a7a5 100644
--- a/indra/newview/llviewernetwork.h
+++ b/indra/newview/llviewernetwork.h
@@ -43,11 +43,8 @@ extern const char* DEFAULT_LOGIN_PAGE;
 #define GRID_LOGIN_PAGE_VALUE "login_page"
 #define GRID_IS_SYSTEM_GRID_VALUE "system_grid"
 #define GRID_IS_FAVORITE_VALUE "favorite"
-#define GRID_LOGIN_CREDENTIAL_PAGE_TYPE_VALUE "credential_type"
-#define GRID_LOGIN_CREDENTIAL_PAGE_TYPE_AGENT "agent"
-#define GRID_LOGIN_CREDENTIAL_PAGE_TYPE_ACCOUNT "account"
 #define MAINGRID "util.agni.lindenlab.com"
-
+#define GRID_LOGIN_IDENTIFIER_TYPES "login_identifier_types"
 // defines slurl formats associated with various grids.
 // we need to continue to support existing forms, as slurls
 // are shared between viewers that may not understand newer
@@ -119,6 +116,7 @@ public:
 	std::string getLoginPage() {return mGridList[mGrid][GRID_LOGIN_PAGE_VALUE];}
 	std::string getGridLoginID() { return mGridList[mGrid][GRID_ID_VALUE]; }	
 	std::string getLoginPage(const std::string& grid) { return mGridList[grid][GRID_LOGIN_PAGE_VALUE]; }
+	void        getLoginIdentifierTypes(LLSD& idTypes) { idTypes = mGridList[mGrid][GRID_LOGIN_IDENTIFIER_TYPES]; }
 	
 	// build a slurl for the given region within the selected grid
 	std::string getSLURLBase(const std::string& grid);
diff --git a/indra/newview/skins/default/xui/en/notifications.xml b/indra/newview/skins/default/xui/en/notifications.xml
index e06f36c823..a0a1113b4d 100644
--- a/indra/newview/skins/default/xui/en/notifications.xml
+++ b/indra/newview/skins/default/xui/en/notifications.xml
@@ -733,6 +733,14 @@ You need an account to enter [SECOND_LIFE]. Would you like to create one now?
      yestext="Create a new account"/>
   </notification>
 
+  <notification
+   icon="alertmodal.tga"
+   name="InvalidCredentialFormat"
+   type="alertmodal">
+You need to enter both the First and Last name of your avatar into the Username field, then login again.
+  </notification>
+  
+
   <notification
    icon="alertmodal.tga"
    name="AddClassified"
diff --git a/indra/newview/tests/lllogininstance_test.cpp b/indra/newview/tests/lllogininstance_test.cpp
index 67da9f2cdf..1c29feec5f 100644
--- a/indra/newview/tests/lllogininstance_test.cpp
+++ b/indra/newview/tests/lllogininstance_test.cpp
@@ -72,6 +72,13 @@ LLSD LLCredential::getLoginParams()
 	result["last"] ="mylast";
 	return result;
 }
+void LLCredential::identifierType(std::string &idType)
+{
+}
+
+void LLCredential::authenticatorType(std::string &idType)
+{
+}
 
 //-----------------------------------------------------------------------------
 #include "../llviewernetwork.h"
diff --git a/indra/newview/tests/llviewernetwork_test.cpp b/indra/newview/tests/llviewernetwork_test.cpp
index 90c8357453..025b570be2 100644
--- a/indra/newview/tests/llviewernetwork_test.cpp
+++ b/indra/newview/tests/llviewernetwork_test.cpp
@@ -145,7 +145,7 @@ namespace tut
 		std::map<std::string, std::string> known_grids = manager->getKnownGrids();
 		ensure_equals("Known grids is a string-string map of size 18", known_grids.size(), 18);
 		ensure_equals("Agni has the right name and label", 
-					  known_grids[std::string("util.agni.lindenlab.com")], std::string("Secondlife.com (Agni)"));
+					  known_grids[std::string("util.agni.lindenlab.com")], std::string("Agni"));
 		ensure_equals("None exists", known_grids[""], "None");
 		
 		LLSD grid = LLGridManager::getInstance()->getGridInfo("util.agni.lindenlab.com");
@@ -153,7 +153,7 @@ namespace tut
 		ensure_equals("name is correct for agni", 
 					  grid[GRID_VALUE].asString(), std::string("util.agni.lindenlab.com"));
 		ensure_equals("label is correct for agni", 
-					  grid[GRID_LABEL_VALUE].asString(), std::string("Secondlife.com (Agni)"));
+					  grid[GRID_LABEL_VALUE].asString(), std::string("Agni"));
 		ensure("Login URI is an array", 
 			   grid[GRID_LOGIN_URI_VALUE].isArray());
 		ensure_equals("Agni login uri is correct", 
@@ -186,14 +186,14 @@ namespace tut
 		ensure_equals("adding a grid via a grid file increases known grid size", 
 					  known_grids.size(), 19);
 		ensure_equals("Agni is still there after we've added a grid via a grid file", 
-					  known_grids["util.agni.lindenlab.com"], std::string("Secondlife.com (Agni)"));
+					  known_grids["util.agni.lindenlab.com"], std::string("Agni"));
 	
 		
 		// assure Agni doesn't get overwritten
 		LLSD grid = LLGridManager::getInstance()->getGridInfo("util.agni.lindenlab.com");
 
 		ensure_equals("Agni grid label was not modified by grid file", 
-					  grid[GRID_LABEL_VALUE].asString(), std::string("Secondlife.com (Agni)"));
+					  grid[GRID_LABEL_VALUE].asString(), std::string("Agni"));
 		
 		ensure_equals("Agni name wasn't modified by grid file",
 					  grid[GRID_VALUE].asString(), std::string("util.agni.lindenlab.com"));
@@ -320,7 +320,7 @@ namespace tut
 		LLGridManager::getInstance()->initialize("grid_test.xml");
 		LLGridManager::getInstance()->addGrid(grid);
 		LLGridManager::getInstance()->setGridChoice("util.agni.lindenlab.com");	
-		ensure_equals("getGridLabel", LLGridManager::getInstance()->getGridLabel(), std::string("Secondlife.com (Agni)"));
+		ensure_equals("getGridLabel", LLGridManager::getInstance()->getGridLabel(), std::string("Agni"));
 		ensure_equals("getGrid", LLGridManager::getInstance()->getGrid(), 
 					  std::string("util.agni.lindenlab.com"));
 		ensure_equals("getHelperURI", LLGridManager::getInstance()->getHelperURI(), 
-- 
cgit v1.3


From 1ad46b5cd0fcac0d3224d37d555092258593eabd Mon Sep 17 00:00:00 2001
From: Roxie Linden <roxie@lindenlab.com>
Date: Mon, 24 May 2010 13:59:10 -0700
Subject: DEV-50173 - investigate certificate code performance DEV-50166 -
 LLBasicCertificateChain::validate calls in log Added caching of certificates
 that have been validated. The sha1 hash for the certificate is stored and is
 associated with the from and to times.  When the certificate is validated,
 the code determines whether the certificate has successfully been validated
 before by looking for it in the cache, and then checks the date of the cert. 
 If that is successful, the validation calls with success.

Otherwise, it proceeds to do a full validation of the certificate.
---
 indra/newview/llsecapi.cpp                      |   2 +-
 indra/newview/llsecapi.h                        |  31 ++++---
 indra/newview/llsechandler_basic.cpp            | 114 +++++++++++++++++-------
 indra/newview/llsechandler_basic.h              |  23 +++--
 indra/newview/llstartup.cpp                     |   3 +-
 indra/newview/llxmlrpctransaction.cpp           |   3 +-
 indra/newview/tests/llsechandler_basic_test.cpp |  34 +++----
 7 files changed, 134 insertions(+), 76 deletions(-)

(limited to 'indra/newview/llsecapi.h')

diff --git a/indra/newview/llsecapi.cpp b/indra/newview/llsecapi.cpp
index 1caeec5b04..9e636f38c0 100644
--- a/indra/newview/llsecapi.cpp
+++ b/indra/newview/llsecapi.cpp
@@ -124,7 +124,7 @@ int secapiSSLCertVerifyCallback(X509_STORE_CTX *ctx, void *param)
 		// we rely on libcurl to validate the hostname, as libcurl does more extensive validation
 		// leaving our hostname validation call mechanism for future additions with respect to
 		// OS native (Mac keyring, windows CAPI) validation.
-		chain->validate(VALIDATION_POLICY_SSL & (~VALIDATION_POLICY_HOSTNAME), store, validation_params);
+		store->validate(VALIDATION_POLICY_SSL & (~VALIDATION_POLICY_HOSTNAME), chain, validation_params);
 	}
 	catch (LLCertValidationTrustException& cert_exception)
 	{
diff --git a/indra/newview/llsecapi.h b/indra/newview/llsecapi.h
index 59a1e1eff0..5a1a3879d4 100644
--- a/indra/newview/llsecapi.h
+++ b/indra/newview/llsecapi.h
@@ -154,7 +154,7 @@ public:
 	
 	// return an LLSD object containing information about the certificate
 	// such as its name, signature, expiry time, serial number
-	virtual LLSD getLLSD() const=0; 
+	virtual void getLLSD(LLSD& llsd)=0; 
 	
 	// return an openSSL X509 struct for the certificate
 	virtual X509* getOpenSSLX509() const=0;
@@ -231,6 +231,18 @@ public:
 	virtual LLPointer<LLCertificate> erase(iterator cert)=0;	
 };
 
+// class LLCertificateChain
+// Class representing a chain of certificates in order, with the 
+// first element being the child cert.
+class LLCertificateChain : virtual public LLCertificateVector
+{	
+	
+public:
+	LLCertificateChain() {}
+	
+	virtual ~LLCertificateChain() {}
+	
+};
 
 // class LLCertificateStore
 // represents a store of certificates, typically a store of root CA
@@ -250,30 +262,17 @@ public:
 	
 	// return the store id
 	virtual std::string storeId() const=0;
-};
-
-// class LLCertificateChain
-// Class representing a chain of certificates in order, with the 
-// first element being the child cert.
-class LLCertificateChain : virtual public LLCertificateVector
-{	
-
-public:
-	LLCertificateChain() {}
 	
-	virtual ~LLCertificateChain() {}
-
 	// validate a certificate chain given the params.
 	// Will throw exceptions on error
 	
 	virtual void validate(int validation_policy,
-						  LLPointer<LLCertificateStore> ca_store,
+						  LLPointer<LLCertificateChain> cert_chain,
 						  const LLSD& validation_params) =0;
+	
 };
 
 
-
-
 inline
 bool operator==(const LLCertificateVector::iterator& _lhs, const LLCertificateVector::iterator& _rhs)
 {
diff --git a/indra/newview/llsechandler_basic.cpp b/indra/newview/llsechandler_basic.cpp
index edf5ce9b60..84ab9b9175 100644
--- a/indra/newview/llsechandler_basic.cpp
+++ b/indra/newview/llsechandler_basic.cpp
@@ -85,7 +85,6 @@ LLBasicCertificate::LLBasicCertificate(const std::string& pem_cert)
 	{
 		throw LLInvalidCertificate(this);
 	}
-	_initLLSD();
 }
 
 
@@ -96,7 +95,6 @@ LLBasicCertificate::LLBasicCertificate(X509* pCert)
 		throw LLInvalidCertificate(this);
 	}	
 	mCert = X509_dup(pCert);
-	_initLLSD();
 }
 
 LLBasicCertificate::~LLBasicCertificate() 
@@ -150,9 +148,13 @@ std::vector<U8> LLBasicCertificate::getBinary() const
 }
 
 
-LLSD LLBasicCertificate::getLLSD() const
+void LLBasicCertificate::getLLSD(LLSD &llsd)
 {
-	return mLLSDInfo;
+	if (mLLSDInfo.isUndefined())
+	{
+		_initLLSD();
+	}
+	llsd = mLLSDInfo;
 }
 
 // Initialize the LLSD info for the certificate
@@ -516,8 +518,9 @@ LLBasicCertificateVector::iterator LLBasicCertificateVector::find(const LLSD& pa
 		cert++)
 	{
 
-			found= TRUE;
-		LLSD cert_info = (*cert)->getLLSD();
+		found= TRUE;
+		LLSD cert_info;
+		(*cert)->getLLSD(cert_info);
 			for (LLSD::map_const_iterator param = params.beginMap();
 			 param != params.endMap();
 			 param++)
@@ -543,7 +546,8 @@ LLBasicCertificateVector::iterator LLBasicCertificateVector::find(const LLSD& pa
 void  LLBasicCertificateVector::insert(iterator _iter, 
 									   LLPointer<LLCertificate> cert)
 {
-	LLSD cert_info = cert->getLLSD();
+	LLSD cert_info;
+	cert->getLLSD(cert_info);
 	if (cert_info.isMap() && cert_info.has(CERT_SHA1_DIGEST))
 	{
 		LLSD existing_cert_info = LLSD::emptyMap();
@@ -691,7 +695,8 @@ LLBasicCertificateChain::LLBasicCertificateChain(const X509_STORE_CTX* store)
 		while(untrusted_certs.size() > 0)
 		{
 			LLSD find_data = LLSD::emptyMap();
-			LLSD cert_data = current->getLLSD();
+			LLSD cert_data;
+			current->getLLSD(cert_data);
 			// we simply build the chain via subject/issuer name as the
 			// client should not have passed in multiple CA's with the same 
 			// subject name.  If they did, it'll come out in the wash during
@@ -850,12 +855,13 @@ bool _LLSDArrayIncludesValue(const LLSD& llsd_set, LLSD llsd_value)
 }
 
 void _validateCert(int validation_policy,
-				  const LLPointer<LLCertificate> cert,
+				  LLPointer<LLCertificate> cert,
 				  const LLSD& validation_params,
 				  int depth)
 {
 
-	LLSD current_cert_info = cert->getLLSD();		
+	LLSD current_cert_info;
+	cert->getLLSD(current_cert_info);		
 	// check basic properties exist in the cert
 	if(!current_cert_info.has(CERT_SUBJECT_NAME) || !current_cert_info.has(CERT_SUBJECT_NAME_STRING))
 	{
@@ -943,8 +949,9 @@ bool _verify_signature(LLPointer<LLCertificate> parent,
 					   LLPointer<LLCertificate> child)
 {
 	bool verify_result = FALSE; 
-	LLSD cert1 = parent->getLLSD();
-	LLSD cert2 = child->getLLSD();
+	LLSD cert1, cert2;
+	parent->getLLSD(cert1);
+	child->getLLSD(cert2);
 	X509 *signing_cert = parent->getOpenSSLX509();
 	X509 *child_cert = child->getOpenSSLX509();
 	if((signing_cert != NULL) && (child_cert != NULL))
@@ -979,6 +986,7 @@ bool _verify_signature(LLPointer<LLCertificate> parent,
 	return verify_result;
 }
 
+
 // validate the certificate chain against a store.
 // There are many aspects of cert validatioin policy involved in
 // trust validation.  The policies in this validation algorithm include
@@ -993,8 +1001,8 @@ bool _verify_signature(LLPointer<LLCertificate> parent,
 // and verify the last cert is in the certificate store, or points
 // to a cert in the store.  It validates whether any cert in the chain
 // is trusted in the store, even if it's not the last one.
-void LLBasicCertificateChain::validate(int validation_policy,
-									   LLPointer<LLCertificateStore> ca_store,
+void LLBasicCertificateStore::validate(int validation_policy,
+									   LLPointer<LLCertificateChain> cert_chain,
 									   const LLSD& validation_params)
 {
 
@@ -1002,8 +1010,8 @@ void LLBasicCertificateChain::validate(int validation_policy,
 	{
 		throw LLCertException(NULL, "No certs in chain");
 	}
-	iterator current_cert = begin();
-	LLSD 	current_cert_info = (*current_cert)->getLLSD();
+	iterator current_cert = cert_chain->begin();
+	LLSD 	current_cert_info;
 	LLSD validation_date;
 	if (validation_params.has(CERT_VALIDATION_DATE))
 	{
@@ -1012,6 +1020,7 @@ void LLBasicCertificateChain::validate(int validation_policy,
 
 	if (validation_policy & VALIDATION_POLICY_HOSTNAME)
 	{
+		(*current_cert)->getLLSD(current_cert_info);
 		if(!validation_params.has(CERT_HOSTNAME))
 		{
 			throw LLCertException((*current_cert), "No hostname passed in for validation");			
@@ -1021,7 +1030,7 @@ void LLBasicCertificateChain::validate(int validation_policy,
 			throw LLInvalidCertificate((*current_cert));				
 		}
 		
-		LL_INFOS("SECAPI") << "Validating the hostname " << validation_params[CERT_HOSTNAME].asString() << 
+		LL_DEBUGS("SECAPI") << "Validating the hostname " << validation_params[CERT_HOSTNAME].asString() << 
 		     "against the cert CN " << current_cert_info[CERT_SUBJECT_NAME][CERT_NAME_CN].asString() << LL_ENDL;
 		if(!_cert_hostname_wildcard_match(validation_params[CERT_HOSTNAME].asString(),
 										  current_cert_info[CERT_SUBJECT_NAME][CERT_NAME_CN].asString()))
@@ -1030,16 +1039,50 @@ void LLBasicCertificateChain::validate(int validation_policy,
 													(*current_cert));
 		}
 	}
-	
 
+	// check the cache of already validated certs
+	X509* cert_x509 = (*current_cert)->getOpenSSLX509();
+	if(!cert_x509)
+	{
+		throw LLInvalidCertificate((*current_cert));			
+	}
+	std::string sha1_hash((const char *)cert_x509->sha1_hash, SHA_DIGEST_LENGTH);
+	t_cert_cache::iterator cache_entry = mTrustedCertCache.find(sha1_hash);
+	if(cache_entry != mTrustedCertCache.end())
+	{
+		LL_DEBUGS("SECAPI") << "Found cert in cache" << LL_ENDL;	
+		// this cert is in the cache, so validate the time.
+		if (validation_policy & VALIDATION_POLICY_TIME)
+		{
+			LLDate validation_date(time(NULL));
+			if(validation_params.has(CERT_VALIDATION_DATE))
+			{
+				validation_date = validation_params[CERT_VALIDATION_DATE];
+			}
+			
+			if((validation_date < cache_entry->second.first) ||
+			   (validation_date > cache_entry->second.second))
+			{
+				throw LLCertValidationExpirationException((*current_cert), validation_date);
+			}
+		}
+		// successfully found in cache
+		return;
+	}
+	if(current_cert_info.isUndefined())
+	{
+		(*current_cert)->getLLSD(current_cert_info);
+	}
+	LLDate from_time = current_cert_info[CERT_VALID_FROM].asDate();
+	LLDate to_time = current_cert_info[CERT_VALID_TO].asDate();
 	int depth = 0;
 	LLPointer<LLCertificate> previous_cert;
 	// loop through the cert chain, validating the current cert against the next one.
-	while(current_cert != end())
+	while(current_cert != cert_chain->end())
 	{
 		
 		int local_validation_policy = validation_policy;
-		if(current_cert == begin())
+		if(current_cert == cert_chain->begin())
 		{
 			// for the child cert, we don't validate CA stuff
 			local_validation_policy &= ~(VALIDATION_POLICY_CA_KU | 
@@ -1061,23 +1104,23 @@ void LLBasicCertificateChain::validate(int validation_policy,
 					  depth);
 		
 		// look for a CA in the CA store that may belong to this chain.
-		LLSD cert_llsd = (*current_cert)->getLLSD();
 		LLSD cert_search_params = LLSD::emptyMap();		
 		// is the cert itself in the store?
-		cert_search_params[CERT_SHA1_DIGEST] = cert_llsd[CERT_SHA1_DIGEST];
-		LLCertificateStore::iterator found_store_cert = ca_store->find(cert_search_params);
-		if(found_store_cert != ca_store->end())
+		cert_search_params[CERT_SHA1_DIGEST] = current_cert_info[CERT_SHA1_DIGEST];
+		LLCertificateStore::iterator found_store_cert = find(cert_search_params);
+		if(found_store_cert != end())
 		{
+			mTrustedCertCache[sha1_hash] = std::pair<LLDate, LLDate>(from_time, to_time);
 			return;
 		}
 		
 		// is the parent in the cert store?
 			
 		cert_search_params = LLSD::emptyMap();
-		cert_search_params[CERT_SUBJECT_NAME_STRING] = cert_llsd[CERT_ISSUER_NAME_STRING];
-		if (cert_llsd.has(CERT_AUTHORITY_KEY_IDENTIFIER))
+		cert_search_params[CERT_SUBJECT_NAME_STRING] = current_cert_info[CERT_ISSUER_NAME_STRING];
+		if (current_cert_info.has(CERT_AUTHORITY_KEY_IDENTIFIER))
 		{
-			LLSD cert_aki = cert_llsd[CERT_AUTHORITY_KEY_IDENTIFIER];
+			LLSD cert_aki = current_cert_info[CERT_AUTHORITY_KEY_IDENTIFIER];
 			if(cert_aki.has(CERT_AUTHORITY_KEY_IDENTIFIER_ID))
 			{
 				cert_search_params[CERT_SUBJECT_KEY_IDENTFIER] = cert_aki[CERT_AUTHORITY_KEY_IDENTIFIER_ID];
@@ -1087,11 +1130,10 @@ void LLBasicCertificateChain::validate(int validation_policy,
 				cert_search_params[CERT_SERIAL_NUMBER] = cert_aki[CERT_AUTHORITY_KEY_IDENTIFIER_SERIAL];
 			}
 		}
-		found_store_cert = ca_store->find(cert_search_params);
+		found_store_cert = find(cert_search_params);
 		
-		if(found_store_cert != ca_store->end())
+		if(found_store_cert != end())
 		{
-			LLSD foo = (*found_store_cert)->getLLSD();
 			// validate the store cert against the depth
 			_validateCert(validation_policy & VALIDATION_POLICY_CA_BASIC_CONSTRAINTS,
 						  (*found_store_cert),
@@ -1105,11 +1147,16 @@ void LLBasicCertificateChain::validate(int validation_policy,
 				throw LLCertValidationInvalidSignatureException(*current_cert);
 			}			
 			// successfully validated.
+			mTrustedCertCache[sha1_hash] = std::pair<LLDate, LLDate>(from_time, to_time);		
 			return;
 		}
 		previous_cert = (*current_cert);
 		current_cert++;
-			   depth++;
+		depth++;
+		if(current_cert != current_cert != cert_chain->end())
+		{
+			(*current_cert)->getLLSD(current_cert_info);
+		}
 	}
 	if (validation_policy & VALIDATION_POLICY_TRUSTED)
 	{
@@ -1118,6 +1165,7 @@ void LLBasicCertificateChain::validate(int validation_policy,
 		throw LLCertValidationTrustException((*this)[size()-1]);
 
 	}
+	mTrustedCertCache[sha1_hash] = std::pair<LLDate, LLDate>(from_time, to_time);	
 }
 
 
@@ -1155,7 +1203,7 @@ void LLSecAPIBasicHandler::init()
 														"CA.pem");
 		
 		
-		LL_INFOS("SECAPI") << "Loading certificate store from " << store_file << LL_ENDL;
+		LL_DEBUGS("SECAPI") << "Loading certificate store from " << store_file << LL_ENDL;
 		mStore = new LLBasicCertificateStore(store_file);
 		
 		// grab the application CA.pem file that contains the well-known certs shipped
@@ -1465,7 +1513,7 @@ void LLSecAPIBasicHandler::saveCredential(LLPointer<LLCredential> cred, bool sav
 	{
 		credential["authenticator"] = cred->getAuthenticator();
 	}
-	LL_INFOS("SECAPI") << "Saving Credential " << cred->getGrid() << ":" << cred->userID() << " " << save_authenticator << LL_ENDL;
+	LL_DEBUGS("SECAPI") << "Saving Credential " << cred->getGrid() << ":" << cred->userID() << " " << save_authenticator << LL_ENDL;
 	setProtectedData("credential", cred->getGrid(), credential);
 	//*TODO: If we're saving Agni credentials, should we write the
 	// credentials to the legacy password.dat/etc?
diff --git a/indra/newview/llsechandler_basic.h b/indra/newview/llsechandler_basic.h
index 4bbb73f062..3ddd36a81a 100644
--- a/indra/newview/llsechandler_basic.h
+++ b/indra/newview/llsechandler_basic.h
@@ -59,12 +59,13 @@ public:
 	
 	virtual std::string getPem() const;
 	virtual std::vector<U8> getBinary() const;
-	virtual LLSD getLLSD() const;
+	virtual void getLLSD(LLSD &llsd);
 
 	virtual X509* getOpenSSLX509() const;
 	
 	// set llsd elements for testing
 	void setLLSD(const std::string name, const LLSD& value) { mLLSDInfo[name] = value; }
+
 protected:
 
 	// certificates are stored as X509 objects, as validation and
@@ -173,8 +174,21 @@ public:
 	// return the store id
 	virtual std::string storeId() const;
 	
+	// validate a certificate chain against a certificate store, using the
+	// given validation policy.
+	virtual void validate(int validation_policy,
+						  LLPointer<LLCertificateChain> ca_chain,
+						  const LLSD& validation_params);
+	
 protected:
-	std::vector<LLPointer<LLCertificate> >mCerts;
+	std::vector<LLPointer<LLCertificate> >            mCerts;
+	
+	// cache of cert sha1 hashes to from/to date pairs, to improve
+	// performance of cert trust.  Note, these are not the CA certs,
+	// but the certs that have been validated against this store.
+	typedef std::map<std::string, std::pair<LLDate, LLDate> > t_cert_cache;
+	t_cert_cache mTrustedCertCache;
+	
 	std::string mFilename;
 };
 
@@ -189,11 +203,6 @@ public:
 	
 	virtual ~LLBasicCertificateChain() {}
 	
-	// validate a certificate chain against a certificate store, using the
-	// given validation policy.
-	virtual void validate(int validation_policy,
-						  LLPointer<LLCertificateStore> ca_store,
-						  const LLSD& validation_params);
 };
 
 
diff --git a/indra/newview/llstartup.cpp b/indra/newview/llstartup.cpp
index 0a464b3b6c..7022d83868 100644
--- a/indra/newview/llstartup.cpp
+++ b/indra/newview/llstartup.cpp
@@ -2702,7 +2702,8 @@ LLSD transform_cert_args(LLPointer<LLCertificate> cert)
 {
 	LLSD args = LLSD::emptyMap();
 	std::string value;
-	LLSD cert_info = cert->getLLSD();
+	LLSD cert_info;
+	cert->getLLSD(cert_info);
 	// convert all of the elements in the cert into                                        
 	// args for the xml dialog, so we have flexability to                                  
 	// display various parts of the cert by only modifying                                 
diff --git a/indra/newview/llxmlrpctransaction.cpp b/indra/newview/llxmlrpctransaction.cpp
index da61840761..bc1a48e26a 100644
--- a/indra/newview/llxmlrpctransaction.cpp
+++ b/indra/newview/llxmlrpctransaction.cpp
@@ -247,7 +247,8 @@ int LLXMLRPCTransaction::Impl::_sslCertVerifyCallback(X509_STORE_CTX *ctx, void
 	validation_params[CERT_HOSTNAME] = uri.hostName();
 	try
 	{
-		chain->validate(VALIDATION_POLICY_SSL, store, validation_params);
+		// don't validate hostname.  Let libcurl do it instead.  That way, it'll handle redirects
+		store->validate(VALIDATION_POLICY_SSL & (~VALIDATION_POLICY_HOSTNAME), chain, validation_params);
 	}
 	catch (LLCertValidationTrustException& cert_exception)
 	{
diff --git a/indra/newview/tests/llsechandler_basic_test.cpp b/indra/newview/tests/llsechandler_basic_test.cpp
index fd680b24f0..d1330e2270 100644
--- a/indra/newview/tests/llsechandler_basic_test.cpp
+++ b/indra/newview/tests/llsechandler_basic_test.cpp
@@ -950,15 +950,15 @@ namespace tut
 
 		test_chain->add(new LLBasicCertificate(mX509IntermediateCert));
 
-		test_chain->validate(0, test_store, validation_params);
+		test_store->validate(0, test_chain, validation_params);
 
 		// add the root certificate to the chain and revalidate
 		test_chain->add(new LLBasicCertificate(mX509RootCert));	
-		test_chain->validate(0, test_store, validation_params);
+		test_store->validate(0, test_chain, validation_params);
 
 		// add the child cert at the head of the chain, and revalidate (3 deep chain)
 		test_chain->insert(test_chain->begin(), new LLBasicCertificate(mX509ChildCert));
-		test_chain->validate(0, test_store, validation_params);
+		test_store->validate(0, test_chain, validation_params);
 
 		// basic failure cases
 		test_chain = new LLBasicCertificateChain(NULL);
@@ -967,14 +967,14 @@ namespace tut
 		ensure_throws("no CA, with only a child cert", 
 					  LLCertValidationTrustException, 
 					  (*test_chain)[0],
-					  test_chain->validate, 
+					  test_store->validate, 
 					  VALIDATION_POLICY_TRUSTED, 
-					  test_store, 
+					  test_chain, 
 					  validation_params);
 
 
 		// validate without the trust flag.
-		test_chain->validate(0, test_store, validation_params);		
+		test_store->validate(0, test_chain, validation_params);		
 
 		// clear out the store
 		test_store = new LLBasicCertificateStore("mycertstore.pem");
@@ -983,9 +983,9 @@ namespace tut
 		ensure_throws("no CA, with child and intermediate certs", 
 					  LLCertValidationTrustException, 
 					  (*test_chain)[1],
-					  test_chain->validate, 
+					  test_store->validate, 
 					  VALIDATION_POLICY_TRUSTED, 
-					  test_store, 
+					  test_chain, 
 					  validation_params);
 		// validate without the trust flag
 		test_chain->validate(0, test_store, validation_params);
@@ -994,7 +994,7 @@ namespace tut
 		LLSD child_info = (*test_chain)[0]->getLLSD();
 		validation_params = LLSD::emptyMap();
 		validation_params[CERT_VALIDATION_DATE] = LLDate(child_info[CERT_VALID_FROM].asDate().secondsSinceEpoch() + 1.0);  
-		test_chain->validate(VALIDATION_POLICY_TIME, test_store, validation_params);
+		test_store->validate(VALIDATION_POLICY_TIME, test_chain, validation_params);
 
 		validation_params = LLSD::emptyMap();		
 		validation_params[CERT_VALIDATION_DATE] = child_info[CERT_VALID_FROM].asDate();
@@ -1005,9 +1005,9 @@ namespace tut
 		ensure_throws("Child cert not yet valid" , 
 					  LLCertValidationExpirationException, 
 					  (*test_chain)[0],
-					  test_chain->validate, 
+					  test_store->validate, 
 					  VALIDATION_POLICY_TIME, 
-					  test_store, 
+					  test_chain, 
 					  validation_params);	
 		validation_params = LLSD::emptyMap();		
 		validation_params[CERT_VALIDATION_DATE] = LLDate(child_info[CERT_VALID_TO].asDate().secondsSinceEpoch() + 1.0);
@@ -1016,9 +1016,9 @@ namespace tut
 		ensure_throws("Child cert expired", 
 					  LLCertValidationExpirationException, 
 					  (*test_chain)[0],
-					  test_chain->validate, 
+					  test_store->validate, 
 					  VALIDATION_POLICY_TIME, 
-					  test_store, 
+					  test_chain, 
 					  validation_params);
 
 		// test SSL KU
@@ -1026,7 +1026,7 @@ namespace tut
 		test_chain = new LLBasicCertificateChain(NULL);
 		test_chain->add(new LLBasicCertificate(mX509ChildCert));
 		test_chain->add(new LLBasicCertificate(mX509IntermediateCert));
-		test_chain->validate(VALIDATION_POLICY_SSL_KU, test_store, validation_params);	
+		test_store->validate(VALIDATION_POLICY_SSL_KU, test_chain, validation_params);	
 
 		test_chain = new LLBasicCertificateChain(NULL);
 		test_chain->add(new LLBasicCertificate(mX509TestCert));
@@ -1034,9 +1034,9 @@ namespace tut
 		ensure_throws("Cert doesn't have ku", 
 					  LLCertKeyUsageValidationException, 
 					  (*test_chain)[0],
-					  test_chain->validate, 
+					  test_store->validate, 
 					  VALIDATION_POLICY_SSL_KU, 
-					  test_store, 
+					  test_chain, 
 					  validation_params);
 		
 		// test sha1RSA validation
@@ -1044,7 +1044,7 @@ namespace tut
 		test_chain->add(new LLBasicCertificate(mSha1RSATestCert));	
 		test_chain->add(new LLBasicCertificate(mSha1RSATestCA));
 
-		test_chain->validate(0, test_store, validation_params);	
+		test_store->validate(0, test_chain, validation_params);	
 	}
 	
 };
-- 
cgit v1.3