mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-11-14 16:45:00 +08:00
Update src
This commit is contained in:
Zhi Guan
808
src/x509_crl.c
808
src/x509_crl.c
@@ -1,4 +1,4 @@
|
||||
/*
|
||||
/*
|
||||
* Copyright (c) 2021 - 2021 The GmSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -49,415 +49,535 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <gmssl/crl.h>
|
||||
#include <gmssl/asn1.h>
|
||||
#include <gmssl/oid.h>
|
||||
#include <gmssl/x509.h>
|
||||
#include <gmssl/x509_crl.h>
|
||||
#include <gmssl/x509_alg.h>
|
||||
#include <gmssl/x509_ext.h>
|
||||
#include <gmssl/error.h>
|
||||
|
||||
static const char *x509_crl_reason_names[] = {
|
||||
"unspecified",
|
||||
"keyCompromise",
|
||||
"cACompromise",
|
||||
"affiliationChanged",
|
||||
"superseded",
|
||||
"cessationOfOperation",
|
||||
"certificateHold",
|
||||
"notAssigned",
|
||||
"removeFromCRL",
|
||||
"privilegeWithdrawn",
|
||||
"aACompromise",
|
||||
};
|
||||
|
||||
const char *crl_reason_text(int reason)
|
||||
static const size_t x509_crl_reason_names_count =
|
||||
sizeof(x509_crl_reason_names)/sizeof(x509_crl_reason_names[0]);
|
||||
|
||||
const char *x509_crl_reason_name(int reason)
|
||||
{
|
||||
switch (reason) {
|
||||
case X509_cr_unspecified: return "unspecified";
|
||||
case X509_cr_key_compromise: return "keyCompromise";
|
||||
case X509_cr_ca_compromise: return "cACompromise";
|
||||
case X509_cr_affiliation_changed: return "affiliationChanged";
|
||||
case X509_cr_superseded: return "superseded";
|
||||
case X509_cr_cessation_of_operation: return "cessationOfOperation";
|
||||
case X509_cr_certificate_hold: return "certificateHold";
|
||||
case X509_cr_remove_from_crl: return "removeFromCRL";
|
||||
case X509_cr_privilege_withdrawn: return "privilegeWithdrawn";
|
||||
case X509_cr_aa_compromise: return "aACompromise";
|
||||
if (reason < 0 || reason >= x509_crl_reason_names_count) {
|
||||
error_print();
|
||||
return NULL;
|
||||
}
|
||||
return NULL;
|
||||
return x509_crl_reason_names[reason];
|
||||
}
|
||||
|
||||
84 typedef struct {
|
||||
85 uint8_t serial_number[20];
|
||||
86 size_t serial_number_len;
|
||||
87 time_t revoke_date;
|
||||
88 CRL_EXTENSIONS crlEntryExtensions;
|
||||
89 } CRL_REVOKED_CERT;
|
||||
|
||||
|
||||
int crl_revoked_cert_to_der(const CRL_REVOKED_CERT *a, uint8_t **out, size_t *outlen)
|
||||
int x509_crl_reason_from_name(int *reason, const char *name)
|
||||
{
|
||||
int i;
|
||||
for (i = 0; i < x509_crl_reason_names_count; i++) {
|
||||
if (strcmp(name, x509_crl_reason_names[i]) == 0) {
|
||||
*reason = i;
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int x509_crl_reason_to_der(int reason, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
if (reason >= 0 && !x509_crl_reason_name(reason)) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return asn1_enumerated_to_der(reason, out, outlen);
|
||||
}
|
||||
|
||||
int x509_crl_reason_from_der(int *reason, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
return asn1_enumerated_from_der(reason, in, inlen);
|
||||
}
|
||||
|
||||
|
||||
static uint32_t oid_ce_crl_reasons[] = { oid_ce,21 };
|
||||
static uint32_t oid_ce_invalidity_date[] = { oid_ce,24 };
|
||||
static uint32_t oid_ce_certificate_issuer[] = { oid_ce,29 };
|
||||
|
||||
static const ASN1_OID_INFO x509_crl_entry_exts[] = {
|
||||
{ OID_ce_crl_reasons, "CRLReasons", oid_ce_crl_reasons, sizeof(oid_ce_crl_reasons)/sizeof(int) },
|
||||
{ OID_ce_invalidity_date, "InvalidityDate", oid_ce_invalidity_date, sizeof(oid_ce_invalidity_date)/sizeof(int) },
|
||||
{ OID_ce_certificate_issuer, "CertificateIssuer", oid_ce_certificate_issuer, sizeof(oid_ce_certificate_issuer)/sizeof(int) },
|
||||
};
|
||||
|
||||
static const int x509_crl_entry_exts_count =
|
||||
sizeof(x509_crl_entry_exts)/sizeof(x509_crl_entry_exts[0]);
|
||||
|
||||
const char *x509_crl_entry_ext_id_name(int oid)
|
||||
{
|
||||
const ASN1_OID_INFO *info;
|
||||
if (!(info = asn1_oid_info_from_oid(x509_crl_entry_exts, x509_crl_entry_exts_count, oid))) {
|
||||
error_print();
|
||||
return NULL;
|
||||
}
|
||||
return info->name;
|
||||
}
|
||||
|
||||
int x509_crl_entry_ext_id_from_name(const char *name)
|
||||
{
|
||||
const ASN1_OID_INFO *info;
|
||||
if (!(info = asn1_oid_info_from_name(x509_crl_entry_exts, x509_crl_entry_exts_count, name))) {
|
||||
error_print();
|
||||
return OID_undef;
|
||||
}
|
||||
return info->oid;
|
||||
}
|
||||
|
||||
int x509_crl_entry_ext_id_to_der(int oid, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
const ASN1_OID_INFO *info;
|
||||
size_t len = 0;
|
||||
if (asn1_integer_to_der(a->serial_number, a->serial_number_len, NULL, &len) != 1
|
||||
|| x509_time_to_der(a->revoke_date, NULL, &len) != 1
|
||||
|| x509_extension_to_der(a->exts, NULL, &len) != 1
|
||||
if (!(info = asn1_oid_info_from_oid(x509_crl_entry_exts, x509_crl_entry_exts_count, oid))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, NULL, &len) != 1
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| asn1_integer_to_der(a->serial_number, a->serial_number_len, out, outlen) != 1
|
||||
|| x509_time_to_der(a->revoke_date, out, outlen) != 1
|
||||
|| x509_extension_to_der(a->exts, out, outlen) != 1) {
|
||||
|| asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int crl_revoked_cert_from_der(CRL_REVOKED_CERT *a, const uint8_t **in, size_t *inlen)
|
||||
int x509_crl_entry_ext_id_from_der(int *oid, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t datalen;
|
||||
const uint8_t *p;
|
||||
size_t len;
|
||||
const ASN1_OID_INFO *info;
|
||||
|
||||
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
|
||||
*oid = 0;
|
||||
if ((ret = asn1_oid_info_from_der(&info, x509_crl_entry_exts, x509_crl_entry_exts_count, in, inlen)) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
*oid = info->oid;
|
||||
return ret;
|
||||
}
|
||||
|
||||
int x509_crl_entry_exts_add_reason(uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical, int reason)
|
||||
{
|
||||
int oid = OID_ce_crl_reasons;
|
||||
size_t curlen = *extslen;
|
||||
uint8_t val[16];
|
||||
uint8_t *p = val;
|
||||
size_t vlen = 0;
|
||||
|
||||
if (x509_crl_reason_to_der(reason, &p, &vlen) != 1
|
||||
|| x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1
|
||||
|| asn1_length_le(curlen, maxlen) != 1
|
||||
|| x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_crl_entry_exts_add_invalidity_date(uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical, time_t tv)
|
||||
{
|
||||
int oid = OID_ce_invalidity_date;
|
||||
size_t curlen = *extslen;
|
||||
uint8_t val[16];
|
||||
uint8_t *p = val;
|
||||
size_t vlen = 0;
|
||||
|
||||
if (asn1_generalized_time_to_der(tv, &p, &vlen) != 1
|
||||
|| x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1
|
||||
|| asn1_length_le(curlen, maxlen) != 1
|
||||
|| x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_crl_entry_exts_add_certificate_issuer(uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
int oid = OID_ce_certificate_issuer;
|
||||
return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen);
|
||||
}
|
||||
|
||||
int x509_crl_entry_exts_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_revoked_cert_to_der(
|
||||
const uint8_t *serial, size_t serial_len,
|
||||
time_t revoke_date,
|
||||
const uint8_t *entry_exts, size_t entry_exts_len,
|
||||
uint8_t **out, size_t *outlen)
|
||||
{
|
||||
size_t len = 0;
|
||||
if (asn1_integer_to_der(serial, serial_len, NULL, &len) != 1
|
||||
|| asn1_generalized_time_to_der(revoke_date, NULL, &len) != 1
|
||||
|| asn1_sequence_to_der(entry_exts, entry_exts_len, NULL, &len) < 0
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| asn1_integer_to_der(serial, serial_len, out, outlen) != 1
|
||||
|| asn1_generalized_time_to_der(revoke_date, out, outlen) != 1
|
||||
|| asn1_sequence_to_der(entry_exts, entry_exts_len, out, outlen) < 0) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_revoked_cert_from_der(
|
||||
const uint8_t **serial, size_t *serial_len,
|
||||
time_t *revoke_date,
|
||||
const uint8_t **entry_exts, size_t *entry_exts_len,
|
||||
const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *d;
|
||||
size_t dlen;
|
||||
|
||||
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
|
||||
if (ret < 0) error_print();
|
||||
return ret;
|
||||
}
|
||||
if (asn1_integer_from_der(a->serial_number, &a->serial_number_len, &data, &datalen) != 1
|
||||
|| x509_time_from_der(&a->revoke_date, &data, &datalen) != 1
|
||||
|| x509_extensions_from_der(&a->exts, &data, &datalen) != 1
|
||||
|| datalen) {
|
||||
if (asn1_integer_from_der(serial, serial_len, &d, &dlen) != 1
|
||||
|| asn1_generalized_time_from_der(revoke_date, &d, &dlen) != 1
|
||||
|| asn1_sequence_from_der(entry_exts, entry_exts_len, &d, &dlen) < 0
|
||||
|| asn1_length_is_zero(dlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int crl_revoked_cert_print(FILE *fp, const CRL_REVOKED_CERT *a, int format, int indent)
|
||||
{
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int crl_tbs_cert_list_to_der(const CRL_TBS_CERT_LIST *a, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
size_t len = 0;
|
||||
if (asn1_int_to_der(a->version, NULL, &len) != 1
|
||||
|| x509_algorithm_id_to_der(a->signature_algor, NULL, &len) != 1
|
||||
|| x509_name_to_der(&a->issuer, NULL, &len) != 1
|
||||
|| x509_time_to_der(a->this_update, NULL, &len) != 1
|
||||
|| x509_time_to_der(a->next_update, NULL, &len) != 1
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| asn1_int_to_der(a->version, out, outlen) != 1
|
||||
|| x509_algorithm_id_to_der(a->signature_algor, out, outlen) != 1
|
||||
|| x509_name_to_der(&a->issuer, out, outlen) != 1
|
||||
|| x509_time_to_der(a->next_update, out, outlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int crl_tbs_cert_list_from_der(CRL_TBS_CERT_LIST *a, const uint8_t **in, size_t *inlen)
|
||||
int x509_revoked_cert_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t datalen;
|
||||
const uint8_t *p;
|
||||
size_t len;
|
||||
time_t tv;
|
||||
|
||||
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
|
||||
if (ret < 0) error_print();
|
||||
return ret;
|
||||
}
|
||||
if (asn1_int_from_der(&a->version, &data, &datalen) != 1
|
||||
|| x509_algorithm_id_from_der(&a->signature_algor, &data, &datalen) != 1
|
||||
|| x509_name_from_der(&a->issuer, &data, &datalen) != 1
|
||||
|| x509_time_from_der(&a->this_update, &data, &datalen) != 1
|
||||
|| x509_time_from_der(&a->next_update, &data, &datalen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
int x509_cert_list_to_der(const X509_CERT_LIST *a, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
size_t len = 0;
|
||||
if (x509_tbs_cert_list_to_der(&a->tbs_cert_list, NULL, &len) != 1
|
||||
|| x509_signature_algor_to_der(a->signature_algor, NULL, &len) != 1
|
||||
|| asn1_bit_string_to_der(a->signature, a->signature_len, NULL, &len) != 1
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| x509_tbs_cert_list_to_der(&a->tbs_cert_list, out, outlen) != 1
|
||||
|| x509_signature_algor_to_der(a->signature_algor, out, outlen) != 1
|
||||
|| asn1_bit_string_to_der(a->signature, a->signature_len, out, outlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_cert_list_from_der(X509_CERT_LIST *a, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t datalen;
|
||||
const uint8_t *sig;
|
||||
|
||||
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
|
||||
if (ret < 0)
|
||||
error_print();
|
||||
return ret;
|
||||
}
|
||||
if (x509_tbs_cert_list_from_der(&a->tbs_cert_list, in, inlen) != 1
|
||||
|| x509_signature_algor_from_der(&a->signature_algor, in, inlen) != 1
|
||||
|| asn1_bit_string_from_der(&sig, &a->signature_len, in, inlen) != 1
|
||||
|| a->signature_len <= 0
|
||||
|| a->signature_len >= X509_MAX_SIGNATURE_SIZE) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
memcpy(a->signature, sig, a->signature_len);
|
||||
if (asn1_integer_from_der(&p, &len, &d, &dlen) != 1) goto err;
|
||||
format_bytes(fp, fmt, ind, "userCertificate", p, len);
|
||||
if (asn1_generalized_time_from_der(&tv, &d, &dlen) != 1) goto err;
|
||||
format_print(fp, fmt, ind, "revocationDate: %s\n", ctime(&tv));
|
||||
if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err;
|
||||
//if (ret) x509_crl_entry_exts_print(fp, fmt, ind, "crlEntryExtensions", p, len); // 这里需要一个函数能够处理
|
||||
if (asn1_length_is_zero(dlen) != 1) goto err;
|
||||
return 1;
|
||||
err:
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
static const int X509_CRLExtensionOIDs[7] = {
|
||||
OID_id_ce_authorityKeyIdentifier,
|
||||
OID_id_ce_issuerAltName,
|
||||
OID_id_ce_cRLNumber,
|
||||
OID_id_ce_deltaCRLIndicator,
|
||||
OID_id_ce_issuingDistributionPoint,
|
||||
OID_id_ce_freshestCRL,
|
||||
OID_pe_authorityInfoAccess,
|
||||
static uint32_t oid_ce_authority_key_identifier[] = { oid_ce,35 };
|
||||
static uint32_t oid_ce_issuer_alt_name[] = { oid_ce,18 };
|
||||
static uint32_t oid_ce_crl_number[] = { oid_ce,20 };
|
||||
static uint32_t oid_ce_delta_crl_indicator[] = { oid_ce,27 };
|
||||
static uint32_t oid_ce_issuing_distribution_point[] = { oid_ce,28 };
|
||||
|
||||
static const ASN1_OID_INFO x509_crl_exts[] = {
|
||||
{ OID_ce_authority_key_identifier, "AuthorityKeyIdentifier", oid_ce_authority_key_identifier, sizeof(oid_ce_authority_key_identifier)/sizeof(int) },
|
||||
{ OID_ce_issuer_alt_name, "IssuerAltName", oid_ce_issuer_alt_name, sizeof(oid_ce_issuer_alt_name)/sizeof(int) },
|
||||
{ OID_ce_crl_number, "CRLNumber", oid_ce_crl_number, sizeof(oid_ce_crl_number)/sizeof(int) },
|
||||
{ OID_ce_delta_crl_indicator, "DeltaCRLIndicator", oid_ce_delta_crl_indicator, sizeof(oid_ce_delta_crl_indicator)/sizeof(int) },
|
||||
{ OID_ce_issuing_distribution_point, "IssuingDistributionPoint", oid_ce_issuing_distribution_point, sizeof(oid_ce_issuing_distribution_point)/sizeof(int) }
|
||||
};
|
||||
|
||||
static const int x509_crl_exts_count =
|
||||
sizeof(x509_crl_exts)/sizeof(x509_crl_exts[0]);
|
||||
|
||||
|
||||
void X509_CRLExtensionValue_to_der(const X509_CRLExtensionValue *a, int type, uint8_t **out, size_t *outlen)
|
||||
const char *x509_crl_ext_id_name(int oid)
|
||||
{
|
||||
switch (type) {
|
||||
case OID_id_ce_authorityKeyIdentifier: AuthorityKeyIdentifier_to_der(&a->u.authorityKeyIdentifier, out, outlen); break;
|
||||
case OID_id_ce_issuerAltName: X509_GeneralNames_to_der(&a->u.issuerAltName, out, outlen); break;
|
||||
case OID_id_ce_cRLNumber: ASN1_INTEGER_to_der(&a->u.cRLNumber, out, outlen); break;
|
||||
case OID_id_ce_deltaCRLIndicator: ASN1_INTEGER_to_der(&a->u.deltaCRLIndicator, out, outlen);
|
||||
case OID_id_ce_issuingDistributionPoint: X509_IssuingDistributionPoint_to_der(&a->u.issuingDistributionPoint, out, outlen);
|
||||
case OID_id_ce_freshestCRL: X509_CRLDistributionPoints_to_der(&a->u.freshestCRL, out, outlen);
|
||||
case OID_pe_authorityInfoAccess: X509_AuthorityInfoAccessSyntax_to_der(&a->u.authorityInfoAccess, out, outlen);
|
||||
const ASN1_OID_INFO *info;
|
||||
if (!(info = asn1_oid_info_from_oid(x509_crl_exts, x509_crl_exts_count, oid))) {
|
||||
error_print();
|
||||
return NULL;
|
||||
}
|
||||
return info->name;
|
||||
}
|
||||
|
||||
int X509_CRLExtensionValue_from_der(X509_CRLExtensionValue *a, int type, const uint8_t **in, size_t *inlen)
|
||||
int x509_crl_ext_id_from_name(const char *name)
|
||||
{
|
||||
switch (type) {
|
||||
case OID_id_ce_authorityKeyIdentifier: return AuthorityKeyIdentifier_from_der(&a->u.authorityKeyIdentifier, in, inlen);
|
||||
case OID_id_ce_issuerAltName: return X509_GeneralNames_from_der(&a->u.issuerAltName, in, inlen);
|
||||
case OID_id_ce_cRLNumber: return ASN1_INTEGER_from_der(&a->u.cRLNumber, in, inlen);
|
||||
case OID_id_ce_deltaCRLIndicator: return ASN1_INTEGER_from_der(&a->u.deltaCRLIndicator, in, inlen);
|
||||
case OID_id_ce_issuingDistributionPoint: return X509_IssuingDistributionPoint_from_der(&a->u.issuingDistributionPoint, in, inlen);
|
||||
case OID_id_ce_freshestCRL: return X509_CRLDistributionPoints_from_der(&a->u.freshestCRL, in, inlen);
|
||||
case OID_pe_authorityInfoAccess: return X509_AuthorityInfoAccessSyntax_from_der(&a->u.authorityInfoAccess, in, inlen);
|
||||
const ASN1_OID_INFO *info;
|
||||
if (!(info = asn1_oid_info_from_name(x509_crl_exts, x509_crl_exts_count, name))) {
|
||||
error_print();
|
||||
return OID_undef;
|
||||
}
|
||||
return info->oid;
|
||||
}
|
||||
|
||||
|
||||
|
||||
void X509_CRLExtension_to_der(const X509_CRLExtension *a, uint8_t **out, size_t *outlen)
|
||||
int x509_crl_ext_id_to_der(int oid, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
ASN1_SEQUENCE_tag_length_to_der((ASN1_SEQUENCE *)a, out, outlen);
|
||||
ASN1_OBJECT_IDENTIFIER_to_der(&a->extnID, out, outlen);
|
||||
ASN1_BOOLEAN_to_der(&a->critical, out, outlen);
|
||||
ASN1_OCTET_STRING_tag_length_to_der(&a->extnValue, out, outlen);
|
||||
X509_CRLExtensionValue_to_der(&a->extnValue_data, out, outlen);
|
||||
}
|
||||
|
||||
int X509_CRLExtension_from_der(X509_CRLExtension *a, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t length;
|
||||
|
||||
if ((ret = ASN1_SEQUENCE_from_der((ASN1_SEQUENCE *)a, in, inlen)) <= 0) {
|
||||
return ret;
|
||||
}
|
||||
data = ((ASN1_SEQUENCE *)a)->data;
|
||||
length = ((ASN1_SEQUENCE *)a)->length;
|
||||
if (ASN1_OBJECT_IDENTIFIER_from_der(&a->extnID, &data, &length) <= 0
|
||||
|| ASN1_BOOLEAN_from_der(&a->critical, &data, &length) < 0
|
||||
|| ASN1_OCTET_STRING_from_der(&a->extnValue, &data, &length) <= 0
|
||||
|| length > 0) {
|
||||
const ASN1_OID_INFO *info;
|
||||
size_t len = 0;
|
||||
if (!(info = asn1_oid_info_from_oid(x509_crl_exts, x509_crl_exts_count, oid))) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
data = a->extnValue.data;
|
||||
length = a->extnValue.length;
|
||||
if (X509_CRLExtensionValue_from_der(&a->extnValue_data, &data, &length) < 0
|
||||
|| length > 0) {
|
||||
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, NULL, &len) != 1
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
void X509_CRLExtensions_add(X509_CRLExtensions *a, const X509_CRLExtension *value)
|
||||
{
|
||||
size_t length = ((ASN1_SEQUENCE *)a)->length;
|
||||
assert(a->count < 16);
|
||||
X509_CRLExtension_copy(&a->values[a->count], value);
|
||||
X509_CRLExtension_to_der(&a->values[a->count], NULL, &length);
|
||||
ASN1_SEQUENCE_set((ASN1_SEQUENCE *)a, NULL, length);
|
||||
a->count++;
|
||||
}
|
||||
|
||||
void X509_CRLExtensions_to_der(const X509_CRLExtensions *a, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
int i;
|
||||
ASN1_SEQUENCE_tag_length_to_der((ASN1_SEQUENCE *)a, out, outlen);
|
||||
for (i = 0; i < a->count; i++) {
|
||||
X509_CRLExtension_to_der(&a->value[i], out, outlen);
|
||||
}
|
||||
}
|
||||
|
||||
int X509_CRLExtensions_from_der(X509_CRLExtensions *a, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t length;
|
||||
|
||||
if ((ret = ASN1_SEQUENCE_from_der((ASN1_SEQUENCE *)a, in, inlen)) <= 0) {
|
||||
return ret;
|
||||
}
|
||||
data = ((ASN1_SEQUENCE *)a)->data;
|
||||
length = ((ASN1_SEQUENCE *)a)->length;
|
||||
while (length > 0) {
|
||||
if (a->count >= 16
|
||||
|| X509_CRLExtension_from_der(&a->values[a->count], &data, &length) <= 0) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
// 5.2.5. Issuing Distribution Point
|
||||
/*
|
||||
-- issuing distribution point extension OID and syntax
|
||||
|
||||
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
|
||||
|
||||
IssuingDistributionPoint ::= SEQUENCE {
|
||||
distributionPoint [0] IMPLICIT DistributionPointName OPTIONAL,
|
||||
onlyContainsUserCerts [1] IMPLICIT BOOLEAN DEFAULT FALSE,
|
||||
onlyContainsCACerts [2] IMPLICIT BOOLEAN DEFAULT FALSE,
|
||||
onlySomeReasons [3] IMPLICIT ReasonFlags OPTIONAL,
|
||||
indirectCRL [4] IMPLICIT BOOLEAN DEFAULT FALSE,
|
||||
onlyContainsAttributeCerts [5] IMPLICIT BOOLEAN DEFAULT FALSE }
|
||||
-- at most one of onlyContainsUserCerts, onlyContainsCACerts,
|
||||
-- and onlyContainsAttributeCerts may be set to TRUE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
void X509_CRLEntryExtension_to_der(const X509_CRLEntryExtension *a, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
ASN1_SEQUENCE_tag_length_to_der((ASN1_SEQUENCE *)a, out, outlen);
|
||||
ASN1_OBJECT_IDENTIFIER_to_der(&a->extnID, out, outlen);
|
||||
ASN1_BOOLEAN_to_der(&a->critical, out, outlen);
|
||||
ASN1_OCTET_STRING_tag_length_to_der(&a->extnValue, out, outlen);
|
||||
X509_CRLEntryExtensionValue_to_der(&a->extnValue_data, out, outlen);
|
||||
}
|
||||
|
||||
int X509_CRLEntryExtension_from_der(X509_CRLEntryExtension *a, const uint8_t **in, size_t *inlen)
|
||||
int x509_crl_ext_id_from_der(int *oid, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t length;
|
||||
const uint8_t *p;
|
||||
size_t len;
|
||||
const ASN1_OID_INFO *info;
|
||||
|
||||
if ((ret = ASN1_SEQUENCE_from_der((ASN1_SEQUENCE *)a, in, inlen)) <= 0) {
|
||||
return ret;
|
||||
}
|
||||
data = ((ASN1_SEQUENCE *)a)->data;
|
||||
length = ((ASN1_SEQUENCE *)a)->length;
|
||||
if (ASN1_OBJECT_IDENTIFIER_from_der(&a->extnID, &data, &length) <= 0
|
||||
|| ASN1_BOOLEAN_from_der(&a->critical, &data, &length) < 0
|
||||
|| ASN1_OCTET_STRING_from_der(&a->extnValue, &data, &length) <= 0
|
||||
|| length > 0) {
|
||||
*oid = 0;
|
||||
if ((ret = asn1_oid_info_from_der(&info, x509_crl_exts, x509_crl_exts_count, in, inlen)) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
data = a->extnValue.data;
|
||||
length = a->extnValue.length;
|
||||
if (X509_CRLEntryExtensionValue_from_der(&a->extnValue_data, &data, &length) < 0
|
||||
|| length > 0) {
|
||||
*oid = info->oid;
|
||||
return ret;
|
||||
}
|
||||
|
||||
int x509_crl_exts_add_authority_key_identifier(
|
||||
uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical,
|
||||
const uint8_t *keyid, size_t keyid_len,
|
||||
const uint8_t *issuer, size_t issuer_len,
|
||||
const uint8_t *serial, size_t serial_len)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_exts_add_issuer_alt_name(
|
||||
uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical,
|
||||
const uint8_t *d, size_t dlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_exts_add_crl_number(
|
||||
uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical,
|
||||
int num)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_exts_add_delta_crl_indicator(
|
||||
uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical,
|
||||
int num)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_exts_add_issuing_distribution_point(
|
||||
uint8_t *exts, size_t *extslen, size_t maxlen,
|
||||
int critical,
|
||||
const uint8_t *dist_point, size_t dist_point_len,
|
||||
int only_contains_user_certs,
|
||||
int only_contains_ca_certs,
|
||||
int only_some_reasons,
|
||||
int indirect_crl,
|
||||
int only_contains_attr_certs)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_exts_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_tbs_crl_to_der(
|
||||
int version,
|
||||
int signature_algor,
|
||||
const uint8_t *issuer, size_t issuer_len,
|
||||
time_t this_update, time_t next_update,
|
||||
const uint8_t *revoked_certs, size_t revoked_certs_len,
|
||||
const uint8_t *exts, size_t exts_len,
|
||||
uint8_t **out, size_t *outlen)
|
||||
{
|
||||
size_t len = 0;
|
||||
if (asn1_int_to_der(version, NULL, &len) < 0
|
||||
|| x509_signature_algor_to_der(signature_algor, NULL, &len) < 0
|
||||
|| asn1_sequence_to_der(issuer, issuer_len, NULL, &len) != 1
|
||||
|| x509_time_to_der(this_update, NULL, &len) != 1
|
||||
|| x509_time_to_der(next_update, NULL, &len) < 0
|
||||
|| asn1_sequence_to_der(revoked_certs, revoked_certs_len, NULL, &len) < 0
|
||||
|| asn1_sequence_to_der(exts, exts_len, NULL, &len) < 0
|
||||
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|
||||
|| asn1_int_to_der(version, out, outlen) < 0
|
||||
|| x509_signature_algor_to_der(signature_algor, out, outlen) < 0
|
||||
|| asn1_sequence_to_der(issuer, issuer_len, out, outlen) != 1
|
||||
|| x509_time_to_der(this_update, out, outlen) != 1
|
||||
|| x509_time_to_der(next_update, out, outlen) < 0
|
||||
|| asn1_sequence_to_der(revoked_certs, revoked_certs_len, out, outlen) < 0
|
||||
|| asn1_sequence_to_der(exts, exts_len, out, outlen) < 0) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
// CRL Entry Extensions
|
||||
//***********************************************************************************************************
|
||||
|
||||
static const int X509_CRLEntryExtensionOIDs[3] = {
|
||||
OID_id_ce_cRLReasons,
|
||||
OID_id_ce_invalidityDate,
|
||||
OID_id_ce_certificateIssuer,
|
||||
};
|
||||
|
||||
|
||||
|
||||
void X509_CRLEntryExtensionValue_to_der(const X509_CRLEntryExtensionValue *a, int type, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
switch (type) {
|
||||
case OID_id_ce_cRLReasons: ASN1_ENUMERATED_to_der(&a->u.reasonCode, out, outlen); break;
|
||||
case OID_id_ce_invalidityDate: X509_GeneralizedTime_to_der(&a->u.invalidityDate, out, outlen); break;
|
||||
case OID_id_ce_certificateIssuer: X509_GeneralNames_to_der(&a->u.certificateIssuer, out, outlen); break;
|
||||
}
|
||||
}
|
||||
|
||||
int X509_CRLEntryExtensionValue_from_der(X509_CRLEntryExtensionValue *a, int type, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
switch (type) {
|
||||
case OID_id_ce_cRLReasons: return ASN1_ENUMERATED_to_der(&a->u.reasonCode, in, inlen);
|
||||
case OID_id_ce_invalidityDate: return X509_GeneralizedTime_to_der(&a->u.invalidityDate, in, inlen);
|
||||
case OID_id_ce_certificateIssuer: return X509_GeneralNames_to_der(&a->u.certificateIssuer, in, inlen);
|
||||
}
|
||||
}
|
||||
|
||||
void X509_CRLEntryExtensions_add(X509_CRLEntryExtensions *a, const X509_CRLEntryExtension *value)
|
||||
{
|
||||
size_t length = ((ASN1_SEQUENCE *)a)->length;
|
||||
assert(a->count < 16);
|
||||
X509_CRLEntryExtension_copy(&a->values[a->count], value);
|
||||
X509_CRLEntryExtension_to_der(&a->values[a->count], NULL, &length);
|
||||
ASN1_SEQUENCE_set((ASN1_SEQUENCE *)a, NULL, length);
|
||||
a->count++;
|
||||
}
|
||||
|
||||
void X509_CRLEntryExtensions_to_der(const X509_CRLEntryExtensions *a, uint8_t **out, size_t *outlen)
|
||||
{
|
||||
int i;
|
||||
ASN1_SEQUENCE_tag_length_to_der((ASN1_SEQUENCE *)a, out, outlen);
|
||||
for (i = 0; i < a->count; i++) {
|
||||
X509_CRLEntryExtension_to_der(&a->value[i], out, outlen);
|
||||
}
|
||||
}
|
||||
|
||||
int X509_CRLEntryExtensions_from_der(X509_CRLExtensions *a, const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
int ret;
|
||||
const uint8_t *data;
|
||||
size_t length;
|
||||
|
||||
if ((ret = ASN1_SEQUENCE_from_der((ASN1_SEQUENCE *)a, in, inlen)) <= 0) {
|
||||
return ret;
|
||||
}
|
||||
data = ((ASN1_SEQUENCE *)a)->data;
|
||||
length = ((ASN1_SEQUENCE *)a)->length;
|
||||
while (length > 0) {
|
||||
if (a->count >= 16
|
||||
|| X509_CRLEntryExtension_from_der(&a->values[a->count], &data, &length) <= 0) {
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_tbs_crl_from_der(
|
||||
int *version,
|
||||
int *signature_algor,
|
||||
const uint8_t **issuer, size_t *issuer_len,
|
||||
time_t *this_update,
|
||||
time_t *next_update,
|
||||
const uint8_t **revoked_certs, size_t *revoked_certs_len,
|
||||
const uint8_t **exts, size_t *exts_len,
|
||||
uint8_t **in, size_t *inlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_tbs_crl_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_cert_list_to_der(const uint8_t *tbs_crl, size_t tbs_crl_len,
|
||||
int signature_algor, const uint8_t *sig, size_t siglen,
|
||||
uint8_t **out, size_t *outlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_cert_list_from_der(const uint8_t **tbs_crl, size_t *tbs_crl_len,
|
||||
int *signature_algor, const uint8_t **sig, size_t *siglen,
|
||||
const uint8_t **in, size_t *inlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_cert_list_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_to_pem(const uint8_t *a, size_t *alen, FILE *fp)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_crl_from_pem(uint8_t *a, size_t *alen, size_t maxlen, FILE *fp)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_crl_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_tbs_crl_sign(
|
||||
int version,
|
||||
int signature_algor,
|
||||
const uint8_t *issuer, size_t issuer_len,
|
||||
time_t this_update, time_t next_update,
|
||||
const uint8_t *revoked_certs, size_t revoked_certs_len,
|
||||
const uint8_t *exts, size_t exts_len,
|
||||
const SM2_KEY *sign_key, const char *signer_id, size_t signer_id_len,
|
||||
uint8_t *crl, size_t *crl_len)
|
||||
{
|
||||
uint8_t tbs[512];
|
||||
size_t tbslen;
|
||||
SM2_SIGN_CTX sign_ctx;
|
||||
uint8_t sig[SM2_MAX_SIGNATURE_SIZE];
|
||||
size_t siglen;
|
||||
uint8_t *p = tbs;
|
||||
size_t len = 0;
|
||||
uint8_t *out = crl;
|
||||
size_t outlen = 0;
|
||||
|
||||
if (x509_tbs_crl_to_der(version, signature_algor, issuer, issuer_len,
|
||||
this_update, next_update, revoked_certs, revoked_certs_len,
|
||||
exts, exts_len, &p, &tbslen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm2_sign_init(&sign_ctx, sign_key, signer_id, signer_id_len) != 1
|
||||
|| sm2_sign_update(&sign_ctx, tbs, tbslen) != 1
|
||||
|| sm2_sign_finish(&sign_ctx, sig, &siglen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (asn1_data_to_der(tbs, tbslen, NULL, &len) != 1
|
||||
|| x509_signature_algor_to_der(signature_algor, NULL, &len) != 1
|
||||
|| asn1_bit_octets_to_der(sig, siglen, NULL, &len) != 1
|
||||
|| asn1_sequence_header_to_der(len, &out, &outlen) != 1
|
||||
|| asn1_data_to_der(tbs, tbslen, &out, &outlen) != 1
|
||||
|| x509_signature_algor_to_der(signature_algor, &out, &outlen) != 1
|
||||
|| asn1_bit_octets_to_der(sig, siglen, &out, &outlen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
*crl_len = outlen;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int x509_crl_verify(const uint8_t *a, size_t alen,
|
||||
const SM2_KEY *signer_key, const char *signer_id, size_t signer_id_len)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_get_details(const uint8_t *crl, size_t crl_len,
|
||||
int *version,
|
||||
const uint8_t **issuer, size_t *issuer_len,
|
||||
time_t *this_update,
|
||||
time_t *next_update,
|
||||
const uint8_t **revoked_certs, size_t *revoked_certs_len,
|
||||
int *signature_algor,
|
||||
const uint8_t *sig, size_t *siglen)
|
||||
{
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
int x509_crl_get_revoked_cert_by_serial_number(const uint8_t *a, size_t alen,
|
||||
const uint8_t *serial, size_t serial_len,
|
||||
time_t *revoke_date,
|
||||
const uint8_t **entry_exts, size_t *entry_exts_len)
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user