abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-07 08:56:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update tests and tools

Browse Source
This commit is contained in:
Zhi Guan
2022-03-16 15:12:29 +08:00
parent 2c2425d230
commit ea4cc6585c
52 changed files with 3600 additions and 3216 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
src/asn1.c
View File

@@ -59,9 +59,6 @@
#include "endian.h"
//FIXME: ENUMERATED 没有支持，在CRLReason中用到
/*
## 返回值
@@ -113,7 +110,10 @@ const char *asn1_tag_name(int tag)
case ASN1_TAG_EXTERNAL: return "EXTERNAL";
case ASN1_TAG_REAL: return "REAL";
case ASN1_TAG_ENUMERATED: return "ENUMERATED";
case ASN1_TAG_EMBEDDED: return "EMBEDDED";
case ASN1_TAG_UTF8String: return "UTF8String";
case ASN1_TAG_RELATIVE_OID: return "RELATIVE_OID";
case ASN1_TAG_NumericString: return "NumericString";
case ASN1_TAG_PrintableString: return "PrintableString";
case ASN1_TAG_TeletexString: return "TeletexString";
case ASN1_TAG_VideotexString: return "VideotexString";
@@ -128,6 +128,7 @@ const char *asn1_tag_name(int tag)
case ASN1_TAG_BMPString: return "BMPString";
case ASN1_TAG_SEQUENCE: return "SEQUENCE";
case ASN1_TAG_SET: return "SET";
case ASN1_TAG_EXPLICIT: return "EXPLICIT";
}
error_print();
@@ -221,11 +222,9 @@ int asn1_data_to_der(const uint8_t *data, size_t datalen, uint8_t **out, size_t
int asn1_tag_from_der(int tag, const uint8_t **in, size_t *inlen)
{
if (*inlen == 0) {
//error_print_msg("inlen = %zu\n", *inlen);
return 0;
}
if (**in != tag) {
//error_print_msg("tag get %d instead of %d\n", **in, tag);
return 0;
}
(*in)++;
@@ -276,15 +275,15 @@ int asn1_length_from_der(size_t *plen, const uint8_t **pin, size_t *pinlen)
inlen -= nbytes;
}
if (inlen < len) {
error_print_msg("inlen = %zu\n", *pinlen);
error_print_msg("length = %zu, left = %zu\n", len, inlen);
return -1;
}
*plen = len;
*pin = in;
*pinlen = inlen;
if (inlen < len) {
error_print_msg("inlen = %zu\n", *pinlen);
error_print_msg("length = %zu, left = %zu\n", len, inlen);
return -2; // 特殊错误值用于 test_asn1_length() 的测试
}
return 1;
}
@@ -476,27 +475,19 @@ int asn1_int_to_der_ex(int tag, int a, uint8_t **out, size_t *outlen)
int asn1_bit_string_to_der_ex(int tag, const uint8_t *bits, size_t nbits, uint8_t **out, size_t *outlen)
{
int unused = (8 - nbits % 8) % 8;
uint8_t unused = (8 - nbits % 8) % 8;
size_t nbytes = (nbits + 7) / 8;
if (!bits || nbits >= INT_MAX || (out && !(*out)) || !outlen) {
if (!bits) {
return 0;
}
if (asn1_tag_to_der(tag, out, outlen) != 1
|| asn1_length_to_der(nbytes + 1, out, outlen) != 1
|| asn1_data_to_der(&unused, 1, out, outlen) != 1
|| asn1_data_to_der(bits, nbytes, out, outlen) != 1) {
error_print();
return -1;
}
if (out)
*(*out)++ = tag;
(*outlen)++;
asn1_length_to_der(nbytes + 1, out, outlen);
if (out) {
*(*out)++ = (uint8_t)unused;
memcpy(*out, bits, nbytes);
(*out) += nbytes;
}
*outlen += 1 + nbytes;
return 1;
}
@@ -505,22 +496,25 @@ int asn1_bit_octets_to_der_ex(int tag, const uint8_t *octs, size_t nocts, uint8_
return asn1_bit_string_to_der_ex(tag, octs, nocts << 3, out, outlen);
}
int asn1_bits_to_der_ex(int tag, int bits, uint8_t **out, size_t *outlen)
{
size_t nbits = 0;
uint8_t buf[4] = {0};
int i = 0;
uint8_t mask = 0x80;
if (bits < 0) {
return 0;
}
while (bits) {
buf[i] = (buf[i] << 1) | (bits & 1);
while (bits > 0) {
if (bits & 1)
buf[i] |= mask;
mask >>= 1;
bits >>= 1;
nbits++;
if (nbits % 8) {
if (nbits % 8 == 0) {
i++;
mask = 0x80;
}
}
if (!nbits) {
@@ -643,9 +637,11 @@ int asn1_object_identifier_from_octets(uint32_t *nodes, size_t *nodes_cnt, const
while (inlen) {
uint32_t val;
if (count > 32) {
error_print();
return -1;
}
if (asn1_oid_node_from_base128(&val, &in, &inlen) < 0) {
error_print();
return -1;
}
if (nodes) {
@@ -706,8 +702,6 @@ const ASN1_OID_INFO *asn1_oid_info_from_oid(const ASN1_OID_INFO *infos, size_t c
return NULL;
}
// 这个函数可以支持未知的OID，通常只有在print或者解析Extensions时需要调用该函数
// 注意：函数有特殊返回值
int asn1_oid_info_from_der_ex(const ASN1_OID_INFO **info, uint32_t *nodes, size_t *nodes_cnt,
const ASN1_OID_INFO *infos, size_t count, const uint8_t **in, size_t *inlen)
{
@@ -716,6 +710,7 @@ int asn1_oid_info_from_der_ex(const ASN1_OID_INFO **info, uint32_t *nodes, size_
if ((ret = asn1_object_identifier_from_der(nodes, nodes_cnt, in, inlen)) != 1) {
if (ret < 0) error_print();
if (ret == 0) error_print();
return ret;
}
*info = NULL;
@@ -726,7 +721,8 @@ int asn1_oid_info_from_der_ex(const ASN1_OID_INFO **info, uint32_t *nodes, size_
return 1;
}
}
return 2; // 返回非1的正整数表示OID格式正确但是不在给定列表中
// 注意，此时虽然返回1，但是*info == NULL，因此调用方应该显式的判断info
return 1;
}
int asn1_oid_info_from_der(const ASN1_OID_INFO **info, const ASN1_OID_INFO *infos, size_t count, const uint8_t **in, size_t *inlen)
@@ -777,13 +773,12 @@ int asn1_ia5_string_to_der_ex(int tag, const char *d, size_t dlen, uint8_t **out
int asn1_utc_time_to_der_ex(int tag, time_t a, uint8_t **out, size_t *outlen)
{
struct tm tm_val;
char buf[sizeof("YYMMDDHHMMSSZ")];
char buf[ASN1_UTC_TIME_LEN + 1];
if ((out && !(*out)) || !outlen) {
return -1;
}
// 注意，这个函数可能在Windows上是没有的！
gmtime_r(&a, &tm_val);
strftime(buf, sizeof(buf), "%y%m%d%H%M%SZ", &tm_val);
@@ -800,10 +795,11 @@ int asn1_utc_time_to_der_ex(int tag, time_t a, uint8_t **out, size_t *outlen)
return 1;
}
int asn1_generalized_time_to_der_ex(int tag, time_t a, uint8_t **out, size_t *outlen)
{
struct tm tm_val;
char buf[sizeof("YYYYMMDDHHMMSSZ")];
char buf[ASN1_GENERALIZED_TIME_LEN + 1];
if ((out && !(*out)) || !outlen) {
error_print();
@@ -812,16 +808,17 @@ int asn1_generalized_time_to_der_ex(int tag, time_t a, uint8_t **out, size_t *ou
gmtime_r(&a, &tm_val);
strftime(buf, sizeof(buf), "%Y%m%d%H%M%SZ", &tm_val);
//printf("%s %d: generalized time : %s\n", __FILE__, __LINE__, buf);
if (out)
*(*out)++ = tag;
(*outlen)++;
asn1_length_to_der(sizeof(buf)-1, out, outlen);
asn1_length_to_der(ASN1_GENERALIZED_TIME_LEN, out, outlen);
if (out) {
memcpy(*out, buf, sizeof(buf)-1);
(*out) += sizeof(buf)-1;
memcpy(*out, buf, ASN1_GENERALIZED_TIME_LEN);
(*out) += ASN1_GENERALIZED_TIME_LEN;
}
*outlen += sizeof(buf)-1;
*outlen += ASN1_GENERALIZED_TIME_LEN;
return 1;
}
@@ -951,41 +948,45 @@ int asn1_int_from_der_ex(int tag, int *a, const uint8_t **in, size_t *inlen)
return 1;
}
int asn1_bit_string_from_der_ex(int tag, const uint8_t **bits, size_t *nbits, const uint8_t **pin, size_t *pinlen)
int asn1_bit_string_from_der_ex(int tag, const uint8_t **bits, size_t *nbits, const uint8_t **in, size_t *inlen)
{
const uint8_t *in = *pin;
size_t inlen = *pinlen;
int ret;
size_t len;
int unused_bits;
if (!bits || !nbits || !pin || !(*pin) || !pinlen) {
if ((ret = asn1_tag_from_der(tag, in, inlen)) != 1) {
if (ret < 0) error_print();
else {
*bits = NULL;
*nbits = 0;
}
return ret;
}
if (asn1_length_from_der(&len, in, inlen) != 1
|| asn1_data_from_der(bits, len, in, inlen) != 1) {
error_print();
return -1;
}
if (len < 2) {
error_print();
return -1;
}
// FIXME: 其他函数可能存在类似情况
*bits = NULL;
*nbits = 0;
if (inlen-- < 1 || *in++ != tag) {
return 0;
}
if (asn1_length_from_der(&len, &in, &inlen) != 1
|| len <= 0) {
unused_bits = **bits;
if (len < 1) {
error_print();
return -1;
}
unused_bits = *in;
if (unused_bits > 8 || (len == 1 && unused_bits > 0)) {
error_print();
return -1;
}
*bits = in + 1;
*nbits = (len - 1) * 8 - unused_bits;
*pin = in + len;
*pinlen = inlen - len;
(*bits)++;
*nbits = (len - 1) << 3;
return 1;
}
@@ -1051,32 +1052,22 @@ int asn1_null_from_der(const uint8_t **in, size_t *inlen)
}
int asn1_object_identifier_from_der_ex(int tag, uint32_t *nodes, size_t *nodes_cnt,
const uint8_t **pin, size_t *pinlen)
const uint8_t **in, size_t *inlen)
{
const uint8_t *in = *pin;
size_t inlen = *pinlen;
int ret;
size_t len;
const uint8_t *p;
if (!nodes || !nodes_cnt || !pin || !(*pin) || !pinlen) {
if ((ret = asn1_tag_from_der(tag, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_length_from_der(&len, in, inlen) != 1
|| asn1_data_from_der(&p, len, in, inlen) != 1
|| asn1_object_identifier_from_octets(nodes, nodes_cnt, p, len) != 1) {
error_print();
return -1;
}
if (inlen-- <= 0 || *in++ != tag) {
error_print();
return 0;
}
if (asn1_length_from_der(&len, &in, &inlen) != 1
|| len <= 0) {
error_print();
return -1;
}
if (asn1_object_identifier_from_octets(nodes, nodes_cnt, in, len) != 1) {
error_print();
return -1;
}
*pin = in + len;
*pinlen = inlen - len;
return 1;
}
@@ -1206,8 +1197,6 @@ int asn1_generalized_time_from_der_ex(int tag, time_t *t, const uint8_t **pin, s
}
memcpy(buf, in, len);
if (len == sizeof("YYYYMMDDHHMMSSZ")-1) {
if (!strptime(buf, "%Y%m%d%H%M%SZ", &tm_val)) {
error_print();
@@ -1312,7 +1301,17 @@ int asn1_sequence_of_int_from_der(int *nums, size_t *nums_cnt, const uint8_t **i
int asn1_sequence_of_int_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return -1;
int val;
format_print(fp, fmt, ind, "%s: ", label);
while (dlen) {
if (asn1_int_from_der(&val, &d, &dlen) != 1) {
error_print();
return -1;
}
fprintf(fp, "%d%s", val, dlen ? "," : "");
}
fprintf(fp, "\n");
return 1;
}
@@ -1320,11 +1319,15 @@ int asn1_object_identifier_print(FILE *fp, int format, int indent, const char *l
const uint32_t *nodes, size_t nodes_cnt)
{
size_t i;
format_print(fp, format, indent, "%s: %s (", label, name);
for (i = 0; i < nodes_cnt - 1; i++) {
fprintf(fp, "%d.", (int)nodes[i]);
format_print(fp, format, indent, "%s: %s", label, name);
if (nodes) {
fprintf(fp, " (");
for (i = 0; i < nodes_cnt - 1; i++) {
fprintf(fp, "%d.", (int)nodes[i]);
}
fprintf(fp, "%d)", nodes[i]);
}
fprintf(fp, "%d)\n", nodes[i]);
fprintf(fp, "\n");
return 1;
}
@@ -1345,10 +1348,8 @@ int asn1_bits_print(FILE *fp, int fmt, int ind, const char *label, const char **
for (i = 0; i < names_cnt; i++) {
if (bits & 0x01)
fprintf(fp, "%s", names[i]);
fprintf(fp, "%s%s", names[i], bits >> 1 ? "," : "");
bits >>= 1;
if (bits)
fprintf(fp, ", ");
}
fprintf(fp, "\n");
if (bits) {
@@ -1358,7 +1359,6 @@ int asn1_bits_print(FILE *fp, int fmt, int ind, const char *label, const char **
return 1;
}
int asn1_types_get_count(const uint8_t *d, size_t dlen, int tag, size_t *cnt)
{
error_print();
@@ -1371,11 +1371,3 @@ int asn1_types_get_item_by_index(const uint8_t *d, size_t *dlen, int tag,
error_print();
return -1;
}

2
src/cms.c
View File

@@ -1975,7 +1975,7 @@ int cms_key_agreement_info_print(FILE *fp, int fmt, int ind, const char *label,
if (sm2_public_key_info_from_der(&pub_key, &d, &dlen) != 1) goto err;
sm2_public_key_print(fp, fmt, ind, "tempPublicKeyR", &pub_key);
if (x509_cert_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_cert_print(fp, fmt, ind, p, len);
x509_cert_print(fp, fmt, ind, "certificate", p, len);
if (asn1_octet_string_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "userID", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;

2
src/debug.c
View File

@@ -107,7 +107,7 @@ int format_bytes(FILE *fp, int format, int indent, const char *str, const uint8_
for (i = 0; i < indent; i++) {
fprintf(fp, " ");
}
fprintf(fp, "%s", str);
fprintf(fp, "%s: ", str);
if (!datalen) {
fprintf(fp, "(null)\n");
return 1;

15
src/pem.c
View File

@@ -67,7 +67,8 @@ int pem_write(FILE *fp, const char *name, const uint8_t *data, size_t datalen)
ret += fprintf(fp, "-----BEGIN %s-----\n", name);
ret += fprintf(fp, "%s", (char *)b64);
ret += fprintf(fp, "-----END %s-----\n", name);
return ret;
//return ret;
return 1;
}
int pem_read(FILE *fp, const char *name, uint8_t *data, size_t *datalen, size_t maxlen)
@@ -81,11 +82,19 @@ int pem_read(FILE *fp, const char *name, uint8_t *data, size_t *datalen, size_t
snprintf(begin_line, sizeof(begin_line), "-----BEGIN %s-----\n", name);
snprintf(end_line, sizeof(end_line), "-----END %s-----\n", name);
if (!fgets(line, sizeof(line), fp)) {
//FIXME: feof 判断是不是文件结束了呢
if (feof(fp)) {
return 0;
}
if (!fgets(line, sizeof(line), fp)) {
if (feof(fp))
return 0;
else {
error_print();
return -1;
}
}
if (strcmp(line, begin_line) != 0) {
// FIXME: 这里是不是应该容忍一些错误呢？
error_print();

582
src/pkcs8.c
View File

@@ -1,4 +1,4 @@
/*
/*
* Copyright (c) 2021 - 2021 The GmSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -58,22 +58,69 @@
#include <gmssl/digest.h>
#include <gmssl/sm4.h>
#include <gmssl/rand.h>
#include <gmssl/x509_alg.h>
/*
PBKDF2-params ::= SEQUENCE {
salt OCTET STRING,
iterationCount INTEGER (1..MAX),
keyLength INTEGER (1..MAX) OPTIONAL,
prf AlgorithmIdentifier DEFAULT algid-hmacWithSHA1
static const uint32_t oid_hmac_sm3[] = { oid_sm_algors,401,2 };
static const size_t oid_hmac_sm3_cnt = sizeof(oid_hmac_sm3)/sizeof(oid_hmac_sm3[0]);
char *pbkdf2_prf_name(int oid)
{
switch (oid) {
case OID_hmac_sm3: return "hmac-sm3";
}
return NULL;
}
这里prf的OID一般来说其他地方是用不到的，并且除了sm3-hmac之外，我们都不支持
int pbkdf2_prf_from_name(const char *name)
{
if (strcmp(name, "hmac-sm3") == 0) {
return OID_hmac_sm3;
}
return 0;
}
*/
int pbkdf2_prf_to_der(int oid, uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (oid == -1)
return 0;
static const uint32_t oid_hmac_sm3[] = { 1,2 };
static const size_t oid_hmac_sm3_count = sizeof(oid_hmac_sm3)/sizeof(oid_hmac_sm3[0]);
if (oid != OID_hmac_sm3) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(oid_hmac_sm3, oid_hmac_sm3_cnt, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_hmac_sm3, oid_hmac_sm3_cnt, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int pbkdf2_prf_from_der(int *oid, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
uint32_t nodes[32];
size_t nodes_cnt;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else *oid = -1;
return ret;
}
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_hmac_sm3, oid_hmac_sm3_cnt) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
*oid = OID_hmac_sm3;
return 1;
}
int pbkdf2_params_to_der(
const uint8_t *salt, size_t saltlen,
@@ -83,40 +130,15 @@ int pbkdf2_params_to_der(
uint8_t **out, size_t *outlen)
{
size_t len = 0;
size_t prflen = 0;
switch (prf) {
case OID_hmac_sm3:
break;
/*
case OID_hmacWithSHA1:
case OID_hmacWithSHA224:
case OID_hmacWithSHA256:
case OID_hmacWithSHA384:
case OID_hmacWithSHA512:
case OID_hmacWithSHA512_224:
case OID_hmacWithSHA512_256:
error_print();
return -1;
*/
default:
error_print();
return -1;
}
if (asn1_octet_string_to_der(salt, saltlen, NULL, &len) != 1
|| asn1_int_to_der(iter, NULL, &len) != 1
|| asn1_int_to_der(keylen, NULL, &len) < 0
|| asn1_object_identifier_to_der(oid_hmac_sm3, oid_hmac_sm3_count, NULL, &prflen) != 1
|| asn1_null_to_der(NULL, &prflen) != 1
|| asn1_sequence_to_der(NULL, prflen, NULL, &len) != 1
|| pbkdf2_prf_to_der(prf, NULL, &len) < 0
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_octet_string_to_der(salt, saltlen, out, outlen) != 1
|| asn1_int_to_der(iter, out, outlen) != 1
|| asn1_int_to_der(keylen, out, outlen) < 0
|| asn1_sequence_header_to_der(prflen, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_hmac_sm3, oid_hmac_sm3_count, out, outlen) != 1
|| asn1_null_to_der(out, outlen) != 1) {
|| pbkdf2_prf_to_der(prf, out, outlen) < 0) {
error_print();
return -1;
}
@@ -131,61 +153,53 @@ int pbkdf2_params_from_der(
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
const uint8_t *algo;
size_t datalen;
size_t algolen;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_octet_string_from_der(salt, saltlen, &data, &datalen) != 1
|| asn1_int_from_der(iter, &data, &datalen) != 1
|| asn1_int_from_der(keylen, &data, &datalen) < 0
|| asn1_sequence_from_der(&algo, &algolen, &data, &datalen) < 0
|| datalen > 0) {
if (asn1_octet_string_from_der(salt, saltlen, &d, &dlen) != 1
|| asn1_int_from_der(iter, &d, &dlen) != 1
|| asn1_int_from_der(keylen, &d, &dlen) < 0
|| pbkdf2_prf_from_der(prf, &d, &dlen) < 0
|| asn1_check(*saltlen > 0) != 1
|| asn1_check(*iter > 0) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (*saltlen < 1) {
error_print();
return -1;
}
if (*iter < 1) {
error_print();
return -1;
}
if (algo) {
uint32_t nodes[32];
size_t nodes_count;
if (asn1_object_identifier_from_der(nodes, &nodes_count, &algo, &algolen) != 1
|| asn1_null_from_der(&algo, &algolen) != 1
|| algolen > 0) {
error_print();
return -1;
}
if (nodes_count == oid_hmac_sm3_count
&& memcmp(nodes, oid_hmac_sm3, sizeof(oid_hmac_sm3)) == 0) {
*prf = OID_hmac_sm3;
} else {
*prf = OID_undef;
error_print();
return -1;
}
} else {
//*prf = OID_hmacWithSHA1;
error_print();
return -1;
}
return 1;
}
static const uint32_t oid_pbkdf2[] = { 1, 2, 840, 113549, 1, 5, 12 };
static const size_t oid_pbkdf2_count = sizeof(oid_pbkdf2)/sizeof(oid_pbkdf2[0]);
int pbkdf2_params_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
const uint8_t *p;
size_t len;
int val;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_octet_string_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "salt", p, len);
if (asn1_int_from_der(&val, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "iterationCount: %d\n", val);
if ((ret = asn1_int_from_der(&val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "keyLength: %d\n", val);
if ((ret = pbkdf2_prf_from_der(&val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "prf: %s\n", pbkdf2_prf_name(val));
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
static const uint32_t oid_pbkdf2[] = { oid_pkcs5,12 };
static const size_t oid_pbkdf2_cnt = sizeof(oid_pbkdf2)/sizeof(oid_pbkdf2[0]);
int pbkdf2_algor_to_der(
const uint8_t *salt, size_t saltlen,
@@ -195,11 +209,10 @@ int pbkdf2_algor_to_der(
uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (asn1_object_identifier_to_der(oid_pbkdf2, oid_pbkdf2_count, NULL, &len) != 1
if (asn1_object_identifier_to_der(oid_pbkdf2, oid_pbkdf2_cnt, NULL, &len) != 1
|| pbkdf2_params_to_der(salt, saltlen, iter, keylen, prf, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_pbkdf2, oid_pbkdf2_count, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_pbkdf2, oid_pbkdf2_cnt, out, outlen) != 1
|| pbkdf2_params_to_der(salt, saltlen, iter, keylen, prf, out, outlen) != 1) {
error_print();
return -1;
@@ -215,104 +228,88 @@ int pbkdf2_algor_from_der(
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
int oid;
const uint8_t *d;
size_t dlen;
uint32_t nodes[32];
size_t nodes_count;
size_t nodes_cnt;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_object_identifier_from_der(nodes, &nodes_count, &data, &datalen) != 1
|| pbkdf2_params_from_der(salt, saltlen, iter, keylen, prf, &data, &datalen) != 1
|| datalen > 0) {
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_pbkdf2, oid_pbkdf2_cnt) != 1
|| pbkdf2_params_from_der(salt, saltlen, iter, keylen, prf, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (oid != OID_undef || nodes_count != oid_pbkdf2_count
|| memcmp(nodes, oid_pbkdf2, sizeof(oid_pbkdf2)) != 0) {
error_print();
return -1;
}
// FIXME: 检查keylen
return 1;
}
static const uint32_t oid_sm4_cbc[] = { 1, 2, 156, 10197, 1, 104, 2 };
static const size_t oid_sm4_cbc_count = sizeof(oid_sm4_cbc)/sizeof(oid_sm4_cbc[0]);
// 这个应该提取到外面，和digest_algor, encryption_algor, sign_algor 之类的放到一起
int pbes2_enc_algor_to_der(int cipher, const uint8_t *iv, size_t ivlen, uint8_t **out, size_t *outlen)
int pbkdf2_algor_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
size_t len = 0;
uint32_t nodes[32];
size_t nodes_cnt;
const uint8_t *p;
size_t len;
if (cipher != OID_sm4_cbc || ivlen != 16) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_pbkdf2, oid_pbkdf2_cnt) != 1) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(oid_sm4_cbc, oid_sm4_cbc_count, NULL, &len) != 1
|| asn1_octet_string_to_der(iv, ivlen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_sm4_cbc, oid_sm4_cbc_count, out, outlen) != 1
|| asn1_octet_string_to_der(iv, ivlen, out, outlen) != 1) {
format_print(fp, fmt, ind, "algorithm: %s\n", "pbkdf2");
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
pbkdf2_params_print(fp, fmt, ind, "parameters", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
int pbes2_enc_algor_to_der(int oid, const uint8_t *iv, size_t ivlen, uint8_t **out, size_t *outlen)
{
if (oid != OID_sm4_cbc) {
error_print();
return -1;
}
if (x509_encryption_algor_to_der(oid, iv, ivlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int pbes2_enc_algor_from_der(int *cipher, const uint8_t **iv, size_t *ivlen, const uint8_t **in, size_t *inlen)
int pbes2_enc_algor_from_der(int *oid, const uint8_t **iv, size_t *ivlen, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
uint32_t nodes[32];
size_t nodes_count;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = x509_encryption_algor_from_der(oid, iv, ivlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_object_identifier_from_der(nodes, &nodes_count, &data, &datalen) != 1
|| asn1_octet_string_from_der(iv, ivlen, &data, &datalen) != 1
|| asn1_length_is_zero(datalen) != 1) {
if (*oid != OID_sm4_cbc) {
error_print();
return -1;
}
if (asn1_object_identifier_equ(nodes, nodes_count, oid_sm4_cbc, oid_sm4_cbc_count) != 1) {
size_t i;
*cipher = OID_undef;
error_print();
for (i = 0; i < nodes_count; i++) {
fprintf(stderr, " %d", nodes[i]);
}
fprintf(stderr, "\n");
return -1;
}
*cipher = OID_sm4_cbc;
// FIXME: 检查ivlen
return 1;
}
int pbes2_enc_algor_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return x509_encryption_algor_print(fp, fmt, ind, label, d, dlen);
}
int pbes2_params_to_der(
const uint8_t *salt, size_t saltlen,
int iter,
int prf,
int cipher,
const uint8_t *iv, size_t ivlen,
const uint8_t *salt, size_t saltlen, int iter, int keylen, int prf,
int cipher, const uint8_t *iv, size_t ivlen,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
int keylen = -1;
if (pbkdf2_algor_to_der(salt, saltlen, iter, keylen, prf, NULL, &len) != 1
|| pbes2_enc_algor_to_der(cipher, iv, ivlen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
@@ -325,54 +322,61 @@ int pbes2_params_to_der(
}
int pbes2_params_from_der(
const uint8_t **salt, size_t *saltlen,
int *iter,
int *prf,
int *cipher,
const uint8_t **iv, size_t *ivlen,
const uint8_t **salt, size_t *saltlen, int *iter, int *keylen, int *prf,
int *cipher, const uint8_t **iv, size_t *ivlen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
int keylen;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (pbkdf2_algor_from_der(salt, saltlen, iter, &keylen, prf, &data, &datalen) != 1
|| pbes2_enc_algor_from_der(cipher, iv, ivlen, &data, &datalen) != 1
|| datalen > 0) {
error_print();
return -1;
}
if (keylen >= 0 && keylen != 16) {
if (pbkdf2_algor_from_der(salt, saltlen, iter, keylen, prf, &d, &dlen) != 1
|| pbes2_enc_algor_from_der(cipher, iv, ivlen, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int pbes2_params_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
static const uint32_t oid_pbes2[] = { 1, 2, 840, 113549, 1, 5, 13 };
static const size_t oid_pbes2_count = sizeof(oid_pbes2)/sizeof(oid_pbes2[0]);
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
pbkdf2_algor_print(fp, fmt, ind, "keyDerivationFunc", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
pbes2_enc_algor_print(fp, fmt, ind, "encryptionScheme", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
static const uint32_t oid_pbes2[] = { oid_pkcs5,13 };
static const size_t oid_pbes2_cnt = sizeof(oid_pbes2)/sizeof(oid_pbes2[0]);
int pbes2_algor_to_der(
const uint8_t *salt, size_t saltlen,
int iter,
int prf,
int cipher,
const uint8_t *iv, size_t ivlen,
const uint8_t *salt, size_t saltlen, int iter, int keylen, int prf,
int cipher, const uint8_t *iv, size_t ivlen,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (asn1_object_identifier_to_der(oid_pbes2, oid_pbes2_count, NULL, &len) != 1
|| pbes2_params_to_der(salt, saltlen, iter, prf, cipher, iv, ivlen, NULL, &len) != 1
if (asn1_object_identifier_to_der(oid_pbes2, oid_pbes2_cnt, NULL, &len) != 1
|| pbes2_params_to_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(oid_pbes2, oid_pbes2_count, out, outlen) != 1
|| pbes2_params_to_der(salt, saltlen, iter, prf, cipher, iv, ivlen, out, outlen) != 1) {
|| asn1_object_identifier_to_der(oid_pbes2, oid_pbes2_cnt, out, outlen) != 1
|| pbes2_params_to_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, out, outlen) != 1) {
error_print();
return -1;
}
@@ -380,212 +384,110 @@ int pbes2_algor_to_der(
}
int pbes2_algor_from_der(
const uint8_t **salt, size_t *saltlen,
int *iter,
int *prf,
int *cipher,
const uint8_t **iv, size_t *ivlen,
const uint8_t **salt, size_t *saltlen, int *iter, int *keylen, int *prf,
int *cipher, const uint8_t **iv, size_t *ivlen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
const uint8_t *d;
size_t dlen;
int oid;
uint32_t nodes[32];
size_t nodes_count;
size_t nodes_cnt;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_object_identifier_from_der(nodes, &nodes_count, &data, &datalen) != 1
|| pbes2_params_from_der(salt, saltlen, iter, prf, cipher, iv, ivlen, &data, &datalen) != 1
|| datalen > 0) {
error_print();
return -1;
}
if (nodes_count != oid_pbes2_count
&& memcmp(nodes, oid_pbes2, sizeof(oid_pbes2)) != 0) {
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_pbes2, oid_pbes2_cnt) != 1
|| pbes2_params_from_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int pbes2_algor_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
uint32_t nodes[32];
size_t nodes_cnt;
const uint8_t *p;
size_t len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1
|| asn1_object_identifier_equ(nodes, nodes_cnt, oid_pbes2, oid_pbes2_cnt) != 1)
goto err;
format_print(fp, fmt, ind, "algorithm: %s\n", "pbes2");
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
pbes2_params_print(fp, fmt, ind, "parameters", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
int pkcs8_enced_private_key_info_to_der(
const uint8_t *salt, size_t saltlen,
int iter,
int prf,
int cipher,
const uint8_t *iv, size_t ivlen,
const uint8_t *salt, size_t saltlen, int iter, int keylen, int prf,
int cipher, const uint8_t *iv, size_t ivlen,
const uint8_t *enced, size_t encedlen,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
pbes2_algor_to_der(salt, saltlen, iter, prf, cipher, iv, ivlen, NULL, &len);
asn1_octet_string_to_der(enced, encedlen, NULL, &len);
asn1_sequence_header_to_der(len, out, outlen);
pbes2_algor_to_der(salt, saltlen, iter, prf, cipher, iv, ivlen, out, outlen);
asn1_octet_string_to_der(enced, encedlen, out, outlen);
if (pbes2_algor_to_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, NULL, &len) != 1
|| asn1_octet_string_to_der(enced, encedlen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| pbes2_algor_to_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, out, outlen) != 1
|| asn1_octet_string_to_der(enced, encedlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int pkcs8_enced_private_key_info_from_der(
const uint8_t **salt, size_t *saltlen,
int *iter,
int *prf,
int *cipher,
const uint8_t **iv, size_t *ivlen,
const uint8_t **salt, size_t *saltlen, int *iter, int *keylen, int *prf,
int *cipher, const uint8_t **iv, size_t *ivlen,
const uint8_t **enced, size_t *encedlen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (pbes2_algor_from_der(salt, saltlen, iter, prf, cipher, iv, ivlen, &data, &datalen) != 1
|| asn1_octet_string_from_der(enced, encedlen, &data, &datalen) != 1
|| datalen > 0) {
if (pbes2_algor_from_der(salt, saltlen, iter, keylen, prf, cipher, iv, ivlen, &d, &dlen) != 1
|| asn1_octet_string_from_der(enced, encedlen, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
// output PKCS #8 EncryptedPrivateKeyInfo
int sm2_enced_private_key_info_to_der(const SM2_KEY *sm2, const char *pass, uint8_t **out, size_t *outlen)
int pkcs8_enced_private_key_info_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
SM4_KEY sm4_key;
uint8_t salt[16];
int iter = 65536;
int prf = OID_hmac_sm3;
uint8_t key[16];
int cipher = OID_sm4_cbc;
uint8_t iv[16];
uint8_t info[256];
uint8_t *pinfo = info;
size_t infolen = 0;
uint8_t enced[512];
size_t encedlen;
if (rand_bytes(salt, sizeof(salt)) != 1
|| rand_bytes(iv, sizeof(iv)) != 1) {
error_print();
return -1;
}
// SM2_KEY to PKCS8 PrivateKeyInfo
if (sm2_private_key_info_to_der(sm2, &pinfo, &infolen) != 1) {
error_print();
return -1;
}
// password to encryption key
if (pbkdf2_genkey(DIGEST_sm3(), pass, strlen(pass), salt, sizeof(salt), iter, sizeof(key), key) != 1) {
error_print();
return -1;
}
// encrypt PrivateKeyInfo
sm4_set_encrypt_key(&sm4_key, key);
if (sm4_cbc_padding_encrypt(&sm4_key, iv, info, infolen, enced, &encedlen) != 1) {
error_print();
return -1;
}
// encode EncryptedPrivateKeyInfo
if (pkcs8_enced_private_key_info_to_der(salt, sizeof(salt), iter, prf,
cipher, iv, sizeof(iv), enced, encedlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm2_enced_private_key_info_from_der(SM2_KEY *sm2, const uint8_t **attrs, size_t *attrslen, const char *pass, const uint8_t **in, size_t *inlen)
{
SM4_KEY sm4_key;
const uint8_t *salt;
size_t saltlen;
int iter;
int prf;
int cipher;
const uint8_t *iv;
size_t ivlen;
const uint8_t *enced;
size_t encedlen;
uint8_t key[16];
uint8_t info[256];
const uint8_t *pinfo = info;
size_t infolen;
if (pkcs8_enced_private_key_info_from_der(&salt, &saltlen, &iter, &prf,
&cipher, &iv, &ivlen, &enced, &encedlen, in, inlen) != 1) {
error_print();
return -1;
}
if (pbkdf2_genkey(DIGEST_sm3(), pass, strlen(pass), salt, saltlen, iter, sizeof(key), key) != 1) {
error_print();
return -1;
}
sm4_set_decrypt_key(&sm4_key, key);
if (sm4_cbc_padding_decrypt(&sm4_key, iv, enced, encedlen, info, &infolen) != 1) {
error_print();
return -1;
}
if (sm2_private_key_info_from_der(sm2, attrs, attrslen, &pinfo, &infolen) != 1
|| infolen > 0) {
error_print();
return -1;
}
return 1;
}
int sm2_enced_private_key_info_to_pem(const SM2_KEY *key, const char *pass, FILE *fp)
{
uint8_t buf[1024];
uint8_t *p = buf;
size_t len = 0;
if (sm2_enced_private_key_info_to_der(key, pass, &p, &len) != 1) {
error_print();
return -1;
}
if (pem_write(fp, "ENCRYPTED PRIVATE KEY", buf, len) <= 0) {
error_print();
return -1;
}
return 1;
}
// TODO: return attributes
int sm2_enced_private_key_info_from_pem(SM2_KEY *key, const char *pass, FILE *fp)
{
uint8_t buf[512];
const uint8_t *cp = buf;
const uint8_t *p;
size_t len;
const uint8_t *attrs;
size_t attrslen;
if (pem_read(fp, "ENCRYPTED PRIVATE KEY", buf, &len, sizeof(buf)) != 1) {
error_print();
return -1;
}
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (sm2_enced_private_key_info_from_der(key, &attrs, &attrslen, pass, &cp, &len) != 1
|| len > 0) {
error_print();
return -1;
}
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
pbes2_algor_print(fp, fmt, ind, "encryptionAlgorithm", p, len);
if (asn1_octet_string_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "encryptedData", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}

377
src/sm2_asn1.c
View File

@@ -51,6 +51,10 @@
#include <gmssl/oid.h>
#include <gmssl/asn1.h>
#include <gmssl/pem.h>
#include <gmssl/sm4.h>
#include <gmssl/rand.h>
#include <gmssl/pbkdf2.h>
#include <gmssl/pkcs8.h>
#include <gmssl/error.h>
// sm2 curve 1.2.156.10197.1.301
@@ -71,71 +75,93 @@ void sm2_point_to_uncompressed_octets(const SM2_POINT *P, uint8_t out[65])
int sm2_point_from_octets(SM2_POINT *P, const uint8_t *in, size_t inlen)
{
if ((*in == 0x02 || *in == 0x03) && inlen == 33) {
return sm2_point_from_x(P, in + 1, *in);
if (sm2_point_from_x(P, in + 1, *in) != 1) {
error_print();
return -1;
}
} else if (*in == 0x04 && inlen == 65) {
return sm2_point_from_xy(P, in + 1, in + 33);
if (sm2_point_from_xy(P, in + 1, in + 33) != 1) {
error_print();
return -1;
}
} else {
error_print();
return -1;
}
}
int sm2_point_to_der(const SM2_POINT *a, uint8_t **out, size_t *outlen)
{
uint8_t buf[65];
sm2_point_to_uncompressed_octets(a, buf);
asn1_octet_string_to_der(buf, sizeof(buf), out, outlen);
return 1;
}
int sm2_point_from_der(SM2_POINT *a, const uint8_t **in, size_t *inlen)
int sm2_point_to_der(const SM2_POINT *P, uint8_t **out, size_t *outlen)
{
int ret;
const uint8_t *data;
size_t datalen;
error_print_msg("inlen = %zu\n", *inlen);
if ((ret = asn1_octet_string_from_der(&data, &datalen, in, inlen)) != 1) {
if (ret < 0) error_print();
else error_print();
return ret;
}
if (sm2_point_from_octets(a, data, datalen) != 1) {
uint8_t buf[65];
if (!P)
return 0;
sm2_point_to_uncompressed_octets(P, buf);
if (asn1_octet_string_to_der(buf, sizeof(buf), out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm2_point_from_der(SM2_POINT *P, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_octet_string_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (sm2_point_from_octets(P, d, dlen) != 1) {
error_print();
return -1;
}
error_print_msg("inlen = %zu\n", *inlen);
return 1;
}
int sm2_signature_to_der(const SM2_SIGNATURE *sig, uint8_t **out, size_t *outlen)
{
size_t len = 0;
asn1_integer_to_der(sig->r, 32, NULL, &len);
asn1_integer_to_der(sig->s, 32, NULL, &len);
asn1_sequence_header_to_der(len, out, outlen);
asn1_integer_to_der(sig->r, 32, out, outlen);
asn1_integer_to_der(sig->s, 32, out, outlen);
if (!sig)
return 0;
if (asn1_integer_to_der(sig->r, 32, NULL, &len) != 1
|| asn1_integer_to_der(sig->s, 32, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_integer_to_der(sig->r, 32, out, outlen) != 1
|| asn1_integer_to_der(sig->s, 32, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm2_signature_from_der(SM2_SIGNATURE *sig, const uint8_t **in, size_t *inlen)
{
const uint8_t *data, *r, *s;
size_t datalen, rlen, slen;
int ret;
const uint8_t *d;
size_t dlen;
const uint8_t *r;
size_t rlen;
const uint8_t *s;
size_t slen;
if (asn1_sequence_from_der(&data, &datalen, in, inlen) < 0
|| asn1_integer_from_der(&r, &rlen, &data, &datalen) < 0
|| asn1_integer_from_der(&s, &slen, &data, &datalen) < 0
|| datalen > 0) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_integer_from_der(&r, &rlen, &d, &dlen) != 1
|| asn1_integer_from_der(&s, &slen, &d, &dlen) != 1
|| asn1_length_le(rlen, 32) != 1
|| asn1_length_le(slen, 32) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (rlen != 32 || slen != 32) {
return -2;
}
memcpy(sig->r, r, 32);
memcpy(sig->s, s, 32);
memset(sig, 0, sizeof(*sig));
memcpy(sig->r, r, rlen);
memcpy(sig->s, s, slen);
return 1;
}
@@ -148,48 +174,59 @@ int sm2_ciphertext_size(size_t inlen, size_t *outlen)
int sm2_ciphertext_to_der(const SM2_CIPHERTEXT *c, uint8_t **out, size_t *outlen)
{
size_t len = 0;
asn1_integer_to_der(c->point.x, 32, NULL, &len);
asn1_integer_to_der(c->point.y, 32, NULL, &len);
asn1_octet_string_to_der(c->hash, 32, NULL, &len);
asn1_octet_string_to_der(c->ciphertext, c->ciphertext_size, NULL, &len);
asn1_sequence_header_to_der(len, out, outlen);
asn1_integer_to_der(c->point.x, 32, out, outlen);
asn1_integer_to_der(c->point.y, 32, out, outlen);
asn1_octet_string_to_der(c->hash, 32, out, outlen);
asn1_octet_string_to_der(c->ciphertext, c->ciphertext_size, out, outlen);
if (!c)
return 0;
if (asn1_integer_to_der(c->point.x, 32, NULL, &len) != 1
|| asn1_integer_to_der(c->point.y, 32, NULL, &len) != 1
|| asn1_octet_string_to_der(c->hash, 32, NULL, &len) != 1
|| asn1_octet_string_to_der(c->ciphertext, c->ciphertext_size, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_integer_to_der(c->point.x, 32, out, outlen) != 1
|| asn1_integer_to_der(c->point.y, 32, out, outlen) != 1
|| asn1_octet_string_to_der(c->hash, 32, out, outlen) != 1
|| asn1_octet_string_to_der(c->ciphertext, c->ciphertext_size, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm2_ciphertext_from_der(SM2_CIPHERTEXT *a, const uint8_t **in, size_t *inlen)
int sm2_ciphertext_from_der(SM2_CIPHERTEXT *C, const uint8_t **in, size_t *inlen)
{
const uint8_t *data, *x, *y, *hash, *c;
int ret;
const uint8_t *d;
size_t dlen;
const uint8_t *x;
const uint8_t *y;
const uint8_t *hash;
const uint8_t *c;
size_t datalen, xlen, ylen, hashlen, clen;
if (asn1_sequence_from_der(&data, &datalen, in, inlen) < 0
|| asn1_integer_from_der(&x, &xlen, &data, &datalen) < 0
|| asn1_integer_from_der(&y, &ylen, &data, &datalen) < 0
|| asn1_octet_string_from_der(&hash, &hashlen, &data, &datalen) < 0
|| asn1_octet_string_from_der(&c, &clen, &data, &datalen) < 0
|| datalen > 0) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_integer_from_der(&x, &xlen, &d, &dlen) != 1
|| asn1_integer_from_der(&y, &ylen, &d, &dlen) != 1
|| asn1_octet_string_from_der(&hash, &hashlen, &d, &dlen) != 1
|| asn1_octet_string_from_der(&c, &clen, &d, &dlen) != 1
|| asn1_length_le(xlen, 32) != 1
|| asn1_length_le(ylen, 32) != 1
|| asn1_check(hashlen == 32) != 1
|| asn1_length_le(clen, SM2_MAX_PLAINTEXT_SIZE) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (xlen != 32
|| ylen != 32
|| hashlen != 32
|| clen < 1) {
return -1;
}
memcpy(a->point.x, x, 32);
memcpy(a->point.y, y, 32);
memcpy(a->hash, hash, 32);
memcpy(a->ciphertext, c, clen);
a->ciphertext_size = (uint32_t)clen;
memset(C, 0, sizeof(SM2_CIPHERTEXT));
memcpy(C->point.x, x, xlen);
memcpy(C->point.y, y, ylen);
memcpy(C->hash, hash, hashlen);
memcpy(C->ciphertext, c, clen);
C->ciphertext_size = (uint32_t)clen;
return 1;
}
// TODO: sm2, ecPublicKey 这些公用的OID应该提取到一个地方
static const uint32_t oid_sm2[] = { 1,2,156,10197,1,301 };
static const size_t oid_sm2_count = sizeof(oid_sm2)/sizeof(oid_sm2[0]);
@@ -345,54 +382,57 @@ int sm2_public_key_algor_from_der(const uint8_t **in, size_t *inlen)
return 1;
}
int sm2_private_key_info_to_der(const SM2_KEY *key, uint8_t **out, size_t *outlen)
int sm2_private_key_info_to_der(const SM2_KEY *sm2_key, uint8_t **out, size_t *outlen)
{
size_t len = 0;
uint8_t prikey[512];
uint8_t *p = prikey;
size_t prikey_len = 0;
sm2_private_key_to_der(key, &p, &prikey_len);
asn1_int_to_der(0, NULL, &len);
sm2_public_key_algor_to_der(NULL, &len);
asn1_octet_string_to_der(prikey, prikey_len, NULL, &len);
asn1_sequence_header_to_der(len, out, outlen);
asn1_int_to_der(0, out, outlen);
sm2_public_key_algor_to_der(out, outlen);
asn1_octet_string_to_der(prikey, prikey_len, out, outlen);
if (sm2_private_key_to_der(sm2_key, &p, &prikey_len) != 1) {
error_print();
return -1;
}
if (asn1_int_to_der(0, NULL, &len) != 1
|| sm2_public_key_algor_to_der(NULL, &len) != 1
|| asn1_octet_string_to_der(prikey, prikey_len, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_int_to_der(0, out, outlen) != 1
|| sm2_public_key_algor_to_der(out, outlen) != 1
|| asn1_octet_string_to_der(prikey, prikey_len, out, outlen) != 1) {
memset(prikey, 0, sizeof(prikey));
error_print();
return -1;
}
memset(prikey, 0, sizeof(prikey));
return 1;
}
int sm2_private_key_info_from_der(SM2_KEY *key, const uint8_t **attrs, size_t *attrslen,
int sm2_private_key_info_from_der(SM2_KEY *sm2_key, const uint8_t **attrs, size_t *attrslen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *data;
size_t datalen;
const uint8_t *d;
size_t dlen;
int version;
const uint8_t *prikey;
size_t prikeylen;
if ((ret = asn1_sequence_from_der(&data, &datalen, in, inlen)) != 1) {
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_int_from_der(&version, &data, &datalen) != 1
|| sm2_public_key_algor_from_der(&data, &datalen) != 1
|| asn1_octet_string_from_der(&prikey, &prikeylen, &data, &datalen) != 1
|| asn1_implicit_set_from_der(0, attrs, attrslen, &data, &datalen) < 0
|| datalen > 0) {
if (asn1_int_from_der(&version, &d, &dlen) != 1
|| sm2_public_key_algor_from_der(&d, &dlen) != 1
|| asn1_octet_string_from_der(&prikey, &prikeylen, &d, &dlen) != 1
|| asn1_implicit_set_from_der(0, attrs, attrslen, &d, &dlen) < 0
|| asn1_check(version == 0) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (version != 0) {
error_print();
return -1;
}
if (sm2_private_key_from_der(key, &prikey, &prikeylen) != 1
|| prikeylen > 0) {
if (sm2_private_key_from_der(sm2_key, &prikey, &prikeylen) != 1
|| asn1_length_is_zero(prikeylen) != 1) {
error_print();
return -1;
}
@@ -405,31 +445,28 @@ int sm2_private_key_info_to_pem(const SM2_KEY *key, FILE *fp)
uint8_t *p = buf;
size_t len = 0;
if (sm2_private_key_info_to_der(key, &p, &len) != 1) {
error_print();
return -1;
}
if (pem_write(fp, "PRIVATE KEY", buf, len) <= 0) {
if (sm2_private_key_info_to_der(key, &p, &len) != 1
|| pem_write(fp, "PRIVATE KEY", buf, len) != 1) {
memset(buf, 0, sizeof(buf));
error_print();
return -1;
}
memset(buf, 0, sizeof(buf));
return 1;
}
int sm2_private_key_info_from_pem(SM2_KEY *key, const uint8_t **attrs, size_t *attrslen, FILE *fp)
int sm2_private_key_info_from_pem(SM2_KEY *sm2_key, const uint8_t **attrs, size_t *attrslen, FILE *fp)
{
uint8_t buf[512];
const uint8_t *cp = buf;
size_t len;
if (pem_read(fp, "PRIVATE KEY", buf, &len, sizeof(buf)) != 1) {
if (pem_read(fp, "PRIVATE KEY", buf, &len, sizeof(buf)) != 1
|| sm2_private_key_info_from_der(sm2_key, attrs, attrslen, &cp, &len) != 1
|| asn1_length_is_zero(len) != 1) {
error_print();
return -1;
}
if (sm2_private_key_info_from_der(key, attrs, attrslen, &cp, &len) != 1
|| len > 0) {
return -1;
}
return 1;
}
@@ -567,3 +604,129 @@ int sm2_public_key_digest(const SM2_KEY *sm2_key, uint8_t dgst[32])
return 1;
}
int sm2_private_key_info_encrypt_to_der(const SM2_KEY *sm2_key, const char *pass,
uint8_t **out, size_t *outlen)
{
int ret = -1;
uint8_t pkey_info[2560];
uint8_t *p = pkey_info;
size_t pkey_info_len = 0;
uint8_t salt[16];
int iter = 65536;
uint8_t iv[16];
uint8_t key[16];
SM4_KEY sm4_key;
uint8_t enced_pkey_info[5120];
size_t enced_pkey_info_len;
if (sm2_private_key_info_to_der(sm2_key, &p, &pkey_info_len) != 1
|| rand_bytes(salt, sizeof(salt)) != 1
|| rand_bytes(iv, sizeof(iv)) != 1
|| pbkdf2_genkey(DIGEST_sm3(), pass, strlen(pass),
salt, sizeof(salt), iter, sizeof(key), key) != 1) {
error_print();
goto end;
}
sm4_set_encrypt_key(&sm4_key, key);
if (sm4_cbc_padding_encrypt(
&sm4_key, iv, pkey_info, pkey_info_len,
enced_pkey_info, &enced_pkey_info_len) != 1
|| pkcs8_enced_private_key_info_to_der(
salt, sizeof(salt), iter, sizeof(key), OID_hmac_sm3,
OID_sm4_cbc, iv, sizeof(iv),
enced_pkey_info, enced_pkey_info_len, out, outlen) != 1) {
error_print();
goto end;
}
ret = 1;
end:
memset(pkey_info, 0, sizeof(pkey_info));
memset(key, 0, sizeof(key));
memset(&sm4_key, 0, sizeof(sm4_key));
return ret;
}
int sm2_private_key_info_decrypt_from_der(SM2_KEY *sm2,
const uint8_t **attrs, size_t *attrs_len,
const char *pass, const uint8_t **in, size_t *inlen)
{
int ret = -1;
const uint8_t *salt;
size_t saltlen;
int iter;
int keylen;
int prf;
int cipher;
const uint8_t *iv;
size_t ivlen;
uint8_t key[16];
SM4_KEY sm4_key;
const uint8_t *enced_pkey_info;
size_t enced_pkey_info_len;
uint8_t pkey_info[256];
const uint8_t *cp = pkey_info;
size_t pkey_info_len;
if (pkcs8_enced_private_key_info_from_der(&salt, &saltlen, &iter, &keylen, &prf,
&cipher, &iv, &ivlen, &enced_pkey_info, &enced_pkey_info_len, in, inlen) != 1
|| asn1_check(keylen == -1 || keylen == 16) != 1
|| asn1_check(prf == - 1 || prf == OID_hmac_sm3) != 1
|| asn1_check(cipher == OID_sm4_cbc) != 1
|| asn1_check(ivlen == 16) != 1
|| asn1_length_le(enced_pkey_info_len, sizeof(pkey_info)) != 1) {
error_print();
return -1;
}
if (pbkdf2_genkey(DIGEST_sm3(), pass, strlen(pass), salt, saltlen, iter, sizeof(key), key) != 1) {
error_print();
goto end;
}
sm4_set_decrypt_key(&sm4_key, key);
if (sm4_cbc_padding_decrypt(&sm4_key, iv, enced_pkey_info, enced_pkey_info_len,
pkey_info, &pkey_info_len) != 1
|| sm2_private_key_info_from_der(sm2, attrs, attrs_len, &cp, &pkey_info_len) != 1
|| asn1_length_is_zero(pkey_info_len) != 1) {
error_print();
goto end;
}
ret = 1;
end:
memset(&sm4_key, 0, sizeof(sm4_key));
memset(key, 0, sizeof(key));
memset(pkey_info, 0, sizeof(pkey_info));
return ret;
}
int sm2_private_key_info_encrypt_to_pem(const SM2_KEY *sm2_key, const char *pass, FILE *fp)
{
uint8_t buf[1024];
uint8_t *p = buf;
size_t len = 0;
if (sm2_private_key_info_encrypt_to_der(sm2_key, pass, &p, &len) != 1) {
error_print();
return -1;
}
if (pem_write(fp, "ENCRYPTED PRIVATE KEY", buf, len) != 1) {
error_print();
return -1;
}
return 1;
}
int sm2_private_key_info_decrypt_from_pem(SM2_KEY *key, const char *pass, FILE *fp)
{
uint8_t buf[512];
const uint8_t *cp = buf;
size_t len;
const uint8_t *attrs;
size_t attrs_len;
if (pem_read(fp, "ENCRYPTED PRIVATE KEY", buf, &len, sizeof(buf)) != 1
|| sm2_private_key_info_decrypt_from_der(key, &attrs, &attrs_len, pass, &cp, &len) != 1
|| asn1_length_is_zero(len) != 1) {
error_print();
return -1;
}
return 1;
}

31
src/sm2_prn.c
View File

@@ -54,41 +54,42 @@
#include <gmssl/asn1.h>
#include <gmssl/error.h>
// FIXME: 缺乏打印公钥的函数，有时候SM2_KEY中只有公钥，没有私钥
int sm2_key_print(FILE *fp, int format, int indent, const char *label, const SM2_KEY *key)
int sm2_key_print(FILE *fp, int fmt, int ind, const char *label, const SM2_KEY *key)
{
format_print(fp, format, indent, "SM2PrivateKey\n");
indent += 4;
format_bytes(fp, format, indent, "private_key : ", key->private_key, 32);
sm2_point_print(fp, format, indent + 4, "public_key", &key->public_key);
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
sm2_public_key_print(fp, fmt, ind, "publicKey", key);
format_bytes(fp, fmt, ind, "privateKey", key->private_key, 32);
return 1;
}
int sm2_public_key_print(FILE *fp, int fmt, int ind, const char *label, const SM2_KEY *pub_key)
{
sm2_point_print(fp, fmt, ind + 4, "public_key", &pub_key->public_key);
return 1;
return sm2_point_print(fp, fmt, ind, label, &pub_key->public_key);
}
int sm2_point_print(FILE *fp, int format, int indent, const char *label, const SM2_POINT *P)
int sm2_point_print(FILE *fp, int fmt, int ind, const char *label, const SM2_POINT *P)
{
format_bytes(fp, format, indent, "x : ", P->x, 32);
format_bytes(fp, format, indent, "y : ", P->y, 32);
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
format_bytes(fp, fmt, ind, "x", P->x, 32);
format_bytes(fp, fmt, ind, "y", P->y, 32);
return 1;
}
int sm2_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
{
SM2_SIGNATURE sig;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (sm2_signature_from_der(&sig, &a, &alen) != 1
|| asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
format_bytes(fp, fmt, ind, "r : ", sig.r, 32);
format_bytes(fp, fmt, ind, "s : ", sig.s, 32);
format_bytes(fp, fmt, ind, "r", sig.r, 32);
format_bytes(fp, fmt, ind, "s", sig.s, 32);
return 1;
}

144
src/x509_cer.c
View File

@@ -101,7 +101,7 @@ int x509_explicit_version_from_der(int index, int *version, const uint8_t **in,
if ((ret = asn1_explicit_from_der(index, &d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else *version = X509_version_v1;
else *version = -1;
return ret;
}
if (asn1_int_from_der(version, &d, &dlen) != 1
@@ -224,9 +224,9 @@ int x509_validity_print(FILE *fp, int fmt, int ind, const char *label, const uin
ind += 4;
if (x509_time_from_der(&tv, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "notBefore : %s\n", ctime(&tv));
format_print(fp, fmt, ind, "notBefore: %s", ctime(&tv));
if (x509_time_from_der(&tv, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "notAfter : %s\n", ctime(&tv));
format_print(fp, fmt, ind, "notAfter: %s", ctime(&tv));
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
@@ -278,7 +278,8 @@ int x509_attr_type_and_value_check(int oid, int tag, const uint8_t *val, size_t
return 1;
}
}
return 0;
error_print();
return -1;
}
int x509_attr_type_and_value_to_der(int oid, int tag, const uint8_t *val, size_t vlen,
@@ -324,14 +325,19 @@ int x509_attr_type_and_value_print(FILE *fp, int fmt, int ind, const char *label
const uint8_t *val;
size_t vlen;
if (label) {
if (fmt & ASN1_FMT_FULL) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if (x509_name_type_from_der(&oid, &d, &dlen) != 1) goto err;
asn1_object_identifier_print(fp, fmt, ind, "type", x509_name_type_name(oid), NULL, 0);
if (fmt & ASN1_FMT_FULL)
asn1_object_identifier_print(fp, fmt, ind, "type", x509_name_type_name(oid), NULL, 0);
if (x509_directory_name_from_der(&tag, &val, &vlen, &d, &dlen) != 1) goto err;
x509_directory_name_print(fp, fmt, ind, "value", tag, val, vlen);
if (fmt & ASN1_FMT_FULL)
x509_directory_name_print(fp, fmt, ind, "value", tag, val, vlen);
else x509_directory_name_print(fp, fmt, ind, x509_name_type_name(oid), tag, val, vlen);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
@@ -387,7 +393,7 @@ int x509_rdn_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t
const uint8_t *p;
size_t len;
if (label) {
if (fmt & ASN1_FMT_FULL) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
@@ -398,7 +404,7 @@ int x509_rdn_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t
}
x509_attr_type_and_value_print(fp, fmt, ind, "AttributeTypeAndValue", p, len);
}
format_print(fp, fmt, ind, "\n");
//format_print(fp, fmt, ind, "\n");
return 1;
}
@@ -406,19 +412,14 @@ int x509_name_add_rdn(uint8_t *d, size_t *dlen, size_t maxlen,
int oid, int tag, const uint8_t *val, size_t vlen,
const uint8_t *more, size_t morelen)
{
uint8_t *p;
size_t len = 0;
if (x509_rdn_to_der(oid, tag, val, len, NULL, 0, NULL, &len) != 1) {
error_print();
return -1;
uint8_t *p = d + *dlen;
if (!val && !more) {
return 0;
}
if (*dlen + len + morelen > maxlen) {
error_print();
return -1;
}
if (x509_rdn_to_der(oid, tag, val, len, NULL, 0, &d, dlen) != 1
|| asn1_data_to_der(more, morelen, &d, dlen) < 0) {
if (x509_rdn_to_der(oid, tag, val, vlen, NULL, 0, NULL, &len) != 1
|| asn1_length_le(*dlen + len, maxlen) != 1
|| x509_rdn_to_der(oid, tag, val, vlen, NULL, 0, &p, dlen) != 1) {
error_print();
return -1;
}
@@ -427,44 +428,88 @@ int x509_name_add_rdn(uint8_t *d, size_t *dlen, size_t maxlen,
int x509_name_add_country_name(uint8_t *d, size_t *dlen, int maxlen, const char val[2])
{
return x509_name_add_rdn(d, dlen, maxlen,
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen,
OID_at_country_name, ASN1_TAG_PrintableString, (uint8_t *)val, 2, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_state_or_province_name(uint8_t *d, size_t *dlen, int maxlen,
int tag, const uint8_t *val, size_t vlen)
{
return x509_name_add_rdn(d, dlen, maxlen, OID_at_state_or_province_name, tag, val, vlen, NULL, 0);
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_state_or_province_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_locality_name(uint8_t *d, size_t *dlen, int maxlen,
int tag, const uint8_t *val, size_t vlen)
{
return x509_name_add_rdn(d, dlen, maxlen, OID_at_locality_name, tag, val, vlen, NULL, 0);
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_locality_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_organization_name(uint8_t *d, size_t *dlen, int maxlen,
int tag, const uint8_t *val, size_t vlen)
{
return x509_name_add_rdn(d, dlen, maxlen, OID_at_organization_name, tag, val, vlen, NULL, 0);
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_organization_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_organizational_unit_name(uint8_t *d, size_t *dlen, int maxlen,
int tag, const uint8_t *val, size_t vlen)
{
return x509_name_add_rdn(d, dlen, maxlen, OID_at_organizational_unit_name, tag, val, vlen, NULL, 0);
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_organizational_unit_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_common_name(uint8_t *d, size_t *dlen, int maxlen,
int tag, const uint8_t *val, size_t vlen)
{
return x509_name_add_rdn(d, dlen, maxlen, OID_at_common_name, tag, val, vlen, NULL, 0);
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_common_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_domain_component(uint8_t *d, size_t *dlen, int maxlen,
const char *val, size_t vlen)
{
int ret;
return x509_name_add_rdn(d, dlen, maxlen, OID_domain_component, ASN1_TAG_IA5String, (uint8_t *)val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
static size_t _strlen(const char *s) { return s ? strlen(s) : 0; }
int x509_name_set(uint8_t *d, size_t *dlen, size_t maxlen,
const char *country, const char *state, const char *locality,
const char *org, const char *org_unit, const char *common_name)
{
int tag = ASN1_TAG_PrintableString;
if (country && strlen(country) != 2) {
error_print();
return -1;
}
if (x509_name_add_country_name(d, dlen, maxlen, country) < 0
|| x509_name_add_state_or_province_name(d, dlen, maxlen, tag, (uint8_t *)state, _strlen(state)) < 0
|| x509_name_add_locality_name(d, dlen, maxlen, tag, (uint8_t *)locality, _strlen(locality)) < 0
|| x509_name_add_organization_name(d, dlen, maxlen, tag, (uint8_t *)org, _strlen(org)) < 0
|| x509_name_add_organizational_unit_name(d, dlen, maxlen, tag, (uint8_t *)org_unit, _strlen(org_unit)) < 0
|| x509_name_add_common_name(d, dlen, maxlen, tag, (uint8_t *)common_name, _strlen(common_name)) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
@@ -515,7 +560,7 @@ int x509_public_key_info_print(FILE *fp, int fmt, int ind, const char *label, co
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_public_key_algor_print(fp, fmt, ind, "algorithm", p, len);
if (asn1_bit_octets_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "subjectPublicKey: ", p, len);
format_bytes(fp, fmt, ind, "subjectPublicKey", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
@@ -649,6 +694,9 @@ err:
int x509_explicit_exts_to_der(int index, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (!d) {
return 0;
}
if (asn1_sequence_to_der(d, dlen, NULL, &len) != 1
|| asn1_explicit_header_to_der(index, len, out, outlen) != 1
|| asn1_sequence_to_der(d, dlen, out, outlen) != 1) {
@@ -803,17 +851,17 @@ int x509_tbs_cert_print(FILE *fp, int fmt, int ind, const char *label, const uin
ind += 4;
if ((ret = x509_explicit_version_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "version: %s\n", x509_version_name(val));
if (ret) format_print(fp, fmt, ind, "version: %s (%d)\n", x509_version_name(val), val);
if (asn1_integer_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "serialNumber", p, len);
if (x509_signature_algor_from_der(&val, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "siganture: %s\n", x509_signature_algor_name(val));
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_name_print(fp, fmt, ind, "issuer", d, dlen);
x509_name_print(fp, fmt, ind, "issuer", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_validity_print(fp, fmt, ind, "validity", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_name_print(fp, fmt, ind, "subject", d, dlen);
x509_name_print(fp, fmt, ind, "subject", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_public_key_info_print(fp, fmt, ind, "subjectPulbicKeyInfo", p, len);
if ((ret = asn1_implicit_bit_octets_from_der(1, &p, &len, &d, &dlen)) < 0) goto err;
@@ -886,6 +934,7 @@ int x509_certificate_print(FILE *fp, int fmt, int ind, const char *label, const
if (asn1_bit_octets_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "signatureValue", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
@@ -980,13 +1029,15 @@ int x509_cert_verify(const uint8_t *a, size_t alen,
return ret;
}
int x509_cert_verify_by_ca_cert(const uint8_t *a, size_t alen, const uint8_t *cacert, size_t cacertlen)
int x509_cert_verify_by_ca_cert(const uint8_t *a, size_t alen,
const uint8_t *cacert, size_t cacertlen,
const char *signer_id, size_t signer_id_len)
{
int ret;
SM2_KEY public_key;
if (x509_cert_get_subject_public_key(cacert, cacertlen, &public_key) != 1
|| (ret = x509_cert_verify(a, alen, &public_key, NULL, 0)) < 0) {
|| (ret = x509_cert_verify(a, alen, &public_key, signer_id, signer_id_len)) < 0) {
error_print();
return -1;
}
@@ -1015,9 +1066,10 @@ int x509_cert_to_pem(const uint8_t *a, size_t alen, FILE *fp)
int x509_cert_from_pem(uint8_t *a, size_t *alen, size_t maxlen, FILE *fp)
{
if (pem_read(fp, "CERTIFICATE", a, alen, maxlen) != 1) {
error_print();
return -1;
int ret;
if ((ret = pem_read(fp, "CERTIFICATE", a, alen, maxlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
return 1;
}
@@ -1054,17 +1106,20 @@ int x509_cert_from_pem_by_subject(uint8_t *a, size_t *alen, size_t maxlen, const
return 0;
}
int x509_cert_print(FILE *fp, int fmt, int ind, const uint8_t *a, size_t alen)
int x509_cert_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
{
const uint8_t *d;
size_t dlen;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_sequence_from_der(&d, &dlen, &a, &alen) != 1
|| asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
x509_certificate_print(fp, fmt, ind, "Certificate", d, dlen);
x509_certificate_print(fp, fmt, ind, label, d, dlen);
return 1;
}
@@ -1082,11 +1137,14 @@ int x509_cert_get_details(const uint8_t *a, size_t alen,
int *signature_algor,
const uint8_t **signature, size_t *signature_len)
{
const uint8_t *d;
size_t dlen;
const uint8_t *tbs;
size_t tbs_len;
int sig_alg;
const uint8_t *sig; size_t sig_len;
const uint8_t *d;
size_t dlen;
int ver;
const uint8_t *serial; size_t serial_len;
int inner_sig_alg;
@@ -1098,11 +1156,17 @@ int x509_cert_get_details(const uint8_t *a, size_t alen,
const uint8_t *subj_uniq_id; size_t subj_uniq_id_len;
const uint8_t *exts; size_t exts_len;
if (x509_certificate_from_der(&d, &dlen, &sig_alg, &sig, &sig_len, &a, &alen) != 1
if (x509_certificate_from_der(&tbs, &tbs_len, &sig_alg, &sig, &sig_len, &a, &alen) != 1
|| asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
if (asn1_sequence_from_der(&d, &dlen, &tbs, &tbs_len) != 1
|| asn1_length_is_zero(tbs_len) != 1) {
error_print();
return -1;
}
if (x509_explicit_version_from_der(0, &ver, &d, &dlen) < 0
|| asn1_integer_from_der(&serial, &serial_len, &d, &dlen) != 1
|| x509_signature_algor_from_der(&inner_sig_alg, &d, &dlen) != 1

20
src/x509_crl.c
View File

@@ -146,14 +146,11 @@ int x509_crl_entry_ext_id_from_name(const char *name)
int x509_crl_entry_ext_id_to_der(int oid, uint8_t **out, size_t *outlen)
{
const ASN1_OID_INFO *info;
size_t len = 0;
if (!(info = asn1_oid_info_from_oid(x509_crl_entry_exts, x509_crl_entry_exts_count, oid))) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
error_print();
return -1;
}
@@ -163,17 +160,15 @@ int x509_crl_entry_ext_id_to_der(int oid, uint8_t **out, size_t *outlen)
int x509_crl_entry_ext_id_from_der(int *oid, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *p;
size_t len;
const ASN1_OID_INFO *info;
*oid = 0;
if ((ret = asn1_oid_info_from_der(&info, x509_crl_entry_exts, x509_crl_entry_exts_count, in, inlen)) != 1) {
error_print();
return -1;
if (ret < 0) error_print();
else *oid = -1;
return ret;
}
*oid = info->oid;
return ret;
return 1;
}
int x509_crl_entry_exts_add_reason(uint8_t *exts, size_t *extslen, size_t maxlen,
@@ -278,12 +273,15 @@ int x509_revoked_cert_print(FILE *fp, int fmt, int ind, const char *label, const
size_t len;
time_t tv;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_integer_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "userCertificate", p, len);
if (asn1_generalized_time_from_der(&tv, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "revocationDate: %s\n", ctime(&tv));
if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err;
//if (ret) x509_crl_entry_exts_print(fp, fmt, ind, "crlEntryExtensions", p, len); // 这里需要一个函数能够处理
if (ret) x509_crl_entry_exts_print(fp, fmt, ind, "crlEntryExtensions", p, len); // 这里需要一个函数能够处理
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:

34
src/x509_ext.c
View File

@@ -423,6 +423,9 @@ int x509_edi_party_name_print(FILE *fp, int fmt, int ind, const char *label, con
size_t len;
int tag;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if ((ret = x509_explicit_directory_name_from_der(0, &tag, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) x509_directory_name_print(fp, fmt, ind, "nameAssigner", tag, p, len);
if (x509_explicit_directory_name_from_der(1, &tag, &p, &len, &d, &dlen) != 1) goto err;
@@ -443,13 +446,27 @@ int x509_general_name_to_der(int choice, const uint8_t *d, size_t dlen, uint8_t
int x509_general_name_from_der(int *choice, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen)
{
int ret, tag;
int ret;
int tag;
if ((ret = asn1_any_type_from_der(&tag, d, dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
return -1;
switch (tag) {
case ASN1_TAG_IMPLICIT(0): *choice = 0; break;
case ASN1_TAG_IMPLICIT(1): *choice = 1; break;
case ASN1_TAG_IMPLICIT(2): *choice = 2; break;
case ASN1_TAG_IMPLICIT(3): *choice = 3; break;
case ASN1_TAG_IMPLICIT(4): *choice = 4; break;
case ASN1_TAG_IMPLICIT(5): *choice = 5; break;
case ASN1_TAG_IMPLICIT(6): *choice = 6; break;
case ASN1_TAG_IMPLICIT(7): *choice = 7; break;
case ASN1_TAG_IMPLICIT(8): *choice = 8; break;
default:
error_print();
return -1;
}
return 1;
}
int x509_general_name_print(FILE *fp, int fmt, int ind, const char *label, int choice, const uint8_t *d, size_t dlen)
@@ -486,8 +503,15 @@ int x509_general_name_print(FILE *fp, int fmt, int ind, const char *label, int c
int x509_general_names_add_general_name(uint8_t *gns, size_t *gnslen, size_t maxlen,
int choice, const uint8_t *d, size_t dlen)
{
error_print();
return -1;
size_t len = 0;
uint8_t *p = gns + *gnslen;
if (x509_general_name_to_der(choice, d, dlen, NULL, &len) != 1
|| asn1_length_le(*gnslen + len, maxlen) != 1
|| x509_general_name_to_der(choice, d, dlen, &p, gnslen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_general_names_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)

150
src/x509_oid.c
View File

@@ -75,24 +75,25 @@ static uint32_t oid_at_country_name[] = { oid_at,6 };
static uint32_t oid_at_serial_number[] = { oid_at,5 };
static uint32_t oid_at_pseudonym[] = { oid_at,65 };
static uint32_t oid_domain_component[] = { 0,9,2342,19200300,100,1,25 };
static const size_t oid_at_cnt = sizeof(oid_at_name)/sizeof(int);
static const ASN1_OID_INFO x509_name_types[] = {
{ OID_at_name, "name", oid_at_name, 3 },
{ OID_at_surname, "surname", oid_at_surname, 3 },
{ OID_at_given_name, "givenName", oid_at_given_name, 3 },
{ OID_at_initials, "initials", oid_at_initials, 3 },
{ OID_at_generation_qualifier, "generationQualifier", oid_at_generation_qualifier, 3 },
{ OID_at_common_name, "commonName", oid_at_common_name, 3 },
{ OID_at_locality_name, "localityName", oid_at_locality_name, 3 },
{ OID_at_state_or_province_name, "stateOrProvinceName", oid_at_state_or_province_name, 3 },
{ OID_at_organization_name, "organizationName", oid_at_organization_name, 3 },
{ OID_at_organizational_unit_name, "organizationalUnitName", oid_at_organizational_unit_name, 3 },
{ OID_at_title, "title", oid_at_title, 3 },
{ OID_at_dn_qualifier, "dnQualifier", oid_at_dn_qualifier, 3 },
{ OID_at_country_name, "countryName", oid_at_country_name, 3 },
{ OID_at_serial_number, "serialNumber", oid_at_serial_number, 3 },
{ OID_at_pseudonym, "pseudonym", oid_at_pseudonym, 3 },
{ OID_domain_component, "domainComponent", oid_domain_component, 7 },
{ OID_at_name, "name", oid_at_name, oid_at_cnt },
{ OID_at_surname, "surname", oid_at_surname, oid_at_cnt },
{ OID_at_given_name, "givenName", oid_at_given_name, oid_at_cnt },
{ OID_at_initials, "initials", oid_at_initials, oid_at_cnt },
{ OID_at_generation_qualifier, "generationQualifier", oid_at_generation_qualifier, oid_at_cnt },
{ OID_at_common_name, "commonName", oid_at_common_name, oid_at_cnt },
{ OID_at_locality_name, "localityName", oid_at_locality_name, oid_at_cnt },
{ OID_at_state_or_province_name, "stateOrProvinceName", oid_at_state_or_province_name, oid_at_cnt },
{ OID_at_organization_name, "organizationName", oid_at_organization_name, oid_at_cnt },
{ OID_at_organizational_unit_name, "organizationalUnitName", oid_at_organizational_unit_name, oid_at_cnt },
{ OID_at_title, "title", oid_at_title, oid_at_cnt },
{ OID_at_dn_qualifier, "dnQualifier", oid_at_dn_qualifier, oid_at_cnt },
{ OID_at_country_name, "countryName", oid_at_country_name, oid_at_cnt },
{ OID_at_serial_number, "serialNumber", oid_at_serial_number, oid_at_cnt },
{ OID_at_pseudonym, "pseudonym", oid_at_pseudonym, oid_at_cnt },
{ OID_domain_component, "domainComponent", oid_domain_component, sizeof(oid_domain_component)/sizeof(int) },
};
static const int x509_name_types_count
@@ -121,14 +122,11 @@ int x509_name_type_from_name(const char *name)
int x509_name_type_to_der(int oid, uint8_t **out, size_t *outlen)
{
const ASN1_OID_INFO *info;
size_t len = 0;
if (!(info = asn1_oid_info_from_oid(x509_name_types, x509_name_types_count, oid))) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
error_print();
return -1;
}
@@ -138,18 +136,11 @@ int x509_name_type_to_der(int oid, uint8_t **out, size_t *outlen)
int x509_name_type_from_der(int *oid, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
const ASN1_OID_INFO *info;
*oid = 0;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if ((ret = asn1_oid_info_from_der(&info, x509_name_types, x509_name_types_count, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if ((ret = asn1_oid_info_from_der(&info, x509_name_types, x509_name_types_count, &d, &dlen)) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
else *oid = -1;
return ret;
}
*oid = info->oid;
@@ -172,23 +163,24 @@ static uint32_t oid_ce_policy_constraints[] = { oid_ce,36 };
static uint32_t oid_ce_ext_key_usage[] = { oid_ce,37 };
static uint32_t oid_ce_freshest_crl[] = { oid_ce,46 };
static uint32_t oid_ce_inhibit_any_policy[] = { oid_ce,54 };
static const size_t oid_ce_cnt = sizeof(oid_ce_subject_directory_attributes)/sizeof(int);
static const ASN1_OID_INFO x509_ext_ids[] = {
{ OID_ce_authority_key_identifier, "AuthorityKeyIdentifier", oid_ce_authority_key_identifier, 4 },
{ OID_ce_subject_key_identifier, "SubjectKeyIdentifier", oid_ce_subject_key_identifier, 4 },
{ OID_ce_key_usage, "KeyUsage", oid_ce_key_usage, 4 },
{ OID_ce_certificate_policies, "CertificatePolicies", oid_ce_certificate_policies, 4 },
{ OID_ce_policy_mappings, "PolicyMappings", oid_ce_policy_mappings, 4 },
{ OID_ce_subject_alt_name, "SubjectAltName", oid_ce_subject_alt_name, 4 },
{ OID_ce_issuer_alt_name, "IssuerAltName", oid_ce_issuer_alt_name, 4 },
{ OID_ce_subject_directory_attributes, "SubjectDirectoryAttributes", oid_ce_subject_directory_attributes, 4 },
{ OID_ce_basic_constraints, "BasicConstraints", oid_ce_basic_constraints, 4 },
{ OID_ce_name_constraints, "NameConstraints", oid_ce_name_constraints, 4 },
{ OID_ce_policy_constraints, "PolicyConstraints", oid_ce_policy_constraints, 4 },
{ OID_ce_ext_key_usage, "ExtKeyUsage", oid_ce_ext_key_usage, 4 },
{ OID_ce_crl_distribution_points, "CRLDistributionPoints", oid_ce_crl_distribution_points, 4 },
{ OID_ce_inhibit_any_policy, "InhibitAnyPolicy", oid_ce_inhibit_any_policy, 4 },
{ OID_ce_freshest_crl, "FreshestCRL", oid_ce_freshest_crl, 4 },
{ OID_ce_authority_key_identifier, "AuthorityKeyIdentifier", oid_ce_authority_key_identifier, oid_ce_cnt },
{ OID_ce_subject_key_identifier, "SubjectKeyIdentifier", oid_ce_subject_key_identifier, oid_ce_cnt },
{ OID_ce_key_usage, "KeyUsage", oid_ce_key_usage, oid_ce_cnt },
{ OID_ce_certificate_policies, "CertificatePolicies", oid_ce_certificate_policies, oid_ce_cnt },
{ OID_ce_policy_mappings, "PolicyMappings", oid_ce_policy_mappings, oid_ce_cnt },
{ OID_ce_subject_alt_name, "SubjectAltName", oid_ce_subject_alt_name, oid_ce_cnt },
{ OID_ce_issuer_alt_name, "IssuerAltName", oid_ce_issuer_alt_name, oid_ce_cnt },
{ OID_ce_subject_directory_attributes, "SubjectDirectoryAttributes", oid_ce_subject_directory_attributes, oid_ce_cnt },
{ OID_ce_basic_constraints, "BasicConstraints", oid_ce_basic_constraints, oid_ce_cnt },
{ OID_ce_name_constraints, "NameConstraints", oid_ce_name_constraints, oid_ce_cnt },
{ OID_ce_policy_constraints, "PolicyConstraints", oid_ce_policy_constraints, oid_ce_cnt },
{ OID_ce_ext_key_usage, "ExtKeyUsage", oid_ce_ext_key_usage, oid_ce_cnt },
{ OID_ce_crl_distribution_points, "CRLDistributionPoints", oid_ce_crl_distribution_points, oid_ce_cnt },
{ OID_ce_inhibit_any_policy, "InhibitAnyPolicy", oid_ce_inhibit_any_policy, oid_ce_cnt },
{ OID_ce_freshest_crl, "FreshestCRL", oid_ce_freshest_crl, oid_ce_cnt },
};
static const int x509_ext_ids_count =
@@ -217,35 +209,30 @@ int x509_ext_id_from_name(const char *name)
int x509_ext_id_to_der(int oid, uint8_t **out, size_t *outlen)
{
const ASN1_OID_INFO *info;
size_t len = 0;
if (!(info = asn1_oid_info_from_oid(x509_ext_ids, x509_ext_ids_count, oid))) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
// 不同于X509算法，X509扩展的数量比较多，而且很多没有在RFC中，而是由某些大公司给出的, 因此这个函数接口要返回nodes
// 如果要支持未知的ext_id，应该提供一个callback
int x509_ext_id_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *p;
size_t len;
const ASN1_OID_INFO *info;
*oid = 0;
if ((ret = asn1_oid_info_from_der_ex(&info, nodes, nodes_cnt, x509_ext_ids, x509_ext_ids_count, in, inlen)) != 1) {
error_print();
return -1;
if (ret < 0) error_print();
else *oid = -1;
return ret;
}
*oid = info->oid;
return ret;
*oid = info ? info->oid : 0;
return 1;
}
@@ -300,6 +287,7 @@ int x509_qualifier_id_from_der(int *oid, const uint8_t **in, size_t *inlen)
const ASN1_OID_INFO *info;
if ((ret = asn1_oid_info_from_der(&info, x509_qt_ids, x509_qt_ids_count, in, inlen)) != 1) {
if (ret < 0) error_print();
else *oid = -1;
return ret;
}
*oid = info->oid;
@@ -307,6 +295,22 @@ int x509_qualifier_id_from_der(int *oid, const uint8_t **in, size_t *inlen)
}
int x509_cert_policy_id_from_name(const char *name)
{
if (strcmp(name, "anyPolicy") == 0) {
return OID_any_policy;
}
return OID_undef;
}
char *x509_cert_policy_id_name(int oid)
{
switch (oid) {
case OID_any_policy: return "anyPolicy";
}
return NULL;
}
static uint32_t oid_any_policy[] = { oid_ce,32,0 };
int x509_cert_policy_id_to_der(int oid, const uint32_t *nodes, size_t nodes_cnt, uint8_t **out, size_t *outlen)
@@ -334,9 +338,9 @@ int x509_cert_policy_id_to_der(int oid, const uint32_t *nodes, size_t nodes_cnt,
int x509_cert_policy_id_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **in, size_t *inlen)
{
int ret;
*oid = OID_undef;
if ((ret = asn1_object_identifier_from_der(nodes, nodes_cnt, in, inlen)) != 1) {
if (ret < 0) error_print();
*oid = -1;
return ret;
}
if (*nodes_cnt == sizeof(oid_any_policy)/sizeof(int)
@@ -346,23 +350,6 @@ int x509_cert_policy_id_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, c
return 1;
}
int x509_cert_policy_id_from_name(const char *name)
{
if (strcmp(name, "anyPolicy") == 0) {
return OID_any_policy;
}
return OID_undef;
}
char *x509_cert_policy_id_name(int oid)
{
switch (oid) {
case OID_any_policy: return "anyPolicy";
}
return NULL;
}
#define oid_kp oid_pkix,3
@@ -372,15 +359,16 @@ static uint32_t oid_kp_code_signing[] = { oid_kp,3 };
static uint32_t oid_kp_email_protection[] = { oid_kp,4 };
static uint32_t oid_kp_time_stamping[] = { oid_kp,8 };
static uint32_t oid_kp_ocsp_signing[] = { oid_kp,9 };
static const size_t oid_kp_cnt = sizeof(oid_kp_server_auth)/sizeof(int);
static const ASN1_OID_INFO x509_key_purposes[] = {
{ OID_kp_server_auth, "serverAuth", oid_kp_server_auth, 9, 0, "TLS WWW server authentication" },
{ OID_kp_client_auth, "clientAuth", oid_kp_client_auth, 9, 0, "TLS WWW client authentication" },
{ OID_kp_code_signing, "codeSigning", oid_kp_code_signing, 9, 0, "Signing of downloadable executable code" },
{ OID_kp_email_protection, "emailProtection", oid_kp_email_protection, 9, 0, "Email protection" },
{ OID_kp_time_stamping, "timeStamping", oid_kp_time_stamping, 9, 0, "Binding the hash of an object to a time" },
{ OID_kp_ocsp_signing, "OCSPSigning", oid_kp_ocsp_signing, 9, 0, "Signing OCSP responses" },
{ OID_kp_server_auth, "serverAuth", oid_kp_server_auth, oid_kp_cnt, 0, "TLS WWW server authentication" },
{ OID_kp_client_auth, "clientAuth", oid_kp_client_auth, oid_kp_cnt, 0, "TLS WWW client authentication" },
{ OID_kp_code_signing, "codeSigning", oid_kp_code_signing, oid_kp_cnt, 0, "Signing of downloadable executable code" },
{ OID_kp_email_protection, "emailProtection", oid_kp_email_protection, oid_kp_cnt, 0, "Email protection" },
{ OID_kp_time_stamping, "timeStamping", oid_kp_time_stamping, oid_kp_cnt, 0, "Binding the hash of an object to a time" },
{ OID_kp_ocsp_signing, "OCSPSigning", oid_kp_ocsp_signing, oid_kp_cnt, 0, "Signing OCSP responses" },
};
static const int x509_key_purposes_count =
@@ -434,9 +422,9 @@ int x509_key_purpose_from_der(int *oid, const uint8_t **in, size_t *inlen)
{
int ret;
const ASN1_OID_INFO *info;
if ((ret = asn1_oid_info_from_der(&info, x509_key_purposes, x509_key_purposes_count, in, inlen)) != 1) {
if (ret < 0) error_print();
else *oid = 0;
return ret;
}
*oid = info->oid;

511
src/x509_prn.c
View File

@@ -1,511 +0,0 @@
/*
* Copyright (c) 2014 - 2020 The GmSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the GmSSL Project.
* (http://gmssl.org/)"
*
* 4. The name "GmSSL Project" must not be used to endorse or promote
* products derived from this software without prior written
* permission. For written permission, please contact
* guanzhi1980@gmail.com.
*
* 5. Products derived from this software may not be called "GmSSL"
* nor may "GmSSL" appear in their names without prior written
* permission of the GmSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the GmSSL Project
* (http://gmssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE GmSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <assert.h>
#include <gmssl/sm2.h>
#include <gmssl/oid.h>
#include <gmssl/asn1.h>
#include <gmssl/x509.h>
#include <gmssl/error.h>
int x509_other_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
uint32_t nodes[32];
size_t nodes_count;
const uint8_t *value;
size_t valuelen;
format_print(fp, fmt, ind, "%s:\n", label);
ind += 4;
if (asn1_object_identifier_from_der(nodes, &nodes_count, &d, &dlen) != 1
|| asn1_explicit_from_der(0, &value, &valuelen, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
asn1_oid_nodes_print(fp, fmt, ind, "type-id", "unknown", nodes, nodes_count);
format_bytes(fp, fmt, ind, "value: ", value, valuelen);
return 1;
}
int x509_edi_party_name_print(FILE *fp, int fmt, int ind, const char *label,const uint8_t *d, size_t dlen)
{
const uint8_t *name_assigner;
const uint8_t *party_name;
size_t name_assigner_len, party_name_len;
format_print(fp, fmt, ind, "%s:\n", label);
ind += 4;
if (asn1_explicit_from_der(0, &name_assigner, &name_assigner_len, &d, &dlen) < 0
|| asn1_explicit_from_der(1, &party_name, &party_name_len, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (name_assigner) {
if (x509_directory_string_print(fp, fmt, ind, "nameAssigner",
name_assigner, name_assigner_len) != 1) {
error_print();
return -1;
}
}
if (x509_directory_string_print(fp, fmt, ind, "partyName", party_name, party_name_len) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_general_name_print(FILE *fp, int fmt, int ind, const char *label, int tag, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
switch (tag) {
case ASN1_TAG_IMPLICIT(0): return x509_other_name_print(fp, fmt, ind, "otherName", d, dlen);
case ASN1_TAG_IMPLICIT(1): return asn1_string_print(fp, fmt, ind, "rfc822Name", (char *)d, dlen);
case ASN1_TAG_IMPLICIT(2): return asn1_string_print(fp, fmt, ind, "DNSName", (char *)d, dlen);
case ASN1_TAG_IMPLICIT(3): return format_bytes(fp, fmt, ind, "x400Address", d, dlen);
case ASN1_TAG_IMPLICIT(4): return x509_name_print(fp, fmt, ind, "directoryName", d, dlen);
case ASN1_TAG_IMPLICIT(5): return x509_edi_party_name_print(fp, fmt, ind, "ediPartyName", d, dlen);
case ASN1_TAG_IMPLICIT(6): return asn1_string_print(fp, fmt, ind, "URI", (char *)d, dlen);
case ASN1_TAG_IMPLICIT(7): return format_bytes(fp, fmt, ind, "IPAddress", d, dlen);
case ASN1_TAG_IMPLICIT(8): return asn1_object_identifier_print(fp, fmt, ind, "registeredID", d, dlen);
default:
error_print();
return -1;
}
return 1;
}
int x509_general_names_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
while (dlen) {
int tag;
const uint8_t *p;
size_t len;
if (asn1_any_type_from_der(&tag, &p, &len, &d, &dlen) != 1
|| x509_general_name_print(fp, fmt, ind, NULL, tag, p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_key_usage_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int usage;
if (asn1_bits_from_der(&usage, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
format_print(fp, fmt, ind, "keyUsage:\n");
ind += 4;
if (usage & X509_KU_DIGITAL_SIGNATURE)
format_print(fp, fmt, ind, "DigitalSignature\n");
if (usage & X509_KU_NON_REPUDIATION)
format_print(fp, fmt, ind, "NonRepudiation\n");
if (usage & X509_KU_KEY_ENCIPHERMENT)
format_print(fp, fmt, ind, "KeyEncipherment\n");
if (usage & X509_KU_DATA_ENCIPHERMENT)
format_print(fp, fmt, ind, "DataEncipherment\n");
if (usage & X509_KU_KEY_AGREEMENT)
format_print(fp, fmt, ind, "KeyAgreement\n");
if (usage & X509_KU_KEY_CERT_SIGN)
format_print(fp, fmt, ind, "KeyCertSign\n");
if (usage & X509_KU_CRL_SIGN)
format_print(fp, fmt, ind, "CRLSign\n");
if (usage & X509_KU_ENCIPHER_ONLY)
format_print(fp, fmt, ind, "EncipherOnly\n");
if (usage & X509_KU_DECIPHER_ONLY)
format_print(fp, fmt, ind, "DecipherOnly\n");
return 1;
}
int x509_authority_key_identifier_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *keyid, *issuer, *serial;
size_t keyid_len, issuer_len, serial_len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_implicit_octet_string_from_der(0, &keyid, &keyid_len, &d, &dlen) < 0
|| asn1_implicit_sequence_from_der(1, &issuer, &issuer_len, &d, &dlen) < 0
|| asn1_implicit_integer_from_der(2, &serial, &serial_len, &d, &dlen) < 0
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (keyid) {
format_bytes(fp, fmt, ind, "keyIdentifier : ", keyid, keyid_len);
}
if (issuer) {
x509_general_names_print(fp, fmt, ind, "authorityCertIssuer", issuer, issuer_len);
}
if (serial) {
format_bytes(fp, fmt, ind, "authorityCertSerialNumber", serial, serial_len);
}
return 1;
}
int x509_policy_information_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1) goto err;
return 1;
}
int x509_certificate_policies_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
const uint8_t *p;
size_t len;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_policy_information_print(fp, fmt, ind, "PolicyInformation", p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_policy_mapping_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return 1;
}
int x509_policy_mappings_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
const uint8_t *p;
size_t len;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1
|| x509_policy_mapping_print(fp, fmt, ind, "PolicyMapping", p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_attribute_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return 1;
}
int x509_attributes_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
const uint8_t *p;
size_t len;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1
|| x509_attribute_print(fp, fmt, ind, "Attribute", p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_basic_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
int val;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if ((ret = asn1_boolean_from_der(&val, &d, &dlen)) < 0) goto err;
else if (ret)
format_print(fp, fmt, ind, "cA: %s\n", val ? "true" : "false");
if ((ret = asn1_int_from_der(&val, &d, &dlen)) < 0) goto err;
else if (ret)
format_print(fp, fmt, ind, "pathLenConstraint: %d\n", val);
return 1;
err:
error_print();
return -1;
}
int x509_general_subtree_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
int val;
const uint8_t *p;
size_t len;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if (asn1_any_type_from_der(&val, &p, &len, &d, &dlen) != 1) goto err;
if (x509_general_name_print(fp, fmt, ind, "base", val, p, len) != 1) goto err;
if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "minimum: %d\n", val);
if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "maximum: %d\n", val);
if (dlen) {
format_bytes(fp, fmt, ind, "", d, dlen);
goto err;
}
return 1;
err:
error_print();
return -1;
}
int x509_general_subtrees_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
const uint8_t *p;
size_t len;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1
|| x509_general_subtree_print(fp, fmt, ind, "GeneralSubtree", p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_name_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
const uint8_t *p;
size_t len;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err;
if (ret) {
x509_general_subtrees_print(fp, fmt, ind, "permittedSubtrees", p, len);
}
if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err;
if (ret) {
x509_general_subtrees_print(fp, fmt, ind, "excludedSubtrees", p, len);
}
if (dlen) {
}
return 1;
err:
error_print();
return -1;
}
int x509_policy_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
int val;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "requireExplicitPolicy: %d\n", val);
if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "inhibitPolicyMapping: %d\n", val);
if (dlen) {
format_bytes(fp, fmt, ind, "", d, dlen);
goto err;
}
return 1;
err:
error_print();
return -1;
}
int x509_ext_key_usage_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
int oid;
if (x509_key_purpose_from_der(&oid, &d, &dlen) != 1) {
error_print();
return -1;
}
format_print(fp, fmt, ind, "%s\n", x509_key_purpose_name(oid));
}
return 1;
}
int x509_distribution_point_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return -1;
}
int x509_reason_flags_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
return -1;
}
int x509_distribution_point_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret;
int val;
const uint8_t *p;
size_t len;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if ((ret = asn1_explicit_from_der(0, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) {
if (x509_distribution_point_name_print(fp, fmt, ind, "distributionPoint", p, len) != 1) {
error_print();
return -1;
}
}
if ((ret = asn1_implicit_bits_from_der(1, &val, &d, &dlen)) < 0) goto err;
if (ret) {
x509_reason_flags_print(fp, fmt, ind, "reasons", p, len);
}
if ((ret = asn1_implicit_sequence_from_der(2, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) {
x509_general_names_print(fp, fmt, ind, "cRLIssuer", p, len);
}
if (dlen) {
format_bytes(fp, fmt, ind, "", d, dlen);
goto err;
}
return 1;
err:
error_print();
return -1;
}
int x509_crl_distribution_points_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
const uint8_t *p;
size_t len;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_distribution_point_print(fp, fmt, ind, "DistributionPoint", p, len) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_directory_string_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
{
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
return -1;
}

4
src/x509_req.c
View File

@@ -350,7 +350,7 @@ int x509_req_get_details(const uint8_t *req, size_t reqlen,
return 1;
}
int x509_req_print(FILE *fp, int fmt, int ind, const uint8_t *req, size_t reqlen)
int x509_req_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *req, size_t reqlen)
{
const uint8_t *d;
size_t dlen;
@@ -360,7 +360,7 @@ int x509_req_print(FILE *fp, int fmt, int ind, const uint8_t *req, size_t reqlen
error_print();
return -1;
}
x509_request_print(fp, fmt, ind, "CertificationRequest", d, dlen);
x509_request_print(fp, fmt, ind, label, d, dlen);
return 1;
}

1
src/x509_str.c
View File

@@ -105,6 +105,7 @@ int x509_directory_name_check_ex(int tag, const uint8_t *d, size_t dlen, size_t
return -1;
}
if (dlen < minlen || dlen > maxlen) {
printf("%s %d: dlen = %zu, minlen = %zu, maxlne = %zu\n", __FILE__, __LINE__, dlen, minlen, maxlen);
error_print();
return -1;
}