/* * Copyright 2014-2023 The GmSSL Project. All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the License); you may * not use this file except in compliance with the License. * * http://www.apache.org/licenses/LICENSE-2.0 */ #include #include #include #include #include #include #include #include #include #include #include static uint32_t oid_ce_subject_directory_attributes[] = { oid_ce,9 }; static uint32_t oid_ce_subject_key_identifier[] = { oid_ce,14 }; static uint32_t oid_ce_key_usage[] = { oid_ce,15 }; static uint32_t oid_ce_subject_alt_name[] = { oid_ce,17 }; static uint32_t oid_ce_issuer_alt_name[] = { oid_ce,18 }; static uint32_t oid_ce_basic_constraints[] = { oid_ce,19 }; static uint32_t oid_ce_name_constraints[] = { oid_ce,30 }; static uint32_t oid_ce_crl_distribution_points[] = { oid_ce,31 }; static uint32_t oid_ce_certificate_policies[] = { oid_ce,32 }; static uint32_t oid_ce_policy_mappings[] = { oid_ce,33 }; static uint32_t oid_ce_authority_key_identifier[] = { oid_ce,35 }; static uint32_t oid_ce_policy_constraints[] = { oid_ce,36 }; static uint32_t oid_ce_ext_key_usage[] = { oid_ce,37 }; static uint32_t oid_ce_freshest_crl[] = { oid_ce,46 }; static uint32_t oid_ce_inhibit_any_policy[] = { oid_ce,54 }; static uint32_t oid_ce_crl_reasons[] = { oid_ce,21 }; // crl_entry_ext static uint32_t oid_ce_invalidity_date[] = { oid_ce,24 }; // crl_entry_ext static uint32_t oid_ce_certificate_issuer[] = { oid_ce,29 }; // crl_entry_ext #define OID_CE_CNT sizeof(oid_ce_subject_directory_attributes)/sizeof(int) static uint32_t oid_netscape_cert_type[] = { 2,16,840,1,113730,1,1 }; static uint32_t oid_netscape_cert_comment[] = { 2,16,840,1,113730,1,13 }; static uint32_t oid_pe_authority_info_access[] = { 1,3,6,1,5,5,7,1,1 }; static uint32_t oid_ct_precertificate_scts[] = { 1,3,6,1,4,1,11129,2,4,2 }; static const ASN1_OID_INFO x509_ext_ids[] = { { OID_ce_authority_key_identifier, "AuthorityKeyIdentifier", oid_ce_authority_key_identifier, OID_CE_CNT }, { OID_ce_subject_key_identifier, "SubjectKeyIdentifier", oid_ce_subject_key_identifier, OID_CE_CNT }, { OID_ce_key_usage, "KeyUsage", oid_ce_key_usage, OID_CE_CNT }, { OID_ce_certificate_policies, "CertificatePolicies", oid_ce_certificate_policies, OID_CE_CNT }, { OID_ce_policy_mappings, "PolicyMappings", oid_ce_policy_mappings, OID_CE_CNT }, { OID_ce_subject_alt_name, "SubjectAltName", oid_ce_subject_alt_name, OID_CE_CNT }, { OID_ce_issuer_alt_name, "IssuerAltName", oid_ce_issuer_alt_name, OID_CE_CNT }, { OID_ce_subject_directory_attributes, "SubjectDirectoryAttributes", oid_ce_subject_directory_attributes, OID_CE_CNT }, { OID_ce_basic_constraints, "BasicConstraints", oid_ce_basic_constraints, OID_CE_CNT }, { OID_ce_name_constraints, "NameConstraints", oid_ce_name_constraints, OID_CE_CNT }, { OID_ce_policy_constraints, "PolicyConstraints", oid_ce_policy_constraints, OID_CE_CNT }, { OID_ce_ext_key_usage, "ExtKeyUsage", oid_ce_ext_key_usage, OID_CE_CNT }, { OID_ce_crl_distribution_points, "CRLDistributionPoints", oid_ce_crl_distribution_points, OID_CE_CNT }, { OID_ce_inhibit_any_policy, "InhibitAnyPolicy", oid_ce_inhibit_any_policy, OID_CE_CNT }, { OID_ce_freshest_crl, "FreshestCRL", oid_ce_freshest_crl, OID_CE_CNT }, { OID_ce_crl_reasons, "CRLReasons", oid_ce_crl_reasons, OID_CE_CNT }, { OID_ce_invalidity_date, "InvalidityDate", oid_ce_invalidity_date, OID_CE_CNT }, { OID_ce_certificate_issuer, "CertificateIssuer", oid_ce_certificate_issuer, OID_CE_CNT }, { OID_netscape_cert_type, "NetscapeCertType", oid_netscape_cert_type, sizeof(oid_netscape_cert_type)/sizeof(int) }, { OID_netscape_cert_comment, "NetscapeCertComment", oid_netscape_cert_comment, sizeof(oid_netscape_cert_comment)/sizeof(int) }, { OID_pe_authority_info_access, "AuthorityInformationAccess", oid_pe_authority_info_access, sizeof(oid_pe_authority_info_access)/sizeof(int) }, { OID_ct_precertificate_scts, "CT-PrecertificateSCTs", oid_ct_precertificate_scts, sizeof(oid_ct_precertificate_scts)/sizeof(int) }, }; static const int x509_ext_ids_count = sizeof(x509_ext_ids)/sizeof(x509_ext_ids[0]); const char *x509_ext_id_name(int oid) { const ASN1_OID_INFO *info; if (oid == 0) { return NULL; } if (!(info = asn1_oid_info_from_oid(x509_ext_ids, x509_ext_ids_count, oid))) { error_print(); return NULL; } return info->name; } int x509_ext_id_from_name(const char *name) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_name(x509_ext_ids, x509_ext_ids_count, name))) { error_print(); return OID_undef; } return info->oid; } int x509_ext_id_to_der(int oid, uint8_t **out, size_t *outlen) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_ext_ids, x509_ext_ids_count, oid))) { error_print(); return -1; } if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_ext_id_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **in, size_t *inlen) { int ret; const ASN1_OID_INFO *info; if ((ret = asn1_oid_info_from_der_ex(&info, nodes, nodes_cnt, x509_ext_ids, x509_ext_ids_count, in, inlen)) != 1) { if (ret < 0) error_print(); else *oid = -1; return ret; } *oid = info ? info->oid : 0; return 1; } int x509_ext_to_der(int oid, int critical, const uint8_t *val, size_t vlen, uint8_t **out, size_t *outlen) { size_t len = 0; if (vlen == 0) { return 0; } if (x509_ext_id_to_der(oid, NULL, &len) != 1 || asn1_boolean_to_der(critical, NULL, &len) < 0 || asn1_octet_string_to_der(val, vlen, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_ext_id_to_der(oid, out, outlen) != 1 || asn1_boolean_to_der(critical, out, outlen) < 0 || asn1_octet_string_to_der(val, vlen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_ext_to_der_ex(int oid, int critical, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen) { size_t vlen = 0; size_t len = 0; if (dlen == 0) { return 0; } if (asn1_sequence_to_der(d, dlen, NULL, &vlen) != 1) { error_print(); return -1; } if (x509_ext_id_to_der(oid, NULL, &len) != 1 || asn1_boolean_to_der(critical, NULL, &len) < 0 || asn1_tag_to_der(ASN1_TAG_OCTET_STRING, NULL, &len) != 1 || asn1_length_to_der(vlen, NULL, &len) != 1 || asn1_sequence_to_der(d, dlen, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_ext_id_to_der(oid, out, outlen) != 1 || asn1_boolean_to_der(critical, out, outlen) < 0 || asn1_tag_to_der(ASN1_TAG_OCTET_STRING, out, outlen) != 1 || asn1_length_to_der(vlen, out, outlen) != 1 || asn1_sequence_to_der(d, dlen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_ext_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, int *critical, const uint8_t **val, size_t *vlen, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_ext_id_from_der(oid, nodes, nodes_cnt, &d, &dlen) != 1 || asn1_boolean_from_der(critical, &d, &dlen) < 0 || asn1_octet_string_from_der(val, vlen, &d, &dlen) != 1 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_ext_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret, oid, critical; uint32_t nodes[32]; size_t nodes_cnt; const uint8_t *val; size_t vlen; const uint8_t *p; size_t len; int ival; const char *name; if (label) { format_print(fp, fmt, ind, "%s\n", label); ind += 4; } if (x509_ext_id_from_der(&oid, nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "extnID", x509_ext_id_name(oid), nodes, nodes_cnt); if ((ret = asn1_boolean_from_der(&critical, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "critical: %s\n", asn1_boolean_name(critical)); if (asn1_octet_string_from_der(&val, &vlen, &d, &dlen) != 1) goto err; switch (oid) { case OID_ce_subject_key_identifier: if (asn1_octet_string_from_der(&p, &len, &val, &vlen) != 1) { error_print(); return -1; } break; case OID_ce_key_usage: case OID_netscape_cert_type: if (asn1_bits_from_der(&ival, &val, &vlen) != 1) { error_print(); return -1; } break; case OID_ce_inhibit_any_policy: if (asn1_int_from_der(&ival, &val, &vlen) != 1) { error_print(); return -1; } break; case OID_netscape_cert_comment: if (asn1_ia5_string_from_der((const char **)&p, &len, &val, &vlen) != 1) { error_print(); return -1; } break; case OID_ct_precertificate_scts: case OID_undef: p = val; len = vlen; vlen = 0; break; default: if (asn1_sequence_from_der(&p, &len, &val, &vlen) != 1) { error_print(); return -1; } } if (asn1_length_is_zero(vlen) != 1) { error_print(); return -1; } name = x509_ext_id_name(oid); switch (oid) { case OID_ce_authority_key_identifier: return x509_authority_key_identifier_print(fp, fmt, ind, name, p, len); case OID_ce_subject_key_identifier: return format_bytes(fp, fmt, ind, name, p, len); case OID_ce_key_usage: return x509_key_usage_print(fp, fmt, ind, name, ival); case OID_ce_certificate_policies: return x509_certificate_policies_print(fp, fmt, ind, name, p, len); case OID_ce_policy_mappings: return x509_policy_mappings_print(fp, fmt, ind, name, p, len); case OID_ce_subject_alt_name: return x509_general_names_print(fp, fmt, ind, name, p, len); case OID_ce_issuer_alt_name: return x509_general_names_print(fp, fmt, ind, name, p, len); case OID_ce_subject_directory_attributes: return x509_attributes_print(fp, fmt, ind, name, p, len); case OID_ce_basic_constraints: return x509_basic_constraints_print(fp, fmt, ind, name, p, len); case OID_ce_name_constraints: return x509_name_constraints_print(fp, fmt, ind, name, p, len); case OID_ce_policy_constraints: return x509_policy_constraints_print(fp, fmt, ind, name, p, len); case OID_ce_ext_key_usage: return x509_ext_key_usage_print(fp, fmt, ind, name, p, len); case OID_ce_crl_distribution_points: return x509_crl_distribution_points_print(fp, fmt, ind, name, p, len); case OID_ce_inhibit_any_policy: format_print(fp, fmt, ind, "%s: %d\n", name, ival); case OID_ce_freshest_crl: return x509_freshest_crl_print(fp, fmt, ind, name, p, len); case OID_netscape_cert_type: return x509_netscape_cert_type_print(fp, fmt, ind, name, ival); case OID_netscape_cert_comment: return format_string(fp, fmt, ind, name, p, len); case OID_pe_authority_info_access: return x509_authority_info_access_print(fp, fmt, ind, name, p, len); default: format_bytes(fp, fmt, ind, "extnValue", p, len); } return 1; err: error_print(); return -1; } int x509_exts_add_sequence(uint8_t *exts, size_t *extslen, size_t maxlen, int oid, int critical, const uint8_t *d, size_t dlen) { size_t curlen = *extslen; if (dlen == 0) { return 0; } exts += *extslen; if (x509_ext_to_der_ex(oid, critical, d, dlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der_ex(oid, critical, d, dlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_authority_key_identifier(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *keyid, size_t keyid_len, const uint8_t *issuer, size_t issuer_len, const uint8_t *serial, size_t serial_len) { int oid = OID_ce_authority_key_identifier; size_t curlen = *extslen; uint8_t val[512]; uint8_t *p = val; size_t vlen = 0; size_t len = 0; if (keyid_len == 0 && issuer_len == 0 && serial_len == 0) { return 0; } exts += *extslen; if (x509_authority_key_identifier_to_der( keyid, keyid_len, issuer, issuer_len, serial, serial_len, NULL, &len) != 1 || asn1_length_le(len, sizeof(val)) != 1 || x509_authority_key_identifier_to_der( keyid, keyid_len, issuer, issuer_len, serial, serial_len, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_default_authority_key_identifier(uint8_t *exts, size_t *extslen, size_t maxlen, const SM2_KEY *public_key) { uint8_t id[32]; int critical = -1; if (!public_key) { return 0; } if (sm2_public_key_digest(public_key, id) != 1) { error_print(); return -1; } if (x509_exts_add_authority_key_identifier(exts, extslen, maxlen, critical, id, sizeof(id), NULL, 0, NULL, 0) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_subject_key_identifier(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_subject_key_identifier; size_t curlen = *extslen; uint8_t val[32 + X509_SUBJECT_KEY_IDENTIFIER_MAX_LEN]; uint8_t *p = val; size_t vlen = 0; if (dlen == 0) { return 0; } if (dlen < X509_SUBJECT_KEY_IDENTIFIER_MIN_LEN || dlen > X509_SUBJECT_KEY_IDENTIFIER_MAX_LEN) { error_print(); return -1; } exts += *extslen; if (asn1_octet_string_to_der(d, dlen, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_subject_key_identifier_ex(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const SM2_KEY *subject_key) { uint8_t id[32]; if (!subject_key) { return 0; } if (sm2_public_key_digest(subject_key, id) != 1) { error_print(); return -1; } if (x509_exts_add_subject_key_identifier(exts, extslen, maxlen, critical, id, 32) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_key_usage(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, int bits) { int oid = OID_ce_key_usage; size_t curlen = *extslen; uint8_t val[16]; uint8_t *p = val; size_t vlen = 0; if (bits == -1) { return 0; } if (!bits) { if (x509_key_usage_check(bits, -1) != 1) { error_print(); return -1; } } exts += *extslen; if (asn1_bits_to_der(bits, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_certificate_policies(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_certificate_policies; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_add_policy_mappings(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_policy_mappings; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_add_subject_alt_name(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_subject_alt_name; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_add_issuer_alt_name(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_issuer_alt_name; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_add_subject_directory_attributes(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_subject_directory_attributes; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_add_name_constraints(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *permitted_subtrees, size_t permitted_subtrees_len, const uint8_t *excluded_subtrees, size_t excluded_subtrees_len) { int oid = OID_ce_name_constraints; size_t curlen = *extslen; uint8_t val[512]; uint8_t *p = val; size_t vlen = 0; size_t len = 0; if (permitted_subtrees_len == 0 && excluded_subtrees_len == 0) { return 0; } exts += *extslen; if (x509_name_constraints_to_der( permitted_subtrees, permitted_subtrees_len, excluded_subtrees, excluded_subtrees_len, NULL, &len) != 1 || asn1_length_le(len, sizeof(val)) != 1 || x509_name_constraints_to_der( permitted_subtrees, permitted_subtrees_len, excluded_subtrees, excluded_subtrees_len, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_policy_constraints(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, int require_explicit_policy, int inhibit_policy_mapping) { int oid = OID_ce_policy_constraints; size_t curlen = *extslen; uint8_t val[32]; uint8_t *p = val; size_t vlen = 0; if (require_explicit_policy == -1 && inhibit_policy_mapping == -1) { return 0; } exts += *extslen; if (x509_policy_constraints_to_der( require_explicit_policy, inhibit_policy_mapping, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_basic_constraints(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, int ca, int path_len_constraint) { int oid = OID_ce_basic_constraints; size_t curlen = *extslen; uint8_t val[32]; uint8_t *p = val; size_t vlen = 0; if (ca == -1 && path_len_constraint == -1) { return 0; } exts += *extslen; if (x509_basic_constraints_to_der(ca, path_len_constraint, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_ext_key_usage(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const int *key_purposes, size_t key_purposes_cnt) { int oid = OID_ce_ext_key_usage; size_t curlen = *extslen; uint8_t val[256]; uint8_t *p = val; size_t vlen = 0; size_t len = 0; if (key_purposes_cnt == 0) { return 0; } exts += *extslen; if (x509_ext_key_usage_to_der(key_purposes, key_purposes_cnt, NULL, &len) != 1 || asn1_length_le(len, sizeof(val)) != 1 || x509_ext_key_usage_to_der(key_purposes, key_purposes_cnt, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_crl_distribution_points_ex(uint8_t *exts, size_t *extslen, size_t maxlen, int oid, int critical, const char *uri, size_t urilen, const char *ldap_uri, size_t ldap_urilen) { size_t curlen = *extslen; uint8_t val[256]; uint8_t *p = val; size_t vlen = 0; size_t len = 0; if (urilen == 0 && ldap_urilen == 0) { return 0; } if (x509_uri_as_distribution_points_to_der(uri, urilen, -1, NULL, 0, NULL, &len) != 1 || asn1_length_le(len, sizeof(val)) != 1 || x509_uri_as_distribution_points_to_der(uri, urilen, -1, NULL, 0, &p, &vlen) != 1) { error_print(); return -1; } exts += *extslen; if (x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_crl_distribution_points(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const char *http_uri, size_t http_urilen, const char *ldap_uri, size_t ldap_urilen) { int oid = OID_ce_crl_distribution_points; if (x509_exts_add_crl_distribution_points_ex(exts, extslen, maxlen, oid, critical, http_uri, http_urilen, ldap_uri, ldap_urilen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_inhibit_any_policy(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, int skip_certs) { int oid = OID_ce_inhibit_any_policy; size_t curlen = *extslen; uint8_t val[16]; uint8_t *p = val; size_t vlen = 0; if (skip_certs == -1) { return 0; } exts += *extslen; if (x509_inhibit_any_policy_to_der(skip_certs, &p, &vlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; } int x509_exts_add_freshest_crl(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const uint8_t *d, size_t dlen) { int oid = OID_ce_freshest_crl; return x509_exts_add_sequence(exts, extslen, maxlen, oid, critical, d, dlen); } int x509_exts_get_ext_by_oid(const uint8_t *d, size_t dlen, int oid, int *critical, const uint8_t **val, size_t *vlen) { int ext_id; uint32_t nodes[32]; size_t nodes_cnt; while (dlen) { if (x509_ext_from_der(&ext_id, nodes, &nodes_cnt, critical, val, vlen, &d, &dlen) != 1) { error_print(); return -1; } if (ext_id == oid) { return 1; } } *critical = -1; *val = NULL; *vlen = 0; return 0; } int x509_exts_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; if (label) { format_print(fp, fmt, ind, "%s\n", label); ind += 4; } while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_ext_print(fp, fmt, ind, "Extension", p, len); } return 1; } // GeneralName int x509_other_name_to_der( const uint32_t *type_nodes, size_t type_nodes_cnt, const uint8_t *value_a, size_t value_alen, uint8_t **out, size_t *outlen) { size_t len = 0; if (type_nodes_cnt == 0 && value_alen == 0) { return 0; } if (asn1_object_identifier_to_der(type_nodes, type_nodes_cnt, NULL, &len) != 1 || asn1_explicit_to_der(0, value_a, value_alen, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_object_identifier_to_der(type_nodes, type_nodes_cnt, out, outlen) != 1 || asn1_explicit_to_der(0, value_a, value_alen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_other_name_from_der( uint32_t *type_nodes, size_t *type_nodes_cnt, const uint8_t **value, size_t *value_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *p; size_t len; if ((ret = asn1_sequence_from_der(&p, &len, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (asn1_object_identifier_from_der(type_nodes, type_nodes_cnt, &p, &len) != 1 || asn1_explicit_from_der(0, value, value_len, &p, &len) != 1 || asn1_length_is_zero(len) != 1) { error_print(); return -1; } return 1; } int x509_other_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { uint32_t nodes[32]; size_t nodes_cnt; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "type-id", NULL, nodes, nodes_cnt); if (asn1_explicit_from_der(0, &p, &len, &d, &dlen) != 1) goto err; format_bytes(fp, fmt, ind, "value", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_edi_party_name_to_der( int assigner_choice, const uint8_t *assigner, size_t assigner_len, int party_name_choice, const uint8_t *party_name, size_t party_name_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (assigner_len == 0 && party_name_len == 0) { return 0; } if (x509_explicit_directory_name_to_der(0, assigner_choice, assigner, assigner_len, NULL, &len) < 0 || x509_explicit_directory_name_to_der(1, party_name_choice, party_name, party_name_len, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_explicit_directory_name_to_der(0, assigner_choice, assigner, assigner_len, out, outlen) < 0 || x509_explicit_directory_name_to_der(1, party_name_choice, party_name, party_name_len, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_edi_party_name_from_der( int *assigner_choice, const uint8_t **assigner, size_t *assigner_len, int *party_name_choice, const uint8_t **party_name, size_t *party_name_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *p; size_t len; if ((ret = asn1_sequence_from_der(&p, &len, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_explicit_directory_name_from_der(0, assigner_choice, assigner, assigner_len, &p, &len) < 0 || x509_explicit_directory_name_from_der(1, party_name_choice, party_name, party_name_len, &p, &len) != 1 || asn1_length_is_zero(len) != 1) { error_print(); return -1; } return 1; } int x509_edi_party_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret; const uint8_t *p; size_t len; int tag; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = x509_explicit_directory_name_from_der(0, &tag, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_directory_name_print(fp, fmt, ind, "nameAssigner", tag, p, len); if (x509_explicit_directory_name_from_der(1, &tag, &p, &len, &d, &dlen) != 1) goto err; x509_directory_name_print(fp, fmt, ind, "partyName", tag, p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_general_name_to_der(int choice, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen) { int ret; if (dlen == 0) { return 0; } switch (choice) { case X509_gn_other_name: case X509_gn_rfc822_name: case X509_gn_dns_name: case X509_gn_x400_address: case X509_gn_directory_name: case X509_gn_edi_party_name: case X509_gn_uniform_resource_identifier: case X509_gn_ip_address: case X509_gn_registered_id: if ((ret = asn1_implicit_to_der(choice, d, dlen, out, outlen)) != 1) { if (ret < 0) error_print(); return ret; } break; default: error_print(); return -1; } return 1; } int x509_general_name_from_der(int *choice, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen) { int ret; int tag; if ((ret = asn1_any_type_from_der(&tag, d, dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } switch (tag) { case ASN1_TAG_EXPLICIT(0): *choice = 0; break; case ASN1_TAG_IMPLICIT(1): *choice = 1; break; case ASN1_TAG_IMPLICIT(2): *choice = 2; break; case ASN1_TAG_EXPLICIT(3): *choice = 3; break; case ASN1_TAG_EXPLICIT(4): *choice = 4; break; case ASN1_TAG_EXPLICIT(5): *choice = 5; break; case ASN1_TAG_IMPLICIT(6): *choice = 6; break; case ASN1_TAG_IMPLICIT(7): *choice = 7; break; case ASN1_TAG_IMPLICIT(8): *choice = 8; break; default: fprintf(stderr, "%s %d: tag = %x\n", __FILE__, __LINE__, tag); error_print(); return -1; } return 1; } int x509_general_name_print(FILE *fp, int fmt, int ind, const char *label, int choice, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; switch (choice) { case 0: case 3: case 4: case 5: if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } d = p; dlen = len; } switch (choice) { case 0: return x509_other_name_print(fp, fmt, ind, "otherName", d, dlen); case 1: return asn1_string_print(fp, fmt, ind, "rfc822Name", ASN1_TAG_IA5String, d, dlen); case 2: return asn1_string_print(fp, fmt, ind, "DNSName", ASN1_TAG_IA5String, d, dlen); case 3: return format_bytes(fp, fmt, ind, "x400Address", d, dlen); case 4: return x509_name_print(fp, fmt, ind, "directoryName", d, dlen); case 5: return x509_edi_party_name_print(fp, fmt, ind, "ediPartyName", d, dlen); case 6: return asn1_string_print(fp, fmt, ind, "URI", ASN1_TAG_IA5String, d, dlen); case 7: return format_bytes(fp, fmt, ind, "IPAddress", d, dlen); case 8: { uint32_t nodes[32]; size_t nodes_cnt; if (asn1_object_identifier_from_octets(nodes, &nodes_cnt, d, dlen) != 1) { error_print(); return -1; } return asn1_object_identifier_print(fp, fmt, ind, "registeredID", NULL, nodes, nodes_cnt); } default: error_print(); return -1; } return 1; } int x509_general_names_add_general_name(uint8_t *gns, size_t *gnslen, size_t maxlen, int choice, const uint8_t *d, size_t dlen) { size_t len = 0; uint8_t *p = gns + *gnslen; switch (choice) { case X509_gn_rfc822_name: case X509_gn_dns_name: case X509_gn_uniform_resource_identifier: if (asn1_string_is_ia5_string((char *)d, dlen) != 1) { error_print(); return -1; } break; } if (x509_general_name_to_der(choice, d, dlen, NULL, &len) != 1 || asn1_length_le(*gnslen + len, maxlen) != 1 || x509_general_name_to_der(choice, d, dlen, &p, gnslen) != 1) { error_print(); return -1; } return 1; } int x509_general_names_add_other_name(uint8_t *gns, size_t *gnslen, size_t maxlen, const uint32_t *nodes, size_t nodes_cnt, const uint8_t *value, size_t value_len) { int choice = X509_gn_other_name; uint8_t buf[256]; uint8_t *p = buf; const uint8_t *cp = buf; size_t len = 0; const uint8_t *d; size_t dlen; if (x509_other_name_to_der(nodes, nodes_cnt, value, value_len, &p, &len) != 1 || asn1_sequence_from_der(&d, &dlen, &cp, &len) != 1 || x509_general_names_add_general_name(gns, gnslen, maxlen, choice, d, dlen) != 1) { error_print(); return -1; } return 1; } int x509_general_names_add_edi_party_name(uint8_t *gns, size_t *gnslen, size_t maxlen, int assigner_tag, const uint8_t *assigner, size_t assigner_len, int party_name_tag, const uint8_t *party_name, size_t party_name_len) { int choice = X509_gn_edi_party_name; uint8_t buf[256]; uint8_t *p = buf; const uint8_t *cp = buf; size_t len = 0; const uint8_t *d; size_t dlen; if (x509_edi_party_name_to_der( assigner_tag, assigner, assigner_len, party_name_tag, party_name, party_name_len, &p, &len) != 1 || asn1_sequence_from_der(&d, &dlen, &cp, &len) != 1 || x509_general_names_add_general_name(gns, gnslen, maxlen, choice, d, dlen) != 1) { error_print(); return -1; } return 1; } int x509_general_names_add_registered_id(uint8_t *gns, size_t *gnslen, size_t maxlen, const uint32_t *nodes, size_t nodes_cnt) { int choice = X509_gn_registered_id; uint8_t d[64]; size_t dlen; if (asn1_object_identifier_to_octets(nodes, nodes_cnt, d, &dlen) != 1 || x509_general_names_add_general_name(gns, gnslen, maxlen, choice, d, dlen) != 1) { error_print(); return -1; } return 1; } int x509_general_names_get_next(const uint8_t *gns, size_t gns_len, const uint8_t **ptr, int choice, const uint8_t **d, size_t *dlen) { if (!gns || !gns_len) { error_print(); return -1; } if (!ptr || !d || !dlen) { error_print(); return -1; } if (*ptr > gns + gns_len) { error_print(); return -1; } gns_len -= (*ptr - gns); while (gns_len) { int tag; if (x509_general_name_from_der(&tag, d, dlen, ptr, &gns_len) != 1) { error_print(); return -1; } if (tag == choice) { return 1; } } *d = NULL; *dlen = 0; return 0; } int x509_general_names_get_first(const uint8_t *gns, size_t gns_len, const uint8_t **ptr, int choice, const uint8_t **d, size_t *dlen) { int ret; const uint8_t *p; p = gns; if ((ret = x509_general_names_get_next(gns, gns_len, &p, choice, d, dlen)) < 0) { error_print(); return - 1; } if (ptr) { *ptr = p; } return ret; } int x509_uri_as_general_names_to_der_ex(int tag, const char *uri, size_t urilen, uint8_t **out, size_t *outlen) { int choice = X509_gn_uniform_resource_identifier; size_t len = 0; if (!urilen) { return 0; } if (x509_general_name_to_der(choice, (uint8_t *)uri, urilen, NULL, &len) != 1 || asn1_sequence_header_to_der_ex(tag, len, out, outlen) != 1 || x509_general_name_to_der(choice, (uint8_t *)uri, urilen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_uri_as_general_names_from_der_ex(int tag, const uint8_t **uri, size_t *urilen, const uint8_t **in, size_t *inlen) { int choice = X509_gn_uniform_resource_identifier; int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_type_from_der(tag, &d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); else { *uri = NULL; *urilen = 0; } return ret; } if (x509_general_names_get_first(d, dlen, NULL, choice, uri, urilen) < 0) { error_print(); return -1; } return 1; } int x509_general_names_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int choice; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (x509_general_name_from_der(&choice, &p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_general_name_print(fp, fmt, ind, "GeneralName", choice, p, len); } return 1; } int x509_authority_key_identifier_to_der( const uint8_t *keyid, size_t keyid_len, const uint8_t *issuer, size_t issuer_len, const uint8_t *serial, size_t serial_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (keyid_len == 0 && issuer_len == 0 && serial_len == 0) { return 0; } if (asn1_implicit_octet_string_to_der(0, keyid, keyid_len, NULL, &len) < 0 || asn1_implicit_sequence_to_der(1, issuer, issuer_len, NULL, &len) < 0 || asn1_implicit_integer_to_der(2, serial, serial_len, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_implicit_octet_string_to_der(0, keyid, keyid_len, out, outlen) < 0 || asn1_implicit_sequence_to_der(1, issuer, issuer_len, out, outlen) < 0 || asn1_implicit_integer_to_der(2, serial, serial_len, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_authority_key_identifier_from_der( const uint8_t **keyid, size_t *keyid_len, const uint8_t **issuer, size_t *issuer_len, const uint8_t **serial, size_t *serial_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (asn1_implicit_octet_string_from_der(0, keyid, keyid_len, &d, &dlen) < 0 || asn1_implicit_sequence_from_der(1, issuer, issuer_len, &d, &dlen) < 0 || asn1_implicit_integer_from_der(2, serial, serial_len, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_authority_key_identifier_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = asn1_implicit_octet_string_from_der(0, &p, &len, &d, &dlen)) < 0) goto err; if (ret) format_bytes(fp, fmt, ind, "keyIdentifier", p, len); if ((ret = asn1_implicit_sequence_from_der(1, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_general_names_print(fp, fmt, ind, "authorityCertIssuer", p, len); if ((ret = asn1_implicit_integer_from_der(2, &p, &len, &d, &dlen)) < 0) goto err; if (ret) format_bytes(fp, fmt, ind, "authorityCertSerialNumber", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } static const char *x509_key_usages[] = { "digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly", }; static size_t x509_key_usages_count = sizeof(x509_key_usages)/sizeof(x509_key_usages[0]); const char *x509_key_usage_name(int flag) { size_t i; for (i = 0; i < x509_key_usages_count; i++) { if (flag & 1) { if (flag >> 1) { error_print(); return NULL; } return x509_key_usages[i]; } flag >>= 1; } error_print(); return NULL; } int x509_key_usage_from_name(int *flag, const char *name) { size_t i; for (i = 0; i < x509_key_usages_count; i++) { if (strcmp(name, x509_key_usages[i]) == 0) { *flag = 1 << i; return 1; } } *flag = 0; error_print(); return -1; } int x509_key_usage_check(int bits, int cert_type) { if (bits == -1) { return 0; } if (!bits) { error_print(); return -1; } switch (cert_type) { case -1: break; case X509_cert_server_auth: case X509_cert_client_auth: if (!(bits & X509_KU_DIGITAL_SIGNATURE)) { error_print(); return -1; } if ((bits & X509_KU_KEY_CERT_SIGN) || (bits & X509_KU_CRL_SIGN)) { error_print(); return -1; } break; case X509_cert_server_key_encipher: case X509_cert_client_key_encipher: if (!(bits & X509_KU_KEY_ENCIPHERMENT)) { error_print(); return -1; } if ((bits & X509_KU_KEY_CERT_SIGN) || (bits & X509_KU_CRL_SIGN)) { error_print(); return -1; } break; case X509_cert_ca: if (!(bits & X509_KU_KEY_CERT_SIGN)) { error_print(); return -1; } break; case X509_cert_crl_sign: if (!(bits & X509_KU_CRL_SIGN)) { error_print(); return -1; } break; default: error_print(); return -1; } return 1; } int x509_key_usage_print(FILE *fp, int fmt, int ind, const char *label, int bits) { (void)asn1_bits_print(fp, fmt, ind, label, x509_key_usages, x509_key_usages_count, bits); return 1; } int x509_display_text_check(int tag, const uint8_t *d, size_t dlen) { switch (tag) { case ASN1_TAG_IA5String: case ASN1_TAG_VisibleString: case ASN1_TAG_UTF8String: if (d && strnlen((char *)d, dlen) != dlen) { error_print(); return -1; } break; case ASN1_TAG_BMPString: if (d && dlen % 2) { error_print(); return -1; } break; default: error_print(); return -1; } if (dlen < X509_DISPLAY_TEXT_MIN_LEN || dlen > X509_DISPLAY_TEXT_MAX_LEN) { error_print(); return -1; } return 1; } int x509_display_text_to_der(int tag, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen) { int ret; if (x509_display_text_check(tag, d, dlen) != 1) { error_print(); return -1; } if ((ret = asn1_type_to_der(tag, d, dlen, out, outlen)) != 1) { if (ret < 0) error_print(); return ret; } return 1; } int x509_display_text_from_der(int *tag, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen) { int ret; if ((ret = asn1_tag_from_der_readonly(tag, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } switch (*tag) { case ASN1_TAG_IA5String: case ASN1_TAG_VisibleString: case ASN1_TAG_UTF8String: case ASN1_TAG_BMPString: break; default: return 0; } if ((ret = asn1_any_type_from_der(tag, d, dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_display_text_check(*tag, *d, *dlen) != 1) { error_print(); return -1; } return 1; } int x509_display_text_print(FILE *fp, int fmt, int ind, const char *label, int tag, const uint8_t *d, size_t dlen) { return asn1_string_print(fp, fmt, ind, label, tag, d, dlen); } int x509_notice_reference_to_der( int org_tag, const uint8_t *org, size_t org_len, const int *notice_numbers, size_t notice_numbers_cnt, uint8_t **out, size_t *outlen) { size_t len = 0; if (org_len == 0 && notice_numbers_cnt == 0) { return 0; } if (x509_display_text_to_der(org_tag, org, org_len, NULL, &len) != 1 || asn1_sequence_of_int_to_der(notice_numbers, notice_numbers_cnt, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_display_text_to_der(org_tag, org, org_len, out, outlen) != 1 || asn1_sequence_of_int_to_der(notice_numbers, notice_numbers_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_notice_reference_from_der( int *org_tag, const uint8_t **org, size_t *org_len, int *notice_numbers, size_t *notice_numbers_cnt, size_t max_notice_numbers, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); else error_print(); return ret; } if (x509_display_text_from_der(org_tag, org, org_len, &d, &dlen) != 1 || asn1_sequence_of_int_from_der(notice_numbers, notice_numbers_cnt, max_notice_numbers, &d, &dlen) != 1 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_notice_reference_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int tag; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (x509_display_text_from_der(&tag, &p, &len, &d, &dlen) != 1) goto err; x509_display_text_print(fp, fmt, ind, "organization", tag, p, len); if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err; asn1_sequence_of_int_print(fp, fmt, ind, "noticeNumbers", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_user_notice_to_der( int notice_ref_org_tag, const uint8_t *notice_ref_org, size_t notice_ref_org_len, const int *notice_ref_notice_numbers, size_t notice_ref_notice_numbers_cnt, int explicit_text_tag, const uint8_t *explicit_text, size_t explicit_text_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (notice_ref_org_len == 0 && notice_ref_notice_numbers_cnt == 0 && explicit_text_len == 0) { return 0; } if (x509_notice_reference_to_der( notice_ref_org_tag, notice_ref_org, notice_ref_org_len, notice_ref_notice_numbers, notice_ref_notice_numbers_cnt, NULL, &len) < 0 || x509_display_text_to_der(explicit_text_tag, explicit_text, explicit_text_len, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_notice_reference_to_der( notice_ref_org_tag, notice_ref_org, notice_ref_org_len, notice_ref_notice_numbers, notice_ref_notice_numbers_cnt, out, outlen) < 0 || x509_display_text_to_der(explicit_text_tag, explicit_text, explicit_text_len, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_user_notice_from_der( int *notice_ref_org_tag, const uint8_t **notice_ref_org, size_t *notice_ref_org_len, int *notice_ref_notice_numbers, size_t *notice_ref_notice_numbers_cnt, size_t max_notice_ref_notice_numbers, int *explicit_text_tag, const uint8_t **explicit_text, size_t *explicit_text_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_notice_reference_from_der(notice_ref_org_tag, notice_ref_org, notice_ref_org_len, notice_ref_notice_numbers, notice_ref_notice_numbers_cnt, max_notice_ref_notice_numbers, &d, &dlen) < 0 || x509_display_text_from_der(explicit_text_tag, explicit_text, explicit_text_len, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_user_notice_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret; const uint8_t *p; size_t len; int tag; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_notice_reference_print(fp, fmt, ind, "noticeRef", p, len); if ((ret = x509_display_text_from_der(&tag, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_display_text_print(fp, fmt, ind, "explicitText", tag, p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } static uint32_t oid_qt_cps[] = { oid_qt,1 }; static uint32_t oid_qt_unotice[] = {oid_qt,2 }; static const ASN1_OID_INFO x509_qt_ids[] = { { OID_qt_cps, "CPS", oid_qt_cps, sizeof(oid_qt_cps)/sizeof(int) }, { OID_qt_unotice, "userNotice", oid_qt_unotice, sizeof(oid_qt_unotice)/sizeof(int) } }; static const int x509_qt_ids_count = sizeof(x509_qt_ids)/sizeof(x509_qt_ids[0]); int x509_qualifier_id_from_name(const char *name) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_name(x509_qt_ids, x509_qt_ids_count, name))) { error_print(); return OID_undef; } return info->oid; } const char *x509_qualifier_id_name(int oid) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_qt_ids, x509_qt_ids_count, oid))) { error_print(); return NULL; } return info->name; } int x509_qualifier_id_to_der(int oid, uint8_t **out, size_t *outlen) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_qt_ids, x509_qt_ids_count, oid))) { error_print(); return -1; } if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_qualifier_id_from_der(int *oid, const uint8_t **in, size_t *inlen) { int ret; const ASN1_OID_INFO *info; if ((ret = asn1_oid_info_from_der(&info, x509_qt_ids, x509_qt_ids_count, in, inlen)) != 1) { if (ret < 0) error_print(); else *oid = -1; return ret; } *oid = info->oid; return 1; } int x509_policy_qualifier_info_to_der( int oid, const uint8_t *qualifier, size_t qualifier_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (qualifier_len == 0) { return 0; } if (x509_qualifier_id_to_der(oid, NULL, &len) != 1 || asn1_any_to_der(qualifier, qualifier_len, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_qualifier_id_to_der(oid, out, outlen) != 1 || asn1_any_to_der(qualifier, qualifier_len, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_policy_qualifier_info_from_der(int *oid, const uint8_t **qualifier, size_t *qualifier_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *p; size_t len; if ((ret = asn1_sequence_from_der(&p, &len, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_qualifier_id_from_der(oid, &p, &len) != 1 || asn1_any_from_der(qualifier, qualifier_len, &p, &len) != 1 || asn1_length_is_zero(len) != 1) { error_print(); return -1; } return 1; } int x509_policy_qualifier_info_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int oid; const uint8_t *p; size_t len; if (x509_qualifier_id_from_der(&oid, &d, &dlen) != 1) goto err; switch (oid) { case OID_qt_cps: if (asn1_ia5_string_from_der((const char **)&p, &len, &d, &dlen) != 1) goto err; format_string(fp, fmt, ind, "cPSuri", p, len); break; case OID_qt_unotice: if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err; x509_user_notice_print(fp, fmt, ind, "userNotice", p, len); break; } return 1; err: error_print(); return -1; } int x509_policy_qualifier_infos_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_policy_qualifier_info_print(fp, fmt, ind, "PolicyQualifierInfo", p, len); } return 1; } int x509_cert_policy_id_from_name(const char *name) { if (strcmp(name, "anyPolicy") == 0) { return OID_any_policy; } return OID_undef; } char *x509_cert_policy_id_name(int oid) { switch (oid) { case OID_any_policy: return "anyPolicy"; } return NULL; } static uint32_t oid_any_policy[] = { oid_ce,32,0 }; int x509_cert_policy_id_to_der(int oid, const uint32_t *nodes, size_t nodes_cnt, uint8_t **out, size_t *outlen) { switch (oid) { case OID_any_policy: if (asn1_object_identifier_to_der(oid_any_policy, sizeof(oid_any_policy)/sizeof(int), out, outlen) != 1) { error_print(); return -1; } break; case OID_undef: if (asn1_object_identifier_to_der(nodes, nodes_cnt, out, outlen) != 1) { error_print(); return -1; } break; default: error_print(); return -1; } return 1; } int x509_cert_policy_id_from_der(int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **in, size_t *inlen) { int ret; if ((ret = asn1_object_identifier_from_der(nodes, nodes_cnt, in, inlen)) != 1) { if (ret < 0) error_print(); else *oid = -1; return ret; } if (asn1_object_identifier_equ(nodes, *nodes_cnt, oid_any_policy, oid_cnt(oid_any_policy))) *oid = OID_any_policy; else *oid = 0; return 1; } int x509_policy_information_to_der( int oid, const uint32_t *nodes, size_t nodes_cnt, const uint8_t *qualifiers, size_t qualifiers_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (x509_cert_policy_id_to_der(oid, nodes, nodes_cnt, NULL, &len) != 1 || asn1_sequence_to_der(qualifiers, qualifiers_len, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_cert_policy_id_to_der(oid, nodes, nodes_cnt, out, outlen) != 1 || asn1_sequence_to_der(qualifiers, qualifiers_len, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_policy_information_from_der( int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **qualifiers, size_t *qualifiers_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_cert_policy_id_from_der(oid, nodes, nodes_cnt, &d, &dlen) != 1 || asn1_sequence_from_der(qualifiers, qualifiers_len, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_policy_information_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret, oid; uint32_t nodes[32]; size_t nodes_cnt; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (x509_cert_policy_id_from_der(&oid, nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "policyIdentifier", x509_cert_policy_id_name(oid), nodes, nodes_cnt); if ((ret = asn1_sequence_from_der(&p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_policy_qualifier_infos_print(fp, fmt, ind, "policyQualifiers", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_certificate_policies_add_policy_information(uint8_t *d, size_t *dlen, size_t maxlen, int policy_oid, const uint32_t *policy_nodes, size_t policy_nodes_cnt, const uint8_t *qualifiers, size_t qualifiers_len) { error_print(); return -1; } int x509_certificate_polices_check(const uint8_t *d, size_t dlen) { error_print(); return -1; } int x509_certificate_policies_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_policy_information_print(fp, fmt, ind, label, p, len); } return 1; } int x509_policy_mapping_to_der( int issuer_policy_oid, const uint32_t *issuer_policy_nodes, size_t issuer_policy_nodes_cnt, int subject_policy_oid, const uint32_t *subject_policy_nodes, size_t subject_policy_nodes_cnt, uint8_t **out, size_t *outlen) { size_t len = 0; if (issuer_policy_oid == -1 && subject_policy_oid == -1) { return 0; } if (x509_cert_policy_id_to_der(issuer_policy_oid, issuer_policy_nodes, issuer_policy_nodes_cnt, NULL, &len) != 1 || x509_cert_policy_id_to_der(subject_policy_oid, subject_policy_nodes, subject_policy_nodes_cnt, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_cert_policy_id_to_der(issuer_policy_oid, issuer_policy_nodes, issuer_policy_nodes_cnt, out, outlen) != 1 || x509_cert_policy_id_to_der(subject_policy_oid, subject_policy_nodes, subject_policy_nodes_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_policy_mapping_from_der( int *issuer_policy_oid, uint32_t *issuer_policy_nodes, size_t *issuer_policy_nodes_cnt, int *subject_policy_oid, uint32_t *subject_policy_nodes, size_t *subject_policy_nodes_cnt, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_cert_policy_id_from_der(issuer_policy_oid, issuer_policy_nodes, issuer_policy_nodes_cnt, &d, &dlen) != 1 || x509_cert_policy_id_from_der(subject_policy_oid, subject_policy_nodes, subject_policy_nodes_cnt, &d, &dlen) != 1 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_policy_mapping_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int oid; uint32_t nodes[32]; size_t nodes_cnt; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (x509_cert_policy_id_from_der(&oid, nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "issuerDomainPolicy", x509_cert_policy_id_name(oid), nodes, nodes_cnt); if (x509_cert_policy_id_from_der(&oid, nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "subjectDomainPolicy", x509_cert_policy_id_name(oid), nodes, nodes_cnt); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_policy_mappings_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_policy_mapping_print(fp, fmt, ind, label, p, len); } return 1; } int x509_attribute_to_der( const uint32_t *nodes, size_t nodes_cnt, const uint8_t *values, size_t values_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (asn1_object_identifier_to_der(nodes, nodes_cnt, NULL, &len) != 1 || asn1_set_to_der(values, values_len, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_object_identifier_to_der(nodes, nodes_cnt, out, outlen) != 1 || asn1_set_to_der(values, values_len, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_attribute_from_der( int *oid, uint32_t *nodes, size_t *nodes_cnt, const uint8_t **values, size_t *values_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *p; size_t len; *oid = OID_undef; if ((ret = asn1_sequence_from_der(&p, &len, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (asn1_object_identifier_from_der(nodes, nodes_cnt, &p, &len) != 1 || asn1_set_from_der(values, values_len, &p, &len) != 1 || asn1_length_is_zero(len) != 1) { error_print(); return -1; } return 1; } int x509_attribute_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { uint32_t nodes[32]; size_t nodes_cnt; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (asn1_object_identifier_from_der(nodes, &nodes_cnt, &d, &dlen) != 1) goto err; asn1_object_identifier_print(fp, fmt, ind, "type", NULL, nodes, nodes_cnt); if (asn1_set_from_der(&p, &len, &d, &dlen) != 1) goto err; format_bytes(fp, fmt, ind, "values", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_attributes_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; if (label) { format_print(fp, fmt, ind, "%s\n", label); ind += 4; } if (!dlen) { format_print(fp, fmt, ind, "(null)\n"); } while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_attribute_print(fp, fmt, ind, "Attribute", p, len); } return 1; } int x509_basic_constraints_to_der(int ca, int path_len_cons, uint8_t **out, size_t *outlen) { size_t len = 0; if (ca == -1 && path_len_cons == -1) { error_print(); return -1; } if (asn1_boolean_to_der(ca, NULL, &len) < 0 || asn1_int_to_der(path_len_cons, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_boolean_to_der(ca, out, outlen) < 0 || asn1_int_to_der(path_len_cons, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_basic_constraints_from_der(int *ca, int *path_len_cons, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); else *ca = *path_len_cons = -1; return ret; } if (dlen == 0) { error_print(); return -1; } if (asn1_boolean_from_der(ca, &d, &dlen) < 0 || asn1_int_from_der(path_len_cons, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_basic_constraints_check(int ca, int path_len_constraint, int cert_type) { /* entity_cert: ca = -1 or 0 path_len_constraint = -1 first_ca_cert: ca = 1 path_len_constraint = 0 middle_ca_cert: ca = 1 path_len_constraint = -1 or > 0 root_ca_cert: ca = 1 path_len_constraint = -1 or > 0 (=0 might be ok?) */ switch (cert_type) { case X509_cert_server_auth: case X509_cert_client_auth: case X509_cert_server_key_encipher: case X509_cert_client_key_encipher: if (ca > 0 || path_len_constraint != -1) { error_print(); return -1; } break; // FIXME: add more cert types and check path_len_constraint case X509_cert_ca: case X509_cert_crl_sign: case X509_cert_root_ca: if (ca != 1) { error_print(); return -1; } break; default: error_print(); return -1; } return 1; } int x509_basic_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret, val; format_print(fp, fmt, ind, "%s\n", label); ind += 4; // BasicConstraints might be an empty sequence in entity certificates if (!d || !dlen) { return 1; } if ((ret = asn1_boolean_from_der(&val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "cA: %s\n", asn1_boolean_name(val)); if ((ret = asn1_int_from_der(&val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "pathLenConstraint: %d\n", val); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_general_subtree_to_der( int base_choice, const uint8_t *base, size_t base_len, int minimum, int maximum, uint8_t **out, size_t *outlen) { size_t len = 0; if (x509_general_name_to_der(base_choice, base, base_len, NULL, &len) != 1 || asn1_implicit_int_to_der(0, minimum, NULL, &len) < 0 || asn1_implicit_int_to_der(1, maximum, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_general_name_to_der(base_choice, base, base_len, out, outlen) != 1 || asn1_implicit_int_to_der(0, minimum, out, outlen) < 0 || asn1_implicit_int_to_der(1, maximum, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_general_subtree_from_der( int *base_choice, const uint8_t **base, size_t *base_len, int *minimum, int *maximum, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_general_name_from_der(base_choice, base, base_len, &d, &dlen) != 1 || asn1_implicit_int_from_der(0, minimum, &d, &dlen) < 0 || asn1_implicit_int_from_der(1, maximum, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } if (*minimum < 0) *minimum = 0; return 1; } int x509_general_subtree_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret, choice, val; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (x509_general_name_from_der(&choice, &p, &len, &d, &dlen) != 1) goto err; x509_general_name_print(fp, fmt, ind, "base", choice, p, len); if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "minimum: %d\n", val); if ((ret = asn1_implicit_int_from_der(1, &val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "maximum: %d\n", val); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_general_subtrees_add_general_subtree(uint8_t *d, size_t *dlen, size_t maxlen, int base_choice, const uint8_t *base, size_t base_len, int minimum, int maximum) { error_print(); return -1; } int x509_general_subtrees_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_general_subtree_print(fp, fmt, ind, "GeneralSubtree", p, len); } return 1; } int x509_name_constraints_to_der( const uint8_t *permitted_subtrees, size_t permitted_subtrees_len, const uint8_t *excluded_subtrees, size_t excluded_subtrees_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (asn1_implicit_sequence_to_der(0, permitted_subtrees, permitted_subtrees_len, NULL, &len) < 0 || asn1_implicit_sequence_to_der(1, excluded_subtrees, excluded_subtrees_len, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_implicit_sequence_to_der(0, permitted_subtrees, permitted_subtrees_len, out, outlen) < 0 || asn1_implicit_sequence_to_der(1, excluded_subtrees, excluded_subtrees_len, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_name_constraints_from_der( const uint8_t **permitted_subtrees, size_t *permitted_subtrees_len, const uint8_t **excluded_subtrees, size_t *excluded_subtrees_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } *permitted_subtrees = NULL; *permitted_subtrees_len = 0; *excluded_subtrees = NULL; *excluded_subtrees_len = 0; if (asn1_implicit_sequence_from_der(0, permitted_subtrees, permitted_subtrees_len, &d, &dlen) < 0 || asn1_implicit_sequence_from_der(1, excluded_subtrees, excluded_subtrees_len, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_name_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = asn1_implicit_sequence_from_der(0, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_general_subtrees_print(fp, fmt, ind, "permittedSubtrees", p, len); if ((ret = asn1_implicit_sequence_from_der(1, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_general_subtrees_print(fp, fmt, ind, "excludedSubtrees", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_policy_constraints_to_der( int require_explicit_policy, int inhibit_policy_mapping, uint8_t **out, size_t *outlen) { size_t len = 0; if (require_explicit_policy == -1 && inhibit_policy_mapping == -1) { error_print(); return -1; } if (asn1_implicit_int_to_der(0, require_explicit_policy, NULL, &len) < 0 || asn1_implicit_int_to_der(1, inhibit_policy_mapping, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || asn1_implicit_int_to_der(0, require_explicit_policy, out, outlen) < 0 || asn1_implicit_int_to_der(1, inhibit_policy_mapping, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_policy_constraints_from_der( int *require_explicit_policy, int *inhibit_policy_mapping, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); else *require_explicit_policy = *inhibit_policy_mapping = -1; return ret; } if (dlen == 0) { error_print(); return -1; } if (asn1_implicit_int_from_der(0, require_explicit_policy, &d, &dlen) < 0 || asn1_implicit_int_from_der(1, inhibit_policy_mapping, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_policy_constraints_check(const uint8_t *a, size_t alen) { error_print(); return -1; } int x509_policy_constraints_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret, val; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = asn1_implicit_int_from_der(0, &val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "requireExplicitPolicy: %d\n", val); if ((ret = asn1_implicit_int_from_der(1, &val, &d, &dlen)) < 0) goto err; if (ret) format_print(fp, fmt, ind, "inhibitPolicyMapping: %d\n", val); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } static uint32_t oid_any_extended_key_usage[] = { oid_ce,37,0 }; #define oid_kp oid_pkix,3 static uint32_t oid_kp_server_auth[] = { oid_kp,1 }; static uint32_t oid_kp_client_auth[] = { oid_kp,2 }; static uint32_t oid_kp_code_signing[] = { oid_kp,3 }; static uint32_t oid_kp_email_protection[] = { oid_kp,4 }; static uint32_t oid_kp_time_stamping[] = { oid_kp,8 }; static uint32_t oid_kp_ocsp_signing[] = { oid_kp,9 }; #define OID_KP_CNT sizeof(oid_kp_server_auth)/sizeof(int) static const ASN1_OID_INFO x509_key_purposes[] = { { OID_any_extended_key_usage, "anyExtendedKeyUsage", oid_any_extended_key_usage, sizeof(oid_any_extended_key_usage)/sizeof(uint32_t), 0, "Any Extended Key Usage" }, { OID_kp_server_auth, "serverAuth", oid_kp_server_auth, OID_KP_CNT, 0, "TLS WWW server authentication" }, { OID_kp_client_auth, "clientAuth", oid_kp_client_auth, OID_KP_CNT, 0, "TLS WWW client authentication" }, { OID_kp_code_signing, "codeSigning", oid_kp_code_signing, OID_KP_CNT, 0, "Signing of downloadable executable code" }, { OID_kp_email_protection, "emailProtection", oid_kp_email_protection, OID_KP_CNT, 0, "Email protection" }, { OID_kp_time_stamping, "timeStamping", oid_kp_time_stamping, OID_KP_CNT, 0, "Binding the hash of an object to a time" }, { OID_kp_ocsp_signing, "OCSPSigning", oid_kp_ocsp_signing, OID_KP_CNT, 0, "Signing OCSP responses" }, }; static const int x509_key_purposes_count = sizeof(x509_key_purposes)/sizeof(x509_key_purposes[0]); int x509_key_purpose_from_name(const char *name) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_name(x509_key_purposes, x509_key_purposes_count, name))) { error_print(); return OID_undef; } return info->oid; } const char *x509_key_purpose_name(int oid) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_key_purposes, x509_key_purposes_count, oid))) { error_print(); return NULL; } return info->name; } const char *x509_key_purpose_text(int oid) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_key_purposes, x509_key_purposes_count, oid))) { error_print(); return NULL; } return info->description; } int x509_key_purpose_to_der(int oid, uint8_t **out, size_t *outlen) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(x509_key_purposes, x509_key_purposes_count, oid))) { error_print(); return -1; } if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_key_purpose_from_der(int *oid, const uint8_t **in, size_t *inlen) { int ret; const ASN1_OID_INFO *info; if ((ret = asn1_oid_info_from_der(&info, x509_key_purposes, x509_key_purposes_count, in, inlen)) != 1) { if (ret < 0) error_print(); else *oid = -1; return ret; } *oid = info->oid; return 1; } int x509_ext_key_usage_to_der(const int *oids, size_t oids_cnt, uint8_t **out, size_t *outlen) { size_t len = 0; size_t i; if (oids_cnt > X509_MAX_KEY_PURPOSES) { error_print(); return -1; } for (i = 0; i < oids_cnt; i++) { if (x509_key_purpose_to_der(oids[i], NULL, &len) != 1) { error_print(); return -1; } } if (asn1_sequence_header_to_der(len, out, outlen) != 1) { error_print(); return -1; } for (i = 0; i < oids_cnt; i++) { if (x509_key_purpose_to_der(oids[i], out, outlen) != 1) { error_print(); return -1; } } return 1; } int x509_ext_key_usage_from_der(int *oids, size_t *oids_cnt, size_t max_cnt, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *p; size_t len; *oids_cnt = 0; if ((ret = asn1_sequence_from_der(&p, &len, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } while (len && (*oids_cnt < max_cnt)) { if (x509_key_purpose_from_der(oids, &p, &len) != 1) { error_print(); return -1; } oids++; (*oids_cnt)++; } if (len) { error_print(); return -1; } return 1; } int x509_ext_key_usage_check(const int *oids, size_t oids_cnt, int cert_type) { int ret = -1; size_t i; for (i = 0; i < oids_cnt; i++) { // anyExtendedKeyUsage might not acceptable for strict validation if (oids[i] == OID_any_extended_key_usage) { ret = 0; } switch (cert_type) { case X509_cert_server_auth: case X509_cert_server_key_encipher: if (oids[i] == OID_kp_server_auth) { return 1; } break; case X509_cert_client_auth: case X509_cert_client_key_encipher: if (oids[i] == OID_kp_client_auth) { return 1; } break; default: error_print(); return -1; } } return ret; } int x509_ext_key_usage_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int oid; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (x509_key_purpose_from_der(&oid, &d, &dlen) != 1) { error_print(); return -1; } format_print(fp, fmt, ind, "%s\n", x509_key_purpose_name(oid)); } return 1; } static const char *x509_revoke_reason_flags[] = { "unused", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", "privilegeWithdrawn", "aACompromise", }; static size_t x509_revoke_reason_flags_count = sizeof(x509_revoke_reason_flags)/sizeof(x509_revoke_reason_flags[0]); const char *x509_revoke_reason_flag_name(int flag) { size_t i; for (i = 0; i < x509_revoke_reason_flags_count; i++) { if (flag & 1) { if (flag >> 1) { error_print(); return NULL; } return x509_revoke_reason_flags[i]; } flag >>= 1; } return NULL; } int x509_revoke_reason_flag_from_name(int *flag, const char *name) { size_t i; for (i = 0; i < x509_revoke_reason_flags_count; i++) { if (strcmp(name, x509_revoke_reason_flags[i]) == 0) { *flag = 1 << i; return 1; } } *flag = 0; error_print(); return -1; } int x509_revoke_reason_flags_print(FILE *fp, int fmt, int ind, const char *label, int bits) { return asn1_bits_print(fp, fmt, ind, label, x509_revoke_reason_flags, x509_revoke_reason_flags_count, bits); } int x509_uri_as_distribution_point_name_to_der(const char *uri, size_t urilen, uint8_t **out, size_t *outlen) { int tag = ASN1_TAG_EXPLICIT(X509_full_name); if (urilen == 0) { return 0; } if (x509_uri_as_general_names_to_der_ex(tag, uri, urilen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_distribution_point_name_from_der(int *choice, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen) { int ret; int tag; if ((ret = asn1_any_type_from_der(&tag, d, dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } switch (tag) { case ASN1_TAG_EXPLICIT(X509_full_name): *choice = X509_full_name; break; case ASN1_TAG_EXPLICIT(X509_name_relative_to_crl_issuer): *choice = X509_name_relative_to_crl_issuer; break; default: error_print(); return -1; } return 1; } int x509_uri_as_distribution_point_name_from_der(const char **uri, size_t *urilen, const uint8_t **in, size_t *inlen) { int ret; int choice; const uint8_t *d; size_t dlen; if ((ret = x509_distribution_point_name_from_der(&choice, &d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (choice == X509_full_name) { if (x509_general_names_get_first(d, dlen, NULL, X509_gn_uniform_resource_identifier, (const uint8_t **)uri, urilen) < 0) { error_print(); return -1; } } return 1; } int x509_distribution_point_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen) { int tag; const uint8_t *d; size_t dlen; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (asn1_any_type_from_der(&tag, &d, &dlen, &a, &alen) != 1) { error_print(); return -1; } switch (tag) { case ASN1_TAG_EXPLICIT(0): return x509_general_names_print(fp, fmt, ind, "fullName", d, dlen); case ASN1_TAG_IMPLICIT(1): return x509_rdn_print(fp, fmt, ind, "nameRelativeToCRLIssuer", d, dlen); default: error_print(); return -1; } return 1; } int x509_uri_as_explicit_distribution_point_name_to_der(int index, const char *uri, size_t urilen, uint8_t **out, size_t *outlen) { size_t len = 0; if (!urilen) { return 0; } if (x509_uri_as_distribution_point_name_to_der(uri, urilen, NULL, &len) != 1 || asn1_explicit_header_to_der(index, len, out, outlen) != 1 || x509_uri_as_distribution_point_name_to_der(uri, urilen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_uri_as_explicit_distribution_point_name_from_der(int index, const char **uri, size_t *urilen, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *a; size_t alen; if ((ret = asn1_explicit_from_der(index, &a, &alen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_uri_as_distribution_point_name_from_der(uri, urilen, &a, &alen) != 1 || asn1_length_is_zero(alen) != 1) { error_print(); return -1; } return 1; } int x509_uri_as_distribution_point_to_der(const char *uri, size_t urilen, int reasons, const uint8_t *crl_issuer, size_t crl_issuer_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (x509_uri_as_explicit_distribution_point_name_to_der(0, uri, urilen, NULL, &len) != 1 || x509_revoke_reason_flags_to_der(reasons, NULL, &len) < 0 || x509_general_names_to_der(crl_issuer, crl_issuer_len, NULL, &len) < 0 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_uri_as_explicit_distribution_point_name_to_der(0, uri, urilen, out, outlen) != 1 || x509_revoke_reason_flags_to_der(reasons, out, outlen) < 0 || x509_general_names_to_der(crl_issuer, crl_issuer_len, out, outlen) < 0) { error_print(); return -1; } return 1; } int x509_uri_as_distribution_point_from_der(const char **uri, size_t *urilen, int *reasons, const uint8_t **crl_issuer, size_t *crl_issuer_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } if (x509_uri_as_explicit_distribution_point_name_from_der(0, uri, urilen, &d, &dlen) < 0 || x509_revoke_reason_flags_from_der(reasons, &d, &dlen) < 0 || x509_general_names_from_der(crl_issuer, crl_issuer_len, &d, &dlen) < 0 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } return 1; } int x509_distribution_point_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int ret; const uint8_t *p; size_t len; int bits; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if ((ret = asn1_explicit_from_der(0, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_distribution_point_name_print(fp, fmt, ind, "distributionPoint", p, len); if ((ret = asn1_implicit_bits_from_der(1, &bits, &d, &dlen)) < 0) goto err; if (ret) x509_revoke_reason_flags_print(fp, fmt, ind, "reasons", bits); if ((ret = asn1_implicit_sequence_from_der(2, &p, &len, &d, &dlen)) < 0) goto err; if (ret) x509_general_names_print(fp, fmt, ind, "cRLIssuer", p, len); if (asn1_length_is_zero(dlen) != 1) goto err; return 1; err: error_print(); return -1; } int x509_uri_as_distribution_points_to_der(const char *uri, size_t urilen, int reasons, const uint8_t *crl_issuer, size_t crl_issuer_len, uint8_t **out, size_t *outlen) { size_t len = 0; if (x509_uri_as_distribution_point_to_der(uri, urilen, reasons, crl_issuer, crl_issuer_len, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_uri_as_distribution_point_to_der(uri, urilen, reasons, crl_issuer, crl_issuer_len, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_uri_as_distribution_points_from_der(const char **uri, size_t *urilen, int *reasons, const uint8_t **crl_issuer, size_t *crl_issuer_len, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } while (dlen) { if (x509_uri_as_distribution_point_from_der(uri, urilen, reasons, crl_issuer, crl_issuer_len, &d, &dlen) != 1) { error_print(); return -1; } if (*uri != NULL) { return 1; } } *uri = NULL; *urilen = 0; *reasons = -1; *crl_issuer = NULL; *crl_issuer_len = 0; return 1; } int x509_distribution_points_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; if (label) { format_print(fp, fmt, ind, "%s\n", label); ind += 4; } while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_distribution_point_print(fp, fmt, ind, "DistributionPoint", p, len); } return 1; } static const char *netscape_cert_types[] = { "SSL Client certificate", "SSL Server certificate", "S/MIME certificate", "Object-signing certificate", "Reserved for future use", "SSL CA certificate", "S/MIME CA certificate", "Object-signing CA certificate", }; int x509_netscape_cert_type_print(FILE *fp, int fmt, int ind, const char *label, int bits) { return asn1_bits_print(fp, fmt, ind, label, netscape_cert_types, sizeof(netscape_cert_types)/sizeof(netscape_cert_types[0]), bits); } int x509_exts_check(const uint8_t *exts, size_t extslen, int cert_type, int *path_len_constraint) { int oid; uint32_t nodes[32]; size_t nodes_cnt; int critical; const uint8_t *val; size_t vlen; int ca = -1; int path_len = -1; int key_usage; int ext_key_usages[X509_MAX_KEY_PURPOSES]; size_t ext_key_usages_cnt; *path_len_constraint = -1; while (extslen) { if (x509_ext_from_der(&oid, nodes, &nodes_cnt, &critical, &val, &vlen, &exts, &extslen) != 1) { error_print(); return -1; } switch (oid) { case OID_ce_authority_key_identifier: if (critical == X509_critical) { error_print(); return -1; } /* if (x509_authority_key_identifier(val, vlen) != 1) { error_print(); return -1; } */ break; case OID_ce_subject_key_identifier: if (critical == X509_critical) { error_print(); return -1; } const uint8_t *p; size_t len; if (asn1_octet_string_from_der(&p, &len, &val, &vlen) != 1 || asn1_length_is_zero(vlen) != 1) { error_print(); return -1; } if (!p || !len) { error_print(); return -1; } break; case OID_ce_key_usage: if (critical != X509_critical) { error_print(); // conforming CAs SHOULD mark this extension as critical. } if (asn1_bits_from_der(&key_usage, &val, &vlen) != 1 || x509_key_usage_check(key_usage, cert_type) != 1) { error_print(); return -1; } break; case OID_ce_certificate_policies: break; case OID_ce_policy_mappings: if (critical != X509_critical) { error_print(); return -1; } break; case OID_ce_subject_alt_name: break; case OID_ce_issuer_alt_name: if (critical == X509_critical) { error_print(); return -1; } break; case OID_ce_subject_directory_attributes: if (critical == X509_critical) { error_print(); return -1; } break; case OID_ce_basic_constraints: if (x509_basic_constraints_from_der(&ca, &path_len, &val, &vlen) != 1 || x509_basic_constraints_check(ca, path_len, cert_type) != 1) { error_print(); return -1; } *path_len_constraint = path_len; break; case OID_ce_ext_key_usage: if (x509_ext_key_usage_from_der(ext_key_usages, &ext_key_usages_cnt, sizeof(ext_key_usages)/sizeof(ext_key_usages[0]), &val, &vlen) != 1 || x509_ext_key_usage_check(ext_key_usages, ext_key_usages_cnt, cert_type) != 1) { error_print(); return -1; } break; case OID_ce_name_constraints: case OID_ce_policy_constraints: case OID_ce_crl_distribution_points: case OID_ce_inhibit_any_policy: case OID_ce_freshest_crl: break; default: if (critical == X509_critical) { error_print(); return -1; } } } return 1; } // AuthorityInfoAccess Extension static uint32_t oid_ad_ocsp[] = { oid_ad,1 }; static uint32_t oid_ad_ca_issuers[] = { oid_ad,2 }; #define cnt(oid) (sizeof(oid)/sizeof((oid)[0])) static const ASN1_OID_INFO access_methods[] = { { OID_ad_ocsp, "OCSP", oid_ad_ocsp, oid_cnt(oid_ad_ocsp) }, { OID_ad_ca_issuers, "CAIssuers", oid_ad_ca_issuers, oid_cnt(oid_ad_ca_issuers) }, }; const char *x509_access_method_name(int oid) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(access_methods, cnt(access_methods), oid))) { error_print(); return NULL; } return info->name; } int x509_access_method_from_name(const char *name) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_name(access_methods, cnt(access_methods), name))) { error_print(); return OID_undef; } return info->oid; } int x509_access_method_to_der(int oid, uint8_t **out, size_t *outlen) { const ASN1_OID_INFO *info; if (!(info = asn1_oid_info_from_oid(access_methods, cnt(access_methods), oid))) { error_print(); return -1; } if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_access_method_from_der(int *oid, const uint8_t **in, size_t *inlen) { int ret; const ASN1_OID_INFO *info; uint32_t nodes[32]; size_t nodes_cnt; if ((ret = asn1_oid_info_from_der_ex(&info, nodes, &nodes_cnt, access_methods, cnt(access_methods), in, inlen)) != 1) { if (ret < 0) error_print(); else *oid = -1; return ret; } *oid = info->oid; return 1; } // currently AccessDescription not support values of SubjectInfoAccess extension int x509_access_description_to_der(int oid, const char *uri, size_t urilen, uint8_t **out, size_t *outlen) { const int uri_choice = X509_gn_uniform_resource_identifier; size_t len = 0; if (oid != OID_ad_ocsp && oid != OID_ad_ca_issuers) { error_print(); return -1; } if (!uri || !urilen) { error_print(); return -1; } if (x509_access_method_to_der(oid, NULL, &len) != 1 || x509_general_name_to_der(uri_choice, (const uint8_t *)uri, urilen, NULL, &len) != 1 || asn1_sequence_header_to_der(len, out, outlen) != 1 || x509_access_method_to_der(oid, out, outlen) != 1 || x509_general_name_to_der(uri_choice, (const uint8_t *)uri, urilen, out, outlen) != 1) { error_print(); return -1; } return 1; } int x509_access_description_from_der(int *oid, const char **uri, size_t *urilen, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; int uri_choice; if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); else { *oid = -1; *uri = NULL; *urilen = 0; } return ret; } if (x509_access_method_from_der(oid, &d, &dlen) != 1 || x509_general_name_from_der(&uri_choice, (const uint8_t **)uri, urilen, &d, &dlen) != 1 || asn1_length_is_zero(dlen) != 1) { error_print(); return -1; } if (uri_choice != X509_gn_uniform_resource_identifier) { error_print(); return -1; } if (*uri == NULL || *urilen == 0) { error_print(); return -1; } return 1; } int x509_access_description_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { int oid; int choice; const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; if (x509_access_method_from_der(&oid, &d, &dlen) != 1) { error_print(); return -1; } format_print(fp, fmt, ind, "accessMethod: %s\n", x509_access_method_name(oid)); if (x509_general_name_from_der(&choice, &p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_general_name_print(fp, fmt, ind, "GeneralName", choice, p, len); if (dlen) { error_print(); return -1; } return 1; } int x509_authority_info_access_to_der( const char *ca_issuers_uri, size_t ca_issuers_urilen, const char *ocsp_uri, size_t ocsp_urilen, uint8_t **out, size_t *outlen) { size_t len = 0; if (ca_issuers_uri && ca_issuers_urilen) { if (x509_access_description_to_der(OID_ad_ca_issuers, ca_issuers_uri, ca_issuers_urilen, NULL, &len) != 1) { error_print(); return -1; } } if (ocsp_uri && ocsp_urilen) { if (x509_access_description_to_der(OID_ad_ocsp, ocsp_uri, ocsp_urilen, NULL, &len) != 1) { error_print(); return -1; } } if (!len) { error_print(); return -1; } if (asn1_sequence_header_to_der(len, out, outlen) != 1) { error_print(); return -1; } if (ca_issuers_uri && ca_issuers_urilen) { if (x509_access_description_to_der(OID_ad_ca_issuers, ca_issuers_uri, ca_issuers_urilen, out, outlen) != 1) { error_print(); return -1; } } if (ocsp_uri && ocsp_urilen) { if (x509_access_description_to_der(OID_ad_ocsp, ocsp_uri, ocsp_urilen, out, outlen) != 1) { error_print(); return -1; } } return 1; } int x509_authority_info_access_from_der( const char **ca_issuers_uri, size_t *ca_issuers_urilen, const char **ocsp_uri, size_t *ocsp_urilen, const uint8_t **in, size_t *inlen) { int ret; const uint8_t *d; size_t dlen; if (!ca_issuers_uri || !ca_issuers_urilen || !ocsp_uri || !ocsp_urilen || !in || !(*in) || !inlen) { error_print(); return -1; } *ca_issuers_uri = NULL; *ca_issuers_urilen = 0; *ocsp_uri = NULL; *ocsp_urilen = 0; if ((ret = asn1_sequence_of_from_der(&d, &dlen, in, inlen)) != 1) { if (ret < 0) error_print(); return ret; } while (dlen) { int oid; const char *uri; size_t urilen; if (x509_access_description_from_der(&oid, &uri, &urilen, &d, &dlen) != 1) { error_print(); return -1; } switch (oid) { case OID_ad_ca_issuers: if (*ca_issuers_uri) { error_print(); return -1; } *ca_issuers_uri = uri; *ca_issuers_urilen = urilen; break; case OID_ad_ocsp: if (*ocsp_uri) { error_print(); return -1; } *ocsp_uri = uri; *ocsp_urilen = urilen; break; default: error_print(); return -1; } } return 1; } int x509_authority_info_access_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen) { const uint8_t *p; size_t len; format_print(fp, fmt, ind, "%s\n", label); ind += 4; while (dlen) { if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) { error_print(); return -1; } x509_access_description_print(fp, fmt, ind, "AccessDescription", p, len); } return 1; } int x509_exts_add_authority_info_access(uint8_t *exts, size_t *extslen, size_t maxlen, int critical, const char *ca_issuers_uri, size_t ca_issuers_urilen, const char *ocsp_uri, size_t ocsp_urilen) { int oid = OID_pe_authority_info_access; size_t curlen = *extslen; uint8_t val[256]; uint8_t *p = val; size_t vlen = 0; size_t len = 0; if (x509_authority_info_access_to_der(ca_issuers_uri, ca_issuers_urilen, ocsp_uri, ocsp_urilen, NULL, &len) != 1 || asn1_length_le(len, sizeof(val)) != 1 || x509_authority_info_access_to_der(ca_issuers_uri, ca_issuers_urilen, ocsp_uri, ocsp_urilen, &p, &vlen) != 1) { error_print(); return -1; } exts += *extslen; if (x509_ext_to_der(oid, critical, val, vlen, NULL, &curlen) != 1 || asn1_length_le(curlen, maxlen) != 1 || x509_ext_to_der(oid, critical, val, vlen, &exts, extslen) != 1) { error_print(); return -1; } return 1; }