abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-07 00:46:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
8eb0d3b5720a0e0651e07d2baf0b54dda75adc3b
GmSSL/src/x509_cer.c
Zhi Guan 8eb0d3b572 x509_key all tests passed
2026-02-05 20:26:40 +08:00

2053 lines
53 KiB
C
Raw Blame History

/*
* Copyright 2014-2026 The GmSSL Project. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the License); you may
* not use this file except in compliance with the License.
*
* http://www.apache.org/licenses/LICENSE-2.0
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <assert.h>
#include <gmssl/mem.h>
#include <gmssl/sm2.h>
#include <gmssl/oid.h>
#include <gmssl/pem.h>
#include <gmssl/asn1.h>
#include <gmssl/rsa.h>
#include <gmssl/file.h>
#include <gmssl/x509_alg.h>
#include <gmssl/x509_ext.h>
#include <gmssl/x509.h>
#include <gmssl/error.h>
const char *x509_version_name(int version)
{
switch (version) {
case X509_version_v1: return "v1";
case X509_version_v2: return "v2";
case X509_version_v3: return "v3";
}
return NULL;
}
int x509_explicit_version_to_der(int index, int version, uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (version == -1) {
return 0;
}
if (!x509_version_name(version)) {
error_print();
return -1;
}
if (asn1_int_to_der(version, NULL, &len) != 1
|| asn1_explicit_header_to_der(index, len, out, outlen) != 1
|| asn1_int_to_der(version, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_explicit_version_from_der(int index, int *version, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_explicit_from_der(index, &d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else *version = -1;
return ret;
}
if (asn1_int_from_der(version, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (!x509_version_name(*version)) {
error_print();
return -1;
}
return 1;
}
int x509_time_to_der(time_t tv, uint8_t **out, size_t *outlen)
{
if (tv == -1) {
return 0;
}
if (tv < -1 || tv > X509_MAX_GENERALIZED_TIME) {
error_print();
return -1;
}
if (tv <= X509_MAX_UTC_TIME) {
if (asn1_utc_time_to_der(tv, out, outlen) != 1) {
error_print();
return -1;
}
} else {
if (asn1_generalized_time_to_der(tv, out, outlen) !=1) {
error_print();
return -1;
}
}
return 1;
}
int x509_time_from_der(time_t *tv, const uint8_t **in, size_t *inlen)
{
int ret;
int tag;
if ((ret = asn1_tag_from_der_readonly(&tag, in, inlen)) != 1) {
if (ret < 0) error_print();
else *tv = -1;
return ret;
}
switch (tag) {
case ASN1_TAG_UTCTime:
if (asn1_utc_time_from_der(tv, in, inlen) != 1) {
error_print();
return -1;
}
break;
case ASN1_TAG_GeneralizedTime:
if (asn1_generalized_time_from_der(tv, in, inlen) != 1) {
error_print();
return -1;
}
break;
default:
return 0;
}
return 1;
}
int x509_validity_add_days(time_t *not_after, time_t not_before, int days)
{
if (days < X509_VALIDITY_MIN_DAYS
|| days > X509_VALIDITY_MAX_DAYS) {
error_print();
return -1;
}
*not_after = not_before + (time_t)days * 24 * 60 * 60;
return 1;
}
int x509_validity_to_der(time_t not_before, time_t not_after, uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (x509_time_to_der(not_before, NULL, &len) != 1
|| x509_time_to_der(not_after, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| x509_time_to_der(not_before, out, outlen) != 1
|| x509_time_to_der(not_after, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_validity_from_der(time_t *not_before, time_t *not_after, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else *not_before = *not_after = -1;
return ret;
}
if (x509_time_from_der(not_before, &d, &dlen) != 1
|| x509_time_from_der(not_after, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (*not_before >= *not_after) {
error_print();
return -1;
}
return 1;
}
int x509_validity_check(time_t not_before, time_t not_after, time_t now, int max_secs)
{
if (!(not_before <= not_after)) {
error_print();
return -1;
}
if (!(not_after - not_before <= (unsigned int)max_secs)) {
error_print();
return -1;
}
if (!(not_before <= now && now <= not_after)) {
error_print();
return -1;
}
return 1;
}
int x509_validity_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
time_t tv;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (x509_time_from_der(&tv, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "notBefore: %s", ctime(&tv));
if (x509_time_from_der(&tv, &d, &dlen) != 1) goto err;
format_print(fp, fmt, ind, "notAfter: %s", ctime(&tv));
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
static uint32_t oid_at_name[] = { oid_at,41 };
static uint32_t oid_at_surname[] = { oid_at,4 };
static uint32_t oid_at_given_name[] = { oid_at,42 };
static uint32_t oid_at_initials[] = { oid_at,43 };
static uint32_t oid_at_generation_qualifier[] = { oid_at,44 };
static uint32_t oid_at_common_name[] = { oid_at,3 };
static uint32_t oid_at_locality_name[] = { oid_at,7 };
static uint32_t oid_at_state_or_province_name[] = { oid_at,8 };
static uint32_t oid_at_organization_name[] = { oid_at,10 };
static uint32_t oid_at_organizational_unit_name[] = { oid_at,11 };
static uint32_t oid_at_title[] = { oid_at,12 };
static uint32_t oid_at_dn_qualifier[] = { oid_at,46 };
static uint32_t oid_at_country_name[] = { oid_at,6 };
static uint32_t oid_at_serial_number[] = { oid_at,5 };
static uint32_t oid_at_pseudonym[] = { oid_at,65 };
static uint32_t oid_domain_component[] = { 0,9,2342,19200300,100,1,25 };
static uint32_t oid_email_address[] = { 1,2,840,113549,1,9,1 };
#define OID_AT_CNT (sizeof(oid_at_name)/sizeof(int))
static const ASN1_OID_INFO x509_name_types[] = {
{ OID_at_name, "name", oid_at_name, OID_AT_CNT },
{ OID_at_surname, "surname", oid_at_surname, OID_AT_CNT },
{ OID_at_given_name, "givenName", oid_at_given_name, OID_AT_CNT },
{ OID_at_initials, "initials", oid_at_initials, OID_AT_CNT },
{ OID_at_generation_qualifier, "generationQualifier", oid_at_generation_qualifier, OID_AT_CNT },
{ OID_at_common_name, "commonName", oid_at_common_name, OID_AT_CNT },
{ OID_at_locality_name, "localityName", oid_at_locality_name, OID_AT_CNT },
{ OID_at_state_or_province_name, "stateOrProvinceName", oid_at_state_or_province_name, OID_AT_CNT },
{ OID_at_organization_name, "organizationName", oid_at_organization_name, OID_AT_CNT },
{ OID_at_organizational_unit_name, "organizationalUnitName", oid_at_organizational_unit_name, OID_AT_CNT },
{ OID_at_title, "title", oid_at_title, OID_AT_CNT },
{ OID_at_dn_qualifier, "dnQualifier", oid_at_dn_qualifier, OID_AT_CNT },
{ OID_at_country_name, "countryName", oid_at_country_name, OID_AT_CNT },
{ OID_at_serial_number, "serialNumber", oid_at_serial_number, OID_AT_CNT },
{ OID_at_pseudonym, "pseudonym", oid_at_pseudonym, OID_AT_CNT },
{ OID_domain_component, "domainComponent", oid_domain_component, sizeof(oid_domain_component)/sizeof(int) },
{ OID_email_address, "emailAddress", oid_email_address, sizeof(oid_email_address)/sizeof(int) },
};
static const int x509_name_types_count
= sizeof(x509_name_types)/sizeof(x509_name_types[0]);
const char *x509_name_type_name(int oid)
{
const ASN1_OID_INFO *info;
if (!(info = asn1_oid_info_from_oid(x509_name_types, x509_name_types_count, oid))) {
error_print();
return NULL;
}
return info->name;
}
int x509_name_type_from_name(const char *name)
{
const ASN1_OID_INFO *info;
if (!(info = asn1_oid_info_from_name(x509_name_types, x509_name_types_count, name))) {
error_print();
return OID_undef;
}
return info->oid;
}
int x509_name_type_to_der(int oid, uint8_t **out, size_t *outlen)
{
const ASN1_OID_INFO *info;
if (!(info = asn1_oid_info_from_oid(x509_name_types, x509_name_types_count, oid))) {
error_print();
return -1;
}
if (asn1_object_identifier_to_der(info->nodes, info->nodes_cnt, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_name_type_from_der(int *oid, const uint8_t **in, size_t *inlen)
{
int ret;
const ASN1_OID_INFO *info;
if ((ret = asn1_oid_info_from_der(&info, x509_name_types, x509_name_types_count, in, inlen)) != 1) {
if (ret < 0) error_print();
else *oid = -1;
return ret;
}
*oid = info->oid;
return 1;
}
int x509_directory_name_check(int tag, const uint8_t *d, size_t dlen)
{
if (dlen == 0) {
return 0;
}
if (!d) {
error_print();
return -1;
}
switch (tag) {
case ASN1_TAG_TeletexString:
case ASN1_TAG_PrintableString:
case ASN1_TAG_UniversalString:
case ASN1_TAG_UTF8String:
if (strnlen((char *)d, dlen) != dlen) {
error_print();
return -1;
}
break;
case ASN1_TAG_BMPString:
if (dlen % 2) {
error_print();
return -1;
}
break;
default:
error_print();
return -1;
}
return 1;
}
int x509_directory_name_check_ex(int tag, const uint8_t *d, size_t dlen, size_t minlen, size_t maxlen)
{
int ret;
if ((ret = x509_directory_name_check(tag, d, dlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (dlen < minlen || dlen > maxlen) {
error_print();
return -1;
}
return 1;
}
int x509_directory_name_to_der(int tag, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen)
{
if (dlen == 0) {
return 0;
}
if (x509_directory_name_check(tag, d, dlen) != 1) {
error_print();
return -1;
}
if (asn1_type_to_der(tag, d, dlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_directory_name_from_der(int *tag, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen)
{
int ret;
if ((ret = asn1_tag_from_der_readonly(tag, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
switch (*tag) {
case ASN1_TAG_TeletexString:
case ASN1_TAG_PrintableString:
case ASN1_TAG_UniversalString:
case ASN1_TAG_UTF8String:
case ASN1_TAG_BMPString:
break;
default:
return 0;
}
if (asn1_any_type_from_der(tag, d, dlen, in, inlen) != 1) {
error_print();
return -1;
}
if (x509_directory_name_check(*tag, *d, *dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_directory_name_print(FILE *fp, int fmt, int ind, const char *label, int tag, const uint8_t *d, size_t dlen)
{
return asn1_string_print(fp, fmt, ind, label, tag, d, dlen);
}
int x509_explicit_directory_name_to_der(int index, int tag, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen)
{
int ret;
size_t len = 0;
if ((ret = x509_directory_name_to_der(tag, d, dlen, NULL, &len)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_explicit_header_to_der(index, len, out, outlen) != 1
|| x509_directory_name_to_der(tag, d, dlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_explicit_directory_name_from_der(int index, int *tag, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *p;
size_t len;
if ((ret = asn1_explicit_from_der(index, &p, &len, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (x509_directory_name_from_der(tag, d, dlen, &p, &len) != 1
|| asn1_length_is_zero(len) != 1) {
error_print();
return -1;
}
return 1;
}
static const struct {
int oid;
int is_printable_string_only;
int minlen;
int maxlen;
} x509_name_types_info[] = {
{ OID_at_country_name, 1, 2, 2 },
{ OID_at_state_or_province_name, 0, 1, X509_ub_state_name },
{ OID_at_locality_name, 0, 1, X509_ub_locality_name },
{ OID_at_organization_name, 0, 1, X509_ub_organization_name },
{ OID_at_organizational_unit_name, 0, 1, X509_ub_organizational_unit_name },
{ OID_at_common_name, 0, 1, X509_ub_common_name },
{ OID_at_serial_number, 1, 1, X509_ub_serial_number },
{ OID_at_dn_qualifier, 1, 1, 64 }, // max length unspecified in RFC 5280
{ OID_at_title, 0, 1, X509_ub_title },
{ OID_at_surname, 0, 1, X509_ub_name },
{ OID_at_given_name, 0, 1, X509_ub_name },
{ OID_at_initials, 0, 1, X509_ub_name },
{ OID_at_generation_qualifier, 0, 1, X509_ub_name },
{ OID_at_pseudonym, 0, 1, X509_ub_pseudonym },
};
static const int x509_name_types_info_count
= sizeof(x509_name_types_info)/sizeof(x509_name_types_info[0]);
int x509_attr_type_and_value_check(int oid, int tag, const uint8_t *val, size_t vlen)
{
int i;
for (i = 0; i < x509_name_types_info_count; i++) {
if (oid == x509_name_types_info[i].oid) {
if (x509_name_types_info[i].is_printable_string_only
&& tag != ASN1_TAG_PrintableString) {
error_print();
return -1;
}
if (x509_directory_name_check_ex(tag, val, vlen,
x509_name_types_info[i].minlen, x509_name_types_info[i].maxlen) != 1) {
error_print();
return -1;
}
return 1;
}
}
error_print();
return -1;
}
int x509_attr_type_and_value_to_der(int oid, int tag, const uint8_t *val, size_t vlen,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (vlen == 0) {
return 0;
}
if (x509_attr_type_and_value_check(oid, tag, val, vlen) != 1
|| x509_name_type_to_der(oid, NULL, &len) != 1
|| x509_directory_name_to_der(tag, val, vlen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| x509_name_type_to_der(oid, out, outlen) != 1
|| x509_directory_name_to_der(tag, val, vlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_attr_type_and_value_from_der(int *oid, int *tag, const uint8_t **val, size_t *vlen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else {
*tag = -1;
*val = NULL;
*vlen = 0;
}
return ret;
}
if (x509_name_type_from_der(oid, &d, &dlen) != 1
|| x509_directory_name_from_der(tag, val, vlen, &d, &dlen) != 1
|| x509_attr_type_and_value_check(*oid, *tag, *val, *vlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_attr_type_and_value_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int oid, tag;
const uint8_t *val;
size_t vlen;
if (fmt & ASN1_FMT_FULL) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (x509_name_type_from_der(&oid, &d, &dlen) != 1) goto err;
asn1_object_identifier_print(fp, fmt, ind, "type", x509_name_type_name(oid), NULL, 0);
if (oid == OID_email_address) {
if (asn1_ia5_string_from_der((const char **)&val, &vlen, &d, &dlen) != 1) goto err;
format_string(fp, fmt, ind, "value", val, vlen);
} else {
if (x509_directory_name_from_der(&tag, &val, &vlen, &d, &dlen) != 1) goto err;
x509_directory_name_print(fp, fmt, ind, "value", tag, val, vlen);
}
} else {
if (x509_name_type_from_der(&oid, &d, &dlen) != 1) { error_print(); goto err; }
if (oid == OID_email_address) {
if (asn1_ia5_string_from_der((const char **)&val, &vlen, &d, &dlen) != 1) goto err;
format_string(fp, fmt, ind, "emailAddress", val, vlen);
} else {
if (x509_directory_name_from_der(&tag, &val, &vlen, &d, &dlen) != 1) goto err;
x509_directory_name_print(fp, fmt, ind, x509_name_type_name(oid), tag, val, vlen);
}
}
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
int x509_rdn_check(const uint8_t *d, size_t dlen)
{
int oid;
int tag;
const uint8_t *val;
size_t vlen;
if (dlen == 0) {
return 0;
}
while (dlen) {
if (x509_attr_type_and_value_from_der(&oid, &tag, &val, &vlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (vlen == 0) {
error_print();
return -1;
}
}
return 1;
}
int x509_rdn_to_der(int oid, int tag, const uint8_t *val, size_t vlen,
const uint8_t *more, size_t morelen,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (vlen == 0 && morelen == 0) {
return 0;
}
if (x509_rdn_check(more, morelen) < 0) {
error_print();
return -1;
}
if (x509_attr_type_and_value_to_der(oid, tag, val, vlen, NULL, &len) < 0
|| asn1_data_to_der(more, morelen, NULL, &len) < 0
|| asn1_set_header_to_der(len, out, outlen) != 1
|| x509_attr_type_and_value_to_der(oid, tag, val, vlen, out, outlen) < 0
|| asn1_data_to_der(more, morelen, out, outlen) < 0) {
error_print();
return -1;
}
return 1;
}
int x509_rdn_from_der(int *oid, int *tag, const uint8_t **val, size_t *vlen,
const uint8_t **more, size_t *morelen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_set_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else {
*oid = *tag = -1;
*val = *more = NULL;
*vlen = *morelen = 0;
}
return ret;
}
if (x509_attr_type_and_value_from_der(oid, tag, val, vlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_rdn_check(d, dlen) < 0) {
error_print();
return -1;
}
*more = dlen ? d : NULL;
*morelen = dlen;
return 1;
}
int x509_rdn_get_value_by_type(const uint8_t *d, size_t dlen, int type, int *tag, const uint8_t **val, size_t *vlen)
{
int oid;
while (dlen) {
if (x509_attr_type_and_value_from_der(&oid, tag, val, vlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (oid == type) {
return 1;
}
}
*tag = -1;
*val = NULL;
*vlen = 0;
return 0;
}
int x509_rdn_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
if (fmt & ASN1_FMT_FULL) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
x509_attr_type_and_value_print(fp, fmt, ind, "AttributeTypeAndValue", p, len);
while (dlen) {
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
x509_attr_type_and_value_print(fp, fmt, ind + 4, "AttributeTypeAndValue", p, len);
}
return 1;
}
int x509_name_check(const uint8_t *d, size_t dlen)
{
const uint8_t *rdn;
size_t rdnlen;
if (dlen == 0) {
return 0;
}
while (dlen) {
if (asn1_set_from_der(&rdn, &rdnlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_rdn_check(rdn, rdnlen) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_name_add_rdn(uint8_t *d, size_t *dlen, size_t maxlen,
int oid, int tag, const uint8_t *val, size_t vlen,
const uint8_t *more, size_t morelen)
{
int ret;
uint8_t *p;
size_t len;
if (!d || !dlen) {
error_print();
return -1;
}
p = d + (*dlen);
if (x509_rdn_to_der(oid, tag, val, vlen, more, morelen, NULL, dlen) < 0
|| asn1_length_le(*dlen, maxlen) != 1
|| (ret = x509_rdn_to_der(oid, tag, val, vlen, more, morelen, &p, &len)) < 0) {
error_print();
return -1;
}
return ret;
}
int x509_name_add_country_name(uint8_t *d, size_t *dlen, size_t maxlen, const char val[2])
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen,
OID_at_country_name, ASN1_TAG_PrintableString, (uint8_t *)val, val ? 2 : 0, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_state_or_province_name(uint8_t *d, size_t *dlen, size_t maxlen,
int tag, const uint8_t *val, size_t vlen)
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_state_or_province_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_locality_name(uint8_t *d, size_t *dlen, size_t maxlen,
int tag, const uint8_t *val, size_t vlen)
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_locality_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_organization_name(uint8_t *d, size_t *dlen, size_t maxlen,
int tag, const uint8_t *val, size_t vlen)
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_organization_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_organizational_unit_name(uint8_t *d, size_t *dlen, size_t maxlen,
int tag, const uint8_t *val, size_t vlen)
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_organizational_unit_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_common_name(uint8_t *d, size_t *dlen, size_t maxlen,
int tag, const uint8_t *val, size_t vlen)
{
int ret;
ret = x509_name_add_rdn(d, dlen, maxlen, OID_at_common_name, tag, val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
int x509_name_add_domain_component(uint8_t *d, size_t *dlen, size_t maxlen,
const char *val, size_t vlen)
{
int ret;
return x509_name_add_rdn(d, dlen, maxlen, OID_domain_component, ASN1_TAG_IA5String, (uint8_t *)val, vlen, NULL, 0);
if (ret < 0) error_print();
return ret;
}
static size_t optstrlen(const char *s) { return s ? strlen(s) : 0; }
static int x509_name_tag(const char *str)
{
if (str) {
if (asn1_string_is_printable_string(str, strlen(str)) == 1)
return ASN1_TAG_PrintableString;
else return ASN1_TAG_UTF8String;
}
return 0;
}
int x509_name_set(uint8_t *d, size_t *dlen, size_t maxlen,
const char country[2], const char *state, const char *locality,
const char *org, const char *org_unit, const char *common_name)
{
if (country && strlen(country) != 2) {
error_print();
return -1;
}
*dlen = 0;
if (x509_name_add_country_name(d, dlen, maxlen, country) < 0
|| x509_name_add_state_or_province_name(d, dlen, maxlen, x509_name_tag(state), (uint8_t *)state, optstrlen(state)) < 0
|| x509_name_add_locality_name(d, dlen, maxlen, x509_name_tag(locality), (uint8_t *)locality, optstrlen(locality)) < 0
|| x509_name_add_organization_name(d, dlen, maxlen, x509_name_tag(org), (uint8_t *)org, optstrlen(org)) < 0
|| x509_name_add_organizational_unit_name(d, dlen, maxlen, x509_name_tag(org_unit), (uint8_t *)org_unit, optstrlen(org_unit)) < 0
|| x509_name_add_common_name(d, dlen, maxlen, x509_name_tag(common_name), (uint8_t *)common_name, optstrlen(common_name)) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_name_get_value_by_type(const uint8_t *d, size_t dlen, int oid, int *tag, const uint8_t **val, size_t *vlen)
{
int ret;
const uint8_t *rdn;
size_t rdnlen;
while (dlen) {
if (asn1_set_from_der(&rdn, &rdnlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if ((ret = x509_rdn_get_value_by_type(rdn, rdnlen, oid, tag, val, vlen)) < 0) {
error_print();
return -1;
}
if (ret) {
return 1;
}
}
return 0;
}
int x509_name_get_common_name(const uint8_t *d, size_t dlen, int *tag, const uint8_t **val, size_t *vlen)
{
int ret;
ret = x509_name_get_value_by_type(d, dlen, OID_at_common_name, tag, val, vlen);
if (ret < 0) error_print();
return ret;
}
int x509_name_equ(const uint8_t *a, size_t alen, const uint8_t *b, size_t blen)
{
if (alen != blen || memcmp(a, b, blen) != 0) {
return 0;
}
return 1;
}
int x509_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
if (label) {
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
}
while (dlen) {
if (asn1_set_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
x509_rdn_print(fp, fmt, ind, "RelativeDistinguishedName", p, len);
}
return 1;
}
int x509_names_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
while (dlen) {
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
x509_name_print(fp, fmt, ind, "Name", p, len);
}
return 1;
}
/*
int x509_public_key_info_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p = d;
size_t len = dlen;
int alg;
int params;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (x509_public_key_algor_from_der(&alg, &params, &p, &len) != 1) goto err;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_public_key_algor_print(fp, fmt, ind, "algorithm", p, len);
format_print(fp, fmt, ind, "subjectPublicKey\n");
ind += 4;
if (asn1_bit_octets_from_der(&p, &len, &d, &dlen) != 1) goto err;
switch (alg) {
case OID_ec_public_key:
format_bytes(fp, fmt, ind, "ECPoint", p, len);
break;
case OID_rsa_encryption:
rsa_public_key_print(fp, fmt, ind, "RSAPublicKey", p, len);
break;
default:
format_bytes(fp, fmt, ind, "raw_data", p, len);
}
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
*/
int x509_explicit_exts_to_der(int index, const uint8_t *d, size_t dlen, uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (dlen == 0) {
return 0;
}
if (asn1_sequence_to_der(d, dlen, NULL, &len) != 1
|| asn1_explicit_header_to_der(index, len, out, outlen) != 1
|| asn1_sequence_to_der(d, dlen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_explicit_exts_from_der(int index, const uint8_t **d, size_t *dlen, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *p;
size_t len;
if ((ret = asn1_explicit_from_der(index, &p, &len, in, inlen)) != 1) {
if (ret < 0) error_print();
else {
*d = NULL;
*dlen = 0;
}
return ret;
}
if (asn1_sequence_from_der(d, dlen, &p, &len) != 1
|| asn1_length_is_zero(len) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_tbs_cert_to_der(
int version,
const uint8_t *serial, size_t serial_len,
int signature_algor,
const uint8_t *issuer, size_t issuer_len,
time_t not_before, time_t not_after,
const uint8_t *subject, size_t subject_len,
const X509_KEY *subject_public_key,
const uint8_t *issuer_unique_id, size_t issuer_unique_id_len,
const uint8_t *subject_unique_id, size_t subject_unique_id_len,
const uint8_t *exts, size_t exts_len,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
if (x509_explicit_version_to_der(0, version, NULL, &len) < 0
|| asn1_integer_to_der(serial, serial_len, NULL, &len) != 1
|| x509_signature_algor_to_der(signature_algor, NULL, &len) != 1
|| asn1_sequence_to_der(issuer, issuer_len, NULL, &len) != 1
|| x509_validity_to_der(not_before, not_after, NULL, &len) != 1
|| asn1_sequence_to_der(subject, subject_len, NULL, &len) != 1
|| x509_public_key_info_to_der(subject_public_key, NULL, &len) != 1
|| asn1_implicit_bit_octets_to_der(1, issuer_unique_id, issuer_unique_id_len, NULL, &len) < 0
|| asn1_implicit_bit_octets_to_der(2, subject_unique_id, subject_unique_id_len, NULL, &len) < 0
|| x509_explicit_exts_to_der(3, exts, exts_len, NULL, &len) < 0
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| x509_explicit_version_to_der(0, version, out, outlen) < 0
|| asn1_integer_to_der(serial, serial_len, out, outlen) != 1
|| x509_signature_algor_to_der(signature_algor, out, outlen) != 1
|| asn1_sequence_to_der(issuer, issuer_len, out, outlen) != 1
|| x509_validity_to_der(not_before, not_after, out, outlen) != 1
|| asn1_sequence_to_der(subject, subject_len, out, outlen) != 1
|| x509_public_key_info_to_der(subject_public_key, out, outlen) != 1
|| asn1_implicit_bit_octets_to_der(1, issuer_unique_id, issuer_unique_id_len, out, outlen) < 0
|| asn1_implicit_bit_octets_to_der(2, subject_unique_id, subject_unique_id_len, out, outlen) < 0
|| x509_explicit_exts_to_der(3, exts, exts_len, out, outlen) < 0) {
error_print();
return -1;
}
return 1;
}
int x509_tbs_cert_from_der(
int *version,
const uint8_t **serial, size_t *serial_len,
int *signature_algor,
const uint8_t **issuer, size_t *issuer_len,
time_t *not_before, time_t *not_after,
const uint8_t **subject, size_t *subject_len,
X509_KEY *subject_public_key,
const uint8_t **issuer_unique_id, size_t *issuer_unique_id_len,
const uint8_t **subject_unique_id, size_t *subject_unique_id_len,
const uint8_t **exts, size_t *exts_len,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (x509_explicit_version_from_der(0, version, &d, &dlen) < 0
|| asn1_integer_from_der(serial, serial_len, &d, &dlen) != 1
|| x509_signature_algor_from_der(signature_algor, &d, &dlen) != 1
|| asn1_sequence_from_der(issuer, issuer_len, &d, &dlen) != 1
|| x509_validity_from_der(not_before, not_after, &d, &dlen) != 1
|| asn1_sequence_from_der(subject, subject_len, &d, &dlen) != 1
|| x509_public_key_info_from_der(subject_public_key, &d, &dlen) != 1
|| asn1_implicit_bit_octets_from_der(1, issuer_unique_id, issuer_unique_id_len, &d, &dlen) < 0
|| asn1_implicit_bit_octets_from_der(2, subject_unique_id, subject_unique_id_len, &d, &dlen) < 0
|| x509_explicit_exts_from_der(3, exts, exts_len, &d, &dlen) < 0
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_tbs_cert_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
int ret, val;
const uint8_t *p;
size_t len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if ((ret = x509_explicit_version_from_der(0, &val, &d, &dlen)) < 0) goto err;
if (ret) format_print(fp, fmt, ind, "version: %s (%d)\n", x509_version_name(val), val);
if (asn1_integer_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "serialNumber", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_signature_algor_print(fp, fmt, ind, "signature", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_name_print(fp, fmt, ind, "issuer", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_validity_print(fp, fmt, ind, "validity", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_name_print(fp, fmt, ind, "subject", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_public_key_info_print(fp, fmt, ind, "subjectPulbicKeyInfo", p, len);
if ((ret = asn1_implicit_bit_octets_from_der(1, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) format_bytes(fp, fmt, ind, "issuerUniqueID", p, len);
if ((ret = asn1_implicit_bit_octets_from_der(2, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) format_bytes(fp, fmt, ind, "subjectUniqueID", p, len);
if ((ret = x509_explicit_exts_from_der(3, &p, &len, &d, &dlen)) < 0) goto err;
if (ret) x509_exts_print(fp, fmt, ind, "extensions", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
int x509_cert_sign_to_der(
int version,
const uint8_t *serial, size_t serial_len,
int signature_algor,
const uint8_t *issuer, size_t issuer_len,
time_t not_before, time_t not_after,
const uint8_t *subject, size_t subject_len,
const X509_KEY *subject_public_key,
const uint8_t *issuer_unique_id, size_t issuer_unique_id_len,
const uint8_t *subject_unique_id, size_t subject_unique_id_len,
const uint8_t *exts, size_t exts_len,
X509_KEY *sign_key, const char *signer_id, size_t signer_id_len,
uint8_t **out, size_t *outlen)
{
size_t len = 0;
uint8_t *tbs = NULL;
int sig_alg;
uint8_t sig[X509_SIGNATURE_MAX_SIZE];
size_t siglen;
if (x509_key_get_sign_algor(sign_key, &sig_alg) != 1) {
error_print();
return -1;
}
if (x509_key_get_signature_size(sign_key, &siglen) != 1) {
error_print();
return -1;
}
if (sign_key->algor == OID_ec_public_key) {
siglen = SM2_signature_typical_size;
}
if (x509_tbs_cert_to_der(
version,
serial, serial_len,
signature_algor,
issuer, issuer_len,
not_before, not_after,
subject, subject_len,
subject_public_key,
issuer_unique_id, issuer_unique_id_len,
subject_unique_id, subject_unique_id_len,
exts, exts_len,
NULL, &len) != 1
|| x509_signature_algor_to_der(sig_alg, NULL, &len) != 1
|| asn1_bit_octets_to_der(sig, siglen, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1) {
error_print();
return -1;
}
if (out && *out) {
tbs = *out;
}
if (x509_tbs_cert_to_der(
version,
serial, serial_len,
signature_algor,
issuer, issuer_len,
not_before, not_after,
subject, subject_len,
subject_public_key,
issuer_unique_id, issuer_unique_id_len,
subject_unique_id, subject_unique_id_len,
exts, exts_len,
out, outlen) != 1) {
error_print();
return -1;
}
if (out && *out) {
X509_SIGN_CTX sign_ctx;
void *sign_args = NULL;
size_t sign_argslen = 0;
if (sign_key->algor == OID_ec_public_key && sign_key->algor_param == OID_sm2) {
sign_args = SM2_DEFAULT_ID;
sign_argslen = SM2_DEFAULT_ID_LENGTH;
}
if (x509_sign_init(&sign_ctx, sign_key, sign_args, sign_argslen) != 1) {
error_print();
return -1;
}
if (sign_key->algor == OID_ec_public_key) {
if (x509_sign_set_signature_size(&sign_ctx, siglen) != 1) {
gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
error_print();
return -1;
}
}
if (x509_sign(&sign_ctx, tbs, *out - tbs, sig, &siglen) != 1) {
gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
error_print();
return -1;
}
gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
}
if (x509_signature_algor_to_der(sig_alg, out, outlen) != 1
|| asn1_bit_octets_to_der(sig, siglen, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_signed_from_der(const uint8_t **tbs, size_t *tbslen,
int *sig_alg, const uint8_t **sig, size_t *siglen,
const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
else {
*tbs = *sig = NULL;
*tbslen = *siglen = 0;
*sig_alg = -1;
}
return ret;
}
if (asn1_any_from_der(tbs, tbslen, &d, &dlen) != 1
|| x509_signature_algor_from_der(sig_alg, &d, &dlen) != 1
|| asn1_bit_octets_from_der(sig, siglen, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_signed_verify(const uint8_t *a, size_t alen,
const X509_KEY *key, const char *signer_id, size_t signer_id_len)
{
const uint8_t *tbs;
size_t tbslen;
int sig_alg;
const uint8_t *sig;
size_t siglen;
int key_sig_alg;
void *sign_args = NULL;
size_t sign_argslen = 0;
X509_SIGN_CTX verify_ctx;
if (x509_key_get_sign_algor(key, &key_sig_alg) != 1) {
error_print();
return -1;
}
if (x509_signed_from_der(&tbs, &tbslen, &sig_alg, &sig, &siglen, &a, &alen) != 1
|| asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
if (sig_alg != key_sig_alg) {
error_print();
return -1;
}
if (key->algor == OID_ec_public_key && key->algor_param == OID_sm2) {
sign_args = SM2_DEFAULT_ID;
sign_argslen = SM2_DEFAULT_ID_LENGTH;
}
if (x509_verify_init(&verify_ctx, key, sign_args, sign_argslen, sig, siglen) != 1
|| x509_verify_update(&verify_ctx, tbs, tbslen) != 1
|| x509_verify_finish(&verify_ctx) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_signed_verify_by_ca_cert(const uint8_t *a, size_t alen,
const uint8_t *cacert, size_t cacertlen,
const char *signer_id, size_t signer_id_len)
{
int ret;
X509_KEY public_key;
if (x509_cert_get_subject_public_key(cacert, cacertlen, &public_key) != 1
|| (ret = x509_signed_verify(a, alen, &public_key, signer_id, signer_id_len)) < 0) {
error_print();
return -1;
}
if (!ret) error_print();
return ret;
}
int x509_cert_verify_by_ca_cert(const uint8_t *a, size_t alen,
const uint8_t *cacert, size_t cacertlen,
const char *signer_id, size_t signer_id_len)
{
const uint8_t *issuer;
size_t issuer_len;
const uint8_t *subject;
size_t subject_len;
if (x509_cert_get_issuer(a, alen, &issuer, &issuer_len) != 1
|| x509_cert_get_subject(cacert, cacertlen, &subject, &subject_len) != 1
|| x509_name_equ(issuer, issuer_len, subject, subject_len) != 1) {
error_print();
return -1;
}
if (x509_signed_verify_by_ca_cert(a, alen, cacert, cacertlen, signer_id, signer_id_len) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_cert_to_der(const uint8_t *a, size_t alen, uint8_t **out, size_t *outlen)
{
int ret;
if (x509_cert_get_subject(a, alen, NULL, NULL) != 1) {
error_print();
return -1;
}
if ((ret = asn1_any_to_der(a, alen, out, outlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
return 1;
}
int x509_cert_from_der(const uint8_t **a, size_t *alen, const uint8_t **in, size_t *inlen)
{
int ret;
if ((ret = asn1_any_from_der(a, alen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (x509_cert_get_subject(*a, *alen, NULL, NULL) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_cert_to_pem(const uint8_t *a, size_t alen, FILE *fp)
{
if (x509_cert_get_subject(a, alen, NULL, NULL) != 1) {
error_print();
return -1;
}
if (pem_write(fp, "CERTIFICATE", a, alen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_cert_from_pem(uint8_t *a, size_t *alen, size_t maxlen, FILE *fp)
{
int ret;
if ((ret = pem_read(fp, "CERTIFICATE", a, alen, maxlen)) != 1) {
if (ret < 0) error_print();
else *alen = 0;
return ret;
}
if (x509_cert_get_subject(a, *alen, NULL, NULL) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_cert_from_pem_by_subject(uint8_t *a, size_t *alen, size_t maxlen, const uint8_t *name, size_t namelen, FILE *fp)
{
int ret;
const uint8_t *d;
size_t dlen;
for (;;) {
if ((ret = x509_cert_from_pem(a, alen, maxlen, fp)) != 1) {
if (ret < 0) error_print();
else *alen = 0;
return ret;
}
if (x509_cert_get_subject(a, *alen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_name_equ(d, dlen, name, namelen) == 1) {
return 1;
}
}
*alen = 0;
return 0;
}
static int x509_certificate_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_tbs_cert_print(fp, fmt, ind, "tbsCertificate", p, len);
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) goto err;
x509_signature_algor_print(fp, fmt, ind, "signatureAlgorithm", p, len);
if (asn1_bit_octets_from_der(&p, &len, &d, &dlen) != 1) goto err;
format_bytes(fp, fmt, ind, "signatureValue", p, len);
if (asn1_length_is_zero(dlen) != 1) goto err;
return 1;
err:
error_print();
return -1;
}
int x509_cert_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
{
const uint8_t *d;
size_t dlen;
if (asn1_sequence_from_der(&d, &dlen, &a, &alen) != 1) {
error_print();
return -1;
}
x509_certificate_print(fp, fmt, ind, label, d, dlen);
if (asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_cert_get_details(const uint8_t *a, size_t alen,
int *version,
const uint8_t **serial_number, size_t *serial_number_len,
int *inner_signature_algor,
const uint8_t **issuer, size_t *issuer_len,
time_t *not_before, time_t *not_after,
const uint8_t **subject, size_t *subject_len,
X509_KEY *subject_public_key,
const uint8_t **issuer_unique_id, size_t *issuer_unique_id_len,
const uint8_t **subject_unique_id, size_t *subject_unique_id_len,
const uint8_t **extensions, size_t *extensions_len,
int *signature_algor,
const uint8_t **signature, size_t *signature_len)
{
const uint8_t *tbs_a;
size_t tbs_alen;
int sig_alg;
const uint8_t *sig;
size_t sig_len;
struct {
int version;
const uint8_t *serial; size_t serial_len;
int sig_alg;
const uint8_t *issuer; size_t issuer_len;
time_t not_before; time_t not_after;
const uint8_t *subject; size_t subject_len;
X509_KEY subject_public_key;
const uint8_t *issuer_unique_id; size_t issuer_unique_id_len;
const uint8_t *subject_unique_id; size_t subject_unique_id_len;
const uint8_t *exts; size_t exts_len;
} tbs;
if (x509_signed_from_der(&tbs_a, &tbs_alen, &sig_alg, &sig, &sig_len, &a, &alen) != 1
|| asn1_length_is_zero(alen) != 1) {
error_print();
return -1;
}
if (x509_tbs_cert_from_der(
&tbs.version,
&tbs.serial, &tbs.serial_len,
&tbs.sig_alg,
&tbs.issuer, &tbs.issuer_len,
&tbs.not_before, &tbs.not_after,
&tbs.subject, &tbs.subject_len,
&tbs.subject_public_key,
&tbs.issuer_unique_id, &tbs.issuer_unique_id_len,
&tbs.subject_unique_id, &tbs.subject_unique_id_len,
&tbs.exts, &tbs.exts_len, &tbs_a, &tbs_alen) != 1) {
error_print();
return -1;
}
if (version) *version = tbs.version;
if (serial_number) *serial_number = tbs.serial;
if (serial_number_len) *serial_number_len = tbs.serial_len;
if (inner_signature_algor) *inner_signature_algor = tbs.sig_alg;
if (issuer) *issuer = tbs.issuer;
if (issuer_len) *issuer_len = tbs.issuer_len;
if (not_before) *not_before = tbs.not_before;
if (not_after) *not_after = tbs.not_after;
if (subject) *subject = tbs.subject;
if (subject_len) *subject_len = tbs.subject_len;
if (subject_public_key) *subject_public_key = tbs.subject_public_key;
if (issuer_unique_id) *issuer_unique_id = tbs.issuer_unique_id;
if (issuer_unique_id_len) *issuer_unique_id_len = tbs.issuer_unique_id_len;
if (subject_unique_id) *subject_unique_id = tbs.subject_unique_id;
if (subject_unique_id_len) *subject_unique_id_len = tbs.subject_unique_id_len;
if (extensions) *extensions = tbs.exts;
if (extensions_len) *extensions_len = tbs.exts_len;
if (signature_algor) *signature_algor = sig_alg;
if (signature) *signature = sig;
if (signature_len) *signature_len = sig_len;
return 1;
}
int x509_cert_get_issuer_and_serial_number(const uint8_t *a, size_t alen,
const uint8_t **issuer, size_t *issuer_len,
const uint8_t **serial_number, size_t *serial_number_len)
{
return x509_cert_get_details(a, alen,
NULL, // version
serial_number, serial_number_len, // serial
NULL, // signature_algor
issuer, issuer_len, // issuer
NULL, NULL, // validity
NULL, NULL, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
NULL, NULL, // extensions
NULL, // signature_algor
NULL, NULL); // signature
}
int x509_cert_get_subject_public_key(const uint8_t *a, size_t alen, X509_KEY *public_key)
{
return x509_cert_get_details(a, alen,
NULL, // version
NULL, NULL, // serial
NULL, // signature_algor
NULL, NULL, // issuer
NULL, NULL, // validity
NULL, NULL, // subject
public_key, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
NULL, NULL, // extensions
NULL, // signature_algor
NULL, NULL); // signature
}
int x509_cert_get_subject(const uint8_t *a, size_t alen, const uint8_t **d, size_t *dlen)
{
return x509_cert_get_details(a, alen,
NULL, // version
NULL, NULL, // serial
NULL, // signature_algor
NULL, NULL, // issuer
NULL, NULL, // validity
d, dlen, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
NULL, NULL, // extensions
NULL, // signature_algor
NULL, NULL); // signature
}
int x509_cert_get_issuer(const uint8_t *a, size_t alen, const uint8_t **d, size_t *dlen)
{
return x509_cert_get_details(a, alen,
NULL, // version
NULL, NULL, // serial
NULL, // signature_algor
d, dlen, // issuer
NULL, NULL, // validity
NULL, NULL, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
NULL, NULL, // extensions
NULL, // signature_algor
NULL, NULL); // signature
}
int x509_cert_get_exts(const uint8_t *a, size_t alen, const uint8_t **d, size_t *dlen)
{
if (x509_cert_get_details(a, alen,
NULL, // version
NULL, NULL, // serial
NULL, // signature_algor
NULL, NULL, // issuer
NULL, NULL, // validity
NULL, NULL, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
d, dlen, // extensions
NULL, // signature_algor
NULL, NULL // signature
) != 1) {
error_print();
return -1;
}
if (!d || !dlen) {
return 0;
}
return 1;
}
int x509_certs_to_pem(const uint8_t *d, size_t dlen, FILE *fp)
{
const uint8_t *a;
size_t alen;
while (dlen) {
if (asn1_any_from_der(&a, &alen, &d, &dlen) != 1
|| x509_cert_to_pem(a, alen, fp) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_certs_from_pem(uint8_t *d, size_t *dlen, size_t maxlen, FILE *fp)
{
int ret;
size_t len;
*dlen = 0;
for (;;) {
if ((ret = x509_cert_from_pem(d, &len, maxlen, fp)) < 0) {
error_print();
return -1;
} else if (ret == 0) {
break;
}
d += len;
*dlen += len;
maxlen -= len;
}
if (*dlen == 0) {
return 0;
}
return 1;
}
int x509_certs_get_count(const uint8_t *d, size_t dlen, size_t *cnt)
{
int ret;
ret = asn1_types_get_count(d, dlen, ASN1_TAG_SEQUENCE, cnt);
if (ret < 0) error_print();
return ret;
}
int x509_certs_get_cert_by_index(const uint8_t *d, size_t dlen, int index, const uint8_t **cert, size_t *certlen)
{
int i = 0;
if (index < 0) {
error_print();
return -1;
}
while (dlen) {
if (x509_cert_from_der(cert, certlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (i++ == index) {
return 1;
}
}
*cert = NULL;
*certlen = 0;
return 0;
}
int x509_certs_get_last(const uint8_t *d, size_t dlen, const uint8_t **cert, size_t *certlen)
{
if (dlen == 0) {
return 0;
}
while (dlen) {
if (x509_cert_from_der(cert, certlen, &d, &dlen) != 1) {
error_print();
return -1;
}
}
return 1;
}
int x509_certs_get_cert_by_subject(const uint8_t *d, size_t dlen,
const uint8_t *subject, size_t subject_len, const uint8_t **cert, size_t *certlen)
{
const uint8_t *subj;
size_t subj_len;
while (dlen) {
if (x509_cert_from_der(cert, certlen, &d, &dlen) != 1) {
error_print();
return -1;
}
if (x509_cert_get_subject(*cert, *certlen, &subj, &subj_len) != 1) {
error_print();
return -1;
}
if (x509_name_equ(subj, subj_len, subject, subject_len) == 1) {
return 1;
}
}
*cert = NULL;
*certlen = 0;
return 0;
}
int x509_certs_get_cert_by_issuer_and_serial_number(const uint8_t *d, size_t dlen,
const uint8_t *issuer, size_t issuer_len, const uint8_t *serial, size_t serial_len,
const uint8_t **cert, size_t *cert_len)
{
const uint8_t *cur_issuer;
size_t cur_issuer_len;
const uint8_t *cur_serial;
size_t cur_serial_len;
while (dlen) {
if (x509_cert_from_der(cert, cert_len, &d, &dlen) != 1
|| x509_cert_get_issuer_and_serial_number(*cert, *cert_len,
&cur_issuer, &cur_issuer_len, &cur_serial, &cur_serial_len) != 1) {
error_print();
return -1;
}
if (x509_name_equ(cur_issuer, cur_issuer_len, issuer, issuer_len) == 1
&& cur_serial_len == serial_len && memcmp(cur_serial, serial, serial_len) == 0) {
return 1;
}
}
*cert = NULL;
*cert_len = 0;
return 0;
}
int x509_cert_check(const uint8_t *cert, size_t certlen, int cert_type,
int *path_len_constraint)
{
int version;
const uint8_t *serial;
size_t serial_len;
int tbs_sig_algor;
const uint8_t *issuer;
size_t issuer_len;
time_t not_before;
time_t not_after;
time_t now;
const uint8_t *subject;
size_t subject_len;
const uint8_t *exts;
size_t extslen;
int sig_algor;
if (x509_cert_get_details(cert, certlen,
&version, // version
&serial, &serial_len, // serial
&tbs_sig_algor, // signature_algor
&issuer, &issuer_len, // issuer
&not_before, &not_after, // validity
&subject, &subject_len, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
&exts, &extslen, // extensions
&sig_algor, // signature_algor
NULL, NULL // signature
) != 1) {
error_print();
return -1;
}
if (version != X509_version_v3) {
error_print();
return -1;
}
if (!serial || !serial_len) {
error_print();
return -1;
}
if (serial_len < 4) {
error_print(); // not enough randomness
}
time(&now);
if (x509_validity_check(not_before, not_after, now, X509_VALIDITY_MAX_SECONDS) != 1) {
error_print();
return -1;
}
// check issuer and subject not empty
if (x509_name_check(issuer, issuer_len) != 1) {
error_print();
return -1;
}
if (x509_name_check(subject, subject_len) != 1) {
error_print();
return -1;
}
if (x509_exts_check(exts, extslen, cert_type, path_len_constraint) != 1) {
error_print();
return -1;
}
if (tbs_sig_algor != sig_algor) {
error_print();
return -1;
}
return 1;
}
int x509_certs_verify(const uint8_t *certs, size_t certslen, int certs_type,
const uint8_t *rootcerts, size_t rootcertslen, int depth, int *verify_result)
{
int entity_cert_type;
const uint8_t *cert;
size_t certlen;
const uint8_t *cacert;
size_t cacertlen;
const uint8_t *name;
size_t namelen;
int path_len = 0;
int path_len_constraint;
switch (certs_type) {
case X509_cert_chain_server:
entity_cert_type = X509_cert_server_auth;
break;
case X509_cert_chain_client:
entity_cert_type = X509_cert_client_auth;
break;
default:
error_print();
return -1;
}
// entity cert
if (x509_cert_from_der(&cert, &certlen, &certs, &certslen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cert, certlen, entity_cert_type, &path_len_constraint) != 1) {
error_print();
x509_cert_print(stderr, 0, 10, "Invalid Entity Certificate", cert, certlen);
return -1;
}
while (certslen) {
if (x509_cert_from_der(&cacert, &cacertlen, &certs, &certslen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cacert, cacertlen, X509_cert_ca, &path_len_constraint) != 1) {
error_print();
x509_cert_print(stderr, 0, 10, "Invalid CA Certificate", cacert, cacertlen);
return -1;
}
if (path_len == 0) {
if (path_len_constraint != 0) {
error_print();
return -1;
}
}
if ((path_len_constraint >= 0 && path_len > path_len_constraint)
|| path_len > depth) {
error_print();
return -1;
}
if (x509_cert_verify_by_ca_cert(cert, certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
cert = cacert;
certlen = cacertlen;
path_len++;
}
if (x509_cert_get_issuer(cert, certlen, &name, &namelen) != 1) {
error_print();
return -1;
}
if (x509_certs_get_cert_by_subject(rootcerts, rootcertslen, name, namelen,
&cacert, &cacertlen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cacert, cacertlen, X509_cert_ca, &path_len_constraint) != 1) {
error_print();
return -1;
}
if ((path_len_constraint >= 0 && path_len > path_len_constraint)
|| path_len > depth) {
error_print();
return -1;
}
if (x509_cert_verify_by_ca_cert(cert, certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_certs_verify_tlcp(const uint8_t *certs, size_t certslen, int certs_type,
const uint8_t *rootcerts, size_t rootcertslen, int depth, int *verify_result)
{
int sign_cert_type;
int kenc_cert_type;
const uint8_t *cert;
size_t certlen;
const uint8_t *kenc_cert;
size_t kenc_certlen;
const uint8_t *cacert;
size_t cacertlen;
const uint8_t *name;
size_t namelen;
int path_len = 0;
int path_len_constraint;
switch (certs_type) {
case X509_cert_chain_server:
sign_cert_type = X509_cert_server_auth;
kenc_cert_type = X509_cert_server_key_encipher;
break;
case X509_cert_chain_client:
sign_cert_type = X509_cert_server_auth;
kenc_cert_type = X509_cert_server_key_encipher;
break;
default:
error_print();
return -1;
}
if (x509_cert_from_der(&cert, &certlen, &certs, &certslen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cert, certlen, sign_cert_type, &path_len_constraint) != 1) {
error_print();
return -1;
}
// entity key encipherment cert
if (x509_cert_from_der(&kenc_cert, &kenc_certlen, &certs, &certslen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(kenc_cert, kenc_certlen, kenc_cert_type, &path_len_constraint) != 1) {
error_print();
return -1;
}
while (certslen) {
if (x509_cert_from_der(&cacert, &cacertlen, &certs, &certslen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cacert, cacertlen, X509_cert_ca, &path_len_constraint) != 1) {
error_print();
return -1;
}
if (path_len == 0) {
if (path_len_constraint != 0) {
error_print();
return -1;
}
// verify entity key encipherment cert
if (x509_cert_verify_by_ca_cert(kenc_cert, kenc_certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
}
if ((path_len_constraint >= 0 && path_len > path_len_constraint)
|| path_len > depth) {
error_print();
return -1;
}
if (x509_cert_verify_by_ca_cert(cert, certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
cert = cacert;
certlen = cacertlen;
path_len++;
}
if (x509_cert_get_issuer(cert, certlen, &name, &namelen) != 1) {
error_print();
return -1;
}
if (x509_certs_get_cert_by_subject(rootcerts, rootcertslen, name, namelen, &cacert, &cacertlen) != 1) {
error_print();
return -1;
}
if (x509_cert_check(cacert, cacertlen, X509_cert_ca, &path_len_constraint) != 1) {
error_print();
return -1;
}
if ((path_len_constraint >= 0 && path_len > path_len_constraint)
|| path_len > depth) {
error_print();
return -1;
}
// when no mid CA certs
if (path_len == 0) {
if (x509_cert_verify_by_ca_cert(kenc_cert, kenc_certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
}
if (x509_cert_verify_by_ca_cert(cert, certlen, cacert, cacertlen,
SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH) != 1) {
error_print();
return -1;
}
return 1;
}
int x509_certs_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen)
{
const uint8_t *p;
size_t len;
format_print(fp, fmt, ind, "%s\n", label);
ind += 4;
while (dlen) {
if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
error_print();
return -1;
}
x509_certificate_print(fp, fmt, ind, "Certficate", p, len);
}
return 1;
}
Reference in New Issue View Git Blame Copy Permalink