1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
|
/*
* Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
* Author: Nikos Mavrogiannopoulos, Simon Josefsson, Howard Chu
*
* This file is part of GNUTLS.
*
* The GNUTLS library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
* USA
*
*/
/* Functions on X.509 Certificate parsing
*/
#include <gnutls_int.h>
#include <gnutls_datum.h>
#include <gnutls_global.h>
#include <gnutls_errors.h>
#include <common.h>
#include <gnutls_x509.h>
#include <x509_b64.h>
#include <x509.h>
#include <extensions.h>
#include <libtasn1.h>
#include <mpi.h>
#include <privkey.h>
/**
* MHD_gnutls_x509_crt_init - This function initializes a MHD_gnutls_x509_crt_t structure
* @cert: The structure to be initialized
*
* This function will initialize an X.509 certificate structure.
*
* Returns 0 on success.
*
**/
int
MHD_gnutls_x509_crt_init (MHD_gnutls_x509_crt_t * cert)
{
MHD_gnutls_x509_crt_t tmp =
MHD_gnutls_calloc (1, sizeof (MHD_gnutls_x509_crt_int));
int result;
if (!tmp)
return GNUTLS_E_MEMORY_ERROR;
result = MHD__asn1_create_element (MHD__gnutls_get_pkix (),
"PKIX1.Certificate", &tmp->cert);
if (result != ASN1_SUCCESS)
{
MHD_gnutls_assert ();
MHD_gnutls_free (tmp);
return MHD_gtls_asn2err (result);
}
*cert = tmp;
return 0; /* success */
}
/**
* MHD_gnutls_x509_crt_deinit - This function deinitializes memory used by a MHD_gnutls_x509_crt_t structure
* @cert: The structure to be initialized
*
* This function will deinitialize a CRL structure.
*
**/
void
MHD_gnutls_x509_crt_deinit (MHD_gnutls_x509_crt_t cert)
{
if (!cert)
return;
if (cert->cert)
MHD__asn1_delete_structure (&cert->cert);
MHD_gnutls_free (cert);
}
/**
* MHD_gnutls_x509_crt_import - This function will import a DER or PEM encoded Certificate
* @cert: The structure to store the parsed certificate.
* @data: The DER or PEM encoded certificate.
* @format: One of DER or PEM
*
* This function will convert the given DER or PEM encoded Certificate
* to the native MHD_gnutls_x509_crt_t format. The output will be stored in @cert.
*
* If the Certificate is PEM encoded it should have a header of "X509 CERTIFICATE", or
* "CERTIFICATE".
*
* Returns 0 on success.
*
**/
int
MHD_gnutls_x509_crt_import (MHD_gnutls_x509_crt_t cert,
const MHD_gnutls_datum_t * data,
MHD_gnutls_x509_crt_fmt_t format)
{
int result = 0, need_free = 0;
MHD_gnutls_datum_t _data;
opaque *signature = NULL;
if (cert == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_INVALID_REQUEST;
}
_data.data = data->data;
_data.size = data->size;
/* If the Certificate is in PEM format then decode it
*/
if (format == GNUTLS_X509_FMT_PEM)
{
opaque *out;
/* Try the first header */
result =
MHD__gnutls_fbase64_decode (PEM_X509_CERT2, data->data, data->size,
&out);
if (result <= 0)
{
/* try for the second header */
result = MHD__gnutls_fbase64_decode (PEM_X509_CERT, data->data,
data->size, &out);
if (result <= 0)
{
if (result == 0)
result = GNUTLS_E_INTERNAL_ERROR;
MHD_gnutls_assert ();
return result;
}
}
_data.data = out;
_data.size = result;
need_free = 1;
}
result = MHD__asn1_der_decoding (&cert->cert, _data.data, _data.size, NULL);
if (result != ASN1_SUCCESS)
{
result = MHD_gtls_asn2err (result);
MHD_gnutls_assert ();
goto cleanup;
}
/* Since we do not want to disable any extension
*/
cert->use_extensions = 1;
if (need_free)
MHD__gnutls_free_datum (&_data);
return 0;
cleanup:MHD_gnutls_free (signature);
if (need_free)
MHD__gnutls_free_datum (&_data);
return result;
}
/**
* MHD_gnutls_x509_crt_get_version - This function returns the Certificate's version number
* @cert: should contain a MHD_gnutls_x509_crt_t structure
*
* This function will return the version of the specified Certificate.
*
* Returns a negative value on error.
*
**/
int
MHD_gnutls_x509_crt_get_version (MHD_gnutls_x509_crt_t cert)
{
opaque version[5];
int len, result;
if (cert == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_INVALID_REQUEST;
}
len = sizeof (version);
if ((result =
MHD__asn1_read_value (cert->cert, "tbsCertificate.version", version,
&len)) != ASN1_SUCCESS)
{
if (result == ASN1_ELEMENT_NOT_FOUND)
return 1; /* the DEFAULT version */
MHD_gnutls_assert ();
return MHD_gtls_asn2err (result);
}
return (int) version[0] + 1;
}
/**
* MHD_gnutls_x509_crt_get_pk_algorithm - This function returns the certificate's PublicKey algorithm
* @cert: should contain a MHD_gnutls_x509_crt_t structure
* @bits: if bits is non null it will hold the size of the parameters' in bits
*
* This function will return the public key algorithm of an X.509
* certificate.
*
* If bits is non null, it should have enough size to hold the parameters
* size in bits. For RSA the bits returned is the modulus.
* For DSA the bits returned are of the public
* exponent.
*
* Returns a member of the enum MHD_GNUTLS_PublicKeyAlgorithm enumeration on success,
* or a negative value on error.
*
**/
int
MHD_gnutls_x509_crt_get_pk_algorithm (MHD_gnutls_x509_crt_t cert,
unsigned int *bits)
{
int result;
if (cert == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_INVALID_REQUEST;
}
result = MHD__gnutls_x509_get_pk_algorithm (cert->cert,
"tbsCertificate.subjectPublicKeyInfo",
bits);
if (result < 0)
{
MHD_gnutls_assert ();
return result;
}
return result;
}
inline static int
is_type_printable (int type)
{
if (type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME || type
== GNUTLS_SAN_URI)
return 1;
else
return 0;
}
/**
* MHD_gnutls_x509_crt_get_key_usage - This function returns the certificate's key usage
* @cert: should contain a MHD_gnutls_x509_crt_t structure
* @key_usage: where the key usage bits will be stored
* @critical: will be non zero if the extension is marked as critical
*
* This function will return certificate's key usage, by reading the
* keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the:
* GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION,
* GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT,
* GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN,
* GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY,
* GNUTLS_KEY_DECIPHER_ONLY.
*
* A negative value may be returned in case of parsing error.
* If the certificate does not contain the keyUsage extension
* GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
*
**/
int
MHD_gnutls_x509_crt_get_key_usage (MHD_gnutls_x509_crt_t cert,
unsigned int *key_usage,
unsigned int *critical)
{
int result;
MHD_gnutls_datum_t keyUsage;
uint16_t _usage;
if (cert == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_INVALID_REQUEST;
}
if ((result =
MHD__gnutls_x509_crt_get_extension (cert, "2.5.29.15", 0, &keyUsage,
critical)) < 0)
{
return result;
}
if (keyUsage.size == 0 || keyUsage.data == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
}
result = MHD__gnutls_x509_ext_extract_keyUsage (&_usage, keyUsage.data,
keyUsage.size);
MHD__gnutls_free_datum (&keyUsage);
*key_usage = _usage;
if (result < 0)
{
MHD_gnutls_assert ();
return result;
}
return 0;
}
static int
MHD__gnutls_x509_crt_get_raw_dn2 (MHD_gnutls_x509_crt_t cert,
const char *whom,
MHD_gnutls_datum_t * start)
{
ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
int result, len1;
int start1, end1;
MHD_gnutls_datum_t signed_data = { NULL,
0
};
/* get the issuer of 'cert'
*/
if ((result =
MHD__asn1_create_element (MHD__gnutls_get_pkix (),
"PKIX1.TBSCertificate",
&c2)) != ASN1_SUCCESS)
{
MHD_gnutls_assert ();
return MHD_gtls_asn2err (result);
}
result = MHD__gnutls_x509_get_signed_data (cert->cert, "tbsCertificate",
&signed_data);
if (result < 0)
{
MHD_gnutls_assert ();
goto cleanup;
}
result =
MHD__asn1_der_decoding (&c2, signed_data.data, signed_data.size, NULL);
if (result != ASN1_SUCCESS)
{
MHD_gnutls_assert ();
MHD__asn1_delete_structure (&c2);
result = MHD_gtls_asn2err (result);
goto cleanup;
}
result =
MHD__asn1_der_decoding_startEnd (c2, signed_data.data, signed_data.size,
whom, &start1, &end1);
if (result != ASN1_SUCCESS)
{
MHD_gnutls_assert ();
result = MHD_gtls_asn2err (result);
goto cleanup;
}
len1 = end1 - start1 + 1;
MHD__gnutls_set_datum (start, &signed_data.data[start1], len1);
result = 0;
cleanup:MHD__asn1_delete_structure (&c2);
MHD__gnutls_free_datum (&signed_data);
return result;
}
/**
* MHD_gnutls_x509_crt_get_raw_dn - This function returns the subject's DN DER encoded
* @cert: should contain a MHD_gnutls_x509_crt_t structure
* @start: will hold the starting point of the DN
*
* This function will return a pointer to the DER encoded DN structure and
* the length.
*
* Returns 0 on success, or a negative value on error.
*
**/
int
MHD_gnutls_x509_crt_get_raw_dn (MHD_gnutls_x509_crt_t cert,
MHD_gnutls_datum_t * start)
{
return MHD__gnutls_x509_crt_get_raw_dn2 (cert, "subject", start);
}
/**
* MHD_gnutls_x509_crt_export - This function will export the certificate
* @cert: Holds the certificate
* @format: the format of output params. One of PEM or DER.
* @output_data: will contain a certificate PEM or DER encoded
* @output_data_size: holds the size of output_data (and will be
* replaced by the actual size of parameters)
*
* This function will export the certificate to DER or PEM format.
*
* If the buffer provided is not long enough to hold the output, then
* *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
* be returned.
*
* If the structure is PEM encoded, it will have a header
* of "BEGIN CERTIFICATE".
*
* Return value: In case of failure a negative value will be
* returned, and 0 on success.
**/
int
MHD_gnutls_x509_crt_export (MHD_gnutls_x509_crt_t cert,
MHD_gnutls_x509_crt_fmt_t format,
void *output_data, size_t * output_data_size)
{
if (cert == NULL)
{
MHD_gnutls_assert ();
return GNUTLS_E_INVALID_REQUEST;
}
return MHD__gnutls_x509_export_int (cert->cert, format, "CERTIFICATE",
output_data, output_data_size);
}
|