src/libstrongswan/asn1/asn1.c

   1 /*
   2  * Copyright (C) 2006 Martin Will
   3  * Copyright (C) 2000-2008 Andreas Steffen
   4  *
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  *
  17  * $Id$
  18  */
  19
  20 #include <stdio.h>
  21 #include <string.h>
  22 #include <time.h>
  23
  24 #include <library.h>
  25 #include <debug.h>
  26
  27 #include "oid.h"
  28 #include "asn1.h"
  29 #include "asn1_parser.h"
  30
  31 /**
  32  * some common prefabricated ASN.1 constants
  33  */
  34 static u_char ASN1_INTEGER_0_str[] = { 0x02, 0x00 };
  35 static u_char ASN1_INTEGER_1_str[] = { 0x02, 0x01, 0x01 };
  36 static u_char ASN1_INTEGER_2_str[] = { 0x02, 0x01, 0x02 };
  37
  38 const chunk_t ASN1_INTEGER_0 = chunk_from_buf(ASN1_INTEGER_0_str);
  39 const chunk_t ASN1_INTEGER_1 = chunk_from_buf(ASN1_INTEGER_1_str);
  40 const chunk_t ASN1_INTEGER_2 = chunk_from_buf(ASN1_INTEGER_2_str);
  41
  42 /**
  43  * some popular algorithmIdentifiers
  44  */
  45
  46 static u_char ASN1_md2_id_str[] = {
  47         0x30, 0x0c,
  48                   0x06, 0x08,
  49                                 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x02,
  50                   0x05,0x00,
  51 };
  52
  53 static u_char ASN1_md5_id_str[] = {
  54         0x30, 0x0C,
  55                   0x06, 0x08,
  56                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05,
  57                   0x05, 0x00
  58 };
  59
  60 static u_char ASN1_sha1_id_str[] = {
  61         0x30, 0x09,
  62                   0x06, 0x05,
  63                                 0x2B, 0x0E,0x03, 0x02, 0x1A,
  64                   0x05, 0x00
  65 };
  66
  67 static u_char ASN1_sha256_id_str[] = {
  68         0x30, 0x0d,
  69                   0x06, 0x09,
  70                                 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
  71                   0x05, 0x00
  72 };
  73
  74 static u_char ASN1_sha384_id_str[] = {
  75         0x30, 0x0d,
  76                   0x06, 0x09,
  77                                 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
  78                   0x05, 0x00
  79 };
  80
  81 static u_char ASN1_sha512_id_str[] = {
  82         0x30, 0x0d,
  83                   0x06, 0x09,
  84                                 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
  85                   0x05,0x00
  86 };
  87
  88 static u_char ASN1_md2WithRSA_id_str[] = {
  89         0x30, 0x0D,
  90                   0x06, 0x09,
  91                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x02,
  92                   0x05, 0x00
  93 };
  94
  95 static u_char ASN1_md5WithRSA_id_str[] = {
  96         0x30, 0x0D,
  97                   0x06, 0x09,
  98                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04,
  99                   0x05, 0x00
 100 };
 101
 102 static u_char ASN1_sha1WithRSA_id_str[] = {
 103         0x30, 0x0D,
 104                   0x06, 0x09,
 105                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05,
 106                   0x05, 0x00
 107 };
 108
 109 static u_char ASN1_sha256WithRSA_id_str[] = {
 110         0x30, 0x0D,
 111                   0x06, 0x09,
 112                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B,
 113                   0x05, 0x00
 114 };
 115
 116 static u_char ASN1_sha384WithRSA_id_str[] = {
 117         0x30, 0x0D,
 118                   0x06, 0x09,
 119                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C,
 120                   0x05, 0x00
 121 };
 122
 123 static u_char ASN1_sha512WithRSA_id_str[] = {
 124         0x30, 0x0D,
 125                   0x06, 0x09,
 126                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D,
 127                   0x05, 0x00
 128 };
 129
 130 static u_char ASN1_rsaEncryption_id_str[] = {
 131         0x30, 0x0D,
 132                   0x06, 0x09,
 133                                 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01,
 134                   0x05, 0x00
 135 };
 136
 137 static const chunk_t ASN1_md2_id    = chunk_from_buf(ASN1_md2_id_str);
 138 static const chunk_t ASN1_md5_id    = chunk_from_buf(ASN1_md5_id_str);
 139 static const chunk_t ASN1_sha1_id   = chunk_from_buf(ASN1_sha1_id_str);
 140 static const chunk_t ASN1_sha256_id = chunk_from_buf(ASN1_sha256_id_str);
 141 static const chunk_t ASN1_sha384_id = chunk_from_buf(ASN1_sha384_id_str);
 142 static const chunk_t ASN1_sha512_id = chunk_from_buf(ASN1_sha512_id_str);
 143 static const chunk_t ASN1_rsaEncryption_id = chunk_from_buf(ASN1_rsaEncryption_id_str);
 144 static const chunk_t ASN1_md2WithRSA_id = chunk_from_buf(ASN1_md2WithRSA_id_str);
 145 static const chunk_t ASN1_md5WithRSA_id = chunk_from_buf(ASN1_md5WithRSA_id_str);
 146 static const chunk_t ASN1_sha1WithRSA_id = chunk_from_buf(ASN1_sha1WithRSA_id_str);
 147 static const chunk_t ASN1_sha256WithRSA_id = chunk_from_buf(ASN1_sha256WithRSA_id_str);
 148 static const chunk_t ASN1_sha384WithRSA_id = chunk_from_buf(ASN1_sha384WithRSA_id_str);
 149 static const chunk_t ASN1_sha512WithRSA_id = chunk_from_buf(ASN1_sha512WithRSA_id_str);
 150
 151 /*
 152  * Defined in header.
 153  */
 154 chunk_t asn1_algorithmIdentifier(int oid)
 155 {
 156         switch (oid)
 157         {
 158                 case OID_RSA_ENCRYPTION:
 159                         return ASN1_rsaEncryption_id;
 160                 case OID_MD2_WITH_RSA:
 161                         return ASN1_md2WithRSA_id;
 162                 case OID_MD5_WITH_RSA:
 163                         return ASN1_md5WithRSA_id;
 164                 case OID_SHA1_WITH_RSA:
 165                         return ASN1_sha1WithRSA_id;
 166                 case OID_SHA256_WITH_RSA:
 167                         return ASN1_sha256WithRSA_id;
 168                 case OID_SHA384_WITH_RSA:
 169                         return ASN1_sha384WithRSA_id;
 170                 case OID_SHA512_WITH_RSA:
 171                         return ASN1_sha512WithRSA_id;
 172                 case OID_MD2:
 173                         return ASN1_md2_id;
 174                 case OID_MD5:
 175                         return ASN1_md5_id;
 176                 case OID_SHA1:
 177                         return ASN1_sha1_id;
 178                 case OID_SHA256:
 179                         return ASN1_sha256_id;
 180                 case OID_SHA384:
 181                         return ASN1_sha384_id;
 182                 case OID_SHA512:
 183                         return ASN1_sha512_id;
 184                 default:
 185                         return chunk_empty;
 186         }
 187 }
 188
 189 /*
 190  * Defined in header.
 191  */
 192 int asn1_known_oid(chunk_t object)
 193 {
 194         int oid = 0;
 195
 196         while (object.len)
 197         {
 198                 if (oid_names[oid].octet == *object.ptr)
 199                 {
 200                         if (--object.len == 0 || oid_names[oid].down == 0)
 201                         {
 202                                 return oid;          /* found terminal symbol */
 203                         }
 204                         else
 205                         {
 206                                 object.ptr++; oid++; /* advance to next hex octet */
 207                         }
 208                 }
 209                 else
 210                 {
 211                         if (oid_names[oid].next)
 212                                 oid = oid_names[oid].next;
 213                         else
 214                                 return OID_UNKNOWN;
 215                 }
 216         }
 217         return -1;
 218 }
 219
 220 /*
 221  * Defined in header.
 222  */
 223 u_int asn1_length(chunk_t *blob)
 224 {
 225         u_char n;
 226         size_t len;
 227
 228         /* advance from tag field on to length field */
 229         blob->ptr++;
 230         blob->len--;
 231
 232         /* read first octet of length field */
 233         n = *blob->ptr++;
 234         blob->len--;
 235
 236         if ((n & 0x80) == 0)
 237         {/* single length octet */
 238                 return n;
 239         }
 240
 241         /* composite length, determine number of length octets */
 242         n &= 0x7f;
 243
 244         if (n > blob->len)
 245         {
 246                 DBG2("number of length octets is larger than ASN.1 object");
 247                 return ASN1_INVALID_LENGTH;
 248         }
 249
 250         if (n > sizeof(len))
 251         {
 252                 DBG2("number of length octets is larger than limit of %d octets",
 253                          (int)sizeof(len));
 254                 return ASN1_INVALID_LENGTH;
 255         }
 256
 257         len = 0;
 258
 259         while (n-- > 0)
 260         {
 261                 len = 256*len + *blob->ptr++;
 262                 blob->len--;
 263         }
 264         return len;
 265 }
 266
 267 #define TIME_MAX        0x7fffffff
 268
 269 /**
 270  * Converts ASN.1 UTCTIME or GENERALIZEDTIME into calender time
 271  */
 272 time_t asn1_to_time(const chunk_t *utctime, asn1_t type)
 273 {
 274         struct tm t;
 275         time_t tc, tz_offset;
 276         u_char *eot = NULL;
 277
 278         if ((eot = memchr(utctime->ptr, 'Z', utctime->len)) != NULL)
 279         {
 280                 tz_offset = 0; /* Zulu time with a zero time zone offset */
 281         }
 282         else if ((eot = memchr(utctime->ptr, '+', utctime->len)) != NULL)
 283         {
 284                 int tz_hour, tz_min;
 285
 286                 sscanf(eot+1, "%2d%2d", &tz_hour, &tz_min);
 287                 tz_offset = 3600*tz_hour + 60*tz_min;  /* positive time zone offset */
 288         }
 289         else if ((eot = memchr(utctime->ptr, '-', utctime->len)) != NULL)
 290         {
 291                 int tz_hour, tz_min;
 292
 293                 sscanf(eot+1, "%2d%2d", &tz_hour, &tz_min);
 294                 tz_offset = -3600*tz_hour - 60*tz_min;  /* negative time zone offset */
 295         }
 296         else
 297         {
 298                 return 0; /* error in time format */
 299         }
 300
 301         /* parse ASN.1 time string */
 302         {
 303                 const char* format = (type == ASN1_UTCTIME)? "%2d%2d%2d%2d%2d":
 304                                                                                                          "%4d%2d%2d%2d%2d";
 305
 306                 sscanf(utctime->ptr, format, &t.tm_year, &t.tm_mon, &t.tm_mday,
 307                                                                          &t.tm_hour, &t.tm_min);
 308         }
 309
 310         /* is there a seconds field? */
 311         if ((eot - utctime->ptr) == ((type == ASN1_UTCTIME)?12:14))
 312         {
 313                 sscanf(eot-2, "%2d", &t.tm_sec);
 314         }
 315         else
 316         {
 317                 t.tm_sec = 0;
 318         }
 319
 320         /* representation of year */
 321         if (t.tm_year >= 1900)
 322         {
 323                 t.tm_year -= 1900;
 324         }
 325         else if (t.tm_year >= 100)
 326         {
 327                 return 0;
 328         }
 329         else if (t.tm_year < 50)
 330         {
 331                 t.tm_year += 100;
 332         }
 333
 334         /* representation of month 0..11*/
 335         t.tm_mon--;
 336
 337         /* set daylight saving time to off */
 338         t.tm_isdst = 0;
 339
 340         /* convert to time_t */
 341         tc = mktime(&t);
 342
 343         /* if no conversion overflow occurred, compensate timezone */
 344         return (tc == -1) ? TIME_MAX : (tc - timezone - tz_offset);
 345 }
 346
 347 /**
 348  *  Convert a date into ASN.1 UTCTIME or GENERALIZEDTIME format
 349  */
 350 chunk_t asn1_from_time(const time_t *time, asn1_t type)
 351 {
 352         int offset;
 353         const char *format;
 354         char buf[BUF_LEN];
 355         chunk_t formatted_time;
 356         struct tm t;
 357
 358         gmtime_r(time, &t);
 359         if (type == ASN1_GENERALIZEDTIME)
 360         {
 361                 format = "%04d%02d%02d%02d%02d%02dZ";
 362                 offset = 1900;
 363         }
 364         else /* ASN1_UTCTIME */
 365         {
 366                 format = "%02d%02d%02d%02d%02d%02dZ";
 367                 offset = (t.tm_year < 100)? 0 : -100;
 368         }
 369         snprintf(buf, BUF_LEN, format, t.tm_year + offset,
 370                          t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec);
 371         formatted_time.ptr = buf;
 372         formatted_time.len = strlen(buf);
 373         return asn1_simple_object(type, formatted_time);
 374 }
 375
 376 /*
 377  * Defined in header.
 378  */
 379 void asn1_debug_simple_object(chunk_t object, asn1_t type, bool private)
 380 {
 381         int oid;
 382
 383         switch (type)
 384         {
 385                 case ASN1_OID:
 386                         oid = asn1_known_oid(object);
 387                         if (oid != OID_UNKNOWN)
 388                         {
 389                                 DBG2("  '%s'", oid_names[oid].name);
 390                                 return;
 391                         }
 392                         break;
 393                 case ASN1_UTF8STRING:
 394                 case ASN1_IA5STRING:
 395                 case ASN1_PRINTABLESTRING:
 396                 case ASN1_T61STRING:
 397                 case ASN1_VISIBLESTRING:
 398                         DBG2("  '%.*s'", (int)object.len, object.ptr);
 399                         return;
 400                 case ASN1_UTCTIME:
 401                 case ASN1_GENERALIZEDTIME:
 402                         {
 403                                 time_t time = asn1_to_time(&object, type);
 404
 405                                 DBG2("  '%T'", &time, TRUE);
 406                         }
 407                         return;
 408                 default:
 409                         break;
 410         }
 411         if (private)
 412         {
 413                 DBG4("%B", &object);
 414         }
 415         else
 416         {
 417                 DBG3("%B", &object);
 418         }
 419 }
 420
 421 /**
 422  * parse an ASN.1 simple type
 423  */
 424 bool asn1_parse_simple_object(chunk_t *object, asn1_t type, u_int level, const char* name)
 425 {
 426         size_t len;
 427
 428         /* an ASN.1 object must possess at least a tag and length field */
 429         if (object->len < 2)
 430         {
 431                 DBG2("L%d - %s:  ASN.1 object smaller than 2 octets", level, name);
 432                 return FALSE;
 433         }
 434
 435         if (*object->ptr != type)
 436         {
 437                 DBG2("L%d - %s: ASN1 tag 0x%02x expected, but is 0x%02x",
 438                          level, name, type, *object->ptr);
 439                 return FALSE;
 440         }
 441
 442         len = asn1_length(object);
 443
 444         if (len == ASN1_INVALID_LENGTH || object->len < len)
 445         {
 446                 DBG2("L%d - %s:  length of ASN.1 object invalid or too large",
 447                          level, name);
 448                 return FALSE;
 449         }
 450
 451         DBG2("L%d - %s:", level, name);
 452         asn1_debug_simple_object(*object, type, FALSE);
 453         return TRUE;
 454 }
 455
 456 /**
 457  * ASN.1 definition of an algorithmIdentifier
 458  */
 459 static const asn1Object_t algorithmIdentifierObjects[] = {
 460         { 0, "algorithmIdentifier",     ASN1_SEQUENCE,  ASN1_NONE         }, /* 0 */
 461         { 1,   "algorithm",                     ASN1_OID,               ASN1_BODY         }, /* 1 */
 462         { 1,   "parameters",            ASN1_EOC,               ASN1_RAW|ASN1_OPT }, /* 2 */
 463         { 1,   "end opt",                       ASN1_EOC,               ASN1_END              }, /* 3 */
 464         { 0, "exit",                            ASN1_EOC,               ASN1_EXIT         }
 465 };
 466 #define ALGORITHM_ID_ALG                        1
 467 #define ALGORITHM_ID_PARAMETERS         2
 468
 469 /*
 470  * Defined in header
 471  */
 472 int asn1_parse_algorithmIdentifier(chunk_t blob, int level0, chunk_t *parameters)
 473 {
 474         asn1_parser_t *parser;
 475         chunk_t object;
 476         int objectID;
 477         int alg = OID_UNKNOWN;
 478
 479         parser = asn1_parser_create(algorithmIdentifierObjects, blob);
 480         parser->set_top_level(parser, level0);
 481
 482         while (parser->iterate(parser, &objectID, &object))
 483         {
 484                 switch (objectID)
 485                 {
 486                         case ALGORITHM_ID_ALG:
 487                                 alg = asn1_known_oid(object);
 488                                 break;
 489                         case ALGORITHM_ID_PARAMETERS:
 490                                 if (parameters != NULL)
 491                                 {
 492                                         *parameters = object;
 493                                 }
 494                                 break;
 495                         default:
 496                                 break;
 497                 }
 498         }
 499         parser->destroy(parser);
 500         return alg;
 501 }
 502
 503 /*
 504  *  tests if a blob contains a valid ASN.1 set or sequence
 505  */
 506 bool is_asn1(chunk_t blob)
 507 {
 508         u_int len;
 509         u_char tag = *blob.ptr;
 510
 511         if (tag != ASN1_SEQUENCE && tag != ASN1_SET)
 512         {
 513                 DBG2("  file content is not binary ASN.1");
 514                 return FALSE;
 515         }
 516
 517         len = asn1_length(&blob);
 518
 519         /* exact match */
 520         if (len == blob.len)
 521         {
 522                 return TRUE;
 523         }
 524
 525         /* some websites append a surplus newline character to the blob */
 526         if (len + 1 == blob.len && *(blob.ptr + len) == '\n')
 527         {
 528                 return TRUE;
 529         }
 530
 531         DBG2("  file size does not match ASN.1 coded length");
 532         return FALSE;
 533 }
 534
 535 /*
 536  * Defined in header.
 537  */
 538 bool asn1_is_printablestring(chunk_t str)
 539 {
 540         const char printablestring_charset[] =
 541                 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 '()+,-./:=?";
 542         u_int i;
 543
 544         for (i = 0; i < str.len; i++)
 545         {
 546                 if (strchr(printablestring_charset, str.ptr[i]) == NULL)
 547                         return FALSE;
 548         }
 549         return TRUE;
 550 }
 551
 552 /**
 553  * codes ASN.1 lengths up to a size of 16'777'215 bytes
 554  */
 555 static void asn1_code_length(size_t length, chunk_t *code)
 556 {
 557         if (length < 128)
 558         {
 559                 code->ptr[0] = length;
 560                 code->len = 1;
 561         }
 562         else if (length < 256)
 563         {
 564                 code->ptr[0] = 0x81;
 565                 code->ptr[1] = (u_char) length;
 566                 code->len = 2;
 567         }
 568         else if (length < 65536)
 569         {
 570                 code->ptr[0] = 0x82;
 571                 code->ptr[1] = length >> 8;
 572                 code->ptr[2] = length & 0x00ff;
 573                 code->len = 3;
 574         }
 575         else
 576         {
 577                 code->ptr[0] = 0x83;
 578                 code->ptr[1] = length >> 16;
 579                 code->ptr[2] = (length >> 8) & 0x00ff;
 580                 code->ptr[3] = length & 0x0000ff;
 581                 code->len = 4;
 582         }
 583 }
 584
 585 /**
 586  * build an empty asn.1 object with tag and length fields already filled in
 587  */
 588 u_char* asn1_build_object(chunk_t *object, asn1_t type, size_t datalen)
 589 {
 590         u_char length_buf[4];
 591         chunk_t length = { length_buf, 0 };
 592         u_char *pos;
 593
 594         /* code the asn.1 length field */
 595         asn1_code_length(datalen, &length);
 596
 597         /* allocate memory for the asn.1 TLV object */
 598         object->len = 1 + length.len + datalen;
 599         object->ptr = malloc(object->len);
 600
 601         /* set position pointer at the start of the object */
 602         pos = object->ptr;
 603
 604         /* copy the asn.1 tag field and advance the pointer */
 605         *pos++ = type;
 606
 607         /* copy the asn.1 length field and advance the pointer */
 608         memcpy(pos, length.ptr, length.len);
 609         pos += length.len;
 610
 611         return pos;
 612 }
 613
 614 /**
 615  * Build a simple ASN.1 object
 616  */
 617 chunk_t asn1_simple_object(asn1_t tag, chunk_t content)
 618 {
 619         chunk_t object;
 620
 621         u_char *pos = asn1_build_object(&object, tag, content.len);
 622         memcpy(pos, content.ptr, content.len);
 623         pos += content.len;
 624
 625         return object;
 626 }
 627
 628 /**
 629  * Build an ASN.1 BITSTRING object
 630  */
 631 chunk_t asn1_bitstring(const char *mode, chunk_t content)
 632 {
 633         chunk_t object;
 634         u_char *pos = asn1_build_object(&object, ASN1_BIT_STRING, 1 + content.len);
 635
 636         *pos++ = 0x00;
 637         memcpy(pos, content.ptr, content.len);
 638         if (*mode == 'm')
 639         {
 640                 free(content.ptr);
 641         }
 642         return object;
 643 }
 644
 645 /**
 646  * Build an ASN.1 object from a variable number of individual chunks.
 647  * Depending on the mode, chunks either are moved ('m') or copied ('c').
 648  */
 649 chunk_t asn1_wrap(asn1_t type, const char *mode, ...)
 650 {
 651         chunk_t construct;
 652         va_list chunks;
 653         u_char *pos;
 654         int i;
 655         int count = strlen(mode);
 656
 657         /* sum up lengths of individual chunks */
 658         va_start(chunks, mode);
 659         construct.len = 0;
 660         for (i = 0; i < count; i++)
 661         {
 662                 chunk_t ch = va_arg(chunks, chunk_t);
 663                 construct.len += ch.len;
 664         }
 665         va_end(chunks);
 666
 667         /* allocate needed memory for construct */
 668         pos = asn1_build_object(&construct, type, construct.len);
 669
 670         /* copy or move the chunks */
 671         va_start(chunks, mode);
 672         for (i = 0; i < count; i++)
 673         {
 674                 chunk_t ch = va_arg(chunks, chunk_t);
 675
 676                 memcpy(pos, ch.ptr, ch.len);
 677                 pos += ch.len;
 678
 679                 if (*mode++ == 'm')
 680                 {
 681                         free(ch.ptr);
 682                 }
 683         }
 684         va_end(chunks);
 685
 686         return construct;
 687 }
 688
 689 /**
 690  * ASN.1 definition of time
 691  */
 692 static const asn1Object_t timeObjects[] = {
 693         { 0, "utcTime",                 ASN1_UTCTIME,                   ASN1_OPT|ASN1_BODY      }, /* 0 */
 694         { 0, "end opt",                 ASN1_EOC,                               ASN1_END                        }, /* 1 */
 695         { 0, "generalizeTime",  ASN1_GENERALIZEDTIME,   ASN1_OPT|ASN1_BODY      }, /* 2 */
 696         { 0, "end opt",                 ASN1_EOC,                               ASN1_END                        }, /* 3 */
 697         { 0, "exit",                    ASN1_EOC,                               ASN1_EXIT                       }
 698 };
 699 #define TIME_UTC                        0
 700 #define TIME_GENERALIZED        2
 701
 702 /**
 703  * extracts and converts a UTCTIME or GENERALIZEDTIME object
 704  */
 705 time_t asn1_parse_time(chunk_t blob, int level0)
 706 {
 707         asn1_parser_t *parser;
 708         chunk_t object;
 709         int objectID;
 710         time_t utc_time = 0;
 711
 712         parser= asn1_parser_create(timeObjects, blob);
 713         parser->set_top_level(parser, level0);
 714
 715         while (parser->iterate(parser, &objectID, &object))
 716         {
 717                 if (objectID == TIME_UTC || objectID == TIME_GENERALIZED)
 718                 {
 719                         utc_time = asn1_to_time(&object, (objectID == TIME_UTC)
 720                                                                         ? ASN1_UTCTIME : ASN1_GENERALIZEDTIME);
 721                 }
 722         }
 723         parser->destroy(parser);
 724         return utc_time;
 725 }