Added certificatePolicy support to x509 plugin
[strongswan.git] / src / libstrongswan / plugins / openssl / openssl_x509.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 /*
17 * Copyright (C) 2010 secunet Security Networks AG
18 * Copyright (C) 2010 Thomas Egerer
19 *
20 * Permission is hereby granted, free of charge, to any person obtaining a copy
21 * of this software and associated documentation files (the "Software"), to deal
22 * in the Software without restriction, including without limitation the rights
23 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
24 * copies of the Software, and to permit persons to whom the Software is
25 * furnished to do so, subject to the following conditions:
26 *
27 * The above copyright notice and this permission notice shall be included in
28 * all copies or substantial portions of the Software.
29 *
30 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
36 * THE SOFTWARE.
37 */
38
39 #define _GNU_SOURCE
40 #include <stdio.h>
41 #include <openssl/x509.h>
42 #include <openssl/x509v3.h>
43
44 #include "openssl_x509.h"
45 #include "openssl_util.h"
46
47 #include <debug.h>
48 #include <asn1/oid.h>
49 #include <utils/linked_list.h>
50
51
52 typedef struct private_openssl_x509_t private_openssl_x509_t;
53
54 /**
55 * Private data of an openssl_x509_t object.
56 */
57 struct private_openssl_x509_t {
58
59 /**
60 * Public openssl_x509_t interface.
61 */
62 openssl_x509_t public;
63
64 /**
65 * OpenSSL certificate representation
66 */
67 X509 *x509;
68
69 /**
70 * DER encoded certificate
71 */
72 chunk_t encoding;
73
74 /**
75 * SHA1 hash of the certificate
76 */
77 chunk_t hash;
78
79 /**
80 * X509 flags
81 */
82 x509_flag_t flags;
83
84 /**
85 * Pathlen constraint
86 */
87 int pathlen;
88
89 /**
90 * certificate subject
91 */
92 identification_t *subject;
93
94 /**
95 * certificate issuer
96 */
97 identification_t *issuer;
98
99 /**
100 * Certificates public key
101 */
102 public_key_t *pubkey;
103
104 /**
105 * subjectKeyIdentifier as read from cert
106 */
107 chunk_t subjectKeyIdentifier;
108
109 /**
110 * authorityKeyIdentifier as read from cert
111 */
112 chunk_t authKeyIdentifier;
113
114 /**
115 * Start time of certificate validity
116 */
117 time_t notBefore;
118
119 /**
120 * End time of certificate validity
121 */
122 time_t notAfter;
123
124 /**
125 * Signature scheme of the certificate
126 */
127 signature_scheme_t scheme;
128
129 /**
130 * subjectAltNames
131 */
132 linked_list_t *subjectAltNames;
133
134 /**
135 * issuerAltNames
136 */
137 linked_list_t *issuerAltNames;
138
139 /**
140 * List of CRL URIs, as crl_uri_t
141 */
142 linked_list_t *crl_uris;
143
144 /**
145 * List of OCSP URIs
146 */
147 linked_list_t *ocsp_uris;
148
149 /**
150 * References to this cert
151 */
152 refcount_t ref;
153 };
154
155 /**
156 * CRL URIs with associated issuer
157 */
158 typedef struct {
159 identification_t *issuer;
160 linked_list_t *uris;
161 } crl_uri_t;
162
163 /**
164 * Create a new issuer entry
165 */
166 static crl_uri_t *crl_uri_create()
167 {
168 crl_uri_t *this;
169
170 INIT(this,
171 .uris = linked_list_create(),
172 );
173 return this;
174 }
175
176 /**
177 * Destroy a CRL URI struct
178 */
179 static void crl_uri_destroy(crl_uri_t *this)
180 {
181 this->uris->destroy_function(this->uris, free);
182 DESTROY_IF(this->issuer);
183 free(this);
184 }
185
186 /**
187 * Convert a GeneralName to an identification_t.
188 */
189 static identification_t *general_name2id(GENERAL_NAME *name)
190 {
191 if (!name)
192 {
193 return NULL;
194 }
195 switch (name->type)
196 {
197 case GEN_EMAIL:
198 return identification_create_from_encoding(ID_RFC822_ADDR,
199 openssl_asn1_str2chunk(name->d.rfc822Name));
200 case GEN_DNS:
201 return identification_create_from_encoding(ID_FQDN,
202 openssl_asn1_str2chunk(name->d.dNSName));
203 case GEN_URI:
204 return identification_create_from_encoding(ID_DER_ASN1_GN_URI,
205 openssl_asn1_str2chunk(name->d.uniformResourceIdentifier));
206 case GEN_IPADD:
207 {
208 chunk_t chunk = openssl_asn1_str2chunk(name->d.iPAddress);
209 if (chunk.len == 4)
210 {
211 return identification_create_from_encoding(ID_IPV4_ADDR, chunk);
212 }
213 if (chunk.len == 16)
214 {
215 return identification_create_from_encoding(ID_IPV6_ADDR, chunk);
216 }
217 return NULL;
218 }
219 case GEN_DIRNAME :
220 return openssl_x509_name2id(name->d.directoryName);
221 case GEN_OTHERNAME:
222 if (OBJ_obj2nid(name->d.otherName->type_id) == NID_ms_upn &&
223 name->d.otherName->value->type == V_ASN1_UTF8STRING)
224 {
225 return identification_create_from_encoding(ID_RFC822_ADDR,
226 openssl_asn1_str2chunk(
227 name->d.otherName->value->value.utf8string));
228 }
229 return NULL;
230 default:
231 return NULL;
232 }
233 }
234
235 METHOD(x509_t, get_flags, x509_flag_t,
236 private_openssl_x509_t *this)
237 {
238 return this->flags;
239 }
240
241 METHOD(x509_t, get_serial, chunk_t,
242 private_openssl_x509_t *this)
243 {
244 return openssl_asn1_str2chunk(X509_get_serialNumber(this->x509));
245 }
246
247 METHOD(x509_t, get_subjectKeyIdentifier, chunk_t,
248 private_openssl_x509_t *this)
249 {
250 chunk_t fingerprint;
251
252 if (this->subjectKeyIdentifier.len)
253 {
254 return this->subjectKeyIdentifier;
255 }
256 if (this->pubkey->get_fingerprint(this->pubkey, KEYID_PUBKEY_SHA1,
257 &fingerprint))
258 {
259 return fingerprint;
260 }
261 return chunk_empty;
262 }
263
264 METHOD(x509_t, get_authKeyIdentifier, chunk_t,
265 private_openssl_x509_t *this)
266 {
267 if (this->authKeyIdentifier.len)
268 {
269 return this->authKeyIdentifier;
270 }
271 return chunk_empty;
272 }
273
274 METHOD(x509_t, get_pathLenConstraint, int,
275 private_openssl_x509_t *this)
276 {
277 return this->pathlen;
278 }
279
280 METHOD(x509_t, create_subjectAltName_enumerator, enumerator_t*,
281 private_openssl_x509_t *this)
282 {
283 return this->subjectAltNames->create_enumerator(this->subjectAltNames);
284 }
285
286 /**
287 * Convert enumerator value from entry to (uri, issuer)
288 */
289 static bool crl_enum_filter(identification_t *issuer_in,
290 char **uri_in, char **uri_out,
291 void *none_in, identification_t **issuer_out)
292 {
293 *uri_out = *uri_in;
294 if (issuer_out)
295 {
296 *issuer_out = issuer_in;
297 }
298 return TRUE;
299 }
300
301 /**
302 * Create inner enumerator over URIs
303 */
304 static enumerator_t *crl_enum_create(crl_uri_t *entry)
305 {
306 return enumerator_create_filter(entry->uris->create_enumerator(entry->uris),
307 (void*)crl_enum_filter, entry->issuer, NULL);
308 }
309
310 METHOD(x509_t, create_crl_uri_enumerator, enumerator_t*,
311 private_openssl_x509_t *this)
312 {
313 return enumerator_create_nested(
314 this->crl_uris->create_enumerator(this->crl_uris),
315 (void*)crl_enum_create, NULL, NULL);
316 }
317
318 METHOD(x509_t, create_ocsp_uri_enumerator, enumerator_t*,
319 private_openssl_x509_t *this)
320 {
321 return this->ocsp_uris->create_enumerator(this->ocsp_uris);
322 }
323
324 METHOD(certificate_t, get_type, certificate_type_t,
325 private_openssl_x509_t *this)
326 {
327 return CERT_X509;
328 }
329
330 METHOD(certificate_t, get_subject, identification_t*,
331 private_openssl_x509_t *this)
332 {
333 return this->subject;
334 }
335
336 METHOD(certificate_t, get_issuer, identification_t*,
337 private_openssl_x509_t *this)
338 {
339 return this->issuer;
340 }
341
342 METHOD(certificate_t, has_subject, id_match_t,
343 private_openssl_x509_t *this, identification_t *subject)
344 {
345 identification_t *current;
346 enumerator_t *enumerator;
347 id_match_t match, best;
348 chunk_t encoding;
349
350 if (subject->get_type(subject) == ID_KEY_ID)
351 {
352 encoding = subject->get_encoding(subject);
353
354 if (chunk_equals(this->hash, encoding))
355 {
356 return ID_MATCH_PERFECT;
357 }
358 if (this->subjectKeyIdentifier.len &&
359 chunk_equals(this->subjectKeyIdentifier, encoding))
360 {
361 return ID_MATCH_PERFECT;
362 }
363 if (this->pubkey &&
364 this->pubkey->has_fingerprint(this->pubkey, encoding))
365 {
366 return ID_MATCH_PERFECT;
367 }
368 }
369 best = this->subject->matches(this->subject, subject);
370 enumerator = create_subjectAltName_enumerator(this);
371 while (enumerator->enumerate(enumerator, &current))
372 {
373 match = current->matches(current, subject);
374 if (match > best)
375 {
376 best = match;
377 }
378 }
379 enumerator->destroy(enumerator);
380 return best;
381 }
382
383 METHOD(certificate_t, has_issuer, id_match_t,
384 private_openssl_x509_t *this, identification_t *issuer)
385 {
386 /* issuerAltNames currently not supported */
387 return this->issuer->matches(this->issuer, issuer);
388 }
389
390 METHOD(certificate_t, issued_by, bool,
391 private_openssl_x509_t *this, certificate_t *issuer)
392 {
393 public_key_t *key;
394 bool valid;
395 x509_t *x509 = (x509_t*)issuer;
396 chunk_t tbs;
397
398 if (&this->public.x509.interface == issuer)
399 {
400 if (this->flags & X509_SELF_SIGNED)
401 {
402 return TRUE;
403 }
404 }
405 else
406 {
407 if (issuer->get_type(issuer) != CERT_X509)
408 {
409 return FALSE;
410 }
411 if (!(x509->get_flags(x509) & X509_CA))
412 {
413 return FALSE;
414 }
415 if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
416 {
417 return FALSE;
418 }
419 }
420 if (this->scheme == SIGN_UNKNOWN)
421 {
422 return FALSE;
423 }
424 key = issuer->get_public_key(issuer);
425 if (!key)
426 {
427 return FALSE;
428 }
429 tbs = openssl_i2chunk(X509_CINF, this->x509->cert_info);
430 valid = key->verify(key, this->scheme, tbs,
431 openssl_asn1_str2chunk(this->x509->signature));
432 free(tbs.ptr);
433 key->destroy(key);
434 return valid;
435 }
436
437 METHOD(certificate_t, get_public_key, public_key_t*,
438 private_openssl_x509_t *this)
439 {
440 return this->pubkey->get_ref(this->pubkey);
441 }
442
443 METHOD(certificate_t, get_validity, bool,
444 private_openssl_x509_t *this,
445 time_t *when, time_t *not_before, time_t *not_after)
446 {
447 time_t t;
448
449 if (when)
450 {
451 t = *when;
452 }
453 else
454 {
455 t = time(NULL);
456 }
457 if (not_before)
458 {
459 *not_before = this->notBefore;
460 }
461 if (not_after)
462 {
463 *not_after = this->notAfter;
464 }
465 return (t >= this->notBefore && t <= this->notAfter);
466 }
467
468 METHOD(certificate_t, get_encoding, bool,
469 private_openssl_x509_t *this, cred_encoding_type_t type, chunk_t *encoding)
470 {
471 if (type == CERT_ASN1_DER)
472 {
473 *encoding = chunk_clone(this->encoding);
474 return TRUE;
475 }
476 return lib->encoding->encode(lib->encoding, type, NULL, encoding,
477 CRED_PART_X509_ASN1_DER, this->encoding, CRED_PART_END);
478 }
479
480
481 METHOD(certificate_t, equals, bool,
482 private_openssl_x509_t *this, certificate_t *other)
483 {
484 chunk_t encoding;
485 bool equal;
486
487 if (this == (private_openssl_x509_t*)other)
488 {
489 return TRUE;
490 }
491 if (other->get_type(other) != CERT_X509)
492 {
493 return FALSE;
494 }
495 if (other->equals == (void*)equals)
496 { /* skip allocation if we have the same implementation */
497 encoding = ((private_openssl_x509_t*)other)->encoding;
498 return chunk_equals(this->encoding, encoding);
499 }
500 if (!other->get_encoding(other, CERT_ASN1_DER, &encoding))
501 {
502 return FALSE;
503 }
504 equal = chunk_equals(this->encoding, encoding);
505 free(encoding.ptr);
506 return equal;
507 }
508
509 METHOD(certificate_t, get_ref, certificate_t*,
510 private_openssl_x509_t *this)
511 {
512 ref_get(&this->ref);
513 return &this->public.x509.interface;
514 }
515
516 METHOD(certificate_t, destroy, void,
517 private_openssl_x509_t *this)
518 {
519 if (ref_put(&this->ref))
520 {
521 if (this->x509)
522 {
523 X509_free(this->x509);
524 }
525 DESTROY_IF(this->subject);
526 DESTROY_IF(this->issuer);
527 DESTROY_IF(this->pubkey);
528 free(this->subjectKeyIdentifier.ptr);
529 free(this->authKeyIdentifier.ptr);
530 free(this->encoding.ptr);
531 free(this->hash.ptr);
532 this->subjectAltNames->destroy_offset(this->subjectAltNames,
533 offsetof(identification_t, destroy));
534 this->issuerAltNames->destroy_offset(this->issuerAltNames,
535 offsetof(identification_t, destroy));
536 this->crl_uris->destroy_function(this->crl_uris, (void*)crl_uri_destroy);
537 this->ocsp_uris->destroy_function(this->ocsp_uris, free);
538 free(this);
539 }
540 }
541
542 /**
543 * Create an empty certificate
544 */
545 static private_openssl_x509_t *create_empty()
546 {
547 private_openssl_x509_t *this;
548
549 INIT(this,
550 .public = {
551 .x509 = {
552 .interface = {
553 .get_type = _get_type,
554 .get_subject = _get_subject,
555 .get_issuer = _get_issuer,
556 .has_subject = _has_subject,
557 .has_issuer = _has_issuer,
558 .issued_by = _issued_by,
559 .get_public_key = _get_public_key,
560 .get_validity = _get_validity,
561 .get_encoding = _get_encoding,
562 .equals = _equals,
563 .get_ref = _get_ref,
564 .destroy = _destroy,
565 },
566 .get_flags = _get_flags,
567 .get_serial = _get_serial,
568 .get_subjectKeyIdentifier = _get_subjectKeyIdentifier,
569 .get_authKeyIdentifier = _get_authKeyIdentifier,
570 .get_pathLenConstraint = _get_pathLenConstraint,
571 .create_subjectAltName_enumerator = _create_subjectAltName_enumerator,
572 .create_crl_uri_enumerator = _create_crl_uri_enumerator,
573 .create_ocsp_uri_enumerator = _create_ocsp_uri_enumerator,
574 .create_ipAddrBlock_enumerator = (void*)enumerator_create_empty,
575 .create_name_constraint_enumerator = (void*)enumerator_create_empty,
576 .create_cert_policy_enumerator = (void*)enumerator_create_empty,
577 },
578 },
579 .subjectAltNames = linked_list_create(),
580 .issuerAltNames = linked_list_create(),
581 .crl_uris = linked_list_create(),
582 .ocsp_uris = linked_list_create(),
583 .pathlen = X509_NO_PATH_LEN_CONSTRAINT,
584 .ref = 1,
585 );
586
587 return this;
588 }
589
590 /**
591 * parse an extionsion containing GENERAL_NAMES into a list
592 */
593 static bool parse_generalNames_ext(linked_list_t *list,
594 X509_EXTENSION *ext)
595 {
596 GENERAL_NAMES *names;
597 GENERAL_NAME *name;
598 identification_t *id;
599 int i, num;
600
601 names = X509V3_EXT_d2i(ext);
602 if (!names)
603 {
604 return FALSE;
605 }
606
607 num = sk_GENERAL_NAME_num(names);
608 for (i = 0; i < num; i++)
609 {
610 name = sk_GENERAL_NAME_value(names, i);
611 id = general_name2id(name);
612 if (id)
613 {
614 list->insert_last(list, id);
615 }
616 GENERAL_NAME_free(name);
617 }
618 sk_GENERAL_NAME_free(names);
619 return TRUE;
620 }
621
622 /**
623 * parse basic constraints
624 */
625 static bool parse_basicConstraints_ext(private_openssl_x509_t *this,
626 X509_EXTENSION *ext)
627 {
628 BASIC_CONSTRAINTS *constraints;
629
630 constraints = (BASIC_CONSTRAINTS*)X509V3_EXT_d2i(ext);
631 if (constraints)
632 {
633 if (constraints->ca)
634 {
635 this->flags |= X509_CA;
636 }
637 if (constraints->pathlen)
638 {
639 this->pathlen = ASN1_INTEGER_get(constraints->pathlen);
640 }
641 BASIC_CONSTRAINTS_free(constraints);
642 return TRUE;
643 }
644 return FALSE;
645 }
646
647 /**
648 * Parse CRL distribution points
649 */
650 static bool parse_crlDistributionPoints_ext(private_openssl_x509_t *this,
651 X509_EXTENSION *ext)
652 {
653 CRL_DIST_POINTS *cdps;
654 DIST_POINT *cdp;
655 identification_t *id;
656 char *uri;
657 int i, j, point_num, name_num;
658
659 cdps = X509V3_EXT_d2i(ext);
660 if (!cdps)
661 {
662 return FALSE;
663 }
664 point_num = sk_DIST_POINT_num(cdps);
665 for (i = 0; i < point_num; i++)
666 {
667 cdp = sk_DIST_POINT_value(cdps, i);
668 if (cdp)
669 {
670 crl_uri_t *entry;
671
672 entry = crl_uri_create();
673 this->crl_uris->insert_last(this->crl_uris, entry);
674
675 if (cdp->distpoint && cdp->distpoint->type == 0 &&
676 cdp->distpoint->name.fullname)
677 {
678 name_num = sk_GENERAL_NAME_num(cdp->distpoint->name.fullname);
679 for (j = 0; j < name_num; j++)
680 {
681 id = general_name2id(sk_GENERAL_NAME_value(
682 cdp->distpoint->name.fullname, j));
683 if (id)
684 {
685 if (asprintf(&uri, "%Y", id) > 0)
686 {
687 entry->uris->insert_last(entry->uris, uri);
688 }
689 id->destroy(id);
690 }
691 }
692 }
693 if (cdp->CRLissuer)
694 {
695 name_num = sk_GENERAL_NAME_num(cdp->CRLissuer);
696 for (j = 0; j < name_num; j++)
697 {
698 id = general_name2id(sk_GENERAL_NAME_value(cdp->CRLissuer, j));
699 if (id)
700 { /* get only one */
701 entry->issuer = id;
702 break;
703 }
704 }
705 }
706 DIST_POINT_free(cdp);
707 }
708 }
709 sk_DIST_POINT_free(cdps);
710 return TRUE;
711 }
712
713 /**
714 * Parse authorityInfoAccess with OCSP URIs
715 */
716 static bool parse_authorityInfoAccess_ext(private_openssl_x509_t *this,
717 X509_EXTENSION *ext)
718 {
719 AUTHORITY_INFO_ACCESS *infos;
720 ACCESS_DESCRIPTION *desc;
721 identification_t *id;
722 int i, num;
723 char *uri;
724
725 infos = X509V3_EXT_d2i(ext);
726 if (!infos)
727 {
728 return FALSE;
729 }
730 num = sk_ACCESS_DESCRIPTION_num(infos);
731 for (i = 0; i < num; i++)
732 {
733 desc = sk_ACCESS_DESCRIPTION_value(infos, i);
734 if (desc)
735 {
736 if (openssl_asn1_known_oid(desc->method) == OID_OCSP)
737 {
738 id = general_name2id(desc->location);
739 if (id)
740 {
741 if (asprintf(&uri, "%Y", id) > 0)
742 {
743 this->ocsp_uris->insert_first(this->ocsp_uris, uri);
744 }
745 id->destroy(id);
746 }
747 }
748 ACCESS_DESCRIPTION_free(desc);
749 }
750 }
751 sk_ACCESS_DESCRIPTION_free(infos);
752 return TRUE;
753 }
754
755 /**
756 * Parse authorityKeyIdentifier extension
757 */
758 static bool parse_authKeyIdentifier_ext(private_openssl_x509_t *this,
759 X509_EXTENSION *ext)
760 {
761 AUTHORITY_KEYID *keyid;
762
763 keyid = (AUTHORITY_KEYID*)X509V3_EXT_d2i(ext);
764 if (keyid)
765 {
766 free(this->authKeyIdentifier.ptr);
767 this->authKeyIdentifier = chunk_clone(
768 openssl_asn1_str2chunk(keyid->keyid));
769 AUTHORITY_KEYID_free(keyid);
770 return TRUE;
771 }
772 return FALSE;
773 }
774
775 /**
776 * Parse subjectKeyIdentifier extension
777 */
778 static bool parse_subjectKeyIdentifier_ext(private_openssl_x509_t *this,
779 X509_EXTENSION *ext)
780 {
781 chunk_t ostr;
782
783 ostr = openssl_asn1_str2chunk(X509_EXTENSION_get_data(ext));
784 /* quick and dirty unwrap of octet string */
785 if (ostr.len > 2 &&
786 ostr.ptr[0] == V_ASN1_OCTET_STRING && ostr.ptr[1] == ostr.len - 2)
787 {
788 free(this->subjectKeyIdentifier.ptr);
789 this->subjectKeyIdentifier = chunk_clone(chunk_skip(ostr, 2));
790 return TRUE;
791 }
792 return FALSE;
793 }
794
795 /**
796 * Parse X509 extensions we are interested in
797 */
798 static bool parse_extensions(private_openssl_x509_t *this)
799 {
800 STACK_OF(X509_EXTENSION) *extensions;
801 int i, num;
802
803 extensions = this->x509->cert_info->extensions;
804 if (extensions)
805 {
806 num = sk_X509_EXTENSION_num(extensions);
807
808 for (i = 0; i < num; i++)
809 {
810 X509_EXTENSION *ext;
811 bool ok;
812
813 ext = sk_X509_EXTENSION_value(extensions, i);
814 switch (OBJ_obj2nid(X509_EXTENSION_get_object(ext)))
815 {
816 case NID_info_access:
817 ok = parse_authorityInfoAccess_ext(this, ext);
818 break;
819 case NID_authority_key_identifier:
820 ok = parse_authKeyIdentifier_ext(this, ext);
821 break;
822 case NID_subject_key_identifier:
823 ok = parse_subjectKeyIdentifier_ext(this, ext);
824 break;
825 case NID_subject_alt_name:
826 ok = parse_generalNames_ext(this->subjectAltNames, ext);
827 break;
828 case NID_issuer_alt_name:
829 ok = parse_generalNames_ext(this->issuerAltNames, ext);
830 break;
831 case NID_basic_constraints:
832 ok = parse_basicConstraints_ext(this, ext);
833 break;
834 case NID_crl_distribution_points:
835 ok = parse_crlDistributionPoints_ext(this, ext);
836 break;
837 default:
838 ok = X509_EXTENSION_get_critical(ext) != 0;
839 if (!ok)
840 {
841 DBG1(DBG_LIB, "found unsupported critical X.509 extension");
842 }
843 break;
844 }
845 if (!ok)
846 {
847 return FALSE;
848 }
849 }
850 }
851 return TRUE;
852 }
853
854 /**
855 * Parse ExtendedKeyUsage
856 */
857 static void parse_extKeyUsage(private_openssl_x509_t *this)
858 {
859 EXTENDED_KEY_USAGE *usage;
860 int i;
861
862 usage = X509_get_ext_d2i(this->x509, NID_ext_key_usage, NULL, NULL);
863 if (usage)
864 {
865 for (i = 0; i < sk_ASN1_OBJECT_num(usage); i++)
866 {
867 switch (OBJ_obj2nid(sk_ASN1_OBJECT_value(usage, i)))
868 {
869 case NID_server_auth:
870 this->flags |= X509_SERVER_AUTH;
871 break;
872 case NID_client_auth:
873 this->flags |= X509_CLIENT_AUTH;
874 break;
875 case NID_OCSP_sign:
876 this->flags |= X509_OCSP_SIGNER;
877 break;
878 default:
879 break;
880 }
881 }
882 sk_ASN1_OBJECT_pop_free(usage, ASN1_OBJECT_free);
883 }
884 }
885
886 /**
887 * Parse a DER encoded x509 certificate
888 */
889 static bool parse_certificate(private_openssl_x509_t *this)
890 {
891 const unsigned char *ptr = this->encoding.ptr;
892 hasher_t *hasher;
893 chunk_t chunk;
894
895 this->x509 = d2i_X509(NULL, &ptr, this->encoding.len);
896 if (!this->x509)
897 {
898 return FALSE;
899 }
900 if (X509_get_version(this->x509) < 0 || X509_get_version(this->x509) > 2)
901 {
902 DBG1(DBG_LIB, "unsupported x509 version: %d",
903 X509_get_version(this->x509) + 1);
904 return FALSE;
905 }
906
907 this->subject = openssl_x509_name2id(X509_get_subject_name(this->x509));
908 this->issuer = openssl_x509_name2id(X509_get_issuer_name(this->x509));
909
910 switch (openssl_asn1_known_oid(this->x509->cert_info->key->algor->algorithm))
911 {
912 case OID_RSA_ENCRYPTION:
913 this->pubkey = lib->creds->create(lib->creds,
914 CRED_PUBLIC_KEY, KEY_RSA, BUILD_BLOB_ASN1_DER,
915 openssl_asn1_str2chunk(X509_get0_pubkey_bitstr(this->x509)),
916 BUILD_END);
917 break;
918 case OID_EC_PUBLICKEY:
919 /* for ECDSA, we need the full subjectPublicKeyInfo, as it contains
920 * the curve parameters. */
921 chunk = openssl_i2chunk(X509_PUBKEY, X509_get_X509_PUBKEY(this->x509));
922 this->pubkey = lib->creds->create(lib->creds,
923 CRED_PUBLIC_KEY, KEY_ECDSA, BUILD_BLOB_ASN1_DER,
924 chunk, BUILD_END);
925 free(chunk.ptr);
926 break;
927 default:
928 DBG1(DBG_LIB, "unsupported public key algorithm");
929 break;
930 }
931 if (!this->subject || !this->issuer || !this->pubkey)
932 {
933 return FALSE;
934 }
935
936 this->notBefore = openssl_asn1_to_time(X509_get_notBefore(this->x509));
937 this->notAfter = openssl_asn1_to_time(X509_get_notAfter(this->x509));
938
939 if (!chunk_equals(
940 openssl_asn1_obj2chunk(this->x509->cert_info->signature->algorithm),
941 openssl_asn1_obj2chunk(this->x509->sig_alg->algorithm)))
942 {
943 return FALSE;
944 }
945 this->scheme = signature_scheme_from_oid(openssl_asn1_known_oid(
946 this->x509->sig_alg->algorithm));
947
948 if (!parse_extensions(this))
949 {
950 return TRUE;
951 }
952 parse_extKeyUsage(this);
953
954 hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
955 if (!hasher)
956 {
957 return FALSE;
958 }
959 hasher->allocate_hash(hasher, this->encoding, &this->hash);
960 hasher->destroy(hasher);
961
962 if (issued_by(this, &this->public.x509.interface))
963 {
964 this->flags |= X509_SELF_SIGNED;
965 }
966 return TRUE;
967 }
968
969 openssl_x509_t *openssl_x509_load(certificate_type_t type, va_list args)
970 {
971 chunk_t blob = chunk_empty;
972 x509_flag_t flags = 0;
973
974 while (TRUE)
975 {
976 switch (va_arg(args, builder_part_t))
977 {
978 case BUILD_BLOB_ASN1_DER:
979 blob = va_arg(args, chunk_t);
980 continue;
981 case BUILD_X509_FLAG:
982 flags |= va_arg(args, x509_flag_t);
983 continue;
984 case BUILD_END:
985 break;
986 default:
987 return NULL;
988 }
989 break;
990 }
991
992 if (blob.ptr)
993 {
994 private_openssl_x509_t *this;
995
996 this = create_empty();
997 this->encoding = chunk_clone(blob);
998 this->flags |= flags;
999 if (parse_certificate(this))
1000 {
1001 return &this->public;
1002 }
1003 DBG1(DBG_LIB, "OpenSSL X.509 parsing failed");
1004 destroy(this);
1005 }
1006 return NULL;
1007 }