merged the modularization branch (credentials) back to trunk
[strongswan.git] / src / libstrongswan / plugins / x509 / x509_crl.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include "x509_crl.h"
19
20 typedef struct private_x509_crl_t private_x509_crl_t;
21 typedef struct revoked_t revoked_t;
22
23 #include <debug.h>
24 #include <library.h>
25 #include <asn1/asn1.h>
26 #include <credentials/certificates/x509.h>
27
28 /**
29 * entry for a revoked certificate
30 */
31 struct revoked_t {
32 /**
33 * serial of the revoked certificate
34 */
35 chunk_t serial;
36
37 /**
38 * date of revocation
39 */
40 time_t date;
41
42 /**
43 * reason for revocation
44 */
45 crl_reason_t reason;
46 };
47
48 /**
49 * private data of x509_crl
50 */
51 struct private_x509_crl_t {
52
53 /**
54 * public functions
55 */
56 x509_crl_t public;
57
58 /**
59 * X.509 crl in DER format
60 */
61 chunk_t certificateList;
62
63 /**
64 * X.509 crl body over which signature is computed
65 */
66 chunk_t tbsCertList;
67
68 /**
69 * Version of the X.509 crl
70 */
71 u_int version;
72
73 /**
74 * ID representing the crl issuer
75 */
76 identification_t *issuer;
77
78 /**
79 * CRL number
80 */
81 chunk_t crlNumber;
82
83 /**
84 * Time when the crl was generated
85 */
86 time_t thisUpdate;
87
88 /**
89 * Time when an update crl will be available
90 */
91 time_t nextUpdate;
92
93 /**
94 * list of revoked certificates as revoked_t
95 */
96 linked_list_t *revoked;
97
98 /**
99 * Authority Key Identifier
100 */
101 identification_t *authKeyIdentifier;
102
103 /**
104 * Authority Key Serial Number
105 */
106 chunk_t authKeySerialNumber;
107
108 /**
109 * Signature algorithm
110 */
111 int algorithm;
112
113 /**
114 * Signature
115 */
116 chunk_t signature;
117
118 /**
119 * reference counter
120 */
121 refcount_t ref;
122 };
123
124 /**
125 * from x509_cert
126 */
127 extern identification_t* x509_parse_authorityKeyIdentifier(
128 chunk_t blob, int level0,
129 chunk_t *authKeySerialNumber);
130
131 /**
132 * ASN.1 definition of an X.509 certificate revocation list
133 */
134 static const asn1Object_t crlObjects[] = {
135 { 0, "certificateList", ASN1_SEQUENCE, ASN1_OBJ }, /* 0 */
136 { 1, "tbsCertList", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */
137 { 2, "version", ASN1_INTEGER, ASN1_OPT |
138 ASN1_BODY }, /* 2 */
139 { 2, "end opt", ASN1_EOC, ASN1_END }, /* 3 */
140 { 2, "signature", ASN1_EOC, ASN1_RAW }, /* 4 */
141 { 2, "issuer", ASN1_SEQUENCE, ASN1_OBJ }, /* 5 */
142 { 2, "thisUpdate", ASN1_EOC, ASN1_RAW }, /* 6 */
143 { 2, "nextUpdate", ASN1_EOC, ASN1_RAW }, /* 7 */
144 { 2, "revokedCertificates", ASN1_SEQUENCE, ASN1_OPT |
145 ASN1_LOOP }, /* 8 */
146 { 3, "certList", ASN1_SEQUENCE, ASN1_NONE }, /* 9 */
147 { 4, "userCertificate", ASN1_INTEGER, ASN1_BODY }, /* 10 */
148 { 4, "revocationDate", ASN1_EOC, ASN1_RAW }, /* 11 */
149 { 4, "crlEntryExtensions", ASN1_SEQUENCE, ASN1_OPT |
150 ASN1_LOOP }, /* 12 */
151 { 5, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 13 */
152 { 6, "extnID", ASN1_OID, ASN1_BODY }, /* 14 */
153 { 6, "critical", ASN1_BOOLEAN, ASN1_DEF |
154 ASN1_BODY }, /* 15 */
155 { 6, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 16 */
156 { 4, "end opt or loop", ASN1_EOC, ASN1_END }, /* 17 */
157 { 2, "end opt or loop", ASN1_EOC, ASN1_END }, /* 18 */
158 { 2, "optional extensions", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 19 */
159 { 3, "crlExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 20 */
160 { 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 21 */
161 { 5, "extnID", ASN1_OID, ASN1_BODY }, /* 22 */
162 { 5, "critical", ASN1_BOOLEAN, ASN1_DEF |
163 ASN1_BODY }, /* 23 */
164 { 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 24 */
165 { 3, "end loop", ASN1_EOC, ASN1_END }, /* 25 */
166 { 2, "end opt", ASN1_EOC, ASN1_END }, /* 26 */
167 { 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 27 */
168 { 1, "signatureValue", ASN1_BIT_STRING, ASN1_BODY } /* 28 */
169 };
170
171 #define CRL_OBJ_TBS_CERT_LIST 1
172 #define CRL_OBJ_VERSION 2
173 #define CRL_OBJ_SIG_ALG 4
174 #define CRL_OBJ_ISSUER 5
175 #define CRL_OBJ_THIS_UPDATE 6
176 #define CRL_OBJ_NEXT_UPDATE 7
177 #define CRL_OBJ_USER_CERTIFICATE 10
178 #define CRL_OBJ_REVOCATION_DATE 11
179 #define CRL_OBJ_CRL_ENTRY_EXTN_ID 14
180 #define CRL_OBJ_CRL_ENTRY_CRITICAL 15
181 #define CRL_OBJ_CRL_ENTRY_EXTN_VALUE 16
182 #define CRL_OBJ_EXTN_ID 22
183 #define CRL_OBJ_CRITICAL 23
184 #define CRL_OBJ_EXTN_VALUE 24
185 #define CRL_OBJ_ALGORITHM 27
186 #define CRL_OBJ_SIGNATURE 28
187 #define CRL_OBJ_ROOF 29
188
189 /**
190 * Parses an X.509 Certificate Revocation List (CRL)
191 */
192 static bool parse(private_x509_crl_t *this)
193 {
194 asn1_ctx_t ctx;
195 bool critical;
196 chunk_t extnID;
197 chunk_t userCertificate = chunk_empty;
198 revoked_t *revoked = NULL;
199 chunk_t object;
200 u_int level;
201 int objectID = 0;
202
203 asn1_init(&ctx, this->certificateList, 0, FALSE, FALSE);
204 while (objectID < CRL_OBJ_ROOF)
205 {
206 if (!extract_object(crlObjects, &objectID, &object, &level, &ctx))
207 {
208 return FALSE;
209 }
210
211 /* those objects which will parsed further need the next higher level */
212 level++;
213
214 switch (objectID)
215 {
216 case CRL_OBJ_TBS_CERT_LIST:
217 this->tbsCertList = object;
218 break;
219 case CRL_OBJ_VERSION:
220 this->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
221 DBG2(" v%d", this->version);
222 break;
223 case CRL_OBJ_SIG_ALG:
224 this->algorithm = parse_algorithmIdentifier(object, level, NULL);
225 break;
226 case CRL_OBJ_ISSUER:
227 this->issuer = identification_create_from_encoding(ID_DER_ASN1_DN, object);
228 DBG2(" '%D'", this->issuer);
229 break;
230 case CRL_OBJ_THIS_UPDATE:
231 this->thisUpdate = parse_time(object, level);
232 break;
233 case CRL_OBJ_NEXT_UPDATE:
234 this->nextUpdate = parse_time(object, level);
235 break;
236 case CRL_OBJ_USER_CERTIFICATE:
237 userCertificate = object;
238 break;
239 case CRL_OBJ_REVOCATION_DATE:
240 revoked = malloc_thing(revoked_t);
241 revoked->serial = userCertificate;
242 revoked->date = parse_time(object, level);
243 revoked->reason = CRL_UNSPECIFIED;
244 this->revoked->insert_last(this->revoked, (void *)revoked);
245 break;
246 case CRL_OBJ_CRL_ENTRY_EXTN_ID:
247 case CRL_OBJ_EXTN_ID:
248 extnID = object;
249 break;
250 case CRL_OBJ_CRL_ENTRY_CRITICAL:
251 case CRL_OBJ_CRITICAL:
252 critical = object.len && *object.ptr;
253 DBG2(" %s", critical ? "TRUE" : "FALSE");
254 break;
255 case CRL_OBJ_CRL_ENTRY_EXTN_VALUE:
256 case CRL_OBJ_EXTN_VALUE:
257 {
258 int extn_oid = known_oid(extnID);
259
260 if (revoked && extn_oid == OID_CRL_REASON_CODE)
261 {
262 if (*object.ptr == ASN1_ENUMERATED &&
263 asn1_length(&object) == 1)
264 {
265 revoked->reason = *object.ptr;
266 }
267 DBG2(" '%N'", crl_reason_names, revoked->reason);
268 }
269 else if (extn_oid == OID_AUTHORITY_KEY_ID)
270 {
271
272 this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(object,
273 level, &this->authKeySerialNumber);
274 }
275 else if (extn_oid == OID_CRL_NUMBER)
276 {
277 if (!parse_asn1_simple_object(&object, ASN1_INTEGER,
278 level, "crlNumber"))
279 {
280 return FALSE;
281 }
282 this->crlNumber = object;
283 }
284 }
285 break;
286 case CRL_OBJ_ALGORITHM:
287 {
288 int algo = parse_algorithmIdentifier(object, level, NULL);
289 if (this->algorithm != algo)
290 {
291 DBG1(" signature algorithms do not agree");
292 return FALSE;
293 }
294 break;
295 }
296 case CRL_OBJ_SIGNATURE:
297 this->signature = object;
298 break;
299 default:
300 break;
301 }
302 objectID++;
303 }
304 return TRUE;
305 }
306
307 /**
308 * enumerator filter callback for create_enumerator
309 */
310 static bool filter(void *data, revoked_t *revoked, chunk_t *serial, void *p2,
311 time_t *date, void *p3, crl_reason_t *reason)
312 {
313 if (serial)
314 {
315 *serial = revoked->serial;
316 }
317 if (date)
318 {
319 *date = revoked->date;
320 }
321 if (reason)
322 {
323 *reason = revoked->reason;
324 }
325 return TRUE;
326 }
327
328 /**
329 * Implementation of crl_t.is_newer.
330 */
331 static bool is_newer(private_x509_crl_t *this, crl_t *that)
332 {
333 chunk_t that_crlNumber = that->get_serial(that);
334 bool new;
335
336 /* compare crlNumbers if available - otherwise use thisUpdate */
337 if (this->crlNumber.ptr != NULL && that_crlNumber.ptr != NULL)
338 {
339 new = chunk_compare(this->crlNumber, that_crlNumber) > 0;
340 DBG1(" crl #%#B is %s - existing crl #%#B %s",
341 &this->crlNumber, new ? "newer":"not newer",
342 &that_crlNumber, new ? "replaced":"retained");
343 }
344 else
345 {
346 certificate_t *this_cert = &this->public.crl.certificate;
347 certificate_t *that_cert = &that->certificate;
348
349 time_t this_update, that_update, now = time(NULL);
350
351 this_cert->get_validity(this_cert, &now, &this_update, NULL);
352 that_cert->get_validity(that_cert, &now, &that_update, NULL);
353 new = this_update > that_update;
354 DBG1(" crl from %#T is %s - existing crl from %#T %s",
355 &this_update, FALSE, new ? "newer":"not newer",
356 &that_update, FALSE, new ? "replaced":"retained");
357 }
358 return new;
359 }
360
361 /**
362 * Implementation of crl_t.get_serial.
363 */
364 static chunk_t get_serial(private_x509_crl_t *this)
365 {
366 return this->crlNumber;
367 }
368
369 /**
370 * Implementation of crl_t.get_authKeyIdentifier.
371 */
372 static identification_t* get_authKeyIdentifier(private_x509_crl_t *this)
373 {
374 return this->authKeyIdentifier;
375 }
376 /**
377 * Implementation of crl_t.create_enumerator.
378 */
379 static enumerator_t* create_enumerator(private_x509_crl_t *this)
380 {
381 return enumerator_create_filter(
382 this->revoked->create_enumerator(this->revoked),
383 (void*)filter, NULL, NULL);
384 }
385
386 /**
387 * Implementation of certificate_t.get_type
388 */
389 static certificate_type_t get_type(private_x509_crl_t *this)
390 {
391 return CERT_X509_CRL;
392 }
393
394 /**
395 * Implementation of certificate_t.get_subject
396 */
397 static identification_t* get_subject(private_x509_crl_t *this)
398 {
399 return this->issuer;
400 }
401
402 /**
403 * Implementation of certificate_t.get_issuer
404 */
405 static identification_t* get_issuer(private_x509_crl_t *this)
406 {
407 return this->issuer;
408 }
409
410 /**
411 * Implementation of certificate_t.has_subject.
412 */
413 static id_match_t has_subject(private_x509_crl_t *this, identification_t *subject)
414 {
415 return ID_MATCH_NONE;
416 }
417
418 /**
419 * Implementation of certificate_t.has_issuer.
420 */
421 static id_match_t has_issuer(private_x509_crl_t *this, identification_t *issuer)
422 {
423 id_match_t match;
424
425 if (issuer->get_type(issuer) == ID_PUBKEY_SHA1)
426 {
427 if (this->authKeyIdentifier)
428 {
429 match = issuer->matches(issuer, this->authKeyIdentifier);
430 }
431 else
432 {
433 match = ID_MATCH_NONE;
434 }
435 }
436 else
437 {
438 match = this->issuer->matches(this->issuer, issuer);
439 }
440 return match;
441 }
442
443 /**
444 * Implementation of certificate_t.issued_by
445 */
446 static bool issued_by(private_x509_crl_t *this, certificate_t *issuer,
447 bool sigcheck)
448 {
449 public_key_t *key;
450 signature_scheme_t scheme;
451 bool valid;
452 x509_t *x509 = (x509_t*)issuer;
453
454 /* check if issuer is an X.509 CA certificate */
455 if (issuer->get_type(issuer) != CERT_X509)
456 {
457 return FALSE;
458 }
459 if (!(x509->get_flags(x509) & X509_CA))
460 {
461 return FALSE;
462 }
463
464 /* get the public key of the issuer */
465 key = issuer->get_public_key(issuer);
466
467 /* compare keyIdentifiers if available, otherwise use DNs */
468 if (this->authKeyIdentifier && key)
469 {
470 identification_t *subjectKeyIdentifier = key->get_id(key, ID_PUBKEY_SHA1);
471
472 if (!subjectKeyIdentifier->equals(subjectKeyIdentifier,
473 this->authKeyIdentifier))
474 {
475 return FALSE;
476 }
477 }
478 else
479 {
480 if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
481 {
482 return FALSE;
483 }
484 }
485
486 if (!sigcheck)
487 {
488 return TRUE;
489 }
490 /* TODO: generic OID to scheme mapper? */
491 switch (this->algorithm)
492 {
493 case OID_MD5_WITH_RSA:
494 scheme = SIGN_RSA_EMSA_PKCS1_MD5;
495 break;
496 case OID_SHA1_WITH_RSA:
497 scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
498 break;
499 case OID_SHA256_WITH_RSA:
500 scheme = SIGN_RSA_EMSA_PKCS1_SHA256;
501 break;
502 case OID_SHA384_WITH_RSA:
503 scheme = SIGN_RSA_EMSA_PKCS1_SHA384;
504 break;
505 case OID_SHA512_WITH_RSA:
506 scheme = SIGN_RSA_EMSA_PKCS1_SHA512;
507 break;
508 default:
509 return FALSE;
510 }
511 if (key == NULL)
512 {
513 return FALSE;
514 }
515 valid = key->verify(key, scheme, this->tbsCertList, this->signature);
516 key->destroy(key);
517 return valid;
518 }
519
520 /**
521 * Implementation of certificate_t.get_public_key
522 */
523 static public_key_t* get_public_key(private_x509_crl_t *this)
524 {
525 return NULL;
526 }
527
528 /**
529 * Implementation of certificate_t.asdf
530 */
531 static private_x509_crl_t* get_ref(private_x509_crl_t *this)
532 {
533 ref_get(&this->ref);
534 return this;
535 }
536
537 /**
538 * Implementation of certificate_t.get_validity.
539 */
540 static bool get_validity(private_x509_crl_t *this, time_t *when,
541 time_t *not_before, time_t *not_after)
542 {
543 time_t t;
544
545 if (when)
546 {
547 t = *when;
548 }
549 else
550 {
551 t = time(NULL);
552 }
553 if (not_after)
554 {
555 *not_after = this->nextUpdate;
556 }
557 if (not_before)
558 {
559 *not_before = this->thisUpdate;
560 }
561 return (t <= this->nextUpdate);
562 }
563
564 /**
565 * Implementation of certificate_t.get_encoding.
566 */
567 static chunk_t get_encoding(private_x509_crl_t *this)
568 {
569 return chunk_clone(this->certificateList);
570 }
571
572 /**
573 * Implementation of certificate_t.equals.
574 */
575 static bool equals(private_x509_crl_t *this, certificate_t *other)
576 {
577 if ((certificate_t*)this == other)
578 {
579 return TRUE;
580 }
581 if (other->equals == (void*)equals)
582 { /* same implementation */
583 return chunk_equals(this->signature,
584 ((private_x509_crl_t*)other)->signature);
585 }
586 /* TODO: compare against other implementations */
587 return FALSE;
588 }
589
590 /**
591 * Implementation of certificate_t.destroy
592 */
593 static void destroy(private_x509_crl_t *this)
594 {
595 if (ref_put(&this->ref))
596 {
597 this->revoked->destroy_function(this->revoked, free);
598 DESTROY_IF(this->issuer);
599 DESTROY_IF(this->authKeyIdentifier);
600 free(this->certificateList.ptr);
601 free(this);
602 }
603 }
604
605 /**
606 * load a X509 CRL from a chunk of date (ASN1 DER)
607 */
608 static x509_crl_t *load(chunk_t chunk)
609 {
610 private_x509_crl_t *this = malloc_thing(private_x509_crl_t);
611
612 this->public.crl.is_newer = (bool (*)(crl_t*,crl_t*))is_newer;
613 this->public.crl.get_serial = (chunk_t (*)(crl_t*))get_serial;
614 this->public.crl.get_authKeyIdentifier = (identification_t* (*)(crl_t*))get_authKeyIdentifier;
615 this->public.crl.create_enumerator = (enumerator_t* (*)(crl_t*))create_enumerator;
616 this->public.crl.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type;
617 this->public.crl.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_subject;
618 this->public.crl.certificate.get_issuer = (identification_t* (*)(certificate_t *this))get_issuer;
619 this->public.crl.certificate.has_subject = (id_match_t (*)(certificate_t*, identification_t *subject))has_subject;
620 this->public.crl.certificate.has_issuer = (id_match_t (*)(certificate_t*, identification_t *issuer))has_issuer;
621 this->public.crl.certificate.issued_by = (bool (*)(certificate_t *this, certificate_t *issuer,bool))issued_by;
622 this->public.crl.certificate.get_public_key = (public_key_t* (*)(certificate_t *this))get_public_key;
623 this->public.crl.certificate.get_validity = (bool (*)(certificate_t*, time_t *when, time_t *, time_t*))get_validity;
624 this->public.crl.certificate.get_encoding = (chunk_t (*)(certificate_t*))get_encoding;
625 this->public.crl.certificate.equals = (bool (*)(certificate_t*, certificate_t *other))equals;
626 this->public.crl.certificate.get_ref = (certificate_t* (*)(certificate_t *this))get_ref;
627 this->public.crl.certificate.destroy = (void (*)(certificate_t *this))destroy;
628
629 this->certificateList = chunk;
630 this->tbsCertList = chunk_empty;
631 this->issuer = NULL;
632 this->crlNumber = chunk_empty;
633 this->revoked = linked_list_create();
634 this->authKeyIdentifier = NULL;
635 this->authKeySerialNumber = chunk_empty;
636 this->ref = 1;
637
638 if (!parse(this))
639 {
640 destroy(this);
641 return NULL;
642 }
643
644 return &this->public;
645 }
646
647 typedef struct private_builder_t private_builder_t;
648 /**
649 * Builder implementation for certificate loading
650 */
651 struct private_builder_t {
652 /** implements the builder interface */
653 builder_t public;
654 /** loaded CRL */
655 x509_crl_t *crl;
656 };
657
658 /**
659 * Implementation of builder_t.build
660 */
661 static x509_crl_t *build(private_builder_t *this)
662 {
663 x509_crl_t *crl = this->crl;
664
665 free(this);
666 return crl;
667 }
668
669 /**
670 * Implementation of builder_t.add
671 */
672 static void add(private_builder_t *this, builder_part_t part, ...)
673 {
674 va_list args;
675
676 if (this->crl)
677 {
678 DBG1("ignoring surplus build part %N", builder_part_names, part);
679 return;
680 }
681
682 switch (part)
683 {
684 case BUILD_BLOB_ASN1_DER:
685 {
686 va_start(args, part);
687 this->crl = load(va_arg(args, chunk_t));
688 va_end(args);
689 break;
690 }
691 default:
692 DBG1("ignoring unsupported build part %N", builder_part_names, part);
693 break;
694 }
695 }
696
697 /**
698 * Builder construction function
699 */
700 builder_t *x509_crl_builder(certificate_type_t type)
701 {
702 private_builder_t *this;
703
704 if (type != CERT_X509_CRL)
705 {
706 return NULL;
707 }
708
709 this = malloc_thing(private_builder_t);
710
711 this->crl = NULL;
712 this->public.add = (void(*)(builder_t *this, builder_part_t part, ...))add;
713 this->public.build = (void*(*)(builder_t *this))build;
714
715 return &this->public;
716 }
717