c755d7f63e12c8c3a9f8cffdaae4bc82639d61d4
[strongswan.git] / src / libstrongswan / plugins / x509 / x509_crl.c
1 /*
2 * Copyright (C) 2008-2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "x509_crl.h"
17
18 typedef struct private_x509_crl_t private_x509_crl_t;
19 typedef struct revoked_t revoked_t;
20
21 #include <time.h>
22
23 #include <debug.h>
24 #include <library.h>
25 #include <asn1/oid.h>
26 #include <asn1/asn1.h>
27 #include <asn1/asn1_parser.h>
28 #include <credentials/certificates/x509.h>
29 #include <utils/linked_list.h>
30
31 /**
32 * entry for a revoked certificate
33 */
34 struct revoked_t {
35 /**
36 * serial of the revoked certificate
37 */
38 chunk_t serial;
39
40 /**
41 * date of revocation
42 */
43 time_t date;
44
45 /**
46 * reason for revocation
47 */
48 crl_reason_t reason;
49 };
50
51 /**
52 * private data of x509_crl
53 */
54 struct private_x509_crl_t {
55
56 /**
57 * public functions
58 */
59 x509_crl_t public;
60
61 /**
62 * X.509 crl encoding in ASN.1 DER format
63 */
64 chunk_t encoding;
65
66 /**
67 * X.509 crl body over which signature is computed
68 */
69 chunk_t tbsCertList;
70
71 /**
72 * Version of the X.509 crl
73 */
74 u_int version;
75
76 /**
77 * ID representing the crl issuer
78 */
79 identification_t *issuer;
80
81 /**
82 * CRL number
83 */
84 chunk_t crlNumber;
85
86 /**
87 * Time when the crl was generated
88 */
89 time_t thisUpdate;
90
91 /**
92 * Time when an update crl will be available
93 */
94 time_t nextUpdate;
95
96 /**
97 * list of revoked certificates as revoked_t
98 */
99 linked_list_t *revoked;
100
101 /**
102 * Authority Key Identifier
103 */
104 chunk_t authKeyIdentifier;
105
106 /**
107 * Authority Key Serial Number
108 */
109 chunk_t authKeySerialNumber;
110
111 /**
112 * Signature algorithm
113 */
114 int algorithm;
115
116 /**
117 * Signature
118 */
119 chunk_t signature;
120
121 /**
122 * reference counter
123 */
124 refcount_t ref;
125 };
126
127 /**
128 * from x509_cert
129 */
130 extern chunk_t x509_parse_authorityKeyIdentifier(
131 chunk_t blob, int level0,
132 chunk_t *authKeySerialNumber);
133
134 /**
135 * ASN.1 definition of an X.509 certificate revocation list
136 */
137 static const asn1Object_t crlObjects[] = {
138 { 0, "certificateList", ASN1_SEQUENCE, ASN1_OBJ }, /* 0 */
139 { 1, "tbsCertList", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */
140 { 2, "version", ASN1_INTEGER, ASN1_OPT |
141 ASN1_BODY }, /* 2 */
142 { 2, "end opt", ASN1_EOC, ASN1_END }, /* 3 */
143 { 2, "signature", ASN1_EOC, ASN1_RAW }, /* 4 */
144 { 2, "issuer", ASN1_SEQUENCE, ASN1_OBJ }, /* 5 */
145 { 2, "thisUpdate", ASN1_EOC, ASN1_RAW }, /* 6 */
146 { 2, "nextUpdate", ASN1_EOC, ASN1_RAW }, /* 7 */
147 { 2, "revokedCertificates", ASN1_SEQUENCE, ASN1_OPT |
148 ASN1_LOOP }, /* 8 */
149 { 3, "certList", ASN1_SEQUENCE, ASN1_NONE }, /* 9 */
150 { 4, "userCertificate", ASN1_INTEGER, ASN1_BODY }, /* 10 */
151 { 4, "revocationDate", ASN1_EOC, ASN1_RAW }, /* 11 */
152 { 4, "crlEntryExtensions", ASN1_SEQUENCE, ASN1_OPT |
153 ASN1_LOOP }, /* 12 */
154 { 5, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 13 */
155 { 6, "extnID", ASN1_OID, ASN1_BODY }, /* 14 */
156 { 6, "critical", ASN1_BOOLEAN, ASN1_DEF |
157 ASN1_BODY }, /* 15 */
158 { 6, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 16 */
159 { 4, "end opt or loop", ASN1_EOC, ASN1_END }, /* 17 */
160 { 2, "end opt or loop", ASN1_EOC, ASN1_END }, /* 18 */
161 { 2, "optional extensions", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 19 */
162 { 3, "crlExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 20 */
163 { 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 21 */
164 { 5, "extnID", ASN1_OID, ASN1_BODY }, /* 22 */
165 { 5, "critical", ASN1_BOOLEAN, ASN1_DEF |
166 ASN1_BODY }, /* 23 */
167 { 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 24 */
168 { 3, "end loop", ASN1_EOC, ASN1_END }, /* 25 */
169 { 2, "end opt", ASN1_EOC, ASN1_END }, /* 26 */
170 { 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 27 */
171 { 1, "signatureValue", ASN1_BIT_STRING, ASN1_BODY }, /* 28 */
172 { 0, "exit", ASN1_EOC, ASN1_EXIT }
173 };
174 #define CRL_OBJ_TBS_CERT_LIST 1
175 #define CRL_OBJ_VERSION 2
176 #define CRL_OBJ_SIG_ALG 4
177 #define CRL_OBJ_ISSUER 5
178 #define CRL_OBJ_THIS_UPDATE 6
179 #define CRL_OBJ_NEXT_UPDATE 7
180 #define CRL_OBJ_USER_CERTIFICATE 10
181 #define CRL_OBJ_REVOCATION_DATE 11
182 #define CRL_OBJ_CRL_ENTRY_EXTN_ID 14
183 #define CRL_OBJ_CRL_ENTRY_CRITICAL 15
184 #define CRL_OBJ_CRL_ENTRY_EXTN_VALUE 16
185 #define CRL_OBJ_EXTN_ID 22
186 #define CRL_OBJ_CRITICAL 23
187 #define CRL_OBJ_EXTN_VALUE 24
188 #define CRL_OBJ_ALGORITHM 27
189 #define CRL_OBJ_SIGNATURE 28
190
191 /**
192 * Parses an X.509 Certificate Revocation List (CRL)
193 */
194 static bool parse(private_x509_crl_t *this)
195 {
196 asn1_parser_t *parser;
197 chunk_t object;
198 chunk_t extnID;
199 chunk_t userCertificate = chunk_empty;
200 int objectID;
201 int sig_alg = OID_UNKNOWN;
202 bool success = FALSE;
203 bool critical;
204 revoked_t *revoked = NULL;
205
206 parser = asn1_parser_create(crlObjects, this->encoding);
207
208 while (parser->iterate(parser, &objectID, &object))
209 {
210 u_int level = parser->get_level(parser)+1;
211
212 switch (objectID)
213 {
214 case CRL_OBJ_TBS_CERT_LIST:
215 this->tbsCertList = object;
216 break;
217 case CRL_OBJ_VERSION:
218 this->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
219 DBG2(DBG_LIB, " v%d", this->version);
220 break;
221 case CRL_OBJ_SIG_ALG:
222 sig_alg = asn1_parse_algorithmIdentifier(object, level, NULL);
223 break;
224 case CRL_OBJ_ISSUER:
225 this->issuer = identification_create_from_encoding(ID_DER_ASN1_DN, object);
226 DBG2(DBG_LIB, " '%Y'", this->issuer);
227 break;
228 case CRL_OBJ_THIS_UPDATE:
229 this->thisUpdate = asn1_parse_time(object, level);
230 break;
231 case CRL_OBJ_NEXT_UPDATE:
232 this->nextUpdate = asn1_parse_time(object, level);
233 break;
234 case CRL_OBJ_USER_CERTIFICATE:
235 userCertificate = object;
236 break;
237 case CRL_OBJ_REVOCATION_DATE:
238 revoked = malloc_thing(revoked_t);
239 revoked->serial = userCertificate;
240 revoked->date = asn1_parse_time(object, level);
241 revoked->reason = CRL_REASON_UNSPECIFIED;
242 this->revoked->insert_last(this->revoked, (void *)revoked);
243 break;
244 case CRL_OBJ_CRL_ENTRY_EXTN_ID:
245 case CRL_OBJ_EXTN_ID:
246 extnID = object;
247 break;
248 case CRL_OBJ_CRL_ENTRY_CRITICAL:
249 case CRL_OBJ_CRITICAL:
250 critical = object.len && *object.ptr;
251 DBG2(DBG_LIB, " %s", critical ? "TRUE" : "FALSE");
252 break;
253 case CRL_OBJ_CRL_ENTRY_EXTN_VALUE:
254 case CRL_OBJ_EXTN_VALUE:
255 {
256 int extn_oid = asn1_known_oid(extnID);
257
258 if (revoked && extn_oid == OID_CRL_REASON_CODE)
259 {
260 if (*object.ptr == ASN1_ENUMERATED &&
261 asn1_length(&object) == 1)
262 {
263 revoked->reason = *object.ptr;
264 }
265 DBG2(DBG_LIB, " '%N'", crl_reason_names,
266 revoked->reason);
267 }
268 else if (extn_oid == OID_AUTHORITY_KEY_ID)
269 {
270
271 this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(object,
272 level, &this->authKeySerialNumber);
273 }
274 else if (extn_oid == OID_CRL_NUMBER)
275 {
276 if (!asn1_parse_simple_object(&object, ASN1_INTEGER,
277 level, "crlNumber"))
278 {
279 goto end;
280 }
281 this->crlNumber = object;
282 }
283 }
284 break;
285 case CRL_OBJ_ALGORITHM:
286 {
287 this->algorithm = asn1_parse_algorithmIdentifier(object, level, NULL);
288 if (this->algorithm != sig_alg)
289 {
290 DBG1(DBG_LIB, " signature algorithms do not agree");
291 goto end;
292 }
293 break;
294 }
295 case CRL_OBJ_SIGNATURE:
296 this->signature = object;
297 break;
298 default:
299 break;
300 }
301 }
302 success = parser->success(parser);
303
304 end:
305 parser->destroy(parser);
306 return success;
307 }
308
309 /**
310 * enumerator filter callback for create_enumerator
311 */
312 static bool filter(void *data, revoked_t **revoked, chunk_t *serial, void *p2,
313 time_t *date, void *p3, crl_reason_t *reason)
314 {
315 if (serial)
316 {
317 *serial = (*revoked)->serial;
318 }
319 if (date)
320 {
321 *date = (*revoked)->date;
322 }
323 if (reason)
324 {
325 *reason = (*revoked)->reason;
326 }
327 return TRUE;
328 }
329
330 /**
331 * Implementation of crl_t.get_serial.
332 */
333 static chunk_t get_serial(private_x509_crl_t *this)
334 {
335 return this->crlNumber;
336 }
337
338 /**
339 * Implementation of crl_t.get_authKeyIdentifier.
340 */
341 static chunk_t get_authKeyIdentifier(private_x509_crl_t *this)
342 {
343 return this->authKeyIdentifier;
344 }
345
346 /**
347 * Implementation of crl_t.create_enumerator.
348 */
349 static enumerator_t* create_enumerator(private_x509_crl_t *this)
350 {
351 return enumerator_create_filter(
352 this->revoked->create_enumerator(this->revoked),
353 (void*)filter, NULL, NULL);
354 }
355
356 /**
357 * Implementation of certificate_t.get_type
358 */
359 static certificate_type_t get_type(private_x509_crl_t *this)
360 {
361 return CERT_X509_CRL;
362 }
363
364 /**
365 * Implementation of certificate_t.get_issuer and get_subject
366 */
367 static identification_t* get_issuer(private_x509_crl_t *this)
368 {
369 return this->issuer;
370 }
371
372 /**
373 * Implementation of certificate_t.has_subject and has_issuer.
374 */
375 static id_match_t has_issuer(private_x509_crl_t *this, identification_t *issuer)
376 {
377 if (issuer->get_type(issuer) == ID_KEY_ID && this->authKeyIdentifier.ptr &&
378 chunk_equals(this->authKeyIdentifier, issuer->get_encoding(issuer)))
379 {
380 return ID_MATCH_PERFECT;
381 }
382 return this->issuer->matches(this->issuer, issuer);
383 }
384
385 /**
386 * Implementation of certificate_t.issued_by
387 */
388 static bool issued_by(private_x509_crl_t *this, certificate_t *issuer)
389 {
390 public_key_t *key;
391 signature_scheme_t scheme;
392 bool valid;
393 x509_t *x509 = (x509_t*)issuer;
394
395 /* check if issuer is an X.509 CA certificate */
396 if (issuer->get_type(issuer) != CERT_X509)
397 {
398 return FALSE;
399 }
400 if (!(x509->get_flags(x509) & X509_CA))
401 {
402 return FALSE;
403 }
404
405 /* get the public key of the issuer */
406 key = issuer->get_public_key(issuer);
407
408 /* compare keyIdentifiers if available, otherwise use DNs */
409 if (this->authKeyIdentifier.ptr && key)
410 {
411 chunk_t fingerprint;
412
413 if (!key->get_fingerprint(key, KEY_ID_PUBKEY_SHA1, &fingerprint) ||
414 !chunk_equals(fingerprint, this->authKeyIdentifier))
415 {
416 return FALSE;
417 }
418 }
419 else
420 {
421 if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
422 {
423 return FALSE;
424 }
425 }
426
427 /* determine signature scheme */
428 scheme = signature_scheme_from_oid(this->algorithm);
429
430 if (scheme == SIGN_UNKNOWN || key == NULL)
431 {
432 return FALSE;
433 }
434 valid = key->verify(key, scheme, this->tbsCertList, this->signature);
435 key->destroy(key);
436 return valid;
437 }
438
439 /**
440 * Implementation of certificate_t.get_public_key
441 */
442 static public_key_t* get_public_key(private_x509_crl_t *this)
443 {
444 return NULL;
445 }
446
447 /**
448 * Implementation of certificate_t.asdf
449 */
450 static private_x509_crl_t* get_ref(private_x509_crl_t *this)
451 {
452 ref_get(&this->ref);
453 return this;
454 }
455
456 /**
457 * Implementation of certificate_t.get_validity.
458 */
459 static bool get_validity(private_x509_crl_t *this, time_t *when,
460 time_t *not_before, time_t *not_after)
461 {
462 time_t t = when ? *when : time(NULL);
463
464 if (not_before)
465 {
466 *not_before = this->thisUpdate;
467 }
468 if (not_after)
469 {
470 *not_after = this->nextUpdate;
471 }
472 return (t <= this->nextUpdate);
473 }
474
475 /**
476 * Implementation of certificate_t.is_newer.
477 */
478 static bool is_newer(private_x509_crl_t *this, crl_t *that)
479 {
480 chunk_t that_crlNumber = that->get_serial(that);
481 bool new;
482
483 /* compare crlNumbers if available - otherwise use thisUpdate */
484 if (this->crlNumber.ptr != NULL && that_crlNumber.ptr != NULL)
485 {
486 new = chunk_compare(this->crlNumber, that_crlNumber) > 0;
487 DBG1(DBG_LIB, " crl #%#B is %s - existing crl #%#B %s",
488 &this->crlNumber, new ? "newer":"not newer",
489 &that_crlNumber, new ? "replaced":"retained");
490 }
491 else
492 {
493 certificate_t *this_cert = &this->public.crl.certificate;
494 certificate_t *that_cert = &that->certificate;
495
496 time_t this_update, that_update, now = time(NULL);
497
498 this_cert->get_validity(this_cert, &now, &this_update, NULL);
499 that_cert->get_validity(that_cert, &now, &that_update, NULL);
500 new = this_update > that_update;
501 DBG1(DBG_LIB, " crl from %T is %s - existing crl from %T %s",
502 &this_update, FALSE, new ? "newer":"not newer",
503 &that_update, FALSE, new ? "replaced":"retained");
504 }
505 return new;
506 }
507
508 /**
509 * Implementation of certificate_t.get_encoding.
510 */
511 static chunk_t get_encoding(private_x509_crl_t *this)
512 {
513 return chunk_clone(this->encoding);
514 }
515
516 /**
517 * Implementation of certificate_t.equals.
518 */
519 static bool equals(private_x509_crl_t *this, certificate_t *other)
520 {
521 chunk_t encoding;
522 bool equal;
523
524 if ((certificate_t*)this == other)
525 {
526 return TRUE;
527 }
528 if (other->equals == (void*)equals)
529 { /* skip allocation if we have the same implementation */
530 return chunk_equals(this->encoding, ((private_x509_crl_t*)other)->encoding);
531 }
532 encoding = other->get_encoding(other);
533 equal = chunk_equals(this->encoding, encoding);
534 free(encoding.ptr);
535 return equal;
536 }
537
538 /**
539 * Implementation of certificate_t.destroy
540 */
541 static void destroy(private_x509_crl_t *this)
542 {
543 if (ref_put(&this->ref))
544 {
545 this->revoked->destroy_function(this->revoked, free);
546 DESTROY_IF(this->issuer);
547 free(this->authKeyIdentifier.ptr);
548 free(this->encoding.ptr);
549 free(this);
550 }
551 }
552
553 /**
554 * create an empty but initialized X.509 crl
555 */
556 static private_x509_crl_t* create_empty(void)
557 {
558 private_x509_crl_t *this = malloc_thing(private_x509_crl_t);
559
560 this->public.crl.get_serial = (chunk_t (*)(crl_t*))get_serial;
561 this->public.crl.get_authKeyIdentifier = (chunk_t (*)(crl_t*))get_authKeyIdentifier;
562 this->public.crl.create_enumerator = (enumerator_t* (*)(crl_t*))create_enumerator;
563 this->public.crl.certificate.get_type = (certificate_type_t (*)(certificate_t *this))get_type;
564 this->public.crl.certificate.get_subject = (identification_t* (*)(certificate_t *this))get_issuer;
565 this->public.crl.certificate.get_issuer = (identification_t* (*)(certificate_t *this))get_issuer;
566 this->public.crl.certificate.has_subject = (id_match_t (*)(certificate_t*, identification_t *subject))has_issuer;
567 this->public.crl.certificate.has_issuer = (id_match_t (*)(certificate_t*, identification_t *issuer))has_issuer;
568 this->public.crl.certificate.issued_by = (bool (*)(certificate_t *this, certificate_t *issuer))issued_by;
569 this->public.crl.certificate.get_public_key = (public_key_t* (*)(certificate_t *this))get_public_key;
570 this->public.crl.certificate.get_validity = (bool (*)(certificate_t*, time_t *when, time_t *, time_t*))get_validity;
571 this->public.crl.certificate.is_newer = (bool (*)(certificate_t*,certificate_t*))is_newer;
572 this->public.crl.certificate.get_encoding = (chunk_t (*)(certificate_t*))get_encoding;
573 this->public.crl.certificate.equals = (bool (*)(certificate_t*, certificate_t *other))equals;
574 this->public.crl.certificate.get_ref = (certificate_t* (*)(certificate_t *this))get_ref;
575 this->public.crl.certificate.destroy = (void (*)(certificate_t *this))destroy;
576
577 this->encoding = chunk_empty;
578 this->tbsCertList = chunk_empty;
579 this->issuer = NULL;
580 this->crlNumber = chunk_empty;
581 this->revoked = linked_list_create();
582 this->authKeyIdentifier = chunk_empty;
583 this->authKeySerialNumber = chunk_empty;
584 this->ref = 1;
585
586 return this;
587 }
588
589 /**
590 * See header.
591 */
592 x509_crl_t *x509_crl_load(certificate_type_t type, va_list args)
593 {
594 chunk_t blob = chunk_empty;
595
596 while (TRUE)
597 {
598 switch (va_arg(args, builder_part_t))
599 {
600 case BUILD_BLOB_ASN1_DER:
601 blob = va_arg(args, chunk_t);
602 continue;
603 case BUILD_END:
604 break;
605 default:
606 return NULL;
607 }
608 break;
609 }
610 if (blob.ptr)
611 {
612 private_x509_crl_t *crl = create_empty();
613
614 crl->encoding = chunk_clone(blob);
615 if (parse(crl))
616 {
617 return &crl->public;
618 }
619 destroy(crl);
620 }
621 return NULL;
622 };
623