hide credentials headers in credential_factory.h
[strongswan.git] / src / libstrongswan / plugins / x509 / x509_ocsp_request.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Copyright (C) 2007 Andreas Steffen
4 * Hochschule fuer Technik Rapperswil
5 * Copyright (C) 2003 Christoph Gysin, Simon Zwahlen
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "x509_ocsp_request.h"
19
20 #include <library.h>
21 #include <asn1/oid.h>
22 #include <asn1/asn1.h>
23 #include <utils/identification.h>
24 #include <utils/linked_list.h>
25 #include <debug.h>
26 #include <credentials/certificates/x509.h>
27 #include <credentials/keys/private_key.h>
28
29 #define NONCE_LEN 16
30
31 typedef struct private_x509_ocsp_request_t private_x509_ocsp_request_t;
32
33 /**
34 * private data of x509_ocsp_request
35 */
36 struct private_x509_ocsp_request_t {
37
38 /**
39 * public functions
40 */
41 x509_ocsp_request_t public;
42
43 /**
44 * CA the candidates belong to
45 */
46 x509_t *ca;
47
48 /**
49 * Requestor name, subject of cert used if not set
50 */
51 identification_t *requestor;
52
53 /**
54 * Requestor certificate, included in request
55 */
56 certificate_t *cert;
57
58 /**
59 * Requestor private key to sign request
60 */
61 private_key_t *key;
62
63 /**
64 * list of certificates to check, x509_t
65 */
66 linked_list_t *candidates;
67
68 /**
69 * nonce used in request
70 */
71 chunk_t nonce;
72
73 /**
74 * encoded OCSP request
75 */
76 chunk_t encoding;
77
78 /**
79 * reference count
80 */
81 refcount_t ref;
82 };
83
84 static u_char ASN1_nonce_oid_str[] = {
85 0x06, 0x09,
86 0x2B, 0x06,
87 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x02
88 };
89
90 static u_char ASN1_response_oid_str[] = {
91 0x06, 0x09,
92 0x2B, 0x06,
93 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x04
94 };
95
96 static u_char ASN1_response_content_str[] = {
97 0x04, 0x0D,
98 0x30, 0x0B,
99 0x06, 0x09,
100 0x2B, 0x06,
101 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x01
102 };
103
104 static const chunk_t ASN1_nonce_oid = chunk_from_buf(ASN1_nonce_oid_str);
105 static const chunk_t ASN1_response_oid = chunk_from_buf(ASN1_response_oid_str);
106 static const chunk_t ASN1_response_content = chunk_from_buf(ASN1_response_content_str);
107
108 /**
109 * build requestorName
110 */
111 static chunk_t build_requestorName(private_x509_ocsp_request_t *this)
112 {
113 if (this->requestor || this->cert)
114 { /* use requestor name, fallback to his cert subject */
115 if (!this->requestor)
116 {
117 this->requestor = this->cert->get_subject(this->cert);
118 this->requestor = this->requestor->clone(this->requestor);
119 }
120 return asn1_wrap(ASN1_CONTEXT_C_1, "m",
121 asn1_simple_object(ASN1_CONTEXT_C_4,
122 this->requestor->get_encoding(this->requestor)));
123
124 }
125 return chunk_empty;
126 }
127
128 /**
129 * build Request, not using singleRequestExtensions
130 */
131 static chunk_t build_Request(private_x509_ocsp_request_t *this,
132 chunk_t issuerNameHash, chunk_t issuerKeyHash,
133 chunk_t serialNumber)
134 {
135 return asn1_wrap(ASN1_SEQUENCE, "m",
136 asn1_wrap(ASN1_SEQUENCE, "cmmm",
137 asn1_algorithmIdentifier(OID_SHA1),
138 asn1_simple_object(ASN1_OCTET_STRING, issuerNameHash),
139 asn1_simple_object(ASN1_OCTET_STRING, issuerKeyHash),
140 asn1_simple_object(ASN1_INTEGER, serialNumber)));
141 }
142
143 /**
144 * build requestList
145 */
146 static chunk_t build_requestList(private_x509_ocsp_request_t *this)
147 {
148 chunk_t issuerNameHash, issuerKeyHash;
149 identification_t *issuer;
150 x509_t *x509;
151 certificate_t *cert;
152 chunk_t list = chunk_empty;
153 public_key_t *public;
154
155 cert = (certificate_t*)this->ca;
156 public = cert->get_public_key(cert);
157 if (public)
158 {
159 hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
160 if (hasher)
161 {
162 identification_t *keyid = public->get_id(public, ID_PUBKEY_SHA1);
163 if (keyid)
164 {
165 enumerator_t *enumerator;
166
167 issuerKeyHash = keyid->get_encoding(keyid);
168
169 issuer = cert->get_subject(cert);
170 hasher->allocate_hash(hasher, issuer->get_encoding(issuer),
171 &issuerNameHash);
172 hasher->destroy(hasher);
173
174 enumerator = this->candidates->create_enumerator(this->candidates);
175 while (enumerator->enumerate(enumerator, &x509))
176 {
177 chunk_t request, serialNumber;
178
179 serialNumber = x509->get_serial(x509);
180 request = build_Request(this, issuerNameHash, issuerKeyHash,
181 serialNumber);
182 list = chunk_cat("mm", list, request);
183 }
184 enumerator->destroy(enumerator);
185 chunk_free(&issuerNameHash);
186 }
187 }
188 else
189 {
190 DBG1("creating OCSP request failed, SHA1 not supported");
191 }
192 public->destroy(public);
193 }
194 else
195 {
196 DBG1("creating OCSP request failed, CA certificate has no public key");
197 }
198 return asn1_wrap(ASN1_SEQUENCE, "m", list);
199 }
200
201 /**
202 * build nonce extension
203 */
204 static chunk_t build_nonce(private_x509_ocsp_request_t *this)
205 {
206 rng_t *rng;
207
208 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
209 if (rng)
210 {
211 rng->allocate_bytes(rng, NONCE_LEN, &this->nonce);
212 rng->destroy(rng);
213 return asn1_wrap(ASN1_SEQUENCE, "cm", ASN1_nonce_oid,
214 asn1_simple_object(ASN1_OCTET_STRING, this->nonce));
215 }
216 DBG1("creating OCSP request nonce failed, no RNG found");
217 return chunk_empty;
218 }
219
220 /**
221 * build acceptableResponses extension
222 */
223 static chunk_t build_acceptableResponses(private_x509_ocsp_request_t *this)
224 {
225 return asn1_wrap(ASN1_SEQUENCE, "cc",
226 ASN1_response_oid,
227 ASN1_response_content);
228 }
229
230 /**
231 * build requestExtensions
232 */
233 static chunk_t build_requestExtensions(private_x509_ocsp_request_t *this)
234 {
235 return asn1_wrap(ASN1_CONTEXT_C_2, "m",
236 asn1_wrap(ASN1_SEQUENCE, "mm",
237 build_nonce(this),
238 build_acceptableResponses(this)));
239 }
240
241 /**
242 * build tbsRequest
243 */
244 static chunk_t build_tbsRequest(private_x509_ocsp_request_t *this)
245 {
246 return asn1_wrap(ASN1_SEQUENCE, "mmm",
247 build_requestorName(this),
248 build_requestList(this),
249 build_requestExtensions(this));
250 }
251
252 /**
253 * Build the optionalSignature
254 */
255 static chunk_t build_optionalSignature(private_x509_ocsp_request_t *this,
256 chunk_t tbsRequest)
257 {
258 int oid;
259 signature_scheme_t scheme;
260 chunk_t certs, signature;
261
262 switch (this->key->get_type(this->key))
263 {
264 /* TODO: use a generic mapping function */
265 case KEY_RSA:
266 oid = OID_SHA1_WITH_RSA;
267 scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
268 break;
269 case KEY_ECDSA:
270 oid = OID_ECDSA_WITH_SHA1;
271 scheme = SIGN_ECDSA_WITH_SHA1;
272 break;
273 default:
274 DBG1("unable to sign OCSP request, %N signature not supported",
275 key_type_names, this->key->get_type(this->key));
276 return chunk_empty;
277 }
278
279 if (!this->key->sign(this->key, scheme, tbsRequest, &signature))
280 {
281 DBG1("creating OCSP signature failed, skipped");
282 return chunk_empty;
283 }
284 if (this->cert)
285 {
286 certs = asn1_wrap(ASN1_CONTEXT_C_0, "m",
287 asn1_wrap(ASN1_SEQUENCE, "m",
288 this->cert->get_encoding(this->cert)));
289 }
290 return asn1_wrap(ASN1_CONTEXT_C_0, "m",
291 asn1_wrap(ASN1_SEQUENCE, "cmm",
292 asn1_algorithmIdentifier(oid),
293 asn1_bitstring("m", signature),
294 certs));
295 }
296
297 /**
298 * Build the OCSPRequest data
299 *
300 */
301 static chunk_t build_OCSPRequest(private_x509_ocsp_request_t *this)
302 {
303 chunk_t tbsRequest, optionalSignature = chunk_empty;
304
305 tbsRequest = build_tbsRequest(this);
306 if (this->key)
307 {
308 optionalSignature = build_optionalSignature(this, tbsRequest);
309 }
310 return asn1_wrap(ASN1_SEQUENCE, "mm", tbsRequest, optionalSignature);
311 }
312
313
314 /**
315 * Implementation of certificate_t.get_type
316 */
317 static certificate_type_t get_type(private_x509_ocsp_request_t *this)
318 {
319 return CERT_X509_OCSP_REQUEST;
320 }
321
322 /**
323 * Implementation of certificate_t.get_subject
324 */
325 static identification_t* get_subject(private_x509_ocsp_request_t *this)
326 {
327 certificate_t *ca = (certificate_t*)this->ca;
328
329 if (this->requestor)
330 {
331 return this->requestor;
332 }
333 if (this->cert)
334 {
335 return this->cert->get_subject(this->cert);
336 }
337 return ca->get_subject(ca);
338 }
339
340 /**
341 * Implementation of certificate_t.get_issuer
342 */
343 static identification_t* get_issuer(private_x509_ocsp_request_t *this)
344 {
345 certificate_t *ca = (certificate_t*)this->ca;
346
347 return ca->get_subject(ca);
348 }
349
350 /**
351 * Implementation of certificate_t.has_subject.
352 */
353 static id_match_t has_subject(private_x509_ocsp_request_t *this,
354 identification_t *subject)
355 {
356 certificate_t *current;
357 enumerator_t *enumerator;
358 id_match_t match, best = ID_MATCH_NONE;
359
360 enumerator = this->candidates->create_enumerator(this->candidates);
361 while (enumerator->enumerate(enumerator, &current))
362 {
363 match = current->has_subject(current, subject);
364 if (match > best)
365 {
366 best = match;
367 }
368 }
369 enumerator->destroy(enumerator);
370 return best;
371 }
372
373 /**
374 * Implementation of certificate_t.has_subject.
375 */
376 static id_match_t has_issuer(private_x509_ocsp_request_t *this,
377 identification_t *issuer)
378 {
379 certificate_t *ca = (certificate_t*)this->ca;
380
381 return ca->has_subject(ca, issuer);
382 }
383
384 /**
385 * Implementation of certificate_t.issued_by
386 */
387 static bool issued_by(private_x509_ocsp_request_t *this, certificate_t *issuer)
388 {
389 DBG1("OCSP request validation not implemented!");
390 return FALSE;
391 }
392
393 /**
394 * Implementation of certificate_t.get_public_key
395 */
396 static public_key_t* get_public_key(private_x509_ocsp_request_t *this)
397 {
398 return NULL;
399 }
400
401 /**
402 * Implementation of x509_cert_t.get_validity.
403 */
404 static bool get_validity(private_x509_ocsp_request_t *this, time_t *when,
405 time_t *not_before, time_t *not_after)
406 {
407 certificate_t *cert;
408
409 if (this->cert)
410 {
411 cert = this->cert;
412 }
413 else
414 {
415 cert = (certificate_t*)this->ca;
416 }
417 return cert->get_validity(cert, when, not_before, not_after);
418 }
419
420 /**
421 * Implementation of certificate_t.get_encoding.
422 */
423 static chunk_t get_encoding(private_x509_ocsp_request_t *this)
424 {
425 return chunk_clone(this->encoding);
426 }
427
428 /**
429 * Implementation of certificate_t.equals.
430 */
431 static bool equals(private_x509_ocsp_request_t *this, certificate_t *other)
432 {
433 chunk_t encoding;
434 bool equal;
435
436 if (this == (private_x509_ocsp_request_t*)other)
437 {
438 return TRUE;
439 }
440 if (other->get_type(other) != CERT_X509_OCSP_REQUEST)
441 {
442 return FALSE;
443 }
444 if (other->equals == (void*)equals)
445 { /* skip allocation if we have the same implementation */
446 return chunk_equals(this->encoding, ((private_x509_ocsp_request_t*)other)->encoding);
447 }
448 encoding = other->get_encoding(other);
449 equal = chunk_equals(this->encoding, encoding);
450 free(encoding.ptr);
451 return equal;
452 }
453
454 /**
455 * Implementation of certificate_t.asdf
456 */
457 static private_x509_ocsp_request_t* get_ref(private_x509_ocsp_request_t *this)
458 {
459 ref_get(&this->ref);
460 return this;
461 }
462
463 /**
464 * Implementation of x509_ocsp_request_t.destroy
465 */
466 static void destroy(private_x509_ocsp_request_t *this)
467 {
468 if (ref_put(&this->ref))
469 {
470 DESTROY_IF((certificate_t*)this->ca);
471 DESTROY_IF(this->requestor);
472 DESTROY_IF(this->cert);
473 DESTROY_IF(this->key);
474 this->candidates->destroy_offset(this->candidates, offsetof(certificate_t, destroy));
475 chunk_free(&this->nonce);
476 chunk_free(&this->encoding);
477 free(this);
478 }
479 }
480
481 /**
482 * create an empty but initialized OCSP request
483 */
484 static private_x509_ocsp_request_t *create_empty()
485 {
486 private_x509_ocsp_request_t *this = malloc_thing(private_x509_ocsp_request_t);
487
488 this->public.interface.interface.get_type = (certificate_type_t (*)(certificate_t *this))get_type;
489 this->public.interface.interface.get_subject = (identification_t* (*)(certificate_t *this))get_subject;
490 this->public.interface.interface.get_issuer = (identification_t* (*)(certificate_t *this))get_issuer;
491 this->public.interface.interface.has_subject = (id_match_t(*)(certificate_t*, identification_t *subject))has_subject;
492 this->public.interface.interface.has_issuer = (id_match_t(*)(certificate_t*, identification_t *issuer))has_issuer;
493 this->public.interface.interface.issued_by = (bool (*)(certificate_t *this, certificate_t *issuer))issued_by;
494 this->public.interface.interface.get_public_key = (public_key_t* (*)(certificate_t *this))get_public_key;
495 this->public.interface.interface.get_validity = (bool(*)(certificate_t*, time_t *when, time_t *, time_t*))get_validity;
496 this->public.interface.interface.get_encoding = (chunk_t(*)(certificate_t*))get_encoding;
497 this->public.interface.interface.equals = (bool(*)(certificate_t*, certificate_t *other))equals;
498 this->public.interface.interface.get_ref = (certificate_t* (*)(certificate_t *this))get_ref;
499 this->public.interface.interface.destroy = (void (*)(certificate_t *this))destroy;
500
501 this->ca = NULL;
502 this->requestor = NULL;
503 this->cert = NULL;
504 this->key = NULL;
505 this->nonce = chunk_empty;
506 this->encoding = chunk_empty;
507 this->candidates = linked_list_create();
508 this->ref = 1;
509
510 return this;
511 }
512
513 typedef struct private_builder_t private_builder_t;
514 /**
515 * Builder implementation for certificate loading
516 */
517 struct private_builder_t {
518 /** implements the builder interface */
519 builder_t public;
520 /** OCSP request to build */
521 private_x509_ocsp_request_t *req;
522 };
523
524 /**
525 * Implementation of builder_t.build
526 */
527 static x509_ocsp_request_t *build(private_builder_t *this)
528 {
529 private_x509_ocsp_request_t *req;
530
531 req = this->req;
532 free(this);
533 if (req->ca)
534 {
535 req->encoding = build_OCSPRequest(req);
536 return &req->public;
537 }
538 destroy(req);
539 return NULL;
540 }
541
542 /**
543 * Implementation of builder_t.add
544 */
545 static void add(private_builder_t *this, builder_part_t part, ...)
546 {
547 va_list args;
548 certificate_t *cert;
549 identification_t *subject;
550 private_key_t *private;
551
552 va_start(args, part);
553 switch (part)
554 {
555 case BUILD_CA_CERT:
556 cert = va_arg(args, certificate_t*);
557 if (cert->get_type(cert) == CERT_X509)
558 {
559 this->req->ca = (x509_t*)cert->get_ref(cert);
560 }
561 break;
562 case BUILD_CERT:
563 cert = va_arg(args, certificate_t*);
564 if (cert->get_type(cert) == CERT_X509)
565 {
566 this->req->candidates->insert_last(this->req->candidates,
567 cert->get_ref(cert));
568 }
569 break;
570 case BUILD_SIGNING_CERT:
571 cert = va_arg(args, certificate_t*);
572 this->req->cert = cert->get_ref(cert);
573 break;
574 case BUILD_SIGNING_KEY:
575 private = va_arg(args, private_key_t*);
576 this->req->key = private->get_ref(private);
577 break;
578 case BUILD_SUBJECT:
579 subject = va_arg(args, identification_t*);
580 this->req->requestor = subject->clone(subject);
581 break;
582 default:
583 /* cancel if option not supported */
584 if (this->req)
585 {
586 destroy(this->req);
587 }
588 builder_cancel(&this->public);
589 break;
590 }
591 va_end(args);
592 }
593
594 /**
595 * Builder construction function
596 */
597 builder_t *x509_ocsp_request_builder(certificate_type_t type)
598 {
599 private_builder_t *this;
600
601 if (type != CERT_X509_OCSP_REQUEST)
602 {
603 return NULL;
604 }
605
606 this = malloc_thing(private_builder_t);
607
608 this->req = create_empty();
609 this->public.add = (void(*)(builder_t *this, builder_part_t part, ...))add;
610 this->public.build = (void*(*)(builder_t *this))build;
611
612 return &this->public;
613 }
614