src/libstrongswan/plugins/x509/x509_pkcs10.c

   1 /*
   2  * Copyright (C) 2005 Jan Hutter, Martin Willi
   3  * Copyright (C) 2009 Andreas Steffen
   4  *
   5  * HSR Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include "x509_pkcs10.h"
  19
  20 #include <library.h>
  21 #include <debug.h>
  22 #include <asn1/oid.h>
  23 #include <asn1/asn1.h>
  24 #include <asn1/asn1_parser.h>
  25 #include <credentials/keys/private_key.h>
  26 #include <utils/linked_list.h>
  27 #include <utils/identification.h>
  28
  29 typedef struct private_x509_pkcs10_t private_x509_pkcs10_t;
  30
  31 /**
  32  * Private data of a x509_pkcs10_t object.
  33  */
  34 struct private_x509_pkcs10_t {
  35         /**
  36          * Public interface for this certificate.
  37          */
  38         x509_pkcs10_t public;
  39
  40         /**
  41          * PKCS#10 certificate request encoding in ASN.1 DER format
  42          */
  43         chunk_t encoding;
  44
  45         /**
  46          * PKCS#10 request body over which signature is computed
  47          */
  48         chunk_t certificationRequestInfo;
  49
  50         /**
  51          * Version of the PKCS#10 certificate request
  52          */
  53         u_int version;
  54
  55         /**
  56          * ID representing the certificate subject
  57          */
  58         identification_t *subject;
  59
  60         /**
  61          * List of subjectAltNames as identification_t
  62          */
  63         linked_list_t *subjectAltNames;
  64
  65         /**
  66          * certificate's embedded public key
  67          */
  68         public_key_t *public_key;
  69
  70         /**
  71          * challenge password
  72          */
  73         chunk_t challengePassword;
  74
  75         /**
  76          * Signature algorithm
  77          */
  78         int algorithm;
  79
  80         /**
  81          * Signature
  82          */
  83         chunk_t signature;
  84
  85         /**
  86          * Is the certificate request self-signed?
  87          */
  88         bool self_signed;
  89
  90         /**
  91          * Certificate request parsed from blob/file?
  92          */
  93         bool parsed;
  94
  95         /**
  96          * reference count
  97          */
  98         refcount_t ref;
  99 };
 100
 101 /**
 102  * Imported from x509_cert.c
 103  */
 104 extern void x509_parse_generalNames(chunk_t blob, int level0, bool implicit, linked_list_t *list);
 105 extern chunk_t x509_build_subjectAltNames(linked_list_t *list);
 106
 107 METHOD(certificate_t, get_type, certificate_type_t,
 108         private_x509_pkcs10_t *this)
 109 {
 110         return CERT_PKCS10_REQUEST;
 111 }
 112
 113 METHOD(certificate_t, get_subject, identification_t*,
 114         private_x509_pkcs10_t *this)
 115 {
 116         return this->subject;
 117 }
 118
 119 METHOD(certificate_t, has_subject, id_match_t,
 120         private_x509_pkcs10_t *this, identification_t *subject)
 121 {
 122         return this->subject->matches(this->subject, subject);
 123 }
 124
 125 METHOD(certificate_t, issued_by, bool,
 126         private_x509_pkcs10_t *this, certificate_t *issuer,
 127         signature_scheme_t *schemep)
 128 {
 129         public_key_t *key;
 130         signature_scheme_t scheme;
 131         bool valid;
 132
 133         if (&this->public.interface.interface != issuer)
 134         {
 135                 return FALSE;
 136         }
 137         if (this->self_signed)
 138         {
 139                 return TRUE;
 140         }
 141
 142         /* determine signature scheme */
 143         scheme = signature_scheme_from_oid(this->algorithm);
 144         if (scheme == SIGN_UNKNOWN)
 145         {
 146                 return FALSE;
 147         }
 148
 149         /* get the public key contained in the certificate request */
 150         key = this->public_key;
 151         if (!key)
 152         {
 153                 return FALSE;
 154         }
 155         valid = key->verify(key, scheme, this->certificationRequestInfo,
 156                                                 this->signature);
 157         if (valid && schemep)
 158         {
 159                 *schemep = scheme;
 160         }
 161         return valid;
 162 }
 163
 164 METHOD(certificate_t, get_public_key, public_key_t*,
 165         private_x509_pkcs10_t *this)
 166 {
 167         this->public_key->get_ref(this->public_key);
 168         return this->public_key;
 169 }
 170
 171 METHOD(certificate_t, get_validity, bool,
 172         private_x509_pkcs10_t *this, time_t *when, time_t *not_before,
 173         time_t *not_after)
 174 {
 175         if (not_before)
 176         {
 177                 *not_before = 0;
 178         }
 179         if (not_after)
 180         {
 181                 *not_after = ~0;
 182         }
 183         return TRUE;
 184 }
 185
 186 METHOD(certificate_t, get_encoding, bool,
 187         private_x509_pkcs10_t *this, cred_encoding_type_t type, chunk_t *encoding)
 188 {
 189         if (type == CERT_ASN1_DER)
 190         {
 191                 *encoding = chunk_clone(this->encoding);
 192                 return TRUE;
 193         }
 194         return lib->encoding->encode(lib->encoding, type, NULL, encoding,
 195                                         CRED_PART_PKCS10_ASN1_DER, this->encoding, CRED_PART_END);
 196 }
 197
 198 METHOD(certificate_t, equals, bool,
 199         private_x509_pkcs10_t *this, certificate_t *other)
 200 {
 201         chunk_t encoding;
 202         bool equal;
 203
 204         if (this == (private_x509_pkcs10_t*)other)
 205         {
 206                 return TRUE;
 207         }
 208         if (other->get_type(other) != CERT_PKCS10_REQUEST)
 209         {
 210                 return FALSE;
 211         }
 212         if (other->equals == (void*)equals)
 213         {       /* skip allocation if we have the same implementation */
 214                 return chunk_equals(this->encoding, ((private_x509_pkcs10_t*)other)->encoding);
 215         }
 216         if (!other->get_encoding(other, CERT_ASN1_DER, &encoding))
 217         {
 218                 return FALSE;
 219         }
 220         equal = chunk_equals(this->encoding, encoding);
 221         free(encoding.ptr);
 222         return equal;
 223 }
 224
 225 METHOD(certificate_t, get_ref, certificate_t*,
 226         private_x509_pkcs10_t *this)
 227 {
 228         ref_get(&this->ref);
 229         return &this->public.interface.interface;
 230 }
 231
 232 METHOD(pkcs10_t, get_challengePassword, chunk_t,
 233         private_x509_pkcs10_t *this)
 234 {
 235         return this->challengePassword;
 236 }
 237
 238 METHOD(pkcs10_t, create_subjectAltName_enumerator, enumerator_t*,
 239         private_x509_pkcs10_t *this)
 240 {
 241         return this->subjectAltNames->create_enumerator(this->subjectAltNames);
 242 }
 243
 244 /**
 245  * ASN.1 definition of a PKCS#10 extension request
 246  */
 247 static const asn1Object_t extensionRequestObjects[] = {
 248         { 0, "extensions",   ASN1_SEQUENCE,     ASN1_LOOP           }, /* 0 */
 249         { 1,   "extension",   ASN1_SEQUENCE,     ASN1_NONE          }, /* 1 */
 250         { 2,     "extnID",        ASN1_OID,          ASN1_BODY          }, /* 2 */
 251         { 2,     "critical",  ASN1_BOOLEAN,      ASN1_DEF|ASN1_BODY }, /* 3 */
 252         { 2,     "extnValue", ASN1_OCTET_STRING, ASN1_BODY          }, /* 4 */
 253         { 1, "end loop",      ASN1_EOC,          ASN1_END                       }, /* 5 */
 254         { 0, "exit",          ASN1_EOC,          ASN1_EXIT          }
 255 };
 256 #define PKCS10_EXTN_ID                  2
 257 #define PKCS10_EXTN_CRITICAL    3
 258 #define PKCS10_EXTN_VALUE               4
 259
 260 /**
 261  * Parses a PKCS#10 extension request
 262  */
 263 static bool parse_extension_request(private_x509_pkcs10_t *this, chunk_t blob, int level0)
 264 {
 265         asn1_parser_t *parser;
 266         chunk_t object;
 267         int objectID;
 268         int extn_oid = OID_UNKNOWN;
 269         bool success = FALSE;
 270         bool critical;
 271
 272         parser = asn1_parser_create(extensionRequestObjects, blob);
 273         parser->set_top_level(parser, level0);
 274
 275         while (parser->iterate(parser, &objectID, &object))
 276         {
 277                 u_int level = parser->get_level(parser)+1;
 278
 279                 switch (objectID)
 280                 {
 281                         case PKCS10_EXTN_ID:
 282                                 extn_oid = asn1_known_oid(object);
 283                                 break;
 284                         case PKCS10_EXTN_CRITICAL:
 285                                 critical = object.len && *object.ptr;
 286                                 DBG2(DBG_ASN, "  %s", critical ? "TRUE" : "FALSE");
 287                                 break;
 288                         case PKCS10_EXTN_VALUE:
 289                         {
 290                                 switch (extn_oid)
 291                                 {
 292                                         case OID_SUBJECT_ALT_NAME:
 293                                                 x509_parse_generalNames(object, level, FALSE,
 294                                                                                                 this->subjectAltNames);
 295                                                 break;
 296                                         default:
 297                                                 break;
 298                                 }
 299                                 break;
 300                         }
 301                         default:
 302                                 break;
 303                 }
 304         }
 305         success = parser->success(parser);
 306         parser->destroy(parser);
 307         return success;
 308 }
 309
 310 /**
 311  * Parses a PKCS#10 challenge password
 312  */
 313 static bool parse_challengePassword(private_x509_pkcs10_t *this, chunk_t blob, int level)
 314 {
 315         char tag;
 316
 317         if (blob.len < 2)
 318         {
 319                 DBG1(DBG_ASN, "L%d - challengePassword:  ASN.1 object smaller "
 320                          "than 2 octets", level);
 321                 return FALSE;
 322         }
 323         tag = *blob.ptr;
 324         if (tag < ASN1_UTF8STRING || tag > ASN1_IA5STRING)
 325         {
 326                 DBG1(DBG_ASN, "L%d - challengePassword:  ASN.1 object is not "
 327                          "a character string", level);
 328                 return FALSE;
 329         }
 330         if (asn1_length(&blob) == ASN1_INVALID_LENGTH)
 331         {
 332                 DBG1(DBG_ASN, "L%d - challengePassword:  ASN.1 object has an "
 333                          "invalid length", level);
 334                 return FALSE;
 335         }
 336         DBG2(DBG_ASN, "L%d - challengePassword:", level);
 337         DBG4(DBG_ASN, "  '%.*s'", (int)blob.len, blob.ptr);
 338         return TRUE;
 339 }
 340
 341 /**
 342  * ASN.1 definition of a PKCS#10 certificate request
 343  */
 344 static const asn1Object_t certificationRequestObjects[] = {
 345         { 0, "certificationRequest",       ASN1_SEQUENCE,    ASN1_OBJ  }, /*  0 */
 346         { 1,   "certificationRequestInfo", ASN1_SEQUENCE,    ASN1_OBJ  }, /*  1 */
 347         { 2,     "version",                ASN1_INTEGER,     ASN1_BODY }, /*  2 */
 348         { 2,     "subject",                ASN1_SEQUENCE,    ASN1_OBJ  }, /*  3 */
 349         { 2,     "subjectPublicKeyInfo",   ASN1_SEQUENCE,    ASN1_RAW  }, /*  4 */
 350         { 2,     "attributes",             ASN1_CONTEXT_C_0, ASN1_LOOP }, /*  5 */
 351         { 3,       "attribute",            ASN1_SEQUENCE,    ASN1_NONE }, /*  6 */
 352         { 4,         "type",               ASN1_OID,         ASN1_BODY }, /*  7 */
 353         { 4,         "values",             ASN1_SET,         ASN1_LOOP }, /*  8 */
 354         { 5,           "value",            ASN1_EOC,         ASN1_RAW  }, /*  9 */
 355         { 4,         "end loop",           ASN1_EOC,         ASN1_END  }, /* 10 */
 356         { 2,     "end loop",               ASN1_EOC,         ASN1_END  }, /* 11 */
 357         { 1,   "signatureAlgorithm",       ASN1_EOC,         ASN1_RAW  }, /* 12 */
 358         { 1,    "signature",               ASN1_BIT_STRING,  ASN1_BODY }, /* 13 */
 359         { 0, "exit",                       ASN1_EOC,         ASN1_EXIT }
 360 };
 361 #define PKCS10_CERT_REQUEST_INFO                 1
 362 #define PKCS10_VERSION                                   2
 363 #define PKCS10_SUBJECT                                   3
 364 #define PKCS10_SUBJECT_PUBLIC_KEY_INFO   4
 365 #define PKCS10_ATTR_TYPE                                 7
 366 #define PKCS10_ATTR_VALUE                                9
 367 #define PKCS10_ALGORITHM                                12
 368 #define PKCS10_SIGNATURE                                13
 369
 370 /**
 371  * Parses a PKCS#10 certificate request
 372  */
 373 static bool parse_certificate_request(private_x509_pkcs10_t *this)
 374 {
 375         asn1_parser_t *parser;
 376         chunk_t object;
 377         int objectID;
 378         int attr_oid = OID_UNKNOWN;
 379         bool success = FALSE;
 380
 381         parser = asn1_parser_create(certificationRequestObjects, this->encoding);
 382
 383         while (parser->iterate(parser, &objectID, &object))
 384         {
 385                 u_int level = parser->get_level(parser)+1;
 386
 387                 switch (objectID)
 388                 {
 389                         case PKCS10_CERT_REQUEST_INFO:
 390                                 this->certificationRequestInfo = object;
 391                                 break;
 392                         case PKCS10_VERSION:
 393                                 if (object.len > 0 && *object.ptr != 0)
 394                                 {
 395                                         DBG1(DBG_ASN, "PKCS#10 certificate request format is "
 396                                                  "not version 1");
 397                                         goto end;
 398                                 }
 399                                 break;
 400                         case PKCS10_SUBJECT:
 401                                 this->subject = identification_create_from_encoding(ID_DER_ASN1_DN, object);
 402                                 DBG2(DBG_ASN, "  '%Y'", this->subject);
 403                                 break;
 404                         case PKCS10_SUBJECT_PUBLIC_KEY_INFO:
 405                                 this->public_key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY,
 406                                                 KEY_ANY, BUILD_BLOB_ASN1_DER, object, BUILD_END);
 407                                 if (this->public_key == NULL)
 408                                 {
 409                                         goto end;
 410                                 }
 411                                 break;
 412                         case PKCS10_ATTR_TYPE:
 413                                 attr_oid = asn1_known_oid(object);
 414                                 break;
 415                         case PKCS10_ATTR_VALUE:
 416                                 switch (attr_oid)
 417                                 {
 418                                         case OID_EXTENSION_REQUEST:
 419                                                 if (!parse_extension_request(this, object, level))
 420                                                 {
 421                                                         goto end;
 422                                                 }
 423                                                 break;
 424                                         case OID_CHALLENGE_PASSWORD:
 425                                                 if (!parse_challengePassword(this, object, level))
 426                                                 {
 427                                                         goto end;
 428                                                 }
 429                                                 break;
 430                                         default:
 431                                                 break;
 432                                 }
 433                                 break;
 434                         case PKCS10_ALGORITHM:
 435                                 this->algorithm = asn1_parse_algorithmIdentifier(object, level, NULL);
 436                                 break;
 437                         case PKCS10_SIGNATURE:
 438                                 this->signature = object;
 439                                 break;
 440                         default:
 441                                 break;
 442                 }
 443         }
 444         success = parser->success(parser);
 445
 446 end:
 447         parser->destroy(parser);
 448         if (success)
 449         {
 450                 /* check if the certificate request is self-signed */
 451                 if (issued_by(this, &this->public.interface.interface, NULL))
 452                 {
 453                         this->self_signed = TRUE;
 454                 }
 455                 else
 456                 {
 457                         DBG1(DBG_LIB, "certificate request is not self-signed");
 458                         success = FALSE;
 459                 }
 460         }
 461         return success;
 462 }
 463
 464 METHOD(certificate_t, destroy, void,
 465         private_x509_pkcs10_t *this)
 466 {
 467         if (ref_put(&this->ref))
 468         {
 469                 this->subjectAltNames->destroy_offset(this->subjectAltNames,
 470                                                                         offsetof(identification_t, destroy));
 471                 DESTROY_IF(this->subject);
 472                 DESTROY_IF(this->public_key);
 473                 chunk_free(&this->encoding);
 474                 if (!this->parsed)
 475                 {       /* only parsed certificate requests point these fields to "encoded" */
 476                         chunk_free(&this->certificationRequestInfo);
 477                         chunk_free(&this->challengePassword);
 478                         chunk_free(&this->signature);
 479                 }
 480                 free(this);
 481         }
 482 }
 483
 484 /**
 485  * create an empty but initialized PKCS#10 certificate request
 486  */
 487 static private_x509_pkcs10_t* create_empty(void)
 488 {
 489         private_x509_pkcs10_t *this;
 490
 491         INIT(this,
 492                 .public = {
 493                         .interface = {
 494                                 .interface = {
 495                                         .get_type = _get_type,
 496                                         .get_subject = _get_subject,
 497                                         .get_issuer = _get_subject,
 498                                         .has_subject = _has_subject,
 499                                         .has_issuer = _has_subject,
 500                                         .issued_by = _issued_by,
 501                                         .get_public_key = _get_public_key,
 502                                         .get_validity = _get_validity,
 503                                         .get_encoding = _get_encoding,
 504                                         .equals = _equals,
 505                                         .get_ref = _get_ref,
 506                                         .destroy = _destroy,
 507                                 },
 508                                 .get_challengePassword = _get_challengePassword,
 509                                 .create_subjectAltName_enumerator = _create_subjectAltName_enumerator,
 510                         },
 511                 },
 512                 .subjectAltNames = linked_list_create(),
 513                 .ref = 1,
 514         );
 515
 516         return this;
 517 }
 518
 519 /**
 520  * Generate and sign a new certificate request
 521  */
 522 static bool generate(private_x509_pkcs10_t *cert, private_key_t *sign_key,
 523                                          int digest_alg)
 524 {
 525         chunk_t key_info, subjectAltNames, attributes;
 526         chunk_t extensionRequest  = chunk_empty;
 527         chunk_t challengePassword = chunk_empty;
 528         signature_scheme_t scheme;
 529         identification_t *subject;
 530
 531         subject = cert->subject;
 532         cert->public_key = sign_key->get_public_key(sign_key);
 533
 534         /* select signature scheme */
 535         cert->algorithm = hasher_signature_algorithm_to_oid(digest_alg,
 536                                                                         sign_key->get_type(sign_key));
 537         if (cert->algorithm == OID_UNKNOWN)
 538         {
 539                 return FALSE;
 540         }
 541         scheme = signature_scheme_from_oid(cert->algorithm);
 542
 543         if (!cert->public_key->get_encoding(cert->public_key,
 544                                                                                 PUBKEY_SPKI_ASN1_DER, &key_info))
 545         {
 546                 return FALSE;
 547         }
 548
 549         /* encode subjectAltNames */
 550         subjectAltNames = x509_build_subjectAltNames(cert->subjectAltNames);
 551
 552         if (subjectAltNames.ptr)
 553         {
 554                 extensionRequest = asn1_wrap(ASN1_SEQUENCE, "mm",
 555                                         asn1_build_known_oid(OID_EXTENSION_REQUEST),
 556                                         asn1_wrap(ASN1_SET, "m",
 557                                                 asn1_wrap(ASN1_SEQUENCE, "m", subjectAltNames)
 558                                         ));
 559         }
 560         if (cert->challengePassword.len > 0)
 561         {
 562                 asn1_t type = asn1_is_printablestring(cert->challengePassword) ?
 563                                                                 ASN1_PRINTABLESTRING : ASN1_T61STRING;
 564
 565                 challengePassword = asn1_wrap(ASN1_SEQUENCE, "mm",
 566                                         asn1_build_known_oid(OID_CHALLENGE_PASSWORD),
 567                                         asn1_wrap(ASN1_SET, "m",
 568                                                 asn1_simple_object(type, cert->challengePassword)
 569                                         )
 570                         );
 571         }
 572         attributes = asn1_wrap(ASN1_CONTEXT_C_0, "mm", extensionRequest,
 573                                                                                                    challengePassword);
 574
 575         cert->certificationRequestInfo = asn1_wrap(ASN1_SEQUENCE, "ccmm",
 576                                                         ASN1_INTEGER_0,
 577                                                         subject->get_encoding(subject),
 578                                                         key_info,
 579                                                         attributes);
 580
 581         if (!sign_key->sign(sign_key, scheme, cert->certificationRequestInfo,
 582                                                 &cert->signature))
 583         {
 584                 return FALSE;
 585         }
 586
 587         cert->encoding = asn1_wrap(ASN1_SEQUENCE, "cmm",
 588                                                            cert->certificationRequestInfo,
 589                                                            asn1_algorithmIdentifier(cert->algorithm),
 590                                                            asn1_bitstring("c", cert->signature));
 591         return TRUE;
 592 }
 593
 594 /**
 595  * See header.
 596  */
 597 x509_pkcs10_t *x509_pkcs10_load(certificate_type_t type, va_list args)
 598 {
 599         chunk_t blob = chunk_empty;
 600
 601         while (TRUE)
 602         {
 603                 switch (va_arg(args, builder_part_t))
 604                 {
 605                         case BUILD_BLOB_ASN1_DER:
 606                                 blob = va_arg(args, chunk_t);
 607                                 continue;
 608                         case BUILD_END:
 609                                 break;
 610                         default:
 611                                 return NULL;
 612                 }
 613                 break;
 614         }
 615
 616         if (blob.ptr)
 617         {
 618                 private_x509_pkcs10_t *cert = create_empty();
 619
 620                 cert->encoding = chunk_clone(blob);
 621                 cert->parsed = TRUE;
 622                 if (parse_certificate_request(cert))
 623                 {
 624                         return &cert->public;
 625                 }
 626                 destroy(cert);
 627         }
 628         return NULL;
 629 }
 630
 631 /**
 632  * See header.
 633  */
 634 x509_pkcs10_t *x509_pkcs10_gen(certificate_type_t type, va_list args)
 635 {
 636         private_x509_pkcs10_t *cert;
 637         private_key_t *sign_key = NULL;
 638         hash_algorithm_t digest_alg = HASH_SHA1;
 639
 640         cert = create_empty();
 641         while (TRUE)
 642         {
 643                 switch (va_arg(args, builder_part_t))
 644                 {
 645                         case BUILD_SIGNING_KEY:
 646                                 sign_key = va_arg(args, private_key_t*);
 647                                 continue;
 648                         case BUILD_SUBJECT:
 649                                 cert->subject = va_arg(args, identification_t*);
 650                                 cert->subject = cert->subject->clone(cert->subject);
 651                                 continue;
 652                         case BUILD_SUBJECT_ALTNAMES:
 653                         {
 654                                 enumerator_t *enumerator;
 655                                 identification_t *id;
 656                                 linked_list_t *list;
 657
 658                                 list = va_arg(args, linked_list_t*);
 659                                 enumerator = list->create_enumerator(list);
 660                                 while (enumerator->enumerate(enumerator, &id))
 661                                 {
 662                                         cert->subjectAltNames->insert_last(cert->subjectAltNames,
 663                                                                                                            id->clone(id));
 664                                 }
 665                                 enumerator->destroy(enumerator);
 666                                 continue;
 667                         }
 668                         case BUILD_CHALLENGE_PWD:
 669                                 cert->challengePassword = chunk_clone(va_arg(args, chunk_t));
 670                                 continue;
 671                         case BUILD_DIGEST_ALG:
 672                                 digest_alg = va_arg(args, int);
 673                                 continue;
 674                         case BUILD_END:
 675                                 break;
 676                         default:
 677                                 destroy(cert);
 678                                 return NULL;
 679                 }
 680                 break;
 681         }
 682
 683         if (sign_key && generate(cert, sign_key, digest_alg))
 684         {
 685                 return &cert->public;
 686         }
 687         destroy(cert);
 688         return NULL;
 689 }
 690