/* * Copyright (c) 2006 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * 3. Neither the name of the Institute nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include "hx_locl.h" #include struct hx509_request_data { hx509_name name; SubjectPublicKeyInfo key; ExtKeyUsage eku; GeneralNames san; }; /* * */ HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_init(hx509_context context, hx509_request *req) { *req = calloc(1, sizeof(**req)); if (*req == NULL) return ENOMEM; return 0; } HX509_LIB_FUNCTION void HX509_LIB_CALL hx509_request_free(hx509_request *req) { if ((*req)->name) hx509_name_free(&(*req)->name); free_SubjectPublicKeyInfo(&(*req)->key); free_ExtKeyUsage(&(*req)->eku); free_GeneralNames(&(*req)->san); memset(*req, 0, sizeof(**req)); free(*req); *req = NULL; } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_set_name(hx509_context context, hx509_request req, hx509_name name) { if (req->name) hx509_name_free(&req->name); if (name) { int ret = hx509_name_copy(context, name, &req->name); if (ret) return ret; } return 0; } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_get_name(hx509_context context, hx509_request req, hx509_name *name) { if (req->name == NULL) { hx509_set_error_string(context, 0, EINVAL, "Request have no name"); return EINVAL; } return hx509_name_copy(context, req->name, name); } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_set_SubjectPublicKeyInfo(hx509_context context, hx509_request req, const SubjectPublicKeyInfo *key) { free_SubjectPublicKeyInfo(&req->key); return copy_SubjectPublicKeyInfo(key, &req->key); } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_get_SubjectPublicKeyInfo(hx509_context context, hx509_request req, SubjectPublicKeyInfo *key) { return copy_SubjectPublicKeyInfo(&req->key, key); } HX509_LIB_FUNCTION int HX509_LIB_CALL _hx509_request_add_eku(hx509_context context, hx509_request req, const heim_oid *oid) { void *val; int ret; val = realloc(req->eku.val, sizeof(req->eku.val[0]) * (req->eku.len + 1)); if (val == NULL) return ENOMEM; req->eku.val = val; ret = der_copy_oid(oid, &req->eku.val[req->eku.len]); if (ret) return ret; req->eku.len += 1; return 0; } HX509_LIB_FUNCTION int HX509_LIB_CALL _hx509_request_add_dns_name(hx509_context context, hx509_request req, const char *hostname) { GeneralName name; memset(&name, 0, sizeof(name)); name.element = choice_GeneralName_dNSName; name.u.dNSName.data = rk_UNCONST(hostname); name.u.dNSName.length = strlen(hostname); return add_GeneralNames(&req->san, &name); } HX509_LIB_FUNCTION int HX509_LIB_CALL _hx509_request_add_email(hx509_context context, hx509_request req, const char *email) { GeneralName name; memset(&name, 0, sizeof(name)); name.element = choice_GeneralName_rfc822Name; name.u.dNSName.data = rk_UNCONST(email); name.u.dNSName.length = strlen(email); return add_GeneralNames(&req->san, &name); } HX509_LIB_FUNCTION int HX509_LIB_CALL _hx509_request_to_pkcs10(hx509_context context, const hx509_request req, const hx509_private_key signer, heim_octet_string *request) { CertificationRequest r; heim_octet_string data, os; int ret; size_t size; if (req->name == NULL) { hx509_set_error_string(context, 0, EINVAL, "PKCS10 needs to have a subject"); return EINVAL; } memset(&r, 0, sizeof(r)); memset(request, 0, sizeof(*request)); r.certificationRequestInfo.version = pkcs10_v1; ret = copy_Name(&req->name->der_name, &r.certificationRequestInfo.subject); if (ret) goto out; ret = copy_SubjectPublicKeyInfo(&req->key, &r.certificationRequestInfo.subjectPKInfo); if (ret) goto out; r.certificationRequestInfo.attributes = calloc(1, sizeof(*r.certificationRequestInfo.attributes)); if (r.certificationRequestInfo.attributes == NULL) { ret = ENOMEM; goto out; } ASN1_MALLOC_ENCODE(CertificationRequestInfo, data.data, data.length, &r.certificationRequestInfo, &size, ret); if (ret) goto out; if (data.length != size) abort(); ret = _hx509_create_signature(context, signer, _hx509_crypto_default_sig_alg, &data, &r.signatureAlgorithm, &os); free(data.data); if (ret) goto out; r.signature.data = os.data; r.signature.length = os.length * 8; ASN1_MALLOC_ENCODE(CertificationRequest, data.data, data.length, &r, &size, ret); if (ret) goto out; if (data.length != size) abort(); *request = data; out: free_CertificationRequest(&r); return ret; } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_parse_der(hx509_context context, heim_octet_string *der, hx509_request *req) { CertificationRequestInfo *rinfo = NULL; CertificationRequest r; Certificate c; hx509_name subject = NULL; hx509_cert signer = NULL; size_t size; int ret; ret = decode_CertificationRequest(der->data, der->length, &r, &size); if (ret) { hx509_set_error_string(context, 0, ret, "Failed to decode CSR"); return ret; } rinfo = &r.certificationRequestInfo; if (ret == 0) { /* * Sadly we need an hx509_cert here because _hx509_verify_signature_*() * functions want one as a signer even though all the verification * functions that use the signer argument always only use the spki of * the signer certificate. * * XXX Change struct signature_alg's verify_signature's prototype to * use an spki instead of an hx509_cert as the signer! The we * won't have to do this. */ memset(&c, 0, sizeof(c)); c.tbsCertificate.subjectPublicKeyInfo = rinfo->subjectPKInfo; if ((signer = hx509_cert_init(context, &c, NULL)) == NULL) ret = ENOMEM; } /* Verify the signature */ if (ret == 0) { heim_octet_string *d = &r.certificationRequestInfo._save; ret = _hx509_verify_signature_bitstring(context, signer, &r.signatureAlgorithm, d, &r.signature); if (ret) hx509_set_error_string(context, 0, ret, "CSR signature verification failed"); } /* Build and populate the hx509_request */ if (ret == 0) ret = hx509_request_init(context, req); if (ret == 0) ret = hx509_request_set_SubjectPublicKeyInfo(context, *req, &rinfo->subjectPKInfo); if (ret == 0) ret = _hx509_name_from_Name(&rinfo->subject, &subject); if (ret == 0) ret = hx509_request_set_name(context, *req, subject); /* * XXX Extract EKUs and SANs from the CSR's attributes. That means looking * for an attr of OID asn1_oid_id_x509_ce_subjectAltName * (id-ce-subjectAltName) and decoding their values. See RFC5912. */ if (subject) hx509_name_free(&subject); if (signer) hx509_cert_free(signer); if (ret) hx509_request_free(req); free_CertificationRequest(&r); return ret; } HX509_LIB_FUNCTION int HX509_LIB_CALL hx509_request_parse(hx509_context context, const char *csr, hx509_request *req) { heim_octet_string d; int ret; /* XXX Add support for PEM */ if (strncmp(csr, "PKCS10:", 7) != 0) { hx509_set_error_string(context, 0, HX509_UNSUPPORTED_OPERATION, "unsupport type in %s", csr); return HX509_UNSUPPORTED_OPERATION; } ret = rk_undumpdata(csr + 7, &d.data, &d.length); if (ret) { hx509_set_error_string(context, 0, ret, "Could not read %s", csr); return ret; } ret = hx509_request_parse_der(context, &d, req); free(d.data); if (ret) hx509_set_error_string(context, HX509_ERROR_APPEND, ret, " (while parsing CSR from %s)", csr); return ret; } HX509_LIB_FUNCTION int HX509_LIB_CALL _hx509_request_print(hx509_context context, hx509_request req, FILE *f) { int ret; if (req->name) { char *subject; ret = hx509_name_to_string(req->name, &subject); if (ret) { hx509_set_error_string(context, 0, ret, "Failed to print name"); return ret; } fprintf(f, "name: %s\n", subject); free(subject); } return 0; }