monotone

monotone Mtn Source Tree

Root/botan/x509_ext.cpp

1/*************************************************
2* X.509 Certificate Extensions Source File *
3* (C) 1999-2007 The Botan Project *
4*************************************************/
5
6#include <botan/x509_ext.h>
7#include <botan/x509stat.h>
8#include <botan/libstate.h>
9#include <botan/der_enc.h>
10#include <botan/ber_dec.h>
11#include <botan/lookup.h>
12#include <botan/oids.h>
13#include <botan/config.h>
14#include <botan/bit_ops.h>
15#include <algorithm>
16#include <memory>
17
18namespace Botan {
19
20/*************************************************
21* Return the OID of this extension *
22*************************************************/
23OID Certificate_Extension::oid_of() const
24 {
25 return OIDS::lookup(oid_name());
26 }
27
28/*************************************************
29* Encode an Extensions list *
30*************************************************/
31void Extensions::encode_into(DER_Encoder& to_object) const
32 {
33 for(u32bit j = 0; j != extensions.size(); ++j)
34 {
35 const Certificate_Extension* ext = extensions[j];
36
37 std::string setting;
38
39 if(ext->config_id() != "")
40 setting = global_config().option("x509/exts/" + ext->config_id());
41
42 if(setting == "")
43 setting = "yes";
44
45 if(setting != "yes" && setting != "no" && setting != "critical")
46 throw Invalid_Argument("X509_CA:: Invalid value for option "
47 "x509/exts/" + ext->config_id() + " of " +
48 setting);
49
50 bool is_critical = (setting == "critical");
51 bool should_encode = ext->should_encode() && (setting != "no");
52
53 if(should_encode)
54 {
55 to_object.start_cons(SEQUENCE)
56 .encode(ext->oid_of())
57 .encode_optional(is_critical, false)
58 .encode(ext->encode_inner(), OCTET_STRING)
59 .end_cons();
60 }
61 }
62 }
63
64/*************************************************
65* Decode a list of Extensions *
66*************************************************/
67void Extensions::decode_from(BER_Decoder& from_source)
68 {
69 for(u32bit j = 0; j != extensions.size(); ++j)
70 delete extensions[j];
71 extensions.clear();
72
73 BER_Decoder sequence = from_source.start_cons(SEQUENCE);
74 while(sequence.more_items())
75 {
76 OID oid;
77 MemoryVector<byte> value;
78 bool critical;
79
80 sequence.start_cons(SEQUENCE)
81 .decode(oid)
82 .decode_optional(critical, BOOLEAN, UNIVERSAL, false)
83 .decode(value, OCTET_STRING)
84 .verify_end()
85 .end_cons();
86
87 Certificate_Extension* ext =
88 global_state().x509_state().get_extension(oid);
89
90 if(!ext)
91 {
92 if(!critical || !should_throw)
93 continue;
94
95 throw Decoding_Error("Encountered unknown X.509 extension marked "
96 "as critical; OID = " + oid.as_string());
97 }
98
99 ext->decode_inner(value);
100
101 extensions.push_back(ext);
102 }
103 sequence.verify_end();
104 }
105
106/*************************************************
107* Write the extensions to an info store *
108*************************************************/
109void Extensions::contents_to(Data_Store& subject_info,
110 Data_Store& issuer_info) const
111 {
112 for(u32bit j = 0; j != extensions.size(); ++j)
113 extensions[j]->contents_to(subject_info, issuer_info);
114 }
115
116/*************************************************
117* Copy another extensions list *
118*************************************************/
119Extensions& Extensions::copy_this(const Extensions& other)
120 {
121 for(u32bit j = 0; j != extensions.size(); ++j)
122 delete extensions[j];
123 extensions.clear();
124
125 for(u32bit j = 0; j != other.extensions.size(); ++j)
126 extensions.push_back(other.extensions[j]->copy());
127
128 return (*this);
129 }
130
131/*************************************************
132* Delete an Extensions list *
133*************************************************/
134Extensions::~Extensions()
135 {
136 for(u32bit j = 0; j != extensions.size(); ++j)
137 delete extensions[j];
138 }
139
140namespace Cert_Extension {
141
142/*************************************************
143* Checked accessor for the path_limit member *
144*************************************************/
145u32bit Basic_Constraints::get_path_limit() const
146 {
147 if(!is_ca)
148 throw Invalid_State("Basic_Constraints::get_path_limit: Not a CA");
149 return path_limit;
150 }
151
152/*************************************************
153* Encode the extension *
154*************************************************/
155MemoryVector<byte> Basic_Constraints::encode_inner() const
156 {
157 return DER_Encoder()
158 .start_cons(SEQUENCE)
159 .encode_if(is_ca,
160 DER_Encoder()
161 .encode(is_ca)
162 .encode_optional(path_limit, NO_CERT_PATH_LIMIT)
163 )
164 .end_cons()
165 .get_contents();
166 }
167
168/*************************************************
169* Decode the extension *
170*************************************************/
171void Basic_Constraints::decode_inner(const MemoryRegion<byte>& in)
172 {
173 BER_Decoder(in)
174 .start_cons(SEQUENCE)
175 .decode_optional(is_ca, BOOLEAN, UNIVERSAL, false)
176 .decode_optional(path_limit, INTEGER, UNIVERSAL, NO_CERT_PATH_LIMIT)
177 .verify_end()
178 .end_cons();
179
180 if(is_ca == false)
181 path_limit = 0;
182 }
183
184/*************************************************
185* Return a textual representation *
186*************************************************/
187void Basic_Constraints::contents_to(Data_Store& subject, Data_Store&) const
188 {
189 subject.add("X509v3.BasicConstraints.is_ca", (is_ca ? 1 : 0));
190 subject.add("X509v3.BasicConstraints.path_constraint", path_limit);
191 }
192
193/*************************************************
194* Encode the extension *
195*************************************************/
196MemoryVector<byte> Key_Usage::encode_inner() const
197 {
198 if(constraints == NO_CONSTRAINTS)
199 throw Encoding_Error("Cannot encode zero usage constraints");
200
201 const u32bit unused_bits = low_bit(constraints) - 1;
202
203 SecureVector<byte> der;
204 der.append(BIT_STRING);
205 der.append(2 + ((unused_bits < 8) ? 1 : 0));
206 der.append(unused_bits % 8);
207 der.append((constraints >> 8) & 0xFF);
208 if(constraints & 0xFF)
209 der.append(constraints & 0xFF);
210
211 return der;
212 }
213
214/*************************************************
215* Decode the extension *
216*************************************************/
217void Key_Usage::decode_inner(const MemoryRegion<byte>& in)
218 {
219 BER_Decoder ber(in);
220
221 BER_Object obj = ber.get_next_object();
222
223 if(obj.type_tag != BIT_STRING || obj.class_tag != UNIVERSAL)
224 throw BER_Bad_Tag("Bad tag for usage constraint",
225 obj.type_tag, obj.class_tag);
226
227 if(obj.value.size() != 2 && obj.value.size() != 3)
228 throw BER_Decoding_Error("Bad size for BITSTRING in usage constraint");
229
230 if(obj.value[0] >= 8)
231 throw BER_Decoding_Error("Invalid unused bits in usage constraint");
232
233 obj.value[obj.value.size()-1] &= (0xFF << obj.value[0]);
234
235 u16bit usage = 0;
236 for(u32bit j = 1; j != obj.value.size(); ++j)
237 usage = (obj.value[j] << 8) | usage;
238
239 constraints = Key_Constraints(usage);
240 }
241
242/*************************************************
243* Return a textual representation *
244*************************************************/
245void Key_Usage::contents_to(Data_Store& subject, Data_Store&) const
246 {
247 subject.add("X509v3.KeyUsage", constraints);
248 }
249
250/*************************************************
251* Encode the extension *
252*************************************************/
253MemoryVector<byte> Subject_Key_ID::encode_inner() const
254 {
255 return DER_Encoder().encode(key_id, OCTET_STRING).get_contents();
256 }
257
258/*************************************************
259* Decode the extension *
260*************************************************/
261void Subject_Key_ID::decode_inner(const MemoryRegion<byte>& in)
262 {
263 BER_Decoder(in).decode(key_id, OCTET_STRING).verify_end();
264 }
265
266/*************************************************
267* Return a textual representation *
268*************************************************/
269void Subject_Key_ID::contents_to(Data_Store& subject, Data_Store&) const
270 {
271 subject.add("X509v3.SubjectKeyIdentifier", key_id);
272 }
273
274/*************************************************
275* Subject_Key_ID Constructor *
276*************************************************/
277Subject_Key_ID::Subject_Key_ID(const MemoryRegion<byte>& pub_key)
278 {
279 std::auto_ptr<HashFunction> hash(get_hash("SHA-1"));
280 key_id = hash->process(pub_key);
281 }
282
283/*************************************************
284* Encode the extension *
285*************************************************/
286MemoryVector<byte> Authority_Key_ID::encode_inner() const
287 {
288 return DER_Encoder()
289 .start_cons(SEQUENCE)
290 .encode(key_id, OCTET_STRING, ASN1_Tag(0), CONTEXT_SPECIFIC)
291 .end_cons()
292 .get_contents();
293 }
294
295/*************************************************
296* Decode the extension *
297*************************************************/
298void Authority_Key_ID::decode_inner(const MemoryRegion<byte>& in)
299 {
300 BER_Decoder(in)
301 .start_cons(SEQUENCE)
302 .decode_optional_string(key_id, OCTET_STRING, 0);
303 }
304
305/*************************************************
306* Return a textual representation *
307*************************************************/
308void Authority_Key_ID::contents_to(Data_Store&, Data_Store& issuer) const
309 {
310 if(key_id.size())
311 issuer.add("X509v3.AuthorityKeyIdentifier", key_id);
312 }
313
314/*************************************************
315* Encode the extension *
316*************************************************/
317MemoryVector<byte> Alternative_Name::encode_inner() const
318 {
319 return DER_Encoder().encode(alt_name).get_contents();
320 }
321
322/*************************************************
323* Decode the extension *
324*************************************************/
325void Alternative_Name::decode_inner(const MemoryRegion<byte>& in)
326 {
327 BER_Decoder(in).decode(alt_name);
328 }
329
330/*************************************************
331* Return a textual representation *
332*************************************************/
333void Alternative_Name::contents_to(Data_Store& subject_info,
334 Data_Store& issuer_info) const
335 {
336 std::multimap<std::string, std::string> contents =
337 get_alt_name().contents();
338
339 if(oid_name_str == "X509v3.SubjectAlternativeName")
340 subject_info.add(contents);
341 else if(oid_name_str == "X509v3.IssuerAlternativeName")
342 issuer_info.add(contents);
343 else
344 throw Internal_Error("In Alternative_Name, unknown type " +
345 oid_name_str);
346 }
347
348/*************************************************
349* Alternative_Name Constructor *
350*************************************************/
351Alternative_Name::Alternative_Name(const AlternativeName& alt_name,
352 const std::string& oid_name_str,
353 const std::string& config_name_str)
354 {
355 this->alt_name = alt_name;
356 this->oid_name_str = oid_name_str;
357 this->config_name_str = config_name_str;
358 }
359
360/*************************************************
361* Subject_Alternative_Name Constructor *
362*************************************************/
363Subject_Alternative_Name::Subject_Alternative_Name(
364 const AlternativeName& name) :
365
366 Alternative_Name(name, "X509v3.SubjectAlternativeName",
367 "subject_alternative_name")
368 {
369 }
370
371/*************************************************
372* Issuer_Alternative_Name Constructor *
373*************************************************/
374Issuer_Alternative_Name::Issuer_Alternative_Name(const AlternativeName& name) :
375 Alternative_Name(name, "X509v3.IssuerAlternativeName",
376 "issuer_alternative_name")
377 {
378 }
379
380/*************************************************
381* Encode the extension *
382*************************************************/
383MemoryVector<byte> Extended_Key_Usage::encode_inner() const
384 {
385 return DER_Encoder()
386 .start_cons(SEQUENCE)
387 .encode_list(oids)
388 .end_cons()
389 .get_contents();
390 }
391
392/*************************************************
393* Decode the extension *
394*************************************************/
395void Extended_Key_Usage::decode_inner(const MemoryRegion<byte>& in)
396 {
397 BER_Decoder(in)
398 .start_cons(SEQUENCE)
399 .decode_list(oids)
400 .end_cons();
401 }
402
403/*************************************************
404* Return a textual representation *
405*************************************************/
406void Extended_Key_Usage::contents_to(Data_Store& subject, Data_Store&) const
407 {
408 for(u32bit j = 0; j != oids.size(); ++j)
409 subject.add("X509v3.ExtendedKeyUsage", oids[j].as_string());
410 }
411
412namespace {
413
414/*************************************************
415* A policy specifier *
416*************************************************/
417class Policy_Information : public ASN1_Object
418 {
419 public:
420 OID oid;
421
422 void encode_into(DER_Encoder& codec) const
423 {
424 codec.start_cons(SEQUENCE)
425 .encode(oid)
426 .end_cons();
427 }
428
429 void decode_from(BER_Decoder& codec)
430 {
431 codec.start_cons(SEQUENCE)
432 .decode(oid)
433 .discard_remaining()
434 .end_cons();
435 }
436 };
437
438}
439
440/*************************************************
441* Encode the extension *
442*************************************************/
443MemoryVector<byte> Certificate_Policies::encode_inner() const
444 {
445 throw Exception("Certificate_Policies::encode_inner: Bugged");
446
447 std::vector<Policy_Information> policies;
448
449 return DER_Encoder()
450 .start_cons(SEQUENCE)
451 .encode_list(policies)
452 .end_cons()
453 .get_contents();
454 }
455
456/*************************************************
457* Decode the extension *
458*************************************************/
459void Certificate_Policies::decode_inner(const MemoryRegion<byte>& in)
460 {
461 std::vector<Policy_Information> policies;
462
463 BER_Decoder(in)
464 .start_cons(SEQUENCE)
465 .decode_list(policies)
466 .end_cons();
467 }
468
469/*************************************************
470* Return a textual representation *
471*************************************************/
472void Certificate_Policies::contents_to(Data_Store& info, Data_Store&) const
473 {
474 for(u32bit j = 0; j != oids.size(); ++j)
475 info.add("X509v3.ExtendedKeyUsage", oids[j].as_string());
476 }
477
478/*************************************************
479* Checked accessor for the crl_number member *
480*************************************************/
481u32bit CRL_Number::get_crl_number() const
482 {
483 if(!has_value)
484 throw Invalid_State("CRL_Number::get_crl_number: Not set");
485 return crl_number;
486 }
487
488/*************************************************
489* Copy a CRL_Number extension *
490*************************************************/
491CRL_Number* CRL_Number::copy() const
492 {
493 if(!has_value)
494 throw Invalid_State("CRL_Number::copy: Not set");
495 return new CRL_Number(crl_number);
496 }
497
498/*************************************************
499* Encode the extension *
500*************************************************/
501MemoryVector<byte> CRL_Number::encode_inner() const
502 {
503 return DER_Encoder().encode(crl_number).get_contents();
504 }
505
506/*************************************************
507* Decode the extension *
508*************************************************/
509void CRL_Number::decode_inner(const MemoryRegion<byte>& in)
510 {
511 BER_Decoder(in).decode(crl_number);
512 }
513
514/*************************************************
515* Return a textual representation *
516*************************************************/
517void CRL_Number::contents_to(Data_Store& info, Data_Store&) const
518 {
519 info.add("X509v3.CRLNumber", crl_number);
520 }
521
522/*************************************************
523* Encode the extension *
524*************************************************/
525MemoryVector<byte> CRL_ReasonCode::encode_inner() const
526 {
527 return DER_Encoder()
528 .encode(static_cast<u32bit>(reason), ENUMERATED, UNIVERSAL)
529 .get_contents();
530 }
531
532/*************************************************
533* Decode the extension *
534*************************************************/
535void CRL_ReasonCode::decode_inner(const MemoryRegion<byte>& in)
536 {
537 u32bit reason_code = 0;
538 BER_Decoder(in).decode(reason_code, ENUMERATED, UNIVERSAL);
539 reason = static_cast<CRL_Code>(reason_code);
540 }
541
542/*************************************************
543* Return a textual representation *
544*************************************************/
545void CRL_ReasonCode::contents_to(Data_Store& info, Data_Store&) const
546 {
547 info.add("X509v3.CRLReasonCode", reason);
548 }
549
550}
551
552}

Archive Download this file

Branches

Tags

Quick Links:     www.monotone.ca    -     Downloads    -     Documentation    -     Wiki    -     Code Forge    -     Build Status