Below is the file 'src/x509_ext.cpp' from this revision. You can also download the file.
/************************************************* * X.509 Certificate Extensions Source File * * (C) 1999-2007 The Botan Project * *************************************************/ #include <botan/x509_ext.h> #include <botan/x509stat.h> #include <botan/libstate.h> #include <botan/der_enc.h> #include <botan/ber_dec.h> #include <botan/lookup.h> #include <botan/parsing.h> #include <botan/oids.h> #include <botan/config.h> #include <botan/bit_ops.h> #include <botan/loadstor.h> #include <botan/stl_util.h> #include <botan/charset.h> #include <algorithm> #include <memory> namespace Botan { /************************************************* * Return the OID of this extension * *************************************************/ OID Certificate_Extension::oid_of() const { return OIDS::lookup(oid_name()); } /************************************************* * Encode an Extensions list * *************************************************/ void Extensions::encode_into(DER_Encoder& to_object) const { for(u32bit j = 0; j != extensions.size(); ++j) { const Certificate_Extension* ext = extensions[j]; std::string setting; if(ext->config_id() != "") setting = global_config().option("x509/exts/" + ext->config_id()); if(setting == "") setting = "yes"; if(setting != "yes" && setting != "no" && setting != "critical") throw Invalid_Argument("X509_CA:: Invalid value for option " "x509/exts/" + ext->config_id() + " of " + setting); bool is_critical = (setting == "critical"); bool should_encode = ext->should_encode() && (setting != "no"); if(should_encode) { to_object.start_cons(SEQUENCE) .encode(ext->oid_of()) .encode_optional(is_critical, false) .encode(ext->encode_inner(), OCTET_STRING) .end_cons(); } } } /************************************************* * Decode a list of Extensions * *************************************************/ void Extensions::decode_from(BER_Decoder& from_source) { for(u32bit j = 0; j != extensions.size(); ++j) delete extensions[j]; extensions.clear(); BER_Decoder sequence = from_source.start_cons(SEQUENCE); while(sequence.more_items()) { OID oid; MemoryVector<byte> contents; bool critical; sequence.start_cons(SEQUENCE) .decode(oid) .decode_optional(critical, BOOLEAN, UNIVERSAL, false) .decode(contents, OCTET_STRING) .verify_end() .end_cons(); printf("saw extension oid %s (%s)\n", oid.as_string().c_str(), OIDS::lookup(oid).c_str()); Certificate_Extension* ext = global_state().x509_state().get_extension(oid); if(!ext) { if(!critical || !should_throw) continue; throw Decoding_Error("Encountered unknown X.509 extension marked " "as critical; OID = " + oid.as_string()); } ext->decode_inner(contents); extensions.push_back(ext); } sequence.verify_end(); } /************************************************* * Write the extensions to an info store * *************************************************/ void Extensions::contents_to(Data_Store& subject_info, Data_Store& issuer_info) const { for(u32bit j = 0; j != extensions.size(); ++j) extensions[j]->contents_to(subject_info, issuer_info); } /************************************************* * Copy another extensions list * *************************************************/ Extensions& Extensions::copy_this(const Extensions& other) { for(u32bit j = 0; j != extensions.size(); ++j) delete extensions[j]; extensions.clear(); for(u32bit j = 0; j != other.extensions.size(); ++j) extensions.push_back(other.extensions[j]->copy()); return (*this); } /************************************************* * Delete an Extensions list * *************************************************/ Extensions::~Extensions() { for(u32bit j = 0; j != extensions.size(); ++j) delete extensions[j]; } namespace Cert_Extension { /************************************************* * Checked accessor for the path_limit member * *************************************************/ u32bit Basic_Constraints::get_path_limit() const { if(!is_ca) throw Invalid_State("Basic_Constraints::get_path_limit: Not a CA"); return path_limit; } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Basic_Constraints::encode_inner() const { return DER_Encoder() .start_cons(SEQUENCE) .encode_if(is_ca, DER_Encoder() .encode(is_ca) .encode_optional(path_limit, NO_CERT_PATH_LIMIT) ) .end_cons() .get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Basic_Constraints::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder(in) .start_cons(SEQUENCE) .decode_optional(is_ca, BOOLEAN, UNIVERSAL, false) .decode_optional(path_limit, INTEGER, UNIVERSAL, NO_CERT_PATH_LIMIT) .verify_end() .end_cons(); if(is_ca == false) path_limit = 0; } /************************************************* * Write the extensions to an info store * *************************************************/ void Basic_Constraints::contents_to(Data_Store& subject, Data_Store&) const { subject.add("X509v3.BasicConstraints.is_ca", (is_ca ? 1 : 0)); subject.add("X509v3.BasicConstraints.path_constraint", path_limit); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Key_Usage::encode_inner() const { if(constraints == NO_CONSTRAINTS) throw Encoding_Error("Cannot encode zero usage constraints"); const u32bit unused_bits = low_bit(constraints) - 1; SecureVector<byte> der; der.append(BIT_STRING); der.append(2 + ((unused_bits < 8) ? 1 : 0)); der.append(unused_bits % 8); der.append((constraints >> 8) & 0xFF); if(constraints & 0xFF) der.append(constraints & 0xFF); return der; } /************************************************* * Decode the extension * *************************************************/ void Key_Usage::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder ber(in); BER_Object obj = ber.get_next_object(); if(obj.type_tag != BIT_STRING || obj.class_tag != UNIVERSAL) throw BER_Bad_Tag("Bad tag for usage constraint", obj.type_tag, obj.class_tag); if(obj.value.size() != 2 && obj.value.size() != 3) throw BER_Decoding_Error("Bad size for BITSTRING in usage constraint"); if(obj.value[0] >= 8) throw BER_Decoding_Error("Invalid unused bits in usage constraint"); obj.value[obj.value.size()-1] &= (0xFF << obj.value[0]); u16bit usage = 0; for(u32bit j = 1; j != obj.value.size(); ++j) usage = (obj.value[j] << 8) | usage; constraints = Key_Constraints(usage); } /************************************************* * Write the extensions to an info store * *************************************************/ void Key_Usage::contents_to(Data_Store& subject, Data_Store&) const { subject.add("X509v3.KeyUsage", constraints); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Subject_Key_ID::encode_inner() const { return DER_Encoder().encode(key_id, OCTET_STRING).get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Subject_Key_ID::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder(in).decode(key_id, OCTET_STRING).verify_end(); } /************************************************* * Write the extensions to an info store * *************************************************/ void Subject_Key_ID::contents_to(Data_Store& subject, Data_Store&) const { subject.add("X509v3.SubjectKeyIdentifier", key_id); } /************************************************* * Subject_Key_ID Constructor * *************************************************/ Subject_Key_ID::Subject_Key_ID(const MemoryRegion<byte>& pub_key) { std::auto_ptr<HashFunction> hash(get_hash("SHA-1")); key_id = hash->process(pub_key); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Authority_Key_ID::encode_inner() const { return DER_Encoder() .start_cons(SEQUENCE) .encode(key_id, OCTET_STRING, ASN1_Tag(0), CONTEXT_SPECIFIC) .end_cons() .get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Authority_Key_ID::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder(in) .start_cons(SEQUENCE) .decode_optional_string(key_id, OCTET_STRING, 0); } /************************************************* * Write the extensions to an info store * *************************************************/ void Authority_Key_ID::contents_to(Data_Store&, Data_Store& issuer) const { if(key_id.size()) issuer.add("X509v3.AuthorityKeyIdentifier", key_id); } namespace { /************************************************* * DER encode an Alternative_Name entry * *************************************************/ void encode_entries(DER_Encoder& encoder, const std::multimap<std::string, std::string>& attr, const std::string& type, ASN1_Tag tagging) { typedef std::multimap<std::string, std::string>::const_iterator iter; std::pair<iter, iter> range = attr.equal_range(type); for(iter j = range.first; j != range.second; ++j) { printf("type = %s, 1=%s 2=%s", type.c_str(), j->first.c_str(), j->second.c_str()); if(type == "RFC822" || type == "DNS" || type == "URI") { ASN1_String asn1_string(j->second, IA5_STRING); encoder.add_object(tagging, CONTEXT_SPECIFIC, asn1_string.iso_8859()); } else if(type == "IP") { u32bit ip = string_to_ipv4(j->second); byte ip_buf[4] = { 0 }; store_be(ip, ip_buf); encoder.add_object(tagging, CONTEXT_SPECIFIC, ip_buf, 4); } } } } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Alternative_Name::encode_inner() const { DER_Encoder der; der.start_cons(SEQUENCE); encode_entries(der, alt_info, "RFC822", ASN1_Tag(1)); encode_entries(der, alt_info, "DNS", ASN1_Tag(2)); encode_entries(der, alt_info, "URI", ASN1_Tag(6)); encode_entries(der, alt_info, "IP", ASN1_Tag(7)); std::multimap<OID, ASN1_String>::const_iterator i; for(i = othernames.begin(); i != othernames.end(); ++i) { der.start_explicit(0) .encode(i->first) .start_explicit(0) .encode(i->second) .end_explicit() .end_explicit(); } der.end_cons(); return der.get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Alternative_Name::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder source(in); BER_Decoder names = source.start_cons(SEQUENCE); while(names.more_items()) { BER_Object obj = names.get_next_object(); if((obj.class_tag != CONTEXT_SPECIFIC) && (obj.class_tag != (CONTEXT_SPECIFIC | CONSTRUCTED))) continue; ASN1_Tag tag = obj.type_tag; if(tag == 0) { BER_Decoder othername(obj.value); OID oid; othername.decode(oid); if(othername.more_items()) { BER_Object othername_value_outer = othername.get_next_object(); othername.verify_end(); if(othername_value_outer.type_tag != ASN1_Tag(0) || othername_value_outer.class_tag != (CONTEXT_SPECIFIC | CONSTRUCTED) ) throw Decoding_Error("Invalid tags on otherName value"); BER_Decoder othername_value_inner(othername_value_outer.value); BER_Object value = othername_value_inner.get_next_object(); othername_value_inner.verify_end(); ASN1_Tag value_type = value.type_tag; if(is_string_type(value_type) && value.class_tag == UNIVERSAL) add_othername(oid, ASN1::to_string(value), value_type); } } else if(tag == 1 || tag == 2 || tag == 6) { const std::string value = Charset::transcode(ASN1::to_string(obj), LATIN1_CHARSET, LOCAL_CHARSET); printf("decoded tag = %d, value = %s\n", tag, value.c_str()); if(tag == 1) add_attribute("RFC822", value); if(tag == 2) add_attribute("DNS", value); if(tag == 6) add_attribute("URI", value); } else if(tag == 7) { if(obj.value.size() == 4) { u32bit ip = load_be<u32bit>(obj.value.begin(), 0); add_attribute("IP", ipv4_to_string(ip)); } } } } /************************************************* * Add an attribute to an alternative name * *************************************************/ void Alternative_Name::add_attribute(const std::string& type, const std::string& str) { if(type == "" || str == "") return; typedef std::multimap<std::string, std::string>::iterator iter; std::pair<iter, iter> range = alt_info.equal_range(type); for(iter j = range.first; j != range.second; ++j) if(j->second == str) return; printf("%p adding %s, %s\n", this, type.c_str(), str.c_str()); multimap_insert(alt_info, type, str); } /************************************************* * Add an OtherName field * *************************************************/ void Alternative_Name::add_othername(const OID& oid, const std::string& value, ASN1_Tag type) { if(value != "") multimap_insert(othernames, oid, ASN1_String(value, type)); } /************************************************* * Return all of the alternative names * *************************************************/ std::multimap<std::string, std::string> Alternative_Name::contents() const { std::multimap<std::string, std::string> names; typedef std::multimap<std::string, std::string>::const_iterator rdn_iter; for(rdn_iter j = alt_info.begin(); j != alt_info.end(); ++j) multimap_insert(names, j->first, j->second); typedef std::multimap<OID, ASN1_String>::const_iterator on_iter; for(on_iter j = othernames.begin(); j != othernames.end(); ++j) multimap_insert(names, OIDS::lookup(j->first), j->second.value()); return names; } /************************************************* * Subject_Alternative_Name Constructor * *************************************************/ Subject_Alternative_Name::Subject_Alternative_Name(const std::string& email, const std::string& uri, const std::string& dns, const std::string& ip) { add_attribute("RFC822", email); add_attribute("DNS", dns); add_attribute("URI", uri); add_attribute("IP", ip); } /************************************************* * Write the extensions to an info store * *************************************************/ void Subject_Alternative_Name::contents_to(Data_Store& subject_info, Data_Store&) const { printf("%p adding subject info contents to %p\n", this, &subject_info); std::multimap<std::string, std::string> names = contents(); std::multimap<std::string, std::string>::iterator i = names.begin(); while(i != names.end()) { printf("i->first = %s i->second = %s\n", i->first.c_str(), i->second.c_str()); ++i; } printf("done\n"); subject_info.add(contents()); } /************************************************* * Issuer_Alternative_Name Constructor * *************************************************/ Issuer_Alternative_Name::Issuer_Alternative_Name(const std::string& email, const std::string& uri, const std::string& dns, const std::string& ip) { add_attribute("RFC822", email); add_attribute("DNS", dns); add_attribute("URI", uri); add_attribute("IP", ip); } /************************************************* * Write the extensions to an info store * *************************************************/ void Issuer_Alternative_Name::contents_to(Data_Store&, Data_Store& issuer_info) const { issuer_info.add(contents()); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Extended_Key_Usage::encode_inner() const { return DER_Encoder() .start_cons(SEQUENCE) .encode_list(oids) .end_cons() .get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Extended_Key_Usage::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder(in) .start_cons(SEQUENCE) .decode_list(oids) .end_cons(); } /************************************************* * Write the extensions to an info store * *************************************************/ void Extended_Key_Usage::contents_to(Data_Store& subject, Data_Store&) const { for(u32bit j = 0; j != oids.size(); ++j) subject.add("X509v3.ExtendedKeyUsage", oids[j].as_string()); } namespace { /************************************************* * A policy specifier * *************************************************/ class Policy_Information : public ASN1_Object { public: OID oid; void encode_into(DER_Encoder& codec) const { codec.start_cons(SEQUENCE) .encode(oid) .end_cons(); } void decode_from(BER_Decoder& codec) { codec.start_cons(SEQUENCE) .decode(oid) .discard_remaining() .end_cons(); } }; } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> Certificate_Policies::encode_inner() const { throw Exception("Certificate_Policies::encode_inner: Bugged"); std::vector<Policy_Information> policies; return DER_Encoder() .start_cons(SEQUENCE) .encode_list(policies) .end_cons() .get_contents(); } /************************************************* * Decode the extension * *************************************************/ void Certificate_Policies::decode_inner(const MemoryRegion<byte>& in) { std::vector<Policy_Information> policies; BER_Decoder(in) .start_cons(SEQUENCE) .decode_list(policies) .end_cons(); } /************************************************* * Write the extensions to an info store * *************************************************/ void Certificate_Policies::contents_to(Data_Store& info, Data_Store&) const { for(u32bit j = 0; j != oids.size(); ++j) info.add("X509v3.ExtendedKeyUsage", oids[j].as_string()); } /************************************************* * Checked accessor for the crl_number member * *************************************************/ u32bit CRL_Number::get_crl_number() const { if(!has_value) throw Invalid_State("CRL_Number::get_crl_number: Not set"); return crl_number; } /************************************************* * Copy a CRL_Number extension * *************************************************/ CRL_Number* CRL_Number::copy() const { if(!has_value) throw Invalid_State("CRL_Number::copy: Not set"); return new CRL_Number(crl_number); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> CRL_Number::encode_inner() const { return DER_Encoder().encode(crl_number).get_contents(); } /************************************************* * Decode the extension * *************************************************/ void CRL_Number::decode_inner(const MemoryRegion<byte>& in) { BER_Decoder(in).decode(crl_number); } /************************************************* * Write the extensions to an info store * *************************************************/ void CRL_Number::contents_to(Data_Store& subject_info, Data_Store&) const { subject_info.add("X509v3.CRLNumber", crl_number); } /************************************************* * Encode the extension * *************************************************/ MemoryVector<byte> CRL_ReasonCode::encode_inner() const { return DER_Encoder() .encode(static_cast<u32bit>(reason), ENUMERATED, UNIVERSAL) .get_contents(); } /************************************************* * Decode the extension * *************************************************/ void CRL_ReasonCode::decode_inner(const MemoryRegion<byte>& in) { u32bit reason_code = 0; BER_Decoder(in).decode(reason_code, ENUMERATED, UNIVERSAL); reason = static_cast<CRL_Code>(reason_code); } /************************************************* * Write the extensions to an info store * *************************************************/ void CRL_ReasonCode::contents_to(Data_Store& subject_info, Data_Store&) const { subject_info.add("X509v3.CRLReasonCode", reason); } } }