2 * Copyright (C) 2003-2012 Free Software Foundation, Inc.
4 * Author: Nikos Mavrogiannopoulos
6 * This file is part of GnuTLS.
8 * The GnuTLS is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public License
10 * as published by the Free Software Foundation; either version 3 of
11 * the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public License
19 * along with this program. If not, see <http://www.gnu.org/licenses/>
23 #include <gnutls_int.h>
25 #include <gnutls_datum.h>
26 #include <gnutls_global.h>
27 #include <gnutls_errors.h>
28 #include <gnutls_str.h>
29 #include <gnutls_x509.h>
30 #include <gnutls_num.h>
38 const char *ldap_desc
;
39 int choice
; /* of type DirectoryString */
41 const char *asn_desc
; /* description in the pkix file */
44 /* This list contains all the OIDs that may be
45 * contained in a rdnSequence and are printable.
47 static const struct oid2string _oid2str
[] = {
50 {"1.3.6.1.5.5.7.9.1", "dateOfBirth", 0, 1, "PKIX1.GeneralizedTime"},
51 {"1.3.6.1.5.5.7.9.2", "placeOfBirth", 0, 1, "PKIX1.DirectoryString"},
52 {"1.3.6.1.5.5.7.9.3", "gender", 0, 1, "PKIX1.PrintableString"},
53 {"1.3.6.1.5.5.7.9.4", "countryOfCitizenship", 0, 1,
54 "PKIX1.PrintableString"},
55 {"1.3.6.1.5.5.7.9.5", "countryOfResidence", 0, 1, "PKIX1.PrintableString"},
57 {"2.5.4.6", "C", 0, 1, "PKIX1.PrintableString"},
58 {"2.5.4.9", "STREET", 1, 1, "PKIX1.DirectoryString"},
59 {"2.5.4.12", "T", 1, 1, "PKIX1.DirectoryString"},
60 {"2.5.4.10", "O", 1, 1, "PKIX1.DirectoryString"},
61 {"2.5.4.11", "OU", 1, 1, "PKIX1.DirectoryString"},
62 {"2.5.4.3", "CN", 1, 1, "PKIX1.DirectoryString"},
63 {"2.5.4.7", "L", 1, 1, "PKIX1.DirectoryString"},
64 {"2.5.4.8", "ST", 1, 1, "PKIX1.DirectoryString"},
66 {"2.5.4.5", "serialNumber", 0, 1, "PKIX1.PrintableString"},
67 {"2.5.4.20", "telephoneNumber", 0, 1, "PKIX1.PrintableString"},
68 {"2.5.4.4", "surName", 1, 1, "PKIX1.DirectoryString"},
69 {"2.5.4.43", "initials", 1, 1, "PKIX1.DirectoryString"},
70 {"2.5.4.44", "generationQualifier", 1, 1, "PKIX1.DirectoryString"},
71 {"2.5.4.42", "givenName", 1, 1, "PKIX1.DirectoryString"},
72 {"2.5.4.65", "pseudonym", 1, 1, "PKIX1.DirectoryString"},
73 {"2.5.4.46", "dnQualifier", 0, 1, "PKIX1.PrintableString"},
74 {"2.5.4.17", "postalCode", 1, 1, "PKIX1.DirectoryString"},
75 {"2.5.4.41", "Name", 1, 1, "PKIX1.DirectoryString"},
76 {"2.5.4.15", "businessCategory", 1, 1, "PKIX1.DirectoryString"},
78 {"0.9.2342.19200300.100.1.25", "DC", 0, 1, "PKIX1.IA5String"},
79 {"0.9.2342.19200300.100.1.1", "UID", 1, 1, "PKIX1.DirectoryString"},
81 /* Extended validation
83 {"1.3.6.1.4.1.311.60.2.1.1", "jurisdictionOfIncorporationLocalityName", 1,
84 1, "PKIX1.DirectoryString"},
85 {"1.3.6.1.4.1.311.60.2.1.2",
86 "jurisdictionOfIncorporationStateOrProvinceName", 1, 1,
87 "PKIX1.DirectoryString"},
88 {"1.3.6.1.4.1.311.60.2.1.3", "jurisdictionOfIncorporationCountryName", 0, 1,
89 "PKIX1.PrintableString"},
93 {"1.2.840.113549.1.9.1", "EMAIL", 0, 1, "PKIX1.IA5String"},
94 {"1.2.840.113549.1.9.7", NULL
, 1, 1, "PKIX1.pkcs-9-challengePassword"},
97 {"1.2.840.113549.1.9.20", NULL
, 0, 1, "PKIX1.BMPString"},
99 {"1.2.840.113549.1.9.21", NULL
, 0, 1, "PKIX1.pkcs-9-localKeyId"},
101 /* rfc3920 section 5.1.1 */
102 {"1.3.6.1.5.5.7.8.5", "XmppAddr", 0, 1, "PKIX1.UTF8String"},
104 {NULL
, NULL
, 0, 0, ""}
107 /* Returns 1 if the data defined by the OID are printable.
110 _gnutls_x509_oid_data_printable (const char *oid
)
116 if (strcmp (_oid2str
[i
].oid
, oid
) == 0)
117 return _oid2str
[i
].printable
;
120 while (_oid2str
[i
].oid
!= NULL
);
126 * gnutls_x509_dn_oid_known:
127 * @oid: holds an Object Identifier in a null terminated string
129 * This function will inform about known DN OIDs. This is useful since
130 * functions like gnutls_x509_crt_set_dn_by_oid() use the information
131 * on known OIDs to properly encode their input. Object Identifiers
132 * that are not known are not encoded by these functions, and their
133 * input is stored directly into the ASN.1 structure. In that case of
134 * unknown OIDs, you have the responsibility of DER encoding your
137 * Returns: 1 on known OIDs and 0 otherwise.
140 gnutls_x509_dn_oid_known (const char *oid
)
146 if (strcmp (_oid2str
[i
].oid
, oid
) == 0)
150 while (_oid2str
[i
].oid
!= NULL
);
155 /* Returns 1 if the data defined by the OID are of a choice
159 _gnutls_x509_oid_data_choice (const char *oid
)
165 if (strcmp (_oid2str
[i
].oid
, oid
) == 0)
166 return _oid2str
[i
].choice
;
169 while (_oid2str
[i
].oid
!= NULL
);
175 * gnutls_x509_dn_oid_name:
176 * @oid: holds an Object Identifier in a null terminated string
177 * @flags: 0 or GNUTLS_X509_DN_OID_*
179 * This function will return the name of a known DN OID. If
180 * %GNUTLS_X509_DN_OID_RETURN_OID is specified this function
181 * will return the given OID if no descriptive name has been
184 * Returns: A null terminated string or NULL otherwise.
189 gnutls_x509_dn_oid_name (const char *oid
, unsigned int flags
)
195 if (strcmp (_oid2str
[i
].oid
, oid
) == 0)
196 return _oid2str
[i
].ldap_desc
;
199 while (_oid2str
[i
].oid
!= NULL
);
201 if (flags
& GNUTLS_X509_DN_OID_RETURN_OID
) return oid
;
206 _gnutls_x509_oid2asn_string (const char *oid
)
212 if (strcmp (_oid2str
[i
].oid
, oid
) == 0)
213 return _oid2str
[i
].asn_desc
;
216 while (_oid2str
[i
].oid
!= NULL
);
222 /* This function will convert an attribute value, specified by the OID,
223 * to a string. The result will be a null terminated string.
225 * res may be null. This will just return the res_size, needed to
229 _gnutls_x509_oid_data2string (const char *oid
, void *value
,
230 int value_size
, char *res
, size_t * res_size
)
232 char str
[MAX_STRING_LEN
], tmpname
[128];
233 const char *ANAME
= NULL
;
234 int CHOICE
= -1, len
= -1, result
;
235 ASN1_TYPE tmpasn
= ASN1_TYPE_EMPTY
;
236 char asn1_err
[ASN1_MAX_ERROR_DESCRIPTION_SIZE
] = "";
238 if (value
== NULL
|| value_size
<= 0 || res_size
== NULL
)
241 return GNUTLS_E_INVALID_REQUEST
;
244 if (_gnutls_x509_oid_data_printable (oid
) == 0)
247 return GNUTLS_E_INTERNAL_ERROR
;
250 ANAME
= _gnutls_x509_oid2asn_string (oid
);
251 CHOICE
= _gnutls_x509_oid_data_choice (oid
);
256 return GNUTLS_E_INTERNAL_ERROR
;
260 asn1_create_element (_gnutls_get_pkix (), ANAME
,
261 &tmpasn
)) != ASN1_SUCCESS
)
264 return _gnutls_asn2err (result
);
268 asn1_der_decoding (&tmpasn
, value
, value_size
,
269 asn1_err
)) != ASN1_SUCCESS
)
272 _gnutls_debug_log ("asn1_der_decoding: %s:%s\n", str
, asn1_err
);
273 asn1_delete_structure (&tmpasn
);
274 return _gnutls_asn2err (result
);
277 /* If this is a choice then we read the choice. Otherwise it
280 len
= sizeof (str
) - 1;
281 if ((result
= asn1_read_value (tmpasn
, "", str
, &len
)) != ASN1_SUCCESS
)
284 asn1_delete_structure (&tmpasn
);
285 return _gnutls_asn2err (result
);
292 /* Refuse to deal with strings containing NULs. */
293 if (strlen (str
) != (size_t)len
)
294 return GNUTLS_E_ASN1_DER_ERROR
;
297 _gnutls_str_cpy (res
, *res_size
, str
);
298 *res_size
= (size_t)len
;
300 asn1_delete_structure (&tmpasn
);
304 int non_printable
= 0, teletex
= 0;
307 /* Note that we do not support strings other than
308 * UTF-8 (thus ASCII as well).
310 if (strcmp (str
, "printableString") != 0 &&
311 strcmp (str
, "ia5String") != 0 && strcmp (str
, "utf8String") != 0)
315 if (strcmp (str
, "teletexString") == 0)
319 _gnutls_str_cpy (tmpname
, sizeof (tmpname
), str
);
321 len
= sizeof (str
) - 1;
323 asn1_read_value (tmpasn
, tmpname
, str
, &len
)) != ASN1_SUCCESS
)
325 asn1_delete_structure (&tmpasn
);
326 return _gnutls_asn2err (result
);
329 asn1_delete_structure (&tmpasn
);
334 /* HACK: if the teletex string contains only ascii
335 * characters then treat it as printable.
337 for (i
= 0; i
< len
; i
++)
338 if (!isascii (str
[i
]))
345 if (non_printable
== 0)
349 /* Refuse to deal with strings containing NULs. */
350 if (strlen (str
) != (size_t)len
)
351 return GNUTLS_E_ASN1_DER_ERROR
;
354 _gnutls_str_cpy (res
, *res_size
, str
);
355 *res_size
= (size_t)len
;
359 result
= _gnutls_x509_data2hex (str
, (size_t)len
, res
, res_size
);
372 /* Converts a data string to an LDAP rfc2253 hex string
373 * something like '#01020304'
376 _gnutls_x509_data2hex (const void * data
, size_t data_size
,
377 void * _out
, size_t * sizeof_out
)
380 char escaped
[MAX_STRING_LEN
];
384 if (2 * data_size
+ 1 > MAX_STRING_LEN
)
387 return GNUTLS_E_INTERNAL_ERROR
;
390 res
= _gnutls_bin2hex (data
, data_size
, escaped
, sizeof (escaped
), NULL
);
394 return GNUTLS_E_INTERNAL_ERROR
;
397 size
= strlen (res
) + 1;
398 if (size
+ 1 > *sizeof_out
)
401 return GNUTLS_E_SHORT_MEMORY_BUFFER
;
403 *sizeof_out
= size
; /* -1 for the null +1 for the '#' */
409 _gnutls_str_cat (out
, *sizeof_out
, res
);
417 * Convertions between generalized or UTC time to time_t
421 /* This is an emulations of the struct tm.
422 * Since we do not use libc's functions, we don't need to
423 * depend on the libc structure.
425 typedef struct fake_tm
428 int tm_year
; /* FULL year - ie 1971 */
435 /* The mktime_utc function is due to Russ Allbery (rra@stanford.edu),
436 * who placed it under public domain:
439 /* The number of days in each month.
441 static const int MONTHDAYS
[] = {
442 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
445 /* Whether a given year is a leap year. */
446 #define ISLEAP(year) \
447 (((year) % 4) == 0 && (((year) % 100) != 0 || ((year) % 400) == 0))
450 ** Given a struct tm representing a calendar time in UTC, convert it to
451 ** seconds since epoch. Returns (time_t) -1 if the time is not
452 ** convertable. Note that this function does not canonicalize the provided
453 ** struct tm, nor does it allow out of range values or years before 1970.
456 mktime_utc (const struct fake_tm
*tm
)
461 /* We do allow some ill-formed dates, but we don't do anything special
462 * with them and our callers really shouldn't pass them to us. Do
463 * explicitly disallow the ones that would cause invalid array accesses
464 * or other algorithm problems.
466 if (tm
->tm_mon
< 0 || tm
->tm_mon
> 11 || tm
->tm_year
< 1970)
469 /* Convert to a time_t.
471 for (i
= 1970; i
< tm
->tm_year
; i
++)
472 result
+= 365 + ISLEAP (i
);
473 for (i
= 0; i
< tm
->tm_mon
; i
++)
474 result
+= MONTHDAYS
[i
];
475 if (tm
->tm_mon
> 1 && ISLEAP (tm
->tm_year
))
477 result
= 24 * (result
+ tm
->tm_mday
- 1) + tm
->tm_hour
;
478 result
= 60 * result
+ tm
->tm_min
;
479 result
= 60 * result
+ tm
->tm_sec
;
484 /* this one will parse dates of the form:
485 * month|day|hour|minute|sec* (2 chars each)
486 * and year is given. Returns a time_t date.
489 time2gtime (const char *ttime
, int year
)
492 struct fake_tm etime
;
494 if (strlen (ttime
) < 8)
500 etime
.tm_year
= year
;
502 /* In order to work with 32 bit
505 if (sizeof (time_t) <= 4 && etime
.tm_year
>= 2038)
506 return (time_t) 2145914603; /* 2037-12-31 23:23:23 */
508 if (etime
.tm_year
< 1970)
515 memcpy (xx
, ttime
, 2); /* month */
516 etime
.tm_mon
= atoi (xx
) - 1;
521 memcpy (xx
, ttime
, 2); /* day */
522 etime
.tm_mday
= atoi (xx
);
527 memcpy (xx
, ttime
, 2); /* hour */
528 etime
.tm_hour
= atoi (xx
);
533 memcpy (xx
, ttime
, 2); /* minutes */
534 etime
.tm_min
= atoi (xx
);
537 if (strlen (ttime
) >= 2)
539 memcpy (xx
, ttime
, 2);
540 etime
.tm_sec
= atoi (xx
);
545 return mktime_utc (&etime
);
549 /* returns a time_t value that contains the given time.
550 * The given time is expressed as:
551 * YEAR(2)|MONTH(2)|DAY(2)|HOUR(2)|MIN(2)|SEC(2)*
553 * (seconds are optional)
556 utcTime2gtime (const char *ttime
)
561 if (strlen (ttime
) < 10)
569 memcpy (xx
, ttime
, 2); /* year */
578 return time2gtime (ttime
, year
);
581 /* returns a time_t value that contains the given time.
582 * The given time is expressed as:
583 * YEAR(4)|MONTH(2)|DAY(2)|HOUR(2)|MIN(2)|SEC(2)*
586 _gnutls_x509_generalTime2gtime (const char *ttime
)
591 if (strlen (ttime
) < 12)
597 if (strchr (ttime
, 'Z') == 0)
600 /* sorry we don't support it yet
608 memcpy (xx
, ttime
, 4); /* year */
612 return time2gtime (ttime
, year
);
616 gtime2generalTime (time_t gtime
, char *str_time
, size_t str_time_size
)
621 if (!gmtime_r (>ime
, &_tm
))
624 return GNUTLS_E_INTERNAL_ERROR
;
627 ret
= strftime (str_time
, str_time_size
, "%Y%m%d%H%M%SZ", &_tm
);
631 return GNUTLS_E_SHORT_MEMORY_BUFFER
;
639 /* Extracts the time in time_t from the ASN1_TYPE given. When should
640 * be something like "tbsCertList.thisUpdate".
644 _gnutls_x509_get_time (ASN1_TYPE c2
, const char *when
, int nochoice
)
646 char ttime
[MAX_TIME
];
648 time_t c_time
= (time_t) - 1;
651 len
= sizeof (ttime
) - 1;
652 result
= asn1_read_value (c2
, when
, ttime
, &len
);
653 if (result
!= ASN1_SUCCESS
)
656 return (time_t) (-1);
661 c_time
= _gnutls_x509_generalTime2gtime (ttime
);
665 _gnutls_str_cpy (name
, sizeof (name
), when
);
668 if (strcmp (ttime
, "generalTime") == 0)
670 _gnutls_str_cat (name
, sizeof (name
), ".generalTime");
671 len
= sizeof (ttime
) - 1;
672 result
= asn1_read_value (c2
, name
, ttime
, &len
);
673 if (result
== ASN1_SUCCESS
)
674 c_time
= _gnutls_x509_generalTime2gtime (ttime
);
678 _gnutls_str_cat (name
, sizeof (name
), ".utcTime");
679 len
= sizeof (ttime
) - 1;
680 result
= asn1_read_value (c2
, name
, ttime
, &len
);
681 if (result
== ASN1_SUCCESS
)
682 c_time
= utcTime2gtime (ttime
);
685 /* We cannot handle dates after 2031 in 32 bit machines.
686 * a time_t of 64bits has to be used.
688 if (result
!= ASN1_SUCCESS
)
691 return (time_t) (-1);
698 /* Sets the time in time_t in the ASN1_TYPE given. Where should
699 * be something like "tbsCertList.thisUpdate".
702 _gnutls_x509_set_time (ASN1_TYPE c2
, const char *where
, time_t tim
, int nochoice
)
704 char str_time
[MAX_TIME
];
710 result
= gtime2generalTime( tim
, str_time
, sizeof(str_time
));
712 return gnutls_assert_val(result
);
714 len
= strlen (str_time
);
715 result
= asn1_write_value(c2
, where
, str_time
, len
);
716 if (result
!= ASN1_SUCCESS
)
717 return gnutls_assert_val(_gnutls_asn2err (result
));
722 _gnutls_str_cpy (name
, sizeof (name
), where
);
724 if ((result
= asn1_write_value (c2
, name
, "generalTime", 1)) < 0)
727 return _gnutls_asn2err (result
);
730 result
= gtime2generalTime (tim
, str_time
, sizeof (str_time
));
737 _gnutls_str_cat (name
, sizeof (name
), ".generalTime");
739 len
= strlen (str_time
);
740 result
= asn1_write_value (c2
, name
, str_time
, len
);
741 if (result
!= ASN1_SUCCESS
)
744 return _gnutls_asn2err (result
);
751 gnutls_x509_subject_alt_name_t
752 _gnutls_x509_san_find_type (char *str_type
)
754 if (strcmp (str_type
, "dNSName") == 0)
755 return GNUTLS_SAN_DNSNAME
;
756 if (strcmp (str_type
, "rfc822Name") == 0)
757 return GNUTLS_SAN_RFC822NAME
;
758 if (strcmp (str_type
, "uniformResourceIdentifier") == 0)
759 return GNUTLS_SAN_URI
;
760 if (strcmp (str_type
, "iPAddress") == 0)
761 return GNUTLS_SAN_IPADDRESS
;
762 if (strcmp (str_type
, "otherName") == 0)
763 return GNUTLS_SAN_OTHERNAME
;
764 if (strcmp (str_type
, "directoryName") == 0)
765 return GNUTLS_SAN_DN
;
766 return (gnutls_x509_subject_alt_name_t
) - 1;
769 /* A generic export function. Will export the given ASN.1 encoded data
770 * to PEM or DER raw data.
773 _gnutls_x509_export_int_named (ASN1_TYPE asn1_data
, const char *name
,
774 gnutls_x509_crt_fmt_t format
,
775 const char *pem_header
,
776 unsigned char *output_data
,
777 size_t * output_data_size
)
783 ret
= _gnutls_x509_export_int_named2 (asn1_data
, name
,
784 format
, pem_header
, &out
);
786 return gnutls_assert_val(ret
);
788 if (format
== GNUTLS_X509_FMT_PEM
)
793 if (*output_data_size
< size
)
795 *output_data_size
= size
;
796 ret
= gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER
);
800 *output_data_size
= (size_t)out
.size
;
803 memcpy (output_data
, out
.data
, (size_t)out
.size
);
804 if (format
== GNUTLS_X509_FMT_PEM
)
805 output_data
[out
.size
] = 0;
811 gnutls_free (out
.data
);
816 /* A generic export function. Will export the given ASN.1 encoded data
817 * to PEM or DER raw data.
820 _gnutls_x509_export_int_named2 (ASN1_TYPE asn1_data
, const char *name
,
821 gnutls_x509_crt_fmt_t format
,
822 const char *pem_header
,
827 if (format
== GNUTLS_X509_FMT_DER
)
829 ret
= _gnutls_x509_der_encode(asn1_data
, name
, out
, 0);
831 return gnutls_assert_val(ret
);
837 ret
= _gnutls_x509_der_encode (asn1_data
, name
, &tmp
, 0);
839 return gnutls_assert_val(ret
);
841 ret
= _gnutls_fbase64_encode (pem_header
, tmp
.data
, tmp
.size
, out
);
842 _gnutls_free_datum (&tmp
);
845 return gnutls_assert_val(ret
);
851 /* Decodes an octet string. Leave string_type null for a normal
852 * octet string. Otherwise put something like BMPString, PrintableString
856 _gnutls_x509_decode_octet_string (const char *string_type
,
857 const uint8_t * der
, size_t der_size
,
858 uint8_t * output
, size_t * output_size
)
860 ASN1_TYPE c2
= ASN1_TYPE_EMPTY
;
861 int result
, tmp_output_size
;
864 if (string_type
== NULL
)
865 _gnutls_str_cpy (strname
, sizeof (strname
), "PKIX1.pkcs-7-Data");
868 _gnutls_str_cpy (strname
, sizeof (strname
), "PKIX1.");
869 _gnutls_str_cat (strname
, sizeof (strname
), string_type
);
872 if ((result
= asn1_create_element
873 (_gnutls_get_pkix (), strname
, &c2
)) != ASN1_SUCCESS
)
876 result
= _gnutls_asn2err (result
);
880 result
= asn1_der_decoding (&c2
, der
, der_size
, NULL
);
881 if (result
!= ASN1_SUCCESS
)
884 result
= _gnutls_asn2err (result
);
888 tmp_output_size
= *output_size
;
889 result
= asn1_read_value (c2
, "", output
, &tmp_output_size
);
890 *output_size
= (size_t)tmp_output_size
;
892 if (result
!= ASN1_SUCCESS
)
895 result
= _gnutls_asn2err (result
);
903 asn1_delete_structure (&c2
);
909 /* Reads a value from an ASN1 tree, and puts the output
910 * in an allocated variable in the given datum.
911 * flags == 0 do nothing with the DER output
912 * flags == 1 parse the DER output as OCTET STRING
913 * flags == 2 the value is a BIT STRING
916 _gnutls_x509_read_value (ASN1_TYPE c
, const char *root
,
917 gnutls_datum_t
* ret
, int flags
)
923 result
= asn1_read_value (c
, root
, NULL
, &len
);
924 if (result
!= ASN1_MEM_ERROR
)
927 result
= _gnutls_asn2err (result
);
934 tmp
= gnutls_malloc ((size_t)len
);
938 result
= GNUTLS_E_MEMORY_ERROR
;
942 result
= asn1_read_value (c
, root
, tmp
, &len
);
943 if (result
!= ASN1_SUCCESS
)
946 result
= _gnutls_asn2err (result
);
953 /* Extract the OCTET STRING.
959 result
= _gnutls_x509_decode_octet_string (NULL
, tmp
, slen
, tmp
, &slen
);
969 ret
->size
= (unsigned)len
;
979 int _gnutls_x509_encode_octet_string(const void* input_data
, size_t input_size
,
980 gnutls_datum_t
* output
)
983 ASN1_TYPE c2
= ASN1_TYPE_EMPTY
;
985 if ((ret
= asn1_create_element
986 (_gnutls_get_pkix (), "PKIX1.pkcs-7-Data", &c2
)) != ASN1_SUCCESS
)
989 ret
= _gnutls_asn2err (ret
);
993 ret
= asn1_write_value (c2
, "", input_data
, input_size
);
994 if (ret
!= ASN1_SUCCESS
)
997 ret
= _gnutls_asn2err (ret
);
1001 ret
= _gnutls_x509_der_encode(c2
, "", output
, 0);
1011 asn1_delete_structure (&c2
);
1015 /* DER Encodes the src ASN1_TYPE and stores it to
1016 * the given datum. If str is non zero then the data are encoded as
1020 _gnutls_x509_der_encode (ASN1_TYPE src
, const char *src_name
,
1021 gnutls_datum_t
* res
, int str
)
1025 uint8_t *data
= NULL
;
1026 ASN1_TYPE c2
= ASN1_TYPE_EMPTY
;
1029 result
= asn1_der_coding (src
, src_name
, NULL
, &size
, NULL
);
1030 if (result
!= ASN1_MEM_ERROR
)
1033 result
= _gnutls_asn2err (result
);
1037 /* allocate data for the der
1041 size
+= 16; /* for later to include the octet tags */
1044 data
= gnutls_malloc ((size_t)size
);
1048 result
= GNUTLS_E_MEMORY_ERROR
;
1052 result
= asn1_der_coding (src
, src_name
, data
, &size
, NULL
);
1053 if (result
!= ASN1_SUCCESS
)
1056 result
= _gnutls_asn2err (result
);
1062 if ((result
= asn1_create_element
1063 (_gnutls_get_pkix (), "PKIX1.pkcs-7-Data", &c2
)) != ASN1_SUCCESS
)
1066 result
= _gnutls_asn2err (result
);
1070 result
= asn1_write_value (c2
, "", data
, size
);
1071 if (result
!= ASN1_SUCCESS
)
1074 result
= _gnutls_asn2err (result
);
1078 result
= asn1_der_coding (c2
, "", data
, &asize
, NULL
);
1079 if (result
!= ASN1_SUCCESS
)
1082 result
= _gnutls_asn2err (result
);
1088 asn1_delete_structure (&c2
);
1092 res
->size
= (unsigned)size
;
1097 asn1_delete_structure (&c2
);
1102 /* DER Encodes the src ASN1_TYPE and stores it to
1103 * dest in dest_name. Useful to encode something and store it
1104 * as OCTET. If str is non null then the data are encoded as
1108 _gnutls_x509_der_encode_and_copy (ASN1_TYPE src
, const char *src_name
,
1109 ASN1_TYPE dest
, const char *dest_name
,
1113 gnutls_datum_t encoded
;
1115 result
= _gnutls_x509_der_encode (src
, src_name
, &encoded
, str
);
1125 result
= asn1_write_value (dest
, dest_name
, encoded
.data
, (int)encoded
.size
);
1127 _gnutls_free_datum (&encoded
);
1129 if (result
!= ASN1_SUCCESS
)
1132 return _gnutls_asn2err (result
);
1138 /* Writes the value of the datum in the given ASN1_TYPE. If str is non
1139 * (0) it encodes it as OCTET STRING.
1142 _gnutls_x509_write_value (ASN1_TYPE c
, const char *root
,
1143 const gnutls_datum_t
* data
, int str
)
1146 ASN1_TYPE c2
= ASN1_TYPE_EMPTY
;
1147 gnutls_datum_t val
= { NULL
, 0 };
1151 /* Convert it to OCTET STRING
1153 if ((result
= asn1_create_element
1154 (_gnutls_get_pkix (), "PKIX1.pkcs-7-Data", &c2
)) != ASN1_SUCCESS
)
1157 result
= _gnutls_asn2err (result
);
1161 result
= asn1_write_value (c2
, "", data
->data
, data
->size
);
1162 if (result
!= ASN1_SUCCESS
)
1165 result
= _gnutls_asn2err (result
);
1169 result
= _gnutls_x509_der_encode (c2
, "", &val
, 0);
1179 val
.data
= data
->data
;
1180 val
.size
= data
->size
;
1185 result
= asn1_write_value (c
, root
, val
.data
, val
.size
);
1186 if (result
!= ASN1_SUCCESS
)
1189 result
= _gnutls_asn2err (result
);
1196 asn1_delete_structure (&c2
);
1197 if (val
.data
!= data
->data
)
1198 _gnutls_free_datum (&val
);
1203 _asnstr_append_name (char *name
, size_t name_size
, const char *part1
,
1208 _gnutls_str_cpy (name
, name_size
, part1
);
1209 _gnutls_str_cat (name
, name_size
, part2
);
1212 _gnutls_str_cpy (name
, name_size
, part2
+ 1 /* remove initial dot */ );
1217 /* Encodes and copies the private key parameters into a
1218 * subjectPublicKeyInfo structure.
1222 _gnutls_x509_encode_and_copy_PKI_params (ASN1_TYPE dst
,
1223 const char *dst_name
,
1224 gnutls_pk_algorithm_t
1225 pk_algorithm
, gnutls_pk_params_st
* params
)
1228 gnutls_datum_t der
= { NULL
, 0 };
1232 pk
= _gnutls_x509_pk_to_oid (pk_algorithm
);
1236 return GNUTLS_E_UNKNOWN_PK_ALGORITHM
;
1241 _asnstr_append_name (name
, sizeof (name
), dst_name
, ".algorithm.algorithm");
1243 result
= asn1_write_value (dst
, name
, pk
, 1);
1244 if (result
!= ASN1_SUCCESS
)
1247 return _gnutls_asn2err (result
);
1250 result
= _gnutls_x509_write_pubkey_params (pk_algorithm
, params
, &der
);
1257 _asnstr_append_name (name
, sizeof (name
), dst_name
,
1258 ".algorithm.parameters");
1260 result
= asn1_write_value (dst
, name
, der
.data
, der
.size
);
1262 _gnutls_free_datum (&der
);
1264 if (result
!= ASN1_SUCCESS
)
1267 return _gnutls_asn2err (result
);
1270 result
= _gnutls_x509_write_pubkey (pk_algorithm
, params
, &der
);
1277 /* Write the DER parameters. (in bits)
1279 _asnstr_append_name (name
, sizeof (name
), dst_name
,
1280 ".subjectPublicKey");
1281 result
= asn1_write_value (dst
, name
, der
.data
, der
.size
* 8);
1282 _gnutls_free_datum (&der
);
1284 if (result
!= ASN1_SUCCESS
)
1287 return _gnutls_asn2err (result
);
1293 /* Encodes and public key parameters into a
1294 * subjectPublicKeyInfo structure and stores it in der.
1297 _gnutls_x509_encode_PKI_params (gnutls_datum_t
*der
,
1298 gnutls_pk_algorithm_t
1299 pk_algorithm
, gnutls_pk_params_st
* params
)
1304 ret
= asn1_create_element (_gnutls_get_pkix (),
1305 "PKIX1.Certificate", &tmp
);
1306 if (ret
!= ASN1_SUCCESS
)
1309 return _gnutls_asn2err (ret
);
1312 ret
= _gnutls_x509_encode_and_copy_PKI_params (tmp
,
1313 "tbsCertificate.subjectPublicKeyInfo",
1314 pk_algorithm
, params
);
1315 if (ret
!= ASN1_SUCCESS
)
1318 ret
= _gnutls_asn2err (ret
);
1322 ret
= _gnutls_x509_der_encode(tmp
, "tbsCertificate.subjectPublicKeyInfo", der
, 0);
1325 asn1_delete_structure (&tmp
);
1330 /* Reads and returns the PK algorithm of the given certificate-like
1331 * ASN.1 structure. src_name should be something like "tbsCertificate.subjectPublicKeyInfo".
1334 _gnutls_x509_get_pk_algorithm (ASN1_TYPE src
, const char *src_name
,
1341 gnutls_pk_params_st params
;
1344 gnutls_pk_params_init(¶ms
);
1346 _asnstr_append_name (name
, sizeof (name
), src_name
, ".algorithm.algorithm");
1348 result
= asn1_read_value (src
, name
, oid
, &len
);
1350 if (result
!= ASN1_SUCCESS
)
1353 return _gnutls_asn2err (result
);
1356 algo
= _gnutls_x509_oid2pk_algorithm (oid
);
1357 if (algo
== GNUTLS_PK_UNKNOWN
)
1360 ("%s: unknown public key algorithm: %s\n", __func__
, oid
);
1368 /* Now read the parameters' bits
1370 result
= _gnutls_get_asn_mpis(src
, src_name
, ¶ms
);
1372 return gnutls_assert_val(result
);
1374 bits
[0] = pubkey_to_bits(algo
, ¶ms
);
1376 gnutls_pk_params_release(¶ms
);
1380 /* Reads the DER signed data from the certificate and allocates space and
1381 * returns them into signed_data.
1384 _gnutls_x509_get_signed_data (ASN1_TYPE src
, const char *src_name
,
1385 gnutls_datum_t
* signed_data
)
1388 int start
, end
, result
;
1390 result
= _gnutls_x509_der_encode (src
, "", &der
, 0);
1397 /* Get the signed data
1399 result
= asn1_der_decoding_startEnd (src
, der
.data
, der
.size
,
1400 src_name
, &start
, &end
);
1401 if (result
!= ASN1_SUCCESS
)
1403 result
= _gnutls_asn2err (result
);
1408 result
= _gnutls_set_datum (signed_data
, &der
.data
[start
], end
- start
+ 1);
1419 _gnutls_free_datum (&der
);
1425 * gnutls_x509_get_signature_algorithm:
1426 * @src: should contain an ASN1_TYPE structure
1427 * @src_name: the description of the signature field
1429 * This function will return a value of the #gnutls_sign_algorithm_t
1430 * enumeration that is the signature algorithm that has been used to
1431 * sign this certificate.
1433 * Returns: a #gnutls_sign_algorithm_t value, or a negative error code on
1437 _gnutls_x509_get_signature_algorithm (ASN1_TYPE src
, const char *src_name
)
1442 /* Read the signature algorithm. Note that parameters are not
1443 * read. They will be read from the issuer's certificate if needed.
1446 _gnutls_x509_read_value (src
, src_name
, &sa
, 0);
1454 result
= _gnutls_x509_oid2sign_algorithm ( (char*)sa
.data
);
1456 _gnutls_free_datum (&sa
);
1462 /* Reads the DER signature from the certificate and allocates space and
1463 * returns them into signed_data.
1466 _gnutls_x509_get_signature (ASN1_TYPE src
, const char *src_name
,
1467 gnutls_datum_t
* signature
)
1472 signature
->data
= NULL
;
1473 signature
->size
= 0;
1475 /* Read the signature
1478 result
= asn1_read_value (src
, src_name
, NULL
, &len
);
1480 if (result
!= ASN1_MEM_ERROR
)
1482 result
= _gnutls_asn2err (result
);
1491 result
= GNUTLS_E_CERTIFICATE_ERROR
;
1497 signature
->data
= gnutls_malloc (len
);
1498 if (signature
->data
== NULL
)
1501 result
= GNUTLS_E_MEMORY_ERROR
;
1505 /* read the bit string of the signature
1508 result
= asn1_read_value (src
, src_name
, signature
->data
, (int*)&bits
);
1510 if (result
!= ASN1_SUCCESS
)
1512 result
= _gnutls_asn2err (result
);
1517 signature
->size
= len
;