generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Separate the SCT List parser from the SCT List viewer

Browse Source 
(cherry picked from commit fd2309aa29e3ea00e445f03407820398962c0b94)
This commit is contained in:
Rob Stradling 2014-05-12 14:40:19 +01:00 committed by Dr. Stephen Henson
parent 728bd41a15
commit 5fc3d333c7
2 changed files with 194 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
crypto/stack/safestack.h
View File

@ -1481,6 +1481,28 @@ DECLARE_SPECIAL_STACK_OF(OPENSSL_BLOCK, void)
#define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st)) #define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st))
#define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st)) #define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st))
#define sk_SCT_new(cmp) SKM_sk_new(SCT, (cmp))
#define sk_SCT_new_null() SKM_sk_new_null(SCT)
#define sk_SCT_free(st) SKM_sk_free(SCT, (st))
#define sk_SCT_num(st) SKM_sk_num(SCT, (st))
#define sk_SCT_value(st, i) SKM_sk_value(SCT, (st), (i))
#define sk_SCT_set(st, i, val) SKM_sk_set(SCT, (st), (i), (val))
#define sk_SCT_zero(st) SKM_sk_zero(SCT, (st))
#define sk_SCT_push(st, val) SKM_sk_push(SCT, (st), (val))
#define sk_SCT_unshift(st, val) SKM_sk_unshift(SCT, (st), (val))
#define sk_SCT_find(st, val) SKM_sk_find(SCT, (st), (val))
#define sk_SCT_find_ex(st, val) SKM_sk_find_ex(SCT, (st), (val))
#define sk_SCT_delete(st, i) SKM_sk_delete(SCT, (st), (i))
#define sk_SCT_delete_ptr(st, ptr) SKM_sk_delete_ptr(SCT, (st), (ptr))
#define sk_SCT_insert(st, val, i) SKM_sk_insert(SCT, (st), (val), (i))
#define sk_SCT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SCT, (st), (cmp))
#define sk_SCT_dup(st) SKM_sk_dup(SCT, st)
#define sk_SCT_pop_free(st, free_func) SKM_sk_pop_free(SCT, (st), (free_func))
#define sk_SCT_shift(st) SKM_sk_shift(SCT, (st))
#define sk_SCT_pop(st) SKM_sk_pop(SCT, (st))
#define sk_SCT_sort(st) SKM_sk_sort(SCT, (st))
#define sk_SCT_is_sorted(st) SKM_sk_is_sorted(SCT, (st))
#define sk_SRP_gN_new(cmp) SKM_sk_new(SRP_gN, (cmp)) #define sk_SRP_gN_new(cmp) SKM_sk_new(SRP_gN, (cmp))
#define sk_SRP_gN_new_null() SKM_sk_new_null(SRP_gN) #define sk_SRP_gN_new_null() SKM_sk_new_null(SRP_gN)
#define sk_SRP_gN_free(st) SKM_sk_free(SRP_gN, (st)) #define sk_SRP_gN_free(st) SKM_sk_free(SRP_gN, (st))

243
crypto/x509v3/v3_scts.c
View File

@ -60,61 +60,88 @@
#include "cryptlib.h" #include "cryptlib.h"
#include <openssl/asn1.h> #include <openssl/asn1.h>
#include <openssl/x509v3.h> #include <openssl/x509v3.h>
#include <openssl/bn.h>
#include "../ssl/ssl_locl.h" #include "../ssl/ssl_locl.h"
#if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__) #if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
#define SCTS_TIMESTAMP unsigned __int64 #define SCT_TIMESTAMP unsigned __int64
#elif defined(__arch64__) #elif defined(__arch64__)
#define SCTS_TIMESTAMP unsigned long #define SCT_TIMESTAMP unsigned long
#else #else
#define SCTS_TIMESTAMP unsigned long long #define SCT_TIMESTAMP unsigned long long
#endif #endif
#define n2l8(c,l) (l =((SCTS_TIMESTAMP)(*((c)++)))<<56, \ #define n2l8(c,l) (l =((SCT_TIMESTAMP)(*((c)++)))<<56, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<<48, \ l|=((SCT_TIMESTAMP)(*((c)++)))<<48, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<<40, \ l|=((SCT_TIMESTAMP)(*((c)++)))<<40, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<<32, \ l|=((SCT_TIMESTAMP)(*((c)++)))<<32, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<<24, \ l|=((SCT_TIMESTAMP)(*((c)++)))<<24, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<<16, \ l|=((SCT_TIMESTAMP)(*((c)++)))<<16, \
l|=((SCTS_TIMESTAMP)(*((c)++)))<< 8, \ l|=((SCT_TIMESTAMP)(*((c)++)))<< 8, \
l|=((SCTS_TIMESTAMP)(*((c)++)))) l|=((SCT_TIMESTAMP)(*((c)++))))
typedef struct SCT_st {
/* The encoded SCT */
unsigned char *sct;
unsigned short sctlen;
static int i2r_scts(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct, BIO *out, int indent); /* Components of the SCT. "logid", "ext" and "sig" point to addresses
* inside "sct".
*/
unsigned char version;
unsigned char* logid;
unsigned short logidlen;
SCT_TIMESTAMP timestamp;
unsigned char *ext;
unsigned short extlen;
unsigned char hash_alg;
unsigned char sig_alg;
unsigned char *sig;
unsigned short siglen;
} SCT;
DECLARE_STACK_OF(SCT)
static void SCT_LIST_free(STACK_OF(SCT) *a);
static STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
long length);
static int i2r_SCT_LIST(X509V3_EXT_METHOD *method, STACK_OF(SCT) *sct_list,
BIO *out, int indent);
const X509V3_EXT_METHOD v3_ct_scts[] = { const X509V3_EXT_METHOD v3_ct_scts[] = {
{ NID_ct_precert_scts, 0, ASN1_ITEM_ref(ASN1_OCTET_STRING), { NID_ct_precert_scts, 0, NULL,
0,(X509V3_EXT_FREE)SCT_LIST_free,
(X509V3_EXT_D2I)d2i_SCT_LIST, 0,
0,0,0,0, 0,0,0,0,
0,0,0,0, (X509V3_EXT_I2R)i2r_SCT_LIST, 0,
(X509V3_EXT_I2R)i2r_scts, NULL,
NULL}, NULL},
{ NID_ct_cert_scts, 0, ASN1_ITEM_ref(ASN1_OCTET_STRING), { NID_ct_cert_scts, 0, NULL,
0,(X509V3_EXT_FREE)SCT_LIST_free,
(X509V3_EXT_D2I)d2i_SCT_LIST, 0,
0,0,0,0, 0,0,0,0,
0,0,0,0, (X509V3_EXT_I2R)i2r_SCT_LIST, 0,
(X509V3_EXT_I2R)i2r_scts, NULL,
NULL}, NULL},
}; };
static void tls12_signature_print(BIO *out, const unsigned char *data) static void tls12_signature_print(BIO *out, const unsigned char hash_alg,
const unsigned char sig_alg)
{ {
int nid = NID_undef; int nid = NID_undef;
/* RFC6962 only permits two signature algorithms */ /* RFC6962 only permits two signature algorithms */
if (data[0] == TLSEXT_hash_sha256) if (hash_alg == TLSEXT_hash_sha256)
{ {
if (data[1] == TLSEXT_signature_rsa) if (sig_alg == TLSEXT_signature_rsa)
nid = NID_sha256WithRSAEncryption; nid = NID_sha256WithRSAEncryption;
else if (data[1] == TLSEXT_signature_ecdsa) else if (sig_alg == TLSEXT_signature_ecdsa)
nid = NID_ecdsa_with_SHA256; nid = NID_ecdsa_with_SHA256;
} }
if (nid == NID_undef) if (nid == NID_undef)
BIO_printf(out, "%02X%02X", data[0], data[1]); BIO_printf(out, "%02X%02X", hash_alg, sig_alg);
else else
BIO_printf(out, "%s", OBJ_nid2ln(nid)); BIO_printf(out, "%s", OBJ_nid2ln(nid));
} }
static void timestamp_print(BIO *out, SCTS_TIMESTAMP timestamp) static void timestamp_print(BIO *out, SCT_TIMESTAMP timestamp)
{ {
ASN1_GENERALIZEDTIME *gen; ASN1_GENERALIZEDTIME *gen;
char genstr[20]; char genstr[20];
@ -133,38 +160,72 @@ static void timestamp_print(BIO *out, SCTS_TIMESTAMP timestamp)
ASN1_GENERALIZEDTIME_free(gen); ASN1_GENERALIZEDTIME_free(gen);
} }
static int i2r_scts(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct, static void SCT_free(SCT *sct)
BIO *out, int indent)
{ {
SCTS_TIMESTAMP timestamp; if (sct)
unsigned char* data = oct->data; {
if (sct->sct) OPENSSL_free(sct->sct);
OPENSSL_free(sct);
}
}
static void SCT_LIST_free(STACK_OF(SCT) *a)
{
sk_SCT_pop_free(a, SCT_free);
}
static STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
long length)
{
ASN1_OCTET_STRING *oct = NULL;
STACK_OF(SCT) *sk = NULL;
SCT *sct;
unsigned char *p, *p2;
unsigned short listlen, sctlen = 0, fieldlen; unsigned short listlen, sctlen = 0, fieldlen;
if (d2i_ASN1_OCTET_STRING(&oct, pp, length) == NULL)
return NULL;
if (oct->length < 2) if (oct->length < 2)
return 0; goto done;
n2s(data, listlen); p = oct->data;
n2s(p, listlen);
if (listlen != oct->length - 2) if (listlen != oct->length - 2)
return 0; goto done;
if ((sk=sk_SCT_new_null()) == NULL)
goto done;
while (listlen > 0) while (listlen > 0)
{ {
if (listlen < 2) if (listlen < 2)
return 0; goto err;
n2s(data, sctlen); n2s(p, sctlen);
listlen -= 2; listlen -= 2;
if ((sctlen < 1) || (sctlen > listlen)) if ((sctlen < 1) || (sctlen > listlen))
return 0; goto err;
listlen -= sctlen; listlen -= sctlen;
BIO_printf(out, "%*sSigned Certificate Timestamp:", indent, sct = OPENSSL_malloc(sizeof(SCT));
""); if (!sct)
BIO_printf(out, "\n%*sVersion : ", indent + 4, ""); goto err;
if (!sk_SCT_push(sk, sct))
if (*data == 0) /* SCT v1 */
{ {
BIO_printf(out, "v1(0)"); OPENSSL_free(sct);
goto err;
}
sct->sct = OPENSSL_malloc(sctlen);
if (!sct->sct)
goto err;
memcpy(sct->sct, p, sctlen);
sct->sctlen = sctlen;
p += sctlen;
p2 = sct->sct;
sct->version = *p2++;
if (sct->version == 0) /* SCT v1 */
{
/* Fixed-length header: /* Fixed-length header:
* struct { * struct {
* (1 byte) Version sct_version; * (1 byte) Version sct_version;
@ -173,56 +234,96 @@ static int i2r_scts(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct,
* (2 bytes + ?) CtExtensions extensions; * (2 bytes + ?) CtExtensions extensions;
*/ */
if (sctlen < 43) if (sctlen < 43)
return 0; goto err;
sctlen -= 43; sctlen -= 43;
BIO_printf(out, "\n%*sLog ID : ", indent + 4, ""); sct->logid = p2;
BIO_hex_string(out, indent + 16, 16, data + 1, 32); sct->logidlen = 32;
p2 += 32;
data += 33; n2l8(p2, sct->timestamp);
n2l8(data, timestamp);
BIO_printf(out, "\n%*sTimestamp : ", indent + 4, "");
timestamp_print(out, timestamp);
n2s(data, fieldlen); n2s(p2, fieldlen);
if (sctlen < fieldlen) if (sctlen < fieldlen)
return 0; goto err;
sct->ext = p2;
sct->extlen = fieldlen;
p2 += fieldlen;
sctlen -= fieldlen; sctlen -= fieldlen;
BIO_printf(out, "\n%*sExtensions: ", indent + 4, "");
if (fieldlen == 0)
BIO_printf(out, "none");
else
BIO_hex_string(out, indent + 16, 16, data,
fieldlen);
data += fieldlen;
/* digitally-signed struct header: /* digitally-signed struct header:
* (1 byte) Hash algorithm * (1 byte) Hash algorithm
* (1 byte) Signature algorithm * (1 byte) Signature algorithm
* (2 bytes + ?) Signature * (2 bytes + ?) Signature
*/ */
if (sctlen < 4) if (sctlen < 4)
return 0; goto err;
sctlen -= 4; sctlen -= 4;
BIO_printf(out, "\n%*sSignature : ", indent + 4, ""); sct->hash_alg = *p2++;
tls12_signature_print(out, data); sct->sig_alg = *p2++;
data += 2; n2s(p2, fieldlen);
n2s(data, fieldlen);
if (sctlen != fieldlen) if (sctlen != fieldlen)
return 0; goto err;
sct->sig = p2;
sct->siglen = fieldlen;
}
}
done:
ASN1_OCTET_STRING_free(oct);
return sk;
err:
SCT_LIST_free(sk);
sk = NULL;
goto done;
}
static int i2r_SCT_LIST(X509V3_EXT_METHOD *method, STACK_OF(SCT) *sct_list,
BIO *out, int indent)
{
SCT *sct;
int i;
for (i = 0; i < sk_SCT_num(sct_list);) {
sct = sk_SCT_value(sct_list, i);
BIO_printf(out, "%*sSigned Certificate Timestamp:", indent, "");
BIO_printf(out, "\n%*sVersion : ", indent + 4, "");
if (sct->version == 0) /* SCT v1 */
{
BIO_printf(out, "v1(0)");
BIO_printf(out, "\n%*sLog ID : ", indent + 4, "");
BIO_hex_string(out, indent + 16, 16, sct->logid,
sct->logidlen);
BIO_printf(out, "\n%*sTimestamp : ", indent + 4, "");
timestamp_print(out, sct->timestamp);
BIO_printf(out, "\n%*sExtensions: ", indent + 4, "");
if (sct->extlen == 0)
BIO_printf(out, "none");
else
BIO_hex_string(out, indent + 16, 16, sct->ext,
sct->extlen);
BIO_printf(out, "\n%*sSignature : ", indent + 4, "");
tls12_signature_print(out, sct->hash_alg, sct->sig_alg);
BIO_printf(out, "\n%*s ", indent + 4, ""); BIO_printf(out, "\n%*s ", indent + 4, "");
BIO_hex_string(out, indent + 16, 16, data, fieldlen); BIO_hex_string(out, indent + 16, 16, sct->sig,
data += fieldlen; sct->siglen);
} }
else /* Unknown version */ else /* Unknown version */
{ {
BIO_printf(out, "unknown\n%*s", indent + 16, ""); BIO_printf(out, "unknown\n%*s", indent + 16, "");
BIO_hex_string(out, indent + 16, 16, data, sctlen); BIO_hex_string(out, indent + 16, 16, sct->sct,
data += sctlen; sct->sctlen);
} }
if (listlen > 0) BIO_printf(out, "\n"); if (++i < sk_SCT_num(sct_list)) BIO_printf(out, "\n");
} }
return 1; return 1;