Botan 2.19.5 Crypto and TLS for C&

x509_ext.cpp
Go to the documentation of this file.
1/*
2* X.509 Certificate Extensions
3* (C) 1999-2010,2012 Jack Lloyd
4* (C) 2016 René Korthaus, Rohde & Schwarz Cybersecurity
5* (C) 2017 Fabian Weissberg, Rohde & Schwarz Cybersecurity
6*
7* Botan is released under the Simplified BSD License (see license.txt)
8*/
9
10#include <botan/x509_ext.h>
11#include <botan/x509cert.h>
12#include <botan/datastor.h>
13#include <botan/der_enc.h>
14#include <botan/ber_dec.h>
15#include <botan/hash.h>
16#include <botan/loadstor.h>
17#include <botan/internal/bit_ops.h>
18#include <algorithm>
19#include <set>
20#include <sstream>
21
22 namespace Botan {
23
24/*
25* Create a Certificate_Extension object of some kind to handle
26*/
27std::unique_ptr<Certificate_Extension>
28Extensions::create_extn_obj(const OID& oid,
29 bool critical,
30 const std::vector<uint8_t>& body)
31 {
32 const std::string oid_str = oid.to_string();
33
34 std::unique_ptr<Certificate_Extension> extn;
35
36 if(oid == Cert_Extension::Subject_Key_ID::static_oid())
37 {
38 extn.reset(new Cert_Extension::Subject_Key_ID);
39 }
40 else if(oid == Cert_Extension::Key_Usage::static_oid())
41 {
42 extn.reset(new Cert_Extension::Key_Usage);
43 }
44 else if(oid == Cert_Extension::Subject_Alternative_Name::static_oid())
45 {
46 extn.reset(new Cert_Extension::Subject_Alternative_Name);
47 }
48 else if(oid == Cert_Extension::Issuer_Alternative_Name::static_oid())
49 {
50 extn.reset(new Cert_Extension::Issuer_Alternative_Name);
51 }
52 else if(oid == Cert_Extension::Basic_Constraints::static_oid())
53 {
54 extn.reset(new Cert_Extension::Basic_Constraints);
55 }
56 else if(oid == Cert_Extension::CRL_Number::static_oid())
57 {
58 extn.reset(new Cert_Extension::CRL_Number);
59 }
60 else if(oid == Cert_Extension::CRL_ReasonCode::static_oid())
61 {
62 extn.reset(new Cert_Extension::CRL_ReasonCode);
63 }
64 else if(oid == Cert_Extension::Authority_Key_ID::static_oid())
65 {
66 extn.reset(new Cert_Extension::Authority_Key_ID);
67 }
68 else if(oid == Cert_Extension::Name_Constraints::static_oid())
69 {
70 extn.reset(new Cert_Extension::Name_Constraints);
71 }
72 else if(oid == Cert_Extension::CRL_Distribution_Points::static_oid())
73 {
74 extn.reset(new Cert_Extension::CRL_Distribution_Points);
75 }
76 else if(oid == Cert_Extension::CRL_Issuing_Distribution_Point::static_oid())
77 {
78 extn.reset(new Cert_Extension::CRL_Issuing_Distribution_Point);
79 }
80 else if(oid == Cert_Extension::Certificate_Policies::static_oid())
81 {
82 extn.reset(new Cert_Extension::Certificate_Policies);
83 }
84 else if(oid == Cert_Extension::Extended_Key_Usage::static_oid())
85 {
86 extn.reset(new Cert_Extension::Extended_Key_Usage);
87 }
88 else if(oid == Cert_Extension::Authority_Information_Access::static_oid())
89 {
90 extn.reset(new Cert_Extension::Authority_Information_Access);
91 }
92 else
93 {
94 // some other unknown extension type
95 extn.reset(new Cert_Extension::Unknown_Extension(oid, critical));
96 }
97
98 try
99 {
100 extn->decode_inner(body);
101 }
102 catch(Decoding_Error&)
103 {
104 extn.reset(new Cert_Extension::Unknown_Extension(oid, critical));
105 extn->decode_inner(body);
106 }
107 return extn;
108 }
109
110/*
111* Validate the extension (the default implementation is a NOP)
112*/
113 void Certificate_Extension::validate(const X509_Certificate&, const X509_Certificate&,
114 const std::vector<std::shared_ptr<const X509_Certificate>>&,
115 std::vector<std::set<Certificate_Status_Code>>&,
116 size_t)
117 {
118 }
119
120/*
121* Add a new cert
122*/
123 void Extensions::add(Certificate_Extension* extn, bool critical)
124 {
125 // sanity check: we don't want to have the same extension more than once
126 if(m_extension_info.count(extn->oid_of()) > 0)
127 {
128 const std::string name = extn->oid_name();
129 delete extn;
130 throw Invalid_Argument("Extension " + name + " already present in Extensions::add");
131 }
132
133 const OID oid = extn->oid_of();
134 Extensions_Info info(critical, extn);
135 m_extension_oids.push_back(oid);
136 m_extension_info[oid] = info;
137 }
138
139 bool Extensions::add_new(Certificate_Extension* extn, bool critical)
140 {
141 if(m_extension_info.count(extn->oid_of()) > 0)
142 {
143 delete extn;
144 return false; // already exists
145 }
146
147 const OID oid = extn->oid_of();
148 Extensions_Info info(critical, extn);
149 m_extension_oids.push_back(oid);
150 m_extension_info[oid] = info;
151 return true;
152 }
153
154 bool Extensions::remove(const OID& oid)
155 {
156 const bool erased = m_extension_info.erase(oid) > 0;
157
158 if(erased)
159 {
160 m_extension_oids.erase(std::find(m_extension_oids.begin(), m_extension_oids.end(), oid));
161 }
162
163 return erased;
164 }
165
166 void Extensions::replace(Certificate_Extension* extn, bool critical)
167 {
168 // Remove it if it existed
169 remove(extn->oid_of());
170
171 const OID oid = extn->oid_of();
172 Extensions_Info info(critical, extn);
173 m_extension_oids.push_back(oid);
174 m_extension_info[oid] = info;
175 }
176
177 bool Extensions::extension_set(const OID& oid) const
178 {
179 return (m_extension_info.find(oid) != m_extension_info.end());
180 }
181
182 bool Extensions::critical_extension_set(const OID& oid) const
183 {
184 auto i = m_extension_info.find(oid);
185 if(i != m_extension_info.end())
186 return i->second.is_critical();
187 return false;
188 }
189
190std::vector<uint8_t> Extensions::get_extension_bits(const OID& oid) const
191 {
192 auto i = m_extension_info.find(oid);
193 if(i == m_extension_info.end())
194 throw Invalid_Argument("Extensions::get_extension_bits no such extension set");
195
196 return i->second.bits();
197 }
198
199 const Certificate_Extension* Extensions::get_extension_object(const OID& oid) const
200 {
201 auto extn = m_extension_info.find(oid);
202 if(extn == m_extension_info.end())
203 return nullptr;
204
205 return &extn->second.obj();
206 }
207
208std::unique_ptr<Certificate_Extension> Extensions::get(const OID& oid) const
209 {
210 if(const Certificate_Extension* ext = this->get_extension_object(oid))
211 {
212 return std::unique_ptr<Certificate_Extension>(ext->copy());
213 }
214 return nullptr;
215 }
216
217std::vector<std::pair<std::unique_ptr<Certificate_Extension>, bool>> Extensions::extensions() const
218 {
219 std::vector<std::pair<std::unique_ptr<Certificate_Extension>, bool>> exts;
220 for(auto&& ext : m_extension_info)
221 {
222 exts.push_back(
223 std::make_pair(
224 std::unique_ptr<Certificate_Extension>(ext.second.obj().copy()),
225 ext.second.is_critical())
226 );
227 }
228 return exts;
229 }
230
231std::map<OID, std::pair<std::vector<uint8_t>, bool>> Extensions::extensions_raw() const
232 {
233 std::map<OID, std::pair<std::vector<uint8_t>, bool>> out;
234 for(auto&& ext : m_extension_info)
235 {
236 const auto bits = ext.second.bits();
237 const bool is_critical = ext.second.is_critical();
238
239 out[ext.first] = std::make_pair(bits, is_critical);
240 }
241 return out;
242 }
243
244/*
245* Encode an Extensions list
246*/
247 void Extensions::encode_into(DER_Encoder& to_object) const
248 {
249 for(auto ext_info : m_extension_info)
250 {
251 const OID& oid = ext_info.first;
252 const bool should_encode = ext_info.second.obj().should_encode();
253
254 if(should_encode)
255 {
256 const bool is_critical = ext_info.second.is_critical();
257 const std::vector<uint8_t>& ext_value = ext_info.second.bits();
258
259 to_object.start_cons(SEQUENCE)
260 .encode(oid)
261 .encode_optional(is_critical, false)
262 .encode(ext_value, OCTET_STRING)
263 .end_cons();
264 }
265 }
266 }
267
268/*
269* Decode a list of Extensions
270*/
271 void Extensions::decode_from(BER_Decoder& from_source)
272 {
273 m_extension_oids.clear();
274 m_extension_info.clear();
275
276 BER_Decoder sequence = from_source.start_cons(SEQUENCE);
277
278 while(sequence.more_items())
279 {
280 OID oid;
281 bool critical;
282 std::vector<uint8_t> bits;
283
284 sequence.start_cons(SEQUENCE)
285 .decode(oid)
286 .decode_optional(critical, BOOLEAN, UNIVERSAL, false)
287 .decode(bits, OCTET_STRING)
288 .end_cons();
289
290 std::unique_ptr<Certificate_Extension> obj = create_extn_obj(oid, critical, bits);
291 Extensions_Info info(critical, bits, obj.release());
292
293 m_extension_oids.push_back(oid);
294 m_extension_info[oid] = info;
295 }
296 sequence.verify_end();
297 }
298
299/*
300* Write the extensions to an info store
301*/
302 void Extensions::contents_to(Data_Store& subject_info,
303 Data_Store& issuer_info) const
304 {
305 for(auto&& m_extn_info : m_extension_info)
306 {
307 m_extn_info.second.obj().contents_to(subject_info, issuer_info);
308 subject_info.add(m_extn_info.second.obj().oid_name() + ".is_critical",
309 m_extn_info.second.is_critical());
310 }
311 }
312
313 namespace Cert_Extension {
314
315/*
316* Checked accessor for the path_limit member
317*/
318 size_t Basic_Constraints::get_path_limit() const
319 {
320 if(!m_is_ca)
321 throw Invalid_State("Basic_Constraints::get_path_limit: Not a CA");
322 return m_path_limit;
323 }
324
325/*
326* Encode the extension
327*/
328std::vector<uint8_t> Basic_Constraints::encode_inner() const
329 {
330 std::vector<uint8_t> output;
331 DER_Encoder(output)
332 .start_cons(SEQUENCE)
333 .encode_if(m_is_ca,
334 DER_Encoder()
335 .encode(m_is_ca)
336 .encode_optional(m_path_limit, NO_CERT_PATH_LIMIT)
337 )
338 .end_cons();
339 return output;
340 }
341
342/*
343* Decode the extension
344*/
345 void Basic_Constraints::decode_inner(const std::vector<uint8_t>& in)
346 {
347 BER_Decoder(in)
348 .start_cons(SEQUENCE)
349 .decode_optional(m_is_ca, BOOLEAN, UNIVERSAL, false)
350 .decode_optional(m_path_limit, INTEGER, UNIVERSAL, NO_CERT_PATH_LIMIT)
351 .end_cons();
352
353 if(m_is_ca == false)
354 m_path_limit = 0;
355 }
356
357/*
358* Return a textual representation
359*/
360 void Basic_Constraints::contents_to(Data_Store& subject, Data_Store&) const
361 {
362 subject.add("X509v3.BasicConstraints.is_ca", (m_is_ca ? 1 : 0));
363 subject.add("X509v3.BasicConstraints.path_constraint", static_cast<uint32_t>(m_path_limit));
364 }
365
366/*
367* Encode the extension
368*/
369std::vector<uint8_t> Key_Usage::encode_inner() const
370 {
371 if(m_constraints == NO_CONSTRAINTS)
372 throw Encoding_Error("Cannot encode zero usage constraints");
373
374 const size_t unused_bits = ctz(static_cast<uint32_t>(m_constraints));
375
376 std::vector<uint8_t> der;
377 der.push_back(BIT_STRING);
378 der.push_back(2 + ((unused_bits < 8) ? 1 : 0));
379 der.push_back(unused_bits % 8);
380 der.push_back((m_constraints >> 8) & 0xFF);
381 if(m_constraints & 0xFF)
382 der.push_back(m_constraints & 0xFF);
383
384 return der;
385 }
386
387/*
388* Decode the extension
389*/
390 void Key_Usage::decode_inner(const std::vector<uint8_t>& in)
391 {
392 BER_Decoder ber(in);
393
394 BER_Object obj = ber.get_next_object();
395
396 obj.assert_is_a(BIT_STRING, UNIVERSAL, "usage constraint");
397
398 if(obj.length() != 2 && obj.length() != 3)
399 throw BER_Decoding_Error("Bad size for BITSTRING in usage constraint");
400
401 uint16_t usage = 0;
402
403 const uint8_t* bits = obj.bits();
404
405 if(bits[0] >= 8)
406 throw BER_Decoding_Error("Invalid unused bits in usage constraint");
407
408 const uint8_t mask = static_cast<uint8_t>(0xFF << bits[0]);
409
410 if(obj.length() == 2)
411 {
412 usage = make_uint16(bits[1] & mask, 0);
413 }
414 else if(obj.length() == 3)
415 {
416 usage = make_uint16(bits[1], bits[2] & mask);
417 }
418
419 m_constraints = Key_Constraints(usage);
420 }
421
422/*
423* Return a textual representation
424*/
425 void Key_Usage::contents_to(Data_Store& subject, Data_Store&) const
426 {
427 subject.add("X509v3.KeyUsage", m_constraints);
428 }
429
430/*
431* Encode the extension
432*/
433std::vector<uint8_t> Subject_Key_ID::encode_inner() const
434 {
435 std::vector<uint8_t> output;
436 DER_Encoder(output).encode(m_key_id, OCTET_STRING);
437 return output;
438 }
439
440/*
441* Decode the extension
442*/
443 void Subject_Key_ID::decode_inner(const std::vector<uint8_t>& in)
444 {
445 BER_Decoder(in).decode(m_key_id, OCTET_STRING).verify_end();
446 }
447
448/*
449* Return a textual representation
450*/
451 void Subject_Key_ID::contents_to(Data_Store& subject, Data_Store&) const
452 {
453 subject.add("X509v3.SubjectKeyIdentifier", m_key_id);
454 }
455
456/*
457* Subject_Key_ID Constructor
458*/
459 Subject_Key_ID::Subject_Key_ID(const std::vector<uint8_t>& pub_key, const std::string& hash_name)
460 {
461 std::unique_ptr<HashFunction> hash(HashFunction::create_or_throw(hash_name));
462
463 m_key_id.resize(hash->output_length());
464
465 hash->update(pub_key);
466 hash->final(m_key_id.data());
467
468 // Truncate longer hashes, 192 bits here seems plenty
469 const size_t max_skid_len = (192 / 8);
470 if(m_key_id.size() > max_skid_len)
471 m_key_id.resize(max_skid_len);
472 }
473
474/*
475* Encode the extension
476*/
477std::vector<uint8_t> Authority_Key_ID::encode_inner() const
478 {
479 std::vector<uint8_t> output;
480 DER_Encoder(output)
481 .start_cons(SEQUENCE)
482 .encode(m_key_id, OCTET_STRING, ASN1_Tag(0), CONTEXT_SPECIFIC)
483 .end_cons();
484 return output;
485 }
486
487/*
488* Decode the extension
489*/
490 void Authority_Key_ID::decode_inner(const std::vector<uint8_t>& in)
491 {
492 BER_Decoder(in)
493 .start_cons(SEQUENCE)
494 .decode_optional_string(m_key_id, OCTET_STRING, 0);
495 }
496
497/*
498* Return a textual representation
499*/
500 void Authority_Key_ID::contents_to(Data_Store&, Data_Store& issuer) const
501 {
502 if(m_key_id.size())
503 issuer.add("X509v3.AuthorityKeyIdentifier", m_key_id);
504 }
505
506/*
507* Encode the extension
508*/
509std::vector<uint8_t> Subject_Alternative_Name::encode_inner() const
510 {
511 std::vector<uint8_t> output;
512 DER_Encoder(output).encode(m_alt_name);
513 return output;
514 }
515
516/*
517* Encode the extension
518*/
519std::vector<uint8_t> Issuer_Alternative_Name::encode_inner() const
520 {
521 std::vector<uint8_t> output;
522 DER_Encoder(output).encode(m_alt_name);
523 return output;
524 }
525
526/*
527* Decode the extension
528*/
529 void Subject_Alternative_Name::decode_inner(const std::vector<uint8_t>& in)
530 {
531 BER_Decoder(in).decode(m_alt_name);
532 }
533
534/*
535* Decode the extension
536*/
537 void Issuer_Alternative_Name::decode_inner(const std::vector<uint8_t>& in)
538 {
539 BER_Decoder(in).decode(m_alt_name);
540 }
541
542/*
543* Return a textual representation
544*/
545 void Subject_Alternative_Name::contents_to(Data_Store& subject_info,
546 Data_Store&) const
547 {
548 subject_info.add(get_alt_name().contents());
549 }
550
551/*
552* Return a textual representation
553*/
554 void Issuer_Alternative_Name::contents_to(Data_Store&, Data_Store& issuer_info) const
555 {
556 issuer_info.add(get_alt_name().contents());
557 }
558
559/*
560* Encode the extension
561*/
562std::vector<uint8_t> Extended_Key_Usage::encode_inner() const
563 {
564 std::vector<uint8_t> output;
565 DER_Encoder(output)
566 .start_cons(SEQUENCE)
567 .encode_list(m_oids)
568 .end_cons();
569 return output;
570 }
571
572/*
573* Decode the extension
574*/
575 void Extended_Key_Usage::decode_inner(const std::vector<uint8_t>& in)
576 {
577 BER_Decoder(in).decode_list(m_oids);
578 }
579
580/*
581* Return a textual representation
582*/
583 void Extended_Key_Usage::contents_to(Data_Store& subject, Data_Store&) const
584 {
585 for(size_t i = 0; i != m_oids.size(); ++i)
586 subject.add("X509v3.ExtendedKeyUsage", m_oids[i].to_string());
587 }
588
589/*
590* Encode the extension
591*/
592std::vector<uint8_t> Name_Constraints::encode_inner() const
593 {
594 throw Not_Implemented("Name_Constraints encoding");
595 }
596
597
598/*
599* Decode the extension
600*/
601 void Name_Constraints::decode_inner(const std::vector<uint8_t>& in)
602 {
603 std::vector<GeneralSubtree> permit, exclude;
604 BER_Decoder ber(in);
605 BER_Decoder inner = ber.start_cons(SEQUENCE);
606 BER_Object per = inner.get_next_object();
607
608 inner.push_back(per);
609 if(per.is_a(0, ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC)))
610 {
611 inner.decode_list(permit,ASN1_Tag(0),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
612 if(permit.empty())
613 throw Encoding_Error("Empty Name Contraint list");
614 }
615
616 BER_Object exc = inner.get_next_object();
617 inner.push_back(exc);
618 if(exc.is_a(1, ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC)))
619 {
620 inner.decode_list(exclude,ASN1_Tag(1),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
621 if(exclude.empty())
622 throw Encoding_Error("Empty Name Contraint list");
623 }
624
625 inner.end_cons();
626
627 if(permit.empty() && exclude.empty())
628 throw Encoding_Error("Empty Name Contraint extension");
629
630 m_name_constraints = NameConstraints(std::move(permit),std::move(exclude));
631 }
632
633/*
634* Return a textual representation
635*/
636 void Name_Constraints::contents_to(Data_Store& subject, Data_Store&) const
637 {
638 std::stringstream ss;
639
640 for(const GeneralSubtree& gs: m_name_constraints.permitted())
641 {
642 ss << gs;
643 subject.add("X509v3.NameConstraints.permitted", ss.str());
644 ss.str(std::string());
645 }
646 for(const GeneralSubtree& gs: m_name_constraints.excluded())
647 {
648 ss << gs;
649 subject.add("X509v3.NameConstraints.excluded", ss.str());
650 ss.str(std::string());
651 }
652 }
653
654 void Name_Constraints::validate(const X509_Certificate& subject, const X509_Certificate& /*issuer*/,
655 const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
656 std::vector<std::set<Certificate_Status_Code>>& cert_status,
657 size_t pos)
658 {
659 // This is much smaller limit than in Botan3 because here name constraint checks
660 // are much more expensive due to optimizations which would be difficult to
661 // backport here.
662 const size_t MAX_NC_COMPARES = (1 << 12);
663 const size_t total_constraints = m_name_constraints.permitted().size() + m_name_constraints.excluded().size();
664
665 if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty())
666 {
667 if(!subject.is_CA_cert())
668 {
669 cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
670 }
671
672 const bool issuer_name_constraint_critical =
673 subject.is_critical("X509v3.NameConstraints");
674
675 // Check that all subordinate certs pass the name constraint
676 for(size_t j = 0; j < pos; ++j)
677 {
678 const auto& cert = cert_path.at(j);
679
680 const size_t total_names =
681 cert->subject_dn().dn_info().size() +
682 cert->subject_alt_name().get_attributes().size();
683
684 if(total_names * total_constraints >= MAX_NC_COMPARES) {
685 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
686 continue;
687 }
688
689 if(!m_name_constraints.is_permitted(*cert, issuer_name_constraint_critical)) {
690 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
691 continue;
692 }
693
694 if(m_name_constraints.is_excluded(*cert, issuer_name_constraint_critical)) {
695 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
696 continue;
697 }
698 }
699 }
700}
701
702 namespace {
703
704/*
705* A policy specifier
706*/
707 class Policy_Information final : public ASN1_Object
708 {
709 public:
710 Policy_Information() = default;
711 explicit Policy_Information(const OID& oid) : m_oid(oid) {}
712
713 const OID& oid() const { return m_oid; }
714
715 void encode_into(DER_Encoder& codec) const override
716 {
717 codec.start_cons(SEQUENCE)
718 .encode(m_oid)
719 .end_cons();
720 }
721
722 void decode_from(BER_Decoder& codec) override
723 {
724 codec.start_cons(SEQUENCE)
725 .decode(m_oid)
726 .discard_remaining()
727 .end_cons();
728 }
729
730 private:
731 OID m_oid;
732 };
733
734}
735
736/*
737* Encode the extension
738*/
739std::vector<uint8_t> Certificate_Policies::encode_inner() const
740 {
741 std::vector<Policy_Information> policies;
742
743 for(size_t i = 0; i != m_oids.size(); ++i)
744 policies.push_back(Policy_Information(m_oids[i]));
745
746 std::vector<uint8_t> output;
747 DER_Encoder(output)
748 .start_cons(SEQUENCE)
749 .encode_list(policies)
750 .end_cons();
751 return output;
752 }
753
754/*
755* Decode the extension
756*/
757 void Certificate_Policies::decode_inner(const std::vector<uint8_t>& in)
758 {
759 std::vector<Policy_Information> policies;
760
761 BER_Decoder(in).decode_list(policies);
762 m_oids.clear();
763 for(size_t i = 0; i != policies.size(); ++i)
764 m_oids.push_back(policies[i].oid());
765 }
766
767/*
768* Return a textual representation
769*/
770 void Certificate_Policies::contents_to(Data_Store& info, Data_Store&) const
771 {
772 for(size_t i = 0; i != m_oids.size(); ++i)
773 info.add("X509v3.CertificatePolicies", m_oids[i].to_string());
774 }
775
776 void Certificate_Policies::validate(
777 const X509_Certificate& /*subject*/,
778 const X509_Certificate& /*issuer*/,
779 const std::vector<std::shared_ptr<const X509_Certificate>>& /*cert_path*/,
780 std::vector<std::set<Certificate_Status_Code>>& cert_status,
781 size_t pos)
782 {
783 std::set<OID> oid_set(m_oids.begin(), m_oids.end());
784 if(oid_set.size() != m_oids.size())
785 {
786 cert_status.at(pos).insert(Certificate_Status_Code::DUPLICATE_CERT_POLICY);
787 }
788 }
789
790std::vector<uint8_t> Authority_Information_Access::encode_inner() const
791 {
792 ASN1_String url(m_ocsp_responder, IA5_STRING);
793
794 std::vector<uint8_t> output;
795 DER_Encoder(output)
796 .start_cons(SEQUENCE)
797 .start_cons(SEQUENCE)
798 .encode(OID::from_string("PKIX.OCSP"))
799 .add_object(ASN1_Tag(6), CONTEXT_SPECIFIC, url.value())
800 .end_cons()
801 .end_cons();
802 return output;
803 }
804
805 void Authority_Information_Access::decode_inner(const std::vector<uint8_t>& in)
806 {
807 BER_Decoder ber = BER_Decoder(in).start_cons(SEQUENCE);
808
809 while(ber.more_items())
810 {
811 OID oid;
812
813 BER_Decoder info = ber.start_cons(SEQUENCE);
814
815 info.decode(oid);
816
817 if(oid == OID::from_string("PKIX.OCSP"))
818 {
819 BER_Object name = info.get_next_object();
820
821 if(name.is_a(6, CONTEXT_SPECIFIC))
822 {
823 m_ocsp_responder = ASN1::to_string(name);
824 }
825
826 }
827 if(oid == OID::from_string("PKIX.CertificateAuthorityIssuers"))
828 {
829 BER_Object name = info.get_next_object();
830
831 if(name.is_a(6, CONTEXT_SPECIFIC))
832 {
833 m_ca_issuers.push_back(ASN1::to_string(name));
834 }
835 }
836 }
837 }
838
839 void Authority_Information_Access::contents_to(Data_Store& subject, Data_Store&) const
840 {
841 if(!m_ocsp_responder.empty())
842 subject.add("OCSP.responder", m_ocsp_responder);
843 for(const std::string& ca_issuer : m_ca_issuers)
844 subject.add("PKIX.CertificateAuthorityIssuers", ca_issuer);
845 }
846
847/*
848* Checked accessor for the crl_number member
849*/
850 size_t CRL_Number::get_crl_number() const
851 {
852 if(!m_has_value)
853 throw Invalid_State("CRL_Number::get_crl_number: Not set");
854 return m_crl_number;
855 }
856
857/*
858* Copy a CRL_Number extension
859*/
860 CRL_Number* CRL_Number::copy() const
861 {
862 if(!m_has_value)
863 throw Invalid_State("CRL_Number::copy: Not set");
864 return new CRL_Number(m_crl_number);
865 }
866
867/*
868* Encode the extension
869*/
870std::vector<uint8_t> CRL_Number::encode_inner() const
871 {
872 std::vector<uint8_t> output;
873 DER_Encoder(output).encode(m_crl_number);
874 return output;
875 }
876
877/*
878* Decode the extension
879*/
880 void CRL_Number::decode_inner(const std::vector<uint8_t>& in)
881 {
882 BER_Decoder(in).decode(m_crl_number);
883 m_has_value = true;
884 }
885
886/*
887* Return a textual representation
888*/
889 void CRL_Number::contents_to(Data_Store& info, Data_Store&) const
890 {
891 info.add("X509v3.CRLNumber", static_cast<uint32_t>(m_crl_number));
892 }
893
894/*
895* Encode the extension
896*/
897std::vector<uint8_t> CRL_ReasonCode::encode_inner() const
898 {
899 std::vector<uint8_t> output;
900 DER_Encoder(output).encode(static_cast<size_t>(m_reason), ENUMERATED, UNIVERSAL);
901 return output;
902 }
903
904/*
905* Decode the extension
906*/
907 void CRL_ReasonCode::decode_inner(const std::vector<uint8_t>& in)
908 {
909 size_t reason_code = 0;
910 BER_Decoder(in).decode(reason_code, ENUMERATED, UNIVERSAL);
911 m_reason = static_cast<CRL_Code>(reason_code);
912 }
913
914/*
915* Return a textual representation
916*/
917 void CRL_ReasonCode::contents_to(Data_Store& info, Data_Store&) const
918 {
919 info.add("X509v3.CRLReasonCode", m_reason);
920 }
921
922std::vector<uint8_t> CRL_Distribution_Points::encode_inner() const
923 {
924 throw Not_Implemented("CRL_Distribution_Points encoding");
925 }
926
927 void CRL_Distribution_Points::decode_inner(const std::vector<uint8_t>& buf)
928 {
929 BER_Decoder(buf)
930 .decode_list(m_distribution_points)
931 .verify_end();
932
933 std::stringstream ss;
934
935 for(size_t i = 0; i != m_distribution_points.size(); ++i)
936 {
937 auto contents = m_distribution_points[i].point().contents();
938
939 for(const auto& pair : contents)
940 {
941 ss << pair.first << ": " << pair.second << " ";
942 }
943 }
944
945 m_crl_distribution_urls.push_back(ss.str());
946 }
947
948 void CRL_Distribution_Points::contents_to(Data_Store& subject, Data_Store&) const
949 {
950 for(const std::string& crl_url : m_crl_distribution_urls)
951 subject.add("CRL.DistributionPoint", crl_url);
952 }
953
954 void CRL_Distribution_Points::Distribution_Point::encode_into(class DER_Encoder&) const
955 {
956 throw Not_Implemented("CRL_Distribution_Points encoding");
957 }
958
959 void CRL_Distribution_Points::Distribution_Point::decode_from(class BER_Decoder& ber)
960 {
961 ber.start_cons(SEQUENCE)
962 .start_cons(ASN1_Tag(0), CONTEXT_SPECIFIC)
963 .decode_optional_implicit(m_point, ASN1_Tag(0),
964 ASN1_Tag(CONTEXT_SPECIFIC | CONSTRUCTED),
965 SEQUENCE, CONSTRUCTED)
966 .end_cons().end_cons();
967 }
968
969std::vector<uint8_t> CRL_Issuing_Distribution_Point::encode_inner() const
970 {
971 throw Not_Implemented("CRL_Issuing_Distribution_Point encoding");
972 }
973
974 void CRL_Issuing_Distribution_Point::decode_inner(const std::vector<uint8_t>& buf)
975 {
976 BER_Decoder(buf).decode(m_distribution_point).verify_end();
977 }
978
979 void CRL_Issuing_Distribution_Point::contents_to(Data_Store& info, Data_Store&) const
980 {
981 auto contents = m_distribution_point.point().contents();
982 std::stringstream ss;
983
984 for(const auto& pair : contents)
985 {
986 ss << pair.first << ": " << pair.second << " ";
987 }
988
989 info.add("X509v3.CRLIssuingDistributionPoint", ss.str());
990 }
991
992std::vector<uint8_t> Unknown_Extension::encode_inner() const
993 {
994 return m_bytes;
995 }
996
997 void Unknown_Extension::decode_inner(const std::vector<uint8_t>& bytes)
998 {
999 // Just treat as an opaque blob at this level
1000 m_bytes = bytes;
1001 }
1002
1003 void Unknown_Extension::contents_to(Data_Store&, Data_Store&) const
1004 {
1005 // No information store
1006 }
1007
1008}
1009
1010}
Botan::ASN1_Object
Definition: asn1_obj.h:69
Botan::ASN1_String
Definition: asn1_obj.h:393
Botan::BER_Decoder
Definition: ber_dec.h:22
Botan::BER_Decoder::start_cons
BER_Decoder start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: ber_dec.cpp:290
Botan::BER_Decoder::decode_list
BER_Decoder & decode_list(std::vector< T > &out, ASN1_Tag type_tag=SEQUENCE, ASN1_Tag class_tag=UNIVERSAL)
Definition: ber_dec.h:398
Botan::BER_Decoder::get_next_object
BER_Object get_next_object()
Definition: ber_dec.cpp:237
Botan::BER_Decoder::decode
BER_Decoder & decode(bool &out)
Definition: ber_dec.h:170
Botan::BER_Decoder::more_items
bool more_items() const
Definition: ber_dec.cpp:198
Botan::BER_Decoder::decode_optional_string
BER_Decoder & decode_optional_string(std::vector< uint8_t, Alloc > &out, ASN1_Tag real_type, uint16_t type_no, ASN1_Tag class_tag=CONTEXT_SPECIFIC)
Definition: ber_dec.h:293
Botan::BER_Decoder::decode_optional
BER_Decoder & decode_optional(T &out, ASN1_Tag type_tag, ASN1_Tag class_tag, const T &default_value=T())
Definition: ber_dec.h:337
Botan::BER_Decoder::verify_end
BER_Decoder & verify_end()
Definition: ber_dec.cpp:208
Botan::BER_Decoder::end_cons
BER_Decoder & end_cons()
Definition: ber_dec.cpp:300
Botan::BER_Decoder::decode_optional_implicit
BER_Decoder & decode_optional_implicit(T &out, ASN1_Tag type_tag, ASN1_Tag class_tag, ASN1_Tag real_type, ASN1_Tag real_class, const T &default_value=T())
Definition: ber_dec.h:369
Botan::BER_Object
Definition: asn1_obj.h:100
Botan::Cert_Extension::Authority_Information_Access::static_oid
static OID static_oid()
Definition: x509_ext.h:313
Botan::Cert_Extension::Authority_Key_ID::static_oid
static OID static_oid()
Definition: x509_ext.h:128
Botan::Cert_Extension::Basic_Constraints::get_path_limit
size_t get_path_limit() const
Definition: x509_ext.cpp:318
Botan::Cert_Extension::Basic_Constraints::static_oid
static OID static_oid()
Definition: x509_ext.h:38
Botan::Cert_Extension::CRL_Distribution_Points::Distribution_Point::decode_from
void decode_from(class BER_Decoder &) override
Definition: x509_ext.cpp:959
Botan::Cert_Extension::CRL_Distribution_Points::Distribution_Point::encode_into
void encode_into(class DER_Encoder &) const override
Definition: x509_ext.cpp:954
Botan::Cert_Extension::CRL_Distribution_Points::static_oid
static OID static_oid()
Definition: x509_ext.h:419
Botan::Cert_Extension::CRL_Issuing_Distribution_Point::static_oid
static OID static_oid()
Definition: x509_ext.h:455
Botan::Cert_Extension::CRL_Number
Definition: x509_ext.h:336
Botan::Cert_Extension::CRL_Number::copy
CRL_Number * copy() const override
Definition: x509_ext.cpp:860
Botan::Cert_Extension::CRL_Number::get_crl_number
size_t get_crl_number() const
Definition: x509_ext.cpp:850
Botan::Cert_Extension::CRL_Number::CRL_Number
CRL_Number()
Definition: x509_ext.h:340
Botan::Cert_Extension::CRL_Number::static_oid
static OID static_oid()
Definition: x509_ext.h:345
Botan::Cert_Extension::CRL_ReasonCode::static_oid
static OID static_oid()
Definition: x509_ext.h:373
Botan::Cert_Extension::Certificate_Policies::static_oid
static OID static_oid()
Definition: x509_ext.h:278
Botan::Cert_Extension::Certificate_Policies::validate
void validate(const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate > > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) override
Definition: x509_ext.cpp:776
Botan::Cert_Extension::Extended_Key_Usage::static_oid
static OID static_oid()
Definition: x509_ext.h:213
Botan::Cert_Extension::Issuer_Alternative_Name::static_oid
static OID static_oid()
Definition: x509_ext.h:179
Botan::Cert_Extension::Issuer_Alternative_Name::get_alt_name
const AlternativeName & get_alt_name() const
Definition: x509_ext.h:177
Botan::Cert_Extension::Key_Usage::static_oid
static OID static_oid()
Definition: x509_ext.h:65
Botan::Cert_Extension::Name_Constraints::validate
void validate(const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate > > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) override
Definition: x509_ext.cpp:654
Botan::Cert_Extension::Name_Constraints::static_oid
static OID static_oid()
Definition: x509_ext.h:246
Botan::Cert_Extension::Subject_Alternative_Name::get_alt_name
const AlternativeName & get_alt_name() const
Definition: x509_ext.h:149
Botan::Cert_Extension::Subject_Alternative_Name::static_oid
static OID static_oid()
Definition: x509_ext.h:151
Botan::Cert_Extension::Subject_Key_ID::Subject_Key_ID
Subject_Key_ID()=default
Botan::Cert_Extension::Subject_Key_ID::static_oid
static OID static_oid()
Definition: x509_ext.h:98
Botan::Certificate_Extension
Definition: pkix_types.h:374
Botan::Certificate_Extension::validate
virtual void validate(const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate > > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos)
Definition: x509_ext.cpp:113
Botan::Certificate_Extension::oid_name
virtual std::string oid_name() const =0
Botan::Certificate_Extension::oid_of
virtual OID oid_of() const =0
Botan::DER_Encoder
Definition: der_enc.h:23
Botan::DER_Encoder::encode_optional
DER_Encoder & encode_optional(const T &value, const T &default_value)
Definition: der_enc.h:120
Botan::DER_Encoder::add_object
DER_Encoder & add_object(ASN1_Tag type_tag, ASN1_Tag class_tag, const uint8_t rep[], size_t length)
Definition: der_enc.cpp:249
Botan::DER_Encoder::start_cons
DER_Encoder & start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: der_enc.cpp:181
Botan::DER_Encoder::encode_if
DER_Encoder & encode_if(bool pred, DER_Encoder &enc)
Definition: der_enc.h:143
Botan::DER_Encoder::end_cons
DER_Encoder & end_cons()
Definition: der_enc.cpp:191
Botan::DER_Encoder::encode
DER_Encoder & encode(bool b)
Definition: der_enc.cpp:285
Botan::Data_Store
Definition: datastor.h:29
Botan::Data_Store::add
void add(const std::multimap< std::string, std::string > &)
Definition: datastor.cpp:154
Botan::Extensions::get_extension_object
const Certificate_Extension * get_extension_object(const OID &oid) const
Definition: x509_ext.cpp:199
Botan::Extensions::decode_from
void decode_from(class BER_Decoder &) override
Definition: x509_ext.cpp:271
Botan::Extensions::extensions_raw
std::map< OID, std::pair< std::vector< uint8_t >, bool > > extensions_raw() const
Definition: x509_ext.cpp:231
Botan::Extensions::replace
void replace(Certificate_Extension *extn, bool critical=false)
Definition: x509_ext.cpp:166
Botan::Extensions::get
std::unique_ptr< Certificate_Extension > get(const OID &oid) const
Definition: x509_ext.cpp:208
Botan::Extensions::remove
bool remove(const OID &oid)
Definition: x509_ext.cpp:154
Botan::Extensions::contents_to
void contents_to(Data_Store &, Data_Store &) const
Definition: x509_ext.cpp:302
Botan::Extensions::get_extension_bits
std::vector< uint8_t > get_extension_bits(const OID &oid) const
Definition: x509_ext.cpp:190
Botan::Extensions::critical_extension_set
bool critical_extension_set(const OID &oid) const
Definition: x509_ext.cpp:182
Botan::Extensions::extensions
std::vector< std::pair< std::unique_ptr< Certificate_Extension >, bool > > extensions() const
Definition: x509_ext.cpp:217
Botan::Extensions::add_new
bool add_new(Certificate_Extension *extn, bool critical=false)
Definition: x509_ext.cpp:139
Botan::Extensions::encode_into
void encode_into(class DER_Encoder &) const override
Definition: x509_ext.cpp:247
Botan::Extensions::add
void add(Certificate_Extension *extn, bool critical=false)
Definition: x509_ext.cpp:123
Botan::Extensions::extension_set
bool extension_set(const OID &oid) const
Definition: x509_ext.cpp:177
Botan::HashFunction::create_or_throw
static std::unique_ptr< HashFunction > create_or_throw(const std::string &algo_spec, const std::string &provider="")
Definition: hash.cpp:329
Botan::Invalid_Argument
Definition: exceptn.h:137
Botan::Invalid_State
Definition: exceptn.h:216
Botan::NameConstraints::is_permitted
bool is_permitted(const X509_Certificate &cert, bool reject_unknown) const
Definition: name_constraint.cpp:323
Botan::NameConstraints::is_excluded
bool is_excluded(const X509_Certificate &cert, bool reject_unknown) const
Definition: name_constraint.cpp:444
Botan::NameConstraints::permitted
const std::vector< GeneralSubtree > & permitted() const
Definition: pkix_types.h:345
Botan::NameConstraints::excluded
const std::vector< GeneralSubtree > & excluded() const
Definition: pkix_types.h:350
Botan::Not_Implemented
Definition: exceptn.h:356
Botan::OID
Definition: asn1_obj.h:194
Botan::OID::from_string
static OID from_string(const std::string &str)
Definition: asn1_oid.cpp:62
Botan::X509_Certificate
Definition: x509cert.h:38
Botan::X509_Certificate::is_CA_cert
bool is_CA_cert() const
Definition: x509cert.cpp:492
Botan::X509_Certificate::is_critical
bool is_critical(const std::string &ex_name) const
Definition: x509cert.cpp:609
name
std::string name
Definition: commoncrypto_hash.cpp:24
final
int(* final)(unsigned char *, CTX *)
Definition: commoncrypto_hash.cpp:29
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::PEM_Code::encode
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
Botan
Definition: alg_id.cpp:13
Botan::ctz
size_t ctz(T n)
Definition: bit_ops.h:99
Botan::CRL_Code
CRL_Code
Definition: pkix_enums.h:123
Botan::ASN1_Tag
ASN1_Tag
Definition: asn1_obj.h:25
Botan::CONSTRUCTED
@ CONSTRUCTED
Definition: asn1_obj.h:30
Botan::IA5_STRING
@ IA5_STRING
Definition: asn1_obj.h:49
Botan::BIT_STRING
@ BIT_STRING
Definition: asn1_obj.h:37
Botan::SEQUENCE
@ SEQUENCE
Definition: asn1_obj.h:42
Botan::BOOLEAN
@ BOOLEAN
Definition: asn1_obj.h:35
Botan::CONTEXT_SPECIFIC
@ CONTEXT_SPECIFIC
Definition: asn1_obj.h:28
Botan::ENUMERATED
@ ENUMERATED
Definition: asn1_obj.h:41
Botan::OCTET_STRING
@ OCTET_STRING
Definition: asn1_obj.h:38
Botan::UNIVERSAL
@ UNIVERSAL
Definition: asn1_obj.h:26
Botan::INTEGER
@ INTEGER
Definition: asn1_obj.h:36
Botan::Certificate_Status_Code::NAME_CONSTRAINT_ERROR
@ NAME_CONSTRAINT_ERROR
Botan::Certificate_Status_Code::DUPLICATE_CERT_POLICY
@ DUPLICATE_CERT_POLICY
Botan::Key_Constraints
Key_Constraints
Definition: pkix_enums.h:106
Botan::NO_CONSTRAINTS
@ NO_CONSTRAINTS
Definition: pkix_enums.h:107
Botan::make_uint16
constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1)
Definition: loadstor.h:54
hash
MechanismType hash
Definition: p11_mechanism.cpp:64