diff options
author | deshevoy <[email protected]> | 2022-02-10 16:46:57 +0300 |
---|---|---|
committer | Daniil Cherednik <[email protected]> | 2022-02-10 16:46:57 +0300 |
commit | 28148f76dbfcc644d96427d41c92f36cbf2fdc6e (patch) | |
tree | b83306b6e37edeea782e9eed673d89286c4fef35 /contrib/libs/curl/lib/x509asn1.c | |
parent | e988f30484abe5fdeedcc7a5d3c226c01a21800c (diff) |
Restoring authorship annotation for <[email protected]>. Commit 2 of 2.
Diffstat (limited to 'contrib/libs/curl/lib/x509asn1.c')
-rw-r--r-- | contrib/libs/curl/lib/x509asn1.c | 684 |
1 files changed, 342 insertions, 342 deletions
diff --git a/contrib/libs/curl/lib/x509asn1.c b/contrib/libs/curl/lib/x509asn1.c index eba0b470c8a..d7cf9eb2af5 100644 --- a/contrib/libs/curl/lib/x509asn1.c +++ b/contrib/libs/curl/lib/x509asn1.c @@ -22,21 +22,21 @@ #include "curl_setup.h" -#if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \ +#if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \ defined(USE_WOLFSSL) || defined(USE_SCHANNEL) #include <curl/curl.h> #include "urldata.h" -#include "strcase.h" +#include "strcase.h" #include "hostcheck.h" -#include "vtls/vtls.h" +#include "vtls/vtls.h" #include "sendf.h" #include "inet_pton.h" #include "curl_base64.h" #include "x509asn1.h" -/* The last 3 #include files should be in this order */ -#include "curl_printf.h" +/* The last 3 #include files should be in this order */ +#include "curl_printf.h" #include "curl_memory.h" #include "memdebug.h" @@ -104,11 +104,11 @@ static const struct Curl_OID OIDtable[] = { */ static const char *getASN1Element(struct Curl_asn1Element *elem, - const char *beg, const char *end) - WARN_UNUSED_RESULT; + const char *beg, const char *end) + WARN_UNUSED_RESULT; static const char *getASN1Element(struct Curl_asn1Element *elem, - const char *beg, const char *end) + const char *beg, const char *end) { unsigned char b; unsigned long len; @@ -118,12 +118,12 @@ static const char *getASN1Element(struct Curl_asn1Element *elem, ending at `end'. Returns a pointer in source string after the parsed element, or NULL if an error occurs. */ - if(!beg || !end || beg >= end || !*beg || - (size_t)(end - beg) > CURL_ASN1_MAX) + if(!beg || !end || beg >= end || !*beg || + (size_t)(end - beg) > CURL_ASN1_MAX) return NULL; /* Process header byte. */ - elem->header = beg; + elem->header = beg; b = (unsigned char) *beg++; elem->constructed = (b & 0x20) != 0; elem->class = (b >> 6) & 3; @@ -145,7 +145,7 @@ static const char *getASN1Element(struct Curl_asn1Element *elem, return NULL; elem->beg = beg; while(beg < end && *beg) { - beg = getASN1Element(&lelem, beg, end); + beg = getASN1Element(&lelem, beg, end); if(!beg) return NULL; } @@ -154,7 +154,7 @@ static const char *getASN1Element(struct Curl_asn1Element *elem, elem->end = beg; return beg + 1; } - else if((unsigned)b > (size_t)(end - beg)) + else if((unsigned)b > (size_t)(end - beg)) return NULL; /* Does not fit in source. */ else { /* Get long length. */ @@ -165,7 +165,7 @@ static const char *getASN1Element(struct Curl_asn1Element *elem, len = (len << 8) | (unsigned char) *beg++; } while(--b); } - if(len > (size_t)(end - beg)) + if(len > (size_t)(end - beg)) return NULL; /* Element data does not fit in source. */ elem->beg = beg; elem->end = beg + len; @@ -180,7 +180,7 @@ static const struct Curl_OID *searchOID(const char *oid) { const struct Curl_OID *op; for(op = OIDtable; op->numoid; op++) - if(!strcmp(op->numoid, oid) || strcasecompare(op->textoid, oid)) + if(!strcmp(op->numoid, oid) || strcasecompare(op->textoid, oid)) return op; return NULL; @@ -192,7 +192,7 @@ static const struct Curl_OID *searchOID(const char *oid) * value. */ -static const char *bool2str(const char *beg, const char *end) +static const char *bool2str(const char *beg, const char *end) { if(end - beg != 1) return NULL; @@ -203,21 +203,21 @@ static const char *bool2str(const char *beg, const char *end) * Convert an ASN.1 octet string to a printable string. * Return the dynamically allocated string, or NULL if an error occurs. */ -static const char *octet2str(const char *beg, const char *end) +static const char *octet2str(const char *beg, const char *end) { size_t n = end - beg; - char *buf = NULL; - - if(n <= (SIZE_T_MAX - 1) / 3) { - buf = malloc(3 * n + 1); - if(buf) - for(n = 0; beg < end; n += 3) - msnprintf(buf + n, 4, "%02x:", *(const unsigned char *) beg++); - } + char *buf = NULL; + + if(n <= (SIZE_T_MAX - 1) / 3) { + buf = malloc(3 * n + 1); + if(buf) + for(n = 0; beg < end; n += 3) + msnprintf(buf + n, 4, "%02x:", *(const unsigned char *) beg++); + } return buf; } -static const char *bit2str(const char *beg, const char *end) +static const char *bit2str(const char *beg, const char *end) { /* Convert an ASN.1 bit string to a printable string. Return the dynamically allocated string, or NULL if an error occurs. */ @@ -232,9 +232,9 @@ static const char *bit2str(const char *beg, const char *end) * Return the dynamically allocated string, or NULL if source is not an * ASN.1 integer value. */ -static const char *int2str(const char *beg, const char *end) +static const char *int2str(const char *beg, const char *end) { - unsigned long val = 0; + unsigned long val = 0; size_t n = end - beg; if(!n) @@ -250,7 +250,7 @@ static const char *int2str(const char *beg, const char *end) do val = (val << 8) | *(const unsigned char *) beg++; while(beg < end); - return curl_maprintf("%s%lx", val >= 10? "0x": "", val); + return curl_maprintf("%s%lx", val >= 10? "0x": "", val); } /* @@ -261,15 +261,15 @@ static const char *int2str(const char *beg, const char *end) * string length. */ static ssize_t -utf8asn1str(char **to, int type, const char *from, const char *end) +utf8asn1str(char **to, int type, const char *from, const char *end) { size_t inlength = end - from; int size = 1; size_t outlength; - char *buf; + char *buf; *to = NULL; - switch(type) { + switch(type) { case CURL_ASN1_BMP_STRING: size = 2; break; @@ -289,8 +289,8 @@ utf8asn1str(char **to, int type, const char *from, const char *end) if(inlength % size) return -1; /* Length inconsistent with character size. */ - if(inlength / size > (SIZE_T_MAX - 1) / 4) - return -1; /* Too big. */ + if(inlength / size > (SIZE_T_MAX - 1) / 4) + return -1; /* Too big. */ buf = malloc(4 * (inlength / size) + 1); if(!buf) return -1; /* Not enough memory. */ @@ -307,18 +307,18 @@ utf8asn1str(char **to, int type, const char *from, const char *end) unsigned int wc; wc = 0; - switch(size) { + switch(size) { case 4: wc = (wc << 8) | *(const unsigned char *) from++; wc = (wc << 8) | *(const unsigned char *) from++; - /* FALLTHROUGH */ + /* FALLTHROUGH */ case 2: wc = (wc << 8) | *(const unsigned char *) from++; - /* FALLTHROUGH */ + /* FALLTHROUGH */ default: /* case 1: */ wc = (wc << 8) | *(const unsigned char *) from++; } - charsize = 1; + charsize = 1; if(wc >= 0x00000080) { if(wc >= 0x00000800) { if(wc >= 0x00010000) { @@ -328,18 +328,18 @@ utf8asn1str(char **to, int type, const char *from, const char *end) } buf[outlength + 3] = (char) (0x80 | (wc & 0x3F)); wc = (wc >> 6) | 0x00010000; - charsize++; + charsize++; } buf[outlength + 2] = (char) (0x80 | (wc & 0x3F)); wc = (wc >> 6) | 0x00000800; - charsize++; + charsize++; } buf[outlength + 1] = (char) (0x80 | (wc & 0x3F)); wc = (wc >> 6) | 0x000000C0; - charsize++; + charsize++; } buf[outlength] = (char) wc; - outlength += charsize; + outlength += charsize; } } buf[outlength] = '\0'; @@ -351,9 +351,9 @@ utf8asn1str(char **to, int type, const char *from, const char *end) * Convert an ASN.1 String into its UTF-8 string representation. * Return the dynamically allocated string, or NULL if an error occurs. */ -static const char *string2str(int type, const char *beg, const char *end) +static const char *string2str(int type, const char *beg, const char *end) { - char *buf; + char *buf; if(utf8asn1str(&buf, type, beg, end) < 0) return NULL; return buf; @@ -433,7 +433,7 @@ static size_t encodeOID(char *buf, size_t buflen, * Return the dynamically allocated string, or NULL if an error occurs. */ -static const char *OID2str(const char *beg, const char *end, bool symbolic) +static const char *OID2str(const char *beg, const char *end, bool symbolic) { char *buf = NULL; if(beg < end) { @@ -457,14 +457,14 @@ static const char *OID2str(const char *beg, const char *end, bool symbolic) return buf; } -static const char *GTime2str(const char *beg, const char *end) +static const char *GTime2str(const char *beg, const char *end) { - const char *tzp; - const char *fracp; + const char *tzp; + const char *fracp; char sec1, sec2; size_t fracl; size_t tzl; - const char *sep = ""; + const char *sep = ""; /* Convert an ASN.1 Generalized time to a printable string. Return the dynamically allocated string, or NULL if an error occurs. */ @@ -474,13 +474,13 @@ static const char *GTime2str(const char *beg, const char *end) /* Get seconds digits. */ sec1 = '0'; - switch(fracp - beg - 12) { + switch(fracp - beg - 12) { case 0: sec2 = '0'; break; case 2: sec1 = fracp[-2]; - /* FALLTHROUGH */ + /* FALLTHROUGH */ case 1: sec2 = fracp[-1]; break; @@ -525,17 +525,17 @@ static const char *GTime2str(const char *beg, const char *end) * Convert an ASN.1 UTC time to a printable string. * Return the dynamically allocated string, or NULL if an error occurs. */ -static const char *UTime2str(const char *beg, const char *end) +static const char *UTime2str(const char *beg, const char *end) { - const char *tzp; + const char *tzp; size_t tzl; - const char *sec; + const char *sec; for(tzp = beg; tzp < end && *tzp >= '0' && *tzp <= '9'; tzp++) ; /* Get the seconds. */ sec = beg + 10; - switch(tzp - sec) { + switch(tzp - sec) { case 0: sec = "00"; case 2: @@ -573,7 +573,7 @@ static const char *ASN1tostr(struct Curl_asn1Element *elem, int type) if(!type) type = elem->tag; /* Type not forced: use element tag as type. */ - switch(type) { + switch(type) { case CURL_ASN1_BOOLEAN: return bool2str(elem->beg, elem->end); case CURL_ASN1_INTEGER: @@ -584,7 +584,7 @@ static const char *ASN1tostr(struct Curl_asn1Element *elem, int type) case CURL_ASN1_OCTET_STRING: return octet2str(elem->beg, elem->end); case CURL_ASN1_NULL: - return strdup(""); + return strdup(""); case CURL_ASN1_OBJECT_IDENTIFIER: return OID2str(elem->beg, elem->end, TRUE); case CURL_ASN1_UTC_TIME: @@ -616,25 +616,25 @@ static ssize_t encodeDN(char *buf, size_t buflen, struct Curl_asn1Element *dn) struct Curl_asn1Element oid; struct Curl_asn1Element value; size_t l = 0; - const char *p1; - const char *p2; - const char *p3; - const char *str; + const char *p1; + const char *p2; + const char *p3; + const char *str; for(p1 = dn->beg; p1 < dn->end;) { - p1 = getASN1Element(&rdn, p1, dn->end); - if(!p1) - return -1; + p1 = getASN1Element(&rdn, p1, dn->end); + if(!p1) + return -1; for(p2 = rdn.beg; p2 < rdn.end;) { - p2 = getASN1Element(&atv, p2, rdn.end); - if(!p2) - return -1; - p3 = getASN1Element(&oid, atv.beg, atv.end); - if(!p3) - return -1; - if(!getASN1Element(&value, p3, atv.end)) - return -1; - str = ASN1tostr(&oid, 0); + p2 = getASN1Element(&atv, p2, rdn.end); + if(!p2) + return -1; + p3 = getASN1Element(&oid, atv.beg, atv.end); + if(!p3) + return -1; + if(!getASN1Element(&value, p3, atv.end)) + return -1; + str = ASN1tostr(&oid, 0); if(!str) return -1; @@ -664,7 +664,7 @@ static ssize_t encodeDN(char *buf, size_t buflen, struct Curl_asn1Element *dn) l++; /* Generate value. */ - str = ASN1tostr(&value, 0); + str = ASN1tostr(&value, 0); if(!str) return -1; for(p3 = str; *p3; p3++) { @@ -704,117 +704,117 @@ static const char *DNtostr(struct Curl_asn1Element *dn) * See RFC 5280. */ int Curl_parseX509(struct Curl_X509certificate *cert, - const char *beg, const char *end) + const char *beg, const char *end) { struct Curl_asn1Element elem; struct Curl_asn1Element tbsCertificate; - const char *ccp; + const char *ccp; static const char defaultVersion = 0; /* v1. */ - cert->certificate.header = NULL; + cert->certificate.header = NULL; cert->certificate.beg = beg; cert->certificate.end = end; /* Get the sequence content. */ - if(!getASN1Element(&elem, beg, end)) - return -1; /* Invalid bounds/size. */ + if(!getASN1Element(&elem, beg, end)) + return -1; /* Invalid bounds/size. */ beg = elem.beg; end = elem.end; /* Get tbsCertificate. */ - beg = getASN1Element(&tbsCertificate, beg, end); - if(!beg) - return -1; + beg = getASN1Element(&tbsCertificate, beg, end); + if(!beg) + return -1; /* Skip the signatureAlgorithm. */ - beg = getASN1Element(&cert->signatureAlgorithm, beg, end); - if(!beg) - return -1; + beg = getASN1Element(&cert->signatureAlgorithm, beg, end); + if(!beg) + return -1; /* Get the signatureValue. */ - if(!getASN1Element(&cert->signature, beg, end)) - return -1; + if(!getASN1Element(&cert->signature, beg, end)) + return -1; /* Parse TBSCertificate. */ beg = tbsCertificate.beg; end = tbsCertificate.end; /* Get optional version, get serialNumber. */ - cert->version.header = NULL; + cert->version.header = NULL; cert->version.beg = &defaultVersion; - cert->version.end = &defaultVersion + sizeof(defaultVersion); - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; + cert->version.end = &defaultVersion + sizeof(defaultVersion); + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; if(elem.tag == 0) { - if(!getASN1Element(&cert->version, elem.beg, elem.end)) - return -1; - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; + if(!getASN1Element(&cert->version, elem.beg, elem.end)) + return -1; + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; } cert->serialNumber = elem; /* Get signature algorithm. */ - beg = getASN1Element(&cert->signatureAlgorithm, beg, end); + beg = getASN1Element(&cert->signatureAlgorithm, beg, end); /* Get issuer. */ - beg = getASN1Element(&cert->issuer, beg, end); - if(!beg) - return -1; + beg = getASN1Element(&cert->issuer, beg, end); + if(!beg) + return -1; /* Get notBefore and notAfter. */ - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; - ccp = getASN1Element(&cert->notBefore, elem.beg, elem.end); - if(!ccp) - return -1; - if(!getASN1Element(&cert->notAfter, ccp, elem.end)) - return -1; + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; + ccp = getASN1Element(&cert->notBefore, elem.beg, elem.end); + if(!ccp) + return -1; + if(!getASN1Element(&cert->notAfter, ccp, elem.end)) + return -1; /* Get subject. */ - beg = getASN1Element(&cert->subject, beg, end); - if(!beg) - return -1; + beg = getASN1Element(&cert->subject, beg, end); + if(!beg) + return -1; /* Get subjectPublicKeyAlgorithm and subjectPublicKey. */ - beg = getASN1Element(&cert->subjectPublicKeyInfo, beg, end); - if(!beg) - return -1; - ccp = getASN1Element(&cert->subjectPublicKeyAlgorithm, - cert->subjectPublicKeyInfo.beg, - cert->subjectPublicKeyInfo.end); - if(!ccp) - return -1; - if(!getASN1Element(&cert->subjectPublicKey, ccp, - cert->subjectPublicKeyInfo.end)) - return -1; + beg = getASN1Element(&cert->subjectPublicKeyInfo, beg, end); + if(!beg) + return -1; + ccp = getASN1Element(&cert->subjectPublicKeyAlgorithm, + cert->subjectPublicKeyInfo.beg, + cert->subjectPublicKeyInfo.end); + if(!ccp) + return -1; + if(!getASN1Element(&cert->subjectPublicKey, ccp, + cert->subjectPublicKeyInfo.end)) + return -1; /* Get optional issuerUiqueID, subjectUniqueID and extensions. */ cert->issuerUniqueID.tag = cert->subjectUniqueID.tag = 0; cert->extensions.tag = elem.tag = 0; - cert->issuerUniqueID.header = cert->subjectUniqueID.header = NULL; + cert->issuerUniqueID.header = cert->subjectUniqueID.header = NULL; cert->issuerUniqueID.beg = cert->issuerUniqueID.end = ""; cert->subjectUniqueID.beg = cert->subjectUniqueID.end = ""; - cert->extensions.header = NULL; + cert->extensions.header = NULL; cert->extensions.beg = cert->extensions.end = ""; - if(beg < end) { - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; - } + if(beg < end) { + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; + } if(elem.tag == 1) { cert->issuerUniqueID = elem; - if(beg < end) { - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; - } + if(beg < end) { + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; + } } if(elem.tag == 2) { cert->subjectUniqueID = elem; - if(beg < end) { - beg = getASN1Element(&elem, beg, end); - if(!beg) - return -1; - } + if(beg < end) { + beg = getASN1Element(&elem, beg, end); + if(!beg) + return -1; + } } if(elem.tag == 3) - if(!getASN1Element(&cert->extensions, elem.beg, elem.end)) - return -1; - return 0; + if(!getASN1Element(&cert->extensions, elem.beg, elem.end)) + return -1; + return 0; } @@ -822,7 +822,7 @@ int Curl_parseX509(struct Curl_X509certificate *cert, * Copy at most 64-characters, terminate with a newline and returns the * effective number of stored characters. */ -static size_t copySubstring(char *to, const char *from) +static size_t copySubstring(char *to, const char *from) { size_t i; for(i = 0; i < 64; i++) { @@ -836,67 +836,67 @@ static size_t copySubstring(char *to, const char *from) } static const char *dumpAlgo(struct Curl_asn1Element *param, - const char *beg, const char *end) + const char *beg, const char *end) { struct Curl_asn1Element oid; /* Get algorithm parameters and return algorithm name. */ - beg = getASN1Element(&oid, beg, end); - if(!beg) - return NULL; - param->header = NULL; + beg = getASN1Element(&oid, beg, end); + if(!beg) + return NULL; + param->header = NULL; param->tag = 0; param->beg = param->end = end; if(beg < end) - if(!getASN1Element(param, beg, end)) - return NULL; + if(!getASN1Element(param, beg, end)) + return NULL; return OID2str(oid.beg, oid.end, TRUE); } -static void do_pubkey_field(struct Curl_easy *data, int certnum, +static void do_pubkey_field(struct Curl_easy *data, int certnum, const char *label, struct Curl_asn1Element *elem) { - const char *output; + const char *output; /* Generate a certificate information record for the public key. */ - output = ASN1tostr(elem, 0); + output = ASN1tostr(elem, 0); if(output) { - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, label, output); - if(!certnum) - infof(data, " %s: %s\n", label, output); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, label, output); + if(!certnum) + infof(data, " %s: %s\n", label, output); free((char *) output); } } -static void do_pubkey(struct Curl_easy *data, int certnum, +static void do_pubkey(struct Curl_easy *data, int certnum, const char *algo, struct Curl_asn1Element *param, struct Curl_asn1Element *pubkey) { struct Curl_asn1Element elem; struct Curl_asn1Element pk; - const char *p; + const char *p; /* Generate all information records for the public key. */ /* Get the public key (single element). */ - if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end)) - return; + if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end)) + return; - if(strcasecompare(algo, "rsaEncryption")) { + if(strcasecompare(algo, "rsaEncryption")) { const char *q; unsigned long len; - p = getASN1Element(&elem, pk.beg, pk.end); - if(!p) - return; - + p = getASN1Element(&elem, pk.beg, pk.end); + if(!p) + return; + /* Compute key length. */ for(q = elem.beg; !*q && q < elem.end; q++) ; - len = (unsigned long)((elem.end - q) * 8); + len = (unsigned long)((elem.end - q) * 8); if(len) { unsigned int i; for(i = *(unsigned char *) q; !(i & 0x80); i <<= 1) @@ -904,116 +904,116 @@ static void do_pubkey(struct Curl_easy *data, int certnum, } if(len > 32) elem.beg = q; /* Strip leading zero bytes. */ - if(!certnum) - infof(data, " RSA Public Key (%lu bits)\n", len); - if(data->set.ssl.certinfo) { - q = curl_maprintf("%lu", len); - if(q) { - Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", q); - free((char *) q); - } + if(!certnum) + infof(data, " RSA Public Key (%lu bits)\n", len); + if(data->set.ssl.certinfo) { + q = curl_maprintf("%lu", len); + if(q) { + Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", q); + free((char *) q); + } } /* Generate coefficients. */ do_pubkey_field(data, certnum, "rsa(n)", &elem); - if(!getASN1Element(&elem, p, pk.end)) - return; + if(!getASN1Element(&elem, p, pk.end)) + return; do_pubkey_field(data, certnum, "rsa(e)", &elem); } - else if(strcasecompare(algo, "dsa")) { - p = getASN1Element(&elem, param->beg, param->end); - if(p) { - do_pubkey_field(data, certnum, "dsa(p)", &elem); - p = getASN1Element(&elem, p, param->end); - if(p) { - do_pubkey_field(data, certnum, "dsa(q)", &elem); - if(getASN1Element(&elem, p, param->end)) { - do_pubkey_field(data, certnum, "dsa(g)", &elem); - do_pubkey_field(data, certnum, "dsa(pub_key)", &pk); - } - } - } + else if(strcasecompare(algo, "dsa")) { + p = getASN1Element(&elem, param->beg, param->end); + if(p) { + do_pubkey_field(data, certnum, "dsa(p)", &elem); + p = getASN1Element(&elem, p, param->end); + if(p) { + do_pubkey_field(data, certnum, "dsa(q)", &elem); + if(getASN1Element(&elem, p, param->end)) { + do_pubkey_field(data, certnum, "dsa(g)", &elem); + do_pubkey_field(data, certnum, "dsa(pub_key)", &pk); + } + } + } } - else if(strcasecompare(algo, "dhpublicnumber")) { - p = getASN1Element(&elem, param->beg, param->end); - if(p) { - do_pubkey_field(data, certnum, "dh(p)", &elem); - if(getASN1Element(&elem, param->beg, param->end)) { - do_pubkey_field(data, certnum, "dh(g)", &elem); - do_pubkey_field(data, certnum, "dh(pub_key)", &pk); - } - } + else if(strcasecompare(algo, "dhpublicnumber")) { + p = getASN1Element(&elem, param->beg, param->end); + if(p) { + do_pubkey_field(data, certnum, "dh(p)", &elem); + if(getASN1Element(&elem, param->beg, param->end)) { + do_pubkey_field(data, certnum, "dh(g)", &elem); + do_pubkey_field(data, certnum, "dh(pub_key)", &pk); + } + } } } -CURLcode Curl_extract_certinfo(struct connectdata *conn, +CURLcode Curl_extract_certinfo(struct connectdata *conn, int certnum, - const char *beg, - const char *end) + const char *beg, + const char *end) { struct Curl_X509certificate cert; - struct Curl_easy *data = conn->data; + struct Curl_easy *data = conn->data; struct Curl_asn1Element param; - const char *ccp; - char *cp1; + const char *ccp; + char *cp1; size_t cl1; - char *cp2; - CURLcode result; + char *cp2; + CURLcode result; unsigned long version; size_t i; size_t j; - if(!data->set.ssl.certinfo) - if(certnum) - return CURLE_OK; - + if(!data->set.ssl.certinfo) + if(certnum) + return CURLE_OK; + /* Prepare the certificate information for curl_easy_getinfo(). */ /* Extract the certificate ASN.1 elements. */ - if(Curl_parseX509(&cert, beg, end)) - return CURLE_PEER_FAILED_VERIFICATION; + if(Curl_parseX509(&cert, beg, end)) + return CURLE_PEER_FAILED_VERIFICATION; /* Subject. */ - ccp = DNtostr(&cert.subject); + ccp = DNtostr(&cert.subject); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Subject", ccp); - if(!certnum) - infof(data, "%2d Subject: %s\n", certnum, ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Subject", ccp); + if(!certnum) + infof(data, "%2d Subject: %s\n", certnum, ccp); free((char *) ccp); /* Issuer. */ - ccp = DNtostr(&cert.issuer); + ccp = DNtostr(&cert.issuer); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Issuer", ccp); - if(!certnum) - infof(data, " Issuer: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Issuer", ccp); + if(!certnum) + infof(data, " Issuer: %s\n", ccp); free((char *) ccp); /* Version (always fits in less than 32 bits). */ version = 0; for(ccp = cert.version.beg; ccp < cert.version.end; ccp++) version = (version << 8) | *(const unsigned char *) ccp; - if(data->set.ssl.certinfo) { - ccp = curl_maprintf("%lx", version); - if(!ccp) - return CURLE_OUT_OF_MEMORY; - Curl_ssl_push_certinfo(data, certnum, "Version", ccp); - free((char *) ccp); - } - if(!certnum) - infof(data, " Version: %lu (0x%lx)\n", version + 1, version); + if(data->set.ssl.certinfo) { + ccp = curl_maprintf("%lx", version); + if(!ccp) + return CURLE_OUT_OF_MEMORY; + Curl_ssl_push_certinfo(data, certnum, "Version", ccp); + free((char *) ccp); + } + if(!certnum) + infof(data, " Version: %lu (0x%lx)\n", version + 1, version); /* Serial number. */ - ccp = ASN1tostr(&cert.serialNumber, 0); + ccp = ASN1tostr(&cert.serialNumber, 0); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Serial Number", ccp); - if(!certnum) - infof(data, " Serial Number: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Serial Number", ccp); + if(!certnum) + infof(data, " Serial Number: %s\n", ccp); free((char *) ccp); /* Signature algorithm .*/ @@ -1021,30 +1021,30 @@ CURLcode Curl_extract_certinfo(struct connectdata *conn, cert.signatureAlgorithm.end); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp); - if(!certnum) - infof(data, " Signature Algorithm: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp); + if(!certnum) + infof(data, " Signature Algorithm: %s\n", ccp); free((char *) ccp); /* Start Date. */ - ccp = ASN1tostr(&cert.notBefore, 0); + ccp = ASN1tostr(&cert.notBefore, 0); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Start Date", ccp); - if(!certnum) - infof(data, " Start Date: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Start Date", ccp); + if(!certnum) + infof(data, " Start Date: %s\n", ccp); free((char *) ccp); /* Expire Date. */ - ccp = ASN1tostr(&cert.notAfter, 0); + ccp = ASN1tostr(&cert.notAfter, 0); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Expire Date", ccp); - if(!certnum) - infof(data, " Expire Date: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Expire Date", ccp); + if(!certnum) + infof(data, " Expire Date: %s\n", ccp); free((char *) ccp); /* Public Key Algorithm. */ @@ -1052,30 +1052,30 @@ CURLcode Curl_extract_certinfo(struct connectdata *conn, cert.subjectPublicKeyAlgorithm.end); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Public Key Algorithm", ccp); - if(!certnum) - infof(data, " Public Key Algorithm: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Public Key Algorithm", ccp); + if(!certnum) + infof(data, " Public Key Algorithm: %s\n", ccp); do_pubkey(data, certnum, ccp, ¶m, &cert.subjectPublicKey); free((char *) ccp); /* Signature. */ - ccp = ASN1tostr(&cert.signature, 0); + ccp = ASN1tostr(&cert.signature, 0); if(!ccp) return CURLE_OUT_OF_MEMORY; - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Signature", ccp); - if(!certnum) - infof(data, " Signature: %s\n", ccp); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Signature", ccp); + if(!certnum) + infof(data, " Signature: %s\n", ccp); free((char *) ccp); /* Generate PEM certificate. */ - result = Curl_base64_encode(data, cert.certificate.beg, - cert.certificate.end - cert.certificate.beg, - &cp1, &cl1); - if(result) - return result; - /* Compute the number of characters in final certificate string. Format is: + result = Curl_base64_encode(data, cert.certificate.beg, + cert.certificate.end - cert.certificate.beg, + &cp1, &cl1); + if(result) + return result; + /* Compute the number of characters in final certificate string. Format is: -----BEGIN CERTIFICATE-----\n <max 64 base64 characters>\n . @@ -1096,54 +1096,54 @@ CURLcode Curl_extract_certinfo(struct connectdata *conn, i += copySubstring(cp2 + i, "-----END CERTIFICATE-----"); cp2[i] = '\0'; free(cp1); - if(data->set.ssl.certinfo) - Curl_ssl_push_certinfo(data, certnum, "Cert", cp2); - if(!certnum) - infof(data, "%s\n", cp2); + if(data->set.ssl.certinfo) + Curl_ssl_push_certinfo(data, certnum, "Cert", cp2); + if(!certnum) + infof(data, "%s\n", cp2); free(cp2); return CURLE_OK; } #endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */ -#if defined(USE_GSKIT) - -static const char *checkOID(const char *beg, const char *end, - const char *oid) +#if defined(USE_GSKIT) + +static const char *checkOID(const char *beg, const char *end, + const char *oid) { struct Curl_asn1Element e; - const char *ccp; - const char *p; - bool matched; - - /* Check if first ASN.1 element at `beg' is the given OID. - Return a pointer in the source after the OID if found, else NULL. */ - - ccp = getASN1Element(&e, beg, end); - if(!ccp || e.tag != CURL_ASN1_OBJECT_IDENTIFIER) + const char *ccp; + const char *p; + bool matched; + + /* Check if first ASN.1 element at `beg' is the given OID. + Return a pointer in the source after the OID if found, else NULL. */ + + ccp = getASN1Element(&e, beg, end); + if(!ccp || e.tag != CURL_ASN1_OBJECT_IDENTIFIER) return NULL; - - p = OID2str(e.beg, e.end, FALSE); - if(!p) + + p = OID2str(e.beg, e.end, FALSE); + if(!p) return NULL; - - matched = !strcmp(p, oid); - free((char *) p); + + matched = !strcmp(p, oid); + free((char *) p); return matched? ccp: NULL; -} - -CURLcode Curl_verifyhost(struct connectdata *conn, - const char *beg, const char *end) -{ - struct Curl_easy *data = conn->data; +} + +CURLcode Curl_verifyhost(struct connectdata *conn, + const char *beg, const char *end) +{ + struct Curl_easy *data = conn->data; struct Curl_X509certificate cert; struct Curl_asn1Element dn; struct Curl_asn1Element elem; struct Curl_asn1Element ext; struct Curl_asn1Element name; - const char *p; - const char *q; - char *dnsname; + const char *p; + const char *q; + char *dnsname; int matched = -1; size_t addrlen = (size_t) -1; ssize_t len; @@ -1160,93 +1160,93 @@ CURLcode Curl_verifyhost(struct connectdata *conn, /* Verify that connection server matches info in X509 certificate at `beg'..`end'. */ - if(!SSL_CONN_CONFIG(verifyhost)) + if(!SSL_CONN_CONFIG(verifyhost)) return CURLE_OK; - if(Curl_parseX509(&cert, beg, end)) + if(Curl_parseX509(&cert, beg, end)) return CURLE_PEER_FAILED_VERIFICATION; /* Get the server IP address. */ #ifdef ENABLE_IPV6 - if(conn->bits.ipv6_ip && Curl_inet_pton(AF_INET6, hostname, &addr)) + if(conn->bits.ipv6_ip && Curl_inet_pton(AF_INET6, hostname, &addr)) addrlen = sizeof(struct in6_addr); else #endif - if(Curl_inet_pton(AF_INET, hostname, &addr)) + if(Curl_inet_pton(AF_INET, hostname, &addr)) addrlen = sizeof(struct in_addr); /* Process extensions. */ for(p = cert.extensions.beg; p < cert.extensions.end && matched != 1;) { - p = getASN1Element(&ext, p, cert.extensions.end); - if(!p) - return CURLE_PEER_FAILED_VERIFICATION; - + p = getASN1Element(&ext, p, cert.extensions.end); + if(!p) + return CURLE_PEER_FAILED_VERIFICATION; + /* Check if extension is a subjectAlternativeName. */ ext.beg = checkOID(ext.beg, ext.end, sanOID); if(ext.beg) { - ext.beg = getASN1Element(&elem, ext.beg, ext.end); - if(!ext.beg) - return CURLE_PEER_FAILED_VERIFICATION; + ext.beg = getASN1Element(&elem, ext.beg, ext.end); + if(!ext.beg) + return CURLE_PEER_FAILED_VERIFICATION; /* Skip critical if present. */ - if(elem.tag == CURL_ASN1_BOOLEAN) { - ext.beg = getASN1Element(&elem, ext.beg, ext.end); - if(!ext.beg) - return CURLE_PEER_FAILED_VERIFICATION; - } + if(elem.tag == CURL_ASN1_BOOLEAN) { + ext.beg = getASN1Element(&elem, ext.beg, ext.end); + if(!ext.beg) + return CURLE_PEER_FAILED_VERIFICATION; + } /* Parse the octet string contents: is a single sequence. */ - if(!getASN1Element(&elem, elem.beg, elem.end)) - return CURLE_PEER_FAILED_VERIFICATION; + if(!getASN1Element(&elem, elem.beg, elem.end)) + return CURLE_PEER_FAILED_VERIFICATION; /* Check all GeneralNames. */ for(q = elem.beg; matched != 1 && q < elem.end;) { - q = getASN1Element(&name, q, elem.end); - if(!q) - break; - switch(name.tag) { + q = getASN1Element(&name, q, elem.end); + if(!q) + break; + switch(name.tag) { case 2: /* DNS name. */ len = utf8asn1str(&dnsname, CURL_ASN1_IA5_STRING, name.beg, name.end); - if(len > 0 && (size_t)len == strlen(dnsname)) - matched = Curl_cert_hostcheck(dnsname, hostname); - else - matched = 0; - free(dnsname); + if(len > 0 && (size_t)len == strlen(dnsname)) + matched = Curl_cert_hostcheck(dnsname, hostname); + else + matched = 0; + free(dnsname); break; case 7: /* IP address. */ - matched = (size_t) (name.end - name.beg) == addrlen && - !memcmp(&addr, name.beg, addrlen); + matched = (size_t) (name.end - name.beg) == addrlen && + !memcmp(&addr, name.beg, addrlen); break; } } } } - switch(matched) { + switch(matched) { case 1: /* an alternative name matched the server hostname */ - infof(data, "\t subjectAltName: %s matched\n", dispname); + infof(data, "\t subjectAltName: %s matched\n", dispname); return CURLE_OK; case 0: /* an alternative name field existed, but didn't match and then we MUST fail */ - infof(data, "\t subjectAltName does not match %s\n", dispname); + infof(data, "\t subjectAltName does not match %s\n", dispname); return CURLE_PEER_FAILED_VERIFICATION; } /* Process subject. */ - name.header = NULL; + name.header = NULL; name.beg = name.end = ""; q = cert.subject.beg; /* we have to look to the last occurrence of a commonName in the distinguished one to get the most significant one. */ while(q < cert.subject.end) { - q = getASN1Element(&dn, q, cert.subject.end); - if(!q) - break; + q = getASN1Element(&dn, q, cert.subject.end); + if(!q) + break; for(p = dn.beg; p < dn.end;) { - p = getASN1Element(&elem, p, dn.end); - if(!p) - return CURLE_PEER_FAILED_VERIFICATION; + p = getASN1Element(&elem, p, dn.end); + if(!p) + return CURLE_PEER_FAILED_VERIFICATION; /* We have a DN's AttributeTypeAndValue: check it in case it's a CN. */ elem.beg = checkOID(elem.beg, elem.end, cnOID); if(elem.beg) @@ -1255,7 +1255,7 @@ CURLcode Curl_verifyhost(struct connectdata *conn, } /* Check the CN if found. */ - if(!getASN1Element(&elem, name.beg, name.end)) + if(!getASN1Element(&elem, name.beg, name.end)) failf(data, "SSL: unable to obtain common name from peer certificate"); else { len = utf8asn1str(&dnsname, elem.tag, elem.beg, elem.end); @@ -1265,18 +1265,18 @@ CURLcode Curl_verifyhost(struct connectdata *conn, } if(strlen(dnsname) != (size_t) len) /* Nul byte in string ? */ failf(data, "SSL: illegal cert name field"); - else if(Curl_cert_hostcheck((const char *) dnsname, hostname)) { + else if(Curl_cert_hostcheck((const char *) dnsname, hostname)) { infof(data, "\t common name: %s (matched)\n", dnsname); free(dnsname); return CURLE_OK; } else failf(data, "SSL: certificate subject name '%s' does not match " - "target host name '%s'", dnsname, dispname); + "target host name '%s'", dnsname, dispname); free(dnsname); } return CURLE_PEER_FAILED_VERIFICATION; } -#endif /* USE_GSKIT */ +#endif /* USE_GSKIT */ |