sys/src/libsec/port/x509.c

   1 #include <u.h>
   2 #include <libc.h>
   3 #include <mp.h>
   4 #include <libsec.h>
   5
   6 /*=============================================================*/
   7 /*  general ASN1 declarations and parsing
   8  *
   9  *  For now, this is used only for extracting the key from an
  10  *  X509 certificate, so the entire collection is hidden.  But
  11  *  someday we should probably make the functions visible and
  12  *  give them their own man page.
  13  */
  14 typedef struct Elem Elem;
  15 typedef struct Tag Tag;
  16 typedef struct Value Value;
  17 typedef struct Bytes Bytes;
  18 typedef struct Ints Ints;
  19 typedef struct Bits Bits;
  20 typedef struct Elist Elist;
  21
  22 /* tag classes */
  23 #define Universal 0
  24 #define Context 0x80
  25
  26 /* universal tags */
  27 #define BOOLEAN 1
  28 #define INTEGER 2
  29 #define BIT_STRING 3
  30 #define OCTET_STRING 4
  31 #define NULLTAG 5
  32 #define OBJECT_ID 6
  33 #define ObjectDescriptor 7
  34 #define EXTERNAL 8
  35 #define REAL 9
  36 #define ENUMERATED 10
  37 #define EMBEDDED_PDV 11
  38 #define UTF8String 12
  39 #define SEQUENCE 16             /* also SEQUENCE OF */
  40 #define SETOF 17                                /* also SETOF OF */
  41 #define NumericString 18
  42 #define PrintableString 19
  43 #define TeletexString 20
  44 #define VideotexString 21
  45 #define IA5String 22
  46 #define UTCTime 23
  47 #define GeneralizedTime 24
  48 #define GraphicString 25
  49 #define VisibleString 26
  50 #define GeneralString 27
  51 #define UniversalString 28
  52 #define BMPString 30
  53
  54 struct Bytes {
  55         int     len;
  56         uchar   data[];
  57 };
  58
  59 struct Ints {
  60         int     len;
  61         int     data[];
  62 };
  63
  64 struct Bits {
  65         int     len;            /* number of bytes */
  66         int     unusedbits;     /* unused bits in last byte */
  67         uchar   data[];         /* most-significant bit first */
  68 };
  69
  70 struct Tag {
  71         int     class;
  72         int     num;
  73 };
  74
  75 enum { VBool, VInt, VOctets, VBigInt, VReal, VOther,
  76         VBitString, VNull, VEOC, VObjId, VString, VSeq, VSet };
  77 struct Value {
  78         int     tag;            /* VBool, etc. */
  79         union {
  80                 int     boolval;
  81                 int     intval;
  82                 Bytes*  octetsval;
  83                 Bytes*  bigintval;
  84                 Bytes*  realval;        /* undecoded; hardly ever used */
  85                 Bytes*  otherval;
  86                 Bits*   bitstringval;
  87                 Ints*   objidval;
  88                 char*   stringval;
  89                 Elist*  seqval;
  90                 Elist*  setval;
  91         } u;  /* (Don't use anonymous unions, for ease of porting) */
  92 };
  93
  94 struct Elem {
  95         Tag     tag;
  96         Value   val;
  97 };
  98
  99 struct Elist {
 100         Elist*  tl;
 101         Elem    hd;
 102 };
 103
 104 /* decoding errors */
 105 enum { ASN_OK, ASN_ESHORT, ASN_ETOOBIG, ASN_EVALLEN,
 106                 ASN_ECONSTR, ASN_EPRIM, ASN_EINVAL, ASN_EUNIMPL };
 107
 108
 109 /* here are the functions to consider making extern someday */
 110 static Bytes*   newbytes(int len);
 111 static Bytes*   makebytes(uchar* buf, int len);
 112 static void     freebytes(Bytes* b);
 113 static Bytes*   catbytes(Bytes* b1, Bytes* b2);
 114 static Ints*    newints(int len);
 115 static Ints*    makeints(int* buf, int len);
 116 static void     freeints(Ints* b);
 117 static Bits*    newbits(int len);
 118 static Bits*    makebits(uchar* buf, int len, int unusedbits);
 119 static void     freebits(Bits* b);
 120 static Elist*   mkel(Elem e, Elist* tail);
 121 static void     freeelist(Elist* el);
 122 static int      elistlen(Elist* el);
 123 static int      is_seq(Elem* pe, Elist** pseq);
 124 static int      is_set(Elem* pe, Elist** pset);
 125 static int      is_int(Elem* pe, int* pint);
 126 static int      is_bigint(Elem* pe, Bytes** pbigint);
 127 static int      is_bitstring(Elem* pe, Bits** pbits);
 128 static int      is_octetstring(Elem* pe, Bytes** poctets);
 129 static int      is_oid(Elem* pe, Ints** poid);
 130 static int      is_string(Elem* pe, char** pstring);
 131 static int      is_time(Elem* pe, char** ptime);
 132 static int      decode(uchar* a, int alen, Elem* pelem);
 133 static int      encode(Elem e, Bytes** pbytes);
 134 static int      oid_lookup(Ints* o, Ints** tab);
 135 static void     freevalfields(Value* v);
 136 static mpint    *asn1mpint(Elem *e);
 137 static void     edump(Elem);
 138
 139 #define TAG_MASK 0x1F
 140 #define CONSTR_MASK 0x20
 141 #define CLASS_MASK 0xC0
 142 #define MAXOBJIDLEN 20
 143
 144 static int ber_decode(uchar** pp, uchar* pend, Elem* pelem);
 145 static int tag_decode(uchar** pp, uchar* pend, Tag* ptag, int* pisconstr);
 146 static int length_decode(uchar** pp, uchar* pend, int* plength);
 147 static int value_decode(uchar** pp, uchar* pend, int length, int kind, int isconstr, Value* pval);
 148 static int int_decode(uchar** pp, uchar* pend, int count, int unsgned, int* pint);
 149 static int uint7_decode(uchar** pp, uchar* pend, int* pint);
 150 static int octet_decode(uchar** pp, uchar* pend, int length, int isconstr, Bytes** pbytes);
 151 static int seq_decode(uchar** pp, uchar* pend, int length, int isconstr, Elist** pelist);
 152 static int enc(uchar** pp, Elem e, int lenonly);
 153 static int val_enc(uchar** pp, Elem e, int *pconstr, int lenonly);
 154 static void uint7_enc(uchar** pp, int num, int lenonly);
 155 static void int_enc(uchar** pp, int num, int unsgned, int lenonly);
 156
 157 static void *
 158 emalloc(int n)
 159 {
 160         void *p;
 161         if(n==0)
 162                 n=1;
 163         p = malloc(n);
 164         if(p == nil)
 165                 sysfatal("out of memory");
 166         memset(p, 0, n);
 167         setmalloctag(p, getcallerpc(&n));
 168         return p;
 169 }
 170
 171 static char*
 172 estrdup(char *s)
 173 {
 174         char *d;
 175         int n;
 176
 177         n = strlen(s)+1;
 178         d = emalloc(n);
 179         memmove(d, s, n);
 180         return d;
 181 }
 182
 183
 184 /*
 185  * Decode a[0..len] as a BER encoding of an ASN1 type.
 186  * The return value is one of ASN_OK, etc.
 187  * Depending on the error, the returned elem may or may not
 188  * be nil.
 189  */
 190 static int
 191 decode(uchar* a, int alen, Elem* pelem)
 192 {
 193         uchar* p = a;
 194         int err;
 195
 196         err = ber_decode(&p, &a[alen], pelem);
 197         if(err == ASN_OK && p != &a[alen])
 198                 err = ASN_EVALLEN;
 199         return err;
 200 }
 201
 202 /*
 203  * All of the following decoding routines take arguments:
 204  *      uchar **pp;
 205  *      uchar *pend;
 206  * Where parsing is supposed to start at **pp, and when parsing
 207  * is done, *pp is updated to point at next char to be parsed.
 208  * The pend pointer is just past end of string; an error should
 209  * be returned parsing hasn't finished by then.
 210  *
 211  * The returned int is ASN_OK if all went fine, else ASN_ESHORT, etc.
 212  * The remaining argument(s) are pointers to where parsed entity goes.
 213  */
 214
 215 /* Decode an ASN1 'Elem' (tag, length, value) */
 216 static int
 217 ber_decode(uchar** pp, uchar* pend, Elem* pelem)
 218 {
 219         int err;
 220         int isconstr;
 221         int length;
 222         Tag tag;
 223         Value val;
 224
 225         memset(pelem, 0, sizeof(*pelem));
 226         err = tag_decode(pp, pend, &tag, &isconstr);
 227         if(err == ASN_OK) {
 228                 err = length_decode(pp, pend, &length);
 229                 if(err == ASN_OK) {
 230                         if(tag.class == Universal)
 231                                 err = value_decode(pp, pend, length, tag.num, isconstr, &val);
 232                         else
 233                                 err = value_decode(pp, pend, length, OCTET_STRING, 0, &val);
 234                         if(err == ASN_OK) {
 235                                 pelem->tag = tag;
 236                                 pelem->val = val;
 237                         }
 238                 }
 239         }
 240         return err;
 241 }
 242
 243 /* Decode a tag field */
 244 static int
 245 tag_decode(uchar** pp, uchar* pend, Tag* ptag, int* pisconstr)
 246 {
 247         int err;
 248         int v;
 249         uchar* p;
 250
 251         err = ASN_OK;
 252         p = *pp;
 253         if(pend-p >= 2) {
 254                 v = *p++;
 255                 ptag->class = v&CLASS_MASK;
 256                 if(v&CONSTR_MASK)
 257                         *pisconstr = 1;
 258                 else
 259                         *pisconstr = 0;
 260                 v &= TAG_MASK;
 261                 if(v == TAG_MASK)
 262                         err = uint7_decode(&p, pend, &v);
 263                 ptag->num = v;
 264         }
 265         else
 266                 err = ASN_ESHORT;
 267         *pp = p;
 268         return err;
 269 }
 270
 271 /* Decode a length field */
 272 static int
 273 length_decode(uchar** pp, uchar* pend, int* plength)
 274 {
 275         int err;
 276         int num;
 277         int v;
 278         uchar* p;
 279
 280         err = ASN_OK;
 281         num = 0;
 282         p = *pp;
 283         if(p < pend) {
 284                 v = *p++;
 285                 if(v&0x80)
 286                         err = int_decode(&p, pend, v&0x7F, 1, &num);
 287                 else
 288                         num = v;
 289         }
 290         else
 291                 err = ASN_ESHORT;
 292         *pp = p;
 293         *plength = num;
 294         return err;
 295 }
 296
 297 /* Decode a value field  */
 298 static int
 299 value_decode(uchar** pp, uchar* pend, int length, int kind, int isconstr, Value* pval)
 300 {
 301         int err;
 302         Bytes* va;
 303         int num;
 304         int bitsunused;
 305         int subids[MAXOBJIDLEN];
 306         int isubid;
 307         Elist*  vl;
 308         uchar* p;
 309         uchar* pe;
 310
 311         err = ASN_OK;
 312         p = *pp;
 313         if(length == -1) {      /* "indefinite" length spec */
 314                 if(!isconstr)
 315                         err = ASN_EINVAL;
 316         }
 317         else if(p + length > pend)
 318                 err = ASN_EVALLEN;
 319         if(err != ASN_OK)
 320                 return err;
 321
 322         switch(kind) {
 323         case 0:
 324                 /* marker for end of indefinite constructions */
 325                 if(length == 0)
 326                         pval->tag = VNull;
 327                 else
 328                         err = ASN_EINVAL;
 329                 break;
 330
 331         case BOOLEAN:
 332                 if(isconstr)
 333                         err = ASN_ECONSTR;
 334                 else if(length != 1)
 335                         err = ASN_EVALLEN;
 336                 else {
 337                         pval->tag = VBool;
 338                         pval->u.boolval = (*p++ != 0);
 339                 }
 340                 break;
 341
 342         case INTEGER:
 343         case ENUMERATED:
 344                 if(isconstr)
 345                         err = ASN_ECONSTR;
 346                 else if(length <= 4) {
 347                         err = int_decode(&p, pend, length, 0, &num);
 348                         if(err == ASN_OK) {
 349                                 pval->tag = VInt;
 350                                 pval->u.intval = num;
 351                         }
 352                 }
 353                 else {
 354                         pval->tag = VBigInt;
 355                         pval->u.bigintval = makebytes(p, length);
 356                         p += length;
 357                 }
 358                 break;
 359
 360         case BIT_STRING:
 361                 pval->tag = VBitString;
 362                 if(isconstr) {
 363                         if(length == -1 && p + 2 <= pend && *p == 0 && *(p+1) ==0) {
 364                                 pval->u.bitstringval = makebits(0, 0, 0);
 365                                 p += 2;
 366                         }
 367                         else    /* TODO: recurse and concat results */
 368                                 err = ASN_EUNIMPL;
 369                 }
 370                 else {
 371                         if(length < 2) {
 372                                 if(length == 1 && *p == 0) {
 373                                         pval->u.bitstringval = makebits(0, 0, 0);
 374                                         p++;
 375                                 }
 376                                 else
 377                                         err = ASN_EINVAL;
 378                         }
 379                         else {
 380                                 bitsunused = *p;
 381                                 if(bitsunused > 7)
 382                                         err = ASN_EINVAL;
 383                                 else if(length > 0x0FFFFFFF)
 384                                         err = ASN_ETOOBIG;
 385                                 else {
 386                                         pval->u.bitstringval = makebits(p+1, length-1, bitsunused);
 387                                         p += length;
 388                                 }
 389                         }
 390                 }
 391                 break;
 392
 393         case OCTET_STRING:
 394         case ObjectDescriptor:
 395                 err = octet_decode(&p, pend, length, isconstr, &va);
 396                 if(err == ASN_OK) {
 397                         pval->tag = VOctets;
 398                         pval->u.octetsval = va;
 399                 }
 400                 break;
 401
 402         case NULLTAG:
 403                 if(isconstr)
 404                         err = ASN_ECONSTR;
 405                 else if(length != 0)
 406                         err = ASN_EVALLEN;
 407                 else
 408                         pval->tag = VNull;
 409                 break;
 410
 411         case OBJECT_ID:
 412                 if(isconstr)
 413                         err = ASN_ECONSTR;
 414                 else if(length == 0)
 415                         err = ASN_EVALLEN;
 416                 else {
 417                         isubid = 0;
 418                         pe = p+length;
 419                         while(p < pe && isubid < MAXOBJIDLEN) {
 420                                 err = uint7_decode(&p, pend, &num);
 421                                 if(err != ASN_OK)
 422                                         break;
 423                                 if(isubid == 0) {
 424                                         subids[isubid++] = num / 40;
 425                                         subids[isubid++] = num % 40;
 426                                 }
 427                                 else
 428                                         subids[isubid++] = num;
 429                         }
 430                         if(err == ASN_OK) {
 431                                 if(p != pe)
 432                                         err = ASN_EVALLEN;
 433                                 else {
 434                                         pval->tag = VObjId;
 435                                         pval->u.objidval = makeints(subids, isubid);
 436                                 }
 437                         }
 438                 }
 439                 break;
 440
 441         case EXTERNAL:
 442         case EMBEDDED_PDV:
 443                 /* TODO: parse this internally */
 444                 if(p+length > pend)
 445                         err = ASN_EVALLEN;
 446                 else {
 447                         pval->tag = VOther;
 448                         pval->u.otherval = makebytes(p, length);
 449                         p += length;
 450                 }
 451                 break;
 452
 453         case REAL:
 454                 /* Let the application decode */
 455                 if(isconstr)
 456                         err = ASN_ECONSTR;
 457                 else if(p+length > pend)
 458                         err = ASN_EVALLEN;
 459                 else {
 460                         pval->tag = VReal;
 461                         pval->u.realval = makebytes(p, length);
 462                         p += length;
 463                 }
 464                 break;
 465
 466         case SEQUENCE:
 467                 err = seq_decode(&p, pend, length, isconstr, &vl);
 468                 if(err == ASN_OK) {
 469                         pval->tag = VSeq ;
 470                         pval->u.seqval = vl;
 471                 }
 472                 break;
 473
 474         case SETOF:
 475                 err = seq_decode(&p, pend, length, isconstr, &vl);
 476                 if(err == ASN_OK) {
 477                         pval->tag = VSet;
 478                         pval->u.setval = vl;
 479                 }
 480                 break;
 481
 482         case UTF8String:
 483         case NumericString:
 484         case PrintableString:
 485         case TeletexString:
 486         case VideotexString:
 487         case IA5String:
 488         case UTCTime:
 489         case GeneralizedTime:
 490         case GraphicString:
 491         case VisibleString:
 492         case GeneralString:
 493         case UniversalString:
 494         case BMPString:
 495                 err = octet_decode(&p, pend, length, isconstr, &va);
 496                 if(err == ASN_OK) {
 497                         uchar *s;
 498                         char *d;
 499                         Rune r;
 500                         int n;
 501
 502                         switch(kind){
 503                         case UniversalString:
 504                                 n = va->len / 4;
 505                                 d = emalloc(n*UTFmax+1);
 506                                 pval->u.stringval = d;
 507                                 s = va->data;
 508                                 while(n > 0){
 509                                         r = s[0]<<24 | s[1]<<16 | s[2]<<8 | s[3];
 510                                         if(r == 0)
 511                                                 break;
 512                                         n--;
 513                                         s += 4;
 514                                         d += runetochar(d, &r);
 515                                 }
 516                                 *d = 0;
 517                                 break;
 518                         case BMPString:
 519                                 n = va->len / 2;
 520                                 d = emalloc(n*UTFmax+1);
 521                                 pval->u.stringval = d;
 522                                 s = va->data;
 523                                 while(n > 0){
 524                                         r = s[0]<<8 | s[1];
 525                                         if(r == 0)
 526                                                 break;
 527                                         n--;
 528                                         s += 2;
 529                                         d += runetochar(d, &r);
 530                                 }
 531                                 *d = 0;
 532                                 break;
 533                         default:
 534                                 n = va->len;
 535                                 d = emalloc(n+1);
 536                                 pval->u.stringval = d;
 537                                 s = va->data;
 538                                 while(n > 0){
 539                                         if((*d = *s) == 0)
 540                                                 break;
 541                                         n--;
 542                                         s++;
 543                                         d++;
 544                                 }
 545                                 *d = 0;
 546                                 break;
 547                         }
 548                         if(n != 0){
 549                                 err = ASN_EINVAL;
 550                                 free(pval->u.stringval);
 551                         } else
 552                                 pval->tag = VString;
 553                         free(va);
 554                 }
 555                 break;
 556
 557         default:
 558                 if(p+length > pend)
 559                         err = ASN_EVALLEN;
 560                 else {
 561                         pval->tag = VOther;
 562                         pval->u.otherval = makebytes(p, length);
 563                         p += length;
 564                 }
 565                 break;
 566         }
 567         *pp = p;
 568         return err;
 569 }
 570
 571 /*
 572  * Decode an int in format where count bytes are
 573  * concatenated to form value.
 574  * Although ASN1 allows any size integer, we return
 575  * an error if the result doesn't fit in a 32-bit int.
 576  * If unsgned is not set, make sure to propagate sign bit.
 577  */
 578 static int
 579 int_decode(uchar** pp, uchar* pend, int count, int unsgned, int* pint)
 580 {
 581         int err;
 582         int num;
 583         uchar* p;
 584
 585         p = *pp;
 586         err = ASN_OK;
 587         num = 0;
 588         if(p+count <= pend) {
 589                 if((count > 4) || (unsgned && count == 4 && (*p&0x80)))
 590                         err = ASN_ETOOBIG;
 591                 else {
 592                         if(!unsgned && count > 0 && count < 4 && (*p&0x80))
 593                                 num = -1;       /* set all bits, initially */
 594                         while(count--)
 595                                 num = (num << 8)|(*p++);
 596                 }
 597         }
 598         else
 599                 err = ASN_ESHORT;
 600         *pint = num;
 601         *pp = p;
 602         return err;
 603 }
 604
 605 /*
 606  * Decode an unsigned int in format where each
 607  * byte except last has high bit set, and remaining
 608  * seven bits of each byte are concatenated to form value.
 609  * Although ASN1 allows any size integer, we return
 610  * an error if the result doesn't fit in a 32 bit int.
 611  */
 612 static int
 613 uint7_decode(uchar** pp, uchar* pend, int* pint)
 614 {
 615         int err;
 616         int num;
 617         int more;
 618         int v;
 619         uchar* p;
 620
 621         p = *pp;
 622         err = ASN_OK;
 623         num = 0;
 624         more = 1;
 625         while(more && p < pend) {
 626                 v = *p++;
 627                 if(num&0x7F000000) {
 628                         err = ASN_ETOOBIG;
 629                         break;
 630                 }
 631                 num <<= 7;
 632                 more = v&0x80;
 633                 num |= (v&0x7F);
 634         }
 635         if(p == pend)
 636                 err = ASN_ESHORT;
 637         *pint = num;
 638         *pp = p;
 639         return err;
 640 }
 641
 642 /*
 643  * Decode an octet string, recursively if isconstr.
 644  * We've already checked that length==-1 implies isconstr==1,
 645  * and otherwise that specified length fits within (*pp..pend)
 646  */
 647 static int
 648 octet_decode(uchar** pp, uchar* pend, int length, int isconstr, Bytes** pbytes)
 649 {
 650         int err;
 651         uchar* p;
 652         Bytes* ans;
 653         Bytes* newans;
 654         uchar* pstart;
 655         uchar* pold;
 656         Elem    elem;
 657
 658         err = ASN_OK;
 659         p = *pp;
 660         ans = nil;
 661         if(length >= 0 && !isconstr) {
 662                 ans = makebytes(p, length);
 663                 p += length;
 664         }
 665         else {
 666                 /* constructed, either definite or indefinite length */
 667                 pstart = p;
 668                 for(;;) {
 669                         if(length >= 0 && p >= pstart + length) {
 670                                 if(p != pstart + length)
 671                                         err = ASN_EVALLEN;
 672                                 break;
 673                         }
 674                         pold = p;
 675                         err = ber_decode(&p, pend, &elem);
 676                         if(err != ASN_OK)
 677                                 break;
 678                         switch(elem.val.tag) {
 679                         case VOctets:
 680                                 newans = catbytes(ans, elem.val.u.octetsval);
 681                                 freevalfields(&elem.val);
 682                                 freebytes(ans);
 683                                 ans = newans;
 684                                 break;
 685
 686                         case VEOC:
 687                                 if(length == -1)
 688                                         goto cloop_done;
 689                                 /* no break */
 690                         default:
 691                                 freevalfields(&elem.val);
 692                                 p = pold;
 693                                 err = ASN_EINVAL;
 694                                 goto cloop_done;
 695                         }
 696                 }
 697 cloop_done:
 698                 if(err != ASN_OK){
 699                         freebytes(ans);
 700                         ans = nil;
 701                 }
 702         }
 703         *pp = p;
 704         *pbytes = ans;
 705         return err;
 706 }
 707
 708 /*
 709  * Decode a sequence or set.
 710  * We've already checked that length==-1 implies isconstr==1,
 711  * and otherwise that specified length fits within (*p..pend)
 712  */
 713 static int
 714 seq_decode(uchar** pp, uchar* pend, int length, int isconstr, Elist** pelist)
 715 {
 716         int err;
 717         uchar* p;
 718         uchar* pstart;
 719         uchar* pold;
 720         Elist* ans;
 721         Elem elem;
 722         Elist* lve;
 723         Elist* lveold;
 724
 725         err = ASN_OK;
 726         ans = nil;
 727         p = *pp;
 728         if(!isconstr)
 729                 err = ASN_EPRIM;
 730         else {
 731                 /* constructed, either definite or indefinite length */
 732                 lve = nil;
 733                 pstart = p;
 734                 for(;;) {
 735                         if(length >= 0 && p >= pstart + length) {
 736                                 if(p != pstart + length)
 737                                         err = ASN_EVALLEN;
 738                                 break;
 739                         }
 740                         pold = p;
 741                         err = ber_decode(&p, pend, &elem);
 742                         if(err != ASN_OK)
 743                                 break;
 744                         if(elem.val.tag == VEOC) {
 745                                 if(length != -1) {
 746                                         p = pold;
 747                                         err = ASN_EINVAL;
 748                                 }
 749                                 break;
 750                         }
 751                         else
 752                                 lve = mkel(elem, lve);
 753                 }
 754                 if(err != ASN_OK)
 755                         freeelist(lve);
 756                 else {
 757                         /* reverse back to original order */
 758                         while(lve != nil) {
 759                                 lveold = lve;
 760                                 lve = lve->tl;
 761                                 lveold->tl = ans;
 762                                 ans = lveold;
 763                         }
 764                 }
 765         }
 766         *pp = p;
 767         *pelist = ans;
 768         return err;
 769 }
 770
 771 /*
 772  * Encode e by BER rules, putting answer in *pbytes.
 773  * This is done by first calling enc with lenonly==1
 774  * to get the length of the needed buffer,
 775  * then allocating the buffer and using enc again to fill it up.
 776  */
 777 static int
 778 encode(Elem e, Bytes** pbytes)
 779 {
 780         uchar* p;
 781         Bytes* ans;
 782         int err;
 783         uchar uc;
 784
 785         p = &uc;
 786         err = enc(&p, e, 1);
 787         if(err == ASN_OK) {
 788                 ans = newbytes(p-&uc);
 789                 p = ans->data;
 790                 err = enc(&p, e, 0);
 791                 *pbytes = ans;
 792         }
 793         return err;
 794 }
 795
 796 /*
 797  * The various enc functions take a pointer to a pointer
 798  * into a buffer, and encode their entity starting there,
 799  * updating the pointer afterwards.
 800  * If lenonly is 1, only the pointer update is done,
 801  * allowing enc to be called first to calculate the needed
 802  * buffer length.
 803  * If lenonly is 0, it is assumed that the answer will fit.
 804  */
 805
 806 static int
 807 enc(uchar** pp, Elem e, int lenonly)
 808 {
 809         int err;
 810         int vlen;
 811         int constr;
 812         Tag tag;
 813         int v;
 814         int ilen;
 815         uchar* p;
 816         uchar* psave;
 817
 818         p = *pp;
 819         err = val_enc(&p, e, &constr, 1);
 820         if(err != ASN_OK)
 821                 return err;
 822         vlen = p - *pp;
 823         p = *pp;
 824         tag = e.tag;
 825         v = tag.class|constr;
 826         if(tag.num < 31) {
 827                 if(!lenonly)
 828                         *p = (v|tag.num);
 829                 p++;
 830         }
 831         else {
 832                 if(!lenonly)
 833                         *p = (v|31);
 834                 p++;
 835                 if(tag.num < 0)
 836                         return ASN_EINVAL;
 837                 uint7_enc(&p, tag.num, lenonly);
 838         }
 839         if(vlen < 0x80) {
 840                 if(!lenonly)
 841                         *p = vlen;
 842                 p++;
 843         }
 844         else {
 845                 psave = p;
 846                 int_enc(&p, vlen, 1, 1);
 847                 ilen = p-psave;
 848                 p = psave;
 849                 if(!lenonly) {
 850                         *p++ = (0x80 | ilen);
 851                         int_enc(&p, vlen, 1, 0);
 852                 }
 853                 else
 854                         p += 1 + ilen;
 855         }
 856         if(!lenonly)
 857                 val_enc(&p, e, &constr, 0);
 858         else
 859                 p += vlen;
 860         *pp = p;
 861         return err;
 862 }
 863
 864 static int
 865 val_enc(uchar** pp, Elem e, int *pconstr, int lenonly)
 866 {
 867         int err;
 868         uchar* p;
 869         int kind;
 870         int cl;
 871         int v;
 872         Bytes* bb = nil;
 873         Bits* bits;
 874         Ints* oid;
 875         int k;
 876         Elist* el;
 877         char* s;
 878
 879         p = *pp;
 880         err = ASN_OK;
 881         kind = e.tag.num;
 882         cl = e.tag.class;
 883         *pconstr = 0;
 884         if(cl != Universal) {
 885                 switch(e.val.tag) {
 886                 case VBool:
 887                         kind = BOOLEAN;
 888                         break;
 889                 case VInt:
 890                         kind = INTEGER;
 891                         break;
 892                 case VBigInt:
 893                         kind = INTEGER;
 894                         break;
 895                 case VOctets:
 896                         kind = OCTET_STRING;
 897                         break;
 898                 case VReal:
 899                         kind = REAL;
 900                         break;
 901                 case VOther:
 902                         kind = OCTET_STRING;
 903                         break;
 904                 case VBitString:
 905                         kind = BIT_STRING;
 906                         break;
 907                 case VNull:
 908                         kind = NULLTAG;
 909                         break;
 910                 case VObjId:
 911                         kind = OBJECT_ID;
 912                         break;
 913                 case VString:
 914                         kind = UniversalString;
 915                         break;
 916                 case VSeq:
 917                         kind = SEQUENCE;
 918                         break;
 919                 case VSet:
 920                         kind = SETOF;
 921                         break;
 922                 }
 923         }
 924         switch(kind) {
 925         case BOOLEAN:
 926                 if(is_int(&e, &v)) {
 927                         if(v != 0)
 928                                 v = 255;
 929                          int_enc(&p, v, 1, lenonly);
 930                 }
 931                 else
 932                         err = ASN_EINVAL;
 933                 break;
 934
 935         case INTEGER:
 936         case ENUMERATED:
 937                 if(is_int(&e, &v))
 938                         int_enc(&p, v, 0, lenonly);
 939                 else {
 940                         if(is_bigint(&e, &bb)) {
 941                                 if(!lenonly)
 942                                         memmove(p, bb->data, bb->len);
 943                                 p += bb->len;
 944                         }
 945                         else
 946                                 err = ASN_EINVAL;
 947                 }
 948                 break;
 949
 950         case BIT_STRING:
 951                 if(is_bitstring(&e, &bits)) {
 952                         if(bits->len == 0) {
 953                                 if(!lenonly)
 954                                         *p = 0;
 955                                 p++;
 956                         }
 957                         else {
 958                                 v = bits->unusedbits;
 959                                 if(v < 0 || v > 7)
 960                                         err = ASN_EINVAL;
 961                                 else {
 962                                         if(!lenonly) {
 963                                                 *p = v;
 964                                                 memmove(p+1, bits->data, bits->len);
 965                                         }
 966                                         p += 1 + bits->len;
 967                                 }
 968                         }
 969                 }
 970                 else
 971                         err = ASN_EINVAL;
 972                 break;
 973
 974         case OCTET_STRING:
 975         case ObjectDescriptor:
 976         case EXTERNAL:
 977         case REAL:
 978         case EMBEDDED_PDV:
 979                 bb = nil;
 980                 switch(e.val.tag) {
 981                 case VOctets:
 982                         bb = e.val.u.octetsval;
 983                         break;
 984                 case VReal:
 985                         bb = e.val.u.realval;
 986                         break;
 987                 case VOther:
 988                         bb = e.val.u.otherval;
 989                         break;
 990                 }
 991                 if(bb != nil) {
 992                         if(!lenonly)
 993                                 memmove(p, bb->data, bb->len);
 994                         p += bb->len;
 995                 }
 996                 else
 997                         err = ASN_EINVAL;
 998                 break;
 999
1000         case NULLTAG:
1001                 break;
1002
1003         case OBJECT_ID:
1004                 if(is_oid(&e, &oid)) {
1005                         for(k = 0; k < oid->len; k++) {
1006                                 v = oid->data[k];
1007                                 if(k == 0) {
1008                                         v *= 40;
1009                                         if(oid->len > 1)
1010                                                 v += oid->data[++k];
1011                                 }
1012                                 uint7_enc(&p, v, lenonly);
1013                         }
1014                 }
1015                 else
1016                         err = ASN_EINVAL;
1017                 break;
1018
1019         case SEQUENCE:
1020         case SETOF:
1021                 el = nil;
1022                 if(e.val.tag == VSeq)
1023                         el = e.val.u.seqval;
1024                 else if(e.val.tag == VSet)
1025                         el = e.val.u.setval;
1026                 else
1027                         err = ASN_EINVAL;
1028                 if(el != nil) {
1029                         *pconstr = CONSTR_MASK;
1030                         for(; el != nil; el = el->tl) {
1031                                 err = enc(&p, el->hd, lenonly);
1032                                 if(err != ASN_OK)
1033                                         break;
1034                         }
1035                 }
1036                 break;
1037
1038         case UTF8String:
1039         case NumericString:
1040         case PrintableString:
1041         case TeletexString:
1042         case VideotexString:
1043         case IA5String:
1044         case UTCTime:
1045         case GeneralizedTime:
1046         case GraphicString:
1047         case VisibleString:
1048         case GeneralString:
1049         case UniversalString:
1050         case BMPString:
1051                 if(e.val.tag == VString) {
1052                         s = e.val.u.stringval;
1053                         if(s != nil) {
1054                                 v = strlen(s);
1055                                 if(!lenonly)
1056                                         memmove(p, s, v);
1057                                 p += v;
1058                         }
1059                 }
1060                 else
1061                         err = ASN_EINVAL;
1062                 break;
1063
1064         default:
1065                 err = ASN_EINVAL;
1066         }
1067         *pp = p;
1068         return err;
1069 }
1070
1071 /*
1072  * Encode num as unsigned 7 bit values with top bit 1 on all bytes
1073  * except last, only putting in bytes if !lenonly.
1074  */
1075 static void
1076 uint7_enc(uchar** pp, int num, int lenonly)
1077 {
1078         int n;
1079         int v;
1080         int k;
1081         uchar* p;
1082
1083         p = *pp;
1084         n = 1;
1085         v = num >> 7;
1086         while(v > 0) {
1087                 v >>= 7;
1088                 n++;
1089         }
1090         if(lenonly)
1091                 p += n;
1092         else {
1093                 for(k = (n - 1)*7; k > 0; k -= 7)
1094                         *p++= ((num >> k)|0x80);
1095                 *p++ = (num&0x7F);
1096         }
1097         *pp = p;
1098 }
1099
1100 /*
1101  * Encode num as unsigned or signed integer,
1102  * only putting in bytes if !lenonly.
1103  * Encoding is length followed by bytes to concatenate.
1104  */
1105 static void
1106 int_enc(uchar** pp, int num, int unsgned, int lenonly)
1107 {
1108         int v;
1109         int n;
1110         int prevv;
1111         int k;
1112         uchar* p;
1113
1114         p = *pp;
1115         v = num;
1116         if(v < 0)
1117                 v = -(v + 1);
1118         n = 1;
1119         prevv = v;
1120         v >>= 8;
1121         while(v > 0) {
1122                 prevv = v;
1123                 v >>= 8;
1124                 n++;
1125         }
1126         if(!unsgned && (prevv&0x80))
1127                 n++;
1128         if(lenonly)
1129                 p += n;
1130         else {
1131                 for(k = (n - 1)*8; k >= 0; k -= 8)
1132                         *p++ = (num >> k);
1133         }
1134         *pp = p;
1135 }
1136
1137 static int
1138 ints_eq(Ints* a, Ints* b)
1139 {
1140         int     alen;
1141         int     i;
1142
1143         alen = a->len;
1144         if(alen != b->len)
1145                 return 0;
1146         for(i = 0; i < alen; i++)
1147                 if(a->data[i] != b->data[i])
1148                         return 0;
1149         return 1;
1150 }
1151
1152 /*
1153  * Look up o in tab (which must have nil entry to terminate).
1154  * Return index of matching entry, or -1 if none.
1155  */
1156 static int
1157 oid_lookup(Ints* o, Ints** tab)
1158 {
1159         int i;
1160
1161         for(i = 0; tab[i] != nil; i++)
1162                 if(ints_eq(o, tab[i]))
1163                         return  i;
1164         return -1;
1165 }
1166
1167 /*
1168  * Return true if *pe is a SEQUENCE, and set *pseq to
1169  * the value of the sequence if so.
1170  */
1171 static int
1172 is_seq(Elem* pe, Elist** pseq)
1173 {
1174         if(pe->tag.class == Universal && pe->tag.num == SEQUENCE && pe->val.tag == VSeq) {
1175                 *pseq = pe->val.u.seqval;
1176                 return 1;
1177         }
1178         return 0;
1179 }
1180
1181 static int
1182 is_set(Elem* pe, Elist** pset)
1183 {
1184         if(pe->tag.class == Universal && pe->tag.num == SETOF && pe->val.tag == VSet) {
1185                 *pset = pe->val.u.setval;
1186                 return 1;
1187         }
1188         return 0;
1189 }
1190
1191 static int
1192 is_int(Elem* pe, int* pint)
1193 {
1194         if(pe->tag.class == Universal) {
1195                 if(pe->tag.num == INTEGER && pe->val.tag == VInt) {
1196                         *pint = pe->val.u.intval;
1197                         return 1;
1198                 }
1199                 else if(pe->tag.num == BOOLEAN && pe->val.tag == VBool) {
1200                         *pint = pe->val.u.boolval;
1201                         return 1;
1202                 }
1203         }
1204         return 0;
1205 }
1206
1207 /*
1208  * for convience, all VInt's are readable via this routine,
1209  * as well as all VBigInt's
1210  */
1211 static int
1212 is_bigint(Elem* pe, Bytes** pbigint)
1213 {
1214         if(pe->tag.class == Universal && pe->tag.num == INTEGER && pe->val.tag == VBigInt) {
1215                 *pbigint = pe->val.u.bigintval;
1216                 return 1;
1217         }
1218         return 0;
1219 }
1220
1221 static int
1222 is_bitstring(Elem* pe, Bits** pbits)
1223 {
1224         if(pe->tag.class == Universal && pe->tag.num == BIT_STRING && pe->val.tag == VBitString) {
1225                 *pbits = pe->val.u.bitstringval;
1226                 return 1;
1227         }
1228         return 0;
1229 }
1230
1231 static int
1232 is_octetstring(Elem* pe, Bytes** poctets)
1233 {
1234         if(pe->tag.class == Universal && pe->tag.num == OCTET_STRING && pe->val.tag == VOctets) {
1235                 *poctets = pe->val.u.octetsval;
1236                 return 1;
1237         }
1238         return 0;
1239 }
1240
1241 static int
1242 is_oid(Elem* pe, Ints** poid)
1243 {
1244         if(pe->tag.class == Universal && pe->tag.num == OBJECT_ID && pe->val.tag == VObjId) {
1245                 *poid = pe->val.u.objidval;
1246                 return 1;
1247         }
1248         return 0;
1249 }
1250
1251 static int
1252 is_string(Elem* pe, char** pstring)
1253 {
1254         if(pe->tag.class == Universal) {
1255                 switch(pe->tag.num) {
1256                 case UTF8String:
1257                 case NumericString:
1258                 case PrintableString:
1259                 case TeletexString:
1260                 case VideotexString:
1261                 case IA5String:
1262                 case GraphicString:
1263                 case VisibleString:
1264                 case GeneralString:
1265                 case UniversalString:
1266                 case BMPString:
1267                         if(pe->val.tag == VString) {
1268                                 *pstring = pe->val.u.stringval;
1269                                 return 1;
1270                         }
1271                 }
1272         }
1273         return 0;
1274 }
1275
1276 static int
1277 is_time(Elem* pe, char** ptime)
1278 {
1279         if(pe->tag.class == Universal
1280            && (pe->tag.num == UTCTime || pe->tag.num == GeneralizedTime)
1281            && pe->val.tag == VString) {
1282                 *ptime = pe->val.u.stringval;
1283                 return 1;
1284         }
1285         return 0;
1286 }
1287
1288
1289 /*
1290  * malloc and return a new Bytes structure capable of
1291  * holding len bytes. (len >= 0)
1292  */
1293 static Bytes*
1294 newbytes(int len)
1295 {
1296         Bytes* ans;
1297
1298         if(len < 0)
1299                 abort();
1300         ans = emalloc(sizeof(Bytes) + len);
1301         ans->len = len;
1302         return ans;
1303 }
1304
1305 /*
1306  * newbytes(len), with data initialized from buf
1307  */
1308 static Bytes*
1309 makebytes(uchar* buf, int len)
1310 {
1311         Bytes* ans;
1312
1313         ans = newbytes(len);
1314         memmove(ans->data, buf, len);
1315         return ans;
1316 }
1317
1318 static void
1319 freebytes(Bytes* b)
1320 {
1321         free(b);
1322 }
1323
1324 /*
1325  * Make a new Bytes, containing bytes of b1 followed by those of b2.
1326  * Either b1 or b2 or both can be nil.
1327  */
1328 static Bytes*
1329 catbytes(Bytes* b1, Bytes* b2)
1330 {
1331         Bytes* ans;
1332         int n;
1333
1334         if(b1 == nil) {
1335                 if(b2 == nil)
1336                         ans = newbytes(0);
1337                 else
1338                         ans = makebytes(b2->data, b2->len);
1339         }
1340         else if(b2 == nil) {
1341                 ans = makebytes(b1->data, b1->len);
1342         }
1343         else {
1344                 n = b1->len + b2->len;
1345                 ans = newbytes(n);
1346                 ans->len = n;
1347                 memmove(ans->data, b1->data, b1->len);
1348                 memmove(ans->data+b1->len, b2->data, b2->len);
1349         }
1350         return ans;
1351 }
1352
1353 /* len is number of ints */
1354 static Ints*
1355 newints(int len)
1356 {
1357         Ints* ans;
1358
1359         if(len < 0 || len > ((uint)-1>>1)/sizeof(int))
1360                 abort();
1361         ans = emalloc(sizeof(Ints) + len*sizeof(int));
1362         ans->len = len;
1363         return ans;
1364 }
1365
1366 static Ints*
1367 makeints(int* buf, int len)
1368 {
1369         Ints* ans;
1370
1371         ans = newints(len);
1372         memmove(ans->data, buf, len*sizeof(int));
1373         return ans;
1374 }
1375
1376 static void
1377 freeints(Ints* b)
1378 {
1379         free(b);
1380 }
1381
1382 /* len is number of bytes */
1383 static Bits*
1384 newbits(int len)
1385 {
1386         Bits* ans;
1387
1388         if(len < 0)
1389                 abort();
1390         ans = emalloc(sizeof(Bits) + len);
1391         ans->len = len;
1392         ans->unusedbits = 0;
1393         return ans;
1394 }
1395
1396 static Bits*
1397 makebits(uchar* buf, int len, int unusedbits)
1398 {
1399         Bits* ans;
1400
1401         ans = newbits(len);
1402         memmove(ans->data, buf, len);
1403         ans->unusedbits = unusedbits;
1404         return ans;
1405 }
1406
1407 static void
1408 freebits(Bits* b)
1409 {
1410         free(b);
1411 }
1412
1413 static Elist*
1414 mkel(Elem e, Elist* tail)
1415 {
1416         Elist* el;
1417
1418         el = (Elist*)emalloc(sizeof(Elist));
1419         setmalloctag(el, getcallerpc(&e));
1420         el->hd = e;
1421         el->tl = tail;
1422         return el;
1423 }
1424
1425 static int
1426 elistlen(Elist* el)
1427 {
1428         int ans = 0;
1429         while(el != nil) {
1430                 ans++;
1431                 el = el->tl;
1432         }
1433         return ans;
1434 }
1435
1436 /* Frees elist, but not fields inside values of constituent elems */
1437 static void
1438 freeelist(Elist* el)
1439 {
1440         Elist* next;
1441
1442         while(el != nil) {
1443                 next = el->tl;
1444                 free(el);
1445                 el = next;
1446         }
1447 }
1448
1449 /* free any allocated structures inside v (recursively freeing Elists) */
1450 static void
1451 freevalfields(Value* v)
1452 {
1453         Elist* el;
1454         Elist* l;
1455         if(v == nil)
1456                 return;
1457         switch(v->tag) {
1458         case VOctets:
1459                 freebytes(v->u.octetsval);
1460                 break;
1461         case VBigInt:
1462                 freebytes(v->u.bigintval);
1463                 break;
1464         case VReal:
1465                 freebytes(v->u.realval);
1466                 break;
1467         case VOther:
1468                 freebytes(v->u.otherval);
1469                 break;
1470         case VBitString:
1471                 freebits(v->u.bitstringval);
1472                 break;
1473         case VObjId:
1474                 freeints(v->u.objidval);
1475                 break;
1476         case VString:
1477                 free(v->u.stringval);
1478                 break;
1479         case VSeq:
1480                 el = v->u.seqval;
1481                 for(l = el; l != nil; l = l->tl)
1482                         freevalfields(&l->hd.val);
1483                 freeelist(el);
1484                 break;
1485         case VSet:
1486                 el = v->u.setval;
1487                 for(l = el; l != nil; l = l->tl)
1488                         freevalfields(&l->hd.val);
1489                 freeelist(el);
1490                 break;
1491         }
1492         memset(v, 0, sizeof(*v));
1493 }
1494
1495 static mpint*
1496 asn1mpint(Elem *e)
1497 {
1498         Bytes *b;
1499         int v;
1500
1501         if(is_int(e, &v))
1502                 return itomp(v, nil);
1503         if(is_bigint(e, &b))
1504                 return betomp(b->data, b->len, nil);
1505         return nil;
1506 }
1507
1508 /* end of general ASN1 functions */
1509
1510
1511
1512
1513
1514 /*=============================================================*/
1515 /*
1516  * Decode and parse an X.509 Certificate, defined by this ASN1:
1517  *      Certificate ::= SEQUENCE {
1518  *              certificateInfo CertificateInfo,
1519  *              signatureAlgorithm AlgorithmIdentifier,
1520  *              signature BIT STRING }
1521  *
1522  *      CertificateInfo ::= SEQUENCE {
1523  *              version [0] INTEGER DEFAULT v1 (0),
1524  *              serialNumber INTEGER,
1525  *              signature AlgorithmIdentifier,
1526  *              issuer Name,
1527  *              validity Validity,
1528  *              subject Name,
1529  *              subjectPublicKeyInfo SubjectPublicKeyInfo }
1530  *      (version v2 has two more fields, optional unique identifiers for
1531  *  issuer and subject; since we ignore these anyway, we won't parse them)
1532  *
1533  *      Validity ::= SEQUENCE {
1534  *              notBefore UTCTime,
1535  *              notAfter UTCTime }
1536  *
1537  *      SubjectPublicKeyInfo ::= SEQUENCE {
1538  *              algorithm AlgorithmIdentifier,
1539  *              subjectPublicKey BIT STRING }
1540  *
1541  *      AlgorithmIdentifier ::= SEQUENCE {
1542  *              algorithm OBJECT IDENTIFER,
1543  *              parameters ANY DEFINED BY ALGORITHM OPTIONAL }
1544  *
1545  *      Name ::= SEQUENCE OF RelativeDistinguishedName
1546  *
1547  *      RelativeDistinguishedName ::= SETOF SIZE(1..MAX) OF AttributeTypeAndValue
1548  *
1549  *      AttributeTypeAndValue ::= SEQUENCE {
1550  *              type OBJECT IDENTIFER,
1551  *              value DirectoryString }
1552  *      (selected attributes have these Object Ids:
1553  *              commonName {2 5 4 3}
1554  *              countryName {2 5 4 6}
1555  *              localityName {2 5 4 7}
1556  *              stateOrProvinceName {2 5 4 8}
1557  *              organizationName {2 5 4 10}
1558  *              organizationalUnitName {2 5 4 11}
1559  *      )
1560  *
1561  *      DirectoryString ::= CHOICE {
1562  *              teletexString TeletexString,
1563  *              printableString PrintableString,
1564  *              universalString UniversalString }
1565  *
1566  *  See rfc1423, rfc2437 for AlgorithmIdentifier, subjectPublicKeyInfo, signature.
1567  *
1568  *  Not yet implemented:
1569  *   CertificateRevocationList ::= SIGNED SEQUENCE{
1570  *           signature       AlgorithmIdentifier,
1571  *           issuer          Name,
1572  *           lastUpdate      UTCTime,
1573  *           nextUpdate      UTCTime,
1574  *           revokedCertificates
1575  *                           SEQUENCE OF CRLEntry OPTIONAL}
1576  *   CRLEntry ::= SEQUENCE{
1577  *           userCertificate SerialNumber,
1578  *           revocationDate UTCTime}
1579  */
1580
1581 typedef struct CertX509 {
1582         int     serial;
1583         char*   issuer;
1584         char*   validity_start;
1585         char*   validity_end;
1586         char*   subject;
1587         int     publickey_alg;
1588         Bits*   publickey;
1589         int     signature_alg;
1590         Bits*   signature;
1591         int     curve;
1592         Bytes*  ext;
1593 } CertX509;
1594
1595 /* Algorithm object-ids */
1596 enum {
1597         ALG_rsaEncryption,
1598         ALG_md2WithRSAEncryption,
1599         ALG_md4WithRSAEncryption,
1600         ALG_md5WithRSAEncryption,
1601
1602         ALG_sha1WithRSAEncryption,
1603         ALG_sha1WithRSAEncryptionOiw,
1604
1605         ALG_sha256WithRSAEncryption,
1606         ALG_sha384WithRSAEncryption,
1607         ALG_sha512WithRSAEncryption,
1608         ALG_sha224WithRSAEncryption,
1609
1610         ALG_ecPublicKey,
1611         ALG_sha1WithECDSA,
1612         ALG_sha256WithECDSA,
1613         ALG_sha384WithECDSA,
1614         ALG_sha512WithECDSA,
1615
1616         ALG_md5,
1617         ALG_sha1,
1618         ALG_sha256,
1619         ALG_sha384,
1620         ALG_sha512,
1621         ALG_sha224,
1622
1623         NUMALGS
1624 };
1625
1626 typedef struct Ints15 {
1627         int             len;
1628         int             data[15];
1629 } Ints15;
1630
1631 typedef struct DigestAlg {
1632         int             alg;
1633         DigestState*    (*fun)(uchar*,ulong,uchar*,DigestState*);
1634         int             len;
1635 } DigestAlg;
1636
1637 static DigestAlg alg_md5 = { ALG_md5, md5, MD5dlen};
1638 static DigestAlg alg_sha1 = { ALG_sha1, sha1, SHA1dlen };
1639 static DigestAlg alg_sha256 = { ALG_sha256, sha2_256, SHA2_256dlen };
1640 static DigestAlg alg_sha384 = { ALG_sha384, sha2_384, SHA2_384dlen };
1641 static DigestAlg alg_sha512 = { ALG_sha512, sha2_512, SHA2_512dlen };
1642 static DigestAlg alg_sha224 = { ALG_sha224, sha2_224, SHA2_224dlen };
1643
1644 /* maximum length of digest output of the digest algs above */
1645 enum {
1646         MAXdlen = SHA2_512dlen,
1647 };
1648
1649 static Ints15 oid_rsaEncryption = {7, 1, 2, 840, 113549, 1, 1, 1 };
1650
1651 static Ints15 oid_md2WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 2 };
1652 static Ints15 oid_md4WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 3 };
1653 static Ints15 oid_md5WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 4 };
1654 static Ints15 oid_sha1WithRSAEncryption ={7, 1, 2, 840, 113549, 1, 1, 5 };
1655 static Ints15 oid_sha1WithRSAEncryptionOiw ={6, 1, 3, 14, 3, 2, 29 };
1656 static Ints15 oid_sha256WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 11 };
1657 static Ints15 oid_sha384WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 12 };
1658 static Ints15 oid_sha512WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 13 };
1659 static Ints15 oid_sha224WithRSAEncryption = {7, 1, 2, 840, 113549, 1, 1, 14 };
1660
1661 static Ints15 oid_ecPublicKey = {6, 1, 2, 840, 10045, 2, 1 };
1662 static Ints15 oid_sha1WithECDSA = {6, 1, 2, 840, 10045, 4, 1 };
1663 static Ints15 oid_sha256WithECDSA = {7, 1, 2, 840, 10045, 4, 3, 2 };
1664 static Ints15 oid_sha384WithECDSA = {7, 1, 2, 840, 10045, 4, 3, 3 };
1665 static Ints15 oid_sha512WithECDSA = {7, 1, 2, 840, 10045, 4, 3, 4 };
1666
1667 static Ints15 oid_md5 = {6, 1, 2, 840, 113549, 2, 5 };
1668 static Ints15 oid_sha1 = {6, 1, 3, 14, 3, 2, 26 };
1669 static Ints15 oid_sha256= {9, 2, 16, 840, 1, 101, 3, 4, 2, 1 };
1670 static Ints15 oid_sha384= {9, 2, 16, 840, 1, 101, 3, 4, 2, 2 };
1671 static Ints15 oid_sha512= {9, 2, 16, 840, 1, 101, 3, 4, 2, 3 };
1672 static Ints15 oid_sha224= {9, 2, 16, 840, 1, 101, 3, 4, 2, 4 };
1673
1674 static Ints *alg_oid_tab[NUMALGS+1] = {
1675         (Ints*)&oid_rsaEncryption,
1676         (Ints*)&oid_md2WithRSAEncryption,
1677         (Ints*)&oid_md4WithRSAEncryption,
1678         (Ints*)&oid_md5WithRSAEncryption,
1679
1680         (Ints*)&oid_sha1WithRSAEncryption,
1681         (Ints*)&oid_sha1WithRSAEncryptionOiw,
1682
1683         (Ints*)&oid_sha256WithRSAEncryption,
1684         (Ints*)&oid_sha384WithRSAEncryption,
1685         (Ints*)&oid_sha512WithRSAEncryption,
1686         (Ints*)&oid_sha224WithRSAEncryption,
1687
1688         (Ints*)&oid_ecPublicKey,
1689         (Ints*)&oid_sha1WithECDSA,
1690         (Ints*)&oid_sha256WithECDSA,
1691         (Ints*)&oid_sha384WithECDSA,
1692         (Ints*)&oid_sha512WithECDSA,
1693
1694         (Ints*)&oid_md5,
1695         (Ints*)&oid_sha1,
1696         (Ints*)&oid_sha256,
1697         (Ints*)&oid_sha384,
1698         (Ints*)&oid_sha512,
1699         (Ints*)&oid_sha224,
1700         nil
1701 };
1702
1703 static DigestAlg *digestalg[NUMALGS+1] = {
1704         &alg_md5, &alg_md5, &alg_md5, &alg_md5,
1705         &alg_sha1, &alg_sha1,
1706         &alg_sha256, &alg_sha384, &alg_sha512, &alg_sha224,
1707         &alg_sha256, &alg_sha1, &alg_sha256, &alg_sha384, &alg_sha512,
1708         &alg_md5, &alg_sha1, &alg_sha256, &alg_sha384, &alg_sha512, &alg_sha224,
1709         nil
1710 };
1711
1712 static Bytes* encode_digest(DigestAlg *da, uchar *digest);
1713
1714 static Ints15 oid_secp256r1 = {7, 1, 2, 840, 10045, 3, 1, 7};
1715 static Ints15 oid_secp384r1 = {5, 1, 3, 132, 0, 34};
1716
1717 static Ints *namedcurves_oid_tab[] = {
1718         (Ints*)&oid_secp256r1,
1719         (Ints*)&oid_secp384r1,
1720         nil,
1721 };
1722 static void (*namedcurves[])(mpint *p, mpint *a, mpint *b, mpint *x, mpint *y, mpint *n, mpint *h) = {
1723         secp256r1,
1724         secp384r1,
1725         nil,
1726 };
1727
1728 static void appendaltnames(char *name, int nname, Bytes *ext, int req);
1729
1730 static void
1731 freecert(CertX509* c)
1732 {
1733         if(c == nil)
1734                 return;
1735         free(c->issuer);
1736         free(c->validity_start);
1737         free(c->validity_end);
1738         free(c->subject);
1739         freebits(c->publickey);
1740         freebits(c->signature);
1741         freebytes(c->ext);
1742         free(c);
1743 }
1744
1745 /*
1746  * Parse the Name ASN1 type.
1747  * The sequence of RelativeDistinguishedName's gives a sort of pathname,
1748  * from most general to most specific.  Each element of the path can be
1749  * one or more (but usually just one) attribute-value pair, such as
1750  * countryName="US".
1751  * We'll just form a "postal-style" address string by concatenating the elements
1752  * from most specific to least specific, separated by commas.
1753  * Return name-as-string (which must be freed by caller).
1754  */
1755 static char*
1756 parse_name(Elem* e)
1757 {
1758         Elist* el;
1759         Elem* es;
1760         Elist* esetl;
1761         Elem* eat;
1762         Elist* eatl;
1763         char* s;
1764         enum { MAXPARTS = 100 };
1765         char* parts[MAXPARTS];
1766         int i;
1767         int plen;
1768         char* ans = nil;
1769
1770         if(!is_seq(e, &el))
1771                 goto errret;
1772         i = 0;
1773         plen = 0;
1774         while(el != nil) {
1775                 es = &el->hd;
1776                 if(!is_set(es, &esetl))
1777                         goto errret;
1778                 while(esetl != nil) {
1779                         eat = &esetl->hd;
1780                         if(!is_seq(eat, &eatl) || elistlen(eatl) != 2)
1781                                 goto errret;
1782                         if(!is_string(&eatl->tl->hd, &s) || i>=MAXPARTS)
1783                                 goto errret;
1784                         parts[i++] = s;
1785                         plen += strlen(s) + 2;          /* room for ", " after */
1786                         esetl = esetl->tl;
1787                 }
1788                 el = el->tl;
1789         }
1790         if(i > 0) {
1791                 ans = (char*)emalloc(plen);
1792                 *ans = '\0';
1793                 while(--i >= 0) {
1794                         s = parts[i];
1795                         strcat(ans, s);
1796                         if(i > 0)
1797                                 strcat(ans, ", ");
1798                 }
1799         }
1800
1801 errret:
1802         return ans;
1803 }
1804
1805 /*
1806  * Parse an AlgorithmIdentifer ASN1 type.
1807  * Look up the oid in oid_tab and return one of OID_rsaEncryption, etc..,
1808  * or -1 if not found.
1809  * For now, ignore parameters, since none of our algorithms need them.
1810  */
1811 static int
1812 parse_alg(Elem* e)
1813 {
1814         Elist* el;
1815         Ints* oid;
1816
1817         if(!is_seq(e, &el) || el == nil || !is_oid(&el->hd, &oid))
1818                 return -1;
1819         return oid_lookup(oid, alg_oid_tab);
1820 }
1821
1822 static int
1823 parse_curve(Elem* e)
1824 {
1825         Elist* el;
1826         Ints* oid;
1827
1828         if(!is_seq(e, &el) || elistlen(el)<2 || !is_oid(&el->tl->hd, &oid))
1829                 return -1;
1830         return oid_lookup(oid, namedcurves_oid_tab);
1831 }
1832
1833 static CertX509*
1834 decode_cert(uchar *buf, int len)
1835 {
1836         int ok = 0;
1837         int n;
1838         Elem  ecert;
1839         Elem* ecertinfo;
1840         Elem* esigalg;
1841         Elem* esig;
1842         Elem* eserial;
1843         Elem* eissuer;
1844         Elem* evalidity;
1845         Elem* esubj;
1846         Elem* epubkey;
1847         Elist* el;
1848         Elist* elcert = nil;
1849         Elist* elcertinfo = nil;
1850         Elist* elvalidity = nil;
1851         Elist* elpubkey = nil;
1852         Bits* bits = nil;
1853         Bytes* b;
1854         Elem* e;
1855         CertX509* c = nil;
1856
1857         if(decode(buf, len, &ecert) != ASN_OK)
1858                 goto errret;
1859
1860         c = (CertX509*)emalloc(sizeof(CertX509));
1861         c->serial = -1;
1862         c->issuer = nil;
1863         c->validity_start = nil;
1864         c->validity_end = nil;
1865         c->subject = nil;
1866         c->publickey_alg = -1;
1867         c->publickey = nil;
1868         c->signature_alg = -1;
1869         c->signature = nil;
1870         c->ext = nil;
1871
1872         /* Certificate */
1873         if(!is_seq(&ecert, &elcert) || elistlen(elcert) !=3)
1874                 goto errret;
1875         ecertinfo = &elcert->hd;
1876         el = elcert->tl;
1877         esigalg = &el->hd;
1878         c->signature_alg = parse_alg(esigalg);
1879         el = el->tl;
1880         esig = &el->hd;
1881
1882         /* Certificate Info */
1883         if(!is_seq(ecertinfo, &elcertinfo))
1884                 goto errret;
1885         n = elistlen(elcertinfo);
1886         if(n < 6)
1887                 goto errret;
1888         eserial =&elcertinfo->hd;
1889         el = elcertinfo->tl;
1890         /* check for optional version, marked by explicit context tag 0 */
1891         if(eserial->tag.class == Context && eserial->tag.num == 0) {
1892                 eserial = &el->hd;
1893                 if(n < 7)
1894                         goto errret;
1895                 el = el->tl;
1896         }
1897
1898         if(parse_alg(&el->hd) != c->signature_alg)
1899                 goto errret;
1900         el = el->tl;
1901         eissuer = &el->hd;
1902         el = el->tl;
1903         evalidity = &el->hd;
1904         el = el->tl;
1905         esubj = &el->hd;
1906         el = el->tl;
1907         epubkey = &el->hd;
1908         if(el->tl != nil
1909         && el->tl->hd.tag.class == Context
1910         && el->tl->hd.tag.num == 3
1911         && el->tl->hd.val.tag == VOctets){
1912                 c->ext = el->tl->hd.val.u.octetsval;
1913                 el->tl->hd.val.u.octetsval = nil;       /* transfer ownership */
1914         }
1915         if(!is_int(eserial, &c->serial)) {
1916                 if(!is_bigint(eserial, &b))
1917                         goto errret;
1918                 c->serial = -1; /* else we have to change cert struct */
1919         }
1920         c->issuer = parse_name(eissuer);
1921         if(c->issuer == nil)
1922                 goto errret;
1923         /* Validity */
1924         if(!is_seq(evalidity, &elvalidity))
1925                 goto errret;
1926         if(elistlen(elvalidity) != 2)
1927                 goto errret;
1928         e = &elvalidity->hd;
1929         if(!is_time(e, &c->validity_start))
1930                 goto errret;
1931         e->val.u.stringval = nil;       /* string ownership transfer */
1932         e = &elvalidity->tl->hd;
1933         if(!is_time(e, &c->validity_end))
1934                 goto errret;
1935         e->val.u.stringval = nil;       /* string ownership transfer */
1936
1937         /* resume CertificateInfo */
1938         c->subject = parse_name(esubj);
1939         if(c->subject == nil)
1940                 goto errret;
1941
1942         /* SubjectPublicKeyInfo */
1943         if(!is_seq(epubkey, &elpubkey))
1944                 goto errret;
1945         if(elistlen(elpubkey) != 2)
1946                 goto errret;
1947
1948         c->publickey_alg = parse_alg(&elpubkey->hd);
1949         if(c->publickey_alg < 0)
1950                 goto errret;
1951         c->curve = -1;
1952         if(c->publickey_alg == ALG_ecPublicKey){
1953                 c->curve = parse_curve(&elpubkey->hd);
1954                 if(c->curve < 0)
1955                         goto errret;
1956         }
1957         elpubkey = elpubkey->tl;
1958         if(!is_bitstring(&elpubkey->hd, &bits))
1959                 goto errret;
1960         elpubkey->hd.val.u.bitstringval = nil;  /* transfer ownership */
1961         c->publickey = bits;
1962
1963         /*resume Certificate */
1964         if(c->signature_alg < 0)
1965                 goto errret;
1966         if(!is_bitstring(esig, &bits))
1967                 goto errret;
1968         esig->val.u.bitstringval = nil; /* transfer ownership */
1969         c->signature = bits;
1970         ok = 1;
1971
1972 errret:
1973         freevalfields(&ecert.val);      /* recurses through lists, too */
1974         if(!ok){
1975                 freecert(c);
1976                 c = nil;
1977         }
1978         return c;
1979 }
1980
1981 /*
1982  *      RSAPublickKey ::= SEQUENCE {
1983  *              modulus INTEGER,
1984  *              publicExponent INTEGER
1985  *      }
1986  */
1987 RSApub*
1988 asn1toRSApub(uchar *buf, int len)
1989 {
1990         Elem e;
1991         Elist *el;
1992         RSApub* key;
1993
1994         key = nil;
1995         if(decode(buf, len, &e) != ASN_OK)
1996                 goto errret;
1997         if(!is_seq(&e, &el) || elistlen(el) != 2)
1998                 goto errret;
1999
2000         key = rsapuballoc();
2001         if((key->n = asn1mpint(&el->hd)) == nil)
2002                 goto errret;
2003         el = el->tl;
2004         if((key->ek = asn1mpint(&el->hd)) == nil)
2005                 goto errret;
2006
2007         freevalfields(&e.val);
2008         return key;
2009 errret:
2010         freevalfields(&e.val);
2011         rsapubfree(key);
2012         return nil;
2013
2014 }
2015
2016 /*
2017  *      RSAPrivateKey ::= SEQUENCE {
2018  *              version Version,
2019  *              modulus INTEGER, -- n
2020  *              publicExponent INTEGER, -- e
2021  *              privateExponent INTEGER, -- d
2022  *              prime1 INTEGER, -- p
2023  *              prime2 INTEGER, -- q
2024  *              exponent1 INTEGER, -- d mod (p-1)
2025  *              exponent2 INTEGER, -- d mod (q-1)
2026  *              coefficient INTEGER -- (inverse of q) mod p }
2027  */
2028 RSApriv*
2029 asn1toRSApriv(uchar *buf, int len)
2030 {
2031         int version;
2032         Elem e;
2033         Elist *el;
2034         Bytes *b;
2035         RSApriv* key = nil;
2036
2037         if(decode(buf, len, &e) != ASN_OK)
2038                 goto errret;
2039         if(!is_seq(&e, &el))
2040                 goto errret;
2041
2042         if(!is_int(&el->hd, &version) || version != 0)
2043                 goto errret;
2044
2045         if(elistlen(el) != 9){
2046                 if(elistlen(el) == 3
2047                 && parse_alg(&el->tl->hd) == ALG_rsaEncryption
2048                 && is_octetstring(&el->tl->tl->hd, &b)){
2049                         key = asn1toRSApriv(b->data, b->len);
2050                         if(key != nil)
2051                                 goto done;
2052                 }
2053                 goto errret;
2054         }
2055
2056         key = rsaprivalloc();
2057         el = el->tl;
2058         if((key->pub.n = asn1mpint(&el->hd)) == nil)
2059                 goto errret;
2060
2061         el = el->tl;
2062         if((key->pub.ek = asn1mpint(&el->hd)) == nil)
2063                 goto errret;
2064
2065         el = el->tl;
2066         if((key->dk = asn1mpint(&el->hd)) == nil)
2067                 goto errret;
2068
2069         el = el->tl;
2070         if((key->q = asn1mpint(&el->hd)) == nil)
2071                 goto errret;
2072
2073         el = el->tl;
2074         if((key->p = asn1mpint(&el->hd)) == nil)
2075                 goto errret;
2076
2077         el = el->tl;
2078         if((key->kq = asn1mpint(&el->hd)) == nil)
2079                 goto errret;
2080
2081         el = el->tl;
2082         if((key->kp = asn1mpint(&el->hd)) == nil)
2083                 goto errret;
2084
2085         el = el->tl;
2086         if((key->c2 = asn1mpint(&el->hd)) == nil)
2087                 goto errret;
2088
2089 done:
2090         freevalfields(&e.val);
2091         return key;
2092 errret:
2093         freevalfields(&e.val);
2094         rsaprivfree(key);
2095         return nil;
2096 }
2097
2098 /*
2099  * digest(CertificateInfo)
2100  * Our ASN.1 library doesn't return pointers into the original
2101  * data array, so we need to do a little hand decoding.
2102  */
2103 static int
2104 digest_certinfo(uchar *cert, int ncert, DigestAlg *da, uchar *digest)
2105 {
2106         uchar *info, *p, *pend;
2107         int isconstr, length;
2108         Tag tag;
2109         Elem elem;
2110
2111         p = cert;
2112         pend = cert + ncert;
2113         if(tag_decode(&p, pend, &tag, &isconstr) != ASN_OK ||
2114            tag.class != Universal || tag.num != SEQUENCE ||
2115            length_decode(&p, pend, &length) != ASN_OK ||
2116            p+length > pend ||
2117            p+length < p)
2118                 return -1;
2119         info = p;
2120         if(ber_decode(&p, pend, &elem) != ASN_OK)
2121                 return -1;
2122         freevalfields(&elem.val);
2123         if(elem.tag.num != SEQUENCE)
2124                 return -1;
2125         (*da->fun)(info, p - info, digest, nil);
2126         return da->len;
2127 }
2128
2129 mpint*
2130 pkcs1padbuf(uchar *buf, int len, mpint *modulus, int blocktype)
2131 {
2132         int i, n = (mpsignif(modulus)-1)/8;
2133         int pad = n - 2 - len;
2134         uchar *p;
2135         mpint *mp;
2136
2137         if(pad < 8){
2138                 werrstr("rsa modulus too small");
2139                 return nil;
2140         }
2141         if((p = malloc(n)) == nil)
2142                 return nil;
2143         p[0] = blocktype;
2144         switch(blocktype){
2145         default:
2146         case 1:
2147                 memset(p+1, 0xFF, pad);
2148                 break;
2149         case 2:
2150                 for(i=1; i <= pad; i++)
2151                         p[i] = 1 + nfastrand(255);
2152                 break;
2153         }
2154         p[1+pad] = 0;
2155         memmove(p+2+pad, buf, len);
2156         mp = betomp(p, n, nil);
2157         free(p);
2158         return mp;
2159 }
2160
2161 int
2162 pkcs1unpadbuf(uchar *buf, int len, mpint *modulus, int blocktype)
2163 {
2164         uchar *p = buf + 1, *e = buf + len;
2165
2166         if(len < 1 || len != (mpsignif(modulus)-1)/8 || buf[0] != blocktype)
2167                 return -1;
2168         switch(blocktype){
2169         default:
2170         case 1:
2171                 while(p < e && *p == 0xFF)
2172                         p++;
2173                 break;
2174         case 2:
2175                 while(p < e && *p != 0x00)
2176                         p++;
2177                 break;
2178         }
2179         if(p - buf <= 8 || p >= e || *p++ != 0x00)
2180                 return -1;
2181         memmove(buf, p, len = e - p);
2182         return len;
2183 }
2184
2185 static char Ebadsig[] = "bad signature";
2186
2187 char*
2188 X509rsaverifydigest(uchar *sig, int siglen, uchar *edigest, int edigestlen, RSApub *pk)
2189 {
2190         mpint *x, *y;
2191         DigestAlg **dp;
2192         Bytes *digest;
2193         uchar *buf;
2194         int len;
2195         char *err;
2196
2197         x = betomp(sig, siglen, nil);
2198         y = rsaencrypt(pk, x, nil);
2199         mpfree(x);
2200         len = mptobe(y, nil, 0, &buf);
2201         mpfree(y);
2202
2203         err = Ebadsig;
2204         len = pkcs1unpadbuf(buf, len, pk->n, 1);
2205         if(len == edigestlen && tsmemcmp(buf, edigest, edigestlen) == 0)
2206                 err = nil;
2207         for(dp = digestalg; err != nil && *dp != nil; dp++){
2208                 if((*dp)->len != edigestlen)
2209                         continue;
2210                 digest = encode_digest(*dp, edigest);
2211                 if(digest->len == len && tsmemcmp(digest->data, buf, len) == 0)
2212                         err = nil;
2213                 freebytes(digest);
2214         }
2215         free(buf);
2216         return err;
2217 }
2218
2219 char*
2220 X509ecdsaverifydigest(uchar *sig, int siglen, uchar *edigest, int edigestlen, ECdomain *dom, ECpub *pub)
2221 {
2222         Elem e;
2223         Elist *el;
2224         mpint *r, *s;
2225         char *err;
2226
2227         r = s = nil;
2228         err = Ebadsig;
2229         if(decode(sig, siglen, &e) != ASN_OK)
2230                 goto end;
2231         if(!is_seq(&e, &el) || elistlen(el) != 2)
2232                 goto end;
2233         r = asn1mpint(&el->hd);
2234         if(r == nil)
2235                 goto end;
2236         el = el->tl;
2237         s = asn1mpint(&el->hd);
2238         if(s == nil)
2239                 goto end;
2240         if(ecdsaverify(dom, pub, edigest, edigestlen, r, s))
2241                 err = nil;
2242 end:
2243         freevalfields(&e.val);
2244         mpfree(s);
2245         mpfree(r);
2246         return err;
2247 }
2248
2249 static void
2250 copysubject(char *name, int nname, char *subject)
2251 {
2252         char *e;
2253
2254         if(name == nil)
2255                 return;
2256         memset(name, 0, nname);
2257         if(subject == nil)
2258                 return;
2259         strncpy(name, subject, nname-1);
2260         e = strchr(name, ',');
2261         if(e != nil)
2262                 *e = 0; /* take just CN part of Distinguished Name */
2263 }
2264
2265 ECpub*
2266 X509toECpub(uchar *cert, int ncert, char *name, int nname, ECdomain *dom)
2267 {
2268         CertX509 *c;
2269         ECpub *pub;
2270
2271         c = decode_cert(cert, ncert);
2272         if(c == nil)
2273                 return nil;
2274         copysubject(name, nname, c->subject);
2275         appendaltnames(name, nname, c->ext, 0);
2276         pub = nil;
2277         if(c->publickey_alg == ALG_ecPublicKey){
2278                 ecdominit(dom, namedcurves[c->curve]);
2279                 pub = ecdecodepub(dom, c->publickey->data, c->publickey->len);
2280                 if(pub == nil)
2281                         ecdomfree(dom);
2282         }
2283         freecert(c);
2284         return pub;
2285 }
2286
2287 char*
2288 X509ecdsaverify(uchar *cert, int ncert, ECdomain *dom, ECpub *pk)
2289 {
2290         char *e;
2291         CertX509 *c;
2292         int digestlen;
2293         uchar digest[MAXdlen];
2294
2295         c = decode_cert(cert, ncert);
2296         if(c == nil)
2297                 return "cannot decode cert";
2298         digestlen = digest_certinfo(cert, ncert, digestalg[c->signature_alg], digest);
2299         if(digestlen <= 0){
2300                 freecert(c);
2301                 return "cannot decode certinfo";
2302         }
2303         e = X509ecdsaverifydigest(c->signature->data, c->signature->len, digest, digestlen, dom, pk);
2304         freecert(c);
2305         return e;
2306 }
2307
2308 RSApub*
2309 X509toRSApub(uchar *cert, int ncert, char *name, int nname)
2310 {
2311         CertX509 *c;
2312         RSApub *pub;
2313
2314         c = decode_cert(cert, ncert);
2315         if(c == nil)
2316                 return nil;
2317         copysubject(name, nname, c->subject);
2318         appendaltnames(name, nname, c->ext, 0);
2319         pub = nil;
2320         if(c->publickey_alg == ALG_rsaEncryption)
2321                 pub = asn1toRSApub(c->publickey->data, c->publickey->len);
2322         freecert(c);
2323         return pub;
2324 }
2325
2326 char*
2327 X509rsaverify(uchar *cert, int ncert, RSApub *pk)
2328 {
2329         char *e;
2330         CertX509 *c;
2331         int digestlen;
2332         uchar digest[MAXdlen];
2333
2334         c = decode_cert(cert, ncert);
2335         if(c == nil)
2336                 return "cannot decode cert";
2337         digestlen = digest_certinfo(cert, ncert, digestalg[c->signature_alg], digest);
2338         if(digestlen <= 0){
2339                 freecert(c);
2340                 return "cannot decode certinfo";
2341         }
2342         e = X509rsaverifydigest(c->signature->data, c->signature->len, digest, digestlen, pk);
2343         freecert(c);
2344         return e;
2345 }
2346
2347 /* ------- Elem constructors ---------- */
2348 static Elem
2349 Null(void)
2350 {
2351         Elem e;
2352
2353         e.tag.class = Universal;
2354         e.tag.num = NULLTAG;
2355         e.val.tag = VNull;
2356         return e;
2357 }
2358
2359 static Elem
2360 mkint(int j)
2361 {
2362         Elem e;
2363
2364         e.tag.class = Universal;
2365         e.tag.num = INTEGER;
2366         e.val.tag = VInt;
2367         e.val.u.intval = j;
2368         return e;
2369 }
2370
2371 static Elem
2372 mkbigint(mpint *p)
2373 {
2374         Elem e;
2375
2376         e.tag.class = Universal;
2377         e.tag.num = INTEGER;
2378         e.val.tag = VBigInt;
2379         e.val.u.bigintval = newbytes((mpsignif(p)+8)/8);
2380         if(p->sign < 0){
2381                 mpint *s = mpnew(e.val.u.bigintval->len*8+1);
2382                 mpleft(mpone, e.val.u.bigintval->len*8, s);
2383                 mpadd(p, s, s);
2384                 mptober(s, e.val.u.bigintval->data, e.val.u.bigintval->len);
2385                 mpfree(s);
2386         } else {
2387                 mptober(p, e.val.u.bigintval->data, e.val.u.bigintval->len);
2388         }
2389         return e;
2390 }
2391
2392 static int
2393 printable(char *s)
2394 {
2395         int c;
2396
2397         while((c = (uchar)*s++) != 0){
2398                 if((c >= 'a' && c <= 'z')
2399                 || (c >= 'A' && c <= 'Z')
2400                 || (c >= '0' && c <= '9')
2401                 || strchr("'=()+,-./:? ", c) != nil)
2402                         continue;
2403                 return 0;
2404         }
2405         return 1;
2406 }
2407
2408 #define DirectoryString 0
2409
2410 static Elem
2411 mkstring(char *s, int t)
2412 {
2413         Elem e;
2414
2415         if(t == DirectoryString)
2416                 t = printable(s) ? PrintableString : UTF8String;
2417         e.tag.class = Universal;
2418         e.tag.num = t;
2419         e.val.tag = VString;
2420         e.val.u.stringval = estrdup(s);
2421         return e;
2422 }
2423
2424 static Elem
2425 mkoctet(uchar *buf, int buflen)
2426 {
2427         Elem e;
2428
2429         e.tag.class = Universal;
2430         e.tag.num = OCTET_STRING;
2431         e.val.tag = VOctets;
2432         e.val.u.octetsval = makebytes(buf, buflen);
2433         return e;
2434 }
2435
2436 static Elem
2437 mkbits(uchar *buf, int buflen)
2438 {
2439         Elem e;
2440
2441         e.tag.class = Universal;
2442         e.tag.num = BIT_STRING;
2443         e.val.tag = VBitString;
2444         e.val.u.bitstringval = makebits(buf, buflen, 0);
2445         return e;
2446 }
2447
2448 static Elem
2449 mkutc(long t)
2450 {
2451         Elem e;
2452         char utc[50];
2453         Tm *tm = gmtime(t);
2454
2455         e.tag.class = Universal;
2456         e.tag.num = UTCTime;
2457         e.val.tag = VString;
2458         snprint(utc, sizeof(utc), "%.2d%.2d%.2d%.2d%.2d%.2dZ",
2459                 tm->year % 100, tm->mon+1, tm->mday, tm->hour, tm->min, tm->sec);
2460         e.val.u.stringval = estrdup(utc);
2461         return e;
2462 }
2463
2464 static Elem
2465 mkoid(Ints *oid)
2466 {
2467         Elem e;
2468
2469         e.tag.class = Universal;
2470         e.tag.num = OBJECT_ID;
2471         e.val.tag = VObjId;
2472         e.val.u.objidval = makeints(oid->data, oid->len);
2473         return e;
2474 }
2475
2476 static Elem
2477 mkseq(Elist *el)
2478 {
2479         Elem e;
2480
2481         e.tag.class = Universal;
2482         e.tag.num = SEQUENCE;
2483         e.val.tag = VSeq;
2484         e.val.u.seqval = el;
2485         return e;
2486 }
2487
2488 static Elem
2489 mkset(Elist *el)
2490 {
2491         Elem e;
2492
2493         e.tag.class = Universal;
2494         e.tag.num = SETOF;
2495         e.val.tag = VSet;
2496         e.val.u.setval = el;
2497         return e;
2498 }
2499
2500 static Elem
2501 mkalg(int alg)
2502 {
2503         return mkseq(mkel(mkoid(alg_oid_tab[alg]), mkel(Null(), nil)));
2504 }
2505
2506 typedef struct Ints7pref {
2507         int     len;
2508         int     data[7];
2509         char    prefix[4];
2510         int     stype;
2511 } Ints7pref;
2512 Ints7pref DN_oid[] = {
2513         {4, 2, 5, 4, 6, 0, 0, 0,        "C=", PrintableString},
2514         {4, 2, 5, 4, 8, 0, 0, 0,        "ST=",DirectoryString},
2515         {4, 2, 5, 4, 7, 0, 0, 0,        "L=", DirectoryString},
2516         {4, 2, 5, 4, 10, 0, 0, 0,       "O=", DirectoryString},
2517         {4, 2, 5, 4, 11, 0, 0, 0,       "OU=",DirectoryString},
2518         {4, 2, 5, 4, 3, 0, 0, 0,        "CN=",DirectoryString},
2519         {7, 1,2,840,113549,1,9,1,       "E=", IA5String},
2520         {7, 0,9,2342,19200300,100,1,25, "DC=",IA5String},
2521 };
2522
2523 static Elem
2524 mkname(Ints7pref *oid, char *subj)
2525 {
2526         return mkset(mkel(mkseq(mkel(mkoid((Ints*)oid), mkel(mkstring(subj, oid->stype), nil))), nil));
2527 }
2528
2529 static Elem
2530 mkDN(char *dn)
2531 {
2532         int i, j, nf;
2533         char *f[20], *prefix, *d2 = estrdup(dn);
2534         Elist* el = nil;
2535
2536         nf = tokenize(d2, f, nelem(f));
2537         for(i=nf-1; i>=0; i--){
2538                 for(j=0; j<nelem(DN_oid); j++){
2539                         prefix = DN_oid[j].prefix;
2540                         if(strncmp(f[i],prefix,strlen(prefix))==0){
2541                                 el = mkel(mkname(&DN_oid[j],f[i]+strlen(prefix)), el);
2542                                 break;
2543                         }
2544                 }
2545         }
2546         free(d2);
2547         return mkseq(el);
2548 }
2549
2550 /*
2551  * DigestInfo ::= SEQUENCE {
2552  *      digestAlgorithm AlgorithmIdentifier,
2553  *      digest OCTET STRING }
2554  */
2555 static Bytes*
2556 encode_digest(DigestAlg *da, uchar *digest)
2557 {
2558         Bytes *b = nil;
2559         Elem e = mkseq(
2560                 mkel(mkalg(da->alg),
2561                 mkel(mkoctet(digest, da->len),
2562                 nil)));
2563         encode(e, &b);
2564         freevalfields(&e.val);
2565         return b;
2566 }
2567
2568 int
2569 asn1encodedigest(DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest, uchar *buf, int len)
2570 {
2571         Bytes *bytes;
2572         DigestAlg **dp;
2573
2574         for(dp = digestalg; *dp != nil; dp++){
2575                 if((*dp)->fun != fun)
2576                         continue;
2577                 bytes = encode_digest(*dp, digest);
2578                 if(bytes == nil)
2579                         break;
2580                 if(bytes->len > len){
2581                         freebytes(bytes);
2582                         break;
2583                 }
2584                 len = bytes->len;
2585                 memmove(buf, bytes->data, len);
2586                 freebytes(bytes);
2587                 return len;
2588         }
2589         return -1;
2590 }
2591
2592 static Elem
2593 mkcont(int num, Elist *l)
2594 {
2595         Elem e = mkseq(l);
2596         e.tag.class = Context;
2597         e.tag.num = num;
2598         return e;
2599 }
2600
2601 static Elem
2602 mkaltname(char *s)
2603 {
2604         Elem e;
2605         int i;
2606
2607         for(i=0; i<nelem(DN_oid); i++){
2608                 if(strstr(s, DN_oid[i].prefix) != nil)
2609                         return mkcont(4, mkel(mkDN(s), nil)); /* DN */
2610         }
2611         e = mkstring(s, IA5String);
2612         e.tag.class = Context;
2613         e.tag.num = strchr(s, '@') != nil ? 1 : 2; /* email : DNS */
2614         return e;
2615 }
2616
2617 static Elist*
2618 mkaltnames(char *alts)
2619 {
2620         Elist *el;
2621         char *s, *p;
2622
2623         if(alts == nil)
2624                 return nil;
2625
2626         el = nil;
2627         alts = estrdup(alts);
2628         for(s = alts; s != nil; s = p){
2629                 while(*s == ' ')
2630                         s++;
2631                 if(*s == '\0')
2632                         break;
2633                 if((p = strchr(s, ',')) != nil)
2634                         *p++ = 0;
2635                 el = mkel(mkaltname(s), el);
2636         }
2637         free(alts);
2638         return el;
2639 }
2640
2641 static Elist*
2642 mkextel(Elem e, Ints *oid, Elist *el)
2643 {
2644         Bytes *b = nil;
2645
2646         if(encode(e, &b) == ASN_OK){
2647                 el = mkel(mkseq(
2648                         mkel(mkoid(oid),
2649                         mkel(mkoctet(b->data, b->len),
2650                         nil))), el);
2651                 freebytes(b);
2652         }
2653         freevalfields(&e.val);
2654         return el;
2655 }
2656
2657 static Ints15 oid_subjectAltName = {4, 2, 5, 29, 17 };
2658 static Ints15 oid_extensionRequest = { 7, 1, 2, 840, 113549, 1, 9, 14};
2659
2660 static Elist*
2661 mkextensions(char *alts, int isreq)
2662 {
2663         Elist *sl, *xl;
2664
2665         xl = nil;
2666         if((sl = mkaltnames(alts)) != nil)
2667                 xl = mkextel(mkseq(sl), (Ints*)&oid_subjectAltName, xl);
2668         if(xl != nil){
2669                 xl = mkel(mkseq(xl), nil);
2670                 if(isreq)
2671                         xl = mkel(mkseq(
2672                                 mkel(mkoid((Ints*)&oid_extensionRequest),
2673                                 mkel(mkset(xl), nil))), nil);
2674         }
2675         if(isreq)
2676                 xl = mkel(mkcont(0, xl), nil);
2677         else if(xl != nil)
2678                 xl = mkel(mkcont(3, xl), nil);
2679         return xl;
2680 }
2681
2682 static char*
2683 splitalts(char *s)
2684 {
2685         int q;
2686
2687         for(q = 0; *s != '\0'; s++){
2688                 if(*s == '\'')
2689                         q ^= 1;
2690                 else if(q == 0 && *s == ','){
2691                         *s++ = 0;
2692                         return s;
2693                 }
2694         }
2695         return nil;
2696 }
2697
2698 static void
2699 appendaltnames(char *name, int nname, Bytes *ext, int isreq)
2700 {
2701         Elem eext, ealt, edn;
2702         Elist *el, *l;
2703         Ints *oid;
2704         char *alt, *e;
2705         int len;
2706
2707         if(name == nil || ext == nil)
2708                 return;
2709         if(decode(ext->data, ext->len, &eext) != ASN_OK)
2710                 return;
2711         if(isreq){
2712                 if(!is_seq(&eext, &el) || elistlen(el) != 2)
2713                         goto errext;
2714                 if(!is_oid(&el->hd, &oid) || !ints_eq(oid, (Ints*)&oid_extensionRequest))
2715                         goto errext;
2716                 el = el->tl;
2717                 if(!is_set(&el->hd, &el))
2718                         goto errext;
2719                 if(!is_seq(&el->hd, &el))
2720                         goto errext;
2721         } else {
2722                 if(!is_seq(&eext, &el))
2723                         goto errext;
2724         }
2725         for(; el != nil; el = el->tl){
2726                 if(!is_seq(&el->hd, &l) || elistlen(l) != 2)
2727                         goto errext;
2728                 if(!is_oid(&l->hd, &oid) || !ints_eq(oid, (Ints*)&oid_subjectAltName))
2729                         continue;
2730                 el = l->tl;
2731                 break;
2732         }
2733         if(el == nil)
2734                 goto errext;
2735         if(!is_octetstring(&el->hd, &ext))
2736                 goto errext;
2737         if(decode(ext->data, ext->len, &ealt) != ASN_OK)
2738                 goto errext;
2739         if(!is_seq(&ealt, &el))
2740                 goto erralt;
2741         for(; el != nil; el = el->tl){
2742                 ext = el->hd.val.u.octetsval;
2743                 switch(el->hd.tag.num){
2744                 default:
2745                         continue;
2746                 case 1: /* email */
2747                 case 2: /* DNS */
2748                         if(el->hd.val.tag != VOctets)
2749                                 goto erralt;
2750                         alt = smprint("%.*s", ext->len, (char*)ext->data);
2751                         break;
2752                 case 4: /* DN */
2753                         if(el->hd.val.tag != VOctets
2754                         || decode(ext->data, ext->len, &edn) != ASN_OK)
2755                                 goto erralt;
2756                         alt = parse_name(&edn);
2757                         freevalfields(&edn.val);
2758                         break;
2759                 }
2760                 if(alt == nil)
2761                         goto erralt;
2762                 /* take just CN part of Distinguished Name */
2763                 if((e = strchr(alt, ',')) != nil)
2764                         *e = '\0';
2765                 len = strlen(alt);
2766                 if(strncmp(name, alt, len) == 0 && strchr(",", name[len]) != nil){
2767                         free(alt);      /* same as the subject */
2768                         continue;
2769                 }
2770                 if(name[0] != '\0')
2771                         strncat(name, ", ", nname-1);
2772                 strncat(name, alt, nname-1);
2773                 free(alt);
2774         }
2775 erralt:
2776         freevalfields(&ealt.val);
2777 errext:
2778         freevalfields(&eext.val);
2779 }
2780
2781 static Bytes*
2782 encode_rsapubkey(RSApub *pk)
2783 {
2784         Bytes *b = nil;
2785         Elem e = mkseq(
2786                 mkel(mkbigint(pk->n),
2787                 mkel(mpsignif(pk->ek)<32 ? mkint(mptoi(pk->ek)) : mkbigint(pk->ek),
2788                 nil)));
2789         encode(e, &b);
2790         freevalfields(&e.val);
2791         return b;
2792 }
2793
2794 static Bytes*
2795 encode_rsaprivkey(RSApriv *k)
2796 {
2797         Bytes *b = nil;
2798         RSApub *pk = &k->pub;
2799         Elem e = mkseq(
2800                 mkel(mkint(0),
2801                 mkel(mkbigint(pk->n),
2802                 mkel(mpsignif(pk->ek)<32 ? mkint(mptoi(pk->ek)) : mkbigint(pk->ek),
2803                 mkel(mkbigint(k->dk),
2804                 mkel(mkbigint(k->p),
2805                 mkel(mkbigint(k->q),
2806                 mkel(mkbigint(k->kp),
2807                 mkel(mkbigint(k->kq),
2808                 mkel(mkbigint(k->c2),
2809                 nil))))))))));
2810         encode(e, &b);
2811         freevalfields(&e.val);
2812         return b;
2813 }
2814
2815 int
2816 asn1encodeRSApub(RSApub *pk, uchar *buf, int len)
2817 {
2818         Bytes *b = encode_rsapubkey(pk);
2819         if(b == nil)
2820                 return -1;
2821         if(b->len > len){
2822                 freebytes(b);
2823                 werrstr("buffer too small");
2824                 return -1;
2825         }
2826         memmove(buf, b->data, len = b->len);
2827         freebytes(b);
2828         return len;
2829 }
2830
2831 int
2832 asn1encodeRSApriv(RSApriv *k, uchar *buf, int len)
2833 {
2834         Bytes *b;
2835         b = encode_rsaprivkey(k);
2836         if(b == nil)
2837                 return -1;
2838         if(b->len > len){
2839                 freebytes(b);
2840                 werrstr("buffer too small");
2841                 return -1;
2842         }
2843         memmove(buf, b->data, len = b->len);
2844         freebytes(b);
2845         return len;
2846 }
2847
2848 uchar*
2849 X509rsagen(RSApriv *priv, char *subj, ulong valid[2], int *certlen)
2850 {
2851         int serial = 0, sigalg = ALG_sha256WithRSAEncryption;
2852         uchar *cert = nil;
2853         Bytes *certbytes, *pkbytes, *certinfobytes, *sigbytes;
2854         Elem e, certinfo;
2855         DigestAlg *da;
2856         uchar digest[MAXdlen], *buf;
2857         int buflen;
2858         mpint *pkcs1;
2859         char *alts;
2860
2861         if((pkbytes = encode_rsapubkey(&priv->pub)) == nil)
2862                 return nil;
2863
2864         subj = estrdup(subj);
2865         alts = splitalts(subj);
2866
2867         e = mkseq(
2868                 mkel(mkcont(0, mkel(mkint(2), nil)),
2869                 mkel(mkint(serial),
2870                 mkel(mkalg(sigalg),
2871                 mkel(mkDN(subj),
2872                 mkel(mkseq(
2873                         mkel(mkutc(valid[0]),
2874                         mkel(mkutc(valid[1]),
2875                         nil))),
2876                 mkel(mkDN(subj),
2877                 mkel(mkseq(
2878                         mkel(mkalg(ALG_rsaEncryption),
2879                         mkel(mkbits(pkbytes->data, pkbytes->len),
2880                         nil))),
2881                 mkextensions(alts, 0)))))))));
2882         freebytes(pkbytes);
2883         if(encode(e, &certinfobytes) != ASN_OK)
2884                 goto errret;
2885
2886         da = digestalg[sigalg];
2887         (*da->fun)(certinfobytes->data, certinfobytes->len, digest, 0);
2888         freebytes(certinfobytes);
2889         certinfo = e;
2890
2891         sigbytes = encode_digest(da, digest);
2892         if(sigbytes == nil)
2893                 goto errret;
2894         pkcs1 = pkcs1padbuf(sigbytes->data, sigbytes->len, priv->pub.n, 1);
2895         freebytes(sigbytes);
2896         if(pkcs1 == nil)
2897                 goto errret;
2898
2899         rsadecrypt(priv, pkcs1, pkcs1);
2900         buflen = mptobe(pkcs1, nil, 0, &buf);
2901         mpfree(pkcs1);
2902         e = mkseq(
2903                 mkel(certinfo,
2904                 mkel(mkalg(sigalg),
2905                 mkel(mkbits(buf, buflen),
2906                 nil))));
2907         free(buf);
2908         if(encode(e, &certbytes) != ASN_OK)
2909                 goto errret;
2910         if(certlen != nil)
2911                 *certlen = certbytes->len;
2912         cert = (uchar*)certbytes;
2913         memmove(cert, certbytes->data, certbytes->len);
2914 errret:
2915         freevalfields(&e.val);
2916         free(subj);
2917         return cert;
2918 }
2919
2920 uchar*
2921 X509rsareq(RSApriv *priv, char *subj, int *certlen)
2922 {
2923         /* RFC 2314, PKCS #10 Certification Request Syntax */
2924         int version = 0, sigalg = ALG_sha256WithRSAEncryption;
2925         uchar *cert = nil;
2926         Bytes *certbytes, *pkbytes, *certinfobytes, *sigbytes;
2927         Elem e, certinfo;
2928         DigestAlg *da;
2929         uchar digest[MAXdlen], *buf;
2930         int buflen;
2931         mpint *pkcs1;
2932         char *alts;
2933
2934         if((pkbytes = encode_rsapubkey(&priv->pub)) == nil)
2935                 return nil;
2936
2937         subj = estrdup(subj);
2938         alts = splitalts(subj);
2939
2940         e = mkseq(
2941                 mkel(mkint(version),
2942                 mkel(mkDN(subj),
2943                 mkel(mkseq(
2944                         mkel(mkalg(ALG_rsaEncryption),
2945                         mkel(mkbits(pkbytes->data, pkbytes->len),
2946                         nil))),
2947                 mkextensions(alts, 1)))));
2948         freebytes(pkbytes);
2949         if(encode(e, &certinfobytes) != ASN_OK)
2950                 goto errret;
2951         da = digestalg[sigalg];
2952         (*da->fun)(certinfobytes->data, certinfobytes->len, digest, 0);
2953         freebytes(certinfobytes);
2954         certinfo = e;
2955
2956         sigbytes = encode_digest(da, digest);
2957         if(sigbytes == nil)
2958                 goto errret;
2959         pkcs1 = pkcs1padbuf(sigbytes->data, sigbytes->len, priv->pub.n, 1);
2960         freebytes(sigbytes);
2961         if(pkcs1 == nil)
2962                 goto errret;
2963
2964         rsadecrypt(priv, pkcs1, pkcs1);
2965         buflen = mptobe(pkcs1, nil, 0, &buf);
2966         mpfree(pkcs1);
2967         e = mkseq(
2968                 mkel(certinfo,
2969                 mkel(mkalg(sigalg),
2970                 mkel(mkbits(buf, buflen),
2971                 nil))));
2972         free(buf);
2973         if(encode(e, &certbytes) != ASN_OK)
2974                 goto errret;
2975         if(certlen != nil)
2976                 *certlen = certbytes->len;
2977         cert = (uchar*)certbytes;
2978         memmove(cert, certbytes->data, certbytes->len);
2979 errret:
2980         freevalfields(&e.val);
2981         free(subj);
2982         return cert;
2983 }
2984
2985 RSApub*
2986 X509reqtoRSApub(uchar *req, int nreq, char *name, int nname)
2987 {
2988         Elem ereq;
2989         Elist *el;
2990         char *subject;
2991         Bits *bits;
2992         RSApub *pub;
2993
2994         pub = nil;
2995         if(decode(req, nreq, &ereq) != ASN_OK)
2996                 goto errret;
2997         if(!is_seq(&ereq, &el) || elistlen(el) != 3)
2998                 goto errret;
2999         if(!is_seq(&el->hd, &el) || elistlen(el) < 3)
3000                 goto errret;
3001         el = el->tl;
3002         subject = parse_name(&el->hd);
3003         if(subject == nil)
3004                 goto errret;
3005         copysubject(name, nname, subject);
3006         free(subject);
3007         el = el->tl;
3008         if(el->tl != nil
3009         && el->tl->hd.tag.class == Context
3010         && el->tl->hd.tag.num == 0
3011         && el->tl->hd.val.tag == VOctets)
3012                 appendaltnames(name, nname, el->tl->hd.val.u.octetsval, 1);
3013         if(!is_seq(&el->hd, &el) || elistlen(el) != 2)
3014                 goto errret;
3015         if(parse_alg(&el->hd) != ALG_rsaEncryption)
3016                 goto errret;
3017         el = el->tl;
3018         if(!is_bitstring(&el->hd, &bits))
3019                 goto errret;
3020         pub = asn1toRSApub(bits->data, bits->len);
3021         if(pub == nil)
3022                 goto errret;
3023 errret:
3024         freevalfields(&ereq.val);
3025         return pub;
3026 }
3027
3028 static void
3029 digestSPKI(int alg, uchar *pubkey, int npubkey, DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest)
3030 {
3031         Bytes *b = nil;
3032         Elem e = mkseq(mkel(mkalg(alg), mkel(mkbits(pubkey, npubkey), nil)));
3033         encode(e, &b);
3034         freevalfields(&e.val);
3035         (*fun)(b->data, b->len, digest, nil);
3036         freebytes(b);
3037 }
3038
3039 int
3040 X509digestSPKI(uchar *cert, int ncert, DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest)
3041 {
3042         CertX509 *c;
3043
3044         c = decode_cert(cert, ncert);
3045         if(c == nil){
3046                 werrstr("cannot decode cert");
3047                 return -1;
3048         }
3049         digestSPKI(c->publickey_alg, c->publickey->data, c->publickey->len, fun, digest);
3050         freecert(c);
3051         return 0;
3052 }
3053
3054 static char*
3055 tagdump(Tag tag)
3056 {
3057         static char buf[32];
3058
3059         if(tag.class != Universal){
3060                 snprint(buf, sizeof(buf), "class%d,num%d", tag.class, tag.num);
3061                 return buf;
3062         }
3063         switch(tag.num){
3064         case BOOLEAN: return "BOOLEAN";
3065         case INTEGER: return "INTEGER";
3066         case BIT_STRING: return "BIT STRING";
3067         case OCTET_STRING: return "OCTET STRING";
3068         case NULLTAG: return "NULLTAG";
3069         case OBJECT_ID: return "OID";
3070         case ObjectDescriptor: return "OBJECT_DES";
3071         case EXTERNAL: return "EXTERNAL";
3072         case REAL: return "REAL";
3073         case ENUMERATED: return "ENUMERATED";
3074         case EMBEDDED_PDV: return "EMBEDDED PDV";
3075         case SEQUENCE: return "SEQUENCE";
3076         case SETOF: return "SETOF";
3077         case UTF8String: return "UTF8String";
3078         case NumericString: return "NumericString";
3079         case PrintableString: return "PrintableString";
3080         case TeletexString: return "TeletexString";
3081         case VideotexString: return "VideotexString";
3082         case IA5String: return "IA5String";
3083         case UTCTime: return "UTCTime";
3084         case GeneralizedTime: return "GeneralizedTime";
3085         case GraphicString: return "GraphicString";
3086         case VisibleString: return "VisibleString";
3087         case GeneralString: return "GeneralString";
3088         case UniversalString: return "UniversalString";
3089         case BMPString: return "BMPString";
3090         default:
3091                 snprint(buf, sizeof(buf), "Universal,num%d", tag.num);
3092                 return buf;
3093         }
3094 }
3095
3096 static void
3097 edump(Elem e)
3098 {
3099         Value v;
3100         Elist *el;
3101         int i;
3102
3103         print("%s{", tagdump(e.tag));
3104         v = e.val;
3105         switch(v.tag){
3106         case VBool: print("Bool %d",v.u.boolval); break;
3107         case VInt: print("Int %d",v.u.intval); break;
3108         case VOctets: print("Octets[%d] %.2x%.2x...",v.u.octetsval->len,v.u.octetsval->data[0],v.u.octetsval->data[1]); break;
3109         case VBigInt: print("BigInt[%d] %.2x%.2x...",v.u.bigintval->len,v.u.bigintval->data[0],v.u.bigintval->data[1]); break;
3110         case VReal: print("Real..."); break;
3111         case VOther: print("Other..."); break;
3112         case VBitString: print("BitString[%d]...", v.u.bitstringval->len*8 - v.u.bitstringval->unusedbits); break;
3113         case VNull: print("Null"); break;
3114         case VEOC: print("EOC..."); break;
3115         case VObjId: print("ObjId");
3116                 for(i = 0; i<v.u.objidval->len; i++)
3117                         print(" %d", v.u.objidval->data[i]);
3118                 break;
3119         case VString: print("String \"%s\"",v.u.stringval); break;
3120         case VSeq: print("Seq\n");
3121                 for(el = v.u.seqval; el!=nil; el = el->tl)
3122                         edump(el->hd);
3123                 break;
3124         case VSet: print("Set\n");
3125                 for(el = v.u.setval; el!=nil; el = el->tl)
3126                         edump(el->hd);
3127                 break;
3128         }
3129         print("}\n");
3130 }
3131
3132 void
3133 asn1dump(uchar *der, int len)
3134 {
3135         Elem e;
3136
3137         if(decode(der, len, &e) != ASN_OK){
3138                 print("didn't parse\n");
3139                 exits("didn't parse");
3140         }
3141         edump(e);
3142 }
3143
3144 void
3145 X509dump(uchar *cert, int ncert)
3146 {
3147         char *e;
3148         CertX509 *c;
3149         RSApub *rsapub;
3150         ECpub *ecpub;
3151         ECdomain ecdom;
3152         int digestlen;
3153         uchar digest[MAXdlen];
3154
3155         print("begin X509dump\n");
3156         c = decode_cert(cert, ncert);
3157         if(c == nil){
3158                 print("cannot decode cert\n");
3159                 return;
3160         }
3161
3162         digestlen = digest_certinfo(cert, ncert, digestalg[c->signature_alg], digest);
3163         if(digestlen <= 0){
3164                 freecert(c);
3165                 print("cannot decode certinfo\n");
3166                 return;
3167         }
3168
3169         print("serial %d\n", c->serial);
3170         print("issuer %s\n", c->issuer);
3171         print("validity %s %s\n", c->validity_start, c->validity_end);
3172         print("subject %s\n", c->subject);
3173         print("sigalg=%d digest=%.*H\n", c->signature_alg, digestlen, digest);
3174         print("publickey_alg=%d pubkey[%d] %.*H\n", c->publickey_alg, c->publickey->len,
3175                 c->publickey->len, c->publickey->data);
3176
3177         switch(c->publickey_alg){
3178         case ALG_rsaEncryption:
3179                 rsapub = asn1toRSApub(c->publickey->data, c->publickey->len);
3180                 if(rsapub != nil){
3181                         print("rsa pubkey e=%B n(%d)=%B\n", rsapub->ek, mpsignif(rsapub->n), rsapub->n);
3182                         e = X509rsaverifydigest(c->signature->data, c->signature->len,
3183                                 digest, digestlen, rsapub);
3184                         if(e==nil)
3185                                 e = "nil (meaning ok)";
3186                         print("self-signed X509rsaverifydigest returns: %s\n", e);
3187                         rsapubfree(rsapub);
3188                 }
3189                 break;
3190         case ALG_ecPublicKey:
3191                 ecdominit(&ecdom, namedcurves[c->curve]);
3192                 ecpub = ecdecodepub(&ecdom, c->publickey->data, c->publickey->len);
3193                 if(ecpub != nil){
3194                         e = X509ecdsaverifydigest(c->signature->data, c->signature->len,
3195                                 digest, digestlen, &ecdom, ecpub);
3196                         if(e==nil)
3197                                 e = "nil (meaning ok)";
3198                         print("self-signed X509ecdsaverifydigest returns: %s\n", e);
3199                         ecpubfree(ecpub);
3200                 }
3201                 ecdomfree(&ecdom);
3202                 break;
3203         }
3204
3205         digestSPKI(c->publickey_alg, c->publickey->data, c->publickey->len, sha2_256, digest);
3206         print("publickey_thumbprint sha256=%.*[\n", SHA2_256dlen, digest);
3207
3208         sha2_256(cert, ncert, digest, nil);
3209         print("cert_thumbprint sha256=%.*[\n", SHA2_256dlen, digest);
3210
3211         sha1(cert, ncert, digest, nil);
3212         print("cert_thumbprint sha1=%.*H\n", SHA1dlen, digest);
3213
3214         freecert(c);
3215         print("end X509dump\n");
3216 }