WebSVN – planix.SVN – Diff – /os/branches/feature_tlsv12/sys/src/libsec/port/x509.c

 errret:
 	freevalfields(&e.val);
 	rsaprivfree(key);
 	return nil;
+}
 /*
  * digest(CertificateInfo)
  * Our ASN.1 library doesn't return pointers into the original
  * data array, so we need to do a little hand decoding.
 	freevalfields(&elem.val);
 	if(elem.tag.num != SEQUENCE)
 		return -1;
 	(*da->fun)(info, p - info, digest, nil);
 	return da->len;
 }
 mpint*
 pkcs1padbuf(uchar *buf, int len, mpint *modulus, int blocktype)
+{
 	int i, n = (mpsignif(modulus)-1)/8;
 		return -1;
 	switch(blocktype){
 	default:
 	case 1:
 		while(p < e && *p == 0xFF)
 			p++;
 		break;
 	case 2:
 		while(p < e && *p != 0x00)
 			p++;
 		break;
 			continue;
 		digest = encode_digest(*dp, edigest);
 		if(digest->len == len && tsmemcmp(digest->data, buf, len) == 0)
 			err = nil;
 		freebytes(digest);
 	}
 	free(buf);
 	return err;
+}
 char*
 X509ecdsaverifydigest(uchar *sig, int siglen, uchar *edigest, int edigestlen, ECdomain *dom, ECpub *pub)
+{
 mkutc(long t)
+{
 	Elem e;
 	char utc[50];
 	Tm *tm = gmtime(t);
 	e.tag.class = Universal;
 	e.tag.num = UTCTime;
 	e.val.tag = VString;
 	snprint(utc, sizeof(utc), "%.2d%.2d%.2d%.2d%.2d%.2dZ",
 		tm->year % 100, tm->mon+1, tm->mday, tm->hour, tm->min, tm->sec);
 	e.val.u.stringval = estrdup(utc);
 	e.tag.class = Universal;
 	e.tag.num = SEQUENCE;
 	e.val.tag = VSeq;
 	e.val.u.seqval = el;
 	return e;
 }
 static Elem
 mkset(Elist *el)
+{
 	Elem e;
 	e.tag.class = Universal;
 	e.tag.num = SETOF;
 	e.val.tag = VSet;
 	e.val.u.setval = el;
 	return e;
 }
 static Elem
 mkalg(int alg)
+{
 	return mkseq(mkel(mkoid(alg_oid_tab[alg]), mkel(Null(), nil)));
+}
 int
 asn1encodedigest(DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest, uchar *buf, int len)
+{
 	Bytes *bytes;
 	DigestAlg **dp;
 	for(dp = digestalg; *dp != nil; dp++){
 		if((*dp)->fun != fun)
 			continue;
 		bytes = encode_digest(*dp, digest);
 		if(bytes == nil)
 mkcont(Elem e, int num)
+{
 	e = mkseq(mkel(e, nil));
 	e.tag.class = Context;
 	e.tag.num = num;
 	return e;
 }
 static Elem
 mkaltname(char *s)
+{
 	Elem e;
 	int i;
+	}
 	e = mkstring(s, IA5String);
 	e.tag.class = Context;
 	e.tag.num = strchr(s, '@') != nil ? 1 : 2; /* email : DNS */
 	return e;
 }
 static Elist*
 mkaltnames(char *alts)
+{
 	Elist *el;
 	if(xl != nil){
 		if(req) return mkel(mkcont(mkseq(
 			mkel(mkoid((Ints*)&oid_extensionRequest),
 			mkel(mkset(mkel(mkseq(xl), nil)), nil))), 0), nil);
 		return mkel(mkcont(mkseq(xl), 3), nil);
 	}
 	return nil;
 }
 static char*
 splitalts(char *s)
+{
 	int q;
 		if(*s == '\'')
 			q ^= 1;
 		else if(q == 0 && *s == ','){
 			*s++ = 0;
 			return s;
 		}
 	}
 	return nil;
 }
 static Bytes*
 encode_rsapubkey(RSApub *pk)
+{
 	Bytes *b = nil;
 	Elem e = mkseq(
 		return -1;
+	}
 	memmove(buf, b->data, len = b->len);
 	freebytes(b);
 	return len;
 }
 uchar*
 X509rsagen(RSApriv *priv, char *subj, ulong valid[2], int *certlen)
+{
 	int serial = 0, sigalg = ALG_sha256WithRSAEncryption;
 	uchar *cert = nil;
 	Bytes *certbytes, *pkbytes, *certinfobytes, *sigbytes;
 	Elem e, certinfo;
 	DigestAlg *da;
 	uchar digest[MAXdlen], *buf;
 	int buflen;
 	mpint *pkcs1;
 	char *alts;
 	if((pkbytes = encode_rsapubkey(&priv->pub)) == nil)
 		return nil;
 	subj = estrdup(subj);
 	alts = splitalts(subj);
 	e = mkseq(
 		mkel(mkcont(mkint(2), 0),
 	mpint *pkcs1;
 	char *alts;
 	if((pkbytes = encode_rsapubkey(&priv->pub)) == nil)
 		return nil;
 	subj = estrdup(subj);
 	alts = splitalts(subj);
 	e = mkseq(
 		mkel(mkint(version),
+	}
+}
 static void
 edump(Elem e)
 {
 	Value v;
 	Elist *el;
 	int i;
 	print("%s{", tagdump(e.tag));
 			edump(el->hd);
 		break;
 	case VSet: print("Set\n");
 		for(el = v.u.setval; el!=nil; el = el->tl)
 			edump(el->hd);
 		break;
 	}
 	print("}\n");
+}
 void
 asn1dump(uchar *der, int len)
 	if(decode(der, len, &e) != ASN_OK){
 		print("didn't parse\n");
 		exits("didn't parse");
+	}
 	edump(e);
 }
 void
 X509dump(uchar *cert, int ncert)
+{
 	char *e;
 	CertX509 *c;
 	print("cert_thumbprint sha1=%.*H\n", SHA1dlen, digest);
 	freecert(c);
 	print("end X509dump\n");
+}
+static mpint*
+pkcs1pad(Bytes *b, mpint *modulus)
+{
+	int n = (mpsignif(modulus)+7)/8;
+	int pm1, i;
+	uchar *p;
+	mpint *mp;
+	pm1 = n - 1 - b->len;
+	p = (uchar*)emalloc(n);
+	p[0] = 0;
+	p[1] = 1;
+	for(i = 2; i < pm1; i++)
+		p[i] = 0xFF;
+	p[pm1] = 0;
+	memcpy(&p[pm1+1], b->data, b->len);
+	mp = betomp(p, n, nil);
+	free(p);
+	return mp;
+}
+uchar*
+X509gen(RSApriv *priv, char *subj, ulong valid[2], int *certlen)
+{
+	int serial = 0;
+	uchar *cert = nil;
+	RSApub *pk = rsaprivtopub(priv);
+	Bytes *certbytes, *pkbytes, *certinfobytes, *sigbytes;
+	Elem e, certinfo, issuer, subject, pubkey, validity, sig;
+	uchar digest[MD5dlen], *buf;
+	int buflen;
+	mpint *pkcs1;
+	e.val.tag = VInt;  /* so freevalfields at errret is no-op */
+	issuer = mkDN(subj);
+	subject = mkDN(subj);
+	pubkey = mkseq(mkel(mkbigint(pk->n),mkel(mkint(mptoi(pk->ek)),nil)));
+	if(encode(pubkey, &pkbytes) != ASN_OK)
+		goto errret;
+	freevalfields(&pubkey.val);
+	pubkey = mkseq(
+		mkel(mkalg(ALG_rsaEncryption),
+		mkel(mkbits(pkbytes->data, pkbytes->len),
+		nil)));
+	freebytes(pkbytes);
+	validity = mkseq(
+		mkel(mkutc(valid[0]),
+		mkel(mkutc(valid[1]),
+		nil)));
+	certinfo = mkseq(
+		mkel(mkint(serial),
+		mkel(mkalg(ALG_md5WithRSAEncryption),
+		mkel(issuer,
+		mkel(validity,
+		mkel(subject,
+		mkel(pubkey,
+		nil)))))));
+	if(encode(certinfo, &certinfobytes) != ASN_OK)
+		goto errret;
+	md5(certinfobytes->data, certinfobytes->len, digest, 0);
+	freebytes(certinfobytes);
+	sig = mkseq(
+		mkel(mkalg(ALG_md5),
+		mkel(mkoctet(digest, MD5dlen),
+		nil)));
+	if(encode(sig, &sigbytes) != ASN_OK)
+		goto errret;
+	pkcs1 = pkcs1pad(sigbytes, pk->n);
+	freebytes(sigbytes);
+	rsadecrypt(priv, pkcs1, pkcs1);
+	buflen = mptobe(pkcs1, nil, 0, &buf);
+	mpfree(pkcs1);
+	e = mkseq(
+		mkel(certinfo,
+		mkel(mkalg(ALG_md5WithRSAEncryption),
+		mkel(mkbits(buf, buflen),
+		nil))));
+	free(buf);
+	if(encode(e, &certbytes) != ASN_OK)
+		goto errret;
+	if(certlen)
+		*certlen = certbytes->len;
+	cert = certbytes->data;
+errret:
+	freevalfields(&e.val);
+	return cert;
+}
+uchar*
+X509req(RSApriv *priv, char *subj, int *certlen)
+{
+	/* RFC 2314, PKCS #10 Certification Request Syntax */
+	int version = 0;
+	uchar *cert = nil;
+	RSApub *pk = rsaprivtopub(priv);
+	Bytes *certbytes, *pkbytes, *certinfobytes, *sigbytes;
+	Elem e, certinfo, subject, pubkey, sig;
+	uchar digest[MD5dlen], *buf;
+	int buflen;
+	mpint *pkcs1;
+	e.val.tag = VInt;  /* so freevalfields at errret is no-op */
+	subject = mkDN(subj);
+	pubkey = mkseq(mkel(mkbigint(pk->n),mkel(mkint(mptoi(pk->ek)),nil)));
+	if(encode(pubkey, &pkbytes) != ASN_OK)
+		goto errret;
+	freevalfields(&pubkey.val);
+	pubkey = mkseq(
+		mkel(mkalg(ALG_rsaEncryption),
+		mkel(mkbits(pkbytes->data, pkbytes->len),
+		nil)));
+	freebytes(pkbytes);
+	certinfo = mkseq(
+		mkel(mkint(version),
+		mkel(subject,
+		mkel(pubkey,
+		nil))));
+	if(encode(certinfo, &certinfobytes) != ASN_OK)
+		goto errret;
+	md5(certinfobytes->data, certinfobytes->len, digest, 0);
+	freebytes(certinfobytes);
+	sig = mkseq(
+		mkel(mkalg(ALG_md5),
+		mkel(mkoctet(digest, MD5dlen),
+		nil)));
+	if(encode(sig, &sigbytes) != ASN_OK)
+		goto errret;
+	pkcs1 = pkcs1pad(sigbytes, pk->n);
+	freebytes(sigbytes);
+	rsadecrypt(priv, pkcs1, pkcs1);
+	buflen = mptobe(pkcs1, nil, 0, &buf);
+	mpfree(pkcs1);
+	e = mkseq(
+		mkel(certinfo,
+		mkel(mkalg(ALG_md5),
+		mkel(mkbits(buf, buflen),
+		nil))));
+	free(buf);
+	if(encode(e, &certbytes) != ASN_OK)
+		goto errret;
+	if(certlen)
+		*certlen = certbytes->len;
+	cert = certbytes->data;
+errret:
+	freevalfields(&e.val);
+	return cert;
+}
+/*
+ * 	DSAPrivateKey ::= SEQUENCE{
+ *		version Version,
+ *		p INTEGER,
+ *		q INTEGER,
+ *		g INTEGER, -- alpha
+ *		pub_key INTEGER, -- key
+ *		priv_key INTEGER, -- secret
+ *	}
+ */
+static DSApriv*
+decode_dsaprivkey(Bytes* a)
+{
+	int version;
+	Elem e;
+	Elist *el;
+	mpint *mp;
+	DSApriv* key;
+	key = dsaprivalloc();
+	if(decode(a->data, a->len, &e) != ASN_OK)
+		goto errret;
+	if(!is_seq(&e, &el) || elistlen(el) != 6)
+		goto errret;
+version = -1;
+	if(!is_int(&el->hd, &version) || version != 0)
+{
+fprint(2, "version %d\n", version);
+		goto errret;
+}
+	el = el->tl;
+	key->pub.p = mp = asn1mpint(&el->hd);
+	if(mp == nil)
+		goto errret;
+	el = el->tl;
+	key->pub.q = mp = asn1mpint(&el->hd);
+	if(mp == nil)
+		goto errret;
+	el = el->tl;
+	key->pub.alpha = mp = asn1mpint(&el->hd);
+	if(mp == nil)
+		goto errret;
+	el = el->tl;
+	key->pub.key = mp = asn1mpint(&el->hd);
+	if(mp == nil)
+		goto errret;
+	el = el->tl;
+	key->secret = mp = asn1mpint(&el->hd);
+	if(mp == nil)
+		goto errret;
+	return key;
+errret:
+	dsaprivfree(key);
+	return nil;
+}
+DSApriv*
+asn1toDSApriv(uchar *kd, int kn)
+{
+	Bytes *b;
+	DSApriv *key;
+	b = makebytes(kd, kn);
+	key = decode_dsaprivkey(b);
+	freebytes(b);
+	return key;
+}

Subversion Repositories planix.SVN

(root)/os/branches/feature_tlsv12/sys/src/libsec/port/x509.c – Rev 26 → 29