/src/strongswan/src/libstrongswan/plugins/x509/x509_crl.c

Source (jump to first uncovered line)
/*
 * Copyright (C) 2014-2017 Tobias Brunner
 * Copyright (C) 2008-2009 Martin Willi
 * Copyright (C) 2017-2022 Andreas Steffen
 *
 * Copyright (C) secunet Security Networks AG
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */

#include "x509_crl.h"

typedef struct private_x509_crl_t private_x509_crl_t;

#include <time.h>

#include <utils/debug.h>
#include <library.h>
#include <asn1/oid.h>
#include <asn1/asn1.h>
#include <asn1/asn1_parser.h>
#include <credentials/certificates/x509.h>
#include <credentials/keys/private_key.h>
#include <collections/linked_list.h>

/**
 * private data of x509_crl
 */
struct private_x509_crl_t {

  /**
   * public functions
   */
  x509_crl_t public;

  /**
   * X.509 crl encoding in ASN.1 DER format
   */
  chunk_t encoding;

  /**
   * X.509 crl body over which signature is computed
   */
  chunk_t tbsCertList;

  /**
   * Version of the X.509 crl
   */
  u_int version;

  /**
   * ID representing the crl issuer
   */
  identification_t *issuer;

  /**
   * CRL number
   */
  chunk_t crlNumber;

  /**
   * Time when the crl was generated
   */
  time_t thisUpdate;

  /**
   * Time when an update crl will be available
   */
  time_t nextUpdate;

  /**
   * list of revoked certificates as crl_revoked_t
   */
  linked_list_t *revoked;

  /**
   * List of Freshest CRL distribution points
   */
  linked_list_t *crl_uris;

  /**
   * Authority Key Identifier
   */
  chunk_t authKeyIdentifier;

  /**
   * Authority Key Serial Number
   */
  chunk_t authKeySerialNumber;

  /**
   * Optional OID of an [unsupported] critical extension
   */
  chunk_t critical_extension_oid;

  /**
   * Number of BaseCRL, if a delta CRL
   */
  chunk_t baseCrlNumber;

  /**
   * Signature scheme
   */
  signature_params_t *scheme;

  /**
   * Signature
   */
  chunk_t signature;

  /**
   * has this CRL been generated
   */
  bool generated;

  /**
   * reference counter
   */
  refcount_t ref;
};

/**
 * from x509_cert
 */
extern chunk_t x509_parse_authorityKeyIdentifier(chunk_t blob, int level0,
                         chunk_t *authKeySerialNumber);

/**
 * from x509_cert
 */
extern bool x509_parse_crlDistributionPoints(chunk_t blob, int level0,
                       linked_list_t *list);

/**
 * from x509_cert
 */
extern chunk_t x509_build_crlDistributionPoints(linked_list_t *list, int extn);

/**
  * ASN.1 definition of an X.509 certificate revocation list
 */
static const asn1Object_t crlObjects[] = {
  { 0, "certificateList",       ASN1_SEQUENCE,     ASN1_OBJ  }, /*  0 */
  { 1,   "tbsCertList",       ASN1_SEQUENCE,     ASN1_OBJ  }, /*  1 */
  { 2,     "version",         ASN1_INTEGER,      ASN1_OPT |
                               ASN1_BODY }, /*  2 */
  { 2,     "end opt",         ASN1_EOC,          ASN1_END  }, /*  3 */
  { 2,     "signature",       ASN1_EOC,          ASN1_RAW  }, /*  4 */
  { 2,     "issuer",          ASN1_SEQUENCE,     ASN1_OBJ  }, /*  5 */
  { 2,     "thisUpdate",        ASN1_EOC,          ASN1_RAW  }, /*  6 */
  { 2,     "nextUpdate",        ASN1_EOC,          ASN1_RAW  }, /*  7 */
  { 2,     "revokedCertificates",   ASN1_SEQUENCE,     ASN1_OPT |
                               ASN1_LOOP }, /*  8 */
  { 3,       "certList",        ASN1_SEQUENCE,     ASN1_NONE }, /*  9 */
  { 4,         "userCertificate",   ASN1_INTEGER,      ASN1_BODY }, /* 10 */
  { 4,         "revocationDate",    ASN1_EOC,          ASN1_RAW  }, /* 11 */
  { 4,         "crlEntryExtensions",  ASN1_SEQUENCE,     ASN1_OPT |
                               ASN1_LOOP }, /* 12 */
  { 5,           "extension",     ASN1_SEQUENCE,     ASN1_NONE }, /* 13 */
  { 6,             "extnID",      ASN1_OID,          ASN1_BODY }, /* 14 */
  { 6,             "critical",    ASN1_BOOLEAN,      ASN1_DEF |
                               ASN1_BODY }, /* 15 */
  { 6,             "extnValue",   ASN1_OCTET_STRING, ASN1_BODY }, /* 16 */
  { 4,         "end opt or loop",   ASN1_EOC,          ASN1_END  }, /* 17 */
  { 2,     "end opt or loop",     ASN1_EOC,          ASN1_END  }, /* 18 */
  { 2,     "optional extensions",   ASN1_CONTEXT_C_0,  ASN1_OPT  }, /* 19 */
  { 3,       "crlExtensions",     ASN1_SEQUENCE,     ASN1_LOOP }, /* 20 */
  { 4,         "extension",     ASN1_SEQUENCE,     ASN1_NONE }, /* 21 */
  { 5,           "extnID",      ASN1_OID,          ASN1_BODY }, /* 22 */
  { 5,           "critical",      ASN1_BOOLEAN,      ASN1_DEF |
                               ASN1_BODY }, /* 23 */
  { 5,           "extnValue",     ASN1_OCTET_STRING, ASN1_BODY }, /* 24 */
  { 3,       "end loop",        ASN1_EOC,          ASN1_END  }, /* 25 */
  { 2,     "end opt",         ASN1_EOC,          ASN1_END  }, /* 26 */
  { 1,   "signatureAlgorithm",    ASN1_EOC,          ASN1_RAW  }, /* 27 */
  { 1,   "signatureValue",      ASN1_BIT_STRING,   ASN1_BODY }, /* 28 */
  { 0, "exit",            ASN1_EOC,      ASN1_EXIT }
};
#define CRL_OBJ_TBS_CERT_LIST      1
#define CRL_OBJ_VERSION          2
#define CRL_OBJ_SIG_ALG          4
#define CRL_OBJ_ISSUER           5
#define CRL_OBJ_THIS_UPDATE        6
#define CRL_OBJ_NEXT_UPDATE        7
#define CRL_OBJ_USER_CERTIFICATE    10
#define CRL_OBJ_REVOCATION_DATE     11
#define CRL_OBJ_CRL_ENTRY_EXTN_ID   14
#define CRL_OBJ_CRL_ENTRY_CRITICAL    15
#define CRL_OBJ_CRL_ENTRY_EXTN_VALUE  16
#define CRL_OBJ_EXTN_ID         22
#define CRL_OBJ_CRITICAL        23
#define CRL_OBJ_EXTN_VALUE        24
#define CRL_OBJ_ALGORITHM       27
#define CRL_OBJ_SIGNATURE       28

/**
 *  Parses an X.509 Certificate Revocation List (CRL)
 */
static bool parse(private_x509_crl_t *this)
{
  asn1_parser_t *parser;
  chunk_t object;
  chunk_t extnID = chunk_empty;
  chunk_t userCertificate = chunk_empty;
  int objectID;
  signature_params_t sig_alg = {};
  bool success = FALSE;
  bool critical = FALSE;
  crl_revoked_t *revoked = NULL;

  parser = asn1_parser_create(crlObjects, this->encoding);

  while (parser->iterate(parser, &objectID, &object))
  {
    u_int level = parser->get_level(parser)+1;

    switch (objectID)
    {
      case CRL_OBJ_TBS_CERT_LIST:
        this->tbsCertList = object;
        break;
      case CRL_OBJ_VERSION:
        this->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
        DBG2(DBG_ASN, "  v%d", this->version);
        break;
      case CRL_OBJ_SIG_ALG:
        if (!signature_params_parse(object, level, &sig_alg))
        {
          DBG1(DBG_ASN, "  unable to parse signature algorithm");
          goto end;
        }
        break;
      case CRL_OBJ_ISSUER:
        this->issuer = identification_create_from_encoding(ID_DER_ASN1_DN, object);
        DBG2(DBG_ASN, "  '%Y'", this->issuer);
        break;
      case CRL_OBJ_THIS_UPDATE:
        this->thisUpdate = asn1_parse_time(object, level);
        break;
      case CRL_OBJ_NEXT_UPDATE:
        this->nextUpdate = asn1_parse_time(object, level);
        break;
      case CRL_OBJ_USER_CERTIFICATE:
        userCertificate = object;
        break;
      case CRL_OBJ_REVOCATION_DATE:
        revoked = malloc_thing(crl_revoked_t);
        revoked->serial = chunk_clone(userCertificate);
        revoked->date = asn1_parse_time(object, level);
        revoked->reason = CRL_REASON_UNSPECIFIED;
        this->revoked->insert_last(this->revoked, (void *)revoked);
        break;
      case CRL_OBJ_CRL_ENTRY_EXTN_ID:
      case CRL_OBJ_EXTN_ID:
        extnID = object;
        break;
      case CRL_OBJ_CRL_ENTRY_CRITICAL:
      case CRL_OBJ_CRITICAL:
        critical = object.len && *object.ptr;
        DBG2(DBG_ASN, "  %s", critical ? "TRUE" : "FALSE");
        break;
      case CRL_OBJ_CRL_ENTRY_EXTN_VALUE:
      case CRL_OBJ_EXTN_VALUE:
      {
        int extn_oid = asn1_known_oid(extnID);

        switch (extn_oid)
        {
          case OID_CRL_REASON_CODE:
            if (revoked)
            {
              if (object.len && *object.ptr == ASN1_ENUMERATED &&
                asn1_length(&object) == 1)
              {
                revoked->reason = *object.ptr;
              }
              DBG2(DBG_ASN, "  '%N'", crl_reason_names,
                 revoked->reason);
            }
            break;
          case OID_AUTHORITY_KEY_ID:
            chunk_free(&this->authKeyIdentifier);
            this->authKeyIdentifier =
              x509_parse_authorityKeyIdentifier(
                  object, level, &this->authKeySerialNumber);
            break;
          case OID_CRL_NUMBER:
            if (!asn1_parse_simple_object(&object, ASN1_INTEGER,
                            level, "crlNumber"))
            {
              goto end;
            }
            this->crlNumber = object;
            break;
          case OID_FRESHEST_CRL:
            if (!x509_parse_crlDistributionPoints(object, level,
                                this->crl_uris))
            {
              goto end;
            }
            break;
          case OID_DELTA_CRL_INDICATOR:
            if (!asn1_parse_simple_object(&object, ASN1_INTEGER,
                          level, "deltaCrlIndicator"))
            {
              goto end;
            }
            this->baseCrlNumber = object;
            break;
          case OID_ISSUING_DIST_POINT:
            /* TODO support of IssuingDistributionPoints */
            break;
          default:
            if (critical && lib->settings->get_bool(lib->settings,
              "%s.x509.enforce_critical", TRUE, lib->ns))
            {
              DBG1(DBG_ASN, "critical '%s' extension not supported",
                 (extn_oid == OID_UNKNOWN) ? "unknown" :
                 (char*)oid_names[extn_oid].name);
              goto end;
            }
            break;
        }
        break;
      }
      case CRL_OBJ_ALGORITHM:
      {
        INIT(this->scheme);
        if (!signature_params_parse(object, level, this->scheme))
        {
          DBG1(DBG_ASN, "  unable to parse signature algorithm");
          goto end;
        }
        if (!signature_params_equal(this->scheme, &sig_alg))
        {
          DBG1(DBG_ASN, "  signature algorithms do not agree");
          goto end;
        }
        break;
      }
      case CRL_OBJ_SIGNATURE:
        this->signature = chunk_skip(object, 1);
        break;
      default:
        break;
    }
  }
  success = parser->success(parser);

end:
  parser->destroy(parser);
  signature_params_clear(&sig_alg);
  return success;
}

CALLBACK(filter, bool,
  void *data, enumerator_t *orig, va_list args)
{
  crl_revoked_t *revoked;
  crl_reason_t *reason;
  chunk_t *serial;
  time_t *date;

  VA_ARGS_VGET(args, serial, date, reason);

  if (orig->enumerate(orig, &revoked))
  {
    if (serial)
    {
      *serial = chunk_skip_zero(revoked->serial);
    }
    if (date)
    {
      *date = revoked->date;
    }
    if (reason)
    {
      *reason = revoked->reason;
    }
    return TRUE;
  }
  return FALSE;
}

METHOD(crl_t, get_serial, chunk_t,
  private_x509_crl_t *this)
{
  return chunk_skip_zero(this->crlNumber);
}

METHOD(crl_t, get_authKeyIdentifier, chunk_t,
  private_x509_crl_t *this)
{
  return this->authKeyIdentifier;
}

METHOD(crl_t, is_delta_crl, bool,
  private_x509_crl_t *this, chunk_t *base_crl)
{
  if (this->baseCrlNumber.len)
  {
    if (base_crl)
    {
      *base_crl = chunk_skip_zero(this->baseCrlNumber);
    }
    return TRUE;
  }
  return FALSE;
}

METHOD(crl_t, create_delta_crl_uri_enumerator, enumerator_t*,
  private_x509_crl_t *this)
{
  return this->crl_uris->create_enumerator(this->crl_uris);
}

METHOD(crl_t, create_enumerator, enumerator_t*,
  private_x509_crl_t *this)
{
  return enumerator_create_filter(
                this->revoked->create_enumerator(this->revoked),
                filter, NULL, NULL);
}

METHOD(certificate_t, get_type, certificate_type_t,
  private_x509_crl_t *this)
{
  return CERT_X509_CRL;
}

METHOD(certificate_t, get_issuer, identification_t*,
  private_x509_crl_t *this)
{
  return this->issuer;
}

METHOD(certificate_t, has_issuer, id_match_t,
  private_x509_crl_t *this, identification_t *issuer)
{
  if (issuer->get_type(issuer) == ID_KEY_ID && this->authKeyIdentifier.ptr &&
    chunk_equals(this->authKeyIdentifier, issuer->get_encoding(issuer)))
  {
    return ID_MATCH_PERFECT;
  }
  return this->issuer->matches(this->issuer, issuer);
}

METHOD(certificate_t, issued_by, bool,
  private_x509_crl_t *this, certificate_t *issuer,
  signature_params_t **scheme)
{
  public_key_t *key;
  bool valid;
  x509_t *x509 = (x509_t*)issuer;
  chunk_t keyid = chunk_empty;

  /* check if issuer is an X.509 certificate with cRLSign keyUsage bit set */
  if (issuer->get_type(issuer) != CERT_X509)
  {
    return FALSE;
  }
  if (!(x509->get_flags(x509) & X509_CRL_SIGN))
  {
    return FALSE;
  }

  /* compare keyIdentifiers if available, otherwise use DNs */
  if (this->authKeyIdentifier.ptr)
  {
    keyid = x509->get_subjectKeyIdentifier(x509);
    if (keyid.len && !chunk_equals(keyid, this->authKeyIdentifier))
    {
      return FALSE;
    }
  }
  if (!keyid.len)
  {
    if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
    {
      return FALSE;
    }
  }

  key = issuer->get_public_key(issuer);
  if (!key)
  {
    return FALSE;
  }
  valid = key->verify(key, this->scheme->scheme, this->scheme->params,
            this->tbsCertList, this->signature);
  key->destroy(key);
  if (valid && scheme)
  {
    *scheme = signature_params_clone(this->scheme);
  }
  return valid;
}

METHOD(certificate_t, get_public_key, public_key_t*,
  private_x509_crl_t *this)
{
  return NULL;
}

METHOD(certificate_t, get_ref, certificate_t*,
  private_x509_crl_t *this)
{
  ref_get(&this->ref);
  return &this->public.crl.certificate;
}

METHOD(certificate_t, get_validity, bool,
  private_x509_crl_t *this, time_t *when,
  time_t *not_before, time_t *not_after)
{
  time_t t = when ? *when : time(NULL);

  if (not_before)
  {
    *not_before = this->thisUpdate;
  }
  if (not_after)
  {
    *not_after = this->nextUpdate;
  }
  return (t >= this->thisUpdate && t <= this->nextUpdate);
}

METHOD(certificate_t, get_encoding, bool,
  private_x509_crl_t *this, cred_encoding_type_t type, chunk_t *encoding)
{
  if (type == CERT_ASN1_DER)
  {
    *encoding = chunk_clone(this->encoding);
    return TRUE;
  }
  return lib->encoding->encode(lib->encoding, type, NULL, encoding,
          CRED_PART_X509_CRL_ASN1_DER, this->encoding, CRED_PART_END);
}

METHOD(certificate_t, equals, bool,
  private_x509_crl_t *this, certificate_t *other)
{
  chunk_t encoding;
  bool equal;

  if ((certificate_t*)this == other)
  {
    return TRUE;
  }
  if (other->equals == (void*)equals)
  { /* skip allocation if we have the same implementation */
    return chunk_equals(this->encoding, ((private_x509_crl_t*)other)->encoding);
  }
  if (!other->get_encoding(other, CERT_ASN1_DER, &encoding))
  {
    return FALSE;
  }
  equal = chunk_equals(this->encoding, encoding);
  free(encoding.ptr);
  return equal;
}

/**
 * Destroy a revoked_t entry
 */
static void revoked_destroy(crl_revoked_t *revoked)
{
  free(revoked->serial.ptr);
  free(revoked);
}

METHOD(certificate_t, destroy, void,
  private_x509_crl_t *this)
{
  if (ref_put(&this->ref))
  {
    this->revoked->destroy_function(this->revoked, (void*)revoked_destroy);
    this->crl_uris->destroy_function(this->crl_uris,
                     (void*)x509_cdp_destroy);
    signature_params_destroy(this->scheme);
    DESTROY_IF(this->issuer);
    free(this->authKeyIdentifier.ptr);
    free(this->encoding.ptr);
    free(this->critical_extension_oid.ptr);
    if (this->generated)
    {
      free(this->crlNumber.ptr);
      free(this->baseCrlNumber.ptr);
      free(this->signature.ptr);
      free(this->tbsCertList.ptr);
    }
    free(this);
  }
}

/**
 * create an empty but initialized X.509 crl
 */
static private_x509_crl_t* create_empty(void)
{
  private_x509_crl_t *this;

  INIT(this,
    .public = {
      .crl = {
        .certificate = {
          .get_type = _get_type,
          .get_subject = _get_issuer,
          .get_issuer = _get_issuer,
          .has_subject = _has_issuer,
          .has_issuer = _has_issuer,
          .issued_by = _issued_by,
          .get_public_key = _get_public_key,
          .get_validity = _get_validity,
          .get_encoding = _get_encoding,
          .equals = _equals,
          .get_ref = _get_ref,
          .destroy = _destroy,
        },
        .get_serial = _get_serial,
        .get_authKeyIdentifier = _get_authKeyIdentifier,
        .is_delta_crl = _is_delta_crl,
        .create_delta_crl_uri_enumerator = _create_delta_crl_uri_enumerator,
        .create_enumerator = _create_enumerator,
      },
    },
    .revoked = linked_list_create(),
    .crl_uris = linked_list_create(),
    .ref = 1,
  );
  return this;
}

/**
 * See header.
 */
x509_crl_t *x509_crl_load(certificate_type_t type, va_list args)
{
  chunk_t blob = chunk_empty;

  while (TRUE)
  {
    switch (va_arg(args, builder_part_t))
    {
      case BUILD_BLOB_ASN1_DER:
        blob = va_arg(args, chunk_t);
        continue;
      case BUILD_END:
        break;
      default:
        return NULL;
    }
    break;
  }
  if (blob.ptr)
  {
    private_x509_crl_t *crl = create_empty();

    crl->encoding = chunk_clone(blob);
    if (parse(crl))
    {
      return &crl->public;
    }
    destroy(crl);
  }
  return NULL;
};

/**
 * Read certificate status from enumerator, copy to crl
 */
static void read_revoked(private_x509_crl_t *crl, enumerator_t *enumerator)
{
  crl_revoked_t *revoked;
  chunk_t serial;
  time_t date;
  crl_reason_t reason;

  while (enumerator->enumerate(enumerator, &serial, &date, &reason))
  {
    INIT(revoked,
      .serial = chunk_clone(serial),
      .date = date,
      .reason = reason,
    );
    crl->revoked->insert_last(crl->revoked, revoked);
  }
}

/**
 * Generate CRL encoding, sign CRL
 */
static bool generate(private_x509_crl_t *this, certificate_t *cert,
           private_key_t *key, hash_algorithm_t digest_alg)
{
  chunk_t extensions = chunk_empty, certList = chunk_empty, serial;
  chunk_t crlDistributionPoints = chunk_empty, baseCrlNumber = chunk_empty;
  chunk_t sig_scheme = chunk_empty, criticalExtension = chunk_empty;
  enumerator_t *enumerator;
  crl_reason_t reason;
  time_t date;
  x509_t *x509;

  x509 = (x509_t*)cert;

  this->issuer = cert->get_subject(cert);
  this->issuer = this->issuer->clone(this->issuer);

  this->authKeyIdentifier = chunk_clone(x509->get_subjectKeyIdentifier(x509));

  /* select signature scheme, if not already specified */
  if (!this->scheme)
  {
    INIT(this->scheme,
      .scheme = signature_scheme_from_oid(
                hasher_signature_algorithm_to_oid(digest_alg,
                        key->get_type(key))),
    );
  }
  if (this->scheme->scheme == SIGN_UNKNOWN)
  {
    return FALSE;
  }
  if (!signature_params_build(this->scheme, &sig_scheme))
  {
    return FALSE;
  }

  enumerator = create_enumerator(this);
  while (enumerator->enumerate(enumerator, &serial, &date, &reason))
  {
    chunk_t revoked, entry_ext = chunk_empty;

    if (reason != CRL_REASON_UNSPECIFIED)
    {
      entry_ext = asn1_wrap(ASN1_SEQUENCE, "m",
              asn1_wrap(ASN1_SEQUENCE, "mm",
                asn1_build_known_oid(OID_CRL_REASON_CODE),
                asn1_wrap(ASN1_OCTET_STRING, "m",
                  asn1_wrap(ASN1_ENUMERATED, "c",
                    chunk_from_chars(reason)))));
    }
    revoked = asn1_wrap(ASN1_SEQUENCE, "mmm",
              asn1_integer("c", serial),
              asn1_from_time(&date, ASN1_UTCTIME),
              entry_ext);
    certList = chunk_cat("mm", certList, revoked);
  }
  enumerator->destroy(enumerator);

  crlDistributionPoints = x509_build_crlDistributionPoints(this->crl_uris,
                               OID_FRESHEST_CRL);

  if (this->baseCrlNumber.len)
  {
    baseCrlNumber =  asn1_wrap(ASN1_SEQUENCE, "mmm",
              asn1_build_known_oid(OID_DELTA_CRL_INDICATOR),
              asn1_wrap(ASN1_BOOLEAN, "c",
                chunk_from_chars(0xFF)),
              asn1_wrap(ASN1_OCTET_STRING, "m",
                asn1_integer("c", this->baseCrlNumber)));
  }

  if (this->critical_extension_oid.len > 0)
  {
    criticalExtension = asn1_wrap(ASN1_SEQUENCE, "mmm",
          asn1_simple_object(ASN1_OID, this->critical_extension_oid),
          asn1_simple_object(ASN1_BOOLEAN, chunk_from_chars(0xFF)),
          asn1_simple_object(ASN1_OCTET_STRING, chunk_empty));
  }

  extensions = asn1_wrap(ASN1_CONTEXT_C_0, "m",
          asn1_wrap(ASN1_SEQUENCE, "mmmmm",
            asn1_wrap(ASN1_SEQUENCE, "mm",
              asn1_build_known_oid(OID_AUTHORITY_KEY_ID),
              asn1_wrap(ASN1_OCTET_STRING, "m",
                asn1_wrap(ASN1_SEQUENCE, "m",
                  asn1_wrap(ASN1_CONTEXT_S_0, "c",
                        this->authKeyIdentifier)))),
            asn1_wrap(ASN1_SEQUENCE, "mm",
              asn1_build_known_oid(OID_CRL_NUMBER),
              asn1_wrap(ASN1_OCTET_STRING, "m",
                asn1_integer("c", this->crlNumber))),
            crlDistributionPoints, baseCrlNumber,
            criticalExtension));

  this->tbsCertList = asn1_wrap(ASN1_SEQUENCE, "cccmmmm",
              ASN1_INTEGER_1,
              sig_scheme,
              this->issuer->get_encoding(this->issuer),
              asn1_from_time(&this->thisUpdate, ASN1_UTCTIME),
              asn1_from_time(&this->nextUpdate, ASN1_UTCTIME),
              asn1_wrap(ASN1_SEQUENCE, "m", certList),
              extensions);

  if (!key->sign(key, this->scheme->scheme, this->scheme->params,
           this->tbsCertList, &this->signature))
  {
    chunk_free(&sig_scheme);
    return FALSE;
  }
  this->encoding = asn1_wrap(ASN1_SEQUENCE, "cmm",
              this->tbsCertList,
              sig_scheme,
              asn1_bitstring("c", this->signature));
  return TRUE;
}

/**
 * See header.
 */
x509_crl_t *x509_crl_gen(certificate_type_t type, va_list args)
{
  hash_algorithm_t digest_alg = HASH_SHA256;
  private_x509_crl_t *crl;
  certificate_t *cert = NULL;
  private_key_t *key = NULL;

  crl = create_empty();
  crl->generated = TRUE;
  while (TRUE)
  {
    builder_part_t part = va_arg(args, builder_part_t);

    switch (part)
    {
      case BUILD_SIGNING_KEY:
        key = va_arg(args, private_key_t*);
        continue;
      case BUILD_SIGNING_CERT:
        cert = va_arg(args, certificate_t*);
        continue;
      case BUILD_NOT_BEFORE_TIME:
        crl->thisUpdate = va_arg(args, time_t);
        continue;
      case BUILD_NOT_AFTER_TIME:
        crl->nextUpdate = va_arg(args, time_t);
        continue;
      case BUILD_SERIAL:
        crl->crlNumber = va_arg(args, chunk_t);
        crl->crlNumber = chunk_clone(crl->crlNumber);
        continue;
      case BUILD_SIGNATURE_SCHEME:
        crl->scheme = va_arg(args, signature_params_t*);
        crl->scheme = signature_params_clone(crl->scheme);
        continue;
      case BUILD_DIGEST_ALG:
        digest_alg = va_arg(args, int);
        continue;
      case BUILD_REVOKED_ENUMERATOR:
        read_revoked(crl, va_arg(args, enumerator_t*));
        continue;
      case BUILD_BASE_CRL:
        crl->baseCrlNumber = va_arg(args, chunk_t);
        crl->baseCrlNumber = chunk_clone(crl->baseCrlNumber);
        continue;
      case BUILD_CRL_DISTRIBUTION_POINTS:
      {
        enumerator_t *enumerator;
        linked_list_t *list;
        x509_cdp_t *in, *cdp;

        list = va_arg(args, linked_list_t*);
        enumerator = list->create_enumerator(list);
        while (enumerator->enumerate(enumerator, &in))
        {
          INIT(cdp,
            .uri = strdup(in->uri),
            .issuer = in->issuer ? in->issuer->clone(in->issuer) : NULL,
          );
          crl->crl_uris->insert_last(crl->crl_uris, cdp);
        }
        enumerator->destroy(enumerator);
        continue;
      }
      case BUILD_CRITICAL_EXTENSION:
        crl->critical_extension_oid = chunk_clone(va_arg(args, chunk_t));
        continue;
      case BUILD_END:
        break;
      default:
        destroy(crl);
        return NULL;
    }
    break;
  }

  if (key && cert && cert->get_type(cert) == CERT_X509 &&
    generate(crl, cert, key, digest_alg))
  {
    return &crl->public;
  }
  destroy(crl);
  return NULL;
}

Coverage Report

Created: 2025-07-23 07:07