|
|
// X509Cert.cpp - Implementation of X509Cert class
//
// (c) Copyright Schlumberger Technology Corp., unpublished work, created
// 1999. This computer program includes Confidential, Proprietary
// Information and is a Trade Secret of Schlumberger Technology Corp. All
// use, disclosure, and/or reproduction is prohibited unless authorized
// in writing. All Rights Reserved.
#include "pkiX509Cert.h"
using namespace pki;
X509Cert::X509Cert(){}
X509Cert::X509Cert(const X509Cert &cert){ *this = cert;}
X509Cert::X509Cert(const std::string &buffer){ *this = buffer;}
X509Cert::X509Cert(const unsigned char *buffer, const unsigned long size){ m_Cert = BEROctet(buffer,size); Decode();}
X509Cert& X509Cert::operator=(const X509Cert &cert){ m_Cert = cert.m_Cert; Decode();
return *this;}
X509Cert& X509Cert::operator=(const std::string &buffer){ m_Cert = BEROctet((unsigned char*)buffer.data(),buffer.size()); Decode();
return *this;}
// Returns Serial Number (long) integer value.
std::string X509Cert::SerialNumber() const{ std::string RetVal((char*)m_SerialNumber.Data(),m_SerialNumber.DataSize()); return RetVal;}
// Returns whole DER string of Issuer
std::string X509Cert::Issuer() const{ std::string RetVal((char*)m_Issuer.Octet(),m_Issuer.OctetSize()); return RetVal;}
// Returns list of attributes in Issuer matching id-at-organizationName.
// List will be invalidated when object changes.
std::vector<std::string> X509Cert::IssuerOrg() const{
std::vector<std::string> orgNames; std::vector<BEROctet const*> orgOcts;
m_Issuer.SearchOIDNext("2 5 4 10",orgOcts); // Issuer's id-at-organizationName
for(long i=0; i<orgOcts.size(); i++) { std::string oName((char*)orgOcts[i]->Data(), orgOcts[i]->DataSize()); orgNames.push_back(oName); }
return orgNames;
}
// Returns whole DER string of Subject
std::string X509Cert::Subject() const{ std::string RetVal((char*)m_Subject.Octet(),m_Subject.OctetSize()); return RetVal;}
// Returns list of attributes in Subject matching id-at-commonName
// List will be invalidated when object changes.
std::vector<std::string> X509Cert::SubjectCommonName() const{
std::vector<std::string> cnNames; std::vector<BEROctet const*> cnOcts;
m_Subject.SearchOIDNext("2 5 4 3",cnOcts); // Subject's id-at-commonName
for(long i=0; i<cnOcts.size(); i++) { std::string cnName((char*)cnOcts[i]->Data(), cnOcts[i]->DataSize()); cnNames.push_back(cnName);
}
return cnNames;
}
// Returns modulus from SubjectPublicKeyInfo, stripped for any leading zero(s).
std::string X509Cert::Modulus() const{
std::string RawMod = RawModulus();
unsigned long i = 0; while(!RawMod[i] && i<RawMod.size()) i++; // Skip leading zero(s).
return std::string(&RawMod[i],RawMod.size()-i);
}
// Returns public exponent from SubjectPublicKeyInfo, possibly with leading zero(s).
std::string X509Cert::RawModulus() const{
if(m_SubjectPublicKeyInfo.SubOctetList().size()!=2) throw Exception(ccX509CertFormatError);
BEROctet PubKeyString = *(m_SubjectPublicKeyInfo.SubOctetList()[1]);
unsigned char *KeyBlob = PubKeyString.Data(); unsigned long KeyBlobSize = PubKeyString.DataSize();
if(KeyBlob[0]) throw Exception(ccX509CertFormatError); // Expect number of unused bits in
// last octet to be zero.
KeyBlob++; KeyBlobSize--; BEROctet PubKeyOct(KeyBlob,KeyBlobSize);
if(PubKeyOct.SubOctetList().size()!=2) throw Exception(ccX509CertFormatError);
unsigned char *Mod = PubKeyOct.SubOctetList()[0]->Data(); unsigned long ModSize = PubKeyOct.SubOctetList()[0]->DataSize();
return std::string((char*)Mod,ModSize);
}
// Returns public exponent from SubjectPublicKeyInfo, stripped for any leading zero(s).
std::string X509Cert::PublicExponent() const{
std::string RawPubExp = RawPublicExponent();
unsigned long i = 0; while(!RawPubExp[i] && i<RawPubExp.size()) i++; // Skip leading zero(s).
return std::string(&RawPubExp[i],RawPubExp.size()-i);
}// Returns public exponent from SubjectPublicKeyInfo, possibly with leading zero(s).
std::string X509Cert::RawPublicExponent() const{
if(m_SubjectPublicKeyInfo.SubOctetList().size()!=2) throw Exception(ccX509CertFormatError);
BEROctet PubKeyString = *(m_SubjectPublicKeyInfo.SubOctetList()[1]);
unsigned char *KeyBlob = PubKeyString.Data(); unsigned long KeyBlobSize = PubKeyString.DataSize();
if(KeyBlob[0]) throw Exception(ccX509CertFormatError); // Expect number of unused bits
// in last octet to be zero.
KeyBlob++; KeyBlobSize--;
BEROctet PubKeyOct(KeyBlob,KeyBlobSize);
if(PubKeyOct.SubOctetList().size()!=2) throw Exception(ccX509CertFormatError);
unsigned char *PubExp = PubKeyOct.SubOctetList()[1]->Data(); unsigned long PubExpSize = PubKeyOct.SubOctetList()[1]->DataSize();
return std::string((char*)PubExp,PubExpSize);
}
// Returns KeyUsage attribute, left justified with most significant bit as first bit (BER convention)
unsigned long X509Cert::KeyUsage() const{
if(!m_Extensions.Octet()) throw Exception(ccX509CertExtensionNotPresent);
unsigned long ReturnKeyUsage = 0;
const unsigned char UnusedBitsMask[] = {0xFF,0xFE, 0xFC, 0xF8, 0xF0, 0xE0, 0xC0, 0x80};
std::vector<BEROctet const*> ExtensionList;
m_Extensions.SearchOID("2 5 29 15",ExtensionList); // "Extensions" octets containing id-ce-keyUsage
if(ExtensionList.size()!=1) throw Exception(ccX509CertExtensionNotPresent); // One and only one instance
BEROctet const* Extension = ExtensionList[0]; BEROctet* extnValue = 0; if(Extension->SubOctetList().size()==2) extnValue = Extension->SubOctetList()[1]; // No "critical" attribute present
else if(Extension->SubOctetList().size()==3) extnValue = Extension->SubOctetList()[2]; // A "critical" attribute present
else throw Exception(ccX509CertFormatError); // "Extensions" must contain either 2 or 3 octets
unsigned char *KeyUsageBlob = extnValue->Data(); unsigned long KeyUsageBlobSize = extnValue->DataSize();
BEROctet KeyUsage(KeyUsageBlob,KeyUsageBlobSize); unsigned char *KeyUsageBitString = KeyUsage.Data(); unsigned long KeyUsageBitStringSize = KeyUsage.DataSize();
unsigned char UnusedBits = KeyUsageBitString[0]; unsigned long NumBytes = KeyUsageBitStringSize-1; if(NumBytes>4) { NumBytes = 4; // Truncate to fit the ulong, should be plenty though
UnusedBits = 0; }
unsigned long Shift = 24; for(unsigned long i=0; i<NumBytes-1; i++) { ReturnKeyUsage |= (KeyUsageBitString[i+1] << Shift); Shift -= 8; }
ReturnKeyUsage |= ( (KeyUsageBitString[NumBytes] & UnusedBitsMask[UnusedBits]) << Shift ); return ReturnKeyUsage;
}
void X509Cert::Decode(){
if(m_Cert.SubOctetList().size()!=3) throw Exception(ccX509CertFormatError);
BEROctet *tbsCert = m_Cert.SubOctetList()[0]; unsigned long Size = tbsCert->SubOctetList().size(); if(!Size) throw Exception(ccX509CertFormatError);
int i = 0; BEROctet *first = tbsCert->SubOctetList()[i]; if((first->Class()==2) && (first->Tag()==0)) i++; // Version
if(Size < (6+i)) throw Exception(ccX509CertFormatError);
m_SerialNumber = *(tbsCert->SubOctetList()[i]); i++; // SerialNumber
i++; // Signature (algorithm)
m_Issuer = *(tbsCert->SubOctetList()[i]); i++; // Issuer
i++; // Validity
m_Subject = *(tbsCert->SubOctetList()[i]); i++; // Subject
m_SubjectPublicKeyInfo = *(tbsCert->SubOctetList()[i]); i++; // SubjectPublicKeyInfo
m_Extensions = BEROctet(); while(i<Size) { BEROctet *oct = tbsCert->SubOctetList()[i]; if((oct->Class()==2) && (oct->Tag()==3)) { m_Extensions = *oct; break; } i++; }
}
|
