mirror of
https://github.com/chris2511/xca.git
synced 2026-09-12 19:51:05 +05:00
5f4308245c
This check is performed before the certificate is issued and signed. Like all the other checks regarding validity, extensions and other things. Issuing certificates that violate the Name Constraints of any CA in the chain is still be possible. But there will be a warning now with the name of the affected CA-Certificate and the violated constraint. The Issuer can then decide whether to issue the certificate or not.
1270 lines
29 KiB
C++
1270 lines
29 KiB
C++
/* vi: set sw=4 ts=4:
|
|
*
|
|
* Copyright (C) 2001 - 2020 Christian Hohnstaedt.
|
|
*
|
|
* All rights reserved.
|
|
*/
|
|
|
|
|
|
#include "pki_x509.h"
|
|
#include "pki_x509req.h"
|
|
#include "pki_evp.h"
|
|
#include "pki_scard.h"
|
|
#include "pki_crl.h"
|
|
#include "db_base.h"
|
|
#include "func.h"
|
|
#include "base.h"
|
|
#include "exception.h"
|
|
#include "pass_info.h"
|
|
|
|
#include <openssl/rand.h>
|
|
#include <openssl/err.h>
|
|
#include <openssl/x509_vfy.h>
|
|
#include <openssl/x509v3.h>
|
|
|
|
pki_x509::pki_x509(X509 *c)
|
|
:pki_x509super(), cert(c)
|
|
{
|
|
init();
|
|
}
|
|
|
|
pki_x509::pki_x509(const pki_x509 *crt)
|
|
:pki_x509super(crt)
|
|
{
|
|
init();
|
|
cert = X509_dup(crt->cert);
|
|
pki_openssl_error();
|
|
issuerSqlId = crt->issuerSqlId;
|
|
setRefKey(crt->getRefKey());
|
|
caTemplateSqlId = crt->caTemplateSqlId;
|
|
revocation = crt->revocation;
|
|
crlDays = crt->crlDays;
|
|
crlExpire = crt->crlExpire;
|
|
pki_openssl_error();
|
|
}
|
|
|
|
pki_x509::pki_x509(const QString &name)
|
|
:pki_x509super(name)
|
|
{
|
|
init();
|
|
cert = X509_new();
|
|
X509_set_version(cert, 2);
|
|
pki_openssl_error();
|
|
}
|
|
|
|
QString pki_x509::getMsg(msg_type msg, int n) const
|
|
{
|
|
/*
|
|
* We do not construct english sentences from fragments
|
|
* to allow proper translations.
|
|
* The drawback are all the slightly different duplicated messages
|
|
*
|
|
* %1 will be replaced by the internal name of the certificate
|
|
*/
|
|
switch (msg) {
|
|
case msg_import: return tr("Successfully imported the certificate '%1'");
|
|
case msg_delete: return tr("Delete the %n certificate(s): '%1'?", "", n);
|
|
case msg_create: return tr("Successfully created the certificate '%1'");
|
|
}
|
|
return pki_base::getMsg(msg);
|
|
}
|
|
|
|
void pki_x509::resetX509ReqCount() const
|
|
{
|
|
QList<pki_x509req *> reqs = Store.sqlSELECTpki<pki_x509req>(
|
|
"SELECT item FROM x509super LEFT JOIN items ON items.id = x509super.item "
|
|
"WHERE key_hash=? AND items.type=?",
|
|
QList<QVariant>() << QVariant(pubHash()) << QVariant(x509_req));
|
|
|
|
foreach(pki_x509req *req, reqs)
|
|
req->resetX509count();
|
|
}
|
|
|
|
QSqlError pki_x509::insertSqlData()
|
|
{
|
|
XSqlQuery q;
|
|
a1time now;
|
|
pki_x509 *signer = findIssuer();
|
|
QSqlError e = pki_x509super::insertSqlData();
|
|
if (e.isValid())
|
|
return e;
|
|
|
|
SQL_PREPARE(q, "INSERT INTO certs (item, hash, iss_hash, serial, issuer, "
|
|
"ca, cert) "
|
|
"VALUES (?, ?, ?, ?, ?, ?, ?)");
|
|
q.bindValue(0, sqlItemId);
|
|
q.bindValue(1, hash());
|
|
q.bindValue(2, getIssuerName().hashNum());
|
|
q.bindValue(3, getSerial().toHex());
|
|
q.bindValue(4, signer ? signer->getSqlItemId() : QVariant());
|
|
q.bindValue(5, (int)isCA());
|
|
q.bindValue(6, i2d_b64());
|
|
q.exec();
|
|
|
|
resetX509ReqCount();
|
|
|
|
if (!isCA())
|
|
return q.lastError();
|
|
|
|
SQL_PREPARE(q, "INSERT INTO authority (item, template, crlExpire, crlNo, crlDays) "
|
|
"VALUES (?, ?, ?, 0, ?)");
|
|
q.bindValue(0, sqlItemId);
|
|
q.bindValue(1, caTemplateSqlId);
|
|
q.bindValue(2, crlExpire.toPlain());
|
|
q.bindValue(3, crlDays);
|
|
q.exec();
|
|
if (fromDataRevList.size() > 0)
|
|
fromDataRevList.sqlUpdate(sqlItemId);
|
|
return q.lastError();
|
|
}
|
|
|
|
void pki_x509::restoreSql(const QSqlRecord &rec)
|
|
{
|
|
pki_x509super::restoreSql(rec);
|
|
QByteArray ba = QByteArray::fromBase64(
|
|
rec.value(VIEW_x509_cert).toByteArray());
|
|
d2i(ba);
|
|
issuerSqlId = rec.value(VIEW_x509_issuer);
|
|
crlNumber.set(rec.value(VIEW_x509_auth_crlNo).toUInt());
|
|
crlExpire.fromPlain(rec.value(VIEW_x509_auth_crlExpire).toString());
|
|
caTemplateSqlId = rec.value(VIEW_x509_auth_template);
|
|
if (!rec.isNull(VIEW_x509_auth_crlDays))
|
|
crlDays = rec.value(VIEW_x509_auth_crlDays).toInt();
|
|
else
|
|
crlDays = 30;
|
|
if (!rec.isNull(VIEW_x509_revocation))
|
|
revocation = x509rev(rec, VIEW_x509_revocation);
|
|
}
|
|
|
|
QSqlError pki_x509::deleteSqlData()
|
|
{
|
|
XSqlQuery q;
|
|
QSqlError e = pki_x509super::deleteSqlData();
|
|
QStringList tasks; tasks
|
|
<< "DELETE FROM certs WHERE item=?"
|
|
<< "DELETE FROM authority WHERE item=?"
|
|
<< "UPDATE crls SET issuer=NULL WHERE issuer=?"
|
|
<< "UPDATE certs SET issuer=NULL WHERE issuer=?"
|
|
<< "DELETE FROM revocations WHERE caId=?"
|
|
<< "DELETE FROM takeys WHERE item=?"
|
|
;
|
|
foreach(QString task, tasks) {
|
|
SQL_PREPARE(q, task);
|
|
q.bindValue(0, sqlItemId);
|
|
q.exec();
|
|
e = q.lastError();
|
|
if (e.isValid())
|
|
return e;
|
|
}
|
|
// Select affected items
|
|
q = Store.sqlSELECTpki(
|
|
"SELECT DISTINCT items.id FROM items, certs, crls "
|
|
"WHERE (items.id = certs.item OR items.id = crls.item) "
|
|
"AND crls.issuer = ? AND certs.issuer = ?",
|
|
QList<QVariant>() << QVariant(sqlItemId)
|
|
<< QVariant(sqlItemId));
|
|
|
|
while (q.next())
|
|
AffectedItems(q.value(0));
|
|
|
|
resetX509ReqCount();
|
|
return q.lastError();
|
|
}
|
|
|
|
pki_x509 *pki_x509::findIssuer()
|
|
{
|
|
XSqlQuery q;
|
|
pki_x509 *issuer = NULL;
|
|
unsigned hash;
|
|
|
|
if ((issuer = getSigner()) != NULL)
|
|
return issuer;
|
|
// first check for self-signed
|
|
if (verify(this))
|
|
return this;
|
|
|
|
hash = getIssuerName().hashNum();
|
|
/* Select X509 CA certificates with subject-hash == hash */
|
|
SQL_PREPARE(q, "SELECT x509super.item from x509super "
|
|
"JOIN certs ON certs.item = x509super.item "
|
|
"WHERE certs.ca=1 AND x509super.subj_hash=?");
|
|
q.bindValue(0, hash);
|
|
q.exec();
|
|
while (q.next()) {
|
|
pki_x509 *an_issuer = Store.lookupPki<pki_x509>(q.value(0));
|
|
qDebug() << "Possible Issuer of" << *this << *an_issuer << an_issuer->getNotAfter();
|
|
if (!an_issuer) {
|
|
qDebug("Certificate with id %d not found", q.value(0).toInt());
|
|
continue;
|
|
}
|
|
if (verify_only(an_issuer)) {
|
|
if (!issuer || (issuer->getNotAfter() < an_issuer->getNotAfter())) {
|
|
qDebug() << "New issuer of" << *this << *an_issuer << an_issuer->getNotAfter();
|
|
issuer = an_issuer;
|
|
}
|
|
}
|
|
}
|
|
verify(issuer);
|
|
return issuer;
|
|
}
|
|
|
|
void pki_x509::fromPEM_BIO(BIO *bio, const QString &fname)
|
|
{
|
|
X509 *_cert;
|
|
_cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
|
|
openssl_error_msg(fname);
|
|
if (!_cert)
|
|
throw errorEx();
|
|
X509_free(cert);
|
|
cert = _cert;
|
|
}
|
|
|
|
void pki_x509::fload(const QString &fname)
|
|
{
|
|
X509 *_cert;
|
|
XFile file(fname);
|
|
file.open_read();
|
|
QByteArray ba(file.readAll());
|
|
|
|
_cert = PEM_read_bio_X509(BioByteArray(ba).ro(), NULL, NULL, NULL);
|
|
if (!_cert) {
|
|
pki_ign_openssl_error();
|
|
_cert = d2i_X509_bio(BioByteArray(ba).ro(), NULL);
|
|
}
|
|
if (pki_ign_openssl_error() || !_cert) {
|
|
if (_cert)
|
|
X509_free(_cert);
|
|
throw errorEx(tr("Unable to load the certificate in file %1. Tried PEM and DER certificate.").arg(fname));
|
|
}
|
|
X509_free(cert);
|
|
cert = _cert;
|
|
}
|
|
|
|
pki_x509::~pki_x509()
|
|
{
|
|
if (cert) {
|
|
X509_free(cert);
|
|
}
|
|
pki_openssl_error();
|
|
}
|
|
|
|
void pki_x509::init()
|
|
{
|
|
crlExpire.setUndefined();
|
|
pkiType = x509;
|
|
}
|
|
|
|
void pki_x509::setSerial(const a1int &serial)
|
|
{
|
|
X509_set_serialNumber(cert, serial.get());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
a1int pki_x509::getSerial() const
|
|
{
|
|
a1int a(X509_get_serialNumber(cert));
|
|
pki_openssl_error();
|
|
return a;
|
|
}
|
|
|
|
pki_x509 *pki_x509::getBySerial(const a1int &a) const
|
|
{
|
|
foreach(pki_base *p, childItems) {
|
|
pki_x509 *pki = static_cast<pki_x509 *>(p);
|
|
if (a == pki->getSerial())
|
|
return pki;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
#define D5 "-----"
|
|
#define OVPN_TA_KEY "OpenVPN Static key V1"
|
|
|
|
QString pki_x509::getTaKey()
|
|
{
|
|
XSqlQuery q;
|
|
QByteArray b;
|
|
pki_x509 *issuer = getSigner();
|
|
if (!isCA() && issuer && issuer != this)
|
|
return issuer->getTaKey();
|
|
|
|
Transaction;
|
|
if (!TransBegin())
|
|
return QString();
|
|
|
|
SQL_PREPARE(q, "SELECT value FROM takeys WHERE item = ?");
|
|
q.bindValue(0, sqlItemId);
|
|
q.exec();
|
|
if (q.next()) {
|
|
b = QByteArray::fromBase64(q.value(0).toByteArray());
|
|
qDebug() << "Loaded TA key" << this << b.size() << QString::fromLatin1(b.toHex()).left(6);
|
|
} else {
|
|
b.resize(2048/8);
|
|
RAND_bytes((unsigned char*)b.data(), 2048/8);
|
|
SQL_PREPARE(q, "INSERT INTO takeys (item, value) VALUES ( ?, ? )");
|
|
q.bindValue(0, sqlItemId);
|
|
q.bindValue(1, b.toBase64());
|
|
q.exec();
|
|
qDebug() << "Generated TA key" << this << b.size() << QString::fromLatin1(b.toHex()).left(6);
|
|
}
|
|
TransCommit();
|
|
QString takey(D5 "BEGIN " OVPN_TA_KEY D5 "\n");
|
|
QString hex(QString::fromLatin1(b.toHex()));
|
|
for (int i=0; i<16; i++)
|
|
takey += hex.mid(32*i, 32) + "\n";
|
|
takey += D5 "END " OVPN_TA_KEY D5 "\n";
|
|
return takey;
|
|
}
|
|
|
|
bool pki_x509::importTaKey(const QByteArray &takey)
|
|
{
|
|
int start = takey.indexOf(D5 "BEGIN " OVPN_TA_KEY D5);
|
|
int end = takey.indexOf(D5 "END " OVPN_TA_KEY D5);
|
|
QByteArray data, existing_takey;
|
|
bool existed= false;
|
|
|
|
if (start >= 0 && end > 0 && start < end) {
|
|
start += sizeof D5 "BEGIN " OVPN_TA_KEY D5;
|
|
data = QByteArray::fromHex(takey.mid(start, end-start));
|
|
qDebug() << "TAKEY content" << start << end << data.size();
|
|
}
|
|
if (data.size() != 2048/8) {
|
|
XCA_ERROR(tr("Invalid OpenVPN tls-auth key"));
|
|
return false;
|
|
}
|
|
|
|
XSqlQuery q;
|
|
Transaction;
|
|
if (!TransBegin())
|
|
return false;
|
|
|
|
SQL_PREPARE(q, "SELECT value FROM takeys WHERE item = ?");
|
|
q.bindValue(0, sqlItemId);
|
|
q.exec();
|
|
if (q.next()) {
|
|
existed = true;
|
|
existing_takey = QByteArray::fromBase64(q.value(0).toByteArray());
|
|
qDebug() << "Existing TA key" << this << existing_takey.size()
|
|
<< QString::fromLatin1(existing_takey.toHex()).left(6);
|
|
}
|
|
if (existing_takey != data) {
|
|
if (existed)
|
|
SQL_PREPARE(q, "UPDATE takeys SET value = ? WHERE item = ?");
|
|
else
|
|
SQL_PREPARE(q, "INSERT INTO takeys (item, value) VALUES ( ?, ? )");
|
|
q.bindValue(0, sqlItemId);
|
|
q.bindValue(1, data.toBase64());
|
|
q.exec();
|
|
}
|
|
TransCommit();
|
|
QSqlError e = q.lastError();
|
|
if (e.isValid()) {
|
|
XCA_ERROR(tr("Failed to import tls-auth key"));
|
|
return false;
|
|
} else if (existing_takey == data) {
|
|
XCA_INFO(tr("Same tls-auth key already stored for this CA"));
|
|
} else if (existing_takey.isEmpty()) {
|
|
XCA_INFO(tr("New tls-auth key successfully imported"));
|
|
} else {
|
|
XCA_INFO(tr("Existing tls-auth key successfully replaced"));
|
|
}
|
|
return true;
|
|
}
|
|
|
|
a1int pki_x509::hashInfo(const EVP_MD *md) const
|
|
{
|
|
unsigned char digest[EVP_MAX_MD_SIZE];
|
|
unsigned len = 0;
|
|
|
|
if (!X509_digest(cert, md, digest, &len))
|
|
pki_openssl_error();
|
|
a1int a;
|
|
a.setRaw(digest,len);
|
|
return a;
|
|
}
|
|
|
|
void pki_x509::load_token(pkcs11 &p11, CK_OBJECT_HANDLE object)
|
|
{
|
|
QString desc;
|
|
|
|
pk11_attr_ulong type(CKA_CERTIFICATE_TYPE);
|
|
p11.loadAttribute(type, object);
|
|
if (type.getValue() != CKC_X_509)
|
|
throw errorEx(QString("Unsupported Certificate type %1"
|
|
).arg(type.getValue()));
|
|
|
|
try {
|
|
pk11_attr_data label(CKA_LABEL);
|
|
p11.loadAttribute(label, object);
|
|
desc = label.getText();
|
|
} catch(errorEx &err) {
|
|
qDebug("No Cert Label: %s", err.getCString());
|
|
// IGNORE
|
|
}
|
|
pk11_attr_data x509(CKA_VALUE);
|
|
p11.loadAttribute(x509, object);
|
|
QByteArray der = x509.getData();
|
|
d2i(der);
|
|
|
|
if (desc.isEmpty()) {
|
|
try {
|
|
x509name xn;
|
|
|
|
pk11_attr_data subj(CKA_SUBJECT);
|
|
p11.loadAttribute(subj, object);
|
|
QByteArray der = subj.getData();
|
|
xn.d2i(der);
|
|
desc = xn.getMostPopular();
|
|
pki_openssl_error();
|
|
} catch(errorEx &err) {
|
|
qDebug("No Cert Subject: %s", err.getCString());
|
|
// IGNORE
|
|
}
|
|
}
|
|
setIntName(desc);
|
|
pkiSource = token;
|
|
pki_openssl_error();
|
|
}
|
|
|
|
void pki_x509::d2i(QByteArray &ba)
|
|
{
|
|
X509 *c = (X509*)d2i_bytearray(D2I_VOID(d2i_X509), ba);
|
|
if (c) {
|
|
X509_free(cert);
|
|
cert = c;
|
|
}
|
|
pki_openssl_error();
|
|
}
|
|
|
|
QByteArray pki_x509::i2d() const
|
|
{
|
|
return i2d_bytearray(I2D_VOID(i2d_X509), cert);
|
|
}
|
|
|
|
void pki_x509::store_token(bool alwaysSelect)
|
|
{
|
|
pki_scard *card = NULL;
|
|
slotid slot;
|
|
x509name xname;
|
|
QList<CK_OBJECT_HANDLE> objects;
|
|
|
|
pkcs11 p11;
|
|
|
|
pki_key *privkey = getRefKey();
|
|
if (!privkey || !privkey->isToken() || alwaysSelect) {
|
|
if (!p11.selectToken(&slot, NULL))
|
|
return;
|
|
} else {
|
|
card = dynamic_cast<pki_scard *>(privkey);
|
|
if (!card || !card->prepare_card(&slot))
|
|
return;
|
|
}
|
|
|
|
pk11_attlist p11_atts;
|
|
p11_atts <<
|
|
pk11_attr_ulong(CKA_CLASS, CKO_CERTIFICATE) <<
|
|
pk11_attr_ulong(CKA_CERTIFICATE_TYPE, CKC_X_509) <<
|
|
pk11_attr_data(CKA_VALUE, i2d());
|
|
|
|
p11.startSession(slot, true);
|
|
|
|
QList<CK_OBJECT_HANDLE> objs = p11.objectList(p11_atts);
|
|
if (objs.count() != 0) {
|
|
XCA_WARN(tr("This certificate is already on the security token"));
|
|
return;
|
|
}
|
|
|
|
p11_atts <<
|
|
pk11_attr_bool(CKA_TOKEN, true) <<
|
|
pk11_attr_bool(CKA_PRIVATE, false) <<
|
|
pk11_attr_data(CKA_SUBJECT, getSubject().i2d()) <<
|
|
pk11_attr_data(CKA_ISSUER, getIssuerName().i2d()) <<
|
|
pk11_attr_data(CKA_SERIAL_NUMBER, getSerial().i2d()) <<
|
|
pk11_attr_data(CKA_LABEL, desc.toUtf8()) <<
|
|
(card ? card->getIdAttr() : p11.findUniqueID(CKO_CERTIFICATE));
|
|
|
|
if (!p11.tokenLoginForModification())
|
|
return;
|
|
|
|
p11.createObject(p11_atts);
|
|
}
|
|
|
|
void pki_x509::deleteFromToken()
|
|
{
|
|
pki_key *privkey = getRefKey();
|
|
pki_scard *card = dynamic_cast<pki_scard *>(privkey);
|
|
slotidList p11_slots;
|
|
|
|
if (!card || !pkcs11::libraries.loaded())
|
|
return;
|
|
|
|
if (privkey && privkey->isToken()) {
|
|
slotid slot;
|
|
if (!card->prepare_card(&slot))
|
|
return;
|
|
p11_slots << slot;
|
|
} else {
|
|
pkcs11 p11;
|
|
p11_slots = p11.getSlotList();
|
|
}
|
|
for (int i=0; i<p11_slots.count(); i++) {
|
|
deleteFromToken(p11_slots[i]);
|
|
}
|
|
}
|
|
|
|
pk11_attlist pki_x509::objectAttributes()
|
|
{
|
|
pk11_attlist attrs;
|
|
attrs <<
|
|
pk11_attr_ulong(CKA_CLASS, CKO_CERTIFICATE) <<
|
|
pk11_attr_ulong(CKA_CERTIFICATE_TYPE, CKC_X_509) <<
|
|
pk11_attr_data(CKA_VALUE, i2d());
|
|
return attrs;
|
|
}
|
|
|
|
void pki_x509::deleteFromToken(const slotid &slot)
|
|
{
|
|
pkcs11 p11;
|
|
p11.startSession(slot, true);
|
|
|
|
pk11_attlist atts = objectAttributes();
|
|
QList<CK_OBJECT_HANDLE> objs = p11.objectList(atts);
|
|
if (!objs.count())
|
|
return;
|
|
|
|
tkInfo ti = p11.tokenInfo();
|
|
if (!XCA_YESNO(tr("Delete the certificate '%1' from the token '%2 (#%3)'?").
|
|
arg(getIntName()).arg(ti.label()).arg(ti.serial())))
|
|
{
|
|
return;
|
|
}
|
|
if (!p11.tokenLoginForModification())
|
|
return;
|
|
|
|
p11.deleteObjects(objs);
|
|
}
|
|
|
|
int pki_x509::renameOnToken(const slotid &slot, const QString &name)
|
|
{
|
|
|
|
pkcs11 p11;
|
|
p11.startSession(slot, true);
|
|
pk11_attlist attrs = objectAttributes();
|
|
|
|
QList<CK_OBJECT_HANDLE> objs = p11.objectList(attrs);
|
|
if (!objs.count())
|
|
return 0;
|
|
|
|
pk11_attr_data label(CKA_LABEL, name.toUtf8());
|
|
if (!p11.tokenLoginForModification())
|
|
return 0;
|
|
p11.storeAttribute(label, objs[0]);
|
|
return 1;
|
|
}
|
|
|
|
void pki_x509::setNotBefore(const a1time &a)
|
|
{
|
|
a1time t(a);
|
|
X509_set_notBefore(cert, t.get_utc());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
void pki_x509::setNotAfter(const a1time &a)
|
|
{
|
|
a1time t(a);
|
|
X509_set_notAfter(cert, t.get_utc());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
a1time pki_x509::getNotBefore() const
|
|
{
|
|
a1time a(X509_get_notBefore(cert));
|
|
return a;
|
|
}
|
|
|
|
a1time pki_x509::getNotAfter() const
|
|
{
|
|
a1time a(X509_get_notAfter(cert));
|
|
return a;
|
|
}
|
|
|
|
x509name pki_x509::getSubject() const
|
|
{
|
|
x509name x(X509_get_subject_name(cert));
|
|
pki_openssl_error();
|
|
return x;
|
|
}
|
|
|
|
x509name pki_x509::getIssuerName() const
|
|
{
|
|
x509name x(X509_get_issuer_name(cert));
|
|
pki_openssl_error();
|
|
return x;
|
|
}
|
|
|
|
void pki_x509::setSubject(const x509name &n)
|
|
{
|
|
X509_set_subject_name(cert, n.get());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
void pki_x509::setIssuer(const x509name &n)
|
|
{
|
|
X509_set_issuer_name(cert, n.get());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
bool pki_x509::addV3ext(const x509v3ext &e, bool skip_existing)
|
|
{
|
|
if (!e.isValid())
|
|
return false;
|
|
if (skip_existing && X509_get_ext_by_NID(cert, e.nid(), -1) != -1)
|
|
return false;
|
|
X509_EXTENSION *ext = e.get();
|
|
X509_add_ext(cert, ext, -1);
|
|
X509_EXTENSION_free(ext);
|
|
pki_openssl_error();
|
|
return true;
|
|
}
|
|
|
|
void pki_x509::delSigner(pki_base *s)
|
|
{
|
|
if (s && (s->getSqlItemId() == issuerSqlId))
|
|
issuerSqlId = QVariant();
|
|
}
|
|
|
|
bool pki_x509::isCA() const
|
|
{
|
|
return X509_check_ca(cert) == 1;
|
|
}
|
|
|
|
bool pki_x509::canSign() const
|
|
{
|
|
pki_key *privkey = getRefKey();
|
|
if (!privkey || privkey->isPubKey())
|
|
return false;
|
|
if (privkey->isToken() && !pkcs11::libraries.loaded())
|
|
return false;
|
|
return isCA();
|
|
}
|
|
|
|
bool pki_x509::hasExtension(int nid) const
|
|
{
|
|
return getV3ext().idxByNid(nid) != -1;
|
|
}
|
|
|
|
void pki_x509::sign(pki_key *signkey, const digest &digest)
|
|
{
|
|
EVP_PKEY *tkey;
|
|
if (!signkey) {
|
|
my_error(tr("There is no key for signing !"));
|
|
}
|
|
tkey = signkey->decryptKey();
|
|
pki_openssl_error();
|
|
X509_sign(cert, tkey, digest.MD());
|
|
pki_openssl_error();
|
|
EVP_PKEY_free(tkey);
|
|
pki_openssl_error();
|
|
}
|
|
|
|
void pki_x509::writeDefault(const QString &dirname) const
|
|
{
|
|
XFile file(get_dump_filename(dirname, ".crt"));
|
|
file.open_write();
|
|
writeCert(file, true);
|
|
}
|
|
|
|
void pki_x509::writeCert(XFile &file, bool PEM) const
|
|
{
|
|
if (!cert)
|
|
return;
|
|
BioByteArray b;
|
|
if (PEM) {
|
|
b += PEM_comment();
|
|
PEM_write_bio_X509(b, cert);
|
|
} else {
|
|
i2d_X509_bio(b, cert);
|
|
}
|
|
pki_openssl_error();
|
|
file.write(b);
|
|
}
|
|
|
|
QString pki_x509::getIndexEntry()
|
|
{
|
|
QString flag = NULL;
|
|
bool revoked = isRevoked();
|
|
|
|
if (revoked)
|
|
flag = "R";
|
|
else if (checkDate())
|
|
flag = "V";
|
|
else
|
|
flag = "E";
|
|
|
|
return QString("%1\t%2\t%3\t%4\tunknown\t%5\n").arg(
|
|
flag, getNotAfter().toPlainUTC(),
|
|
revoked ? revocation.getDate().toPlainUTC() : "",
|
|
getSerial(),
|
|
QString(X509_NAME_oneline(getSubject().get(), NULL, 0)));
|
|
}
|
|
|
|
bool pki_x509::pem(BioByteArray &b)
|
|
{
|
|
const pki_export *xport = pki_export::by_id(Settings["CertFormat"]);
|
|
|
|
if (xport->match_all(F_PEM | F_CHAIN)) {
|
|
pki_x509 *iss, *prev;
|
|
for (iss = this, prev = nullptr; iss && iss != prev;
|
|
prev = iss, iss = iss->getSigner())
|
|
{
|
|
qDebug() << "Exporting to ClipBoard" << iss->getIntName();
|
|
if (!PEM_write_bio_X509(b, iss->cert))
|
|
return false;
|
|
}
|
|
} else if (xport->match_all(F_PEM | F_PRIVATE)) {
|
|
pki_key *key = getRefKey();
|
|
if (!key || !PEM_write_bio_X509(b, cert))
|
|
return false;
|
|
return key->pem(b, xport);
|
|
} else {
|
|
return PEM_write_bio_X509(b, cert);
|
|
}
|
|
return true;
|
|
}
|
|
|
|
void pki_x509::fillJWK(QJsonObject &json, const pki_export *xport) const
|
|
{
|
|
QByteArray der = i2d();
|
|
pki_key *key = getPubKey();
|
|
|
|
key->fillJWK(json, xport);
|
|
json["kid"] = getIntName();
|
|
json["x5t"] = BioByteArray(Digest(der, EVP_sha1())).base64UrlEncode();
|
|
json["x5t#256"] = BioByteArray(Digest(der, EVP_sha256())).base64UrlEncode();
|
|
if (xport->match_all(F_JWK_X5C)) {
|
|
QJsonArray x5c;
|
|
for (const pki_x509 *cert = this, *prev = nullptr;
|
|
cert && cert != prev;
|
|
prev = cert, cert = cert->getSigner())
|
|
{
|
|
x5c.append(cert->i2d_b64());
|
|
}
|
|
json["x5c"] = x5c;
|
|
}
|
|
delete key;
|
|
}
|
|
|
|
bool pki_x509::cmpIssuerAndSerial(pki_x509 *refcert)
|
|
{
|
|
bool ret = X509_issuer_and_serial_cmp(cert, refcert->cert);
|
|
pki_openssl_error();
|
|
return ret;
|
|
}
|
|
|
|
bool pki_x509::verify_only(const pki_x509 *signer) const
|
|
{
|
|
return X509_check_issued(signer->getCert(), cert) == X509_V_OK;
|
|
}
|
|
|
|
bool pki_x509::verify(pki_x509 *signer)
|
|
{
|
|
if (getSigner() || !signer)
|
|
return false;
|
|
if (signer == this &&
|
|
issuerSqlId == sqlItemId &&
|
|
issuerSqlId != QVariant())
|
|
return true;
|
|
|
|
if (signer && verify_only(signer)) {
|
|
int idx;
|
|
x509rev r;
|
|
x509revList rl(revocation);
|
|
r.setSerial(getSerial());
|
|
setSigner(signer);
|
|
signer->mergeRevList(rl);
|
|
rl = signer->getRevList();
|
|
idx = rl.indexOf(r);
|
|
if (idx != -1)
|
|
revocation = rl[idx];
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
x509revList pki_x509::getRevList() const
|
|
{
|
|
return isCA() ? x509revList::fromSql(sqlItemId) : x509revList();
|
|
}
|
|
|
|
void pki_x509::mergeRevList(x509revList &l)
|
|
{
|
|
x509revList revList = getRevList();
|
|
revList.merge(l);
|
|
|
|
if (revList.merged)
|
|
revList.sqlUpdate(sqlItemId);
|
|
}
|
|
|
|
void pki_x509::setRevocations(const x509revList &rl)
|
|
{
|
|
x509rev rev;
|
|
x509revList revList = rl;
|
|
|
|
foreach(pki_base *p, childItems) {
|
|
pki_x509 *pki = static_cast<pki_x509 *>(p);
|
|
rev.setSerial(pki->getSerial());
|
|
int idx = revList.indexOf(rev);
|
|
if (idx != -1)
|
|
pki->revocation = revList[idx];
|
|
else
|
|
pki->revocation = x509rev();
|
|
}
|
|
revList.sqlUpdate(sqlItemId);
|
|
}
|
|
|
|
pki_key *pki_x509::getPubKey() const
|
|
{
|
|
EVP_PKEY *pkey = X509_get_pubkey(cert);
|
|
pki_ign_openssl_error();
|
|
if (pkey == NULL)
|
|
return NULL;
|
|
pki_evp *key = new pki_evp(pkey);
|
|
pki_openssl_error();
|
|
return key;
|
|
}
|
|
|
|
bool pki_x509::compareNameAndKey(pki_x509 *other)
|
|
{
|
|
int r;
|
|
X509_NAME *s1, *s2;
|
|
EVP_PKEY *pub1, *pub2;
|
|
|
|
if (!cert || !other->cert)
|
|
return false;
|
|
s1 = X509_get_subject_name(cert);
|
|
s2 = X509_get_subject_name(other->cert);
|
|
pki_openssl_error();
|
|
if (!s1 || !s2)
|
|
return false;
|
|
/* X509_NAME_cmp returns 0 if they match */
|
|
r = X509_NAME_cmp(s1, s2);
|
|
pki_openssl_error();
|
|
if (r)
|
|
return false;
|
|
pub1 = X509_get_pubkey(cert);
|
|
pub2 = X509_get_pubkey(other->cert);
|
|
pki_ign_openssl_error();
|
|
if (!pub1 || !pub2)
|
|
return false;
|
|
/* EVP_PKEY_cmp() return 1 if the keys match */
|
|
r = EVP_PKEY_cmp(pub1, pub2);
|
|
pki_openssl_error();
|
|
return r == 1;
|
|
}
|
|
|
|
void pki_x509::setPubKey(pki_key *key)
|
|
{
|
|
X509_set_pubkey(cert, key->getPubKey());
|
|
pki_openssl_error();
|
|
}
|
|
|
|
QString pki_x509::fingerprint(const EVP_MD *digest) const
|
|
{
|
|
return ::fingerprint(i2d(), digest);
|
|
}
|
|
|
|
bool pki_x509::checkDate()
|
|
{
|
|
a1time n, b, a;
|
|
|
|
n = a1time::now(),
|
|
b = getNotBefore();
|
|
a = getNotAfter();
|
|
pki_openssl_error();
|
|
|
|
if (!a.isValid() || !b.isValid())
|
|
return false;
|
|
if (!a.isUndefined() && (a < n))
|
|
return false;
|
|
if (b > n)
|
|
return false;
|
|
pki_openssl_error();
|
|
return true;
|
|
}
|
|
|
|
extList pki_x509::getV3ext() const
|
|
{
|
|
extList el;
|
|
el.setStack(X509_get0_extensions(cert));
|
|
return el;
|
|
}
|
|
|
|
x509v3ext pki_x509::getExtByNid(int nid) const
|
|
{
|
|
extList el = getV3ext();
|
|
int i = el.idxByNid(nid);
|
|
|
|
try {
|
|
pki_openssl_error();
|
|
} catch(errorEx &err) {
|
|
XCA_WARN(err.getString());
|
|
}
|
|
if (i == -1)
|
|
return x509v3ext();
|
|
return el[i];
|
|
}
|
|
|
|
int pki_x509::sigAlg() const
|
|
{
|
|
return X509_get_signature_nid(cert);
|
|
}
|
|
|
|
pki_x509 *pki_x509::getSigner() const
|
|
{
|
|
return Store.lookupPki<pki_x509>(issuerSqlId);
|
|
}
|
|
|
|
bool pki_x509::isRevoked() const
|
|
{
|
|
return revocation.isValid();
|
|
}
|
|
|
|
void pki_x509::setRevoked(const x509rev &revok)
|
|
{
|
|
revocation = revok;
|
|
}
|
|
|
|
bool pki_x509::caAndPathLen(bool *ca, a1int *pathlen, bool *hasLen) const
|
|
{
|
|
x509v3ext e = getExtByNid(NID_basic_constraints);
|
|
if (e.nid() != NID_basic_constraints)
|
|
return false;
|
|
BASIC_CONSTRAINTS *bc = (BASIC_CONSTRAINTS *)e.d2i();
|
|
if (hasLen)
|
|
*hasLen = bc->pathlen ? true : false;
|
|
if (pathlen && bc->pathlen)
|
|
pathlen->set(bc->pathlen);
|
|
if (ca)
|
|
*ca = bc->ca;
|
|
BASIC_CONSTRAINTS_free(bc);
|
|
pki_openssl_error();
|
|
return true;
|
|
}
|
|
|
|
QVariant pki_x509::column_data(const dbheader *hd) const
|
|
{
|
|
switch (hd->id) {
|
|
case HD_cert_serial:
|
|
return QVariant(getSerial().toHex());
|
|
case HD_cert_md5fp:
|
|
return QVariant(fingerprint(EVP_md5()));
|
|
case HD_cert_sha1fp:
|
|
return QVariant(fingerprint(EVP_sha1()));
|
|
case HD_cert_sha256fp:
|
|
return QVariant(fingerprint(EVP_sha256()));
|
|
case HD_cert_ca: {
|
|
a1int len;
|
|
bool ca, haslen;
|
|
if (caAndPathLen(&ca, &len, &haslen)) {
|
|
if (ca && haslen)
|
|
return QVariant(len.toDec());
|
|
if (!ca)
|
|
return QVariant(tr("No"));
|
|
else
|
|
return QVariant(tr("Yes"));
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
return pki_x509super::column_data(hd);
|
|
}
|
|
|
|
a1time pki_x509::column_a1time(const dbheader *hd) const
|
|
{
|
|
switch (hd->id) {
|
|
case HD_cert_notBefore:
|
|
return getNotBefore();
|
|
case HD_cert_notAfter:
|
|
return getNotAfter();
|
|
case HD_cert_revocation:
|
|
if (isRevoked())
|
|
return revocation.getDate();
|
|
break;
|
|
case HD_cert_crl_expire:
|
|
if (canSign())
|
|
return crlExpire;
|
|
break;
|
|
}
|
|
return pki_base::column_a1time(hd);
|
|
}
|
|
|
|
QStringList pki_x509::icsVEVENT() const
|
|
{
|
|
return pki_base::icsVEVENT(getNotAfter(),
|
|
tr("Renew certificate: %1").arg(getIntName()),
|
|
tr("The XCA certificate '%1', issued on %2 "
|
|
"will expire on %3.\n"
|
|
"It is stored in the XCA database '%4'")
|
|
.arg(getIntName())
|
|
.arg(getNotBefore().toPretty())
|
|
.arg(getNotAfter().toPretty())
|
|
.arg(nativeSeparator(Database.name()))
|
|
);
|
|
}
|
|
|
|
void pki_x509::collect_properties(QMap<QString, QString> &prp) const
|
|
{
|
|
prp["Issuer"] = getIssuerName().oneLine(XN_FLAG_RFC2253);
|
|
prp["Serial"] = getSerial().toHex();
|
|
prp["CA"] = isCA() ? "Yes" : "No";
|
|
prp["Not Before"] = getNotBefore().toPretty();
|
|
prp["Not After"] = getNotAfter().toPretty();
|
|
prp["Self signed"] = verify_only(this) ? "Yes" : "No";
|
|
pki_x509super::collect_properties(prp);
|
|
}
|
|
|
|
void pki_x509::print(BioByteArray &bba, enum print_opt opt) const
|
|
{
|
|
pki_x509super::print(bba, opt);
|
|
switch (opt) {
|
|
case print_openssl_txt:
|
|
X509_print(bba, cert);
|
|
break;
|
|
case print_pem:
|
|
PEM_write_bio_X509(bba, cert);
|
|
break;
|
|
case print_coloured:
|
|
break;
|
|
}
|
|
}
|
|
|
|
QStringList pki_x509::icsVEVENT_ca() const
|
|
{
|
|
QStringList ics;
|
|
pki_crl *crl = NULL;
|
|
|
|
ics << icsVEVENT();
|
|
foreach(pki_base *p, childItems) {
|
|
pki_x509 *pki = static_cast<pki_x509 *>(p);
|
|
if (pki->getNotAfter() > a1time() && !isRevoked())
|
|
ics << pki->icsVEVENT();
|
|
}
|
|
|
|
QList<pki_crl*> list = Store.sqlSELECTpki<pki_crl>(
|
|
"SELECT item FROM crls WHERE issuer = ?",
|
|
QList<QVariant>() << QVariant(sqlItemId));
|
|
|
|
/* Get latest CRL */
|
|
foreach(pki_crl *pki, list) {
|
|
if (!crl || crl->getNextUpdate() < pki->getNextUpdate())
|
|
crl = pki;
|
|
}
|
|
if (crl)
|
|
ics << crl->icsVEVENT();
|
|
|
|
return ics;
|
|
}
|
|
|
|
QVariant pki_x509::getIcon(const dbheader *hd) const
|
|
{
|
|
int pixnum = 0;
|
|
bool ca;
|
|
QStringList icon_names {
|
|
":validcertIco", ":validcertkeyIco",
|
|
":invalidcertIco", ":invalidcertkeyIco"
|
|
};
|
|
switch (hd->id) {
|
|
case HD_cert_ca:
|
|
if (!caAndPathLen(&ca, NULL, NULL))
|
|
return QVariant();
|
|
if (!ca)
|
|
return QVariant();
|
|
return QVariant(QPixmap(":doneIco"));
|
|
case HD_internal_name:
|
|
if (hasPrivKey())
|
|
pixnum += 1;
|
|
if (isRevoked())
|
|
pixnum += 2;
|
|
break;
|
|
default:
|
|
return pki_x509super::getIcon(hd);
|
|
}
|
|
return QVariant(QPixmap(icon_names[pixnum]));
|
|
}
|
|
|
|
bool pki_x509::unusable() const
|
|
{
|
|
return getNotAfter() < a1time::now() || isRevoked();
|
|
}
|
|
|
|
bool pki_x509::visible() const
|
|
{
|
|
if (pki_x509super::visible())
|
|
return true;
|
|
if (getIssuerName().search(limitPattern))
|
|
return true;
|
|
if (fingerprint(EVP_md5()).contains(limitPattern))
|
|
return true;
|
|
if (fingerprint(EVP_sha1()).contains(limitPattern))
|
|
return true;
|
|
if (fingerprint(EVP_sha256()).contains(limitPattern))
|
|
return true;
|
|
if (getSerial().toHex().contains(limitPattern))
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
QVariant pki_x509::bg_color(const dbheader *hd) const
|
|
{
|
|
if (Settings["no_expire_colors"])
|
|
return QVariant();
|
|
|
|
QString unit, cert_expiry_num = Settings["cert_expiry"];
|
|
unit = cert_expiry_num.right(1);
|
|
cert_expiry_num.chop(1);
|
|
int n = cert_expiry_num.toInt();
|
|
|
|
a1time nb, na, now, certwarn;
|
|
|
|
nb = getNotBefore();
|
|
na = getNotAfter();
|
|
now = a1time::now();
|
|
|
|
if (unit == "%") {
|
|
quint64 lifetime = nb.secsTo(na);
|
|
certwarn = nb.addSecs(lifetime *n /100);
|
|
} else if (unit == "D") {
|
|
certwarn = na.addDays(-n);
|
|
} else if (unit == "W") {
|
|
certwarn = na.addDays(-n*7);
|
|
}
|
|
switch (hd->id) {
|
|
case HD_cert_notBefore:
|
|
if (nb > now || !nb.isValid() || nb.isUndefined())
|
|
return QVariant(red);
|
|
break;
|
|
case HD_cert_notAfter: {
|
|
if (na.isUndefined())
|
|
return QVariant(cyan);
|
|
if (na < now)
|
|
return QVariant(red);
|
|
if (certwarn < now)
|
|
return QVariant(yellow);
|
|
break;
|
|
}
|
|
case HD_cert_crl_expire:
|
|
if (canSign()) {
|
|
QDateTime crlwarn, crlex;
|
|
crlex = crlExpire;
|
|
if (!crlExpire.isUndefined()) {
|
|
crlwarn = crlex.addSecs(-2 *60*60*24);
|
|
if (crlex < now)
|
|
return QVariant(red);
|
|
if (crlwarn < now || !crlex.isValid())
|
|
return QVariant(yellow);
|
|
}
|
|
}
|
|
}
|
|
return QVariant();
|
|
}
|
|
|
|
static int verify_cb(int ok, X509_STORE_CTX *ctx)
|
|
{
|
|
int cert_error = X509_STORE_CTX_get_error(ctx);
|
|
QList<int> *errors = (QList<int>*)X509_STORE_CTX_get_app_data(ctx);
|
|
|
|
if (cert_error != X509_V_OK && errors->indexOf(cert_error) == -1)
|
|
errors->append(cert_error);
|
|
|
|
qDebug() << "OK:" << ok << "Error:" << cert_error
|
|
<< get_ossl_verify_error(cert_error);
|
|
return 1;
|
|
}
|
|
|
|
QList<int> pki_x509::ossl_verify() const
|
|
{
|
|
STACK_OF(X509) *untrusted = sk_X509_new_null();
|
|
Q_CHECK_PTR(untrusted);
|
|
STACK_OF(X509) *trusted = sk_X509_new_null();
|
|
Q_CHECK_PTR(trusted);
|
|
X509_STORE_CTX *csc = X509_STORE_CTX_new();
|
|
Q_CHECK_PTR(csc);
|
|
|
|
for (pki_x509 *crt = getSigner(), *oldcrt = nullptr;
|
|
crt && crt != oldcrt; oldcrt = crt, crt = crt->getSigner())
|
|
{
|
|
if (crt && crt == crt->getSigner())
|
|
sk_X509_push(trusted, crt->getCert());
|
|
else
|
|
sk_X509_push(untrusted, crt->getCert());
|
|
}
|
|
QList<int> errors;
|
|
X509_STORE_CTX_init(csc, NULL, cert, untrusted);
|
|
X509_STORE_CTX_set0_trusted_stack(csc, trusted);
|
|
X509_STORE_CTX_set_verify_cb(csc, verify_cb);
|
|
X509_STORE_CTX_set_app_data(csc, (void *)&errors);
|
|
|
|
X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
|
|
Q_CHECK_PTR(param);
|
|
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_POLICY_CHECK | X509_V_FLAG_X509_STRICT);
|
|
X509_VERIFY_PARAM_set_depth(param, 20);
|
|
X509_STORE_CTX_set0_param(csc, param);
|
|
|
|
qDebug() << "########### START VERIFY" << getIntName();
|
|
int i = X509_verify_cert(csc);
|
|
for (int cert_error : errors) {
|
|
qDebug() << "VERIFY_CB" << getIntName() << cert_error
|
|
<< get_ossl_verify_error(cert_error)
|
|
<< X509_verify_cert_error_string(cert_error);
|
|
}
|
|
qDebug() << "########### END VERIFY" << getIntName() << i;
|
|
|
|
X509_STORE_CTX_free(csc);
|
|
sk_X509_free(untrusted);
|
|
sk_X509_free(trusted);
|
|
|
|
pki_ign_openssl_error();
|
|
return errors;
|
|
}
|
|
|
|
QList<X509_PURPOSE *> pki_x509::purposes() const
|
|
{
|
|
QList<X509_PURPOSE *> purposes;
|
|
for (int i = 0; i< X509_PURPOSE_get_count(); i++) {
|
|
X509_PURPOSE *purp = X509_PURPOSE_get0(i);
|
|
int id = X509_PURPOSE_get_id(purp);
|
|
if (id == X509_PURPOSE_ANY)
|
|
continue;
|
|
Q_CHECK_PTR(purp);
|
|
int r = X509_check_purpose(cert, id, 0);
|
|
qDebug() << "Purpose" << i << X509_PURPOSE_get0_name(purp) << isCA() << r;
|
|
if (r)
|
|
purposes << purp;
|
|
}
|
|
return purposes;
|
|
}
|
|
|
|
int pki_x509::name_constraint_check(pki_x509 *issuer) const
|
|
{
|
|
int rc = X509_V_OK;
|
|
|
|
if (!issuer || issuer == this)
|
|
return rc;
|
|
|
|
x509v3ext e = issuer->getExtByNid(NID_name_constraints);
|
|
if (e.nid() != NID_name_constraints)
|
|
return rc;
|
|
|
|
NAME_CONSTRAINTS *nc = (NAME_CONSTRAINTS *)e.d2i();
|
|
Q_CHECK_PTR(nc);
|
|
rc = NAME_CONSTRAINTS_check(cert, nc);
|
|
#ifndef LIBRESSL_VERSION_NUMBER
|
|
if (!isCA() && rc == X509_V_OK)
|
|
rc = NAME_CONSTRAINTS_check_CN(cert, nc);
|
|
#endif
|
|
NAME_CONSTRAINTS_free(nc);
|
|
pki_openssl_error();
|
|
qDebug() << getIntName() << issuer->getIntName() << get_ossl_verify_error(rc);
|
|
return rc;
|
|
}
|