1 | /*************************************************************************** |
2 | * _ _ ____ _ |
3 | * Project ___| | | | _ \| | |
4 | * / __| | | | |_) | | |
5 | * | (__| |_| | _ <| |___ |
6 | * \___|\___/|_| \_\_____| |
7 | * |
8 | * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. |
9 | * |
10 | * This software is licensed as described in the file COPYING, which |
11 | * you should have received as part of this distribution. The terms |
12 | * are also available at https://curl.haxx.se/docs/copyright.html. |
13 | * |
14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
15 | * copies of the Software, and permit persons to whom the Software is |
16 | * furnished to do so, under the terms of the COPYING file. |
17 | * |
18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
19 | * KIND, either express or implied. |
20 | * |
21 | ***************************************************************************/ |
22 | |
23 | #include "curl_setup.h" |
24 | |
25 | #if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \ |
26 | defined(USE_WOLFSSL) || defined(USE_SCHANNEL) |
27 | |
28 | #include <curl/curl.h> |
29 | #include "urldata.h" |
30 | #include "strcase.h" |
31 | #include "hostcheck.h" |
32 | #include "vtls/vtls.h" |
33 | #include "sendf.h" |
34 | #include "inet_pton.h" |
35 | #include "curl_base64.h" |
36 | #include "x509asn1.h" |
37 | |
38 | /* The last 3 #include files should be in this order */ |
39 | #include "curl_printf.h" |
40 | #include "curl_memory.h" |
41 | #include "memdebug.h" |
42 | |
43 | /* ASN.1 OIDs. */ |
44 | static const char cnOID[] = "2.5.4.3" ; /* Common name. */ |
45 | static const char sanOID[] = "2.5.29.17" ; /* Subject alternative name. */ |
46 | |
47 | static const curl_OID OIDtable[] = { |
48 | { "1.2.840.10040.4.1" , "dsa" }, |
49 | { "1.2.840.10040.4.3" , "dsa-with-sha1" }, |
50 | { "1.2.840.10045.2.1" , "ecPublicKey" }, |
51 | { "1.2.840.10045.3.0.1" , "c2pnb163v1" }, |
52 | { "1.2.840.10045.4.1" , "ecdsa-with-SHA1" }, |
53 | { "1.2.840.10046.2.1" , "dhpublicnumber" }, |
54 | { "1.2.840.113549.1.1.1" , "rsaEncryption" }, |
55 | { "1.2.840.113549.1.1.2" , "md2WithRSAEncryption" }, |
56 | { "1.2.840.113549.1.1.4" , "md5WithRSAEncryption" }, |
57 | { "1.2.840.113549.1.1.5" , "sha1WithRSAEncryption" }, |
58 | { "1.2.840.113549.1.1.10" , "RSASSA-PSS" }, |
59 | { "1.2.840.113549.1.1.14" , "sha224WithRSAEncryption" }, |
60 | { "1.2.840.113549.1.1.11" , "sha256WithRSAEncryption" }, |
61 | { "1.2.840.113549.1.1.12" , "sha384WithRSAEncryption" }, |
62 | { "1.2.840.113549.1.1.13" , "sha512WithRSAEncryption" }, |
63 | { "1.2.840.113549.2.2" , "md2" }, |
64 | { "1.2.840.113549.2.5" , "md5" }, |
65 | { "1.3.14.3.2.26" , "sha1" }, |
66 | { cnOID, "CN" }, |
67 | { "2.5.4.4" , "SN" }, |
68 | { "2.5.4.5" , "serialNumber" }, |
69 | { "2.5.4.6" , "C" }, |
70 | { "2.5.4.7" , "L" }, |
71 | { "2.5.4.8" , "ST" }, |
72 | { "2.5.4.9" , "streetAddress" }, |
73 | { "2.5.4.10" , "O" }, |
74 | { "2.5.4.11" , "OU" }, |
75 | { "2.5.4.12" , "title" }, |
76 | { "2.5.4.13" , "description" }, |
77 | { "2.5.4.17" , "postalCode" }, |
78 | { "2.5.4.41" , "name" }, |
79 | { "2.5.4.42" , "givenName" }, |
80 | { "2.5.4.43" , "initials" }, |
81 | { "2.5.4.44" , "generationQualifier" }, |
82 | { "2.5.4.45" , "X500UniqueIdentifier" }, |
83 | { "2.5.4.46" , "dnQualifier" }, |
84 | { "2.5.4.65" , "pseudonym" }, |
85 | { "1.2.840.113549.1.9.1" , "emailAddress" }, |
86 | { "2.5.4.72" , "role" }, |
87 | { sanOID, "subjectAltName" }, |
88 | { "2.5.29.18" , "issuerAltName" }, |
89 | { "2.5.29.19" , "basicConstraints" }, |
90 | { "2.16.840.1.101.3.4.2.4" , "sha224" }, |
91 | { "2.16.840.1.101.3.4.2.1" , "sha256" }, |
92 | { "2.16.840.1.101.3.4.2.2" , "sha384" }, |
93 | { "2.16.840.1.101.3.4.2.3" , "sha512" }, |
94 | { (const char *) NULL, (const char *) NULL } |
95 | }; |
96 | |
97 | /* |
98 | * Lightweight ASN.1 parser. |
99 | * In particular, it does not check for syntactic/lexical errors. |
100 | * It is intended to support certificate information gathering for SSL backends |
101 | * that offer a mean to get certificates as a whole, but do not supply |
102 | * entry points to get particular certificate sub-fields. |
103 | * Please note there is no pretention here to rewrite a full SSL library. |
104 | */ |
105 | |
106 | static const char *getASN1Element(curl_asn1Element *elem, |
107 | const char *beg, const char *end) |
108 | WARN_UNUSED_RESULT; |
109 | |
110 | static const char *getASN1Element(curl_asn1Element *elem, |
111 | const char *beg, const char *end) |
112 | { |
113 | unsigned char b; |
114 | unsigned long len; |
115 | curl_asn1Element lelem; |
116 | |
117 | /* Get a single ASN.1 element into `elem', parse ASN.1 string at `beg' |
118 | ending at `end'. |
119 | Returns a pointer in source string after the parsed element, or NULL |
120 | if an error occurs. */ |
121 | if(!beg || !end || beg >= end || !*beg || |
122 | (size_t)(end - beg) > CURL_ASN1_MAX) |
123 | return NULL; |
124 | |
125 | /* Process header byte. */ |
126 | elem->header = beg; |
127 | b = (unsigned char) *beg++; |
128 | elem->constructed = (b & 0x20) != 0; |
129 | elem->class = (b >> 6) & 3; |
130 | b &= 0x1F; |
131 | if(b == 0x1F) |
132 | return NULL; /* Long tag values not supported here. */ |
133 | elem->tag = b; |
134 | |
135 | /* Process length. */ |
136 | if(beg >= end) |
137 | return NULL; |
138 | b = (unsigned char) *beg++; |
139 | if(!(b & 0x80)) |
140 | len = b; |
141 | else if(!(b &= 0x7F)) { |
142 | /* Unspecified length. Since we have all the data, we can determine the |
143 | effective length by skipping element until an end element is found. */ |
144 | if(!elem->constructed) |
145 | return NULL; |
146 | elem->beg = beg; |
147 | while(beg < end && *beg) { |
148 | beg = getASN1Element(&lelem, beg, end); |
149 | if(!beg) |
150 | return NULL; |
151 | } |
152 | if(beg >= end) |
153 | return NULL; |
154 | elem->end = beg; |
155 | return beg + 1; |
156 | } |
157 | else if((unsigned)b > (size_t)(end - beg)) |
158 | return NULL; /* Does not fit in source. */ |
159 | else { |
160 | /* Get long length. */ |
161 | len = 0; |
162 | do { |
163 | if(len & 0xFF000000L) |
164 | return NULL; /* Lengths > 32 bits are not supported. */ |
165 | len = (len << 8) | (unsigned char) *beg++; |
166 | } while(--b); |
167 | } |
168 | if(len > (size_t)(end - beg)) |
169 | return NULL; /* Element data does not fit in source. */ |
170 | elem->beg = beg; |
171 | elem->end = beg + len; |
172 | return elem->end; |
173 | } |
174 | |
175 | /* |
176 | * Search the null terminated OID or OID identifier in local table. |
177 | * Return the table entry pointer or NULL if not found. |
178 | */ |
179 | static const curl_OID * searchOID(const char *oid) |
180 | { |
181 | const curl_OID *op; |
182 | for(op = OIDtable; op->numoid; op++) |
183 | if(!strcmp(op->numoid, oid) || strcasecompare(op->textoid, oid)) |
184 | return op; |
185 | |
186 | return NULL; |
187 | } |
188 | |
189 | /* |
190 | * Convert an ASN.1 Boolean value into its string representation. Return the |
191 | * dynamically allocated string, or NULL if source is not an ASN.1 Boolean |
192 | * value. |
193 | */ |
194 | |
195 | static const char *bool2str(const char *beg, const char *end) |
196 | { |
197 | if(end - beg != 1) |
198 | return NULL; |
199 | return strdup(*beg? "TRUE" : "FALSE" ); |
200 | } |
201 | |
202 | /* |
203 | * Convert an ASN.1 octet string to a printable string. |
204 | * Return the dynamically allocated string, or NULL if an error occurs. |
205 | */ |
206 | static const char *octet2str(const char *beg, const char *end) |
207 | { |
208 | size_t n = end - beg; |
209 | char *buf = NULL; |
210 | |
211 | if(n <= (SIZE_T_MAX - 1) / 3) { |
212 | buf = malloc(3 * n + 1); |
213 | if(buf) |
214 | for(n = 0; beg < end; n += 3) |
215 | msnprintf(buf + n, 4, "%02x:" , *(const unsigned char *) beg++); |
216 | } |
217 | return buf; |
218 | } |
219 | |
220 | static const char *bit2str(const char *beg, const char *end) |
221 | { |
222 | /* Convert an ASN.1 bit string to a printable string. |
223 | Return the dynamically allocated string, or NULL if an error occurs. */ |
224 | |
225 | if(++beg > end) |
226 | return NULL; |
227 | return octet2str(beg, end); |
228 | } |
229 | |
230 | /* |
231 | * Convert an ASN.1 integer value into its string representation. |
232 | * Return the dynamically allocated string, or NULL if source is not an |
233 | * ASN.1 integer value. |
234 | */ |
235 | static const char *int2str(const char *beg, const char *end) |
236 | { |
237 | unsigned long val = 0; |
238 | size_t n = end - beg; |
239 | |
240 | if(!n) |
241 | return NULL; |
242 | |
243 | if(n > 4) |
244 | return octet2str(beg, end); |
245 | |
246 | /* Represent integers <= 32-bit as a single value. */ |
247 | if(*beg & 0x80) |
248 | val = ~val; |
249 | |
250 | do |
251 | val = (val << 8) | *(const unsigned char *) beg++; |
252 | while(beg < end); |
253 | return curl_maprintf("%s%lx" , val >= 10? "0x" : "" , val); |
254 | } |
255 | |
256 | /* |
257 | * Perform a lazy conversion from an ASN.1 typed string to UTF8. Allocate the |
258 | * destination buffer dynamically. The allocation size will normally be too |
259 | * large: this is to avoid buffer overflows. |
260 | * Terminate the string with a nul byte and return the converted |
261 | * string length. |
262 | */ |
263 | static ssize_t |
264 | utf8asn1str(char **to, int type, const char *from, const char *end) |
265 | { |
266 | size_t inlength = end - from; |
267 | int size = 1; |
268 | size_t outlength; |
269 | char *buf; |
270 | |
271 | *to = NULL; |
272 | switch(type) { |
273 | case CURL_ASN1_BMP_STRING: |
274 | size = 2; |
275 | break; |
276 | case CURL_ASN1_UNIVERSAL_STRING: |
277 | size = 4; |
278 | break; |
279 | case CURL_ASN1_NUMERIC_STRING: |
280 | case CURL_ASN1_PRINTABLE_STRING: |
281 | case CURL_ASN1_TELETEX_STRING: |
282 | case CURL_ASN1_IA5_STRING: |
283 | case CURL_ASN1_VISIBLE_STRING: |
284 | case CURL_ASN1_UTF8_STRING: |
285 | break; |
286 | default: |
287 | return -1; /* Conversion not supported. */ |
288 | } |
289 | |
290 | if(inlength % size) |
291 | return -1; /* Length inconsistent with character size. */ |
292 | if(inlength / size > (SIZE_T_MAX - 1) / 4) |
293 | return -1; /* Too big. */ |
294 | buf = malloc(4 * (inlength / size) + 1); |
295 | if(!buf) |
296 | return -1; /* Not enough memory. */ |
297 | |
298 | if(type == CURL_ASN1_UTF8_STRING) { |
299 | /* Just copy. */ |
300 | outlength = inlength; |
301 | if(outlength) |
302 | memcpy(buf, from, outlength); |
303 | } |
304 | else { |
305 | for(outlength = 0; from < end;) { |
306 | int charsize; |
307 | unsigned int wc; |
308 | |
309 | wc = 0; |
310 | switch(size) { |
311 | case 4: |
312 | wc = (wc << 8) | *(const unsigned char *) from++; |
313 | wc = (wc << 8) | *(const unsigned char *) from++; |
314 | /* FALLTHROUGH */ |
315 | case 2: |
316 | wc = (wc << 8) | *(const unsigned char *) from++; |
317 | /* FALLTHROUGH */ |
318 | default: /* case 1: */ |
319 | wc = (wc << 8) | *(const unsigned char *) from++; |
320 | } |
321 | charsize = 1; |
322 | if(wc >= 0x00000080) { |
323 | if(wc >= 0x00000800) { |
324 | if(wc >= 0x00010000) { |
325 | if(wc >= 0x00200000) { |
326 | free(buf); |
327 | return -1; /* Invalid char. size for target encoding. */ |
328 | } |
329 | buf[outlength + 3] = (char) (0x80 | (wc & 0x3F)); |
330 | wc = (wc >> 6) | 0x00010000; |
331 | charsize++; |
332 | } |
333 | buf[outlength + 2] = (char) (0x80 | (wc & 0x3F)); |
334 | wc = (wc >> 6) | 0x00000800; |
335 | charsize++; |
336 | } |
337 | buf[outlength + 1] = (char) (0x80 | (wc & 0x3F)); |
338 | wc = (wc >> 6) | 0x000000C0; |
339 | charsize++; |
340 | } |
341 | buf[outlength] = (char) wc; |
342 | outlength += charsize; |
343 | } |
344 | } |
345 | buf[outlength] = '\0'; |
346 | *to = buf; |
347 | return outlength; |
348 | } |
349 | |
350 | /* |
351 | * Convert an ASN.1 String into its UTF-8 string representation. |
352 | * Return the dynamically allocated string, or NULL if an error occurs. |
353 | */ |
354 | static const char *string2str(int type, const char *beg, const char *end) |
355 | { |
356 | char *buf; |
357 | if(utf8asn1str(&buf, type, beg, end) < 0) |
358 | return NULL; |
359 | return buf; |
360 | } |
361 | |
362 | /* |
363 | * Decimal ASCII encode unsigned integer `x' into the buflen sized buffer at |
364 | * buf. Return the total number of encoded digits, even if larger than |
365 | * `buflen'. |
366 | */ |
367 | static size_t encodeUint(char *buf, size_t buflen, unsigned int x) |
368 | { |
369 | size_t i = 0; |
370 | unsigned int y = x / 10; |
371 | |
372 | if(y) { |
373 | i = encodeUint(buf, buflen, y); |
374 | x -= y * 10; |
375 | } |
376 | if(i < buflen) |
377 | buf[i] = (char) ('0' + x); |
378 | i++; |
379 | if(i < buflen) |
380 | buf[i] = '\0'; /* Store a terminator if possible. */ |
381 | return i; |
382 | } |
383 | |
384 | /* |
385 | * Convert an ASN.1 OID into its dotted string representation. |
386 | * Store the result in th `n'-byte buffer at `buf'. |
387 | * Return the converted string length, or 0 on errors. |
388 | */ |
389 | static size_t encodeOID(char *buf, size_t buflen, |
390 | const char *beg, const char *end) |
391 | { |
392 | size_t i; |
393 | unsigned int x; |
394 | unsigned int y; |
395 | |
396 | /* Process the first two numbers. */ |
397 | y = *(const unsigned char *) beg++; |
398 | x = y / 40; |
399 | y -= x * 40; |
400 | i = encodeUint(buf, buflen, x); |
401 | if(i < buflen) |
402 | buf[i] = '.'; |
403 | i++; |
404 | if(i >= buflen) |
405 | i += encodeUint(NULL, 0, y); |
406 | else |
407 | i += encodeUint(buf + i, buflen - i, y); |
408 | |
409 | /* Process the trailing numbers. */ |
410 | while(beg < end) { |
411 | if(i < buflen) |
412 | buf[i] = '.'; |
413 | i++; |
414 | x = 0; |
415 | do { |
416 | if(x & 0xFF000000) |
417 | return 0; |
418 | y = *(const unsigned char *) beg++; |
419 | x = (x << 7) | (y & 0x7F); |
420 | } while(y & 0x80); |
421 | if(i >= buflen) |
422 | i += encodeUint(NULL, 0, x); |
423 | else |
424 | i += encodeUint(buf + i, buflen - i, x); |
425 | } |
426 | if(i < buflen) |
427 | buf[i] = '\0'; |
428 | return i; |
429 | } |
430 | |
431 | /* |
432 | * Convert an ASN.1 OID into its dotted or symbolic string representation. |
433 | * Return the dynamically allocated string, or NULL if an error occurs. |
434 | */ |
435 | |
436 | static const char *OID2str(const char *beg, const char *end, bool symbolic) |
437 | { |
438 | char *buf = NULL; |
439 | if(beg < end) { |
440 | size_t buflen = encodeOID(NULL, 0, beg, end); |
441 | if(buflen) { |
442 | buf = malloc(buflen + 1); /* one extra for the zero byte */ |
443 | if(buf) { |
444 | encodeOID(buf, buflen, beg, end); |
445 | buf[buflen] = '\0'; |
446 | |
447 | if(symbolic) { |
448 | const curl_OID *op = searchOID(buf); |
449 | if(op) { |
450 | free(buf); |
451 | buf = strdup(op->textoid); |
452 | } |
453 | } |
454 | } |
455 | } |
456 | } |
457 | return buf; |
458 | } |
459 | |
460 | static const char *GTime2str(const char *beg, const char *end) |
461 | { |
462 | const char *tzp; |
463 | const char *fracp; |
464 | char sec1, sec2; |
465 | size_t fracl; |
466 | size_t tzl; |
467 | const char *sep = "" ; |
468 | |
469 | /* Convert an ASN.1 Generalized time to a printable string. |
470 | Return the dynamically allocated string, or NULL if an error occurs. */ |
471 | |
472 | for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++) |
473 | ; |
474 | |
475 | /* Get seconds digits. */ |
476 | sec1 = '0'; |
477 | switch(fracp - beg - 12) { |
478 | case 0: |
479 | sec2 = '0'; |
480 | break; |
481 | case 2: |
482 | sec1 = fracp[-2]; |
483 | /* FALLTHROUGH */ |
484 | case 1: |
485 | sec2 = fracp[-1]; |
486 | break; |
487 | default: |
488 | return NULL; |
489 | } |
490 | |
491 | /* Scan for timezone, measure fractional seconds. */ |
492 | tzp = fracp; |
493 | fracl = 0; |
494 | if(fracp < end && (*fracp == '.' || *fracp == ',')) { |
495 | fracp++; |
496 | do |
497 | tzp++; |
498 | while(tzp < end && *tzp >= '0' && *tzp <= '9'); |
499 | /* Strip leading zeroes in fractional seconds. */ |
500 | for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--) |
501 | ; |
502 | } |
503 | |
504 | /* Process timezone. */ |
505 | if(tzp >= end) |
506 | ; /* Nothing to do. */ |
507 | else if(*tzp == 'Z') { |
508 | tzp = " GMT" ; |
509 | end = tzp + 4; |
510 | } |
511 | else { |
512 | sep = " " ; |
513 | tzp++; |
514 | } |
515 | |
516 | tzl = end - tzp; |
517 | return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s" , |
518 | beg, beg + 4, beg + 6, |
519 | beg + 8, beg + 10, sec1, sec2, |
520 | fracl? "." : "" , fracl, fracp, |
521 | sep, tzl, tzp); |
522 | } |
523 | |
524 | /* |
525 | * Convert an ASN.1 UTC time to a printable string. |
526 | * Return the dynamically allocated string, or NULL if an error occurs. |
527 | */ |
528 | static const char *UTime2str(const char *beg, const char *end) |
529 | { |
530 | const char *tzp; |
531 | size_t tzl; |
532 | const char *sec; |
533 | |
534 | for(tzp = beg; tzp < end && *tzp >= '0' && *tzp <= '9'; tzp++) |
535 | ; |
536 | /* Get the seconds. */ |
537 | sec = beg + 10; |
538 | switch(tzp - sec) { |
539 | case 0: |
540 | sec = "00" ; |
541 | case 2: |
542 | break; |
543 | default: |
544 | return NULL; |
545 | } |
546 | |
547 | /* Process timezone. */ |
548 | if(tzp >= end) |
549 | return NULL; |
550 | if(*tzp == 'Z') { |
551 | tzp = "GMT" ; |
552 | end = tzp + 3; |
553 | } |
554 | else |
555 | tzp++; |
556 | |
557 | tzl = end - tzp; |
558 | return curl_maprintf("%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s" , |
559 | 20 - (*beg >= '5'), beg, beg + 2, beg + 4, |
560 | beg + 6, beg + 8, sec, |
561 | tzl, tzp); |
562 | } |
563 | |
564 | /* |
565 | * Convert an ASN.1 element to a printable string. |
566 | * Return the dynamically allocated string, or NULL if an error occurs. |
567 | */ |
568 | static const char *ASN1tostr(curl_asn1Element *elem, int type) |
569 | { |
570 | if(elem->constructed) |
571 | return NULL; /* No conversion of structured elements. */ |
572 | |
573 | if(!type) |
574 | type = elem->tag; /* Type not forced: use element tag as type. */ |
575 | |
576 | switch(type) { |
577 | case CURL_ASN1_BOOLEAN: |
578 | return bool2str(elem->beg, elem->end); |
579 | case CURL_ASN1_INTEGER: |
580 | case CURL_ASN1_ENUMERATED: |
581 | return int2str(elem->beg, elem->end); |
582 | case CURL_ASN1_BIT_STRING: |
583 | return bit2str(elem->beg, elem->end); |
584 | case CURL_ASN1_OCTET_STRING: |
585 | return octet2str(elem->beg, elem->end); |
586 | case CURL_ASN1_NULL: |
587 | return strdup("" ); |
588 | case CURL_ASN1_OBJECT_IDENTIFIER: |
589 | return OID2str(elem->beg, elem->end, TRUE); |
590 | case CURL_ASN1_UTC_TIME: |
591 | return UTime2str(elem->beg, elem->end); |
592 | case CURL_ASN1_GENERALIZED_TIME: |
593 | return GTime2str(elem->beg, elem->end); |
594 | case CURL_ASN1_UTF8_STRING: |
595 | case CURL_ASN1_NUMERIC_STRING: |
596 | case CURL_ASN1_PRINTABLE_STRING: |
597 | case CURL_ASN1_TELETEX_STRING: |
598 | case CURL_ASN1_IA5_STRING: |
599 | case CURL_ASN1_VISIBLE_STRING: |
600 | case CURL_ASN1_UNIVERSAL_STRING: |
601 | case CURL_ASN1_BMP_STRING: |
602 | return string2str(type, elem->beg, elem->end); |
603 | } |
604 | |
605 | return NULL; /* Unsupported. */ |
606 | } |
607 | |
608 | /* |
609 | * ASCII encode distinguished name at `dn' into the `buflen'-sized buffer at |
610 | * `buf'. Return the total string length, even if larger than `buflen'. |
611 | */ |
612 | static ssize_t encodeDN(char *buf, size_t buflen, curl_asn1Element *dn) |
613 | { |
614 | curl_asn1Element rdn; |
615 | curl_asn1Element atv; |
616 | curl_asn1Element oid; |
617 | curl_asn1Element value; |
618 | size_t l = 0; |
619 | const char *p1; |
620 | const char *p2; |
621 | const char *p3; |
622 | const char *str; |
623 | |
624 | for(p1 = dn->beg; p1 < dn->end;) { |
625 | p1 = getASN1Element(&rdn, p1, dn->end); |
626 | if(!p1) |
627 | return -1; |
628 | for(p2 = rdn.beg; p2 < rdn.end;) { |
629 | p2 = getASN1Element(&atv, p2, rdn.end); |
630 | if(!p2) |
631 | return -1; |
632 | p3 = getASN1Element(&oid, atv.beg, atv.end); |
633 | if(!p3) |
634 | return -1; |
635 | if(!getASN1Element(&value, p3, atv.end)) |
636 | return -1; |
637 | str = ASN1tostr(&oid, 0); |
638 | if(!str) |
639 | return -1; |
640 | |
641 | /* Encode delimiter. |
642 | If attribute has a short uppercase name, delimiter is ", ". */ |
643 | if(l) { |
644 | for(p3 = str; isupper(*p3); p3++) |
645 | ; |
646 | for(p3 = (*p3 || p3 - str > 2)? "/" : ", " ; *p3; p3++) { |
647 | if(l < buflen) |
648 | buf[l] = *p3; |
649 | l++; |
650 | } |
651 | } |
652 | |
653 | /* Encode attribute name. */ |
654 | for(p3 = str; *p3; p3++) { |
655 | if(l < buflen) |
656 | buf[l] = *p3; |
657 | l++; |
658 | } |
659 | free((char *) str); |
660 | |
661 | /* Generate equal sign. */ |
662 | if(l < buflen) |
663 | buf[l] = '='; |
664 | l++; |
665 | |
666 | /* Generate value. */ |
667 | str = ASN1tostr(&value, 0); |
668 | if(!str) |
669 | return -1; |
670 | for(p3 = str; *p3; p3++) { |
671 | if(l < buflen) |
672 | buf[l] = *p3; |
673 | l++; |
674 | } |
675 | free((char *) str); |
676 | } |
677 | } |
678 | |
679 | return l; |
680 | } |
681 | |
682 | /* |
683 | * Convert an ASN.1 distinguished name into a printable string. |
684 | * Return the dynamically allocated string, or NULL if an error occurs. |
685 | */ |
686 | static const char *DNtostr(curl_asn1Element *dn) |
687 | { |
688 | char *buf = NULL; |
689 | ssize_t buflen = encodeDN(NULL, 0, dn); |
690 | |
691 | if(buflen >= 0) { |
692 | buf = malloc(buflen + 1); |
693 | if(buf) { |
694 | encodeDN(buf, buflen + 1, dn); |
695 | buf[buflen] = '\0'; |
696 | } |
697 | } |
698 | return buf; |
699 | } |
700 | |
701 | /* |
702 | * ASN.1 parse an X509 certificate into structure subfields. |
703 | * Syntax is assumed to have already been checked by the SSL backend. |
704 | * See RFC 5280. |
705 | */ |
706 | int Curl_parseX509(curl_X509certificate *cert, |
707 | const char *beg, const char *end) |
708 | { |
709 | curl_asn1Element elem; |
710 | curl_asn1Element tbsCertificate; |
711 | const char *ccp; |
712 | static const char defaultVersion = 0; /* v1. */ |
713 | |
714 | cert->certificate.header = NULL; |
715 | cert->certificate.beg = beg; |
716 | cert->certificate.end = end; |
717 | |
718 | /* Get the sequence content. */ |
719 | if(!getASN1Element(&elem, beg, end)) |
720 | return -1; /* Invalid bounds/size. */ |
721 | beg = elem.beg; |
722 | end = elem.end; |
723 | |
724 | /* Get tbsCertificate. */ |
725 | beg = getASN1Element(&tbsCertificate, beg, end); |
726 | if(!beg) |
727 | return -1; |
728 | /* Skip the signatureAlgorithm. */ |
729 | beg = getASN1Element(&cert->signatureAlgorithm, beg, end); |
730 | if(!beg) |
731 | return -1; |
732 | /* Get the signatureValue. */ |
733 | if(!getASN1Element(&cert->signature, beg, end)) |
734 | return -1; |
735 | |
736 | /* Parse TBSCertificate. */ |
737 | beg = tbsCertificate.beg; |
738 | end = tbsCertificate.end; |
739 | /* Get optional version, get serialNumber. */ |
740 | cert->version.header = NULL; |
741 | cert->version.beg = &defaultVersion; |
742 | cert->version.end = &defaultVersion + sizeof(defaultVersion); |
743 | beg = getASN1Element(&elem, beg, end); |
744 | if(!beg) |
745 | return -1; |
746 | if(elem.tag == 0) { |
747 | if(!getASN1Element(&cert->version, elem.beg, elem.end)) |
748 | return -1; |
749 | beg = getASN1Element(&elem, beg, end); |
750 | if(!beg) |
751 | return -1; |
752 | } |
753 | cert->serialNumber = elem; |
754 | /* Get signature algorithm. */ |
755 | beg = getASN1Element(&cert->signatureAlgorithm, beg, end); |
756 | /* Get issuer. */ |
757 | beg = getASN1Element(&cert->issuer, beg, end); |
758 | if(!beg) |
759 | return -1; |
760 | /* Get notBefore and notAfter. */ |
761 | beg = getASN1Element(&elem, beg, end); |
762 | if(!beg) |
763 | return -1; |
764 | ccp = getASN1Element(&cert->notBefore, elem.beg, elem.end); |
765 | if(!ccp) |
766 | return -1; |
767 | if(!getASN1Element(&cert->notAfter, ccp, elem.end)) |
768 | return -1; |
769 | /* Get subject. */ |
770 | beg = getASN1Element(&cert->subject, beg, end); |
771 | if(!beg) |
772 | return -1; |
773 | /* Get subjectPublicKeyAlgorithm and subjectPublicKey. */ |
774 | beg = getASN1Element(&cert->subjectPublicKeyInfo, beg, end); |
775 | if(!beg) |
776 | return -1; |
777 | ccp = getASN1Element(&cert->subjectPublicKeyAlgorithm, |
778 | cert->subjectPublicKeyInfo.beg, |
779 | cert->subjectPublicKeyInfo.end); |
780 | if(!ccp) |
781 | return -1; |
782 | if(!getASN1Element(&cert->subjectPublicKey, ccp, |
783 | cert->subjectPublicKeyInfo.end)) |
784 | return -1; |
785 | /* Get optional issuerUiqueID, subjectUniqueID and extensions. */ |
786 | cert->issuerUniqueID.tag = cert->subjectUniqueID.tag = 0; |
787 | cert->extensions.tag = elem.tag = 0; |
788 | cert->issuerUniqueID.header = cert->subjectUniqueID.header = NULL; |
789 | cert->issuerUniqueID.beg = cert->issuerUniqueID.end = "" ; |
790 | cert->subjectUniqueID.beg = cert->subjectUniqueID.end = "" ; |
791 | cert->extensions.header = NULL; |
792 | cert->extensions.beg = cert->extensions.end = "" ; |
793 | if(beg < end) { |
794 | beg = getASN1Element(&elem, beg, end); |
795 | if(!beg) |
796 | return -1; |
797 | } |
798 | if(elem.tag == 1) { |
799 | cert->issuerUniqueID = elem; |
800 | if(beg < end) { |
801 | beg = getASN1Element(&elem, beg, end); |
802 | if(!beg) |
803 | return -1; |
804 | } |
805 | } |
806 | if(elem.tag == 2) { |
807 | cert->subjectUniqueID = elem; |
808 | if(beg < end) { |
809 | beg = getASN1Element(&elem, beg, end); |
810 | if(!beg) |
811 | return -1; |
812 | } |
813 | } |
814 | if(elem.tag == 3) |
815 | if(!getASN1Element(&cert->extensions, elem.beg, elem.end)) |
816 | return -1; |
817 | return 0; |
818 | } |
819 | |
820 | |
821 | /* |
822 | * Copy at most 64-characters, terminate with a newline and returns the |
823 | * effective number of stored characters. |
824 | */ |
825 | static size_t copySubstring(char *to, const char *from) |
826 | { |
827 | size_t i; |
828 | for(i = 0; i < 64; i++) { |
829 | to[i] = *from; |
830 | if(!*from++) |
831 | break; |
832 | } |
833 | |
834 | to[i++] = '\n'; |
835 | return i; |
836 | } |
837 | |
838 | static const char *dumpAlgo(curl_asn1Element *param, |
839 | const char *beg, const char *end) |
840 | { |
841 | curl_asn1Element oid; |
842 | |
843 | /* Get algorithm parameters and return algorithm name. */ |
844 | |
845 | beg = getASN1Element(&oid, beg, end); |
846 | if(!beg) |
847 | return NULL; |
848 | param->header = NULL; |
849 | param->tag = 0; |
850 | param->beg = param->end = end; |
851 | if(beg < end) |
852 | if(!getASN1Element(param, beg, end)) |
853 | return NULL; |
854 | return OID2str(oid.beg, oid.end, TRUE); |
855 | } |
856 | |
857 | static void do_pubkey_field(struct Curl_easy *data, int certnum, |
858 | const char *label, curl_asn1Element *elem) |
859 | { |
860 | const char *output; |
861 | |
862 | /* Generate a certificate information record for the public key. */ |
863 | |
864 | output = ASN1tostr(elem, 0); |
865 | if(output) { |
866 | if(data->set.ssl.certinfo) |
867 | Curl_ssl_push_certinfo(data, certnum, label, output); |
868 | if(!certnum) |
869 | infof(data, " %s: %s\n" , label, output); |
870 | free((char *) output); |
871 | } |
872 | } |
873 | |
874 | static void do_pubkey(struct Curl_easy *data, int certnum, |
875 | const char *algo, curl_asn1Element *param, |
876 | curl_asn1Element *pubkey) |
877 | { |
878 | curl_asn1Element elem; |
879 | curl_asn1Element pk; |
880 | const char *p; |
881 | |
882 | /* Generate all information records for the public key. */ |
883 | |
884 | /* Get the public key (single element). */ |
885 | if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end)) |
886 | return; |
887 | |
888 | if(strcasecompare(algo, "rsaEncryption" )) { |
889 | const char *q; |
890 | unsigned long len; |
891 | |
892 | p = getASN1Element(&elem, pk.beg, pk.end); |
893 | if(!p) |
894 | return; |
895 | |
896 | /* Compute key length. */ |
897 | for(q = elem.beg; !*q && q < elem.end; q++) |
898 | ; |
899 | len = (unsigned long)((elem.end - q) * 8); |
900 | if(len) { |
901 | unsigned int i; |
902 | for(i = *(unsigned char *) q; !(i & 0x80); i <<= 1) |
903 | len--; |
904 | } |
905 | if(len > 32) |
906 | elem.beg = q; /* Strip leading zero bytes. */ |
907 | if(!certnum) |
908 | infof(data, " RSA Public Key (%lu bits)\n" , len); |
909 | if(data->set.ssl.certinfo) { |
910 | q = curl_maprintf("%lu" , len); |
911 | if(q) { |
912 | Curl_ssl_push_certinfo(data, certnum, "RSA Public Key" , q); |
913 | free((char *) q); |
914 | } |
915 | } |
916 | /* Generate coefficients. */ |
917 | do_pubkey_field(data, certnum, "rsa(n)" , &elem); |
918 | if(!getASN1Element(&elem, p, pk.end)) |
919 | return; |
920 | do_pubkey_field(data, certnum, "rsa(e)" , &elem); |
921 | } |
922 | else if(strcasecompare(algo, "dsa" )) { |
923 | p = getASN1Element(&elem, param->beg, param->end); |
924 | if(p) { |
925 | do_pubkey_field(data, certnum, "dsa(p)" , &elem); |
926 | p = getASN1Element(&elem, p, param->end); |
927 | if(p) { |
928 | do_pubkey_field(data, certnum, "dsa(q)" , &elem); |
929 | if(getASN1Element(&elem, p, param->end)) { |
930 | do_pubkey_field(data, certnum, "dsa(g)" , &elem); |
931 | do_pubkey_field(data, certnum, "dsa(pub_key)" , &pk); |
932 | } |
933 | } |
934 | } |
935 | } |
936 | else if(strcasecompare(algo, "dhpublicnumber" )) { |
937 | p = getASN1Element(&elem, param->beg, param->end); |
938 | if(p) { |
939 | do_pubkey_field(data, certnum, "dh(p)" , &elem); |
940 | if(getASN1Element(&elem, param->beg, param->end)) { |
941 | do_pubkey_field(data, certnum, "dh(g)" , &elem); |
942 | do_pubkey_field(data, certnum, "dh(pub_key)" , &pk); |
943 | } |
944 | } |
945 | } |
946 | } |
947 | |
948 | CURLcode Curl_extract_certinfo(struct connectdata *conn, |
949 | int certnum, |
950 | const char *beg, |
951 | const char *end) |
952 | { |
953 | curl_X509certificate cert; |
954 | struct Curl_easy *data = conn->data; |
955 | curl_asn1Element param; |
956 | const char *ccp; |
957 | char *cp1; |
958 | size_t cl1; |
959 | char *cp2; |
960 | CURLcode result; |
961 | unsigned long version; |
962 | size_t i; |
963 | size_t j; |
964 | |
965 | if(!data->set.ssl.certinfo) |
966 | if(certnum) |
967 | return CURLE_OK; |
968 | |
969 | /* Prepare the certificate information for curl_easy_getinfo(). */ |
970 | |
971 | /* Extract the certificate ASN.1 elements. */ |
972 | if(Curl_parseX509(&cert, beg, end)) |
973 | return CURLE_PEER_FAILED_VERIFICATION; |
974 | |
975 | /* Subject. */ |
976 | ccp = DNtostr(&cert.subject); |
977 | if(!ccp) |
978 | return CURLE_OUT_OF_MEMORY; |
979 | if(data->set.ssl.certinfo) |
980 | Curl_ssl_push_certinfo(data, certnum, "Subject" , ccp); |
981 | if(!certnum) |
982 | infof(data, "%2d Subject: %s\n" , certnum, ccp); |
983 | free((char *) ccp); |
984 | |
985 | /* Issuer. */ |
986 | ccp = DNtostr(&cert.issuer); |
987 | if(!ccp) |
988 | return CURLE_OUT_OF_MEMORY; |
989 | if(data->set.ssl.certinfo) |
990 | Curl_ssl_push_certinfo(data, certnum, "Issuer" , ccp); |
991 | if(!certnum) |
992 | infof(data, " Issuer: %s\n" , ccp); |
993 | free((char *) ccp); |
994 | |
995 | /* Version (always fits in less than 32 bits). */ |
996 | version = 0; |
997 | for(ccp = cert.version.beg; ccp < cert.version.end; ccp++) |
998 | version = (version << 8) | *(const unsigned char *) ccp; |
999 | if(data->set.ssl.certinfo) { |
1000 | ccp = curl_maprintf("%lx" , version); |
1001 | if(!ccp) |
1002 | return CURLE_OUT_OF_MEMORY; |
1003 | Curl_ssl_push_certinfo(data, certnum, "Version" , ccp); |
1004 | free((char *) ccp); |
1005 | } |
1006 | if(!certnum) |
1007 | infof(data, " Version: %lu (0x%lx)\n" , version + 1, version); |
1008 | |
1009 | /* Serial number. */ |
1010 | ccp = ASN1tostr(&cert.serialNumber, 0); |
1011 | if(!ccp) |
1012 | return CURLE_OUT_OF_MEMORY; |
1013 | if(data->set.ssl.certinfo) |
1014 | Curl_ssl_push_certinfo(data, certnum, "Serial Number" , ccp); |
1015 | if(!certnum) |
1016 | infof(data, " Serial Number: %s\n" , ccp); |
1017 | free((char *) ccp); |
1018 | |
1019 | /* Signature algorithm .*/ |
1020 | ccp = dumpAlgo(¶m, cert.signatureAlgorithm.beg, |
1021 | cert.signatureAlgorithm.end); |
1022 | if(!ccp) |
1023 | return CURLE_OUT_OF_MEMORY; |
1024 | if(data->set.ssl.certinfo) |
1025 | Curl_ssl_push_certinfo(data, certnum, "Signature Algorithm" , ccp); |
1026 | if(!certnum) |
1027 | infof(data, " Signature Algorithm: %s\n" , ccp); |
1028 | free((char *) ccp); |
1029 | |
1030 | /* Start Date. */ |
1031 | ccp = ASN1tostr(&cert.notBefore, 0); |
1032 | if(!ccp) |
1033 | return CURLE_OUT_OF_MEMORY; |
1034 | if(data->set.ssl.certinfo) |
1035 | Curl_ssl_push_certinfo(data, certnum, "Start Date" , ccp); |
1036 | if(!certnum) |
1037 | infof(data, " Start Date: %s\n" , ccp); |
1038 | free((char *) ccp); |
1039 | |
1040 | /* Expire Date. */ |
1041 | ccp = ASN1tostr(&cert.notAfter, 0); |
1042 | if(!ccp) |
1043 | return CURLE_OUT_OF_MEMORY; |
1044 | if(data->set.ssl.certinfo) |
1045 | Curl_ssl_push_certinfo(data, certnum, "Expire Date" , ccp); |
1046 | if(!certnum) |
1047 | infof(data, " Expire Date: %s\n" , ccp); |
1048 | free((char *) ccp); |
1049 | |
1050 | /* Public Key Algorithm. */ |
1051 | ccp = dumpAlgo(¶m, cert.subjectPublicKeyAlgorithm.beg, |
1052 | cert.subjectPublicKeyAlgorithm.end); |
1053 | if(!ccp) |
1054 | return CURLE_OUT_OF_MEMORY; |
1055 | if(data->set.ssl.certinfo) |
1056 | Curl_ssl_push_certinfo(data, certnum, "Public Key Algorithm" , ccp); |
1057 | if(!certnum) |
1058 | infof(data, " Public Key Algorithm: %s\n" , ccp); |
1059 | do_pubkey(data, certnum, ccp, ¶m, &cert.subjectPublicKey); |
1060 | free((char *) ccp); |
1061 | |
1062 | /* Signature. */ |
1063 | ccp = ASN1tostr(&cert.signature, 0); |
1064 | if(!ccp) |
1065 | return CURLE_OUT_OF_MEMORY; |
1066 | if(data->set.ssl.certinfo) |
1067 | Curl_ssl_push_certinfo(data, certnum, "Signature" , ccp); |
1068 | if(!certnum) |
1069 | infof(data, " Signature: %s\n" , ccp); |
1070 | free((char *) ccp); |
1071 | |
1072 | /* Generate PEM certificate. */ |
1073 | result = Curl_base64_encode(data, cert.certificate.beg, |
1074 | cert.certificate.end - cert.certificate.beg, |
1075 | &cp1, &cl1); |
1076 | if(result) |
1077 | return result; |
1078 | /* Compute the number of characters in final certificate string. Format is: |
1079 | -----BEGIN CERTIFICATE-----\n |
1080 | <max 64 base64 characters>\n |
1081 | . |
1082 | . |
1083 | . |
1084 | -----END CERTIFICATE-----\n |
1085 | */ |
1086 | i = 28 + cl1 + (cl1 + 64 - 1) / 64 + 26; |
1087 | cp2 = malloc(i + 1); |
1088 | if(!cp2) { |
1089 | free(cp1); |
1090 | return CURLE_OUT_OF_MEMORY; |
1091 | } |
1092 | /* Build the certificate string. */ |
1093 | i = copySubstring(cp2, "-----BEGIN CERTIFICATE-----" ); |
1094 | for(j = 0; j < cl1; j += 64) |
1095 | i += copySubstring(cp2 + i, cp1 + j); |
1096 | i += copySubstring(cp2 + i, "-----END CERTIFICATE-----" ); |
1097 | cp2[i] = '\0'; |
1098 | free(cp1); |
1099 | if(data->set.ssl.certinfo) |
1100 | Curl_ssl_push_certinfo(data, certnum, "Cert" , cp2); |
1101 | if(!certnum) |
1102 | infof(data, "%s\n" , cp2); |
1103 | free(cp2); |
1104 | return CURLE_OK; |
1105 | } |
1106 | |
1107 | #endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */ |
1108 | |
1109 | #if defined(USE_GSKIT) |
1110 | |
1111 | static const char *checkOID(const char *beg, const char *end, |
1112 | const char *oid) |
1113 | { |
1114 | curl_asn1Element e; |
1115 | const char *ccp; |
1116 | const char *p; |
1117 | bool matched; |
1118 | |
1119 | /* Check if first ASN.1 element at `beg' is the given OID. |
1120 | Return a pointer in the source after the OID if found, else NULL. */ |
1121 | |
1122 | ccp = getASN1Element(&e, beg, end); |
1123 | if(!ccp || e.tag != CURL_ASN1_OBJECT_IDENTIFIER) |
1124 | return NULL; |
1125 | |
1126 | p = OID2str(e.beg, e.end, FALSE); |
1127 | if(!p) |
1128 | return NULL; |
1129 | |
1130 | matched = !strcmp(p, oid); |
1131 | free((char *) p); |
1132 | return matched? ccp: NULL; |
1133 | } |
1134 | |
1135 | CURLcode Curl_verifyhost(struct connectdata *conn, |
1136 | const char *beg, const char *end) |
1137 | { |
1138 | struct Curl_easy *data = conn->data; |
1139 | curl_X509certificate cert; |
1140 | curl_asn1Element dn; |
1141 | curl_asn1Element elem; |
1142 | curl_asn1Element ext; |
1143 | curl_asn1Element name; |
1144 | const char *p; |
1145 | const char *q; |
1146 | char *dnsname; |
1147 | int matched = -1; |
1148 | size_t addrlen = (size_t) -1; |
1149 | ssize_t len; |
1150 | const char * const hostname = SSL_IS_PROXY()? conn->http_proxy.host.name: |
1151 | conn->host.name; |
1152 | const char * const dispname = SSL_IS_PROXY()? |
1153 | conn->http_proxy.host.dispname: |
1154 | conn->host.dispname; |
1155 | #ifdef ENABLE_IPV6 |
1156 | struct in6_addr addr; |
1157 | #else |
1158 | struct in_addr addr; |
1159 | #endif |
1160 | |
1161 | /* Verify that connection server matches info in X509 certificate at |
1162 | `beg'..`end'. */ |
1163 | |
1164 | if(!SSL_CONN_CONFIG(verifyhost)) |
1165 | return CURLE_OK; |
1166 | |
1167 | if(Curl_parseX509(&cert, beg, end)) |
1168 | return CURLE_PEER_FAILED_VERIFICATION; |
1169 | |
1170 | /* Get the server IP address. */ |
1171 | #ifdef ENABLE_IPV6 |
1172 | if(conn->bits.ipv6_ip && Curl_inet_pton(AF_INET6, hostname, &addr)) |
1173 | addrlen = sizeof(struct in6_addr); |
1174 | else |
1175 | #endif |
1176 | if(Curl_inet_pton(AF_INET, hostname, &addr)) |
1177 | addrlen = sizeof(struct in_addr); |
1178 | |
1179 | /* Process extensions. */ |
1180 | for(p = cert.extensions.beg; p < cert.extensions.end && matched != 1;) { |
1181 | p = getASN1Element(&ext, p, cert.extensions.end); |
1182 | if(!p) |
1183 | return CURLE_PEER_FAILED_VERIFICATION; |
1184 | |
1185 | /* Check if extension is a subjectAlternativeName. */ |
1186 | ext.beg = checkOID(ext.beg, ext.end, sanOID); |
1187 | if(ext.beg) { |
1188 | ext.beg = getASN1Element(&elem, ext.beg, ext.end); |
1189 | if(!ext.beg) |
1190 | return CURLE_PEER_FAILED_VERIFICATION; |
1191 | /* Skip critical if present. */ |
1192 | if(elem.tag == CURL_ASN1_BOOLEAN) { |
1193 | ext.beg = getASN1Element(&elem, ext.beg, ext.end); |
1194 | if(!ext.beg) |
1195 | return CURLE_PEER_FAILED_VERIFICATION; |
1196 | } |
1197 | /* Parse the octet string contents: is a single sequence. */ |
1198 | if(!getASN1Element(&elem, elem.beg, elem.end)) |
1199 | return CURLE_PEER_FAILED_VERIFICATION; |
1200 | /* Check all GeneralNames. */ |
1201 | for(q = elem.beg; matched != 1 && q < elem.end;) { |
1202 | q = getASN1Element(&name, q, elem.end); |
1203 | if(!q) |
1204 | break; |
1205 | switch(name.tag) { |
1206 | case 2: /* DNS name. */ |
1207 | len = utf8asn1str(&dnsname, CURL_ASN1_IA5_STRING, |
1208 | name.beg, name.end); |
1209 | if(len > 0 && (size_t)len == strlen(dnsname)) |
1210 | matched = Curl_cert_hostcheck(dnsname, hostname); |
1211 | else |
1212 | matched = 0; |
1213 | free(dnsname); |
1214 | break; |
1215 | |
1216 | case 7: /* IP address. */ |
1217 | matched = (size_t) (name.end - name.beg) == addrlen && |
1218 | !memcmp(&addr, name.beg, addrlen); |
1219 | break; |
1220 | } |
1221 | } |
1222 | } |
1223 | } |
1224 | |
1225 | switch(matched) { |
1226 | case 1: |
1227 | /* an alternative name matched the server hostname */ |
1228 | infof(data, "\t subjectAltName: %s matched\n" , dispname); |
1229 | return CURLE_OK; |
1230 | case 0: |
1231 | /* an alternative name field existed, but didn't match and then |
1232 | we MUST fail */ |
1233 | infof(data, "\t subjectAltName does not match %s\n" , dispname); |
1234 | return CURLE_PEER_FAILED_VERIFICATION; |
1235 | } |
1236 | |
1237 | /* Process subject. */ |
1238 | name.header = NULL; |
1239 | name.beg = name.end = "" ; |
1240 | q = cert.subject.beg; |
1241 | /* we have to look to the last occurrence of a commonName in the |
1242 | distinguished one to get the most significant one. */ |
1243 | while(q < cert.subject.end) { |
1244 | q = getASN1Element(&dn, q, cert.subject.end); |
1245 | if(!q) |
1246 | break; |
1247 | for(p = dn.beg; p < dn.end;) { |
1248 | p = getASN1Element(&elem, p, dn.end); |
1249 | if(!p) |
1250 | return CURLE_PEER_FAILED_VERIFICATION; |
1251 | /* We have a DN's AttributeTypeAndValue: check it in case it's a CN. */ |
1252 | elem.beg = checkOID(elem.beg, elem.end, cnOID); |
1253 | if(elem.beg) |
1254 | name = elem; /* Latch CN. */ |
1255 | } |
1256 | } |
1257 | |
1258 | /* Check the CN if found. */ |
1259 | if(!getASN1Element(&elem, name.beg, name.end)) |
1260 | failf(data, "SSL: unable to obtain common name from peer certificate" ); |
1261 | else { |
1262 | len = utf8asn1str(&dnsname, elem.tag, elem.beg, elem.end); |
1263 | if(len < 0) { |
1264 | free(dnsname); |
1265 | return CURLE_OUT_OF_MEMORY; |
1266 | } |
1267 | if(strlen(dnsname) != (size_t) len) /* Nul byte in string ? */ |
1268 | failf(data, "SSL: illegal cert name field" ); |
1269 | else if(Curl_cert_hostcheck((const char *) dnsname, hostname)) { |
1270 | infof(data, "\t common name: %s (matched)\n" , dnsname); |
1271 | free(dnsname); |
1272 | return CURLE_OK; |
1273 | } |
1274 | else |
1275 | failf(data, "SSL: certificate subject name '%s' does not match " |
1276 | "target host name '%s'" , dnsname, dispname); |
1277 | free(dnsname); |
1278 | } |
1279 | |
1280 | return CURLE_PEER_FAILED_VERIFICATION; |
1281 | } |
1282 | |
1283 | #endif /* USE_GSKIT */ |
1284 | |