VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/x509-sanity.cpp@ 64797

Last change on this file since 64797 was 62564, checked in by vboxsync, 9 years ago

IPRT: Mark unused parameters.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 7.2 KB
Line 
1/* $Id: x509-sanity.cpp 62564 2016-07-26 14:43:03Z vboxsync $ */
2/** @file
3 * IPRT - Crypto - X.509, Sanity Checkers.
4 */
5
6/*
7 * Copyright (C) 2006-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#include "internal/iprt.h"
32#include <iprt/crypto/x509.h>
33
34#include <iprt/err.h>
35#include <iprt/string.h>
36
37#include "x509-internal.h"
38
39
40
41static int rtCrX509Validity_CheckSanityExtra(PCRTCRX509VALIDITY pThis, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag)
42{
43 RT_NOREF_PV(fFlags);
44
45 if (RTAsn1Time_Compare(&pThis->NotBefore, &pThis->NotAfter) > 0)
46 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_VALIDITY_SWAPPED, "%s: NotBefore is after NotAfter", pszErrorTag);
47 /** @todo check tag constraints? */
48 return VINF_SUCCESS;
49}
50
51
52static int rtCrX509Name_CheckSanityExtra(PCRTCRX509NAME pThis, uint32_t fFlags, PRTERRINFO pErrInfo, const char *pszErrorTag)
53{
54 RT_NOREF_PV(fFlags);
55
56 if (pThis->cItems == 0)
57 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_EMPTY_SET, "%s: Has no components.", pszErrorTag);
58
59 for (uint32_t i = 0; i < pThis->cItems; i++)
60 {
61 if (pThis->cItems == 0)
62 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_EMPTY_SUB_SET,
63 "%s: Items[%u] has no sub components.", pszErrorTag, i);
64
65 for (uint32_t j = 0; j < pThis->paItems[i].cItems; j++)
66 {
67 if (pThis->paItems[i].paItems[j].Value.enmType != RTASN1TYPE_STRING)
68 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_NOT_STRING,
69 "%s: Items[%u].paItems[%u].enmType is %d instead of string (%d).",
70 pszErrorTag, i, j, pThis->paItems[i].paItems[j].Value.enmType, RTASN1TYPE_STRING);
71 if (pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.cb == 0)
72 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_EMPTY_STRING,
73 "%s: Items[%u].paItems[%u] is an empty string", pszErrorTag, i, j);
74 switch (pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.uTag)
75 {
76 case ASN1_TAG_PRINTABLE_STRING:
77 case ASN1_TAG_UTF8_STRING:
78 break;
79 case ASN1_TAG_T61_STRING:
80 case ASN1_TAG_UNIVERSAL_STRING:
81 case ASN1_TAG_BMP_STRING:
82 break;
83 case ASN1_TAG_IA5_STRING: /* Used by "Microsoft Root Certificate Authority" in the "com" part of the Issuer. */
84 break;
85 default:
86 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_INVALID_NAME_STRING_TAG,
87 "%s: Items[%u].paItems[%u] invalid string type: %u", pszErrorTag, i, j,
88 pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.uTag);
89 }
90 }
91 }
92
93 return VINF_SUCCESS;
94}
95
96
97static int rtCrX509SubjectPublicKeyInfo_CheckSanityExtra(PCRTCRX509SUBJECTPUBLICKEYINFO pThis, uint32_t fFlags,
98 PRTERRINFO pErrInfo, const char *pszErrorTag)
99{
100 RT_NOREF_PV(fFlags);
101 if (pThis->SubjectPublicKey.cBits <= 32)
102 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_PUBLIC_KEY_TOO_SMALL,
103 "%s: SubjectPublicKey is too small, only %u bits", pszErrorTag, pThis->SubjectPublicKey.cBits);
104 return VINF_SUCCESS;
105}
106
107
108static int rtCrX509TbsCertificate_CheckSanityExtra(PCRTCRX509TBSCERTIFICATE pThis, uint32_t fFlags,
109 PRTERRINFO pErrInfo, const char *pszErrorTag)
110{
111 RT_NOREF_PV(fFlags);
112
113 if ( RTAsn1Integer_IsPresent(&pThis->T0.Version)
114 && RTAsn1Integer_UnsignedCompareWithU32(&pThis->T0.Version, RTCRX509TBSCERTIFICATE_V1) != 0
115 && RTAsn1Integer_UnsignedCompareWithU32(&pThis->T0.Version, RTCRX509TBSCERTIFICATE_V2) != 0
116 && RTAsn1Integer_UnsignedCompareWithU32(&pThis->T0.Version, RTCRX509TBSCERTIFICATE_V3) != 0)
117 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_TBSCERT_UNSUPPORTED_VERSION,
118 "%s: Unknown Version number: %llu",
119 pszErrorTag, pThis->T0.Version.uValue.u);
120
121 if ( pThis->SerialNumber.Asn1Core.cb < 1
122 || pThis->SerialNumber.Asn1Core.cb > 1024)
123 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_TBSCERT_SERIAL_NUMBER_OUT_OF_BOUNDS,
124 "%s: Bad SerialNumber length: %u", pszErrorTag, pThis->SerialNumber.Asn1Core.cb);
125
126 if ( ( RTAsn1BitString_IsPresent(&pThis->T1.IssuerUniqueId)
127 || RTAsn1BitString_IsPresent(&pThis->T2.SubjectUniqueId))
128 && RTAsn1Integer_UnsignedCompareWithU32(&pThis->T0.Version, RTCRX509TBSCERTIFICATE_V2) < 0)
129 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_TBSCERT_UNIQUE_IDS_REQ_V2,
130 "%s: IssuerUniqueId and SubjectUniqueId requires version 2", pszErrorTag);
131
132 if ( RTCrX509Extensions_IsPresent(&pThis->T3.Extensions)
133 && RTAsn1Integer_UnsignedCompareWithU32(&pThis->T0.Version, RTCRX509TBSCERTIFICATE_V3) < 0)
134 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_TBSCERT_EXTS_REQ_V3, "%s: Extensions requires version 3", pszErrorTag);
135
136 return VINF_SUCCESS;
137}
138
139
140static int rtCrX509Certificate_CheckSanityExtra(PCRTCRX509CERTIFICATE pThis, uint32_t fFlags,
141 PRTERRINFO pErrInfo, const char *pszErrorTag)
142{
143 RT_NOREF_PV(fFlags);
144
145 if (RTCrX509AlgorithmIdentifier_Compare(&pThis->SignatureAlgorithm, &pThis->TbsCertificate.Signature) != 0)
146 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_CERT_TBS_SIGN_ALGO_MISMATCH,
147 "%s: SignatureAlgorithm (%s) does not match TbsCertificate.Signature (%s).", pszErrorTag,
148 pThis->SignatureAlgorithm.Algorithm.szObjId,
149 pThis->TbsCertificate.Signature.Algorithm.szObjId);
150 return VINF_SUCCESS;
151}
152
153
154/*
155 * Generate the code.
156 */
157#include <iprt/asn1-generator-sanity.h>
158
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette