/*
* Create a CRL_Entry
*/
CRL_Entry::CRL_Entry(const X509_Certificate& cert, CRL_Code why) :
throw_on_unknown_critical(false)
{
serial = cert.serial_number();
time = X509_Time(system_time());
reason = why;
}
Request::Request(const X509_Certificate& issuer_cert,
const X509_Certificate& subject_cert) :
m_issuer(issuer_cert),
m_certid(m_issuer, BigInt::decode(subject_cert.serial_number()))
{
if(subject_cert.issuer_dn() != issuer_cert.subject_dn())
throw Invalid_Argument("Invalid cert pair to OCSP::Request (mismatched issuer,subject args?)");
}
/*
* Create a CRL_Entry
*/
CRL_Entry::CRL_Entry(const X509_Certificate& cert, CRL_Code why)
{
m_data.reset(new CRL_Entry_Data);
m_data->m_serial = cert.serial_number();
m_data->m_time = X509_Time(std::chrono::system_clock::now());
m_data->m_reason = why;
if(why != UNSPECIFIED)
{
m_data->m_extensions.add(new Cert_Extension::CRL_ReasonCode(why));
}
}
CertID::CertID(const X509_Certificate& issuer,
const X509_Certificate& subject)
{
/*
In practice it seems some responders, including, notably,
ocsp.verisign.com, will reject anything but SHA-1 here
*/
std::unique_ptr<HashFunction> hash(HashFunction::create("SHA-160"));
m_hash_id = AlgorithmIdentifier(hash->name(), AlgorithmIdentifier::USE_NULL_PARAM);
m_issuer_key_hash = unlock(hash->process(issuer.subject_public_key_bitstring()));
m_issuer_dn_hash = unlock(hash->process(subject.raw_issuer_dn()));
m_subject_serial = BigInt::decode(subject.serial_number());
}
Response online_check(const X509_Certificate& issuer,
const X509_Certificate& subject,
Certificate_Store* trusted_roots,
std::chrono::milliseconds timeout)
{
if(subject.issuer_dn() != issuer.subject_dn())
throw Invalid_Argument("Invalid cert pair to OCSP::online_check (mismatched issuer,subject args?)");
return online_check(issuer,
BigInt::decode(subject.serial_number()),
subject.ocsp_responder(),
trusted_roots,
timeout);
}
bool CertID::is_id_for(const X509_Certificate& issuer,
const X509_Certificate& subject) const
{
try
{
if(BigInt::decode(subject.serial_number()) != m_subject_serial)
return false;
std::unique_ptr<HashFunction> hash(HashFunction::create(OIDS::lookup(m_hash_id.oid)));
if(m_issuer_dn_hash != unlock(hash->process(subject.raw_issuer_dn())))
return false;
if(m_issuer_key_hash != unlock(hash->process(issuer.subject_public_key_bitstring())))
return false;
}
catch(...)
{
return false;
}
return true;
}
/**
* Check if this particular certificate is listed in the CRL
*/
bool X509_CRL::is_revoked(const X509_Certificate& cert) const
{
/*
If the cert wasn't issued by the CRL issuer, it's possible the cert
is revoked, but not by this CRL. Maybe throw an exception instead?
*/
if(cert.issuer_dn() != issuer_dn())
return false;
std::vector<uint8_t> crl_akid = authority_key_id();
std::vector<uint8_t> cert_akid = cert.authority_key_id();
if(!crl_akid.empty() && !cert_akid.empty())
{
if(crl_akid != cert_akid)
return false;
}
std::vector<uint8_t> cert_serial = cert.serial_number();
bool is_revoked = false;
// FIXME would be nice to avoid a linear scan here - maybe sort the entries?
for(const CRL_Entry& entry : get_revoked())
{
if(cert_serial == entry.serial_number())
{
if(entry.reason_code() == REMOVE_FROM_CRL)
is_revoked = false;
else
is_revoked = true;
}
}
return is_revoked;
}
/*
* Match by issuer and serial number
*/
bool IandS_Match::match(const X509_Certificate& cert) const
{
if(cert.serial_number() != serial)
return false;
return (cert.issuer_dn() == issuer);
}
