Exemplo n.º 1
0
static gboolean
rsa_subject_public_key_from_attributes (GckAttributes *attrs,
                                        GNode *info_asn)
{
	const GckAttribute *modulus;
	const GckAttribute *exponent;
	GNode *key_asn;
	GNode *params_asn;
	GBytes *key;
	GBytes *usg;

	modulus = gck_attributes_find (attrs, CKA_MODULUS);
	exponent = gck_attributes_find (attrs, CKA_PUBLIC_EXPONENT);
	if (modulus == NULL || gck_attribute_is_invalid (modulus) ||
	    exponent == NULL || gck_attribute_is_invalid (exponent))
		return FALSE;

	key_asn = egg_asn1x_create (pk_asn1_tab, "RSAPublicKey");
	g_return_val_if_fail (key_asn, FALSE);

	params_asn = egg_asn1x_create (pk_asn1_tab, "RSAParameters");
	g_return_val_if_fail (params_asn, FALSE);

	usg = g_bytes_new_with_free_func (modulus->value, modulus->length,
	                                    gck_attributes_unref,
	                                    gck_attributes_ref (attrs));
	egg_asn1x_set_integer_as_usg (egg_asn1x_node (key_asn, "modulus", NULL), usg);
	g_bytes_unref (usg);

	usg = g_bytes_new_with_free_func (exponent->value, exponent->length,
	                                    gck_attributes_unref,
	                                    gck_attributes_ref (attrs));
	egg_asn1x_set_integer_as_usg (egg_asn1x_node (key_asn, "publicExponent", NULL), usg);
	g_bytes_unref (usg);

	key = egg_asn1x_encode (key_asn, NULL);
	egg_asn1x_destroy (key_asn);

	egg_asn1x_set_null (params_asn);

	egg_asn1x_set_bits_as_raw (egg_asn1x_node (info_asn, "subjectPublicKey", NULL),
	                           key, g_bytes_get_size (key) * 8);

	egg_asn1x_set_oid_as_quark (egg_asn1x_node (info_asn, "algorithm", "algorithm", NULL), GCR_OID_PKIX1_RSA);
	egg_asn1x_set_any_from (egg_asn1x_node (info_asn, "algorithm", "parameters", NULL), params_asn);

	egg_asn1x_destroy (params_asn);
	g_bytes_unref (key);
	return TRUE;
}
Exemplo n.º 2
0
guchar*
gkm_data_der_write_private_key_dsa_part (gcry_sexp_t skey, gsize *n_key)
{
	GNode *asn = NULL;
	gcry_mpi_t x;
	guchar *result = NULL;

	x = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "DSAPrivatePart");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (skey, &x, "dsa", "x", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (asn, x))
		goto done;

	result = egg_asn1x_encode (asn, egg_secure_realloc, n_key);
	if (result == NULL)
		g_warning ("couldn't encode private dsa key: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (x);

	return result;
}
Exemplo n.º 3
0
guchar*
gkm_data_der_write_public_key_rsa (gcry_sexp_t s_key, gsize *len)
{
	GNode *asn = NULL;
	gcry_mpi_t n, e;
	guchar *result = NULL;

	n = e = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "RSAPublicKey");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (s_key, &n, "rsa", "n", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &e, "rsa", "e", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "modulus", NULL), n) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "publicExponent", NULL), e))
		goto done;

	result = egg_asn1x_encode (asn, NULL, len);
	if (result == NULL)
		g_warning ("couldn't encode public rsa key: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (n);
	gcry_mpi_release (e);

	return result;
}
Exemplo n.º 4
0
static void
test_some_asn1_stuff (const ASN1_ARRAY_TYPE *defs, const gchar *file, const gchar *identifier)
{
	GNode *asn;
	gpointer data, encoded;
	gsize n_data, n_encoded;

	if (!g_file_get_contents (file, (gchar**)&data, &n_data, NULL))
		g_assert_not_reached ();
	asn = egg_asn1x_create (defs, identifier);
	egg_asn1x_dump (asn);

	if (!egg_asn1x_decode (asn, data, n_data))
		g_warning ("decode of %s failed: %s", identifier, egg_asn1x_message (asn));

	encoded = egg_asn1x_encode (asn, NULL, &n_encoded);
	if (encoded == NULL)
		g_warning ("encode of %s failed: %s", identifier, egg_asn1x_message (asn));

	/* Decode the encoding */
	if (!egg_asn1x_decode (asn, encoded, n_encoded))
		g_warning ("decode of encoded %s failed: %s", identifier, egg_asn1x_message (asn));

	egg_asn1x_clear (asn);
	egg_asn1x_destroy (asn);
	g_free (encoded);
	g_free (data);
}
Exemplo n.º 5
0
static gboolean
validate_der (CK_ATTRIBUTE_PTR attr, const gchar *asn_type)
{
	GNode *asn;
	gboolean valid = TRUE;
	GBytes *data;

	if (!attr->pValue || attr->ulValueLen == (CK_ULONG)-1)
		return FALSE;

	asn = egg_asn1x_create (pkix_asn1_tab, asn_type);
	g_return_val_if_fail (asn, FALSE);

	data = g_bytes_new_static (attr->pValue, attr->ulValueLen);
	valid = egg_asn1x_decode (asn, data);
	g_bytes_unref (data);

	if (!valid)
		g_message ("failed to parse certificate passed to trust assertion: %s",
		           egg_asn1x_message (asn));

	/* Yes, this is an expensive check, but worthwhile */
	egg_asn1x_destroy (asn);
	return valid;
}
Exemplo n.º 6
0
static GkmXdgTrust*
create_trust_for_complete (GkmModule *module, GkmManager *manager,
                              CK_ATTRIBUTE_PTR cert)
{
	GkmXdgTrust *trust;
	GNode *asn, *ref, *node;
	GBytes *bytes;

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_val_if_fail (asn, NULL);

	ref = egg_asn1x_node (asn, "reference", NULL);
	node = egg_asn1x_node (ref, "certComplete", NULL);

	egg_asn1x_set_choice (ref, node);
	bytes = g_bytes_new (cert->pValue, cert->ulValueLen);
	egg_asn1x_set_any_raw (node, bytes);
	g_bytes_unref (bytes);

	trust = g_object_new (GKM_XDG_TYPE_TRUST, "module", module, "manager", manager, NULL);
	trust->pv->asn = asn;

	/* Encode it, which validates, and so we have read access to all the data */
	trust->pv->bytes = egg_asn1x_encode (asn, NULL);
	if (!trust->pv->bytes) {
		g_warning ("created invalid trust object: %s", egg_asn1x_message (asn));
		return NULL;
	}

	return trust;
}
Exemplo n.º 7
0
static void
test_decode_encode (Test *test,
                    gconstpointer data)
{
	const Fixture *fixture = data;
	GNode *asn;
	GBytes *encoded;
	gboolean ret;

	asn = egg_asn1x_create (fixture->defs, fixture->identifier);

	if (g_test_verbose ())
		egg_asn1x_dump (asn);

	ret = egg_asn1x_decode (asn, test->data);
	egg_asn1x_assert (ret == TRUE, asn);

	encoded = egg_asn1x_encode (asn, NULL);
	egg_asn1x_assert (encoded != NULL, asn);

	/* Decode the encoding */
	ret = egg_asn1x_decode (asn, encoded);
	egg_asn1x_assert (ret == TRUE, asn);

	egg_asn1x_clear (asn);
	egg_asn1x_destroy (asn);
	g_bytes_unref (encoded);
}
Exemplo n.º 8
0
static gboolean
gkm_xdg_trust_real_load (GkmSerializable *base,
                         GkmSecret *login,
                         GBytes *data)
{
	GkmXdgTrust *self = GKM_XDG_TRUST (base);
	GNode *asn = NULL;

	if (g_bytes_get_size (data) == 0)
		return FALSE;

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_val_if_fail (asn, FALSE);

	if (!egg_asn1x_decode (asn, data)) {
		g_warning ("couldn't parse trust data: %s", egg_asn1x_message (asn));
		egg_asn1x_destroy (asn);
		return FALSE;
	}

	/* Next parse out all the pairs */
	if (!load_assertions (self, asn)) {
		egg_asn1x_destroy (asn);
		return FALSE;
	}

	/* Take ownership of this new data */
	if (self->pv->bytes)
		g_bytes_unref (self->pv->bytes);
	self->pv->bytes = g_bytes_ref (data);
	egg_asn1x_destroy (self->pv->asn);
	self->pv->asn = asn;

	return TRUE;
}
Exemplo n.º 9
0
guchar*
gkm_data_der_write_private_key_dsa_params (gcry_sexp_t skey, gsize *n_params)
{
	GNode *asn = NULL;
	gcry_mpi_t p, q, g;
	guchar *result = NULL;

	p = q = g = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "DSAParameters");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (skey, &p, "dsa", "p", NULL) ||
	    !gkm_sexp_extract_mpi (skey, &q, "dsa", "q", NULL) ||
	    !gkm_sexp_extract_mpi (skey, &g, "dsa", "g", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g))
		goto done;

	result = egg_asn1x_encode (asn, egg_secure_realloc, n_params);
	if (result == NULL)
		g_warning ("couldn't encode private dsa params: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (p);
	gcry_mpi_release (q);
	gcry_mpi_release (g);

	return result;
}
Exemplo n.º 10
0
static GkmXdgTrust*
create_trust_for_reference (GkmModule *module, GkmManager *manager,
                            CK_ATTRIBUTE_PTR serial, CK_ATTRIBUTE_PTR issuer)
{
	GkmXdgTrust *trust;
	GNode *asn, *ref, *node;

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_val_if_fail (asn, NULL);

	ref = egg_asn1x_node (asn, "reference", NULL);
	node = egg_asn1x_node (ref, "certReference", NULL);

	egg_asn1x_set_choice (ref, node);
	egg_asn1x_set_integer_as_raw (egg_asn1x_node (node, "serialNumber", NULL),
	                              g_memdup (serial->pValue, serial->ulValueLen),
	                              serial->ulValueLen, g_free);

	egg_asn1x_set_raw_element (egg_asn1x_node (node, "issuer", NULL),
	                           g_memdup (issuer->pValue, issuer->ulValueLen),
	                           issuer->ulValueLen, g_free);

	trust = g_object_new (GKM_XDG_TYPE_TRUST, "module", module, "manager", manager, NULL);
	trust->pv->asn = asn;

	/* Encode it, so we have read access to all the data */
	trust->pv->data = egg_asn1x_encode (asn, NULL, &trust->pv->n_data);
	if (!trust->pv->data) {
		g_warning ("created invalid trust object: %s", egg_asn1x_message (asn));
		return NULL;
	}

	return trust;
}
Exemplo n.º 11
0
static void
create_trust_file_for_certificate (const gchar *filename, const gchar *certificate)
{
	GError *err = NULL;
	GNode *asn, *cert, *choice, *ref;
	GBytes *bytes, *result;
	gchar *data;
	gsize n_data;

	if (!g_file_get_contents (certificate, &data, &n_data, &err))
		barf_and_die ("couldn't read certificate file", egg_error_message (err));

	/* Make sure the certificate is */
	cert = egg_asn1x_create (pkix_asn1_tab, "Certificate");
	g_return_if_fail (cert);

	bytes = g_bytes_new_take (data, n_data);
	if (!egg_asn1x_decode (cert, bytes))
		barf_and_die ("couldn't parse der certificate file", egg_asn1x_message (cert));

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_if_fail (asn);

	ref = egg_asn1x_node (asn, "reference", NULL);
	choice = egg_asn1x_node (ref, "certComplete", NULL);

	if (!egg_asn1x_set_choice (ref, choice) || !egg_asn1x_set_any_raw (choice, bytes))
		g_return_if_reached ();

	g_bytes_unref (bytes);

	result = egg_asn1x_encode (asn, NULL);
	if (result == NULL)
		barf_and_die ("couldn't encode the trust file", egg_asn1x_message (asn));

	egg_asn1x_destroy (asn);
	egg_asn1x_destroy (cert);

	if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL),
	                          g_bytes_get_size (result), &err))
		barf_and_die ("couldn't write trust file", egg_error_message (err));

	g_bytes_unref (result);
}
Exemplo n.º 12
0
guchar*
gkm_data_der_write_private_pkcs8_crypted (gcry_sexp_t skey, const gchar *password,
                                          gsize n_password, gsize *n_data)
{
	gcry_error_t gcry;
	gcry_cipher_hd_t cih;
	GNode *asn = NULL;
	guchar *key, *data;
	gsize n_key, block = 0;

	/* Encode the key in normal pkcs8 fashion */
	key = gkm_data_der_write_private_pkcs8_plain (skey, &n_key);
	if (key == NULL)
		return NULL;

	asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-8-EncryptedPrivateKeyInfo");
	g_return_val_if_fail (asn, NULL);

	/* Create a and write out a cipher used for encryption */
	cih = prepare_and_encode_pkcs8_cipher (asn, password, n_password, &block);
	g_return_val_if_fail (cih, NULL);

	/* Pad the block of data */
	if(block > 1) {
		gsize pad;
		guchar *padded;

		pad = block - (n_key % block);
		if (pad == 0)
			pad = block;
		padded = egg_secure_realloc (key, n_key + pad);
		memset (padded + n_key, pad, pad);
		key = padded;
		n_key += pad;
	}

	gcry = gcry_cipher_encrypt (cih, key, n_key, NULL, 0);
	g_return_val_if_fail (gcry == 0, NULL);

	gcry_cipher_close (cih);

	if (!egg_asn1x_set_string_as_raw (egg_asn1x_node (asn, "encryptedData", NULL),
	                                  key, n_key, egg_secure_free))
		g_return_val_if_reached (NULL);

	data = egg_asn1x_encode (asn, NULL, n_data);
	if (data == NULL)
		g_warning ("couldn't encode encrypted pkcs8 key: %s", egg_asn1x_message (asn));

	egg_asn1x_destroy (asn);
	return data;
}
Exemplo n.º 13
0
static void
gcr_certificate_request_constructed (GObject *obj)
{
	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);
	GNode *version;

	G_OBJECT_CLASS (gcr_certificate_request_parent_class)->constructed (obj);

	self->asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-10-CertificationRequest");
	g_return_if_fail (self->asn != NULL);

	/* Setup the version */
	version = egg_asn1x_node (self->asn, "certificationRequestInfo", "version", NULL);
	egg_asn1x_set_integer_as_ulong (version, 0);
}
Exemplo n.º 14
0
int
main(int argc, char* argv[])
{
	GError *err = NULL;
	gchar *contents;
	gsize n_contents;
	GNode *asn, *node;
	gint i, count;

	if (argc != 2) {
		g_printerr ("usage: dump-trust-file file\n");
		return 2;
	}

	if (!g_file_get_contents (argv[1], &contents, &n_contents, &err))
		barf_and_die ("couldn't load file", egg_error_message (err));

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_val_if_fail (asn, 1);

	if (!egg_asn1x_decode (asn, contents, n_contents))
		barf_and_die ("couldn't parse file", egg_asn1x_message (asn));

	/* Print out the certificate we refer to first */
	node = egg_asn1x_node (asn, "reference", "certReference", NULL);
	if (egg_asn1x_have (node)) {
		dump_certificate_reference (node);
	} else {
		node = egg_asn1x_node (asn, "reference", "certComplete", NULL);
		if (egg_asn1x_have (node))
			dump_certificate_complete (node);
		else
			barf_and_die ("unsupported certificate reference", NULL);
	}

	/* Then the assertions */
	count = egg_asn1x_count (egg_asn1x_node (asn, "assertions", NULL));
	for (i = 0; i < count; ++i) {
		node = egg_asn1x_node (asn, "assertions", i + 1, NULL);
		dump_assertion (node);
	}

	egg_asn1x_destroy (asn);
	g_free (contents);

	return 0;
}
Exemplo n.º 15
0
static void
test_pkcs12_decode (Test *test,
                    gconstpointer unused)
{
	GNode *asn;
	gboolean ret;

	asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-12-PFX");

	if (g_test_verbose ())
		egg_asn1x_dump (asn);

	ret = egg_asn1x_decode (asn, test->data);
	egg_asn1x_assert (ret == TRUE, asn);

	egg_asn1x_destroy (asn);
}
Exemplo n.º 16
0
GNode *
_gcr_subject_public_key_for_attributes (GckAttributes *attributes)
{
	gboolean ret = FALSE;
	gulong key_type;
	gulong klass;
	GNode *asn = NULL;

	if (!gck_attributes_find_ulong (attributes, CKA_CLASS, &klass)) {
		_gcr_debug ("no class in attributes");
		return NULL;
	}

	if (klass == CKO_CERTIFICATE) {
		return cert_subject_public_key_from_attributes (attributes);

	} else if (klass == CKO_PUBLIC_KEY || klass == CKO_PRIVATE_KEY) {
		if (!gck_attributes_find_ulong (attributes, CKA_KEY_TYPE, &key_type)) {
			_gcr_debug ("no key type in attributes");
			return NULL;
		}

		asn = egg_asn1x_create (pkix_asn1_tab, "SubjectPublicKeyInfo");
		g_return_val_if_fail (asn, NULL);

		if (key_type == CKK_RSA) {
			ret = rsa_subject_public_key_from_attributes (attributes, asn);

		} else if (key_type == CKK_DSA) {
			ret = dsa_subject_public_key_from_attributes (attributes, klass, asn);

		} else {
			_gcr_debug ("unsupported key type: %lu", key_type);
			ret = FALSE;
		}


		if (ret == FALSE) {
			egg_asn1x_destroy (asn);
			asn = NULL;
		}
	}

	return asn;
}
Exemplo n.º 17
0
static void
test_personal_name_invalid (Test *test,
                            gconstpointer unused)
{
	GNode *asn;
	gboolean ret;

	asn = egg_asn1x_create (pkix_asn1_tab, "PersonalName");

	if (g_test_verbose ())
		egg_asn1x_dump (asn);

	ret = egg_asn1x_decode (asn, test->data);
	g_assert (ret == FALSE);
	g_assert (strstr (egg_asn1x_message (asn), "content size is out of bounds") != NULL);

	egg_asn1x_destroy (asn);
}
Exemplo n.º 18
0
static void
test_asn1_bit_string (Test *test, gconstpointer unused)
{
	GNode *asn;
	GBytes *data;
	gboolean ret;
	GBytes *source, *target;
	gsize target_bits, source_bits;

	asn = egg_asn1x_create (test_asn1_tab, "TestBitString");
	g_assert ("asn test structure is null" && asn != NULL);

	/* Create a string */
	source = g_bytes_new (TEST_STRING, strlen(TEST_STRING));
	g_return_if_fail (source);
	source_bits = g_bytes_get_size(source)*8;

	/* Write the string out */
	ret = gkm_data_asn1_write_bit_string (egg_asn1x_node (asn, "data", NULL),
                                              source, source_bits);
	g_assert ("couldn't write string to asn1" && ret);

	/* Now encode the whole caboodle */
	data = egg_asn1x_encode (asn, NULL);
	g_assert ("encoding asn1 didn't work" && data != NULL);

	egg_asn1x_destroy (asn);

	/* Now decode it all nicely */
	asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestBitString", data);
	g_assert (asn != NULL);

	ret = gkm_data_asn1_read_bit_string (egg_asn1x_node (asn, "data", NULL),
                                             &target, &target_bits);
	egg_asn1x_destroy (asn);
	g_assert ("couldn't read bit string from asn1" && ret);
	g_assert ("bit string returned is null" && target != NULL);
	g_assert ("Source and target length differ" && target_bits == source_bits);
	g_assert ("Bit strings differ" && g_bytes_equal (source, target));

	g_bytes_unref (data);
	g_bytes_unref (source);
	g_bytes_unref (target);
}
Exemplo n.º 19
0
guchar*
gkm_data_der_write_private_key_dsa (gcry_sexp_t s_key, gsize *len)
{
	GNode *asn = NULL;
	gcry_mpi_t p, q, g, y, x;
	guchar *result = NULL;

	p = q = g = y = x = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "DSAPrivateKey");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (s_key, &p, "dsa", "p", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &q, "dsa", "q", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &g, "dsa", "g", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &y, "dsa", "y", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &x, "dsa", "x", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "Y", NULL), y) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "priv", NULL), x))
		goto done;

	if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0))
		goto done;

	result = egg_asn1x_encode (asn, egg_secure_realloc, len);
	if (result == NULL)
		g_warning ("couldn't encode private dsa key: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (p);
	gcry_mpi_release (q);
	gcry_mpi_release (g);
	gcry_mpi_release (y);
	gcry_mpi_release (x);

	return result;
}
Exemplo n.º 20
0
static void
add_trust_purpose_to_file (const gchar *filename, const gchar *purpose)
{
	GError *err = NULL;
	gchar *data;
	GBytes *result;
	gsize n_data;
	GNode *asn, *assertion;
	GBytes *bytes;

	if (!g_file_get_contents (filename, &data, &n_data, &err))
		barf_and_die ("couldn't read trust file", egg_error_message (err));

	/* Create up the trust structure */
	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_if_fail (asn);

	/* And parse it */
	bytes = g_bytes_new_take (data, n_data);
	if (!egg_asn1x_decode (asn, bytes))
		barf_and_die ("couldn't parse trust file", egg_asn1x_message (asn));
	g_bytes_unref (bytes);

	assertion = egg_asn1x_append (egg_asn1x_node (asn, "assertions", NULL));
	g_return_if_fail (assertion);

	if (!egg_asn1x_set_string_as_utf8 (egg_asn1x_node (assertion, "purpose", NULL), g_strdup (purpose), g_free))
		g_return_if_reached ();
	egg_asn1x_set_enumerated (egg_asn1x_node (assertion, "level", NULL), g_quark_from_string ("trusted"));

	result = egg_asn1x_encode (asn, NULL);
	if (result == NULL)
		barf_and_die ("couldn't encode trust file", egg_asn1x_message (asn));

	egg_asn1x_destroy (asn);

	if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL),
	                          g_bytes_get_size (result), &err))
		barf_and_die ("couldn't write trust file", egg_error_message (err));

	g_bytes_unref (result);
}
Exemplo n.º 21
0
static gboolean
gkm_xdg_trust_real_load (GkmSerializable *base, GkmSecret *login, gconstpointer data, gsize n_data)
{
	GkmXdgTrust *self = GKM_XDG_TRUST (base);
	GNode *asn = NULL;
	gpointer copy;

	g_return_val_if_fail (GKM_XDG_IS_TRUST (self), FALSE);
	g_return_val_if_fail (data, FALSE);

	if (n_data == 0)
		return FALSE;

	copy = g_memdup (data, n_data);

	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_val_if_fail (asn, FALSE);

	if (!egg_asn1x_decode (asn, copy, n_data)) {
		g_warning ("couldn't parse trust data: %s", egg_asn1x_message (asn));
		egg_asn1x_destroy (asn);
		g_free (copy);
		return FALSE;
	}

	/* Next parse out all the pairs */
	if (!load_assertions (self, asn)) {
		egg_asn1x_destroy (asn);
		g_free (copy);
		return FALSE;
	}

	/* Take ownership of this new data */
	g_free (self->pv->data);
	self->pv->data = copy;
	self->pv->n_data = n_data;
	egg_asn1x_destroy (self->pv->asn);
	self->pv->asn = asn;

	return TRUE;
}
Exemplo n.º 22
0
static void
dump_certificate_complete (GNode *asn)
{
	GNode *cert;
	gchar *issuer, *serial, *subject;
	gconstpointer element;
	gpointer data;
	gsize n_data, n_element;

	/* Parse the certificate out */
	cert = egg_asn1x_create (pkix_asn1_tab, "Certificate");
	g_return_if_fail (cert);
	element = egg_asn1x_get_raw_element (asn, &n_element);
	g_return_if_fail (element);
	if (!egg_asn1x_decode (cert, element, n_element))
		barf_and_die ("couldn't parse certificate", egg_asn1x_message (cert));

	issuer = egg_dn_read (egg_asn1x_node (asn, "issuer", NULL));
	g_return_if_fail (issuer);

	subject = egg_dn_read (egg_asn1x_node (asn, "subject", NULL));
	g_return_if_fail (subject);

	data = egg_asn1x_get_integer_as_raw (egg_asn1x_node (asn, "serial", NULL), NULL, &n_data);
	g_return_if_fail (data && n_data);
	serial = egg_hex_encode (data, n_data);
	g_free (data);

	g_print ("Complete\n");
	g_print ("    issuer: %s\n", issuer);
	g_print ("    subject: %s\n", subject);
	g_print ("    serial: 0x%s\n", serial);

	egg_asn1x_destroy (cert);

	g_free (data);
	g_free (serial);
	g_free (issuer);
	g_free (subject);
}
Exemplo n.º 23
0
static void
test_asn1_integers (Test *test, gconstpointer unused)
{
	GNode *asn;
	gcry_mpi_t mpi, mpt;
	GBytes *data;
	gboolean ret;

	asn = egg_asn1x_create (test_asn1_tab, "TestIntegers");
	g_assert ("asn test structure is null" && asn != NULL);

	/* Make a random number */
	mpi = gcry_mpi_new (512);
	g_return_if_fail (mpi);
	gcry_mpi_randomize (mpi, 512, GCRY_WEAK_RANDOM);

	/* Write the mpi out */
	ret = gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "mpi", NULL), mpi);
	g_assert ("couldn't write mpi to asn1" && ret);

	/* Now encode the whole caboodle */
	data = egg_asn1x_encode (asn, NULL);
	g_assert ("encoding asn1 didn't work" && data != NULL);

	egg_asn1x_destroy (asn);

	/* Now decode it all nicely */
	asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestIntegers", data);
	g_assert (asn != NULL);

	ret = gkm_data_asn1_read_mpi (egg_asn1x_node (asn, "mpi", NULL), &mpt);
	egg_asn1x_destroy (asn);
	g_assert ("couldn't read mpi from asn1" && ret);
	g_assert ("mpi returned is null" && mpt != NULL);
	g_assert ("mpi is wrong number" && gcry_mpi_cmp (mpi, mpt) == 0);

	g_bytes_unref (data);
	gcry_mpi_release (mpi);
	gcry_mpi_release (mpt);
}
Exemplo n.º 24
0
GBytes *
gkm_data_der_write_public_key_dsa (gcry_sexp_t s_key)
{
	GNode *asn = NULL;
	gcry_mpi_t p, q, g, y;
	GBytes *result = NULL;

	p = q = g = y = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "DSAPublicKey");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (s_key, &p, "dsa", "p", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &q, "dsa", "q", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &g, "dsa", "g", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &y, "dsa", "y", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "Y", NULL), y))
		goto done;

	egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0);

	result = egg_asn1x_encode (asn, NULL);
	if (result == NULL)
		g_warning ("couldn't encode public dsa key: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (p);
	gcry_mpi_release (q);
	gcry_mpi_release (g);
	gcry_mpi_release (y);

	return result;
}
Exemplo n.º 25
0
static void
test_asn1_oid (Test *test, gconstpointer unused)
{
	GNode *asn;
	GBytes *data;
	gboolean ret;
	GQuark source, target;

	asn = egg_asn1x_create (test_asn1_tab, "TestOid");
	g_assert ("asn test structure is null" && asn != NULL);

	/* Create a OID Quark */
	OID_ANSI_SECP256R1 = g_quark_from_static_string("1.2.840.10045.3.1.7");
	source = OID_ANSI_SECP256R1;

	/* Write the OID out */
	ret = gkm_data_asn1_write_oid (egg_asn1x_node (asn, "oid", NULL), source);
	g_assert ("couldn't write OID to asn1" && ret);

	/* Now encode the whole caboodle */
	data = egg_asn1x_encode (asn, NULL);
	g_assert ("encoding asn1 didn't work" && data != NULL);

	egg_asn1x_destroy (asn);

	/* Now decode it all nicely */
	asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestOid", data);
	g_assert (asn != NULL);

	ret = gkm_data_asn1_read_oid (egg_asn1x_node (asn, "oid", NULL), &target);
	egg_asn1x_destroy (asn);
	g_assert ("couldn't read oid from asn1" && ret);
	g_assert ("oid returned is 0" && target != 0);
	g_assert ("mpi is wrong number" && source == target);

	g_bytes_unref (data);
}
Exemplo n.º 26
0
static void
dump_certificate_reference (GNode *asn)
{
	gchar *issuer, *serial;
	gpointer data;
	gsize n_data;
	GNode *name;
	gconstpointer element;
	gsize n_element;

	/* Parse the name out */
	name = egg_asn1x_create (pkix_asn1_tab, "Name");
	g_return_if_fail (name);
	element = egg_asn1x_get_raw_element (egg_asn1x_node (asn, "issuer", NULL), &n_element);
	g_return_if_fail (element);
	if (!egg_asn1x_decode (name, element, n_element))
		barf_and_die ("couldn't parse certificate", egg_asn1x_message (name));

	issuer = egg_dn_read (name);
	g_return_if_fail (issuer);

	data = egg_asn1x_get_integer_as_raw (egg_asn1x_node (asn, "serial", NULL), NULL, &n_data);
	g_return_if_fail (data && n_data);
	serial = egg_hex_encode (data, n_data);
	g_free (data);

	g_print ("Reference\n");
	g_print ("    issuer: %s\n", issuer);
	g_print ("    serial: 0x%s\n", serial);

	egg_asn1x_destroy (name);

	g_free (data);
	g_free (serial);
	g_free (issuer);
}
Exemplo n.º 27
0
guchar*
gkm_data_der_write_private_key_rsa (gcry_sexp_t s_key, gsize *n_key)
{
	GNode *asn = NULL;
	gcry_mpi_t n, e, d, p, q, u, e1, e2, tmp;
	guchar *result = NULL;

	n = e = d = p = q = u = e1 = e2 = tmp = NULL;

	asn = egg_asn1x_create (pk_asn1_tab, "RSAPrivateKey");
	g_return_val_if_fail (asn, NULL);

	if (!gkm_sexp_extract_mpi (s_key, &n, "rsa", "n", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &e, "rsa", "e", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &d, "rsa", "d", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &p, "rsa", "p", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &q, "rsa", "q", NULL) ||
	    !gkm_sexp_extract_mpi (s_key, &u, "rsa", "u", NULL))
		goto done;

	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "modulus", NULL), n) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "publicExponent", NULL), e) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "privateExponent", NULL), d) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "prime1", NULL), p) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "prime2", NULL), q) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "coefficient", NULL), u))
		goto done;

	/* Calculate e1 and e2 */
	tmp = gcry_mpi_snew (1024);
	gcry_mpi_sub_ui (tmp, p, 1);
	e1 = gcry_mpi_snew (1024);
	gcry_mpi_mod (e1, d, tmp);
	gcry_mpi_sub_ui (tmp, q, 1);
	e2 = gcry_mpi_snew (1024);
	gcry_mpi_mod (e2, d, tmp);

	/* Write out calculated */
	if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "exponent1", NULL), e1) ||
	    !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "exponent2", NULL), e2))
		goto done;

	/* Write out the version */
	if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0))
		goto done;

	result = egg_asn1x_encode (asn, egg_secure_realloc, n_key);
	if (result == NULL)
		g_warning ("couldn't encode private rsa key: %s", egg_asn1x_message (asn));

done:
	egg_asn1x_destroy (asn);
	gcry_mpi_release (n);
	gcry_mpi_release (e);
	gcry_mpi_release (d);
	gcry_mpi_release (p);
	gcry_mpi_release (q);
	gcry_mpi_release (u);

	gcry_mpi_release (tmp);
	gcry_mpi_release (e1);
	gcry_mpi_release (e2);

	return result;
}
Exemplo n.º 28
0
static void
create_trust_file_for_issuer_and_serial (const gchar *filename, const gchar *certificate)
{
	GError *err = NULL;
	GNode *asn, *cert, *choice, *ref;
	GNode *issuer, *serial;
	gchar *data;
	GBytes *result;
	GBytes *value;
	GBytes *element;
	gsize n_data;
	GBytes *bytes;

	if (!g_file_get_contents (certificate, &data, &n_data, &err))
		barf_and_die ("couldn't read certificate file", egg_error_message (err));

	/* Make sure the certificate is */
	cert = egg_asn1x_create (pkix_asn1_tab, "Certificate");
	g_return_if_fail (cert);

	bytes = g_bytes_new_take (data, n_data);
	if (!egg_asn1x_decode (cert, bytes))
		barf_and_die ("couldn't parse der certificate file", egg_asn1x_message (cert));
	g_bytes_unref (bytes);

	/* Dig out the issuer and serial */
	issuer = egg_asn1x_node (cert, "tbsCertificate", "issuer", NULL);
	serial = egg_asn1x_node (cert, "tbsCertificate", "serialNumber", NULL);
	g_return_if_fail (issuer && serial);

	/* Create up the trust structure */
	asn = egg_asn1x_create (xdg_asn1_tab, "trust-1");
	g_return_if_fail (asn);

	/* Setup the type of trust assertion */
	ref = egg_asn1x_node (asn, "reference", NULL);
	choice = egg_asn1x_node (ref, "certReference", NULL);
	if (!egg_asn1x_set_choice (ref, choice))
		g_return_if_reached ();

	/* Copy over the serial and issuer */
	element = egg_asn1x_get_element_raw (issuer);
	if (!egg_asn1x_set_any_raw (egg_asn1x_node (choice, "issuer", NULL), element))
		g_return_if_reached ();
	g_bytes_unref (element);

	value = egg_asn1x_get_integer_as_raw (serial);
	egg_asn1x_set_integer_as_raw (egg_asn1x_node (choice, "serialNumber", NULL), value);
	g_bytes_unref (value);

	result = egg_asn1x_encode (asn, NULL);
	if (result == NULL)
		barf_and_die ("couldn't encode the trust file", egg_asn1x_message (asn));

	g_free (data);
	egg_asn1x_destroy (cert);
	egg_asn1x_destroy (asn);

	if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL),
	                          g_bytes_get_size (result), &err))
		barf_and_die ("couldn't write trust file", egg_error_message (err));

	g_bytes_unref (result);
}
Exemplo n.º 29
0
static gcry_cipher_hd_t
prepare_and_encode_pkcs8_cipher (GNode *asn, const gchar *password,
                                 gsize n_password, gsize *n_block)
{
	GNode *asn1_params = NULL;
	gcry_cipher_hd_t cih;
	guchar salt[8];
	gcry_error_t gcry;
	guchar *key, *iv, *portion;
	gsize n_key, n_portion;
	int iterations;

	init_quarks ();

	/* Make sure the encryption algorithm works */
	g_return_val_if_fail (gcry_cipher_algo_info (OID_PKCS12_PBE_3DES_SHA1,
	                                             GCRYCTL_TEST_ALGO, NULL, 0), NULL);

	/* The encryption algorithm */
	if(!egg_asn1x_set_oid_as_quark (egg_asn1x_node (asn, "encryptionAlgorithm", "algorithm", NULL),
	                                OID_PKCS12_PBE_3DES_SHA1))
		g_return_val_if_reached (NULL);

	/* Randomize some input for the password based secret */
	iterations = 1000 + (int) (1000.0 * rand () / (RAND_MAX + 1.0));
	gcry_create_nonce (salt, sizeof (salt));

	/* Allocate space for the key and iv */
	n_key = gcry_cipher_get_algo_keylen (GCRY_CIPHER_3DES);
	*n_block = gcry_cipher_get_algo_blklen (GCRY_MD_SHA1);
	g_return_val_if_fail (n_key && *n_block, NULL);

	if (!egg_symkey_generate_pkcs12 (GCRY_CIPHER_3DES, GCRY_MD_SHA1,
	                                        password, n_password, salt,
	                                        sizeof (salt), iterations, &key, &iv))
		g_return_val_if_reached (NULL);

	/* Now write out the parameters */
	asn1_params = egg_asn1x_create (pkix_asn1_tab, "pkcs-12-PbeParams");
	g_return_val_if_fail (asn1_params, NULL);
	if (!egg_asn1x_set_string_as_raw (egg_asn1x_node (asn1_params, "salt", NULL), salt, sizeof (salt), NULL))
		g_return_val_if_reached (NULL);
	if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn1_params, "iterations", NULL), iterations))
		g_return_val_if_reached (NULL);
	portion = egg_asn1x_encode (asn1_params, NULL, &n_portion);
	if (portion == NULL) {
		g_warning ("couldn't encode pkcs8 params key: %s", egg_asn1x_message (asn1_params));
		g_return_val_if_reached (NULL);
	}

	if (!egg_asn1x_set_raw_element (egg_asn1x_node (asn, "encryptionAlgorithm", "parameters", NULL),
	                                portion, n_portion, g_free))
		g_return_val_if_reached (NULL);

	/* Now make a cipher that matches what we wrote out */
	gcry = gcry_cipher_open (&cih, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_CBC, 0);
	g_return_val_if_fail (gcry == 0, NULL);
	g_return_val_if_fail (cih, NULL);

	gcry_cipher_setiv (cih, iv, *n_block);
	gcry_cipher_setkey (cih, key, n_key);

	g_free (iv);
	egg_secure_free (key);
	egg_asn1x_destroy (asn1_params);

	return cih;
}
Exemplo n.º 30
0
static gboolean
dsa_subject_public_key_from_attributes (GckAttributes *attrs,
                                        gulong klass,
                                        GNode *info_asn)
{
	const GckAttribute *value, *g, *q, *p;
	GNode *key_asn, *params_asn;
	GBytes *key;

	p = gck_attributes_find (attrs, CKA_PRIME);
	q = gck_attributes_find (attrs, CKA_SUBPRIME);
	g = gck_attributes_find (attrs, CKA_BASE);
	value = gck_attributes_find (attrs, CKA_VALUE);

	if (p == NULL || gck_attribute_is_invalid (p) ||
	    q == NULL || gck_attribute_is_invalid (q) ||
	    g == NULL || gck_attribute_is_invalid (g) ||
	    value == NULL || gck_attribute_is_invalid (value))
		return FALSE;

	key_asn = egg_asn1x_create (pk_asn1_tab, "DSAPublicPart");
	g_return_val_if_fail (key_asn, FALSE);

	params_asn = egg_asn1x_create (pk_asn1_tab, "DSAParameters");
	g_return_val_if_fail (params_asn, FALSE);

	egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "p", NULL),
	                               g_bytes_new_with_free_func (p->value, p->length,
	                                                             gck_attributes_unref,
	                                                             gck_attributes_ref (attrs)));
	egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "q", NULL),
	                               g_bytes_new_with_free_func (q->value, q->length,
	                                                             gck_attributes_unref,
	                                                             gck_attributes_ref (attrs)));
	egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "g", NULL),
	                               g_bytes_new_with_free_func (g->value, g->length,
	                                                             gck_attributes_unref,
	                                                             gck_attributes_ref (attrs)));

	/* Are these attributes for a public or private key? */
	if (klass == CKO_PRIVATE_KEY) {

		/* We need to calculate the public from the private key */
		if (!dsa_subject_public_key_from_private (key_asn, p, q, g, value))
			g_return_val_if_reached (FALSE);

	} else if (klass == CKO_PUBLIC_KEY) {
		egg_asn1x_take_integer_as_usg (key_asn,
		                               g_bytes_new_with_free_func (value->value, value->length,
		                                                             gck_attributes_unref,
		                                                             gck_attributes_ref (attrs)));
	} else {
		g_assert_not_reached ();
	}

	key = egg_asn1x_encode (key_asn, NULL);
	egg_asn1x_destroy (key_asn);

	egg_asn1x_set_bits_as_raw (egg_asn1x_node (info_asn, "subjectPublicKey", NULL),
	                           key, g_bytes_get_size (key) * 8);
	egg_asn1x_set_any_from (egg_asn1x_node (info_asn, "algorithm", "parameters", NULL), params_asn);

	egg_asn1x_set_oid_as_quark (egg_asn1x_node (info_asn, "algorithm", "algorithm", NULL), GCR_OID_PKIX1_DSA);

	g_bytes_unref (key);
	egg_asn1x_destroy (params_asn);
	return TRUE;
}