// Get the CA which signed the certificate X *FindCaSignedX(LIST *o, X *x) { X *ret; // Validate arguments if (o == NULL || x == NULL) { return NULL; } ret = NULL; LockList(o); { UINT i; for (i = 0;i < LIST_NUM(o);i++) { X *ca = LIST_DATA(o, i); if (CheckXDateNow(ca)) { if (CompareName(ca->subject_name, x->issuer_name)) { K *k = GetKFromX(ca); if (k != NULL) { if (CheckSignature(x, k)) { ret = CloneX(ca); } FreeK(k); } } else if (CompareX(ca, x)) { ret = CloneX(ca); } } if (ret != NULL) { break; } } } UnlockList(o); return ret; }
// Get the root certificate that signed the specified certificate from the list X *GetIssuerFromList(LIST *cert_list, X *cert) { UINT i; X *ret = NULL; // Validate arguments if (cert_list == NULL || cert == NULL) { return NULL; } for (i = 0;i < LIST_NUM(cert_list);i++) { X *x = LIST_DATA(cert_list, i); // Name comparison if (CheckXDateNow(x)) { if (CompareName(x->subject_name, cert->issuer_name)) { // Get the public key of the root certificate K *k = GetKFromX(x); if (k != NULL) { // Check the signature if (CheckSignature(cert, k)) { ret = x; } FreeK(k); } } } if (CompareX(x, cert)) { // Complete identical ret = x; } } return ret; }
// Certificate authentication of user bool SamAuthUserByCert(HUB *h, char *username, X *x) { bool b = false; // Validate arguments if (h == NULL || username == NULL || x == NULL) { return false; } if (GetGlobalServerFlag(GSF_DISABLE_CERT_AUTH) != 0) { return false; } // Check expiration date if (CheckXDateNow(x) == false) { return false; } // Check the Certification Revocation List if (IsValidCertInHub(h, x) == false) { // Bad wchar_t tmp[MAX_SIZE * 2]; // Log the contents of the certificate GetAllNameFromX(tmp, sizeof(tmp), x); HLog(h, "LH_AUTH_NG_CERT", username, tmp); return false; } AcLock(h); { USER *u; u = AcGetUser(h, username); if (u) { Lock(u->lock); { if (u->AuthType == AUTHTYPE_USERCERT) { // Check whether to matche with the registered certificate AUTHUSERCERT *auth = (AUTHUSERCERT *)u->AuthData; if (CompareX(auth->UserX, x)) { b = true; } } else if (u->AuthType == AUTHTYPE_ROOTCERT) { // Check whether the certificate has been signed by the root certificate AUTHROOTCERT *auth = (AUTHROOTCERT *)u->AuthData; if (h->HubDb != NULL) { LockList(h->HubDb->RootCertList); { X *root_cert; root_cert = GetIssuerFromList(h->HubDb->RootCertList, x); if (root_cert != NULL) { b = true; if (auth->CommonName != NULL && UniIsEmptyStr(auth->CommonName) == false) { // Compare the CN if (UniStrCmpi(x->subject_name->CommonName, auth->CommonName) != 0) { b = false; } } if (auth->Serial != NULL && auth->Serial->size >= 1) { // Compare the serial number if (CompareXSerial(x->serial, auth->Serial) == false) { b = false; } } } } UnlockList(h->HubDb->RootCertList); } } } Unlock(u->lock); ReleaseUser(u); } } AcUnlock(h); if (b) { wchar_t tmp[MAX_SIZE * 2]; // Log the contents of the certificate GetAllNameFromX(tmp, sizeof(tmp), x); HLog(h, "LH_AUTH_OK_CERT", username, tmp); } return b; }