static gboolean rsa_subject_public_key_from_attributes (GckAttributes *attrs, GNode *info_asn) { const GckAttribute *modulus; const GckAttribute *exponent; GNode *key_asn; GNode *params_asn; GBytes *key; GBytes *usg; modulus = gck_attributes_find (attrs, CKA_MODULUS); exponent = gck_attributes_find (attrs, CKA_PUBLIC_EXPONENT); if (modulus == NULL || gck_attribute_is_invalid (modulus) || exponent == NULL || gck_attribute_is_invalid (exponent)) return FALSE; key_asn = egg_asn1x_create (pk_asn1_tab, "RSAPublicKey"); g_return_val_if_fail (key_asn, FALSE); params_asn = egg_asn1x_create (pk_asn1_tab, "RSAParameters"); g_return_val_if_fail (params_asn, FALSE); usg = g_bytes_new_with_free_func (modulus->value, modulus->length, gck_attributes_unref, gck_attributes_ref (attrs)); egg_asn1x_set_integer_as_usg (egg_asn1x_node (key_asn, "modulus", NULL), usg); g_bytes_unref (usg); usg = g_bytes_new_with_free_func (exponent->value, exponent->length, gck_attributes_unref, gck_attributes_ref (attrs)); egg_asn1x_set_integer_as_usg (egg_asn1x_node (key_asn, "publicExponent", NULL), usg); g_bytes_unref (usg); key = egg_asn1x_encode (key_asn, NULL); egg_asn1x_destroy (key_asn); egg_asn1x_set_null (params_asn); egg_asn1x_set_bits_as_raw (egg_asn1x_node (info_asn, "subjectPublicKey", NULL), key, g_bytes_get_size (key) * 8); egg_asn1x_set_oid_as_quark (egg_asn1x_node (info_asn, "algorithm", "algorithm", NULL), GCR_OID_PKIX1_RSA); egg_asn1x_set_any_from (egg_asn1x_node (info_asn, "algorithm", "parameters", NULL), params_asn); egg_asn1x_destroy (params_asn); g_bytes_unref (key); return TRUE; }
guchar* gkm_data_der_write_private_key_dsa_part (gcry_sexp_t skey, gsize *n_key) { GNode *asn = NULL; gcry_mpi_t x; guchar *result = NULL; x = NULL; asn = egg_asn1x_create (pk_asn1_tab, "DSAPrivatePart"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (skey, &x, "dsa", "x", NULL)) goto done; if (!gkm_data_asn1_write_mpi (asn, x)) goto done; result = egg_asn1x_encode (asn, egg_secure_realloc, n_key); if (result == NULL) g_warning ("couldn't encode private dsa key: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (x); return result; }
guchar* gkm_data_der_write_public_key_rsa (gcry_sexp_t s_key, gsize *len) { GNode *asn = NULL; gcry_mpi_t n, e; guchar *result = NULL; n = e = NULL; asn = egg_asn1x_create (pk_asn1_tab, "RSAPublicKey"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (s_key, &n, "rsa", "n", NULL) || !gkm_sexp_extract_mpi (s_key, &e, "rsa", "e", NULL)) goto done; if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "modulus", NULL), n) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "publicExponent", NULL), e)) goto done; result = egg_asn1x_encode (asn, NULL, len); if (result == NULL) g_warning ("couldn't encode public rsa key: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (n); gcry_mpi_release (e); return result; }
static void test_some_asn1_stuff (const ASN1_ARRAY_TYPE *defs, const gchar *file, const gchar *identifier) { GNode *asn; gpointer data, encoded; gsize n_data, n_encoded; if (!g_file_get_contents (file, (gchar**)&data, &n_data, NULL)) g_assert_not_reached (); asn = egg_asn1x_create (defs, identifier); egg_asn1x_dump (asn); if (!egg_asn1x_decode (asn, data, n_data)) g_warning ("decode of %s failed: %s", identifier, egg_asn1x_message (asn)); encoded = egg_asn1x_encode (asn, NULL, &n_encoded); if (encoded == NULL) g_warning ("encode of %s failed: %s", identifier, egg_asn1x_message (asn)); /* Decode the encoding */ if (!egg_asn1x_decode (asn, encoded, n_encoded)) g_warning ("decode of encoded %s failed: %s", identifier, egg_asn1x_message (asn)); egg_asn1x_clear (asn); egg_asn1x_destroy (asn); g_free (encoded); g_free (data); }
static gboolean validate_der (CK_ATTRIBUTE_PTR attr, const gchar *asn_type) { GNode *asn; gboolean valid = TRUE; GBytes *data; if (!attr->pValue || attr->ulValueLen == (CK_ULONG)-1) return FALSE; asn = egg_asn1x_create (pkix_asn1_tab, asn_type); g_return_val_if_fail (asn, FALSE); data = g_bytes_new_static (attr->pValue, attr->ulValueLen); valid = egg_asn1x_decode (asn, data); g_bytes_unref (data); if (!valid) g_message ("failed to parse certificate passed to trust assertion: %s", egg_asn1x_message (asn)); /* Yes, this is an expensive check, but worthwhile */ egg_asn1x_destroy (asn); return valid; }
static GkmXdgTrust* create_trust_for_complete (GkmModule *module, GkmManager *manager, CK_ATTRIBUTE_PTR cert) { GkmXdgTrust *trust; GNode *asn, *ref, *node; GBytes *bytes; asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_val_if_fail (asn, NULL); ref = egg_asn1x_node (asn, "reference", NULL); node = egg_asn1x_node (ref, "certComplete", NULL); egg_asn1x_set_choice (ref, node); bytes = g_bytes_new (cert->pValue, cert->ulValueLen); egg_asn1x_set_any_raw (node, bytes); g_bytes_unref (bytes); trust = g_object_new (GKM_XDG_TYPE_TRUST, "module", module, "manager", manager, NULL); trust->pv->asn = asn; /* Encode it, which validates, and so we have read access to all the data */ trust->pv->bytes = egg_asn1x_encode (asn, NULL); if (!trust->pv->bytes) { g_warning ("created invalid trust object: %s", egg_asn1x_message (asn)); return NULL; } return trust; }
static void test_decode_encode (Test *test, gconstpointer data) { const Fixture *fixture = data; GNode *asn; GBytes *encoded; gboolean ret; asn = egg_asn1x_create (fixture->defs, fixture->identifier); if (g_test_verbose ()) egg_asn1x_dump (asn); ret = egg_asn1x_decode (asn, test->data); egg_asn1x_assert (ret == TRUE, asn); encoded = egg_asn1x_encode (asn, NULL); egg_asn1x_assert (encoded != NULL, asn); /* Decode the encoding */ ret = egg_asn1x_decode (asn, encoded); egg_asn1x_assert (ret == TRUE, asn); egg_asn1x_clear (asn); egg_asn1x_destroy (asn); g_bytes_unref (encoded); }
static gboolean gkm_xdg_trust_real_load (GkmSerializable *base, GkmSecret *login, GBytes *data) { GkmXdgTrust *self = GKM_XDG_TRUST (base); GNode *asn = NULL; if (g_bytes_get_size (data) == 0) return FALSE; asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_val_if_fail (asn, FALSE); if (!egg_asn1x_decode (asn, data)) { g_warning ("couldn't parse trust data: %s", egg_asn1x_message (asn)); egg_asn1x_destroy (asn); return FALSE; } /* Next parse out all the pairs */ if (!load_assertions (self, asn)) { egg_asn1x_destroy (asn); return FALSE; } /* Take ownership of this new data */ if (self->pv->bytes) g_bytes_unref (self->pv->bytes); self->pv->bytes = g_bytes_ref (data); egg_asn1x_destroy (self->pv->asn); self->pv->asn = asn; return TRUE; }
guchar* gkm_data_der_write_private_key_dsa_params (gcry_sexp_t skey, gsize *n_params) { GNode *asn = NULL; gcry_mpi_t p, q, g; guchar *result = NULL; p = q = g = NULL; asn = egg_asn1x_create (pk_asn1_tab, "DSAParameters"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (skey, &p, "dsa", "p", NULL) || !gkm_sexp_extract_mpi (skey, &q, "dsa", "q", NULL) || !gkm_sexp_extract_mpi (skey, &g, "dsa", "g", NULL)) goto done; if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g)) goto done; result = egg_asn1x_encode (asn, egg_secure_realloc, n_params); if (result == NULL) g_warning ("couldn't encode private dsa params: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (p); gcry_mpi_release (q); gcry_mpi_release (g); return result; }
static GkmXdgTrust* create_trust_for_reference (GkmModule *module, GkmManager *manager, CK_ATTRIBUTE_PTR serial, CK_ATTRIBUTE_PTR issuer) { GkmXdgTrust *trust; GNode *asn, *ref, *node; asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_val_if_fail (asn, NULL); ref = egg_asn1x_node (asn, "reference", NULL); node = egg_asn1x_node (ref, "certReference", NULL); egg_asn1x_set_choice (ref, node); egg_asn1x_set_integer_as_raw (egg_asn1x_node (node, "serialNumber", NULL), g_memdup (serial->pValue, serial->ulValueLen), serial->ulValueLen, g_free); egg_asn1x_set_raw_element (egg_asn1x_node (node, "issuer", NULL), g_memdup (issuer->pValue, issuer->ulValueLen), issuer->ulValueLen, g_free); trust = g_object_new (GKM_XDG_TYPE_TRUST, "module", module, "manager", manager, NULL); trust->pv->asn = asn; /* Encode it, so we have read access to all the data */ trust->pv->data = egg_asn1x_encode (asn, NULL, &trust->pv->n_data); if (!trust->pv->data) { g_warning ("created invalid trust object: %s", egg_asn1x_message (asn)); return NULL; } return trust; }
static void create_trust_file_for_certificate (const gchar *filename, const gchar *certificate) { GError *err = NULL; GNode *asn, *cert, *choice, *ref; GBytes *bytes, *result; gchar *data; gsize n_data; if (!g_file_get_contents (certificate, &data, &n_data, &err)) barf_and_die ("couldn't read certificate file", egg_error_message (err)); /* Make sure the certificate is */ cert = egg_asn1x_create (pkix_asn1_tab, "Certificate"); g_return_if_fail (cert); bytes = g_bytes_new_take (data, n_data); if (!egg_asn1x_decode (cert, bytes)) barf_and_die ("couldn't parse der certificate file", egg_asn1x_message (cert)); asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_if_fail (asn); ref = egg_asn1x_node (asn, "reference", NULL); choice = egg_asn1x_node (ref, "certComplete", NULL); if (!egg_asn1x_set_choice (ref, choice) || !egg_asn1x_set_any_raw (choice, bytes)) g_return_if_reached (); g_bytes_unref (bytes); result = egg_asn1x_encode (asn, NULL); if (result == NULL) barf_and_die ("couldn't encode the trust file", egg_asn1x_message (asn)); egg_asn1x_destroy (asn); egg_asn1x_destroy (cert); if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL), g_bytes_get_size (result), &err)) barf_and_die ("couldn't write trust file", egg_error_message (err)); g_bytes_unref (result); }
guchar* gkm_data_der_write_private_pkcs8_crypted (gcry_sexp_t skey, const gchar *password, gsize n_password, gsize *n_data) { gcry_error_t gcry; gcry_cipher_hd_t cih; GNode *asn = NULL; guchar *key, *data; gsize n_key, block = 0; /* Encode the key in normal pkcs8 fashion */ key = gkm_data_der_write_private_pkcs8_plain (skey, &n_key); if (key == NULL) return NULL; asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-8-EncryptedPrivateKeyInfo"); g_return_val_if_fail (asn, NULL); /* Create a and write out a cipher used for encryption */ cih = prepare_and_encode_pkcs8_cipher (asn, password, n_password, &block); g_return_val_if_fail (cih, NULL); /* Pad the block of data */ if(block > 1) { gsize pad; guchar *padded; pad = block - (n_key % block); if (pad == 0) pad = block; padded = egg_secure_realloc (key, n_key + pad); memset (padded + n_key, pad, pad); key = padded; n_key += pad; } gcry = gcry_cipher_encrypt (cih, key, n_key, NULL, 0); g_return_val_if_fail (gcry == 0, NULL); gcry_cipher_close (cih); if (!egg_asn1x_set_string_as_raw (egg_asn1x_node (asn, "encryptedData", NULL), key, n_key, egg_secure_free)) g_return_val_if_reached (NULL); data = egg_asn1x_encode (asn, NULL, n_data); if (data == NULL) g_warning ("couldn't encode encrypted pkcs8 key: %s", egg_asn1x_message (asn)); egg_asn1x_destroy (asn); return data; }
static void gcr_certificate_request_constructed (GObject *obj) { GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj); GNode *version; G_OBJECT_CLASS (gcr_certificate_request_parent_class)->constructed (obj); self->asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-10-CertificationRequest"); g_return_if_fail (self->asn != NULL); /* Setup the version */ version = egg_asn1x_node (self->asn, "certificationRequestInfo", "version", NULL); egg_asn1x_set_integer_as_ulong (version, 0); }
int main(int argc, char* argv[]) { GError *err = NULL; gchar *contents; gsize n_contents; GNode *asn, *node; gint i, count; if (argc != 2) { g_printerr ("usage: dump-trust-file file\n"); return 2; } if (!g_file_get_contents (argv[1], &contents, &n_contents, &err)) barf_and_die ("couldn't load file", egg_error_message (err)); asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_val_if_fail (asn, 1); if (!egg_asn1x_decode (asn, contents, n_contents)) barf_and_die ("couldn't parse file", egg_asn1x_message (asn)); /* Print out the certificate we refer to first */ node = egg_asn1x_node (asn, "reference", "certReference", NULL); if (egg_asn1x_have (node)) { dump_certificate_reference (node); } else { node = egg_asn1x_node (asn, "reference", "certComplete", NULL); if (egg_asn1x_have (node)) dump_certificate_complete (node); else barf_and_die ("unsupported certificate reference", NULL); } /* Then the assertions */ count = egg_asn1x_count (egg_asn1x_node (asn, "assertions", NULL)); for (i = 0; i < count; ++i) { node = egg_asn1x_node (asn, "assertions", i + 1, NULL); dump_assertion (node); } egg_asn1x_destroy (asn); g_free (contents); return 0; }
static void test_pkcs12_decode (Test *test, gconstpointer unused) { GNode *asn; gboolean ret; asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-12-PFX"); if (g_test_verbose ()) egg_asn1x_dump (asn); ret = egg_asn1x_decode (asn, test->data); egg_asn1x_assert (ret == TRUE, asn); egg_asn1x_destroy (asn); }
GNode * _gcr_subject_public_key_for_attributes (GckAttributes *attributes) { gboolean ret = FALSE; gulong key_type; gulong klass; GNode *asn = NULL; if (!gck_attributes_find_ulong (attributes, CKA_CLASS, &klass)) { _gcr_debug ("no class in attributes"); return NULL; } if (klass == CKO_CERTIFICATE) { return cert_subject_public_key_from_attributes (attributes); } else if (klass == CKO_PUBLIC_KEY || klass == CKO_PRIVATE_KEY) { if (!gck_attributes_find_ulong (attributes, CKA_KEY_TYPE, &key_type)) { _gcr_debug ("no key type in attributes"); return NULL; } asn = egg_asn1x_create (pkix_asn1_tab, "SubjectPublicKeyInfo"); g_return_val_if_fail (asn, NULL); if (key_type == CKK_RSA) { ret = rsa_subject_public_key_from_attributes (attributes, asn); } else if (key_type == CKK_DSA) { ret = dsa_subject_public_key_from_attributes (attributes, klass, asn); } else { _gcr_debug ("unsupported key type: %lu", key_type); ret = FALSE; } if (ret == FALSE) { egg_asn1x_destroy (asn); asn = NULL; } } return asn; }
static void test_personal_name_invalid (Test *test, gconstpointer unused) { GNode *asn; gboolean ret; asn = egg_asn1x_create (pkix_asn1_tab, "PersonalName"); if (g_test_verbose ()) egg_asn1x_dump (asn); ret = egg_asn1x_decode (asn, test->data); g_assert (ret == FALSE); g_assert (strstr (egg_asn1x_message (asn), "content size is out of bounds") != NULL); egg_asn1x_destroy (asn); }
static void test_asn1_bit_string (Test *test, gconstpointer unused) { GNode *asn; GBytes *data; gboolean ret; GBytes *source, *target; gsize target_bits, source_bits; asn = egg_asn1x_create (test_asn1_tab, "TestBitString"); g_assert ("asn test structure is null" && asn != NULL); /* Create a string */ source = g_bytes_new (TEST_STRING, strlen(TEST_STRING)); g_return_if_fail (source); source_bits = g_bytes_get_size(source)*8; /* Write the string out */ ret = gkm_data_asn1_write_bit_string (egg_asn1x_node (asn, "data", NULL), source, source_bits); g_assert ("couldn't write string to asn1" && ret); /* Now encode the whole caboodle */ data = egg_asn1x_encode (asn, NULL); g_assert ("encoding asn1 didn't work" && data != NULL); egg_asn1x_destroy (asn); /* Now decode it all nicely */ asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestBitString", data); g_assert (asn != NULL); ret = gkm_data_asn1_read_bit_string (egg_asn1x_node (asn, "data", NULL), &target, &target_bits); egg_asn1x_destroy (asn); g_assert ("couldn't read bit string from asn1" && ret); g_assert ("bit string returned is null" && target != NULL); g_assert ("Source and target length differ" && target_bits == source_bits); g_assert ("Bit strings differ" && g_bytes_equal (source, target)); g_bytes_unref (data); g_bytes_unref (source); g_bytes_unref (target); }
guchar* gkm_data_der_write_private_key_dsa (gcry_sexp_t s_key, gsize *len) { GNode *asn = NULL; gcry_mpi_t p, q, g, y, x; guchar *result = NULL; p = q = g = y = x = NULL; asn = egg_asn1x_create (pk_asn1_tab, "DSAPrivateKey"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (s_key, &p, "dsa", "p", NULL) || !gkm_sexp_extract_mpi (s_key, &q, "dsa", "q", NULL) || !gkm_sexp_extract_mpi (s_key, &g, "dsa", "g", NULL) || !gkm_sexp_extract_mpi (s_key, &y, "dsa", "y", NULL) || !gkm_sexp_extract_mpi (s_key, &x, "dsa", "x", NULL)) goto done; if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "Y", NULL), y) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "priv", NULL), x)) goto done; if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0)) goto done; result = egg_asn1x_encode (asn, egg_secure_realloc, len); if (result == NULL) g_warning ("couldn't encode private dsa key: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (p); gcry_mpi_release (q); gcry_mpi_release (g); gcry_mpi_release (y); gcry_mpi_release (x); return result; }
static void add_trust_purpose_to_file (const gchar *filename, const gchar *purpose) { GError *err = NULL; gchar *data; GBytes *result; gsize n_data; GNode *asn, *assertion; GBytes *bytes; if (!g_file_get_contents (filename, &data, &n_data, &err)) barf_and_die ("couldn't read trust file", egg_error_message (err)); /* Create up the trust structure */ asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_if_fail (asn); /* And parse it */ bytes = g_bytes_new_take (data, n_data); if (!egg_asn1x_decode (asn, bytes)) barf_and_die ("couldn't parse trust file", egg_asn1x_message (asn)); g_bytes_unref (bytes); assertion = egg_asn1x_append (egg_asn1x_node (asn, "assertions", NULL)); g_return_if_fail (assertion); if (!egg_asn1x_set_string_as_utf8 (egg_asn1x_node (assertion, "purpose", NULL), g_strdup (purpose), g_free)) g_return_if_reached (); egg_asn1x_set_enumerated (egg_asn1x_node (assertion, "level", NULL), g_quark_from_string ("trusted")); result = egg_asn1x_encode (asn, NULL); if (result == NULL) barf_and_die ("couldn't encode trust file", egg_asn1x_message (asn)); egg_asn1x_destroy (asn); if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL), g_bytes_get_size (result), &err)) barf_and_die ("couldn't write trust file", egg_error_message (err)); g_bytes_unref (result); }
static gboolean gkm_xdg_trust_real_load (GkmSerializable *base, GkmSecret *login, gconstpointer data, gsize n_data) { GkmXdgTrust *self = GKM_XDG_TRUST (base); GNode *asn = NULL; gpointer copy; g_return_val_if_fail (GKM_XDG_IS_TRUST (self), FALSE); g_return_val_if_fail (data, FALSE); if (n_data == 0) return FALSE; copy = g_memdup (data, n_data); asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_val_if_fail (asn, FALSE); if (!egg_asn1x_decode (asn, copy, n_data)) { g_warning ("couldn't parse trust data: %s", egg_asn1x_message (asn)); egg_asn1x_destroy (asn); g_free (copy); return FALSE; } /* Next parse out all the pairs */ if (!load_assertions (self, asn)) { egg_asn1x_destroy (asn); g_free (copy); return FALSE; } /* Take ownership of this new data */ g_free (self->pv->data); self->pv->data = copy; self->pv->n_data = n_data; egg_asn1x_destroy (self->pv->asn); self->pv->asn = asn; return TRUE; }
static void dump_certificate_complete (GNode *asn) { GNode *cert; gchar *issuer, *serial, *subject; gconstpointer element; gpointer data; gsize n_data, n_element; /* Parse the certificate out */ cert = egg_asn1x_create (pkix_asn1_tab, "Certificate"); g_return_if_fail (cert); element = egg_asn1x_get_raw_element (asn, &n_element); g_return_if_fail (element); if (!egg_asn1x_decode (cert, element, n_element)) barf_and_die ("couldn't parse certificate", egg_asn1x_message (cert)); issuer = egg_dn_read (egg_asn1x_node (asn, "issuer", NULL)); g_return_if_fail (issuer); subject = egg_dn_read (egg_asn1x_node (asn, "subject", NULL)); g_return_if_fail (subject); data = egg_asn1x_get_integer_as_raw (egg_asn1x_node (asn, "serial", NULL), NULL, &n_data); g_return_if_fail (data && n_data); serial = egg_hex_encode (data, n_data); g_free (data); g_print ("Complete\n"); g_print (" issuer: %s\n", issuer); g_print (" subject: %s\n", subject); g_print (" serial: 0x%s\n", serial); egg_asn1x_destroy (cert); g_free (data); g_free (serial); g_free (issuer); g_free (subject); }
static void test_asn1_integers (Test *test, gconstpointer unused) { GNode *asn; gcry_mpi_t mpi, mpt; GBytes *data; gboolean ret; asn = egg_asn1x_create (test_asn1_tab, "TestIntegers"); g_assert ("asn test structure is null" && asn != NULL); /* Make a random number */ mpi = gcry_mpi_new (512); g_return_if_fail (mpi); gcry_mpi_randomize (mpi, 512, GCRY_WEAK_RANDOM); /* Write the mpi out */ ret = gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "mpi", NULL), mpi); g_assert ("couldn't write mpi to asn1" && ret); /* Now encode the whole caboodle */ data = egg_asn1x_encode (asn, NULL); g_assert ("encoding asn1 didn't work" && data != NULL); egg_asn1x_destroy (asn); /* Now decode it all nicely */ asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestIntegers", data); g_assert (asn != NULL); ret = gkm_data_asn1_read_mpi (egg_asn1x_node (asn, "mpi", NULL), &mpt); egg_asn1x_destroy (asn); g_assert ("couldn't read mpi from asn1" && ret); g_assert ("mpi returned is null" && mpt != NULL); g_assert ("mpi is wrong number" && gcry_mpi_cmp (mpi, mpt) == 0); g_bytes_unref (data); gcry_mpi_release (mpi); gcry_mpi_release (mpt); }
GBytes * gkm_data_der_write_public_key_dsa (gcry_sexp_t s_key) { GNode *asn = NULL; gcry_mpi_t p, q, g, y; GBytes *result = NULL; p = q = g = y = NULL; asn = egg_asn1x_create (pk_asn1_tab, "DSAPublicKey"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (s_key, &p, "dsa", "p", NULL) || !gkm_sexp_extract_mpi (s_key, &q, "dsa", "q", NULL) || !gkm_sexp_extract_mpi (s_key, &g, "dsa", "g", NULL) || !gkm_sexp_extract_mpi (s_key, &y, "dsa", "y", NULL)) goto done; if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "p", NULL), p) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "q", NULL), q) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "g", NULL), g) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "Y", NULL), y)) goto done; egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0); result = egg_asn1x_encode (asn, NULL); if (result == NULL) g_warning ("couldn't encode public dsa key: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (p); gcry_mpi_release (q); gcry_mpi_release (g); gcry_mpi_release (y); return result; }
static void test_asn1_oid (Test *test, gconstpointer unused) { GNode *asn; GBytes *data; gboolean ret; GQuark source, target; asn = egg_asn1x_create (test_asn1_tab, "TestOid"); g_assert ("asn test structure is null" && asn != NULL); /* Create a OID Quark */ OID_ANSI_SECP256R1 = g_quark_from_static_string("1.2.840.10045.3.1.7"); source = OID_ANSI_SECP256R1; /* Write the OID out */ ret = gkm_data_asn1_write_oid (egg_asn1x_node (asn, "oid", NULL), source); g_assert ("couldn't write OID to asn1" && ret); /* Now encode the whole caboodle */ data = egg_asn1x_encode (asn, NULL); g_assert ("encoding asn1 didn't work" && data != NULL); egg_asn1x_destroy (asn); /* Now decode it all nicely */ asn = egg_asn1x_create_and_decode (test_asn1_tab, "TestOid", data); g_assert (asn != NULL); ret = gkm_data_asn1_read_oid (egg_asn1x_node (asn, "oid", NULL), &target); egg_asn1x_destroy (asn); g_assert ("couldn't read oid from asn1" && ret); g_assert ("oid returned is 0" && target != 0); g_assert ("mpi is wrong number" && source == target); g_bytes_unref (data); }
static void dump_certificate_reference (GNode *asn) { gchar *issuer, *serial; gpointer data; gsize n_data; GNode *name; gconstpointer element; gsize n_element; /* Parse the name out */ name = egg_asn1x_create (pkix_asn1_tab, "Name"); g_return_if_fail (name); element = egg_asn1x_get_raw_element (egg_asn1x_node (asn, "issuer", NULL), &n_element); g_return_if_fail (element); if (!egg_asn1x_decode (name, element, n_element)) barf_and_die ("couldn't parse certificate", egg_asn1x_message (name)); issuer = egg_dn_read (name); g_return_if_fail (issuer); data = egg_asn1x_get_integer_as_raw (egg_asn1x_node (asn, "serial", NULL), NULL, &n_data); g_return_if_fail (data && n_data); serial = egg_hex_encode (data, n_data); g_free (data); g_print ("Reference\n"); g_print (" issuer: %s\n", issuer); g_print (" serial: 0x%s\n", serial); egg_asn1x_destroy (name); g_free (data); g_free (serial); g_free (issuer); }
guchar* gkm_data_der_write_private_key_rsa (gcry_sexp_t s_key, gsize *n_key) { GNode *asn = NULL; gcry_mpi_t n, e, d, p, q, u, e1, e2, tmp; guchar *result = NULL; n = e = d = p = q = u = e1 = e2 = tmp = NULL; asn = egg_asn1x_create (pk_asn1_tab, "RSAPrivateKey"); g_return_val_if_fail (asn, NULL); if (!gkm_sexp_extract_mpi (s_key, &n, "rsa", "n", NULL) || !gkm_sexp_extract_mpi (s_key, &e, "rsa", "e", NULL) || !gkm_sexp_extract_mpi (s_key, &d, "rsa", "d", NULL) || !gkm_sexp_extract_mpi (s_key, &p, "rsa", "p", NULL) || !gkm_sexp_extract_mpi (s_key, &q, "rsa", "q", NULL) || !gkm_sexp_extract_mpi (s_key, &u, "rsa", "u", NULL)) goto done; if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "modulus", NULL), n) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "publicExponent", NULL), e) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "privateExponent", NULL), d) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "prime1", NULL), p) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "prime2", NULL), q) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "coefficient", NULL), u)) goto done; /* Calculate e1 and e2 */ tmp = gcry_mpi_snew (1024); gcry_mpi_sub_ui (tmp, p, 1); e1 = gcry_mpi_snew (1024); gcry_mpi_mod (e1, d, tmp); gcry_mpi_sub_ui (tmp, q, 1); e2 = gcry_mpi_snew (1024); gcry_mpi_mod (e2, d, tmp); /* Write out calculated */ if (!gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "exponent1", NULL), e1) || !gkm_data_asn1_write_mpi (egg_asn1x_node (asn, "exponent2", NULL), e2)) goto done; /* Write out the version */ if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn, "version", NULL), 0)) goto done; result = egg_asn1x_encode (asn, egg_secure_realloc, n_key); if (result == NULL) g_warning ("couldn't encode private rsa key: %s", egg_asn1x_message (asn)); done: egg_asn1x_destroy (asn); gcry_mpi_release (n); gcry_mpi_release (e); gcry_mpi_release (d); gcry_mpi_release (p); gcry_mpi_release (q); gcry_mpi_release (u); gcry_mpi_release (tmp); gcry_mpi_release (e1); gcry_mpi_release (e2); return result; }
static void create_trust_file_for_issuer_and_serial (const gchar *filename, const gchar *certificate) { GError *err = NULL; GNode *asn, *cert, *choice, *ref; GNode *issuer, *serial; gchar *data; GBytes *result; GBytes *value; GBytes *element; gsize n_data; GBytes *bytes; if (!g_file_get_contents (certificate, &data, &n_data, &err)) barf_and_die ("couldn't read certificate file", egg_error_message (err)); /* Make sure the certificate is */ cert = egg_asn1x_create (pkix_asn1_tab, "Certificate"); g_return_if_fail (cert); bytes = g_bytes_new_take (data, n_data); if (!egg_asn1x_decode (cert, bytes)) barf_and_die ("couldn't parse der certificate file", egg_asn1x_message (cert)); g_bytes_unref (bytes); /* Dig out the issuer and serial */ issuer = egg_asn1x_node (cert, "tbsCertificate", "issuer", NULL); serial = egg_asn1x_node (cert, "tbsCertificate", "serialNumber", NULL); g_return_if_fail (issuer && serial); /* Create up the trust structure */ asn = egg_asn1x_create (xdg_asn1_tab, "trust-1"); g_return_if_fail (asn); /* Setup the type of trust assertion */ ref = egg_asn1x_node (asn, "reference", NULL); choice = egg_asn1x_node (ref, "certReference", NULL); if (!egg_asn1x_set_choice (ref, choice)) g_return_if_reached (); /* Copy over the serial and issuer */ element = egg_asn1x_get_element_raw (issuer); if (!egg_asn1x_set_any_raw (egg_asn1x_node (choice, "issuer", NULL), element)) g_return_if_reached (); g_bytes_unref (element); value = egg_asn1x_get_integer_as_raw (serial); egg_asn1x_set_integer_as_raw (egg_asn1x_node (choice, "serialNumber", NULL), value); g_bytes_unref (value); result = egg_asn1x_encode (asn, NULL); if (result == NULL) barf_and_die ("couldn't encode the trust file", egg_asn1x_message (asn)); g_free (data); egg_asn1x_destroy (cert); egg_asn1x_destroy (asn); if (!g_file_set_contents (filename, g_bytes_get_data (result, NULL), g_bytes_get_size (result), &err)) barf_and_die ("couldn't write trust file", egg_error_message (err)); g_bytes_unref (result); }
static gcry_cipher_hd_t prepare_and_encode_pkcs8_cipher (GNode *asn, const gchar *password, gsize n_password, gsize *n_block) { GNode *asn1_params = NULL; gcry_cipher_hd_t cih; guchar salt[8]; gcry_error_t gcry; guchar *key, *iv, *portion; gsize n_key, n_portion; int iterations; init_quarks (); /* Make sure the encryption algorithm works */ g_return_val_if_fail (gcry_cipher_algo_info (OID_PKCS12_PBE_3DES_SHA1, GCRYCTL_TEST_ALGO, NULL, 0), NULL); /* The encryption algorithm */ if(!egg_asn1x_set_oid_as_quark (egg_asn1x_node (asn, "encryptionAlgorithm", "algorithm", NULL), OID_PKCS12_PBE_3DES_SHA1)) g_return_val_if_reached (NULL); /* Randomize some input for the password based secret */ iterations = 1000 + (int) (1000.0 * rand () / (RAND_MAX + 1.0)); gcry_create_nonce (salt, sizeof (salt)); /* Allocate space for the key and iv */ n_key = gcry_cipher_get_algo_keylen (GCRY_CIPHER_3DES); *n_block = gcry_cipher_get_algo_blklen (GCRY_MD_SHA1); g_return_val_if_fail (n_key && *n_block, NULL); if (!egg_symkey_generate_pkcs12 (GCRY_CIPHER_3DES, GCRY_MD_SHA1, password, n_password, salt, sizeof (salt), iterations, &key, &iv)) g_return_val_if_reached (NULL); /* Now write out the parameters */ asn1_params = egg_asn1x_create (pkix_asn1_tab, "pkcs-12-PbeParams"); g_return_val_if_fail (asn1_params, NULL); if (!egg_asn1x_set_string_as_raw (egg_asn1x_node (asn1_params, "salt", NULL), salt, sizeof (salt), NULL)) g_return_val_if_reached (NULL); if (!egg_asn1x_set_integer_as_ulong (egg_asn1x_node (asn1_params, "iterations", NULL), iterations)) g_return_val_if_reached (NULL); portion = egg_asn1x_encode (asn1_params, NULL, &n_portion); if (portion == NULL) { g_warning ("couldn't encode pkcs8 params key: %s", egg_asn1x_message (asn1_params)); g_return_val_if_reached (NULL); } if (!egg_asn1x_set_raw_element (egg_asn1x_node (asn, "encryptionAlgorithm", "parameters", NULL), portion, n_portion, g_free)) g_return_val_if_reached (NULL); /* Now make a cipher that matches what we wrote out */ gcry = gcry_cipher_open (&cih, GCRY_CIPHER_3DES, GCRY_CIPHER_MODE_CBC, 0); g_return_val_if_fail (gcry == 0, NULL); g_return_val_if_fail (cih, NULL); gcry_cipher_setiv (cih, iv, *n_block); gcry_cipher_setkey (cih, key, n_key); g_free (iv); egg_secure_free (key); egg_asn1x_destroy (asn1_params); return cih; }
static gboolean dsa_subject_public_key_from_attributes (GckAttributes *attrs, gulong klass, GNode *info_asn) { const GckAttribute *value, *g, *q, *p; GNode *key_asn, *params_asn; GBytes *key; p = gck_attributes_find (attrs, CKA_PRIME); q = gck_attributes_find (attrs, CKA_SUBPRIME); g = gck_attributes_find (attrs, CKA_BASE); value = gck_attributes_find (attrs, CKA_VALUE); if (p == NULL || gck_attribute_is_invalid (p) || q == NULL || gck_attribute_is_invalid (q) || g == NULL || gck_attribute_is_invalid (g) || value == NULL || gck_attribute_is_invalid (value)) return FALSE; key_asn = egg_asn1x_create (pk_asn1_tab, "DSAPublicPart"); g_return_val_if_fail (key_asn, FALSE); params_asn = egg_asn1x_create (pk_asn1_tab, "DSAParameters"); g_return_val_if_fail (params_asn, FALSE); egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "p", NULL), g_bytes_new_with_free_func (p->value, p->length, gck_attributes_unref, gck_attributes_ref (attrs))); egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "q", NULL), g_bytes_new_with_free_func (q->value, q->length, gck_attributes_unref, gck_attributes_ref (attrs))); egg_asn1x_take_integer_as_usg (egg_asn1x_node (params_asn, "g", NULL), g_bytes_new_with_free_func (g->value, g->length, gck_attributes_unref, gck_attributes_ref (attrs))); /* Are these attributes for a public or private key? */ if (klass == CKO_PRIVATE_KEY) { /* We need to calculate the public from the private key */ if (!dsa_subject_public_key_from_private (key_asn, p, q, g, value)) g_return_val_if_reached (FALSE); } else if (klass == CKO_PUBLIC_KEY) { egg_asn1x_take_integer_as_usg (key_asn, g_bytes_new_with_free_func (value->value, value->length, gck_attributes_unref, gck_attributes_ref (attrs))); } else { g_assert_not_reached (); } key = egg_asn1x_encode (key_asn, NULL); egg_asn1x_destroy (key_asn); egg_asn1x_set_bits_as_raw (egg_asn1x_node (info_asn, "subjectPublicKey", NULL), key, g_bytes_get_size (key) * 8); egg_asn1x_set_any_from (egg_asn1x_node (info_asn, "algorithm", "parameters", NULL), params_asn); egg_asn1x_set_oid_as_quark (egg_asn1x_node (info_asn, "algorithm", "algorithm", NULL), GCR_OID_PKIX1_DSA); g_bytes_unref (key); egg_asn1x_destroy (params_asn); return TRUE; }