OSX/sec/securityd/SecOCSPRequest.c

   1 /*
   2  * Copyright (c) 2008-2009,2012,2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * SecOCSPRequest.c - Trust policies dealing with certificate revocation.
  26  */
  27
  28 #include <securityd/SecOCSPRequest.h>
  29 #include <Security/SecCertificateInternal.h>
  30 #include <AssertMacros.h>
  31 #include <utilities/debugging.h>
  32 #include <security_asn1/SecAsn1Coder.h>
  33 #include <security_asn1/ocspTemplates.h>
  34 #include <security_asn1/oidsalg.h>
  35 #include <CommonCrypto/CommonDigest.h>
  36 #include <stdlib.h>
  37 #include "SecInternal.h"
  38
  39 /*
  40    OCSPRequest     ::=     SEQUENCE {
  41        tbsRequest                  TBSRequest,
  42        optionalSignature   [0]     EXPLICIT Signature OPTIONAL }
  43
  44    TBSRequest      ::=     SEQUENCE {
  45        version             [0]     EXPLICIT Version DEFAULT v1,
  46        requestorName       [1]     EXPLICIT GeneralName OPTIONAL,
  47        requestList                 SEQUENCE OF Request,
  48        requestExtensions   [2]     EXPLICIT Extensions OPTIONAL }
  49
  50    Signature       ::=     SEQUENCE {
  51        signatureAlgorithm      AlgorithmIdentifier,
  52        signature               BIT STRING,
  53        certs               [0] EXPLICIT SEQUENCE OF Certificate
  54    OPTIONAL}
  55
  56    Version         ::=             INTEGER  {  v1(0) }
  57
  58    Request         ::=     SEQUENCE {
  59        reqCert                     CertID,
  60        singleRequestExtensions     [0] EXPLICIT Extensions OPTIONAL }
  61
  62    CertID          ::=     SEQUENCE {
  63        hashAlgorithm       AlgorithmIdentifier,
  64        issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
  65        issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
  66        serialNumber        CertificateSerialNumber }
  67  */
  68 static CFDataRef _SecOCSPRequestCopyDEREncoding(SecOCSPRequestRef this) {
  69         /* fields obtained from issuer */
  70         SecAsn1OCSPSignedRequest        signedReq = {};
  71         SecAsn1OCSPTbsRequest           *tbs = &signedReq.tbsRequest;
  72         SecAsn1OCSPRequest                      singleReq = {};
  73         SecAsn1OCSPCertID                       *certId = &singleReq.reqCert;
  74         SecAsn1OCSPRequest                      *reqArray[2] = { &singleReq, NULL };
  75         uint8_t                                         version = 0;
  76         SecAsn1Item                                     vers = {1, &version};
  77     CFDataRef                   der = NULL;
  78     SecAsn1CoderRef             coder = NULL;
  79     CFDataRef                   issuerNameDigest;
  80     CFDataRef                   serial;
  81     CFDataRef                   issuerPubKeyDigest;
  82
  83
  84     /* algId refers to the hash we'll perform in issuer name and key */
  85     certId->algId.algorithm = CSSMOID_SHA1;
  86     /* preencoded DER NULL */
  87     static uint8_t nullParam[2] = {5, 0};
  88         certId->algId.parameters.Data = nullParam;
  89         certId->algId.parameters.Length = sizeof(nullParam);
  90
  91     /* @@@ Change this from using SecCertificateCopyIssuerSHA1Digest() /
  92        SecCertificateCopyPublicKeySHA1Digest() to
  93        SecCertificateCopyIssuerSequence() / SecCertificateGetPublicKeyData()
  94        and call SecDigestCreate here instead. */
  95     issuerNameDigest = SecCertificateCopyIssuerSHA1Digest(this->certificate);
  96     issuerPubKeyDigest = SecCertificateCopyPublicKeySHA1Digest(this->issuer);
  97 #if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
  98     serial = SecCertificateCopySerialNumber(this->certificate, NULL);
  99 #else
 100     serial = SecCertificateCopySerialNumber(this->certificate);
 101 #endif
 102
 103         /* build the CertID from those components */
 104         certId->issuerNameHash.Length = CC_SHA1_DIGEST_LENGTH;
 105         certId->issuerNameHash.Data = (uint8_t *)CFDataGetBytePtr(issuerNameDigest);
 106         certId->issuerPubKeyHash.Length = CC_SHA1_DIGEST_LENGTH;
 107         certId->issuerPubKeyHash.Data = (uint8_t *)CFDataGetBytePtr(issuerPubKeyDigest);
 108         certId->serialNumber.Length = CFDataGetLength(serial);
 109         certId->serialNumber.Data = (uint8_t *)CFDataGetBytePtr(serial);
 110
 111         /* Build top level request with one entry in requestList, no signature,
 112        and no optional extensions. */
 113         tbs->version = &vers;
 114         tbs->requestList = reqArray;
 115
 116         /* Encode the request. */
 117     require_noerr(SecAsn1CoderCreate(&coder), errOut);
 118     SecAsn1Item encoded;
 119         require_noerr(SecAsn1EncodeItem(coder, &signedReq,
 120         kSecAsn1OCSPSignedRequestTemplate, &encoded), errOut);
 121     der = CFDataCreate(kCFAllocatorDefault, encoded.Data,
 122         encoded.Length);
 123
 124 errOut:
 125     if (coder)
 126         SecAsn1CoderRelease(coder);
 127     CFReleaseSafe(issuerNameDigest);
 128     CFReleaseSafe(serial);
 129     CFReleaseSafe(issuerPubKeyDigest);
 130
 131     return der;
 132 }
 133
 134 SecOCSPRequestRef SecOCSPRequestCreate(SecCertificateRef certificate,
 135     SecCertificateRef issuer) {
 136     SecOCSPRequestRef this;
 137     require(this = (SecOCSPRequestRef)calloc(1, sizeof(struct __SecOCSPRequest)),
 138         errOut);
 139     this->certificate = certificate;
 140     this->issuer = issuer;
 141
 142     return this;
 143 errOut:
 144     if (this) {
 145         SecOCSPRequestFinalize(this);
 146     }
 147     return NULL;
 148 }
 149
 150 CFDataRef SecOCSPRequestGetDER(SecOCSPRequestRef this) {
 151     CFDataRef der = this->der;
 152     if (!der) {
 153         this->der = der = _SecOCSPRequestCopyDEREncoding(this);
 154     }
 155     return der;
 156 }
 157
 158 void SecOCSPRequestFinalize(SecOCSPRequestRef this) {
 159     CFReleaseSafe(this->der);
 160     free(this);
 161 }
 162