|
Packit Service |
4684c1 |
/*
|
|
Packit Service |
4684c1 |
* Copyright (C) 2016 Red Hat, Inc.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Author: Nikos Mavrogiannopoulos
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This file is part of GnuTLS.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* GnuTLS is free software; you can redistribute it and/or modify it
|
|
Packit Service |
4684c1 |
* under the terms of the GNU General Public License as published by
|
|
Packit Service |
4684c1 |
* the Free Software Foundation; either version 3 of the License, or
|
|
Packit Service |
4684c1 |
* (at your option) any later version.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* GnuTLS is distributed in the hope that it will be useful, but
|
|
Packit Service |
4684c1 |
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit Service |
4684c1 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit Service |
4684c1 |
* General Public License for more details.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* You should have received a copy of the GNU General Public License
|
|
Packit Service |
4684c1 |
* along with GnuTLS; if not, write to the Free Software Foundation,
|
|
Packit Service |
4684c1 |
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#ifdef HAVE_CONFIG_H
|
|
Packit Service |
4684c1 |
#include <config.h>
|
|
Packit Service |
4684c1 |
#endif
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include <stdio.h>
|
|
Packit Service |
4684c1 |
#include <stdlib.h>
|
|
Packit Service |
4684c1 |
#include <string.h>
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include <gnutls/gnutls.h>
|
|
Packit Service |
4684c1 |
#include <gnutls/x509.h>
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include "utils.h"
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static const char simple1[] =
|
|
Packit Service |
4684c1 |
/* CRL */
|
|
Packit Service |
4684c1 |
"-----BEGIN X509 CRL-----\n"
|
|
Packit Service |
4684c1 |
"MIIBmjCBgwIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDEwRDQS0wGA8yMDE0\n"
|
|
Packit Service |
4684c1 |
"MDkxMzA5MDUyM1oYDzIwMTUwOTEzMDkwNTIzWjAAoDowODAfBgNVHSMEGDAWgBTx\n"
|
|
Packit Service |
4684c1 |
"Fcb1FYLbhH9yuqg4wlVJUZnYKTAVBgNVHRQEDgIMVBQI0zeJoFHkLaWNMA0GCSqG\n"
|
|
Packit Service |
4684c1 |
"SIb3DQEBCwUAA4IBAQB6SGYePy1MBmtELyWdnlJHlQ4bBgb4vjuLDSfH0X6b4dAS\n"
|
|
Packit Service |
4684c1 |
"MEZws8iA5SaJFIioIP41s3lfQ1Am7GjSoNccHdrLmEcUSTQLwLYaDL8SgxekP5Au\n"
|
|
Packit Service |
4684c1 |
"w8HTu1cz/mnjBBDURq1RvyGNFm6MXf1Rg/bHSea/EpDkn8KY152BT1/46iQ+Uho6\n"
|
|
Packit Service |
4684c1 |
"hz6UUWsTB4Lj25X8F2hlKwQcb3E63Or2XEPBw4rhaCDFAtSZeBaGUUSJ8CLUKXZf\n"
|
|
Packit Service |
4684c1 |
"5b45MjiZ/osgd81tfn3wdQVjDnaQwNtjeRbK+qU0Z4pIKBvHzRS/fZKwTnrK1DLI\n"
|
|
Packit Service |
4684c1 |
"yY/nqBJT/+Q5zdUx5FXp0bwyZuarJ1GHqcES3Rz1\n"
|
|
Packit Service |
4684c1 |
"-----END X509 CRL-----\n";
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static const char simple1_constraints[] =
|
|
Packit Service |
4684c1 |
/* CRL */
|
|
Packit Service |
4684c1 |
"-----BEGIN X509 CRL-----\n"
|
|
Packit Service |
4684c1 |
"MIIBmjCBgwIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDEwRDQS0wGA8yMDE0\n"
|
|
Packit Service |
4684c1 |
"MDkxMzA4NTkxNloYDzIwMTUwOTEzMDg1OTE2WjAAoDowODAfBgNVHSMEGDAWgBTn\n"
|
|
Packit Service |
4684c1 |
"sISO6h9leKTKtOh/HG0jV03AMzAVBgNVHRQEDgIMVBQHZC2mj6EAgMPSMA0GCSqG\n"
|
|
Packit Service |
4684c1 |
"SIb3DQEBCwUAA4IBAQBHUgtxpOn8EHwlajVYoOh6DFCwIoxBIeUA4518W1cHoV7J\n"
|
|
Packit Service |
4684c1 |
"KMif6lmJRodrcbienDX781QcOaQcNnuu/oBEcoBdbZa0VICzXekIteSwEgGsbRve\n"
|
|
Packit Service |
4684c1 |
"QQFPnZn83I4btse1ly5fdxMsliSM+qRwIyNR18VHXZz9GWYrr4tYWnI2b9XrDnaC\n"
|
|
Packit Service |
4684c1 |
"1b3Ywt7I9pNi0/O0C0rE/37/VvPx6HghnC+un7LtT0Y0n+FQP7dhlMvzHaR8wVxs\n"
|
|
Packit Service |
4684c1 |
"WAzaNvSiJ1rVPzL21iCmQJsRQeDTSJBlzm0lWiU8Nys3ugM2KlERezfp8DkFGA3y\n"
|
|
Packit Service |
4684c1 |
"9Yzpq6gAi39ZK+LjopgGDkrQjxzBIaoe2bcDqB7X\n"
|
|
Packit Service |
4684c1 |
"-----END X509 CRL-----\n";
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static const char crl_dsa[] =
|
|
Packit Service |
4684c1 |
"-----BEGIN X509 CRL-----\n"
|
|
Packit Service |
4684c1 |
"MIGmMGUwCwYHKoZIzjgEAwUAMDgxCzAJBgNVBAYTAnVzMQwwCgYDVQQKEwNzdW4x\n"
|
|
Packit Service |
4684c1 |
"DDAKBgNVBAsTA2plczENMAsGA1UEAxMEZ3JlZxcNMDUwNTE3MTk1OTQwWhcNMDYw\n"
|
|
Packit Service |
4684c1 |
"NTE3MTk1OTQwWjALBgcqhkjOOAQDBQADMAAwLQIUBBFLGYjUCVrRTGf3GTR6SGs/\n"
|
|
Packit Service |
4684c1 |
"accCFQCUhnSmr+CXCWKq8DtydVwH9FLsRA==\n"
|
|
Packit Service |
4684c1 |
"-----END X509 CRL-----\n";
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static const char crl_rsa_sha1[] =
|
|
Packit Service |
4684c1 |
"-----BEGIN X509 CRL-----\n"
|
|
Packit Service |
4684c1 |
"MIIB2zCBxAIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJOTjExMC8GA1UE\n"
|
|
Packit Service |
4684c1 |
"CgwoRWRlbCBDdXJsIEFyY3RpYyBJbGx1ZGl1bSBSZXNlYXJjaCBDbG91ZDElMCMG\n"
|
|
Packit Service |
4684c1 |
"A1UEAwwcTm90aGVybiBOb3doZXJlIFRydXN0IEFuY2hvchcNMTAwNTI3MjEzNzEx\n"
|
|
Packit Service |
4684c1 |
"WhcNMTAwNjI2MjEzNzExWjAZMBcCBguYlPl8ahcNMTAwNTI3MjEzNzExWqAOMAww\n"
|
|
Packit Service |
4684c1 |
"CgYDVR0UBAMCAQEwDQYJKoZIhvcNAQEFBQADggEBAFuPZJ/cNNCeAzkSxVvPPPRX\n"
|
|
Packit Service |
4684c1 |
"Wsv9T6Dt61C5Fmq9eSNN2kRf7/dq5A5nqTIlHbXXiLdj3UqNhUHXe2oA1UpbdHz9\n"
|
|
Packit Service |
4684c1 |
"0JlfwWm1Y/gMr1fh1n0oFebEtCuOgDRpd07Uiz8AqOUBykDNDUlMvVwR9raHL8hj\n"
|
|
Packit Service |
4684c1 |
"NRwzugsfIxl0CvLLqrBpUWMxW3qemk4cWW39yrDdZgKo6eOZAOR3FQYlLIrw6Jcr\n"
|
|
Packit Service |
4684c1 |
"Kmm0PjdcJIfRgJvNysgyx1dIIKe7QXvFTR/QzdHWIWTkiYIW7wUKSzSICvDCr094\n"
|
|
Packit Service |
4684c1 |
"eo3nr3n9BtOqT61Z1m6FGCP6Mm0wFl6xLTCNd6ygfFo7pcAdWlUsdBgKzics0Kc=\n"
|
|
Packit Service |
4684c1 |
"-----END X509 CRL-----\n";
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static struct
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
const char *name;
|
|
Packit Service |
4684c1 |
const char *crl;
|
|
Packit Service |
4684c1 |
unsigned sign_algo;
|
|
Packit Service |
4684c1 |
const char *sign_oid;
|
|
Packit Service |
4684c1 |
int crt_count;
|
|
Packit Service |
4684c1 |
time_t next_update;
|
|
Packit Service |
4684c1 |
time_t this_update;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
time_t crt_revoke_time;
|
|
Packit Service |
4684c1 |
size_t crt_serial_size;
|
|
Packit Service |
4684c1 |
const char *crt_serial;
|
|
Packit Service |
4684c1 |
} crl_list[] =
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
{ .name = "crl-sha256-1",
|
|
Packit Service |
4684c1 |
.crl = simple1,
|
|
Packit Service |
4684c1 |
.sign_algo = GNUTLS_SIGN_RSA_SHA256,
|
|
Packit Service |
4684c1 |
.sign_oid = "1.2.840.113549.1.1.11",
|
|
Packit Service |
4684c1 |
.crt_count = 0,
|
|
Packit Service |
4684c1 |
.this_update = 1410599123,
|
|
Packit Service |
4684c1 |
.next_update = 1442135123
|
|
Packit Service |
4684c1 |
},
|
|
Packit Service |
4684c1 |
{ .name = "crl-sha256-2",
|
|
Packit Service |
4684c1 |
.crl = simple1_constraints,
|
|
Packit Service |
4684c1 |
.sign_algo = GNUTLS_SIGN_RSA_SHA256,
|
|
Packit Service |
4684c1 |
.sign_oid = "1.2.840.113549.1.1.11",
|
|
Packit Service |
4684c1 |
.crt_count = 0,
|
|
Packit Service |
4684c1 |
.this_update = 1410598756,
|
|
Packit Service |
4684c1 |
.next_update = 1442134756
|
|
Packit Service |
4684c1 |
},
|
|
Packit Service |
4684c1 |
{ .name = "crl-dsa",
|
|
Packit Service |
4684c1 |
.crl = crl_dsa,
|
|
Packit Service |
4684c1 |
.sign_algo = GNUTLS_SIGN_DSA_SHA1,
|
|
Packit Service |
4684c1 |
.sign_oid = "1.2.840.10040.4.3",
|
|
Packit Service |
4684c1 |
.crt_count = 0,
|
|
Packit Service |
4684c1 |
.this_update = 1116359980,
|
|
Packit Service |
4684c1 |
.next_update = 1147895980
|
|
Packit Service |
4684c1 |
},
|
|
Packit Service |
4684c1 |
{ .name = "crl-rsa-sha1",
|
|
Packit Service |
4684c1 |
.crl = crl_rsa_sha1,
|
|
Packit Service |
4684c1 |
.sign_algo = GNUTLS_SIGN_RSA_SHA1,
|
|
Packit Service |
4684c1 |
.sign_oid = "1.2.840.113549.1.1.5",
|
|
Packit Service |
4684c1 |
.crt_count = 1,
|
|
Packit Service |
4684c1 |
.this_update = 1274996231,
|
|
Packit Service |
4684c1 |
.next_update = 1277588231,
|
|
Packit Service |
4684c1 |
.crt_revoke_time = 1274996231,
|
|
Packit Service |
4684c1 |
.crt_serial = "\x0b\x98\x94\xf9\x7c\x6a",
|
|
Packit Service |
4684c1 |
.crt_serial_size = 6
|
|
Packit Service |
4684c1 |
},
|
|
Packit Service |
4684c1 |
{ NULL, NULL, 0, 0}
|
|
Packit Service |
4684c1 |
};
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static void tls_log_func(int level, const char *str)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
fprintf(stderr, "|<%d>| %s", level, str);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
void doit(void)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
int exit_val = 0;
|
|
Packit Service |
4684c1 |
size_t i;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
gnutls_x509_crl_t crl;
|
|
Packit Service |
4684c1 |
gnutls_datum_t tmp;
|
|
Packit Service |
4684c1 |
char oid[256];
|
|
Packit Service |
4684c1 |
size_t oid_size;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = global_init();
|
|
Packit Service |
4684c1 |
if (ret != 0) {
|
|
Packit Service |
4684c1 |
fail("%d: %s\n", ret, gnutls_strerror(ret));
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_global_set_log_function(tls_log_func);
|
|
Packit Service |
4684c1 |
if (debug)
|
|
Packit Service |
4684c1 |
gnutls_global_set_log_level(4711);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i = 0; crl_list[i].name; i++) {
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (debug)
|
|
Packit Service |
4684c1 |
printf("Chain '%s' (%d)...\n", crl_list[i].name,
|
|
Packit Service |
4684c1 |
(int) i);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (debug > 2)
|
|
Packit Service |
4684c1 |
printf("\tAdding CRL...");
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_init(&crl;;
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
fprintf(stderr,
|
|
Packit Service |
4684c1 |
"gnutls_x509_crl_init[%d]: %s\n",
|
|
Packit Service |
4684c1 |
(int) i,
|
|
Packit Service |
4684c1 |
gnutls_strerror(ret));
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
tmp.data = (unsigned char*)crl_list[i].crl;
|
|
Packit Service |
4684c1 |
tmp.size = strlen(crl_list[i].crl);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
gnutls_x509_crl_import(crl, &tmp,
|
|
Packit Service |
4684c1 |
GNUTLS_X509_FMT_PEM);
|
|
Packit Service |
4684c1 |
if (debug > 2)
|
|
Packit Service |
4684c1 |
printf("done\n");
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
fprintf(stderr,
|
|
Packit Service |
4684c1 |
"gnutls_x509_crl_import[%s]: %s\n",
|
|
Packit Service |
4684c1 |
crl_list[i].name,
|
|
Packit Service |
4684c1 |
gnutls_strerror(ret));
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_x509_crl_print(crl,
|
|
Packit Service |
4684c1 |
GNUTLS_CRT_PRINT_ONELINE,
|
|
Packit Service |
4684c1 |
&tmp);
|
|
Packit Service |
4684c1 |
if (debug)
|
|
Packit Service |
4684c1 |
printf("\tCRL: %.*s\n",
|
|
Packit Service |
4684c1 |
tmp.size, tmp.data);
|
|
Packit Service |
4684c1 |
gnutls_free(tmp.data);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_signature_algorithm(crl);
|
|
Packit Service |
4684c1 |
if (ret != (int)crl_list[i].sign_algo) {
|
|
Packit Service |
4684c1 |
fail("%s: error extracting signature algorithm: %d/%s\n", crl_list[i].name, ret, gnutls_strerror(ret));
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
oid_size = sizeof(oid);
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_signature_oid(crl, oid, &oid_size);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
fail("%s: error extracting signature algorithm OID: %s\n", crl_list[i].name, gnutls_strerror(ret));
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (strcmp(oid, crl_list[i].sign_oid) != 0) {
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted signature algorithm: %s\n", crl_list[i].name, oid);
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_crt_count(crl);
|
|
Packit Service |
4684c1 |
if (ret != crl_list[i].crt_count) {
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted CRT count: %d\n", crl_list[i].name, ret);
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (crl_list[i].crt_count > 0) {
|
|
Packit Service |
4684c1 |
unsigned char serial[128];
|
|
Packit Service |
4684c1 |
size_t ssize = sizeof(serial);
|
|
Packit Service |
4684c1 |
time_t t = 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_crt_serial(crl, 0, serial, &ssize, &t);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted serial: %d\n", crl_list[i].name, ret);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (t != crl_list[i].crt_revoke_time)
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted revocation time: %u\n", crl_list[i].name, (unsigned)t);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (ssize != crl_list[i].crt_serial_size || memcmp(serial, crl_list[i].crt_serial, ssize) != 0) {
|
|
Packit Service |
4684c1 |
for (i=0;i
|
|
Packit Service |
4684c1 |
fprintf(stderr, "%.2x", (unsigned)serial[i]);
|
|
Packit Service |
4684c1 |
fprintf(stderr, "\n");
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted serial\n", crl_list[i].name);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_this_update(crl);
|
|
Packit Service |
4684c1 |
if (ret != crl_list[i].this_update) {
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted thisUpdate: %d\n", crl_list[i].name, ret);
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_x509_crl_get_next_update(crl);
|
|
Packit Service |
4684c1 |
if (ret != crl_list[i].next_update) {
|
|
Packit Service |
4684c1 |
fail("%s: error on the extracted nextUpdate: %d\n", crl_list[i].name, ret);
|
|
Packit Service |
4684c1 |
exit(1);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_x509_crl_deinit(crl);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (debug)
|
|
Packit Service |
4684c1 |
printf("done\n\n\n");
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_global_deinit();
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (debug)
|
|
Packit Service |
4684c1 |
printf("Exit status...%d\n", exit_val);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
exit(exit_val);
|
|
Packit Service |
4684c1 |
}
|