Source file src/pkg/crypto/x509/x509.go
1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // Package x509 parses X.509-encoded keys and certificates. 6 package x509 7 8 import ( 9 "bytes" 10 "crypto" 11 "crypto/dsa" 12 "crypto/rsa" 13 "crypto/sha1" 14 "crypto/x509/pkix" 15 "encoding/asn1" 16 "encoding/pem" 17 "errors" 18 "io" 19 "math/big" 20 "time" 21 ) 22 23 // pkixPublicKey reflects a PKIX public key structure. See SubjectPublicKeyInfo 24 // in RFC 3280. 25 type pkixPublicKey struct { 26 Algo pkix.AlgorithmIdentifier 27 BitString asn1.BitString 28 } 29 30 // ParsePKIXPublicKey parses a DER encoded public key. These values are 31 // typically found in PEM blocks with "BEGIN PUBLIC KEY". 32 func ParsePKIXPublicKey(derBytes []byte) (pub interface{}, err error) { 33 var pki publicKeyInfo 34 if _, err = asn1.Unmarshal(derBytes, &pki); err != nil { 35 return 36 } 37 algo := getPublicKeyAlgorithmFromOID(pki.Algorithm.Algorithm) 38 if algo == UnknownPublicKeyAlgorithm { 39 return nil, errors.New("ParsePKIXPublicKey: unknown public key algorithm") 40 } 41 return parsePublicKey(algo, &pki) 42 } 43 44 // MarshalPKIXPublicKey serialises a public key to DER-encoded PKIX format. 45 func MarshalPKIXPublicKey(pub interface{}) ([]byte, error) { 46 var pubBytes []byte 47 48 switch pub := pub.(type) { 49 case *rsa.PublicKey: 50 pubBytes, _ = asn1.Marshal(rsaPublicKey{ 51 N: pub.N, 52 E: pub.E, 53 }) 54 default: 55 return nil, errors.New("MarshalPKIXPublicKey: unknown public key type") 56 } 57 58 pkix := pkixPublicKey{ 59 Algo: pkix.AlgorithmIdentifier{ 60 Algorithm: []int{1, 2, 840, 113549, 1, 1, 1}, 61 // This is a NULL parameters value which is technically 62 // superfluous, but most other code includes it and, by 63 // doing this, we match their public key hashes. 64 Parameters: asn1.RawValue{ 65 Tag: 5, 66 }, 67 }, 68 BitString: asn1.BitString{ 69 Bytes: pubBytes, 70 BitLength: 8 * len(pubBytes), 71 }, 72 } 73 74 ret, _ := asn1.Marshal(pkix) 75 return ret, nil 76 } 77 78 // These structures reflect the ASN.1 structure of X.509 certificates.: 79 80 type certificate struct { 81 Raw asn1.RawContent 82 TBSCertificate tbsCertificate 83 SignatureAlgorithm pkix.AlgorithmIdentifier 84 SignatureValue asn1.BitString 85 } 86 87 type tbsCertificate struct { 88 Raw asn1.RawContent 89 Version int `asn1:"optional,explicit,default:1,tag:0"` 90 SerialNumber *big.Int 91 SignatureAlgorithm pkix.AlgorithmIdentifier 92 Issuer asn1.RawValue 93 Validity validity 94 Subject asn1.RawValue 95 PublicKey publicKeyInfo 96 UniqueId asn1.BitString `asn1:"optional,tag:1"` 97 SubjectUniqueId asn1.BitString `asn1:"optional,tag:2"` 98 Extensions []pkix.Extension `asn1:"optional,explicit,tag:3"` 99 } 100 101 type dsaAlgorithmParameters struct { 102 P, Q, G *big.Int 103 } 104 105 type dsaSignature struct { 106 R, S *big.Int 107 } 108 109 type validity struct { 110 NotBefore, NotAfter time.Time 111 } 112 113 type publicKeyInfo struct { 114 Raw asn1.RawContent 115 Algorithm pkix.AlgorithmIdentifier 116 PublicKey asn1.BitString 117 } 118 119 // RFC 5280, 4.2.1.1 120 type authKeyId struct { 121 Id []byte `asn1:"optional,tag:0"` 122 } 123 124 type SignatureAlgorithm int 125 126 const ( 127 UnknownSignatureAlgorithm SignatureAlgorithm = iota 128 MD2WithRSA 129 MD5WithRSA 130 SHA1WithRSA 131 SHA256WithRSA 132 SHA384WithRSA 133 SHA512WithRSA 134 DSAWithSHA1 135 DSAWithSHA256 136 ) 137 138 type PublicKeyAlgorithm int 139 140 const ( 141 UnknownPublicKeyAlgorithm PublicKeyAlgorithm = iota 142 RSA 143 DSA 144 ) 145 146 // OIDs for signature algorithms 147 // 148 // pkcs-1 OBJECT IDENTIFIER ::= { 149 // iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 } 150 // 151 // 152 // RFC 3279 2.2.1 RSA Signature Algorithms 153 // 154 // md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 } 155 // 156 // md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 } 157 // 158 // sha-1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 } 159 // 160 // dsaWithSha1 OBJECT IDENTIFIER ::= { 161 // iso(1) member-body(2) us(840) x9-57(10040) x9cm(4) 3 } 162 // 163 // 164 // RFC 4055 5 PKCS #1 Version 1.5 165 // 166 // sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 } 167 // 168 // sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 } 169 // 170 // sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 } 171 // 172 // 173 // RFC 5758 3.1 DSA Signature Algorithms 174 // 175 // dsaWithSha256 OBJECT IDENTIFIER ::= { 176 // joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) 177 // csor(3) algorithms(4) id-dsa-with-sha2(3) 2} 178 // 179 var ( 180 oidSignatureMD2WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 2} 181 oidSignatureMD5WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4} 182 oidSignatureSHA1WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5} 183 oidSignatureSHA256WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11} 184 oidSignatureSHA384WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12} 185 oidSignatureSHA512WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13} 186 oidSignatureDSAWithSHA1 = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3} 187 oidSignatureDSAWithSHA256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 4, 3, 2} 188 ) 189 190 func getSignatureAlgorithmFromOID(oid asn1.ObjectIdentifier) SignatureAlgorithm { 191 switch { 192 case oid.Equal(oidSignatureMD2WithRSA): 193 return MD2WithRSA 194 case oid.Equal(oidSignatureMD5WithRSA): 195 return MD5WithRSA 196 case oid.Equal(oidSignatureSHA1WithRSA): 197 return SHA1WithRSA 198 case oid.Equal(oidSignatureSHA256WithRSA): 199 return SHA256WithRSA 200 case oid.Equal(oidSignatureSHA384WithRSA): 201 return SHA384WithRSA 202 case oid.Equal(oidSignatureSHA512WithRSA): 203 return SHA512WithRSA 204 case oid.Equal(oidSignatureDSAWithSHA1): 205 return DSAWithSHA1 206 case oid.Equal(oidSignatureDSAWithSHA256): 207 return DSAWithSHA256 208 } 209 return UnknownSignatureAlgorithm 210 } 211 212 // RFC 3279, 2.3 Public Key Algorithms 213 // 214 // pkcs-1 OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840) 215 // rsadsi(113549) pkcs(1) 1 } 216 // 217 // rsaEncryption OBJECT IDENTIFIER ::== { pkcs1-1 1 } 218 // 219 // id-dsa OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840) 220 // x9-57(10040) x9cm(4) 1 } 221 var ( 222 oidPublicKeyRsa = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1} 223 oidPublicKeyDsa = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 1} 224 ) 225 226 func getPublicKeyAlgorithmFromOID(oid asn1.ObjectIdentifier) PublicKeyAlgorithm { 227 switch { 228 case oid.Equal(oidPublicKeyRsa): 229 return RSA 230 case oid.Equal(oidPublicKeyDsa): 231 return DSA 232 } 233 return UnknownPublicKeyAlgorithm 234 } 235 236 // KeyUsage represents the set of actions that are valid for a given key. It's 237 // a bitmap of the KeyUsage* constants. 238 type KeyUsage int 239 240 const ( 241 KeyUsageDigitalSignature KeyUsage = 1 << iota 242 KeyUsageContentCommitment 243 KeyUsageKeyEncipherment 244 KeyUsageDataEncipherment 245 KeyUsageKeyAgreement 246 KeyUsageCertSign 247 KeyUsageCRLSign 248 KeyUsageEncipherOnly 249 KeyUsageDecipherOnly 250 ) 251 252 // RFC 5280, 4.2.1.12 Extended Key Usage 253 // 254 // anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } 255 // 256 // id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } 257 // 258 // id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 } 259 // id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 } 260 // id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 } 261 // id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 } 262 // id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } 263 // id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } 264 var ( 265 oidExtKeyUsageAny = asn1.ObjectIdentifier{2, 5, 29, 37, 0} 266 oidExtKeyUsageServerAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1} 267 oidExtKeyUsageClientAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2} 268 oidExtKeyUsageCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 3} 269 oidExtKeyUsageEmailProtection = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 4} 270 oidExtKeyUsageTimeStamping = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 8} 271 oidExtKeyUsageOCSPSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 9} 272 ) 273 274 // ExtKeyUsage represents an extended set of actions that are valid for a given key. 275 // Each of the ExtKeyUsage* constants define a unique action. 276 type ExtKeyUsage int 277 278 const ( 279 ExtKeyUsageAny ExtKeyUsage = iota 280 ExtKeyUsageServerAuth 281 ExtKeyUsageClientAuth 282 ExtKeyUsageCodeSigning 283 ExtKeyUsageEmailProtection 284 ExtKeyUsageTimeStamping 285 ExtKeyUsageOCSPSigning 286 ) 287 288 // A Certificate represents an X.509 certificate. 289 type Certificate struct { 290 Raw []byte // Complete ASN.1 DER content (certificate, signature algorithm and signature). 291 RawTBSCertificate []byte // Certificate part of raw ASN.1 DER content. 292 RawSubjectPublicKeyInfo []byte // DER encoded SubjectPublicKeyInfo. 293 RawSubject []byte // DER encoded Subject 294 RawIssuer []byte // DER encoded Issuer 295 296 Signature []byte 297 SignatureAlgorithm SignatureAlgorithm 298 299 PublicKeyAlgorithm PublicKeyAlgorithm 300 PublicKey interface{} 301 302 Version int 303 SerialNumber *big.Int 304 Issuer pkix.Name 305 Subject pkix.Name 306 NotBefore, NotAfter time.Time // Validity bounds. 307 KeyUsage KeyUsage 308 309 ExtKeyUsage []ExtKeyUsage // Sequence of extended key usages. 310 UnknownExtKeyUsage []asn1.ObjectIdentifier // Encountered extended key usages unknown to this package. 311 312 BasicConstraintsValid bool // if true then the next two fields are valid. 313 IsCA bool 314 MaxPathLen int 315 316 SubjectKeyId []byte 317 AuthorityKeyId []byte 318 319 // Subject Alternate Name values 320 DNSNames []string 321 EmailAddresses []string 322 323 // Name constraints 324 PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical. 325 PermittedDNSDomains []string 326 327 PolicyIdentifiers []asn1.ObjectIdentifier 328 } 329 330 // ErrUnsupportedAlgorithm results from attempting to perform an operation that 331 // involves algorithms that are not currently implemented. 332 var ErrUnsupportedAlgorithm = errors.New("crypto/x509: cannot verify signature: algorithm unimplemented") 333 334 // ConstraintViolationError results when a requested usage is not permitted by 335 // a certificate. For example: checking a signature when the public key isn't a 336 // certificate signing key. 337 type ConstraintViolationError struct{} 338 339 func (ConstraintViolationError) Error() string { 340 return "crypto/x509: invalid signature: parent certificate cannot sign this kind of certificate" 341 } 342 343 func (c *Certificate) Equal(other *Certificate) bool { 344 return bytes.Equal(c.Raw, other.Raw) 345 } 346 347 // CheckSignatureFrom verifies that the signature on c is a valid signature 348 // from parent. 349 func (c *Certificate) CheckSignatureFrom(parent *Certificate) (err error) { 350 // RFC 5280, 4.2.1.9: 351 // "If the basic constraints extension is not present in a version 3 352 // certificate, or the extension is present but the cA boolean is not 353 // asserted, then the certified public key MUST NOT be used to verify 354 // certificate signatures." 355 if parent.Version == 3 && !parent.BasicConstraintsValid || 356 parent.BasicConstraintsValid && !parent.IsCA { 357 return ConstraintViolationError{} 358 } 359 360 if parent.KeyUsage != 0 && parent.KeyUsage&KeyUsageCertSign == 0 { 361 return ConstraintViolationError{} 362 } 363 364 if parent.PublicKeyAlgorithm == UnknownPublicKeyAlgorithm { 365 return ErrUnsupportedAlgorithm 366 } 367 368 // TODO(agl): don't ignore the path length constraint. 369 370 return parent.CheckSignature(c.SignatureAlgorithm, c.RawTBSCertificate, c.Signature) 371 } 372 373 // CheckSignature verifies that signature is a valid signature over signed from 374 // c's public key. 375 func (c *Certificate) CheckSignature(algo SignatureAlgorithm, signed, signature []byte) (err error) { 376 var hashType crypto.Hash 377 378 switch algo { 379 case SHA1WithRSA, DSAWithSHA1: 380 hashType = crypto.SHA1 381 case SHA256WithRSA, DSAWithSHA256: 382 hashType = crypto.SHA256 383 case SHA384WithRSA: 384 hashType = crypto.SHA384 385 case SHA512WithRSA: 386 hashType = crypto.SHA512 387 default: 388 return ErrUnsupportedAlgorithm 389 } 390 391 h := hashType.New() 392 if h == nil { 393 return ErrUnsupportedAlgorithm 394 } 395 396 h.Write(signed) 397 digest := h.Sum(nil) 398 399 switch pub := c.PublicKey.(type) { 400 case *rsa.PublicKey: 401 return rsa.VerifyPKCS1v15(pub, hashType, digest, signature) 402 case *dsa.PublicKey: 403 dsaSig := new(dsaSignature) 404 if _, err := asn1.Unmarshal(signature, dsaSig); err != nil { 405 return err 406 } 407 if dsaSig.R.Sign() <= 0 || dsaSig.S.Sign() <= 0 { 408 return errors.New("DSA signature contained zero or negative values") 409 } 410 if !dsa.Verify(pub, digest, dsaSig.R, dsaSig.S) { 411 return errors.New("DSA verification failure") 412 } 413 return 414 } 415 return ErrUnsupportedAlgorithm 416 } 417 418 // CheckCRLSignature checks that the signature in crl is from c. 419 func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) (err error) { 420 algo := getSignatureAlgorithmFromOID(crl.SignatureAlgorithm.Algorithm) 421 return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign()) 422 } 423 424 type UnhandledCriticalExtension struct{} 425 426 func (h UnhandledCriticalExtension) Error() string { 427 return "unhandled critical extension" 428 } 429 430 type basicConstraints struct { 431 IsCA bool `asn1:"optional"` 432 MaxPathLen int `asn1:"optional,default:-1"` 433 } 434 435 // RFC 5280 4.2.1.4 436 type policyInformation struct { 437 Policy asn1.ObjectIdentifier 438 // policyQualifiers omitted 439 } 440 441 // RFC 5280, 4.2.1.10 442 type nameConstraints struct { 443 Permitted []generalSubtree `asn1:"optional,tag:0"` 444 Excluded []generalSubtree `asn1:"optional,tag:1"` 445 } 446 447 type generalSubtree struct { 448 Name string `asn1:"tag:2,optional,ia5"` 449 Min int `asn1:"optional,tag:0"` 450 Max int `asn1:"optional,tag:1"` 451 } 452 453 func parsePublicKey(algo PublicKeyAlgorithm, keyData *publicKeyInfo) (interface{}, error) { 454 asn1Data := keyData.PublicKey.RightAlign() 455 switch algo { 456 case RSA: 457 p := new(rsaPublicKey) 458 _, err := asn1.Unmarshal(asn1Data, p) 459 if err != nil { 460 return nil, err 461 } 462 463 pub := &rsa.PublicKey{ 464 E: p.E, 465 N: p.N, 466 } 467 return pub, nil 468 case DSA: 469 var p *big.Int 470 _, err := asn1.Unmarshal(asn1Data, &p) 471 if err != nil { 472 return nil, err 473 } 474 paramsData := keyData.Algorithm.Parameters.FullBytes 475 params := new(dsaAlgorithmParameters) 476 _, err = asn1.Unmarshal(paramsData, params) 477 if err != nil { 478 return nil, err 479 } 480 if p.Sign() <= 0 || params.P.Sign() <= 0 || params.Q.Sign() <= 0 || params.G.Sign() <= 0 { 481 return nil, errors.New("zero or negative DSA parameter") 482 } 483 pub := &dsa.PublicKey{ 484 Parameters: dsa.Parameters{ 485 P: params.P, 486 Q: params.Q, 487 G: params.G, 488 }, 489 Y: p, 490 } 491 return pub, nil 492 default: 493 return nil, nil 494 } 495 panic("unreachable") 496 } 497 498 func parseCertificate(in *certificate) (*Certificate, error) { 499 out := new(Certificate) 500 out.Raw = in.Raw 501 out.RawTBSCertificate = in.TBSCertificate.Raw 502 out.RawSubjectPublicKeyInfo = in.TBSCertificate.PublicKey.Raw 503 out.RawSubject = in.TBSCertificate.Subject.FullBytes 504 out.RawIssuer = in.TBSCertificate.Issuer.FullBytes 505 506 out.Signature = in.SignatureValue.RightAlign() 507 out.SignatureAlgorithm = 508 getSignatureAlgorithmFromOID(in.TBSCertificate.SignatureAlgorithm.Algorithm) 509 510 out.PublicKeyAlgorithm = 511 getPublicKeyAlgorithmFromOID(in.TBSCertificate.PublicKey.Algorithm.Algorithm) 512 var err error 513 out.PublicKey, err = parsePublicKey(out.PublicKeyAlgorithm, &in.TBSCertificate.PublicKey) 514 if err != nil { 515 return nil, err 516 } 517 518 if in.TBSCertificate.SerialNumber.Sign() < 0 { 519 return nil, errors.New("negative serial number") 520 } 521 522 out.Version = in.TBSCertificate.Version + 1 523 out.SerialNumber = in.TBSCertificate.SerialNumber 524 525 var issuer, subject pkix.RDNSequence 526 if _, err := asn1.Unmarshal(in.TBSCertificate.Subject.FullBytes, &subject); err != nil { 527 return nil, err 528 } 529 if _, err := asn1.Unmarshal(in.TBSCertificate.Issuer.FullBytes, &issuer); err != nil { 530 return nil, err 531 } 532 533 out.Issuer.FillFromRDNSequence(&issuer) 534 out.Subject.FillFromRDNSequence(&subject) 535 536 out.NotBefore = in.TBSCertificate.Validity.NotBefore 537 out.NotAfter = in.TBSCertificate.Validity.NotAfter 538 539 for _, e := range in.TBSCertificate.Extensions { 540 if len(e.Id) == 4 && e.Id[0] == 2 && e.Id[1] == 5 && e.Id[2] == 29 { 541 switch e.Id[3] { 542 case 15: 543 // RFC 5280, 4.2.1.3 544 var usageBits asn1.BitString 545 _, err := asn1.Unmarshal(e.Value, &usageBits) 546 547 if err == nil { 548 var usage int 549 for i := 0; i < 9; i++ { 550 if usageBits.At(i) != 0 { 551 usage |= 1 << uint(i) 552 } 553 } 554 out.KeyUsage = KeyUsage(usage) 555 continue 556 } 557 case 19: 558 // RFC 5280, 4.2.1.9 559 var constraints basicConstraints 560 _, err := asn1.Unmarshal(e.Value, &constraints) 561 562 if err == nil { 563 out.BasicConstraintsValid = true 564 out.IsCA = constraints.IsCA 565 out.MaxPathLen = constraints.MaxPathLen 566 continue 567 } 568 case 17: 569 // RFC 5280, 4.2.1.6 570 571 // SubjectAltName ::= GeneralNames 572 // 573 // GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName 574 // 575 // GeneralName ::= CHOICE { 576 // otherName [0] OtherName, 577 // rfc822Name [1] IA5String, 578 // dNSName [2] IA5String, 579 // x400Address [3] ORAddress, 580 // directoryName [4] Name, 581 // ediPartyName [5] EDIPartyName, 582 // uniformResourceIdentifier [6] IA5String, 583 // iPAddress [7] OCTET STRING, 584 // registeredID [8] OBJECT IDENTIFIER } 585 var seq asn1.RawValue 586 _, err := asn1.Unmarshal(e.Value, &seq) 587 if err != nil { 588 return nil, err 589 } 590 if !seq.IsCompound || seq.Tag != 16 || seq.Class != 0 { 591 return nil, asn1.StructuralError{Msg: "bad SAN sequence"} 592 } 593 594 parsedName := false 595 596 rest := seq.Bytes 597 for len(rest) > 0 { 598 var v asn1.RawValue 599 rest, err = asn1.Unmarshal(rest, &v) 600 if err != nil { 601 return nil, err 602 } 603 switch v.Tag { 604 case 1: 605 out.EmailAddresses = append(out.EmailAddresses, string(v.Bytes)) 606 parsedName = true 607 case 2: 608 out.DNSNames = append(out.DNSNames, string(v.Bytes)) 609 parsedName = true 610 } 611 } 612 613 if parsedName { 614 continue 615 } 616 // If we didn't parse any of the names then we 617 // fall through to the critical check below. 618 619 case 30: 620 // RFC 5280, 4.2.1.10 621 622 // NameConstraints ::= SEQUENCE { 623 // permittedSubtrees [0] GeneralSubtrees OPTIONAL, 624 // excludedSubtrees [1] GeneralSubtrees OPTIONAL } 625 // 626 // GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree 627 // 628 // GeneralSubtree ::= SEQUENCE { 629 // base GeneralName, 630 // minimum [0] BaseDistance DEFAULT 0, 631 // maximum [1] BaseDistance OPTIONAL } 632 // 633 // BaseDistance ::= INTEGER (0..MAX) 634 635 var constraints nameConstraints 636 _, err := asn1.Unmarshal(e.Value, &constraints) 637 if err != nil { 638 return nil, err 639 } 640 641 if len(constraints.Excluded) > 0 && e.Critical { 642 return out, UnhandledCriticalExtension{} 643 } 644 645 for _, subtree := range constraints.Permitted { 646 if subtree.Min > 0 || subtree.Max > 0 || len(subtree.Name) == 0 { 647 if e.Critical { 648 return out, UnhandledCriticalExtension{} 649 } 650 continue 651 } 652 out.PermittedDNSDomains = append(out.PermittedDNSDomains, subtree.Name) 653 } 654 continue 655 656 case 35: 657 // RFC 5280, 4.2.1.1 658 var a authKeyId 659 _, err = asn1.Unmarshal(e.Value, &a) 660 if err != nil { 661 return nil, err 662 } 663 out.AuthorityKeyId = a.Id 664 continue 665 666 case 37: 667 // RFC 5280, 4.2.1.12. Extended Key Usage 668 669 // id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 } 670 // 671 // ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId 672 // 673 // KeyPurposeId ::= OBJECT IDENTIFIER 674 675 var keyUsage []asn1.ObjectIdentifier 676 _, err = asn1.Unmarshal(e.Value, &keyUsage) 677 if err != nil { 678 return nil, err 679 } 680 681 for _, u := range keyUsage { 682 switch { 683 case u.Equal(oidExtKeyUsageAny): 684 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageAny) 685 case u.Equal(oidExtKeyUsageServerAuth): 686 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageServerAuth) 687 case u.Equal(oidExtKeyUsageClientAuth): 688 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageClientAuth) 689 case u.Equal(oidExtKeyUsageCodeSigning): 690 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageCodeSigning) 691 case u.Equal(oidExtKeyUsageEmailProtection): 692 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageEmailProtection) 693 case u.Equal(oidExtKeyUsageTimeStamping): 694 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageTimeStamping) 695 case u.Equal(oidExtKeyUsageOCSPSigning): 696 out.ExtKeyUsage = append(out.ExtKeyUsage, ExtKeyUsageOCSPSigning) 697 default: 698 out.UnknownExtKeyUsage = append(out.UnknownExtKeyUsage, u) 699 } 700 } 701 702 continue 703 704 case 14: 705 // RFC 5280, 4.2.1.2 706 var keyid []byte 707 _, err = asn1.Unmarshal(e.Value, &keyid) 708 if err != nil { 709 return nil, err 710 } 711 out.SubjectKeyId = keyid 712 continue 713 714 case 32: 715 // RFC 5280 4.2.1.4: Certificate Policies 716 var policies []policyInformation 717 if _, err = asn1.Unmarshal(e.Value, &policies); err != nil { 718 return nil, err 719 } 720 out.PolicyIdentifiers = make([]asn1.ObjectIdentifier, len(policies)) 721 for i, policy := range policies { 722 out.PolicyIdentifiers[i] = policy.Policy 723 } 724 } 725 } 726 727 if e.Critical { 728 return out, UnhandledCriticalExtension{} 729 } 730 } 731 732 return out, nil 733 } 734 735 // ParseCertificate parses a single certificate from the given ASN.1 DER data. 736 func ParseCertificate(asn1Data []byte) (*Certificate, error) { 737 var cert certificate 738 rest, err := asn1.Unmarshal(asn1Data, &cert) 739 if err != nil { 740 return nil, err 741 } 742 if len(rest) > 0 { 743 return nil, asn1.SyntaxError{Msg: "trailing data"} 744 } 745 746 return parseCertificate(&cert) 747 } 748 749 // ParseCertificates parses one or more certificates from the given ASN.1 DER 750 // data. The certificates must be concatenated with no intermediate padding. 751 func ParseCertificates(asn1Data []byte) ([]*Certificate, error) { 752 var v []*certificate 753 754 for len(asn1Data) > 0 { 755 cert := new(certificate) 756 var err error 757 asn1Data, err = asn1.Unmarshal(asn1Data, cert) 758 if err != nil { 759 return nil, err 760 } 761 v = append(v, cert) 762 } 763 764 ret := make([]*Certificate, len(v)) 765 for i, ci := range v { 766 cert, err := parseCertificate(ci) 767 if err != nil { 768 return nil, err 769 } 770 ret[i] = cert 771 } 772 773 return ret, nil 774 } 775 776 func reverseBitsInAByte(in byte) byte { 777 b1 := in>>4 | in<<4 778 b2 := b1>>2&0x33 | b1<<2&0xcc 779 b3 := b2>>1&0x55 | b2<<1&0xaa 780 return b3 781 } 782 783 var ( 784 oidExtensionSubjectKeyId = []int{2, 5, 29, 14} 785 oidExtensionKeyUsage = []int{2, 5, 29, 15} 786 oidExtensionAuthorityKeyId = []int{2, 5, 29, 35} 787 oidExtensionBasicConstraints = []int{2, 5, 29, 19} 788 oidExtensionSubjectAltName = []int{2, 5, 29, 17} 789 oidExtensionCertificatePolicies = []int{2, 5, 29, 32} 790 oidExtensionNameConstraints = []int{2, 5, 29, 30} 791 ) 792 793 func buildExtensions(template *Certificate) (ret []pkix.Extension, err error) { 794 ret = make([]pkix.Extension, 7 /* maximum number of elements. */) 795 n := 0 796 797 if template.KeyUsage != 0 { 798 ret[n].Id = oidExtensionKeyUsage 799 ret[n].Critical = true 800 801 var a [2]byte 802 a[0] = reverseBitsInAByte(byte(template.KeyUsage)) 803 a[1] = reverseBitsInAByte(byte(template.KeyUsage >> 8)) 804 805 l := 1 806 if a[1] != 0 { 807 l = 2 808 } 809 810 ret[n].Value, err = asn1.Marshal(asn1.BitString{Bytes: a[0:l], BitLength: l * 8}) 811 if err != nil { 812 return 813 } 814 n++ 815 } 816 817 if template.BasicConstraintsValid { 818 ret[n].Id = oidExtensionBasicConstraints 819 ret[n].Value, err = asn1.Marshal(basicConstraints{template.IsCA, template.MaxPathLen}) 820 ret[n].Critical = true 821 if err != nil { 822 return 823 } 824 n++ 825 } 826 827 if len(template.SubjectKeyId) > 0 { 828 ret[n].Id = oidExtensionSubjectKeyId 829 ret[n].Value, err = asn1.Marshal(template.SubjectKeyId) 830 if err != nil { 831 return 832 } 833 n++ 834 } 835 836 if len(template.AuthorityKeyId) > 0 { 837 ret[n].Id = oidExtensionAuthorityKeyId 838 ret[n].Value, err = asn1.Marshal(authKeyId{template.AuthorityKeyId}) 839 if err != nil { 840 return 841 } 842 n++ 843 } 844 845 if len(template.DNSNames) > 0 { 846 ret[n].Id = oidExtensionSubjectAltName 847 rawValues := make([]asn1.RawValue, len(template.DNSNames)) 848 for i, name := range template.DNSNames { 849 rawValues[i] = asn1.RawValue{Tag: 2, Class: 2, Bytes: []byte(name)} 850 } 851 ret[n].Value, err = asn1.Marshal(rawValues) 852 if err != nil { 853 return 854 } 855 n++ 856 } 857 858 if len(template.PolicyIdentifiers) > 0 { 859 ret[n].Id = oidExtensionCertificatePolicies 860 policies := make([]policyInformation, len(template.PolicyIdentifiers)) 861 for i, policy := range template.PolicyIdentifiers { 862 policies[i].Policy = policy 863 } 864 ret[n].Value, err = asn1.Marshal(policies) 865 if err != nil { 866 return 867 } 868 n++ 869 } 870 871 if len(template.PermittedDNSDomains) > 0 { 872 ret[n].Id = oidExtensionNameConstraints 873 ret[n].Critical = template.PermittedDNSDomainsCritical 874 875 var out nameConstraints 876 out.Permitted = make([]generalSubtree, len(template.PermittedDNSDomains)) 877 for i, permitted := range template.PermittedDNSDomains { 878 out.Permitted[i] = generalSubtree{Name: permitted} 879 } 880 ret[n].Value, err = asn1.Marshal(out) 881 if err != nil { 882 return 883 } 884 n++ 885 } 886 887 // Adding another extension here? Remember to update the maximum number 888 // of elements in the make() at the top of the function. 889 890 return ret[0:n], nil 891 } 892 893 var ( 894 oidSHA1WithRSA = []int{1, 2, 840, 113549, 1, 1, 5} 895 oidRSA = []int{1, 2, 840, 113549, 1, 1, 1} 896 ) 897 898 func subjectBytes(cert *Certificate) ([]byte, error) { 899 if len(cert.RawSubject) > 0 { 900 return cert.RawSubject, nil 901 } 902 903 return asn1.Marshal(cert.Subject.ToRDNSequence()) 904 } 905 906 // CreateCertificate creates a new certificate based on a template. The 907 // following members of template are used: SerialNumber, Subject, NotBefore, 908 // NotAfter, KeyUsage, BasicConstraintsValid, IsCA, MaxPathLen, SubjectKeyId, 909 // DNSNames, PermittedDNSDomainsCritical, PermittedDNSDomains. 910 // 911 // The certificate is signed by parent. If parent is equal to template then the 912 // certificate is self-signed. The parameter pub is the public key of the 913 // signee and priv is the private key of the signer. 914 // 915 // The returned slice is the certificate in DER encoding. 916 // 917 // The only supported key type is RSA (*rsa.PublicKey for pub, *rsa.PrivateKey 918 // for priv). 919 func CreateCertificate(rand io.Reader, template, parent *Certificate, pub interface{}, priv interface{}) (cert []byte, err error) { 920 rsaPub, ok := pub.(*rsa.PublicKey) 921 if !ok { 922 return nil, errors.New("x509: non-RSA public keys not supported") 923 } 924 925 rsaPriv, ok := priv.(*rsa.PrivateKey) 926 if !ok { 927 return nil, errors.New("x509: non-RSA private keys not supported") 928 } 929 930 asn1PublicKey, err := asn1.Marshal(rsaPublicKey{ 931 N: rsaPub.N, 932 E: rsaPub.E, 933 }) 934 if err != nil { 935 return 936 } 937 938 if len(parent.SubjectKeyId) > 0 { 939 template.AuthorityKeyId = parent.SubjectKeyId 940 } 941 942 extensions, err := buildExtensions(template) 943 if err != nil { 944 return 945 } 946 947 asn1Issuer, err := subjectBytes(parent) 948 if err != nil { 949 return 950 } 951 952 asn1Subject, err := subjectBytes(template) 953 if err != nil { 954 return 955 } 956 957 encodedPublicKey := asn1.BitString{BitLength: len(asn1PublicKey) * 8, Bytes: asn1PublicKey} 958 c := tbsCertificate{ 959 Version: 2, 960 SerialNumber: template.SerialNumber, 961 SignatureAlgorithm: pkix.AlgorithmIdentifier{Algorithm: oidSHA1WithRSA}, 962 Issuer: asn1.RawValue{FullBytes: asn1Issuer}, 963 Validity: validity{template.NotBefore, template.NotAfter}, 964 Subject: asn1.RawValue{FullBytes: asn1Subject}, 965 PublicKey: publicKeyInfo{nil, pkix.AlgorithmIdentifier{Algorithm: oidRSA}, encodedPublicKey}, 966 Extensions: extensions, 967 } 968 969 tbsCertContents, err := asn1.Marshal(c) 970 if err != nil { 971 return 972 } 973 974 c.Raw = tbsCertContents 975 976 h := sha1.New() 977 h.Write(tbsCertContents) 978 digest := h.Sum(nil) 979 980 signature, err := rsa.SignPKCS1v15(rand, rsaPriv, crypto.SHA1, digest) 981 if err != nil { 982 return 983 } 984 985 cert, err = asn1.Marshal(certificate{ 986 nil, 987 c, 988 pkix.AlgorithmIdentifier{Algorithm: oidSHA1WithRSA}, 989 asn1.BitString{Bytes: signature, BitLength: len(signature) * 8}, 990 }) 991 return 992 } 993 994 // pemCRLPrefix is the magic string that indicates that we have a PEM encoded 995 // CRL. 996 var pemCRLPrefix = []byte("-----BEGIN X509 CRL") 997 998 // pemType is the type of a PEM encoded CRL. 999 var pemType = "X509 CRL" 1000 1001 // ParseCRL parses a CRL from the given bytes. It's often the case that PEM 1002 // encoded CRLs will appear where they should be DER encoded, so this function 1003 // will transparently handle PEM encoding as long as there isn't any leading 1004 // garbage. 1005 func ParseCRL(crlBytes []byte) (certList *pkix.CertificateList, err error) { 1006 if bytes.HasPrefix(crlBytes, pemCRLPrefix) { 1007 block, _ := pem.Decode(crlBytes) 1008 if block != nil && block.Type == pemType { 1009 crlBytes = block.Bytes 1010 } 1011 } 1012 return ParseDERCRL(crlBytes) 1013 } 1014 1015 // ParseDERCRL parses a DER encoded CRL from the given bytes. 1016 func ParseDERCRL(derBytes []byte) (certList *pkix.CertificateList, err error) { 1017 certList = new(pkix.CertificateList) 1018 _, err = asn1.Unmarshal(derBytes, certList) 1019 if err != nil { 1020 certList = nil 1021 } 1022 return 1023 } 1024 1025 // CreateCRL returns a DER encoded CRL, signed by this Certificate, that 1026 // contains the given list of revoked certificates. 1027 // 1028 // The only supported key type is RSA (*rsa.PrivateKey for priv). 1029 func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error) { 1030 rsaPriv, ok := priv.(*rsa.PrivateKey) 1031 if !ok { 1032 return nil, errors.New("x509: non-RSA private keys not supported") 1033 } 1034 tbsCertList := pkix.TBSCertificateList{ 1035 Version: 2, 1036 Signature: pkix.AlgorithmIdentifier{ 1037 Algorithm: oidSignatureSHA1WithRSA, 1038 }, 1039 Issuer: c.Subject.ToRDNSequence(), 1040 ThisUpdate: now, 1041 NextUpdate: expiry, 1042 RevokedCertificates: revokedCerts, 1043 } 1044 1045 tbsCertListContents, err := asn1.Marshal(tbsCertList) 1046 if err != nil { 1047 return 1048 } 1049 1050 h := sha1.New() 1051 h.Write(tbsCertListContents) 1052 digest := h.Sum(nil) 1053 1054 signature, err := rsa.SignPKCS1v15(rand, rsaPriv, crypto.SHA1, digest) 1055 if err != nil { 1056 return 1057 } 1058 1059 return asn1.Marshal(pkix.CertificateList{ 1060 TBSCertList: tbsCertList, 1061 SignatureAlgorithm: pkix.AlgorithmIdentifier{ 1062 Algorithm: oidSignatureSHA1WithRSA, 1063 }, 1064 SignatureValue: asn1.BitString{Bytes: signature, BitLength: len(signature) * 8}, 1065 }) 1066 }