Source file src/crypto/x509/x509.go

Documentation: crypto/x509

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package x509 parses X.509-encoded keys and certificates.
     6  package x509
     7  
     8  import (
     9  	"bytes"
    10  	"crypto"
    11  	"crypto/dsa"
    12  	"crypto/ecdsa"
    13  	"crypto/ed25519"
    14  	"crypto/elliptic"
    15  	"crypto/rsa"
    16  	"crypto/sha1"
    17  	_ "crypto/sha1"
    18  	_ "crypto/sha256"
    19  	_ "crypto/sha512"
    20  	"crypto/x509/pkix"
    21  	"encoding/asn1"
    22  	"encoding/pem"
    23  	"errors"
    24  	"fmt"
    25  	"io"
    26  	"math/big"
    27  	"net"
    28  	"net/url"
    29  	"strconv"
    30  	"strings"
    31  	"time"
    32  	"unicode/utf8"
    33  
    34  	"golang.org/x/crypto/cryptobyte"
    35  	cryptobyte_asn1 "golang.org/x/crypto/cryptobyte/asn1"
    36  )
    37  
    38  // pkixPublicKey reflects a PKIX public key structure. See SubjectPublicKeyInfo
    39  // in RFC 3280.
    40  type pkixPublicKey struct {
    41  	Algo      pkix.AlgorithmIdentifier
    42  	BitString asn1.BitString
    43  }
    44  
    45  // ParsePKIXPublicKey parses a public key in PKIX, ASN.1 DER form.
    46  // The encoded public key is a SubjectPublicKeyInfo structure
    47  // (see RFC 5280, Section 4.1).
    48  //
    49  // It returns a *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey, or
    50  // ed25519.PublicKey. More types might be supported in the future.
    51  //
    52  // This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
    53  func ParsePKIXPublicKey(derBytes []byte) (pub interface{}, err error) {
    54  	var pki publicKeyInfo
    55  	if rest, err := asn1.Unmarshal(derBytes, &pki); err != nil {
    56  		if _, err := asn1.Unmarshal(derBytes, &pkcs1PublicKey{}); err == nil {
    57  			return nil, errors.New("x509: failed to parse public key (use ParsePKCS1PublicKey instead for this key format)")
    58  		}
    59  		return nil, err
    60  	} else if len(rest) != 0 {
    61  		return nil, errors.New("x509: trailing data after ASN.1 of public-key")
    62  	}
    63  	algo := getPublicKeyAlgorithmFromOID(pki.Algorithm.Algorithm)
    64  	if algo == UnknownPublicKeyAlgorithm {
    65  		return nil, errors.New("x509: unknown public key algorithm")
    66  	}
    67  	return parsePublicKey(algo, &pki)
    68  }
    69  
    70  func marshalPublicKey(pub interface{}) (publicKeyBytes []byte, publicKeyAlgorithm pkix.AlgorithmIdentifier, err error) {
    71  	switch pub := pub.(type) {
    72  	case *rsa.PublicKey:
    73  		publicKeyBytes, err = asn1.Marshal(pkcs1PublicKey{
    74  			N: pub.N,
    75  			E: pub.E,
    76  		})
    77  		if err != nil {
    78  			return nil, pkix.AlgorithmIdentifier{}, err
    79  		}
    80  		publicKeyAlgorithm.Algorithm = oidPublicKeyRSA
    81  		// This is a NULL parameters value which is required by
    82  		// RFC 3279, Section 2.3.1.
    83  		publicKeyAlgorithm.Parameters = asn1.NullRawValue
    84  	case *ecdsa.PublicKey:
    85  		publicKeyBytes = elliptic.Marshal(pub.Curve, pub.X, pub.Y)
    86  		oid, ok := oidFromNamedCurve(pub.Curve)
    87  		if !ok {
    88  			return nil, pkix.AlgorithmIdentifier{}, errors.New("x509: unsupported elliptic curve")
    89  		}
    90  		publicKeyAlgorithm.Algorithm = oidPublicKeyECDSA
    91  		var paramBytes []byte
    92  		paramBytes, err = asn1.Marshal(oid)
    93  		if err != nil {
    94  			return
    95  		}
    96  		publicKeyAlgorithm.Parameters.FullBytes = paramBytes
    97  	case ed25519.PublicKey:
    98  		publicKeyBytes = pub
    99  		publicKeyAlgorithm.Algorithm = oidPublicKeyEd25519
   100  	default:
   101  		return nil, pkix.AlgorithmIdentifier{}, fmt.Errorf("x509: unsupported public key type: %T", pub)
   102  	}
   103  
   104  	return publicKeyBytes, publicKeyAlgorithm, nil
   105  }
   106  
   107  // MarshalPKIXPublicKey converts a public key to PKIX, ASN.1 DER form.
   108  // The encoded public key is a SubjectPublicKeyInfo structure
   109  // (see RFC 5280, Section 4.1).
   110  //
   111  // The following key types are currently supported: *rsa.PublicKey, *ecdsa.PublicKey
   112  // and ed25519.PublicKey. Unsupported key types result in an error.
   113  //
   114  // This kind of key is commonly encoded in PEM blocks of type "PUBLIC KEY".
   115  func MarshalPKIXPublicKey(pub interface{}) ([]byte, error) {
   116  	var publicKeyBytes []byte
   117  	var publicKeyAlgorithm pkix.AlgorithmIdentifier
   118  	var err error
   119  
   120  	if publicKeyBytes, publicKeyAlgorithm, err = marshalPublicKey(pub); err != nil {
   121  		return nil, err
   122  	}
   123  
   124  	pkix := pkixPublicKey{
   125  		Algo: publicKeyAlgorithm,
   126  		BitString: asn1.BitString{
   127  			Bytes:     publicKeyBytes,
   128  			BitLength: 8 * len(publicKeyBytes),
   129  		},
   130  	}
   131  
   132  	ret, _ := asn1.Marshal(pkix)
   133  	return ret, nil
   134  }
   135  
   136  // These structures reflect the ASN.1 structure of X.509 certificates.:
   137  
   138  type certificate struct {
   139  	Raw                asn1.RawContent
   140  	TBSCertificate     tbsCertificate
   141  	SignatureAlgorithm pkix.AlgorithmIdentifier
   142  	SignatureValue     asn1.BitString
   143  }
   144  
   145  type tbsCertificate struct {
   146  	Raw                asn1.RawContent
   147  	Version            int `asn1:"optional,explicit,default:0,tag:0"`
   148  	SerialNumber       *big.Int
   149  	SignatureAlgorithm pkix.AlgorithmIdentifier
   150  	Issuer             asn1.RawValue
   151  	Validity           validity
   152  	Subject            asn1.RawValue
   153  	PublicKey          publicKeyInfo
   154  	UniqueId           asn1.BitString   `asn1:"optional,tag:1"`
   155  	SubjectUniqueId    asn1.BitString   `asn1:"optional,tag:2"`
   156  	Extensions         []pkix.Extension `asn1:"optional,explicit,tag:3"`
   157  }
   158  
   159  type dsaAlgorithmParameters struct {
   160  	P, Q, G *big.Int
   161  }
   162  
   163  type dsaSignature struct {
   164  	R, S *big.Int
   165  }
   166  
   167  type validity struct {
   168  	NotBefore, NotAfter time.Time
   169  }
   170  
   171  type publicKeyInfo struct {
   172  	Raw       asn1.RawContent
   173  	Algorithm pkix.AlgorithmIdentifier
   174  	PublicKey asn1.BitString
   175  }
   176  
   177  // RFC 5280,  4.2.1.1
   178  type authKeyId struct {
   179  	Id []byte `asn1:"optional,tag:0"`
   180  }
   181  
   182  type SignatureAlgorithm int
   183  
   184  const (
   185  	UnknownSignatureAlgorithm SignatureAlgorithm = iota
   186  	MD2WithRSA
   187  	MD5WithRSA
   188  	SHA1WithRSA
   189  	SHA256WithRSA
   190  	SHA384WithRSA
   191  	SHA512WithRSA
   192  	DSAWithSHA1
   193  	DSAWithSHA256
   194  	ECDSAWithSHA1
   195  	ECDSAWithSHA256
   196  	ECDSAWithSHA384
   197  	ECDSAWithSHA512
   198  	SHA256WithRSAPSS
   199  	SHA384WithRSAPSS
   200  	SHA512WithRSAPSS
   201  	PureEd25519
   202  )
   203  
   204  func (algo SignatureAlgorithm) isRSAPSS() bool {
   205  	switch algo {
   206  	case SHA256WithRSAPSS, SHA384WithRSAPSS, SHA512WithRSAPSS:
   207  		return true
   208  	default:
   209  		return false
   210  	}
   211  }
   212  
   213  func (algo SignatureAlgorithm) String() string {
   214  	for _, details := range signatureAlgorithmDetails {
   215  		if details.algo == algo {
   216  			return details.name
   217  		}
   218  	}
   219  	return strconv.Itoa(int(algo))
   220  }
   221  
   222  type PublicKeyAlgorithm int
   223  
   224  const (
   225  	UnknownPublicKeyAlgorithm PublicKeyAlgorithm = iota
   226  	RSA
   227  	DSA
   228  	ECDSA
   229  	Ed25519
   230  )
   231  
   232  var publicKeyAlgoName = [...]string{
   233  	RSA:     "RSA",
   234  	DSA:     "DSA",
   235  	ECDSA:   "ECDSA",
   236  	Ed25519: "Ed25519",
   237  }
   238  
   239  func (algo PublicKeyAlgorithm) String() string {
   240  	if 0 < algo && int(algo) < len(publicKeyAlgoName) {
   241  		return publicKeyAlgoName[algo]
   242  	}
   243  	return strconv.Itoa(int(algo))
   244  }
   245  
   246  // OIDs for signature algorithms
   247  //
   248  // pkcs-1 OBJECT IDENTIFIER ::= {
   249  //    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
   250  //
   251  //
   252  // RFC 3279 2.2.1 RSA Signature Algorithms
   253  //
   254  // md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
   255  //
   256  // md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
   257  //
   258  // sha-1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
   259  //
   260  // dsaWithSha1 OBJECT IDENTIFIER ::= {
   261  //    iso(1) member-body(2) us(840) x9-57(10040) x9cm(4) 3 }
   262  //
   263  // RFC 3279 2.2.3 ECDSA Signature Algorithm
   264  //
   265  // ecdsa-with-SHA1 OBJECT IDENTIFIER ::= {
   266  // 	  iso(1) member-body(2) us(840) ansi-x962(10045)
   267  //    signatures(4) ecdsa-with-SHA1(1)}
   268  //
   269  //
   270  // RFC 4055 5 PKCS #1 Version 1.5
   271  //
   272  // sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 }
   273  //
   274  // sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 }
   275  //
   276  // sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }
   277  //
   278  //
   279  // RFC 5758 3.1 DSA Signature Algorithms
   280  //
   281  // dsaWithSha256 OBJECT IDENTIFIER ::= {
   282  //    joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
   283  //    csor(3) algorithms(4) id-dsa-with-sha2(3) 2}
   284  //
   285  // RFC 5758 3.2 ECDSA Signature Algorithm
   286  //
   287  // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   288  //    us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 }
   289  //
   290  // ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   291  //    us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 }
   292  //
   293  // ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   294  //    us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 }
   295  //
   296  //
   297  // RFC 8410 3 Curve25519 and Curve448 Algorithm Identifiers
   298  //
   299  // id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }
   300  
   301  var (
   302  	oidSignatureMD2WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 2}
   303  	oidSignatureMD5WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4}
   304  	oidSignatureSHA1WithRSA     = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
   305  	oidSignatureSHA256WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
   306  	oidSignatureSHA384WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
   307  	oidSignatureSHA512WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13}
   308  	oidSignatureRSAPSS          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 10}
   309  	oidSignatureDSAWithSHA1     = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3}
   310  	oidSignatureDSAWithSHA256   = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 2}
   311  	oidSignatureECDSAWithSHA1   = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 1}
   312  	oidSignatureECDSAWithSHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
   313  	oidSignatureECDSAWithSHA384 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 3}
   314  	oidSignatureECDSAWithSHA512 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 4}
   315  	oidSignatureEd25519         = asn1.ObjectIdentifier{1, 3, 101, 112}
   316  
   317  	oidSHA256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 1}
   318  	oidSHA384 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 2}
   319  	oidSHA512 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 3}
   320  
   321  	oidMGF1 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 8}
   322  
   323  	// oidISOSignatureSHA1WithRSA means the same as oidSignatureSHA1WithRSA
   324  	// but it's specified by ISO. Microsoft's makecert.exe has been known
   325  	// to produce certificates with this OID.
   326  	oidISOSignatureSHA1WithRSA = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 29}
   327  )
   328  
   329  var signatureAlgorithmDetails = []struct {
   330  	algo       SignatureAlgorithm
   331  	name       string
   332  	oid        asn1.ObjectIdentifier
   333  	pubKeyAlgo PublicKeyAlgorithm
   334  	hash       crypto.Hash
   335  }{
   336  	{MD2WithRSA, "MD2-RSA", oidSignatureMD2WithRSA, RSA, crypto.Hash(0) /* no value for MD2 */},
   337  	{MD5WithRSA, "MD5-RSA", oidSignatureMD5WithRSA, RSA, crypto.MD5},
   338  	{SHA1WithRSA, "SHA1-RSA", oidSignatureSHA1WithRSA, RSA, crypto.SHA1},
   339  	{SHA1WithRSA, "SHA1-RSA", oidISOSignatureSHA1WithRSA, RSA, crypto.SHA1},
   340  	{SHA256WithRSA, "SHA256-RSA", oidSignatureSHA256WithRSA, RSA, crypto.SHA256},
   341  	{SHA384WithRSA, "SHA384-RSA", oidSignatureSHA384WithRSA, RSA, crypto.SHA384},
   342  	{SHA512WithRSA, "SHA512-RSA", oidSignatureSHA512WithRSA, RSA, crypto.SHA512},
   343  	{SHA256WithRSAPSS, "SHA256-RSAPSS", oidSignatureRSAPSS, RSA, crypto.SHA256},
   344  	{SHA384WithRSAPSS, "SHA384-RSAPSS", oidSignatureRSAPSS, RSA, crypto.SHA384},
   345  	{SHA512WithRSAPSS, "SHA512-RSAPSS", oidSignatureRSAPSS, RSA, crypto.SHA512},
   346  	{DSAWithSHA1, "DSA-SHA1", oidSignatureDSAWithSHA1, DSA, crypto.SHA1},
   347  	{DSAWithSHA256, "DSA-SHA256", oidSignatureDSAWithSHA256, DSA, crypto.SHA256},
   348  	{ECDSAWithSHA1, "ECDSA-SHA1", oidSignatureECDSAWithSHA1, ECDSA, crypto.SHA1},
   349  	{ECDSAWithSHA256, "ECDSA-SHA256", oidSignatureECDSAWithSHA256, ECDSA, crypto.SHA256},
   350  	{ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, ECDSA, crypto.SHA384},
   351  	{ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, ECDSA, crypto.SHA512},
   352  	{PureEd25519, "Ed25519", oidSignatureEd25519, Ed25519, crypto.Hash(0) /* no pre-hashing */},
   353  }
   354  
   355  // pssParameters reflects the parameters in an AlgorithmIdentifier that
   356  // specifies RSA PSS. See RFC 3447, Appendix A.2.3.
   357  type pssParameters struct {
   358  	// The following three fields are not marked as
   359  	// optional because the default values specify SHA-1,
   360  	// which is no longer suitable for use in signatures.
   361  	Hash         pkix.AlgorithmIdentifier `asn1:"explicit,tag:0"`
   362  	MGF          pkix.AlgorithmIdentifier `asn1:"explicit,tag:1"`
   363  	SaltLength   int                      `asn1:"explicit,tag:2"`
   364  	TrailerField int                      `asn1:"optional,explicit,tag:3,default:1"`
   365  }
   366  
   367  // rsaPSSParameters returns an asn1.RawValue suitable for use as the Parameters
   368  // in an AlgorithmIdentifier that specifies RSA PSS.
   369  func rsaPSSParameters(hashFunc crypto.Hash) asn1.RawValue {
   370  	var hashOID asn1.ObjectIdentifier
   371  
   372  	switch hashFunc {
   373  	case crypto.SHA256:
   374  		hashOID = oidSHA256
   375  	case crypto.SHA384:
   376  		hashOID = oidSHA384
   377  	case crypto.SHA512:
   378  		hashOID = oidSHA512
   379  	}
   380  
   381  	params := pssParameters{
   382  		Hash: pkix.AlgorithmIdentifier{
   383  			Algorithm:  hashOID,
   384  			Parameters: asn1.NullRawValue,
   385  		},
   386  		MGF: pkix.AlgorithmIdentifier{
   387  			Algorithm: oidMGF1,
   388  		},
   389  		SaltLength:   hashFunc.Size(),
   390  		TrailerField: 1,
   391  	}
   392  
   393  	mgf1Params := pkix.AlgorithmIdentifier{
   394  		Algorithm:  hashOID,
   395  		Parameters: asn1.NullRawValue,
   396  	}
   397  
   398  	var err error
   399  	params.MGF.Parameters.FullBytes, err = asn1.Marshal(mgf1Params)
   400  	if err != nil {
   401  		panic(err)
   402  	}
   403  
   404  	serialized, err := asn1.Marshal(params)
   405  	if err != nil {
   406  		panic(err)
   407  	}
   408  
   409  	return asn1.RawValue{FullBytes: serialized}
   410  }
   411  
   412  func getSignatureAlgorithmFromAI(ai pkix.AlgorithmIdentifier) SignatureAlgorithm {
   413  	if ai.Algorithm.Equal(oidSignatureEd25519) {
   414  		// RFC 8410, Section 3
   415  		// > For all of the OIDs, the parameters MUST be absent.
   416  		if len(ai.Parameters.FullBytes) != 0 {
   417  			return UnknownSignatureAlgorithm
   418  		}
   419  	}
   420  
   421  	if !ai.Algorithm.Equal(oidSignatureRSAPSS) {
   422  		for _, details := range signatureAlgorithmDetails {
   423  			if ai.Algorithm.Equal(details.oid) {
   424  				return details.algo
   425  			}
   426  		}
   427  		return UnknownSignatureAlgorithm
   428  	}
   429  
   430  	// RSA PSS is special because it encodes important parameters
   431  	// in the Parameters.
   432  
   433  	var params pssParameters
   434  	if _, err := asn1.Unmarshal(ai.Parameters.FullBytes, &params); err != nil {
   435  		return UnknownSignatureAlgorithm
   436  	}
   437  
   438  	var mgf1HashFunc pkix.AlgorithmIdentifier
   439  	if _, err := asn1.Unmarshal(params.MGF.Parameters.FullBytes, &mgf1HashFunc); err != nil {
   440  		return UnknownSignatureAlgorithm
   441  	}
   442  
   443  	// PSS is greatly overburdened with options. This code forces them into
   444  	// three buckets by requiring that the MGF1 hash function always match the
   445  	// message hash function (as recommended in RFC 3447, Section 8.1), that the
   446  	// salt length matches the hash length, and that the trailer field has the
   447  	// default value.
   448  	if (len(params.Hash.Parameters.FullBytes) != 0 && !bytes.Equal(params.Hash.Parameters.FullBytes, asn1.NullBytes)) ||
   449  		!params.MGF.Algorithm.Equal(oidMGF1) ||
   450  		!mgf1HashFunc.Algorithm.Equal(params.Hash.Algorithm) ||
   451  		(len(mgf1HashFunc.Parameters.FullBytes) != 0 && !bytes.Equal(mgf1HashFunc.Parameters.FullBytes, asn1.NullBytes)) ||
   452  		params.TrailerField != 1 {
   453  		return UnknownSignatureAlgorithm
   454  	}
   455  
   456  	switch {
   457  	case params.Hash.Algorithm.Equal(oidSHA256) && params.SaltLength == 32:
   458  		return SHA256WithRSAPSS
   459  	case params.Hash.Algorithm.Equal(oidSHA384) && params.SaltLength == 48:
   460  		return SHA384WithRSAPSS
   461  	case params.Hash.Algorithm.Equal(oidSHA512) && params.SaltLength == 64:
   462  		return SHA512WithRSAPSS
   463  	}
   464  
   465  	return UnknownSignatureAlgorithm
   466  }
   467  
   468  // RFC 3279, 2.3 Public Key Algorithms
   469  //
   470  // pkcs-1 OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840)
   471  //    rsadsi(113549) pkcs(1) 1 }
   472  //
   473  // rsaEncryption OBJECT IDENTIFIER ::== { pkcs1-1 1 }
   474  //
   475  // id-dsa OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840)
   476  //    x9-57(10040) x9cm(4) 1 }
   477  //
   478  // RFC 5480, 2.1.1 Unrestricted Algorithm Identifier and Parameters
   479  //
   480  // id-ecPublicKey OBJECT IDENTIFIER ::= {
   481  //       iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 }
   482  var (
   483  	oidPublicKeyRSA     = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1}
   484  	oidPublicKeyDSA     = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 1}
   485  	oidPublicKeyECDSA   = asn1.ObjectIdentifier{1, 2, 840, 10045, 2, 1}
   486  	oidPublicKeyEd25519 = oidSignatureEd25519
   487  )
   488  
   489  func getPublicKeyAlgorithmFromOID(oid asn1.ObjectIdentifier) PublicKeyAlgorithm {
   490  	switch {
   491  	case oid.Equal(oidPublicKeyRSA):
   492  		return RSA
   493  	case oid.Equal(oidPublicKeyDSA):
   494  		return DSA
   495  	case oid.Equal(oidPublicKeyECDSA):
   496  		return ECDSA
   497  	case oid.Equal(oidPublicKeyEd25519):
   498  		return Ed25519
   499  	}
   500  	return UnknownPublicKeyAlgorithm
   501  }
   502  
   503  // RFC 5480, 2.1.1.1. Named Curve
   504  //
   505  // secp224r1 OBJECT IDENTIFIER ::= {
   506  //   iso(1) identified-organization(3) certicom(132) curve(0) 33 }
   507  //
   508  // secp256r1 OBJECT IDENTIFIER ::= {
   509  //   iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)
   510  //   prime(1) 7 }
   511  //
   512  // secp384r1 OBJECT IDENTIFIER ::= {
   513  //   iso(1) identified-organization(3) certicom(132) curve(0) 34 }
   514  //
   515  // secp521r1 OBJECT IDENTIFIER ::= {
   516  //   iso(1) identified-organization(3) certicom(132) curve(0) 35 }
   517  //
   518  // NB: secp256r1 is equivalent to prime256v1
   519  var (
   520  	oidNamedCurveP224 = asn1.ObjectIdentifier{1, 3, 132, 0, 33}
   521  	oidNamedCurveP256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}
   522  	oidNamedCurveP384 = asn1.ObjectIdentifier{1, 3, 132, 0, 34}
   523  	oidNamedCurveP521 = asn1.ObjectIdentifier{1, 3, 132, 0, 35}
   524  )
   525  
   526  func namedCurveFromOID(oid asn1.ObjectIdentifier) elliptic.Curve {
   527  	switch {
   528  	case oid.Equal(oidNamedCurveP224):
   529  		return elliptic.P224()
   530  	case oid.Equal(oidNamedCurveP256):
   531  		return elliptic.P256()
   532  	case oid.Equal(oidNamedCurveP384):
   533  		return elliptic.P384()
   534  	case oid.Equal(oidNamedCurveP521):
   535  		return elliptic.P521()
   536  	}
   537  	return nil
   538  }
   539  
   540  func oidFromNamedCurve(curve elliptic.Curve) (asn1.ObjectIdentifier, bool) {
   541  	switch curve {
   542  	case elliptic.P224():
   543  		return oidNamedCurveP224, true
   544  	case elliptic.P256():
   545  		return oidNamedCurveP256, true
   546  	case elliptic.P384():
   547  		return oidNamedCurveP384, true
   548  	case elliptic.P521():
   549  		return oidNamedCurveP521, true
   550  	}
   551  
   552  	return nil, false
   553  }
   554  
   555  // KeyUsage represents the set of actions that are valid for a given key. It's
   556  // a bitmap of the KeyUsage* constants.
   557  type KeyUsage int
   558  
   559  const (
   560  	KeyUsageDigitalSignature KeyUsage = 1 << iota
   561  	KeyUsageContentCommitment
   562  	KeyUsageKeyEncipherment
   563  	KeyUsageDataEncipherment
   564  	KeyUsageKeyAgreement
   565  	KeyUsageCertSign
   566  	KeyUsageCRLSign
   567  	KeyUsageEncipherOnly
   568  	KeyUsageDecipherOnly
   569  )
   570  
   571  // RFC 5280, 4.2.1.12  Extended Key Usage
   572  //
   573  // anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
   574  //
   575  // id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
   576  //
   577  // id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   578  // id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   579  // id-kp-codeSigning            OBJECT IDENTIFIER ::= { id-kp 3 }
   580  // id-kp-emailProtection        OBJECT IDENTIFIER ::= { id-kp 4 }
   581  // id-kp-timeStamping           OBJECT IDENTIFIER ::= { id-kp 8 }
   582  // id-kp-OCSPSigning            OBJECT IDENTIFIER ::= { id-kp 9 }
   583  var (
   584  	oidExtKeyUsageAny                            = asn1.ObjectIdentifier{2, 5, 29, 37, 0}
   585  	oidExtKeyUsageServerAuth                     = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1}
   586  	oidExtKeyUsageClientAuth                     = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2}
   587  	oidExtKeyUsageCodeSigning                    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 3}
   588  	oidExtKeyUsageEmailProtection                = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 4}
   589  	oidExtKeyUsageIPSECEndSystem                 = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 5}
   590  	oidExtKeyUsageIPSECTunnel                    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 6}
   591  	oidExtKeyUsageIPSECUser                      = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 7}
   592  	oidExtKeyUsageTimeStamping                   = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 8}
   593  	oidExtKeyUsageOCSPSigning                    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 9}
   594  	oidExtKeyUsageMicrosoftServerGatedCrypto     = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 10, 3, 3}
   595  	oidExtKeyUsageNetscapeServerGatedCrypto      = asn1.ObjectIdentifier{2, 16, 840, 1, 113730, 4, 1}
   596  	oidExtKeyUsageMicrosoftCommercialCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 2, 1, 22}
   597  	oidExtKeyUsageMicrosoftKernelCodeSigning     = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 61, 1, 1}
   598  )
   599  
   600  // ExtKeyUsage represents an extended set of actions that are valid for a given key.
   601  // Each of the ExtKeyUsage* constants define a unique action.
   602  type ExtKeyUsage int
   603  
   604  const (
   605  	ExtKeyUsageAny ExtKeyUsage = iota
   606  	ExtKeyUsageServerAuth
   607  	ExtKeyUsageClientAuth
   608  	ExtKeyUsageCodeSigning
   609  	ExtKeyUsageEmailProtection
   610  	ExtKeyUsageIPSECEndSystem
   611  	ExtKeyUsageIPSECTunnel
   612  	ExtKeyUsageIPSECUser
   613  	ExtKeyUsageTimeStamping
   614  	ExtKeyUsageOCSPSigning
   615  	ExtKeyUsageMicrosoftServerGatedCrypto
   616  	ExtKeyUsageNetscapeServerGatedCrypto
   617  	ExtKeyUsageMicrosoftCommercialCodeSigning
   618  	ExtKeyUsageMicrosoftKernelCodeSigning
   619  )
   620  
   621  // extKeyUsageOIDs contains the mapping between an ExtKeyUsage and its OID.
   622  var extKeyUsageOIDs = []struct {
   623  	extKeyUsage ExtKeyUsage
   624  	oid         asn1.ObjectIdentifier
   625  }{
   626  	{ExtKeyUsageAny, oidExtKeyUsageAny},
   627  	{ExtKeyUsageServerAuth, oidExtKeyUsageServerAuth},
   628  	{ExtKeyUsageClientAuth, oidExtKeyUsageClientAuth},
   629  	{ExtKeyUsageCodeSigning, oidExtKeyUsageCodeSigning},
   630  	{ExtKeyUsageEmailProtection, oidExtKeyUsageEmailProtection},
   631  	{ExtKeyUsageIPSECEndSystem, oidExtKeyUsageIPSECEndSystem},
   632  	{ExtKeyUsageIPSECTunnel, oidExtKeyUsageIPSECTunnel},
   633  	{ExtKeyUsageIPSECUser, oidExtKeyUsageIPSECUser},
   634  	{ExtKeyUsageTimeStamping, oidExtKeyUsageTimeStamping},
   635  	{ExtKeyUsageOCSPSigning, oidExtKeyUsageOCSPSigning},
   636  	{ExtKeyUsageMicrosoftServerGatedCrypto, oidExtKeyUsageMicrosoftServerGatedCrypto},
   637  	{ExtKeyUsageNetscapeServerGatedCrypto, oidExtKeyUsageNetscapeServerGatedCrypto},
   638  	{ExtKeyUsageMicrosoftCommercialCodeSigning, oidExtKeyUsageMicrosoftCommercialCodeSigning},
   639  	{ExtKeyUsageMicrosoftKernelCodeSigning, oidExtKeyUsageMicrosoftKernelCodeSigning},
   640  }
   641  
   642  func extKeyUsageFromOID(oid asn1.ObjectIdentifier) (eku ExtKeyUsage, ok bool) {
   643  	for _, pair := range extKeyUsageOIDs {
   644  		if oid.Equal(pair.oid) {
   645  			return pair.extKeyUsage, true
   646  		}
   647  	}
   648  	return
   649  }
   650  
   651  func oidFromExtKeyUsage(eku ExtKeyUsage) (oid asn1.ObjectIdentifier, ok bool) {
   652  	for _, pair := range extKeyUsageOIDs {
   653  		if eku == pair.extKeyUsage {
   654  			return pair.oid, true
   655  		}
   656  	}
   657  	return
   658  }
   659  
   660  // A Certificate represents an X.509 certificate.
   661  type Certificate struct {
   662  	Raw                     []byte // Complete ASN.1 DER content (certificate, signature algorithm and signature).
   663  	RawTBSCertificate       []byte // Certificate part of raw ASN.1 DER content.
   664  	RawSubjectPublicKeyInfo []byte // DER encoded SubjectPublicKeyInfo.
   665  	RawSubject              []byte // DER encoded Subject
   666  	RawIssuer               []byte // DER encoded Issuer
   667  
   668  	Signature          []byte
   669  	SignatureAlgorithm SignatureAlgorithm
   670  
   671  	PublicKeyAlgorithm PublicKeyAlgorithm
   672  	PublicKey          interface{}
   673  
   674  	Version             int
   675  	SerialNumber        *big.Int
   676  	Issuer              pkix.Name
   677  	Subject             pkix.Name
   678  	NotBefore, NotAfter time.Time // Validity bounds.
   679  	KeyUsage            KeyUsage
   680  
   681  	// Extensions contains raw X.509 extensions. When parsing certificates,
   682  	// this can be used to extract non-critical extensions that are not
   683  	// parsed by this package. When marshaling certificates, the Extensions
   684  	// field is ignored, see ExtraExtensions.
   685  	Extensions []pkix.Extension
   686  
   687  	// ExtraExtensions contains extensions to be copied, raw, into any
   688  	// marshaled certificates. Values override any extensions that would
   689  	// otherwise be produced based on the other fields. The ExtraExtensions
   690  	// field is not populated when parsing certificates, see Extensions.
   691  	ExtraExtensions []pkix.Extension
   692  
   693  	// UnhandledCriticalExtensions contains a list of extension IDs that
   694  	// were not (fully) processed when parsing. Verify will fail if this
   695  	// slice is non-empty, unless verification is delegated to an OS
   696  	// library which understands all the critical extensions.
   697  	//
   698  	// Users can access these extensions using Extensions and can remove
   699  	// elements from this slice if they believe that they have been
   700  	// handled.
   701  	UnhandledCriticalExtensions []asn1.ObjectIdentifier
   702  
   703  	ExtKeyUsage        []ExtKeyUsage           // Sequence of extended key usages.
   704  	UnknownExtKeyUsage []asn1.ObjectIdentifier // Encountered extended key usages unknown to this package.
   705  
   706  	// BasicConstraintsValid indicates whether IsCA, MaxPathLen,
   707  	// and MaxPathLenZero are valid.
   708  	BasicConstraintsValid bool
   709  	IsCA                  bool
   710  
   711  	// MaxPathLen and MaxPathLenZero indicate the presence and
   712  	// value of the BasicConstraints' "pathLenConstraint".
   713  	//
   714  	// When parsing a certificate, a positive non-zero MaxPathLen
   715  	// means that the field was specified, -1 means it was unset,
   716  	// and MaxPathLenZero being true mean that the field was
   717  	// explicitly set to zero. The case of MaxPathLen==0 with MaxPathLenZero==false
   718  	// should be treated equivalent to -1 (unset).
   719  	//
   720  	// When generating a certificate, an unset pathLenConstraint
   721  	// can be requested with either MaxPathLen == -1 or using the
   722  	// zero value for both MaxPathLen and MaxPathLenZero.
   723  	MaxPathLen int
   724  	// MaxPathLenZero indicates that BasicConstraintsValid==true
   725  	// and MaxPathLen==0 should be interpreted as an actual
   726  	// maximum path length of zero. Otherwise, that combination is
   727  	// interpreted as MaxPathLen not being set.
   728  	MaxPathLenZero bool
   729  
   730  	SubjectKeyId   []byte
   731  	AuthorityKeyId []byte
   732  
   733  	// RFC 5280, 4.2.2.1 (Authority Information Access)
   734  	OCSPServer            []string
   735  	IssuingCertificateURL []string
   736  
   737  	// Subject Alternate Name values. (Note that these values may not be valid
   738  	// if invalid values were contained within a parsed certificate. For
   739  	// example, an element of DNSNames may not be a valid DNS domain name.)
   740  	DNSNames       []string
   741  	EmailAddresses []string
   742  	IPAddresses    []net.IP
   743  	URIs           []*url.URL
   744  
   745  	// Name constraints
   746  	PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
   747  	PermittedDNSDomains         []string
   748  	ExcludedDNSDomains          []string
   749  	PermittedIPRanges           []*net.IPNet
   750  	ExcludedIPRanges            []*net.IPNet
   751  	PermittedEmailAddresses     []string
   752  	ExcludedEmailAddresses      []string
   753  	PermittedURIDomains         []string
   754  	ExcludedURIDomains          []string
   755  
   756  	// CRL Distribution Points
   757  	CRLDistributionPoints []string
   758  
   759  	PolicyIdentifiers []asn1.ObjectIdentifier
   760  }
   761  
   762  // ErrUnsupportedAlgorithm results from attempting to perform an operation that
   763  // involves algorithms that are not currently implemented.
   764  var ErrUnsupportedAlgorithm = errors.New("x509: cannot verify signature: algorithm unimplemented")
   765  
   766  // An InsecureAlgorithmError
   767  type InsecureAlgorithmError SignatureAlgorithm
   768  
   769  func (e InsecureAlgorithmError) Error() string {
   770  	return fmt.Sprintf("x509: cannot verify signature: insecure algorithm %v", SignatureAlgorithm(e))
   771  }
   772  
   773  // ConstraintViolationError results when a requested usage is not permitted by
   774  // a certificate. For example: checking a signature when the public key isn't a
   775  // certificate signing key.
   776  type ConstraintViolationError struct{}
   777  
   778  func (ConstraintViolationError) Error() string {
   779  	return "x509: invalid signature: parent certificate cannot sign this kind of certificate"
   780  }
   781  
   782  func (c *Certificate) Equal(other *Certificate) bool {
   783  	if c == nil || other == nil {
   784  		return c == other
   785  	}
   786  	return bytes.Equal(c.Raw, other.Raw)
   787  }
   788  
   789  func (c *Certificate) hasSANExtension() bool {
   790  	return oidInExtensions(oidExtensionSubjectAltName, c.Extensions)
   791  }
   792  
   793  // CheckSignatureFrom verifies that the signature on c is a valid signature
   794  // from parent.
   795  func (c *Certificate) CheckSignatureFrom(parent *Certificate) error {
   796  	// RFC 5280, 4.2.1.9:
   797  	// "If the basic constraints extension is not present in a version 3
   798  	// certificate, or the extension is present but the cA boolean is not
   799  	// asserted, then the certified public key MUST NOT be used to verify
   800  	// certificate signatures."
   801  	if parent.Version == 3 && !parent.BasicConstraintsValid ||
   802  		parent.BasicConstraintsValid && !parent.IsCA {
   803  		return ConstraintViolationError{}
   804  	}
   805  
   806  	if parent.KeyUsage != 0 && parent.KeyUsage&KeyUsageCertSign == 0 {
   807  		return ConstraintViolationError{}
   808  	}
   809  
   810  	if parent.PublicKeyAlgorithm == UnknownPublicKeyAlgorithm {
   811  		return ErrUnsupportedAlgorithm
   812  	}
   813  
   814  	// TODO(agl): don't ignore the path length constraint.
   815  
   816  	return parent.CheckSignature(c.SignatureAlgorithm, c.RawTBSCertificate, c.Signature)
   817  }
   818  
   819  // CheckSignature verifies that signature is a valid signature over signed from
   820  // c's public key.
   821  func (c *Certificate) CheckSignature(algo SignatureAlgorithm, signed, signature []byte) error {
   822  	return checkSignature(algo, signed, signature, c.PublicKey)
   823  }
   824  
   825  func (c *Certificate) hasNameConstraints() bool {
   826  	return oidInExtensions(oidExtensionNameConstraints, c.Extensions)
   827  }
   828  
   829  func (c *Certificate) getSANExtension() []byte {
   830  	for _, e := range c.Extensions {
   831  		if e.Id.Equal(oidExtensionSubjectAltName) {
   832  			return e.Value
   833  		}
   834  	}
   835  	return nil
   836  }
   837  
   838  func signaturePublicKeyAlgoMismatchError(expectedPubKeyAlgo PublicKeyAlgorithm, pubKey interface{}) error {
   839  	return fmt.Errorf("x509: signature algorithm specifies an %s public key, but have public key of type %T", expectedPubKeyAlgo.String(), pubKey)
   840  }
   841  
   842  // CheckSignature verifies that signature is a valid signature over signed from
   843  // a crypto.PublicKey.
   844  func checkSignature(algo SignatureAlgorithm, signed, signature []byte, publicKey crypto.PublicKey) (err error) {
   845  	var hashType crypto.Hash
   846  	var pubKeyAlgo PublicKeyAlgorithm
   847  
   848  	for _, details := range signatureAlgorithmDetails {
   849  		if details.algo == algo {
   850  			hashType = details.hash
   851  			pubKeyAlgo = details.pubKeyAlgo
   852  		}
   853  	}
   854  
   855  	switch hashType {
   856  	case crypto.Hash(0):
   857  		if pubKeyAlgo != Ed25519 {
   858  			return ErrUnsupportedAlgorithm
   859  		}
   860  	case crypto.MD5:
   861  		return InsecureAlgorithmError(algo)
   862  	default:
   863  		if !hashType.Available() {
   864  			return ErrUnsupportedAlgorithm
   865  		}
   866  		h := hashType.New()
   867  		h.Write(signed)
   868  		signed = h.Sum(nil)
   869  	}
   870  
   871  	switch pub := publicKey.(type) {
   872  	case *rsa.PublicKey:
   873  		if pubKeyAlgo != RSA {
   874  			return signaturePublicKeyAlgoMismatchError(pubKeyAlgo, pub)
   875  		}
   876  		if algo.isRSAPSS() {
   877  			return rsa.VerifyPSS(pub, hashType, signed, signature, &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})
   878  		} else {
   879  			return rsa.VerifyPKCS1v15(pub, hashType, signed, signature)
   880  		}
   881  	case *dsa.PublicKey:
   882  		if pubKeyAlgo != DSA {
   883  			return signaturePublicKeyAlgoMismatchError(pubKeyAlgo, pub)
   884  		}
   885  		dsaSig := new(dsaSignature)
   886  		if rest, err := asn1.Unmarshal(signature, dsaSig); err != nil {
   887  			return err
   888  		} else if len(rest) != 0 {
   889  			return errors.New("x509: trailing data after DSA signature")
   890  		}
   891  		if dsaSig.R.Sign() <= 0 || dsaSig.S.Sign() <= 0 {
   892  			return errors.New("x509: DSA signature contained zero or negative values")
   893  		}
   894  		// According to FIPS 186-3, section 4.6, the hash must be truncated if it is longer
   895  		// than the key length, but crypto/dsa doesn't do it automatically.
   896  		if maxHashLen := pub.Q.BitLen() / 8; maxHashLen < len(signed) {
   897  			signed = signed[:maxHashLen]
   898  		}
   899  		if !dsa.Verify(pub, signed, dsaSig.R, dsaSig.S) {
   900  			return errors.New("x509: DSA verification failure")
   901  		}
   902  		return
   903  	case *ecdsa.PublicKey:
   904  		if pubKeyAlgo != ECDSA {
   905  			return signaturePublicKeyAlgoMismatchError(pubKeyAlgo, pub)
   906  		}
   907  		if !ecdsa.VerifyASN1(pub, signed, signature) {
   908  			return errors.New("x509: ECDSA verification failure")
   909  		}
   910  		return
   911  	case ed25519.PublicKey:
   912  		if pubKeyAlgo != Ed25519 {
   913  			return signaturePublicKeyAlgoMismatchError(pubKeyAlgo, pub)
   914  		}
   915  		if !ed25519.Verify(pub, signed, signature) {
   916  			return errors.New("x509: Ed25519 verification failure")
   917  		}
   918  		return
   919  	}
   920  	return ErrUnsupportedAlgorithm
   921  }
   922  
   923  // CheckCRLSignature checks that the signature in crl is from c.
   924  func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) error {
   925  	algo := getSignatureAlgorithmFromAI(crl.SignatureAlgorithm)
   926  	return c.CheckSignature(algo, crl.TBSCertList.Raw, crl.SignatureValue.RightAlign())
   927  }
   928  
   929  type UnhandledCriticalExtension struct{}
   930  
   931  func (h UnhandledCriticalExtension) Error() string {
   932  	return "x509: unhandled critical extension"
   933  }
   934  
   935  type basicConstraints struct {
   936  	IsCA       bool `asn1:"optional"`
   937  	MaxPathLen int  `asn1:"optional,default:-1"`
   938  }
   939  
   940  // RFC 5280 4.2.1.4
   941  type policyInformation struct {
   942  	Policy asn1.ObjectIdentifier
   943  	// policyQualifiers omitted
   944  }
   945  
   946  const (
   947  	nameTypeEmail = 1
   948  	nameTypeDNS   = 2
   949  	nameTypeURI   = 6
   950  	nameTypeIP    = 7
   951  )
   952  
   953  // RFC 5280, 4.2.2.1
   954  type authorityInfoAccess struct {
   955  	Method   asn1.ObjectIdentifier
   956  	Location asn1.RawValue
   957  }
   958  
   959  // RFC 5280, 4.2.1.14
   960  type distributionPoint struct {
   961  	DistributionPoint distributionPointName `asn1:"optional,tag:0"`
   962  	Reason            asn1.BitString        `asn1:"optional,tag:1"`
   963  	CRLIssuer         asn1.RawValue         `asn1:"optional,tag:2"`
   964  }
   965  
   966  type distributionPointName struct {
   967  	FullName     []asn1.RawValue  `asn1:"optional,tag:0"`
   968  	RelativeName pkix.RDNSequence `asn1:"optional,tag:1"`
   969  }
   970  
   971  func parsePublicKey(algo PublicKeyAlgorithm, keyData *publicKeyInfo) (interface{}, error) {
   972  	asn1Data := keyData.PublicKey.RightAlign()
   973  	switch algo {
   974  	case RSA:
   975  		// RSA public keys must have a NULL in the parameters.
   976  		// See RFC 3279, Section 2.3.1.
   977  		if !bytes.Equal(keyData.Algorithm.Parameters.FullBytes, asn1.NullBytes) {
   978  			return nil, errors.New("x509: RSA key missing NULL parameters")
   979  		}
   980  
   981  		p := new(pkcs1PublicKey)
   982  		rest, err := asn1.Unmarshal(asn1Data, p)
   983  		if err != nil {
   984  			return nil, err
   985  		}
   986  		if len(rest) != 0 {
   987  			return nil, errors.New("x509: trailing data after RSA public key")
   988  		}
   989  
   990  		if p.N.Sign() <= 0 {
   991  			return nil, errors.New("x509: RSA modulus is not a positive number")
   992  		}
   993  		if p.E <= 0 {
   994  			return nil, errors.New("x509: RSA public exponent is not a positive number")
   995  		}
   996  
   997  		pub := &rsa.PublicKey{
   998  			E: p.E,
   999  			N: p.N,
  1000  		}
  1001  		return pub, nil
  1002  	case DSA:
  1003  		var p *big.Int
  1004  		rest, err := asn1.Unmarshal(asn1Data, &p)
  1005  		if err != nil {
  1006  			return nil, err
  1007  		}
  1008  		if len(rest) != 0 {
  1009  			return nil, errors.New("x509: trailing data after DSA public key")
  1010  		}
  1011  		paramsData := keyData.Algorithm.Parameters.FullBytes
  1012  		params := new(dsaAlgorithmParameters)
  1013  		rest, err = asn1.Unmarshal(paramsData, params)
  1014  		if err != nil {
  1015  			return nil, err
  1016  		}
  1017  		if len(rest) != 0 {
  1018  			return nil, errors.New("x509: trailing data after DSA parameters")
  1019  		}
  1020  		if p.Sign() <= 0 || params.P.Sign() <= 0 || params.Q.Sign() <= 0 || params.G.Sign() <= 0 {
  1021  			return nil, errors.New("x509: zero or negative DSA parameter")
  1022  		}
  1023  		pub := &dsa.PublicKey{
  1024  			Parameters: dsa.Parameters{
  1025  				P: params.P,
  1026  				Q: params.Q,
  1027  				G: params.G,
  1028  			},
  1029  			Y: p,
  1030  		}
  1031  		return pub, nil
  1032  	case ECDSA:
  1033  		paramsData := keyData.Algorithm.Parameters.FullBytes
  1034  		namedCurveOID := new(asn1.ObjectIdentifier)
  1035  		rest, err := asn1.Unmarshal(paramsData, namedCurveOID)
  1036  		if err != nil {
  1037  			return nil, errors.New("x509: failed to parse ECDSA parameters as named curve")
  1038  		}
  1039  		if len(rest) != 0 {
  1040  			return nil, errors.New("x509: trailing data after ECDSA parameters")
  1041  		}
  1042  		namedCurve := namedCurveFromOID(*namedCurveOID)
  1043  		if namedCurve == nil {
  1044  			return nil, errors.New("x509: unsupported elliptic curve")
  1045  		}
  1046  		x, y := elliptic.Unmarshal(namedCurve, asn1Data)
  1047  		if x == nil {
  1048  			return nil, errors.New("x509: failed to unmarshal elliptic curve point")
  1049  		}
  1050  		pub := &ecdsa.PublicKey{
  1051  			Curve: namedCurve,
  1052  			X:     x,
  1053  			Y:     y,
  1054  		}
  1055  		return pub, nil
  1056  	case Ed25519:
  1057  		// RFC 8410, Section 3
  1058  		// > For all of the OIDs, the parameters MUST be absent.
  1059  		if len(keyData.Algorithm.Parameters.FullBytes) != 0 {
  1060  			return nil, errors.New("x509: Ed25519 key encoded with illegal parameters")
  1061  		}
  1062  		if len(asn1Data) != ed25519.PublicKeySize {
  1063  			return nil, errors.New("x509: wrong Ed25519 public key size")
  1064  		}
  1065  		pub := make([]byte, ed25519.PublicKeySize)
  1066  		copy(pub, asn1Data)
  1067  		return ed25519.PublicKey(pub), nil
  1068  	default:
  1069  		return nil, nil
  1070  	}
  1071  }
  1072  
  1073  func forEachSAN(extension []byte, callback func(tag int, data []byte) error) error {
  1074  	// RFC 5280, 4.2.1.6
  1075  
  1076  	// SubjectAltName ::= GeneralNames
  1077  	//
  1078  	// GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
  1079  	//
  1080  	// GeneralName ::= CHOICE {
  1081  	//      otherName                       [0]     OtherName,
  1082  	//      rfc822Name                      [1]     IA5String,
  1083  	//      dNSName                         [2]     IA5String,
  1084  	//      x400Address                     [3]     ORAddress,
  1085  	//      directoryName                   [4]     Name,
  1086  	//      ediPartyName                    [5]     EDIPartyName,
  1087  	//      uniformResourceIdentifier       [6]     IA5String,
  1088  	//      iPAddress                       [7]     OCTET STRING,
  1089  	//      registeredID                    [8]     OBJECT IDENTIFIER }
  1090  	var seq asn1.RawValue
  1091  	rest, err := asn1.Unmarshal(extension, &seq)
  1092  	if err != nil {
  1093  		return err
  1094  	} else if len(rest) != 0 {
  1095  		return errors.New("x509: trailing data after X.509 extension")
  1096  	}
  1097  	if !seq.IsCompound || seq.Tag != 16 || seq.Class != 0 {
  1098  		return asn1.StructuralError{Msg: "bad SAN sequence"}
  1099  	}
  1100  
  1101  	rest = seq.Bytes
  1102  	for len(rest) > 0 {
  1103  		var v asn1.RawValue
  1104  		rest, err = asn1.Unmarshal(rest, &v)
  1105  		if err != nil {
  1106  			return err
  1107  		}
  1108  
  1109  		if err := callback(v.Tag, v.Bytes); err != nil {
  1110  			return err
  1111  		}
  1112  	}
  1113  
  1114  	return nil
  1115  }
  1116  
  1117  func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddresses []net.IP, uris []*url.URL, err error) {
  1118  	err = forEachSAN(value, func(tag int, data []byte) error {
  1119  		switch tag {
  1120  		case nameTypeEmail:
  1121  			emailAddresses = append(emailAddresses, string(data))
  1122  		case nameTypeDNS:
  1123  			dnsNames = append(dnsNames, string(data))
  1124  		case nameTypeURI:
  1125  			uri, err := url.Parse(string(data))
  1126  			if err != nil {
  1127  				return fmt.Errorf("x509: cannot parse URI %q: %s", string(data), err)
  1128  			}
  1129  			if len(uri.Host) > 0 {
  1130  				if _, ok := domainToReverseLabels(uri.Host); !ok {
  1131  					return fmt.Errorf("x509: cannot parse URI %q: invalid domain", string(data))
  1132  				}
  1133  			}
  1134  			uris = append(uris, uri)
  1135  		case nameTypeIP:
  1136  			switch len(data) {
  1137  			case net.IPv4len, net.IPv6len:
  1138  				ipAddresses = append(ipAddresses, data)
  1139  			default:
  1140  				return errors.New("x509: cannot parse IP address of length " + strconv.Itoa(len(data)))
  1141  			}
  1142  		}
  1143  
  1144  		return nil
  1145  	})
  1146  
  1147  	return
  1148  }
  1149  
  1150  // isValidIPMask reports whether mask consists of zero or more 1 bits, followed by zero bits.
  1151  func isValidIPMask(mask []byte) bool {
  1152  	seenZero := false
  1153  
  1154  	for _, b := range mask {
  1155  		if seenZero {
  1156  			if b != 0 {
  1157  				return false
  1158  			}
  1159  
  1160  			continue
  1161  		}
  1162  
  1163  		switch b {
  1164  		case 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe:
  1165  			seenZero = true
  1166  		case 0xff:
  1167  		default:
  1168  			return false
  1169  		}
  1170  	}
  1171  
  1172  	return true
  1173  }
  1174  
  1175  func parseNameConstraintsExtension(out *Certificate, e pkix.Extension) (unhandled bool, err error) {
  1176  	// RFC 5280, 4.2.1.10
  1177  
  1178  	// NameConstraints ::= SEQUENCE {
  1179  	//      permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
  1180  	//      excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
  1181  	//
  1182  	// GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
  1183  	//
  1184  	// GeneralSubtree ::= SEQUENCE {
  1185  	//      base                    GeneralName,
  1186  	//      minimum         [0]     BaseDistance DEFAULT 0,
  1187  	//      maximum         [1]     BaseDistance OPTIONAL }
  1188  	//
  1189  	// BaseDistance ::= INTEGER (0..MAX)
  1190  
  1191  	outer := cryptobyte.String(e.Value)
  1192  	var toplevel, permitted, excluded cryptobyte.String
  1193  	var havePermitted, haveExcluded bool
  1194  	if !outer.ReadASN1(&toplevel, cryptobyte_asn1.SEQUENCE) ||
  1195  		!outer.Empty() ||
  1196  		!toplevel.ReadOptionalASN1(&permitted, &havePermitted, cryptobyte_asn1.Tag(0).ContextSpecific().Constructed()) ||
  1197  		!toplevel.ReadOptionalASN1(&excluded, &haveExcluded, cryptobyte_asn1.Tag(1).ContextSpecific().Constructed()) ||
  1198  		!toplevel.Empty() {
  1199  		return false, errors.New("x509: invalid NameConstraints extension")
  1200  	}
  1201  
  1202  	if !havePermitted && !haveExcluded || len(permitted) == 0 && len(excluded) == 0 {
  1203  		// From RFC 5280, Section 4.2.1.10:
  1204  		//   “either the permittedSubtrees field
  1205  		//   or the excludedSubtrees MUST be
  1206  		//   present”
  1207  		return false, errors.New("x509: empty name constraints extension")
  1208  	}
  1209  
  1210  	getValues := func(subtrees cryptobyte.String) (dnsNames []string, ips []*net.IPNet, emails, uriDomains []string, err error) {
  1211  		for !subtrees.Empty() {
  1212  			var seq, value cryptobyte.String
  1213  			var tag cryptobyte_asn1.Tag
  1214  			if !subtrees.ReadASN1(&seq, cryptobyte_asn1.SEQUENCE) ||
  1215  				!seq.ReadAnyASN1(&value, &tag) {
  1216  				return nil, nil, nil, nil, fmt.Errorf("x509: invalid NameConstraints extension")
  1217  			}
  1218  
  1219  			var (
  1220  				dnsTag   = cryptobyte_asn1.Tag(2).ContextSpecific()
  1221  				emailTag = cryptobyte_asn1.Tag(1).ContextSpecific()
  1222  				ipTag    = cryptobyte_asn1.Tag(7).ContextSpecific()
  1223  				uriTag   = cryptobyte_asn1.Tag(6).ContextSpecific()
  1224  			)
  1225  
  1226  			switch tag {
  1227  			case dnsTag:
  1228  				domain := string(value)
  1229  				if err := isIA5String(domain); err != nil {
  1230  					return nil, nil, nil, nil, errors.New("x509: invalid constraint value: " + err.Error())
  1231  				}
  1232  
  1233  				trimmedDomain := domain
  1234  				if len(trimmedDomain) > 0 && trimmedDomain[0] == '.' {
  1235  					// constraints can have a leading
  1236  					// period to exclude the domain
  1237  					// itself, but that's not valid in a
  1238  					// normal domain name.
  1239  					trimmedDomain = trimmedDomain[1:]
  1240  				}
  1241  				if _, ok := domainToReverseLabels(trimmedDomain); !ok {
  1242  					return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse dnsName constraint %q", domain)
  1243  				}
  1244  				dnsNames = append(dnsNames, domain)
  1245  
  1246  			case ipTag:
  1247  				l := len(value)
  1248  				var ip, mask []byte
  1249  
  1250  				switch l {
  1251  				case 8:
  1252  					ip = value[:4]
  1253  					mask = value[4:]
  1254  
  1255  				case 32:
  1256  					ip = value[:16]
  1257  					mask = value[16:]
  1258  
  1259  				default:
  1260  					return nil, nil, nil, nil, fmt.Errorf("x509: IP constraint contained value of length %d", l)
  1261  				}
  1262  
  1263  				if !isValidIPMask(mask) {
  1264  					return nil, nil, nil, nil, fmt.Errorf("x509: IP constraint contained invalid mask %x", mask)
  1265  				}
  1266  
  1267  				ips = append(ips, &net.IPNet{IP: net.IP(ip), Mask: net.IPMask(mask)})
  1268  
  1269  			case emailTag:
  1270  				constraint := string(value)
  1271  				if err := isIA5String(constraint); err != nil {
  1272  					return nil, nil, nil, nil, errors.New("x509: invalid constraint value: " + err.Error())
  1273  				}
  1274  
  1275  				// If the constraint contains an @ then
  1276  				// it specifies an exact mailbox name.
  1277  				if strings.Contains(constraint, "@") {
  1278  					if _, ok := parseRFC2821Mailbox(constraint); !ok {
  1279  						return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse rfc822Name constraint %q", constraint)
  1280  					}
  1281  				} else {
  1282  					// Otherwise it's a domain name.
  1283  					domain := constraint
  1284  					if len(domain) > 0 && domain[0] == '.' {
  1285  						domain = domain[1:]
  1286  					}
  1287  					if _, ok := domainToReverseLabels(domain); !ok {
  1288  						return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse rfc822Name constraint %q", constraint)
  1289  					}
  1290  				}
  1291  				emails = append(emails, constraint)
  1292  
  1293  			case uriTag:
  1294  				domain := string(value)
  1295  				if err := isIA5String(domain); err != nil {
  1296  					return nil, nil, nil, nil, errors.New("x509: invalid constraint value: " + err.Error())
  1297  				}
  1298  
  1299  				if net.ParseIP(domain) != nil {
  1300  					return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse URI constraint %q: cannot be IP address", domain)
  1301  				}
  1302  
  1303  				trimmedDomain := domain
  1304  				if len(trimmedDomain) > 0 && trimmedDomain[0] == '.' {
  1305  					// constraints can have a leading
  1306  					// period to exclude the domain itself,
  1307  					// but that's not valid in a normal
  1308  					// domain name.
  1309  					trimmedDomain = trimmedDomain[1:]
  1310  				}
  1311  				if _, ok := domainToReverseLabels(trimmedDomain); !ok {
  1312  					return nil, nil, nil, nil, fmt.Errorf("x509: failed to parse URI constraint %q", domain)
  1313  				}
  1314  				uriDomains = append(uriDomains, domain)
  1315  
  1316  			default:
  1317  				unhandled = true
  1318  			}
  1319  		}
  1320  
  1321  		return dnsNames, ips, emails, uriDomains, nil
  1322  	}
  1323  
  1324  	if out.PermittedDNSDomains, out.PermittedIPRanges, out.PermittedEmailAddresses, out.PermittedURIDomains, err = getValues(permitted); err != nil {
  1325  		return false, err
  1326  	}
  1327  	if out.ExcludedDNSDomains, out.ExcludedIPRanges, out.ExcludedEmailAddresses, out.ExcludedURIDomains, err = getValues(excluded); err != nil {
  1328  		return false, err
  1329  	}
  1330  	out.PermittedDNSDomainsCritical = e.Critical
  1331  
  1332  	return unhandled, nil
  1333  }
  1334  
  1335  func parseCertificate(in *certificate) (*Certificate, error) {
  1336  	out := new(Certificate)
  1337  	out.Raw = in.Raw
  1338  	out.RawTBSCertificate = in.TBSCertificate.Raw
  1339  	out.RawSubjectPublicKeyInfo = in.TBSCertificate.PublicKey.Raw
  1340  	out.RawSubject = in.TBSCertificate.Subject.FullBytes
  1341  	out.RawIssuer = in.TBSCertificate.Issuer.FullBytes
  1342  
  1343  	out.Signature = in.SignatureValue.RightAlign()
  1344  	out.SignatureAlgorithm =
  1345  		getSignatureAlgorithmFromAI(in.TBSCertificate.SignatureAlgorithm)
  1346  
  1347  	out.PublicKeyAlgorithm =
  1348  		getPublicKeyAlgorithmFromOID(in.TBSCertificate.PublicKey.Algorithm.Algorithm)
  1349  	var err error
  1350  	out.PublicKey, err = parsePublicKey(out.PublicKeyAlgorithm, &in.TBSCertificate.PublicKey)
  1351  	if err != nil {
  1352  		return nil, err
  1353  	}
  1354  
  1355  	out.Version = in.TBSCertificate.Version + 1
  1356  	out.SerialNumber = in.TBSCertificate.SerialNumber
  1357  
  1358  	var issuer, subject pkix.RDNSequence
  1359  	if rest, err := asn1.Unmarshal(in.TBSCertificate.Subject.FullBytes, &subject); err != nil {
  1360  		return nil, err
  1361  	} else if len(rest) != 0 {
  1362  		return nil, errors.New("x509: trailing data after X.509 subject")
  1363  	}
  1364  	if rest, err := asn1.Unmarshal(in.TBSCertificate.Issuer.FullBytes, &issuer); err != nil {
  1365  		return nil, err
  1366  	} else if len(rest) != 0 {
  1367  		return nil, errors.New("x509: trailing data after X.509 issuer")
  1368  	}
  1369  
  1370  	out.Issuer.FillFromRDNSequence(&issuer)
  1371  	out.Subject.FillFromRDNSequence(&subject)
  1372  
  1373  	out.NotBefore = in.TBSCertificate.Validity.NotBefore
  1374  	out.NotAfter = in.TBSCertificate.Validity.NotAfter
  1375  
  1376  	for _, e := range in.TBSCertificate.Extensions {
  1377  		out.Extensions = append(out.Extensions, e)
  1378  		unhandled := false
  1379  
  1380  		if len(e.Id) == 4 && e.Id[0] == 2 && e.Id[1] == 5 && e.Id[2] == 29 {
  1381  			switch e.Id[3] {
  1382  			case 15:
  1383  				// RFC 5280, 4.2.1.3
  1384  				var usageBits asn1.BitString
  1385  				if rest, err := asn1.Unmarshal(e.Value, &usageBits); err != nil {
  1386  					return nil, err
  1387  				} else if len(rest) != 0 {
  1388  					return nil, errors.New("x509: trailing data after X.509 KeyUsage")
  1389  				}
  1390  
  1391  				var usage int
  1392  				for i := 0; i < 9; i++ {
  1393  					if usageBits.At(i) != 0 {
  1394  						usage |= 1 << uint(i)
  1395  					}
  1396  				}
  1397  				out.KeyUsage = KeyUsage(usage)
  1398  
  1399  			case 19:
  1400  				// RFC 5280, 4.2.1.9
  1401  				var constraints basicConstraints
  1402  				if rest, err := asn1.Unmarshal(e.Value, &constraints); err != nil {
  1403  					return nil, err
  1404  				} else if len(rest) != 0 {
  1405  					return nil, errors.New("x509: trailing data after X.509 BasicConstraints")
  1406  				}
  1407  
  1408  				out.BasicConstraintsValid = true
  1409  				out.IsCA = constraints.IsCA
  1410  				out.MaxPathLen = constraints.MaxPathLen
  1411  				out.MaxPathLenZero = out.MaxPathLen == 0
  1412  				// TODO: map out.MaxPathLen to 0 if it has the -1 default value? (Issue 19285)
  1413  			case 17:
  1414  				out.DNSNames, out.EmailAddresses, out.IPAddresses, out.URIs, err = parseSANExtension(e.Value)
  1415  				if err != nil {
  1416  					return nil, err
  1417  				}
  1418  
  1419  				if len(out.DNSNames) == 0 && len(out.EmailAddresses) == 0 && len(out.IPAddresses) == 0 && len(out.URIs) == 0 {
  1420  					// If we didn't parse anything then we do the critical check, below.
  1421  					unhandled = true
  1422  				}
  1423  
  1424  			case 30:
  1425  				unhandled, err = parseNameConstraintsExtension(out, e)
  1426  				if err != nil {
  1427  					return nil, err
  1428  				}
  1429  
  1430  			case 31:
  1431  				// RFC 5280, 4.2.1.13
  1432  
  1433  				// CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
  1434  				//
  1435  				// DistributionPoint ::= SEQUENCE {
  1436  				//     distributionPoint       [0]     DistributionPointName OPTIONAL,
  1437  				//     reasons                 [1]     ReasonFlags OPTIONAL,
  1438  				//     cRLIssuer               [2]     GeneralNames OPTIONAL }
  1439  				//
  1440  				// DistributionPointName ::= CHOICE {
  1441  				//     fullName                [0]     GeneralNames,
  1442  				//     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
  1443  
  1444  				var cdp []distributionPoint
  1445  				if rest, err := asn1.Unmarshal(e.Value, &cdp); err != nil {
  1446  					return nil, err
  1447  				} else if len(rest) != 0 {
  1448  					return nil, errors.New("x509: trailing data after X.509 CRL distribution point")
  1449  				}
  1450  
  1451  				for _, dp := range cdp {
  1452  					// Per RFC 5280, 4.2.1.13, one of distributionPoint or cRLIssuer may be empty.
  1453  					if len(dp.DistributionPoint.FullName) == 0 {
  1454  						continue
  1455  					}
  1456  
  1457  					for _, fullName := range dp.DistributionPoint.FullName {
  1458  						if fullName.Tag == 6 {
  1459  							out.CRLDistributionPoints = append(out.CRLDistributionPoints, string(fullName.Bytes))
  1460  						}
  1461  					}
  1462  				}
  1463  
  1464  			case 35:
  1465  				// RFC 5280, 4.2.1.1
  1466  				var a authKeyId
  1467  				if rest, err := asn1.Unmarshal(e.Value, &a); err != nil {
  1468  					return nil, err
  1469  				} else if len(rest) != 0 {
  1470  					return nil, errors.New("x509: trailing data after X.509 authority key-id")
  1471  				}
  1472  				out.AuthorityKeyId = a.Id
  1473  
  1474  			case 37:
  1475  				// RFC 5280, 4.2.1.12.  Extended Key Usage
  1476  
  1477  				// id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
  1478  				//
  1479  				// ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
  1480  				//
  1481  				// KeyPurposeId ::= OBJECT IDENTIFIER
  1482  
  1483  				var keyUsage []asn1.ObjectIdentifier
  1484  				if rest, err := asn1.Unmarshal(e.Value, &keyUsage); err != nil {
  1485  					return nil, err
  1486  				} else if len(rest) != 0 {
  1487  					return nil, errors.New("x509: trailing data after X.509 ExtendedKeyUsage")
  1488  				}
  1489  
  1490  				for _, u := range keyUsage {
  1491  					if extKeyUsage, ok := extKeyUsageFromOID(u); ok {
  1492  						out.ExtKeyUsage = append(out.ExtKeyUsage, extKeyUsage)
  1493  					} else {
  1494  						out.UnknownExtKeyUsage = append(out.UnknownExtKeyUsage, u)
  1495  					}
  1496  				}
  1497  
  1498  			case 14:
  1499  				// RFC 5280, 4.2.1.2
  1500  				var keyid []byte
  1501  				if rest, err := asn1.Unmarshal(e.Value, &keyid); err != nil {
  1502  					return nil, err
  1503  				} else if len(rest) != 0 {
  1504  					return nil, errors.New("x509: trailing data after X.509 key-id")
  1505  				}
  1506  				out.SubjectKeyId = keyid
  1507  
  1508  			case 32:
  1509  				// RFC 5280 4.2.1.4: Certificate Policies
  1510  				var policies []policyInformation
  1511  				if rest, err := asn1.Unmarshal(e.Value, &policies); err != nil {
  1512  					return nil, err
  1513  				} else if len(rest) != 0 {
  1514  					return nil, errors.New("x509: trailing data after X.509 certificate policies")
  1515  				}
  1516  				out.PolicyIdentifiers = make([]asn1.ObjectIdentifier, len(policies))
  1517  				for i, policy := range policies {
  1518  					out.PolicyIdentifiers[i] = policy.Policy
  1519  				}
  1520  
  1521  			default:
  1522  				// Unknown extensions are recorded if critical.
  1523  				unhandled = true
  1524  			}
  1525  		} else if e.Id.Equal(oidExtensionAuthorityInfoAccess) {
  1526  			// RFC 5280 4.2.2.1: Authority Information Access
  1527  			var aia []authorityInfoAccess
  1528  			if rest, err := asn1.Unmarshal(e.Value, &aia); err != nil {
  1529  				return nil, err
  1530  			} else if len(rest) != 0 {
  1531  				return nil, errors.New("x509: trailing data after X.509 authority information")
  1532  			}
  1533  
  1534  			for _, v := range aia {
  1535  				// GeneralName: uniformResourceIdentifier [6] IA5String
  1536  				if v.Location.Tag != 6 {
  1537  					continue
  1538  				}
  1539  				if v.Method.Equal(oidAuthorityInfoAccessOcsp) {
  1540  					out.OCSPServer = append(out.OCSPServer, string(v.Location.Bytes))
  1541  				} else if v.Method.Equal(oidAuthorityInfoAccessIssuers) {
  1542  					out.IssuingCertificateURL = append(out.IssuingCertificateURL, string(v.Location.Bytes))
  1543  				}
  1544  			}
  1545  		} else {
  1546  			// Unknown extensions are recorded if critical.
  1547  			unhandled = true
  1548  		}
  1549  
  1550  		if e.Critical && unhandled {
  1551  			out.UnhandledCriticalExtensions = append(out.UnhandledCriticalExtensions, e.Id)
  1552  		}
  1553  	}
  1554  
  1555  	return out, nil
  1556  }
  1557  
  1558  // ParseCertificate parses a single certificate from the given ASN.1 DER data.
  1559  func ParseCertificate(asn1Data []byte) (*Certificate, error) {
  1560  	var cert certificate
  1561  	rest, err := asn1.Unmarshal(asn1Data, &cert)
  1562  	if err != nil {
  1563  		return nil, err
  1564  	}
  1565  	if len(rest) > 0 {
  1566  		return nil, asn1.SyntaxError{Msg: "trailing data"}
  1567  	}
  1568  
  1569  	return parseCertificate(&cert)
  1570  }
  1571  
  1572  // ParseCertificates parses one or more certificates from the given ASN.1 DER
  1573  // data. The certificates must be concatenated with no intermediate padding.
  1574  func ParseCertificates(asn1Data []byte) ([]*Certificate, error) {
  1575  	var v []*certificate
  1576  
  1577  	for len(asn1Data) > 0 {
  1578  		cert := new(certificate)
  1579  		var err error
  1580  		asn1Data, err = asn1.Unmarshal(asn1Data, cert)
  1581  		if err != nil {
  1582  			return nil, err
  1583  		}
  1584  		v = append(v, cert)
  1585  	}
  1586  
  1587  	ret := make([]*Certificate, len(v))
  1588  	for i, ci := range v {
  1589  		cert, err := parseCertificate(ci)
  1590  		if err != nil {
  1591  			return nil, err
  1592  		}
  1593  		ret[i] = cert
  1594  	}
  1595  
  1596  	return ret, nil
  1597  }
  1598  
  1599  func reverseBitsInAByte(in byte) byte {
  1600  	b1 := in>>4 | in<<4
  1601  	b2 := b1>>2&0x33 | b1<<2&0xcc
  1602  	b3 := b2>>1&0x55 | b2<<1&0xaa
  1603  	return b3
  1604  }
  1605  
  1606  // asn1BitLength returns the bit-length of bitString by considering the
  1607  // most-significant bit in a byte to be the "first" bit. This convention
  1608  // matches ASN.1, but differs from almost everything else.
  1609  func asn1BitLength(bitString []byte) int {
  1610  	bitLen := len(bitString) * 8
  1611  
  1612  	for i := range bitString {
  1613  		b := bitString[len(bitString)-i-1]
  1614  
  1615  		for bit := uint(0); bit < 8; bit++ {
  1616  			if (b>>bit)&1 == 1 {
  1617  				return bitLen
  1618  			}
  1619  			bitLen--
  1620  		}
  1621  	}
  1622  
  1623  	return 0
  1624  }
  1625  
  1626  var (
  1627  	oidExtensionSubjectKeyId          = []int{2, 5, 29, 14}
  1628  	oidExtensionKeyUsage              = []int{2, 5, 29, 15}
  1629  	oidExtensionExtendedKeyUsage      = []int{2, 5, 29, 37}
  1630  	oidExtensionAuthorityKeyId        = []int{2, 5, 29, 35}
  1631  	oidExtensionBasicConstraints      = []int{2, 5, 29, 19}
  1632  	oidExtensionSubjectAltName        = []int{2, 5, 29, 17}
  1633  	oidExtensionCertificatePolicies   = []int{2, 5, 29, 32}
  1634  	oidExtensionNameConstraints       = []int{2, 5, 29, 30}
  1635  	oidExtensionCRLDistributionPoints = []int{2, 5, 29, 31}
  1636  	oidExtensionAuthorityInfoAccess   = []int{1, 3, 6, 1, 5, 5, 7, 1, 1}
  1637  	oidExtensionCRLNumber             = []int{2, 5, 29, 20}
  1638  )
  1639  
  1640  var (
  1641  	oidAuthorityInfoAccessOcsp    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1}
  1642  	oidAuthorityInfoAccessIssuers = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 2}
  1643  )
  1644  
  1645  // oidNotInExtensions reports whether an extension with the given oid exists in
  1646  // extensions.
  1647  func oidInExtensions(oid asn1.ObjectIdentifier, extensions []pkix.Extension) bool {
  1648  	for _, e := range extensions {
  1649  		if e.Id.Equal(oid) {
  1650  			return true
  1651  		}
  1652  	}
  1653  	return false
  1654  }
  1655  
  1656  // marshalSANs marshals a list of addresses into a the contents of an X.509
  1657  // SubjectAlternativeName extension.
  1658  func marshalSANs(dnsNames, emailAddresses []string, ipAddresses []net.IP, uris []*url.URL) (derBytes []byte, err error) {
  1659  	var rawValues []asn1.RawValue
  1660  	for _, name := range dnsNames {
  1661  		rawValues = append(rawValues, asn1.RawValue{Tag: nameTypeDNS, Class: 2, Bytes: []byte(name)})
  1662  	}
  1663  	for _, email := range emailAddresses {
  1664  		rawValues = append(rawValues, asn1.RawValue{Tag: nameTypeEmail, Class: 2, Bytes: []byte(email)})
  1665  	}
  1666  	for _, rawIP := range ipAddresses {
  1667  		// If possible, we always want to encode IPv4 addresses in 4 bytes.
  1668  		ip := rawIP.To4()
  1669  		if ip == nil {
  1670  			ip = rawIP
  1671  		}
  1672  		rawValues = append(rawValues, asn1.RawValue{Tag: nameTypeIP, Class: 2, Bytes: ip})
  1673  	}
  1674  	for _, uri := range uris {
  1675  		rawValues = append(rawValues, asn1.RawValue{Tag: nameTypeURI, Class: 2, Bytes: []byte(uri.String())})
  1676  	}
  1677  	return asn1.Marshal(rawValues)
  1678  }
  1679  
  1680  func isIA5String(s string) error {
  1681  	for _, r := range s {
  1682  		if r >= utf8.RuneSelf {
  1683  			return fmt.Errorf("x509: %q cannot be encoded as an IA5String", s)
  1684  		}
  1685  	}
  1686  
  1687  	return nil
  1688  }
  1689  
  1690  func buildExtensions(template *Certificate, subjectIsEmpty bool, authorityKeyId []byte, subjectKeyId []byte) (ret []pkix.Extension, err error) {
  1691  	ret = make([]pkix.Extension, 10 /* maximum number of elements. */)
  1692  	n := 0
  1693  
  1694  	if template.KeyUsage != 0 &&
  1695  		!oidInExtensions(oidExtensionKeyUsage, template.ExtraExtensions) {
  1696  		ret[n].Id = oidExtensionKeyUsage
  1697  		ret[n].Critical = true
  1698  
  1699  		var a [2]byte
  1700  		a[0] = reverseBitsInAByte(byte(template.KeyUsage))
  1701  		a[1] = reverseBitsInAByte(byte(template.KeyUsage >> 8))
  1702  
  1703  		l := 1
  1704  		if a[1] != 0 {
  1705  			l = 2
  1706  		}
  1707  
  1708  		bitString := a[:l]
  1709  		ret[n].Value, err = asn1.Marshal(asn1.BitString{Bytes: bitString, BitLength: asn1BitLength(bitString)})
  1710  		if err != nil {
  1711  			return
  1712  		}
  1713  		n++
  1714  	}
  1715  
  1716  	if (len(template.ExtKeyUsage) > 0 || len(template.UnknownExtKeyUsage) > 0) &&
  1717  		!oidInExtensions(oidExtensionExtendedKeyUsage, template.ExtraExtensions) {
  1718  		ret[n].Id = oidExtensionExtendedKeyUsage
  1719  
  1720  		var oids []asn1.ObjectIdentifier
  1721  		for _, u := range template.ExtKeyUsage {
  1722  			if oid, ok := oidFromExtKeyUsage(u); ok {
  1723  				oids = append(oids, oid)
  1724  			} else {
  1725  				panic("internal error")
  1726  			}
  1727  		}
  1728  
  1729  		oids = append(oids, template.UnknownExtKeyUsage...)
  1730  
  1731  		ret[n].Value, err = asn1.Marshal(oids)
  1732  		if err != nil {
  1733  			return
  1734  		}
  1735  		n++
  1736  	}
  1737  
  1738  	if template.BasicConstraintsValid && !oidInExtensions(oidExtensionBasicConstraints, template.ExtraExtensions) {
  1739  		// Leaving MaxPathLen as zero indicates that no maximum path
  1740  		// length is desired, unless MaxPathLenZero is set. A value of
  1741  		// -1 causes encoding/asn1 to omit the value as desired.
  1742  		maxPathLen := template.MaxPathLen
  1743  		if maxPathLen == 0 && !template.MaxPathLenZero {
  1744  			maxPathLen = -1
  1745  		}
  1746  		ret[n].Id = oidExtensionBasicConstraints
  1747  		ret[n].Value, err = asn1.Marshal(basicConstraints{template.IsCA, maxPathLen})
  1748  		ret[n].Critical = true
  1749  		if err != nil {
  1750  			return
  1751  		}
  1752  		n++
  1753  	}
  1754  
  1755  	if len(subjectKeyId) > 0 && !oidInExtensions(oidExtensionSubjectKeyId, template.ExtraExtensions) {
  1756  		ret[n].Id = oidExtensionSubjectKeyId
  1757  		ret[n].Value, err = asn1.Marshal(subjectKeyId)
  1758  		if err != nil {
  1759  			return
  1760  		}
  1761  		n++
  1762  	}
  1763  
  1764  	if len(authorityKeyId) > 0 && !oidInExtensions(oidExtensionAuthorityKeyId, template.ExtraExtensions) {
  1765  		ret[n].Id = oidExtensionAuthorityKeyId
  1766  		ret[n].Value, err = asn1.Marshal(authKeyId{authorityKeyId})
  1767  		if err != nil {
  1768  			return
  1769  		}
  1770  		n++
  1771  	}
  1772  
  1773  	if (len(template.OCSPServer) > 0 || len(template.IssuingCertificateURL) > 0) &&
  1774  		!oidInExtensions(oidExtensionAuthorityInfoAccess, template.ExtraExtensions) {
  1775  		ret[n].Id = oidExtensionAuthorityInfoAccess
  1776  		var aiaValues []authorityInfoAccess
  1777  		for _, name := range template.OCSPServer {
  1778  			aiaValues = append(aiaValues, authorityInfoAccess{
  1779  				Method:   oidAuthorityInfoAccessOcsp,
  1780  				Location: asn1.RawValue{Tag: 6, Class: 2, Bytes: []byte(name)},
  1781  			})
  1782  		}
  1783  		for _, name := range template.IssuingCertificateURL {
  1784  			aiaValues = append(aiaValues, authorityInfoAccess{
  1785  				Method:   oidAuthorityInfoAccessIssuers,
  1786  				Location: asn1.RawValue{Tag: 6, Class: 2, Bytes: []byte(name)},
  1787  			})
  1788  		}
  1789  		ret[n].Value, err = asn1.Marshal(aiaValues)
  1790  		if err != nil {
  1791  			return
  1792  		}
  1793  		n++
  1794  	}
  1795  
  1796  	if (len(template.DNSNames) > 0 || len(template.EmailAddresses) > 0 || len(template.IPAddresses) > 0 || len(template.URIs) > 0) &&
  1797  		!oidInExtensions(oidExtensionSubjectAltName, template.ExtraExtensions) {
  1798  		ret[n].Id = oidExtensionSubjectAltName
  1799  		// From RFC 5280, Section 4.2.1.6:
  1800  		// “If the subject field contains an empty sequence ... then
  1801  		// subjectAltName extension ... is marked as critical”
  1802  		ret[n].Critical = subjectIsEmpty
  1803  		ret[n].Value, err = marshalSANs(template.DNSNames, template.EmailAddresses, template.IPAddresses, template.URIs)
  1804  		if err != nil {
  1805  			return
  1806  		}
  1807  		n++
  1808  	}
  1809  
  1810  	if len(template.PolicyIdentifiers) > 0 &&
  1811  		!oidInExtensions(oidExtensionCertificatePolicies, template.ExtraExtensions) {
  1812  		ret[n].Id = oidExtensionCertificatePolicies
  1813  		policies := make([]policyInformation, len(template.PolicyIdentifiers))
  1814  		for i, policy := range template.PolicyIdentifiers {
  1815  			policies[i].Policy = policy
  1816  		}
  1817  		ret[n].Value, err = asn1.Marshal(policies)
  1818  		if err != nil {
  1819  			return
  1820  		}
  1821  		n++
  1822  	}
  1823  
  1824  	if (len(template.PermittedDNSDomains) > 0 || len(template.ExcludedDNSDomains) > 0 ||
  1825  		len(template.PermittedIPRanges) > 0 || len(template.ExcludedIPRanges) > 0 ||
  1826  		len(template.PermittedEmailAddresses) > 0 || len(template.ExcludedEmailAddresses) > 0 ||
  1827  		len(template.PermittedURIDomains) > 0 || len(template.ExcludedURIDomains) > 0) &&
  1828  		!oidInExtensions(oidExtensionNameConstraints, template.ExtraExtensions) {
  1829  		ret[n].Id = oidExtensionNameConstraints
  1830  		ret[n].Critical = template.PermittedDNSDomainsCritical
  1831  
  1832  		ipAndMask := func(ipNet *net.IPNet) []byte {
  1833  			maskedIP := ipNet.IP.Mask(ipNet.Mask)
  1834  			ipAndMask := make([]byte, 0, len(maskedIP)+len(ipNet.Mask))
  1835  			ipAndMask = append(ipAndMask, maskedIP...)
  1836  			ipAndMask = append(ipAndMask, ipNet.Mask...)
  1837  			return ipAndMask
  1838  		}
  1839  
  1840  		serialiseConstraints := func(dns []string, ips []*net.IPNet, emails []string, uriDomains []string) (der []byte, err error) {
  1841  			var b cryptobyte.Builder
  1842  
  1843  			for _, name := range dns {
  1844  				if err = isIA5String(name); err != nil {
  1845  					return nil, err
  1846  				}
  1847  
  1848  				b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
  1849  					b.AddASN1(cryptobyte_asn1.Tag(2).ContextSpecific(), func(b *cryptobyte.Builder) {
  1850  						b.AddBytes([]byte(name))
  1851  					})
  1852  				})
  1853  			}
  1854  
  1855  			for _, ipNet := range ips {
  1856  				b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
  1857  					b.AddASN1(cryptobyte_asn1.Tag(7).ContextSpecific(), func(b *cryptobyte.Builder) {
  1858  						b.AddBytes(ipAndMask(ipNet))
  1859  					})
  1860  				})
  1861  			}
  1862  
  1863  			for _, email := range emails {
  1864  				if err = isIA5String(email); err != nil {
  1865  					return nil, err
  1866  				}
  1867  
  1868  				b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
  1869  					b.AddASN1(cryptobyte_asn1.Tag(1).ContextSpecific(), func(b *cryptobyte.Builder) {
  1870  						b.AddBytes([]byte(email))
  1871  					})
  1872  				})
  1873  			}
  1874  
  1875  			for _, uriDomain := range uriDomains {
  1876  				if err = isIA5String(uriDomain); err != nil {
  1877  					return nil, err
  1878  				}
  1879  
  1880  				b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
  1881  					b.AddASN1(cryptobyte_asn1.Tag(6).ContextSpecific(), func(b *cryptobyte.Builder) {
  1882  						b.AddBytes([]byte(uriDomain))
  1883  					})
  1884  				})
  1885  			}
  1886  
  1887  			return b.Bytes()
  1888  		}
  1889  
  1890  		permitted, err := serialiseConstraints(template.PermittedDNSDomains, template.PermittedIPRanges, template.PermittedEmailAddresses, template.PermittedURIDomains)
  1891  		if err != nil {
  1892  			return nil, err
  1893  		}
  1894  
  1895  		excluded, err := serialiseConstraints(template.ExcludedDNSDomains, template.ExcludedIPRanges, template.ExcludedEmailAddresses, template.ExcludedURIDomains)
  1896  		if err != nil {
  1897  			return nil, err
  1898  		}
  1899  
  1900  		var b cryptobyte.Builder
  1901  		b.AddASN1(cryptobyte_asn1.SEQUENCE, func(b *cryptobyte.Builder) {
  1902  			if len(permitted) > 0 {
  1903  				b.AddASN1(cryptobyte_asn1.Tag(0).ContextSpecific().Constructed(), func(b *cryptobyte.Builder) {
  1904  					b.AddBytes(permitted)
  1905  				})
  1906  			}
  1907  
  1908  			if len(excluded) > 0 {
  1909  				b.AddASN1(cryptobyte_asn1.Tag(1).ContextSpecific().Constructed(), func(b *cryptobyte.Builder) {
  1910  					b.AddBytes(excluded)
  1911  				})
  1912  			}
  1913  		})
  1914  
  1915  		ret[n].Value, err = b.Bytes()
  1916  		if err != nil {
  1917  			return nil, err
  1918  		}
  1919  		n++
  1920  	}
  1921  
  1922  	if len(template.CRLDistributionPoints) > 0 &&
  1923  		!oidInExtensions(oidExtensionCRLDistributionPoints, template.ExtraExtensions) {
  1924  		ret[n].Id = oidExtensionCRLDistributionPoints
  1925  
  1926  		var crlDp []distributionPoint
  1927  		for _, name := range template.CRLDistributionPoints {
  1928  			dp := distributionPoint{
  1929  				DistributionPoint: distributionPointName{
  1930  					FullName: []asn1.RawValue{
  1931  						{Tag: 6, Class: 2, Bytes: []byte(name)},
  1932  					},
  1933  				},
  1934  			}
  1935  			crlDp = append(crlDp, dp)
  1936  		}
  1937  
  1938  		ret[n].Value, err = asn1.Marshal(crlDp)
  1939  		if err != nil {
  1940  			return
  1941  		}
  1942  		n++
  1943  	}
  1944  
  1945  	// Adding another extension here? Remember to update the maximum number
  1946  	// of elements in the make() at the top of the function and the list of
  1947  	// template fields used in CreateCertificate documentation.
  1948  
  1949  	return append(ret[:n], template.ExtraExtensions...), nil
  1950  }
  1951  
  1952  func subjectBytes(cert *Certificate) ([]byte, error) {
  1953  	if len(cert.RawSubject) > 0 {
  1954  		return cert.RawSubject, nil
  1955  	}
  1956  
  1957  	return asn1.Marshal(cert.Subject.ToRDNSequence())
  1958  }
  1959  
  1960  // signingParamsForPublicKey returns the parameters to use for signing with
  1961  // priv. If requestedSigAlgo is not zero then it overrides the default
  1962  // signature algorithm.
  1963  func signingParamsForPublicKey(pub interface{}, requestedSigAlgo SignatureAlgorithm) (hashFunc crypto.Hash, sigAlgo pkix.AlgorithmIdentifier, err error) {
  1964  	var pubType PublicKeyAlgorithm
  1965  
  1966  	switch pub := pub.(type) {
  1967  	case *rsa.PublicKey:
  1968  		pubType = RSA
  1969  		hashFunc = crypto.SHA256
  1970  		sigAlgo.Algorithm = oidSignatureSHA256WithRSA
  1971  		sigAlgo.Parameters = asn1.NullRawValue
  1972  
  1973  	case *ecdsa.PublicKey:
  1974  		pubType = ECDSA
  1975  
  1976  		switch pub.Curve {
  1977  		case elliptic.P224(), elliptic.P256():
  1978  			hashFunc = crypto.SHA256
  1979  			sigAlgo.Algorithm = oidSignatureECDSAWithSHA256
  1980  		case elliptic.P384():
  1981  			hashFunc = crypto.SHA384
  1982  			sigAlgo.Algorithm = oidSignatureECDSAWithSHA384
  1983  		case elliptic.P521():
  1984  			hashFunc = crypto.SHA512
  1985  			sigAlgo.Algorithm = oidSignatureECDSAWithSHA512
  1986  		default:
  1987  			err = errors.New("x509: unknown elliptic curve")
  1988  		}
  1989  
  1990  	case ed25519.PublicKey:
  1991  		pubType = Ed25519
  1992  		sigAlgo.Algorithm = oidSignatureEd25519
  1993  
  1994  	default:
  1995  		err = errors.New("x509: only RSA, ECDSA and Ed25519 keys supported")
  1996  	}
  1997  
  1998  	if err != nil {
  1999  		return
  2000  	}
  2001  
  2002  	if requestedSigAlgo == 0 {
  2003  		return
  2004  	}
  2005  
  2006  	found := false
  2007  	for _, details := range signatureAlgorithmDetails {
  2008  		if details.algo == requestedSigAlgo {
  2009  			if details.pubKeyAlgo != pubType {
  2010  				err = errors.New("x509: requested SignatureAlgorithm does not match private key type")
  2011  				return
  2012  			}
  2013  			sigAlgo.Algorithm, hashFunc = details.oid, details.hash
  2014  			if hashFunc == 0 && pubType != Ed25519 {
  2015  				err = errors.New("x509: cannot sign with hash function requested")
  2016  				return
  2017  			}
  2018  			if requestedSigAlgo.isRSAPSS() {
  2019  				sigAlgo.Parameters = rsaPSSParameters(hashFunc)
  2020  			}
  2021  			found = true
  2022  			break
  2023  		}
  2024  	}
  2025  
  2026  	if !found {
  2027  		err = errors.New("x509: unknown SignatureAlgorithm")
  2028  	}
  2029  
  2030  	return
  2031  }
  2032  
  2033  // emptyASN1Subject is the ASN.1 DER encoding of an empty Subject, which is
  2034  // just an empty SEQUENCE.
  2035  var emptyASN1Subject = []byte{0x30, 0}
  2036  
  2037  // CreateCertificate creates a new X.509v3 certificate based on a template.
  2038  // The following members of template are used:
  2039  //
  2040  //  - AuthorityKeyId
  2041  //  - BasicConstraintsValid
  2042  //  - CRLDistributionPoints
  2043  //  - DNSNames
  2044  //  - EmailAddresses
  2045  //  - ExcludedDNSDomains
  2046  //  - ExcludedEmailAddresses
  2047  //  - ExcludedIPRanges
  2048  //  - ExcludedURIDomains
  2049  //  - ExtKeyUsage
  2050  //  - ExtraExtensions
  2051  //  - IPAddresses
  2052  //  - IsCA
  2053  //  - IssuingCertificateURL
  2054  //  - KeyUsage
  2055  //  - MaxPathLen
  2056  //  - MaxPathLenZero
  2057  //  - NotAfter
  2058  //  - NotBefore
  2059  //  - OCSPServer
  2060  //  - PermittedDNSDomains
  2061  //  - PermittedDNSDomainsCritical
  2062  //  - PermittedEmailAddresses
  2063  //  - PermittedIPRanges
  2064  //  - PermittedURIDomains
  2065  //  - PolicyIdentifiers
  2066  //  - SerialNumber
  2067  //  - SignatureAlgorithm
  2068  //  - Subject
  2069  //  - SubjectKeyId
  2070  //  - URIs
  2071  //  - UnknownExtKeyUsage
  2072  //
  2073  // The certificate is signed by parent. If parent is equal to template then the
  2074  // certificate is self-signed. The parameter pub is the public key of the
  2075  // signee and priv is the private key of the signer.
  2076  //
  2077  // The returned slice is the certificate in DER encoding.
  2078  //
  2079  // The currently supported key types are *rsa.PublicKey, *ecdsa.PublicKey and
  2080  // ed25519.PublicKey. pub must be a supported key type, and priv must be a
  2081  // crypto.Signer with a supported public key.
  2082  //
  2083  // The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
  2084  // unless the resulting certificate is self-signed. Otherwise the value from
  2085  // template will be used.
  2086  //
  2087  // If SubjectKeyId from template is empty and the template is a CA, SubjectKeyId
  2088  // will be generated from the hash of the public key.
  2089  func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) {
  2090  	key, ok := priv.(crypto.Signer)
  2091  	if !ok {
  2092  		return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
  2093  	}
  2094  
  2095  	if template.SerialNumber == nil {
  2096  		return nil, errors.New("x509: no SerialNumber given")
  2097  	}
  2098  
  2099  	if template.BasicConstraintsValid && !template.IsCA && template.MaxPathLen != -1 && (template.MaxPathLen != 0 || template.MaxPathLenZero) {
  2100  		return nil, errors.New("x509: only CAs are allowed to specify MaxPathLen")
  2101  	}
  2102  
  2103  	hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
  2104  	if err != nil {
  2105  		return nil, err
  2106  	}
  2107  
  2108  	publicKeyBytes, publicKeyAlgorithm, err := marshalPublicKey(pub)
  2109  	if err != nil {
  2110  		return nil, err
  2111  	}
  2112  
  2113  	asn1Issuer, err := subjectBytes(parent)
  2114  	if err != nil {
  2115  		return
  2116  	}
  2117  
  2118  	asn1Subject, err := subjectBytes(template)
  2119  	if err != nil {
  2120  		return
  2121  	}
  2122  
  2123  	authorityKeyId := template.AuthorityKeyId
  2124  	if !bytes.Equal(asn1Issuer, asn1Subject) && len(parent.SubjectKeyId) > 0 {
  2125  		authorityKeyId = parent.SubjectKeyId
  2126  	}
  2127  
  2128  	subjectKeyId := template.SubjectKeyId
  2129  	if len(subjectKeyId) == 0 && template.IsCA {
  2130  		// SubjectKeyId generated using method 1 in RFC 5280, Section 4.2.1.2:
  2131  		//   (1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
  2132  		//   value of the BIT STRING subjectPublicKey (excluding the tag,
  2133  		//   length, and number of unused bits).
  2134  		h := sha1.Sum(publicKeyBytes)
  2135  		subjectKeyId = h[:]
  2136  	}
  2137  
  2138  	extensions, err := buildExtensions(template, bytes.Equal(asn1Subject, emptyASN1Subject), authorityKeyId, subjectKeyId)
  2139  	if err != nil {
  2140  		return
  2141  	}
  2142  
  2143  	encodedPublicKey := asn1.BitString{BitLength: len(publicKeyBytes) * 8, Bytes: publicKeyBytes}
  2144  	c := tbsCertificate{
  2145  		Version:            2,
  2146  		SerialNumber:       template.SerialNumber,
  2147  		SignatureAlgorithm: signatureAlgorithm,
  2148  		Issuer:             asn1.RawValue{FullBytes: asn1Issuer},
  2149  		Validity:           validity{template.NotBefore.UTC(), template.NotAfter.UTC()},
  2150  		Subject:            asn1.RawValue{FullBytes: asn1Subject},
  2151  		PublicKey:          publicKeyInfo{nil, publicKeyAlgorithm, encodedPublicKey},
  2152  		Extensions:         extensions,
  2153  	}
  2154  
  2155  	tbsCertContents, err := asn1.Marshal(c)
  2156  	if err != nil {
  2157  		return
  2158  	}
  2159  	c.Raw = tbsCertContents
  2160  
  2161  	signed := tbsCertContents
  2162  	if hashFunc != 0 {
  2163  		h := hashFunc.New()
  2164  		h.Write(signed)
  2165  		signed = h.Sum(nil)
  2166  	}
  2167  
  2168  	var signerOpts crypto.SignerOpts = hashFunc
  2169  	if template.SignatureAlgorithm != 0 && template.SignatureAlgorithm.isRSAPSS() {
  2170  		signerOpts = &rsa.PSSOptions{
  2171  			SaltLength: rsa.PSSSaltLengthEqualsHash,
  2172  			Hash:       hashFunc,
  2173  		}
  2174  	}
  2175  
  2176  	var signature []byte
  2177  	signature, err = key.Sign(rand, signed, signerOpts)
  2178  	if err != nil {
  2179  		return
  2180  	}
  2181  
  2182  	return asn1.Marshal(certificate{
  2183  		nil,
  2184  		c,
  2185  		signatureAlgorithm,
  2186  		asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
  2187  	})
  2188  }
  2189  
  2190  // pemCRLPrefix is the magic string that indicates that we have a PEM encoded
  2191  // CRL.
  2192  var pemCRLPrefix = []byte("-----BEGIN X509 CRL")
  2193  
  2194  // pemType is the type of a PEM encoded CRL.
  2195  var pemType = "X509 CRL"
  2196  
  2197  // ParseCRL parses a CRL from the given bytes. It's often the case that PEM
  2198  // encoded CRLs will appear where they should be DER encoded, so this function
  2199  // will transparently handle PEM encoding as long as there isn't any leading
  2200  // garbage.
  2201  func ParseCRL(crlBytes []byte) (*pkix.CertificateList, error) {
  2202  	if bytes.HasPrefix(crlBytes, pemCRLPrefix) {
  2203  		block, _ := pem.Decode(crlBytes)
  2204  		if block != nil && block.Type == pemType {
  2205  			crlBytes = block.Bytes
  2206  		}
  2207  	}
  2208  	return ParseDERCRL(crlBytes)
  2209  }
  2210  
  2211  // ParseDERCRL parses a DER encoded CRL from the given bytes.
  2212  func ParseDERCRL(derBytes []byte) (*pkix.CertificateList, error) {
  2213  	certList := new(pkix.CertificateList)
  2214  	if rest, err := asn1.Unmarshal(derBytes, certList); err != nil {
  2215  		return nil, err
  2216  	} else if len(rest) != 0 {
  2217  		return nil, errors.New("x509: trailing data after CRL")
  2218  	}
  2219  	return certList, nil
  2220  }
  2221  
  2222  // CreateCRL returns a DER encoded CRL, signed by this Certificate, that
  2223  // contains the given list of revoked certificates.
  2224  //
  2225  // Note: this method does not generate an RFC 5280 conformant X.509 v2 CRL.
  2226  // To generate a standards compliant CRL, use CreateRevocationList instead.
  2227  func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts []pkix.RevokedCertificate, now, expiry time.Time) (crlBytes []byte, err error) {
  2228  	key, ok := priv.(crypto.Signer)
  2229  	if !ok {
  2230  		return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
  2231  	}
  2232  
  2233  	hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), 0)
  2234  	if err != nil {
  2235  		return nil, err
  2236  	}
  2237  
  2238  	// Force revocation times to UTC per RFC 5280.
  2239  	revokedCertsUTC := make([]pkix.RevokedCertificate, len(revokedCerts))
  2240  	for i, rc := range revokedCerts {
  2241  		rc.RevocationTime = rc.RevocationTime.UTC()
  2242  		revokedCertsUTC[i] = rc
  2243  	}
  2244  
  2245  	tbsCertList := pkix.TBSCertificateList{
  2246  		Version:             1,
  2247  		Signature:           signatureAlgorithm,
  2248  		Issuer:              c.Subject.ToRDNSequence(),
  2249  		ThisUpdate:          now.UTC(),
  2250  		NextUpdate:          expiry.UTC(),
  2251  		RevokedCertificates: revokedCertsUTC,
  2252  	}
  2253  
  2254  	// Authority Key Id
  2255  	if len(c.SubjectKeyId) > 0 {
  2256  		var aki pkix.Extension
  2257  		aki.Id = oidExtensionAuthorityKeyId
  2258  		aki.Value, err = asn1.Marshal(authKeyId{Id: c.SubjectKeyId})
  2259  		if err != nil {
  2260  			return
  2261  		}
  2262  		tbsCertList.Extensions = append(tbsCertList.Extensions, aki)
  2263  	}
  2264  
  2265  	tbsCertListContents, err := asn1.Marshal(tbsCertList)
  2266  	if err != nil {
  2267  		return
  2268  	}
  2269  
  2270  	signed := tbsCertListContents
  2271  	if hashFunc != 0 {
  2272  		h := hashFunc.New()
  2273  		h.Write(signed)
  2274  		signed = h.Sum(nil)
  2275  	}
  2276  
  2277  	var signature []byte
  2278  	signature, err = key.Sign(rand, signed, hashFunc)
  2279  	if err != nil {
  2280  		return
  2281  	}
  2282  
  2283  	return asn1.Marshal(pkix.CertificateList{
  2284  		TBSCertList:        tbsCertList,
  2285  		SignatureAlgorithm: signatureAlgorithm,
  2286  		SignatureValue:     asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
  2287  	})
  2288  }
  2289  
  2290  // CertificateRequest represents a PKCS #10, certificate signature request.
  2291  type CertificateRequest struct {
  2292  	Raw                      []byte // Complete ASN.1 DER content (CSR, signature algorithm and signature).
  2293  	RawTBSCertificateRequest []byte // Certificate request info part of raw ASN.1 DER content.
  2294  	RawSubjectPublicKeyInfo  []byte // DER encoded SubjectPublicKeyInfo.
  2295  	RawSubject               []byte // DER encoded Subject.
  2296  
  2297  	Version            int
  2298  	Signature          []byte
  2299  	SignatureAlgorithm SignatureAlgorithm
  2300  
  2301  	PublicKeyAlgorithm PublicKeyAlgorithm
  2302  	PublicKey          interface{}
  2303  
  2304  	Subject pkix.Name
  2305  
  2306  	// Attributes contains the CSR attributes that can parse as
  2307  	// pkix.AttributeTypeAndValueSET.
  2308  	//
  2309  	// Deprecated: Use Extensions and ExtraExtensions instead for parsing and
  2310  	// generating the requestedExtensions attribute.
  2311  	Attributes []pkix.AttributeTypeAndValueSET
  2312  
  2313  	// Extensions contains all requested extensions, in raw form. When parsing
  2314  	// CSRs, this can be used to extract extensions that are not parsed by this
  2315  	// package.
  2316  	Extensions []pkix.Extension
  2317  
  2318  	// ExtraExtensions contains extensions to be copied, raw, into any CSR
  2319  	// marshaled by CreateCertificateRequest. Values override any extensions
  2320  	// that would otherwise be produced based on the other fields but are
  2321  	// overridden by any extensions specified in Attributes.
  2322  	//
  2323  	// The ExtraExtensions field is not populated by ParseCertificateRequest,
  2324  	// see Extensions instead.
  2325  	ExtraExtensions []pkix.Extension
  2326  
  2327  	// Subject Alternate Name values.
  2328  	DNSNames       []string
  2329  	EmailAddresses []string
  2330  	IPAddresses    []net.IP
  2331  	URIs           []*url.URL
  2332  }
  2333  
  2334  // These structures reflect the ASN.1 structure of X.509 certificate
  2335  // signature requests (see RFC 2986):
  2336  
  2337  type tbsCertificateRequest struct {
  2338  	Raw           asn1.RawContent
  2339  	Version       int
  2340  	Subject       asn1.RawValue
  2341  	PublicKey     publicKeyInfo
  2342  	RawAttributes []asn1.RawValue `asn1:"tag:0"`
  2343  }
  2344  
  2345  type certificateRequest struct {
  2346  	Raw                asn1.RawContent
  2347  	TBSCSR             tbsCertificateRequest
  2348  	SignatureAlgorithm pkix.AlgorithmIdentifier
  2349  	SignatureValue     asn1.BitString
  2350  }
  2351  
  2352  // oidExtensionRequest is a PKCS #9 OBJECT IDENTIFIER that indicates requested
  2353  // extensions in a CSR.
  2354  var oidExtensionRequest = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 14}
  2355  
  2356  // newRawAttributes converts AttributeTypeAndValueSETs from a template
  2357  // CertificateRequest's Attributes into tbsCertificateRequest RawAttributes.
  2358  func newRawAttributes(attributes []pkix.AttributeTypeAndValueSET) ([]asn1.RawValue, error) {
  2359  	var rawAttributes []asn1.RawValue
  2360  	b, err := asn1.Marshal(attributes)
  2361  	if err != nil {
  2362  		return nil, err
  2363  	}
  2364  	rest, err := asn1.Unmarshal(b, &rawAttributes)
  2365  	if err != nil {
  2366  		return nil, err
  2367  	}
  2368  	if len(rest) != 0 {
  2369  		return nil, errors.New("x509: failed to unmarshal raw CSR Attributes")
  2370  	}
  2371  	return rawAttributes, nil
  2372  }
  2373  
  2374  // parseRawAttributes Unmarshals RawAttributes into AttributeTypeAndValueSETs.
  2375  func parseRawAttributes(rawAttributes []asn1.RawValue) []pkix.AttributeTypeAndValueSET {
  2376  	var attributes []pkix.AttributeTypeAndValueSET
  2377  	for _, rawAttr := range rawAttributes {
  2378  		var attr pkix.AttributeTypeAndValueSET
  2379  		rest, err := asn1.Unmarshal(rawAttr.FullBytes, &attr)
  2380  		// Ignore attributes that don't parse into pkix.AttributeTypeAndValueSET
  2381  		// (i.e.: challengePassword or unstructuredName).
  2382  		if err == nil && len(rest) == 0 {
  2383  			attributes = append(attributes, attr)
  2384  		}
  2385  	}
  2386  	return attributes
  2387  }
  2388  
  2389  // parseCSRExtensions parses the attributes from a CSR and extracts any
  2390  // requested extensions.
  2391  func parseCSRExtensions(rawAttributes []asn1.RawValue) ([]pkix.Extension, error) {
  2392  	// pkcs10Attribute reflects the Attribute structure from RFC 2986, Section 4.1.
  2393  	type pkcs10Attribute struct {
  2394  		Id     asn1.ObjectIdentifier
  2395  		Values []asn1.RawValue `asn1:"set"`
  2396  	}
  2397  
  2398  	var ret []pkix.Extension
  2399  	for _, rawAttr := range rawAttributes {
  2400  		var attr pkcs10Attribute
  2401  		if rest, err := asn1.Unmarshal(rawAttr.FullBytes, &attr); err != nil || len(rest) != 0 || len(attr.Values) == 0 {
  2402  			// Ignore attributes that don't parse.
  2403  			continue
  2404  		}
  2405  
  2406  		if !attr.Id.Equal(oidExtensionRequest) {
  2407  			continue
  2408  		}
  2409  
  2410  		var extensions []pkix.Extension
  2411  		if _, err := asn1.Unmarshal(attr.Values[0].FullBytes, &extensions); err != nil {
  2412  			return nil, err
  2413  		}
  2414  		ret = append(ret, extensions...)
  2415  	}
  2416  
  2417  	return ret, nil
  2418  }
  2419  
  2420  // CreateCertificateRequest creates a new certificate request based on a
  2421  // template. The following members of template are used:
  2422  //
  2423  //  - SignatureAlgorithm
  2424  //  - Subject
  2425  //  - DNSNames
  2426  //  - EmailAddresses
  2427  //  - IPAddresses
  2428  //  - URIs
  2429  //  - ExtraExtensions
  2430  //  - Attributes (deprecated)
  2431  //
  2432  // priv is the private key to sign the CSR with, and the corresponding public
  2433  // key will be included in the CSR. It must implement crypto.Signer and its
  2434  // Public() method must return a *rsa.PublicKey or a *ecdsa.PublicKey or a
  2435  // ed25519.PublicKey. (A *rsa.PrivateKey, *ecdsa.PrivateKey or
  2436  // ed25519.PrivateKey satisfies this.)
  2437  //
  2438  // The returned slice is the certificate request in DER encoding.
  2439  func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv interface{}) (csr []byte, err error) {
  2440  	key, ok := priv.(crypto.Signer)
  2441  	if !ok {
  2442  		return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
  2443  	}
  2444  
  2445  	var hashFunc crypto.Hash
  2446  	var sigAlgo pkix.AlgorithmIdentifier
  2447  	hashFunc, sigAlgo, err = signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
  2448  	if err != nil {
  2449  		return nil, err
  2450  	}
  2451  
  2452  	var publicKeyBytes []byte
  2453  	var publicKeyAlgorithm pkix.AlgorithmIdentifier
  2454  	publicKeyBytes, publicKeyAlgorithm, err = marshalPublicKey(key.Public())
  2455  	if err != nil {
  2456  		return nil, err
  2457  	}
  2458  
  2459  	var extensions []pkix.Extension
  2460  
  2461  	if (len(template.DNSNames) > 0 || len(template.EmailAddresses) > 0 || len(template.IPAddresses) > 0 || len(template.URIs) > 0) &&
  2462  		!oidInExtensions(oidExtensionSubjectAltName, template.ExtraExtensions) {
  2463  		sanBytes, err := marshalSANs(template.DNSNames, template.EmailAddresses, template.IPAddresses, template.URIs)
  2464  		if err != nil {
  2465  			return nil, err
  2466  		}
  2467  
  2468  		extensions = append(extensions, pkix.Extension{
  2469  			Id:    oidExtensionSubjectAltName,
  2470  			Value: sanBytes,
  2471  		})
  2472  	}
  2473  
  2474  	extensions = append(extensions, template.ExtraExtensions...)
  2475  
  2476  	// Make a copy of template.Attributes because we may alter it below.
  2477  	attributes := make([]pkix.AttributeTypeAndValueSET, 0, len(template.Attributes))
  2478  	for _, attr := range template.Attributes {
  2479  		values := make([][]pkix.AttributeTypeAndValue, len(attr.Value))
  2480  		copy(values, attr.Value)
  2481  		attributes = append(attributes, pkix.AttributeTypeAndValueSET{
  2482  			Type:  attr.Type,
  2483  			Value: values,
  2484  		})
  2485  	}
  2486  
  2487  	extensionsAppended := false
  2488  	if len(extensions) > 0 {
  2489  		// Append the extensions to an existing attribute if possible.
  2490  		for _, atvSet := range attributes {
  2491  			if !atvSet.Type.Equal(oidExtensionRequest) || len(atvSet.Value) == 0 {
  2492  				continue
  2493  			}
  2494  
  2495  			// specifiedExtensions contains all the extensions that we
  2496  			// found specified via template.Attributes.
  2497  			specifiedExtensions := make(map[string]bool)
  2498  
  2499  			for _, atvs := range atvSet.Value {
  2500  				for _, atv := range atvs {
  2501  					specifiedExtensions[atv.Type.String()] = true
  2502  				}
  2503  			}
  2504  
  2505  			newValue := make([]pkix.AttributeTypeAndValue, 0, len(atvSet.Value[0])+len(extensions))
  2506  			newValue = append(newValue, atvSet.Value[0]...)
  2507  
  2508  			for _, e := range extensions {
  2509  				if specifiedExtensions[e.Id.String()] {
  2510  					// Attributes already contained a value for
  2511  					// this extension and it takes priority.
  2512  					continue
  2513  				}
  2514  
  2515  				newValue = append(newValue, pkix.AttributeTypeAndValue{
  2516  					// There is no place for the critical
  2517  					// flag in an AttributeTypeAndValue.
  2518  					Type:  e.Id,
  2519  					Value: e.Value,
  2520  				})
  2521  			}
  2522  
  2523  			atvSet.Value[0] = newValue
  2524  			extensionsAppended = true
  2525  			break
  2526  		}
  2527  	}
  2528  
  2529  	rawAttributes, err := newRawAttributes(attributes)
  2530  	if err != nil {
  2531  		return
  2532  	}
  2533  
  2534  	// If not included in attributes, add a new attribute for the
  2535  	// extensions.
  2536  	if len(extensions) > 0 && !extensionsAppended {
  2537  		attr := struct {
  2538  			Type  asn1.ObjectIdentifier
  2539  			Value [][]pkix.Extension `asn1:"set"`
  2540  		}{
  2541  			Type:  oidExtensionRequest,
  2542  			Value: [][]pkix.Extension{extensions},
  2543  		}
  2544  
  2545  		b, err := asn1.Marshal(attr)
  2546  		if err != nil {
  2547  			return nil, errors.New("x509: failed to serialise extensions attribute: " + err.Error())
  2548  		}
  2549  
  2550  		var rawValue asn1.RawValue
  2551  		if _, err := asn1.Unmarshal(b, &rawValue); err != nil {
  2552  			return nil, err
  2553  		}
  2554  
  2555  		rawAttributes = append(rawAttributes, rawValue)
  2556  	}
  2557  
  2558  	asn1Subject := template.RawSubject
  2559  	if len(asn1Subject) == 0 {
  2560  		asn1Subject, err = asn1.Marshal(template.Subject.ToRDNSequence())
  2561  		if err != nil {
  2562  			return nil, err
  2563  		}
  2564  	}
  2565  
  2566  	tbsCSR := tbsCertificateRequest{
  2567  		Version: 0, // PKCS #10, RFC 2986
  2568  		Subject: asn1.RawValue{FullBytes: asn1Subject},
  2569  		PublicKey: publicKeyInfo{
  2570  			Algorithm: publicKeyAlgorithm,
  2571  			PublicKey: asn1.BitString{
  2572  				Bytes:     publicKeyBytes,
  2573  				BitLength: len(publicKeyBytes) * 8,
  2574  			},
  2575  		},
  2576  		RawAttributes: rawAttributes,
  2577  	}
  2578  
  2579  	tbsCSRContents, err := asn1.Marshal(tbsCSR)
  2580  	if err != nil {
  2581  		return
  2582  	}
  2583  	tbsCSR.Raw = tbsCSRContents
  2584  
  2585  	signed := tbsCSRContents
  2586  	if hashFunc != 0 {
  2587  		h := hashFunc.New()
  2588  		h.Write(signed)
  2589  		signed = h.Sum(nil)
  2590  	}
  2591  
  2592  	var signature []byte
  2593  	signature, err = key.Sign(rand, signed, hashFunc)
  2594  	if err != nil {
  2595  		return
  2596  	}
  2597  
  2598  	return asn1.Marshal(certificateRequest{
  2599  		TBSCSR:             tbsCSR,
  2600  		SignatureAlgorithm: sigAlgo,
  2601  		SignatureValue: asn1.BitString{
  2602  			Bytes:     signature,
  2603  			BitLength: len(signature) * 8,
  2604  		},
  2605  	})
  2606  }
  2607  
  2608  // ParseCertificateRequest parses a single certificate request from the
  2609  // given ASN.1 DER data.
  2610  func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error) {
  2611  	var csr certificateRequest
  2612  
  2613  	rest, err := asn1.Unmarshal(asn1Data, &csr)
  2614  	if err != nil {
  2615  		return nil, err
  2616  	} else if len(rest) != 0 {
  2617  		return nil, asn1.SyntaxError{Msg: "trailing data"}
  2618  	}
  2619  
  2620  	return parseCertificateRequest(&csr)
  2621  }
  2622  
  2623  func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error) {
  2624  	out := &CertificateRequest{
  2625  		Raw:                      in.Raw,
  2626  		RawTBSCertificateRequest: in.TBSCSR.Raw,
  2627  		RawSubjectPublicKeyInfo:  in.TBSCSR.PublicKey.Raw,
  2628  		RawSubject:               in.TBSCSR.Subject.FullBytes,
  2629  
  2630  		Signature:          in.SignatureValue.RightAlign(),
  2631  		SignatureAlgorithm: getSignatureAlgorithmFromAI(in.SignatureAlgorithm),
  2632  
  2633  		PublicKeyAlgorithm: getPublicKeyAlgorithmFromOID(in.TBSCSR.PublicKey.Algorithm.Algorithm),
  2634  
  2635  		Version:    in.TBSCSR.Version,
  2636  		Attributes: parseRawAttributes(in.TBSCSR.RawAttributes),
  2637  	}
  2638  
  2639  	var err error
  2640  	out.PublicKey, err = parsePublicKey(out.PublicKeyAlgorithm, &in.TBSCSR.PublicKey)
  2641  	if err != nil {
  2642  		return nil, err
  2643  	}
  2644  
  2645  	var subject pkix.RDNSequence
  2646  	if rest, err := asn1.Unmarshal(in.TBSCSR.Subject.FullBytes, &subject); err != nil {
  2647  		return nil, err
  2648  	} else if len(rest) != 0 {
  2649  		return nil, errors.New("x509: trailing data after X.509 Subject")
  2650  	}
  2651  
  2652  	out.Subject.FillFromRDNSequence(&subject)
  2653  
  2654  	if out.Extensions, err = parseCSRExtensions(in.TBSCSR.RawAttributes); err != nil {
  2655  		return nil, err
  2656  	}
  2657  
  2658  	for _, extension := range out.Extensions {
  2659  		if extension.Id.Equal(oidExtensionSubjectAltName) {
  2660  			out.DNSNames, out.EmailAddresses, out.IPAddresses, out.URIs, err = parseSANExtension(extension.Value)
  2661  			if err != nil {
  2662  				return nil, err
  2663  			}
  2664  		}
  2665  	}
  2666  
  2667  	return out, nil
  2668  }
  2669  
  2670  // CheckSignature reports whether the signature on c is valid.
  2671  func (c *CertificateRequest) CheckSignature() error {
  2672  	return checkSignature(c.SignatureAlgorithm, c.RawTBSCertificateRequest, c.Signature, c.PublicKey)
  2673  }
  2674  
  2675  // RevocationList contains the fields used to create an X.509 v2 Certificate
  2676  // Revocation list with CreateRevocationList.
  2677  type RevocationList struct {
  2678  	// SignatureAlgorithm is used to determine the signature algorithm to be
  2679  	// used when signing the CRL. If 0 the default algorithm for the signing
  2680  	// key will be used.
  2681  	SignatureAlgorithm SignatureAlgorithm
  2682  
  2683  	// RevokedCertificates is used to populate the revokedCertificates
  2684  	// sequence in the CRL, it may be empty. RevokedCertificates may be nil,
  2685  	// in which case an empty CRL will be created.
  2686  	RevokedCertificates []pkix.RevokedCertificate
  2687  
  2688  	// Number is used to populate the X.509 v2 cRLNumber extension in the CRL,
  2689  	// which should be a monotonically increasing sequence number for a given
  2690  	// CRL scope and CRL issuer.
  2691  	Number *big.Int
  2692  	// ThisUpdate is used to populate the thisUpdate field in the CRL, which
  2693  	// indicates the issuance date of the CRL.
  2694  	ThisUpdate time.Time
  2695  	// NextUpdate is used to populate the nextUpdate field in the CRL, which
  2696  	// indicates the date by which the next CRL will be issued. NextUpdate
  2697  	// must be greater than ThisUpdate.
  2698  	NextUpdate time.Time
  2699  	// ExtraExtensions contains any additional extensions to add directly to
  2700  	// the CRL.
  2701  	ExtraExtensions []pkix.Extension
  2702  }
  2703  
  2704  // CreateRevocationList creates a new X.509 v2 Certificate Revocation List,
  2705  // according to RFC 5280, based on template.
  2706  //
  2707  // The CRL is signed by priv which should be the private key associated with
  2708  // the public key in the issuer certificate.
  2709  //
  2710  // The issuer may not be nil, and the crlSign bit must be set in KeyUsage in
  2711  // order to use it as a CRL issuer.
  2712  //
  2713  // The issuer distinguished name CRL field and authority key identifier
  2714  // extension are populated using the issuer certificate. issuer must have
  2715  // SubjectKeyId set.
  2716  func CreateRevocationList(rand io.Reader, template *RevocationList, issuer *Certificate, priv crypto.Signer) ([]byte, error) {
  2717  	if template == nil {
  2718  		return nil, errors.New("x509: template can not be nil")
  2719  	}
  2720  	if issuer == nil {
  2721  		return nil, errors.New("x509: issuer can not be nil")
  2722  	}
  2723  	if (issuer.KeyUsage & KeyUsageCRLSign) == 0 {
  2724  		return nil, errors.New("x509: issuer must have the crlSign key usage bit set")
  2725  	}
  2726  	if len(issuer.SubjectKeyId) == 0 {
  2727  		return nil, errors.New("x509: issuer certificate doesn't contain a subject key identifier")
  2728  	}
  2729  	if template.NextUpdate.Before(template.ThisUpdate) {
  2730  		return nil, errors.New("x509: template.ThisUpdate is after template.NextUpdate")
  2731  	}
  2732  	if template.Number == nil {
  2733  		return nil, errors.New("x509: template contains nil Number field")
  2734  	}
  2735  
  2736  	hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(priv.Public(), template.SignatureAlgorithm)
  2737  	if err != nil {
  2738  		return nil, err
  2739  	}
  2740  
  2741  	// Force revocation times to UTC per RFC 5280.
  2742  	revokedCertsUTC := make([]pkix.RevokedCertificate, len(template.RevokedCertificates))
  2743  	for i, rc := range template.RevokedCertificates {
  2744  		rc.RevocationTime = rc.RevocationTime.UTC()
  2745  		revokedCertsUTC[i] = rc
  2746  	}
  2747  
  2748  	aki, err := asn1.Marshal(authKeyId{Id: issuer.SubjectKeyId})
  2749  	if err != nil {
  2750  		return nil, err
  2751  	}
  2752  	crlNum, err := asn1.Marshal(template.Number)
  2753  	if err != nil {
  2754  		return nil, err
  2755  	}
  2756  
  2757  	tbsCertList := pkix.TBSCertificateList{
  2758  		Version:    1, // v2
  2759  		Signature:  signatureAlgorithm,
  2760  		Issuer:     issuer.Subject.ToRDNSequence(),
  2761  		ThisUpdate: template.ThisUpdate.UTC(),
  2762  		NextUpdate: template.NextUpdate.UTC(),
  2763  		Extensions: []pkix.Extension{
  2764  			{
  2765  				Id:    oidExtensionAuthorityKeyId,
  2766  				Value: aki,
  2767  			},
  2768  			{
  2769  				Id:    oidExtensionCRLNumber,
  2770  				Value: crlNum,
  2771  			},
  2772  		},
  2773  	}
  2774  	if len(revokedCertsUTC) > 0 {
  2775  		tbsCertList.RevokedCertificates = revokedCertsUTC
  2776  	}
  2777  
  2778  	if len(template.ExtraExtensions) > 0 {
  2779  		tbsCertList.Extensions = append(tbsCertList.Extensions, template.ExtraExtensions...)
  2780  	}
  2781  
  2782  	tbsCertListContents, err := asn1.Marshal(tbsCertList)
  2783  	if err != nil {
  2784  		return nil, err
  2785  	}
  2786  
  2787  	input := tbsCertListContents
  2788  	if hashFunc != 0 {
  2789  		h := hashFunc.New()
  2790  		h.Write(tbsCertListContents)
  2791  		input = h.Sum(nil)
  2792  	}
  2793  	var signerOpts crypto.SignerOpts = hashFunc
  2794  	if template.SignatureAlgorithm.isRSAPSS() {
  2795  		signerOpts = &rsa.PSSOptions{
  2796  			SaltLength: rsa.PSSSaltLengthEqualsHash,
  2797  			Hash:       hashFunc,
  2798  		}
  2799  	}
  2800  
  2801  	signature, err := priv.Sign(rand, input, signerOpts)
  2802  	if err != nil {
  2803  		return nil, err
  2804  	}
  2805  
  2806  	return asn1.Marshal(pkix.CertificateList{
  2807  		TBSCertList:        tbsCertList,
  2808  		SignatureAlgorithm: signatureAlgorithm,
  2809  		SignatureValue:     asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
  2810  	})
  2811  }
  2812  

View as plain text