X-Git-Url: https://main.carlh.net/gitweb/?a=blobdiff_plain;f=src%2Fcertificate_chain.cc;h=2fb0f651bb07ad8aa626ebffb11c66c30a7da8e4;hb=a6e9959aeceb10001d3a1f8c62b00132cfec7c54;hp=0e032a851d17a7ad820f2c36fb591074f28bf471;hpb=d630b7b1e1c77742ff131a7d0c9497f061f87142;p=libdcp.git diff --git a/src/certificate_chain.cc b/src/certificate_chain.cc index 0e032a85..2fb0f651 100644 --- a/src/certificate_chain.cc +++ b/src/certificate_chain.cc @@ -186,6 +186,9 @@ CertificateChain::CertificateChain ( string leaf_common_name ) { + /* Valid for 40 years */ + int const days = 365 * 40; + boost::filesystem::path directory = boost::filesystem::temp_directory_path() / boost::filesystem::unique_path (); boost::filesystem::create_directories (directory); @@ -221,9 +224,9 @@ CertificateChain::CertificateChain ( { command ( String::compose ( - "%1 req -new -x509 -sha256 -config ca.cnf -days 3650 -set_serial 5" - " -subj \"%2\" -key ca.key -outform PEM -out ca.self-signed.pem", - quoted_openssl, ca_subject + "%1 req -new -x509 -sha256 -config ca.cnf -days %2 -set_serial 5" + " -subj \"%3\" -key ca.key -outform PEM -out ca.self-signed.pem", + quoted_openssl, days, ca_subject ) ); } @@ -255,16 +258,18 @@ CertificateChain::CertificateChain ( { command ( String::compose ( - "%1 req -new -config intermediate.cnf -days 3649 -subj \"%2\" -key intermediate.key -out intermediate.csr", - quoted_openssl, inter_subject + "%1 req -new -config intermediate.cnf -days %2 -subj \"%3\" -key intermediate.key -out intermediate.csr", + quoted_openssl, days - 1, inter_subject ) ); } command ( - quoted_openssl + - " x509 -req -sha256 -days 3649 -CA ca.self-signed.pem -CAkey ca.key -set_serial 6" - " -in intermediate.csr -extfile intermediate.cnf -extensions v3_ca -out intermediate.signed.pem" + String::compose ( + "%1 x509 -req -sha256 -days %2 -CA ca.self-signed.pem -CAkey ca.key -set_serial 6" + " -in intermediate.csr -extfile intermediate.cnf -extensions v3_ca -out intermediate.signed.pem", + quoted_openssl, days - 1 + ) ); command (quoted_openssl + " genrsa -out leaf.key 2048"); @@ -294,16 +299,18 @@ CertificateChain::CertificateChain ( { command ( String::compose ( - "%1 req -new -config leaf.cnf -days 3648 -subj \"%2\" -key leaf.key -outform PEM -out leaf.csr", - quoted_openssl, leaf_subject + "%1 req -new -config leaf.cnf -days %2 -subj \"%3\" -key leaf.key -outform PEM -out leaf.csr", + quoted_openssl, days - 2, leaf_subject ) ); } command ( - quoted_openssl + - " x509 -req -sha256 -days 3648 -CA intermediate.signed.pem -CAkey intermediate.key" - " -set_serial 7 -in leaf.csr -extfile leaf.cnf -extensions v3_ca -out leaf.signed.pem" + String::compose ( + "%1 x509 -req -sha256 -days %2 -CA intermediate.signed.pem -CAkey intermediate.key" + " -set_serial 7 -in leaf.csr -extfile leaf.cnf -extensions v3_ca -out leaf.signed.pem", + quoted_openssl, days - 2 + ) ); boost::filesystem::current_path (cwd); @@ -464,10 +471,11 @@ CertificateChain::chain_valid (List const & chain) const return false; } - /* I don't know why OpenSSL doesn't check this in verify_cert, but without this check - the certificates_validation8 test fails. + /* I don't know why OpenSSL doesn't check this stuff + in verify_cert, but without these checks the + certificates_validation8 test fails. */ - if (j->issuer() != i->subject()) { + if (j->issuer() != i->subject() || j->subject() == i->subject()) { X509_STORE_free (store); return false; } @@ -499,6 +507,10 @@ CertificateChain::private_key_valid () const } RSA* private_key = PEM_read_bio_RSAPrivateKey (bio, 0, 0, 0); + if (!private_key) { + return false; + } + RSA* public_key = leaf().public_key (); #if OPENSSL_VERSION_NUMBER > 0x10100000L @@ -506,6 +518,9 @@ CertificateChain::private_key_valid () const RSA_get0_key(private_key, &private_key_n, 0, 0); BIGNUM const * public_key_n; RSA_get0_key(public_key, &public_key_n, 0, 0); + if (!private_key_n || !public_key_n) { + return false; + } bool const valid = !BN_cmp (private_key_n, public_key_n); #else bool const valid = !BN_cmp (private_key->n, public_key->n); @@ -561,6 +576,7 @@ CertificateChain::sign (xmlpp::Element* parent, Standard standard) const { /* */ + parent->add_child_text(" "); xmlpp::Element* signer = parent->add_child("Signer"); signer->set_namespace_declaration ("http://www.w3.org/2000/09/xmldsig#", "dsig"); xmlpp::Element* data = signer->add_child("X509Data", "dsig"); @@ -569,11 +585,15 @@ CertificateChain::sign (xmlpp::Element* parent, Standard standard) const serial_element->add_child("X509SerialNumber", "dsig")->add_child_text (leaf().serial()); data->add_child("X509SubjectName", "dsig")->add_child_text (leaf().subject()); + indent (signer, 2); + /* */ + parent->add_child_text("\n "); xmlpp::Element* signature = parent->add_child("Signature"); signature->set_namespace_declaration ("http://www.w3.org/2000/09/xmldsig#", "dsig"); signature->set_namespace ("dsig"); + parent->add_child_text("\n"); xmlpp::Element* signed_info = signature->add_child ("SignedInfo", "dsig"); signed_info->add_child("CanonicalizationMethod", "dsig")->set_attribute ("Algorithm", "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"); @@ -598,7 +618,7 @@ CertificateChain::sign (xmlpp::Element* parent, Standard standard) const signature->add_child("SignatureValue", "dsig"); signature->add_child("KeyInfo", "dsig"); - add_signature_value (signature, "dsig"); + add_signature_value (signature, "dsig", true); } @@ -608,7 +628,7 @@ CertificateChain::sign (xmlpp::Element* parent, Standard standard) const * @param ns Namespace to use for the signature XML nodes. */ void -CertificateChain::add_signature_value (xmlpp::Node* parent, string ns) const +CertificateChain::add_signature_value (xmlpp::Element* parent, string ns, bool add_indentation) const { cxml::Node cp (parent); xmlpp::Node* key_info = cp.node_child("KeyInfo")->node (); @@ -639,11 +659,9 @@ CertificateChain::add_signature_value (xmlpp::Node* parent, string ns) const throw runtime_error ("could not read private key"); } - /* XXX: set key name to the PEM string: this can't be right! */ - if (xmlSecKeySetName (signature_context->signKey, reinterpret_cast (_key->c_str())) < 0) { - throw MiscError ("could not set key name"); + if (add_indentation) { + indent (parent, 2); } - int const r = xmlSecDSigCtxSign (signature_context, parent->cobj ()); if (r < 0) { throw MiscError (String::compose ("could not sign (%1)", r));