42 #include <glib/gstdio.h>
43 #include <gnutls/gnutls.h>
44 #include <gnutls/x509.h>
45 #include <gvm/base/logging.h>
56 #define G_LOG_DOMAIN "lib nasl"
59 #define DIM(v) (sizeof (v) / sizeof ((v)[0]))
60 #define DIMof(type, member) DIM (((type *) 0)->member)
64 #define spacep(p) (*(p) == ' ' || *(p) == '\t')
65 #define digitp(p) (*(p) >= '0' && *(p) <= '9')
66 #define hexdigitp(a) \
67 (digitp (a) || (*(a) >= 'A' && *(a) <= 'F') || (*(a) >= 'a' && *(a) <= 'f'))
70 #define atoi_1(p) (*(p) - '0')
71 #define atoi_2(p) ((atoi_1 (p) * 10) + atoi_1 ((p) + 1))
72 #define atoi_4(p) ((atoi_2 (p) * 100) + atoi_2 ((p) + 2))
74 (*(p) <= '9' ? (*(p) - '0') \
75 : *(p) <= 'F' ? (*(p) - 'A' + 10) : (*(p) - 'a' + 10))
77 ((xtoi_1 ((const unsigned char *) (p)) * 16) \
78 + xtoi_1 ((const unsigned char *) (p) + 1))
81 #define tohex(n) ((n) < 10 ? ((n) + '0') : (((n) -10) + 'A'))
98 typedef struct object_desc_s *object_desc_t;
107 static object_desc_t object_list;
111 next_object_id (
void)
136 for (obj = object_list; obj; obj = obj->next)
137 if (obj->object_id == last)
178 ksba_reader_t reader;
185 g_message (
"No certificate passed to cert_open");
189 err = ksba_reader_new (&reader);
192 g_message (
"Opening reader object failed: %s", gpg_strerror (err));
195 err = ksba_reader_set_mem (reader, data, datalen);
198 g_message (
"ksba_reader_set_mem failed: %s", gpg_strerror (err));
199 ksba_reader_release (reader);
203 err = ksba_cert_new (&cert);
206 g_message (
"ksba_cert_new failed: %s", gpg_strerror (err));
207 ksba_reader_release (reader);
211 err = ksba_cert_read_der (cert, reader);
214 g_message (
"Certificate parsing failed: %s", gpg_strerror (err));
216 ksba_reader_release (reader);
217 ksba_cert_release (cert);
220 ksba_reader_release (reader);
222 obj = g_try_malloc (
sizeof *obj);
225 g_message (
"malloc failed in %s", __FUNCTION__);
226 ksba_cert_release (cert);
229 obj->object_id = next_object_id ();
231 obj->next = object_list;
236 retc->
x.
i_val = obj->object_id;
261 object_desc_t prevobj, obj;
268 g_message (
"Bad object id %d passed to cert_close", object_id);
272 for (prevobj = NULL, obj = object_list; obj; prevobj = obj, obj = obj->next)
273 if (obj->object_id == object_id)
277 g_message (
"Unused object id %d passed to cert_close", object_id);
282 prevobj->next = obj->next;
284 object_list = obj->next;
286 ksba_cert_release (obj->cert);
294 parse_dn_part_for_CN (
const char *
string,
char **r_value)
304 for (s =
string + 1; *s && *s !=
'='; s++)
312 found = (n == 2 &&
string[0] ==
'C' &&
string[1] ==
'N');
318 for (s =
string; hexdigitp (s); s++)
325 *r_value = p = g_malloc0 (n + 1);
327 for (s1 =
string; n; s1 += 2, n--, p++)
331 *(
unsigned char *) p = xtoi_2 (s1);
342 for (n = 0, s =
string; *s; s++)
347 if (*s ==
',' || *s ==
'=' || *s ==
'+' || *s ==
'<' || *s ==
'>'
348 || *s ==
'#' || *s ==
';' || *s ==
'\\' || *s ==
'\"'
351 else if (hexdigitp (s) && hexdigitp (s + 1))
361 else if (*s ==
',' || *s ==
'=' || *s ==
'+' || *s ==
'<' || *s ==
'>'
369 *r_value = p = g_malloc0 (n + 1);
371 for (s =
string; n; s++, n--)
380 *(
unsigned char *) p = xtoi_2 (s);
406 parse_dn_for_CN (
const char *
string)
410 while (*
string && !value)
412 while (*
string ==
' ')
416 string = parse_dn_part_for_CN (
string, &value);
419 while (*
string ==
' ')
421 if (*
string && *
string !=
',' && *
string !=
';' && *
string !=
'+')
438 build_hostname_list (ksba_cert_t cert)
447 name = ksba_cert_get_subject (cert, 0);
452 retc->
x.
ref_val = a = g_malloc0 (
sizeof *a);
455 value = parse_dn_for_CN (
name);
461 memset (&v, 0,
sizeof v);
470 for (idx = 1; (
name = ksba_cert_get_subject (cert, idx)); idx++)
476 && !memcmp (
name + 3,
"dns-name", 8))
479 unsigned long n = strtoul (
name + 11, &endp, 10);
487 memset (&v, 0,
sizeof v);
504 make_hexstring (
const void *buffer,
size_t length)
506 const unsigned char *s;
511 retc->
size = length * 2;
512 retc->
x.
str_val = p = g_malloc0 (length * 2 + 1);
514 for (s = buffer; length; length--, s++)
516 *p++ = tohex ((*s >> 4) & 15);
517 *p++ = tohex (*s & 15);
534 get_fingerprint (ksba_cert_t cert,
int algo)
537 const unsigned char *der;
539 unsigned char digest[32];
541 dlen = gcry_md_get_algo_dlen (algo);
542 if (dlen != 20 && dlen != 32)
545 der = ksba_cert_get_image (cert, &derlen);
548 gcry_md_hash_buffer (algo, digest, der, derlen);
550 return make_hexstring (digest, dlen);
561 get_oid_name (
const char *
oid)
564 if (!strcmp (
"1.2.840.10040.4.1",
oid))
566 else if (!strcmp (
"1.2.840.10046.2.1",
oid))
567 return "dhpublicnumber";
568 else if (!strcmp (
"2.16.840.1.101.2.1.1.22",
oid))
569 return "id-keyExchangeAlgorithm";
570 else if (!strcmp (
"1.2.840.10045.2.1",
oid))
571 return "id-ecPublicKey";
572 else if (!strcmp (
"1.3.132.1.12",
oid))
574 else if (!strcmp (
"1.2.840.10045.2.13",
oid))
576 else if (!strcmp (
"1.2.840.113549.1.1.10",
oid))
577 return "id-RSASSA-PSS";
578 else if (!strcmp (
"1.2.840.113549.1.1.11",
oid))
579 return "sha256WithRSAEncryption";
580 else if (!strcmp (
"1.2.840.113549.1.1.12",
oid))
581 return "sha384WithRSAEncryption";
582 else if (!strcmp (
"1.2.840.113549.1.1.13",
oid))
583 return "sha512WithRSAEncryption";
584 else if (!strcmp (
"1.2.840.113549.1.1.14",
oid))
585 return "sha224WithRSAEncryption";
586 else if (!strcmp (
"1.2.840.113549.1.1.8",
oid))
588 else if (!strcmp (
"1.2.840.113549.2.2",
oid))
590 else if (!strcmp (
"1.2.840.113549.2.4",
oid))
592 else if (!strcmp (
"1.2.840.113549.2.5",
oid))
594 else if (!strcmp (
"1.2.840.113549.1.1.1",
oid))
595 return "rsaEncryption";
596 else if (!strcmp (
"1.2.840.113549.1.1.2",
oid))
597 return "md2WithRSAEncryption";
598 else if (!strcmp (
"1.2.840.113549.1.1.3",
oid))
599 return "md4WithRSAEncryption";
600 else if (!strcmp (
"1.2.840.113549.1.1.4",
oid))
601 return "md5WithRSAEncryption";
602 else if (!strcmp (
"1.2.840.113549.1.1.5",
oid))
603 return "sha1WithRSAEncryption";
604 else if (!strcmp (
"1.2.840.113549.1.1.6",
oid))
605 return "rsaOAEPEncryptionSET";
606 else if (!strcmp (
"1.2.840.10045.3.1.1",
oid))
608 else if (!strcmp (
"1.3.132.0.1",
oid))
610 else if (!strcmp (
"1.3.132.0.15",
oid))
612 else if (!strcmp (
"1.3.132.0.33",
oid))
614 else if (!strcmp (
"1.3.132.0.26",
oid))
616 else if (!strcmp (
"1.3.132.0.27",
oid))
618 else if (!strcmp (
"1.2.840.10045.3.1.7",
oid))
620 else if (!strcmp (
"1.3.132.0.16",
oid))
622 else if (!strcmp (
"1.3.132.0.17",
oid))
624 else if (!strcmp (
"1.3.132.0.34",
oid))
626 else if (!strcmp (
"1.3.132.0.36",
oid))
628 else if (!strcmp (
"1.3.132.0.37",
oid))
630 else if (!strcmp (
"1.3.132.0.35",
oid))
632 else if (!strcmp (
"1.3.132.0.38",
oid))
634 else if (!strcmp (
"1.3.132.0.39",
oid))
647 get_name (
const char *
string)
659 len = gcry_sexp_canon_len ((
const unsigned char *)
string, 0, NULL, NULL);
660 if (gcry_sexp_sscan (&sexp, NULL,
string, len))
662 len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, NULL, 0);
665 buffer = g_malloc0 (len);
666 len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, buffer, len);
669 len = strlen (buffer);
671 if (len && buffer[len - 1] ==
'\n')
673 gcry_sexp_release (sexp);
683 retc->
x.
str_val = g_strdup (
string);
765 ksba_isotime_t isotime;
772 g_message (
"Bad object id %d passed to cert_query", object_id);
776 for (obj = object_list; obj; obj = obj->next)
777 if (obj->object_id == object_id)
781 g_message (
"Unused object id %d passed to cert_query", object_id);
789 g_message (
"No proper command passed to cert_query");
798 if (!strcmp (command,
"serial"))
800 const unsigned char *s;
804 sexp = ksba_cert_get_serial (obj->cert);
809 n = strtoul ((
const char *) s, &endp, 10);
810 s = (
const unsigned char *) endp;
814 retc = make_hexstring (s, n);
818 else if (!strcmp (command,
"issuer"))
820 result = ksba_cert_get_issuer (obj->cert, cmdidx);
824 retc = get_name (result);
827 else if (!strcmp (command,
"subject"))
829 result = ksba_cert_get_subject (obj->cert, cmdidx);
833 retc = get_name (result);
836 else if (!strcmp (command,
"not-before"))
838 ksba_cert_get_validity (obj->cert, 0, isotime);
840 retc->
x.
str_val = g_strdup (isotime);
841 retc->
size = strlen (isotime);
843 else if (!strcmp (command,
"not-after"))
845 ksba_cert_get_validity (obj->cert, 1, isotime);
847 retc->
x.
str_val = g_strdup (isotime);
848 retc->
size = strlen (isotime);
850 else if (!strcmp (command,
"fpr-sha-256"))
852 retc = get_fingerprint (obj->cert, GCRY_MD_SHA256);
854 else if (!strcmp (command,
"fpr-sha-1"))
856 retc = get_fingerprint (obj->cert, GCRY_MD_SHA1);
858 else if (!strcmp (command,
"all"))
862 else if (!strcmp (command,
"hostnames"))
864 retc = build_hostname_list (obj->cert);
866 else if (!strcmp (command,
"image"))
868 const unsigned char *der;
871 der = ksba_cert_get_image (obj->cert, &derlen);
876 retc->
x.
str_val = g_malloc0 (derlen);
877 memcpy (retc->
x.
str_val, der, derlen);
880 else if (!strcmp (command,
"algorithm-name"))
882 const char *digest = ksba_cert_get_digest_algo (obj->cert);
885 const char *
name = get_oid_name (digest);
893 else if (!strcmp (command,
"modulus"))
895 gnutls_datum_t datum, m, e;
896 gnutls_x509_crt_t cert = NULL;
899 (
void *) ksba_cert_get_image (obj->cert, (
size_t *) &datum.size);
902 if (gnutls_x509_crt_init (&cert) != GNUTLS_E_SUCCESS)
904 if (gnutls_x509_crt_import (cert, &datum, GNUTLS_X509_FMT_DER)
907 if (gnutls_x509_crt_get_pk_rsa_raw (cert, &m, &e) != GNUTLS_E_SUCCESS)
912 retc->
x.
str_val = g_memdup (m.data, m.size);
913 gnutls_free (m.data);
914 gnutls_free (e.data);
915 gnutls_x509_crt_deinit (cert);
917 else if (!strcmp (command,
"exponent"))
919 gnutls_datum_t datum, m, e;
920 gnutls_x509_crt_t cert = NULL;
923 (
void *) ksba_cert_get_image (obj->cert, (
size_t *) &datum.size);
926 if (gnutls_x509_crt_init (&cert) != GNUTLS_E_SUCCESS)
928 if (gnutls_x509_crt_import (cert, &datum, GNUTLS_X509_FMT_DER)
931 if (gnutls_x509_crt_get_pk_rsa_raw (cert, &m, &e) != GNUTLS_E_SUCCESS)
936 retc->
x.
str_val = g_memdup (e.data, e.size);
937 gnutls_free (m.data);
938 gnutls_free (e.data);
939 gnutls_x509_crt_deinit (cert);
941 else if (!strcmp (command,
"key-size"))
943 gnutls_datum_t datum;
944 gnutls_x509_crt_t cert = NULL;
945 unsigned int bits = 0;
948 (
void *) ksba_cert_get_image (obj->cert, (
size_t *) &datum.size);
951 if (gnutls_x509_crt_init (&cert) != GNUTLS_E_SUCCESS)
953 if (gnutls_x509_crt_import (cert, &datum, GNUTLS_X509_FMT_DER)
956 gnutls_x509_crt_get_pk_algorithm (cert, &bits);
957 gnutls_free (datum.data);
958 gnutls_x509_crt_deinit (cert);
965 g_message (
"Unknown command '%s' passed to cert_query", command);