ObjOpenSSL  Check-in [b53c1ba1a8]

Overview
Comment:Add methods for easier certificate verification
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: b53c1ba1a81041c7c4b4a32fbb01ee84ac173e49596579e17bfe6837182dda4c
User & Date: florob@babelmonkeys.de on 2011-11-01 15:09:29
Other Links: manifest | tags
Context
2011-11-02
00:25
Implement -description for X509Certificate check-in: 84117b853b user: florob@babelmonkeys.de tags: trunk
2011-11-01
15:09
Add methods for easier certificate verification check-in: b53c1ba1a8 user: florob@babelmonkeys.de tags: trunk
14:36
Cache subject, issuer and SANs check-in: e100eb1e52 user: florob@babelmonkeys.de tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified src/X509Certificate.h from [685333962c] to [89a75a3894].

︙
51
52
53
54
55
56
57






58
59
60

61

51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

66
67








+
+
+
+
+
+


-
+


#endif

- initWithFile: (OFString*)file;
- initWithX509Struct: (X509*)cert;
- (OFDictionary*)issuer;
- (OFDictionary*)subject;
- (OFDictionary*)subjectAlternativeName;
- (BOOL)hasCommonNameMatchingDomain: (OFString*)domain;
- (BOOL)hasDNSNameMatchingDomain: (OFString*)domain;
- (BOOL)hasSRVNameMatchingDomain: (OFString*)domain
			 service: (OFString*)service;
- (BOOL)X509_isAssertedDomain: (OFString*)asserted
		  equalDomain: (OFString*)domain;
- (OFDictionary*)X509_dictionaryFromX509Name: (X509_NAME*)name;
- (OFString*)X509_stringFromASN1Object: (ASN1_OBJECT*)obj;
- (OFString*) X509_stringFromASN1String: (ASN1_STRING*)str;
- (OFString*)X509_stringFromASN1String: (ASN1_STRING*)str;
@end

Modified src/X509Certificate.m from [19eeb8fa7d] to [c571703a37].

︙
236
237
238
239
240
241
242






































































































243
244
245
246
247
248
249

236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351








+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+









	[ret makeImmutable];
	[ret retain];
	[pool release];

	return (subjectAlternativeName = ret);
}

- (BOOL)hasCommonNameMatchingDomain: (OFString*)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFList *CNs = [[self subject] objectForKey: OID_commonName];

	for (name in CNs) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return YES;
		}
	}

	[pool release];
	return NO;
}

- (BOOL)hasDNSNameMatchingDomain: (OFString*)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [SANs objectForKey: @"dNSName"];

	for (name in assertedNames) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return YES;
		}
	}

	[pool release];
	return NO;
}

- (BOOL)hasSRVNameMatchingDomain: (OFString*)domain
			 service: (OFString*)service
{
	size_t serviceLength;
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [[SANs objectForKey: @"otherName"]
				     objectForKey: OID_SRVName];

	if (![service hasPrefix: @"_"])
		service = [service stringByPrependingString: @"_"];

	service = [service stringByAppendingString: @"."];
	serviceLength = [service length];

	for (name in assertedNames) {
		if ([name hasPrefix: service]) {
			OFString *asserted;
			asserted = [name substringWithRange:
				of_range(serviceLength,
					[name length] - serviceLength)];
			if ([self X509_isAssertedDomain: asserted
					    equalDomain: domain]) {
				[pool release];
				return YES;
			}
		}
	}

	[pool release];
	return NO;
}

- (BOOL) X509_isAssertedDomain: (OFString*)asserted
		   equalDomain: (OFString*)domain
{
	/*
	 * In accordance with RFC 6125 this only allows a wildcard as the
	 * left-most label and matches only the left-most label with it.
	 * E.g. *.example.com matches foo.example.com,
	 * but not foo.bar.example.com
	 */
	size_t firstDot;
	if (![asserted caseInsensitiveCompare: domain])
		return YES;

	if (![asserted hasPrefix: @"*."])
		return NO;

	asserted = [asserted substringWithRange: of_range(2,
			[asserted length] - 2)];

	firstDot = [domain indexOfFirstOccurrenceOfString: @"."];
	if (firstDot == OF_INVALID_INDEX)
		return NO;
	domain = [domain substringWithRange: of_range(firstDot + 1,
			[domain length] - firstDot - 1)];

	if (![asserted caseInsensitiveCompare: domain])
		return YES;

	return NO;
}

- (OFDictionary*)X509_dictionaryFromX509Name: (X509_NAME*)name
{
	int i;
	int count = X509_NAME_entry_count(name);
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFMutableDictionary *dict = [OFMutableDictionary dictionary];
︙