C++ i2d_X509_NAME函数代码示例

int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
{
    int ret;

    /* Ensure canonical encoding is present and up to date */

    if (!a->canon_enc || a->modified) {
        ret = i2d_X509_NAME((X509_NAME *)a, NULL);
        if (ret < 0)
            return -2;
    }

    if (!b->canon_enc || b->modified) {
        ret = i2d_X509_NAME((X509_NAME *)b, NULL);
        if (ret < 0)
            return -2;
    }

    ret = a->canon_enclen - b->canon_enclen;

    if (ret)
        return ret;

    return memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);

}

int X509_ocspid_print(BIO *bp, X509 *x)
{
    unsigned char *der = NULL;
    unsigned char *dertmp;
    int derlen;
    int i;
    unsigned char SHA1md[SHA_DIGEST_LENGTH];
    ASN1_BIT_STRING *keybstr;
    X509_NAME *subj;

    /*
     * display the hash of the subject as it would appear in OCSP requests
     */
    if (BIO_printf(bp, "        Subject OCSP hash: ") <= 0)
        goto err;
    subj = X509_get_subject_name(x);
    derlen = i2d_X509_NAME(subj, NULL);
    if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL)
        goto err;
    i2d_X509_NAME(subj, &dertmp);

    if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL))
        goto err;
    for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
        if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
            goto err;
    }
    OPENSSL_free(der);
    der = NULL;

    /*
     * display the hash of the public key as it would appear in OCSP requests
     */
    if (BIO_printf(bp, "\n        Public key OCSP hash: ") <= 0)
        goto err;

    keybstr = X509_get0_pubkey_bitstr(x);

    if (keybstr == NULL)
        goto err;

    if (!EVP_Digest(ASN1_STRING_get0_data(keybstr),
                    ASN1_STRING_length(keybstr), SHA1md, NULL, EVP_sha1(),
                    NULL))
        goto err;
    for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
        if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
            goto err;
    }
    BIO_printf(bp, "\n");

    return 1;
 err:
    OPENSSL_free(der);
    return 0;
}

int X509_ocspid_print(BIO *bp, X509 *x)
{
    unsigned char *der = NULL;
    unsigned char *dertmp;
    int derlen;
    int i;
    unsigned char SHA1md[SHA_DIGEST_LENGTH];

    /*
     * display the hash of the subject as it would appear in OCSP requests
     */
    if (BIO_printf(bp, "        Subject OCSP hash: ") <= 0)
        goto err;
    derlen = i2d_X509_NAME(x->cert_info->subject, NULL);
    if ((der = dertmp = (unsigned char *)OPENSSL_malloc(derlen)) == NULL)
        goto err;
    i2d_X509_NAME(x->cert_info->subject, &dertmp);

    if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL))
        goto err;
    for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
        if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
            goto err;
    }
    OPENSSL_free(der);
    der = NULL;

    /*
     * display the hash of the public key as it would appear in OCSP requests
     */
    if (BIO_printf(bp, "\n        Public key OCSP hash: ") <= 0)
        goto err;

    if (!EVP_Digest(x->cert_info->key->public_key->data,
                    x->cert_info->key->public_key->length,
                    SHA1md, NULL, EVP_sha1(), NULL))
        goto err;
    for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
        if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
            goto err;
    }
    BIO_printf(bp, "\n");

    return (1);
 err:
    if (der != NULL)
        OPENSSL_free(der);
    return (0);
}

static int
tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
{
	tlso_session *s = (tlso_session *)sess;
	X509 *x = tlso_get_cert( s );
	X509_NAME *xn;

	if ( !x )
		return LDAP_INVALID_CREDENTIALS;

	xn = X509_get_subject_name(x);
#if OPENSSL_VERSION_NUMBER < 0x10100000
	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
	der_dn->bv_val = xn->bytes->data;
#else
	{
		size_t len = 0;
		der_dn->bv_val = NULL;
		X509_NAME_get0_der( (const unsigned char **)&der_dn->bv_val, &len, xn );
		der_dn->bv_len = len;
	}
#endif
	X509_free(x);
	return 0;
}

static int
tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
{
	tlso_session *s = (tlso_session *)sess;
	X509 *x;
	X509_NAME *xn;

	x = SSL_get_certificate( s );

	if (!x) return LDAP_INVALID_CREDENTIALS;
	
	xn = X509_get_subject_name(x);
#if OPENSSL_VERSION_NUMBER < 0x10100000
	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
	der_dn->bv_val = xn->bytes->data;
#else
	{
		size_t len = 0;
		der_dn->bv_val = NULL;
		X509_NAME_get0_der( xn, (const unsigned char **)&der_dn->bv_val, &len );
		der_dn->bv_len = len;
	}
#endif
	/* Don't X509_free, the session is still using it */
	return 0;
}

unsigned long X509_NAME_hash(X509_NAME *x)
	{
	unsigned long ret=0;
	unsigned char md[SHA_DIGEST_LENGTH];

	/* Make sure X509_NAME structure contains valid cached encoding */
	i2d_X509_NAME(x,NULL);
	EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(), NULL);

	ret=(	((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
		((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
		)&0xffffffffL;
	return(ret);
	}

/* I now DER encode the name and hash it.  Since I cache the DER encoding,
 * this is reasonably efficient. */
unsigned long X509_NAME_hash(X509_NAME *x)
	{
	unsigned long ret=0;
	unsigned char md[16];

	/* Make sure X509_NAME structure contains valid cached encoding */
	i2d_X509_NAME(x,NULL);
	EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);

	ret=(	((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
		((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
		)&0xffffffffL;
	return(ret);
	}

static int
tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
{
	tlso_session *s = (tlso_session *)sess;
	X509 *x = tlso_get_cert( s );
	X509_NAME *xn;

	if ( !x )
		return LDAP_INVALID_CREDENTIALS;

	xn = X509_get_subject_name(x);
	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
	der_dn->bv_val = xn->bytes->data;
	X509_free(x);
	return 0;
}

static int
tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
{
	tlso_session *s = (tlso_session *)sess;
	X509 *x;
	X509_NAME *xn;

	x = SSL_get_certificate( s );

	if (!x) return LDAP_INVALID_CREDENTIALS;
	
	xn = X509_get_subject_name(x);
	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
	der_dn->bv_val = xn->bytes->data;
	/* Don't X509_free, the session is still using it */
	return 0;
}

/* I now DER encode the name and hash it.  Since I cache the DER encoding,
 * this is reasonably efficient. */
unsigned long X509_NAME_hash(X509_NAME *x)
	{
	unsigned long ret=0;
	unsigned char md[16];

	/* Ensure cached version is up to date */
	i2d_X509_NAME(x,NULL);
	/* Use cached encoding directly rather than copying: this should
	 * keep libsafe happy.
	 */
	MD5((unsigned char *)x->bytes->data,x->bytes->length,&(md[0]));

	ret=(	((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
		((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
		)&0xffffffffL;
	return(ret);
	}

unsigned long X509_NAME_hash_old(X509_NAME *x)
{
    EVP_MD_CTX md_ctx;
    unsigned long ret = 0;
    unsigned char md[16];

    /* Make sure X509_NAME structure contains valid cached encoding */
    i2d_X509_NAME(x, NULL);
    EVP_MD_CTX_init(&md_ctx);
    EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
    if (EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL)
        && EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length)
        && EVP_DigestFinal_ex(&md_ctx, md, NULL))
        ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
               ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)
            ) & 0xffffffffL;
    EVP_MD_CTX_cleanup(&md_ctx);

    return (ret);
}

MONO_API int
mono_btls_x509_name_get_raw_data (MonoBtlsX509Name *name, void **buffer, int use_canon_enc)
{
	int len;
	void *ptr;

	if (use_canon_enc) {
		// make sure canon_enc is initialized.
		i2d_X509_NAME (name->name, NULL);

		len = name->name->canon_enclen;
		ptr = name->name->canon_enc;
	} else {
		len = (int)name->name->bytes->length;
		ptr = name->name->bytes->data;
	}

	*buffer = OPENSSL_malloc (len);
	if (!*buffer)
		return 0;

	memcpy (*buffer, ptr, len);
	return len;
}

//.........这里部分代码省略.........
				if (pubkey == i)
				{
				EVP_PKEY *pkey;

				pkey=X509_get_pubkey(x);
				if (pkey == NULL)
					{
					BIO_printf(bio_err,"Error getting public key\n");
					ERR_print_errors(bio_err);
					goto end;
					}
				PEM_write_bio_PUBKEY(STDout, pkey);
				EVP_PKEY_free(pkey);
				}
			else
				if (C == i)
				{
				unsigned char *d;
				char *m;
				int y,z;

				X509_NAME_oneline(X509_get_subject_name(x),
					buf,sizeof buf);
				BIO_printf(STDout,"/* subject:%s */\n",buf);
				m=X509_NAME_oneline(
					X509_get_issuer_name(x),buf,
					sizeof buf);
				BIO_printf(STDout,"/* issuer :%s */\n",buf);

				z=i2d_X509(x,NULL);
				m=OPENSSL_malloc(z);

				d=(unsigned char *)m;
				z=i2d_X509_NAME(X509_get_subject_name(x),&d);
				BIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");

				z=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d);
				BIO_printf(STDout,"unsigned char XXX_public_key[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");

				z=i2d_X509(x,&d);
				BIO_printf(STDout,"unsigned char XXX_certificate[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");

static int op_capi_get_by_subject(X509_LOOKUP *_lu,int _type,X509_NAME *_name,
                                  X509_OBJECT *_ret) {
    HCERTSTORE h_store;
    if(_name==NULL)return 0;
    if(_name->bytes==NULL||_name->bytes->length<=0||_name->modified) {
        if(i2d_X509_NAME(_name,NULL)<0)return 0;
        OP_ASSERT(_name->bytes->length>0);
    }
    h_store=(HCERTSTORE)_lu->method_data;
    switch(_type) {
    case X509_LU_X509: {
        CERT_NAME_BLOB  find_para;
        PCCERT_CONTEXT  cert;
        X509           *x;
        int             ret;
        /*Although X509_NAME contains a canon_enc field, that "canonical" [1]
           encoding was just made up by OpenSSL.
          It doesn't correspond to any actual standard, and since it drops the
           initial sequence header, won't be recognized by the Crypto API.
          The assumption here is that CertFindCertificateInStore() will allow any
           appropriate variations in the encoding when it does its comparison.
          This is, however, emphatically not true under Wine, which just compares
           the encodings with memcmp().
          Most of the time things work anyway, though, and there isn't really
           anything we can do to make the situation better.

          [1] A "canonical form" is defined as the one where, if you locked 10
           mathematicians in a room and asked them to come up with a
           representation for something, it's the answer that 9 of them would
           give you back.
          I don't think OpenSSL's encoding qualifies.*/
        find_para.cbData=_name->bytes->length;
        find_para.pbData=(unsigned char *)_name->bytes->data;
        cert=CertFindCertificateInStore(h_store,X509_ASN_ENCODING,0,
                                        CERT_FIND_SUBJECT_NAME,&find_para,NULL);
        if(cert==NULL)return 0;
        x=d2i_X509(NULL,(const unsigned char **)&cert->pbCertEncoded,
                   cert->cbCertEncoded);
        CertFreeCertificateContext(cert);
        if(x==NULL)return 0;
        ret=X509_STORE_add_cert(_lu->store_ctx,x);
        X509_free(x);
        if(ret)return op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
    }
    break;
    case X509_LU_CRL: {
        CERT_INFO      cert_info;
        CERT_CONTEXT   find_para;
        PCCRL_CONTEXT  crl;
        X509_CRL      *x;
        int            ret;
        ret=op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
        if(ret>0)return ret;
        memset(&cert_info,0,sizeof(cert_info));
        cert_info.Issuer.cbData=_name->bytes->length;
        cert_info.Issuer.pbData=(unsigned char *)_name->bytes->data;
        memset(&find_para,0,sizeof(find_para));
        find_para.pCertInfo=&cert_info;
        crl=CertFindCRLInStore(h_store,0,0,CRL_FIND_ISSUED_BY,&find_para,NULL);
        if(crl==NULL)return 0;
        x=d2i_X509_CRL(NULL,(const unsigned char **)&crl->pbCrlEncoded,
                       crl->cbCrlEncoded);
        CertFreeCRLContext(crl);
        if(x==NULL)return 0;
        ret=X509_STORE_add_crl(_lu->store_ctx,x);
        X509_CRL_free(x);
        if(ret)return op_capi_retrieve_by_subject(_lu,_type,_name,_ret);
    }
    break;
    }
    return 0;
}

int
x509_cert_get_subjects(void *scert, int *cnt, u_int8_t ***id,
    u_int32_t **id_len)
{
	X509		*cert = scert;
	X509_NAME	*subject;
	int		type;
	u_int8_t	*altname;
	u_int32_t	altlen;
	u_int8_t	*buf = 0;
	unsigned char	*ubuf;
	int		i;

	*id = 0;
	*id_len = 0;

	/*
	 * XXX There can be a collection of subjectAltNames, but for now I
	 * only return the subjectName and a single subjectAltName, if
	 * present.
	 */
	type = x509_cert_subjectaltname(cert, &altname, &altlen);
	if (!type) {
		*cnt = 1;
		altlen = 0;
	} else
		*cnt = 2;

	*id = calloc(*cnt, sizeof **id);
	if (!*id) {
		log_print("x509_cert_get_subject: malloc (%lu) failed",
		    *cnt * (unsigned long)sizeof **id);
		*cnt = 0;
		goto fail;
	}
	*id_len = calloc(*cnt, sizeof **id_len);
	if (!*id_len) {
		log_print("x509_cert_get_subject: malloc (%lu) failed",
		    *cnt * (unsigned long)sizeof **id_len);
		goto fail;
	}
	/* Stash the subjectName into the first slot.  */
	subject = X509_get_subject_name(cert);
	if (!subject)
		goto fail;

	(*id_len)[0] =
		ISAKMP_ID_DATA_OFF + i2d_X509_NAME(subject, NULL) -
		    ISAKMP_GEN_SZ;
	(*id)[0] = malloc((*id_len)[0]);
	if (!(*id)[0]) {
		log_print("x509_cert_get_subject: malloc (%d) failed",
		    (*id_len)[0]);
		goto fail;
	}
	SET_ISAKMP_ID_TYPE((*id)[0] - ISAKMP_GEN_SZ, IPSEC_ID_DER_ASN1_DN);
	ubuf = (*id)[0] + ISAKMP_ID_DATA_OFF - ISAKMP_GEN_SZ;
	i2d_X509_NAME(subject, &ubuf);

	if (altlen) {
		/* Stash the subjectAltName into the second slot.  */
		buf = malloc(altlen + ISAKMP_ID_DATA_OFF);
		if (!buf) {
			log_print("x509_cert_get_subject: malloc (%d) failed",
			    altlen + ISAKMP_ID_DATA_OFF);
			goto fail;
		}
		switch (type) {
		case X509v3_DNS_NAME:
			SET_ISAKMP_ID_TYPE(buf, IPSEC_ID_FQDN);
			break;

		case X509v3_RFC_NAME:
			SET_ISAKMP_ID_TYPE(buf, IPSEC_ID_USER_FQDN);
			break;

		case X509v3_IP_ADDR:
			/*
			 * XXX I dislike the numeric constants, but I don't
			 * know what we should use otherwise.
			 */
			switch (altlen) {
			case 4:
				SET_ISAKMP_ID_TYPE(buf, IPSEC_ID_IPV4_ADDR);
				break;

			case 16:
				SET_ISAKMP_ID_TYPE(buf, IPSEC_ID_IPV6_ADDR);
				break;

			default:
				log_print("x509_cert_get_subject: invalid "
				    "subjectAltName IPaddress length %d ",
				    altlen);
				goto fail;
			}
			break;
		}

		SET_IPSEC_ID_PROTO(buf + ISAKMP_ID_DOI_DATA_OFF, 0);
//.........这里部分代码省略.........