x509asn1.c 35 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. ***************************************************************************/
  22. #include "curl_setup.h"
  23. #if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \
  24. defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
  25. #include <curl/curl.h>
  26. #include "urldata.h"
  27. #include "strcase.h"
  28. #include "hostcheck.h"
  29. #include "vtls/vtls.h"
  30. #include "sendf.h"
  31. #include "inet_pton.h"
  32. #include "curl_base64.h"
  33. #include "x509asn1.h"
  34. /* The last 3 #include files should be in this order */
  35. #include "curl_printf.h"
  36. #include "curl_memory.h"
  37. #include "memdebug.h"
  38. /* ASN.1 OIDs. */
  39. static const char cnOID[] = "2.5.4.3"; /* Common name. */
  40. static const char sanOID[] = "2.5.29.17"; /* Subject alternative name. */
  41. static const struct Curl_OID OIDtable[] = {
  42. { "1.2.840.10040.4.1", "dsa" },
  43. { "1.2.840.10040.4.3", "dsa-with-sha1" },
  44. { "1.2.840.10045.2.1", "ecPublicKey" },
  45. { "1.2.840.10045.3.0.1", "c2pnb163v1" },
  46. { "1.2.840.10045.4.1", "ecdsa-with-SHA1" },
  47. { "1.2.840.10046.2.1", "dhpublicnumber" },
  48. { "1.2.840.113549.1.1.1", "rsaEncryption" },
  49. { "1.2.840.113549.1.1.2", "md2WithRSAEncryption" },
  50. { "1.2.840.113549.1.1.4", "md5WithRSAEncryption" },
  51. { "1.2.840.113549.1.1.5", "sha1WithRSAEncryption" },
  52. { "1.2.840.113549.1.1.10", "RSASSA-PSS" },
  53. { "1.2.840.113549.1.1.14", "sha224WithRSAEncryption" },
  54. { "1.2.840.113549.1.1.11", "sha256WithRSAEncryption" },
  55. { "1.2.840.113549.1.1.12", "sha384WithRSAEncryption" },
  56. { "1.2.840.113549.1.1.13", "sha512WithRSAEncryption" },
  57. { "1.2.840.113549.2.2", "md2" },
  58. { "1.2.840.113549.2.5", "md5" },
  59. { "1.3.14.3.2.26", "sha1" },
  60. { cnOID, "CN" },
  61. { "2.5.4.4", "SN" },
  62. { "2.5.4.5", "serialNumber" },
  63. { "2.5.4.6", "C" },
  64. { "2.5.4.7", "L" },
  65. { "2.5.4.8", "ST" },
  66. { "2.5.4.9", "streetAddress" },
  67. { "2.5.4.10", "O" },
  68. { "2.5.4.11", "OU" },
  69. { "2.5.4.12", "title" },
  70. { "2.5.4.13", "description" },
  71. { "2.5.4.17", "postalCode" },
  72. { "2.5.4.41", "name" },
  73. { "2.5.4.42", "givenName" },
  74. { "2.5.4.43", "initials" },
  75. { "2.5.4.44", "generationQualifier" },
  76. { "2.5.4.45", "X500UniqueIdentifier" },
  77. { "2.5.4.46", "dnQualifier" },
  78. { "2.5.4.65", "pseudonym" },
  79. { "1.2.840.113549.1.9.1", "emailAddress" },
  80. { "2.5.4.72", "role" },
  81. { sanOID, "subjectAltName" },
  82. { "2.5.29.18", "issuerAltName" },
  83. { "2.5.29.19", "basicConstraints" },
  84. { "2.16.840.1.101.3.4.2.4", "sha224" },
  85. { "2.16.840.1.101.3.4.2.1", "sha256" },
  86. { "2.16.840.1.101.3.4.2.2", "sha384" },
  87. { "2.16.840.1.101.3.4.2.3", "sha512" },
  88. { (const char *) NULL, (const char *) NULL }
  89. };
  90. /*
  91. * Lightweight ASN.1 parser.
  92. * In particular, it does not check for syntactic/lexical errors.
  93. * It is intended to support certificate information gathering for SSL backends
  94. * that offer a mean to get certificates as a whole, but do not supply
  95. * entry points to get particular certificate sub-fields.
  96. * Please note there is no pretention here to rewrite a full SSL library.
  97. */
  98. static const char *getASN1Element(struct Curl_asn1Element *elem,
  99. const char *beg, const char *end)
  100. WARN_UNUSED_RESULT;
  101. static const char *getASN1Element(struct Curl_asn1Element *elem,
  102. const char *beg, const char *end)
  103. {
  104. unsigned char b;
  105. unsigned long len;
  106. struct Curl_asn1Element lelem;
  107. /* Get a single ASN.1 element into `elem', parse ASN.1 string at `beg'
  108. ending at `end'.
  109. Returns a pointer in source string after the parsed element, or NULL
  110. if an error occurs. */
  111. if(!beg || !end || beg >= end || !*beg ||
  112. (size_t)(end - beg) > CURL_ASN1_MAX)
  113. return NULL;
  114. /* Process header byte. */
  115. elem->header = beg;
  116. b = (unsigned char) *beg++;
  117. elem->constructed = (b & 0x20) != 0;
  118. elem->class = (b >> 6) & 3;
  119. b &= 0x1F;
  120. if(b == 0x1F)
  121. return NULL; /* Long tag values not supported here. */
  122. elem->tag = b;
  123. /* Process length. */
  124. if(beg >= end)
  125. return NULL;
  126. b = (unsigned char) *beg++;
  127. if(!(b & 0x80))
  128. len = b;
  129. else if(!(b &= 0x7F)) {
  130. /* Unspecified length. Since we have all the data, we can determine the
  131. effective length by skipping element until an end element is found. */
  132. if(!elem->constructed)
  133. return NULL;
  134. elem->beg = beg;
  135. while(beg < end && *beg) {
  136. beg = getASN1Element(&lelem, beg, end);
  137. if(!beg)
  138. return NULL;
  139. }
  140. if(beg >= end)
  141. return NULL;
  142. elem->end = beg;
  143. return beg + 1;
  144. }
  145. else if((unsigned)b > (size_t)(end - beg))
  146. return NULL; /* Does not fit in source. */
  147. else {
  148. /* Get long length. */
  149. len = 0;
  150. do {
  151. if(len & 0xFF000000L)
  152. return NULL; /* Lengths > 32 bits are not supported. */
  153. len = (len << 8) | (unsigned char) *beg++;
  154. } while(--b);
  155. }
  156. if(len > (size_t)(end - beg))
  157. return NULL; /* Element data does not fit in source. */
  158. elem->beg = beg;
  159. elem->end = beg + len;
  160. return elem->end;
  161. }
  162. /*
  163. * Search the null terminated OID or OID identifier in local table.
  164. * Return the table entry pointer or NULL if not found.
  165. */
  166. static const struct Curl_OID *searchOID(const char *oid)
  167. {
  168. const struct Curl_OID *op;
  169. for(op = OIDtable; op->numoid; op++)
  170. if(!strcmp(op->numoid, oid) || strcasecompare(op->textoid, oid))
  171. return op;
  172. return NULL;
  173. }
  174. /*
  175. * Convert an ASN.1 Boolean value into its string representation. Return the
  176. * dynamically allocated string, or NULL if source is not an ASN.1 Boolean
  177. * value.
  178. */
  179. static const char *bool2str(const char *beg, const char *end)
  180. {
  181. if(end - beg != 1)
  182. return NULL;
  183. return strdup(*beg? "TRUE": "FALSE");
  184. }
  185. /*
  186. * Convert an ASN.1 octet string to a printable string.
  187. * Return the dynamically allocated string, or NULL if an error occurs.
  188. */
  189. static const char *octet2str(const char *beg, const char *end)
  190. {
  191. size_t n = end - beg;
  192. char *buf = NULL;
  193. if(n <= (SIZE_T_MAX - 1) / 3) {
  194. buf = malloc(3 * n + 1);
  195. if(buf)
  196. for(n = 0; beg < end; n += 3)
  197. msnprintf(buf + n, 4, "%02x:", *(const unsigned char *) beg++);
  198. }
  199. return buf;
  200. }
  201. static const char *bit2str(const char *beg, const char *end)
  202. {
  203. /* Convert an ASN.1 bit string to a printable string.
  204. Return the dynamically allocated string, or NULL if an error occurs. */
  205. if(++beg > end)
  206. return NULL;
  207. return octet2str(beg, end);
  208. }
  209. /*
  210. * Convert an ASN.1 integer value into its string representation.
  211. * Return the dynamically allocated string, or NULL if source is not an
  212. * ASN.1 integer value.
  213. */
  214. static const char *int2str(const char *beg, const char *end)
  215. {
  216. unsigned long val = 0;
  217. size_t n = end - beg;
  218. if(!n)
  219. return NULL;
  220. if(n > 4)
  221. return octet2str(beg, end);
  222. /* Represent integers <= 32-bit as a single value. */
  223. if(*beg & 0x80)
  224. val = ~val;
  225. do
  226. val = (val << 8) | *(const unsigned char *) beg++;
  227. while(beg < end);
  228. return curl_maprintf("%s%lx", val >= 10? "0x": "", val);
  229. }
  230. /*
  231. * Perform a lazy conversion from an ASN.1 typed string to UTF8. Allocate the
  232. * destination buffer dynamically. The allocation size will normally be too
  233. * large: this is to avoid buffer overflows.
  234. * Terminate the string with a nul byte and return the converted
  235. * string length.
  236. */
  237. static ssize_t
  238. utf8asn1str(char **to, int type, const char *from, const char *end)
  239. {
  240. size_t inlength = end - from;
  241. int size = 1;
  242. size_t outlength;
  243. char *buf;
  244. *to = NULL;
  245. switch(type) {
  246. case CURL_ASN1_BMP_STRING:
  247. size = 2;
  248. break;
  249. case CURL_ASN1_UNIVERSAL_STRING:
  250. size = 4;
  251. break;
  252. case CURL_ASN1_NUMERIC_STRING:
  253. case CURL_ASN1_PRINTABLE_STRING:
  254. case CURL_ASN1_TELETEX_STRING:
  255. case CURL_ASN1_IA5_STRING:
  256. case CURL_ASN1_VISIBLE_STRING:
  257. case CURL_ASN1_UTF8_STRING:
  258. break;
  259. default:
  260. return -1; /* Conversion not supported. */
  261. }
  262. if(inlength % size)
  263. return -1; /* Length inconsistent with character size. */
  264. if(inlength / size > (SIZE_T_MAX - 1) / 4)
  265. return -1; /* Too big. */
  266. buf = malloc(4 * (inlength / size) + 1);
  267. if(!buf)
  268. return -1; /* Not enough memory. */
  269. if(type == CURL_ASN1_UTF8_STRING) {
  270. /* Just copy. */
  271. outlength = inlength;
  272. if(outlength)
  273. memcpy(buf, from, outlength);
  274. }
  275. else {
  276. for(outlength = 0; from < end;) {
  277. int charsize;
  278. unsigned int wc;
  279. wc = 0;
  280. switch(size) {
  281. case 4:
  282. wc = (wc << 8) | *(const unsigned char *) from++;
  283. wc = (wc << 8) | *(const unsigned char *) from++;
  284. /* FALLTHROUGH */
  285. case 2:
  286. wc = (wc << 8) | *(const unsigned char *) from++;
  287. /* FALLTHROUGH */
  288. default: /* case 1: */
  289. wc = (wc << 8) | *(const unsigned char *) from++;
  290. }
  291. charsize = 1;
  292. if(wc >= 0x00000080) {
  293. if(wc >= 0x00000800) {
  294. if(wc >= 0x00010000) {
  295. if(wc >= 0x00200000) {
  296. free(buf);
  297. return -1; /* Invalid char. size for target encoding. */
  298. }
  299. buf[outlength + 3] = (char) (0x80 | (wc & 0x3F));
  300. wc = (wc >> 6) | 0x00010000;
  301. charsize++;
  302. }
  303. buf[outlength + 2] = (char) (0x80 | (wc & 0x3F));
  304. wc = (wc >> 6) | 0x00000800;
  305. charsize++;
  306. }
  307. buf[outlength + 1] = (char) (0x80 | (wc & 0x3F));
  308. wc = (wc >> 6) | 0x000000C0;
  309. charsize++;
  310. }
  311. buf[outlength] = (char) wc;
  312. outlength += charsize;
  313. }
  314. }
  315. buf[outlength] = '\0';
  316. *to = buf;
  317. return outlength;
  318. }
  319. /*
  320. * Convert an ASN.1 String into its UTF-8 string representation.
  321. * Return the dynamically allocated string, or NULL if an error occurs.
  322. */
  323. static const char *string2str(int type, const char *beg, const char *end)
  324. {
  325. char *buf;
  326. if(utf8asn1str(&buf, type, beg, end) < 0)
  327. return NULL;
  328. return buf;
  329. }
  330. /*
  331. * Decimal ASCII encode unsigned integer `x' into the buflen sized buffer at
  332. * buf. Return the total number of encoded digits, even if larger than
  333. * `buflen'.
  334. */
  335. static size_t encodeUint(char *buf, size_t buflen, unsigned int x)
  336. {
  337. size_t i = 0;
  338. unsigned int y = x / 10;
  339. if(y) {
  340. i = encodeUint(buf, buflen, y);
  341. x -= y * 10;
  342. }
  343. if(i < buflen)
  344. buf[i] = (char) ('0' + x);
  345. i++;
  346. if(i < buflen)
  347. buf[i] = '\0'; /* Store a terminator if possible. */
  348. return i;
  349. }
  350. /*
  351. * Convert an ASN.1 OID into its dotted string representation.
  352. * Store the result in th `n'-byte buffer at `buf'.
  353. * Return the converted string length, or 0 on errors.
  354. */
  355. static size_t encodeOID(char *buf, size_t buflen,
  356. const char *beg, const char *end)
  357. {
  358. size_t i;
  359. unsigned int x;
  360. unsigned int y;
  361. /* Process the first two numbers. */
  362. y = *(const unsigned char *) beg++;
  363. x = y / 40;
  364. y -= x * 40;
  365. i = encodeUint(buf, buflen, x);
  366. if(i < buflen)
  367. buf[i] = '.';
  368. i++;
  369. if(i >= buflen)
  370. i += encodeUint(NULL, 0, y);
  371. else
  372. i += encodeUint(buf + i, buflen - i, y);
  373. /* Process the trailing numbers. */
  374. while(beg < end) {
  375. if(i < buflen)
  376. buf[i] = '.';
  377. i++;
  378. x = 0;
  379. do {
  380. if(x & 0xFF000000)
  381. return 0;
  382. y = *(const unsigned char *) beg++;
  383. x = (x << 7) | (y & 0x7F);
  384. } while(y & 0x80);
  385. if(i >= buflen)
  386. i += encodeUint(NULL, 0, x);
  387. else
  388. i += encodeUint(buf + i, buflen - i, x);
  389. }
  390. if(i < buflen)
  391. buf[i] = '\0';
  392. return i;
  393. }
  394. /*
  395. * Convert an ASN.1 OID into its dotted or symbolic string representation.
  396. * Return the dynamically allocated string, or NULL if an error occurs.
  397. */
  398. static const char *OID2str(const char *beg, const char *end, bool symbolic)
  399. {
  400. char *buf = NULL;
  401. if(beg < end) {
  402. size_t buflen = encodeOID(NULL, 0, beg, end);
  403. if(buflen) {
  404. buf = malloc(buflen + 1); /* one extra for the zero byte */
  405. if(buf) {
  406. encodeOID(buf, buflen, beg, end);
  407. buf[buflen] = '\0';
  408. if(symbolic) {
  409. const struct Curl_OID *op = searchOID(buf);
  410. if(op) {
  411. free(buf);
  412. buf = strdup(op->textoid);
  413. }
  414. }
  415. }
  416. }
  417. }
  418. return buf;
  419. }
  420. static const char *GTime2str(const char *beg, const char *end)
  421. {
  422. const char *tzp;
  423. const char *fracp;
  424. char sec1, sec2;
  425. size_t fracl;
  426. size_t tzl;
  427. const char *sep = "";
  428. /* Convert an ASN.1 Generalized time to a printable string.
  429. Return the dynamically allocated string, or NULL if an error occurs. */
  430. for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
  431. ;
  432. /* Get seconds digits. */
  433. sec1 = '0';
  434. switch(fracp - beg - 12) {
  435. case 0:
  436. sec2 = '0';
  437. break;
  438. case 2:
  439. sec1 = fracp[-2];
  440. /* FALLTHROUGH */
  441. case 1:
  442. sec2 = fracp[-1];
  443. break;
  444. default:
  445. return NULL;
  446. }
  447. /* Scan for timezone, measure fractional seconds. */
  448. tzp = fracp;
  449. fracl = 0;
  450. if(fracp < end && (*fracp == '.' || *fracp == ',')) {
  451. fracp++;
  452. do
  453. tzp++;
  454. while(tzp < end && *tzp >= '0' && *tzp <= '9');
  455. /* Strip leading zeroes in fractional seconds. */
  456. for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
  457. ;
  458. }
  459. /* Process timezone. */
  460. if(tzp >= end)
  461. ; /* Nothing to do. */
  462. else if(*tzp == 'Z') {
  463. tzp = " GMT";
  464. end = tzp + 4;
  465. }
  466. else {
  467. sep = " ";
  468. tzp++;
  469. }
  470. tzl = end - tzp;
  471. return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
  472. beg, beg + 4, beg + 6,
  473. beg + 8, beg + 10, sec1, sec2,
  474. fracl? ".": "", fracl, fracp,
  475. sep, tzl, tzp);
  476. }
  477. /*
  478. * Convert an ASN.1 UTC time to a printable string.
  479. * Return the dynamically allocated string, or NULL if an error occurs.
  480. */
  481. static const char *UTime2str(const char *beg, const char *end)
  482. {
  483. const char *tzp;
  484. size_t tzl;
  485. const char *sec;
  486. for(tzp = beg; tzp < end && *tzp >= '0' && *tzp <= '9'; tzp++)
  487. ;
  488. /* Get the seconds. */
  489. sec = beg + 10;
  490. switch(tzp - sec) {
  491. case 0:
  492. sec = "00";
  493. case 2:
  494. break;
  495. default:
  496. return NULL;
  497. }
  498. /* Process timezone. */
  499. if(tzp >= end)
  500. return NULL;
  501. if(*tzp == 'Z') {
  502. tzp = "GMT";
  503. end = tzp + 3;
  504. }
  505. else
  506. tzp++;
  507. tzl = end - tzp;
  508. return curl_maprintf("%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s",
  509. 20 - (*beg >= '5'), beg, beg + 2, beg + 4,
  510. beg + 6, beg + 8, sec,
  511. tzl, tzp);
  512. }
  513. /*
  514. * Convert an ASN.1 element to a printable string.
  515. * Return the dynamically allocated string, or NULL if an error occurs.
  516. */
  517. static const char *ASN1tostr(struct Curl_asn1Element *elem, int type)
  518. {
  519. if(elem->constructed)
  520. return NULL; /* No conversion of structured elements. */
  521. if(!type)
  522. type = elem->tag; /* Type not forced: use element tag as type. */
  523. switch(type) {
  524. case CURL_ASN1_BOOLEAN:
  525. return bool2str(elem->beg, elem->end);
  526. case CURL_ASN1_INTEGER:
  527. case CURL_ASN1_ENUMERATED:
  528. return int2str(elem->beg, elem->end);
  529. case CURL_ASN1_BIT_STRING:
  530. return bit2str(elem->beg, elem->end);
  531. case CURL_ASN1_OCTET_STRING:
  532. return octet2str(elem->beg, elem->end);
  533. case CURL_ASN1_NULL:
  534. return strdup("");
  535. case CURL_ASN1_OBJECT_IDENTIFIER:
  536. return OID2str(elem->beg, elem->end, TRUE);
  537. case CURL_ASN1_UTC_TIME:
  538. return UTime2str(elem->beg, elem->end);
  539. case CURL_ASN1_GENERALIZED_TIME:
  540. return GTime2str(elem->beg, elem->end);
  541. case CURL_ASN1_UTF8_STRING:
  542. case CURL_ASN1_NUMERIC_STRING:
  543. case CURL_ASN1_PRINTABLE_STRING:
  544. case CURL_ASN1_TELETEX_STRING:
  545. case CURL_ASN1_IA5_STRING:
  546. case CURL_ASN1_VISIBLE_STRING:
  547. case CURL_ASN1_UNIVERSAL_STRING:
  548. case CURL_ASN1_BMP_STRING:
  549. return string2str(type, elem->beg, elem->end);
  550. }
  551. return NULL; /* Unsupported. */
  552. }
  553. /*
  554. * ASCII encode distinguished name at `dn' into the `buflen'-sized buffer at
  555. * `buf'. Return the total string length, even if larger than `buflen'.
  556. */
  557. static ssize_t encodeDN(char *buf, size_t buflen, struct Curl_asn1Element *dn)
  558. {
  559. struct Curl_asn1Element rdn;
  560. struct Curl_asn1Element atv;
  561. struct Curl_asn1Element oid;
  562. struct Curl_asn1Element value;
  563. size_t l = 0;
  564. const char *p1;
  565. const char *p2;
  566. const char *p3;
  567. const char *str;
  568. for(p1 = dn->beg; p1 < dn->end;) {
  569. p1 = getASN1Element(&rdn, p1, dn->end);
  570. if(!p1)
  571. return -1;
  572. for(p2 = rdn.beg; p2 < rdn.end;) {
  573. p2 = getASN1Element(&atv, p2, rdn.end);
  574. if(!p2)
  575. return -1;
  576. p3 = getASN1Element(&oid, atv.beg, atv.end);
  577. if(!p3)
  578. return -1;
  579. if(!getASN1Element(&value, p3, atv.end))
  580. return -1;
  581. str = ASN1tostr(&oid, 0);
  582. if(!str)
  583. return -1;
  584. /* Encode delimiter.
  585. If attribute has a short uppercase name, delimiter is ", ". */
  586. if(l) {
  587. for(p3 = str; isupper(*p3); p3++)
  588. ;
  589. for(p3 = (*p3 || p3 - str > 2)? "/": ", "; *p3; p3++) {
  590. if(l < buflen)
  591. buf[l] = *p3;
  592. l++;
  593. }
  594. }
  595. /* Encode attribute name. */
  596. for(p3 = str; *p3; p3++) {
  597. if(l < buflen)
  598. buf[l] = *p3;
  599. l++;
  600. }
  601. free((char *) str);
  602. /* Generate equal sign. */
  603. if(l < buflen)
  604. buf[l] = '=';
  605. l++;
  606. /* Generate value. */
  607. str = ASN1tostr(&value, 0);
  608. if(!str)
  609. return -1;
  610. for(p3 = str; *p3; p3++) {
  611. if(l < buflen)
  612. buf[l] = *p3;
  613. l++;
  614. }
  615. free((char *) str);
  616. }
  617. }
  618. return l;
  619. }
  620. /*
  621. * Convert an ASN.1 distinguished name into a printable string.
  622. * Return the dynamically allocated string, or NULL if an error occurs.
  623. */
  624. static const char *DNtostr(struct Curl_asn1Element *dn)
  625. {
  626. char *buf = NULL;
  627. ssize_t buflen = encodeDN(NULL, 0, dn);
  628. if(buflen >= 0) {
  629. buf = malloc(buflen + 1);
  630. if(buf) {
  631. encodeDN(buf, buflen + 1, dn);
  632. buf[buflen] = '\0';
  633. }
  634. }
  635. return buf;
  636. }
  637. /*
  638. * ASN.1 parse an X509 certificate into structure subfields.
  639. * Syntax is assumed to have already been checked by the SSL backend.
  640. * See RFC 5280.
  641. */
  642. int Curl_parseX509(struct Curl_X509certificate *cert,
  643. const char *beg, const char *end)
  644. {
  645. struct Curl_asn1Element elem;
  646. struct Curl_asn1Element tbsCertificate;
  647. const char *ccp;
  648. static const char defaultVersion = 0; /* v1. */
  649. cert->certificate.header = NULL;
  650. cert->certificate.beg = beg;
  651. cert->certificate.end = end;
  652. /* Get the sequence content. */
  653. if(!getASN1Element(&elem, beg, end))
  654. return -1; /* Invalid bounds/size. */
  655. beg = elem.beg;
  656. end = elem.end;
  657. /* Get tbsCertificate. */
  658. beg = getASN1Element(&tbsCertificate, beg, end);
  659. if(!beg)
  660. return -1;
  661. /* Skip the signatureAlgorithm. */
  662. beg = getASN1Element(&cert->signatureAlgorithm, beg, end);
  663. if(!beg)
  664. return -1;
  665. /* Get the signatureValue. */
  666. if(!getASN1Element(&cert->signature, beg, end))
  667. return -1;
  668. /* Parse TBSCertificate. */
  669. beg = tbsCertificate.beg;
  670. end = tbsCertificate.end;
  671. /* Get optional version, get serialNumber. */
  672. cert->version.header = NULL;
  673. cert->version.beg = &defaultVersion;
  674. cert->version.end = &defaultVersion + sizeof(defaultVersion);
  675. beg = getASN1Element(&elem, beg, end);
  676. if(!beg)
  677. return -1;
  678. if(elem.tag == 0) {
  679. if(!getASN1Element(&cert->version, elem.beg, elem.end))
  680. return -1;
  681. beg = getASN1Element(&elem, beg, end);
  682. if(!beg)
  683. return -1;
  684. }
  685. cert->serialNumber = elem;
  686. /* Get signature algorithm. */
  687. beg = getASN1Element(&cert->signatureAlgorithm, beg, end);
  688. /* Get issuer. */
  689. beg = getASN1Element(&cert->issuer, beg, end);
  690. if(!beg)
  691. return -1;
  692. /* Get notBefore and notAfter. */
  693. beg = getASN1Element(&elem, beg, end);
  694. if(!beg)
  695. return -1;
  696. ccp = getASN1Element(&cert->notBefore, elem.beg, elem.end);
  697. if(!ccp)
  698. return -1;
  699. if(!getASN1Element(&cert->notAfter, ccp, elem.end))
  700. return -1;
  701. /* Get subject. */
  702. beg = getASN1Element(&cert->subject, beg, end);
  703. if(!beg)
  704. return -1;
  705. /* Get subjectPublicKeyAlgorithm and subjectPublicKey. */
  706. beg = getASN1Element(&cert->subjectPublicKeyInfo, beg, end);
  707. if(!beg)
  708. return -1;
  709. ccp = getASN1Element(&cert->subjectPublicKeyAlgorithm,
  710. cert->subjectPublicKeyInfo.beg,
  711. cert->subjectPublicKeyInfo.end);
  712. if(!ccp)
  713. return -1;
  714. if(!getASN1Element(&cert->subjectPublicKey, ccp,
  715. cert->subjectPublicKeyInfo.end))
  716. return -1;
  717. /* Get optional issuerUiqueID, subjectUniqueID and extensions. */
  718. cert->issuerUniqueID.tag = cert->subjectUniqueID.tag = 0;
  719. cert->extensions.tag = elem.tag = 0;
  720. cert->issuerUniqueID.header = cert->subjectUniqueID.header = NULL;
  721. cert->issuerUniqueID.beg = cert->issuerUniqueID.end = "";
  722. cert->subjectUniqueID.beg = cert->subjectUniqueID.end = "";
  723. cert->extensions.header = NULL;
  724. cert->extensions.beg = cert->extensions.end = "";
  725. if(beg < end) {
  726. beg = getASN1Element(&elem, beg, end);
  727. if(!beg)
  728. return -1;
  729. }
  730. if(elem.tag == 1) {
  731. cert->issuerUniqueID = elem;
  732. if(beg < end) {
  733. beg = getASN1Element(&elem, beg, end);
  734. if(!beg)
  735. return -1;
  736. }
  737. }
  738. if(elem.tag == 2) {
  739. cert->subjectUniqueID = elem;
  740. if(beg < end) {
  741. beg = getASN1Element(&elem, beg, end);
  742. if(!beg)
  743. return -1;
  744. }
  745. }
  746. if(elem.tag == 3)
  747. if(!getASN1Element(&cert->extensions, elem.beg, elem.end))
  748. return -1;
  749. return 0;
  750. }
  751. /*
  752. * Copy at most 64-characters, terminate with a newline and returns the
  753. * effective number of stored characters.
  754. */
  755. static size_t copySubstring(char *to, const char *from)
  756. {
  757. size_t i;
  758. for(i = 0; i < 64; i++) {
  759. to[i] = *from;
  760. if(!*from++)
  761. break;
  762. }
  763. to[i++] = '\n';
  764. return i;
  765. }
  766. static const char *dumpAlgo(struct Curl_asn1Element *param,
  767. const char *beg, const char *end)
  768. {
  769. struct Curl_asn1Element oid;
  770. /* Get algorithm parameters and return algorithm name. */
  771. beg = getASN1Element(&oid, beg, end);
  772. if(!beg)
  773. return NULL;
  774. param->header = NULL;
  775. param->tag = 0;
  776. param->beg = param->end = end;
  777. if(beg < end)
  778. if(!getASN1Element(param, beg, end))
  779. return NULL;
  780. return OID2str(oid.beg, oid.end, TRUE);
  781. }
  782. static void do_pubkey_field(struct Curl_easy *data, int certnum,
  783. const char *label, struct Curl_asn1Element *elem)
  784. {
  785. const char *output;
  786. /* Generate a certificate information record for the public key. */
  787. output = ASN1tostr(elem, 0);
  788. if(output) {
  789. if(data->set.ssl.certinfo)
  790. Curl_ssl_push_certinfo(data, certnum, label, output);
  791. if(!certnum)
  792. infof(data, " %s: %s\n", label, output);
  793. free((char *) output);
  794. }
  795. }
  796. static void do_pubkey(struct Curl_easy *data, int certnum,
  797. const char *algo, struct Curl_asn1Element *param,
  798. struct Curl_asn1Element *pubkey)
  799. {
  800. struct Curl_asn1Element elem;
  801. struct Curl_asn1Element pk;
  802. const char *p;
  803. /* Generate all information records for the public key. */
  804. /* Get the public key (single element). */
  805. if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end))
  806. return;
  807. if(strcasecompare(algo, "rsaEncryption")) {
  808. const char *q;
  809. unsigned long len;
  810. p = getASN1Element(&elem, pk.beg, pk.end);
  811. if(!p)
  812. return;
  813. /* Compute key length. */
  814. for(q = elem.beg; !*q && q < elem.end; q++)
  815. ;
  816. len = (unsigned long)((elem.end - q) * 8);
  817. if(len) {
  818. unsigned int i;
  819. for(i = *(unsigned char *) q; !(i & 0x80); i <<= 1)
  820. len--;
  821. }
  822. if(len > 32)
  823. elem.beg = q; /* Strip leading zero bytes. */
  824. if(!certnum)
  825. infof(data, " RSA Public Key (%lu bits)\n", len);
  826. if(data->set.ssl.certinfo) {
  827. q = curl_maprintf("%lu", len);
  828. if(q) {
  829. Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", q);
  830. free((char *) q);
  831. }
  832. }
  833. /* Generate coefficients. */
  834. do_pubkey_field(data, certnum, "rsa(n)", &elem);
  835. if(!getASN1Element(&elem, p, pk.end))
  836. return;
  837. do_pubkey_field(data, certnum, "rsa(e)", &elem);
  838. }
  839. else if(strcasecompare(algo, "dsa")) {
  840. p = getASN1Element(&elem, param->beg, param->end);
  841. if(p) {
  842. do_pubkey_field(data, certnum, "dsa(p)", &elem);
  843. p = getASN1Element(&elem, p, param->end);
  844. if(p) {
  845. do_pubkey_field(data, certnum, "dsa(q)", &elem);
  846. if(getASN1Element(&elem, p, param->end)) {
  847. do_pubkey_field(data, certnum, "dsa(g)", &elem);
  848. do_pubkey_field(data, certnum, "dsa(pub_key)", &pk);
  849. }
  850. }
  851. }
  852. }
  853. else if(strcasecompare(algo, "dhpublicnumber")) {
  854. p = getASN1Element(&elem, param->beg, param->end);
  855. if(p) {
  856. do_pubkey_field(data, certnum, "dh(p)", &elem);
  857. if(getASN1Element(&elem, param->beg, param->end)) {
  858. do_pubkey_field(data, certnum, "dh(g)", &elem);
  859. do_pubkey_field(data, certnum, "dh(pub_key)", &pk);
  860. }
  861. }
  862. }
  863. }
  864. CURLcode Curl_extract_certinfo(struct connectdata *conn,
  865. int certnum,
  866. const char *beg,
  867. const char *end)
  868. {
  869. struct Curl_X509certificate cert;
  870. struct Curl_easy *data = conn->data;
  871. struct Curl_asn1Element param;
  872. const char *ccp;
  873. char *cp1;
  874. size_t cl1;
  875. char *cp2;
  876. CURLcode result;
  877. unsigned long version;
  878. size_t i;
  879. size_t j;
  880. if(!data->set.ssl.certinfo)
  881. if(certnum)
  882. return CURLE_OK;
  883. /* Prepare the certificate information for curl_easy_getinfo(). */
  884. /* Extract the certificate ASN.1 elements. */
  885. if(Curl_parseX509(&cert, beg, end))
  886. return CURLE_PEER_FAILED_VERIFICATION;
  887. /* Subject. */
  888. ccp = DNtostr(&cert.subject);
  889. if(!ccp)
  890. return CURLE_OUT_OF_MEMORY;
  891. if(data->set.ssl.certinfo)
  892. Curl_ssl_push_certinfo(data, certnum, "Subject", ccp);
  893. if(!certnum)
  894. infof(data, "%2d Subject: %s\n", certnum, ccp);
  895. free((char *) ccp);
  896. /* Issuer. */
  897. ccp = DNtostr(&cert.issuer);
  898. if(!ccp)
  899. return CURLE_OUT_OF_MEMORY;
  900. if(data->set.ssl.certinfo)
  901. Curl_ssl_push_certinfo(data, certnum, "Issuer", ccp);
  902. if(!certnum)
  903. infof(data, " Issuer: %s\n", ccp);
  904. free((char *) ccp);
  905. /* Version (always fits in less than 32 bits). */
  906. version = 0;
  907. for(ccp = cert.version.beg; ccp < cert.version.end; ccp++)
  908. version = (version << 8) | *(const unsigned char *) ccp;
  909. if(data->set.ssl.certinfo) {
  910. ccp = curl_maprintf("%lx", version);
  911. if(!ccp)
  912. return CURLE_OUT_OF_MEMORY;
  913. Curl_ssl_push_certinfo(data, certnum, "Version", ccp);
  914. free((char *) ccp);
  915. }
  916. if(!certnum)
  917. infof(data, " Version: %lu (0x%lx)\n", version + 1, version);
  918. /* Serial number. */
  919. ccp = ASN1tostr(&cert.serialNumber, 0);
  920. if(!ccp)
  921. return CURLE_OUT_OF_MEMORY;
  922. if(data->set.ssl.certinfo)
  923. Curl_ssl_push_certinfo(data, certnum, "Serial Number", ccp);
  924. if(!certnum)
  925. infof(data, " Serial Number: %s\n", ccp);
  926. free((char *) ccp);
  927. /* Signature algorithm .*/
  928. ccp = dumpAlgo(&param, cert.signatureAlgorithm.beg,
  929. cert.signatureAlgorithm.end);
  930. if(!ccp)
  931. return CURLE_OUT_OF_MEMORY;
  932. if(data->set.ssl.certinfo)
  933. Curl_ssl_push_certinfo(data, certnum, "Signature Algorithm", ccp);
  934. if(!certnum)
  935. infof(data, " Signature Algorithm: %s\n", ccp);
  936. free((char *) ccp);
  937. /* Start Date. */
  938. ccp = ASN1tostr(&cert.notBefore, 0);
  939. if(!ccp)
  940. return CURLE_OUT_OF_MEMORY;
  941. if(data->set.ssl.certinfo)
  942. Curl_ssl_push_certinfo(data, certnum, "Start Date", ccp);
  943. if(!certnum)
  944. infof(data, " Start Date: %s\n", ccp);
  945. free((char *) ccp);
  946. /* Expire Date. */
  947. ccp = ASN1tostr(&cert.notAfter, 0);
  948. if(!ccp)
  949. return CURLE_OUT_OF_MEMORY;
  950. if(data->set.ssl.certinfo)
  951. Curl_ssl_push_certinfo(data, certnum, "Expire Date", ccp);
  952. if(!certnum)
  953. infof(data, " Expire Date: %s\n", ccp);
  954. free((char *) ccp);
  955. /* Public Key Algorithm. */
  956. ccp = dumpAlgo(&param, cert.subjectPublicKeyAlgorithm.beg,
  957. cert.subjectPublicKeyAlgorithm.end);
  958. if(!ccp)
  959. return CURLE_OUT_OF_MEMORY;
  960. if(data->set.ssl.certinfo)
  961. Curl_ssl_push_certinfo(data, certnum, "Public Key Algorithm", ccp);
  962. if(!certnum)
  963. infof(data, " Public Key Algorithm: %s\n", ccp);
  964. do_pubkey(data, certnum, ccp, &param, &cert.subjectPublicKey);
  965. free((char *) ccp);
  966. /* Signature. */
  967. ccp = ASN1tostr(&cert.signature, 0);
  968. if(!ccp)
  969. return CURLE_OUT_OF_MEMORY;
  970. if(data->set.ssl.certinfo)
  971. Curl_ssl_push_certinfo(data, certnum, "Signature", ccp);
  972. if(!certnum)
  973. infof(data, " Signature: %s\n", ccp);
  974. free((char *) ccp);
  975. /* Generate PEM certificate. */
  976. result = Curl_base64_encode(data, cert.certificate.beg,
  977. cert.certificate.end - cert.certificate.beg,
  978. &cp1, &cl1);
  979. if(result)
  980. return result;
  981. /* Compute the number of characters in final certificate string. Format is:
  982. -----BEGIN CERTIFICATE-----\n
  983. <max 64 base64 characters>\n
  984. .
  985. .
  986. .
  987. -----END CERTIFICATE-----\n
  988. */
  989. i = 28 + cl1 + (cl1 + 64 - 1) / 64 + 26;
  990. cp2 = malloc(i + 1);
  991. if(!cp2) {
  992. free(cp1);
  993. return CURLE_OUT_OF_MEMORY;
  994. }
  995. /* Build the certificate string. */
  996. i = copySubstring(cp2, "-----BEGIN CERTIFICATE-----");
  997. for(j = 0; j < cl1; j += 64)
  998. i += copySubstring(cp2 + i, cp1 + j);
  999. i += copySubstring(cp2 + i, "-----END CERTIFICATE-----");
  1000. cp2[i] = '\0';
  1001. free(cp1);
  1002. if(data->set.ssl.certinfo)
  1003. Curl_ssl_push_certinfo(data, certnum, "Cert", cp2);
  1004. if(!certnum)
  1005. infof(data, "%s\n", cp2);
  1006. free(cp2);
  1007. return CURLE_OK;
  1008. }
  1009. #endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */
  1010. #if defined(USE_GSKIT)
  1011. static const char *checkOID(const char *beg, const char *end,
  1012. const char *oid)
  1013. {
  1014. struct Curl_asn1Element e;
  1015. const char *ccp;
  1016. const char *p;
  1017. bool matched;
  1018. /* Check if first ASN.1 element at `beg' is the given OID.
  1019. Return a pointer in the source after the OID if found, else NULL. */
  1020. ccp = getASN1Element(&e, beg, end);
  1021. if(!ccp || e.tag != CURL_ASN1_OBJECT_IDENTIFIER)
  1022. return NULL;
  1023. p = OID2str(e.beg, e.end, FALSE);
  1024. if(!p)
  1025. return NULL;
  1026. matched = !strcmp(p, oid);
  1027. free((char *) p);
  1028. return matched? ccp: NULL;
  1029. }
  1030. CURLcode Curl_verifyhost(struct connectdata *conn,
  1031. const char *beg, const char *end)
  1032. {
  1033. struct Curl_easy *data = conn->data;
  1034. struct Curl_X509certificate cert;
  1035. struct Curl_asn1Element dn;
  1036. struct Curl_asn1Element elem;
  1037. struct Curl_asn1Element ext;
  1038. struct Curl_asn1Element name;
  1039. const char *p;
  1040. const char *q;
  1041. char *dnsname;
  1042. int matched = -1;
  1043. size_t addrlen = (size_t) -1;
  1044. ssize_t len;
  1045. const char *const hostname = SSL_IS_PROXY()?
  1046. conn->http_proxy.host.name : conn->host.name;
  1047. const char *const dispname = SSL_IS_PROXY()?
  1048. conn->http_proxy.host.dispname : conn->host.dispname;
  1049. #ifdef ENABLE_IPV6
  1050. struct in6_addr addr;
  1051. #else
  1052. struct in_addr addr;
  1053. #endif
  1054. /* Verify that connection server matches info in X509 certificate at
  1055. `beg'..`end'. */
  1056. if(!SSL_CONN_CONFIG(verifyhost))
  1057. return CURLE_OK;
  1058. if(Curl_parseX509(&cert, beg, end))
  1059. return CURLE_PEER_FAILED_VERIFICATION;
  1060. /* Get the server IP address. */
  1061. #ifdef ENABLE_IPV6
  1062. if(conn->bits.ipv6_ip && Curl_inet_pton(AF_INET6, hostname, &addr))
  1063. addrlen = sizeof(struct in6_addr);
  1064. else
  1065. #endif
  1066. if(Curl_inet_pton(AF_INET, hostname, &addr))
  1067. addrlen = sizeof(struct in_addr);
  1068. /* Process extensions. */
  1069. for(p = cert.extensions.beg; p < cert.extensions.end && matched != 1;) {
  1070. p = getASN1Element(&ext, p, cert.extensions.end);
  1071. if(!p)
  1072. return CURLE_PEER_FAILED_VERIFICATION;
  1073. /* Check if extension is a subjectAlternativeName. */
  1074. ext.beg = checkOID(ext.beg, ext.end, sanOID);
  1075. if(ext.beg) {
  1076. ext.beg = getASN1Element(&elem, ext.beg, ext.end);
  1077. if(!ext.beg)
  1078. return CURLE_PEER_FAILED_VERIFICATION;
  1079. /* Skip critical if present. */
  1080. if(elem.tag == CURL_ASN1_BOOLEAN) {
  1081. ext.beg = getASN1Element(&elem, ext.beg, ext.end);
  1082. if(!ext.beg)
  1083. return CURLE_PEER_FAILED_VERIFICATION;
  1084. }
  1085. /* Parse the octet string contents: is a single sequence. */
  1086. if(!getASN1Element(&elem, elem.beg, elem.end))
  1087. return CURLE_PEER_FAILED_VERIFICATION;
  1088. /* Check all GeneralNames. */
  1089. for(q = elem.beg; matched != 1 && q < elem.end;) {
  1090. q = getASN1Element(&name, q, elem.end);
  1091. if(!q)
  1092. break;
  1093. switch(name.tag) {
  1094. case 2: /* DNS name. */
  1095. len = utf8asn1str(&dnsname, CURL_ASN1_IA5_STRING,
  1096. name.beg, name.end);
  1097. if(len > 0 && (size_t)len == strlen(dnsname))
  1098. matched = Curl_cert_hostcheck(dnsname, hostname);
  1099. else
  1100. matched = 0;
  1101. free(dnsname);
  1102. break;
  1103. case 7: /* IP address. */
  1104. matched = (size_t) (name.end - name.beg) == addrlen &&
  1105. !memcmp(&addr, name.beg, addrlen);
  1106. break;
  1107. }
  1108. }
  1109. }
  1110. }
  1111. switch(matched) {
  1112. case 1:
  1113. /* an alternative name matched the server hostname */
  1114. infof(data, "\t subjectAltName: %s matched\n", dispname);
  1115. return CURLE_OK;
  1116. case 0:
  1117. /* an alternative name field existed, but didn't match and then
  1118. we MUST fail */
  1119. infof(data, "\t subjectAltName does not match %s\n", dispname);
  1120. return CURLE_PEER_FAILED_VERIFICATION;
  1121. }
  1122. /* Process subject. */
  1123. name.header = NULL;
  1124. name.beg = name.end = "";
  1125. q = cert.subject.beg;
  1126. /* we have to look to the last occurrence of a commonName in the
  1127. distinguished one to get the most significant one. */
  1128. while(q < cert.subject.end) {
  1129. q = getASN1Element(&dn, q, cert.subject.end);
  1130. if(!q)
  1131. break;
  1132. for(p = dn.beg; p < dn.end;) {
  1133. p = getASN1Element(&elem, p, dn.end);
  1134. if(!p)
  1135. return CURLE_PEER_FAILED_VERIFICATION;
  1136. /* We have a DN's AttributeTypeAndValue: check it in case it's a CN. */
  1137. elem.beg = checkOID(elem.beg, elem.end, cnOID);
  1138. if(elem.beg)
  1139. name = elem; /* Latch CN. */
  1140. }
  1141. }
  1142. /* Check the CN if found. */
  1143. if(!getASN1Element(&elem, name.beg, name.end))
  1144. failf(data, "SSL: unable to obtain common name from peer certificate");
  1145. else {
  1146. len = utf8asn1str(&dnsname, elem.tag, elem.beg, elem.end);
  1147. if(len < 0) {
  1148. free(dnsname);
  1149. return CURLE_OUT_OF_MEMORY;
  1150. }
  1151. if(strlen(dnsname) != (size_t) len) /* Nul byte in string ? */
  1152. failf(data, "SSL: illegal cert name field");
  1153. else if(Curl_cert_hostcheck((const char *) dnsname, hostname)) {
  1154. infof(data, "\t common name: %s (matched)\n", dnsname);
  1155. free(dnsname);
  1156. return CURLE_OK;
  1157. }
  1158. else
  1159. failf(data, "SSL: certificate subject name '%s' does not match "
  1160. "target host name '%s'", dnsname, dispname);
  1161. free(dnsname);
  1162. }
  1163. return CURLE_PEER_FAILED_VERIFICATION;
  1164. }
  1165. #endif /* USE_GSKIT */