diff --git a/Certificate.hs b/Certificate.hs --- a/Certificate.hs +++ b/Certificate.hs @@ -25,7 +25,9 @@ import qualified Crypto.Cipher.RSA as RSA import qualified Crypto.Cipher.DSA as DSA -import Data.ASN1.DER (decodeASN1Stream, ASN1(..), ASN1ConstructionType(..)) +import Data.ASN1.Encoding +import Data.ASN1.BinaryEncoding +import Data.ASN1.Stream import Data.ASN1.BitArray import Text.Printf import Numeric @@ -79,7 +81,7 @@ X509.PubKeyUnknown oid ws -> do printf "public key unknown: %s\n" (show oid) printf " raw bytes: %s\n" (show ws) - case decodeASN1Stream $ L.pack ws of + case decodeASN1 BER $ L.pack ws of Left err -> printf " asn1 decoding failed: %s\n" (show err) Right l -> printf " asn1 decoding:\n" >> showASN1 4 l pk -> @@ -160,7 +162,7 @@ processCert opts (cert, x509) = do when (raw opts) $ putStrLn $ hexdump $ L.fromChunks [cert] - when (asn1 opts) $ case decodeASN1Stream $ L.fromChunks [cert] of + when (asn1 opts) $ case decodeASN1' BER cert of Left err -> error ("decoding ASN1 failed: " ++ show err) Right asn1 -> showASN1 0 asn1 diff --git a/Data/Certificate/KeyDSA.hs b/Data/Certificate/KeyDSA.hs --- a/Data/Certificate/KeyDSA.hs +++ b/Data/Certificate/KeyDSA.hs @@ -13,8 +13,9 @@ , encodePrivate ) where -import Data.ASN1.DER (encodeASN1Stream, ASN1(..), ASN1ConstructionType(..)) -import Data.ASN1.BER (decodeASN1Stream) +import Data.ASN1.Stream +import Data.ASN1.Encoding +import Data.ASN1.BinaryEncoding import qualified Data.ByteString.Lazy as L import qualified Crypto.Types.PubKey.DSA as DSA @@ -34,13 +35,10 @@ parsePrivate _ = Left "unexpected format" decodePrivate :: L.ByteString -> Either String (DSA.PublicKey, DSA.PrivateKey) -decodePrivate dat = either (Left . show) parsePrivate $ decodeASN1Stream dat +decodePrivate dat = either (Left . show) parsePrivate $ decodeASN1 BER dat encodePrivate :: (DSA.PublicKey, DSA.PrivateKey) -> L.ByteString -encodePrivate (pubkey, privkey) = - case encodeASN1Stream pkseq of - Left err -> error $ show err - Right lbs -> lbs +encodePrivate (pubkey, privkey) = encodeASN1 DER pkseq where pkseq = [ Start Sequence , IntVal 0 diff --git a/Data/Certificate/KeyRSA.hs b/Data/Certificate/KeyRSA.hs --- a/Data/Certificate/KeyRSA.hs +++ b/Data/Certificate/KeyRSA.hs @@ -16,8 +16,9 @@ , parse_RSA ) where -import Data.ASN1.DER (encodeASN1Stream, ASN1(..), ASN1ConstructionType(..)) -import Data.ASN1.BER (decodeASN1Stream) +import Data.ASN1.Stream +import Data.ASN1.Encoding +import Data.ASN1.BinaryEncoding import Data.ASN1.BitArray import qualified Data.ByteString.Lazy as L import qualified Crypto.Types.PubKey.RSA as RSA @@ -34,28 +35,22 @@ parsePublic _ = Left "unexpected format" decodePublic :: L.ByteString -> Either String RSA.PublicKey -decodePublic dat = either (Left . show) parsePublic $ decodeASN1Stream dat +decodePublic dat = either (Left . show) parsePublic $ decodeASN1 BER dat encodePublic :: RSA.PublicKey -> L.ByteString -encodePublic p = - let innerSeq = encodeASN1Stream +encodePublic p = encodeASN1 DER [ Start Sequence - , IntVal $ RSA.public_n p - , IntVal $ RSA.public_e p + , Start Sequence + , OID [1,2,840,113549,1,1,1] -- PubKeyALG_RSA + , Null , End Sequence - ] - in case innerSeq of - Left err -> error $ show err - Right bs -> case encodeASN1Stream - [ Start Sequence - , Start Sequence - , OID [1,2,840,113549,1,1,1] -- PubKeyALG_RSA - , Null - , End Sequence - , BitString $ toBitArray bs 0 - , End Sequence ] of - Left err -> error $ show err - Right ibs -> ibs + , BitString $ toBitArray innerSeq 0 + , End Sequence ] + where innerSeq = encodeASN1 DER [ Start Sequence + , IntVal $ RSA.public_n p + , IntVal $ RSA.public_e p + , End Sequence + ] parsePrivate :: [ASN1] -> Either String (RSA.PublicKey, RSA.PrivateKey) parsePrivate @@ -89,13 +84,10 @@ parsePrivate _ = Left "unexpected format" decodePrivate :: L.ByteString -> Either String (RSA.PublicKey, RSA.PrivateKey) -decodePrivate dat = either (Left . show) parsePrivate $ decodeASN1Stream dat +decodePrivate dat = either (Left . show) parsePrivate $ decodeASN1 BER dat encodePrivate :: (RSA.PublicKey, RSA.PrivateKey) -> L.ByteString -encodePrivate (pubkey, privkey) = - case encodeASN1Stream pkseq of - Left err -> error $ show err - Right lbs -> lbs +encodePrivate (pubkey, privkey) = encodeASN1 DER pkseq where pkseq = [ Start Sequence , IntVal 0 @@ -114,7 +106,7 @@ - return RSA.PublicKey (len-modulus, modulus, e) if successful -} parse_RSA :: L.ByteString -> Either String RSA.PublicKey parse_RSA bits = - case decodeASN1Stream $ bits of + case decodeASN1 BER bits of Right [Start Sequence, IntVal modulus, IntVal pubexp, End Sequence] -> Right $ RSA.PublicKey { RSA.public_size = calculate_modulus modulus 1 diff --git a/Data/Certificate/X509.hs b/Data/Certificate/X509.hs --- a/Data/Certificate/X509.hs +++ b/Data/Certificate/X509.hs @@ -20,6 +20,7 @@ , OID , ASN1StringType(..) , ASN1String + , DistinguishedName , Certificate(..) , module Data.Certificate.X509.Ext @@ -36,9 +37,10 @@ ) where import Data.Word -import Data.ASN1.DER -import Data.ASN1.Stream (getConstructedEndRepr) -import Data.ASN1.Raw (toBytes) +import Data.ASN1.Encoding +import Data.ASN1.BinaryEncoding +import qualified Data.ASN1.BinaryEncoding.Raw as Raw (toLazyByteString) +import Data.ASN1.Stream import Data.ASN1.BitArray import qualified Data.ByteString.Lazy as L @@ -66,10 +68,8 @@ - which is either the cached data or the encoded certificate -} getSigningData :: X509 -> L.ByteString getSigningData (X509 _ (Just e) _ _ _) = e -getSigningData (X509 cert Nothing _ _ _) = e - where - (Right e) = encodeASN1Stream header - header = asn1Container Sequence $ encodeCertificateHeader cert +getSigningData (X509 cert Nothing _ _ _) = encodeASN1 DER header + where header = asn1Container Sequence $ encodeCertificateHeader cert {- | decode an X509 from a bytestring - the structure is the following: @@ -78,7 +78,7 @@ - Certificate Signature -} decodeCertificate :: L.ByteString -> Either String X509 -decodeCertificate by = either (Left . show) parseRootASN1 $ decodeASN1StreamRepr by +decodeCertificate by = either (Left . show) parseRootASN1 $ decodeASN1Repr BER by where {- | parse root structure of a x509 certificate. this has to be a sequence of 3 objects : - * the header @@ -91,7 +91,7 @@ let cert = onContainer certrepr (runParseASN1 parseCertificate . map fst) in case (cert, map fst sigseq) of (Right c, [BitString b]) -> - let certevs = toBytes $ concatMap snd certrepr in + let certevs = Raw.toLazyByteString $ concatMap snd certrepr in let sigalg = onContainer sigalgseq (parseSigAlg . map fst) in Right $ X509 c (Just certevs) (Just by) sigalg (L.unpack $ bitArrayGetData b) (Left err, _) -> Left $ ("certificate error: " ++ show err) @@ -111,17 +111,15 @@ {-| encode a X509 certificate to a bytestring -} encodeCertificate :: X509 -> L.ByteString encodeCertificate (X509 _ _ (Just lbs) _ _ ) = lbs -encodeCertificate (X509 cert _ Nothing sigalg sigbits) = case encodeASN1Stream rootSeq of - Right x -> x - Left err -> error (show err) +encodeCertificate (X509 cert _ Nothing sigalg sigbits) = encodeASN1 DER rootSeq where esigalg = asn1Container Sequence [OID (sigOID sigalg), Null] esig = BitString $ toBitArray (L.pack sigbits) 0 header = asn1Container Sequence $ encodeCertificateHeader cert rootSeq = asn1Container Sequence (header ++ esigalg ++ [esig]) -decodeDN :: L.ByteString -> Either String [(OID, ASN1String)] -decodeDN by = either (Left . show) (runParseASN1 parseDN) $ decodeASN1Stream by +decodeDN :: L.ByteString -> Either String DistinguishedName +decodeDN by = either (Left . show) (runParseASN1 parseDN) $ decodeASN1 BER by -encodeDN :: [(OID, ASN1String)] -> Either String L.ByteString -encodeDN dn = either (Left . show) Right $ encodeASN1Stream $ Cert.encodeDN dn +encodeDN :: DistinguishedName -> L.ByteString +encodeDN dn = encodeASN1 DER $ Cert.encodeDN dn diff --git a/Data/Certificate/X509/Cert.hs b/Data/Certificate/X509/Cert.hs --- a/Data/Certificate/X509/Cert.hs +++ b/Data/Certificate/X509/Cert.hs @@ -8,6 +8,7 @@ , ASN1StringType(..) , ASN1String , Certificate(..) + , DistinguishedName , OID -- various OID @@ -34,7 +35,9 @@ import Data.Word import Data.List (find, sortBy) -import Data.ASN1.DER +import Data.ASN1.Stream +import Data.ASN1.Encoding +import Data.ASN1.BinaryEncoding import Data.ASN1.BitArray import Data.Maybe import Data.Time.Calendar @@ -100,12 +103,14 @@ data ASN1StringType = UTF8 | Printable | Univ | BMP | IA5 | T61 deriving (Show,Eq) type ASN1String = (ASN1StringType, String) +type DistinguishedName = [(OID, ASN1String)] + data Certificate = Certificate { certVersion :: Int -- ^ Certificate Version , certSerial :: Integer -- ^ Certificate Serial number , certSignatureAlg :: SignatureALG -- ^ Certificate Signature algorithm - , certIssuerDN :: [ (OID, ASN1String) ] -- ^ Certificate Issuer DN - , certSubjectDN :: [ (OID, ASN1String) ] -- ^ Certificate Subject DN + , certIssuerDN :: DistinguishedName -- ^ Certificate Issuer DN + , certSubjectDN :: DistinguishedName -- ^ Certificate Subject DN , certValidity :: (Time, Time) -- ^ Certificate Validity period , certPubKey :: PubKey -- ^ Certificate Public key , certExtensions :: Maybe [ExtensionRaw] -- ^ Certificate Extensions @@ -119,7 +124,7 @@ parse_ECDSA :: ByteString -> ParseASN1 PubKey parse_ECDSA bits = - case decodeASN1Stream bits of + case decodeASN1 BER bits of Right l -> return $ PubKeyECDSA l Left _ -> return $ PubKeyUnknown (pubkeyalgOID PubKeyALG_ECDSA) (L.unpack bits) @@ -253,7 +258,7 @@ _ -> return $ PubKeyUnknown pkalg $ L.unpack bits [OID pkalg,Start Sequence,IntVal p,IntVal q,IntVal g,End Sequence] -> do let sig = oidPubKey pkalg - case decodeASN1Stream bits of + case decodeASN1 BER bits of Right [IntVal dsapub] -> return $ PubKeyDSA $ DSA.PublicKey { DSA.public_params = (p, q, g), DSA.public_y = dsapub } _ -> return $ PubKeyUnknown pkalg $ L.unpack bits @@ -273,10 +278,10 @@ if n then getNextContainer Sequence >>= \sq -> liftM (sq :) getSequences else return [] - extractExtension [OID oid,Boolean True,OctetString obj] = case decodeASN1Stream obj of + extractExtension [OID oid,Boolean True,OctetString obj] = case decodeASN1 BER obj of Left _ -> Nothing Right r -> Just (oid, True, r) - extractExtension [OID oid,OctetString obj] = case decodeASN1Stream obj of + extractExtension [OID oid,OctetString obj] = case decodeASN1 BER obj of Left _ -> Nothing Right r -> Just (oid, False, r) extractExtension _ = Nothing @@ -332,16 +337,16 @@ encodePK k@(PubKeyRSA pubkey) = asn1Container Sequence (asn1Container Sequence [pkalg,Null] ++ [BitString $ toBitArray bits 0]) where - pkalg = OID $ pubkeyalgOID $ pubkeyToAlg k - (Right bits) = encodeASN1Stream $ asn1Container Sequence [IntVal (RSA.public_n pubkey), IntVal (RSA.public_e pubkey)] + pkalg = OID $ pubkeyalgOID $ pubkeyToAlg k + bits = encodeASN1 DER $ asn1Container Sequence [IntVal (RSA.public_n pubkey), IntVal (RSA.public_e pubkey)] encodePK k@(PubKeyDSA pubkey) = asn1Container Sequence (asn1Container Sequence ([pkalg] ++ dsaseq) ++ [BitString $ toBitArray bits 0]) where - pkalg = OID $ pubkeyalgOID $ pubkeyToAlg k - dsaseq = asn1Container Sequence [IntVal p,IntVal q,IntVal g] - (p,q,g) = DSA.public_params pubkey - (Right bits) = encodeASN1Stream [IntVal $ DSA.public_y pubkey] + pkalg = OID $ pubkeyalgOID $ pubkeyToAlg k + dsaseq = asn1Container Sequence [IntVal p,IntVal q,IntVal g] + (p,q,g) = DSA.public_params pubkey + bits = encodeASN1 DER [IntVal $ DSA.public_y pubkey] encodePK k@(PubKeyUnknown _ l) = asn1Container Sequence (asn1Container Sequence [pkalg,Null] ++ [BitString $ toBitArray (L.pack l) 0]) @@ -351,9 +356,9 @@ encodeExts :: Maybe [ExtensionRaw] -> [ASN1] encodeExts Nothing = [] encodeExts (Just l) = asn1Container (Container Context 3) $ concatMap encodeExt l - where encodeExt (oid, critical, asn1) = case encodeASN1Stream asn1 of - Left _ -> error "cannot encode asn1 extension" - Right bs -> asn1Container Sequence ([OID oid] ++ (if critical then [Boolean True] else []) ++ [OctetString bs]) + where encodeExt (oid, critical, asn1) = + let bs = encodeASN1 DER asn1 + in asn1Container Sequence ([OID oid] ++ (if critical then [Boolean True] else []) ++ [OctetString bs]) encodeCertificateHeader :: Certificate -> [ASN1] encodeCertificateHeader cert = diff --git a/Data/Certificate/X509/Ext.hs b/Data/Certificate/X509/Ext.hs --- a/Data/Certificate/X509/Ext.hs +++ b/Data/Certificate/X509/Ext.hs @@ -24,7 +24,8 @@ import qualified Data.ByteString as B import qualified Data.ByteString.Char8 as BC import qualified Data.ByteString.Lazy as L -import Data.ASN1.DER +import Data.ASN1.Types +import Data.ASN1.Stream import Data.ASN1.BitArray import Data.Certificate.X509.Internal diff --git a/Data/Certificate/X509/Internal.hs b/Data/Certificate/X509/Internal.hs --- a/Data/Certificate/X509/Internal.hs +++ b/Data/Certificate/X509/Internal.hs @@ -1,87 +1,14 @@ -{-# LANGUAGE GeneralizedNewtypeDeriving #-} - module Data.Certificate.X509.Internal - ( ParseASN1 - , runParseASN1 - , onNextContainer - , onNextContainerMaybe - , getNextContainer - , getNextContainerMaybe - , getNext - , hasNext + ( module Data.ASN1.Parse , makeASN1Sequence , asn1Container , OID ) where -import Data.ASN1.DER -import Data.ASN1.Stream (getConstructedEnd) -import Control.Monad.State -import Control.Monad.Error +import Data.ASN1.Stream +import Data.ASN1.Parse type OID = [Integer] - -newtype ParseASN1 a = P { runP :: ErrorT String (State [ASN1]) a } - deriving (Functor, Monad, MonadError String) - -runParseASN1 :: ParseASN1 a -> [ASN1] -> Either String a -runParseASN1 f s = - case runState (runErrorT (runP f)) s of - (Left err, _) -> Left err - (Right r, _) -> Right r - -getNext :: ParseASN1 ASN1 -getNext = do - list <- P (lift get) - case list of - [] -> throwError "empty" - (h:l) -> P (lift (put l)) >> return h - -getNextContainer :: ASN1ConstructionType -> ParseASN1 [ASN1] -getNextContainer ty = do - list <- P (lift get) - case list of - [] -> throwError "empty" - (h:l) -> if h == Start ty - then do - let (l1, l2) = getConstructedEnd 0 l - P (lift $ put l2) >> return l1 - else throwError "not an expected container" - - -onNextContainer :: ASN1ConstructionType -> ParseASN1 a -> ParseASN1 a -onNextContainer ty f = do - n <- getNextContainer ty - case runParseASN1 f n of - Left err -> throwError err - Right r -> return r - -getNextContainerMaybe :: ASN1ConstructionType -> ParseASN1 (Maybe [ASN1]) -getNextContainerMaybe ty = do - list <- P (lift get) - case list of - [] -> return Nothing - (h:l) -> if h == Start ty - then do - let (l1, l2) = getConstructedEnd 0 l - P (lift $ put l2) >> return (Just l1) - else return Nothing - -onNextContainerMaybe :: ASN1ConstructionType -> ParseASN1 a -> ParseASN1 (Maybe a) -onNextContainerMaybe ty f = do - n <- getNextContainerMaybe ty - case n of - Just l -> case runParseASN1 f l of - Left err -> throwError err - Right r -> return $ Just r - Nothing -> return Nothing - -hasNext :: ParseASN1 Bool -hasNext = do - list <- P (lift get) - case list of - [] -> return False - _ -> return True asn1Container :: ASN1ConstructionType -> [ASN1] -> [ASN1] asn1Container ty l = [Start ty] ++ l ++ [End ty] diff --git a/certificate.cabal b/certificate.cabal --- a/certificate.cabal +++ b/certificate.cabal @@ -1,5 +1,5 @@ Name: certificate -Version: 1.2.5 +Version: 1.2.6 Description: Certificates and Key reader/writer . @@ -30,7 +30,7 @@ , bytestring , mtl , pem >= 0.1 && < 0.2 - , asn1-data >= 0.6.1.3 && < 0.7 + , asn1-data >= 0.7.1 , crypto-pubkey-types >= 0.1 && < 0.2 , directory , process