diff --git a/Data/X509/AlgorithmIdentifier.hs b/Data/X509/AlgorithmIdentifier.hs --- a/Data/X509/AlgorithmIdentifier.hs +++ b/Data/X509/AlgorithmIdentifier.hs @@ -102,7 +102,10 @@ instance ASN1Object SignatureALG where fromASN1 (Start Sequence:OID oid:Null:End Sequence:xs) = - Right (oidSig oid, xs) + case oidSig oid of + SignatureALG_IntrinsicHash _ -> + Left "fromASN1: X509.SignatureALG: EdDSA requires absent parameter" + signatureAlg -> Right (signatureAlg, xs) fromASN1 (Start Sequence:OID oid:End Sequence:xs) = Right (oidSig oid, xs) fromASN1 (Start Sequence:OID [1,2,840,113549,1,1,10]:Start Sequence:Start _:Start Sequence:OID hash1:End Sequence:End _:Start _:Start Sequence:OID [1,2,840,113549,1,1,8]:Start Sequence:OID _hash2:End Sequence:End Sequence:End _:Start _: IntVal _iv: End _: End Sequence : End Sequence:xs) = @@ -113,4 +116,5 @@ Left "fromASN1: X509.SignatureALG: unknown format" toASN1 (SignatureALG_Unknown oid) = \xs -> Start Sequence:OID oid:Null:End Sequence:xs toASN1 signatureAlg@(SignatureALG hashAlg PubKeyALG_RSAPSS) = \xs -> Start Sequence:OID [1,2,840,113549,1,1,10]:Start Sequence:Start (Container Context 0):Start Sequence:OID (sigOID signatureAlg):End Sequence:End (Container Context 0):Start (Container Context 1): Start Sequence:OID [1,2,840,113549,1,1,8]:Start Sequence:OID (sigOID signatureAlg):End Sequence:End Sequence:End (Container Context 1):Start (Container Context 2):IntVal (saltLen hashAlg):End (Container Context 2):End Sequence:End Sequence:xs + toASN1 signatureAlg@(SignatureALG_IntrinsicHash _) = \xs -> Start Sequence:OID (sigOID signatureAlg):End Sequence:xs toASN1 signatureAlg = \xs -> Start Sequence:OID (sigOID signatureAlg):Null:End Sequence:xs diff --git a/Data/X509/CRL.hs b/Data/X509/CRL.hs --- a/Data/X509/CRL.hs +++ b/Data/X509/CRL.hs @@ -48,14 +48,30 @@ toASN1 crl = encodeCRL crl fromASN1 = runParseASN1State parseCRL --- TODO support extension instance ASN1Object RevokedCertificate where - fromASN1 (Start Sequence : IntVal serial : ASN1Time _ t _ : End Sequence : xs) = - Right (RevokedCertificate serial t (Extensions Nothing), xs) - fromASN1 l = Left ("fromASN1: X509.RevokedCertificate: unknown format:" ++ show l) - toASN1 (RevokedCertificate serial time _) = \xs -> - Start Sequence : IntVal serial : ASN1Time TimeGeneralized time (Just (TimezoneOffset 0)) : End Sequence : xs + fromASN1 = runParseASN1State $ + onNextContainer Sequence $ + RevokedCertificate + <$> parseSerialNumber + <*> (getNext >>= toTime) + <*> getObject + where toTime (ASN1Time _ t _) = pure t + toTime _ = throwParseError "bad revocation date" + toASN1 (RevokedCertificate serial time crlEntryExtensions) = \xs -> + [ Start Sequence ] ++ + [ IntVal serial ] ++ + [ ASN1Time TimeGeneralized time (Just (TimezoneOffset 0)) ] ++ + toASN1 crlEntryExtensions [] ++ + [ End Sequence ] ++ + xs +parseSerialNumber :: ParseASN1 Integer +parseSerialNumber = do + n <- getNext + case n of + IntVal v -> return v + _ -> throwParseError ("missing serial" ++ show n) + parseCRL :: ParseASN1 CRL parseCRL = do CRL <$> (getNext >>= getVersion) @@ -63,8 +79,8 @@ <*> getObject <*> (getNext >>= getThisUpdate) <*> getNextUpdate - <*> getRevokedCertificates - <*> getObject + <*> parseRevokedCertificates + <*> parseCRLExtensions where getVersion (IntVal v) = return $ fromIntegral v getVersion _ = throwParseError "unexpected type for version" @@ -76,8 +92,16 @@ timeOrNothing (ASN1Time _ tnext _) = Just tnext timeOrNothing _ = Nothing - getRevokedCertificates = onNextContainer Sequence $ getMany getObject +parseRevokedCertificates :: ParseASN1 [RevokedCertificate] +parseRevokedCertificates = + fmap (maybe [] id) $ onNextContainerMaybe Sequence $ getMany getObject +parseCRLExtensions :: ParseASN1 Extensions +parseCRLExtensions = + fmap adapt $ onNextContainerMaybe (Container Context 0) $ getObject + where adapt (Just e) = e + adapt Nothing = Extensions Nothing + encodeCRL :: CRL -> ASN1S encodeCRL crl xs = [IntVal $ crlVersion crl] ++ @@ -85,10 +109,11 @@ toASN1 (crlIssuer crl) [] ++ [ASN1Time TimeGeneralized (crlThisUpdate crl) (Just (TimezoneOffset 0))] ++ (maybe [] (\t -> [ASN1Time TimeGeneralized t (Just (TimezoneOffset 0))]) (crlNextUpdate crl)) ++ - [Start Sequence] ++ - revoked ++ - [End Sequence] ++ - toASN1 (crlExtensions crl) [] ++ + maybeRevoked (crlRevokedCertificates crl) ++ + maybeCrlExts (crlExtensions crl) ++ xs where - revoked = concatMap (\e -> toASN1 e []) (crlRevokedCertificates crl) + maybeRevoked [] = [] + maybeRevoked xs' = asn1Container Sequence $ concatMap (\e -> toASN1 e []) xs' + maybeCrlExts (Extensions Nothing) = [] + maybeCrlExts exts = asn1Container (Container Context 0) $ toASN1 exts [] diff --git a/Data/X509/Cert.hs b/Data/X509/Cert.hs --- a/Data/X509/Cert.hs +++ b/Data/X509/Cert.hs @@ -85,6 +85,12 @@ Subject Unique Identifier (Optional) (>= 2) Extensions (Optional) (>= v3) -} + +parseExtensions :: ParseASN1 Extensions +parseExtensions = fmap adapt $ onNextContainerMaybe (Container Context 3) $ getObject + where adapt (Just e) = e + adapt Nothing = Extensions Nothing + parseCertificate :: ParseASN1 Certificate parseCertificate = Certificate <$> parseCertHeaderVersion @@ -94,7 +100,7 @@ <*> parseCertHeaderValidity <*> getObject <*> getObject - <*> getObject + <*> parseExtensions encodeCertificateHeader :: Certificate -> [ASN1] encodeCertificateHeader cert = @@ -108,7 +114,9 @@ ,ASN1Time (timeType t2) t2 (Just (TimezoneOffset 0))] eSubject = toASN1 (certSubjectDN cert) [] epkinfo = toASN1 (certPubKey cert) [] - eexts = toASN1 (certExtensions cert) [] + eexts = case certExtensions cert of + Extensions Nothing -> [] + exts -> asn1Container (Container Context 3) $ toASN1 exts [] timeType t = if t >= timeConvert (Date 2050 January 1) then TimeGeneralized diff --git a/Data/X509/ExtensionRaw.hs b/Data/X509/ExtensionRaw.hs --- a/Data/X509/ExtensionRaw.hs +++ b/Data/X509/ExtensionRaw.hs @@ -45,10 +45,9 @@ instance ASN1Object Extensions where toASN1 (Extensions Nothing) = \xs -> xs toASN1 (Extensions (Just exts)) = \xs -> - asn1Container (Container Context 3) (asn1Container Sequence (concatMap encodeExt exts)) ++ xs + asn1Container Sequence (concatMap encodeExt exts) ++ xs fromASN1 s = runParseASN1State (Extensions <$> parseExtensions) s - where parseExtensions = onNextContainerMaybe (Container Context 3) $ - onNextContainer Sequence (getMany getObject) + where parseExtensions = onNextContainerMaybe Sequence (getMany getObject) instance ASN1Object ExtensionRaw where toASN1 extraw = \xs -> encodeExt extraw ++ xs diff --git a/Data/X509/PublicKey.hs b/Data/X509/PublicKey.hs --- a/Data/X509/PublicKey.hs +++ b/Data/X509/PublicKey.hs @@ -35,6 +35,7 @@ import qualified Crypto.PubKey.Curve448 as X448 import qualified Crypto.PubKey.Ed25519 as Ed25519 import qualified Crypto.PubKey.Ed448 as Ed448 +import Crypto.Number.Basic (numBytes) import Crypto.Number.Serialize (os2ip) import Data.Word @@ -234,11 +235,10 @@ rsaPubFromASN1 (Start Sequence:IntVal smodulus:IntVal pubexp:End Sequence:xs) = Right (pub, xs) where - pub = RSA.PublicKey { RSA.public_size = calculate_modulus modulus 1 + pub = RSA.PublicKey { RSA.public_size = numBytes modulus , RSA.public_n = modulus , RSA.public_e = pubexp } - calculate_modulus n i = if (2 ^ (i * 8)) > n then i else calculate_modulus n (i+1) -- some bad implementation will not serialize ASN.1 integer properly, leading -- to negative modulus. if that's the case, we correct it. modulus = toPositive smodulus diff --git a/Tests/Tests.hs b/Tests/Tests.hs --- a/Tests/Tests.hs +++ b/Tests/Tests.hs @@ -179,7 +179,7 @@ instance Arbitrary RevokedCertificate where arbitrary = RevokedCertificate <$> arbitrary <*> arbitrary - <*> pure (Extensions Nothing) + <*> arbitrary instance Arbitrary CRL where arbitrary = CRL <$> pure 1 diff --git a/x509.cabal b/x509.cabal --- a/x509.cabal +++ b/x509.cabal @@ -1,5 +1,5 @@ Name: x509 -version: 1.7.5 +version: 1.7.6 Description: X509 reader and writer. please see README License: BSD3 License-file: LICENSE