Attachment 140369 Details for Bug 107055 – certificateinfo class

[patch] certificateinfo class

001-CertificateInfo.patch (text/plain), 10.37 KB, created by Chinmoy on 2018-06-27 17:29:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chinmoy

Created: 2018-06-27 17:29:40 UTC

Size: 10.37 KB

patch

obsolete

>From 13aa32dde99cc398772f490c24af6dbfd529ef35 Mon Sep 17 00:00:00 2001
>From: Chinmoy Ranjan Pradhan <chinmoyrp65@protonmail.com>
>Date: Sun, 24 Jun 2018 05:16:18 +0000
>Subject: [PATCH] Add helper class CertificateInfo
>
>This class will be used to store details of a digital certificate.
>---
> poppler/Form.cc             |   3 +-
> poppler/SignatureHandler.cc |  59 +++++++++++++++++++
> poppler/SignatureHandler.h  |   3 +
> poppler/SignatureInfo.cc    | 114 ++++++++++++++++++++++++++++++++++++
> poppler/SignatureInfo.h     |  58 ++++++++++++++++++
> 5 files changed, 236 insertions(+), 1 deletion(-)
>
>diff --git a/poppler/Form.cc b/poppler/Form.cc
>index 820944e8..17e42536 100644
>--- a/poppler/Form.cc
>+++ b/poppler/Form.cc
>@@ -1735,6 +1735,8 @@ SignatureInfo *FormFieldSignature::validateSignature(bool doVerifyCert, bool for
>   memcpy(signatureuchar, signature->getCString(), signature_len);
>   SignatureHandler signature_handler(signatureuchar, signature_len);
> 
>+  signature_info->setCertificateInfo(signature_handler.getCertificateInfo());
>+
>   Goffset fileLength = doc->getBaseStream()->getLength();
>   for (int i = 0; i < arrayLen/2; i++) {
>     Object offsetObj = byte_range.arrayGet(i*2);
>@@ -1774,7 +1776,6 @@ SignatureInfo *FormFieldSignature::validateSignature(bool doVerifyCert, bool for
> 
>   cert_val_state = signature_handler.validateCertificate(validationTime);
>   signature_info->setCertificateValStatus(SignatureHandler::NSS_CertTranslate(cert_val_state));
>-
> #endif
>   return signature_info;
> }
>diff --git a/poppler/SignatureHandler.cc b/poppler/SignatureHandler.cc
>index 6ddd1a84..87b01e19 100644
>--- a/poppler/SignatureHandler.cc
>+++ b/poppler/SignatureHandler.cc
>@@ -18,6 +18,7 @@
> #include "SignatureHandler.h"
> #include "goo/gmem.h"
> #include <secmod.h>
>+#include <keyhi.h>
> 
> #include <dirent.h>
> #include <Error.h>
>@@ -78,6 +79,56 @@ time_t SignatureHandler::getSigningTime()
>   return static_cast<time_t>(sTime/1000000);
> }
> 
>+ X509CertificateInfo *SignatureHandler::getCertificateInfo()
>+{
>+  if (!CMSSignerInfo)
>+    return nullptr;
>+
>+  X509CertificateInfo *cert_info = new X509CertificateInfo;
>+  if (!cert_info)
>+    return nullptr;
>+
>+  CERTCertificate *cert = NSS_CMSSignerInfo_GetSigningCertificate(CMSSignerInfo, CERT_GetDefaultCertDB());
>+  if (!cert)
>+    return nullptr;
>+
>+  cert_info->setVersion(SECItemToCertItem(cert->version));
>+  cert_info->setSerialNumber(SECItemToCertItem(cert->serialNumber));
>+  cert_info->setCertDER(SECItemToCertItem(cert->derCert));
>+  cert_info->setIssuerName(CERT_GetCommonName(&cert->issuer));
>+  cert_info->setIssuerDN(cert->issuerName);
>+  cert_info->setKeyUsages(cert->keyUsage);
>+
>+  PRTime notBefore, notAfter;
>+  CERT_GetCertTimes(cert, &notBefore, &notAfter);
>+  X509CertificateInfo::Validity certValidity;
>+  certValidity.notBefore = static_cast<time_t>(notBefore);
>+  certValidity.notAfter = static_cast<time_t>(notAfter);
>+  cert_info->setValidity(certValidity);
>+
>+  X509CertificateInfo::PublicKeyInfo pkInfo;
>+  SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
>+  switch (pk->keyType) {
>+  case rsaKey:
>+      pkInfo.publicKey = SECItemToCertItem(pk->u.rsa.modulus);
>+      break;
>+  case dsaKey:
>+      pkInfo.publicKey = SECItemToCertItem(pk->u.dsa.publicValue);
>+      break;
>+  case ecKey:
>+      pkInfo.publicKey = SECItemToCertItem(pk->u.ec.publicValue);
>+      break;
>+  default:
>+      pkInfo.publicKey = SECItemToCertItem(cert->subjectPublicKeyInfo.subjectPublicKey);
>+      break;
>+  }
>+  pkInfo.publicKeyType = pk->keyType;
>+  pkInfo.publicKeyStrength = SECKEY_PublicKeyStrengthInBits(pk);
>+  PORT_FreeArena(pk->arena, PR_TRUE);
>+
>+  return cert_info;
>+}
>+
> 
> GooString *SignatureHandler::getDefaultFirefoxCertDB_Linux()
> {
>@@ -370,3 +421,11 @@ CertificateValidationStatus SignatureHandler::NSS_CertTranslate(SECErrorCodes ns
>       return CERTIFICATE_GENERIC_ERROR;
>   }
> }
>+
>+X509CertificateInfo::CertItem SignatureHandler::SECItemToCertItem(SECItem secItem)
>+{
>+    X509CertificateInfo::CertItem certItem;
>+    certItem.data = reinterpret_cast<const char *>(secItem.data);
>+    certItem.len = secItem.len;
>+    return certItem;
>+}
>diff --git a/poppler/SignatureHandler.h b/poppler/SignatureHandler.h
>index 3b2f62b9..5cbeedfd 100644
>--- a/poppler/SignatureHandler.h
>+++ b/poppler/SignatureHandler.h
>@@ -44,11 +44,14 @@ public:
>   NSSCMSVerificationStatus validateSignature();
>   // Use -1 as validation_time for now
>   SECErrorCodes validateCertificate(time_t validation_time);
>+  X509CertificateInfo *getCertificateInfo();
> 
>   //Translate NSS error codes
>   static SignatureValidationStatus NSS_SigTranslate(NSSCMSVerificationStatus nss_code);
>   static CertificateValidationStatus NSS_CertTranslate(SECErrorCodes nss_code);
> 
>+  static X509CertificateInfo::CertItem SECItemToCertItem(SECItem secItem);
>+
> private:
>   SignatureHandler(const SignatureHandler &);
>   SignatureHandler& operator=(const SignatureHandler &);
>diff --git a/poppler/SignatureInfo.cc b/poppler/SignatureInfo.cc
>index 7ca8b969..0807e5e8 100644
>--- a/poppler/SignatureInfo.cc
>+++ b/poppler/SignatureInfo.cc
>@@ -35,6 +35,7 @@ SignatureInfo::SignatureInfo()
>   hash_type = HASH_AlgNULL;
>   signing_time = 0;
>   sig_subfilter_supported = false;
>+  cert_info = nullptr;
> }
> 
> SignatureInfo::SignatureInfo(SignatureValidationStatus sig_val_status, CertificateValidationStatus cert_val_status)
>@@ -46,11 +47,14 @@ SignatureInfo::SignatureInfo(SignatureValidationStatus sig_val_status, Certifica
>   hash_type = HASH_AlgNULL;
>   signing_time = 0;
>   sig_subfilter_supported = false;
>+  cert_info = nullptr;
> }
> 
> SignatureInfo::~SignatureInfo()
> {
>   free(signer_name);
>+  if (cert_info)
>+    delete cert_info;
> }
> 
> /* GETTERS */
>@@ -85,6 +89,11 @@ time_t SignatureInfo::getSigningTime()
>   return signing_time;
> }
> 
>+X509CertificateInfo *SignatureInfo::getCertificateInfo()
>+{
>+  return cert_info;
>+}
>+
> /* SETTERS */
> 
> void SignatureInfo::setSignatureValStatus(enum SignatureValidationStatus sig_val_status)
>@@ -117,3 +126,108 @@ void SignatureInfo::setSigningTime(time_t signingTime)
> {
>   signing_time = signingTime;
> }
>+
>+void SignatureInfo::setCertificateInfo(X509CertificateInfo *certInfo)
>+{
>+  if (cert_info)
>+    delete cert_info;
>+  cert_info = certInfo;
>+}
>+
>+X509CertificateInfo::X509CertificateInfo()
>+{
>+    memset(&cert_pub_key_info, 0, sizeof cert_pub_key_info);
>+    memset(&cert_validity, 0, sizeof cert_validity);
>+    memset(&cert_version, 0, sizeof cert_version);
>+    memset(&cert_serial, 0, sizeof cert_serial);
>+    memset(&cert_der, 0, sizeof cert_der);
>+    cert_key_usages = 0;
>+    issuer_name = nullptr;
>+    issuer_dn = nullptr;
>+}
>+
>+X509CertificateInfo::~X509CertificateInfo()
>+{
>+  free(issuer_name);
>+}
>+
>+X509CertificateInfo::CertItem X509CertificateInfo::getVersion()
>+{
>+  return cert_version;
>+}
>+
>+const char *X509CertificateInfo::getIssuerName()
>+{
>+  return issuer_name;
>+}
>+
>+const char *X509CertificateInfo::getIssuerDN()
>+{
>+  return issuer_dn;
>+}
>+
>+X509CertificateInfo::CertItem X509CertificateInfo::getSerialNumber()
>+{
>+  return cert_serial;
>+}
>+
>+X509CertificateInfo::Validity X509CertificateInfo::getValidity()
>+{
>+  return cert_validity;
>+}
>+
>+unsigned int X509CertificateInfo::getKeyUsages()
>+{
>+  return cert_key_usages;
>+}
>+
>+X509CertificateInfo::PublicKeyInfo X509CertificateInfo::getPublicKeyInfo()
>+{
>+  return cert_pub_key_info;
>+}
>+
>+X509CertificateInfo::CertItem X509CertificateInfo::getCertDER()
>+{
>+  return cert_der;
>+}
>+
>+void X509CertificateInfo::setVersion(CertItem version)
>+{
>+  cert_version = version;
>+}
>+
>+void X509CertificateInfo::setIssuerName(char *issuerName)
>+{
>+  free(issuer_name);
>+  issuer_name = issuerName;
>+}
>+
>+void X509CertificateInfo::setIssuerDN(const char *issuerDN)
>+{
>+  issuer_dn = issuerDN;
>+}
>+
>+void X509CertificateInfo::setSerialNumber(CertItem serial)
>+{
>+  cert_serial = serial;
>+}
>+
>+void X509CertificateInfo::setValidity(Validity validity)
>+{
>+  cert_validity = validity;
>+}
>+
>+void X509CertificateInfo::setKeyUsages(unsigned int keyUsages)
>+{
>+  cert_key_usages = keyUsages;
>+}
>+
>+void X509CertificateInfo::setPublicKeyInfo(PublicKeyInfo pkInfo)
>+{
>+  cert_pub_key_info = pkInfo;
>+}
>+
>+void X509CertificateInfo::setCertDER(CertItem derCert)
>+{
>+  cert_der = derCert;
>+}
>diff --git a/poppler/SignatureInfo.h b/poppler/SignatureInfo.h
>index 35e7568c..86a8cbf6 100644
>--- a/poppler/SignatureInfo.h
>+++ b/poppler/SignatureInfo.h
>@@ -38,6 +38,61 @@ enum CertificateValidationStatus
>   CERTIFICATE_NOT_VERIFIED
> };
> 
>+class X509CertificateInfo {
>+public:
>+  X509CertificateInfo();
>+  ~X509CertificateInfo();
>+
>+  typedef struct {
>+    const char *data;
>+    unsigned int len;
>+  } CertItem;
>+
>+  typedef struct {
>+    CertItem publicKey;
>+    unsigned int publicKeyType;
>+    unsigned int publicKeyStrength; // in bits
>+  } PublicKeyInfo;
>+
>+  typedef struct {
>+    time_t notBefore;
>+    time_t notAfter;
>+  } Validity;
>+
>+  /* GETTERS */
>+  CertItem getVersion();
>+  const char *getIssuerName();
>+  const char *getIssuerDN();
>+  CertItem getSerialNumber();
>+  Validity getValidity();
>+  unsigned int getKeyUsages();
>+  PublicKeyInfo getPublicKeyInfo();
>+  CertItem getCertDER();
>+
>+  /* SETTERS */
>+  void setVersion(CertItem);
>+  void setIssuerName(char *);
>+  void setIssuerDN(const char *);
>+  void setSerialNumber(CertItem);
>+  void setValidity(Validity);
>+  void setKeyUsages(unsigned int);
>+  void setPublicKeyInfo(PublicKeyInfo);
>+  void setCertDER(CertItem);
>+
>+private:
>+  X509CertificateInfo(const X509CertificateInfo &);
>+  X509CertificateInfo& operator=(const X509CertificateInfo &);
>+
>+  PublicKeyInfo cert_pub_key_info;
>+  Validity cert_validity;
>+  CertItem cert_version;
>+  CertItem cert_serial;
>+  CertItem cert_der;
>+  unsigned int cert_key_usages;
>+  const char *issuer_dn;
>+  char *issuer_name;
>+};
>+
> class SignatureInfo {
> public:
>   SignatureInfo();
>@@ -52,6 +107,7 @@ public:
>   int getHashAlgorithm(); // Returns a NSS3 HASH_HashType or -1 if compiled without NSS3
>   time_t getSigningTime();
>   bool isSubfilterSupported() { return sig_subfilter_supported; }
>+  X509CertificateInfo *getCertificateInfo();
> 
>   /* SETTERS */
>   void setSignatureValStatus(enum SignatureValidationStatus );
>@@ -61,6 +117,7 @@ public:
>   void setHashAlgorithm(int);
>   void setSigningTime(time_t);
>   void setSubFilterSupport(bool isSupported) { sig_subfilter_supported = isSupported; }
>+  void setCertificateInfo(X509CertificateInfo *);
> 
> private:
>   SignatureInfo(const SignatureInfo &);
>@@ -73,6 +130,7 @@ private:
>   int hash_type;
>   time_t signing_time;
>   bool sig_subfilter_supported;
>+  X509CertificateInfo *cert_info;
> };
> 
> #endif
>-- 
>2.17.0
>

Actions: View | Splinter Review

Attachments on bug 107055: 140369 | 140670 | 140671 | 140739 | 141082

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.