mirror of https://github.com/namecoin/ncdns
Merge #101: Move x509 subpackage to its own repo
7db5b5a Move x509 subpackage to its own repo (JeremyRand)
Pull request description:
This avoids tying the ncdns repo to a specific Go version; we can maintain separate branches of the x509-signature-splice repo per Go version with much less hassle.
ACKs for commit 7db5b5:
Tree-SHA512: e6d784c6b344d46955d0ca275174772b6da6bf86bfa84e03a5a59faa9f0a88805d32ecfe29d83970c61246904e1025859dd4cff031ec8052b8f544867c55bf21
JeremyRand
5 years ago
commit
13500dbc55
@ -1,17 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -eu -o pipefail
|
||||
shopt -s failglob
|
||||
|
||||
cp -a $(go env GOROOT)/src/crypto/x509/* ./
|
||||
rm ./x509_test.go
|
||||
|
||||
# Stdlib x509 relies on "internal" packages in Go, which aren't importable
|
||||
# outside of stdlib. So we copy those packages and rename them.
|
||||
OLD_INTERNAL_PATH=$(go env GOROOT)/src/internal/x/crypto/cryptobyte
|
||||
NEW_INTERNAL_PATH=$(go env GOPATH)/src/github.com/namecoin/ncdns/x509/golang/x/crypto/cryptobyte
|
||||
mkdir -p ${NEW_INTERNAL_PATH}/
|
||||
cp -R ${OLD_INTERNAL_PATH}/* ${NEW_INTERNAL_PATH}/
|
||||
OLD_PACKAGE='"internal/x/crypto/cryptobyte'
|
||||
NEW_PACKAGE='"github.com/namecoin/ncdns/x509/golang/x/crypto/cryptobyte'
|
||||
sed -i "s_${OLD_PACKAGE}_${NEW_PACKAGE}_g" ./*.go ${NEW_INTERNAL_PATH}/*.go
|
||||
@ -1,192 +0,0 @@
|
||||
// Copyright 2009 The Go Authors. All rights reserved.
|
||||
// Modifications Copyright 2015-2019 Jeremy Rand. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// This code is modified from the stock CreateCertificate to use a
|
||||
// pre-existing signature.
|
||||
|
||||
// Last rebased on Go 1.12
|
||||
// Remove all content between "import" and "CreateCertificate" in original.
|
||||
// Remove all content after "CreateCertificate" in original.
|
||||
//go:generate bash install.sh
|
||||
|
||||
// Package x509 parses X.509-encoded keys and certificates.
|
||||
//
|
||||
// On UNIX systems the environment variables SSL_CERT_FILE and SSL_CERT_DIR
|
||||
// can be used to override the system default locations for the SSL certificate
|
||||
// file and SSL certificate files directory, respectively.
|
||||
package x509
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
//"crypto"
|
||||
//"crypto/dsa"
|
||||
//"crypto/ecdsa"
|
||||
//"crypto/elliptic"
|
||||
//"crypto/rsa"
|
||||
_ "crypto/sha1"
|
||||
_ "crypto/sha256"
|
||||
_ "crypto/sha512"
|
||||
//"crypto/x509/pkix"
|
||||
"encoding/asn1"
|
||||
//"encoding/pem"
|
||||
"errors"
|
||||
//"fmt"
|
||||
//"internal/x/crypto/cryptobyte"
|
||||
//cryptobyte_asn1 "internal/x/crypto/cryptobyte/asn1"
|
||||
//"io"
|
||||
//"math/big"
|
||||
//"net"
|
||||
//"net/url"
|
||||
//"strconv"
|
||||
//"strings"
|
||||
//"time"
|
||||
//"unicode/utf8"
|
||||
)
|
||||
|
||||
// CreateCertificate creates a new X.509v3 certificate based on a template.
|
||||
// The following members of template are used:
|
||||
//
|
||||
// - AuthorityKeyId
|
||||
// - BasicConstraintsValid
|
||||
// - CRLDistributionPoints
|
||||
// - DNSNames
|
||||
// - EmailAddresses
|
||||
// - ExcludedDNSDomains
|
||||
// - ExcludedEmailAddresses
|
||||
// - ExcludedIPRanges
|
||||
// - ExcludedURIDomains
|
||||
// - ExtKeyUsage
|
||||
// - ExtraExtensions
|
||||
// - IsCA
|
||||
// - IssuingCertificateURL
|
||||
// - KeyUsage
|
||||
// - MaxPathLen
|
||||
// - MaxPathLenZero
|
||||
// - NotAfter
|
||||
// - NotBefore
|
||||
// - OCSPServer
|
||||
// - PermittedDNSDomains
|
||||
// - PermittedDNSDomainsCritical
|
||||
// - PermittedEmailAddresses
|
||||
// - PermittedIPRanges
|
||||
// - PermittedURIDomains
|
||||
// - PolicyIdentifiers
|
||||
// - SerialNumber
|
||||
// - SignatureAlgorithm
|
||||
// - Subject
|
||||
// - SubjectKeyId
|
||||
// - URIs
|
||||
// - UnknownExtKeyUsage
|
||||
//
|
||||
// The certificate is signed by parent. If parent is equal to template then the
|
||||
// certificate is self-signed. The parameter pub is the public key of the
|
||||
// signee and priv is the private key of the signer.
|
||||
//
|
||||
// The returned slice is the certificate in DER encoding.
|
||||
//
|
||||
// All keys types that are implemented via crypto.Signer are supported (This
|
||||
// includes *rsa.PublicKey and *ecdsa.PublicKey.)
|
||||
//
|
||||
// The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
|
||||
// unless the resulting certificate is self-signed. Otherwise the value from
|
||||
// template will be used.
|
||||
//func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) {
|
||||
func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert []byte, err error) {
|
||||
//key, ok := priv.(crypto.Signer)
|
||||
//if !ok {
|
||||
// return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
|
||||
//}
|
||||
|
||||
if template.SerialNumber == nil {
|
||||
return nil, errors.New("x509: no SerialNumber given")
|
||||
}
|
||||
|
||||
//hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
|
||||
//if err != nil {
|
||||
// return nil, err
|
||||
//}
|
||||
|
||||
// This block added
|
||||
_, signatureAlgorithm, err := signingParamsForPublicKey(parent.PublicKey, template.SignatureAlgorithm)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// This line added
|
||||
pub := template.PublicKey
|
||||
|
||||
publicKeyBytes, publicKeyAlgorithm, err := marshalPublicKey(pub)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
asn1Issuer, err := subjectBytes(parent)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
asn1Subject, err := subjectBytes(template)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
authorityKeyId := template.AuthorityKeyId
|
||||
if !bytes.Equal(asn1Issuer, asn1Subject) && len(parent.SubjectKeyId) > 0 {
|
||||
authorityKeyId = parent.SubjectKeyId
|
||||
}
|
||||
|
||||
extensions, err := buildExtensions(template, bytes.Equal(asn1Subject, emptyASN1Subject), authorityKeyId)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
encodedPublicKey := asn1.BitString{BitLength: len(publicKeyBytes) * 8, Bytes: publicKeyBytes}
|
||||
c := tbsCertificate{
|
||||
Version: 2,
|
||||
SerialNumber: template.SerialNumber,
|
||||
SignatureAlgorithm: signatureAlgorithm,
|
||||
Issuer: asn1.RawValue{FullBytes: asn1Issuer},
|
||||
Validity: validity{template.NotBefore.UTC(), template.NotAfter.UTC()},
|
||||
Subject: asn1.RawValue{FullBytes: asn1Subject},
|
||||
PublicKey: publicKeyInfo{nil, publicKeyAlgorithm, encodedPublicKey},
|
||||
Extensions: extensions,
|
||||
}
|
||||
|
||||
tbsCertContents, err := asn1.Marshal(c)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
c.Raw = tbsCertContents
|
||||
|
||||
//h := hashFunc.New()
|
||||
//h.Write(tbsCertContents)
|
||||
//digest := h.Sum(nil)
|
||||
|
||||
//var signerOpts crypto.SignerOpts
|
||||
//signerOpts = hashFunc
|
||||
//if template.SignatureAlgorithm != 0 && template.SignatureAlgorithm.isRSAPSS() {
|
||||
// signerOpts = &rsa.PSSOptions{
|
||||
// SaltLength: rsa.PSSSaltLengthEqualsHash,
|
||||
// Hash: hashFunc,
|
||||
// }
|
||||
//}
|
||||
|
||||
//var signature []byte
|
||||
//signature, err = key.Sign(rand, digest, signerOpts)
|
||||
//if err != nil {
|
||||
// return
|
||||
//}
|
||||
|
||||
// This line added
|
||||
signature := template.Signature
|
||||
|
||||
return asn1.Marshal(certificate{
|
||||
nil,
|
||||
c,
|
||||
signatureAlgorithm,
|
||||
asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
|
||||
})
|
||||
}
|
||||
Loading…
Reference in New Issue