mirror/gmsm
1
0
Fork 0
mirror of https://github.com/emmansun/gmsm.git synced 2025-04-26 20:26:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Alias x509 types

Browse Source
This commit is contained in:
徐胖 2022-01-20 18:30:47 +08:00
parent 20dbdcd08f
commit a6a596c3f9
5 changed files with 33 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
smx509/root_windows.go
View File

@ -92,9 +92,9 @@ func checkChainTrustStatus(c *Certificate, chainCtx *syscall.CertChainContext) e
status := chainCtx.TrustStatus.ErrorStatus status := chainCtx.TrustStatus.ErrorStatus
switch status { switch status {
case syscall.CERT_TRUST_IS_NOT_TIME_VALID: case syscall.CERT_TRUST_IS_NOT_TIME_VALID:
return x509.CertificateInvalidError{&c.Certificate, x509.Expired, ""} return x509.CertificateInvalidError{c.asX509(), x509.Expired, ""}
case syscall.CERT_TRUST_IS_NOT_VALID_FOR_USAGE: case syscall.CERT_TRUST_IS_NOT_VALID_FOR_USAGE:
return x509.CertificateInvalidError{&c.Certificate, x509.IncompatibleUsage, ""} return x509.CertificateInvalidError{c.asX509(), x509.IncompatibleUsage, ""}
// TODO(filippo): surface more error statuses. // TODO(filippo): surface more error statuses.
default: default:
return UnknownAuthorityError{c, nil, nil} return UnknownAuthorityError{c, nil, nil}
@ -133,9 +133,9 @@ func checkChainSSLServerPolicy(c *Certificate, chainCtx *syscall.CertChainContex
if status.Error != 0 { if status.Error != 0 {
switch status.Error { switch status.Error {
case syscall.CERT_E_EXPIRED: case syscall.CERT_E_EXPIRED:
return x509.CertificateInvalidError{Cert: &c.Certificate, Reason: x509.Expired, Detail: ""} return x509.CertificateInvalidError{Cert: c.asX509(), Reason: x509.Expired, Detail: ""}
case syscall.CERT_E_CN_NO_MATCH: case syscall.CERT_E_CN_NO_MATCH:
return x509.HostnameError{Certificate: &c.Certificate, Host: opts.DNSName} return x509.HostnameError{Certificate: c.asX509(), Host: opts.DNSName}
case syscall.CERT_E_UNTRUSTEDROOT: case syscall.CERT_E_UNTRUSTEDROOT:
return UnknownAuthorityError{c, nil, nil} return UnknownAuthorityError{c, nil, nil}
default: default:

28
smx509/verify.go
View File

@ -246,18 +246,18 @@ func (c *Certificate) checkNameConstraints(count *int,
*count += excludedValue.Len() *count += excludedValue.Len()
if *count > maxConstraintComparisons { if *count > maxConstraintComparisons {
return x509.CertificateInvalidError{&c.Certificate, x509.TooManyConstraints, ""} return x509.CertificateInvalidError{c.asX509(), x509.TooManyConstraints, ""}
} }
for i := 0; i < excludedValue.Len(); i++ { for i := 0; i < excludedValue.Len(); i++ {
constraint := excludedValue.Index(i).Interface() constraint := excludedValue.Index(i).Interface()
match, err := match(parsedName, constraint) match, err := match(parsedName, constraint)
if err != nil { if err != nil {
return x509.CertificateInvalidError{&c.Certificate, x509.CANotAuthorizedForThisName, err.Error()} return x509.CertificateInvalidError{c.asX509(), x509.CANotAuthorizedForThisName, err.Error()}
} }
if match { if match {
return x509.CertificateInvalidError{&c.Certificate, x509.CANotAuthorizedForThisName, fmt.Sprintf("%s %q is excluded by constraint %q", nameType, name, constraint)} return x509.CertificateInvalidError{c.asX509(), x509.CANotAuthorizedForThisName, fmt.Sprintf("%s %q is excluded by constraint %q", nameType, name, constraint)}
} }
} }
@ -265,7 +265,7 @@ func (c *Certificate) checkNameConstraints(count *int,
*count += permittedValue.Len() *count += permittedValue.Len()
if *count > maxConstraintComparisons { if *count > maxConstraintComparisons {
return x509.CertificateInvalidError{&c.Certificate, x509.TooManyConstraints, ""} return x509.CertificateInvalidError{c.asX509(), x509.TooManyConstraints, ""}
} }
ok := true ok := true
@ -274,7 +274,7 @@ func (c *Certificate) checkNameConstraints(count *int,
var err error var err error
if ok, err = match(parsedName, constraint); err != nil { if ok, err = match(parsedName, constraint); err != nil {
return x509.CertificateInvalidError{&c.Certificate, x509.CANotAuthorizedForThisName, err.Error()} return x509.CertificateInvalidError{c.asX509(), x509.CANotAuthorizedForThisName, err.Error()}
} }
if ok { if ok {
@ -283,7 +283,7 @@ func (c *Certificate) checkNameConstraints(count *int,
} }
if !ok { if !ok {
return x509.CertificateInvalidError{&c.Certificate, x509.CANotAuthorizedForThisName, fmt.Sprintf("%s %q is not permitted by any constraint", nameType, name)} return x509.CertificateInvalidError{c.asX509(), x509.CANotAuthorizedForThisName, fmt.Sprintf("%s %q is not permitted by any constraint", nameType, name)}
} }
return nil return nil
@ -334,7 +334,7 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
if len(currentChain) > 0 { if len(currentChain) > 0 {
child := currentChain[len(currentChain)-1] child := currentChain[len(currentChain)-1]
if !bytes.Equal(child.RawIssuer, c.RawSubject) { if !bytes.Equal(child.RawIssuer, c.RawSubject) {
return x509.CertificateInvalidError{&c.Certificate, x509.NameMismatch, ""} return x509.CertificateInvalidError{c.asX509(), x509.NameMismatch, ""}
} }
} }
@ -344,13 +344,13 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
} }
if now.Before(c.NotBefore) { if now.Before(c.NotBefore) {
return x509.CertificateInvalidError{ return x509.CertificateInvalidError{
Cert: &c.Certificate, Cert: c.asX509(),
Reason: x509.Expired, Reason: x509.Expired,
Detail: fmt.Sprintf("current time %s is before %s", now.Format(time.RFC3339), c.NotBefore.Format(time.RFC3339)), Detail: fmt.Sprintf("current time %s is before %s", now.Format(time.RFC3339), c.NotBefore.Format(time.RFC3339)),
} }
} else if now.After(c.NotAfter) { } else if now.After(c.NotAfter) {
return x509.CertificateInvalidError{ return x509.CertificateInvalidError{
Cert: &c.Certificate, Cert: c.asX509(),
Reason: x509.Expired, Reason: x509.Expired,
Detail: fmt.Sprintf("current time %s is after %s", now.Format(time.RFC3339), c.NotAfter.Format(time.RFC3339)), Detail: fmt.Sprintf("current time %s is after %s", now.Format(time.RFC3339), c.NotAfter.Format(time.RFC3339)),
} }
@ -458,13 +458,13 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
// encryption key could only be used for Diffie-Hellman key agreement. // encryption key could only be used for Diffie-Hellman key agreement.
if certType == intermediateCertificate && (!c.BasicConstraintsValid || !c.IsCA) { if certType == intermediateCertificate && (!c.BasicConstraintsValid || !c.IsCA) {
return x509.CertificateInvalidError{&c.Certificate, x509.NotAuthorizedToSign, ""} return x509.CertificateInvalidError{c.asX509(), x509.NotAuthorizedToSign, ""}
} }
if c.BasicConstraintsValid && c.MaxPathLen >= 0 { if c.BasicConstraintsValid && c.MaxPathLen >= 0 {
numIntermediates := len(currentChain) - 1 numIntermediates := len(currentChain) - 1
if numIntermediates > c.MaxPathLen { if numIntermediates > c.MaxPathLen {
return x509.CertificateInvalidError{&c.Certificate, x509.TooManyIntermediates, ""} return x509.CertificateInvalidError{c.asX509(), x509.TooManyIntermediates, ""}
} }
} }
@ -571,7 +571,7 @@ func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err e
} }
if len(chains) == 0 { if len(chains) == 0 {
return nil, x509.CertificateInvalidError{&c.Certificate, x509.IncompatibleUsage, ""} return nil, x509.CertificateInvalidError{c.asX509(), x509.IncompatibleUsage, ""}
} }
return chains, nil return chains, nil
@ -798,7 +798,7 @@ func (c *Certificate) VerifyHostname(h string) error {
return nil return nil
} }
} }
return x509.HostnameError{&c.Certificate, candidateIP} return x509.HostnameError{c.asX509(), candidateIP}
} }
candidateName := toLowerCaseASCII(h) // Save allocations inside the loop. candidateName := toLowerCaseASCII(h) // Save allocations inside the loop.
@ -820,7 +820,7 @@ func (c *Certificate) VerifyHostname(h string) error {
} }
} }
} }
return x509.HostnameError{&c.Certificate, h} return x509.HostnameError{c.asX509(), h}
} }
func checkChainForKeyUsage(chain []*Certificate, keyUsages []ExtKeyUsage) bool { func checkChainForKeyUsage(chain []*Certificate, keyUsages []ExtKeyUsage) bool {

8
smx509/verify_test.go
View File

@ -1759,14 +1759,14 @@ func TestPathologicalChain(t *testing.T) {
roots.AddCert(parent) roots.AddCert(parent)
for i := 1; i < 100; i++ { for i := 1; i < 100; i++ {
parent, parentKey, err = generateCert("Intermediate CA", true, &parent.Certificate, parentKey) parent, parentKey, err = generateCert("Intermediate CA", true, parent.asX509(), parentKey)
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }
intermediates.AddCert(parent) intermediates.AddCert(parent)
} }
leaf, _, err := generateCert("Leaf", false, &parent.Certificate, parentKey) leaf, _, err := generateCert("Leaf", false, parent.asX509(), parentKey)
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }
@ -1798,14 +1798,14 @@ func TestLongChain(t *testing.T) {
for i := 1; i < 15; i++ { for i := 1; i < 15; i++ {
name := fmt.Sprintf("Intermediate CA #%d", i) name := fmt.Sprintf("Intermediate CA #%d", i)
parent, parentKey, err = generateCert(name, true, &parent.Certificate, parentKey) parent, parentKey, err = generateCert(name, true, parent.asX509(), parentKey)
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }
intermediates.AddCert(parent) intermediates.AddCert(parent)
} }
leaf, _, err := generateCert("Leaf", false, &parent.Certificate, parentKey) leaf, _, err := generateCert("Leaf", false, parent.asX509(), parentKey)
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }

17
smx509/x509.go
View File

@ -146,8 +146,10 @@ func MarshalPKIXPublicKey(pub interface{}) ([]byte, error) {
} }
// CertificateRequest represents a PKCS #10, certificate signature request. // CertificateRequest represents a PKCS #10, certificate signature request.
type CertificateRequest struct { type CertificateRequest x509.CertificateRequest
x509.CertificateRequest
func (c *CertificateRequest) asX509() *x509.CertificateRequest {
return (*x509.CertificateRequest)(c)
} }
// These structures reflect the ASN.1 structure of X.509 certificates.: // These structures reflect the ASN.1 structure of X.509 certificates.:
@ -562,8 +564,10 @@ func oidFromExtKeyUsage(eku ExtKeyUsage) (oid asn1.ObjectIdentifier, ok bool) {
} }
// A Certificate represents an X.509 certificate. // A Certificate represents an X.509 certificate.
type Certificate struct { type Certificate x509.Certificate
x509.Certificate
func (c *Certificate) asX509() *x509.Certificate {
return (*x509.Certificate)(c)
} }
func (c *Certificate) Equal(other *Certificate) bool { func (c *Certificate) Equal(other *Certificate) bool {
@ -1790,7 +1794,7 @@ func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error) {
if err != nil { if err != nil {
return nil, err return nil, err
} }
return &CertificateRequest{*csrR}, nil return (*CertificateRequest)(csrR), nil
} }
return parseCertificateRequest(&csr) return parseCertificateRequest(&csr)
} }
@ -1809,7 +1813,7 @@ func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error
if !oidSignatureSM2WithSM3.Equal(in.SignatureAlgorithm.Algorithm) { if !oidSignatureSM2WithSM3.Equal(in.SignatureAlgorithm.Algorithm) {
return nil, errors.New("unsupport signature algorithm") return nil, errors.New("unsupport signature algorithm")
} }
out := &CertificateRequest{x509.CertificateRequest{ out := &CertificateRequest{
Raw: in.Raw, Raw: in.Raw,
RawTBSCertificateRequest: in.TBSCSR.Raw, RawTBSCertificateRequest: in.TBSCSR.Raw,
RawSubjectPublicKeyInfo: in.TBSCSR.PublicKey.Raw, RawSubjectPublicKeyInfo: in.TBSCSR.PublicKey.Raw,
@ -1822,7 +1826,6 @@ func parseCertificateRequest(in *certificateRequest) (*CertificateRequest, error
Version: in.TBSCSR.Version, Version: in.TBSCSR.Version,
Attributes: parseRawAttributes(in.TBSCSR.RawAttributes), Attributes: parseRawAttributes(in.TBSCSR.RawAttributes),
},
} }
var err error var err error

2
smx509/x509_test.go
View File

@ -1368,7 +1368,7 @@ func TestCreateRevocationList(t *testing.T) {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
var issuer *Certificate var issuer *Certificate
if tc.issuer != nil { if tc.issuer != nil {
issuer = &Certificate{*tc.issuer} issuer = (*Certificate)(tc.issuer)
} }
crl, err := CreateRevocationList(rand.Reader, tc.template, issuer, tc.key) crl, err := CreateRevocationList(rand.Reader, tc.template, issuer, tc.key)
if err != nil && tc.expectedError == "" { if err != nil && tc.expectedError == "" {