• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2023-2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "x509_crl_openssl.h"
17 
18 #include <openssl/evp.h>
19 #include <openssl/pem.h>
20 #include <openssl/pkcs7.h>
21 #include <openssl/rsa.h>
22 #include <openssl/x509.h>
23 
24 #include "certificate_openssl_class.h"
25 #include "certificate_openssl_common.h"
26 #include "cf_log.h"
27 #include "cf_memory.h"
28 #include "config.h"
29 #include "fwk_class.h"
30 #include "securec.h"
31 #include "utils.h"
32 #include "x509_crl.h"
33 #include "x509_crl_entry_openssl.h"
34 #include "x509_crl_spi.h"
35 
36 typedef struct {
37     HcfX509CrlSpi base;
38     X509_CRL *crl;
39     CfBlob *certIssuer;
40     CfBlob *certIssuerUtf8;
41 } HcfX509CRLOpensslImpl;
42 
43 typedef enum {
44     CRL_MAX,
45     CRL_MIN,
46 } X509CRLType;
47 
48 #define OPENSSL_INVALID_VERSION (-1)
49 #define OPENSSL_ERROR 0
50 #define TYPE_NAME "X509"
51 #define OID_LENGTH 128
52 #define MAX_REV_NUM 256
53 #define MAX_SIGNATURE_LEN 8192
54 
GetClass(void)55 static const char *GetClass(void)
56 {
57     return X509_CRL_OPENSSL_CLASS;
58 }
59 
GetType(HcfX509CrlSpi * self)60 static const char *GetType(HcfX509CrlSpi *self)
61 {
62     if (self == NULL) {
63         LOGE("Invalid params!");
64         return NULL;
65     }
66     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
67         LOGE("Input wrong class type!");
68         return NULL;
69     }
70     return TYPE_NAME;
71 }
72 
GetCrl(HcfX509CrlSpi * self)73 static X509_CRL *GetCrl(HcfX509CrlSpi *self)
74 {
75     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
76         LOGE("Input wrong class type!");
77         return NULL;
78     }
79     return ((HcfX509CRLOpensslImpl *)self)->crl;
80 }
81 
GetX509FromCertificate(const HcfCertificate * cert)82 static X509 *GetX509FromCertificate(const HcfCertificate *cert)
83 {
84     if (!CfIsClassMatch((CfObjectBase *)cert, HCF_X509_CERTIFICATE_CLASS)) {
85         LOGE("Input wrong openssl class type!");
86         return NULL;
87     }
88     HcfX509CertificateImpl *impl = (HcfX509CertificateImpl *)cert;
89     if (!CfIsClassMatch((CfObjectBase *)(impl->spiObj), X509_CERT_OPENSSL_CLASS)) {
90         LOGE("Input wrong openssl class type!");
91         return NULL;
92     }
93     HcfOpensslX509Cert *realCert = (HcfOpensslX509Cert *)(impl->spiObj);
94     return realCert->x509;
95 }
96 
IsRevoked(HcfX509CrlSpi * self,const HcfCertificate * cert)97 static bool IsRevoked(HcfX509CrlSpi *self, const HcfCertificate *cert)
98 {
99     if ((self == NULL) || (cert == NULL)) {
100         LOGE("Invalid params!");
101         return false;
102     }
103     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
104         LOGE("Input wrong class type!");
105         return false;
106     }
107     X509 *certOpenssl = GetX509FromCertificate(cert);
108     if (certOpenssl == NULL) {
109         LOGE("Input Cert is wrong!");
110         return false;
111     }
112     X509_CRL *crl = ((HcfX509CRLOpensslImpl *)self)->crl;
113     if (crl == NULL) {
114         LOGE("crl is null!");
115         return false;
116     }
117     X509_REVOKED *rev = NULL;
118     int32_t res = X509_CRL_get0_by_cert(crl, &rev, certOpenssl);
119     return (res != 0);
120 }
121 
GetEncoded(HcfX509CrlSpi * self,CfEncodingBlob * encodedOut)122 static CfResult GetEncoded(HcfX509CrlSpi *self, CfEncodingBlob *encodedOut)
123 {
124     if ((self == NULL) || (encodedOut == NULL)) {
125         LOGE("Invalid params!");
126         return CF_INVALID_PARAMS;
127     }
128     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
129         LOGE("Input wrong class type!");
130         return CF_INVALID_PARAMS;
131     }
132     unsigned char *out = NULL;
133     X509_CRL *crl = ((HcfX509CRLOpensslImpl *)self)->crl;
134     if (crl == NULL) {
135         LOGE("crl is null!");
136         return CF_INVALID_PARAMS;
137     }
138     int32_t length = i2d_X509_CRL(crl, &out);
139     if (length <= 0) {
140         LOGE("Do i2d_X509_CRL fail!");
141         CfPrintOpensslError();
142         return CF_ERR_CRYPTO_OPERATION;
143     }
144     encodedOut->data = (uint8_t *)CfMalloc(length, 0);
145     if (encodedOut->data == NULL) {
146         LOGE("Failed to malloc for crl encoded data!");
147         OPENSSL_free(out);
148         return CF_ERR_MALLOC;
149     }
150     (void)memcpy_s(encodedOut->data, length, out, length);
151     OPENSSL_free(out);
152     encodedOut->len = length;
153     encodedOut->encodingFormat = CF_FORMAT_DER;
154     return CF_SUCCESS;
155 }
156 
Verify(HcfX509CrlSpi * self,HcfPubKey * key)157 static CfResult Verify(HcfX509CrlSpi *self, HcfPubKey *key)
158 {
159     if ((self == NULL) || (key == NULL)) {
160         LOGE("Invalid params!");
161         return CF_INVALID_PARAMS;
162     }
163     if (!CfIsClassMatch((CfObjectBase *)self, GetClass()) ||
164         (!CfIsPubKeyClassMatch((HcfObjectBase *)key, OPENSSL_RSA_PUBKEY_CLASS))) {
165         LOGE("Input wrong class type!");
166         return CF_INVALID_PARAMS;
167     }
168     RSA *rsaPubkey = ((HcfOpensslRsaPubKey *)key)->pk;
169     if (rsaPubkey == NULL) {
170         LOGE("rsaPubkey is null!");
171         return CF_INVALID_PARAMS;
172     }
173     EVP_PKEY *pubKey = EVP_PKEY_new();
174     if (pubKey == NULL) {
175         LOGE("pubKey is null!");
176         CfPrintOpensslError();
177         return CF_ERR_CRYPTO_OPERATION;
178     }
179 
180     CfResult ret = CF_SUCCESS;
181     do {
182         if (EVP_PKEY_set1_RSA(pubKey, rsaPubkey) <= 0) {
183             LOGE("Do EVP_PKEY_assign_RSA fail!");
184             CfPrintOpensslError();
185             ret = CF_ERR_CRYPTO_OPERATION;
186             break;
187         }
188 
189         X509_CRL *crl = ((HcfX509CRLOpensslImpl *)self)->crl;
190         if (crl == NULL) {
191             LOGE("crl is null!");
192             ret = CF_INVALID_PARAMS;
193             break;
194         }
195 
196         int32_t res = X509_CRL_verify(crl, pubKey);
197         if (res != CF_OPENSSL_SUCCESS) {
198             LOGE("Verify fail!");
199             CfPrintOpensslError();
200             ret = CF_ERR_CRYPTO_OPERATION;
201             break;
202         }
203     } while (0);
204 
205     EVP_PKEY_free(pubKey);
206     return ret;
207 }
208 
GetVersion(HcfX509CrlSpi * self)209 static long GetVersion(HcfX509CrlSpi *self)
210 {
211     if (self == NULL) {
212         LOGE("Invalid params!");
213         return OPENSSL_INVALID_VERSION;
214     }
215     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
216         LOGE("Input wrong class type!");
217         return OPENSSL_INVALID_VERSION;
218     }
219     X509_CRL *crl = ((HcfX509CRLOpensslImpl *)self)->crl;
220     if (crl == NULL) {
221         LOGE("crl is null!");
222         return OPENSSL_INVALID_VERSION;
223     }
224     return X509_CRL_get_version(crl) + 1;
225 }
226 
GetIssuerName(HcfX509CrlSpi * self,CfBlob * out)227 static CfResult GetIssuerName(HcfX509CrlSpi *self, CfBlob *out)
228 {
229     if ((self == NULL) || (out == NULL)) {
230         LOGE("Invalid params for calling GetIssuerName!");
231         return CF_INVALID_PARAMS;
232     }
233     X509_CRL *crl = GetCrl(self);
234     if (crl == NULL) {
235         LOGE("crl is null!");
236         return CF_INVALID_PARAMS;
237     }
238     X509_NAME *x509Name = X509_CRL_get_issuer(crl);
239     if (x509Name == NULL) {
240         LOGE("Get Issuer DN fail!");
241         CfPrintOpensslError();
242         return CF_ERR_CRYPTO_OPERATION;
243     }
244     char *issuer = X509_NAME_oneline(x509Name, NULL, 0);
245     if (issuer == NULL) {
246         LOGE("X509Name convert char fail!");
247         CfPrintOpensslError();
248         return CF_ERR_CRYPTO_OPERATION;
249     }
250     if (strlen(issuer) > HCF_MAX_STR_LEN) {
251         LOGE("issuer name is too long!");
252         CfPrintOpensslError();
253         OPENSSL_free(issuer);
254         return CF_ERR_CRYPTO_OPERATION;
255     }
256     uint32_t length = strlen(issuer) + 1;
257     out->data = (uint8_t *)CfMalloc(length, 0);
258     if (out->data == NULL) {
259         LOGE("Failed to malloc for crl issuer data!");
260         OPENSSL_free(issuer);
261         return CF_ERR_MALLOC;
262     }
263     (void)memcpy_s(out->data, length, issuer, length);
264     out->size = length;
265     OPENSSL_free(issuer);
266     return CF_SUCCESS;
267 }
268 
GetIssuerNameDer(HcfX509CrlSpi * self,CfBlob * out)269 static CfResult GetIssuerNameDer(HcfX509CrlSpi *self, CfBlob *out)
270 {
271     if ((self == NULL) || (out == NULL)) {
272         LOGE("Invalid params for calling GetIssuerName!");
273         return CF_ERR_INTERNAL;
274     }
275     X509_CRL *crl = GetCrl(self);
276     if (crl == NULL) {
277         LOGE("crl is null!");
278         return CF_ERR_INTERNAL;
279     }
280     X509_NAME *x509Name = X509_CRL_get_issuer(crl);
281     if (x509Name == NULL) {
282         LOGE("Get Issuer DN fail!");
283         CfPrintOpensslError();
284         return CF_ERR_CRYPTO_OPERATION;
285     }
286 
287     int32_t size = i2d_X509_NAME(x509Name, &(out->data));
288     if (size <= 0) {
289         LOGE("Failed to get Issuer DER data!");
290         CfPrintOpensslError();
291         return CF_ERR_CRYPTO_OPERATION;
292     }
293     out->size = (uint32_t)size;
294     return CF_SUCCESS;
295 }
296 
GetIssuerNameEx(HcfX509CrlSpi * self,CfEncodinigType encodingType,CfBlob * out)297 static CfResult GetIssuerNameEx(HcfX509CrlSpi *self, CfEncodinigType encodingType, CfBlob *out)
298 {
299     if ((self == NULL) || (out == NULL)) {
300         LOGE("Invalid params for calling GetIssuerNameEx!");
301         return CF_ERR_INTERNAL;
302     }
303     if (encodingType != CF_ENCODING_UTF8) {
304         LOGE("encodingType is not utf8!");
305         return CF_ERR_PARAMETER_CHECK;
306     }
307     X509_CRL *crl = GetCrl(self);
308     if (crl == NULL) {
309         LOGE("crl is null!");
310         return CF_ERR_INTERNAL;
311     }
312     X509_NAME *x509Name = X509_CRL_get_issuer(crl);
313     if (x509Name == NULL) {
314         LOGE("Get Issuer DN fail!");
315         CfPrintOpensslError();
316         return CF_ERR_CRYPTO_OPERATION;
317     }
318     BIO *bio = BIO_new(BIO_s_mem());
319     if (bio == NULL) {
320         LOGE("BIO new fail.");
321         CfPrintOpensslError();
322         return CF_ERR_CRYPTO_OPERATION;
323     }
324     CfResult res = CF_SUCCESS;
325     do {
326         int ret = X509_NAME_print_ex(bio, x509Name, 0, XN_FLAG_SEP_COMMA_PLUS | ASN1_STRFLGS_UTF8_CONVERT);
327         if (ret <= 0) {
328             LOGE("Failed to X509_NAME_print_ex in openssl!");
329             CfPrintOpensslError();
330             res = CF_ERR_CRYPTO_OPERATION;
331             break;
332         }
333         res = CopyMemFromBIO(bio, out);
334         if (res != CF_SUCCESS) {
335             LOGE("CopyMemFromBIO failed!");
336             break;
337         }
338     } while (0);
339     BIO_free(bio);
340     return res;
341 }
342 
SetCertIssuer(HcfX509CrlSpi * self)343 static CfResult SetCertIssuer(HcfX509CrlSpi *self)
344 {
345     ((HcfX509CRLOpensslImpl *)self)->certIssuer = (CfBlob *)CfMalloc(sizeof(CfBlob), 0);
346     if (((HcfX509CRLOpensslImpl *)self)->certIssuer == NULL) {
347         LOGE("Failed to malloc for certIssuer!");
348         return CF_ERR_MALLOC;
349     }
350     CfResult res = GetIssuerName(self, ((HcfX509CRLOpensslImpl *)self)->certIssuer);
351     if (res != CF_SUCCESS) {
352         CfFree(((HcfX509CRLOpensslImpl *)self)->certIssuer);
353         ((HcfX509CRLOpensslImpl *)self)->certIssuer = NULL;
354     }
355     return res;
356 }
357 
SetCertIssuerUtf8(HcfX509CrlSpi * self)358 static CfResult SetCertIssuerUtf8(HcfX509CrlSpi *self)
359 {
360     ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8 = (CfBlob *)CfMalloc(sizeof(CfBlob), 0);
361     if (((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8 == NULL) {
362         LOGE("Failed to malloc for certIssuerUtf8!");
363         return CF_ERR_MALLOC;
364     }
365     CfResult res = GetIssuerNameEx(self, CF_ENCODING_UTF8, ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8);
366     if (res != CF_SUCCESS) {
367         CfFree(((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8);
368         ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8 = NULL;
369     }
370     return res;
371 }
372 
GetLastUpdate(HcfX509CrlSpi * self,CfBlob * out)373 static CfResult GetLastUpdate(HcfX509CrlSpi *self, CfBlob *out)
374 {
375     if ((self == NULL) || (out == NULL)) {
376         LOGE("Invalid params for calling GetLastUpdate!");
377         return CF_INVALID_PARAMS;
378     }
379     X509_CRL *crl = GetCrl(self);
380     if (crl == NULL) {
381         LOGE("crl is null!");
382         return CF_INVALID_PARAMS;
383     }
384     const ASN1_TIME *time = X509_CRL_get0_lastUpdate(crl);
385     if (time == NULL) {
386         LOGE("Get this update time fail!");
387         CfPrintOpensslError();
388         return CF_ERR_CRYPTO_OPERATION;
389     }
390     const char *thisUpdate = (const char *)(time->data);
391     if (thisUpdate == NULL || strlen(thisUpdate) > HCF_MAX_STR_LEN) {
392         LOGE("ThisUpdate convert String fail, or thisUpdate is too long!");
393         return CF_ERR_CRYPTO_OPERATION;
394     }
395     uint32_t length = strlen(thisUpdate) + 1;
396     out->data = (uint8_t *)CfMalloc(length, 0);
397     if (out->data == NULL) {
398         LOGE("Failed to malloc for thisUpdate!");
399         return CF_ERR_MALLOC;
400     }
401     (void)memcpy_s(out->data, length, thisUpdate, length);
402     out->size = length;
403     return CF_SUCCESS;
404 }
405 
GetNextUpdate(HcfX509CrlSpi * self,CfBlob * out)406 static CfResult GetNextUpdate(HcfX509CrlSpi *self, CfBlob *out)
407 {
408     if ((self == NULL) || (out == NULL)) {
409         LOGE("Invalid params for calling GetNextUpdate!");
410         return CF_INVALID_PARAMS;
411     }
412     X509_CRL *crl = GetCrl(self);
413     if (crl == NULL) {
414         LOGE("crl is null!");
415         return CF_INVALID_PARAMS;
416     }
417     const ASN1_TIME *time = X509_CRL_get0_nextUpdate(crl);
418     if (time == NULL) {
419         LOGE("Get next update time fail!");
420         CfPrintOpensslError();
421         return CF_ERR_CRYPTO_OPERATION;
422     }
423     const char *nextUpdate = (const char *)(time->data);
424     if ((nextUpdate == NULL) || (strlen(nextUpdate) > HCF_MAX_STR_LEN)) {
425         LOGE("Get next update time is null, or nextUpdate is too long!");
426         return CF_ERR_CRYPTO_OPERATION;
427     }
428     uint32_t length = strlen(nextUpdate) + 1;
429     out->data = (uint8_t *)CfMalloc(length, 0);
430     if (out->data == NULL) {
431         LOGE("Failed to malloc for nextUpdate!");
432         return CF_ERR_MALLOC;
433     }
434     (void)memcpy_s(out->data, length, nextUpdate, length);
435     out->size = length;
436     return CF_SUCCESS;
437 }
438 
GetRevokedCert(HcfX509CrlSpi * self,const CfBlob * serialNumber,HcfX509CrlEntry ** entryOut)439 static CfResult GetRevokedCert(HcfX509CrlSpi *self, const CfBlob *serialNumber, HcfX509CrlEntry **entryOut)
440 {
441     if ((self == NULL) || (serialNumber == NULL) || (serialNumber->data == NULL) || (serialNumber->size == 0) ||
442         (serialNumber->size > MAX_SN_BYTE_CNT) || (entryOut == NULL)) {
443         LOGE("Invalid params!");
444         return CF_INVALID_PARAMS;
445     }
446     X509_CRL *crl = GetCrl(self);
447     if (crl == NULL) {
448         LOGE("crl is null!");
449         return CF_INVALID_PARAMS;
450     }
451 
452     BIGNUM *bigNum = BN_bin2bn(serialNumber->data, serialNumber->size, NULL);
453     if (bigNum == NULL) {
454         LOGE("bin to big number fail!");
455         return CF_INVALID_PARAMS;
456     }
457     ASN1_INTEGER *serial = BN_to_ASN1_INTEGER(bigNum, NULL);
458 
459     if (serial == NULL) {
460         LOGE("Serial init fail!");
461         CfPrintOpensslError();
462         BN_free(bigNum);
463         return CF_ERR_CRYPTO_OPERATION;
464     }
465 
466     X509_REVOKED *rev = NULL;
467     int32_t opensslRes = X509_CRL_get0_by_serial(crl, &rev, serial);
468     BN_free(bigNum);
469     ASN1_INTEGER_free(serial);
470     if (opensslRes != CF_OPENSSL_SUCCESS) {
471         LOGE("Get revoked certificate fail, res : %{public}d!", opensslRes);
472         CfPrintOpensslError();
473         return CF_ERR_CRYPTO_OPERATION;
474     }
475     CfResult res = HcfCX509CRLEntryCreate(rev, entryOut, ((HcfX509CRLOpensslImpl *)self)->certIssuer,
476         ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8, ((HcfX509CRLOpensslImpl *)self)->crl);
477     if (res != CF_SUCCESS) {
478         LOGE("X509 CRL entry create fail, res : %{public}d!", res);
479         return res;
480     }
481     return CF_SUCCESS;
482 }
483 
GetRevokedCertWithCert(HcfX509CrlSpi * self,HcfX509Certificate * cert,HcfX509CrlEntry ** entryOut)484 static CfResult GetRevokedCertWithCert(HcfX509CrlSpi *self, HcfX509Certificate *cert, HcfX509CrlEntry **entryOut)
485 {
486     if ((self == NULL) || (cert == NULL) || (entryOut == NULL)) {
487         LOGE("Invalid params!");
488         return CF_INVALID_PARAMS;
489     }
490     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
491         LOGE("Input wrong class type!");
492         return CF_INVALID_PARAMS;
493     }
494     X509 *certOpenssl = GetX509FromCertificate((HcfCertificate *)cert);
495     if (certOpenssl == NULL) {
496         LOGE("Input Cert is wrong!");
497         return CF_INVALID_PARAMS;
498     }
499     X509_CRL *crl = ((HcfX509CRLOpensslImpl *)self)->crl;
500     if (crl == NULL) {
501         LOGE("crl is null!");
502         return CF_INVALID_PARAMS;
503     }
504     X509_REVOKED *revokedRet = NULL;
505     int32_t opensslRes = X509_CRL_get0_by_cert(crl, &revokedRet, certOpenssl);
506     if (opensslRes != CF_OPENSSL_SUCCESS) {
507         LOGE("Get revoked certificate with cert fail, res : %{public}d!", opensslRes);
508         CfPrintOpensslError();
509         return CF_ERR_CRYPTO_OPERATION;
510     }
511     CfResult res = HcfCX509CRLEntryCreate(revokedRet, entryOut, ((HcfX509CRLOpensslImpl *)self)->certIssuer,
512         ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8, ((HcfX509CRLOpensslImpl *)self)->crl);
513     if (res != CF_SUCCESS) {
514         LOGE("X509 CRL entry create fail, res : %{public}d!", res);
515         return res;
516     }
517     return CF_SUCCESS;
518 }
519 
DeepCopyRevokedCertificates(HcfX509CrlSpi * self,const STACK_OF (X509_REVOKED)* entrys,int32_t i,CfArray * entrysOut)520 static CfResult DeepCopyRevokedCertificates(
521     HcfX509CrlSpi *self, const STACK_OF(X509_REVOKED) * entrys, int32_t i, CfArray *entrysOut)
522 {
523     X509_REVOKED *rev = sk_X509_REVOKED_value(entrys, i);
524     if (rev == NULL) {
525         LOGE("sk_X509_REVOKED_value fail!");
526         CfPrintOpensslError();
527         return CF_ERR_CRYPTO_OPERATION;
528     }
529     HcfX509CrlEntry *crlEntry = NULL;
530     CfResult res = HcfCX509CRLEntryCreate(rev, &crlEntry, ((HcfX509CRLOpensslImpl *)self)->certIssuer,
531         ((HcfX509CRLOpensslImpl *)self)->certIssuerUtf8, ((HcfX509CRLOpensslImpl *)self)->crl);
532     if (res != CF_SUCCESS || crlEntry == NULL) {
533         LOGE("X509 CRL entry create fail, res : %{public}d!", res);
534         return res;
535     }
536     entrysOut->data[i].data = (uint8_t *)crlEntry;
537     entrysOut->data[i].size = sizeof(HcfX509CrlEntry);
538     return CF_SUCCESS;
539 }
540 
DestroyCRLEntryArray(CfArray * arr)541 static void DestroyCRLEntryArray(CfArray *arr)
542 {
543     if (arr == NULL) {
544         LOGD("The input array is null, no need to free.");
545         return;
546     }
547     for (uint32_t i = 0; i < arr->count; ++i) {
548         if (arr->data[i].data == NULL) {
549             continue;
550         }
551         HcfX509CrlEntry *crlEntry = (HcfX509CrlEntry *)(arr->data[i].data);
552         crlEntry->base.destroy((CfObjectBase *)crlEntry);
553         arr->data[i].data = NULL;
554         arr->data[i].size = 0;
555     }
556     CfFree(arr->data);
557     arr->data = NULL;
558 }
559 
GetRevokedCerts(HcfX509CrlSpi * self,CfArray * entrysOut)560 static CfResult GetRevokedCerts(HcfX509CrlSpi *self, CfArray *entrysOut)
561 {
562     if ((self == NULL) || (entrysOut == NULL)) {
563         LOGE("Invalid params!");
564         return CF_INVALID_PARAMS;
565     }
566     X509_CRL *crl = GetCrl(self);
567     if (crl == NULL) {
568         LOGE("crl is null!");
569         return CF_INVALID_PARAMS;
570     }
571     STACK_OF(X509_REVOKED) *entrys = X509_CRL_get_REVOKED(crl);
572     if (entrys == NULL) {
573         LOGE("Get revoked certificates fail!");
574         CfPrintOpensslError();
575         return CF_ERR_CRYPTO_OPERATION;
576     }
577     int32_t revokedNum = sk_X509_REVOKED_num(entrys);
578     if ((revokedNum <= 0) || (revokedNum > MAX_REV_NUM)) {
579         LOGE("Get revoked invalid number!");
580         CfPrintOpensslError();
581         return CF_ERR_CRYPTO_OPERATION;
582     }
583     uint32_t blobSize = sizeof(CfBlob) * revokedNum;
584     entrysOut->data = (CfBlob *)CfMalloc(blobSize, 0);
585     if (entrysOut->data == NULL) {
586         LOGE("Failed to malloc for entrysOut array!");
587         return CF_ERR_MALLOC;
588     }
589     entrysOut->count = revokedNum;
590     for (int32_t i = 0; i < revokedNum; i++) {
591         if (DeepCopyRevokedCertificates(self, entrys, i, entrysOut) != CF_SUCCESS) {
592             LOGE("Falied to copy revoked certificates!");
593             DestroyCRLEntryArray(entrysOut);
594             return CF_ERR_MALLOC;
595         }
596     }
597     return CF_SUCCESS;
598 }
599 
GetTbsList(HcfX509CrlSpi * self,CfBlob * tbsCertListOut)600 static CfResult GetTbsList(HcfX509CrlSpi *self, CfBlob *tbsCertListOut)
601 {
602     if ((self == NULL) || (tbsCertListOut == NULL)) {
603         LOGE("Invalid params!");
604         return CF_INVALID_PARAMS;
605     }
606     X509_CRL *crl = GetCrl(self);
607     if (crl == NULL) {
608         LOGE("crl is null!");
609         return CF_INVALID_PARAMS;
610     }
611     unsigned char *tbs = NULL;
612     int32_t length = i2d_re_X509_CRL_tbs(crl, &tbs);
613     if ((length <= 0) || (tbs == NULL)) {
614         LOGE("Get TBS certList fail!");
615         CfPrintOpensslError();
616         return CF_ERR_CRYPTO_OPERATION;
617     }
618     tbsCertListOut->data = (uint8_t *)CfMalloc(length, 0);
619     if (tbsCertListOut->data == NULL) {
620         LOGE("Failed to malloc for tbs!");
621         OPENSSL_free(tbs);
622         return CF_ERR_MALLOC;
623     }
624     (void)memcpy_s(tbsCertListOut->data, length, tbs, length);
625     OPENSSL_free(tbs);
626     tbsCertListOut->size = length;
627     return CF_SUCCESS;
628 }
629 
GetSignature(HcfX509CrlSpi * self,CfBlob * signature)630 static CfResult GetSignature(HcfX509CrlSpi *self, CfBlob *signature)
631 {
632     if ((self == NULL) || (signature == NULL)) {
633         LOGE("Invalid params!");
634         return CF_INVALID_PARAMS;
635     }
636     X509_CRL *crl = GetCrl(self);
637     if (crl == NULL) {
638         LOGE("crl is null!");
639         return CF_INVALID_PARAMS;
640     }
641     const ASN1_BIT_STRING *asn1Signature = NULL;
642     X509_CRL_get0_signature(((HcfX509CRLOpensslImpl *)self)->crl, &asn1Signature, NULL);
643     if (asn1Signature == NULL) {
644         LOGE("Get signature is null!");
645         CfPrintOpensslError();
646         return CF_ERR_CRYPTO_OPERATION;
647     }
648     int32_t signatureLen = ASN1_STRING_length(asn1Signature);
649     if (signatureLen <= 0) {
650         LOGE("Get signature length is invalid!");
651         CfPrintOpensslError();
652         return CF_ERR_CRYPTO_OPERATION;
653     }
654     const unsigned char *signatureStr = ASN1_STRING_get0_data(asn1Signature);
655     if ((signatureStr == NULL) || (signatureLen > MAX_SIGNATURE_LEN)) {
656         LOGE("ASN1 get string fail, or signature length is too long!");
657         CfPrintOpensslError();
658         return CF_ERR_CRYPTO_OPERATION;
659     }
660     signature->data = (uint8_t *)CfMalloc(signatureLen, 0);
661     if (signature->data == NULL) {
662         LOGE("Failed to malloc for signature!");
663         return CF_ERR_MALLOC;
664     }
665     (void)memcpy_s(signature->data, signatureLen, signatureStr, signatureLen);
666     signature->size = signatureLen;
667     return CF_SUCCESS;
668 }
669 
GetSignatureAlgOidInner(X509_CRL * crl,CfBlob * oidOut)670 static CfResult GetSignatureAlgOidInner(X509_CRL *crl, CfBlob *oidOut)
671 {
672     const X509_ALGOR *palg = NULL;
673     X509_CRL_get0_signature(crl, NULL, &palg);
674     if (palg == NULL) {
675         LOGE("alg is null!");
676         CfPrintOpensslError();
677         return CF_ERR_CRYPTO_OPERATION;
678     }
679     const ASN1_OBJECT *oid = NULL;
680     X509_ALGOR_get0(&oid, NULL, NULL, palg);
681     if (oid == NULL) {
682         LOGE("oid is null!");
683         CfPrintOpensslError();
684         return CF_ERR_CRYPTO_OPERATION;
685     }
686     char *output = (char *)CfMalloc(OID_LENGTH, 0);
687     if (output == NULL) {
688         LOGE("Failed to malloc the output!");
689         return CF_ERR_MALLOC;
690     }
691     int32_t resLen = OBJ_obj2txt(output, OID_LENGTH, oid, 1);
692     if (resLen <= 0) {
693         LOGE("Failed to do OBJ_obj2txt!");
694         CfPrintOpensslError();
695         CfFree(output);
696         output = NULL;
697         return CF_ERR_CRYPTO_OPERATION;
698     }
699     uint32_t length = strlen(output) + 1;
700     oidOut->data = (uint8_t *)CfMalloc(length, 0);
701     if (oidOut->data == NULL) {
702         LOGE("Failed to malloc for oidOut!");
703         CfFree(output);
704         output = NULL;
705         return CF_ERR_MALLOC;
706     }
707     (void)memcpy_s(oidOut->data, length, output, length);
708     CfFree(output);
709     output = NULL;
710     oidOut->size = length;
711     return CF_SUCCESS;
712 }
713 
GetSignatureAlgOid(HcfX509CrlSpi * self,CfBlob * oidOut)714 static CfResult GetSignatureAlgOid(HcfX509CrlSpi *self, CfBlob *oidOut)
715 {
716     if ((self == NULL) || (oidOut == NULL)) {
717         LOGE("Invalid params!");
718         return CF_INVALID_PARAMS;
719     }
720     X509_CRL *crl = GetCrl(self);
721     if (crl == NULL) {
722         LOGE("crl is null!");
723         return CF_INVALID_PARAMS;
724     }
725     return GetSignatureAlgOidInner(crl, oidOut);
726 }
727 
GetSignatureAlgName(HcfX509CrlSpi * self,CfBlob * algNameOut)728 static CfResult GetSignatureAlgName(HcfX509CrlSpi *self, CfBlob *algNameOut)
729 {
730     if ((self == NULL) || (algNameOut == NULL)) {
731         LOGE("Invalid params!");
732         return CF_INVALID_PARAMS;
733     }
734     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
735         LOGE("Input wrong class type!");
736         return CF_INVALID_PARAMS;
737     }
738     CfBlob *oidOut = (CfBlob *)CfMalloc(sizeof(CfBlob), 0);
739     if (oidOut == NULL) {
740         LOGE("Failed to malloc for oidOut!");
741         return CF_ERR_MALLOC;
742     }
743     CfResult res = GetSignatureAlgOid(self, oidOut);
744     if (res != CF_SUCCESS) {
745         LOGE("Get signature algor oid failed!");
746         CfFree(oidOut);
747         oidOut = NULL;
748         return res;
749     }
750     const char *algName = GetAlgorithmName((const char *)(oidOut->data));
751     CfFree(oidOut->data);
752     oidOut->data = NULL;
753     CfFree(oidOut);
754     oidOut = NULL;
755     if (algName == NULL) {
756         LOGE("Can not find algorithmName!");
757         return CF_ERR_CRYPTO_OPERATION;
758     }
759     uint32_t length = strlen(algName) + 1;
760     algNameOut->data = (uint8_t *)CfMalloc(length, 0);
761     if (algNameOut->data == NULL) {
762         LOGE("Failed to malloc for algName!");
763         return CF_ERR_MALLOC;
764     }
765     (void)memcpy_s(algNameOut->data, length, algName, length);
766     algNameOut->size = length;
767     return CF_SUCCESS;
768 }
769 
GetSignatureAlgParamsInner(X509_CRL * crl,CfBlob * sigAlgParamOut)770 static CfResult GetSignatureAlgParamsInner(X509_CRL *crl, CfBlob *sigAlgParamOut)
771 {
772     const X509_ALGOR *palg = NULL;
773     X509_CRL_get0_signature(crl, NULL, &palg);
774     if (palg == NULL) {
775         LOGE("Get alg is null!");
776         CfPrintOpensslError();
777         return CF_ERR_CRYPTO_OPERATION;
778     }
779     int32_t paramType = 0;
780     const void *paramValue = NULL;
781     X509_ALGOR_get0(NULL, &paramType, &paramValue, palg);
782     if (paramType == V_ASN1_UNDEF) {
783         LOGE("get_X509_ALGOR_parameter, no parameters!");
784         CfPrintOpensslError();
785         return CF_NOT_SUPPORT;
786     }
787     ASN1_TYPE *param = ASN1_TYPE_new();
788     if (param == NULL) {
789         LOGE("create param fail!");
790         CfPrintOpensslError();
791         return CF_ERR_MALLOC;
792     }
793     if (ASN1_TYPE_set1(param, paramType, paramValue) != CF_OPENSSL_SUCCESS) {
794         LOGE("Set type fail!");
795         ASN1_TYPE_free(param);
796         CfPrintOpensslError();
797         return CF_ERR_CRYPTO_OPERATION;
798     }
799     unsigned char *outParams = NULL;
800     int32_t length = i2d_ASN1_TYPE(param, &outParams);
801     ASN1_TYPE_free(param);
802     if (length <= 0) {
803         LOGE("Do i2d_ASN1_TYPE fail!");
804         CfPrintOpensslError();
805         return CF_ERR_CRYPTO_OPERATION;
806     }
807     sigAlgParamOut->data = (uint8_t *)CfMalloc(length, 0);
808     if (sigAlgParamOut->data == NULL) {
809         LOGE("Failed to malloc for sigAlgParam!");
810         OPENSSL_free(outParams);
811         return CF_ERR_MALLOC;
812     }
813     (void)memcpy_s(sigAlgParamOut->data, length, outParams, length);
814     sigAlgParamOut->size = length;
815     OPENSSL_free(outParams);
816     return CF_SUCCESS;
817 }
818 
GetSignatureAlgParams(HcfX509CrlSpi * self,CfBlob * sigAlgParamOut)819 static CfResult GetSignatureAlgParams(HcfX509CrlSpi *self, CfBlob *sigAlgParamOut)
820 {
821     if ((self == NULL) || (sigAlgParamOut == NULL)) {
822         LOGE("Invalid params!");
823         return CF_INVALID_PARAMS;
824     }
825     X509_CRL *crl = GetCrl(self);
826     if (crl == NULL) {
827         LOGE("crl is null!");
828         return CF_INVALID_PARAMS;
829     }
830     return GetSignatureAlgParamsInner(crl, sigAlgParamOut);
831 }
832 
GetExtensions(HcfX509CrlSpi * self,CfBlob * outBlob)833 static CfResult GetExtensions(HcfX509CrlSpi *self, CfBlob *outBlob)
834 {
835     if ((self == NULL) || (outBlob == NULL)) {
836         LOGE("Invalid params!");
837         return CF_INVALID_PARAMS;
838     }
839 
840     X509_CRL *crl = GetCrl(self);
841     if (crl == NULL) {
842         LOGE("crl is null!");
843         return CF_INVALID_PARAMS;
844     }
845 
846     X509_EXTENSIONS *exts = (X509_EXTENSIONS *)X509_CRL_get0_extensions(crl);
847     CfResult ret = CopyExtensionsToBlob(exts, outBlob);
848     if (ret != CF_SUCCESS) {
849         CfPrintOpensslError();
850     }
851     return ret;
852 }
853 
ToString(HcfX509CrlSpi * self,CfBlob * out)854 static CfResult ToString(HcfX509CrlSpi *self, CfBlob *out)
855 {
856     if ((self == NULL) || (out == NULL)) {
857         LOGE("The input data is null!");
858         return CF_INVALID_PARAMS;
859     }
860     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
861         LOGE("Input wrong class type!");
862         return CF_INVALID_PARAMS;
863     }
864     X509_CRL *crl = GetCrl(self);
865     if (crl == NULL) {
866         LOGE("crl is null!");
867         return CF_INVALID_PARAMS;
868     }
869     BIO *bio = BIO_new(BIO_s_mem());
870     if (bio == NULL) {
871         LOGE("BIO_new error");
872         return CF_ERR_MALLOC;
873     }
874 
875     int len = X509_CRL_print(bio, crl);
876     if (len <= 0) {
877         LOGE("X509_CRL_print error");
878         BIO_free(bio);
879         return CF_ERR_CRYPTO_OPERATION;
880     }
881     BUF_MEM *bufMem = NULL;
882     if (BIO_get_mem_ptr(bio, &bufMem) > 0 && bufMem != NULL) {
883         CfResult res = DeepCopyDataToOut(bufMem->data, bufMem->length, out);
884         BIO_free(bio);
885         return res;
886     }
887     BIO_free(bio);
888     LOGE("BIO_get_mem_ptr error");
889     return CF_ERR_CRYPTO_OPERATION;
890 }
891 
ToStringEx(HcfX509CrlSpi * self,CfEncodinigType encodingType,CfBlob * out)892 static CfResult ToStringEx(HcfX509CrlSpi *self, CfEncodinigType encodingType, CfBlob *out)
893 {
894     if ((self == NULL) || (out == NULL)) {
895         LOGE("The input data is null!");
896         return CF_ERR_INTERNAL;
897     }
898     if (encodingType != CF_ENCODING_UTF8) {
899         LOGE("encodingType is not utf8!");
900         return CF_ERR_PARAMETER_CHECK;
901     }
902     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
903         LOGE("Input wrong class type!");
904         return CF_ERR_INTERNAL;
905     }
906     X509_CRL *crl = GetCrl(self);
907     if (crl == NULL) {
908         LOGE("crl is null!");
909         return CF_ERR_INTERNAL;
910     }
911     BIO *bio = BIO_new(BIO_s_mem());
912     if (bio == NULL) {
913         LOGE("BIO_new error");
914         return CF_ERR_MALLOC;
915     }
916 
917     int len = X509_CRL_print_ex(bio, crl, XN_FLAG_SEP_CPLUS_SPC | ASN1_STRFLGS_UTF8_CONVERT);
918     if (len <= 0) {
919         LOGE("X509_CRL_print_ex error");
920         BIO_free(bio);
921         return CF_ERR_CRYPTO_OPERATION;
922     }
923     BUF_MEM *bufMem = NULL;
924     if (BIO_get_mem_ptr(bio, &bufMem) > 0 && bufMem != NULL) {
925         CfResult res = DeepCopyDataToOut(bufMem->data, bufMem->length, out);
926         BIO_free(bio);
927         return res;
928     }
929     BIO_free(bio);
930     LOGE("BIO_get_mem_ptr error");
931     return CF_ERR_CRYPTO_OPERATION;
932 }
933 
HashCode(HcfX509CrlSpi * self,CfBlob * out)934 static CfResult HashCode(HcfX509CrlSpi *self, CfBlob *out)
935 {
936     if ((self == NULL) || (out == NULL)) {
937         LOGE("The input data is null!");
938         return CF_INVALID_PARAMS;
939     }
940     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
941         LOGE("Input wrong class type!");
942         return CF_INVALID_PARAMS;
943     }
944     X509_CRL *crl = GetCrl(self);
945     if (crl == NULL) {
946         LOGE("crl is null!");
947         return CF_INVALID_PARAMS;
948     }
949     unsigned char *buf = NULL;
950     int len = i2d_X509_CRL(crl, &buf);
951     if (len < 0 || buf == NULL) {
952         LOGE("i2d_X509_CRL error");
953         return CF_ERR_CRYPTO_OPERATION;
954     }
955 
956     out->data = (uint8_t *)CfMalloc(SHA256_DIGEST_LENGTH, 0);
957     if (out->data == NULL) {
958         LOGE("CfMalloc error");
959         OPENSSL_free(buf);
960         return CF_ERR_MALLOC;
961     }
962     if (SHA256(buf, len, out->data) == NULL) {
963         LOGE("Compute sha256 error");
964         OPENSSL_free(buf);
965         CfFree(out->data);
966         out->data = NULL;
967         return CF_ERR_CRYPTO_OPERATION;
968     }
969     out->size = SHA256_DIGEST_LENGTH;
970     OPENSSL_free(buf);
971     return CF_SUCCESS;
972 }
973 
GetExtensionsObject(HcfX509CrlSpi * self,CfBlob * out)974 static CfResult GetExtensionsObject(HcfX509CrlSpi *self, CfBlob *out)
975 {
976     if ((self == NULL) || (out == NULL)) {
977         LOGE("The input data is null!");
978         return CF_INVALID_PARAMS;
979     }
980     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
981         LOGE("Input wrong class type!");
982         return CF_INVALID_PARAMS;
983     }
984     X509_CRL *crl = GetCrl(self);
985     if (crl == NULL) {
986         LOGE("crl is null!");
987         return CF_INVALID_PARAMS;
988     }
989 
990     unsigned char *tmp = NULL;
991     int len = i2d_X509_EXTENSIONS(X509_CRL_get0_extensions(crl), &tmp);
992     if (len <= 0) {
993         LOGE("i2d_X509_EXTENSIONS error");
994         return CF_ERR_CRYPTO_OPERATION;
995     }
996 
997     out->data = (uint8_t *)CfMalloc(len, 0);
998     if (out->data == NULL) {
999         LOGE("Failed to malloc for extensions data!");
1000         OPENSSL_free(tmp);
1001         return CF_ERR_MALLOC;
1002     }
1003     (void)memcpy_s(out->data, len, tmp, len);
1004     OPENSSL_free(tmp);
1005     out->size = len;
1006     return CF_SUCCESS;
1007 }
1008 
GetNumOfCRL(HcfX509CrlSpi * self,CfBlob * outBlob)1009 static CfResult GetNumOfCRL(HcfX509CrlSpi *self, CfBlob *outBlob)
1010 {
1011     X509_CRL *crl = GetCrl(self);
1012     if (crl == NULL) {
1013         LOGE("Crl is null!");
1014         return CF_INVALID_PARAMS;
1015     }
1016 
1017     ASN1_INTEGER *crlNumber = X509_CRL_get_ext_d2i(crl, NID_crl_number, NULL, NULL);
1018     if (crlNumber == NULL) {
1019         LOGE("Crl number is null!");
1020         return CF_INVALID_PARAMS;
1021     }
1022     outBlob->data = (uint8_t *)CfMalloc(crlNumber->length, 0);
1023     if (!outBlob->data) {
1024         ASN1_INTEGER_free(crlNumber);
1025         LOGE("Malloc failed!");
1026         return CF_ERR_MALLOC;
1027     }
1028     (void)memcpy_s(outBlob->data, crlNumber->length, crlNumber->data, crlNumber->length);
1029     outBlob->size = (uint32_t)crlNumber->length;
1030     ASN1_INTEGER_free(crlNumber);
1031     return CF_SUCCESS;
1032 }
1033 
Comparex509CertX509Openssl(HcfX509CrlSpi * self,const HcfCertificate * x509Cert,bool * out)1034 static CfResult Comparex509CertX509Openssl(HcfX509CrlSpi *self, const HcfCertificate *x509Cert, bool *out)
1035 {
1036     bool bRet = IsRevoked(self, x509Cert);
1037     if (!bRet) {
1038         *out = false;
1039         LOGI("Crl revoked is false!");
1040     }
1041     return CF_SUCCESS;
1042 }
1043 
CompareIssuerX509Openssl(HcfX509CrlSpi * self,const CfBlobArray * issuer,bool * out)1044 static CfResult CompareIssuerX509Openssl(HcfX509CrlSpi *self, const CfBlobArray *issuer, bool *out)
1045 {
1046     if (issuer == NULL || issuer->data == NULL || issuer->count == 0) {
1047         LOGE("The input data is null!");
1048         return CF_INVALID_PARAMS;
1049     }
1050     CfBlob outTmpSelf = { 0 };
1051     CfBlob cfBlobDataParam = { 0 };
1052     CfResult ret = GetIssuerName(self, &outTmpSelf);
1053     if (ret != CF_SUCCESS) {
1054         *out = false;
1055         LOGE("x509Crl GetIssuerName failed!");
1056         return ret;
1057     }
1058 
1059     *out = false;
1060     for (uint32_t i = 0; i < issuer->count; ++i) {
1061         ret = ConvertNameDerDataToString(issuer->data[i].data, issuer->data[i].size, &cfBlobDataParam);
1062         if (ret != CF_SUCCESS) {
1063             LOGE("ConvertNameDerDataToString failed!");
1064             CfFree(outTmpSelf.data);
1065             outTmpSelf.data = NULL;
1066             return ret;
1067         }
1068         if (outTmpSelf.size != cfBlobDataParam.size) {
1069             CfFree(cfBlobDataParam.data);
1070             cfBlobDataParam.data = NULL;
1071             continue;
1072         }
1073         if (strncmp((const char *)outTmpSelf.data, (const char *)cfBlobDataParam.data, outTmpSelf.size) == 0) {
1074             *out = true;
1075             CfFree(cfBlobDataParam.data);
1076             cfBlobDataParam.data = NULL;
1077             break;
1078         }
1079         CfFree(cfBlobDataParam.data);
1080         cfBlobDataParam.data = NULL;
1081     }
1082     CfFree(outTmpSelf.data);
1083     outTmpSelf.data = NULL;
1084     return CF_SUCCESS;
1085 }
1086 
CompareUpdateDateTimeX509Openssl(HcfX509CrlSpi * self,const CfBlob * updateDateTime,bool * out)1087 static CfResult CompareUpdateDateTimeX509Openssl(HcfX509CrlSpi *self, const CfBlob *updateDateTime, bool *out)
1088 {
1089     *out = false;
1090     CfBlob outNextUpdate = { 0 };
1091     CfBlob outThisUpdate = { 0 };
1092     CfResult res = GetNextUpdate(self, &outNextUpdate);
1093     if (res != CF_SUCCESS) {
1094         LOGE("X509Crl getNextUpdate failed!");
1095         return res;
1096     }
1097     res = GetLastUpdate(self, &outThisUpdate);
1098     if (res != CF_SUCCESS) {
1099         LOGE("X509Crl getLastUpdate failed!");
1100         CfFree(outNextUpdate.data);
1101         outNextUpdate.data = NULL;
1102         return res;
1103     }
1104 
1105     int ret = 0;
1106     res = CompareBigNum(updateDateTime, &outNextUpdate, &ret);
1107     if (res != CF_SUCCESS || ret > 0) {
1108         LOGE("updateDateTime should <= outNextUpdate!");
1109         CfFree(outNextUpdate.data);
1110         outNextUpdate.data = NULL;
1111         CfFree(outThisUpdate.data);
1112         outThisUpdate.data = NULL;
1113         return res;
1114     }
1115     res = CompareBigNum(updateDateTime, &outThisUpdate, &ret);
1116     if (res != CF_SUCCESS || ret < 0) {
1117         LOGE("updateDateTime should >= outThisUpdate!");
1118         CfFree(outNextUpdate.data);
1119         outNextUpdate.data = NULL;
1120         CfFree(outThisUpdate.data);
1121         outThisUpdate.data = NULL;
1122         return res;
1123     }
1124     *out = true;
1125     CfFree(outNextUpdate.data);
1126     outNextUpdate.data = NULL;
1127     CfFree(outThisUpdate.data);
1128     outThisUpdate.data = NULL;
1129     return CF_SUCCESS;
1130 }
1131 
CompareCRLX509Openssl(HcfX509CrlSpi * self,const CfBlob * crlBlob,X509CRLType type,bool * out)1132 static CfResult CompareCRLX509Openssl(HcfX509CrlSpi *self, const CfBlob *crlBlob, X509CRLType type, bool *out)
1133 {
1134     *out = false;
1135     CfBlob outNum = { 0, NULL };
1136     CfResult res = GetNumOfCRL(self, &outNum);
1137     if (res != CF_SUCCESS) {
1138         LOGE("X509Crl get num of CRL failed!");
1139         return res;
1140     }
1141 
1142     int ret = 0;
1143     res = CompareBigNum(crlBlob, &outNum, &ret);
1144     switch (type) {
1145         case CRL_MAX:
1146             if (res == CF_SUCCESS && ret > 0) {
1147                 *out = true;
1148             }
1149             break;
1150         case CRL_MIN:
1151             if (res == CF_SUCCESS && ret < 0) {
1152                 *out = true;
1153             }
1154             break;
1155         default:
1156             LOGE("Unknown type!");
1157             break;
1158     }
1159     CfFree(outNum.data);
1160     outNum.data = NULL;
1161     return CF_SUCCESS;
1162 }
1163 
MatchX509CRLOpensslPart2(HcfX509CrlSpi * self,const HcfX509CrlMatchParams * matchParams,bool * out)1164 static CfResult MatchX509CRLOpensslPart2(HcfX509CrlSpi *self, const HcfX509CrlMatchParams *matchParams, bool *out)
1165 {
1166     CfResult res = CF_SUCCESS;
1167     // updateDateTime
1168     if (matchParams->updateDateTime != NULL) {
1169         res = CompareUpdateDateTimeX509Openssl(self, matchParams->updateDateTime, out);
1170         if (res != CF_SUCCESS || (*out == false)) {
1171             LOGE("X509Crl match updateDateTime failed!");
1172             return res;
1173         }
1174     }
1175 
1176     // maxCRL & minCRL
1177     if ((matchParams->maxCRL != NULL) && (matchParams->minCRL != NULL)) {
1178         int ret = 0;
1179         res = CompareBigNum(matchParams->maxCRL, matchParams->minCRL, &ret);
1180         if (res != CF_SUCCESS || ret < 0) {
1181             LOGE("X509Crl minCRL should be smaller than maxCRL!");
1182             return CF_INVALID_PARAMS;
1183         }
1184     }
1185 
1186     // maxCRL
1187     if (matchParams->maxCRL != NULL) {
1188         res = CompareCRLX509Openssl(self, matchParams->maxCRL, CRL_MAX, out);
1189         if (res != CF_SUCCESS || (*out == false)) {
1190             LOGE("X509Crl match maxCRL failed!");
1191             return res;
1192         }
1193     }
1194 
1195     // minCRL
1196     if (matchParams->minCRL != NULL) {
1197         res = CompareCRLX509Openssl(self, matchParams->minCRL, CRL_MIN, out);
1198         if (res != CF_SUCCESS || (*out == false)) {
1199             LOGE("X509Crl match minCRL failed!");
1200             return res;
1201         }
1202     }
1203     return res;
1204 }
1205 
MatchX509CRLOpenssl(HcfX509CrlSpi * self,const HcfX509CrlMatchParams * matchParams,bool * out)1206 static CfResult MatchX509CRLOpenssl(HcfX509CrlSpi *self, const HcfX509CrlMatchParams *matchParams, bool *out)
1207 {
1208     if ((self == NULL) || (matchParams == NULL) || (out == NULL)) {
1209         LOGE("The input data is null!");
1210         return CF_INVALID_PARAMS;
1211     }
1212     if (!CfIsClassMatch((CfObjectBase *)self, GetClass())) {
1213         LOGE("Input wrong class type!");
1214         return CF_INVALID_PARAMS;
1215     }
1216 
1217     *out = true;
1218 
1219     // x509Cert
1220     if (matchParams->x509Cert != NULL) {
1221         CfResult res = Comparex509CertX509Openssl(self, matchParams->x509Cert, out);
1222         if (res != CF_SUCCESS || (*out == false)) {
1223             LOGE("X509Crl match x509Cert failed!");
1224             return res;
1225         }
1226     }
1227 
1228     // issuer
1229     if (matchParams->issuer != NULL) {
1230         CfResult res = CompareIssuerX509Openssl(self, matchParams->issuer, out);
1231         if (res != CF_SUCCESS || (*out == false)) {
1232             LOGE("X509Crl match issuer failed!");
1233             return res;
1234         }
1235     }
1236 
1237     // updateDateTime、maxCRL、minCRL
1238     return MatchX509CRLOpensslPart2(self, matchParams, out);
1239 }
1240 
Destroy(CfObjectBase * self)1241 static void Destroy(CfObjectBase *self)
1242 {
1243     if (self == NULL) {
1244         return;
1245     }
1246     if (!CfIsClassMatch(self, GetClass())) {
1247         LOGE("Input wrong class type!");
1248         return;
1249     }
1250     HcfX509CRLOpensslImpl *realCrl = (HcfX509CRLOpensslImpl *)self;
1251     X509_CRL_free(realCrl->crl);
1252     realCrl->crl = NULL;
1253     if (realCrl->certIssuer != NULL) {
1254         CfFree(realCrl->certIssuer->data);
1255         realCrl->certIssuer->data = NULL;
1256         CfFree(realCrl->certIssuer);
1257         realCrl->certIssuer = NULL;
1258     }
1259     if (realCrl->certIssuerUtf8 != NULL) {
1260         CfFree(realCrl->certIssuerUtf8->data);
1261         realCrl->certIssuerUtf8->data = NULL;
1262         CfFree(realCrl->certIssuerUtf8);
1263         realCrl->certIssuerUtf8 = NULL;
1264     }
1265     CfFree(realCrl);
1266 }
1267 
ParseX509CRL(const CfEncodingBlob * inStream)1268 static X509_CRL *ParseX509CRL(const CfEncodingBlob *inStream)
1269 {
1270     if ((inStream->data == NULL) || (inStream->len <= 0)) {
1271         LOGE("Invalid params!");
1272         return NULL;
1273     }
1274     BIO *bio = BIO_new_mem_buf(inStream->data, inStream->len);
1275     if (bio == NULL) {
1276         LOGE("bio get null!");
1277         CfPrintOpensslError();
1278         return NULL;
1279     }
1280     X509_CRL *crlOut = NULL;
1281     switch (inStream->encodingFormat) {
1282         case CF_FORMAT_DER:
1283             crlOut = d2i_X509_CRL_bio(bio, NULL);
1284             break;
1285         case CF_FORMAT_PEM:
1286             crlOut = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL);
1287             break;
1288         default:
1289             LOGE("Not support format!");
1290             break;
1291     }
1292     BIO_free_all(bio);
1293     if (crlOut == NULL) {
1294         LOGE("Parse X509 CRL fail!");
1295         CfPrintOpensslError();
1296         return NULL;
1297     }
1298     return crlOut;
1299 }
1300 
CheckX509CrlSpi(const CfEncodingBlob * inStream,HcfX509CrlSpi ** spi,HcfX509CRLOpensslImpl ** returnCRL,X509_CRL ** crl)1301 static CfResult CheckX509CrlSpi(const CfEncodingBlob *inStream, HcfX509CrlSpi **spi, HcfX509CRLOpensslImpl **returnCRL,
1302     X509_CRL **crl)
1303 {
1304     if ((inStream == NULL) || (inStream->data == NULL) || (spi == NULL)) {
1305         LOGE("Invalid params!");
1306         return CF_INVALID_PARAMS;
1307     }
1308     *returnCRL = (HcfX509CRLOpensslImpl *)CfMalloc(sizeof(HcfX509CRLOpensslImpl), 0);
1309     if (*returnCRL == NULL) {
1310         LOGE("Failed to malloc for x509 instance!");
1311         return CF_ERR_MALLOC;
1312     }
1313     *crl = ParseX509CRL(inStream);
1314     if (*crl == NULL) {
1315         LOGE("Failed to Parse x509 CRL!");
1316         CfFree(*returnCRL);
1317         *returnCRL = NULL;
1318         return CF_INVALID_PARAMS;
1319     }
1320     return CF_SUCCESS;
1321 }
1322 
HcfCX509CrlSpiCreate(const CfEncodingBlob * inStream,HcfX509CrlSpi ** spi)1323 CfResult HcfCX509CrlSpiCreate(const CfEncodingBlob *inStream, HcfX509CrlSpi **spi)
1324 {
1325     HcfX509CRLOpensslImpl *returnCRL = NULL;
1326     X509_CRL *crl = NULL;
1327     CfResult ret = CheckX509CrlSpi(inStream, spi, &returnCRL, &crl);
1328     if (ret != CF_SUCCESS) {
1329         return ret;
1330     }
1331     returnCRL->crl = crl;
1332     returnCRL->certIssuer = NULL;
1333     returnCRL->certIssuerUtf8 = NULL;
1334     returnCRL->base.base.getClass = GetClass;
1335     returnCRL->base.base.destroy = Destroy;
1336     returnCRL->base.engineIsRevoked = IsRevoked;
1337     returnCRL->base.engineGetType = GetType;
1338     returnCRL->base.engineGetEncoded = GetEncoded;
1339     returnCRL->base.engineVerify = Verify;
1340     returnCRL->base.engineGetVersion = GetVersion;
1341     returnCRL->base.engineGetIssuerName = GetIssuerName;
1342     returnCRL->base.engineGetIssuerNameEx = GetIssuerNameEx;
1343     returnCRL->base.engineGetIssuerNameDer = GetIssuerNameDer;
1344     returnCRL->base.engineGetLastUpdate = GetLastUpdate;
1345     returnCRL->base.engineGetNextUpdate = GetNextUpdate;
1346     returnCRL->base.engineGetRevokedCert = GetRevokedCert;
1347     returnCRL->base.engineGetRevokedCertWithCert = GetRevokedCertWithCert;
1348     returnCRL->base.engineGetRevokedCerts = GetRevokedCerts;
1349     returnCRL->base.engineGetTbsInfo = GetTbsList;
1350     returnCRL->base.engineGetSignature = GetSignature;
1351     returnCRL->base.engineGetSignatureAlgName = GetSignatureAlgName;
1352     returnCRL->base.engineGetSignatureAlgOid = GetSignatureAlgOid;
1353     returnCRL->base.engineGetSignatureAlgParams = GetSignatureAlgParams;
1354     returnCRL->base.engineGetExtensions = GetExtensions;
1355     returnCRL->base.engineMatch = MatchX509CRLOpenssl;
1356     returnCRL->base.engineToString = ToString;
1357     returnCRL->base.engineToStringEx = ToStringEx;
1358     returnCRL->base.engineHashCode = HashCode;
1359     returnCRL->base.engineGetExtensionsObject = GetExtensionsObject;
1360     if (SetCertIssuer((HcfX509CrlSpi *)returnCRL) != CF_SUCCESS) {
1361         LOGI("No cert issuer find or set cert issuer fail!");
1362     }
1363     if (SetCertIssuerUtf8((HcfX509CrlSpi *)returnCRL) != CF_SUCCESS) {
1364         LOGI("No utf8 cert issuer find or set utf8 cert issuer fail!");
1365     }
1366     *spi = (HcfX509CrlSpi *)returnCRL;
1367     return CF_SUCCESS;
1368 }
1369