Archives/ncdns
2
0
Fork 0
mirror of https://github.com/namecoin/ncdns synced 2024-11-16 00:13:01 +00:00
Code Issues Projects Releases Wiki Activity

Rebase x509 onto Go 1.9.

Browse Source
This commit is contained in:
JeremyRand 2018-03-12 22:32:00 +00:00
parent 19534f1dcf
commit 92ed6ce8a8
No known key found for this signature in database
GPG Key ID: B3F2D165786D6570
1 changed files with 58 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
x509/x509_splice.go
View File

@ -1,28 +1,51 @@
// Copyright 2009 The Go Authors, 2015-2016 Jeremy Rand. All rights reserved.
// Copyright 2009 The Go Authors. All rights reserved.
// Modifications Copyright 2015-2018 Jeremy Rand. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// This code is modified from the stock CreateCertificate to use a
// pre-existing signature.
// Last rebased on Go 1.6.2
// Last rebased on Go 1.9
// Remove all content between "import" and "CreateCertificate" in original.
// Remove all content after "CreateCertificate" in original.
//go:generate bash install.sh
// Package x509 parses X.509-encoded keys and certificates.
//
// On UNIX systems the environment variables SSL_CERT_FILE and SSL_CERT_DIR
// can be used to override the system default locations for the SSL certificate
// file and SSL certificate files directory, respectively.
package x509
import (
"bytes"
//"crypto"
//"crypto/dsa"
//"crypto/ecdsa"
//"crypto/elliptic"
//"crypto/rsa"
_ "crypto/sha1"
_ "crypto/sha256"
_ "crypto/sha512"
//"crypto/x509/pkix"
"encoding/asn1"
//"encoding/pem"
"errors"
//"fmt"
//"io"
//"math/big"
//"net"
//"strconv"
//"time"
)
// CreateCertificate creates a new certificate based on a template. The
// following members of template are used: SerialNumber, Subject, NotBefore,
// NotAfter, KeyUsage, ExtKeyUsage, UnknownExtKeyUsage, BasicConstraintsValid,
// IsCA, MaxPathLen, SubjectKeyId, DNSNames, PermittedDNSDomainsCritical,
// PermittedDNSDomains, SignatureAlgorithm.
// CreateCertificate creates a new certificate based on a template.
// The following members of template are used: AuthorityKeyId,
// BasicConstraintsValid, DNSNames, ExcludedDNSDomains, ExtKeyUsage,
// IsCA, KeyUsage, MaxPathLen, MaxPathLenZero, NotAfter, NotBefore,
// PermittedDNSDomains, PermittedDNSDomainsCritical, SerialNumber,
// SignatureAlgorithm, Subject, SubjectKeyId, and UnknownExtKeyUsage.
//
// The certificate is signed by parent. If parent is equal to template then the
// certificate is self-signed. The parameter pub is the public key of the
@ -32,15 +55,21 @@ import (
//
// All keys types that are implemented via crypto.Signer are supported (This
// includes *rsa.PublicKey and *ecdsa.PublicKey.)
//
// The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
// unless the resulting certificate is self-signed. Otherwise the value from
// template will be used.
//func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) {
func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert []byte, err error) {
//key, ok := priv.(crypto.Signer)
//if !ok {
// return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
//}
if template.SerialNumber == nil {
return nil, errors.New("x509: no SerialNumber given")
}
//hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
//if err != nil {
// return nil, err
@ -60,15 +89,6 @@ func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert
return nil, err
}
if len(parent.SubjectKeyId) > 0 {
template.AuthorityKeyId = parent.SubjectKeyId
}
extensions, err := buildExtensions(template)
if err != nil {
return
}
asn1Issuer, err := subjectBytes(parent)
if err != nil {
return
@ -79,6 +99,16 @@ func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert
return
}
authorityKeyId := template.AuthorityKeyId
if !bytes.Equal(asn1Issuer, asn1Subject) && len(parent.SubjectKeyId) > 0 {
authorityKeyId = parent.SubjectKeyId
}
extensions, err := buildExtensions(template, authorityKeyId)
if err != nil {
return
}
encodedPublicKey := asn1.BitString{BitLength: len(publicKeyBytes) * 8, Bytes: publicKeyBytes}
c := tbsCertificate{
Version: 2,
@ -102,8 +132,17 @@ func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert
//h.Write(tbsCertContents)
//digest := h.Sum(nil)
//var signerOpts crypto.SignerOpts
//signerOpts = hashFunc
//if template.SignatureAlgorithm != 0 && template.SignatureAlgorithm.isRSAPSS() {
// signerOpts = &rsa.PSSOptions{
// SaltLength: rsa.PSSSaltLengthEqualsHash,
// Hash: hashFunc,
// }
//}
//var signature []byte
//signature, err = key.Sign(rand, digest, hashFunc)
//signature, err = key.Sign(rand, digest, signerOpts)
//if err != nil {
// return
//}