1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "x509_crl.h"
17 
18 #include "securec.h"
19 
20 #include "cf_log.h"
21 #include "cf_memory.h"
22 #include "config.h"
23 #include "utils.h"
24 #include "x509_crl_match_parameters.h"
25 #include "x509_crl_openssl.h"
26 #include "x509_crl_spi.h"
27 
28 #define HCF_X509_CRL_CLASS "HcfX509Crl"
29 #define OPENSSL_INVALID_VERSION (-1)
30 
31 typedef CfResult (*HcfX509CrlSpiCreateFunc)(const CfEncodingBlob *, HcfX509CrlSpi **);
32 
33 typedef struct {
34     HcfX509Crl base;
35     HcfX509CrlSpi *spiObj;
36     const char *certType;
37 } HcfX509CrlImpl;
38 
39 typedef struct {
40     HcfX509CrlSpiCreateFunc createFunc;
41 } HcfX509CrlFuncSet;
42 
43 typedef struct {
44     char *certType;
45     HcfX509CrlFuncSet funcSet;
46 } HcfCCertFactoryAbility;
47 
GetX509CrlClass(void)48 static const char *GetX509CrlClass(void)
49 {
50     return HCF_X509_CRL_CLASS;
51 }
52 
53 static const HcfCCertFactoryAbility X509_CRL_ABILITY_SET[] = {
54     { "X509", { HcfCX509CrlSpiCreate, } }
55 };
56 
FindAbility(const char * certType)57 static const HcfX509CrlFuncSet *FindAbility(const char *certType)
58 {
59     if (certType == NULL) {
60         LOGE("CertType is null!");
61         return NULL;
62     }
63     for (uint32_t i = 0; i < sizeof(X509_CRL_ABILITY_SET) / sizeof(HcfCCertFactoryAbility); i++) {
64         if (strcmp(X509_CRL_ABILITY_SET[i].certType, certType) == 0) {
65             return &(X509_CRL_ABILITY_SET[i].funcSet);
66         }
67     }
68     LOGE("Cert not support! [cert]: %s", certType);
69     return NULL;
70 }
71 
DestroyX509Crl(CfObjectBase * self)72 static void DestroyX509Crl(CfObjectBase *self)
73 {
74     if (self == NULL) {
75         LOGE("Invalid input parameter.");
76         return;
77     }
78     if (!CfIsClassMatch(self, GetX509CrlClass())) {
79         LOGE("Class is not match.");
80         return;
81     }
82     HcfX509CrlImpl *impl = (HcfX509CrlImpl *)self;
83     CfObjDestroy(impl->spiObj);
84     CfFree(impl);
85 }
86 
GetType(HcfCrl * self)87 static const char *GetType(HcfCrl *self)
88 {
89     if (self == NULL) {
90         LOGE("Invalid input parameter.");
91         return NULL;
92     }
93     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
94         LOGE("Class is not match.");
95         return NULL;
96     }
97     return ((HcfX509CrlImpl *)self)->spiObj->engineGetType(
98         ((HcfX509CrlImpl *)self)->spiObj);
99 }
100 
IsRevoked(HcfCrl * self,const HcfCertificate * cert)101 static bool IsRevoked(HcfCrl *self, const HcfCertificate *cert)
102 {
103     if ((self == NULL) || (cert == NULL)) {
104         LOGE("Invalid input parameter.");
105         return false;
106     }
107     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
108         LOGE("Class is not match.");
109         return false;
110     }
111     return ((HcfX509CrlImpl *)self)->spiObj->engineIsRevoked(
112         ((HcfX509CrlImpl *)self)->spiObj, cert);
113 }
114 
Verify(HcfX509Crl * self,void * key)115 static CfResult Verify(HcfX509Crl *self, void *key)
116 {
117     if ((self == NULL) || (key == NULL)) {
118         LOGE("Invalid input parameter.");
119         return CF_INVALID_PARAMS;
120     }
121     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
122         LOGE("Class is not match.");
123         return CF_INVALID_PARAMS;
124     }
125     return ((HcfX509CrlImpl *)self)->spiObj->engineVerify(
126         ((HcfX509CrlImpl *)self)->spiObj, (HcfPubKey *)key);
127 }
128 
GetEncoded(HcfX509Crl * self,CfEncodingBlob * encodedByte)129 static CfResult GetEncoded(HcfX509Crl *self, CfEncodingBlob *encodedByte)
130 {
131     if ((self == NULL) || (encodedByte == NULL)) {
132         LOGE("Invalid input parameter.");
133         return CF_INVALID_PARAMS;
134     }
135     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
136         LOGE("Class is not match.");
137         return CF_INVALID_PARAMS;
138     }
139     return ((HcfX509CrlImpl *)self)->spiObj->engineGetEncoded(
140         ((HcfX509CrlImpl *)self)->spiObj, encodedByte);
141 }
142 
GetVersion(HcfX509Crl * self)143 static long GetVersion(HcfX509Crl *self)
144 {
145     if (self == NULL) {
146         LOGE("Invalid input parameter.");
147         return OPENSSL_INVALID_VERSION;
148     }
149     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
150         LOGE("Class is not match.");
151         return OPENSSL_INVALID_VERSION;
152     }
153     return ((HcfX509CrlImpl *)self)->spiObj->engineGetVersion(
154         ((HcfX509CrlImpl *)self)->spiObj);
155 }
156 
GetIssuerName(HcfX509Crl * self,CfBlob * out)157 static CfResult GetIssuerName(HcfX509Crl *self, CfBlob *out)
158 {
159     if ((self == NULL) || (out == NULL)) {
160         LOGE("Invalid input parameter.");
161         return CF_INVALID_PARAMS;
162     }
163     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
164         LOGE("Class is not match.");
165         return CF_INVALID_PARAMS;
166     }
167     return ((HcfX509CrlImpl *)self)->spiObj->engineGetIssuerName(
168         ((HcfX509CrlImpl *)self)->spiObj, out);
169 }
170 
GetLastUpdate(HcfX509Crl * self,CfBlob * out)171 static CfResult GetLastUpdate(HcfX509Crl *self, CfBlob *out)
172 {
173     if ((self == NULL) || (out == NULL)) {
174         LOGE("Invalid input parameter.");
175         return CF_INVALID_PARAMS;
176     }
177     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
178         LOGE("Class is not match.");
179         return CF_INVALID_PARAMS;
180     }
181     return ((HcfX509CrlImpl *)self)->spiObj->engineGetLastUpdate(
182         ((HcfX509CrlImpl *)self)->spiObj, out);
183 }
184 
GetNextUpdate(HcfX509Crl * self,CfBlob * out)185 static CfResult GetNextUpdate(HcfX509Crl *self, CfBlob *out)
186 {
187     if ((self == NULL) || (out == NULL)) {
188         LOGE("Invalid input parameter.");
189         return CF_INVALID_PARAMS;
190     }
191     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
192         LOGE("Class is not match.");
193         return CF_INVALID_PARAMS;
194     }
195     return ((HcfX509CrlImpl *)self)->spiObj->engineGetNextUpdate(
196         ((HcfX509CrlImpl *)self)->spiObj, out);
197 }
198 
GetRevokedCert(HcfX509Crl * self,const CfBlob * serialNumber,HcfX509CrlEntry ** entryOut)199 static CfResult GetRevokedCert(HcfX509Crl *self, const CfBlob *serialNumber, HcfX509CrlEntry **entryOut)
200 {
201     if (self == NULL || serialNumber == NULL || entryOut == NULL) {
202         LOGE("Invalid input parameter.");
203         return CF_INVALID_PARAMS;
204     }
205     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
206         LOGE("Class is not match.");
207         return CF_INVALID_PARAMS;
208     }
209     return ((HcfX509CrlImpl *)self)->spiObj->engineGetRevokedCert(
210         ((HcfX509CrlImpl *)self)->spiObj, serialNumber, entryOut);
211 }
212 
GetRevokedCertWithCert(HcfX509Crl * self,HcfX509Certificate * cert,HcfX509CrlEntry ** entryOut)213 static CfResult GetRevokedCertWithCert(HcfX509Crl *self, HcfX509Certificate *cert, HcfX509CrlEntry **entryOut)
214 {
215     if ((self == NULL) || (cert == NULL) || (entryOut == NULL)) {
216         LOGE("Invalid input parameter.");
217         return CF_INVALID_PARAMS;
218     }
219     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
220         LOGE("Class is not match.");
221         return CF_INVALID_PARAMS;
222     }
223     return ((HcfX509CrlImpl *)self)->spiObj->engineGetRevokedCertWithCert(
224         ((HcfX509CrlImpl *)self)->spiObj, cert, entryOut);
225 }
226 
GetRevokedCerts(HcfX509Crl * self,CfArray * entrysOut)227 static CfResult GetRevokedCerts(HcfX509Crl *self, CfArray *entrysOut)
228 {
229     if ((self == NULL) || (entrysOut == NULL)) {
230         LOGE("Invalid input parameter.");
231         return CF_INVALID_PARAMS;
232     }
233     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
234         LOGE("Class is not match.");
235         return CF_INVALID_PARAMS;
236     }
237     return ((HcfX509CrlImpl *)self)->spiObj->engineGetRevokedCerts(
238         ((HcfX509CrlImpl *)self)->spiObj, entrysOut);
239 }
240 
GetTbsInfo(HcfX509Crl * self,CfBlob * tbsCertListOut)241 static CfResult GetTbsInfo(HcfX509Crl *self, CfBlob *tbsCertListOut)
242 {
243     if ((self == NULL) || (tbsCertListOut == NULL)) {
244         LOGE("Invalid input parameter.");
245         return CF_INVALID_PARAMS;
246     }
247     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
248         LOGE("Class is not match.");
249         return CF_INVALID_PARAMS;
250     }
251     return ((HcfX509CrlImpl *)self)->spiObj->engineGetTbsInfo(
252         ((HcfX509CrlImpl *)self)->spiObj, tbsCertListOut);
253 }
254 
GetSignature(HcfX509Crl * self,CfBlob * signature)255 static CfResult GetSignature(HcfX509Crl *self, CfBlob *signature)
256 {
257     if ((self == NULL) || (signature == NULL)) {
258         LOGE("Invalid input parameter.");
259         return CF_INVALID_PARAMS;
260     }
261     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
262         LOGE("Class is not match.");
263         return CF_INVALID_PARAMS;
264     }
265     return ((HcfX509CrlImpl *)self)->spiObj->engineGetSignature(
266         ((HcfX509CrlImpl *)self)->spiObj, signature);
267 }
268 
GetSignatureAlgName(HcfX509Crl * self,CfBlob * out)269 static CfResult GetSignatureAlgName(HcfX509Crl *self, CfBlob *out)
270 {
271     if ((self == NULL) || (out == NULL)) {
272         LOGE("Invalid input parameter.");
273         return CF_INVALID_PARAMS;
274     }
275     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
276         LOGE("Class is not match.");
277         return CF_INVALID_PARAMS;
278     }
279     return ((HcfX509CrlImpl *)self)->spiObj->engineGetSignatureAlgName(
280         ((HcfX509CrlImpl *)self)->spiObj, out);
281 }
282 
GetSignatureAlgOid(HcfX509Crl * self,CfBlob * out)283 static CfResult GetSignatureAlgOid(HcfX509Crl *self, CfBlob *out)
284 {
285     if ((self == NULL) || (out == NULL)) {
286         LOGE("Invalid input parameter.");
287         return CF_INVALID_PARAMS;
288     }
289     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
290         LOGE("Class is not match.");
291         return CF_INVALID_PARAMS;
292     }
293     return ((HcfX509CrlImpl *)self)->spiObj->engineGetSignatureAlgOid(
294         ((HcfX509CrlImpl *)self)->spiObj, out);
295 }
296 
GetSignatureAlgParams(HcfX509Crl * self,CfBlob * sigAlgParamOut)297 static CfResult GetSignatureAlgParams(HcfX509Crl *self, CfBlob *sigAlgParamOut)
298 {
299     if ((self == NULL) || (sigAlgParamOut == NULL)) {
300         LOGE("Invalid input parameter.");
301         return CF_INVALID_PARAMS;
302     }
303     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
304         LOGE("Class is not match.");
305         return CF_INVALID_PARAMS;
306     }
307     return ((HcfX509CrlImpl *)self)->spiObj->engineGetSignatureAlgParams(
308         ((HcfX509CrlImpl *)self)->spiObj, sigAlgParamOut);
309 }
310 
GetExtensions(HcfX509Crl * self,CfBlob * outBlob)311 static CfResult GetExtensions(HcfX509Crl *self, CfBlob *outBlob)
312 {
313     if ((self == NULL) || (outBlob == NULL)) {
314         LOGE("Invalid input parameter.");
315         return CF_INVALID_PARAMS;
316     }
317     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
318         LOGE("Class is not match.");
319         return CF_INVALID_PARAMS;
320     }
321     return ((HcfX509CrlImpl *)self)->spiObj->engineGetExtensions(
322         ((HcfX509CrlImpl *)self)->spiObj, outBlob);
323 }
324 
ToString(HcfX509Crl * self,CfBlob * out)325 static CfResult ToString(HcfX509Crl *self, CfBlob *out)
326 {
327     if ((self == NULL) || (out == NULL)) {
328         LOGE("Invalid input parameter.");
329         return CF_INVALID_PARAMS;
330     }
331     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
332         LOGE("Class is not match.");
333         return CF_INVALID_PARAMS;
334     }
335     return ((HcfX509CrlImpl *)self)->spiObj->engineToString(
336         ((HcfX509CrlImpl *)self)->spiObj, out);
337 }
338 
HashCode(HcfX509Crl * self,CfBlob * out)339 static CfResult HashCode(HcfX509Crl *self, CfBlob *out)
340 {
341     if ((self == NULL) || (out == NULL)) {
342         LOGE("Invalid input parameter.");
343         return CF_INVALID_PARAMS;
344     }
345     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
346         LOGE("Class is not match.");
347         return CF_INVALID_PARAMS;
348     }
349     return ((HcfX509CrlImpl *)self)->spiObj->engineHashCode(
350         ((HcfX509CrlImpl *)self)->spiObj, out);
351 }
352 
GetExtensionsOjbect(HcfX509Crl * self,CfBlob * out)353 static CfResult GetExtensionsOjbect(HcfX509Crl *self, CfBlob *out)
354 {
355     if ((self == NULL) || (out == NULL)) {
356         LOGE("Invalid input parameter.");
357         return CF_INVALID_PARAMS;
358     }
359     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
360         LOGE("Class is not match.");
361         return CF_INVALID_PARAMS;
362     }
363     return ((HcfX509CrlImpl *)self)->spiObj->engineGetExtensionsObject(
364         ((HcfX509CrlImpl *)self)->spiObj, out);
365 }
366 
Match(HcfX509Crl * self,const HcfX509CrlMatchParams * matchParams,bool * out)367 static CfResult Match(HcfX509Crl *self, const HcfX509CrlMatchParams *matchParams, bool *out)
368 {
369     if ((self == NULL) || (matchParams == NULL) || (out == NULL)) {
370         LOGE("Invalid input parameter.");
371         return CF_INVALID_PARAMS;
372     }
373     if (!CfIsClassMatch((CfObjectBase *)self, GetX509CrlClass())) {
374         LOGE("Class is not match.");
375         return CF_INVALID_PARAMS;
376     }
377     return ((HcfX509CrlImpl *)self)->spiObj->engineMatch(
378         ((HcfX509CrlImpl *)self)->spiObj, matchParams, out);
379 }
380 
HcfX509CrlCreate(const CfEncodingBlob * inStream,HcfX509Crl ** returnObj)381 CfResult HcfX509CrlCreate(const CfEncodingBlob *inStream, HcfX509Crl **returnObj)
382 {
383     if ((inStream == NULL) || (inStream->data == NULL) || (inStream->len > HCF_MAX_BUFFER_LEN) || (returnObj == NULL)) {
384         LOGE("FuncSet is null!");
385         return CF_INVALID_PARAMS;
386     }
387     const HcfX509CrlFuncSet *funcSet = FindAbility("X509");
388     if (funcSet == NULL) {
389         return CF_NOT_SUPPORT;
390     }
391     HcfX509CrlSpi *spiObj = NULL;
392     CfResult res = funcSet->createFunc(inStream, &spiObj);
393     if (res != CF_SUCCESS) {
394         LOGE("Failed to create spi object!");
395         return res;
396     }
397     HcfX509CrlImpl *x509CertImpl = (HcfX509CrlImpl *)CfMalloc(sizeof(HcfX509CrlImpl), 0);
398     if (x509CertImpl == NULL) {
399         LOGE("Failed to allocate x509CertImpl memory!");
400         CfObjDestroy(spiObj);
401         return CF_ERR_MALLOC;
402     }
403     x509CertImpl->base.base.base.getClass = GetX509CrlClass;
404     x509CertImpl->base.base.base.destroy = DestroyX509Crl;
405     x509CertImpl->base.base.getType = GetType;
406     x509CertImpl->base.base.isRevoked = IsRevoked;
407     x509CertImpl->base.verify = Verify;
408     x509CertImpl->base.getEncoded = GetEncoded;
409     x509CertImpl->base.getVersion = GetVersion;
410     x509CertImpl->base.getIssuerName = GetIssuerName;
411     x509CertImpl->base.getLastUpdate = GetLastUpdate;
412     x509CertImpl->base.getNextUpdate = GetNextUpdate;
413     x509CertImpl->base.getRevokedCert = GetRevokedCert;
414     x509CertImpl->base.getRevokedCertWithCert = GetRevokedCertWithCert;
415     x509CertImpl->base.getRevokedCerts = GetRevokedCerts;
416     x509CertImpl->base.getTbsInfo = GetTbsInfo;
417     x509CertImpl->base.getSignature = GetSignature;
418     x509CertImpl->base.getSignatureAlgName = GetSignatureAlgName;
419     x509CertImpl->base.getSignatureAlgOid = GetSignatureAlgOid;
420     x509CertImpl->base.getSignatureAlgParams = GetSignatureAlgParams;
421     x509CertImpl->base.getExtensions = GetExtensions;
422     x509CertImpl->base.toString = ToString;
423     x509CertImpl->base.hashCode = HashCode;
424     x509CertImpl->base.getExtensionsObject = GetExtensionsOjbect;
425     x509CertImpl->base.match = Match;
426     x509CertImpl->spiObj = spiObj;
427     *returnObj = (HcfX509Crl *)x509CertImpl;
428     return CF_SUCCESS;
429 }