folly::ssl::OpenSSLCertUtils Class Reference

#include <OpenSSLCertUtils.h>

Static Public Member Functions
static Optional< std::string >	getCommonName (X509 &x509)
static std::vector< std::string >	getSubjectAltNames (X509 &x509)
static Optional< std::string >	getSubject (X509 &x509)
static Optional< std::string >	getIssuer (X509 &x509)
static std::string	getNotBeforeTime (X509 &x509)
static std::string	getNotAfterTime (X509 &x509)
static folly::Optional< std::string >	toString (X509 &x509)
static X509UniquePtr	derDecode (ByteRange)
static std::unique_ptr< IOBuf >	derEncode (X509 &)
static std::vector< X509UniquePtr >	readCertsFromBuffer (ByteRange range)
static std::array< uint8_t, SHA_DIGEST_LENGTH >	getDigestSha1 (X509 &x509)
static std::array< uint8_t, SHA256_DIGEST_LENGTH >	getDigestSha256 (X509 &x509)
static X509StoreUniquePtr	readStoreFromFile (std::string caFile)
static X509StoreUniquePtr	readStoreFromBuffer (ByteRange range)

Static Private Member Functions
static std::string	getDateTimeStr (const ASN1_TIME *time)

Detailed Description

Definition at line 29 of file OpenSSLCertUtils.h.

Member Function Documentation

X509UniquePtr folly::ssl::OpenSSLCertUtils::derDecode ( ByteRange  range )

static

Decode the DER representation of an X509 certificate.

Throws on error (if a valid certificate can't be decoded).

Definition at line 185 of file OpenSSLCertUtils.cpp.

References folly::test::begin(), folly::Range< Iter >::data(), and folly::Range< Iter >::size().

Referenced by TEST_P().

                                                         {
  auto begin = range.data();
  X509UniquePtr cert(d2i_X509(nullptr, &begin, range.size()));
  if (!cert) {
    throw std::runtime_error("could not read cert");
  }
  return cert;
}

std::unique_ptr< IOBuf > folly::ssl::OpenSSLCertUtils::derEncode ( X509 &  x509 )

static

Encode an X509 certificate in DER format.

Throws on error.

Definition at line 194 of file OpenSSLCertUtils.cpp.

References folly::IOBuf::create(), and dataPtr().

Referenced by fizz::server::appendClientCertificate(), fizz::test::getCertData(), and TEST_P().

                                                           {
  auto len = i2d_X509(&x509, nullptr);
  if (len < 0) {
    throw std::runtime_error("Error computing length");
  }
  auto buf = IOBuf::create(len);
  auto dataPtr = buf->writableData();
  len = i2d_X509(&x509, &dataPtr);
  if (len < 0) {
    throw std::runtime_error("Error converting cert to DER");
  }
  buf->append(len);
  return buf;
}

Optional< std::string > folly::ssl::OpenSSLCertUtils::getCommonName ( X509 &  x509 )

static

Definition at line 34 of file OpenSSLCertUtils.cpp.

References folly::portability::ssl::ASN1_STRING_get0_data(), folly::none, and string.

Referenced by ConnectionFilterTest::createDefaultOpts(), fizz::SelfCertImpl< T >::getIdentity(), fizz::PeerCertImpl< T >::getIdentity(), TestHandlerFactory::TestHandler::onEOM(), TEST_P(), validateTestCertBundle(), and validateTestCertWithSAN().

                                                              {
  auto subject = X509_get_subject_name(&x509);
  if (!subject) {
    return none;
  }

  auto cnLoc = X509_NAME_get_index_by_NID(subject, NID_commonName, -1);
  if (cnLoc < 0) {
    return none;
  }

  auto cnEntry = X509_NAME_get_entry(subject, cnLoc);
  if (!cnEntry) {
    return none;
  }

  auto cnAsn = X509_NAME_ENTRY_get_data(cnEntry);
  if (!cnAsn) {
    return none;
  }

  auto cnData = reinterpret_cast<const char*>(ASN1_STRING_get0_data(cnAsn));
  auto cnLen = ASN1_STRING_length(cnAsn);
  if (!cnData || cnLen <= 0) {
    return none;
  }

  return Optional<std::string>(std::string(cnData, cnLen));
}

std::string folly::ssl::OpenSSLCertUtils::getDateTimeStr ( const ASN1_TIME *  time )

staticprivate

Definition at line 166 of file OpenSSLCertUtils.cpp.

References string, and folly::detail::distributed_mutex::time().

Referenced by getNotAfterTime(), and getNotBeforeTime().

                                                                {
  if (!time) {
    return "";
  }

  auto bio = BioUniquePtr(BIO_new(BIO_s_mem()));
  if (bio == nullptr) {
    throw std::runtime_error("Cannot allocate bio");
  }

  if (ASN1_TIME_print(bio.get(), time) <= 0) {
    throw std::runtime_error("Cannot print ASN1_TIME");
  }

  char* bioData = nullptr;
  size_t bioLen = BIO_get_mem_data(bio.get(), &bioData);
  return std::string(bioData, bioLen);
}

std::array< uint8_t, SHA_DIGEST_LENGTH > folly::ssl::OpenSSLCertUtils::getDigestSha1 ( X509 &  x509 )

static

Return the output of the X509_digest for chosen message-digest algo NOTE: The returned digest will be in binary, and may need to be hex-encoded

Definition at line 240 of file OpenSSLCertUtils.cpp.

Referenced by TEST_P().

                {
  unsigned int len;
  std::array<uint8_t, SHA_DIGEST_LENGTH> md;
  int rc = X509_digest(&x509, EVP_sha1(), md.data(), &len);

  if (rc <= 0) {
    throw std::runtime_error("Could not calculate SHA1 digest for cert");
  }
  return md;
}

std::array< uint8_t, SHA256_DIGEST_LENGTH > folly::ssl::OpenSSLCertUtils::getDigestSha256 ( X509 &  x509 )

static

Definition at line 252 of file OpenSSLCertUtils.cpp.

Referenced by TEST_P().

                {
  unsigned int len;
  std::array<uint8_t, SHA256_DIGEST_LENGTH> md;
  int rc = X509_digest(&x509, EVP_sha256(), md.data(), &len);

  if (rc <= 0) {
    throw std::runtime_error("Could not calculate SHA256 digest for cert");
  }
  return md;
}

Optional< std::string > folly::ssl::OpenSSLCertUtils::getIssuer ( X509 &  x509 )

static

Definition at line 111 of file OpenSSLCertUtils.cpp.

References folly::none, and string.

Referenced by TEST_P().

                                                          {
  auto issuer = X509_get_issuer_name(&x509);
  if (!issuer) {
    return none;
  }

  auto bio = BioUniquePtr(BIO_new(BIO_s_mem()));
  if (bio == nullptr) {
    throw std::runtime_error("Cannot allocate bio");
  }

  if (X509_NAME_print_ex(bio.get(), issuer, 0, XN_FLAG_ONELINE) <= 0) {
    return none;
  }

  char* bioData = nullptr;
  size_t bioLen = BIO_get_mem_data(bio.get(), &bioData);
  return std::string(bioData, bioLen);
}

std::string folly::ssl::OpenSSLCertUtils::getNotAfterTime ( X509 &  x509 )

static

Definition at line 158 of file OpenSSLCertUtils.cpp.

References getDateTimeStr().

Referenced by TEST_P().

                                                      {
  return getDateTimeStr(X509_get_notAfter(&x509));
}

std::string folly::ssl::OpenSSLCertUtils::getNotBeforeTime ( X509 &  x509 )

static

Definition at line 162 of file OpenSSLCertUtils.cpp.

References getDateTimeStr().

Referenced by TEST_P().

                                                       {
  return getDateTimeStr(X509_get_notBefore(&x509));
}

Optional< std::string > folly::ssl::OpenSSLCertUtils::getSubject ( X509 &  x509 )

static

Definition at line 92 of file OpenSSLCertUtils.cpp.

References folly::none, and string.

Referenced by TEST_P().

                                                           {
  auto subject = X509_get_subject_name(&x509);
  if (!subject) {
    return none;
  }

  auto bio = BioUniquePtr(BIO_new(BIO_s_mem()));
  if (bio == nullptr) {
    throw std::runtime_error("Cannot allocate bio");
  }
  if (X509_NAME_print_ex(bio.get(), subject, 0, XN_FLAG_ONELINE) <= 0) {
    return none;
  }

  char* bioData = nullptr;
  size_t bioLen = BIO_get_mem_data(bio.get(), &bioData);
  return std::string(bioData, bioLen);
}

std::vector< std::string > folly::ssl::OpenSSLCertUtils::getSubjectAltNames ( X509 &  x509 )

static

Definition at line 64 of file OpenSSLCertUtils.cpp.

References folly::portability::ssl::ASN1_STRING_get0_data(), count, i, SCOPE_EXIT, and folly::portability::ssl::STACK_OF().

Referenced by fizz::SelfCertImpl< T >::getAltIdentities(), TEST_P(), and validateTestCertWithSAN().

                                                                    {
  auto names = reinterpret_cast<STACK_OF(GENERAL_NAME)*>(
      X509_get_ext_d2i(&x509, NID_subject_alt_name, nullptr, nullptr));
  if (!names) {
    return {};
  }
  SCOPE_EXIT {
    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
  };

  std::vector<std::string> ret;
  auto count = sk_GENERAL_NAME_num(names);
  for (int i = 0; i < count; i++) {
    auto genName = sk_GENERAL_NAME_value(names, i);
    if (!genName || genName->type != GEN_DNS) {
      continue;
    }
    auto nameData = reinterpret_cast<const char*>(
        ASN1_STRING_get0_data(genName->d.dNSName));
    auto nameLen = ASN1_STRING_length(genName->d.dNSName);
    if (!nameData || nameLen <= 0) {
      continue;
    }
    ret.emplace_back(nameData, nameLen);
  }
  return ret;
}

std::vector< X509UniquePtr > folly::ssl::OpenSSLCertUtils::readCertsFromBuffer ( ByteRange  range )

static

Read certificates from memory and returns them as a vector of X509 pointers. Throw if there is any malformed cert or memory allocation problem.

Parameters

range

Buffer to parse.

Returns

A vector of X509 objects.

Definition at line 209 of file OpenSSLCertUtils.cpp.

References b, folly::Range< Iter >::data(), folly::gen::move, and folly::Range< Iter >::size().

Referenced by fizz::server::test::FizzTestServer::enableClientAuthWithChain(), fizz::CertUtils::makePeerCert(), fizz::FizzUtil::readChainFile(), readStoreFromBuffer(), and TEST_P().

                     {
  BioUniquePtr b(
      BIO_new_mem_buf(const_cast<unsigned char*>(range.data()), range.size()));
  if (!b) {
    throw std::runtime_error("failed to create BIO");
  }
  std::vector<X509UniquePtr> certs;
  ERR_clear_error();
  while (true) {
    X509UniquePtr x509(PEM_read_bio_X509(b.get(), nullptr, nullptr, nullptr));
    if (x509) {
      certs.push_back(std::move(x509));
      continue;
    }
    auto err = ERR_get_error();
    ERR_clear_error();
    if (BIO_eof(b.get()) && ERR_GET_LIB(err) == ERR_LIB_PEM &&
        ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {
      // Reach end of buffer.
      break;
    }
    throw std::runtime_error(folly::to<std::string>(
        "Unable to parse cert ",
        certs.size(),
        ": ",
        getOpenSSLErrorString(err)));
  }
  return certs;
}

X509StoreUniquePtr folly::ssl::OpenSSLCertUtils::readStoreFromBuffer ( ByteRange  range )

static

Read a store from a PEM buffer. Throw if memory allocation fails, or any cert can't be parsed or added to the store.

Parameters

range

A buffer containing certs in PEM format.

Returns

A X509 store that contains certs in the CA file.

Definition at line 273 of file OpenSSLCertUtils.cpp.

References readCertsFromBuffer().

Referenced by readStoreFromFile(), and TEST_P().

                                                                            {
  auto certs = readCertsFromBuffer(certRange);
  ERR_clear_error();
  folly::ssl::X509StoreUniquePtr store(X509_STORE_new());
  for (auto& caCert : certs) {
    if (X509_STORE_add_cert(store.get(), caCert.get()) != 1) {
      auto err = ERR_get_error();
      if (ERR_GET_LIB(err) != ERR_LIB_X509 ||
          ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
        throw std::runtime_error(folly::to<std::string>(
            "Could not insert CA certificate into store: ",
            getOpenSSLErrorString(err)));
      }
    }
  }
  return store;
}

X509StoreUniquePtr folly::ssl::OpenSSLCertUtils::readStoreFromFile ( std::string  caFile )

static

Read a store from a file. Throw if unable to read the file, memory allocation fails, or any cert can't be parsed or added to the store.

Parameters

caFile

Path to the CA file.

Returns

A X509 store that contains certs in the CA file.

Definition at line 264 of file OpenSSLCertUtils.cpp.

References folly::readFile(), readStoreFromBuffer(), and string.

Referenced by fizz::JavaCryptoCertificateVerifier::createFromCAFile(), fizz::DefaultCertificateVerifier::createFromCAFile(), and TEST_P().

                                                                       {
  std::string certData;
  if (!folly::readFile(caFile.c_str(), certData)) {
    throw std::runtime_error(
        folly::to<std::string>("Could not read store file: ", caFile));
  }
  return readStoreFromBuffer(folly::StringPiece(certData));
}

folly::Optional< std::string > folly::ssl::OpenSSLCertUtils::toString ( X509 &  x509 )

static

Definition at line 131 of file OpenSSLCertUtils.cpp.

References folly::none, and string.

Referenced by TEST_P().

                                                              {
  auto in = BioUniquePtr(BIO_new(BIO_s_mem()));
  if (in == nullptr) {
    throw std::runtime_error("Cannot allocate bio");
  }

  int flags = 0;

  flags |= X509_FLAG_NO_HEADER | /* A few bytes of cert and data */
      X509_FLAG_NO_PUBKEY | /* Public key */
      X509_FLAG_NO_AUX | /* Auxiliary info? */
      X509_FLAG_NO_SIGDUMP | /* Prints the signature */
      X509_FLAG_NO_SIGNAME; /* Signature algorithms */

#ifdef X509_FLAG_NO_IDS
  flags |= X509_FLAG_NO_IDS; /* Issuer/subject IDs */
#endif

  if (X509_print_ex(in.get(), &x509, XN_FLAG_ONELINE, flags) > 0) {
    char* bioData = nullptr;
    size_t bioLen = BIO_get_mem_data(in.get(), &bioData);
    return std::string(bioData, bioLen);
  } else {
    return none;
  }
}

---

The documentation for this class was generated from the following files:

• proxygen/folly/folly/ssl/OpenSSLCertUtils.h
• proxygen/folly/folly/ssl/OpenSSLCertUtils.cpp