--- /dev/null
+//
+// X509Certificate.m
+//
+// This class is in the public domain.
+// Originally created by Robbie Hanson on Mon Jan 26 2009.
+// Updated and maintained by Deusty Designs and the Mac development community.
+//
+// http://code.google.com/p/cocoaasyncsocket/
+//
+// This class is largely derived from Apple's sample code project: SSLSample.
+// This class does not extract every bit of available information, just the most common fields.
+
+#import "X509Certificate.h"
+#import "AsyncSocket.h"
+#import <Security/Security.h>
+
+#define UTC_TIME_STRLEN 13
+#define GENERALIZED_TIME_STRLEN 15
+
+
+@implementation X509Certificate
+
+// Standard app-level memory functions required by CDSA
+
+static void * appMalloc (uint32 size, void *allocRef)
+{
+ return malloc(size);
+}
+static void * appCalloc(uint32 num, uint32 size, void *allocRef)
+{
+ return calloc(num, size);
+}
+static void * appRealloc (void *ptr, uint32 size, void *allocRef)
+{
+ return realloc(ptr, size);
+}
+static void appFree (void *mem_ptr, void *allocRef)
+{
+ free(mem_ptr);
+}
+
+
+static const CSSM_API_MEMORY_FUNCS memFuncs = {
+ (CSSM_MALLOC)appMalloc,
+ (CSSM_FREE)appFree,
+ (CSSM_REALLOC)appRealloc,
+ (CSSM_CALLOC)appCalloc,
+ NULL
+};
+
+static const CSSM_VERSION vers = {2, 0};
+static const CSSM_GUID testGuid = { 0xFADE, 0, 0, { 1,2,3,4,5,6,7,0 }};
+
+static BOOL CSSMStartup()
+{
+ CSSM_RETURN crtn;
+ CSSM_PVC_MODE pvcPolicy = CSSM_PVC_NONE;
+
+ crtn = CSSM_Init (&vers,
+ CSSM_PRIVILEGE_SCOPE_NONE,
+ &testGuid,
+ CSSM_KEY_HIERARCHY_NONE,
+ &pvcPolicy,
+ NULL /* reserved */);
+
+ if(crtn != CSSM_OK)
+ {
+ cssmPerror("CSSM_Init", crtn);
+ return NO;
+ }
+ else
+ {
+ return YES;
+ }
+}
+
+static CSSM_CL_HANDLE CLStartup()
+{
+ CSSM_CL_HANDLE clHandle;
+ CSSM_RETURN crtn;
+
+ if(CSSMStartup() == NO)
+ {
+ return 0;
+ }
+
+ crtn = CSSM_ModuleLoad(&gGuidAppleX509CL,
+ CSSM_KEY_HIERARCHY_NONE,
+ NULL, // eventHandler
+ NULL); // AppNotifyCallbackCtx
+ if(crtn != CSSM_OK)
+ {
+ cssmPerror("CSSM_ModuleLoad", crtn);
+ return 0;
+ }
+
+ crtn = CSSM_ModuleAttach (&gGuidAppleX509CL,
+ &vers,
+ &memFuncs, // memFuncs
+ 0, // SubserviceID
+ CSSM_SERVICE_CL, // SubserviceFlags - Where is this used?
+ 0, // AttachFlags
+ CSSM_KEY_HIERARCHY_NONE,
+ NULL, // FunctionTable
+ 0, // NumFuncTable
+ NULL, // reserved
+ &clHandle);
+ if(crtn != CSSM_OK)
+ {
+ cssmPerror("CSSM_ModuleAttach", crtn);
+ return 0;
+ }
+
+ return clHandle;
+}
+
+static void CLShutdown(CSSM_CL_HANDLE clHandle)
+{
+ CSSM_RETURN crtn;
+
+ crtn = CSSM_ModuleDetach(clHandle);
+ if(crtn != CSSM_OK)
+ {
+ cssmPerror("CSSM_ModuleDetach", crtn);
+ }
+
+ crtn = CSSM_ModuleUnload(&gGuidAppleX509CL, NULL, NULL);
+ if(crtn != CSSM_OK)
+ {
+ cssmPerror("CSSM_ModuleUnload", crtn);
+ }
+}
+
+static BOOL CompareCSSMData(const CSSM_DATA *d1, const CSSM_DATA *d2)
+{
+ if(d1 == NULL || d2 == NULL)
+ {
+ return NO;
+ }
+ if(d1->Length != d2->Length)
+ {
+ return NO;
+ }
+
+ return memcmp(d1->Data, d2->Data, d1->Length) == 0;
+}
+
+static BOOL CompareOids(const CSSM_OID *oid1, const CSSM_OID *oid2)
+{
+ if(oid1 == NULL || oid2 == NULL)
+ {
+ return NO;
+ }
+ if(oid1->Length != oid2->Length)
+ {
+ return NO;
+ }
+
+ return memcmp(oid1->Data, oid2->Data, oid1->Length) == 0;
+}
+
+static NSString* KeyForOid(const CSSM_OID *oid)
+{
+ if(CompareOids(oid, &CSSMOID_CountryName))
+ {
+ return X509_COUNTRY;
+ }
+ if(CompareOids(oid, &CSSMOID_OrganizationName))
+ {
+ return X509_ORGANIZATION;
+ }
+ if(CompareOids(oid, &CSSMOID_LocalityName))
+ {
+ return X509_LOCALITY;
+ }
+ if(CompareOids(oid, &CSSMOID_OrganizationalUnitName))
+ {
+ return X509_ORANIZATIONAL_UNIT;
+ }
+ if(CompareOids(oid, &CSSMOID_CommonName))
+ {
+ return X509_COMMON_NAME;
+ }
+ if(CompareOids(oid, &CSSMOID_Surname))
+ {
+ return X509_SURNAME;
+ }
+ if(CompareOids(oid, &CSSMOID_Title))
+ {
+ return X509_TITLE;
+ }
+ if(CompareOids(oid, &CSSMOID_StateProvinceName))
+ {
+ return X509_STATE_PROVINCE;
+ }
+ if(CompareOids(oid, &CSSMOID_CollectiveStateProvinceName))
+ {
+ return X509_COLLECTIVE_STATE_PROVINCE;
+ }
+ if(CompareOids(oid, &CSSMOID_EmailAddress))
+ {
+ return X509_EMAIL_ADDRESS;
+ }
+ if(CompareOids(oid, &CSSMOID_StreetAddress))
+ {
+ return X509_STREET_ADDRESS;
+ }
+ if(CompareOids(oid, &CSSMOID_PostalCode))
+ {
+ return X509_POSTAL_CODE;
+ }
+
+ // Not every possible Oid is checked for.
+ // Feel free to add any you may need.
+ // They are listed in the Security Framework's aoisattr.h file.
+
+ return nil;
+}
+
+static NSString* DataToString(const CSSM_DATA *data, const CSSM_BER_TAG *type)
+{
+ NSStringEncoding encoding;
+ switch (*type)
+ {
+ case BER_TAG_PRINTABLE_STRING :
+ case BER_TAG_TELETEX_STRING :
+
+ encoding = NSISOLatin1StringEncoding;
+ break;
+
+ case BER_TAG_PKIX_BMP_STRING :
+ case BER_TAG_PKIX_UNIVERSAL_STRING :
+ case BER_TAG_PKIX_UTF8_STRING :
+
+ encoding = NSUTF8StringEncoding;
+ break;
+
+ default :
+ return nil;
+ }
+
+ NSString *result = [[NSString alloc] initWithBytes:data->Data
+ length:data->Length
+ encoding:encoding];
+ return [result autorelease];
+}
+
+static NSDate* TimeToDate(const char *str, unsigned len)
+{
+ BOOL isUTC;
+ unsigned i;
+ long year, month, day, hour, minute, second;
+
+ // Check for null or empty strings
+ if(str == NULL || len == 0)
+ {
+ return nil;
+ }
+
+ // Ignore NULL termination
+ if(str[len - 1] == '\0')
+ {
+ len--;
+ }
+
+ // Check for proper string length
+ if(len == UTC_TIME_STRLEN)
+ {
+ // 2-digit year, not Y2K compliant
+ isUTC = YES;
+ }
+ else if(len == GENERALIZED_TIME_STRLEN)
+ {
+ // 4-digit year
+ isUTC = NO;
+ }
+ else
+ {
+ // Unknown format
+ return nil;
+ }
+
+ // Check that all characters except last are digits
+ for(i = 0; i < (len - 1); i++)
+ {
+ if(!(isdigit(str[i])))
+ {
+ return nil;
+ }
+ }
+
+ // Check last character is a 'Z'
+ if(str[len - 1] != 'Z' )
+ {
+ return nil;
+ }
+
+ // Start parsing
+ i = 0;
+ char tmp[5];
+
+ // Year
+ if(isUTC)
+ {
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ year = strtol(tmp, NULL, 10);
+
+ // 2-digit year:
+ // 0 <= year < 50 : assume century 21
+ // 50 <= year < 70 : illegal per PKIX
+ // 70 < year <= 99 : assume century 20
+
+ if(year < 50)
+ {
+ year += 2000;
+ }
+ else if(year < 70)
+ {
+ return nil;
+ }
+ else
+ {
+ year += 1900;
+ }
+ }
+ else
+ {
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = str[i++];
+ tmp[3] = str[i++];
+ tmp[4] = '\0';
+
+ year = strtol(tmp, NULL, 10);
+ }
+
+ // Month
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ month = strtol(tmp, NULL, 10);
+
+ // Months are represented in format from 1 to 12
+ if(month > 12 || month <= 0)
+ {
+ return nil;
+ }
+
+ // Day
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ day = strtol(tmp, NULL, 10);
+
+ // Days are represented in format from 1 to 31
+ if(day > 31 || day <= 0)
+ {
+ return nil;
+ }
+
+ // Hour
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ hour = strtol(tmp, NULL, 10);
+
+ // Hours are represented in format from 0 to 23
+ if(hour > 23 || hour < 0)
+ {
+ return nil;
+ }
+
+ // Minute
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ minute = strtol(tmp, NULL, 10);
+
+ // Minutes are represented in format from 0 to 59
+ if(minute > 59 || minute < 0)
+ {
+ return nil;
+ }
+
+ // Second
+ tmp[0] = str[i++];
+ tmp[1] = str[i++];
+ tmp[2] = '\0';
+
+ second = strtol(tmp, NULL, 10);
+
+ // Seconds are represented in format from 0 to 59
+ if(second > 59 || second < 0)
+ {
+ return nil;
+ }
+
+ CFGregorianDate gDate = { year, month, day, hour, minute, second };
+ CFAbsoluteTime aTime = CFGregorianDateGetAbsoluteTime(gDate, NULL);
+
+ return [NSDate dateWithTimeIntervalSinceReferenceDate:aTime];
+}
+
+static NSData* RawToData(const CSSM_DATA *data)
+{
+ if(data == NULL)
+ {
+ return nil;
+ }
+
+ return [NSData dataWithBytes:data->Data length:data->Length];
+}
+
+static NSDictionary* X509NameToDictionary(const CSSM_X509_NAME *x509Name)
+{
+ if(x509Name == NULL)
+ {
+ return nil;
+ }
+
+ NSMutableDictionary *result = [NSMutableDictionary dictionaryWithCapacity:6];
+ NSMutableArray *others = [NSMutableArray arrayWithCapacity:6];
+
+ UInt32 i, j;
+ for(i = 0; i < x509Name->numberOfRDNs; i++)
+ {
+ const CSSM_X509_RDN *name = &x509Name->RelativeDistinguishedName[i];
+
+ for(j = 0; j < name->numberOfPairs; j++)
+ {
+ const CSSM_X509_TYPE_VALUE_PAIR *pair = &name->AttributeTypeAndValue[j];
+
+ NSString *value = DataToString(&pair->value, &pair->valueType);
+ if(value)
+ {
+ NSString *key = KeyForOid(&pair->type);
+ if(key)
+ [result setObject:value forKey:key];
+ else
+ [others addObject:value];
+ }
+ }
+ }
+
+ if([others count] > 0)
+ {
+ [result setObject:others forKey:X509_OTHERS];
+ }
+
+ return result;
+}
+
+static void AddCSSMField(const CSSM_FIELD *field, NSMutableDictionary *dict)
+{
+ const CSSM_DATA *fieldData = &field->FieldValue;
+ const CSSM_OID *fieldOid = &field->FieldOid;
+
+ if(CompareOids(fieldOid, &CSSMOID_X509V1SerialNumber))
+ {
+ NSData *data = RawToData(fieldData);
+ if(data)
+ {
+ [dict setObject:data forKey:X509_SERIAL_NUMBER];
+ }
+ }
+ else if(CompareOids(fieldOid, &CSSMOID_X509V1IssuerNameCStruct))
+ {
+ CSSM_X509_NAME_PTR issuer = (CSSM_X509_NAME_PTR)fieldData->Data;
+ if(issuer && fieldData->Length == sizeof(CSSM_X509_NAME))
+ {
+ NSDictionary *issuerDict = X509NameToDictionary(issuer);
+ if(issuerDict)
+ {
+ [dict setObject:issuerDict forKey:X509_ISSUER];
+ }
+ }
+ }
+ else if(CompareOids(fieldOid, &CSSMOID_X509V1SubjectNameCStruct))
+ {
+ CSSM_X509_NAME_PTR subject = (CSSM_X509_NAME_PTR)fieldData->Data;
+ if(subject && fieldData->Length == sizeof(CSSM_X509_NAME))
+ {
+ NSDictionary *subjectDict = X509NameToDictionary(subject);
+ if(subjectDict)
+ {
+ [dict setObject:subjectDict forKey:X509_SUBJECT];
+ }
+ }
+ }
+ else if(CompareOids(fieldOid, &CSSMOID_X509V1ValidityNotBefore))
+ {
+ CSSM_X509_TIME_PTR time = (CSSM_X509_TIME_PTR)fieldData->Data;
+ if(time && fieldData->Length == sizeof(CSSM_X509_TIME))
+ {
+ NSDate *date = TimeToDate((const char *)time->time.Data, time->time.Length);
+ if(date)
+ {
+ [dict setObject:date forKey:X509_NOT_VALID_BEFORE];
+ }
+ }
+ }
+ else if(CompareOids(fieldOid, &CSSMOID_X509V1ValidityNotAfter))
+ {
+ CSSM_X509_TIME_PTR time = (CSSM_X509_TIME_PTR)fieldData->Data;
+ if(time && fieldData->Length == sizeof(CSSM_X509_TIME))
+ {
+ NSDate *date = TimeToDate((const char *)time->time.Data, time->time.Length);
+ if(date)
+ {
+ [dict setObject:date forKey:X509_NOT_VALID_AFTER];
+ }
+ }
+ }
+ else if(CompareOids(fieldOid, &CSSMOID_X509V1SubjectPublicKeyCStruct))
+ {
+ CSSM_X509_SUBJECT_PUBLIC_KEY_INFO_PTR pubKeyInfo = (CSSM_X509_SUBJECT_PUBLIC_KEY_INFO_PTR)fieldData->Data;
+ if(pubKeyInfo && fieldData->Length == sizeof(CSSM_X509_SUBJECT_PUBLIC_KEY_INFO))
+ {
+ NSData *data = RawToData(&pubKeyInfo->subjectPublicKey);
+ if(data)
+ {
+ [dict setObject:data forKey:X509_PUBLIC_KEY];
+ }
+ }
+ }
+}
+
++ (NSDictionary *)extractCertDictFromAsyncSocket:(AsyncSocket *)socket
+{
+ if(socket == nil)
+ {
+ return nil;
+ }
+
+ return [self extractCertDictFromReadStream:[socket getCFReadStream]];
+}
+
++ (NSDictionary *)extractCertDictFromReadStream:(CFReadStreamRef)readStream
+{
+ if(readStream == NULL)
+ {
+ return nil;
+ }
+
+ NSDictionary *result = nil;
+
+ CFArrayRef certs = CFReadStreamCopyProperty(readStream, kCFStreamPropertySSLPeerCertificates);
+ if(certs && CFArrayGetCount(certs) > 0)
+ {
+ // The first cert in the chain is the subject cert
+ SecCertificateRef cert = (SecCertificateRef)CFArrayGetValueAtIndex(certs, 0);
+
+ result = [self extractCertDictFromCert:cert];
+ }
+
+ if(certs) CFRelease(certs);
+
+ return result;
+}
+
++ (NSDictionary *)extractCertDictFromIdentity:(SecIdentityRef)identity
+{
+ if(identity == NULL)
+ {
+ return nil;
+ }
+
+ NSDictionary *result = nil;
+ SecCertificateRef cert = NULL;
+
+ OSStatus err = SecIdentityCopyCertificate(identity, &cert);
+ if(err)
+ {
+ cssmPerror("SecIdentityCopyCertificate", err);
+ return nil;
+ }
+ else
+ {
+ result = [self extractCertDictFromCert:cert];
+ }
+
+ if(cert) CFRelease(cert);
+
+ return result;
+}
+
++ (NSDictionary *)extractCertDictFromCert:(SecCertificateRef)cert
+{
+ CSSM_CL_HANDLE clHandle = CLStartup();
+ if(clHandle == 0)
+ {
+ return nil;
+ }
+
+ NSMutableDictionary *result = nil;
+
+ CSSM_DATA certData;
+ if(SecCertificateGetData(cert, &certData) == noErr)
+ {
+ uint32 i;
+ uint32 numFields;
+ CSSM_FIELD_PTR fieldPtr;
+
+ CSSM_RETURN crtn = CSSM_CL_CertGetAllFields(clHandle, &certData, &numFields, &fieldPtr);
+ if(crtn == CSSM_OK)
+ {
+ result = [NSMutableDictionary dictionaryWithCapacity:6];
+
+ for(i = 0; i < numFields; i++)
+ {
+ AddCSSMField(&fieldPtr[i], result);
+ }
+
+ CSSM_CL_FreeFields(clHandle, numFields, &fieldPtr);
+ }
+ }
+
+ CLShutdown(clHandle);
+
+ return result;
+}
+
+@end
OSDN Git Service
