code review 10245048: crypto/x509: Added RFC 5280, section 4.2.2.1 Authority ...

src/pkg/crypto/x509/x509.go

 // Copyright 2009 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // Package x509 parses X.509-encoded keys and certificates.
 package x509
 
 import (
         "bytes"
         "crypto"
@@ skipping 445 matching lines @@
         ExtKeyUsage        []ExtKeyUsage           // Sequence of extended key usages.
         UnknownExtKeyUsage []asn1.ObjectIdentifier // Encountered extended key usages unknown to this package.
 
         BasicConstraintsValid bool // if true then the next two fields are valid.
         IsCA                  bool
         MaxPathLen            int
 
         SubjectKeyId   []byte
         AuthorityKeyId []byte
 
+        // RFC 5280, 4.2.2.1 (Authority Information Access)
+        OCSPServer            []string
+        IssuingCertificateURL []string
+
         // Subject Alternate Name values
         DNSNames       []string
         EmailAddresses []string
         IPAddresses    []net.IP
 
         // Name constraints
         PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
         PermittedDNSDomains         []string
 
         // CRL Distribution Points
@@ skipping 179 matching lines @@
 // RFC 5280, 4.2.1.10
 type nameConstraints struct {
         Permitted []generalSubtree `asn1:"optional,tag:0"`
         Excluded  []generalSubtree `asn1:"optional,tag:1"`
 }
 
 type generalSubtree struct {
         Name string `asn1:"tag:2,optional,ia5"`
 }
 
+// RFC 5280, 4.2.2.1
+type authorityInfoAccess struct {
+        Method   asn1.ObjectIdentifier
+        Location asn1.RawValue
+}
+
 // RFC 5280, 4.2.1.14
 type distributionPoint struct {
         DistributionPoint distributionPointName `asn1:"optional,tag:0"`
         Reason            asn1.BitString        `asn1:"optional,tag:1"`
         CRLIssuer         asn1.RawValue         `asn1:"optional,tag:2"`
 }
 
 type distributionPointName struct {
         FullName     asn1.RawValue    `asn1:"optional,tag:0"`
         RelativeName pkix.RDNSequence `asn1:"optional,tag:1"`
@@ skipping 318 matching lines @@
                                 // RFC 5280 4.2.1.4: Certificate Policies
                                 var policies []policyInformation
                                 if _, err = asn1.Unmarshal(e.Value, &policies); err != nil {
                                         return nil, err
                                 }
                                 out.PolicyIdentifiers = make([]asn1.ObjectIdentifier, len(policies))
                                 for i, policy := range policies {
                                         out.PolicyIdentifiers[i] = policy.Policy
                                 }
                         }
+                } else if e.Id.Equal(oidExtensionAuthorityInfoAccess) {
+                        // RFC 5280 4.2.2.1: Authority Information Access
+                        var aia []authorityInfoAccess
+                        if _, err = asn1.Unmarshal(e.Value, &aia); err != nil {
+                                return nil, err
+                        }
+
+                        for _, v := range aia {
+                                // GeneralName: uniformResourceIdentifier [6] IA5String
+                                if v.Location.Tag != 6 {
+                                        continue
+                                }
+                                if v.Method.Equal(oidAuthorityInfoAccessOcsp) {
+                                        out.OCSPServer = append(out.OCSPServer, string(v.Location.Bytes))
+                                } else if v.Method.Equal(oidAuthorityInfoAccessIssuers) {
+                                        out.IssuingCertificateURL = append(out.IssuingCertificateURL, string(v.Location.Bytes))
+                                }
+                        }
                 }
 
                 if e.Critical {
                         return out, UnhandledCriticalExtension{}
                 }
         }
 
         return out, nil
 }
 
@@ skipping 48 matching lines @@
 var (
         oidExtensionSubjectKeyId          = []int{2, 5, 29, 14}
         oidExtensionKeyUsage              = []int{2, 5, 29, 15}
         oidExtensionExtendedKeyUsage      = []int{2, 5, 29, 37}
         oidExtensionAuthorityKeyId        = []int{2, 5, 29, 35}
         oidExtensionBasicConstraints      = []int{2, 5, 29, 19}
         oidExtensionSubjectAltName        = []int{2, 5, 29, 17}
         oidExtensionCertificatePolicies   = []int{2, 5, 29, 32}
         oidExtensionNameConstraints       = []int{2, 5, 29, 30}
         oidExtensionCRLDistributionPoints = []int{2, 5, 29, 31}
+        oidExtensionAuthorityInfoAccess   = []int{1, 3, 6, 1, 5, 5, 7, 1, 1}
+)
+
+var (
+        oidAuthorityInfoAccessOcsp    = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1}
+        oidAuthorityInfoAccessIssuers = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 2}
 )
 
 func buildExtensions(template *Certificate) (ret []pkix.Extension, err error) {
-        ret = make([]pkix.Extension, 9 /* maximum number of elements. */)
+        ret = make([]pkix.Extension, 10 /* maximum number of elements. */)
         n := 0
 
         if template.KeyUsage != 0 {
                 ret[n].Id = oidExtensionKeyUsage
                 ret[n].Critical = true
 
                 var a [2]byte
                 a[0] = reverseBitsInAByte(byte(template.KeyUsage))
                 a[1] = reverseBitsInAByte(byte(template.KeyUsage >> 8))
 
@@ skipping 51 matching lines @@
 
         if len(template.AuthorityKeyId) > 0 {
                 ret[n].Id = oidExtensionAuthorityKeyId
                 ret[n].Value, err = asn1.Marshal(authKeyId{template.AuthorityKeyId})
                 if err != nil {
                         return
                 }
                 n++
         }
 
+        if len(template.OCSPServer) > 0 || len(template.IssuingCertificateURL) > 0 {
+                ret[n].Id = oidExtensionAuthorityInfoAccess
+                var aiaValues []authorityInfoAccess
+                for _, name := range template.OCSPServer {
+                        aiaValues = append(aiaValues, authorityInfoAccess{
+                                Method:   oidAuthorityInfoAccessOcsp,
+                                Location: asn1.RawValue{Tag: 6, Class: 2, Bytes: []byte(name)},
+                        })
+                }
+                for _, name := range template.IssuingCertificateURL {
+                        aiaValues = append(aiaValues, authorityInfoAccess{
+                                Method:   oidAuthorityInfoAccessIssuers,
+                                Location: asn1.RawValue{Tag: 6, Class: 2, Bytes: []byte(name)},
+                        })
+                }
+                ret[n].Value, err = asn1.Marshal(aiaValues)
+                if err != nil {
+                        return
+                }
+                n++
+        }
+
         if len(template.DNSNames) > 0 || len(template.EmailAddresses) > 0 || len(template.IPAddresses) > 0 {
                 ret[n].Id = oidExtensionSubjectAltName
                 var rawValues []asn1.RawValue
                 for _, name := range template.DNSNames {
                         rawValues = append(rawValues, asn1.RawValue{Tag: 2, Class: 2, Bytes: []byte(name)})
                 }
                 for _, email := range template.EmailAddresses {
                         rawValues = append(rawValues, asn1.RawValue{Tag: 1, Class: 2, Bytes: []byte(email)})
                 }
                 for _, rawIP := range template.IPAddresses {
@@ skipping 282 matching lines @@
         }
 
         return asn1.Marshal(pkix.CertificateList{
                 TBSCertList: tbsCertList,
                 SignatureAlgorithm: pkix.AlgorithmIdentifier{
                         Algorithm: oidSignatureSHA1WithRSA,
                 },
                 SignatureValue: asn1.BitString{Bytes: signature, BitLength: len(signature) * 8},
         })
 }