实现X509格式证书的链式校验
// cert_public.cpp : Defines the exported functions for the DLL application. // #include "stdafx.h" #include <string.h> #include <stdio.h> #include <string> #include <stdarg.h> #include <openssl/pem.h> #include <openssl/x509.h> #include <openssl/x509v3.h> #include "sm_public.h" extern "C" { /***************************************************************************** * @brief : 通过X509格式的字符串得到一个X509内部结构对象 * @author : xiaomw * @date : 2019/8/13 * @inparam : plaintext X509格式的字符串 * @return : 成功返回非0 失败返回0 *****************************************************************************/ CRYPT_SMDLL_C void* X509_Str2Object(const char *in) { BIO *bio_obj = NULL; X509* x509_obj = NULL; //根据字符串内容，构造一个BIO对象 bio_obj = BIO_new_mem_buf(in, strlen(in)); if (NULL == bio_obj){ return NULL; } //调用接口创建呗 x509_obj = (X509 *) PEM_ASN1_read_bio((d2i_of_void *)d2i_X509, PEM_STRING_X509, bio_obj, NULL, NULL, NULL); //释放对象 BIO_free(bio_obj); return x509_obj; } X509* _X509_RootCertStr2Object(const char *in) { BIO *bio_obj = NULL; X509* x509_obj = NULL; X509_INFO *itmp = NULL; STACK_OF(X509_INFO) *inf = NULL; //根据字符串内容，构造一个BIO对象 bio_obj = BIO_new_mem_buf(in, strlen(in)); if (NULL == bio_obj){ return NULL; } inf = PEM_X509_INFO_read_bio(bio_obj, NULL, NULL, NULL); //释放对象 BIO_free(bio_obj); if (NULL == inf){ return NULL; } for (int i = 0; i < sk_X509_INFO_num(inf); i++) { itmp = sk_X509_INFO_value(inf, i); if (itmp->x509) { //复制一个X509对象 x509_obj = X509_dup(itmp->x509); sk_X509_INFO_pop_free(inf, X509_INFO_free); return x509_obj; } } sk_X509_INFO_pop_free(inf, X509_INFO_free); return NULL; } static UINT32 _x509_get_entry_value(const X509_NAME* x509_name, X509_NAME_ENTRY_TYPE nEntry, char* value) { ASN1_STRING* strNameValue = NULL; const X509_NAME_ENTRY *x_name_entry = NULL; //获取到相应的NameEntry x_name_entry = X509_NAME_get_entry(x509_name, nEntry); if (NULL == x_name_entry) { return 1; } strNameValue = X509_NAME_ENTRY_get_data(x_name_entry); if (NULL == strNameValue) { return 1; } //拷贝内容 lstrcpyA(value, (const char*)ASN1_STRING_data(strNameValue)); return 0; } CRYPT_SMDLL_C UINT32 X509_GetIssuerName(const void* pX509_object, X509_NAME_ENTRY_TYPE nEntry, char* value) { const X509_NAME* x_name = NULL; ASN1_STRING* strNameValue = NULL; const X509_NAME_ENTRY *x_name_entry = NULL; if (NULL == pX509_object) { return 1; } //校验nEntry if (nEntry < NID_commonName || nEntry > NID_organizationalUnitName) { return 1; } //获取到值 x_name = X509_get_issuer_name((const X509*)pX509_object); if (NULL == x_name) { return 1; } //调用一样的接口返回 return _x509_get_entry_value(x_name, nEntry, value); } CRYPT_SMDLL_C UINT32 X509_GetSubjectName(const void* pX509_object, X509_NAME_ENTRY_TYPE nEntry, char* value) { const X509_NAME* x_name = NULL; ASN1_STRING* strNameValue = NULL; const X509_NAME_ENTRY *x_name_entry = NULL; if (NULL == pX509_object) { return 1; } //校验nEntry if (nEntry < NID_commonName || nEntry > NID_organizationalUnitName) { return 1; } //获取到值 x_name = X509_get_subject_name((const X509*)pX509_object); if (NULL == x_name) { return 1; } //调用一样的接口返回 return _x509_get_entry_value(x_name, nEntry, value); } class Mini_X509_Verify_Class { private: X509* x509_obj; X509_STORE * x509_store; STACK_OF(X509) * x509_chain; X509_STORE_CTX * x509_store_ctx; public: Mini_X509_Verify_Class(): x509_obj(NULL), x509_store(NULL), x509_chain(NULL), x509_store_ctx(NULL){} ~Mini_X509_Verify_Class() { if (NULL != x509_obj){ X509_free(x509_obj); } if (NULL != x509_store){ X509_STORE_free(x509_store); } if (NULL != x509_chain){ sk_X509_pop_free(x509_chain, X509_free); } if (NULL != x509_store_ctx){ X509_STORE_CTX_cleanup(x509_store_ctx); } } UINT32 set_verify_cert(const char* cert) { x509_obj = (X509*)X509_Str2Object(cert); if (NULL == x509_obj){ return 1; } return 0; } UINT32 add_root_cert(const char* root_cert) { //没有存储对象，则先创建一个 if (NULL == x509_store){ x509_store = X509_STORE_new(); if (NULL == x509_store) { return 1; } } //得到X509对象 X509* x509_root_obj = (X509*)_X509_RootCertStr2Object(root_cert); if (NULL == x509_root_obj){ return 1; } //加入存储区 if (0 == X509_STORE_add_cert(x509_store, x509_root_obj)){ X509_free(x509_root_obj); return 1; } return 0; } UINT32 add_cert_chain(const char* cert_node) { //没有X509链，则先创建一个 if (NULL == x509_chain){ x509_chain = sk_X509_new_null(); if (NULL == x509_chain) { return 1; } } //得到X509对象 X509* x509_node_obj = (X509*)X509_Str2Object(cert_node); if (NULL == x509_node_obj){ return 1; } //加入X509链 if (0 == sk_X509_push(x509_chain, x509_node_obj)){ X509_free(x509_node_obj); return 1; } return 0; } BOOL verify(X509* cert) { X509* pTemp = NULL; EVP_PKEY *pkey=NULL; // 每次都采取遍历证书的办法吧 if (NULL != x509_chain){ //获取链条总长度 int nSize = sk_X509_num(x509_chain); for (int index = 0; index < nSize; index ++) { //取出相应的数值 pTemp = sk_X509_value(x509_chain, index); //取出公钥 pkey = X509_get_pubkey(pTemp); //测试能否验证过，能够验证过，递归下去验证 if (X509_verify(cert, pkey)){ return verify(pTemp); } } } //如果链条中都验证不过，试一下根证书 STACK_OF(X509_OBJECT) * root_obj = X509_STORE_get0_objects(x509_store); if (NULL == root_obj) { return FALSE; } int root_obj_num = sk_X509_OBJECT_num(root_obj); if (root_obj_num <= 0) { return FALSE; } X509 *root_cert = NULL; X509_OBJECT* x509_obj = NULL; for(int j = 0; j < root_obj_num; j ++){ //取出OBJ x509_obj = sk_X509_OBJECT_value(root_obj, j); //取出证书 root_cert = X509_OBJECT_get0_X509(x509_obj); //取出公钥 pkey = X509_get_pubkey(root_cert); //测试能否验证过，能够验证过，返回成功 if (X509_verify(cert, pkey)){ return TRUE; } } return FALSE; } UINT32 verify_cert() { if (!x509_obj){ return 1; } if (verify(x509_obj)) { return 0; } return 1; } }; // 验证一个证书，输入根证书及相应的二级、三级...证书 UINT32 X509_Verify(const char *cert, const char* root_cert, UINT32 ulLevelNum, ...) { UINT32 index = 0; va_list arg_ptr; const char* cert_node = NULL; Mini_X509_Verify_Class x509_verify; if (NULL == cert) { return 1; } if (NULL == root_cert) { return 1; } //最多支持6级 if (ulLevelNum > 6) { return 1; } //存放待验证证书 if (x509_verify.set_verify_cert(cert)) { return 1; } //存放根证书 if (x509_verify.add_root_cert(root_cert)) { return 1; } va_start(arg_ptr, ulLevelNum); for(index = 0; index < ulLevelNum; index ++){ cert_node = va_arg(arg_ptr, const char*); //存放证书链接 if (x509_verify.add_cert_chain(cert_node)) { return 1; } } va_end(arg_ptr); //开始校验 if (x509_verify.verify_cert()) { return 1; } return 0; } };
DEMO验证代码
BOOL LoadCertFileToStr(const char* strFile, std::string& strBuff) { // 打开文件，读取内容 FILE * hSrcfile = NULL; fopen_s(&hSrcfile, strFile,"rb"); if (hSrcfile == NULL) { return FALSE; } //读取文件 fseek (hSrcfile, 0, SEEK_END); ///将文件指针移动文件结尾 long size = ftell (hSrcfile); ///求出当前文件指针距离文件开始的字节数 //分配内存 strBuff.resize(size + 1, '\0'); //重新开始读取文件 fseek (hSrcfile, 0, SEEK_SET); //读取文件 fread(&strBuff[0], size,1, hSrcfile); fclose(hSrcfile); return TRUE; } int main(int argc, char* argv[]) { //cwSL3D_test_sum();//测试能否成功调用所有接口 //至少两个证书文件 if (argc < 3) { std::cout << "缺少证书文件" << std::endl; return -1; } if (argc > 9) { std::cout << "证书文件过多，目前不支持" << std::endl; return -1; } //第一个证书文件，根证书文件 std::string root_cert; if (!LoadCertFileToStr(argv[1], root_cert)) { std::cout << "读取根证书文件失败" << std::endl; return -1; } //第二个证书文件，待验证的证书 std::string cert_file; if (!LoadCertFileToStr(argv[2], cert_file)) { std::cout << "读取待验证证书文件失败" << std::endl; return -1; } //后续的证书文件，证书链条上的文件 std::string cert_chain[6]; for(int index = 0; index < 6 && index < argc - 3; index ++) { if (!LoadCertFileToStr(argv[index + 3], cert_chain[index])) { std::cout << "读取证书文件失败:" << argv[index + 2] << std::endl; return -1; } } //直接调用接口验证吧 if (X509_Verify(cert_file.c_str(), root_cert.c_str(), argc - 3, cert_chain[0].c_str(), cert_chain[1].c_str(), cert_chain[2].c_str(), cert_chain[3].c_str(), cert_chain[4].c_str(), cert_chain[5].c_str())) { std::cout << "验证证书文件失败" << std::endl; return -1; } return 0; }