<commit_before>#include "create_crl.h"

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <ctype.h>
#include <fcntl.h>
#include <errno.h>
#include "util/cryptlib_compat.h"
#include "rpki-object/crl.h"
#include "rpki-object/certificate.h"
#include "rpki-asn1/extensions.h"
#include <rpki-asn1/roa.h>
#include <rpki-asn1/keyfile.h>
#include <casn/casn.h>
#include <casn/asn.h>
#include <time.h>
#include "create_object.h"
#include "obj_err.h"
#include "config/config.h"


/*
 * function declarations
 */
extern int sign_cert(
    struct Certificate *certp,
    char *keyname);
extern int fieldInTable(
    char *field,
    int field_len,
    struct object_field *tbl);
int get_table_value(
    char *name,
    struct object_field *table,
    char **value,
    int *type);
int use_pcert(
    void *crl,
    void *val);                 // filename of parent cert
int write_crl_iname(
    void *crl,
    void *val);
int write_lastUpdate_time(
    void *crl,
    void *val);
int write_nextUpdate_time(
    void *crl,
    void *val);
int write_revoked_certlist(
    void *crl,
    void *val);
int write_crl_aki(
    void *cert,
    void *val);
int write_crlNum(
    void *cert,
    void *val);

/*
 * Note: Some fields are in the table as optional but are actually required.
 * These are special cases where we could get the value from multiple places.
 * For example, Issuer Name can come from the parentcertfile (subject in the
 * parentcertfile) or it can be specified exactly as issuer)
 */
struct object_field crl_field_table[] = {
    {"outputfilename", TEXT, NULL, REQUIRED, NULL},
    {"parentcertfile", TEXT, NULL, OPTIONAL, use_pcert},
    {"parentkeyfile", TEXT, NULL, OPTIONAL, NULL},
    {"issuer", TEXT, NULL, OPTIONAL, write_crl_iname},
    {"thisupdate", TEXT, NULL, REQUIRED, write_lastUpdate_time},
    {"nextupdate", TEXT, NULL, REQUIRED, write_nextUpdate_time},
    {"crlnum", INTEGER, NULL, REQUIRED, write_crlNum},
    {"revokedcertlist", LIST, NULL, OPTIONAL, write_revoked_certlist},
    {"aki", OCTETSTRING, NULL, OPTIONAL, write_crl_aki},
    {"signatureValue", OCTETSTRING, NULL, OPTIONAL, NULL},
    {NULL, 0, NULL, REQUIRED, NULL}
};

struct object_field *get_crl_field_table(
    )
{
    return crl_field_table;
}


struct CRLExtension *findCrlExtension(
    struct CrlExtensions *extsp,
    char *oid)
{
    struct CRLExtension *extp;

    if (!num_items(&extsp->self))
        return (struct CRLExtension *)0;

    for (extp = (struct CRLExtension *)member_casn(&extsp->self, 0);
         extp && diff_objid(&extp->extnID, oid);
         extp = (struct CRLExtension *)next_of(&extp->self));
    return extp;
}


/*
 * Take values from the certificate and write them to the
 * current CRL
 * val is filename of the parent certificate
 * fields of interest:
 *    signature algorithm ID - overwrite (from template)
 *    issuer     - overwrite using issuer cert's subject
 *    aki        - overwrite using issuer cert's ski
 *    algorithm ID  overwrite (from template)
 */
int use_pcert(
    void *crl,
    void *val)
{
    struct Certificate issuer;
    struct CertificateRevocationList *crlp =
        (struct CertificateRevocationList *)crl;
    struct CertificateRevocationListToBeSigned *crltbsp = &crlp->toBeSigned;
    Certificate(&issuer, (ushort) 0);
    struct Extension *iextp;
    struct CRLExtension *cextp;

    if (val == NULL)
        return SUCCESS;

    if (get_casn_file(&issuer.self, val, 0) < 0)
    {
        fprintf(stdout, "can't use issuers cert %s", (char *)val);
        return -1;
    }
    // copy algorithm identifiers (overwrite template value)
    copy_casn(&crlp->algorithm.self, &issuer.toBeSigned.signature.self);
    copy_casn(&crltbsp->signature.self, &issuer.toBeSigned.signature.self);

    // copy subject name from issuer cert into issuer name in cert if issuer
    // name
    // not filled in.
    copy_casn(&crltbsp->issuer.self, &issuer.toBeSigned.subject.self);

    // overwrite crl aki extension using ski from issuer's cert
    if (!(iextp = find_extension(&issuer.toBeSigned.extensions,
                                 id_subjectKeyIdentifier, false)))
    {
        fprintf(stderr, "Error: could not obtain SKI from issuer cert");
        return -1;
    }
    cextp = findCrlExtension(&crltbsp->extensions, id_authKeyId);
    if (!cextp)
    {
        cextp =
            (struct CRLExtension *)inject_casn(&crltbsp->extensions.self, 0);
        write_objid(&cextp->extnID, id_authKeyId);
    }
    copy_casn(&cextp->extnValue.authKeyId.keyIdentifier,
              &iextp->extnValue.subjectKeyIdentifier);

    return (SUCCESS);
}

int write_revoked_entry(
    struct CertificateRevocationListToBeSigned *crltbsp,
    char *entry,
    int entry_len,
    int num)
{
    struct CRLEntry *crlentryp;
    char *str_num;
    char *eptr;
    char *rtime;
    int rtime_len,
        snum_len;
    long certnum;
    int utclen = 13;
    int glen = 15;

    // we have a % separated pair of serial number and date to add
    eptr = entry + entry_len;
    rtime = strchr(entry, '%');
    if (rtime != NULL)
    {
        crlentryp =
            (struct CRLEntry *)inject_casn(&crltbsp->revokedCertificates.self,
                                           num);
        if (!crlentryp)
            return -1;

        // pull out the serial number and convert to an int
        snum_len = rtime - entry;
        if ((str_num = calloc(snum_len, sizeof(char))) == NULL)
            return -1;
        memcpy(str_num, entry, snum_len);
        certnum = atoi(str_num);
        free(str_num);
        write_casn_num(&crlentryp->userCertificate, (long)certnum);

        // write out the time
        rtime++;
        rtime_len = eptr - rtime;<commit_msg>improve readability of object declarations/definitions<commit_after>#include "create_crl.h"

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <ctype.h>
#include <fcntl.h>
#include <errno.h>
#include "util/cryptlib_compat.h"
#include "rpki-object/crl.h"
#include "rpki-object/certificate.h"
#include "rpki-asn1/extensions.h"
#include <rpki-asn1/roa.h>
#include <rpki-asn1/keyfile.h>
#include <casn/casn.h>
#include <casn/asn.h>
#include <time.h>
#include "create_object.h"
#include "obj_err.h"
#include "config/config.h"


/*
 * function declarations
 */
extern int sign_cert(
    struct Certificate *certp,
    char *keyname);
extern int fieldInTable(
    char *field,
    int field_len,
    struct object_field *tbl);
int get_table_value(
    char *name,
    struct object_field *table,
    char **value,
    int *type);
int use_pcert(
    void *crl,
    void *val);                 // filename of parent cert
int write_crl_iname(
    void *crl,
    void *val);
int write_lastUpdate_time(
    void *crl,
    void *val);
int write_nextUpdate_time(
    void *crl,
    void *val);
int write_revoked_certlist(
    void *crl,
    void *val);
int write_crl_aki(
    void *cert,
    void *val);
int write_crlNum(
    void *cert,
    void *val);

/*
 * Note: Some fields are in the table as optional but are actually required.
 * These are special cases where we could get the value from multiple places.
 * For example, Issuer Name can come from the parentcertfile (subject in the
 * parentcertfile) or it can be specified exactly as issuer)
 */
struct object_field crl_field_table[] = {
    {"outputfilename", TEXT, NULL, REQUIRED, NULL},
    {"parentcertfile", TEXT, NULL, OPTIONAL, use_pcert},
    {"parentkeyfile", TEXT, NULL, OPTIONAL, NULL},
    {"issuer", TEXT, NULL, OPTIONAL, write_crl_iname},
    {"thisupdate", TEXT, NULL, REQUIRED, write_lastUpdate_time},
    {"nextupdate", TEXT, NULL, REQUIRED, write_nextUpdate_time},
    {"crlnum", INTEGER, NULL, REQUIRED, write_crlNum},
    {"revokedcertlist", LIST, NULL, OPTIONAL, write_revoked_certlist},
    {"aki", OCTETSTRING, NULL, OPTIONAL, write_crl_aki},
    {"signatureValue", OCTETSTRING, NULL, OPTIONAL, NULL},
    {NULL, 0, NULL, REQUIRED, NULL}
};

struct object_field *get_crl_field_table(
    )
{
    return crl_field_table;
}


struct CRLExtension *findCrlExtension(
    struct CrlExtensions *extsp,
    char *oid)
{
    struct CRLExtension *extp;

    if (!num_items(&extsp->self))
        return (struct CRLExtension *)0;

    for (extp = (struct CRLExtension *)member_casn(&extsp->self, 0);
         extp && diff_objid(&extp->extnID, oid);
         extp = (struct CRLExtension *)next_of(&extp->self));
    return extp;
}


/*
 * Take values from the certificate and write them to the
 * current CRL
 * val is filename of the parent certificate
 * fields of interest:
 *    signature algorithm ID - overwrite (from template)
 *    issuer     - overwrite using issuer cert's subject
 *    aki        - overwrite using issuer cert's ski
 *    algorithm ID  overwrite (from template)
 */
int use_pcert(
    void *crl,
    void *val)
{
    struct Certificate issuer;
    struct CertificateRevocationList *crlp =
        (struct CertificateRevocationList *)crl;
    struct CertificateRevocationListToBeSigned *crltbsp = &crlp->toBeSigned;
    Certificate(&issuer, (ushort) 0);
    struct Extension *iextp;
    struct CRLExtension *cextp;

    if (val == NULL)
        return SUCCESS;

    if (get_casn_file(&issuer.self, val, 0) < 0)
    {
        fprintf(stdout, "can't use issuers cert %s", (char *)val);
        return -1;
    }
    // copy algorithm identifiers (overwrite template value)
    copy_casn(&crlp->algorithm.self, &issuer.toBeSigned.signature.self);
    copy_casn(&crltbsp->signature.self, &issuer.toBeSigned.signature.self);

    // copy subject name from issuer cert into issuer name in cert if issuer
    // name
    // not filled in.
    copy_casn(&crltbsp->issuer.self, &issuer.toBeSigned.subject.self);

    // overwrite crl aki extension using ski from issuer's cert
    if (!(iextp = find_extension(&issuer.toBeSigned.extensions,
                                 id_subjectKeyIdentifier, false)))
    {
        fprintf(stderr, "Error: could not obtain SKI from issuer cert");
        return -1;
    }
    cextp = findCrlExtension(&crltbsp->extensions, id_authKeyId);
    if (!cextp)
    {
        cextp =
            (struct CRLExtension *)inject_casn(&crltbsp->extensions.self, 0);
        write_objid(&cextp->extnID, id_authKeyId);
    }
    copy_casn(&cextp->extnValue.authKeyId.keyIdentifier,
              &iextp->extnValue.subjectKeyIdentifier);

    return (SUCCESS);
}

int write_revoked_entry(
    struct CertificateRevocationListToBeSigned *crltbsp,
    char *entry,
    int entry_len,
    int num)
{
    struct CRLEntry *crlentryp;
    char *str_num;
    char *eptr;
    char *rtime;
    int rtime_len;
    int snum_len;
    long certnum;
    int utclen = 13;
    int glen = 15;

    // we have a % separated pair of serial number and date to add
    eptr = entry + entry_len;
    rtime = strchr(entry, '%');
    if (rtime != NULL)
    {
        crlentryp =
            (struct CRLEntry *)inject_casn(&crltbsp->revokedCertificates.self,
                                           num);
        if (!crlentryp)
            return -1;

        // pull out the serial number and convert to an int
        snum_len = rtime - entry;
        if ((str_num = calloc(snum_len, sizeof(char))) == NULL)
            return -1;
        memcpy(str_num, entry, snum_len);
        certnum = atoi(str_num);
        free(str_num);
        write_casn_num(&crlentryp->userCertificate, (long)certnum);

        // write out the time
        rtime++;
        rtime_len = eptr - rtime;
{'fraction_non_alphanumeric': 0.11490388759589691, 'fraction_numerical': 0.0031031807602792862, 'mean_word_length': 2.963785445848992, 'pattern_counts': {'":': 0, '<': 31, '<?xml version=': 0, '>': 59, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '812438', 'n_tokens_mistral': 4017, 'n_tokens_neox': 3900, 'n_words': 1044}