Source code
Revision control
Copy as Markdown
Other Tools
import * as asn1js from "asn1js";
import * as pvtsutils from "pvtsutils";
import * as pvutils from "pvutils";
import { AuthorityKeyIdentifier } from "./AuthorityKeyIdentifier";
import { BasicOCSPResponse } from "./BasicOCSPResponse";
import { Certificate } from "./Certificate";
import { CertificateRevocationList } from "./CertificateRevocationList";
import * as common from "./common";
import * as Helpers from "./Helpers";
import { GeneralName } from "./GeneralName";
import { id_AnyPolicy, id_AuthorityInfoAccess, id_AuthorityKeyIdentifier, id_BasicConstraints, id_CertificatePolicies, id_CRLDistributionPoints, id_FreshestCRL, id_InhibitAnyPolicy, id_KeyUsage, id_NameConstraints, id_PolicyConstraints, id_PolicyMappings, id_SubjectAltName, id_SubjectKeyIdentifier } from "./ObjectIdentifiers";
import { RelativeDistinguishedNames } from "./RelativeDistinguishedNames";
import { GeneralSubtree } from "./GeneralSubtree";
import { EMPTY_STRING } from "./constants";
const TRUSTED_CERTS = "trustedCerts";
const CERTS = "certs";
const CRLS = "crls";
const OCSPS = "ocsps";
const CHECK_DATE = "checkDate";
const FIND_ORIGIN = "findOrigin";
const FIND_ISSUER = "findIssuer";
export enum ChainValidationCode {
unknown = -1,
success = 0,
noRevocation = 11,
noPath = 60,
noValidPath = 97,
}
export class ChainValidationError extends Error {
public static readonly NAME = "ChainValidationError";
public code: ChainValidationCode;
constructor(code: ChainValidationCode, message: string) {
super(message);
this.name = ChainValidationError.NAME;
this.code = code;
this.message = message;
}
}
export interface CertificateChainValidationEngineVerifyResult {
result: boolean;
resultCode: number;
resultMessage: string;
error?: Error | ChainValidationError;
authConstrPolicies?: string[];
userConstrPolicies?: string[];
explicitPolicyIndicator?: boolean;
policyMappings?: string[];
certificatePath?: Certificate[];
}
export type FindOriginCallback = (certificate: Certificate, validationEngine: CertificateChainValidationEngine) => string;
export type FindIssuerCallback = (certificate: Certificate, validationEngine: CertificateChainValidationEngine, crypto?: common.ICryptoEngine) => Promise<Certificate[]>;
export interface CertificateChainValidationEngineParameters {
trustedCerts?: Certificate[];
certs?: Certificate[];
crls?: CertificateRevocationList[];
ocsps?: BasicOCSPResponse[];
checkDate?: Date;
findOrigin?: FindOriginCallback;
findIssuer?: FindIssuerCallback;
}
interface CrlAndCertificate {
crl: CertificateRevocationList;
certificate: Certificate;
}
interface FindCrlResult {
status: number;
statusMessage: string;
result?: CrlAndCertificate[];
}
export interface CertificateChainValidationEngineVerifyParams {
initialPolicySet?: string[];
initialExplicitPolicy?: boolean;
initialPolicyMappingInhibit?: boolean;
initialInhibitPolicy?: boolean;
initialPermittedSubtreesSet?: GeneralSubtree[];
initialExcludedSubtreesSet?: GeneralSubtree[];
initialRequiredNameForms?: GeneralSubtree[];
passedWhenNotRevValues?: boolean;
}
/**
* Returns `true` if the certificate is in the trusted list, otherwise `false`
* @param cert A certificate that is expected to be in the trusted list
* @param trustedList List of trusted certificates
* @returns
*/
function isTrusted(cert: Certificate, trustedList: Certificate[]): boolean {
for (let i = 0; i < trustedList.length; i++) {
if (pvtsutils.BufferSourceConverter.isEqual(cert.tbsView, trustedList[i].tbsView)) {
return true;
}
}
return false;
}
/**
* Represents a chain-building engine for {@link Certificate} certificates.
*
* @example
* ```js The following example demonstrates how to verify certificate chain
* const rootCa = pkijs.Certificate.fromBER(certRaw1);
* const intermediateCa = pkijs.Certificate.fromBER(certRaw2);
* const leafCert = pkijs.Certificate.fromBER(certRaw3);
* const crl1 = pkijs.CertificateRevocationList.fromBER(crlRaw1);
* const ocsp1 = pkijs.BasicOCSPResponse.fromBER(ocspRaw1);
*
* const chainEngine = new pkijs.CertificateChainValidationEngine({
* certs: [rootCa, intermediateCa, leafCert],
* crls: [crl1],
* ocsps: [ocsp1],
* checkDate: new Date("2015-07-13"), // optional
* trustedCerts: [rootCa],
* });
*
* const chain = await chainEngine.verify();
* ```
*/
export class CertificateChainValidationEngine {
/**
* Array of pre-defined trusted (by user) certificates
*/
public trustedCerts: Certificate[];
/**
* Array with certificate chain. Could be only one end-user certificate in there!
*/
public certs: Certificate[];
/**
* Array of all CRLs for all certificates from certificate chain
*/
public crls: CertificateRevocationList[];
/**
* Array of all OCSP responses
*/
public ocsps: BasicOCSPResponse[];
/**
* The date at which the check would be
*/
public checkDate: Date;
/**
* The date at which the check would be
*/
public findOrigin: FindOriginCallback;
/**
* The date at which the check would be
*/
public findIssuer: FindIssuerCallback;
/**
* Constructor for CertificateChainValidationEngine class
* @param parameters
*/
constructor(parameters: CertificateChainValidationEngineParameters = {}) {
//#region Internal properties of the object
this.trustedCerts = pvutils.getParametersValue(parameters, TRUSTED_CERTS, this.defaultValues(TRUSTED_CERTS));
this.certs = pvutils.getParametersValue(parameters, CERTS, this.defaultValues(CERTS));
this.crls = pvutils.getParametersValue(parameters, CRLS, this.defaultValues(CRLS));
this.ocsps = pvutils.getParametersValue(parameters, OCSPS, this.defaultValues(OCSPS));
this.checkDate = pvutils.getParametersValue(parameters, CHECK_DATE, this.defaultValues(CHECK_DATE));
this.findOrigin = pvutils.getParametersValue(parameters, FIND_ORIGIN, this.defaultValues(FIND_ORIGIN));
this.findIssuer = pvutils.getParametersValue(parameters, FIND_ISSUER, this.defaultValues(FIND_ISSUER));
//#endregion
}
public static defaultFindOrigin(certificate: Certificate, validationEngine: CertificateChainValidationEngine): string {
//#region Firstly encode TBS for certificate
if (certificate.tbsView.byteLength === 0) {
certificate.tbsView = new Uint8Array(certificate.encodeTBS().toBER());
}
//#endregion
//#region Search in Intermediate Certificates
for (const localCert of validationEngine.certs) {
//#region Firstly encode TBS for certificate
if (localCert.tbsView.byteLength === 0) {
localCert.tbsView = new Uint8Array(localCert.encodeTBS().toBER());
}
//#endregion
if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, localCert.tbsView))
return "Intermediate Certificates";
}
//#endregion
//#region Search in Trusted Certificates
for (const trustedCert of validationEngine.trustedCerts) {
//#region Firstly encode TBS for certificate
if (trustedCert.tbsView.byteLength === 0)
trustedCert.tbsView = new Uint8Array(trustedCert.encodeTBS().toBER());
//#endregion
if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, trustedCert.tbsView))
return "Trusted Certificates";
}
//#endregion
return "Unknown";
}
public async defaultFindIssuer(certificate: Certificate, validationEngine: CertificateChainValidationEngine, crypto = common.getCrypto(true)): Promise<Certificate[]> {
//#region Initial variables
const result: Certificate[] = [];
let keyIdentifier: asn1js.OctetString | null = null;
let authorityCertIssuer: GeneralName[] | null = null;
let authorityCertSerialNumber: asn1js.Integer | null = null;
//#endregion
//#region Speed-up searching in case of self-signed certificates
if (certificate.subject.isEqual(certificate.issuer)) {
try {
const verificationResult = await certificate.verify(undefined, crypto);
if (verificationResult) {
return [certificate];
}
}
catch (ex) {
// nothing
}
}
//#endregion
//#region Find values to speed-up search
if (certificate.extensions) {
for (const extension of certificate.extensions) {
if (extension.extnID === id_AuthorityKeyIdentifier && extension.parsedValue instanceof AuthorityKeyIdentifier) {
if (extension.parsedValue.keyIdentifier) {
keyIdentifier = extension.parsedValue.keyIdentifier;
} else {
if (extension.parsedValue.authorityCertIssuer) {
authorityCertIssuer = extension.parsedValue.authorityCertIssuer;
}
if (extension.parsedValue.authorityCertSerialNumber) {
authorityCertSerialNumber = extension.parsedValue.authorityCertSerialNumber;
}
}
break;
}
}
}
//#endregion
// Aux function
function checkCertificate(possibleIssuer: Certificate): void {
//#region Firstly search for appropriate extensions
if (keyIdentifier !== null) {
if (possibleIssuer.extensions) {
let extensionFound = false;
for (const extension of possibleIssuer.extensions) {
if (extension.extnID === id_SubjectKeyIdentifier && extension.parsedValue) {
extensionFound = true;
if (pvtsutils.BufferSourceConverter.isEqual(extension.parsedValue.valueBlock.valueHex, keyIdentifier.valueBlock.valueHexView)) {
result.push(possibleIssuer);
}
break;
}
}
if (extensionFound) {
return;
}
}
}
//#endregion
//#region Now search for authorityCertSerialNumber
let authorityCertSerialNumberEqual = false;
if (authorityCertSerialNumber !== null)
authorityCertSerialNumberEqual = possibleIssuer.serialNumber.isEqual(authorityCertSerialNumber);
//#endregion
//#region And at least search for Issuer data
if (authorityCertIssuer !== null) {
if (possibleIssuer.subject.isEqual(authorityCertIssuer)) {
if (authorityCertSerialNumberEqual)
result.push(possibleIssuer);
}
}
else {
if (certificate.issuer.isEqual(possibleIssuer.subject))
result.push(possibleIssuer);
}
//#endregion
}
// Search in Trusted Certificates
for (const trustedCert of validationEngine.trustedCerts) {
checkCertificate(trustedCert);
}
// Search in Intermediate Certificates
for (const intermediateCert of validationEngine.certs) {
checkCertificate(intermediateCert);
}
// Now perform certificate verification checking
for (let i = 0; i < result.length; i++) {
try {
const verificationResult = await certificate.verify(result[i], crypto);
if (verificationResult === false)
result.splice(i, 1);
}
catch (ex) {
result.splice(i, 1); // Something wrong, remove the certificate
}
}
return result;
}
/**
* Returns default values for all class members
* @param memberName String name for a class member
* @returns Default value
*/
public defaultValues(memberName: typeof TRUSTED_CERTS): Certificate[];
public defaultValues(memberName: typeof CERTS): Certificate[];
public defaultValues(memberName: typeof CRLS): CertificateRevocationList[];
public defaultValues(memberName: typeof OCSPS): BasicOCSPResponse[];
public defaultValues(memberName: typeof CHECK_DATE): Date;
public defaultValues(memberName: typeof FIND_ORIGIN): FindOriginCallback;
public defaultValues(memberName: typeof FIND_ISSUER): FindIssuerCallback;
public defaultValues(memberName: string): any {
switch (memberName) {
case TRUSTED_CERTS:
return [];
case CERTS:
return [];
case CRLS:
return [];
case OCSPS:
return [];
case CHECK_DATE:
return new Date();
case FIND_ORIGIN:
return CertificateChainValidationEngine.defaultFindOrigin;
case FIND_ISSUER:
return this.defaultFindIssuer;
default:
throw new Error(`Invalid member name for CertificateChainValidationEngine class: ${memberName}`);
}
}
public async sort(passedWhenNotRevValues = false, crypto = common.getCrypto(true)): Promise<Certificate[]> {
// Initial variables
const localCerts: Certificate[] = [];
//#region Building certificate path
const buildPath = async (certificate: Certificate, crypto: common.ICryptoEngine): Promise<Certificate[][]> => {
const result: Certificate[][] = [];
// Aux function checking array for unique elements
function checkUnique(array: Certificate[]): boolean {
let unique = true;
for (let i = 0; i < array.length; i++) {
for (let j = 0; j < array.length; j++) {
if (j === i)
continue;
if (array[i] === array[j]) {
unique = false;
break;
}
}
if (!unique)
break;
}
return unique;
}
if (isTrusted(certificate, this.trustedCerts)) {
return [[certificate]];
}
const findIssuerResult = await this.findIssuer(certificate, this, crypto);
if (findIssuerResult.length === 0) {
throw new Error("No valid certificate paths found");
}
for (let i = 0; i < findIssuerResult.length; i++) {
if (pvtsutils.BufferSourceConverter.isEqual(findIssuerResult[i].tbsView, certificate.tbsView)) {
result.push([findIssuerResult[i]]);
continue;
}
const buildPathResult = await buildPath(findIssuerResult[i], crypto);
for (let j = 0; j < buildPathResult.length; j++) {
const copy = buildPathResult[j].slice();
copy.splice(0, 0, findIssuerResult[i]);
if (checkUnique(copy))
result.push(copy);
else
result.push(buildPathResult[j]);
}
}
return result;
};
//#endregion
//#region Find CRL for specific certificate
const findCRL = async (certificate: Certificate): Promise<FindCrlResult> => {
//#region Initial variables
const issuerCertificates: Certificate[] = [];
const crls: CertificateRevocationList[] = [];
const crlsAndCertificates: CrlAndCertificate[] = [];
//#endregion
//#region Find all possible CRL issuers
issuerCertificates.push(...localCerts.filter(element => certificate.issuer.isEqual(element.subject)));
if (issuerCertificates.length === 0) {
return {
status: 1,
statusMessage: "No certificate's issuers"
};
}
//#endregion
//#region Find all CRLs for certificate's issuer
crls.push(...this.crls.filter(o => o.issuer.isEqual(certificate.issuer)));
if (crls.length === 0) {
return {
status: 2,
statusMessage: "No CRLs for specific certificate issuer"
};
}
//#endregion
//#region Find specific certificate of issuer for each CRL
for (let i = 0; i < crls.length; i++) {
const crl = crls[i];
//#region Check "nextUpdate" for the CRL
// The "nextUpdate" is older than CHECK_DATE.
// Thus we should do have another, updated CRL.
// Thus the CRL assumed to be invalid.
if (crl.nextUpdate && crl.nextUpdate.value < this.checkDate) {
continue;
}
//#endregion
for (let j = 0; j < issuerCertificates.length; j++) {
try {
const result = await crls[i].verify({ issuerCertificate: issuerCertificates[j] }, crypto);
if (result) {
crlsAndCertificates.push({
crl: crls[i],
certificate: issuerCertificates[j]
});
break;
}
}
catch (ex) {
// nothing
}
}
}
//#endregion
if (crlsAndCertificates.length) {
return {
status: 0,
statusMessage: EMPTY_STRING,
result: crlsAndCertificates
};
}
return {
status: 3,
statusMessage: "No valid CRLs found"
};
};
//#endregion
//#region Find OCSP for specific certificate
const findOCSP = async (certificate: Certificate, issuerCertificate: Certificate): Promise<number> => {
//#region Get hash algorithm from certificate
const hashAlgorithm = crypto.getAlgorithmByOID<any>(certificate.signatureAlgorithm.algorithmId);
if (!hashAlgorithm.name) {
return 1;
}
if (!hashAlgorithm.hash) {
return 1;
}
//#endregion
//#region Search for OCSP response for the certificate
for (let i = 0; i < this.ocsps.length; i++) {
const ocsp = this.ocsps[i];
const result = await ocsp.getCertificateStatus(certificate, issuerCertificate, crypto);
if (result.isForCertificate) {
if (result.status === 0)
return 0;
return 1;
}
}
//#endregion
return 2;
};
//#endregion
//#region Check for certificate to be CA
async function checkForCA(certificate: Certificate, needToCheckCRL = false) {
//#region Initial variables
let isCA = false;
let mustBeCA = false;
let keyUsagePresent = false;
let cRLSign = false;
//#endregion
if (certificate.extensions) {
for (let j = 0; j < certificate.extensions.length; j++) {
const extension = certificate.extensions[j];
if (extension.critical && !extension.parsedValue) {
return {
result: false,
resultCode: 6,
resultMessage: `Unable to parse critical certificate extension: ${extension.extnID}`
};
}
if (extension.extnID === id_KeyUsage) // KeyUsage
{
keyUsagePresent = true;
const view = new Uint8Array(extension.parsedValue.valueBlock.valueHex);
if ((view[0] & 0x04) === 0x04) // Set flag "keyCertSign"
mustBeCA = true;
if ((view[0] & 0x02) === 0x02) // Set flag "cRLSign"
cRLSign = true;
}
if (extension.extnID === id_BasicConstraints) // BasicConstraints
{
if ("cA" in extension.parsedValue) {
if (extension.parsedValue.cA === true)
isCA = true;
}
}
}
if ((mustBeCA === true) && (isCA === false)) {
return {
result: false,
resultCode: 3,
resultMessage: "Unable to build certificate chain - using \"keyCertSign\" flag set without BasicConstraints"
};
}
if ((keyUsagePresent === true) && (isCA === true) && (mustBeCA === false)) {
return {
result: false,
resultCode: 4,
resultMessage: "Unable to build certificate chain - \"keyCertSign\" flag was not set"
};
}
if ((isCA === true) && (keyUsagePresent === true) && ((needToCheckCRL) && (cRLSign === false))) {
return {
result: false,
resultCode: 5,
resultMessage: "Unable to build certificate chain - intermediate certificate must have \"cRLSign\" key usage flag"
};
}
}
if (isCA === false) {
return {
result: false,
resultCode: 7,
resultMessage: "Unable to build certificate chain - more than one possible end-user certificate"
};
}
return {
result: true,
resultCode: 0,
resultMessage: EMPTY_STRING
};
}
//#endregion
//#region Basic check for certificate path
const basicCheck = async (path: Certificate[], checkDate: Date): Promise<{ result: boolean; resultCode?: number; resultMessage?: string; }> => {
//#region Check that all dates are valid
for (let i = 0; i < path.length; i++) {
if ((path[i].notBefore.value > checkDate) ||
(path[i].notAfter.value < checkDate)) {
return {
result: false,
resultCode: 8,
resultMessage: "The certificate is either not yet valid or expired"
};
}
}
//#endregion
//#region Check certificate name chain
// We should have at least two certificates: end entity and trusted root
if (path.length < 2) {
return {
result: false,
resultCode: 9,
resultMessage: "Too short certificate path"
};
}
for (let i = (path.length - 2); i >= 0; i--) {
//#region Check that we do not have a "self-signed" certificate
if (path[i].issuer.isEqual(path[i].subject) === false) {
if (path[i].issuer.isEqual(path[i + 1].subject) === false) {
return {
result: false,
resultCode: 10,
resultMessage: "Incorrect name chaining"
};
}
}
//#endregion
}
//#endregion
//#region Check each certificate (except "trusted root") to be non-revoked
if ((this.crls.length !== 0) || (this.ocsps.length !== 0)) // If CRLs and OCSPs are empty then we consider all certificates to be valid
{
for (let i = 0; i < (path.length - 1); i++) {
//#region Initial variables
let ocspResult = 2;
let crlResult: FindCrlResult = {
status: 0,
statusMessage: EMPTY_STRING
};
//#endregion
//#region Check OCSPs first
if (this.ocsps.length !== 0) {
ocspResult = await findOCSP(path[i], path[i + 1]);
switch (ocspResult) {
case 0:
continue;
case 1:
return {
result: false,
resultCode: 12,
resultMessage: "One of certificates was revoked via OCSP response"
};
case 2: // continue to check the certificate with CRL
break;
default:
}
}
//#endregion
//#region Check CRLs
if (this.crls.length !== 0) {
crlResult = await findCRL(path[i]);
if (crlResult.status === 0 && crlResult.result) {
for (let j = 0; j < crlResult.result.length; j++) {
//#region Check that the CRL issuer certificate have not been revoked
const isCertificateRevoked = crlResult.result[j].crl.isCertificateRevoked(path[i]);
if (isCertificateRevoked) {
return {
result: false,
resultCode: 12,
resultMessage: "One of certificates had been revoked"
};
}
//#endregion
//#region Check that the CRL issuer certificate is a CA certificate
const isCertificateCA = await checkForCA(crlResult.result[j].certificate, true);
if (isCertificateCA.result === false) {
return {
result: false,
resultCode: 13,
resultMessage: "CRL issuer certificate is not a CA certificate or does not have crlSign flag"
};
}
//#endregion
}
} else {
if (passedWhenNotRevValues === false) {
throw new ChainValidationError(ChainValidationCode.noRevocation, `No revocation values found for one of certificates: ${crlResult.statusMessage}`);
}
}
} else {
if (ocspResult === 2) {
return {
result: false,
resultCode: 11,
resultMessage: "No revocation values found for one of certificates"
};
}
}
//#endregion
//#region Check we do have links to revocation values inside issuer's certificate
if ((ocspResult === 2) && (crlResult.status === 2) && passedWhenNotRevValues) {
const issuerCertificate = path[i + 1];
let extensionFound = false;
if (issuerCertificate.extensions) {
for (const extension of issuerCertificate.extensions) {
switch (extension.extnID) {
case id_CRLDistributionPoints:
case id_FreshestCRL:
case id_AuthorityInfoAccess:
extensionFound = true;
break;
default:
}
}
}
if (extensionFound) {
throw new ChainValidationError(ChainValidationCode.noRevocation, `No revocation values found for one of certificates: ${crlResult.statusMessage}`);
}
}
//#endregion
}
}
//#endregion
//#region Check each certificate (except "end entity") in the path to be a CA certificate
for (const [i, cert] of path.entries()) {
if (!i) {
// Skip entity certificate
continue;
}
const result = await checkForCA(cert);
if (!result.result) {
return {
result: false,
resultCode: 14,
resultMessage: "One of intermediate certificates is not a CA certificate"
};
}
}
//#endregion
return {
result: true
};
};
//#endregion
//#region Do main work
//#region Initialize "localCerts" by value of "this.certs" + "this.trustedCerts" arrays
localCerts.push(...this.trustedCerts);
localCerts.push(...this.certs);
//#endregion
//#region Check all certificates for been unique
for (let i = 0; i < localCerts.length; i++) {
for (let j = 0; j < localCerts.length; j++) {
if (i === j)
continue;
if (pvtsutils.BufferSourceConverter.isEqual(localCerts[i].tbsView, localCerts[j].tbsView)) {
localCerts.splice(j, 1);
i = 0;
break;
}
}
}
//#endregion
const leafCert = localCerts[localCerts.length - 1];
//#region Initial variables
let result;
const certificatePath = [leafCert]; // The "end entity" certificate must be the least in CERTS array
//#endregion
//#region Build path for "end entity" certificate
result = await buildPath(leafCert, crypto);
if (result.length === 0) {
throw new ChainValidationError(ChainValidationCode.noPath, "Unable to find certificate path");
}
//#endregion
//#region Exclude certificate paths not ended with "trusted roots"
for (let i = 0; i < result.length; i++) {
let found = false;
for (let j = 0; j < (result[i]).length; j++) {
const certificate = (result[i])[j];
for (let k = 0; k < this.trustedCerts.length; k++) {
if (pvtsutils.BufferSourceConverter.isEqual(certificate.tbsView, this.trustedCerts[k].tbsView)) {
found = true;
break;
}
}
if (found)
break;
}
if (!found) {
result.splice(i, 1);
i = 0;
}
}
if (result.length === 0) {
throw new ChainValidationError(ChainValidationCode.noValidPath, "No valid certificate paths found");
}
//#endregion
//#region Find shortest certificate path (for the moment it is the only criteria)
let shortestLength = result[0].length;
let shortestIndex = 0;
for (let i = 0; i < result.length; i++) {
if (result[i].length < shortestLength) {
shortestLength = result[i].length;
shortestIndex = i;
}
}
//#endregion
//#region Create certificate path for basic check
for (let i = 0; i < result[shortestIndex].length; i++)
certificatePath.push((result[shortestIndex])[i]);
//#endregion
//#region Perform basic checking for all certificates in the path
result = await basicCheck(certificatePath, this.checkDate);
if (result.result === false)
throw result;
//#endregion
return certificatePath;
//#endregion
}
/**
* Major verification function for certificate chain.
* @param parameters
* @param crypto Crypto engine
* @returns
*/
async verify(parameters: CertificateChainValidationEngineVerifyParams = {}, crypto = common.getCrypto(true)): Promise<CertificateChainValidationEngineVerifyResult> {
//#region Auxiliary functions for name constraints checking
/**
* Compare two dNSName values
* @param name DNS from name
* @param constraint Constraint for DNS from name
* @returns Boolean result - valid or invalid the "name" against the "constraint"
*/
function compareDNSName(name: string, constraint: string): boolean {
//#region Make a "string preparation" for both name and constrain
const namePrepared = Helpers.stringPrep(name);
const constraintPrepared = Helpers.stringPrep(constraint);
//#endregion
//#region Make a "splitted" versions of "constraint" and "name"
const nameSplitted = namePrepared.split(".");
const constraintSplitted = constraintPrepared.split(".");
//#endregion
//#region Length calculation and additional check
const nameLen = nameSplitted.length;
const constrLen = constraintSplitted.length;
if ((nameLen === 0) || (constrLen === 0) || (nameLen < constrLen)) {
return false;
}
//#endregion
//#region Check that no part of "name" has zero length
for (let i = 0; i < nameLen; i++) {
if (nameSplitted[i].length === 0) {
return false;
}
}
//#endregion
//#region Check that no part of "constraint" has zero length
for (let i = 0; i < constrLen; i++) {
if (constraintSplitted[i].length === 0) {
if (i === 0) {
if (constrLen === 1) {
return false;
}
continue;
}
return false;
}
}
//#endregion
//#region Check that "name" has a tail as "constraint"
for (let i = 0; i < constrLen; i++) {
if (constraintSplitted[constrLen - 1 - i].length === 0) {
continue;
}
if (nameSplitted[nameLen - 1 - i].localeCompare(constraintSplitted[constrLen - 1 - i]) !== 0) {
return false;
}
}
//#endregion
return true;
}
/**
* Compare two rfc822Name values
* @param name E-mail address from name
* @param constraint Constraint for e-mail address from name
* @returns Boolean result - valid or invalid the "name" against the "constraint"
*/
function compareRFC822Name(name: string, constraint: string): boolean {
//#region Make a "string preparation" for both name and constrain
const namePrepared = Helpers.stringPrep(name);
const constraintPrepared = Helpers.stringPrep(constraint);
//#endregion
//#region Make a "splitted" versions of "constraint" and "name"
const nameSplitted = namePrepared.split("@");
const constraintSplitted = constraintPrepared.split("@");
//#endregion
//#region Splitted array length checking
if ((nameSplitted.length === 0) || (constraintSplitted.length === 0) || (nameSplitted.length < constraintSplitted.length))
return false;
//#endregion
if (constraintSplitted.length === 1) {
const result = compareDNSName(nameSplitted[1], constraintSplitted[0]);
if (result) {
//#region Make a "splitted" versions of domain name from "constraint" and "name"
const ns = nameSplitted[1].split(".");
const cs = constraintSplitted[0].split(".");
//#endregion
if (cs[0].length === 0)
return true;
return ns.length === cs.length;
}
return false;
}
return (namePrepared.localeCompare(constraintPrepared) === 0);
}
/**
* Compare two uniformResourceIdentifier values
* @param name uniformResourceIdentifier from name
* @param constraint Constraint for uniformResourceIdentifier from name
* @returns Boolean result - valid or invalid the "name" against the "constraint"
*/
function compareUniformResourceIdentifier(name: string, constraint: string): boolean {
//#region Make a "string preparation" for both name and constrain
let namePrepared = Helpers.stringPrep(name);
const constraintPrepared = Helpers.stringPrep(constraint);
//#endregion
//#region Find out a major URI part to compare with
const ns = namePrepared.split("/");
const cs = constraintPrepared.split("/");
if (cs.length > 1) // Malformed constraint
return false;
if (ns.length > 1) // Full URI string
{
for (let i = 0; i < ns.length; i++) {
if ((ns[i].length > 0) && (ns[i].charAt(ns[i].length - 1) !== ":")) {
const nsPort = ns[i].split(":");
namePrepared = nsPort[0];
break;
}
}
}
//#endregion
const result = compareDNSName(namePrepared, constraintPrepared);
if (result) {
//#region Make a "splitted" versions of "constraint" and "name"
const nameSplitted = namePrepared.split(".");
const constraintSplitted = constraintPrepared.split(".");
//#endregion
if (constraintSplitted[0].length === 0)
return true;
return nameSplitted.length === constraintSplitted.length;
}
return false;
}
/**
* Compare two iPAddress values
* @param name iPAddress from name
* @param constraint Constraint for iPAddress from name
* @returns Boolean result - valid or invalid the "name" against the "constraint"
*/
function compareIPAddress(name: asn1js.OctetString, constraint: asn1js.OctetString): boolean {
//#region Common variables
const nameView = name.valueBlock.valueHexView;
const constraintView = constraint.valueBlock.valueHexView;
//#endregion
//#region Work with IPv4 addresses
if ((nameView.length === 4) && (constraintView.length === 8)) {
for (let i = 0; i < 4; i++) {
if ((nameView[i] ^ constraintView[i]) & constraintView[i + 4])
return false;
}
return true;
}
//#endregion
//#region Work with IPv6 addresses
if ((nameView.length === 16) && (constraintView.length === 32)) {
for (let i = 0; i < 16; i++) {
if ((nameView[i] ^ constraintView[i]) & constraintView[i + 16])
return false;
}
return true;
}
//#endregion
return false;
}
/**
* Compare two directoryName values
* @param name directoryName from name
* @param constraint Constraint for directoryName from name
* @returns Boolean result - valid or invalid the "name" against the "constraint"
*/
function compareDirectoryName(name: RelativeDistinguishedNames, constraint: RelativeDistinguishedNames): boolean {
//#region Initial check
if ((name.typesAndValues.length === 0) || (constraint.typesAndValues.length === 0))
return true;
if (name.typesAndValues.length < constraint.typesAndValues.length)
return false;
//#endregion
//#region Initial variables
let result = true;
let nameStart = 0;
//#endregion
for (let i = 0; i < constraint.typesAndValues.length; i++) {
let localResult = false;
for (let j = nameStart; j < name.typesAndValues.length; j++) {
localResult = name.typesAndValues[j].isEqual(constraint.typesAndValues[i]);
if (name.typesAndValues[j].type === constraint.typesAndValues[i].type)
result = result && localResult;
if (localResult === true) {
if ((nameStart === 0) || (nameStart === j)) {
nameStart = j + 1;
break;
}
else // Structure of "name" must be the same with "constraint"
return false;
}
}
if (localResult === false)
return false;
}
return (nameStart === 0) ? false : result;
}
//#endregion
try {
//#region Initial checks
if (this.certs.length === 0)
throw new Error("Empty certificate array");
//#endregion
//#region Get input variables
const passedWhenNotRevValues = parameters.passedWhenNotRevValues || false;
const initialPolicySet = parameters.initialPolicySet || [id_AnyPolicy];
const initialExplicitPolicy = parameters.initialExplicitPolicy || false;
const initialPolicyMappingInhibit = parameters.initialPolicyMappingInhibit || false;
const initialInhibitPolicy = parameters.initialInhibitPolicy || false;
const initialPermittedSubtreesSet = parameters.initialPermittedSubtreesSet || [];
const initialExcludedSubtreesSet = parameters.initialExcludedSubtreesSet || [];
const initialRequiredNameForms = parameters.initialRequiredNameForms || [];
let explicitPolicyIndicator = initialExplicitPolicy;
let policyMappingInhibitIndicator = initialPolicyMappingInhibit;
let inhibitAnyPolicyIndicator = initialInhibitPolicy;
const pendingConstraints = [
false, // For "explicitPolicyPending"
false, // For "policyMappingInhibitPending"
false, // For "inhibitAnyPolicyPending"
];
let explicitPolicyPending = 0;
let policyMappingInhibitPending = 0;
let inhibitAnyPolicyPending = 0;
let permittedSubtrees = initialPermittedSubtreesSet;
let excludedSubtrees = initialExcludedSubtreesSet;
const requiredNameForms = initialRequiredNameForms;
let pathDepth = 1;
//#endregion
//#region Sorting certificates in the chain array
this.certs = await this.sort(passedWhenNotRevValues, crypto);
//#endregion
//#region Work with policies
//#region Support variables
const allPolicies: string[] = []; // Array of all policies (string values)
allPolicies.push(id_AnyPolicy); // Put "anyPolicy" at first place
const policiesAndCerts = []; // In fact "array of array" where rows are for each specific policy, column for each certificate and value is "true/false"
const anyPolicyArray = new Array(this.certs.length - 1); // Minus "trusted anchor"
for (let ii = 0; ii < (this.certs.length - 1); ii++)
anyPolicyArray[ii] = true;
policiesAndCerts.push(anyPolicyArray);
const policyMappings = new Array(this.certs.length - 1); // Array of "PolicyMappings" for each certificate
const certPolicies = new Array(this.certs.length - 1); // Array of "CertificatePolicies" for each certificate
let explicitPolicyStart = (explicitPolicyIndicator) ? (this.certs.length - 1) : (-1);
//#endregion
//#region Gather all necessary information from certificate chain
for (let i = (this.certs.length - 2); i >= 0; i--, pathDepth++) {
const cert = this.certs[i];
if (cert.extensions) {
//#region Get information about certificate extensions
for (let j = 0; j < cert.extensions.length; j++) {
const extension = cert.extensions[j];
//#region CertificatePolicies
if (extension.extnID === id_CertificatePolicies) {
certPolicies[i] = extension.parsedValue;
//#region Remove entry from "anyPolicies" for the certificate
for (let s = 0; s < allPolicies.length; s++) {
if (allPolicies[s] === id_AnyPolicy) {
delete (policiesAndCerts[s])[i];
break;
}
}
//#endregion
for (let k = 0; k < extension.parsedValue.certificatePolicies.length; k++) {
let policyIndex = (-1);
const policyId = extension.parsedValue.certificatePolicies[k].policyIdentifier;
//#region Try to find extension in "allPolicies" array
for (let s = 0; s < allPolicies.length; s++) {
if (policyId === allPolicies[s]) {
policyIndex = s;
break;
}
}
//#endregion
if (policyIndex === (-1)) {
allPolicies.push(policyId);
const certArray = new Array(this.certs.length - 1);
certArray[i] = true;
policiesAndCerts.push(certArray);
}
else
(policiesAndCerts[policyIndex])[i] = true;
}
}
//#endregion
//#region PolicyMappings
if (extension.extnID === id_PolicyMappings) {
if (policyMappingInhibitIndicator) {
return {
result: false,
resultCode: 98,
resultMessage: "Policy mapping prohibited"
};
}
policyMappings[i] = extension.parsedValue;
}
//#endregion
//#region PolicyConstraints
if (extension.extnID === id_PolicyConstraints) {
if (explicitPolicyIndicator === false) {
//#region requireExplicitPolicy
if (extension.parsedValue.requireExplicitPolicy === 0) {
explicitPolicyIndicator = true;
explicitPolicyStart = i;
}
else {
if (pendingConstraints[0] === false) {
pendingConstraints[0] = true;
explicitPolicyPending = extension.parsedValue.requireExplicitPolicy;
}
else
explicitPolicyPending = (explicitPolicyPending > extension.parsedValue.requireExplicitPolicy) ? extension.parsedValue.requireExplicitPolicy : explicitPolicyPending;
}
//#endregion
//#region inhibitPolicyMapping
if (extension.parsedValue.inhibitPolicyMapping === 0)
policyMappingInhibitIndicator = true;
else {
if (pendingConstraints[1] === false) {
pendingConstraints[1] = true;
policyMappingInhibitPending = extension.parsedValue.inhibitPolicyMapping + 1;
}
else
policyMappingInhibitPending = (policyMappingInhibitPending > (extension.parsedValue.inhibitPolicyMapping + 1)) ? (extension.parsedValue.inhibitPolicyMapping + 1) : policyMappingInhibitPending;
}
//#endregion
}
}
//#endregion
//#region InhibitAnyPolicy
if (extension.extnID === id_InhibitAnyPolicy) {
if (inhibitAnyPolicyIndicator === false) {
if (extension.parsedValue.valueBlock.valueDec === 0)
inhibitAnyPolicyIndicator = true;
else {
if (pendingConstraints[2] === false) {
pendingConstraints[2] = true;
inhibitAnyPolicyPending = extension.parsedValue.valueBlock.valueDec;
}
else
inhibitAnyPolicyPending = (inhibitAnyPolicyPending > extension.parsedValue.valueBlock.valueDec) ? extension.parsedValue.valueBlock.valueDec : inhibitAnyPolicyPending;
}
}
}
//#endregion
}
//#endregion
//#region Check "inhibitAnyPolicyIndicator"
if (inhibitAnyPolicyIndicator === true) {
let policyIndex = (-1);
//#region Find "anyPolicy" index
for (let searchAnyPolicy = 0; searchAnyPolicy < allPolicies.length; searchAnyPolicy++) {
if (allPolicies[searchAnyPolicy] === id_AnyPolicy) {
policyIndex = searchAnyPolicy;
break;
}
}
//#endregion
if (policyIndex !== (-1))
delete (policiesAndCerts[0])[i]; // Unset value to "undefined" for "anyPolicies" value for current certificate
}
//#endregion
//#region Process with "pending constraints"
if (explicitPolicyIndicator === false) {
if (pendingConstraints[0] === true) {
explicitPolicyPending--;
if (explicitPolicyPending === 0) {
explicitPolicyIndicator = true;
explicitPolicyStart = i;
pendingConstraints[0] = false;
}
}
}
if (policyMappingInhibitIndicator === false) {
if (pendingConstraints[1] === true) {
policyMappingInhibitPending--;
if (policyMappingInhibitPending === 0) {
policyMappingInhibitIndicator = true;
pendingConstraints[1] = false;
}
}
}
if (inhibitAnyPolicyIndicator === false) {
if (pendingConstraints[2] === true) {
inhibitAnyPolicyPending--;
if (inhibitAnyPolicyPending === 0) {
inhibitAnyPolicyIndicator = true;
pendingConstraints[2] = false;
}
}
}
//#endregion
}
}
//#endregion
//#region Working with policy mappings
for (let i = 0; i < (this.certs.length - 1); i++) {
//#region Check that there is "policy mapping" for level "i + 1"
if ((i < (this.certs.length - 2)) && (typeof policyMappings[i + 1] !== "undefined")) {
for (let k = 0; k < policyMappings[i + 1].mappings.length; k++) {
//#region Check that we do not have "anyPolicy" in current mapping
if ((policyMappings[i + 1].mappings[k].issuerDomainPolicy === id_AnyPolicy) || (policyMappings[i + 1].mappings[k].subjectDomainPolicy === id_AnyPolicy)) {
return {
result: false,
resultCode: 99,
resultMessage: "The \"anyPolicy\" should not be a part of policy mapping scheme"
};
}
//#endregion
//#region Initial variables
let issuerDomainPolicyIndex = (-1);
let subjectDomainPolicyIndex = (-1);
//#endregion
//#region Search for index of policies indexes
for (let n = 0; n < allPolicies.length; n++) {
if (allPolicies[n] === policyMappings[i + 1].mappings[k].issuerDomainPolicy)
issuerDomainPolicyIndex = n;
if (allPolicies[n] === policyMappings[i + 1].mappings[k].subjectDomainPolicy)
subjectDomainPolicyIndex = n;
}
//#endregion
//#region Delete existing "issuerDomainPolicy" because on the level we mapped the policy to another one
if (typeof (policiesAndCerts[issuerDomainPolicyIndex])[i] !== "undefined")
delete (policiesAndCerts[issuerDomainPolicyIndex])[i];
//#endregion
//#region Check all policies for the certificate
for (let j = 0; j < certPolicies[i].certificatePolicies.length; j++) {
if (policyMappings[i + 1].mappings[k].subjectDomainPolicy === certPolicies[i].certificatePolicies[j].policyIdentifier) {
//#region Set mapped policy for current certificate
if ((issuerDomainPolicyIndex !== (-1)) && (subjectDomainPolicyIndex !== (-1))) {
for (let m = 0; m <= i; m++) {
if (typeof (policiesAndCerts[subjectDomainPolicyIndex])[m] !== "undefined") {
(policiesAndCerts[issuerDomainPolicyIndex])[m] = true;
delete (policiesAndCerts[subjectDomainPolicyIndex])[m];
}
}
}
//#endregion
}
}
//#endregion
}
}
//#endregion
}
//#endregion
//#region Working with "explicitPolicyIndicator" and "anyPolicy"
for (let i = 0; i < allPolicies.length; i++) {
if (allPolicies[i] === id_AnyPolicy) {
for (let j = 0; j < explicitPolicyStart; j++)
delete (policiesAndCerts[i])[j];
}
}
//#endregion
//#region Create "set of authorities-constrained policies"
const authConstrPolicies = [];
for (let i = 0; i < policiesAndCerts.length; i++) {
let found = true;
for (let j = 0; j < (this.certs.length - 1); j++) {
let anyPolicyFound = false;
if ((j < explicitPolicyStart) && (allPolicies[i] === id_AnyPolicy) && (allPolicies.length > 1)) {
found = false;
break;
}
if (typeof (policiesAndCerts[i])[j] === "undefined") {
if (j >= explicitPolicyStart) {
//#region Search for "anyPolicy" in the policy set
for (let k = 0; k < allPolicies.length; k++) {
if (allPolicies[k] === id_AnyPolicy) {
if ((policiesAndCerts[k])[j] === true)
anyPolicyFound = true;
break;
}
}
//#endregion
}
if (!anyPolicyFound) {
found = false;
break;
}
}
}
if (found === true)
authConstrPolicies.push(allPolicies[i]);
}
//#endregion
//#region Create "set of user-constrained policies"
let userConstrPolicies: string[] = [];
if ((initialPolicySet.length === 1) && (initialPolicySet[0] === id_AnyPolicy) && (explicitPolicyIndicator === false))
userConstrPolicies = initialPolicySet;
else {
if ((authConstrPolicies.length === 1) && (authConstrPolicies[0] === id_AnyPolicy))
userConstrPolicies = initialPolicySet;
else {
for (let i = 0; i < authConstrPolicies.length; i++) {
for (let j = 0; j < initialPolicySet.length; j++) {
if ((initialPolicySet[j] === authConstrPolicies[i]) || (initialPolicySet[j] === id_AnyPolicy)) {
userConstrPolicies.push(authConstrPolicies[i]);
break;
}
}
}
}
}
//#endregion
//#region Combine output object
const policyResult: CertificateChainValidationEngineVerifyResult = {
result: (userConstrPolicies.length > 0),
resultCode: 0,
resultMessage: (userConstrPolicies.length > 0) ? EMPTY_STRING : "Zero \"userConstrPolicies\" array, no intersections with \"authConstrPolicies\"",
authConstrPolicies,
userConstrPolicies,
explicitPolicyIndicator,
policyMappings,
certificatePath: this.certs
};
if (userConstrPolicies.length === 0)
return policyResult;
//#endregion
//#endregion
//#region Work with name constraints
//#region Check a result from "policy checking" part
if (policyResult.result === false)
return policyResult;
//#endregion
//#region Check all certificates, excluding "trust anchor"
pathDepth = 1;
for (let i = (this.certs.length - 2); i >= 0; i--, pathDepth++) {
const cert = this.certs[i];
//#region Support variables
let subjectAltNames: GeneralName[] = [];
let certPermittedSubtrees: GeneralSubtree[] = [];
let certExcludedSubtrees: GeneralSubtree[] = [];
//#endregion
if (cert.extensions) {
for (let j = 0; j < cert.extensions.length; j++) {
const extension = cert.extensions[j];
//#region NameConstraints
if (extension.extnID === id_NameConstraints) {
if ("permittedSubtrees" in extension.parsedValue)
certPermittedSubtrees = certPermittedSubtrees.concat(extension.parsedValue.permittedSubtrees);
if ("excludedSubtrees" in extension.parsedValue)
certExcludedSubtrees = certExcludedSubtrees.concat(extension.parsedValue.excludedSubtrees);
}
//#endregion
//#region SubjectAltName
if (extension.extnID === id_SubjectAltName)
subjectAltNames = subjectAltNames.concat(extension.parsedValue.altNames);
//#endregion
}
}
//#region Checking for "required name forms"
let formFound = (requiredNameForms.length <= 0);
for (let j = 0; j < requiredNameForms.length; j++) {
switch (requiredNameForms[j].base.type) {
case 4: // directoryName
{
if (requiredNameForms[j].base.value.typesAndValues.length !== cert.subject.typesAndValues.length)
continue;
formFound = true;
for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
if (cert.subject.typesAndValues[k].type !== requiredNameForms[j].base.value.typesAndValues[k].type) {
formFound = false;
break;
}
}
if (formFound === true)
break;
}
break;
default: // ??? Probably here we should reject the certificate ???
}
}
if (formFound === false) {
policyResult.result = false;
policyResult.resultCode = 21;
policyResult.resultMessage = "No necessary name form found";
throw policyResult;
}
//#endregion
//#region Checking for "permited sub-trees"
//#region Make groups for all types of constraints
const constrGroups: GeneralSubtree[][] = [ // Array of array for groupped constraints
[], // rfc822Name
[], // dNSName
[], // directoryName
[], // uniformResourceIdentifier
[], // iPAddress
];
for (let j = 0; j < permittedSubtrees.length; j++) {
switch (permittedSubtrees[j].base.type) {
//#region rfc822Name
case 1:
constrGroups[0].push(permittedSubtrees[j]);
break;
//#endregion
//#region dNSName
case 2:
constrGroups[1].push(permittedSubtrees[j]);
break;
//#endregion
//#region directoryName
case 4:
constrGroups[2].push(permittedSubtrees[j]);
break;
//#endregion
//#region uniformResourceIdentifier
case 6:
constrGroups[3].push(permittedSubtrees[j]);
break;
//#endregion
//#region iPAddress
case 7:
constrGroups[4].push(permittedSubtrees[j]);
break;
//#endregion
//#region default
default:
//#endregion
}
}
//#endregion
//#region Check name constraints groupped by type, one-by-one
for (let p = 0; p < 5; p++) {
let groupPermitted = false;
let valueExists = false;
const group = constrGroups[p];
for (let j = 0; j < group.length; j++) {
switch (p) {
//#region rfc822Name
case 0:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 1) // rfc822Name
{
valueExists = true;
groupPermitted = groupPermitted || compareRFC822Name(subjectAltNames[k].value, group[j].base.value);
}
}
}
else // Try to find out "emailAddress" inside "subject"
{
for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
if ((cert.subject.typesAndValues[k].type === "1.2.840.113549.1.9.1") || // PKCS#9 e-mail address
(cert.subject.typesAndValues[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
{
valueExists = true;
groupPermitted = groupPermitted || compareRFC822Name(cert.subject.typesAndValues[k].value.valueBlock.value, group[j].base.value);
}
}
}
break;
//#endregion
//#region dNSName
case 1:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 2) // dNSName
{
valueExists = true;
groupPermitted = groupPermitted || compareDNSName(subjectAltNames[k].value, group[j].base.value);
}
}
}
break;
//#endregion
//#region directoryName
case 2:
valueExists = true;
groupPermitted = compareDirectoryName(cert.subject, group[j].base.value);
break;
//#endregion
//#region uniformResourceIdentifier
case 3:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 6) // uniformResourceIdentifier
{
valueExists = true;
groupPermitted = groupPermitted || compareUniformResourceIdentifier(subjectAltNames[k].value, group[j].base.value);
}
}
}
break;
//#endregion
//#region iPAddress
case 4:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 7) // iPAddress
{
valueExists = true;
groupPermitted = groupPermitted || compareIPAddress(subjectAltNames[k].value, group[j].base.value);
}
}
}
break;
//#endregion
//#region default
default:
//#endregion
}
if (groupPermitted)
break;
}
if ((groupPermitted === false) && (group.length > 0) && valueExists) {
policyResult.result = false;
policyResult.resultCode = 41;
policyResult.resultMessage = "Failed to meet \"permitted sub-trees\" name constraint";
throw policyResult;
}
}
//#endregion
//#endregion
//#region Checking for "excluded sub-trees"
let excluded = false;
for (let j = 0; j < excludedSubtrees.length; j++) {
switch (excludedSubtrees[j].base.type) {
//#region rfc822Name
case 1:
if (subjectAltNames.length >= 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 1) // rfc822Name
excluded = excluded || compareRFC822Name(subjectAltNames[k].value, excludedSubtrees[j].base.value);
}
}
else // Try to find out "emailAddress" inside "subject"
{
for (let k = 0; k < cert.subject.typesAndValues.length; k++) {
if ((cert.subject.typesAndValues[k].type === "1.2.840.113549.1.9.1") || // PKCS#9 e-mail address
(cert.subject.typesAndValues[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
excluded = excluded || compareRFC822Name(cert.subject.typesAndValues[k].value.valueBlock.value, excludedSubtrees[j].base.value);
}
}
break;
//#endregion
//#region dNSName
case 2:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 2) // dNSName
excluded = excluded || compareDNSName(subjectAltNames[k].value, excludedSubtrees[j].base.value);
}
}
break;
//#endregion
//#region directoryName
case 4:
excluded = excluded || compareDirectoryName(cert.subject, excludedSubtrees[j].base.value);
break;
//#endregion
//#region uniformResourceIdentifier
case 6:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 6) // uniformResourceIdentifier
excluded = excluded || compareUniformResourceIdentifier(subjectAltNames[k].value, excludedSubtrees[j].base.value);
}
}
break;
//#endregion
//#region iPAddress
case 7:
if (subjectAltNames.length > 0) {
for (let k = 0; k < subjectAltNames.length; k++) {
if (subjectAltNames[k].type === 7) // iPAddress
excluded = excluded || compareIPAddress(subjectAltNames[k].value, excludedSubtrees[j].base.value);
}
}
break;
//#endregion
//#region default
default: // No action, but probably here we need to create a warning for "malformed constraint"
//#endregion
}
if (excluded)
break;
}
if (excluded === true) {
policyResult.result = false;
policyResult.resultCode = 42;
policyResult.resultMessage = "Failed to meet \"excluded sub-trees\" name constraint";
throw policyResult;
}
//#endregion
//#region Append "cert_..._subtrees" to "..._subtrees"
permittedSubtrees = permittedSubtrees.concat(certPermittedSubtrees);
excludedSubtrees = excludedSubtrees.concat(certExcludedSubtrees);
//#endregion
}
//#endregion
return policyResult;
//#endregion
} catch (error) {
if (error instanceof Error) {
if (error instanceof ChainValidationError) {
return {
result: false,
resultCode: error.code,
resultMessage: error.message,
error: error,
};
}
return {
result: false,
resultCode: ChainValidationCode.unknown,
resultMessage: error.message,
error: error,
};
}
if (error && typeof error === "object" && "resultMessage" in error) {
return error as CertificateChainValidationEngineVerifyResult;
}
return {
result: false,
resultCode: -1,
resultMessage: `${error}`,
};
}
}
}