parse.go

// Copyright (C) 2026 Opsmate, Inc.
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the "Software"),
// to deal in the Software without restriction, including without limitation
// the rights to use, copy, modify, merge, publish, distribute, sublicense,
// and/or sell copies of the Software, and to permit persons to whom the
// Software is furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included
// in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
// OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
// OTHER DEALINGS IN THE SOFTWARE.
//
// Except as contained in this notice, the name(s) of the above copyright
// holders shall not be used in advertising or otherwise to promote the
// sale, use or other dealings in this Software without prior written
// authorization.

// Package crlutil provides functionality for parsing and validating CRLs.
package crlutil

import (
	"bytes"
	"crypto/x509"
	"encoding/asn1"
	"errors"
	"fmt"
	"golang.org/x/crypto/cryptobyte"
	cryptobyte_asn1 "golang.org/x/crypto/cryptobyte/asn1"
	"math/big"
	"slices"
	"time"
)

var oidIssuingDistributionPoint = asn1.ObjectIdentifier{2, 5, 29, 28}

// RevokedCertificate represents a certificate that has been revoked.
type RevokedCertificate struct {
	SerialNumber   *big.Int
	RevocationTime time.Time
	Reason         int
}

func parseIssuingDistributionPoint(extValue []byte) ([]string, error) {
	str := cryptobyte.String(extValue)
	if !str.ReadASN1(&str, cryptobyte_asn1.SEQUENCE) {
		return nil, errors.New("invalid IssuingDistributionPoint SEQUENCE")
	}
	var dpName cryptobyte.String
	var dpNamePresent bool
	if !str.ReadOptionalASN1(&dpName, &dpNamePresent, cryptobyte_asn1.Tag(0).Constructed().ContextSpecific()) {
		return nil, errors.New("invalid IssuingDistributionPoint")
	}
	if !dpNamePresent {
		return nil, nil
	}

	var fullName cryptobyte.String
	var fullNamePresent bool
	if !dpName.ReadOptionalASN1(&fullName, &fullNamePresent, cryptobyte_asn1.Tag(0).Constructed().ContextSpecific()) {
		return nil, errors.New("invalid DistributionPointName")
	}

	uris := []string{}
	if fullNamePresent {
		for !fullName.Empty() {
			var name cryptobyte.String
			var nameType cryptobyte_asn1.Tag
			if !fullName.ReadAnyASN1(&name, &nameType) {
				return nil, errors.New("invalid GeneralNames")
			}
			if nameType != cryptobyte_asn1.Tag(6).ContextSpecific() {
				continue
			}
			uris = append(uris, string(name))
		}
	}
	return uris, nil
}

// RevocationList represents a parsed Certificate Revocation List.
type RevocationList struct {
	PublishedAt  time.Time
	Certificates []RevokedCertificate
	NumBytes     int
}

// ParseRevocationList parses a DER-encoded CRL and validates it.
// If ca is not nil, verifies the CRL signature and issuer match the CA certificate.
// If uri is not empty and the CRL contains an Issuing Distribution Point extension,
// verifies the URI is listed in the extension.
// Returns an error if the fails validation.
func ParseRevocationList(der []byte, ca *x509.Certificate, uri string) (*RevocationList, error) {
	crl, err := x509.ParseRevocationList(der)
	if err != nil {
		return nil, err
	}
	if ca != nil {
		if !bytes.Equal(crl.RawIssuer, ca.RawSubject) {
			return nil, fmt.Errorf("CRL issuer (%x) does not match CA subject (%x)", crl.RawIssuer, ca.RawSubject)
		}
		if err := ca.CheckSignature(crl.SignatureAlgorithm, crl.RawTBSRevocationList, crl.Signature); err != nil {
			return nil, fmt.Errorf("invalid signature: %w", err)
		}
	}
	//if time.Since(crl.ThisUpdate) > 7*24*time.Hour {
	//	return nil, fmt.Errorf("issued more than 7 days ago (%s)", crl.ThisUpdate)
	//}
	if time.Now().After(crl.NextUpdate) {
		return nil, fmt.Errorf("should have been updated by %s", crl.NextUpdate)
	}

	for _, ext := range crl.Extensions {
		switch {
		case ext.Id.Equal(oidIssuingDistributionPoint):
			uris, err := parseIssuingDistributionPoint(ext.Value)
			if err != nil {
				return nil, fmt.Errorf("invalid Issuing Distribution Point extension: %w", err)
			}
			if uris != nil && uri != "" && !slices.Contains(uris, uri) {
				return nil, fmt.Errorf("Issuing Distribution Point does not contain expected URL")
			}
		}
	}

	certs := make([]RevokedCertificate, len(crl.RevokedCertificateEntries))
	for i := range crl.RevokedCertificateEntries {
		certs[i] = makeRevokedCertificate(crl.RevokedCertificateEntries[i])
	}
	return &RevocationList{
		PublishedAt:  crl.ThisUpdate,
		Certificates: certs,
		NumBytes:     len(der),
	}, nil
}

func makeRevokedCertificate(entry x509.RevocationListEntry) RevokedCertificate {
	return RevokedCertificate{
		SerialNumber:   entry.SerialNumber,
		RevocationTime: entry.RevocationTime,
		Reason:         entry.ReasonCode,
	}
}