scripts
This commit is contained in:
niko
@@ -0,0 +1,871 @@
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.Collections.Generic;
|
||||
using System.Text;
|
||||
using Mono.Security.X509;
|
||||
using Mono.Security.X509.Extensions;
|
||||
|
||||
namespace System.Security.Cryptography.X509Certificates
|
||||
{
|
||||
/// <summary>Represents a chain-building engine for <see cref="T:System.Security.Cryptography.X509Certificates.X509Certificate2" /> certificates.</summary>
|
||||
// Token: 0x0200028D RID: 653
|
||||
public class X509Chain
|
||||
{
|
||||
/// <summary>Initializes a new instance of the <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> class.</summary>
|
||||
// Token: 0x06001804 RID: 6148 RVA: 0x00050F74 File Offset: 0x0004F174
|
||||
public X509Chain()
|
||||
: this(false)
|
||||
{
|
||||
}
|
||||
|
||||
/// <summary>Initializes a new instance of the <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> class specifying a value that indicates whether the machine context should be used.</summary>
|
||||
/// <param name="useMachineContext">true to use the machine context; false to use the current user context. </param>
|
||||
// Token: 0x06001805 RID: 6149 RVA: 0x00050F80 File Offset: 0x0004F180
|
||||
public X509Chain(bool useMachineContext)
|
||||
{
|
||||
this.location = ((!useMachineContext) ? StoreLocation.CurrentUser : StoreLocation.LocalMachine);
|
||||
this.elements = new X509ChainElementCollection();
|
||||
this.policy = new X509ChainPolicy();
|
||||
}
|
||||
|
||||
/// <summary>Initializes a new instance of the <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> class using an <see cref="T:System.IntPtr" /> handle to an X.509 chain.</summary>
|
||||
/// <param name="chainContext">An <see cref="T:System.IntPtr" /> handle to an X.509 chain.</param>
|
||||
/// <exception cref="T:System.ArgumentNullException">The <paramref name="chainContext" /> parameter is null.</exception>
|
||||
/// <exception cref="T:System.Security.Cryptography.CryptographicException">The <paramref name="chainContext" /> parameter points to an invalid context.</exception>
|
||||
// Token: 0x06001806 RID: 6150 RVA: 0x00050FB4 File Offset: 0x0004F1B4
|
||||
[global::System.MonoTODO("Mono's X509Chain is fully managed. All handles are invalid.")]
|
||||
public X509Chain(IntPtr chainContext)
|
||||
{
|
||||
throw new NotSupportedException();
|
||||
}
|
||||
|
||||
/// <summary>Gets a handle to an X.509 chain.</summary>
|
||||
/// <returns>An <see cref="T:System.IntPtr" /> handle to an X.509 chain.</returns>
|
||||
// Token: 0x1700078D RID: 1933
|
||||
// (get) Token: 0x06001808 RID: 6152 RVA: 0x00050FD4 File Offset: 0x0004F1D4
|
||||
[global::System.MonoTODO("Mono's X509Chain is fully managed. Always returns IntPtr.Zero.")]
|
||||
public IntPtr ChainContext
|
||||
{
|
||||
get
|
||||
{
|
||||
return IntPtr.Zero;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Gets a collection of <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainElement" /> objects.</summary>
|
||||
/// <returns>An <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainElementCollection" /> object.</returns>
|
||||
// Token: 0x1700078E RID: 1934
|
||||
// (get) Token: 0x06001809 RID: 6153 RVA: 0x00050FDC File Offset: 0x0004F1DC
|
||||
public X509ChainElementCollection ChainElements
|
||||
{
|
||||
get
|
||||
{
|
||||
return this.elements;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Gets or sets the <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainPolicy" /> to use when building an X.509 certificate chain.</summary>
|
||||
/// <returns>The <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainPolicy" /> object associated with this X.509 chain.</returns>
|
||||
/// <exception cref="T:System.ArgumentNullException">The value being set for this property is null.</exception>
|
||||
// Token: 0x1700078F RID: 1935
|
||||
// (get) Token: 0x0600180A RID: 6154 RVA: 0x00050FE4 File Offset: 0x0004F1E4
|
||||
// (set) Token: 0x0600180B RID: 6155 RVA: 0x00050FEC File Offset: 0x0004F1EC
|
||||
public X509ChainPolicy ChainPolicy
|
||||
{
|
||||
get
|
||||
{
|
||||
return this.policy;
|
||||
}
|
||||
set
|
||||
{
|
||||
this.policy = value;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Gets the status of each element in an <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> object.</summary>
|
||||
/// <returns>An array of <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainStatus" /> objects.</returns>
|
||||
/// <PermissionSet>
|
||||
/// <IPermission class="System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Flags="UnmanagedCode, ControlEvidence" />
|
||||
/// </PermissionSet>
|
||||
// Token: 0x17000790 RID: 1936
|
||||
// (get) Token: 0x0600180C RID: 6156 RVA: 0x00050FF8 File Offset: 0x0004F1F8
|
||||
public X509ChainStatus[] ChainStatus
|
||||
{
|
||||
get
|
||||
{
|
||||
if (this.status == null)
|
||||
{
|
||||
return X509Chain.Empty;
|
||||
}
|
||||
return this.status;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Builds an X.509 chain using the policy specified in <see cref="T:System.Security.Cryptography.X509Certificates.X509ChainPolicy" />.</summary>
|
||||
/// <returns>true if the X.509 certificate is valid; otherwise, false.</returns>
|
||||
/// <param name="certificate">An <see cref="T:System.Security.Cryptography.X509Certificates.X509Certificate2" /> object.</param>
|
||||
/// <exception cref="T:System.ArgumentException">The <paramref name="certificate" /> is not a valid certificate or is null. </exception>
|
||||
/// <exception cref="T:System.Security.Cryptography.CryptographicException">The <paramref name="certificate" /> is unreadable. </exception>
|
||||
// Token: 0x0600180D RID: 6157 RVA: 0x00051014 File Offset: 0x0004F214
|
||||
[global::System.MonoTODO("Not totally RFC3280 compliant, but neither is MS implementation...")]
|
||||
public bool Build(X509Certificate2 certificate)
|
||||
{
|
||||
if (certificate == null)
|
||||
{
|
||||
throw new ArgumentException("certificate");
|
||||
}
|
||||
this.Reset();
|
||||
X509ChainStatusFlags x509ChainStatusFlags;
|
||||
try
|
||||
{
|
||||
x509ChainStatusFlags = this.BuildChainFrom(certificate);
|
||||
this.ValidateChain(x509ChainStatusFlags);
|
||||
}
|
||||
catch (CryptographicException ex)
|
||||
{
|
||||
throw new ArgumentException("certificate", ex);
|
||||
}
|
||||
X509ChainStatusFlags x509ChainStatusFlags2 = X509ChainStatusFlags.NoError;
|
||||
ArrayList arrayList = new ArrayList();
|
||||
foreach (X509ChainElement x509ChainElement in this.elements)
|
||||
{
|
||||
foreach (X509ChainStatus x509ChainStatus in x509ChainElement.ChainElementStatus)
|
||||
{
|
||||
if ((x509ChainStatusFlags2 & x509ChainStatus.Status) != x509ChainStatus.Status)
|
||||
{
|
||||
arrayList.Add(x509ChainStatus);
|
||||
x509ChainStatusFlags2 |= x509ChainStatus.Status;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (x509ChainStatusFlags != X509ChainStatusFlags.NoError)
|
||||
{
|
||||
arrayList.Insert(0, new X509ChainStatus(x509ChainStatusFlags));
|
||||
}
|
||||
this.status = (X509ChainStatus[])arrayList.ToArray(typeof(X509ChainStatus));
|
||||
if (this.status.Length == 0 || this.ChainPolicy.VerificationFlags == X509VerificationFlags.AllFlags)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
bool flag = true;
|
||||
foreach (X509ChainStatus x509ChainStatus2 in this.status)
|
||||
{
|
||||
X509ChainStatusFlags x509ChainStatusFlags3 = x509ChainStatus2.Status;
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.NotTimeValid)
|
||||
{
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.NotTimeNested)
|
||||
{
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.UntrustedRoot)
|
||||
{
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.InvalidExtension)
|
||||
{
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.InvalidPolicyConstraints)
|
||||
{
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.InvalidBasicConstraints)
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreInvalidBasicConstraints) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.InvalidNameConstraints || x509ChainStatusFlags3 == X509ChainStatusFlags.HasNotSupportedNameConstraint || x509ChainStatusFlags3 == X509ChainStatusFlags.HasNotPermittedNameConstraint || x509ChainStatusFlags3 == X509ChainStatusFlags.HasExcludedNameConstraint)
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreInvalidName) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.PartialChain)
|
||||
{
|
||||
goto IL_1FC;
|
||||
}
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.CtlNotTimeValid)
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreCtlNotTimeValid) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.CtlNotSignatureValid)
|
||||
{
|
||||
goto IL_316;
|
||||
}
|
||||
if (x509ChainStatusFlags3 == X509ChainStatusFlags.CtlNotValidForUsage)
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreWrongUsage) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
if (x509ChainStatusFlags3 != X509ChainStatusFlags.NoIssuanceChainPolicy)
|
||||
{
|
||||
flag = false;
|
||||
goto IL_316;
|
||||
}
|
||||
}
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreInvalidPolicy) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreWrongUsage) != X509VerificationFlags.NoFlag;
|
||||
goto IL_316;
|
||||
}
|
||||
IL_1FC:
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.AllowUnknownCertificateAuthority) != X509VerificationFlags.NoFlag;
|
||||
}
|
||||
else
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreNotTimeNested) != X509VerificationFlags.NoFlag;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
flag &= (this.ChainPolicy.VerificationFlags & X509VerificationFlags.IgnoreNotTimeValid) != X509VerificationFlags.NoFlag;
|
||||
}
|
||||
IL_316:
|
||||
if (!flag)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/// <summary>Clears the current <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> object.</summary>
|
||||
// Token: 0x0600180E RID: 6158 RVA: 0x00051370 File Offset: 0x0004F570
|
||||
public void Reset()
|
||||
{
|
||||
if (this.status != null && this.status.Length != 0)
|
||||
{
|
||||
this.status = null;
|
||||
}
|
||||
if (this.elements.Count > 0)
|
||||
{
|
||||
this.elements.Clear();
|
||||
}
|
||||
if (this.roots != null)
|
||||
{
|
||||
this.roots.Close();
|
||||
this.roots = null;
|
||||
}
|
||||
if (this.cas != null)
|
||||
{
|
||||
this.cas.Close();
|
||||
this.cas = null;
|
||||
}
|
||||
this.collection = null;
|
||||
this.bce_restriction = null;
|
||||
this.working_public_key = null;
|
||||
}
|
||||
|
||||
/// <summary>Creates an <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> object after querying for the mapping defined in the CryptoConfig file, and maps the chain to that mapping.</summary>
|
||||
/// <returns>An <see cref="T:System.Security.Cryptography.X509Certificates.X509Chain" /> object.</returns>
|
||||
/// <PermissionSet>
|
||||
/// <IPermission class="System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Flags="UnmanagedCode" />
|
||||
/// </PermissionSet>
|
||||
// Token: 0x0600180F RID: 6159 RVA: 0x00051408 File Offset: 0x0004F608
|
||||
public static X509Chain Create()
|
||||
{
|
||||
return (X509Chain)CryptoConfig.CreateFromName("X509Chain");
|
||||
}
|
||||
|
||||
// Token: 0x17000791 RID: 1937
|
||||
// (get) Token: 0x06001810 RID: 6160 RVA: 0x0005141C File Offset: 0x0004F61C
|
||||
private X509Store Roots
|
||||
{
|
||||
get
|
||||
{
|
||||
if (this.roots == null)
|
||||
{
|
||||
this.roots = new X509Store(StoreName.Root, this.location);
|
||||
this.roots.Open(OpenFlags.ReadOnly);
|
||||
}
|
||||
return this.roots;
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x17000792 RID: 1938
|
||||
// (get) Token: 0x06001811 RID: 6161 RVA: 0x00051450 File Offset: 0x0004F650
|
||||
private X509Store CertificateAuthorities
|
||||
{
|
||||
get
|
||||
{
|
||||
if (this.cas == null)
|
||||
{
|
||||
this.cas = new X509Store(StoreName.CertificateAuthority, this.location);
|
||||
this.cas.Open(OpenFlags.ReadOnly);
|
||||
}
|
||||
return this.cas;
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x17000793 RID: 1939
|
||||
// (get) Token: 0x06001812 RID: 6162 RVA: 0x00051484 File Offset: 0x0004F684
|
||||
private X509Certificate2Collection CertificateCollection
|
||||
{
|
||||
get
|
||||
{
|
||||
if (this.collection == null)
|
||||
{
|
||||
this.collection = new X509Certificate2Collection(this.ChainPolicy.ExtraStore);
|
||||
if (this.Roots.Certificates.Count > 0)
|
||||
{
|
||||
this.collection.AddRange(this.Roots.Certificates);
|
||||
}
|
||||
if (this.CertificateAuthorities.Certificates.Count > 0)
|
||||
{
|
||||
this.collection.AddRange(this.CertificateAuthorities.Certificates);
|
||||
}
|
||||
}
|
||||
return this.collection;
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x06001813 RID: 6163 RVA: 0x00051510 File Offset: 0x0004F710
|
||||
private X509ChainStatusFlags BuildChainFrom(X509Certificate2 certificate)
|
||||
{
|
||||
this.elements.Add(certificate);
|
||||
while (!this.IsChainComplete(certificate))
|
||||
{
|
||||
certificate = this.FindParent(certificate);
|
||||
if (certificate == null)
|
||||
{
|
||||
return X509ChainStatusFlags.PartialChain;
|
||||
}
|
||||
if (this.elements.Contains(certificate))
|
||||
{
|
||||
return X509ChainStatusFlags.Cyclic;
|
||||
}
|
||||
this.elements.Add(certificate);
|
||||
}
|
||||
if (!this.Roots.Certificates.Contains(certificate))
|
||||
{
|
||||
this.elements[this.elements.Count - 1].StatusFlags |= X509ChainStatusFlags.UntrustedRoot;
|
||||
}
|
||||
return X509ChainStatusFlags.NoError;
|
||||
}
|
||||
|
||||
// Token: 0x06001814 RID: 6164 RVA: 0x000515B0 File Offset: 0x0004F7B0
|
||||
private X509Certificate2 SelectBestFromCollection(X509Certificate2 child, X509Certificate2Collection c)
|
||||
{
|
||||
int count = c.Count;
|
||||
if (count == 0)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
if (count == 1)
|
||||
{
|
||||
return c[0];
|
||||
}
|
||||
X509Certificate2Collection x509Certificate2Collection = c.Find(X509FindType.FindByTimeValid, this.ChainPolicy.VerificationTime, false);
|
||||
int count2 = x509Certificate2Collection.Count;
|
||||
if (count2 != 0)
|
||||
{
|
||||
if (count2 == 1)
|
||||
{
|
||||
return x509Certificate2Collection[0];
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
x509Certificate2Collection = c;
|
||||
}
|
||||
string authorityKeyIdentifier = this.GetAuthorityKeyIdentifier(child);
|
||||
if (string.IsNullOrEmpty(authorityKeyIdentifier))
|
||||
{
|
||||
return x509Certificate2Collection[0];
|
||||
}
|
||||
foreach (X509Certificate2 x509Certificate in x509Certificate2Collection)
|
||||
{
|
||||
string subjectKeyIdentifier = this.GetSubjectKeyIdentifier(x509Certificate);
|
||||
if (authorityKeyIdentifier == subjectKeyIdentifier)
|
||||
{
|
||||
return x509Certificate;
|
||||
}
|
||||
}
|
||||
return x509Certificate2Collection[0];
|
||||
}
|
||||
|
||||
// Token: 0x06001815 RID: 6165 RVA: 0x00051684 File Offset: 0x0004F884
|
||||
private X509Certificate2 FindParent(X509Certificate2 certificate)
|
||||
{
|
||||
X509Certificate2Collection x509Certificate2Collection = this.CertificateCollection.Find(X509FindType.FindBySubjectDistinguishedName, certificate.Issuer, false);
|
||||
string authorityKeyIdentifier = this.GetAuthorityKeyIdentifier(certificate);
|
||||
if (authorityKeyIdentifier != null && authorityKeyIdentifier.Length > 0)
|
||||
{
|
||||
x509Certificate2Collection.AddRange(this.CertificateCollection.Find(X509FindType.FindBySubjectKeyIdentifier, authorityKeyIdentifier, false));
|
||||
}
|
||||
X509Certificate2 x509Certificate = this.SelectBestFromCollection(certificate, x509Certificate2Collection);
|
||||
return (!certificate.Equals(x509Certificate)) ? x509Certificate : null;
|
||||
}
|
||||
|
||||
// Token: 0x06001816 RID: 6166 RVA: 0x000516F0 File Offset: 0x0004F8F0
|
||||
private bool IsChainComplete(X509Certificate2 certificate)
|
||||
{
|
||||
if (!this.IsSelfIssued(certificate))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (certificate.Version < 3)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
string subjectKeyIdentifier = this.GetSubjectKeyIdentifier(certificate);
|
||||
if (string.IsNullOrEmpty(subjectKeyIdentifier))
|
||||
{
|
||||
return true;
|
||||
}
|
||||
string authorityKeyIdentifier = this.GetAuthorityKeyIdentifier(certificate);
|
||||
return string.IsNullOrEmpty(authorityKeyIdentifier) || authorityKeyIdentifier == subjectKeyIdentifier;
|
||||
}
|
||||
|
||||
// Token: 0x06001817 RID: 6167 RVA: 0x0005174C File Offset: 0x0004F94C
|
||||
private bool IsSelfIssued(X509Certificate2 certificate)
|
||||
{
|
||||
return certificate.Issuer == certificate.Subject;
|
||||
}
|
||||
|
||||
// Token: 0x06001818 RID: 6168 RVA: 0x00051760 File Offset: 0x0004F960
|
||||
private void ValidateChain(X509ChainStatusFlags flag)
|
||||
{
|
||||
int num = this.elements.Count - 1;
|
||||
X509Certificate2 certificate = this.elements[num].Certificate;
|
||||
if ((flag & X509ChainStatusFlags.PartialChain) == X509ChainStatusFlags.NoError)
|
||||
{
|
||||
this.Process(num);
|
||||
if (num == 0)
|
||||
{
|
||||
this.elements[0].UncompressFlags();
|
||||
return;
|
||||
}
|
||||
num--;
|
||||
}
|
||||
this.working_public_key = certificate.PublicKey.Key;
|
||||
this.working_issuer_name = certificate.IssuerName;
|
||||
this.max_path_length = num;
|
||||
for (int i = num; i > 0; i--)
|
||||
{
|
||||
this.Process(i);
|
||||
this.PrepareForNextCertificate(i);
|
||||
}
|
||||
this.Process(0);
|
||||
this.CheckRevocationOnChain(flag);
|
||||
this.WrapUp();
|
||||
}
|
||||
|
||||
// Token: 0x06001819 RID: 6169 RVA: 0x00051814 File Offset: 0x0004FA14
|
||||
private void Process(int n)
|
||||
{
|
||||
X509ChainElement x509ChainElement = this.elements[n];
|
||||
X509Certificate2 certificate = x509ChainElement.Certificate;
|
||||
if (n != this.elements.Count - 1 && certificate.MonoCertificate.KeyAlgorithm == "1.2.840.10040.4.1" && certificate.MonoCertificate.KeyAlgorithmParameters == null)
|
||||
{
|
||||
X509Certificate2 certificate2 = this.elements[n + 1].Certificate;
|
||||
certificate.MonoCertificate.KeyAlgorithmParameters = certificate2.MonoCertificate.KeyAlgorithmParameters;
|
||||
}
|
||||
bool flag = this.working_public_key == null;
|
||||
if (!this.IsSignedWith(certificate, (!flag) ? this.working_public_key : certificate.PublicKey.Key) && (flag || n != this.elements.Count - 1 || this.IsSelfIssued(certificate)))
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.NotSignatureValid;
|
||||
}
|
||||
if (this.ChainPolicy.VerificationTime < certificate.NotBefore || this.ChainPolicy.VerificationTime > certificate.NotAfter)
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.NotTimeValid;
|
||||
}
|
||||
if (flag)
|
||||
{
|
||||
return;
|
||||
}
|
||||
if (!X500DistinguishedName.AreEqual(certificate.IssuerName, this.working_issuer_name))
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.InvalidNameConstraints;
|
||||
}
|
||||
if (this.IsSelfIssued(certificate) || n != 0)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x0600181A RID: 6170 RVA: 0x00051988 File Offset: 0x0004FB88
|
||||
private void PrepareForNextCertificate(int n)
|
||||
{
|
||||
X509ChainElement x509ChainElement = this.elements[n];
|
||||
X509Certificate2 certificate = x509ChainElement.Certificate;
|
||||
this.working_issuer_name = certificate.SubjectName;
|
||||
this.working_public_key = certificate.PublicKey.Key;
|
||||
X509BasicConstraintsExtension x509BasicConstraintsExtension = (X509BasicConstraintsExtension)certificate.Extensions["2.5.29.19"];
|
||||
if (x509BasicConstraintsExtension != null)
|
||||
{
|
||||
if (!x509BasicConstraintsExtension.CertificateAuthority)
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.InvalidBasicConstraints;
|
||||
}
|
||||
}
|
||||
else if (certificate.Version >= 3)
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.InvalidBasicConstraints;
|
||||
}
|
||||
if (!this.IsSelfIssued(certificate))
|
||||
{
|
||||
if (this.max_path_length > 0)
|
||||
{
|
||||
this.max_path_length--;
|
||||
}
|
||||
else if (this.bce_restriction != null)
|
||||
{
|
||||
this.bce_restriction.StatusFlags |= X509ChainStatusFlags.InvalidBasicConstraints;
|
||||
}
|
||||
}
|
||||
if (x509BasicConstraintsExtension != null && x509BasicConstraintsExtension.HasPathLengthConstraint && x509BasicConstraintsExtension.PathLengthConstraint < this.max_path_length)
|
||||
{
|
||||
this.max_path_length = x509BasicConstraintsExtension.PathLengthConstraint;
|
||||
this.bce_restriction = x509ChainElement;
|
||||
}
|
||||
X509KeyUsageExtension x509KeyUsageExtension = (X509KeyUsageExtension)certificate.Extensions["2.5.29.15"];
|
||||
if (x509KeyUsageExtension != null)
|
||||
{
|
||||
X509KeyUsageFlags x509KeyUsageFlags = X509KeyUsageFlags.KeyCertSign;
|
||||
if ((x509KeyUsageExtension.KeyUsages & x509KeyUsageFlags) != x509KeyUsageFlags)
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.NotValidForUsage;
|
||||
}
|
||||
}
|
||||
this.ProcessCertificateExtensions(x509ChainElement);
|
||||
}
|
||||
|
||||
// Token: 0x0600181B RID: 6171 RVA: 0x00051AEC File Offset: 0x0004FCEC
|
||||
private void WrapUp()
|
||||
{
|
||||
X509ChainElement x509ChainElement = this.elements[0];
|
||||
X509Certificate2 certificate = x509ChainElement.Certificate;
|
||||
if (this.IsSelfIssued(certificate))
|
||||
{
|
||||
}
|
||||
this.ProcessCertificateExtensions(x509ChainElement);
|
||||
for (int i = this.elements.Count - 1; i >= 0; i--)
|
||||
{
|
||||
this.elements[i].UncompressFlags();
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x0600181C RID: 6172 RVA: 0x00051B50 File Offset: 0x0004FD50
|
||||
private void ProcessCertificateExtensions(X509ChainElement element)
|
||||
{
|
||||
foreach (X509Extension x509Extension in element.Certificate.Extensions)
|
||||
{
|
||||
if (x509Extension.Critical)
|
||||
{
|
||||
string value = x509Extension.Oid.Value;
|
||||
if (value != null)
|
||||
{
|
||||
if (X509Chain.<>f__switch$mapB == null)
|
||||
{
|
||||
X509Chain.<>f__switch$mapB = new Dictionary<string, int>(2)
|
||||
{
|
||||
{ "2.5.29.15", 0 },
|
||||
{ "2.5.29.19", 0 }
|
||||
};
|
||||
}
|
||||
int num;
|
||||
if (X509Chain.<>f__switch$mapB.TryGetValue(value, out num))
|
||||
{
|
||||
if (num == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
element.StatusFlags |= X509ChainStatusFlags.InvalidExtension;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x0600181D RID: 6173 RVA: 0x00051C0C File Offset: 0x0004FE0C
|
||||
private bool IsSignedWith(X509Certificate2 signed, AsymmetricAlgorithm pubkey)
|
||||
{
|
||||
if (pubkey == null)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
X509Certificate monoCertificate = signed.MonoCertificate;
|
||||
return monoCertificate.VerifySignature(pubkey);
|
||||
}
|
||||
|
||||
// Token: 0x0600181E RID: 6174 RVA: 0x00051C30 File Offset: 0x0004FE30
|
||||
private string GetSubjectKeyIdentifier(X509Certificate2 certificate)
|
||||
{
|
||||
X509SubjectKeyIdentifierExtension x509SubjectKeyIdentifierExtension = (X509SubjectKeyIdentifierExtension)certificate.Extensions["2.5.29.14"];
|
||||
return (x509SubjectKeyIdentifierExtension != null) ? x509SubjectKeyIdentifierExtension.SubjectKeyIdentifier : string.Empty;
|
||||
}
|
||||
|
||||
// Token: 0x0600181F RID: 6175 RVA: 0x00051C6C File Offset: 0x0004FE6C
|
||||
private string GetAuthorityKeyIdentifier(X509Certificate2 certificate)
|
||||
{
|
||||
return this.GetAuthorityKeyIdentifier(certificate.MonoCertificate.Extensions["2.5.29.35"]);
|
||||
}
|
||||
|
||||
// Token: 0x06001820 RID: 6176 RVA: 0x00051C94 File Offset: 0x0004FE94
|
||||
private string GetAuthorityKeyIdentifier(X509Crl crl)
|
||||
{
|
||||
return this.GetAuthorityKeyIdentifier(crl.Extensions["2.5.29.35"]);
|
||||
}
|
||||
|
||||
// Token: 0x06001821 RID: 6177 RVA: 0x00051CAC File Offset: 0x0004FEAC
|
||||
private string GetAuthorityKeyIdentifier(X509Extension ext)
|
||||
{
|
||||
if (ext == null)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
AuthorityKeyIdentifierExtension authorityKeyIdentifierExtension = new AuthorityKeyIdentifierExtension(ext);
|
||||
byte[] identifier = authorityKeyIdentifierExtension.Identifier;
|
||||
if (identifier == null)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
foreach (byte b in identifier)
|
||||
{
|
||||
stringBuilder.Append(b.ToString("X02"));
|
||||
}
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
// Token: 0x06001822 RID: 6178 RVA: 0x00051D20 File Offset: 0x0004FF20
|
||||
private void CheckRevocationOnChain(X509ChainStatusFlags flag)
|
||||
{
|
||||
bool flag2 = (flag & X509ChainStatusFlags.PartialChain) != X509ChainStatusFlags.NoError;
|
||||
bool flag3;
|
||||
switch (this.ChainPolicy.RevocationMode)
|
||||
{
|
||||
case X509RevocationMode.NoCheck:
|
||||
return;
|
||||
case X509RevocationMode.Online:
|
||||
flag3 = true;
|
||||
break;
|
||||
case X509RevocationMode.Offline:
|
||||
flag3 = false;
|
||||
break;
|
||||
default:
|
||||
throw new InvalidOperationException(global::Locale.GetText("Invalid revocation mode."));
|
||||
}
|
||||
bool flag4 = flag2;
|
||||
for (int i = this.elements.Count - 1; i >= 0; i--)
|
||||
{
|
||||
bool flag5 = true;
|
||||
switch (this.ChainPolicy.RevocationFlag)
|
||||
{
|
||||
case X509RevocationFlag.EndCertificateOnly:
|
||||
flag5 = i == 0;
|
||||
break;
|
||||
case X509RevocationFlag.EntireChain:
|
||||
flag5 = true;
|
||||
break;
|
||||
case X509RevocationFlag.ExcludeRoot:
|
||||
flag5 = i != this.elements.Count - 1;
|
||||
break;
|
||||
}
|
||||
X509ChainElement x509ChainElement = this.elements[i];
|
||||
if (!flag4)
|
||||
{
|
||||
flag4 |= (x509ChainElement.StatusFlags & X509ChainStatusFlags.NotSignatureValid) != X509ChainStatusFlags.NoError;
|
||||
}
|
||||
if (flag4)
|
||||
{
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
x509ChainElement.StatusFlags |= X509ChainStatusFlags.OfflineRevocation;
|
||||
}
|
||||
else if (flag5 && !flag2 && !this.IsSelfIssued(x509ChainElement.Certificate))
|
||||
{
|
||||
x509ChainElement.StatusFlags |= this.CheckRevocation(x509ChainElement.Certificate, i + 1, flag3);
|
||||
flag4 |= (x509ChainElement.StatusFlags & X509ChainStatusFlags.Revoked) != X509ChainStatusFlags.NoError;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Token: 0x06001823 RID: 6179 RVA: 0x00051E98 File Offset: 0x00050098
|
||||
private X509ChainStatusFlags CheckRevocation(X509Certificate2 certificate, int ca, bool online)
|
||||
{
|
||||
X509ChainStatusFlags x509ChainStatusFlags = X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
X509ChainElement x509ChainElement = this.elements[ca];
|
||||
X509Certificate2 x509Certificate = x509ChainElement.Certificate;
|
||||
while (this.IsSelfIssued(x509Certificate) && ca < this.elements.Count - 1)
|
||||
{
|
||||
x509ChainStatusFlags = this.CheckRevocation(certificate, x509Certificate, online);
|
||||
if (x509ChainStatusFlags != X509ChainStatusFlags.RevocationStatusUnknown)
|
||||
{
|
||||
break;
|
||||
}
|
||||
ca++;
|
||||
x509ChainElement = this.elements[ca];
|
||||
x509Certificate = x509ChainElement.Certificate;
|
||||
}
|
||||
if (x509ChainStatusFlags == X509ChainStatusFlags.RevocationStatusUnknown)
|
||||
{
|
||||
x509ChainStatusFlags = this.CheckRevocation(certificate, x509Certificate, online);
|
||||
}
|
||||
return x509ChainStatusFlags;
|
||||
}
|
||||
|
||||
// Token: 0x06001824 RID: 6180 RVA: 0x00051F24 File Offset: 0x00050124
|
||||
private X509ChainStatusFlags CheckRevocation(X509Certificate2 certificate, X509Certificate2 ca_cert, bool online)
|
||||
{
|
||||
X509KeyUsageExtension x509KeyUsageExtension = (X509KeyUsageExtension)ca_cert.Extensions["2.5.29.15"];
|
||||
if (x509KeyUsageExtension != null)
|
||||
{
|
||||
X509KeyUsageFlags x509KeyUsageFlags = X509KeyUsageFlags.CrlSign;
|
||||
if ((x509KeyUsageExtension.KeyUsages & x509KeyUsageFlags) != x509KeyUsageFlags)
|
||||
{
|
||||
return X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
}
|
||||
}
|
||||
X509Crl x509Crl = this.FindCrl(ca_cert);
|
||||
if (x509Crl != null || online)
|
||||
{
|
||||
}
|
||||
if (x509Crl == null)
|
||||
{
|
||||
return X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
}
|
||||
if (!x509Crl.VerifySignature(ca_cert.PublicKey.Key))
|
||||
{
|
||||
return X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
}
|
||||
X509Crl.X509CrlEntry crlEntry = x509Crl.GetCrlEntry(certificate.MonoCertificate);
|
||||
if (crlEntry != null)
|
||||
{
|
||||
if (!this.ProcessCrlEntryExtensions(crlEntry))
|
||||
{
|
||||
return X509ChainStatusFlags.Revoked;
|
||||
}
|
||||
if (crlEntry.RevocationDate <= this.ChainPolicy.VerificationTime)
|
||||
{
|
||||
return X509ChainStatusFlags.Revoked;
|
||||
}
|
||||
}
|
||||
if (x509Crl.NextUpdate < this.ChainPolicy.VerificationTime)
|
||||
{
|
||||
return X509ChainStatusFlags.RevocationStatusUnknown | X509ChainStatusFlags.OfflineRevocation;
|
||||
}
|
||||
if (!this.ProcessCrlExtensions(x509Crl))
|
||||
{
|
||||
return X509ChainStatusFlags.RevocationStatusUnknown;
|
||||
}
|
||||
return X509ChainStatusFlags.NoError;
|
||||
}
|
||||
|
||||
// Token: 0x06001825 RID: 6181 RVA: 0x0005200C File Offset: 0x0005020C
|
||||
private X509Crl FindCrl(X509Certificate2 caCertificate)
|
||||
{
|
||||
string text = caCertificate.SubjectName.Decode(X500DistinguishedNameFlags.None);
|
||||
string subjectKeyIdentifier = this.GetSubjectKeyIdentifier(caCertificate);
|
||||
foreach (object obj in this.CertificateAuthorities.Store.Crls)
|
||||
{
|
||||
X509Crl x509Crl = (X509Crl)obj;
|
||||
if (x509Crl.IssuerName == text && (subjectKeyIdentifier.Length == 0 || subjectKeyIdentifier == this.GetAuthorityKeyIdentifier(x509Crl)))
|
||||
{
|
||||
return x509Crl;
|
||||
}
|
||||
}
|
||||
foreach (object obj2 in this.Roots.Store.Crls)
|
||||
{
|
||||
X509Crl x509Crl2 = (X509Crl)obj2;
|
||||
if (x509Crl2.IssuerName == text && (subjectKeyIdentifier.Length == 0 || subjectKeyIdentifier == this.GetAuthorityKeyIdentifier(x509Crl2)))
|
||||
{
|
||||
return x509Crl2;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// Token: 0x06001826 RID: 6182 RVA: 0x00052174 File Offset: 0x00050374
|
||||
private bool ProcessCrlExtensions(X509Crl crl)
|
||||
{
|
||||
foreach (object obj in crl.Extensions)
|
||||
{
|
||||
X509Extension x509Extension = (X509Extension)obj;
|
||||
if (x509Extension.Critical)
|
||||
{
|
||||
string oid = x509Extension.Oid;
|
||||
if (oid != null)
|
||||
{
|
||||
if (X509Chain.<>f__switch$mapC == null)
|
||||
{
|
||||
X509Chain.<>f__switch$mapC = new Dictionary<string, int>(2)
|
||||
{
|
||||
{ "2.5.29.20", 0 },
|
||||
{ "2.5.29.35", 0 }
|
||||
};
|
||||
}
|
||||
int num;
|
||||
if (X509Chain.<>f__switch$mapC.TryGetValue(oid, out num))
|
||||
{
|
||||
if (num == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// Token: 0x06001827 RID: 6183 RVA: 0x00052258 File Offset: 0x00050458
|
||||
private bool ProcessCrlEntryExtensions(X509Crl.X509CrlEntry entry)
|
||||
{
|
||||
foreach (object obj in entry.Extensions)
|
||||
{
|
||||
X509Extension x509Extension = (X509Extension)obj;
|
||||
if (x509Extension.Critical)
|
||||
{
|
||||
string oid = x509Extension.Oid;
|
||||
if (oid != null)
|
||||
{
|
||||
if (X509Chain.<>f__switch$mapD == null)
|
||||
{
|
||||
X509Chain.<>f__switch$mapD = new Dictionary<string, int>(1) { { "2.5.29.21", 0 } };
|
||||
}
|
||||
int num;
|
||||
if (X509Chain.<>f__switch$mapD.TryGetValue(oid, out num))
|
||||
{
|
||||
if (num == 0)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// Token: 0x04001307 RID: 4871
|
||||
private StoreLocation location;
|
||||
|
||||
// Token: 0x04001308 RID: 4872
|
||||
private X509ChainElementCollection elements;
|
||||
|
||||
// Token: 0x04001309 RID: 4873
|
||||
private X509ChainPolicy policy;
|
||||
|
||||
// Token: 0x0400130A RID: 4874
|
||||
private X509ChainStatus[] status;
|
||||
|
||||
// Token: 0x0400130B RID: 4875
|
||||
private static X509ChainStatus[] Empty = new X509ChainStatus[0];
|
||||
|
||||
// Token: 0x0400130C RID: 4876
|
||||
private int max_path_length;
|
||||
|
||||
// Token: 0x0400130D RID: 4877
|
||||
private X500DistinguishedName working_issuer_name;
|
||||
|
||||
// Token: 0x0400130E RID: 4878
|
||||
private AsymmetricAlgorithm working_public_key;
|
||||
|
||||
// Token: 0x0400130F RID: 4879
|
||||
private X509ChainElement bce_restriction;
|
||||
|
||||
// Token: 0x04001310 RID: 4880
|
||||
private X509Store roots;
|
||||
|
||||
// Token: 0x04001311 RID: 4881
|
||||
private X509Store cas;
|
||||
|
||||
// Token: 0x04001312 RID: 4882
|
||||
private X509Certificate2Collection collection;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user