Class: MooTool::Models::Certificate

Inherits:
Object
  • Object
show all
Includes:
Helpers::IMG4
Defined in:
lib/mootool/models/certificate.rb

Constant Summary collapse

APPLE_OID_MAP = 
load_oid_map

Constants included from Helpers::IMG4

Helpers::IMG4::DECODE_TAGS, Helpers::IMG4::FIRMWARE_TAGS, Helpers::IMG4::HASH_LENGTHS, Helpers::IMG4::KEY_INSTANCE_TAGS, Helpers::IMG4::KVP_TAGS, Helpers::IMG4::OCTET_TAGS, Helpers::IMG4::SEQUENCE_TAGS, Helpers::IMG4::SIGNATURE_TAGS

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Helpers::IMG4

#construct, #construct_object, #decode_construct, parse_4cc

Constructor Details

#initialize(certificate) ⇒ Certificate

Returns a new instance of Certificate.



18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/mootool/models/certificate.rb', line 18

def initialize(certificate)
  @certificate = certificate
  @hash = Models::Digest.digest(@certificate.to_der)
  @fingerprint = ::Digest::SHA1.hexdigest(@certificate.to_der).scan(/../).join(':').upcase

  @extensions = certificate.extensions.map do |extension|
    parse_extension(extension)
  end.reduce(&:merge)

  CertificateIndex.add_certificate(self)
end

Instance Attribute Details

#fingerprint ⇒ Object (readonly)

Returns the value of attribute fingerprint.



10
11
12
 
# File 'lib/mootool/models/certificate.rb', line 10

def fingerprint
  @fingerprint
end

#hash ⇒ Object (readonly)

Returns the value of attribute hash.



10
11
12
 
# File 'lib/mootool/models/certificate.rb', line 10

def hash
  @hash
end

Class Method Details

.formatted_public_key(key, find_matches: false) ⇒ Object 



194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
 
# File 'lib/mootool/models/certificate.rb', line 194

def self.formatted_public_key(key, find_matches: false)
  result_key = case key
               when OpenSSL::PKey::EC, OpenSSL::PKey::EC::Point
                 ECCPublicKey.new key
               when OpenSSL::PKey::RSA
                 Models::Digest.create key.to_der, 'RSAPublicKey'
               else
                 { class: key.class, key: key }
               end

  if find_matches
    matches = CertificateIndex.current.matching_key(key)
    if matches.any?
      { key: result_key, matches: matches }
    else
      result_key
    end
  else
    result_key
  end
end

.load(path) ⇒ Object 



55
56
57
58
59
60
61
62
63
64
 
# File 'lib/mootool/models/certificate.rb', line 55

def self.load(path)
  file_data = File.read(path)
  if file_data.include?('-----BEGIN CERTIFICATE-----')
    file_data.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m).map do |text|
      ::MooTool::Models::Certificate.new OpenSSL::X509::Certificate.new(text)
    end
  else
    ::MooTool::Models::Certificate.new(OpenSSL::X509::Certificate.new(file_data))
  end
end

.load_oid_map ⇒ Object 



12
13
14
 
# File 'lib/mootool/models/certificate.rb', line 12

def self.load_oid_map
  YAML.load_file(File.join(DATA_PATH, 'pki.yaml')).deep_symbolize_keys
end

.oid_properties(oid) ⇒ Object 



66
67
68
69
70
71
72
73
 
# File 'lib/mootool/models/certificate.rb', line 66

def self.oid_properties(oid)
  match = APPLE_OID_MAP.dig :oids, oid.to_sym

  match ||= { name: oid.to_sym }
  match[:name] = (match[:name] || oid).to_sym
  match[:type] = match[:type].to_sym if match[:type]
  match
end

.oid_to_name(oid) ⇒ Object 



75
76
77
78
79
 
# File 'lib/mootool/models/certificate.rb', line 75

def self.oid_to_name(oid)
  oid = oid.to_sym
  result = APPLE_OID_MAP.dig(:oids, oid, :name) || oid
  result.to_sym
end

.parse_sik(key) ⇒ Object 



155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
 
# File 'lib/mootool/models/certificate.rb', line 155

def self.parse_sik(key)
  key = case key
        when MooTool::Models::Digest
          key.value
        when UUIDTools::UUID
          key.raw
        when nil
          return nil
        else
          key
        end

  return key unless key.start_with? 'sik-'

  parts = key.split('-')
  if parts.size == 3
    { type: :sik, serial: parts[1], hash: Models::Digest.from_hex(parts[2]) }
  elsif parts.size == 4
    { type: :sik, chip: parts[1], ecid: parts[2], hash: Models::Digest.from_hex(parts[3]) }
  end
end

Instance Method Details

#==(other) ⇒ Object 



42
43
44
45
46
47
48
49
 
# File 'lib/mootool/models/certificate.rb', line 42

def ==(other)
  case other
  when Certificate
    @certificate == other.openssl_certificate
  when OpenSSL::X509::Certificate
    @certificate == other
  end
end

#formatted_public_key(find_matches: false) ⇒ Object 



34
35
36
 
# File 'lib/mootool/models/certificate.rb', line 34

def formatted_public_key(find_matches: false)
  Certificate.formatted_public_key(public_key, find_matches: find_matches)
end

#identifiers ⇒ Object 



30
31
32
 
# File 'lib/mootool/models/certificate.rb', line 30

def identifiers
  [@fingerprint, @extensions[:subjectKeyIdentifier]]
end

#inspect ⇒ Object 



245
246
247
 
# File 'lib/mootool/models/certificate.rb', line 245

def inspect
  to_h
end

#issuer ⇒ Object 



226
227
228
 
# File 'lib/mootool/models/certificate.rb', line 226

def issuer
  @certificate.issuer
end

#key_id ⇒ Object 



216
217
218
219
220
221
222
223
224
 
# File 'lib/mootool/models/certificate.rb', line 216

def key_id
  common_name = @certificate.subject.to_a.to_h do |entry|
    [entry[0], entry[1]]
  end['CN']

  return unless /^[0-9a-z]*$/.match(common_name)

  Models::Digest.create [common_name].pack('H*')
end

#map_to_arrays(input) ⇒ Object 



181
182
183
184
185
186
187
188
 
# File 'lib/mootool/models/certificate.rb', line 181

def map_to_arrays(input)
  case input
  when OpenSSL::ASN1::Set, OpenSSL::ASN1::Sequence
    input.value.map { |e| map_to_arrays(e) }
  else
    input
  end
end

#openssl_certificate ⇒ Object 



38
39
40
 
# File 'lib/mootool/models/certificate.rb', line 38

def openssl_certificate
  @certificate
end

#parse_ds_name(name) ⇒ Object 



190
191
192
 
# File 'lib/mootool/models/certificate.rb', line 190

def parse_ds_name(name)
  map_to_arrays(name).flatten.each_slice(2).to_h.transform_keys(&:to_sym)
end

#parse_extension(extension) ⇒ Object 



81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
# File 'lib/mootool/models/certificate.rb', line 81

def parse_extension(extension)
  oid_properties = Certificate.oid_properties(extension.oid)
  value = case oid_properties[:name]
          when :basicConstraints
            extension.value
          when :keyUsage
            construct(OpenSSL::ASN1.decode(extension.value_der))
          when :authorityKeyIdentifier
            aki = extension.value.include?("\n") ? extension.value.split("\n") : extension.value
            matches = CertificateIndex.current.with_identifier(aki)

            if matches.any?
              { id: aki, matches: matches }
            else
              aki
            end
          when :subjectKeyIdentifier
            extension.value.include?("\n") ? extension.value.split("\n") : extension.value
          when :'1.2.840.113635.100.6.17'
            data = construct(OpenSSL::ASN1.decode(extension.value_der))
            Certificate.parse_sik(data)
          when :'1.2.840.113635.100.6.16'
            construct(OpenSSL::ASN1.decode(extension.value_der)).split(';').map do |entry|
              command, value = entry.split(':')
              direction, config = command.split('/')
              { direction: direction, config: config, value: Certificate.parse_sik(value) }
            end
          when :appleDeviceAttestationKeyUsageProperties
            result = construct(OpenSSL::ASN1.decode(extension.value_der))

            result.map do |item|
              if item.is_a?(Hash)
                item.to_h do |key, value|
                  tag = APPLE_OID_MAP.dig(:extension_tags, key) || { name: key }
                  tag = tag[:name].respond_to?(:to_sym) ? tag[:name].to_sym : tag[:name]
                  [tag, value.first]
                end
              else
                item
              end
            end
          when :appleDeviceAttestationDeviceOSInformation, :appleFactoryTrustModeSigning,
            :appleDeviceAttestationHardwareProperties

            resequence(construct(OpenSSL::ASN1.decode(extension.value_der))).transform_keys do |key|
              if key.is_a?(Symbol)
                key
              else
                tag = APPLE_OID_MAP.dig(:extension_tags, key) || { name: key }
                tag[:name].respond_to?(:to_sym) ? tag[:name].to_sym : tag[:name]
              end
            end.transform_values(&:first)
          else
            case oid_properties[:type]
            when :img4
              IMG4::File.new(extension.value_der).to_h
            when :scalar
              construct(OpenSSL::ASN1.decode(extension.value_der)).first
            when :hashes
              construct(OpenSSL::ASN1.decode(extension.value_der)).map(&:to_h).reduce(&:merge)
            when :sequence
              resequence(construct(OpenSSL::ASN1.decode(extension.value_der)))
            else
              construct(OpenSSL::ASN1.decode(extension.value_der))
            end
          end

  if extension.critical?
    { oid_properties[:name].to_sym => { critical: extension.critical?, value: value } }
  else
    { oid_properties[:name].to_sym => value }
  end
end

#public_key ⇒ Object 



51
52
53
 
# File 'lib/mootool/models/certificate.rb', line 51

def public_key
  @certificate.public_key
end

#resequence(input) ⇒ Object 



177
178
179
 
# File 'lib/mootool/models/certificate.rb', line 177

def resequence(input)
  input.map(&:to_h).reduce(&:merge)
end

#subject ⇒ Object 



230
231
232
 
# File 'lib/mootool/models/certificate.rb', line 230

def subject
  @certificate.subject
end

#to_h ⇒ Object 



234
235
236
237
238
239
240
241
242
243
 
# File 'lib/mootool/models/certificate.rb', line 234

def to_h
  result = { subject: @certificate.subject.to_s, issuer: @certificate.issuer.to_s }

  result[:key_id] = key_id if key_id
  result[:public_key] = formatted_public_key(find_matches: true)
  result[:fingerprint] = @fingerprint

  result[:extensions] = @extensions
  result
end