| 58 | } |
| 59 | |
| 60 | bool PaymentRequestPlus::getMerchant(X509_STORE* certStore, QString& merchant) const |
| 61 | { |
| 62 | merchant.clear(); |
| 63 | |
| 64 | if (!IsInitialized()) |
| 65 | return false; |
| 66 | |
| 67 | // One day we'll support more PKI types, but just |
| 68 | // x509 for now: |
| 69 | const EVP_MD* digestAlgorithm = nullptr; |
| 70 | if (paymentRequest.pki_type() == "x509+sha256") { |
| 71 | digestAlgorithm = EVP_sha256(); |
| 72 | } |
| 73 | else if (paymentRequest.pki_type() == "x509+sha1") { |
| 74 | digestAlgorithm = EVP_sha1(); |
| 75 | } |
| 76 | else if (paymentRequest.pki_type() == "none") { |
| 77 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: pki_type == none"; |
| 78 | return false; |
| 79 | } |
| 80 | else { |
| 81 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: unknown pki_type " << QString::fromStdString(paymentRequest.pki_type()); |
| 82 | return false; |
| 83 | } |
| 84 | |
| 85 | payments::X509Certificates certChain; |
| 86 | if (!certChain.ParseFromString(paymentRequest.pki_data())) { |
| 87 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: error parsing pki_data"; |
| 88 | return false; |
| 89 | } |
| 90 | |
| 91 | std::vector<X509*> certs; |
| 92 | const QDateTime currentTime = QDateTime::currentDateTime(); |
| 93 | for (int i = 0; i < certChain.certificate_size(); i++) { |
| 94 | QByteArray certData(certChain.certificate(i).data(), certChain.certificate(i).size()); |
| 95 | QSslCertificate qCert(certData, QSsl::Der); |
| 96 | if (currentTime < qCert.effectiveDate() || currentTime > qCert.expiryDate()) { |
| 97 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: certificate expired or not yet active: " << qCert; |
| 98 | return false; |
| 99 | } |
| 100 | if (qCert.isBlacklisted()) { |
| 101 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: certificate blacklisted: " << qCert; |
| 102 | return false; |
| 103 | } |
| 104 | const unsigned char *data = (const unsigned char *)certChain.certificate(i).data(); |
| 105 | X509 *cert = d2i_X509(nullptr, &data, certChain.certificate(i).size()); |
| 106 | if (cert) |
| 107 | certs.push_back(cert); |
| 108 | } |
| 109 | if (certs.empty()) { |
| 110 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: empty certificate chain"; |
| 111 | return false; |
| 112 | } |
| 113 | |
| 114 | // The first cert is the signing cert, the rest are untrusted certs that chain |
| 115 | // to a valid root authority. OpenSSL needs them separately. |
| 116 | STACK_OF(X509) *chain = sk_X509_new_null(); |
| 117 | for (int i = certs.size() - 1; i > 0; i--) { |