| 60 | } |
| 61 | |
| 62 | bool PaymentRequestPlus::getMerchant(X509_STORE* certStore, QString& merchant) const |
| 63 | { |
| 64 | merchant.clear(); |
| 65 | |
| 66 | if (!IsInitialized()) |
| 67 | return false; |
| 68 | |
| 69 | // One day we'll support more PKI types, but just |
| 70 | // x509 for now: |
| 71 | const EVP_MD* digestAlgorithm = NULL; |
| 72 | if (paymentRequest.pki_type() == "x509+sha256") { |
| 73 | digestAlgorithm = EVP_sha256(); |
| 74 | } |
| 75 | else if (paymentRequest.pki_type() == "x509+sha1") { |
| 76 | digestAlgorithm = EVP_sha1(); |
| 77 | } |
| 78 | else if (paymentRequest.pki_type() == "none") { |
| 79 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: pki_type == none"; |
| 80 | return false; |
| 81 | } |
| 82 | else { |
| 83 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: unknown pki_type " << QString::fromStdString(paymentRequest.pki_type()); |
| 84 | return false; |
| 85 | } |
| 86 | |
| 87 | payments::X509Certificates certChain; |
| 88 | if (!certChain.ParseFromString(paymentRequest.pki_data())) { |
| 89 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: error parsing pki_data"; |
| 90 | return false; |
| 91 | } |
| 92 | |
| 93 | std::vector<X509*> certs; |
| 94 | const QDateTime currentTime = QDateTime::currentDateTime(); |
| 95 | for (int i = 0; i < certChain.certificate_size(); i++) { |
| 96 | QByteArray certData(certChain.certificate(i).data(), certChain.certificate(i).size()); |
| 97 | QSslCertificate qCert(certData, QSsl::Der); |
| 98 | if (currentTime < qCert.effectiveDate() || currentTime > qCert.expiryDate()) { |
| 99 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: certificate expired or not yet active: " << qCert; |
| 100 | return false; |
| 101 | } |
| 102 | #if QT_VERSION >= 0x050000 |
| 103 | if (qCert.isBlacklisted()) { |
| 104 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: certificate blacklisted: " << qCert; |
| 105 | return false; |
| 106 | } |
| 107 | #endif |
| 108 | const unsigned char *data = (const unsigned char *)certChain.certificate(i).data(); |
| 109 | X509 *cert = d2i_X509(NULL, &data, certChain.certificate(i).size()); |
| 110 | if (cert) |
| 111 | certs.push_back(cert); |
| 112 | } |
| 113 | if (certs.empty()) { |
| 114 | qWarning() << "PaymentRequestPlus::getMerchant: Payment request: empty certificate chain"; |
| 115 | return false; |
| 116 | } |
| 117 | |
| 118 | // The first cert is the signing cert, the rest are untrusted certs that chain |
| 119 | // to a valid root authority. OpenSSL needs them separately. |