Certificate store using SQLite

18 files changed, 585 insertions, 82 deletions

diff --git a/src/lib/cert/x509/certstor.cpp b/src/lib/cert/x509/certstor.cpp
index 26c9ce117..4ef0e5240 100644
--- a/src/lib/cert/x509/certstor.cpp
+++ b/src/lib/cert/x509/certstor.cpp
@@ -5,62 +5,73 @@
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
+#include <cassert>
 #include <botan/certstor.h>
+#include <botan/ber_dec.h>
+#include <botan/der_enc.h>
 #include <botan/internal/filesystem.h>
+#include <botan/pkcs8.h>
+#include <botan/data_src.h>
+#include <botan/auto_rng.h>
+#include <botan/hash.h>
+#include <botan/hex.h>
+
+#include <iostream>
 
 namespace Botan {
 
-const X509_CRL* Certificate_Store::find_crl_for(const X509_Certificate&) const
+std::shared_ptr<const X509_CRL> Certificate_Store::find_crl_for(const X509_Certificate&) const
    {
-   return nullptr;
+   return std::shared_ptr<const X509_CRL>();
    }
 
 void Certificate_Store_In_Memory::add_certificate(const X509_Certificate& cert)
    {
    for(size_t i = 0; i != m_certs.size(); ++i)
       {
-      if(m_certs[i] == cert)
+      if(*m_certs[i] == cert)
          return;
       }
 
-   m_certs.push_back(cert);
+   m_certs.push_back(std::make_shared<X509_Certificate>(cert));
    }
 
 std::vector<X509_DN> Certificate_Store_In_Memory::all_subjects() const
    {
    std::vector<X509_DN> subjects;
    for(size_t i = 0; i != m_certs.size(); ++i)
-      subjects.push_back(m_certs[i].subject_dn());
+      subjects.push_back(m_certs[i]->subject_dn());
    return subjects;
    }
 
 namespace {
 
-const X509_Certificate*
+template<typename T>
+std::shared_ptr<const X509_Certificate>
 cert_search(const X509_DN& subject_dn, const std::vector<byte>& key_id,
-            const std::vector<X509_Certificate>& certs)
+            const std::vector<std::shared_ptr<T>>& certs)
    {
    for(size_t i = 0; i != certs.size(); ++i)
       {
       // Only compare key ids if set in both call and in the cert
       if(key_id.size())
          {
-         std::vector<byte> skid = certs[i].subject_key_id();
+         std::vector<byte> skid = certs[i]->subject_key_id();
 
          if(skid.size() && skid != key_id) // no match
             continue;
          }
 
-      if(certs[i].subject_dn() == subject_dn)
-         return &certs[i];
+      if(certs[i]->subject_dn() == subject_dn)
+         return certs[i];
       }
 
-   return nullptr;
+   return std::shared_ptr<const X509_Certificate>();
    }
 
 }
 
-const X509_Certificate*
+std::shared_ptr<const X509_Certificate>
 Certificate_Store_In_Memory::find_cert(const X509_DN& subject_dn,
                                        const std::vector<byte>& key_id) const
    {
@@ -74,19 +85,19 @@ void Certificate_Store_In_Memory::add_crl(const X509_CRL& crl)
    for(size_t i = 0; i != m_crls.size(); ++i)
       {
       // Found an update of a previously existing one; replace it
-      if(m_crls[i].issuer_dn() == crl_issuer)
+      if(m_crls[i]->issuer_dn() == crl_issuer)
          {
-         if(m_crls[i].this_update() <= crl.this_update())
-            m_crls[i] = crl;
+         if(m_crls[i]->this_update() <= crl.this_update())
+            m_crls[i] = std::make_shared<X509_CRL>(crl);
          return;
          }
       }
 
    // Totally new CRL, add to the list
-   m_crls.push_back(crl);
+   m_crls.push_back(std::make_shared<X509_CRL>(crl));
    }
 
-const X509_CRL* Certificate_Store_In_Memory::find_crl_for(const X509_Certificate& subject) const
+std::shared_ptr<const X509_CRL> Certificate_Store_In_Memory::find_crl_for(const X509_Certificate& subject) const
    {
    const std::vector<byte>& key_id = subject.authority_key_id();
 
@@ -95,17 +106,17 @@ const X509_CRL* Certificate_Store_In_Memory::find_crl_for(const X509_Certificate
       // Only compare key ids if set in both call and in the CRL
       if(key_id.size())
          {
-         std::vector<byte> akid = m_crls[i].authority_key_id();
+         std::vector<byte> akid = m_crls[i]->authority_key_id();
 
          if(akid.size() && akid != key_id) // no match
             continue;
          }
 
-      if(m_crls[i].issuer_dn() == subject.issuer_dn())
-         return &m_crls[i];
+      if(m_crls[i]->issuer_dn() == subject.issuer_dn())
+         return m_crls[i];
       }
 
-   return nullptr;
+   return std::shared_ptr<const X509_CRL>();
    }
 
 Certificate_Store_In_Memory::Certificate_Store_In_Memory(const X509_Certificate& cert)
@@ -123,7 +134,7 @@ Certificate_Store_In_Memory::Certificate_Store_In_Memory(const std::string& dir)
       {
       try
          {
-         m_certs.push_back(X509_Certificate(cert_file));
+         m_certs.push_back(std::make_shared<X509_Certificate>(cert_file));
          }
       catch(std::exception&)
          {
@@ -131,7 +142,7 @@ Certificate_Store_In_Memory::Certificate_Store_In_Memory(const std::string& dir)
       }
    }
 
-const X509_Certificate*
+std::shared_ptr<const X509_Certificate>
 Certificate_Store_Overlay::find_cert(const X509_DN& subject_dn,
                                      const std::vector<byte>& key_id) const
    {
@@ -142,7 +153,7 @@ std::vector<X509_DN> Certificate_Store_Overlay::all_subjects() const
    {
    std::vector<X509_DN> subjects;
    for(size_t i = 0; i != m_certs.size(); ++i)
-      subjects.push_back(m_certs[i].subject_dn());
+      subjects.push_back(m_certs[i]->subject_dn());
    return subjects;
    }
 
diff --git a/src/lib/cert/x509/certstor.h b/src/lib/cert/x509/certstor.h
index 29948c709..c769bfe5c 100644
--- a/src/lib/cert/x509/certstor.h
+++ b/src/lib/cert/x509/certstor.h
@@ -10,6 +10,8 @@
 
 #include <botan/x509cert.h>
 #include <botan/x509_crl.h>
+#include <botan/database.h>
+#include <botan/pbkdf.h>
 
 namespace Botan {
 
@@ -24,10 +26,10 @@ class BOTAN_DLL Certificate_Store
       /**
       * Subject DN and (optionally) key identifier
       */
-      virtual const X509_Certificate*
+      virtual std::shared_ptr<const X509_Certificate>
          find_cert(const X509_DN& subject_dn, const std::vector<byte>& key_id) const = 0;
 
-      virtual const X509_CRL* find_crl_for(const X509_Certificate& subject) const;
+      virtual std::shared_ptr<const X509_CRL> find_crl_for(const X509_Certificate& subject) const;
 
       bool certificate_known(const X509_Certificate& cert) const
          {
@@ -60,32 +62,31 @@ class BOTAN_DLL Certificate_Store_In_Memory : public Certificate_Store
 
       std::vector<X509_DN> all_subjects() const override;
 
-      const X509_Certificate* find_cert(
+      std::shared_ptr<const X509_Certificate> find_cert(
          const X509_DN& subject_dn,
          const std::vector<byte>& key_id) const override;
 
-      const X509_CRL* find_crl_for(const X509_Certificate& subject) const override;
+      std::shared_ptr<const X509_CRL> find_crl_for(const X509_Certificate& subject) const override;
    private:
       // TODO: Add indexing on the DN and key id to avoid linear search
-      std::vector<X509_Certificate> m_certs;
-      std::vector<X509_CRL> m_crls;
+      std::vector<std::shared_ptr<X509_Certificate>> m_certs;
+      std::vector<std::shared_ptr<X509_CRL>> m_crls;
    };
 
 class BOTAN_DLL Certificate_Store_Overlay : public Certificate_Store
    {
    public:
-      explicit Certificate_Store_Overlay(const std::vector<X509_Certificate>& certs) :
+      explicit Certificate_Store_Overlay(const std::vector<std::shared_ptr<const X509_Certificate>>& certs) :
          m_certs(certs) {}
 
       std::vector<X509_DN> all_subjects() const override;
 
-      const X509_Certificate* find_cert(
+      std::shared_ptr<const X509_Certificate> find_cert(
          const X509_DN& subject_dn,
          const std::vector<byte>& key_id) const override;
    private:
-      const std::vector<X509_Certificate>& m_certs;
+      const std::vector<std::shared_ptr<const X509_Certificate>>& m_certs;
    };
 
 }
-
 #endif
diff --git a/src/lib/cert/x509/certstor_sql/certstor_sql.cpp b/src/lib/cert/x509/certstor_sql/certstor_sql.cpp
new file mode 100644
index 000000000..d8325fb87
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sql/certstor_sql.cpp
@@ -0,0 +1,320 @@
+/*
+* Certificate Store in SQL
+* (C) 2016 Kai Michaelis, Rohde & Schwarz Cybersecurity
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/certstor_sql.h>
+#include <botan/ber_dec.h>
+#include <botan/der_enc.h>
+#include <botan/internal/filesystem.h>
+#include <botan/pkcs8.h>
+#include <botan/data_src.h>
+#include <botan/auto_rng.h>
+#include <botan/hash.h>
+#include <botan/hex.h>
+
+namespace Botan {
+
+Certificate_Store_In_SQL::Certificate_Store_In_SQL(std::shared_ptr<SQL_Database> db,
+                                                   const std::string& passwd,
+                                                   const std::string& table_prefix)
+: m_database(db), m_prefix(table_prefix), m_password(passwd)
+   {
+   m_database->create_table("CREATE TABLE IF NOT EXISTS certificates ( \
+                                 fingerprint       BLOB PRIMARY KEY,   \
+                                 subject_dn        BLOB,               \
+                                 key_id            BLOB,               \
+                                 priv_fingerprint  BLOB,               \
+                                 certificate       BLOB UNIQUE NOT NULL\
+                             )");
+   m_database->create_table("CREATE TABLE IF NOT EXISTS keys (   \
+                                 fingerprint BLOB PRIMARY KEY,   \
+                                 key         BLOB UNIQUE NOT NULL\
+                             )");
+   m_database->create_table("CREATE TABLE IF NOT EXISTS revoked (\
+                                 fingerprint BLOB PRIMARY KEY,   \
+                                 reason      BLOB NOT NULL,      \
+                                 time        BLOB NOT NULL       \
+                            )");
+   }
+
+// Certificate handling
+std::shared_ptr<const X509_Certificate>
+Certificate_Store_In_SQL::find_cert(const X509_DN& subject_dn, const std::vector<byte>& key_id) const
+   {
+   DER_Encoder enc;
+   std::shared_ptr<SQL_Database::Statement> stmt;
+
+   subject_dn.encode_into(enc);
+
+   if(key_id.empty())
+      {
+      stmt = m_database->new_statement("SELECT certificate FROM certificates WHERE subject_dn == ?1");
+      stmt->bind(1,enc.get_contents_unlocked());
+      }
+   else
+      {
+      stmt = m_database->new_statement("SELECT certificate FROM certificates WHERE\
+                                        subject_dn == ?1 AND (key_id == NULL OR key_id == ?2)");
+      stmt->bind(1,enc.get_contents_unlocked());
+      stmt->bind(2,key_id);
+      }
+
+   std::shared_ptr<const X509_Certificate> cert;
+   while(stmt->step())
+      {
+      auto blob = stmt->get_blob(0);
+      cert = std::make_shared<X509_Certificate>(
+            std::vector<byte>(blob.first,blob.first + blob.second));
+
+      }
+
+   return cert;
+   }
+
+std::shared_ptr<const X509_CRL>
+Certificate_Store_In_SQL::find_crl_for(const X509_Certificate& subject) const
+   {
+   auto all_crls = generate_crls();
+
+   for(auto crl: all_crls)
+      {
+      if(!crl.get_revoked().empty() && crl.issuer_dn() == subject.issuer_dn())
+         return std::shared_ptr<X509_CRL>(new X509_CRL(crl));
+      }
+
+   return std::shared_ptr<X509_CRL>();
+   }
+
+std::vector<X509_DN> Certificate_Store_In_SQL::all_subjects() const
+   {
+   std::vector<X509_DN> ret;
+   auto stmt = m_database->new_statement("SELECT subject_dn FROM certificates");
+
+   while(stmt->step())
+      {
+      auto blob = stmt->get_blob(0);
+      BER_Decoder dec(blob.first,blob.second);
+      X509_DN dn;
+
+      dn.decode_from(dec);
+
+      ret.push_back(dn);
+      }
+
+   return ret;
+   }
+
+bool Certificate_Store_In_SQL::insert_cert(const X509_Certificate& cert)
+   {
+   if(find_cert(cert.subject_dn(),cert.subject_key_id()))
+      return false;
+
+   DER_Encoder enc;
+   auto stmt = m_database->new_statement("INSERT OR REPLACE INTO certificates (\
+                                         fingerprint,                          \
+                                         subject_dn,                           \
+                                         key_id,                               \
+                                         priv_fingerprint,                     \
+                                         certificate                           \
+                                     ) VALUES ( ?1, ?2, ?3, ?4, ?5 )");
+
+   stmt->bind(1,cert.fingerprint("SHA-256"));
+   cert.subject_dn().encode_into(enc);
+   stmt->bind(2,enc.get_contents_unlocked());
+   stmt->bind(3,cert.subject_key_id());
+   stmt->bind(4,std::vector<byte>());
+   enc = DER_Encoder();
+   cert.encode_into(enc);
+   stmt->bind(5,enc.get_contents_unlocked());
+   stmt->spin();
+
+   return true;
+   }
+
+
+bool Certificate_Store_In_SQL::remove_cert(const X509_Certificate& cert)
+   {
+   if(!find_cert(cert.subject_dn(),cert.subject_key_id()))
+      return false;
+
+   auto stmt = m_database->new_statement("DELETE FROM certificates WHERE fingerprint == ?1");
+
+   stmt->bind(1,cert.fingerprint("SHA-256"));
+   stmt->spin();
+
+   return true;
+   }
+
+// Private key handling
+std::shared_ptr<const Private_Key> Certificate_Store_In_SQL::find_key(const X509_Certificate& cert) const
+   {
+   auto stmt = m_database->new_statement("SELECT key FROM keys JOIN certificates ON keys.fingerprint == certificates.priv_fingerprint WHERE certificates.fingerprint == ?1");
+   stmt->bind(1,cert.fingerprint("SHA-256"));
+
+   std::shared_ptr<const Private_Key> key;
+   while(stmt->step())
+      {
+      auto blob = stmt->get_blob(0);
+      AutoSeeded_RNG rng;
+      DataSource_Memory src(blob.first,blob.second);
+      key.reset(PKCS8::load_key(src,rng,m_password));
+      }
+
+   return key;
+   }
+
+std::vector<std::shared_ptr<const X509_Certificate>>
+Certificate_Store_In_SQL::find_certs_for_key(const Private_Key& key) const
+   {
+   AutoSeeded_RNG rng;
+   auto fpr = fingerprint_key(key);
+   auto stmt = m_database->new_statement("SELECT certificate FROM certificates WHERE priv_fingerprint == ?1");
+
+   stmt->bind(1,fpr);
+
+   std::shared_ptr<const X509_Certificate> cert;
+   while(stmt->step())
+      {
+      auto blob = stmt->get_blob(0);
+      cert = std::make_shared<X509_Certificate>(
+            std::vector<byte>(blob.first,blob.first + blob.second));
+      }
+
+   return {cert};
+   }
+
+bool Certificate_Store_In_SQL::insert_key(const X509_Certificate& cert, const Private_Key& key) {
+   insert_cert(cert);
+
+   if(find_key(cert))
+      return false;
+
+   AutoSeeded_RNG rng;
+   auto pkcs8 = PKCS8::BER_encode(key,rng,m_password);
+   auto fpr = fingerprint_key(key);
+
+   //m_database->new_statement("BEGIN TRANSACTION")->spin();
+
+   auto stmt1 = m_database->new_statement(
+         "INSERT OR REPLACE INTO keys ( fingerprint, key ) VALUES ( ?1, ?2 )");
+
+   stmt1->bind(1,fpr);
+   stmt1->bind(2,pkcs8.data(),pkcs8.size());
+   stmt1->spin();
+
+   auto stmt2 = m_database->new_statement(
+         "UPDATE certificates SET priv_fingerprint = ?1 WHERE fingerprint == ?2");
+
+   stmt2->bind(1,fpr);
+   stmt2->bind(2,cert.fingerprint("SHA-256"));
+   stmt2->spin();
+
+   //m_database->new_statement("END TRANSACTION")->spin();
+   
+   return true;
+   }
+
+std::string Certificate_Store_In_SQL::fingerprint_key(const Botan::Private_Key& key) const
+   {
+   secure_vector<byte> buf = key.pkcs8_private_key();
+   std::unique_ptr<HashFunction> hash(HashFunction::create("SHA-256"));
+   hash->update(buf);
+   const auto hex_print = hex_encode(hash->final());
+
+   std::string formatted_print;
+
+   for(size_t i = 0; i != hex_print.size(); i += 2)
+      {
+      formatted_print.push_back(hex_print[i]);
+      formatted_print.push_back(hex_print[i+1]);
+
+      if(i != hex_print.size() - 2)
+         formatted_print.push_back(':');
+      }
+
+   return formatted_print;
+   }
+
+void Certificate_Store_In_SQL::remove_key(const Private_Key& key)
+   {
+   AutoSeeded_RNG rng;
+   auto fpr = fingerprint_key(key);
+   auto stmt = m_database->new_statement("DELETE FROM keys WHERE fingerprint == ?1");
+
+   stmt->bind(1,fpr);
+   stmt->spin();
+   }
+
+// Revocation
+void Certificate_Store_In_SQL::revoke_cert(const X509_Certificate& cert, CRL_Code code, const X509_Time& time)
+   {
+   insert_cert(cert);
+
+   auto stmt1 = m_database->new_statement(
+         "INSERT OR REPLACE INTO revoked ( fingerprint, reason, time ) VALUES ( ?1, ?2, ?3 )");
+
+   stmt1->bind(1,cert.fingerprint("SHA-256"));
+   stmt1->bind(2,code);
+
+   if(time.time_is_set())
+      {
+      DER_Encoder der;
+      time.encode_into(der);
+      stmt1->bind(3,der.get_contents_unlocked());
+      }
+   else
+      {
+      stmt1->bind(3,-1);
+      }
+
+   stmt1->spin();
+   }
+
+void Certificate_Store_In_SQL::affirm_cert(const X509_Certificate& cert)
+   {
+   auto stmt = m_database->new_statement("DELETE FROM revoked WHERE fingerprint == ?1");
+
+   stmt->bind(1,cert.fingerprint("SHA-256"));
+   stmt->spin();
+   }
+
+std::vector<X509_CRL> Certificate_Store_In_SQL::generate_crls() const
+   {
+   auto stmt = m_database->new_statement(
+         "SELECT certificate,reason,time FROM revoked JOIN certificates ON certificates.fingerprint == revoked.fingerprint");
+
+   std::map<X509_DN,std::vector<CRL_Entry>> crls;
+   while(stmt->step())
+      {
+      auto blob = stmt->get_blob(0);
+      auto cert = X509_Certificate(
+            std::vector<byte>(blob.first,blob.first + blob.second));
+      auto code = static_cast<CRL_Code>(stmt->get_size_t(1));
+      auto ent = CRL_Entry(cert,code);
+
+      auto i = crls.find(cert.issuer_dn());
+      if(i == crls.end())
+         {
+         crls.insert(std::make_pair(cert.issuer_dn(),std::vector<CRL_Entry>({ent})));
+         }
+      else
+         {
+         i->second.push_back(ent);
+         }
+      }
+
+   std::vector<X509_CRL> ret;
+   X509_Time t(std::chrono::system_clock::now());
+
+   for(auto p: crls)
+      {
+      ret.push_back(X509_CRL(p.first,t,t,p.second));
+      }
+
+   return ret;
+   }
+
+}
diff --git a/src/lib/cert/x509/certstor_sql/certstor_sql.h b/src/lib/cert/x509/certstor_sql/certstor_sql.h
new file mode 100644
index 000000000..24db88cdd
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sql/certstor_sql.h
@@ -0,0 +1,93 @@
+/*
+* Certificate Store in SQL
+* (C) 2016 Kai Michaelis, Rohde & Schwarz Cybersecurity
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_CERT_STORE_SQL_H__
+#define BOTAN_CERT_STORE_SQL_H__
+
+#include <botan/certstor.h>
+#include <botan/x509cert.h>
+#include <botan/x509_crl.h>
+#include <botan/database.h>
+
+namespace Botan {
+
+/**
+ * Certificate and private key store backed an SQL database.
+ */
+class BOTAN_DLL Certificate_Store_In_SQL : public Certificate_Store
+   {
+   public:
+      /**
+       * Create/open a certificate store backed by "db".
+       * Inserted private keys are encrypted using "passwd".
+       */
+      explicit Certificate_Store_In_SQL(const std::shared_ptr<SQL_Database> db,
+                                         const std::string& passwd,
+                                         const std::string& table_prefix = "");
+
+      /// Returns the first certificate with matching subject DN and optional key ID.
+      virtual std::shared_ptr<const X509_Certificate>
+         find_cert(const X509_DN& subject_dn, const std::vector<byte>& key_id) const override;
+
+      /// Generates a CRL for all certificates issued by "subject"s issuer.
+      virtual std::shared_ptr<const X509_CRL>
+         find_crl_for(const X509_Certificate& subject) const override;
+
+      /// Returns all subject DNs known to the store instance,
+      virtual std::vector<X509_DN> all_subjects() const override;
+
+      /**
+       * Inserts "cert" into the store, returns false if the certificate is
+       * already known and true if insertion was successful.
+       */
+      bool insert_cert(const X509_Certificate& cert);
+
+      /**
+       * Removes "cert" from the store. Returns false if the certificate could not
+       * be found and true if removal was successful.
+       */
+      bool remove_cert(const X509_Certificate& cert);
+
+      /// Returns the private key for "cert" or an empty shared_ptr if none was found.
+      std::shared_ptr<const Private_Key> find_key(const X509_Certificate&) const;
+
+      /// Returns all certificates for private key "key".
+      std::vector<std::shared_ptr<const X509_Certificate>>
+         find_certs_for_key(const Private_Key& key) const;
+
+      /**
+       * Inserts "key" for "cert" into the store, returns false if the key is
+       * already known and true if insertion was successful.
+       */
+      bool insert_key(const X509_Certificate& cert, const Private_Key& key);
+
+      /// Removes "key" from the store.
+      void remove_key(const Private_Key& key);
+
+      /// Marks "cert" as revoked starting from "time".
+      void revoke_cert(const X509_Certificate&,CRL_Code,const X509_Time& time = X509_Time());
+
+      /// Reverses the revokation for "cert".
+      void affirm_cert(const X509_Certificate&);
+
+      /**
+       * Generates Certificate Revocation Lists for all certificates marked as revoked.
+       * A CRL is returned for each unique issuer DN.
+       */
+      std::vector<X509_CRL> generate_crls() const;
+
+   private:
+      std::string fingerprint_key(const Private_Key&) const;
+
+      std::shared_ptr<SQL_Database> m_database;
+      std::string m_prefix;
+      std::string m_password;
+      std::mutex m_mutex;
+   };
+
+}
+#endif
diff --git a/src/lib/cert/x509/certstor_sql/info.txt b/src/lib/cert/x509/certstor_sql/info.txt
new file mode 100644
index 000000000..cfdd521a2
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sql/info.txt
@@ -0,0 +1,5 @@
+define CERTSTOR_SQL 20160818
+
+<requires>
+datastor
+</requires>
diff --git a/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.cpp b/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.cpp
new file mode 100644
index 000000000..89dfb3575
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.cpp
@@ -0,0 +1,18 @@
+/*
+* Certificate Store in SQL
+* (C) 2016 Kai Michaelis, Rohde & Schwarz Cybersecurity
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/certstor_sqlite.h>
+#include <botan/sqlite3.h>
+
+namespace Botan {
+
+Certificate_Store_In_SQLite::Certificate_Store_In_SQLite(const std::string& db_path,
+                                                   const std::string& passwd,
+                                                   const std::string& table_prefix)
+: Certificate_Store_In_SQL(std::make_shared<Sqlite3_Database>(db_path), passwd, table_prefix)
+   {}
+}
diff --git a/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.h b/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.h
new file mode 100644
index 000000000..c7d686d89
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sqlite3/certstor_sqlite.h
@@ -0,0 +1,23 @@
+/*
+* Certificate Store in SQL
+* (C) 2016 Kai Michaelis, Rohde & Schwarz Cybersecurity
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_CERT_STORE_SQLITE_H__
+#define BOTAN_CERT_STORE_SQLITE_H__
+
+#include <botan/certstor_sql.h>
+
+namespace Botan {
+
+class BOTAN_DLL Certificate_Store_In_SQLite : public Certificate_Store_In_SQL
+   {
+   public:
+      Certificate_Store_In_SQLite(const std::string& db_path,
+                                           const std::string& passwd,
+                                           const std::string& table_prefix = "");
+   };
+}
+#endif
diff --git a/src/lib/cert/x509/certstor_sqlite3/info.txt b/src/lib/cert/x509/certstor_sqlite3/info.txt
new file mode 100644
index 000000000..d5e50fc95
--- /dev/null
+++ b/src/lib/cert/x509/certstor_sqlite3/info.txt
@@ -0,0 +1,6 @@
+define CERTSTOR_SQLITE3 20160818
+
+<requires>
+certstor_sql
+sqlite3
+</requires>
diff --git a/src/lib/cert/x509/ocsp.cpp b/src/lib/cert/x509/ocsp.cpp
index df8df3b39..761c5b436 100644
--- a/src/lib/cert/x509/ocsp.cpp
+++ b/src/lib/cert/x509/ocsp.cpp
@@ -92,9 +92,9 @@ void check_signature(const std::vector<byte>& tbs_response,
    if(!trusted_roots.certificate_known(result.trust_root())) // not needed anymore?
       throw Exception("Certificate chain roots in unknown/untrusted CA");
 
-   const std::vector<X509_Certificate>& cert_path = result.cert_path();
+   const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path = result.cert_path();
 
-   check_signature(tbs_response, sig_algo, signature, cert_path[0]);
+   check_signature(tbs_response, sig_algo, signature, *cert_path[0]);
    }
 
 }
diff --git a/src/lib/cert/x509/x509_crl.cpp b/src/lib/cert/x509/x509_crl.cpp
index 64cb1b308..3c75825c1 100644
--- a/src/lib/cert/x509/x509_crl.cpp
+++ b/src/lib/cert/x509/x509_crl.cpp
@@ -39,6 +39,15 @@ X509_CRL::X509_CRL(const std::vector<byte>& in, bool touc) :
    do_decode();
    }
 
+X509_CRL::X509_CRL(const X509_DN& issuer, const X509_Time& thisUpdate,
+                   const X509_Time& nextUpdate, const std::vector<CRL_Entry>& revoked) :
+   X509_Object(), m_throw_on_unknown_critical(false), m_revoked(revoked)
+   {
+   m_info.add(issuer.contents());
+   m_info.add("X509.CRL.start", thisUpdate.to_string());
+   m_info.add("X509.CRL.end", nextUpdate.to_string());
+   }
+
 /**
 * Check if this particular certificate is listed in the CRL
 */
diff --git a/src/lib/cert/x509/x509_crl.h b/src/lib/cert/x509/x509_crl.h
index dab4d5153..2e05f98fb 100644
--- a/src/lib/cert/x509/x509_crl.h
+++ b/src/lib/cert/x509/x509_crl.h
@@ -100,6 +100,9 @@ class BOTAN_DLL X509_CRL final : public X509_Object
       X509_CRL(const std::vector<byte>& vec,
                bool throw_on_unknown_critical = false);
 
+      X509_CRL(const X509_DN& issuer, const X509_Time& thisUpdate,
+               const X509_Time& nextUpdate, const std::vector<CRL_Entry>& revoked);
+
    private:
       void force_decode() override;
 
diff --git a/src/lib/cert/x509/x509_ext.cpp b/src/lib/cert/x509/x509_ext.cpp
index 650c20d53..23340f784 100644
--- a/src/lib/cert/x509/x509_ext.cpp
+++ b/src/lib/cert/x509/x509_ext.cpp
@@ -83,7 +83,7 @@ OID Certificate_Extension::oid_of() const
 * Validate the extension (the default implementation is a NOP)
 */
 void Certificate_Extension::validate(const X509_Certificate&, const X509_Certificate&,
-      const std::vector<X509_Certificate>&,
+      const std::vector<std::shared_ptr<const X509_Certificate>>&,
       std::vector<std::set<Certificate_Status_Code>>&,
       size_t)
    {
@@ -525,7 +525,7 @@ void Name_Constraints::contents_to(Data_Store& subject, Data_Store&) const
    }
 
 void Name_Constraints::validate(const X509_Certificate& subject, const X509_Certificate& issuer,
-      const std::vector<X509_Certificate>& cert_path,
+      const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
       std::vector<std::set<Certificate_Status_Code>>& cert_status,
       size_t pos)
    {
@@ -547,7 +547,7 @@ void Name_Constraints::validate(const X509_Certificate& subject, const X509_Cert
 
          for(auto c: m_name_constraints.permitted())
             {
-            switch(c.base().matches(cert_path.at(j)))
+            switch(c.base().matches(*cert_path.at(j)))
                {
             case GeneralName::MatchResult::NotFound:
             case GeneralName::MatchResult::All:
@@ -564,7 +564,7 @@ void Name_Constraints::validate(const X509_Certificate& subject, const X509_Cert
 
          for(auto c: m_name_constraints.excluded())
             {
-            switch(c.base().matches(cert_path.at(j)))
+            switch(c.base().matches(*cert_path.at(j)))
                {
             case GeneralName::MatchResult::All:
             case GeneralName::MatchResult::Some:
diff --git a/src/lib/cert/x509/x509_ext.h b/src/lib/cert/x509/x509_ext.h
index 8ea2f2da6..b1984fa94 100644
--- a/src/lib/cert/x509/x509_ext.h
+++ b/src/lib/cert/x509/x509_ext.h
@@ -68,7 +68,7 @@ class BOTAN_DLL Certificate_Extension
       * @param pos Position of subject certificate in cert_path
       */
       virtual void validate(const X509_Certificate& subject, const X509_Certificate& issuer,
-            const std::vector<X509_Certificate>& cert_path,
+            const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
             std::vector<std::set<Certificate_Status_Code>>& cert_status,
             size_t pos);
 
@@ -305,7 +305,7 @@ class BOTAN_DLL Name_Constraints : public Certificate_Extension
       Name_Constraints(const NameConstraints &nc) : m_name_constraints(nc) {}
 
       void validate(const X509_Certificate& subject, const X509_Certificate& issuer,
-            const std::vector<X509_Certificate>& cert_path,
+            const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
             std::vector<std::set<Certificate_Status_Code>>& cert_status,
             size_t pos) override;
 
@@ -479,7 +479,7 @@ class BOTAN_DLL Unknown_Critical_Extension final : public Certificate_Extension
          { return m_oid; };
 
       void validate(const X509_Certificate&, const X509_Certificate&,
-      		const std::vector<X509_Certificate>&,
+      		const std::vector<std::shared_ptr<const X509_Certificate>>&,
       		std::vector<std::set<Certificate_Status_Code>>& cert_status,
       		size_t pos) override
          {
diff --git a/src/lib/cert/x509/x509path.cpp b/src/lib/cert/x509/x509path.cpp
index c08b11d42..65ab3eac1 100644
--- a/src/lib/cert/x509/x509path.cpp
+++ b/src/lib/cert/x509/x509path.cpp
@@ -20,7 +20,7 @@ namespace Botan {
 
 namespace {
 
-const X509_Certificate*
+std::shared_ptr<const X509_Certificate>
 find_issuing_cert(const X509_Certificate& cert,
                   Certificate_Store& end_certs,
                   const std::vector<Certificate_Store*>& certstores)
@@ -28,25 +28,25 @@ find_issuing_cert(const X509_Certificate& cert,
    const X509_DN issuer_dn = cert.issuer_dn();
    const std::vector<byte> auth_key_id = cert.authority_key_id();
 
-   const X509_Certificate* c = end_certs.find_cert(issuer_dn, auth_key_id);
+   std::shared_ptr<const X509_Certificate> c = end_certs.find_cert(issuer_dn, auth_key_id);
    if(c && *c != cert)
       return c;
 
    for(size_t i = 0; i != certstores.size(); ++i)
       {
-      if(const X509_Certificate* c = certstores[i]->find_cert(issuer_dn, auth_key_id))
+      if(std::shared_ptr<const X509_Certificate> c = certstores[i]->find_cert(issuer_dn, auth_key_id))
          return c;
       }
 
    return nullptr;
    }
 
-const X509_CRL* find_crls_for(const X509_Certificate& cert,
+std::shared_ptr<const X509_CRL> find_crls_for(const X509_Certificate& cert,
                               const std::vector<Certificate_Store*>& certstores)
    {
    for(size_t i = 0; i != certstores.size(); ++i)
       {
-      if(const X509_CRL* crl = certstores[i]->find_crl_for(cert))
+      if(std::shared_ptr<const X509_CRL> crl = certstores[i]->find_crl_for(cert))
          return crl;
       }
 
@@ -72,7 +72,7 @@ const X509_CRL* find_crls_for(const X509_Certificate& cert,
    }
 
 std::vector<std::set<Certificate_Status_Code>>
-check_chain(const std::vector<X509_Certificate>& cert_path,
+check_chain(const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
             const Path_Validation_Restrictions& restrictions,
             const std::vector<Certificate_Store*>& certstores)
    {
@@ -92,9 +92,9 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
 
       const bool at_self_signed_root = (i == cert_path.size() - 1);
 
-      const X509_Certificate& subject = cert_path[i];
+      std::shared_ptr<const X509_Certificate> subject = cert_path[i];
 
-      const X509_Certificate& issuer = cert_path[at_self_signed_root ? (i) : (i + 1)];
+      std::shared_ptr<const X509_Certificate> issuer = cert_path[at_self_signed_root ? (i) : (i + 1)];
 
       if(i == 0 || restrictions.ocsp_all_intermediates())
          {
@@ -102,25 +102,25 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
          if(certstores.size() > 1)
             ocsp_responses.push_back(
                std::async(std::launch::async,
-                          OCSP::online_check, issuer, subject, certstores[0]));
+                          OCSP::online_check, *issuer, *subject, certstores[0]));
          }
 
       // Check all certs for valid time range
-      if(current_time < X509_Time(subject.start_time(), ASN1_Tag::UTC_OR_GENERALIZED_TIME))
+      if(current_time < X509_Time(subject->start_time(), ASN1_Tag::UTC_OR_GENERALIZED_TIME))
          status.insert(Certificate_Status_Code::CERT_NOT_YET_VALID);
 
-      if(current_time > X509_Time(subject.end_time(), ASN1_Tag::UTC_OR_GENERALIZED_TIME))
+      if(current_time > X509_Time(subject->end_time(), ASN1_Tag::UTC_OR_GENERALIZED_TIME))
          status.insert(Certificate_Status_Code::CERT_HAS_EXPIRED);
 
       // Check issuer constraints
 
-      if(!issuer.is_CA_cert() && !self_signed_ee_cert)
+      if(!issuer->is_CA_cert() && !self_signed_ee_cert)
          status.insert(Certificate_Status_Code::CA_CERT_NOT_FOR_CERT_ISSUER);
 
-      if(issuer.path_limit() < i)
+      if(issuer->path_limit() < i)
          status.insert(Certificate_Status_Code::CERT_CHAIN_TOO_LONG);
 
-      std::unique_ptr<Public_Key> issuer_key(issuer.subject_public_key());
+      std::unique_ptr<Public_Key> issuer_key(issuer->subject_public_key());
 
       if(!issuer_key)
          {
@@ -128,7 +128,7 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
          }
       else
          {
-         if(subject.check_signature(*issuer_key) == false)
+         if(subject->check_signature(*issuer_key) == false)
             status.insert(Certificate_Status_Code::SIGNATURE_ERROR);
 
          if(issuer_key->estimated_strength() < restrictions.minimum_key_strength())
@@ -138,15 +138,15 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
       // Allow untrusted hashes on self-signed roots
       if(!trusted_hashes.empty() && !at_self_signed_root)
          {
-         if(!trusted_hashes.count(subject.hash_used_for_signature()))
+         if(!trusted_hashes.count(subject->hash_used_for_signature()))
             status.insert(Certificate_Status_Code::UNTRUSTED_HASH);
          }
 
       // Check cert extensions
-      Extensions extensions = subject.v3_extensions();
+      Extensions extensions = subject->v3_extensions();
       for(auto& extension : extensions.extensions())
          {
-         extension.first->validate(subject, issuer, cert_path, cert_status, i);
+         extension.first->validate(*subject, *issuer, cert_path, cert_status, i);
          }
       }
 
@@ -154,8 +154,8 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
       {
       std::set<Certificate_Status_Code>& status = cert_status.at(i);
 
-      const X509_Certificate& subject = cert_path.at(i);
-      const X509_Certificate& ca = cert_path.at(i+1);
+      std::shared_ptr<const X509_Certificate> subject = cert_path.at(i);
+      std::shared_ptr<const X509_Certificate> ca = cert_path.at(i+1);
 
       if(i < ocsp_responses.size())
          {
@@ -163,7 +163,7 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
             {
             OCSP::Response ocsp = ocsp_responses[i].get();
 
-            auto ocsp_status = ocsp.status_for(ca, subject);
+            auto ocsp_status = ocsp.status_for(*ca, *subject);
 
             status.insert(ocsp_status);
 
@@ -181,7 +181,7 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
             }
          }
 
-      const X509_CRL* crl_p = find_crls_for(subject, certstores);
+      std::shared_ptr<const X509_CRL> crl_p = find_crls_for(*subject, certstores);
 
       if(!crl_p)
          {
@@ -192,7 +192,7 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
 
       const X509_CRL& crl = *crl_p;
 
-      if(!ca.allowed_usage(CRL_SIGN))
+      if(!ca->allowed_usage(CRL_SIGN))
          status.insert(Certificate_Status_Code::CA_CERT_NOT_FOR_CRL_ISSUER);
 
       if(current_time < X509_Time(crl.this_update()))
@@ -201,10 +201,10 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
       if(current_time > X509_Time(crl.next_update()))
          status.insert(Certificate_Status_Code::CRL_HAS_EXPIRED);
 
-      if(crl.check_signature(ca.subject_public_key()) == false)
+      if(crl.check_signature(ca->subject_public_key()) == false)
          status.insert(Certificate_Status_Code::CRL_BAD_SIGNATURE);
 
-      if(crl.is_revoked(subject))
+      if(crl.is_revoked(*subject))
          status.insert(Certificate_Status_Code::CERT_IS_REVOKED);
       }
 
@@ -226,8 +226,12 @@ Path_Validation_Result x509_path_validate(
    if(end_certs.empty())
       throw Invalid_Argument("x509_path_validate called with no subjects");
 
-   std::vector<X509_Certificate> cert_path;
-   cert_path.push_back(end_certs[0]);
+   std::vector<std::shared_ptr<const X509_Certificate>> cert_path;
+   std::vector<std::shared_ptr<const X509_Certificate>> end_certs_sharedptr;
+   cert_path.push_back(std::make_shared<X509_Certificate>(end_certs[0]));
+
+   for(auto c: end_certs)
+      end_certs_sharedptr.push_back(std::make_shared<const X509_Certificate>(c));
 
    /*
    * This is an inelegant but functional way of preventing path loops
@@ -236,12 +240,12 @@ Path_Validation_Result x509_path_validate(
    */
    std::set<std::string> certs_seen;
 
-   Certificate_Store_Overlay extra(end_certs);
+   Certificate_Store_Overlay extra(end_certs_sharedptr);
 
    // iterate until we reach a root or cannot find the issuer
-   while(!cert_path.back().is_self_signed())
+   while(!cert_path.back()->is_self_signed())
       {
-      const X509_Certificate* cert = find_issuing_cert(cert_path.back(), extra, certstores);
+      std::shared_ptr<const X509_Certificate> cert = find_issuing_cert(*cert_path.back(), extra, certstores);
       if(!cert)
          return Path_Validation_Result(Certificate_Status_Code::CERT_ISSUER_NOT_FOUND);
 
@@ -249,15 +253,15 @@ Path_Validation_Result x509_path_validate(
       if(certs_seen.count(fprint) > 0)
          return Path_Validation_Result(Certificate_Status_Code::CERT_CHAIN_LOOP);
       certs_seen.insert(fprint);
-      cert_path.push_back(*cert);
+      cert_path.push_back(cert);
       }
 
    std::vector<std::set<Certificate_Status_Code>> res = check_chain(cert_path, restrictions, certstores);
 
-   if(!hostname.empty() && !cert_path[0].matches_dns_name(hostname))
+   if(!hostname.empty() && !cert_path[0]->matches_dns_name(hostname))
       res[0].insert(Certificate_Status_Code::CERT_NAME_NOMATCH);
 
-   if(!cert_path[0].allowed_usage(usage))
+   if(!cert_path[0]->allowed_usage(usage))
       res[0].insert(Certificate_Status_Code::INVALID_USAGE);
 
    return Path_Validation_Result(res, std::move(cert_path));
@@ -321,7 +325,7 @@ Path_Validation_Restrictions::Path_Validation_Restrictions(bool require_rev,
    }
 
 Path_Validation_Result::Path_Validation_Result(std::vector<std::set<Certificate_Status_Code>> status,
-                                               std::vector<X509_Certificate>&& cert_chain) :
+                                               std::vector<std::shared_ptr<const X509_Certificate>>&& cert_chain) :
    m_overall(Certificate_Status_Code::VERIFIED),
    m_all_status(status),
    m_cert_path(cert_chain)
@@ -346,14 +350,14 @@ const X509_Certificate& Path_Validation_Result::trust_root() const
    if(result() != Certificate_Status_Code::VERIFIED)
       throw Exception("Path_Validation_Result::trust_root meaningless with invalid status");
 
-   return m_cert_path[m_cert_path.size()-1];
+   return *m_cert_path[m_cert_path.size()-1];
    }
 
 std::set<std::string> Path_Validation_Result::trusted_hashes() const
    {
    std::set<std::string> hashes;
    for(size_t i = 0; i != m_cert_path.size(); ++i)
-      hashes.insert(m_cert_path[i].hash_used_for_signature());
+      hashes.insert(m_cert_path[i]->hash_used_for_signature());
    return hashes;
    }
 
diff --git a/src/lib/cert/x509/x509path.h b/src/lib/cert/x509/x509path.h
index b7061685a..60b7fa1a2 100644
--- a/src/lib/cert/x509/x509path.h
+++ b/src/lib/cert/x509/x509path.h
@@ -92,7 +92,7 @@ class BOTAN_DLL Path_Validation_Result
       /**
       * @return the full path from subject to trust root
       */
-      const std::vector<X509_Certificate>& cert_path() const { return m_cert_path; }
+      const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path() const { return m_cert_path; }
 
       /**
       * @return true iff the validation was successful
@@ -118,7 +118,7 @@ class BOTAN_DLL Path_Validation_Result
       static const char* status_string(Certificate_Status_Code code);
 
       Path_Validation_Result(std::vector<std::set<Certificate_Status_Code>> status,
-                             std::vector<X509_Certificate>&& cert_chain);
+                             std::vector<std::shared_ptr<const X509_Certificate>>&& cert_chain);
 
       explicit Path_Validation_Result(Certificate_Status_Code status) : m_overall(status) {}
 
@@ -130,7 +130,7 @@ class BOTAN_DLL Path_Validation_Result
 
       Certificate_Status_Code m_overall;
       std::vector<std::set<Certificate_Status_Code>> m_all_status;
-      std::vector<X509_Certificate> m_cert_path;
+      std::vector<std::shared_ptr<const X509_Certificate>> m_cert_path;
    };
 
 
diff --git a/src/lib/utils/database.h b/src/lib/utils/database.h
index 4cc0989b1..0cd45dac0 100644
--- a/src/lib/utils/database.h
+++ b/src/lib/utils/database.h
@@ -38,6 +38,8 @@ class BOTAN_DLL SQL_Database
 
             virtual void bind(int column, const std::vector<byte>& blob) = 0;
 
+            virtual void bind(int column, const byte* data, size_t len) = 0;
+
             /* Get output */
             virtual std::pair<const byte*, size_t> get_blob(int column) = 0;
 
diff --git a/src/lib/utils/sqlite3/sqlite3.cpp b/src/lib/utils/sqlite3/sqlite3.cpp
index 77b4c0d10..251cbcdf5 100644
--- a/src/lib/utils/sqlite3/sqlite3.cpp
+++ b/src/lib/utils/sqlite3/sqlite3.cpp
@@ -99,6 +99,13 @@ void Sqlite3_Database::Sqlite3_Statement::bind(int column, const std::vector<byt
       throw SQL_DB_Error("sqlite3_bind_text failed, code " + std::to_string(rc));
    }
 
+void Sqlite3_Database::Sqlite3_Statement::bind(int column, const byte* p, size_t len)
+   {
+   int rc = ::sqlite3_bind_blob(m_stmt, column, p, len, SQLITE_TRANSIENT);
+   if(rc != SQLITE_OK)
+      throw SQL_DB_Error("sqlite3_bind_text failed, code " + std::to_string(rc));
+   }
+
 std::pair<const byte*, size_t> Sqlite3_Database::Sqlite3_Statement::get_blob(int column)
    {
    BOTAN_ASSERT(::sqlite3_column_type(m_stmt, 0) == SQLITE_BLOB,
diff --git a/src/lib/utils/sqlite3/sqlite3.h b/src/lib/utils/sqlite3/sqlite3.h
index 067b94e85..659e1c487 100644
--- a/src/lib/utils/sqlite3/sqlite3.h
+++ b/src/lib/utils/sqlite3/sqlite3.h
@@ -35,6 +35,7 @@ class BOTAN_DLL Sqlite3_Database  : public SQL_Database
             void bind(int column, size_t val) override;
             void bind(int column, std::chrono::system_clock::time_point time) override;
             void bind(int column, const std::vector<byte>& val) override;
+            void bind(int column, const byte* data, size_t len) override;
 
             std::pair<const byte*, size_t> get_blob(int column) override;
             size_t get_size_t(int column) override;