使用Golang解析CRL中的IDP扩展信息

你的代码在解析nameRelativeToCRLIssuer类型的DistributionPoint时遇到了ASN.1序列标签不匹配的问题。问题在于parseRDN函数期望接收一个完整的RDN序列，但实际传入的是经过ASN.1编码的RelativeDistinguishedName结构。

以下是修复后的parseRDN函数和相关的解析逻辑：

func parseRDN(data []byte) (string, error) {
	var builder strings.Builder
	
	// 直接解析为pkix.AttributeTypeAndValue序列
	var atvs []pkix.AttributeTypeAndValue
	if _, err := asn1.Unmarshal(data, &atvs); err != nil {
		return "", fmt.Errorf("failed to parse RDN sequence: %v", err)
	}

	for i, atv := range atvs {
		builder.WriteString(fmt.Sprintf("RDN[%d]:\n", i+1))
		oid := atv.Type.String()
		name := oidMap[oid]
		if name == "" {
			name = oid
		}

		value, err := decodeAttributeValue(atv.Value)
		if err != nil {
			return "", fmt.Errorf("failed to decode attribute value: %v", err)
		}

		if name == "DC" {
			if decoded, err := decodeDomainComponent(value); err == nil {
				value = decoded
			}
		}

		builder.WriteString(fmt.Sprintf("  Type:%-8s Value:%s\n", name, value))
	}
	return builder.String(), nil
}

// 修改main函数中解析nameRelativeToCRLIssuer的部分
if dpName.Tag == 1 { // nameRelativeToCRLIssuer
	fmt.Println("Distribution Point Type: nameRelativeToCRLIssuer")
	
	// nameRelativeToCRLIssuer是RelativeDistinguishedName类型
	// 需要直接解析为RDN序列
	result, err := parseRDN(dpName.Bytes)
	if err != nil {
		fmt.Printf("Failed to parse RDN: %v\n", err)
		continue
	}
	fmt.Println(result)
}

另外，你的parseGeneralName函数在处理directoryName（tag 4）时也有问题。需要添加对directoryName的支持：

func parseGeneralName(gn asn1.RawValue) (interface{}, error) {
	if gn.Class == asn1.ClassContextSpecific {
		switch gn.Tag {
		case 0: // otherName
			return fmt.Sprintf("otherName: %X", gn.Bytes), nil
		case 1: // rfc822Name
			return fmt.Sprintf("rfc822Name: %s", string(gn.Bytes)), nil
		case 2: // dNSName
			return fmt.Sprintf("dNSName: %s", string(gn.Bytes)), nil
		case 4: // directoryName
			// directoryName是Name类型，需要特殊处理
			return parseRDN(gn.Bytes)
		case 6: // uniformResourceIdentifier
			return fmt.Sprintf("URI: %s", string(gn.Bytes)), nil
		case 7: // iPAddress
			return fmt.Sprintf("IP: %X", gn.Bytes), nil
		case 8: // registeredID
			var oid asn1.ObjectIdentifier
			if _, err := asn1.Unmarshal(gn.Bytes, &oid); err != nil {
				return nil, fmt.Errorf("failed to parse registeredID: %v", err)
			}
			return fmt.Sprintf("registeredID: %s", oid.String()), nil
		}
	}

	return nil, fmt.Errorf("unsupported GeneralName type: tag=%d class=%d", gn.Tag, gn.Class)
}

对于你提供的CRL数据，IDP扩展可能不包含DistributionPoint字段。你可以添加一个检查来避免空指针错误：

if idp.DistributionPoint.FullBytes != nil {
	// 现有的解析逻辑
}

完整的修复示例：

package main

import (
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"encoding/hex"
	"flag"
	"fmt"
	"os"
	"strings"
)

type IssuingDistributionPoint struct {
	DistributionPoint          asn1.RawValue  `asn1:"optional,tag:0"`
	OnlyContainsUserCerts      bool           `asn1:"optional,tag:1"`
	OnlyContainsCACerts        bool           `asn1:"optional,tag:2"`
	OnlySomeReasons            asn1.BitString `asn1:"optional,tag:3"`
	IndirectCRL                bool           `asn1:"optional,tag:4"`
	OnlyContainsAttributeCerts bool           `asn1:"optional,tag:5"`
}

var oidMap = map[string]string{
	"2.5.4.3":  "CN",
	"2.5.4.6":  "C",
	"2.5.4.10": "O",
	"2.5.4.11": "OU",
	"1.2.840.113549.1.9.1":       "E",
	"0.9.2342.19200300.100.1.25": "DC",
	"0.9.2342.19200300.100.1.1":  "UID",
}

func parseRDN(data []byte) (string, error) {
	var builder strings.Builder
	
	var atvs []pkix.AttributeTypeAndValue
	if _, err := asn1.Unmarshal(data, &atvs); err != nil {
		return "", fmt.Errorf("failed to parse RDN sequence: %v", err)
	}

	for i, atv := range atvs {
		builder.WriteString(fmt.Sprintf("RDN[%d]:\n", i+1))
		oid := atv.Type.String()
		name := oidMap[oid]
		if name == "" {
			name = oid
		}

		value, err := decodeAttributeValue(atv.Value)
		if err != nil {
			return "", fmt.Errorf("failed to decode attribute value: %v", err)
		}

		if name == "DC" {
			if decoded, err := decodeDomainComponent(value); err == nil {
				value = decoded
			}
		}

		builder.WriteString(fmt.Sprintf("  Type:%-8s Value:%s\n", name, value))
	}
	return builder.String(), nil
}

func decodeAttributeValue(raw interface{}) (string, error) {
	switch v := raw.(type) {
	case string:
		return v, nil
	case []byte:
		if isPrintable(string(v)) {
			return string(v), nil
		}
		return fmt.Sprintf("#%X", v), nil
	default:
		return fmt.Sprintf("%v", v), nil
	}
}

func decodeDomainComponent(value string) (string, error) {
	if strings.HasPrefix(value, "#") {
		decoded, err := hex.DecodeString(value[1:])
		if err != nil {
			return "", fmt.Errorf("HEX decoding failed: %v", err)
		}
		return string(decoded), nil
	}
	return value, nil
}

func isPrintable(s string) bool {
	for _, r := range s {
		if r < 32 || r > 126 {
			return false
		}
	}
	return true
}

func parseGeneralName(gn asn1.RawValue) (interface{}, error) {
	if gn.Class == asn1.ClassContextSpecific {
		switch gn.Tag {
		case 0:
			return fmt.Sprintf("otherName: %X", gn.Bytes), nil
		case 1:
			return fmt.Sprintf("rfc822Name: %s", string(gn.Bytes)), nil
		case 2:
			return fmt.Sprintf("dNSName: %s", string(gn.Bytes)), nil
		case 4:
			return parseRDN(gn.Bytes)
		case 6:
			return fmt.Sprintf("URI: %s", string(gn.Bytes)), nil
		case 7:
			return fmt.Sprintf("IP: %X", gn.Bytes), nil
		case 8:
			var oid asn1.ObjectIdentifier
			if _, err := asn1.Unmarshal(gn.Bytes, &oid); err != nil {
				return nil, fmt.Errorf("failed to parse registeredID: %v", err)
			}
			return fmt.Sprintf("registeredID: %s", oid.String()), nil
		}
	}

	return nil, fmt.Errorf("unsupported GeneralName type: tag=%d class=%d", gn.Tag, gn.Class)
}

func main() {
	crlFilePath := flag.String("crl", "", "Path to the CRL file")
	flag.Parse()

	if *crlFilePath == "" {
		fmt.Println("CRL file path must be provided")
		os.Exit(1)
	}

	derBytes, err := os.ReadFile(*crlFilePath)
	if err != nil {
		fmt.Printf("Failed to read file: %v\n", err)
		os.Exit(1)
	}

	crl, err := x509.ParseRevocationList(derBytes)
	if err != nil {
		fmt.Printf("Failed to parse CRL: %v\n", err)
		os.Exit(1)
	}

	oidIssuingDistributionPoint := asn1.ObjectIdentifier{2, 5, 29, 28}

	for _, ext := range crl.Extensions {
		if ext.Id.Equal(oidIssuingDistributionPoint) {
			var idp IssuingDistributionPoint
			if _, err := asn1.Unmarshal(ext.Value, &idp); err != nil {
				fmt.Printf("Failed to decode IDP extension: %v\n", err)
				continue
			}

			fmt.Printf("IDP Extension Flags:\n")
			fmt.Printf(" Only Contains User Certs: %t\n", idp.OnlyContainsUserCerts)
			fmt.Printf(" Only Contains CA Certs: %t\n", idp.OnlyContainsCACerts)
			fmt.Printf(" Indirect CRL: %t\n", idp.IndirectCRL)

			if len(idp.DistributionPoint.Bytes) > 0 {
				var dpName asn1.RawValue
				if _, err := asn1.Unmarshal(idp.DistributionPoint.Bytes, &dpName); err != nil {
					fmt.Printf("Failed to unpack DistributionPointName: %v\n", err)
					continue
				}

				if dpName.Class == asn1.ClassContextSpecific {
					switch dpName.Tag {
					case 0:
						fmt.Println("Distribution Point Type: fullName")
						var generalNames []asn1.RawValue
						if _, err := asn1.Unmarshal(dpName.Bytes, &generalNames); err != nil {
							fmt.Printf("Failed to parse GeneralNames: %v\n", err)
							continue
						}

						for i, gn := range generalNames {
							result, err := parseGeneralName(gn)
							if err != nil {
								fmt.Printf("[Entry %d] Parsing error: %v\n", i+1, err)
								continue
							}
							fmt.Printf("[Entry %d] Distribution Point: %s\n", i+1, result)
						}

					case 1:
						fmt.Println("Distribution Point Type: nameRelativeToCRLIssuer")
						result, err := parseRDN(dpName.Bytes)
						if err != nil {
							fmt.Printf("Failed to parse RDN: %v\n", err)
							continue
						}
						fmt.Println(result)

					default:
						fmt.Printf("Unknown distribution point tag: %d\n", dpName.Tag)
					}
				}
			}
		}
	}
}

主要修改：

1. 简化了parseRDN函数，直接解析为pkix.AttributeTypeAndValue序列
2. 修复了parseGeneralName函数对directoryName（tag 4）的支持
3. 移除了IssuingDistributionPoint结构体标签中的explicit标记，因为IDP扩展使用隐式标签