[331] | 1 | /*
|
---|
| 2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | #include <stdio.h>
|
---|
| 11 | #include "internal/cryptlib.h"
|
---|
| 12 | #include <openssl/lhash.h>
|
---|
| 13 | #include <openssl/x509.h>
|
---|
| 14 | #include "internal/x509_int.h"
|
---|
| 15 | #include <openssl/x509v3.h>
|
---|
| 16 | #include "x509_lcl.h"
|
---|
| 17 |
|
---|
| 18 | X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
|
---|
| 19 | {
|
---|
| 20 | X509_LOOKUP *ret;
|
---|
| 21 |
|
---|
| 22 | ret = OPENSSL_zalloc(sizeof(*ret));
|
---|
| 23 | if (ret == NULL)
|
---|
| 24 | return NULL;
|
---|
| 25 |
|
---|
| 26 | ret->method = method;
|
---|
| 27 | if ((method->new_item != NULL) && !method->new_item(ret)) {
|
---|
| 28 | OPENSSL_free(ret);
|
---|
| 29 | return NULL;
|
---|
| 30 | }
|
---|
| 31 | return ret;
|
---|
| 32 | }
|
---|
| 33 |
|
---|
| 34 | void X509_LOOKUP_free(X509_LOOKUP *ctx)
|
---|
| 35 | {
|
---|
| 36 | if (ctx == NULL)
|
---|
| 37 | return;
|
---|
| 38 | if ((ctx->method != NULL) && (ctx->method->free != NULL))
|
---|
| 39 | (*ctx->method->free) (ctx);
|
---|
| 40 | OPENSSL_free(ctx);
|
---|
| 41 | }
|
---|
| 42 |
|
---|
| 43 | int X509_STORE_lock(X509_STORE *s)
|
---|
| 44 | {
|
---|
| 45 | return CRYPTO_THREAD_write_lock(s->lock);
|
---|
| 46 | }
|
---|
| 47 |
|
---|
| 48 | int X509_STORE_unlock(X509_STORE *s)
|
---|
| 49 | {
|
---|
| 50 | return CRYPTO_THREAD_unlock(s->lock);
|
---|
| 51 | }
|
---|
| 52 |
|
---|
| 53 | int X509_LOOKUP_init(X509_LOOKUP *ctx)
|
---|
| 54 | {
|
---|
| 55 | if (ctx->method == NULL)
|
---|
| 56 | return 0;
|
---|
| 57 | if (ctx->method->init != NULL)
|
---|
| 58 | return ctx->method->init(ctx);
|
---|
| 59 | else
|
---|
| 60 | return 1;
|
---|
| 61 | }
|
---|
| 62 |
|
---|
| 63 | int X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
|
---|
| 64 | {
|
---|
| 65 | if (ctx->method == NULL)
|
---|
| 66 | return 0;
|
---|
| 67 | if (ctx->method->shutdown != NULL)
|
---|
| 68 | return ctx->method->shutdown(ctx);
|
---|
| 69 | else
|
---|
| 70 | return 1;
|
---|
| 71 | }
|
---|
| 72 |
|
---|
| 73 | int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
|
---|
| 74 | char **ret)
|
---|
| 75 | {
|
---|
| 76 | if (ctx->method == NULL)
|
---|
| 77 | return -1;
|
---|
| 78 | if (ctx->method->ctrl != NULL)
|
---|
| 79 | return ctx->method->ctrl(ctx, cmd, argc, argl, ret);
|
---|
| 80 | else
|
---|
| 81 | return 1;
|
---|
| 82 | }
|
---|
| 83 |
|
---|
| 84 | int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
|
---|
| 85 | X509_NAME *name, X509_OBJECT *ret)
|
---|
| 86 | {
|
---|
| 87 | if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
|
---|
| 88 | return 0;
|
---|
| 89 | if (ctx->skip)
|
---|
| 90 | return 0;
|
---|
| 91 | return ctx->method->get_by_subject(ctx, type, name, ret);
|
---|
| 92 | }
|
---|
| 93 |
|
---|
| 94 | int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
|
---|
| 95 | X509_NAME *name, ASN1_INTEGER *serial,
|
---|
| 96 | X509_OBJECT *ret)
|
---|
| 97 | {
|
---|
| 98 | if ((ctx->method == NULL) || (ctx->method->get_by_issuer_serial == NULL))
|
---|
| 99 | return 0;
|
---|
| 100 | return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret);
|
---|
| 101 | }
|
---|
| 102 |
|
---|
| 103 | int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
|
---|
| 104 | const unsigned char *bytes, int len,
|
---|
| 105 | X509_OBJECT *ret)
|
---|
| 106 | {
|
---|
| 107 | if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL))
|
---|
| 108 | return 0;
|
---|
| 109 | return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret);
|
---|
| 110 | }
|
---|
| 111 |
|
---|
| 112 | int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
|
---|
| 113 | const char *str, int len, X509_OBJECT *ret)
|
---|
| 114 | {
|
---|
| 115 | if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL))
|
---|
| 116 | return 0;
|
---|
| 117 | return ctx->method->get_by_alias(ctx, type, str, len, ret);
|
---|
| 118 | }
|
---|
| 119 |
|
---|
| 120 | static int x509_object_cmp(const X509_OBJECT *const *a,
|
---|
| 121 | const X509_OBJECT *const *b)
|
---|
| 122 | {
|
---|
| 123 | int ret;
|
---|
| 124 |
|
---|
| 125 | ret = ((*a)->type - (*b)->type);
|
---|
| 126 | if (ret)
|
---|
| 127 | return ret;
|
---|
| 128 | switch ((*a)->type) {
|
---|
| 129 | case X509_LU_X509:
|
---|
| 130 | ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);
|
---|
| 131 | break;
|
---|
| 132 | case X509_LU_CRL:
|
---|
| 133 | ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);
|
---|
| 134 | break;
|
---|
| 135 | default:
|
---|
| 136 | /* abort(); */
|
---|
| 137 | return 0;
|
---|
| 138 | }
|
---|
| 139 | return ret;
|
---|
| 140 | }
|
---|
| 141 |
|
---|
| 142 | X509_STORE *X509_STORE_new(void)
|
---|
| 143 | {
|
---|
| 144 | X509_STORE *ret;
|
---|
| 145 |
|
---|
| 146 | if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)
|
---|
| 147 | return NULL;
|
---|
| 148 | if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL)
|
---|
| 149 | goto err;
|
---|
| 150 | ret->cache = 1;
|
---|
| 151 | if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL)
|
---|
| 152 | goto err;
|
---|
| 153 |
|
---|
| 154 | if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
|
---|
| 155 | goto err;
|
---|
| 156 |
|
---|
| 157 | if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
|
---|
| 158 | goto err;
|
---|
| 159 |
|
---|
| 160 | ret->lock = CRYPTO_THREAD_lock_new();
|
---|
| 161 | if (ret->lock == NULL)
|
---|
| 162 | goto err;
|
---|
| 163 |
|
---|
| 164 | ret->references = 1;
|
---|
| 165 | return ret;
|
---|
| 166 |
|
---|
| 167 | err:
|
---|
| 168 | X509_VERIFY_PARAM_free(ret->param);
|
---|
| 169 | sk_X509_OBJECT_free(ret->objs);
|
---|
| 170 | sk_X509_LOOKUP_free(ret->get_cert_methods);
|
---|
| 171 | OPENSSL_free(ret);
|
---|
| 172 | return NULL;
|
---|
| 173 | }
|
---|
| 174 |
|
---|
| 175 | static void cleanup(X509_OBJECT *a)
|
---|
| 176 | {
|
---|
| 177 | if (!a)
|
---|
| 178 | return;
|
---|
| 179 | if (a->type == X509_LU_X509) {
|
---|
| 180 | X509_free(a->data.x509);
|
---|
| 181 | } else if (a->type == X509_LU_CRL) {
|
---|
| 182 | X509_CRL_free(a->data.crl);
|
---|
| 183 | } else {
|
---|
| 184 | /* abort(); */
|
---|
| 185 | }
|
---|
| 186 |
|
---|
| 187 | OPENSSL_free(a);
|
---|
| 188 | }
|
---|
| 189 |
|
---|
| 190 | void X509_STORE_free(X509_STORE *vfy)
|
---|
| 191 | {
|
---|
| 192 | int i;
|
---|
| 193 | STACK_OF(X509_LOOKUP) *sk;
|
---|
| 194 | X509_LOOKUP *lu;
|
---|
| 195 |
|
---|
| 196 | if (vfy == NULL)
|
---|
| 197 | return;
|
---|
| 198 |
|
---|
| 199 | CRYPTO_atomic_add(&vfy->references, -1, &i, vfy->lock);
|
---|
| 200 | REF_PRINT_COUNT("X509_STORE", vfy);
|
---|
| 201 | if (i > 0)
|
---|
| 202 | return;
|
---|
| 203 | REF_ASSERT_ISNT(i < 0);
|
---|
| 204 |
|
---|
| 205 | sk = vfy->get_cert_methods;
|
---|
| 206 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
|
---|
| 207 | lu = sk_X509_LOOKUP_value(sk, i);
|
---|
| 208 | X509_LOOKUP_shutdown(lu);
|
---|
| 209 | X509_LOOKUP_free(lu);
|
---|
| 210 | }
|
---|
| 211 | sk_X509_LOOKUP_free(sk);
|
---|
| 212 | sk_X509_OBJECT_pop_free(vfy->objs, cleanup);
|
---|
| 213 |
|
---|
| 214 | CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
|
---|
| 215 | X509_VERIFY_PARAM_free(vfy->param);
|
---|
| 216 | CRYPTO_THREAD_lock_free(vfy->lock);
|
---|
| 217 | OPENSSL_free(vfy);
|
---|
| 218 | }
|
---|
| 219 |
|
---|
| 220 | int X509_STORE_up_ref(X509_STORE *vfy)
|
---|
| 221 | {
|
---|
| 222 | int i;
|
---|
| 223 |
|
---|
| 224 | if (CRYPTO_atomic_add(&vfy->references, 1, &i, vfy->lock) <= 0)
|
---|
| 225 | return 0;
|
---|
| 226 |
|
---|
| 227 | REF_PRINT_COUNT("X509_STORE", a);
|
---|
| 228 | REF_ASSERT_ISNT(i < 2);
|
---|
| 229 | return ((i > 1) ? 1 : 0);
|
---|
| 230 | }
|
---|
| 231 |
|
---|
| 232 | X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
|
---|
| 233 | {
|
---|
| 234 | int i;
|
---|
| 235 | STACK_OF(X509_LOOKUP) *sk;
|
---|
| 236 | X509_LOOKUP *lu;
|
---|
| 237 |
|
---|
| 238 | sk = v->get_cert_methods;
|
---|
| 239 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
|
---|
| 240 | lu = sk_X509_LOOKUP_value(sk, i);
|
---|
| 241 | if (m == lu->method) {
|
---|
| 242 | return lu;
|
---|
| 243 | }
|
---|
| 244 | }
|
---|
| 245 | /* a new one */
|
---|
| 246 | lu = X509_LOOKUP_new(m);
|
---|
| 247 | if (lu == NULL)
|
---|
| 248 | return NULL;
|
---|
| 249 | else {
|
---|
| 250 | lu->store_ctx = v;
|
---|
| 251 | if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))
|
---|
| 252 | return lu;
|
---|
| 253 | else {
|
---|
| 254 | X509_LOOKUP_free(lu);
|
---|
| 255 | return NULL;
|
---|
| 256 | }
|
---|
| 257 | }
|
---|
| 258 | }
|
---|
| 259 |
|
---|
| 260 | X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs,
|
---|
| 261 | X509_LOOKUP_TYPE type,
|
---|
| 262 | X509_NAME *name)
|
---|
| 263 | {
|
---|
| 264 | X509_OBJECT *ret = X509_OBJECT_new();
|
---|
| 265 |
|
---|
| 266 | if (ret == NULL)
|
---|
| 267 | return NULL;
|
---|
| 268 | if (!X509_STORE_CTX_get_by_subject(vs, type, name, ret)) {
|
---|
| 269 | X509_OBJECT_free(ret);
|
---|
| 270 | return NULL;
|
---|
| 271 | }
|
---|
| 272 | return ret;
|
---|
| 273 | }
|
---|
| 274 |
|
---|
| 275 | int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type,
|
---|
| 276 | X509_NAME *name, X509_OBJECT *ret)
|
---|
| 277 | {
|
---|
| 278 | X509_STORE *ctx = vs->ctx;
|
---|
| 279 | X509_LOOKUP *lu;
|
---|
| 280 | X509_OBJECT stmp, *tmp;
|
---|
| 281 | int i, j;
|
---|
| 282 |
|
---|
| 283 | CRYPTO_THREAD_write_lock(ctx->lock);
|
---|
| 284 | tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
|
---|
| 285 | CRYPTO_THREAD_unlock(ctx->lock);
|
---|
| 286 |
|
---|
| 287 | if (tmp == NULL || type == X509_LU_CRL) {
|
---|
| 288 | for (i = 0; i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
|
---|
| 289 | lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
|
---|
| 290 | j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
|
---|
| 291 | if (j) {
|
---|
| 292 | tmp = &stmp;
|
---|
| 293 | break;
|
---|
| 294 | }
|
---|
| 295 | }
|
---|
| 296 | if (tmp == NULL)
|
---|
| 297 | return 0;
|
---|
| 298 | }
|
---|
| 299 |
|
---|
| 300 | ret->type = tmp->type;
|
---|
| 301 | ret->data.ptr = tmp->data.ptr;
|
---|
| 302 |
|
---|
| 303 | X509_OBJECT_up_ref_count(ret);
|
---|
| 304 |
|
---|
| 305 | return 1;
|
---|
| 306 | }
|
---|
| 307 |
|
---|
| 308 | int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
|
---|
| 309 | {
|
---|
| 310 | X509_OBJECT *obj;
|
---|
| 311 | int ret = 1, added = 1;
|
---|
| 312 |
|
---|
| 313 | if (x == NULL)
|
---|
| 314 | return 0;
|
---|
| 315 | obj = X509_OBJECT_new();
|
---|
| 316 | if (obj == NULL)
|
---|
| 317 | return 0;
|
---|
| 318 | obj->type = X509_LU_X509;
|
---|
| 319 | obj->data.x509 = x;
|
---|
| 320 | X509_OBJECT_up_ref_count(obj);
|
---|
| 321 |
|
---|
| 322 | CRYPTO_THREAD_write_lock(ctx->lock);
|
---|
| 323 |
|
---|
| 324 | if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
|
---|
| 325 | X509err(X509_F_X509_STORE_ADD_CERT,
|
---|
| 326 | X509_R_CERT_ALREADY_IN_HASH_TABLE);
|
---|
| 327 | ret = 0;
|
---|
| 328 | } else {
|
---|
| 329 | added = sk_X509_OBJECT_push(ctx->objs, obj);
|
---|
| 330 | ret = added != 0;
|
---|
| 331 | }
|
---|
| 332 |
|
---|
| 333 | CRYPTO_THREAD_unlock(ctx->lock);
|
---|
| 334 |
|
---|
| 335 | if (!ret) /* obj not pushed */
|
---|
| 336 | X509_OBJECT_free(obj);
|
---|
| 337 | if (!added) /* on push failure */
|
---|
| 338 | X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
|
---|
| 339 |
|
---|
| 340 | return ret;
|
---|
| 341 | }
|
---|
| 342 |
|
---|
| 343 | int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
|
---|
| 344 | {
|
---|
| 345 | X509_OBJECT *obj;
|
---|
| 346 | int ret = 1, added = 1;
|
---|
| 347 |
|
---|
| 348 | if (x == NULL)
|
---|
| 349 | return 0;
|
---|
| 350 | obj = X509_OBJECT_new();
|
---|
| 351 | if (obj == NULL)
|
---|
| 352 | return 0;
|
---|
| 353 | obj->type = X509_LU_CRL;
|
---|
| 354 | obj->data.crl = x;
|
---|
| 355 | X509_OBJECT_up_ref_count(obj);
|
---|
| 356 |
|
---|
| 357 | CRYPTO_THREAD_write_lock(ctx->lock);
|
---|
| 358 |
|
---|
| 359 | if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
|
---|
| 360 | X509err(X509_F_X509_STORE_ADD_CRL, X509_R_CERT_ALREADY_IN_HASH_TABLE);
|
---|
| 361 | ret = 0;
|
---|
| 362 | } else {
|
---|
| 363 | added = sk_X509_OBJECT_push(ctx->objs, obj);
|
---|
| 364 | ret = added != 0;
|
---|
| 365 | }
|
---|
| 366 |
|
---|
| 367 | CRYPTO_THREAD_unlock(ctx->lock);
|
---|
| 368 |
|
---|
| 369 | if (!ret) /* obj not pushed */
|
---|
| 370 | X509_OBJECT_free(obj);
|
---|
| 371 | if (!added) /* on push failure */
|
---|
| 372 | X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
|
---|
| 373 |
|
---|
| 374 | return ret;
|
---|
| 375 | }
|
---|
| 376 |
|
---|
| 377 | int X509_OBJECT_up_ref_count(X509_OBJECT *a)
|
---|
| 378 | {
|
---|
| 379 | switch (a->type) {
|
---|
| 380 | default:
|
---|
| 381 | break;
|
---|
| 382 | case X509_LU_X509:
|
---|
| 383 | return X509_up_ref(a->data.x509);
|
---|
| 384 | case X509_LU_CRL:
|
---|
| 385 | return X509_CRL_up_ref(a->data.crl);
|
---|
| 386 | }
|
---|
| 387 | return 1;
|
---|
| 388 | }
|
---|
| 389 |
|
---|
| 390 | X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a)
|
---|
| 391 | {
|
---|
| 392 | if (a == NULL || a->type != X509_LU_X509)
|
---|
| 393 | return NULL;
|
---|
| 394 | return a->data.x509;
|
---|
| 395 | }
|
---|
| 396 |
|
---|
| 397 | X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *a)
|
---|
| 398 | {
|
---|
| 399 | if (a == NULL || a->type != X509_LU_CRL)
|
---|
| 400 | return NULL;
|
---|
| 401 | return a->data.crl;
|
---|
| 402 | }
|
---|
| 403 |
|
---|
| 404 | X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a)
|
---|
| 405 | {
|
---|
| 406 | return a->type;
|
---|
| 407 | }
|
---|
| 408 |
|
---|
| 409 | X509_OBJECT *X509_OBJECT_new()
|
---|
| 410 | {
|
---|
| 411 | X509_OBJECT *ret = OPENSSL_zalloc(sizeof(*ret));
|
---|
| 412 |
|
---|
| 413 | if (ret == NULL) {
|
---|
| 414 | X509err(X509_F_X509_OBJECT_NEW, ERR_R_MALLOC_FAILURE);
|
---|
| 415 | return NULL;
|
---|
| 416 | }
|
---|
| 417 | ret->type = X509_LU_NONE;
|
---|
| 418 | return ret;
|
---|
| 419 | }
|
---|
| 420 |
|
---|
| 421 |
|
---|
| 422 | void X509_OBJECT_free(X509_OBJECT *a)
|
---|
| 423 | {
|
---|
| 424 | if (a == NULL)
|
---|
| 425 | return;
|
---|
| 426 | switch (a->type) {
|
---|
| 427 | default:
|
---|
| 428 | break;
|
---|
| 429 | case X509_LU_X509:
|
---|
| 430 | X509_free(a->data.x509);
|
---|
| 431 | break;
|
---|
| 432 | case X509_LU_CRL:
|
---|
| 433 | X509_CRL_free(a->data.crl);
|
---|
| 434 | break;
|
---|
| 435 | }
|
---|
| 436 | OPENSSL_free(a);
|
---|
| 437 | }
|
---|
| 438 |
|
---|
| 439 | static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type,
|
---|
| 440 | X509_NAME *name, int *pnmatch)
|
---|
| 441 | {
|
---|
| 442 | X509_OBJECT stmp;
|
---|
| 443 | X509 x509_s;
|
---|
| 444 | X509_CRL crl_s;
|
---|
| 445 | int idx;
|
---|
| 446 |
|
---|
| 447 | stmp.type = type;
|
---|
| 448 | switch (type) {
|
---|
| 449 | case X509_LU_X509:
|
---|
| 450 | stmp.data.x509 = &x509_s;
|
---|
| 451 | x509_s.cert_info.subject = name;
|
---|
| 452 | break;
|
---|
| 453 | case X509_LU_CRL:
|
---|
| 454 | stmp.data.crl = &crl_s;
|
---|
| 455 | crl_s.crl.issuer = name;
|
---|
| 456 | break;
|
---|
| 457 | default:
|
---|
| 458 | /* abort(); */
|
---|
| 459 | return -1;
|
---|
| 460 | }
|
---|
| 461 |
|
---|
| 462 | idx = sk_X509_OBJECT_find(h, &stmp);
|
---|
| 463 | if (idx >= 0 && pnmatch) {
|
---|
| 464 | int tidx;
|
---|
| 465 | const X509_OBJECT *tobj, *pstmp;
|
---|
| 466 | *pnmatch = 1;
|
---|
| 467 | pstmp = &stmp;
|
---|
| 468 | for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
|
---|
| 469 | tobj = sk_X509_OBJECT_value(h, tidx);
|
---|
| 470 | if (x509_object_cmp(&tobj, &pstmp))
|
---|
| 471 | break;
|
---|
| 472 | (*pnmatch)++;
|
---|
| 473 | }
|
---|
| 474 | }
|
---|
| 475 | return idx;
|
---|
| 476 | }
|
---|
| 477 |
|
---|
| 478 | int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type,
|
---|
| 479 | X509_NAME *name)
|
---|
| 480 | {
|
---|
| 481 | return x509_object_idx_cnt(h, type, name, NULL);
|
---|
| 482 | }
|
---|
| 483 |
|
---|
| 484 | X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
|
---|
| 485 | X509_LOOKUP_TYPE type,
|
---|
| 486 | X509_NAME *name)
|
---|
| 487 | {
|
---|
| 488 | int idx;
|
---|
| 489 | idx = X509_OBJECT_idx_by_subject(h, type, name);
|
---|
| 490 | if (idx == -1)
|
---|
| 491 | return NULL;
|
---|
| 492 | return sk_X509_OBJECT_value(h, idx);
|
---|
| 493 | }
|
---|
| 494 |
|
---|
| 495 | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v)
|
---|
| 496 | {
|
---|
| 497 | return v->objs;
|
---|
| 498 | }
|
---|
| 499 |
|
---|
| 500 | STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
|
---|
| 501 | {
|
---|
| 502 | int i, idx, cnt;
|
---|
| 503 | STACK_OF(X509) *sk = NULL;
|
---|
| 504 | X509 *x;
|
---|
| 505 | X509_OBJECT *obj;
|
---|
| 506 |
|
---|
| 507 | CRYPTO_THREAD_write_lock(ctx->ctx->lock);
|
---|
| 508 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
|
---|
| 509 | if (idx < 0) {
|
---|
| 510 | /*
|
---|
| 511 | * Nothing found in cache: do lookup to possibly add new objects to
|
---|
| 512 | * cache
|
---|
| 513 | */
|
---|
| 514 | X509_OBJECT *xobj = X509_OBJECT_new();
|
---|
| 515 |
|
---|
| 516 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 517 | if (xobj == NULL)
|
---|
| 518 | return NULL;
|
---|
| 519 | if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, nm, xobj)) {
|
---|
| 520 | X509_OBJECT_free(xobj);
|
---|
| 521 | return NULL;
|
---|
| 522 | }
|
---|
| 523 | X509_OBJECT_free(xobj);
|
---|
| 524 | CRYPTO_THREAD_write_lock(ctx->ctx->lock);
|
---|
| 525 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
|
---|
| 526 | if (idx < 0) {
|
---|
| 527 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 528 | return NULL;
|
---|
| 529 | }
|
---|
| 530 | }
|
---|
| 531 |
|
---|
| 532 | sk = sk_X509_new_null();
|
---|
| 533 | for (i = 0; i < cnt; i++, idx++) {
|
---|
| 534 | obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
|
---|
| 535 | x = obj->data.x509;
|
---|
| 536 | X509_up_ref(x);
|
---|
| 537 | if (!sk_X509_push(sk, x)) {
|
---|
| 538 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 539 | X509_free(x);
|
---|
| 540 | sk_X509_pop_free(sk, X509_free);
|
---|
| 541 | return NULL;
|
---|
| 542 | }
|
---|
| 543 | }
|
---|
| 544 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 545 | return sk;
|
---|
| 546 | }
|
---|
| 547 |
|
---|
| 548 | STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
|
---|
| 549 | {
|
---|
| 550 | int i, idx, cnt;
|
---|
| 551 | STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
|
---|
| 552 | X509_CRL *x;
|
---|
| 553 | X509_OBJECT *obj, *xobj = X509_OBJECT_new();
|
---|
| 554 |
|
---|
| 555 | /* Always do lookup to possibly add new CRLs to cache */
|
---|
| 556 | if (sk == NULL || xobj == NULL ||
|
---|
| 557 | !X509_STORE_CTX_get_by_subject(ctx, X509_LU_CRL, nm, xobj)) {
|
---|
| 558 | X509_OBJECT_free(xobj);
|
---|
| 559 | sk_X509_CRL_free(sk);
|
---|
| 560 | return NULL;
|
---|
| 561 | }
|
---|
| 562 | X509_OBJECT_free(xobj);
|
---|
| 563 | CRYPTO_THREAD_write_lock(ctx->ctx->lock);
|
---|
| 564 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
|
---|
| 565 | if (idx < 0) {
|
---|
| 566 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 567 | sk_X509_CRL_free(sk);
|
---|
| 568 | return NULL;
|
---|
| 569 | }
|
---|
| 570 |
|
---|
| 571 | for (i = 0; i < cnt; i++, idx++) {
|
---|
| 572 | obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
|
---|
| 573 | x = obj->data.crl;
|
---|
| 574 | X509_CRL_up_ref(x);
|
---|
| 575 | if (!sk_X509_CRL_push(sk, x)) {
|
---|
| 576 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 577 | X509_CRL_free(x);
|
---|
| 578 | sk_X509_CRL_pop_free(sk, X509_CRL_free);
|
---|
| 579 | return NULL;
|
---|
| 580 | }
|
---|
| 581 | }
|
---|
| 582 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 583 | return sk;
|
---|
| 584 | }
|
---|
| 585 |
|
---|
| 586 | X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h,
|
---|
| 587 | X509_OBJECT *x)
|
---|
| 588 | {
|
---|
| 589 | int idx, i;
|
---|
| 590 | X509_OBJECT *obj;
|
---|
| 591 | idx = sk_X509_OBJECT_find(h, x);
|
---|
| 592 | if (idx == -1)
|
---|
| 593 | return NULL;
|
---|
| 594 | if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
|
---|
| 595 | return sk_X509_OBJECT_value(h, idx);
|
---|
| 596 | for (i = idx; i < sk_X509_OBJECT_num(h); i++) {
|
---|
| 597 | obj = sk_X509_OBJECT_value(h, i);
|
---|
| 598 | if (x509_object_cmp
|
---|
| 599 | ((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x))
|
---|
| 600 | return NULL;
|
---|
| 601 | if (x->type == X509_LU_X509) {
|
---|
| 602 | if (!X509_cmp(obj->data.x509, x->data.x509))
|
---|
| 603 | return obj;
|
---|
| 604 | } else if (x->type == X509_LU_CRL) {
|
---|
| 605 | if (!X509_CRL_match(obj->data.crl, x->data.crl))
|
---|
| 606 | return obj;
|
---|
| 607 | } else
|
---|
| 608 | return obj;
|
---|
| 609 | }
|
---|
| 610 | return NULL;
|
---|
| 611 | }
|
---|
| 612 |
|
---|
| 613 | /*-
|
---|
| 614 | * Try to get issuer certificate from store. Due to limitations
|
---|
| 615 | * of the API this can only retrieve a single certificate matching
|
---|
| 616 | * a given subject name. However it will fill the cache with all
|
---|
| 617 | * matching certificates, so we can examine the cache for all
|
---|
| 618 | * matches.
|
---|
| 619 | *
|
---|
| 620 | * Return values are:
|
---|
| 621 | * 1 lookup successful.
|
---|
| 622 | * 0 certificate not found.
|
---|
| 623 | * -1 some other error.
|
---|
| 624 | */
|
---|
| 625 | int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
|
---|
| 626 | {
|
---|
| 627 | X509_NAME *xn;
|
---|
| 628 | X509_OBJECT *obj = X509_OBJECT_new(), *pobj = NULL;
|
---|
| 629 | int i, ok, idx, ret;
|
---|
| 630 |
|
---|
| 631 | if (obj == NULL)
|
---|
| 632 | return -1;
|
---|
| 633 | *issuer = NULL;
|
---|
| 634 | xn = X509_get_issuer_name(x);
|
---|
| 635 | ok = X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, xn, obj);
|
---|
| 636 | if (ok != 1) {
|
---|
| 637 | X509_OBJECT_free(obj);
|
---|
| 638 | return 0;
|
---|
| 639 | }
|
---|
| 640 | /* If certificate matches all OK */
|
---|
| 641 | if (ctx->check_issued(ctx, x, obj->data.x509)) {
|
---|
| 642 | if (x509_check_cert_time(ctx, obj->data.x509, -1)) {
|
---|
| 643 | *issuer = obj->data.x509;
|
---|
| 644 | X509_up_ref(*issuer);
|
---|
| 645 | X509_OBJECT_free(obj);
|
---|
| 646 | return 1;
|
---|
| 647 | }
|
---|
| 648 | }
|
---|
| 649 | X509_OBJECT_free(obj);
|
---|
| 650 |
|
---|
| 651 | /* Else find index of first cert accepted by 'check_issued' */
|
---|
| 652 | ret = 0;
|
---|
| 653 | CRYPTO_THREAD_write_lock(ctx->ctx->lock);
|
---|
| 654 | idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
|
---|
| 655 | if (idx != -1) { /* should be true as we've had at least one
|
---|
| 656 | * match */
|
---|
| 657 | /* Look through all matching certs for suitable issuer */
|
---|
| 658 | for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
|
---|
| 659 | pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
|
---|
| 660 | /* See if we've run past the matches */
|
---|
| 661 | if (pobj->type != X509_LU_X509)
|
---|
| 662 | break;
|
---|
| 663 | if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
|
---|
| 664 | break;
|
---|
| 665 | if (ctx->check_issued(ctx, x, pobj->data.x509)) {
|
---|
| 666 | *issuer = pobj->data.x509;
|
---|
| 667 | ret = 1;
|
---|
| 668 | /*
|
---|
| 669 | * If times check, exit with match,
|
---|
| 670 | * otherwise keep looking. Leave last
|
---|
| 671 | * match in issuer so we return nearest
|
---|
| 672 | * match if no certificate time is OK.
|
---|
| 673 | */
|
---|
| 674 |
|
---|
| 675 | if (x509_check_cert_time(ctx, *issuer, -1))
|
---|
| 676 | break;
|
---|
| 677 | }
|
---|
| 678 | }
|
---|
| 679 | }
|
---|
| 680 | CRYPTO_THREAD_unlock(ctx->ctx->lock);
|
---|
| 681 | if (*issuer)
|
---|
| 682 | X509_up_ref(*issuer);
|
---|
| 683 | return ret;
|
---|
| 684 | }
|
---|
| 685 |
|
---|
| 686 | int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
|
---|
| 687 | {
|
---|
| 688 | return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
|
---|
| 689 | }
|
---|
| 690 |
|
---|
| 691 | int X509_STORE_set_depth(X509_STORE *ctx, int depth)
|
---|
| 692 | {
|
---|
| 693 | X509_VERIFY_PARAM_set_depth(ctx->param, depth);
|
---|
| 694 | return 1;
|
---|
| 695 | }
|
---|
| 696 |
|
---|
| 697 | int X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
|
---|
| 698 | {
|
---|
| 699 | return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
|
---|
| 700 | }
|
---|
| 701 |
|
---|
| 702 | int X509_STORE_set_trust(X509_STORE *ctx, int trust)
|
---|
| 703 | {
|
---|
| 704 | return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
|
---|
| 705 | }
|
---|
| 706 |
|
---|
| 707 | int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
|
---|
| 708 | {
|
---|
| 709 | return X509_VERIFY_PARAM_set1(ctx->param, param);
|
---|
| 710 | }
|
---|
| 711 |
|
---|
| 712 | X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx)
|
---|
| 713 | {
|
---|
| 714 | return ctx->param;
|
---|
| 715 | }
|
---|
| 716 |
|
---|
| 717 | void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify)
|
---|
| 718 | {
|
---|
| 719 | ctx->verify = verify;
|
---|
| 720 | }
|
---|
| 721 |
|
---|
| 722 | X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx)
|
---|
| 723 | {
|
---|
| 724 | return ctx->verify;
|
---|
| 725 | }
|
---|
| 726 |
|
---|
| 727 | void X509_STORE_set_verify_cb(X509_STORE *ctx,
|
---|
| 728 | X509_STORE_CTX_verify_cb verify_cb)
|
---|
| 729 | {
|
---|
| 730 | ctx->verify_cb = verify_cb;
|
---|
| 731 | }
|
---|
| 732 |
|
---|
| 733 | X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx)
|
---|
| 734 | {
|
---|
| 735 | return ctx->verify_cb;
|
---|
| 736 | }
|
---|
| 737 |
|
---|
| 738 | void X509_STORE_set_get_issuer(X509_STORE *ctx,
|
---|
| 739 | X509_STORE_CTX_get_issuer_fn get_issuer)
|
---|
| 740 | {
|
---|
| 741 | ctx->get_issuer = get_issuer;
|
---|
| 742 | }
|
---|
| 743 |
|
---|
| 744 | X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(X509_STORE *ctx)
|
---|
| 745 | {
|
---|
| 746 | return ctx->get_issuer;
|
---|
| 747 | }
|
---|
| 748 |
|
---|
| 749 | void X509_STORE_set_check_issued(X509_STORE *ctx,
|
---|
| 750 | X509_STORE_CTX_check_issued_fn check_issued)
|
---|
| 751 | {
|
---|
| 752 | ctx->check_issued = check_issued;
|
---|
| 753 | }
|
---|
| 754 |
|
---|
| 755 | X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *ctx)
|
---|
| 756 | {
|
---|
| 757 | return ctx->check_issued;
|
---|
| 758 | }
|
---|
| 759 |
|
---|
| 760 | void X509_STORE_set_check_revocation(X509_STORE *ctx,
|
---|
| 761 | X509_STORE_CTX_check_revocation_fn check_revocation)
|
---|
| 762 | {
|
---|
| 763 | ctx->check_revocation = check_revocation;
|
---|
| 764 | }
|
---|
| 765 |
|
---|
| 766 | X509_STORE_CTX_check_revocation_fn X509_STORE_get_check_revocation(X509_STORE *ctx)
|
---|
| 767 | {
|
---|
| 768 | return ctx->check_revocation;
|
---|
| 769 | }
|
---|
| 770 |
|
---|
| 771 | void X509_STORE_set_get_crl(X509_STORE *ctx,
|
---|
| 772 | X509_STORE_CTX_get_crl_fn get_crl)
|
---|
| 773 | {
|
---|
| 774 | ctx->get_crl = get_crl;
|
---|
| 775 | }
|
---|
| 776 |
|
---|
| 777 | X509_STORE_CTX_get_crl_fn X509_STORE_get_get_crl(X509_STORE *ctx)
|
---|
| 778 | {
|
---|
| 779 | return ctx->get_crl;
|
---|
| 780 | }
|
---|
| 781 |
|
---|
| 782 | void X509_STORE_set_check_crl(X509_STORE *ctx,
|
---|
| 783 | X509_STORE_CTX_check_crl_fn check_crl)
|
---|
| 784 | {
|
---|
| 785 | ctx->check_crl = check_crl;
|
---|
| 786 | }
|
---|
| 787 |
|
---|
| 788 | X509_STORE_CTX_check_crl_fn X509_STORE_get_check_crl(X509_STORE *ctx)
|
---|
| 789 | {
|
---|
| 790 | return ctx->check_crl;
|
---|
| 791 | }
|
---|
| 792 |
|
---|
| 793 | void X509_STORE_set_cert_crl(X509_STORE *ctx,
|
---|
| 794 | X509_STORE_CTX_cert_crl_fn cert_crl)
|
---|
| 795 | {
|
---|
| 796 | ctx->cert_crl = cert_crl;
|
---|
| 797 | }
|
---|
| 798 |
|
---|
| 799 | X509_STORE_CTX_cert_crl_fn X509_STORE_get_cert_crl(X509_STORE *ctx)
|
---|
| 800 | {
|
---|
| 801 | return ctx->cert_crl;
|
---|
| 802 | }
|
---|
| 803 |
|
---|
| 804 | void X509_STORE_set_check_policy(X509_STORE *ctx,
|
---|
| 805 | X509_STORE_CTX_check_policy_fn check_policy)
|
---|
| 806 | {
|
---|
| 807 | ctx->check_policy = check_policy;
|
---|
| 808 | }
|
---|
| 809 |
|
---|
| 810 | X509_STORE_CTX_check_policy_fn X509_STORE_get_check_policy(X509_STORE *ctx)
|
---|
| 811 | {
|
---|
| 812 | return ctx->check_policy;
|
---|
| 813 | }
|
---|
| 814 |
|
---|
| 815 | void X509_STORE_set_lookup_certs(X509_STORE *ctx,
|
---|
| 816 | X509_STORE_CTX_lookup_certs_fn lookup_certs)
|
---|
| 817 | {
|
---|
| 818 | ctx->lookup_certs = lookup_certs;
|
---|
| 819 | }
|
---|
| 820 |
|
---|
| 821 | X509_STORE_CTX_lookup_certs_fn X509_STORE_get_lookup_certs(X509_STORE *ctx)
|
---|
| 822 | {
|
---|
| 823 | return ctx->lookup_certs;
|
---|
| 824 | }
|
---|
| 825 |
|
---|
| 826 | void X509_STORE_set_lookup_crls(X509_STORE *ctx,
|
---|
| 827 | X509_STORE_CTX_lookup_crls_fn lookup_crls)
|
---|
| 828 | {
|
---|
| 829 | ctx->lookup_crls = lookup_crls;
|
---|
| 830 | }
|
---|
| 831 |
|
---|
| 832 | X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx)
|
---|
| 833 | {
|
---|
| 834 | return ctx->lookup_crls;
|
---|
| 835 | }
|
---|
| 836 |
|
---|
| 837 | void X509_STORE_set_cleanup(X509_STORE *ctx,
|
---|
| 838 | X509_STORE_CTX_cleanup_fn ctx_cleanup)
|
---|
| 839 | {
|
---|
| 840 | ctx->cleanup = ctx_cleanup;
|
---|
| 841 | }
|
---|
| 842 |
|
---|
| 843 | X509_STORE_CTX_cleanup_fn X509_STORE_get_cleanup(X509_STORE *ctx)
|
---|
| 844 | {
|
---|
| 845 | return ctx->cleanup;
|
---|
| 846 | }
|
---|
| 847 |
|
---|
| 848 | int X509_STORE_set_ex_data(X509_STORE *ctx, int idx, void *data)
|
---|
| 849 | {
|
---|
| 850 | return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
|
---|
| 851 | }
|
---|
| 852 |
|
---|
| 853 | void *X509_STORE_get_ex_data(X509_STORE *ctx, int idx)
|
---|
| 854 | {
|
---|
| 855 | return CRYPTO_get_ex_data(&ctx->ex_data, idx);
|
---|
| 856 | }
|
---|
| 857 |
|
---|
| 858 | X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx)
|
---|
| 859 | {
|
---|
| 860 | return ctx->ctx;
|
---|
| 861 | }
|
---|