[331] | 1 | /*
|
---|
| 2 | * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | /* Internal X509 structures and functions: not for application use */
|
---|
| 11 |
|
---|
| 12 | /* Note: unless otherwise stated a field pointer is mandatory and should
|
---|
| 13 | * never be set to NULL: the ASN.1 code and accessors rely on mandatory
|
---|
| 14 | * fields never being NULL.
|
---|
| 15 | */
|
---|
| 16 |
|
---|
| 17 | /*
|
---|
| 18 | * name entry structure, equivalent to AttributeTypeAndValue defined
|
---|
| 19 | * in RFC5280 et al.
|
---|
| 20 | */
|
---|
| 21 | struct X509_name_entry_st {
|
---|
| 22 | ASN1_OBJECT *object; /* AttributeType */
|
---|
| 23 | ASN1_STRING *value; /* AttributeValue */
|
---|
| 24 | int set; /* index of RDNSequence for this entry */
|
---|
| 25 | int size; /* temp variable */
|
---|
| 26 | };
|
---|
| 27 |
|
---|
| 28 | /* Name from RFC 5280. */
|
---|
| 29 | struct X509_name_st {
|
---|
| 30 | STACK_OF(X509_NAME_ENTRY) *entries; /* DN components */
|
---|
| 31 | int modified; /* true if 'bytes' needs to be built */
|
---|
| 32 | BUF_MEM *bytes; /* cached encoding: cannot be NULL */
|
---|
| 33 | /* canonical encoding used for rapid Name comparison */
|
---|
| 34 | unsigned char *canon_enc;
|
---|
| 35 | int canon_enclen;
|
---|
| 36 | } /* X509_NAME */ ;
|
---|
| 37 |
|
---|
| 38 | /* PKCS#10 certificate request */
|
---|
| 39 |
|
---|
| 40 | struct X509_req_info_st {
|
---|
| 41 | ASN1_ENCODING enc; /* cached encoding of signed part */
|
---|
| 42 | ASN1_INTEGER *version; /* version, defaults to v1(0) so can be NULL */
|
---|
| 43 | X509_NAME *subject; /* certificate request DN */
|
---|
| 44 | X509_PUBKEY *pubkey; /* public key of request */
|
---|
| 45 | /*
|
---|
| 46 | * Zero or more attributes.
|
---|
| 47 | * NB: although attributes is a mandatory field some broken
|
---|
| 48 | * encodings omit it so this may be NULL in that case.
|
---|
| 49 | */
|
---|
| 50 | STACK_OF(X509_ATTRIBUTE) *attributes;
|
---|
| 51 | };
|
---|
| 52 |
|
---|
| 53 | struct X509_req_st {
|
---|
| 54 | X509_REQ_INFO req_info; /* signed certificate request data */
|
---|
| 55 | X509_ALGOR sig_alg; /* signature algorithm */
|
---|
| 56 | ASN1_BIT_STRING *signature; /* signature */
|
---|
| 57 | int references;
|
---|
| 58 | CRYPTO_RWLOCK *lock;
|
---|
| 59 | };
|
---|
| 60 |
|
---|
| 61 | struct X509_crl_info_st {
|
---|
| 62 | ASN1_INTEGER *version; /* version: defaults to v1(0) so may be NULL */
|
---|
| 63 | X509_ALGOR sig_alg; /* signature algorithm */
|
---|
| 64 | X509_NAME *issuer; /* CRL issuer name */
|
---|
| 65 | ASN1_TIME *lastUpdate; /* lastUpdate field */
|
---|
| 66 | ASN1_TIME *nextUpdate; /* nextUpdate field: optional */
|
---|
| 67 | STACK_OF(X509_REVOKED) *revoked; /* revoked entries: optional */
|
---|
| 68 | STACK_OF(X509_EXTENSION) *extensions; /* extensions: optional */
|
---|
| 69 | ASN1_ENCODING enc; /* encoding of signed portion of CRL */
|
---|
| 70 | };
|
---|
| 71 |
|
---|
| 72 | struct X509_crl_st {
|
---|
| 73 | X509_CRL_INFO crl; /* signed CRL data */
|
---|
| 74 | X509_ALGOR sig_alg; /* CRL signature algorithm */
|
---|
| 75 | ASN1_BIT_STRING signature; /* CRL signature */
|
---|
| 76 | int references;
|
---|
| 77 | int flags;
|
---|
| 78 | /*
|
---|
| 79 | * Cached copies of decoded extension values, since extensions
|
---|
| 80 | * are optional any of these can be NULL.
|
---|
| 81 | */
|
---|
| 82 | AUTHORITY_KEYID *akid;
|
---|
| 83 | ISSUING_DIST_POINT *idp;
|
---|
| 84 | /* Convenient breakdown of IDP */
|
---|
| 85 | int idp_flags;
|
---|
| 86 | int idp_reasons;
|
---|
| 87 | /* CRL and base CRL numbers for delta processing */
|
---|
| 88 | ASN1_INTEGER *crl_number;
|
---|
| 89 | ASN1_INTEGER *base_crl_number;
|
---|
| 90 | STACK_OF(GENERAL_NAMES) *issuers;
|
---|
| 91 | /* hash of CRL */
|
---|
| 92 | unsigned char sha1_hash[SHA_DIGEST_LENGTH];
|
---|
| 93 | /* alternative method to handle this CRL */
|
---|
| 94 | const X509_CRL_METHOD *meth;
|
---|
| 95 | void *meth_data;
|
---|
| 96 | CRYPTO_RWLOCK *lock;
|
---|
| 97 | };
|
---|
| 98 |
|
---|
| 99 | struct x509_revoked_st {
|
---|
| 100 | ASN1_INTEGER serialNumber; /* revoked entry serial number */
|
---|
| 101 | ASN1_TIME *revocationDate; /* revocation date */
|
---|
| 102 | STACK_OF(X509_EXTENSION) *extensions; /* CRL entry extensions: optional */
|
---|
| 103 | /* decoded value of CRLissuer extension: set if indirect CRL */
|
---|
| 104 | STACK_OF(GENERAL_NAME) *issuer;
|
---|
| 105 | /* revocation reason: set to CRL_REASON_NONE if reason extension absent */
|
---|
| 106 | int reason;
|
---|
| 107 | /*
|
---|
| 108 | * CRL entries are reordered for faster lookup of serial numbers. This
|
---|
| 109 | * field contains the original load sequence for this entry.
|
---|
| 110 | */
|
---|
| 111 | int sequence;
|
---|
| 112 | };
|
---|
| 113 |
|
---|
| 114 | /*
|
---|
| 115 | * This stuff is certificate "auxiliary info": it contains details which are
|
---|
| 116 | * useful in certificate stores and databases. When used this is tagged onto
|
---|
| 117 | * the end of the certificate itself. OpenSSL specific structure not defined
|
---|
| 118 | * in any RFC.
|
---|
| 119 | */
|
---|
| 120 |
|
---|
| 121 | struct x509_cert_aux_st {
|
---|
| 122 | STACK_OF(ASN1_OBJECT) *trust; /* trusted uses */
|
---|
| 123 | STACK_OF(ASN1_OBJECT) *reject; /* rejected uses */
|
---|
| 124 | ASN1_UTF8STRING *alias; /* "friendly name" */
|
---|
| 125 | ASN1_OCTET_STRING *keyid; /* key id of private key */
|
---|
| 126 | STACK_OF(X509_ALGOR) *other; /* other unspecified info */
|
---|
| 127 | };
|
---|
| 128 |
|
---|
| 129 | struct x509_cinf_st {
|
---|
| 130 | ASN1_INTEGER *version; /* [ 0 ] default of v1 */
|
---|
| 131 | ASN1_INTEGER serialNumber;
|
---|
| 132 | X509_ALGOR signature;
|
---|
| 133 | X509_NAME *issuer;
|
---|
| 134 | X509_VAL validity;
|
---|
| 135 | X509_NAME *subject;
|
---|
| 136 | X509_PUBKEY *key;
|
---|
| 137 | ASN1_BIT_STRING *issuerUID; /* [ 1 ] optional in v2 */
|
---|
| 138 | ASN1_BIT_STRING *subjectUID; /* [ 2 ] optional in v2 */
|
---|
| 139 | STACK_OF(X509_EXTENSION) *extensions; /* [ 3 ] optional in v3 */
|
---|
| 140 | ASN1_ENCODING enc;
|
---|
| 141 | };
|
---|
| 142 |
|
---|
| 143 | struct x509_st {
|
---|
| 144 | X509_CINF cert_info;
|
---|
| 145 | X509_ALGOR sig_alg;
|
---|
| 146 | ASN1_BIT_STRING signature;
|
---|
| 147 | int references;
|
---|
| 148 | CRYPTO_EX_DATA ex_data;
|
---|
| 149 | /* These contain copies of various extension values */
|
---|
| 150 | long ex_pathlen;
|
---|
| 151 | long ex_pcpathlen;
|
---|
| 152 | uint32_t ex_flags;
|
---|
| 153 | uint32_t ex_kusage;
|
---|
| 154 | uint32_t ex_xkusage;
|
---|
| 155 | uint32_t ex_nscert;
|
---|
| 156 | ASN1_OCTET_STRING *skid;
|
---|
| 157 | AUTHORITY_KEYID *akid;
|
---|
| 158 | X509_POLICY_CACHE *policy_cache;
|
---|
| 159 | STACK_OF(DIST_POINT) *crldp;
|
---|
| 160 | STACK_OF(GENERAL_NAME) *altname;
|
---|
| 161 | NAME_CONSTRAINTS *nc;
|
---|
| 162 | #ifndef OPENSSL_NO_RFC3779
|
---|
| 163 | STACK_OF(IPAddressFamily) *rfc3779_addr;
|
---|
| 164 | struct ASIdentifiers_st *rfc3779_asid;
|
---|
| 165 | # endif
|
---|
| 166 | unsigned char sha1_hash[SHA_DIGEST_LENGTH];
|
---|
| 167 | X509_CERT_AUX *aux;
|
---|
| 168 | CRYPTO_RWLOCK *lock;
|
---|
| 169 | } /* X509 */ ;
|
---|
| 170 |
|
---|
| 171 | /*
|
---|
| 172 | * This is a used when verifying cert chains. Since the gathering of the
|
---|
| 173 | * cert chain can take some time (and have to be 'retried', this needs to be
|
---|
| 174 | * kept and passed around.
|
---|
| 175 | */
|
---|
| 176 | struct x509_store_ctx_st { /* X509_STORE_CTX */
|
---|
| 177 | X509_STORE *ctx;
|
---|
| 178 | /* The following are set by the caller */
|
---|
| 179 | /* The cert to check */
|
---|
| 180 | X509 *cert;
|
---|
| 181 | /* chain of X509s - untrusted - passed in */
|
---|
| 182 | STACK_OF(X509) *untrusted;
|
---|
| 183 | /* set of CRLs passed in */
|
---|
| 184 | STACK_OF(X509_CRL) *crls;
|
---|
| 185 | X509_VERIFY_PARAM *param;
|
---|
| 186 | /* Other info for use with get_issuer() */
|
---|
| 187 | void *other_ctx;
|
---|
| 188 | /* Callbacks for various operations */
|
---|
| 189 | /* called to verify a certificate */
|
---|
| 190 | int (*verify) (X509_STORE_CTX *ctx);
|
---|
| 191 | /* error callback */
|
---|
| 192 | int (*verify_cb) (int ok, X509_STORE_CTX *ctx);
|
---|
| 193 | /* get issuers cert from ctx */
|
---|
| 194 | int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
|
---|
| 195 | /* check issued */
|
---|
| 196 | int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
|
---|
| 197 | /* Check revocation status of chain */
|
---|
| 198 | int (*check_revocation) (X509_STORE_CTX *ctx);
|
---|
| 199 | /* retrieve CRL */
|
---|
| 200 | int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x);
|
---|
| 201 | /* Check CRL validity */
|
---|
| 202 | int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl);
|
---|
| 203 | /* Check certificate against CRL */
|
---|
| 204 | int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x);
|
---|
| 205 | /* Check policy status of the chain */
|
---|
| 206 | int (*check_policy) (X509_STORE_CTX *ctx);
|
---|
| 207 | STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, X509_NAME *nm);
|
---|
| 208 | STACK_OF(X509_CRL) *(*lookup_crls) (X509_STORE_CTX *ctx, X509_NAME *nm);
|
---|
| 209 | int (*cleanup) (X509_STORE_CTX *ctx);
|
---|
| 210 | /* The following is built up */
|
---|
| 211 | /* if 0, rebuild chain */
|
---|
| 212 | int valid;
|
---|
| 213 | /* number of untrusted certs */
|
---|
| 214 | int num_untrusted;
|
---|
| 215 | /* chain of X509s - built up and trusted */
|
---|
| 216 | STACK_OF(X509) *chain;
|
---|
| 217 | /* Valid policy tree */
|
---|
| 218 | X509_POLICY_TREE *tree;
|
---|
| 219 | /* Require explicit policy value */
|
---|
| 220 | int explicit_policy;
|
---|
| 221 | /* When something goes wrong, this is why */
|
---|
| 222 | int error_depth;
|
---|
| 223 | int error;
|
---|
| 224 | X509 *current_cert;
|
---|
| 225 | /* cert currently being tested as valid issuer */
|
---|
| 226 | X509 *current_issuer;
|
---|
| 227 | /* current CRL */
|
---|
| 228 | X509_CRL *current_crl;
|
---|
| 229 | /* score of current CRL */
|
---|
| 230 | int current_crl_score;
|
---|
| 231 | /* Reason mask */
|
---|
| 232 | unsigned int current_reasons;
|
---|
| 233 | /* For CRL path validation: parent context */
|
---|
| 234 | X509_STORE_CTX *parent;
|
---|
| 235 | CRYPTO_EX_DATA ex_data;
|
---|
| 236 | SSL_DANE *dane;
|
---|
| 237 | /* signed via bare TA public key, rather than CA certificate */
|
---|
| 238 | int bare_ta_signed;
|
---|
| 239 | };
|
---|
| 240 |
|
---|
| 241 | /* PKCS#8 private key info structure */
|
---|
| 242 |
|
---|
| 243 | struct pkcs8_priv_key_info_st {
|
---|
| 244 | ASN1_INTEGER *version;
|
---|
| 245 | X509_ALGOR *pkeyalg;
|
---|
| 246 | ASN1_OCTET_STRING *pkey;
|
---|
| 247 | STACK_OF(X509_ATTRIBUTE) *attributes;
|
---|
| 248 | };
|
---|
| 249 |
|
---|
| 250 | struct X509_sig_st {
|
---|
| 251 | X509_ALGOR *algor;
|
---|
| 252 | ASN1_OCTET_STRING *digest;
|
---|
| 253 | };
|
---|
| 254 |
|
---|
| 255 | struct x509_object_st {
|
---|
| 256 | /* one of the above types */
|
---|
| 257 | X509_LOOKUP_TYPE type;
|
---|
| 258 | union {
|
---|
| 259 | char *ptr;
|
---|
| 260 | X509 *x509;
|
---|
| 261 | X509_CRL *crl;
|
---|
| 262 | EVP_PKEY *pkey;
|
---|
| 263 | } data;
|
---|
| 264 | };
|
---|
| 265 |
|
---|
| 266 | int a2i_ipadd(unsigned char *ipout, const char *ipasc);
|
---|
| 267 | int x509_set1_time(ASN1_TIME **ptm, const ASN1_TIME *tm);
|
---|