Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 2 | * All rights reserved. |
| 3 | * |
| 4 | * This package is an SSL implementation written |
| 5 | * by Eric Young (eay@cryptsoft.com). |
| 6 | * The implementation was written so as to conform with Netscapes SSL. |
| 7 | * |
| 8 | * This library is free for commercial and non-commercial use as long as |
| 9 | * the following conditions are aheared to. The following conditions |
| 10 | * apply to all code found in this distribution, be it the RC4, RSA, |
| 11 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| 12 | * included with this distribution is covered by the same copyright terms |
| 13 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| 14 | * |
| 15 | * Copyright remains Eric Young's, and as such any Copyright notices in |
| 16 | * the code are not to be removed. |
| 17 | * If this package is used in a product, Eric Young should be given attribution |
| 18 | * as the author of the parts of the library used. |
| 19 | * This can be in the form of a textual message at program startup or |
| 20 | * in documentation (online or textual) provided with the package. |
| 21 | * |
| 22 | * Redistribution and use in source and binary forms, with or without |
| 23 | * modification, are permitted provided that the following conditions |
| 24 | * are met: |
| 25 | * 1. Redistributions of source code must retain the copyright |
| 26 | * notice, this list of conditions and the following disclaimer. |
| 27 | * 2. Redistributions in binary form must reproduce the above copyright |
| 28 | * notice, this list of conditions and the following disclaimer in the |
| 29 | * documentation and/or other materials provided with the distribution. |
| 30 | * 3. All advertising materials mentioning features or use of this software |
| 31 | * must display the following acknowledgement: |
| 32 | * "This product includes cryptographic software written by |
| 33 | * Eric Young (eay@cryptsoft.com)" |
| 34 | * The word 'cryptographic' can be left out if the rouines from the library |
| 35 | * being used are not cryptographic related :-). |
| 36 | * 4. If you include any Windows specific code (or a derivative thereof) from |
| 37 | * the apps directory (application code) you must include an acknowledgement: |
| 38 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| 39 | * |
| 40 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| 41 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 42 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 43 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| 44 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 45 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 46 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 47 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 48 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 49 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 50 | * SUCH DAMAGE. |
| 51 | * |
| 52 | * The licence and distribution terms for any publically available version or |
| 53 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
| 54 | * copied and put under another distribution licence |
| 55 | * [including the GNU Public Licence.] */ |
| 56 | |
| 57 | #include <string.h> |
| 58 | #include <time.h> |
| 59 | |
| 60 | #include <openssl/asn1.h> |
| 61 | #include <openssl/buf.h> |
| 62 | #include <openssl/err.h> |
| 63 | #include <openssl/evp.h> |
| 64 | #include <openssl/lhash.h> |
| 65 | #include <openssl/mem.h> |
| 66 | #include <openssl/obj.h> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 67 | #include <openssl/thread.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 68 | #include <openssl/x509.h> |
| 69 | #include <openssl/x509v3.h> |
| 70 | |
| 71 | #include "vpm_int.h" |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 72 | #include "../internal.h" |
| 73 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 74 | static CRYPTO_EX_DATA_CLASS g_ex_data_class = |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 75 | CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 76 | |
| 77 | /* CRL score values */ |
| 78 | |
| 79 | /* No unhandled critical extensions */ |
| 80 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 81 | #define CRL_SCORE_NOCRITICAL 0x100 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 82 | |
| 83 | /* certificate is within CRL scope */ |
| 84 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 85 | #define CRL_SCORE_SCOPE 0x080 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 86 | |
| 87 | /* CRL times valid */ |
| 88 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 89 | #define CRL_SCORE_TIME 0x040 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 90 | |
| 91 | /* Issuer name matches certificate */ |
| 92 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 93 | #define CRL_SCORE_ISSUER_NAME 0x020 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 94 | |
| 95 | /* If this score or above CRL is probably valid */ |
| 96 | |
| 97 | #define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE) |
| 98 | |
| 99 | /* CRL issuer is certificate issuer */ |
| 100 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 101 | #define CRL_SCORE_ISSUER_CERT 0x018 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 102 | |
| 103 | /* CRL issuer is on certificate path */ |
| 104 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 105 | #define CRL_SCORE_SAME_PATH 0x008 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 106 | |
| 107 | /* CRL issuer matches CRL AKID */ |
| 108 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 109 | #define CRL_SCORE_AKID 0x004 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 110 | |
| 111 | /* Have a delta CRL with valid times */ |
| 112 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 113 | #define CRL_SCORE_TIME_DELTA 0x002 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 114 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 115 | static int null_callback(int ok, X509_STORE_CTX *e); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 116 | static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); |
| 117 | static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); |
| 118 | static int check_chain_extensions(X509_STORE_CTX *ctx); |
| 119 | static int check_name_constraints(X509_STORE_CTX *ctx); |
| 120 | static int check_id(X509_STORE_CTX *ctx); |
| 121 | static int check_trust(X509_STORE_CTX *ctx); |
| 122 | static int check_revocation(X509_STORE_CTX *ctx); |
| 123 | static int check_cert(X509_STORE_CTX *ctx); |
| 124 | static int check_policy(X509_STORE_CTX *ctx); |
| 125 | |
| 126 | static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 127 | unsigned int *preasons, X509_CRL *crl, X509 *x); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 128 | static int get_crl_delta(X509_STORE_CTX *ctx, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 129 | X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x); |
| 130 | static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, |
| 131 | int *pcrl_score, X509_CRL *base, |
| 132 | STACK_OF(X509_CRL) *crls); |
| 133 | static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, |
| 134 | int *pcrl_score); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 135 | static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 136 | unsigned int *preasons); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 137 | static int check_crl_path(X509_STORE_CTX *ctx, X509 *x); |
| 138 | static int check_crl_chain(X509_STORE_CTX *ctx, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 139 | STACK_OF(X509) *cert_path, |
| 140 | STACK_OF(X509) *crl_path); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 141 | |
| 142 | static int internal_verify(X509_STORE_CTX *ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 143 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 144 | static int null_callback(int ok, X509_STORE_CTX *e) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 145 | { |
| 146 | return ok; |
| 147 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 148 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 149 | /* Return 1 is a certificate is self signed */ |
| 150 | static int cert_self_signed(X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 151 | { |
| 152 | X509_check_purpose(x, -1, 0); |
| 153 | if (x->ex_flags & EXFLAG_SS) |
| 154 | return 1; |
| 155 | else |
| 156 | return 0; |
| 157 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 158 | |
| 159 | /* Given a certificate try and find an exact match in the store */ |
| 160 | |
| 161 | static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 162 | { |
| 163 | STACK_OF(X509) *certs; |
| 164 | X509 *xtmp = NULL; |
| 165 | size_t i; |
| 166 | /* Lookup all certs with matching subject name */ |
| 167 | certs = ctx->lookup_certs(ctx, X509_get_subject_name(x)); |
| 168 | if (certs == NULL) |
| 169 | return NULL; |
| 170 | /* Look for exact match */ |
| 171 | for (i = 0; i < sk_X509_num(certs); i++) { |
| 172 | xtmp = sk_X509_value(certs, i); |
| 173 | if (!X509_cmp(xtmp, x)) |
| 174 | break; |
| 175 | } |
| 176 | if (i < sk_X509_num(certs)) |
| 177 | X509_up_ref(xtmp); |
| 178 | else |
| 179 | xtmp = NULL; |
| 180 | sk_X509_pop_free(certs, X509_free); |
| 181 | return xtmp; |
| 182 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 183 | |
| 184 | int X509_verify_cert(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 185 | { |
| 186 | X509 *x, *xtmp, *xtmp2, *chain_ss = NULL; |
| 187 | int bad_chain = 0; |
| 188 | X509_VERIFY_PARAM *param = ctx->param; |
| 189 | int depth, i, ok = 0; |
| 190 | int num, j, retry, trust; |
| 191 | int (*cb) (int xok, X509_STORE_CTX *xctx); |
| 192 | STACK_OF(X509) *sktmp = NULL; |
| 193 | if (ctx->cert == NULL) { |
| 194 | OPENSSL_PUT_ERROR(X509, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 195 | ctx->error = X509_V_ERR_INVALID_CALL; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 196 | return -1; |
| 197 | } |
| 198 | if (ctx->chain != NULL) { |
| 199 | /* |
| 200 | * This X509_STORE_CTX has already been used to verify a cert. We |
| 201 | * cannot do another one. |
| 202 | */ |
| 203 | OPENSSL_PUT_ERROR(X509, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 204 | ctx->error = X509_V_ERR_INVALID_CALL; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 205 | return -1; |
| 206 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 207 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 208 | cb = ctx->verify_cb; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 209 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 210 | /* |
| 211 | * first we make sure the chain we are going to build is present and that |
| 212 | * the first entry is in place |
| 213 | */ |
| 214 | ctx->chain = sk_X509_new_null(); |
| 215 | if (ctx->chain == NULL || !sk_X509_push(ctx->chain, ctx->cert)) { |
| 216 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 217 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 218 | goto end; |
| 219 | } |
| 220 | X509_up_ref(ctx->cert); |
| 221 | ctx->last_untrusted = 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 222 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 223 | /* We use a temporary STACK so we can chop and hack at it. |
| 224 | * sktmp = ctx->untrusted ++ ctx->ctx->additional_untrusted */ |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 225 | if (ctx->untrusted != NULL |
| 226 | && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { |
| 227 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 228 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 229 | goto end; |
| 230 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 231 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 232 | if (ctx->ctx->additional_untrusted != NULL) { |
| 233 | if (sktmp == NULL) { |
| 234 | sktmp = sk_X509_new_null(); |
| 235 | if (sktmp == NULL) { |
| 236 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
| 237 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
| 238 | goto end; |
| 239 | } |
| 240 | } |
| 241 | |
| 242 | for (size_t k = 0; k < sk_X509_num(ctx->ctx->additional_untrusted); |
| 243 | k++) { |
| 244 | if (!sk_X509_push(sktmp, |
| 245 | sk_X509_value(ctx->ctx->additional_untrusted, |
| 246 | k))) { |
| 247 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
| 248 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
| 249 | goto end; |
| 250 | } |
| 251 | } |
| 252 | } |
| 253 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 254 | num = sk_X509_num(ctx->chain); |
| 255 | x = sk_X509_value(ctx->chain, num - 1); |
| 256 | depth = param->depth; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 257 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 258 | for (;;) { |
| 259 | /* If we have enough, we break */ |
| 260 | if (depth < num) |
| 261 | break; /* FIXME: If this happens, we should take |
| 262 | * note of it and, if appropriate, use the |
| 263 | * X509_V_ERR_CERT_CHAIN_TOO_LONG error code |
| 264 | * later. */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 265 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 266 | /* If we are self signed, we break */ |
| 267 | if (cert_self_signed(x)) |
| 268 | break; |
| 269 | /* |
| 270 | * If asked see if we can find issuer in trusted store first |
| 271 | */ |
| 272 | if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) { |
| 273 | ok = ctx->get_issuer(&xtmp, ctx, x); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 274 | if (ok < 0) { |
| 275 | ctx->error = X509_V_ERR_STORE_LOOKUP; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 276 | goto end; |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 277 | } |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 278 | /* |
| 279 | * If successful for now free up cert so it will be picked up |
| 280 | * again later. |
| 281 | */ |
| 282 | if (ok > 0) { |
| 283 | X509_free(xtmp); |
| 284 | break; |
| 285 | } |
| 286 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 287 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 288 | /* If we were passed a cert chain, use it first */ |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 289 | if (sktmp != NULL) { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 290 | xtmp = find_issuer(ctx, sktmp, x); |
| 291 | if (xtmp != NULL) { |
| 292 | if (!sk_X509_push(ctx->chain, xtmp)) { |
| 293 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 294 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 295 | ok = 0; |
| 296 | goto end; |
| 297 | } |
| 298 | X509_up_ref(xtmp); |
| 299 | (void)sk_X509_delete_ptr(sktmp, xtmp); |
| 300 | ctx->last_untrusted++; |
| 301 | x = xtmp; |
| 302 | num++; |
| 303 | /* |
| 304 | * reparse the full chain for the next one |
| 305 | */ |
| 306 | continue; |
| 307 | } |
| 308 | } |
| 309 | break; |
| 310 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 311 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 312 | /* Remember how many untrusted certs we have */ |
| 313 | j = num; |
| 314 | /* |
| 315 | * at this point, chain should contain a list of untrusted certificates. |
| 316 | * We now need to add at least one trusted one, if possible, otherwise we |
| 317 | * complain. |
| 318 | */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 319 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 320 | do { |
| 321 | /* |
| 322 | * Examine last certificate in chain and see if it is self signed. |
| 323 | */ |
| 324 | i = sk_X509_num(ctx->chain); |
| 325 | x = sk_X509_value(ctx->chain, i - 1); |
| 326 | if (cert_self_signed(x)) { |
| 327 | /* we have a self signed certificate */ |
| 328 | if (sk_X509_num(ctx->chain) == 1) { |
| 329 | /* |
| 330 | * We have a single self signed certificate: see if we can |
| 331 | * find it in the store. We must have an exact match to avoid |
| 332 | * possible impersonation. |
| 333 | */ |
| 334 | ok = ctx->get_issuer(&xtmp, ctx, x); |
| 335 | if ((ok <= 0) || X509_cmp(x, xtmp)) { |
| 336 | ctx->error = X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT; |
| 337 | ctx->current_cert = x; |
| 338 | ctx->error_depth = i - 1; |
| 339 | if (ok == 1) |
| 340 | X509_free(xtmp); |
| 341 | bad_chain = 1; |
| 342 | ok = cb(0, ctx); |
| 343 | if (!ok) |
| 344 | goto end; |
| 345 | } else { |
| 346 | /* |
| 347 | * We have a match: replace certificate with store |
| 348 | * version so we get any trust settings. |
| 349 | */ |
| 350 | X509_free(x); |
| 351 | x = xtmp; |
| 352 | (void)sk_X509_set(ctx->chain, i - 1, x); |
| 353 | ctx->last_untrusted = 0; |
| 354 | } |
| 355 | } else { |
| 356 | /* |
| 357 | * extract and save self signed certificate for later use |
| 358 | */ |
| 359 | chain_ss = sk_X509_pop(ctx->chain); |
| 360 | ctx->last_untrusted--; |
| 361 | num--; |
| 362 | j--; |
| 363 | x = sk_X509_value(ctx->chain, num - 1); |
| 364 | } |
| 365 | } |
| 366 | /* We now lookup certs from the certificate store */ |
| 367 | for (;;) { |
| 368 | /* If we have enough, we break */ |
| 369 | if (depth < num) |
| 370 | break; |
| 371 | /* If we are self signed, we break */ |
| 372 | if (cert_self_signed(x)) |
| 373 | break; |
| 374 | ok = ctx->get_issuer(&xtmp, ctx, x); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 375 | |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 376 | if (ok < 0) { |
| 377 | ctx->error = X509_V_ERR_STORE_LOOKUP; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 378 | goto end; |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 379 | } |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 380 | if (ok == 0) |
| 381 | break; |
| 382 | x = xtmp; |
| 383 | if (!sk_X509_push(ctx->chain, x)) { |
| 384 | X509_free(xtmp); |
| 385 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 386 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 387 | ok = 0; |
| 388 | goto end; |
| 389 | } |
| 390 | num++; |
| 391 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 392 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 393 | /* we now have our chain, lets check it... */ |
| 394 | trust = check_trust(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 395 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 396 | /* If explicitly rejected error */ |
| 397 | if (trust == X509_TRUST_REJECTED) { |
| 398 | ok = 0; |
| 399 | goto end; |
| 400 | } |
| 401 | /* |
| 402 | * If it's not explicitly trusted then check if there is an alternative |
| 403 | * chain that could be used. We only do this if we haven't already |
| 404 | * checked via TRUSTED_FIRST and the user hasn't switched off alternate |
| 405 | * chain checking |
| 406 | */ |
| 407 | retry = 0; |
| 408 | if (trust != X509_TRUST_TRUSTED |
| 409 | && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) |
| 410 | && !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) { |
| 411 | while (j-- > 1) { |
| 412 | xtmp2 = sk_X509_value(ctx->chain, j - 1); |
| 413 | ok = ctx->get_issuer(&xtmp, ctx, xtmp2); |
| 414 | if (ok < 0) |
| 415 | goto end; |
| 416 | /* Check if we found an alternate chain */ |
| 417 | if (ok > 0) { |
| 418 | /* |
| 419 | * Free up the found cert we'll add it again later |
| 420 | */ |
| 421 | X509_free(xtmp); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 422 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 423 | /* |
| 424 | * Dump all the certs above this point - we've found an |
| 425 | * alternate chain |
| 426 | */ |
| 427 | while (num > j) { |
| 428 | xtmp = sk_X509_pop(ctx->chain); |
| 429 | X509_free(xtmp); |
| 430 | num--; |
| 431 | } |
| 432 | ctx->last_untrusted = sk_X509_num(ctx->chain); |
| 433 | retry = 1; |
| 434 | break; |
| 435 | } |
| 436 | } |
| 437 | } |
| 438 | } while (retry); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 439 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 440 | /* |
| 441 | * If not explicitly trusted then indicate error unless it's a single |
| 442 | * self signed certificate in which case we've indicated an error already |
| 443 | * and set bad_chain == 1 |
| 444 | */ |
| 445 | if (trust != X509_TRUST_TRUSTED && !bad_chain) { |
| 446 | if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss)) { |
| 447 | if (ctx->last_untrusted >= num) |
| 448 | ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY; |
| 449 | else |
| 450 | ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT; |
| 451 | ctx->current_cert = x; |
| 452 | } else { |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 453 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 454 | sk_X509_push(ctx->chain, chain_ss); |
| 455 | num++; |
| 456 | ctx->last_untrusted = num; |
| 457 | ctx->current_cert = chain_ss; |
| 458 | ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; |
| 459 | chain_ss = NULL; |
| 460 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 461 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 462 | ctx->error_depth = num - 1; |
| 463 | bad_chain = 1; |
| 464 | ok = cb(0, ctx); |
| 465 | if (!ok) |
| 466 | goto end; |
| 467 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 468 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 469 | /* We have the chain complete: now we need to check its purpose */ |
| 470 | ok = check_chain_extensions(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 471 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 472 | if (!ok) |
| 473 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 474 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 475 | /* Check name constraints */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 476 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 477 | ok = check_name_constraints(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 478 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 479 | if (!ok) |
| 480 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 481 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 482 | ok = check_id(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 483 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 484 | if (!ok) |
| 485 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 486 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 487 | /* |
| 488 | * Check revocation status: we do this after copying parameters because |
| 489 | * they may be needed for CRL signature verification. |
| 490 | */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 491 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 492 | ok = ctx->check_revocation(ctx); |
| 493 | if (!ok) |
| 494 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 495 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 496 | int err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, |
| 497 | ctx->param->flags); |
| 498 | if (err != X509_V_OK) { |
| 499 | ctx->error = err; |
| 500 | ctx->current_cert = sk_X509_value(ctx->chain, ctx->error_depth); |
| 501 | ok = cb(0, ctx); |
| 502 | if (!ok) |
| 503 | goto end; |
| 504 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 505 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 506 | /* At this point, we have a chain and need to verify it */ |
| 507 | if (ctx->verify != NULL) |
| 508 | ok = ctx->verify(ctx); |
| 509 | else |
| 510 | ok = internal_verify(ctx); |
| 511 | if (!ok) |
| 512 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 513 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 514 | /* If we get this far evaluate policies */ |
| 515 | if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK)) |
| 516 | ok = ctx->check_policy(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 517 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 518 | end: |
| 519 | if (sktmp != NULL) |
| 520 | sk_X509_free(sktmp); |
| 521 | if (chain_ss != NULL) |
| 522 | X509_free(chain_ss); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 523 | |
| 524 | /* Safety net, error returns must set ctx->error */ |
| 525 | if (ok <= 0 && ctx->error == X509_V_OK) |
| 526 | ctx->error = X509_V_ERR_UNSPECIFIED; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 527 | return ok; |
| 528 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 529 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 530 | /* |
| 531 | * Given a STACK_OF(X509) find the issuer of cert (if any) |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 532 | */ |
| 533 | |
| 534 | static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) |
| 535 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 536 | size_t i; |
| 537 | X509 *issuer; |
| 538 | for (i = 0; i < sk_X509_num(sk); i++) { |
| 539 | issuer = sk_X509_value(sk, i); |
| 540 | if (ctx->check_issued(ctx, x, issuer)) |
| 541 | return issuer; |
| 542 | } |
| 543 | return NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 544 | } |
| 545 | |
| 546 | /* Given a possible certificate and issuer check them */ |
| 547 | |
| 548 | static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) |
| 549 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 550 | int ret; |
| 551 | ret = X509_check_issued(issuer, x); |
| 552 | if (ret == X509_V_OK) |
| 553 | return 1; |
| 554 | /* If we haven't asked for issuer errors don't set ctx */ |
| 555 | if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK)) |
| 556 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 557 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 558 | ctx->error = ret; |
| 559 | ctx->current_cert = x; |
| 560 | ctx->current_issuer = issuer; |
| 561 | return ctx->verify_cb(0, ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 562 | } |
| 563 | |
| 564 | /* Alternative lookup method: look from a STACK stored in other_ctx */ |
| 565 | |
| 566 | static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) |
| 567 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 568 | *issuer = find_issuer(ctx, ctx->other_ctx, x); |
| 569 | if (*issuer) { |
| 570 | X509_up_ref(*issuer); |
| 571 | return 1; |
| 572 | } else |
| 573 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 574 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 575 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 576 | /* |
| 577 | * Check a certificate chains extensions for consistency with the supplied |
| 578 | * purpose |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 579 | */ |
| 580 | |
| 581 | static int check_chain_extensions(X509_STORE_CTX *ctx) |
| 582 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 583 | int i, ok = 0, must_be_ca, plen = 0; |
| 584 | X509 *x; |
| 585 | int (*cb) (int xok, X509_STORE_CTX *xctx); |
| 586 | int proxy_path_length = 0; |
| 587 | int purpose; |
| 588 | int allow_proxy_certs; |
| 589 | cb = ctx->verify_cb; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 590 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 591 | /* |
| 592 | * must_be_ca can have 1 of 3 values: -1: we accept both CA and non-CA |
| 593 | * certificates, to allow direct use of self-signed certificates (which |
| 594 | * are marked as CA). 0: we only accept non-CA certificates. This is |
| 595 | * currently not used, but the possibility is present for future |
| 596 | * extensions. 1: we only accept CA certificates. This is currently used |
| 597 | * for all certificates in the chain except the leaf certificate. |
| 598 | */ |
| 599 | must_be_ca = -1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 600 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 601 | /* CRL path validation */ |
| 602 | if (ctx->parent) { |
| 603 | allow_proxy_certs = 0; |
| 604 | purpose = X509_PURPOSE_CRL_SIGN; |
| 605 | } else { |
| 606 | allow_proxy_certs = |
| 607 | ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 608 | purpose = ctx->param->purpose; |
| 609 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 610 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 611 | /* Check all untrusted certificates */ |
| 612 | for (i = 0; i < ctx->last_untrusted; i++) { |
| 613 | int ret; |
| 614 | x = sk_X509_value(ctx->chain, i); |
| 615 | if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) |
| 616 | && (x->ex_flags & EXFLAG_CRITICAL)) { |
| 617 | ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION; |
| 618 | ctx->error_depth = i; |
| 619 | ctx->current_cert = x; |
| 620 | ok = cb(0, ctx); |
| 621 | if (!ok) |
| 622 | goto end; |
| 623 | } |
| 624 | if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) { |
| 625 | ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED; |
| 626 | ctx->error_depth = i; |
| 627 | ctx->current_cert = x; |
| 628 | ok = cb(0, ctx); |
| 629 | if (!ok) |
| 630 | goto end; |
| 631 | } |
| 632 | ret = X509_check_ca(x); |
| 633 | switch (must_be_ca) { |
| 634 | case -1: |
| 635 | if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) |
| 636 | && (ret != 1) && (ret != 0)) { |
| 637 | ret = 0; |
| 638 | ctx->error = X509_V_ERR_INVALID_CA; |
| 639 | } else |
| 640 | ret = 1; |
| 641 | break; |
| 642 | case 0: |
| 643 | if (ret != 0) { |
| 644 | ret = 0; |
| 645 | ctx->error = X509_V_ERR_INVALID_NON_CA; |
| 646 | } else |
| 647 | ret = 1; |
| 648 | break; |
| 649 | default: |
| 650 | if ((ret == 0) |
| 651 | || ((ctx->param->flags & X509_V_FLAG_X509_STRICT) |
| 652 | && (ret != 1))) { |
| 653 | ret = 0; |
| 654 | ctx->error = X509_V_ERR_INVALID_CA; |
| 655 | } else |
| 656 | ret = 1; |
| 657 | break; |
| 658 | } |
| 659 | if (ret == 0) { |
| 660 | ctx->error_depth = i; |
| 661 | ctx->current_cert = x; |
| 662 | ok = cb(0, ctx); |
| 663 | if (!ok) |
| 664 | goto end; |
| 665 | } |
| 666 | if (ctx->param->purpose > 0) { |
| 667 | ret = X509_check_purpose(x, purpose, must_be_ca > 0); |
| 668 | if ((ret == 0) |
| 669 | || ((ctx->param->flags & X509_V_FLAG_X509_STRICT) |
| 670 | && (ret != 1))) { |
| 671 | ctx->error = X509_V_ERR_INVALID_PURPOSE; |
| 672 | ctx->error_depth = i; |
| 673 | ctx->current_cert = x; |
| 674 | ok = cb(0, ctx); |
| 675 | if (!ok) |
| 676 | goto end; |
| 677 | } |
| 678 | } |
| 679 | /* Check pathlen if not self issued */ |
| 680 | if ((i > 1) && !(x->ex_flags & EXFLAG_SI) |
| 681 | && (x->ex_pathlen != -1) |
| 682 | && (plen > (x->ex_pathlen + proxy_path_length + 1))) { |
| 683 | ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED; |
| 684 | ctx->error_depth = i; |
| 685 | ctx->current_cert = x; |
| 686 | ok = cb(0, ctx); |
| 687 | if (!ok) |
| 688 | goto end; |
| 689 | } |
| 690 | /* Increment path length if not self issued */ |
| 691 | if (!(x->ex_flags & EXFLAG_SI)) |
| 692 | plen++; |
| 693 | /* |
| 694 | * If this certificate is a proxy certificate, the next certificate |
| 695 | * must be another proxy certificate or a EE certificate. If not, |
| 696 | * the next certificate must be a CA certificate. |
| 697 | */ |
| 698 | if (x->ex_flags & EXFLAG_PROXY) { |
| 699 | if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen) { |
| 700 | ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED; |
| 701 | ctx->error_depth = i; |
| 702 | ctx->current_cert = x; |
| 703 | ok = cb(0, ctx); |
| 704 | if (!ok) |
| 705 | goto end; |
| 706 | } |
| 707 | proxy_path_length++; |
| 708 | must_be_ca = 0; |
| 709 | } else |
| 710 | must_be_ca = 1; |
| 711 | } |
| 712 | ok = 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 713 | end: |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 714 | return ok; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 715 | } |
| 716 | |
| 717 | static int check_name_constraints(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 718 | { |
| 719 | X509 *x; |
| 720 | int i, j, rv; |
| 721 | /* Check name constraints for all certificates */ |
| 722 | for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) { |
| 723 | x = sk_X509_value(ctx->chain, i); |
| 724 | /* Ignore self issued certs unless last in chain */ |
| 725 | if (i && (x->ex_flags & EXFLAG_SI)) |
| 726 | continue; |
| 727 | /* |
| 728 | * Check against constraints for all certificates higher in chain |
| 729 | * including trust anchor. Trust anchor not strictly speaking needed |
| 730 | * but if it includes constraints it is to be assumed it expects them |
| 731 | * to be obeyed. |
| 732 | */ |
| 733 | for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) { |
| 734 | NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc; |
| 735 | if (nc) { |
| 736 | rv = NAME_CONSTRAINTS_check(x, nc); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 737 | switch (rv) { |
| 738 | case X509_V_OK: |
| 739 | continue; |
| 740 | case X509_V_ERR_OUT_OF_MEM: |
| 741 | ctx->error = rv; |
| 742 | return 0; |
| 743 | default: |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 744 | ctx->error = rv; |
| 745 | ctx->error_depth = i; |
| 746 | ctx->current_cert = x; |
| 747 | if (!ctx->verify_cb(0, ctx)) |
| 748 | return 0; |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 749 | break; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 750 | } |
| 751 | } |
| 752 | } |
| 753 | } |
| 754 | return 1; |
| 755 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 756 | |
| 757 | static int check_id_error(X509_STORE_CTX *ctx, int errcode) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 758 | { |
| 759 | ctx->error = errcode; |
| 760 | ctx->current_cert = ctx->cert; |
| 761 | ctx->error_depth = 0; |
| 762 | return ctx->verify_cb(0, ctx); |
| 763 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 764 | |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 765 | static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 766 | { |
| 767 | size_t i; |
| 768 | size_t n = sk_OPENSSL_STRING_num(id->hosts); |
| 769 | char *name; |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 770 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 771 | if (id->peername != NULL) { |
| 772 | OPENSSL_free(id->peername); |
| 773 | id->peername = NULL; |
| 774 | } |
| 775 | for (i = 0; i < n; ++i) { |
| 776 | name = sk_OPENSSL_STRING_value(id->hosts, i); |
| 777 | if (X509_check_host(x, name, strlen(name), id->hostflags, |
| 778 | &id->peername) > 0) |
| 779 | return 1; |
| 780 | } |
| 781 | return n == 0; |
| 782 | } |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 783 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 784 | static int check_id(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 785 | { |
| 786 | X509_VERIFY_PARAM *vpm = ctx->param; |
| 787 | X509_VERIFY_PARAM_ID *id = vpm->id; |
| 788 | X509 *x = ctx->cert; |
| 789 | if (id->hosts && check_hosts(x, id) <= 0) { |
| 790 | if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH)) |
| 791 | return 0; |
| 792 | } |
| 793 | if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0) { |
| 794 | if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH)) |
| 795 | return 0; |
| 796 | } |
| 797 | if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0) { |
| 798 | if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH)) |
| 799 | return 0; |
| 800 | } |
| 801 | return 1; |
| 802 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 803 | |
| 804 | static int check_trust(X509_STORE_CTX *ctx) |
| 805 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 806 | size_t i; |
| 807 | int ok; |
| 808 | X509 *x = NULL; |
| 809 | int (*cb) (int xok, X509_STORE_CTX *xctx); |
| 810 | cb = ctx->verify_cb; |
| 811 | /* Check all trusted certificates in chain */ |
| 812 | for (i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) { |
| 813 | x = sk_X509_value(ctx->chain, i); |
| 814 | ok = X509_check_trust(x, ctx->param->trust, 0); |
| 815 | /* If explicitly trusted return trusted */ |
| 816 | if (ok == X509_TRUST_TRUSTED) |
| 817 | return X509_TRUST_TRUSTED; |
| 818 | /* |
| 819 | * If explicitly rejected notify callback and reject if not |
| 820 | * overridden. |
| 821 | */ |
| 822 | if (ok == X509_TRUST_REJECTED) { |
| 823 | ctx->error_depth = i; |
| 824 | ctx->current_cert = x; |
| 825 | ctx->error = X509_V_ERR_CERT_REJECTED; |
| 826 | ok = cb(0, ctx); |
| 827 | if (!ok) |
| 828 | return X509_TRUST_REJECTED; |
| 829 | } |
| 830 | } |
| 831 | /* |
| 832 | * If we accept partial chains and have at least one trusted certificate |
| 833 | * return success. |
| 834 | */ |
| 835 | if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { |
| 836 | X509 *mx; |
| 837 | if (ctx->last_untrusted < (int)sk_X509_num(ctx->chain)) |
| 838 | return X509_TRUST_TRUSTED; |
| 839 | x = sk_X509_value(ctx->chain, 0); |
| 840 | mx = lookup_cert_match(ctx, x); |
| 841 | if (mx) { |
| 842 | (void)sk_X509_set(ctx->chain, 0, mx); |
| 843 | X509_free(x); |
| 844 | ctx->last_untrusted = 0; |
| 845 | return X509_TRUST_TRUSTED; |
| 846 | } |
| 847 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 848 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 849 | /* |
| 850 | * If no trusted certs in chain at all return untrusted and allow |
| 851 | * standard (no issuer cert) etc errors to be indicated. |
| 852 | */ |
| 853 | return X509_TRUST_UNTRUSTED; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 854 | } |
| 855 | |
| 856 | static int check_revocation(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 857 | { |
| 858 | int i, last, ok; |
| 859 | if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK)) |
| 860 | return 1; |
| 861 | if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) |
| 862 | last = sk_X509_num(ctx->chain) - 1; |
| 863 | else { |
| 864 | /* If checking CRL paths this isn't the EE certificate */ |
| 865 | if (ctx->parent) |
| 866 | return 1; |
| 867 | last = 0; |
| 868 | } |
| 869 | for (i = 0; i <= last; i++) { |
| 870 | ctx->error_depth = i; |
| 871 | ok = check_cert(ctx); |
| 872 | if (!ok) |
| 873 | return ok; |
| 874 | } |
| 875 | return 1; |
| 876 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 877 | |
| 878 | static int check_cert(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 879 | { |
| 880 | X509_CRL *crl = NULL, *dcrl = NULL; |
| 881 | X509 *x; |
| 882 | int ok = 0, cnum; |
| 883 | unsigned int last_reasons; |
| 884 | cnum = ctx->error_depth; |
| 885 | x = sk_X509_value(ctx->chain, cnum); |
| 886 | ctx->current_cert = x; |
| 887 | ctx->current_issuer = NULL; |
| 888 | ctx->current_crl_score = 0; |
| 889 | ctx->current_reasons = 0; |
| 890 | while (ctx->current_reasons != CRLDP_ALL_REASONS) { |
| 891 | last_reasons = ctx->current_reasons; |
| 892 | /* Try to retrieve relevant CRL */ |
| 893 | if (ctx->get_crl) |
| 894 | ok = ctx->get_crl(ctx, &crl, x); |
| 895 | else |
| 896 | ok = get_crl_delta(ctx, &crl, &dcrl, x); |
| 897 | /* |
| 898 | * If error looking up CRL, nothing we can do except notify callback |
| 899 | */ |
| 900 | if (!ok) { |
| 901 | ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; |
| 902 | ok = ctx->verify_cb(0, ctx); |
| 903 | goto err; |
| 904 | } |
| 905 | ctx->current_crl = crl; |
| 906 | ok = ctx->check_crl(ctx, crl); |
| 907 | if (!ok) |
| 908 | goto err; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 909 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 910 | if (dcrl) { |
| 911 | ok = ctx->check_crl(ctx, dcrl); |
| 912 | if (!ok) |
| 913 | goto err; |
| 914 | ok = ctx->cert_crl(ctx, dcrl, x); |
| 915 | if (!ok) |
| 916 | goto err; |
| 917 | } else |
| 918 | ok = 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 919 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 920 | /* Don't look in full CRL if delta reason is removefromCRL */ |
| 921 | if (ok != 2) { |
| 922 | ok = ctx->cert_crl(ctx, crl, x); |
| 923 | if (!ok) |
| 924 | goto err; |
| 925 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 926 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 927 | X509_CRL_free(crl); |
| 928 | X509_CRL_free(dcrl); |
| 929 | crl = NULL; |
| 930 | dcrl = NULL; |
| 931 | /* |
| 932 | * If reasons not updated we wont get anywhere by another iteration, |
| 933 | * so exit loop. |
| 934 | */ |
| 935 | if (last_reasons == ctx->current_reasons) { |
| 936 | ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; |
| 937 | ok = ctx->verify_cb(0, ctx); |
| 938 | goto err; |
| 939 | } |
| 940 | } |
| 941 | err: |
| 942 | X509_CRL_free(crl); |
| 943 | X509_CRL_free(dcrl); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 944 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 945 | ctx->current_crl = NULL; |
| 946 | return ok; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 947 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 948 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 949 | |
| 950 | /* Check CRL times against values in X509_STORE_CTX */ |
| 951 | |
| 952 | static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 953 | { |
| 954 | time_t *ptime; |
| 955 | int i; |
| 956 | if (notify) |
| 957 | ctx->current_crl = crl; |
| 958 | if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) |
| 959 | ptime = &ctx->param->check_time; |
| 960 | else |
| 961 | ptime = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 962 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 963 | i = X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime); |
| 964 | if (i == 0) { |
| 965 | if (!notify) |
| 966 | return 0; |
| 967 | ctx->error = X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD; |
| 968 | if (!ctx->verify_cb(0, ctx)) |
| 969 | return 0; |
| 970 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 971 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 972 | if (i > 0) { |
| 973 | if (!notify) |
| 974 | return 0; |
| 975 | ctx->error = X509_V_ERR_CRL_NOT_YET_VALID; |
| 976 | if (!ctx->verify_cb(0, ctx)) |
| 977 | return 0; |
| 978 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 979 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 980 | if (X509_CRL_get_nextUpdate(crl)) { |
| 981 | i = X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 982 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 983 | if (i == 0) { |
| 984 | if (!notify) |
| 985 | return 0; |
| 986 | ctx->error = X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD; |
| 987 | if (!ctx->verify_cb(0, ctx)) |
| 988 | return 0; |
| 989 | } |
| 990 | /* Ignore expiry of base CRL is delta is valid */ |
| 991 | if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) { |
| 992 | if (!notify) |
| 993 | return 0; |
| 994 | ctx->error = X509_V_ERR_CRL_HAS_EXPIRED; |
| 995 | if (!ctx->verify_cb(0, ctx)) |
| 996 | return 0; |
| 997 | } |
| 998 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 999 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1000 | if (notify) |
| 1001 | ctx->current_crl = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1002 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1003 | return 1; |
| 1004 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1005 | |
| 1006 | static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1007 | X509 **pissuer, int *pscore, unsigned int *preasons, |
| 1008 | STACK_OF(X509_CRL) *crls) |
| 1009 | { |
| 1010 | int crl_score, best_score = *pscore; |
| 1011 | size_t i; |
| 1012 | unsigned int reasons, best_reasons = 0; |
| 1013 | X509 *x = ctx->current_cert; |
| 1014 | X509_CRL *crl, *best_crl = NULL; |
| 1015 | X509 *crl_issuer = NULL, *best_crl_issuer = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1016 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1017 | for (i = 0; i < sk_X509_CRL_num(crls); i++) { |
| 1018 | crl = sk_X509_CRL_value(crls, i); |
| 1019 | reasons = *preasons; |
| 1020 | crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x); |
Steven Valdez | bb1ceac | 2016-10-07 10:34:51 -0400 | [diff] [blame] | 1021 | if (crl_score < best_score || crl_score == 0) |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 1022 | continue; |
| 1023 | /* If current CRL is equivalent use it if it is newer */ |
Steven Valdez | bb1ceac | 2016-10-07 10:34:51 -0400 | [diff] [blame] | 1024 | if (crl_score == best_score && best_crl != NULL) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 1025 | int day, sec; |
| 1026 | if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), |
| 1027 | X509_CRL_get_lastUpdate(crl)) == 0) |
| 1028 | continue; |
| 1029 | /* |
| 1030 | * ASN1_TIME_diff never returns inconsistent signs for |day| |
| 1031 | * and |sec|. |
| 1032 | */ |
| 1033 | if (day <= 0 && sec <= 0) |
| 1034 | continue; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1035 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 1036 | best_crl = crl; |
| 1037 | best_crl_issuer = crl_issuer; |
| 1038 | best_score = crl_score; |
| 1039 | best_reasons = reasons; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1040 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1041 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1042 | if (best_crl) { |
| 1043 | if (*pcrl) |
| 1044 | X509_CRL_free(*pcrl); |
| 1045 | *pcrl = best_crl; |
| 1046 | *pissuer = best_crl_issuer; |
| 1047 | *pscore = best_score; |
| 1048 | *preasons = best_reasons; |
| 1049 | X509_CRL_up_ref(best_crl); |
| 1050 | if (*pdcrl) { |
| 1051 | X509_CRL_free(*pdcrl); |
| 1052 | *pdcrl = NULL; |
| 1053 | } |
| 1054 | get_delta_sk(ctx, pdcrl, pscore, best_crl, crls); |
| 1055 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1056 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1057 | if (best_score >= CRL_SCORE_VALID) |
| 1058 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1059 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1060 | return 0; |
| 1061 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1062 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1063 | /* |
| 1064 | * Compare two CRL extensions for delta checking purposes. They should be |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1065 | * both present or both absent. If both present all fields must be identical. |
| 1066 | */ |
| 1067 | |
| 1068 | static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1069 | { |
| 1070 | ASN1_OCTET_STRING *exta, *extb; |
| 1071 | int i; |
| 1072 | i = X509_CRL_get_ext_by_NID(a, nid, -1); |
| 1073 | if (i >= 0) { |
| 1074 | /* Can't have multiple occurrences */ |
| 1075 | if (X509_CRL_get_ext_by_NID(a, nid, i) != -1) |
| 1076 | return 0; |
| 1077 | exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i)); |
| 1078 | } else |
| 1079 | exta = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1080 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1081 | i = X509_CRL_get_ext_by_NID(b, nid, -1); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1082 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1083 | if (i >= 0) { |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1084 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1085 | if (X509_CRL_get_ext_by_NID(b, nid, i) != -1) |
| 1086 | return 0; |
| 1087 | extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i)); |
| 1088 | } else |
| 1089 | extb = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1090 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1091 | if (!exta && !extb) |
| 1092 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1093 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1094 | if (!exta || !extb) |
| 1095 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1096 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1097 | if (ASN1_OCTET_STRING_cmp(exta, extb)) |
| 1098 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1099 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1100 | return 1; |
| 1101 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1102 | |
| 1103 | /* See if a base and delta are compatible */ |
| 1104 | |
| 1105 | static int check_delta_base(X509_CRL *delta, X509_CRL *base) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1106 | { |
| 1107 | /* Delta CRL must be a delta */ |
| 1108 | if (!delta->base_crl_number) |
| 1109 | return 0; |
| 1110 | /* Base must have a CRL number */ |
| 1111 | if (!base->crl_number) |
| 1112 | return 0; |
| 1113 | /* Issuer names must match */ |
| 1114 | if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(delta))) |
| 1115 | return 0; |
| 1116 | /* AKID and IDP must match */ |
| 1117 | if (!crl_extension_match(delta, base, NID_authority_key_identifier)) |
| 1118 | return 0; |
| 1119 | if (!crl_extension_match(delta, base, NID_issuing_distribution_point)) |
| 1120 | return 0; |
| 1121 | /* Delta CRL base number must not exceed Full CRL number. */ |
| 1122 | if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0) |
| 1123 | return 0; |
| 1124 | /* Delta CRL number must exceed full CRL number */ |
| 1125 | if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0) |
| 1126 | return 1; |
| 1127 | return 0; |
| 1128 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1129 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1130 | /* |
| 1131 | * For a given base CRL find a delta... maybe extend to delta scoring or |
| 1132 | * retrieve a chain of deltas... |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1133 | */ |
| 1134 | |
| 1135 | static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1136 | X509_CRL *base, STACK_OF(X509_CRL) *crls) |
| 1137 | { |
| 1138 | X509_CRL *delta; |
| 1139 | size_t i; |
| 1140 | if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS)) |
| 1141 | return; |
| 1142 | if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST)) |
| 1143 | return; |
| 1144 | for (i = 0; i < sk_X509_CRL_num(crls); i++) { |
| 1145 | delta = sk_X509_CRL_value(crls, i); |
| 1146 | if (check_delta_base(delta, base)) { |
| 1147 | if (check_crl_time(ctx, delta, 0)) |
| 1148 | *pscore |= CRL_SCORE_TIME_DELTA; |
| 1149 | X509_CRL_up_ref(delta); |
| 1150 | *dcrl = delta; |
| 1151 | return; |
| 1152 | } |
| 1153 | } |
| 1154 | *dcrl = NULL; |
| 1155 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1156 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1157 | /* |
| 1158 | * For a given CRL return how suitable it is for the supplied certificate |
| 1159 | * 'x'. The return value is a mask of several criteria. If the issuer is not |
| 1160 | * the certificate issuer this is returned in *pissuer. The reasons mask is |
| 1161 | * also used to determine if the CRL is suitable: if no new reasons the CRL |
| 1162 | * is rejected, otherwise reasons is updated. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1163 | */ |
| 1164 | |
| 1165 | static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1166 | unsigned int *preasons, X509_CRL *crl, X509 *x) |
| 1167 | { |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1168 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1169 | int crl_score = 0; |
| 1170 | unsigned int tmp_reasons = *preasons, crl_reasons; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1171 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1172 | /* First see if we can reject CRL straight away */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1173 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1174 | /* Invalid IDP cannot be processed */ |
| 1175 | if (crl->idp_flags & IDP_INVALID) |
| 1176 | return 0; |
| 1177 | /* Reason codes or indirect CRLs need extended CRL support */ |
| 1178 | if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) { |
| 1179 | if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS)) |
| 1180 | return 0; |
| 1181 | } else if (crl->idp_flags & IDP_REASONS) { |
| 1182 | /* If no new reasons reject */ |
| 1183 | if (!(crl->idp_reasons & ~tmp_reasons)) |
| 1184 | return 0; |
| 1185 | } |
| 1186 | /* Don't process deltas at this stage */ |
| 1187 | else if (crl->base_crl_number) |
| 1188 | return 0; |
| 1189 | /* If issuer name doesn't match certificate need indirect CRL */ |
| 1190 | if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) { |
| 1191 | if (!(crl->idp_flags & IDP_INDIRECT)) |
| 1192 | return 0; |
| 1193 | } else |
| 1194 | crl_score |= CRL_SCORE_ISSUER_NAME; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1195 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1196 | if (!(crl->flags & EXFLAG_CRITICAL)) |
| 1197 | crl_score |= CRL_SCORE_NOCRITICAL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1198 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1199 | /* Check expiry */ |
| 1200 | if (check_crl_time(ctx, crl, 0)) |
| 1201 | crl_score |= CRL_SCORE_TIME; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1202 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1203 | /* Check authority key ID and locate certificate issuer */ |
| 1204 | crl_akid_check(ctx, crl, pissuer, &crl_score); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1205 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1206 | /* If we can't locate certificate issuer at this point forget it */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1207 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1208 | if (!(crl_score & CRL_SCORE_AKID)) |
| 1209 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1210 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1211 | /* Check cert for matching CRL distribution points */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1212 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1213 | if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) { |
| 1214 | /* If no new reasons reject */ |
| 1215 | if (!(crl_reasons & ~tmp_reasons)) |
| 1216 | return 0; |
| 1217 | tmp_reasons |= crl_reasons; |
| 1218 | crl_score |= CRL_SCORE_SCOPE; |
| 1219 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1220 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1221 | *preasons = tmp_reasons; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1222 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1223 | return crl_score; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1224 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1225 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1226 | |
| 1227 | static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1228 | X509 **pissuer, int *pcrl_score) |
| 1229 | { |
| 1230 | X509 *crl_issuer = NULL; |
| 1231 | X509_NAME *cnm = X509_CRL_get_issuer(crl); |
| 1232 | int cidx = ctx->error_depth; |
| 1233 | size_t i; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1234 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1235 | if ((size_t)cidx != sk_X509_num(ctx->chain) - 1) |
| 1236 | cidx++; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1237 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1238 | crl_issuer = sk_X509_value(ctx->chain, cidx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1239 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1240 | if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { |
| 1241 | if (*pcrl_score & CRL_SCORE_ISSUER_NAME) { |
| 1242 | *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_ISSUER_CERT; |
| 1243 | *pissuer = crl_issuer; |
| 1244 | return; |
| 1245 | } |
| 1246 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1247 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1248 | for (cidx++; cidx < (int)sk_X509_num(ctx->chain); cidx++) { |
| 1249 | crl_issuer = sk_X509_value(ctx->chain, cidx); |
| 1250 | if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) |
| 1251 | continue; |
| 1252 | if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { |
| 1253 | *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_SAME_PATH; |
| 1254 | *pissuer = crl_issuer; |
| 1255 | return; |
| 1256 | } |
| 1257 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1258 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1259 | /* Anything else needs extended CRL support */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1260 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1261 | if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) |
| 1262 | return; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1263 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1264 | /* |
| 1265 | * Otherwise the CRL issuer is not on the path. Look for it in the set of |
| 1266 | * untrusted certificates. |
| 1267 | */ |
| 1268 | for (i = 0; i < sk_X509_num(ctx->untrusted); i++) { |
| 1269 | crl_issuer = sk_X509_value(ctx->untrusted, i); |
| 1270 | if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) |
| 1271 | continue; |
| 1272 | if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { |
| 1273 | *pissuer = crl_issuer; |
| 1274 | *pcrl_score |= CRL_SCORE_AKID; |
| 1275 | return; |
| 1276 | } |
| 1277 | } |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 1278 | |
| 1279 | for (i = 0; i < sk_X509_num(ctx->ctx->additional_untrusted); i++) { |
| 1280 | crl_issuer = sk_X509_value(ctx->ctx->additional_untrusted, i); |
| 1281 | if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) |
| 1282 | continue; |
| 1283 | if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { |
| 1284 | *pissuer = crl_issuer; |
| 1285 | *pcrl_score |= CRL_SCORE_AKID; |
| 1286 | return; |
| 1287 | } |
| 1288 | } |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1289 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1290 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1291 | /* |
| 1292 | * Check the path of a CRL issuer certificate. This creates a new |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1293 | * X509_STORE_CTX and populates it with most of the parameters from the |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1294 | * parent. This could be optimised somewhat since a lot of path checking will |
| 1295 | * be duplicated by the parent, but this will rarely be used in practice. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1296 | */ |
| 1297 | |
| 1298 | static int check_crl_path(X509_STORE_CTX *ctx, X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1299 | { |
| 1300 | X509_STORE_CTX crl_ctx; |
| 1301 | int ret; |
| 1302 | /* Don't allow recursive CRL path validation */ |
| 1303 | if (ctx->parent) |
| 1304 | return 0; |
| 1305 | if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted)) |
| 1306 | return -1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1307 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1308 | crl_ctx.crls = ctx->crls; |
| 1309 | /* Copy verify params across */ |
| 1310 | X509_STORE_CTX_set0_param(&crl_ctx, ctx->param); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1311 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1312 | crl_ctx.parent = ctx; |
| 1313 | crl_ctx.verify_cb = ctx->verify_cb; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1314 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1315 | /* Verify CRL issuer */ |
| 1316 | ret = X509_verify_cert(&crl_ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1317 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1318 | if (ret <= 0) |
| 1319 | goto err; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1320 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1321 | /* Check chain is acceptable */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1322 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1323 | ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain); |
| 1324 | err: |
| 1325 | X509_STORE_CTX_cleanup(&crl_ctx); |
| 1326 | return ret; |
| 1327 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1328 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1329 | /* |
| 1330 | * RFC3280 says nothing about the relationship between CRL path and |
| 1331 | * certificate path, which could lead to situations where a certificate could |
| 1332 | * be revoked or validated by a CA not authorised to do so. RFC5280 is more |
| 1333 | * strict and states that the two paths must end in the same trust anchor, |
| 1334 | * though some discussions remain... until this is resolved we use the |
| 1335 | * RFC5280 version |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1336 | */ |
| 1337 | |
| 1338 | static int check_crl_chain(X509_STORE_CTX *ctx, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1339 | STACK_OF(X509) *cert_path, |
| 1340 | STACK_OF(X509) *crl_path) |
| 1341 | { |
| 1342 | X509 *cert_ta, *crl_ta; |
| 1343 | cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1); |
| 1344 | crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1); |
| 1345 | if (!X509_cmp(cert_ta, crl_ta)) |
| 1346 | return 1; |
| 1347 | return 0; |
| 1348 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1349 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1350 | /* |
| 1351 | * Check for match between two dist point names: three separate cases. 1. |
| 1352 | * Both are relative names and compare X509_NAME types. 2. One full, one |
| 1353 | * relative. Compare X509_NAME to GENERAL_NAMES. 3. Both are full names and |
| 1354 | * compare two GENERAL_NAMES. 4. One is NULL: automatic match. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1355 | */ |
| 1356 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1357 | static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1358 | { |
| 1359 | X509_NAME *nm = NULL; |
| 1360 | GENERAL_NAMES *gens = NULL; |
| 1361 | GENERAL_NAME *gena, *genb; |
| 1362 | size_t i, j; |
| 1363 | if (!a || !b) |
| 1364 | return 1; |
| 1365 | if (a->type == 1) { |
| 1366 | if (!a->dpname) |
| 1367 | return 0; |
| 1368 | /* Case 1: two X509_NAME */ |
| 1369 | if (b->type == 1) { |
| 1370 | if (!b->dpname) |
| 1371 | return 0; |
| 1372 | if (!X509_NAME_cmp(a->dpname, b->dpname)) |
| 1373 | return 1; |
| 1374 | else |
| 1375 | return 0; |
| 1376 | } |
| 1377 | /* Case 2: set name and GENERAL_NAMES appropriately */ |
| 1378 | nm = a->dpname; |
| 1379 | gens = b->name.fullname; |
| 1380 | } else if (b->type == 1) { |
| 1381 | if (!b->dpname) |
| 1382 | return 0; |
| 1383 | /* Case 2: set name and GENERAL_NAMES appropriately */ |
| 1384 | gens = a->name.fullname; |
| 1385 | nm = b->dpname; |
| 1386 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1387 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1388 | /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */ |
| 1389 | if (nm) { |
| 1390 | for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { |
| 1391 | gena = sk_GENERAL_NAME_value(gens, i); |
| 1392 | if (gena->type != GEN_DIRNAME) |
| 1393 | continue; |
| 1394 | if (!X509_NAME_cmp(nm, gena->d.directoryName)) |
| 1395 | return 1; |
| 1396 | } |
| 1397 | return 0; |
| 1398 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1399 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1400 | /* Else case 3: two GENERAL_NAMES */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1401 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1402 | for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) { |
| 1403 | gena = sk_GENERAL_NAME_value(a->name.fullname, i); |
| 1404 | for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) { |
| 1405 | genb = sk_GENERAL_NAME_value(b->name.fullname, j); |
| 1406 | if (!GENERAL_NAME_cmp(gena, genb)) |
| 1407 | return 1; |
| 1408 | } |
| 1409 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1410 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1411 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1412 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1413 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1414 | |
| 1415 | static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1416 | { |
| 1417 | size_t i; |
| 1418 | X509_NAME *nm = X509_CRL_get_issuer(crl); |
| 1419 | /* If no CRLissuer return is successful iff don't need a match */ |
| 1420 | if (!dp->CRLissuer) |
| 1421 | return ! !(crl_score & CRL_SCORE_ISSUER_NAME); |
| 1422 | for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) { |
| 1423 | GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i); |
| 1424 | if (gen->type != GEN_DIRNAME) |
| 1425 | continue; |
| 1426 | if (!X509_NAME_cmp(gen->d.directoryName, nm)) |
| 1427 | return 1; |
| 1428 | } |
| 1429 | return 0; |
| 1430 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1431 | |
| 1432 | /* Check CRLDP and IDP */ |
| 1433 | |
| 1434 | static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1435 | unsigned int *preasons) |
| 1436 | { |
| 1437 | size_t i; |
| 1438 | if (crl->idp_flags & IDP_ONLYATTR) |
| 1439 | return 0; |
| 1440 | if (x->ex_flags & EXFLAG_CA) { |
| 1441 | if (crl->idp_flags & IDP_ONLYUSER) |
| 1442 | return 0; |
| 1443 | } else { |
| 1444 | if (crl->idp_flags & IDP_ONLYCA) |
| 1445 | return 0; |
| 1446 | } |
| 1447 | *preasons = crl->idp_reasons; |
| 1448 | for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) { |
| 1449 | DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i); |
| 1450 | if (crldp_check_crlissuer(dp, crl, crl_score)) { |
| 1451 | if (!crl->idp || idp_check_dp(dp->distpoint, crl->idp->distpoint)) { |
| 1452 | *preasons &= dp->dp_reasons; |
| 1453 | return 1; |
| 1454 | } |
| 1455 | } |
| 1456 | } |
| 1457 | if ((!crl->idp || !crl->idp->distpoint) |
| 1458 | && (crl_score & CRL_SCORE_ISSUER_NAME)) |
| 1459 | return 1; |
| 1460 | return 0; |
| 1461 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1462 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1463 | /* |
| 1464 | * Retrieve CRL corresponding to current certificate. If deltas enabled try |
| 1465 | * to find a delta CRL too |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1466 | */ |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1467 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1468 | static int get_crl_delta(X509_STORE_CTX *ctx, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1469 | X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x) |
| 1470 | { |
| 1471 | int ok; |
| 1472 | X509 *issuer = NULL; |
| 1473 | int crl_score = 0; |
| 1474 | unsigned int reasons; |
| 1475 | X509_CRL *crl = NULL, *dcrl = NULL; |
| 1476 | STACK_OF(X509_CRL) *skcrl; |
| 1477 | X509_NAME *nm = X509_get_issuer_name(x); |
| 1478 | reasons = ctx->current_reasons; |
| 1479 | ok = get_crl_sk(ctx, &crl, &dcrl, |
| 1480 | &issuer, &crl_score, &reasons, ctx->crls); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1481 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1482 | if (ok) |
| 1483 | goto done; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1484 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1485 | /* Lookup CRLs from store */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1486 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1487 | skcrl = ctx->lookup_crls(ctx, nm); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1488 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1489 | /* If no CRLs found and a near match from get_crl_sk use that */ |
| 1490 | if (!skcrl && crl) |
| 1491 | goto done; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1492 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1493 | get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1494 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1495 | sk_X509_CRL_pop_free(skcrl, X509_CRL_free); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1496 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1497 | done: |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1498 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1499 | /* If we got any kind of CRL use it and return success */ |
| 1500 | if (crl) { |
| 1501 | ctx->current_issuer = issuer; |
| 1502 | ctx->current_crl_score = crl_score; |
| 1503 | ctx->current_reasons = reasons; |
| 1504 | *pcrl = crl; |
| 1505 | *pdcrl = dcrl; |
| 1506 | return 1; |
| 1507 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1508 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1509 | return 0; |
| 1510 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1511 | |
| 1512 | /* Check CRL validity */ |
| 1513 | static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1514 | { |
| 1515 | X509 *issuer = NULL; |
| 1516 | EVP_PKEY *ikey = NULL; |
| 1517 | int ok = 0, chnum, cnum; |
| 1518 | cnum = ctx->error_depth; |
| 1519 | chnum = sk_X509_num(ctx->chain) - 1; |
| 1520 | /* if we have an alternative CRL issuer cert use that */ |
| 1521 | if (ctx->current_issuer) |
| 1522 | issuer = ctx->current_issuer; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1523 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1524 | /* |
| 1525 | * Else find CRL issuer: if not last certificate then issuer is next |
| 1526 | * certificate in chain. |
| 1527 | */ |
| 1528 | else if (cnum < chnum) |
| 1529 | issuer = sk_X509_value(ctx->chain, cnum + 1); |
| 1530 | else { |
| 1531 | issuer = sk_X509_value(ctx->chain, chnum); |
| 1532 | /* If not self signed, can't check signature */ |
| 1533 | if (!ctx->check_issued(ctx, issuer, issuer)) { |
| 1534 | ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER; |
| 1535 | ok = ctx->verify_cb(0, ctx); |
| 1536 | if (!ok) |
| 1537 | goto err; |
| 1538 | } |
| 1539 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1540 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1541 | if (issuer) { |
| 1542 | /* |
| 1543 | * Skip most tests for deltas because they have already been done |
| 1544 | */ |
| 1545 | if (!crl->base_crl_number) { |
| 1546 | /* Check for cRLSign bit if keyUsage present */ |
| 1547 | if ((issuer->ex_flags & EXFLAG_KUSAGE) && |
| 1548 | !(issuer->ex_kusage & KU_CRL_SIGN)) { |
| 1549 | ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN; |
| 1550 | ok = ctx->verify_cb(0, ctx); |
| 1551 | if (!ok) |
| 1552 | goto err; |
| 1553 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1554 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1555 | if (!(ctx->current_crl_score & CRL_SCORE_SCOPE)) { |
| 1556 | ctx->error = X509_V_ERR_DIFFERENT_CRL_SCOPE; |
| 1557 | ok = ctx->verify_cb(0, ctx); |
| 1558 | if (!ok) |
| 1559 | goto err; |
| 1560 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1561 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1562 | if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH)) { |
| 1563 | if (check_crl_path(ctx, ctx->current_issuer) <= 0) { |
| 1564 | ctx->error = X509_V_ERR_CRL_PATH_VALIDATION_ERROR; |
| 1565 | ok = ctx->verify_cb(0, ctx); |
| 1566 | if (!ok) |
| 1567 | goto err; |
| 1568 | } |
| 1569 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1570 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1571 | if (crl->idp_flags & IDP_INVALID) { |
| 1572 | ctx->error = X509_V_ERR_INVALID_EXTENSION; |
| 1573 | ok = ctx->verify_cb(0, ctx); |
| 1574 | if (!ok) |
| 1575 | goto err; |
| 1576 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1577 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1578 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1579 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1580 | if (!(ctx->current_crl_score & CRL_SCORE_TIME)) { |
| 1581 | ok = check_crl_time(ctx, crl, 1); |
| 1582 | if (!ok) |
| 1583 | goto err; |
| 1584 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1585 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1586 | /* Attempt to get issuer certificate public key */ |
| 1587 | ikey = X509_get_pubkey(issuer); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1588 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1589 | if (!ikey) { |
| 1590 | ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY; |
| 1591 | ok = ctx->verify_cb(0, ctx); |
| 1592 | if (!ok) |
| 1593 | goto err; |
| 1594 | } else { |
| 1595 | int rv; |
| 1596 | rv = X509_CRL_check_suiteb(crl, ikey, ctx->param->flags); |
| 1597 | if (rv != X509_V_OK) { |
| 1598 | ctx->error = rv; |
| 1599 | ok = ctx->verify_cb(0, ctx); |
| 1600 | if (!ok) |
| 1601 | goto err; |
| 1602 | } |
| 1603 | /* Verify CRL signature */ |
| 1604 | if (X509_CRL_verify(crl, ikey) <= 0) { |
| 1605 | ctx->error = X509_V_ERR_CRL_SIGNATURE_FAILURE; |
| 1606 | ok = ctx->verify_cb(0, ctx); |
| 1607 | if (!ok) |
| 1608 | goto err; |
| 1609 | } |
| 1610 | } |
| 1611 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1612 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1613 | ok = 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1614 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1615 | err: |
| 1616 | EVP_PKEY_free(ikey); |
| 1617 | return ok; |
| 1618 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1619 | |
| 1620 | /* Check certificate against CRL */ |
| 1621 | static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1622 | { |
| 1623 | int ok; |
| 1624 | X509_REVOKED *rev; |
| 1625 | /* |
| 1626 | * The rules changed for this... previously if a CRL contained unhandled |
| 1627 | * critical extensions it could still be used to indicate a certificate |
| 1628 | * was revoked. This has since been changed since critical extension can |
| 1629 | * change the meaning of CRL entries. |
| 1630 | */ |
| 1631 | if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) |
| 1632 | && (crl->flags & EXFLAG_CRITICAL)) { |
| 1633 | ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION; |
| 1634 | ok = ctx->verify_cb(0, ctx); |
| 1635 | if (!ok) |
| 1636 | return 0; |
| 1637 | } |
| 1638 | /* |
| 1639 | * Look for serial number of certificate in CRL If found make sure reason |
| 1640 | * is not removeFromCRL. |
| 1641 | */ |
| 1642 | if (X509_CRL_get0_by_cert(crl, &rev, x)) { |
| 1643 | if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) |
| 1644 | return 2; |
| 1645 | ctx->error = X509_V_ERR_CERT_REVOKED; |
| 1646 | ok = ctx->verify_cb(0, ctx); |
| 1647 | if (!ok) |
| 1648 | return 0; |
| 1649 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1650 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1651 | return 1; |
| 1652 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1653 | |
| 1654 | static int check_policy(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1655 | { |
| 1656 | int ret; |
| 1657 | if (ctx->parent) |
| 1658 | return 1; |
| 1659 | ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, |
| 1660 | ctx->param->policies, ctx->param->flags); |
| 1661 | if (ret == 0) { |
| 1662 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 1663 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1664 | return 0; |
| 1665 | } |
| 1666 | /* Invalid or inconsistent extensions */ |
| 1667 | if (ret == -1) { |
| 1668 | /* |
| 1669 | * Locate certificates with bad extensions and notify callback. |
| 1670 | */ |
| 1671 | X509 *x; |
| 1672 | size_t i; |
| 1673 | for (i = 1; i < sk_X509_num(ctx->chain); i++) { |
| 1674 | x = sk_X509_value(ctx->chain, i); |
| 1675 | if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) |
| 1676 | continue; |
| 1677 | ctx->current_cert = x; |
| 1678 | ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION; |
| 1679 | if (!ctx->verify_cb(0, ctx)) |
| 1680 | return 0; |
| 1681 | } |
| 1682 | return 1; |
| 1683 | } |
| 1684 | if (ret == -2) { |
| 1685 | ctx->current_cert = NULL; |
| 1686 | ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY; |
| 1687 | return ctx->verify_cb(0, ctx); |
| 1688 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1689 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1690 | if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) { |
| 1691 | ctx->current_cert = NULL; |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 1692 | /* |
| 1693 | * Verification errors need to be "sticky", a callback may have allowed |
| 1694 | * an SSL handshake to continue despite an error, and we must then |
| 1695 | * remain in an error state. Therefore, we MUST NOT clear earlier |
| 1696 | * verification errors by setting the error to X509_V_OK. |
| 1697 | */ |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1698 | if (!ctx->verify_cb(2, ctx)) |
| 1699 | return 0; |
| 1700 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1701 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1702 | return 1; |
| 1703 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1704 | |
| 1705 | static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1706 | { |
| 1707 | time_t *ptime; |
| 1708 | int i; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1709 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1710 | if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) |
| 1711 | ptime = &ctx->param->check_time; |
| 1712 | else |
| 1713 | ptime = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1714 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1715 | i = X509_cmp_time(X509_get_notBefore(x), ptime); |
| 1716 | if (i == 0) { |
| 1717 | ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD; |
| 1718 | ctx->current_cert = x; |
| 1719 | if (!ctx->verify_cb(0, ctx)) |
| 1720 | return 0; |
| 1721 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1722 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1723 | if (i > 0) { |
| 1724 | ctx->error = X509_V_ERR_CERT_NOT_YET_VALID; |
| 1725 | ctx->current_cert = x; |
| 1726 | if (!ctx->verify_cb(0, ctx)) |
| 1727 | return 0; |
| 1728 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1729 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1730 | i = X509_cmp_time(X509_get_notAfter(x), ptime); |
| 1731 | if (i == 0) { |
| 1732 | ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD; |
| 1733 | ctx->current_cert = x; |
| 1734 | if (!ctx->verify_cb(0, ctx)) |
| 1735 | return 0; |
| 1736 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1737 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1738 | if (i < 0) { |
| 1739 | ctx->error = X509_V_ERR_CERT_HAS_EXPIRED; |
| 1740 | ctx->current_cert = x; |
| 1741 | if (!ctx->verify_cb(0, ctx)) |
| 1742 | return 0; |
| 1743 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1744 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1745 | return 1; |
| 1746 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1747 | |
| 1748 | static int internal_verify(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1749 | { |
| 1750 | int ok = 0, n; |
| 1751 | X509 *xs, *xi; |
| 1752 | EVP_PKEY *pkey = NULL; |
| 1753 | int (*cb) (int xok, X509_STORE_CTX *xctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1754 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1755 | cb = ctx->verify_cb; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1756 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1757 | n = sk_X509_num(ctx->chain); |
| 1758 | ctx->error_depth = n - 1; |
| 1759 | n--; |
| 1760 | xi = sk_X509_value(ctx->chain, n); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1761 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1762 | if (ctx->check_issued(ctx, xi, xi)) |
| 1763 | xs = xi; |
| 1764 | else { |
| 1765 | if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { |
| 1766 | xs = xi; |
| 1767 | goto check_cert; |
| 1768 | } |
| 1769 | if (n <= 0) { |
| 1770 | ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE; |
| 1771 | ctx->current_cert = xi; |
| 1772 | ok = cb(0, ctx); |
| 1773 | goto end; |
| 1774 | } else { |
| 1775 | n--; |
| 1776 | ctx->error_depth = n; |
| 1777 | xs = sk_X509_value(ctx->chain, n); |
| 1778 | } |
| 1779 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1780 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1781 | /* ctx->error=0; not needed */ |
| 1782 | while (n >= 0) { |
| 1783 | ctx->error_depth = n; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1784 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1785 | /* |
| 1786 | * Skip signature check for self signed certificates unless |
| 1787 | * explicitly asked for. It doesn't add any security and just wastes |
| 1788 | * time. |
| 1789 | */ |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 1790 | if (xs != xi || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)) { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1791 | if ((pkey = X509_get_pubkey(xi)) == NULL) { |
| 1792 | ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY; |
| 1793 | ctx->current_cert = xi; |
| 1794 | ok = (*cb) (0, ctx); |
| 1795 | if (!ok) |
| 1796 | goto end; |
| 1797 | } else if (X509_verify(xs, pkey) <= 0) { |
| 1798 | ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE; |
| 1799 | ctx->current_cert = xs; |
| 1800 | ok = (*cb) (0, ctx); |
| 1801 | if (!ok) { |
| 1802 | EVP_PKEY_free(pkey); |
| 1803 | goto end; |
| 1804 | } |
| 1805 | } |
| 1806 | EVP_PKEY_free(pkey); |
| 1807 | pkey = NULL; |
| 1808 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1809 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1810 | check_cert: |
| 1811 | ok = check_cert_time(ctx, xs); |
| 1812 | if (!ok) |
| 1813 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1814 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1815 | /* The last error (if any) is still in the error value */ |
| 1816 | ctx->current_issuer = xi; |
| 1817 | ctx->current_cert = xs; |
| 1818 | ok = (*cb) (1, ctx); |
| 1819 | if (!ok) |
| 1820 | goto end; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1821 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1822 | n--; |
| 1823 | if (n >= 0) { |
| 1824 | xi = xs; |
| 1825 | xs = sk_X509_value(ctx->chain, n); |
| 1826 | } |
| 1827 | } |
| 1828 | ok = 1; |
| 1829 | end: |
| 1830 | return ok; |
| 1831 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1832 | |
| 1833 | int X509_cmp_current_time(const ASN1_TIME *ctm) |
| 1834 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1835 | return X509_cmp_time(ctm, NULL); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1836 | } |
| 1837 | |
| 1838 | int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1839 | { |
| 1840 | char *str; |
| 1841 | ASN1_TIME atm; |
| 1842 | long offset; |
| 1843 | char buff1[24], buff2[24], *p; |
| 1844 | int i, j, remaining; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1845 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1846 | p = buff1; |
| 1847 | remaining = ctm->length; |
| 1848 | str = (char *)ctm->data; |
| 1849 | /* |
| 1850 | * Note that the following (historical) code allows much more slack in |
| 1851 | * the time format than RFC5280. In RFC5280, the representation is fixed: |
| 1852 | * UTCTime: YYMMDDHHMMSSZ GeneralizedTime: YYYYMMDDHHMMSSZ |
| 1853 | */ |
| 1854 | if (ctm->type == V_ASN1_UTCTIME) { |
| 1855 | /* YYMMDDHHMM[SS]Z or YYMMDDHHMM[SS](+-)hhmm */ |
| 1856 | int min_length = sizeof("YYMMDDHHMMZ") - 1; |
| 1857 | int max_length = sizeof("YYMMDDHHMMSS+hhmm") - 1; |
| 1858 | if (remaining < min_length || remaining > max_length) |
| 1859 | return 0; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 1860 | OPENSSL_memcpy(p, str, 10); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1861 | p += 10; |
| 1862 | str += 10; |
| 1863 | remaining -= 10; |
| 1864 | } else { |
| 1865 | /* |
| 1866 | * YYYYMMDDHHMM[SS[.fff]]Z or YYYYMMDDHHMM[SS[.f[f[f]]]](+-)hhmm |
| 1867 | */ |
| 1868 | int min_length = sizeof("YYYYMMDDHHMMZ") - 1; |
| 1869 | int max_length = sizeof("YYYYMMDDHHMMSS.fff+hhmm") - 1; |
| 1870 | if (remaining < min_length || remaining > max_length) |
| 1871 | return 0; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 1872 | OPENSSL_memcpy(p, str, 12); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1873 | p += 12; |
| 1874 | str += 12; |
| 1875 | remaining -= 12; |
| 1876 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1877 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1878 | if ((*str == 'Z') || (*str == '-') || (*str == '+')) { |
| 1879 | *(p++) = '0'; |
| 1880 | *(p++) = '0'; |
| 1881 | } else { |
| 1882 | /* SS (seconds) */ |
| 1883 | if (remaining < 2) |
| 1884 | return 0; |
| 1885 | *(p++) = *(str++); |
| 1886 | *(p++) = *(str++); |
| 1887 | remaining -= 2; |
| 1888 | /* |
| 1889 | * Skip any (up to three) fractional seconds... TODO(emilia): in |
| 1890 | * RFC5280, fractional seconds are forbidden. Can we just kill them |
| 1891 | * altogether? |
| 1892 | */ |
| 1893 | if (remaining && *str == '.') { |
| 1894 | str++; |
| 1895 | remaining--; |
| 1896 | for (i = 0; i < 3 && remaining; i++, str++, remaining--) { |
| 1897 | if (*str < '0' || *str > '9') |
| 1898 | break; |
| 1899 | } |
| 1900 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1901 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1902 | } |
| 1903 | *(p++) = 'Z'; |
| 1904 | *(p++) = '\0'; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1905 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1906 | /* We now need either a terminating 'Z' or an offset. */ |
| 1907 | if (!remaining) |
| 1908 | return 0; |
| 1909 | if (*str == 'Z') { |
| 1910 | if (remaining != 1) |
| 1911 | return 0; |
| 1912 | offset = 0; |
| 1913 | } else { |
| 1914 | /* (+-)HHMM */ |
| 1915 | if ((*str != '+') && (*str != '-')) |
| 1916 | return 0; |
| 1917 | /* |
| 1918 | * Historical behaviour: the (+-)hhmm offset is forbidden in RFC5280. |
| 1919 | */ |
| 1920 | if (remaining != 5) |
| 1921 | return 0; |
| 1922 | if (str[1] < '0' || str[1] > '9' || str[2] < '0' || str[2] > '9' || |
| 1923 | str[3] < '0' || str[3] > '9' || str[4] < '0' || str[4] > '9') |
| 1924 | return 0; |
| 1925 | offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60; |
| 1926 | offset += (str[3] - '0') * 10 + (str[4] - '0'); |
| 1927 | if (*str == '-') |
| 1928 | offset = -offset; |
| 1929 | } |
| 1930 | atm.type = ctm->type; |
| 1931 | atm.flags = 0; |
| 1932 | atm.length = sizeof(buff2); |
| 1933 | atm.data = (unsigned char *)buff2; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1934 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1935 | if (X509_time_adj(&atm, offset * 60, cmp_time) == NULL) |
| 1936 | return 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1937 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1938 | if (ctm->type == V_ASN1_UTCTIME) { |
| 1939 | i = (buff1[0] - '0') * 10 + (buff1[1] - '0'); |
| 1940 | if (i < 50) |
| 1941 | i += 100; /* cf. RFC 2459 */ |
| 1942 | j = (buff2[0] - '0') * 10 + (buff2[1] - '0'); |
| 1943 | if (j < 50) |
| 1944 | j += 100; |
| 1945 | |
| 1946 | if (i < j) |
| 1947 | return -1; |
| 1948 | if (i > j) |
| 1949 | return 1; |
| 1950 | } |
| 1951 | i = strcmp(buff1, buff2); |
| 1952 | if (i == 0) /* wait a second then return younger :-) */ |
| 1953 | return -1; |
| 1954 | else |
| 1955 | return i; |
| 1956 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1957 | |
| 1958 | ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj) |
| 1959 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1960 | return X509_time_adj(s, adj, NULL); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1961 | } |
| 1962 | |
| 1963 | ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1964 | { |
| 1965 | return X509_time_adj_ex(s, 0, offset_sec, in_tm); |
| 1966 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1967 | |
| 1968 | ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1969 | int offset_day, long offset_sec, time_t *in_tm) |
| 1970 | { |
| 1971 | time_t t = 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1972 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1973 | if (in_tm) |
| 1974 | t = *in_tm; |
| 1975 | else |
| 1976 | time(&t); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1977 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1978 | if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) { |
| 1979 | if (s->type == V_ASN1_UTCTIME) |
| 1980 | return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec); |
| 1981 | if (s->type == V_ASN1_GENERALIZEDTIME) |
| 1982 | return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec); |
| 1983 | } |
| 1984 | return ASN1_TIME_adj(s, t, offset_day, offset_sec); |
| 1985 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1986 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1987 | /* Make a delta CRL as the diff between two full CRLs */ |
| 1988 | |
| 1989 | X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 1990 | EVP_PKEY *skey, const EVP_MD *md, unsigned int flags) |
| 1991 | { |
| 1992 | X509_CRL *crl = NULL; |
| 1993 | int i; |
| 1994 | size_t j; |
| 1995 | STACK_OF(X509_REVOKED) *revs = NULL; |
| 1996 | /* CRLs can't be delta already */ |
| 1997 | if (base->base_crl_number || newer->base_crl_number) { |
| 1998 | OPENSSL_PUT_ERROR(X509, X509_R_CRL_ALREADY_DELTA); |
| 1999 | return NULL; |
| 2000 | } |
| 2001 | /* Base and new CRL must have a CRL number */ |
| 2002 | if (!base->crl_number || !newer->crl_number) { |
| 2003 | OPENSSL_PUT_ERROR(X509, X509_R_NO_CRL_NUMBER); |
| 2004 | return NULL; |
| 2005 | } |
| 2006 | /* Issuer names must match */ |
| 2007 | if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(newer))) { |
| 2008 | OPENSSL_PUT_ERROR(X509, X509_R_ISSUER_MISMATCH); |
| 2009 | return NULL; |
| 2010 | } |
| 2011 | /* AKID and IDP must match */ |
| 2012 | if (!crl_extension_match(base, newer, NID_authority_key_identifier)) { |
| 2013 | OPENSSL_PUT_ERROR(X509, X509_R_AKID_MISMATCH); |
| 2014 | return NULL; |
| 2015 | } |
| 2016 | if (!crl_extension_match(base, newer, NID_issuing_distribution_point)) { |
| 2017 | OPENSSL_PUT_ERROR(X509, X509_R_IDP_MISMATCH); |
| 2018 | return NULL; |
| 2019 | } |
| 2020 | /* Newer CRL number must exceed full CRL number */ |
| 2021 | if (ASN1_INTEGER_cmp(newer->crl_number, base->crl_number) <= 0) { |
| 2022 | OPENSSL_PUT_ERROR(X509, X509_R_NEWER_CRL_NOT_NEWER); |
| 2023 | return NULL; |
| 2024 | } |
| 2025 | /* CRLs must verify */ |
| 2026 | if (skey && (X509_CRL_verify(base, skey) <= 0 || |
| 2027 | X509_CRL_verify(newer, skey) <= 0)) { |
| 2028 | OPENSSL_PUT_ERROR(X509, X509_R_CRL_VERIFY_FAILURE); |
| 2029 | return NULL; |
| 2030 | } |
| 2031 | /* Create new CRL */ |
| 2032 | crl = X509_CRL_new(); |
| 2033 | if (!crl || !X509_CRL_set_version(crl, 1)) |
| 2034 | goto memerr; |
| 2035 | /* Set issuer name */ |
| 2036 | if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer))) |
| 2037 | goto memerr; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2038 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2039 | if (!X509_CRL_set_lastUpdate(crl, X509_CRL_get_lastUpdate(newer))) |
| 2040 | goto memerr; |
| 2041 | if (!X509_CRL_set_nextUpdate(crl, X509_CRL_get_nextUpdate(newer))) |
| 2042 | goto memerr; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2043 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2044 | /* Set base CRL number: must be critical */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2045 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2046 | if (!X509_CRL_add1_ext_i2d(crl, NID_delta_crl, base->crl_number, 1, 0)) |
| 2047 | goto memerr; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2048 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2049 | /* |
| 2050 | * Copy extensions across from newest CRL to delta: this will set CRL |
| 2051 | * number to correct value too. |
| 2052 | */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2053 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2054 | for (i = 0; i < X509_CRL_get_ext_count(newer); i++) { |
| 2055 | X509_EXTENSION *ext; |
| 2056 | ext = X509_CRL_get_ext(newer, i); |
| 2057 | if (!X509_CRL_add_ext(crl, ext, -1)) |
| 2058 | goto memerr; |
| 2059 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2060 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2061 | /* Go through revoked entries, copying as needed */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2062 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2063 | revs = X509_CRL_get_REVOKED(newer); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2064 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2065 | for (j = 0; j < sk_X509_REVOKED_num(revs); j++) { |
| 2066 | X509_REVOKED *rvn, *rvtmp; |
| 2067 | rvn = sk_X509_REVOKED_value(revs, j); |
| 2068 | /* |
| 2069 | * Add only if not also in base. TODO: need something cleverer here |
| 2070 | * for some more complex CRLs covering multiple CAs. |
| 2071 | */ |
| 2072 | if (!X509_CRL_get0_by_serial(base, &rvtmp, rvn->serialNumber)) { |
| 2073 | rvtmp = X509_REVOKED_dup(rvn); |
| 2074 | if (!rvtmp) |
| 2075 | goto memerr; |
| 2076 | if (!X509_CRL_add0_revoked(crl, rvtmp)) { |
| 2077 | X509_REVOKED_free(rvtmp); |
| 2078 | goto memerr; |
| 2079 | } |
| 2080 | } |
| 2081 | } |
| 2082 | /* TODO: optionally prune deleted entries */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2083 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2084 | if (skey && md && !X509_CRL_sign(crl, skey, md)) |
| 2085 | goto memerr; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2086 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2087 | return crl; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2088 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2089 | memerr: |
| 2090 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
| 2091 | if (crl) |
| 2092 | X509_CRL_free(crl); |
| 2093 | return NULL; |
| 2094 | } |
| 2095 | |
| 2096 | int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, |
| 2097 | CRYPTO_EX_unused * unused, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 2098 | CRYPTO_EX_dup *dup_unused, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2099 | CRYPTO_EX_free *free_func) |
| 2100 | { |
| 2101 | /* |
| 2102 | * This function is (usually) called only once, by |
| 2103 | * SSL_get_ex_data_X509_STORE_CTX_idx (ssl/ssl_cert.c). |
| 2104 | */ |
| 2105 | int index; |
| 2106 | if (!CRYPTO_get_ex_new_index(&g_ex_data_class, &index, argl, argp, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 2107 | free_func)) { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2108 | return -1; |
| 2109 | } |
| 2110 | return index; |
| 2111 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2112 | |
| 2113 | int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2114 | { |
| 2115 | return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); |
| 2116 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2117 | |
| 2118 | void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2119 | { |
| 2120 | return CRYPTO_get_ex_data(&ctx->ex_data, idx); |
| 2121 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2122 | |
| 2123 | int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2124 | { |
| 2125 | return ctx->error; |
| 2126 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2127 | |
| 2128 | void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2129 | { |
| 2130 | ctx->error = err; |
| 2131 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2132 | |
| 2133 | int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2134 | { |
| 2135 | return ctx->error_depth; |
| 2136 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2137 | |
| 2138 | X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2139 | { |
| 2140 | return ctx->current_cert; |
| 2141 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2142 | |
| 2143 | STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2144 | { |
| 2145 | return ctx->chain; |
| 2146 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2147 | |
| 2148 | STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2149 | { |
| 2150 | if (!ctx->chain) |
| 2151 | return NULL; |
| 2152 | return X509_chain_up_ref(ctx->chain); |
| 2153 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2154 | |
| 2155 | X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2156 | { |
| 2157 | return ctx->current_issuer; |
| 2158 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2159 | |
| 2160 | X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2161 | { |
| 2162 | return ctx->current_crl; |
| 2163 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2164 | |
| 2165 | X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2166 | { |
| 2167 | return ctx->parent; |
| 2168 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2169 | |
| 2170 | void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2171 | { |
| 2172 | ctx->cert = x; |
| 2173 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2174 | |
| 2175 | void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2176 | { |
| 2177 | ctx->untrusted = sk; |
| 2178 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2179 | |
| 2180 | void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2181 | { |
| 2182 | ctx->crls = sk; |
| 2183 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2184 | |
| 2185 | int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2186 | { |
| 2187 | return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0); |
| 2188 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2189 | |
| 2190 | int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2191 | { |
| 2192 | return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust); |
| 2193 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2194 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2195 | /* |
| 2196 | * This function is used to set the X509_STORE_CTX purpose and trust values. |
| 2197 | * This is intended to be used when another structure has its own trust and |
| 2198 | * purpose values which (if set) will be inherited by the ctx. If they aren't |
| 2199 | * set then we will usually have a default purpose in mind which should then |
| 2200 | * be used to set the trust value. An example of this is SSL use: an SSL |
| 2201 | * structure will have its own purpose and trust settings which the |
| 2202 | * application can set: if they aren't set then we use the default of SSL |
| 2203 | * client/server. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2204 | */ |
| 2205 | |
| 2206 | int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2207 | int purpose, int trust) |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2208 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2209 | int idx; |
| 2210 | /* If purpose not set use default */ |
| 2211 | if (!purpose) |
| 2212 | purpose = def_purpose; |
| 2213 | /* If we have a purpose then check it is valid */ |
| 2214 | if (purpose) { |
| 2215 | X509_PURPOSE *ptmp; |
| 2216 | idx = X509_PURPOSE_get_by_id(purpose); |
| 2217 | if (idx == -1) { |
| 2218 | OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_PURPOSE_ID); |
| 2219 | return 0; |
| 2220 | } |
| 2221 | ptmp = X509_PURPOSE_get0(idx); |
| 2222 | if (ptmp->trust == X509_TRUST_DEFAULT) { |
| 2223 | idx = X509_PURPOSE_get_by_id(def_purpose); |
| 2224 | if (idx == -1) { |
| 2225 | OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_PURPOSE_ID); |
| 2226 | return 0; |
| 2227 | } |
| 2228 | ptmp = X509_PURPOSE_get0(idx); |
| 2229 | } |
| 2230 | /* If trust not set then get from purpose default */ |
| 2231 | if (!trust) |
| 2232 | trust = ptmp->trust; |
| 2233 | } |
| 2234 | if (trust) { |
| 2235 | idx = X509_TRUST_get_by_id(trust); |
| 2236 | if (idx == -1) { |
| 2237 | OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_TRUST_ID); |
| 2238 | return 0; |
| 2239 | } |
| 2240 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2241 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2242 | if (purpose && !ctx->param->purpose) |
| 2243 | ctx->param->purpose = purpose; |
| 2244 | if (trust && !ctx->param->trust) |
| 2245 | ctx->param->trust = trust; |
| 2246 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2247 | } |
| 2248 | |
| 2249 | X509_STORE_CTX *X509_STORE_CTX_new(void) |
| 2250 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2251 | X509_STORE_CTX *ctx; |
| 2252 | ctx = (X509_STORE_CTX *)OPENSSL_malloc(sizeof(X509_STORE_CTX)); |
| 2253 | if (!ctx) { |
| 2254 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
| 2255 | return NULL; |
| 2256 | } |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 2257 | OPENSSL_memset(ctx, 0, sizeof(X509_STORE_CTX)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2258 | return ctx; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2259 | } |
| 2260 | |
| 2261 | void X509_STORE_CTX_free(X509_STORE_CTX *ctx) |
| 2262 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2263 | if (ctx == NULL) { |
| 2264 | return; |
| 2265 | } |
| 2266 | X509_STORE_CTX_cleanup(ctx); |
| 2267 | OPENSSL_free(ctx); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2268 | } |
| 2269 | |
| 2270 | int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2271 | STACK_OF(X509) *chain) |
| 2272 | { |
| 2273 | int ret = 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2274 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 2275 | OPENSSL_memset(ctx, 0, sizeof(X509_STORE_CTX)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2276 | ctx->ctx = store; |
| 2277 | ctx->cert = x509; |
| 2278 | ctx->untrusted = chain; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2279 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2280 | CRYPTO_new_ex_data(&ctx->ex_data); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2281 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2282 | ctx->param = X509_VERIFY_PARAM_new(); |
| 2283 | if (!ctx->param) |
| 2284 | goto err; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2285 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2286 | /* |
| 2287 | * Inherit callbacks and flags from X509_STORE if not set use defaults. |
| 2288 | */ |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2289 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2290 | if (store) |
| 2291 | ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param); |
| 2292 | else |
| 2293 | ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT | X509_VP_FLAG_ONCE; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2294 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2295 | if (store) { |
| 2296 | ctx->verify_cb = store->verify_cb; |
| 2297 | ctx->cleanup = store->cleanup; |
| 2298 | } else |
| 2299 | ctx->cleanup = 0; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2300 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2301 | if (ret) |
| 2302 | ret = X509_VERIFY_PARAM_inherit(ctx->param, |
| 2303 | X509_VERIFY_PARAM_lookup("default")); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2304 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2305 | if (ret == 0) |
| 2306 | goto err; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2307 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2308 | if (store && store->check_issued) |
| 2309 | ctx->check_issued = store->check_issued; |
| 2310 | else |
| 2311 | ctx->check_issued = check_issued; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2312 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2313 | if (store && store->get_issuer) |
| 2314 | ctx->get_issuer = store->get_issuer; |
| 2315 | else |
| 2316 | ctx->get_issuer = X509_STORE_CTX_get1_issuer; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2317 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2318 | if (store && store->verify_cb) |
| 2319 | ctx->verify_cb = store->verify_cb; |
| 2320 | else |
| 2321 | ctx->verify_cb = null_callback; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2322 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2323 | if (store && store->verify) |
| 2324 | ctx->verify = store->verify; |
| 2325 | else |
| 2326 | ctx->verify = internal_verify; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2327 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2328 | if (store && store->check_revocation) |
| 2329 | ctx->check_revocation = store->check_revocation; |
| 2330 | else |
| 2331 | ctx->check_revocation = check_revocation; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2332 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2333 | if (store && store->get_crl) |
| 2334 | ctx->get_crl = store->get_crl; |
| 2335 | else |
| 2336 | ctx->get_crl = NULL; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2337 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2338 | if (store && store->check_crl) |
| 2339 | ctx->check_crl = store->check_crl; |
| 2340 | else |
| 2341 | ctx->check_crl = check_crl; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2342 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2343 | if (store && store->cert_crl) |
| 2344 | ctx->cert_crl = store->cert_crl; |
| 2345 | else |
| 2346 | ctx->cert_crl = cert_crl; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2347 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2348 | if (store && store->lookup_certs) |
| 2349 | ctx->lookup_certs = store->lookup_certs; |
| 2350 | else |
| 2351 | ctx->lookup_certs = X509_STORE_get1_certs; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2352 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2353 | if (store && store->lookup_crls) |
| 2354 | ctx->lookup_crls = store->lookup_crls; |
| 2355 | else |
| 2356 | ctx->lookup_crls = X509_STORE_get1_crls; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2357 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2358 | ctx->check_policy = check_policy; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2359 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2360 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2361 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2362 | err: |
| 2363 | CRYPTO_free_ex_data(&g_ex_data_class, ctx, &ctx->ex_data); |
| 2364 | if (ctx->param != NULL) { |
| 2365 | X509_VERIFY_PARAM_free(ctx->param); |
| 2366 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2367 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 2368 | OPENSSL_memset(ctx, 0, sizeof(X509_STORE_CTX)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2369 | OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); |
| 2370 | return 0; |
| 2371 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2372 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2373 | /* |
| 2374 | * Set alternative lookup method: just a STACK of trusted certificates. This |
| 2375 | * avoids X509_STORE nastiness where it isn't needed. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2376 | */ |
| 2377 | |
| 2378 | void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) |
| 2379 | { |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2380 | ctx->other_ctx = sk; |
| 2381 | ctx->get_issuer = get_issuer_sk; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2382 | } |
| 2383 | |
| 2384 | void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2385 | { |
| 2386 | /* We need to be idempotent because, unfortunately, |X509_STORE_CTX_free| |
| 2387 | * also calls this function. */ |
| 2388 | if (ctx->cleanup != NULL) { |
| 2389 | ctx->cleanup(ctx); |
| 2390 | ctx->cleanup = NULL; |
| 2391 | } |
| 2392 | if (ctx->param != NULL) { |
| 2393 | if (ctx->parent == NULL) |
| 2394 | X509_VERIFY_PARAM_free(ctx->param); |
| 2395 | ctx->param = NULL; |
| 2396 | } |
| 2397 | if (ctx->tree != NULL) { |
| 2398 | X509_policy_tree_free(ctx->tree); |
| 2399 | ctx->tree = NULL; |
| 2400 | } |
| 2401 | if (ctx->chain != NULL) { |
| 2402 | sk_X509_pop_free(ctx->chain, X509_free); |
| 2403 | ctx->chain = NULL; |
| 2404 | } |
| 2405 | CRYPTO_free_ex_data(&g_ex_data_class, ctx, &(ctx->ex_data)); |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 2406 | OPENSSL_memset(&ctx->ex_data, 0, sizeof(CRYPTO_EX_DATA)); |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2407 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2408 | |
| 2409 | void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2410 | { |
| 2411 | X509_VERIFY_PARAM_set_depth(ctx->param, depth); |
| 2412 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2413 | |
| 2414 | void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2415 | { |
| 2416 | X509_VERIFY_PARAM_set_flags(ctx->param, flags); |
| 2417 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2418 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2419 | void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, |
| 2420 | time_t t) |
| 2421 | { |
| 2422 | X509_VERIFY_PARAM_set_time(ctx->param, t); |
| 2423 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2424 | |
| 2425 | void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2426 | int (*verify_cb) (int, X509_STORE_CTX *)) |
| 2427 | { |
| 2428 | ctx->verify_cb = verify_cb; |
| 2429 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2430 | |
| 2431 | X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2432 | { |
| 2433 | return ctx->tree; |
| 2434 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2435 | |
| 2436 | int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2437 | { |
| 2438 | return ctx->explicit_policy; |
| 2439 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2440 | |
| 2441 | int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2442 | { |
| 2443 | const X509_VERIFY_PARAM *param; |
| 2444 | param = X509_VERIFY_PARAM_lookup(name); |
| 2445 | if (!param) |
| 2446 | return 0; |
| 2447 | return X509_VERIFY_PARAM_inherit(ctx->param, param); |
| 2448 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2449 | |
| 2450 | X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2451 | { |
| 2452 | return ctx->param; |
| 2453 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2454 | |
| 2455 | void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2456 | { |
| 2457 | if (ctx->param) |
| 2458 | X509_VERIFY_PARAM_free(ctx->param); |
| 2459 | ctx->param = param; |
| 2460 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2461 | |
| 2462 | IMPLEMENT_ASN1_SET_OF(X509) |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 2463 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 2464 | IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE) |