]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
3c2bdd7d | 2 | * Copyright 2014-2021 The OpenSSL Project Authors. All Rights Reserved. |
4a253652 | 3 | * |
3e4b43b9 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1322259 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4a253652 DSH |
8 | */ |
9 | ||
2f545ae4 KR |
10 | #include "internal/refcount.h" |
11 | ||
c90c4693 DDO |
12 | #define X509V3_conf_add_error_name_value(val) \ |
13 | ERR_add_error_data(4, "name=", (val)->name, ", value=", (val)->value) | |
14 | ||
6f4d71ff DSH |
15 | /* |
16 | * This structure holds all parameters associated with a verify operation by | |
17 | * including an X509_VERIFY_PARAM structure in related structures the | |
18 | * parameters used can be customized | |
19 | */ | |
20 | ||
21 | struct X509_VERIFY_PARAM_st { | |
22 | char *name; | |
23 | time_t check_time; /* Time to use */ | |
a47bc283 | 24 | uint32_t inh_flags; /* Inheritance flags */ |
6f4d71ff DSH |
25 | unsigned long flags; /* Various verify flags */ |
26 | int purpose; /* purpose to check untrusted certificates */ | |
27 | int trust; /* trust setting to check */ | |
28 | int depth; /* Verify depth */ | |
fbb82a60 | 29 | int auth_level; /* Security level for chain verification */ |
6f4d71ff | 30 | STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ |
9689a6ae | 31 | /* Peer identity details */ |
0f113f3e MC |
32 | STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ |
33 | unsigned int hostflags; /* Flags to control matching features */ | |
34 | char *peername; /* Matching hostname in peer certificate */ | |
35 | char *email; /* If not NULL email address to match */ | |
36 | size_t emaillen; | |
37 | unsigned char *ip; /* If not NULL IP address to match */ | |
38 | size_t iplen; /* Length of IP address */ | |
39 | }; | |
0930251d | 40 | |
70dd3c65 | 41 | /* No error callback if depth < 0 */ |
4669015d | 42 | int ossl_x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth); |
9b0a4531 DSH |
43 | |
44 | /* a sequence of these are used */ | |
45 | struct x509_attributes_st { | |
46 | ASN1_OBJECT *object; | |
e20b5727 | 47 | STACK_OF(ASN1_TYPE) *set; |
9b0a4531 | 48 | }; |
4903abd5 DSH |
49 | |
50 | struct X509_extension_st { | |
51 | ASN1_OBJECT *object; | |
52 | ASN1_BOOLEAN critical; | |
4392479c | 53 | ASN1_OCTET_STRING value; |
4903abd5 | 54 | }; |
1e898fb0 DSH |
55 | |
56 | /* | |
57 | * Method to handle CRL access. In general a CRL could be very large (several | |
58 | * Mb) and can consume large amounts of resources if stored in memory by | |
59 | * multiple processes. This method allows general CRL operations to be | |
60 | * redirected to more efficient callbacks: for example a CRL entry database. | |
61 | */ | |
62 | ||
63 | #define X509_CRL_METHOD_DYNAMIC 1 | |
64 | ||
65 | struct x509_crl_method_st { | |
66 | int flags; | |
67 | int (*crl_init) (X509_CRL *crl); | |
68 | int (*crl_free) (X509_CRL *crl); | |
69 | int (*crl_lookup) (X509_CRL *crl, X509_REVOKED **ret, | |
8cc86b81 | 70 | const ASN1_INTEGER *ser, const X509_NAME *issuer); |
1e898fb0 DSH |
71 | int (*crl_verify) (X509_CRL *crl, EVP_PKEY *pk); |
72 | }; | |
4a1f3f27 | 73 | |
f0e0fd51 | 74 | struct x509_lookup_method_st { |
0124f32a | 75 | char *name; |
f0e0fd51 RS |
76 | int (*new_item) (X509_LOOKUP *ctx); |
77 | void (*free) (X509_LOOKUP *ctx); | |
78 | int (*init) (X509_LOOKUP *ctx); | |
79 | int (*shutdown) (X509_LOOKUP *ctx); | |
80 | int (*ctrl) (X509_LOOKUP *ctx, int cmd, const char *argc, long argl, | |
81 | char **ret); | |
0946a198 | 82 | int (*get_by_subject) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
8cc86b81 | 83 | const X509_NAME *name, X509_OBJECT *ret); |
0946a198 | 84 | int (*get_by_issuer_serial) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
8cc86b81 DDO |
85 | const X509_NAME *name, |
86 | const ASN1_INTEGER *serial, | |
0946a198 DSH |
87 | X509_OBJECT *ret); |
88 | int (*get_by_fingerprint) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, | |
cfc5e0aa | 89 | const unsigned char *bytes, int len, |
f0e0fd51 | 90 | X509_OBJECT *ret); |
0946a198 | 91 | int (*get_by_alias) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 92 | const char *str, int len, X509_OBJECT *ret); |
d8652be0 | 93 | int (*get_by_subject_ex) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
746f3674 | 94 | const X509_NAME *name, X509_OBJECT *ret, |
b4250010 | 95 | OSSL_LIB_CTX *libctx, const char *propq); |
746f3674 | 96 | int (*ctrl_ex) (X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
b4250010 | 97 | char **ret, OSSL_LIB_CTX *libctx, const char *propq); |
f0e0fd51 RS |
98 | }; |
99 | ||
100 | /* This is the functions plus an instance of the local variables. */ | |
101 | struct x509_lookup_st { | |
102 | int init; /* have we been started */ | |
103 | int skip; /* don't use us. */ | |
104 | X509_LOOKUP_METHOD *method; /* the functions */ | |
0124f32a | 105 | void *method_data; /* method data */ |
f0e0fd51 RS |
106 | X509_STORE *store_ctx; /* who owns us */ |
107 | }; | |
108 | ||
109 | /* | |
110 | * This is used to hold everything. It is used for all certificate | |
111 | * validation. Once we have a certificate chain, the 'verify' function is | |
112 | * then called to actually check the cert chain. | |
113 | */ | |
114 | struct x509_store_st { | |
115 | /* The following is a cache of trusted certs */ | |
116 | int cache; /* if true, stash any hits */ | |
117 | STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */ | |
118 | /* These are external lookup methods */ | |
119 | STACK_OF(X509_LOOKUP) *get_cert_methods; | |
120 | X509_VERIFY_PARAM *param; | |
121 | /* Callbacks for various operations */ | |
122 | /* called to verify a certificate */ | |
123 | int (*verify) (X509_STORE_CTX *ctx); | |
124 | /* error callback */ | |
125 | int (*verify_cb) (int ok, X509_STORE_CTX *ctx); | |
126 | /* get issuers cert from ctx */ | |
127 | int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x); | |
128 | /* check issued */ | |
129 | int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer); | |
130 | /* Check revocation status of chain */ | |
131 | int (*check_revocation) (X509_STORE_CTX *ctx); | |
132 | /* retrieve CRL */ | |
133 | int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); | |
134 | /* Check CRL validity */ | |
135 | int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl); | |
136 | /* Check certificate against CRL */ | |
137 | int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); | |
0a5fe2eb RL |
138 | /* Check policy status of the chain */ |
139 | int (*check_policy) (X509_STORE_CTX *ctx); | |
8cc86b81 DDO |
140 | STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, |
141 | const X509_NAME *nm); | |
142 | /* cannot constify 'ctx' param due to lookup_certs_sk() in x509_vfy.c */ | |
143 | STACK_OF(X509_CRL) *(*lookup_crls) (const X509_STORE_CTX *ctx, | |
144 | const X509_NAME *nm); | |
f0e0fd51 RS |
145 | int (*cleanup) (X509_STORE_CTX *ctx); |
146 | CRYPTO_EX_DATA ex_data; | |
2f545ae4 | 147 | CRYPTO_REF_COUNT references; |
f0e0fd51 RS |
148 | CRYPTO_RWLOCK *lock; |
149 | }; | |
150 | ||
4a1f3f27 DSH |
151 | typedef struct lookup_dir_hashes_st BY_DIR_HASH; |
152 | typedef struct lookup_dir_entry_st BY_DIR_ENTRY; | |
153 | DEFINE_STACK_OF(BY_DIR_HASH) | |
154 | DEFINE_STACK_OF(BY_DIR_ENTRY) | |
155 | typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY; | |
156 | DEFINE_STACK_OF(STACK_OF_X509_NAME_ENTRY) | |
786dd2c2 | 157 | |
4669015d SL |
158 | int ossl_x509_likely_issued(X509 *issuer, X509 *subject); |
159 | int ossl_x509_signing_allowed(const X509 *issuer, const X509 *subject); |