[thirdparty/openssl.git] / crypto / x509 / by_store.c

/*
 * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/store.h>
#include "internal/cryptlib.h"
#include "crypto/x509.h"
#include "x509_local.h"

/* Generic object loader, given expected type and criterion */
static int cache_objects(X509_LOOKUP *lctx, const char *uri,
                         const OSSL_STORE_SEARCH *criterion,
                         int depth, OPENSSL_CTX *libctx, const char *propq)
{
    int ok = 0;
    OSSL_STORE_CTX *ctx = NULL;
    X509_STORE *xstore = X509_LOOKUP_get_store(lctx);

    if ((ctx = OSSL_STORE_open_with_libctx(uri, libctx, propq,
                                           NULL, NULL, NULL, NULL)) == NULL)
        return 0;

    /*
     * We try to set the criterion, but don't care if it was valid or not.
     * For a OSSL_STORE, it merely serves as an optimization, the expectation
     * being that if the criterion couldn't be used, we will get *everything*
     * from the container that the URI represents rather than the subset that
     * the criterion indicates, so the biggest harm is that we cache more
     * objects certs and CRLs than we may expect, but that's ok.
     *
     * Specifically for OpenSSL's own file: scheme, the only workable
     * criterion is the BY_NAME one, which it can only apply on directories,
     * but it's possible that the URI is a single file rather than a directory,
     * and in that case, the BY_NAME criterion is pointless.
     *
     * We could very simply not apply any criterion at all here, and just let
     * the code that selects certs and CRLs from the cached objects do its job,
     * but it's a nice optimization when it can be applied (such as on an
     * actual directory with a thousand CA certs).
     */
    if (criterion != NULL)
        OSSL_STORE_find(ctx, criterion);

    for (;;) {
        OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
        int infotype;

        /* NULL means error or "end of file".  Either way, we break. */
        if (info == NULL)
            break;

        infotype = OSSL_STORE_INFO_get_type(info);
        ok = 0;

        if (infotype == OSSL_STORE_INFO_NAME) {
            /*
             * This is an entry in the "directory" represented by the current
             * uri.  if |depth| allows, dive into it.
             */
            if (depth > 0)
                ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
                                   criterion, depth - 1, libctx, propq);
        } else {
            /*
             * We know that X509_STORE_add_{cert|crl} increments the object's
             * refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
             * to get them.
             */
            switch (infotype) {
            case OSSL_STORE_INFO_CERT:
                ok = X509_STORE_add_cert(xstore,
                                         OSSL_STORE_INFO_get0_CERT(info));
                break;
            case OSSL_STORE_INFO_CRL:
                ok = X509_STORE_add_crl(xstore,
                                        OSSL_STORE_INFO_get0_CRL(info));
                break;
            }
        }

        OSSL_STORE_INFO_free(info);
        if (!ok)
            break;
    }
    OSSL_STORE_close(ctx);

    return ok;
}


/* Because OPENSSL_free is a macro and for C type match */
static void free_uri(OPENSSL_STRING data)
{
    OPENSSL_free(data);
}

static void by_store_free(X509_LOOKUP *ctx)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    sk_OPENSSL_STRING_pop_free(uris, free_uri);
}

static int by_store_ctrl_with_libctx(X509_LOOKUP *ctx, int cmd,
                                     const char *argp, long argl,
                                     char **retp,
                                     OPENSSL_CTX *libctx, const char *propq)
{
    switch (cmd) {
    case X509_L_ADD_STORE:
        /* If no URI is given, use the default cert dir as default URI */
        if (argp == NULL)
            argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
        if (argp == NULL)
            argp = X509_get_default_cert_dir();

        {
            STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);

            if (uris == NULL) {
                uris = sk_OPENSSL_STRING_new_null();
                X509_LOOKUP_set_method_data(ctx, uris);
            }
            return sk_OPENSSL_STRING_push(uris, OPENSSL_strdup(argp)) > 0;
        }
    case X509_L_LOAD_STORE:
        /* This is a shortcut for quick loading of specific containers */
        return cache_objects(ctx, argp, NULL, 0, libctx, propq);
    }

    return 0;
}

static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
                         const char *argp, long argl, char **retp)
{
    return by_store_ctrl_with_libctx(ctx, cmd, argp, argl, retp, NULL, NULL);
}

static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                    const OSSL_STORE_SEARCH *criterion, X509_OBJECT *ret,
                    OPENSSL_CTX *libctx, const char *propq)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    int i;
    int ok = 0;

    for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
        ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
                           1 /* depth */, libctx, propq);

        if (ok)
            break;
    }
    return ok;
}

static int by_store_subject_with_libctx(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                                        const X509_NAME *name, X509_OBJECT *ret,
                                        OPENSSL_CTX *libctx, const char *propq)
{
    OSSL_STORE_SEARCH *criterion =
        OSSL_STORE_SEARCH_by_name((X509_NAME *)name); /* won't modify it */
    int ok = by_store(ctx, type, criterion, ret, libctx, propq);
    STACK_OF(X509_OBJECT) *store_objects =
        X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
    X509_OBJECT *tmp = NULL;

    OSSL_STORE_SEARCH_free(criterion);

    if (ok)
        tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);

    ok = 0;
    if (tmp != NULL) {
        /*
         * This could also be done like this:
         *
         *     if (tmp != NULL) {
         *         *ret = *tmp;
         *         ok = 1;
         *     }
         *
         * However, we want to exercise the documented API to the max, so
         * we do it the hard way.
         *
         * To be noted is that X509_OBJECT_set1_* increment the refcount,
         * but so does X509_STORE_CTX_get_by_subject upon return of this
         * function, so we must ensure the the refcount is decremented
         * before we return, or we will get a refcount leak.  We cannot do
         * this with X509_OBJECT_free(), though, as that will free a bit
         * too much.
         */
        switch (type) {
        case X509_LU_X509:
            ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
            if (ok)
                X509_free(tmp->data.x509);
            break;
        case X509_LU_CRL:
            ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
            if (ok)
                X509_CRL_free(tmp->data.crl);
            break;
        case X509_LU_NONE:
            break;
        }
    }
    return ok;
}

static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                            const X509_NAME *name, X509_OBJECT *ret)
{
    return by_store_subject_with_libctx(ctx, type, name, ret, NULL, NULL);
}

/*
 * We lack the implementations for get_by_issuer_serial, get_by_fingerprint
 * and get_by_alias.  There's simply not enough support in the X509_LOOKUP
 * or X509_STORE APIs.
 */

static X509_LOOKUP_METHOD x509_store_lookup = {
    "Load certs from STORE URIs",
    NULL,                        /* new_item */
    by_store_free,               /* free */
    NULL,                        /* init */
    NULL,                        /* shutdown */
    by_store_ctrl,               /* ctrl */
    by_store_subject,            /* get_by_subject */
    NULL,                        /* get_by_issuer_serial */
    NULL,                        /* get_by_fingerprint */
    NULL,                        /* get_by_alias */
    by_store_subject_with_libctx,
    by_store_ctrl_with_libctx
};

X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
{
    return &x509_store_lookup;
}
Commit	Line	Data
6dcb100f	1	/*
33388b44	2	* Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
6dcb100f RL	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <openssl/store.h>
	11	#include "internal/cryptlib.h"
	12	#include "crypto/x509.h"
	13	#include "x509_local.h"
	14
	15	/* Generic object loader, given expected type and criterion */
	16	static int cache_objects(X509_LOOKUP lctx, const char uri,
	17	const OSSL_STORE_SEARCH *criterion,
6725682d	18	int depth, OPENSSL_CTX libctx, const char propq)
6dcb100f RL	19	{
	20	int ok = 0;
	21	OSSL_STORE_CTX *ctx = NULL;
	22	X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
	23
6725682d SL	24	if ((ctx = OSSL_STORE_open_with_libctx(uri, libctx, propq,
6725682d SL	25	NULL, NULL, NULL, NULL)) == NULL)
6dcb100f RL	26	return 0;
	27
	28	/*
	29	* We try to set the criterion, but don't care if it was valid or not.
	30	* For a OSSL_STORE, it merely serves as an optimization, the expectation
	31	* being that if the criterion couldn't be used, we will get everything
	32	* from the container that the URI represents rather than the subset that
	33	* the criterion indicates, so the biggest harm is that we cache more
	34	* objects certs and CRLs than we may expect, but that's ok.
	35	*
	36	* Specifically for OpenSSL's own file: scheme, the only workable
	37	* criterion is the BY_NAME one, which it can only apply on directories,
	38	* but it's possible that the URI is a single file rather than a directory,
	39	* and in that case, the BY_NAME criterion is pointless.
	40	*
	41	* We could very simply not apply any criterion at all here, and just let
	42	* the code that selects certs and CRLs from the cached objects do its job,
	43	* but it's a nice optimization when it can be applied (such as on an
	44	* actual directory with a thousand CA certs).
	45	*/
	46	if (criterion != NULL)
	47	OSSL_STORE_find(ctx, criterion);
	48
	49	for (;;) {
	50	OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
	51	int infotype;
	52
	53	/* NULL means error or "end of file". Either way, we break. */
	54	if (info == NULL)
	55	break;
	56
	57	infotype = OSSL_STORE_INFO_get_type(info);
	58	ok = 0;
	59
	60	if (infotype == OSSL_STORE_INFO_NAME) {
	61	/*
	62	* This is an entry in the "directory" represented by the current
	63	* uri. if \|depth\| allows, dive into it.
	64	*/
	65	if (depth > 0)
	66	ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
6725682d	67	criterion, depth - 1, libctx, propq);
6dcb100f RL	68	} else {
	69	/*
	70	* We know that X509_STORE_add_{cert\|crl} increments the object's
	71	* refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
	72	* to get them.
	73	*/
	74	switch (infotype) {
	75	case OSSL_STORE_INFO_CERT:
	76	ok = X509_STORE_add_cert(xstore,
	77	OSSL_STORE_INFO_get0_CERT(info));
	78	break;
	79	case OSSL_STORE_INFO_CRL:
	80	ok = X509_STORE_add_crl(xstore,
	81	OSSL_STORE_INFO_get0_CRL(info));
	82	break;
	83	}
	84	}
	85
	86	OSSL_STORE_INFO_free(info);
	87	if (!ok)
	88	break;
	89	}
	90	OSSL_STORE_close(ctx);
	91
	92	return ok;
	93	}
	94
	95
	96	/* Because OPENSSL_free is a macro and for C type match */
	97	static void free_uri(OPENSSL_STRING data)
	98	{
	99	OPENSSL_free(data);
	100	}
	101
	102	static void by_store_free(X509_LOOKUP *ctx)
	103	{
	104	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	105	sk_OPENSSL_STRING_pop_free(uris, free_uri);
	106	}
	107
6725682d SL	108	static int by_store_ctrl_with_libctx(X509_LOOKUP *ctx, int cmd,
	109	const char *argp, long argl,
	110	char **retp,
	111	OPENSSL_CTX libctx, const char propq)
6dcb100f RL	112	{
	113	switch (cmd) {
	114	case X509_L_ADD_STORE:
	115	/* If no URI is given, use the default cert dir as default URI */
	116	if (argp == NULL)
	117	argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
	118	if (argp == NULL)
	119	argp = X509_get_default_cert_dir();
	120
	121	{
	122	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	123
	124	if (uris == NULL) {
	125	uris = sk_OPENSSL_STRING_new_null();
	126	X509_LOOKUP_set_method_data(ctx, uris);
	127	}
	128	return sk_OPENSSL_STRING_push(uris, OPENSSL_strdup(argp)) > 0;
	129	}
	130	case X509_L_LOAD_STORE:
	131	/* This is a shortcut for quick loading of specific containers */
6725682d	132	return cache_objects(ctx, argp, NULL, 0, libctx, propq);
6dcb100f RL	133	}
	134
	135	return 0;
	136	}
	137
6725682d SL	138	static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
	139	const char argp, long argl, char *retp)
	140	{
	141	return by_store_ctrl_with_libctx(ctx, cmd, argp, argl, retp, NULL, NULL);
	142	}
	143
6dcb100f	144	static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
6725682d SL	145	const OSSL_STORE_SEARCH criterion, X509_OBJECT ret,
6725682d SL	146	OPENSSL_CTX libctx, const char propq)
6dcb100f RL	147	{
	148	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	149	int i;
	150	int ok = 0;
	151
	152	for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
	153	ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
6725682d	154	1 /* depth */, libctx, propq);
6dcb100f RL	155
	156	if (ok)
	157	break;
	158	}
	159	return ok;
	160	}
	161
6725682d SL	162	static int by_store_subject_with_libctx(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
	163	const X509_NAME name, X509_OBJECT ret,
	164	OPENSSL_CTX libctx, const char propq)
6dcb100f	165	{
8cc86b81 DDO	166	OSSL_STORE_SEARCH *criterion =
8cc86b81 DDO	167	OSSL_STORE_SEARCH_by_name((X509_NAME )name); / won't modify it */
6725682d	168	int ok = by_store(ctx, type, criterion, ret, libctx, propq);
6dcb100f RL	169	STACK_OF(X509_OBJECT) *store_objects =
	170	X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
	171	X509_OBJECT *tmp = NULL;
	172
	173	OSSL_STORE_SEARCH_free(criterion);
	174
	175	if (ok)
	176	tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);
	177
	178	ok = 0;
	179	if (tmp != NULL) {
	180	/*
	181	* This could also be done like this:
	182	*
	183	* if (tmp != NULL) {
	184	* ret = tmp;
	185	* ok = 1;
	186	* }
	187	*
	188	* However, we want to exercise the documented API to the max, so
	189	* we do it the hard way.
	190	*
	191	* To be noted is that X509_OBJECT_set1_* increment the refcount,
	192	* but so does X509_STORE_CTX_get_by_subject upon return of this
	193	* function, so we must ensure the the refcount is decremented
	194	* before we return, or we will get a refcount leak. We cannot do
	195	* this with X509_OBJECT_free(), though, as that will free a bit
	196	* too much.
	197	*/
	198	switch (type) {
	199	case X509_LU_X509:
	200	ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
	201	if (ok)
	202	X509_free(tmp->data.x509);
	203	break;
	204	case X509_LU_CRL:
	205	ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
	206	if (ok)
	207	X509_CRL_free(tmp->data.crl);
	208	break;
	209	case X509_LU_NONE:
	210	break;
	211	}
	212	}
	213	return ok;
	214	}
	215
6725682d SL	216	static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
	217	const X509_NAME name, X509_OBJECT ret)
	218	{
	219	return by_store_subject_with_libctx(ctx, type, name, ret, NULL, NULL);
	220	}
	221
6dcb100f RL	222	/*
	223	* We lack the implementations for get_by_issuer_serial, get_by_fingerprint
	224	* and get_by_alias. There's simply not enough support in the X509_LOOKUP
	225	* or X509_STORE APIs.
	226	*/
	227
	228	static X509_LOOKUP_METHOD x509_store_lookup = {
	229	"Load certs from STORE URIs",
	230	NULL, /* new_item */
	231	by_store_free, /* free */
	232	NULL, /* init */
	233	NULL, /* shutdown */
	234	by_store_ctrl, /* ctrl */
	235	by_store_subject, /* get_by_subject */
	236	NULL, /* get_by_issuer_serial */
	237	NULL, /* get_by_fingerprint */
	238	NULL, /* get_by_alias */
6725682d SL	239	by_store_subject_with_libctx,
6725682d SL	240	by_store_ctrl_with_libctx
6dcb100f RL	241	};
	242
	243	X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
	244	{
	245	return &x509_store_lookup;
	246	}