[thirdparty/openssl.git] / crypto / x509 / by_store.c

/*
 * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/store.h>
#include "internal/cryptlib.h"
#include "crypto/x509.h"
#include "x509_local.h"

/* Generic object loader, given expected type and criterion */
static int cache_objects(X509_LOOKUP *lctx, const char *uri,
                         const OSSL_STORE_SEARCH *criterion,
                         int depth, OSSL_LIB_CTX *libctx, const char *propq)
{
    int ok = 0;
    OSSL_STORE_CTX *ctx = NULL;
    X509_STORE *xstore = X509_LOOKUP_get_store(lctx);

    if ((ctx = OSSL_STORE_open_ex(uri, libctx, propq, NULL, NULL, NULL, NULL)) == NULL)
        return 0;

    /*
     * We try to set the criterion, but don't care if it was valid or not.
     * For a OSSL_STORE, it merely serves as an optimization, the expectation
     * being that if the criterion couldn't be used, we will get *everything*
     * from the container that the URI represents rather than the subset that
     * the criterion indicates, so the biggest harm is that we cache more
     * objects certs and CRLs than we may expect, but that's ok.
     *
     * Specifically for OpenSSL's own file: scheme, the only workable
     * criterion is the BY_NAME one, which it can only apply on directories,
     * but it's possible that the URI is a single file rather than a directory,
     * and in that case, the BY_NAME criterion is pointless.
     *
     * We could very simply not apply any criterion at all here, and just let
     * the code that selects certs and CRLs from the cached objects do its job,
     * but it's a nice optimization when it can be applied (such as on an
     * actual directory with a thousand CA certs).
     */
    if (criterion != NULL)
        OSSL_STORE_find(ctx, criterion);

    for (;;) {
        OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
        int infotype;

        /* NULL means error or "end of file".  Either way, we break. */
        if (info == NULL)
            break;

        infotype = OSSL_STORE_INFO_get_type(info);
        ok = 0;

        if (infotype == OSSL_STORE_INFO_NAME) {
            /*
             * This is an entry in the "directory" represented by the current
             * uri.  if |depth| allows, dive into it.
             */
            if (depth > 0)
                ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
                                   criterion, depth - 1, libctx, propq);
        } else {
            /*
             * We know that X509_STORE_add_{cert|crl} increments the object's
             * refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
             * to get them.
             */
            switch (infotype) {
            case OSSL_STORE_INFO_CERT:
                ok = X509_STORE_add_cert(xstore,
                                         OSSL_STORE_INFO_get0_CERT(info));
                break;
            case OSSL_STORE_INFO_CRL:
                ok = X509_STORE_add_crl(xstore,
                                        OSSL_STORE_INFO_get0_CRL(info));
                break;
            }
        }

        OSSL_STORE_INFO_free(info);
        if (!ok)
            break;
    }
    OSSL_STORE_close(ctx);

    return ok;
}


/* Because OPENSSL_free is a macro and for C type match */
static void free_uri(OPENSSL_STRING data)
{
    OPENSSL_free(data);
}

static void by_store_free(X509_LOOKUP *ctx)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    sk_OPENSSL_STRING_pop_free(uris, free_uri);
}

static int by_store_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp,
                            long argl, char **retp, OSSL_LIB_CTX *libctx,
                            const char *propq)
{
    switch (cmd) {
    case X509_L_ADD_STORE:
        /* If no URI is given, use the default cert dir as default URI */
        if (argp == NULL)
            argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
        if (argp == NULL)
            argp = X509_get_default_cert_dir();

        {
            STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);

            if (uris == NULL) {
                uris = sk_OPENSSL_STRING_new_null();
                X509_LOOKUP_set_method_data(ctx, uris);
            }
            return sk_OPENSSL_STRING_push(uris, OPENSSL_strdup(argp)) > 0;
        }
    case X509_L_LOAD_STORE:
        /* This is a shortcut for quick loading of specific containers */
        return cache_objects(ctx, argp, NULL, 0, libctx, propq);
    }

    return 0;
}

static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
                         const char *argp, long argl, char **retp)
{
    return by_store_ctrl_ex(ctx, cmd, argp, argl, retp, NULL, NULL);
}

static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                    const OSSL_STORE_SEARCH *criterion, X509_OBJECT *ret,
                    OSSL_LIB_CTX *libctx, const char *propq)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    int i;
    int ok = 0;

    for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
        ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
                           1 /* depth */, libctx, propq);

        if (ok)
            break;
    }
    return ok;
}

static int by_store_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret,
                               OSSL_LIB_CTX *libctx, const char *propq)
{
    OSSL_STORE_SEARCH *criterion =
        OSSL_STORE_SEARCH_by_name((X509_NAME *)name); /* won't modify it */
    int ok = by_store(ctx, type, criterion, ret, libctx, propq);
    STACK_OF(X509_OBJECT) *store_objects =
        X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
    X509_OBJECT *tmp = NULL;

    OSSL_STORE_SEARCH_free(criterion);

    if (ok)
        tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);

    ok = 0;
    if (tmp != NULL) {
        /*
         * This could also be done like this:
         *
         *     if (tmp != NULL) {
         *         *ret = *tmp;
         *         ok = 1;
         *     }
         *
         * However, we want to exercise the documented API to the max, so
         * we do it the hard way.
         *
         * To be noted is that X509_OBJECT_set1_* increment the refcount,
         * but so does X509_STORE_CTX_get_by_subject upon return of this
         * function, so we must ensure the refcount is decremented
         * before we return, or we will get a refcount leak.  We cannot do
         * this with X509_OBJECT_free(), though, as that will free a bit
         * too much.
         */
        switch (type) {
        case X509_LU_X509:
            ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
            if (ok)
                X509_free(tmp->data.x509);
            break;
        case X509_LU_CRL:
            ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
            if (ok)
                X509_CRL_free(tmp->data.crl);
            break;
        case X509_LU_NONE:
            break;
        }
    }
    return ok;
}

static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                            const X509_NAME *name, X509_OBJECT *ret)
{
    return by_store_subject_ex(ctx, type, name, ret, NULL, NULL);
}

/*
 * We lack the implementations for get_by_issuer_serial, get_by_fingerprint
 * and get_by_alias.  There's simply not enough support in the X509_LOOKUP
 * or X509_STORE APIs.
 */

static X509_LOOKUP_METHOD x509_store_lookup = {
    "Load certs from STORE URIs",
    NULL,                        /* new_item */
    by_store_free,               /* free */
    NULL,                        /* init */
    NULL,                        /* shutdown */
    by_store_ctrl,               /* ctrl */
    by_store_subject,            /* get_by_subject */
    NULL,                        /* get_by_issuer_serial */
    NULL,                        /* get_by_fingerprint */
    NULL,                        /* get_by_alias */
    by_store_subject_ex,
    by_store_ctrl_ex
};

X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
{
    return &x509_store_lookup;
}
Commit	Line	Data
6dcb100f	1	/*
8020d79b	2	* Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
6dcb100f RL	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <openssl/store.h>
	11	#include "internal/cryptlib.h"
	12	#include "crypto/x509.h"
	13	#include "x509_local.h"
	14
	15	/* Generic object loader, given expected type and criterion */
	16	static int cache_objects(X509_LOOKUP lctx, const char uri,
	17	const OSSL_STORE_SEARCH *criterion,
b4250010	18	int depth, OSSL_LIB_CTX libctx, const char propq)
6dcb100f RL	19	{
	20	int ok = 0;
	21	OSSL_STORE_CTX *ctx = NULL;
	22	X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
	23
d8652be0	24	if ((ctx = OSSL_STORE_open_ex(uri, libctx, propq, NULL, NULL, NULL, NULL)) == NULL)
6dcb100f RL	25	return 0;
	26
	27	/*
	28	* We try to set the criterion, but don't care if it was valid or not.
	29	* For a OSSL_STORE, it merely serves as an optimization, the expectation
	30	* being that if the criterion couldn't be used, we will get everything
	31	* from the container that the URI represents rather than the subset that
	32	* the criterion indicates, so the biggest harm is that we cache more
	33	* objects certs and CRLs than we may expect, but that's ok.
	34	*
	35	* Specifically for OpenSSL's own file: scheme, the only workable
	36	* criterion is the BY_NAME one, which it can only apply on directories,
	37	* but it's possible that the URI is a single file rather than a directory,
	38	* and in that case, the BY_NAME criterion is pointless.
	39	*
	40	* We could very simply not apply any criterion at all here, and just let
	41	* the code that selects certs and CRLs from the cached objects do its job,
	42	* but it's a nice optimization when it can be applied (such as on an
	43	* actual directory with a thousand CA certs).
	44	*/
	45	if (criterion != NULL)
	46	OSSL_STORE_find(ctx, criterion);
	47
	48	for (;;) {
	49	OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
	50	int infotype;
	51
	52	/* NULL means error or "end of file". Either way, we break. */
	53	if (info == NULL)
	54	break;
	55
	56	infotype = OSSL_STORE_INFO_get_type(info);
	57	ok = 0;
	58
	59	if (infotype == OSSL_STORE_INFO_NAME) {
	60	/*
	61	* This is an entry in the "directory" represented by the current
	62	* uri. if \|depth\| allows, dive into it.
	63	*/
	64	if (depth > 0)
	65	ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
6725682d	66	criterion, depth - 1, libctx, propq);
6dcb100f RL	67	} else {
	68	/*
	69	* We know that X509_STORE_add_{cert\|crl} increments the object's
	70	* refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
	71	* to get them.
	72	*/
	73	switch (infotype) {
	74	case OSSL_STORE_INFO_CERT:
	75	ok = X509_STORE_add_cert(xstore,
	76	OSSL_STORE_INFO_get0_CERT(info));
	77	break;
	78	case OSSL_STORE_INFO_CRL:
	79	ok = X509_STORE_add_crl(xstore,
	80	OSSL_STORE_INFO_get0_CRL(info));
	81	break;
	82	}
	83	}
	84
	85	OSSL_STORE_INFO_free(info);
	86	if (!ok)
	87	break;
	88	}
	89	OSSL_STORE_close(ctx);
	90
	91	return ok;
	92	}
	93
	94
	95	/* Because OPENSSL_free is a macro and for C type match */
	96	static void free_uri(OPENSSL_STRING data)
	97	{
	98	OPENSSL_free(data);
	99	}
	100
	101	static void by_store_free(X509_LOOKUP *ctx)
	102	{
	103	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	104	sk_OPENSSL_STRING_pop_free(uris, free_uri);
	105	}
	106
d8652be0	107	static int by_store_ctrl_ex(X509_LOOKUP ctx, int cmd, const char argp,
b4250010	108	long argl, char *retp, OSSL_LIB_CTX libctx,
d8652be0	109	const char *propq)
6dcb100f RL	110	{
	111	switch (cmd) {
	112	case X509_L_ADD_STORE:
	113	/* If no URI is given, use the default cert dir as default URI */
	114	if (argp == NULL)
	115	argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
	116	if (argp == NULL)
	117	argp = X509_get_default_cert_dir();
	118
	119	{
	120	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	121
	122	if (uris == NULL) {
	123	uris = sk_OPENSSL_STRING_new_null();
	124	X509_LOOKUP_set_method_data(ctx, uris);
	125	}
	126	return sk_OPENSSL_STRING_push(uris, OPENSSL_strdup(argp)) > 0;
	127	}
	128	case X509_L_LOAD_STORE:
	129	/* This is a shortcut for quick loading of specific containers */
6725682d	130	return cache_objects(ctx, argp, NULL, 0, libctx, propq);
6dcb100f RL	131	}
	132
	133	return 0;
	134	}
	135
6725682d SL	136	static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
	137	const char argp, long argl, char *retp)
	138	{
d8652be0	139	return by_store_ctrl_ex(ctx, cmd, argp, argl, retp, NULL, NULL);
6725682d SL	140	}
6725682d SL	141
6dcb100f	142	static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
6725682d	143	const OSSL_STORE_SEARCH criterion, X509_OBJECT ret,
b4250010	144	OSSL_LIB_CTX libctx, const char propq)
6dcb100f RL	145	{
	146	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	147	int i;
	148	int ok = 0;
	149
	150	for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
	151	ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
6725682d	152	1 /* depth */, libctx, propq);
6dcb100f RL	153
	154	if (ok)
	155	break;
	156	}
	157	return ok;
	158	}
	159
d8652be0 MC	160	static int by_store_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
d8652be0 MC	161	const X509_NAME name, X509_OBJECT ret,
b4250010	162	OSSL_LIB_CTX libctx, const char propq)
6dcb100f	163	{
8cc86b81 DDO	164	OSSL_STORE_SEARCH *criterion =
8cc86b81 DDO	165	OSSL_STORE_SEARCH_by_name((X509_NAME )name); / won't modify it */
6725682d	166	int ok = by_store(ctx, type, criterion, ret, libctx, propq);
6dcb100f RL	167	STACK_OF(X509_OBJECT) *store_objects =
	168	X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
	169	X509_OBJECT *tmp = NULL;
	170
	171	OSSL_STORE_SEARCH_free(criterion);
	172
	173	if (ok)
	174	tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);
	175
	176	ok = 0;
	177	if (tmp != NULL) {
	178	/*
	179	* This could also be done like this:
	180	*
	181	* if (tmp != NULL) {
	182	* ret = tmp;
	183	* ok = 1;
	184	* }
	185	*
	186	* However, we want to exercise the documented API to the max, so
	187	* we do it the hard way.
	188	*
	189	* To be noted is that X509_OBJECT_set1_* increment the refcount,
	190	* but so does X509_STORE_CTX_get_by_subject upon return of this
3e6a0d57	191	* function, so we must ensure the refcount is decremented
6dcb100f RL	192	* before we return, or we will get a refcount leak. We cannot do
	193	* this with X509_OBJECT_free(), though, as that will free a bit
	194	* too much.
	195	*/
	196	switch (type) {
	197	case X509_LU_X509:
	198	ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
	199	if (ok)
	200	X509_free(tmp->data.x509);
	201	break;
	202	case X509_LU_CRL:
	203	ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
	204	if (ok)
	205	X509_CRL_free(tmp->data.crl);
	206	break;
	207	case X509_LU_NONE:
	208	break;
	209	}
	210	}
	211	return ok;
	212	}
	213
6725682d SL	214	static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
	215	const X509_NAME name, X509_OBJECT ret)
	216	{
d8652be0	217	return by_store_subject_ex(ctx, type, name, ret, NULL, NULL);
6725682d SL	218	}
6725682d SL	219
6dcb100f RL	220	/*
	221	* We lack the implementations for get_by_issuer_serial, get_by_fingerprint
	222	* and get_by_alias. There's simply not enough support in the X509_LOOKUP
	223	* or X509_STORE APIs.
	224	*/
	225
	226	static X509_LOOKUP_METHOD x509_store_lookup = {
	227	"Load certs from STORE URIs",
	228	NULL, /* new_item */
	229	by_store_free, /* free */
	230	NULL, /* init */
	231	NULL, /* shutdown */
	232	by_store_ctrl, /* ctrl */
	233	by_store_subject, /* get_by_subject */
	234	NULL, /* get_by_issuer_serial */
	235	NULL, /* get_by_fingerprint */
	236	NULL, /* get_by_alias */
d8652be0 MC	237	by_store_subject_ex,
d8652be0 MC	238	by_store_ctrl_ex
6dcb100f RL	239	};
	240
	241	X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
	242	{
	243	return &x509_store_lookup;
	244	}