]>
Commit | Line | Data |
---|---|---|
b1322259 | 1 | /* |
c4d3c19b | 2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
3e4b43b9 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1322259 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
b39fc560 | 11 | #include "internal/cryptlib.h" |
cd420b0b | 12 | #include "internal/refcount.h" |
ec577822 | 13 | #include <openssl/x509.h> |
25f2138b | 14 | #include "crypto/x509.h" |
926a56bf | 15 | #include <openssl/x509v3.h> |
706457b7 | 16 | #include "x509_local.h" |
d02b48c6 | 17 | |
6b691a5c | 18 | X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method) |
0f113f3e | 19 | { |
7fcdbd83 | 20 | X509_LOOKUP *ret = OPENSSL_zalloc(sizeof(*ret)); |
0f113f3e | 21 | |
7fcdbd83 F |
22 | if (ret == NULL) { |
23 | X509err(X509_F_X509_LOOKUP_NEW, ERR_R_MALLOC_FAILURE); | |
0f113f3e | 24 | return NULL; |
7fcdbd83 | 25 | } |
0f113f3e | 26 | |
0f113f3e | 27 | ret->method = method; |
7fcdbd83 | 28 | if (method->new_item != NULL && method->new_item(ret) == 0) { |
0f113f3e MC |
29 | OPENSSL_free(ret); |
30 | return NULL; | |
31 | } | |
32 | return ret; | |
33 | } | |
d02b48c6 | 34 | |
6b691a5c | 35 | void X509_LOOKUP_free(X509_LOOKUP *ctx) |
0f113f3e MC |
36 | { |
37 | if (ctx == NULL) | |
38 | return; | |
39 | if ((ctx->method != NULL) && (ctx->method->free != NULL)) | |
40 | (*ctx->method->free) (ctx); | |
41 | OPENSSL_free(ctx); | |
42 | } | |
d02b48c6 | 43 | |
3067095e RL |
44 | int X509_STORE_lock(X509_STORE *s) |
45 | { | |
46 | return CRYPTO_THREAD_write_lock(s->lock); | |
47 | } | |
48 | ||
49 | int X509_STORE_unlock(X509_STORE *s) | |
50 | { | |
51 | return CRYPTO_THREAD_unlock(s->lock); | |
52 | } | |
53 | ||
6b691a5c | 54 | int X509_LOOKUP_init(X509_LOOKUP *ctx) |
0f113f3e MC |
55 | { |
56 | if (ctx->method == NULL) | |
57 | return 0; | |
58 | if (ctx->method->init != NULL) | |
59 | return ctx->method->init(ctx); | |
60 | else | |
61 | return 1; | |
62 | } | |
d02b48c6 | 63 | |
6b691a5c | 64 | int X509_LOOKUP_shutdown(X509_LOOKUP *ctx) |
0f113f3e MC |
65 | { |
66 | if (ctx->method == NULL) | |
67 | return 0; | |
68 | if (ctx->method->shutdown != NULL) | |
69 | return ctx->method->shutdown(ctx); | |
70 | else | |
71 | return 1; | |
72 | } | |
d02b48c6 | 73 | |
303c0028 | 74 | int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
0f113f3e MC |
75 | char **ret) |
76 | { | |
77 | if (ctx->method == NULL) | |
78 | return -1; | |
79 | if (ctx->method->ctrl != NULL) | |
80 | return ctx->method->ctrl(ctx, cmd, argc, argl, ret); | |
81 | else | |
82 | return 1; | |
83 | } | |
d02b48c6 | 84 | |
0946a198 DSH |
85 | int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
86 | X509_NAME *name, X509_OBJECT *ret) | |
0f113f3e MC |
87 | { |
88 | if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL)) | |
ba1a1c37 | 89 | return 0; |
0f113f3e MC |
90 | if (ctx->skip) |
91 | return 0; | |
92 | return ctx->method->get_by_subject(ctx, type, name, ret); | |
93 | } | |
d02b48c6 | 94 | |
0946a198 DSH |
95 | int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
96 | X509_NAME *name, ASN1_INTEGER *serial, | |
97 | X509_OBJECT *ret) | |
0f113f3e MC |
98 | { |
99 | if ((ctx->method == NULL) || (ctx->method->get_by_issuer_serial == NULL)) | |
ba1a1c37 | 100 | return 0; |
0f113f3e MC |
101 | return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret); |
102 | } | |
d02b48c6 | 103 | |
0946a198 | 104 | int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 105 | const unsigned char *bytes, int len, |
0f113f3e MC |
106 | X509_OBJECT *ret) |
107 | { | |
108 | if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL)) | |
ba1a1c37 | 109 | return 0; |
0f113f3e MC |
110 | return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret); |
111 | } | |
d02b48c6 | 112 | |
0946a198 | 113 | int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 114 | const char *str, int len, X509_OBJECT *ret) |
0f113f3e MC |
115 | { |
116 | if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL)) | |
ba1a1c37 | 117 | return 0; |
0f113f3e MC |
118 | return ctx->method->get_by_alias(ctx, type, str, len, ret); |
119 | } | |
120 | ||
0124f32a MY |
121 | int X509_LOOKUP_set_method_data(X509_LOOKUP *ctx, void *data) |
122 | { | |
123 | ctx->method_data = data; | |
124 | return 1; | |
125 | } | |
126 | ||
127 | void *X509_LOOKUP_get_method_data(const X509_LOOKUP *ctx) | |
128 | { | |
129 | return ctx->method_data; | |
130 | } | |
131 | ||
132 | X509_STORE *X509_LOOKUP_get_store(const X509_LOOKUP *ctx) | |
133 | { | |
134 | return ctx->store_ctx; | |
135 | } | |
136 | ||
137 | ||
0f113f3e MC |
138 | static int x509_object_cmp(const X509_OBJECT *const *a, |
139 | const X509_OBJECT *const *b) | |
140 | { | |
141 | int ret; | |
142 | ||
143 | ret = ((*a)->type - (*b)->type); | |
144 | if (ret) | |
145 | return ret; | |
146 | switch ((*a)->type) { | |
147 | case X509_LU_X509: | |
148 | ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509); | |
149 | break; | |
150 | case X509_LU_CRL: | |
151 | ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl); | |
152 | break; | |
f3b3d7f0 | 153 | case X509_LU_NONE: |
0f113f3e MC |
154 | /* abort(); */ |
155 | return 0; | |
156 | } | |
157 | return ret; | |
158 | } | |
d02b48c6 | 159 | |
6b691a5c | 160 | X509_STORE *X509_STORE_new(void) |
0f113f3e | 161 | { |
7fcdbd83 | 162 | X509_STORE *ret = OPENSSL_zalloc(sizeof(*ret)); |
0f113f3e | 163 | |
7fcdbd83 F |
164 | if (ret == NULL) { |
165 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
0f113f3e | 166 | return NULL; |
7fcdbd83 F |
167 | } |
168 | if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL) { | |
169 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
90945fa3 | 170 | goto err; |
7fcdbd83 | 171 | } |
0f113f3e | 172 | ret->cache = 1; |
7fcdbd83 F |
173 | if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL) { |
174 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
90945fa3 | 175 | goto err; |
7fcdbd83 | 176 | } |
0f113f3e | 177 | |
7fcdbd83 F |
178 | if ((ret->param = X509_VERIFY_PARAM_new()) == NULL) { |
179 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
90945fa3 | 180 | goto err; |
7fcdbd83 F |
181 | } |
182 | if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data)) { | |
183 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
90945fa3 | 184 | goto err; |
7fcdbd83 | 185 | } |
0f113f3e | 186 | |
c001ce33 | 187 | ret->lock = CRYPTO_THREAD_lock_new(); |
7fcdbd83 F |
188 | if (ret->lock == NULL) { |
189 | X509err(X509_F_X509_STORE_NEW, ERR_R_MALLOC_FAILURE); | |
c001ce33 | 190 | goto err; |
7fcdbd83 | 191 | } |
c001ce33 | 192 | |
0f113f3e MC |
193 | ret->references = 1; |
194 | return ret; | |
c001ce33 | 195 | |
90945fa3 MC |
196 | err: |
197 | X509_VERIFY_PARAM_free(ret->param); | |
198 | sk_X509_OBJECT_free(ret->objs); | |
199 | sk_X509_LOOKUP_free(ret->get_cert_methods); | |
200 | OPENSSL_free(ret); | |
201 | return NULL; | |
0f113f3e | 202 | } |
d02b48c6 | 203 | |
6b691a5c | 204 | void X509_STORE_free(X509_STORE *vfy) |
0f113f3e MC |
205 | { |
206 | int i; | |
207 | STACK_OF(X509_LOOKUP) *sk; | |
208 | X509_LOOKUP *lu; | |
d02b48c6 | 209 | |
e6e9170d RS |
210 | if (vfy == NULL) |
211 | return; | |
2f545ae4 | 212 | CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock); |
f3f1cf84 | 213 | REF_PRINT_COUNT("X509_STORE", vfy); |
0f113f3e MC |
214 | if (i > 0) |
215 | return; | |
f3f1cf84 | 216 | REF_ASSERT_ISNT(i < 0); |
bff9ce4d | 217 | |
0f113f3e MC |
218 | sk = vfy->get_cert_methods; |
219 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { | |
220 | lu = sk_X509_LOOKUP_value(sk, i); | |
221 | X509_LOOKUP_shutdown(lu); | |
222 | X509_LOOKUP_free(lu); | |
223 | } | |
224 | sk_X509_LOOKUP_free(sk); | |
b6ef12c4 | 225 | sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free); |
0f113f3e MC |
226 | |
227 | CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data); | |
222561fe | 228 | X509_VERIFY_PARAM_free(vfy->param); |
c001ce33 | 229 | CRYPTO_THREAD_lock_free(vfy->lock); |
0f113f3e MC |
230 | OPENSSL_free(vfy); |
231 | } | |
d02b48c6 | 232 | |
c001ce33 AG |
233 | int X509_STORE_up_ref(X509_STORE *vfy) |
234 | { | |
235 | int i; | |
236 | ||
2f545ae4 | 237 | if (CRYPTO_UP_REF(&vfy->references, &i, vfy->lock) <= 0) |
c001ce33 AG |
238 | return 0; |
239 | ||
e26f653d | 240 | REF_PRINT_COUNT("X509_STORE", vfy); |
c001ce33 AG |
241 | REF_ASSERT_ISNT(i < 2); |
242 | return ((i > 1) ? 1 : 0); | |
243 | } | |
244 | ||
6b691a5c | 245 | X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m) |
0f113f3e MC |
246 | { |
247 | int i; | |
248 | STACK_OF(X509_LOOKUP) *sk; | |
249 | X509_LOOKUP *lu; | |
250 | ||
251 | sk = v->get_cert_methods; | |
252 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { | |
253 | lu = sk_X509_LOOKUP_value(sk, i); | |
254 | if (m == lu->method) { | |
255 | return lu; | |
256 | } | |
257 | } | |
258 | /* a new one */ | |
259 | lu = X509_LOOKUP_new(m); | |
7fcdbd83 F |
260 | if (lu == NULL) { |
261 | X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE); | |
0f113f3e | 262 | return NULL; |
0f113f3e | 263 | } |
7fcdbd83 F |
264 | |
265 | lu->store_ctx = v; | |
266 | if (sk_X509_LOOKUP_push(v->get_cert_methods, lu)) | |
267 | return lu; | |
268 | /* malloc failed */ | |
269 | X509err(X509_F_X509_STORE_ADD_LOOKUP, ERR_R_MALLOC_FAILURE); | |
270 | X509_LOOKUP_free(lu); | |
271 | return NULL; | |
0f113f3e | 272 | } |
d02b48c6 | 273 | |
0946a198 DSH |
274 | X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs, |
275 | X509_LOOKUP_TYPE type, | |
6ddbb4cd | 276 | X509_NAME *name) |
f0e0fd51 | 277 | { |
6ddbb4cd | 278 | X509_OBJECT *ret = X509_OBJECT_new(); |
f0e0fd51 | 279 | |
6ddbb4cd | 280 | if (ret == NULL) |
f0e0fd51 | 281 | return NULL; |
6ddbb4cd RS |
282 | if (!X509_STORE_CTX_get_by_subject(vs, type, name, ret)) { |
283 | X509_OBJECT_free(ret); | |
f0e0fd51 RS |
284 | return NULL; |
285 | } | |
286 | return ret; | |
287 | } | |
288 | ||
6ddbb4cd RS |
289 | int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type, |
290 | X509_NAME *name, X509_OBJECT *ret) | |
0f113f3e | 291 | { |
faa9dcd4 | 292 | X509_STORE *store = vs->store; |
0f113f3e MC |
293 | X509_LOOKUP *lu; |
294 | X509_OBJECT stmp, *tmp; | |
295 | int i, j; | |
296 | ||
7a9abccd | 297 | if (store == NULL) |
1c705121 MC |
298 | return 0; |
299 | ||
b926f9de MC |
300 | stmp.type = X509_LU_NONE; |
301 | stmp.data.ptr = NULL; | |
302 | ||
7a9abccd SL |
303 | |
304 | X509_STORE_lock(store); | |
305 | tmp = X509_OBJECT_retrieve_by_subject(store->objs, type, name); | |
306 | X509_STORE_unlock(store); | |
0f113f3e MC |
307 | |
308 | if (tmp == NULL || type == X509_LU_CRL) { | |
7a9abccd SL |
309 | for (i = 0; i < sk_X509_LOOKUP_num(store->get_cert_methods); i++) { |
310 | lu = sk_X509_LOOKUP_value(store->get_cert_methods, i); | |
0f113f3e | 311 | j = X509_LOOKUP_by_subject(lu, type, name, &stmp); |
fc9d1ef3 | 312 | if (j) { |
0f113f3e MC |
313 | tmp = &stmp; |
314 | break; | |
315 | } | |
316 | } | |
0f113f3e MC |
317 | if (tmp == NULL) |
318 | return 0; | |
319 | } | |
320 | ||
c70e2ec3 BE |
321 | if (!X509_OBJECT_up_ref_count(tmp)) |
322 | return 0; | |
323 | ||
0f113f3e MC |
324 | ret->type = tmp->type; |
325 | ret->data.ptr = tmp->data.ptr; | |
326 | ||
0f113f3e MC |
327 | return 1; |
328 | } | |
d02b48c6 | 329 | |
7a9abccd | 330 | static int x509_store_add(X509_STORE *store, void *x, int crl) { |
0f113f3e | 331 | X509_OBJECT *obj; |
c0452248 | 332 | int ret = 0, added = 0; |
0f113f3e MC |
333 | |
334 | if (x == NULL) | |
335 | return 0; | |
6ddbb4cd RS |
336 | obj = X509_OBJECT_new(); |
337 | if (obj == NULL) | |
0f113f3e | 338 | return 0; |
c0452248 RS |
339 | |
340 | if (crl) { | |
341 | obj->type = X509_LU_CRL; | |
342 | obj->data.crl = (X509_CRL *)x; | |
343 | } else { | |
344 | obj->type = X509_LU_X509; | |
345 | obj->data.x509 = (X509 *)x; | |
346 | } | |
c70e2ec3 BE |
347 | if (!X509_OBJECT_up_ref_count(obj)) { |
348 | obj->type = X509_LU_NONE; | |
349 | X509_OBJECT_free(obj); | |
350 | return 0; | |
351 | } | |
0f113f3e | 352 | |
7a9abccd SL |
353 | X509_STORE_lock(store); |
354 | if (X509_OBJECT_retrieve_match(store->objs, obj)) { | |
c0452248 | 355 | ret = 1; |
68efafc5 | 356 | } else { |
7a9abccd | 357 | added = sk_X509_OBJECT_push(store->objs, obj); |
68efafc5 F |
358 | ret = added != 0; |
359 | } | |
7a9abccd | 360 | X509_STORE_unlock(store); |
0f113f3e | 361 | |
c0452248 | 362 | if (added == 0) /* obj not pushed */ |
68efafc5 | 363 | X509_OBJECT_free(obj); |
68efafc5 | 364 | |
0f113f3e MC |
365 | return ret; |
366 | } | |
2f043896 | 367 | |
c0452248 | 368 | int X509_STORE_add_cert(X509_STORE *ctx, X509 *x) |
0f113f3e | 369 | { |
c0452248 RS |
370 | if (!x509_store_add(ctx, x, 0)) { |
371 | X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE); | |
0f113f3e | 372 | return 0; |
68efafc5 | 373 | } |
c0452248 RS |
374 | return 1; |
375 | } | |
0f113f3e | 376 | |
c0452248 RS |
377 | int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x) |
378 | { | |
379 | if (!x509_store_add(ctx, x, 1)) { | |
68efafc5 | 380 | X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE); |
c0452248 RS |
381 | return 0; |
382 | } | |
383 | return 1; | |
0f113f3e | 384 | } |
2f043896 | 385 | |
c5ebfcab | 386 | int X509_OBJECT_up_ref_count(X509_OBJECT *a) |
0f113f3e MC |
387 | { |
388 | switch (a->type) { | |
f3b3d7f0 | 389 | case X509_LU_NONE: |
bca3f06b | 390 | break; |
0f113f3e | 391 | case X509_LU_X509: |
c5ebfcab | 392 | return X509_up_ref(a->data.x509); |
0f113f3e | 393 | case X509_LU_CRL: |
c5ebfcab | 394 | return X509_CRL_up_ref(a->data.crl); |
0f113f3e | 395 | } |
c5ebfcab | 396 | return 1; |
0f113f3e | 397 | } |
d02b48c6 | 398 | |
7d7da288 | 399 | X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a) |
f0e0fd51 | 400 | { |
6ddbb4cd RS |
401 | if (a == NULL || a->type != X509_LU_X509) |
402 | return NULL; | |
f0e0fd51 RS |
403 | return a->data.x509; |
404 | } | |
405 | ||
6ddbb4cd RS |
406 | X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *a) |
407 | { | |
408 | if (a == NULL || a->type != X509_LU_CRL) | |
409 | return NULL; | |
410 | return a->data.crl; | |
411 | } | |
412 | ||
0946a198 | 413 | X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a) |
f0c58c32 CH |
414 | { |
415 | return a->type; | |
416 | } | |
417 | ||
3cb7c5cf | 418 | X509_OBJECT *X509_OBJECT_new(void) |
f0e0fd51 | 419 | { |
6ddbb4cd RS |
420 | X509_OBJECT *ret = OPENSSL_zalloc(sizeof(*ret)); |
421 | ||
422 | if (ret == NULL) { | |
423 | X509err(X509_F_X509_OBJECT_NEW, ERR_R_MALLOC_FAILURE); | |
424 | return NULL; | |
425 | } | |
ba1a1c37 | 426 | ret->type = X509_LU_NONE; |
6ddbb4cd | 427 | return ret; |
f0e0fd51 RS |
428 | } |
429 | ||
0124f32a | 430 | static void x509_object_free_internal(X509_OBJECT *a) |
0f113f3e | 431 | { |
f0e0fd51 | 432 | if (a == NULL) |
222561fe | 433 | return; |
0f113f3e | 434 | switch (a->type) { |
f3b3d7f0 | 435 | case X509_LU_NONE: |
bca3f06b | 436 | break; |
0f113f3e MC |
437 | case X509_LU_X509: |
438 | X509_free(a->data.x509); | |
439 | break; | |
440 | case X509_LU_CRL: | |
441 | X509_CRL_free(a->data.crl); | |
442 | break; | |
443 | } | |
0124f32a MY |
444 | } |
445 | ||
446 | int X509_OBJECT_set1_X509(X509_OBJECT *a, X509 *obj) | |
447 | { | |
448 | if (a == NULL || !X509_up_ref(obj)) | |
449 | return 0; | |
450 | ||
451 | x509_object_free_internal(a); | |
452 | a->type = X509_LU_X509; | |
453 | a->data.x509 = obj; | |
454 | return 1; | |
455 | } | |
456 | ||
457 | int X509_OBJECT_set1_X509_CRL(X509_OBJECT *a, X509_CRL *obj) | |
458 | { | |
459 | if (a == NULL || !X509_CRL_up_ref(obj)) | |
460 | return 0; | |
461 | ||
462 | x509_object_free_internal(a); | |
463 | a->type = X509_LU_CRL; | |
464 | a->data.crl = obj; | |
465 | return 1; | |
466 | } | |
467 | ||
468 | void X509_OBJECT_free(X509_OBJECT *a) | |
469 | { | |
470 | x509_object_free_internal(a); | |
6ddbb4cd | 471 | OPENSSL_free(a); |
0f113f3e | 472 | } |
d02b48c6 | 473 | |
0946a198 | 474 | static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
0f113f3e MC |
475 | X509_NAME *name, int *pnmatch) |
476 | { | |
477 | X509_OBJECT stmp; | |
478 | X509 x509_s; | |
0f113f3e | 479 | X509_CRL crl_s; |
0f113f3e MC |
480 | int idx; |
481 | ||
482 | stmp.type = type; | |
483 | switch (type) { | |
484 | case X509_LU_X509: | |
485 | stmp.data.x509 = &x509_s; | |
5cf6abd8 | 486 | x509_s.cert_info.subject = name; |
0f113f3e MC |
487 | break; |
488 | case X509_LU_CRL: | |
489 | stmp.data.crl = &crl_s; | |
7aef39a7 | 490 | crl_s.crl.issuer = name; |
0f113f3e | 491 | break; |
f3b3d7f0 | 492 | case X509_LU_NONE: |
0f113f3e MC |
493 | /* abort(); */ |
494 | return -1; | |
495 | } | |
496 | ||
497 | idx = sk_X509_OBJECT_find(h, &stmp); | |
498 | if (idx >= 0 && pnmatch) { | |
499 | int tidx; | |
500 | const X509_OBJECT *tobj, *pstmp; | |
501 | *pnmatch = 1; | |
502 | pstmp = &stmp; | |
503 | for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) { | |
504 | tobj = sk_X509_OBJECT_value(h, tidx); | |
505 | if (x509_object_cmp(&tobj, &pstmp)) | |
506 | break; | |
507 | (*pnmatch)++; | |
508 | } | |
509 | } | |
510 | return idx; | |
511 | } | |
4d50a2b4 | 512 | |
0946a198 | 513 | int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
0f113f3e MC |
514 | X509_NAME *name) |
515 | { | |
516 | return x509_object_idx_cnt(h, type, name, NULL); | |
517 | } | |
518 | ||
519 | X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, | |
0946a198 DSH |
520 | X509_LOOKUP_TYPE type, |
521 | X509_NAME *name) | |
0f113f3e MC |
522 | { |
523 | int idx; | |
524 | idx = X509_OBJECT_idx_by_subject(h, type, name); | |
525 | if (idx == -1) | |
526 | return NULL; | |
527 | return sk_X509_OBJECT_value(h, idx); | |
528 | } | |
11262391 | 529 | |
f0c58c32 CH |
530 | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v) |
531 | { | |
532 | return v->objs; | |
533 | } | |
534 | ||
6ddbb4cd | 535 | STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm) |
0f113f3e MC |
536 | { |
537 | int i, idx, cnt; | |
6ddbb4cd | 538 | STACK_OF(X509) *sk = NULL; |
0f113f3e MC |
539 | X509 *x; |
540 | X509_OBJECT *obj; | |
faa9dcd4 | 541 | X509_STORE *store = ctx->store; |
6ddbb4cd | 542 | |
7a9abccd | 543 | if (store == NULL) |
1c705121 MC |
544 | return NULL; |
545 | ||
7a9abccd SL |
546 | X509_STORE_lock(store); |
547 | idx = x509_object_idx_cnt(store->objs, X509_LU_X509, nm, &cnt); | |
0f113f3e MC |
548 | if (idx < 0) { |
549 | /* | |
550 | * Nothing found in cache: do lookup to possibly add new objects to | |
551 | * cache | |
552 | */ | |
6ddbb4cd RS |
553 | X509_OBJECT *xobj = X509_OBJECT_new(); |
554 | ||
7a9abccd SL |
555 | X509_STORE_unlock(store); |
556 | ||
6ddbb4cd RS |
557 | if (xobj == NULL) |
558 | return NULL; | |
559 | if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, nm, xobj)) { | |
560 | X509_OBJECT_free(xobj); | |
0f113f3e MC |
561 | return NULL; |
562 | } | |
6ddbb4cd | 563 | X509_OBJECT_free(xobj); |
7a9abccd SL |
564 | X509_STORE_lock(store); |
565 | idx = x509_object_idx_cnt(store->objs, X509_LU_X509, nm, &cnt); | |
0f113f3e | 566 | if (idx < 0) { |
7a9abccd | 567 | X509_STORE_unlock(store); |
0f113f3e MC |
568 | return NULL; |
569 | } | |
570 | } | |
6ddbb4cd RS |
571 | |
572 | sk = sk_X509_new_null(); | |
0f113f3e | 573 | for (i = 0; i < cnt; i++, idx++) { |
7a9abccd | 574 | obj = sk_X509_OBJECT_value(store->objs, idx); |
0f113f3e | 575 | x = obj->data.x509; |
c70e2ec3 BE |
576 | if (!X509_up_ref(x)) { |
577 | X509_STORE_unlock(store); | |
578 | sk_X509_pop_free(sk, X509_free); | |
579 | return NULL; | |
580 | } | |
0f113f3e | 581 | if (!sk_X509_push(sk, x)) { |
7a9abccd | 582 | X509_STORE_unlock(store); |
0f113f3e MC |
583 | X509_free(x); |
584 | sk_X509_pop_free(sk, X509_free); | |
585 | return NULL; | |
586 | } | |
587 | } | |
7a9abccd | 588 | X509_STORE_unlock(store); |
0f113f3e | 589 | return sk; |
0f113f3e | 590 | } |
4d50a2b4 | 591 | |
6ddbb4cd | 592 | STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm) |
0f113f3e MC |
593 | { |
594 | int i, idx, cnt; | |
6ddbb4cd | 595 | STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null(); |
0f113f3e | 596 | X509_CRL *x; |
6ddbb4cd | 597 | X509_OBJECT *obj, *xobj = X509_OBJECT_new(); |
faa9dcd4 | 598 | X509_STORE *store = ctx->store; |
0f113f3e | 599 | |
6ddbb4cd | 600 | /* Always do lookup to possibly add new CRLs to cache */ |
1c705121 MC |
601 | if (sk == NULL |
602 | || xobj == NULL | |
7a9abccd | 603 | || store == NULL |
1c705121 | 604 | || !X509_STORE_CTX_get_by_subject(ctx, X509_LU_CRL, nm, xobj)) { |
6ddbb4cd | 605 | X509_OBJECT_free(xobj); |
0f113f3e MC |
606 | sk_X509_CRL_free(sk); |
607 | return NULL; | |
608 | } | |
6ddbb4cd | 609 | X509_OBJECT_free(xobj); |
7a9abccd SL |
610 | X509_STORE_lock(store); |
611 | idx = x509_object_idx_cnt(store->objs, X509_LU_CRL, nm, &cnt); | |
0f113f3e | 612 | if (idx < 0) { |
7a9abccd | 613 | X509_STORE_unlock(store); |
0f113f3e MC |
614 | sk_X509_CRL_free(sk); |
615 | return NULL; | |
616 | } | |
617 | ||
618 | for (i = 0; i < cnt; i++, idx++) { | |
7a9abccd | 619 | obj = sk_X509_OBJECT_value(store->objs, idx); |
0f113f3e | 620 | x = obj->data.crl; |
c70e2ec3 BE |
621 | if (!X509_CRL_up_ref(x)) { |
622 | X509_STORE_unlock(store); | |
623 | sk_X509_CRL_pop_free(sk, X509_CRL_free); | |
624 | return NULL; | |
625 | } | |
0f113f3e | 626 | if (!sk_X509_CRL_push(sk, x)) { |
7a9abccd | 627 | X509_STORE_unlock(store); |
0f113f3e MC |
628 | X509_CRL_free(x); |
629 | sk_X509_CRL_pop_free(sk, X509_CRL_free); | |
630 | return NULL; | |
631 | } | |
632 | } | |
7a9abccd | 633 | X509_STORE_unlock(store); |
0f113f3e MC |
634 | return sk; |
635 | } | |
636 | ||
637 | X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, | |
638 | X509_OBJECT *x) | |
639 | { | |
5b37fef0 | 640 | int idx, i, num; |
0f113f3e | 641 | X509_OBJECT *obj; |
5b37fef0 | 642 | |
0f113f3e | 643 | idx = sk_X509_OBJECT_find(h, x); |
5b37fef0 | 644 | if (idx < 0) |
0f113f3e MC |
645 | return NULL; |
646 | if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL)) | |
647 | return sk_X509_OBJECT_value(h, idx); | |
5b37fef0 | 648 | for (i = idx, num = sk_X509_OBJECT_num(h); i < num; i++) { |
0f113f3e | 649 | obj = sk_X509_OBJECT_value(h, i); |
5b37fef0 AP |
650 | if (x509_object_cmp((const X509_OBJECT **)&obj, |
651 | (const X509_OBJECT **)&x)) | |
0f113f3e MC |
652 | return NULL; |
653 | if (x->type == X509_LU_X509) { | |
654 | if (!X509_cmp(obj->data.x509, x->data.x509)) | |
655 | return obj; | |
656 | } else if (x->type == X509_LU_CRL) { | |
657 | if (!X509_CRL_match(obj->data.crl, x->data.crl)) | |
658 | return obj; | |
659 | } else | |
660 | return obj; | |
661 | } | |
662 | return NULL; | |
663 | } | |
d02b48c6 | 664 | |
1d97c843 TH |
665 | /*- |
666 | * Try to get issuer certificate from store. Due to limitations | |
2f043896 DSH |
667 | * of the API this can only retrieve a single certificate matching |
668 | * a given subject name. However it will fill the cache with all | |
a8397553 | 669 | * matching certificates, so we can examine the cache for all |
2f043896 DSH |
670 | * matches. |
671 | * | |
672 | * Return values are: | |
673 | * 1 lookup successful. | |
674 | * 0 certificate not found. | |
675 | * -1 some other error. | |
676 | */ | |
2f043896 | 677 | int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) |
0f113f3e MC |
678 | { |
679 | X509_NAME *xn; | |
6ddbb4cd | 680 | X509_OBJECT *obj = X509_OBJECT_new(), *pobj = NULL; |
faa9dcd4 | 681 | X509_STORE *store = ctx->store; |
0f113f3e | 682 | int i, ok, idx, ret; |
f0e0fd51 | 683 | |
6ddbb4cd RS |
684 | if (obj == NULL) |
685 | return -1; | |
0f113f3e MC |
686 | *issuer = NULL; |
687 | xn = X509_get_issuer_name(x); | |
6ddbb4cd | 688 | ok = X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, xn, obj); |
ba1a1c37 | 689 | if (ok != 1) { |
6ddbb4cd | 690 | X509_OBJECT_free(obj); |
0f113f3e MC |
691 | return 0; |
692 | } | |
693 | /* If certificate matches all OK */ | |
6ddbb4cd RS |
694 | if (ctx->check_issued(ctx, x, obj->data.x509)) { |
695 | if (x509_check_cert_time(ctx, obj->data.x509, -1)) { | |
696 | *issuer = obj->data.x509; | |
c70e2ec3 BE |
697 | if (!X509_up_ref(*issuer)) { |
698 | *issuer = NULL; | |
699 | ok = -1; | |
700 | } | |
6ddbb4cd | 701 | X509_OBJECT_free(obj); |
c70e2ec3 | 702 | return ok; |
0f113f3e MC |
703 | } |
704 | } | |
6ddbb4cd | 705 | X509_OBJECT_free(obj); |
0f113f3e | 706 | |
7a9abccd | 707 | if (store == NULL) |
1c705121 MC |
708 | return 0; |
709 | ||
0f113f3e MC |
710 | /* Else find index of first cert accepted by 'check_issued' */ |
711 | ret = 0; | |
7a9abccd SL |
712 | X509_STORE_lock(store); |
713 | idx = X509_OBJECT_idx_by_subject(store->objs, X509_LU_X509, xn); | |
0f113f3e MC |
714 | if (idx != -1) { /* should be true as we've had at least one |
715 | * match */ | |
716 | /* Look through all matching certs for suitable issuer */ | |
7a9abccd SL |
717 | for (i = idx; i < sk_X509_OBJECT_num(store->objs); i++) { |
718 | pobj = sk_X509_OBJECT_value(store->objs, i); | |
0f113f3e MC |
719 | /* See if we've run past the matches */ |
720 | if (pobj->type != X509_LU_X509) | |
721 | break; | |
722 | if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) | |
723 | break; | |
724 | if (ctx->check_issued(ctx, x, pobj->data.x509)) { | |
725 | *issuer = pobj->data.x509; | |
726 | ret = 1; | |
727 | /* | |
728 | * If times check, exit with match, | |
729 | * otherwise keep looking. Leave last | |
730 | * match in issuer so we return nearest | |
731 | * match if no certificate time is OK. | |
732 | */ | |
733 | ||
70dd3c65 | 734 | if (x509_check_cert_time(ctx, *issuer, -1)) |
0f113f3e MC |
735 | break; |
736 | } | |
737 | } | |
738 | } | |
c70e2ec3 BE |
739 | if (*issuer && !X509_up_ref(*issuer)) { |
740 | *issuer = NULL; | |
741 | ret = -1; | |
742 | } | |
7a9abccd | 743 | X509_STORE_unlock(store); |
0f113f3e MC |
744 | return ret; |
745 | } | |
d02b48c6 | 746 | |
5d7c222d | 747 | int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags) |
0f113f3e MC |
748 | { |
749 | return X509_VERIFY_PARAM_set_flags(ctx->param, flags); | |
750 | } | |
5d7c222d DSH |
751 | |
752 | int X509_STORE_set_depth(X509_STORE *ctx, int depth) | |
0f113f3e MC |
753 | { |
754 | X509_VERIFY_PARAM_set_depth(ctx->param, depth); | |
755 | return 1; | |
756 | } | |
bdee69f7 | 757 | |
926a56bf | 758 | int X509_STORE_set_purpose(X509_STORE *ctx, int purpose) |
0f113f3e MC |
759 | { |
760 | return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose); | |
761 | } | |
926a56bf DSH |
762 | |
763 | int X509_STORE_set_trust(X509_STORE *ctx, int trust) | |
0f113f3e MC |
764 | { |
765 | return X509_VERIFY_PARAM_set_trust(ctx->param, trust); | |
766 | } | |
5d7c222d DSH |
767 | |
768 | int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param) | |
0f113f3e MC |
769 | { |
770 | return X509_VERIFY_PARAM_set1(ctx->param, param); | |
771 | } | |
926a56bf | 772 | |
f0c58c32 CH |
773 | X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx) |
774 | { | |
775 | return ctx->param; | |
776 | } | |
777 | ||
1060a50b RL |
778 | void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify) |
779 | { | |
780 | ctx->verify = verify; | |
781 | } | |
782 | ||
783 | X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx) | |
784 | { | |
785 | return ctx->verify; | |
786 | } | |
787 | ||
a5b37fca | 788 | void X509_STORE_set_verify_cb(X509_STORE *ctx, |
1060a50b | 789 | X509_STORE_CTX_verify_cb verify_cb) |
0f113f3e MC |
790 | { |
791 | ctx->verify_cb = verify_cb; | |
792 | } | |
a5b37fca | 793 | |
1060a50b | 794 | X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx) |
7cafbb4b | 795 | { |
1060a50b RL |
796 | return ctx->verify_cb; |
797 | } | |
798 | ||
799 | void X509_STORE_set_get_issuer(X509_STORE *ctx, | |
800 | X509_STORE_CTX_get_issuer_fn get_issuer) | |
801 | { | |
802 | ctx->get_issuer = get_issuer; | |
803 | } | |
804 | ||
805 | X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(X509_STORE *ctx) | |
806 | { | |
807 | return ctx->get_issuer; | |
808 | } | |
809 | ||
810 | void X509_STORE_set_check_issued(X509_STORE *ctx, | |
811 | X509_STORE_CTX_check_issued_fn check_issued) | |
812 | { | |
813 | ctx->check_issued = check_issued; | |
814 | } | |
815 | ||
816 | X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *ctx) | |
817 | { | |
818 | return ctx->check_issued; | |
819 | } | |
820 | ||
821 | void X509_STORE_set_check_revocation(X509_STORE *ctx, | |
822 | X509_STORE_CTX_check_revocation_fn check_revocation) | |
823 | { | |
824 | ctx->check_revocation = check_revocation; | |
825 | } | |
826 | ||
827 | X509_STORE_CTX_check_revocation_fn X509_STORE_get_check_revocation(X509_STORE *ctx) | |
828 | { | |
829 | return ctx->check_revocation; | |
830 | } | |
831 | ||
832 | void X509_STORE_set_get_crl(X509_STORE *ctx, | |
833 | X509_STORE_CTX_get_crl_fn get_crl) | |
834 | { | |
835 | ctx->get_crl = get_crl; | |
836 | } | |
837 | ||
838 | X509_STORE_CTX_get_crl_fn X509_STORE_get_get_crl(X509_STORE *ctx) | |
839 | { | |
840 | return ctx->get_crl; | |
841 | } | |
842 | ||
843 | void X509_STORE_set_check_crl(X509_STORE *ctx, | |
844 | X509_STORE_CTX_check_crl_fn check_crl) | |
845 | { | |
846 | ctx->check_crl = check_crl; | |
847 | } | |
848 | ||
849 | X509_STORE_CTX_check_crl_fn X509_STORE_get_check_crl(X509_STORE *ctx) | |
850 | { | |
851 | return ctx->check_crl; | |
852 | } | |
853 | ||
854 | void X509_STORE_set_cert_crl(X509_STORE *ctx, | |
855 | X509_STORE_CTX_cert_crl_fn cert_crl) | |
856 | { | |
857 | ctx->cert_crl = cert_crl; | |
858 | } | |
859 | ||
860 | X509_STORE_CTX_cert_crl_fn X509_STORE_get_cert_crl(X509_STORE *ctx) | |
861 | { | |
862 | return ctx->cert_crl; | |
863 | } | |
864 | ||
0a5fe2eb RL |
865 | void X509_STORE_set_check_policy(X509_STORE *ctx, |
866 | X509_STORE_CTX_check_policy_fn check_policy) | |
867 | { | |
868 | ctx->check_policy = check_policy; | |
869 | } | |
870 | ||
871 | X509_STORE_CTX_check_policy_fn X509_STORE_get_check_policy(X509_STORE *ctx) | |
872 | { | |
873 | return ctx->check_policy; | |
874 | } | |
875 | ||
1060a50b RL |
876 | void X509_STORE_set_lookup_certs(X509_STORE *ctx, |
877 | X509_STORE_CTX_lookup_certs_fn lookup_certs) | |
878 | { | |
879 | ctx->lookup_certs = lookup_certs; | |
880 | } | |
881 | ||
882 | X509_STORE_CTX_lookup_certs_fn X509_STORE_get_lookup_certs(X509_STORE *ctx) | |
883 | { | |
884 | return ctx->lookup_certs; | |
885 | } | |
886 | ||
887 | void X509_STORE_set_lookup_crls(X509_STORE *ctx, | |
888 | X509_STORE_CTX_lookup_crls_fn lookup_crls) | |
889 | { | |
890 | ctx->lookup_crls = lookup_crls; | |
891 | } | |
892 | ||
893 | X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx) | |
894 | { | |
895 | return ctx->lookup_crls; | |
896 | } | |
897 | ||
898 | void X509_STORE_set_cleanup(X509_STORE *ctx, | |
899 | X509_STORE_CTX_cleanup_fn ctx_cleanup) | |
900 | { | |
901 | ctx->cleanup = ctx_cleanup; | |
7cafbb4b MC |
902 | } |
903 | ||
1060a50b | 904 | X509_STORE_CTX_cleanup_fn X509_STORE_get_cleanup(X509_STORE *ctx) |
0f113f3e | 905 | { |
1060a50b | 906 | return ctx->cleanup; |
0f113f3e | 907 | } |
2c340864 | 908 | |
3aec886e KY |
909 | int X509_STORE_set_ex_data(X509_STORE *ctx, int idx, void *data) |
910 | { | |
911 | return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); | |
912 | } | |
913 | ||
914 | void *X509_STORE_get_ex_data(X509_STORE *ctx, int idx) | |
915 | { | |
916 | return CRYPTO_get_ex_data(&ctx->ex_data, idx); | |
917 | } | |
918 | ||
2c340864 | 919 | X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx) |
0f113f3e | 920 | { |
faa9dcd4 | 921 | return ctx->store; |
0f113f3e | 922 | } |