[thirdparty/openssl.git] / crypto / x509 / by_store.c

/*
 * Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/store.h>
#include "internal/cryptlib.h"
#include "crypto/x509.h"
#include "x509_local.h"

/* Generic object loader, given expected type and criterion */
static int cache_objects(X509_LOOKUP *lctx, const char *uri,
                         const OSSL_STORE_SEARCH *criterion,
                         int depth, OSSL_LIB_CTX *libctx, const char *propq)
{
    int ok = 0;
    OSSL_STORE_CTX *ctx = NULL;
    X509_STORE *xstore = X509_LOOKUP_get_store(lctx);

    if ((ctx = OSSL_STORE_open_ex(uri, libctx, propq, NULL, NULL, NULL,
                                  NULL, NULL)) == NULL)
        return 0;

    /*
     * We try to set the criterion, but don't care if it was valid or not.
     * For an OSSL_STORE, it merely serves as an optimization, the expectation
     * being that if the criterion couldn't be used, we will get *everything*
     * from the container that the URI represents rather than the subset that
     * the criterion indicates, so the biggest harm is that we cache more
     * objects certs and CRLs than we may expect, but that's ok.
     *
     * Specifically for OpenSSL's own file: scheme, the only workable
     * criterion is the BY_NAME one, which it can only apply on directories,
     * but it's possible that the URI is a single file rather than a directory,
     * and in that case, the BY_NAME criterion is pointless.
     *
     * We could very simply not apply any criterion at all here, and just let
     * the code that selects certs and CRLs from the cached objects do its job,
     * but it's a nice optimization when it can be applied (such as on an
     * actual directory with a thousand CA certs).
     */
    if (criterion != NULL)
        OSSL_STORE_find(ctx, criterion);

    for (;;) {
        OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
        int infotype;

        /* NULL means error or "end of file".  Either way, we break. */
        if (info == NULL)
            break;

        infotype = OSSL_STORE_INFO_get_type(info);
        ok = 0;

        if (infotype == OSSL_STORE_INFO_NAME) {
            /*
             * This is an entry in the "directory" represented by the current
             * uri.  if |depth| allows, dive into it.
             */
            if (depth > 0)
                ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
                                   criterion, depth - 1, libctx, propq);
        } else {
            /*
             * We know that X509_STORE_add_{cert|crl} increments the object's
             * refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
             * to get them.
             */
            switch (infotype) {
            case OSSL_STORE_INFO_CERT:
                ok = X509_STORE_add_cert(xstore,
                                         OSSL_STORE_INFO_get0_CERT(info));
                break;
            case OSSL_STORE_INFO_CRL:
                ok = X509_STORE_add_crl(xstore,
                                        OSSL_STORE_INFO_get0_CRL(info));
                break;
            }
        }

        OSSL_STORE_INFO_free(info);
        if (!ok)
            break;
    }
    OSSL_STORE_close(ctx);

    return ok;
}


/* Because OPENSSL_free is a macro and for C type match */
static void free_uri(OPENSSL_STRING data)
{
    OPENSSL_free(data);
}

static void by_store_free(X509_LOOKUP *ctx)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    sk_OPENSSL_STRING_pop_free(uris, free_uri);
}

static int by_store_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp,
                            long argl, char **retp, OSSL_LIB_CTX *libctx,
                            const char *propq)
{
    switch (cmd) {
    case X509_L_ADD_STORE:
        /* If no URI is given, use the default cert dir as default URI */
        if (argp == NULL)
            argp = ossl_safe_getenv(X509_get_default_cert_dir_env());

        if (argp == NULL)
            argp = X509_get_default_cert_dir();

        {
            STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
            char *data = OPENSSL_strdup(argp);

            if (data == NULL) {
                return 0;
            }
            if (uris == NULL) {
                uris = sk_OPENSSL_STRING_new_null();
                X509_LOOKUP_set_method_data(ctx, uris);
            }
            return sk_OPENSSL_STRING_push(uris, data) > 0;
        }
    case X509_L_LOAD_STORE:
        /* This is a shortcut for quick loading of specific containers */
        return cache_objects(ctx, argp, NULL, 0, libctx, propq);
    }

    return 0;
}

static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
                         const char *argp, long argl, char **retp)
{
    return by_store_ctrl_ex(ctx, cmd, argp, argl, retp, NULL, NULL);
}

static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                    const OSSL_STORE_SEARCH *criterion, X509_OBJECT *ret,
                    OSSL_LIB_CTX *libctx, const char *propq)
{
    STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
    int i;
    int ok = 0;

    for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
        ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
                           1 /* depth */, libctx, propq);

        if (ok)
            break;
    }
    return ok;
}

static int by_store_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret,
                               OSSL_LIB_CTX *libctx, const char *propq)
{
    OSSL_STORE_SEARCH *criterion =
        OSSL_STORE_SEARCH_by_name((X509_NAME *)name); /* won't modify it */
    int ok = by_store(ctx, type, criterion, ret, libctx, propq);
    STACK_OF(X509_OBJECT) *store_objects =
        X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
    X509_OBJECT *tmp = NULL;

    OSSL_STORE_SEARCH_free(criterion);

    if (ok)
        tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);

    ok = 0;
    if (tmp != NULL) {
        /*
         * This could also be done like this:
         *
         *     if (tmp != NULL) {
         *         *ret = *tmp;
         *         ok = 1;
         *     }
         *
         * However, we want to exercise the documented API to the max, so
         * we do it the hard way.
         *
         * To be noted is that X509_OBJECT_set1_* increment the refcount,
         * but so does X509_STORE_CTX_get_by_subject upon return of this
         * function, so we must ensure the refcount is decremented
         * before we return, or we will get a refcount leak.  We cannot do
         * this with X509_OBJECT_free(), though, as that will free a bit
         * too much.
         */
        switch (type) {
        case X509_LU_X509:
            ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
            if (ok)
                X509_free(tmp->data.x509);
            break;
        case X509_LU_CRL:
            ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
            if (ok)
                X509_CRL_free(tmp->data.crl);
            break;
        case X509_LU_NONE:
            break;
        }
    }
    return ok;
}

static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
                            const X509_NAME *name, X509_OBJECT *ret)
{
    return by_store_subject_ex(ctx, type, name, ret, NULL, NULL);
}

/*
 * We lack the implementations for get_by_issuer_serial, get_by_fingerprint
 * and get_by_alias.  There's simply not enough support in the X509_LOOKUP
 * or X509_STORE APIs.
 */

static X509_LOOKUP_METHOD x509_store_lookup = {
    "Load certs from STORE URIs",
    NULL,                        /* new_item */
    by_store_free,               /* free */
    NULL,                        /* init */
    NULL,                        /* shutdown */
    by_store_ctrl,               /* ctrl */
    by_store_subject,            /* get_by_subject */
    NULL,                        /* get_by_issuer_serial */
    NULL,                        /* get_by_fingerprint */
    NULL,                        /* get_by_alias */
    by_store_subject_ex,
    by_store_ctrl_ex
};

X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
{
    return &x509_store_lookup;
}
Commit	Line	Data
6dcb100f	1	/*
da1c088f	2	* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
6dcb100f RL	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <openssl/store.h>
	11	#include "internal/cryptlib.h"
	12	#include "crypto/x509.h"
	13	#include "x509_local.h"
	14
	15	/* Generic object loader, given expected type and criterion */
	16	static int cache_objects(X509_LOOKUP lctx, const char uri,
	17	const OSSL_STORE_SEARCH *criterion,
b4250010	18	int depth, OSSL_LIB_CTX libctx, const char propq)
6dcb100f RL	19	{
	20	int ok = 0;
	21	OSSL_STORE_CTX *ctx = NULL;
	22	X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
	23
d382e796 TM	24	if ((ctx = OSSL_STORE_open_ex(uri, libctx, propq, NULL, NULL, NULL,
d382e796 TM	25	NULL, NULL)) == NULL)
6dcb100f RL	26	return 0;
	27
	28	/*
	29	* We try to set the criterion, but don't care if it was valid or not.
c7340583	30	* For an OSSL_STORE, it merely serves as an optimization, the expectation
6dcb100f RL	31	* being that if the criterion couldn't be used, we will get everything
	32	* from the container that the URI represents rather than the subset that
	33	* the criterion indicates, so the biggest harm is that we cache more
	34	* objects certs and CRLs than we may expect, but that's ok.
	35	*
	36	* Specifically for OpenSSL's own file: scheme, the only workable
	37	* criterion is the BY_NAME one, which it can only apply on directories,
	38	* but it's possible that the URI is a single file rather than a directory,
	39	* and in that case, the BY_NAME criterion is pointless.
	40	*
	41	* We could very simply not apply any criterion at all here, and just let
	42	* the code that selects certs and CRLs from the cached objects do its job,
	43	* but it's a nice optimization when it can be applied (such as on an
	44	* actual directory with a thousand CA certs).
	45	*/
	46	if (criterion != NULL)
	47	OSSL_STORE_find(ctx, criterion);
	48
	49	for (;;) {
	50	OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
	51	int infotype;
	52
	53	/* NULL means error or "end of file". Either way, we break. */
	54	if (info == NULL)
	55	break;
	56
	57	infotype = OSSL_STORE_INFO_get_type(info);
	58	ok = 0;
	59
	60	if (infotype == OSSL_STORE_INFO_NAME) {
	61	/*
	62	* This is an entry in the "directory" represented by the current
	63	* uri. if \|depth\| allows, dive into it.
	64	*/
	65	if (depth > 0)
	66	ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
6725682d	67	criterion, depth - 1, libctx, propq);
6dcb100f RL	68	} else {
	69	/*
	70	* We know that X509_STORE_add_{cert\|crl} increments the object's
	71	* refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
	72	* to get them.
	73	*/
	74	switch (infotype) {
	75	case OSSL_STORE_INFO_CERT:
	76	ok = X509_STORE_add_cert(xstore,
	77	OSSL_STORE_INFO_get0_CERT(info));
	78	break;
	79	case OSSL_STORE_INFO_CRL:
	80	ok = X509_STORE_add_crl(xstore,
	81	OSSL_STORE_INFO_get0_CRL(info));
	82	break;
	83	}
	84	}
	85
	86	OSSL_STORE_INFO_free(info);
	87	if (!ok)
	88	break;
	89	}
	90	OSSL_STORE_close(ctx);
	91
	92	return ok;
	93	}
	94
	95
	96	/* Because OPENSSL_free is a macro and for C type match */
	97	static void free_uri(OPENSSL_STRING data)
	98	{
	99	OPENSSL_free(data);
	100	}
	101
	102	static void by_store_free(X509_LOOKUP *ctx)
	103	{
	104	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	105	sk_OPENSSL_STRING_pop_free(uris, free_uri);
	106	}
	107
d8652be0	108	static int by_store_ctrl_ex(X509_LOOKUP ctx, int cmd, const char argp,
b4250010	109	long argl, char *retp, OSSL_LIB_CTX libctx,
d8652be0	110	const char *propq)
6dcb100f RL	111	{
	112	switch (cmd) {
	113	case X509_L_ADD_STORE:
dfdbc113	114	/* If no URI is given, use the default cert dir as default URI */
606e0426	115	if (argp == NULL)
6dcb100f	116	argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
021859bf	117
6dcb100f	118	if (argp == NULL)
dfdbc113	119	argp = X509_get_default_cert_dir();
6dcb100f RL	120
	121	{
	122	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
e163969d	123	char *data = OPENSSL_strdup(argp);
6dcb100f	124
e163969d JJ	125	if (data == NULL) {
	126	return 0;
	127	}
6dcb100f RL	128	if (uris == NULL) {
	129	uris = sk_OPENSSL_STRING_new_null();
	130	X509_LOOKUP_set_method_data(ctx, uris);
	131	}
e163969d	132	return sk_OPENSSL_STRING_push(uris, data) > 0;
6dcb100f RL	133	}
	134	case X509_L_LOAD_STORE:
	135	/* This is a shortcut for quick loading of specific containers */
6725682d	136	return cache_objects(ctx, argp, NULL, 0, libctx, propq);
6dcb100f RL	137	}
	138
	139	return 0;
	140	}
	141
6725682d SL	142	static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
	143	const char argp, long argl, char *retp)
	144	{
d8652be0	145	return by_store_ctrl_ex(ctx, cmd, argp, argl, retp, NULL, NULL);
6725682d SL	146	}
6725682d SL	147
6dcb100f	148	static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
6725682d	149	const OSSL_STORE_SEARCH criterion, X509_OBJECT ret,
b4250010	150	OSSL_LIB_CTX libctx, const char propq)
6dcb100f RL	151	{
	152	STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
	153	int i;
	154	int ok = 0;
	155
	156	for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
	157	ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
6725682d	158	1 /* depth */, libctx, propq);
6dcb100f RL	159
	160	if (ok)
	161	break;
	162	}
	163	return ok;
	164	}
	165
d8652be0 MC	166	static int by_store_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
d8652be0 MC	167	const X509_NAME name, X509_OBJECT ret,
b4250010	168	OSSL_LIB_CTX libctx, const char propq)
6dcb100f	169	{
8cc86b81 DDO	170	OSSL_STORE_SEARCH *criterion =
8cc86b81 DDO	171	OSSL_STORE_SEARCH_by_name((X509_NAME )name); / won't modify it */
6725682d	172	int ok = by_store(ctx, type, criterion, ret, libctx, propq);
6dcb100f RL	173	STACK_OF(X509_OBJECT) *store_objects =
	174	X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
	175	X509_OBJECT *tmp = NULL;
	176
	177	OSSL_STORE_SEARCH_free(criterion);
	178
	179	if (ok)
	180	tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);
	181
	182	ok = 0;
	183	if (tmp != NULL) {
	184	/*
	185	* This could also be done like this:
	186	*
	187	* if (tmp != NULL) {
	188	* ret = tmp;
	189	* ok = 1;
	190	* }
	191	*
	192	* However, we want to exercise the documented API to the max, so
	193	* we do it the hard way.
	194	*
	195	* To be noted is that X509_OBJECT_set1_* increment the refcount,
	196	* but so does X509_STORE_CTX_get_by_subject upon return of this
3e6a0d57	197	* function, so we must ensure the refcount is decremented
6dcb100f RL	198	* before we return, or we will get a refcount leak. We cannot do
	199	* this with X509_OBJECT_free(), though, as that will free a bit
	200	* too much.
	201	*/
	202	switch (type) {
	203	case X509_LU_X509:
	204	ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
	205	if (ok)
	206	X509_free(tmp->data.x509);
	207	break;
	208	case X509_LU_CRL:
	209	ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
	210	if (ok)
	211	X509_CRL_free(tmp->data.crl);
	212	break;
	213	case X509_LU_NONE:
	214	break;
	215	}
	216	}
	217	return ok;
	218	}
	219
6725682d SL	220	static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
	221	const X509_NAME name, X509_OBJECT ret)
	222	{
d8652be0	223	return by_store_subject_ex(ctx, type, name, ret, NULL, NULL);
6725682d SL	224	}
6725682d SL	225
6dcb100f RL	226	/*
	227	* We lack the implementations for get_by_issuer_serial, get_by_fingerprint
	228	* and get_by_alias. There's simply not enough support in the X509_LOOKUP
	229	* or X509_STORE APIs.
	230	*/
	231
	232	static X509_LOOKUP_METHOD x509_store_lookup = {
	233	"Load certs from STORE URIs",
	234	NULL, /* new_item */
	235	by_store_free, /* free */
	236	NULL, /* init */
	237	NULL, /* shutdown */
	238	by_store_ctrl, /* ctrl */
	239	by_store_subject, /* get_by_subject */
	240	NULL, /* get_by_issuer_serial */
	241	NULL, /* get_by_fingerprint */
	242	NULL, /* get_by_alias */
d8652be0 MC	243	by_store_subject_ex,
d8652be0 MC	244	by_store_ctrl_ex
6dcb100f RL	245	};
	246
	247	X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
	248	{
	249	return &x509_store_lookup;
	250	}