]>
Commit | Line | Data |
---|---|---|
6dcb100f | 1 | /* |
8020d79b | 2 | * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. |
6dcb100f RL |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <openssl/store.h> | |
11 | #include "internal/cryptlib.h" | |
12 | #include "crypto/x509.h" | |
13 | #include "x509_local.h" | |
14 | ||
15 | /* Generic object loader, given expected type and criterion */ | |
16 | static int cache_objects(X509_LOOKUP *lctx, const char *uri, | |
17 | const OSSL_STORE_SEARCH *criterion, | |
b4250010 | 18 | int depth, OSSL_LIB_CTX *libctx, const char *propq) |
6dcb100f RL |
19 | { |
20 | int ok = 0; | |
21 | OSSL_STORE_CTX *ctx = NULL; | |
22 | X509_STORE *xstore = X509_LOOKUP_get_store(lctx); | |
23 | ||
d382e796 TM |
24 | if ((ctx = OSSL_STORE_open_ex(uri, libctx, propq, NULL, NULL, NULL, |
25 | NULL, NULL)) == NULL) | |
6dcb100f RL |
26 | return 0; |
27 | ||
28 | /* | |
29 | * We try to set the criterion, but don't care if it was valid or not. | |
c7340583 | 30 | * For an OSSL_STORE, it merely serves as an optimization, the expectation |
6dcb100f RL |
31 | * being that if the criterion couldn't be used, we will get *everything* |
32 | * from the container that the URI represents rather than the subset that | |
33 | * the criterion indicates, so the biggest harm is that we cache more | |
34 | * objects certs and CRLs than we may expect, but that's ok. | |
35 | * | |
36 | * Specifically for OpenSSL's own file: scheme, the only workable | |
37 | * criterion is the BY_NAME one, which it can only apply on directories, | |
38 | * but it's possible that the URI is a single file rather than a directory, | |
39 | * and in that case, the BY_NAME criterion is pointless. | |
40 | * | |
41 | * We could very simply not apply any criterion at all here, and just let | |
42 | * the code that selects certs and CRLs from the cached objects do its job, | |
43 | * but it's a nice optimization when it can be applied (such as on an | |
44 | * actual directory with a thousand CA certs). | |
45 | */ | |
46 | if (criterion != NULL) | |
47 | OSSL_STORE_find(ctx, criterion); | |
48 | ||
49 | for (;;) { | |
50 | OSSL_STORE_INFO *info = OSSL_STORE_load(ctx); | |
51 | int infotype; | |
52 | ||
53 | /* NULL means error or "end of file". Either way, we break. */ | |
54 | if (info == NULL) | |
55 | break; | |
56 | ||
57 | infotype = OSSL_STORE_INFO_get_type(info); | |
58 | ok = 0; | |
59 | ||
60 | if (infotype == OSSL_STORE_INFO_NAME) { | |
61 | /* | |
62 | * This is an entry in the "directory" represented by the current | |
63 | * uri. if |depth| allows, dive into it. | |
64 | */ | |
65 | if (depth > 0) | |
66 | ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info), | |
6725682d | 67 | criterion, depth - 1, libctx, propq); |
6dcb100f RL |
68 | } else { |
69 | /* | |
70 | * We know that X509_STORE_add_{cert|crl} increments the object's | |
71 | * refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl} | |
72 | * to get them. | |
73 | */ | |
74 | switch (infotype) { | |
75 | case OSSL_STORE_INFO_CERT: | |
76 | ok = X509_STORE_add_cert(xstore, | |
77 | OSSL_STORE_INFO_get0_CERT(info)); | |
78 | break; | |
79 | case OSSL_STORE_INFO_CRL: | |
80 | ok = X509_STORE_add_crl(xstore, | |
81 | OSSL_STORE_INFO_get0_CRL(info)); | |
82 | break; | |
83 | } | |
84 | } | |
85 | ||
86 | OSSL_STORE_INFO_free(info); | |
87 | if (!ok) | |
88 | break; | |
89 | } | |
90 | OSSL_STORE_close(ctx); | |
91 | ||
92 | return ok; | |
93 | } | |
94 | ||
95 | ||
96 | /* Because OPENSSL_free is a macro and for C type match */ | |
97 | static void free_uri(OPENSSL_STRING data) | |
98 | { | |
99 | OPENSSL_free(data); | |
100 | } | |
101 | ||
102 | static void by_store_free(X509_LOOKUP *ctx) | |
103 | { | |
104 | STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx); | |
105 | sk_OPENSSL_STRING_pop_free(uris, free_uri); | |
106 | } | |
107 | ||
d8652be0 | 108 | static int by_store_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp, |
b4250010 | 109 | long argl, char **retp, OSSL_LIB_CTX *libctx, |
d8652be0 | 110 | const char *propq) |
6dcb100f RL |
111 | { |
112 | switch (cmd) { | |
113 | case X509_L_ADD_STORE: | |
dfdbc113 | 114 | /* If no URI is given, use the default cert dir as default URI */ |
606e0426 | 115 | if (argp == NULL) |
6dcb100f | 116 | argp = ossl_safe_getenv(X509_get_default_cert_dir_env()); |
021859bf | 117 | |
6dcb100f | 118 | if (argp == NULL) |
dfdbc113 | 119 | argp = X509_get_default_cert_dir(); |
6dcb100f RL |
120 | |
121 | { | |
122 | STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx); | |
e163969d | 123 | char *data = OPENSSL_strdup(argp); |
6dcb100f | 124 | |
e163969d JJ |
125 | if (data == NULL) { |
126 | return 0; | |
127 | } | |
6dcb100f RL |
128 | if (uris == NULL) { |
129 | uris = sk_OPENSSL_STRING_new_null(); | |
130 | X509_LOOKUP_set_method_data(ctx, uris); | |
131 | } | |
e163969d | 132 | return sk_OPENSSL_STRING_push(uris, data) > 0; |
6dcb100f RL |
133 | } |
134 | case X509_L_LOAD_STORE: | |
135 | /* This is a shortcut for quick loading of specific containers */ | |
6725682d | 136 | return cache_objects(ctx, argp, NULL, 0, libctx, propq); |
6dcb100f RL |
137 | } |
138 | ||
139 | return 0; | |
140 | } | |
141 | ||
6725682d SL |
142 | static int by_store_ctrl(X509_LOOKUP *ctx, int cmd, |
143 | const char *argp, long argl, char **retp) | |
144 | { | |
d8652be0 | 145 | return by_store_ctrl_ex(ctx, cmd, argp, argl, retp, NULL, NULL); |
6725682d SL |
146 | } |
147 | ||
6dcb100f | 148 | static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
6725682d | 149 | const OSSL_STORE_SEARCH *criterion, X509_OBJECT *ret, |
b4250010 | 150 | OSSL_LIB_CTX *libctx, const char *propq) |
6dcb100f RL |
151 | { |
152 | STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx); | |
153 | int i; | |
154 | int ok = 0; | |
155 | ||
156 | for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) { | |
157 | ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion, | |
6725682d | 158 | 1 /* depth */, libctx, propq); |
6dcb100f RL |
159 | |
160 | if (ok) | |
161 | break; | |
162 | } | |
163 | return ok; | |
164 | } | |
165 | ||
d8652be0 MC |
166 | static int by_store_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
167 | const X509_NAME *name, X509_OBJECT *ret, | |
b4250010 | 168 | OSSL_LIB_CTX *libctx, const char *propq) |
6dcb100f | 169 | { |
8cc86b81 DDO |
170 | OSSL_STORE_SEARCH *criterion = |
171 | OSSL_STORE_SEARCH_by_name((X509_NAME *)name); /* won't modify it */ | |
6725682d | 172 | int ok = by_store(ctx, type, criterion, ret, libctx, propq); |
6dcb100f RL |
173 | STACK_OF(X509_OBJECT) *store_objects = |
174 | X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx)); | |
175 | X509_OBJECT *tmp = NULL; | |
176 | ||
177 | OSSL_STORE_SEARCH_free(criterion); | |
178 | ||
179 | if (ok) | |
180 | tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name); | |
181 | ||
182 | ok = 0; | |
183 | if (tmp != NULL) { | |
184 | /* | |
185 | * This could also be done like this: | |
186 | * | |
187 | * if (tmp != NULL) { | |
188 | * *ret = *tmp; | |
189 | * ok = 1; | |
190 | * } | |
191 | * | |
192 | * However, we want to exercise the documented API to the max, so | |
193 | * we do it the hard way. | |
194 | * | |
195 | * To be noted is that X509_OBJECT_set1_* increment the refcount, | |
196 | * but so does X509_STORE_CTX_get_by_subject upon return of this | |
3e6a0d57 | 197 | * function, so we must ensure the refcount is decremented |
6dcb100f RL |
198 | * before we return, or we will get a refcount leak. We cannot do |
199 | * this with X509_OBJECT_free(), though, as that will free a bit | |
200 | * too much. | |
201 | */ | |
202 | switch (type) { | |
203 | case X509_LU_X509: | |
204 | ok = X509_OBJECT_set1_X509(ret, tmp->data.x509); | |
205 | if (ok) | |
206 | X509_free(tmp->data.x509); | |
207 | break; | |
208 | case X509_LU_CRL: | |
209 | ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl); | |
210 | if (ok) | |
211 | X509_CRL_free(tmp->data.crl); | |
212 | break; | |
213 | case X509_LU_NONE: | |
214 | break; | |
215 | } | |
216 | } | |
217 | return ok; | |
218 | } | |
219 | ||
6725682d SL |
220 | static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
221 | const X509_NAME *name, X509_OBJECT *ret) | |
222 | { | |
d8652be0 | 223 | return by_store_subject_ex(ctx, type, name, ret, NULL, NULL); |
6725682d SL |
224 | } |
225 | ||
6dcb100f RL |
226 | /* |
227 | * We lack the implementations for get_by_issuer_serial, get_by_fingerprint | |
228 | * and get_by_alias. There's simply not enough support in the X509_LOOKUP | |
229 | * or X509_STORE APIs. | |
230 | */ | |
231 | ||
232 | static X509_LOOKUP_METHOD x509_store_lookup = { | |
233 | "Load certs from STORE URIs", | |
234 | NULL, /* new_item */ | |
235 | by_store_free, /* free */ | |
236 | NULL, /* init */ | |
237 | NULL, /* shutdown */ | |
238 | by_store_ctrl, /* ctrl */ | |
239 | by_store_subject, /* get_by_subject */ | |
240 | NULL, /* get_by_issuer_serial */ | |
241 | NULL, /* get_by_fingerprint */ | |
242 | NULL, /* get_by_alias */ | |
d8652be0 MC |
243 | by_store_subject_ex, |
244 | by_store_ctrl_ex | |
6dcb100f RL |
245 | }; |
246 | ||
247 | X509_LOOKUP_METHOD *X509_LOOKUP_store(void) | |
248 | { | |
249 | return &x509_store_lookup; | |
250 | } |