]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
fd38836b | 2 | * Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved. |
4a253652 | 3 | * |
3e4b43b9 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1322259 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4a253652 DSH |
8 | */ |
9 | ||
2f545ae4 KR |
10 | #include "internal/refcount.h" |
11 | ||
6f4d71ff DSH |
12 | /* |
13 | * This structure holds all parameters associated with a verify operation by | |
14 | * including an X509_VERIFY_PARAM structure in related structures the | |
15 | * parameters used can be customized | |
16 | */ | |
17 | ||
18 | struct X509_VERIFY_PARAM_st { | |
19 | char *name; | |
20 | time_t check_time; /* Time to use */ | |
a47bc283 | 21 | uint32_t inh_flags; /* Inheritance flags */ |
6f4d71ff DSH |
22 | unsigned long flags; /* Various verify flags */ |
23 | int purpose; /* purpose to check untrusted certificates */ | |
24 | int trust; /* trust setting to check */ | |
25 | int depth; /* Verify depth */ | |
fbb82a60 | 26 | int auth_level; /* Security level for chain verification */ |
6f4d71ff | 27 | STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ |
9689a6ae | 28 | /* Peer identity details */ |
0f113f3e MC |
29 | STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ |
30 | unsigned int hostflags; /* Flags to control matching features */ | |
31 | char *peername; /* Matching hostname in peer certificate */ | |
32 | char *email; /* If not NULL email address to match */ | |
33 | size_t emaillen; | |
34 | unsigned char *ip; /* If not NULL IP address to match */ | |
35 | size_t iplen; /* Length of IP address */ | |
36 | }; | |
0930251d | 37 | |
70dd3c65 VD |
38 | /* No error callback if depth < 0 */ |
39 | int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth); | |
9b0a4531 DSH |
40 | |
41 | /* a sequence of these are used */ | |
42 | struct x509_attributes_st { | |
43 | ASN1_OBJECT *object; | |
e20b5727 | 44 | STACK_OF(ASN1_TYPE) *set; |
9b0a4531 | 45 | }; |
4903abd5 DSH |
46 | |
47 | struct X509_extension_st { | |
48 | ASN1_OBJECT *object; | |
49 | ASN1_BOOLEAN critical; | |
4392479c | 50 | ASN1_OCTET_STRING value; |
4903abd5 | 51 | }; |
1e898fb0 DSH |
52 | |
53 | /* | |
54 | * Method to handle CRL access. In general a CRL could be very large (several | |
55 | * Mb) and can consume large amounts of resources if stored in memory by | |
56 | * multiple processes. This method allows general CRL operations to be | |
57 | * redirected to more efficient callbacks: for example a CRL entry database. | |
58 | */ | |
59 | ||
60 | #define X509_CRL_METHOD_DYNAMIC 1 | |
61 | ||
62 | struct x509_crl_method_st { | |
63 | int flags; | |
64 | int (*crl_init) (X509_CRL *crl); | |
65 | int (*crl_free) (X509_CRL *crl); | |
66 | int (*crl_lookup) (X509_CRL *crl, X509_REVOKED **ret, | |
67 | ASN1_INTEGER *ser, X509_NAME *issuer); | |
68 | int (*crl_verify) (X509_CRL *crl, EVP_PKEY *pk); | |
69 | }; | |
4a1f3f27 | 70 | |
f0e0fd51 | 71 | struct x509_lookup_method_st { |
0124f32a | 72 | char *name; |
f0e0fd51 RS |
73 | int (*new_item) (X509_LOOKUP *ctx); |
74 | void (*free) (X509_LOOKUP *ctx); | |
75 | int (*init) (X509_LOOKUP *ctx); | |
76 | int (*shutdown) (X509_LOOKUP *ctx); | |
77 | int (*ctrl) (X509_LOOKUP *ctx, int cmd, const char *argc, long argl, | |
78 | char **ret); | |
0946a198 DSH |
79 | int (*get_by_subject) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
80 | X509_NAME *name, X509_OBJECT *ret); | |
81 | int (*get_by_issuer_serial) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, | |
82 | X509_NAME *name, ASN1_INTEGER *serial, | |
83 | X509_OBJECT *ret); | |
84 | int (*get_by_fingerprint) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, | |
cfc5e0aa | 85 | const unsigned char *bytes, int len, |
f0e0fd51 | 86 | X509_OBJECT *ret); |
0946a198 | 87 | int (*get_by_alias) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 88 | const char *str, int len, X509_OBJECT *ret); |
f0e0fd51 RS |
89 | }; |
90 | ||
91 | /* This is the functions plus an instance of the local variables. */ | |
92 | struct x509_lookup_st { | |
93 | int init; /* have we been started */ | |
94 | int skip; /* don't use us. */ | |
95 | X509_LOOKUP_METHOD *method; /* the functions */ | |
0124f32a | 96 | void *method_data; /* method data */ |
f0e0fd51 RS |
97 | X509_STORE *store_ctx; /* who owns us */ |
98 | }; | |
99 | ||
100 | /* | |
101 | * This is used to hold everything. It is used for all certificate | |
102 | * validation. Once we have a certificate chain, the 'verify' function is | |
103 | * then called to actually check the cert chain. | |
104 | */ | |
105 | struct x509_store_st { | |
106 | /* The following is a cache of trusted certs */ | |
107 | int cache; /* if true, stash any hits */ | |
108 | STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */ | |
109 | /* These are external lookup methods */ | |
110 | STACK_OF(X509_LOOKUP) *get_cert_methods; | |
111 | X509_VERIFY_PARAM *param; | |
112 | /* Callbacks for various operations */ | |
113 | /* called to verify a certificate */ | |
114 | int (*verify) (X509_STORE_CTX *ctx); | |
115 | /* error callback */ | |
116 | int (*verify_cb) (int ok, X509_STORE_CTX *ctx); | |
117 | /* get issuers cert from ctx */ | |
118 | int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x); | |
119 | /* check issued */ | |
120 | int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer); | |
121 | /* Check revocation status of chain */ | |
122 | int (*check_revocation) (X509_STORE_CTX *ctx); | |
123 | /* retrieve CRL */ | |
124 | int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); | |
125 | /* Check CRL validity */ | |
126 | int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl); | |
127 | /* Check certificate against CRL */ | |
128 | int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); | |
0a5fe2eb RL |
129 | /* Check policy status of the chain */ |
130 | int (*check_policy) (X509_STORE_CTX *ctx); | |
f0e0fd51 RS |
131 | STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, X509_NAME *nm); |
132 | STACK_OF(X509_CRL) *(*lookup_crls) (X509_STORE_CTX *ctx, X509_NAME *nm); | |
133 | int (*cleanup) (X509_STORE_CTX *ctx); | |
134 | CRYPTO_EX_DATA ex_data; | |
2f545ae4 | 135 | CRYPTO_REF_COUNT references; |
f0e0fd51 RS |
136 | CRYPTO_RWLOCK *lock; |
137 | }; | |
138 | ||
4a1f3f27 DSH |
139 | typedef struct lookup_dir_hashes_st BY_DIR_HASH; |
140 | typedef struct lookup_dir_entry_st BY_DIR_ENTRY; | |
141 | DEFINE_STACK_OF(BY_DIR_HASH) | |
142 | DEFINE_STACK_OF(BY_DIR_ENTRY) | |
143 | typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY; | |
144 | DEFINE_STACK_OF(STACK_OF_X509_NAME_ENTRY) | |
786dd2c2 DSH |
145 | |
146 | void x509_set_signature_info(X509_SIG_INFO *siginf, const X509_ALGOR *alg, | |
147 | const ASN1_STRING *sig); |