]>
Commit | Line | Data |
---|---|---|
b1322259 | 1 | /* |
c4d3c19b | 2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
b1322259 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
b39fc560 | 11 | #include "internal/cryptlib.h" |
cd420b0b | 12 | #include "internal/refcount.h" |
ec577822 | 13 | #include <openssl/x509.h> |
e3e57192 | 14 | #include "internal/x509_int.h" |
926a56bf | 15 | #include <openssl/x509v3.h> |
0930251d | 16 | #include "x509_lcl.h" |
d02b48c6 | 17 | |
6b691a5c | 18 | X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method) |
0f113f3e MC |
19 | { |
20 | X509_LOOKUP *ret; | |
21 | ||
64b25758 | 22 | ret = OPENSSL_zalloc(sizeof(*ret)); |
0f113f3e MC |
23 | if (ret == NULL) |
24 | return NULL; | |
25 | ||
0f113f3e | 26 | ret->method = method; |
0f113f3e MC |
27 | if ((method->new_item != NULL) && !method->new_item(ret)) { |
28 | OPENSSL_free(ret); | |
29 | return NULL; | |
30 | } | |
31 | return ret; | |
32 | } | |
d02b48c6 | 33 | |
6b691a5c | 34 | void X509_LOOKUP_free(X509_LOOKUP *ctx) |
0f113f3e MC |
35 | { |
36 | if (ctx == NULL) | |
37 | return; | |
38 | if ((ctx->method != NULL) && (ctx->method->free != NULL)) | |
39 | (*ctx->method->free) (ctx); | |
40 | OPENSSL_free(ctx); | |
41 | } | |
d02b48c6 | 42 | |
3067095e RL |
43 | int X509_STORE_lock(X509_STORE *s) |
44 | { | |
45 | return CRYPTO_THREAD_write_lock(s->lock); | |
46 | } | |
47 | ||
48 | int X509_STORE_unlock(X509_STORE *s) | |
49 | { | |
50 | return CRYPTO_THREAD_unlock(s->lock); | |
51 | } | |
52 | ||
6b691a5c | 53 | int X509_LOOKUP_init(X509_LOOKUP *ctx) |
0f113f3e MC |
54 | { |
55 | if (ctx->method == NULL) | |
56 | return 0; | |
57 | if (ctx->method->init != NULL) | |
58 | return ctx->method->init(ctx); | |
59 | else | |
60 | return 1; | |
61 | } | |
d02b48c6 | 62 | |
6b691a5c | 63 | int X509_LOOKUP_shutdown(X509_LOOKUP *ctx) |
0f113f3e MC |
64 | { |
65 | if (ctx->method == NULL) | |
66 | return 0; | |
67 | if (ctx->method->shutdown != NULL) | |
68 | return ctx->method->shutdown(ctx); | |
69 | else | |
70 | return 1; | |
71 | } | |
d02b48c6 | 72 | |
303c0028 | 73 | int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
0f113f3e MC |
74 | char **ret) |
75 | { | |
76 | if (ctx->method == NULL) | |
77 | return -1; | |
78 | if (ctx->method->ctrl != NULL) | |
79 | return ctx->method->ctrl(ctx, cmd, argc, argl, ret); | |
80 | else | |
81 | return 1; | |
82 | } | |
d02b48c6 | 83 | |
0946a198 DSH |
84 | int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
85 | X509_NAME *name, X509_OBJECT *ret) | |
0f113f3e MC |
86 | { |
87 | if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL)) | |
ba1a1c37 | 88 | return 0; |
0f113f3e MC |
89 | if (ctx->skip) |
90 | return 0; | |
91 | return ctx->method->get_by_subject(ctx, type, name, ret); | |
92 | } | |
d02b48c6 | 93 | |
0946a198 DSH |
94 | int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
95 | X509_NAME *name, ASN1_INTEGER *serial, | |
96 | X509_OBJECT *ret) | |
0f113f3e MC |
97 | { |
98 | if ((ctx->method == NULL) || (ctx->method->get_by_issuer_serial == NULL)) | |
ba1a1c37 | 99 | return 0; |
0f113f3e MC |
100 | return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret); |
101 | } | |
d02b48c6 | 102 | |
0946a198 | 103 | int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 104 | const unsigned char *bytes, int len, |
0f113f3e MC |
105 | X509_OBJECT *ret) |
106 | { | |
107 | if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL)) | |
ba1a1c37 | 108 | return 0; |
0f113f3e MC |
109 | return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret); |
110 | } | |
d02b48c6 | 111 | |
0946a198 | 112 | int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
cfc5e0aa | 113 | const char *str, int len, X509_OBJECT *ret) |
0f113f3e MC |
114 | { |
115 | if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL)) | |
ba1a1c37 | 116 | return 0; |
0f113f3e MC |
117 | return ctx->method->get_by_alias(ctx, type, str, len, ret); |
118 | } | |
119 | ||
120 | static int x509_object_cmp(const X509_OBJECT *const *a, | |
121 | const X509_OBJECT *const *b) | |
122 | { | |
123 | int ret; | |
124 | ||
125 | ret = ((*a)->type - (*b)->type); | |
126 | if (ret) | |
127 | return ret; | |
128 | switch ((*a)->type) { | |
129 | case X509_LU_X509: | |
130 | ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509); | |
131 | break; | |
132 | case X509_LU_CRL: | |
133 | ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl); | |
134 | break; | |
f3b3d7f0 | 135 | case X509_LU_NONE: |
0f113f3e MC |
136 | /* abort(); */ |
137 | return 0; | |
138 | } | |
139 | return ret; | |
140 | } | |
d02b48c6 | 141 | |
6b691a5c | 142 | X509_STORE *X509_STORE_new(void) |
0f113f3e MC |
143 | { |
144 | X509_STORE *ret; | |
145 | ||
64b25758 | 146 | if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) |
0f113f3e | 147 | return NULL; |
90945fa3 MC |
148 | if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL) |
149 | goto err; | |
0f113f3e | 150 | ret->cache = 1; |
90945fa3 MC |
151 | if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL) |
152 | goto err; | |
0f113f3e MC |
153 | |
154 | if ((ret->param = X509_VERIFY_PARAM_new()) == NULL) | |
90945fa3 | 155 | goto err; |
0f113f3e | 156 | |
90945fa3 MC |
157 | if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data)) |
158 | goto err; | |
0f113f3e | 159 | |
c001ce33 AG |
160 | ret->lock = CRYPTO_THREAD_lock_new(); |
161 | if (ret->lock == NULL) | |
162 | goto err; | |
163 | ||
0f113f3e MC |
164 | ret->references = 1; |
165 | return ret; | |
c001ce33 | 166 | |
90945fa3 MC |
167 | err: |
168 | X509_VERIFY_PARAM_free(ret->param); | |
169 | sk_X509_OBJECT_free(ret->objs); | |
170 | sk_X509_LOOKUP_free(ret->get_cert_methods); | |
171 | OPENSSL_free(ret); | |
172 | return NULL; | |
0f113f3e | 173 | } |
d02b48c6 | 174 | |
6b691a5c | 175 | void X509_STORE_free(X509_STORE *vfy) |
0f113f3e MC |
176 | { |
177 | int i; | |
178 | STACK_OF(X509_LOOKUP) *sk; | |
179 | X509_LOOKUP *lu; | |
d02b48c6 | 180 | |
e6e9170d RS |
181 | if (vfy == NULL) |
182 | return; | |
2f545ae4 | 183 | CRYPTO_DOWN_REF(&vfy->references, &i, vfy->lock); |
f3f1cf84 | 184 | REF_PRINT_COUNT("X509_STORE", vfy); |
0f113f3e MC |
185 | if (i > 0) |
186 | return; | |
f3f1cf84 | 187 | REF_ASSERT_ISNT(i < 0); |
bff9ce4d | 188 | |
0f113f3e MC |
189 | sk = vfy->get_cert_methods; |
190 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { | |
191 | lu = sk_X509_LOOKUP_value(sk, i); | |
192 | X509_LOOKUP_shutdown(lu); | |
193 | X509_LOOKUP_free(lu); | |
194 | } | |
195 | sk_X509_LOOKUP_free(sk); | |
b6ef12c4 | 196 | sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free); |
0f113f3e MC |
197 | |
198 | CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data); | |
222561fe | 199 | X509_VERIFY_PARAM_free(vfy->param); |
c001ce33 | 200 | CRYPTO_THREAD_lock_free(vfy->lock); |
0f113f3e MC |
201 | OPENSSL_free(vfy); |
202 | } | |
d02b48c6 | 203 | |
c001ce33 AG |
204 | int X509_STORE_up_ref(X509_STORE *vfy) |
205 | { | |
206 | int i; | |
207 | ||
2f545ae4 | 208 | if (CRYPTO_UP_REF(&vfy->references, &i, vfy->lock) <= 0) |
c001ce33 AG |
209 | return 0; |
210 | ||
211 | REF_PRINT_COUNT("X509_STORE", a); | |
212 | REF_ASSERT_ISNT(i < 2); | |
213 | return ((i > 1) ? 1 : 0); | |
214 | } | |
215 | ||
6b691a5c | 216 | X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m) |
0f113f3e MC |
217 | { |
218 | int i; | |
219 | STACK_OF(X509_LOOKUP) *sk; | |
220 | X509_LOOKUP *lu; | |
221 | ||
222 | sk = v->get_cert_methods; | |
223 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { | |
224 | lu = sk_X509_LOOKUP_value(sk, i); | |
225 | if (m == lu->method) { | |
226 | return lu; | |
227 | } | |
228 | } | |
229 | /* a new one */ | |
230 | lu = X509_LOOKUP_new(m); | |
231 | if (lu == NULL) | |
232 | return NULL; | |
233 | else { | |
234 | lu->store_ctx = v; | |
235 | if (sk_X509_LOOKUP_push(v->get_cert_methods, lu)) | |
236 | return lu; | |
237 | else { | |
238 | X509_LOOKUP_free(lu); | |
239 | return NULL; | |
240 | } | |
241 | } | |
242 | } | |
d02b48c6 | 243 | |
0946a198 DSH |
244 | X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs, |
245 | X509_LOOKUP_TYPE type, | |
6ddbb4cd | 246 | X509_NAME *name) |
f0e0fd51 | 247 | { |
6ddbb4cd | 248 | X509_OBJECT *ret = X509_OBJECT_new(); |
f0e0fd51 | 249 | |
6ddbb4cd | 250 | if (ret == NULL) |
f0e0fd51 | 251 | return NULL; |
6ddbb4cd RS |
252 | if (!X509_STORE_CTX_get_by_subject(vs, type, name, ret)) { |
253 | X509_OBJECT_free(ret); | |
f0e0fd51 RS |
254 | return NULL; |
255 | } | |
256 | return ret; | |
257 | } | |
258 | ||
6ddbb4cd RS |
259 | int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type, |
260 | X509_NAME *name, X509_OBJECT *ret) | |
0f113f3e MC |
261 | { |
262 | X509_STORE *ctx = vs->ctx; | |
263 | X509_LOOKUP *lu; | |
264 | X509_OBJECT stmp, *tmp; | |
265 | int i, j; | |
266 | ||
c001ce33 | 267 | CRYPTO_THREAD_write_lock(ctx->lock); |
0f113f3e | 268 | tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name); |
c001ce33 | 269 | CRYPTO_THREAD_unlock(ctx->lock); |
0f113f3e MC |
270 | |
271 | if (tmp == NULL || type == X509_LU_CRL) { | |
fc9d1ef3 | 272 | for (i = 0; i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) { |
0f113f3e MC |
273 | lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i); |
274 | j = X509_LOOKUP_by_subject(lu, type, name, &stmp); | |
fc9d1ef3 | 275 | if (j) { |
0f113f3e MC |
276 | tmp = &stmp; |
277 | break; | |
278 | } | |
279 | } | |
0f113f3e MC |
280 | if (tmp == NULL) |
281 | return 0; | |
282 | } | |
283 | ||
0f113f3e MC |
284 | ret->type = tmp->type; |
285 | ret->data.ptr = tmp->data.ptr; | |
286 | ||
287 | X509_OBJECT_up_ref_count(ret); | |
288 | ||
289 | return 1; | |
290 | } | |
d02b48c6 | 291 | |
c0452248 | 292 | static int x509_store_add(X509_STORE *ctx, void *x, int crl) { |
0f113f3e | 293 | X509_OBJECT *obj; |
c0452248 | 294 | int ret = 0, added = 0; |
0f113f3e MC |
295 | |
296 | if (x == NULL) | |
297 | return 0; | |
6ddbb4cd RS |
298 | obj = X509_OBJECT_new(); |
299 | if (obj == NULL) | |
0f113f3e | 300 | return 0; |
c0452248 RS |
301 | |
302 | if (crl) { | |
303 | obj->type = X509_LU_CRL; | |
304 | obj->data.crl = (X509_CRL *)x; | |
305 | } else { | |
306 | obj->type = X509_LU_X509; | |
307 | obj->data.x509 = (X509 *)x; | |
308 | } | |
68efafc5 | 309 | X509_OBJECT_up_ref_count(obj); |
0f113f3e | 310 | |
c001ce33 | 311 | CRYPTO_THREAD_write_lock(ctx->lock); |
0f113f3e | 312 | |
0f113f3e | 313 | if (X509_OBJECT_retrieve_match(ctx->objs, obj)) { |
c0452248 | 314 | ret = 1; |
68efafc5 F |
315 | } else { |
316 | added = sk_X509_OBJECT_push(ctx->objs, obj); | |
317 | ret = added != 0; | |
318 | } | |
0f113f3e | 319 | |
c001ce33 | 320 | CRYPTO_THREAD_unlock(ctx->lock); |
0f113f3e | 321 | |
c0452248 | 322 | if (added == 0) /* obj not pushed */ |
68efafc5 | 323 | X509_OBJECT_free(obj); |
68efafc5 | 324 | |
0f113f3e MC |
325 | return ret; |
326 | } | |
2f043896 | 327 | |
c0452248 | 328 | int X509_STORE_add_cert(X509_STORE *ctx, X509 *x) |
0f113f3e | 329 | { |
c0452248 RS |
330 | if (!x509_store_add(ctx, x, 0)) { |
331 | X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE); | |
0f113f3e | 332 | return 0; |
68efafc5 | 333 | } |
c0452248 RS |
334 | return 1; |
335 | } | |
0f113f3e | 336 | |
c0452248 RS |
337 | int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x) |
338 | { | |
339 | if (!x509_store_add(ctx, x, 1)) { | |
68efafc5 | 340 | X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE); |
c0452248 RS |
341 | return 0; |
342 | } | |
343 | return 1; | |
0f113f3e | 344 | } |
2f043896 | 345 | |
c5ebfcab | 346 | int X509_OBJECT_up_ref_count(X509_OBJECT *a) |
0f113f3e MC |
347 | { |
348 | switch (a->type) { | |
f3b3d7f0 | 349 | case X509_LU_NONE: |
bca3f06b | 350 | break; |
0f113f3e | 351 | case X509_LU_X509: |
c5ebfcab | 352 | return X509_up_ref(a->data.x509); |
0f113f3e | 353 | case X509_LU_CRL: |
c5ebfcab | 354 | return X509_CRL_up_ref(a->data.crl); |
0f113f3e | 355 | } |
c5ebfcab | 356 | return 1; |
0f113f3e | 357 | } |
d02b48c6 | 358 | |
7d7da288 | 359 | X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a) |
f0e0fd51 | 360 | { |
6ddbb4cd RS |
361 | if (a == NULL || a->type != X509_LU_X509) |
362 | return NULL; | |
f0e0fd51 RS |
363 | return a->data.x509; |
364 | } | |
365 | ||
6ddbb4cd RS |
366 | X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *a) |
367 | { | |
368 | if (a == NULL || a->type != X509_LU_CRL) | |
369 | return NULL; | |
370 | return a->data.crl; | |
371 | } | |
372 | ||
0946a198 | 373 | X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a) |
f0c58c32 CH |
374 | { |
375 | return a->type; | |
376 | } | |
377 | ||
6ddbb4cd | 378 | X509_OBJECT *X509_OBJECT_new() |
f0e0fd51 | 379 | { |
6ddbb4cd RS |
380 | X509_OBJECT *ret = OPENSSL_zalloc(sizeof(*ret)); |
381 | ||
382 | if (ret == NULL) { | |
383 | X509err(X509_F_X509_OBJECT_NEW, ERR_R_MALLOC_FAILURE); | |
384 | return NULL; | |
385 | } | |
ba1a1c37 | 386 | ret->type = X509_LU_NONE; |
6ddbb4cd | 387 | return ret; |
f0e0fd51 RS |
388 | } |
389 | ||
6ddbb4cd RS |
390 | |
391 | void X509_OBJECT_free(X509_OBJECT *a) | |
0f113f3e | 392 | { |
f0e0fd51 | 393 | if (a == NULL) |
222561fe | 394 | return; |
0f113f3e | 395 | switch (a->type) { |
f3b3d7f0 | 396 | case X509_LU_NONE: |
bca3f06b | 397 | break; |
0f113f3e MC |
398 | case X509_LU_X509: |
399 | X509_free(a->data.x509); | |
400 | break; | |
401 | case X509_LU_CRL: | |
402 | X509_CRL_free(a->data.crl); | |
403 | break; | |
404 | } | |
6ddbb4cd | 405 | OPENSSL_free(a); |
0f113f3e | 406 | } |
d02b48c6 | 407 | |
0946a198 | 408 | static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
0f113f3e MC |
409 | X509_NAME *name, int *pnmatch) |
410 | { | |
411 | X509_OBJECT stmp; | |
412 | X509 x509_s; | |
0f113f3e | 413 | X509_CRL crl_s; |
0f113f3e MC |
414 | int idx; |
415 | ||
416 | stmp.type = type; | |
417 | switch (type) { | |
418 | case X509_LU_X509: | |
419 | stmp.data.x509 = &x509_s; | |
5cf6abd8 | 420 | x509_s.cert_info.subject = name; |
0f113f3e MC |
421 | break; |
422 | case X509_LU_CRL: | |
423 | stmp.data.crl = &crl_s; | |
7aef39a7 | 424 | crl_s.crl.issuer = name; |
0f113f3e | 425 | break; |
f3b3d7f0 | 426 | case X509_LU_NONE: |
0f113f3e MC |
427 | /* abort(); */ |
428 | return -1; | |
429 | } | |
430 | ||
431 | idx = sk_X509_OBJECT_find(h, &stmp); | |
432 | if (idx >= 0 && pnmatch) { | |
433 | int tidx; | |
434 | const X509_OBJECT *tobj, *pstmp; | |
435 | *pnmatch = 1; | |
436 | pstmp = &stmp; | |
437 | for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) { | |
438 | tobj = sk_X509_OBJECT_value(h, tidx); | |
439 | if (x509_object_cmp(&tobj, &pstmp)) | |
440 | break; | |
441 | (*pnmatch)++; | |
442 | } | |
443 | } | |
444 | return idx; | |
445 | } | |
4d50a2b4 | 446 | |
0946a198 | 447 | int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
0f113f3e MC |
448 | X509_NAME *name) |
449 | { | |
450 | return x509_object_idx_cnt(h, type, name, NULL); | |
451 | } | |
452 | ||
453 | X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, | |
0946a198 DSH |
454 | X509_LOOKUP_TYPE type, |
455 | X509_NAME *name) | |
0f113f3e MC |
456 | { |
457 | int idx; | |
458 | idx = X509_OBJECT_idx_by_subject(h, type, name); | |
459 | if (idx == -1) | |
460 | return NULL; | |
461 | return sk_X509_OBJECT_value(h, idx); | |
462 | } | |
11262391 | 463 | |
f0c58c32 CH |
464 | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v) |
465 | { | |
466 | return v->objs; | |
467 | } | |
468 | ||
6ddbb4cd | 469 | STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm) |
0f113f3e MC |
470 | { |
471 | int i, idx, cnt; | |
6ddbb4cd | 472 | STACK_OF(X509) *sk = NULL; |
0f113f3e MC |
473 | X509 *x; |
474 | X509_OBJECT *obj; | |
6ddbb4cd | 475 | |
c001ce33 | 476 | CRYPTO_THREAD_write_lock(ctx->ctx->lock); |
0f113f3e MC |
477 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt); |
478 | if (idx < 0) { | |
479 | /* | |
480 | * Nothing found in cache: do lookup to possibly add new objects to | |
481 | * cache | |
482 | */ | |
6ddbb4cd RS |
483 | X509_OBJECT *xobj = X509_OBJECT_new(); |
484 | ||
c001ce33 | 485 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
6ddbb4cd RS |
486 | if (xobj == NULL) |
487 | return NULL; | |
488 | if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, nm, xobj)) { | |
489 | X509_OBJECT_free(xobj); | |
0f113f3e MC |
490 | return NULL; |
491 | } | |
6ddbb4cd | 492 | X509_OBJECT_free(xobj); |
c001ce33 | 493 | CRYPTO_THREAD_write_lock(ctx->ctx->lock); |
0f113f3e MC |
494 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt); |
495 | if (idx < 0) { | |
c001ce33 | 496 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e MC |
497 | return NULL; |
498 | } | |
499 | } | |
6ddbb4cd RS |
500 | |
501 | sk = sk_X509_new_null(); | |
0f113f3e MC |
502 | for (i = 0; i < cnt; i++, idx++) { |
503 | obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx); | |
504 | x = obj->data.x509; | |
05f0fb9f | 505 | X509_up_ref(x); |
0f113f3e | 506 | if (!sk_X509_push(sk, x)) { |
c001ce33 | 507 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e MC |
508 | X509_free(x); |
509 | sk_X509_pop_free(sk, X509_free); | |
510 | return NULL; | |
511 | } | |
512 | } | |
c001ce33 | 513 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e | 514 | return sk; |
0f113f3e | 515 | } |
4d50a2b4 | 516 | |
6ddbb4cd | 517 | STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm) |
0f113f3e MC |
518 | { |
519 | int i, idx, cnt; | |
6ddbb4cd | 520 | STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null(); |
0f113f3e | 521 | X509_CRL *x; |
6ddbb4cd | 522 | X509_OBJECT *obj, *xobj = X509_OBJECT_new(); |
0f113f3e | 523 | |
6ddbb4cd RS |
524 | /* Always do lookup to possibly add new CRLs to cache */ |
525 | if (sk == NULL || xobj == NULL || | |
526 | !X509_STORE_CTX_get_by_subject(ctx, X509_LU_CRL, nm, xobj)) { | |
527 | X509_OBJECT_free(xobj); | |
0f113f3e MC |
528 | sk_X509_CRL_free(sk); |
529 | return NULL; | |
530 | } | |
6ddbb4cd | 531 | X509_OBJECT_free(xobj); |
c001ce33 | 532 | CRYPTO_THREAD_write_lock(ctx->ctx->lock); |
0f113f3e MC |
533 | idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt); |
534 | if (idx < 0) { | |
c001ce33 | 535 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e MC |
536 | sk_X509_CRL_free(sk); |
537 | return NULL; | |
538 | } | |
539 | ||
540 | for (i = 0; i < cnt; i++, idx++) { | |
541 | obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx); | |
542 | x = obj->data.crl; | |
65cbf983 | 543 | X509_CRL_up_ref(x); |
0f113f3e | 544 | if (!sk_X509_CRL_push(sk, x)) { |
c001ce33 | 545 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e MC |
546 | X509_CRL_free(x); |
547 | sk_X509_CRL_pop_free(sk, X509_CRL_free); | |
548 | return NULL; | |
549 | } | |
550 | } | |
c001ce33 | 551 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e MC |
552 | return sk; |
553 | } | |
554 | ||
555 | X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, | |
556 | X509_OBJECT *x) | |
557 | { | |
558 | int idx, i; | |
559 | X509_OBJECT *obj; | |
560 | idx = sk_X509_OBJECT_find(h, x); | |
561 | if (idx == -1) | |
562 | return NULL; | |
563 | if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL)) | |
564 | return sk_X509_OBJECT_value(h, idx); | |
565 | for (i = idx; i < sk_X509_OBJECT_num(h); i++) { | |
566 | obj = sk_X509_OBJECT_value(h, i); | |
567 | if (x509_object_cmp | |
568 | ((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x)) | |
569 | return NULL; | |
570 | if (x->type == X509_LU_X509) { | |
571 | if (!X509_cmp(obj->data.x509, x->data.x509)) | |
572 | return obj; | |
573 | } else if (x->type == X509_LU_CRL) { | |
574 | if (!X509_CRL_match(obj->data.crl, x->data.crl)) | |
575 | return obj; | |
576 | } else | |
577 | return obj; | |
578 | } | |
579 | return NULL; | |
580 | } | |
d02b48c6 | 581 | |
1d97c843 TH |
582 | /*- |
583 | * Try to get issuer certificate from store. Due to limitations | |
2f043896 DSH |
584 | * of the API this can only retrieve a single certificate matching |
585 | * a given subject name. However it will fill the cache with all | |
a8397553 | 586 | * matching certificates, so we can examine the cache for all |
2f043896 DSH |
587 | * matches. |
588 | * | |
589 | * Return values are: | |
590 | * 1 lookup successful. | |
591 | * 0 certificate not found. | |
592 | * -1 some other error. | |
593 | */ | |
2f043896 | 594 | int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) |
0f113f3e MC |
595 | { |
596 | X509_NAME *xn; | |
6ddbb4cd | 597 | X509_OBJECT *obj = X509_OBJECT_new(), *pobj = NULL; |
0f113f3e | 598 | int i, ok, idx, ret; |
f0e0fd51 | 599 | |
6ddbb4cd RS |
600 | if (obj == NULL) |
601 | return -1; | |
0f113f3e MC |
602 | *issuer = NULL; |
603 | xn = X509_get_issuer_name(x); | |
6ddbb4cd | 604 | ok = X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, xn, obj); |
ba1a1c37 | 605 | if (ok != 1) { |
6ddbb4cd | 606 | X509_OBJECT_free(obj); |
0f113f3e MC |
607 | return 0; |
608 | } | |
609 | /* If certificate matches all OK */ | |
6ddbb4cd RS |
610 | if (ctx->check_issued(ctx, x, obj->data.x509)) { |
611 | if (x509_check_cert_time(ctx, obj->data.x509, -1)) { | |
612 | *issuer = obj->data.x509; | |
613 | X509_up_ref(*issuer); | |
614 | X509_OBJECT_free(obj); | |
0f113f3e MC |
615 | return 1; |
616 | } | |
617 | } | |
6ddbb4cd | 618 | X509_OBJECT_free(obj); |
0f113f3e MC |
619 | |
620 | /* Else find index of first cert accepted by 'check_issued' */ | |
621 | ret = 0; | |
c001ce33 | 622 | CRYPTO_THREAD_write_lock(ctx->ctx->lock); |
0f113f3e MC |
623 | idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn); |
624 | if (idx != -1) { /* should be true as we've had at least one | |
625 | * match */ | |
626 | /* Look through all matching certs for suitable issuer */ | |
627 | for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) { | |
628 | pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i); | |
629 | /* See if we've run past the matches */ | |
630 | if (pobj->type != X509_LU_X509) | |
631 | break; | |
632 | if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) | |
633 | break; | |
634 | if (ctx->check_issued(ctx, x, pobj->data.x509)) { | |
635 | *issuer = pobj->data.x509; | |
636 | ret = 1; | |
637 | /* | |
638 | * If times check, exit with match, | |
639 | * otherwise keep looking. Leave last | |
640 | * match in issuer so we return nearest | |
641 | * match if no certificate time is OK. | |
642 | */ | |
643 | ||
70dd3c65 | 644 | if (x509_check_cert_time(ctx, *issuer, -1)) |
0f113f3e MC |
645 | break; |
646 | } | |
647 | } | |
648 | } | |
c001ce33 | 649 | CRYPTO_THREAD_unlock(ctx->ctx->lock); |
0f113f3e | 650 | if (*issuer) |
05f0fb9f | 651 | X509_up_ref(*issuer); |
0f113f3e MC |
652 | return ret; |
653 | } | |
d02b48c6 | 654 | |
5d7c222d | 655 | int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags) |
0f113f3e MC |
656 | { |
657 | return X509_VERIFY_PARAM_set_flags(ctx->param, flags); | |
658 | } | |
5d7c222d DSH |
659 | |
660 | int X509_STORE_set_depth(X509_STORE *ctx, int depth) | |
0f113f3e MC |
661 | { |
662 | X509_VERIFY_PARAM_set_depth(ctx->param, depth); | |
663 | return 1; | |
664 | } | |
bdee69f7 | 665 | |
926a56bf | 666 | int X509_STORE_set_purpose(X509_STORE *ctx, int purpose) |
0f113f3e MC |
667 | { |
668 | return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose); | |
669 | } | |
926a56bf DSH |
670 | |
671 | int X509_STORE_set_trust(X509_STORE *ctx, int trust) | |
0f113f3e MC |
672 | { |
673 | return X509_VERIFY_PARAM_set_trust(ctx->param, trust); | |
674 | } | |
5d7c222d DSH |
675 | |
676 | int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param) | |
0f113f3e MC |
677 | { |
678 | return X509_VERIFY_PARAM_set1(ctx->param, param); | |
679 | } | |
926a56bf | 680 | |
f0c58c32 CH |
681 | X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx) |
682 | { | |
683 | return ctx->param; | |
684 | } | |
685 | ||
1060a50b RL |
686 | void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify) |
687 | { | |
688 | ctx->verify = verify; | |
689 | } | |
690 | ||
691 | X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx) | |
692 | { | |
693 | return ctx->verify; | |
694 | } | |
695 | ||
a5b37fca | 696 | void X509_STORE_set_verify_cb(X509_STORE *ctx, |
1060a50b | 697 | X509_STORE_CTX_verify_cb verify_cb) |
0f113f3e MC |
698 | { |
699 | ctx->verify_cb = verify_cb; | |
700 | } | |
a5b37fca | 701 | |
1060a50b | 702 | X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx) |
7cafbb4b | 703 | { |
1060a50b RL |
704 | return ctx->verify_cb; |
705 | } | |
706 | ||
707 | void X509_STORE_set_get_issuer(X509_STORE *ctx, | |
708 | X509_STORE_CTX_get_issuer_fn get_issuer) | |
709 | { | |
710 | ctx->get_issuer = get_issuer; | |
711 | } | |
712 | ||
713 | X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(X509_STORE *ctx) | |
714 | { | |
715 | return ctx->get_issuer; | |
716 | } | |
717 | ||
718 | void X509_STORE_set_check_issued(X509_STORE *ctx, | |
719 | X509_STORE_CTX_check_issued_fn check_issued) | |
720 | { | |
721 | ctx->check_issued = check_issued; | |
722 | } | |
723 | ||
724 | X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *ctx) | |
725 | { | |
726 | return ctx->check_issued; | |
727 | } | |
728 | ||
729 | void X509_STORE_set_check_revocation(X509_STORE *ctx, | |
730 | X509_STORE_CTX_check_revocation_fn check_revocation) | |
731 | { | |
732 | ctx->check_revocation = check_revocation; | |
733 | } | |
734 | ||
735 | X509_STORE_CTX_check_revocation_fn X509_STORE_get_check_revocation(X509_STORE *ctx) | |
736 | { | |
737 | return ctx->check_revocation; | |
738 | } | |
739 | ||
740 | void X509_STORE_set_get_crl(X509_STORE *ctx, | |
741 | X509_STORE_CTX_get_crl_fn get_crl) | |
742 | { | |
743 | ctx->get_crl = get_crl; | |
744 | } | |
745 | ||
746 | X509_STORE_CTX_get_crl_fn X509_STORE_get_get_crl(X509_STORE *ctx) | |
747 | { | |
748 | return ctx->get_crl; | |
749 | } | |
750 | ||
751 | void X509_STORE_set_check_crl(X509_STORE *ctx, | |
752 | X509_STORE_CTX_check_crl_fn check_crl) | |
753 | { | |
754 | ctx->check_crl = check_crl; | |
755 | } | |
756 | ||
757 | X509_STORE_CTX_check_crl_fn X509_STORE_get_check_crl(X509_STORE *ctx) | |
758 | { | |
759 | return ctx->check_crl; | |
760 | } | |
761 | ||
762 | void X509_STORE_set_cert_crl(X509_STORE *ctx, | |
763 | X509_STORE_CTX_cert_crl_fn cert_crl) | |
764 | { | |
765 | ctx->cert_crl = cert_crl; | |
766 | } | |
767 | ||
768 | X509_STORE_CTX_cert_crl_fn X509_STORE_get_cert_crl(X509_STORE *ctx) | |
769 | { | |
770 | return ctx->cert_crl; | |
771 | } | |
772 | ||
0a5fe2eb RL |
773 | void X509_STORE_set_check_policy(X509_STORE *ctx, |
774 | X509_STORE_CTX_check_policy_fn check_policy) | |
775 | { | |
776 | ctx->check_policy = check_policy; | |
777 | } | |
778 | ||
779 | X509_STORE_CTX_check_policy_fn X509_STORE_get_check_policy(X509_STORE *ctx) | |
780 | { | |
781 | return ctx->check_policy; | |
782 | } | |
783 | ||
1060a50b RL |
784 | void X509_STORE_set_lookup_certs(X509_STORE *ctx, |
785 | X509_STORE_CTX_lookup_certs_fn lookup_certs) | |
786 | { | |
787 | ctx->lookup_certs = lookup_certs; | |
788 | } | |
789 | ||
790 | X509_STORE_CTX_lookup_certs_fn X509_STORE_get_lookup_certs(X509_STORE *ctx) | |
791 | { | |
792 | return ctx->lookup_certs; | |
793 | } | |
794 | ||
795 | void X509_STORE_set_lookup_crls(X509_STORE *ctx, | |
796 | X509_STORE_CTX_lookup_crls_fn lookup_crls) | |
797 | { | |
798 | ctx->lookup_crls = lookup_crls; | |
799 | } | |
800 | ||
801 | X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx) | |
802 | { | |
803 | return ctx->lookup_crls; | |
804 | } | |
805 | ||
806 | void X509_STORE_set_cleanup(X509_STORE *ctx, | |
807 | X509_STORE_CTX_cleanup_fn ctx_cleanup) | |
808 | { | |
809 | ctx->cleanup = ctx_cleanup; | |
7cafbb4b MC |
810 | } |
811 | ||
1060a50b | 812 | X509_STORE_CTX_cleanup_fn X509_STORE_get_cleanup(X509_STORE *ctx) |
0f113f3e | 813 | { |
1060a50b | 814 | return ctx->cleanup; |
0f113f3e | 815 | } |
2c340864 | 816 | |
3aec886e KY |
817 | int X509_STORE_set_ex_data(X509_STORE *ctx, int idx, void *data) |
818 | { | |
819 | return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); | |
820 | } | |
821 | ||
822 | void *X509_STORE_get_ex_data(X509_STORE *ctx, int idx) | |
823 | { | |
824 | return CRYPTO_get_ex_data(&ctx->ex_data, idx); | |
825 | } | |
826 | ||
2c340864 | 827 | X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx) |
0f113f3e MC |
828 | { |
829 | return ctx->ctx; | |
830 | } |