]>
Commit | Line | Data |
---|---|---|
2039c421 RS |
1 | /* |
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. | |
d02b48c6 | 3 | * |
365a2d99 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
2039c421 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
11 | #include <time.h> | |
b379fe6c | 12 | #include <sys/types.h> |
d02b48c6 | 13 | |
b39fc560 | 14 | #include "internal/cryptlib.h" |
17f389bb | 15 | |
ec577822 BM |
16 | #include <openssl/bn.h> |
17 | #include <openssl/x509.h> | |
18 | #include <openssl/objects.h> | |
19 | #include <openssl/buffer.h> | |
20 | #include <openssl/evp.h> | |
5fe736e5 | 21 | #include "internal/asn1_int.h" |
3aeb9348 | 22 | #include "internal/evp_int.h" |
d02b48c6 | 23 | |
73e92de5 DSH |
24 | #ifndef NO_ASN1_OLD |
25 | ||
8bb826ee | 26 | int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature, |
0f113f3e MC |
27 | char *data, EVP_PKEY *pkey) |
28 | { | |
bfb0641f | 29 | EVP_MD_CTX *ctx = EVP_MD_CTX_new(); |
0f113f3e MC |
30 | const EVP_MD *type; |
31 | unsigned char *p, *buf_in = NULL; | |
32 | int ret = -1, i, inl; | |
33 | ||
6e59a892 RL |
34 | if (ctx == NULL) { |
35 | ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_MALLOC_FAILURE); | |
36 | goto err; | |
37 | } | |
0f113f3e MC |
38 | i = OBJ_obj2nid(a->algorithm); |
39 | type = EVP_get_digestbyname(OBJ_nid2sn(i)); | |
40 | if (type == NULL) { | |
41 | ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM); | |
42 | goto err; | |
43 | } | |
44 | ||
45 | if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7) { | |
46 | ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT); | |
47 | goto err; | |
48 | } | |
49 | ||
50 | inl = i2d(data, NULL); | |
da84249b F |
51 | if (inl <= 0) { |
52 | ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_INTERNAL_ERROR); | |
53 | goto err; | |
54 | } | |
0f113f3e MC |
55 | buf_in = OPENSSL_malloc((unsigned int)inl); |
56 | if (buf_in == NULL) { | |
57 | ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_MALLOC_FAILURE); | |
58 | goto err; | |
59 | } | |
60 | p = buf_in; | |
61 | ||
62 | i2d(data, &p); | |
6e59a892 RL |
63 | ret = EVP_VerifyInit_ex(ctx, type, NULL) |
64 | && EVP_VerifyUpdate(ctx, (unsigned char *)buf_in, inl); | |
0f113f3e | 65 | |
4b45c6e5 | 66 | OPENSSL_clear_free(buf_in, (unsigned int)inl); |
0f113f3e MC |
67 | |
68 | if (!ret) { | |
69 | ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB); | |
70 | goto err; | |
71 | } | |
72 | ret = -1; | |
73 | ||
6e59a892 | 74 | if (EVP_VerifyFinal(ctx, (unsigned char *)signature->data, |
0f113f3e MC |
75 | (unsigned int)signature->length, pkey) <= 0) { |
76 | ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB); | |
77 | ret = 0; | |
78 | goto err; | |
79 | } | |
0f113f3e MC |
80 | ret = 1; |
81 | err: | |
bfb0641f | 82 | EVP_MD_CTX_free(ctx); |
26a7d938 | 83 | return ret; |
0f113f3e | 84 | } |
09ab755c | 85 | |
73e92de5 DSH |
86 | #endif |
87 | ||
31904ecd | 88 | int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, |
0f113f3e MC |
89 | ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey) |
90 | { | |
6e59a892 | 91 | EVP_MD_CTX *ctx = NULL; |
0f113f3e | 92 | unsigned char *buf_in = NULL; |
75394189 | 93 | int ret = -1, inl = 0; |
0f113f3e | 94 | int mdnid, pknid; |
da84249b | 95 | size_t inll = 0; |
0f113f3e | 96 | |
8267becb | 97 | if (pkey == NULL) { |
0f113f3e MC |
98 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_PASSED_NULL_PARAMETER); |
99 | return -1; | |
100 | } | |
101 | ||
102 | if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7) { | |
103 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT); | |
104 | return -1; | |
105 | } | |
106 | ||
bfb0641f | 107 | ctx = EVP_MD_CTX_new(); |
6e59a892 RL |
108 | if (ctx == NULL) { |
109 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_MALLOC_FAILURE); | |
110 | goto err; | |
111 | } | |
0f113f3e MC |
112 | |
113 | /* Convert signature OID into digest and public key OIDs */ | |
114 | if (!OBJ_find_sigid_algs(OBJ_obj2nid(a->algorithm), &mdnid, &pknid)) { | |
115 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM); | |
116 | goto err; | |
117 | } | |
118 | if (mdnid == NID_undef) { | |
119 | if (!pkey->ameth || !pkey->ameth->item_verify) { | |
120 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, | |
121 | ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM); | |
122 | goto err; | |
123 | } | |
6e59a892 | 124 | ret = pkey->ameth->item_verify(ctx, it, asn, a, signature, pkey); |
0f113f3e MC |
125 | /* |
126 | * Return value of 2 means carry on, anything else means we exit | |
127 | * straight away: either a fatal error of the underlying verification | |
128 | * routine handles all verification. | |
129 | */ | |
130 | if (ret != 2) | |
131 | goto err; | |
132 | ret = -1; | |
133 | } else { | |
da84249b F |
134 | const EVP_MD *type = EVP_get_digestbynid(mdnid); |
135 | ||
0f113f3e MC |
136 | if (type == NULL) { |
137 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, | |
138 | ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM); | |
139 | goto err; | |
140 | } | |
141 | ||
142 | /* Check public key OID matches public key type */ | |
143 | if (EVP_PKEY_type(pknid) != pkey->ameth->pkey_id) { | |
144 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_WRONG_PUBLIC_KEY_TYPE); | |
145 | goto err; | |
146 | } | |
147 | ||
6e59a892 | 148 | if (!EVP_DigestVerifyInit(ctx, NULL, type, NULL, pkey)) { |
0f113f3e MC |
149 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB); |
150 | ret = 0; | |
151 | goto err; | |
152 | } | |
0f113f3e MC |
153 | } |
154 | ||
155 | inl = ASN1_item_i2d(asn, &buf_in, it); | |
da84249b F |
156 | if (inl <= 0) { |
157 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_INTERNAL_ERROR); | |
158 | goto err; | |
159 | } | |
0f113f3e MC |
160 | if (buf_in == NULL) { |
161 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_MALLOC_FAILURE); | |
162 | goto err; | |
163 | } | |
da84249b | 164 | inll = inl; |
0f113f3e | 165 | |
75394189 DSH |
166 | ret = EVP_DigestVerify(ctx, signature->data, (size_t)signature->length, |
167 | buf_in, inl); | |
168 | if (ret <= 0) { | |
0f113f3e | 169 | ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB); |
0f113f3e MC |
170 | goto err; |
171 | } | |
0f113f3e MC |
172 | ret = 1; |
173 | err: | |
da84249b | 174 | OPENSSL_clear_free(buf_in, inll); |
bfb0641f | 175 | EVP_MD_CTX_free(ctx); |
75394189 | 176 | return ret; |
0f113f3e | 177 | } |