1 /* $OpenBSD: x509_lu.c,v 1.31 2021/10/06 08:29:41 claudio Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 #include <stdio.h>
60
61 #include <openssl/err.h>
62 #include <openssl/lhash.h>
63 #include <openssl/x509.h>
64 #include <openssl/x509v3.h>
65 #include "x509_lcl.h"
66
67 static void X509_OBJECT_dec_ref_count(X509_OBJECT *a);
68
69 X509_LOOKUP *
X509_LOOKUP_new(X509_LOOKUP_METHOD * method)70 X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
71 {
72 X509_LOOKUP *ret;
73
74 ret = malloc(sizeof(X509_LOOKUP));
75 if (ret == NULL)
76 return NULL;
77
78 ret->init = 0;
79 ret->skip = 0;
80 ret->method = method;
81 ret->method_data = NULL;
82 ret->store_ctx = NULL;
83 if ((method->new_item != NULL) && !method->new_item(ret)) {
84 free(ret);
85 return NULL;
86 }
87 return ret;
88 }
89
90 void
X509_LOOKUP_free(X509_LOOKUP * ctx)91 X509_LOOKUP_free(X509_LOOKUP *ctx)
92 {
93 if (ctx == NULL)
94 return;
95 if ((ctx->method != NULL) && (ctx->method->free != NULL))
96 (*ctx->method->free)(ctx);
97 free(ctx);
98 }
99
100 int
X509_LOOKUP_init(X509_LOOKUP * ctx)101 X509_LOOKUP_init(X509_LOOKUP *ctx)
102 {
103 if (ctx->method == NULL)
104 return 0;
105 if (ctx->method->init != NULL)
106 return ctx->method->init(ctx);
107 else
108 return 1;
109 }
110
111 int
X509_LOOKUP_shutdown(X509_LOOKUP * ctx)112 X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
113 {
114 if (ctx->method == NULL)
115 return 0;
116 if (ctx->method->shutdown != NULL)
117 return ctx->method->shutdown(ctx);
118 else
119 return 1;
120 }
121
122 int
X509_LOOKUP_ctrl(X509_LOOKUP * ctx,int cmd,const char * argc,long argl,char ** ret)123 X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
124 char **ret)
125 {
126 if (ctx->method == NULL)
127 return -1;
128 if (ctx->method->ctrl != NULL)
129 return ctx->method->ctrl(ctx, cmd, argc, argl, ret);
130 else
131 return 1;
132 }
133
134 int
X509_LOOKUP_by_subject(X509_LOOKUP * ctx,int type,X509_NAME * name,X509_OBJECT * ret)135 X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
136 X509_OBJECT *ret)
137 {
138 if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
139 return X509_LU_FAIL;
140 if (ctx->skip)
141 return 0;
142 return ctx->method->get_by_subject(ctx, type, name, ret);
143 }
144
145 int
X509_LOOKUP_by_issuer_serial(X509_LOOKUP * ctx,int type,X509_NAME * name,ASN1_INTEGER * serial,X509_OBJECT * ret)146 X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
147 ASN1_INTEGER *serial, X509_OBJECT *ret)
148 {
149 if ((ctx->method == NULL) ||
150 (ctx->method->get_by_issuer_serial == NULL))
151 return X509_LU_FAIL;
152 return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret);
153 }
154
155 int
X509_LOOKUP_by_fingerprint(X509_LOOKUP * ctx,int type,const unsigned char * bytes,int len,X509_OBJECT * ret)156 X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type,
157 const unsigned char *bytes, int len, X509_OBJECT *ret)
158 {
159 if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL))
160 return X509_LU_FAIL;
161 return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret);
162 }
163
164 int
X509_LOOKUP_by_alias(X509_LOOKUP * ctx,int type,const char * str,int len,X509_OBJECT * ret)165 X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, const char *str, int len,
166 X509_OBJECT *ret)
167 {
168 if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL))
169 return X509_LU_FAIL;
170 return ctx->method->get_by_alias(ctx, type, str, len, ret);
171 }
172
173 static int
x509_object_cmp(const X509_OBJECT * const * a,const X509_OBJECT * const * b)174 x509_object_cmp(const X509_OBJECT * const *a, const X509_OBJECT * const *b)
175 {
176 int ret;
177
178 ret = ((*a)->type - (*b)->type);
179 if (ret)
180 return ret;
181 switch ((*a)->type) {
182 case X509_LU_X509:
183 ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);
184 break;
185 case X509_LU_CRL:
186 ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);
187 break;
188 default:
189 /* abort(); */
190 return 0;
191 }
192 return ret;
193 }
194
195 X509_STORE *
X509_STORE_new(void)196 X509_STORE_new(void)
197 {
198 X509_STORE *ret;
199
200 if ((ret = malloc(sizeof(X509_STORE))) == NULL)
201 return NULL;
202 ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
203 ret->cache = 1;
204 ret->get_cert_methods = sk_X509_LOOKUP_new_null();
205 ret->verify = 0;
206 ret->verify_cb = 0;
207
208 if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
209 goto err;
210
211 ret->get_issuer = 0;
212 ret->check_issued = 0;
213 ret->check_revocation = 0;
214 ret->get_crl = 0;
215 ret->check_crl = 0;
216 ret->cert_crl = 0;
217 ret->lookup_certs = 0;
218 ret->lookup_crls = 0;
219 ret->cleanup = 0;
220
221 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
222 goto err;
223
224 ret->references = 1;
225 return ret;
226
227 err:
228 X509_VERIFY_PARAM_free(ret->param);
229 sk_X509_LOOKUP_free(ret->get_cert_methods);
230 sk_X509_OBJECT_free(ret->objs);
231 free(ret);
232 return NULL;
233 }
234
235 static void
X509_OBJECT_free(X509_OBJECT * a)236 X509_OBJECT_free(X509_OBJECT *a)
237 {
238 X509_OBJECT_free_contents(a);
239 free(a);
240 }
241
242 void
X509_STORE_free(X509_STORE * vfy)243 X509_STORE_free(X509_STORE *vfy)
244 {
245 int i;
246 STACK_OF(X509_LOOKUP) *sk;
247 X509_LOOKUP *lu;
248
249 if (vfy == NULL)
250 return;
251
252 i = CRYPTO_add(&vfy->references, -1, CRYPTO_LOCK_X509_STORE);
253 if (i > 0)
254 return;
255
256 sk = vfy->get_cert_methods;
257 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
258 lu = sk_X509_LOOKUP_value(sk, i);
259 X509_LOOKUP_shutdown(lu);
260 X509_LOOKUP_free(lu);
261 }
262 sk_X509_LOOKUP_free(sk);
263 sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free);
264
265 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
266 X509_VERIFY_PARAM_free(vfy->param);
267 free(vfy);
268 }
269
270 int
X509_STORE_up_ref(X509_STORE * x)271 X509_STORE_up_ref(X509_STORE *x)
272 {
273 int refs = CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_STORE);
274 return (refs > 1) ? 1 : 0;
275 }
276
277 X509_LOOKUP *
X509_STORE_add_lookup(X509_STORE * v,X509_LOOKUP_METHOD * m)278 X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
279 {
280 int i;
281 STACK_OF(X509_LOOKUP) *sk;
282 X509_LOOKUP *lu;
283
284 sk = v->get_cert_methods;
285 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
286 lu = sk_X509_LOOKUP_value(sk, i);
287 if (m == lu->method) {
288 return lu;
289 }
290 }
291 /* a new one */
292 lu = X509_LOOKUP_new(m);
293 if (lu == NULL)
294 return NULL;
295 else {
296 lu->store_ctx = v;
297 if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))
298 return lu;
299 else {
300 X509_LOOKUP_free(lu);
301 return NULL;
302 }
303 }
304 }
305
306 int
X509_STORE_get_by_subject(X509_STORE_CTX * vs,int type,X509_NAME * name,X509_OBJECT * ret)307 X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
308 X509_OBJECT *ret)
309 {
310 X509_STORE *ctx = vs->ctx;
311 X509_LOOKUP *lu;
312 X509_OBJECT stmp, *tmp;
313 int i, j;
314
315 if (ctx == NULL)
316 return 0;
317
318 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
319 tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
320 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
321
322 if (tmp == NULL || type == X509_LU_CRL) {
323 for (i = vs->current_method;
324 i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
325 lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
326 j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
327 if (j < 0) {
328 vs->current_method = j;
329 return j;
330 } else if (j) {
331 tmp = &stmp;
332 break;
333 }
334 }
335 vs->current_method = 0;
336 if (tmp == NULL)
337 return 0;
338 }
339
340 /* if (ret->data.ptr != NULL)
341 X509_OBJECT_free_contents(ret); */
342
343 ret->type = tmp->type;
344 ret->data.ptr = tmp->data.ptr;
345
346 X509_OBJECT_up_ref_count(ret);
347
348 return 1;
349 }
350
351 int
X509_STORE_add_cert(X509_STORE * ctx,X509 * x)352 X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
353 {
354 X509_OBJECT *obj;
355 int ret = 1;
356
357 if (x == NULL)
358 return 0;
359 obj = malloc(sizeof(X509_OBJECT));
360 if (obj == NULL) {
361 X509error(ERR_R_MALLOC_FAILURE);
362 return 0;
363 }
364 obj->type = X509_LU_X509;
365 obj->data.x509 = x;
366
367 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
368
369 X509_OBJECT_up_ref_count(obj);
370
371 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
372 X509error(X509_R_CERT_ALREADY_IN_HASH_TABLE);
373 ret = 0;
374 } else {
375 if (sk_X509_OBJECT_push(ctx->objs, obj) == 0) {
376 X509error(ERR_R_MALLOC_FAILURE);
377 ret = 0;
378 }
379 }
380
381 if (ret == 0)
382 X509_OBJECT_dec_ref_count(obj);
383
384 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
385
386 if (ret == 0) {
387 obj->data.x509 = NULL; /* owned by the caller */
388 X509_OBJECT_free(obj);
389 }
390
391 return ret;
392 }
393
394 int
X509_STORE_add_crl(X509_STORE * ctx,X509_CRL * x)395 X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
396 {
397 X509_OBJECT *obj;
398 int ret = 1;
399
400 if (x == NULL)
401 return 0;
402 obj = malloc(sizeof(X509_OBJECT));
403 if (obj == NULL) {
404 X509error(ERR_R_MALLOC_FAILURE);
405 return 0;
406 }
407 obj->type = X509_LU_CRL;
408 obj->data.crl = x;
409
410 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
411
412 X509_OBJECT_up_ref_count(obj);
413
414 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
415 X509error(X509_R_CERT_ALREADY_IN_HASH_TABLE);
416 ret = 0;
417 } else {
418 if (sk_X509_OBJECT_push(ctx->objs, obj) == 0) {
419 X509error(ERR_R_MALLOC_FAILURE);
420 ret = 0;
421 }
422 }
423
424 if (ret == 0)
425 X509_OBJECT_dec_ref_count(obj);
426
427 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
428
429 if (ret == 0) {
430 obj->data.crl = NULL; /* owned by the caller */
431 X509_OBJECT_free(obj);
432 }
433
434 return ret;
435 }
436
437 static void
X509_OBJECT_dec_ref_count(X509_OBJECT * a)438 X509_OBJECT_dec_ref_count(X509_OBJECT *a)
439 {
440 switch (a->type) {
441 case X509_LU_X509:
442 CRYPTO_add(&a->data.x509->references, -1, CRYPTO_LOCK_X509);
443 break;
444 case X509_LU_CRL:
445 CRYPTO_add(&a->data.crl->references, -1, CRYPTO_LOCK_X509_CRL);
446 break;
447 }
448 }
449
450 int
X509_OBJECT_up_ref_count(X509_OBJECT * a)451 X509_OBJECT_up_ref_count(X509_OBJECT *a)
452 {
453 switch (a->type) {
454 case X509_LU_X509:
455 return X509_up_ref(a->data.x509);
456 case X509_LU_CRL:
457 return X509_CRL_up_ref(a->data.crl);
458 }
459 return 1;
460 }
461
462 int
X509_OBJECT_get_type(const X509_OBJECT * a)463 X509_OBJECT_get_type(const X509_OBJECT *a)
464 {
465 return a->type;
466 }
467
468 void
X509_OBJECT_free_contents(X509_OBJECT * a)469 X509_OBJECT_free_contents(X509_OBJECT *a)
470 {
471 switch (a->type) {
472 case X509_LU_X509:
473 X509_free(a->data.x509);
474 break;
475 case X509_LU_CRL:
476 X509_CRL_free(a->data.crl);
477 break;
478 }
479 }
480
481 static int
x509_object_idx_cnt(STACK_OF (X509_OBJECT)* h,int type,X509_NAME * name,int * pnmatch)482 x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name,
483 int *pnmatch)
484 {
485 X509_OBJECT stmp;
486 X509 x509_s;
487 X509_CINF cinf_s;
488 X509_CRL crl_s;
489 X509_CRL_INFO crl_info_s;
490 int idx;
491
492 stmp.type = type;
493 switch (type) {
494 case X509_LU_X509:
495 stmp.data.x509 = &x509_s;
496 x509_s.cert_info = &cinf_s;
497 cinf_s.subject = name;
498 break;
499 case X509_LU_CRL:
500 stmp.data.crl = &crl_s;
501 crl_s.crl = &crl_info_s;
502 crl_info_s.issuer = name;
503 break;
504 default:
505 /* abort(); */
506 return -1;
507 }
508
509 idx = sk_X509_OBJECT_find(h, &stmp);
510 if (idx >= 0 && pnmatch) {
511 int tidx;
512 const X509_OBJECT *tobj, *pstmp;
513 *pnmatch = 1;
514 pstmp = &stmp;
515 for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
516 tobj = sk_X509_OBJECT_value(h, tidx);
517 if (x509_object_cmp(&tobj, &pstmp))
518 break;
519 (*pnmatch)++;
520 }
521 }
522 return idx;
523 }
524
525 int
X509_OBJECT_idx_by_subject(STACK_OF (X509_OBJECT)* h,int type,X509_NAME * name)526 X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name)
527 {
528 return x509_object_idx_cnt(h, type, name, NULL);
529 }
530
531 X509_OBJECT *
X509_OBJECT_retrieve_by_subject(STACK_OF (X509_OBJECT)* h,int type,X509_NAME * name)532 X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
533 X509_NAME *name)
534 {
535 int idx;
536
537 idx = X509_OBJECT_idx_by_subject(h, type, name);
538 if (idx == -1)
539 return NULL;
540 return sk_X509_OBJECT_value(h, idx);
541 }
542
543 X509 *
X509_OBJECT_get0_X509(const X509_OBJECT * xo)544 X509_OBJECT_get0_X509(const X509_OBJECT *xo)
545 {
546 if (xo != NULL && xo->type == X509_LU_X509)
547 return xo->data.x509;
548 return NULL;
549 }
550
551 X509_CRL *
X509_OBJECT_get0_X509_CRL(X509_OBJECT * xo)552 X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo)
553 {
554 if (xo != NULL && xo->type == X509_LU_CRL)
555 return xo->data.crl;
556 return NULL;
557 }
558
STACK_OF(X509)559 STACK_OF(X509) *
560 X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
561 {
562 int i, idx, cnt;
563 STACK_OF(X509) *sk;
564 X509 *x;
565 X509_OBJECT *obj;
566
567 if (ctx->ctx == NULL)
568 return NULL;
569 sk = sk_X509_new_null();
570 if (sk == NULL)
571 return NULL;
572 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
573 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
574 if (idx < 0) {
575 /* Nothing found in cache: do lookup to possibly add new
576 * objects to cache
577 */
578 X509_OBJECT xobj;
579 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
580 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
581 sk_X509_free(sk);
582 return NULL;
583 }
584 X509_OBJECT_free_contents(&xobj);
585 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
586 idx = x509_object_idx_cnt(ctx->ctx->objs,
587 X509_LU_X509, nm, &cnt);
588 if (idx < 0) {
589 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
590 sk_X509_free(sk);
591 return NULL;
592 }
593 }
594 for (i = 0; i < cnt; i++, idx++) {
595 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
596 x = obj->data.x509;
597 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
598 if (!sk_X509_push(sk, x)) {
599 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
600 X509_free(x);
601 sk_X509_pop_free(sk, X509_free);
602 return NULL;
603 }
604 }
605 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
606 return sk;
607
608 }
609
STACK_OF(X509_CRL)610 STACK_OF(X509_CRL) *
611 X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
612 {
613 int i, idx, cnt;
614 STACK_OF(X509_CRL) *sk;
615 X509_CRL *x;
616 X509_OBJECT *obj, xobj;
617
618 if (ctx->ctx == NULL)
619 return NULL;
620 sk = sk_X509_CRL_new_null();
621 if (sk == NULL)
622 return NULL;
623 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
624 /* Check cache first */
625 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
626
627 /* Always do lookup to possibly add new CRLs to cache
628 */
629 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
630 if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
631 sk_X509_CRL_free(sk);
632 return NULL;
633 }
634 X509_OBJECT_free_contents(&xobj);
635 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
636 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
637 if (idx < 0) {
638 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
639 sk_X509_CRL_free(sk);
640 return NULL;
641 }
642
643 for (i = 0; i < cnt; i++, idx++) {
644 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
645 x = obj->data.crl;
646 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
647 if (!sk_X509_CRL_push(sk, x)) {
648 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
649 X509_CRL_free(x);
650 sk_X509_CRL_pop_free(sk, X509_CRL_free);
651 return NULL;
652 }
653 }
654 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
655 return sk;
656 }
657
658 X509_OBJECT *
X509_OBJECT_retrieve_match(STACK_OF (X509_OBJECT)* h,X509_OBJECT * x)659 X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
660 {
661 int idx, i;
662 X509_OBJECT *obj;
663
664 idx = sk_X509_OBJECT_find(h, x);
665 if (idx == -1)
666 return NULL;
667 if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
668 return sk_X509_OBJECT_value(h, idx);
669 for (i = idx; i < sk_X509_OBJECT_num(h); i++) {
670 obj = sk_X509_OBJECT_value(h, i);
671 if (x509_object_cmp((const X509_OBJECT **)&obj,
672 (const X509_OBJECT **)&x))
673 return NULL;
674 if (x->type == X509_LU_X509) {
675 if (!X509_cmp(obj->data.x509, x->data.x509))
676 return obj;
677 } else if (x->type == X509_LU_CRL) {
678 if (!X509_CRL_match(obj->data.crl, x->data.crl))
679 return obj;
680 } else
681 return obj;
682 }
683 return NULL;
684 }
685
686 /* Try to get issuer certificate from store. Due to limitations
687 * of the API this can only retrieve a single certificate matching
688 * a given subject name. However it will fill the cache with all
689 * matching certificates, so we can examine the cache for all
690 * matches.
691 *
692 * Return values are:
693 * 1 lookup successful.
694 * 0 certificate not found.
695 * -1 some other error.
696 */
697 int
X509_STORE_CTX_get1_issuer(X509 ** issuer,X509_STORE_CTX * ctx,X509 * x)698 X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
699 {
700 X509_NAME *xn;
701 X509_OBJECT obj, *pobj;
702 int i, ok, idx, ret;
703
704 *issuer = NULL;
705 xn = X509_get_issuer_name(x);
706 ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
707 if (ok != X509_LU_X509) {
708 if (ok == X509_LU_RETRY) {
709 X509_OBJECT_free_contents(&obj);
710 X509error(X509_R_SHOULD_RETRY);
711 return -1;
712 } else if (ok != X509_LU_FAIL) {
713 X509_OBJECT_free_contents(&obj);
714 /* not good :-(, break anyway */
715 return -1;
716 }
717 return 0;
718 }
719 /* If certificate matches all OK */
720 if (ctx->check_issued(ctx, x, obj.data.x509)) {
721 if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
722 *issuer = obj.data.x509;
723 return 1;
724 }
725 }
726 X509_OBJECT_free_contents(&obj);
727
728 if (ctx->ctx == NULL)
729 return 0;
730
731 /* Else find index of first cert accepted by 'check_issued' */
732 ret = 0;
733 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
734 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
735 if (idx != -1) /* should be true as we've had at least one match */ {
736 /* Look through all matching certs for suitable issuer */
737 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
738 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
739 /* See if we've run past the matches */
740 if (pobj->type != X509_LU_X509)
741 break;
742 if (X509_NAME_cmp(xn,
743 X509_get_subject_name(pobj->data.x509)))
744 break;
745 if (ctx->check_issued(ctx, x, pobj->data.x509)) {
746 *issuer = pobj->data.x509;
747 ret = 1;
748 /*
749 * If times check, exit with match,
750 * otherwise keep looking. Leave last
751 * match in issuer so we return nearest
752 * match if no certificate time is OK.
753 */
754 if (x509_check_cert_time(ctx, *issuer, 1))
755 break;
756 }
757 }
758 }
759 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
760 if (*issuer)
761 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
762 return ret;
763 }
764
STACK_OF(X509_OBJECT)765 STACK_OF(X509_OBJECT) *
766 X509_STORE_get0_objects(X509_STORE *xs)
767 {
768 return xs->objs;
769 }
770
771 void *
X509_STORE_get_ex_data(X509_STORE * xs,int idx)772 X509_STORE_get_ex_data(X509_STORE *xs, int idx)
773 {
774 return CRYPTO_get_ex_data(&xs->ex_data, idx);
775 }
776
777 int
X509_STORE_set_ex_data(X509_STORE * xs,int idx,void * data)778 X509_STORE_set_ex_data(X509_STORE *xs, int idx, void *data)
779 {
780 return CRYPTO_set_ex_data(&xs->ex_data, idx, data);
781 }
782
783 int
X509_STORE_set_flags(X509_STORE * ctx,unsigned long flags)784 X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
785 {
786 return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
787 }
788
789 int
X509_STORE_set_depth(X509_STORE * ctx,int depth)790 X509_STORE_set_depth(X509_STORE *ctx, int depth)
791 {
792 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
793 return 1;
794 }
795
796 int
X509_STORE_set_purpose(X509_STORE * ctx,int purpose)797 X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
798 {
799 return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
800 }
801
802 int
X509_STORE_set_trust(X509_STORE * ctx,int trust)803 X509_STORE_set_trust(X509_STORE *ctx, int trust)
804 {
805 return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
806 }
807
808 int
X509_STORE_set1_param(X509_STORE * ctx,X509_VERIFY_PARAM * param)809 X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
810 {
811 return X509_VERIFY_PARAM_set1(ctx->param, param);
812 }
813
814 X509_VERIFY_PARAM *
X509_STORE_get0_param(X509_STORE * ctx)815 X509_STORE_get0_param(X509_STORE *ctx)
816 {
817 return ctx->param;
818 }
819
820 void
X509_STORE_set_verify_cb(X509_STORE * ctx,int (* verify_cb)(int,X509_STORE_CTX *))821 X509_STORE_set_verify_cb(X509_STORE *ctx,
822 int (*verify_cb)(int, X509_STORE_CTX *))
823 {
824 ctx->verify_cb = verify_cb;
825 }
826