1c19800e8SDoug Rabson /*
2c19800e8SDoug Rabson * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
3c19800e8SDoug Rabson * (Royal Institute of Technology, Stockholm, Sweden).
4c19800e8SDoug Rabson * All rights reserved.
5c19800e8SDoug Rabson *
6c19800e8SDoug Rabson * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7c19800e8SDoug Rabson *
8c19800e8SDoug Rabson * Redistribution and use in source and binary forms, with or without
9c19800e8SDoug Rabson * modification, are permitted provided that the following conditions
10c19800e8SDoug Rabson * are met:
11c19800e8SDoug Rabson *
12c19800e8SDoug Rabson * 1. Redistributions of source code must retain the above copyright
13c19800e8SDoug Rabson * notice, this list of conditions and the following disclaimer.
14c19800e8SDoug Rabson *
15c19800e8SDoug Rabson * 2. Redistributions in binary form must reproduce the above copyright
16c19800e8SDoug Rabson * notice, this list of conditions and the following disclaimer in the
17c19800e8SDoug Rabson * documentation and/or other materials provided with the distribution.
18c19800e8SDoug Rabson *
19c19800e8SDoug Rabson * 3. Neither the name of the Institute nor the names of its contributors
20c19800e8SDoug Rabson * may be used to endorse or promote products derived from this software
21c19800e8SDoug Rabson * without specific prior written permission.
22c19800e8SDoug Rabson *
23c19800e8SDoug Rabson * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24c19800e8SDoug Rabson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25c19800e8SDoug Rabson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26c19800e8SDoug Rabson * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27c19800e8SDoug Rabson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28c19800e8SDoug Rabson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29c19800e8SDoug Rabson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30c19800e8SDoug Rabson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31c19800e8SDoug Rabson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32c19800e8SDoug Rabson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33c19800e8SDoug Rabson * SUCH DAMAGE.
34c19800e8SDoug Rabson */
35c19800e8SDoug Rabson
36c19800e8SDoug Rabson #include "hx_locl.h"
37c19800e8SDoug Rabson
38c19800e8SDoug Rabson /**
39c19800e8SDoug Rabson * @page page_keyset Certificate store operations
40c19800e8SDoug Rabson *
41c19800e8SDoug Rabson * Type of certificates store:
42c19800e8SDoug Rabson * - MEMORY
43c19800e8SDoug Rabson * In memory based format. Doesnt support storing.
44c19800e8SDoug Rabson * - FILE
45c19800e8SDoug Rabson * FILE supports raw DER certicates and PEM certicates. When PEM is
46c19800e8SDoug Rabson * used the file can contain may certificates and match private
47c19800e8SDoug Rabson * keys. Support storing the certificates. DER format only supports
48c19800e8SDoug Rabson * on certificate and no private key.
49c19800e8SDoug Rabson * - PEM-FILE
50c19800e8SDoug Rabson * Same as FILE, defaulting to PEM encoded certificates.
51c19800e8SDoug Rabson * - PEM-FILE
52c19800e8SDoug Rabson * Same as FILE, defaulting to DER encoded certificates.
53c19800e8SDoug Rabson * - PKCS11
54c19800e8SDoug Rabson * - PKCS12
55c19800e8SDoug Rabson * - DIR
56c19800e8SDoug Rabson * - KEYCHAIN
57c19800e8SDoug Rabson * Apple Mac OS X KeyChain backed keychain object.
58c19800e8SDoug Rabson *
59c19800e8SDoug Rabson * See the library functions here: @ref hx509_keyset
60c19800e8SDoug Rabson */
61c19800e8SDoug Rabson
62c19800e8SDoug Rabson struct hx509_certs_data {
63c19800e8SDoug Rabson unsigned int ref;
64c19800e8SDoug Rabson struct hx509_keyset_ops *ops;
65c19800e8SDoug Rabson void *ops_data;
66c19800e8SDoug Rabson };
67c19800e8SDoug Rabson
68c19800e8SDoug Rabson static struct hx509_keyset_ops *
_hx509_ks_type(hx509_context context,const char * type)69c19800e8SDoug Rabson _hx509_ks_type(hx509_context context, const char *type)
70c19800e8SDoug Rabson {
71c19800e8SDoug Rabson int i;
72c19800e8SDoug Rabson
73c19800e8SDoug Rabson for (i = 0; i < context->ks_num_ops; i++)
74c19800e8SDoug Rabson if (strcasecmp(type, context->ks_ops[i]->name) == 0)
75c19800e8SDoug Rabson return context->ks_ops[i];
76c19800e8SDoug Rabson
77c19800e8SDoug Rabson return NULL;
78c19800e8SDoug Rabson }
79c19800e8SDoug Rabson
80c19800e8SDoug Rabson void
_hx509_ks_register(hx509_context context,struct hx509_keyset_ops * ops)81c19800e8SDoug Rabson _hx509_ks_register(hx509_context context, struct hx509_keyset_ops *ops)
82c19800e8SDoug Rabson {
83c19800e8SDoug Rabson struct hx509_keyset_ops **val;
84c19800e8SDoug Rabson
85c19800e8SDoug Rabson if (_hx509_ks_type(context, ops->name))
86c19800e8SDoug Rabson return;
87c19800e8SDoug Rabson
88c19800e8SDoug Rabson val = realloc(context->ks_ops,
89c19800e8SDoug Rabson (context->ks_num_ops + 1) * sizeof(context->ks_ops[0]));
90c19800e8SDoug Rabson if (val == NULL)
91c19800e8SDoug Rabson return;
92c19800e8SDoug Rabson val[context->ks_num_ops] = ops;
93c19800e8SDoug Rabson context->ks_ops = val;
94c19800e8SDoug Rabson context->ks_num_ops++;
95c19800e8SDoug Rabson }
96c19800e8SDoug Rabson
97c19800e8SDoug Rabson /**
98c19800e8SDoug Rabson * Open or creates a new hx509 certificate store.
99c19800e8SDoug Rabson *
100c19800e8SDoug Rabson * @param context A hx509 context
101c19800e8SDoug Rabson * @param name name of the store, format is TYPE:type-specific-string,
102c19800e8SDoug Rabson * if NULL is used the MEMORY store is used.
103c19800e8SDoug Rabson * @param flags list of flags:
104c19800e8SDoug Rabson * - HX509_CERTS_CREATE create a new keystore of the specific TYPE.
105c19800e8SDoug Rabson * - HX509_CERTS_UNPROTECT_ALL fails if any private key failed to be extracted.
106c19800e8SDoug Rabson * @param lock a lock that unlocks the certificates store, use NULL to
107c19800e8SDoug Rabson * select no password/certifictes/prompt lock (see @ref page_lock).
108c19800e8SDoug Rabson * @param certs return pointer, free with hx509_certs_free().
109c19800e8SDoug Rabson *
110c19800e8SDoug Rabson * @ingroup hx509_keyset
111c19800e8SDoug Rabson */
112c19800e8SDoug Rabson
113c19800e8SDoug Rabson int
hx509_certs_init(hx509_context context,const char * name,int flags,hx509_lock lock,hx509_certs * certs)114c19800e8SDoug Rabson hx509_certs_init(hx509_context context,
115c19800e8SDoug Rabson const char *name, int flags,
116c19800e8SDoug Rabson hx509_lock lock, hx509_certs *certs)
117c19800e8SDoug Rabson {
118c19800e8SDoug Rabson struct hx509_keyset_ops *ops;
119c19800e8SDoug Rabson const char *residue;
120c19800e8SDoug Rabson hx509_certs c;
121c19800e8SDoug Rabson char *type;
122c19800e8SDoug Rabson int ret;
123c19800e8SDoug Rabson
124c19800e8SDoug Rabson *certs = NULL;
125c19800e8SDoug Rabson
126c19800e8SDoug Rabson residue = strchr(name, ':');
127c19800e8SDoug Rabson if (residue) {
128c19800e8SDoug Rabson type = malloc(residue - name + 1);
129c19800e8SDoug Rabson if (type)
130c19800e8SDoug Rabson strlcpy(type, name, residue - name + 1);
131c19800e8SDoug Rabson residue++;
132c19800e8SDoug Rabson if (residue[0] == '\0')
133c19800e8SDoug Rabson residue = NULL;
134c19800e8SDoug Rabson } else {
135c19800e8SDoug Rabson type = strdup("MEMORY");
136c19800e8SDoug Rabson residue = name;
137c19800e8SDoug Rabson }
138c19800e8SDoug Rabson if (type == NULL) {
139c19800e8SDoug Rabson hx509_clear_error_string(context);
140c19800e8SDoug Rabson return ENOMEM;
141c19800e8SDoug Rabson }
142c19800e8SDoug Rabson
143c19800e8SDoug Rabson ops = _hx509_ks_type(context, type);
144c19800e8SDoug Rabson if (ops == NULL) {
145c19800e8SDoug Rabson hx509_set_error_string(context, 0, ENOENT,
146c19800e8SDoug Rabson "Keyset type %s is not supported", type);
147c19800e8SDoug Rabson free(type);
148c19800e8SDoug Rabson return ENOENT;
149c19800e8SDoug Rabson }
150c19800e8SDoug Rabson free(type);
151c19800e8SDoug Rabson c = calloc(1, sizeof(*c));
152c19800e8SDoug Rabson if (c == NULL) {
153c19800e8SDoug Rabson hx509_clear_error_string(context);
154c19800e8SDoug Rabson return ENOMEM;
155c19800e8SDoug Rabson }
156c19800e8SDoug Rabson c->ops = ops;
157c19800e8SDoug Rabson c->ref = 1;
158c19800e8SDoug Rabson
159c19800e8SDoug Rabson ret = (*ops->init)(context, c, &c->ops_data, flags, residue, lock);
160c19800e8SDoug Rabson if (ret) {
161c19800e8SDoug Rabson free(c);
162c19800e8SDoug Rabson return ret;
163c19800e8SDoug Rabson }
164c19800e8SDoug Rabson
165c19800e8SDoug Rabson *certs = c;
166c19800e8SDoug Rabson return 0;
167c19800e8SDoug Rabson }
168c19800e8SDoug Rabson
169c19800e8SDoug Rabson /**
170c19800e8SDoug Rabson * Write the certificate store to stable storage.
171c19800e8SDoug Rabson *
172c19800e8SDoug Rabson * @param context A hx509 context.
173c19800e8SDoug Rabson * @param certs a certificate store to store.
174c19800e8SDoug Rabson * @param flags currently unused, use 0.
175c19800e8SDoug Rabson * @param lock a lock that unlocks the certificates store, use NULL to
176c19800e8SDoug Rabson * select no password/certifictes/prompt lock (see @ref page_lock).
177c19800e8SDoug Rabson *
178c19800e8SDoug Rabson * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION if
179c19800e8SDoug Rabson * the certificate store doesn't support the store operation.
180c19800e8SDoug Rabson *
181c19800e8SDoug Rabson * @ingroup hx509_keyset
182c19800e8SDoug Rabson */
183c19800e8SDoug Rabson
184c19800e8SDoug Rabson int
hx509_certs_store(hx509_context context,hx509_certs certs,int flags,hx509_lock lock)185c19800e8SDoug Rabson hx509_certs_store(hx509_context context,
186c19800e8SDoug Rabson hx509_certs certs,
187c19800e8SDoug Rabson int flags,
188c19800e8SDoug Rabson hx509_lock lock)
189c19800e8SDoug Rabson {
190c19800e8SDoug Rabson if (certs->ops->store == NULL) {
191c19800e8SDoug Rabson hx509_set_error_string(context, 0, HX509_UNSUPPORTED_OPERATION,
192c19800e8SDoug Rabson "keystore if type %s doesn't support "
193c19800e8SDoug Rabson "store operation",
194c19800e8SDoug Rabson certs->ops->name);
195c19800e8SDoug Rabson return HX509_UNSUPPORTED_OPERATION;
196c19800e8SDoug Rabson }
197c19800e8SDoug Rabson
198c19800e8SDoug Rabson return (*certs->ops->store)(context, certs, certs->ops_data, flags, lock);
199c19800e8SDoug Rabson }
200c19800e8SDoug Rabson
201c19800e8SDoug Rabson
202c19800e8SDoug Rabson hx509_certs
hx509_certs_ref(hx509_certs certs)203c19800e8SDoug Rabson hx509_certs_ref(hx509_certs certs)
204c19800e8SDoug Rabson {
205c19800e8SDoug Rabson if (certs == NULL)
206c19800e8SDoug Rabson return NULL;
207c19800e8SDoug Rabson if (certs->ref == 0)
208c19800e8SDoug Rabson _hx509_abort("certs refcount == 0 on ref");
209c19800e8SDoug Rabson if (certs->ref == UINT_MAX)
210c19800e8SDoug Rabson _hx509_abort("certs refcount == UINT_MAX on ref");
211c19800e8SDoug Rabson certs->ref++;
212c19800e8SDoug Rabson return certs;
213c19800e8SDoug Rabson }
214c19800e8SDoug Rabson
215c19800e8SDoug Rabson /**
216c19800e8SDoug Rabson * Free a certificate store.
217c19800e8SDoug Rabson *
218c19800e8SDoug Rabson * @param certs certificate store to free.
219c19800e8SDoug Rabson *
220c19800e8SDoug Rabson * @ingroup hx509_keyset
221c19800e8SDoug Rabson */
222c19800e8SDoug Rabson
223c19800e8SDoug Rabson void
hx509_certs_free(hx509_certs * certs)224c19800e8SDoug Rabson hx509_certs_free(hx509_certs *certs)
225c19800e8SDoug Rabson {
226c19800e8SDoug Rabson if (*certs) {
227c19800e8SDoug Rabson if ((*certs)->ref == 0)
228c19800e8SDoug Rabson _hx509_abort("cert refcount == 0 on free");
229c19800e8SDoug Rabson if (--(*certs)->ref > 0)
230c19800e8SDoug Rabson return;
231c19800e8SDoug Rabson
232c19800e8SDoug Rabson (*(*certs)->ops->free)(*certs, (*certs)->ops_data);
233c19800e8SDoug Rabson free(*certs);
234c19800e8SDoug Rabson *certs = NULL;
235c19800e8SDoug Rabson }
236c19800e8SDoug Rabson }
237c19800e8SDoug Rabson
238c19800e8SDoug Rabson /**
239c19800e8SDoug Rabson * Start the integration
240c19800e8SDoug Rabson *
241c19800e8SDoug Rabson * @param context a hx509 context.
242c19800e8SDoug Rabson * @param certs certificate store to iterate over
243c19800e8SDoug Rabson * @param cursor cursor that will keep track of progress, free with
244c19800e8SDoug Rabson * hx509_certs_end_seq().
245c19800e8SDoug Rabson *
246c19800e8SDoug Rabson * @return Returns an hx509 error code. HX509_UNSUPPORTED_OPERATION is
247c19800e8SDoug Rabson * returned if the certificate store doesn't support the iteration
248c19800e8SDoug Rabson * operation.
249c19800e8SDoug Rabson *
250c19800e8SDoug Rabson * @ingroup hx509_keyset
251c19800e8SDoug Rabson */
252c19800e8SDoug Rabson
253c19800e8SDoug Rabson int
hx509_certs_start_seq(hx509_context context,hx509_certs certs,hx509_cursor * cursor)254c19800e8SDoug Rabson hx509_certs_start_seq(hx509_context context,
255c19800e8SDoug Rabson hx509_certs certs,
256c19800e8SDoug Rabson hx509_cursor *cursor)
257c19800e8SDoug Rabson {
258c19800e8SDoug Rabson int ret;
259c19800e8SDoug Rabson
260c19800e8SDoug Rabson if (certs->ops->iter_start == NULL) {
261c19800e8SDoug Rabson hx509_set_error_string(context, 0, HX509_UNSUPPORTED_OPERATION,
262c19800e8SDoug Rabson "Keyset type %s doesn't support iteration",
263c19800e8SDoug Rabson certs->ops->name);
264c19800e8SDoug Rabson return HX509_UNSUPPORTED_OPERATION;
265c19800e8SDoug Rabson }
266c19800e8SDoug Rabson
267c19800e8SDoug Rabson ret = (*certs->ops->iter_start)(context, certs, certs->ops_data, cursor);
268c19800e8SDoug Rabson if (ret)
269c19800e8SDoug Rabson return ret;
270c19800e8SDoug Rabson
271c19800e8SDoug Rabson return 0;
272c19800e8SDoug Rabson }
273c19800e8SDoug Rabson
274c19800e8SDoug Rabson /**
275c19800e8SDoug Rabson * Get next ceritificate from the certificate keystore pointed out by
276c19800e8SDoug Rabson * cursor.
277c19800e8SDoug Rabson *
278c19800e8SDoug Rabson * @param context a hx509 context.
279c19800e8SDoug Rabson * @param certs certificate store to iterate over.
280c19800e8SDoug Rabson * @param cursor cursor that keeps track of progress.
281c19800e8SDoug Rabson * @param cert return certificate next in store, NULL if the store
282c19800e8SDoug Rabson * contains no more certificates. Free with hx509_cert_free().
283c19800e8SDoug Rabson *
284c19800e8SDoug Rabson * @return Returns an hx509 error code.
285c19800e8SDoug Rabson *
286c19800e8SDoug Rabson * @ingroup hx509_keyset
287c19800e8SDoug Rabson */
288c19800e8SDoug Rabson
289c19800e8SDoug Rabson int
hx509_certs_next_cert(hx509_context context,hx509_certs certs,hx509_cursor cursor,hx509_cert * cert)290c19800e8SDoug Rabson hx509_certs_next_cert(hx509_context context,
291c19800e8SDoug Rabson hx509_certs certs,
292c19800e8SDoug Rabson hx509_cursor cursor,
293c19800e8SDoug Rabson hx509_cert *cert)
294c19800e8SDoug Rabson {
295c19800e8SDoug Rabson *cert = NULL;
296c19800e8SDoug Rabson return (*certs->ops->iter)(context, certs, certs->ops_data, cursor, cert);
297c19800e8SDoug Rabson }
298c19800e8SDoug Rabson
299c19800e8SDoug Rabson /**
300c19800e8SDoug Rabson * End the iteration over certificates.
301c19800e8SDoug Rabson *
302c19800e8SDoug Rabson * @param context a hx509 context.
303c19800e8SDoug Rabson * @param certs certificate store to iterate over.
304c19800e8SDoug Rabson * @param cursor cursor that will keep track of progress, freed.
305c19800e8SDoug Rabson *
306c19800e8SDoug Rabson * @return Returns an hx509 error code.
307c19800e8SDoug Rabson *
308c19800e8SDoug Rabson * @ingroup hx509_keyset
309c19800e8SDoug Rabson */
310c19800e8SDoug Rabson
311c19800e8SDoug Rabson int
hx509_certs_end_seq(hx509_context context,hx509_certs certs,hx509_cursor cursor)312c19800e8SDoug Rabson hx509_certs_end_seq(hx509_context context,
313c19800e8SDoug Rabson hx509_certs certs,
314c19800e8SDoug Rabson hx509_cursor cursor)
315c19800e8SDoug Rabson {
316c19800e8SDoug Rabson (*certs->ops->iter_end)(context, certs, certs->ops_data, cursor);
317c19800e8SDoug Rabson return 0;
318c19800e8SDoug Rabson }
319c19800e8SDoug Rabson
320c19800e8SDoug Rabson /**
321c19800e8SDoug Rabson * Iterate over all certificates in a keystore and call an function
322c19800e8SDoug Rabson * for each fo them.
323c19800e8SDoug Rabson *
324c19800e8SDoug Rabson * @param context a hx509 context.
325c19800e8SDoug Rabson * @param certs certificate store to iterate over.
326c19800e8SDoug Rabson * @param func function to call for each certificate. The function
327c19800e8SDoug Rabson * should return non-zero to abort the iteration, that value is passed
328c19800e8SDoug Rabson * back to the caller of hx509_certs_iter_f().
329c19800e8SDoug Rabson * @param ctx context variable that will passed to the function.
330c19800e8SDoug Rabson *
331c19800e8SDoug Rabson * @return Returns an hx509 error code.
332c19800e8SDoug Rabson *
333c19800e8SDoug Rabson * @ingroup hx509_keyset
334c19800e8SDoug Rabson */
335c19800e8SDoug Rabson
336c19800e8SDoug Rabson int
hx509_certs_iter_f(hx509_context context,hx509_certs certs,int (* func)(hx509_context,void *,hx509_cert),void * ctx)337c19800e8SDoug Rabson hx509_certs_iter_f(hx509_context context,
338c19800e8SDoug Rabson hx509_certs certs,
339c19800e8SDoug Rabson int (*func)(hx509_context, void *, hx509_cert),
340c19800e8SDoug Rabson void *ctx)
341c19800e8SDoug Rabson {
342c19800e8SDoug Rabson hx509_cursor cursor;
343c19800e8SDoug Rabson hx509_cert c;
344c19800e8SDoug Rabson int ret;
345c19800e8SDoug Rabson
346c19800e8SDoug Rabson ret = hx509_certs_start_seq(context, certs, &cursor);
347c19800e8SDoug Rabson if (ret)
348c19800e8SDoug Rabson return ret;
349c19800e8SDoug Rabson
350c19800e8SDoug Rabson while (1) {
351c19800e8SDoug Rabson ret = hx509_certs_next_cert(context, certs, cursor, &c);
352c19800e8SDoug Rabson if (ret)
353c19800e8SDoug Rabson break;
354c19800e8SDoug Rabson if (c == NULL) {
355c19800e8SDoug Rabson ret = 0;
356c19800e8SDoug Rabson break;
357c19800e8SDoug Rabson }
358c19800e8SDoug Rabson ret = (*func)(context, ctx, c);
359c19800e8SDoug Rabson hx509_cert_free(c);
360c19800e8SDoug Rabson if (ret)
361c19800e8SDoug Rabson break;
362c19800e8SDoug Rabson }
363c19800e8SDoug Rabson
364c19800e8SDoug Rabson hx509_certs_end_seq(context, certs, cursor);
365c19800e8SDoug Rabson
366c19800e8SDoug Rabson return ret;
367c19800e8SDoug Rabson }
368c19800e8SDoug Rabson
369c19800e8SDoug Rabson /**
370c19800e8SDoug Rabson * Iterate over all certificates in a keystore and call an function
371c19800e8SDoug Rabson * for each fo them.
372c19800e8SDoug Rabson *
373c19800e8SDoug Rabson * @param context a hx509 context.
374c19800e8SDoug Rabson * @param certs certificate store to iterate over.
375c19800e8SDoug Rabson * @param func function to call for each certificate. The function
376c19800e8SDoug Rabson * should return non-zero to abort the iteration, that value is passed
377c19800e8SDoug Rabson * back to the caller of hx509_certs_iter().
378c19800e8SDoug Rabson *
379c19800e8SDoug Rabson * @return Returns an hx509 error code.
380c19800e8SDoug Rabson *
381c19800e8SDoug Rabson * @ingroup hx509_keyset
382c19800e8SDoug Rabson */
383c19800e8SDoug Rabson
384c19800e8SDoug Rabson #ifdef __BLOCKS__
385c19800e8SDoug Rabson
386c19800e8SDoug Rabson static int
certs_iter(hx509_context context,void * ctx,hx509_cert cert)387c19800e8SDoug Rabson certs_iter(hx509_context context, void *ctx, hx509_cert cert)
388c19800e8SDoug Rabson {
389c19800e8SDoug Rabson int (^func)(hx509_cert) = ctx;
390c19800e8SDoug Rabson return func(cert);
391c19800e8SDoug Rabson }
392c19800e8SDoug Rabson
393c19800e8SDoug Rabson /**
394c19800e8SDoug Rabson * Iterate over all certificates in a keystore and call an block
395c19800e8SDoug Rabson * for each fo them.
396c19800e8SDoug Rabson *
397c19800e8SDoug Rabson * @param context a hx509 context.
398c19800e8SDoug Rabson * @param certs certificate store to iterate over.
399c19800e8SDoug Rabson * @param func block to call for each certificate. The function
400c19800e8SDoug Rabson * should return non-zero to abort the iteration, that value is passed
401c19800e8SDoug Rabson * back to the caller of hx509_certs_iter().
402c19800e8SDoug Rabson *
403c19800e8SDoug Rabson * @return Returns an hx509 error code.
404c19800e8SDoug Rabson *
405c19800e8SDoug Rabson * @ingroup hx509_keyset
406c19800e8SDoug Rabson */
407c19800e8SDoug Rabson
408c19800e8SDoug Rabson int
409c19800e8SDoug Rabson hx509_certs_iter(hx509_context context,
410c19800e8SDoug Rabson hx509_certs certs,
411c19800e8SDoug Rabson int (^func)(hx509_cert))
412c19800e8SDoug Rabson {
413c19800e8SDoug Rabson return hx509_certs_iter_f(context, certs, certs_iter, func);
414c19800e8SDoug Rabson }
415c19800e8SDoug Rabson #endif
416c19800e8SDoug Rabson
417c19800e8SDoug Rabson
418c19800e8SDoug Rabson /**
419c19800e8SDoug Rabson * Function to use to hx509_certs_iter_f() as a function argument, the
420c19800e8SDoug Rabson * ctx variable to hx509_certs_iter_f() should be a FILE file descriptor.
421c19800e8SDoug Rabson *
422c19800e8SDoug Rabson * @param context a hx509 context.
423c19800e8SDoug Rabson * @param ctx used by hx509_certs_iter_f().
424c19800e8SDoug Rabson * @param c a certificate
425c19800e8SDoug Rabson *
426c19800e8SDoug Rabson * @return Returns an hx509 error code.
427c19800e8SDoug Rabson *
428c19800e8SDoug Rabson * @ingroup hx509_keyset
429c19800e8SDoug Rabson */
430c19800e8SDoug Rabson
431c19800e8SDoug Rabson int
hx509_ci_print_names(hx509_context context,void * ctx,hx509_cert c)432c19800e8SDoug Rabson hx509_ci_print_names(hx509_context context, void *ctx, hx509_cert c)
433c19800e8SDoug Rabson {
434c19800e8SDoug Rabson Certificate *cert;
435c19800e8SDoug Rabson hx509_name n;
436c19800e8SDoug Rabson char *s, *i;
437c19800e8SDoug Rabson
438c19800e8SDoug Rabson cert = _hx509_get_cert(c);
439c19800e8SDoug Rabson
440c19800e8SDoug Rabson _hx509_name_from_Name(&cert->tbsCertificate.subject, &n);
441c19800e8SDoug Rabson hx509_name_to_string(n, &s);
442c19800e8SDoug Rabson hx509_name_free(&n);
443c19800e8SDoug Rabson _hx509_name_from_Name(&cert->tbsCertificate.issuer, &n);
444c19800e8SDoug Rabson hx509_name_to_string(n, &i);
445c19800e8SDoug Rabson hx509_name_free(&n);
446c19800e8SDoug Rabson fprintf(ctx, "subject: %s\nissuer: %s\n", s, i);
447c19800e8SDoug Rabson free(s);
448c19800e8SDoug Rabson free(i);
449c19800e8SDoug Rabson return 0;
450c19800e8SDoug Rabson }
451c19800e8SDoug Rabson
452c19800e8SDoug Rabson /**
453c19800e8SDoug Rabson * Add a certificate to the certificiate store.
454c19800e8SDoug Rabson *
455c19800e8SDoug Rabson * The receiving keyset certs will either increase reference counter
456c19800e8SDoug Rabson * of the cert or make a deep copy, either way, the caller needs to
457c19800e8SDoug Rabson * free the cert itself.
458c19800e8SDoug Rabson *
459c19800e8SDoug Rabson * @param context a hx509 context.
460c19800e8SDoug Rabson * @param certs certificate store to add the certificate to.
461c19800e8SDoug Rabson * @param cert certificate to add.
462c19800e8SDoug Rabson *
463c19800e8SDoug Rabson * @return Returns an hx509 error code.
464c19800e8SDoug Rabson *
465c19800e8SDoug Rabson * @ingroup hx509_keyset
466c19800e8SDoug Rabson */
467c19800e8SDoug Rabson
468c19800e8SDoug Rabson int
hx509_certs_add(hx509_context context,hx509_certs certs,hx509_cert cert)469c19800e8SDoug Rabson hx509_certs_add(hx509_context context, hx509_certs certs, hx509_cert cert)
470c19800e8SDoug Rabson {
471c19800e8SDoug Rabson if (certs->ops->add == NULL) {
472c19800e8SDoug Rabson hx509_set_error_string(context, 0, ENOENT,
473c19800e8SDoug Rabson "Keyset type %s doesn't support add operation",
474c19800e8SDoug Rabson certs->ops->name);
475c19800e8SDoug Rabson return ENOENT;
476c19800e8SDoug Rabson }
477c19800e8SDoug Rabson
478c19800e8SDoug Rabson return (*certs->ops->add)(context, certs, certs->ops_data, cert);
479c19800e8SDoug Rabson }
480c19800e8SDoug Rabson
481c19800e8SDoug Rabson /**
482c19800e8SDoug Rabson * Find a certificate matching the query.
483c19800e8SDoug Rabson *
484c19800e8SDoug Rabson * @param context a hx509 context.
485c19800e8SDoug Rabson * @param certs certificate store to search.
486c19800e8SDoug Rabson * @param q query allocated with @ref hx509_query functions.
487c19800e8SDoug Rabson * @param r return certificate (or NULL on error), should be freed
488c19800e8SDoug Rabson * with hx509_cert_free().
489c19800e8SDoug Rabson *
490c19800e8SDoug Rabson * @return Returns an hx509 error code.
491c19800e8SDoug Rabson *
492c19800e8SDoug Rabson * @ingroup hx509_keyset
493c19800e8SDoug Rabson */
494c19800e8SDoug Rabson
495c19800e8SDoug Rabson int
hx509_certs_find(hx509_context context,hx509_certs certs,const hx509_query * q,hx509_cert * r)496c19800e8SDoug Rabson hx509_certs_find(hx509_context context,
497c19800e8SDoug Rabson hx509_certs certs,
498c19800e8SDoug Rabson const hx509_query *q,
499c19800e8SDoug Rabson hx509_cert *r)
500c19800e8SDoug Rabson {
501c19800e8SDoug Rabson hx509_cursor cursor;
502c19800e8SDoug Rabson hx509_cert c;
503c19800e8SDoug Rabson int ret;
504c19800e8SDoug Rabson
505c19800e8SDoug Rabson *r = NULL;
506c19800e8SDoug Rabson
507c19800e8SDoug Rabson _hx509_query_statistic(context, 0, q);
508c19800e8SDoug Rabson
509c19800e8SDoug Rabson if (certs->ops->query)
510c19800e8SDoug Rabson return (*certs->ops->query)(context, certs, certs->ops_data, q, r);
511c19800e8SDoug Rabson
512c19800e8SDoug Rabson ret = hx509_certs_start_seq(context, certs, &cursor);
513c19800e8SDoug Rabson if (ret)
514c19800e8SDoug Rabson return ret;
515c19800e8SDoug Rabson
516c19800e8SDoug Rabson c = NULL;
517c19800e8SDoug Rabson while (1) {
518c19800e8SDoug Rabson ret = hx509_certs_next_cert(context, certs, cursor, &c);
519c19800e8SDoug Rabson if (ret)
520c19800e8SDoug Rabson break;
521c19800e8SDoug Rabson if (c == NULL)
522c19800e8SDoug Rabson break;
523c19800e8SDoug Rabson if (_hx509_query_match_cert(context, q, c)) {
524c19800e8SDoug Rabson *r = c;
525c19800e8SDoug Rabson break;
526c19800e8SDoug Rabson }
527c19800e8SDoug Rabson hx509_cert_free(c);
528c19800e8SDoug Rabson }
529c19800e8SDoug Rabson
530c19800e8SDoug Rabson hx509_certs_end_seq(context, certs, cursor);
531c19800e8SDoug Rabson if (ret)
532c19800e8SDoug Rabson return ret;
533c19800e8SDoug Rabson /**
534c19800e8SDoug Rabson * Return HX509_CERT_NOT_FOUND if no certificate in certs matched
535c19800e8SDoug Rabson * the query.
536c19800e8SDoug Rabson */
537c19800e8SDoug Rabson if (c == NULL) {
538c19800e8SDoug Rabson hx509_clear_error_string(context);
539c19800e8SDoug Rabson return HX509_CERT_NOT_FOUND;
540c19800e8SDoug Rabson }
541c19800e8SDoug Rabson
542c19800e8SDoug Rabson return 0;
543c19800e8SDoug Rabson }
544c19800e8SDoug Rabson
545c19800e8SDoug Rabson /**
546c19800e8SDoug Rabson * Filter certificate matching the query.
547c19800e8SDoug Rabson *
548c19800e8SDoug Rabson * @param context a hx509 context.
549c19800e8SDoug Rabson * @param certs certificate store to search.
550c19800e8SDoug Rabson * @param q query allocated with @ref hx509_query functions.
551c19800e8SDoug Rabson * @param result the filtered certificate store, caller must free with
552c19800e8SDoug Rabson * hx509_certs_free().
553c19800e8SDoug Rabson *
554c19800e8SDoug Rabson * @return Returns an hx509 error code.
555c19800e8SDoug Rabson *
556c19800e8SDoug Rabson * @ingroup hx509_keyset
557c19800e8SDoug Rabson */
558c19800e8SDoug Rabson
559c19800e8SDoug Rabson int
hx509_certs_filter(hx509_context context,hx509_certs certs,const hx509_query * q,hx509_certs * result)560c19800e8SDoug Rabson hx509_certs_filter(hx509_context context,
561c19800e8SDoug Rabson hx509_certs certs,
562c19800e8SDoug Rabson const hx509_query *q,
563c19800e8SDoug Rabson hx509_certs *result)
564c19800e8SDoug Rabson {
565c19800e8SDoug Rabson hx509_cursor cursor;
566c19800e8SDoug Rabson hx509_cert c;
567c19800e8SDoug Rabson int ret, found = 0;
568c19800e8SDoug Rabson
569c19800e8SDoug Rabson _hx509_query_statistic(context, 0, q);
570c19800e8SDoug Rabson
571c19800e8SDoug Rabson ret = hx509_certs_init(context, "MEMORY:filter-certs", 0,
572c19800e8SDoug Rabson NULL, result);
573c19800e8SDoug Rabson if (ret)
574c19800e8SDoug Rabson return ret;
575c19800e8SDoug Rabson
576c19800e8SDoug Rabson ret = hx509_certs_start_seq(context, certs, &cursor);
577c19800e8SDoug Rabson if (ret) {
578c19800e8SDoug Rabson hx509_certs_free(result);
579c19800e8SDoug Rabson return ret;
580c19800e8SDoug Rabson }
581c19800e8SDoug Rabson
582c19800e8SDoug Rabson c = NULL;
583c19800e8SDoug Rabson while (1) {
584c19800e8SDoug Rabson ret = hx509_certs_next_cert(context, certs, cursor, &c);
585c19800e8SDoug Rabson if (ret)
586c19800e8SDoug Rabson break;
587c19800e8SDoug Rabson if (c == NULL)
588c19800e8SDoug Rabson break;
589c19800e8SDoug Rabson if (_hx509_query_match_cert(context, q, c)) {
590c19800e8SDoug Rabson hx509_certs_add(context, *result, c);
591c19800e8SDoug Rabson found = 1;
592c19800e8SDoug Rabson }
593c19800e8SDoug Rabson hx509_cert_free(c);
594c19800e8SDoug Rabson }
595c19800e8SDoug Rabson
596c19800e8SDoug Rabson hx509_certs_end_seq(context, certs, cursor);
597c19800e8SDoug Rabson if (ret) {
598c19800e8SDoug Rabson hx509_certs_free(result);
599c19800e8SDoug Rabson return ret;
600c19800e8SDoug Rabson }
601c19800e8SDoug Rabson
602c19800e8SDoug Rabson /**
603c19800e8SDoug Rabson * Return HX509_CERT_NOT_FOUND if no certificate in certs matched
604c19800e8SDoug Rabson * the query.
605c19800e8SDoug Rabson */
606c19800e8SDoug Rabson if (!found) {
607c19800e8SDoug Rabson hx509_certs_free(result);
608c19800e8SDoug Rabson hx509_clear_error_string(context);
609c19800e8SDoug Rabson return HX509_CERT_NOT_FOUND;
610c19800e8SDoug Rabson }
611c19800e8SDoug Rabson
612c19800e8SDoug Rabson return 0;
613c19800e8SDoug Rabson }
614c19800e8SDoug Rabson
615c19800e8SDoug Rabson
616c19800e8SDoug Rabson static int
certs_merge_func(hx509_context context,void * ctx,hx509_cert c)617c19800e8SDoug Rabson certs_merge_func(hx509_context context, void *ctx, hx509_cert c)
618c19800e8SDoug Rabson {
619c19800e8SDoug Rabson return hx509_certs_add(context, (hx509_certs)ctx, c);
620c19800e8SDoug Rabson }
621c19800e8SDoug Rabson
622c19800e8SDoug Rabson /**
623c19800e8SDoug Rabson * Merge a certificate store into another. The from store is keep
624c19800e8SDoug Rabson * intact.
625c19800e8SDoug Rabson *
626c19800e8SDoug Rabson * @param context a hx509 context.
627c19800e8SDoug Rabson * @param to the store to merge into.
628c19800e8SDoug Rabson * @param from the store to copy the object from.
629c19800e8SDoug Rabson *
630c19800e8SDoug Rabson * @return Returns an hx509 error code.
631c19800e8SDoug Rabson *
632c19800e8SDoug Rabson * @ingroup hx509_keyset
633c19800e8SDoug Rabson */
634c19800e8SDoug Rabson
635c19800e8SDoug Rabson int
hx509_certs_merge(hx509_context context,hx509_certs to,hx509_certs from)636c19800e8SDoug Rabson hx509_certs_merge(hx509_context context, hx509_certs to, hx509_certs from)
637c19800e8SDoug Rabson {
638c19800e8SDoug Rabson if (from == NULL)
639c19800e8SDoug Rabson return 0;
640c19800e8SDoug Rabson return hx509_certs_iter_f(context, from, certs_merge_func, to);
641c19800e8SDoug Rabson }
642c19800e8SDoug Rabson
643c19800e8SDoug Rabson /**
644c19800e8SDoug Rabson * Same a hx509_certs_merge() but use a lock and name to describe the
645c19800e8SDoug Rabson * from source.
646c19800e8SDoug Rabson *
647c19800e8SDoug Rabson * @param context a hx509 context.
648c19800e8SDoug Rabson * @param to the store to merge into.
649c19800e8SDoug Rabson * @param lock a lock that unlocks the certificates store, use NULL to
650c19800e8SDoug Rabson * select no password/certifictes/prompt lock (see @ref page_lock).
651c19800e8SDoug Rabson * @param name name of the source store
652c19800e8SDoug Rabson *
653c19800e8SDoug Rabson * @return Returns an hx509 error code.
654c19800e8SDoug Rabson *
655c19800e8SDoug Rabson * @ingroup hx509_keyset
656c19800e8SDoug Rabson */
657c19800e8SDoug Rabson
658c19800e8SDoug Rabson int
hx509_certs_append(hx509_context context,hx509_certs to,hx509_lock lock,const char * name)659c19800e8SDoug Rabson hx509_certs_append(hx509_context context,
660c19800e8SDoug Rabson hx509_certs to,
661c19800e8SDoug Rabson hx509_lock lock,
662c19800e8SDoug Rabson const char *name)
663c19800e8SDoug Rabson {
664c19800e8SDoug Rabson hx509_certs s;
665c19800e8SDoug Rabson int ret;
666c19800e8SDoug Rabson
667c19800e8SDoug Rabson ret = hx509_certs_init(context, name, 0, lock, &s);
668c19800e8SDoug Rabson if (ret)
669c19800e8SDoug Rabson return ret;
670c19800e8SDoug Rabson ret = hx509_certs_merge(context, to, s);
671c19800e8SDoug Rabson hx509_certs_free(&s);
672c19800e8SDoug Rabson return ret;
673c19800e8SDoug Rabson }
674c19800e8SDoug Rabson
675c19800e8SDoug Rabson /**
676c19800e8SDoug Rabson * Get one random certificate from the certificate store.
677c19800e8SDoug Rabson *
678 * @param context a hx509 context.
679 * @param certs a certificate store to get the certificate from.
680 * @param c return certificate, should be freed with hx509_cert_free().
681 *
682 * @return Returns an hx509 error code.
683 *
684 * @ingroup hx509_keyset
685 */
686
687 int
hx509_get_one_cert(hx509_context context,hx509_certs certs,hx509_cert * c)688 hx509_get_one_cert(hx509_context context, hx509_certs certs, hx509_cert *c)
689 {
690 hx509_cursor cursor;
691 int ret;
692
693 *c = NULL;
694
695 ret = hx509_certs_start_seq(context, certs, &cursor);
696 if (ret)
697 return ret;
698
699 ret = hx509_certs_next_cert(context, certs, cursor, c);
700 if (ret)
701 return ret;
702
703 hx509_certs_end_seq(context, certs, cursor);
704 return 0;
705 }
706
707 static int
certs_info_stdio(void * ctx,const char * str)708 certs_info_stdio(void *ctx, const char *str)
709 {
710 FILE *f = ctx;
711 fprintf(f, "%s\n", str);
712 return 0;
713 }
714
715 /**
716 * Print some info about the certificate store.
717 *
718 * @param context a hx509 context.
719 * @param certs certificate store to print information about.
720 * @param func function that will get each line of the information, if
721 * NULL is used the data is printed on a FILE descriptor that should
722 * be passed in ctx, if ctx also is NULL, stdout is used.
723 * @param ctx parameter to func.
724 *
725 * @return Returns an hx509 error code.
726 *
727 * @ingroup hx509_keyset
728 */
729
730 int
hx509_certs_info(hx509_context context,hx509_certs certs,int (* func)(void *,const char *),void * ctx)731 hx509_certs_info(hx509_context context,
732 hx509_certs certs,
733 int (*func)(void *, const char *),
734 void *ctx)
735 {
736 if (func == NULL) {
737 func = certs_info_stdio;
738 if (ctx == NULL)
739 ctx = stdout;
740 }
741 if (certs->ops->printinfo == NULL) {
742 (*func)(ctx, "No info function for certs");
743 return 0;
744 }
745 return (*certs->ops->printinfo)(context, certs, certs->ops_data,
746 func, ctx);
747 }
748
749 void
_hx509_pi_printf(int (* func)(void *,const char *),void * ctx,const char * fmt,...)750 _hx509_pi_printf(int (*func)(void *, const char *), void *ctx,
751 const char *fmt, ...)
752 {
753 va_list ap;
754 char *str;
755
756 va_start(ap, fmt);
757 vasprintf(&str, fmt, ap);
758 va_end(ap);
759 if (str == NULL)
760 return;
761 (*func)(ctx, str);
762 free(str);
763 }
764
765 int
_hx509_certs_keys_get(hx509_context context,hx509_certs certs,hx509_private_key ** keys)766 _hx509_certs_keys_get(hx509_context context,
767 hx509_certs certs,
768 hx509_private_key **keys)
769 {
770 if (certs->ops->getkeys == NULL) {
771 *keys = NULL;
772 return 0;
773 }
774 return (*certs->ops->getkeys)(context, certs, certs->ops_data, keys);
775 }
776
777 int
_hx509_certs_keys_add(hx509_context context,hx509_certs certs,hx509_private_key key)778 _hx509_certs_keys_add(hx509_context context,
779 hx509_certs certs,
780 hx509_private_key key)
781 {
782 if (certs->ops->addkey == NULL) {
783 hx509_set_error_string(context, 0, EINVAL,
784 "keystore if type %s doesn't support "
785 "key add operation",
786 certs->ops->name);
787 return EINVAL;
788 }
789 return (*certs->ops->addkey)(context, certs, certs->ops_data, key);
790 }
791
792
793 void
_hx509_certs_keys_free(hx509_context context,hx509_private_key * keys)794 _hx509_certs_keys_free(hx509_context context,
795 hx509_private_key *keys)
796 {
797 int i;
798 for (i = 0; keys[i]; i++)
799 hx509_private_key_free(&keys[i]);
800 free(keys);
801 }
802