1 /* 2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <time.h> 12 #include <errno.h> 13 #include <limits.h> 14 15 #include "internal/ctype.h" 16 #include "internal/cryptlib.h" 17 #include <openssl/crypto.h> 18 #include <openssl/buffer.h> 19 #include <openssl/evp.h> 20 #include <openssl/asn1.h> 21 #include <openssl/x509.h> 22 #include <openssl/x509v3.h> 23 #include <openssl/objects.h> 24 #include "internal/dane.h" 25 #include "internal/x509_int.h" 26 #include "x509_lcl.h" 27 28 /* CRL score values */ 29 30 /* No unhandled critical extensions */ 31 32 #define CRL_SCORE_NOCRITICAL 0x100 33 34 /* certificate is within CRL scope */ 35 36 #define CRL_SCORE_SCOPE 0x080 37 38 /* CRL times valid */ 39 40 #define CRL_SCORE_TIME 0x040 41 42 /* Issuer name matches certificate */ 43 44 #define CRL_SCORE_ISSUER_NAME 0x020 45 46 /* If this score or above CRL is probably valid */ 47 48 #define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE) 49 50 /* CRL issuer is certificate issuer */ 51 52 #define CRL_SCORE_ISSUER_CERT 0x018 53 54 /* CRL issuer is on certificate path */ 55 56 #define CRL_SCORE_SAME_PATH 0x008 57 58 /* CRL issuer matches CRL AKID */ 59 60 #define CRL_SCORE_AKID 0x004 61 62 /* Have a delta CRL with valid times */ 63 64 #define CRL_SCORE_TIME_DELTA 0x002 65 66 static int build_chain(X509_STORE_CTX *ctx); 67 static int verify_chain(X509_STORE_CTX *ctx); 68 static int dane_verify(X509_STORE_CTX *ctx); 69 static int null_callback(int ok, X509_STORE_CTX *e); 70 static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); 71 static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); 72 static int check_chain_extensions(X509_STORE_CTX *ctx); 73 static int check_name_constraints(X509_STORE_CTX *ctx); 74 static int check_id(X509_STORE_CTX *ctx); 75 static int check_trust(X509_STORE_CTX *ctx, int num_untrusted); 76 static int check_revocation(X509_STORE_CTX *ctx); 77 static int check_cert(X509_STORE_CTX *ctx); 78 static int check_policy(X509_STORE_CTX *ctx); 79 static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); 80 static int check_dane_issuer(X509_STORE_CTX *ctx, int depth); 81 static int check_key_level(X509_STORE_CTX *ctx, X509 *cert); 82 static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert); 83 84 static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, 85 unsigned int *preasons, X509_CRL *crl, X509 *x); 86 static int get_crl_delta(X509_STORE_CTX *ctx, 87 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x); 88 static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, 89 int *pcrl_score, X509_CRL *base, 90 STACK_OF(X509_CRL) *crls); 91 static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, 92 int *pcrl_score); 93 static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, 94 unsigned int *preasons); 95 static int check_crl_path(X509_STORE_CTX *ctx, X509 *x); 96 static int check_crl_chain(X509_STORE_CTX *ctx, 97 STACK_OF(X509) *cert_path, 98 STACK_OF(X509) *crl_path); 99 100 static int internal_verify(X509_STORE_CTX *ctx); 101 102 static int null_callback(int ok, X509_STORE_CTX *e) 103 { 104 return ok; 105 } 106 107 /* Return 1 is a certificate is self signed */ 108 static int cert_self_signed(X509 *x) 109 { 110 /* 111 * FIXME: x509v3_cache_extensions() needs to detect more failures and not 112 * set EXFLAG_SET when that happens. Especially, if the failures are 113 * parse errors, rather than memory pressure! 114 */ 115 X509_check_purpose(x, -1, 0); 116 if (x->ex_flags & EXFLAG_SS) 117 return 1; 118 else 119 return 0; 120 } 121 122 /* Given a certificate try and find an exact match in the store */ 123 124 static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x) 125 { 126 STACK_OF(X509) *certs; 127 X509 *xtmp = NULL; 128 int i; 129 /* Lookup all certs with matching subject name */ 130 certs = ctx->lookup_certs(ctx, X509_get_subject_name(x)); 131 if (certs == NULL) 132 return NULL; 133 /* Look for exact match */ 134 for (i = 0; i < sk_X509_num(certs); i++) { 135 xtmp = sk_X509_value(certs, i); 136 if (!X509_cmp(xtmp, x)) 137 break; 138 } 139 if (i < sk_X509_num(certs)) 140 X509_up_ref(xtmp); 141 else 142 xtmp = NULL; 143 sk_X509_pop_free(certs, X509_free); 144 return xtmp; 145 } 146 147 /*- 148 * Inform the verify callback of an error. 149 * If B<x> is not NULL it is the error cert, otherwise use the chain cert at 150 * B<depth>. 151 * If B<err> is not X509_V_OK, that's the error value, otherwise leave 152 * unchanged (presumably set by the caller). 153 * 154 * Returns 0 to abort verification with an error, non-zero to continue. 155 */ 156 static int verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err) 157 { 158 ctx->error_depth = depth; 159 ctx->current_cert = (x != NULL) ? x : sk_X509_value(ctx->chain, depth); 160 if (err != X509_V_OK) 161 ctx->error = err; 162 return ctx->verify_cb(0, ctx); 163 } 164 165 /*- 166 * Inform the verify callback of an error, CRL-specific variant. Here, the 167 * error depth and certificate are already set, we just specify the error 168 * number. 169 * 170 * Returns 0 to abort verification with an error, non-zero to continue. 171 */ 172 static int verify_cb_crl(X509_STORE_CTX *ctx, int err) 173 { 174 ctx->error = err; 175 return ctx->verify_cb(0, ctx); 176 } 177 178 static int check_auth_level(X509_STORE_CTX *ctx) 179 { 180 int i; 181 int num = sk_X509_num(ctx->chain); 182 183 if (ctx->param->auth_level <= 0) 184 return 1; 185 186 for (i = 0; i < num; ++i) { 187 X509 *cert = sk_X509_value(ctx->chain, i); 188 189 /* 190 * We've already checked the security of the leaf key, so here we only 191 * check the security of issuer keys. 192 */ 193 if (i > 0 && !check_key_level(ctx, cert) && 194 verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_KEY_TOO_SMALL) == 0) 195 return 0; 196 /* 197 * We also check the signature algorithm security of all certificates 198 * except those of the trust anchor at index num-1. 199 */ 200 if (i < num - 1 && !check_sig_level(ctx, cert) && 201 verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_MD_TOO_WEAK) == 0) 202 return 0; 203 } 204 return 1; 205 } 206 207 static int verify_chain(X509_STORE_CTX *ctx) 208 { 209 int err; 210 int ok; 211 212 /* 213 * Before either returning with an error, or continuing with CRL checks, 214 * instantiate chain public key parameters. 215 */ 216 if ((ok = build_chain(ctx)) == 0 || 217 (ok = check_chain_extensions(ctx)) == 0 || 218 (ok = check_auth_level(ctx)) == 0 || 219 (ok = check_id(ctx)) == 0 || 1) 220 X509_get_pubkey_parameters(NULL, ctx->chain); 221 if (ok == 0 || (ok = ctx->check_revocation(ctx)) == 0) 222 return ok; 223 224 err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, 225 ctx->param->flags); 226 if (err != X509_V_OK) { 227 if ((ok = verify_cb_cert(ctx, NULL, ctx->error_depth, err)) == 0) 228 return ok; 229 } 230 231 /* Verify chain signatures and expiration times */ 232 ok = (ctx->verify != NULL) ? ctx->verify(ctx) : internal_verify(ctx); 233 if (!ok) 234 return ok; 235 236 if ((ok = check_name_constraints(ctx)) == 0) 237 return ok; 238 239 #ifndef OPENSSL_NO_RFC3779 240 /* RFC 3779 path validation, now that CRL check has been done */ 241 if ((ok = X509v3_asid_validate_path(ctx)) == 0) 242 return ok; 243 if ((ok = X509v3_addr_validate_path(ctx)) == 0) 244 return ok; 245 #endif 246 247 /* If we get this far evaluate policies */ 248 if (ctx->param->flags & X509_V_FLAG_POLICY_CHECK) 249 ok = ctx->check_policy(ctx); 250 return ok; 251 } 252 253 int X509_verify_cert(X509_STORE_CTX *ctx) 254 { 255 SSL_DANE *dane = ctx->dane; 256 int ret; 257 258 if (ctx->cert == NULL) { 259 X509err(X509_F_X509_VERIFY_CERT, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); 260 ctx->error = X509_V_ERR_INVALID_CALL; 261 return -1; 262 } 263 264 if (ctx->chain != NULL) { 265 /* 266 * This X509_STORE_CTX has already been used to verify a cert. We 267 * cannot do another one. 268 */ 269 X509err(X509_F_X509_VERIFY_CERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 270 ctx->error = X509_V_ERR_INVALID_CALL; 271 return -1; 272 } 273 274 /* 275 * first we make sure the chain we are going to build is present and that 276 * the first entry is in place 277 */ 278 if (((ctx->chain = sk_X509_new_null()) == NULL) || 279 (!sk_X509_push(ctx->chain, ctx->cert))) { 280 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 281 ctx->error = X509_V_ERR_OUT_OF_MEM; 282 return -1; 283 } 284 X509_up_ref(ctx->cert); 285 ctx->num_untrusted = 1; 286 287 /* If the peer's public key is too weak, we can stop early. */ 288 if (!check_key_level(ctx, ctx->cert) && 289 !verify_cb_cert(ctx, ctx->cert, 0, X509_V_ERR_EE_KEY_TOO_SMALL)) 290 return 0; 291 292 if (DANETLS_ENABLED(dane)) 293 ret = dane_verify(ctx); 294 else 295 ret = verify_chain(ctx); 296 297 /* 298 * Safety-net. If we are returning an error, we must also set ctx->error, 299 * so that the chain is not considered verified should the error be ignored 300 * (e.g. TLS with SSL_VERIFY_NONE). 301 */ 302 if (ret <= 0 && ctx->error == X509_V_OK) 303 ctx->error = X509_V_ERR_UNSPECIFIED; 304 return ret; 305 } 306 307 /* 308 * Given a STACK_OF(X509) find the issuer of cert (if any) 309 */ 310 static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) 311 { 312 int i; 313 X509 *issuer, *rv = NULL; 314 315 for (i = 0; i < sk_X509_num(sk); i++) { 316 issuer = sk_X509_value(sk, i); 317 if (ctx->check_issued(ctx, x, issuer)) { 318 rv = issuer; 319 if (x509_check_cert_time(ctx, rv, -1)) 320 break; 321 } 322 } 323 return rv; 324 } 325 326 /* Given a possible certificate and issuer check them */ 327 328 static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) 329 { 330 int ret; 331 if (x == issuer) 332 return cert_self_signed(x); 333 ret = X509_check_issued(issuer, x); 334 if (ret == X509_V_OK) { 335 int i; 336 X509 *ch; 337 /* Special case: single self signed certificate */ 338 if (cert_self_signed(x) && sk_X509_num(ctx->chain) == 1) 339 return 1; 340 for (i = 0; i < sk_X509_num(ctx->chain); i++) { 341 ch = sk_X509_value(ctx->chain, i); 342 if (ch == issuer || !X509_cmp(ch, issuer)) { 343 ret = X509_V_ERR_PATH_LOOP; 344 break; 345 } 346 } 347 } 348 349 return (ret == X509_V_OK); 350 } 351 352 /* Alternative lookup method: look from a STACK stored in other_ctx */ 353 354 static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) 355 { 356 *issuer = find_issuer(ctx, ctx->other_ctx, x); 357 if (*issuer) { 358 X509_up_ref(*issuer); 359 return 1; 360 } else 361 return 0; 362 } 363 364 static STACK_OF(X509) *lookup_certs_sk(X509_STORE_CTX *ctx, X509_NAME *nm) 365 { 366 STACK_OF(X509) *sk = NULL; 367 X509 *x; 368 int i; 369 370 for (i = 0; i < sk_X509_num(ctx->other_ctx); i++) { 371 x = sk_X509_value(ctx->other_ctx, i); 372 if (X509_NAME_cmp(nm, X509_get_subject_name(x)) == 0) { 373 if (sk == NULL) 374 sk = sk_X509_new_null(); 375 if (sk == NULL || sk_X509_push(sk, x) == 0) { 376 sk_X509_pop_free(sk, X509_free); 377 X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_MALLOC_FAILURE); 378 ctx->error = X509_V_ERR_OUT_OF_MEM; 379 return NULL; 380 } 381 X509_up_ref(x); 382 } 383 } 384 return sk; 385 } 386 387 /* 388 * Check EE or CA certificate purpose. For trusted certificates explicit local 389 * auxiliary trust can be used to override EKU-restrictions. 390 */ 391 static int check_purpose(X509_STORE_CTX *ctx, X509 *x, int purpose, int depth, 392 int must_be_ca) 393 { 394 int tr_ok = X509_TRUST_UNTRUSTED; 395 396 /* 397 * For trusted certificates we want to see whether any auxiliary trust 398 * settings trump the purpose constraints. 399 * 400 * This is complicated by the fact that the trust ordinals in 401 * ctx->param->trust are entirely independent of the purpose ordinals in 402 * ctx->param->purpose! 403 * 404 * What connects them is their mutual initialization via calls from 405 * X509_STORE_CTX_set_default() into X509_VERIFY_PARAM_lookup() which sets 406 * related values of both param->trust and param->purpose. It is however 407 * typically possible to infer associated trust values from a purpose value 408 * via the X509_PURPOSE API. 409 * 410 * Therefore, we can only check for trust overrides when the purpose we're 411 * checking is the same as ctx->param->purpose and ctx->param->trust is 412 * also set. 413 */ 414 if (depth >= ctx->num_untrusted && purpose == ctx->param->purpose) 415 tr_ok = X509_check_trust(x, ctx->param->trust, X509_TRUST_NO_SS_COMPAT); 416 417 switch (tr_ok) { 418 case X509_TRUST_TRUSTED: 419 return 1; 420 case X509_TRUST_REJECTED: 421 break; 422 default: 423 switch (X509_check_purpose(x, purpose, must_be_ca > 0)) { 424 case 1: 425 return 1; 426 case 0: 427 break; 428 default: 429 if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) == 0) 430 return 1; 431 } 432 break; 433 } 434 435 return verify_cb_cert(ctx, x, depth, X509_V_ERR_INVALID_PURPOSE); 436 } 437 438 /* 439 * Check a certificate chains extensions for consistency with the supplied 440 * purpose 441 */ 442 443 static int check_chain_extensions(X509_STORE_CTX *ctx) 444 { 445 int i, must_be_ca, plen = 0; 446 X509 *x; 447 int proxy_path_length = 0; 448 int purpose; 449 int allow_proxy_certs; 450 int num = sk_X509_num(ctx->chain); 451 452 /*- 453 * must_be_ca can have 1 of 3 values: 454 * -1: we accept both CA and non-CA certificates, to allow direct 455 * use of self-signed certificates (which are marked as CA). 456 * 0: we only accept non-CA certificates. This is currently not 457 * used, but the possibility is present for future extensions. 458 * 1: we only accept CA certificates. This is currently used for 459 * all certificates in the chain except the leaf certificate. 460 */ 461 must_be_ca = -1; 462 463 /* CRL path validation */ 464 if (ctx->parent) { 465 allow_proxy_certs = 0; 466 purpose = X509_PURPOSE_CRL_SIGN; 467 } else { 468 allow_proxy_certs = 469 ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS); 470 purpose = ctx->param->purpose; 471 } 472 473 for (i = 0; i < num; i++) { 474 int ret; 475 x = sk_X509_value(ctx->chain, i); 476 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) 477 && (x->ex_flags & EXFLAG_CRITICAL)) { 478 if (!verify_cb_cert(ctx, x, i, 479 X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION)) 480 return 0; 481 } 482 if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) { 483 if (!verify_cb_cert(ctx, x, i, 484 X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED)) 485 return 0; 486 } 487 ret = X509_check_ca(x); 488 switch (must_be_ca) { 489 case -1: 490 if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) 491 && (ret != 1) && (ret != 0)) { 492 ret = 0; 493 ctx->error = X509_V_ERR_INVALID_CA; 494 } else 495 ret = 1; 496 break; 497 case 0: 498 if (ret != 0) { 499 ret = 0; 500 ctx->error = X509_V_ERR_INVALID_NON_CA; 501 } else 502 ret = 1; 503 break; 504 default: 505 /* X509_V_FLAG_X509_STRICT is implicit for intermediate CAs */ 506 if ((ret == 0) 507 || ((i + 1 < num || ctx->param->flags & X509_V_FLAG_X509_STRICT) 508 && (ret != 1))) { 509 ret = 0; 510 ctx->error = X509_V_ERR_INVALID_CA; 511 } else 512 ret = 1; 513 break; 514 } 515 if (ret == 0 && !verify_cb_cert(ctx, x, i, X509_V_OK)) 516 return 0; 517 /* check_purpose() makes the callback as needed */ 518 if (purpose > 0 && !check_purpose(ctx, x, purpose, i, must_be_ca)) 519 return 0; 520 /* Check pathlen */ 521 if ((i > 1) && (x->ex_pathlen != -1) 522 && (plen > (x->ex_pathlen + proxy_path_length))) { 523 if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PATH_LENGTH_EXCEEDED)) 524 return 0; 525 } 526 /* Increment path length if not a self issued intermediate CA */ 527 if (i > 0 && (x->ex_flags & EXFLAG_SI) == 0) 528 plen++; 529 /* 530 * If this certificate is a proxy certificate, the next certificate 531 * must be another proxy certificate or a EE certificate. If not, 532 * the next certificate must be a CA certificate. 533 */ 534 if (x->ex_flags & EXFLAG_PROXY) { 535 /* 536 * RFC3820, 4.1.3 (b)(1) stipulates that if pCPathLengthConstraint 537 * is less than max_path_length, the former should be copied to 538 * the latter, and 4.1.4 (a) stipulates that max_path_length 539 * should be verified to be larger than zero and decrement it. 540 * 541 * Because we're checking the certs in the reverse order, we start 542 * with verifying that proxy_path_length isn't larger than pcPLC, 543 * and copy the latter to the former if it is, and finally, 544 * increment proxy_path_length. 545 */ 546 if (x->ex_pcpathlen != -1) { 547 if (proxy_path_length > x->ex_pcpathlen) { 548 if (!verify_cb_cert(ctx, x, i, 549 X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED)) 550 return 0; 551 } 552 proxy_path_length = x->ex_pcpathlen; 553 } 554 proxy_path_length++; 555 must_be_ca = 0; 556 } else 557 must_be_ca = 1; 558 } 559 return 1; 560 } 561 562 static int has_san_id(X509 *x, int gtype) 563 { 564 int i; 565 int ret = 0; 566 GENERAL_NAMES *gs = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL); 567 568 if (gs == NULL) 569 return 0; 570 571 for (i = 0; i < sk_GENERAL_NAME_num(gs); i++) { 572 GENERAL_NAME *g = sk_GENERAL_NAME_value(gs, i); 573 574 if (g->type == gtype) { 575 ret = 1; 576 break; 577 } 578 } 579 GENERAL_NAMES_free(gs); 580 return ret; 581 } 582 583 static int check_name_constraints(X509_STORE_CTX *ctx) 584 { 585 int i; 586 587 /* Check name constraints for all certificates */ 588 for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) { 589 X509 *x = sk_X509_value(ctx->chain, i); 590 int j; 591 592 /* Ignore self issued certs unless last in chain */ 593 if (i && (x->ex_flags & EXFLAG_SI)) 594 continue; 595 596 /* 597 * Proxy certificates policy has an extra constraint, where the 598 * certificate subject MUST be the issuer with a single CN entry 599 * added. 600 * (RFC 3820: 3.4, 4.1.3 (a)(4)) 601 */ 602 if (x->ex_flags & EXFLAG_PROXY) { 603 X509_NAME *tmpsubject = X509_get_subject_name(x); 604 X509_NAME *tmpissuer = X509_get_issuer_name(x); 605 X509_NAME_ENTRY *tmpentry = NULL; 606 int last_object_nid = 0; 607 int err = X509_V_OK; 608 int last_object_loc = X509_NAME_entry_count(tmpsubject) - 1; 609 610 /* Check that there are at least two RDNs */ 611 if (last_object_loc < 1) { 612 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 613 goto proxy_name_done; 614 } 615 616 /* 617 * Check that there is exactly one more RDN in subject as 618 * there is in issuer. 619 */ 620 if (X509_NAME_entry_count(tmpsubject) 621 != X509_NAME_entry_count(tmpissuer) + 1) { 622 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 623 goto proxy_name_done; 624 } 625 626 /* 627 * Check that the last subject component isn't part of a 628 * multivalued RDN 629 */ 630 if (X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject, 631 last_object_loc)) 632 == X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject, 633 last_object_loc - 1))) { 634 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 635 goto proxy_name_done; 636 } 637 638 /* 639 * Check that the last subject RDN is a commonName, and that 640 * all the previous RDNs match the issuer exactly 641 */ 642 tmpsubject = X509_NAME_dup(tmpsubject); 643 if (tmpsubject == NULL) { 644 X509err(X509_F_CHECK_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE); 645 ctx->error = X509_V_ERR_OUT_OF_MEM; 646 return 0; 647 } 648 649 tmpentry = 650 X509_NAME_delete_entry(tmpsubject, last_object_loc); 651 last_object_nid = 652 OBJ_obj2nid(X509_NAME_ENTRY_get_object(tmpentry)); 653 654 if (last_object_nid != NID_commonName 655 || X509_NAME_cmp(tmpsubject, tmpissuer) != 0) { 656 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 657 } 658 659 X509_NAME_ENTRY_free(tmpentry); 660 X509_NAME_free(tmpsubject); 661 662 proxy_name_done: 663 if (err != X509_V_OK 664 && !verify_cb_cert(ctx, x, i, err)) 665 return 0; 666 } 667 668 /* 669 * Check against constraints for all certificates higher in chain 670 * including trust anchor. Trust anchor not strictly speaking needed 671 * but if it includes constraints it is to be assumed it expects them 672 * to be obeyed. 673 */ 674 for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) { 675 NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc; 676 677 if (nc) { 678 int rv = NAME_CONSTRAINTS_check(x, nc); 679 680 /* If EE certificate check commonName too */ 681 if (rv == X509_V_OK && i == 0 682 && (ctx->param->hostflags 683 & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT) == 0 684 && ((ctx->param->hostflags 685 & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT) != 0 686 || !has_san_id(x, GEN_DNS))) 687 rv = NAME_CONSTRAINTS_check_CN(x, nc); 688 689 switch (rv) { 690 case X509_V_OK: 691 break; 692 case X509_V_ERR_OUT_OF_MEM: 693 return 0; 694 default: 695 if (!verify_cb_cert(ctx, x, i, rv)) 696 return 0; 697 break; 698 } 699 } 700 } 701 } 702 return 1; 703 } 704 705 static int check_id_error(X509_STORE_CTX *ctx, int errcode) 706 { 707 return verify_cb_cert(ctx, ctx->cert, 0, errcode); 708 } 709 710 static int check_hosts(X509 *x, X509_VERIFY_PARAM *vpm) 711 { 712 int i; 713 int n = sk_OPENSSL_STRING_num(vpm->hosts); 714 char *name; 715 716 if (vpm->peername != NULL) { 717 OPENSSL_free(vpm->peername); 718 vpm->peername = NULL; 719 } 720 for (i = 0; i < n; ++i) { 721 name = sk_OPENSSL_STRING_value(vpm->hosts, i); 722 if (X509_check_host(x, name, 0, vpm->hostflags, &vpm->peername) > 0) 723 return 1; 724 } 725 return n == 0; 726 } 727 728 static int check_id(X509_STORE_CTX *ctx) 729 { 730 X509_VERIFY_PARAM *vpm = ctx->param; 731 X509 *x = ctx->cert; 732 if (vpm->hosts && check_hosts(x, vpm) <= 0) { 733 if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH)) 734 return 0; 735 } 736 if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) { 737 if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH)) 738 return 0; 739 } 740 if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) { 741 if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH)) 742 return 0; 743 } 744 return 1; 745 } 746 747 static int check_trust(X509_STORE_CTX *ctx, int num_untrusted) 748 { 749 int i; 750 X509 *x = NULL; 751 X509 *mx; 752 SSL_DANE *dane = ctx->dane; 753 int num = sk_X509_num(ctx->chain); 754 int trust; 755 756 /* 757 * Check for a DANE issuer at depth 1 or greater, if it is a DANE-TA(2) 758 * match, we're done, otherwise we'll merely record the match depth. 759 */ 760 if (DANETLS_HAS_TA(dane) && num_untrusted > 0 && num_untrusted < num) { 761 switch (trust = check_dane_issuer(ctx, num_untrusted)) { 762 case X509_TRUST_TRUSTED: 763 case X509_TRUST_REJECTED: 764 return trust; 765 } 766 } 767 768 /* 769 * Check trusted certificates in chain at depth num_untrusted and up. 770 * Note, that depths 0..num_untrusted-1 may also contain trusted 771 * certificates, but the caller is expected to have already checked those, 772 * and wants to incrementally check just any added since. 773 */ 774 for (i = num_untrusted; i < num; i++) { 775 x = sk_X509_value(ctx->chain, i); 776 trust = X509_check_trust(x, ctx->param->trust, 0); 777 /* If explicitly trusted return trusted */ 778 if (trust == X509_TRUST_TRUSTED) 779 goto trusted; 780 if (trust == X509_TRUST_REJECTED) 781 goto rejected; 782 } 783 784 /* 785 * If we are looking at a trusted certificate, and accept partial chains, 786 * the chain is PKIX trusted. 787 */ 788 if (num_untrusted < num) { 789 if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) 790 goto trusted; 791 return X509_TRUST_UNTRUSTED; 792 } 793 794 if (num_untrusted == num && ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { 795 /* 796 * Last-resort call with no new trusted certificates, check the leaf 797 * for a direct trust store match. 798 */ 799 i = 0; 800 x = sk_X509_value(ctx->chain, i); 801 mx = lookup_cert_match(ctx, x); 802 if (!mx) 803 return X509_TRUST_UNTRUSTED; 804 805 /* 806 * Check explicit auxiliary trust/reject settings. If none are set, 807 * we'll accept X509_TRUST_UNTRUSTED when not self-signed. 808 */ 809 trust = X509_check_trust(mx, ctx->param->trust, 0); 810 if (trust == X509_TRUST_REJECTED) { 811 X509_free(mx); 812 goto rejected; 813 } 814 815 /* Replace leaf with trusted match */ 816 (void) sk_X509_set(ctx->chain, 0, mx); 817 X509_free(x); 818 ctx->num_untrusted = 0; 819 goto trusted; 820 } 821 822 /* 823 * If no trusted certs in chain at all return untrusted and allow 824 * standard (no issuer cert) etc errors to be indicated. 825 */ 826 return X509_TRUST_UNTRUSTED; 827 828 rejected: 829 if (!verify_cb_cert(ctx, x, i, X509_V_ERR_CERT_REJECTED)) 830 return X509_TRUST_REJECTED; 831 return X509_TRUST_UNTRUSTED; 832 833 trusted: 834 if (!DANETLS_ENABLED(dane)) 835 return X509_TRUST_TRUSTED; 836 if (dane->pdpth < 0) 837 dane->pdpth = num_untrusted; 838 /* With DANE, PKIX alone is not trusted until we have both */ 839 if (dane->mdpth >= 0) 840 return X509_TRUST_TRUSTED; 841 return X509_TRUST_UNTRUSTED; 842 } 843 844 static int check_revocation(X509_STORE_CTX *ctx) 845 { 846 int i = 0, last = 0, ok = 0; 847 if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK)) 848 return 1; 849 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) 850 last = sk_X509_num(ctx->chain) - 1; 851 else { 852 /* If checking CRL paths this isn't the EE certificate */ 853 if (ctx->parent) 854 return 1; 855 last = 0; 856 } 857 for (i = 0; i <= last; i++) { 858 ctx->error_depth = i; 859 ok = check_cert(ctx); 860 if (!ok) 861 return ok; 862 } 863 return 1; 864 } 865 866 static int check_cert(X509_STORE_CTX *ctx) 867 { 868 X509_CRL *crl = NULL, *dcrl = NULL; 869 int ok = 0; 870 int cnum = ctx->error_depth; 871 X509 *x = sk_X509_value(ctx->chain, cnum); 872 873 ctx->current_cert = x; 874 ctx->current_issuer = NULL; 875 ctx->current_crl_score = 0; 876 ctx->current_reasons = 0; 877 878 if (x->ex_flags & EXFLAG_PROXY) 879 return 1; 880 881 while (ctx->current_reasons != CRLDP_ALL_REASONS) { 882 unsigned int last_reasons = ctx->current_reasons; 883 884 /* Try to retrieve relevant CRL */ 885 if (ctx->get_crl) 886 ok = ctx->get_crl(ctx, &crl, x); 887 else 888 ok = get_crl_delta(ctx, &crl, &dcrl, x); 889 /* 890 * If error looking up CRL, nothing we can do except notify callback 891 */ 892 if (!ok) { 893 ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL); 894 goto done; 895 } 896 ctx->current_crl = crl; 897 ok = ctx->check_crl(ctx, crl); 898 if (!ok) 899 goto done; 900 901 if (dcrl) { 902 ok = ctx->check_crl(ctx, dcrl); 903 if (!ok) 904 goto done; 905 ok = ctx->cert_crl(ctx, dcrl, x); 906 if (!ok) 907 goto done; 908 } else 909 ok = 1; 910 911 /* Don't look in full CRL if delta reason is removefromCRL */ 912 if (ok != 2) { 913 ok = ctx->cert_crl(ctx, crl, x); 914 if (!ok) 915 goto done; 916 } 917 918 X509_CRL_free(crl); 919 X509_CRL_free(dcrl); 920 crl = NULL; 921 dcrl = NULL; 922 /* 923 * If reasons not updated we won't get anywhere by another iteration, 924 * so exit loop. 925 */ 926 if (last_reasons == ctx->current_reasons) { 927 ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL); 928 goto done; 929 } 930 } 931 done: 932 X509_CRL_free(crl); 933 X509_CRL_free(dcrl); 934 935 ctx->current_crl = NULL; 936 return ok; 937 } 938 939 /* Check CRL times against values in X509_STORE_CTX */ 940 941 static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) 942 { 943 time_t *ptime; 944 int i; 945 946 if (notify) 947 ctx->current_crl = crl; 948 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) 949 ptime = &ctx->param->check_time; 950 else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) 951 return 1; 952 else 953 ptime = NULL; 954 955 i = X509_cmp_time(X509_CRL_get0_lastUpdate(crl), ptime); 956 if (i == 0) { 957 if (!notify) 958 return 0; 959 if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD)) 960 return 0; 961 } 962 963 if (i > 0) { 964 if (!notify) 965 return 0; 966 if (!verify_cb_crl(ctx, X509_V_ERR_CRL_NOT_YET_VALID)) 967 return 0; 968 } 969 970 if (X509_CRL_get0_nextUpdate(crl)) { 971 i = X509_cmp_time(X509_CRL_get0_nextUpdate(crl), ptime); 972 973 if (i == 0) { 974 if (!notify) 975 return 0; 976 if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD)) 977 return 0; 978 } 979 /* Ignore expiry of base CRL is delta is valid */ 980 if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) { 981 if (!notify) 982 return 0; 983 if (!verify_cb_crl(ctx, X509_V_ERR_CRL_HAS_EXPIRED)) 984 return 0; 985 } 986 } 987 988 if (notify) 989 ctx->current_crl = NULL; 990 991 return 1; 992 } 993 994 static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, 995 X509 **pissuer, int *pscore, unsigned int *preasons, 996 STACK_OF(X509_CRL) *crls) 997 { 998 int i, crl_score, best_score = *pscore; 999 unsigned int reasons, best_reasons = 0; 1000 X509 *x = ctx->current_cert; 1001 X509_CRL *crl, *best_crl = NULL; 1002 X509 *crl_issuer = NULL, *best_crl_issuer = NULL; 1003 1004 for (i = 0; i < sk_X509_CRL_num(crls); i++) { 1005 crl = sk_X509_CRL_value(crls, i); 1006 reasons = *preasons; 1007 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x); 1008 if (crl_score < best_score || crl_score == 0) 1009 continue; 1010 /* If current CRL is equivalent use it if it is newer */ 1011 if (crl_score == best_score && best_crl != NULL) { 1012 int day, sec; 1013 if (ASN1_TIME_diff(&day, &sec, X509_CRL_get0_lastUpdate(best_crl), 1014 X509_CRL_get0_lastUpdate(crl)) == 0) 1015 continue; 1016 /* 1017 * ASN1_TIME_diff never returns inconsistent signs for |day| 1018 * and |sec|. 1019 */ 1020 if (day <= 0 && sec <= 0) 1021 continue; 1022 } 1023 best_crl = crl; 1024 best_crl_issuer = crl_issuer; 1025 best_score = crl_score; 1026 best_reasons = reasons; 1027 } 1028 1029 if (best_crl) { 1030 X509_CRL_free(*pcrl); 1031 *pcrl = best_crl; 1032 *pissuer = best_crl_issuer; 1033 *pscore = best_score; 1034 *preasons = best_reasons; 1035 X509_CRL_up_ref(best_crl); 1036 X509_CRL_free(*pdcrl); 1037 *pdcrl = NULL; 1038 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls); 1039 } 1040 1041 if (best_score >= CRL_SCORE_VALID) 1042 return 1; 1043 1044 return 0; 1045 } 1046 1047 /* 1048 * Compare two CRL extensions for delta checking purposes. They should be 1049 * both present or both absent. If both present all fields must be identical. 1050 */ 1051 1052 static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) 1053 { 1054 ASN1_OCTET_STRING *exta, *extb; 1055 int i; 1056 i = X509_CRL_get_ext_by_NID(a, nid, -1); 1057 if (i >= 0) { 1058 /* Can't have multiple occurrences */ 1059 if (X509_CRL_get_ext_by_NID(a, nid, i) != -1) 1060 return 0; 1061 exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i)); 1062 } else 1063 exta = NULL; 1064 1065 i = X509_CRL_get_ext_by_NID(b, nid, -1); 1066 1067 if (i >= 0) { 1068 1069 if (X509_CRL_get_ext_by_NID(b, nid, i) != -1) 1070 return 0; 1071 extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i)); 1072 } else 1073 extb = NULL; 1074 1075 if (!exta && !extb) 1076 return 1; 1077 1078 if (!exta || !extb) 1079 return 0; 1080 1081 if (ASN1_OCTET_STRING_cmp(exta, extb)) 1082 return 0; 1083 1084 return 1; 1085 } 1086 1087 /* See if a base and delta are compatible */ 1088 1089 static int check_delta_base(X509_CRL *delta, X509_CRL *base) 1090 { 1091 /* Delta CRL must be a delta */ 1092 if (!delta->base_crl_number) 1093 return 0; 1094 /* Base must have a CRL number */ 1095 if (!base->crl_number) 1096 return 0; 1097 /* Issuer names must match */ 1098 if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(delta))) 1099 return 0; 1100 /* AKID and IDP must match */ 1101 if (!crl_extension_match(delta, base, NID_authority_key_identifier)) 1102 return 0; 1103 if (!crl_extension_match(delta, base, NID_issuing_distribution_point)) 1104 return 0; 1105 /* Delta CRL base number must not exceed Full CRL number. */ 1106 if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0) 1107 return 0; 1108 /* Delta CRL number must exceed full CRL number */ 1109 if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0) 1110 return 1; 1111 return 0; 1112 } 1113 1114 /* 1115 * For a given base CRL find a delta... maybe extend to delta scoring or 1116 * retrieve a chain of deltas... 1117 */ 1118 1119 static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, 1120 X509_CRL *base, STACK_OF(X509_CRL) *crls) 1121 { 1122 X509_CRL *delta; 1123 int i; 1124 if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS)) 1125 return; 1126 if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST)) 1127 return; 1128 for (i = 0; i < sk_X509_CRL_num(crls); i++) { 1129 delta = sk_X509_CRL_value(crls, i); 1130 if (check_delta_base(delta, base)) { 1131 if (check_crl_time(ctx, delta, 0)) 1132 *pscore |= CRL_SCORE_TIME_DELTA; 1133 X509_CRL_up_ref(delta); 1134 *dcrl = delta; 1135 return; 1136 } 1137 } 1138 *dcrl = NULL; 1139 } 1140 1141 /* 1142 * For a given CRL return how suitable it is for the supplied certificate 1143 * 'x'. The return value is a mask of several criteria. If the issuer is not 1144 * the certificate issuer this is returned in *pissuer. The reasons mask is 1145 * also used to determine if the CRL is suitable: if no new reasons the CRL 1146 * is rejected, otherwise reasons is updated. 1147 */ 1148 1149 static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, 1150 unsigned int *preasons, X509_CRL *crl, X509 *x) 1151 { 1152 1153 int crl_score = 0; 1154 unsigned int tmp_reasons = *preasons, crl_reasons; 1155 1156 /* First see if we can reject CRL straight away */ 1157 1158 /* Invalid IDP cannot be processed */ 1159 if (crl->idp_flags & IDP_INVALID) 1160 return 0; 1161 /* Reason codes or indirect CRLs need extended CRL support */ 1162 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) { 1163 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS)) 1164 return 0; 1165 } else if (crl->idp_flags & IDP_REASONS) { 1166 /* If no new reasons reject */ 1167 if (!(crl->idp_reasons & ~tmp_reasons)) 1168 return 0; 1169 } 1170 /* Don't process deltas at this stage */ 1171 else if (crl->base_crl_number) 1172 return 0; 1173 /* If issuer name doesn't match certificate need indirect CRL */ 1174 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) { 1175 if (!(crl->idp_flags & IDP_INDIRECT)) 1176 return 0; 1177 } else 1178 crl_score |= CRL_SCORE_ISSUER_NAME; 1179 1180 if (!(crl->flags & EXFLAG_CRITICAL)) 1181 crl_score |= CRL_SCORE_NOCRITICAL; 1182 1183 /* Check expiry */ 1184 if (check_crl_time(ctx, crl, 0)) 1185 crl_score |= CRL_SCORE_TIME; 1186 1187 /* Check authority key ID and locate certificate issuer */ 1188 crl_akid_check(ctx, crl, pissuer, &crl_score); 1189 1190 /* If we can't locate certificate issuer at this point forget it */ 1191 1192 if (!(crl_score & CRL_SCORE_AKID)) 1193 return 0; 1194 1195 /* Check cert for matching CRL distribution points */ 1196 1197 if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) { 1198 /* If no new reasons reject */ 1199 if (!(crl_reasons & ~tmp_reasons)) 1200 return 0; 1201 tmp_reasons |= crl_reasons; 1202 crl_score |= CRL_SCORE_SCOPE; 1203 } 1204 1205 *preasons = tmp_reasons; 1206 1207 return crl_score; 1208 1209 } 1210 1211 static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, 1212 X509 **pissuer, int *pcrl_score) 1213 { 1214 X509 *crl_issuer = NULL; 1215 X509_NAME *cnm = X509_CRL_get_issuer(crl); 1216 int cidx = ctx->error_depth; 1217 int i; 1218 1219 if (cidx != sk_X509_num(ctx->chain) - 1) 1220 cidx++; 1221 1222 crl_issuer = sk_X509_value(ctx->chain, cidx); 1223 1224 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1225 if (*pcrl_score & CRL_SCORE_ISSUER_NAME) { 1226 *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_ISSUER_CERT; 1227 *pissuer = crl_issuer; 1228 return; 1229 } 1230 } 1231 1232 for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) { 1233 crl_issuer = sk_X509_value(ctx->chain, cidx); 1234 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) 1235 continue; 1236 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1237 *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_SAME_PATH; 1238 *pissuer = crl_issuer; 1239 return; 1240 } 1241 } 1242 1243 /* Anything else needs extended CRL support */ 1244 1245 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) 1246 return; 1247 1248 /* 1249 * Otherwise the CRL issuer is not on the path. Look for it in the set of 1250 * untrusted certificates. 1251 */ 1252 for (i = 0; i < sk_X509_num(ctx->untrusted); i++) { 1253 crl_issuer = sk_X509_value(ctx->untrusted, i); 1254 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) 1255 continue; 1256 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1257 *pissuer = crl_issuer; 1258 *pcrl_score |= CRL_SCORE_AKID; 1259 return; 1260 } 1261 } 1262 } 1263 1264 /* 1265 * Check the path of a CRL issuer certificate. This creates a new 1266 * X509_STORE_CTX and populates it with most of the parameters from the 1267 * parent. This could be optimised somewhat since a lot of path checking will 1268 * be duplicated by the parent, but this will rarely be used in practice. 1269 */ 1270 1271 static int check_crl_path(X509_STORE_CTX *ctx, X509 *x) 1272 { 1273 X509_STORE_CTX crl_ctx; 1274 int ret; 1275 1276 /* Don't allow recursive CRL path validation */ 1277 if (ctx->parent) 1278 return 0; 1279 if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted)) 1280 return -1; 1281 1282 crl_ctx.crls = ctx->crls; 1283 /* Copy verify params across */ 1284 X509_STORE_CTX_set0_param(&crl_ctx, ctx->param); 1285 1286 crl_ctx.parent = ctx; 1287 crl_ctx.verify_cb = ctx->verify_cb; 1288 1289 /* Verify CRL issuer */ 1290 ret = X509_verify_cert(&crl_ctx); 1291 if (ret <= 0) 1292 goto err; 1293 1294 /* Check chain is acceptable */ 1295 ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain); 1296 err: 1297 X509_STORE_CTX_cleanup(&crl_ctx); 1298 return ret; 1299 } 1300 1301 /* 1302 * RFC3280 says nothing about the relationship between CRL path and 1303 * certificate path, which could lead to situations where a certificate could 1304 * be revoked or validated by a CA not authorised to do so. RFC5280 is more 1305 * strict and states that the two paths must end in the same trust anchor, 1306 * though some discussions remain... until this is resolved we use the 1307 * RFC5280 version 1308 */ 1309 1310 static int check_crl_chain(X509_STORE_CTX *ctx, 1311 STACK_OF(X509) *cert_path, 1312 STACK_OF(X509) *crl_path) 1313 { 1314 X509 *cert_ta, *crl_ta; 1315 cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1); 1316 crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1); 1317 if (!X509_cmp(cert_ta, crl_ta)) 1318 return 1; 1319 return 0; 1320 } 1321 1322 /*- 1323 * Check for match between two dist point names: three separate cases. 1324 * 1. Both are relative names and compare X509_NAME types. 1325 * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES. 1326 * 3. Both are full names and compare two GENERAL_NAMES. 1327 * 4. One is NULL: automatic match. 1328 */ 1329 1330 static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b) 1331 { 1332 X509_NAME *nm = NULL; 1333 GENERAL_NAMES *gens = NULL; 1334 GENERAL_NAME *gena, *genb; 1335 int i, j; 1336 if (!a || !b) 1337 return 1; 1338 if (a->type == 1) { 1339 if (!a->dpname) 1340 return 0; 1341 /* Case 1: two X509_NAME */ 1342 if (b->type == 1) { 1343 if (!b->dpname) 1344 return 0; 1345 if (!X509_NAME_cmp(a->dpname, b->dpname)) 1346 return 1; 1347 else 1348 return 0; 1349 } 1350 /* Case 2: set name and GENERAL_NAMES appropriately */ 1351 nm = a->dpname; 1352 gens = b->name.fullname; 1353 } else if (b->type == 1) { 1354 if (!b->dpname) 1355 return 0; 1356 /* Case 2: set name and GENERAL_NAMES appropriately */ 1357 gens = a->name.fullname; 1358 nm = b->dpname; 1359 } 1360 1361 /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */ 1362 if (nm) { 1363 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { 1364 gena = sk_GENERAL_NAME_value(gens, i); 1365 if (gena->type != GEN_DIRNAME) 1366 continue; 1367 if (!X509_NAME_cmp(nm, gena->d.directoryName)) 1368 return 1; 1369 } 1370 return 0; 1371 } 1372 1373 /* Else case 3: two GENERAL_NAMES */ 1374 1375 for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) { 1376 gena = sk_GENERAL_NAME_value(a->name.fullname, i); 1377 for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) { 1378 genb = sk_GENERAL_NAME_value(b->name.fullname, j); 1379 if (!GENERAL_NAME_cmp(gena, genb)) 1380 return 1; 1381 } 1382 } 1383 1384 return 0; 1385 1386 } 1387 1388 static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score) 1389 { 1390 int i; 1391 X509_NAME *nm = X509_CRL_get_issuer(crl); 1392 /* If no CRLissuer return is successful iff don't need a match */ 1393 if (!dp->CRLissuer) 1394 return ! !(crl_score & CRL_SCORE_ISSUER_NAME); 1395 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) { 1396 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i); 1397 if (gen->type != GEN_DIRNAME) 1398 continue; 1399 if (!X509_NAME_cmp(gen->d.directoryName, nm)) 1400 return 1; 1401 } 1402 return 0; 1403 } 1404 1405 /* Check CRLDP and IDP */ 1406 1407 static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, 1408 unsigned int *preasons) 1409 { 1410 int i; 1411 if (crl->idp_flags & IDP_ONLYATTR) 1412 return 0; 1413 if (x->ex_flags & EXFLAG_CA) { 1414 if (crl->idp_flags & IDP_ONLYUSER) 1415 return 0; 1416 } else { 1417 if (crl->idp_flags & IDP_ONLYCA) 1418 return 0; 1419 } 1420 *preasons = crl->idp_reasons; 1421 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) { 1422 DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i); 1423 if (crldp_check_crlissuer(dp, crl, crl_score)) { 1424 if (!crl->idp || idp_check_dp(dp->distpoint, crl->idp->distpoint)) { 1425 *preasons &= dp->dp_reasons; 1426 return 1; 1427 } 1428 } 1429 } 1430 if ((!crl->idp || !crl->idp->distpoint) 1431 && (crl_score & CRL_SCORE_ISSUER_NAME)) 1432 return 1; 1433 return 0; 1434 } 1435 1436 /* 1437 * Retrieve CRL corresponding to current certificate. If deltas enabled try 1438 * to find a delta CRL too 1439 */ 1440 1441 static int get_crl_delta(X509_STORE_CTX *ctx, 1442 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x) 1443 { 1444 int ok; 1445 X509 *issuer = NULL; 1446 int crl_score = 0; 1447 unsigned int reasons; 1448 X509_CRL *crl = NULL, *dcrl = NULL; 1449 STACK_OF(X509_CRL) *skcrl; 1450 X509_NAME *nm = X509_get_issuer_name(x); 1451 1452 reasons = ctx->current_reasons; 1453 ok = get_crl_sk(ctx, &crl, &dcrl, 1454 &issuer, &crl_score, &reasons, ctx->crls); 1455 if (ok) 1456 goto done; 1457 1458 /* Lookup CRLs from store */ 1459 1460 skcrl = ctx->lookup_crls(ctx, nm); 1461 1462 /* If no CRLs found and a near match from get_crl_sk use that */ 1463 if (!skcrl && crl) 1464 goto done; 1465 1466 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl); 1467 1468 sk_X509_CRL_pop_free(skcrl, X509_CRL_free); 1469 1470 done: 1471 /* If we got any kind of CRL use it and return success */ 1472 if (crl) { 1473 ctx->current_issuer = issuer; 1474 ctx->current_crl_score = crl_score; 1475 ctx->current_reasons = reasons; 1476 *pcrl = crl; 1477 *pdcrl = dcrl; 1478 return 1; 1479 } 1480 return 0; 1481 } 1482 1483 /* Check CRL validity */ 1484 static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) 1485 { 1486 X509 *issuer = NULL; 1487 EVP_PKEY *ikey = NULL; 1488 int cnum = ctx->error_depth; 1489 int chnum = sk_X509_num(ctx->chain) - 1; 1490 1491 /* if we have an alternative CRL issuer cert use that */ 1492 if (ctx->current_issuer) 1493 issuer = ctx->current_issuer; 1494 /* 1495 * Else find CRL issuer: if not last certificate then issuer is next 1496 * certificate in chain. 1497 */ 1498 else if (cnum < chnum) 1499 issuer = sk_X509_value(ctx->chain, cnum + 1); 1500 else { 1501 issuer = sk_X509_value(ctx->chain, chnum); 1502 /* If not self signed, can't check signature */ 1503 if (!ctx->check_issued(ctx, issuer, issuer) && 1504 !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER)) 1505 return 0; 1506 } 1507 1508 if (issuer == NULL) 1509 return 1; 1510 1511 /* 1512 * Skip most tests for deltas because they have already been done 1513 */ 1514 if (!crl->base_crl_number) { 1515 /* Check for cRLSign bit if keyUsage present */ 1516 if ((issuer->ex_flags & EXFLAG_KUSAGE) && 1517 !(issuer->ex_kusage & KU_CRL_SIGN) && 1518 !verify_cb_crl(ctx, X509_V_ERR_KEYUSAGE_NO_CRL_SIGN)) 1519 return 0; 1520 1521 if (!(ctx->current_crl_score & CRL_SCORE_SCOPE) && 1522 !verify_cb_crl(ctx, X509_V_ERR_DIFFERENT_CRL_SCOPE)) 1523 return 0; 1524 1525 if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH) && 1526 check_crl_path(ctx, ctx->current_issuer) <= 0 && 1527 !verify_cb_crl(ctx, X509_V_ERR_CRL_PATH_VALIDATION_ERROR)) 1528 return 0; 1529 1530 if ((crl->idp_flags & IDP_INVALID) && 1531 !verify_cb_crl(ctx, X509_V_ERR_INVALID_EXTENSION)) 1532 return 0; 1533 } 1534 1535 if (!(ctx->current_crl_score & CRL_SCORE_TIME) && 1536 !check_crl_time(ctx, crl, 1)) 1537 return 0; 1538 1539 /* Attempt to get issuer certificate public key */ 1540 ikey = X509_get0_pubkey(issuer); 1541 1542 if (!ikey && 1543 !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY)) 1544 return 0; 1545 1546 if (ikey) { 1547 int rv = X509_CRL_check_suiteb(crl, ikey, ctx->param->flags); 1548 1549 if (rv != X509_V_OK && !verify_cb_crl(ctx, rv)) 1550 return 0; 1551 /* Verify CRL signature */ 1552 if (X509_CRL_verify(crl, ikey) <= 0 && 1553 !verify_cb_crl(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE)) 1554 return 0; 1555 } 1556 return 1; 1557 } 1558 1559 /* Check certificate against CRL */ 1560 static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) 1561 { 1562 X509_REVOKED *rev; 1563 1564 /* 1565 * The rules changed for this... previously if a CRL contained unhandled 1566 * critical extensions it could still be used to indicate a certificate 1567 * was revoked. This has since been changed since critical extensions can 1568 * change the meaning of CRL entries. 1569 */ 1570 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) 1571 && (crl->flags & EXFLAG_CRITICAL) && 1572 !verify_cb_crl(ctx, X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION)) 1573 return 0; 1574 /* 1575 * Look for serial number of certificate in CRL. If found, make sure 1576 * reason is not removeFromCRL. 1577 */ 1578 if (X509_CRL_get0_by_cert(crl, &rev, x)) { 1579 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) 1580 return 2; 1581 if (!verify_cb_crl(ctx, X509_V_ERR_CERT_REVOKED)) 1582 return 0; 1583 } 1584 1585 return 1; 1586 } 1587 1588 static int check_policy(X509_STORE_CTX *ctx) 1589 { 1590 int ret; 1591 1592 if (ctx->parent) 1593 return 1; 1594 /* 1595 * With DANE, the trust anchor might be a bare public key, not a 1596 * certificate! In that case our chain does not have the trust anchor 1597 * certificate as a top-most element. This comports well with RFC5280 1598 * chain verification, since there too, the trust anchor is not part of the 1599 * chain to be verified. In particular, X509_policy_check() does not look 1600 * at the TA cert, but assumes that it is present as the top-most chain 1601 * element. We therefore temporarily push a NULL cert onto the chain if it 1602 * was verified via a bare public key, and pop it off right after the 1603 * X509_policy_check() call. 1604 */ 1605 if (ctx->bare_ta_signed && !sk_X509_push(ctx->chain, NULL)) { 1606 X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); 1607 ctx->error = X509_V_ERR_OUT_OF_MEM; 1608 return 0; 1609 } 1610 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, 1611 ctx->param->policies, ctx->param->flags); 1612 if (ctx->bare_ta_signed) 1613 sk_X509_pop(ctx->chain); 1614 1615 if (ret == X509_PCY_TREE_INTERNAL) { 1616 X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); 1617 ctx->error = X509_V_ERR_OUT_OF_MEM; 1618 return 0; 1619 } 1620 /* Invalid or inconsistent extensions */ 1621 if (ret == X509_PCY_TREE_INVALID) { 1622 int i; 1623 1624 /* Locate certificates with bad extensions and notify callback. */ 1625 for (i = 1; i < sk_X509_num(ctx->chain); i++) { 1626 X509 *x = sk_X509_value(ctx->chain, i); 1627 1628 if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) 1629 continue; 1630 if (!verify_cb_cert(ctx, x, i, 1631 X509_V_ERR_INVALID_POLICY_EXTENSION)) 1632 return 0; 1633 } 1634 return 1; 1635 } 1636 if (ret == X509_PCY_TREE_FAILURE) { 1637 ctx->current_cert = NULL; 1638 ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY; 1639 return ctx->verify_cb(0, ctx); 1640 } 1641 if (ret != X509_PCY_TREE_VALID) { 1642 X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR); 1643 return 0; 1644 } 1645 1646 if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) { 1647 ctx->current_cert = NULL; 1648 /* 1649 * Verification errors need to be "sticky", a callback may have allowed 1650 * an SSL handshake to continue despite an error, and we must then 1651 * remain in an error state. Therefore, we MUST NOT clear earlier 1652 * verification errors by setting the error to X509_V_OK. 1653 */ 1654 if (!ctx->verify_cb(2, ctx)) 1655 return 0; 1656 } 1657 1658 return 1; 1659 } 1660 1661 /*- 1662 * Check certificate validity times. 1663 * If depth >= 0, invoke verification callbacks on error, otherwise just return 1664 * the validation status. 1665 * 1666 * Return 1 on success, 0 otherwise. 1667 */ 1668 int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth) 1669 { 1670 time_t *ptime; 1671 int i; 1672 1673 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) 1674 ptime = &ctx->param->check_time; 1675 else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) 1676 return 1; 1677 else 1678 ptime = NULL; 1679 1680 i = X509_cmp_time(X509_get0_notBefore(x), ptime); 1681 if (i >= 0 && depth < 0) 1682 return 0; 1683 if (i == 0 && !verify_cb_cert(ctx, x, depth, 1684 X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD)) 1685 return 0; 1686 if (i > 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_NOT_YET_VALID)) 1687 return 0; 1688 1689 i = X509_cmp_time(X509_get0_notAfter(x), ptime); 1690 if (i <= 0 && depth < 0) 1691 return 0; 1692 if (i == 0 && !verify_cb_cert(ctx, x, depth, 1693 X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD)) 1694 return 0; 1695 if (i < 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_HAS_EXPIRED)) 1696 return 0; 1697 return 1; 1698 } 1699 1700 static int internal_verify(X509_STORE_CTX *ctx) 1701 { 1702 int n = sk_X509_num(ctx->chain) - 1; 1703 X509 *xi = sk_X509_value(ctx->chain, n); 1704 X509 *xs; 1705 1706 /* 1707 * With DANE-verified bare public key TA signatures, it remains only to 1708 * check the timestamps of the top certificate. We report the issuer as 1709 * NULL, since all we have is a bare key. 1710 */ 1711 if (ctx->bare_ta_signed) { 1712 xs = xi; 1713 xi = NULL; 1714 goto check_cert; 1715 } 1716 1717 if (ctx->check_issued(ctx, xi, xi)) 1718 xs = xi; 1719 else { 1720 if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { 1721 xs = xi; 1722 goto check_cert; 1723 } 1724 if (n <= 0) 1725 return verify_cb_cert(ctx, xi, 0, 1726 X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE); 1727 n--; 1728 ctx->error_depth = n; 1729 xs = sk_X509_value(ctx->chain, n); 1730 } 1731 1732 /* 1733 * Do not clear ctx->error=0, it must be "sticky", only the user's callback 1734 * is allowed to reset errors (at its own peril). 1735 */ 1736 while (n >= 0) { 1737 EVP_PKEY *pkey; 1738 1739 /* 1740 * Skip signature check for self signed certificates unless explicitly 1741 * asked for. It doesn't add any security and just wastes time. If 1742 * the issuer's public key is unusable, report the issuer certificate 1743 * and its depth (rather than the depth of the subject). 1744 */ 1745 if (xs != xi || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)) { 1746 if ((pkey = X509_get0_pubkey(xi)) == NULL) { 1747 if (!verify_cb_cert(ctx, xi, xi != xs ? n+1 : n, 1748 X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY)) 1749 return 0; 1750 } else if (X509_verify(xs, pkey) <= 0) { 1751 if (!verify_cb_cert(ctx, xs, n, 1752 X509_V_ERR_CERT_SIGNATURE_FAILURE)) 1753 return 0; 1754 } 1755 } 1756 1757 check_cert: 1758 /* Calls verify callback as needed */ 1759 if (!x509_check_cert_time(ctx, xs, n)) 1760 return 0; 1761 1762 /* 1763 * Signal success at this depth. However, the previous error (if any) 1764 * is retained. 1765 */ 1766 ctx->current_issuer = xi; 1767 ctx->current_cert = xs; 1768 ctx->error_depth = n; 1769 if (!ctx->verify_cb(1, ctx)) 1770 return 0; 1771 1772 if (--n >= 0) { 1773 xi = xs; 1774 xs = sk_X509_value(ctx->chain, n); 1775 } 1776 } 1777 return 1; 1778 } 1779 1780 int X509_cmp_current_time(const ASN1_TIME *ctm) 1781 { 1782 return X509_cmp_time(ctm, NULL); 1783 } 1784 1785 int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) 1786 { 1787 static const size_t utctime_length = sizeof("YYMMDDHHMMSSZ") - 1; 1788 static const size_t generalizedtime_length = sizeof("YYYYMMDDHHMMSSZ") - 1; 1789 ASN1_TIME *asn1_cmp_time = NULL; 1790 int i, day, sec, ret = 0; 1791 1792 /* 1793 * Note that ASN.1 allows much more slack in the time format than RFC5280. 1794 * In RFC5280, the representation is fixed: 1795 * UTCTime: YYMMDDHHMMSSZ 1796 * GeneralizedTime: YYYYMMDDHHMMSSZ 1797 * 1798 * We do NOT currently enforce the following RFC 5280 requirement: 1799 * "CAs conforming to this profile MUST always encode certificate 1800 * validity dates through the year 2049 as UTCTime; certificate validity 1801 * dates in 2050 or later MUST be encoded as GeneralizedTime." 1802 */ 1803 switch (ctm->type) { 1804 case V_ASN1_UTCTIME: 1805 if (ctm->length != (int)(utctime_length)) 1806 return 0; 1807 break; 1808 case V_ASN1_GENERALIZEDTIME: 1809 if (ctm->length != (int)(generalizedtime_length)) 1810 return 0; 1811 break; 1812 default: 1813 return 0; 1814 } 1815 1816 /** 1817 * Verify the format: the ASN.1 functions we use below allow a more 1818 * flexible format than what's mandated by RFC 5280. 1819 * Digit and date ranges will be verified in the conversion methods. 1820 */ 1821 for (i = 0; i < ctm->length - 1; i++) { 1822 if (!ossl_isdigit(ctm->data[i])) 1823 return 0; 1824 } 1825 if (ctm->data[ctm->length - 1] != 'Z') 1826 return 0; 1827 1828 /* 1829 * There is ASN1_UTCTIME_cmp_time_t but no 1830 * ASN1_GENERALIZEDTIME_cmp_time_t or ASN1_TIME_cmp_time_t, 1831 * so we go through ASN.1 1832 */ 1833 asn1_cmp_time = X509_time_adj(NULL, 0, cmp_time); 1834 if (asn1_cmp_time == NULL) 1835 goto err; 1836 if (!ASN1_TIME_diff(&day, &sec, ctm, asn1_cmp_time)) 1837 goto err; 1838 1839 /* 1840 * X509_cmp_time comparison is <=. 1841 * The return value 0 is reserved for errors. 1842 */ 1843 ret = (day >= 0 && sec >= 0) ? -1 : 1; 1844 1845 err: 1846 ASN1_TIME_free(asn1_cmp_time); 1847 return ret; 1848 } 1849 1850 ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj) 1851 { 1852 return X509_time_adj(s, adj, NULL); 1853 } 1854 1855 ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm) 1856 { 1857 return X509_time_adj_ex(s, 0, offset_sec, in_tm); 1858 } 1859 1860 ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, 1861 int offset_day, long offset_sec, time_t *in_tm) 1862 { 1863 time_t t; 1864 1865 if (in_tm) 1866 t = *in_tm; 1867 else 1868 time(&t); 1869 1870 if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) { 1871 if (s->type == V_ASN1_UTCTIME) 1872 return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec); 1873 if (s->type == V_ASN1_GENERALIZEDTIME) 1874 return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec); 1875 } 1876 return ASN1_TIME_adj(s, t, offset_day, offset_sec); 1877 } 1878 1879 int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) 1880 { 1881 EVP_PKEY *ktmp = NULL, *ktmp2; 1882 int i, j; 1883 1884 if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey)) 1885 return 1; 1886 1887 for (i = 0; i < sk_X509_num(chain); i++) { 1888 ktmp = X509_get0_pubkey(sk_X509_value(chain, i)); 1889 if (ktmp == NULL) { 1890 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, 1891 X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY); 1892 return 0; 1893 } 1894 if (!EVP_PKEY_missing_parameters(ktmp)) 1895 break; 1896 } 1897 if (ktmp == NULL) { 1898 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, 1899 X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN); 1900 return 0; 1901 } 1902 1903 /* first, populate the other certs */ 1904 for (j = i - 1; j >= 0; j--) { 1905 ktmp2 = X509_get0_pubkey(sk_X509_value(chain, j)); 1906 EVP_PKEY_copy_parameters(ktmp2, ktmp); 1907 } 1908 1909 if (pkey != NULL) 1910 EVP_PKEY_copy_parameters(pkey, ktmp); 1911 return 1; 1912 } 1913 1914 /* Make a delta CRL as the diff between two full CRLs */ 1915 1916 X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, 1917 EVP_PKEY *skey, const EVP_MD *md, unsigned int flags) 1918 { 1919 X509_CRL *crl = NULL; 1920 int i; 1921 STACK_OF(X509_REVOKED) *revs = NULL; 1922 /* CRLs can't be delta already */ 1923 if (base->base_crl_number || newer->base_crl_number) { 1924 X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_ALREADY_DELTA); 1925 return NULL; 1926 } 1927 /* Base and new CRL must have a CRL number */ 1928 if (!base->crl_number || !newer->crl_number) { 1929 X509err(X509_F_X509_CRL_DIFF, X509_R_NO_CRL_NUMBER); 1930 return NULL; 1931 } 1932 /* Issuer names must match */ 1933 if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(newer))) { 1934 X509err(X509_F_X509_CRL_DIFF, X509_R_ISSUER_MISMATCH); 1935 return NULL; 1936 } 1937 /* AKID and IDP must match */ 1938 if (!crl_extension_match(base, newer, NID_authority_key_identifier)) { 1939 X509err(X509_F_X509_CRL_DIFF, X509_R_AKID_MISMATCH); 1940 return NULL; 1941 } 1942 if (!crl_extension_match(base, newer, NID_issuing_distribution_point)) { 1943 X509err(X509_F_X509_CRL_DIFF, X509_R_IDP_MISMATCH); 1944 return NULL; 1945 } 1946 /* Newer CRL number must exceed full CRL number */ 1947 if (ASN1_INTEGER_cmp(newer->crl_number, base->crl_number) <= 0) { 1948 X509err(X509_F_X509_CRL_DIFF, X509_R_NEWER_CRL_NOT_NEWER); 1949 return NULL; 1950 } 1951 /* CRLs must verify */ 1952 if (skey && (X509_CRL_verify(base, skey) <= 0 || 1953 X509_CRL_verify(newer, skey) <= 0)) { 1954 X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_VERIFY_FAILURE); 1955 return NULL; 1956 } 1957 /* Create new CRL */ 1958 crl = X509_CRL_new(); 1959 if (crl == NULL || !X509_CRL_set_version(crl, 1)) 1960 goto memerr; 1961 /* Set issuer name */ 1962 if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer))) 1963 goto memerr; 1964 1965 if (!X509_CRL_set1_lastUpdate(crl, X509_CRL_get0_lastUpdate(newer))) 1966 goto memerr; 1967 if (!X509_CRL_set1_nextUpdate(crl, X509_CRL_get0_nextUpdate(newer))) 1968 goto memerr; 1969 1970 /* Set base CRL number: must be critical */ 1971 1972 if (!X509_CRL_add1_ext_i2d(crl, NID_delta_crl, base->crl_number, 1, 0)) 1973 goto memerr; 1974 1975 /* 1976 * Copy extensions across from newest CRL to delta: this will set CRL 1977 * number to correct value too. 1978 */ 1979 1980 for (i = 0; i < X509_CRL_get_ext_count(newer); i++) { 1981 X509_EXTENSION *ext; 1982 ext = X509_CRL_get_ext(newer, i); 1983 if (!X509_CRL_add_ext(crl, ext, -1)) 1984 goto memerr; 1985 } 1986 1987 /* Go through revoked entries, copying as needed */ 1988 1989 revs = X509_CRL_get_REVOKED(newer); 1990 1991 for (i = 0; i < sk_X509_REVOKED_num(revs); i++) { 1992 X509_REVOKED *rvn, *rvtmp; 1993 rvn = sk_X509_REVOKED_value(revs, i); 1994 /* 1995 * Add only if not also in base. TODO: need something cleverer here 1996 * for some more complex CRLs covering multiple CAs. 1997 */ 1998 if (!X509_CRL_get0_by_serial(base, &rvtmp, &rvn->serialNumber)) { 1999 rvtmp = X509_REVOKED_dup(rvn); 2000 if (!rvtmp) 2001 goto memerr; 2002 if (!X509_CRL_add0_revoked(crl, rvtmp)) { 2003 X509_REVOKED_free(rvtmp); 2004 goto memerr; 2005 } 2006 } 2007 } 2008 /* TODO: optionally prune deleted entries */ 2009 2010 if (skey && md && !X509_CRL_sign(crl, skey, md)) 2011 goto memerr; 2012 2013 return crl; 2014 2015 memerr: 2016 X509err(X509_F_X509_CRL_DIFF, ERR_R_MALLOC_FAILURE); 2017 X509_CRL_free(crl); 2018 return NULL; 2019 } 2020 2021 int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) 2022 { 2023 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); 2024 } 2025 2026 void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx) 2027 { 2028 return CRYPTO_get_ex_data(&ctx->ex_data, idx); 2029 } 2030 2031 int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx) 2032 { 2033 return ctx->error; 2034 } 2035 2036 void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err) 2037 { 2038 ctx->error = err; 2039 } 2040 2041 int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx) 2042 { 2043 return ctx->error_depth; 2044 } 2045 2046 void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth) 2047 { 2048 ctx->error_depth = depth; 2049 } 2050 2051 X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx) 2052 { 2053 return ctx->current_cert; 2054 } 2055 2056 void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x) 2057 { 2058 ctx->current_cert = x; 2059 } 2060 2061 STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *ctx) 2062 { 2063 return ctx->chain; 2064 } 2065 2066 STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx) 2067 { 2068 if (!ctx->chain) 2069 return NULL; 2070 return X509_chain_up_ref(ctx->chain); 2071 } 2072 2073 X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx) 2074 { 2075 return ctx->current_issuer; 2076 } 2077 2078 X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx) 2079 { 2080 return ctx->current_crl; 2081 } 2082 2083 X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx) 2084 { 2085 return ctx->parent; 2086 } 2087 2088 void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x) 2089 { 2090 ctx->cert = x; 2091 } 2092 2093 void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk) 2094 { 2095 ctx->crls = sk; 2096 } 2097 2098 int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose) 2099 { 2100 /* 2101 * XXX: Why isn't this function always used to set the associated trust? 2102 * Should there even be a VPM->trust field at all? Or should the trust 2103 * always be inferred from the purpose by X509_STORE_CTX_init(). 2104 */ 2105 return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0); 2106 } 2107 2108 int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) 2109 { 2110 /* 2111 * XXX: See above, this function would only be needed when the default 2112 * trust for the purpose needs an override in a corner case. 2113 */ 2114 return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust); 2115 } 2116 2117 /* 2118 * This function is used to set the X509_STORE_CTX purpose and trust values. 2119 * This is intended to be used when another structure has its own trust and 2120 * purpose values which (if set) will be inherited by the ctx. If they aren't 2121 * set then we will usually have a default purpose in mind which should then 2122 * be used to set the trust value. An example of this is SSL use: an SSL 2123 * structure will have its own purpose and trust settings which the 2124 * application can set: if they aren't set then we use the default of SSL 2125 * client/server. 2126 */ 2127 2128 int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, 2129 int purpose, int trust) 2130 { 2131 int idx; 2132 /* If purpose not set use default */ 2133 if (!purpose) 2134 purpose = def_purpose; 2135 /* If we have a purpose then check it is valid */ 2136 if (purpose) { 2137 X509_PURPOSE *ptmp; 2138 idx = X509_PURPOSE_get_by_id(purpose); 2139 if (idx == -1) { 2140 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2141 X509_R_UNKNOWN_PURPOSE_ID); 2142 return 0; 2143 } 2144 ptmp = X509_PURPOSE_get0(idx); 2145 if (ptmp->trust == X509_TRUST_DEFAULT) { 2146 idx = X509_PURPOSE_get_by_id(def_purpose); 2147 /* 2148 * XXX: In the two callers above def_purpose is always 0, which is 2149 * not a known value, so idx will always be -1. How is the 2150 * X509_TRUST_DEFAULT case actually supposed to be handled? 2151 */ 2152 if (idx == -1) { 2153 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2154 X509_R_UNKNOWN_PURPOSE_ID); 2155 return 0; 2156 } 2157 ptmp = X509_PURPOSE_get0(idx); 2158 } 2159 /* If trust not set then get from purpose default */ 2160 if (!trust) 2161 trust = ptmp->trust; 2162 } 2163 if (trust) { 2164 idx = X509_TRUST_get_by_id(trust); 2165 if (idx == -1) { 2166 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2167 X509_R_UNKNOWN_TRUST_ID); 2168 return 0; 2169 } 2170 } 2171 2172 if (purpose && !ctx->param->purpose) 2173 ctx->param->purpose = purpose; 2174 if (trust && !ctx->param->trust) 2175 ctx->param->trust = trust; 2176 return 1; 2177 } 2178 2179 X509_STORE_CTX *X509_STORE_CTX_new(void) 2180 { 2181 X509_STORE_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); 2182 2183 if (ctx == NULL) { 2184 X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE); 2185 return NULL; 2186 } 2187 return ctx; 2188 } 2189 2190 void X509_STORE_CTX_free(X509_STORE_CTX *ctx) 2191 { 2192 if (ctx == NULL) 2193 return; 2194 2195 X509_STORE_CTX_cleanup(ctx); 2196 OPENSSL_free(ctx); 2197 } 2198 2199 int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, 2200 STACK_OF(X509) *chain) 2201 { 2202 int ret = 1; 2203 2204 ctx->ctx = store; 2205 ctx->cert = x509; 2206 ctx->untrusted = chain; 2207 ctx->crls = NULL; 2208 ctx->num_untrusted = 0; 2209 ctx->other_ctx = NULL; 2210 ctx->valid = 0; 2211 ctx->chain = NULL; 2212 ctx->error = 0; 2213 ctx->explicit_policy = 0; 2214 ctx->error_depth = 0; 2215 ctx->current_cert = NULL; 2216 ctx->current_issuer = NULL; 2217 ctx->current_crl = NULL; 2218 ctx->current_crl_score = 0; 2219 ctx->current_reasons = 0; 2220 ctx->tree = NULL; 2221 ctx->parent = NULL; 2222 ctx->dane = NULL; 2223 ctx->bare_ta_signed = 0; 2224 /* Zero ex_data to make sure we're cleanup-safe */ 2225 memset(&ctx->ex_data, 0, sizeof(ctx->ex_data)); 2226 2227 /* store->cleanup is always 0 in OpenSSL, if set must be idempotent */ 2228 if (store) 2229 ctx->cleanup = store->cleanup; 2230 else 2231 ctx->cleanup = 0; 2232 2233 if (store && store->check_issued) 2234 ctx->check_issued = store->check_issued; 2235 else 2236 ctx->check_issued = check_issued; 2237 2238 if (store && store->get_issuer) 2239 ctx->get_issuer = store->get_issuer; 2240 else 2241 ctx->get_issuer = X509_STORE_CTX_get1_issuer; 2242 2243 if (store && store->verify_cb) 2244 ctx->verify_cb = store->verify_cb; 2245 else 2246 ctx->verify_cb = null_callback; 2247 2248 if (store && store->verify) 2249 ctx->verify = store->verify; 2250 else 2251 ctx->verify = internal_verify; 2252 2253 if (store && store->check_revocation) 2254 ctx->check_revocation = store->check_revocation; 2255 else 2256 ctx->check_revocation = check_revocation; 2257 2258 if (store && store->get_crl) 2259 ctx->get_crl = store->get_crl; 2260 else 2261 ctx->get_crl = NULL; 2262 2263 if (store && store->check_crl) 2264 ctx->check_crl = store->check_crl; 2265 else 2266 ctx->check_crl = check_crl; 2267 2268 if (store && store->cert_crl) 2269 ctx->cert_crl = store->cert_crl; 2270 else 2271 ctx->cert_crl = cert_crl; 2272 2273 if (store && store->check_policy) 2274 ctx->check_policy = store->check_policy; 2275 else 2276 ctx->check_policy = check_policy; 2277 2278 if (store && store->lookup_certs) 2279 ctx->lookup_certs = store->lookup_certs; 2280 else 2281 ctx->lookup_certs = X509_STORE_CTX_get1_certs; 2282 2283 if (store && store->lookup_crls) 2284 ctx->lookup_crls = store->lookup_crls; 2285 else 2286 ctx->lookup_crls = X509_STORE_CTX_get1_crls; 2287 2288 ctx->param = X509_VERIFY_PARAM_new(); 2289 if (ctx->param == NULL) { 2290 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2291 goto err; 2292 } 2293 2294 /* 2295 * Inherit callbacks and flags from X509_STORE if not set use defaults. 2296 */ 2297 if (store) 2298 ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param); 2299 else 2300 ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT | X509_VP_FLAG_ONCE; 2301 2302 if (ret) 2303 ret = X509_VERIFY_PARAM_inherit(ctx->param, 2304 X509_VERIFY_PARAM_lookup("default")); 2305 2306 if (ret == 0) { 2307 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2308 goto err; 2309 } 2310 2311 /* 2312 * XXX: For now, continue to inherit trust from VPM, but infer from the 2313 * purpose if this still yields the default value. 2314 */ 2315 if (ctx->param->trust == X509_TRUST_DEFAULT) { 2316 int idx = X509_PURPOSE_get_by_id(ctx->param->purpose); 2317 X509_PURPOSE *xp = X509_PURPOSE_get0(idx); 2318 2319 if (xp != NULL) 2320 ctx->param->trust = X509_PURPOSE_get_trust(xp); 2321 } 2322 2323 if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, 2324 &ctx->ex_data)) 2325 return 1; 2326 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2327 2328 err: 2329 /* 2330 * On error clean up allocated storage, if the store context was not 2331 * allocated with X509_STORE_CTX_new() this is our last chance to do so. 2332 */ 2333 X509_STORE_CTX_cleanup(ctx); 2334 return 0; 2335 } 2336 2337 /* 2338 * Set alternative lookup method: just a STACK of trusted certificates. This 2339 * avoids X509_STORE nastiness where it isn't needed. 2340 */ 2341 void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) 2342 { 2343 ctx->other_ctx = sk; 2344 ctx->get_issuer = get_issuer_sk; 2345 ctx->lookup_certs = lookup_certs_sk; 2346 } 2347 2348 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) 2349 { 2350 /* 2351 * We need to be idempotent because, unfortunately, free() also calls 2352 * cleanup(), so the natural call sequence new(), init(), cleanup(), free() 2353 * calls cleanup() for the same object twice! Thus we must zero the 2354 * pointers below after they're freed! 2355 */ 2356 /* Seems to always be 0 in OpenSSL, do this at most once. */ 2357 if (ctx->cleanup != NULL) { 2358 ctx->cleanup(ctx); 2359 ctx->cleanup = NULL; 2360 } 2361 if (ctx->param != NULL) { 2362 if (ctx->parent == NULL) 2363 X509_VERIFY_PARAM_free(ctx->param); 2364 ctx->param = NULL; 2365 } 2366 X509_policy_tree_free(ctx->tree); 2367 ctx->tree = NULL; 2368 sk_X509_pop_free(ctx->chain, X509_free); 2369 ctx->chain = NULL; 2370 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &(ctx->ex_data)); 2371 memset(&ctx->ex_data, 0, sizeof(ctx->ex_data)); 2372 } 2373 2374 void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth) 2375 { 2376 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 2377 } 2378 2379 void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags) 2380 { 2381 X509_VERIFY_PARAM_set_flags(ctx->param, flags); 2382 } 2383 2384 void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, 2385 time_t t) 2386 { 2387 X509_VERIFY_PARAM_set_time(ctx->param, t); 2388 } 2389 2390 X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx) 2391 { 2392 return ctx->cert; 2393 } 2394 2395 STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(X509_STORE_CTX *ctx) 2396 { 2397 return ctx->untrusted; 2398 } 2399 2400 void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) 2401 { 2402 ctx->untrusted = sk; 2403 } 2404 2405 void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) 2406 { 2407 sk_X509_pop_free(ctx->chain, X509_free); 2408 ctx->chain = sk; 2409 } 2410 2411 void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, 2412 X509_STORE_CTX_verify_cb verify_cb) 2413 { 2414 ctx->verify_cb = verify_cb; 2415 } 2416 2417 X509_STORE_CTX_verify_cb X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx) 2418 { 2419 return ctx->verify_cb; 2420 } 2421 2422 void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx, 2423 X509_STORE_CTX_verify_fn verify) 2424 { 2425 ctx->verify = verify; 2426 } 2427 2428 X509_STORE_CTX_verify_fn X509_STORE_CTX_get_verify(X509_STORE_CTX *ctx) 2429 { 2430 return ctx->verify; 2431 } 2432 2433 X509_STORE_CTX_get_issuer_fn X509_STORE_CTX_get_get_issuer(X509_STORE_CTX *ctx) 2434 { 2435 return ctx->get_issuer; 2436 } 2437 2438 X509_STORE_CTX_check_issued_fn X509_STORE_CTX_get_check_issued(X509_STORE_CTX *ctx) 2439 { 2440 return ctx->check_issued; 2441 } 2442 2443 X509_STORE_CTX_check_revocation_fn X509_STORE_CTX_get_check_revocation(X509_STORE_CTX *ctx) 2444 { 2445 return ctx->check_revocation; 2446 } 2447 2448 X509_STORE_CTX_get_crl_fn X509_STORE_CTX_get_get_crl(X509_STORE_CTX *ctx) 2449 { 2450 return ctx->get_crl; 2451 } 2452 2453 X509_STORE_CTX_check_crl_fn X509_STORE_CTX_get_check_crl(X509_STORE_CTX *ctx) 2454 { 2455 return ctx->check_crl; 2456 } 2457 2458 X509_STORE_CTX_cert_crl_fn X509_STORE_CTX_get_cert_crl(X509_STORE_CTX *ctx) 2459 { 2460 return ctx->cert_crl; 2461 } 2462 2463 X509_STORE_CTX_check_policy_fn X509_STORE_CTX_get_check_policy(X509_STORE_CTX *ctx) 2464 { 2465 return ctx->check_policy; 2466 } 2467 2468 X509_STORE_CTX_lookup_certs_fn X509_STORE_CTX_get_lookup_certs(X509_STORE_CTX *ctx) 2469 { 2470 return ctx->lookup_certs; 2471 } 2472 2473 X509_STORE_CTX_lookup_crls_fn X509_STORE_CTX_get_lookup_crls(X509_STORE_CTX *ctx) 2474 { 2475 return ctx->lookup_crls; 2476 } 2477 2478 X509_STORE_CTX_cleanup_fn X509_STORE_CTX_get_cleanup(X509_STORE_CTX *ctx) 2479 { 2480 return ctx->cleanup; 2481 } 2482 2483 X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx) 2484 { 2485 return ctx->tree; 2486 } 2487 2488 int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx) 2489 { 2490 return ctx->explicit_policy; 2491 } 2492 2493 int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx) 2494 { 2495 return ctx->num_untrusted; 2496 } 2497 2498 int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) 2499 { 2500 const X509_VERIFY_PARAM *param; 2501 param = X509_VERIFY_PARAM_lookup(name); 2502 if (!param) 2503 return 0; 2504 return X509_VERIFY_PARAM_inherit(ctx->param, param); 2505 } 2506 2507 X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) 2508 { 2509 return ctx->param; 2510 } 2511 2512 void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param) 2513 { 2514 X509_VERIFY_PARAM_free(ctx->param); 2515 ctx->param = param; 2516 } 2517 2518 void X509_STORE_CTX_set0_dane(X509_STORE_CTX *ctx, SSL_DANE *dane) 2519 { 2520 ctx->dane = dane; 2521 } 2522 2523 static unsigned char *dane_i2d( 2524 X509 *cert, 2525 uint8_t selector, 2526 unsigned int *i2dlen) 2527 { 2528 unsigned char *buf = NULL; 2529 int len; 2530 2531 /* 2532 * Extract ASN.1 DER form of certificate or public key. 2533 */ 2534 switch (selector) { 2535 case DANETLS_SELECTOR_CERT: 2536 len = i2d_X509(cert, &buf); 2537 break; 2538 case DANETLS_SELECTOR_SPKI: 2539 len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &buf); 2540 break; 2541 default: 2542 X509err(X509_F_DANE_I2D, X509_R_BAD_SELECTOR); 2543 return NULL; 2544 } 2545 2546 if (len < 0 || buf == NULL) { 2547 X509err(X509_F_DANE_I2D, ERR_R_MALLOC_FAILURE); 2548 return NULL; 2549 } 2550 2551 *i2dlen = (unsigned int)len; 2552 return buf; 2553 } 2554 2555 #define DANETLS_NONE 256 /* impossible uint8_t */ 2556 2557 static int dane_match(X509_STORE_CTX *ctx, X509 *cert, int depth) 2558 { 2559 SSL_DANE *dane = ctx->dane; 2560 unsigned usage = DANETLS_NONE; 2561 unsigned selector = DANETLS_NONE; 2562 unsigned ordinal = DANETLS_NONE; 2563 unsigned mtype = DANETLS_NONE; 2564 unsigned char *i2dbuf = NULL; 2565 unsigned int i2dlen = 0; 2566 unsigned char mdbuf[EVP_MAX_MD_SIZE]; 2567 unsigned char *cmpbuf = NULL; 2568 unsigned int cmplen = 0; 2569 int i; 2570 int recnum; 2571 int matched = 0; 2572 danetls_record *t = NULL; 2573 uint32_t mask; 2574 2575 mask = (depth == 0) ? DANETLS_EE_MASK : DANETLS_TA_MASK; 2576 2577 /* 2578 * The trust store is not applicable with DANE-TA(2) 2579 */ 2580 if (depth >= ctx->num_untrusted) 2581 mask &= DANETLS_PKIX_MASK; 2582 2583 /* 2584 * If we've previously matched a PKIX-?? record, no need to test any 2585 * further PKIX-?? records, it remains to just build the PKIX chain. 2586 * Had the match been a DANE-?? record, we'd be done already. 2587 */ 2588 if (dane->mdpth >= 0) 2589 mask &= ~DANETLS_PKIX_MASK; 2590 2591 /*- 2592 * https://tools.ietf.org/html/rfc7671#section-5.1 2593 * https://tools.ietf.org/html/rfc7671#section-5.2 2594 * https://tools.ietf.org/html/rfc7671#section-5.3 2595 * https://tools.ietf.org/html/rfc7671#section-5.4 2596 * 2597 * We handle DANE-EE(3) records first as they require no chain building 2598 * and no expiration or hostname checks. We also process digests with 2599 * higher ordinals first and ignore lower priorities except Full(0) which 2600 * is always processed (last). If none match, we then process PKIX-EE(1). 2601 * 2602 * NOTE: This relies on DANE usages sorting before the corresponding PKIX 2603 * usages in SSL_dane_tlsa_add(), and also on descending sorting of digest 2604 * priorities. See twin comment in ssl/ssl_lib.c. 2605 * 2606 * We expect that most TLSA RRsets will have just a single usage, so we 2607 * don't go out of our way to cache multiple selector-specific i2d buffers 2608 * across usages, but if the selector happens to remain the same as switch 2609 * usages, that's OK. Thus, a set of "3 1 1", "3 0 1", "1 1 1", "1 0 1", 2610 * records would result in us generating each of the certificate and public 2611 * key DER forms twice, but more typically we'd just see multiple "3 1 1" 2612 * or multiple "3 0 1" records. 2613 * 2614 * As soon as we find a match at any given depth, we stop, because either 2615 * we've matched a DANE-?? record and the peer is authenticated, or, after 2616 * exhausting all DANE-?? records, we've matched a PKIX-?? record, which is 2617 * sufficient for DANE, and what remains to do is ordinary PKIX validation. 2618 */ 2619 recnum = (dane->umask & mask) ? sk_danetls_record_num(dane->trecs) : 0; 2620 for (i = 0; matched == 0 && i < recnum; ++i) { 2621 t = sk_danetls_record_value(dane->trecs, i); 2622 if ((DANETLS_USAGE_BIT(t->usage) & mask) == 0) 2623 continue; 2624 if (t->usage != usage) { 2625 usage = t->usage; 2626 2627 /* Reset digest agility for each usage/selector pair */ 2628 mtype = DANETLS_NONE; 2629 ordinal = dane->dctx->mdord[t->mtype]; 2630 } 2631 if (t->selector != selector) { 2632 selector = t->selector; 2633 2634 /* Update per-selector state */ 2635 OPENSSL_free(i2dbuf); 2636 i2dbuf = dane_i2d(cert, selector, &i2dlen); 2637 if (i2dbuf == NULL) 2638 return -1; 2639 2640 /* Reset digest agility for each usage/selector pair */ 2641 mtype = DANETLS_NONE; 2642 ordinal = dane->dctx->mdord[t->mtype]; 2643 } else if (t->mtype != DANETLS_MATCHING_FULL) { 2644 /*- 2645 * Digest agility: 2646 * 2647 * <https://tools.ietf.org/html/rfc7671#section-9> 2648 * 2649 * For a fixed selector, after processing all records with the 2650 * highest mtype ordinal, ignore all mtypes with lower ordinals 2651 * other than "Full". 2652 */ 2653 if (dane->dctx->mdord[t->mtype] < ordinal) 2654 continue; 2655 } 2656 2657 /* 2658 * Each time we hit a (new selector or) mtype, re-compute the relevant 2659 * digest, more complex caching is not worth the code space. 2660 */ 2661 if (t->mtype != mtype) { 2662 const EVP_MD *md = dane->dctx->mdevp[mtype = t->mtype]; 2663 cmpbuf = i2dbuf; 2664 cmplen = i2dlen; 2665 2666 if (md != NULL) { 2667 cmpbuf = mdbuf; 2668 if (!EVP_Digest(i2dbuf, i2dlen, cmpbuf, &cmplen, md, 0)) { 2669 matched = -1; 2670 break; 2671 } 2672 } 2673 } 2674 2675 /* 2676 * Squirrel away the certificate and depth if we have a match. Any 2677 * DANE match is dispositive, but with PKIX we still need to build a 2678 * full chain. 2679 */ 2680 if (cmplen == t->dlen && 2681 memcmp(cmpbuf, t->data, cmplen) == 0) { 2682 if (DANETLS_USAGE_BIT(usage) & DANETLS_DANE_MASK) 2683 matched = 1; 2684 if (matched || dane->mdpth < 0) { 2685 dane->mdpth = depth; 2686 dane->mtlsa = t; 2687 OPENSSL_free(dane->mcert); 2688 dane->mcert = cert; 2689 X509_up_ref(cert); 2690 } 2691 break; 2692 } 2693 } 2694 2695 /* Clear the one-element DER cache */ 2696 OPENSSL_free(i2dbuf); 2697 return matched; 2698 } 2699 2700 static int check_dane_issuer(X509_STORE_CTX *ctx, int depth) 2701 { 2702 SSL_DANE *dane = ctx->dane; 2703 int matched = 0; 2704 X509 *cert; 2705 2706 if (!DANETLS_HAS_TA(dane) || depth == 0) 2707 return X509_TRUST_UNTRUSTED; 2708 2709 /* 2710 * Record any DANE trust-anchor matches, for the first depth to test, if 2711 * there's one at that depth. (This'll be false for length 1 chains looking 2712 * for an exact match for the leaf certificate). 2713 */ 2714 cert = sk_X509_value(ctx->chain, depth); 2715 if (cert != NULL && (matched = dane_match(ctx, cert, depth)) < 0) 2716 return X509_TRUST_REJECTED; 2717 if (matched > 0) { 2718 ctx->num_untrusted = depth - 1; 2719 return X509_TRUST_TRUSTED; 2720 } 2721 2722 return X509_TRUST_UNTRUSTED; 2723 } 2724 2725 static int check_dane_pkeys(X509_STORE_CTX *ctx) 2726 { 2727 SSL_DANE *dane = ctx->dane; 2728 danetls_record *t; 2729 int num = ctx->num_untrusted; 2730 X509 *cert = sk_X509_value(ctx->chain, num - 1); 2731 int recnum = sk_danetls_record_num(dane->trecs); 2732 int i; 2733 2734 for (i = 0; i < recnum; ++i) { 2735 t = sk_danetls_record_value(dane->trecs, i); 2736 if (t->usage != DANETLS_USAGE_DANE_TA || 2737 t->selector != DANETLS_SELECTOR_SPKI || 2738 t->mtype != DANETLS_MATCHING_FULL || 2739 X509_verify(cert, t->spki) <= 0) 2740 continue; 2741 2742 /* Clear any PKIX-?? matches that failed to extend to a full chain */ 2743 X509_free(dane->mcert); 2744 dane->mcert = NULL; 2745 2746 /* Record match via a bare TA public key */ 2747 ctx->bare_ta_signed = 1; 2748 dane->mdpth = num - 1; 2749 dane->mtlsa = t; 2750 2751 /* Prune any excess chain certificates */ 2752 num = sk_X509_num(ctx->chain); 2753 for (; num > ctx->num_untrusted; --num) 2754 X509_free(sk_X509_pop(ctx->chain)); 2755 2756 return X509_TRUST_TRUSTED; 2757 } 2758 2759 return X509_TRUST_UNTRUSTED; 2760 } 2761 2762 static void dane_reset(SSL_DANE *dane) 2763 { 2764 /* 2765 * Reset state to verify another chain, or clear after failure. 2766 */ 2767 X509_free(dane->mcert); 2768 dane->mcert = NULL; 2769 dane->mtlsa = NULL; 2770 dane->mdpth = -1; 2771 dane->pdpth = -1; 2772 } 2773 2774 static int check_leaf_suiteb(X509_STORE_CTX *ctx, X509 *cert) 2775 { 2776 int err = X509_chain_check_suiteb(NULL, cert, NULL, ctx->param->flags); 2777 2778 if (err == X509_V_OK) 2779 return 1; 2780 return verify_cb_cert(ctx, cert, 0, err); 2781 } 2782 2783 static int dane_verify(X509_STORE_CTX *ctx) 2784 { 2785 X509 *cert = ctx->cert; 2786 SSL_DANE *dane = ctx->dane; 2787 int matched; 2788 int done; 2789 2790 dane_reset(dane); 2791 2792 /*- 2793 * When testing the leaf certificate, if we match a DANE-EE(3) record, 2794 * dane_match() returns 1 and we're done. If however we match a PKIX-EE(1) 2795 * record, the match depth and matching TLSA record are recorded, but the 2796 * return value is 0, because we still need to find a PKIX trust-anchor. 2797 * Therefore, when DANE authentication is enabled (required), we're done 2798 * if: 2799 * + matched < 0, internal error. 2800 * + matched == 1, we matched a DANE-EE(3) record 2801 * + matched == 0, mdepth < 0 (no PKIX-EE match) and there are no 2802 * DANE-TA(2) or PKIX-TA(0) to test. 2803 */ 2804 matched = dane_match(ctx, ctx->cert, 0); 2805 done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0); 2806 2807 if (done) 2808 X509_get_pubkey_parameters(NULL, ctx->chain); 2809 2810 if (matched > 0) { 2811 /* Callback invoked as needed */ 2812 if (!check_leaf_suiteb(ctx, cert)) 2813 return 0; 2814 /* Callback invoked as needed */ 2815 if ((dane->flags & DANE_FLAG_NO_DANE_EE_NAMECHECKS) == 0 && 2816 !check_id(ctx)) 2817 return 0; 2818 /* Bypass internal_verify(), issue depth 0 success callback */ 2819 ctx->error_depth = 0; 2820 ctx->current_cert = cert; 2821 return ctx->verify_cb(1, ctx); 2822 } 2823 2824 if (matched < 0) { 2825 ctx->error_depth = 0; 2826 ctx->current_cert = cert; 2827 ctx->error = X509_V_ERR_OUT_OF_MEM; 2828 return -1; 2829 } 2830 2831 if (done) { 2832 /* Fail early, TA-based success is not possible */ 2833 if (!check_leaf_suiteb(ctx, cert)) 2834 return 0; 2835 return verify_cb_cert(ctx, cert, 0, X509_V_ERR_DANE_NO_MATCH); 2836 } 2837 2838 /* 2839 * Chain verification for usages 0/1/2. TLSA record matching of depth > 0 2840 * certificates happens in-line with building the rest of the chain. 2841 */ 2842 return verify_chain(ctx); 2843 } 2844 2845 /* Get issuer, without duplicate suppression */ 2846 static int get_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *cert) 2847 { 2848 STACK_OF(X509) *saved_chain = ctx->chain; 2849 int ok; 2850 2851 ctx->chain = NULL; 2852 ok = ctx->get_issuer(issuer, ctx, cert); 2853 ctx->chain = saved_chain; 2854 2855 return ok; 2856 } 2857 2858 static int build_chain(X509_STORE_CTX *ctx) 2859 { 2860 SSL_DANE *dane = ctx->dane; 2861 int num = sk_X509_num(ctx->chain); 2862 X509 *cert = sk_X509_value(ctx->chain, num - 1); 2863 int ss = cert_self_signed(cert); 2864 STACK_OF(X509) *sktmp = NULL; 2865 unsigned int search; 2866 int may_trusted = 0; 2867 int may_alternate = 0; 2868 int trust = X509_TRUST_UNTRUSTED; 2869 int alt_untrusted = 0; 2870 int depth; 2871 int ok = 0; 2872 int i; 2873 2874 /* Our chain starts with a single untrusted element. */ 2875 if (!ossl_assert(num == 1 && ctx->num_untrusted == num)) { 2876 X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); 2877 ctx->error = X509_V_ERR_UNSPECIFIED; 2878 return 0; 2879 } 2880 2881 #define S_DOUNTRUSTED (1 << 0) /* Search untrusted chain */ 2882 #define S_DOTRUSTED (1 << 1) /* Search trusted store */ 2883 #define S_DOALTERNATE (1 << 2) /* Retry with pruned alternate chain */ 2884 /* 2885 * Set up search policy, untrusted if possible, trusted-first if enabled. 2886 * If we're doing DANE and not doing PKIX-TA/PKIX-EE, we never look in the 2887 * trust_store, otherwise we might look there first. If not trusted-first, 2888 * and alternate chains are not disabled, try building an alternate chain 2889 * if no luck with untrusted first. 2890 */ 2891 search = (ctx->untrusted != NULL) ? S_DOUNTRUSTED : 0; 2892 if (DANETLS_HAS_PKIX(dane) || !DANETLS_HAS_DANE(dane)) { 2893 if (search == 0 || ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) 2894 search |= S_DOTRUSTED; 2895 else if (!(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) 2896 may_alternate = 1; 2897 may_trusted = 1; 2898 } 2899 2900 /* 2901 * Shallow-copy the stack of untrusted certificates (with TLS, this is 2902 * typically the content of the peer's certificate message) so can make 2903 * multiple passes over it, while free to remove elements as we go. 2904 */ 2905 if (ctx->untrusted && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { 2906 X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); 2907 ctx->error = X509_V_ERR_OUT_OF_MEM; 2908 return 0; 2909 } 2910 2911 /* 2912 * If we got any "DANE-TA(2) Cert(0) Full(0)" trust-anchors from DNS, add 2913 * them to our working copy of the untrusted certificate stack. Since the 2914 * caller of X509_STORE_CTX_init() may have provided only a leaf cert with 2915 * no corresponding stack of untrusted certificates, we may need to create 2916 * an empty stack first. [ At present only the ssl library provides DANE 2917 * support, and ssl_verify_cert_chain() always provides a non-null stack 2918 * containing at least the leaf certificate, but we must be prepared for 2919 * this to change. ] 2920 */ 2921 if (DANETLS_ENABLED(dane) && dane->certs != NULL) { 2922 if (sktmp == NULL && (sktmp = sk_X509_new_null()) == NULL) { 2923 X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); 2924 ctx->error = X509_V_ERR_OUT_OF_MEM; 2925 return 0; 2926 } 2927 for (i = 0; i < sk_X509_num(dane->certs); ++i) { 2928 if (!sk_X509_push(sktmp, sk_X509_value(dane->certs, i))) { 2929 sk_X509_free(sktmp); 2930 X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); 2931 ctx->error = X509_V_ERR_OUT_OF_MEM; 2932 return 0; 2933 } 2934 } 2935 } 2936 2937 /* 2938 * Still absurdly large, but arithmetically safe, a lower hard upper bound 2939 * might be reasonable. 2940 */ 2941 if (ctx->param->depth > INT_MAX/2) 2942 ctx->param->depth = INT_MAX/2; 2943 2944 /* 2945 * Try to Extend the chain until we reach an ultimately trusted issuer. 2946 * Build chains up to one longer the limit, later fail if we hit the limit, 2947 * with an X509_V_ERR_CERT_CHAIN_TOO_LONG error code. 2948 */ 2949 depth = ctx->param->depth + 1; 2950 2951 while (search != 0) { 2952 X509 *x; 2953 X509 *xtmp = NULL; 2954 2955 /* 2956 * Look in the trust store if enabled for first lookup, or we've run 2957 * out of untrusted issuers and search here is not disabled. When we 2958 * reach the depth limit, we stop extending the chain, if by that point 2959 * we've not found a trust-anchor, any trusted chain would be too long. 2960 * 2961 * The error reported to the application verify callback is at the 2962 * maximal valid depth with the current certificate equal to the last 2963 * not ultimately-trusted issuer. For example, with verify_depth = 0, 2964 * the callback will report errors at depth=1 when the immediate issuer 2965 * of the leaf certificate is not a trust anchor. No attempt will be 2966 * made to locate an issuer for that certificate, since such a chain 2967 * would be a-priori too long. 2968 */ 2969 if ((search & S_DOTRUSTED) != 0) { 2970 i = num = sk_X509_num(ctx->chain); 2971 if ((search & S_DOALTERNATE) != 0) { 2972 /* 2973 * As high up the chain as we can, look for an alternative 2974 * trusted issuer of an untrusted certificate that currently 2975 * has an untrusted issuer. We use the alt_untrusted variable 2976 * to track how far up the chain we find the first match. It 2977 * is only if and when we find a match, that we prune the chain 2978 * and reset ctx->num_untrusted to the reduced count of 2979 * untrusted certificates. While we're searching for such a 2980 * match (which may never be found), it is neither safe nor 2981 * wise to preemptively modify either the chain or 2982 * ctx->num_untrusted. 2983 * 2984 * Note, like ctx->num_untrusted, alt_untrusted is a count of 2985 * untrusted certificates, not a "depth". 2986 */ 2987 i = alt_untrusted; 2988 } 2989 x = sk_X509_value(ctx->chain, i-1); 2990 2991 ok = (depth < num) ? 0 : get_issuer(&xtmp, ctx, x); 2992 2993 if (ok < 0) { 2994 trust = X509_TRUST_REJECTED; 2995 ctx->error = X509_V_ERR_STORE_LOOKUP; 2996 search = 0; 2997 continue; 2998 } 2999 3000 if (ok > 0) { 3001 /* 3002 * Alternative trusted issuer for a mid-chain untrusted cert? 3003 * Pop the untrusted cert's successors and retry. We might now 3004 * be able to complete a valid chain via the trust store. Note 3005 * that despite the current trust-store match we might still 3006 * fail complete the chain to a suitable trust-anchor, in which 3007 * case we may prune some more untrusted certificates and try 3008 * again. Thus the S_DOALTERNATE bit may yet be turned on 3009 * again with an even shorter untrusted chain! 3010 * 3011 * If in the process we threw away our matching PKIX-TA trust 3012 * anchor, reset DANE trust. We might find a suitable trusted 3013 * certificate among the ones from the trust store. 3014 */ 3015 if ((search & S_DOALTERNATE) != 0) { 3016 if (!ossl_assert(num > i && i > 0 && ss == 0)) { 3017 X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); 3018 X509_free(xtmp); 3019 trust = X509_TRUST_REJECTED; 3020 ctx->error = X509_V_ERR_UNSPECIFIED; 3021 search = 0; 3022 continue; 3023 } 3024 search &= ~S_DOALTERNATE; 3025 for (; num > i; --num) 3026 X509_free(sk_X509_pop(ctx->chain)); 3027 ctx->num_untrusted = num; 3028 3029 if (DANETLS_ENABLED(dane) && 3030 dane->mdpth >= ctx->num_untrusted) { 3031 dane->mdpth = -1; 3032 X509_free(dane->mcert); 3033 dane->mcert = NULL; 3034 } 3035 if (DANETLS_ENABLED(dane) && 3036 dane->pdpth >= ctx->num_untrusted) 3037 dane->pdpth = -1; 3038 } 3039 3040 /* 3041 * Self-signed untrusted certificates get replaced by their 3042 * trusted matching issuer. Otherwise, grow the chain. 3043 */ 3044 if (ss == 0) { 3045 if (!sk_X509_push(ctx->chain, x = xtmp)) { 3046 X509_free(xtmp); 3047 X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); 3048 trust = X509_TRUST_REJECTED; 3049 ctx->error = X509_V_ERR_OUT_OF_MEM; 3050 search = 0; 3051 continue; 3052 } 3053 ss = cert_self_signed(x); 3054 } else if (num == ctx->num_untrusted) { 3055 /* 3056 * We have a self-signed certificate that has the same 3057 * subject name (and perhaps keyid and/or serial number) as 3058 * a trust-anchor. We must have an exact match to avoid 3059 * possible impersonation via key substitution etc. 3060 */ 3061 if (X509_cmp(x, xtmp) != 0) { 3062 /* Self-signed untrusted mimic. */ 3063 X509_free(xtmp); 3064 ok = 0; 3065 } else { 3066 X509_free(x); 3067 ctx->num_untrusted = --num; 3068 (void) sk_X509_set(ctx->chain, num, x = xtmp); 3069 } 3070 } 3071 3072 /* 3073 * We've added a new trusted certificate to the chain, recheck 3074 * trust. If not done, and not self-signed look deeper. 3075 * Whether or not we're doing "trusted first", we no longer 3076 * look for untrusted certificates from the peer's chain. 3077 * 3078 * At this point ctx->num_trusted and num must reflect the 3079 * correct number of untrusted certificates, since the DANE 3080 * logic in check_trust() depends on distinguishing CAs from 3081 * "the wire" from CAs from the trust store. In particular, the 3082 * certificate at depth "num" should be the new trusted 3083 * certificate with ctx->num_untrusted <= num. 3084 */ 3085 if (ok) { 3086 if (!ossl_assert(ctx->num_untrusted <= num)) { 3087 X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); 3088 trust = X509_TRUST_REJECTED; 3089 ctx->error = X509_V_ERR_UNSPECIFIED; 3090 search = 0; 3091 continue; 3092 } 3093 search &= ~S_DOUNTRUSTED; 3094 switch (trust = check_trust(ctx, num)) { 3095 case X509_TRUST_TRUSTED: 3096 case X509_TRUST_REJECTED: 3097 search = 0; 3098 continue; 3099 } 3100 if (ss == 0) 3101 continue; 3102 } 3103 } 3104 3105 /* 3106 * No dispositive decision, and either self-signed or no match, if 3107 * we were doing untrusted-first, and alt-chains are not disabled, 3108 * do that, by repeatedly losing one untrusted element at a time, 3109 * and trying to extend the shorted chain. 3110 */ 3111 if ((search & S_DOUNTRUSTED) == 0) { 3112 /* Continue search for a trusted issuer of a shorter chain? */ 3113 if ((search & S_DOALTERNATE) != 0 && --alt_untrusted > 0) 3114 continue; 3115 /* Still no luck and no fallbacks left? */ 3116 if (!may_alternate || (search & S_DOALTERNATE) != 0 || 3117 ctx->num_untrusted < 2) 3118 break; 3119 /* Search for a trusted issuer of a shorter chain */ 3120 search |= S_DOALTERNATE; 3121 alt_untrusted = ctx->num_untrusted - 1; 3122 ss = 0; 3123 } 3124 } 3125 3126 /* 3127 * Extend chain with peer-provided certificates 3128 */ 3129 if ((search & S_DOUNTRUSTED) != 0) { 3130 num = sk_X509_num(ctx->chain); 3131 if (!ossl_assert(num == ctx->num_untrusted)) { 3132 X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); 3133 trust = X509_TRUST_REJECTED; 3134 ctx->error = X509_V_ERR_UNSPECIFIED; 3135 search = 0; 3136 continue; 3137 } 3138 x = sk_X509_value(ctx->chain, num-1); 3139 3140 /* 3141 * Once we run out of untrusted issuers, we stop looking for more 3142 * and start looking only in the trust store if enabled. 3143 */ 3144 xtmp = (ss || depth < num) ? NULL : find_issuer(ctx, sktmp, x); 3145 if (xtmp == NULL) { 3146 search &= ~S_DOUNTRUSTED; 3147 if (may_trusted) 3148 search |= S_DOTRUSTED; 3149 continue; 3150 } 3151 3152 /* Drop this issuer from future consideration */ 3153 (void) sk_X509_delete_ptr(sktmp, xtmp); 3154 3155 if (!sk_X509_push(ctx->chain, xtmp)) { 3156 X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); 3157 trust = X509_TRUST_REJECTED; 3158 ctx->error = X509_V_ERR_OUT_OF_MEM; 3159 search = 0; 3160 continue; 3161 } 3162 3163 X509_up_ref(x = xtmp); 3164 ++ctx->num_untrusted; 3165 ss = cert_self_signed(xtmp); 3166 3167 /* 3168 * Check for DANE-TA trust of the topmost untrusted certificate. 3169 */ 3170 switch (trust = check_dane_issuer(ctx, ctx->num_untrusted - 1)) { 3171 case X509_TRUST_TRUSTED: 3172 case X509_TRUST_REJECTED: 3173 search = 0; 3174 continue; 3175 } 3176 } 3177 } 3178 sk_X509_free(sktmp); 3179 3180 /* 3181 * Last chance to make a trusted chain, either bare DANE-TA public-key 3182 * signers, or else direct leaf PKIX trust. 3183 */ 3184 num = sk_X509_num(ctx->chain); 3185 if (num <= depth) { 3186 if (trust == X509_TRUST_UNTRUSTED && DANETLS_HAS_DANE_TA(dane)) 3187 trust = check_dane_pkeys(ctx); 3188 if (trust == X509_TRUST_UNTRUSTED && num == ctx->num_untrusted) 3189 trust = check_trust(ctx, num); 3190 } 3191 3192 switch (trust) { 3193 case X509_TRUST_TRUSTED: 3194 return 1; 3195 case X509_TRUST_REJECTED: 3196 /* Callback already issued */ 3197 return 0; 3198 case X509_TRUST_UNTRUSTED: 3199 default: 3200 num = sk_X509_num(ctx->chain); 3201 if (num > depth) 3202 return verify_cb_cert(ctx, NULL, num-1, 3203 X509_V_ERR_CERT_CHAIN_TOO_LONG); 3204 if (DANETLS_ENABLED(dane) && 3205 (!DANETLS_HAS_PKIX(dane) || dane->pdpth >= 0)) 3206 return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_DANE_NO_MATCH); 3207 if (ss && sk_X509_num(ctx->chain) == 1) 3208 return verify_cb_cert(ctx, NULL, num-1, 3209 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT); 3210 if (ss) 3211 return verify_cb_cert(ctx, NULL, num-1, 3212 X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN); 3213 if (ctx->num_untrusted < num) 3214 return verify_cb_cert(ctx, NULL, num-1, 3215 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT); 3216 return verify_cb_cert(ctx, NULL, num-1, 3217 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY); 3218 } 3219 } 3220 3221 static const int minbits_table[] = { 80, 112, 128, 192, 256 }; 3222 static const int NUM_AUTH_LEVELS = OSSL_NELEM(minbits_table); 3223 3224 /* 3225 * Check whether the public key of ``cert`` meets the security level of 3226 * ``ctx``. 3227 * 3228 * Returns 1 on success, 0 otherwise. 3229 */ 3230 static int check_key_level(X509_STORE_CTX *ctx, X509 *cert) 3231 { 3232 EVP_PKEY *pkey = X509_get0_pubkey(cert); 3233 int level = ctx->param->auth_level; 3234 3235 /* Unsupported or malformed keys are not secure */ 3236 if (pkey == NULL) 3237 return 0; 3238 3239 if (level <= 0) 3240 return 1; 3241 if (level > NUM_AUTH_LEVELS) 3242 level = NUM_AUTH_LEVELS; 3243 3244 return EVP_PKEY_security_bits(pkey) >= minbits_table[level - 1]; 3245 } 3246 3247 /* 3248 * Check whether the signature digest algorithm of ``cert`` meets the security 3249 * level of ``ctx``. Should not be checked for trust anchors (whether 3250 * self-signed or otherwise). 3251 * 3252 * Returns 1 on success, 0 otherwise. 3253 */ 3254 static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert) 3255 { 3256 int secbits = -1; 3257 int level = ctx->param->auth_level; 3258 3259 if (level <= 0) 3260 return 1; 3261 if (level > NUM_AUTH_LEVELS) 3262 level = NUM_AUTH_LEVELS; 3263 3264 if (!X509_get_signature_info(cert, NULL, NULL, &secbits, NULL)) 3265 return 0; 3266 3267 return secbits >= minbits_table[level - 1]; 3268 } 3269