/src/openssl/crypto/x509/x509_lu.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <stdio.h> |
11 | | #include "internal/cryptlib.h" |
12 | | #include "internal/refcount.h" |
13 | | #include <openssl/x509.h> |
14 | | #include "crypto/x509.h" |
15 | | #include <openssl/x509v3.h> |
16 | | #include "x509_local.h" |
17 | | |
18 | | X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method) |
19 | 0 | { |
20 | 0 | X509_LOOKUP *ret = OPENSSL_zalloc(sizeof(*ret)); |
21 | |
|
22 | 0 | if (ret == NULL) |
23 | 0 | return NULL; |
24 | | |
25 | 0 | ret->method = method; |
26 | 0 | if (method->new_item != NULL && method->new_item(ret) == 0) { |
27 | 0 | OPENSSL_free(ret); |
28 | 0 | return NULL; |
29 | 0 | } |
30 | 0 | return ret; |
31 | 0 | } |
32 | | |
33 | | void X509_LOOKUP_free(X509_LOOKUP *ctx) |
34 | 0 | { |
35 | 0 | if (ctx == NULL) |
36 | 0 | return; |
37 | 0 | if ((ctx->method != NULL) && (ctx->method->free != NULL)) |
38 | 0 | (*ctx->method->free) (ctx); |
39 | 0 | OPENSSL_free(ctx); |
40 | 0 | } |
41 | | |
42 | | int X509_STORE_lock(X509_STORE *xs) |
43 | 0 | { |
44 | 0 | return CRYPTO_THREAD_write_lock(xs->lock); |
45 | 0 | } |
46 | | |
47 | | static int x509_store_read_lock(X509_STORE *xs) |
48 | 0 | { |
49 | 0 | return CRYPTO_THREAD_read_lock(xs->lock); |
50 | 0 | } |
51 | | |
52 | | int X509_STORE_unlock(X509_STORE *xs) |
53 | 0 | { |
54 | 0 | return CRYPTO_THREAD_unlock(xs->lock); |
55 | 0 | } |
56 | | |
57 | | int X509_LOOKUP_init(X509_LOOKUP *ctx) |
58 | 0 | { |
59 | 0 | if (ctx->method == NULL) |
60 | 0 | return 0; |
61 | 0 | if (ctx->method->init != NULL) |
62 | 0 | return ctx->method->init(ctx); |
63 | 0 | else |
64 | 0 | return 1; |
65 | 0 | } |
66 | | |
67 | | int X509_LOOKUP_shutdown(X509_LOOKUP *ctx) |
68 | 0 | { |
69 | 0 | if (ctx->method == NULL) |
70 | 0 | return 0; |
71 | 0 | if (ctx->method->shutdown != NULL) |
72 | 0 | return ctx->method->shutdown(ctx); |
73 | 0 | else |
74 | 0 | return 1; |
75 | 0 | } |
76 | | |
77 | | int X509_LOOKUP_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
78 | | char **ret, OSSL_LIB_CTX *libctx, const char *propq) |
79 | 0 | { |
80 | 0 | if (ctx->method == NULL) |
81 | 0 | return -1; |
82 | 0 | if (ctx->method->ctrl_ex != NULL) |
83 | 0 | return ctx->method->ctrl_ex(ctx, cmd, argc, argl, ret, libctx, propq); |
84 | 0 | if (ctx->method->ctrl != NULL) |
85 | 0 | return ctx->method->ctrl(ctx, cmd, argc, argl, ret); |
86 | 0 | return 1; |
87 | 0 | } |
88 | | |
89 | | int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
90 | | char **ret) |
91 | 0 | { |
92 | 0 | return X509_LOOKUP_ctrl_ex(ctx, cmd, argc, argl, ret, NULL, NULL); |
93 | 0 | } |
94 | | |
95 | | int X509_LOOKUP_by_subject_ex(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
96 | | const X509_NAME *name, X509_OBJECT *ret, |
97 | | OSSL_LIB_CTX *libctx, const char *propq) |
98 | 0 | { |
99 | 0 | if (ctx->skip |
100 | 0 | || ctx->method == NULL |
101 | 0 | || (ctx->method->get_by_subject == NULL |
102 | 0 | && ctx->method->get_by_subject_ex == NULL)) |
103 | 0 | return 0; |
104 | 0 | if (ctx->method->get_by_subject_ex != NULL) |
105 | 0 | return ctx->method->get_by_subject_ex(ctx, type, name, ret, libctx, |
106 | 0 | propq); |
107 | 0 | else |
108 | 0 | return ctx->method->get_by_subject(ctx, type, name, ret); |
109 | 0 | } |
110 | | |
111 | | int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
112 | | const X509_NAME *name, X509_OBJECT *ret) |
113 | 0 | { |
114 | 0 | return X509_LOOKUP_by_subject_ex(ctx, type, name, ret, NULL, NULL); |
115 | 0 | } |
116 | | |
117 | | int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
118 | | const X509_NAME *name, |
119 | | const ASN1_INTEGER *serial, |
120 | | X509_OBJECT *ret) |
121 | 0 | { |
122 | 0 | if ((ctx->method == NULL) || (ctx->method->get_by_issuer_serial == NULL)) |
123 | 0 | return 0; |
124 | 0 | return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret); |
125 | 0 | } |
126 | | |
127 | | int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
128 | | const unsigned char *bytes, int len, |
129 | | X509_OBJECT *ret) |
130 | 0 | { |
131 | 0 | if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL)) |
132 | 0 | return 0; |
133 | 0 | return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret); |
134 | 0 | } |
135 | | |
136 | | int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
137 | | const char *str, int len, X509_OBJECT *ret) |
138 | 0 | { |
139 | 0 | if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL)) |
140 | 0 | return 0; |
141 | 0 | return ctx->method->get_by_alias(ctx, type, str, len, ret); |
142 | 0 | } |
143 | | |
144 | | int X509_LOOKUP_set_method_data(X509_LOOKUP *ctx, void *data) |
145 | 0 | { |
146 | 0 | ctx->method_data = data; |
147 | 0 | return 1; |
148 | 0 | } |
149 | | |
150 | | void *X509_LOOKUP_get_method_data(const X509_LOOKUP *ctx) |
151 | 0 | { |
152 | 0 | return ctx->method_data; |
153 | 0 | } |
154 | | |
155 | | X509_STORE *X509_LOOKUP_get_store(const X509_LOOKUP *ctx) |
156 | 0 | { |
157 | 0 | return ctx->store_ctx; |
158 | 0 | } |
159 | | |
160 | | static int x509_object_cmp(const X509_OBJECT *const *a, |
161 | | const X509_OBJECT *const *b) |
162 | 0 | { |
163 | 0 | int ret; |
164 | |
|
165 | 0 | ret = ((*a)->type - (*b)->type); |
166 | 0 | if (ret) |
167 | 0 | return ret; |
168 | 0 | switch ((*a)->type) { |
169 | 0 | case X509_LU_X509: |
170 | 0 | ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509); |
171 | 0 | break; |
172 | 0 | case X509_LU_CRL: |
173 | 0 | ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl); |
174 | 0 | break; |
175 | 0 | case X509_LU_NONE: |
176 | | /* abort(); */ |
177 | 0 | return 0; |
178 | 0 | } |
179 | 0 | return ret; |
180 | 0 | } |
181 | | |
182 | | X509_STORE *X509_STORE_new(void) |
183 | 0 | { |
184 | 0 | X509_STORE *ret = OPENSSL_zalloc(sizeof(*ret)); |
185 | |
|
186 | 0 | if (ret == NULL) |
187 | 0 | return NULL; |
188 | 0 | if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL) { |
189 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB); |
190 | 0 | goto err; |
191 | 0 | } |
192 | 0 | ret->cache = 1; |
193 | 0 | if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL) { |
194 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB); |
195 | 0 | goto err; |
196 | 0 | } |
197 | | |
198 | 0 | if ((ret->param = X509_VERIFY_PARAM_new()) == NULL) { |
199 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_X509_LIB); |
200 | 0 | goto err; |
201 | 0 | } |
202 | 0 | if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data)) { |
203 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB); |
204 | 0 | goto err; |
205 | 0 | } |
206 | | |
207 | 0 | ret->lock = CRYPTO_THREAD_lock_new(); |
208 | 0 | if (ret->lock == NULL) { |
209 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB); |
210 | 0 | goto err; |
211 | 0 | } |
212 | | |
213 | 0 | if (!CRYPTO_NEW_REF(&ret->references, 1)) |
214 | 0 | goto err; |
215 | 0 | return ret; |
216 | | |
217 | 0 | err: |
218 | 0 | X509_VERIFY_PARAM_free(ret->param); |
219 | 0 | sk_X509_OBJECT_free(ret->objs); |
220 | 0 | sk_X509_LOOKUP_free(ret->get_cert_methods); |
221 | 0 | CRYPTO_THREAD_lock_free(ret->lock); |
222 | 0 | OPENSSL_free(ret); |
223 | 0 | return NULL; |
224 | 0 | } |
225 | | |
226 | | void X509_STORE_free(X509_STORE *xs) |
227 | 0 | { |
228 | 0 | int i; |
229 | 0 | STACK_OF(X509_LOOKUP) *sk; |
230 | 0 | X509_LOOKUP *lu; |
231 | |
|
232 | 0 | if (xs == NULL) |
233 | 0 | return; |
234 | 0 | CRYPTO_DOWN_REF(&xs->references, &i); |
235 | 0 | REF_PRINT_COUNT("X509_STORE", xs); |
236 | 0 | if (i > 0) |
237 | 0 | return; |
238 | 0 | REF_ASSERT_ISNT(i < 0); |
239 | |
|
240 | 0 | sk = xs->get_cert_methods; |
241 | 0 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { |
242 | 0 | lu = sk_X509_LOOKUP_value(sk, i); |
243 | 0 | X509_LOOKUP_shutdown(lu); |
244 | 0 | X509_LOOKUP_free(lu); |
245 | 0 | } |
246 | 0 | sk_X509_LOOKUP_free(sk); |
247 | 0 | sk_X509_OBJECT_pop_free(xs->objs, X509_OBJECT_free); |
248 | |
|
249 | 0 | CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, xs, &xs->ex_data); |
250 | 0 | X509_VERIFY_PARAM_free(xs->param); |
251 | 0 | CRYPTO_THREAD_lock_free(xs->lock); |
252 | 0 | CRYPTO_FREE_REF(&xs->references); |
253 | 0 | OPENSSL_free(xs); |
254 | 0 | } |
255 | | |
256 | | int X509_STORE_up_ref(X509_STORE *xs) |
257 | 0 | { |
258 | 0 | int i; |
259 | |
|
260 | 0 | if (CRYPTO_UP_REF(&xs->references, &i) <= 0) |
261 | 0 | return 0; |
262 | | |
263 | 0 | REF_PRINT_COUNT("X509_STORE", xs); |
264 | 0 | REF_ASSERT_ISNT(i < 2); |
265 | 0 | return i > 1 ? 1 : 0; |
266 | 0 | } |
267 | | |
268 | | X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *xs, X509_LOOKUP_METHOD *m) |
269 | 0 | { |
270 | 0 | int i; |
271 | 0 | STACK_OF(X509_LOOKUP) *sk; |
272 | 0 | X509_LOOKUP *lu; |
273 | |
|
274 | 0 | sk = xs->get_cert_methods; |
275 | 0 | for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { |
276 | 0 | lu = sk_X509_LOOKUP_value(sk, i); |
277 | 0 | if (m == lu->method) { |
278 | 0 | return lu; |
279 | 0 | } |
280 | 0 | } |
281 | | /* a new one */ |
282 | 0 | lu = X509_LOOKUP_new(m); |
283 | 0 | if (lu == NULL) { |
284 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_X509_LIB); |
285 | 0 | return NULL; |
286 | 0 | } |
287 | | |
288 | 0 | lu->store_ctx = xs; |
289 | 0 | if (sk_X509_LOOKUP_push(xs->get_cert_methods, lu)) |
290 | 0 | return lu; |
291 | | /* sk_X509_LOOKUP_push() failed */ |
292 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB); |
293 | 0 | X509_LOOKUP_free(lu); |
294 | 0 | return NULL; |
295 | 0 | } |
296 | | |
297 | | /* Also fill the cache (ctx->store->objs) with all matching certificates. */ |
298 | | X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *ctx, |
299 | | X509_LOOKUP_TYPE type, |
300 | | const X509_NAME *name) |
301 | 0 | { |
302 | 0 | X509_OBJECT *ret = X509_OBJECT_new(); |
303 | |
|
304 | 0 | if (ret == NULL) |
305 | 0 | return NULL; |
306 | 0 | if (!X509_STORE_CTX_get_by_subject(ctx, type, name, ret)) { |
307 | 0 | X509_OBJECT_free(ret); |
308 | 0 | return NULL; |
309 | 0 | } |
310 | 0 | return ret; |
311 | 0 | } |
312 | | |
313 | | /* |
314 | | * May be called with |ret| == NULL just for the side effect of |
315 | | * caching all certs matching the given subject DN in |ctx->store->objs|. |
316 | | * Returns 1 if successful, |
317 | | * 0 if not found or X509_LOOKUP_by_subject_ex() returns an error, |
318 | | * -1 on failure |
319 | | */ |
320 | | static int ossl_x509_store_ctx_get_by_subject(const X509_STORE_CTX *ctx, |
321 | | X509_LOOKUP_TYPE type, |
322 | | const X509_NAME *name, |
323 | | X509_OBJECT *ret) |
324 | 0 | { |
325 | 0 | X509_STORE *store = ctx->store; |
326 | 0 | X509_LOOKUP *lu; |
327 | 0 | X509_OBJECT stmp, *tmp; |
328 | 0 | int i, j; |
329 | |
|
330 | 0 | if (store == NULL) |
331 | 0 | return 0; |
332 | | |
333 | 0 | stmp.type = X509_LU_NONE; |
334 | 0 | stmp.data.x509 = NULL; |
335 | |
|
336 | 0 | if (!x509_store_read_lock(store)) |
337 | 0 | return 0; |
338 | | /* Should already be sorted...but just in case */ |
339 | 0 | if (!sk_X509_OBJECT_is_sorted(store->objs)) { |
340 | 0 | X509_STORE_unlock(store); |
341 | | /* Take a write lock instead of a read lock */ |
342 | 0 | if (!X509_STORE_lock(store)) |
343 | 0 | return 0; |
344 | | /* |
345 | | * Another thread might have sorted it in the meantime. But if so, |
346 | | * sk_X509_OBJECT_sort() exits early. |
347 | | */ |
348 | 0 | sk_X509_OBJECT_sort(store->objs); |
349 | 0 | } |
350 | 0 | tmp = X509_OBJECT_retrieve_by_subject(store->objs, type, name); |
351 | 0 | X509_STORE_unlock(store); |
352 | |
|
353 | 0 | if (tmp == NULL || type == X509_LU_CRL) { |
354 | 0 | for (i = 0; i < sk_X509_LOOKUP_num(store->get_cert_methods); i++) { |
355 | 0 | lu = sk_X509_LOOKUP_value(store->get_cert_methods, i); |
356 | 0 | if (lu->skip) |
357 | 0 | continue; |
358 | 0 | if (lu->method == NULL) |
359 | 0 | return -1; |
360 | 0 | j = X509_LOOKUP_by_subject_ex(lu, type, name, &stmp, |
361 | 0 | ctx->libctx, ctx->propq); |
362 | 0 | if (j != 0) { /* non-zero value is considered success here */ |
363 | 0 | tmp = &stmp; |
364 | 0 | break; |
365 | 0 | } |
366 | 0 | } |
367 | 0 | if (tmp == NULL) |
368 | 0 | return 0; |
369 | 0 | } |
370 | | |
371 | 0 | if (ret != NULL) { |
372 | 0 | if (!X509_OBJECT_up_ref_count(tmp)) |
373 | 0 | return -1; |
374 | 0 | ret->type = tmp->type; |
375 | 0 | ret->data = tmp->data; |
376 | 0 | } |
377 | 0 | return 1; |
378 | 0 | } |
379 | | |
380 | | /* Also fill the cache |ctx->store->objs| with all matching certificates. */ |
381 | | int X509_STORE_CTX_get_by_subject(const X509_STORE_CTX *ctx, |
382 | | X509_LOOKUP_TYPE type, |
383 | | const X509_NAME *name, X509_OBJECT *ret) |
384 | 0 | { |
385 | 0 | return ossl_x509_store_ctx_get_by_subject(ctx, type, name, ret) > 0; |
386 | 0 | } |
387 | | |
388 | | static int x509_store_add(X509_STORE *store, void *x, int crl) |
389 | 0 | { |
390 | 0 | X509_OBJECT *obj; |
391 | 0 | int ret = 0, added = 0; |
392 | |
|
393 | 0 | if (x == NULL) |
394 | 0 | return 0; |
395 | 0 | obj = X509_OBJECT_new(); |
396 | 0 | if (obj == NULL) |
397 | 0 | return 0; |
398 | | |
399 | 0 | if (crl) { |
400 | 0 | obj->type = X509_LU_CRL; |
401 | 0 | obj->data.crl = (X509_CRL *)x; |
402 | 0 | } else { |
403 | 0 | obj->type = X509_LU_X509; |
404 | 0 | obj->data.x509 = (X509 *)x; |
405 | 0 | } |
406 | 0 | if (!X509_OBJECT_up_ref_count(obj)) { |
407 | 0 | obj->type = X509_LU_NONE; |
408 | 0 | X509_OBJECT_free(obj); |
409 | 0 | return 0; |
410 | 0 | } |
411 | | |
412 | 0 | if (!X509_STORE_lock(store)) { |
413 | 0 | obj->type = X509_LU_NONE; |
414 | 0 | X509_OBJECT_free(obj); |
415 | 0 | return 0; |
416 | 0 | } |
417 | | |
418 | 0 | if (X509_OBJECT_retrieve_match(store->objs, obj)) { |
419 | 0 | ret = 1; |
420 | 0 | } else { |
421 | 0 | added = sk_X509_OBJECT_push(store->objs, obj); |
422 | 0 | ret = added != 0; |
423 | 0 | } |
424 | 0 | X509_STORE_unlock(store); |
425 | |
|
426 | 0 | if (added == 0) /* obj not pushed */ |
427 | 0 | X509_OBJECT_free(obj); |
428 | |
|
429 | 0 | return ret; |
430 | 0 | } |
431 | | |
432 | | int X509_STORE_add_cert(X509_STORE *xs, X509 *x) |
433 | 0 | { |
434 | 0 | if (!x509_store_add(xs, x, 0)) { |
435 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_X509_LIB); |
436 | 0 | return 0; |
437 | 0 | } |
438 | 0 | return 1; |
439 | 0 | } |
440 | | |
441 | | int X509_STORE_add_crl(X509_STORE *xs, X509_CRL *x) |
442 | 0 | { |
443 | 0 | if (!x509_store_add(xs, x, 1)) { |
444 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_X509_LIB); |
445 | 0 | return 0; |
446 | 0 | } |
447 | 0 | return 1; |
448 | 0 | } |
449 | | |
450 | | int X509_OBJECT_up_ref_count(X509_OBJECT *a) |
451 | 0 | { |
452 | 0 | switch (a->type) { |
453 | 0 | case X509_LU_NONE: |
454 | 0 | break; |
455 | 0 | case X509_LU_X509: |
456 | 0 | return X509_up_ref(a->data.x509); |
457 | 0 | case X509_LU_CRL: |
458 | 0 | return X509_CRL_up_ref(a->data.crl); |
459 | 0 | } |
460 | 0 | return 1; |
461 | 0 | } |
462 | | |
463 | | X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a) |
464 | 0 | { |
465 | 0 | if (a == NULL || a->type != X509_LU_X509) |
466 | 0 | return NULL; |
467 | 0 | return a->data.x509; |
468 | 0 | } |
469 | | |
470 | | X509_CRL *X509_OBJECT_get0_X509_CRL(const X509_OBJECT *a) |
471 | 0 | { |
472 | 0 | if (a == NULL || a->type != X509_LU_CRL) |
473 | 0 | return NULL; |
474 | 0 | return a->data.crl; |
475 | 0 | } |
476 | | |
477 | | X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a) |
478 | 0 | { |
479 | 0 | return a->type; |
480 | 0 | } |
481 | | |
482 | | X509_OBJECT *X509_OBJECT_new(void) |
483 | 0 | { |
484 | 0 | X509_OBJECT *ret = OPENSSL_zalloc(sizeof(*ret)); |
485 | |
|
486 | 0 | if (ret == NULL) |
487 | 0 | return NULL; |
488 | 0 | ret->type = X509_LU_NONE; |
489 | 0 | return ret; |
490 | 0 | } |
491 | | |
492 | | static void x509_object_free_internal(X509_OBJECT *a) |
493 | 0 | { |
494 | 0 | if (a == NULL) |
495 | 0 | return; |
496 | 0 | switch (a->type) { |
497 | 0 | case X509_LU_NONE: |
498 | 0 | break; |
499 | 0 | case X509_LU_X509: |
500 | 0 | X509_free(a->data.x509); |
501 | 0 | break; |
502 | 0 | case X509_LU_CRL: |
503 | 0 | X509_CRL_free(a->data.crl); |
504 | 0 | break; |
505 | 0 | } |
506 | 0 | } |
507 | | |
508 | | int X509_OBJECT_set1_X509(X509_OBJECT *a, X509 *obj) |
509 | 0 | { |
510 | 0 | if (a == NULL || !X509_up_ref(obj)) |
511 | 0 | return 0; |
512 | | |
513 | 0 | x509_object_free_internal(a); |
514 | 0 | a->type = X509_LU_X509; |
515 | 0 | a->data.x509 = obj; |
516 | 0 | return 1; |
517 | 0 | } |
518 | | |
519 | | int X509_OBJECT_set1_X509_CRL(X509_OBJECT *a, X509_CRL *obj) |
520 | 0 | { |
521 | 0 | if (a == NULL || !X509_CRL_up_ref(obj)) |
522 | 0 | return 0; |
523 | | |
524 | 0 | x509_object_free_internal(a); |
525 | 0 | a->type = X509_LU_CRL; |
526 | 0 | a->data.crl = obj; |
527 | 0 | return 1; |
528 | 0 | } |
529 | | |
530 | | void X509_OBJECT_free(X509_OBJECT *a) |
531 | 0 | { |
532 | 0 | x509_object_free_internal(a); |
533 | 0 | OPENSSL_free(a); |
534 | 0 | } |
535 | | |
536 | | /* Returns -1 if not found, but also on error */ |
537 | | static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
538 | | const X509_NAME *name, int *pnmatch) |
539 | 0 | { |
540 | 0 | X509_OBJECT stmp; |
541 | 0 | X509 x509_s; |
542 | 0 | X509_CRL crl_s; |
543 | |
|
544 | 0 | stmp.type = type; |
545 | 0 | switch (type) { |
546 | 0 | case X509_LU_X509: |
547 | 0 | stmp.data.x509 = &x509_s; |
548 | 0 | x509_s.cert_info.subject = (X509_NAME *)name; /* won't modify it */ |
549 | 0 | break; |
550 | 0 | case X509_LU_CRL: |
551 | 0 | stmp.data.crl = &crl_s; |
552 | 0 | crl_s.crl.issuer = (X509_NAME *)name; /* won't modify it */ |
553 | 0 | break; |
554 | 0 | case X509_LU_NONE: |
555 | 0 | default: |
556 | | /* abort(); */ |
557 | 0 | return -1; |
558 | 0 | } |
559 | | |
560 | | /* Assumes h is locked for read if applicable */ |
561 | 0 | return sk_X509_OBJECT_find_all(h, &stmp, pnmatch); |
562 | 0 | } |
563 | | |
564 | | /* Assumes h is locked for read if applicable */ |
565 | | int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, |
566 | | const X509_NAME *name) |
567 | 0 | { |
568 | 0 | return x509_object_idx_cnt(h, type, name, NULL); |
569 | 0 | } |
570 | | |
571 | | /* Assumes h is locked for read if applicable */ |
572 | | X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, |
573 | | X509_LOOKUP_TYPE type, |
574 | | const X509_NAME *name) |
575 | 0 | { |
576 | 0 | int idx = X509_OBJECT_idx_by_subject(h, type, name); |
577 | |
|
578 | 0 | if (idx == -1) |
579 | 0 | return NULL; |
580 | 0 | return sk_X509_OBJECT_value(h, idx); |
581 | 0 | } |
582 | | |
583 | | STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(const X509_STORE *xs) |
584 | 0 | { |
585 | 0 | return xs->objs; |
586 | 0 | } |
587 | | |
588 | | static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj) |
589 | 0 | { |
590 | 0 | X509_OBJECT *ret = X509_OBJECT_new(); |
591 | 0 | if (ret == NULL) |
592 | 0 | return NULL; |
593 | | |
594 | 0 | ret->type = obj->type; |
595 | 0 | ret->data = obj->data; |
596 | 0 | X509_OBJECT_up_ref_count(ret); |
597 | 0 | return ret; |
598 | 0 | } |
599 | | |
600 | | STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *store) |
601 | 0 | { |
602 | 0 | STACK_OF(X509_OBJECT) *objs; |
603 | |
|
604 | 0 | if (store == NULL) { |
605 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER); |
606 | 0 | return NULL; |
607 | 0 | } |
608 | | |
609 | 0 | if (!x509_store_read_lock(store)) |
610 | 0 | return NULL; |
611 | | |
612 | 0 | objs = sk_X509_OBJECT_deep_copy(store->objs, x509_object_dup, |
613 | 0 | X509_OBJECT_free); |
614 | 0 | X509_STORE_unlock(store); |
615 | 0 | return objs; |
616 | 0 | } |
617 | | |
618 | | STACK_OF(X509) *X509_STORE_get1_all_certs(X509_STORE *store) |
619 | 0 | { |
620 | 0 | STACK_OF(X509) *sk; |
621 | 0 | STACK_OF(X509_OBJECT) *objs; |
622 | 0 | int i; |
623 | |
|
624 | 0 | if (store == NULL) { |
625 | 0 | ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER); |
626 | 0 | return NULL; |
627 | 0 | } |
628 | 0 | if ((sk = sk_X509_new_null()) == NULL) |
629 | 0 | return NULL; |
630 | 0 | if (!X509_STORE_lock(store)) |
631 | 0 | goto out_free; |
632 | | |
633 | 0 | sk_X509_OBJECT_sort(store->objs); |
634 | 0 | objs = X509_STORE_get0_objects(store); |
635 | 0 | for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { |
636 | 0 | X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(objs, i)); |
637 | |
|
638 | 0 | if (cert != NULL |
639 | 0 | && !X509_add_cert(sk, cert, X509_ADD_FLAG_UP_REF)) |
640 | 0 | goto err; |
641 | 0 | } |
642 | 0 | X509_STORE_unlock(store); |
643 | 0 | return sk; |
644 | | |
645 | 0 | err: |
646 | 0 | X509_STORE_unlock(store); |
647 | 0 | out_free: |
648 | 0 | OSSL_STACK_OF_X509_free(sk); |
649 | 0 | return NULL; |
650 | 0 | } |
651 | | |
652 | | /*- |
653 | | * Collect from |ctx->store| all certs with subject matching |nm|. |
654 | | * Returns NULL on internal/fatal error, empty stack if not found. |
655 | | */ |
656 | | STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *ctx, |
657 | | const X509_NAME *nm) |
658 | 0 | { |
659 | 0 | int i, idx, cnt; |
660 | 0 | STACK_OF(X509) *sk = NULL; |
661 | 0 | X509 *x; |
662 | 0 | X509_OBJECT *obj; |
663 | 0 | X509_STORE *store = ctx->store; |
664 | |
|
665 | 0 | if (store == NULL) |
666 | 0 | return sk_X509_new_null(); |
667 | | |
668 | 0 | if (!X509_STORE_lock(store)) |
669 | 0 | return NULL; |
670 | | |
671 | 0 | sk_X509_OBJECT_sort(store->objs); |
672 | 0 | idx = x509_object_idx_cnt(store->objs, X509_LU_X509, nm, &cnt); |
673 | 0 | if (idx < 0) { |
674 | | /* |
675 | | * Nothing found in cache: do lookup to possibly add new objects to |
676 | | * cache |
677 | | */ |
678 | 0 | X509_STORE_unlock(store); |
679 | 0 | i = ossl_x509_store_ctx_get_by_subject(ctx, X509_LU_X509, nm, NULL); |
680 | 0 | if (i <= 0) |
681 | 0 | return i < 0 ? NULL : sk_X509_new_null(); |
682 | 0 | if (!X509_STORE_lock(store)) |
683 | 0 | return NULL; |
684 | 0 | sk_X509_OBJECT_sort(store->objs); |
685 | 0 | idx = x509_object_idx_cnt(store->objs, X509_LU_X509, nm, &cnt); |
686 | 0 | } |
687 | | |
688 | 0 | sk = sk_X509_new_null(); |
689 | 0 | if (idx < 0 || sk == NULL) |
690 | 0 | goto end; |
691 | 0 | for (i = 0; i < cnt; i++, idx++) { |
692 | 0 | obj = sk_X509_OBJECT_value(store->objs, idx); |
693 | 0 | x = obj->data.x509; |
694 | 0 | if (!X509_add_cert(sk, x, X509_ADD_FLAG_UP_REF)) { |
695 | 0 | X509_STORE_unlock(store); |
696 | 0 | OSSL_STACK_OF_X509_free(sk); |
697 | 0 | return NULL; |
698 | 0 | } |
699 | 0 | } |
700 | 0 | end: |
701 | 0 | X509_STORE_unlock(store); |
702 | 0 | return sk; |
703 | 0 | } |
704 | | |
705 | | /* Returns NULL on internal/fatal error, empty stack if not found */ |
706 | | STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(const X509_STORE_CTX *ctx, |
707 | | const X509_NAME *nm) |
708 | 0 | { |
709 | 0 | int i = 1, idx, cnt; |
710 | 0 | STACK_OF(X509_CRL) *sk; |
711 | 0 | X509_CRL *x; |
712 | 0 | X509_OBJECT *obj; |
713 | 0 | X509_STORE *store = ctx->store; |
714 | | |
715 | | /* Always do lookup to possibly add new CRLs to cache */ |
716 | 0 | i = ossl_x509_store_ctx_get_by_subject(ctx, X509_LU_CRL, nm, NULL); |
717 | 0 | if (i < 0) |
718 | 0 | return NULL; |
719 | 0 | sk = sk_X509_CRL_new_null(); |
720 | 0 | if (i == 0) |
721 | 0 | return sk; |
722 | 0 | if (!X509_STORE_lock(store)) { |
723 | 0 | sk_X509_CRL_free(sk); |
724 | 0 | return NULL; |
725 | 0 | } |
726 | 0 | sk_X509_OBJECT_sort(store->objs); |
727 | 0 | idx = x509_object_idx_cnt(store->objs, X509_LU_CRL, nm, &cnt); |
728 | 0 | if (idx < 0) { |
729 | 0 | X509_STORE_unlock(store); |
730 | 0 | return sk; |
731 | 0 | } |
732 | | |
733 | 0 | for (i = 0; i < cnt; i++, idx++) { |
734 | 0 | obj = sk_X509_OBJECT_value(store->objs, idx); |
735 | 0 | x = obj->data.crl; |
736 | 0 | if (!X509_CRL_up_ref(x)) { |
737 | 0 | X509_STORE_unlock(store); |
738 | 0 | sk_X509_CRL_pop_free(sk, X509_CRL_free); |
739 | 0 | return NULL; |
740 | 0 | } |
741 | 0 | if (!sk_X509_CRL_push(sk, x)) { |
742 | 0 | X509_STORE_unlock(store); |
743 | 0 | X509_CRL_free(x); |
744 | 0 | sk_X509_CRL_pop_free(sk, X509_CRL_free); |
745 | 0 | return NULL; |
746 | 0 | } |
747 | 0 | } |
748 | 0 | X509_STORE_unlock(store); |
749 | 0 | return sk; |
750 | 0 | } |
751 | | |
752 | | X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, |
753 | | X509_OBJECT *x) |
754 | 0 | { |
755 | 0 | int idx, i, num; |
756 | 0 | X509_OBJECT *obj; |
757 | |
|
758 | 0 | idx = sk_X509_OBJECT_find(h, x); |
759 | 0 | if (idx < 0) |
760 | 0 | return NULL; |
761 | 0 | if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL)) |
762 | 0 | return sk_X509_OBJECT_value(h, idx); |
763 | 0 | for (i = idx, num = sk_X509_OBJECT_num(h); i < num; i++) { |
764 | 0 | obj = sk_X509_OBJECT_value(h, i); |
765 | 0 | if (x509_object_cmp((const X509_OBJECT **)&obj, |
766 | 0 | (const X509_OBJECT **)&x)) |
767 | 0 | return NULL; |
768 | 0 | if (x->type == X509_LU_X509) { |
769 | 0 | if (!X509_cmp(obj->data.x509, x->data.x509)) |
770 | 0 | return obj; |
771 | 0 | } else if (x->type == X509_LU_CRL) { |
772 | 0 | if (X509_CRL_match(obj->data.crl, x->data.crl) == 0) |
773 | 0 | return obj; |
774 | 0 | } else { |
775 | 0 | return obj; |
776 | 0 | } |
777 | 0 | } |
778 | 0 | return NULL; |
779 | 0 | } |
780 | | |
781 | | int X509_STORE_set_flags(X509_STORE *xs, unsigned long flags) |
782 | 0 | { |
783 | 0 | return X509_VERIFY_PARAM_set_flags(xs->param, flags); |
784 | 0 | } |
785 | | |
786 | | int X509_STORE_set_depth(X509_STORE *xs, int depth) |
787 | 0 | { |
788 | 0 | X509_VERIFY_PARAM_set_depth(xs->param, depth); |
789 | 0 | return 1; |
790 | 0 | } |
791 | | |
792 | | int X509_STORE_set_purpose(X509_STORE *xs, int purpose) |
793 | 0 | { |
794 | 0 | return X509_VERIFY_PARAM_set_purpose(xs->param, purpose); |
795 | 0 | } |
796 | | |
797 | | int X509_STORE_set_trust(X509_STORE *xs, int trust) |
798 | 0 | { |
799 | 0 | return X509_VERIFY_PARAM_set_trust(xs->param, trust); |
800 | 0 | } |
801 | | |
802 | | int X509_STORE_set1_param(X509_STORE *xs, const X509_VERIFY_PARAM *param) |
803 | 0 | { |
804 | 0 | return X509_VERIFY_PARAM_set1(xs->param, param); |
805 | 0 | } |
806 | | |
807 | | X509_VERIFY_PARAM *X509_STORE_get0_param(const X509_STORE *xs) |
808 | 0 | { |
809 | 0 | return xs->param; |
810 | 0 | } |
811 | | |
812 | | void X509_STORE_set_verify(X509_STORE *xs, X509_STORE_CTX_verify_fn verify) |
813 | 0 | { |
814 | 0 | xs->verify = verify; |
815 | 0 | } |
816 | | |
817 | | X509_STORE_CTX_verify_fn X509_STORE_get_verify(const X509_STORE *xs) |
818 | 0 | { |
819 | 0 | return xs->verify; |
820 | 0 | } |
821 | | |
822 | | void X509_STORE_set_verify_cb(X509_STORE *xs, |
823 | | X509_STORE_CTX_verify_cb verify_cb) |
824 | 0 | { |
825 | 0 | xs->verify_cb = verify_cb; |
826 | 0 | } |
827 | | |
828 | | X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(const X509_STORE *xs) |
829 | 0 | { |
830 | 0 | return xs->verify_cb; |
831 | 0 | } |
832 | | |
833 | | void X509_STORE_set_get_issuer(X509_STORE *xs, |
834 | | X509_STORE_CTX_get_issuer_fn get_issuer) |
835 | 0 | { |
836 | 0 | xs->get_issuer = get_issuer; |
837 | 0 | } |
838 | | |
839 | | X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(const X509_STORE *xs) |
840 | 0 | { |
841 | 0 | return xs->get_issuer; |
842 | 0 | } |
843 | | |
844 | | void X509_STORE_set_check_issued(X509_STORE *xs, |
845 | | X509_STORE_CTX_check_issued_fn check_issued) |
846 | 0 | { |
847 | 0 | xs->check_issued = check_issued; |
848 | 0 | } |
849 | | |
850 | | X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(const X509_STORE *xs) |
851 | 0 | { |
852 | 0 | return xs->check_issued; |
853 | 0 | } |
854 | | |
855 | | void X509_STORE_set_check_revocation(X509_STORE *xs, |
856 | | X509_STORE_CTX_check_revocation_fn cb) |
857 | 0 | { |
858 | 0 | xs->check_revocation = cb; |
859 | 0 | } |
860 | | |
861 | | X509_STORE_CTX_check_revocation_fn X509_STORE_get_check_revocation(const X509_STORE *xs) |
862 | 0 | { |
863 | 0 | return xs->check_revocation; |
864 | 0 | } |
865 | | |
866 | | void X509_STORE_set_get_crl(X509_STORE *xs, |
867 | | X509_STORE_CTX_get_crl_fn get_crl) |
868 | 0 | { |
869 | 0 | xs->get_crl = get_crl; |
870 | 0 | } |
871 | | |
872 | | X509_STORE_CTX_get_crl_fn X509_STORE_get_get_crl(const X509_STORE *xs) |
873 | 0 | { |
874 | 0 | return xs->get_crl; |
875 | 0 | } |
876 | | |
877 | | void X509_STORE_set_check_crl(X509_STORE *xs, |
878 | | X509_STORE_CTX_check_crl_fn check_crl) |
879 | 0 | { |
880 | 0 | xs->check_crl = check_crl; |
881 | 0 | } |
882 | | |
883 | | X509_STORE_CTX_check_crl_fn X509_STORE_get_check_crl(const X509_STORE *xs) |
884 | 0 | { |
885 | 0 | return xs->check_crl; |
886 | 0 | } |
887 | | |
888 | | void X509_STORE_set_cert_crl(X509_STORE *xs, |
889 | | X509_STORE_CTX_cert_crl_fn cert_crl) |
890 | 0 | { |
891 | 0 | xs->cert_crl = cert_crl; |
892 | 0 | } |
893 | | |
894 | | X509_STORE_CTX_cert_crl_fn X509_STORE_get_cert_crl(const X509_STORE *xs) |
895 | 0 | { |
896 | 0 | return xs->cert_crl; |
897 | 0 | } |
898 | | |
899 | | void X509_STORE_set_check_policy(X509_STORE *xs, |
900 | | X509_STORE_CTX_check_policy_fn check_policy) |
901 | 0 | { |
902 | 0 | xs->check_policy = check_policy; |
903 | 0 | } |
904 | | |
905 | | X509_STORE_CTX_check_policy_fn X509_STORE_get_check_policy(const X509_STORE *xs) |
906 | 0 | { |
907 | 0 | return xs->check_policy; |
908 | 0 | } |
909 | | |
910 | | void X509_STORE_set_lookup_certs(X509_STORE *xs, |
911 | | X509_STORE_CTX_lookup_certs_fn lookup_certs) |
912 | 0 | { |
913 | 0 | xs->lookup_certs = lookup_certs; |
914 | 0 | } |
915 | | |
916 | | X509_STORE_CTX_lookup_certs_fn X509_STORE_get_lookup_certs(const X509_STORE *xs) |
917 | 0 | { |
918 | 0 | return xs->lookup_certs; |
919 | 0 | } |
920 | | |
921 | | void X509_STORE_set_lookup_crls(X509_STORE *xs, |
922 | | X509_STORE_CTX_lookup_crls_fn lookup_crls) |
923 | 0 | { |
924 | 0 | xs->lookup_crls = lookup_crls; |
925 | 0 | } |
926 | | |
927 | | X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(const X509_STORE *xs) |
928 | 0 | { |
929 | 0 | return xs->lookup_crls; |
930 | 0 | } |
931 | | |
932 | | void X509_STORE_set_cleanup(X509_STORE *xs, |
933 | | X509_STORE_CTX_cleanup_fn cleanup) |
934 | 0 | { |
935 | 0 | xs->cleanup = cleanup; |
936 | 0 | } |
937 | | |
938 | | X509_STORE_CTX_cleanup_fn X509_STORE_get_cleanup(const X509_STORE *xs) |
939 | 0 | { |
940 | 0 | return xs->cleanup; |
941 | 0 | } |
942 | | |
943 | | int X509_STORE_set_ex_data(X509_STORE *xs, int idx, void *data) |
944 | 0 | { |
945 | 0 | return CRYPTO_set_ex_data(&xs->ex_data, idx, data); |
946 | 0 | } |
947 | | |
948 | | void *X509_STORE_get_ex_data(const X509_STORE *xs, int idx) |
949 | 0 | { |
950 | 0 | return CRYPTO_get_ex_data(&xs->ex_data, idx); |
951 | 0 | } |
952 | | |
953 | | X509_STORE *X509_STORE_CTX_get0_store(const X509_STORE_CTX *ctx) |
954 | 0 | { |
955 | 0 | return ctx->store; |
956 | 0 | } |