Line data Source code
1 : /*
2 : * ! \file ssl/ssl_cert.c
3 : */
4 : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 : * All rights reserved.
6 : *
7 : * This package is an SSL implementation written
8 : * by Eric Young (eay@cryptsoft.com).
9 : * The implementation was written so as to conform with Netscapes SSL.
10 : *
11 : * This library is free for commercial and non-commercial use as long as
12 : * the following conditions are aheared to. The following conditions
13 : * apply to all code found in this distribution, be it the RC4, RSA,
14 : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
15 : * included with this distribution is covered by the same copyright terms
16 : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
17 : *
18 : * Copyright remains Eric Young's, and as such any Copyright notices in
19 : * the code are not to be removed.
20 : * If this package is used in a product, Eric Young should be given attribution
21 : * as the author of the parts of the library used.
22 : * This can be in the form of a textual message at program startup or
23 : * in documentation (online or textual) provided with the package.
24 : *
25 : * Redistribution and use in source and binary forms, with or without
26 : * modification, are permitted provided that the following conditions
27 : * are met:
28 : * 1. Redistributions of source code must retain the copyright
29 : * notice, this list of conditions and the following disclaimer.
30 : * 2. Redistributions in binary form must reproduce the above copyright
31 : * notice, this list of conditions and the following disclaimer in the
32 : * documentation and/or other materials provided with the distribution.
33 : * 3. All advertising materials mentioning features or use of this software
34 : * must display the following acknowledgement:
35 : * "This product includes cryptographic software written by
36 : * Eric Young (eay@cryptsoft.com)"
37 : * The word 'cryptographic' can be left out if the rouines from the library
38 : * being used are not cryptographic related :-).
39 : * 4. If you include any Windows specific code (or a derivative thereof) from
40 : * the apps directory (application code) you must include an acknowledgement:
41 : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
42 : *
43 : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
44 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
47 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 : * SUCH DAMAGE.
54 : *
55 : * The licence and distribution terms for any publically available version or
56 : * derivative of this code cannot be changed. i.e. this code cannot simply be
57 : * copied and put under another distribution licence
58 : * [including the GNU Public Licence.]
59 : */
60 : /* ====================================================================
61 : * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
62 : *
63 : * Redistribution and use in source and binary forms, with or without
64 : * modification, are permitted provided that the following conditions
65 : * are met:
66 : *
67 : * 1. Redistributions of source code must retain the above copyright
68 : * notice, this list of conditions and the following disclaimer.
69 : *
70 : * 2. Redistributions in binary form must reproduce the above copyright
71 : * notice, this list of conditions and the following disclaimer in
72 : * the documentation and/or other materials provided with the
73 : * distribution.
74 : *
75 : * 3. All advertising materials mentioning features or use of this
76 : * software must display the following acknowledgment:
77 : * "This product includes software developed by the OpenSSL Project
78 : * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
79 : *
80 : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
81 : * endorse or promote products derived from this software without
82 : * prior written permission. For written permission, please contact
83 : * openssl-core@openssl.org.
84 : *
85 : * 5. Products derived from this software may not be called "OpenSSL"
86 : * nor may "OpenSSL" appear in their names without prior written
87 : * permission of the OpenSSL Project.
88 : *
89 : * 6. Redistributions of any form whatsoever must retain the following
90 : * acknowledgment:
91 : * "This product includes software developed by the OpenSSL Project
92 : * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
93 : *
94 : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
95 : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
96 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
97 : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
98 : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
99 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
100 : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
101 : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
102 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
103 : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
104 : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
105 : * OF THE POSSIBILITY OF SUCH DAMAGE.
106 : * ====================================================================
107 : *
108 : * This product includes cryptographic software written by Eric Young
109 : * (eay@cryptsoft.com). This product includes software written by Tim
110 : * Hudson (tjh@cryptsoft.com).
111 : *
112 : */
113 : /* ====================================================================
114 : * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
115 : * ECC cipher suite support in OpenSSL originally developed by
116 : * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
117 : */
118 :
119 : #include <stdio.h>
120 :
121 : #include "e_os.h"
122 : #ifndef NO_SYS_TYPES_H
123 : # include <sys/types.h>
124 : #endif
125 :
126 : #include "o_dir.h"
127 : #include <openssl/objects.h>
128 : #include <openssl/bio.h>
129 : #include <openssl/pem.h>
130 : #include <openssl/x509v3.h>
131 : #ifndef OPENSSL_NO_DH
132 : # include <openssl/dh.h>
133 : #endif
134 : #include <openssl/bn.h>
135 : #include "ssl_locl.h"
136 :
137 1242 : int SSL_get_ex_data_X509_STORE_CTX_idx(void)
138 : {
139 : static volatile int ssl_x509_store_ctx_idx = -1;
140 : int got_write_lock = 0;
141 :
142 : if (((size_t)&ssl_x509_store_ctx_idx &
143 : (sizeof(ssl_x509_store_ctx_idx) - 1))
144 : == 0) { /* check alignment, practically always true */
145 : int ret;
146 :
147 1242 : if ((ret = ssl_x509_store_ctx_idx) < 0) {
148 121 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
149 121 : if ((ret = ssl_x509_store_ctx_idx) < 0) {
150 121 : ret = ssl_x509_store_ctx_idx =
151 121 : X509_STORE_CTX_get_ex_new_index(0,
152 : "SSL for verify callback",
153 : NULL, NULL, NULL);
154 : }
155 121 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
156 : }
157 :
158 : return ret;
159 : } else { /* commonly eliminated */
160 :
161 : CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
162 :
163 : if (ssl_x509_store_ctx_idx < 0) {
164 : CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
165 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
166 : got_write_lock = 1;
167 :
168 : if (ssl_x509_store_ctx_idx < 0) {
169 : ssl_x509_store_ctx_idx =
170 : X509_STORE_CTX_get_ex_new_index(0,
171 : "SSL for verify callback",
172 : NULL, NULL, NULL);
173 : }
174 : }
175 :
176 : if (got_write_lock)
177 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
178 : else
179 : CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
180 :
181 : return ssl_x509_store_ctx_idx;
182 : }
183 : }
184 :
185 1622 : void ssl_cert_set_default_md(CERT *cert)
186 : {
187 : /* Set digest values to defaults */
188 : #ifndef OPENSSL_NO_DSA
189 1622 : cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
190 : #endif
191 : #ifndef OPENSSL_NO_RSA
192 1622 : cert->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
193 1622 : cert->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
194 : #endif
195 : #ifndef OPENSSL_NO_ECDSA
196 1622 : cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
197 : #endif
198 1622 : }
199 :
200 872 : CERT *ssl_cert_new(void)
201 : {
202 : CERT *ret;
203 :
204 872 : ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
205 872 : if (ret == NULL) {
206 0 : SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
207 0 : return (NULL);
208 : }
209 : memset(ret, 0, sizeof(CERT));
210 :
211 872 : ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
212 872 : ret->references = 1;
213 872 : ssl_cert_set_default_md(ret);
214 872 : return (ret);
215 : }
216 :
217 750 : CERT *ssl_cert_dup(CERT *cert)
218 : {
219 : CERT *ret;
220 : int i;
221 :
222 750 : ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
223 750 : if (ret == NULL) {
224 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
225 0 : return (NULL);
226 : }
227 :
228 : memset(ret, 0, sizeof(CERT));
229 :
230 750 : ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
231 : /*
232 : * or ret->key = ret->pkeys + (cert->key - cert->pkeys), if you find that
233 : * more readable
234 : */
235 :
236 750 : ret->valid = cert->valid;
237 750 : ret->mask_k = cert->mask_k;
238 750 : ret->mask_a = cert->mask_a;
239 750 : ret->export_mask_k = cert->export_mask_k;
240 750 : ret->export_mask_a = cert->export_mask_a;
241 :
242 : #ifndef OPENSSL_NO_RSA
243 750 : if (cert->rsa_tmp != NULL) {
244 0 : RSA_up_ref(cert->rsa_tmp);
245 0 : ret->rsa_tmp = cert->rsa_tmp;
246 : }
247 750 : ret->rsa_tmp_cb = cert->rsa_tmp_cb;
248 : #endif
249 :
250 : #ifndef OPENSSL_NO_DH
251 750 : if (cert->dh_tmp != NULL) {
252 0 : ret->dh_tmp = DHparams_dup(cert->dh_tmp);
253 0 : if (ret->dh_tmp == NULL) {
254 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB);
255 0 : goto err;
256 : }
257 0 : if (cert->dh_tmp->priv_key) {
258 0 : BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
259 0 : if (!b) {
260 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
261 0 : goto err;
262 : }
263 0 : ret->dh_tmp->priv_key = b;
264 : }
265 0 : if (cert->dh_tmp->pub_key) {
266 0 : BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
267 0 : if (!b) {
268 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
269 0 : goto err;
270 : }
271 0 : ret->dh_tmp->pub_key = b;
272 : }
273 : }
274 750 : ret->dh_tmp_cb = cert->dh_tmp_cb;
275 : #endif
276 :
277 : #ifndef OPENSSL_NO_ECDH
278 750 : if (cert->ecdh_tmp) {
279 750 : ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
280 749 : if (ret->ecdh_tmp == NULL) {
281 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
282 0 : goto err;
283 : }
284 : }
285 749 : ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
286 749 : ret->ecdh_tmp_auto = cert->ecdh_tmp_auto;
287 : #endif
288 :
289 6749 : for (i = 0; i < SSL_PKEY_NUM; i++) {
290 5999 : CERT_PKEY *cpk = cert->pkeys + i;
291 5999 : CERT_PKEY *rpk = ret->pkeys + i;
292 5999 : if (cpk->x509 != NULL) {
293 377 : rpk->x509 = cpk->x509;
294 377 : CRYPTO_add(&rpk->x509->references, 1, CRYPTO_LOCK_X509);
295 : }
296 :
297 6000 : if (cpk->privatekey != NULL) {
298 377 : rpk->privatekey = cpk->privatekey;
299 377 : CRYPTO_add(&cpk->privatekey->references, 1, CRYPTO_LOCK_EVP_PKEY);
300 : }
301 :
302 6000 : if (cpk->chain) {
303 0 : rpk->chain = X509_chain_up_ref(cpk->chain);
304 0 : if (!rpk->chain) {
305 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
306 0 : goto err;
307 : }
308 : }
309 6000 : rpk->valid_flags = 0;
310 : #ifndef OPENSSL_NO_TLSEXT
311 6000 : if (cert->pkeys[i].serverinfo != NULL) {
312 : /* Just copy everything. */
313 0 : ret->pkeys[i].serverinfo =
314 0 : OPENSSL_malloc(cert->pkeys[i].serverinfo_length);
315 0 : if (ret->pkeys[i].serverinfo == NULL) {
316 0 : SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
317 0 : return NULL;
318 : }
319 0 : ret->pkeys[i].serverinfo_length =
320 0 : cert->pkeys[i].serverinfo_length;
321 0 : memcpy(ret->pkeys[i].serverinfo,
322 0 : cert->pkeys[i].serverinfo,
323 : cert->pkeys[i].serverinfo_length);
324 : }
325 : #endif
326 : }
327 :
328 750 : ret->references = 1;
329 : /*
330 : * Set digests to defaults. NB: we don't copy existing values as they
331 : * will be set during handshake.
332 : */
333 750 : ssl_cert_set_default_md(ret);
334 : /* Peer sigalgs set to NULL as we get these from handshake too */
335 750 : ret->peer_sigalgs = NULL;
336 750 : ret->peer_sigalgslen = 0;
337 : /* Configured sigalgs however we copy across */
338 :
339 750 : if (cert->conf_sigalgs) {
340 0 : ret->conf_sigalgs = OPENSSL_malloc(cert->conf_sigalgslen);
341 0 : if (!ret->conf_sigalgs)
342 : goto err;
343 0 : memcpy(ret->conf_sigalgs, cert->conf_sigalgs, cert->conf_sigalgslen);
344 0 : ret->conf_sigalgslen = cert->conf_sigalgslen;
345 : } else
346 750 : ret->conf_sigalgs = NULL;
347 :
348 750 : if (cert->client_sigalgs) {
349 0 : ret->client_sigalgs = OPENSSL_malloc(cert->client_sigalgslen);
350 0 : if (!ret->client_sigalgs)
351 : goto err;
352 0 : memcpy(ret->client_sigalgs, cert->client_sigalgs,
353 : cert->client_sigalgslen);
354 0 : ret->client_sigalgslen = cert->client_sigalgslen;
355 : } else
356 750 : ret->client_sigalgs = NULL;
357 : /* Shared sigalgs also NULL */
358 750 : ret->shared_sigalgs = NULL;
359 : /* Copy any custom client certificate types */
360 750 : if (cert->ctypes) {
361 0 : ret->ctypes = OPENSSL_malloc(cert->ctype_num);
362 0 : if (!ret->ctypes)
363 : goto err;
364 0 : memcpy(ret->ctypes, cert->ctypes, cert->ctype_num);
365 0 : ret->ctype_num = cert->ctype_num;
366 : }
367 :
368 750 : ret->cert_flags = cert->cert_flags;
369 :
370 750 : ret->cert_cb = cert->cert_cb;
371 750 : ret->cert_cb_arg = cert->cert_cb_arg;
372 :
373 750 : if (cert->verify_store) {
374 0 : CRYPTO_add(&cert->verify_store->references, 1,
375 : CRYPTO_LOCK_X509_STORE);
376 0 : ret->verify_store = cert->verify_store;
377 : }
378 :
379 750 : if (cert->chain_store) {
380 0 : CRYPTO_add(&cert->chain_store->references, 1, CRYPTO_LOCK_X509_STORE);
381 0 : ret->chain_store = cert->chain_store;
382 : }
383 :
384 750 : ret->ciphers_raw = NULL;
385 :
386 : #ifndef OPENSSL_NO_TLSEXT
387 750 : if (!custom_exts_copy(&ret->cli_ext, &cert->cli_ext))
388 : goto err;
389 750 : if (!custom_exts_copy(&ret->srv_ext, &cert->srv_ext))
390 : goto err;
391 : #endif
392 :
393 : return (ret);
394 :
395 : #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
396 : err:
397 : #endif
398 : #ifndef OPENSSL_NO_RSA
399 0 : if (ret->rsa_tmp != NULL)
400 0 : RSA_free(ret->rsa_tmp);
401 : #endif
402 : #ifndef OPENSSL_NO_DH
403 0 : if (ret->dh_tmp != NULL)
404 0 : DH_free(ret->dh_tmp);
405 : #endif
406 : #ifndef OPENSSL_NO_ECDH
407 0 : if (ret->ecdh_tmp != NULL)
408 0 : EC_KEY_free(ret->ecdh_tmp);
409 : #endif
410 :
411 : #ifndef OPENSSL_NO_TLSEXT
412 0 : custom_exts_free(&ret->cli_ext);
413 0 : custom_exts_free(&ret->srv_ext);
414 : #endif
415 :
416 0 : ssl_cert_clear_certs(ret);
417 :
418 0 : return NULL;
419 : }
420 :
421 : /* Free up and clear all certificates and chains */
422 :
423 1622 : void ssl_cert_clear_certs(CERT *c)
424 : {
425 : int i;
426 1622 : if (c == NULL)
427 1621 : return;
428 12968 : for (i = 0; i < SSL_PKEY_NUM; i++) {
429 12969 : CERT_PKEY *cpk = c->pkeys + i;
430 12969 : if (cpk->x509) {
431 816 : X509_free(cpk->x509);
432 815 : cpk->x509 = NULL;
433 : }
434 12968 : if (cpk->privatekey) {
435 815 : EVP_PKEY_free(cpk->privatekey);
436 815 : cpk->privatekey = NULL;
437 : }
438 12968 : if (cpk->chain) {
439 0 : sk_X509_pop_free(cpk->chain, X509_free);
440 0 : cpk->chain = NULL;
441 : }
442 : #ifndef OPENSSL_NO_TLSEXT
443 12968 : if (cpk->serverinfo) {
444 0 : OPENSSL_free(cpk->serverinfo);
445 0 : cpk->serverinfo = NULL;
446 0 : cpk->serverinfo_length = 0;
447 : }
448 : #endif
449 : /* Clear all flags apart from explicit sign */
450 12968 : cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
451 : }
452 : }
453 :
454 1622 : void ssl_cert_free(CERT *c)
455 : {
456 : int i;
457 :
458 1622 : if (c == NULL)
459 : return;
460 :
461 1622 : i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT);
462 : #ifdef REF_PRINT
463 : REF_PRINT("CERT", c);
464 : #endif
465 1622 : if (i > 0)
466 : return;
467 : #ifdef REF_CHECK
468 : if (i < 0) {
469 : fprintf(stderr, "ssl_cert_free, bad reference count\n");
470 : abort(); /* ok */
471 : }
472 : #endif
473 :
474 : #ifndef OPENSSL_NO_RSA
475 1622 : if (c->rsa_tmp)
476 0 : RSA_free(c->rsa_tmp);
477 : #endif
478 : #ifndef OPENSSL_NO_DH
479 1622 : if (c->dh_tmp)
480 0 : DH_free(c->dh_tmp);
481 : #endif
482 : #ifndef OPENSSL_NO_ECDH
483 1622 : if (c->ecdh_tmp)
484 1622 : EC_KEY_free(c->ecdh_tmp);
485 : #endif
486 :
487 1622 : ssl_cert_clear_certs(c);
488 1622 : if (c->peer_sigalgs)
489 373 : OPENSSL_free(c->peer_sigalgs);
490 1622 : if (c->conf_sigalgs)
491 0 : OPENSSL_free(c->conf_sigalgs);
492 1622 : if (c->client_sigalgs)
493 0 : OPENSSL_free(c->client_sigalgs);
494 1622 : if (c->shared_sigalgs)
495 373 : OPENSSL_free(c->shared_sigalgs);
496 1622 : if (c->ctypes)
497 0 : OPENSSL_free(c->ctypes);
498 1622 : if (c->verify_store)
499 0 : X509_STORE_free(c->verify_store);
500 1622 : if (c->chain_store)
501 0 : X509_STORE_free(c->chain_store);
502 1622 : if (c->ciphers_raw)
503 373 : OPENSSL_free(c->ciphers_raw);
504 : #ifndef OPENSSL_NO_TLSEXT
505 1622 : custom_exts_free(&c->cli_ext);
506 1622 : custom_exts_free(&c->srv_ext);
507 : #endif
508 1622 : OPENSSL_free(c);
509 : }
510 :
511 876 : int ssl_cert_inst(CERT **o)
512 : {
513 : /*
514 : * Create a CERT if there isn't already one (which cannot really happen,
515 : * as it is initially created in SSL_CTX_new; but the earlier code
516 : * usually allows for that one being non-existant, so we follow that
517 : * behaviour, as it might turn out that there actually is a reason for it
518 : * -- but I'm not sure that *all* of the existing code could cope with
519 : * s->cert being NULL, otherwise we could do without the initialization
520 : * in SSL_CTX_new).
521 : */
522 :
523 876 : if (o == NULL) {
524 0 : SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER);
525 0 : return (0);
526 : }
527 876 : if (*o == NULL) {
528 0 : if ((*o = ssl_cert_new()) == NULL) {
529 0 : SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE);
530 0 : return (0);
531 : }
532 : }
533 : return (1);
534 : }
535 :
536 0 : int ssl_cert_set0_chain(CERT *c, STACK_OF(X509) *chain)
537 : {
538 0 : CERT_PKEY *cpk = c->key;
539 0 : if (!cpk)
540 : return 0;
541 0 : if (cpk->chain)
542 0 : sk_X509_pop_free(cpk->chain, X509_free);
543 0 : cpk->chain = chain;
544 0 : return 1;
545 : }
546 :
547 0 : int ssl_cert_set1_chain(CERT *c, STACK_OF(X509) *chain)
548 : {
549 : STACK_OF(X509) *dchain;
550 0 : if (!chain)
551 0 : return ssl_cert_set0_chain(c, NULL);
552 0 : dchain = X509_chain_up_ref(chain);
553 0 : if (!dchain)
554 : return 0;
555 0 : if (!ssl_cert_set0_chain(c, dchain)) {
556 0 : sk_X509_pop_free(dchain, X509_free);
557 0 : return 0;
558 : }
559 : return 1;
560 : }
561 :
562 0 : int ssl_cert_add0_chain_cert(CERT *c, X509 *x)
563 : {
564 0 : CERT_PKEY *cpk = c->key;
565 0 : if (!cpk)
566 : return 0;
567 0 : if (!cpk->chain)
568 0 : cpk->chain = sk_X509_new_null();
569 0 : if (!cpk->chain || !sk_X509_push(cpk->chain, x))
570 : return 0;
571 : return 1;
572 : }
573 :
574 0 : int ssl_cert_add1_chain_cert(CERT *c, X509 *x)
575 : {
576 0 : if (!ssl_cert_add0_chain_cert(c, x))
577 : return 0;
578 0 : CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
579 0 : return 1;
580 : }
581 :
582 0 : int ssl_cert_select_current(CERT *c, X509 *x)
583 : {
584 : int i;
585 0 : if (x == NULL)
586 : return 0;
587 0 : for (i = 0; i < SSL_PKEY_NUM; i++) {
588 0 : CERT_PKEY *cpk = c->pkeys + i;
589 0 : if (cpk->x509 == x && cpk->privatekey) {
590 0 : c->key = cpk;
591 0 : return 1;
592 : }
593 : }
594 :
595 0 : for (i = 0; i < SSL_PKEY_NUM; i++) {
596 0 : CERT_PKEY *cpk = c->pkeys + i;
597 0 : if (cpk->privatekey && cpk->x509 && !X509_cmp(cpk->x509, x)) {
598 0 : c->key = cpk;
599 0 : return 1;
600 : }
601 : }
602 : return 0;
603 : }
604 :
605 0 : int ssl_cert_set_current(CERT *c, long op)
606 : {
607 : int i, idx;
608 0 : if (!c)
609 : return 0;
610 0 : if (op == SSL_CERT_SET_FIRST)
611 : idx = 0;
612 0 : else if (op == SSL_CERT_SET_NEXT) {
613 0 : idx = (int)(c->key - c->pkeys + 1);
614 0 : if (idx >= SSL_PKEY_NUM)
615 : return 0;
616 : } else
617 : return 0;
618 0 : for (i = idx; i < SSL_PKEY_NUM; i++) {
619 0 : CERT_PKEY *cpk = c->pkeys + i;
620 0 : if (cpk->x509 && cpk->privatekey) {
621 0 : c->key = cpk;
622 0 : return 1;
623 : }
624 : }
625 : return 0;
626 : }
627 :
628 0 : void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg)
629 : {
630 0 : c->cert_cb = cb;
631 0 : c->cert_cb_arg = arg;
632 0 : }
633 :
634 370 : SESS_CERT *ssl_sess_cert_new(void)
635 : {
636 : SESS_CERT *ret;
637 :
638 370 : ret = OPENSSL_malloc(sizeof *ret);
639 370 : if (ret == NULL) {
640 0 : SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
641 0 : return NULL;
642 : }
643 :
644 : memset(ret, 0, sizeof *ret);
645 370 : ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
646 370 : ret->references = 1;
647 :
648 370 : return ret;
649 : }
650 :
651 370 : void ssl_sess_cert_free(SESS_CERT *sc)
652 : {
653 : int i;
654 :
655 370 : if (sc == NULL)
656 : return;
657 :
658 370 : i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);
659 : #ifdef REF_PRINT
660 : REF_PRINT("SESS_CERT", sc);
661 : #endif
662 370 : if (i > 0)
663 : return;
664 : #ifdef REF_CHECK
665 : if (i < 0) {
666 : fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
667 : abort(); /* ok */
668 : }
669 : #endif
670 :
671 : /* i == 0 */
672 370 : if (sc->cert_chain != NULL)
673 370 : sk_X509_pop_free(sc->cert_chain, X509_free);
674 2960 : for (i = 0; i < SSL_PKEY_NUM; i++) {
675 2960 : if (sc->peer_pkeys[i].x509 != NULL)
676 370 : X509_free(sc->peer_pkeys[i].x509);
677 : #if 0 /* We don't have the peer's private key.
678 : * These lines are just * here as a reminder
679 : * that we're still using a
680 : * not-quite-appropriate * data structure. */
681 : if (sc->peer_pkeys[i].privatekey != NULL)
682 : EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
683 : #endif
684 : }
685 :
686 : #ifndef OPENSSL_NO_RSA
687 370 : if (sc->peer_rsa_tmp != NULL)
688 0 : RSA_free(sc->peer_rsa_tmp);
689 : #endif
690 : #ifndef OPENSSL_NO_DH
691 370 : if (sc->peer_dh_tmp != NULL)
692 0 : DH_free(sc->peer_dh_tmp);
693 : #endif
694 : #ifndef OPENSSL_NO_ECDH
695 370 : if (sc->peer_ecdh_tmp != NULL)
696 370 : EC_KEY_free(sc->peer_ecdh_tmp);
697 : #endif
698 :
699 370 : OPENSSL_free(sc);
700 : }
701 :
702 0 : int ssl_set_peer_cert_type(SESS_CERT *sc, int type)
703 : {
704 0 : sc->peer_cert_type = type;
705 0 : return (1);
706 : }
707 :
708 370 : int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
709 : {
710 : X509 *x;
711 : int i;
712 : X509_STORE *verify_store;
713 : X509_STORE_CTX ctx;
714 :
715 370 : if (s->cert->verify_store)
716 : verify_store = s->cert->verify_store;
717 : else
718 370 : verify_store = s->ctx->cert_store;
719 :
720 370 : if ((sk == NULL) || (sk_X509_num(sk) == 0))
721 : return (0);
722 :
723 370 : x = sk_X509_value(sk, 0);
724 370 : if (!X509_STORE_CTX_init(&ctx, verify_store, x, sk)) {
725 0 : SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB);
726 0 : return (0);
727 : }
728 : /* Set suite B flags if needed */
729 370 : X509_STORE_CTX_set_flags(&ctx, tls1_suiteb(s));
730 : #if 0
731 : if (SSL_get_verify_depth(s) >= 0)
732 : X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
733 : #endif
734 370 : X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s);
735 :
736 : /*
737 : * We need to inherit the verify parameters. These can be determined by
738 : * the context: if its a server it will verify SSL client certificates or
739 : * vice versa.
740 : */
741 :
742 370 : X509_STORE_CTX_set_default(&ctx, s->server ? "ssl_client" : "ssl_server");
743 : /*
744 : * Anything non-default in "param" should overwrite anything in the ctx.
745 : */
746 370 : X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx), s->param);
747 :
748 370 : if (s->verify_callback)
749 0 : X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback);
750 :
751 370 : if (s->ctx->app_verify_callback != NULL)
752 : #if 1 /* new with OpenSSL 0.9.7 */
753 0 : i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg);
754 : #else
755 : i = s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
756 : #endif
757 : else {
758 : #ifndef OPENSSL_NO_X509_VERIFY
759 370 : i = X509_verify_cert(&ctx);
760 : #else
761 : i = 0;
762 : ctx.error = X509_V_ERR_APPLICATION_VERIFICATION;
763 : SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, SSL_R_NO_VERIFY_CALLBACK);
764 : #endif
765 : }
766 :
767 370 : s->verify_result = ctx.error;
768 370 : X509_STORE_CTX_cleanup(&ctx);
769 :
770 370 : return (i);
771 : }
772 :
773 : static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,
774 : STACK_OF(X509_NAME) *name_list)
775 : {
776 0 : if (*ca_list != NULL)
777 0 : sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
778 :
779 0 : *ca_list = name_list;
780 : }
781 :
782 0 : STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
783 : {
784 : int i;
785 : STACK_OF(X509_NAME) *ret;
786 : X509_NAME *name;
787 :
788 0 : ret = sk_X509_NAME_new_null();
789 0 : for (i = 0; i < sk_X509_NAME_num(sk); i++) {
790 0 : name = X509_NAME_dup(sk_X509_NAME_value(sk, i));
791 0 : if ((name == NULL) || !sk_X509_NAME_push(ret, name)) {
792 0 : sk_X509_NAME_pop_free(ret, X509_NAME_free);
793 0 : return (NULL);
794 : }
795 : }
796 : return (ret);
797 : }
798 :
799 0 : void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
800 : {
801 : set_client_CA_list(&(s->client_CA), name_list);
802 0 : }
803 :
804 0 : void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
805 : {
806 : set_client_CA_list(&(ctx->client_CA), name_list);
807 0 : }
808 :
809 0 : STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
810 : {
811 0 : return (ctx->client_CA);
812 : }
813 :
814 0 : STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s)
815 : {
816 0 : if (s->type == SSL_ST_CONNECT) { /* we are in the client */
817 0 : if (((s->version >> 8) == SSL3_VERSION_MAJOR) && (s->s3 != NULL))
818 0 : return (s->s3->tmp.ca_names);
819 : else
820 : return (NULL);
821 : } else {
822 0 : if (s->client_CA != NULL)
823 : return (s->client_CA);
824 : else
825 0 : return (s->ctx->client_CA);
826 : }
827 : }
828 :
829 0 : static int add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x)
830 : {
831 : X509_NAME *name;
832 :
833 0 : if (x == NULL)
834 : return (0);
835 0 : if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL))
836 : return (0);
837 :
838 0 : if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL)
839 : return (0);
840 :
841 0 : if (!sk_X509_NAME_push(*sk, name)) {
842 0 : X509_NAME_free(name);
843 0 : return (0);
844 : }
845 : return (1);
846 : }
847 :
848 0 : int SSL_add_client_CA(SSL *ssl, X509 *x)
849 : {
850 0 : return (add_client_CA(&(ssl->client_CA), x));
851 : }
852 :
853 0 : int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
854 : {
855 0 : return (add_client_CA(&(ctx->client_CA), x));
856 : }
857 :
858 0 : static int xname_cmp(const X509_NAME *const *a, const X509_NAME *const *b)
859 : {
860 0 : return (X509_NAME_cmp(*a, *b));
861 : }
862 :
863 : #ifndef OPENSSL_NO_STDIO
864 : /**
865 : * Load CA certs from a file into a ::STACK. Note that it is somewhat misnamed;
866 : * it doesn't really have anything to do with clients (except that a common use
867 : * for a stack of CAs is to send it to the client). Actually, it doesn't have
868 : * much to do with CAs, either, since it will load any old cert.
869 : * \param file the file containing one or more certs.
870 : * \return a ::STACK containing the certs.
871 : */
872 0 : STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
873 : {
874 : BIO *in;
875 0 : X509 *x = NULL;
876 : X509_NAME *xn = NULL;
877 : STACK_OF(X509_NAME) *ret = NULL, *sk;
878 :
879 0 : sk = sk_X509_NAME_new(xname_cmp);
880 :
881 0 : in = BIO_new(BIO_s_file_internal());
882 :
883 0 : if ((sk == NULL) || (in == NULL)) {
884 0 : SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
885 0 : goto err;
886 : }
887 :
888 0 : if (!BIO_read_filename(in, file))
889 : goto err;
890 :
891 : for (;;) {
892 0 : if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
893 : break;
894 0 : if (ret == NULL) {
895 0 : ret = sk_X509_NAME_new_null();
896 0 : if (ret == NULL) {
897 0 : SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
898 0 : goto err;
899 : }
900 : }
901 0 : if ((xn = X509_get_subject_name(x)) == NULL)
902 : goto err;
903 : /* check for duplicates */
904 0 : xn = X509_NAME_dup(xn);
905 0 : if (xn == NULL)
906 : goto err;
907 0 : if (sk_X509_NAME_find(sk, xn) >= 0)
908 0 : X509_NAME_free(xn);
909 : else {
910 0 : sk_X509_NAME_push(sk, xn);
911 0 : sk_X509_NAME_push(ret, xn);
912 : }
913 : }
914 :
915 : if (0) {
916 : err:
917 0 : if (ret != NULL)
918 0 : sk_X509_NAME_pop_free(ret, X509_NAME_free);
919 : ret = NULL;
920 : }
921 0 : if (sk != NULL)
922 0 : sk_X509_NAME_free(sk);
923 0 : if (in != NULL)
924 0 : BIO_free(in);
925 0 : if (x != NULL)
926 0 : X509_free(x);
927 0 : if (ret != NULL)
928 0 : ERR_clear_error();
929 0 : return (ret);
930 : }
931 : #endif
932 :
933 : /**
934 : * Add a file of certs to a stack.
935 : * \param stack the stack to add to.
936 : * \param file the file to add from. All certs in this file that are not
937 : * already in the stack will be added.
938 : * \return 1 for success, 0 for failure. Note that in the case of failure some
939 : * certs may have been added to \c stack.
940 : */
941 :
942 0 : int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
943 : const char *file)
944 : {
945 : BIO *in;
946 0 : X509 *x = NULL;
947 : X509_NAME *xn = NULL;
948 : int ret = 1;
949 : int (*oldcmp) (const X509_NAME *const *a, const X509_NAME *const *b);
950 :
951 0 : oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);
952 :
953 0 : in = BIO_new(BIO_s_file_internal());
954 :
955 0 : if (in == NULL) {
956 0 : SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,
957 : ERR_R_MALLOC_FAILURE);
958 0 : goto err;
959 : }
960 :
961 0 : if (!BIO_read_filename(in, file))
962 : goto err;
963 :
964 : for (;;) {
965 0 : if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
966 : break;
967 0 : if ((xn = X509_get_subject_name(x)) == NULL)
968 : goto err;
969 0 : xn = X509_NAME_dup(xn);
970 0 : if (xn == NULL)
971 : goto err;
972 0 : if (sk_X509_NAME_find(stack, xn) >= 0)
973 0 : X509_NAME_free(xn);
974 : else
975 0 : sk_X509_NAME_push(stack, xn);
976 : }
977 :
978 0 : ERR_clear_error();
979 :
980 : if (0) {
981 : err:
982 : ret = 0;
983 : }
984 0 : if (in != NULL)
985 0 : BIO_free(in);
986 0 : if (x != NULL)
987 0 : X509_free(x);
988 :
989 0 : (void)sk_X509_NAME_set_cmp_func(stack, oldcmp);
990 :
991 0 : return ret;
992 : }
993 :
994 : /**
995 : * Add a directory of certs to a stack.
996 : * \param stack the stack to append to.
997 : * \param dir the directory to append from. All files in this directory will be
998 : * examined as potential certs. Any that are acceptable to
999 : * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will be
1000 : * included.
1001 : * \return 1 for success, 0 for failure. Note that in the case of failure some
1002 : * certs may have been added to \c stack.
1003 : */
1004 :
1005 0 : int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
1006 : const char *dir)
1007 : {
1008 0 : OPENSSL_DIR_CTX *d = NULL;
1009 : const char *filename;
1010 : int ret = 0;
1011 :
1012 0 : CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
1013 :
1014 : /* Note that a side effect is that the CAs will be sorted by name */
1015 :
1016 0 : while ((filename = OPENSSL_DIR_read(&d, dir))) {
1017 : char buf[1024];
1018 : int r;
1019 :
1020 0 : if (strlen(dir) + strlen(filename) + 2 > sizeof buf) {
1021 0 : SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,
1022 : SSL_R_PATH_TOO_LONG);
1023 0 : goto err;
1024 : }
1025 : #ifdef OPENSSL_SYS_VMS
1026 : r = BIO_snprintf(buf, sizeof buf, "%s%s", dir, filename);
1027 : #else
1028 0 : r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename);
1029 : #endif
1030 0 : if (r <= 0 || r >= (int)sizeof(buf))
1031 : goto err;
1032 0 : if (!SSL_add_file_cert_subjects_to_stack(stack, buf))
1033 : goto err;
1034 : }
1035 :
1036 0 : if (errno) {
1037 0 : SYSerr(SYS_F_OPENDIR, get_last_sys_error());
1038 0 : ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
1039 0 : SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
1040 0 : goto err;
1041 : }
1042 :
1043 : ret = 1;
1044 :
1045 : err:
1046 0 : if (d)
1047 0 : OPENSSL_DIR_end(&d);
1048 0 : CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
1049 0 : return ret;
1050 : }
1051 :
1052 : /* Add a certificate to a BUF_MEM structure */
1053 :
1054 373 : static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
1055 : {
1056 : int n;
1057 : unsigned char *p;
1058 :
1059 373 : n = i2d_X509(x, NULL);
1060 373 : if (!BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
1061 0 : SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
1062 0 : return 0;
1063 : }
1064 373 : p = (unsigned char *)&(buf->data[*l]);
1065 373 : l2n3(n, p);
1066 373 : i2d_X509(x, &p);
1067 373 : *l += n + 3;
1068 :
1069 373 : return 1;
1070 : }
1071 :
1072 : /* Add certificate chain to internal SSL BUF_MEM strcuture */
1073 373 : int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
1074 : {
1075 373 : BUF_MEM *buf = s->init_buf;
1076 : int no_chain;
1077 : int i;
1078 :
1079 : X509 *x;
1080 : STACK_OF(X509) *extra_certs;
1081 : X509_STORE *chain_store;
1082 :
1083 373 : if (cpk)
1084 373 : x = cpk->x509;
1085 : else
1086 : x = NULL;
1087 :
1088 373 : if (s->cert->chain_store)
1089 : chain_store = s->cert->chain_store;
1090 : else
1091 373 : chain_store = s->ctx->cert_store;
1092 :
1093 : /*
1094 : * If we have a certificate specific chain use it, else use parent ctx.
1095 : */
1096 373 : if (cpk && cpk->chain)
1097 : extra_certs = cpk->chain;
1098 : else
1099 373 : extra_certs = s->ctx->extra_certs;
1100 :
1101 373 : if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || extra_certs)
1102 : no_chain = 1;
1103 : else
1104 : no_chain = 0;
1105 :
1106 : /* TLSv1 sends a chain with nothing in it, instead of an alert */
1107 373 : if (!BUF_MEM_grow_clean(buf, 10)) {
1108 0 : SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);
1109 0 : return 0;
1110 : }
1111 373 : if (x != NULL) {
1112 373 : if (no_chain) {
1113 0 : if (!ssl_add_cert_to_buf(buf, l, x))
1114 : return 0;
1115 : } else {
1116 : X509_STORE_CTX xs_ctx;
1117 :
1118 373 : if (!X509_STORE_CTX_init(&xs_ctx, chain_store, x, NULL)) {
1119 0 : SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_X509_LIB);
1120 0 : return (0);
1121 : }
1122 373 : X509_verify_cert(&xs_ctx);
1123 : /* Don't leave errors in the queue */
1124 373 : ERR_clear_error();
1125 746 : for (i = 0; i < sk_X509_num(xs_ctx.chain); i++) {
1126 373 : x = sk_X509_value(xs_ctx.chain, i);
1127 :
1128 373 : if (!ssl_add_cert_to_buf(buf, l, x)) {
1129 0 : X509_STORE_CTX_cleanup(&xs_ctx);
1130 0 : return 0;
1131 : }
1132 : }
1133 373 : X509_STORE_CTX_cleanup(&xs_ctx);
1134 : }
1135 : }
1136 0 : for (i = 0; i < sk_X509_num(extra_certs); i++) {
1137 0 : x = sk_X509_value(extra_certs, i);
1138 0 : if (!ssl_add_cert_to_buf(buf, l, x))
1139 : return 0;
1140 : }
1141 :
1142 : return 1;
1143 : }
1144 :
1145 : /* Build a certificate chain for current certificate */
1146 0 : int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags)
1147 : {
1148 0 : CERT_PKEY *cpk = c->key;
1149 : X509_STORE_CTX xs_ctx;
1150 : STACK_OF(X509) *chain = NULL, *untrusted = NULL;
1151 : X509 *x;
1152 : int i, rv = 0;
1153 : unsigned long error;
1154 :
1155 0 : if (!cpk->x509) {
1156 0 : SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, SSL_R_NO_CERTIFICATE_SET);
1157 0 : goto err;
1158 : }
1159 : /* Rearranging and check the chain: add everything to a store */
1160 0 : if (flags & SSL_BUILD_CHAIN_FLAG_CHECK) {
1161 0 : chain_store = X509_STORE_new();
1162 0 : if (!chain_store)
1163 : goto err;
1164 0 : for (i = 0; i < sk_X509_num(cpk->chain); i++) {
1165 0 : x = sk_X509_value(cpk->chain, i);
1166 0 : if (!X509_STORE_add_cert(chain_store, x)) {
1167 0 : error = ERR_peek_last_error();
1168 0 : if (ERR_GET_LIB(error) != ERR_LIB_X509 ||
1169 0 : ERR_GET_REASON(error) !=
1170 : X509_R_CERT_ALREADY_IN_HASH_TABLE)
1171 : goto err;
1172 0 : ERR_clear_error();
1173 : }
1174 : }
1175 : /* Add EE cert too: it might be self signed */
1176 0 : if (!X509_STORE_add_cert(chain_store, cpk->x509)) {
1177 0 : error = ERR_peek_last_error();
1178 0 : if (ERR_GET_LIB(error) != ERR_LIB_X509 ||
1179 0 : ERR_GET_REASON(error) != X509_R_CERT_ALREADY_IN_HASH_TABLE)
1180 : goto err;
1181 0 : ERR_clear_error();
1182 : }
1183 : } else {
1184 0 : if (c->chain_store)
1185 : chain_store = c->chain_store;
1186 :
1187 0 : if (flags & SSL_BUILD_CHAIN_FLAG_UNTRUSTED)
1188 0 : untrusted = cpk->chain;
1189 : }
1190 :
1191 0 : if (!X509_STORE_CTX_init(&xs_ctx, chain_store, cpk->x509, untrusted)) {
1192 0 : SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, ERR_R_X509_LIB);
1193 0 : goto err;
1194 : }
1195 : /* Set suite B flags if needed */
1196 0 : X509_STORE_CTX_set_flags(&xs_ctx,
1197 0 : c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS);
1198 :
1199 0 : i = X509_verify_cert(&xs_ctx);
1200 0 : if (i <= 0 && flags & SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR) {
1201 0 : if (flags & SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR)
1202 0 : ERR_clear_error();
1203 : i = 1;
1204 : rv = 2;
1205 : }
1206 0 : if (i > 0)
1207 0 : chain = X509_STORE_CTX_get1_chain(&xs_ctx);
1208 0 : if (i <= 0) {
1209 0 : SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, SSL_R_CERTIFICATE_VERIFY_FAILED);
1210 0 : i = X509_STORE_CTX_get_error(&xs_ctx);
1211 0 : ERR_add_error_data(2, "Verify error:",
1212 : X509_verify_cert_error_string(i));
1213 :
1214 0 : X509_STORE_CTX_cleanup(&xs_ctx);
1215 0 : goto err;
1216 : }
1217 0 : X509_STORE_CTX_cleanup(&xs_ctx);
1218 0 : if (cpk->chain)
1219 0 : sk_X509_pop_free(cpk->chain, X509_free);
1220 : /* Remove EE certificate from chain */
1221 0 : x = sk_X509_shift(chain);
1222 0 : X509_free(x);
1223 0 : if (flags & SSL_BUILD_CHAIN_FLAG_NO_ROOT) {
1224 0 : if (sk_X509_num(chain) > 0) {
1225 : /* See if last cert is self signed */
1226 0 : x = sk_X509_value(chain, sk_X509_num(chain) - 1);
1227 0 : X509_check_purpose(x, -1, 0);
1228 0 : if (x->ex_flags & EXFLAG_SS) {
1229 0 : x = sk_X509_pop(chain);
1230 0 : X509_free(x);
1231 : }
1232 : }
1233 : }
1234 0 : cpk->chain = chain;
1235 0 : if (rv == 0)
1236 : rv = 1;
1237 : err:
1238 0 : if (flags & SSL_BUILD_CHAIN_FLAG_CHECK)
1239 0 : X509_STORE_free(chain_store);
1240 :
1241 0 : return rv;
1242 : }
1243 :
1244 0 : int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref)
1245 : {
1246 : X509_STORE **pstore;
1247 0 : if (chain)
1248 0 : pstore = &c->chain_store;
1249 : else
1250 0 : pstore = &c->verify_store;
1251 0 : if (*pstore)
1252 0 : X509_STORE_free(*pstore);
1253 0 : *pstore = store;
1254 0 : if (ref && store)
1255 0 : CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);
1256 0 : return 1;
1257 : }
|
