1 | /* |
2 | * Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include "internal/refcount.h" |
11 | |
12 | /* |
13 | * This structure holds all parameters associated with a verify operation by |
14 | * including an X509_VERIFY_PARAM structure in related structures the |
15 | * parameters used can be customized |
16 | */ |
17 | |
18 | struct X509_VERIFY_PARAM_st { |
19 | char *name; |
20 | time_t check_time; /* Time to use */ |
21 | uint32_t inh_flags; /* Inheritance flags */ |
22 | unsigned long flags; /* Various verify flags */ |
23 | int purpose; /* purpose to check untrusted certificates */ |
24 | int trust; /* trust setting to check */ |
25 | int depth; /* Verify depth */ |
26 | int auth_level; /* Security level for chain verification */ |
27 | STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ |
28 | /* Peer identity details */ |
29 | STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ |
30 | unsigned int hostflags; /* Flags to control matching features */ |
31 | char *peername; /* Matching hostname in peer certificate */ |
32 | char *email; /* If not NULL email address to match */ |
33 | size_t emaillen; |
34 | unsigned char *ip; /* If not NULL IP address to match */ |
35 | size_t iplen; /* Length of IP address */ |
36 | }; |
37 | |
38 | /* No error callback if depth < 0 */ |
39 | int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth); |
40 | |
41 | /* a sequence of these are used */ |
42 | struct x509_attributes_st { |
43 | ASN1_OBJECT *object; |
44 | STACK_OF(ASN1_TYPE) *set; |
45 | }; |
46 | |
47 | struct X509_extension_st { |
48 | ASN1_OBJECT *object; |
49 | ASN1_BOOLEAN critical; |
50 | ASN1_OCTET_STRING value; |
51 | }; |
52 | |
53 | /* |
54 | * Method to handle CRL access. In general a CRL could be very large (several |
55 | * Mb) and can consume large amounts of resources if stored in memory by |
56 | * multiple processes. This method allows general CRL operations to be |
57 | * redirected to more efficient callbacks: for example a CRL entry database. |
58 | */ |
59 | |
60 | #define X509_CRL_METHOD_DYNAMIC 1 |
61 | |
62 | struct x509_crl_method_st { |
63 | int flags; |
64 | int (*crl_init) (X509_CRL *crl); |
65 | int (*crl_free) (X509_CRL *crl); |
66 | int (*crl_lookup) (X509_CRL *crl, X509_REVOKED **ret, |
67 | ASN1_INTEGER *ser, X509_NAME *issuer); |
68 | int (*crl_verify) (X509_CRL *crl, EVP_PKEY *pk); |
69 | }; |
70 | |
71 | struct x509_lookup_method_st { |
72 | char *name; |
73 | int (*new_item) (X509_LOOKUP *ctx); |
74 | void (*free) (X509_LOOKUP *ctx); |
75 | int (*init) (X509_LOOKUP *ctx); |
76 | int (*shutdown) (X509_LOOKUP *ctx); |
77 | int (*ctrl) (X509_LOOKUP *ctx, int cmd, const char *argc, long argl, |
78 | char **ret); |
79 | int (*get_by_subject) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
80 | X509_NAME *name, X509_OBJECT *ret); |
81 | int (*get_by_issuer_serial) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
82 | X509_NAME *name, ASN1_INTEGER *serial, |
83 | X509_OBJECT *ret); |
84 | int (*get_by_fingerprint) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
85 | const unsigned char *bytes, int len, |
86 | X509_OBJECT *ret); |
87 | int (*get_by_alias) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, |
88 | const char *str, int len, X509_OBJECT *ret); |
89 | }; |
90 | |
91 | /* This is the functions plus an instance of the local variables. */ |
92 | struct x509_lookup_st { |
93 | int init; /* have we been started */ |
94 | int skip; /* don't use us. */ |
95 | X509_LOOKUP_METHOD *method; /* the functions */ |
96 | void *method_data; /* method data */ |
97 | X509_STORE *store_ctx; /* who owns us */ |
98 | }; |
99 | |
100 | /* |
101 | * This is used to hold everything. It is used for all certificate |
102 | * validation. Once we have a certificate chain, the 'verify' function is |
103 | * then called to actually check the cert chain. |
104 | */ |
105 | struct x509_store_st { |
106 | /* The following is a cache of trusted certs */ |
107 | int cache; /* if true, stash any hits */ |
108 | STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */ |
109 | /* These are external lookup methods */ |
110 | STACK_OF(X509_LOOKUP) *get_cert_methods; |
111 | X509_VERIFY_PARAM *param; |
112 | /* Callbacks for various operations */ |
113 | /* called to verify a certificate */ |
114 | int (*verify) (X509_STORE_CTX *ctx); |
115 | /* error callback */ |
116 | int (*verify_cb) (int ok, X509_STORE_CTX *ctx); |
117 | /* get issuers cert from ctx */ |
118 | int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x); |
119 | /* check issued */ |
120 | int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer); |
121 | /* Check revocation status of chain */ |
122 | int (*check_revocation) (X509_STORE_CTX *ctx); |
123 | /* retrieve CRL */ |
124 | int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); |
125 | /* Check CRL validity */ |
126 | int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl); |
127 | /* Check certificate against CRL */ |
128 | int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); |
129 | /* Check policy status of the chain */ |
130 | int (*check_policy) (X509_STORE_CTX *ctx); |
131 | STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, X509_NAME *nm); |
132 | STACK_OF(X509_CRL) *(*lookup_crls) (X509_STORE_CTX *ctx, X509_NAME *nm); |
133 | int (*cleanup) (X509_STORE_CTX *ctx); |
134 | CRYPTO_EX_DATA ex_data; |
135 | CRYPTO_REF_COUNT references; |
136 | CRYPTO_RWLOCK *lock; |
137 | }; |
138 | |
139 | typedef struct lookup_dir_hashes_st BY_DIR_HASH; |
140 | typedef struct lookup_dir_entry_st BY_DIR_ENTRY; |
141 | DEFINE_STACK_OF(BY_DIR_HASH) |
142 | DEFINE_STACK_OF(BY_DIR_ENTRY) |
143 | typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY; |
144 | DEFINE_STACK_OF(STACK_OF_X509_NAME_ENTRY) |
145 | |
146 | void x509_set_signature_info(X509_SIG_INFO *siginf, const X509_ALGOR *alg, |
147 | const ASN1_STRING *sig); |
148 | |