155714Skris/* crypto/x509/by_dir.c */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 8280304Sjkim * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15280304Sjkim * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 22280304Sjkim * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 37280304Sjkim * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40280304Sjkim * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 52280304Sjkim * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 5855714Skris 5955714Skris#include <stdio.h> 6055714Skris#include <time.h> 6155714Skris#include <errno.h> 6255714Skris 6355714Skris#include "cryptlib.h" 6459191Skris 6559191Skris#ifndef NO_SYS_TYPES_H 6659191Skris# include <sys/types.h> 6759191Skris#endif 68238405Sjkim#ifndef OPENSSL_NO_POSIX_IO 6959191Skris# include <sys/stat.h> 7059191Skris#endif 7159191Skris 7255714Skris#include <openssl/lhash.h> 7355714Skris#include <openssl/x509.h> 7455714Skris 75280304Sjkimtypedef struct lookup_dir_hashes_st { 76280304Sjkim unsigned long hash; 77280304Sjkim int suffix; 78280304Sjkim} BY_DIR_HASH; 79194206Ssimon 80280304Sjkimtypedef struct lookup_dir_entry_st { 81280304Sjkim char *dir; 82280304Sjkim int dir_type; 83280304Sjkim STACK_OF(BY_DIR_HASH) *hashes; 84280304Sjkim} BY_DIR_ENTRY; 85238405Sjkim 86280304Sjkimtypedef struct lookup_dir_st { 87280304Sjkim BUF_MEM *buffer; 88280304Sjkim STACK_OF(BY_DIR_ENTRY) *dirs; 89280304Sjkim} BY_DIR; 90238405Sjkim 91238405SjkimDECLARE_STACK_OF(BY_DIR_HASH) 92238405SjkimDECLARE_STACK_OF(BY_DIR_ENTRY) 93238405Sjkim 9455714Skrisstatic int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl, 95280304Sjkim char **ret); 9655714Skrisstatic int new_dir(X509_LOOKUP *lu); 9755714Skrisstatic void free_dir(X509_LOOKUP *lu); 98280304Sjkimstatic int add_cert_dir(BY_DIR *ctx, const char *dir, int type); 99280304Sjkimstatic int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name, 100280304Sjkim X509_OBJECT *ret); 101280304SjkimX509_LOOKUP_METHOD x509_dir_lookup = { 102280304Sjkim "Load certs from files in a directory", 103280304Sjkim new_dir, /* new */ 104280304Sjkim free_dir, /* free */ 105280304Sjkim NULL, /* init */ 106280304Sjkim NULL, /* shutdown */ 107280304Sjkim dir_ctrl, /* ctrl */ 108280304Sjkim get_cert_by_subject, /* get_by_subject */ 109280304Sjkim NULL, /* get_by_issuer_serial */ 110280304Sjkim NULL, /* get_by_fingerprint */ 111280304Sjkim NULL, /* get_by_alias */ 112280304Sjkim}; 11355714Skris 11455714SkrisX509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void) 115280304Sjkim{ 116280304Sjkim return (&x509_dir_lookup); 117280304Sjkim} 11855714Skris 11955714Skrisstatic int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl, 120280304Sjkim char **retp) 121280304Sjkim{ 122280304Sjkim int ret = 0; 123280304Sjkim BY_DIR *ld; 124280304Sjkim char *dir = NULL; 12555714Skris 126280304Sjkim ld = (BY_DIR *)ctx->method_data; 12755714Skris 128280304Sjkim switch (cmd) { 129280304Sjkim case X509_L_ADD_DIR: 130280304Sjkim if (argl == X509_FILETYPE_DEFAULT) { 131280304Sjkim dir = (char *)getenv(X509_get_default_cert_dir_env()); 132280304Sjkim if (dir) 133280304Sjkim ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM); 134280304Sjkim else 135280304Sjkim ret = add_cert_dir(ld, X509_get_default_cert_dir(), 136280304Sjkim X509_FILETYPE_PEM); 137280304Sjkim if (!ret) { 138280304Sjkim X509err(X509_F_DIR_CTRL, X509_R_LOADING_CERT_DIR); 139280304Sjkim } 140280304Sjkim } else 141280304Sjkim ret = add_cert_dir(ld, argp, (int)argl); 142280304Sjkim break; 143280304Sjkim } 144280304Sjkim return (ret); 145280304Sjkim} 14655714Skris 14755714Skrisstatic int new_dir(X509_LOOKUP *lu) 148280304Sjkim{ 149280304Sjkim BY_DIR *a; 15055714Skris 151280304Sjkim if ((a = (BY_DIR *)OPENSSL_malloc(sizeof(BY_DIR))) == NULL) 152280304Sjkim return (0); 153280304Sjkim if ((a->buffer = BUF_MEM_new()) == NULL) { 154280304Sjkim OPENSSL_free(a); 155280304Sjkim return (0); 156280304Sjkim } 157280304Sjkim a->dirs = NULL; 158280304Sjkim lu->method_data = (char *)a; 159280304Sjkim return (1); 160280304Sjkim} 16155714Skris 162238405Sjkimstatic void by_dir_hash_free(BY_DIR_HASH *hash) 163280304Sjkim{ 164280304Sjkim OPENSSL_free(hash); 165280304Sjkim} 166238405Sjkim 167280304Sjkimstatic int by_dir_hash_cmp(const BY_DIR_HASH *const *a, 168280304Sjkim const BY_DIR_HASH *const *b) 169280304Sjkim{ 170280304Sjkim if ((*a)->hash > (*b)->hash) 171280304Sjkim return 1; 172280304Sjkim if ((*a)->hash < (*b)->hash) 173280304Sjkim return -1; 174280304Sjkim return 0; 175280304Sjkim} 176238405Sjkim 177238405Sjkimstatic void by_dir_entry_free(BY_DIR_ENTRY *ent) 178280304Sjkim{ 179280304Sjkim if (ent->dir) 180280304Sjkim OPENSSL_free(ent->dir); 181280304Sjkim if (ent->hashes) 182280304Sjkim sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free); 183280304Sjkim OPENSSL_free(ent); 184280304Sjkim} 185238405Sjkim 18655714Skrisstatic void free_dir(X509_LOOKUP *lu) 187280304Sjkim{ 188280304Sjkim BY_DIR *a; 18955714Skris 190280304Sjkim a = (BY_DIR *)lu->method_data; 191280304Sjkim if (a->dirs != NULL) 192280304Sjkim sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free); 193280304Sjkim if (a->buffer != NULL) 194280304Sjkim BUF_MEM_free(a->buffer); 195280304Sjkim OPENSSL_free(a); 196280304Sjkim} 19755714Skris 19855714Skrisstatic int add_cert_dir(BY_DIR *ctx, const char *dir, int type) 199280304Sjkim{ 200280304Sjkim int j, len; 201280304Sjkim const char *s, *ss, *p; 20255714Skris 203280304Sjkim if (dir == NULL || !*dir) { 204280304Sjkim X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY); 205280304Sjkim return 0; 206280304Sjkim } 20755714Skris 208280304Sjkim s = dir; 209280304Sjkim p = s; 210280304Sjkim do { 211280304Sjkim if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) { 212280304Sjkim BY_DIR_ENTRY *ent; 213280304Sjkim ss = s; 214280304Sjkim s = p + 1; 215280304Sjkim len = (int)(p - ss); 216280304Sjkim if (len == 0) 217280304Sjkim continue; 218280304Sjkim for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) { 219280304Sjkim ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j); 220280304Sjkim if (strlen(ent->dir) == (size_t)len && 221280304Sjkim strncmp(ent->dir, ss, (unsigned int)len) == 0) 222280304Sjkim break; 223280304Sjkim } 224280304Sjkim if (j < sk_BY_DIR_ENTRY_num(ctx->dirs)) 225280304Sjkim continue; 226280304Sjkim if (ctx->dirs == NULL) { 227280304Sjkim ctx->dirs = sk_BY_DIR_ENTRY_new_null(); 228280304Sjkim if (!ctx->dirs) { 229280304Sjkim X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE); 230280304Sjkim return 0; 231280304Sjkim } 232280304Sjkim } 233280304Sjkim ent = OPENSSL_malloc(sizeof(BY_DIR_ENTRY)); 234280304Sjkim if (!ent) 235280304Sjkim return 0; 236280304Sjkim ent->dir_type = type; 237280304Sjkim ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp); 238280304Sjkim ent->dir = OPENSSL_malloc((unsigned int)len + 1); 239280304Sjkim if (!ent->dir || !ent->hashes) { 240280304Sjkim by_dir_entry_free(ent); 241280304Sjkim return 0; 242280304Sjkim } 243280304Sjkim strncpy(ent->dir, ss, (unsigned int)len); 244280304Sjkim ent->dir[len] = '\0'; 245280304Sjkim if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) { 246280304Sjkim by_dir_entry_free(ent); 247280304Sjkim return 0; 248280304Sjkim } 249280304Sjkim } 250280304Sjkim } while (*p++ != '\0'); 251280304Sjkim return 1; 252280304Sjkim} 25355714Skris 25455714Skrisstatic int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name, 255280304Sjkim X509_OBJECT *ret) 256280304Sjkim{ 257280304Sjkim BY_DIR *ctx; 258280304Sjkim union { 259280304Sjkim struct { 260280304Sjkim X509 st_x509; 261280304Sjkim X509_CINF st_x509_cinf; 262280304Sjkim } x509; 263280304Sjkim struct { 264280304Sjkim X509_CRL st_crl; 265280304Sjkim X509_CRL_INFO st_crl_info; 266280304Sjkim } crl; 267280304Sjkim } data; 268280304Sjkim int ok = 0; 269280304Sjkim int i, j, k; 270280304Sjkim unsigned long h; 271280304Sjkim BUF_MEM *b = NULL; 272280304Sjkim X509_OBJECT stmp, *tmp; 273280304Sjkim const char *postfix = ""; 27455714Skris 275280304Sjkim if (name == NULL) 276280304Sjkim return (0); 27755714Skris 278280304Sjkim stmp.type = type; 279280304Sjkim if (type == X509_LU_X509) { 280280304Sjkim data.x509.st_x509.cert_info = &data.x509.st_x509_cinf; 281280304Sjkim data.x509.st_x509_cinf.subject = name; 282280304Sjkim stmp.data.x509 = &data.x509.st_x509; 283280304Sjkim postfix = ""; 284280304Sjkim } else if (type == X509_LU_CRL) { 285280304Sjkim data.crl.st_crl.crl = &data.crl.st_crl_info; 286280304Sjkim data.crl.st_crl_info.issuer = name; 287280304Sjkim stmp.data.crl = &data.crl.st_crl; 288280304Sjkim postfix = "r"; 289280304Sjkim } else { 290280304Sjkim X509err(X509_F_GET_CERT_BY_SUBJECT, X509_R_WRONG_LOOKUP_TYPE); 291280304Sjkim goto finish; 292280304Sjkim } 29355714Skris 294280304Sjkim if ((b = BUF_MEM_new()) == NULL) { 295280304Sjkim X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_BUF_LIB); 296280304Sjkim goto finish; 297280304Sjkim } 29855714Skris 299280304Sjkim ctx = (BY_DIR *)xl->method_data; 300280304Sjkim 301280304Sjkim h = X509_NAME_hash(name); 302280304Sjkim for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) { 303280304Sjkim BY_DIR_ENTRY *ent; 304280304Sjkim int idx; 305280304Sjkim BY_DIR_HASH htmp, *hent; 306280304Sjkim ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i); 307280304Sjkim j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1; 308280304Sjkim if (!BUF_MEM_grow(b, j)) { 309280304Sjkim X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE); 310280304Sjkim goto finish; 311280304Sjkim } 312280304Sjkim if (type == X509_LU_CRL && ent->hashes) { 313280304Sjkim htmp.hash = h; 314280304Sjkim CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); 315280304Sjkim idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp); 316280304Sjkim if (idx >= 0) { 317280304Sjkim hent = sk_BY_DIR_HASH_value(ent->hashes, idx); 318280304Sjkim k = hent->suffix; 319280304Sjkim } else { 320280304Sjkim hent = NULL; 321280304Sjkim k = 0; 322280304Sjkim } 323280304Sjkim CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); 324280304Sjkim } else { 325280304Sjkim k = 0; 326280304Sjkim hent = NULL; 327280304Sjkim } 328280304Sjkim for (;;) { 329280304Sjkim char c = '/'; 330127128Snectar#ifdef OPENSSL_SYS_VMS 331280304Sjkim c = ent->dir[strlen(ent->dir) - 1]; 332280304Sjkim if (c != ':' && c != '>' && c != ']') { 333280304Sjkim /* 334280304Sjkim * If no separator is present, we assume the directory 335280304Sjkim * specifier is a logical name, and add a colon. We really 336280304Sjkim * should use better VMS routines for merging things like 337280304Sjkim * this, but this will do for now... -- Richard Levitte 338280304Sjkim */ 339280304Sjkim c = ':'; 340280304Sjkim } else { 341280304Sjkim c = '\0'; 342280304Sjkim } 343127128Snectar#endif 344280304Sjkim if (c == '\0') { 345280304Sjkim /* 346280304Sjkim * This is special. When c == '\0', no directory separator 347280304Sjkim * should be added. 348280304Sjkim */ 349280304Sjkim BIO_snprintf(b->data, b->max, 350280304Sjkim "%s%08lx.%s%d", ent->dir, h, postfix, k); 351280304Sjkim } else { 352280304Sjkim BIO_snprintf(b->data, b->max, 353280304Sjkim "%s%c%08lx.%s%d", ent->dir, c, h, postfix, k); 354280304Sjkim } 355238405Sjkim#ifndef OPENSSL_NO_POSIX_IO 356280304Sjkim# ifdef _WIN32 357280304Sjkim# define stat _stat 358280304Sjkim# endif 359280304Sjkim { 360280304Sjkim struct stat st; 361280304Sjkim if (stat(b->data, &st) < 0) 362280304Sjkim break; 363280304Sjkim } 364238405Sjkim#endif 365280304Sjkim /* found one. */ 366280304Sjkim if (type == X509_LU_X509) { 367280304Sjkim if ((X509_load_cert_file(xl, b->data, ent->dir_type)) == 0) 368280304Sjkim break; 369280304Sjkim } else if (type == X509_LU_CRL) { 370280304Sjkim if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0) 371280304Sjkim break; 372280304Sjkim } 373280304Sjkim /* else case will caught higher up */ 374280304Sjkim k++; 375280304Sjkim } 37655714Skris 377280304Sjkim /* 378280304Sjkim * we have added it to the cache so now pull it out again 379280304Sjkim */ 380280304Sjkim CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 381280304Sjkim j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp); 382280304Sjkim if (j != -1) 383280304Sjkim tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j); 384280304Sjkim else 385280304Sjkim tmp = NULL; 386280304Sjkim CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 38755714Skris 388280304Sjkim /* If a CRL, update the last file suffix added for this */ 389238405Sjkim 390280304Sjkim if (type == X509_LU_CRL) { 391280304Sjkim CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 392280304Sjkim /* 393280304Sjkim * Look for entry again in case another thread added an entry 394280304Sjkim * first. 395280304Sjkim */ 396280304Sjkim if (!hent) { 397280304Sjkim htmp.hash = h; 398280304Sjkim idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp); 399280304Sjkim if (idx >= 0) 400280304Sjkim hent = sk_BY_DIR_HASH_value(ent->hashes, idx); 401280304Sjkim } 402280304Sjkim if (!hent) { 403280304Sjkim hent = OPENSSL_malloc(sizeof(BY_DIR_HASH)); 404280304Sjkim hent->hash = h; 405280304Sjkim hent->suffix = k; 406280304Sjkim if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) { 407280304Sjkim CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 408280304Sjkim OPENSSL_free(hent); 409280304Sjkim ok = 0; 410280304Sjkim goto finish; 411280304Sjkim } 412280304Sjkim } else if (hent->suffix < k) 413280304Sjkim hent->suffix = k; 414238405Sjkim 415280304Sjkim CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 416238405Sjkim 417280304Sjkim } 418238405Sjkim 419280304Sjkim if (tmp != NULL) { 420280304Sjkim ok = 1; 421280304Sjkim ret->type = tmp->type; 422280304Sjkim memcpy(&ret->data, &tmp->data, sizeof(ret->data)); 423280304Sjkim /* 424280304Sjkim * If we were going to up the reference count, we would need to 425280304Sjkim * do it on a perl 'type' basis 426280304Sjkim */ 427280304Sjkim /*- CRYPTO_add(&tmp->data.x509->references,1, 428280304Sjkim CRYPTO_LOCK_X509);*/ 429280304Sjkim goto finish; 430280304Sjkim } 431280304Sjkim } 432280304Sjkim finish: 433280304Sjkim if (b != NULL) 434280304Sjkim BUF_MEM_free(b); 435280304Sjkim return (ok); 436280304Sjkim} 437