x509_vfy.c revision 340704
1/* crypto/x509/x509_vfy.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59#include <ctype.h> 60#include <stdio.h> 61#include <time.h> 62#include <errno.h> 63 64#include "cryptlib.h" 65#include <openssl/crypto.h> 66#include <openssl/lhash.h> 67#include <openssl/buffer.h> 68#include <openssl/evp.h> 69#include <openssl/asn1.h> 70#include <openssl/x509.h> 71#include <openssl/x509v3.h> 72#include <openssl/objects.h> 73#include "vpm_int.h" 74 75/* CRL score values */ 76 77/* No unhandled critical extensions */ 78 79#define CRL_SCORE_NOCRITICAL 0x100 80 81/* certificate is within CRL scope */ 82 83#define CRL_SCORE_SCOPE 0x080 84 85/* CRL times valid */ 86 87#define CRL_SCORE_TIME 0x040 88 89/* Issuer name matches certificate */ 90 91#define CRL_SCORE_ISSUER_NAME 0x020 92 93/* If this score or above CRL is probably valid */ 94 95#define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE) 96 97/* CRL issuer is certificate issuer */ 98 99#define CRL_SCORE_ISSUER_CERT 0x018 100 101/* CRL issuer is on certificate path */ 102 103#define CRL_SCORE_SAME_PATH 0x008 104 105/* CRL issuer matches CRL AKID */ 106 107#define CRL_SCORE_AKID 0x004 108 109/* Have a delta CRL with valid times */ 110 111#define CRL_SCORE_TIME_DELTA 0x002 112 113static int null_callback(int ok, X509_STORE_CTX *e); 114static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); 115static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); 116static int check_chain_extensions(X509_STORE_CTX *ctx); 117static int check_name_constraints(X509_STORE_CTX *ctx); 118static int check_id(X509_STORE_CTX *ctx); 119static int check_trust(X509_STORE_CTX *ctx); 120static int check_revocation(X509_STORE_CTX *ctx); 121static int check_cert(X509_STORE_CTX *ctx); 122static int check_policy(X509_STORE_CTX *ctx); 123 124static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, 125 unsigned int *preasons, X509_CRL *crl, X509 *x); 126static int get_crl_delta(X509_STORE_CTX *ctx, 127 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x); 128static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, 129 int *pcrl_score, X509_CRL *base, 130 STACK_OF(X509_CRL) *crls); 131static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, 132 int *pcrl_score); 133static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, 134 unsigned int *preasons); 135static int check_crl_path(X509_STORE_CTX *ctx, X509 *x); 136static int check_crl_chain(X509_STORE_CTX *ctx, 137 STACK_OF(X509) *cert_path, 138 STACK_OF(X509) *crl_path); 139 140static int internal_verify(X509_STORE_CTX *ctx); 141const char X509_version[] = "X.509" OPENSSL_VERSION_PTEXT; 142 143static int null_callback(int ok, X509_STORE_CTX *e) 144{ 145 return ok; 146} 147 148#if 0 149static int x509_subject_cmp(X509 **a, X509 **b) 150{ 151 return X509_subject_name_cmp(*a, *b); 152} 153#endif 154/* Return 1 is a certificate is self signed */ 155static int cert_self_signed(X509 *x) 156{ 157 X509_check_purpose(x, -1, 0); 158 if (x->ex_flags & EXFLAG_SS) 159 return 1; 160 else 161 return 0; 162} 163 164/* Given a certificate try and find an exact match in the store */ 165 166static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x) 167{ 168 STACK_OF(X509) *certs; 169 X509 *xtmp = NULL; 170 int i; 171 /* Lookup all certs with matching subject name */ 172 certs = ctx->lookup_certs(ctx, X509_get_subject_name(x)); 173 if (certs == NULL) 174 return NULL; 175 /* Look for exact match */ 176 for (i = 0; i < sk_X509_num(certs); i++) { 177 xtmp = sk_X509_value(certs, i); 178 if (!X509_cmp(xtmp, x)) 179 break; 180 } 181 if (i < sk_X509_num(certs)) 182 CRYPTO_add(&xtmp->references, 1, CRYPTO_LOCK_X509); 183 else 184 xtmp = NULL; 185 sk_X509_pop_free(certs, X509_free); 186 return xtmp; 187} 188 189int X509_verify_cert(X509_STORE_CTX *ctx) 190{ 191 X509 *x, *xtmp, *xtmp2, *chain_ss = NULL; 192 int bad_chain = 0; 193 X509_VERIFY_PARAM *param = ctx->param; 194 int depth, i, ok = 0; 195 int num, j, retry; 196 int (*cb) (int xok, X509_STORE_CTX *xctx); 197 STACK_OF(X509) *sktmp = NULL; 198 int trust = X509_TRUST_UNTRUSTED; 199 int err; 200 201 if (ctx->cert == NULL) { 202 X509err(X509_F_X509_VERIFY_CERT, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); 203 ctx->error = X509_V_ERR_INVALID_CALL; 204 return -1; 205 } 206 if (ctx->chain != NULL) { 207 /* 208 * This X509_STORE_CTX has already been used to verify a cert. We 209 * cannot do another one. 210 */ 211 X509err(X509_F_X509_VERIFY_CERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 212 ctx->error = X509_V_ERR_INVALID_CALL; 213 return -1; 214 } 215 216 cb = ctx->verify_cb; 217 218 /* 219 * first we make sure the chain we are going to build is present and that 220 * the first entry is in place 221 */ 222 if (((ctx->chain = sk_X509_new_null()) == NULL) || 223 (!sk_X509_push(ctx->chain, ctx->cert))) { 224 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 225 ctx->error = X509_V_ERR_OUT_OF_MEM; 226 ok = -1; 227 goto err; 228 } 229 CRYPTO_add(&ctx->cert->references, 1, CRYPTO_LOCK_X509); 230 ctx->last_untrusted = 1; 231 232 /* We use a temporary STACK so we can chop and hack at it */ 233 if (ctx->untrusted != NULL 234 && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { 235 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 236 ctx->error = X509_V_ERR_OUT_OF_MEM; 237 ok = -1; 238 goto err; 239 } 240 241 num = sk_X509_num(ctx->chain); 242 x = sk_X509_value(ctx->chain, num - 1); 243 depth = param->depth; 244 245 for (;;) { 246 /* If we have enough, we break */ 247 if (depth < num) 248 break; /* FIXME: If this happens, we should take 249 * note of it and, if appropriate, use the 250 * X509_V_ERR_CERT_CHAIN_TOO_LONG error code 251 * later. */ 252 253 /* If we are self signed, we break */ 254 if (cert_self_signed(x)) 255 break; 256 /* 257 * If asked see if we can find issuer in trusted store first 258 */ 259 if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) { 260 ok = ctx->get_issuer(&xtmp, ctx, x); 261 if (ok < 0) { 262 ctx->error = X509_V_ERR_STORE_LOOKUP; 263 goto err; 264 } 265 /* 266 * If successful for now free up cert so it will be picked up 267 * again later. 268 */ 269 if (ok > 0) { 270 X509_free(xtmp); 271 break; 272 } 273 } 274 275 /* If we were passed a cert chain, use it first */ 276 if (ctx->untrusted != NULL) { 277 xtmp = find_issuer(ctx, sktmp, x); 278 if (xtmp != NULL) { 279 if (!sk_X509_push(ctx->chain, xtmp)) { 280 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 281 ctx->error = X509_V_ERR_OUT_OF_MEM; 282 ok = -1; 283 goto err; 284 } 285 CRYPTO_add(&xtmp->references, 1, CRYPTO_LOCK_X509); 286 (void)sk_X509_delete_ptr(sktmp, xtmp); 287 ctx->last_untrusted++; 288 x = xtmp; 289 num++; 290 /* 291 * reparse the full chain for the next one 292 */ 293 continue; 294 } 295 } 296 break; 297 } 298 299 /* Remember how many untrusted certs we have */ 300 j = num; 301 /* 302 * at this point, chain should contain a list of untrusted certificates. 303 * We now need to add at least one trusted one, if possible, otherwise we 304 * complain. 305 */ 306 307 do { 308 /* 309 * Examine last certificate in chain and see if it is self signed. 310 */ 311 i = sk_X509_num(ctx->chain); 312 x = sk_X509_value(ctx->chain, i - 1); 313 if (cert_self_signed(x)) { 314 /* we have a self signed certificate */ 315 if (sk_X509_num(ctx->chain) == 1) { 316 /* 317 * We have a single self signed certificate: see if we can 318 * find it in the store. We must have an exact match to avoid 319 * possible impersonation. 320 */ 321 ok = ctx->get_issuer(&xtmp, ctx, x); 322 if ((ok <= 0) || X509_cmp(x, xtmp)) { 323 ctx->error = X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT; 324 ctx->current_cert = x; 325 ctx->error_depth = i - 1; 326 if (ok == 1) 327 X509_free(xtmp); 328 bad_chain = 1; 329 ok = cb(0, ctx); 330 if (!ok) 331 goto err; 332 } else { 333 /* 334 * We have a match: replace certificate with store 335 * version so we get any trust settings. 336 */ 337 X509_free(x); 338 x = xtmp; 339 (void)sk_X509_set(ctx->chain, i - 1, x); 340 ctx->last_untrusted = 0; 341 } 342 } else { 343 /* 344 * extract and save self signed certificate for later use 345 */ 346 chain_ss = sk_X509_pop(ctx->chain); 347 ctx->last_untrusted--; 348 num--; 349 j--; 350 x = sk_X509_value(ctx->chain, num - 1); 351 } 352 } 353 /* We now lookup certs from the certificate store */ 354 for (;;) { 355 /* If we have enough, we break */ 356 if (depth < num) 357 break; 358 /* If we are self signed, we break */ 359 if (cert_self_signed(x)) 360 break; 361 ok = ctx->get_issuer(&xtmp, ctx, x); 362 363 if (ok < 0) { 364 ctx->error = X509_V_ERR_STORE_LOOKUP; 365 goto err; 366 } 367 if (ok == 0) 368 break; 369 x = xtmp; 370 if (!sk_X509_push(ctx->chain, x)) { 371 X509_free(xtmp); 372 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); 373 ctx->error = X509_V_ERR_OUT_OF_MEM; 374 ok = -1; 375 goto err; 376 } 377 num++; 378 } 379 380 /* we now have our chain, lets check it... */ 381 if ((trust = check_trust(ctx)) == X509_TRUST_REJECTED) { 382 /* Callback already issued */ 383 ok = 0; 384 goto err; 385 } 386 387 /* 388 * If it's not explicitly trusted then check if there is an alternative 389 * chain that could be used. We only do this if we haven't already 390 * checked via TRUSTED_FIRST and the user hasn't switched off alternate 391 * chain checking 392 */ 393 retry = 0; 394 if (trust != X509_TRUST_TRUSTED 395 && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) 396 && !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) { 397 while (j-- > 1) { 398 xtmp2 = sk_X509_value(ctx->chain, j - 1); 399 ok = ctx->get_issuer(&xtmp, ctx, xtmp2); 400 if (ok < 0) { 401 ctx->error = X509_V_ERR_STORE_LOOKUP; 402 goto err; 403 } 404 /* Check if we found an alternate chain */ 405 if (ok > 0) { 406 /* 407 * Free up the found cert we'll add it again later 408 */ 409 X509_free(xtmp); 410 411 /* 412 * Dump all the certs above this point - we've found an 413 * alternate chain 414 */ 415 while (num > j) { 416 xtmp = sk_X509_pop(ctx->chain); 417 X509_free(xtmp); 418 num--; 419 } 420 ctx->last_untrusted = sk_X509_num(ctx->chain); 421 retry = 1; 422 break; 423 } 424 } 425 } 426 } while (retry); 427 428 /* 429 * If not explicitly trusted then indicate error unless it's a single 430 * self signed certificate in which case we've indicated an error already 431 * and set bad_chain == 1 432 */ 433 if (trust != X509_TRUST_TRUSTED && !bad_chain) { 434 if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss)) { 435 if (ctx->last_untrusted >= num) 436 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY; 437 else 438 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT; 439 ctx->current_cert = x; 440 } else { 441 442 sk_X509_push(ctx->chain, chain_ss); 443 num++; 444 ctx->last_untrusted = num; 445 ctx->current_cert = chain_ss; 446 ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; 447 chain_ss = NULL; 448 } 449 450 ctx->error_depth = num - 1; 451 bad_chain = 1; 452 ok = cb(0, ctx); 453 if (!ok) 454 goto err; 455 } 456 457 /* We have the chain complete: now we need to check its purpose */ 458 ok = check_chain_extensions(ctx); 459 460 if (!ok) 461 goto err; 462 463 /* Check name constraints */ 464 465 ok = check_name_constraints(ctx); 466 467 if (!ok) 468 goto err; 469 470 ok = check_id(ctx); 471 472 if (!ok) 473 goto err; 474 475 /* We may as well copy down any DSA parameters that are required */ 476 X509_get_pubkey_parameters(NULL, ctx->chain); 477 478 /* 479 * Check revocation status: we do this after copying parameters because 480 * they may be needed for CRL signature verification. 481 */ 482 483 ok = ctx->check_revocation(ctx); 484 if (!ok) 485 goto err; 486 487 err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, 488 ctx->param->flags); 489 if (err != X509_V_OK) { 490 ctx->error = err; 491 ctx->current_cert = sk_X509_value(ctx->chain, ctx->error_depth); 492 ok = cb(0, ctx); 493 if (!ok) 494 goto err; 495 } 496 497 /* At this point, we have a chain and need to verify it */ 498 if (ctx->verify != NULL) 499 ok = ctx->verify(ctx); 500 else 501 ok = internal_verify(ctx); 502 if (!ok) 503 goto err; 504 505#ifndef OPENSSL_NO_RFC3779 506 /* RFC 3779 path validation, now that CRL check has been done */ 507 ok = v3_asid_validate_path(ctx); 508 if (!ok) 509 goto err; 510 ok = v3_addr_validate_path(ctx); 511 if (!ok) 512 goto err; 513#endif 514 515 /* If we get this far evaluate policies */ 516 if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK)) 517 ok = ctx->check_policy(ctx); 518 if (!ok) 519 goto err; 520 if (0) { 521 err: 522 /* Ensure we return an error */ 523 if (ok > 0) 524 ok = 0; 525 X509_get_pubkey_parameters(NULL, ctx->chain); 526 } 527 if (sktmp != NULL) 528 sk_X509_free(sktmp); 529 if (chain_ss != NULL) 530 X509_free(chain_ss); 531 532 /* Safety net, error returns must set ctx->error */ 533 if (ok <= 0 && ctx->error == X509_V_OK) 534 ctx->error = X509_V_ERR_UNSPECIFIED; 535 return ok; 536} 537 538/* 539 * Given a STACK_OF(X509) find the issuer of cert (if any) 540 */ 541 542static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) 543{ 544 int i; 545 X509 *issuer; 546 for (i = 0; i < sk_X509_num(sk); i++) { 547 issuer = sk_X509_value(sk, i); 548 if (ctx->check_issued(ctx, x, issuer)) 549 return issuer; 550 } 551 return NULL; 552} 553 554/* Given a possible certificate and issuer check them */ 555 556static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) 557{ 558 int ret; 559 ret = X509_check_issued(issuer, x); 560 if (ret == X509_V_OK) 561 return 1; 562 /* If we haven't asked for issuer errors don't set ctx */ 563 if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK)) 564 return 0; 565 566 ctx->error = ret; 567 ctx->current_cert = x; 568 ctx->current_issuer = issuer; 569 return ctx->verify_cb(0, ctx); 570} 571 572/* Alternative lookup method: look from a STACK stored in other_ctx */ 573 574static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) 575{ 576 *issuer = find_issuer(ctx, ctx->other_ctx, x); 577 if (*issuer) { 578 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509); 579 return 1; 580 } else 581 return 0; 582} 583 584/* 585 * Check a certificate chains extensions for consistency with the supplied 586 * purpose 587 */ 588 589static int check_chain_extensions(X509_STORE_CTX *ctx) 590{ 591#ifdef OPENSSL_NO_CHAIN_VERIFY 592 return 1; 593#else 594 int i, ok = 0, must_be_ca, plen = 0; 595 X509 *x; 596 int (*cb) (int xok, X509_STORE_CTX *xctx); 597 int proxy_path_length = 0; 598 int purpose; 599 int allow_proxy_certs; 600 cb = ctx->verify_cb; 601 602 /*- 603 * must_be_ca can have 1 of 3 values: 604 * -1: we accept both CA and non-CA certificates, to allow direct 605 * use of self-signed certificates (which are marked as CA). 606 * 0: we only accept non-CA certificates. This is currently not 607 * used, but the possibility is present for future extensions. 608 * 1: we only accept CA certificates. This is currently used for 609 * all certificates in the chain except the leaf certificate. 610 */ 611 must_be_ca = -1; 612 613 /* CRL path validation */ 614 if (ctx->parent) { 615 allow_proxy_certs = 0; 616 purpose = X509_PURPOSE_CRL_SIGN; 617 } else { 618 allow_proxy_certs = 619 ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS); 620 /* 621 * A hack to keep people who don't want to modify their software 622 * happy 623 */ 624 if (ossl_safe_getenv("OPENSSL_ALLOW_PROXY_CERTS")) 625 allow_proxy_certs = 1; 626 purpose = ctx->param->purpose; 627 } 628 629 /* Check all untrusted certificates */ 630 for (i = 0; i < ctx->last_untrusted; i++) { 631 int ret; 632 x = sk_X509_value(ctx->chain, i); 633 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) 634 && (x->ex_flags & EXFLAG_CRITICAL)) { 635 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION; 636 ctx->error_depth = i; 637 ctx->current_cert = x; 638 ok = cb(0, ctx); 639 if (!ok) 640 goto end; 641 } 642 if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) { 643 ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED; 644 ctx->error_depth = i; 645 ctx->current_cert = x; 646 ok = cb(0, ctx); 647 if (!ok) 648 goto end; 649 } 650 ret = X509_check_ca(x); 651 switch (must_be_ca) { 652 case -1: 653 if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) 654 && (ret != 1) && (ret != 0)) { 655 ret = 0; 656 ctx->error = X509_V_ERR_INVALID_CA; 657 } else 658 ret = 1; 659 break; 660 case 0: 661 if (ret != 0) { 662 ret = 0; 663 ctx->error = X509_V_ERR_INVALID_NON_CA; 664 } else 665 ret = 1; 666 break; 667 default: 668 if ((ret == 0) 669 || ((ctx->param->flags & X509_V_FLAG_X509_STRICT) 670 && (ret != 1))) { 671 ret = 0; 672 ctx->error = X509_V_ERR_INVALID_CA; 673 } else 674 ret = 1; 675 break; 676 } 677 if (ret == 0) { 678 ctx->error_depth = i; 679 ctx->current_cert = x; 680 ok = cb(0, ctx); 681 if (!ok) 682 goto end; 683 } 684 if (ctx->param->purpose > 0) { 685 ret = X509_check_purpose(x, purpose, must_be_ca > 0); 686 if ((ret == 0) 687 || ((ctx->param->flags & X509_V_FLAG_X509_STRICT) 688 && (ret != 1))) { 689 ctx->error = X509_V_ERR_INVALID_PURPOSE; 690 ctx->error_depth = i; 691 ctx->current_cert = x; 692 ok = cb(0, ctx); 693 if (!ok) 694 goto end; 695 } 696 } 697 /* Check pathlen */ 698 if ((i > 1) && (x->ex_pathlen != -1) 699 && (plen > (x->ex_pathlen + proxy_path_length))) { 700 ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED; 701 ctx->error_depth = i; 702 ctx->current_cert = x; 703 ok = cb(0, ctx); 704 if (!ok) 705 goto end; 706 } 707 /* Increment path length if not a self issued intermediate CA */ 708 if (i > 0 && (x->ex_flags & EXFLAG_SI) == 0) 709 plen++; 710 /* 711 * If this certificate is a proxy certificate, the next certificate 712 * must be another proxy certificate or a EE certificate. If not, 713 * the next certificate must be a CA certificate. 714 */ 715 if (x->ex_flags & EXFLAG_PROXY) { 716 /* 717 * RFC3820, 4.1.3 (b)(1) stipulates that if pCPathLengthConstraint 718 * is less than max_path_length, the former should be copied to 719 * the latter, and 4.1.4 (a) stipulates that max_path_length 720 * should be verified to be larger than zero and decrement it. 721 * 722 * Because we're checking the certs in the reverse order, we start 723 * with verifying that proxy_path_length isn't larger than pcPLC, 724 * and copy the latter to the former if it is, and finally, 725 * increment proxy_path_length. 726 */ 727 if (x->ex_pcpathlen != -1) { 728 if (proxy_path_length > x->ex_pcpathlen) { 729 ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED; 730 ctx->error_depth = i; 731 ctx->current_cert = x; 732 ok = cb(0, ctx); 733 if (!ok) 734 goto end; 735 } 736 proxy_path_length = x->ex_pcpathlen; 737 } 738 proxy_path_length++; 739 must_be_ca = 0; 740 } else 741 must_be_ca = 1; 742 } 743 ok = 1; 744 end: 745 return ok; 746#endif 747} 748 749static int check_name_constraints(X509_STORE_CTX *ctx) 750{ 751 X509 *x; 752 int i, j, rv; 753 /* Check name constraints for all certificates */ 754 for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) { 755 x = sk_X509_value(ctx->chain, i); 756 /* Ignore self issued certs unless last in chain */ 757 if (i && (x->ex_flags & EXFLAG_SI)) 758 continue; 759 760 /* 761 * Proxy certificates policy has an extra constraint, where the 762 * certificate subject MUST be the issuer with a single CN entry 763 * added. 764 * (RFC 3820: 3.4, 4.1.3 (a)(4)) 765 */ 766 if (x->ex_flags & EXFLAG_PROXY) { 767 X509_NAME *tmpsubject = X509_get_subject_name(x); 768 X509_NAME *tmpissuer = X509_get_issuer_name(x); 769 X509_NAME_ENTRY *tmpentry = NULL; 770 int last_object_nid = 0; 771 int err = X509_V_OK; 772 int last_object_loc = X509_NAME_entry_count(tmpsubject) - 1; 773 774 /* Check that there are at least two RDNs */ 775 if (last_object_loc < 1) { 776 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 777 goto proxy_name_done; 778 } 779 780 /* 781 * Check that there is exactly one more RDN in subject as 782 * there is in issuer. 783 */ 784 if (X509_NAME_entry_count(tmpsubject) 785 != X509_NAME_entry_count(tmpissuer) + 1) { 786 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 787 goto proxy_name_done; 788 } 789 790 /* 791 * Check that the last subject component isn't part of a 792 * multivalued RDN 793 */ 794 if (X509_NAME_get_entry(tmpsubject, last_object_loc)->set 795 == X509_NAME_get_entry(tmpsubject, last_object_loc - 1)->set) { 796 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 797 goto proxy_name_done; 798 } 799 800 /* 801 * Check that the last subject RDN is a commonName, and that 802 * all the previous RDNs match the issuer exactly 803 */ 804 tmpsubject = X509_NAME_dup(tmpsubject); 805 if (tmpsubject == NULL) { 806 X509err(X509_F_CHECK_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE); 807 ctx->error = X509_V_ERR_OUT_OF_MEM; 808 return 0; 809 } 810 811 tmpentry = 812 X509_NAME_delete_entry(tmpsubject, last_object_loc); 813 last_object_nid = 814 OBJ_obj2nid(X509_NAME_ENTRY_get_object(tmpentry)); 815 816 if (last_object_nid != NID_commonName 817 || X509_NAME_cmp(tmpsubject, tmpissuer) != 0) { 818 err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; 819 } 820 821 X509_NAME_ENTRY_free(tmpentry); 822 X509_NAME_free(tmpsubject); 823 824 proxy_name_done: 825 if (err != X509_V_OK) { 826 ctx->error = err; 827 ctx->error_depth = i; 828 ctx->current_cert = x; 829 if (!ctx->verify_cb(0, ctx)) 830 return 0; 831 } 832 } 833 834 /* 835 * Check against constraints for all certificates higher in chain 836 * including trust anchor. Trust anchor not strictly speaking needed 837 * but if it includes constraints it is to be assumed it expects them 838 * to be obeyed. 839 */ 840 for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) { 841 NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc; 842 if (nc) { 843 rv = NAME_CONSTRAINTS_check(x, nc); 844 switch (rv) { 845 case X509_V_OK: 846 continue; 847 case X509_V_ERR_OUT_OF_MEM: 848 ctx->error = rv; 849 return 0; 850 default: 851 ctx->error = rv; 852 ctx->error_depth = i; 853 ctx->current_cert = x; 854 if (!ctx->verify_cb(0, ctx)) 855 return 0; 856 break; 857 } 858 } 859 } 860 } 861 return 1; 862} 863 864static int check_id_error(X509_STORE_CTX *ctx, int errcode) 865{ 866 ctx->error = errcode; 867 ctx->current_cert = ctx->cert; 868 ctx->error_depth = 0; 869 return ctx->verify_cb(0, ctx); 870} 871 872static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id) 873{ 874 int i; 875 int n = sk_OPENSSL_STRING_num(id->hosts); 876 char *name; 877 878 if (id->peername != NULL) { 879 OPENSSL_free(id->peername); 880 id->peername = NULL; 881 } 882 for (i = 0; i < n; ++i) { 883 name = sk_OPENSSL_STRING_value(id->hosts, i); 884 if (X509_check_host(x, name, 0, id->hostflags, &id->peername) > 0) 885 return 1; 886 } 887 return n == 0; 888} 889 890static int check_id(X509_STORE_CTX *ctx) 891{ 892 X509_VERIFY_PARAM *vpm = ctx->param; 893 X509_VERIFY_PARAM_ID *id = vpm->id; 894 X509 *x = ctx->cert; 895 if (id->hosts && check_hosts(x, id) <= 0) { 896 if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH)) 897 return 0; 898 } 899 if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0) { 900 if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH)) 901 return 0; 902 } 903 if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0) { 904 if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH)) 905 return 0; 906 } 907 return 1; 908} 909 910static int check_trust(X509_STORE_CTX *ctx) 911{ 912 int i, ok; 913 X509 *x = NULL; 914 int (*cb) (int xok, X509_STORE_CTX *xctx); 915 cb = ctx->verify_cb; 916 /* Check all trusted certificates in chain */ 917 for (i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) { 918 x = sk_X509_value(ctx->chain, i); 919 ok = X509_check_trust(x, ctx->param->trust, 0); 920 /* If explicitly trusted return trusted */ 921 if (ok == X509_TRUST_TRUSTED) 922 return X509_TRUST_TRUSTED; 923 /* 924 * If explicitly rejected notify callback and reject if not 925 * overridden. 926 */ 927 if (ok == X509_TRUST_REJECTED) { 928 ctx->error_depth = i; 929 ctx->current_cert = x; 930 ctx->error = X509_V_ERR_CERT_REJECTED; 931 ok = cb(0, ctx); 932 if (!ok) 933 return X509_TRUST_REJECTED; 934 } 935 } 936 /* 937 * If we accept partial chains and have at least one trusted certificate 938 * return success. 939 */ 940 if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { 941 X509 *mx; 942 if (ctx->last_untrusted < sk_X509_num(ctx->chain)) 943 return X509_TRUST_TRUSTED; 944 x = sk_X509_value(ctx->chain, 0); 945 mx = lookup_cert_match(ctx, x); 946 if (mx) { 947 (void)sk_X509_set(ctx->chain, 0, mx); 948 X509_free(x); 949 ctx->last_untrusted = 0; 950 return X509_TRUST_TRUSTED; 951 } 952 } 953 954 /* 955 * If no trusted certs in chain at all return untrusted and allow 956 * standard (no issuer cert) etc errors to be indicated. 957 */ 958 return X509_TRUST_UNTRUSTED; 959} 960 961static int check_revocation(X509_STORE_CTX *ctx) 962{ 963 int i, last, ok; 964 if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK)) 965 return 1; 966 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) 967 last = sk_X509_num(ctx->chain) - 1; 968 else { 969 /* If checking CRL paths this isn't the EE certificate */ 970 if (ctx->parent) 971 return 1; 972 last = 0; 973 } 974 for (i = 0; i <= last; i++) { 975 ctx->error_depth = i; 976 ok = check_cert(ctx); 977 if (!ok) 978 return ok; 979 } 980 return 1; 981} 982 983static int check_cert(X509_STORE_CTX *ctx) 984{ 985 X509_CRL *crl = NULL, *dcrl = NULL; 986 X509 *x; 987 int ok, cnum; 988 unsigned int last_reasons; 989 cnum = ctx->error_depth; 990 x = sk_X509_value(ctx->chain, cnum); 991 ctx->current_cert = x; 992 ctx->current_issuer = NULL; 993 ctx->current_crl_score = 0; 994 ctx->current_reasons = 0; 995 if (x->ex_flags & EXFLAG_PROXY) 996 return 1; 997 while (ctx->current_reasons != CRLDP_ALL_REASONS) { 998 last_reasons = ctx->current_reasons; 999 /* Try to retrieve relevant CRL */ 1000 if (ctx->get_crl) 1001 ok = ctx->get_crl(ctx, &crl, x); 1002 else 1003 ok = get_crl_delta(ctx, &crl, &dcrl, x); 1004 /* 1005 * If error looking up CRL, nothing we can do except notify callback 1006 */ 1007 if (!ok) { 1008 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; 1009 ok = ctx->verify_cb(0, ctx); 1010 goto err; 1011 } 1012 ctx->current_crl = crl; 1013 ok = ctx->check_crl(ctx, crl); 1014 if (!ok) 1015 goto err; 1016 1017 if (dcrl) { 1018 ok = ctx->check_crl(ctx, dcrl); 1019 if (!ok) 1020 goto err; 1021 ok = ctx->cert_crl(ctx, dcrl, x); 1022 if (!ok) 1023 goto err; 1024 } else 1025 ok = 1; 1026 1027 /* Don't look in full CRL if delta reason is removefromCRL */ 1028 if (ok != 2) { 1029 ok = ctx->cert_crl(ctx, crl, x); 1030 if (!ok) 1031 goto err; 1032 } 1033 1034 X509_CRL_free(crl); 1035 X509_CRL_free(dcrl); 1036 crl = NULL; 1037 dcrl = NULL; 1038 /* 1039 * If reasons not updated we wont get anywhere by another iteration, 1040 * so exit loop. 1041 */ 1042 if (last_reasons == ctx->current_reasons) { 1043 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; 1044 ok = ctx->verify_cb(0, ctx); 1045 goto err; 1046 } 1047 } 1048 err: 1049 X509_CRL_free(crl); 1050 X509_CRL_free(dcrl); 1051 1052 ctx->current_crl = NULL; 1053 return ok; 1054 1055} 1056 1057/* Check CRL times against values in X509_STORE_CTX */ 1058 1059static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) 1060{ 1061 time_t *ptime; 1062 int i; 1063 if (notify) 1064 ctx->current_crl = crl; 1065 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) 1066 ptime = &ctx->param->check_time; 1067 else 1068 ptime = NULL; 1069 1070 i = X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime); 1071 if (i == 0) { 1072 if (!notify) 1073 return 0; 1074 ctx->error = X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD; 1075 if (!ctx->verify_cb(0, ctx)) 1076 return 0; 1077 } 1078 1079 if (i > 0) { 1080 if (!notify) 1081 return 0; 1082 ctx->error = X509_V_ERR_CRL_NOT_YET_VALID; 1083 if (!ctx->verify_cb(0, ctx)) 1084 return 0; 1085 } 1086 1087 if (X509_CRL_get_nextUpdate(crl)) { 1088 i = X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime); 1089 1090 if (i == 0) { 1091 if (!notify) 1092 return 0; 1093 ctx->error = X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD; 1094 if (!ctx->verify_cb(0, ctx)) 1095 return 0; 1096 } 1097 /* Ignore expiry of base CRL is delta is valid */ 1098 if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) { 1099 if (!notify) 1100 return 0; 1101 ctx->error = X509_V_ERR_CRL_HAS_EXPIRED; 1102 if (!ctx->verify_cb(0, ctx)) 1103 return 0; 1104 } 1105 } 1106 1107 if (notify) 1108 ctx->current_crl = NULL; 1109 1110 return 1; 1111} 1112 1113static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, 1114 X509 **pissuer, int *pscore, unsigned int *preasons, 1115 STACK_OF(X509_CRL) *crls) 1116{ 1117 int i, crl_score, best_score = *pscore; 1118 unsigned int reasons, best_reasons = 0; 1119 X509 *x = ctx->current_cert; 1120 X509_CRL *crl, *best_crl = NULL; 1121 X509 *crl_issuer = NULL, *best_crl_issuer = NULL; 1122 1123 for (i = 0; i < sk_X509_CRL_num(crls); i++) { 1124 crl = sk_X509_CRL_value(crls, i); 1125 reasons = *preasons; 1126 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x); 1127 if (crl_score < best_score || crl_score == 0) 1128 continue; 1129 /* If current CRL is equivalent use it if it is newer */ 1130 if (crl_score == best_score && best_crl != NULL) { 1131 int day, sec; 1132 if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), 1133 X509_CRL_get_lastUpdate(crl)) == 0) 1134 continue; 1135 /* 1136 * ASN1_TIME_diff never returns inconsistent signs for |day| 1137 * and |sec|. 1138 */ 1139 if (day <= 0 && sec <= 0) 1140 continue; 1141 } 1142 best_crl = crl; 1143 best_crl_issuer = crl_issuer; 1144 best_score = crl_score; 1145 best_reasons = reasons; 1146 } 1147 1148 if (best_crl) { 1149 if (*pcrl) 1150 X509_CRL_free(*pcrl); 1151 *pcrl = best_crl; 1152 *pissuer = best_crl_issuer; 1153 *pscore = best_score; 1154 *preasons = best_reasons; 1155 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509_CRL); 1156 if (*pdcrl) { 1157 X509_CRL_free(*pdcrl); 1158 *pdcrl = NULL; 1159 } 1160 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls); 1161 } 1162 1163 if (best_score >= CRL_SCORE_VALID) 1164 return 1; 1165 1166 return 0; 1167} 1168 1169/* 1170 * Compare two CRL extensions for delta checking purposes. They should be 1171 * both present or both absent. If both present all fields must be identical. 1172 */ 1173 1174static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) 1175{ 1176 ASN1_OCTET_STRING *exta, *extb; 1177 int i; 1178 i = X509_CRL_get_ext_by_NID(a, nid, -1); 1179 if (i >= 0) { 1180 /* Can't have multiple occurrences */ 1181 if (X509_CRL_get_ext_by_NID(a, nid, i) != -1) 1182 return 0; 1183 exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i)); 1184 } else 1185 exta = NULL; 1186 1187 i = X509_CRL_get_ext_by_NID(b, nid, -1); 1188 1189 if (i >= 0) { 1190 1191 if (X509_CRL_get_ext_by_NID(b, nid, i) != -1) 1192 return 0; 1193 extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i)); 1194 } else 1195 extb = NULL; 1196 1197 if (!exta && !extb) 1198 return 1; 1199 1200 if (!exta || !extb) 1201 return 0; 1202 1203 if (ASN1_OCTET_STRING_cmp(exta, extb)) 1204 return 0; 1205 1206 return 1; 1207} 1208 1209/* See if a base and delta are compatible */ 1210 1211static int check_delta_base(X509_CRL *delta, X509_CRL *base) 1212{ 1213 /* Delta CRL must be a delta */ 1214 if (!delta->base_crl_number) 1215 return 0; 1216 /* Base must have a CRL number */ 1217 if (!base->crl_number) 1218 return 0; 1219 /* Issuer names must match */ 1220 if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(delta))) 1221 return 0; 1222 /* AKID and IDP must match */ 1223 if (!crl_extension_match(delta, base, NID_authority_key_identifier)) 1224 return 0; 1225 if (!crl_extension_match(delta, base, NID_issuing_distribution_point)) 1226 return 0; 1227 /* Delta CRL base number must not exceed Full CRL number. */ 1228 if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0) 1229 return 0; 1230 /* Delta CRL number must exceed full CRL number */ 1231 if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0) 1232 return 1; 1233 return 0; 1234} 1235 1236/* 1237 * For a given base CRL find a delta... maybe extend to delta scoring or 1238 * retrieve a chain of deltas... 1239 */ 1240 1241static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, 1242 X509_CRL *base, STACK_OF(X509_CRL) *crls) 1243{ 1244 X509_CRL *delta; 1245 int i; 1246 if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS)) 1247 return; 1248 if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST)) 1249 return; 1250 for (i = 0; i < sk_X509_CRL_num(crls); i++) { 1251 delta = sk_X509_CRL_value(crls, i); 1252 if (check_delta_base(delta, base)) { 1253 if (check_crl_time(ctx, delta, 0)) 1254 *pscore |= CRL_SCORE_TIME_DELTA; 1255 CRYPTO_add(&delta->references, 1, CRYPTO_LOCK_X509_CRL); 1256 *dcrl = delta; 1257 return; 1258 } 1259 } 1260 *dcrl = NULL; 1261} 1262 1263/* 1264 * For a given CRL return how suitable it is for the supplied certificate 1265 * 'x'. The return value is a mask of several criteria. If the issuer is not 1266 * the certificate issuer this is returned in *pissuer. The reasons mask is 1267 * also used to determine if the CRL is suitable: if no new reasons the CRL 1268 * is rejected, otherwise reasons is updated. 1269 */ 1270 1271static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, 1272 unsigned int *preasons, X509_CRL *crl, X509 *x) 1273{ 1274 1275 int crl_score = 0; 1276 unsigned int tmp_reasons = *preasons, crl_reasons; 1277 1278 /* First see if we can reject CRL straight away */ 1279 1280 /* Invalid IDP cannot be processed */ 1281 if (crl->idp_flags & IDP_INVALID) 1282 return 0; 1283 /* Reason codes or indirect CRLs need extended CRL support */ 1284 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) { 1285 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS)) 1286 return 0; 1287 } else if (crl->idp_flags & IDP_REASONS) { 1288 /* If no new reasons reject */ 1289 if (!(crl->idp_reasons & ~tmp_reasons)) 1290 return 0; 1291 } 1292 /* Don't process deltas at this stage */ 1293 else if (crl->base_crl_number) 1294 return 0; 1295 /* If issuer name doesn't match certificate need indirect CRL */ 1296 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) { 1297 if (!(crl->idp_flags & IDP_INDIRECT)) 1298 return 0; 1299 } else 1300 crl_score |= CRL_SCORE_ISSUER_NAME; 1301 1302 if (!(crl->flags & EXFLAG_CRITICAL)) 1303 crl_score |= CRL_SCORE_NOCRITICAL; 1304 1305 /* Check expiry */ 1306 if (check_crl_time(ctx, crl, 0)) 1307 crl_score |= CRL_SCORE_TIME; 1308 1309 /* Check authority key ID and locate certificate issuer */ 1310 crl_akid_check(ctx, crl, pissuer, &crl_score); 1311 1312 /* If we can't locate certificate issuer at this point forget it */ 1313 1314 if (!(crl_score & CRL_SCORE_AKID)) 1315 return 0; 1316 1317 /* Check cert for matching CRL distribution points */ 1318 1319 if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) { 1320 /* If no new reasons reject */ 1321 if (!(crl_reasons & ~tmp_reasons)) 1322 return 0; 1323 tmp_reasons |= crl_reasons; 1324 crl_score |= CRL_SCORE_SCOPE; 1325 } 1326 1327 *preasons = tmp_reasons; 1328 1329 return crl_score; 1330 1331} 1332 1333static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, 1334 X509 **pissuer, int *pcrl_score) 1335{ 1336 X509 *crl_issuer = NULL; 1337 X509_NAME *cnm = X509_CRL_get_issuer(crl); 1338 int cidx = ctx->error_depth; 1339 int i; 1340 1341 if (cidx != sk_X509_num(ctx->chain) - 1) 1342 cidx++; 1343 1344 crl_issuer = sk_X509_value(ctx->chain, cidx); 1345 1346 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1347 if (*pcrl_score & CRL_SCORE_ISSUER_NAME) { 1348 *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_ISSUER_CERT; 1349 *pissuer = crl_issuer; 1350 return; 1351 } 1352 } 1353 1354 for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) { 1355 crl_issuer = sk_X509_value(ctx->chain, cidx); 1356 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) 1357 continue; 1358 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1359 *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_SAME_PATH; 1360 *pissuer = crl_issuer; 1361 return; 1362 } 1363 } 1364 1365 /* Anything else needs extended CRL support */ 1366 1367 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) 1368 return; 1369 1370 /* 1371 * Otherwise the CRL issuer is not on the path. Look for it in the set of 1372 * untrusted certificates. 1373 */ 1374 for (i = 0; i < sk_X509_num(ctx->untrusted); i++) { 1375 crl_issuer = sk_X509_value(ctx->untrusted, i); 1376 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) 1377 continue; 1378 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { 1379 *pissuer = crl_issuer; 1380 *pcrl_score |= CRL_SCORE_AKID; 1381 return; 1382 } 1383 } 1384} 1385 1386/* 1387 * Check the path of a CRL issuer certificate. This creates a new 1388 * X509_STORE_CTX and populates it with most of the parameters from the 1389 * parent. This could be optimised somewhat since a lot of path checking will 1390 * be duplicated by the parent, but this will rarely be used in practice. 1391 */ 1392 1393static int check_crl_path(X509_STORE_CTX *ctx, X509 *x) 1394{ 1395 X509_STORE_CTX crl_ctx; 1396 int ret; 1397 /* Don't allow recursive CRL path validation */ 1398 if (ctx->parent) 1399 return 0; 1400 if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted)) 1401 return -1; 1402 1403 crl_ctx.crls = ctx->crls; 1404 /* Copy verify params across */ 1405 X509_STORE_CTX_set0_param(&crl_ctx, ctx->param); 1406 1407 crl_ctx.parent = ctx; 1408 crl_ctx.verify_cb = ctx->verify_cb; 1409 1410 /* Verify CRL issuer */ 1411 ret = X509_verify_cert(&crl_ctx); 1412 1413 if (ret <= 0) 1414 goto err; 1415 1416 /* Check chain is acceptable */ 1417 1418 ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain); 1419 err: 1420 X509_STORE_CTX_cleanup(&crl_ctx); 1421 return ret; 1422} 1423 1424/* 1425 * RFC3280 says nothing about the relationship between CRL path and 1426 * certificate path, which could lead to situations where a certificate could 1427 * be revoked or validated by a CA not authorised to do so. RFC5280 is more 1428 * strict and states that the two paths must end in the same trust anchor, 1429 * though some discussions remain... until this is resolved we use the 1430 * RFC5280 version 1431 */ 1432 1433static int check_crl_chain(X509_STORE_CTX *ctx, 1434 STACK_OF(X509) *cert_path, 1435 STACK_OF(X509) *crl_path) 1436{ 1437 X509 *cert_ta, *crl_ta; 1438 cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1); 1439 crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1); 1440 if (!X509_cmp(cert_ta, crl_ta)) 1441 return 1; 1442 return 0; 1443} 1444 1445/*- 1446 * Check for match between two dist point names: three separate cases. 1447 * 1. Both are relative names and compare X509_NAME types. 1448 * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES. 1449 * 3. Both are full names and compare two GENERAL_NAMES. 1450 * 4. One is NULL: automatic match. 1451 */ 1452 1453static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b) 1454{ 1455 X509_NAME *nm = NULL; 1456 GENERAL_NAMES *gens = NULL; 1457 GENERAL_NAME *gena, *genb; 1458 int i, j; 1459 if (!a || !b) 1460 return 1; 1461 if (a->type == 1) { 1462 if (!a->dpname) 1463 return 0; 1464 /* Case 1: two X509_NAME */ 1465 if (b->type == 1) { 1466 if (!b->dpname) 1467 return 0; 1468 if (!X509_NAME_cmp(a->dpname, b->dpname)) 1469 return 1; 1470 else 1471 return 0; 1472 } 1473 /* Case 2: set name and GENERAL_NAMES appropriately */ 1474 nm = a->dpname; 1475 gens = b->name.fullname; 1476 } else if (b->type == 1) { 1477 if (!b->dpname) 1478 return 0; 1479 /* Case 2: set name and GENERAL_NAMES appropriately */ 1480 gens = a->name.fullname; 1481 nm = b->dpname; 1482 } 1483 1484 /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */ 1485 if (nm) { 1486 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { 1487 gena = sk_GENERAL_NAME_value(gens, i); 1488 if (gena->type != GEN_DIRNAME) 1489 continue; 1490 if (!X509_NAME_cmp(nm, gena->d.directoryName)) 1491 return 1; 1492 } 1493 return 0; 1494 } 1495 1496 /* Else case 3: two GENERAL_NAMES */ 1497 1498 for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) { 1499 gena = sk_GENERAL_NAME_value(a->name.fullname, i); 1500 for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) { 1501 genb = sk_GENERAL_NAME_value(b->name.fullname, j); 1502 if (!GENERAL_NAME_cmp(gena, genb)) 1503 return 1; 1504 } 1505 } 1506 1507 return 0; 1508 1509} 1510 1511static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score) 1512{ 1513 int i; 1514 X509_NAME *nm = X509_CRL_get_issuer(crl); 1515 /* If no CRLissuer return is successful iff don't need a match */ 1516 if (!dp->CRLissuer) 1517 return ! !(crl_score & CRL_SCORE_ISSUER_NAME); 1518 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) { 1519 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i); 1520 if (gen->type != GEN_DIRNAME) 1521 continue; 1522 if (!X509_NAME_cmp(gen->d.directoryName, nm)) 1523 return 1; 1524 } 1525 return 0; 1526} 1527 1528/* Check CRLDP and IDP */ 1529 1530static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, 1531 unsigned int *preasons) 1532{ 1533 int i; 1534 if (crl->idp_flags & IDP_ONLYATTR) 1535 return 0; 1536 if (x->ex_flags & EXFLAG_CA) { 1537 if (crl->idp_flags & IDP_ONLYUSER) 1538 return 0; 1539 } else { 1540 if (crl->idp_flags & IDP_ONLYCA) 1541 return 0; 1542 } 1543 *preasons = crl->idp_reasons; 1544 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) { 1545 DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i); 1546 if (crldp_check_crlissuer(dp, crl, crl_score)) { 1547 if (!crl->idp || idp_check_dp(dp->distpoint, crl->idp->distpoint)) { 1548 *preasons &= dp->dp_reasons; 1549 return 1; 1550 } 1551 } 1552 } 1553 if ((!crl->idp || !crl->idp->distpoint) 1554 && (crl_score & CRL_SCORE_ISSUER_NAME)) 1555 return 1; 1556 return 0; 1557} 1558 1559/* 1560 * Retrieve CRL corresponding to current certificate. If deltas enabled try 1561 * to find a delta CRL too 1562 */ 1563 1564static int get_crl_delta(X509_STORE_CTX *ctx, 1565 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x) 1566{ 1567 int ok; 1568 X509 *issuer = NULL; 1569 int crl_score = 0; 1570 unsigned int reasons; 1571 X509_CRL *crl = NULL, *dcrl = NULL; 1572 STACK_OF(X509_CRL) *skcrl; 1573 X509_NAME *nm = X509_get_issuer_name(x); 1574 reasons = ctx->current_reasons; 1575 ok = get_crl_sk(ctx, &crl, &dcrl, 1576 &issuer, &crl_score, &reasons, ctx->crls); 1577 1578 if (ok) 1579 goto done; 1580 1581 /* Lookup CRLs from store */ 1582 1583 skcrl = ctx->lookup_crls(ctx, nm); 1584 1585 /* If no CRLs found and a near match from get_crl_sk use that */ 1586 if (!skcrl && crl) 1587 goto done; 1588 1589 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl); 1590 1591 sk_X509_CRL_pop_free(skcrl, X509_CRL_free); 1592 1593 done: 1594 1595 /* If we got any kind of CRL use it and return success */ 1596 if (crl) { 1597 ctx->current_issuer = issuer; 1598 ctx->current_crl_score = crl_score; 1599 ctx->current_reasons = reasons; 1600 *pcrl = crl; 1601 *pdcrl = dcrl; 1602 return 1; 1603 } 1604 1605 return 0; 1606} 1607 1608/* Check CRL validity */ 1609static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) 1610{ 1611 X509 *issuer = NULL; 1612 EVP_PKEY *ikey = NULL; 1613 int ok = 0, chnum, cnum; 1614 cnum = ctx->error_depth; 1615 chnum = sk_X509_num(ctx->chain) - 1; 1616 /* if we have an alternative CRL issuer cert use that */ 1617 if (ctx->current_issuer) 1618 issuer = ctx->current_issuer; 1619 1620 /* 1621 * Else find CRL issuer: if not last certificate then issuer is next 1622 * certificate in chain. 1623 */ 1624 else if (cnum < chnum) 1625 issuer = sk_X509_value(ctx->chain, cnum + 1); 1626 else { 1627 issuer = sk_X509_value(ctx->chain, chnum); 1628 /* If not self signed, can't check signature */ 1629 if (!ctx->check_issued(ctx, issuer, issuer)) { 1630 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER; 1631 ok = ctx->verify_cb(0, ctx); 1632 if (!ok) 1633 goto err; 1634 } 1635 } 1636 1637 if (issuer) { 1638 /* 1639 * Skip most tests for deltas because they have already been done 1640 */ 1641 if (!crl->base_crl_number) { 1642 /* Check for cRLSign bit if keyUsage present */ 1643 if ((issuer->ex_flags & EXFLAG_KUSAGE) && 1644 !(issuer->ex_kusage & KU_CRL_SIGN)) { 1645 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN; 1646 ok = ctx->verify_cb(0, ctx); 1647 if (!ok) 1648 goto err; 1649 } 1650 1651 if (!(ctx->current_crl_score & CRL_SCORE_SCOPE)) { 1652 ctx->error = X509_V_ERR_DIFFERENT_CRL_SCOPE; 1653 ok = ctx->verify_cb(0, ctx); 1654 if (!ok) 1655 goto err; 1656 } 1657 1658 if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH)) { 1659 if (check_crl_path(ctx, ctx->current_issuer) <= 0) { 1660 ctx->error = X509_V_ERR_CRL_PATH_VALIDATION_ERROR; 1661 ok = ctx->verify_cb(0, ctx); 1662 if (!ok) 1663 goto err; 1664 } 1665 } 1666 1667 if (crl->idp_flags & IDP_INVALID) { 1668 ctx->error = X509_V_ERR_INVALID_EXTENSION; 1669 ok = ctx->verify_cb(0, ctx); 1670 if (!ok) 1671 goto err; 1672 } 1673 1674 } 1675 1676 if (!(ctx->current_crl_score & CRL_SCORE_TIME)) { 1677 ok = check_crl_time(ctx, crl, 1); 1678 if (!ok) 1679 goto err; 1680 } 1681 1682 /* Attempt to get issuer certificate public key */ 1683 ikey = X509_get_pubkey(issuer); 1684 1685 if (!ikey) { 1686 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY; 1687 ok = ctx->verify_cb(0, ctx); 1688 if (!ok) 1689 goto err; 1690 } else { 1691 int rv; 1692 rv = X509_CRL_check_suiteb(crl, ikey, ctx->param->flags); 1693 if (rv != X509_V_OK) { 1694 ctx->error = rv; 1695 ok = ctx->verify_cb(0, ctx); 1696 if (!ok) 1697 goto err; 1698 } 1699 /* Verify CRL signature */ 1700 if (X509_CRL_verify(crl, ikey) <= 0) { 1701 ctx->error = X509_V_ERR_CRL_SIGNATURE_FAILURE; 1702 ok = ctx->verify_cb(0, ctx); 1703 if (!ok) 1704 goto err; 1705 } 1706 } 1707 } 1708 1709 ok = 1; 1710 1711 err: 1712 EVP_PKEY_free(ikey); 1713 return ok; 1714} 1715 1716/* Check certificate against CRL */ 1717static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) 1718{ 1719 int ok; 1720 X509_REVOKED *rev; 1721 /* 1722 * The rules changed for this... previously if a CRL contained unhandled 1723 * critical extensions it could still be used to indicate a certificate 1724 * was revoked. This has since been changed since critical extension can 1725 * change the meaning of CRL entries. 1726 */ 1727 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) 1728 && (crl->flags & EXFLAG_CRITICAL)) { 1729 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION; 1730 ok = ctx->verify_cb(0, ctx); 1731 if (!ok) 1732 return 0; 1733 } 1734 /* 1735 * Look for serial number of certificate in CRL If found make sure reason 1736 * is not removeFromCRL. 1737 */ 1738 if (X509_CRL_get0_by_cert(crl, &rev, x)) { 1739 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) 1740 return 2; 1741 ctx->error = X509_V_ERR_CERT_REVOKED; 1742 ok = ctx->verify_cb(0, ctx); 1743 if (!ok) 1744 return 0; 1745 } 1746 1747 return 1; 1748} 1749 1750static int check_policy(X509_STORE_CTX *ctx) 1751{ 1752 int ret; 1753 if (ctx->parent) 1754 return 1; 1755 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, 1756 ctx->param->policies, ctx->param->flags); 1757 if (ret == 0) { 1758 X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); 1759 ctx->error = X509_V_ERR_OUT_OF_MEM; 1760 return 0; 1761 } 1762 /* Invalid or inconsistent extensions */ 1763 if (ret == -1) { 1764 /* 1765 * Locate certificates with bad extensions and notify callback. 1766 */ 1767 X509 *x; 1768 int i; 1769 for (i = 1; i < sk_X509_num(ctx->chain); i++) { 1770 x = sk_X509_value(ctx->chain, i); 1771 if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) 1772 continue; 1773 ctx->current_cert = x; 1774 ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION; 1775 if (!ctx->verify_cb(0, ctx)) 1776 return 0; 1777 } 1778 return 1; 1779 } 1780 if (ret == -2) { 1781 ctx->current_cert = NULL; 1782 ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY; 1783 return ctx->verify_cb(0, ctx); 1784 } 1785 1786 if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) { 1787 ctx->current_cert = NULL; 1788 /* 1789 * Verification errors need to be "sticky", a callback may have allowed 1790 * an SSL handshake to continue despite an error, and we must then 1791 * remain in an error state. Therefore, we MUST NOT clear earlier 1792 * verification errors by setting the error to X509_V_OK. 1793 */ 1794 if (!ctx->verify_cb(2, ctx)) 1795 return 0; 1796 } 1797 1798 return 1; 1799} 1800 1801static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) 1802{ 1803 time_t *ptime; 1804 int i; 1805 1806 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) 1807 ptime = &ctx->param->check_time; 1808 else 1809 ptime = NULL; 1810 1811 i = X509_cmp_time(X509_get_notBefore(x), ptime); 1812 if (i == 0) { 1813 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD; 1814 ctx->current_cert = x; 1815 if (!ctx->verify_cb(0, ctx)) 1816 return 0; 1817 } 1818 1819 if (i > 0) { 1820 ctx->error = X509_V_ERR_CERT_NOT_YET_VALID; 1821 ctx->current_cert = x; 1822 if (!ctx->verify_cb(0, ctx)) 1823 return 0; 1824 } 1825 1826 i = X509_cmp_time(X509_get_notAfter(x), ptime); 1827 if (i == 0) { 1828 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD; 1829 ctx->current_cert = x; 1830 if (!ctx->verify_cb(0, ctx)) 1831 return 0; 1832 } 1833 1834 if (i < 0) { 1835 ctx->error = X509_V_ERR_CERT_HAS_EXPIRED; 1836 ctx->current_cert = x; 1837 if (!ctx->verify_cb(0, ctx)) 1838 return 0; 1839 } 1840 1841 return 1; 1842} 1843 1844static int internal_verify(X509_STORE_CTX *ctx) 1845{ 1846 int ok = 0, n; 1847 X509 *xs, *xi; 1848 EVP_PKEY *pkey = NULL; 1849 int (*cb) (int xok, X509_STORE_CTX *xctx); 1850 1851 cb = ctx->verify_cb; 1852 1853 n = sk_X509_num(ctx->chain); 1854 ctx->error_depth = n - 1; 1855 n--; 1856 xi = sk_X509_value(ctx->chain, n); 1857 1858 if (ctx->check_issued(ctx, xi, xi)) 1859 xs = xi; 1860 else { 1861 if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { 1862 xs = xi; 1863 goto check_cert; 1864 } 1865 if (n <= 0) { 1866 ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE; 1867 ctx->current_cert = xi; 1868 ok = cb(0, ctx); 1869 goto end; 1870 } else { 1871 n--; 1872 ctx->error_depth = n; 1873 xs = sk_X509_value(ctx->chain, n); 1874 } 1875 } 1876 1877/* ctx->error=0; not needed */ 1878 while (n >= 0) { 1879 ctx->error_depth = n; 1880 1881 /* 1882 * Skip signature check for self signed certificates unless 1883 * explicitly asked for. It doesn't add any security and just wastes 1884 * time. 1885 */ 1886 if (!xs->valid 1887 && (xs != xi 1888 || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE))) { 1889 if ((pkey = X509_get_pubkey(xi)) == NULL) { 1890 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY; 1891 ctx->current_cert = xi; 1892 ok = (*cb) (0, ctx); 1893 if (!ok) 1894 goto end; 1895 } else if (X509_verify(xs, pkey) <= 0) { 1896 ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE; 1897 ctx->current_cert = xs; 1898 ok = (*cb) (0, ctx); 1899 if (!ok) { 1900 EVP_PKEY_free(pkey); 1901 goto end; 1902 } 1903 } 1904 EVP_PKEY_free(pkey); 1905 pkey = NULL; 1906 } 1907 1908 xs->valid = 1; 1909 1910 check_cert: 1911 ok = check_cert_time(ctx, xs); 1912 if (!ok) 1913 goto end; 1914 1915 /* The last error (if any) is still in the error value */ 1916 ctx->current_issuer = xi; 1917 ctx->current_cert = xs; 1918 ok = (*cb) (1, ctx); 1919 if (!ok) 1920 goto end; 1921 1922 n--; 1923 if (n >= 0) { 1924 xi = xs; 1925 xs = sk_X509_value(ctx->chain, n); 1926 } 1927 } 1928 ok = 1; 1929 end: 1930 return ok; 1931} 1932 1933int X509_cmp_current_time(const ASN1_TIME *ctm) 1934{ 1935 return X509_cmp_time(ctm, NULL); 1936} 1937 1938int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) 1939{ 1940 static const size_t utctime_length = sizeof("YYMMDDHHMMSSZ") - 1; 1941 static const size_t generalizedtime_length = sizeof("YYYYMMDDHHMMSSZ") - 1; 1942 ASN1_TIME *asn1_cmp_time = NULL; 1943 int i, day, sec, ret = 0; 1944 1945 /* 1946 * Note that ASN.1 allows much more slack in the time format than RFC5280. 1947 * In RFC5280, the representation is fixed: 1948 * UTCTime: YYMMDDHHMMSSZ 1949 * GeneralizedTime: YYYYMMDDHHMMSSZ 1950 * 1951 * We do NOT currently enforce the following RFC 5280 requirement: 1952 * "CAs conforming to this profile MUST always encode certificate 1953 * validity dates through the year 2049 as UTCTime; certificate validity 1954 * dates in 2050 or later MUST be encoded as GeneralizedTime." 1955 */ 1956 switch (ctm->type) { 1957 case V_ASN1_UTCTIME: 1958 if (ctm->length != (int)(utctime_length)) 1959 return 0; 1960 break; 1961 case V_ASN1_GENERALIZEDTIME: 1962 if (ctm->length != (int)(generalizedtime_length)) 1963 return 0; 1964 break; 1965 default: 1966 return 0; 1967 } 1968 1969 /** 1970 * Verify the format: the ASN.1 functions we use below allow a more 1971 * flexible format than what's mandated by RFC 5280. 1972 * Digit and date ranges will be verified in the conversion methods. 1973 */ 1974 for (i = 0; i < ctm->length - 1; i++) { 1975 if (!isdigit(ctm->data[i])) 1976 return 0; 1977 } 1978 if (ctm->data[ctm->length - 1] != 'Z') 1979 return 0; 1980 1981 /* 1982 * There is ASN1_UTCTIME_cmp_time_t but no 1983 * ASN1_GENERALIZEDTIME_cmp_time_t or ASN1_TIME_cmp_time_t, 1984 * so we go through ASN.1 1985 */ 1986 asn1_cmp_time = X509_time_adj(NULL, 0, cmp_time); 1987 if (asn1_cmp_time == NULL) 1988 goto err; 1989 if (!ASN1_TIME_diff(&day, &sec, ctm, asn1_cmp_time)) 1990 goto err; 1991 1992 /* 1993 * X509_cmp_time comparison is <=. 1994 * The return value 0 is reserved for errors. 1995 */ 1996 ret = (day >= 0 && sec >= 0) ? -1 : 1; 1997 1998 err: 1999 ASN1_TIME_free(asn1_cmp_time); 2000 return ret; 2001} 2002 2003ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj) 2004{ 2005 return X509_time_adj(s, adj, NULL); 2006} 2007 2008ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm) 2009{ 2010 return X509_time_adj_ex(s, 0, offset_sec, in_tm); 2011} 2012 2013ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, 2014 int offset_day, long offset_sec, time_t *in_tm) 2015{ 2016 time_t t; 2017 2018 if (in_tm) 2019 t = *in_tm; 2020 else 2021 time(&t); 2022 2023 if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) { 2024 if (s->type == V_ASN1_UTCTIME) 2025 return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec); 2026 if (s->type == V_ASN1_GENERALIZEDTIME) 2027 return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec); 2028 } 2029 return ASN1_TIME_adj(s, t, offset_day, offset_sec); 2030} 2031 2032int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) 2033{ 2034 EVP_PKEY *ktmp = NULL, *ktmp2; 2035 int i, j; 2036 2037 if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey)) 2038 return 1; 2039 2040 for (i = 0; i < sk_X509_num(chain); i++) { 2041 ktmp = X509_get_pubkey(sk_X509_value(chain, i)); 2042 if (ktmp == NULL) { 2043 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, 2044 X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY); 2045 return 0; 2046 } 2047 if (!EVP_PKEY_missing_parameters(ktmp)) 2048 break; 2049 else { 2050 EVP_PKEY_free(ktmp); 2051 ktmp = NULL; 2052 } 2053 } 2054 if (ktmp == NULL) { 2055 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, 2056 X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN); 2057 return 0; 2058 } 2059 2060 /* first, populate the other certs */ 2061 for (j = i - 1; j >= 0; j--) { 2062 ktmp2 = X509_get_pubkey(sk_X509_value(chain, j)); 2063 EVP_PKEY_copy_parameters(ktmp2, ktmp); 2064 EVP_PKEY_free(ktmp2); 2065 } 2066 2067 if (pkey != NULL) 2068 EVP_PKEY_copy_parameters(pkey, ktmp); 2069 EVP_PKEY_free(ktmp); 2070 return 1; 2071} 2072 2073/* Make a delta CRL as the diff between two full CRLs */ 2074 2075X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, 2076 EVP_PKEY *skey, const EVP_MD *md, unsigned int flags) 2077{ 2078 X509_CRL *crl = NULL; 2079 int i; 2080 STACK_OF(X509_REVOKED) *revs = NULL; 2081 /* CRLs can't be delta already */ 2082 if (base->base_crl_number || newer->base_crl_number) { 2083 X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_ALREADY_DELTA); 2084 return NULL; 2085 } 2086 /* Base and new CRL must have a CRL number */ 2087 if (!base->crl_number || !newer->crl_number) { 2088 X509err(X509_F_X509_CRL_DIFF, X509_R_NO_CRL_NUMBER); 2089 return NULL; 2090 } 2091 /* Issuer names must match */ 2092 if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(newer))) { 2093 X509err(X509_F_X509_CRL_DIFF, X509_R_ISSUER_MISMATCH); 2094 return NULL; 2095 } 2096 /* AKID and IDP must match */ 2097 if (!crl_extension_match(base, newer, NID_authority_key_identifier)) { 2098 X509err(X509_F_X509_CRL_DIFF, X509_R_AKID_MISMATCH); 2099 return NULL; 2100 } 2101 if (!crl_extension_match(base, newer, NID_issuing_distribution_point)) { 2102 X509err(X509_F_X509_CRL_DIFF, X509_R_IDP_MISMATCH); 2103 return NULL; 2104 } 2105 /* Newer CRL number must exceed full CRL number */ 2106 if (ASN1_INTEGER_cmp(newer->crl_number, base->crl_number) <= 0) { 2107 X509err(X509_F_X509_CRL_DIFF, X509_R_NEWER_CRL_NOT_NEWER); 2108 return NULL; 2109 } 2110 /* CRLs must verify */ 2111 if (skey && (X509_CRL_verify(base, skey) <= 0 || 2112 X509_CRL_verify(newer, skey) <= 0)) { 2113 X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_VERIFY_FAILURE); 2114 return NULL; 2115 } 2116 /* Create new CRL */ 2117 crl = X509_CRL_new(); 2118 if (!crl || !X509_CRL_set_version(crl, 1)) 2119 goto memerr; 2120 /* Set issuer name */ 2121 if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer))) 2122 goto memerr; 2123 2124 if (!X509_CRL_set_lastUpdate(crl, X509_CRL_get_lastUpdate(newer))) 2125 goto memerr; 2126 if (!X509_CRL_set_nextUpdate(crl, X509_CRL_get_nextUpdate(newer))) 2127 goto memerr; 2128 2129 /* Set base CRL number: must be critical */ 2130 2131 if (!X509_CRL_add1_ext_i2d(crl, NID_delta_crl, base->crl_number, 1, 0)) 2132 goto memerr; 2133 2134 /* 2135 * Copy extensions across from newest CRL to delta: this will set CRL 2136 * number to correct value too. 2137 */ 2138 2139 for (i = 0; i < X509_CRL_get_ext_count(newer); i++) { 2140 X509_EXTENSION *ext; 2141 ext = X509_CRL_get_ext(newer, i); 2142 if (!X509_CRL_add_ext(crl, ext, -1)) 2143 goto memerr; 2144 } 2145 2146 /* Go through revoked entries, copying as needed */ 2147 2148 revs = X509_CRL_get_REVOKED(newer); 2149 2150 for (i = 0; i < sk_X509_REVOKED_num(revs); i++) { 2151 X509_REVOKED *rvn, *rvtmp; 2152 rvn = sk_X509_REVOKED_value(revs, i); 2153 /* 2154 * Add only if not also in base. TODO: need something cleverer here 2155 * for some more complex CRLs covering multiple CAs. 2156 */ 2157 if (!X509_CRL_get0_by_serial(base, &rvtmp, rvn->serialNumber)) { 2158 rvtmp = X509_REVOKED_dup(rvn); 2159 if (!rvtmp) 2160 goto memerr; 2161 if (!X509_CRL_add0_revoked(crl, rvtmp)) { 2162 X509_REVOKED_free(rvtmp); 2163 goto memerr; 2164 } 2165 } 2166 } 2167 /* TODO: optionally prune deleted entries */ 2168 2169 if (skey && md && !X509_CRL_sign(crl, skey, md)) 2170 goto memerr; 2171 2172 return crl; 2173 2174 memerr: 2175 X509err(X509_F_X509_CRL_DIFF, ERR_R_MALLOC_FAILURE); 2176 if (crl) 2177 X509_CRL_free(crl); 2178 return NULL; 2179} 2180 2181int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, 2182 CRYPTO_EX_new *new_func, 2183 CRYPTO_EX_dup *dup_func, 2184 CRYPTO_EX_free *free_func) 2185{ 2186 /* 2187 * This function is (usually) called only once, by 2188 * SSL_get_ex_data_X509_STORE_CTX_idx (ssl/ssl_cert.c). 2189 */ 2190 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE_CTX, argl, argp, 2191 new_func, dup_func, free_func); 2192} 2193 2194int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) 2195{ 2196 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); 2197} 2198 2199void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx) 2200{ 2201 return CRYPTO_get_ex_data(&ctx->ex_data, idx); 2202} 2203 2204int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx) 2205{ 2206 return ctx->error; 2207} 2208 2209void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err) 2210{ 2211 ctx->error = err; 2212} 2213 2214int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx) 2215{ 2216 return ctx->error_depth; 2217} 2218 2219X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx) 2220{ 2221 return ctx->current_cert; 2222} 2223 2224STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx) 2225{ 2226 return ctx->chain; 2227} 2228 2229STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx) 2230{ 2231 if (!ctx->chain) 2232 return NULL; 2233 return X509_chain_up_ref(ctx->chain); 2234} 2235 2236X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx) 2237{ 2238 return ctx->current_issuer; 2239} 2240 2241X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx) 2242{ 2243 return ctx->current_crl; 2244} 2245 2246X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx) 2247{ 2248 return ctx->parent; 2249} 2250 2251void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x) 2252{ 2253 ctx->cert = x; 2254} 2255 2256void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) 2257{ 2258 ctx->untrusted = sk; 2259} 2260 2261void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk) 2262{ 2263 ctx->crls = sk; 2264} 2265 2266int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose) 2267{ 2268 return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0); 2269} 2270 2271int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) 2272{ 2273 return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust); 2274} 2275 2276/* 2277 * This function is used to set the X509_STORE_CTX purpose and trust values. 2278 * This is intended to be used when another structure has its own trust and 2279 * purpose values which (if set) will be inherited by the ctx. If they aren't 2280 * set then we will usually have a default purpose in mind which should then 2281 * be used to set the trust value. An example of this is SSL use: an SSL 2282 * structure will have its own purpose and trust settings which the 2283 * application can set: if they aren't set then we use the default of SSL 2284 * client/server. 2285 */ 2286 2287int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, 2288 int purpose, int trust) 2289{ 2290 int idx; 2291 /* If purpose not set use default */ 2292 if (!purpose) 2293 purpose = def_purpose; 2294 /* If we have a purpose then check it is valid */ 2295 if (purpose) { 2296 X509_PURPOSE *ptmp; 2297 idx = X509_PURPOSE_get_by_id(purpose); 2298 if (idx == -1) { 2299 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2300 X509_R_UNKNOWN_PURPOSE_ID); 2301 return 0; 2302 } 2303 ptmp = X509_PURPOSE_get0(idx); 2304 if (ptmp->trust == X509_TRUST_DEFAULT) { 2305 idx = X509_PURPOSE_get_by_id(def_purpose); 2306 if (idx == -1) { 2307 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2308 X509_R_UNKNOWN_PURPOSE_ID); 2309 return 0; 2310 } 2311 ptmp = X509_PURPOSE_get0(idx); 2312 } 2313 /* If trust not set then get from purpose default */ 2314 if (!trust) 2315 trust = ptmp->trust; 2316 } 2317 if (trust) { 2318 idx = X509_TRUST_get_by_id(trust); 2319 if (idx == -1) { 2320 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, 2321 X509_R_UNKNOWN_TRUST_ID); 2322 return 0; 2323 } 2324 } 2325 2326 if (purpose && !ctx->param->purpose) 2327 ctx->param->purpose = purpose; 2328 if (trust && !ctx->param->trust) 2329 ctx->param->trust = trust; 2330 return 1; 2331} 2332 2333X509_STORE_CTX *X509_STORE_CTX_new(void) 2334{ 2335 X509_STORE_CTX *ctx; 2336 ctx = (X509_STORE_CTX *)OPENSSL_malloc(sizeof(X509_STORE_CTX)); 2337 if (!ctx) { 2338 X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE); 2339 return NULL; 2340 } 2341 memset(ctx, 0, sizeof(X509_STORE_CTX)); 2342 return ctx; 2343} 2344 2345void X509_STORE_CTX_free(X509_STORE_CTX *ctx) 2346{ 2347 if (!ctx) 2348 return; 2349 X509_STORE_CTX_cleanup(ctx); 2350 OPENSSL_free(ctx); 2351} 2352 2353int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, 2354 STACK_OF(X509) *chain) 2355{ 2356 int ret = 1; 2357 ctx->ctx = store; 2358 ctx->current_method = 0; 2359 ctx->cert = x509; 2360 ctx->untrusted = chain; 2361 ctx->crls = NULL; 2362 ctx->last_untrusted = 0; 2363 ctx->other_ctx = NULL; 2364 ctx->valid = 0; 2365 ctx->chain = NULL; 2366 ctx->error = 0; 2367 ctx->explicit_policy = 0; 2368 ctx->error_depth = 0; 2369 ctx->current_cert = NULL; 2370 ctx->current_issuer = NULL; 2371 ctx->current_crl = NULL; 2372 ctx->current_crl_score = 0; 2373 ctx->current_reasons = 0; 2374 ctx->tree = NULL; 2375 ctx->parent = NULL; 2376 /* Zero ex_data to make sure we're cleanup-safe */ 2377 memset(&ctx->ex_data, 0, sizeof(ctx->ex_data)); 2378 2379 ctx->param = X509_VERIFY_PARAM_new(); 2380 if (!ctx->param) { 2381 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2382 return 0; 2383 } 2384 2385 /* 2386 * Inherit callbacks and flags from X509_STORE if not set use defaults. 2387 */ 2388 if (store) 2389 ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param); 2390 else 2391 ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT | X509_VP_FLAG_ONCE; 2392 2393 if (store) { 2394 ctx->verify_cb = store->verify_cb; 2395 /* Seems to always be 0 in OpenSSL, else must be idempotent */ 2396 ctx->cleanup = store->cleanup; 2397 } else 2398 ctx->cleanup = 0; 2399 2400 if (ret) 2401 ret = X509_VERIFY_PARAM_inherit(ctx->param, 2402 X509_VERIFY_PARAM_lookup("default")); 2403 2404 if (ret == 0) { 2405 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2406 goto err; 2407 } 2408 2409 if (store && store->check_issued) 2410 ctx->check_issued = store->check_issued; 2411 else 2412 ctx->check_issued = check_issued; 2413 2414 if (store && store->get_issuer) 2415 ctx->get_issuer = store->get_issuer; 2416 else 2417 ctx->get_issuer = X509_STORE_CTX_get1_issuer; 2418 2419 if (store && store->verify_cb) 2420 ctx->verify_cb = store->verify_cb; 2421 else 2422 ctx->verify_cb = null_callback; 2423 2424 if (store && store->verify) 2425 ctx->verify = store->verify; 2426 else 2427 ctx->verify = internal_verify; 2428 2429 if (store && store->check_revocation) 2430 ctx->check_revocation = store->check_revocation; 2431 else 2432 ctx->check_revocation = check_revocation; 2433 2434 if (store && store->get_crl) 2435 ctx->get_crl = store->get_crl; 2436 else 2437 ctx->get_crl = NULL; 2438 2439 if (store && store->check_crl) 2440 ctx->check_crl = store->check_crl; 2441 else 2442 ctx->check_crl = check_crl; 2443 2444 if (store && store->cert_crl) 2445 ctx->cert_crl = store->cert_crl; 2446 else 2447 ctx->cert_crl = cert_crl; 2448 2449 if (store && store->lookup_certs) 2450 ctx->lookup_certs = store->lookup_certs; 2451 else 2452 ctx->lookup_certs = X509_STORE_get1_certs; 2453 2454 if (store && store->lookup_crls) 2455 ctx->lookup_crls = store->lookup_crls; 2456 else 2457 ctx->lookup_crls = X509_STORE_get1_crls; 2458 2459 ctx->check_policy = check_policy; 2460 2461 if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, 2462 &ctx->ex_data)) 2463 return 1; 2464 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); 2465 2466 err: 2467 /* 2468 * On error clean up allocated storage, if the store context was not 2469 * allocated with X509_STORE_CTX_new() this is our last chance to do so. 2470 */ 2471 X509_STORE_CTX_cleanup(ctx); 2472 return 0; 2473} 2474 2475/* 2476 * Set alternative lookup method: just a STACK of trusted certificates. This 2477 * avoids X509_STORE nastiness where it isn't needed. 2478 */ 2479 2480void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) 2481{ 2482 ctx->other_ctx = sk; 2483 ctx->get_issuer = get_issuer_sk; 2484} 2485 2486void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) 2487{ 2488 /* 2489 * We need to be idempotent because, unfortunately, free() also calls 2490 * cleanup(), so the natural call sequence new(), init(), cleanup(), free() 2491 * calls cleanup() for the same object twice! Thus we must zero the 2492 * pointers below after they're freed! 2493 */ 2494 /* Seems to always be 0 in OpenSSL, do this at most once. */ 2495 if (ctx->cleanup != NULL) { 2496 ctx->cleanup(ctx); 2497 ctx->cleanup = NULL; 2498 } 2499 if (ctx->param != NULL) { 2500 if (ctx->parent == NULL) 2501 X509_VERIFY_PARAM_free(ctx->param); 2502 ctx->param = NULL; 2503 } 2504 if (ctx->tree != NULL) { 2505 X509_policy_tree_free(ctx->tree); 2506 ctx->tree = NULL; 2507 } 2508 if (ctx->chain != NULL) { 2509 sk_X509_pop_free(ctx->chain, X509_free); 2510 ctx->chain = NULL; 2511 } 2512 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &(ctx->ex_data)); 2513 memset(&ctx->ex_data, 0, sizeof(CRYPTO_EX_DATA)); 2514} 2515 2516void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth) 2517{ 2518 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 2519} 2520 2521void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags) 2522{ 2523 X509_VERIFY_PARAM_set_flags(ctx->param, flags); 2524} 2525 2526void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, 2527 time_t t) 2528{ 2529 X509_VERIFY_PARAM_set_time(ctx->param, t); 2530} 2531 2532void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, 2533 int (*verify_cb) (int, X509_STORE_CTX *)) 2534{ 2535 ctx->verify_cb = verify_cb; 2536} 2537 2538X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx) 2539{ 2540 return ctx->tree; 2541} 2542 2543int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx) 2544{ 2545 return ctx->explicit_policy; 2546} 2547 2548int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) 2549{ 2550 const X509_VERIFY_PARAM *param; 2551 param = X509_VERIFY_PARAM_lookup(name); 2552 if (!param) 2553 return 0; 2554 return X509_VERIFY_PARAM_inherit(ctx->param, param); 2555} 2556 2557X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) 2558{ 2559 return ctx->param; 2560} 2561 2562void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param) 2563{ 2564 if (ctx->param) 2565 X509_VERIFY_PARAM_free(ctx->param); 2566 ctx->param = param; 2567} 2568 2569IMPLEMENT_STACK_OF(X509) 2570 2571IMPLEMENT_ASN1_SET_OF(X509) 2572 2573IMPLEMENT_STACK_OF(X509_NAME) 2574 2575IMPLEMENT_STACK_OF(X509_ATTRIBUTE) 2576 2577IMPLEMENT_ASN1_SET_OF(X509_ATTRIBUTE) 2578