by_dir.c revision 167613
1/* crypto/x509/by_dir.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59#include <stdio.h> 60#include <time.h> 61#include <errno.h> 62 63#include "cryptlib.h" 64 65#ifndef NO_SYS_TYPES_H 66# include <sys/types.h> 67#endif 68#ifdef MAC_OS_pre_X 69# include <stat.h> 70#else 71# include <sys/stat.h> 72#endif 73 74#include <openssl/lhash.h> 75#include <openssl/x509.h> 76 77typedef struct lookup_dir_st 78 { 79 BUF_MEM *buffer; 80 int num_dirs; 81 char **dirs; 82 int *dirs_type; 83 int num_dirs_alloced; 84 } BY_DIR; 85 86static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl, 87 char **ret); 88static int new_dir(X509_LOOKUP *lu); 89static void free_dir(X509_LOOKUP *lu); 90static int add_cert_dir(BY_DIR *ctx,const char *dir,int type); 91static int get_cert_by_subject(X509_LOOKUP *xl,int type,X509_NAME *name, 92 X509_OBJECT *ret); 93X509_LOOKUP_METHOD x509_dir_lookup= 94 { 95 "Load certs from files in a directory", 96 new_dir, /* new */ 97 free_dir, /* free */ 98 NULL, /* init */ 99 NULL, /* shutdown */ 100 dir_ctrl, /* ctrl */ 101 get_cert_by_subject, /* get_by_subject */ 102 NULL, /* get_by_issuer_serial */ 103 NULL, /* get_by_fingerprint */ 104 NULL, /* get_by_alias */ 105 }; 106 107X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void) 108 { 109 return(&x509_dir_lookup); 110 } 111 112static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl, 113 char **retp) 114 { 115 int ret=0; 116 BY_DIR *ld; 117 char *dir = NULL; 118 119 ld=(BY_DIR *)ctx->method_data; 120 121 switch (cmd) 122 { 123 case X509_L_ADD_DIR: 124 if (argl == X509_FILETYPE_DEFAULT) 125 { 126 dir=(char *)Getenv(X509_get_default_cert_dir_env()); 127 if (dir) 128 ret=add_cert_dir(ld,dir,X509_FILETYPE_PEM); 129 else 130 ret=add_cert_dir(ld,X509_get_default_cert_dir(), 131 X509_FILETYPE_PEM); 132 if (!ret) 133 { 134 X509err(X509_F_DIR_CTRL,X509_R_LOADING_CERT_DIR); 135 } 136 } 137 else 138 ret=add_cert_dir(ld,argp,(int)argl); 139 break; 140 } 141 return(ret); 142 } 143 144static int new_dir(X509_LOOKUP *lu) 145 { 146 BY_DIR *a; 147 148 if ((a=(BY_DIR *)OPENSSL_malloc(sizeof(BY_DIR))) == NULL) 149 return(0); 150 if ((a->buffer=BUF_MEM_new()) == NULL) 151 { 152 OPENSSL_free(a); 153 return(0); 154 } 155 a->num_dirs=0; 156 a->dirs=NULL; 157 a->dirs_type=NULL; 158 a->num_dirs_alloced=0; 159 lu->method_data=(char *)a; 160 return(1); 161 } 162 163static void free_dir(X509_LOOKUP *lu) 164 { 165 BY_DIR *a; 166 int i; 167 168 a=(BY_DIR *)lu->method_data; 169 for (i=0; i<a->num_dirs; i++) 170 if (a->dirs[i] != NULL) OPENSSL_free(a->dirs[i]); 171 if (a->dirs != NULL) OPENSSL_free(a->dirs); 172 if (a->dirs_type != NULL) OPENSSL_free(a->dirs_type); 173 if (a->buffer != NULL) BUF_MEM_free(a->buffer); 174 OPENSSL_free(a); 175 } 176 177static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) 178 { 179 int j,len; 180 int *ip; 181 const char *s,*ss,*p; 182 char **pp; 183 184 if (dir == NULL || !*dir) 185 { 186 X509err(X509_F_ADD_CERT_DIR,X509_R_INVALID_DIRECTORY); 187 return 0; 188 } 189 190 s=dir; 191 p=s; 192 for (;;p++) 193 { 194 if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) 195 { 196 ss=s; 197 s=p+1; 198 len=(int)(p-ss); 199 if (len == 0) continue; 200 for (j=0; j<ctx->num_dirs; j++) 201 if (strlen(ctx->dirs[j]) == (size_t)len && 202 strncmp(ctx->dirs[j],ss,(unsigned int)len) == 0) 203 break; 204 if (j<ctx->num_dirs) 205 continue; 206 if (ctx->num_dirs_alloced < (ctx->num_dirs+1)) 207 { 208 ctx->num_dirs_alloced+=10; 209 pp=(char **)OPENSSL_malloc(ctx->num_dirs_alloced* 210 sizeof(char *)); 211 ip=(int *)OPENSSL_malloc(ctx->num_dirs_alloced* 212 sizeof(int)); 213 if ((pp == NULL) || (ip == NULL)) 214 { 215 X509err(X509_F_ADD_CERT_DIR,ERR_R_MALLOC_FAILURE); 216 return(0); 217 } 218 memcpy(pp,ctx->dirs,(ctx->num_dirs_alloced-10)* 219 sizeof(char *)); 220 memcpy(ip,ctx->dirs_type,(ctx->num_dirs_alloced-10)* 221 sizeof(int)); 222 if (ctx->dirs != NULL) 223 OPENSSL_free(ctx->dirs); 224 if (ctx->dirs_type != NULL) 225 OPENSSL_free(ctx->dirs_type); 226 ctx->dirs=pp; 227 ctx->dirs_type=ip; 228 } 229 ctx->dirs_type[ctx->num_dirs]=type; 230 ctx->dirs[ctx->num_dirs]=(char *)OPENSSL_malloc((unsigned int)len+1); 231 if (ctx->dirs[ctx->num_dirs] == NULL) return(0); 232 strncpy(ctx->dirs[ctx->num_dirs],ss,(unsigned int)len); 233 ctx->dirs[ctx->num_dirs][len]='\0'; 234 ctx->num_dirs++; 235 } 236 if (*p == '\0') break; 237 } 238 return(1); 239 } 240 241static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name, 242 X509_OBJECT *ret) 243 { 244 BY_DIR *ctx; 245 union { 246 struct { 247 X509 st_x509; 248 X509_CINF st_x509_cinf; 249 } x509; 250 struct { 251 X509_CRL st_crl; 252 X509_CRL_INFO st_crl_info; 253 } crl; 254 } data; 255 int ok=0; 256 int i,j,k; 257 unsigned long h; 258 BUF_MEM *b=NULL; 259 struct stat st; 260 X509_OBJECT stmp,*tmp; 261 const char *postfix=""; 262 263 if (name == NULL) return(0); 264 265 stmp.type=type; 266 if (type == X509_LU_X509) 267 { 268 data.x509.st_x509.cert_info= &data.x509.st_x509_cinf; 269 data.x509.st_x509_cinf.subject=name; 270 stmp.data.x509= &data.x509.st_x509; 271 postfix=""; 272 } 273 else if (type == X509_LU_CRL) 274 { 275 data.crl.st_crl.crl= &data.crl.st_crl_info; 276 data.crl.st_crl_info.issuer=name; 277 stmp.data.crl= &data.crl.st_crl; 278 postfix="r"; 279 } 280 else 281 { 282 X509err(X509_F_GET_CERT_BY_SUBJECT,X509_R_WRONG_LOOKUP_TYPE); 283 goto finish; 284 } 285 286 if ((b=BUF_MEM_new()) == NULL) 287 { 288 X509err(X509_F_GET_CERT_BY_SUBJECT,ERR_R_BUF_LIB); 289 goto finish; 290 } 291 292 ctx=(BY_DIR *)xl->method_data; 293 294 h=X509_NAME_hash(name); 295 for (i=0; i<ctx->num_dirs; i++) 296 { 297 j=strlen(ctx->dirs[i])+1+8+6+1+1; 298 if (!BUF_MEM_grow(b,j)) 299 { 300 X509err(X509_F_GET_CERT_BY_SUBJECT,ERR_R_MALLOC_FAILURE); 301 goto finish; 302 } 303 k=0; 304 for (;;) 305 { 306 char c = '/'; 307#ifdef OPENSSL_SYS_VMS 308 c = ctx->dirs[i][strlen(ctx->dirs[i])-1]; 309 if (c != ':' && c != '>' && c != ']') 310 { 311 /* If no separator is present, we assume the 312 directory specifier is a logical name, and 313 add a colon. We really should use better 314 VMS routines for merging things like this, 315 but this will do for now... 316 -- Richard Levitte */ 317 c = ':'; 318 } 319 else 320 { 321 c = '\0'; 322 } 323#endif 324 if (c == '\0') 325 { 326 /* This is special. When c == '\0', no 327 directory separator should be added. */ 328 BIO_snprintf(b->data,b->max, 329 "%s%08lx.%s%d",ctx->dirs[i],h, 330 postfix,k); 331 } 332 else 333 { 334 BIO_snprintf(b->data,b->max, 335 "%s%c%08lx.%s%d",ctx->dirs[i],c,h, 336 postfix,k); 337 } 338 k++; 339 if (stat(b->data,&st) < 0) 340 break; 341 /* found one. */ 342 if (type == X509_LU_X509) 343 { 344 if ((X509_load_cert_file(xl,b->data, 345 ctx->dirs_type[i])) == 0) 346 break; 347 } 348 else if (type == X509_LU_CRL) 349 { 350 if ((X509_load_crl_file(xl,b->data, 351 ctx->dirs_type[i])) == 0) 352 break; 353 } 354 /* else case will caught higher up */ 355 } 356 357 /* we have added it to the cache so now pull 358 * it out again */ 359 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); 360 j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp); 361 if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j); 362 else tmp = NULL; 363 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); 364 365 if (tmp != NULL) 366 { 367 ok=1; 368 ret->type=tmp->type; 369 memcpy(&ret->data,&tmp->data,sizeof(ret->data)); 370 /* If we were going to up the reference count, 371 * we would need to do it on a perl 'type' 372 * basis */ 373 /* CRYPTO_add(&tmp->data.x509->references,1, 374 CRYPTO_LOCK_X509);*/ 375 goto finish; 376 } 377 } 378finish: 379 if (b != NULL) BUF_MEM_free(b); 380 return(ok); 381 } 382 383