1/*
2 * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34/* $Id$ */
35
36#include <config.h>
37
38#include <stdio.h>
39#include <stdlib.h>
40#include <ctype.h>
41#include <errno.h>
42#ifdef HAVE_STRINGS_H
43#include <strings.h>
44#endif
45#include <assert.h>
46#include <stdarg.h>
47#include <err.h>
48#include <limits.h>
49
50#include <roken.h>
51
52#include <getarg.h>
53#include <base64.h>
54#include <hex.h>
55#include <com_err.h>
56#include <parse_units.h>
57#include <parse_bytes.h>
58
59#include <krb5-types.h>
60
61#include <rfc2459_asn1.h>
62#include <cms_asn1.h>
63#include <pkcs8_asn1.h>
64#include <pkcs9_asn1.h>
65#include <pkcs12_asn1.h>
66#include <ocsp_asn1.h>
67#include <pkcs10_asn1.h>
68#include <asn1_err.h>
69#include <pkinit_asn1.h>
70
71#include <der.h>
72
73#include <heimbase.h>
74#include <heimbasepriv.h>
75#include <heimbase_impl.h>
76
77#define HC_DEPRECATED_CRYPTO
78#include "crypto-headers.h"
79
80struct hx509_keyset_ops;
81struct hx509_collector;
82struct hx509_generate_private_context;
83typedef struct hx509_path hx509_path;
84
85#include <heimbase.h>
86
87#include <hx509.h>
88
89typedef void (*_hx509_cert_release_func)(struct hx509_cert_data *, void *);
90
91
92#include "sel.h"
93
94#include <hx509-private.h>
95#include <hx509_err.h>
96
97struct hx509_peer_info {
98    hx509_cert cert;
99    AlgorithmIdentifier *val;
100    size_t len;
101};
102
103#define HX509_CERTS_FIND_SERIALNUMBER		1
104#define HX509_CERTS_FIND_ISSUER			2
105#define HX509_CERTS_FIND_SUBJECT		4
106#define HX509_CERTS_FIND_ISSUER_KEY_ID		8
107#define HX509_CERTS_FIND_SUBJECT_KEY_ID		16
108
109struct hx509_name_data {
110    Name der_name;
111};
112
113struct hx509_evaluate_data {
114    struct heim_base_uniq base;
115    heim_array_t path;
116};
117
118struct hx509_path {
119    size_t len;
120    hx509_cert *val;
121};
122
123struct hx509_query_data {
124    int match;
125#define HX509_QUERY_FIND_ISSUER_CERT		0x0000001
126#define HX509_QUERY_MATCH_SERIALNUMBER		0x0000002
127#define HX509_QUERY_MATCH_ISSUER_NAME		0x0000004
128#define HX509_QUERY_MATCH_SUBJECT_NAME		0x0000008
129#define HX509_QUERY_MATCH_SUBJECT_KEY_ID	0x0000010
130#define HX509_QUERY_MATCH_ISSUER_ID		0x0000020
131#define HX509_QUERY_PRIVATE_KEY			0x0000040
132#define HX509_QUERY_KU_ENCIPHERMENT		0x0000080
133#define HX509_QUERY_KU_DIGITALSIGNATURE		0x0000100
134#define HX509_QUERY_KU_KEYCERTSIGN		0x0000200
135#define HX509_QUERY_KU_CRLSIGN			0x0000400
136#define HX509_QUERY_KU_NONREPUDIATION		0x0000800
137#define HX509_QUERY_KU_KEYAGREEMENT		0x0001000
138#define HX509_QUERY_KU_DATAENCIPHERMENT		0x0002000
139#define HX509_QUERY_ANCHOR			0x0004000
140#define HX509_QUERY_MATCH_CERTIFICATE		0x0008000
141#define HX509_QUERY_MATCH_LOCAL_KEY_ID		0x0010000
142#define HX509_QUERY_NO_MATCH_PATH		0x0020000
143#define HX509_QUERY_MATCH_FRIENDLY_NAME		0x0040000
144#define HX509_QUERY_MATCH_FUNCTION		0x0080000
145#define HX509_QUERY_MATCH_KEY_HASH_SHA1		0x0100000
146#define HX509_QUERY_MATCH_TIME			0x0200000
147#define HX509_QUERY_MATCH_EKU			0x0400000
148#define HX509_QUERY_MATCH_EXPR			0x0800000
149#define HX509_QUERY_MATCH_PERSISTENT		0x1000000
150#define HX509_QUERY_MASK			0x1ffffff
151    Certificate *subject;
152    Certificate *certificate;
153    heim_integer *serial;
154    heim_octet_string *subject_id;
155    heim_octet_string *local_key_id;
156    Name *issuer_name;
157    Name *subject_name;
158    hx509_path *path;
159    char *friendlyname;
160    int (*cmp_func)(hx509_context, hx509_cert, void *);
161    void *cmp_func_ctx;
162    heim_octet_string *keyhash_sha1;
163    time_t timenow;
164    heim_oid *eku;
165    struct hx_expr *expr;
166    heim_octet_string *persistent;
167};
168
169struct hx509_keyset_ops {
170    const char *name;
171    int flags;
172    int (*init)(hx509_context, hx509_certs, void **,
173		int, const char *, hx509_lock);
174    int (*store)(hx509_context, hx509_certs, void *, int, hx509_lock);
175    int (*free)(hx509_certs, void *);
176    int (*add)(hx509_context, hx509_certs, void *, hx509_cert);
177    int (*query)(hx509_context, hx509_certs, void *,
178		 const hx509_query *, hx509_cert *);
179    int (*iter_start)(hx509_context, hx509_certs, void *, void **);
180    int (*iter)(hx509_context, hx509_certs, void *, void *, hx509_cert *);
181    int (*iter_end)(hx509_context, hx509_certs, void *, void *);
182    int (*printinfo)(hx509_context, hx509_certs,
183		     void *, int (*)(void *, const char *), void *);
184    int (*getkeys)(hx509_context, hx509_certs, void *, hx509_private_key **);
185    int (*addkey)(hx509_context, hx509_certs, void *, hx509_private_key);
186};
187
188struct _hx509_password {
189    size_t len;
190    char **val;
191};
192
193extern hx509_lock _hx509_empty_lock;
194
195struct hx509_context_data {
196    struct hx509_keyset_ops **ks_ops;
197    int ks_num_ops;
198    int flags;
199#define HX509_CTX_VERIFY_MISSING_OK	1
200    int ocsp_time_diff;
201#define HX509_DEFAULT_OCSP_TIME_DIFF	(5*60)
202    heim_error_t error;
203    struct et_list *et_list;
204    char *querystat;
205    hx509_certs default_trust_anchors;
206};
207
208/* _hx509_calculate_path flag field */
209#define HX509_CALCULATE_PATH_NO_ANCHOR 1
210
211/* environment */
212struct hx509_env_data {
213    enum { env_string, env_list } type;
214    char *name;
215    struct hx509_env_data *next;
216    union {
217	char *string;
218	struct hx509_env_data *list;
219    } u;
220};
221
222
223extern const AlgorithmIdentifier * _hx509_crypto_default_sig_alg;
224extern const AlgorithmIdentifier * _hx509_crypto_default_digest_alg;
225extern const AlgorithmIdentifier * _hx509_crypto_default_secret_alg;
226
227#undef HEIMDAL_NORETURN_ATTRIBUTE
228#define HEIMDAL_NORETURN_ATTRIBUTE
229#undef HEIMDAL_PRINTF_ATTRIBUTE
230#define HEIMDAL_PRINTF_ATTRIBUTE(x)
231
232/*
233 * Configurable options
234 */
235
236#ifdef __APPLE__
237#define HX509_DEFAULT_ANCHORS "KEYCHAIN:system-anchors"
238#endif
239