Home | History | Annotate | Download | only in x509
      1 /* Written by Dr Stephen N Henson (steve (at) openssl.org) for the OpenSSL
      2  * project 1999. */
      3 /* ====================================================================
      4  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  *
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  *
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in
     15  *    the documentation and/or other materials provided with the
     16  *    distribution.
     17  *
     18  * 3. All advertising materials mentioning features or use of this
     19  *    software must display the following acknowledgment:
     20  *    "This product includes software developed by the OpenSSL Project
     21  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
     22  *
     23  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
     24  *    endorse or promote products derived from this software without
     25  *    prior written permission. For written permission, please contact
     26  *    licensing (at) OpenSSL.org.
     27  *
     28  * 5. Products derived from this software may not be called "OpenSSL"
     29  *    nor may "OpenSSL" appear in their names without prior written
     30  *    permission of the OpenSSL Project.
     31  *
     32  * 6. Redistributions of any form whatsoever must retain the following
     33  *    acknowledgment:
     34  *    "This product includes software developed by the OpenSSL Project
     35  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
     36  *
     37  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
     38  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     39  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     40  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
     41  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     42  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     43  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     45  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
     46  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     47  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
     48  * OF THE POSSIBILITY OF SUCH DAMAGE.
     49  * ====================================================================
     50  *
     51  * This product includes cryptographic software written by Eric Young
     52  * (eay (at) cryptsoft.com).  This product includes software written by Tim
     53  * Hudson (tjh (at) cryptsoft.com). */
     54 
     55 #include <openssl/buf.h>
     56 #include <openssl/err.h>
     57 #include <openssl/mem.h>
     58 #include <openssl/obj.h>
     59 #include <openssl/x509v3.h>
     60 
     61 
     62 static int tr_cmp(const X509_TRUST **a,
     63 		const X509_TRUST **b);
     64 static void trtable_free(X509_TRUST *p);
     65 
     66 static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
     67 static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
     68 static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
     69 
     70 static int obj_trust(int id, X509 *x, int flags);
     71 static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
     72 
     73 /* WARNING: the following table should be kept in order of trust
     74  * and without any gaps so we can just subtract the minimum trust
     75  * value to get an index into the table
     76  */
     77 
     78 static X509_TRUST trstandard[] = {
     79 {X509_TRUST_COMPAT, 0, trust_compat, (char *) "compatible", 0, NULL},
     80 {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, (char *) "SSL Client", NID_client_auth, NULL},
     81 {X509_TRUST_SSL_SERVER, 0, trust_1oidany, (char *) "SSL Server", NID_server_auth, NULL},
     82 {X509_TRUST_EMAIL, 0, trust_1oidany, (char *) "S/MIME email", NID_email_protect, NULL},
     83 {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, (char *) "Object Signer", NID_code_sign, NULL},
     84 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, (char *) "OCSP responder", NID_OCSP_sign, NULL},
     85 {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, (char *) "OCSP request", NID_ad_OCSP, NULL},
     86 {X509_TRUST_TSA, 0, trust_1oidany, (char *) "TSA server", NID_time_stamp, NULL}
     87 };
     88 
     89 #define X509_TRUST_COUNT	(sizeof(trstandard)/sizeof(X509_TRUST))
     90 
     91 static STACK_OF(X509_TRUST) *trtable = NULL;
     92 
     93 static int tr_cmp(const X509_TRUST **a,
     94 		const X509_TRUST **b)
     95 {
     96 	return (*a)->trust - (*b)->trust;
     97 }
     98 
     99 int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
    100 {
    101 	int (*oldtrust)(int , X509 *, int);
    102 	oldtrust = default_trust;
    103 	default_trust = trust;
    104 	return oldtrust;
    105 }
    106 
    107 
    108 int X509_check_trust(X509 *x, int id, int flags)
    109 {
    110 	X509_TRUST *pt;
    111 	int idx;
    112 	if(id == -1) return 1;
    113 	/* We get this as a default value */
    114 	if (id == 0)
    115 		{
    116 		int rv;
    117 		rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
    118 		if (rv != X509_TRUST_UNTRUSTED)
    119 			return rv;
    120 		return trust_compat(NULL, x, 0);
    121 		}
    122 	idx = X509_TRUST_get_by_id(id);
    123 	if(idx == -1) return default_trust(id, x, flags);
    124 	pt = X509_TRUST_get0(idx);
    125 	return pt->check_trust(pt, x, flags);
    126 }
    127 
    128 int X509_TRUST_get_count(void)
    129 {
    130 	if(!trtable) return X509_TRUST_COUNT;
    131 	return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
    132 }
    133 
    134 X509_TRUST * X509_TRUST_get0(int idx)
    135 {
    136 	if(idx < 0) return NULL;
    137 	if(idx < (int)X509_TRUST_COUNT) return trstandard + idx;
    138 	return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
    139 }
    140 
    141 int X509_TRUST_get_by_id(int id)
    142 {
    143 	X509_TRUST tmp;
    144 	size_t idx;
    145 
    146 	if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
    147 				 return id - X509_TRUST_MIN;
    148 	tmp.trust = id;
    149 	if(!trtable) return -1;
    150 	if (!sk_X509_TRUST_find(trtable, &idx, &tmp)) {
    151 		return -1;
    152 	}
    153 	return idx + X509_TRUST_COUNT;
    154 }
    155 
    156 int X509_TRUST_set(int *t, int trust)
    157 {
    158 	if(X509_TRUST_get_by_id(trust) == -1) {
    159 		OPENSSL_PUT_ERROR(X509, X509_R_INVALID_TRUST);
    160 		return 0;
    161 	}
    162 	*t = trust;
    163 	return 1;
    164 }
    165 
    166 int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
    167 					char *name, int arg1, void *arg2)
    168 {
    169 	int idx;
    170 	X509_TRUST *trtmp;
    171 	char *name_dup;
    172 
    173 	/* This is set according to what we change: application can't set it */
    174 	flags &= ~X509_TRUST_DYNAMIC;
    175 	/* This will always be set for application modified trust entries */
    176 	flags |= X509_TRUST_DYNAMIC_NAME;
    177 	/* Get existing entry if any */
    178 	idx = X509_TRUST_get_by_id(id);
    179 	/* Need a new entry */
    180 	if(idx == -1) {
    181 		if(!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
    182 			OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
    183 			return 0;
    184 		}
    185 		trtmp->flags = X509_TRUST_DYNAMIC;
    186 	} else trtmp = X509_TRUST_get0(idx);
    187 
    188 	/* Duplicate the supplied name. */
    189 	name_dup = BUF_strdup(name);
    190 	if (name_dup == NULL) {
    191 		OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
    192 		if (idx == -1)
    193 			OPENSSL_free(trtmp);
    194 		return 0;
    195 	}
    196 
    197 	/* OPENSSL_free existing name if dynamic */
    198 	if (trtmp->flags & X509_TRUST_DYNAMIC_NAME) OPENSSL_free(trtmp->name);
    199 	trtmp->name = name_dup;
    200 	/* Keep the dynamic flag of existing entry */
    201 	trtmp->flags &= X509_TRUST_DYNAMIC;
    202 	/* Set all other flags */
    203 	trtmp->flags |= flags;
    204 
    205 	trtmp->trust = id;
    206 	trtmp->check_trust = ck;
    207 	trtmp->arg1 = arg1;
    208 	trtmp->arg2 = arg2;
    209 
    210 	/* If its a new entry manage the dynamic table */
    211 	if(idx == -1) {
    212 		if(!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
    213 			OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
    214 			trtable_free(trtmp);
    215 			return 0;
    216 		}
    217 		if (!sk_X509_TRUST_push(trtable, trtmp)) {
    218 			OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
    219 			trtable_free(trtmp);
    220 			return 0;
    221 		}
    222 	}
    223 	return 1;
    224 }
    225 
    226 static void trtable_free(X509_TRUST *p)
    227 	{
    228 	if(!p) return;
    229 	if (p->flags & X509_TRUST_DYNAMIC)
    230 		{
    231 		if (p->flags & X509_TRUST_DYNAMIC_NAME)
    232 			OPENSSL_free(p->name);
    233 		OPENSSL_free(p);
    234 		}
    235 	}
    236 
    237 void X509_TRUST_cleanup(void)
    238 {
    239 	unsigned int i;
    240 	for(i = 0; i < X509_TRUST_COUNT; i++) trtable_free(trstandard + i);
    241 	sk_X509_TRUST_pop_free(trtable, trtable_free);
    242 	trtable = NULL;
    243 }
    244 
    245 int X509_TRUST_get_flags(X509_TRUST *xp)
    246 {
    247 	return xp->flags;
    248 }
    249 
    250 char *X509_TRUST_get0_name(X509_TRUST *xp)
    251 {
    252 	return xp->name;
    253 }
    254 
    255 int X509_TRUST_get_trust(X509_TRUST *xp)
    256 {
    257 	return xp->trust;
    258 }
    259 
    260 static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
    261 {
    262 	if(x->aux && (x->aux->trust || x->aux->reject))
    263 		return obj_trust(trust->arg1, x, flags);
    264 	/* we don't have any trust settings: for compatibility
    265 	 * we return trusted if it is self signed
    266 	 */
    267 	return trust_compat(trust, x, flags);
    268 }
    269 
    270 static int trust_1oid(X509_TRUST *trust, X509 *x, int flags)
    271 {
    272 	if(x->aux) return obj_trust(trust->arg1, x, flags);
    273 	return X509_TRUST_UNTRUSTED;
    274 }
    275 
    276 static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
    277 {
    278 	X509_check_purpose(x, -1, 0);
    279 	if(x->ex_flags & EXFLAG_SS) return X509_TRUST_TRUSTED;
    280 	else return X509_TRUST_UNTRUSTED;
    281 }
    282 
    283 static int obj_trust(int id, X509 *x, int flags)
    284 {
    285 	ASN1_OBJECT *obj;
    286 	size_t i;
    287 	X509_CERT_AUX *ax;
    288 	ax = x->aux;
    289 	if(!ax) return X509_TRUST_UNTRUSTED;
    290 	if(ax->reject) {
    291 		for(i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
    292 			obj = sk_ASN1_OBJECT_value(ax->reject, i);
    293 			if(OBJ_obj2nid(obj) == id) return X509_TRUST_REJECTED;
    294 		}
    295 	}
    296 	if(ax->trust) {
    297 		for(i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
    298 			obj = sk_ASN1_OBJECT_value(ax->trust, i);
    299 			if(OBJ_obj2nid(obj) == id) return X509_TRUST_TRUSTED;
    300 		}
    301 	}
    302 	return X509_TRUST_UNTRUSTED;
    303 }
    304 
    305