1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: tls_lib.c,v 1.2 2022/08/20 21:48:25 tb Exp $ */
2*de0e0e4dSAntonio Huete Jimenez /*
3*de0e0e4dSAntonio Huete Jimenez * Copyright (c) 2019, 2021 Joel Sing <jsing@openbsd.org>
4*de0e0e4dSAntonio Huete Jimenez *
5*de0e0e4dSAntonio Huete Jimenez * Permission to use, copy, modify, and distribute this software for any
6*de0e0e4dSAntonio Huete Jimenez * purpose with or without fee is hereby granted, provided that the above
7*de0e0e4dSAntonio Huete Jimenez * copyright notice and this permission notice appear in all copies.
8*de0e0e4dSAntonio Huete Jimenez *
9*de0e0e4dSAntonio Huete Jimenez * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10*de0e0e4dSAntonio Huete Jimenez * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11*de0e0e4dSAntonio Huete Jimenez * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12*de0e0e4dSAntonio Huete Jimenez * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13*de0e0e4dSAntonio Huete Jimenez * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14*de0e0e4dSAntonio Huete Jimenez * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15*de0e0e4dSAntonio Huete Jimenez * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16*de0e0e4dSAntonio Huete Jimenez */
17*de0e0e4dSAntonio Huete Jimenez
18*de0e0e4dSAntonio Huete Jimenez #include "ssl_locl.h"
19*de0e0e4dSAntonio Huete Jimenez
20*de0e0e4dSAntonio Huete Jimenez int
tls_process_peer_certs(SSL * s,STACK_OF (X509)* peer_certs)21*de0e0e4dSAntonio Huete Jimenez tls_process_peer_certs(SSL *s, STACK_OF(X509) *peer_certs)
22*de0e0e4dSAntonio Huete Jimenez {
23*de0e0e4dSAntonio Huete Jimenez STACK_OF(X509) *peer_certs_no_leaf;
24*de0e0e4dSAntonio Huete Jimenez X509 *peer_cert = NULL;
25*de0e0e4dSAntonio Huete Jimenez EVP_PKEY *pkey;
26*de0e0e4dSAntonio Huete Jimenez int cert_type;
27*de0e0e4dSAntonio Huete Jimenez int ret = 0;
28*de0e0e4dSAntonio Huete Jimenez
29*de0e0e4dSAntonio Huete Jimenez if (sk_X509_num(peer_certs) < 1)
30*de0e0e4dSAntonio Huete Jimenez goto err;
31*de0e0e4dSAntonio Huete Jimenez peer_cert = sk_X509_value(peer_certs, 0);
32*de0e0e4dSAntonio Huete Jimenez X509_up_ref(peer_cert);
33*de0e0e4dSAntonio Huete Jimenez
34*de0e0e4dSAntonio Huete Jimenez if ((pkey = X509_get0_pubkey(peer_cert)) == NULL) {
35*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_NO_PUBLICKEY);
36*de0e0e4dSAntonio Huete Jimenez goto err;
37*de0e0e4dSAntonio Huete Jimenez }
38*de0e0e4dSAntonio Huete Jimenez if (EVP_PKEY_missing_parameters(pkey)) {
39*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
40*de0e0e4dSAntonio Huete Jimenez goto err;
41*de0e0e4dSAntonio Huete Jimenez }
42*de0e0e4dSAntonio Huete Jimenez if ((cert_type = ssl_cert_type(pkey)) < 0) {
43*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
44*de0e0e4dSAntonio Huete Jimenez goto err;
45*de0e0e4dSAntonio Huete Jimenez }
46*de0e0e4dSAntonio Huete Jimenez
47*de0e0e4dSAntonio Huete Jimenez s->session->peer_cert_type = cert_type;
48*de0e0e4dSAntonio Huete Jimenez
49*de0e0e4dSAntonio Huete Jimenez X509_free(s->session->peer_cert);
50*de0e0e4dSAntonio Huete Jimenez s->session->peer_cert = peer_cert;
51*de0e0e4dSAntonio Huete Jimenez peer_cert = NULL;
52*de0e0e4dSAntonio Huete Jimenez
53*de0e0e4dSAntonio Huete Jimenez sk_X509_pop_free(s->s3->hs.peer_certs, X509_free);
54*de0e0e4dSAntonio Huete Jimenez if ((s->s3->hs.peer_certs = X509_chain_up_ref(peer_certs)) == NULL)
55*de0e0e4dSAntonio Huete Jimenez goto err;
56*de0e0e4dSAntonio Huete Jimenez
57*de0e0e4dSAntonio Huete Jimenez if ((peer_certs_no_leaf = X509_chain_up_ref(peer_certs)) == NULL)
58*de0e0e4dSAntonio Huete Jimenez goto err;
59*de0e0e4dSAntonio Huete Jimenez X509_free(sk_X509_shift(peer_certs_no_leaf));
60*de0e0e4dSAntonio Huete Jimenez sk_X509_pop_free(s->s3->hs.peer_certs_no_leaf, X509_free);
61*de0e0e4dSAntonio Huete Jimenez s->s3->hs.peer_certs_no_leaf = peer_certs_no_leaf;
62*de0e0e4dSAntonio Huete Jimenez
63*de0e0e4dSAntonio Huete Jimenez ret = 1;
64*de0e0e4dSAntonio Huete Jimenez err:
65*de0e0e4dSAntonio Huete Jimenez X509_free(peer_cert);
66*de0e0e4dSAntonio Huete Jimenez
67*de0e0e4dSAntonio Huete Jimenez return ret;
68*de0e0e4dSAntonio Huete Jimenez }
69