1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: tls_lib.c,v 1.2 2022/08/20 21:48:25 tb Exp $ */ 2*de0e0e4dSAntonio Huete Jimenez /* 3*de0e0e4dSAntonio Huete Jimenez * Copyright (c) 2019, 2021 Joel Sing <jsing@openbsd.org> 4*de0e0e4dSAntonio Huete Jimenez * 5*de0e0e4dSAntonio Huete Jimenez * Permission to use, copy, modify, and distribute this software for any 6*de0e0e4dSAntonio Huete Jimenez * purpose with or without fee is hereby granted, provided that the above 7*de0e0e4dSAntonio Huete Jimenez * copyright notice and this permission notice appear in all copies. 8*de0e0e4dSAntonio Huete Jimenez * 9*de0e0e4dSAntonio Huete Jimenez * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10*de0e0e4dSAntonio Huete Jimenez * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11*de0e0e4dSAntonio Huete Jimenez * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12*de0e0e4dSAntonio Huete Jimenez * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13*de0e0e4dSAntonio Huete Jimenez * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14*de0e0e4dSAntonio Huete Jimenez * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15*de0e0e4dSAntonio Huete Jimenez * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16*de0e0e4dSAntonio Huete Jimenez */ 17*de0e0e4dSAntonio Huete Jimenez 18*de0e0e4dSAntonio Huete Jimenez #include "ssl_locl.h" 19*de0e0e4dSAntonio Huete Jimenez 20*de0e0e4dSAntonio Huete Jimenez int 21*de0e0e4dSAntonio Huete Jimenez tls_process_peer_certs(SSL *s, STACK_OF(X509) *peer_certs) 22*de0e0e4dSAntonio Huete Jimenez { 23*de0e0e4dSAntonio Huete Jimenez STACK_OF(X509) *peer_certs_no_leaf; 24*de0e0e4dSAntonio Huete Jimenez X509 *peer_cert = NULL; 25*de0e0e4dSAntonio Huete Jimenez EVP_PKEY *pkey; 26*de0e0e4dSAntonio Huete Jimenez int cert_type; 27*de0e0e4dSAntonio Huete Jimenez int ret = 0; 28*de0e0e4dSAntonio Huete Jimenez 29*de0e0e4dSAntonio Huete Jimenez if (sk_X509_num(peer_certs) < 1) 30*de0e0e4dSAntonio Huete Jimenez goto err; 31*de0e0e4dSAntonio Huete Jimenez peer_cert = sk_X509_value(peer_certs, 0); 32*de0e0e4dSAntonio Huete Jimenez X509_up_ref(peer_cert); 33*de0e0e4dSAntonio Huete Jimenez 34*de0e0e4dSAntonio Huete Jimenez if ((pkey = X509_get0_pubkey(peer_cert)) == NULL) { 35*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_NO_PUBLICKEY); 36*de0e0e4dSAntonio Huete Jimenez goto err; 37*de0e0e4dSAntonio Huete Jimenez } 38*de0e0e4dSAntonio Huete Jimenez if (EVP_PKEY_missing_parameters(pkey)) { 39*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 40*de0e0e4dSAntonio Huete Jimenez goto err; 41*de0e0e4dSAntonio Huete Jimenez } 42*de0e0e4dSAntonio Huete Jimenez if ((cert_type = ssl_cert_type(pkey)) < 0) { 43*de0e0e4dSAntonio Huete Jimenez SSLerror(s, SSL_R_UNKNOWN_CERTIFICATE_TYPE); 44*de0e0e4dSAntonio Huete Jimenez goto err; 45*de0e0e4dSAntonio Huete Jimenez } 46*de0e0e4dSAntonio Huete Jimenez 47*de0e0e4dSAntonio Huete Jimenez s->session->peer_cert_type = cert_type; 48*de0e0e4dSAntonio Huete Jimenez 49*de0e0e4dSAntonio Huete Jimenez X509_free(s->session->peer_cert); 50*de0e0e4dSAntonio Huete Jimenez s->session->peer_cert = peer_cert; 51*de0e0e4dSAntonio Huete Jimenez peer_cert = NULL; 52*de0e0e4dSAntonio Huete Jimenez 53*de0e0e4dSAntonio Huete Jimenez sk_X509_pop_free(s->s3->hs.peer_certs, X509_free); 54*de0e0e4dSAntonio Huete Jimenez if ((s->s3->hs.peer_certs = X509_chain_up_ref(peer_certs)) == NULL) 55*de0e0e4dSAntonio Huete Jimenez goto err; 56*de0e0e4dSAntonio Huete Jimenez 57*de0e0e4dSAntonio Huete Jimenez if ((peer_certs_no_leaf = X509_chain_up_ref(peer_certs)) == NULL) 58*de0e0e4dSAntonio Huete Jimenez goto err; 59*de0e0e4dSAntonio Huete Jimenez X509_free(sk_X509_shift(peer_certs_no_leaf)); 60*de0e0e4dSAntonio Huete Jimenez sk_X509_pop_free(s->s3->hs.peer_certs_no_leaf, X509_free); 61*de0e0e4dSAntonio Huete Jimenez s->s3->hs.peer_certs_no_leaf = peer_certs_no_leaf; 62*de0e0e4dSAntonio Huete Jimenez 63*de0e0e4dSAntonio Huete Jimenez ret = 1; 64*de0e0e4dSAntonio Huete Jimenez err: 65*de0e0e4dSAntonio Huete Jimenez X509_free(peer_cert); 66*de0e0e4dSAntonio Huete Jimenez 67*de0e0e4dSAntonio Huete Jimenez return ret; 68*de0e0e4dSAntonio Huete Jimenez } 69