1 /* $OpenBSD: x509_lu.c,v 1.33 2021/10/21 16:55:25 tb Exp $ */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 61 #include <openssl/err.h> 62 #include <openssl/lhash.h> 63 #include <openssl/x509.h> 64 #include <openssl/x509v3.h> 65 #include "x509_lcl.h" 66 67 static void X509_OBJECT_dec_ref_count(X509_OBJECT *a); 68 69 X509_LOOKUP * 70 X509_LOOKUP_new(X509_LOOKUP_METHOD *method) 71 { 72 X509_LOOKUP *ret; 73 74 ret = malloc(sizeof(X509_LOOKUP)); 75 if (ret == NULL) 76 return NULL; 77 78 ret->init = 0; 79 ret->skip = 0; 80 ret->method = method; 81 ret->method_data = NULL; 82 ret->store_ctx = NULL; 83 if ((method->new_item != NULL) && !method->new_item(ret)) { 84 free(ret); 85 return NULL; 86 } 87 return ret; 88 } 89 90 void 91 X509_LOOKUP_free(X509_LOOKUP *ctx) 92 { 93 if (ctx == NULL) 94 return; 95 if ((ctx->method != NULL) && (ctx->method->free != NULL)) 96 (*ctx->method->free)(ctx); 97 free(ctx); 98 } 99 100 int 101 X509_LOOKUP_init(X509_LOOKUP *ctx) 102 { 103 if (ctx->method == NULL) 104 return 0; 105 if (ctx->method->init != NULL) 106 return ctx->method->init(ctx); 107 else 108 return 1; 109 } 110 111 int 112 X509_LOOKUP_shutdown(X509_LOOKUP *ctx) 113 { 114 if (ctx->method == NULL) 115 return 0; 116 if (ctx->method->shutdown != NULL) 117 return ctx->method->shutdown(ctx); 118 else 119 return 1; 120 } 121 122 int 123 X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, 124 char **ret) 125 { 126 if (ctx->method == NULL) 127 return -1; 128 if (ctx->method->ctrl != NULL) 129 return ctx->method->ctrl(ctx, cmd, argc, argl, ret); 130 else 131 return 1; 132 } 133 134 int 135 X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name, 136 X509_OBJECT *ret) 137 { 138 if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL)) 139 return 0; 140 if (ctx->skip) 141 return 0; 142 return ctx->method->get_by_subject(ctx, type, name, ret); 143 } 144 145 int 146 X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name, 147 ASN1_INTEGER *serial, X509_OBJECT *ret) 148 { 149 if ((ctx->method == NULL) || 150 (ctx->method->get_by_issuer_serial == NULL)) 151 return 0; 152 return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret); 153 } 154 155 int 156 X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type, 157 const unsigned char *bytes, int len, X509_OBJECT *ret) 158 { 159 if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL)) 160 return 0; 161 return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret); 162 } 163 164 int 165 X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, const char *str, int len, 166 X509_OBJECT *ret) 167 { 168 if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL)) 169 return 0; 170 return ctx->method->get_by_alias(ctx, type, str, len, ret); 171 } 172 173 static int 174 x509_object_cmp(const X509_OBJECT * const *a, const X509_OBJECT * const *b) 175 { 176 int ret; 177 178 ret = ((*a)->type - (*b)->type); 179 if (ret) 180 return ret; 181 switch ((*a)->type) { 182 case X509_LU_X509: 183 ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509); 184 break; 185 case X509_LU_CRL: 186 ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl); 187 break; 188 default: 189 /* abort(); */ 190 return 0; 191 } 192 return ret; 193 } 194 195 X509_STORE * 196 X509_STORE_new(void) 197 { 198 X509_STORE *ret; 199 200 if ((ret = malloc(sizeof(X509_STORE))) == NULL) 201 return NULL; 202 ret->objs = sk_X509_OBJECT_new(x509_object_cmp); 203 ret->cache = 1; 204 ret->get_cert_methods = sk_X509_LOOKUP_new_null(); 205 ret->verify = 0; 206 ret->verify_cb = 0; 207 208 if ((ret->param = X509_VERIFY_PARAM_new()) == NULL) 209 goto err; 210 211 ret->get_issuer = 0; 212 ret->check_issued = 0; 213 ret->check_revocation = 0; 214 ret->get_crl = 0; 215 ret->check_crl = 0; 216 ret->cert_crl = 0; 217 ret->lookup_certs = 0; 218 ret->lookup_crls = 0; 219 ret->cleanup = 0; 220 221 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data)) 222 goto err; 223 224 ret->references = 1; 225 return ret; 226 227 err: 228 X509_VERIFY_PARAM_free(ret->param); 229 sk_X509_LOOKUP_free(ret->get_cert_methods); 230 sk_X509_OBJECT_free(ret->objs); 231 free(ret); 232 return NULL; 233 } 234 235 static void 236 X509_OBJECT_free(X509_OBJECT *a) 237 { 238 X509_OBJECT_free_contents(a); 239 free(a); 240 } 241 242 void 243 X509_STORE_free(X509_STORE *vfy) 244 { 245 int i; 246 STACK_OF(X509_LOOKUP) *sk; 247 X509_LOOKUP *lu; 248 249 if (vfy == NULL) 250 return; 251 252 i = CRYPTO_add(&vfy->references, -1, CRYPTO_LOCK_X509_STORE); 253 if (i > 0) 254 return; 255 256 sk = vfy->get_cert_methods; 257 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { 258 lu = sk_X509_LOOKUP_value(sk, i); 259 X509_LOOKUP_shutdown(lu); 260 X509_LOOKUP_free(lu); 261 } 262 sk_X509_LOOKUP_free(sk); 263 sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free); 264 265 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data); 266 X509_VERIFY_PARAM_free(vfy->param); 267 free(vfy); 268 } 269 270 int 271 X509_STORE_up_ref(X509_STORE *x) 272 { 273 int refs = CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_STORE); 274 return (refs > 1) ? 1 : 0; 275 } 276 277 X509_LOOKUP * 278 X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m) 279 { 280 int i; 281 STACK_OF(X509_LOOKUP) *sk; 282 X509_LOOKUP *lu; 283 284 sk = v->get_cert_methods; 285 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) { 286 lu = sk_X509_LOOKUP_value(sk, i); 287 if (m == lu->method) { 288 return lu; 289 } 290 } 291 /* a new one */ 292 lu = X509_LOOKUP_new(m); 293 if (lu == NULL) 294 return NULL; 295 else { 296 lu->store_ctx = v; 297 if (sk_X509_LOOKUP_push(v->get_cert_methods, lu)) 298 return lu; 299 else { 300 X509_LOOKUP_free(lu); 301 return NULL; 302 } 303 } 304 } 305 306 int 307 X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name, 308 X509_OBJECT *ret) 309 { 310 X509_STORE *ctx = vs->ctx; 311 X509_LOOKUP *lu; 312 X509_OBJECT stmp, *tmp; 313 int i; 314 315 if (ctx == NULL) 316 return 0; 317 318 stmp.type = 0; 319 stmp.data.ptr = NULL; 320 321 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 322 tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name); 323 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 324 325 if (tmp == NULL || type == X509_LU_CRL) { 326 for (i = 0; i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) { 327 lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i); 328 if (X509_LOOKUP_by_subject(lu, type, name, &stmp) != 0) { 329 tmp = &stmp; 330 break; 331 } 332 } 333 if (tmp == NULL) 334 return 0; 335 } 336 337 ret->type = tmp->type; 338 ret->data.ptr = tmp->data.ptr; 339 340 X509_OBJECT_up_ref_count(ret); 341 342 return 1; 343 } 344 345 int 346 X509_STORE_add_cert(X509_STORE *ctx, X509 *x) 347 { 348 X509_OBJECT *obj; 349 int ret = 1; 350 351 if (x == NULL) 352 return 0; 353 obj = malloc(sizeof(X509_OBJECT)); 354 if (obj == NULL) { 355 X509error(ERR_R_MALLOC_FAILURE); 356 return 0; 357 } 358 obj->type = X509_LU_X509; 359 obj->data.x509 = x; 360 361 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 362 363 X509_OBJECT_up_ref_count(obj); 364 365 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) { 366 X509error(X509_R_CERT_ALREADY_IN_HASH_TABLE); 367 ret = 0; 368 } else { 369 if (sk_X509_OBJECT_push(ctx->objs, obj) == 0) { 370 X509error(ERR_R_MALLOC_FAILURE); 371 ret = 0; 372 } 373 } 374 375 if (ret == 0) 376 X509_OBJECT_dec_ref_count(obj); 377 378 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 379 380 if (ret == 0) { 381 obj->data.x509 = NULL; /* owned by the caller */ 382 X509_OBJECT_free(obj); 383 } 384 385 return ret; 386 } 387 388 int 389 X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x) 390 { 391 X509_OBJECT *obj; 392 int ret = 1; 393 394 if (x == NULL) 395 return 0; 396 obj = malloc(sizeof(X509_OBJECT)); 397 if (obj == NULL) { 398 X509error(ERR_R_MALLOC_FAILURE); 399 return 0; 400 } 401 obj->type = X509_LU_CRL; 402 obj->data.crl = x; 403 404 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 405 406 X509_OBJECT_up_ref_count(obj); 407 408 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) { 409 X509error(X509_R_CERT_ALREADY_IN_HASH_TABLE); 410 ret = 0; 411 } else { 412 if (sk_X509_OBJECT_push(ctx->objs, obj) == 0) { 413 X509error(ERR_R_MALLOC_FAILURE); 414 ret = 0; 415 } 416 } 417 418 if (ret == 0) 419 X509_OBJECT_dec_ref_count(obj); 420 421 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 422 423 if (ret == 0) { 424 obj->data.crl = NULL; /* owned by the caller */ 425 X509_OBJECT_free(obj); 426 } 427 428 return ret; 429 } 430 431 static void 432 X509_OBJECT_dec_ref_count(X509_OBJECT *a) 433 { 434 switch (a->type) { 435 case X509_LU_X509: 436 CRYPTO_add(&a->data.x509->references, -1, CRYPTO_LOCK_X509); 437 break; 438 case X509_LU_CRL: 439 CRYPTO_add(&a->data.crl->references, -1, CRYPTO_LOCK_X509_CRL); 440 break; 441 } 442 } 443 444 int 445 X509_OBJECT_up_ref_count(X509_OBJECT *a) 446 { 447 switch (a->type) { 448 case X509_LU_X509: 449 return X509_up_ref(a->data.x509); 450 case X509_LU_CRL: 451 return X509_CRL_up_ref(a->data.crl); 452 } 453 return 1; 454 } 455 456 int 457 X509_OBJECT_get_type(const X509_OBJECT *a) 458 { 459 return a->type; 460 } 461 462 void 463 X509_OBJECT_free_contents(X509_OBJECT *a) 464 { 465 switch (a->type) { 466 case X509_LU_X509: 467 X509_free(a->data.x509); 468 break; 469 case X509_LU_CRL: 470 X509_CRL_free(a->data.crl); 471 break; 472 } 473 } 474 475 static int 476 x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name, 477 int *pnmatch) 478 { 479 X509_OBJECT stmp; 480 X509 x509_s; 481 X509_CINF cinf_s; 482 X509_CRL crl_s; 483 X509_CRL_INFO crl_info_s; 484 int idx; 485 486 stmp.type = type; 487 switch (type) { 488 case X509_LU_X509: 489 stmp.data.x509 = &x509_s; 490 x509_s.cert_info = &cinf_s; 491 cinf_s.subject = name; 492 break; 493 case X509_LU_CRL: 494 stmp.data.crl = &crl_s; 495 crl_s.crl = &crl_info_s; 496 crl_info_s.issuer = name; 497 break; 498 default: 499 /* abort(); */ 500 return -1; 501 } 502 503 idx = sk_X509_OBJECT_find(h, &stmp); 504 if (idx >= 0 && pnmatch) { 505 int tidx; 506 const X509_OBJECT *tobj, *pstmp; 507 *pnmatch = 1; 508 pstmp = &stmp; 509 for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) { 510 tobj = sk_X509_OBJECT_value(h, tidx); 511 if (x509_object_cmp(&tobj, &pstmp)) 512 break; 513 (*pnmatch)++; 514 } 515 } 516 return idx; 517 } 518 519 int 520 X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name) 521 { 522 return x509_object_idx_cnt(h, type, name, NULL); 523 } 524 525 X509_OBJECT * 526 X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type, 527 X509_NAME *name) 528 { 529 int idx; 530 531 idx = X509_OBJECT_idx_by_subject(h, type, name); 532 if (idx == -1) 533 return NULL; 534 return sk_X509_OBJECT_value(h, idx); 535 } 536 537 X509 * 538 X509_OBJECT_get0_X509(const X509_OBJECT *xo) 539 { 540 if (xo != NULL && xo->type == X509_LU_X509) 541 return xo->data.x509; 542 return NULL; 543 } 544 545 X509_CRL * 546 X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo) 547 { 548 if (xo != NULL && xo->type == X509_LU_CRL) 549 return xo->data.crl; 550 return NULL; 551 } 552 553 STACK_OF(X509) * 554 X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm) 555 { 556 int i, idx, cnt; 557 STACK_OF(X509) *sk; 558 X509 *x; 559 X509_OBJECT *obj; 560 561 if (ctx->ctx == NULL) 562 return NULL; 563 sk = sk_X509_new_null(); 564 if (sk == NULL) 565 return NULL; 566 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 567 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt); 568 if (idx < 0) { 569 /* Nothing found in cache: do lookup to possibly add new 570 * objects to cache 571 */ 572 X509_OBJECT xobj; 573 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 574 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) { 575 sk_X509_free(sk); 576 return NULL; 577 } 578 X509_OBJECT_free_contents(&xobj); 579 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 580 idx = x509_object_idx_cnt(ctx->ctx->objs, 581 X509_LU_X509, nm, &cnt); 582 if (idx < 0) { 583 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 584 sk_X509_free(sk); 585 return NULL; 586 } 587 } 588 for (i = 0; i < cnt; i++, idx++) { 589 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx); 590 x = obj->data.x509; 591 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509); 592 if (!sk_X509_push(sk, x)) { 593 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 594 X509_free(x); 595 sk_X509_pop_free(sk, X509_free); 596 return NULL; 597 } 598 } 599 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 600 return sk; 601 602 } 603 604 STACK_OF(X509_CRL) * 605 X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm) 606 { 607 int i, idx, cnt; 608 STACK_OF(X509_CRL) *sk; 609 X509_CRL *x; 610 X509_OBJECT *obj, xobj; 611 612 if (ctx->ctx == NULL) 613 return NULL; 614 sk = sk_X509_CRL_new_null(); 615 if (sk == NULL) 616 return NULL; 617 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 618 /* Check cache first */ 619 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt); 620 621 /* Always do lookup to possibly add new CRLs to cache 622 */ 623 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 624 if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) { 625 sk_X509_CRL_free(sk); 626 return NULL; 627 } 628 X509_OBJECT_free_contents(&xobj); 629 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 630 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt); 631 if (idx < 0) { 632 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 633 sk_X509_CRL_free(sk); 634 return NULL; 635 } 636 637 for (i = 0; i < cnt; i++, idx++) { 638 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx); 639 x = obj->data.crl; 640 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL); 641 if (!sk_X509_CRL_push(sk, x)) { 642 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 643 X509_CRL_free(x); 644 sk_X509_CRL_pop_free(sk, X509_CRL_free); 645 return NULL; 646 } 647 } 648 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 649 return sk; 650 } 651 652 X509_OBJECT * 653 X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x) 654 { 655 int idx, i; 656 X509_OBJECT *obj; 657 658 idx = sk_X509_OBJECT_find(h, x); 659 if (idx == -1) 660 return NULL; 661 if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL)) 662 return sk_X509_OBJECT_value(h, idx); 663 for (i = idx; i < sk_X509_OBJECT_num(h); i++) { 664 obj = sk_X509_OBJECT_value(h, i); 665 if (x509_object_cmp((const X509_OBJECT **)&obj, 666 (const X509_OBJECT **)&x)) 667 return NULL; 668 if (x->type == X509_LU_X509) { 669 if (!X509_cmp(obj->data.x509, x->data.x509)) 670 return obj; 671 } else if (x->type == X509_LU_CRL) { 672 if (!X509_CRL_match(obj->data.crl, x->data.crl)) 673 return obj; 674 } else 675 return obj; 676 } 677 return NULL; 678 } 679 680 /* Try to get issuer certificate from store. Due to limitations 681 * of the API this can only retrieve a single certificate matching 682 * a given subject name. However it will fill the cache with all 683 * matching certificates, so we can examine the cache for all 684 * matches. 685 * 686 * Return values are: 687 * 1 lookup successful. 688 * 0 certificate not found. 689 * -1 some other error. 690 */ 691 int 692 X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) 693 { 694 X509_NAME *xn; 695 X509_OBJECT obj, *pobj; 696 int i, idx, ret; 697 698 *issuer = NULL; 699 xn = X509_get_issuer_name(x); 700 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj)) 701 return 0; 702 /* If certificate matches all OK */ 703 if (ctx->check_issued(ctx, x, obj.data.x509)) { 704 if (x509_check_cert_time(ctx, obj.data.x509, 1)) { 705 *issuer = obj.data.x509; 706 return 1; 707 } 708 } 709 X509_OBJECT_free_contents(&obj); 710 711 if (ctx->ctx == NULL) 712 return 0; 713 714 /* Else find index of first cert accepted by 'check_issued' */ 715 ret = 0; 716 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE); 717 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn); 718 if (idx != -1) /* should be true as we've had at least one match */ { 719 /* Look through all matching certs for suitable issuer */ 720 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) { 721 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i); 722 /* See if we've run past the matches */ 723 if (pobj->type != X509_LU_X509) 724 break; 725 if (X509_NAME_cmp(xn, 726 X509_get_subject_name(pobj->data.x509))) 727 break; 728 if (ctx->check_issued(ctx, x, pobj->data.x509)) { 729 *issuer = pobj->data.x509; 730 ret = 1; 731 /* 732 * If times check, exit with match, 733 * otherwise keep looking. Leave last 734 * match in issuer so we return nearest 735 * match if no certificate time is OK. 736 */ 737 if (x509_check_cert_time(ctx, *issuer, 1)) 738 break; 739 } 740 } 741 } 742 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE); 743 if (*issuer) 744 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509); 745 return ret; 746 } 747 748 STACK_OF(X509_OBJECT) * 749 X509_STORE_get0_objects(X509_STORE *xs) 750 { 751 return xs->objs; 752 } 753 754 void * 755 X509_STORE_get_ex_data(X509_STORE *xs, int idx) 756 { 757 return CRYPTO_get_ex_data(&xs->ex_data, idx); 758 } 759 760 int 761 X509_STORE_set_ex_data(X509_STORE *xs, int idx, void *data) 762 { 763 return CRYPTO_set_ex_data(&xs->ex_data, idx, data); 764 } 765 766 int 767 X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags) 768 { 769 return X509_VERIFY_PARAM_set_flags(ctx->param, flags); 770 } 771 772 int 773 X509_STORE_set_depth(X509_STORE *ctx, int depth) 774 { 775 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 776 return 1; 777 } 778 779 int 780 X509_STORE_set_purpose(X509_STORE *ctx, int purpose) 781 { 782 return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose); 783 } 784 785 int 786 X509_STORE_set_trust(X509_STORE *ctx, int trust) 787 { 788 return X509_VERIFY_PARAM_set_trust(ctx->param, trust); 789 } 790 791 int 792 X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param) 793 { 794 return X509_VERIFY_PARAM_set1(ctx->param, param); 795 } 796 797 X509_VERIFY_PARAM * 798 X509_STORE_get0_param(X509_STORE *ctx) 799 { 800 return ctx->param; 801 } 802 803 void 804 X509_STORE_set_verify_cb(X509_STORE *ctx, 805 int (*verify_cb)(int, X509_STORE_CTX *)) 806 { 807 ctx->verify_cb = verify_cb; 808 } 809