1 /* $OpenBSD: x509_vpm.c,v 1.9 2014/07/11 08:44:49 jsing Exp $ */ 2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3 * project 2004. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <stdio.h> 60 #include <string.h> 61 62 #include <openssl/buffer.h> 63 #include <openssl/crypto.h> 64 #include <openssl/lhash.h> 65 #include <openssl/x509.h> 66 #include <openssl/x509v3.h> 67 68 /* X509_VERIFY_PARAM functions */ 69 70 static void 71 x509_verify_param_zero(X509_VERIFY_PARAM *param) 72 { 73 if (!param) 74 return; 75 param->name = NULL; 76 param->purpose = 0; 77 param->trust = 0; 78 /*param->inh_flags = X509_VP_FLAG_DEFAULT;*/ 79 param->inh_flags = 0; 80 param->flags = 0; 81 param->depth = -1; 82 if (param->policies) { 83 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free); 84 param->policies = NULL; 85 } 86 } 87 88 X509_VERIFY_PARAM * 89 X509_VERIFY_PARAM_new(void) 90 { 91 X509_VERIFY_PARAM *param; 92 93 param = calloc(1, sizeof(X509_VERIFY_PARAM)); 94 x509_verify_param_zero(param); 95 return param; 96 } 97 98 void 99 X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param) 100 { 101 x509_verify_param_zero(param); 102 free(param); 103 } 104 105 /* This function determines how parameters are "inherited" from one structure 106 * to another. There are several different ways this can happen. 107 * 108 * 1. If a child structure needs to have its values initialized from a parent 109 * they are simply copied across. For example SSL_CTX copied to SSL. 110 * 2. If the structure should take on values only if they are currently unset. 111 * For example the values in an SSL structure will take appropriate value 112 * for SSL servers or clients but only if the application has not set new 113 * ones. 114 * 115 * The "inh_flags" field determines how this function behaves. 116 * 117 * Normally any values which are set in the default are not copied from the 118 * destination and verify flags are ORed together. 119 * 120 * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied 121 * to the destination. Effectively the values in "to" become default values 122 * which will be used only if nothing new is set in "from". 123 * 124 * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether 125 * they are set or not. Flags is still Ored though. 126 * 127 * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead 128 * of ORed. 129 * 130 * If X509_VP_FLAG_LOCKED is set then no values are copied. 131 * 132 * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed 133 * after the next call. 134 */ 135 136 /* Macro to test if a field should be copied from src to dest */ 137 138 #define test_x509_verify_param_copy(field, def) \ 139 (to_overwrite || \ 140 ((src->field != def) && (to_default || (dest->field == def)))) 141 142 /* Macro to test and copy a field if necessary */ 143 144 #define x509_verify_param_copy(field, def) \ 145 if (test_x509_verify_param_copy(field, def)) \ 146 dest->field = src->field 147 148 149 int 150 X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src) 151 { 152 unsigned long inh_flags; 153 int to_default, to_overwrite; 154 155 if (!src) 156 return 1; 157 inh_flags = dest->inh_flags | src->inh_flags; 158 159 if (inh_flags & X509_VP_FLAG_ONCE) 160 dest->inh_flags = 0; 161 162 if (inh_flags & X509_VP_FLAG_LOCKED) 163 return 1; 164 165 if (inh_flags & X509_VP_FLAG_DEFAULT) 166 to_default = 1; 167 else 168 to_default = 0; 169 170 if (inh_flags & X509_VP_FLAG_OVERWRITE) 171 to_overwrite = 1; 172 else 173 to_overwrite = 0; 174 175 x509_verify_param_copy(purpose, 0); 176 x509_verify_param_copy(trust, 0); 177 x509_verify_param_copy(depth, -1); 178 179 /* If overwrite or check time not set, copy across */ 180 181 if (to_overwrite || !(dest->flags & X509_V_FLAG_USE_CHECK_TIME)) { 182 dest->check_time = src->check_time; 183 dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME; 184 /* Don't need to copy flag: that is done below */ 185 } 186 187 if (inh_flags & X509_VP_FLAG_RESET_FLAGS) 188 dest->flags = 0; 189 190 dest->flags |= src->flags; 191 192 if (test_x509_verify_param_copy(policies, NULL)) { 193 if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies)) 194 return 0; 195 } 196 197 return 1; 198 } 199 200 int 201 X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, const X509_VERIFY_PARAM *from) 202 { 203 unsigned long save_flags = to->inh_flags; 204 int ret; 205 206 to->inh_flags |= X509_VP_FLAG_DEFAULT; 207 ret = X509_VERIFY_PARAM_inherit(to, from); 208 to->inh_flags = save_flags; 209 return ret; 210 } 211 212 int 213 X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name) 214 { 215 free(param->name); 216 param->name = BUF_strdup(name); 217 if (param->name) 218 return 1; 219 return 0; 220 } 221 222 int 223 X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags) 224 { 225 param->flags |= flags; 226 if (flags & X509_V_FLAG_POLICY_MASK) 227 param->flags |= X509_V_FLAG_POLICY_CHECK; 228 return 1; 229 } 230 231 int 232 X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags) 233 { 234 param->flags &= ~flags; 235 return 1; 236 } 237 238 unsigned long 239 X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param) 240 { 241 return param->flags; 242 } 243 244 int 245 X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose) 246 { 247 return X509_PURPOSE_set(¶m->purpose, purpose); 248 } 249 250 int 251 X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust) 252 { 253 return X509_TRUST_set(¶m->trust, trust); 254 } 255 256 void 257 X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth) 258 { 259 param->depth = depth; 260 } 261 262 void 263 X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t) 264 { 265 param->check_time = t; 266 param->flags |= X509_V_FLAG_USE_CHECK_TIME; 267 } 268 269 int 270 X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy) 271 { 272 if (!param->policies) { 273 param->policies = sk_ASN1_OBJECT_new_null(); 274 if (!param->policies) 275 return 0; 276 } 277 if (!sk_ASN1_OBJECT_push(param->policies, policy)) 278 return 0; 279 return 1; 280 } 281 282 int 283 X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 284 STACK_OF(ASN1_OBJECT) *policies) 285 { 286 int i; 287 ASN1_OBJECT *oid, *doid; 288 289 if (!param) 290 return 0; 291 if (param->policies) 292 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free); 293 294 if (!policies) { 295 param->policies = NULL; 296 return 1; 297 } 298 299 param->policies = sk_ASN1_OBJECT_new_null(); 300 if (!param->policies) 301 return 0; 302 303 for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++) { 304 oid = sk_ASN1_OBJECT_value(policies, i); 305 doid = OBJ_dup(oid); 306 if (!doid) 307 return 0; 308 if (!sk_ASN1_OBJECT_push(param->policies, doid)) { 309 ASN1_OBJECT_free(doid); 310 return 0; 311 } 312 } 313 param->flags |= X509_V_FLAG_POLICY_CHECK; 314 return 1; 315 } 316 317 int 318 X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param) 319 { 320 return param->depth; 321 } 322 323 /* Default verify parameters: these are used for various 324 * applications and can be overridden by the user specified table. 325 * NB: the 'name' field *must* be in alphabetical order because it 326 * will be searched using OBJ_search. 327 */ 328 329 static const X509_VERIFY_PARAM default_table[] = { 330 { 331 "default", /* X509 default parameters */ 332 0, /* Check time */ 333 0, /* internal flags */ 334 0, /* flags */ 335 0, /* purpose */ 336 0, /* trust */ 337 100, /* depth */ 338 NULL /* policies */ 339 }, 340 { 341 "pkcs7", /* S/MIME sign parameters */ 342 0, /* Check time */ 343 0, /* internal flags */ 344 0, /* flags */ 345 X509_PURPOSE_SMIME_SIGN, /* purpose */ 346 X509_TRUST_EMAIL, /* trust */ 347 -1, /* depth */ 348 NULL /* policies */ 349 }, 350 { 351 "smime_sign", /* S/MIME sign parameters */ 352 0, /* Check time */ 353 0, /* internal flags */ 354 0, /* flags */ 355 X509_PURPOSE_SMIME_SIGN, /* purpose */ 356 X509_TRUST_EMAIL, /* trust */ 357 -1, /* depth */ 358 NULL /* policies */ 359 }, 360 { 361 "ssl_client", /* SSL/TLS client parameters */ 362 0, /* Check time */ 363 0, /* internal flags */ 364 0, /* flags */ 365 X509_PURPOSE_SSL_CLIENT, /* purpose */ 366 X509_TRUST_SSL_CLIENT, /* trust */ 367 -1, /* depth */ 368 NULL /* policies */ 369 }, 370 { 371 "ssl_server", /* SSL/TLS server parameters */ 372 0, /* Check time */ 373 0, /* internal flags */ 374 0, /* flags */ 375 X509_PURPOSE_SSL_SERVER, /* purpose */ 376 X509_TRUST_SSL_SERVER, /* trust */ 377 -1, /* depth */ 378 NULL /* policies */ 379 } 380 }; 381 382 static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL; 383 384 static int 385 table_cmp(const X509_VERIFY_PARAM *a, const X509_VERIFY_PARAM *b) 386 { 387 return strcmp(a->name, b->name); 388 } 389 390 DECLARE_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table); 391 IMPLEMENT_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table); 392 393 static int 394 param_cmp(const X509_VERIFY_PARAM * const *a, 395 const X509_VERIFY_PARAM * const *b) 396 { 397 return strcmp((*a)->name, (*b)->name); 398 } 399 400 int 401 X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param) 402 { 403 int idx; 404 X509_VERIFY_PARAM *ptmp; 405 406 if (!param_table) { 407 param_table = sk_X509_VERIFY_PARAM_new(param_cmp); 408 if (!param_table) 409 return 0; 410 } else { 411 idx = sk_X509_VERIFY_PARAM_find(param_table, param); 412 if (idx != -1) { 413 ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx); 414 X509_VERIFY_PARAM_free(ptmp); 415 (void)sk_X509_VERIFY_PARAM_delete(param_table, idx); 416 } 417 } 418 if (!sk_X509_VERIFY_PARAM_push(param_table, param)) 419 return 0; 420 return 1; 421 } 422 423 const X509_VERIFY_PARAM * 424 X509_VERIFY_PARAM_lookup(const char *name) 425 { 426 int idx; 427 X509_VERIFY_PARAM pm; 428 429 pm.name = (char *)name; 430 if (param_table) { 431 idx = sk_X509_VERIFY_PARAM_find(param_table, &pm); 432 if (idx != -1) 433 return sk_X509_VERIFY_PARAM_value(param_table, idx); 434 } 435 return OBJ_bsearch_table(&pm, default_table, 436 sizeof(default_table)/sizeof(X509_VERIFY_PARAM)); 437 } 438 439 void 440 X509_VERIFY_PARAM_table_cleanup(void) 441 { 442 if (param_table) 443 sk_X509_VERIFY_PARAM_pop_free(param_table, 444 X509_VERIFY_PARAM_free); 445 param_table = NULL; 446 } 447