1 /* 2 * Copyright 2014-2020 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/refcount.h" 11 12 /* 13 * This structure holds all parameters associated with a verify operation by 14 * including an X509_VERIFY_PARAM structure in related structures the 15 * parameters used can be customized 16 */ 17 18 struct X509_VERIFY_PARAM_st { 19 char *name; 20 time_t check_time; /* Time to use */ 21 uint32_t inh_flags; /* Inheritance flags */ 22 unsigned long flags; /* Various verify flags */ 23 int purpose; /* purpose to check untrusted certificates */ 24 int trust; /* trust setting to check */ 25 int depth; /* Verify depth */ 26 int auth_level; /* Security level for chain verification */ 27 STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ 28 /* Peer identity details */ 29 STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ 30 unsigned int hostflags; /* Flags to control matching features */ 31 char *peername; /* Matching hostname in peer certificate */ 32 char *email; /* If not NULL email address to match */ 33 size_t emaillen; 34 unsigned char *ip; /* If not NULL IP address to match */ 35 size_t iplen; /* Length of IP address */ 36 }; 37 38 /* No error callback if depth < 0 */ 39 int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth); 40 41 /* a sequence of these are used */ 42 struct x509_attributes_st { 43 ASN1_OBJECT *object; 44 STACK_OF(ASN1_TYPE) *set; 45 }; 46 47 struct X509_extension_st { 48 ASN1_OBJECT *object; 49 ASN1_BOOLEAN critical; 50 ASN1_OCTET_STRING value; 51 }; 52 53 /* 54 * Method to handle CRL access. In general a CRL could be very large (several 55 * Mb) and can consume large amounts of resources if stored in memory by 56 * multiple processes. This method allows general CRL operations to be 57 * redirected to more efficient callbacks: for example a CRL entry database. 58 */ 59 60 #define X509_CRL_METHOD_DYNAMIC 1 61 62 struct x509_crl_method_st { 63 int flags; 64 int (*crl_init) (X509_CRL *crl); 65 int (*crl_free) (X509_CRL *crl); 66 int (*crl_lookup) (X509_CRL *crl, X509_REVOKED **ret, 67 ASN1_INTEGER *ser, X509_NAME *issuer); 68 int (*crl_verify) (X509_CRL *crl, EVP_PKEY *pk); 69 }; 70 71 struct x509_lookup_method_st { 72 char *name; 73 int (*new_item) (X509_LOOKUP *ctx); 74 void (*free) (X509_LOOKUP *ctx); 75 int (*init) (X509_LOOKUP *ctx); 76 int (*shutdown) (X509_LOOKUP *ctx); 77 int (*ctrl) (X509_LOOKUP *ctx, int cmd, const char *argc, long argl, 78 char **ret); 79 int (*get_by_subject) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 80 X509_NAME *name, X509_OBJECT *ret); 81 int (*get_by_issuer_serial) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 82 X509_NAME *name, ASN1_INTEGER *serial, 83 X509_OBJECT *ret); 84 int (*get_by_fingerprint) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 85 const unsigned char *bytes, int len, 86 X509_OBJECT *ret); 87 int (*get_by_alias) (X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 88 const char *str, int len, X509_OBJECT *ret); 89 }; 90 91 /* This is the functions plus an instance of the local variables. */ 92 struct x509_lookup_st { 93 int init; /* have we been started */ 94 int skip; /* don't use us. */ 95 X509_LOOKUP_METHOD *method; /* the functions */ 96 void *method_data; /* method data */ 97 X509_STORE *store_ctx; /* who owns us */ 98 }; 99 100 /* 101 * This is used to hold everything. It is used for all certificate 102 * validation. Once we have a certificate chain, the 'verify' function is 103 * then called to actually check the cert chain. 104 */ 105 struct x509_store_st { 106 /* The following is a cache of trusted certs */ 107 int cache; /* if true, stash any hits */ 108 STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */ 109 /* These are external lookup methods */ 110 STACK_OF(X509_LOOKUP) *get_cert_methods; 111 X509_VERIFY_PARAM *param; 112 /* Callbacks for various operations */ 113 /* called to verify a certificate */ 114 int (*verify) (X509_STORE_CTX *ctx); 115 /* error callback */ 116 int (*verify_cb) (int ok, X509_STORE_CTX *ctx); 117 /* get issuers cert from ctx */ 118 int (*get_issuer) (X509 **issuer, X509_STORE_CTX *ctx, X509 *x); 119 /* check issued */ 120 int (*check_issued) (X509_STORE_CTX *ctx, X509 *x, X509 *issuer); 121 /* Check revocation status of chain */ 122 int (*check_revocation) (X509_STORE_CTX *ctx); 123 /* retrieve CRL */ 124 int (*get_crl) (X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); 125 /* Check CRL validity */ 126 int (*check_crl) (X509_STORE_CTX *ctx, X509_CRL *crl); 127 /* Check certificate against CRL */ 128 int (*cert_crl) (X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); 129 /* Check policy status of the chain */ 130 int (*check_policy) (X509_STORE_CTX *ctx); 131 STACK_OF(X509) *(*lookup_certs) (X509_STORE_CTX *ctx, X509_NAME *nm); 132 STACK_OF(X509_CRL) *(*lookup_crls) (X509_STORE_CTX *ctx, X509_NAME *nm); 133 int (*cleanup) (X509_STORE_CTX *ctx); 134 CRYPTO_EX_DATA ex_data; 135 CRYPTO_REF_COUNT references; 136 CRYPTO_RWLOCK *lock; 137 }; 138 139 typedef struct lookup_dir_hashes_st BY_DIR_HASH; 140 typedef struct lookup_dir_entry_st BY_DIR_ENTRY; 141 DEFINE_STACK_OF(BY_DIR_HASH) 142 DEFINE_STACK_OF(BY_DIR_ENTRY) 143 typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY; 144 DEFINE_STACK_OF(STACK_OF_X509_NAME_ENTRY) 145 146 void x509_set_signature_info(X509_SIG_INFO *siginf, const X509_ALGOR *alg, 147 const ASN1_STRING *sig); 148 int x509_likely_issued(X509 *issuer, X509 *subject); 149 int x509_signing_allowed(const X509 *issuer, const X509 *subject); 150