x509_trs.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288
  1. /* x509_trs.c */
  2. /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
  3. * project 1999.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. *
  57. */
  58. #include <stdio.h>
  59. #include "cryptlib.h"
  60. #include <openssl/x509v3.h>
  61. static int tr_cmp(const X509_TRUST * const *a,
  62. const X509_TRUST * const *b);
  63. static void trtable_free(X509_TRUST *p);
  64. static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
  65. static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
  66. static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
  67. static int obj_trust(int id, X509 *x, int flags);
  68. static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
  69. /* WARNING: the following table should be kept in order of trust
  70. * and without any gaps so we can just subtract the minimum trust
  71. * value to get an index into the table
  72. */
  73. static X509_TRUST trstandard[] = {
  74. {X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
  75. {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
  76. {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
  77. {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
  78. {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
  79. {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
  80. {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
  81. {X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
  82. };
  83. #define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
  84. IMPLEMENT_STACK_OF(X509_TRUST)
  85. static STACK_OF(X509_TRUST) *trtable = NULL;
  86. static int tr_cmp(const X509_TRUST * const *a,
  87. const X509_TRUST * const *b)
  88. {
  89. return (*a)->trust - (*b)->trust;
  90. }
  91. int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
  92. {
  93. int (*oldtrust)(int , X509 *, int);
  94. oldtrust = default_trust;
  95. default_trust = trust;
  96. return oldtrust;
  97. }
  98. int X509_check_trust(X509 *x, int id, int flags)
  99. {
  100. X509_TRUST *pt;
  101. int idx;
  102. if(id == -1) return 1;
  103. idx = X509_TRUST_get_by_id(id);
  104. if(idx == -1) return default_trust(id, x, flags);
  105. pt = X509_TRUST_get0(idx);
  106. return pt->check_trust(pt, x, flags);
  107. }
  108. int X509_TRUST_get_count(void)
  109. {
  110. if(!trtable) return X509_TRUST_COUNT;
  111. return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
  112. }
  113. X509_TRUST * X509_TRUST_get0(int idx)
  114. {
  115. if(idx < 0) return NULL;
  116. if(idx < (int)X509_TRUST_COUNT) return trstandard + idx;
  117. return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
  118. }
  119. int X509_TRUST_get_by_id(int id)
  120. {
  121. X509_TRUST tmp;
  122. int idx;
  123. if((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
  124. return id - X509_TRUST_MIN;
  125. tmp.trust = id;
  126. if(!trtable) return -1;
  127. idx = sk_X509_TRUST_find(trtable, &tmp);
  128. if(idx == -1) return -1;
  129. return idx + X509_TRUST_COUNT;
  130. }
  131. int X509_TRUST_set(int *t, int trust)
  132. {
  133. if(X509_TRUST_get_by_id(trust) == -1) {
  134. X509err(X509_F_X509_TRUST_SET, X509_R_INVALID_TRUST);
  135. return 0;
  136. }
  137. *t = trust;
  138. return 1;
  139. }
  140. int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
  141. char *name, int arg1, void *arg2)
  142. {
  143. int idx;
  144. X509_TRUST *trtmp;
  145. /* This is set according to what we change: application can't set it */
  146. flags &= ~X509_TRUST_DYNAMIC;
  147. /* This will always be set for application modified trust entries */
  148. flags |= X509_TRUST_DYNAMIC_NAME;
  149. /* Get existing entry if any */
  150. idx = X509_TRUST_get_by_id(id);
  151. /* Need a new entry */
  152. if(idx == -1) {
  153. if(!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
  154. X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
  155. return 0;
  156. }
  157. trtmp->flags = X509_TRUST_DYNAMIC;
  158. } else trtmp = X509_TRUST_get0(idx);
  159. /* OPENSSL_free existing name if dynamic */
  160. if(trtmp->flags & X509_TRUST_DYNAMIC_NAME) OPENSSL_free(trtmp->name);
  161. /* dup supplied name */
  162. if(!(trtmp->name = BUF_strdup(name))) {
  163. X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
  164. return 0;
  165. }
  166. /* Keep the dynamic flag of existing entry */
  167. trtmp->flags &= X509_TRUST_DYNAMIC;
  168. /* Set all other flags */
  169. trtmp->flags |= flags;
  170. trtmp->trust = id;
  171. trtmp->check_trust = ck;
  172. trtmp->arg1 = arg1;
  173. trtmp->arg2 = arg2;
  174. /* If its a new entry manage the dynamic table */
  175. if(idx == -1) {
  176. if(!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
  177. X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
  178. return 0;
  179. }
  180. if (!sk_X509_TRUST_push(trtable, trtmp)) {
  181. X509err(X509_F_X509_TRUST_ADD,ERR_R_MALLOC_FAILURE);
  182. return 0;
  183. }
  184. }
  185. return 1;
  186. }
  187. static void trtable_free(X509_TRUST *p)
  188. {
  189. if(!p) return;
  190. if (p->flags & X509_TRUST_DYNAMIC)
  191. {
  192. if (p->flags & X509_TRUST_DYNAMIC_NAME)
  193. OPENSSL_free(p->name);
  194. OPENSSL_free(p);
  195. }
  196. }
  197. void X509_TRUST_cleanup(void)
  198. {
  199. unsigned int i;
  200. for(i = 0; i < X509_TRUST_COUNT; i++) trtable_free(trstandard + i);
  201. sk_X509_TRUST_pop_free(trtable, trtable_free);
  202. trtable = NULL;
  203. }
  204. int X509_TRUST_get_flags(X509_TRUST *xp)
  205. {
  206. return xp->flags;
  207. }
  208. char *X509_TRUST_get0_name(X509_TRUST *xp)
  209. {
  210. return xp->name;
  211. }
  212. int X509_TRUST_get_trust(X509_TRUST *xp)
  213. {
  214. return xp->trust;
  215. }
  216. static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
  217. {
  218. if(x->aux && (x->aux->trust || x->aux->reject))
  219. return obj_trust(trust->arg1, x, flags);
  220. /* we don't have any trust settings: for compatibility
  221. * we return trusted if it is self signed
  222. */
  223. return trust_compat(trust, x, flags);
  224. }
  225. static int trust_1oid(X509_TRUST *trust, X509 *x, int flags)
  226. {
  227. if(x->aux) return obj_trust(trust->arg1, x, flags);
  228. return X509_TRUST_UNTRUSTED;
  229. }
  230. static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
  231. {
  232. X509_check_purpose(x, -1, 0);
  233. if(x->ex_flags & EXFLAG_SS) return X509_TRUST_TRUSTED;
  234. else return X509_TRUST_UNTRUSTED;
  235. }
  236. static int obj_trust(int id, X509 *x, int flags)
  237. {
  238. ASN1_OBJECT *obj;
  239. int i;
  240. X509_CERT_AUX *ax;
  241. ax = x->aux;
  242. if(!ax) return X509_TRUST_UNTRUSTED;
  243. if(ax->reject) {
  244. for(i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
  245. obj = sk_ASN1_OBJECT_value(ax->reject, i);
  246. if(OBJ_obj2nid(obj) == id) return X509_TRUST_REJECTED;
  247. }
  248. }
  249. if(ax->trust) {
  250. for(i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
  251. obj = sk_ASN1_OBJECT_value(ax->trust, i);
  252. if(OBJ_obj2nid(obj) == id) return X509_TRUST_TRUSTED;
  253. }
  254. }
  255. return X509_TRUST_UNTRUSTED;
  256. }