by_file.c 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261
  1. /*
  2. * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <time.h>
  11. #include <errno.h>
  12. #include "internal/cryptlib.h"
  13. #include <openssl/buffer.h>
  14. #include <openssl/x509.h>
  15. #include <openssl/pem.h>
  16. #include "x509_local.h"
  17. static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
  18. long argl, char **ret);
  19. static int by_file_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argc,
  20. long argl, char **ret, OSSL_LIB_CTX *libctx,
  21. const char *propq);
  22. static X509_LOOKUP_METHOD x509_file_lookup = {
  23. "Load file into cache",
  24. NULL, /* new_item */
  25. NULL, /* free */
  26. NULL, /* init */
  27. NULL, /* shutdown */
  28. by_file_ctrl, /* ctrl */
  29. NULL, /* get_by_subject */
  30. NULL, /* get_by_issuer_serial */
  31. NULL, /* get_by_fingerprint */
  32. NULL, /* get_by_alias */
  33. NULL, /* get_by_subject_ex */
  34. by_file_ctrl_ex, /* ctrl_ex */
  35. };
  36. X509_LOOKUP_METHOD *X509_LOOKUP_file(void)
  37. {
  38. return &x509_file_lookup;
  39. }
  40. static int by_file_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp,
  41. long argl, char **ret, OSSL_LIB_CTX *libctx,
  42. const char *propq)
  43. {
  44. int ok = 0;
  45. const char *file;
  46. switch (cmd) {
  47. case X509_L_FILE_LOAD:
  48. if (argl == X509_FILETYPE_DEFAULT) {
  49. file = ossl_safe_getenv(X509_get_default_cert_file_env());
  50. if (file)
  51. ok = (X509_load_cert_crl_file_ex(ctx, file, X509_FILETYPE_PEM,
  52. libctx, propq) != 0);
  53. else
  54. ok = (X509_load_cert_crl_file_ex(
  55. ctx, X509_get_default_cert_file(),
  56. X509_FILETYPE_PEM, libctx, propq) != 0);
  57. if (!ok) {
  58. ERR_raise(ERR_LIB_X509, X509_R_LOADING_DEFAULTS);
  59. }
  60. } else {
  61. if (argl == X509_FILETYPE_PEM)
  62. ok = (X509_load_cert_crl_file_ex(ctx, argp, X509_FILETYPE_PEM,
  63. libctx, propq) != 0);
  64. else
  65. ok = (X509_load_cert_file_ex(ctx, argp, (int)argl, libctx,
  66. propq) != 0);
  67. }
  68. break;
  69. }
  70. return ok;
  71. }
  72. static int by_file_ctrl(X509_LOOKUP *ctx, int cmd,
  73. const char *argp, long argl, char **ret)
  74. {
  75. return by_file_ctrl_ex(ctx, cmd, argp, argl, ret, NULL, NULL);
  76. }
  77. int X509_load_cert_file_ex(X509_LOOKUP *ctx, const char *file, int type,
  78. OSSL_LIB_CTX *libctx, const char *propq)
  79. {
  80. int ret = 0;
  81. BIO *in = NULL;
  82. int i, count = 0;
  83. X509 *x = NULL;
  84. in = BIO_new(BIO_s_file());
  85. if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
  86. ERR_raise(ERR_LIB_X509, ERR_R_SYS_LIB);
  87. goto err;
  88. }
  89. if (type != X509_FILETYPE_PEM && type != X509_FILETYPE_ASN1) {
  90. ERR_raise(ERR_LIB_X509, X509_R_BAD_X509_FILETYPE);
  91. goto err;
  92. }
  93. x = X509_new_ex(libctx, propq);
  94. if (x == NULL) {
  95. ERR_raise(ERR_LIB_X509, ERR_R_MALLOC_FAILURE);
  96. goto err;
  97. }
  98. if (type == X509_FILETYPE_PEM) {
  99. for (;;) {
  100. ERR_set_mark();
  101. if (PEM_read_bio_X509_AUX(in, &x, NULL, "") == NULL) {
  102. if ((ERR_GET_REASON(ERR_peek_last_error()) ==
  103. PEM_R_NO_START_LINE) && (count > 0)) {
  104. ERR_pop_to_mark();
  105. break;
  106. } else {
  107. ERR_clear_last_mark();
  108. goto err;
  109. }
  110. }
  111. ERR_clear_last_mark();
  112. i = X509_STORE_add_cert(ctx->store_ctx, x);
  113. if (!i)
  114. goto err;
  115. count++;
  116. X509_free(x);
  117. x = NULL;
  118. }
  119. ret = count;
  120. } else if (type == X509_FILETYPE_ASN1) {
  121. if (d2i_X509_bio(in, &x) == NULL) {
  122. ERR_raise(ERR_LIB_X509, ERR_R_ASN1_LIB);
  123. goto err;
  124. }
  125. i = X509_STORE_add_cert(ctx->store_ctx, x);
  126. if (!i)
  127. goto err;
  128. ret = i;
  129. }
  130. if (ret == 0)
  131. ERR_raise(ERR_LIB_X509, X509_R_NO_CERTIFICATE_FOUND);
  132. err:
  133. X509_free(x);
  134. BIO_free(in);
  135. return ret;
  136. }
  137. int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
  138. {
  139. return X509_load_cert_file_ex(ctx, file, type, NULL, NULL);
  140. }
  141. int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type)
  142. {
  143. int ret = 0;
  144. BIO *in = NULL;
  145. int i, count = 0;
  146. X509_CRL *x = NULL;
  147. in = BIO_new(BIO_s_file());
  148. if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
  149. ERR_raise(ERR_LIB_X509, ERR_R_SYS_LIB);
  150. goto err;
  151. }
  152. if (type == X509_FILETYPE_PEM) {
  153. for (;;) {
  154. x = PEM_read_bio_X509_CRL(in, NULL, NULL, "");
  155. if (x == NULL) {
  156. if ((ERR_GET_REASON(ERR_peek_last_error()) ==
  157. PEM_R_NO_START_LINE) && (count > 0)) {
  158. ERR_clear_error();
  159. break;
  160. } else {
  161. ERR_raise(ERR_LIB_X509, ERR_R_PEM_LIB);
  162. goto err;
  163. }
  164. }
  165. i = X509_STORE_add_crl(ctx->store_ctx, x);
  166. if (!i)
  167. goto err;
  168. count++;
  169. X509_CRL_free(x);
  170. x = NULL;
  171. }
  172. ret = count;
  173. } else if (type == X509_FILETYPE_ASN1) {
  174. x = d2i_X509_CRL_bio(in, NULL);
  175. if (x == NULL) {
  176. ERR_raise(ERR_LIB_X509, ERR_R_ASN1_LIB);
  177. goto err;
  178. }
  179. i = X509_STORE_add_crl(ctx->store_ctx, x);
  180. if (!i)
  181. goto err;
  182. ret = i;
  183. } else {
  184. ERR_raise(ERR_LIB_X509, X509_R_BAD_X509_FILETYPE);
  185. goto err;
  186. }
  187. if (ret == 0)
  188. ERR_raise(ERR_LIB_X509, X509_R_NO_CRL_FOUND);
  189. err:
  190. X509_CRL_free(x);
  191. BIO_free(in);
  192. return ret;
  193. }
  194. int X509_load_cert_crl_file_ex(X509_LOOKUP *ctx, const char *file, int type,
  195. OSSL_LIB_CTX *libctx, const char *propq)
  196. {
  197. STACK_OF(X509_INFO) *inf;
  198. X509_INFO *itmp;
  199. BIO *in;
  200. int i, count = 0;
  201. if (type != X509_FILETYPE_PEM)
  202. return X509_load_cert_file_ex(ctx, file, type, libctx, propq);
  203. in = BIO_new_file(file, "r");
  204. if (!in) {
  205. ERR_raise(ERR_LIB_X509, ERR_R_SYS_LIB);
  206. return 0;
  207. }
  208. inf = PEM_X509_INFO_read_bio_ex(in, NULL, NULL, "", libctx, propq);
  209. BIO_free(in);
  210. if (!inf) {
  211. ERR_raise(ERR_LIB_X509, ERR_R_PEM_LIB);
  212. return 0;
  213. }
  214. for (i = 0; i < sk_X509_INFO_num(inf); i++) {
  215. itmp = sk_X509_INFO_value(inf, i);
  216. if (itmp->x509) {
  217. if (!X509_STORE_add_cert(ctx->store_ctx, itmp->x509))
  218. goto err;
  219. count++;
  220. }
  221. if (itmp->crl) {
  222. if (!X509_STORE_add_crl(ctx->store_ctx, itmp->crl))
  223. goto err;
  224. count++;
  225. }
  226. }
  227. if (count == 0)
  228. ERR_raise(ERR_LIB_X509, X509_R_NO_CERTIFICATE_OR_CRL_FOUND);
  229. err:
  230. sk_X509_INFO_pop_free(inf, X509_INFO_free);
  231. return count;
  232. }
  233. int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
  234. {
  235. return X509_load_cert_crl_file_ex(ctx, file, type, NULL, NULL);
  236. }