x509_vfy.c 105 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398
  1. /*
  2. * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <time.h>
  11. #include <errno.h>
  12. #include <limits.h>
  13. #include "crypto/ctype.h"
  14. #include "internal/cryptlib.h"
  15. #include <openssl/crypto.h>
  16. #include <openssl/buffer.h>
  17. #include <openssl/evp.h>
  18. #include <openssl/asn1.h>
  19. #include <openssl/x509.h>
  20. #include <openssl/x509v3.h>
  21. #include <openssl/objects.h>
  22. #include "internal/dane.h"
  23. #include "crypto/x509.h"
  24. #include "x509_local.h"
  25. DEFINE_STACK_OF(X509)
  26. DEFINE_STACK_OF(X509_REVOKED)
  27. DEFINE_STACK_OF(GENERAL_NAME)
  28. DEFINE_STACK_OF(X509_CRL)
  29. DEFINE_STACK_OF(DIST_POINT)
  30. DEFINE_STACK_OF_STRING()
  31. /* CRL score values */
  32. /* No unhandled critical extensions */
  33. #define CRL_SCORE_NOCRITICAL 0x100
  34. /* certificate is within CRL scope */
  35. #define CRL_SCORE_SCOPE 0x080
  36. /* CRL times valid */
  37. #define CRL_SCORE_TIME 0x040
  38. /* Issuer name matches certificate */
  39. #define CRL_SCORE_ISSUER_NAME 0x020
  40. /* If this score or above CRL is probably valid */
  41. #define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE)
  42. /* CRL issuer is certificate issuer */
  43. #define CRL_SCORE_ISSUER_CERT 0x018
  44. /* CRL issuer is on certificate path */
  45. #define CRL_SCORE_SAME_PATH 0x008
  46. /* CRL issuer matches CRL AKID */
  47. #define CRL_SCORE_AKID 0x004
  48. /* Have a delta CRL with valid times */
  49. #define CRL_SCORE_TIME_DELTA 0x002
  50. static int build_chain(X509_STORE_CTX *ctx);
  51. static int verify_chain(X509_STORE_CTX *ctx);
  52. static int dane_verify(X509_STORE_CTX *ctx);
  53. static int null_callback(int ok, X509_STORE_CTX *e);
  54. static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
  55. static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);
  56. static int check_chain_extensions(X509_STORE_CTX *ctx);
  57. static int check_name_constraints(X509_STORE_CTX *ctx);
  58. static int check_id(X509_STORE_CTX *ctx);
  59. static int check_trust(X509_STORE_CTX *ctx, int num_untrusted);
  60. static int check_revocation(X509_STORE_CTX *ctx);
  61. static int check_cert(X509_STORE_CTX *ctx);
  62. static int check_policy(X509_STORE_CTX *ctx);
  63. static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
  64. static int check_dane_issuer(X509_STORE_CTX *ctx, int depth);
  65. static int check_key_level(X509_STORE_CTX *ctx, X509 *cert);
  66. static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert);
  67. static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
  68. unsigned int *preasons, X509_CRL *crl, X509 *x);
  69. static int get_crl_delta(X509_STORE_CTX *ctx,
  70. X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x);
  71. static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl,
  72. int *pcrl_score, X509_CRL *base,
  73. STACK_OF(X509_CRL) *crls);
  74. static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer,
  75. int *pcrl_score);
  76. static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
  77. unsigned int *preasons);
  78. static int check_crl_path(X509_STORE_CTX *ctx, X509 *x);
  79. static int check_crl_chain(X509_STORE_CTX *ctx,
  80. STACK_OF(X509) *cert_path,
  81. STACK_OF(X509) *crl_path);
  82. static int internal_verify(X509_STORE_CTX *ctx);
  83. static int null_callback(int ok, X509_STORE_CTX *e)
  84. {
  85. return ok;
  86. }
  87. /* Return 1 is a certificate is self signed, 0 if not, or -1 on error */
  88. static int cert_self_signed(X509_STORE_CTX *ctx, X509 *x)
  89. {
  90. if (!X509v3_cache_extensions(x, ctx->libctx, ctx->propq))
  91. return -1;
  92. if (x->ex_flags & EXFLAG_SS)
  93. return 1;
  94. else
  95. return 0;
  96. }
  97. /* Given a certificate try and find an exact match in the store */
  98. static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x)
  99. {
  100. STACK_OF(X509) *certs;
  101. X509 *xtmp = NULL;
  102. int i;
  103. /* Lookup all certs with matching subject name */
  104. certs = ctx->lookup_certs(ctx, X509_get_subject_name(x));
  105. if (certs == NULL)
  106. return NULL;
  107. /* Look for exact match */
  108. for (i = 0; i < sk_X509_num(certs); i++) {
  109. xtmp = sk_X509_value(certs, i);
  110. if (!X509_cmp(xtmp, x))
  111. break;
  112. xtmp = NULL;
  113. }
  114. if (xtmp != NULL && !X509_up_ref(xtmp))
  115. xtmp = NULL;
  116. sk_X509_pop_free(certs, X509_free);
  117. return xtmp;
  118. }
  119. /*-
  120. * Inform the verify callback of an error.
  121. * If B<x> is not NULL it is the error cert, otherwise use the chain cert at
  122. * B<depth>.
  123. * If B<err> is not X509_V_OK, that's the error value, otherwise leave
  124. * unchanged (presumably set by the caller).
  125. *
  126. * Returns 0 to abort verification with an error, non-zero to continue.
  127. */
  128. static int verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err)
  129. {
  130. ctx->error_depth = depth;
  131. ctx->current_cert = (x != NULL) ? x : sk_X509_value(ctx->chain, depth);
  132. if (err != X509_V_OK)
  133. ctx->error = err;
  134. return ctx->verify_cb(0, ctx);
  135. }
  136. /*-
  137. * Inform the verify callback of an error, CRL-specific variant. Here, the
  138. * error depth and certificate are already set, we just specify the error
  139. * number.
  140. *
  141. * Returns 0 to abort verification with an error, non-zero to continue.
  142. */
  143. static int verify_cb_crl(X509_STORE_CTX *ctx, int err)
  144. {
  145. ctx->error = err;
  146. return ctx->verify_cb(0, ctx);
  147. }
  148. static int check_auth_level(X509_STORE_CTX *ctx)
  149. {
  150. int i;
  151. int num = sk_X509_num(ctx->chain);
  152. if (ctx->param->auth_level <= 0)
  153. return 1;
  154. for (i = 0; i < num; ++i) {
  155. X509 *cert = sk_X509_value(ctx->chain, i);
  156. /*
  157. * We've already checked the security of the leaf key, so here we only
  158. * check the security of issuer keys.
  159. */
  160. if (i > 0 && !check_key_level(ctx, cert) &&
  161. verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_KEY_TOO_SMALL) == 0)
  162. return 0;
  163. /*
  164. * We also check the signature algorithm security of all certificates
  165. * except those of the trust anchor at index num-1.
  166. */
  167. if (i < num - 1 && !check_sig_level(ctx, cert) &&
  168. verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_MD_TOO_WEAK) == 0)
  169. return 0;
  170. }
  171. return 1;
  172. }
  173. static int verify_chain(X509_STORE_CTX *ctx)
  174. {
  175. int err;
  176. int ok;
  177. /*
  178. * Before either returning with an error, or continuing with CRL checks,
  179. * instantiate chain public key parameters.
  180. */
  181. if ((ok = build_chain(ctx)) == 0 ||
  182. (ok = check_chain_extensions(ctx)) == 0 ||
  183. (ok = check_auth_level(ctx)) == 0 ||
  184. (ok = check_id(ctx)) == 0 || 1)
  185. X509_get_pubkey_parameters(NULL, ctx->chain);
  186. if (ok == 0 || (ok = ctx->check_revocation(ctx)) == 0)
  187. return ok;
  188. err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain,
  189. ctx->param->flags);
  190. if (err != X509_V_OK) {
  191. if ((ok = verify_cb_cert(ctx, NULL, ctx->error_depth, err)) == 0)
  192. return ok;
  193. }
  194. /* Verify chain signatures and expiration times */
  195. ok = (ctx->verify != NULL) ? ctx->verify(ctx) : internal_verify(ctx);
  196. if (!ok)
  197. return ok;
  198. if ((ok = check_name_constraints(ctx)) == 0)
  199. return ok;
  200. #ifndef OPENSSL_NO_RFC3779
  201. /* RFC 3779 path validation, now that CRL check has been done */
  202. if ((ok = X509v3_asid_validate_path(ctx)) == 0)
  203. return ok;
  204. if ((ok = X509v3_addr_validate_path(ctx)) == 0)
  205. return ok;
  206. #endif
  207. /* If we get this far evaluate policies */
  208. if (ctx->param->flags & X509_V_FLAG_POLICY_CHECK)
  209. ok = ctx->check_policy(ctx);
  210. return ok;
  211. }
  212. int X509_verify_cert(X509_STORE_CTX *ctx)
  213. {
  214. SSL_DANE *dane = ctx->dane;
  215. int ret;
  216. if (ctx->cert == NULL) {
  217. X509err(X509_F_X509_VERIFY_CERT, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
  218. ctx->error = X509_V_ERR_INVALID_CALL;
  219. return -1;
  220. }
  221. if (ctx->chain != NULL) {
  222. /*
  223. * This X509_STORE_CTX has already been used to verify a cert. We
  224. * cannot do another one.
  225. */
  226. X509err(X509_F_X509_VERIFY_CERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  227. ctx->error = X509_V_ERR_INVALID_CALL;
  228. return -1;
  229. }
  230. if (!X509_up_ref(ctx->cert)) {
  231. X509err(X509_F_X509_VERIFY_CERT, ERR_R_INTERNAL_ERROR);
  232. ctx->error = X509_V_ERR_UNSPECIFIED;
  233. return -1;
  234. }
  235. /*
  236. * first we make sure the chain we are going to build is present and that
  237. * the first entry is in place
  238. */
  239. if ((ctx->chain = sk_X509_new_null()) == NULL
  240. || !sk_X509_push(ctx->chain, ctx->cert)) {
  241. X509_free(ctx->cert);
  242. X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
  243. ctx->error = X509_V_ERR_OUT_OF_MEM;
  244. return -1;
  245. }
  246. ctx->num_untrusted = 1;
  247. /* If the peer's public key is too weak, we can stop early. */
  248. if (!check_key_level(ctx, ctx->cert) &&
  249. !verify_cb_cert(ctx, ctx->cert, 0, X509_V_ERR_EE_KEY_TOO_SMALL))
  250. return 0;
  251. if (DANETLS_ENABLED(dane))
  252. ret = dane_verify(ctx);
  253. else
  254. ret = verify_chain(ctx);
  255. /*
  256. * Safety-net. If we are returning an error, we must also set ctx->error,
  257. * so that the chain is not considered verified should the error be ignored
  258. * (e.g. TLS with SSL_VERIFY_NONE).
  259. */
  260. if (ret <= 0 && ctx->error == X509_V_OK)
  261. ctx->error = X509_V_ERR_UNSPECIFIED;
  262. return ret;
  263. }
  264. /*
  265. * Given a STACK_OF(X509) find the issuer of cert (if any)
  266. */
  267. static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x)
  268. {
  269. int i;
  270. X509 *issuer, *rv = NULL;
  271. for (i = 0; i < sk_X509_num(sk); i++) {
  272. issuer = sk_X509_value(sk, i);
  273. if (ctx->check_issued(ctx, x, issuer)) {
  274. rv = issuer;
  275. if (x509_check_cert_time(ctx, rv, -1))
  276. break;
  277. }
  278. }
  279. return rv;
  280. }
  281. /* Given a possible certificate and issuer check them */
  282. static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
  283. {
  284. int ret;
  285. int ss;
  286. if (x == issuer) {
  287. ss = cert_self_signed(ctx, x);
  288. if (ss < 0)
  289. return 0;
  290. return ss;
  291. }
  292. ret = x509_check_issued_int(issuer, x, ctx->libctx, ctx->propq);
  293. if (ret == X509_V_OK) {
  294. int i;
  295. X509 *ch;
  296. ss = cert_self_signed(ctx, x);
  297. if (ss < 0)
  298. return 0;
  299. /* Special case: single self signed certificate */
  300. if (ss > 0 && sk_X509_num(ctx->chain) == 1)
  301. return 1;
  302. for (i = 0; i < sk_X509_num(ctx->chain); i++) {
  303. ch = sk_X509_value(ctx->chain, i);
  304. if (ch == issuer || !X509_cmp(ch, issuer)) {
  305. ret = X509_V_ERR_PATH_LOOP;
  306. break;
  307. }
  308. }
  309. }
  310. return (ret == X509_V_OK);
  311. }
  312. /* Alternative lookup method: look from a STACK stored in other_ctx */
  313. static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
  314. {
  315. *issuer = find_issuer(ctx, ctx->other_ctx, x);
  316. if (*issuer == NULL || !X509_up_ref(*issuer))
  317. goto err;
  318. return 1;
  319. err:
  320. *issuer = NULL;
  321. return 0;
  322. }
  323. static STACK_OF(X509) *lookup_certs_sk(X509_STORE_CTX *ctx,
  324. const X509_NAME *nm)
  325. {
  326. STACK_OF(X509) *sk = NULL;
  327. X509 *x;
  328. int i;
  329. for (i = 0; i < sk_X509_num(ctx->other_ctx); i++) {
  330. x = sk_X509_value(ctx->other_ctx, i);
  331. if (X509_NAME_cmp(nm, X509_get_subject_name(x)) == 0) {
  332. if (!X509_up_ref(x)) {
  333. sk_X509_pop_free(sk, X509_free);
  334. X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_INTERNAL_ERROR);
  335. ctx->error = X509_V_ERR_UNSPECIFIED;
  336. return NULL;
  337. }
  338. if (sk == NULL)
  339. sk = sk_X509_new_null();
  340. if (sk == NULL || !sk_X509_push(sk, x)) {
  341. X509_free(x);
  342. sk_X509_pop_free(sk, X509_free);
  343. X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_MALLOC_FAILURE);
  344. ctx->error = X509_V_ERR_OUT_OF_MEM;
  345. return NULL;
  346. }
  347. }
  348. }
  349. return sk;
  350. }
  351. /*
  352. * Check EE or CA certificate purpose. For trusted certificates explicit local
  353. * auxiliary trust can be used to override EKU-restrictions.
  354. */
  355. static int check_purpose(X509_STORE_CTX *ctx, X509 *x, int purpose, int depth,
  356. int must_be_ca)
  357. {
  358. int tr_ok = X509_TRUST_UNTRUSTED;
  359. /*
  360. * For trusted certificates we want to see whether any auxiliary trust
  361. * settings trump the purpose constraints.
  362. *
  363. * This is complicated by the fact that the trust ordinals in
  364. * ctx->param->trust are entirely independent of the purpose ordinals in
  365. * ctx->param->purpose!
  366. *
  367. * What connects them is their mutual initialization via calls from
  368. * X509_STORE_CTX_set_default() into X509_VERIFY_PARAM_lookup() which sets
  369. * related values of both param->trust and param->purpose. It is however
  370. * typically possible to infer associated trust values from a purpose value
  371. * via the X509_PURPOSE API.
  372. *
  373. * Therefore, we can only check for trust overrides when the purpose we're
  374. * checking is the same as ctx->param->purpose and ctx->param->trust is
  375. * also set.
  376. */
  377. if (depth >= ctx->num_untrusted && purpose == ctx->param->purpose)
  378. tr_ok = X509_check_trust(x, ctx->param->trust, X509_TRUST_NO_SS_COMPAT);
  379. switch (tr_ok) {
  380. case X509_TRUST_TRUSTED:
  381. return 1;
  382. case X509_TRUST_REJECTED:
  383. break;
  384. default:
  385. switch (X509_check_purpose(x, purpose, must_be_ca > 0)) {
  386. case 1:
  387. return 1;
  388. case 0:
  389. break;
  390. default:
  391. if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) == 0)
  392. return 1;
  393. }
  394. break;
  395. }
  396. return verify_cb_cert(ctx, x, depth, X509_V_ERR_INVALID_PURPOSE);
  397. }
  398. /*
  399. * Check a certificate chains extensions for consistency with the supplied
  400. * purpose
  401. */
  402. static int check_chain_extensions(X509_STORE_CTX *ctx)
  403. {
  404. int i, must_be_ca, plen = 0;
  405. X509 *x;
  406. int proxy_path_length = 0;
  407. int purpose;
  408. int allow_proxy_certs;
  409. int num = sk_X509_num(ctx->chain);
  410. /*-
  411. * must_be_ca can have 1 of 3 values:
  412. * -1: we accept both CA and non-CA certificates, to allow direct
  413. * use of self-signed certificates (which are marked as CA).
  414. * 0: we only accept non-CA certificates. This is currently not
  415. * used, but the possibility is present for future extensions.
  416. * 1: we only accept CA certificates. This is currently used for
  417. * all certificates in the chain except the leaf certificate.
  418. */
  419. must_be_ca = -1;
  420. /* CRL path validation */
  421. if (ctx->parent) {
  422. allow_proxy_certs = 0;
  423. purpose = X509_PURPOSE_CRL_SIGN;
  424. } else {
  425. allow_proxy_certs =
  426. ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
  427. purpose = ctx->param->purpose;
  428. }
  429. for (i = 0; i < num; i++) {
  430. int ret;
  431. x = sk_X509_value(ctx->chain, i);
  432. if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
  433. && (x->ex_flags & EXFLAG_CRITICAL)) {
  434. if (!verify_cb_cert(ctx, x, i,
  435. X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION))
  436. return 0;
  437. }
  438. if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
  439. if (!verify_cb_cert(ctx, x, i,
  440. X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED))
  441. return 0;
  442. }
  443. ret = X509_check_ca(x);
  444. switch (must_be_ca) {
  445. case -1:
  446. if ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
  447. && (ret != 1) && (ret != 0)) {
  448. ret = 0;
  449. ctx->error = X509_V_ERR_INVALID_CA;
  450. } else
  451. ret = 1;
  452. break;
  453. case 0:
  454. if (ret != 0) {
  455. ret = 0;
  456. ctx->error = X509_V_ERR_INVALID_NON_CA;
  457. } else
  458. ret = 1;
  459. break;
  460. default:
  461. /* X509_V_FLAG_X509_STRICT is implicit for intermediate CAs */
  462. if ((ret == 0)
  463. || ((i + 1 < num || ctx->param->flags & X509_V_FLAG_X509_STRICT)
  464. && (ret != 1))) {
  465. ret = 0;
  466. ctx->error = X509_V_ERR_INVALID_CA;
  467. } else
  468. ret = 1;
  469. break;
  470. }
  471. if ((x->ex_flags & EXFLAG_CA) == 0
  472. && x->ex_pathlen != -1
  473. && (ctx->param->flags & X509_V_FLAG_X509_STRICT)) {
  474. ctx->error = X509_V_ERR_INVALID_EXTENSION;
  475. ret = 0;
  476. }
  477. if (ret == 0 && !verify_cb_cert(ctx, x, i, X509_V_OK))
  478. return 0;
  479. /* check_purpose() makes the callback as needed */
  480. if (purpose > 0 && !check_purpose(ctx, x, purpose, i, must_be_ca))
  481. return 0;
  482. /* Check pathlen */
  483. if ((i > 1) && (x->ex_pathlen != -1)
  484. && (plen > (x->ex_pathlen + proxy_path_length))) {
  485. if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PATH_LENGTH_EXCEEDED))
  486. return 0;
  487. }
  488. /* Increment path length if not a self issued intermediate CA */
  489. if (i > 0 && (x->ex_flags & EXFLAG_SI) == 0)
  490. plen++;
  491. /*
  492. * If this certificate is a proxy certificate, the next certificate
  493. * must be another proxy certificate or a EE certificate. If not,
  494. * the next certificate must be a CA certificate.
  495. */
  496. if (x->ex_flags & EXFLAG_PROXY) {
  497. /*
  498. * RFC3820, 4.1.3 (b)(1) stipulates that if pCPathLengthConstraint
  499. * is less than max_path_length, the former should be copied to
  500. * the latter, and 4.1.4 (a) stipulates that max_path_length
  501. * should be verified to be larger than zero and decrement it.
  502. *
  503. * Because we're checking the certs in the reverse order, we start
  504. * with verifying that proxy_path_length isn't larger than pcPLC,
  505. * and copy the latter to the former if it is, and finally,
  506. * increment proxy_path_length.
  507. */
  508. if (x->ex_pcpathlen != -1) {
  509. if (proxy_path_length > x->ex_pcpathlen) {
  510. if (!verify_cb_cert(ctx, x, i,
  511. X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED))
  512. return 0;
  513. }
  514. proxy_path_length = x->ex_pcpathlen;
  515. }
  516. proxy_path_length++;
  517. must_be_ca = 0;
  518. } else
  519. must_be_ca = 1;
  520. }
  521. return 1;
  522. }
  523. static int has_san_id(X509 *x, int gtype)
  524. {
  525. int i;
  526. int ret = 0;
  527. GENERAL_NAMES *gs = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
  528. if (gs == NULL)
  529. return 0;
  530. for (i = 0; i < sk_GENERAL_NAME_num(gs); i++) {
  531. GENERAL_NAME *g = sk_GENERAL_NAME_value(gs, i);
  532. if (g->type == gtype) {
  533. ret = 1;
  534. break;
  535. }
  536. }
  537. GENERAL_NAMES_free(gs);
  538. return ret;
  539. }
  540. static int check_name_constraints(X509_STORE_CTX *ctx)
  541. {
  542. int i;
  543. /* Check name constraints for all certificates */
  544. for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) {
  545. X509 *x = sk_X509_value(ctx->chain, i);
  546. int j;
  547. /* Ignore self issued certs unless last in chain */
  548. if (i && (x->ex_flags & EXFLAG_SI))
  549. continue;
  550. /*
  551. * Proxy certificates policy has an extra constraint, where the
  552. * certificate subject MUST be the issuer with a single CN entry
  553. * added.
  554. * (RFC 3820: 3.4, 4.1.3 (a)(4))
  555. */
  556. if (x->ex_flags & EXFLAG_PROXY) {
  557. X509_NAME *tmpsubject = X509_get_subject_name(x);
  558. X509_NAME *tmpissuer = X509_get_issuer_name(x);
  559. X509_NAME_ENTRY *tmpentry = NULL;
  560. int last_object_nid = 0;
  561. int err = X509_V_OK;
  562. int last_object_loc = X509_NAME_entry_count(tmpsubject) - 1;
  563. /* Check that there are at least two RDNs */
  564. if (last_object_loc < 1) {
  565. err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION;
  566. goto proxy_name_done;
  567. }
  568. /*
  569. * Check that there is exactly one more RDN in subject as
  570. * there is in issuer.
  571. */
  572. if (X509_NAME_entry_count(tmpsubject)
  573. != X509_NAME_entry_count(tmpissuer) + 1) {
  574. err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION;
  575. goto proxy_name_done;
  576. }
  577. /*
  578. * Check that the last subject component isn't part of a
  579. * multivalued RDN
  580. */
  581. if (X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject,
  582. last_object_loc))
  583. == X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject,
  584. last_object_loc - 1))) {
  585. err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION;
  586. goto proxy_name_done;
  587. }
  588. /*
  589. * Check that the last subject RDN is a commonName, and that
  590. * all the previous RDNs match the issuer exactly
  591. */
  592. tmpsubject = X509_NAME_dup(tmpsubject);
  593. if (tmpsubject == NULL) {
  594. X509err(X509_F_CHECK_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
  595. ctx->error = X509_V_ERR_OUT_OF_MEM;
  596. return 0;
  597. }
  598. tmpentry =
  599. X509_NAME_delete_entry(tmpsubject, last_object_loc);
  600. last_object_nid =
  601. OBJ_obj2nid(X509_NAME_ENTRY_get_object(tmpentry));
  602. if (last_object_nid != NID_commonName
  603. || X509_NAME_cmp(tmpsubject, tmpissuer) != 0) {
  604. err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION;
  605. }
  606. X509_NAME_ENTRY_free(tmpentry);
  607. X509_NAME_free(tmpsubject);
  608. proxy_name_done:
  609. if (err != X509_V_OK
  610. && !verify_cb_cert(ctx, x, i, err))
  611. return 0;
  612. }
  613. /*
  614. * Check against constraints for all certificates higher in chain
  615. * including trust anchor. Trust anchor not strictly speaking needed
  616. * but if it includes constraints it is to be assumed it expects them
  617. * to be obeyed.
  618. */
  619. for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) {
  620. NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc;
  621. if (nc) {
  622. int rv = NAME_CONSTRAINTS_check(x, nc);
  623. /* If EE certificate check commonName too */
  624. if (rv == X509_V_OK && i == 0
  625. && (ctx->param->hostflags
  626. & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT) == 0
  627. && ((ctx->param->hostflags
  628. & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT) != 0
  629. || !has_san_id(x, GEN_DNS)))
  630. rv = NAME_CONSTRAINTS_check_CN(x, nc);
  631. switch (rv) {
  632. case X509_V_OK:
  633. break;
  634. case X509_V_ERR_OUT_OF_MEM:
  635. return 0;
  636. default:
  637. if (!verify_cb_cert(ctx, x, i, rv))
  638. return 0;
  639. break;
  640. }
  641. }
  642. }
  643. }
  644. return 1;
  645. }
  646. static int check_id_error(X509_STORE_CTX *ctx, int errcode)
  647. {
  648. return verify_cb_cert(ctx, ctx->cert, 0, errcode);
  649. }
  650. static int check_hosts(X509 *x, X509_VERIFY_PARAM *vpm)
  651. {
  652. int i;
  653. int n = sk_OPENSSL_STRING_num(vpm->hosts);
  654. char *name;
  655. if (vpm->peername != NULL) {
  656. OPENSSL_free(vpm->peername);
  657. vpm->peername = NULL;
  658. }
  659. for (i = 0; i < n; ++i) {
  660. name = sk_OPENSSL_STRING_value(vpm->hosts, i);
  661. if (X509_check_host(x, name, 0, vpm->hostflags, &vpm->peername) > 0)
  662. return 1;
  663. }
  664. return n == 0;
  665. }
  666. static int check_id(X509_STORE_CTX *ctx)
  667. {
  668. X509_VERIFY_PARAM *vpm = ctx->param;
  669. X509 *x = ctx->cert;
  670. if (vpm->hosts && check_hosts(x, vpm) <= 0) {
  671. if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))
  672. return 0;
  673. }
  674. if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) {
  675. if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))
  676. return 0;
  677. }
  678. if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) {
  679. if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
  680. return 0;
  681. }
  682. return 1;
  683. }
  684. static int check_trust(X509_STORE_CTX *ctx, int num_untrusted)
  685. {
  686. int i;
  687. X509 *x = NULL;
  688. X509 *mx;
  689. SSL_DANE *dane = ctx->dane;
  690. int num = sk_X509_num(ctx->chain);
  691. int trust;
  692. /*
  693. * Check for a DANE issuer at depth 1 or greater, if it is a DANE-TA(2)
  694. * match, we're done, otherwise we'll merely record the match depth.
  695. */
  696. if (DANETLS_HAS_TA(dane) && num_untrusted > 0 && num_untrusted < num) {
  697. switch (trust = check_dane_issuer(ctx, num_untrusted)) {
  698. case X509_TRUST_TRUSTED:
  699. case X509_TRUST_REJECTED:
  700. return trust;
  701. }
  702. }
  703. /*
  704. * Check trusted certificates in chain at depth num_untrusted and up.
  705. * Note, that depths 0..num_untrusted-1 may also contain trusted
  706. * certificates, but the caller is expected to have already checked those,
  707. * and wants to incrementally check just any added since.
  708. */
  709. for (i = num_untrusted; i < num; i++) {
  710. x = sk_X509_value(ctx->chain, i);
  711. trust = X509_check_trust(x, ctx->param->trust, 0);
  712. /* If explicitly trusted return trusted */
  713. if (trust == X509_TRUST_TRUSTED)
  714. goto trusted;
  715. if (trust == X509_TRUST_REJECTED)
  716. goto rejected;
  717. }
  718. /*
  719. * If we are looking at a trusted certificate, and accept partial chains,
  720. * the chain is PKIX trusted.
  721. */
  722. if (num_untrusted < num) {
  723. if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN)
  724. goto trusted;
  725. return X509_TRUST_UNTRUSTED;
  726. }
  727. if (num_untrusted == num && ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) {
  728. /*
  729. * Last-resort call with no new trusted certificates, check the leaf
  730. * for a direct trust store match.
  731. */
  732. i = 0;
  733. x = sk_X509_value(ctx->chain, i);
  734. mx = lookup_cert_match(ctx, x);
  735. if (!mx)
  736. return X509_TRUST_UNTRUSTED;
  737. /*
  738. * Check explicit auxiliary trust/reject settings. If none are set,
  739. * we'll accept X509_TRUST_UNTRUSTED when not self-signed.
  740. */
  741. trust = X509_check_trust(mx, ctx->param->trust, 0);
  742. if (trust == X509_TRUST_REJECTED) {
  743. X509_free(mx);
  744. goto rejected;
  745. }
  746. /* Replace leaf with trusted match */
  747. (void) sk_X509_set(ctx->chain, 0, mx);
  748. X509_free(x);
  749. ctx->num_untrusted = 0;
  750. goto trusted;
  751. }
  752. /*
  753. * If no trusted certs in chain at all return untrusted and allow
  754. * standard (no issuer cert) etc errors to be indicated.
  755. */
  756. return X509_TRUST_UNTRUSTED;
  757. rejected:
  758. if (!verify_cb_cert(ctx, x, i, X509_V_ERR_CERT_REJECTED))
  759. return X509_TRUST_REJECTED;
  760. return X509_TRUST_UNTRUSTED;
  761. trusted:
  762. if (!DANETLS_ENABLED(dane))
  763. return X509_TRUST_TRUSTED;
  764. if (dane->pdpth < 0)
  765. dane->pdpth = num_untrusted;
  766. /* With DANE, PKIX alone is not trusted until we have both */
  767. if (dane->mdpth >= 0)
  768. return X509_TRUST_TRUSTED;
  769. return X509_TRUST_UNTRUSTED;
  770. }
  771. static int check_revocation(X509_STORE_CTX *ctx)
  772. {
  773. int i = 0, last = 0, ok = 0;
  774. if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK))
  775. return 1;
  776. if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
  777. last = sk_X509_num(ctx->chain) - 1;
  778. else {
  779. /* If checking CRL paths this isn't the EE certificate */
  780. if (ctx->parent)
  781. return 1;
  782. last = 0;
  783. }
  784. for (i = 0; i <= last; i++) {
  785. ctx->error_depth = i;
  786. ok = check_cert(ctx);
  787. if (!ok)
  788. return ok;
  789. }
  790. return 1;
  791. }
  792. static int check_cert(X509_STORE_CTX *ctx)
  793. {
  794. X509_CRL *crl = NULL, *dcrl = NULL;
  795. int ok = 0;
  796. int cnum = ctx->error_depth;
  797. X509 *x = sk_X509_value(ctx->chain, cnum);
  798. ctx->current_cert = x;
  799. ctx->current_issuer = NULL;
  800. ctx->current_crl_score = 0;
  801. ctx->current_reasons = 0;
  802. if (x->ex_flags & EXFLAG_PROXY)
  803. return 1;
  804. while (ctx->current_reasons != CRLDP_ALL_REASONS) {
  805. unsigned int last_reasons = ctx->current_reasons;
  806. /* Try to retrieve relevant CRL */
  807. if (ctx->get_crl)
  808. ok = ctx->get_crl(ctx, &crl, x);
  809. else
  810. ok = get_crl_delta(ctx, &crl, &dcrl, x);
  811. /*
  812. * If error looking up CRL, nothing we can do except notify callback
  813. */
  814. if (!ok) {
  815. ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL);
  816. goto done;
  817. }
  818. ctx->current_crl = crl;
  819. ok = ctx->check_crl(ctx, crl);
  820. if (!ok)
  821. goto done;
  822. if (dcrl) {
  823. ok = ctx->check_crl(ctx, dcrl);
  824. if (!ok)
  825. goto done;
  826. ok = ctx->cert_crl(ctx, dcrl, x);
  827. if (!ok)
  828. goto done;
  829. } else
  830. ok = 1;
  831. /* Don't look in full CRL if delta reason is removefromCRL */
  832. if (ok != 2) {
  833. ok = ctx->cert_crl(ctx, crl, x);
  834. if (!ok)
  835. goto done;
  836. }
  837. X509_CRL_free(crl);
  838. X509_CRL_free(dcrl);
  839. crl = NULL;
  840. dcrl = NULL;
  841. /*
  842. * If reasons not updated we won't get anywhere by another iteration,
  843. * so exit loop.
  844. */
  845. if (last_reasons == ctx->current_reasons) {
  846. ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL);
  847. goto done;
  848. }
  849. }
  850. done:
  851. X509_CRL_free(crl);
  852. X509_CRL_free(dcrl);
  853. ctx->current_crl = NULL;
  854. return ok;
  855. }
  856. /* Check CRL times against values in X509_STORE_CTX */
  857. static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
  858. {
  859. time_t *ptime;
  860. int i;
  861. if (notify)
  862. ctx->current_crl = crl;
  863. if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
  864. ptime = &ctx->param->check_time;
  865. else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)
  866. return 1;
  867. else
  868. ptime = NULL;
  869. i = X509_cmp_time(X509_CRL_get0_lastUpdate(crl), ptime);
  870. if (i == 0) {
  871. if (!notify)
  872. return 0;
  873. if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD))
  874. return 0;
  875. }
  876. if (i > 0) {
  877. if (!notify)
  878. return 0;
  879. if (!verify_cb_crl(ctx, X509_V_ERR_CRL_NOT_YET_VALID))
  880. return 0;
  881. }
  882. if (X509_CRL_get0_nextUpdate(crl)) {
  883. i = X509_cmp_time(X509_CRL_get0_nextUpdate(crl), ptime);
  884. if (i == 0) {
  885. if (!notify)
  886. return 0;
  887. if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD))
  888. return 0;
  889. }
  890. /* Ignore expiry of base CRL is delta is valid */
  891. if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) {
  892. if (!notify)
  893. return 0;
  894. if (!verify_cb_crl(ctx, X509_V_ERR_CRL_HAS_EXPIRED))
  895. return 0;
  896. }
  897. }
  898. if (notify)
  899. ctx->current_crl = NULL;
  900. return 1;
  901. }
  902. static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
  903. X509 **pissuer, int *pscore, unsigned int *preasons,
  904. STACK_OF(X509_CRL) *crls)
  905. {
  906. int i, crl_score, best_score = *pscore;
  907. unsigned int reasons, best_reasons = 0;
  908. X509 *x = ctx->current_cert;
  909. X509_CRL *crl, *best_crl = NULL;
  910. X509 *crl_issuer = NULL, *best_crl_issuer = NULL;
  911. for (i = 0; i < sk_X509_CRL_num(crls); i++) {
  912. crl = sk_X509_CRL_value(crls, i);
  913. reasons = *preasons;
  914. crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
  915. if (crl_score < best_score || crl_score == 0)
  916. continue;
  917. /* If current CRL is equivalent use it if it is newer */
  918. if (crl_score == best_score && best_crl != NULL) {
  919. int day, sec;
  920. if (ASN1_TIME_diff(&day, &sec, X509_CRL_get0_lastUpdate(best_crl),
  921. X509_CRL_get0_lastUpdate(crl)) == 0)
  922. continue;
  923. /*
  924. * ASN1_TIME_diff never returns inconsistent signs for |day|
  925. * and |sec|.
  926. */
  927. if (day <= 0 && sec <= 0)
  928. continue;
  929. }
  930. best_crl = crl;
  931. best_crl_issuer = crl_issuer;
  932. best_score = crl_score;
  933. best_reasons = reasons;
  934. }
  935. if (best_crl) {
  936. X509_CRL_free(*pcrl);
  937. *pcrl = best_crl;
  938. *pissuer = best_crl_issuer;
  939. *pscore = best_score;
  940. *preasons = best_reasons;
  941. X509_CRL_up_ref(best_crl);
  942. X509_CRL_free(*pdcrl);
  943. *pdcrl = NULL;
  944. get_delta_sk(ctx, pdcrl, pscore, best_crl, crls);
  945. }
  946. if (best_score >= CRL_SCORE_VALID)
  947. return 1;
  948. return 0;
  949. }
  950. /*
  951. * Compare two CRL extensions for delta checking purposes. They should be
  952. * both present or both absent. If both present all fields must be identical.
  953. */
  954. static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid)
  955. {
  956. ASN1_OCTET_STRING *exta, *extb;
  957. int i;
  958. i = X509_CRL_get_ext_by_NID(a, nid, -1);
  959. if (i >= 0) {
  960. /* Can't have multiple occurrences */
  961. if (X509_CRL_get_ext_by_NID(a, nid, i) != -1)
  962. return 0;
  963. exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i));
  964. } else
  965. exta = NULL;
  966. i = X509_CRL_get_ext_by_NID(b, nid, -1);
  967. if (i >= 0) {
  968. if (X509_CRL_get_ext_by_NID(b, nid, i) != -1)
  969. return 0;
  970. extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i));
  971. } else
  972. extb = NULL;
  973. if (!exta && !extb)
  974. return 1;
  975. if (!exta || !extb)
  976. return 0;
  977. if (ASN1_OCTET_STRING_cmp(exta, extb))
  978. return 0;
  979. return 1;
  980. }
  981. /* See if a base and delta are compatible */
  982. static int check_delta_base(X509_CRL *delta, X509_CRL *base)
  983. {
  984. /* Delta CRL must be a delta */
  985. if (!delta->base_crl_number)
  986. return 0;
  987. /* Base must have a CRL number */
  988. if (!base->crl_number)
  989. return 0;
  990. /* Issuer names must match */
  991. if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(delta)))
  992. return 0;
  993. /* AKID and IDP must match */
  994. if (!crl_extension_match(delta, base, NID_authority_key_identifier))
  995. return 0;
  996. if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
  997. return 0;
  998. /* Delta CRL base number must not exceed Full CRL number. */
  999. if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
  1000. return 0;
  1001. /* Delta CRL number must exceed full CRL number */
  1002. if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0)
  1003. return 1;
  1004. return 0;
  1005. }
  1006. /*
  1007. * For a given base CRL find a delta... maybe extend to delta scoring or
  1008. * retrieve a chain of deltas...
  1009. */
  1010. static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore,
  1011. X509_CRL *base, STACK_OF(X509_CRL) *crls)
  1012. {
  1013. X509_CRL *delta;
  1014. int i;
  1015. if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS))
  1016. return;
  1017. if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST))
  1018. return;
  1019. for (i = 0; i < sk_X509_CRL_num(crls); i++) {
  1020. delta = sk_X509_CRL_value(crls, i);
  1021. if (check_delta_base(delta, base)) {
  1022. if (check_crl_time(ctx, delta, 0))
  1023. *pscore |= CRL_SCORE_TIME_DELTA;
  1024. X509_CRL_up_ref(delta);
  1025. *dcrl = delta;
  1026. return;
  1027. }
  1028. }
  1029. *dcrl = NULL;
  1030. }
  1031. /*
  1032. * For a given CRL return how suitable it is for the supplied certificate
  1033. * 'x'. The return value is a mask of several criteria. If the issuer is not
  1034. * the certificate issuer this is returned in *pissuer. The reasons mask is
  1035. * also used to determine if the CRL is suitable: if no new reasons the CRL
  1036. * is rejected, otherwise reasons is updated.
  1037. */
  1038. static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
  1039. unsigned int *preasons, X509_CRL *crl, X509 *x)
  1040. {
  1041. int crl_score = 0;
  1042. unsigned int tmp_reasons = *preasons, crl_reasons;
  1043. /* First see if we can reject CRL straight away */
  1044. /* Invalid IDP cannot be processed */
  1045. if (crl->idp_flags & IDP_INVALID)
  1046. return 0;
  1047. /* Reason codes or indirect CRLs need extended CRL support */
  1048. if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) {
  1049. if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
  1050. return 0;
  1051. } else if (crl->idp_flags & IDP_REASONS) {
  1052. /* If no new reasons reject */
  1053. if (!(crl->idp_reasons & ~tmp_reasons))
  1054. return 0;
  1055. }
  1056. /* Don't process deltas at this stage */
  1057. else if (crl->base_crl_number)
  1058. return 0;
  1059. /* If issuer name doesn't match certificate need indirect CRL */
  1060. if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) {
  1061. if (!(crl->idp_flags & IDP_INDIRECT))
  1062. return 0;
  1063. } else
  1064. crl_score |= CRL_SCORE_ISSUER_NAME;
  1065. if (!(crl->flags & EXFLAG_CRITICAL))
  1066. crl_score |= CRL_SCORE_NOCRITICAL;
  1067. /* Check expiry */
  1068. if (check_crl_time(ctx, crl, 0))
  1069. crl_score |= CRL_SCORE_TIME;
  1070. /* Check authority key ID and locate certificate issuer */
  1071. crl_akid_check(ctx, crl, pissuer, &crl_score);
  1072. /* If we can't locate certificate issuer at this point forget it */
  1073. if (!(crl_score & CRL_SCORE_AKID))
  1074. return 0;
  1075. /* Check cert for matching CRL distribution points */
  1076. if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) {
  1077. /* If no new reasons reject */
  1078. if (!(crl_reasons & ~tmp_reasons))
  1079. return 0;
  1080. tmp_reasons |= crl_reasons;
  1081. crl_score |= CRL_SCORE_SCOPE;
  1082. }
  1083. *preasons = tmp_reasons;
  1084. return crl_score;
  1085. }
  1086. static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl,
  1087. X509 **pissuer, int *pcrl_score)
  1088. {
  1089. X509 *crl_issuer = NULL;
  1090. const X509_NAME *cnm = X509_CRL_get_issuer(crl);
  1091. int cidx = ctx->error_depth;
  1092. int i;
  1093. if (cidx != sk_X509_num(ctx->chain) - 1)
  1094. cidx++;
  1095. crl_issuer = sk_X509_value(ctx->chain, cidx);
  1096. if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
  1097. if (*pcrl_score & CRL_SCORE_ISSUER_NAME) {
  1098. *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_ISSUER_CERT;
  1099. *pissuer = crl_issuer;
  1100. return;
  1101. }
  1102. }
  1103. for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) {
  1104. crl_issuer = sk_X509_value(ctx->chain, cidx);
  1105. if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
  1106. continue;
  1107. if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
  1108. *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_SAME_PATH;
  1109. *pissuer = crl_issuer;
  1110. return;
  1111. }
  1112. }
  1113. /* Anything else needs extended CRL support */
  1114. if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
  1115. return;
  1116. /*
  1117. * Otherwise the CRL issuer is not on the path. Look for it in the set of
  1118. * untrusted certificates.
  1119. */
  1120. for (i = 0; i < sk_X509_num(ctx->untrusted); i++) {
  1121. crl_issuer = sk_X509_value(ctx->untrusted, i);
  1122. if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
  1123. continue;
  1124. if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
  1125. *pissuer = crl_issuer;
  1126. *pcrl_score |= CRL_SCORE_AKID;
  1127. return;
  1128. }
  1129. }
  1130. }
  1131. /*
  1132. * Check the path of a CRL issuer certificate. This creates a new
  1133. * X509_STORE_CTX and populates it with most of the parameters from the
  1134. * parent. This could be optimised somewhat since a lot of path checking will
  1135. * be duplicated by the parent, but this will rarely be used in practice.
  1136. */
  1137. static int check_crl_path(X509_STORE_CTX *ctx, X509 *x)
  1138. {
  1139. X509_STORE_CTX crl_ctx;
  1140. int ret;
  1141. /* Don't allow recursive CRL path validation */
  1142. if (ctx->parent)
  1143. return 0;
  1144. if (!X509_STORE_CTX_init(&crl_ctx, ctx->store, x, ctx->untrusted))
  1145. return -1;
  1146. crl_ctx.crls = ctx->crls;
  1147. /* Copy verify params across */
  1148. X509_STORE_CTX_set0_param(&crl_ctx, ctx->param);
  1149. crl_ctx.parent = ctx;
  1150. crl_ctx.verify_cb = ctx->verify_cb;
  1151. /* Verify CRL issuer */
  1152. ret = X509_verify_cert(&crl_ctx);
  1153. if (ret <= 0)
  1154. goto err;
  1155. /* Check chain is acceptable */
  1156. ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain);
  1157. err:
  1158. X509_STORE_CTX_cleanup(&crl_ctx);
  1159. return ret;
  1160. }
  1161. /*
  1162. * RFC3280 says nothing about the relationship between CRL path and
  1163. * certificate path, which could lead to situations where a certificate could
  1164. * be revoked or validated by a CA not authorised to do so. RFC5280 is more
  1165. * strict and states that the two paths must end in the same trust anchor,
  1166. * though some discussions remain... until this is resolved we use the
  1167. * RFC5280 version
  1168. */
  1169. static int check_crl_chain(X509_STORE_CTX *ctx,
  1170. STACK_OF(X509) *cert_path,
  1171. STACK_OF(X509) *crl_path)
  1172. {
  1173. X509 *cert_ta, *crl_ta;
  1174. cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1);
  1175. crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1);
  1176. if (!X509_cmp(cert_ta, crl_ta))
  1177. return 1;
  1178. return 0;
  1179. }
  1180. /*-
  1181. * Check for match between two dist point names: three separate cases.
  1182. * 1. Both are relative names and compare X509_NAME types.
  1183. * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES.
  1184. * 3. Both are full names and compare two GENERAL_NAMES.
  1185. * 4. One is NULL: automatic match.
  1186. */
  1187. static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b)
  1188. {
  1189. X509_NAME *nm = NULL;
  1190. GENERAL_NAMES *gens = NULL;
  1191. GENERAL_NAME *gena, *genb;
  1192. int i, j;
  1193. if (!a || !b)
  1194. return 1;
  1195. if (a->type == 1) {
  1196. if (!a->dpname)
  1197. return 0;
  1198. /* Case 1: two X509_NAME */
  1199. if (b->type == 1) {
  1200. if (!b->dpname)
  1201. return 0;
  1202. if (!X509_NAME_cmp(a->dpname, b->dpname))
  1203. return 1;
  1204. else
  1205. return 0;
  1206. }
  1207. /* Case 2: set name and GENERAL_NAMES appropriately */
  1208. nm = a->dpname;
  1209. gens = b->name.fullname;
  1210. } else if (b->type == 1) {
  1211. if (!b->dpname)
  1212. return 0;
  1213. /* Case 2: set name and GENERAL_NAMES appropriately */
  1214. gens = a->name.fullname;
  1215. nm = b->dpname;
  1216. }
  1217. /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */
  1218. if (nm) {
  1219. for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
  1220. gena = sk_GENERAL_NAME_value(gens, i);
  1221. if (gena->type != GEN_DIRNAME)
  1222. continue;
  1223. if (!X509_NAME_cmp(nm, gena->d.directoryName))
  1224. return 1;
  1225. }
  1226. return 0;
  1227. }
  1228. /* Else case 3: two GENERAL_NAMES */
  1229. for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) {
  1230. gena = sk_GENERAL_NAME_value(a->name.fullname, i);
  1231. for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) {
  1232. genb = sk_GENERAL_NAME_value(b->name.fullname, j);
  1233. if (!GENERAL_NAME_cmp(gena, genb))
  1234. return 1;
  1235. }
  1236. }
  1237. return 0;
  1238. }
  1239. static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score)
  1240. {
  1241. int i;
  1242. const X509_NAME *nm = X509_CRL_get_issuer(crl);
  1243. /* If no CRLissuer return is successful iff don't need a match */
  1244. if (!dp->CRLissuer)
  1245. return ! !(crl_score & CRL_SCORE_ISSUER_NAME);
  1246. for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) {
  1247. GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i);
  1248. if (gen->type != GEN_DIRNAME)
  1249. continue;
  1250. if (!X509_NAME_cmp(gen->d.directoryName, nm))
  1251. return 1;
  1252. }
  1253. return 0;
  1254. }
  1255. /* Check CRLDP and IDP */
  1256. static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
  1257. unsigned int *preasons)
  1258. {
  1259. int i;
  1260. if (crl->idp_flags & IDP_ONLYATTR)
  1261. return 0;
  1262. if (x->ex_flags & EXFLAG_CA) {
  1263. if (crl->idp_flags & IDP_ONLYUSER)
  1264. return 0;
  1265. } else {
  1266. if (crl->idp_flags & IDP_ONLYCA)
  1267. return 0;
  1268. }
  1269. *preasons = crl->idp_reasons;
  1270. for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) {
  1271. DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i);
  1272. if (crldp_check_crlissuer(dp, crl, crl_score)) {
  1273. if (!crl->idp || idp_check_dp(dp->distpoint, crl->idp->distpoint)) {
  1274. *preasons &= dp->dp_reasons;
  1275. return 1;
  1276. }
  1277. }
  1278. }
  1279. if ((!crl->idp || !crl->idp->distpoint)
  1280. && (crl_score & CRL_SCORE_ISSUER_NAME))
  1281. return 1;
  1282. return 0;
  1283. }
  1284. /*
  1285. * Retrieve CRL corresponding to current certificate. If deltas enabled try
  1286. * to find a delta CRL too
  1287. */
  1288. static int get_crl_delta(X509_STORE_CTX *ctx,
  1289. X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
  1290. {
  1291. int ok;
  1292. X509 *issuer = NULL;
  1293. int crl_score = 0;
  1294. unsigned int reasons;
  1295. X509_CRL *crl = NULL, *dcrl = NULL;
  1296. STACK_OF(X509_CRL) *skcrl;
  1297. const X509_NAME *nm = X509_get_issuer_name(x);
  1298. reasons = ctx->current_reasons;
  1299. ok = get_crl_sk(ctx, &crl, &dcrl,
  1300. &issuer, &crl_score, &reasons, ctx->crls);
  1301. if (ok)
  1302. goto done;
  1303. /* Lookup CRLs from store */
  1304. skcrl = ctx->lookup_crls(ctx, nm);
  1305. /* If no CRLs found and a near match from get_crl_sk use that */
  1306. if (!skcrl && crl)
  1307. goto done;
  1308. get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);
  1309. sk_X509_CRL_pop_free(skcrl, X509_CRL_free);
  1310. done:
  1311. /* If we got any kind of CRL use it and return success */
  1312. if (crl) {
  1313. ctx->current_issuer = issuer;
  1314. ctx->current_crl_score = crl_score;
  1315. ctx->current_reasons = reasons;
  1316. *pcrl = crl;
  1317. *pdcrl = dcrl;
  1318. return 1;
  1319. }
  1320. return 0;
  1321. }
  1322. /* Check CRL validity */
  1323. static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
  1324. {
  1325. X509 *issuer = NULL;
  1326. EVP_PKEY *ikey = NULL;
  1327. int cnum = ctx->error_depth;
  1328. int chnum = sk_X509_num(ctx->chain) - 1;
  1329. /* if we have an alternative CRL issuer cert use that */
  1330. if (ctx->current_issuer)
  1331. issuer = ctx->current_issuer;
  1332. /*
  1333. * Else find CRL issuer: if not last certificate then issuer is next
  1334. * certificate in chain.
  1335. */
  1336. else if (cnum < chnum)
  1337. issuer = sk_X509_value(ctx->chain, cnum + 1);
  1338. else {
  1339. issuer = sk_X509_value(ctx->chain, chnum);
  1340. /* If not self signed, can't check signature */
  1341. if (!ctx->check_issued(ctx, issuer, issuer) &&
  1342. !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER))
  1343. return 0;
  1344. }
  1345. if (issuer == NULL)
  1346. return 1;
  1347. /*
  1348. * Skip most tests for deltas because they have already been done
  1349. */
  1350. if (!crl->base_crl_number) {
  1351. /* Check for cRLSign bit if keyUsage present */
  1352. if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
  1353. !(issuer->ex_kusage & KU_CRL_SIGN) &&
  1354. !verify_cb_crl(ctx, X509_V_ERR_KEYUSAGE_NO_CRL_SIGN))
  1355. return 0;
  1356. if (!(ctx->current_crl_score & CRL_SCORE_SCOPE) &&
  1357. !verify_cb_crl(ctx, X509_V_ERR_DIFFERENT_CRL_SCOPE))
  1358. return 0;
  1359. if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH) &&
  1360. check_crl_path(ctx, ctx->current_issuer) <= 0 &&
  1361. !verify_cb_crl(ctx, X509_V_ERR_CRL_PATH_VALIDATION_ERROR))
  1362. return 0;
  1363. if ((crl->idp_flags & IDP_INVALID) &&
  1364. !verify_cb_crl(ctx, X509_V_ERR_INVALID_EXTENSION))
  1365. return 0;
  1366. }
  1367. if (!(ctx->current_crl_score & CRL_SCORE_TIME) &&
  1368. !check_crl_time(ctx, crl, 1))
  1369. return 0;
  1370. /* Attempt to get issuer certificate public key */
  1371. ikey = X509_get0_pubkey(issuer);
  1372. if (!ikey &&
  1373. !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY))
  1374. return 0;
  1375. if (ikey) {
  1376. int rv = X509_CRL_check_suiteb(crl, ikey, ctx->param->flags);
  1377. if (rv != X509_V_OK && !verify_cb_crl(ctx, rv))
  1378. return 0;
  1379. /* Verify CRL signature */
  1380. if (X509_CRL_verify(crl, ikey) <= 0 &&
  1381. !verify_cb_crl(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE))
  1382. return 0;
  1383. }
  1384. return 1;
  1385. }
  1386. /* Check certificate against CRL */
  1387. static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
  1388. {
  1389. X509_REVOKED *rev;
  1390. /*
  1391. * The rules changed for this... previously if a CRL contained unhandled
  1392. * critical extensions it could still be used to indicate a certificate
  1393. * was revoked. This has since been changed since critical extensions can
  1394. * change the meaning of CRL entries.
  1395. */
  1396. if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
  1397. && (crl->flags & EXFLAG_CRITICAL) &&
  1398. !verify_cb_crl(ctx, X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION))
  1399. return 0;
  1400. /*
  1401. * Look for serial number of certificate in CRL. If found, make sure
  1402. * reason is not removeFromCRL.
  1403. */
  1404. if (X509_CRL_get0_by_cert(crl, &rev, x)) {
  1405. if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
  1406. return 2;
  1407. if (!verify_cb_crl(ctx, X509_V_ERR_CERT_REVOKED))
  1408. return 0;
  1409. }
  1410. return 1;
  1411. }
  1412. static int check_policy(X509_STORE_CTX *ctx)
  1413. {
  1414. int ret;
  1415. if (ctx->parent)
  1416. return 1;
  1417. /*
  1418. * With DANE, the trust anchor might be a bare public key, not a
  1419. * certificate! In that case our chain does not have the trust anchor
  1420. * certificate as a top-most element. This comports well with RFC5280
  1421. * chain verification, since there too, the trust anchor is not part of the
  1422. * chain to be verified. In particular, X509_policy_check() does not look
  1423. * at the TA cert, but assumes that it is present as the top-most chain
  1424. * element. We therefore temporarily push a NULL cert onto the chain if it
  1425. * was verified via a bare public key, and pop it off right after the
  1426. * X509_policy_check() call.
  1427. */
  1428. if (ctx->bare_ta_signed && !sk_X509_push(ctx->chain, NULL)) {
  1429. X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
  1430. ctx->error = X509_V_ERR_OUT_OF_MEM;
  1431. return 0;
  1432. }
  1433. ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
  1434. ctx->param->policies, ctx->param->flags);
  1435. if (ctx->bare_ta_signed)
  1436. sk_X509_pop(ctx->chain);
  1437. if (ret == X509_PCY_TREE_INTERNAL) {
  1438. X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
  1439. ctx->error = X509_V_ERR_OUT_OF_MEM;
  1440. return 0;
  1441. }
  1442. /* Invalid or inconsistent extensions */
  1443. if (ret == X509_PCY_TREE_INVALID) {
  1444. int i;
  1445. /* Locate certificates with bad extensions and notify callback. */
  1446. for (i = 1; i < sk_X509_num(ctx->chain); i++) {
  1447. X509 *x = sk_X509_value(ctx->chain, i);
  1448. if (!(x->ex_flags & EXFLAG_INVALID_POLICY))
  1449. continue;
  1450. if (!verify_cb_cert(ctx, x, i,
  1451. X509_V_ERR_INVALID_POLICY_EXTENSION))
  1452. return 0;
  1453. }
  1454. return 1;
  1455. }
  1456. if (ret == X509_PCY_TREE_FAILURE) {
  1457. ctx->current_cert = NULL;
  1458. ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY;
  1459. return ctx->verify_cb(0, ctx);
  1460. }
  1461. if (ret != X509_PCY_TREE_VALID) {
  1462. X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR);
  1463. return 0;
  1464. }
  1465. if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) {
  1466. ctx->current_cert = NULL;
  1467. /*
  1468. * Verification errors need to be "sticky", a callback may have allowed
  1469. * an SSL handshake to continue despite an error, and we must then
  1470. * remain in an error state. Therefore, we MUST NOT clear earlier
  1471. * verification errors by setting the error to X509_V_OK.
  1472. */
  1473. if (!ctx->verify_cb(2, ctx))
  1474. return 0;
  1475. }
  1476. return 1;
  1477. }
  1478. /*-
  1479. * Check certificate validity times.
  1480. * If depth >= 0, invoke verification callbacks on error, otherwise just return
  1481. * the validation status.
  1482. *
  1483. * Return 1 on success, 0 otherwise.
  1484. */
  1485. int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth)
  1486. {
  1487. time_t *ptime;
  1488. int i;
  1489. if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
  1490. ptime = &ctx->param->check_time;
  1491. else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)
  1492. return 1;
  1493. else
  1494. ptime = NULL;
  1495. i = X509_cmp_time(X509_get0_notBefore(x), ptime);
  1496. if (i >= 0 && depth < 0)
  1497. return 0;
  1498. if (i == 0 && !verify_cb_cert(ctx, x, depth,
  1499. X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD))
  1500. return 0;
  1501. if (i > 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_NOT_YET_VALID))
  1502. return 0;
  1503. i = X509_cmp_time(X509_get0_notAfter(x), ptime);
  1504. if (i <= 0 && depth < 0)
  1505. return 0;
  1506. if (i == 0 && !verify_cb_cert(ctx, x, depth,
  1507. X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD))
  1508. return 0;
  1509. if (i < 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_HAS_EXPIRED))
  1510. return 0;
  1511. return 1;
  1512. }
  1513. static int internal_verify(X509_STORE_CTX *ctx)
  1514. {
  1515. int n = sk_X509_num(ctx->chain) - 1;
  1516. X509 *xi = sk_X509_value(ctx->chain, n);
  1517. X509 *xs;
  1518. /*
  1519. * With DANE-verified bare public key TA signatures, it remains only to
  1520. * check the timestamps of the top certificate. We report the issuer as
  1521. * NULL, since all we have is a bare key.
  1522. */
  1523. if (ctx->bare_ta_signed) {
  1524. xs = xi;
  1525. xi = NULL;
  1526. goto check_cert;
  1527. }
  1528. if (ctx->check_issued(ctx, xi, xi))
  1529. xs = xi;
  1530. else {
  1531. if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) {
  1532. xs = xi;
  1533. goto check_cert;
  1534. }
  1535. if (n <= 0)
  1536. return verify_cb_cert(ctx, xi, 0,
  1537. X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
  1538. n--;
  1539. ctx->error_depth = n;
  1540. xs = sk_X509_value(ctx->chain, n);
  1541. }
  1542. /*
  1543. * Do not clear ctx->error=0, it must be "sticky", only the user's callback
  1544. * is allowed to reset errors (at its own peril).
  1545. */
  1546. while (n >= 0) {
  1547. EVP_PKEY *pkey;
  1548. /*
  1549. * Skip signature check for self signed certificates unless explicitly
  1550. * asked for. It doesn't add any security and just wastes time. If
  1551. * the issuer's public key is unusable, report the issuer certificate
  1552. * and its depth (rather than the depth of the subject).
  1553. */
  1554. if (xs != xi || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)) {
  1555. if ((pkey = X509_get0_pubkey(xi)) == NULL) {
  1556. if (!verify_cb_cert(ctx, xi, xi != xs ? n+1 : n,
  1557. X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY))
  1558. return 0;
  1559. } else if (X509_verify_ex(xs, pkey, ctx->libctx, ctx->propq) <= 0) {
  1560. if (!verify_cb_cert(ctx, xs, n,
  1561. X509_V_ERR_CERT_SIGNATURE_FAILURE))
  1562. return 0;
  1563. }
  1564. }
  1565. check_cert:
  1566. /* Calls verify callback as needed */
  1567. if (!x509_check_cert_time(ctx, xs, n))
  1568. return 0;
  1569. /*
  1570. * Signal success at this depth. However, the previous error (if any)
  1571. * is retained.
  1572. */
  1573. ctx->current_issuer = xi;
  1574. ctx->current_cert = xs;
  1575. ctx->error_depth = n;
  1576. if (!ctx->verify_cb(1, ctx))
  1577. return 0;
  1578. if (--n >= 0) {
  1579. xi = xs;
  1580. xs = sk_X509_value(ctx->chain, n);
  1581. }
  1582. }
  1583. return 1;
  1584. }
  1585. int X509_cmp_current_time(const ASN1_TIME *ctm)
  1586. {
  1587. return X509_cmp_time(ctm, NULL);
  1588. }
  1589. int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
  1590. {
  1591. static const size_t utctime_length = sizeof("YYMMDDHHMMSSZ") - 1;
  1592. static const size_t generalizedtime_length = sizeof("YYYYMMDDHHMMSSZ") - 1;
  1593. ASN1_TIME *asn1_cmp_time = NULL;
  1594. int i, day, sec, ret = 0;
  1595. #ifdef CHARSET_EBCDIC
  1596. const char upper_z = 0x5A;
  1597. #else
  1598. const char upper_z = 'Z';
  1599. #endif
  1600. /*
  1601. * Note that ASN.1 allows much more slack in the time format than RFC5280.
  1602. * In RFC5280, the representation is fixed:
  1603. * UTCTime: YYMMDDHHMMSSZ
  1604. * GeneralizedTime: YYYYMMDDHHMMSSZ
  1605. *
  1606. * We do NOT currently enforce the following RFC 5280 requirement:
  1607. * "CAs conforming to this profile MUST always encode certificate
  1608. * validity dates through the year 2049 as UTCTime; certificate validity
  1609. * dates in 2050 or later MUST be encoded as GeneralizedTime."
  1610. */
  1611. switch (ctm->type) {
  1612. case V_ASN1_UTCTIME:
  1613. if (ctm->length != (int)(utctime_length))
  1614. return 0;
  1615. break;
  1616. case V_ASN1_GENERALIZEDTIME:
  1617. if (ctm->length != (int)(generalizedtime_length))
  1618. return 0;
  1619. break;
  1620. default:
  1621. return 0;
  1622. }
  1623. /**
  1624. * Verify the format: the ASN.1 functions we use below allow a more
  1625. * flexible format than what's mandated by RFC 5280.
  1626. * Digit and date ranges will be verified in the conversion methods.
  1627. */
  1628. for (i = 0; i < ctm->length - 1; i++) {
  1629. if (!ascii_isdigit(ctm->data[i]))
  1630. return 0;
  1631. }
  1632. if (ctm->data[ctm->length - 1] != upper_z)
  1633. return 0;
  1634. /*
  1635. * There is ASN1_UTCTIME_cmp_time_t but no
  1636. * ASN1_GENERALIZEDTIME_cmp_time_t or ASN1_TIME_cmp_time_t,
  1637. * so we go through ASN.1
  1638. */
  1639. asn1_cmp_time = X509_time_adj(NULL, 0, cmp_time);
  1640. if (asn1_cmp_time == NULL)
  1641. goto err;
  1642. if (!ASN1_TIME_diff(&day, &sec, ctm, asn1_cmp_time))
  1643. goto err;
  1644. /*
  1645. * X509_cmp_time comparison is <=.
  1646. * The return value 0 is reserved for errors.
  1647. */
  1648. ret = (day >= 0 && sec >= 0) ? -1 : 1;
  1649. err:
  1650. ASN1_TIME_free(asn1_cmp_time);
  1651. return ret;
  1652. }
  1653. /*
  1654. * Return 0 if time should not be checked or reference time is in range,
  1655. * or else 1 if it is past the end, or -1 if it is before the start
  1656. */
  1657. int X509_cmp_timeframe(const X509_VERIFY_PARAM *vpm,
  1658. const ASN1_TIME *start, const ASN1_TIME *end)
  1659. {
  1660. time_t ref_time;
  1661. time_t *time = NULL;
  1662. unsigned long flags = vpm == NULL ? 0 : X509_VERIFY_PARAM_get_flags(vpm);
  1663. if ((flags & X509_V_FLAG_USE_CHECK_TIME) != 0) {
  1664. ref_time = X509_VERIFY_PARAM_get_time(vpm);
  1665. time = &ref_time;
  1666. } else if ((flags & X509_V_FLAG_NO_CHECK_TIME) != 0) {
  1667. return 0; /* this means ok */
  1668. } /* else reference time is the current time */
  1669. if (end != NULL && X509_cmp_time(end, time) < 0)
  1670. return 1;
  1671. if (start != NULL && X509_cmp_time(start, time) > 0)
  1672. return -1;
  1673. return 0;
  1674. }
  1675. ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj)
  1676. {
  1677. return X509_time_adj(s, adj, NULL);
  1678. }
  1679. ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm)
  1680. {
  1681. return X509_time_adj_ex(s, 0, offset_sec, in_tm);
  1682. }
  1683. ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s,
  1684. int offset_day, long offset_sec, time_t *in_tm)
  1685. {
  1686. time_t t;
  1687. if (in_tm)
  1688. t = *in_tm;
  1689. else
  1690. time(&t);
  1691. if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) {
  1692. if (s->type == V_ASN1_UTCTIME)
  1693. return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec);
  1694. if (s->type == V_ASN1_GENERALIZEDTIME)
  1695. return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec);
  1696. }
  1697. return ASN1_TIME_adj(s, t, offset_day, offset_sec);
  1698. }
  1699. int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain)
  1700. {
  1701. EVP_PKEY *ktmp = NULL, *ktmp2;
  1702. int i, j;
  1703. if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey))
  1704. return 1;
  1705. for (i = 0; i < sk_X509_num(chain); i++) {
  1706. ktmp = X509_get0_pubkey(sk_X509_value(chain, i));
  1707. if (ktmp == NULL) {
  1708. X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
  1709. X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY);
  1710. return 0;
  1711. }
  1712. if (!EVP_PKEY_missing_parameters(ktmp))
  1713. break;
  1714. }
  1715. if (ktmp == NULL) {
  1716. X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
  1717. X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN);
  1718. return 0;
  1719. }
  1720. /* first, populate the other certs */
  1721. for (j = i - 1; j >= 0; j--) {
  1722. ktmp2 = X509_get0_pubkey(sk_X509_value(chain, j));
  1723. EVP_PKEY_copy_parameters(ktmp2, ktmp);
  1724. }
  1725. if (pkey != NULL)
  1726. EVP_PKEY_copy_parameters(pkey, ktmp);
  1727. return 1;
  1728. }
  1729. /* Make a delta CRL as the diff between two full CRLs */
  1730. X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer,
  1731. EVP_PKEY *skey, const EVP_MD *md, unsigned int flags)
  1732. {
  1733. X509_CRL *crl = NULL;
  1734. int i;
  1735. STACK_OF(X509_REVOKED) *revs = NULL;
  1736. /* CRLs can't be delta already */
  1737. if (base->base_crl_number || newer->base_crl_number) {
  1738. X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_ALREADY_DELTA);
  1739. return NULL;
  1740. }
  1741. /* Base and new CRL must have a CRL number */
  1742. if (!base->crl_number || !newer->crl_number) {
  1743. X509err(X509_F_X509_CRL_DIFF, X509_R_NO_CRL_NUMBER);
  1744. return NULL;
  1745. }
  1746. /* Issuer names must match */
  1747. if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(newer))) {
  1748. X509err(X509_F_X509_CRL_DIFF, X509_R_ISSUER_MISMATCH);
  1749. return NULL;
  1750. }
  1751. /* AKID and IDP must match */
  1752. if (!crl_extension_match(base, newer, NID_authority_key_identifier)) {
  1753. X509err(X509_F_X509_CRL_DIFF, X509_R_AKID_MISMATCH);
  1754. return NULL;
  1755. }
  1756. if (!crl_extension_match(base, newer, NID_issuing_distribution_point)) {
  1757. X509err(X509_F_X509_CRL_DIFF, X509_R_IDP_MISMATCH);
  1758. return NULL;
  1759. }
  1760. /* Newer CRL number must exceed full CRL number */
  1761. if (ASN1_INTEGER_cmp(newer->crl_number, base->crl_number) <= 0) {
  1762. X509err(X509_F_X509_CRL_DIFF, X509_R_NEWER_CRL_NOT_NEWER);
  1763. return NULL;
  1764. }
  1765. /* CRLs must verify */
  1766. if (skey && (X509_CRL_verify(base, skey) <= 0 ||
  1767. X509_CRL_verify(newer, skey) <= 0)) {
  1768. X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_VERIFY_FAILURE);
  1769. return NULL;
  1770. }
  1771. /* Create new CRL */
  1772. crl = X509_CRL_new();
  1773. if (crl == NULL || !X509_CRL_set_version(crl, 1))
  1774. goto memerr;
  1775. /* Set issuer name */
  1776. if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer)))
  1777. goto memerr;
  1778. if (!X509_CRL_set1_lastUpdate(crl, X509_CRL_get0_lastUpdate(newer)))
  1779. goto memerr;
  1780. if (!X509_CRL_set1_nextUpdate(crl, X509_CRL_get0_nextUpdate(newer)))
  1781. goto memerr;
  1782. /* Set base CRL number: must be critical */
  1783. if (!X509_CRL_add1_ext_i2d(crl, NID_delta_crl, base->crl_number, 1, 0))
  1784. goto memerr;
  1785. /*
  1786. * Copy extensions across from newest CRL to delta: this will set CRL
  1787. * number to correct value too.
  1788. */
  1789. for (i = 0; i < X509_CRL_get_ext_count(newer); i++) {
  1790. X509_EXTENSION *ext;
  1791. ext = X509_CRL_get_ext(newer, i);
  1792. if (!X509_CRL_add_ext(crl, ext, -1))
  1793. goto memerr;
  1794. }
  1795. /* Go through revoked entries, copying as needed */
  1796. revs = X509_CRL_get_REVOKED(newer);
  1797. for (i = 0; i < sk_X509_REVOKED_num(revs); i++) {
  1798. X509_REVOKED *rvn, *rvtmp;
  1799. rvn = sk_X509_REVOKED_value(revs, i);
  1800. /*
  1801. * Add only if not also in base. TODO: need something cleverer here
  1802. * for some more complex CRLs covering multiple CAs.
  1803. */
  1804. if (!X509_CRL_get0_by_serial(base, &rvtmp, &rvn->serialNumber)) {
  1805. rvtmp = X509_REVOKED_dup(rvn);
  1806. if (!rvtmp)
  1807. goto memerr;
  1808. if (!X509_CRL_add0_revoked(crl, rvtmp)) {
  1809. X509_REVOKED_free(rvtmp);
  1810. goto memerr;
  1811. }
  1812. }
  1813. }
  1814. /* TODO: optionally prune deleted entries */
  1815. if (skey && md && !X509_CRL_sign(crl, skey, md))
  1816. goto memerr;
  1817. return crl;
  1818. memerr:
  1819. X509err(X509_F_X509_CRL_DIFF, ERR_R_MALLOC_FAILURE);
  1820. X509_CRL_free(crl);
  1821. return NULL;
  1822. }
  1823. int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data)
  1824. {
  1825. return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
  1826. }
  1827. void *X509_STORE_CTX_get_ex_data(const X509_STORE_CTX *ctx, int idx)
  1828. {
  1829. return CRYPTO_get_ex_data(&ctx->ex_data, idx);
  1830. }
  1831. int X509_STORE_CTX_get_error(const X509_STORE_CTX *ctx)
  1832. {
  1833. return ctx->error;
  1834. }
  1835. void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err)
  1836. {
  1837. ctx->error = err;
  1838. }
  1839. int X509_STORE_CTX_get_error_depth(const X509_STORE_CTX *ctx)
  1840. {
  1841. return ctx->error_depth;
  1842. }
  1843. void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth)
  1844. {
  1845. ctx->error_depth = depth;
  1846. }
  1847. X509 *X509_STORE_CTX_get_current_cert(const X509_STORE_CTX *ctx)
  1848. {
  1849. return ctx->current_cert;
  1850. }
  1851. void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x)
  1852. {
  1853. ctx->current_cert = x;
  1854. }
  1855. STACK_OF(X509) *X509_STORE_CTX_get0_chain(const X509_STORE_CTX *ctx)
  1856. {
  1857. return ctx->chain;
  1858. }
  1859. STACK_OF(X509) *X509_STORE_CTX_get1_chain(const X509_STORE_CTX *ctx)
  1860. {
  1861. if (!ctx->chain)
  1862. return NULL;
  1863. return X509_chain_up_ref(ctx->chain);
  1864. }
  1865. X509 *X509_STORE_CTX_get0_current_issuer(const X509_STORE_CTX *ctx)
  1866. {
  1867. return ctx->current_issuer;
  1868. }
  1869. X509_CRL *X509_STORE_CTX_get0_current_crl(const X509_STORE_CTX *ctx)
  1870. {
  1871. return ctx->current_crl;
  1872. }
  1873. X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(const X509_STORE_CTX *ctx)
  1874. {
  1875. return ctx->parent;
  1876. }
  1877. void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
  1878. {
  1879. ctx->cert = x;
  1880. }
  1881. void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk)
  1882. {
  1883. ctx->crls = sk;
  1884. }
  1885. int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
  1886. {
  1887. /*
  1888. * XXX: Why isn't this function always used to set the associated trust?
  1889. * Should there even be a VPM->trust field at all? Or should the trust
  1890. * always be inferred from the purpose by X509_STORE_CTX_init().
  1891. */
  1892. return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
  1893. }
  1894. int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
  1895. {
  1896. /*
  1897. * XXX: See above, this function would only be needed when the default
  1898. * trust for the purpose needs an override in a corner case.
  1899. */
  1900. return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
  1901. }
  1902. /*
  1903. * This function is used to set the X509_STORE_CTX purpose and trust values.
  1904. * This is intended to be used when another structure has its own trust and
  1905. * purpose values which (if set) will be inherited by the ctx. If they aren't
  1906. * set then we will usually have a default purpose in mind which should then
  1907. * be used to set the trust value. An example of this is SSL use: an SSL
  1908. * structure will have its own purpose and trust settings which the
  1909. * application can set: if they aren't set then we use the default of SSL
  1910. * client/server.
  1911. */
  1912. int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
  1913. int purpose, int trust)
  1914. {
  1915. int idx;
  1916. /* If purpose not set use default */
  1917. if (purpose == 0)
  1918. purpose = def_purpose;
  1919. /* If we have a purpose then check it is valid */
  1920. if (purpose != 0) {
  1921. X509_PURPOSE *ptmp;
  1922. idx = X509_PURPOSE_get_by_id(purpose);
  1923. if (idx == -1) {
  1924. X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
  1925. X509_R_UNKNOWN_PURPOSE_ID);
  1926. return 0;
  1927. }
  1928. ptmp = X509_PURPOSE_get0(idx);
  1929. if (ptmp->trust == X509_TRUST_DEFAULT) {
  1930. idx = X509_PURPOSE_get_by_id(def_purpose);
  1931. /*
  1932. * XXX: In the two callers above def_purpose is always 0, which is
  1933. * not a known value, so idx will always be -1. How is the
  1934. * X509_TRUST_DEFAULT case actually supposed to be handled?
  1935. */
  1936. if (idx == -1) {
  1937. X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
  1938. X509_R_UNKNOWN_PURPOSE_ID);
  1939. return 0;
  1940. }
  1941. ptmp = X509_PURPOSE_get0(idx);
  1942. }
  1943. /* If trust not set then get from purpose default */
  1944. if (!trust)
  1945. trust = ptmp->trust;
  1946. }
  1947. if (trust) {
  1948. idx = X509_TRUST_get_by_id(trust);
  1949. if (idx == -1) {
  1950. X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
  1951. X509_R_UNKNOWN_TRUST_ID);
  1952. return 0;
  1953. }
  1954. }
  1955. if (purpose && !ctx->param->purpose)
  1956. ctx->param->purpose = purpose;
  1957. if (trust && !ctx->param->trust)
  1958. ctx->param->trust = trust;
  1959. return 1;
  1960. }
  1961. X509_STORE_CTX *X509_STORE_CTX_new_with_libctx(OPENSSL_CTX *libctx,
  1962. const char *propq)
  1963. {
  1964. X509_STORE_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
  1965. if (ctx == NULL) {
  1966. X509err(0, ERR_R_MALLOC_FAILURE);
  1967. return NULL;
  1968. }
  1969. ctx->libctx = libctx;
  1970. if (propq != NULL) {
  1971. ctx->propq = OPENSSL_strdup(propq);
  1972. if (ctx->propq == NULL) {
  1973. OPENSSL_free(ctx);
  1974. X509err(0, ERR_R_MALLOC_FAILURE);
  1975. return NULL;
  1976. }
  1977. }
  1978. return ctx;
  1979. }
  1980. X509_STORE_CTX *X509_STORE_CTX_new(void)
  1981. {
  1982. return X509_STORE_CTX_new_with_libctx(NULL, NULL);
  1983. }
  1984. void X509_STORE_CTX_free(X509_STORE_CTX *ctx)
  1985. {
  1986. if (ctx == NULL)
  1987. return;
  1988. X509_STORE_CTX_cleanup(ctx);
  1989. /* libctx and propq survive X509_STORE_CTX_cleanup() */
  1990. OPENSSL_free(ctx->propq);
  1991. OPENSSL_free(ctx);
  1992. }
  1993. int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
  1994. STACK_OF(X509) *chain)
  1995. {
  1996. int ret = 1;
  1997. ctx->store = store;
  1998. ctx->cert = x509;
  1999. ctx->untrusted = chain;
  2000. ctx->crls = NULL;
  2001. ctx->num_untrusted = 0;
  2002. ctx->other_ctx = NULL;
  2003. ctx->valid = 0;
  2004. ctx->chain = NULL;
  2005. ctx->error = 0;
  2006. ctx->explicit_policy = 0;
  2007. ctx->error_depth = 0;
  2008. ctx->current_cert = NULL;
  2009. ctx->current_issuer = NULL;
  2010. ctx->current_crl = NULL;
  2011. ctx->current_crl_score = 0;
  2012. ctx->current_reasons = 0;
  2013. ctx->tree = NULL;
  2014. ctx->parent = NULL;
  2015. ctx->dane = NULL;
  2016. ctx->bare_ta_signed = 0;
  2017. /* Zero ex_data to make sure we're cleanup-safe */
  2018. memset(&ctx->ex_data, 0, sizeof(ctx->ex_data));
  2019. /* store->cleanup is always 0 in OpenSSL, if set must be idempotent */
  2020. if (store)
  2021. ctx->cleanup = store->cleanup;
  2022. else
  2023. ctx->cleanup = 0;
  2024. if (store && store->check_issued)
  2025. ctx->check_issued = store->check_issued;
  2026. else
  2027. ctx->check_issued = check_issued;
  2028. if (store && store->get_issuer)
  2029. ctx->get_issuer = store->get_issuer;
  2030. else
  2031. ctx->get_issuer = X509_STORE_CTX_get1_issuer;
  2032. if (store && store->verify_cb)
  2033. ctx->verify_cb = store->verify_cb;
  2034. else
  2035. ctx->verify_cb = null_callback;
  2036. if (store && store->verify)
  2037. ctx->verify = store->verify;
  2038. else
  2039. ctx->verify = internal_verify;
  2040. if (store && store->check_revocation)
  2041. ctx->check_revocation = store->check_revocation;
  2042. else
  2043. ctx->check_revocation = check_revocation;
  2044. if (store && store->get_crl)
  2045. ctx->get_crl = store->get_crl;
  2046. else
  2047. ctx->get_crl = NULL;
  2048. if (store && store->check_crl)
  2049. ctx->check_crl = store->check_crl;
  2050. else
  2051. ctx->check_crl = check_crl;
  2052. if (store && store->cert_crl)
  2053. ctx->cert_crl = store->cert_crl;
  2054. else
  2055. ctx->cert_crl = cert_crl;
  2056. if (store && store->check_policy)
  2057. ctx->check_policy = store->check_policy;
  2058. else
  2059. ctx->check_policy = check_policy;
  2060. if (store && store->lookup_certs)
  2061. ctx->lookup_certs = store->lookup_certs;
  2062. else
  2063. ctx->lookup_certs = X509_STORE_CTX_get1_certs;
  2064. if (store && store->lookup_crls)
  2065. ctx->lookup_crls = store->lookup_crls;
  2066. else
  2067. ctx->lookup_crls = X509_STORE_CTX_get1_crls;
  2068. ctx->param = X509_VERIFY_PARAM_new();
  2069. if (ctx->param == NULL) {
  2070. X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
  2071. goto err;
  2072. }
  2073. /*
  2074. * Inherit callbacks and flags from X509_STORE if not set use defaults.
  2075. */
  2076. if (store)
  2077. ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param);
  2078. else
  2079. ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT | X509_VP_FLAG_ONCE;
  2080. if (ret)
  2081. ret = X509_VERIFY_PARAM_inherit(ctx->param,
  2082. X509_VERIFY_PARAM_lookup("default"));
  2083. if (ret == 0) {
  2084. X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
  2085. goto err;
  2086. }
  2087. /*
  2088. * XXX: For now, continue to inherit trust from VPM, but infer from the
  2089. * purpose if this still yields the default value.
  2090. */
  2091. if (ctx->param->trust == X509_TRUST_DEFAULT) {
  2092. int idx = X509_PURPOSE_get_by_id(ctx->param->purpose);
  2093. X509_PURPOSE *xp = X509_PURPOSE_get0(idx);
  2094. if (xp != NULL)
  2095. ctx->param->trust = X509_PURPOSE_get_trust(xp);
  2096. }
  2097. if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx,
  2098. &ctx->ex_data))
  2099. return 1;
  2100. X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
  2101. err:
  2102. /*
  2103. * On error clean up allocated storage, if the store context was not
  2104. * allocated with X509_STORE_CTX_new() this is our last chance to do so.
  2105. */
  2106. X509_STORE_CTX_cleanup(ctx);
  2107. return 0;
  2108. }
  2109. /*
  2110. * Set alternative lookup method: just a STACK of trusted certificates. This
  2111. * avoids X509_STORE nastiness where it isn't needed.
  2112. */
  2113. void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
  2114. {
  2115. ctx->other_ctx = sk;
  2116. ctx->get_issuer = get_issuer_sk;
  2117. ctx->lookup_certs = lookup_certs_sk;
  2118. }
  2119. void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
  2120. {
  2121. /*
  2122. * We need to be idempotent because, unfortunately, free() also calls
  2123. * cleanup(), so the natural call sequence new(), init(), cleanup(), free()
  2124. * calls cleanup() for the same object twice! Thus we must zero the
  2125. * pointers below after they're freed!
  2126. */
  2127. /* Seems to always be 0 in OpenSSL, do this at most once. */
  2128. if (ctx->cleanup != NULL) {
  2129. ctx->cleanup(ctx);
  2130. ctx->cleanup = NULL;
  2131. }
  2132. if (ctx->param != NULL) {
  2133. if (ctx->parent == NULL)
  2134. X509_VERIFY_PARAM_free(ctx->param);
  2135. ctx->param = NULL;
  2136. }
  2137. X509_policy_tree_free(ctx->tree);
  2138. ctx->tree = NULL;
  2139. sk_X509_pop_free(ctx->chain, X509_free);
  2140. ctx->chain = NULL;
  2141. CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &(ctx->ex_data));
  2142. memset(&ctx->ex_data, 0, sizeof(ctx->ex_data));
  2143. }
  2144. void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth)
  2145. {
  2146. X509_VERIFY_PARAM_set_depth(ctx->param, depth);
  2147. }
  2148. void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags)
  2149. {
  2150. X509_VERIFY_PARAM_set_flags(ctx->param, flags);
  2151. }
  2152. void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
  2153. time_t t)
  2154. {
  2155. X509_VERIFY_PARAM_set_time(ctx->param, t);
  2156. }
  2157. X509 *X509_STORE_CTX_get0_cert(const X509_STORE_CTX *ctx)
  2158. {
  2159. return ctx->cert;
  2160. }
  2161. STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(const X509_STORE_CTX *ctx)
  2162. {
  2163. return ctx->untrusted;
  2164. }
  2165. void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
  2166. {
  2167. ctx->untrusted = sk;
  2168. }
  2169. void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
  2170. {
  2171. sk_X509_pop_free(ctx->chain, X509_free);
  2172. ctx->chain = sk;
  2173. }
  2174. void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
  2175. X509_STORE_CTX_verify_cb verify_cb)
  2176. {
  2177. ctx->verify_cb = verify_cb;
  2178. }
  2179. X509_STORE_CTX_verify_cb X509_STORE_CTX_get_verify_cb(const X509_STORE_CTX *ctx)
  2180. {
  2181. return ctx->verify_cb;
  2182. }
  2183. void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx,
  2184. X509_STORE_CTX_verify_fn verify)
  2185. {
  2186. ctx->verify = verify;
  2187. }
  2188. X509_STORE_CTX_verify_fn X509_STORE_CTX_get_verify(const X509_STORE_CTX *ctx)
  2189. {
  2190. return ctx->verify;
  2191. }
  2192. X509_STORE_CTX_get_issuer_fn X509_STORE_CTX_get_get_issuer(const X509_STORE_CTX *ctx)
  2193. {
  2194. return ctx->get_issuer;
  2195. }
  2196. X509_STORE_CTX_check_issued_fn
  2197. X509_STORE_CTX_get_check_issued(const X509_STORE_CTX *ctx)
  2198. {
  2199. return ctx->check_issued;
  2200. }
  2201. X509_STORE_CTX_check_revocation_fn
  2202. X509_STORE_CTX_get_check_revocation(const X509_STORE_CTX *ctx)
  2203. {
  2204. return ctx->check_revocation;
  2205. }
  2206. X509_STORE_CTX_get_crl_fn X509_STORE_CTX_get_get_crl(const X509_STORE_CTX *ctx)
  2207. {
  2208. return ctx->get_crl;
  2209. }
  2210. X509_STORE_CTX_check_crl_fn X509_STORE_CTX_get_check_crl(const X509_STORE_CTX *ctx)
  2211. {
  2212. return ctx->check_crl;
  2213. }
  2214. X509_STORE_CTX_cert_crl_fn X509_STORE_CTX_get_cert_crl(const X509_STORE_CTX *ctx)
  2215. {
  2216. return ctx->cert_crl;
  2217. }
  2218. X509_STORE_CTX_check_policy_fn
  2219. X509_STORE_CTX_get_check_policy(const X509_STORE_CTX *ctx)
  2220. {
  2221. return ctx->check_policy;
  2222. }
  2223. X509_STORE_CTX_lookup_certs_fn
  2224. X509_STORE_CTX_get_lookup_certs(const X509_STORE_CTX *ctx)
  2225. {
  2226. return ctx->lookup_certs;
  2227. }
  2228. X509_STORE_CTX_lookup_crls_fn
  2229. X509_STORE_CTX_get_lookup_crls(const X509_STORE_CTX *ctx)
  2230. {
  2231. return ctx->lookup_crls;
  2232. }
  2233. X509_STORE_CTX_cleanup_fn X509_STORE_CTX_get_cleanup(const X509_STORE_CTX *ctx)
  2234. {
  2235. return ctx->cleanup;
  2236. }
  2237. X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(const X509_STORE_CTX *ctx)
  2238. {
  2239. return ctx->tree;
  2240. }
  2241. int X509_STORE_CTX_get_explicit_policy(const X509_STORE_CTX *ctx)
  2242. {
  2243. return ctx->explicit_policy;
  2244. }
  2245. int X509_STORE_CTX_get_num_untrusted(const X509_STORE_CTX *ctx)
  2246. {
  2247. return ctx->num_untrusted;
  2248. }
  2249. int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name)
  2250. {
  2251. const X509_VERIFY_PARAM *param;
  2252. param = X509_VERIFY_PARAM_lookup(name);
  2253. if (param == NULL)
  2254. return 0;
  2255. return X509_VERIFY_PARAM_inherit(ctx->param, param);
  2256. }
  2257. X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(const X509_STORE_CTX *ctx)
  2258. {
  2259. return ctx->param;
  2260. }
  2261. void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param)
  2262. {
  2263. X509_VERIFY_PARAM_free(ctx->param);
  2264. ctx->param = param;
  2265. }
  2266. void X509_STORE_CTX_set0_dane(X509_STORE_CTX *ctx, SSL_DANE *dane)
  2267. {
  2268. ctx->dane = dane;
  2269. }
  2270. static unsigned char *dane_i2d(
  2271. X509 *cert,
  2272. uint8_t selector,
  2273. unsigned int *i2dlen)
  2274. {
  2275. unsigned char *buf = NULL;
  2276. int len;
  2277. /*
  2278. * Extract ASN.1 DER form of certificate or public key.
  2279. */
  2280. switch (selector) {
  2281. case DANETLS_SELECTOR_CERT:
  2282. len = i2d_X509(cert, &buf);
  2283. break;
  2284. case DANETLS_SELECTOR_SPKI:
  2285. len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &buf);
  2286. break;
  2287. default:
  2288. X509err(X509_F_DANE_I2D, X509_R_BAD_SELECTOR);
  2289. return NULL;
  2290. }
  2291. if (len < 0 || buf == NULL) {
  2292. X509err(X509_F_DANE_I2D, ERR_R_MALLOC_FAILURE);
  2293. return NULL;
  2294. }
  2295. *i2dlen = (unsigned int)len;
  2296. return buf;
  2297. }
  2298. #define DANETLS_NONE 256 /* impossible uint8_t */
  2299. static int dane_match(X509_STORE_CTX *ctx, X509 *cert, int depth)
  2300. {
  2301. SSL_DANE *dane = ctx->dane;
  2302. unsigned usage = DANETLS_NONE;
  2303. unsigned selector = DANETLS_NONE;
  2304. unsigned ordinal = DANETLS_NONE;
  2305. unsigned mtype = DANETLS_NONE;
  2306. unsigned char *i2dbuf = NULL;
  2307. unsigned int i2dlen = 0;
  2308. unsigned char mdbuf[EVP_MAX_MD_SIZE];
  2309. unsigned char *cmpbuf = NULL;
  2310. unsigned int cmplen = 0;
  2311. int i;
  2312. int recnum;
  2313. int matched = 0;
  2314. danetls_record *t = NULL;
  2315. uint32_t mask;
  2316. mask = (depth == 0) ? DANETLS_EE_MASK : DANETLS_TA_MASK;
  2317. /*
  2318. * The trust store is not applicable with DANE-TA(2)
  2319. */
  2320. if (depth >= ctx->num_untrusted)
  2321. mask &= DANETLS_PKIX_MASK;
  2322. /*
  2323. * If we've previously matched a PKIX-?? record, no need to test any
  2324. * further PKIX-?? records, it remains to just build the PKIX chain.
  2325. * Had the match been a DANE-?? record, we'd be done already.
  2326. */
  2327. if (dane->mdpth >= 0)
  2328. mask &= ~DANETLS_PKIX_MASK;
  2329. /*-
  2330. * https://tools.ietf.org/html/rfc7671#section-5.1
  2331. * https://tools.ietf.org/html/rfc7671#section-5.2
  2332. * https://tools.ietf.org/html/rfc7671#section-5.3
  2333. * https://tools.ietf.org/html/rfc7671#section-5.4
  2334. *
  2335. * We handle DANE-EE(3) records first as they require no chain building
  2336. * and no expiration or hostname checks. We also process digests with
  2337. * higher ordinals first and ignore lower priorities except Full(0) which
  2338. * is always processed (last). If none match, we then process PKIX-EE(1).
  2339. *
  2340. * NOTE: This relies on DANE usages sorting before the corresponding PKIX
  2341. * usages in SSL_dane_tlsa_add(), and also on descending sorting of digest
  2342. * priorities. See twin comment in ssl/ssl_lib.c.
  2343. *
  2344. * We expect that most TLSA RRsets will have just a single usage, so we
  2345. * don't go out of our way to cache multiple selector-specific i2d buffers
  2346. * across usages, but if the selector happens to remain the same as switch
  2347. * usages, that's OK. Thus, a set of "3 1 1", "3 0 1", "1 1 1", "1 0 1",
  2348. * records would result in us generating each of the certificate and public
  2349. * key DER forms twice, but more typically we'd just see multiple "3 1 1"
  2350. * or multiple "3 0 1" records.
  2351. *
  2352. * As soon as we find a match at any given depth, we stop, because either
  2353. * we've matched a DANE-?? record and the peer is authenticated, or, after
  2354. * exhausting all DANE-?? records, we've matched a PKIX-?? record, which is
  2355. * sufficient for DANE, and what remains to do is ordinary PKIX validation.
  2356. */
  2357. recnum = (dane->umask & mask) ? sk_danetls_record_num(dane->trecs) : 0;
  2358. for (i = 0; matched == 0 && i < recnum; ++i) {
  2359. t = sk_danetls_record_value(dane->trecs, i);
  2360. if ((DANETLS_USAGE_BIT(t->usage) & mask) == 0)
  2361. continue;
  2362. if (t->usage != usage) {
  2363. usage = t->usage;
  2364. /* Reset digest agility for each usage/selector pair */
  2365. mtype = DANETLS_NONE;
  2366. ordinal = dane->dctx->mdord[t->mtype];
  2367. }
  2368. if (t->selector != selector) {
  2369. selector = t->selector;
  2370. /* Update per-selector state */
  2371. OPENSSL_free(i2dbuf);
  2372. i2dbuf = dane_i2d(cert, selector, &i2dlen);
  2373. if (i2dbuf == NULL)
  2374. return -1;
  2375. /* Reset digest agility for each usage/selector pair */
  2376. mtype = DANETLS_NONE;
  2377. ordinal = dane->dctx->mdord[t->mtype];
  2378. } else if (t->mtype != DANETLS_MATCHING_FULL) {
  2379. /*-
  2380. * Digest agility:
  2381. *
  2382. * <https://tools.ietf.org/html/rfc7671#section-9>
  2383. *
  2384. * For a fixed selector, after processing all records with the
  2385. * highest mtype ordinal, ignore all mtypes with lower ordinals
  2386. * other than "Full".
  2387. */
  2388. if (dane->dctx->mdord[t->mtype] < ordinal)
  2389. continue;
  2390. }
  2391. /*
  2392. * Each time we hit a (new selector or) mtype, re-compute the relevant
  2393. * digest, more complex caching is not worth the code space.
  2394. */
  2395. if (t->mtype != mtype) {
  2396. const EVP_MD *md = dane->dctx->mdevp[mtype = t->mtype];
  2397. cmpbuf = i2dbuf;
  2398. cmplen = i2dlen;
  2399. if (md != NULL) {
  2400. cmpbuf = mdbuf;
  2401. if (!EVP_Digest(i2dbuf, i2dlen, cmpbuf, &cmplen, md, 0)) {
  2402. matched = -1;
  2403. break;
  2404. }
  2405. }
  2406. }
  2407. /*
  2408. * Squirrel away the certificate and depth if we have a match. Any
  2409. * DANE match is dispositive, but with PKIX we still need to build a
  2410. * full chain.
  2411. */
  2412. if (cmplen == t->dlen &&
  2413. memcmp(cmpbuf, t->data, cmplen) == 0) {
  2414. if (DANETLS_USAGE_BIT(usage) & DANETLS_DANE_MASK)
  2415. matched = 1;
  2416. if (matched || dane->mdpth < 0) {
  2417. dane->mdpth = depth;
  2418. dane->mtlsa = t;
  2419. OPENSSL_free(dane->mcert);
  2420. dane->mcert = cert;
  2421. X509_up_ref(cert);
  2422. }
  2423. break;
  2424. }
  2425. }
  2426. /* Clear the one-element DER cache */
  2427. OPENSSL_free(i2dbuf);
  2428. return matched;
  2429. }
  2430. static int check_dane_issuer(X509_STORE_CTX *ctx, int depth)
  2431. {
  2432. SSL_DANE *dane = ctx->dane;
  2433. int matched = 0;
  2434. X509 *cert;
  2435. if (!DANETLS_HAS_TA(dane) || depth == 0)
  2436. return X509_TRUST_UNTRUSTED;
  2437. /*
  2438. * Record any DANE trust-anchor matches, for the first depth to test, if
  2439. * there's one at that depth. (This'll be false for length 1 chains looking
  2440. * for an exact match for the leaf certificate).
  2441. */
  2442. cert = sk_X509_value(ctx->chain, depth);
  2443. if (cert != NULL && (matched = dane_match(ctx, cert, depth)) < 0)
  2444. return X509_TRUST_REJECTED;
  2445. if (matched > 0) {
  2446. ctx->num_untrusted = depth - 1;
  2447. return X509_TRUST_TRUSTED;
  2448. }
  2449. return X509_TRUST_UNTRUSTED;
  2450. }
  2451. static int check_dane_pkeys(X509_STORE_CTX *ctx)
  2452. {
  2453. SSL_DANE *dane = ctx->dane;
  2454. danetls_record *t;
  2455. int num = ctx->num_untrusted;
  2456. X509 *cert = sk_X509_value(ctx->chain, num - 1);
  2457. int recnum = sk_danetls_record_num(dane->trecs);
  2458. int i;
  2459. for (i = 0; i < recnum; ++i) {
  2460. t = sk_danetls_record_value(dane->trecs, i);
  2461. if (t->usage != DANETLS_USAGE_DANE_TA ||
  2462. t->selector != DANETLS_SELECTOR_SPKI ||
  2463. t->mtype != DANETLS_MATCHING_FULL ||
  2464. X509_verify_ex(cert, t->spki, ctx->libctx, ctx->propq) <= 0)
  2465. continue;
  2466. /* Clear any PKIX-?? matches that failed to extend to a full chain */
  2467. X509_free(dane->mcert);
  2468. dane->mcert = NULL;
  2469. /* Record match via a bare TA public key */
  2470. ctx->bare_ta_signed = 1;
  2471. dane->mdpth = num - 1;
  2472. dane->mtlsa = t;
  2473. /* Prune any excess chain certificates */
  2474. num = sk_X509_num(ctx->chain);
  2475. for (; num > ctx->num_untrusted; --num)
  2476. X509_free(sk_X509_pop(ctx->chain));
  2477. return X509_TRUST_TRUSTED;
  2478. }
  2479. return X509_TRUST_UNTRUSTED;
  2480. }
  2481. static void dane_reset(SSL_DANE *dane)
  2482. {
  2483. /*
  2484. * Reset state to verify another chain, or clear after failure.
  2485. */
  2486. X509_free(dane->mcert);
  2487. dane->mcert = NULL;
  2488. dane->mtlsa = NULL;
  2489. dane->mdpth = -1;
  2490. dane->pdpth = -1;
  2491. }
  2492. static int check_leaf_suiteb(X509_STORE_CTX *ctx, X509 *cert)
  2493. {
  2494. int err = X509_chain_check_suiteb(NULL, cert, NULL, ctx->param->flags);
  2495. if (err == X509_V_OK)
  2496. return 1;
  2497. return verify_cb_cert(ctx, cert, 0, err);
  2498. }
  2499. static int dane_verify(X509_STORE_CTX *ctx)
  2500. {
  2501. X509 *cert = ctx->cert;
  2502. SSL_DANE *dane = ctx->dane;
  2503. int matched;
  2504. int done;
  2505. dane_reset(dane);
  2506. /*-
  2507. * When testing the leaf certificate, if we match a DANE-EE(3) record,
  2508. * dane_match() returns 1 and we're done. If however we match a PKIX-EE(1)
  2509. * record, the match depth and matching TLSA record are recorded, but the
  2510. * return value is 0, because we still need to find a PKIX trust-anchor.
  2511. * Therefore, when DANE authentication is enabled (required), we're done
  2512. * if:
  2513. * + matched < 0, internal error.
  2514. * + matched == 1, we matched a DANE-EE(3) record
  2515. * + matched == 0, mdepth < 0 (no PKIX-EE match) and there are no
  2516. * DANE-TA(2) or PKIX-TA(0) to test.
  2517. */
  2518. matched = dane_match(ctx, ctx->cert, 0);
  2519. done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0);
  2520. if (done)
  2521. X509_get_pubkey_parameters(NULL, ctx->chain);
  2522. if (matched > 0) {
  2523. /* Callback invoked as needed */
  2524. if (!check_leaf_suiteb(ctx, cert))
  2525. return 0;
  2526. /* Callback invoked as needed */
  2527. if ((dane->flags & DANE_FLAG_NO_DANE_EE_NAMECHECKS) == 0 &&
  2528. !check_id(ctx))
  2529. return 0;
  2530. /* Bypass internal_verify(), issue depth 0 success callback */
  2531. ctx->error_depth = 0;
  2532. ctx->current_cert = cert;
  2533. return ctx->verify_cb(1, ctx);
  2534. }
  2535. if (matched < 0) {
  2536. ctx->error_depth = 0;
  2537. ctx->current_cert = cert;
  2538. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2539. return -1;
  2540. }
  2541. if (done) {
  2542. /* Fail early, TA-based success is not possible */
  2543. if (!check_leaf_suiteb(ctx, cert))
  2544. return 0;
  2545. return verify_cb_cert(ctx, cert, 0, X509_V_ERR_DANE_NO_MATCH);
  2546. }
  2547. /*
  2548. * Chain verification for usages 0/1/2. TLSA record matching of depth > 0
  2549. * certificates happens in-line with building the rest of the chain.
  2550. */
  2551. return verify_chain(ctx);
  2552. }
  2553. /* Get issuer, without duplicate suppression */
  2554. static int get_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *cert)
  2555. {
  2556. STACK_OF(X509) *saved_chain = ctx->chain;
  2557. int ok;
  2558. ctx->chain = NULL;
  2559. ok = ctx->get_issuer(issuer, ctx, cert);
  2560. ctx->chain = saved_chain;
  2561. return ok;
  2562. }
  2563. static int build_chain(X509_STORE_CTX *ctx)
  2564. {
  2565. SSL_DANE *dane = ctx->dane;
  2566. int num = sk_X509_num(ctx->chain);
  2567. X509 *cert = sk_X509_value(ctx->chain, num - 1);
  2568. int ss;
  2569. STACK_OF(X509) *sktmp = NULL;
  2570. unsigned int search;
  2571. int may_trusted = 0;
  2572. int may_alternate = 0;
  2573. int trust = X509_TRUST_UNTRUSTED;
  2574. int alt_untrusted = 0;
  2575. int depth;
  2576. int ok = 0;
  2577. int i;
  2578. /* Our chain starts with a single untrusted element. */
  2579. if (!ossl_assert(num == 1 && ctx->num_untrusted == num)) {
  2580. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2581. ctx->error = X509_V_ERR_UNSPECIFIED;
  2582. return 0;
  2583. }
  2584. ss = cert_self_signed(ctx, cert);
  2585. if (ss < 0) {
  2586. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2587. ctx->error = X509_V_ERR_UNSPECIFIED;
  2588. return 0;
  2589. }
  2590. #define S_DOUNTRUSTED (1 << 0) /* Search untrusted chain */
  2591. #define S_DOTRUSTED (1 << 1) /* Search trusted store */
  2592. #define S_DOALTERNATE (1 << 2) /* Retry with pruned alternate chain */
  2593. /*
  2594. * Set up search policy, untrusted if possible, trusted-first if enabled.
  2595. * If we're doing DANE and not doing PKIX-TA/PKIX-EE, we never look in the
  2596. * trust_store, otherwise we might look there first. If not trusted-first,
  2597. * and alternate chains are not disabled, try building an alternate chain
  2598. * if no luck with untrusted first.
  2599. */
  2600. search = (ctx->untrusted != NULL) ? S_DOUNTRUSTED : 0;
  2601. if (DANETLS_HAS_PKIX(dane) || !DANETLS_HAS_DANE(dane)) {
  2602. if (search == 0 || ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
  2603. search |= S_DOTRUSTED;
  2604. else if (!(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS))
  2605. may_alternate = 1;
  2606. may_trusted = 1;
  2607. }
  2608. /*
  2609. * Shallow-copy the stack of untrusted certificates (with TLS, this is
  2610. * typically the content of the peer's certificate message) so can make
  2611. * multiple passes over it, while free to remove elements as we go.
  2612. */
  2613. if (ctx->untrusted && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
  2614. X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
  2615. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2616. return 0;
  2617. }
  2618. /*
  2619. * If we got any "DANE-TA(2) Cert(0) Full(0)" trust-anchors from DNS, add
  2620. * them to our working copy of the untrusted certificate stack. Since the
  2621. * caller of X509_STORE_CTX_init() may have provided only a leaf cert with
  2622. * no corresponding stack of untrusted certificates, we may need to create
  2623. * an empty stack first. [ At present only the ssl library provides DANE
  2624. * support, and ssl_verify_cert_chain() always provides a non-null stack
  2625. * containing at least the leaf certificate, but we must be prepared for
  2626. * this to change. ]
  2627. */
  2628. if (DANETLS_ENABLED(dane) && dane->certs != NULL) {
  2629. if (sktmp == NULL && (sktmp = sk_X509_new_null()) == NULL) {
  2630. X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
  2631. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2632. return 0;
  2633. }
  2634. for (i = 0; i < sk_X509_num(dane->certs); ++i) {
  2635. if (!sk_X509_push(sktmp, sk_X509_value(dane->certs, i))) {
  2636. sk_X509_free(sktmp);
  2637. X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
  2638. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2639. return 0;
  2640. }
  2641. }
  2642. }
  2643. /*
  2644. * Still absurdly large, but arithmetically safe, a lower hard upper bound
  2645. * might be reasonable.
  2646. */
  2647. if (ctx->param->depth > INT_MAX/2)
  2648. ctx->param->depth = INT_MAX/2;
  2649. /*
  2650. * Try to Extend the chain until we reach an ultimately trusted issuer.
  2651. * Build chains up to one longer the limit, later fail if we hit the limit,
  2652. * with an X509_V_ERR_CERT_CHAIN_TOO_LONG error code.
  2653. */
  2654. depth = ctx->param->depth + 1;
  2655. while (search != 0) {
  2656. X509 *x;
  2657. X509 *xtmp = NULL;
  2658. /*
  2659. * Look in the trust store if enabled for first lookup, or we've run
  2660. * out of untrusted issuers and search here is not disabled. When we
  2661. * reach the depth limit, we stop extending the chain, if by that point
  2662. * we've not found a trust-anchor, any trusted chain would be too long.
  2663. *
  2664. * The error reported to the application verify callback is at the
  2665. * maximal valid depth with the current certificate equal to the last
  2666. * not ultimately-trusted issuer. For example, with verify_depth = 0,
  2667. * the callback will report errors at depth=1 when the immediate issuer
  2668. * of the leaf certificate is not a trust anchor. No attempt will be
  2669. * made to locate an issuer for that certificate, since such a chain
  2670. * would be a-priori too long.
  2671. */
  2672. if ((search & S_DOTRUSTED) != 0) {
  2673. i = num = sk_X509_num(ctx->chain);
  2674. if ((search & S_DOALTERNATE) != 0) {
  2675. /*
  2676. * As high up the chain as we can, look for an alternative
  2677. * trusted issuer of an untrusted certificate that currently
  2678. * has an untrusted issuer. We use the alt_untrusted variable
  2679. * to track how far up the chain we find the first match. It
  2680. * is only if and when we find a match, that we prune the chain
  2681. * and reset ctx->num_untrusted to the reduced count of
  2682. * untrusted certificates. While we're searching for such a
  2683. * match (which may never be found), it is neither safe nor
  2684. * wise to preemptively modify either the chain or
  2685. * ctx->num_untrusted.
  2686. *
  2687. * Note, like ctx->num_untrusted, alt_untrusted is a count of
  2688. * untrusted certificates, not a "depth".
  2689. */
  2690. i = alt_untrusted;
  2691. }
  2692. x = sk_X509_value(ctx->chain, i-1);
  2693. ok = (depth < num) ? 0 : get_issuer(&xtmp, ctx, x);
  2694. if (ok < 0) {
  2695. trust = X509_TRUST_REJECTED;
  2696. ctx->error = X509_V_ERR_STORE_LOOKUP;
  2697. search = 0;
  2698. continue;
  2699. }
  2700. if (ok > 0) {
  2701. /*
  2702. * Alternative trusted issuer for a mid-chain untrusted cert?
  2703. * Pop the untrusted cert's successors and retry. We might now
  2704. * be able to complete a valid chain via the trust store. Note
  2705. * that despite the current trust-store match we might still
  2706. * fail complete the chain to a suitable trust-anchor, in which
  2707. * case we may prune some more untrusted certificates and try
  2708. * again. Thus the S_DOALTERNATE bit may yet be turned on
  2709. * again with an even shorter untrusted chain!
  2710. *
  2711. * If in the process we threw away our matching PKIX-TA trust
  2712. * anchor, reset DANE trust. We might find a suitable trusted
  2713. * certificate among the ones from the trust store.
  2714. */
  2715. if ((search & S_DOALTERNATE) != 0) {
  2716. if (!ossl_assert(num > i && i > 0 && ss == 0)) {
  2717. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2718. X509_free(xtmp);
  2719. trust = X509_TRUST_REJECTED;
  2720. ctx->error = X509_V_ERR_UNSPECIFIED;
  2721. search = 0;
  2722. continue;
  2723. }
  2724. search &= ~S_DOALTERNATE;
  2725. for (; num > i; --num)
  2726. X509_free(sk_X509_pop(ctx->chain));
  2727. ctx->num_untrusted = num;
  2728. if (DANETLS_ENABLED(dane) &&
  2729. dane->mdpth >= ctx->num_untrusted) {
  2730. dane->mdpth = -1;
  2731. X509_free(dane->mcert);
  2732. dane->mcert = NULL;
  2733. }
  2734. if (DANETLS_ENABLED(dane) &&
  2735. dane->pdpth >= ctx->num_untrusted)
  2736. dane->pdpth = -1;
  2737. }
  2738. /*
  2739. * Self-signed untrusted certificates get replaced by their
  2740. * trusted matching issuer. Otherwise, grow the chain.
  2741. */
  2742. if (ss == 0) {
  2743. if (!sk_X509_push(ctx->chain, x = xtmp)) {
  2744. X509_free(xtmp);
  2745. X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
  2746. trust = X509_TRUST_REJECTED;
  2747. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2748. search = 0;
  2749. continue;
  2750. }
  2751. ss = cert_self_signed(ctx, x);
  2752. if (ss < 0) {
  2753. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2754. ctx->error = X509_V_ERR_UNSPECIFIED;
  2755. return 0;
  2756. }
  2757. } else if (num == ctx->num_untrusted) {
  2758. /*
  2759. * We have a self-signed certificate that has the same
  2760. * subject name (and perhaps keyid and/or serial number) as
  2761. * a trust-anchor. We must have an exact match to avoid
  2762. * possible impersonation via key substitution etc.
  2763. */
  2764. if (X509_cmp(x, xtmp) != 0) {
  2765. /* Self-signed untrusted mimic. */
  2766. X509_free(xtmp);
  2767. ok = 0;
  2768. } else {
  2769. X509_free(x);
  2770. ctx->num_untrusted = --num;
  2771. (void) sk_X509_set(ctx->chain, num, x = xtmp);
  2772. }
  2773. }
  2774. /*
  2775. * We've added a new trusted certificate to the chain, recheck
  2776. * trust. If not done, and not self-signed look deeper.
  2777. * Whether or not we're doing "trusted first", we no longer
  2778. * look for untrusted certificates from the peer's chain.
  2779. *
  2780. * At this point ctx->num_trusted and num must reflect the
  2781. * correct number of untrusted certificates, since the DANE
  2782. * logic in check_trust() depends on distinguishing CAs from
  2783. * "the wire" from CAs from the trust store. In particular, the
  2784. * certificate at depth "num" should be the new trusted
  2785. * certificate with ctx->num_untrusted <= num.
  2786. */
  2787. if (ok) {
  2788. if (!ossl_assert(ctx->num_untrusted <= num)) {
  2789. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2790. trust = X509_TRUST_REJECTED;
  2791. ctx->error = X509_V_ERR_UNSPECIFIED;
  2792. search = 0;
  2793. continue;
  2794. }
  2795. search &= ~S_DOUNTRUSTED;
  2796. switch (trust = check_trust(ctx, num)) {
  2797. case X509_TRUST_TRUSTED:
  2798. case X509_TRUST_REJECTED:
  2799. search = 0;
  2800. continue;
  2801. }
  2802. if (ss == 0)
  2803. continue;
  2804. }
  2805. }
  2806. /*
  2807. * No dispositive decision, and either self-signed or no match, if
  2808. * we were doing untrusted-first, and alt-chains are not disabled,
  2809. * do that, by repeatedly losing one untrusted element at a time,
  2810. * and trying to extend the shorted chain.
  2811. */
  2812. if ((search & S_DOUNTRUSTED) == 0) {
  2813. /* Continue search for a trusted issuer of a shorter chain? */
  2814. if ((search & S_DOALTERNATE) != 0 && --alt_untrusted > 0)
  2815. continue;
  2816. /* Still no luck and no fallbacks left? */
  2817. if (!may_alternate || (search & S_DOALTERNATE) != 0 ||
  2818. ctx->num_untrusted < 2)
  2819. break;
  2820. /* Search for a trusted issuer of a shorter chain */
  2821. search |= S_DOALTERNATE;
  2822. alt_untrusted = ctx->num_untrusted - 1;
  2823. ss = 0;
  2824. }
  2825. }
  2826. /*
  2827. * Extend chain with peer-provided certificates
  2828. */
  2829. if ((search & S_DOUNTRUSTED) != 0) {
  2830. num = sk_X509_num(ctx->chain);
  2831. if (!ossl_assert(num == ctx->num_untrusted)) {
  2832. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2833. trust = X509_TRUST_REJECTED;
  2834. ctx->error = X509_V_ERR_UNSPECIFIED;
  2835. search = 0;
  2836. continue;
  2837. }
  2838. x = sk_X509_value(ctx->chain, num-1);
  2839. /*
  2840. * Once we run out of untrusted issuers, we stop looking for more
  2841. * and start looking only in the trust store if enabled.
  2842. */
  2843. xtmp = (ss || depth < num) ? NULL : find_issuer(ctx, sktmp, x);
  2844. if (xtmp == NULL) {
  2845. search &= ~S_DOUNTRUSTED;
  2846. if (may_trusted)
  2847. search |= S_DOTRUSTED;
  2848. continue;
  2849. }
  2850. /* Drop this issuer from future consideration */
  2851. (void) sk_X509_delete_ptr(sktmp, xtmp);
  2852. if (!X509_up_ref(xtmp)) {
  2853. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2854. trust = X509_TRUST_REJECTED;
  2855. ctx->error = X509_V_ERR_UNSPECIFIED;
  2856. search = 0;
  2857. continue;
  2858. }
  2859. if (!sk_X509_push(ctx->chain, xtmp)) {
  2860. X509_free(xtmp);
  2861. X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
  2862. trust = X509_TRUST_REJECTED;
  2863. ctx->error = X509_V_ERR_OUT_OF_MEM;
  2864. search = 0;
  2865. continue;
  2866. }
  2867. x = xtmp;
  2868. ++ctx->num_untrusted;
  2869. ss = cert_self_signed(ctx, xtmp);
  2870. if (ss < 0) {
  2871. X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR);
  2872. ctx->error = X509_V_ERR_UNSPECIFIED;
  2873. sk_X509_free(sktmp);
  2874. return 0;
  2875. }
  2876. /*
  2877. * Check for DANE-TA trust of the topmost untrusted certificate.
  2878. */
  2879. switch (trust = check_dane_issuer(ctx, ctx->num_untrusted - 1)) {
  2880. case X509_TRUST_TRUSTED:
  2881. case X509_TRUST_REJECTED:
  2882. search = 0;
  2883. continue;
  2884. }
  2885. }
  2886. }
  2887. sk_X509_free(sktmp);
  2888. /*
  2889. * Last chance to make a trusted chain, either bare DANE-TA public-key
  2890. * signers, or else direct leaf PKIX trust.
  2891. */
  2892. num = sk_X509_num(ctx->chain);
  2893. if (num <= depth) {
  2894. if (trust == X509_TRUST_UNTRUSTED && DANETLS_HAS_DANE_TA(dane))
  2895. trust = check_dane_pkeys(ctx);
  2896. if (trust == X509_TRUST_UNTRUSTED && num == ctx->num_untrusted)
  2897. trust = check_trust(ctx, num);
  2898. }
  2899. switch (trust) {
  2900. case X509_TRUST_TRUSTED:
  2901. return 1;
  2902. case X509_TRUST_REJECTED:
  2903. /* Callback already issued */
  2904. return 0;
  2905. case X509_TRUST_UNTRUSTED:
  2906. default:
  2907. num = sk_X509_num(ctx->chain);
  2908. if (num > depth)
  2909. return verify_cb_cert(ctx, NULL, num-1,
  2910. X509_V_ERR_CERT_CHAIN_TOO_LONG);
  2911. if (DANETLS_ENABLED(dane) &&
  2912. (!DANETLS_HAS_PKIX(dane) || dane->pdpth >= 0))
  2913. return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_DANE_NO_MATCH);
  2914. if (ss && sk_X509_num(ctx->chain) == 1)
  2915. return verify_cb_cert(ctx, NULL, num-1,
  2916. X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT);
  2917. if (ss)
  2918. return verify_cb_cert(ctx, NULL, num-1,
  2919. X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN);
  2920. if (ctx->num_untrusted < num)
  2921. return verify_cb_cert(ctx, NULL, num-1,
  2922. X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT);
  2923. return verify_cb_cert(ctx, NULL, num-1,
  2924. X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY);
  2925. }
  2926. }
  2927. static const int minbits_table[] = { 80, 112, 128, 192, 256 };
  2928. static const int NUM_AUTH_LEVELS = OSSL_NELEM(minbits_table);
  2929. /*
  2930. * Check whether the public key of ``cert`` meets the security level of
  2931. * ``ctx``.
  2932. *
  2933. * Returns 1 on success, 0 otherwise.
  2934. */
  2935. static int check_key_level(X509_STORE_CTX *ctx, X509 *cert)
  2936. {
  2937. EVP_PKEY *pkey = X509_get0_pubkey(cert);
  2938. int level = ctx->param->auth_level;
  2939. /*
  2940. * At security level zero, return without checking for a supported public
  2941. * key type. Some engines support key types not understood outside the
  2942. * engine, and we only need to understand the key when enforcing a security
  2943. * floor.
  2944. */
  2945. if (level <= 0)
  2946. return 1;
  2947. /* Unsupported or malformed keys are not secure */
  2948. if (pkey == NULL)
  2949. return 0;
  2950. if (level > NUM_AUTH_LEVELS)
  2951. level = NUM_AUTH_LEVELS;
  2952. return EVP_PKEY_security_bits(pkey) >= minbits_table[level - 1];
  2953. }
  2954. /*
  2955. * Check whether the signature digest algorithm of ``cert`` meets the security
  2956. * level of ``ctx``. Should not be checked for trust anchors (whether
  2957. * self-signed or otherwise).
  2958. *
  2959. * Returns 1 on success, 0 otherwise.
  2960. */
  2961. static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert)
  2962. {
  2963. int secbits = -1;
  2964. int level = ctx->param->auth_level;
  2965. if (level <= 0)
  2966. return 1;
  2967. if (level > NUM_AUTH_LEVELS)
  2968. level = NUM_AUTH_LEVELS;
  2969. if (!X509_get_signature_info(cert, NULL, NULL, &secbits, NULL))
  2970. return 0;
  2971. return secbits >= minbits_table[level - 1];
  2972. }