/* Copyright (C) 1995-1998 Eric Young ([email protected]) * All rights reserved. * * This package is an SSL implementation written * by Eric Young ([email protected]). * The implementation was written so as to conform with Netscapes SSL. * * This library is free for commercial and non-commercial use as long as * the following conditions are aheared to. The following conditions * apply to all code found in this distribution, be it the RC4, RSA, * lhash, DES, etc., code; not just the SSL code. The SSL documentation * included with this distribution is covered by the same copyright terms * except that the holder is Tim Hudson ([email protected]). * * Copyright remains Eric Young's, and as such any Copyright notices in * the code are not to be removed. * If this package is used in a product, Eric Young should be given attribution * as the author of the parts of the library used. * This can be in the form of a textual message at program startup or * in documentation (online or textual) provided with the package. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * "This product includes cryptographic software written by * Eric Young ([email protected])" * The word 'cryptographic' can be left out if the rouines from the library * being used are not cryptographic related :-). * 4. If you include any Windows specific code (or a derivative thereof) from * the apps directory (application code) you must include an acknowledgement: * "This product includes software written by Tim Hudson ([email protected])" * * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * The licence and distribution terms for any publically available version or * derivative of this code cannot be changed. i.e. this code cannot simply be * copied and put under another distribution licence * [including the GNU Public Licence.] */ #include <ctype.h> #include <limits.h> #include <string.h> #include <time.h> #include <openssl/asn1.h> #include <openssl/err.h> #include <openssl/evp.h> #include <openssl/mem.h> #include <openssl/obj.h> #include <openssl/thread.h> #include <openssl/x509.h> #include "../internal.h" #include "internal.h" static CRYPTO_EX_DATA_CLASS g_ex_data_class = …; // CRL score values // No unhandled critical extensions #define CRL_SCORE_NOCRITICAL … // certificate is within CRL scope #define CRL_SCORE_SCOPE … // CRL times valid #define CRL_SCORE_TIME … // Issuer name matches certificate #define CRL_SCORE_ISSUER_NAME … // If this score or above CRL is probably valid #define CRL_SCORE_VALID … // CRL issuer is certificate issuer #define CRL_SCORE_ISSUER_CERT … // CRL issuer is on certificate path #define CRL_SCORE_SAME_PATH … // CRL issuer matches CRL AKID #define CRL_SCORE_AKID … static int null_callback(int ok, X509_STORE_CTX *e); static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); static int check_chain_extensions(X509_STORE_CTX *ctx); static int check_name_constraints(X509_STORE_CTX *ctx); static int check_id(X509_STORE_CTX *ctx); static int check_trust(X509_STORE_CTX *ctx); static int check_revocation(X509_STORE_CTX *ctx); static int check_cert(X509_STORE_CTX *ctx); static int check_policy(X509_STORE_CTX *ctx); static X509 *get_trusted_issuer(X509_STORE_CTX *ctx, X509 *x); static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, X509_CRL *crl, X509 *x); static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x); static int crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, int *pcrl_score); static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score); static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl); static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); static int internal_verify(X509_STORE_CTX *ctx); static int null_callback(int ok, X509_STORE_CTX *e) { … } // cert_self_signed checks if |x| is self-signed. If |x| is valid, it returns // one and sets |*out_is_self_signed| to the result. If |x| is invalid, it // returns zero. static int cert_self_signed(X509 *x, int *out_is_self_signed) { … } static int call_verify_cb(int ok, X509_STORE_CTX *ctx) { … } // Given a certificate try and find an exact match in the store static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x) { … } int X509_verify_cert(X509_STORE_CTX *ctx) { … } // Given a STACK_OF(X509) find the issuer of cert (if any) static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) { … } // Given a possible certificate and issuer check them int x509_check_issued_with_callback(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) { … } static X509 *get_trusted_issuer(X509_STORE_CTX *ctx, X509 *x) { … } // Check a certificate chains extensions for consistency with the supplied // purpose static int check_chain_extensions(X509_STORE_CTX *ctx) { … } static int reject_dns_name_in_common_name(X509 *x509) { … } static int check_name_constraints(X509_STORE_CTX *ctx) { … } static int check_id_error(X509_STORE_CTX *ctx, int errcode) { … } static int check_hosts(X509 *x, X509_VERIFY_PARAM *param) { … } static int check_id(X509_STORE_CTX *ctx) { … } static int check_trust(X509_STORE_CTX *ctx) { … } static int check_revocation(X509_STORE_CTX *ctx) { … } static int check_cert(X509_STORE_CTX *ctx) { … } // Check CRL times against values in X509_STORE_CTX static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) { … } static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 **pissuer, int *pscore, STACK_OF(X509_CRL) *crls) { … } // For a given CRL return how suitable it is for the supplied certificate // 'x'. The return value is a mask of several criteria. If the issuer is not // the certificate issuer this is returned in *pissuer. static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, X509_CRL *crl, X509 *x) { … } static int crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, int *pcrl_score) { … } // Check for match between two dist point names: three separate cases. 1. // Both are relative names and compare X509_NAME types. 2. One full, one // relative. Compare X509_NAME to GENERAL_NAMES. 3. Both are full names and // compare two GENERAL_NAMES. 4. One is NULL: automatic match. static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b) { … } // Check CRLDP and IDP static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score) { … } // Retrieve CRL corresponding to current certificate. static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x) { … } // Check CRL validity static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) { … } // Check certificate against CRL static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) { … } static int check_policy(X509_STORE_CTX *ctx) { … } static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) { … } static int internal_verify(X509_STORE_CTX *ctx) { … } int X509_cmp_current_time(const ASN1_TIME *ctm) { … } int X509_cmp_time(const ASN1_TIME *ctm, const time_t *cmp_time) { … } int X509_cmp_time_posix(const ASN1_TIME *ctm, int64_t cmp_time) { … } ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long offset_sec) { … } ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, const time_t *in_tm) { … } ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, const time_t *in_tm) { … } int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused, CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) { … } int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) { … } void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx) { … } int X509_STORE_CTX_get_error(const X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err) { … } int X509_STORE_CTX_get_error_depth(const X509_STORE_CTX *ctx) { … } X509 *X509_STORE_CTX_get_current_cert(const X509_STORE_CTX *ctx) { … } STACK_OF(X509) *X509_STORE_CTX_get_chain(const X509_STORE_CTX *ctx) { … } STACK_OF(X509) *X509_STORE_CTX_get0_chain(const X509_STORE_CTX *ctx) { … } STACK_OF(X509) *X509_STORE_CTX_get1_chain(const X509_STORE_CTX *ctx) { … } X509_CRL *X509_STORE_CTX_get0_current_crl(const X509_STORE_CTX *ctx) { … } X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(const X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { … } STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(const X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk) { … } int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose) { … } int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) { … } X509_STORE_CTX *X509_STORE_CTX_new(void) { … } void X509_STORE_CTX_free(X509_STORE_CTX *ctx) { … } int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, STACK_OF(X509) *chain) { … } // Set alternative lookup method: just a STACK of trusted certificates. This // avoids X509_STORE nastiness where it isn't needed. void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { … } void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { … } void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth) { … } void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags) { … } void X509_STORE_CTX_set_time_posix(X509_STORE_CTX *ctx, unsigned long flags, int64_t t) { … } void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, time_t t) { … } X509 *X509_STORE_CTX_get0_cert(const X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, int (*verify_cb)(int, X509_STORE_CTX *)) { … } int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) { … } X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) { … } void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param) { … }
Codebase Browser
chromium