1 /* 2 * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/refcount.h" 11 12 #define X509V3_conf_add_error_name_value(val) \ 13 ERR_add_error_data(4, "name=", (val)->name, ", value=", (val)->value) 14 15 /* 16 * This structure holds all parameters associated with a verify operation by 17 * including an X509_VERIFY_PARAM structure in related structures the 18 * parameters used can be customized 19 */ 20 21 struct X509_VERIFY_PARAM_st { 22 char *name; 23 time_t check_time; /* Time to use */ 24 uint32_t inh_flags; /* Inheritance flags */ 25 unsigned long flags; /* Various verify flags */ 26 int purpose; /* purpose to check untrusted certificates */ 27 int trust; /* trust setting to check */ 28 int depth; /* Verify depth */ 29 int auth_level; /* Security level for chain verification */ 30 STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ 31 /* Peer identity details */ 32 STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ 33 unsigned int hostflags; /* Flags to control matching features */ 34 char *peername; /* Matching hostname in peer certificate */ 35 char *email; /* If not NULL email address to match */ 36 size_t emaillen; 37 unsigned char *ip; /* If not NULL IP address to match */ 38 size_t iplen; /* Length of IP address */ 39 }; 40 41 /* No error callback if depth < 0 */ 42 int ossl_x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth); 43 44 /* a sequence of these are used */ 45 struct x509_attributes_st { 46 ASN1_OBJECT *object; 47 STACK_OF(ASN1_TYPE) *set; 48 }; 49 50 struct X509_extension_st { 51 ASN1_OBJECT *object; 52 ASN1_BOOLEAN critical; 53 ASN1_OCTET_STRING value; 54 }; 55 56 /* 57 * Method to handle CRL access. In general a CRL could be very large (several 58 * Mb) and can consume large amounts of resources if stored in memory by 59 * multiple processes. This method allows general CRL operations to be 60 * redirected to more efficient callbacks: for example a CRL entry database. 61 */ 62 63 #define X509_CRL_METHOD_DYNAMIC 1 64 65 struct x509_crl_method_st { 66 int flags; 67 int (*crl_init)(X509_CRL *crl); 68 int (*crl_free)(X509_CRL *crl); 69 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret, 70 const ASN1_INTEGER *ser, const X509_NAME *issuer); 71 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk); 72 }; 73 74 struct x509_lookup_method_st { 75 char *name; 76 int (*new_item)(X509_LOOKUP *ctx); 77 void (*free)(X509_LOOKUP *ctx); 78 int (*init)(X509_LOOKUP *ctx); 79 int (*shutdown)(X509_LOOKUP *ctx); 80 int (*ctrl)(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, 81 char **ret); 82 int (*get_by_subject)(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 83 const X509_NAME *name, X509_OBJECT *ret); 84 int (*get_by_issuer_serial)(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 85 const X509_NAME *name, 86 const ASN1_INTEGER *serial, 87 X509_OBJECT *ret); 88 int (*get_by_fingerprint)(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 89 const unsigned char *bytes, int len, 90 X509_OBJECT *ret); 91 int (*get_by_alias)(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 92 const char *str, int len, X509_OBJECT *ret); 93 int (*get_by_subject_ex)(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type, 94 const X509_NAME *name, X509_OBJECT *ret, 95 OSSL_LIB_CTX *libctx, const char *propq); 96 int (*ctrl_ex)(X509_LOOKUP *ctx, int cmd, const char *argc, long argl, 97 char **ret, OSSL_LIB_CTX *libctx, const char *propq); 98 }; 99 100 /* This is the functions plus an instance of the local variables. */ 101 struct x509_lookup_st { 102 int init; /* have we been started */ 103 int skip; /* don't use us. */ 104 X509_LOOKUP_METHOD *method; /* the functions */ 105 void *method_data; /* method data */ 106 X509_STORE *store_ctx; /* who owns us */ 107 }; 108 109 /* 110 * This is used to hold everything. It is used for all certificate 111 * validation. Once we have a certificate chain, the 'verify' function is 112 * then called to actually check the cert chain. 113 */ 114 struct x509_store_st { 115 /* The following is a cache of trusted certs */ 116 int cache; /* if true, stash any hits */ 117 STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */ 118 /* These are external lookup methods */ 119 STACK_OF(X509_LOOKUP) *get_cert_methods; 120 X509_VERIFY_PARAM *param; 121 /* Callbacks for various operations */ 122 /* called to verify a certificate */ 123 int (*verify)(X509_STORE_CTX *ctx); 124 /* error callback */ 125 int (*verify_cb)(int ok, X509_STORE_CTX *ctx); 126 /* get issuers cert from ctx */ 127 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); 128 /* check issued */ 129 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); 130 /* Check revocation status of chain */ 131 int (*check_revocation)(X509_STORE_CTX *ctx); 132 /* retrieve CRL */ 133 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); 134 /* Check CRL validity */ 135 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); 136 /* Check certificate against CRL */ 137 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); 138 /* Check policy status of the chain */ 139 int (*check_policy)(X509_STORE_CTX *ctx); 140 STACK_OF(X509) *(*lookup_certs)(X509_STORE_CTX *ctx, 141 const X509_NAME *nm); 142 /* cannot constify 'ctx' param due to lookup_certs_sk() in x509_vfy.c */ 143 STACK_OF(X509_CRL) *(*lookup_crls)(const X509_STORE_CTX *ctx, 144 const X509_NAME *nm); 145 int (*cleanup)(X509_STORE_CTX *ctx); 146 CRYPTO_EX_DATA ex_data; 147 CRYPTO_REF_COUNT references; 148 CRYPTO_RWLOCK *lock; 149 }; 150 151 typedef struct lookup_dir_hashes_st BY_DIR_HASH; 152 typedef struct lookup_dir_entry_st BY_DIR_ENTRY; 153 DEFINE_STACK_OF(BY_DIR_HASH) 154 DEFINE_STACK_OF(BY_DIR_ENTRY) 155 typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY; 156 DEFINE_STACK_OF(STACK_OF_X509_NAME_ENTRY) 157 158 int ossl_x509_likely_issued(X509 *issuer, X509 *subject); 159 int ossl_x509_signing_allowed(const X509 *issuer, const X509 *subject); 160 int ossl_x509_store_ctx_get_by_subject(const X509_STORE_CTX *ctx, X509_LOOKUP_TYPE type, 161 const X509_NAME *name, X509_OBJECT *ret); 162 int ossl_x509_store_read_lock(X509_STORE *xs); 163