blob: fd62a418efa1e7a5efee5709c4fd41c629b1b1d8 [file] [log] [blame]
Adam Langley95c29f32014-06-20 12:00:00 -07001/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57/* ====================================================================
58 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com).
108 *
109 */
110/* ====================================================================
111 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
112 * ECC cipher suite support in OpenSSL originally developed by
113 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. */
114
David Benjaminf0ae1702015-04-07 23:05:04 -0400115#include <errno.h>
Adam Langley95c29f32014-06-20 12:00:00 -0700116#include <stdio.h>
David Benjaminf0ae1702015-04-07 23:05:04 -0400117#include <string.h>
Adam Langley95c29f32014-06-20 12:00:00 -0700118
119#include <openssl/bio.h>
120#include <openssl/bn.h>
David Benjamin676d1e72014-07-08 14:34:10 -0400121#include <openssl/buf.h>
David Benjamin680ca962015-06-18 12:37:23 -0400122#include <openssl/ec_key.h>
Adam Langley95c29f32014-06-20 12:00:00 -0700123#include <openssl/dh.h>
124#include <openssl/err.h>
125#include <openssl/mem.h>
126#include <openssl/obj.h>
127#include <openssl/pem.h>
David Benjamin680ca962015-06-18 12:37:23 -0400128#include <openssl/x509.h>
Adam Langley95c29f32014-06-20 12:00:00 -0700129#include <openssl/x509v3.h>
130
131#include "../crypto/dh/internal.h"
132#include "../crypto/directory.h"
Adam Langley0da323a2015-05-15 12:49:30 -0700133#include "../crypto/internal.h"
David Benjamin2ee94aa2015-04-07 22:38:30 -0400134#include "internal.h"
Adam Langley95c29f32014-06-20 12:00:00 -0700135
Adam Langley95c29f32014-06-20 12:00:00 -0700136
Adam Langleyfcf25832014-12-18 17:42:32 -0800137int SSL_get_ex_data_X509_STORE_CTX_idx(void) {
David Benjaminaa585132015-06-29 23:36:17 -0400138 /* The ex_data index to go from |X509_STORE_CTX| to |SSL| always uses the
139 * reserved app_data slot. Before ex_data was introduced, app_data was used.
140 * Avoid breaking any software which assumes |X509_STORE_CTX_get_app_data|
141 * works. */
142 return 0;
Adam Langleyfcf25832014-12-18 17:42:32 -0800143}
Adam Langley95c29f32014-06-20 12:00:00 -0700144
Adam Langleyfcf25832014-12-18 17:42:32 -0800145CERT *ssl_cert_new(void) {
David Benjamind1d80782015-07-05 11:54:09 -0400146 CERT *ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
Adam Langleyfcf25832014-12-18 17:42:32 -0800147 if (ret == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400148 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
Adam Langleyfcf25832014-12-18 17:42:32 -0800149 return NULL;
150 }
151 memset(ret, 0, sizeof(CERT));
Adam Langley95c29f32014-06-20 12:00:00 -0700152
Adam Langleyfcf25832014-12-18 17:42:32 -0800153 return ret;
154}
Adam Langley95c29f32014-06-20 12:00:00 -0700155
Adam Langleyfcf25832014-12-18 17:42:32 -0800156CERT *ssl_cert_dup(CERT *cert) {
David Benjamind1d80782015-07-05 11:54:09 -0400157 CERT *ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
Adam Langleyfcf25832014-12-18 17:42:32 -0800158 if (ret == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400159 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
Adam Langleyfcf25832014-12-18 17:42:32 -0800160 return NULL;
161 }
Adam Langleyfcf25832014-12-18 17:42:32 -0800162 memset(ret, 0, sizeof(CERT));
Adam Langley95c29f32014-06-20 12:00:00 -0700163
Adam Langleyfcf25832014-12-18 17:42:32 -0800164 ret->mask_k = cert->mask_k;
165 ret->mask_a = cert->mask_a;
Adam Langley95c29f32014-06-20 12:00:00 -0700166
Adam Langleyfcf25832014-12-18 17:42:32 -0800167 if (cert->dh_tmp != NULL) {
168 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
169 if (ret->dh_tmp == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400170 OPENSSL_PUT_ERROR(SSL, ERR_R_DH_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800171 goto err;
172 }
173 if (cert->dh_tmp->priv_key) {
174 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
175 if (!b) {
David Benjamin3570d732015-06-29 00:28:17 -0400176 OPENSSL_PUT_ERROR(SSL, ERR_R_BN_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800177 goto err;
178 }
179 ret->dh_tmp->priv_key = b;
180 }
181 if (cert->dh_tmp->pub_key) {
182 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
183 if (!b) {
David Benjamin3570d732015-06-29 00:28:17 -0400184 OPENSSL_PUT_ERROR(SSL, ERR_R_BN_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800185 goto err;
186 }
187 ret->dh_tmp->pub_key = b;
188 }
189 }
190 ret->dh_tmp_cb = cert->dh_tmp_cb;
Adam Langley95c29f32014-06-20 12:00:00 -0700191
David Benjaminc0f763b2015-03-27 02:05:39 -0400192 ret->ecdh_nid = cert->ecdh_nid;
Adam Langleyfcf25832014-12-18 17:42:32 -0800193 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
Adam Langley95c29f32014-06-20 12:00:00 -0700194
David Benjamind1d80782015-07-05 11:54:09 -0400195 if (cert->x509 != NULL) {
196 ret->x509 = X509_up_ref(cert->x509);
197 }
Adam Langley95c29f32014-06-20 12:00:00 -0700198
David Benjamind1d80782015-07-05 11:54:09 -0400199 if (cert->privatekey != NULL) {
200 ret->privatekey = EVP_PKEY_up_ref(cert->privatekey);
201 }
Adam Langley95c29f32014-06-20 12:00:00 -0700202
David Benjamind1d80782015-07-05 11:54:09 -0400203 if (cert->chain) {
204 ret->chain = X509_chain_up_ref(cert->chain);
205 if (!ret->chain) {
David Benjamin3570d732015-06-29 00:28:17 -0400206 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
David Benjamind1d80782015-07-05 11:54:09 -0400207 goto err;
Adam Langleyfcf25832014-12-18 17:42:32 -0800208 }
209 }
Adam Langley95c29f32014-06-20 12:00:00 -0700210
Adam Langleyfcf25832014-12-18 17:42:32 -0800211 ret->cert_cb = cert->cert_cb;
212 ret->cert_cb_arg = cert->cert_cb_arg;
213
Adam Langleyfcf25832014-12-18 17:42:32 -0800214 return ret;
215
Adam Langley95c29f32014-06-20 12:00:00 -0700216err:
Adam Langleyfcf25832014-12-18 17:42:32 -0800217 ssl_cert_free(ret);
218 return NULL;
219}
Adam Langley95c29f32014-06-20 12:00:00 -0700220
221/* Free up and clear all certificates and chains */
David Benjamind1d80782015-07-05 11:54:09 -0400222void ssl_cert_clear_certs(CERT *cert) {
223 if (cert == NULL) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800224 return;
225 }
Adam Langley95c29f32014-06-20 12:00:00 -0700226
David Benjamind1d80782015-07-05 11:54:09 -0400227 X509_free(cert->x509);
228 cert->x509 = NULL;
229 EVP_PKEY_free(cert->privatekey);
230 cert->privatekey = NULL;
231 sk_X509_pop_free(cert->chain, X509_free);
232 cert->chain = NULL;
David Benjamin71d2e542015-07-06 00:30:25 -0400233 cert->key_method = NULL;
Adam Langleyfcf25832014-12-18 17:42:32 -0800234}
Adam Langley95c29f32014-06-20 12:00:00 -0700235
Adam Langleyfcf25832014-12-18 17:42:32 -0800236void ssl_cert_free(CERT *c) {
237 if (c == NULL) {
238 return;
239 }
Adam Langley95c29f32014-06-20 12:00:00 -0700240
David Benjamin2755a3e2015-04-22 16:17:58 -0400241 DH_free(c->dh_tmp);
Adam Langley95c29f32014-06-20 12:00:00 -0700242
Adam Langleyfcf25832014-12-18 17:42:32 -0800243 ssl_cert_clear_certs(c);
David Benjamin2755a3e2015-04-22 16:17:58 -0400244 OPENSSL_free(c->peer_sigalgs);
David Benjamin2755a3e2015-04-22 16:17:58 -0400245 OPENSSL_free(c->shared_sigalgs);
Adam Langley95c29f32014-06-20 12:00:00 -0700246
Adam Langleyfcf25832014-12-18 17:42:32 -0800247 OPENSSL_free(c);
248}
Adam Langley95c29f32014-06-20 12:00:00 -0700249
David Benjamind1d80782015-07-05 11:54:09 -0400250int ssl_cert_set0_chain(CERT *cert, STACK_OF(X509) *chain) {
251 sk_X509_pop_free(cert->chain, X509_free);
252 cert->chain = chain;
Adam Langleyfcf25832014-12-18 17:42:32 -0800253 return 1;
254}
Adam Langley95c29f32014-06-20 12:00:00 -0700255
David Benjamind1d80782015-07-05 11:54:09 -0400256int ssl_cert_set1_chain(CERT *cert, STACK_OF(X509) *chain) {
David Benjamin60da0cd2015-05-03 15:21:28 -0400257 STACK_OF(X509) *dchain;
David Benjamind1d80782015-07-05 11:54:09 -0400258 if (chain == NULL) {
259 return ssl_cert_set0_chain(cert, NULL);
Adam Langleyfcf25832014-12-18 17:42:32 -0800260 }
Adam Langley95c29f32014-06-20 12:00:00 -0700261
Adam Langleyfcf25832014-12-18 17:42:32 -0800262 dchain = X509_chain_up_ref(chain);
David Benjamind1d80782015-07-05 11:54:09 -0400263 if (dchain == NULL) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800264 return 0;
265 }
Adam Langley95c29f32014-06-20 12:00:00 -0700266
David Benjamind1d80782015-07-05 11:54:09 -0400267 if (!ssl_cert_set0_chain(cert, dchain)) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800268 sk_X509_pop_free(dchain, X509_free);
269 return 0;
270 }
Adam Langley95c29f32014-06-20 12:00:00 -0700271
Adam Langleyfcf25832014-12-18 17:42:32 -0800272 return 1;
273}
Adam Langley95c29f32014-06-20 12:00:00 -0700274
David Benjamind1d80782015-07-05 11:54:09 -0400275int ssl_cert_add0_chain_cert(CERT *cert, X509 *x509) {
276 if (cert->chain == NULL) {
277 cert->chain = sk_X509_new_null();
Adam Langleyfcf25832014-12-18 17:42:32 -0800278 }
David Benjamind1d80782015-07-05 11:54:09 -0400279 if (cert->chain == NULL || !sk_X509_push(cert->chain, x509)) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800280 return 0;
281 }
Adam Langley95c29f32014-06-20 12:00:00 -0700282
Adam Langleyfcf25832014-12-18 17:42:32 -0800283 return 1;
284}
Adam Langley95c29f32014-06-20 12:00:00 -0700285
David Benjamind1d80782015-07-05 11:54:09 -0400286int ssl_cert_add1_chain_cert(CERT *cert, X509 *x509) {
287 if (!ssl_cert_add0_chain_cert(cert, x509)) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800288 return 0;
289 }
Adam Langley95c29f32014-06-20 12:00:00 -0700290
David Benjamind1d80782015-07-05 11:54:09 -0400291 X509_up_ref(x509);
Adam Langleyfcf25832014-12-18 17:42:32 -0800292 return 1;
293}
Adam Langley95c29f32014-06-20 12:00:00 -0700294
Adam Langleyfcf25832014-12-18 17:42:32 -0800295void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg), void *arg) {
296 c->cert_cb = cb;
297 c->cert_cb_arg = arg;
298}
Adam Langley95c29f32014-06-20 12:00:00 -0700299
David Benjamin60da0cd2015-05-03 15:21:28 -0400300int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800301 X509 *x;
302 int i;
Adam Langleyfcf25832014-12-18 17:42:32 -0800303 X509_STORE_CTX ctx;
Adam Langley95c29f32014-06-20 12:00:00 -0700304
Adam Langleyfcf25832014-12-18 17:42:32 -0800305 if (sk == NULL || sk_X509_num(sk) == 0) {
306 return 0;
307 }
Adam Langley95c29f32014-06-20 12:00:00 -0700308
Adam Langleyfcf25832014-12-18 17:42:32 -0800309 x = sk_X509_value(sk, 0);
David Benjamind27441a2015-08-09 11:05:17 -0400310 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
David Benjamin3570d732015-06-29 00:28:17 -0400311 OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800312 return 0;
313 }
314 X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s);
Adam Langley95c29f32014-06-20 12:00:00 -0700315
Adam Langleyfcf25832014-12-18 17:42:32 -0800316 /* We need to inherit the verify parameters. These can be determined by the
317 * context: if its a server it will verify SSL client certificates or vice
318 * versa. */
319 X509_STORE_CTX_set_default(&ctx, s->server ? "ssl_client" : "ssl_server");
Adam Langley95c29f32014-06-20 12:00:00 -0700320
Adam Langleyfcf25832014-12-18 17:42:32 -0800321 /* Anything non-default in "param" should overwrite anything in the ctx. */
322 X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx), s->param);
Adam Langley95c29f32014-06-20 12:00:00 -0700323
Adam Langleyfcf25832014-12-18 17:42:32 -0800324 if (s->verify_callback) {
325 X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback);
326 }
Adam Langley95c29f32014-06-20 12:00:00 -0700327
Adam Langleyfcf25832014-12-18 17:42:32 -0800328 if (s->ctx->app_verify_callback != NULL) {
329 i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg);
330 } else {
331 i = X509_verify_cert(&ctx);
332 }
Adam Langley95c29f32014-06-20 12:00:00 -0700333
Adam Langleyfcf25832014-12-18 17:42:32 -0800334 s->verify_result = ctx.error;
335 X509_STORE_CTX_cleanup(&ctx);
Adam Langley95c29f32014-06-20 12:00:00 -0700336
Adam Langleyfcf25832014-12-18 17:42:32 -0800337 return i;
338}
Adam Langley95c29f32014-06-20 12:00:00 -0700339
David Benjamin60da0cd2015-05-03 15:21:28 -0400340static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,
341 STACK_OF(X509_NAME) *name_list) {
David Benjamin2755a3e2015-04-22 16:17:58 -0400342 sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
Adam Langleyfcf25832014-12-18 17:42:32 -0800343 *ca_list = name_list;
344}
Adam Langley95c29f32014-06-20 12:00:00 -0700345
David Benjamin60da0cd2015-05-03 15:21:28 -0400346STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800347 size_t i;
David Benjamin60da0cd2015-05-03 15:21:28 -0400348 STACK_OF(X509_NAME) *ret;
Adam Langleyfcf25832014-12-18 17:42:32 -0800349 X509_NAME *name;
350
351 ret = sk_X509_NAME_new_null();
352 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
353 name = X509_NAME_dup(sk_X509_NAME_value(sk, i));
354 if (name == NULL || !sk_X509_NAME_push(ret, name)) {
355 sk_X509_NAME_pop_free(ret, X509_NAME_free);
356 return NULL;
357 }
358 }
359
360 return ret;
361}
362
David Benjamin60da0cd2015-05-03 15:21:28 -0400363void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800364 set_client_CA_list(&(s->client_CA), name_list);
365}
366
David Benjamin60da0cd2015-05-03 15:21:28 -0400367void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800368 set_client_CA_list(&(ctx->client_CA), name_list);
369}
370
David Benjamin60da0cd2015-05-03 15:21:28 -0400371STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800372 return ctx->client_CA;
373}
374
David Benjamin60da0cd2015-05-03 15:21:28 -0400375STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800376 if (s->server) {
377 if (s->client_CA != NULL) {
378 return s->client_CA;
379 } else {
380 return s->ctx->client_CA;
381 }
382 } else {
383 if ((s->version >> 8) == SSL3_VERSION_MAJOR && s->s3 != NULL) {
384 return s->s3->tmp.ca_names;
385 } else {
386 return NULL;
387 }
388 }
389}
390
David Benjamin60da0cd2015-05-03 15:21:28 -0400391static int add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800392 X509_NAME *name;
393
394 if (x == NULL) {
395 return 0;
396 }
397 if (*sk == NULL) {
398 *sk = sk_X509_NAME_new_null();
399 if (*sk == NULL) {
400 return 0;
401 }
402 }
403
404 name = X509_NAME_dup(X509_get_subject_name(x));
405 if (name == NULL) {
406 return 0;
407 }
408
409 if (!sk_X509_NAME_push(*sk, name)) {
410 X509_NAME_free(name);
411 return 0;
412 }
413
414 return 1;
415}
416
417int SSL_add_client_CA(SSL *ssl, X509 *x) {
418 return add_client_CA(&(ssl->client_CA), x);
419}
420
421int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x) {
422 return add_client_CA(&(ctx->client_CA), x);
423}
424
425static int xname_cmp(const X509_NAME **a, const X509_NAME **b) {
426 return X509_NAME_cmp(*a, *b);
427}
428
429/* Load CA certs from a file into a STACK. Note that it is somewhat misnamed;
Adam Langley95c29f32014-06-20 12:00:00 -0700430 * it doesn't really have anything to do with clients (except that a common use
431 * for a stack of CAs is to send it to the client). Actually, it doesn't have
432 * much to do with CAs, either, since it will load any old cert.
Adam Langleyfcf25832014-12-18 17:42:32 -0800433 *
Adam Langley95c29f32014-06-20 12:00:00 -0700434 * \param file the file containing one or more certs.
Adam Langleyfcf25832014-12-18 17:42:32 -0800435 * \return a ::STACK containing the certs. */
David Benjamin60da0cd2015-05-03 15:21:28 -0400436STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800437 BIO *in;
438 X509 *x = NULL;
439 X509_NAME *xn = NULL;
440 STACK_OF(X509_NAME) *ret = NULL, *sk;
Adam Langley95c29f32014-06-20 12:00:00 -0700441
Adam Langleyfcf25832014-12-18 17:42:32 -0800442 sk = sk_X509_NAME_new(xname_cmp);
443 in = BIO_new(BIO_s_file());
Adam Langley95c29f32014-06-20 12:00:00 -0700444
Adam Langleyfcf25832014-12-18 17:42:32 -0800445 if (sk == NULL || in == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400446 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
Adam Langleyfcf25832014-12-18 17:42:32 -0800447 goto err;
448 }
Adam Langley95c29f32014-06-20 12:00:00 -0700449
Adam Langleyfcf25832014-12-18 17:42:32 -0800450 if (!BIO_read_filename(in, file)) {
451 goto err;
452 }
Adam Langley95c29f32014-06-20 12:00:00 -0700453
Adam Langleyfcf25832014-12-18 17:42:32 -0800454 for (;;) {
455 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL) {
456 break;
457 }
458 if (ret == NULL) {
459 ret = sk_X509_NAME_new_null();
460 if (ret == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400461 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
Adam Langleyfcf25832014-12-18 17:42:32 -0800462 goto err;
463 }
464 }
465 xn = X509_get_subject_name(x);
466 if (xn == NULL) {
467 goto err;
468 }
Adam Langley95c29f32014-06-20 12:00:00 -0700469
Adam Langleyfcf25832014-12-18 17:42:32 -0800470 /* check for duplicates */
471 xn = X509_NAME_dup(xn);
472 if (xn == NULL) {
473 goto err;
474 }
475 if (sk_X509_NAME_find(sk, NULL, xn)) {
476 X509_NAME_free(xn);
477 } else {
478 sk_X509_NAME_push(sk, xn);
479 sk_X509_NAME_push(ret, xn);
480 }
481 }
Adam Langley95c29f32014-06-20 12:00:00 -0700482
Adam Langleyfcf25832014-12-18 17:42:32 -0800483 if (0) {
484 err:
David Benjamin2755a3e2015-04-22 16:17:58 -0400485 sk_X509_NAME_pop_free(ret, X509_NAME_free);
Adam Langleyfcf25832014-12-18 17:42:32 -0800486 ret = NULL;
487 }
488
David Benjamin2755a3e2015-04-22 16:17:58 -0400489 sk_X509_NAME_free(sk);
490 BIO_free(in);
491 X509_free(x);
Adam Langleyfcf25832014-12-18 17:42:32 -0800492 if (ret != NULL) {
493 ERR_clear_error();
494 }
495 return ret;
496}
497
498/* Add a file of certs to a stack.
499 *
Adam Langley95c29f32014-06-20 12:00:00 -0700500 * \param stack the stack to add to.
501 * \param file the file to add from. All certs in this file that are not
Adam Langleyfcf25832014-12-18 17:42:32 -0800502 * already in the stack will be added.
Adam Langley95c29f32014-06-20 12:00:00 -0700503 * \return 1 for success, 0 for failure. Note that in the case of failure some
Adam Langleyfcf25832014-12-18 17:42:32 -0800504 * certs may have been added to \c stack. */
David Benjamin60da0cd2015-05-03 15:21:28 -0400505int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
Adam Langleyfcf25832014-12-18 17:42:32 -0800506 const char *file) {
507 BIO *in;
508 X509 *x = NULL;
509 X509_NAME *xn = NULL;
510 int ret = 1;
511 int (*oldcmp)(const X509_NAME **a, const X509_NAME **b);
Adam Langley95c29f32014-06-20 12:00:00 -0700512
Adam Langleyfcf25832014-12-18 17:42:32 -0800513 oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);
514 in = BIO_new(BIO_s_file());
Adam Langley95c29f32014-06-20 12:00:00 -0700515
Adam Langleyfcf25832014-12-18 17:42:32 -0800516 if (in == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400517 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
Adam Langleyfcf25832014-12-18 17:42:32 -0800518 goto err;
519 }
Adam Langley95c29f32014-06-20 12:00:00 -0700520
Adam Langleyfcf25832014-12-18 17:42:32 -0800521 if (!BIO_read_filename(in, file)) {
522 goto err;
523 }
Adam Langley95c29f32014-06-20 12:00:00 -0700524
Adam Langleyfcf25832014-12-18 17:42:32 -0800525 for (;;) {
526 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL) {
527 break;
528 }
529 xn = X509_get_subject_name(x);
530 if (xn == NULL) {
531 goto err;
532 }
533 xn = X509_NAME_dup(xn);
534 if (xn == NULL) {
535 goto err;
536 }
537 if (sk_X509_NAME_find(stack, NULL, xn)) {
538 X509_NAME_free(xn);
539 } else {
540 sk_X509_NAME_push(stack, xn);
541 }
542 }
Adam Langley95c29f32014-06-20 12:00:00 -0700543
Adam Langleyfcf25832014-12-18 17:42:32 -0800544 ERR_clear_error();
545
546 if (0) {
547 err:
548 ret = 0;
549 }
550
David Benjamin2755a3e2015-04-22 16:17:58 -0400551 BIO_free(in);
552 X509_free(x);
Adam Langleyfcf25832014-12-18 17:42:32 -0800553
Adam Langleya307dfd2015-01-09 15:42:58 -0800554 (void) sk_X509_NAME_set_cmp_func(stack, oldcmp);
Adam Langleyfcf25832014-12-18 17:42:32 -0800555
556 return ret;
557}
558
559/* Add a directory of certs to a stack.
560 *
Adam Langley95c29f32014-06-20 12:00:00 -0700561 * \param stack the stack to append to.
562 * \param dir the directory to append from. All files in this directory will be
Adam Langleyfcf25832014-12-18 17:42:32 -0800563 * examined as potential certs. Any that are acceptable to
564 * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will
565 * be included.
Adam Langley95c29f32014-06-20 12:00:00 -0700566 * \return 1 for success, 0 for failure. Note that in the case of failure some
Adam Langleyfcf25832014-12-18 17:42:32 -0800567 * certs may have been added to \c stack. */
David Benjamin60da0cd2015-05-03 15:21:28 -0400568int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
Adam Langleyfcf25832014-12-18 17:42:32 -0800569 const char *dir) {
570 OPENSSL_DIR_CTX *d = NULL;
571 const char *filename;
572 int ret = 0;
Adam Langley95c29f32014-06-20 12:00:00 -0700573
Adam Langleyfcf25832014-12-18 17:42:32 -0800574 /* Note that a side effect is that the CAs will be sorted by name */
575 while ((filename = OPENSSL_DIR_read(&d, dir))) {
576 char buf[1024];
577 int r;
Adam Langley95c29f32014-06-20 12:00:00 -0700578
Adam Langleyfcf25832014-12-18 17:42:32 -0800579 if (strlen(dir) + strlen(filename) + 2 > sizeof(buf)) {
David Benjamin3570d732015-06-29 00:28:17 -0400580 OPENSSL_PUT_ERROR(SSL, SSL_R_PATH_TOO_LONG);
Adam Langleyfcf25832014-12-18 17:42:32 -0800581 goto err;
582 }
Adam Langley95c29f32014-06-20 12:00:00 -0700583
Adam Langleyfcf25832014-12-18 17:42:32 -0800584 r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename);
585 if (r <= 0 || r >= (int)sizeof(buf) ||
586 !SSL_add_file_cert_subjects_to_stack(stack, buf)) {
587 goto err;
588 }
589 }
Adam Langley95c29f32014-06-20 12:00:00 -0700590
Adam Langleyfcf25832014-12-18 17:42:32 -0800591 if (errno) {
David Benjamin3570d732015-06-29 00:28:17 -0400592 OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800593 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
594 goto err;
595 }
Adam Langley95c29f32014-06-20 12:00:00 -0700596
Adam Langleyfcf25832014-12-18 17:42:32 -0800597 ret = 1;
Adam Langley95c29f32014-06-20 12:00:00 -0700598
599err:
Adam Langleyfcf25832014-12-18 17:42:32 -0800600 if (d) {
601 OPENSSL_DIR_end(&d);
602 }
Adam Langleyfcf25832014-12-18 17:42:32 -0800603 return ret;
604}
Adam Langley95c29f32014-06-20 12:00:00 -0700605
606/* Add a certificate to a BUF_MEM structure */
Adam Langleyfcf25832014-12-18 17:42:32 -0800607static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x) {
608 int n;
609 uint8_t *p;
Adam Langley95c29f32014-06-20 12:00:00 -0700610
Adam Langleyfcf25832014-12-18 17:42:32 -0800611 n = i2d_X509(x, NULL);
612 if (!BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
David Benjamin3570d732015-06-29 00:28:17 -0400613 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
Adam Langleyfcf25832014-12-18 17:42:32 -0800614 return 0;
615 }
616 p = (uint8_t *)&(buf->data[*l]);
617 l2n3(n, p);
618 i2d_X509(x, &p);
619 *l += n + 3;
Adam Langley95c29f32014-06-20 12:00:00 -0700620
Adam Langleyfcf25832014-12-18 17:42:32 -0800621 return 1;
622}
Adam Langley95c29f32014-06-20 12:00:00 -0700623
Adam Langley24819752014-12-15 18:42:07 -0800624/* Add certificate chain to internal SSL BUF_MEM structure. */
David Benjamind1d80782015-07-05 11:54:09 -0400625int ssl_add_cert_chain(SSL *ssl, unsigned long *l) {
626 CERT *cert = ssl->cert;
627 BUF_MEM *buf = ssl->init_buf;
Adam Langleyfcf25832014-12-18 17:42:32 -0800628 int no_chain = 0;
629 size_t i;
Adam Langley95c29f32014-06-20 12:00:00 -0700630
David Benjamind1d80782015-07-05 11:54:09 -0400631 X509 *x = cert->x509;
632 STACK_OF(X509) *chain = cert->chain;
Adam Langley95c29f32014-06-20 12:00:00 -0700633
David Benjamin605641e2015-05-03 15:14:04 -0400634 if (x == NULL) {
David Benjamin3570d732015-06-29 00:28:17 -0400635 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATE_SET);
David Benjamin605641e2015-05-03 15:14:04 -0400636 return 0;
Adam Langleyfcf25832014-12-18 17:42:32 -0800637 }
Adam Langley95c29f32014-06-20 12:00:00 -0700638
David Benjamind1d80782015-07-05 11:54:09 -0400639 if ((ssl->mode & SSL_MODE_NO_AUTO_CHAIN) || chain != NULL) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800640 no_chain = 1;
641 }
Adam Langley95c29f32014-06-20 12:00:00 -0700642
David Benjamin605641e2015-05-03 15:14:04 -0400643 if (no_chain) {
Adam Langleyfcf25832014-12-18 17:42:32 -0800644 if (!ssl_add_cert_to_buf(buf, l, x)) {
645 return 0;
646 }
David Benjamin605641e2015-05-03 15:14:04 -0400647
David Benjamind1d80782015-07-05 11:54:09 -0400648 for (i = 0; i < sk_X509_num(chain); i++) {
649 x = sk_X509_value(chain, i);
David Benjamin605641e2015-05-03 15:14:04 -0400650 if (!ssl_add_cert_to_buf(buf, l, x)) {
651 return 0;
652 }
653 }
654 } else {
655 X509_STORE_CTX xs_ctx;
656
David Benjamind27441a2015-08-09 11:05:17 -0400657 if (!X509_STORE_CTX_init(&xs_ctx, ssl->ctx->cert_store, x, NULL)) {
David Benjamin3570d732015-06-29 00:28:17 -0400658 OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB);
David Benjamin605641e2015-05-03 15:14:04 -0400659 return 0;
660 }
661 X509_verify_cert(&xs_ctx);
662 /* Don't leave errors in the queue */
663 ERR_clear_error();
664 for (i = 0; i < sk_X509_num(xs_ctx.chain); i++) {
665 x = sk_X509_value(xs_ctx.chain, i);
666
667 if (!ssl_add_cert_to_buf(buf, l, x)) {
668 X509_STORE_CTX_cleanup(&xs_ctx);
669 return 0;
670 }
671 }
672 X509_STORE_CTX_cleanup(&xs_ctx);
Adam Langleyfcf25832014-12-18 17:42:32 -0800673 }
674
675 return 1;
676}
Adam Langley95c29f32014-06-20 12:00:00 -0700677
David Benjamin11c0f8e2015-07-06 00:18:15 -0400678int SSL_CTX_set0_chain(SSL_CTX *ctx, STACK_OF(X509) *chain) {
679 return ssl_cert_set0_chain(ctx->cert, chain);
680}
681
682int SSL_CTX_set1_chain(SSL_CTX *ctx, STACK_OF(X509) *chain) {
683 return ssl_cert_set1_chain(ctx->cert, chain);
684}
685
686int SSL_set0_chain(SSL *ssl, STACK_OF(X509) *chain) {
687 return ssl_cert_set0_chain(ssl->cert, chain);
688}
689
690int SSL_set1_chain(SSL *ssl, STACK_OF(X509) *chain) {
691 return ssl_cert_set1_chain(ssl->cert, chain);
692}
693
694int SSL_CTX_add0_chain_cert(SSL_CTX *ctx, X509 *x509) {
695 return ssl_cert_add0_chain_cert(ctx->cert, x509);
696}
697
698int SSL_CTX_add1_chain_cert(SSL_CTX *ctx, X509 *x509) {
699 return ssl_cert_add1_chain_cert(ctx->cert, x509);
700}
701
702int SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *x509) {
703 return SSL_CTX_add0_chain_cert(ctx, x509);
704}
705
706int SSL_add0_chain_cert(SSL *ssl, X509 *x509) {
707 return ssl_cert_add0_chain_cert(ssl->cert, x509);
708}
709
710int SSL_add1_chain_cert(SSL *ssl, X509 *x509) {
711 return ssl_cert_add1_chain_cert(ssl->cert, x509);
712}
713
714int SSL_CTX_clear_chain_certs(SSL_CTX *ctx) {
715 return SSL_CTX_set0_chain(ctx, NULL);
716}
717
718int SSL_CTX_clear_extra_chain_certs(SSL_CTX *ctx) {
719 return SSL_CTX_clear_chain_certs(ctx);
720}
721
722int SSL_clear_chain_certs(SSL *ssl) {
723 return SSL_set0_chain(ssl, NULL);
724}
725
726int SSL_CTX_get0_chain_certs(const SSL_CTX *ctx, STACK_OF(X509) **out_chain) {
727 *out_chain = ctx->cert->chain;
728 return 1;
729}
730
731int SSL_CTX_get_extra_chain_certs(const SSL_CTX *ctx,
732 STACK_OF(X509) **out_chain) {
733 return SSL_CTX_get0_chain_certs(ctx, out_chain);
734}
735
736int SSL_get0_chain_certs(const SSL *ssl, STACK_OF(X509) **out_chain) {
737 *out_chain = ssl->cert->chain;
738 return 1;
739}