VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/crypto/store.cpp@ 58591

Last change on this file since 58591 was 57613, checked in by vboxsync, 9 years ago

IPRT,UINetworkReply.cpp: Added RTPathGlob, a set of RTCrStoreCertAddWantedDir/File/Store, a RTCrStoreCertAddWantedFromFishingExpedition, RTCrStoreCertCheckWanted, RTCrStoreCertCount, RTFsIsCaseSensitive and RTFileOpenTemp. Reworked some RTHttp bits and UINetworkReply stuff - this needs testing.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 15.0 KB
Line 
1/* $Id: store.cpp 57613 2015-09-04 02:19:44Z vboxsync $ */
2/** @file
3 * IPRT - Cryptographic (Certificate) Store.
4 */
5
6/*
7 * Copyright (C) 2006-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#include "internal/iprt.h"
32#include <iprt/crypto/store.h>
33
34#include <iprt/asm.h>
35#include <iprt/err.h>
36#include <iprt/mem.h>
37#include <iprt/string.h>
38
39#include <iprt/crypto/x509.h>
40
41#ifdef IPRT_WITH_OPENSSL
42# include <openssl/x509.h>
43#endif
44
45#include "store-internal.h"
46
47
48/*********************************************************************************************************************************
49* Structures and Typedefs *
50*********************************************************************************************************************************/
51/**
52 * Internal representation of a (certificate,++) store.
53 */
54typedef struct RTCRSTOREINT
55{
56 /** Magic number (RTCRSTOREINT_MAGIC). */
57 uint32_t u32Magic;
58 /** Reference counter. */
59 uint32_t volatile cRefs;
60 /** Pointer to the store provider. */
61 PCRTCRSTOREPROVIDER pProvider;
62 /** Provider specific data. */
63 void *pvProvider;
64} RTCRSTOREINT;
65/** Pointer to the internal representation of a store. */
66typedef RTCRSTOREINT *PRTCRSTOREINT;
67
68/** Magic value for RTCRSTOREINT::u32Magic (Alfred Dillwyn "Dilly" Knox). */
69#define RTCRSTOREINT_MAGIC UINT32_C(0x18840723)
70/** Dead magic value for RTCRSTOREINT::u32Magic. */
71#define RTCRSTOREINT_MAGIC_DEAD UINT32_C(0x19430227)
72
73
74
75/**
76 * Internal method a store provider uses to create a store handle.
77 *
78 * @returns IPRT status code
79 * @param pProvider Pointer to the store provider callback table.
80 * @param pvProvider Pointer to the provider specific instance data.
81 * @param phStore Where to return the store handle.
82 */
83DECLHIDDEN(int) rtCrStoreCreate(PCRTCRSTOREPROVIDER pProvider, void *pvProvider, PRTCRSTORE phStore)
84{
85 PRTCRSTOREINT pThis = (PRTCRSTOREINT)RTMemAlloc(sizeof(*pThis));
86 if (pThis)
87 {
88 pThis->pvProvider = pvProvider;
89 pThis->pProvider = pProvider;
90 pThis->cRefs = 1;
91 pThis->u32Magic = RTCRSTOREINT_MAGIC;
92 *phStore = pThis;
93 return VINF_SUCCESS;
94 }
95 return VERR_NO_MEMORY;
96}
97
98
99
100RTDECL(uint32_t) RTCrStoreRetain(RTCRSTORE hStore)
101{
102 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
103 AssertPtrReturn(pThis, UINT32_MAX);
104 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, UINT32_MAX);
105
106 uint32_t cRet = ASMAtomicIncU32(&pThis->cRefs);
107 Assert(cRet < 8192);
108 return cRet;
109}
110
111
112RTDECL(uint32_t) RTCrStoreRelease(RTCRSTORE hStore)
113{
114 if (hStore == NIL_RTCRSTORE)
115 return 0;
116
117 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
118 AssertPtrReturn(pThis, UINT32_MAX);
119 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, UINT32_MAX);
120
121 uint32_t cStore = ASMAtomicDecU32(&pThis->cRefs);
122 if (!cStore)
123 {
124 ASMAtomicWriteU32(&pThis->u32Magic, RTCRSTOREINT_MAGIC_DEAD);
125 pThis->pProvider->pfnDestroyStore(pThis->pvProvider);
126 RTMemFree(pThis);
127 }
128 return cStore;
129}
130
131
132RTDECL(PCRTCRCERTCTX) RTCrStoreCertByIssuerAndSerialNo(RTCRSTORE hStore, PCRTCRX509NAME pIssuer, PCRTASN1INTEGER pSerialNo)
133{
134 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
135 AssertPtrReturn(pThis, NULL);
136 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, NULL);
137 AssertPtrReturn(pIssuer, NULL);
138
139 int rc;
140 RTCRSTORECERTSEARCH Search;
141 if (pThis->pProvider->pfnCertFindByIssuerAndSerialNo)
142 rc = pThis->pProvider->pfnCertFindByIssuerAndSerialNo(pThis->pvProvider, pIssuer, pSerialNo, &Search);
143 else
144 rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, &Search);
145
146 PCRTCRCERTCTX pCertCtx = NULL;
147 if (RT_SUCCESS(rc))
148 {
149 for (;;)
150 {
151 pCertCtx = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, &Search);
152 if (!pCertCtx)
153 break;
154
155 if ( pCertCtx->pCert
156 && RTCrX509Certificate_MatchIssuerAndSerialNumber(pCertCtx->pCert, pIssuer, pSerialNo))
157 break;
158 RTCrCertCtxRelease(pCertCtx);
159 }
160
161 pThis->pProvider->pfnCertSearchDestroy(pThis->pvProvider, &Search);
162 }
163 else
164 AssertMsg(rc == VERR_NOT_FOUND, ("%Rrc\n", rc));
165 return pCertCtx;
166}
167
168
169RTDECL(int) RTCrStoreCertAddEncoded(RTCRSTORE hStore, uint32_t fFlags, void const *pvSrc, size_t cbSrc, PRTERRINFO pErrInfo)
170{
171 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
172 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
173 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
174 AssertPtrReturn(pvSrc, VERR_INVALID_POINTER);
175 AssertReturn(cbSrc > 16 && cbSrc < _1M, VERR_OUT_OF_RANGE);
176 AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ENC_MASK)), VERR_INVALID_FLAGS);
177 AssertMsgReturn( (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
178 || (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_TAF_DER
179 , ("Only X.509 and TAF DER supported: %#x\n", fFlags), VERR_INVALID_FLAGS);
180
181 int rc;
182 if (pThis->pProvider->pfnCertAddEncoded)
183 rc = pThis->pProvider->pfnCertAddEncoded(pThis->pvProvider, fFlags, (uint8_t const *)pvSrc, (uint32_t)cbSrc, pErrInfo);
184 else
185 rc = VERR_WRITE_PROTECT;
186
187 return rc;
188}
189
190
191
192/*
193 * Searching.
194 * Searching.
195 * Searching.
196 */
197
198RTDECL(int) RTCrStoreCertFindAll(RTCRSTORE hStore, PRTCRSTORECERTSEARCH pSearch)
199{
200 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
201 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
202 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
203 AssertPtrReturn(pSearch, VERR_INVALID_POINTER);
204
205 return pThis->pProvider->pfnCertFindAll(pThis->pvProvider, pSearch);
206}
207
208
209/** Indicator for RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280 searches
210 * implemented by this front-end code. */
211#define RTCRSTORECERTSEARCH_BY_SUBECT_OR_ALT_SUBJECT_BY_RFC5280 UINT32_C(0x5be9145d)
212
213RTDECL(int) RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280(RTCRSTORE hStore, PCRTCRX509NAME pSubject,
214 PRTCRSTORECERTSEARCH pSearch)
215{
216 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
217 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
218 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
219 AssertPtrReturn(pSearch, VERR_INVALID_POINTER);
220
221 int rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, pSearch);
222 if (RT_SUCCESS(rc))
223 {
224 pSearch->auOpaque[2] = RTCRSTORECERTSEARCH_BY_SUBECT_OR_ALT_SUBJECT_BY_RFC5280;
225 pSearch->auOpaque[3] = (uintptr_t)pSubject;
226 }
227 return rc;
228}
229
230
231RTDECL(PCRTCRCERTCTX) RTCrStoreCertSearchNext(RTCRSTORE hStore, PRTCRSTORECERTSEARCH pSearch)
232{
233 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
234 AssertPtrReturn(pThis, NULL);
235 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, NULL);
236 AssertPtrReturn(pSearch, NULL);
237
238 PCRTCRCERTCTX pRet;
239 switch (pSearch->auOpaque[2])
240 {
241 default:
242 pRet = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, pSearch);
243 break;
244
245 case RTCRSTORECERTSEARCH_BY_SUBECT_OR_ALT_SUBJECT_BY_RFC5280:
246 {
247 PCRTCRX509NAME pSubject = (PCRTCRX509NAME)pSearch->auOpaque[3];
248 AssertPtrReturn(pSubject, NULL);
249
250 for (;;)
251 {
252 pRet = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, pSearch);
253 if (!pRet)
254 break;
255 if (pRet->pCert)
256 {
257 if (RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(pRet->pCert, pSubject))
258 break;
259 }
260 else if (pRet->pTaInfo)
261 {
262 if ( RTCrTafCertPathControls_IsPresent(&pRet->pTaInfo->CertPath)
263 && RTCrX509Name_MatchByRfc5280(&pRet->pTaInfo->CertPath.TaName, pSubject))
264 break;
265 }
266 RTCrCertCtxRelease(pRet);
267 }
268 break;
269 }
270 }
271 return pRet;
272}
273
274
275RTDECL(int) RTCrStoreCertSearchDestroy(RTCRSTORE hStore, PRTCRSTORECERTSEARCH pSearch)
276{
277 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
278 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
279 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
280 if (pSearch)
281 {
282 AssertPtrReturn(pSearch, VERR_INVALID_POINTER);
283 pThis->pProvider->pfnCertSearchDestroy(pThis->pvProvider, pSearch);
284 }
285 return VINF_SUCCESS;
286}
287
288
289
290RTDECL(uint32_t) RTCrStoreCertCount(RTCRSTORE hStore)
291{
292 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
293 AssertPtrReturn(pThis, UINT32_MAX);
294 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, UINT32_MAX);
295
296 RTCRSTORECERTSEARCH Search;
297 int rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, &Search);
298 AssertRCReturn(rc, UINT32_MAX);
299
300
301 uint32_t cCerts = 0;
302 PCRTCRCERTCTX pCur;
303 while ((pCur = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, &Search)) != NULL)
304 {
305 RTCrCertCtxRelease(pCur);
306 cCerts++;
307 }
308
309 return cCerts;
310}
311
312
313#ifdef IPRT_WITH_OPENSSL
314/*
315 * OpenSSL helper.
316 * OpenSSL helper.
317 * OpenSSL helper.
318 */
319
320RTDECL(int) RTCrStoreConvertToOpenSslCertStore(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStore)
321{
322 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
323 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
324 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
325
326 /*
327 * Use the pfnCertFindAll method to add all certificates to the store we're returning.
328 */
329 int rc;
330 X509_STORE *pOsslStore = X509_STORE_new();
331 if (pOsslStore)
332 {
333 RTCRSTORECERTSEARCH Search;
334 rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, &Search);
335 if (RT_SUCCESS(rc))
336 {
337 do
338 {
339 PCRTCRCERTCTX pCertCtx = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, &Search);
340 if (!pCertCtx)
341 break;
342
343 if (pCertCtx->fFlags & RTCRCERTCTX_F_ENC_X509_DER)
344 {
345 X509 *pOsslCert = NULL;
346 const unsigned char *pabEncoded = (const unsigned char *)pCertCtx->pabEncoded;
347 if (d2i_X509(&pOsslCert, &pabEncoded, pCertCtx->cbEncoded) == pOsslCert)
348 {
349 if (!X509_STORE_add_cert(pOsslStore, pOsslCert))
350 rc = VERR_NO_MEMORY;
351 X509_free(pOsslCert);
352 }
353 }
354
355 RTCrCertCtxRelease(pCertCtx);
356 } while (RT_SUCCESS(rc));
357
358 pThis->pProvider->pfnCertSearchDestroy(pThis->pvProvider, &Search);
359 if (RT_SUCCESS(rc))
360 {
361 *ppvOpenSslStore = pOsslStore;
362 return VINF_SUCCESS;
363 }
364 }
365 X509_STORE_free(pOsslStore);
366 }
367 else
368 rc = VERR_NO_MEMORY;
369 return rc;
370}
371
372
373RTDECL(int) RTCrStoreConvertToOpenSslCertStack(RTCRSTORE hStore, uint32_t fFlags, void **ppvOpenSslStack)
374{
375 PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
376 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
377 AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, VERR_INVALID_HANDLE);
378
379 /*
380 * Use the pfnCertFindAll method to add all certificates to the store we're returning.
381 */
382 int rc;
383 STACK_OF(X509) *pOsslStack = sk_X509_new_null();
384 if (pOsslStack)
385 {
386 RTCRSTORECERTSEARCH Search;
387 rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, &Search);
388 if (RT_SUCCESS(rc))
389 {
390 do
391 {
392 PCRTCRCERTCTX pCertCtx = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, &Search);
393 if (!pCertCtx)
394 break;
395
396 if (pCertCtx->fFlags & RTCRCERTCTX_F_ENC_X509_DER)
397 {
398 X509 *pOsslCert = NULL;
399 const unsigned char *pabEncoded = (const unsigned char *)pCertCtx->pabEncoded;
400 if (d2i_X509(&pOsslCert, &pabEncoded, pCertCtx->cbEncoded) == pOsslCert)
401 {
402 if (!sk_X509_push(pOsslStack, pOsslCert))
403 {
404 rc = VERR_NO_MEMORY;
405 X509_free(pOsslCert);
406 }
407 }
408 }
409
410 RTCrCertCtxRelease(pCertCtx);
411 } while (RT_SUCCESS(rc));
412
413 pThis->pProvider->pfnCertSearchDestroy(pThis->pvProvider, &Search);
414 if (RT_SUCCESS(rc))
415 {
416 *ppvOpenSslStack = pOsslStack;
417 return VINF_SUCCESS;
418 }
419 }
420 sk_X509_pop_free(pOsslStack, X509_free);
421 }
422 else
423 rc = VERR_NO_MEMORY;
424 return rc;
425}
426
427#endif /* IPRT_WITH_OPENSSL */
428
429
430/*
431 * Certificate context.
432 * Certificate context.
433 * Certificate context.
434 */
435
436
437RTDECL(uint32_t) RTCrCertCtxRetain(PCRTCRCERTCTX pCertCtx)
438{
439 AssertPtrReturn(pCertCtx, UINT32_MAX);
440 PRTCRCERTCTXINT pThis = RT_FROM_MEMBER(pCertCtx, RTCRCERTCTXINT, Public);
441 AssertReturn(pThis->u32Magic == RTCRCERTCTXINT_MAGIC, UINT32_MAX);
442 uint32_t cRet = ASMAtomicIncU32(&pThis->cRefs);
443 Assert(cRet < 64);
444 return cRet;
445}
446
447
448RTDECL(uint32_t) RTCrCertCtxRelease(PCRTCRCERTCTX pCertCtx)
449{
450 if (!pCertCtx)
451 return 0;
452
453 AssertPtrReturn(pCertCtx, UINT32_MAX);
454 PRTCRCERTCTXINT pThis = RT_FROM_MEMBER(pCertCtx, RTCRCERTCTXINT, Public);
455 AssertReturn(pThis->u32Magic == RTCRCERTCTXINT_MAGIC, UINT32_MAX);
456 uint32_t cRet = ASMAtomicDecU32(&pThis->cRefs);
457 if (!cRet)
458 {
459 ASMAtomicWriteU32(&pThis->u32Magic, RTCRCERTCTXINT_MAGIC_DEAD);
460 pThis->pfnDtor(pThis);
461 }
462 return cRet;
463}
464
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette