x_crl.c@ 94081

Last change on this file since 94081 was 91772, checked in by vboxsync, 3 years ago
openssl-1.1.1l: Applied and adjusted our OpenSSL changes to 1.1.1l. bugref:10126
File size: 14.7 KB

Line
1	/*
2	* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the OpenSSL license (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stdio.h>
11	#include "internal/cryptlib.h"
12	#include <openssl/asn1t.h>
13	#include <openssl/x509.h>
14	#include "crypto/x509.h"
15	#include <openssl/x509v3.h>
16	#include "x509_local.h"
17
18	static int X509_REVOKED_cmp(const X509_REVOKED const a,
19	const X509_REVOKED const b);
20	static int setup_idp(X509_CRL crl, ISSUING_DIST_POINT idp);
21
22	ASN1_SEQUENCE(X509_REVOKED) = {
23	ASN1_EMBED(X509_REVOKED,serialNumber, ASN1_INTEGER),
24	ASN1_SIMPLE(X509_REVOKED,revocationDate, ASN1_TIME),
25	ASN1_SEQUENCE_OF_OPT(X509_REVOKED,extensions, X509_EXTENSION)
26	} ASN1_SEQUENCE_END(X509_REVOKED)
27
28	static int def_crl_verify(X509_CRL crl, EVP_PKEY r);
29	static int def_crl_lookup(X509_CRL *crl,
30	X509_REVOKED *ret, ASN1_INTEGER serial,
31	X509_NAME *issuer);
32
33	static X509_CRL_METHOD int_crl_meth = {
34	0,
35	0, 0,
36	def_crl_lookup,
37	def_crl_verify
38	};
39
40	static const X509_CRL_METHOD *default_crl_method = &int_crl_meth;
41
42	/*
43	* The X509_CRL_INFO structure needs a bit of customisation. Since we cache
44	* the original encoding the signature won't be affected by reordering of the
45	* revoked field.
46	*/
47	static int crl_inf_cb(int operation, ASN1_VALUE *pval, const ASN1_ITEM it,
48	void *exarg)
49	{
50	X509_CRL_INFO a = (X509_CRL_INFO )*pval;
51
52	if (!a \|\| !a->revoked)
53	return 1;
54	switch (operation) {
55	/*
56	* Just set cmp function here. We don't sort because that would
57	* affect the output of X509_CRL_print().
58	*/
59	case ASN1_OP_D2I_POST:
60	(void)sk_X509_REVOKED_set_cmp_func(a->revoked, X509_REVOKED_cmp);
61	break;
62	}
63	return 1;
64	}
65
66
67	ASN1_SEQUENCE_enc(X509_CRL_INFO, enc, crl_inf_cb) = {
68	ASN1_OPT(X509_CRL_INFO, version, ASN1_INTEGER),
69	ASN1_EMBED(X509_CRL_INFO, sig_alg, X509_ALGOR),
70	ASN1_SIMPLE(X509_CRL_INFO, issuer, X509_NAME),
71	ASN1_SIMPLE(X509_CRL_INFO, lastUpdate, ASN1_TIME),
72	ASN1_OPT(X509_CRL_INFO, nextUpdate, ASN1_TIME),
73	ASN1_SEQUENCE_OF_OPT(X509_CRL_INFO, revoked, X509_REVOKED),
74	ASN1_EXP_SEQUENCE_OF_OPT(X509_CRL_INFO, extensions, X509_EXTENSION, 0)
75	} ASN1_SEQUENCE_END_enc(X509_CRL_INFO, X509_CRL_INFO)
76
77	/*
78	* Set CRL entry issuer according to CRL certificate issuer extension. Check
79	* for unhandled critical CRL entry extensions.
80	*/
81
82	static int crl_set_issuers(X509_CRL *crl)
83	{
84
85	int i, j;
86	GENERAL_NAMES gens, gtmp;
87	STACK_OF(X509_REVOKED) *revoked;
88
89	revoked = X509_CRL_get_REVOKED(crl);
90
91	gens = NULL;
92	for (i = 0; i < sk_X509_REVOKED_num(revoked); i++) {
93	X509_REVOKED *rev = sk_X509_REVOKED_value(revoked, i);
94	STACK_OF(X509_EXTENSION) *exts;
95	ASN1_ENUMERATED *reason;
96	X509_EXTENSION *ext;
97	gtmp = X509_REVOKED_get_ext_d2i(rev,
98	NID_certificate_issuer, &j, NULL);
99	if (!gtmp && (j != -1)) {
100	crl->flags \|= EXFLAG_INVALID;
101	return 1;
102	}
103
104	if (gtmp) {
105	gens = gtmp;
106	if (!crl->issuers) {
107	crl->issuers = sk_GENERAL_NAMES_new_null();
108	if (!crl->issuers)
109	return 0;
110	}
111	if (!sk_GENERAL_NAMES_push(crl->issuers, gtmp))
112	return 0;
113	}
114	rev->issuer = gens;
115
116	reason = X509_REVOKED_get_ext_d2i(rev, NID_crl_reason, &j, NULL);
117	if (!reason && (j != -1)) {
118	crl->flags \|= EXFLAG_INVALID;
119	return 1;
120	}
121
122	if (reason) {
123	rev->reason = ASN1_ENUMERATED_get(reason);
124	ASN1_ENUMERATED_free(reason);
125	} else
126	rev->reason = CRL_REASON_NONE;
127
128	/* Check for critical CRL entry extensions */
129
130	exts = rev->extensions;
131
132	for (j = 0; j < sk_X509_EXTENSION_num(exts); j++) {
133	ext = sk_X509_EXTENSION_value(exts, j);
134	if (X509_EXTENSION_get_critical(ext)) {
135	if (OBJ_obj2nid(X509_EXTENSION_get_object(ext)) == NID_certificate_issuer)
136	continue;
137	crl->flags \|= EXFLAG_CRITICAL;
138	break;
139	}
140	}
141
142	}
143
144	return 1;
145
146	}
147
148	/*
149	* The X509_CRL structure needs a bit of customisation. Cache some extensions
150	* and hash of the whole CRL.
151	*/
152	static int crl_cb(int operation, ASN1_VALUE *pval, const ASN1_ITEM it,
153	void *exarg)
154	{
155	X509_CRL crl = (X509_CRL )*pval;
156	STACK_OF(X509_EXTENSION) *exts;
157	X509_EXTENSION *ext;
158	int idx, i;
159
160	switch (operation) {
161	case ASN1_OP_D2I_PRE:
162	if (crl->meth->crl_free) {
163	if (!crl->meth->crl_free(crl))
164	return 0;
165	}
166	AUTHORITY_KEYID_free(crl->akid);
167	ISSUING_DIST_POINT_free(crl->idp);
168	ASN1_INTEGER_free(crl->crl_number);
169	ASN1_INTEGER_free(crl->base_crl_number);
170	sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
171	/* fall thru */
172
173	case ASN1_OP_NEW_POST:
174	crl->idp = NULL;
175	crl->akid = NULL;
176	crl->flags = 0;
177	crl->idp_flags = 0;
178	crl->idp_reasons = CRLDP_ALL_REASONS;
179	crl->meth = default_crl_method;
180	crl->meth_data = NULL;
181	crl->issuers = NULL;
182	crl->crl_number = NULL;
183	crl->base_crl_number = NULL;
184	break;
185
186	case ASN1_OP_D2I_POST:
187	if (!X509_CRL_digest(crl, EVP_sha1(), crl->sha1_hash, NULL))
188	crl->flags \|= EXFLAG_INVALID;
189	crl->idp = X509_CRL_get_ext_d2i(crl,
190	NID_issuing_distribution_point, &i,
191	NULL);
192	if (crl->idp != NULL) {
193	if (!setup_idp(crl, crl->idp))
194	crl->flags \|= EXFLAG_INVALID;
195	}
196	else if (i != -1) {
197	crl->flags \|= EXFLAG_INVALID;
198	}
199
200	crl->akid = X509_CRL_get_ext_d2i(crl,
201	NID_authority_key_identifier, &i,
202	NULL);
203	if (crl->akid == NULL && i != -1)
204	crl->flags \|= EXFLAG_INVALID;
205
206	crl->crl_number = X509_CRL_get_ext_d2i(crl,
207	NID_crl_number, &i, NULL);
208	if (crl->crl_number == NULL && i != -1)
209	crl->flags \|= EXFLAG_INVALID;
210
211	crl->base_crl_number = X509_CRL_get_ext_d2i(crl,
212	NID_delta_crl, &i,
213	NULL);
214	if (crl->base_crl_number == NULL && i != -1)
215	crl->flags \|= EXFLAG_INVALID;
216	/* Delta CRLs must have CRL number */
217	if (crl->base_crl_number && !crl->crl_number)
218	crl->flags \|= EXFLAG_INVALID;
219
220	/*
221	* See if we have any unhandled critical CRL extensions and indicate
222	* this in a flag. We only currently handle IDP so anything else
223	* critical sets the flag. This code accesses the X509_CRL structure
224	* directly: applications shouldn't do this.
225	*/
226
227	exts = crl->crl.extensions;
228
229	for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++) {
230	int nid;
231	ext = sk_X509_EXTENSION_value(exts, idx);
232	nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext));
233	if (nid == NID_freshest_crl)
234	crl->flags \|= EXFLAG_FRESHEST;
235	if (X509_EXTENSION_get_critical(ext)) {
236	/* We handle IDP and deltas */
237	if ((nid == NID_issuing_distribution_point)
238	\|\| (nid == NID_authority_key_identifier)
239	\|\| (nid == NID_delta_crl))
240	continue;
241	crl->flags \|= EXFLAG_CRITICAL;
242	break;
243	}
244	}
245
246	if (!crl_set_issuers(crl))
247	return 0;
248
249	if (crl->meth->crl_init) {
250	if (crl->meth->crl_init(crl) == 0)
251	return 0;
252	}
253
254	crl->flags \|= EXFLAG_SET;
255	break;
256
257	case ASN1_OP_FREE_POST:
258	if (crl->meth->crl_free) {
259	if (!crl->meth->crl_free(crl))
260	return 0;
261	}
262	AUTHORITY_KEYID_free(crl->akid);
263	ISSUING_DIST_POINT_free(crl->idp);
264	ASN1_INTEGER_free(crl->crl_number);
265	ASN1_INTEGER_free(crl->base_crl_number);
266	sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
267	break;
268	}
269	return 1;
270	}
271
272	/* Convert IDP into a more convenient form */
273
274	static int setup_idp(X509_CRL crl, ISSUING_DIST_POINT idp)
275	{
276	int idp_only = 0;
277
278	/* Set various flags according to IDP */
279	crl->idp_flags \|= IDP_PRESENT;
280	if (idp->onlyuser > 0) {
281	idp_only++;
282	crl->idp_flags \|= IDP_ONLYUSER;
283	}
284	if (idp->onlyCA > 0) {
285	idp_only++;
286	crl->idp_flags \|= IDP_ONLYCA;
287	}
288	if (idp->onlyattr > 0) {
289	idp_only++;
290	crl->idp_flags \|= IDP_ONLYATTR;
291	}
292
293	if (idp_only > 1)
294	crl->idp_flags \|= IDP_INVALID;
295
296	if (idp->indirectCRL > 0)
297	crl->idp_flags \|= IDP_INDIRECT;
298
299	if (idp->onlysomereasons) {
300	crl->idp_flags \|= IDP_REASONS;
301	if (idp->onlysomereasons->length > 0)
302	crl->idp_reasons = idp->onlysomereasons->data[0];
303	if (idp->onlysomereasons->length > 1)
304	crl->idp_reasons \|= (idp->onlysomereasons->data[1] << 8);
305	crl->idp_reasons &= CRLDP_ALL_REASONS;
306	}
307
308	return DIST_POINT_set_dpname(idp->distpoint, X509_CRL_get_issuer(crl));
309	}
310
311	ASN1_SEQUENCE_ref(X509_CRL, crl_cb) = {
312	ASN1_EMBED(X509_CRL, crl, X509_CRL_INFO),
313	ASN1_EMBED(X509_CRL, sig_alg, X509_ALGOR),
314	ASN1_EMBED(X509_CRL, signature, ASN1_BIT_STRING)
315	} ASN1_SEQUENCE_END_ref(X509_CRL, X509_CRL)
316
317	IMPLEMENT_ASN1_FUNCTIONS(X509_REVOKED)
318
319	IMPLEMENT_ASN1_DUP_FUNCTION(X509_REVOKED)
320
321	IMPLEMENT_ASN1_FUNCTIONS(X509_CRL_INFO)
322
323	IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)
324
325	IMPLEMENT_ASN1_DUP_FUNCTION(X509_CRL)
326
327	static int X509_REVOKED_cmp(const X509_REVOKED const a,
328	const X509_REVOKED const b)
329	{
330	return (ASN1_STRING_cmp((ASN1_STRING )&(a)->serialNumber,
331	(ASN1_STRING )&(b)->serialNumber));
332	}
333
334	int X509_CRL_add0_revoked(X509_CRL crl, X509_REVOKED rev)
335	{
336	X509_CRL_INFO *inf;
337
338	inf = &crl->crl;
339	if (inf->revoked == NULL)
340	inf->revoked = sk_X509_REVOKED_new(X509_REVOKED_cmp);
341	if (inf->revoked == NULL \|\| !sk_X509_REVOKED_push(inf->revoked, rev)) {
342	ASN1err(ASN1_F_X509_CRL_ADD0_REVOKED, ERR_R_MALLOC_FAILURE);
343	return 0;
344	}
345	inf->enc.modified = 1;
346	return 1;
347	}
348
349	int X509_CRL_verify(X509_CRL crl, EVP_PKEY r)
350	{
351	if (crl->meth->crl_verify)
352	return crl->meth->crl_verify(crl, r);
353	return 0;
354	}
355
356	int X509_CRL_get0_by_serial(X509_CRL *crl,
357	X509_REVOKED *ret, ASN1_INTEGER serial)
358	{
359	if (crl->meth->crl_lookup)
360	return crl->meth->crl_lookup(crl, ret, serial, NULL);
361	return 0;
362	}
363
364	int X509_CRL_get0_by_cert(X509_CRL crl, X509_REVOKED ret, X509 x)
365	{
366	if (crl->meth->crl_lookup)
367	return crl->meth->crl_lookup(crl, ret,
368	X509_get_serialNumber(x),
369	X509_get_issuer_name(x));
370	return 0;
371	}
372
373	static int def_crl_verify(X509_CRL crl, EVP_PKEY r)
374	{
375	return (ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO),
376	&crl->sig_alg, &crl->signature, &crl->crl, r));
377	}
378
379	static int crl_revoked_issuer_match(X509_CRL crl, X509_NAME nm,
380	X509_REVOKED *rev)
381	{
382	int i;
383
384	if (!rev->issuer) {
385	if (!nm)
386	return 1;
387	if (!X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)))
388	return 1;
389	return 0;
390	}
391
392	if (!nm)
393	nm = X509_CRL_get_issuer(crl);
394
395	for (i = 0; i < sk_GENERAL_NAME_num(rev->issuer); i++) {
396	GENERAL_NAME *gen = sk_GENERAL_NAME_value(rev->issuer, i);
397	if (gen->type != GEN_DIRNAME)
398	continue;
399	if (!X509_NAME_cmp(nm, gen->d.directoryName))
400	return 1;
401	}
402	return 0;
403
404	}
405
406	static int def_crl_lookup(X509_CRL *crl,
407	X509_REVOKED *ret, ASN1_INTEGER serial,
408	X509_NAME *issuer)
409	{
410	X509_REVOKED rtmp, *rev;
411	int idx, num;
412
413	if (crl->crl.revoked == NULL)
414	return 0;
415
416	/*
417	* Sort revoked into serial number order if not already sorted. Do this
418	* under a lock to avoid race condition.
419	*/
420	if (!sk_X509_REVOKED_is_sorted(crl->crl.revoked)) {
421	CRYPTO_THREAD_write_lock(crl->lock);
422	sk_X509_REVOKED_sort(crl->crl.revoked);
423	CRYPTO_THREAD_unlock(crl->lock);
424	}
425	rtmp.serialNumber = *serial;
426	idx = sk_X509_REVOKED_find(crl->crl.revoked, &rtmp);
427	if (idx < 0)
428	return 0;
429	/* Need to look for matching name */
430	for (num = sk_X509_REVOKED_num(crl->crl.revoked); idx < num; idx++) {
431	rev = sk_X509_REVOKED_value(crl->crl.revoked, idx);
432	if (ASN1_INTEGER_cmp(&rev->serialNumber, serial))
433	return 0;
434	if (crl_revoked_issuer_match(crl, issuer, rev)) {
435	if (ret)
436	*ret = rev;
437	if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
438	return 2;
439	return 1;
440	}
441	}
442	return 0;
443	}
444
445	void X509_CRL_set_default_method(const X509_CRL_METHOD *meth)
446	{
447	if (meth == NULL)
448	default_crl_method = &int_crl_meth;
449	else
450	default_crl_method = meth;
451	}
452
453	X509_CRL_METHOD X509_CRL_METHOD_new(int (crl_init) (X509_CRL *crl),
454	int (crl_free) (X509_CRL crl),
455	int (crl_lookup) (X509_CRL crl,
456	X509_REVOKED **ret,
457	ASN1_INTEGER *ser,
458	X509_NAME *issuer),
459	int (crl_verify) (X509_CRL crl,
460	EVP_PKEY *pk))
461	{
462	X509_CRL_METHOD m = OPENSSL_malloc(sizeof(m));
463
464	if (m == NULL) {
465	X509err(X509_F_X509_CRL_METHOD_NEW, ERR_R_MALLOC_FAILURE);
466	return NULL;
467	}
468	m->crl_init = crl_init;
469	m->crl_free = crl_free;
470	m->crl_lookup = crl_lookup;
471	m->crl_verify = crl_verify;
472	m->flags = X509_CRL_METHOD_DYNAMIC;
473	return m;
474	}
475
476	void X509_CRL_METHOD_free(X509_CRL_METHOD *m)
477	{
478	if (m == NULL \|\| !(m->flags & X509_CRL_METHOD_DYNAMIC))
479	return;
480	OPENSSL_free(m);
481	}
482
483	void X509_CRL_set_meth_data(X509_CRL crl, void dat)
484	{
485	crl->meth_data = dat;
486	}
487
488	void X509_CRL_get_meth_data(X509_CRL crl)
489	{
490	return crl->meth_data;
491	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.0.1/crypto/x509/x_crl.c@ 94081

Download in other formats: