1/* 2 * ! \file ssl/ssl_cert.c 3 */ 4/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 5 * All rights reserved. 6 * 7 * This package is an SSL implementation written 8 * by Eric Young (eay@cryptsoft.com). 9 * The implementation was written so as to conform with Netscapes SSL. 10 * 11 * This library is free for commercial and non-commercial use as long as 12 * the following conditions are aheared to. The following conditions 13 * apply to all code found in this distribution, be it the RC4, RSA, 14 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 15 * included with this distribution is covered by the same copyright terms 16 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 17 * 18 * Copyright remains Eric Young's, and as such any Copyright notices in 19 * the code are not to be removed. 20 * If this package is used in a product, Eric Young should be given attribution 21 * as the author of the parts of the library used. 22 * This can be in the form of a textual message at program startup or 23 * in documentation (online or textual) provided with the package. 24 * 25 * Redistribution and use in source and binary forms, with or without 26 * modification, are permitted provided that the following conditions 27 * are met: 28 * 1. Redistributions of source code must retain the copyright 29 * notice, this list of conditions and the following disclaimer. 30 * 2. Redistributions in binary form must reproduce the above copyright 31 * notice, this list of conditions and the following disclaimer in the 32 * documentation and/or other materials provided with the distribution. 33 * 3. All advertising materials mentioning features or use of this software 34 * must display the following acknowledgement: 35 * "This product includes cryptographic software written by 36 * Eric Young (eay@cryptsoft.com)" 37 * The word 'cryptographic' can be left out if the rouines from the library 38 * being used are not cryptographic related :-). 39 * 4. If you include any Windows specific code (or a derivative thereof) from 40 * the apps directory (application code) you must include an acknowledgement: 41 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 42 * 43 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 46 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 53 * SUCH DAMAGE. 54 * 55 * The licence and distribution terms for any publically available version or 56 * derivative of this code cannot be changed. i.e. this code cannot simply be 57 * copied and put under another distribution licence 58 * [including the GNU Public Licence.] 59 */ 60/* ==================================================================== 61 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. 62 * 63 * Redistribution and use in source and binary forms, with or without 64 * modification, are permitted provided that the following conditions 65 * are met: 66 * 67 * 1. Redistributions of source code must retain the above copyright 68 * notice, this list of conditions and the following disclaimer. 69 * 70 * 2. Redistributions in binary form must reproduce the above copyright 71 * notice, this list of conditions and the following disclaimer in 72 * the documentation and/or other materials provided with the 73 * distribution. 74 * 75 * 3. All advertising materials mentioning features or use of this 76 * software must display the following acknowledgment: 77 * "This product includes software developed by the OpenSSL Project 78 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 79 * 80 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 81 * endorse or promote products derived from this software without 82 * prior written permission. For written permission, please contact 83 * openssl-core@openssl.org. 84 * 85 * 5. Products derived from this software may not be called "OpenSSL" 86 * nor may "OpenSSL" appear in their names without prior written 87 * permission of the OpenSSL Project. 88 * 89 * 6. Redistributions of any form whatsoever must retain the following 90 * acknowledgment: 91 * "This product includes software developed by the OpenSSL Project 92 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 93 * 94 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 95 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 96 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 97 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 98 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 99 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 100 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 101 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 102 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 103 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 104 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 105 * OF THE POSSIBILITY OF SUCH DAMAGE. 106 * ==================================================================== 107 * 108 * This product includes cryptographic software written by Eric Young 109 * (eay@cryptsoft.com). This product includes software written by Tim 110 * Hudson (tjh@cryptsoft.com). 111 * 112 */ 113/* ==================================================================== 114 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 115 * ECC cipher suite support in OpenSSL originally developed by 116 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. 117 */ 118 119#include <stdio.h> 120 121#include "e_os.h" 122#ifndef NO_SYS_TYPES_H 123# include <sys/types.h> 124#endif 125 126#include "o_dir.h" 127#include <openssl/objects.h> 128#include <openssl/bio.h> 129#include <openssl/pem.h> 130#include <openssl/x509v3.h> 131#ifndef OPENSSL_NO_DH 132# include <openssl/dh.h> 133#endif 134#include <openssl/bn.h> 135#include "ssl_locl.h" 136 137int SSL_get_ex_data_X509_STORE_CTX_idx(void) 138{ 139 static volatile int ssl_x509_store_ctx_idx = -1; 140 int got_write_lock = 0; 141 142 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 143 144 if (ssl_x509_store_ctx_idx < 0) { 145 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 146 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 147 got_write_lock = 1; 148 149 if (ssl_x509_store_ctx_idx < 0) { 150 ssl_x509_store_ctx_idx = 151 X509_STORE_CTX_get_ex_new_index(0, "SSL for verify callback", 152 NULL, NULL, NULL); 153 } 154 } 155 156 if (got_write_lock) 157 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 158 else 159 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 160 161 return ssl_x509_store_ctx_idx; 162} 163 164CERT *ssl_cert_new(void) 165{ 166 CERT *ret; 167 168 ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); 169 if (ret == NULL) { 170 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE); 171 return (NULL); 172 } 173 memset(ret, 0, sizeof(CERT)); 174 175 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]); 176 ret->references = 1; 177 178 return (ret); 179} 180 181CERT *ssl_cert_dup(CERT *cert) 182{ 183 CERT *ret; 184 int i; 185 186 ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); 187 if (ret == NULL) { 188 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); 189 return (NULL); 190 } 191 192 memset(ret, 0, sizeof(CERT)); 193 194 ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]]; 195 /* 196 * or ret->key = ret->pkeys + (cert->key - cert->pkeys), if you find that 197 * more readable 198 */ 199 200 ret->valid = cert->valid; 201 ret->mask = cert->mask; 202 ret->export_mask = cert->export_mask; 203 204#ifndef OPENSSL_NO_RSA 205 if (cert->rsa_tmp != NULL) { 206 RSA_up_ref(cert->rsa_tmp); 207 ret->rsa_tmp = cert->rsa_tmp; 208 } 209 ret->rsa_tmp_cb = cert->rsa_tmp_cb; 210#endif 211 212#ifndef OPENSSL_NO_DH 213 if (cert->dh_tmp != NULL) { 214 ret->dh_tmp = DHparams_dup(cert->dh_tmp); 215 if (ret->dh_tmp == NULL) { 216 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB); 217 goto err; 218 } 219 if (cert->dh_tmp->priv_key) { 220 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key); 221 if (!b) { 222 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 223 goto err; 224 } 225 ret->dh_tmp->priv_key = b; 226 } 227 if (cert->dh_tmp->pub_key) { 228 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key); 229 if (!b) { 230 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 231 goto err; 232 } 233 ret->dh_tmp->pub_key = b; 234 } 235 } 236 ret->dh_tmp_cb = cert->dh_tmp_cb; 237#endif 238 239#ifndef OPENSSL_NO_ECDH 240 if (cert->ecdh_tmp) { 241 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp); 242 if (ret->ecdh_tmp == NULL) { 243 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB); 244 goto err; 245 } 246 } 247 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb; 248#endif 249 250 for (i = 0; i < SSL_PKEY_NUM; i++) { 251 if (cert->pkeys[i].x509 != NULL) { 252 ret->pkeys[i].x509 = cert->pkeys[i].x509; 253 CRYPTO_add(&ret->pkeys[i].x509->references, 1, CRYPTO_LOCK_X509); 254 } 255 256 if (cert->pkeys[i].privatekey != NULL) { 257 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey; 258 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1, 259 CRYPTO_LOCK_EVP_PKEY); 260 261 switch (i) { 262 /* 263 * If there was anything special to do for certain types of 264 * keys, we'd do it here. (Nothing at the moment, I think.) 265 */ 266 267 case SSL_PKEY_RSA_ENC: 268 case SSL_PKEY_RSA_SIGN: 269 /* We have an RSA key. */ 270 break; 271 272 case SSL_PKEY_DSA_SIGN: 273 /* We have a DSA key. */ 274 break; 275 276 case SSL_PKEY_DH_RSA: 277 case SSL_PKEY_DH_DSA: 278 /* We have a DH key. */ 279 break; 280 281 case SSL_PKEY_ECC: 282 /* We have an ECC key */ 283 break; 284 285 default: 286 /* Can't happen. */ 287 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG); 288 } 289 } 290 } 291 292 /* 293 * ret->extra_certs *should* exist, but currently the own certificate 294 * chain is held inside SSL_CTX 295 */ 296 297 ret->references = 1; 298 299 return (ret); 300 301#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH) 302 err: 303#endif 304#ifndef OPENSSL_NO_RSA 305 if (ret->rsa_tmp != NULL) 306 RSA_free(ret->rsa_tmp); 307#endif 308#ifndef OPENSSL_NO_DH 309 if (ret->dh_tmp != NULL) 310 DH_free(ret->dh_tmp); 311#endif 312#ifndef OPENSSL_NO_ECDH 313 if (ret->ecdh_tmp != NULL) 314 EC_KEY_free(ret->ecdh_tmp); 315#endif 316 317 for (i = 0; i < SSL_PKEY_NUM; i++) { 318 if (ret->pkeys[i].x509 != NULL) 319 X509_free(ret->pkeys[i].x509); 320 if (ret->pkeys[i].privatekey != NULL) 321 EVP_PKEY_free(ret->pkeys[i].privatekey); 322 } 323 324 return NULL; 325} 326 327void ssl_cert_free(CERT *c) 328{ 329 int i; 330 331 if (c == NULL) 332 return; 333 334 i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT); 335#ifdef REF_PRINT 336 REF_PRINT("CERT", c); 337#endif 338 if (i > 0) 339 return; 340#ifdef REF_CHECK 341 if (i < 0) { 342 fprintf(stderr, "ssl_cert_free, bad reference count\n"); 343 abort(); /* ok */ 344 } 345#endif 346 347#ifndef OPENSSL_NO_RSA 348 if (c->rsa_tmp) 349 RSA_free(c->rsa_tmp); 350#endif 351#ifndef OPENSSL_NO_DH 352 if (c->dh_tmp) 353 DH_free(c->dh_tmp); 354#endif 355#ifndef OPENSSL_NO_ECDH 356 if (c->ecdh_tmp) 357 EC_KEY_free(c->ecdh_tmp); 358#endif 359 360 for (i = 0; i < SSL_PKEY_NUM; i++) { 361 if (c->pkeys[i].x509 != NULL) 362 X509_free(c->pkeys[i].x509); 363 if (c->pkeys[i].privatekey != NULL) 364 EVP_PKEY_free(c->pkeys[i].privatekey); 365#if 0 366 if (c->pkeys[i].publickey != NULL) 367 EVP_PKEY_free(c->pkeys[i].publickey); 368#endif 369 } 370 OPENSSL_free(c); 371} 372 373int ssl_cert_inst(CERT **o) 374{ 375 /* 376 * Create a CERT if there isn't already one (which cannot really happen, 377 * as it is initially created in SSL_CTX_new; but the earlier code 378 * usually allows for that one being non-existant, so we follow that 379 * behaviour, as it might turn out that there actually is a reason for it 380 * -- but I'm not sure that *all* of the existing code could cope with 381 * s->cert being NULL, otherwise we could do without the initialization 382 * in SSL_CTX_new). 383 */ 384 385 if (o == NULL) { 386 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER); 387 return (0); 388 } 389 if (*o == NULL) { 390 if ((*o = ssl_cert_new()) == NULL) { 391 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE); 392 return (0); 393 } 394 } 395 return (1); 396} 397 398SESS_CERT *ssl_sess_cert_new(void) 399{ 400 SESS_CERT *ret; 401 402 ret = OPENSSL_malloc(sizeof *ret); 403 if (ret == NULL) { 404 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); 405 return NULL; 406 } 407 408 memset(ret, 0, sizeof *ret); 409 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); 410 ret->references = 1; 411 412 return ret; 413} 414 415void ssl_sess_cert_free(SESS_CERT *sc) 416{ 417 int i; 418 419 if (sc == NULL) 420 return; 421 422 i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT); 423#ifdef REF_PRINT 424 REF_PRINT("SESS_CERT", sc); 425#endif 426 if (i > 0) 427 return; 428#ifdef REF_CHECK 429 if (i < 0) { 430 fprintf(stderr, "ssl_sess_cert_free, bad reference count\n"); 431 abort(); /* ok */ 432 } 433#endif 434 435 /* i == 0 */ 436 if (sc->cert_chain != NULL) 437 sk_X509_pop_free(sc->cert_chain, X509_free); 438 for (i = 0; i < SSL_PKEY_NUM; i++) { 439 if (sc->peer_pkeys[i].x509 != NULL) 440 X509_free(sc->peer_pkeys[i].x509); 441#if 0 /* We don't have the peer's private key. 442 * These lines are just * here as a reminder 443 * that we're still using a 444 * not-quite-appropriate * data structure. */ 445 if (sc->peer_pkeys[i].privatekey != NULL) 446 EVP_PKEY_free(sc->peer_pkeys[i].privatekey); 447#endif 448 } 449 450#ifndef OPENSSL_NO_RSA 451 if (sc->peer_rsa_tmp != NULL) 452 RSA_free(sc->peer_rsa_tmp); 453#endif 454#ifndef OPENSSL_NO_DH 455 if (sc->peer_dh_tmp != NULL) 456 DH_free(sc->peer_dh_tmp); 457#endif 458#ifndef OPENSSL_NO_ECDH 459 if (sc->peer_ecdh_tmp != NULL) 460 EC_KEY_free(sc->peer_ecdh_tmp); 461#endif 462 463 OPENSSL_free(sc); 464} 465 466int ssl_set_peer_cert_type(SESS_CERT *sc, int type) 467{ 468 sc->peer_cert_type = type; 469 return (1); 470} 471 472int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk) 473{ 474 X509 *x; 475 int i; 476 X509_STORE_CTX ctx; 477 478 if ((sk == NULL) || (sk_X509_num(sk) == 0)) 479 return (0); 480 481 x = sk_X509_value(sk, 0); 482 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) { 483 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB); 484 return (0); 485 } 486#if 0 487 if (SSL_get_verify_depth(s) >= 0) 488 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s)); 489#endif 490 X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s); 491 492 /* 493 * We need to inherit the verify parameters. These can be determined by 494 * the context: if its a server it will verify SSL client certificates or 495 * vice versa. 496 */ 497 498 X509_STORE_CTX_set_default(&ctx, s->server ? "ssl_client" : "ssl_server"); 499 /* 500 * Anything non-default in "param" should overwrite anything in the ctx. 501 */ 502 X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx), s->param); 503 504 if (s->verify_callback) 505 X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback); 506 507 if (s->ctx->app_verify_callback != NULL) 508#if 1 /* new with OpenSSL 0.9.7 */ 509 i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg); 510#else 511 i = s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */ 512#endif 513 else { 514#ifndef OPENSSL_NO_X509_VERIFY 515 i = X509_verify_cert(&ctx); 516#else 517 i = 0; 518 ctx.error = X509_V_ERR_APPLICATION_VERIFICATION; 519 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, SSL_R_NO_VERIFY_CALLBACK); 520#endif 521 } 522 523 s->verify_result = ctx.error; 524 X509_STORE_CTX_cleanup(&ctx); 525 526 return (i); 527} 528 529static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list, 530 STACK_OF(X509_NAME) *name_list) 531{ 532 if (*ca_list != NULL) 533 sk_X509_NAME_pop_free(*ca_list, X509_NAME_free); 534 535 *ca_list = name_list; 536} 537 538STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk) 539{ 540 int i; 541 STACK_OF(X509_NAME) *ret; 542 X509_NAME *name; 543 544 ret = sk_X509_NAME_new_null(); 545 for (i = 0; i < sk_X509_NAME_num(sk); i++) { 546 name = X509_NAME_dup(sk_X509_NAME_value(sk, i)); 547 if ((name == NULL) || !sk_X509_NAME_push(ret, name)) { 548 sk_X509_NAME_pop_free(ret, X509_NAME_free); 549 return (NULL); 550 } 551 } 552 return (ret); 553} 554 555void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list) 556{ 557 set_client_CA_list(&(s->client_CA), name_list); 558} 559 560void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list) 561{ 562 set_client_CA_list(&(ctx->client_CA), name_list); 563} 564 565STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) 566{ 567 return (ctx->client_CA); 568} 569 570STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s) 571{ 572 if (s->type == SSL_ST_CONNECT) { /* we are in the client */ 573 if (((s->version >> 8) == SSL3_VERSION_MAJOR) && (s->s3 != NULL)) 574 return (s->s3->tmp.ca_names); 575 else 576 return (NULL); 577 } else { 578 if (s->client_CA != NULL) 579 return (s->client_CA); 580 else 581 return (s->ctx->client_CA); 582 } 583} 584 585static int add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x) 586{ 587 X509_NAME *name; 588 589 if (x == NULL) 590 return (0); 591 if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL)) 592 return (0); 593 594 if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL) 595 return (0); 596 597 if (!sk_X509_NAME_push(*sk, name)) { 598 X509_NAME_free(name); 599 return (0); 600 } 601 return (1); 602} 603 604int SSL_add_client_CA(SSL *ssl, X509 *x) 605{ 606 return (add_client_CA(&(ssl->client_CA), x)); 607} 608 609int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x) 610{ 611 return (add_client_CA(&(ctx->client_CA), x)); 612} 613 614static int xname_cmp(const X509_NAME *const *a, const X509_NAME *const *b) 615{ 616 return (X509_NAME_cmp(*a, *b)); 617} 618 619#ifndef OPENSSL_NO_STDIO 620/** 621 * Load CA certs from a file into a ::STACK. Note that it is somewhat misnamed; 622 * it doesn't really have anything to do with clients (except that a common use 623 * for a stack of CAs is to send it to the client). Actually, it doesn't have 624 * much to do with CAs, either, since it will load any old cert. 625 * \param file the file containing one or more certs. 626 * \return a ::STACK containing the certs. 627 */ 628STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) 629{ 630 BIO *in; 631 X509 *x = NULL; 632 X509_NAME *xn = NULL; 633 STACK_OF(X509_NAME) *ret = NULL, *sk; 634 635 sk = sk_X509_NAME_new(xname_cmp); 636 637 in = BIO_new(BIO_s_file_internal()); 638 639 if ((sk == NULL) || (in == NULL)) { 640 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE); 641 goto err; 642 } 643 644 if (!BIO_read_filename(in, file)) 645 goto err; 646 647 for (;;) { 648 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL) 649 break; 650 if (ret == NULL) { 651 ret = sk_X509_NAME_new_null(); 652 if (ret == NULL) { 653 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE); 654 goto err; 655 } 656 } 657 if ((xn = X509_get_subject_name(x)) == NULL) 658 goto err; 659 /* check for duplicates */ 660 xn = X509_NAME_dup(xn); 661 if (xn == NULL) 662 goto err; 663 if (sk_X509_NAME_find(sk, xn) >= 0) 664 X509_NAME_free(xn); 665 else { 666 sk_X509_NAME_push(sk, xn); 667 sk_X509_NAME_push(ret, xn); 668 } 669 } 670 671 if (0) { 672 err: 673 if (ret != NULL) 674 sk_X509_NAME_pop_free(ret, X509_NAME_free); 675 ret = NULL; 676 } 677 if (sk != NULL) 678 sk_X509_NAME_free(sk); 679 if (in != NULL) 680 BIO_free(in); 681 if (x != NULL) 682 X509_free(x); 683 if (ret != NULL) 684 ERR_clear_error(); 685 return (ret); 686} 687#endif 688 689/** 690 * Add a file of certs to a stack. 691 * \param stack the stack to add to. 692 * \param file the file to add from. All certs in this file that are not 693 * already in the stack will be added. 694 * \return 1 for success, 0 for failure. Note that in the case of failure some 695 * certs may have been added to \c stack. 696 */ 697 698int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 699 const char *file) 700{ 701 BIO *in; 702 X509 *x = NULL; 703 X509_NAME *xn = NULL; 704 int ret = 1; 705 int (*oldcmp) (const X509_NAME *const *a, const X509_NAME *const *b); 706 707 oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp); 708 709 in = BIO_new(BIO_s_file_internal()); 710 711 if (in == NULL) { 712 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, 713 ERR_R_MALLOC_FAILURE); 714 goto err; 715 } 716 717 if (!BIO_read_filename(in, file)) 718 goto err; 719 720 for (;;) { 721 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL) 722 break; 723 if ((xn = X509_get_subject_name(x)) == NULL) 724 goto err; 725 xn = X509_NAME_dup(xn); 726 if (xn == NULL) 727 goto err; 728 if (sk_X509_NAME_find(stack, xn) >= 0) 729 X509_NAME_free(xn); 730 else 731 sk_X509_NAME_push(stack, xn); 732 } 733 734 ERR_clear_error(); 735 736 if (0) { 737 err: 738 ret = 0; 739 } 740 if (in != NULL) 741 BIO_free(in); 742 if (x != NULL) 743 X509_free(x); 744 745 (void)sk_X509_NAME_set_cmp_func(stack, oldcmp); 746 747 return ret; 748} 749 750/** 751 * Add a directory of certs to a stack. 752 * \param stack the stack to append to. 753 * \param dir the directory to append from. All files in this directory will be 754 * examined as potential certs. Any that are acceptable to 755 * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will be 756 * included. 757 * \return 1 for success, 0 for failure. Note that in the case of failure some 758 * certs may have been added to \c stack. 759 */ 760 761int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 762 const char *dir) 763{ 764 OPENSSL_DIR_CTX *d = NULL; 765 const char *filename; 766 int ret = 0; 767 768 CRYPTO_w_lock(CRYPTO_LOCK_READDIR); 769 770 /* Note that a side effect is that the CAs will be sorted by name */ 771 772 while ((filename = OPENSSL_DIR_read(&d, dir))) { 773 char buf[1024]; 774 int r; 775 776 if (strlen(dir) + strlen(filename) + 2 > sizeof buf) { 777 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, 778 SSL_R_PATH_TOO_LONG); 779 goto err; 780 } 781#ifdef OPENSSL_SYS_VMS 782 r = BIO_snprintf(buf, sizeof buf, "%s%s", dir, filename); 783#else 784 r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename); 785#endif 786 if (r <= 0 || r >= (int)sizeof(buf)) 787 goto err; 788 if (!SSL_add_file_cert_subjects_to_stack(stack, buf)) 789 goto err; 790 } 791 792 if (errno) { 793 SYSerr(SYS_F_OPENDIR, get_last_sys_error()); 794 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')"); 795 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB); 796 goto err; 797 } 798 799 ret = 1; 800 801 err: 802 if (d) 803 OPENSSL_DIR_end(&d); 804 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR); 805 return ret; 806} 807