+static void dane_reset(struct dane_st *dane)
+{
+ /*
+ * Reset state to verify another chain, or clear after failure.
+ */
+ X509_free(dane->mcert);
+ dane->mcert = NULL;
+ dane->mtlsa = NULL;
+ dane->mdpth = -1;
+ dane->pdpth = -1;
+}
+
+static int check_leaf_suiteb(X509_STORE_CTX *ctx, X509 *cert)
+{
+ int err = X509_chain_check_suiteb(NULL, cert, NULL, ctx->param->flags);
+
+ if (err == X509_V_OK)
+ return 1;
+ return verify_cb_cert(ctx, cert, 0, err);
+}
+
+static int dane_verify(X509_STORE_CTX *ctx)
+{
+ X509 *cert = ctx->cert;
+ struct dane_st *dane = (struct dane_st *)ctx->dane;
+ int matched;
+ int done;
+
+ dane_reset(dane);
+
+ /*-
+ * When testing the leaf certificate, if we match a DANE-EE(3) record,
+ * dane_match() returns 1 and we're done. If however we match a PKIX-EE(1)
+ * record, the match depth and matching TLSA record are recorded, but the
+ * return value is 0, because we still need to find a PKIX trust-anchor.
+ * Therefore, when DANE authentication is enabled (required), we're done
+ * if:
+ * + matched < 0, internal error.
+ * + matched == 1, we matched a DANE-EE(3) record
+ * + matched == 0, mdepth < 0 (no PKIX-EE match) and there are no
+ * DANE-TA(2) or PKIX-TA(0) to test.
+ */
+ matched = dane_match(ctx, ctx->cert, 0);
+ done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0);
+
+ if (done)
+ X509_get_pubkey_parameters(NULL, ctx->chain);
+
+ if (matched > 0) {
+ /* Callback invoked as needed */
+ if (!check_leaf_suiteb(ctx, cert))
+ return 0;
+ /* Bypass internal_verify(), issue depth 0 success callback */
+ ctx->error_depth = 0;
+ ctx->current_cert = cert;
+ return ctx->verify_cb(1, ctx);
+ }
+
+ if (matched < 0) {
+ ctx->error_depth = 0;
+ ctx->current_cert = cert;
+ ctx->error = X509_V_ERR_OUT_OF_MEM;
+ return -1;
+ }
+
+ if (done) {
+ /* Fail early, TA-based success is not possible */
+ if (!check_leaf_suiteb(ctx, cert))
+ return 0;
+ return verify_cb_cert(ctx, cert, 0, X509_V_ERR_DANE_NO_MATCH);
+ }
+
+ /*
+ * Chain verification for usages 0/1/2. TLSA record matching of depth > 0
+ * certificates happens in-line with building the rest of the chain.
+ */
+ return verify_chain(ctx);
+}
+
+static int build_chain(X509_STORE_CTX *ctx)
+{
+ struct dane_st *dane = (struct dane_st *)ctx->dane;
+ int num = sk_X509_num(ctx->chain);
+ X509 *cert = sk_X509_value(ctx->chain, num - 1);
+ int ss = cert_self_signed(cert);
+ STACK_OF(X509) *sktmp = NULL;
+ unsigned int search;
+ int may_trusted = 0;
+ int may_alternate = 0;
+ int trust = X509_TRUST_UNTRUSTED;
+ int alt_untrusted = 0;
+ int depth;
+ int ok = 0;
+ int i;
+
+ /* Our chain starts with a single untrusted element. */
+ OPENSSL_assert(num == 1 && ctx->num_untrusted == num);
+
+#define S_DOUNTRUSTED (1 << 0) /* Search untrusted chain */
+#define S_DOTRUSTED (1 << 1) /* Search trusted store */
+#define S_DOALTERNATE (1 << 2) /* Retry with pruned alternate chain */
+ /*
+ * Set up search policy, untrusted if possible, trusted-first if enabled.
+ * If we're doing DANE and not doing PKIX-TA/PKIX-EE, we never look in the
+ * trust_store, otherwise we might look there first. If not trusted-first,
+ * and alternate chains are not disabled, try building an alternate chain
+ * if no luck with untrusted first.
+ */
+ search = (ctx->untrusted != NULL) ? S_DOUNTRUSTED : 0;
+ if (DANETLS_HAS_PKIX(dane) || !DANETLS_HAS_DANE(dane)) {
+ if (search == 0 || ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
+ search |= S_DOTRUSTED;
+ else if (!(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS))
+ may_alternate = 1;
+ may_trusted = 1;
+ }
+
+ /*
+ * Shallow-copy the stack of untrusted certificates (with TLS, this is
+ * typically the content of the peer's certificate message) so can make
+ * multiple passes over it, while free to remove elements as we go.
+ */
+ if (ctx->untrusted && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
+ X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+
+ /* Include any untrusted full certificates from DNS */
+ if (DANETLS_ENABLED(dane) && dane->certs != NULL) {
+ for (i = 0; i < sk_X509_num(dane->certs); ++i) {
+ if (!sk_X509_push(sktmp, sk_X509_value(dane->certs, i))) {
+ sk_X509_free(sktmp);
+ X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+ }
+ }
+
+ /*
+ * Still absurdly large, but arithmetically safe, a lower hard upper bound
+ * might be reasonable.
+ */
+ if (ctx->param->depth > INT_MAX/2)
+ ctx->param->depth = INT_MAX/2;
+
+ /*
+ * Try to Extend the chain until we reach an ultimately trusted issuer.
+ * Build chains up to one longer the limit, later fail if we hit the limit,
+ * with an X509_V_ERR_CERT_CHAIN_TOO_LONG error code.
+ */
+ depth = ctx->param->depth + 1;
+
+ while (search != 0) {
+ X509 *x;
+ X509 *xtmp = NULL;
+
+ /*
+ * Look in the trust store if enabled for first lookup, or we've run
+ * out of untrusted issuers and search here is not disabled. When
+ * we exceed the depth limit, we simulate absence of a match.
+ */
+ if ((search & S_DOTRUSTED) != 0) {
+ STACK_OF(X509) *hide = ctx->chain;
+
+ i = num = sk_X509_num(ctx->chain);
+ if ((search & S_DOALTERNATE) != 0) {
+ /*
+ * As high up the chain as we can, look for an alternative
+ * trusted issuer of an untrusted certificate that currently
+ * has an untrusted issuer. We use the alt_untrusted variable
+ * to track how far up the chain we find the first match. It
+ * is only if and when we find a match, that we prune the chain
+ * and reset ctx->num_untrusted to the reduced count of
+ * untrusted certificates. While we're searching for such a
+ * match (which may never be found), it is neither safe nor
+ * wise to preemptively modify either the chain or
+ * ctx->num_untrusted.
+ *
+ * Note, like ctx->num_untrusted, alt_untrusted is a count of
+ * untrusted certificates, not a "depth".
+ */
+ i = alt_untrusted;
+ }
+ x = sk_X509_value(ctx->chain, i-1);
+
+ /* Suppress duplicate suppression */
+ ctx->chain = NULL;
+ ok = (depth < num) ? 0 : ctx->get_issuer(&xtmp, ctx, x);
+ ctx->chain = hide;
+
+ if (ok < 0) {
+ trust = X509_TRUST_REJECTED;
+ search = 0;
+ continue;
+ }
+
+ if (ok > 0) {
+ /*
+ * Alternative trusted issuer for a mid-chain untrusted cert?
+ * Pop the untrusted cert's successors and retry. We might now
+ * be able to complete a valid chain via the trust store. Note
+ * that despite the current trust-store match we might still
+ * fail complete the chain to a suitable trust-anchor, in which
+ * case we may prune some more untrusted certificates and try
+ * again. Thus the S_DOALTERNATE bit may yet be turned on
+ * again with an even shorter untrusted chain!
+ *
+ * If in the process we threw away our matching PKIX-TA trust
+ * anchor, reset DANE trust. We might find a suitable trusted
+ * certificate among the ones from the trust store.
+ */
+ if ((search & S_DOALTERNATE) != 0) {
+ OPENSSL_assert(num > i && i > 0 && ss == 0);
+ search &= ~S_DOALTERNATE;
+ for (; num > i; --num)
+ X509_free(sk_X509_pop(ctx->chain));
+ ctx->num_untrusted = num;
+
+ if (DANETLS_ENABLED(dane) &&
+ dane->mdpth >= ctx->num_untrusted) {
+ dane->mdpth = -1;
+ X509_free(dane->mcert);
+ dane->mcert = NULL;
+ }
+ if (DANETLS_ENABLED(dane) &&
+ dane->pdpth >= ctx->num_untrusted)
+ dane->pdpth = -1;
+ }
+
+ /*
+ * Self-signed untrusted certificates get replaced by their
+ * trusted matching issuer. Otherwise, grow the chain.
+ */
+ if (ss == 0) {
+ if (!sk_X509_push(ctx->chain, x = xtmp)) {
+ X509_free(xtmp);
+ X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
+ trust = X509_TRUST_REJECTED;
+ search = 0;
+ continue;
+ }
+ ss = cert_self_signed(x);
+ } else if (num == ctx->num_untrusted) {
+ /*
+ * We have a self-signed certificate that has the same
+ * subject name (and perhaps keyid and/or serial number) as
+ * a trust-anchor. We must have an exact match to avoid
+ * possible impersonation via key substitution etc.
+ */
+ if (X509_cmp(x, xtmp) != 0) {
+ /* Self-signed untrusted mimic. */
+ X509_free(xtmp);
+ ok = 0;
+ } else {
+ X509_free(x);
+ ctx->num_untrusted = --num;
+ (void) sk_X509_set(ctx->chain, num, x = xtmp);
+ }
+ }
+
+ /*
+ * We've added a new trusted certificate to the chain, recheck
+ * trust. If not done, and not self-signed look deeper.
+ * Whether or not we're doing "trusted first", we no longer
+ * look for untrusted certificates from the peer's chain.
+ *
+ * At this point ctx->num_trusted and num must reflect the
+ * correct number of untrusted certificates, since the DANE
+ * logic in check_trust() depends on distinguishing CAs from
+ * "the wire" from CAs from the trust store. In particular, the
+ * certificate at depth "num" should be the new trusted
+ * certificate with ctx->num_untrusted <= num.
+ */
+ if (ok) {
+ OPENSSL_assert(ctx->num_untrusted <= num);
+ search &= ~S_DOUNTRUSTED;
+ switch (trust = check_trust(ctx, num)) {
+ case X509_TRUST_TRUSTED:
+ case X509_TRUST_REJECTED:
+ search = 0;
+ continue;
+ }
+ if (ss == 0)
+ continue;
+ }
+ }
+
+ /*
+ * No dispositive decision, and either self-signed or no match, if
+ * we were doing untrusted-first, and alt-chains are not disabled,
+ * do that, by repeatedly losing one untrusted element at a time,
+ * and trying to extend the shorted chain.
+ */
+ if ((search & S_DOUNTRUSTED) == 0) {
+ /* Continue search for a trusted issuer of a shorter chain? */
+ if ((search & S_DOALTERNATE) != 0 && --alt_untrusted > 0)
+ continue;
+ /* Still no luck and no fallbacks left? */
+ if (!may_alternate || (search & S_DOALTERNATE) != 0 ||
+ ctx->num_untrusted < 2)
+ break;
+ /* Search for a trusted issuer of a shorter chain */
+ search |= S_DOALTERNATE;
+ alt_untrusted = ctx->num_untrusted - 1;
+ ss = 0;
+ }
+ }
+
+ /*
+ * Extend chain with peer-provided certificates
+ */
+ if ((search & S_DOUNTRUSTED) != 0) {
+ num = sk_X509_num(ctx->chain);
+ OPENSSL_assert(num == ctx->num_untrusted);
+ x = sk_X509_value(ctx->chain, num-1);
+ xtmp = (depth < num) ? NULL : find_issuer(ctx, sktmp, x);
+
+ /*
+ * Once we run out of untrusted issuers, we stop looking for more
+ * and start looking only in the trust store if enabled.
+ */
+ if (xtmp == NULL) {
+ search &= ~S_DOUNTRUSTED;
+ if (may_trusted)
+ search |= S_DOTRUSTED;
+ continue;
+ }
+
+ if (!sk_X509_push(ctx->chain, x = xtmp)) {
+ X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE);
+ trust = X509_TRUST_REJECTED;
+ search = 0;
+ continue;
+ }
+ X509_up_ref(x);
+ ++ctx->num_untrusted;
+ ss = cert_self_signed(xtmp);
+
+ /*
+ * Not strictly necessary, but saves cycles looking at the same
+ * certificates over and over.
+ */
+ (void) sk_X509_delete_ptr(sktmp, x);
+
+ /*
+ * Check for DANE-TA trust of the topmost untrusted certificate.
+ */
+ switch (trust = check_dane_issuer(ctx, ctx->num_untrusted - 1)) {
+ case X509_TRUST_TRUSTED:
+ case X509_TRUST_REJECTED:
+ search = 0;
+ continue;
+ }
+ }
+ }
+ sk_X509_free(sktmp);
+
+ /*
+ * Last chance to make a trusted chain, either bare DANE-TA public-key
+ * signers, or else direct leaf PKIX trust.
+ */
+ num = sk_X509_num(ctx->chain);
+ if (num <= depth) {
+ if (trust == X509_TRUST_UNTRUSTED && DANETLS_HAS_DANE_TA(dane))
+ trust = check_dane_pkeys(ctx);
+ if (trust == X509_TRUST_UNTRUSTED && num == ctx->num_untrusted)
+ trust = check_trust(ctx, num);
+ }
+
+ switch (trust) {
+ case X509_TRUST_TRUSTED:
+ return 1;
+ case X509_TRUST_REJECTED:
+ /* Callback already issued */
+ return 0;
+ case X509_TRUST_UNTRUSTED:
+ default:
+ num = sk_X509_num(ctx->chain);
+ if (num > depth)
+ return verify_cb_cert(ctx, NULL, num-1,
+ X509_V_ERR_CERT_CHAIN_TOO_LONG);
+ if (DANETLS_ENABLED(dane) &&
+ (!DANETLS_HAS_PKIX(dane) || dane->pdpth >= 0))
+ return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_DANE_NO_MATCH);
+ if (ss && sk_X509_num(ctx->chain) == 1)
+ return verify_cb_cert(ctx, NULL, num-1,
+ X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT);
+ if (ss)
+ return verify_cb_cert(ctx, NULL, num-1,
+ X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN);
+ if (ctx->num_untrusted < num)
+ return verify_cb_cert(ctx, NULL, num-1,
+ X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT);
+ return verify_cb_cert(ctx, NULL, num-1,
+ X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY);
+ }
+}