Tolerate some "variations" used in some

[openssl.git] / crypto / x509v3 / v3_purp.c

diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
index 7b4055f1fa299957cae4a2730f57dff8159632e9..9fa0e50ef03e70e12e2d78f56348ec9fa443a57d 100644 (file)
--- a/crypto/x509v3/v3_purp.c
+++ b/crypto/x509v3/v3_purp.c
@@ -59,22 +59,24 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/x509v3.h>

-
+#include <openssl/x509_vfy.h>

 
 static void x509v3_cache_extensions(X509 *x);
 
 
 static void x509v3_cache_extensions(X509 *x);
 

-static int ca_check(X509 *x);
-static int check_ssl_ca(X509 *x);
-static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca);
-static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
-static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
-static int purpose_smime(X509 *x, int ca);
-static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca);
-static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca);
-static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca);
-static int no_check(X509_PURPOSE *xp, X509 *x, int ca);
-
-static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b);
+static int ca_check(const X509 *x);
+static int check_ssl_ca(const X509 *x);
+static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int purpose_smime(const X509 *x, int ca);
+static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
+static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca);
+
+static int xp_cmp(const X509_PURPOSE * const *a,
+               const X509_PURPOSE * const *b);

 static void xptable_free(X509_PURPOSE *p);
 
 static X509_PURPOSE xstandard[] = {
 static void xptable_free(X509_PURPOSE *p);
 
 static X509_PURPOSE xstandard[] = {


@@ -85,6 +87,7 @@ static X509_PURPOSE xstandard[] = {
        {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
        {X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
        {X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
        {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
        {X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
        {X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},

+       {X509_PURPOSE_OCSP_HELPER, X509_TRUST_COMPAT, 0, ocsp_helper, "OCSP helper", "ocsphelper", NULL},

 };
 
 #define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
 };
 
 #define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))


@@ -93,15 +96,19 @@ IMPLEMENT_STACK_OF(X509_PURPOSE)
 
 static STACK_OF(X509_PURPOSE) *xptable = NULL;
 
 
 static STACK_OF(X509_PURPOSE) *xptable = NULL;
 

-static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b)
+static int xp_cmp(const X509_PURPOSE * const *a,
+               const X509_PURPOSE * const *b)

 {
        return (*a)->purpose - (*b)->purpose;
 }
 
 {
        return (*a)->purpose - (*b)->purpose;
 }
 

+/* As much as I'd like to make X509_check_purpose use a "const" X509*
+ * I really can't because it does recalculate hashes and do other non-const
+ * things. */

 int X509_check_purpose(X509 *x, int id, int ca)
 {
        int idx;
 int X509_check_purpose(X509 *x, int id, int ca)
 {
        int idx;

-       X509_PURPOSE *pt;
+       const X509_PURPOSE *pt;

        if(!(x->ex_flags & EXFLAG_SET)) {
                CRYPTO_w_lock(CRYPTO_LOCK_X509);
                x509v3_cache_extensions(x);
        if(!(x->ex_flags & EXFLAG_SET)) {
                CRYPTO_w_lock(CRYPTO_LOCK_X509);
                x509v3_cache_extensions(x);


@@ -138,7 +145,6 @@ int X509_PURPOSE_get_by_sname(char *sname)
        return -1;
 }
 
        return -1;
 }
 

-

 int X509_PURPOSE_get_by_id(int purpose)
 {
        X509_PURPOSE tmp;
 int X509_PURPOSE_get_by_id(int purpose)
 {
        X509_PURPOSE tmp;


@@ -153,7 +159,7 @@ int X509_PURPOSE_get_by_id(int purpose)
 }
 
 int X509_PURPOSE_add(int id, int trust, int flags,
 }
 
 int X509_PURPOSE_add(int id, int trust, int flags,

-                       int (*ck)(X509_PURPOSE *, X509 *, int),
+                       int (*ck)(const X509_PURPOSE *, const X509 *, int),

                                        char *name, char *sname, void *arg)
 {
        int idx;
                                        char *name, char *sname, void *arg)
 {
        int idx;


@@ -166,17 +172,17 @@ int X509_PURPOSE_add(int id, int trust, int flags,
        idx = X509_PURPOSE_get_by_id(id);
        /* Need a new entry */
        if(idx == -1) {
        idx = X509_PURPOSE_get_by_id(id);
        /* Need a new entry */
        if(idx == -1) {

-               if(!(ptmp = Malloc(sizeof(X509_PURPOSE)))) {
+               if(!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {

                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
                        return 0;
                }
                ptmp->flags = X509_PURPOSE_DYNAMIC;
        } else ptmp = X509_PURPOSE_get0(idx);
 
                        X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
                        return 0;
                }
                ptmp->flags = X509_PURPOSE_DYNAMIC;
        } else ptmp = X509_PURPOSE_get0(idx);
 

-       /* Free existing name if dynamic */
+       /* OPENSSL_free existing name if dynamic */

        if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
        if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {

-               Free(ptmp->name);
-               Free(ptmp->sname);
+               OPENSSL_free(ptmp->name);
+               OPENSSL_free(ptmp->sname);

        }
        /* dup supplied name */
        ptmp->name = BUF_strdup(name);
        }
        /* dup supplied name */
        ptmp->name = BUF_strdup(name);


@@ -215,10 +221,10 @@ static void xptable_free(X509_PURPOSE *p)
        if (p->flags & X509_PURPOSE_DYNAMIC) 
                {
                if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
        if (p->flags & X509_PURPOSE_DYNAMIC) 
                {
                if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {

-                       Free(p->name);
-                       Free(p->sname);
+                       OPENSSL_free(p->name);
+                       OPENSSL_free(p->sname);

                }
                }

-               Free(p);
+               OPENSSL_free(p);

                }
        }
 
                }
        }
 


@@ -250,16 +256,18 @@ int X509_PURPOSE_get_trust(X509_PURPOSE *xp)
        return xp->trust;
 }
 
        return xp->trust;
 }
 

-#ifndef NO_SHA

 static void x509v3_cache_extensions(X509 *x)
 {
        BASIC_CONSTRAINTS *bs;
        ASN1_BIT_STRING *usage;
        ASN1_BIT_STRING *ns;
 static void x509v3_cache_extensions(X509 *x)
 {
        BASIC_CONSTRAINTS *bs;
        ASN1_BIT_STRING *usage;
        ASN1_BIT_STRING *ns;

-       STACK_OF(ASN1_OBJECT) *extusage;
+       EXTENDED_KEY_USAGE *extusage;
+       

        int i;
        if(x->ex_flags & EXFLAG_SET) return;
        int i;
        if(x->ex_flags & EXFLAG_SET) return;

+#ifndef NO_SHA

        X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
        X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);

+#endif

        /* Does subject name match issuer ? */
        if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
                         x->ex_flags |= EXFLAG_SS;
        /* Does subject name match issuer ? */
        if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
                         x->ex_flags |= EXFLAG_SS;


@@ -312,6 +320,15 @@ static void x509v3_cache_extensions(X509 *x)
                                case NID_ms_sgc:
                                case NID_ns_sgc:
                                x->ex_xkusage |= XKU_SGC;
                                case NID_ms_sgc:
                                case NID_ns_sgc:
                                x->ex_xkusage |= XKU_SGC;

+                               break;
+
+                               case NID_OCSP_sign:
+                               x->ex_xkusage |= XKU_OCSP_SIGN;
+                               break;
+
+                               case NID_time_stamp:
+                               x->ex_xkusage |= XKU_TIMESTAMP;
+                               break;

                        }
                }
                sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
                        }
                }
                sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);


@@ -323,9 +340,10 @@ static void x509v3_cache_extensions(X509 *x)
                x->ex_flags |= EXFLAG_NSCERT;
                ASN1_BIT_STRING_free(ns);
        }
                x->ex_flags |= EXFLAG_NSCERT;
                ASN1_BIT_STRING_free(ns);
        }

+       x->skid =X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
+       x->akid =X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);

        x->ex_flags |= EXFLAG_SET;
 }
        x->ex_flags |= EXFLAG_SET;
 }

-#endif

 
 /* CA checks common to all purposes
  * return codes:
 
 /* CA checks common to all purposes
  * return codes:


@@ -343,7 +361,7 @@ static void x509v3_cache_extensions(X509 *x)
 #define ns_reject(x, usage) \
        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
 
 #define ns_reject(x, usage) \
        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
 

-static int ca_check(X509 *x)
+static int ca_check(const X509 *x)

 {
        /* keyUsage if present should allow cert signing */
        if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
 {
        /* keyUsage if present should allow cert signing */
        if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;


@@ -353,12 +371,14 @@ static int ca_check(X509 *x)
                else return 0;
        } else {
                if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
                else return 0;
        } else {
                if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;

+               /* If key usage present it must have certSign so tolerate it */
+               else if (x->ex_flags & EXFLAG_KUSAGE) return 3;

                else return 2;
        }
 }
 
 /* Check SSL CA: common checks for SSL client and server */
                else return 2;
        }
 }
 
 /* Check SSL CA: common checks for SSL client and server */

-static int check_ssl_ca(X509 *x)
+static int check_ssl_ca(const X509 *x)

 {
        int ca_ret;
        ca_ret = ca_check(x);
 {
        int ca_ret;
        ca_ret = ca_check(x);


@@ -371,9 +391,9 @@ static int check_ssl_ca(X509 *x)
        if(ca_ret != 2) return ca_ret;
        else return 0;
 }
        if(ca_ret != 2) return ca_ret;
        else return 0;
 }

-       

 
 

-static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
+
+static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
        if(ca) return check_ssl_ca(x);
 {
        if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
        if(ca) return check_ssl_ca(x);


@@ -384,7 +404,7 @@ static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
        return 1;
 }
 
        return 1;
 }
 

-static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
        if(ca) return check_ssl_ca(x);
 {
        if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
        if(ca) return check_ssl_ca(x);


@@ -397,7 +417,7 @@ static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
 
 }
 
 
 }
 

-static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
+static int check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        int ret;
        ret = check_purpose_ssl_server(xp, x, ca);
 {
        int ret;
        ret = check_purpose_ssl_server(xp, x, ca);


@@ -408,7 +428,7 @@ static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
 }
 
 /* common S/MIME checks */
 }
 
 /* common S/MIME checks */

-static int purpose_smime(X509 *x, int ca)
+static int purpose_smime(const X509 *x, int ca)

 {
        if(xku_reject(x,XKU_SMIME)) return 0;
        if(ca) {
 {
        if(xku_reject(x,XKU_SMIME)) return 0;
        if(ca) {


@@ -432,16 +452,16 @@ static int purpose_smime(X509 *x, int ca)
        return 1;
 }
 
        return 1;
 }
 

-static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca)
+static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        int ret;
        ret = purpose_smime(x, ca);
        if(!ret || ca) return ret;
 {
        int ret;
        ret = purpose_smime(x, ca);
        if(!ret || ca) return ret;

-       if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
+       if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_NON_REPUDIATION)) return 0;

        return ret;
 }
 
        return ret;
 }
 

-static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca)
+static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        int ret;
        ret = purpose_smime(x, ca);
 {
        int ret;
        ret = purpose_smime(x, ca);


@@ -450,7 +470,7 @@ static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca)
        return ret;
 }
 
        return ret;
 }
 

-static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca)
+static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        if(ca) {
                int ca_ret;
 {
        if(ca) {
                int ca_ret;


@@ -461,7 +481,85 @@ static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca)
        return 1;
 }
 
        return 1;
 }
 

-static int no_check(X509_PURPOSE *xp, X509 *x, int ca)
+/* OCSP helper: this is *not* a full OCSP check. It just checks that
+ * each CA is valid. Additional checks must be made on the chain.
+ */
+
+static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca)
+{
+       /* Must be a valid CA */
+       if(ca) {
+               int ca_ret;
+               ca_ret = ca_check(x);
+               if(ca_ret != 2) return ca_ret;
+               if(x->ex_flags & EXFLAG_NSCERT) {
+                       if(x->ex_nscert & NS_ANY_CA) return ca_ret;
+                       return 0;
+               }
+               return 0;
+       }
+       /* leaf certificate is checked in OCSP_verify() */
+       return 1;
+}
+
+static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca)

 {
        return 1;
 }
 {
        return 1;
 }

+
+/* Various checks to see if one certificate issued the second.
+ * This can be used to prune a set of possible issuer certificates
+ * which have been looked up using some simple method such as by
+ * subject name.
+ * These are:
+ * 1. Check issuer_name(subject) == subject_name(issuer)
+ * 2. If akid(subject) exists check it matches issuer
+ * 3. If key_usage(issuer) exists check it supports certificate signing
+ * returns 0 for OK, positive for reason for mismatch, reasons match
+ * codes for X509_verify_cert()
+ */
+
+int X509_check_issued(X509 *issuer, X509 *subject)
+{
+       if(X509_NAME_cmp(X509_get_subject_name(issuer),
+                       X509_get_issuer_name(subject)))
+                               return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
+       x509v3_cache_extensions(issuer);
+       x509v3_cache_extensions(subject);
+       if(subject->akid) {
+               /* Check key ids (if present) */
+               if(subject->akid->keyid && issuer->skid &&
+                ASN1_OCTET_STRING_cmp(subject->akid->keyid, issuer->skid) )
+                               return X509_V_ERR_AKID_SKID_MISMATCH;
+               /* Check serial number */
+               if(subject->akid->serial &&
+                       ASN1_INTEGER_cmp(X509_get_serialNumber(issuer),
+                                               subject->akid->serial))
+                               return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
+               /* Check issuer name */
+               if(subject->akid->issuer) {
+                       /* Ugh, for some peculiar reason AKID includes
+                        * SEQUENCE OF GeneralName. So look for a DirName.
+                        * There may be more than one but we only take any
+                        * notice of the first.
+                        */
+                       GENERAL_NAMES *gens;
+                       GENERAL_NAME *gen;
+                       X509_NAME *nm = NULL;
+                       int i;
+                       gens = subject->akid->issuer;
+                       for(i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
+                               gen = sk_GENERAL_NAME_value(gens, i);
+                               if(gen->type == GEN_DIRNAME) {
+                                       nm = gen->d.dirn;
+                                       break;
+                               }
+                       }
+                       if(nm && X509_NAME_cmp(nm, X509_get_issuer_name(issuer)))
+                               return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
+               }
+       }
+       if(ku_reject(issuer, KU_KEY_CERT_SIGN)) return X509_V_ERR_KEYUSAGE_NO_CERTSIGN;
+       return X509_V_OK;
+}
+