2 * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/store.h>
11 #include "internal/cryptlib.h"
12 #include "crypto/x509.h"
13 #include "x509_local.h"
15 DEFINE_STACK_OF_STRING()
17 /* Generic object loader, given expected type and criterion */
18 static int cache_objects(X509_LOOKUP *lctx, const char *uri,
19 const OSSL_STORE_SEARCH *criterion,
20 int depth, OPENSSL_CTX *libctx, const char *propq)
23 OSSL_STORE_CTX *ctx = NULL;
24 X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
26 if ((ctx = OSSL_STORE_open_with_libctx(uri, libctx, propq,
27 NULL, NULL, NULL, NULL)) == NULL)
31 * We try to set the criterion, but don't care if it was valid or not.
32 * For a OSSL_STORE, it merely serves as an optimization, the expectation
33 * being that if the criterion couldn't be used, we will get *everything*
34 * from the container that the URI represents rather than the subset that
35 * the criterion indicates, so the biggest harm is that we cache more
36 * objects certs and CRLs than we may expect, but that's ok.
38 * Specifically for OpenSSL's own file: scheme, the only workable
39 * criterion is the BY_NAME one, which it can only apply on directories,
40 * but it's possible that the URI is a single file rather than a directory,
41 * and in that case, the BY_NAME criterion is pointless.
43 * We could very simply not apply any criterion at all here, and just let
44 * the code that selects certs and CRLs from the cached objects do its job,
45 * but it's a nice optimization when it can be applied (such as on an
46 * actual directory with a thousand CA certs).
48 if (criterion != NULL)
49 OSSL_STORE_find(ctx, criterion);
52 OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
55 /* NULL means error or "end of file". Either way, we break. */
59 infotype = OSSL_STORE_INFO_get_type(info);
62 if (infotype == OSSL_STORE_INFO_NAME) {
64 * This is an entry in the "directory" represented by the current
65 * uri. if |depth| allows, dive into it.
68 ok = cache_objects(lctx, OSSL_STORE_INFO_get0_NAME(info),
69 criterion, depth - 1, libctx, propq);
72 * We know that X509_STORE_add_{cert|crl} increments the object's
73 * refcount, so we can safely use OSSL_STORE_INFO_get0_{cert,crl}
77 case OSSL_STORE_INFO_CERT:
78 ok = X509_STORE_add_cert(xstore,
79 OSSL_STORE_INFO_get0_CERT(info));
81 case OSSL_STORE_INFO_CRL:
82 ok = X509_STORE_add_crl(xstore,
83 OSSL_STORE_INFO_get0_CRL(info));
88 OSSL_STORE_INFO_free(info);
92 OSSL_STORE_close(ctx);
98 /* Because OPENSSL_free is a macro and for C type match */
99 static void free_uri(OPENSSL_STRING data)
104 static void by_store_free(X509_LOOKUP *ctx)
106 STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
107 sk_OPENSSL_STRING_pop_free(uris, free_uri);
110 static int by_store_ctrl_with_libctx(X509_LOOKUP *ctx, int cmd,
111 const char *argp, long argl,
113 OPENSSL_CTX *libctx, const char *propq)
116 case X509_L_ADD_STORE:
117 /* If no URI is given, use the default cert dir as default URI */
119 argp = ossl_safe_getenv(X509_get_default_cert_dir_env());
121 argp = X509_get_default_cert_dir();
124 STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
127 uris = sk_OPENSSL_STRING_new_null();
128 X509_LOOKUP_set_method_data(ctx, uris);
130 return sk_OPENSSL_STRING_push(uris, OPENSSL_strdup(argp)) > 0;
132 case X509_L_LOAD_STORE:
133 /* This is a shortcut for quick loading of specific containers */
134 return cache_objects(ctx, argp, NULL, 0, libctx, propq);
140 static int by_store_ctrl(X509_LOOKUP *ctx, int cmd,
141 const char *argp, long argl, char **retp)
143 return by_store_ctrl_with_libctx(ctx, cmd, argp, argl, retp, NULL, NULL);
146 static int by_store(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
147 const OSSL_STORE_SEARCH *criterion, X509_OBJECT *ret,
148 OPENSSL_CTX *libctx, const char *propq)
150 STACK_OF(OPENSSL_STRING) *uris = X509_LOOKUP_get_method_data(ctx);
154 for (i = 0; i < sk_OPENSSL_STRING_num(uris); i++) {
155 ok = cache_objects(ctx, sk_OPENSSL_STRING_value(uris, i), criterion,
156 1 /* depth */, libctx, propq);
164 static int by_store_subject_with_libctx(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
165 const X509_NAME *name, X509_OBJECT *ret,
166 OPENSSL_CTX *libctx, const char *propq)
168 OSSL_STORE_SEARCH *criterion =
169 OSSL_STORE_SEARCH_by_name((X509_NAME *)name); /* won't modify it */
170 int ok = by_store(ctx, type, criterion, ret, libctx, propq);
171 STACK_OF(X509_OBJECT) *store_objects =
172 X509_STORE_get0_objects(X509_LOOKUP_get_store(ctx));
173 X509_OBJECT *tmp = NULL;
175 OSSL_STORE_SEARCH_free(criterion);
178 tmp = X509_OBJECT_retrieve_by_subject(store_objects, type, name);
183 * This could also be done like this:
190 * However, we want to exercise the documented API to the max, so
191 * we do it the hard way.
193 * To be noted is that X509_OBJECT_set1_* increment the refcount,
194 * but so does X509_STORE_CTX_get_by_subject upon return of this
195 * function, so we must ensure the the refcount is decremented
196 * before we return, or we will get a refcount leak. We cannot do
197 * this with X509_OBJECT_free(), though, as that will free a bit
202 ok = X509_OBJECT_set1_X509(ret, tmp->data.x509);
204 X509_free(tmp->data.x509);
207 ok = X509_OBJECT_set1_X509_CRL(ret, tmp->data.crl);
209 X509_CRL_free(tmp->data.crl);
218 static int by_store_subject(X509_LOOKUP *ctx, X509_LOOKUP_TYPE type,
219 const X509_NAME *name, X509_OBJECT *ret)
221 return by_store_subject_with_libctx(ctx, type, name, ret, NULL, NULL);
225 * We lack the implementations for get_by_issuer_serial, get_by_fingerprint
226 * and get_by_alias. There's simply not enough support in the X509_LOOKUP
227 * or X509_STORE APIs.
230 static X509_LOOKUP_METHOD x509_store_lookup = {
231 "Load certs from STORE URIs",
233 by_store_free, /* free */
236 by_store_ctrl, /* ctrl */
237 by_store_subject, /* get_by_subject */
238 NULL, /* get_by_issuer_serial */
239 NULL, /* get_by_fingerprint */
240 NULL, /* get_by_alias */
241 by_store_subject_with_libctx,
242 by_store_ctrl_with_libctx
245 X509_LOOKUP_METHOD *X509_LOOKUP_store(void)
247 return &x509_store_lookup;