sync
This commit is contained in:
parent
f609457dcf
commit
62073e0295
GPG key ID:
F42C07F07E2E35B7
318 changed files with 8112 additions and 4346 deletions
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_local.h,v 1.7 2023/04/28 16:30:14 tb Exp $ */
|
||||
/* $OpenBSD: x509_local.h,v 1.8 2023/05/08 14:51:00 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 2013.
|
||||
*/
|
||||
|
|
@ -327,10 +327,10 @@ struct x509_store_ctx_st {
|
|||
/* The following are set by the caller */
|
||||
X509 *cert; /* The cert to check */
|
||||
STACK_OF(X509) *untrusted; /* chain of X509s - untrusted - passed in */
|
||||
STACK_OF(X509) *trusted; /* trusted stack for use with get_issuer() */
|
||||
STACK_OF(X509_CRL) *crls; /* set of CRLs passed in */
|
||||
|
||||
X509_VERIFY_PARAM *param;
|
||||
void *other_ctx; /* Other info for use with get_issuer() */
|
||||
|
||||
/* Callbacks for various operations */
|
||||
int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_prn.c,v 1.5 2023/02/16 08:38:17 tb Exp $ */
|
||||
/* $OpenBSD: x509_prn.c,v 1.6 2023/05/08 05:30:38 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 1999.
|
||||
*/
|
||||
|
|
@ -178,7 +178,7 @@ X509V3_extensions_print(BIO *bp, const char *title,
|
|||
obj = X509_EXTENSION_get_object(ex);
|
||||
i2a_ASN1_OBJECT(bp, obj);
|
||||
j = X509_EXTENSION_get_critical(ex);
|
||||
if (BIO_printf(bp, ": %s\n",j?"critical":"") <= 0)
|
||||
if (BIO_printf(bp, ":%s\n", j ? " critical" : "") <= 0)
|
||||
return 0;
|
||||
if (!X509V3_EXT_print(bp, ex, flag, indent + 4)) {
|
||||
BIO_printf(bp, "%*s", indent + 4, "");
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_utl.c,v 1.14 2023/04/23 11:52:14 tb Exp $ */
|
||||
/* $OpenBSD: x509_utl.c,v 1.17 2023/05/12 19:02:10 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project.
|
||||
*/
|
||||
|
|
@ -55,9 +55,9 @@
|
|||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
/* X509 v3 extension utilities */
|
||||
|
||||
#include <ctype.h>
|
||||
#include <limits.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
|
|
@ -67,6 +67,8 @@
|
|||
#include <openssl/err.h>
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
#include "bytestring.h"
|
||||
|
||||
static char *bn_to_string(const BIGNUM *bn);
|
||||
static char *strip_spaces(char *name);
|
||||
static int sk_strcmp(const char * const *a, const char * const *b);
|
||||
|
|
@ -459,97 +461,148 @@ strip_spaces(char *name)
|
|||
return p;
|
||||
}
|
||||
|
||||
/* hex string utilities */
|
||||
static const char hex_digits[] = "0123456789ABCDEF";
|
||||
|
||||
/* Given a buffer of length 'len' return a malloc'ed string with its
|
||||
* hex representation
|
||||
*/
|
||||
char *
|
||||
hex_to_string(const unsigned char *buffer, long len)
|
||||
{
|
||||
char *tmp, *q;
|
||||
const unsigned char *p;
|
||||
int i;
|
||||
static const char hexdig[] = "0123456789ABCDEF";
|
||||
CBB cbb;
|
||||
CBS cbs;
|
||||
uint8_t *out = NULL;
|
||||
uint8_t c;
|
||||
size_t out_len;
|
||||
|
||||
if (!CBB_init(&cbb, 0))
|
||||
goto err;
|
||||
|
||||
if (len < 0)
|
||||
return NULL;
|
||||
if (len == 0)
|
||||
return calloc(1, 1);
|
||||
if ((tmp = calloc(len, 3)) == NULL) {
|
||||
X509V3error(ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
goto err;
|
||||
|
||||
CBS_init(&cbs, buffer, len);
|
||||
while (CBS_len(&cbs) > 0) {
|
||||
if (!CBS_get_u8(&cbs, &c))
|
||||
goto err;
|
||||
if (!CBB_add_u8(&cbb, hex_digits[c >> 4]))
|
||||
goto err;
|
||||
if (!CBB_add_u8(&cbb, hex_digits[c & 0xf]))
|
||||
goto err;
|
||||
if (CBS_len(&cbs) > 0) {
|
||||
if (!CBB_add_u8(&cbb, ':'))
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
q = tmp;
|
||||
for (i = 0, p = buffer; i < len; i++, p++) {
|
||||
*q++ = hexdig[(*p >> 4) & 0xf];
|
||||
*q++ = hexdig[*p & 0xf];
|
||||
*q++ = ':';
|
||||
}
|
||||
q[-1] = 0;
|
||||
return tmp;
|
||||
|
||||
if (!CBB_add_u8(&cbb, '\0'))
|
||||
goto err;
|
||||
|
||||
if (!CBB_finish(&cbb, &out, &out_len))
|
||||
goto err;
|
||||
|
||||
err:
|
||||
CBB_cleanup(&cbb);
|
||||
|
||||
return out;
|
||||
}
|
||||
LCRYPTO_ALIAS(hex_to_string);
|
||||
|
||||
/* Give a string of hex digits convert to
|
||||
* a buffer
|
||||
*/
|
||||
static int
|
||||
x509_skip_colons_cbs(CBS *cbs)
|
||||
{
|
||||
uint8_t c;
|
||||
|
||||
while (CBS_len(cbs) > 0) {
|
||||
if (!CBS_peek_u8(cbs, &c))
|
||||
return 0;
|
||||
if (c != ':')
|
||||
return 1;
|
||||
if (!CBS_get_u8(cbs, &c))
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
x509_get_xdigit_nibble_cbs(CBS *cbs, uint8_t *out_nibble)
|
||||
{
|
||||
uint8_t c;
|
||||
|
||||
if (!CBS_get_u8(cbs, &c))
|
||||
return 0;
|
||||
|
||||
if (c >= '0' && c <= '9') {
|
||||
*out_nibble = c - '0';
|
||||
return 1;
|
||||
}
|
||||
if (c >= 'a' && c <= 'f') {
|
||||
*out_nibble = c - 'a' + 10;
|
||||
return 1;
|
||||
}
|
||||
if (c >= 'A' && c <= 'F') {
|
||||
*out_nibble = c - 'A' + 10;
|
||||
return 1;
|
||||
}
|
||||
|
||||
X509V3error(X509V3_R_ILLEGAL_HEX_DIGIT);
|
||||
return 0;
|
||||
}
|
||||
|
||||
unsigned char *
|
||||
string_to_hex(const char *str, long *len)
|
||||
{
|
||||
unsigned char *hexbuf, *q;
|
||||
unsigned char ch, cl, *p;
|
||||
if (!str) {
|
||||
X509V3error(X509V3_R_INVALID_NULL_ARGUMENT);
|
||||
return NULL;
|
||||
}
|
||||
if (!(hexbuf = malloc(strlen(str) >> 1)))
|
||||
CBB cbb;
|
||||
CBS cbs;
|
||||
uint8_t *out = NULL;
|
||||
size_t out_len;
|
||||
uint8_t hi, lo;
|
||||
|
||||
*len = 0;
|
||||
|
||||
if (!CBB_init(&cbb, 0))
|
||||
goto err;
|
||||
for (p = (unsigned char *)str, q = hexbuf; *p; ) {
|
||||
ch = *p++;
|
||||
if (ch == ':')
|
||||
continue;
|
||||
cl = *p++;
|
||||
if (!cl) {
|
||||
X509V3error(X509V3_R_ODD_NUMBER_OF_DIGITS);
|
||||
free(hexbuf);
|
||||
return NULL;
|
||||
}
|
||||
ch = tolower(ch);
|
||||
cl = tolower(cl);
|
||||
|
||||
if ((ch >= '0') && (ch <= '9'))
|
||||
ch -= '0';
|
||||
else if ((ch >= 'a') && (ch <= 'f'))
|
||||
ch -= 'a' - 10;
|
||||
else
|
||||
goto badhex;
|
||||
|
||||
if ((cl >= '0') && (cl <= '9'))
|
||||
cl -= '0';
|
||||
else if ((cl >= 'a') && (cl <= 'f'))
|
||||
cl -= 'a' - 10;
|
||||
else
|
||||
goto badhex;
|
||||
|
||||
*q++ = (ch << 4) | cl;
|
||||
if (str == NULL) {
|
||||
X509V3error(X509V3_R_INVALID_NULL_ARGUMENT);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (len)
|
||||
*len = q - hexbuf;
|
||||
CBS_init(&cbs, str, strlen(str));
|
||||
while (CBS_len(&cbs) > 0) {
|
||||
/*
|
||||
* Skipping only a single colon between two pairs of digits
|
||||
* would make more sense - history...
|
||||
*/
|
||||
if (!x509_skip_colons_cbs(&cbs))
|
||||
goto err;
|
||||
/* Another historic idiocy. */
|
||||
if (CBS_len(&cbs) == 0)
|
||||
break;
|
||||
if (!x509_get_xdigit_nibble_cbs(&cbs, &hi))
|
||||
goto err;
|
||||
if (CBS_len(&cbs) == 0) {
|
||||
X509V3error(X509V3_R_ODD_NUMBER_OF_DIGITS);
|
||||
goto err;
|
||||
}
|
||||
if (!x509_get_xdigit_nibble_cbs(&cbs, &lo))
|
||||
goto err;
|
||||
if (!CBB_add_u8(&cbb, hi << 4 | lo))
|
||||
goto err;
|
||||
}
|
||||
|
||||
return hexbuf;
|
||||
if (!CBB_finish(&cbb, &out, &out_len))
|
||||
goto err;
|
||||
if (out_len > LONG_MAX) {
|
||||
freezero(out, out_len);
|
||||
out = NULL;
|
||||
goto err;
|
||||
}
|
||||
|
||||
*len = out_len;
|
||||
|
||||
err:
|
||||
free(hexbuf);
|
||||
X509V3error(ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
CBB_cleanup(&cbb);
|
||||
|
||||
badhex:
|
||||
free(hexbuf);
|
||||
X509V3error(X509V3_R_ILLEGAL_HEX_DIGIT);
|
||||
return NULL;
|
||||
return out;
|
||||
}
|
||||
LCRYPTO_ALIAS(string_to_hex);
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_verify.c,v 1.65 2023/04/28 16:50:16 beck Exp $ */
|
||||
/* $OpenBSD: x509_verify.c,v 1.66 2023/05/07 07:11:50 tb Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
|
||||
*
|
||||
|
|
@ -275,7 +275,6 @@ x509_verify_ctx_cert_is_root(struct x509_verify_ctx *ctx, X509 *cert,
|
|||
cert)) != NULL) {
|
||||
X509_free(match);
|
||||
return x509_verify_check_chain_end(cert, full_chain);
|
||||
|
||||
}
|
||||
} else {
|
||||
/* Check the provided roots */
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_vfy.c,v 1.120 2023/04/30 14:59:52 tb Exp $ */
|
||||
/* $OpenBSD: x509_vfy.c,v 1.122 2023/05/08 14:51:00 tb Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -144,7 +144,7 @@ static int X509_cmp_time_internal(const ASN1_TIME *ctm, time_t *cmp_time,
|
|||
int clamp_notafter);
|
||||
|
||||
static int internal_verify(X509_STORE_CTX *ctx);
|
||||
static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
|
||||
static int get_trusted_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
|
||||
static int check_key_level(X509_STORE_CTX *ctx, X509 *cert);
|
||||
static int verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err);
|
||||
|
||||
|
|
@ -592,7 +592,6 @@ X509_verify_cert_legacy(X509_STORE_CTX *ctx)
|
|||
int
|
||||
X509_verify_cert(X509_STORE_CTX *ctx)
|
||||
{
|
||||
STACK_OF(X509) *roots = NULL;
|
||||
struct x509_verify_ctx *vctx = NULL;
|
||||
int chain_count = 0;
|
||||
|
||||
|
|
@ -656,8 +655,6 @@ X509_verify_cert(X509_STORE_CTX *ctx)
|
|||
}
|
||||
x509_verify_ctx_free(vctx);
|
||||
|
||||
sk_X509_pop_free(roots, X509_free);
|
||||
|
||||
/* if we succeed we have a chain in ctx->chain */
|
||||
return (chain_count > 0 && ctx->chain != NULL);
|
||||
}
|
||||
|
|
@ -697,12 +694,12 @@ check_issued(X509_STORE_CTX *ctx, X509 *subject, X509 *issuer)
|
|||
return X509_check_issued(issuer, subject) == X509_V_OK;
|
||||
}
|
||||
|
||||
/* Alternative lookup method: look from a STACK stored in other_ctx */
|
||||
/* Alternative lookup method: look from a STACK stored in ctx->trusted */
|
||||
|
||||
static int
|
||||
get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
|
||||
get_trusted_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
|
||||
{
|
||||
*issuer = find_issuer(ctx, ctx->other_ctx, x, 1);
|
||||
*issuer = find_issuer(ctx, ctx->trusted, x, 1);
|
||||
if (*issuer) {
|
||||
CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
|
||||
return 1;
|
||||
|
|
@ -2437,17 +2434,17 @@ LCRYPTO_ALIAS(X509_STORE_CTX_init);
|
|||
*/
|
||||
|
||||
void
|
||||
X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
|
||||
X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *trusted)
|
||||
{
|
||||
ctx->other_ctx = sk;
|
||||
ctx->get_issuer = get_issuer_sk;
|
||||
X509_STORE_CTX_set0_trusted_stack(ctx, trusted);
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_STORE_CTX_trusted_stack);
|
||||
|
||||
void
|
||||
X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
|
||||
X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *trusted)
|
||||
{
|
||||
X509_STORE_CTX_trusted_stack(ctx, sk);
|
||||
ctx->trusted = trusted;
|
||||
ctx->get_issuer = get_trusted_issuer;
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_STORE_CTX_set0_trusted_stack);
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509name.c,v 1.32 2023/05/02 14:13:05 beck Exp $ */
|
||||
/* $OpenBSD: x509name.c,v 1.34 2023/05/03 08:10:23 beck Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -66,7 +66,6 @@
|
|||
#include <openssl/stack.h>
|
||||
#include <openssl/x509.h>
|
||||
|
||||
#include "bytestring.h"
|
||||
#include "x509_local.h"
|
||||
|
||||
int
|
||||
|
|
@ -85,37 +84,21 @@ int
|
|||
X509_NAME_get_text_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, char *buf,
|
||||
int len)
|
||||
{
|
||||
unsigned char *text = NULL;
|
||||
int i;
|
||||
ASN1_STRING *data;
|
||||
int i, text_len;
|
||||
int ret = -1;
|
||||
CBS cbs;
|
||||
|
||||
i = X509_NAME_get_index_by_OBJ(name, obj, -1);
|
||||
if (i < 0)
|
||||
goto err;
|
||||
return (-1);
|
||||
data = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
|
||||
/*
|
||||
* Fail if we cannot encode as UTF-8, or if the UTF-8 encoding of the
|
||||
* string contains a 0 byte, because mortal callers seldom handle the
|
||||
* length difference correctly
|
||||
*/
|
||||
if ((text_len = ASN1_STRING_to_UTF8(&text, data)) < 0)
|
||||
goto err;
|
||||
CBS_init(&cbs, text, text_len);
|
||||
if (CBS_contains_zero_byte(&cbs))
|
||||
goto err;
|
||||
/* We still support the "pass NULL to find out how much" API */
|
||||
if (buf != NULL) {
|
||||
if (!CBS_write_bytes(&cbs, buf, len - 1, NULL))
|
||||
goto err;
|
||||
/* It must be a C string */
|
||||
buf[text_len] = '\0';
|
||||
i = (data->length > (len - 1)) ? (len - 1) : data->length;
|
||||
if (buf == NULL)
|
||||
return (data->length);
|
||||
if (i >= 0) {
|
||||
memcpy(buf, data->data, i);
|
||||
buf[i] = '\0';
|
||||
}
|
||||
ret = text_len;
|
||||
err:
|
||||
free(text);
|
||||
return (ret);
|
||||
return (i);
|
||||
}
|
||||
LCRYPTO_ALIAS(X509_NAME_get_text_by_OBJ);
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue