Commit 4a253652 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Add opaque ID structure. 

Move the IP, email and host checking fields from the public
X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID
structure. By doing this the structure can be modified in future
without risk of breaking any applications.
(cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7)

Conflicts:

	crypto/x509/x509_vpm.c
parent 4fcdd66f

crypto/x509/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \ 
SRC= $(LIBSRC)



EXHEADER= x509.h x509_vfy.h

HEADER=	$(EXHEADER)

HEADER=	$(EXHEADER) vpm_int.h



ALL=    $(GENERAL) $(SRC) $(HEADER)

crypto/x509/vpm_int.h

0 → 100644
+69 −0
Original line number Diff line number Diff line 
/* vpm_int.h */

/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL

 * project 2013.

 */

/* ====================================================================

 * Copyright (c) 2013 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer. 

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    licensing@OpenSSL.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */



/* internal only structure to hold additional X509_VERIFY_PARAM data */



struct X509_VERIFY_PARAM_ID_st

	{

	unsigned char *host;	/* If not NULL hostname to match */

	size_t hostlen;

	unsigned char *email;	/* If not NULL email address to match */

	size_t emaillen;

	unsigned char *ip;	/* If not NULL IP address to match */

	size_t iplen;		/* Length of IP address */

	};

crypto/x509/x509_vfy.c

+5 −3
Original line number Diff line number Diff line
@@ -69,6 +69,7 @@ 
#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <openssl/objects.h>

#include "vpm_int.h"



/* CRL score values */
@@ -736,18 +737,19 @@ static int check_id_error(X509_STORE_CTX *ctx, int errcode) 
static int check_id(X509_STORE_CTX *ctx)

	{

	X509_VERIFY_PARAM *vpm = ctx->param;

	X509_VERIFY_PARAM_ID *id = vpm->id;

	X509 *x = ctx->cert;

	if (vpm->host && !X509_check_host(x, vpm->host, vpm->hostlen, 0))

	if (id->host && !X509_check_host(x, id->host, id->hostlen, 0))

		{

		if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))

			return 0;

		}

	if (vpm->email && !X509_check_email(x, vpm->email, vpm->emaillen, 0))

	if (id->email && !X509_check_email(x, id->email, id->emaillen, 0))

		{

		if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))

			return 0;

		}

	if (vpm->ip && !X509_check_ip(x, vpm->ip, vpm->iplen, 0))

	if (id->ip && !X509_check_ip(x, id->ip, id->iplen, 0))

		{

		if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))

			return 0;

crypto/x509/x509_vfy.h

+3 −6
Original line number Diff line number Diff line
@@ -158,6 +158,8 @@ typedef struct x509_lookup_method_st 
			    X509_OBJECT *ret);

	} X509_LOOKUP_METHOD;



typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID;



/* This structure hold all parameters associated with a verify operation

 * by including an X509_VERIFY_PARAM structure in related structures the

 * parameters used can be customized
@@ -173,12 +175,7 @@ typedef struct X509_VERIFY_PARAM_st 
	int trust;		/* trust setting to check */

	int depth;		/* Verify depth */

	STACK_OF(ASN1_OBJECT) *policies;	/* Permissible policies */

	unsigned char *host;	/* If not NULL hostname to match */

	size_t hostlen;

	unsigned char *email;	/* If not NULL email address to match */

	size_t emaillen;

	unsigned char *ip;	/* If not NULL IP address to match */

	size_t iplen;		/* Length of IP address */

	X509_VERIFY_PARAM_ID *id;	/* opaque ID data */

	} X509_VERIFY_PARAM;



DECLARE_STACK_OF(X509_VERIFY_PARAM)

crypto/x509/x509_vpm.c

+61 −27
Original line number Diff line number Diff line
@@ -65,10 +65,13 @@ 
#include <openssl/x509.h>

#include <openssl/x509v3.h>



#include "vpm_int.h"



/* X509_VERIFY_PARAM functions */



static void x509_verify_param_zero(X509_VERIFY_PARAM *param)

	{

	X509_VERIFY_PARAM_ID *paramid;

	if (!param)

		return;

	param->name = NULL;
@@ -83,31 +86,44 @@ static void x509_verify_param_zero(X509_VERIFY_PARAM *param) 
		sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);

		param->policies = NULL;

		}

	if (param->host)

	paramid = param->id;

	if (paramid->host)

		{

		OPENSSL_free(param->host);

		param->host = NULL;

		param->hostlen = 0;

		OPENSSL_free(paramid->host);

		paramid->host = NULL;

		paramid->hostlen = 0;

		}

	if (param->email)

	if (paramid->email)

		{

		OPENSSL_free(param->email);

		param->email = NULL;

		param->emaillen = 0;

		OPENSSL_free(paramid->email);

		paramid->email = NULL;

		paramid->emaillen = 0;

		}

	if (param->ip)

	if (paramid->ip)

		{

		OPENSSL_free(param->ip);

		param->ip = NULL;

		param->iplen = 0;

		OPENSSL_free(paramid->ip);

		paramid->ip = NULL;

		paramid->iplen = 0;

		}



	}



X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)

	{

	X509_VERIFY_PARAM *param;

	X509_VERIFY_PARAM_ID *paramid;

	param = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));

	if (!param)

		return NULL;

	paramid = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));

	if (!paramid)

		{

		OPENSSL_free(param);

		return NULL;

		}

	memset(param, 0, sizeof(X509_VERIFY_PARAM));

	memset(paramid, 0, sizeof(X509_VERIFY_PARAM_ID));

	param->id = paramid;

	x509_verify_param_zero(param);

	return param;

	}
@@ -115,6 +131,7 @@ X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void) 
void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)

	{

	x509_verify_param_zero(param);

	OPENSSL_free(param->id);

	OPENSSL_free(param);

	}
@@ -155,6 +172,11 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param) 
	(to_overwrite || \

		((src->field != def) && (to_default || (dest->field == def))))



/* As above but for ID fields */



#define test_x509_verify_param_copy_id(idf, def) \

	test_x509_verify_param_copy(id->idf, def)



/* Macro to test and copy a field if necessary */



#define x509_verify_param_copy(field, def) \
@@ -167,8 +189,10 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, 
	{

	unsigned long inh_flags;

	int to_default, to_overwrite;

	X509_VERIFY_PARAM_ID *id;

	if (!src)

		return 1;

	id = src->id;

	inh_flags = dest->inh_flags | src->inh_flags;



	if (inh_flags & X509_VP_FLAG_ONCE)
@@ -211,21 +235,21 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, 
			return 0;

		}



	if (test_x509_verify_param_copy(host, NULL))

	if (test_x509_verify_param_copy_id(host, NULL))

		{

		if (!X509_VERIFY_PARAM_set1_host(dest, src->host, src->hostlen))

		if (!X509_VERIFY_PARAM_set1_host(dest, id->host, id->hostlen))

			return 0;

		}



	if (test_x509_verify_param_copy(email, NULL))

	if (test_x509_verify_param_copy_id(email, NULL))

		{

		if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))

		if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen))

			return 0;

		}



	if (test_x509_verify_param_copy(ip, NULL))

	if (test_x509_verify_param_copy_id(ip, NULL))

		{

		if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))

		if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen))

			return 0;

		}
@@ -374,14 +398,14 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,

				const unsigned char *name, size_t namelen)

	{

	return int_x509_param_set1(&param->host, &param->hostlen,

	return int_x509_param_set1(&param->id->host, &param->id->hostlen,

					name, namelen);

	}



int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,

				const unsigned char *email, size_t emaillen)

	{

	return int_x509_param_set1(&param->email, &param->emaillen,

	return int_x509_param_set1(&param->id->email, &param->id->emaillen,

					email, emaillen);

	}
@@ -390,7 +414,7 @@ int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, 
	{

	if (iplen != 0 && iplen != 4 && iplen != 16)

		return 0;

	return int_x509_param_set1(&param->ip, &param->iplen, ip, iplen);

	return int_x509_param_set1(&param->id->ip, &param->id->iplen, ip, iplen);

	}



int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)
@@ -413,6 +437,11 @@ const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param) 
	return param->name;

	}



static X509_VERIFY_PARAM_ID _empty_id = {NULL, 0, NULL, 0, NULL, 0};



#define vpm_empty_id (X509_VERIFY_PARAM_ID *)&_empty_id





/* Default verify parameters: these are used for various

 * applications and can be overridden by the user specified table.

 * NB: the 'name' field *must* be in alphabetical order because it
@@ -428,7 +457,8 @@ static const X509_VERIFY_PARAM default_table[] = { 
	0,		/* purpose */

	0,		/* trust */

	100,		/* depth */

	NULL		/* policies */

	NULL,		/* policies */

	vpm_empty_id

	},

	{

	"pkcs7",			/* S/MIME sign parameters */
@@ -438,7 +468,8 @@ static const X509_VERIFY_PARAM default_table[] = { 
	X509_PURPOSE_SMIME_SIGN,	/* purpose */

	X509_TRUST_EMAIL,		/* trust */

	-1,				/* depth */

	NULL				/* policies */

	NULL,				/* policies */

	vpm_empty_id

	},

	{

	"smime_sign",			/* S/MIME sign parameters */
@@ -448,7 +479,8 @@ static const X509_VERIFY_PARAM default_table[] = { 
	X509_PURPOSE_SMIME_SIGN,	/* purpose */

	X509_TRUST_EMAIL,		/* trust */

	-1,				/* depth */

	NULL				/* policies */

	NULL,				/* policies */

	vpm_empty_id

	},

	{

	"ssl_client",			/* SSL/TLS client parameters */
@@ -458,7 +490,8 @@ static const X509_VERIFY_PARAM default_table[] = { 
	X509_PURPOSE_SSL_CLIENT,	/* purpose */

	X509_TRUST_SSL_CLIENT,		/* trust */

	-1,				/* depth */

	NULL				/* policies */

	NULL,				/* policies */

	vpm_empty_id

	},

	{

	"ssl_server",			/* SSL/TLS server parameters */
@@ -468,7 +501,8 @@ static const X509_VERIFY_PARAM default_table[] = { 
	X509_PURPOSE_SSL_SERVER,	/* purpose */

	X509_TRUST_SSL_SERVER,		/* trust */

	-1,				/* depth */

	NULL				/* policies */

	NULL,				/* policies */

	vpm_empty_id

	}};



static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;