OpenCoverage

x509_trs.c

Absolute File Name:/home/opencoverage/opencoverage/guest-scripts/libressl/src/crypto/x509/x509_trs.c
Source codeSwitch to Preprocessed file
LineSourceCount
1/* $OpenBSD: x509_trs.c,v 1.23 2018/05/18 18:40:38 tb Exp $ */-
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL-
3 * project 1999.-
4 */-
5/* ====================================================================-
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.-
7 *-
8 * Redistribution and use in source and binary forms, with or without-
9 * modification, are permitted provided that the following conditions-
10 * are met:-
11 *-
12 * 1. Redistributions of source code must retain the above copyright-
13 * notice, this list of conditions and the following disclaimer.-
14 *-
15 * 2. Redistributions in binary form must reproduce the above copyright-
16 * notice, this list of conditions and the following disclaimer in-
17 * the documentation and/or other materials provided with the-
18 * distribution.-
19 *-
20 * 3. All advertising materials mentioning features or use of this-
21 * software must display the following acknowledgment:-
22 * "This product includes software developed by the OpenSSL Project-
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"-
24 *-
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to-
26 * endorse or promote products derived from this software without-
27 * prior written permission. For written permission, please contact-
28 * licensing@OpenSSL.org.-
29 *-
30 * 5. Products derived from this software may not be called "OpenSSL"-
31 * nor may "OpenSSL" appear in their names without prior written-
32 * permission of the OpenSSL Project.-
33 *-
34 * 6. Redistributions of any form whatsoever must retain the following-
35 * acknowledgment:-
36 * "This product includes software developed by the OpenSSL Project-
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"-
38 *-
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY-
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE-
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR-
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR-
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,-
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT-
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;-
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)-
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,-
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)-
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED-
50 * OF THE POSSIBILITY OF SUCH DAMAGE.-
51 * ====================================================================-
52 *-
53 * This product includes cryptographic software written by Eric Young-
54 * (eay@cryptsoft.com). This product includes software written by Tim-
55 * Hudson (tjh@cryptsoft.com).-
56 *-
57 */-
58-
59#include <stdio.h>-
60#include <string.h>-
61-
62#include <openssl/err.h>-
63#include <openssl/x509v3.h>-
64-
65static int tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b);-
66static void trtable_free(X509_TRUST *p);-
67-
68static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);-
69static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);-
70static int trust_compat(X509_TRUST *trust, X509 *x, int flags);-
71-
72static int obj_trust(int id, X509 *x, int flags);-
73static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;-
74-
75/* WARNING: the following table should be kept in order of trust-
76 * and without any gaps so we can just subtract the minimum trust-
77 * value to get an index into the table-
78 */-
79-
80static X509_TRUST trstandard[] = {-
81 {X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},-
82 {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},-
83 {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},-
84 {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},-
85 {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},-
86 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},-
87 {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},-
88 {X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}-
89};-
90-
91#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))-
92-
93static STACK_OF(X509_TRUST) *trtable = NULL;-
94-
95static int-
96tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b)-
97{-
98 return (*a)->trust - (*b)->trust;
never executed: return (*a)->trust - (*b)->trust;
0
99}-
100-
101int-
102(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)-
103{-
104 int (*oldtrust)(int , X509 *, int);-
105-
106 oldtrust = default_trust;-
107 default_trust = trust;-
108 return oldtrust;
never executed: return oldtrust;
0
109}-
110-
111int-
112X509_check_trust(X509 *x, int id, int flags)-
113{-
114 X509_TRUST *pt;-
115 int idx;-
116-
117 if (id == -1)
id == -1Description
TRUEnever evaluated
FALSEevaluated 57 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-57
118 return 1;
never executed: return 1;
0
119 /*-
120 * XXX beck/jsing This enables self signed certs to be trusted for-
121 * an unspecified id/trust flag value (this is NOT the-
122 * X509_TRUST_DEFAULT), which was the longstanding-
123 * openssl behaviour. boringssl does not have this behaviour.-
124 *-
125 * This should be revisited, but changing the default "not default"-
126 * may break things.-
127 */-
128 if (id == 0) {
id == 0Description
TRUEevaluated 34 times by 1 test
Evaluated by:
  • ssltest
FALSEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
23-34
129 int rv;-
130 rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);-
131 if (rv != X509_TRUST_UNTRUSTED)
rv != 3Description
TRUEnever evaluated
FALSEevaluated 34 times by 1 test
Evaluated by:
  • ssltest
0-34
132 return rv;
never executed: return rv;
0
133 return trust_compat(NULL, x, 0);
executed 34 times by 1 test: return trust_compat( ((void *)0) , x, 0);
Executed by:
  • ssltest
34
134 }-
135 idx = X509_TRUST_get_by_id(id);-
136 if (idx == -1)
idx == -1Description
TRUEnever evaluated
FALSEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-23
137 return default_trust(id, x, flags);
never executed: return default_trust(id, x, flags);
0
138 pt = X509_TRUST_get0(idx);-
139 return pt->check_trust(pt, x, flags);
executed 23 times by 2 tests: return pt->check_trust(pt, x, flags);
Executed by:
  • ssltest
  • tlstest
23
140}-
141-
142int-
143X509_TRUST_get_count(void)-
144{-
145 if (!trtable)
!trtableDescription
TRUEnever evaluated
FALSEnever evaluated
0
146 return X509_TRUST_COUNT;
never executed: return (sizeof(trstandard)/sizeof(X509_TRUST));
0
147 return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
never executed: return sk_num(((_STACK*) (1 ? (trtable) : (struct stack_st_X509_TRUST*)0))) + (sizeof(trstandard)/sizeof(X509_TRUST));
0
148}-
149-
150X509_TRUST *-
151X509_TRUST_get0(int idx)-
152{-
153 if (idx < 0)
idx < 0Description
TRUEnever evaluated
FALSEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-23
154 return NULL;
never executed: return ((void *)0) ;
0
155 if (idx < (int)X509_TRUST_COUNT)
idx < (int)(si...f(X509_TRUST))Description
TRUEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEnever evaluated
0-23
156 return trstandard + idx;
executed 23 times by 2 tests: return trstandard + idx;
Executed by:
  • ssltest
  • tlstest
23
157 return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
never executed: return ((X509_TRUST *)sk_value(((_STACK*) (1 ? (trtable) : (struct stack_st_X509_TRUST*)0)), (idx - (sizeof(trstandard)/sizeof(X509_TRUST)))));
0
158}-
159-
160int-
161X509_TRUST_get_by_id(int id)-
162{-
163 X509_TRUST tmp;-
164 int idx;-
165-
166 if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
(id >= 1)Description
TRUEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEnever evaluated
(id <= 8)Description
TRUEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEnever evaluated
0-23
167 return id - X509_TRUST_MIN;
executed 23 times by 2 tests: return id - 1;
Executed by:
  • ssltest
  • tlstest
23
168 tmp.trust = id;-
169 if (!trtable)
!trtableDescription
TRUEnever evaluated
FALSEnever evaluated
0
170 return -1;
never executed: return -1;
0
171 idx = sk_X509_TRUST_find(trtable, &tmp);-
172 if (idx == -1)
idx == -1Description
TRUEnever evaluated
FALSEnever evaluated
0
173 return -1;
never executed: return -1;
0
174 return idx + X509_TRUST_COUNT;
never executed: return idx + (sizeof(trstandard)/sizeof(X509_TRUST));
0
175}-
176-
177int-
178X509_TRUST_set(int *t, int trust)-
179{-
180 if (X509_TRUST_get_by_id(trust) == -1) {
X509_TRUST_get...d(trust) == -1Description
TRUEnever evaluated
FALSEnever evaluated
0
181 X509error(X509_R_INVALID_TRUST);-
182 return 0;
never executed: return 0;
0
183 }-
184 *t = trust;-
185 return 1;
never executed: return 1;
0
186}-
187-
188int-
189X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),-
190 const char *name, int arg1, void *arg2)-
191{-
192 int idx;-
193 X509_TRUST *trtmp;-
194 char *name_dup;-
195-
196 /* This is set according to what we change: application can't set it */-
197 flags &= ~X509_TRUST_DYNAMIC;-
198 /* This will always be set for application modified trust entries */-
199 flags |= X509_TRUST_DYNAMIC_NAME;-
200 /* Get existing entry if any */-
201 idx = X509_TRUST_get_by_id(id);-
202 /* Need a new entry */-
203 if (idx == -1) {
idx == -1Description
TRUEnever evaluated
FALSEnever evaluated
0
204 if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
!(trtmp = mall...(X509_TRUST)))Description
TRUEnever evaluated
FALSEnever evaluated
0
205 X509error(ERR_R_MALLOC_FAILURE);-
206 return 0;
never executed: return 0;
0
207 }-
208 trtmp->flags = X509_TRUST_DYNAMIC;-
209 } else {
never executed: end of block
0
210 trtmp = X509_TRUST_get0(idx);-
211 if (trtmp == NULL) {
trtmp == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
212 X509error(X509_R_INVALID_TRUST);-
213 return 0;
never executed: return 0;
0
214 }-
215 }
never executed: end of block
0
216-
217 if ((name_dup = strdup(name)) == NULL)
never executed: __retval = (char *) memcpy (__retval, name , __len);
(name_dup = (_...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
__retval != ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
((const char *... ))[0] == '\0'Description
TRUEnever evaluated
FALSEnever evaluated
__builtin_constant_p ( name )Description
TRUEnever evaluated
FALSEnever evaluated
((size_t)(cons...( name ) == 1)Description
TRUEnever evaluated
FALSEnever evaluated
0
218 goto err;
never executed: goto err;
0
219-
220 /* free existing name if dynamic */-
221 if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
trtmp->flags & 2Description
TRUEnever evaluated
FALSEnever evaluated
0
222 free(trtmp->name);
never executed: free(trtmp->name);
0
223 /* dup supplied name */-
224 trtmp->name = name_dup;-
225 /* Keep the dynamic flag of existing entry */-
226 trtmp->flags &= X509_TRUST_DYNAMIC;-
227 /* Set all other flags */-
228 trtmp->flags |= flags;-
229-
230 trtmp->trust = id;-
231 trtmp->check_trust = ck;-
232 trtmp->arg1 = arg1;-
233 trtmp->arg2 = arg2;-
234-
235 /* If it's a new entry, manage the dynamic table */-
236 if (idx == -1) {
idx == -1Description
TRUEnever evaluated
FALSEnever evaluated
0
237 if (trtable == NULL &&
trtable == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
238 (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
(trtable = ((s...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
239 goto err;
never executed: goto err;
0
240 if (sk_X509_TRUST_push(trtable, trtmp) == 0)
sk_push(((_STA...UST*)0))) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
241 goto err;
never executed: goto err;
0
242 }
never executed: end of block
0
243 return 1;
never executed: return 1;
0
244-
245err:-
246 free(name_dup);-
247 if (idx == -1)
idx == -1Description
TRUEnever evaluated
FALSEnever evaluated
0
248 free(trtmp);
never executed: free(trtmp);
0
249 X509error(ERR_R_MALLOC_FAILURE);-
250 return 0;
never executed: return 0;
0
251}-
252-
253static void-
254trtable_free(X509_TRUST *p)-
255{-
256 if (!p)
!pDescription
TRUEnever evaluated
FALSEnever evaluated
0
257 return;
never executed: return;
0
258 if (p->flags & X509_TRUST_DYNAMIC) {
p->flags & 1Description
TRUEnever evaluated
FALSEnever evaluated
0
259 if (p->flags & X509_TRUST_DYNAMIC_NAME)
p->flags & 2Description
TRUEnever evaluated
FALSEnever evaluated
0
260 free(p->name);
never executed: free(p->name);
0
261 free(p);-
262 }
never executed: end of block
0
263}
never executed: end of block
0
264-
265void-
266X509_TRUST_cleanup(void)-
267{-
268 unsigned int i;-
269-
270 for (i = 0; i < X509_TRUST_COUNT; i++)
i < (sizeof(tr...f(X509_TRUST))Description
TRUEnever evaluated
FALSEnever evaluated
0
271 trtable_free(trstandard + i);
never executed: trtable_free(trstandard + i);
0
272 sk_X509_TRUST_pop_free(trtable, trtable_free);-
273 trtable = NULL;-
274}
never executed: end of block
0
275-
276int-
277X509_TRUST_get_flags(const X509_TRUST *xp)-
278{-
279 return xp->flags;
never executed: return xp->flags;
0
280}-
281-
282char *-
283X509_TRUST_get0_name(const X509_TRUST *xp)-
284{-
285 return xp->name;
never executed: return xp->name;
0
286}-
287-
288int-
289X509_TRUST_get_trust(const X509_TRUST *xp)-
290{-
291 return xp->trust;
never executed: return xp->trust;
0
292}-
293-
294static int-
295trust_1oidany(X509_TRUST *trust, X509 *x, int flags)-
296{-
297 if (x->aux && (x->aux->trust || x->aux->reject))
x->auxDescription
TRUEnever evaluated
FALSEevaluated 23 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
x->aux->trustDescription
TRUEnever evaluated
FALSEnever evaluated
x->aux->rejectDescription
TRUEnever evaluated
FALSEnever evaluated
0-23
298 return obj_trust(trust->arg1, x, flags);
never executed: return obj_trust(trust->arg1, x, flags);
0
299 /* we don't have any trust settings: for compatibility-
300 * we return trusted if it is self signed-
301 */-
302 return trust_compat(trust, x, flags);
executed 23 times by 2 tests: return trust_compat(trust, x, flags);
Executed by:
  • ssltest
  • tlstest
23
303}-
304-
305static int-
306trust_1oid(X509_TRUST *trust, X509 *x, int flags)-
307{-
308 if (x->aux)
x->auxDescription
TRUEnever evaluated
FALSEnever evaluated
0
309 return obj_trust(trust->arg1, x, flags);
never executed: return obj_trust(trust->arg1, x, flags);
0
310 return X509_TRUST_UNTRUSTED;
never executed: return 3;
0
311}-
312-
313static int-
314trust_compat(X509_TRUST *trust, X509 *x, int flags)-
315{-
316 X509_check_purpose(x, -1, 0);-
317 if (x->ex_flags & EXFLAG_SS)
x->ex_flags & 0x2000Description
TRUEevaluated 36 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEevaluated 21 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
21-36
318 return X509_TRUST_TRUSTED;
executed 36 times by 2 tests: return 1;
Executed by:
  • ssltest
  • tlstest
36
319 else-
320 return X509_TRUST_UNTRUSTED;
executed 21 times by 2 tests: return 3;
Executed by:
  • ssltest
  • tlstest
21
321}-
322-
323static int-
324obj_trust(int id, X509 *x, int flags)-
325{-
326 ASN1_OBJECT *obj;-
327 int i;-
328 X509_CERT_AUX *ax;-
329-
330 ax = x->aux;-
331 if (!ax)
!axDescription
TRUEevaluated 34 times by 1 test
Evaluated by:
  • ssltest
FALSEnever evaluated
0-34
332 return X509_TRUST_UNTRUSTED;
executed 34 times by 1 test: return 3;
Executed by:
  • ssltest
34
333 if (ax->reject) {
ax->rejectDescription
TRUEnever evaluated
FALSEnever evaluated
0
334 for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
i < sk_num(((_...1_OBJECT*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
335 obj = sk_ASN1_OBJECT_value(ax->reject, i);-
336 if (OBJ_obj2nid(obj) == id)
OBJ_obj2nid(obj) == idDescription
TRUEnever evaluated
FALSEnever evaluated
0
337 return X509_TRUST_REJECTED;
never executed: return 2;
0
338 }
never executed: end of block
0
339 }
never executed: end of block
0
340 if (ax->trust) {
ax->trustDescription
TRUEnever evaluated
FALSEnever evaluated
0
341 for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
i < sk_num(((_...1_OBJECT*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
342 obj = sk_ASN1_OBJECT_value(ax->trust, i);-
343 if (OBJ_obj2nid(obj) == id)
OBJ_obj2nid(obj) == idDescription
TRUEnever evaluated
FALSEnever evaluated
0
344 return X509_TRUST_TRUSTED;
never executed: return 1;
0
345 }
never executed: end of block
0
346 }
never executed: end of block
0
347 return X509_TRUST_UNTRUSTED;
never executed: return 3;
0
348}-
Source codeSwitch to Preprocessed file
Generated by Squish Coco 4.2.2