Line | Source | Count |
1 | | - |
2 | | - |
3 | | - |
4 | | - |
5 | | - |
6 | | - |
7 | | - |
8 | | - |
9 | | - |
10 | #include <stdio.h> | - |
11 | #include "internal/cryptlib.h" | - |
12 | #include <openssl/objects.h> | - |
13 | #include <openssl/ts.h> | - |
14 | #include <openssl/pkcs7.h> | - |
15 | #include "ts_lcl.h" | - |
16 | | - |
17 | static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, | - |
18 | X509 *signer, STACK_OF(X509) **chain); | - |
19 | static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si, | - |
20 | STACK_OF(X509) *chain); | - |
21 | static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si); | - |
22 | static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert); | - |
23 | static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert); | - |
24 | static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx, | - |
25 | PKCS7 *token, TS_TST_INFO *tst_info); | - |
26 | static int ts_check_status_info(TS_RESP *response); | - |
27 | static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text); | - |
28 | static int ts_check_policy(const ASN1_OBJECT *req_oid, | - |
29 | const TS_TST_INFO *tst_info); | - |
30 | static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info, | - |
31 | X509_ALGOR **md_alg, | - |
32 | unsigned char **imprint, unsigned *imprint_len); | - |
33 | static int ts_check_imprints(X509_ALGOR *algor_a, | - |
34 | const unsigned char *imprint_a, unsigned len_a, | - |
35 | TS_TST_INFO *tst_info); | - |
36 | static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info); | - |
37 | static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer); | - |
38 | static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, | - |
39 | GENERAL_NAME *name); | - |
40 | static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert); | - |
41 | static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si); | - |
42 | | - |
43 | | - |
44 | | - |
45 | | - |
46 | | - |
47 | #define TS_STATUS_BUF_SIZE 256 | - |
48 | | - |
49 | | - |
50 | | - |
51 | | - |
52 | static const char *ts_status_text[] = { | - |
53 | "granted", | - |
54 | "grantedWithMods", | - |
55 | "rejection", | - |
56 | "waiting", | - |
57 | "revocationWarning", | - |
58 | "revocationNotification" | - |
59 | }; | - |
60 | | - |
61 | #define TS_STATUS_TEXT_SIZE OSSL_NELEM(ts_status_text) | - |
62 | | - |
63 | static struct { | - |
64 | int code; | - |
65 | const char *text; | - |
66 | } ts_failure_info[] = { | - |
67 | {TS_INFO_BAD_ALG, "badAlg"}, | - |
68 | {TS_INFO_BAD_REQUEST, "badRequest"}, | - |
69 | {TS_INFO_BAD_DATA_FORMAT, "badDataFormat"}, | - |
70 | {TS_INFO_TIME_NOT_AVAILABLE, "timeNotAvailable"}, | - |
71 | {TS_INFO_UNACCEPTED_POLICY, "unacceptedPolicy"}, | - |
72 | {TS_INFO_UNACCEPTED_EXTENSION, "unacceptedExtension"}, | - |
73 | {TS_INFO_ADD_INFO_NOT_AVAILABLE, "addInfoNotAvailable"}, | - |
74 | {TS_INFO_SYSTEM_FAILURE, "systemFailure"} | - |
75 | }; | - |
76 | | - |
77 | | - |
78 | | - |
79 | | - |
80 | | - |
81 | | - |
82 | | - |
83 | | - |
84 | | - |
85 | | - |
86 | | - |
87 | | - |
88 | | - |
89 | | - |
90 | int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, | - |
91 | X509_STORE *store, X509 **signer_out) | - |
92 | { | - |
93 | STACK_OF(PKCS7_SIGNER_INFO) *sinfos = NULL; | - |
94 | PKCS7_SIGNER_INFO *si; | - |
95 | STACK_OF(X509) *signers = NULL; | - |
96 | X509 *signer; | - |
97 | STACK_OF(X509) *chain = NULL; | - |
98 | char buf[4096]; | - |
99 | int i, j = 0, ret = 0; | - |
100 | BIO *p7bio = NULL; | - |
101 | | - |
102 | | - |
103 | if (!token) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
104 | TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_INVALID_NULL_POINTER); | - |
105 | goto err; never executed: goto err; | 0 |
106 | } | - |
107 | if (!PKCS7_type_is_signed(token)) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
108 | TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_WRONG_CONTENT_TYPE); | - |
109 | goto err; never executed: goto err; | 0 |
110 | } | - |
111 | sinfos = PKCS7_get_signer_info(token); | - |
112 | if (!sinfos || sk_PKCS7_SIGNER_INFO_num(sinfos) != 1) {TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
113 | TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_THERE_MUST_BE_ONE_SIGNER); | - |
114 | goto err; never executed: goto err; | 0 |
115 | } | - |
116 | si = sk_PKCS7_SIGNER_INFO_value(sinfos, 0); | - |
117 | if (PKCS7_get_detached(token)) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
118 | TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_NO_CONTENT); | - |
119 | goto err; never executed: goto err; | 0 |
120 | } | - |
121 | | - |
122 | | - |
123 | | - |
124 | | - |
125 | | - |
126 | signers = PKCS7_get0_signers(token, certs, 0); | - |
127 | if (!signers || sk_X509_num(signers) != 1)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
128 | goto err; never executed: goto err; | 0 |
129 | signer = sk_X509_value(signers, 0); | - |
130 | | - |
131 | if (!ts_verify_cert(store, certs, signer, &chain))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
132 | goto err; never executed: goto err; | 0 |
133 | if (!ts_check_signing_certs(si, chain))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
134 | goto err; never executed: goto err; | 0 |
135 | p7bio = PKCS7_dataInit(token, NULL); | - |
136 | | - |
137 | | - |
138 | while ((i = BIO_read(p7bio, buf, sizeof(buf))) > 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
139 | continue; never executed: continue; | 0 |
140 | | - |
141 | j = PKCS7_signatureVerify(p7bio, token, si, signer); | - |
142 | if (j <= 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
143 | TSerr(TS_F_TS_RESP_VERIFY_SIGNATURE, TS_R_SIGNATURE_FAILURE); | - |
144 | goto err; never executed: goto err; | 0 |
145 | } | - |
146 | | - |
147 | if (signer_out) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
148 | *signer_out = signer; | - |
149 | X509_up_ref(signer); | - |
150 | } never executed: end of block | 0 |
151 | ret = 1; | - |
152 | | - |
153 | err: code before this statement never executed: err: | 0 |
154 | BIO_free_all(p7bio); | - |
155 | sk_X509_pop_free(chain, X509_free); | - |
156 | sk_X509_free(signers); | - |
157 | | - |
158 | return ret; never executed: return ret; | 0 |
159 | } | - |
160 | | - |
161 | | - |
162 | | - |
163 | | - |
164 | | - |
165 | static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, | - |
166 | X509 *signer, STACK_OF(X509) **chain) | - |
167 | { | - |
168 | X509_STORE_CTX *cert_ctx = NULL; | - |
169 | int i; | - |
170 | int ret = 0; | - |
171 | | - |
172 | *chain = NULL; | - |
173 | cert_ctx = X509_STORE_CTX_new(); | - |
174 | if (cert_ctx == NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
175 | TSerr(TS_F_TS_VERIFY_CERT, ERR_R_MALLOC_FAILURE); | - |
176 | goto err; never executed: goto err; | 0 |
177 | } | - |
178 | if (!X509_STORE_CTX_init(cert_ctx, store, signer, untrusted))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
179 | goto end; never executed: goto end; | 0 |
180 | X509_STORE_CTX_set_purpose(cert_ctx, X509_PURPOSE_TIMESTAMP_SIGN); | - |
181 | i = X509_verify_cert(cert_ctx); | - |
182 | if (i <= 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
183 | int j = X509_STORE_CTX_get_error(cert_ctx); | - |
184 | TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR); | - |
185 | ERR_add_error_data(2, "Verify error:", | - |
186 | X509_verify_cert_error_string(j)); | - |
187 | goto err; never executed: goto err; | 0 |
188 | } | - |
189 | *chain = X509_STORE_CTX_get1_chain(cert_ctx); | - |
190 | ret = 1; | - |
191 | goto end; never executed: goto end; | 0 |
192 | | - |
193 | err: | - |
194 | ret = 0; | - |
195 | | - |
196 | end: code before this statement never executed: end: | 0 |
197 | X509_STORE_CTX_free(cert_ctx); | - |
198 | return ret; never executed: return ret; | 0 |
199 | } | - |
200 | | - |
201 | static int ts_check_signing_certs(PKCS7_SIGNER_INFO *si, | - |
202 | STACK_OF(X509) *chain) | - |
203 | { | - |
204 | ESS_SIGNING_CERT *ss = ess_get_signing_cert(si); | - |
205 | STACK_OF(ESS_CERT_ID) *cert_ids = NULL; | - |
206 | ESS_SIGNING_CERT_V2 *ssv2 = ess_get_signing_cert_v2(si); | - |
207 | STACK_OF(ESS_CERT_ID_V2) *cert_ids_v2 = NULL; | - |
208 | X509 *cert; | - |
209 | int i = 0; | - |
210 | int ret = 0; | - |
211 | | - |
212 | if (ss != NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
213 | cert_ids = ss->cert_ids; | - |
214 | cert = sk_X509_value(chain, 0); | - |
215 | if (ts_find_cert(cert_ids, cert) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
216 | goto err; never executed: goto err; | 0 |
217 | | - |
218 | | - |
219 | | - |
220 | | - |
221 | | - |
222 | if (sk_ESS_CERT_ID_num(cert_ids) > 1) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
223 | for (i = 1; i < sk_X509_num(chain); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
224 | cert = sk_X509_value(chain, i); | - |
225 | if (ts_find_cert(cert_ids, cert) < 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
226 | goto err; never executed: goto err; | 0 |
227 | } never executed: end of block | 0 |
228 | } never executed: end of block | 0 |
229 | } else if (ssv2 != NULL) { never executed: end of block TRUE | never evaluated | FALSE | never evaluated |
| 0 |
230 | cert_ids_v2 = ssv2->cert_ids; | - |
231 | cert = sk_X509_value(chain, 0); | - |
232 | if (ts_find_cert_v2(cert_ids_v2, cert) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
233 | goto err; never executed: goto err; | 0 |
234 | | - |
235 | | - |
236 | | - |
237 | | - |
238 | | - |
239 | if (sk_ESS_CERT_ID_V2_num(cert_ids_v2) > 1) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
240 | for (i = 1; i < sk_X509_num(chain); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
241 | cert = sk_X509_value(chain, i); | - |
242 | if (ts_find_cert_v2(cert_ids_v2, cert) < 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
243 | goto err; never executed: goto err; | 0 |
244 | } never executed: end of block | 0 |
245 | } never executed: end of block | 0 |
246 | } else { never executed: end of block | 0 |
247 | goto err; never executed: goto err; | 0 |
248 | } | - |
249 | | - |
250 | ret = 1; | - |
251 | err: code before this statement never executed: err: | 0 |
252 | if (!ret)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
253 | TSerr(TS_F_TS_CHECK_SIGNING_CERTS, never executed: ERR_put_error(47,(103),(101),__FILE__,254) ; | 0 |
254 | TS_R_ESS_SIGNING_CERTIFICATE_ERROR); never executed: ERR_put_error(47,(103),(101),__FILE__,254) ; | 0 |
255 | ESS_SIGNING_CERT_free(ss); | - |
256 | ESS_SIGNING_CERT_V2_free(ssv2); | - |
257 | return ret; never executed: return ret; | 0 |
258 | } | - |
259 | | - |
260 | static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si) | - |
261 | { | - |
262 | ASN1_TYPE *attr; | - |
263 | const unsigned char *p; | - |
264 | attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate); | - |
265 | if (!attr)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
266 | return NULL; never executed: return ((void *)0) ; | 0 |
267 | p = attr->value.sequence->data; | - |
268 | return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); never executed: return d2i_ESS_SIGNING_CERT( ((void *)0) , &p, attr->value.sequence->length); | 0 |
269 | } | - |
270 | | - |
271 | static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si) | - |
272 | { | - |
273 | ASN1_TYPE *attr; | - |
274 | const unsigned char *p; | - |
275 | | - |
276 | attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2); | - |
277 | if (attr == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
278 | return NULL; never executed: return ((void *)0) ; | 0 |
279 | p = attr->value.sequence->data; | - |
280 | return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length); never executed: return d2i_ESS_SIGNING_CERT_V2( ((void *)0) , &p, attr->value.sequence->length); | 0 |
281 | } | - |
282 | | - |
283 | | - |
284 | static int ts_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert) | - |
285 | { | - |
286 | int i; | - |
287 | unsigned char cert_sha1[SHA_DIGEST_LENGTH]; | - |
288 | | - |
289 | if (!cert_ids || !cert)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
290 | return -1; never executed: return -1; | 0 |
291 | | - |
292 | X509_digest(cert, EVP_sha1(), cert_sha1, NULL); | - |
293 | | - |
294 | | - |
295 | X509_check_purpose(cert, -1, 0); | - |
296 | | - |
297 | | - |
298 | for (i = 0; i < sk_ESS_CERT_ID_num(cert_ids); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
299 | ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i); | - |
300 | | - |
301 | if (cid->hash->length == SHA_DIGEST_LENGTHTRUE | never evaluated | FALSE | never evaluated |
| 0 |
302 | && memcmp(cid->hash->data, cert_sha1, SHA_DIGEST_LENGTH) == 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
303 | ESS_ISSUER_SERIAL *is = cid->issuer_serial; | - |
304 | if (!is || !ts_issuer_serial_cmp(is, cert))TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
305 | return i; never executed: return i; | 0 |
306 | } never executed: end of block | 0 |
307 | } never executed: end of block | 0 |
308 | | - |
309 | return -1; never executed: return -1; | 0 |
310 | } | - |
311 | | - |
312 | | - |
313 | static int ts_find_cert_v2(STACK_OF(ESS_CERT_ID_V2) *cert_ids, X509 *cert) | - |
314 | { | - |
315 | int i; | - |
316 | unsigned char cert_digest[EVP_MAX_MD_SIZE]; | - |
317 | unsigned int len; | - |
318 | | - |
319 | | - |
320 | for (i = 0; i < sk_ESS_CERT_ID_V2_num(cert_ids); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
321 | ESS_CERT_ID_V2 *cid = sk_ESS_CERT_ID_V2_value(cert_ids, i); | - |
322 | const EVP_MD *md; | - |
323 | | - |
324 | if (cid->hash_alg != NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
325 | md = EVP_get_digestbyobj(cid->hash_alg->algorithm); never executed: md = EVP_get_digestbyname(OBJ_nid2sn(OBJ_obj2nid(cid->hash_alg->algorithm))); | 0 |
326 | else | - |
327 | md = EVP_sha256(); never executed: md = EVP_sha256(); | 0 |
328 | | - |
329 | X509_digest(cert, md, cert_digest, &len); | - |
330 | if (cid->hash->length != (int)len)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
331 | return -1; never executed: return -1; | 0 |
332 | | - |
333 | if (memcmp(cid->hash->data, cert_digest, cid->hash->length) == 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
334 | ESS_ISSUER_SERIAL *is = cid->issuer_serial; | - |
335 | | - |
336 | if (is == NULL || !ts_issuer_serial_cmp(is, cert))TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
337 | return i; never executed: return i; | 0 |
338 | } never executed: end of block | 0 |
339 | } never executed: end of block | 0 |
340 | | - |
341 | return -1; never executed: return -1; | 0 |
342 | } | - |
343 | | - |
344 | static int ts_issuer_serial_cmp(ESS_ISSUER_SERIAL *is, X509 *cert) | - |
345 | { | - |
346 | GENERAL_NAME *issuer; | - |
347 | | - |
348 | if (!is || !cert || sk_GENERAL_NAME_num(is->issuer) != 1)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
349 | return -1; never executed: return -1; | 0 |
350 | | - |
351 | issuer = sk_GENERAL_NAME_value(is->issuer, 0); | - |
352 | if (issuer->type != GEN_DIRNAMETRUE | never evaluated | FALSE | never evaluated |
| 0 |
353 | || X509_NAME_cmp(issuer->d.dirn, X509_get_issuer_name(cert)))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
354 | return -1; never executed: return -1; | 0 |
355 | | - |
356 | if (ASN1_INTEGER_cmp(is->serial, X509_get_serialNumber(cert)))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
357 | return -1; never executed: return -1; | 0 |
358 | | - |
359 | return 0; never executed: return 0; | 0 |
360 | } | - |
361 | | - |
362 | | - |
363 | | - |
364 | | - |
365 | | - |
366 | | - |
367 | | - |
368 | int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response) | - |
369 | { | - |
370 | PKCS7 *token = response->token; | - |
371 | TS_TST_INFO *tst_info = response->tst_info; | - |
372 | int ret = 0; | - |
373 | | - |
374 | if (!ts_check_status_info(response))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
375 | goto err; never executed: goto err; | 0 |
376 | if (!int_ts_RESP_verify_token(ctx, token, tst_info))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
377 | goto err; never executed: goto err; | 0 |
378 | ret = 1; | - |
379 | | - |
380 | err: code before this statement never executed: err: | 0 |
381 | return ret; never executed: return ret; | 0 |
382 | } | - |
383 | | - |
384 | | - |
385 | | - |
386 | | - |
387 | | - |
388 | int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token) | - |
389 | { | - |
390 | TS_TST_INFO *tst_info = PKCS7_to_TS_TST_INFO(token); | - |
391 | int ret = 0; | - |
392 | if (tst_info) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
393 | ret = int_ts_RESP_verify_token(ctx, token, tst_info); | - |
394 | TS_TST_INFO_free(tst_info); | - |
395 | } never executed: end of block | 0 |
396 | return ret; never executed: return ret; | 0 |
397 | } | - |
398 | | - |
399 | | - |
400 | | - |
401 | | - |
402 | | - |
403 | | - |
404 | | - |
405 | | - |
406 | | - |
407 | | - |
408 | | - |
409 | | - |
410 | | - |
411 | static int int_ts_RESP_verify_token(TS_VERIFY_CTX *ctx, | - |
412 | PKCS7 *token, TS_TST_INFO *tst_info) | - |
413 | { | - |
414 | X509 *signer = NULL; | - |
415 | GENERAL_NAME *tsa_name = tst_info->tsa; | - |
416 | X509_ALGOR *md_alg = NULL; | - |
417 | unsigned char *imprint = NULL; | - |
418 | unsigned imprint_len = 0; | - |
419 | int ret = 0; | - |
420 | int flags = ctx->flags; | - |
421 | | - |
422 | | - |
423 | if (((flags & TS_VFY_SIGNER) && tsa_name != NULL)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
424 | || (flags & TS_VFY_TSA_NAME)) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
425 | flags |= TS_VFY_SIGNATURE; | - |
426 | } never executed: end of block | 0 |
427 | | - |
428 | if ((flags & TS_VFY_SIGNATURE)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
429 | && !TS_RESP_verify_signature(token, ctx->certs, ctx->store, &signer))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
430 | goto err; never executed: goto err; | 0 |
431 | if ((flags & TS_VFY_VERSION)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
432 | && TS_TST_INFO_get_version(tst_info) != 1) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
433 | TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_UNSUPPORTED_VERSION); | - |
434 | goto err; never executed: goto err; | 0 |
435 | } | - |
436 | if ((flags & TS_VFY_POLICY)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
437 | && !ts_check_policy(ctx->policy, tst_info))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
438 | goto err; never executed: goto err; | 0 |
439 | if ((flags & TS_VFY_IMPRINT)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
440 | && !ts_check_imprints(ctx->md_alg, ctx->imprint, ctx->imprint_len,TRUE | never evaluated | FALSE | never evaluated |
| 0 |
441 | tst_info))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
442 | goto err; never executed: goto err; | 0 |
443 | if ((flags & TS_VFY_DATA)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
444 | && (!ts_compute_imprint(ctx->data, tst_info,TRUE | never evaluated | FALSE | never evaluated |
| 0 |
445 | &md_alg, &imprint, &imprint_len)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
446 | || !ts_check_imprints(md_alg, imprint, imprint_len, tst_info)))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
447 | goto err; never executed: goto err; | 0 |
448 | if ((flags & TS_VFY_NONCE)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
449 | && !ts_check_nonces(ctx->nonce, tst_info))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
450 | goto err; never executed: goto err; | 0 |
451 | if ((flags & TS_VFY_SIGNER)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
452 | && tsa_name && !ts_check_signer_name(tsa_name, signer)) {TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
453 | TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_NAME_MISMATCH); | - |
454 | goto err; never executed: goto err; | 0 |
455 | } | - |
456 | if ((flags & TS_VFY_TSA_NAME)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
457 | && !ts_check_signer_name(ctx->tsa_name, signer)) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
458 | TSerr(TS_F_INT_TS_RESP_VERIFY_TOKEN, TS_R_TSA_UNTRUSTED); | - |
459 | goto err; never executed: goto err; | 0 |
460 | } | - |
461 | ret = 1; | - |
462 | | - |
463 | err: code before this statement never executed: err: | 0 |
464 | X509_free(signer); | - |
465 | X509_ALGOR_free(md_alg); | - |
466 | OPENSSL_free(imprint); | - |
467 | return ret; never executed: return ret; | 0 |
468 | } | - |
469 | | - |
470 | static int ts_check_status_info(TS_RESP *response) | - |
471 | { | - |
472 | TS_STATUS_INFO *info = response->status_info; | - |
473 | long status = ASN1_INTEGER_get(info->status); | - |
474 | const char *status_text = NULL; | - |
475 | char *embedded_status_text = NULL; | - |
476 | char failure_text[TS_STATUS_BUF_SIZE] = ""; | - |
477 | | - |
478 | if (status == 0 || status == 1)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
479 | return 1; never executed: return 1; | 0 |
480 | | - |
481 | | - |
482 | if (0 <= status && status < (long) OSSL_NELEM(ts_status_text))TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
483 | status_text = ts_status_text[status]; never executed: status_text = ts_status_text[status]; | 0 |
484 | else | - |
485 | status_text = "unknown code"; never executed: status_text = "unknown code"; | 0 |
486 | | - |
487 | if (sk_ASN1_UTF8STRING_num(info->text) > 0TRUE | never evaluated | FALSE | never evaluated |
| 0 |
488 | && (embedded_status_text = ts_get_status_text(info->text)) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
489 | return 0; never executed: return 0; | 0 |
490 | | - |
491 | | - |
492 | if (info->failure_info) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
493 | int i; | - |
494 | int first = 1; | - |
495 | for (i = 0; i < (int)OSSL_NELEM(ts_failure_info); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
496 | if (ASN1_BIT_STRING_get_bit(info->failure_info,TRUE | never evaluated | FALSE | never evaluated |
| 0 |
497 | ts_failure_info[i].code)) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
498 | if (!first)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
499 | strcat(failure_text, ","); never executed: strcat(failure_text, ","); | 0 |
500 | else | - |
501 | first = 0; never executed: first = 0; | 0 |
502 | strcat(failure_text, ts_failure_info[i].text); | - |
503 | } never executed: end of block | 0 |
504 | } never executed: end of block | 0 |
505 | } never executed: end of block | 0 |
506 | if (failure_text[0] == '\0')TRUE | never evaluated | FALSE | never evaluated |
| 0 |
507 | strcpy(failure_text, "unspecified"); never executed: strcpy(failure_text, "unspecified"); | 0 |
508 | | - |
509 | TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN); | - |
510 | ERR_add_error_data(6, | - |
511 | "status code: ", status_text, | - |
512 | ", status text: ", embedded_status_text ? | - |
513 | embedded_status_text : "unspecified", | - |
514 | ", failure codes: ", failure_text); | - |
515 | OPENSSL_free(embedded_status_text); | - |
516 | | - |
517 | return 0; never executed: return 0; | 0 |
518 | } | - |
519 | | - |
520 | static char *ts_get_status_text(STACK_OF(ASN1_UTF8STRING) *text) | - |
521 | { | - |
522 | int i; | - |
523 | int length = 0; | - |
524 | char *result = NULL; | - |
525 | char *p; | - |
526 | | - |
527 | for (i = 0; i < sk_ASN1_UTF8STRING_num(text); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
528 | ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); | - |
529 | if (ASN1_STRING_length(current) > TS_MAX_STATUS_LENGTH - length - 1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
530 | return NULL; never executed: return ((void *)0) ; | 0 |
531 | length += ASN1_STRING_length(current); | - |
532 | length += 1; | - |
533 | } never executed: end of block | 0 |
534 | if ((result = OPENSSL_malloc(length)) == NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
535 | TSerr(TS_F_TS_GET_STATUS_TEXT, ERR_R_MALLOC_FAILURE); | - |
536 | return NULL; never executed: return ((void *)0) ; | 0 |
537 | } | - |
538 | | - |
539 | for (i = 0, p = result; i < sk_ASN1_UTF8STRING_num(text); ++i) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
540 | ASN1_UTF8STRING *current = sk_ASN1_UTF8STRING_value(text, i); | - |
541 | length = ASN1_STRING_length(current); | - |
542 | if (i > 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
543 | *p++ = '/'; never executed: *p++ = '/'; | 0 |
544 | strncpy(p, (const char *)ASN1_STRING_get0_data(current), length); | - |
545 | p += length; | - |
546 | } never executed: end of block | 0 |
547 | *p = '\0'; | - |
548 | | - |
549 | return result; never executed: return result; | 0 |
550 | } | - |
551 | | - |
552 | static int ts_check_policy(const ASN1_OBJECT *req_oid, | - |
553 | const TS_TST_INFO *tst_info) | - |
554 | { | - |
555 | const ASN1_OBJECT *resp_oid = tst_info->policy_id; | - |
556 | | - |
557 | if (OBJ_cmp(req_oid, resp_oid) != 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
558 | TSerr(TS_F_TS_CHECK_POLICY, TS_R_POLICY_MISMATCH); | - |
559 | return 0; never executed: return 0; | 0 |
560 | } | - |
561 | | - |
562 | return 1; never executed: return 1; | 0 |
563 | } | - |
564 | | - |
565 | static int ts_compute_imprint(BIO *data, TS_TST_INFO *tst_info, | - |
566 | X509_ALGOR **md_alg, | - |
567 | unsigned char **imprint, unsigned *imprint_len) | - |
568 | { | - |
569 | TS_MSG_IMPRINT *msg_imprint = tst_info->msg_imprint; | - |
570 | X509_ALGOR *md_alg_resp = msg_imprint->hash_algo; | - |
571 | const EVP_MD *md; | - |
572 | EVP_MD_CTX *md_ctx = NULL; | - |
573 | unsigned char buffer[4096]; | - |
574 | int length; | - |
575 | | - |
576 | *md_alg = NULL; | - |
577 | *imprint = NULL; | - |
578 | | - |
579 | if ((*md_alg = X509_ALGOR_dup(md_alg_resp)) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
580 | goto err; never executed: goto err; | 0 |
581 | if ((md = EVP_get_digestbyobj((*md_alg)->algorithm)) == NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
582 | TSerr(TS_F_TS_COMPUTE_IMPRINT, TS_R_UNSUPPORTED_MD_ALGORITHM); | - |
583 | goto err; never executed: goto err; | 0 |
584 | } | - |
585 | length = EVP_MD_size(md); | - |
586 | if (length < 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
587 | goto err; never executed: goto err; | 0 |
588 | *imprint_len = length; | - |
589 | if ((*imprint = OPENSSL_malloc(*imprint_len)) == NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
590 | TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); | - |
591 | goto err; never executed: goto err; | 0 |
592 | } | - |
593 | | - |
594 | md_ctx = EVP_MD_CTX_new(); | - |
595 | if (md_ctx == NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
596 | TSerr(TS_F_TS_COMPUTE_IMPRINT, ERR_R_MALLOC_FAILURE); | - |
597 | goto err; never executed: goto err; | 0 |
598 | } | - |
599 | if (!EVP_DigestInit(md_ctx, md))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
600 | goto err; never executed: goto err; | 0 |
601 | while ((length = BIO_read(data, buffer, sizeof(buffer))) > 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
602 | if (!EVP_DigestUpdate(md_ctx, buffer, length))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
603 | goto err; never executed: goto err; | 0 |
604 | } never executed: end of block | 0 |
605 | if (!EVP_DigestFinal(md_ctx, *imprint, NULL))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
606 | goto err; never executed: goto err; | 0 |
607 | EVP_MD_CTX_free(md_ctx); | - |
608 | | - |
609 | return 1; never executed: return 1; | 0 |
610 | err: | - |
611 | EVP_MD_CTX_free(md_ctx); | - |
612 | X509_ALGOR_free(*md_alg); | - |
613 | OPENSSL_free(*imprint); | - |
614 | *imprint_len = 0; | - |
615 | *imprint = 0; | - |
616 | return 0; never executed: return 0; | 0 |
617 | } | - |
618 | | - |
619 | static int ts_check_imprints(X509_ALGOR *algor_a, | - |
620 | const unsigned char *imprint_a, unsigned len_a, | - |
621 | TS_TST_INFO *tst_info) | - |
622 | { | - |
623 | TS_MSG_IMPRINT *b = tst_info->msg_imprint; | - |
624 | X509_ALGOR *algor_b = b->hash_algo; | - |
625 | int ret = 0; | - |
626 | | - |
627 | if (algor_a) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
628 | if (OBJ_cmp(algor_a->algorithm, algor_b->algorithm))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
629 | goto err; never executed: goto err; | 0 |
630 | | - |
631 | | - |
632 | if ((algor_a->parameterTRUE | never evaluated | FALSE | never evaluated |
| 0 |
633 | && ASN1_TYPE_get(algor_a->parameter) != V_ASN1_NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
634 | || (algor_b->parameterTRUE | never evaluated | FALSE | never evaluated |
| 0 |
635 | && ASN1_TYPE_get(algor_b->parameter) != V_ASN1_NULL))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
636 | goto err; never executed: goto err; | 0 |
637 | } never executed: end of block | 0 |
638 | | - |
639 | ret = len_a == (unsigned)ASN1_STRING_length(b->hashed_msg) &&TRUE | never evaluated | FALSE | never evaluated |
| 0 |
640 | memcmp(imprint_a, ASN1_STRING_get0_data(b->hashed_msg), len_a) == 0;TRUE | never evaluated | FALSE | never evaluated |
| 0 |
641 | err: code before this statement never executed: err: | 0 |
642 | if (!ret)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
643 | TSerr(TS_F_TS_CHECK_IMPRINTS, TS_R_MESSAGE_IMPRINT_MISMATCH); never executed: ERR_put_error(47,(100),(103),__FILE__,643); | 0 |
644 | return ret; never executed: return ret; | 0 |
645 | } | - |
646 | | - |
647 | static int ts_check_nonces(const ASN1_INTEGER *a, TS_TST_INFO *tst_info) | - |
648 | { | - |
649 | const ASN1_INTEGER *b = tst_info->nonce; | - |
650 | | - |
651 | if (!b) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
652 | TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_NOT_RETURNED); | - |
653 | return 0; never executed: return 0; | 0 |
654 | } | - |
655 | | - |
656 | | - |
657 | if (ASN1_INTEGER_cmp(a, b) != 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
658 | TSerr(TS_F_TS_CHECK_NONCES, TS_R_NONCE_MISMATCH); | - |
659 | return 0; never executed: return 0; | 0 |
660 | } | - |
661 | | - |
662 | return 1; never executed: return 1; | 0 |
663 | } | - |
664 | | - |
665 | | - |
666 | | - |
667 | | - |
668 | | - |
669 | static int ts_check_signer_name(GENERAL_NAME *tsa_name, X509 *signer) | - |
670 | { | - |
671 | STACK_OF(GENERAL_NAME) *gen_names = NULL; | - |
672 | int idx = -1; | - |
673 | int found = 0; | - |
674 | | - |
675 | if (tsa_name->type == GEN_DIRNAMETRUE | never evaluated | FALSE | never evaluated |
| 0 |
676 | && X509_name_cmp(tsa_name->d.dirn, X509_get_subject_name(signer)) == 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
677 | return 1; never executed: return 1; | 0 |
678 | gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx); | - |
679 | while (gen_names != NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
680 | found = ts_find_name(gen_names, tsa_name) >= 0; | - |
681 | if (found)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
682 | break; never executed: break; | 0 |
683 | | - |
684 | | - |
685 | | - |
686 | | - |
687 | GENERAL_NAMES_free(gen_names); | - |
688 | gen_names = X509_get_ext_d2i(signer, NID_subject_alt_name, NULL, &idx); | - |
689 | } never executed: end of block | 0 |
690 | GENERAL_NAMES_free(gen_names); | - |
691 | | - |
692 | return found; never executed: return found; | 0 |
693 | } | - |
694 | | - |
695 | | - |
696 | static int ts_find_name(STACK_OF(GENERAL_NAME) *gen_names, GENERAL_NAME *name) | - |
697 | { | - |
698 | int i, found; | - |
699 | for (i = 0, found = 0; !found && i < sk_GENERAL_NAME_num(gen_names); ++i) {TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
700 | GENERAL_NAME *current = sk_GENERAL_NAME_value(gen_names, i); | - |
701 | found = GENERAL_NAME_cmp(current, name) == 0; | - |
702 | } never executed: end of block | 0 |
703 | return found ? i - 1 : -1; never executed: return found ? i - 1 : -1; TRUE | never evaluated | FALSE | never evaluated |
| 0 |
704 | } | - |
| | |