Line | Source | Count |
1 | | - |
2 | | - |
3 | | - |
4 | | - |
5 | | - |
6 | | - |
7 | | - |
8 | | - |
9 | | - |
10 | #include <string.h> | - |
11 | | - |
12 | #include <openssl/ct.h> | - |
13 | #include <openssl/err.h> | - |
14 | #include <openssl/evp.h> | - |
15 | #include <openssl/x509.h> | - |
16 | | - |
17 | #include "ct_locl.h" | - |
18 | | - |
19 | typedef enum sct_signature_type_t { | - |
20 | SIGNATURE_TYPE_NOT_SET = -1, | - |
21 | SIGNATURE_TYPE_CERT_TIMESTAMP, | - |
22 | SIGNATURE_TYPE_TREE_HASH | - |
23 | } SCT_SIGNATURE_TYPE; | - |
24 | | - |
25 | | - |
26 | | - |
27 | | - |
28 | | - |
29 | static int sct_ctx_update(EVP_MD_CTX *ctx, const SCT_CTX *sctx, const SCT *sct) | - |
30 | { | - |
31 | unsigned char tmpbuf[12]; | - |
32 | unsigned char *p, *der; | - |
33 | size_t derlen; | - |
34 | | - |
35 | | - |
36 | | - |
37 | | - |
38 | | - |
39 | | - |
40 | | - |
41 | | - |
42 | | - |
43 | | - |
44 | | - |
45 | | - |
46 | | - |
47 | if (sct->entry_type == CT_LOG_ENTRY_TYPE_NOT_SET)TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
48 | return 0; never executed: return 0; | 0 |
49 | if (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT && sctx->ihash == NULL)TRUE | evaluated 8 times by 1 test | FALSE | never evaluated |
TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
50 | return 0; never executed: return 0; | 0 |
51 | | - |
52 | p = tmpbuf; | - |
53 | *p++ = sct->version; | - |
54 | *p++ = SIGNATURE_TYPE_CERT_TIMESTAMP; | - |
55 | l2n8(sct->timestamp, p); | - |
56 | s2n(sct->entry_type, p); | - |
57 | | - |
58 | if (!EVP_DigestUpdate(ctx, tmpbuf, p - tmpbuf))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
59 | return 0; never executed: return 0; | 0 |
60 | | - |
61 | if (sct->entry_type == CT_LOG_ENTRY_TYPE_X509) {TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
62 | der = sctx->certder; | - |
63 | derlen = sctx->certderlen; | - |
64 | } else { never executed: end of block | 0 |
65 | if (!EVP_DigestUpdate(ctx, sctx->ihash, sctx->ihashlen))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
66 | return 0; never executed: return 0; | 0 |
67 | der = sctx->preder; | - |
68 | derlen = sctx->prederlen; | - |
69 | }executed 8 times by 1 test: end of block | 8 |
70 | | - |
71 | | - |
72 | if (der == NULL)TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
73 | return 0; never executed: return 0; | 0 |
74 | | - |
75 | | - |
76 | p = tmpbuf; | - |
77 | l2n3(derlen, p); | - |
78 | | - |
79 | if (!EVP_DigestUpdate(ctx, tmpbuf, 3))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
80 | return 0; never executed: return 0; | 0 |
81 | if (!EVP_DigestUpdate(ctx, der, derlen))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
82 | return 0; never executed: return 0; | 0 |
83 | | - |
84 | | - |
85 | p = tmpbuf; | - |
86 | s2n(sct->ext_len, p); | - |
87 | if (!EVP_DigestUpdate(ctx, tmpbuf, 2))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
88 | return 0; never executed: return 0; | 0 |
89 | | - |
90 | if (sct->ext_len && !EVP_DigestUpdate(ctx, sct->ext, sct->ext_len))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
TRUE | never evaluated | FALSE | never evaluated |
| 0-8 |
91 | return 0; never executed: return 0; | 0 |
92 | | - |
93 | return 1;executed 8 times by 1 test: return 1; | 8 |
94 | } | - |
95 | | - |
96 | int SCT_CTX_verify(const SCT_CTX *sctx, const SCT *sct) | - |
97 | { | - |
98 | EVP_MD_CTX *ctx = NULL; | - |
99 | int ret = 0; | - |
100 | | - |
101 | if (!SCT_is_complete(sct) || sctx->pkey == NULL ||TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
102 | sct->entry_type == CT_LOG_ENTRY_TYPE_NOT_SET ||TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
103 | (sct->entry_type == CT_LOG_ENTRY_TYPE_PRECERT && sctx->ihash == NULL)) {TRUE | evaluated 9 times by 1 test | FALSE | never evaluated |
TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
104 | CTerr(CT_F_SCT_CTX_VERIFY, CT_R_SCT_NOT_SET); | - |
105 | return 0; never executed: return 0; | 0 |
106 | } | - |
107 | if (sct->version != SCT_VERSION_V1) {TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
108 | CTerr(CT_F_SCT_CTX_VERIFY, CT_R_SCT_UNSUPPORTED_VERSION); | - |
109 | return 0; never executed: return 0; | 0 |
110 | } | - |
111 | if (sct->log_id_len != sctx->pkeyhashlen ||TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
112 | memcmp(sct->log_id, sctx->pkeyhash, sctx->pkeyhashlen) != 0) {TRUE | never evaluated | FALSE | evaluated 9 times by 1 test |
| 0-9 |
113 | CTerr(CT_F_SCT_CTX_VERIFY, CT_R_SCT_LOG_ID_MISMATCH); | - |
114 | return 0; never executed: return 0; | 0 |
115 | } | - |
116 | if (sct->timestamp > sctx->epoch_time_in_ms) {TRUE | evaluated 1 time by 1 test | FALSE | evaluated 8 times by 1 test |
| 1-8 |
117 | CTerr(CT_F_SCT_CTX_VERIFY, CT_R_SCT_FUTURE_TIMESTAMP); | - |
118 | return 0;executed 1 time by 1 test: return 0; | 1 |
119 | } | - |
120 | | - |
121 | ctx = EVP_MD_CTX_new(); | - |
122 | if (ctx == NULL)TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
123 | goto end; never executed: goto end; | 0 |
124 | | - |
125 | if (!EVP_DigestVerifyInit(ctx, NULL, EVP_sha256(), NULL, sctx->pkey))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
126 | goto end; never executed: goto end; | 0 |
127 | | - |
128 | if (!sct_ctx_update(ctx, sctx, sct))TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
129 | goto end; never executed: goto end; | 0 |
130 | | - |
131 | | - |
132 | ret = EVP_DigestVerifyFinal(ctx, sct->sig, sct->sig_len); | - |
133 | | - |
134 | if (ret == 0)TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
135 | CTerr(CT_F_SCT_CTX_VERIFY, CT_R_SCT_INVALID_SIGNATURE); never executed: ERR_put_error(50,(128),(107),__FILE__,135); | 0 |
136 | | - |
137 | end:code before this statement executed 8 times by 1 test: end: | 8 |
138 | EVP_MD_CTX_free(ctx); | - |
139 | return ret;executed 8 times by 1 test: return ret; | 8 |
140 | } | - |
| | |