/* crypto/x509/x509_vfy.c */

/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

 * All rights reserved.

 *

 * This package is an SSL implementation written

 * by Eric Young (eay@cryptsoft.com).

 * The implementation was written so as to conform with Netscapes SSL.

 * 

 * This library is free for commercial and non-commercial use as long as

 * the following conditions are aheared to.  The following conditions

 * apply to all code found in this distribution, be it the RC4, RSA,

 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

 * included with this distribution is covered by the same copyright terms

 * except that the holder is Tim Hudson (tjh@cryptsoft.com).

 * 

 * Copyright remains Eric Young's, and as such any Copyright notices in

 * the code are not to be removed.

 * If this package is used in a product, Eric Young should be given attribution

 * as the author of the parts of the library used.

 * This can be in the form of a textual message at program startup or

 * in documentation (online or textual) provided with the package.

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 * 3. All advertising materials mentioning features or use of this software

 *    must display the following acknowledgement:

 *    "This product includes cryptographic software written by

 *     Eric Young (eay@cryptsoft.com)"

 *    The word 'cryptographic' can be left out if the rouines from the library

 *    being used are not cryptographic related :-).

 * 4. If you include any Windows specific code (or a derivative thereof) from 

 *    the apps directory (application code) you must include an acknowledgement:

 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

 * 

 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGE.

 * 

 * The licence and distribution terms for any publically available version or

 * derivative of this code cannot be changed.  i.e. this code cannot simply be

 * copied and put under another distribution licence

 * [including the GNU Public Licence.]

 */

#include <stdio.h>

#include <time.h>

#include <errno.h>

#include "cryptlib.h"

#include <openssl/crypto.h>

#include <openssl/lhash.h>

#include <openssl/buffer.h>

#include <openssl/evp.h>

#include <openssl/asn1.h>

#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <openssl/objects.h>

static int null_callback(int ok,X509_STORE_CTX *e);

static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);

static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);

static int check_chain_extensions(X509_STORE_CTX *ctx);

static int check_trust(X509_STORE_CTX *ctx);

static int check_revocation(X509_STORE_CTX *ctx);

static int check_cert(X509_STORE_CTX *ctx);

static int check_policy(X509_STORE_CTX *ctx);

static int internal_verify(X509_STORE_CTX *ctx);

const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;

static int null_callback(int ok, X509_STORE_CTX *e)

	{

	return ok;

	}

#if 0

static int x509_subject_cmp(X509 **a, X509 **b)

	{

	return X509_subject_name_cmp(*a,*b);

	}

#endif

EXPORT_C int X509_verify_cert(X509_STORE_CTX *ctx)

	{

	X509 *x,*xtmp,*chain_ss=NULL;

	X509_NAME *xn;

	int bad_chain = 0;

	X509_VERIFY_PARAM *param = ctx->param;

	int depth,i,ok=0;

	int num;

	int (*cb)(int xok,X509_STORE_CTX *xctx);

	STACK_OF(X509) *sktmp=NULL;

	if (ctx->cert == NULL)

		{

		X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);

		return -1;

		}

	cb=ctx->verify_cb;

	/* first we make sure the chain we are going to build is

	 * present and that the first entry is in place */

	if (ctx->chain == NULL)

		{

		if (	((ctx->chain=sk_X509_new_null()) == NULL) ||

			(!sk_X509_push(ctx->chain,ctx->cert)))

			{

			X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

			goto end;

			}

		CRYPTO_add(&ctx->cert->references,1,CRYPTO_LOCK_X509);

		ctx->last_untrusted=1;

		}

	/* We use a temporary STACK so we can chop and hack at it */

	if (ctx->untrusted != NULL

	    && (sktmp=sk_X509_dup(ctx->untrusted)) == NULL)

		{

		X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

		goto end;

		}

	num=sk_X509_num(ctx->chain);

	x=sk_X509_value(ctx->chain,num-1);

	depth=param->depth;

	for (;;)

		{

		/* If we have enough, we break */

		if (depth < num) break; /* FIXME: If this happens, we should take

		                         * note of it and, if appropriate, use the

		                         * X509_V_ERR_CERT_CHAIN_TOO_LONG error

		                         * code later.

		                         */

		/* If we are self signed, we break */

		xn=X509_get_issuer_name(x);

		if (ctx->check_issued(ctx, x,x)) break;

		/* If we were passed a cert chain, use it first */

		if (ctx->untrusted != NULL)

			{

			xtmp=find_issuer(ctx, sktmp,x);

			if (xtmp != NULL)

				{

				if (!sk_X509_push(ctx->chain,xtmp))

					{

					X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

					goto end;

					}

				CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);

				(void)sk_X509_delete_ptr(sktmp,xtmp);

				ctx->last_untrusted++;

				x=xtmp;

				num++;

				/* reparse the full chain for

				 * the next one */

				continue;

				}

			}

		break;

		}

	/* at this point, chain should contain a list of untrusted

	 * certificates.  We now need to add at least one trusted one,

	 * if possible, otherwise we complain. */

	/* Examine last certificate in chain and see if it

 	 * is self signed.

 	 */

	i=sk_X509_num(ctx->chain);

	x=sk_X509_value(ctx->chain,i-1);

	xn = X509_get_subject_name(x);

	if (ctx->check_issued(ctx, x, x))

		{

		/* we have a self signed certificate */

		if (sk_X509_num(ctx->chain) == 1)

			{

			/* We have a single self signed certificate: see if

			 * we can find it in the store. We must have an exact

			 * match to avoid possible impersonation.

			 */

			ok = ctx->get_issuer(&xtmp, ctx, x);

			if ((ok <= 0) || X509_cmp(x, xtmp)) 

				{

				ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;

				ctx->current_cert=x;

				ctx->error_depth=i-1;

				if (ok == 1) X509_free(xtmp);

				bad_chain = 1;

				ok=cb(0,ctx);

				if (!ok) goto end;

				}

			else 

				{

				/* We have a match: replace certificate with store version

				 * so we get any trust settings.

				 */

				X509_free(x);

				x = xtmp;

				(void)sk_X509_set(ctx->chain, i - 1, x);

				ctx->last_untrusted=0;

				}

			}

		else

			{

			/* extract and save self signed certificate for later use */

			chain_ss=sk_X509_pop(ctx->chain);

			ctx->last_untrusted--;

			num--;

			x=sk_X509_value(ctx->chain,num-1);

			}

		}

	/* We now lookup certs from the certificate store */

	for (;;)

		{

		/* If we have enough, we break */

		if (depth < num) break;

		/* If we are self signed, we break */

		xn=X509_get_issuer_name(x);

		if (ctx->check_issued(ctx,x,x)) break;

		ok = ctx->get_issuer(&xtmp, ctx, x);

		if (ok < 0) return ok;

		if (ok == 0) break;

		x = xtmp;

		if (!sk_X509_push(ctx->chain,x))

			{

			X509_free(xtmp);

			X509err(X509_F_X509_VERIFY_CERT,ERR_R_MALLOC_FAILURE);

			return 0;

			}

		num++;

		}

	/* we now have our chain, lets check it... */

	xn=X509_get_issuer_name(x);

	/* Is last certificate looked up self signed? */

	if (!ctx->check_issued(ctx,x,x))

		{

		if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss))

			{

			if (ctx->last_untrusted >= num)

				ctx->error=X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;

			else

				ctx->error=X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;

			ctx->current_cert=x;

			}

		else

			{

			sk_X509_push(ctx->chain,chain_ss);

			num++;

			ctx->last_untrusted=num;

			ctx->current_cert=chain_ss;

			ctx->error=X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;

			chain_ss=NULL;

			}

		ctx->error_depth=num-1;

		bad_chain = 1;

		ok=cb(0,ctx);

		if (!ok) goto end;

		}

	/* We have the chain complete: now we need to check its purpose */

	ok = check_chain_extensions(ctx);

	if (!ok) goto end;

	/* The chain extensions are OK: check trust */

	if (param->trust > 0) ok = check_trust(ctx);

	if (!ok) goto end;

	/* We may as well copy down any DSA parameters that are required */

	X509_get_pubkey_parameters(NULL,ctx->chain);

	/* Check revocation status: we do this after copying parameters

	 * because they may be needed for CRL signature verification.

	 */

	ok = ctx->check_revocation(ctx);

	if(!ok) goto end;

	/* At this point, we have a chain and need to verify it */

	if (ctx->verify != NULL)

		ok=ctx->verify(ctx);

	else

		ok=internal_verify(ctx);

	if(!ok) goto end;

	/* If we get this far evaluate policies */

	if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK))

		ok = ctx->check_policy(ctx);

	if(!ok) goto end;

	if (0)

		{

end:

		X509_get_pubkey_parameters(NULL,ctx->chain);

		}

	if (sktmp != NULL) sk_X509_free(sktmp);

	if (chain_ss != NULL) X509_free(chain_ss);

	return ok;

	}

/* Given a STACK_OF(X509) find the issuer of cert (if any)

 */

static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x)

{

	int i;

	X509 *issuer;

	for (i = 0; i < sk_X509_num(sk); i++)

		{

		issuer = sk_X509_value(sk, i);

		if (ctx->check_issued(ctx, x, issuer))

			return issuer;

		}

	return NULL;

}

/* Given a possible certificate and issuer check them */

static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)

{

	int ret;

	ret = X509_check_issued(issuer, x);

	if (ret == X509_V_OK)

		return 1;

	/* If we haven't asked for issuer errors don't set ctx */

	if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK))

		return 0;

	ctx->error = ret;

	ctx->current_cert = x;

	ctx->current_issuer = issuer;

	return ctx->verify_cb(0, ctx);

	return 0;

}

/* Alternative lookup method: look from a STACK stored in other_ctx */

static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)

{

	*issuer = find_issuer(ctx, ctx->other_ctx, x);

	if (*issuer)

		{

		CRYPTO_add(&(*issuer)->references,1,CRYPTO_LOCK_X509);

		return 1;

		}

	else

		return 0;

}

/* Check a certificate chains extensions for consistency

 * with the supplied purpose

 */

static int check_chain_extensions(X509_STORE_CTX *ctx)

{

#ifdef OPENSSL_NO_CHAIN_VERIFY

	return 1;

#else

	int i, ok=0, must_be_ca;

	X509 *x;

	int (*cb)(int xok,X509_STORE_CTX *xctx);

	int proxy_path_length = 0;

	int allow_proxy_certs =

		!!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);

	cb=ctx->verify_cb;

	/* must_be_ca can have 1 of 3 values:

	   -1: we accept both CA and non-CA certificates, to allow direct

	       use of self-signed certificates (which are marked as CA).

	   0:  we only accept non-CA certificates.  This is currently not

	       used, but the possibility is present for future extensions.

	   1:  we only accept CA certificates.  This is currently used for

	       all certificates in the chain except the leaf certificate.

	*/

	must_be_ca = -1;

	/* A hack to keep people who don't want to modify their software

	   happy */

	if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))

		allow_proxy_certs = 1;

	/* Check all untrusted certificates */

	for (i = 0; i < ctx->last_untrusted; i++)

		{

		int ret;

		x = sk_X509_value(ctx->chain, i);

		if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)

			&& (x->ex_flags & EXFLAG_CRITICAL))

			{

			ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;

			ctx->error_depth = i;

			ctx->current_cert = x;

			ok=cb(0,ctx);

			if (!ok) goto end;

			}

		if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY))

			{

			ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;

			ctx->error_depth = i;

			ctx->current_cert = x;

			ok=cb(0,ctx);

			if (!ok) goto end;

			}

		ret = X509_check_ca(x);

		switch(must_be_ca)

			{

		case -1:

			if ((ctx->param->flags & X509_V_FLAG_X509_STRICT)

				&& (ret != 1) && (ret != 0))

				{

				ret = 0;

				ctx->error = X509_V_ERR_INVALID_CA;

				}

			else

				ret = 1;

			break;

		case 0:

			if (ret != 0)

				{

				ret = 0;

				ctx->error = X509_V_ERR_INVALID_NON_CA;

				}

			else

				ret = 1;

			break;

		default:

			if ((ret == 0)

				|| ((ctx->param->flags & X509_V_FLAG_X509_STRICT)

					&& (ret != 1)))

				{

				ret = 0;

				ctx->error = X509_V_ERR_INVALID_CA;

				}

			else

				ret = 1;

			break;

			}

		if (ret == 0)

			{

			ctx->error_depth = i;

			ctx->current_cert = x;

			ok=cb(0,ctx);

			if (!ok) goto end;

			}

		if (ctx->param->purpose > 0)

			{

			ret = X509_check_purpose(x, ctx->param->purpose,

				must_be_ca > 0);

			if ((ret == 0)

				|| ((ctx->param->flags & X509_V_FLAG_X509_STRICT)

					&& (ret != 1)))

				{

				ctx->error = X509_V_ERR_INVALID_PURPOSE;

				ctx->error_depth = i;

				ctx->current_cert = x;

				ok=cb(0,ctx);

				if (!ok) goto end;

				}

			}

		/* Check pathlen */

		if ((i > 1) && (x->ex_pathlen != -1)

			   && (i > (x->ex_pathlen + proxy_path_length + 1)))

			{

			ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;

			ctx->error_depth = i;

			ctx->current_cert = x;

			ok=cb(0,ctx);

			if (!ok) goto end;

			}

		/* If this certificate is a proxy certificate, the next

		   certificate must be another proxy certificate or a EE

		   certificate.  If not, the next certificate must be a

		   CA certificate.  */

		if (x->ex_flags & EXFLAG_PROXY)

			{

			if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen)

				{

				ctx->error =

					X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;

				ctx->error_depth = i;

				ctx->current_cert = x;

				ok=cb(0,ctx);

				if (!ok) goto end;

				}

			proxy_path_length++;

			must_be_ca = 0;

			}

		else

			must_be_ca = 1;

		}

	ok = 1;

 end:

	return ok;

#endif

}

static int check_trust(X509_STORE_CTX *ctx)

{