GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: lib/libcrypto/ts/ts_conf.c Lines: 112 187 59.9 %
Date: 2017-11-13 Branches: 59 140 42.1 %

Line Branch Exec Source
1
/* $OpenBSD: ts_conf.c,v 1.10 2017/01/29 17:49:23 beck Exp $ */
2
/* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
3
 * project 2002.
4
 */
5
/* ====================================================================
6
 * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 *
15
 * 2. Redistributions in binary form must reproduce the above copyright
16
 *    notice, this list of conditions and the following disclaimer in
17
 *    the documentation and/or other materials provided with the
18
 *    distribution.
19
 *
20
 * 3. All advertising materials mentioning features or use of this
21
 *    software must display the following acknowledgment:
22
 *    "This product includes software developed by the OpenSSL Project
23
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24
 *
25
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26
 *    endorse or promote products derived from this software without
27
 *    prior written permission. For written permission, please contact
28
 *    licensing@OpenSSL.org.
29
 *
30
 * 5. Products derived from this software may not be called "OpenSSL"
31
 *    nor may "OpenSSL" appear in their names without prior written
32
 *    permission of the OpenSSL Project.
33
 *
34
 * 6. Redistributions of any form whatsoever must retain the following
35
 *    acknowledgment:
36
 *    "This product includes software developed by the OpenSSL Project
37
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38
 *
39
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50
 * OF THE POSSIBILITY OF SUCH DAMAGE.
51
 * ====================================================================
52
 *
53
 * This product includes cryptographic software written by Eric Young
54
 * (eay@cryptsoft.com).  This product includes software written by Tim
55
 * Hudson (tjh@cryptsoft.com).
56
 *
57
 */
58
59
#include <string.h>
60
61
#include <openssl/opensslconf.h>
62
63
#include <openssl/crypto.h>
64
#include <openssl/err.h>
65
#include <openssl/pem.h>
66
#include <openssl/ts.h>
67
68
#ifndef OPENSSL_NO_ENGINE
69
#include <openssl/engine.h>
70
#endif
71
72
/* Macro definitions for the configuration file. */
73
74
#define	BASE_SECTION			"tsa"
75
#define	ENV_DEFAULT_TSA			"default_tsa"
76
#define	ENV_SERIAL			"serial"
77
#define ENV_CRYPTO_DEVICE		"crypto_device"
78
#define	ENV_SIGNER_CERT			"signer_cert"
79
#define	ENV_CERTS			"certs"
80
#define	ENV_SIGNER_KEY			"signer_key"
81
#define	ENV_DEFAULT_POLICY		"default_policy"
82
#define	ENV_OTHER_POLICIES		"other_policies"
83
#define	ENV_DIGESTS			"digests"
84
#define	ENV_ACCURACY			"accuracy"
85
#define	ENV_ORDERING			"ordering"
86
#define	ENV_TSA_NAME			"tsa_name"
87
#define	ENV_ESS_CERT_ID_CHAIN		"ess_cert_id_chain"
88
#define	ENV_VALUE_SECS			"secs"
89
#define	ENV_VALUE_MILLISECS		"millisecs"
90
#define	ENV_VALUE_MICROSECS		"microsecs"
91
#define	ENV_CLOCK_PRECISION_DIGITS	"clock_precision_digits"
92
#define	ENV_VALUE_YES			"yes"
93
#define	ENV_VALUE_NO			"no"
94
95
/* Function definitions for certificate and key loading. */
96
97
X509 *
98
TS_CONF_load_cert(const char *file)
99
{
100
	BIO *cert = NULL;
101
	X509 *x = NULL;
102
103
4
	if ((cert = BIO_new_file(file, "r")) == NULL)
104
		goto end;
105
2
	x = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL);
106
107
end:
108
2
	if (x == NULL)
109
		fprintf(stderr, "unable to load certificate: %s\n", file);
110
2
	BIO_free(cert);
111
2
	return x;
112
}
113
114
STACK_OF(X509) *
115
TS_CONF_load_certs(const char *file)
116
{
117
	BIO *certs = NULL;
118
	STACK_OF(X509) *othercerts = NULL;
119
	STACK_OF(X509_INFO) *allcerts = NULL;
120
	int i;
121
122
8
	if (!(certs = BIO_new_file(file, "r")))
123
		goto end;
124
125
4
	if (!(othercerts = sk_X509_new_null()))
126
		goto end;
127
4
	allcerts = PEM_X509_INFO_read_bio(certs, NULL, NULL, NULL);
128
16
	for (i = 0; i < sk_X509_INFO_num(allcerts); i++) {
129
4
		X509_INFO *xi = sk_X509_INFO_value(allcerts, i);
130
4
		if (xi->x509) {
131
4
			if (sk_X509_push(othercerts, xi->x509) == 0) {
132
				sk_X509_pop_free(othercerts, X509_free);
133
				othercerts = NULL;
134
				goto end;
135
			}
136
4
			xi->x509 = NULL;
137
4
		}
138
4
	}
139
140
end:
141
4
	if (othercerts == NULL)
142
		fprintf(stderr, "unable to load certificates: %s\n", file);
143
4
	sk_X509_INFO_pop_free(allcerts, X509_INFO_free);
144
4
	BIO_free(certs);
145
4
	return othercerts;
146
4
}
147
148
EVP_PKEY *
149
TS_CONF_load_key(const char *file, const char *pass)
150
{
151
	BIO *key = NULL;
152
	EVP_PKEY *pkey = NULL;
153
154
4
	if (!(key = BIO_new_file(file, "r")))
155
		goto end;
156
2
	pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, (char *) pass);
157
158
end:
159
2
	if (pkey == NULL)
160
		fprintf(stderr, "unable to load private key: %s\n", file);
161
2
	BIO_free(key);
162
2
	return pkey;
163
}
164
165
/* Function definitions for handling configuration options. */
166
167
static void
168
TS_CONF_lookup_fail(const char *name, const char *tag)
169
{
170
	fprintf(stderr, "variable lookup failed for %s::%s\n", name, tag);
171
}
172
173
static void
174
TS_CONF_invalid(const char *name, const char *tag)
175
{
176
	fprintf(stderr, "invalid variable value for %s::%s\n", name, tag);
177
}
178
179
const char *
180
TS_CONF_get_tsa_section(CONF *conf, const char *section)
181
{
182
4
	if (!section) {
183
2
		section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_TSA);
184
2
		if (!section)
185
			TS_CONF_lookup_fail(BASE_SECTION, ENV_DEFAULT_TSA);
186
	}
187
2
	return section;
188
}
189
190
int
191
TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb,
192
    TS_RESP_CTX *ctx)
193
{
194
	int ret = 0;
195
4
	char *serial = NCONF_get_string(conf, section, ENV_SERIAL);
196
197
2
	if (!serial) {
198
		TS_CONF_lookup_fail(section, ENV_SERIAL);
199
		goto err;
200
	}
201
2
	TS_RESP_CTX_set_serial_cb(ctx, cb, serial);
202
203
2
	ret = 1;
204
205
err:
206
2
	return ret;
207
}
208
209
#ifndef OPENSSL_NO_ENGINE
210
211
int
212
TS_CONF_set_crypto_device(CONF *conf, const char *section, const char *device)
213
{
214
	int ret = 0;
215
216
	if (!device)
217
		device = NCONF_get_string(conf, section, ENV_CRYPTO_DEVICE);
218
219
	if (device && !TS_CONF_set_default_engine(device)) {
220
		TS_CONF_invalid(section, ENV_CRYPTO_DEVICE);
221
		goto err;
222
	}
223
	ret = 1;
224
225
err:
226
	return ret;
227
}
228
229
int
230
TS_CONF_set_default_engine(const char *name)
231
{
232
	ENGINE *e = NULL;
233
	int ret = 0;
234
235
	/* Leave the default if builtin specified. */
236
	if (strcmp(name, "builtin") == 0)
237
		return 1;
238
239
	if (!(e = ENGINE_by_id(name)))
240
		goto err;
241
	/* All the operations are going to be carried out by the engine. */
242
	if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
243
		goto err;
244
	ret = 1;
245
246
err:
247
	if (!ret) {
248
		TSerror(TS_R_COULD_NOT_SET_ENGINE);
249
		ERR_asprintf_error_data("engine:%s", name);
250
	}
251
	if (e)
252
		ENGINE_free(e);
253
	return ret;
254
}
255
256
#endif
257
258
int
259
TS_CONF_set_signer_cert(CONF *conf, const char *section, const char *cert,
260
    TS_RESP_CTX *ctx)
261
{
262
	int ret = 0;
263
	X509 *cert_obj = NULL;
264
265
4
	if (!cert)
266
		cert = NCONF_get_string(conf, section, ENV_SIGNER_CERT);
267
2
	if (!cert) {
268
		TS_CONF_lookup_fail(section, ENV_SIGNER_CERT);
269
		goto err;
270
	}
271
2
	if (!(cert_obj = TS_CONF_load_cert(cert)))
272
		goto err;
273
2
	if (!TS_RESP_CTX_set_signer_cert(ctx, cert_obj))
274
		goto err;
275
276
2
	ret = 1;
277
278
err:
279
2
	X509_free(cert_obj);
280
2
	return ret;
281
}
282
283
int
284
TS_CONF_set_certs(CONF *conf, const char *section, const char *certs,
285
    TS_RESP_CTX *ctx)
286
{
287
	int ret = 0;
288
	STACK_OF(X509) *certs_obj = NULL;
289
290
4
	if (!certs)
291
		certs = NCONF_get_string(conf, section, ENV_CERTS);
292
	/* Certificate chain is optional. */
293
2
	if (!certs)
294
		goto end;
295
2
	if (!(certs_obj = TS_CONF_load_certs(certs)))
296
		goto err;
297
2
	if (!TS_RESP_CTX_set_certs(ctx, certs_obj))
298
		goto err;
299
300
end:
301
2
	ret = 1;
302
err:
303
2
	sk_X509_pop_free(certs_obj, X509_free);
304
2
	return ret;
305
}
306
307
int
308
TS_CONF_set_signer_key(CONF *conf, const char *section, const char *key,
309
    const char *pass, TS_RESP_CTX *ctx)
310
{
311
	int ret = 0;
312
	EVP_PKEY *key_obj = NULL;
313
314
4
	if (!key)
315
		key = NCONF_get_string(conf, section, ENV_SIGNER_KEY);
316
2
	if (!key) {
317
		TS_CONF_lookup_fail(section, ENV_SIGNER_KEY);
318
		goto err;
319
	}
320
2
	if (!(key_obj = TS_CONF_load_key(key, pass)))
321
		goto err;
322
2
	if (!TS_RESP_CTX_set_signer_key(ctx, key_obj))
323
		goto err;
324
325
2
	ret = 1;
326
327
err:
328
2
	EVP_PKEY_free(key_obj);
329
2
	return ret;
330
}
331
332
int
333
TS_CONF_set_def_policy(CONF *conf, const char *section, const char *policy,
334
    TS_RESP_CTX *ctx)
335
{
336
	int ret = 0;
337
	ASN1_OBJECT *policy_obj = NULL;
338
339
4
    	if (!policy)
340
2
		policy = NCONF_get_string(conf, section, ENV_DEFAULT_POLICY);
341
2
	if (!policy) {
342
		TS_CONF_lookup_fail(section, ENV_DEFAULT_POLICY);
343
		goto err;
344
	}
345
2
	if (!(policy_obj = OBJ_txt2obj(policy, 0))) {
346
		TS_CONF_invalid(section, ENV_DEFAULT_POLICY);
347
		goto err;
348
	}
349
2
	if (!TS_RESP_CTX_set_def_policy(ctx, policy_obj))
350
		goto err;
351
352
2
	ret = 1;
353
354
err:
355
2
	ASN1_OBJECT_free(policy_obj);
356
2
	return ret;
357
}
358
359
int
360
TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx)
361
{
362
	int ret = 0;
363
	int i;
364
	STACK_OF(CONF_VALUE) *list = NULL;
365
4
	char *policies = NCONF_get_string(conf, section, ENV_OTHER_POLICIES);
366
367
	/* If no other policy is specified, that's fine. */
368

4
	if (policies && !(list = X509V3_parse_list(policies))) {
369
		TS_CONF_invalid(section, ENV_OTHER_POLICIES);
370
		goto err;
371
	}
372
12
	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
373
4
		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
374
4
		const char *extval = val->value ? val->value : val->name;
375
		ASN1_OBJECT *objtmp;
376
4
		if (!(objtmp = OBJ_txt2obj(extval, 0))) {
377
			TS_CONF_invalid(section, ENV_OTHER_POLICIES);
378
			goto err;
379
		}
380
4
		if (!TS_RESP_CTX_add_policy(ctx, objtmp))
381
			goto err;
382
4
		ASN1_OBJECT_free(objtmp);
383
4
	}
384
385
2
	ret = 1;
386
387
err:
388
2
	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
389
2
	return ret;
390
2
}
391
392
int
393
TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx)
394
{
395
	int ret = 0;
396
	int i;
397
	STACK_OF(CONF_VALUE) *list = NULL;
398
4
	char *digests = NCONF_get_string(conf, section, ENV_DIGESTS);
399
400
2
	if (!digests) {
401
		TS_CONF_lookup_fail(section, ENV_DIGESTS);
402
		goto err;
403
	}
404
2
	if (!(list = X509V3_parse_list(digests))) {
405
		TS_CONF_invalid(section, ENV_DIGESTS);
406
		goto err;
407
	}
408
2
	if (sk_CONF_VALUE_num(list) == 0) {
409
		TS_CONF_invalid(section, ENV_DIGESTS);
410
		goto err;
411
	}
412
20
	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
413
8
		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
414
8
		const char *extval = val->value ? val->value : val->name;
415
		const EVP_MD *md;
416
8
		if (!(md = EVP_get_digestbyname(extval))) {
417
			TS_CONF_invalid(section, ENV_DIGESTS);
418
			goto err;
419
		}
420
8
		if (!TS_RESP_CTX_add_md(ctx, md))
421
			goto err;
422
8
	}
423
424
2
	ret = 1;
425
426
err:
427
2
	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
428
2
	return ret;
429
2
}
430
431
int
432
TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx)
433
{
434
	int ret = 0;
435
	int i;
436
	int secs = 0, millis = 0, micros = 0;
437
	STACK_OF(CONF_VALUE) *list = NULL;
438
4
	char *accuracy = NCONF_get_string(conf, section, ENV_ACCURACY);
439
440

2
	if (accuracy && !(list = X509V3_parse_list(accuracy))) {
441
		TS_CONF_invalid(section, ENV_ACCURACY);
442
		goto err;
443
	}
444
4
	for (i = 0; i < sk_CONF_VALUE_num(list); ++i) {
445
		CONF_VALUE *val = sk_CONF_VALUE_value(list, i);
446
		if (strcmp(val->name, ENV_VALUE_SECS) == 0) {
447
			if (val->value)
448
				secs = atoi(val->value);
449
		} else if (strcmp(val->name, ENV_VALUE_MILLISECS) == 0) {
450
			if (val->value)
451
				millis = atoi(val->value);
452
		} else if (strcmp(val->name, ENV_VALUE_MICROSECS) == 0) {
453
			if (val->value)
454
				micros = atoi(val->value);
455
		} else {
456
			TS_CONF_invalid(section, ENV_ACCURACY);
457
			goto err;
458
		}
459
	}
460
2
	if (!TS_RESP_CTX_set_accuracy(ctx, secs, millis, micros))
461
		goto err;
462
463
2
	ret = 1;
464
465
err:
466
2
	sk_CONF_VALUE_pop_free(list, X509V3_conf_free);
467
2
	return ret;
468
2
}
469
470
int
471
TS_CONF_set_clock_precision_digits(CONF *conf, const char *section,
472
    TS_RESP_CTX *ctx)
473
{
474
	int ret = 0;
475
4
	long digits = 0;
476
477
	/* If not specified, set the default value to 0, i.e. sec  precision */
478
2
	if (!NCONF_get_number_e(conf, section, ENV_CLOCK_PRECISION_DIGITS,
479
	    &digits))
480
2
		digits = 0;
481
2
	if (digits < 0 || digits > TS_MAX_CLOCK_PRECISION_DIGITS) {
482
		TS_CONF_invalid(section, ENV_CLOCK_PRECISION_DIGITS);
483
		goto err;
484
	}
485
486
2
	if (!TS_RESP_CTX_set_clock_precision_digits(ctx, digits))
487
		goto err;
488
489
2
	return 1;
490
491
err:
492
	return ret;
493
2
}
494
495
static int
496
TS_CONF_add_flag(CONF *conf, const char *section, const char *field, int flag,
497
    TS_RESP_CTX *ctx)
498
{
499
	/* Default is false. */
500
12
	const char *value = NCONF_get_string(conf, section, field);
501
502
6
	if (value) {
503
		if (strcmp(value, ENV_VALUE_YES) == 0)
504
			TS_RESP_CTX_add_flags(ctx, flag);
505
		else if (strcmp(value, ENV_VALUE_NO) != 0) {
506
			TS_CONF_invalid(section, field);
507
			return 0;
508
		}
509
	}
510
511
6
	return 1;
512
6
}
513
514
int
515
TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx)
516
{
517
4
	return TS_CONF_add_flag(conf, section, ENV_ORDERING, TS_ORDERING, ctx);
518
}
519
520
int
521
TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx)
522
{
523
4
	return TS_CONF_add_flag(conf, section, ENV_TSA_NAME, TS_TSA_NAME, ctx);
524
}
525
526
int
527
TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, TS_RESP_CTX *ctx)
528
{
529
4
	return TS_CONF_add_flag(conf, section, ENV_ESS_CERT_ID_CHAIN,
530
	    TS_ESS_CERT_ID_CHAIN, ctx);
531
}