summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509/x509_cmp.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/x509/x509_cmp.c')
-rw-r--r--src/lib/libcrypto/x509/x509_cmp.c429
1 files changed, 0 insertions, 429 deletions
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
deleted file mode 100644
index 2c1e427093..0000000000
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ /dev/null
@@ -1,429 +0,0 @@
1/* $OpenBSD: x509_cmp.c,v 1.44 2024/03/25 03:41:16 joshua Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <ctype.h>
60#include <stdio.h>
61#include <string.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/asn1.h>
66#include <openssl/err.h>
67#include <openssl/objects.h>
68#include <openssl/x509.h>
69#include <openssl/x509v3.h>
70
71#include "evp_local.h"
72#include "x509_local.h"
73
74int
75X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
76{
77 int i;
78 X509_CINF *ai, *bi;
79
80 ai = a->cert_info;
81 bi = b->cert_info;
82 i = ASN1_INTEGER_cmp(ai->serialNumber, bi->serialNumber);
83 if (i)
84 return (i);
85 return (X509_NAME_cmp(ai->issuer, bi->issuer));
86}
87LCRYPTO_ALIAS(X509_issuer_and_serial_cmp);
88
89#ifndef OPENSSL_NO_MD5
90unsigned long
91X509_issuer_and_serial_hash(X509 *a)
92{
93 unsigned long ret = 0;
94 EVP_MD_CTX *md_ctx;
95 unsigned char md[16];
96 char *f = NULL;
97
98 if ((md_ctx = EVP_MD_CTX_new()) == NULL)
99 goto err;
100
101 if ((f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0)) == NULL)
102 goto err;
103 if (!EVP_DigestInit_ex(md_ctx, EVP_md5(), NULL))
104 goto err;
105 if (!EVP_DigestUpdate(md_ctx, (unsigned char *)f, strlen(f)))
106 goto err;
107 if (!EVP_DigestUpdate(md_ctx,
108 (unsigned char *)a->cert_info->serialNumber->data,
109 (unsigned long)a->cert_info->serialNumber->length))
110 goto err;
111 if (!EVP_DigestFinal_ex(md_ctx, &(md[0]), NULL))
112 goto err;
113
114 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
115 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
116 0xffffffffL;
117
118err:
119 EVP_MD_CTX_free(md_ctx);
120 free(f);
121
122 return ret;
123}
124LCRYPTO_ALIAS(X509_issuer_and_serial_hash);
125#endif
126
127int
128X509_issuer_name_cmp(const X509 *a, const X509 *b)
129{
130 return (X509_NAME_cmp(a->cert_info->issuer, b->cert_info->issuer));
131}
132LCRYPTO_ALIAS(X509_issuer_name_cmp);
133
134int
135X509_subject_name_cmp(const X509 *a, const X509 *b)
136{
137 return (X509_NAME_cmp(a->cert_info->subject, b->cert_info->subject));
138}
139LCRYPTO_ALIAS(X509_subject_name_cmp);
140
141int
142X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
143{
144 return (X509_NAME_cmp(a->crl->issuer, b->crl->issuer));
145}
146LCRYPTO_ALIAS(X509_CRL_cmp);
147
148#ifndef OPENSSL_NO_SHA
149int
150X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
151{
152 return memcmp(a->hash, b->hash, X509_CRL_HASH_LEN);
153}
154LCRYPTO_ALIAS(X509_CRL_match);
155#endif
156
157X509_NAME *
158X509_get_issuer_name(const X509 *a)
159{
160 return (a->cert_info->issuer);
161}
162LCRYPTO_ALIAS(X509_get_issuer_name);
163
164unsigned long
165X509_issuer_name_hash(X509 *x)
166{
167 return (X509_NAME_hash(x->cert_info->issuer));
168}
169LCRYPTO_ALIAS(X509_issuer_name_hash);
170
171#ifndef OPENSSL_NO_MD5
172unsigned long
173X509_issuer_name_hash_old(X509 *x)
174{
175 return (X509_NAME_hash_old(x->cert_info->issuer));
176}
177LCRYPTO_ALIAS(X509_issuer_name_hash_old);
178#endif
179
180X509_NAME *
181X509_get_subject_name(const X509 *a)
182{
183 return (a->cert_info->subject);
184}
185LCRYPTO_ALIAS(X509_get_subject_name);
186
187ASN1_INTEGER *
188X509_get_serialNumber(X509 *a)
189{
190 return (a->cert_info->serialNumber);
191}
192LCRYPTO_ALIAS(X509_get_serialNumber);
193
194const ASN1_INTEGER *
195X509_get0_serialNumber(const X509 *a)
196{
197 return (a->cert_info->serialNumber);
198}
199LCRYPTO_ALIAS(X509_get0_serialNumber);
200
201unsigned long
202X509_subject_name_hash(X509 *x)
203{
204 return (X509_NAME_hash(x->cert_info->subject));
205}
206LCRYPTO_ALIAS(X509_subject_name_hash);
207
208#ifndef OPENSSL_NO_MD5
209unsigned long
210X509_subject_name_hash_old(X509 *x)
211{
212 return (X509_NAME_hash_old(x->cert_info->subject));
213}
214LCRYPTO_ALIAS(X509_subject_name_hash_old);
215#endif
216
217#ifndef OPENSSL_NO_SHA
218/* Compare two certificates: they must be identical for
219 * this to work. NB: Although "cmp" operations are generally
220 * prototyped to take "const" arguments (eg. for use in
221 * STACKs), the way X509 handling is - these operations may
222 * involve ensuring the hashes are up-to-date and ensuring
223 * certain cert information is cached. So this is the point
224 * where the "depth-first" constification tree has to halt
225 * with an evil cast.
226 */
227int
228X509_cmp(const X509 *a, const X509 *b)
229{
230 /* ensure hash is valid */
231 X509_check_purpose((X509 *)a, -1, 0);
232 X509_check_purpose((X509 *)b, -1, 0);
233
234 return memcmp(a->hash, b->hash, X509_CERT_HASH_LEN);
235}
236LCRYPTO_ALIAS(X509_cmp);
237#endif
238
239int
240X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
241{
242 int ret;
243
244 /* Ensure canonical encoding is present and up to date */
245 if (!a->canon_enc || a->modified) {
246 ret = i2d_X509_NAME((X509_NAME *)a, NULL);
247 if (ret < 0)
248 return -2;
249 }
250 if (!b->canon_enc || b->modified) {
251 ret = i2d_X509_NAME((X509_NAME *)b, NULL);
252 if (ret < 0)
253 return -2;
254 }
255 ret = a->canon_enclen - b->canon_enclen;
256 if (ret)
257 return ret;
258 return memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);
259}
260LCRYPTO_ALIAS(X509_NAME_cmp);
261
262unsigned long
263X509_NAME_hash(X509_NAME *x)
264{
265 unsigned long ret = 0;
266 unsigned char md[SHA_DIGEST_LENGTH];
267
268 /* Make sure X509_NAME structure contains valid cached encoding */
269 i2d_X509_NAME(x, NULL);
270 if (!EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(),
271 NULL))
272 return 0;
273
274 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
275 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
276 0xffffffffL;
277 return (ret);
278}
279LCRYPTO_ALIAS(X509_NAME_hash);
280
281
282#ifndef OPENSSL_NO_MD5
283/* I now DER encode the name and hash it. Since I cache the DER encoding,
284 * this is reasonably efficient. */
285
286unsigned long
287X509_NAME_hash_old(X509_NAME *x)
288{
289 EVP_MD_CTX *md_ctx;
290 unsigned long ret = 0;
291 unsigned char md[16];
292
293 if ((md_ctx = EVP_MD_CTX_new()) == NULL)
294 return ret;
295
296 /* Make sure X509_NAME structure contains valid cached encoding */
297 i2d_X509_NAME(x, NULL);
298 if (EVP_DigestInit_ex(md_ctx, EVP_md5(), NULL) &&
299 EVP_DigestUpdate(md_ctx, x->bytes->data, x->bytes->length) &&
300 EVP_DigestFinal_ex(md_ctx, md, NULL))
301 ret = (((unsigned long)md[0]) |
302 ((unsigned long)md[1] << 8L) |
303 ((unsigned long)md[2] << 16L) |
304 ((unsigned long)md[3] << 24L)) &
305 0xffffffffL;
306
307 EVP_MD_CTX_free(md_ctx);
308
309 return ret;
310}
311LCRYPTO_ALIAS(X509_NAME_hash_old);
312#endif
313
314/* Search a stack of X509 for a match */
315X509 *
316X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
317 ASN1_INTEGER *serial)
318{
319 int i;
320 X509_CINF cinf;
321 X509 x, *x509 = NULL;
322
323 if (!sk)
324 return NULL;
325
326 x.cert_info = &cinf;
327 cinf.serialNumber = serial;
328 cinf.issuer = name;
329
330 for (i = 0; i < sk_X509_num(sk); i++) {
331 x509 = sk_X509_value(sk, i);
332 if (X509_issuer_and_serial_cmp(x509, &x) == 0)
333 return (x509);
334 }
335 return (NULL);
336}
337LCRYPTO_ALIAS(X509_find_by_issuer_and_serial);
338
339X509 *
340X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name)
341{
342 X509 *x509;
343 int i;
344
345 for (i = 0; i < sk_X509_num(sk); i++) {
346 x509 = sk_X509_value(sk, i);
347 if (X509_NAME_cmp(X509_get_subject_name(x509), name) == 0)
348 return (x509);
349 }
350 return (NULL);
351}
352LCRYPTO_ALIAS(X509_find_by_subject);
353
354EVP_PKEY *
355X509_get_pubkey(X509 *x)
356{
357 if (x == NULL || x->cert_info == NULL)
358 return (NULL);
359 return (X509_PUBKEY_get(x->cert_info->key));
360}
361LCRYPTO_ALIAS(X509_get_pubkey);
362
363EVP_PKEY *
364X509_get0_pubkey(const X509 *x)
365{
366 if (x == NULL || x->cert_info == NULL)
367 return (NULL);
368 return (X509_PUBKEY_get0(x->cert_info->key));
369}
370LCRYPTO_ALIAS(X509_get0_pubkey);
371
372ASN1_BIT_STRING *
373X509_get0_pubkey_bitstr(const X509 *x)
374{
375 if (!x)
376 return NULL;
377 return x->cert_info->key->public_key;
378}
379LCRYPTO_ALIAS(X509_get0_pubkey_bitstr);
380
381int
382X509_check_private_key(const X509 *x, const EVP_PKEY *k)
383{
384 const EVP_PKEY *xk;
385 int ret;
386
387 xk = X509_get0_pubkey(x);
388
389 if (xk)
390 ret = EVP_PKEY_cmp(xk, k);
391 else
392 ret = -2;
393
394 switch (ret) {
395 case 1:
396 break;
397 case 0:
398 X509error(X509_R_KEY_VALUES_MISMATCH);
399 break;
400 case -1:
401 X509error(X509_R_KEY_TYPE_MISMATCH);
402 break;
403 case -2:
404 X509error(X509_R_UNKNOWN_KEY_TYPE);
405 }
406 if (ret > 0)
407 return 1;
408 return 0;
409}
410LCRYPTO_ALIAS(X509_check_private_key);
411
412/*
413 * Not strictly speaking an "up_ref" as a STACK doesn't have a reference
414 * count but it has the same effect by duping the STACK and upping the ref of
415 * each X509 structure.
416 */
417STACK_OF(X509) *
418X509_chain_up_ref(STACK_OF(X509) *chain)
419{
420 STACK_OF(X509) *ret;
421 size_t i;
422
423 ret = sk_X509_dup(chain);
424 for (i = 0; i < sk_X509_num(ret); i++)
425 X509_up_ref(sk_X509_value(ret, i));
426
427 return ret;
428}
429LCRYPTO_ALIAS(X509_chain_up_ref);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-06 15:41:10 +0000