Skip to content

Commit

Permalink
Squashed commit of the following:
Browse files Browse the repository at this point in the history 
commit c08dd6a
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 15:03:15 2022 -0400

    fixes

commit b18a116
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:31:45 2022 -0400

    remove unnecessary CRL timestamp errors

commit 7dc1a42
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:09:49 2022 -0400

    crl_for_cert -> crl_lookup

commit 011a51b
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:04:02 2022 -0400

    fixes

commit 092384e
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:06:04 2022 -0400

    Squashed commit of the following:

    commit 6e27724
    Merge: 768e061 07e62a4
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 12:55:21 2022 -0400

        Merge branch 'crl-lookup2' into crl-lookup3

    commit 768e061
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 12:15:43 2022 -0400

        Squashed commit of the following:

        commit 295194f
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 28 12:00:58 2022 -0400

            Add wrapper structs for X509/X509_CRL

        commit 49c3345
        Merge: 5347cfa 7f8a951
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 28 10:30:24 2022 -0400

            Merge branch 'main' into refactor-x509-validate-async

        commit 5347cfa
        Merge: b9aa377 f2ef307
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Tue Sep 27 18:47:04 2022 -0400

            Merge branch 'main' into refactor-x509-validate-async

        commit b9aa377
        Merge: fd87c6c e6e8b6a
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Tue Sep 27 12:03:34 2022 -0400

            Merge branch 'main' into refactor-x509-validate-async

        commit fd87c6c
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 19:01:06 2022 -0400

            EXPECT_TRUE -> EXPECT_EQUAL

        commit 876a33b
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 18:59:55 2022 -0400

            CERT_CHAIN_PROCESSED -> READY_TO_VERIFY

        commit 2b5f26e
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 18:52:31 2022 -0400

            add comment for processing leaf certificate extensions

        commit 5d07513
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 16:26:35 2022 -0400

            fixes

        commit 8043a37
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 13:48:17 2022 -0400

            check for INIT state in s2n_x509_validator_read_cert_chain

        commit 5f7443e
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 11:07:51 2022 -0400

            fixes

        commit a9c024e
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Wed Sep 21 11:00:00 2022 -0400

            refactor validate_cert_chain into functions per state

        commit 567385d
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Tue Sep 20 16:27:12 2022 -0400

            prepend s2n_x509_validator

        commit bb86ad4
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Tue Sep 20 14:42:53 2022 -0400

            check for S2N_PKEY_TYPE_UNKNOWN on error

        commit c9870a6
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Fri Sep 16 11:39:08 2022 -0400

            don't check for pkey_type on error in x509_validator tests

        commit 665a692
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Thu Sep 15 11:05:13 2022 -0400

            Refactor s2n_x509_validator_validate_cert_chain to support async callback

    commit 07e62a4
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 27 18:46:01 2022 -0400

        add new api definitions to bindgen test list

    commit 05fcf2f
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 16:42:11 2022 -0400

        fixes

    commit 59b8533
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 20 10:48:18 2022 -0400

        cppcheck

    commit 881821e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 11:59:03 2022 -0400

        Squashed commit of the following:

        commit f683d96
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Mon Sep 19 11:01:23 2022 -0400

            more tests

        commit 3f5b677
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Sun Sep 18 19:21:13 2022 -0400

            get crl/cert issuer hash

        commit add1654
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Fri Sep 16 11:12:04 2022 -0400

            account for 4 additional pointers in s2n_connection_test

        commit 7d7fe48
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Fri Sep 16 10:52:48 2022 -0400

            fix memory

        commit d757f16
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Fri Sep 16 01:37:19 2022 -0400

            previous tests passing

        commit c9870a6
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Fri Sep 16 11:39:08 2022 -0400

            don't check for pkey_type on error in x509_validator tests

        commit 665a692
        Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
        Date:   Thu Sep 15 11:05:13 2022 -0400

            Refactor s2n_x509_validator_validate_cert_chain to support async callback

    commit 33a74ef
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 11:49:59 2022 -0400

        Add wrapper structs for X509/X509_CRL

    commit 49c3345
    Merge: 5347cfa 7f8a951
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 10:30:24 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit 5347cfa
    Merge: b9aa377 f2ef307
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 27 18:47:04 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit b9aa377
    Merge: fd87c6c e6e8b6a
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 27 12:03:34 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit fd87c6c
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 19:01:06 2022 -0400

        EXPECT_TRUE -> EXPECT_EQUAL

    commit 876a33b
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 18:59:55 2022 -0400

        CERT_CHAIN_PROCESSED -> READY_TO_VERIFY

    commit 2b5f26e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 18:52:31 2022 -0400

        add comment for processing leaf certificate extensions

    commit 5d07513
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 16:26:35 2022 -0400

        fixes

    commit 8043a37
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 13:48:17 2022 -0400

        check for INIT state in s2n_x509_validator_read_cert_chain

    commit 5f7443e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 11:07:51 2022 -0400

        fixes

    commit a9c024e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 11:00:00 2022 -0400

        refactor validate_cert_chain into functions per state

    commit 567385d
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 20 16:27:12 2022 -0400

        prepend s2n_x509_validator

    commit bb86ad4
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 20 14:42:53 2022 -0400

        check for S2N_PKEY_TYPE_UNKNOWN on error

    commit c9870a6
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Fri Sep 16 11:39:08 2022 -0400

        don't check for pkey_type on error in x509_validator tests

    commit 665a692
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Thu Sep 15 11:05:13 2022 -0400

        Refactor s2n_x509_validator_validate_cert_chain to support async callback

commit 3937b07
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:20:34 2022 -0400

    update aws-verification-model-for-libcrypto to latest commit

commit 63fd891
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 14:04:30 2022 -0400

    fixes

commit ba33741
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 13:55:38 2022 -0400

    add new structs to bindgen test list

commit 768e061
Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
Date:   Wed Sep 28 12:15:43 2022 -0400

    Squashed commit of the following:

    commit 295194f
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 12:00:58 2022 -0400

        Add wrapper structs for X509/X509_CRL

    commit 49c3345
    Merge: 5347cfa 7f8a951
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 28 10:30:24 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit 5347cfa
    Merge: b9aa377 f2ef307
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 27 18:47:04 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit b9aa377
    Merge: fd87c6c e6e8b6a
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 27 12:03:34 2022 -0400

        Merge branch 'main' into refactor-x509-validate-async

    commit fd87c6c
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 19:01:06 2022 -0400

        EXPECT_TRUE -> EXPECT_EQUAL

    commit 876a33b
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 18:59:55 2022 -0400

        CERT_CHAIN_PROCESSED -> READY_TO_VERIFY

    commit 2b5f26e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 18:52:31 2022 -0400

        add comment for processing leaf certificate extensions

    commit 5d07513
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 16:26:35 2022 -0400

        fixes

    commit 8043a37
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 13:48:17 2022 -0400

        check for INIT state in s2n_x509_validator_read_cert_chain

    commit 5f7443e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 11:07:51 2022 -0400

        fixes

    commit a9c024e
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Wed Sep 21 11:00:00 2022 -0400

        refactor validate_cert_chain into functions per state

    commit 567385d
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 20 16:27:12 2022 -0400

        prepend s2n_x509_validator

    commit bb86ad4
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Tue Sep 20 14:42:53 2022 -0400

        check for S2N_PKEY_TYPE_UNKNOWN on error

    commit c9870a6
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Fri Sep 16 11:39:08 2022 -0400

        don't check for pkey_type on error in x509_validator tests

    commit 665a692
    Author: Sam Clark <3758302+goatgoose@users.noreply.github.com>
    Date:   Thu Sep 15 11:05:13 2022 -0400

        Refactor s2n_x509_validator_validate_cert_chain to support async callback
  • Loading branch information
@goatgoose
goatgoose committed Sep 28, 2022
1 parent c0ad926 commit 373745b
Show file tree
Hide file tree
Showing 10 changed files with 552 additions and 4 deletions.
2 changes: 2 additions & 0 deletions bindings/rust/generate/src/main.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,8 @@ impl FunctionCallbacks {
"s2n_clock_time_nanoseconds",
"s2n_config",
"s2n_connection",
"s2n_crl_lookup_context",
"s2n_crl_lookup_fn",
"s2n_early_data_cb",
"s2n_key_log_fn",
"s2n_mem_cleanup_callback",
Expand Down
4 changes: 4 additions & 0 deletions error/s2n_errno.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,10 @@ static const char *no_such_error = "Internal s2n error";
ERR_ENTRY(S2N_ERR_CERT_TYPE_UNSUPPORTED, "Certificate Type is unsupported") \
ERR_ENTRY(S2N_ERR_CERT_INVALID, "Certificate is invalid") \
ERR_ENTRY(S2N_ERR_CERT_MAX_CHAIN_DEPTH_EXCEEDED, "The maximum certificate chain depth has been exceeded") \
ERR_ENTRY(S2N_ERR_CRL_LOOKUP_FAILED, "No CRL could be found for the corresponding certificate") \
ERR_ENTRY(S2N_ERR_CRL_SIGNATURE, "The signature of the CRL is invalid") \
ERR_ENTRY(S2N_ERR_CRL_ISSUER, "Unable to get the CRL issuer certificate") \
ERR_ENTRY(S2N_ERR_CRL_UNHANDLED_CRITICAL_EXTENSION, "Unhandled critical CRL extension") \
ERR_ENTRY(S2N_ERR_INVALID_MAX_FRAG_LEN, "invalid Maximum Fragmentation Length encountered") \
ERR_ENTRY(S2N_ERR_MAX_FRAG_LEN_MISMATCH, "Negotiated Maximum Fragmentation Length from server does not match the requested length by client") \
ERR_ENTRY(S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED, "TLS protocol version is not supported by configuration") \
Expand Down
4 changes: 4 additions & 0 deletions error/s2n_errno.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@ typedef enum {
S2N_ERR_CERT_TYPE_UNSUPPORTED,
S2N_ERR_CERT_INVALID,
S2N_ERR_CERT_MAX_CHAIN_DEPTH_EXCEEDED,
S2N_ERR_CRL_LOOKUP_FAILED,
S2N_ERR_CRL_SIGNATURE,
S2N_ERR_CRL_ISSUER,
S2N_ERR_CRL_UNHANDLED_CRITICAL_EXTENSION,
S2N_ERR_INVALID_MAX_FRAG_LEN,
S2N_ERR_MAX_FRAG_LEN_MISMATCH,
S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED,
Expand Down
2 changes: 1 addition & 1 deletion tests/unit/s2n_connection_test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ int main(int argc, char **argv)
*/
{
/* Carefully consider any increases to this number. */
const uint16_t max_connection_size = 4150;
const uint16_t max_connection_size = 4182;
const uint16_t min_connection_size = max_connection_size * 0.9;

size_t connection_size = sizeof(struct s2n_connection);
Expand Down
295 changes: 295 additions & 0 deletions tests/unit/s2n_x509_validator_test.c
View file

Large diffs are not rendered by default.

4 changes: 4 additions & 0 deletions tls/s2n_alerts.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,10 @@ static S2N_RESULT s2n_translate_protocol_error_to_alert(int error_code, uint8_t
S2N_NO_ALERT(S2N_ERR_CERT_TYPE_UNSUPPORTED);
S2N_NO_ALERT(S2N_ERR_CERT_INVALID);
S2N_NO_ALERT(S2N_ERR_CERT_MAX_CHAIN_DEPTH_EXCEEDED);
S2N_NO_ALERT(S2N_ERR_CRL_LOOKUP_FAILED);
S2N_NO_ALERT(S2N_ERR_CRL_SIGNATURE);
S2N_NO_ALERT(S2N_ERR_CRL_ISSUER);
S2N_NO_ALERT(S2N_ERR_CRL_UNHANDLED_CRITICAL_EXTENSION);
S2N_NO_ALERT(S2N_ERR_INVALID_MAX_FRAG_LEN);
S2N_NO_ALERT(S2N_ERR_MAX_FRAG_LEN_MISMATCH);
S2N_NO_ALERT(S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
Expand Down
3 changes: 3 additions & 0 deletions tls/s2n_connection.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,9 @@ struct s2n_connection {
void *data_for_verify_host;
uint8_t verify_host_fn_overridden;

s2n_crl_lookup_fn crl_lookup;
void *data_for_crl_lookup;

/* Session ticket data */
s2n_session_ticket_status session_ticket_status;
struct s2n_blob client_ticket;
Expand Down
207 changes: 205 additions & 2 deletions tls/s2n_x509_validator.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,24 @@ int s2n_x509_crl_get_issuer_hash(struct s2n_x509_crl *crl, unsigned long *hash)
return S2N_SUCCESS;
}

S2N_RESULT s2n_crl_lookup_context_init(struct s2n_crl_lookup_context *context) {
context->status = AWAITING_RESPONSE;
context->cert = NULL;
context->cert_idx = -1;
context->crl = NULL;

return S2N_RESULT_OK;
}

S2N_CLEANUP_RESULT s2n_crl_lookup_context_free(struct s2n_crl_lookup_context *context) {
if (context) {
RESULT_GUARD_POSIX(s2n_x509_cert_free(context->cert));
}
return S2N_RESULT_OK;
}

DEFINE_POINTER_CLEANUP_FUNC(struct s2n_crl_lookup_context*, s2n_crl_lookup_context_free);

int s2n_x509_validator_init_no_x509_validation(struct s2n_x509_validator *validator) {
POSIX_ENSURE_REF(validator);
validator->trust_store = NULL;
Expand All @@ -241,6 +259,8 @@ int s2n_x509_validator_init_no_x509_validation(struct s2n_x509_validator *valida
validator->max_chain_depth = DEFAULT_MAX_CHAIN_DEPTH;
validator->state = INIT;
validator->cert_chain_from_wire = sk_X509_new_null();
validator->crl_stack = sk_X509_CRL_new_null();
validator->crl_lookup_contexts = NULL;

return 0;
}
Expand All @@ -257,7 +277,9 @@ int s2n_x509_validator_init(struct s2n_x509_validator *validator, struct s2n_x50
POSIX_ENSURE_REF(validator->store_ctx);
}
validator->cert_chain_from_wire = sk_X509_new_null();
validator->crl_stack = sk_X509_CRL_new_null();
validator->state = INIT;
validator->crl_lookup_contexts = NULL;

return 0;
}
Expand All @@ -268,17 +290,36 @@ static inline void wipe_cert_chain(STACK_OF(X509) *cert_chain) {
}
}

void s2n_x509_validator_wipe(struct s2n_x509_validator *validator) {
int s2n_x509_validator_wipe(struct s2n_x509_validator *validator) {
if (validator->store_ctx) {
X509_STORE_CTX_free(validator->store_ctx);
validator->store_ctx = NULL;
}
wipe_cert_chain(validator->cert_chain_from_wire);
if (validator->crl_stack) {
/* Only free the stack itself, since we don't own the CRLs */
sk_X509_CRL_free(validator->crl_stack);
validator->crl_stack = NULL;
}
validator->cert_chain_from_wire = NULL;
validator->trust_store = NULL;
validator->skip_cert_validation = 0;
validator->state = UNINIT;
validator->max_chain_depth = 0;
if (validator->crl_lookup_contexts) {
uint32_t crl_lookup_contexts_len = 0;
POSIX_GUARD_RESULT(s2n_array_num_elements(validator->crl_lookup_contexts, &crl_lookup_contexts_len));
for (int i = 0; i < crl_lookup_contexts_len; i++) {
struct s2n_crl_lookup_context *context = NULL;
POSIX_GUARD_RESULT(s2n_array_get(validator->crl_lookup_contexts, i, (void**) &context));
POSIX_GUARD_RESULT(s2n_crl_lookup_context_free(context));
}

POSIX_GUARD_RESULT(s2n_array_free(validator->crl_lookup_contexts));
validator->crl_lookup_contexts = NULL;
}

return S2N_SUCCESS;
}

int s2n_x509_validator_set_max_chain_depth(struct s2n_x509_validator *validator, uint16_t max_depth) {
Expand Down Expand Up @@ -444,6 +485,116 @@ static S2N_RESULT s2n_x509_validator_read_cert_chain(struct s2n_x509_validator *
return S2N_RESULT_OK;
}

static S2N_RESULT s2n_x509_validator_load_crls_from_contexts(struct s2n_x509_validator *validator) {
uint32_t num_contexts = 0;
RESULT_GUARD(s2n_array_num_elements(validator->crl_lookup_contexts, &num_contexts));
for (uint32_t i = 0; i < num_contexts; i++) {
struct s2n_crl_lookup_context *context = NULL;
RESULT_GUARD(s2n_array_get(validator->crl_lookup_contexts, i, (void **) &context));
RESULT_ENSURE_REF(context);

if (!context->crl) {
/* A CRL was intentionally not returned from the callback. Don't add anything to the store.*/
continue;
}

RESULT_ENSURE_REF(context->crl->crl);
if (!sk_X509_CRL_push(validator->crl_stack, context->crl->crl)) {
RESULT_BAIL(S2N_ERR_INTERNAL_LIBCRYPTO_ERROR);
}
}

X509_STORE_CTX_set0_crls(validator->store_ctx, validator->crl_stack);

return S2N_RESULT_OK;
}

static S2N_RESULT s2n_x509_validator_get_crl_lookup_callback_status(struct s2n_x509_validator *validator,
crl_lookup_callback_status *status) {
RESULT_ENSURE_REF(validator->crl_lookup_contexts);

*status = FINISHED;

uint32_t num_contexts = 0;
RESULT_GUARD(s2n_array_num_elements(validator->crl_lookup_contexts, &num_contexts));
for (uint32_t i = 0; i < num_contexts; i++) {
struct s2n_crl_lookup_context *context = NULL;
RESULT_GUARD(s2n_array_get(validator->crl_lookup_contexts, i, ( void ** ) &context));
RESULT_ENSURE_REF(context);

switch (context->status) {
case FINISHED:
break;
case AWAITING_RESPONSE:
*status = AWAITING_RESPONSE;
return S2N_RESULT_OK;
}
}

return S2N_RESULT_OK;
}

static S2N_RESULT s2n_x509_validator_handle_crl_lookup_callback_result(struct s2n_x509_validator *validator) {
crl_lookup_callback_status status = 0;
RESULT_GUARD(s2n_x509_validator_get_crl_lookup_callback_status(validator, &status));
switch (status) {
case FINISHED:
RESULT_GUARD(s2n_x509_validator_load_crls_from_contexts(validator));
validator->state = READY_TO_VERIFY;
break;
case AWAITING_RESPONSE:
validator->state = AWAITING_CRL_CALLBACK;
RESULT_BAIL(S2N_ERR_ASYNC_BLOCKED);
}
return S2N_RESULT_OK;
}

static S2N_RESULT s2n_x509_validator_crl_lookup(struct s2n_x509_validator *validator, struct s2n_connection *conn) {
RESULT_ENSURE_REF(validator->store_ctx);

int cert_count = sk_X509_num(validator->cert_chain_from_wire);

DEFER_CLEANUP(struct s2n_array *crl_lookup_contexts = s2n_array_new(sizeof(struct s2n_crl_lookup_context)),
s2n_array_free_p);
RESULT_ENSURE_REF(crl_lookup_contexts);

for (int i = 0; i < cert_count; ++i) {
DEFER_CLEANUP(struct s2n_crl_lookup_context* context = NULL, s2n_crl_lookup_context_free_pointer);
RESULT_GUARD(s2n_array_pushback(crl_lookup_contexts, (void**) &context));

RESULT_GUARD(s2n_crl_lookup_context_init(context));

X509 *cert = sk_X509_value(validator->cert_chain_from_wire, i);
RESULT_ENSURE_REF(cert);

struct s2n_x509_cert *s2n_cert = s2n_x509_cert_new();
RESULT_ENSURE_REF(s2n_cert);
s2n_cert->cert = cert;

context->cert = s2n_cert;
context->cert_idx = i;

ZERO_TO_DISABLE_DEFER_CLEANUP(context);
}

validator->crl_lookup_contexts = crl_lookup_contexts;
ZERO_TO_DISABLE_DEFER_CLEANUP(crl_lookup_contexts);

uint32_t num_contexts = 0;
RESULT_GUARD(s2n_array_num_elements(validator->crl_lookup_contexts, &num_contexts));
for (uint32_t i = 0; i < num_contexts; i++) {
struct s2n_crl_lookup_context *context = NULL;
RESULT_GUARD(s2n_array_get(validator->crl_lookup_contexts, i, (void**) &context));
RESULT_ENSURE_REF(context);

RESULT_GUARD_POSIX(conn->crl_lookup(context, conn->data_for_crl_lookup));
}

RESULT_GUARD(s2n_x509_validator_handle_crl_lookup_callback_result(validator));

return S2N_RESULT_OK;
}

static S2N_RESULT s2n_x509_validator_process_cert_chain(struct s2n_x509_validator *validator, struct s2n_connection *conn,
uint8_t *cert_chain_in, uint32_t cert_chain_len) {
RESULT_ENSURE(validator->state == INIT, S2N_ERR_INVALID_CERT_STATE);
Expand All @@ -464,6 +615,10 @@ static S2N_RESULT s2n_x509_validator_process_cert_chain(struct s2n_x509_validato
RESULT_GUARD_OSSL(X509_STORE_CTX_init(validator->store_ctx, validator->trust_store->trust_store, leaf,
validator->cert_chain_from_wire), S2N_ERR_INTERNAL_LIBCRYPTO_ERROR);

if (conn->crl_lookup) {
RESULT_GUARD(s2n_x509_validator_crl_lookup(validator, conn));
}

validator->state = READY_TO_VERIFY;

return S2N_RESULT_OK;
Expand All @@ -475,6 +630,11 @@ static S2N_RESULT s2n_x509_validator_verify_cert_chain(struct s2n_x509_validator
X509_VERIFY_PARAM *param = X509_STORE_CTX_get0_param(validator->store_ctx);
X509_VERIFY_PARAM_set_depth(param, validator->max_chain_depth);

if (conn->crl_lookup) {
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK_ALL);
}

uint64_t current_sys_time = 0;
conn->config->wall_clock(conn->config->sys_clock_ctx, &current_sys_time);

Expand All @@ -488,6 +648,17 @@ static S2N_RESULT s2n_x509_validator_verify_cert_chain(struct s2n_x509_validator
switch (ossl_error) {
case X509_V_ERR_CERT_HAS_EXPIRED:
RESULT_BAIL(S2N_ERR_CERT_EXPIRED);
case X509_V_ERR_CERT_REVOKED:
RESULT_BAIL(S2N_ERR_CERT_REVOKED);
case X509_V_ERR_UNABLE_TO_GET_CRL:
case X509_V_ERR_DIFFERENT_CRL_SCOPE:
RESULT_BAIL(S2N_ERR_CRL_LOOKUP_FAILED);
case X509_V_ERR_CRL_SIGNATURE_FAILURE:
RESULT_BAIL(S2N_ERR_CRL_SIGNATURE);
case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
RESULT_BAIL(S2N_ERR_CRL_ISSUER);
case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
RESULT_BAIL(S2N_ERR_CRL_UNHANDLED_CRITICAL_EXTENSION);
default:
RESULT_BAIL(S2N_ERR_CERT_UNTRUSTED);
}
Expand Down Expand Up @@ -525,7 +696,15 @@ static S2N_RESULT s2n_x509_validator_read_leaf_info(struct s2n_connection *conn,

S2N_RESULT s2n_x509_validator_validate_cert_chain(struct s2n_x509_validator *validator, struct s2n_connection *conn,
uint8_t *cert_chain_in, uint32_t cert_chain_len, s2n_pkey_type *pkey_type, struct s2n_pkey *public_key_out) {
RESULT_ENSURE(validator->state == INIT, S2N_ERR_INVALID_CERT_STATE);
switch (validator->state) {
case INIT:
break;
case AWAITING_CRL_CALLBACK:
RESULT_GUARD(s2n_x509_validator_handle_crl_lookup_callback_result(validator));
break;
default:
RESULT_BAIL(S2N_ERR_INVALID_CERT_STATE);
}

if (validator->state == INIT) {
RESULT_GUARD(s2n_x509_validator_process_cert_chain(validator, conn, cert_chain_in, cert_chain_len));
Expand Down Expand Up @@ -723,3 +902,27 @@ bool s2n_x509_validator_is_cert_chain_validated(const struct s2n_x509_validator
{
return validator && (validator->state == VALIDATED || validator->state == OCSP_VALIDATED);
}

int s2n_crl_lookup_get_cert(struct s2n_crl_lookup_context *context, struct s2n_x509_cert **cert) {
POSIX_ENSURE_REF(context);
POSIX_ENSURE_REF(context->cert);

*cert = context->cert;

return S2N_SUCCESS;
}

int s2n_crl_lookup_accept(struct s2n_crl_lookup_context *context, struct s2n_x509_crl *crl) {
POSIX_ENSURE_REF(context);
POSIX_ENSURE_REF(crl);
context->crl = crl;
context->status = FINISHED;
return S2N_SUCCESS;
}

int s2n_crl_lookup_reject(struct s2n_crl_lookup_context *context) {
POSIX_ENSURE_REF(context);
context->crl = NULL;
context->status = FINISHED;
return S2N_SUCCESS;
}
Loading

0 comments on commit 373745b

Please sign in to comment.