mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
Merge remote-tracking branch 'origin/master' into topic/robin/dynamic-plugins-2.3
This commit is contained in:
Robin Sommer
commit
ba7af428a7
133 changed files with 3382 additions and 1381 deletions
|
|
@ -46,7 +46,7 @@ bool file_analysis::X509::EndOfFile()
|
|||
::X509* ssl_cert = d2i_X509(NULL, &cert_char, cert_data.size());
|
||||
if ( ! ssl_cert )
|
||||
{
|
||||
reporter->Error("Could not parse X509 certificate (fuid %s)", GetFile()->GetID().c_str());
|
||||
reporter->Weird(fmt("Could not parse X509 certificate (fuid %s)", GetFile()->GetID().c_str()));
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
@ -88,7 +88,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val)
|
|||
{
|
||||
::X509* ssl_cert = cert_val->GetCertificate();
|
||||
|
||||
char buf[256]; // we need a buffer for some of the openssl functions
|
||||
char buf[2048]; // we need a buffer for some of the openssl functions
|
||||
memset(buf, 0, sizeof(buf));
|
||||
|
||||
RecordVal* pX509Cert = new RecordVal(BifType::Record::X509::Certificate);
|
||||
|
|
@ -96,14 +96,16 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val)
|
|||
|
||||
pX509Cert->Assign(0, new Val((uint64) X509_get_version(ssl_cert) + 1, TYPE_COUNT));
|
||||
i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert));
|
||||
int len = BIO_read(bio, &(*buf), sizeof(buf));
|
||||
int len = BIO_read(bio, buf, sizeof(buf));
|
||||
pX509Cert->Assign(1, new StringVal(len, buf));
|
||||
BIO_reset(bio);
|
||||
|
||||
X509_NAME_print_ex(bio, X509_get_subject_name(ssl_cert), 0, XN_FLAG_RFC2253);
|
||||
len = BIO_gets(bio, &(*buf), sizeof(buf));
|
||||
len = BIO_gets(bio, buf, sizeof(buf));
|
||||
pX509Cert->Assign(2, new StringVal(len, buf));
|
||||
BIO_reset(bio);
|
||||
X509_NAME_print_ex(bio, X509_get_issuer_name(ssl_cert), 0, XN_FLAG_RFC2253);
|
||||
len = BIO_gets(bio, &(*buf), sizeof(buf));
|
||||
len = BIO_gets(bio, buf, sizeof(buf));
|
||||
pX509Cert->Assign(3, new StringVal(len, buf));
|
||||
BIO_free(bio);
|
||||
|
||||
|
|
@ -171,7 +173,7 @@ StringVal* file_analysis::X509::GetExtensionFromBIO(BIO* bio)
|
|||
{
|
||||
char tmp[120];
|
||||
ERR_error_string_n(ERR_get_error(), tmp, sizeof(tmp));
|
||||
reporter->Error("X509::GetExtensionFromBIO: %s", tmp);
|
||||
reporter->Weird(fmt("X509::GetExtensionFromBIO: %s", tmp));
|
||||
BIO_free_all(bio);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -279,7 +281,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
|
|||
}
|
||||
|
||||
else
|
||||
reporter->Error("Certificate with invalid BasicConstraint. fuid %s", GetFile()->GetID().c_str());
|
||||
reporter->Weird(fmt("Certificate with invalid BasicConstraint. fuid %s", GetFile()->GetID().c_str()));
|
||||
}
|
||||
|
||||
void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
||||
|
|
@ -289,7 +291,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
|||
GENERAL_NAMES *altname = (GENERAL_NAMES*)X509V3_EXT_d2i(ext);
|
||||
if ( ! altname )
|
||||
{
|
||||
reporter->Error("Could not parse subject alternative names. fuid %s", GetFile()->GetID().c_str());
|
||||
reporter->Weird(fmt("Could not parse subject alternative names. fuid %s", GetFile()->GetID().c_str()));
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
@ -309,7 +311,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
|||
{
|
||||
if ( ASN1_STRING_type(gen->d.ia5) != V_ASN1_IA5STRING )
|
||||
{
|
||||
reporter->Error("DNS-field does not contain an IA5String. fuid %s", GetFile()->GetID().c_str());
|
||||
reporter->Weird(fmt("DNS-field does not contain an IA5String. fuid %s", GetFile()->GetID().c_str()));
|
||||
continue;
|
||||
}
|
||||
|
||||
|
|
@ -356,7 +358,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
|||
|
||||
else
|
||||
{
|
||||
reporter->Error("Weird IP address length %d in subject alternative name. fuid %s", gen->d.ip->length, GetFile()->GetID().c_str());
|
||||
reporter->Weird(fmt("Weird IP address length %d in subject alternative name. fuid %s", gen->d.ip->length, GetFile()->GetID().c_str()));
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,9 +43,9 @@ event x509_extension%(f: fa_file, ext: X509::Extension%);
|
|||
event x509_ext_basic_constraints%(f: fa_file, ext: X509::BasicConstraints%);
|
||||
|
||||
## Generated for the X509 subject alternative name extension seen in a certificate.
|
||||
## This extension can be used to allow additional entities to be bound to the subject
|
||||
## of the certificate. Usually it is used to specify one or multiple DNS names for
|
||||
## which a certificate is valid.
|
||||
## This extension can be used to allow additional entities to be bound to the
|
||||
## subject of the certificate. Usually it is used to specify one or multiple DNS
|
||||
## names for which a certificate is valid.
|
||||
##
|
||||
## f: The file.
|
||||
##
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@
|
|||
#include <openssl/x509.h>
|
||||
#include <openssl/asn1.h>
|
||||
#include <openssl/x509_vfy.h>
|
||||
#include <openssl/ocsp.h>
|
||||
|
||||
// This is the indexed map of X509 certificate stores.
|
||||
static map<Val*, X509_STORE*> x509_stores;
|
||||
|
|
@ -24,23 +25,92 @@ X509* d2i_X509_(X509** px, const u_char** in, int len)
|
|||
}
|
||||
|
||||
// construct an error record
|
||||
RecordVal* x509_error_record(uint64_t num, const char* reason)
|
||||
RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector = 0)
|
||||
{
|
||||
RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
|
||||
|
||||
rrecord->Assign(0, new Val(num, TYPE_COUNT));
|
||||
rrecord->Assign(0, new Val(num, TYPE_INT));
|
||||
rrecord->Assign(1, new StringVal(reason));
|
||||
if ( chainVector )
|
||||
rrecord->Assign(2, chainVector);
|
||||
|
||||
return rrecord;
|
||||
}
|
||||
|
||||
X509_STORE* x509_get_root_store(TableVal* root_certs)
|
||||
{
|
||||
// If this certificate store was built previously, just reuse the old one.
|
||||
if ( x509_stores.count(root_certs) > 0 )
|
||||
return x509_stores[root_certs];
|
||||
|
||||
X509_STORE* ctx = X509_STORE_new();
|
||||
ListVal* idxs = root_certs->ConvertToPureList();
|
||||
|
||||
// Build the validation store
|
||||
for ( int i = 0; i < idxs->Length(); ++i )
|
||||
{
|
||||
Val* key = idxs->Index(i);
|
||||
StringVal *sv = root_certs->Lookup(key)->AsStringVal();
|
||||
assert(sv);
|
||||
const uint8* data = sv->Bytes();
|
||||
X509* x = d2i_X509_(NULL, &data, sv->Len());
|
||||
if ( ! x )
|
||||
{
|
||||
builtin_error(fmt("Root CA error: %s", ERR_error_string(ERR_get_error(),NULL)));
|
||||
return 0;
|
||||
}
|
||||
|
||||
X509_STORE_add_cert(ctx, x);
|
||||
X509_free(x);
|
||||
}
|
||||
|
||||
delete idxs;
|
||||
|
||||
// Save the newly constructed certificate store into the cacheing map.
|
||||
x509_stores[root_certs] = ctx;
|
||||
|
||||
return ctx;
|
||||
}
|
||||
|
||||
// get all cretificates starting at the second one (assuming the first one is the host certificate)
|
||||
STACK_OF(X509)* x509_get_untrusted_stack(VectorVal* certs_vec)
|
||||
{
|
||||
STACK_OF(X509)* untrusted_certs = sk_X509_new_null();
|
||||
if ( ! untrusted_certs )
|
||||
{
|
||||
builtin_error(fmt("Untrusted certificate stack initialization error: %s", ERR_error_string(ERR_get_error(),NULL)));
|
||||
return 0;
|
||||
}
|
||||
|
||||
for ( int i = 1; i < (int) certs_vec->Size(); ++i ) // start at 1 - 0 is host cert
|
||||
{
|
||||
Val *sv = certs_vec->Lookup(i);
|
||||
|
||||
if ( ! sv )
|
||||
continue;
|
||||
|
||||
// Fixme: check type
|
||||
X509* x = ((file_analysis::X509Val*) sv)->GetCertificate();
|
||||
if ( ! x )
|
||||
{
|
||||
sk_X509_free(untrusted_certs);
|
||||
builtin_error(fmt("No certificate in opaque in stack"));
|
||||
return 0;
|
||||
}
|
||||
|
||||
sk_X509_push(untrusted_certs, x);
|
||||
}
|
||||
|
||||
return untrusted_certs;
|
||||
}
|
||||
|
||||
%%}
|
||||
|
||||
## Parses a certificate into an X509::Certificate structure.
|
||||
##
|
||||
## cert: The X509 certificicate opaque handle
|
||||
## cert: The X509 certificate opaque handle.
|
||||
##
|
||||
## Returns: A X509::Certificate structure
|
||||
## Returns: A X509::Certificate structure.
|
||||
##
|
||||
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
|
||||
## x509_ext_subject_alternative_name x509_verify
|
||||
|
|
@ -55,13 +125,13 @@ function x509_parse%(cert: opaque of x509%): X509::Certificate
|
|||
|
||||
## Returns the string form of a certificate.
|
||||
##
|
||||
## cert: The X509 certificate opaque handle
|
||||
## cert: The X509 certificate opaque handle.
|
||||
##
|
||||
## pem: A boolean that specifies if the certificate is returned
|
||||
## in pem-form (true), or as the raw ASN1 encoded binary
|
||||
## (false).
|
||||
##
|
||||
## Returns: X509 certificate as a string
|
||||
## Returns: X509 certificate as a string.
|
||||
##
|
||||
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
|
||||
## x509_ext_subject_alternative_name x509_parse x509_verify
|
||||
|
|
@ -86,6 +156,222 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
|
|||
return ext_val;
|
||||
%}
|
||||
|
||||
## Verifies an OCSP reply.
|
||||
##
|
||||
## certs: Specifies the certificate chain to use. Server certificate first.
|
||||
##
|
||||
## ocsp_reply: the ocsp reply to validate.
|
||||
##
|
||||
## root_certs: A list of root certificates to validate the certificate chain.
|
||||
##
|
||||
## verify_time: Time for the validity check of the certificates.
|
||||
##
|
||||
## Returns: A record of type X509::Result containing the result code of the
|
||||
## verify operation.
|
||||
##
|
||||
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
|
||||
## x509_ext_subject_alternative_name x509_parse
|
||||
## x509_get_certificate_string x509_verify
|
||||
function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_certs: table_string_of_string, verify_time: time &default=network_time()%): X509::Result
|
||||
%{
|
||||
RecordVal* rval = 0;
|
||||
X509_STORE* ctx = x509_get_root_store(root_certs->AsTableVal());
|
||||
if ( ! ctx )
|
||||
return x509_result_record(-1, "Problem initializing root store");
|
||||
|
||||
|
||||
VectorVal *certs_vec = certs->AsVectorVal();
|
||||
if ( certs_vec->Size() < 1 )
|
||||
{
|
||||
reporter->Error("No certificates given in vector");
|
||||
return x509_result_record(-1, "no certificates");
|
||||
}
|
||||
|
||||
// host certificate
|
||||
unsigned int index = 0; // to prevent overloading to 0pointer
|
||||
Val *sv = certs_vec->Lookup(index);
|
||||
if ( ! sv )
|
||||
{
|
||||
builtin_error("undefined value in certificate vector");
|
||||
return x509_result_record(-1, "undefined value in certificate vector");
|
||||
}
|
||||
|
||||
file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv;
|
||||
|
||||
X509* cert = cert_handle->GetCertificate();
|
||||
if ( ! cert )
|
||||
{
|
||||
builtin_error(fmt("No certificate in opaque"));
|
||||
return x509_result_record(-1, "No certificate in opaque");
|
||||
}
|
||||
|
||||
const unsigned char* start = ocsp_reply->Bytes();
|
||||
|
||||
STACK_OF(X509)* untrusted_certs = x509_get_untrusted_stack(certs_vec);
|
||||
if ( ! untrusted_certs )
|
||||
return x509_result_record(-1, "Problem initializing list of untrusted certificates");
|
||||
|
||||
// from here, always goto cleanup. Initialize all other required variables...
|
||||
time_t vtime = (time_t) verify_time;
|
||||
OCSP_BASICRESP *basic = 0;
|
||||
OCSP_SINGLERESP *single = 0;
|
||||
X509_STORE_CTX *csc = 0;
|
||||
OCSP_CERTID *certid = 0;
|
||||
int status = -1;
|
||||
int out = -1;
|
||||
int result = -1;
|
||||
X509* issuer_certificate = 0;
|
||||
OCSP_RESPONSE *resp = d2i_OCSP_RESPONSE(NULL, &start, ocsp_reply->Len());
|
||||
if ( ! resp )
|
||||
{
|
||||
rval = x509_result_record(-1, "Could not parse OCSP response");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
status = OCSP_response_status(resp);
|
||||
if ( status != OCSP_RESPONSE_STATUS_SUCCESSFUL )
|
||||
{
|
||||
rval = x509_result_record(-2, OCSP_response_status_str(status));
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
basic = OCSP_response_get1_basic(resp);
|
||||
if ( ! basic )
|
||||
{
|
||||
rval = x509_result_record(-1, "Could not parse OCSP response");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
|
||||
// the following code took me _forever_ to get right.
|
||||
// The OCSP_basic_verify command takes a list of certificates. However (which is not immediately
|
||||
// visible or understandable), those are only used to find the signer certificate. They are _not_
|
||||
// used for chain building during the actual verification (this would be stupid). But - if we sneakily
|
||||
// inject the certificates in the certificate list of the OCSP reply, they actually are used during
|
||||
// the lookup.
|
||||
// Yay.
|
||||
issuer_certificate = 0;
|
||||
for ( int i = 0; i < sk_X509_num(untrusted_certs); i++)
|
||||
{
|
||||
sk_X509_push(basic->certs, X509_dup(sk_X509_value(untrusted_certs, i)));
|
||||
|
||||
if ( X509_NAME_cmp(X509_get_issuer_name(cert), X509_get_subject_name(sk_X509_value(untrusted_certs, i))) )
|
||||
issuer_certificate = sk_X509_value(untrusted_certs, i);
|
||||
}
|
||||
|
||||
// Because we actually want to be able to give nice error messages that show why we were
|
||||
// not able to verify the OCSP response - do our own verification logic first.
|
||||
csc = X509_STORE_CTX_new();
|
||||
X509_STORE_CTX_init(csc, ctx, sk_X509_value(basic->certs, 0), basic->certs);
|
||||
X509_STORE_CTX_set_time(csc, 0, (time_t) verify_time);
|
||||
X509_STORE_CTX_set_purpose(csc, X509_PURPOSE_OCSP_HELPER);
|
||||
|
||||
result = X509_verify_cert(csc);
|
||||
if ( result != 1 )
|
||||
{
|
||||
const char *reason = X509_verify_cert_error_string((*csc).error);
|
||||
rval = x509_result_record(result, X509_verify_cert_error_string((*csc).error));
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
out = OCSP_basic_verify(basic, NULL, ctx, 0);
|
||||
if ( result < 1 )
|
||||
{
|
||||
rval = x509_result_record(out, ERR_error_string(ERR_get_error(),NULL));
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
|
||||
// ok, now we verified the OCSP response. This means that we have a valid chain tying it
|
||||
// to a root that we trust and that the signature also hopefully is valid. This does not yet
|
||||
// mean that the ocsp response actually matches the certificate the server send us or that
|
||||
// the OCSP response even says that the certificate is valid.
|
||||
|
||||
// let's start this out by checking that the response is actually for the certificate we want
|
||||
// to validate and not for something completely unrelated that the server is trying to trick us
|
||||
// into accepting.
|
||||
|
||||
if ( issuer_certificate )
|
||||
certid = OCSP_cert_to_id(NULL, cert, issuer_certificate);
|
||||
else
|
||||
{
|
||||
// issuer not in list sent by server, check store
|
||||
X509_OBJECT obj;
|
||||
int lookup = X509_STORE_get_by_subject(csc, X509_LU_X509, X509_get_subject_name(cert), &obj);
|
||||
if ( lookup <= 0)
|
||||
{
|
||||
rval = x509_result_record(lookup, "Could not find issuer of host certificate");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
certid = OCSP_cert_to_id(NULL, cert, obj.data.x509);
|
||||
}
|
||||
|
||||
|
||||
if ( ! certid )
|
||||
{
|
||||
rval = x509_result_record(-1, "Certificate ID construction failed");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
// for now, assume we have one reply...
|
||||
single = sk_OCSP_SINGLERESP_value(basic->tbsResponseData->responses, 0);
|
||||
if ( ! single )
|
||||
{
|
||||
rval = x509_result_record(-1, "Could not lookup OCSP response information");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
if ( ! OCSP_id_cmp(certid, single->certId) )
|
||||
return x509_result_record(-1, "OCSP reply is not for host certificate");
|
||||
|
||||
// next - check freshness of proof...
|
||||
if ( ! ASN1_GENERALIZEDTIME_check(single->thisUpdate) || ! ASN1_GENERALIZEDTIME_check(single->nextUpdate) )
|
||||
{
|
||||
rval = x509_result_record(-1, "OCSP reply contains invalid dates");
|
||||
goto x509_ocsp_cleanup;
|
||||
}
|
||||
|
||||
// now - nearly done. Check freshness and status code.
|
||||
// There is a function to check the freshness of the ocsp reply in the ocsp code of OpenSSL. But - it only
|
||||
// supports comparing it against the current time, not against arbitrary times. Hence it is kind of unusable
|
||||
// for us...
|
||||
// Well, we will do it manually.
|
||||
|
||||
|
||||
if ( X509_cmp_time(single->thisUpdate, &vtime) > 0 )
|
||||
rval = x509_result_record(-1, "OCSP reply specifies time in future");
|
||||
else if ( X509_cmp_time(single->nextUpdate, &vtime) < 0 )
|
||||
rval = x509_result_record(-1, "OCSP reply expired");
|
||||
else if ( single->certStatus->type != V_OCSP_CERTSTATUS_GOOD )
|
||||
rval = x509_result_record(-1, OCSP_cert_status_str(single->certStatus->type));
|
||||
|
||||
// if we have no error so far, we are done.
|
||||
if ( !rval )
|
||||
rval = x509_result_record(1, OCSP_cert_status_str(single->certStatus->type));
|
||||
|
||||
x509_ocsp_cleanup:
|
||||
|
||||
if ( untrusted_certs )
|
||||
sk_X509_free(untrusted_certs);
|
||||
|
||||
if ( resp )
|
||||
OCSP_RESPONSE_free(resp);
|
||||
|
||||
if ( basic )
|
||||
OCSP_BASICRESP_free(basic);
|
||||
|
||||
if ( csc )
|
||||
{
|
||||
X509_STORE_CTX_cleanup(csc);
|
||||
X509_STORE_CTX_free(csc);
|
||||
}
|
||||
|
||||
if ( certid )
|
||||
OCSP_CERTID_free(certid);
|
||||
|
||||
return rval;
|
||||
%}
|
||||
|
||||
## Verifies a certificate.
|
||||
##
|
||||
|
|
@ -93,26 +379,29 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
|
|||
## the given certificate against the root store given in *root_certs*.
|
||||
## The host certificate has to be at index 0.
|
||||
##
|
||||
## root_certs: A list of root certificates to validate the certificate chain
|
||||
## root_certs: A list of root certificates to validate the certificate chain.
|
||||
##
|
||||
## verify_time: Time for the validity check of the certificates.
|
||||
##
|
||||
## Returns: A record of type X509::Result containing the result code of the verify
|
||||
## operation. In case of success also returns the full certificate chain.
|
||||
## Returns: A record of type X509::Result containing the result code of the
|
||||
## verify operation. In case of success also returns the full
|
||||
## certificate chain.
|
||||
##
|
||||
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
|
||||
## x509_ext_subject_alternative_name x509_parse
|
||||
## x509_get_certificate_string
|
||||
## x509_get_certificate_string x509_ocsp_verify
|
||||
function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_string, verify_time: time &default=network_time()%): X509::Result
|
||||
%{
|
||||
X509_STORE* ctx = 0;
|
||||
int i = 0;
|
||||
X509_STORE* ctx = x509_get_root_store(root_certs->AsTableVal());
|
||||
if ( ! ctx )
|
||||
return x509_result_record(-1, "Problem initializing root store");
|
||||
|
||||
|
||||
VectorVal *certs_vec = certs->AsVectorVal();
|
||||
if ( certs_vec->Size() < 1 )
|
||||
if ( ! certs_vec || certs_vec->Size() < 1 )
|
||||
{
|
||||
reporter->Error("No certificates given in vector");
|
||||
return x509_error_record(-1, "no certificates");
|
||||
return x509_result_record(-1, "no certificates");
|
||||
}
|
||||
|
||||
// host certificate
|
||||
|
|
@ -121,71 +410,20 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
|
|||
if ( !sv )
|
||||
{
|
||||
builtin_error("undefined value in certificate vector");
|
||||
return x509_error_record(-1, "undefined value in certificate vector");
|
||||
return x509_result_record(-1, "undefined value in certificate vector");
|
||||
}
|
||||
|
||||
file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv;
|
||||
|
||||
// If this certificate store was built previously, just reuse the old one.
|
||||
if ( x509_stores.count(root_certs) > 0 )
|
||||
ctx = x509_stores[root_certs];
|
||||
|
||||
if ( ! ctx ) // lookup to see if we have this one built already!
|
||||
{
|
||||
ctx = X509_STORE_new();
|
||||
TableVal* root_certs2 = root_certs->AsTableVal();
|
||||
ListVal* idxs = root_certs2->ConvertToPureList();
|
||||
|
||||
// Build the validation store
|
||||
for ( i = 0; i < idxs->Length(); ++i )
|
||||
{
|
||||
Val* key = idxs->Index(i);
|
||||
StringVal *sv = root_certs2->Lookup(key)->AsStringVal();
|
||||
const uint8* data = sv->Bytes();
|
||||
X509* x = d2i_X509_(NULL, &data, sv->Len());
|
||||
if ( ! x )
|
||||
{
|
||||
builtin_error(fmt("Root CA error: %s", ERR_error_string(ERR_peek_last_error(),NULL)));
|
||||
return x509_error_record((uint64) ERR_get_error(), ERR_error_string(ERR_peek_last_error(),NULL));
|
||||
}
|
||||
|
||||
X509_STORE_add_cert(ctx, x);
|
||||
}
|
||||
|
||||
delete idxs;
|
||||
|
||||
// Save the newly constructed certificate store into the cacheing map.
|
||||
x509_stores[root_certs] = ctx;
|
||||
}
|
||||
|
||||
X509* cert = cert_handle->GetCertificate();
|
||||
if ( ! cert )
|
||||
{
|
||||
builtin_error(fmt("No certificate in opaque"));
|
||||
return x509_error_record(-1, "No certificate in opaque");
|
||||
return x509_result_record(-1, "No certificate in opaque");
|
||||
}
|
||||
|
||||
STACK_OF(X509)* untrusted_certs = sk_X509_new_null();
|
||||
STACK_OF(X509)* untrusted_certs = x509_get_untrusted_stack(certs_vec);
|
||||
if ( ! untrusted_certs )
|
||||
{
|
||||
builtin_error(fmt("Untrusted certificate stack initialization error: %s", ERR_error_string(ERR_peek_last_error(),NULL)));
|
||||
return x509_error_record((uint64) ERR_get_error(), ERR_error_string(ERR_peek_last_error(),NULL));
|
||||
}
|
||||
|
||||
for ( i = 1; i < (int) certs_vec->Size(); ++i ) // start at 1 - 0 is host cert
|
||||
{
|
||||
Val *sv = certs_vec->Lookup(i);
|
||||
// Fixme: check type
|
||||
X509* x = ((file_analysis::X509Val*) sv)->GetCertificate();
|
||||
if ( ! x )
|
||||
{
|
||||
sk_X509_free(untrusted_certs);
|
||||
builtin_error(fmt("No certificate in opaque in stack"));
|
||||
return x509_error_record(-1, "No certificate in opaque");
|
||||
}
|
||||
|
||||
sk_X509_push(untrusted_certs, x);
|
||||
}
|
||||
return x509_result_record(-1, "Problem initializing list of untrusted certificates");
|
||||
|
||||
X509_STORE_CTX csc;
|
||||
X509_STORE_CTX_init(&csc, ctx, cert, untrusted_certs);
|
||||
|
|
@ -220,11 +458,8 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
|
|||
else
|
||||
{
|
||||
reporter->InternalWarning("OpenSSL returned null certificate");
|
||||
|
||||
for ( int j = i + 1; i < num_certs; ++j )
|
||||
X509_free(sk_X509_value(chain, j));
|
||||
|
||||
break;
|
||||
sk_X509_pop_free(chain, X509_free);
|
||||
goto x509_verify_chainerror;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -237,13 +472,7 @@ x509_verify_chainerror:
|
|||
|
||||
sk_X509_free(untrusted_certs);
|
||||
|
||||
RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
|
||||
|
||||
rrecord->Assign(0, new Val((uint64) csc.error, TYPE_COUNT));
|
||||
rrecord->Assign(1, new StringVal(X509_verify_cert_error_string(csc.error)));
|
||||
|
||||
if ( chainVector )
|
||||
rrecord->Assign(2, chainVector);
|
||||
RecordVal* rrecord = x509_result_record(csc.error, X509_verify_cert_error_string(csc.error), chainVector);
|
||||
|
||||
return rrecord;
|
||||
%}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue