aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_lu.c

@@ -173,7 +173,6 @@ X509_STORE *X509_STORE_new(void) {
   if (ret->objs == NULL) {
     goto err;
   }
-  ret->cache = 1;
   ret->get_cert_methods = sk_X509_LOOKUP_new_null();
   if (ret->get_cert_methods == NULL) {
     goto err;
@@ -279,7 +278,7 @@ X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m) {
   }
 }
 
-int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
+int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
                               X509_OBJECT *ret) {
   X509_STORE *ctx = vs->ctx;
   X509_LOOKUP *lu;
@@ -359,6 +358,15 @@ int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x) {
   return x509_store_add(ctx, x, /*is_crl=*/1);
 }
 
+X509_OBJECT *X509_OBJECT_new(void) {
+  X509_OBJECT *ret = OPENSSL_malloc(sizeof(X509_OBJECT));
+  if (ret == NULL) {
+    return NULL;
+  }
+  OPENSSL_memset(ret, 0, sizeof(X509_OBJECT));
+  return ret;
+}
+
 int X509_OBJECT_up_ref_count(X509_OBJECT *a) {
   switch (a->type) {
     case X509_LU_X509:
@@ -382,6 +390,11 @@ void X509_OBJECT_free_contents(X509_OBJECT *a) {
   }
 }
 
+void X509_OBJECT_free(X509_OBJECT *a) {
+  X509_OBJECT_free_contents(a);
+  OPENSSL_free(a);
+}
+
 int X509_OBJECT_get_type(const X509_OBJECT *a) { return a->type; }
 
 X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a) {
@@ -478,7 +491,7 @@ STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm) {
     // cache
     X509_OBJECT xobj;
     CRYPTO_MUTEX_unlock_write(&ctx->ctx->objs_lock);
-    if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
+    if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
       sk_X509_free(sk);
       return NULL;
     }
@@ -516,7 +529,7 @@ STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm) {
   }
 
   // Always do lookup to possibly add new CRLs to cache.
-  if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
+  if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
     sk_X509_CRL_free(sk);
     return NULL;
   }
@@ -584,14 +597,17 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) {
   X509_OBJECT obj, *pobj;
   int idx, ret;
   size_t i;
+  *issuer = NULL;
   xn = X509_get_issuer_name(x);
-  if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj)) {
+  if (!X509_STORE_CTX_get_by_subject(ctx, X509_LU_X509, xn, &obj)) {
     return 0;
   }
   // If certificate matches all OK
   if (ctx->check_issued(ctx, x, obj.data.x509)) {
-    *issuer = obj.data.x509;
-    return 1;
+    if (x509_check_cert_time(ctx, obj.data.x509, /*suppress_error*/1)) {
+      *issuer = obj.data.x509;
+      return 1;
+    }
   }
   X509_OBJECT_free_contents(&obj);
 
@@ -613,13 +629,21 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) {
       }
       if (ctx->check_issued(ctx, x, pobj->data.x509)) {
         *issuer = pobj->data.x509;
-        X509_OBJECT_up_ref_count(pobj);
         ret = 1;
-        break;
+        // Break the loop with a match if the time check is valid, otherwise
+        // we continue searching. We leave the last tested issuer certificate in
+        // |issuer| on purpose. This returns the closest match if none of the
+        // candidate issuer certificates' timestamps were valid.
+        if (x509_check_cert_time(ctx, *issuer, /*suppress_error*/1)) {
+          break;
+        }
       }
     }
   }
   CRYPTO_MUTEX_unlock_write(&ctx->ctx->objs_lock);
+  if(*issuer) {
+    X509_up_ref(*issuer);
+  }
   return ret;
 }
 

data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_test.cc

@@ -4523,6 +4523,87 @@ TEST(X509Test, Expiry) {
   }
 }
 
+// Test that we don't break the search if an expired candidate cert exists.
+TEST(X509Test, ExpiredCandidate) {
+  // Generate the following certificates:
+  //
+  //         Root (in store)
+  //          |          |
+  // Intermediate 1   Intermediate 2 (expired)
+  //           \         /
+  //               Leaf
+  bssl::UniquePtr<EVP_PKEY> key = PrivateKeyFromPEM(kP256Key);
+  ASSERT_TRUE(key);
+
+  bssl::UniquePtr<X509> root =
+      MakeTestCert("Root", "Root", key.get(), /*is_ca=*/true);
+  ASSERT_TRUE(root);
+  ASSERT_TRUE(X509_sign(root.get(), key.get(), EVP_sha256()));
+
+  bssl::UniquePtr<X509> intermediate1 =
+      MakeTestCert("Root", "Intermediate", key.get(), /*is_ca=*/true);
+  ASSERT_TRUE(intermediate1);
+  ASSERT_TRUE(X509_sign(intermediate1.get(), key.get(), EVP_sha256()));
+
+  bssl::UniquePtr<X509> intermediate2 =
+      MakeTestCert("Root", "Intermediate", key.get(), /*is_ca=*/true);
+  ASSERT_TRUE(intermediate2);
+  ASSERT_TRUE(ASN1_TIME_adj(X509_getm_notAfter(intermediate2.get()),
+                            kReferenceTime,
+                            /*offset_day=*/0,
+                            /*offset_sec=*/-1));
+  ASSERT_TRUE(X509_sign(intermediate2.get(), key.get(), EVP_sha256()));
+
+  bssl::UniquePtr<X509> leaf =
+      MakeTestCert("Intermediate", "Leaf", key.get(), /*is_ca=*/false);
+  ASSERT_TRUE(leaf);
+  ASSERT_TRUE(X509_sign(leaf.get(), key.get(), EVP_sha256()));
+
+  // As a control, confirm that |leaf| -> |intermediate1| -> |root1| is valid,
+  // but the path through |intermediate2| is expired.
+  EXPECT_EQ(X509_V_OK,
+            Verify(leaf.get(), {root.get()}, {intermediate1.get()}, {}));
+  EXPECT_EQ(X509_V_ERR_CERT_HAS_EXPIRED,
+            Verify(leaf.get(), {root.get()}, {intermediate2.get()}, {}));
+
+
+  // We should skip over expired candidate certificates and continue looking.
+  // The test with the expired cert coming first in the stack would fail without
+  // support for this.
+  EXPECT_EQ(X509_V_OK, Verify(leaf.get(), {root.get()},
+                              {intermediate1.get(), intermediate2.get()}, {}));
+  EXPECT_EQ(X509_V_OK, Verify(leaf.get(), {root.get()},
+                              {intermediate2.get(), intermediate1.get()}, {}));
+
+
+
+  // Test that |X509_STORE_CTX_get1_issuer| prioritizes non-expired certs.
+  // With this set up, |intermediate2| would have been returned if expired certs
+  // weren't filtered.
+  bssl::UniquePtr<STACK_OF(X509)> intermediates_stack(
+      CertsToStack({intermediate1.get(), intermediate2.get()}));
+  bssl::UniquePtr<X509_STORE_CTX> ctx(X509_STORE_CTX_new());
+  bssl::UniquePtr<X509_STORE> store(X509_STORE_new());
+
+  // TODO: Remove this ifdef when we pull in google/boringssl@1340a5b.
+#if defined(OPENSSL_WINDOWS)
+  ASSERT_TRUE(X509_STORE_add_cert(store.get(), intermediate1.get()));
+  ASSERT_TRUE(X509_STORE_add_cert(store.get(), intermediate2.get()));
+#else
+  ASSERT_TRUE(X509_STORE_add_cert(store.get(), intermediate2.get()));
+  ASSERT_TRUE(X509_STORE_add_cert(store.get(), intermediate1.get()));
+#endif
+  ASSERT_TRUE(X509_STORE_CTX_init(ctx.get(), store.get(), leaf.get(),
+                           intermediates_stack.get()));
+
+  X509 *issuer;
+  EXPECT_TRUE(X509_STORE_CTX_get1_issuer(&issuer, ctx.get(), leaf.get()));
+  EXPECT_TRUE(issuer);
+  // Check that we return the non-expired |intermediate1|.
+  EXPECT_EQ(X509_cmp(issuer, intermediate1.get()), 0);
+  bssl::UniquePtr<X509> free(issuer);
+}
+
 // kConstructedBitString is an X.509 certificate where the signature is encoded
 // as a BER constructed BIT STRING. Note that, while OpenSSL's parser accepts
 // this input, it interprets the value incorrectly.
@@ -6629,3 +6710,9 @@ TEST(X509Test, TestDecode) {
   ASSERT_TRUE(pkey2);
   ASSERT_TRUE(X509_verify(cert.get(), pkey2.get()));
 }
+
+TEST(X509Test, X509_OBJECT_heap) {
+  X509_OBJECT *x509_object = X509_OBJECT_new();
+  ASSERT_TRUE(x509_object);
+  X509_OBJECT_free(x509_object);
+}

data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_trs.c

@@ -168,7 +168,7 @@ int X509_TRUST_set(int *t, int trust) {
 }
 
 int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
-                   char *name, int arg1, void *arg2) {
+                   const char *name, int arg1, void *arg2) {
   int idx;
   X509_TRUST *trtmp;
   char *name_dup;

data/aws-crt-ffi/crt/aws-lc/crypto/x509/x509_vfy.c

@@ -416,7 +416,11 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
       }
       ctx->current_cert = x;
     } else {
-      sk_X509_push(ctx->chain, chain_ss);
+      if (!sk_X509_push(ctx->chain, chain_ss)) {
+        ctx->error = X509_V_ERR_OUT_OF_MEM;
+        ok = 0;
+        goto end;
+      }
       num++;
       ctx->last_untrusted = num;
       ctx->current_cert = chain_ss;
@@ -491,17 +495,23 @@ end:
 }
 
 // Given a STACK_OF(X509) find the issuer of cert (if any)
-
+//
+// |find_issuer| will directly return the pointer of the corresponding index
+// within |sk|. Callers of |find_issuer| should remember to bump the reference
+// count of the returned |X509| if the call is successful.
 static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) {
   size_t i;
-  X509 *issuer;
+  X509 *issuer, *candidate = NULL;
   for (i = 0; i < sk_X509_num(sk); i++) {
     issuer = sk_X509_value(sk, i);
     if (ctx->check_issued(ctx, x, issuer)) {
-      return issuer;
+      candidate = issuer;
+      if (x509_check_cert_time(ctx, candidate, /*suppress_error*/1)) {
+        break;
+      }
     }
   }
-  return NULL;
+  return candidate;
 }
 
 // Given a possible certificate and issuer check them
@@ -1641,7 +1651,7 @@ static int check_policy(X509_STORE_CTX *ctx) {
   return 1;
 }
 
-static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) {
+int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x509, int suppress_error) {
   if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) {
     return 1;
   }
@@ -1653,35 +1663,47 @@ static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) {
     ptime = time(NULL);
   }
 
-  int i = X509_cmp_time_posix(X509_get_notBefore(x), ptime);
+  int i = X509_cmp_time_posix(X509_get_notBefore(x509), ptime);
   if (i == 0) {
+    if (suppress_error != 0) {
+      return 0;
+    }
     ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
-    ctx->current_cert = x;
+    ctx->current_cert = x509;
     if (!ctx->verify_cb(0, ctx)) {
       return 0;
     }
   }
 
   if (i > 0) {
+    if (suppress_error != 0) {
+      return 0;
+    }
     ctx->error = X509_V_ERR_CERT_NOT_YET_VALID;
-    ctx->current_cert = x;
+    ctx->current_cert = x509;
     if (!ctx->verify_cb(0, ctx)) {
       return 0;
     }
   }
 
-  i = X509_cmp_time_posix(X509_get_notAfter(x), ptime);
+  i = X509_cmp_time_posix(X509_get_notAfter(x509), ptime);
   if (i == 0) {
+    if (suppress_error != 0) {
+      return 0;
+    }
     ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
-    ctx->current_cert = x;
+    ctx->current_cert = x509;
     if (!ctx->verify_cb(0, ctx)) {
       return 0;
     }
   }
 
   if (i < 0) {
+    if (suppress_error != 0) {
+      return 0;
+    }
     ctx->error = X509_V_ERR_CERT_HAS_EXPIRED;
-    ctx->current_cert = x;
+    ctx->current_cert = x509;
     if (!ctx->verify_cb(0, ctx)) {
       return 0;
     }
@@ -1748,7 +1770,7 @@ static int internal_verify(X509_STORE_CTX *ctx) {
     }
 
   check_cert:
-    ok = check_cert_time(ctx, xs);
+    ok = x509_check_cert_time(ctx, xs, /*suppress_error*/0);
     if (!ok) {
       goto end;
     }

data/aws-crt-ffi/crt/aws-lc/crypto/x509v3/v3_lib.c

@@ -141,6 +141,7 @@ int X509V3_EXT_free(int nid, void *ext_data) {
 }
 
 int X509V3_EXT_add_alias(int nid_to, int nid_from) {
+OPENSSL_BEGIN_ALLOW_DEPRECATED
   const X509V3_EXT_METHOD *ext;
   X509V3_EXT_METHOD *tmpext;
 
@@ -159,6 +160,7 @@ int X509V3_EXT_add_alias(int nid_to, int nid_from) {
     return 0;
   }
   return 1;
+OPENSSL_END_ALLOW_DEPRECATED
 }
 
 // Legacy function: we don't need to add standard extensions any more because

data/aws-crt-ffi/crt/aws-lc/crypto/x509v3/v3_purp.c

@@ -177,10 +177,9 @@ X509_PURPOSE *X509_PURPOSE_get0(int idx) {
   return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
 }
 
-int X509_PURPOSE_get_by_sname(char *sname) {
-  int i;
+int X509_PURPOSE_get_by_sname(const char *sname) {
   X509_PURPOSE *xptmp;
-  for (i = 0; i < X509_PURPOSE_get_count(); i++) {
+  for (int i = 0; i < X509_PURPOSE_get_count(); i++) {
     xptmp = X509_PURPOSE_get0(i);
     if (!strcmp(xptmp->sname, sname)) {
       return i;
@@ -209,8 +208,7 @@ int X509_PURPOSE_get_by_id(int purpose) {
 
 int X509_PURPOSE_add(int id, int trust, int flags,
                      int (*ck)(const X509_PURPOSE *, const X509 *, int),
-                     char *name, char *sname, void *arg) {
-  int idx;
+                     const char *name, const char *sname, void *arg) {
   X509_PURPOSE *ptmp;
   char *name_dup, *sname_dup;
 
@@ -219,7 +217,7 @@ int X509_PURPOSE_add(int id, int trust, int flags,
   // This will always be set for application modified trust entries
   flags |= X509_PURPOSE_DYNAMIC_NAME;
   // Get existing entry if any
-  idx = X509_PURPOSE_get_by_id(id);
+  int idx = X509_PURPOSE_get_by_id(id);
   // Need a new entry
   if (idx == -1) {
     if (!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {