Add more CT utility routines to be used as part of larger patch.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>

1 files changed, 137 insertions, 1 deletions

diff --git a/crypto/include/internal/ct_int.h b/crypto/include/internal/ct_int.h
index 1aa3745c9d..b564dce9d9 100644
--- a/crypto/include/internal/ct_int.h
+++ b/crypto/include/internal/ct_int.h
@@ -60,6 +60,8 @@ extern "C" {
 
 # ifndef OPENSSL_NO_CT
 
+# include <openssl/x509v3.h>
+
 /* All hashes are currently SHA256 */
 #  define SCT_V1_HASHLEN  32
 /* Minimum RSA key size, from RFC6962 */
@@ -105,6 +107,7 @@ typedef struct {
     uint64_t timestamp;
     unsigned char *ext;
     size_t ext_len;
+    /* TODO(robpercival): Extract the following 4 fields into a struct */
     unsigned char hash_alg;
     unsigned char sig_alg;
     unsigned char *sig;
@@ -115,6 +118,8 @@ typedef struct {
 
 DEFINE_STACK_OF(SCT)
 
+extern const X509V3_EXT_METHOD v3_ct_scts[];
+
 /*
  * Allocate new SCT.
  * Caller is responsible for calling SCT_free when done.
@@ -139,13 +144,20 @@ int SCT_set_version(SCT *sct, sct_version_t version);
 int SCT_set_log_entry_type(SCT *sct, log_entry_type_t entry_type);
 
 /*
- * Set the log id of an SCT to point directly to the *log_id specified.
+ * Set the log ID of an SCT to point directly to the *log_id specified.
  * The SCT takes ownership of the specified pointer.
  * Returns 1 on success.
  */
 int SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len);
 
 /*
+ * Set the log ID of an SCT.
+ * This makes a copy of the log_id.
+ * Returns 1 on success.
+ */
+int SCT_set1_log_id(SCT *sct, const unsigned char *log_id, size_t log_id_len);
+
+/*
  * Set the timestamp of an SCT.
  */
 void SCT_set_timestamp(SCT *sct, uint64_t timestamp);
@@ -164,12 +176,25 @@ int SCT_set_signature_nid(SCT *sct, int nid);
 void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len);
 
 /*
+ * Set the extensions of an SCT.
+ * This takes a copy of the ext.
+ * Returns 1 on success.
+ */
+int SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len);
+
+/*
  * Set the signature of an SCT to point directly to the *sig specified.
  * The SCT takes ownership of the specified pointer.
  */
 void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len);
 
 /*
+ * Set the signature of an SCT to be a copy of the *sig specified.
+ * Returns 1 on success.
+ */
+int SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len);
+
+/*
  * Returns the version of the SCT.
  */
 sct_version_t SCT_get_version(const SCT *sct);
@@ -212,6 +237,101 @@ size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext);
  */
 size_t SCT_get0_signature(const SCT *sct, unsigned char **sig);
 
+/*
+ * Pretty-print debug information about a SCT, indented as specified.
+ */
+void SCT_print(SCT *sct, BIO *out, int indent);
+
+/*
+ * Does this SCT have the minimum fields populated to be valid?
+ * Returns 1 if so, 0 otherwise.
+ * This does not verify the SCT signature.
+ */
+int SCT_is_valid(const SCT *sct);
+
+/*
+ * Is the signature of this SCT valid?
+ * Returns 1 if so, 0 otherwise.
+ * This checks that the signature and hash algorithms are supported and that the
+ * signature field is set.
+ */
+int SCT_signature_is_valid(const SCT *sct);
+
+/*
+ * Free a stack of SCTs, and the underlying SCTs themselves.
+ * Intended to be compatible with X509V3_EXT_FREE.
+ */
+void SCT_LIST_free(STACK_OF(SCT) *a);
+
+/*
+ * Serialize (to TLS format) a stack of SCTs and return the length.
+ * "a" must not be NULL.
+ * If "pp" is NULL, just return the length of what would have been serialized.
+ * If "pp" is not NULL and "*pp" is null, function will allocate a new pointer
+ * for data that caller is responsible for freeing (only if function returns
+ * successfully).
+ * If "pp" is NULL and "*pp" is not NULL, caller is responsible for ensuring
+ * that "*pp" is large enough to accept all of the serializied data.
+ * Returns < 0 on error, >= 0 indicating bytes written (or would have been)
+ * on success.
+ */
+int i2o_SCT_LIST(STACK_OF(SCT) *a, unsigned char **pp);
+
+/*
+* Parses an SCT signature in TLS format and populates the |sct| with it.
+* |in| should be a pointer to a string contianing the TLS-format signature.
+* |in| will be advanced to the end of the signature if parsing succeeds.
+* |len| should be the length of the signature in |in|.
+* Returns the number of bytes parsed, or a negative integer if an error occurs.
+*/
+int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len);
+
+/*
+ * Parses an SCT in TLS format and returns it.
+ * If |psct| is not null, it will end up pointing to the parsed SCT. If it
+ * already points to a non-null pointer, the pointer will be free'd.
+ * |in| should be a pointer to a string contianing the TLS-format SCT.
+ * |in| will be advanced to the end of the SCT if parsing succeeds.
+ * |len| should be the length of the SCT in |in|.
+ * Returns NULL if an error occurs.
+ * If the SCT is an unsupported version, only the SCT's 'sct' and 'sct_len'
+ * fields will be populated (with |in| and |len| respectively).
+ */
+SCT *o2i_SCT(SCT **psct, const unsigned char **in, size_t len);
+
+/*
+* Converts an |sct| signature into TLS format and writes it to |out|.
+* If |out| is null, no signature will be output but the length will be returned.
+* If |out| points to a null pointer, a string will be allocated to hold the
+* TLS-format signature. It is the responsibility of the caller to free it.
+* If |out| points to an allocated string, the signature will be written to it.
+* The length of the signature in TLS format will be returned.
+*/
+int i2o_SCT_signature(const SCT *sct, unsigned char **out);
+
+/*
+ * Converts an |sct| into TLS format and writes it to |out|.
+ * If |out| is null, no SCT will be output but the length will still be returned.
+ * If |out| points to a null pointer, a string will be allocated to hold the
+ * TLS-format SCT. It is the responsibility of the caller to free it.
+ * If |out| points to an allocated string, the TLS-format SCT will be written
+ * to it.
+ * The length of the SCT in TLS format will be returned.
+ */
+int i2o_SCT(const SCT *sct, unsigned char **out);
+
+/*
+ * Convert TLS format SCT list to a stack of SCTs.
+ * If "a" or "*a" is NULL, a new stack will be created that the caller is
+ * responsible for freeing (by calling SCT_LIST_free).
+ * "**pp" and "*pp" must not be NULL.
+ * Upon success, "*pp" will point to after the last bytes read, and a stack
+ * will be returned.
+ * Upon failure, a NULL pointer will be returned, and the position of "*p" is
+ * not defined.
+ */
+STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp,
+                            size_t len);
 
 # endif
 
@@ -225,14 +345,30 @@ void ERR_load_CT_strings(void);
 /* Error codes for the CT functions. */
 
 /* Function codes. */
+# define CT_F_D2I_SCT_LIST                                105
+# define CT_F_I2D_SCT_LIST                                106
+# define CT_F_I2O_SCT                                     107
+# define CT_F_I2O_SCT_LIST                                108
+# define CT_F_I2O_SCT_SIGNATURE                           109
+# define CT_F_O2I_SCT                                     110
+# define CT_F_O2I_SCT_LIST                                111
+# define CT_F_O2I_SCT_SIGNATURE                           112
 # define CT_F_SCT_NEW                                     100
 # define CT_F_SCT_SET0_LOG_ID                             101
+# define CT_F_SCT_SET1_EXTENSIONS                         114
+# define CT_F_SCT_SET1_LOG_ID                             115
+# define CT_F_SCT_SET1_SIGNATURE                          116
 # define CT_F_SCT_SET_LOG_ENTRY_TYPE                      102
 # define CT_F_SCT_SET_SIGNATURE_NID                       103
 # define CT_F_SCT_SET_VERSION                             104
+# define CT_F_SCT_SIGNATURE_IS_VALID                      113
 
 /* Reason codes. */
 # define CT_R_INVALID_LOG_ID_LENGTH                       100
+# define CT_R_SCT_INVALID                                 104
+# define CT_R_SCT_INVALID_SIGNATURE                       107
+# define CT_R_SCT_LIST_INVALID                            105
+# define CT_R_SCT_NOT_SET                                 106
 # define CT_R_UNRECOGNIZED_SIGNATURE_NID                  101
 # define CT_R_UNSUPPORTED_ENTRY_TYPE                      102
 # define CT_R_UNSUPPORTED_VERSION                         103