Kill X509_TRUST

After peeling off enough layers, the entire wacky abstraction turns out
to be nothing but dispatching from a trust_id to a trust handler and
passing the appropriate nid and the cert.

ok beck jsing

1 files changed, 31 insertions, 79 deletions

diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
index 3466268940..f0f99931eb 100644
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ b/src/lib/libcrypto/x509/x509_trs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_trs.c,v 1.52 2024/03/25 02:18:35 tb Exp $ */
+/* $OpenBSD: x509_trs.c,v 1.53 2024/03/25 03:57:13 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -68,12 +68,6 @@
 #include "x509_internal.h"
 #include "x509_local.h"
 
-typedef struct x509_trust_st {
-        int trust;
-        int (*check_trust)(int, const X509 *);
-        int nid;
-} X509_TRUST;
-
 static int
 obj_trust(int id, const X509 *x)
 {
@@ -130,62 +124,10 @@ trust_1oid(int nid, const X509 *x)
         return X509_TRUST_UNTRUSTED;
 }
 
-/* WARNING: the following table should be kept in order of trust
- * and without any gaps so we can just subtract the minimum trust
- * value to get an index into the table
- */
-
-static const X509_TRUST trstandard[] = {
-        {
-                .trust = X509_TRUST_COMPAT,
-                .check_trust = trust_compat,
-        },
-        {
-                .trust = X509_TRUST_SSL_CLIENT,
-                .check_trust = trust_1oidany,
-                .nid = NID_client_auth,
-        },
-        {
-                .trust = X509_TRUST_SSL_SERVER,
-                .check_trust = trust_1oidany,
-                .nid = NID_server_auth,
-        },
-        {
-                .trust = X509_TRUST_EMAIL,
-                .check_trust = trust_1oidany,
-                .nid = NID_email_protect,
-        },
-        {
-                .trust = X509_TRUST_OBJECT_SIGN,
-                .check_trust = trust_1oidany,
-                .nid = NID_code_sign,
-        },
-        {
-                .trust = X509_TRUST_OCSP_SIGN,
-                .check_trust = trust_1oid,
-                .nid = NID_OCSP_sign,
-        },
-        {
-                .trust = X509_TRUST_OCSP_REQUEST,
-                .check_trust = trust_1oid,
-                .nid = NID_ad_OCSP,
-        },
-        {
-                .trust = X509_TRUST_TSA,
-                .check_trust = trust_1oidany,
-                .nid = NID_time_stamp,
-        },
-};
-
-#define X509_TRUST_COUNT        (sizeof(trstandard) / sizeof(trstandard[0]))
-
-CTASSERT(X509_TRUST_MIN == 1 && X509_TRUST_MAX == X509_TRUST_COUNT);
-
 int
 X509_check_trust(X509 *x, int trust_id, int flags)
 {
-        const X509_TRUST *trust;
-        int idx;
+        int rv;
 
         if (trust_id == -1)
                 return 1;
@@ -194,29 +136,39 @@ X509_check_trust(X509 *x, int trust_id, int flags)
         if (!x509v3_cache_extensions(x))
                 return X509_TRUST_UNTRUSTED;
 
-        /*
-         * XXX beck/jsing This enables self signed certs to be trusted for
-         * an unspecified id/trust flag value (this is NOT the
-         * X509_TRUST_DEFAULT), which was the longstanding
-         * openssl behaviour. boringssl does not have this behaviour.
-         *
-         * This should be revisited, but changing the default "not default"
-         * may break things.
-         */
-        if (trust_id == 0) {
-                int rv;
+        switch (trust_id) {
+        case 0:
+                /*
+                 * XXX beck/jsing This enables self signed certs to be trusted
+                 * for an unspecified id/trust flag value (this is NOT the
+                 * X509_TRUST_DEFAULT), which was the longstanding openssl
+                 * behaviour. boringssl does not have this behaviour.
+                 *
+                 * This should be revisited, but changing the default
+                 * "not default" may break things.
+                 */
                 rv = obj_trust(NID_anyExtendedKeyUsage, x);
                 if (rv != X509_TRUST_UNTRUSTED)
                         return rv;
                 return trust_compat(NID_undef, x);
-        }
-
-        if (trust_id < X509_TRUST_MIN || trust_id > X509_TRUST_MAX)
+        case X509_TRUST_COMPAT:
+                return trust_compat(NID_undef, x);
+        case X509_TRUST_SSL_CLIENT:
+                return trust_1oidany(NID_client_auth, x);
+        case X509_TRUST_SSL_SERVER:
+                return trust_1oidany(NID_server_auth, x);
+        case X509_TRUST_EMAIL:
+                return trust_1oidany(NID_email_protect, x);
+        case X509_TRUST_OBJECT_SIGN:
+                return trust_1oidany(NID_code_sign, x);
+        case X509_TRUST_OCSP_SIGN:
+                return trust_1oid(NID_OCSP_sign, x);
+        case X509_TRUST_OCSP_REQUEST:
+                return trust_1oid(NID_ad_OCSP, x);
+        case X509_TRUST_TSA:
+                return trust_1oidany(NID_time_stamp, x);
+        default:
                 return obj_trust(trust_id, x);
-
-        idx = trust_id - X509_TRUST_MIN;
-        trust = &trstandard[idx];
-
-        return trust->check_trust(trust->nid, x);
+        }
 }
 LCRYPTO_ALIAS(X509_check_trust);