summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509
diff options
context:
space:
mode:
authorcvs2svn <admin@example.com>2016-07-23 19:31:36 +0000
committercvs2svn <admin@example.com>2016-07-23 19:31:36 +0000
commit86c49b31af735796dfde37aa29473a30d36367db (patch)
treee9a354a92a348338fe2b361e2eda703cae23cfab /src/lib/libcrypto/x509
parent19d5fe348e8926bac4521c5807aa64c45b8f7a41 (diff)
downloadopenbsd-OPENBSD_6_0_BASE.tar.gz
openbsd-OPENBSD_6_0_BASE.tar.bz2
openbsd-OPENBSD_6_0_BASE.zip
This commit was manufactured by cvs2git to create tag 'OPENBSD_6_0_BASE'.OPENBSD_6_0_BASE
Diffstat (limited to '')
-rw-r--r--src/lib/libcrypto/x509/by_dir.c422
-rw-r--r--src/lib/libcrypto/x509/by_file.c274
-rw-r--r--src/lib/libcrypto/x509/by_mem.c138
-rw-r--r--src/lib/libcrypto/x509/x509.h1270
-rw-r--r--src/lib/libcrypto/x509/x509_att.c403
-rw-r--r--src/lib/libcrypto/x509/x509_cmp.c369
-rw-r--r--src/lib/libcrypto/x509/x509_d2.c128
-rw-r--r--src/lib/libcrypto/x509/x509_def.c98
-rw-r--r--src/lib/libcrypto/x509/x509_err.c164
-rw-r--r--src/lib/libcrypto/x509/x509_ext.c232
-rw-r--r--src/lib/libcrypto/x509/x509_lcl.h61
-rw-r--r--src/lib/libcrypto/x509/x509_lu.c739
-rw-r--r--src/lib/libcrypto/x509/x509_obj.c179
-rw-r--r--src/lib/libcrypto/x509/x509_r2x.c115
-rw-r--r--src/lib/libcrypto/x509/x509_req.c347
-rw-r--r--src/lib/libcrypto/x509/x509_set.c154
-rw-r--r--src/lib/libcrypto/x509/x509_trs.c332
-rw-r--r--src/lib/libcrypto/x509/x509_txt.c189
-rw-r--r--src/lib/libcrypto/x509/x509_v3.c300
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.c2157
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.h560
-rw-r--r--src/lib/libcrypto/x509/x509_vpm.c449
-rw-r--r--src/lib/libcrypto/x509/x509cset.c173
-rw-r--r--src/lib/libcrypto/x509/x509name.c410
-rw-r--r--src/lib/libcrypto/x509/x509rset.c88
-rw-r--r--src/lib/libcrypto/x509/x509spki.c132
-rw-r--r--src/lib/libcrypto/x509/x509type.c130
-rw-r--r--src/lib/libcrypto/x509/x_all.c602
-rw-r--r--src/lib/libcrypto/x509v3/ext_dat.h129
-rw-r--r--src/lib/libcrypto/x509v3/pcy_cache.c271
-rw-r--r--src/lib/libcrypto/x509v3/pcy_data.c129
-rw-r--r--src/lib/libcrypto/x509v3/pcy_int.h206
-rw-r--r--src/lib/libcrypto/x509v3/pcy_lib.c157
-rw-r--r--src/lib/libcrypto/x509v3/pcy_map.c126
-rw-r--r--src/lib/libcrypto/x509v3/pcy_node.c199
-rw-r--r--src/lib/libcrypto/x509v3/pcy_tree.c768
-rw-r--r--src/lib/libcrypto/x509v3/v3_akey.c215
-rw-r--r--src/lib/libcrypto/x509v3/v3_akeya.c124
-rw-r--r--src/lib/libcrypto/x509v3/v3_alt.c671
-rw-r--r--src/lib/libcrypto/x509v3/v3_bcons.c185
-rw-r--r--src/lib/libcrypto/x509v3/v3_bitst.c175
-rw-r--r--src/lib/libcrypto/x509v3/v3_conf.c576
-rw-r--r--src/lib/libcrypto/x509v3/v3_cpols.c775
-rw-r--r--src/lib/libcrypto/x509v3/v3_crld.c816
-rw-r--r--src/lib/libcrypto/x509v3/v3_enum.c107
-rw-r--r--src/lib/libcrypto/x509v3/v3_extku.c205
-rw-r--r--src/lib/libcrypto/x509v3/v3_genn.c474
-rw-r--r--src/lib/libcrypto/x509v3/v3_ia5.c239
-rw-r--r--src/lib/libcrypto/x509v3/v3_info.c307
-rw-r--r--src/lib/libcrypto/x509v3/v3_int.c110
-rw-r--r--src/lib/libcrypto/x509v3/v3_lib.c345
-rw-r--r--src/lib/libcrypto/x509v3/v3_ncons.c560
-rw-r--r--src/lib/libcrypto/x509v3/v3_ocsp.c380
-rw-r--r--src/lib/libcrypto/x509v3/v3_pci.c332
-rw-r--r--src/lib/libcrypto/x509v3/v3_pcia.c145
-rw-r--r--src/lib/libcrypto/x509v3/v3_pcons.c183
-rw-r--r--src/lib/libcrypto/x509v3/v3_pku.c166
-rw-r--r--src/lib/libcrypto/x509v3/v3_pmaps.c218
-rw-r--r--src/lib/libcrypto/x509v3/v3_prn.c225
-rw-r--r--src/lib/libcrypto/x509v3/v3_purp.c861
-rw-r--r--src/lib/libcrypto/x509v3/v3_skey.c160
-rw-r--r--src/lib/libcrypto/x509v3/v3_sxnet.c386
-rw-r--r--src/lib/libcrypto/x509v3/v3_utl.c925
-rw-r--r--src/lib/libcrypto/x509v3/v3err.c226
-rw-r--r--src/lib/libcrypto/x509v3/x509v3.h862
65 files changed, 0 insertions, 23553 deletions
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
deleted file mode 100644
index 7b7d14a950..0000000000
--- a/src/lib/libcrypto/x509/by_dir.c
+++ /dev/null
@@ -1,422 +0,0 @@
1/* $OpenBSD: by_dir.c,v 1.37 2015/04/11 16:03:21 deraadt Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <sys/types.h>
60
61#include <errno.h>
62#include <stdio.h>
63#include <string.h>
64#include <time.h>
65#include <unistd.h>
66
67#include <openssl/opensslconf.h>
68
69#include <openssl/err.h>
70#include <openssl/lhash.h>
71#include <openssl/x509.h>
72
73# include <sys/stat.h>
74
75typedef struct lookup_dir_hashes_st {
76 unsigned long hash;
77 int suffix;
78} BY_DIR_HASH;
79
80typedef struct lookup_dir_entry_st {
81 char *dir;
82 int dir_type;
83 STACK_OF(BY_DIR_HASH) *hashes;
84} BY_DIR_ENTRY;
85
86typedef struct lookup_dir_st {
87 BUF_MEM *buffer;
88 STACK_OF(BY_DIR_ENTRY) *dirs;
89} BY_DIR;
90
91DECLARE_STACK_OF(BY_DIR_HASH)
92DECLARE_STACK_OF(BY_DIR_ENTRY)
93
94static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
95 char **ret);
96static int new_dir(X509_LOOKUP *lu);
97static void free_dir(X509_LOOKUP *lu);
98static int add_cert_dir(BY_DIR *ctx, const char *dir, int type);
99static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
100 X509_OBJECT *ret);
101
102static X509_LOOKUP_METHOD x509_dir_lookup = {
103 .name = "Load certs from files in a directory",
104 .new_item = new_dir,
105 .free = free_dir,
106 .init = NULL,
107 .shutdown = NULL,
108 .ctrl = dir_ctrl,
109 .get_by_subject = get_cert_by_subject,
110 .get_by_issuer_serial = NULL,
111 .get_by_fingerprint = NULL,
112 .get_by_alias = NULL,
113};
114
115X509_LOOKUP_METHOD *
116X509_LOOKUP_hash_dir(void)
117{
118 return (&x509_dir_lookup);
119}
120
121static int
122dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
123 char **retp)
124{
125 int ret = 0;
126 BY_DIR *ld;
127
128 ld = (BY_DIR *)ctx->method_data;
129
130 switch (cmd) {
131 case X509_L_ADD_DIR:
132 if (argl == X509_FILETYPE_DEFAULT) {
133 ret = add_cert_dir(ld, X509_get_default_cert_dir(),
134 X509_FILETYPE_PEM);
135 if (!ret) {
136 X509err(X509_F_DIR_CTRL, X509_R_LOADING_CERT_DIR);
137 }
138 } else
139 ret = add_cert_dir(ld, argp, (int)argl);
140 break;
141 }
142 return (ret);
143}
144
145static int
146new_dir(X509_LOOKUP *lu)
147{
148 BY_DIR *a;
149
150 if ((a = malloc(sizeof(BY_DIR))) == NULL)
151 return (0);
152 if ((a->buffer = BUF_MEM_new()) == NULL) {
153 free(a);
154 return (0);
155 }
156 a->dirs = NULL;
157 lu->method_data = (char *)a;
158 return (1);
159}
160
161static void
162by_dir_hash_free(BY_DIR_HASH *hash)
163{
164 free(hash);
165}
166
167static int
168by_dir_hash_cmp(const BY_DIR_HASH * const *a,
169 const BY_DIR_HASH * const *b)
170{
171 if ((*a)->hash > (*b)->hash)
172 return 1;
173 if ((*a)->hash < (*b)->hash)
174 return -1;
175 return 0;
176}
177
178static void
179by_dir_entry_free(BY_DIR_ENTRY *ent)
180{
181 free(ent->dir);
182 if (ent->hashes)
183 sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
184 free(ent);
185}
186
187static void
188free_dir(X509_LOOKUP *lu)
189{
190 BY_DIR *a;
191
192 a = (BY_DIR *)lu->method_data;
193 if (a->dirs != NULL)
194 sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
195 if (a->buffer != NULL)
196 BUF_MEM_free(a->buffer);
197 free(a);
198}
199
200static int
201add_cert_dir(BY_DIR *ctx, const char *dir, int type)
202{
203 int j;
204 const char *s, *ss, *p;
205 ptrdiff_t len;
206
207 if (dir == NULL || !*dir) {
208 X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY);
209 return 0;
210 }
211
212 s = dir;
213 p = s;
214 do {
215 if ((*p == ':') || (*p == '\0')) {
216 BY_DIR_ENTRY *ent;
217 ss = s;
218 s = p + 1;
219 len = p - ss;
220 if (len == 0)
221 continue;
222 for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
223 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
224 if (strlen(ent->dir) == (size_t)len &&
225 strncmp(ent->dir, ss, (size_t)len) == 0)
226 break;
227 }
228 if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
229 continue;
230 if (ctx->dirs == NULL) {
231 ctx->dirs = sk_BY_DIR_ENTRY_new_null();
232 if (!ctx->dirs) {
233 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
234 return 0;
235 }
236 }
237 ent = malloc(sizeof(BY_DIR_ENTRY));
238 if (!ent) {
239 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
240 return 0;
241 }
242 ent->dir_type = type;
243 ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
244 ent->dir = strndup(ss, (size_t)len);
245 if (!ent->dir || !ent->hashes) {
246 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
247 by_dir_entry_free(ent);
248 return 0;
249 }
250 if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
251 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
252 by_dir_entry_free(ent);
253 return 0;
254 }
255 }
256 } while (*p++ != '\0');
257 return 1;
258}
259
260static int
261get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
262 X509_OBJECT *ret)
263{
264 BY_DIR *ctx;
265 union {
266 struct {
267 X509 st_x509;
268 X509_CINF st_x509_cinf;
269 } x509;
270 struct {
271 X509_CRL st_crl;
272 X509_CRL_INFO st_crl_info;
273 } crl;
274 } data;
275 int ok = 0;
276 int i, j, k;
277 unsigned long h;
278 BUF_MEM *b = NULL;
279 X509_OBJECT stmp, *tmp;
280 const char *postfix="";
281
282 if (name == NULL)
283 return (0);
284
285 stmp.type = type;
286 if (type == X509_LU_X509) {
287 data.x509.st_x509.cert_info = &data.x509.st_x509_cinf;
288 data.x509.st_x509_cinf.subject = name;
289 stmp.data.x509 = &data.x509.st_x509;
290 postfix="";
291 } else if (type == X509_LU_CRL) {
292 data.crl.st_crl.crl = &data.crl.st_crl_info;
293 data.crl.st_crl_info.issuer = name;
294 stmp.data.crl = &data.crl.st_crl;
295 postfix="r";
296 } else {
297 X509err(X509_F_GET_CERT_BY_SUBJECT, X509_R_WRONG_LOOKUP_TYPE);
298 goto finish;
299 }
300
301 if ((b = BUF_MEM_new()) == NULL) {
302 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_BUF_LIB);
303 goto finish;
304 }
305
306 ctx = (BY_DIR *)xl->method_data;
307
308 h = X509_NAME_hash(name);
309 for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
310 BY_DIR_ENTRY *ent;
311 int idx;
312 BY_DIR_HASH htmp, *hent;
313 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
314 j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
315 if (!BUF_MEM_grow(b, j)) {
316 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
317 goto finish;
318 }
319 if (type == X509_LU_CRL && ent->hashes) {
320 htmp.hash = h;
321 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
322 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
323 if (idx >= 0) {
324 hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
325 k = hent->suffix;
326 } else {
327 hent = NULL;
328 k = 0;
329 }
330 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
331 } else {
332 k = 0;
333 hent = NULL;
334 }
335 for (;;) {
336 (void) snprintf(b->data, b->max, "%s/%08lx.%s%d",
337 ent->dir, h, postfix, k);
338
339 {
340 struct stat st;
341 if (stat(b->data, &st) < 0)
342 break;
343 }
344 /* found one. */
345 if (type == X509_LU_X509) {
346 if ((X509_load_cert_file(xl, b->data,
347 ent->dir_type)) == 0)
348 break;
349 } else if (type == X509_LU_CRL) {
350 if ((X509_load_crl_file(xl, b->data,
351 ent->dir_type)) == 0)
352 break;
353 }
354 /* else case will caught higher up */
355 k++;
356 }
357
358 /* we have added it to the cache so now pull it out again */
359 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
360 j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
361 if (j != -1)
362 tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
363 else
364 tmp = NULL;
365 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
366
367 /* If a CRL, update the last file suffix added for this */
368 if (type == X509_LU_CRL) {
369 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
370 /*
371 * Look for entry again in case another thread added
372 * an entry first.
373 */
374 if (!hent) {
375 htmp.hash = h;
376 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
377 if (idx >= 0)
378 hent = sk_BY_DIR_HASH_value(
379 ent->hashes, idx);
380 }
381 if (!hent) {
382 hent = malloc(sizeof(BY_DIR_HASH));
383 if (!hent) {
384 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
385 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
386 ok = 0;
387 goto finish;
388 }
389 hent->hash = h;
390 hent->suffix = k;
391 if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
392 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
393 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
394 free(hent);
395 ok = 0;
396 goto finish;
397 }
398 } else if (hent->suffix < k)
399 hent->suffix = k;
400
401 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
402
403 }
404
405 if (tmp != NULL) {
406 ok = 1;
407 ret->type = tmp->type;
408 memcpy(&ret->data, &tmp->data, sizeof(ret->data));
409 /*
410 * If we were going to up the reference count,
411 * we would need to do it on a perl 'type' basis
412 */
413 /* CRYPTO_add(&tmp->data.x509->references,1,
414 CRYPTO_LOCK_X509);*/
415 goto finish;
416 }
417 }
418finish:
419 if (b != NULL)
420 BUF_MEM_free(b);
421 return (ok);
422}
diff --git a/src/lib/libcrypto/x509/by_file.c b/src/lib/libcrypto/x509/by_file.c
deleted file mode 100644
index 377b3b0a8b..0000000000
--- a/src/lib/libcrypto/x509/by_file.c
+++ /dev/null
@@ -1,274 +0,0 @@
1/* $OpenBSD: by_file.c,v 1.20 2016/03/11 07:08:45 mmcc Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <time.h>
62#include <unistd.h>
63
64#include <openssl/buffer.h>
65#include <openssl/err.h>
66#include <openssl/pem.h>
67#include <openssl/lhash.h>
68#include <openssl/x509.h>
69
70static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
71 long argl, char **ret);
72
73static X509_LOOKUP_METHOD x509_file_lookup = {
74 .name = "Load file into cache",
75 .new_item = NULL,
76 .free = NULL,
77 .init = NULL,
78 .shutdown = NULL,
79 .ctrl = by_file_ctrl,
80 .get_by_subject = NULL,
81 .get_by_issuer_serial = NULL,
82 .get_by_fingerprint = NULL,
83 .get_by_alias = NULL,
84};
85
86X509_LOOKUP_METHOD *
87X509_LOOKUP_file(void)
88{
89 return (&x509_file_lookup);
90}
91
92static int
93by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
94 char **ret)
95{
96 int ok = 0;
97
98 switch (cmd) {
99 case X509_L_FILE_LOAD:
100 if (argl == X509_FILETYPE_DEFAULT) {
101 ok = (X509_load_cert_crl_file(ctx,
102 X509_get_default_cert_file(),
103 X509_FILETYPE_PEM) != 0);
104 if (!ok) {
105 X509err(X509_F_BY_FILE_CTRL,
106 X509_R_LOADING_DEFAULTS);
107 }
108 } else {
109 if (argl == X509_FILETYPE_PEM)
110 ok = (X509_load_cert_crl_file(ctx, argp,
111 X509_FILETYPE_PEM) != 0);
112 else
113 ok = (X509_load_cert_file(ctx,
114 argp, (int)argl) != 0);
115 }
116 break;
117 }
118 return (ok);
119}
120
121int
122X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
123{
124 int ret = 0;
125 BIO *in = NULL;
126 int i, count = 0;
127 X509 *x = NULL;
128
129 if (file == NULL)
130 return (1);
131 in = BIO_new(BIO_s_file_internal());
132
133 if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
134 X509err(X509_F_X509_LOAD_CERT_FILE, ERR_R_SYS_LIB);
135 goto err;
136 }
137
138 if (type == X509_FILETYPE_PEM) {
139 for (;;) {
140 x = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
141 if (x == NULL) {
142 if ((ERR_GET_REASON(ERR_peek_last_error()) ==
143 PEM_R_NO_START_LINE) && (count > 0)) {
144 ERR_clear_error();
145 break;
146 } else {
147 X509err(X509_F_X509_LOAD_CERT_FILE,
148 ERR_R_PEM_LIB);
149 goto err;
150 }
151 }
152 i = X509_STORE_add_cert(ctx->store_ctx, x);
153 if (!i)
154 goto err;
155 count++;
156 X509_free(x);
157 x = NULL;
158 }
159 ret = count;
160 } else if (type == X509_FILETYPE_ASN1) {
161 x = d2i_X509_bio(in, NULL);
162 if (x == NULL) {
163 X509err(X509_F_X509_LOAD_CERT_FILE, ERR_R_ASN1_LIB);
164 goto err;
165 }
166 i = X509_STORE_add_cert(ctx->store_ctx, x);
167 if (!i)
168 goto err;
169 ret = i;
170 } else {
171 X509err(X509_F_X509_LOAD_CERT_FILE, X509_R_BAD_X509_FILETYPE);
172 goto err;
173 }
174err:
175 X509_free(x);
176 BIO_free(in);
177 return (ret);
178}
179
180int
181X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type)
182{
183 int ret = 0;
184 BIO *in = NULL;
185 int i, count = 0;
186 X509_CRL *x = NULL;
187
188 if (file == NULL)
189 return (1);
190 in = BIO_new(BIO_s_file_internal());
191
192 if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
193 X509err(X509_F_X509_LOAD_CRL_FILE, ERR_R_SYS_LIB);
194 goto err;
195 }
196
197 if (type == X509_FILETYPE_PEM) {
198 for (;;) {
199 x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
200 if (x == NULL) {
201 if ((ERR_GET_REASON(ERR_peek_last_error()) ==
202 PEM_R_NO_START_LINE) && (count > 0)) {
203 ERR_clear_error();
204 break;
205 } else {
206 X509err(X509_F_X509_LOAD_CRL_FILE,
207 ERR_R_PEM_LIB);
208 goto err;
209 }
210 }
211 i = X509_STORE_add_crl(ctx->store_ctx, x);
212 if (!i)
213 goto err;
214 count++;
215 X509_CRL_free(x);
216 x = NULL;
217 }
218 ret = count;
219 } else if (type == X509_FILETYPE_ASN1) {
220 x = d2i_X509_CRL_bio(in, NULL);
221 if (x == NULL) {
222 X509err(X509_F_X509_LOAD_CRL_FILE, ERR_R_ASN1_LIB);
223 goto err;
224 }
225 i = X509_STORE_add_crl(ctx->store_ctx, x);
226 if (!i)
227 goto err;
228 ret = i;
229 } else {
230 X509err(X509_F_X509_LOAD_CRL_FILE, X509_R_BAD_X509_FILETYPE);
231 goto err;
232 }
233err:
234 if (x != NULL)
235 X509_CRL_free(x);
236 BIO_free(in);
237 return (ret);
238}
239
240int
241X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
242{
243 STACK_OF(X509_INFO) *inf;
244 X509_INFO *itmp;
245 BIO *in;
246 int i, count = 0;
247 if (type != X509_FILETYPE_PEM)
248 return X509_load_cert_file(ctx, file, type);
249 in = BIO_new_file(file, "r");
250 if (!in) {
251 X509err(X509_F_X509_LOAD_CERT_CRL_FILE, ERR_R_SYS_LIB);
252 return 0;
253 }
254 inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
255 BIO_free(in);
256 if (!inf) {
257 X509err(X509_F_X509_LOAD_CERT_CRL_FILE, ERR_R_PEM_LIB);
258 return 0;
259 }
260 for (i = 0; i < sk_X509_INFO_num(inf); i++) {
261 itmp = sk_X509_INFO_value(inf, i);
262 if (itmp->x509) {
263 X509_STORE_add_cert(ctx->store_ctx, itmp->x509);
264 count++;
265 }
266 if (itmp->crl) {
267 X509_STORE_add_crl(ctx->store_ctx, itmp->crl);
268 count++;
269 }
270 }
271 sk_X509_INFO_pop_free(inf, X509_INFO_free);
272 return count;
273}
274
diff --git a/src/lib/libcrypto/x509/by_mem.c b/src/lib/libcrypto/x509/by_mem.c
deleted file mode 100644
index ecab813406..0000000000
--- a/src/lib/libcrypto/x509/by_mem.c
+++ /dev/null
@@ -1,138 +0,0 @@
1/* $OpenBSD: by_mem.c,v 1.3 2015/02/05 01:33:22 reyk Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <sys/uio.h>
60#include <errno.h>
61#include <stdio.h>
62#include <time.h>
63#include <unistd.h>
64
65#include <openssl/buffer.h>
66#include <openssl/err.h>
67#include <openssl/pem.h>
68#include <openssl/lhash.h>
69#include <openssl/x509.h>
70
71static int by_mem_ctrl(X509_LOOKUP *, int, const char *, long, char **);
72
73static X509_LOOKUP_METHOD x509_mem_lookup = {
74 .name = "Load cert from memory",
75 .new_item = NULL,
76 .free = NULL,
77 .init = NULL,
78 .shutdown = NULL,
79 .ctrl = by_mem_ctrl,
80 .get_by_subject = NULL,
81 .get_by_issuer_serial = NULL,
82 .get_by_fingerprint = NULL,
83 .get_by_alias = NULL,
84};
85
86X509_LOOKUP_METHOD *
87X509_LOOKUP_mem(void)
88{
89 return (&x509_mem_lookup);
90}
91
92static int
93by_mem_ctrl(X509_LOOKUP *lu, int cmd, const char *buf,
94 long type, char **ret)
95{
96 STACK_OF(X509_INFO) *inf = NULL;
97 const struct iovec *iov;
98 X509_INFO *itmp;
99 BIO *in = NULL;
100 int i, count = 0, ok = 0;
101
102 iov = (const struct iovec *)buf;
103
104 if (!(cmd == X509_L_MEM && type == X509_FILETYPE_PEM))
105 goto done;
106
107 if ((in = BIO_new_mem_buf(iov->iov_base, iov->iov_len)) == NULL)
108 goto done;
109
110 if ((inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL)) == NULL)
111 goto done;
112
113 for (i = 0; i < sk_X509_INFO_num(inf); i++) {
114 itmp = sk_X509_INFO_value(inf, i);
115 if (itmp->x509) {
116 ok = X509_STORE_add_cert(lu->store_ctx, itmp->x509);
117 if (!ok)
118 goto done;
119 count++;
120 }
121 if (itmp->crl) {
122 ok = X509_STORE_add_crl(lu->store_ctx, itmp->crl);
123 if (!ok)
124 goto done;
125 count++;
126 }
127 }
128
129 ok = count != 0;
130 done:
131 if (count == 0)
132 X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_PEM_LIB);
133 if (inf != NULL)
134 sk_X509_INFO_pop_free(inf, X509_INFO_free);
135 if (in != NULL)
136 BIO_free(in);
137 return (ok);
138}
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
deleted file mode 100644
index cf00ea5ebe..0000000000
--- a/src/lib/libcrypto/x509/x509.h
+++ /dev/null
@@ -1,1270 +0,0 @@
1/* $OpenBSD: x509.h,v 1.23 2015/04/12 15:15:51 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58/* ====================================================================
59 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60 * ECDH support in OpenSSL originally developed by
61 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
62 */
63
64#ifndef HEADER_X509_H
65#define HEADER_X509_H
66
67#include <openssl/opensslconf.h>
68
69#ifndef OPENSSL_NO_BUFFER
70#include <openssl/buffer.h>
71#endif
72#ifndef OPENSSL_NO_EVP
73#include <openssl/evp.h>
74#endif
75#ifndef OPENSSL_NO_BIO
76#include <openssl/bio.h>
77#endif
78#include <openssl/stack.h>
79#include <openssl/asn1.h>
80#include <openssl/safestack.h>
81
82#ifndef OPENSSL_NO_EC
83#include <openssl/ec.h>
84#endif
85
86#ifndef OPENSSL_NO_ECDSA
87#include <openssl/ecdsa.h>
88#endif
89
90#ifndef OPENSSL_NO_ECDH
91#include <openssl/ecdh.h>
92#endif
93
94#ifndef OPENSSL_NO_DEPRECATED
95#ifndef OPENSSL_NO_RSA
96#include <openssl/rsa.h>
97#endif
98#ifndef OPENSSL_NO_DSA
99#include <openssl/dsa.h>
100#endif
101#ifndef OPENSSL_NO_DH
102#include <openssl/dh.h>
103#endif
104#endif
105
106#ifndef OPENSSL_NO_SHA
107#include <openssl/sha.h>
108#endif
109#include <openssl/ossl_typ.h>
110
111#ifdef __cplusplus
112extern "C" {
113#endif
114
115#define X509_FILETYPE_PEM 1
116#define X509_FILETYPE_ASN1 2
117#define X509_FILETYPE_DEFAULT 3
118
119#define X509v3_KU_DIGITAL_SIGNATURE 0x0080
120#define X509v3_KU_NON_REPUDIATION 0x0040
121#define X509v3_KU_KEY_ENCIPHERMENT 0x0020
122#define X509v3_KU_DATA_ENCIPHERMENT 0x0010
123#define X509v3_KU_KEY_AGREEMENT 0x0008
124#define X509v3_KU_KEY_CERT_SIGN 0x0004
125#define X509v3_KU_CRL_SIGN 0x0002
126#define X509v3_KU_ENCIPHER_ONLY 0x0001
127#define X509v3_KU_DECIPHER_ONLY 0x8000
128#define X509v3_KU_UNDEF 0xffff
129
130typedef struct X509_objects_st
131 {
132 int nid;
133 int (*a2i)(void);
134 int (*i2a)(void);
135 } X509_OBJECTS;
136
137struct X509_algor_st
138 {
139 ASN1_OBJECT *algorithm;
140 ASN1_TYPE *parameter;
141 } /* X509_ALGOR */;
142
143DECLARE_ASN1_SET_OF(X509_ALGOR)
144
145typedef STACK_OF(X509_ALGOR) X509_ALGORS;
146
147typedef struct X509_val_st
148 {
149 ASN1_TIME *notBefore;
150 ASN1_TIME *notAfter;
151 } X509_VAL;
152
153struct X509_pubkey_st
154 {
155 X509_ALGOR *algor;
156 ASN1_BIT_STRING *public_key;
157 EVP_PKEY *pkey;
158 };
159
160typedef struct X509_sig_st
161 {
162 X509_ALGOR *algor;
163 ASN1_OCTET_STRING *digest;
164 } X509_SIG;
165
166typedef struct X509_name_entry_st
167 {
168 ASN1_OBJECT *object;
169 ASN1_STRING *value;
170 int set;
171 int size; /* temp variable */
172 } X509_NAME_ENTRY;
173
174DECLARE_STACK_OF(X509_NAME_ENTRY)
175DECLARE_ASN1_SET_OF(X509_NAME_ENTRY)
176
177/* we always keep X509_NAMEs in 2 forms. */
178struct X509_name_st
179 {
180 STACK_OF(X509_NAME_ENTRY) *entries;
181 int modified; /* true if 'bytes' needs to be built */
182#ifndef OPENSSL_NO_BUFFER
183 BUF_MEM *bytes;
184#else
185 char *bytes;
186#endif
187/* unsigned long hash; Keep the hash around for lookups */
188 unsigned char *canon_enc;
189 int canon_enclen;
190 } /* X509_NAME */;
191
192DECLARE_STACK_OF(X509_NAME)
193
194#define X509_EX_V_NETSCAPE_HACK 0x8000
195#define X509_EX_V_INIT 0x0001
196typedef struct X509_extension_st
197 {
198 ASN1_OBJECT *object;
199 ASN1_BOOLEAN critical;
200 ASN1_OCTET_STRING *value;
201 } X509_EXTENSION;
202
203typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS;
204
205DECLARE_STACK_OF(X509_EXTENSION)
206DECLARE_ASN1_SET_OF(X509_EXTENSION)
207
208/* a sequence of these are used */
209typedef struct x509_attributes_st
210 {
211 ASN1_OBJECT *object;
212 int single; /* 0 for a set, 1 for a single item (which is wrong) */
213 union {
214 char *ptr;
215/* 0 */ STACK_OF(ASN1_TYPE) *set;
216/* 1 */ ASN1_TYPE *single;
217 } value;
218 } X509_ATTRIBUTE;
219
220DECLARE_STACK_OF(X509_ATTRIBUTE)
221DECLARE_ASN1_SET_OF(X509_ATTRIBUTE)
222
223
224typedef struct X509_req_info_st
225 {
226 ASN1_ENCODING enc;
227 ASN1_INTEGER *version;
228 X509_NAME *subject;
229 X509_PUBKEY *pubkey;
230 /* d=2 hl=2 l= 0 cons: cont: 00 */
231 STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */
232 } X509_REQ_INFO;
233
234typedef struct X509_req_st
235 {
236 X509_REQ_INFO *req_info;
237 X509_ALGOR *sig_alg;
238 ASN1_BIT_STRING *signature;
239 int references;
240 } X509_REQ;
241
242typedef struct x509_cinf_st
243 {
244 ASN1_INTEGER *version; /* [ 0 ] default of v1 */
245 ASN1_INTEGER *serialNumber;
246 X509_ALGOR *signature;
247 X509_NAME *issuer;
248 X509_VAL *validity;
249 X509_NAME *subject;
250 X509_PUBKEY *key;
251 ASN1_BIT_STRING *issuerUID; /* [ 1 ] optional in v2 */
252 ASN1_BIT_STRING *subjectUID; /* [ 2 ] optional in v2 */
253 STACK_OF(X509_EXTENSION) *extensions; /* [ 3 ] optional in v3 */
254 ASN1_ENCODING enc;
255 } X509_CINF;
256
257/* This stuff is certificate "auxiliary info"
258 * it contains details which are useful in certificate
259 * stores and databases. When used this is tagged onto
260 * the end of the certificate itself
261 */
262
263typedef struct x509_cert_aux_st
264 {
265 STACK_OF(ASN1_OBJECT) *trust; /* trusted uses */
266 STACK_OF(ASN1_OBJECT) *reject; /* rejected uses */
267 ASN1_UTF8STRING *alias; /* "friendly name" */
268 ASN1_OCTET_STRING *keyid; /* key id of private key */
269 STACK_OF(X509_ALGOR) *other; /* other unspecified info */
270 } X509_CERT_AUX;
271
272struct x509_st
273 {
274 X509_CINF *cert_info;
275 X509_ALGOR *sig_alg;
276 ASN1_BIT_STRING *signature;
277 int valid;
278 int references;
279 char *name;
280 CRYPTO_EX_DATA ex_data;
281 /* These contain copies of various extension values */
282 long ex_pathlen;
283 long ex_pcpathlen;
284 unsigned long ex_flags;
285 unsigned long ex_kusage;
286 unsigned long ex_xkusage;
287 unsigned long ex_nscert;
288 ASN1_OCTET_STRING *skid;
289 AUTHORITY_KEYID *akid;
290 X509_POLICY_CACHE *policy_cache;
291 STACK_OF(DIST_POINT) *crldp;
292 STACK_OF(GENERAL_NAME) *altname;
293 NAME_CONSTRAINTS *nc;
294#ifndef OPENSSL_NO_SHA
295 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
296#endif
297 X509_CERT_AUX *aux;
298 } /* X509 */;
299
300DECLARE_STACK_OF(X509)
301DECLARE_ASN1_SET_OF(X509)
302
303/* This is used for a table of trust checking functions */
304
305typedef struct x509_trust_st {
306 int trust;
307 int flags;
308 int (*check_trust)(struct x509_trust_st *, X509 *, int);
309 char *name;
310 int arg1;
311 void *arg2;
312} X509_TRUST;
313
314DECLARE_STACK_OF(X509_TRUST)
315
316typedef struct x509_cert_pair_st {
317 X509 *forward;
318 X509 *reverse;
319} X509_CERT_PAIR;
320
321/* standard trust ids */
322
323#define X509_TRUST_DEFAULT -1 /* Only valid in purpose settings */
324
325#define X509_TRUST_COMPAT 1
326#define X509_TRUST_SSL_CLIENT 2
327#define X509_TRUST_SSL_SERVER 3
328#define X509_TRUST_EMAIL 4
329#define X509_TRUST_OBJECT_SIGN 5
330#define X509_TRUST_OCSP_SIGN 6
331#define X509_TRUST_OCSP_REQUEST 7
332#define X509_TRUST_TSA 8
333
334/* Keep these up to date! */
335#define X509_TRUST_MIN 1
336#define X509_TRUST_MAX 8
337
338
339/* trust_flags values */
340#define X509_TRUST_DYNAMIC 1
341#define X509_TRUST_DYNAMIC_NAME 2
342
343/* check_trust return codes */
344
345#define X509_TRUST_TRUSTED 1
346#define X509_TRUST_REJECTED 2
347#define X509_TRUST_UNTRUSTED 3
348
349/* Flags for X509_print_ex() */
350
351#define X509_FLAG_COMPAT 0
352#define X509_FLAG_NO_HEADER 1L
353#define X509_FLAG_NO_VERSION (1L << 1)
354#define X509_FLAG_NO_SERIAL (1L << 2)
355#define X509_FLAG_NO_SIGNAME (1L << 3)
356#define X509_FLAG_NO_ISSUER (1L << 4)
357#define X509_FLAG_NO_VALIDITY (1L << 5)
358#define X509_FLAG_NO_SUBJECT (1L << 6)
359#define X509_FLAG_NO_PUBKEY (1L << 7)
360#define X509_FLAG_NO_EXTENSIONS (1L << 8)
361#define X509_FLAG_NO_SIGDUMP (1L << 9)
362#define X509_FLAG_NO_AUX (1L << 10)
363#define X509_FLAG_NO_ATTRIBUTES (1L << 11)
364
365/* Flags specific to X509_NAME_print_ex() */
366
367/* The field separator information */
368
369#define XN_FLAG_SEP_MASK (0xf << 16)
370
371#define XN_FLAG_COMPAT 0 /* Traditional SSLeay: use old X509_NAME_print */
372#define XN_FLAG_SEP_COMMA_PLUS (1 << 16) /* RFC2253 ,+ */
373#define XN_FLAG_SEP_CPLUS_SPC (2 << 16) /* ,+ spaced: more readable */
374#define XN_FLAG_SEP_SPLUS_SPC (3 << 16) /* ;+ spaced */
375#define XN_FLAG_SEP_MULTILINE (4 << 16) /* One line per field */
376
377#define XN_FLAG_DN_REV (1 << 20) /* Reverse DN order */
378
379/* How the field name is shown */
380
381#define XN_FLAG_FN_MASK (0x3 << 21)
382
383#define XN_FLAG_FN_SN 0 /* Object short name */
384#define XN_FLAG_FN_LN (1 << 21) /* Object long name */
385#define XN_FLAG_FN_OID (2 << 21) /* Always use OIDs */
386#define XN_FLAG_FN_NONE (3 << 21) /* No field names */
387
388#define XN_FLAG_SPC_EQ (1 << 23) /* Put spaces round '=' */
389
390/* This determines if we dump fields we don't recognise:
391 * RFC2253 requires this.
392 */
393
394#define XN_FLAG_DUMP_UNKNOWN_FIELDS (1 << 24)
395
396#define XN_FLAG_FN_ALIGN (1 << 25) /* Align field names to 20 characters */
397
398/* Complete set of RFC2253 flags */
399
400#define XN_FLAG_RFC2253 (ASN1_STRFLGS_RFC2253 | \
401 XN_FLAG_SEP_COMMA_PLUS | \
402 XN_FLAG_DN_REV | \
403 XN_FLAG_FN_SN | \
404 XN_FLAG_DUMP_UNKNOWN_FIELDS)
405
406/* readable oneline form */
407
408#define XN_FLAG_ONELINE (ASN1_STRFLGS_RFC2253 | \
409 ASN1_STRFLGS_ESC_QUOTE | \
410 XN_FLAG_SEP_CPLUS_SPC | \
411 XN_FLAG_SPC_EQ | \
412 XN_FLAG_FN_SN)
413
414/* readable multiline form */
415
416#define XN_FLAG_MULTILINE (ASN1_STRFLGS_ESC_CTRL | \
417 ASN1_STRFLGS_ESC_MSB | \
418 XN_FLAG_SEP_MULTILINE | \
419 XN_FLAG_SPC_EQ | \
420 XN_FLAG_FN_LN | \
421 XN_FLAG_FN_ALIGN)
422
423struct x509_revoked_st
424 {
425 ASN1_INTEGER *serialNumber;
426 ASN1_TIME *revocationDate;
427 STACK_OF(X509_EXTENSION) /* optional */ *extensions;
428 /* Set up if indirect CRL */
429 STACK_OF(GENERAL_NAME) *issuer;
430 /* Revocation reason */
431 int reason;
432 int sequence; /* load sequence */
433 };
434
435DECLARE_STACK_OF(X509_REVOKED)
436DECLARE_ASN1_SET_OF(X509_REVOKED)
437
438typedef struct X509_crl_info_st
439 {
440 ASN1_INTEGER *version;
441 X509_ALGOR *sig_alg;
442 X509_NAME *issuer;
443 ASN1_TIME *lastUpdate;
444 ASN1_TIME *nextUpdate;
445 STACK_OF(X509_REVOKED) *revoked;
446 STACK_OF(X509_EXTENSION) /* [0] */ *extensions;
447 ASN1_ENCODING enc;
448 } X509_CRL_INFO;
449
450struct X509_crl_st
451 {
452 /* actual signature */
453 X509_CRL_INFO *crl;
454 X509_ALGOR *sig_alg;
455 ASN1_BIT_STRING *signature;
456 int references;
457 int flags;
458 /* Copies of various extensions */
459 AUTHORITY_KEYID *akid;
460 ISSUING_DIST_POINT *idp;
461 /* Convenient breakdown of IDP */
462 int idp_flags;
463 int idp_reasons;
464 /* CRL and base CRL numbers for delta processing */
465 ASN1_INTEGER *crl_number;
466 ASN1_INTEGER *base_crl_number;
467#ifndef OPENSSL_NO_SHA
468 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
469#endif
470 STACK_OF(GENERAL_NAMES) *issuers;
471 const X509_CRL_METHOD *meth;
472 void *meth_data;
473 } /* X509_CRL */;
474
475DECLARE_STACK_OF(X509_CRL)
476DECLARE_ASN1_SET_OF(X509_CRL)
477
478typedef struct private_key_st
479 {
480 int version;
481 /* The PKCS#8 data types */
482 X509_ALGOR *enc_algor;
483 ASN1_OCTET_STRING *enc_pkey; /* encrypted pub key */
484
485 /* When decrypted, the following will not be NULL */
486 EVP_PKEY *dec_pkey;
487
488 /* used to encrypt and decrypt */
489 int key_length;
490 char *key_data;
491 int key_free; /* true if we should auto free key_data */
492
493 /* expanded version of 'enc_algor' */
494 EVP_CIPHER_INFO cipher;
495
496 int references;
497 } X509_PKEY;
498
499#ifndef OPENSSL_NO_EVP
500typedef struct X509_info_st
501 {
502 X509 *x509;
503 X509_CRL *crl;
504 X509_PKEY *x_pkey;
505
506 EVP_CIPHER_INFO enc_cipher;
507 int enc_len;
508 char *enc_data;
509
510 int references;
511 } X509_INFO;
512
513DECLARE_STACK_OF(X509_INFO)
514#endif
515
516/* The next 2 structures and their 8 routines were sent to me by
517 * Pat Richard <patr@x509.com> and are used to manipulate
518 * Netscapes spki structures - useful if you are writing a CA web page
519 */
520typedef struct Netscape_spkac_st
521 {
522 X509_PUBKEY *pubkey;
523 ASN1_IA5STRING *challenge; /* challenge sent in atlas >= PR2 */
524 } NETSCAPE_SPKAC;
525
526typedef struct Netscape_spki_st
527 {
528 NETSCAPE_SPKAC *spkac; /* signed public key and challenge */
529 X509_ALGOR *sig_algor;
530 ASN1_BIT_STRING *signature;
531 } NETSCAPE_SPKI;
532
533/* Netscape certificate sequence structure */
534typedef struct Netscape_certificate_sequence
535 {
536 ASN1_OBJECT *type;
537 STACK_OF(X509) *certs;
538 } NETSCAPE_CERT_SEQUENCE;
539
540/* Unused (and iv length is wrong)
541typedef struct CBCParameter_st
542 {
543 unsigned char iv[8];
544 } CBC_PARAM;
545*/
546
547/* Password based encryption structure */
548
549typedef struct PBEPARAM_st {
550ASN1_OCTET_STRING *salt;
551ASN1_INTEGER *iter;
552} PBEPARAM;
553
554/* Password based encryption V2 structures */
555
556typedef struct PBE2PARAM_st {
557X509_ALGOR *keyfunc;
558X509_ALGOR *encryption;
559} PBE2PARAM;
560
561typedef struct PBKDF2PARAM_st {
562ASN1_TYPE *salt; /* Usually OCTET STRING but could be anything */
563ASN1_INTEGER *iter;
564ASN1_INTEGER *keylength;
565X509_ALGOR *prf;
566} PBKDF2PARAM;
567
568
569/* PKCS#8 private key info structure */
570
571struct pkcs8_priv_key_info_st
572 {
573 int broken; /* Flag for various broken formats */
574#define PKCS8_OK 0
575#define PKCS8_NO_OCTET 1
576#define PKCS8_EMBEDDED_PARAM 2
577#define PKCS8_NS_DB 3
578#define PKCS8_NEG_PRIVKEY 4
579 ASN1_INTEGER *version;
580 X509_ALGOR *pkeyalg;
581 ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
582 STACK_OF(X509_ATTRIBUTE) *attributes;
583 };
584
585#ifdef __cplusplus
586}
587#endif
588
589#include <openssl/x509_vfy.h>
590#include <openssl/pkcs7.h>
591
592#ifdef __cplusplus
593extern "C" {
594#endif
595
596#define X509_EXT_PACK_UNKNOWN 1
597#define X509_EXT_PACK_STRING 2
598
599#define X509_get_version(x) ASN1_INTEGER_get((x)->cert_info->version)
600/* #define X509_get_serialNumber(x) ((x)->cert_info->serialNumber) */
601#define X509_get_notBefore(x) ((x)->cert_info->validity->notBefore)
602#define X509_get_notAfter(x) ((x)->cert_info->validity->notAfter)
603#define X509_extract_key(x) X509_get_pubkey(x) /*****/
604#define X509_REQ_get_version(x) ASN1_INTEGER_get((x)->req_info->version)
605#define X509_REQ_get_subject_name(x) ((x)->req_info->subject)
606#define X509_REQ_extract_key(a) X509_REQ_get_pubkey(a)
607#define X509_name_cmp(a,b) X509_NAME_cmp((a),(b))
608#define X509_get_signature_type(x) EVP_PKEY_type(OBJ_obj2nid((x)->sig_alg->algorithm))
609
610#define X509_CRL_get_version(x) ASN1_INTEGER_get((x)->crl->version)
611#define X509_CRL_get_lastUpdate(x) ((x)->crl->lastUpdate)
612#define X509_CRL_get_nextUpdate(x) ((x)->crl->nextUpdate)
613#define X509_CRL_get_issuer(x) ((x)->crl->issuer)
614#define X509_CRL_get_REVOKED(x) ((x)->crl->revoked)
615
616void X509_CRL_set_default_method(const X509_CRL_METHOD *meth);
617X509_CRL_METHOD *X509_CRL_METHOD_new(
618 int (*crl_init)(X509_CRL *crl),
619 int (*crl_free)(X509_CRL *crl),
620 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,
621 ASN1_INTEGER *ser, X509_NAME *issuer),
622 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk));
623void X509_CRL_METHOD_free(X509_CRL_METHOD *m);
624
625void X509_CRL_set_meth_data(X509_CRL *crl, void *dat);
626void *X509_CRL_get_meth_data(X509_CRL *crl);
627
628/* This one is only used so that a binary form can output, as in
629 * i2d_X509_NAME(X509_get_X509_PUBKEY(x),&buf) */
630#define X509_get_X509_PUBKEY(x) ((x)->cert_info->key)
631
632
633const char *X509_verify_cert_error_string(long n);
634
635#ifndef OPENSSL_NO_EVP
636int X509_verify(X509 *a, EVP_PKEY *r);
637
638int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
639int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
640int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
641
642NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len);
643char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *x);
644EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x);
645int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey);
646
647int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);
648
649int X509_signature_dump(BIO *bp,const ASN1_STRING *sig, int indent);
650int X509_signature_print(BIO *bp,X509_ALGOR *alg, ASN1_STRING *sig);
651
652int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
653int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);
654int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
655int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);
656int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
657int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);
658int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
659
660int X509_pubkey_digest(const X509 *data,const EVP_MD *type,
661 unsigned char *md, unsigned int *len);
662int X509_digest(const X509 *data,const EVP_MD *type,
663 unsigned char *md, unsigned int *len);
664int X509_CRL_digest(const X509_CRL *data,const EVP_MD *type,
665 unsigned char *md, unsigned int *len);
666int X509_REQ_digest(const X509_REQ *data,const EVP_MD *type,
667 unsigned char *md, unsigned int *len);
668int X509_NAME_digest(const X509_NAME *data,const EVP_MD *type,
669 unsigned char *md, unsigned int *len);
670#endif
671
672X509 *d2i_X509_fp(FILE *fp, X509 **x509);
673int i2d_X509_fp(FILE *fp,X509 *x509);
674X509_CRL *d2i_X509_CRL_fp(FILE *fp,X509_CRL **crl);
675int i2d_X509_CRL_fp(FILE *fp,X509_CRL *crl);
676X509_REQ *d2i_X509_REQ_fp(FILE *fp,X509_REQ **req);
677int i2d_X509_REQ_fp(FILE *fp,X509_REQ *req);
678#ifndef OPENSSL_NO_RSA
679RSA *d2i_RSAPrivateKey_fp(FILE *fp,RSA **rsa);
680int i2d_RSAPrivateKey_fp(FILE *fp,RSA *rsa);
681RSA *d2i_RSAPublicKey_fp(FILE *fp,RSA **rsa);
682int i2d_RSAPublicKey_fp(FILE *fp,RSA *rsa);
683RSA *d2i_RSA_PUBKEY_fp(FILE *fp,RSA **rsa);
684int i2d_RSA_PUBKEY_fp(FILE *fp,RSA *rsa);
685#endif
686#ifndef OPENSSL_NO_DSA
687DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa);
688int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa);
689int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa);
690#endif
691#ifndef OPENSSL_NO_EC
692EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey);
693int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey);
694EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey);
695int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey);
696#endif
697X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8);
698int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8);
699PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
700 PKCS8_PRIV_KEY_INFO **p8inf);
701int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,PKCS8_PRIV_KEY_INFO *p8inf);
702int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key);
703int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey);
704EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a);
705int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey);
706EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a);
707
708#ifndef OPENSSL_NO_BIO
709X509 *d2i_X509_bio(BIO *bp,X509 **x509);
710int i2d_X509_bio(BIO *bp,X509 *x509);
711X509_CRL *d2i_X509_CRL_bio(BIO *bp,X509_CRL **crl);
712int i2d_X509_CRL_bio(BIO *bp,X509_CRL *crl);
713X509_REQ *d2i_X509_REQ_bio(BIO *bp,X509_REQ **req);
714int i2d_X509_REQ_bio(BIO *bp,X509_REQ *req);
715#ifndef OPENSSL_NO_RSA
716RSA *d2i_RSAPrivateKey_bio(BIO *bp,RSA **rsa);
717int i2d_RSAPrivateKey_bio(BIO *bp,RSA *rsa);
718RSA *d2i_RSAPublicKey_bio(BIO *bp,RSA **rsa);
719int i2d_RSAPublicKey_bio(BIO *bp,RSA *rsa);
720RSA *d2i_RSA_PUBKEY_bio(BIO *bp,RSA **rsa);
721int i2d_RSA_PUBKEY_bio(BIO *bp,RSA *rsa);
722#endif
723#ifndef OPENSSL_NO_DSA
724DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa);
725int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa);
726DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa);
727int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa);
728#endif
729#ifndef OPENSSL_NO_EC
730EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey);
731int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey);
732EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey);
733int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey);
734#endif
735X509_SIG *d2i_PKCS8_bio(BIO *bp,X509_SIG **p8);
736int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8);
737PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
738 PKCS8_PRIV_KEY_INFO **p8inf);
739int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,PKCS8_PRIV_KEY_INFO *p8inf);
740int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key);
741int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey);
742EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a);
743int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey);
744EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a);
745#endif
746
747X509 *X509_dup(X509 *x509);
748X509_ATTRIBUTE *X509_ATTRIBUTE_dup(X509_ATTRIBUTE *xa);
749X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex);
750X509_CRL *X509_CRL_dup(X509_CRL *crl);
751X509_REQ *X509_REQ_dup(X509_REQ *req);
752X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
753int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);
754void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
755 X509_ALGOR *algor);
756void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md);
757int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b);
758
759X509_NAME *X509_NAME_dup(X509_NAME *xn);
760X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
761
762int X509_cmp_time(const ASN1_TIME *s, time_t *t);
763int X509_cmp_current_time(const ASN1_TIME *s);
764ASN1_TIME * X509_time_adj(ASN1_TIME *s, long adj, time_t *t);
765ASN1_TIME * X509_time_adj_ex(ASN1_TIME *s,
766 int offset_day, long offset_sec, time_t *t);
767ASN1_TIME * X509_gmtime_adj(ASN1_TIME *s, long adj);
768
769const char * X509_get_default_cert_area(void );
770const char * X509_get_default_cert_dir(void );
771const char * X509_get_default_cert_file(void );
772const char * X509_get_default_cert_dir_env(void );
773const char * X509_get_default_cert_file_env(void );
774const char * X509_get_default_private_dir(void );
775
776X509_REQ * X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
777X509 * X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
778
779DECLARE_ASN1_FUNCTIONS(X509_ALGOR)
780DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)
781DECLARE_ASN1_FUNCTIONS(X509_VAL)
782
783DECLARE_ASN1_FUNCTIONS(X509_PUBKEY)
784
785int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
786EVP_PKEY * X509_PUBKEY_get(X509_PUBKEY *key);
787int X509_get_pubkey_parameters(EVP_PKEY *pkey,
788 STACK_OF(X509) *chain);
789int i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp);
790EVP_PKEY * d2i_PUBKEY(EVP_PKEY **a,const unsigned char **pp,
791 long length);
792#ifndef OPENSSL_NO_RSA
793int i2d_RSA_PUBKEY(RSA *a,unsigned char **pp);
794RSA * d2i_RSA_PUBKEY(RSA **a,const unsigned char **pp,
795 long length);
796#endif
797#ifndef OPENSSL_NO_DSA
798int i2d_DSA_PUBKEY(DSA *a,unsigned char **pp);
799DSA * d2i_DSA_PUBKEY(DSA **a,const unsigned char **pp,
800 long length);
801#endif
802#ifndef OPENSSL_NO_EC
803int i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp);
804EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp,
805 long length);
806#endif
807
808DECLARE_ASN1_FUNCTIONS(X509_SIG)
809DECLARE_ASN1_FUNCTIONS(X509_REQ_INFO)
810DECLARE_ASN1_FUNCTIONS(X509_REQ)
811
812DECLARE_ASN1_FUNCTIONS(X509_ATTRIBUTE)
813X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value);
814
815DECLARE_ASN1_FUNCTIONS(X509_EXTENSION)
816DECLARE_ASN1_ENCODE_FUNCTIONS(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
817
818DECLARE_ASN1_FUNCTIONS(X509_NAME_ENTRY)
819
820DECLARE_ASN1_FUNCTIONS(X509_NAME)
821
822int X509_NAME_set(X509_NAME **xn, X509_NAME *name);
823
824DECLARE_ASN1_FUNCTIONS(X509_CINF)
825
826DECLARE_ASN1_FUNCTIONS(X509)
827DECLARE_ASN1_FUNCTIONS(X509_CERT_AUX)
828
829DECLARE_ASN1_FUNCTIONS(X509_CERT_PAIR)
830
831int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
832 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
833int X509_set_ex_data(X509 *r, int idx, void *arg);
834void *X509_get_ex_data(X509 *r, int idx);
835int i2d_X509_AUX(X509 *a,unsigned char **pp);
836X509 * d2i_X509_AUX(X509 **a,const unsigned char **pp,long length);
837
838int X509_alias_set1(X509 *x, unsigned char *name, int len);
839int X509_keyid_set1(X509 *x, unsigned char *id, int len);
840unsigned char * X509_alias_get0(X509 *x, int *len);
841unsigned char * X509_keyid_get0(X509 *x, int *len);
842int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int);
843int X509_TRUST_set(int *t, int trust);
844int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
845int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj);
846void X509_trust_clear(X509 *x);
847void X509_reject_clear(X509 *x);
848
849DECLARE_ASN1_FUNCTIONS(X509_REVOKED)
850DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
851DECLARE_ASN1_FUNCTIONS(X509_CRL)
852
853int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
854int X509_CRL_get0_by_serial(X509_CRL *crl,
855 X509_REVOKED **ret, ASN1_INTEGER *serial);
856int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);
857
858X509_PKEY * X509_PKEY_new(void );
859void X509_PKEY_free(X509_PKEY *a);
860
861DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKI)
862DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
863DECLARE_ASN1_FUNCTIONS(NETSCAPE_CERT_SEQUENCE)
864
865#ifndef OPENSSL_NO_EVP
866X509_INFO * X509_INFO_new(void);
867void X509_INFO_free(X509_INFO *a);
868char * X509_NAME_oneline(X509_NAME *a,char *buf,int size);
869
870int ASN1_item_digest(const ASN1_ITEM *it,const EVP_MD *type,void *data,
871 unsigned char *md,unsigned int *len);
872
873int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *algor1,
874 ASN1_BIT_STRING *signature,void *data,EVP_PKEY *pkey);
875
876int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
877 ASN1_BIT_STRING *signature,
878 void *data, EVP_PKEY *pkey, const EVP_MD *type);
879int ASN1_item_sign_ctx(const ASN1_ITEM *it,
880 X509_ALGOR *algor1, X509_ALGOR *algor2,
881 ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx);
882#endif
883
884int X509_set_version(X509 *x,long version);
885int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial);
886ASN1_INTEGER * X509_get_serialNumber(X509 *x);
887int X509_set_issuer_name(X509 *x, X509_NAME *name);
888X509_NAME * X509_get_issuer_name(X509 *a);
889int X509_set_subject_name(X509 *x, X509_NAME *name);
890X509_NAME * X509_get_subject_name(X509 *a);
891int X509_set_notBefore(X509 *x, const ASN1_TIME *tm);
892int X509_set_notAfter(X509 *x, const ASN1_TIME *tm);
893int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
894EVP_PKEY * X509_get_pubkey(X509 *x);
895ASN1_BIT_STRING * X509_get0_pubkey_bitstr(const X509 *x);
896int X509_certificate_type(X509 *x,EVP_PKEY *pubkey /* optional */);
897
898int X509_REQ_set_version(X509_REQ *x,long version);
899int X509_REQ_set_subject_name(X509_REQ *req,X509_NAME *name);
900int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
901EVP_PKEY * X509_REQ_get_pubkey(X509_REQ *req);
902int X509_REQ_extension_nid(int nid);
903int * X509_REQ_get_extension_nids(void);
904void X509_REQ_set_extension_nids(int *nids);
905STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req);
906int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
907 int nid);
908int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts);
909int X509_REQ_get_attr_count(const X509_REQ *req);
910int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
911 int lastpos);
912int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
913 int lastpos);
914X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc);
915X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc);
916int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr);
917int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
918 const ASN1_OBJECT *obj, int type,
919 const unsigned char *bytes, int len);
920int X509_REQ_add1_attr_by_NID(X509_REQ *req,
921 int nid, int type,
922 const unsigned char *bytes, int len);
923int X509_REQ_add1_attr_by_txt(X509_REQ *req,
924 const char *attrname, int type,
925 const unsigned char *bytes, int len);
926
927int X509_CRL_set_version(X509_CRL *x, long version);
928int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name);
929int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
930int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);
931int X509_CRL_sort(X509_CRL *crl);
932
933int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
934int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);
935
936int X509_REQ_check_private_key(X509_REQ *x509,EVP_PKEY *pkey);
937
938int X509_check_private_key(X509 *x509,EVP_PKEY *pkey);
939
940int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b);
941unsigned long X509_issuer_and_serial_hash(X509 *a);
942
943int X509_issuer_name_cmp(const X509 *a, const X509 *b);
944unsigned long X509_issuer_name_hash(X509 *a);
945
946int X509_subject_name_cmp(const X509 *a, const X509 *b);
947unsigned long X509_subject_name_hash(X509 *x);
948
949#ifndef OPENSSL_NO_MD5
950unsigned long X509_issuer_name_hash_old(X509 *a);
951unsigned long X509_subject_name_hash_old(X509 *x);
952#endif
953
954int X509_cmp(const X509 *a, const X509 *b);
955int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
956unsigned long X509_NAME_hash(X509_NAME *x);
957unsigned long X509_NAME_hash_old(X509_NAME *x);
958
959int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
960int X509_CRL_match(const X509_CRL *a, const X509_CRL *b);
961int X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
962int X509_print_fp(FILE *bp,X509 *x);
963int X509_CRL_print_fp(FILE *bp,X509_CRL *x);
964int X509_REQ_print_fp(FILE *bp,X509_REQ *req);
965int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags);
966
967#ifndef OPENSSL_NO_BIO
968int X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
969int X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags);
970int X509_print_ex(BIO *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
971int X509_print(BIO *bp,X509 *x);
972int X509_ocspid_print(BIO *bp,X509 *x);
973int X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent);
974int X509_CRL_print(BIO *bp,X509_CRL *x);
975int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, unsigned long cflag);
976int X509_REQ_print(BIO *bp,X509_REQ *req);
977#endif
978
979int X509_NAME_entry_count(X509_NAME *name);
980int X509_NAME_get_text_by_NID(X509_NAME *name, int nid,
981 char *buf,int len);
982int X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj,
983 char *buf,int len);
984
985/* NOTE: you should be passsing -1, not 0 as lastpos. The functions that use
986 * lastpos, search after that position on. */
987int X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
988int X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj,
989 int lastpos);
990X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
991X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
992int X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne,
993 int loc, int set);
994int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
995 unsigned char *bytes, int len, int loc, int set);
996int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
997 unsigned char *bytes, int len, int loc, int set);
998X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
999 const char *field, int type, const unsigned char *bytes, int len);
1000X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
1001 int type,unsigned char *bytes, int len);
1002int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
1003 const unsigned char *bytes, int len, int loc, int set);
1004X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
1005 ASN1_OBJECT *obj, int type,const unsigned char *bytes,
1006 int len);
1007int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne,
1008 ASN1_OBJECT *obj);
1009int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
1010 const unsigned char *bytes, int len);
1011ASN1_OBJECT * X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne);
1012ASN1_STRING * X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
1013
1014int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x);
1015int X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x,
1016 int nid, int lastpos);
1017int X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *x,
1018 ASN1_OBJECT *obj,int lastpos);
1019int X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *x,
1020 int crit, int lastpos);
1021X509_EXTENSION *X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc);
1022X509_EXTENSION *X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc);
1023STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
1024 X509_EXTENSION *ex, int loc);
1025
1026int X509_get_ext_count(X509 *x);
1027int X509_get_ext_by_NID(X509 *x, int nid, int lastpos);
1028int X509_get_ext_by_OBJ(X509 *x,ASN1_OBJECT *obj,int lastpos);
1029int X509_get_ext_by_critical(X509 *x, int crit, int lastpos);
1030X509_EXTENSION *X509_get_ext(X509 *x, int loc);
1031X509_EXTENSION *X509_delete_ext(X509 *x, int loc);
1032int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
1033void * X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
1034int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit,
1035 unsigned long flags);
1036
1037int X509_CRL_get_ext_count(X509_CRL *x);
1038int X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos);
1039int X509_CRL_get_ext_by_OBJ(X509_CRL *x,ASN1_OBJECT *obj,int lastpos);
1040int X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos);
1041X509_EXTENSION *X509_CRL_get_ext(X509_CRL *x, int loc);
1042X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc);
1043int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc);
1044void * X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx);
1045int X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, int crit,
1046 unsigned long flags);
1047
1048int X509_REVOKED_get_ext_count(X509_REVOKED *x);
1049int X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos);
1050int X509_REVOKED_get_ext_by_OBJ(X509_REVOKED *x,ASN1_OBJECT *obj,int lastpos);
1051int X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos);
1052X509_EXTENSION *X509_REVOKED_get_ext(X509_REVOKED *x, int loc);
1053X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, int loc);
1054int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc);
1055void * X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx);
1056int X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, void *value, int crit,
1057 unsigned long flags);
1058
1059X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
1060 int nid, int crit, ASN1_OCTET_STRING *data);
1061X509_EXTENSION *X509_EXTENSION_create_by_OBJ(X509_EXTENSION **ex,
1062 ASN1_OBJECT *obj,int crit,ASN1_OCTET_STRING *data);
1063int X509_EXTENSION_set_object(X509_EXTENSION *ex,ASN1_OBJECT *obj);
1064int X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit);
1065int X509_EXTENSION_set_data(X509_EXTENSION *ex,
1066 ASN1_OCTET_STRING *data);
1067ASN1_OBJECT * X509_EXTENSION_get_object(X509_EXTENSION *ex);
1068ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne);
1069int X509_EXTENSION_get_critical(X509_EXTENSION *ex);
1070
1071int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x);
1072int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
1073 int lastpos);
1074int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
1075 int lastpos);
1076X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc);
1077X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc);
1078STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
1079 X509_ATTRIBUTE *attr);
1080STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
1081 const ASN1_OBJECT *obj, int type,
1082 const unsigned char *bytes, int len);
1083STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
1084 int nid, int type,
1085 const unsigned char *bytes, int len);
1086STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
1087 const char *attrname, int type,
1088 const unsigned char *bytes, int len);
1089void *X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x,
1090 ASN1_OBJECT *obj, int lastpos, int type);
1091X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
1092 int atrtype, const void *data, int len);
1093X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
1094 const ASN1_OBJECT *obj, int atrtype, const void *data, int len);
1095X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
1096 const char *atrname, int type, const unsigned char *bytes, int len);
1097int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj);
1098int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data, int len);
1099void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
1100 int atrtype, void *data);
1101int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr);
1102ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr);
1103ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx);
1104
1105int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
1106int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid,
1107 int lastpos);
1108int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, ASN1_OBJECT *obj,
1109 int lastpos);
1110X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
1111X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
1112int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
1113int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
1114 const ASN1_OBJECT *obj, int type,
1115 const unsigned char *bytes, int len);
1116int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
1117 int nid, int type,
1118 const unsigned char *bytes, int len);
1119int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
1120 const char *attrname, int type,
1121 const unsigned char *bytes, int len);
1122
1123int X509_verify_cert(X509_STORE_CTX *ctx);
1124
1125/* lookup a cert from a X509 STACK */
1126X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk,X509_NAME *name,
1127 ASN1_INTEGER *serial);
1128X509 *X509_find_by_subject(STACK_OF(X509) *sk,X509_NAME *name);
1129
1130DECLARE_ASN1_FUNCTIONS(PBEPARAM)
1131DECLARE_ASN1_FUNCTIONS(PBE2PARAM)
1132DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM)
1133
1134int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
1135 const unsigned char *salt, int saltlen);
1136
1137X509_ALGOR *PKCS5_pbe_set(int alg, int iter,
1138 const unsigned char *salt, int saltlen);
1139X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
1140 unsigned char *salt, int saltlen);
1141X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
1142 unsigned char *salt, int saltlen,
1143 unsigned char *aiv, int prf_nid);
1144
1145X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,
1146 int prf_nid, int keylen);
1147
1148/* PKCS#8 utilities */
1149
1150DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
1151
1152EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8);
1153PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
1154PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
1155PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
1156
1157int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
1158 int version, int ptype, void *pval,
1159 unsigned char *penc, int penclen);
1160int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg,
1161 const unsigned char **pk, int *ppklen,
1162 X509_ALGOR **pa,
1163 PKCS8_PRIV_KEY_INFO *p8);
1164
1165int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
1166 int ptype, void *pval,
1167 unsigned char *penc, int penclen);
1168int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
1169 const unsigned char **pk, int *ppklen,
1170 X509_ALGOR **pa,
1171 X509_PUBKEY *pub);
1172
1173int X509_check_trust(X509 *x, int id, int flags);
1174int X509_TRUST_get_count(void);
1175X509_TRUST * X509_TRUST_get0(int idx);
1176int X509_TRUST_get_by_id(int id);
1177int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
1178 char *name, int arg1, void *arg2);
1179void X509_TRUST_cleanup(void);
1180int X509_TRUST_get_flags(X509_TRUST *xp);
1181char *X509_TRUST_get0_name(X509_TRUST *xp);
1182int X509_TRUST_get_trust(X509_TRUST *xp);
1183
1184/* BEGIN ERROR CODES */
1185/* The following lines are auto generated by the script mkerr.pl. Any changes
1186 * made after this point may be overwritten when the script is next run.
1187 */
1188void ERR_load_X509_strings(void);
1189
1190/* Error codes for the X509 functions. */
1191
1192/* Function codes. */
1193#define X509_F_ADD_CERT_DIR 100
1194#define X509_F_BY_FILE_CTRL 101
1195#define X509_F_CHECK_POLICY 145
1196#define X509_F_DIR_CTRL 102
1197#define X509_F_GET_CERT_BY_SUBJECT 103
1198#define X509_F_NETSCAPE_SPKI_B64_DECODE 129
1199#define X509_F_NETSCAPE_SPKI_B64_ENCODE 130
1200#define X509_F_X509AT_ADD1_ATTR 135
1201#define X509_F_X509V3_ADD_EXT 104
1202#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID 136
1203#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ 137
1204#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT 140
1205#define X509_F_X509_ATTRIBUTE_GET0_DATA 139
1206#define X509_F_X509_ATTRIBUTE_SET1_DATA 138
1207#define X509_F_X509_CHECK_PRIVATE_KEY 128
1208#define X509_F_X509_CRL_PRINT_FP 147
1209#define X509_F_X509_EXTENSION_CREATE_BY_NID 108
1210#define X509_F_X509_EXTENSION_CREATE_BY_OBJ 109
1211#define X509_F_X509_GET_PUBKEY_PARAMETERS 110
1212#define X509_F_X509_LOAD_CERT_CRL_FILE 132
1213#define X509_F_X509_LOAD_CERT_FILE 111
1214#define X509_F_X509_LOAD_CRL_FILE 112
1215#define X509_F_X509_NAME_ADD_ENTRY 113
1216#define X509_F_X509_NAME_ENTRY_CREATE_BY_NID 114
1217#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT 131
1218#define X509_F_X509_NAME_ENTRY_SET_OBJECT 115
1219#define X509_F_X509_NAME_ONELINE 116
1220#define X509_F_X509_NAME_PRINT 117
1221#define X509_F_X509_PRINT_EX_FP 118
1222#define X509_F_X509_PUBKEY_GET 119
1223#define X509_F_X509_PUBKEY_SET 120
1224#define X509_F_X509_REQ_CHECK_PRIVATE_KEY 144
1225#define X509_F_X509_REQ_PRINT_EX 121
1226#define X509_F_X509_REQ_PRINT_FP 122
1227#define X509_F_X509_REQ_TO_X509 123
1228#define X509_F_X509_STORE_ADD_CERT 124
1229#define X509_F_X509_STORE_ADD_CRL 125
1230#define X509_F_X509_STORE_CTX_GET1_ISSUER 146
1231#define X509_F_X509_STORE_CTX_INIT 143
1232#define X509_F_X509_STORE_CTX_NEW 142
1233#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT 134
1234#define X509_F_X509_TO_X509_REQ 126
1235#define X509_F_X509_TRUST_ADD 133
1236#define X509_F_X509_TRUST_SET 141
1237#define X509_F_X509_VERIFY_CERT 127
1238
1239/* Reason codes. */
1240#define X509_R_BAD_X509_FILETYPE 100
1241#define X509_R_BASE64_DECODE_ERROR 118
1242#define X509_R_CANT_CHECK_DH_KEY 114
1243#define X509_R_CERT_ALREADY_IN_HASH_TABLE 101
1244#define X509_R_ERR_ASN1_LIB 102
1245#define X509_R_INVALID_DIRECTORY 113
1246#define X509_R_INVALID_FIELD_NAME 119
1247#define X509_R_INVALID_TRUST 123
1248#define X509_R_KEY_TYPE_MISMATCH 115
1249#define X509_R_KEY_VALUES_MISMATCH 116
1250#define X509_R_LOADING_CERT_DIR 103
1251#define X509_R_LOADING_DEFAULTS 104
1252#define X509_R_METHOD_NOT_SUPPORTED 124
1253#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105
1254#define X509_R_PUBLIC_KEY_DECODE_ERROR 125
1255#define X509_R_PUBLIC_KEY_ENCODE_ERROR 126
1256#define X509_R_SHOULD_RETRY 106
1257#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN 107
1258#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY 108
1259#define X509_R_UNKNOWN_KEY_TYPE 117
1260#define X509_R_UNKNOWN_NID 109
1261#define X509_R_UNKNOWN_PURPOSE_ID 121
1262#define X509_R_UNKNOWN_TRUST_ID 120
1263#define X509_R_UNSUPPORTED_ALGORITHM 111
1264#define X509_R_WRONG_LOOKUP_TYPE 112
1265#define X509_R_WRONG_TYPE 122
1266
1267#ifdef __cplusplus
1268}
1269#endif
1270#endif
diff --git a/src/lib/libcrypto/x509/x509_att.c b/src/lib/libcrypto/x509/x509_att.c
deleted file mode 100644
index ab11e79b0a..0000000000
--- a/src/lib/libcrypto/x509/x509_att.c
+++ /dev/null
@@ -1,403 +0,0 @@
1/* $OpenBSD: x509_att.c,v 1.14 2016/03/21 04:05:33 mmcc Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/err.h>
63#include <openssl/evp.h>
64#include <openssl/objects.h>
65#include <openssl/stack.h>
66#include <openssl/x509.h>
67#include <openssl/x509v3.h>
68
69int
70X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x)
71{
72 return sk_X509_ATTRIBUTE_num(x);
73}
74
75int
76X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid, int lastpos)
77{
78 ASN1_OBJECT *obj;
79
80 obj = OBJ_nid2obj(nid);
81 if (obj == NULL)
82 return (-2);
83 return (X509at_get_attr_by_OBJ(x, obj, lastpos));
84}
85
86int
87X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
88 int lastpos)
89{
90 int n;
91 X509_ATTRIBUTE *ex;
92
93 if (sk == NULL)
94 return (-1);
95 lastpos++;
96 if (lastpos < 0)
97 lastpos = 0;
98 n = sk_X509_ATTRIBUTE_num(sk);
99 for (; lastpos < n; lastpos++) {
100 ex = sk_X509_ATTRIBUTE_value(sk, lastpos);
101 if (OBJ_cmp(ex->object, obj) == 0)
102 return (lastpos);
103 }
104 return (-1);
105}
106
107X509_ATTRIBUTE *
108X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
109{
110 if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
111 return NULL;
112 else
113 return sk_X509_ATTRIBUTE_value(x, loc);
114}
115
116X509_ATTRIBUTE *
117X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)
118{
119 X509_ATTRIBUTE *ret;
120
121 if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
122 return (NULL);
123 ret = sk_X509_ATTRIBUTE_delete(x, loc);
124 return (ret);
125}
126
127STACK_OF(X509_ATTRIBUTE) *
128X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x, X509_ATTRIBUTE *attr)
129{
130 X509_ATTRIBUTE *new_attr = NULL;
131 STACK_OF(X509_ATTRIBUTE) *sk = NULL;
132
133 if (x == NULL) {
134 X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_PASSED_NULL_PARAMETER);
135 return (NULL);
136 }
137
138 if (*x == NULL) {
139 if ((sk = sk_X509_ATTRIBUTE_new_null()) == NULL)
140 goto err;
141 } else
142 sk = *x;
143
144 if ((new_attr = X509_ATTRIBUTE_dup(attr)) == NULL)
145 goto err2;
146 if (!sk_X509_ATTRIBUTE_push(sk, new_attr))
147 goto err;
148 if (*x == NULL)
149 *x = sk;
150 return (sk);
151
152err:
153 X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_MALLOC_FAILURE);
154err2:
155 if (new_attr != NULL)
156 X509_ATTRIBUTE_free(new_attr);
157 if (sk != NULL && sk != *x)
158 sk_X509_ATTRIBUTE_free(sk);
159 return (NULL);
160}
161
162STACK_OF(X509_ATTRIBUTE) *
163X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x, const ASN1_OBJECT *obj,
164 int type, const unsigned char *bytes, int len)
165{
166 X509_ATTRIBUTE *attr;
167 STACK_OF(X509_ATTRIBUTE) *ret;
168
169 attr = X509_ATTRIBUTE_create_by_OBJ(NULL, obj, type, bytes, len);
170 if (!attr)
171 return 0;
172 ret = X509at_add1_attr(x, attr);
173 X509_ATTRIBUTE_free(attr);
174 return ret;
175}
176
177STACK_OF(X509_ATTRIBUTE) *
178X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x, int nid, int type,
179 const unsigned char *bytes, int len)
180{
181 X509_ATTRIBUTE *attr;
182 STACK_OF(X509_ATTRIBUTE) *ret;
183
184 attr = X509_ATTRIBUTE_create_by_NID(NULL, nid, type, bytes, len);
185 if (!attr)
186 return 0;
187 ret = X509at_add1_attr(x, attr);
188 X509_ATTRIBUTE_free(attr);
189 return ret;
190}
191
192STACK_OF(X509_ATTRIBUTE) *
193X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x, const char *attrname,
194 int type, const unsigned char *bytes, int len)
195{
196 X509_ATTRIBUTE *attr;
197 STACK_OF(X509_ATTRIBUTE) *ret;
198
199 attr = X509_ATTRIBUTE_create_by_txt(NULL, attrname, type, bytes, len);
200 if (!attr)
201 return 0;
202 ret = X509at_add1_attr(x, attr);
203 X509_ATTRIBUTE_free(attr);
204 return ret;
205}
206
207void *
208X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x, ASN1_OBJECT *obj,
209 int lastpos, int type)
210{
211 int i;
212 X509_ATTRIBUTE *at;
213
214 i = X509at_get_attr_by_OBJ(x, obj, lastpos);
215 if (i == -1)
216 return NULL;
217 if ((lastpos <= -2) && (X509at_get_attr_by_OBJ(x, obj, i) != -1))
218 return NULL;
219 at = X509at_get_attr(x, i);
220 if (lastpos <= -3 && (X509_ATTRIBUTE_count(at) != 1))
221 return NULL;
222 return X509_ATTRIBUTE_get0_data(at, 0, type, NULL);
223}
224
225X509_ATTRIBUTE *
226X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid, int atrtype,
227 const void *data, int len)
228{
229 ASN1_OBJECT *obj;
230 X509_ATTRIBUTE *ret;
231
232 obj = OBJ_nid2obj(nid);
233 if (obj == NULL) {
234 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_NID,
235 X509_R_UNKNOWN_NID);
236 return (NULL);
237 }
238 ret = X509_ATTRIBUTE_create_by_OBJ(attr, obj, atrtype, data, len);
239 if (ret == NULL)
240 ASN1_OBJECT_free(obj);
241 return (ret);
242}
243
244X509_ATTRIBUTE *
245X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr, const ASN1_OBJECT *obj,
246 int atrtype, const void *data, int len)
247{
248 X509_ATTRIBUTE *ret;
249
250 if ((attr == NULL) || (*attr == NULL)) {
251 if ((ret = X509_ATTRIBUTE_new()) == NULL) {
252 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,
253 ERR_R_MALLOC_FAILURE);
254 return (NULL);
255 }
256 } else
257 ret= *attr;
258
259 if (!X509_ATTRIBUTE_set1_object(ret, obj))
260 goto err;
261 if (!X509_ATTRIBUTE_set1_data(ret, atrtype, data, len))
262 goto err;
263
264 if ((attr != NULL) && (*attr == NULL))
265 *attr = ret;
266 return (ret);
267
268err:
269 if ((attr == NULL) || (ret != *attr))
270 X509_ATTRIBUTE_free(ret);
271 return (NULL);
272}
273
274X509_ATTRIBUTE *
275X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr, const char *atrname,
276 int type, const unsigned char *bytes, int len)
277{
278 ASN1_OBJECT *obj;
279 X509_ATTRIBUTE *nattr;
280
281 obj = OBJ_txt2obj(atrname, 0);
282 if (obj == NULL) {
283 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
284 X509_R_INVALID_FIELD_NAME);
285 ERR_asprintf_error_data("name=%s", atrname);
286 return (NULL);
287 }
288 nattr = X509_ATTRIBUTE_create_by_OBJ(attr, obj, type, bytes, len);
289 ASN1_OBJECT_free(obj);
290 return nattr;
291}
292
293int
294X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj)
295{
296 if ((attr == NULL) || (obj == NULL))
297 return (0);
298 ASN1_OBJECT_free(attr->object);
299 attr->object = OBJ_dup(obj);
300 return attr->object != NULL;
301}
302
303int
304X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data,
305 int len)
306{
307 ASN1_TYPE *ttmp = NULL;
308 ASN1_STRING *stmp = NULL;
309 int atype = 0;
310
311 if (!attr)
312 return 0;
313 if (attrtype & MBSTRING_FLAG) {
314 stmp = ASN1_STRING_set_by_NID(NULL, data, len, attrtype,
315 OBJ_obj2nid(attr->object));
316 if (!stmp) {
317 X509err(X509_F_X509_ATTRIBUTE_SET1_DATA,
318 ERR_R_ASN1_LIB);
319 return 0;
320 }
321 atype = stmp->type;
322 } else if (len != -1){
323 if (!(stmp = ASN1_STRING_type_new(attrtype)))
324 goto err;
325 if (!ASN1_STRING_set(stmp, data, len))
326 goto err;
327 atype = attrtype;
328 }
329 if (!(attr->value.set = sk_ASN1_TYPE_new_null()))
330 goto err;
331 attr->single = 0;
332 /* This is a bit naughty because the attribute should really have
333 * at least one value but some types use and zero length SET and
334 * require this.
335 */
336 if (attrtype == 0) {
337 ASN1_STRING_free(stmp);
338 return 1;
339 }
340
341 if (!(ttmp = ASN1_TYPE_new()))
342 goto err;
343 if ((len == -1) && !(attrtype & MBSTRING_FLAG)) {
344 if (!ASN1_TYPE_set1(ttmp, attrtype, data))
345 goto err;
346 } else
347 ASN1_TYPE_set(ttmp, atype, stmp);
348 if (!sk_ASN1_TYPE_push(attr->value.set, ttmp))
349 goto err;
350 return 1;
351
352err:
353 ASN1_TYPE_free(ttmp);
354 ASN1_STRING_free(stmp);
355 X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_MALLOC_FAILURE);
356 return 0;
357}
358
359int
360X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr)
361{
362 if (!attr->single)
363 return sk_ASN1_TYPE_num(attr->value.set);
364 if (attr->value.single)
365 return 1;
366 return 0;
367}
368
369ASN1_OBJECT *
370X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr)
371{
372 if (attr == NULL)
373 return (NULL);
374 return (attr->object);
375}
376
377void *
378X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx, int atrtype, void *data)
379{
380 ASN1_TYPE *ttmp;
381
382 ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
383 if (!ttmp)
384 return NULL;
385 if (atrtype != ASN1_TYPE_get(ttmp)){
386 X509err(X509_F_X509_ATTRIBUTE_GET0_DATA, X509_R_WRONG_TYPE);
387 return NULL;
388 }
389 return ttmp->value.ptr;
390}
391
392ASN1_TYPE *
393X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx)
394{
395 if (attr == NULL)
396 return (NULL);
397 if (idx >= X509_ATTRIBUTE_count(attr))
398 return NULL;
399 if (!attr->single)
400 return sk_ASN1_TYPE_value(attr->value.set, idx);
401 else
402 return attr->value.single;
403}
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
deleted file mode 100644
index 407e1e07ad..0000000000
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ /dev/null
@@ -1,369 +0,0 @@
1/* $OpenBSD: x509_cmp.c,v 1.26 2015/07/29 14:58:34 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <ctype.h>
60#include <stdio.h>
61#include <string.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/asn1.h>
66#include <openssl/err.h>
67#include <openssl/objects.h>
68#include <openssl/x509.h>
69#include <openssl/x509v3.h>
70
71int
72X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
73{
74 int i;
75 X509_CINF *ai, *bi;
76
77 ai = a->cert_info;
78 bi = b->cert_info;
79 i = ASN1_STRING_cmp(ai->serialNumber, bi->serialNumber);
80 if (i)
81 return (i);
82 return (X509_NAME_cmp(ai->issuer, bi->issuer));
83}
84
85#ifndef OPENSSL_NO_MD5
86unsigned long
87X509_issuer_and_serial_hash(X509 *a)
88{
89 unsigned long ret = 0;
90 EVP_MD_CTX ctx;
91 unsigned char md[16];
92 char *f;
93
94 EVP_MD_CTX_init(&ctx);
95 f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0);
96 if (f == NULL)
97 goto err;
98 if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
99 goto err;
100 if (!EVP_DigestUpdate(&ctx, (unsigned char *)f, strlen(f)))
101 goto err;
102 free(f);
103 f = NULL;
104 if (!EVP_DigestUpdate(&ctx,
105 (unsigned char *)a->cert_info->serialNumber->data,
106 (unsigned long)a->cert_info->serialNumber->length))
107 goto err;
108 if (!EVP_DigestFinal_ex(&ctx, &(md[0]), NULL))
109 goto err;
110 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
111 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
112 0xffffffffL;
113
114err:
115 EVP_MD_CTX_cleanup(&ctx);
116 free(f);
117 return (ret);
118}
119#endif
120
121int
122X509_issuer_name_cmp(const X509 *a, const X509 *b)
123{
124 return (X509_NAME_cmp(a->cert_info->issuer, b->cert_info->issuer));
125}
126
127int
128X509_subject_name_cmp(const X509 *a, const X509 *b)
129{
130 return (X509_NAME_cmp(a->cert_info->subject, b->cert_info->subject));
131}
132
133int
134X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
135{
136 return (X509_NAME_cmp(a->crl->issuer, b->crl->issuer));
137}
138
139#ifndef OPENSSL_NO_SHA
140int
141X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
142{
143 return memcmp(a->sha1_hash, b->sha1_hash, 20);
144}
145#endif
146
147X509_NAME *
148X509_get_issuer_name(X509 *a)
149{
150 return (a->cert_info->issuer);
151}
152
153unsigned long
154X509_issuer_name_hash(X509 *x)
155{
156 return (X509_NAME_hash(x->cert_info->issuer));
157}
158
159#ifndef OPENSSL_NO_MD5
160unsigned long
161X509_issuer_name_hash_old(X509 *x)
162{
163 return (X509_NAME_hash_old(x->cert_info->issuer));
164}
165#endif
166
167X509_NAME *
168X509_get_subject_name(X509 *a)
169{
170 return (a->cert_info->subject);
171}
172
173ASN1_INTEGER *
174X509_get_serialNumber(X509 *a)
175{
176 return (a->cert_info->serialNumber);
177}
178
179unsigned long
180X509_subject_name_hash(X509 *x)
181{
182 return (X509_NAME_hash(x->cert_info->subject));
183}
184
185#ifndef OPENSSL_NO_MD5
186unsigned long
187X509_subject_name_hash_old(X509 *x)
188{
189 return (X509_NAME_hash_old(x->cert_info->subject));
190}
191#endif
192
193#ifndef OPENSSL_NO_SHA
194/* Compare two certificates: they must be identical for
195 * this to work. NB: Although "cmp" operations are generally
196 * prototyped to take "const" arguments (eg. for use in
197 * STACKs), the way X509 handling is - these operations may
198 * involve ensuring the hashes are up-to-date and ensuring
199 * certain cert information is cached. So this is the point
200 * where the "depth-first" constification tree has to halt
201 * with an evil cast.
202 */
203int
204X509_cmp(const X509 *a, const X509 *b)
205{
206 /* ensure hash is valid */
207 X509_check_purpose((X509 *)a, -1, 0);
208 X509_check_purpose((X509 *)b, -1, 0);
209
210 return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
211}
212#endif
213
214int
215X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
216{
217 int ret;
218
219 /* Ensure canonical encoding is present and up to date */
220 if (!a->canon_enc || a->modified) {
221 ret = i2d_X509_NAME((X509_NAME *)a, NULL);
222 if (ret < 0)
223 return -2;
224 }
225 if (!b->canon_enc || b->modified) {
226 ret = i2d_X509_NAME((X509_NAME *)b, NULL);
227 if (ret < 0)
228 return -2;
229 }
230 ret = a->canon_enclen - b->canon_enclen;
231 if (ret)
232 return ret;
233 return memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);
234}
235
236unsigned long
237X509_NAME_hash(X509_NAME *x)
238{
239 unsigned long ret = 0;
240 unsigned char md[SHA_DIGEST_LENGTH];
241
242 /* Make sure X509_NAME structure contains valid cached encoding */
243 i2d_X509_NAME(x, NULL);
244 if (!EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(),
245 NULL))
246 return 0;
247
248 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
249 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
250 0xffffffffL;
251 return (ret);
252}
253
254
255#ifndef OPENSSL_NO_MD5
256/* I now DER encode the name and hash it. Since I cache the DER encoding,
257 * this is reasonably efficient. */
258
259unsigned long
260X509_NAME_hash_old(X509_NAME *x)
261{
262 EVP_MD_CTX md_ctx;
263 unsigned long ret = 0;
264 unsigned char md[16];
265
266 /* Make sure X509_NAME structure contains valid cached encoding */
267 i2d_X509_NAME(x, NULL);
268 EVP_MD_CTX_init(&md_ctx);
269 if (EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL) &&
270 EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length) &&
271 EVP_DigestFinal_ex(&md_ctx, md, NULL))
272 ret = (((unsigned long)md[0]) |
273 ((unsigned long)md[1] << 8L) |
274 ((unsigned long)md[2] << 16L) |
275 ((unsigned long)md[3] << 24L)) &
276 0xffffffffL;
277 EVP_MD_CTX_cleanup(&md_ctx);
278
279 return (ret);
280}
281#endif
282
283/* Search a stack of X509 for a match */
284X509 *
285X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
286 ASN1_INTEGER *serial)
287{
288 int i;
289 X509_CINF cinf;
290 X509 x, *x509 = NULL;
291
292 if (!sk)
293 return NULL;
294
295 x.cert_info = &cinf;
296 cinf.serialNumber = serial;
297 cinf.issuer = name;
298
299 for (i = 0; i < sk_X509_num(sk); i++) {
300 x509 = sk_X509_value(sk, i);
301 if (X509_issuer_and_serial_cmp(x509, &x) == 0)
302 return (x509);
303 }
304 return (NULL);
305}
306
307X509 *
308X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name)
309{
310 X509 *x509;
311 int i;
312
313 for (i = 0; i < sk_X509_num(sk); i++) {
314 x509 = sk_X509_value(sk, i);
315 if (X509_NAME_cmp(X509_get_subject_name(x509), name) == 0)
316 return (x509);
317 }
318 return (NULL);
319}
320
321EVP_PKEY *
322X509_get_pubkey(X509 *x)
323{
324 if ((x == NULL) || (x->cert_info == NULL))
325 return (NULL);
326 return (X509_PUBKEY_get(x->cert_info->key));
327}
328
329ASN1_BIT_STRING *
330X509_get0_pubkey_bitstr(const X509 *x)
331{
332 if (!x)
333 return NULL;
334 return x->cert_info->key->public_key;
335}
336
337int
338X509_check_private_key(X509 *x, EVP_PKEY *k)
339{
340 EVP_PKEY *xk;
341 int ret;
342
343 xk = X509_get_pubkey(x);
344
345 if (xk)
346 ret = EVP_PKEY_cmp(xk, k);
347 else
348 ret = -2;
349
350 switch (ret) {
351 case 1:
352 break;
353 case 0:
354 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
355 X509_R_KEY_VALUES_MISMATCH);
356 break;
357 case -1:
358 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
359 X509_R_KEY_TYPE_MISMATCH);
360 break;
361 case -2:
362 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
363 X509_R_UNKNOWN_KEY_TYPE);
364 }
365 EVP_PKEY_free(xk);
366 if (ret > 0)
367 return 1;
368 return 0;
369}
diff --git a/src/lib/libcrypto/x509/x509_d2.c b/src/lib/libcrypto/x509/x509_d2.c
deleted file mode 100644
index 5b0f80adda..0000000000
--- a/src/lib/libcrypto/x509/x509_d2.c
+++ /dev/null
@@ -1,128 +0,0 @@
1/* $OpenBSD: x509_d2.c,v 1.10 2015/01/22 09:06:39 reyk Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <sys/uio.h>
61
62#include <openssl/crypto.h>
63#include <openssl/err.h>
64#include <openssl/x509.h>
65
66int
67X509_STORE_set_default_paths(X509_STORE *ctx)
68{
69 X509_LOOKUP *lookup;
70
71 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
72 if (lookup == NULL)
73 return (0);
74 X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
75
76 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
77 if (lookup == NULL)
78 return (0);
79 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
80
81 /* clear any errors */
82 ERR_clear_error();
83
84 return (1);
85}
86
87int
88X509_STORE_load_locations(X509_STORE *ctx, const char *file, const char *path)
89{
90 X509_LOOKUP *lookup;
91
92 if (file != NULL) {
93 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
94 if (lookup == NULL)
95 return (0);
96 if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)
97 return (0);
98 }
99 if (path != NULL) {
100 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
101 if (lookup == NULL)
102 return (0);
103 if (X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1)
104 return (0);
105 }
106 if ((path == NULL) && (file == NULL))
107 return (0);
108 return (1);
109}
110
111int
112X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len)
113{
114 X509_LOOKUP *lookup;
115 struct iovec iov;
116
117 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_mem());
118 if (lookup == NULL)
119 return (0);
120
121 iov.iov_base = buf;
122 iov.iov_len = len;
123
124 if (X509_LOOKUP_add_mem(lookup, &iov, X509_FILETYPE_PEM) != 1)
125 return (0);
126
127 return (1);
128}
diff --git a/src/lib/libcrypto/x509/x509_def.c b/src/lib/libcrypto/x509/x509_def.c
deleted file mode 100644
index 5e570eb9a2..0000000000
--- a/src/lib/libcrypto/x509/x509_def.c
+++ /dev/null
@@ -1,98 +0,0 @@
1/* $OpenBSD: x509_def.c,v 1.5 2014/06/12 15:49:31 deraadt Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include "cryptlib.h"
61#include <openssl/crypto.h>
62#include <openssl/x509.h>
63
64const char *
65X509_get_default_private_dir(void)
66{
67 return (X509_PRIVATE_DIR);
68}
69
70const char *
71X509_get_default_cert_area(void)
72{
73 return (X509_CERT_AREA);
74}
75
76const char *
77X509_get_default_cert_dir(void)
78{
79 return (X509_CERT_DIR);
80}
81
82const char *
83X509_get_default_cert_file(void)
84{
85 return (X509_CERT_FILE);
86}
87
88const char *
89X509_get_default_cert_dir_env(void)
90{
91 return (X509_CERT_DIR_EVP);
92}
93
94const char *
95X509_get_default_cert_file_env(void)
96{
97 return (X509_CERT_FILE_EVP);
98}
diff --git a/src/lib/libcrypto/x509/x509_err.c b/src/lib/libcrypto/x509/x509_err.c
deleted file mode 100644
index 6a15ac9fd0..0000000000
--- a/src/lib/libcrypto/x509/x509_err.c
+++ /dev/null
@@ -1,164 +0,0 @@
1/* $OpenBSD: x509_err.c,v 1.12 2014/07/10 22:45:58 jsing Exp $ */
2/* ====================================================================
3 * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@OpenSSL.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 *
50 * This product includes cryptographic software written by Eric Young
51 * (eay@cryptsoft.com). This product includes software written by Tim
52 * Hudson (tjh@cryptsoft.com).
53 *
54 */
55
56/* NOTE: this file was auto generated by the mkerr.pl script: any changes
57 * made to it will be overwritten when the script next updates this file,
58 * only reason strings will be preserved.
59 */
60
61#include <stdio.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/err.h>
66#include <openssl/x509.h>
67
68/* BEGIN ERROR CODES */
69#ifndef OPENSSL_NO_ERR
70
71#define ERR_FUNC(func) ERR_PACK(ERR_LIB_X509,func,0)
72#define ERR_REASON(reason) ERR_PACK(ERR_LIB_X509,0,reason)
73
74static ERR_STRING_DATA X509_str_functs[] = {
75 {ERR_FUNC(X509_F_ADD_CERT_DIR), "ADD_CERT_DIR"},
76 {ERR_FUNC(X509_F_BY_FILE_CTRL), "BY_FILE_CTRL"},
77 {ERR_FUNC(X509_F_CHECK_POLICY), "CHECK_POLICY"},
78 {ERR_FUNC(X509_F_DIR_CTRL), "DIR_CTRL"},
79 {ERR_FUNC(X509_F_GET_CERT_BY_SUBJECT), "GET_CERT_BY_SUBJECT"},
80 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_DECODE), "NETSCAPE_SPKI_b64_decode"},
81 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_ENCODE), "NETSCAPE_SPKI_b64_encode"},
82 {ERR_FUNC(X509_F_X509AT_ADD1_ATTR), "X509at_add1_attr"},
83 {ERR_FUNC(X509_F_X509V3_ADD_EXT), "X509v3_add_ext"},
84 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_NID), "X509_ATTRIBUTE_create_by_NID"},
85 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ), "X509_ATTRIBUTE_create_by_OBJ"},
86 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT), "X509_ATTRIBUTE_create_by_txt"},
87 {ERR_FUNC(X509_F_X509_ATTRIBUTE_GET0_DATA), "X509_ATTRIBUTE_get0_data"},
88 {ERR_FUNC(X509_F_X509_ATTRIBUTE_SET1_DATA), "X509_ATTRIBUTE_set1_data"},
89 {ERR_FUNC(X509_F_X509_CHECK_PRIVATE_KEY), "X509_check_private_key"},
90 {ERR_FUNC(X509_F_X509_CRL_PRINT_FP), "X509_CRL_print_fp"},
91 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_NID), "X509_EXTENSION_create_by_NID"},
92 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_OBJ), "X509_EXTENSION_create_by_OBJ"},
93 {ERR_FUNC(X509_F_X509_GET_PUBKEY_PARAMETERS), "X509_get_pubkey_parameters"},
94 {ERR_FUNC(X509_F_X509_LOAD_CERT_CRL_FILE), "X509_load_cert_crl_file"},
95 {ERR_FUNC(X509_F_X509_LOAD_CERT_FILE), "X509_load_cert_file"},
96 {ERR_FUNC(X509_F_X509_LOAD_CRL_FILE), "X509_load_crl_file"},
97 {ERR_FUNC(X509_F_X509_NAME_ADD_ENTRY), "X509_NAME_add_entry"},
98 {ERR_FUNC(X509_F_X509_NAME_ENTRY_CREATE_BY_NID), "X509_NAME_ENTRY_create_by_NID"},
99 {ERR_FUNC(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT), "X509_NAME_ENTRY_create_by_txt"},
100 {ERR_FUNC(X509_F_X509_NAME_ENTRY_SET_OBJECT), "X509_NAME_ENTRY_set_object"},
101 {ERR_FUNC(X509_F_X509_NAME_ONELINE), "X509_NAME_oneline"},
102 {ERR_FUNC(X509_F_X509_NAME_PRINT), "X509_NAME_print"},
103 {ERR_FUNC(X509_F_X509_PRINT_EX_FP), "X509_print_ex_fp"},
104 {ERR_FUNC(X509_F_X509_PUBKEY_GET), "X509_PUBKEY_get"},
105 {ERR_FUNC(X509_F_X509_PUBKEY_SET), "X509_PUBKEY_set"},
106 {ERR_FUNC(X509_F_X509_REQ_CHECK_PRIVATE_KEY), "X509_REQ_check_private_key"},
107 {ERR_FUNC(X509_F_X509_REQ_PRINT_EX), "X509_REQ_print_ex"},
108 {ERR_FUNC(X509_F_X509_REQ_PRINT_FP), "X509_REQ_print_fp"},
109 {ERR_FUNC(X509_F_X509_REQ_TO_X509), "X509_REQ_to_X509"},
110 {ERR_FUNC(X509_F_X509_STORE_ADD_CERT), "X509_STORE_add_cert"},
111 {ERR_FUNC(X509_F_X509_STORE_ADD_CRL), "X509_STORE_add_crl"},
112 {ERR_FUNC(X509_F_X509_STORE_CTX_GET1_ISSUER), "X509_STORE_CTX_get1_issuer"},
113 {ERR_FUNC(X509_F_X509_STORE_CTX_INIT), "X509_STORE_CTX_init"},
114 {ERR_FUNC(X509_F_X509_STORE_CTX_NEW), "X509_STORE_CTX_new"},
115 {ERR_FUNC(X509_F_X509_STORE_CTX_PURPOSE_INHERIT), "X509_STORE_CTX_purpose_inherit"},
116 {ERR_FUNC(X509_F_X509_TO_X509_REQ), "X509_to_X509_REQ"},
117 {ERR_FUNC(X509_F_X509_TRUST_ADD), "X509_TRUST_add"},
118 {ERR_FUNC(X509_F_X509_TRUST_SET), "X509_TRUST_set"},
119 {ERR_FUNC(X509_F_X509_VERIFY_CERT), "X509_verify_cert"},
120 {0, NULL}
121};
122
123static ERR_STRING_DATA X509_str_reasons[] = {
124 {ERR_REASON(X509_R_BAD_X509_FILETYPE) , "bad x509 filetype"},
125 {ERR_REASON(X509_R_BASE64_DECODE_ERROR) , "base64 decode error"},
126 {ERR_REASON(X509_R_CANT_CHECK_DH_KEY) , "cant check dh key"},
127 {ERR_REASON(X509_R_CERT_ALREADY_IN_HASH_TABLE), "cert already in hash table"},
128 {ERR_REASON(X509_R_ERR_ASN1_LIB) , "err asn1 lib"},
129 {ERR_REASON(X509_R_INVALID_DIRECTORY) , "invalid directory"},
130 {ERR_REASON(X509_R_INVALID_FIELD_NAME) , "invalid field name"},
131 {ERR_REASON(X509_R_INVALID_TRUST) , "invalid trust"},
132 {ERR_REASON(X509_R_KEY_TYPE_MISMATCH) , "key type mismatch"},
133 {ERR_REASON(X509_R_KEY_VALUES_MISMATCH) , "key values mismatch"},
134 {ERR_REASON(X509_R_LOADING_CERT_DIR) , "loading cert dir"},
135 {ERR_REASON(X509_R_LOADING_DEFAULTS) , "loading defaults"},
136 {ERR_REASON(X509_R_METHOD_NOT_SUPPORTED) , "method not supported"},
137 {ERR_REASON(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY), "no cert set for us to verify"},
138 {ERR_REASON(X509_R_PUBLIC_KEY_DECODE_ERROR), "public key decode error"},
139 {ERR_REASON(X509_R_PUBLIC_KEY_ENCODE_ERROR), "public key encode error"},
140 {ERR_REASON(X509_R_SHOULD_RETRY) , "should retry"},
141 {ERR_REASON(X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN), "unable to find parameters in chain"},
142 {ERR_REASON(X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY), "unable to get certs public key"},
143 {ERR_REASON(X509_R_UNKNOWN_KEY_TYPE) , "unknown key type"},
144 {ERR_REASON(X509_R_UNKNOWN_NID) , "unknown nid"},
145 {ERR_REASON(X509_R_UNKNOWN_PURPOSE_ID) , "unknown purpose id"},
146 {ERR_REASON(X509_R_UNKNOWN_TRUST_ID) , "unknown trust id"},
147 {ERR_REASON(X509_R_UNSUPPORTED_ALGORITHM), "unsupported algorithm"},
148 {ERR_REASON(X509_R_WRONG_LOOKUP_TYPE) , "wrong lookup type"},
149 {ERR_REASON(X509_R_WRONG_TYPE) , "wrong type"},
150 {0, NULL}
151};
152
153#endif
154
155void
156ERR_load_X509_strings(void)
157{
158#ifndef OPENSSL_NO_ERR
159 if (ERR_func_error_string(X509_str_functs[0].error) == NULL) {
160 ERR_load_strings(0, X509_str_functs);
161 ERR_load_strings(0, X509_str_reasons);
162 }
163#endif
164}
diff --git a/src/lib/libcrypto/x509/x509_ext.c b/src/lib/libcrypto/x509/x509_ext.c
deleted file mode 100644
index e90befaba1..0000000000
--- a/src/lib/libcrypto/x509/x509_ext.c
+++ /dev/null
@@ -1,232 +0,0 @@
1/* $OpenBSD: x509_ext.c,v 1.9 2015/02/10 08:33:10 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/stack.h>
65#include <openssl/x509.h>
66#include <openssl/x509v3.h>
67
68int
69X509_CRL_get_ext_count(X509_CRL *x)
70{
71 return (X509v3_get_ext_count(x->crl->extensions));
72}
73
74int
75X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos)
76{
77 return (X509v3_get_ext_by_NID(x->crl->extensions, nid, lastpos));
78}
79
80int
81X509_CRL_get_ext_by_OBJ(X509_CRL *x, ASN1_OBJECT *obj, int lastpos)
82{
83 return (X509v3_get_ext_by_OBJ(x->crl->extensions, obj, lastpos));
84}
85
86int
87X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos)
88{
89 return (X509v3_get_ext_by_critical(x->crl->extensions, crit, lastpos));
90}
91
92X509_EXTENSION *
93X509_CRL_get_ext(X509_CRL *x, int loc)
94{
95 return (X509v3_get_ext(x->crl->extensions, loc));
96}
97
98X509_EXTENSION *
99X509_CRL_delete_ext(X509_CRL *x, int loc)
100{
101 return (X509v3_delete_ext(x->crl->extensions, loc));
102}
103
104void *
105X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx)
106{
107 return X509V3_get_d2i(x->crl->extensions, nid, crit, idx);
108}
109
110int
111X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, int crit,
112 unsigned long flags)
113{
114 return X509V3_add1_i2d(&x->crl->extensions, nid, value, crit, flags);
115}
116
117int
118X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc)
119{
120 return (X509v3_add_ext(&(x->crl->extensions), ex, loc) != NULL);
121}
122
123int
124X509_get_ext_count(X509 *x)
125{
126 return (X509v3_get_ext_count(x->cert_info->extensions));
127}
128
129int
130X509_get_ext_by_NID(X509 *x, int nid, int lastpos)
131{
132 return (X509v3_get_ext_by_NID(x->cert_info->extensions, nid, lastpos));
133}
134
135int
136X509_get_ext_by_OBJ(X509 *x, ASN1_OBJECT *obj, int lastpos)
137{
138 return (X509v3_get_ext_by_OBJ(x->cert_info->extensions, obj, lastpos));
139}
140
141int
142X509_get_ext_by_critical(X509 *x, int crit, int lastpos)
143{
144 return (X509v3_get_ext_by_critical(x->cert_info->extensions, crit,
145 lastpos));
146}
147
148X509_EXTENSION *
149X509_get_ext(X509 *x, int loc)
150{
151 return (X509v3_get_ext(x->cert_info->extensions, loc));
152}
153
154X509_EXTENSION *
155X509_delete_ext(X509 *x, int loc)
156{
157 return (X509v3_delete_ext(x->cert_info->extensions, loc));
158}
159
160int
161X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc)
162{
163 return (X509v3_add_ext(&(x->cert_info->extensions), ex, loc) != NULL);
164}
165
166void *
167X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
168{
169 return X509V3_get_d2i(x->cert_info->extensions, nid, crit, idx);
170}
171
172int
173X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit, unsigned long flags)
174{
175 return X509V3_add1_i2d(&x->cert_info->extensions, nid, value, crit,
176 flags);
177}
178
179int
180X509_REVOKED_get_ext_count(X509_REVOKED *x)
181{
182 return (X509v3_get_ext_count(x->extensions));
183}
184
185int
186X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos)
187{
188 return (X509v3_get_ext_by_NID(x->extensions, nid, lastpos));
189}
190
191int
192X509_REVOKED_get_ext_by_OBJ(X509_REVOKED *x, ASN1_OBJECT *obj, int lastpos)
193{
194 return (X509v3_get_ext_by_OBJ(x->extensions, obj, lastpos));
195}
196
197int
198X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos)
199{
200 return (X509v3_get_ext_by_critical(x->extensions, crit, lastpos));
201}
202
203X509_EXTENSION *
204X509_REVOKED_get_ext(X509_REVOKED *x, int loc)
205{
206 return (X509v3_get_ext(x->extensions, loc));
207}
208
209X509_EXTENSION *
210X509_REVOKED_delete_ext(X509_REVOKED *x, int loc)
211{
212 return (X509v3_delete_ext(x->extensions, loc));
213}
214
215int
216X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc)
217{
218 return (X509v3_add_ext(&(x->extensions), ex, loc) != NULL);
219}
220
221void *
222X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx)
223{
224 return X509V3_get_d2i(x->extensions, nid, crit, idx);
225}
226
227int
228X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, void *value, int crit,
229 unsigned long flags)
230{
231 return X509V3_add1_i2d(&x->extensions, nid, value, crit, flags);
232}
diff --git a/src/lib/libcrypto/x509/x509_lcl.h b/src/lib/libcrypto/x509/x509_lcl.h
deleted file mode 100644
index 9ffdd01e61..0000000000
--- a/src/lib/libcrypto/x509/x509_lcl.h
+++ /dev/null
@@ -1,61 +0,0 @@
1/* x509_lcl.h */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2013.
4 */
5/* ====================================================================
6 * Copyright (c) 2013 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet);
60int asn1_time_parse(const char *, size_t, struct tm *, int);
61int asn1_tm_cmp(struct tm *tm1, struct tm *tm2);
diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
deleted file mode 100644
index fdb10023be..0000000000
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ /dev/null
@@ -1,739 +0,0 @@
1/* $OpenBSD: x509_lu.c,v 1.20 2015/04/25 16:02:55 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/err.h>
62#include <openssl/lhash.h>
63#include <openssl/x509.h>
64#include <openssl/x509v3.h>
65#include "x509_lcl.h"
66
67X509_LOOKUP *
68X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
69{
70 X509_LOOKUP *ret;
71
72 ret = malloc(sizeof(X509_LOOKUP));
73 if (ret == NULL)
74 return NULL;
75
76 ret->init = 0;
77 ret->skip = 0;
78 ret->method = method;
79 ret->method_data = NULL;
80 ret->store_ctx = NULL;
81 if ((method->new_item != NULL) && !method->new_item(ret)) {
82 free(ret);
83 return NULL;
84 }
85 return ret;
86}
87
88void
89X509_LOOKUP_free(X509_LOOKUP *ctx)
90{
91 if (ctx == NULL)
92 return;
93 if ((ctx->method != NULL) && (ctx->method->free != NULL))
94 (*ctx->method->free)(ctx);
95 free(ctx);
96}
97
98int
99X509_LOOKUP_init(X509_LOOKUP *ctx)
100{
101 if (ctx->method == NULL)
102 return 0;
103 if (ctx->method->init != NULL)
104 return ctx->method->init(ctx);
105 else
106 return 1;
107}
108
109int
110X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
111{
112 if (ctx->method == NULL)
113 return 0;
114 if (ctx->method->shutdown != NULL)
115 return ctx->method->shutdown(ctx);
116 else
117 return 1;
118}
119
120int
121X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
122 char **ret)
123{
124 if (ctx->method == NULL)
125 return -1;
126 if (ctx->method->ctrl != NULL)
127 return ctx->method->ctrl(ctx, cmd, argc, argl, ret);
128 else
129 return 1;
130}
131
132int
133X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
134 X509_OBJECT *ret)
135{
136 if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
137 return X509_LU_FAIL;
138 if (ctx->skip)
139 return 0;
140 return ctx->method->get_by_subject(ctx, type, name, ret);
141}
142
143int
144X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
145 ASN1_INTEGER *serial, X509_OBJECT *ret)
146{
147 if ((ctx->method == NULL) ||
148 (ctx->method->get_by_issuer_serial == NULL))
149 return X509_LU_FAIL;
150 return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret);
151}
152
153int
154X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type, unsigned char *bytes,
155 int len, X509_OBJECT *ret)
156{
157 if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL))
158 return X509_LU_FAIL;
159 return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret);
160}
161
162int
163X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, char *str, int len,
164 X509_OBJECT *ret)
165{
166 if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL))
167 return X509_LU_FAIL;
168 return ctx->method->get_by_alias(ctx, type, str, len, ret);
169}
170
171static int
172x509_object_cmp(const X509_OBJECT * const *a, const X509_OBJECT * const *b)
173{
174 int ret;
175
176 ret = ((*a)->type - (*b)->type);
177 if (ret)
178 return ret;
179 switch ((*a)->type) {
180 case X509_LU_X509:
181 ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);
182 break;
183 case X509_LU_CRL:
184 ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);
185 break;
186 default:
187 /* abort(); */
188 return 0;
189 }
190 return ret;
191}
192
193X509_STORE *
194X509_STORE_new(void)
195{
196 X509_STORE *ret;
197
198 if ((ret = malloc(sizeof(X509_STORE))) == NULL)
199 return NULL;
200 ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
201 ret->cache = 1;
202 ret->get_cert_methods = sk_X509_LOOKUP_new_null();
203 ret->verify = 0;
204 ret->verify_cb = 0;
205
206 if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
207 goto err;
208
209 ret->get_issuer = 0;
210 ret->check_issued = 0;
211 ret->check_revocation = 0;
212 ret->get_crl = 0;
213 ret->check_crl = 0;
214 ret->cert_crl = 0;
215 ret->lookup_certs = 0;
216 ret->lookup_crls = 0;
217 ret->cleanup = 0;
218
219 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
220 goto err;
221
222 ret->references = 1;
223 return ret;
224
225err:
226 X509_VERIFY_PARAM_free(ret->param);
227 sk_X509_LOOKUP_free(ret->get_cert_methods);
228 sk_X509_OBJECT_free(ret->objs);
229 free(ret);
230 return NULL;
231}
232
233static void
234cleanup(X509_OBJECT *a)
235{
236 if (a->type == X509_LU_X509) {
237 X509_free(a->data.x509);
238 } else if (a->type == X509_LU_CRL) {
239 X509_CRL_free(a->data.crl);
240 } else {
241 /* abort(); */
242 }
243
244 free(a);
245}
246
247void
248X509_STORE_free(X509_STORE *vfy)
249{
250 int i;
251 STACK_OF(X509_LOOKUP) *sk;
252 X509_LOOKUP *lu;
253
254 if (vfy == NULL)
255 return;
256
257 i = CRYPTO_add(&vfy->references, -1, CRYPTO_LOCK_X509_STORE);
258 if (i > 0)
259 return;
260
261 sk = vfy->get_cert_methods;
262 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
263 lu = sk_X509_LOOKUP_value(sk, i);
264 X509_LOOKUP_shutdown(lu);
265 X509_LOOKUP_free(lu);
266 }
267 sk_X509_LOOKUP_free(sk);
268 sk_X509_OBJECT_pop_free(vfy->objs, cleanup);
269
270 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
271 X509_VERIFY_PARAM_free(vfy->param);
272 free(vfy);
273}
274
275X509_LOOKUP *
276X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
277{
278 int i;
279 STACK_OF(X509_LOOKUP) *sk;
280 X509_LOOKUP *lu;
281
282 sk = v->get_cert_methods;
283 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
284 lu = sk_X509_LOOKUP_value(sk, i);
285 if (m == lu->method) {
286 return lu;
287 }
288 }
289 /* a new one */
290 lu = X509_LOOKUP_new(m);
291 if (lu == NULL)
292 return NULL;
293 else {
294 lu->store_ctx = v;
295 if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))
296 return lu;
297 else {
298 X509_LOOKUP_free(lu);
299 return NULL;
300 }
301 }
302}
303
304int
305X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
306 X509_OBJECT *ret)
307{
308 X509_STORE *ctx = vs->ctx;
309 X509_LOOKUP *lu;
310 X509_OBJECT stmp, *tmp;
311 int i, j;
312
313 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
314 tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
315 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
316
317 if (tmp == NULL || type == X509_LU_CRL) {
318 for (i = vs->current_method;
319 i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
320 lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
321 j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
322 if (j < 0) {
323 vs->current_method = j;
324 return j;
325 } else if (j) {
326 tmp = &stmp;
327 break;
328 }
329 }
330 vs->current_method = 0;
331 if (tmp == NULL)
332 return 0;
333 }
334
335/* if (ret->data.ptr != NULL)
336 X509_OBJECT_free_contents(ret); */
337
338 ret->type = tmp->type;
339 ret->data.ptr = tmp->data.ptr;
340
341 X509_OBJECT_up_ref_count(ret);
342
343 return 1;
344}
345
346int
347X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
348{
349 X509_OBJECT *obj;
350 int ret = 1;
351
352 if (x == NULL)
353 return 0;
354 obj = malloc(sizeof(X509_OBJECT));
355 if (obj == NULL) {
356 X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
357 return 0;
358 }
359 obj->type = X509_LU_X509;
360 obj->data.x509 = x;
361
362 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
363
364 X509_OBJECT_up_ref_count(obj);
365
366 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
367 X509_OBJECT_free_contents(obj);
368 free(obj);
369 X509err(X509_F_X509_STORE_ADD_CERT,
370 X509_R_CERT_ALREADY_IN_HASH_TABLE);
371 ret = 0;
372 } else
373 sk_X509_OBJECT_push(ctx->objs, obj);
374
375 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
376
377 return ret;
378}
379
380int
381X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
382{
383 X509_OBJECT *obj;
384 int ret = 1;
385
386 if (x == NULL)
387 return 0;
388 obj = malloc(sizeof(X509_OBJECT));
389 if (obj == NULL) {
390 X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
391 return 0;
392 }
393 obj->type = X509_LU_CRL;
394 obj->data.crl = x;
395
396 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
397
398 X509_OBJECT_up_ref_count(obj);
399
400 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
401 X509_OBJECT_free_contents(obj);
402 free(obj);
403 X509err(X509_F_X509_STORE_ADD_CRL,
404 X509_R_CERT_ALREADY_IN_HASH_TABLE);
405 ret = 0;
406 } else
407 sk_X509_OBJECT_push(ctx->objs, obj);
408
409 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
410
411 return ret;
412}
413
414void
415X509_OBJECT_up_ref_count(X509_OBJECT *a)
416{
417 switch (a->type) {
418 case X509_LU_X509:
419 CRYPTO_add(&a->data.x509->references, 1, CRYPTO_LOCK_X509);
420 break;
421 case X509_LU_CRL:
422 CRYPTO_add(&a->data.crl->references, 1, CRYPTO_LOCK_X509_CRL);
423 break;
424 }
425}
426
427void
428X509_OBJECT_free_contents(X509_OBJECT *a)
429{
430 switch (a->type) {
431 case X509_LU_X509:
432 X509_free(a->data.x509);
433 break;
434 case X509_LU_CRL:
435 X509_CRL_free(a->data.crl);
436 break;
437 }
438}
439
440static int
441x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name,
442 int *pnmatch)
443{
444 X509_OBJECT stmp;
445 X509 x509_s;
446 X509_CINF cinf_s;
447 X509_CRL crl_s;
448 X509_CRL_INFO crl_info_s;
449 int idx;
450
451 stmp.type = type;
452 switch (type) {
453 case X509_LU_X509:
454 stmp.data.x509 = &x509_s;
455 x509_s.cert_info = &cinf_s;
456 cinf_s.subject = name;
457 break;
458 case X509_LU_CRL:
459 stmp.data.crl = &crl_s;
460 crl_s.crl = &crl_info_s;
461 crl_info_s.issuer = name;
462 break;
463 default:
464 /* abort(); */
465 return -1;
466 }
467
468 idx = sk_X509_OBJECT_find(h, &stmp);
469 if (idx >= 0 && pnmatch) {
470 int tidx;
471 const X509_OBJECT *tobj, *pstmp;
472 *pnmatch = 1;
473 pstmp = &stmp;
474 for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
475 tobj = sk_X509_OBJECT_value(h, tidx);
476 if (x509_object_cmp(&tobj, &pstmp))
477 break;
478 (*pnmatch)++;
479 }
480 }
481 return idx;
482}
483
484int
485X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name)
486{
487 return x509_object_idx_cnt(h, type, name, NULL);
488}
489
490X509_OBJECT *
491X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
492 X509_NAME *name)
493{
494 int idx;
495
496 idx = X509_OBJECT_idx_by_subject(h, type, name);
497 if (idx == -1)
498 return NULL;
499 return sk_X509_OBJECT_value(h, idx);
500}
501
502STACK_OF(X509) *
503X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
504{
505 int i, idx, cnt;
506 STACK_OF(X509) *sk;
507 X509 *x;
508 X509_OBJECT *obj;
509
510 sk = sk_X509_new_null();
511 if (sk == NULL)
512 return NULL;
513 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
514 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
515 if (idx < 0) {
516 /* Nothing found in cache: do lookup to possibly add new
517 * objects to cache
518 */
519 X509_OBJECT xobj;
520 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
521 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
522 sk_X509_free(sk);
523 return NULL;
524 }
525 X509_OBJECT_free_contents(&xobj);
526 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
527 idx = x509_object_idx_cnt(ctx->ctx->objs,
528 X509_LU_X509, nm, &cnt);
529 if (idx < 0) {
530 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
531 sk_X509_free(sk);
532 return NULL;
533 }
534 }
535 for (i = 0; i < cnt; i++, idx++) {
536 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
537 x = obj->data.x509;
538 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
539 if (!sk_X509_push(sk, x)) {
540 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
541 X509_free(x);
542 sk_X509_pop_free(sk, X509_free);
543 return NULL;
544 }
545 }
546 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
547 return sk;
548
549}
550
551STACK_OF(X509_CRL) *
552X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
553{
554 int i, idx, cnt;
555 STACK_OF(X509_CRL) *sk;
556 X509_CRL *x;
557 X509_OBJECT *obj, xobj;
558
559 sk = sk_X509_CRL_new_null();
560 if (sk == NULL)
561 return NULL;
562 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
563 /* Check cache first */
564 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
565
566 /* Always do lookup to possibly add new CRLs to cache
567 */
568 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
569 if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
570 sk_X509_CRL_free(sk);
571 return NULL;
572 }
573 X509_OBJECT_free_contents(&xobj);
574 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
575 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
576 if (idx < 0) {
577 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
578 sk_X509_CRL_free(sk);
579 return NULL;
580 }
581
582 for (i = 0; i < cnt; i++, idx++) {
583 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
584 x = obj->data.crl;
585 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
586 if (!sk_X509_CRL_push(sk, x)) {
587 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
588 X509_CRL_free(x);
589 sk_X509_CRL_pop_free(sk, X509_CRL_free);
590 return NULL;
591 }
592 }
593 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
594 return sk;
595}
596
597X509_OBJECT *
598X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
599{
600 int idx, i;
601 X509_OBJECT *obj;
602
603 idx = sk_X509_OBJECT_find(h, x);
604 if (idx == -1)
605 return NULL;
606 if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
607 return sk_X509_OBJECT_value(h, idx);
608 for (i = idx; i < sk_X509_OBJECT_num(h); i++) {
609 obj = sk_X509_OBJECT_value(h, i);
610 if (x509_object_cmp((const X509_OBJECT **)&obj,
611 (const X509_OBJECT **)&x))
612 return NULL;
613 if (x->type == X509_LU_X509) {
614 if (!X509_cmp(obj->data.x509, x->data.x509))
615 return obj;
616 } else if (x->type == X509_LU_CRL) {
617 if (!X509_CRL_match(obj->data.crl, x->data.crl))
618 return obj;
619 } else
620 return obj;
621 }
622 return NULL;
623}
624
625
626/* Try to get issuer certificate from store. Due to limitations
627 * of the API this can only retrieve a single certificate matching
628 * a given subject name. However it will fill the cache with all
629 * matching certificates, so we can examine the cache for all
630 * matches.
631 *
632 * Return values are:
633 * 1 lookup successful.
634 * 0 certificate not found.
635 * -1 some other error.
636 */
637int
638X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
639{
640 X509_NAME *xn;
641 X509_OBJECT obj, *pobj;
642 int i, ok, idx, ret;
643
644 *issuer = NULL;
645 xn = X509_get_issuer_name(x);
646 ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
647 if (ok != X509_LU_X509) {
648 if (ok == X509_LU_RETRY) {
649 X509_OBJECT_free_contents(&obj);
650 X509err(X509_F_X509_STORE_CTX_GET1_ISSUER,
651 X509_R_SHOULD_RETRY);
652 return -1;
653 } else if (ok != X509_LU_FAIL) {
654 X509_OBJECT_free_contents(&obj);
655 /* not good :-(, break anyway */
656 return -1;
657 }
658 return 0;
659 }
660 /* If certificate matches all OK */
661 if (ctx->check_issued(ctx, x, obj.data.x509)) {
662 if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
663 *issuer = obj.data.x509;
664 return 1;
665 }
666 }
667 X509_OBJECT_free_contents(&obj);
668
669 /* Else find index of first cert accepted by 'check_issued' */
670 ret = 0;
671 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
672 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
673 if (idx != -1) /* should be true as we've had at least one match */ {
674 /* Look through all matching certs for suitable issuer */
675 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
676 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
677 /* See if we've run past the matches */
678 if (pobj->type != X509_LU_X509)
679 break;
680 if (X509_NAME_cmp(xn,
681 X509_get_subject_name(pobj->data.x509)))
682 break;
683 if (ctx->check_issued(ctx, x, pobj->data.x509)) {
684 *issuer = pobj->data.x509;
685 ret = 1;
686 /*
687 * If times check, exit with match,
688 * otherwise keep looking. Leave last
689 * match in issuer so we return nearest
690 * match if no certificate time is OK.
691 */
692 if (x509_check_cert_time(ctx, *issuer, 1))
693 break;
694 }
695 }
696 }
697 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
698 if (*issuer)
699 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
700 return ret;
701}
702
703int
704X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
705{
706 return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
707}
708
709int
710X509_STORE_set_depth(X509_STORE *ctx, int depth)
711{
712 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
713 return 1;
714}
715
716int
717X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
718{
719 return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
720}
721
722int
723X509_STORE_set_trust(X509_STORE *ctx, int trust)
724{
725 return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
726}
727
728int
729X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
730{
731 return X509_VERIFY_PARAM_set1(ctx->param, param);
732}
733
734void
735X509_STORE_set_verify_cb(X509_STORE *ctx,
736 int (*verify_cb)(int, X509_STORE_CTX *))
737{
738 ctx->verify_cb = verify_cb;
739}
diff --git a/src/lib/libcrypto/x509/x509_obj.c b/src/lib/libcrypto/x509/x509_obj.c
deleted file mode 100644
index f7f2a380a1..0000000000
--- a/src/lib/libcrypto/x509/x509_obj.c
+++ /dev/null
@@ -1,179 +0,0 @@
1/* $OpenBSD: x509_obj.c,v 1.16 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/buffer.h>
63#include <openssl/err.h>
64#include <openssl/lhash.h>
65#include <openssl/objects.h>
66#include <openssl/x509.h>
67
68char *
69X509_NAME_oneline(X509_NAME *a, char *buf, int len)
70{
71 X509_NAME_ENTRY *ne;
72 int i;
73 int n, lold, l, l1, l2, num, j, type;
74 const char *s;
75 char *p;
76 unsigned char *q;
77 BUF_MEM *b = NULL;
78 static const char hex[17] = "0123456789ABCDEF";
79 int gs_doit[4];
80 char tmp_buf[80];
81
82 if (buf == NULL) {
83 if ((b = BUF_MEM_new()) == NULL)
84 goto err;
85 if (!BUF_MEM_grow(b, 200))
86 goto err;
87 b->data[0] = '\0';
88 len = 200;
89 }
90 if (a == NULL) {
91 if (b) {
92 buf = b->data;
93 free(b);
94 }
95 strlcpy(buf, "NO X509_NAME", len);
96 return buf;
97 }
98
99 len--; /* space for '\0' */
100 l = 0;
101 for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
102 ne = sk_X509_NAME_ENTRY_value(a->entries, i);
103 n = OBJ_obj2nid(ne->object);
104 if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {
105 i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);
106 s = tmp_buf;
107 }
108 l1 = strlen(s);
109
110 type = ne->value->type;
111 num = ne->value->length;
112 q = ne->value->data;
113 if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {
114 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;
115 for (j = 0; j < num; j++)
116 if (q[j] != 0)
117 gs_doit[j & 3] = 1;
118
119 if (gs_doit[0]|gs_doit[1]|gs_doit[2])
120 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
121 else {
122 gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;
123 gs_doit[3] = 1;
124 }
125 } else
126 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
127
128 for (l2 = j=0; j < num; j++) {
129 if (!gs_doit[j&3])
130 continue;
131 l2++;
132 if ((q[j] < ' ') || (q[j] > '~'))
133 l2 += 3;
134 }
135
136 lold = l;
137 l += 1 + l1 + 1 + l2;
138 if (b != NULL) {
139 if (!BUF_MEM_grow(b, l + 1))
140 goto err;
141 p = &(b->data[lold]);
142 } else if (l > len) {
143 break;
144 } else
145 p = &(buf[lold]);
146 *(p++) = '/';
147 memcpy(p, s, l1);
148 p += l1;
149 *(p++) = '=';
150 q = ne->value->data;
151 for (j = 0; j < num; j++) {
152 if (!gs_doit[j & 3])
153 continue;
154 n = q[j];
155 if ((n < ' ') || (n > '~')) {
156 *(p++) = '\\';
157 *(p++) = 'x';
158 *(p++) = hex[(n >> 4) & 0x0f];
159 *(p++) = hex[n & 0x0f];
160 } else
161 *(p++) = n;
162 }
163 *p = '\0';
164 }
165 if (b != NULL) {
166 p = b->data;
167 free(b);
168 } else
169 p = buf;
170 if (i == 0)
171 *p = '\0';
172 return (p);
173
174err:
175 X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
176 if (b != NULL)
177 BUF_MEM_free(b);
178 return (NULL);
179}
diff --git a/src/lib/libcrypto/x509/x509_r2x.c b/src/lib/libcrypto/x509/x509_r2x.c
deleted file mode 100644
index 76faa29b7f..0000000000
--- a/src/lib/libcrypto/x509/x509_r2x.c
+++ /dev/null
@@ -1,115 +0,0 @@
1/* $OpenBSD: x509_r2x.c,v 1.10 2015/09/30 17:30:16 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/bn.h>
63#include <openssl/buffer.h>
64#include <openssl/err.h>
65#include <openssl/evp.h>
66#include <openssl/objects.h>
67#include <openssl/x509.h>
68
69X509 *
70X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
71{
72 X509 *ret = NULL;
73 X509_CINF *xi = NULL;
74 X509_NAME *xn;
75
76 if ((ret = X509_new()) == NULL) {
77 X509err(X509_F_X509_REQ_TO_X509, ERR_R_MALLOC_FAILURE);
78 goto err;
79 }
80
81 /* duplicate the request */
82 xi = ret->cert_info;
83
84 if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0) {
85 if ((xi->version = ASN1_INTEGER_new()) == NULL)
86 goto err;
87 if (!ASN1_INTEGER_set(xi->version, 2))
88 goto err;
89/* xi->extensions=ri->attributes; <- bad, should not ever be done
90 ri->attributes=NULL; */
91 }
92
93 xn = X509_REQ_get_subject_name(r);
94 if (X509_set_subject_name(ret, X509_NAME_dup(xn)) == 0)
95 goto err;
96 if (X509_set_issuer_name(ret, X509_NAME_dup(xn)) == 0)
97 goto err;
98
99 if (X509_gmtime_adj(xi->validity->notBefore, 0) == NULL)
100 goto err;
101 if (X509_gmtime_adj(xi->validity->notAfter,
102 (long)60 * 60 * 24 * days) == NULL)
103 goto err;
104
105 X509_set_pubkey(ret, X509_REQ_get_pubkey(r));
106
107 if (!X509_sign(ret, pkey, EVP_md5()))
108 goto err;
109 if (0) {
110err:
111 X509_free(ret);
112 ret = NULL;
113 }
114 return (ret);
115}
diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
deleted file mode 100644
index dc4bc2639a..0000000000
--- a/src/lib/libcrypto/x509/x509_req.c
+++ /dev/null
@@ -1,347 +0,0 @@
1/* $OpenBSD: x509_req.c,v 1.18 2015/09/30 17:30:16 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/asn1.h>
64#include <openssl/asn1t.h>
65#include <openssl/bn.h>
66#include <openssl/buffer.h>
67#include <openssl/err.h>
68#include <openssl/evp.h>
69#include <openssl/objects.h>
70#include <openssl/pem.h>
71#include <openssl/x509.h>
72
73X509_REQ *
74X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
75{
76 X509_REQ *ret;
77 X509_REQ_INFO *ri;
78 int i;
79 EVP_PKEY *pktmp;
80
81 ret = X509_REQ_new();
82 if (ret == NULL) {
83 X509err(X509_F_X509_TO_X509_REQ, ERR_R_MALLOC_FAILURE);
84 goto err;
85 }
86
87 ri = ret->req_info;
88
89 if ((ri->version = ASN1_INTEGER_new()) == NULL)
90 goto err;
91 if (ASN1_INTEGER_set(ri->version, 0) == 0)
92 goto err;
93
94 if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
95 goto err;
96
97 if ((pktmp = X509_get_pubkey(x)) == NULL)
98 goto err;
99
100 i = X509_REQ_set_pubkey(ret, pktmp);
101 EVP_PKEY_free(pktmp);
102 if (!i)
103 goto err;
104
105 if (pkey != NULL) {
106 if (!X509_REQ_sign(ret, pkey, md))
107 goto err;
108 }
109 return (ret);
110
111err:
112 X509_REQ_free(ret);
113 return (NULL);
114}
115
116EVP_PKEY *
117X509_REQ_get_pubkey(X509_REQ *req)
118{
119 if ((req == NULL) || (req->req_info == NULL))
120 return (NULL);
121 return (X509_PUBKEY_get(req->req_info->pubkey));
122}
123
124int
125X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
126{
127 EVP_PKEY *xk = NULL;
128 int ok = 0;
129
130 xk = X509_REQ_get_pubkey(x);
131 switch (EVP_PKEY_cmp(xk, k)) {
132 case 1:
133 ok = 1;
134 break;
135 case 0:
136 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
137 X509_R_KEY_VALUES_MISMATCH);
138 break;
139 case -1:
140 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
141 X509_R_KEY_TYPE_MISMATCH);
142 break;
143 case -2:
144#ifndef OPENSSL_NO_EC
145 if (k->type == EVP_PKEY_EC) {
146 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
147 ERR_R_EC_LIB);
148 break;
149 }
150#endif
151#ifndef OPENSSL_NO_DH
152 if (k->type == EVP_PKEY_DH) {
153 /* No idea */
154 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
155 X509_R_CANT_CHECK_DH_KEY);
156 break;
157 }
158#endif
159 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
160 X509_R_UNKNOWN_KEY_TYPE);
161 }
162
163 EVP_PKEY_free(xk);
164 return (ok);
165}
166
167/* It seems several organisations had the same idea of including a list of
168 * extensions in a certificate request. There are at least two OIDs that are
169 * used and there may be more: so the list is configurable.
170 */
171
172static int ext_nid_list[] = {NID_ext_req, NID_ms_ext_req, NID_undef};
173
174static int *ext_nids = ext_nid_list;
175
176int
177X509_REQ_extension_nid(int req_nid)
178{
179 int i, nid;
180
181 for (i = 0; ; i++) {
182 nid = ext_nids[i];
183 if (nid == NID_undef)
184 return 0;
185 else if (req_nid == nid)
186 return 1;
187 }
188}
189
190int *
191X509_REQ_get_extension_nids(void)
192{
193 return ext_nids;
194}
195
196void
197X509_REQ_set_extension_nids(int *nids)
198{
199 ext_nids = nids;
200}
201
202STACK_OF(X509_EXTENSION) *
203X509_REQ_get_extensions(X509_REQ *req)
204{
205 X509_ATTRIBUTE *attr;
206 ASN1_TYPE *ext = NULL;
207 int idx, *pnid;
208 const unsigned char *p;
209
210 if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
211 return (NULL);
212 for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
213 idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
214 if (idx == -1)
215 continue;
216 attr = X509_REQ_get_attr(req, idx);
217 if (attr->single)
218 ext = attr->value.single;
219 else if (sk_ASN1_TYPE_num(attr->value.set))
220 ext = sk_ASN1_TYPE_value(attr->value.set, 0);
221 break;
222 }
223 if (!ext || (ext->type != V_ASN1_SEQUENCE))
224 return NULL;
225 p = ext->value.sequence->data;
226 return (STACK_OF(X509_EXTENSION) *)ASN1_item_d2i(NULL, &p,
227 ext->value.sequence->length, ASN1_ITEM_rptr(X509_EXTENSIONS));
228}
229
230/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
231 * in case we want to create a non standard one.
232 */
233
234int
235X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
236 int nid)
237{
238 ASN1_TYPE *at = NULL;
239 X509_ATTRIBUTE *attr = NULL;
240
241 if (!(at = ASN1_TYPE_new()) ||
242 !(at->value.sequence = ASN1_STRING_new()))
243 goto err;
244
245 at->type = V_ASN1_SEQUENCE;
246 /* Generate encoding of extensions */
247 at->value.sequence->length = ASN1_item_i2d((ASN1_VALUE *)exts,
248 &at->value.sequence->data, ASN1_ITEM_rptr(X509_EXTENSIONS));
249 if (!(attr = X509_ATTRIBUTE_new()))
250 goto err;
251 if (!(attr->value.set = sk_ASN1_TYPE_new_null()))
252 goto err;
253 if (!sk_ASN1_TYPE_push(attr->value.set, at))
254 goto err;
255 at = NULL;
256 attr->single = 0;
257 attr->object = OBJ_nid2obj(nid);
258 if (!req->req_info->attributes) {
259 if (!(req->req_info->attributes = sk_X509_ATTRIBUTE_new_null()))
260 goto err;
261 }
262 if (!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr))
263 goto err;
264 return 1;
265
266err:
267 X509_ATTRIBUTE_free(attr);
268 ASN1_TYPE_free(at);
269 return 0;
270}
271
272/* This is the normal usage: use the "official" OID */
273int
274X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
275{
276 return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
277}
278
279/* Request attribute functions */
280
281int
282X509_REQ_get_attr_count(const X509_REQ *req)
283{
284 return X509at_get_attr_count(req->req_info->attributes);
285}
286
287int
288X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
289{
290 return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
291}
292
293int
294X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj, int lastpos)
295{
296 return X509at_get_attr_by_OBJ(req->req_info->attributes, obj, lastpos);
297}
298
299X509_ATTRIBUTE *
300X509_REQ_get_attr(const X509_REQ *req, int loc)
301{
302 return X509at_get_attr(req->req_info->attributes, loc);
303}
304
305X509_ATTRIBUTE *
306X509_REQ_delete_attr(X509_REQ *req, int loc)
307{
308 return X509at_delete_attr(req->req_info->attributes, loc);
309}
310
311int
312X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
313{
314 if (X509at_add1_attr(&req->req_info->attributes, attr))
315 return 1;
316 return 0;
317}
318
319int
320X509_REQ_add1_attr_by_OBJ(X509_REQ *req, const ASN1_OBJECT *obj, int type,
321 const unsigned char *bytes, int len)
322{
323 if (X509at_add1_attr_by_OBJ(&req->req_info->attributes, obj,
324 type, bytes, len))
325 return 1;
326 return 0;
327}
328
329int
330X509_REQ_add1_attr_by_NID(X509_REQ *req, int nid, int type,
331 const unsigned char *bytes, int len)
332{
333 if (X509at_add1_attr_by_NID(&req->req_info->attributes, nid,
334 type, bytes, len))
335 return 1;
336 return 0;
337}
338
339int
340X509_REQ_add1_attr_by_txt(X509_REQ *req, const char *attrname, int type,
341 const unsigned char *bytes, int len)
342{
343 if (X509at_add1_attr_by_txt(&req->req_info->attributes, attrname,
344 type, bytes, len))
345 return 1;
346 return 0;
347}
diff --git a/src/lib/libcrypto/x509/x509_set.c b/src/lib/libcrypto/x509/x509_set.c
deleted file mode 100644
index aeaf161024..0000000000
--- a/src/lib/libcrypto/x509/x509_set.c
+++ /dev/null
@@ -1,154 +0,0 @@
1/* $OpenBSD: x509_set.c,v 1.12 2015/09/30 17:49:59 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_set_version(X509 *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 if (x->cert_info->version == NULL) {
72 if ((x->cert_info->version = ASN1_INTEGER_new()) == NULL)
73 return (0);
74 }
75 return (ASN1_INTEGER_set(x->cert_info->version, version));
76}
77
78int
79X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
80{
81 ASN1_INTEGER *in;
82
83 if (x == NULL)
84 return (0);
85 in = x->cert_info->serialNumber;
86 if (in != serial) {
87 in = ASN1_INTEGER_dup(serial);
88 if (in != NULL) {
89 ASN1_INTEGER_free(x->cert_info->serialNumber);
90 x->cert_info->serialNumber = in;
91 }
92 }
93 return (in != NULL);
94}
95
96int
97X509_set_issuer_name(X509 *x, X509_NAME *name)
98{
99 if ((x == NULL) || (x->cert_info == NULL))
100 return (0);
101 return (X509_NAME_set(&x->cert_info->issuer, name));
102}
103
104int
105X509_set_subject_name(X509 *x, X509_NAME *name)
106{
107 if ((x == NULL) || (x->cert_info == NULL))
108 return (0);
109 return (X509_NAME_set(&x->cert_info->subject, name));
110}
111
112int
113X509_set_notBefore(X509 *x, const ASN1_TIME *tm)
114{
115 ASN1_TIME *in;
116
117 if ((x == NULL) || (x->cert_info->validity == NULL))
118 return (0);
119 in = x->cert_info->validity->notBefore;
120 if (in != tm) {
121 in = ASN1_STRING_dup(tm);
122 if (in != NULL) {
123 ASN1_TIME_free(x->cert_info->validity->notBefore);
124 x->cert_info->validity->notBefore = in;
125 }
126 }
127 return (in != NULL);
128}
129
130int
131X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
132{
133 ASN1_TIME *in;
134
135 if ((x == NULL) || (x->cert_info->validity == NULL))
136 return (0);
137 in = x->cert_info->validity->notAfter;
138 if (in != tm) {
139 in = ASN1_STRING_dup(tm);
140 if (in != NULL) {
141 ASN1_TIME_free(x->cert_info->validity->notAfter);
142 x->cert_info->validity->notAfter = in;
143 }
144 }
145 return (in != NULL);
146}
147
148int
149X509_set_pubkey(X509 *x, EVP_PKEY *pkey)
150{
151 if ((x == NULL) || (x->cert_info == NULL))
152 return (0);
153 return (X509_PUBKEY_set(&(x->cert_info->key), pkey));
154}
diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
deleted file mode 100644
index 42fb97f571..0000000000
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ /dev/null
@@ -1,332 +0,0 @@
1/* $OpenBSD: x509_trs.c,v 1.20 2015/02/10 11:22:21 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/x509v3.h>
64
65static int tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b);
66static void trtable_free(X509_TRUST *p);
67
68static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
69static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
70static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
71
72static int obj_trust(int id, X509 *x, int flags);
73static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
74
75/* WARNING: the following table should be kept in order of trust
76 * and without any gaps so we can just subtract the minimum trust
77 * value to get an index into the table
78 */
79
80static X509_TRUST trstandard[] = {
81 {X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
82 {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
83 {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
84 {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
85 {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
86 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
87 {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
88 {X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
89};
90
91#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
92
93static STACK_OF(X509_TRUST) *trtable = NULL;
94
95static int
96tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b)
97{
98 return (*a)->trust - (*b)->trust;
99}
100
101int
102(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
103{
104 int (*oldtrust)(int , X509 *, int);
105
106 oldtrust = default_trust;
107 default_trust = trust;
108 return oldtrust;
109}
110
111int
112X509_check_trust(X509 *x, int id, int flags)
113{
114 X509_TRUST *pt;
115 int idx;
116
117 if (id == -1)
118 return 1;
119 idx = X509_TRUST_get_by_id(id);
120 if (idx == -1)
121 return default_trust(id, x, flags);
122 pt = X509_TRUST_get0(idx);
123 return pt->check_trust(pt, x, flags);
124}
125
126int
127X509_TRUST_get_count(void)
128{
129 if (!trtable)
130 return X509_TRUST_COUNT;
131 return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
132}
133
134X509_TRUST *
135X509_TRUST_get0(int idx)
136{
137 if (idx < 0)
138 return NULL;
139 if (idx < (int)X509_TRUST_COUNT)
140 return trstandard + idx;
141 return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
142}
143
144int
145X509_TRUST_get_by_id(int id)
146{
147 X509_TRUST tmp;
148 int idx;
149
150 if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
151 return id - X509_TRUST_MIN;
152 tmp.trust = id;
153 if (!trtable)
154 return -1;
155 idx = sk_X509_TRUST_find(trtable, &tmp);
156 if (idx == -1)
157 return -1;
158 return idx + X509_TRUST_COUNT;
159}
160
161int
162X509_TRUST_set(int *t, int trust)
163{
164 if (X509_TRUST_get_by_id(trust) == -1) {
165 X509err(X509_F_X509_TRUST_SET, X509_R_INVALID_TRUST);
166 return 0;
167 }
168 *t = trust;
169 return 1;
170}
171
172int
173X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
174 char *name, int arg1, void *arg2)
175{
176 int idx;
177 X509_TRUST *trtmp;
178 char *name_dup;
179
180 /* This is set according to what we change: application can't set it */
181 flags &= ~X509_TRUST_DYNAMIC;
182 /* This will always be set for application modified trust entries */
183 flags |= X509_TRUST_DYNAMIC_NAME;
184 /* Get existing entry if any */
185 idx = X509_TRUST_get_by_id(id);
186 /* Need a new entry */
187 if (idx == -1) {
188 if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
189 X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
190 return 0;
191 }
192 trtmp->flags = X509_TRUST_DYNAMIC;
193 } else {
194 trtmp = X509_TRUST_get0(idx);
195 if (trtmp == NULL) {
196 X509err(X509_F_X509_TRUST_ADD, X509_R_INVALID_TRUST);
197 return 0;
198 }
199 }
200
201 if ((name_dup = strdup(name)) == NULL)
202 goto err;
203
204 /* free existing name if dynamic */
205 if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
206 free(trtmp->name);
207 /* dup supplied name */
208 trtmp->name = name_dup;
209 /* Keep the dynamic flag of existing entry */
210 trtmp->flags &= X509_TRUST_DYNAMIC;
211 /* Set all other flags */
212 trtmp->flags |= flags;
213
214 trtmp->trust = id;
215 trtmp->check_trust = ck;
216 trtmp->arg1 = arg1;
217 trtmp->arg2 = arg2;
218
219 /* If it's a new entry, manage the dynamic table */
220 if (idx == -1) {
221 if (trtable == NULL &&
222 (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
223 goto err;
224 if (sk_X509_TRUST_push(trtable, trtmp) == 0)
225 goto err;
226 }
227 return 1;
228
229err:
230 free(name_dup);
231 if (idx == -1)
232 free(trtmp);
233 X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
234 return 0;
235}
236
237static void
238trtable_free(X509_TRUST *p)
239{
240 if (!p)
241 return;
242 if (p->flags & X509_TRUST_DYNAMIC) {
243 if (p->flags & X509_TRUST_DYNAMIC_NAME)
244 free(p->name);
245 free(p);
246 }
247}
248
249void
250X509_TRUST_cleanup(void)
251{
252 unsigned int i;
253
254 for (i = 0; i < X509_TRUST_COUNT; i++)
255 trtable_free(trstandard + i);
256 sk_X509_TRUST_pop_free(trtable, trtable_free);
257 trtable = NULL;
258}
259
260int
261X509_TRUST_get_flags(X509_TRUST *xp)
262{
263 return xp->flags;
264}
265
266char *
267X509_TRUST_get0_name(X509_TRUST *xp)
268{
269 return xp->name;
270}
271
272int
273X509_TRUST_get_trust(X509_TRUST *xp)
274{
275 return xp->trust;
276}
277
278static int
279trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
280{
281 if (x->aux && (x->aux->trust || x->aux->reject))
282 return obj_trust(trust->arg1, x, flags);
283 /* we don't have any trust settings: for compatibility
284 * we return trusted if it is self signed
285 */
286 return trust_compat(trust, x, flags);
287}
288
289static int
290trust_1oid(X509_TRUST *trust, X509 *x, int flags)
291{
292 if (x->aux)
293 return obj_trust(trust->arg1, x, flags);
294 return X509_TRUST_UNTRUSTED;
295}
296
297static int
298trust_compat(X509_TRUST *trust, X509 *x, int flags)
299{
300 X509_check_purpose(x, -1, 0);
301 if (x->ex_flags & EXFLAG_SS)
302 return X509_TRUST_TRUSTED;
303 else
304 return X509_TRUST_UNTRUSTED;
305}
306
307static int
308obj_trust(int id, X509 *x, int flags)
309{
310 ASN1_OBJECT *obj;
311 int i;
312 X509_CERT_AUX *ax;
313
314 ax = x->aux;
315 if (!ax)
316 return X509_TRUST_UNTRUSTED;
317 if (ax->reject) {
318 for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
319 obj = sk_ASN1_OBJECT_value(ax->reject, i);
320 if (OBJ_obj2nid(obj) == id)
321 return X509_TRUST_REJECTED;
322 }
323 }
324 if (ax->trust) {
325 for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
326 obj = sk_ASN1_OBJECT_value(ax->trust, i);
327 if (OBJ_obj2nid(obj) == id)
328 return X509_TRUST_TRUSTED;
329 }
330 }
331 return X509_TRUST_UNTRUSTED;
332}
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
deleted file mode 100644
index 14fa2378c4..0000000000
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ /dev/null
@@ -1,189 +0,0 @@
1/* $OpenBSD: x509_txt.c,v 1.19 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <time.h>
62
63#include <openssl/asn1.h>
64#include <openssl/buffer.h>
65#include <openssl/evp.h>
66#include <openssl/lhash.h>
67#include <openssl/objects.h>
68#include <openssl/x509.h>
69
70const char *
71X509_verify_cert_error_string(long n)
72{
73 static char buf[100];
74
75 switch ((int)n) {
76 case X509_V_OK:
77 return("ok");
78 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
79 return("unable to get issuer certificate");
80 case X509_V_ERR_UNABLE_TO_GET_CRL:
81 return("unable to get certificate CRL");
82 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
83 return("unable to decrypt certificate's signature");
84 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
85 return("unable to decrypt CRL's signature");
86 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
87 return("unable to decode issuer public key");
88 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
89 return("certificate signature failure");
90 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
91 return("CRL signature failure");
92 case X509_V_ERR_CERT_NOT_YET_VALID:
93 return("certificate is not yet valid");
94 case X509_V_ERR_CRL_NOT_YET_VALID:
95 return("CRL is not yet valid");
96 case X509_V_ERR_CERT_HAS_EXPIRED:
97 return("certificate has expired");
98 case X509_V_ERR_CRL_HAS_EXPIRED:
99 return("CRL has expired");
100 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
101 return("format error in certificate's notBefore field");
102 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
103 return("format error in certificate's notAfter field");
104 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
105 return("format error in CRL's lastUpdate field");
106 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
107 return("format error in CRL's nextUpdate field");
108 case X509_V_ERR_OUT_OF_MEM:
109 return("out of memory");
110 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
111 return("self signed certificate");
112 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
113 return("self signed certificate in certificate chain");
114 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
115 return("unable to get local issuer certificate");
116 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
117 return("unable to verify the first certificate");
118 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
119 return("certificate chain too long");
120 case X509_V_ERR_CERT_REVOKED:
121 return("certificate revoked");
122 case X509_V_ERR_INVALID_CA:
123 return ("invalid CA certificate");
124 case X509_V_ERR_INVALID_NON_CA:
125 return ("invalid non-CA certificate (has CA markings)");
126 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
127 return ("path length constraint exceeded");
128 case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
129 return("proxy path length constraint exceeded");
130 case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
131 return("proxy certificates not allowed, please set the appropriate flag");
132 case X509_V_ERR_INVALID_PURPOSE:
133 return ("unsupported certificate purpose");
134 case X509_V_ERR_CERT_UNTRUSTED:
135 return ("certificate not trusted");
136 case X509_V_ERR_CERT_REJECTED:
137 return ("certificate rejected");
138 case X509_V_ERR_APPLICATION_VERIFICATION:
139 return("application verification failure");
140 case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
141 return("subject issuer mismatch");
142 case X509_V_ERR_AKID_SKID_MISMATCH:
143 return("authority and subject key identifier mismatch");
144 case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
145 return("authority and issuer serial number mismatch");
146 case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
147 return("key usage does not include certificate signing");
148 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
149 return("unable to get CRL issuer certificate");
150 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
151 return("unhandled critical extension");
152 case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
153 return("key usage does not include CRL signing");
154 case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
155 return("key usage does not include digital signature");
156 case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
157 return("unhandled critical CRL extension");
158 case X509_V_ERR_INVALID_EXTENSION:
159 return("invalid or inconsistent certificate extension");
160 case X509_V_ERR_INVALID_POLICY_EXTENSION:
161 return("invalid or inconsistent certificate policy extension");
162 case X509_V_ERR_NO_EXPLICIT_POLICY:
163 return("no explicit policy");
164 case X509_V_ERR_DIFFERENT_CRL_SCOPE:
165 return("Different CRL scope");
166 case X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE:
167 return("Unsupported extension feature");
168 case X509_V_ERR_UNNESTED_RESOURCE:
169 return("RFC 3779 resource not subset of parent's resources");
170 case X509_V_ERR_PERMITTED_VIOLATION:
171 return("permitted subtree violation");
172 case X509_V_ERR_EXCLUDED_VIOLATION:
173 return("excluded subtree violation");
174 case X509_V_ERR_SUBTREE_MINMAX:
175 return("name constraints minimum and maximum not supported");
176 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:
177 return("unsupported name constraint type");
178 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX:
179 return("unsupported or invalid name constraint syntax");
180 case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX:
181 return("unsupported or invalid name syntax");
182 case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
183 return("CRL path validation error");
184
185 default:
186 (void) snprintf(buf, sizeof buf, "error number %ld", n);
187 return(buf);
188 }
189}
diff --git a/src/lib/libcrypto/x509/x509_v3.c b/src/lib/libcrypto/x509/x509_v3.c
deleted file mode 100644
index d9ec9c8c14..0000000000
--- a/src/lib/libcrypto/x509/x509_v3.c
+++ /dev/null
@@ -1,300 +0,0 @@
1/* $OpenBSD: x509_v3.c,v 1.13 2016/03/21 04:05:33 mmcc Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/err.h>
63#include <openssl/evp.h>
64#include <openssl/objects.h>
65#include <openssl/stack.h>
66#include <openssl/x509.h>
67#include <openssl/x509v3.h>
68
69int
70X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x)
71{
72 if (x == NULL)
73 return (0);
74 return (sk_X509_EXTENSION_num(x));
75}
76
77int
78X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x, int nid, int lastpos)
79{
80 ASN1_OBJECT *obj;
81
82 obj = OBJ_nid2obj(nid);
83 if (obj == NULL)
84 return (-2);
85 return (X509v3_get_ext_by_OBJ(x, obj, lastpos));
86}
87
88int
89X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *sk, ASN1_OBJECT *obj,
90 int lastpos)
91{
92 int n;
93 X509_EXTENSION *ex;
94
95 if (sk == NULL)
96 return (-1);
97 lastpos++;
98 if (lastpos < 0)
99 lastpos = 0;
100 n = sk_X509_EXTENSION_num(sk);
101 for (; lastpos < n; lastpos++) {
102 ex = sk_X509_EXTENSION_value(sk, lastpos);
103 if (OBJ_cmp(ex->object, obj) == 0)
104 return (lastpos);
105 }
106 return (-1);
107}
108
109int
110X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *sk, int crit,
111 int lastpos)
112{
113 int n;
114 X509_EXTENSION *ex;
115
116 if (sk == NULL)
117 return (-1);
118 lastpos++;
119 if (lastpos < 0)
120 lastpos = 0;
121 n = sk_X509_EXTENSION_num(sk);
122 for (; lastpos < n; lastpos++) {
123 ex = sk_X509_EXTENSION_value(sk, lastpos);
124 if (((ex->critical > 0) && crit) ||
125 ((ex->critical <= 0) && !crit))
126 return (lastpos);
127 }
128 return (-1);
129}
130
131X509_EXTENSION *
132X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc)
133{
134 if (x == NULL || sk_X509_EXTENSION_num(x) <= loc || loc < 0)
135 return NULL;
136 else
137 return sk_X509_EXTENSION_value(x, loc);
138}
139
140X509_EXTENSION *
141X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc)
142{
143 X509_EXTENSION *ret;
144
145 if (x == NULL || sk_X509_EXTENSION_num(x) <= loc || loc < 0)
146 return (NULL);
147 ret = sk_X509_EXTENSION_delete(x, loc);
148 return (ret);
149}
150
151STACK_OF(X509_EXTENSION) *
152X509v3_add_ext(STACK_OF(X509_EXTENSION) **x, X509_EXTENSION *ex, int loc)
153{
154 X509_EXTENSION *new_ex = NULL;
155 int n;
156 STACK_OF(X509_EXTENSION) *sk = NULL;
157
158 if (x == NULL) {
159 X509err(X509_F_X509V3_ADD_EXT, ERR_R_PASSED_NULL_PARAMETER);
160 goto err2;
161 }
162
163 if (*x == NULL) {
164 if ((sk = sk_X509_EXTENSION_new_null()) == NULL)
165 goto err;
166 } else
167 sk= *x;
168
169 n = sk_X509_EXTENSION_num(sk);
170 if (loc > n)
171 loc = n;
172 else if (loc < 0)
173 loc = n;
174
175 if ((new_ex = X509_EXTENSION_dup(ex)) == NULL)
176 goto err2;
177 if (!sk_X509_EXTENSION_insert(sk, new_ex, loc))
178 goto err;
179 if (*x == NULL)
180 *x = sk;
181 return (sk);
182
183err:
184 X509err(X509_F_X509V3_ADD_EXT, ERR_R_MALLOC_FAILURE);
185err2:
186 if (new_ex != NULL)
187 X509_EXTENSION_free(new_ex);
188 if (sk != NULL && (x != NULL && sk != *x))
189 sk_X509_EXTENSION_free(sk);
190 return (NULL);
191}
192
193X509_EXTENSION *
194X509_EXTENSION_create_by_NID(X509_EXTENSION **ex, int nid, int crit,
195 ASN1_OCTET_STRING *data)
196{
197 ASN1_OBJECT *obj;
198 X509_EXTENSION *ret;
199
200 obj = OBJ_nid2obj(nid);
201 if (obj == NULL) {
202 X509err(X509_F_X509_EXTENSION_CREATE_BY_NID,
203 X509_R_UNKNOWN_NID);
204 return (NULL);
205 }
206 ret = X509_EXTENSION_create_by_OBJ(ex, obj, crit, data);
207 if (ret == NULL)
208 ASN1_OBJECT_free(obj);
209 return (ret);
210}
211
212X509_EXTENSION *
213X509_EXTENSION_create_by_OBJ(X509_EXTENSION **ex, ASN1_OBJECT *obj, int crit,
214 ASN1_OCTET_STRING *data)
215{
216 X509_EXTENSION *ret;
217
218 if ((ex == NULL) || (*ex == NULL)) {
219 if ((ret = X509_EXTENSION_new()) == NULL) {
220 X509err(X509_F_X509_EXTENSION_CREATE_BY_OBJ,
221 ERR_R_MALLOC_FAILURE);
222 return (NULL);
223 }
224 } else
225 ret= *ex;
226
227 if (!X509_EXTENSION_set_object(ret, obj))
228 goto err;
229 if (!X509_EXTENSION_set_critical(ret, crit))
230 goto err;
231 if (!X509_EXTENSION_set_data(ret, data))
232 goto err;
233
234 if ((ex != NULL) && (*ex == NULL))
235 *ex = ret;
236 return (ret);
237
238err:
239 if ((ex == NULL) || (ret != *ex))
240 X509_EXTENSION_free(ret);
241 return (NULL);
242}
243
244int
245X509_EXTENSION_set_object(X509_EXTENSION *ex, ASN1_OBJECT *obj)
246{
247 if ((ex == NULL) || (obj == NULL))
248 return (0);
249 ASN1_OBJECT_free(ex->object);
250 ex->object = OBJ_dup(obj);
251 return ex->object != NULL;
252}
253
254int
255X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit)
256{
257 if (ex == NULL)
258 return (0);
259 ex->critical = (crit) ? 0xFF : -1;
260 return (1);
261}
262
263int
264X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data)
265{
266 int i;
267
268 if (ex == NULL)
269 return (0);
270 i = ASN1_STRING_set(ex->value, data->data, data->length);
271 if (!i)
272 return (0);
273 return (1);
274}
275
276ASN1_OBJECT *
277X509_EXTENSION_get_object(X509_EXTENSION *ex)
278{
279 if (ex == NULL)
280 return (NULL);
281 return (ex->object);
282}
283
284ASN1_OCTET_STRING *
285X509_EXTENSION_get_data(X509_EXTENSION *ex)
286{
287 if (ex == NULL)
288 return (NULL);
289 return (ex->value);
290}
291
292int
293X509_EXTENSION_get_critical(X509_EXTENSION *ex)
294{
295 if (ex == NULL)
296 return (0);
297 if (ex->critical > 0)
298 return 1;
299 return 0;
300}
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
deleted file mode 100644
index 5c043aa7b1..0000000000
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ /dev/null
@@ -1,2157 +0,0 @@
1/* $OpenBSD: x509_vfy.c,v 1.49 2016/03/11 07:08:45 mmcc Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <string.h>
62#include <time.h>
63#include <unistd.h>
64
65#include <openssl/opensslconf.h>
66
67#include <openssl/asn1.h>
68#include <openssl/buffer.h>
69#include <openssl/crypto.h>
70#include <openssl/err.h>
71#include <openssl/evp.h>
72#include <openssl/lhash.h>
73#include <openssl/objects.h>
74#include <openssl/x509.h>
75#include <openssl/x509v3.h>
76#include "x509_lcl.h"
77
78/* CRL score values */
79
80/* No unhandled critical extensions */
81
82#define CRL_SCORE_NOCRITICAL 0x100
83
84/* certificate is within CRL scope */
85
86#define CRL_SCORE_SCOPE 0x080
87
88/* CRL times valid */
89
90#define CRL_SCORE_TIME 0x040
91
92/* Issuer name matches certificate */
93
94#define CRL_SCORE_ISSUER_NAME 0x020
95
96/* If this score or above CRL is probably valid */
97
98#define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE)
99
100/* CRL issuer is certificate issuer */
101
102#define CRL_SCORE_ISSUER_CERT 0x018
103
104/* CRL issuer is on certificate path */
105
106#define CRL_SCORE_SAME_PATH 0x008
107
108/* CRL issuer matches CRL AKID */
109
110#define CRL_SCORE_AKID 0x004
111
112/* Have a delta CRL with valid times */
113
114#define CRL_SCORE_TIME_DELTA 0x002
115
116static int null_callback(int ok, X509_STORE_CTX *e);
117static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
118static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);
119static int check_chain_extensions(X509_STORE_CTX *ctx);
120static int check_name_constraints(X509_STORE_CTX *ctx);
121static int check_trust(X509_STORE_CTX *ctx);
122static int check_revocation(X509_STORE_CTX *ctx);
123static int check_cert(X509_STORE_CTX *ctx);
124static int check_policy(X509_STORE_CTX *ctx);
125
126static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
127 unsigned int *preasons, X509_CRL *crl, X509 *x);
128static int get_crl_delta(X509_STORE_CTX *ctx,
129 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x);
130static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pcrl_score,
131 X509_CRL *base, STACK_OF(X509_CRL) *crls);
132static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer,
133 int *pcrl_score);
134static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
135 unsigned int *preasons);
136static int check_crl_path(X509_STORE_CTX *ctx, X509 *x);
137static int check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path,
138 STACK_OF(X509) *crl_path);
139
140static int internal_verify(X509_STORE_CTX *ctx);
141
142static int
143null_callback(int ok, X509_STORE_CTX *e)
144{
145 return ok;
146}
147
148#if 0
149static int
150x509_subject_cmp(X509 **a, X509 **b)
151{
152 return X509_subject_name_cmp(*a, *b);
153}
154#endif
155
156int
157X509_verify_cert(X509_STORE_CTX *ctx)
158{
159 X509 *x, *xtmp, *chain_ss = NULL;
160 int bad_chain = 0;
161 X509_VERIFY_PARAM *param = ctx->param;
162 int depth, i, ok = 0;
163 int num;
164 int (*cb)(int xok, X509_STORE_CTX *xctx);
165 STACK_OF(X509) *sktmp = NULL;
166
167 if (ctx->cert == NULL) {
168 X509err(X509_F_X509_VERIFY_CERT,
169 X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
170 return -1;
171 }
172
173 cb = ctx->verify_cb;
174
175 /* first we make sure the chain we are going to build is
176 * present and that the first entry is in place */
177 if (ctx->chain == NULL) {
178 if (((ctx->chain = sk_X509_new_null()) == NULL) ||
179 (!sk_X509_push(ctx->chain, ctx->cert))) {
180 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
181 goto end;
182 }
183 CRYPTO_add(&ctx->cert->references, 1, CRYPTO_LOCK_X509);
184 ctx->last_untrusted = 1;
185 }
186
187 /* We use a temporary STACK so we can chop and hack at it */
188 if (ctx->untrusted != NULL &&
189 (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
190 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
191 goto end;
192 }
193
194 num = sk_X509_num(ctx->chain);
195 x = sk_X509_value(ctx->chain, num - 1);
196 depth = param->depth;
197
198 for (;;) {
199 /* If we have enough, we break */
200 if (depth < num)
201 break; /* FIXME: If this happens, we should take
202 * note of it and, if appropriate, use the
203 * X509_V_ERR_CERT_CHAIN_TOO_LONG error
204 * code later.
205 */
206
207 /* If we are self signed, we break */
208 if (ctx->check_issued(ctx, x, x))
209 break;
210
211 /* If we were passed a cert chain, use it first */
212 if (ctx->untrusted != NULL) {
213 xtmp = find_issuer(ctx, sktmp, x);
214 if (xtmp != NULL) {
215 if (!sk_X509_push(ctx->chain, xtmp)) {
216 X509err(X509_F_X509_VERIFY_CERT,
217 ERR_R_MALLOC_FAILURE);
218 goto end;
219 }
220 CRYPTO_add(&xtmp->references, 1,
221 CRYPTO_LOCK_X509);
222 (void)sk_X509_delete_ptr(sktmp, xtmp);
223 ctx->last_untrusted++;
224 x = xtmp;
225 num++;
226 /* reparse the full chain for
227 * the next one */
228 continue;
229 }
230 }
231 break;
232 }
233 sk_X509_free(sktmp);
234 sktmp = NULL;
235
236 /* at this point, chain should contain a list of untrusted
237 * certificates. We now need to add at least one trusted one,
238 * if possible, otherwise we complain. */
239
240 /* Examine last certificate in chain and see if it
241 * is self signed.
242 */
243
244 i = sk_X509_num(ctx->chain);
245 x = sk_X509_value(ctx->chain, i - 1);
246 if (ctx->check_issued(ctx, x, x)) {
247 /* we have a self signed certificate */
248 if (sk_X509_num(ctx->chain) == 1) {
249 /* We have a single self signed certificate: see if
250 * we can find it in the store. We must have an exact
251 * match to avoid possible impersonation.
252 */
253 ok = ctx->get_issuer(&xtmp, ctx, x);
254 if ((ok <= 0) || X509_cmp(x, xtmp)) {
255 ctx->error =
256 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
257 ctx->current_cert = x;
258 ctx->error_depth = i - 1;
259 if (ok == 1)
260 X509_free(xtmp);
261 bad_chain = 1;
262 ok = cb(0, ctx);
263 if (!ok)
264 goto end;
265 } else {
266 /* We have a match: replace certificate with store version
267 * so we get any trust settings.
268 */
269 X509_free(x);
270 x = xtmp;
271 (void)sk_X509_set(ctx->chain, i - 1, x);
272 ctx->last_untrusted = 0;
273 }
274 } else {
275 /* extract and save self signed certificate for later use */
276 chain_ss = sk_X509_pop(ctx->chain);
277 ctx->last_untrusted--;
278 num--;
279 x = sk_X509_value(ctx->chain, num - 1);
280 }
281 }
282
283 /* We now lookup certs from the certificate store */
284 for (;;) {
285 /* If we have enough, we break */
286 if (depth < num)
287 break;
288
289 /* If we are self signed, we break */
290 if (ctx->check_issued(ctx, x, x))
291 break;
292
293 ok = ctx->get_issuer(&xtmp, ctx, x);
294 if (ok < 0)
295 return ok;
296 if (ok == 0)
297 break;
298
299 x = xtmp;
300 if (!sk_X509_push(ctx->chain, x)) {
301 X509_free(xtmp);
302 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
303 return 0;
304 }
305 num++;
306 }
307
308 /* we now have our chain, lets check it... */
309
310 /* Is last certificate looked up self signed? */
311 if (!ctx->check_issued(ctx, x, x)) {
312 if ((chain_ss == NULL) ||
313 !ctx->check_issued(ctx, x, chain_ss)) {
314 if (ctx->last_untrusted >= num)
315 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
316 else
317 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
318 ctx->current_cert = x;
319 } else {
320
321 if (!sk_X509_push(ctx->chain, chain_ss)) {
322 X509_free(chain_ss);
323 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
324 return 0;
325 }
326 num++;
327 ctx->last_untrusted = num;
328 ctx->current_cert = chain_ss;
329 ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
330 chain_ss = NULL;
331 }
332
333 ctx->error_depth = num - 1;
334 bad_chain = 1;
335 ok = cb(0, ctx);
336 if (!ok)
337 goto end;
338 }
339
340 /* We have the chain complete: now we need to check its purpose */
341 ok = check_chain_extensions(ctx);
342
343 if (!ok)
344 goto end;
345
346 /* Check name constraints */
347
348 ok = check_name_constraints(ctx);
349
350 if (!ok)
351 goto end;
352
353 /* The chain extensions are OK: check trust */
354
355 if (param->trust > 0)
356 ok = check_trust(ctx);
357
358 if (!ok)
359 goto end;
360
361 /* We may as well copy down any DSA parameters that are required */
362 X509_get_pubkey_parameters(NULL, ctx->chain);
363
364 /* Check revocation status: we do this after copying parameters
365 * because they may be needed for CRL signature verification.
366 */
367
368 ok = ctx->check_revocation(ctx);
369 if (!ok)
370 goto end;
371
372 /* At this point, we have a chain and need to verify it */
373 if (ctx->verify != NULL)
374 ok = ctx->verify(ctx);
375 else
376 ok = internal_verify(ctx);
377 if (!ok)
378 goto end;
379
380 /* If we get this far evaluate policies */
381 if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK))
382 ok = ctx->check_policy(ctx);
383 if (!ok)
384 goto end;
385 if (0) {
386end:
387 X509_get_pubkey_parameters(NULL, ctx->chain);
388 }
389 if (sktmp != NULL)
390 sk_X509_free(sktmp);
391 X509_free(chain_ss);
392 return ok;
393}
394
395
396/* Given a STACK_OF(X509) find the issuer of cert (if any)
397 */
398
399static X509 *
400find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x)
401{
402 int i;
403 X509 *issuer, *rv = NULL;
404
405 for (i = 0; i < sk_X509_num(sk); i++) {
406 issuer = sk_X509_value(sk, i);
407 if (ctx->check_issued(ctx, x, issuer)) {
408 rv = issuer;
409 if (x509_check_cert_time(ctx, rv, 1))
410 break;
411 }
412 }
413 return rv;
414}
415
416/* Given a possible certificate and issuer check them */
417
418static int
419check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
420{
421 int ret;
422
423 ret = X509_check_issued(issuer, x);
424 if (ret == X509_V_OK)
425 return 1;
426 /* If we haven't asked for issuer errors don't set ctx */
427 if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK))
428 return 0;
429
430 ctx->error = ret;
431 ctx->current_cert = x;
432 ctx->current_issuer = issuer;
433 return ctx->verify_cb(0, ctx);
434}
435
436/* Alternative lookup method: look from a STACK stored in other_ctx */
437
438static int
439get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
440{
441 *issuer = find_issuer(ctx, ctx->other_ctx, x);
442 if (*issuer) {
443 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
444 return 1;
445 } else
446 return 0;
447}
448
449/* Check a certificate chains extensions for consistency
450 * with the supplied purpose
451 */
452
453static int
454check_chain_extensions(X509_STORE_CTX *ctx)
455{
456#ifdef OPENSSL_NO_CHAIN_VERIFY
457 return 1;
458#else
459 int i, ok = 0, must_be_ca, plen = 0;
460 X509 *x;
461 int (*cb)(int xok, X509_STORE_CTX *xctx);
462 int proxy_path_length = 0;
463 int purpose;
464 int allow_proxy_certs;
465
466 cb = ctx->verify_cb;
467
468 /* must_be_ca can have 1 of 3 values:
469 -1: we accept both CA and non-CA certificates, to allow direct
470 use of self-signed certificates (which are marked as CA).
471 0: we only accept non-CA certificates. This is currently not
472 used, but the possibility is present for future extensions.
473 1: we only accept CA certificates. This is currently used for
474 all certificates in the chain except the leaf certificate.
475 */
476 must_be_ca = -1;
477
478 /* CRL path validation */
479 if (ctx->parent) {
480 allow_proxy_certs = 0;
481 purpose = X509_PURPOSE_CRL_SIGN;
482 } else {
483 allow_proxy_certs =
484 !!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
485 purpose = ctx->param->purpose;
486 }
487
488 /* Check all untrusted certificates */
489 for (i = 0; i < ctx->last_untrusted; i++) {
490 int ret;
491 x = sk_X509_value(ctx->chain, i);
492 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) &&
493 (x->ex_flags & EXFLAG_CRITICAL)) {
494 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
495 ctx->error_depth = i;
496 ctx->current_cert = x;
497 ok = cb(0, ctx);
498 if (!ok)
499 goto end;
500 }
501 if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
502 ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
503 ctx->error_depth = i;
504 ctx->current_cert = x;
505 ok = cb(0, ctx);
506 if (!ok)
507 goto end;
508 }
509 ret = X509_check_ca(x);
510 switch (must_be_ca) {
511 case -1:
512 if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
513 (ret != 1) && (ret != 0)) {
514 ret = 0;
515 ctx->error = X509_V_ERR_INVALID_CA;
516 } else
517 ret = 1;
518 break;
519 case 0:
520 if (ret != 0) {
521 ret = 0;
522 ctx->error = X509_V_ERR_INVALID_NON_CA;
523 } else
524 ret = 1;
525 break;
526 default:
527 if ((ret == 0) ||
528 ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
529 (ret != 1))) {
530 ret = 0;
531 ctx->error = X509_V_ERR_INVALID_CA;
532 } else
533 ret = 1;
534 break;
535 }
536 if (ret == 0) {
537 ctx->error_depth = i;
538 ctx->current_cert = x;
539 ok = cb(0, ctx);
540 if (!ok)
541 goto end;
542 }
543 if (ctx->param->purpose > 0) {
544 ret = X509_check_purpose(x, purpose, must_be_ca > 0);
545 if ((ret == 0) ||
546 ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
547 (ret != 1))) {
548 ctx->error = X509_V_ERR_INVALID_PURPOSE;
549 ctx->error_depth = i;
550 ctx->current_cert = x;
551 ok = cb(0, ctx);
552 if (!ok)
553 goto end;
554 }
555 }
556 /* Check pathlen if not self issued */
557 if ((i > 1) && !(x->ex_flags & EXFLAG_SI) &&
558 (x->ex_pathlen != -1) &&
559 (plen > (x->ex_pathlen + proxy_path_length + 1))) {
560 ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
561 ctx->error_depth = i;
562 ctx->current_cert = x;
563 ok = cb(0, ctx);
564 if (!ok)
565 goto end;
566 }
567 /* Increment path length if not self issued */
568 if (!(x->ex_flags & EXFLAG_SI))
569 plen++;
570 /* If this certificate is a proxy certificate, the next
571 certificate must be another proxy certificate or a EE
572 certificate. If not, the next certificate must be a
573 CA certificate. */
574 if (x->ex_flags & EXFLAG_PROXY) {
575 if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen) {
576 ctx->error =
577 X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
578 ctx->error_depth = i;
579 ctx->current_cert = x;
580 ok = cb(0, ctx);
581 if (!ok)
582 goto end;
583 }
584 proxy_path_length++;
585 must_be_ca = 0;
586 } else
587 must_be_ca = 1;
588 }
589 ok = 1;
590
591end:
592 return ok;
593#endif
594}
595
596static int
597check_name_constraints(X509_STORE_CTX *ctx)
598{
599 X509 *x;
600 int i, j, rv;
601
602 /* Check name constraints for all certificates */
603 for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) {
604 x = sk_X509_value(ctx->chain, i);
605 /* Ignore self issued certs unless last in chain */
606 if (i && (x->ex_flags & EXFLAG_SI))
607 continue;
608 /* Check against constraints for all certificates higher in
609 * chain including trust anchor. Trust anchor not strictly
610 * speaking needed but if it includes constraints it is to be
611 * assumed it expects them to be obeyed.
612 */
613 for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) {
614 NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc;
615 if (nc) {
616 rv = NAME_CONSTRAINTS_check(x, nc);
617 if (rv != X509_V_OK) {
618 ctx->error = rv;
619 ctx->error_depth = i;
620 ctx->current_cert = x;
621 if (!ctx->verify_cb(0, ctx))
622 return 0;
623 }
624 }
625 }
626 }
627 return 1;
628}
629
630static int
631check_trust(X509_STORE_CTX *ctx)
632{
633#ifdef OPENSSL_NO_CHAIN_VERIFY
634 return 1;
635#else
636 int i, ok;
637 X509 *x;
638 int (*cb)(int xok, X509_STORE_CTX *xctx);
639
640 cb = ctx->verify_cb;
641 /* For now just check the last certificate in the chain */
642 i = sk_X509_num(ctx->chain) - 1;
643 x = sk_X509_value(ctx->chain, i);
644 ok = X509_check_trust(x, ctx->param->trust, 0);
645 if (ok == X509_TRUST_TRUSTED)
646 return 1;
647 ctx->error_depth = i;
648 ctx->current_cert = x;
649 if (ok == X509_TRUST_REJECTED)
650 ctx->error = X509_V_ERR_CERT_REJECTED;
651 else
652 ctx->error = X509_V_ERR_CERT_UNTRUSTED;
653 ok = cb(0, ctx);
654 return ok;
655#endif
656}
657
658static int
659check_revocation(X509_STORE_CTX *ctx)
660{
661 int i, last, ok;
662
663 if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK))
664 return 1;
665 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
666 last = sk_X509_num(ctx->chain) - 1;
667 else {
668 /* If checking CRL paths this isn't the EE certificate */
669 if (ctx->parent)
670 return 1;
671 last = 0;
672 }
673 for (i = 0; i <= last; i++) {
674 ctx->error_depth = i;
675 ok = check_cert(ctx);
676 if (!ok)
677 return ok;
678 }
679 return 1;
680}
681
682static int
683check_cert(X509_STORE_CTX *ctx)
684{
685 X509_CRL *crl = NULL, *dcrl = NULL;
686 X509 *x;
687 int ok = 0, cnum;
688 unsigned int last_reasons;
689
690 cnum = ctx->error_depth;
691 x = sk_X509_value(ctx->chain, cnum);
692 ctx->current_cert = x;
693 ctx->current_issuer = NULL;
694 ctx->current_crl_score = 0;
695 ctx->current_reasons = 0;
696 while (ctx->current_reasons != CRLDP_ALL_REASONS) {
697 last_reasons = ctx->current_reasons;
698 /* Try to retrieve relevant CRL */
699 if (ctx->get_crl)
700 ok = ctx->get_crl(ctx, &crl, x);
701 else
702 ok = get_crl_delta(ctx, &crl, &dcrl, x);
703 /* If error looking up CRL, nothing we can do except
704 * notify callback
705 */
706 if (!ok) {
707 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
708 ok = ctx->verify_cb(0, ctx);
709 goto err;
710 }
711 ctx->current_crl = crl;
712 ok = ctx->check_crl(ctx, crl);
713 if (!ok)
714 goto err;
715
716 if (dcrl) {
717 ok = ctx->check_crl(ctx, dcrl);
718 if (!ok)
719 goto err;
720 ok = ctx->cert_crl(ctx, dcrl, x);
721 if (!ok)
722 goto err;
723 } else
724 ok = 1;
725
726 /* Don't look in full CRL if delta reason is removefromCRL */
727 if (ok != 2) {
728 ok = ctx->cert_crl(ctx, crl, x);
729 if (!ok)
730 goto err;
731 }
732
733 ctx->current_crl = NULL;
734 X509_CRL_free(crl);
735 X509_CRL_free(dcrl);
736 crl = NULL;
737 dcrl = NULL;
738 /* If reasons not updated we wont get anywhere by
739 * another iteration, so exit loop.
740 */
741 if (last_reasons == ctx->current_reasons) {
742 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
743 ok = ctx->verify_cb(0, ctx);
744 goto err;
745 }
746 }
747
748err:
749 ctx->current_crl = NULL;
750 X509_CRL_free(crl);
751 X509_CRL_free(dcrl);
752 return ok;
753}
754
755/* Check CRL times against values in X509_STORE_CTX */
756
757static int
758check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
759{
760 time_t *ptime = NULL;
761 int i;
762
763 if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)
764 return (1);
765
766 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
767 ptime = &ctx->param->check_time;
768
769 if (notify)
770 ctx->current_crl = crl;
771
772 i = X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
773 if (i == 0) {
774 if (!notify)
775 return 0;
776 ctx->error = X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;
777 if (!ctx->verify_cb(0, ctx))
778 return 0;
779 }
780
781 if (i > 0) {
782 if (!notify)
783 return 0;
784 ctx->error = X509_V_ERR_CRL_NOT_YET_VALID;
785 if (!ctx->verify_cb(0, ctx))
786 return 0;
787 }
788
789 if (X509_CRL_get_nextUpdate(crl)) {
790 i = X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);
791
792 if (i == 0) {
793 if (!notify)
794 return 0;
795 ctx->error = X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;
796 if (!ctx->verify_cb(0, ctx))
797 return 0;
798 }
799 /* Ignore expiry of base CRL is delta is valid */
800 if ((i < 0) &&
801 !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) {
802 if (!notify)
803 return 0;
804 ctx->error = X509_V_ERR_CRL_HAS_EXPIRED;
805 if (!ctx->verify_cb(0, ctx))
806 return 0;
807 }
808 }
809
810 if (notify)
811 ctx->current_crl = NULL;
812
813 return 1;
814}
815
816static int
817get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
818 X509 **pissuer, int *pscore, unsigned int *preasons,
819 STACK_OF(X509_CRL) *crls)
820{
821 int i, crl_score, best_score = *pscore;
822 unsigned int reasons, best_reasons = 0;
823 X509 *x = ctx->current_cert;
824 X509_CRL *crl, *best_crl = NULL;
825 X509 *crl_issuer = NULL, *best_crl_issuer = NULL;
826
827 for (i = 0; i < sk_X509_CRL_num(crls); i++) {
828 crl = sk_X509_CRL_value(crls, i);
829 reasons = *preasons;
830 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
831
832 if (crl_score > best_score) {
833 best_crl = crl;
834 best_crl_issuer = crl_issuer;
835 best_score = crl_score;
836 best_reasons = reasons;
837 }
838 }
839
840 if (best_crl) {
841 if (*pcrl)
842 X509_CRL_free(*pcrl);
843 *pcrl = best_crl;
844 *pissuer = best_crl_issuer;
845 *pscore = best_score;
846 *preasons = best_reasons;
847 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509_CRL);
848 if (*pdcrl) {
849 X509_CRL_free(*pdcrl);
850 *pdcrl = NULL;
851 }
852 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls);
853 }
854
855 if (best_score >= CRL_SCORE_VALID)
856 return 1;
857
858 return 0;
859}
860
861/* Compare two CRL extensions for delta checking purposes. They should be
862 * both present or both absent. If both present all fields must be identical.
863 */
864
865static int
866crl_extension_match(X509_CRL *a, X509_CRL *b, int nid)
867{
868 ASN1_OCTET_STRING *exta, *extb;
869 int i;
870
871 i = X509_CRL_get_ext_by_NID(a, nid, -1);
872 if (i >= 0) {
873 /* Can't have multiple occurrences */
874 if (X509_CRL_get_ext_by_NID(a, nid, i) != -1)
875 return 0;
876 exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i));
877 } else
878 exta = NULL;
879
880 i = X509_CRL_get_ext_by_NID(b, nid, -1);
881
882 if (i >= 0) {
883 if (X509_CRL_get_ext_by_NID(b, nid, i) != -1)
884 return 0;
885 extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i));
886 } else
887 extb = NULL;
888
889 if (!exta && !extb)
890 return 1;
891
892 if (!exta || !extb)
893 return 0;
894
895 if (ASN1_OCTET_STRING_cmp(exta, extb))
896 return 0;
897
898 return 1;
899}
900
901/* See if a base and delta are compatible */
902
903static int
904check_delta_base(X509_CRL *delta, X509_CRL *base)
905{
906 /* Delta CRL must be a delta */
907 if (!delta->base_crl_number)
908 return 0;
909 /* Base must have a CRL number */
910 if (!base->crl_number)
911 return 0;
912 /* Issuer names must match */
913 if (X509_NAME_cmp(X509_CRL_get_issuer(base),
914 X509_CRL_get_issuer(delta)))
915 return 0;
916 /* AKID and IDP must match */
917 if (!crl_extension_match(delta, base, NID_authority_key_identifier))
918 return 0;
919 if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
920 return 0;
921 /* Delta CRL base number must not exceed Full CRL number. */
922 if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
923 return 0;
924 /* Delta CRL number must exceed full CRL number */
925 if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0)
926 return 1;
927 return 0;
928}
929
930/* For a given base CRL find a delta... maybe extend to delta scoring
931 * or retrieve a chain of deltas...
932 */
933
934static void
935get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, X509_CRL *base,
936 STACK_OF(X509_CRL) *crls)
937{
938 X509_CRL *delta;
939 int i;
940
941 if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS))
942 return;
943 if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST))
944 return;
945 for (i = 0; i < sk_X509_CRL_num(crls); i++) {
946 delta = sk_X509_CRL_value(crls, i);
947 if (check_delta_base(delta, base)) {
948 if (check_crl_time(ctx, delta, 0))
949 *pscore |= CRL_SCORE_TIME_DELTA;
950 CRYPTO_add(&delta->references, 1, CRYPTO_LOCK_X509_CRL);
951 *dcrl = delta;
952 return;
953 }
954 }
955 *dcrl = NULL;
956}
957
958/* For a given CRL return how suitable it is for the supplied certificate 'x'.
959 * The return value is a mask of several criteria.
960 * If the issuer is not the certificate issuer this is returned in *pissuer.
961 * The reasons mask is also used to determine if the CRL is suitable: if
962 * no new reasons the CRL is rejected, otherwise reasons is updated.
963 */
964
965static int
966get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, unsigned int *preasons,
967 X509_CRL *crl, X509 *x)
968{
969 int crl_score = 0;
970 unsigned int tmp_reasons = *preasons, crl_reasons;
971
972 /* First see if we can reject CRL straight away */
973
974 /* Invalid IDP cannot be processed */
975 if (crl->idp_flags & IDP_INVALID)
976 return 0;
977 /* Reason codes or indirect CRLs need extended CRL support */
978 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) {
979 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
980 return 0;
981 } else if (crl->idp_flags & IDP_REASONS) {
982 /* If no new reasons reject */
983 if (!(crl->idp_reasons & ~tmp_reasons))
984 return 0;
985 }
986 /* Don't process deltas at this stage */
987 else if (crl->base_crl_number)
988 return 0;
989 /* If issuer name doesn't match certificate need indirect CRL */
990 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) {
991 if (!(crl->idp_flags & IDP_INDIRECT))
992 return 0;
993 } else
994 crl_score |= CRL_SCORE_ISSUER_NAME;
995
996 if (!(crl->flags & EXFLAG_CRITICAL))
997 crl_score |= CRL_SCORE_NOCRITICAL;
998
999 /* Check expiry */
1000 if (check_crl_time(ctx, crl, 0))
1001 crl_score |= CRL_SCORE_TIME;
1002
1003 /* Check authority key ID and locate certificate issuer */
1004 crl_akid_check(ctx, crl, pissuer, &crl_score);
1005
1006 /* If we can't locate certificate issuer at this point forget it */
1007
1008 if (!(crl_score & CRL_SCORE_AKID))
1009 return 0;
1010
1011 /* Check cert for matching CRL distribution points */
1012
1013 if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) {
1014 /* If no new reasons reject */
1015 if (!(crl_reasons & ~tmp_reasons))
1016 return 0;
1017 tmp_reasons |= crl_reasons;
1018 crl_score |= CRL_SCORE_SCOPE;
1019 }
1020
1021 *preasons = tmp_reasons;
1022
1023 return crl_score;
1024}
1025
1026static void
1027crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer,
1028 int *pcrl_score)
1029{
1030 X509 *crl_issuer = NULL;
1031 X509_NAME *cnm = X509_CRL_get_issuer(crl);
1032 int cidx = ctx->error_depth;
1033 int i;
1034
1035 if (cidx != sk_X509_num(ctx->chain) - 1)
1036 cidx++;
1037
1038 crl_issuer = sk_X509_value(ctx->chain, cidx);
1039
1040 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1041 if (*pcrl_score & CRL_SCORE_ISSUER_NAME) {
1042 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_ISSUER_CERT;
1043 *pissuer = crl_issuer;
1044 return;
1045 }
1046 }
1047
1048 for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) {
1049 crl_issuer = sk_X509_value(ctx->chain, cidx);
1050 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1051 continue;
1052 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1053 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_SAME_PATH;
1054 *pissuer = crl_issuer;
1055 return;
1056 }
1057 }
1058
1059 /* Anything else needs extended CRL support */
1060
1061 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
1062 return;
1063
1064 /* Otherwise the CRL issuer is not on the path. Look for it in the
1065 * set of untrusted certificates.
1066 */
1067 for (i = 0; i < sk_X509_num(ctx->untrusted); i++) {
1068 crl_issuer = sk_X509_value(ctx->untrusted, i);
1069 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1070 continue;
1071 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1072 *pissuer = crl_issuer;
1073 *pcrl_score |= CRL_SCORE_AKID;
1074 return;
1075 }
1076 }
1077}
1078
1079/* Check the path of a CRL issuer certificate. This creates a new
1080 * X509_STORE_CTX and populates it with most of the parameters from the
1081 * parent. This could be optimised somewhat since a lot of path checking
1082 * will be duplicated by the parent, but this will rarely be used in
1083 * practice.
1084 */
1085
1086static int
1087check_crl_path(X509_STORE_CTX *ctx, X509 *x)
1088{
1089 X509_STORE_CTX crl_ctx;
1090 int ret;
1091
1092 /* Don't allow recursive CRL path validation */
1093 if (ctx->parent)
1094 return 0;
1095 if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted)) {
1096 ret = -1;
1097 goto err;
1098 }
1099
1100 crl_ctx.crls = ctx->crls;
1101 /* Copy verify params across */
1102 X509_STORE_CTX_set0_param(&crl_ctx, ctx->param);
1103
1104 crl_ctx.parent = ctx;
1105 crl_ctx.verify_cb = ctx->verify_cb;
1106
1107 /* Verify CRL issuer */
1108 ret = X509_verify_cert(&crl_ctx);
1109
1110 if (ret <= 0)
1111 goto err;
1112
1113 /* Check chain is acceptable */
1114 ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain);
1115
1116err:
1117 X509_STORE_CTX_cleanup(&crl_ctx);
1118 return ret;
1119}
1120
1121/* RFC3280 says nothing about the relationship between CRL path
1122 * and certificate path, which could lead to situations where a
1123 * certificate could be revoked or validated by a CA not authorised
1124 * to do so. RFC5280 is more strict and states that the two paths must
1125 * end in the same trust anchor, though some discussions remain...
1126 * until this is resolved we use the RFC5280 version
1127 */
1128
1129static int
1130check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path,
1131 STACK_OF(X509) *crl_path)
1132{
1133 X509 *cert_ta, *crl_ta;
1134
1135 cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1);
1136 crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1);
1137 if (!X509_cmp(cert_ta, crl_ta))
1138 return 1;
1139 return 0;
1140}
1141
1142/* Check for match between two dist point names: three separate cases.
1143 * 1. Both are relative names and compare X509_NAME types.
1144 * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES.
1145 * 3. Both are full names and compare two GENERAL_NAMES.
1146 * 4. One is NULL: automatic match.
1147 */
1148
1149static int
1150idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b)
1151{
1152 X509_NAME *nm = NULL;
1153 GENERAL_NAMES *gens = NULL;
1154 GENERAL_NAME *gena, *genb;
1155 int i, j;
1156
1157 if (!a || !b)
1158 return 1;
1159 if (a->type == 1) {
1160 if (!a->dpname)
1161 return 0;
1162 /* Case 1: two X509_NAME */
1163 if (b->type == 1) {
1164 if (!b->dpname)
1165 return 0;
1166 if (!X509_NAME_cmp(a->dpname, b->dpname))
1167 return 1;
1168 else
1169 return 0;
1170 }
1171 /* Case 2: set name and GENERAL_NAMES appropriately */
1172 nm = a->dpname;
1173 gens = b->name.fullname;
1174 } else if (b->type == 1) {
1175 if (!b->dpname)
1176 return 0;
1177 /* Case 2: set name and GENERAL_NAMES appropriately */
1178 gens = a->name.fullname;
1179 nm = b->dpname;
1180 }
1181
1182 /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */
1183 if (nm) {
1184 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
1185 gena = sk_GENERAL_NAME_value(gens, i);
1186 if (gena->type != GEN_DIRNAME)
1187 continue;
1188 if (!X509_NAME_cmp(nm, gena->d.directoryName))
1189 return 1;
1190 }
1191 return 0;
1192 }
1193
1194 /* Else case 3: two GENERAL_NAMES */
1195
1196 for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) {
1197 gena = sk_GENERAL_NAME_value(a->name.fullname, i);
1198 for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) {
1199 genb = sk_GENERAL_NAME_value(b->name.fullname, j);
1200 if (!GENERAL_NAME_cmp(gena, genb))
1201 return 1;
1202 }
1203 }
1204
1205 return 0;
1206}
1207
1208static int
1209crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score)
1210{
1211 int i;
1212 X509_NAME *nm = X509_CRL_get_issuer(crl);
1213
1214 /* If no CRLissuer return is successful iff don't need a match */
1215 if (!dp->CRLissuer)
1216 return !!(crl_score & CRL_SCORE_ISSUER_NAME);
1217 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) {
1218 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i);
1219 if (gen->type != GEN_DIRNAME)
1220 continue;
1221 if (!X509_NAME_cmp(gen->d.directoryName, nm))
1222 return 1;
1223 }
1224 return 0;
1225}
1226
1227/* Check CRLDP and IDP */
1228
1229static int
1230crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, unsigned int *preasons)
1231{
1232 int i;
1233
1234 if (crl->idp_flags & IDP_ONLYATTR)
1235 return 0;
1236 if (x->ex_flags & EXFLAG_CA) {
1237 if (crl->idp_flags & IDP_ONLYUSER)
1238 return 0;
1239 } else {
1240 if (crl->idp_flags & IDP_ONLYCA)
1241 return 0;
1242 }
1243 *preasons = crl->idp_reasons;
1244 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) {
1245 DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i);
1246 if (crldp_check_crlissuer(dp, crl, crl_score)) {
1247 if (!crl->idp ||
1248 idp_check_dp(dp->distpoint, crl->idp->distpoint)) {
1249 *preasons &= dp->dp_reasons;
1250 return 1;
1251 }
1252 }
1253 }
1254 if ((!crl->idp || !crl->idp->distpoint) &&
1255 (crl_score & CRL_SCORE_ISSUER_NAME))
1256 return 1;
1257 return 0;
1258}
1259
1260/* Retrieve CRL corresponding to current certificate.
1261 * If deltas enabled try to find a delta CRL too
1262 */
1263
1264static int
1265get_crl_delta(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
1266{
1267 int ok;
1268 X509 *issuer = NULL;
1269 int crl_score = 0;
1270 unsigned int reasons;
1271 X509_CRL *crl = NULL, *dcrl = NULL;
1272 STACK_OF(X509_CRL) *skcrl;
1273 X509_NAME *nm = X509_get_issuer_name(x);
1274
1275 reasons = ctx->current_reasons;
1276 ok = get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons,
1277 ctx->crls);
1278 if (ok)
1279 goto done;
1280
1281 /* Lookup CRLs from store */
1282 skcrl = ctx->lookup_crls(ctx, nm);
1283
1284 /* If no CRLs found and a near match from get_crl_sk use that */
1285 if (!skcrl && crl)
1286 goto done;
1287
1288 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);
1289
1290 sk_X509_CRL_pop_free(skcrl, X509_CRL_free);
1291
1292done:
1293
1294 /* If we got any kind of CRL use it and return success */
1295 if (crl) {
1296 ctx->current_issuer = issuer;
1297 ctx->current_crl_score = crl_score;
1298 ctx->current_reasons = reasons;
1299 *pcrl = crl;
1300 *pdcrl = dcrl;
1301 return 1;
1302 }
1303
1304 return 0;
1305}
1306
1307/* Check CRL validity */
1308static int
1309check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
1310{
1311 X509 *issuer = NULL;
1312 EVP_PKEY *ikey = NULL;
1313 int ok = 0, chnum, cnum;
1314
1315 cnum = ctx->error_depth;
1316 chnum = sk_X509_num(ctx->chain) - 1;
1317 /* if we have an alternative CRL issuer cert use that */
1318 if (ctx->current_issuer) {
1319 issuer = ctx->current_issuer;
1320 } else if (cnum < chnum) {
1321 /* Else find CRL issuer: if not last certificate then issuer
1322 * is next certificate in chain.
1323 */
1324 issuer = sk_X509_value(ctx->chain, cnum + 1);
1325 } else {
1326 issuer = sk_X509_value(ctx->chain, chnum);
1327 /* If not self signed, can't check signature */
1328 if (!ctx->check_issued(ctx, issuer, issuer)) {
1329 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER;
1330 ok = ctx->verify_cb(0, ctx);
1331 if (!ok)
1332 goto err;
1333 }
1334 }
1335
1336 if (issuer) {
1337 /* Skip most tests for deltas because they have already
1338 * been done
1339 */
1340 if (!crl->base_crl_number) {
1341 /* Check for cRLSign bit if keyUsage present */
1342 if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
1343 !(issuer->ex_kusage & KU_CRL_SIGN)) {
1344 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
1345 ok = ctx->verify_cb(0, ctx);
1346 if (!ok)
1347 goto err;
1348 }
1349
1350 if (!(ctx->current_crl_score & CRL_SCORE_SCOPE)) {
1351 ctx->error = X509_V_ERR_DIFFERENT_CRL_SCOPE;
1352 ok = ctx->verify_cb(0, ctx);
1353 if (!ok)
1354 goto err;
1355 }
1356
1357 if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH)) {
1358 if (check_crl_path(ctx,
1359 ctx->current_issuer) <= 0) {
1360 ctx->error = X509_V_ERR_CRL_PATH_VALIDATION_ERROR;
1361 ok = ctx->verify_cb(0, ctx);
1362 if (!ok)
1363 goto err;
1364 }
1365 }
1366
1367 if (crl->idp_flags & IDP_INVALID) {
1368 ctx->error = X509_V_ERR_INVALID_EXTENSION;
1369 ok = ctx->verify_cb(0, ctx);
1370 if (!ok)
1371 goto err;
1372 }
1373
1374
1375 }
1376
1377 if (!(ctx->current_crl_score & CRL_SCORE_TIME)) {
1378 ok = check_crl_time(ctx, crl, 1);
1379 if (!ok)
1380 goto err;
1381 }
1382
1383 /* Attempt to get issuer certificate public key */
1384 ikey = X509_get_pubkey(issuer);
1385
1386 if (!ikey) {
1387 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
1388 ok = ctx->verify_cb(0, ctx);
1389 if (!ok)
1390 goto err;
1391 } else {
1392 /* Verify CRL signature */
1393 if (X509_CRL_verify(crl, ikey) <= 0) {
1394 ctx->error = X509_V_ERR_CRL_SIGNATURE_FAILURE;
1395 ok = ctx->verify_cb(0, ctx);
1396 if (!ok)
1397 goto err;
1398 }
1399 }
1400 }
1401
1402 ok = 1;
1403
1404err:
1405 EVP_PKEY_free(ikey);
1406 return ok;
1407}
1408
1409/* Check certificate against CRL */
1410static int
1411cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
1412{
1413 int ok;
1414 X509_REVOKED *rev;
1415
1416 /* The rules changed for this... previously if a CRL contained
1417 * unhandled critical extensions it could still be used to indicate
1418 * a certificate was revoked. This has since been changed since
1419 * critical extension can change the meaning of CRL entries.
1420 */
1421 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) &&
1422 (crl->flags & EXFLAG_CRITICAL)) {
1423 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
1424 ok = ctx->verify_cb(0, ctx);
1425 if (!ok)
1426 return 0;
1427 }
1428 /* Look for serial number of certificate in CRL
1429 * If found make sure reason is not removeFromCRL.
1430 */
1431 if (X509_CRL_get0_by_cert(crl, &rev, x)) {
1432 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
1433 return 2;
1434 ctx->error = X509_V_ERR_CERT_REVOKED;
1435 ok = ctx->verify_cb(0, ctx);
1436 if (!ok)
1437 return 0;
1438 }
1439
1440 return 1;
1441}
1442
1443static int
1444check_policy(X509_STORE_CTX *ctx)
1445{
1446 int ret;
1447
1448 if (ctx->parent)
1449 return 1;
1450 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
1451 ctx->param->policies, ctx->param->flags);
1452 if (ret == 0) {
1453 X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
1454 return 0;
1455 }
1456 /* Invalid or inconsistent extensions */
1457 if (ret == -1) {
1458 /* Locate certificates with bad extensions and notify
1459 * callback.
1460 */
1461 X509 *x;
1462 int i;
1463 for (i = 1; i < sk_X509_num(ctx->chain); i++) {
1464 x = sk_X509_value(ctx->chain, i);
1465 if (!(x->ex_flags & EXFLAG_INVALID_POLICY))
1466 continue;
1467 ctx->current_cert = x;
1468 ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION;
1469 if (!ctx->verify_cb(0, ctx))
1470 return 0;
1471 }
1472 return 1;
1473 }
1474 if (ret == -2) {
1475 ctx->current_cert = NULL;
1476 ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY;
1477 return ctx->verify_cb(0, ctx);
1478 }
1479
1480 if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) {
1481 ctx->current_cert = NULL;
1482 ctx->error = X509_V_OK;
1483 if (!ctx->verify_cb(2, ctx))
1484 return 0;
1485 }
1486
1487 return 1;
1488}
1489
1490int
1491x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet)
1492{
1493 time_t *ptime = NULL;
1494 int i;
1495
1496 if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)
1497 return (1);
1498
1499 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
1500 ptime = &ctx->param->check_time;
1501
1502 i = X509_cmp_time(X509_get_notBefore(x), ptime);
1503 if (i == 0) {
1504 if (quiet)
1505 return 0;
1506 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
1507 ctx->current_cert = x;
1508 if (!ctx->verify_cb(0, ctx))
1509 return 0;
1510 }
1511
1512 if (i > 0) {
1513 if (quiet)
1514 return 0;
1515 ctx->error = X509_V_ERR_CERT_NOT_YET_VALID;
1516 ctx->current_cert = x;
1517 if (!ctx->verify_cb(0, ctx))
1518 return 0;
1519 }
1520
1521 i = X509_cmp_time(X509_get_notAfter(x), ptime);
1522 if (i == 0) {
1523 if (quiet)
1524 return 0;
1525 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
1526 ctx->current_cert = x;
1527 if (!ctx->verify_cb(0, ctx))
1528 return 0;
1529 }
1530
1531 if (i < 0) {
1532 if (quiet)
1533 return 0;
1534 ctx->error = X509_V_ERR_CERT_HAS_EXPIRED;
1535 ctx->current_cert = x;
1536 if (!ctx->verify_cb(0, ctx))
1537 return 0;
1538 }
1539
1540 return 1;
1541}
1542
1543static int
1544internal_verify(X509_STORE_CTX *ctx)
1545{
1546 int ok = 0, n;
1547 X509 *xs, *xi;
1548 EVP_PKEY *pkey = NULL;
1549 int (*cb)(int xok, X509_STORE_CTX *xctx);
1550
1551 cb = ctx->verify_cb;
1552
1553 n = sk_X509_num(ctx->chain);
1554 ctx->error_depth = n - 1;
1555 n--;
1556 xi = sk_X509_value(ctx->chain, n);
1557
1558 if (ctx->check_issued(ctx, xi, xi))
1559 xs = xi;
1560 else {
1561 if (n <= 0) {
1562 ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
1563 ctx->current_cert = xi;
1564 ok = cb(0, ctx);
1565 goto end;
1566 } else {
1567 n--;
1568 ctx->error_depth = n;
1569 xs = sk_X509_value(ctx->chain, n);
1570 }
1571 }
1572
1573/* ctx->error=0; not needed */
1574 while (n >= 0) {
1575 ctx->error_depth = n;
1576
1577 /* Skip signature check for self signed certificates unless
1578 * explicitly asked for. It doesn't add any security and
1579 * just wastes time.
1580 */
1581 if (!xs->valid && (xs != xi ||
1582 (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE))) {
1583 if ((pkey = X509_get_pubkey(xi)) == NULL) {
1584 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
1585 ctx->current_cert = xi;
1586 ok = (*cb)(0, ctx);
1587 if (!ok)
1588 goto end;
1589 } else if (X509_verify(xs, pkey) <= 0) {
1590 ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE;
1591 ctx->current_cert = xs;
1592 ok = (*cb)(0, ctx);
1593 if (!ok) {
1594 EVP_PKEY_free(pkey);
1595 goto end;
1596 }
1597 }
1598 EVP_PKEY_free(pkey);
1599 pkey = NULL;
1600 }
1601
1602 xs->valid = 1;
1603
1604 ok = x509_check_cert_time(ctx, xs, 0);
1605 if (!ok)
1606 goto end;
1607
1608 /* The last error (if any) is still in the error value */
1609 ctx->current_issuer = xi;
1610 ctx->current_cert = xs;
1611 ok = (*cb)(1, ctx);
1612 if (!ok)
1613 goto end;
1614
1615 n--;
1616 if (n >= 0) {
1617 xi = xs;
1618 xs = sk_X509_value(ctx->chain, n);
1619 }
1620 }
1621 ok = 1;
1622
1623end:
1624 return ok;
1625}
1626
1627int
1628X509_cmp_current_time(const ASN1_TIME *ctm)
1629{
1630 return X509_cmp_time(ctm, NULL);
1631}
1632
1633/*
1634 * Compare a possibly unvalidated ASN1_TIME string against a time_t
1635 * using RFC 5280 rules for the time string. If *cmp_time is NULL
1636 * the current system time is used.
1637 *
1638 * XXX NOTE that unlike what you expect a "cmp" function to do in C,
1639 * XXX this one is "special", and returns 0 for error.
1640 *
1641 * Returns:
1642 * -1 if the ASN1_time is earlier than OR the same as *cmp_time.
1643 * 1 if the ASN1_time is later than *cmp_time.
1644 * 0 on error.
1645 */
1646int
1647X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
1648{
1649 time_t time1, time2;
1650 struct tm tm1, tm2;
1651 int ret = 0;
1652 int type;
1653
1654 if (cmp_time == NULL)
1655 time2 = time(NULL);
1656 else
1657 time2 = *cmp_time;
1658
1659 memset(&tm1, 0, sizeof(tm1));
1660
1661 if ((type = asn1_time_parse(ctm->data, ctm->length, &tm1, 0)) == -1)
1662 goto out; /* invalid time */
1663
1664 /* RFC 5280 section 4.1.2.5 */
1665 if (tm1.tm_year < 150 && type != V_ASN1_UTCTIME)
1666 goto out;
1667 if (tm1.tm_year >= 150 && type != V_ASN1_GENERALIZEDTIME)
1668 goto out;
1669
1670 /*
1671 * Defensively fail if the time string is not representable as
1672 * a time_t. A time_t must be sane if you care about times after
1673 * Jan 19 2038.
1674 */
1675 if ((time1 = timegm(&tm1)) == -1)
1676 goto out;
1677
1678 if (gmtime_r(&time2, &tm2) == NULL)
1679 goto out;
1680
1681 ret = asn1_tm_cmp(&tm1, &tm2);
1682 if (ret == 0)
1683 ret = -1; /* 0 is used for error, so map same to less than */
1684 out:
1685 return (ret);
1686}
1687
1688ASN1_TIME *
1689X509_gmtime_adj(ASN1_TIME *s, long adj)
1690{
1691 return X509_time_adj(s, adj, NULL);
1692}
1693
1694ASN1_TIME *
1695X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_time)
1696{
1697 return X509_time_adj_ex(s, 0, offset_sec, in_time);
1698}
1699
1700ASN1_TIME *
1701X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, time_t *in_time)
1702{
1703 time_t t;
1704 if (in_time == NULL)
1705 t = time(NULL);
1706 else
1707 t = *in_time;
1708
1709 return ASN1_TIME_adj(s, t, offset_day, offset_sec);
1710}
1711
1712int
1713X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain)
1714{
1715 EVP_PKEY *ktmp = NULL, *ktmp2;
1716 int i, j;
1717
1718 if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey))
1719 return 1;
1720
1721 for (i = 0; i < sk_X509_num(chain); i++) {
1722 ktmp = X509_get_pubkey(sk_X509_value(chain, i));
1723 if (ktmp == NULL) {
1724 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
1725 X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY);
1726 return 0;
1727 }
1728 if (!EVP_PKEY_missing_parameters(ktmp))
1729 break;
1730 else {
1731 EVP_PKEY_free(ktmp);
1732 ktmp = NULL;
1733 }
1734 }
1735 if (ktmp == NULL) {
1736 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
1737 X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN);
1738 return 0;
1739 }
1740
1741 /* first, populate the other certs */
1742 for (j = i - 1; j >= 0; j--) {
1743 ktmp2 = X509_get_pubkey(sk_X509_value(chain, j));
1744 EVP_PKEY_copy_parameters(ktmp2, ktmp);
1745 EVP_PKEY_free(ktmp2);
1746 }
1747
1748 if (pkey != NULL)
1749 EVP_PKEY_copy_parameters(pkey, ktmp);
1750 EVP_PKEY_free(ktmp);
1751 return 1;
1752}
1753
1754int
1755X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
1756 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
1757{
1758 /* This function is (usually) called only once, by
1759 * SSL_get_ex_data_X509_STORE_CTX_idx (ssl/ssl_cert.c). */
1760 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE_CTX,
1761 argl, argp, new_func, dup_func, free_func);
1762}
1763
1764int
1765X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data)
1766{
1767 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
1768}
1769
1770void *
1771X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx)
1772{
1773 return CRYPTO_get_ex_data(&ctx->ex_data, idx);
1774}
1775
1776int
1777X509_STORE_CTX_get_error(X509_STORE_CTX *ctx)
1778{
1779 return ctx->error;
1780}
1781
1782void
1783X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err)
1784{
1785 ctx->error = err;
1786}
1787
1788int
1789X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx)
1790{
1791 return ctx->error_depth;
1792}
1793
1794X509 *
1795X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx)
1796{
1797 return ctx->current_cert;
1798}
1799
1800STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx)
1801{
1802 return ctx->chain;
1803}
1804
1805STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx)
1806{
1807 int i;
1808 X509 *x;
1809 STACK_OF(X509) *chain;
1810
1811 if (!ctx->chain || !(chain = sk_X509_dup(ctx->chain)))
1812 return NULL;
1813 for (i = 0; i < sk_X509_num(chain); i++) {
1814 x = sk_X509_value(chain, i);
1815 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
1816 }
1817 return chain;
1818}
1819
1820X509 *
1821X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx)
1822{
1823 return ctx->current_issuer;
1824}
1825
1826X509_CRL *
1827X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx)
1828{
1829 return ctx->current_crl;
1830}
1831
1832X509_STORE_CTX *
1833X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx)
1834{
1835 return ctx->parent;
1836}
1837
1838void
1839X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
1840{
1841 ctx->cert = x;
1842}
1843
1844void
1845X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
1846{
1847 ctx->untrusted = sk;
1848}
1849
1850void
1851X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk)
1852{
1853 ctx->crls = sk;
1854}
1855
1856int
1857X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
1858{
1859 return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
1860}
1861
1862int
1863X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
1864{
1865 return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
1866}
1867
1868/* This function is used to set the X509_STORE_CTX purpose and trust
1869 * values. This is intended to be used when another structure has its
1870 * own trust and purpose values which (if set) will be inherited by
1871 * the ctx. If they aren't set then we will usually have a default
1872 * purpose in mind which should then be used to set the trust value.
1873 * An example of this is SSL use: an SSL structure will have its own
1874 * purpose and trust settings which the application can set: if they
1875 * aren't set then we use the default of SSL client/server.
1876 */
1877
1878int
1879X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
1880 int purpose, int trust)
1881{
1882 int idx;
1883
1884 /* If purpose not set use default */
1885 if (!purpose)
1886 purpose = def_purpose;
1887 /* If we have a purpose then check it is valid */
1888 if (purpose) {
1889 X509_PURPOSE *ptmp;
1890 idx = X509_PURPOSE_get_by_id(purpose);
1891 if (idx == -1) {
1892 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1893 X509_R_UNKNOWN_PURPOSE_ID);
1894 return 0;
1895 }
1896 ptmp = X509_PURPOSE_get0(idx);
1897 if (ptmp->trust == X509_TRUST_DEFAULT) {
1898 idx = X509_PURPOSE_get_by_id(def_purpose);
1899 if (idx == -1) {
1900 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1901 X509_R_UNKNOWN_PURPOSE_ID);
1902 return 0;
1903 }
1904 ptmp = X509_PURPOSE_get0(idx);
1905 }
1906 /* If trust not set then get from purpose default */
1907 if (!trust)
1908 trust = ptmp->trust;
1909 }
1910 if (trust) {
1911 idx = X509_TRUST_get_by_id(trust);
1912 if (idx == -1) {
1913 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1914 X509_R_UNKNOWN_TRUST_ID);
1915 return 0;
1916 }
1917 }
1918
1919 if (purpose && !ctx->param->purpose)
1920 ctx->param->purpose = purpose;
1921 if (trust && !ctx->param->trust)
1922 ctx->param->trust = trust;
1923 return 1;
1924}
1925
1926X509_STORE_CTX *
1927X509_STORE_CTX_new(void)
1928{
1929 X509_STORE_CTX *ctx;
1930
1931 ctx = calloc(1, sizeof(X509_STORE_CTX));
1932 if (!ctx) {
1933 X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE);
1934 return NULL;
1935 }
1936 return ctx;
1937}
1938
1939void
1940X509_STORE_CTX_free(X509_STORE_CTX *ctx)
1941{
1942 if (ctx == NULL)
1943 return;
1944
1945 X509_STORE_CTX_cleanup(ctx);
1946 free(ctx);
1947}
1948
1949int
1950X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
1951 STACK_OF(X509) *chain)
1952{
1953 int param_ret = 1;
1954
1955 /*
1956 * Make sure everything is initialized properly even in case of an
1957 * early return due to an error.
1958 *
1959 * While this 'ctx' can be reused, X509_STORE_CTX_cleanup() will have
1960 * freed everything and memset ex_data anyway. This also allows us
1961 * to safely use X509_STORE_CTX variables from the stack which will
1962 * have uninitialized data.
1963 */
1964 memset(ctx, 0, sizeof(*ctx));
1965
1966 /*
1967 * Set values other than 0. Keep this in the same order as
1968 * X509_STORE_CTX except for values that may fail. All fields that
1969 * may fail should go last to make sure 'ctx' is as consistent as
1970 * possible even on early exits.
1971 */
1972 ctx->ctx = store;
1973 ctx->cert = x509;
1974 ctx->untrusted = chain;
1975
1976 if (store && store->verify)
1977 ctx->verify = store->verify;
1978 else
1979 ctx->verify = internal_verify;
1980
1981 if (store && store->verify_cb)
1982 ctx->verify_cb = store->verify_cb;
1983 else
1984 ctx->verify_cb = null_callback;
1985
1986 if (store && store->get_issuer)
1987 ctx->get_issuer = store->get_issuer;
1988 else
1989 ctx->get_issuer = X509_STORE_CTX_get1_issuer;
1990
1991 if (store && store->check_issued)
1992 ctx->check_issued = store->check_issued;
1993 else
1994 ctx->check_issued = check_issued;
1995
1996 if (store && store->check_revocation)
1997 ctx->check_revocation = store->check_revocation;
1998 else
1999 ctx->check_revocation = check_revocation;
2000
2001 if (store && store->get_crl)
2002 ctx->get_crl = store->get_crl;
2003 else
2004 ctx->get_crl = NULL;
2005
2006 if (store && store->check_crl)
2007 ctx->check_crl = store->check_crl;
2008 else
2009 ctx->check_crl = check_crl;
2010
2011 if (store && store->cert_crl)
2012 ctx->cert_crl = store->cert_crl;
2013 else
2014 ctx->cert_crl = cert_crl;
2015
2016 ctx->check_policy = check_policy;
2017
2018 if (store && store->lookup_certs)
2019 ctx->lookup_certs = store->lookup_certs;
2020 else
2021 ctx->lookup_certs = X509_STORE_get1_certs;
2022
2023 if (store && store->lookup_crls)
2024 ctx->lookup_crls = store->lookup_crls;
2025 else
2026 ctx->lookup_crls = X509_STORE_get1_crls;
2027
2028 if (store && store->cleanup)
2029 ctx->cleanup = store->cleanup;
2030 else
2031 ctx->cleanup = NULL;
2032
2033 ctx->param = X509_VERIFY_PARAM_new();
2034 if (!ctx->param) {
2035 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2036 return 0;
2037 }
2038
2039 /* Inherit callbacks and flags from X509_STORE if not set
2040 * use defaults.
2041 */
2042 if (store)
2043 param_ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param);
2044 else
2045 ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT|X509_VP_FLAG_ONCE;
2046
2047 if (param_ret)
2048 param_ret = X509_VERIFY_PARAM_inherit(ctx->param,
2049 X509_VERIFY_PARAM_lookup("default"));
2050
2051 if (param_ret == 0) {
2052 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2053 return 0;
2054 }
2055
2056 if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx,
2057 &(ctx->ex_data)) == 0) {
2058 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2059 return 0;
2060 }
2061 return 1;
2062}
2063
2064/* Set alternative lookup method: just a STACK of trusted certificates.
2065 * This avoids X509_STORE nastiness where it isn't needed.
2066 */
2067
2068void
2069X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
2070{
2071 ctx->other_ctx = sk;
2072 ctx->get_issuer = get_issuer_sk;
2073}
2074
2075void
2076X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
2077{
2078 if (ctx->cleanup)
2079 ctx->cleanup(ctx);
2080 if (ctx->param != NULL) {
2081 if (ctx->parent == NULL)
2082 X509_VERIFY_PARAM_free(ctx->param);
2083 ctx->param = NULL;
2084 }
2085 if (ctx->tree != NULL) {
2086 X509_policy_tree_free(ctx->tree);
2087 ctx->tree = NULL;
2088 }
2089 if (ctx->chain != NULL) {
2090 sk_X509_pop_free(ctx->chain, X509_free);
2091 ctx->chain = NULL;
2092 }
2093 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX,
2094 ctx, &(ctx->ex_data));
2095 memset(&ctx->ex_data, 0, sizeof(CRYPTO_EX_DATA));
2096}
2097
2098void
2099X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth)
2100{
2101 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
2102}
2103
2104void
2105X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags)
2106{
2107 X509_VERIFY_PARAM_set_flags(ctx->param, flags);
2108}
2109
2110void
2111X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, time_t t)
2112{
2113 X509_VERIFY_PARAM_set_time(ctx->param, t);
2114}
2115
2116void
2117X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
2118 int (*verify_cb)(int, X509_STORE_CTX *))
2119{
2120 ctx->verify_cb = verify_cb;
2121}
2122
2123X509_POLICY_TREE *
2124X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx)
2125{
2126 return ctx->tree;
2127}
2128
2129int
2130X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx)
2131{
2132 return ctx->explicit_policy;
2133}
2134
2135int
2136X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name)
2137{
2138 const X509_VERIFY_PARAM *param;
2139 param = X509_VERIFY_PARAM_lookup(name);
2140 if (!param)
2141 return 0;
2142 return X509_VERIFY_PARAM_inherit(ctx->param, param);
2143}
2144
2145X509_VERIFY_PARAM *
2146X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx)
2147{
2148 return ctx->param;
2149}
2150
2151void
2152X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param)
2153{
2154 if (ctx->param)
2155 X509_VERIFY_PARAM_free(ctx->param);
2156 ctx->param = param;
2157}
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
deleted file mode 100644
index e3a1db2407..0000000000
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ /dev/null
@@ -1,560 +0,0 @@
1/* $OpenBSD: x509_vfy.h,v 1.16 2015/09/14 16:13:39 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_X509_H
60#include <openssl/x509.h>
61/* openssl/x509.h ends up #include-ing this file at about the only
62 * appropriate moment. */
63#endif
64
65#ifndef HEADER_X509_VFY_H
66#define HEADER_X509_VFY_H
67
68#include <openssl/opensslconf.h>
69
70#ifndef OPENSSL_NO_LHASH
71#include <openssl/lhash.h>
72#endif
73#include <openssl/bio.h>
74#include <openssl/crypto.h>
75
76#ifdef __cplusplus
77extern "C" {
78#endif
79
80typedef struct x509_file_st
81 {
82 int num_paths; /* number of paths to files or directories */
83 int num_alloced;
84 char **paths; /* the list of paths or directories */
85 int *path_type;
86 } X509_CERT_FILE_CTX;
87
88/*******************************/
89/*
90SSL_CTX -> X509_STORE
91 -> X509_LOOKUP
92 ->X509_LOOKUP_METHOD
93 -> X509_LOOKUP
94 ->X509_LOOKUP_METHOD
95
96SSL -> X509_STORE_CTX
97 ->X509_STORE
98
99The X509_STORE holds the tables etc for verification stuff.
100A X509_STORE_CTX is used while validating a single certificate.
101The X509_STORE has X509_LOOKUPs for looking up certs.
102The X509_STORE then calls a function to actually verify the
103certificate chain.
104*/
105
106#define X509_LU_RETRY -1
107#define X509_LU_FAIL 0
108#define X509_LU_X509 1
109#define X509_LU_CRL 2
110#define X509_LU_PKEY 3
111
112typedef struct x509_object_st
113 {
114 /* one of the above types */
115 int type;
116 union {
117 char *ptr;
118 X509 *x509;
119 X509_CRL *crl;
120 EVP_PKEY *pkey;
121 } data;
122 } X509_OBJECT;
123
124typedef struct x509_lookup_st X509_LOOKUP;
125
126DECLARE_STACK_OF(X509_LOOKUP)
127DECLARE_STACK_OF(X509_OBJECT)
128
129/* This is a static that defines the function interface */
130typedef struct x509_lookup_method_st
131 {
132 const char *name;
133 int (*new_item)(X509_LOOKUP *ctx);
134 void (*free)(X509_LOOKUP *ctx);
135 int (*init)(X509_LOOKUP *ctx);
136 int (*shutdown)(X509_LOOKUP *ctx);
137 int (*ctrl)(X509_LOOKUP *ctx,int cmd,const char *argc,long argl,
138 char **ret);
139 int (*get_by_subject)(X509_LOOKUP *ctx,int type,X509_NAME *name,
140 X509_OBJECT *ret);
141 int (*get_by_issuer_serial)(X509_LOOKUP *ctx,int type,X509_NAME *name,
142 ASN1_INTEGER *serial,X509_OBJECT *ret);
143 int (*get_by_fingerprint)(X509_LOOKUP *ctx,int type,
144 unsigned char *bytes,int len,
145 X509_OBJECT *ret);
146 int (*get_by_alias)(X509_LOOKUP *ctx,int type,char *str,int len,
147 X509_OBJECT *ret);
148 } X509_LOOKUP_METHOD;
149
150/* This structure hold all parameters associated with a verify operation
151 * by including an X509_VERIFY_PARAM structure in related structures the
152 * parameters used can be customized
153 */
154
155typedef struct X509_VERIFY_PARAM_st
156 {
157 char *name;
158 time_t check_time; /* Time to use */
159 unsigned long inh_flags; /* Inheritance flags */
160 unsigned long flags; /* Various verify flags */
161 int purpose; /* purpose to check untrusted certificates */
162 int trust; /* trust setting to check */
163 int depth; /* Verify depth */
164 STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */
165 } X509_VERIFY_PARAM;
166
167DECLARE_STACK_OF(X509_VERIFY_PARAM)
168
169/* This is used to hold everything. It is used for all certificate
170 * validation. Once we have a certificate chain, the 'verify'
171 * function is then called to actually check the cert chain. */
172struct x509_store_st
173 {
174 /* The following is a cache of trusted certs */
175 int cache; /* if true, stash any hits */
176 STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */
177
178 /* These are external lookup methods */
179 STACK_OF(X509_LOOKUP) *get_cert_methods;
180
181 X509_VERIFY_PARAM *param;
182
183 /* Callbacks for various operations */
184 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
185 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
186 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
187 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
188 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
189 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
190 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
191 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
192 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
193 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
194 int (*cleanup)(X509_STORE_CTX *ctx);
195
196 CRYPTO_EX_DATA ex_data;
197 int references;
198 } /* X509_STORE */;
199
200int X509_STORE_set_depth(X509_STORE *store, int depth);
201
202#define X509_STORE_set_verify_cb_func(ctx,func) ((ctx)->verify_cb=(func))
203#define X509_STORE_set_verify_func(ctx,func) ((ctx)->verify=(func))
204
205/* This is the functions plus an instance of the local variables. */
206struct x509_lookup_st
207 {
208 int init; /* have we been started */
209 int skip; /* don't use us. */
210 X509_LOOKUP_METHOD *method; /* the functions */
211 char *method_data; /* method data */
212
213 X509_STORE *store_ctx; /* who owns us */
214 } /* X509_LOOKUP */;
215
216/* This is a used when verifying cert chains. Since the
217 * gathering of the cert chain can take some time (and have to be
218 * 'retried', this needs to be kept and passed around. */
219struct x509_store_ctx_st /* X509_STORE_CTX */
220 {
221 X509_STORE *ctx;
222 int current_method; /* used when looking up certs */
223
224 /* The following are set by the caller */
225 X509 *cert; /* The cert to check */
226 STACK_OF(X509) *untrusted; /* chain of X509s - untrusted - passed in */
227 STACK_OF(X509_CRL) *crls; /* set of CRLs passed in */
228
229 X509_VERIFY_PARAM *param;
230 void *other_ctx; /* Other info for use with get_issuer() */
231
232 /* Callbacks for various operations */
233 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
234 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
235 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
236 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
237 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
238 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
239 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
240 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
241 int (*check_policy)(X509_STORE_CTX *ctx);
242 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
243 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
244 int (*cleanup)(X509_STORE_CTX *ctx);
245
246 /* The following is built up */
247 int valid; /* if 0, rebuild chain */
248 int last_untrusted; /* index of last untrusted cert */
249 STACK_OF(X509) *chain; /* chain of X509s - built up and trusted */
250 X509_POLICY_TREE *tree; /* Valid policy tree */
251
252 int explicit_policy; /* Require explicit policy value */
253
254 /* When something goes wrong, this is why */
255 int error_depth;
256 int error;
257 X509 *current_cert;
258 X509 *current_issuer; /* cert currently being tested as valid issuer */
259 X509_CRL *current_crl; /* current CRL */
260
261 int current_crl_score; /* score of current CRL */
262 unsigned int current_reasons; /* Reason mask */
263
264 X509_STORE_CTX *parent; /* For CRL path validation: parent context */
265
266 CRYPTO_EX_DATA ex_data;
267 } /* X509_STORE_CTX */;
268
269void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
270
271#define X509_STORE_CTX_set_app_data(ctx,data) \
272 X509_STORE_CTX_set_ex_data(ctx,0,data)
273#define X509_STORE_CTX_get_app_data(ctx) \
274 X509_STORE_CTX_get_ex_data(ctx,0)
275
276#define X509_L_FILE_LOAD 1
277#define X509_L_ADD_DIR 2
278#define X509_L_MEM 3
279
280#define X509_LOOKUP_load_file(x,name,type) \
281 X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL)
282
283#define X509_LOOKUP_add_dir(x,name,type) \
284 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
285
286#define X509_LOOKUP_add_mem(x,iov,type) \
287 X509_LOOKUP_ctrl((x),X509_L_MEM,(const char *)(iov),\
288 (long)(type),NULL)
289
290#define X509_V_OK 0
291/* illegal error (for uninitialized values, to avoid X509_V_OK): 1 */
292
293#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2
294#define X509_V_ERR_UNABLE_TO_GET_CRL 3
295#define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4
296#define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5
297#define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6
298#define X509_V_ERR_CERT_SIGNATURE_FAILURE 7
299#define X509_V_ERR_CRL_SIGNATURE_FAILURE 8
300#define X509_V_ERR_CERT_NOT_YET_VALID 9
301#define X509_V_ERR_CERT_HAS_EXPIRED 10
302#define X509_V_ERR_CRL_NOT_YET_VALID 11
303#define X509_V_ERR_CRL_HAS_EXPIRED 12
304#define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13
305#define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14
306#define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15
307#define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16
308#define X509_V_ERR_OUT_OF_MEM 17
309#define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18
310#define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19
311#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20
312#define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21
313#define X509_V_ERR_CERT_CHAIN_TOO_LONG 22
314#define X509_V_ERR_CERT_REVOKED 23
315#define X509_V_ERR_INVALID_CA 24
316#define X509_V_ERR_PATH_LENGTH_EXCEEDED 25
317#define X509_V_ERR_INVALID_PURPOSE 26
318#define X509_V_ERR_CERT_UNTRUSTED 27
319#define X509_V_ERR_CERT_REJECTED 28
320/* These are 'informational' when looking for issuer cert */
321#define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29
322#define X509_V_ERR_AKID_SKID_MISMATCH 30
323#define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31
324#define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32
325
326#define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33
327#define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34
328#define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35
329#define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36
330#define X509_V_ERR_INVALID_NON_CA 37
331#define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38
332#define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39
333#define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40
334
335#define X509_V_ERR_INVALID_EXTENSION 41
336#define X509_V_ERR_INVALID_POLICY_EXTENSION 42
337#define X509_V_ERR_NO_EXPLICIT_POLICY 43
338#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44
339#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45
340
341#define X509_V_ERR_UNNESTED_RESOURCE 46
342
343#define X509_V_ERR_PERMITTED_VIOLATION 47
344#define X509_V_ERR_EXCLUDED_VIOLATION 48
345#define X509_V_ERR_SUBTREE_MINMAX 49
346#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51
347#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52
348#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53
349#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54
350
351/* The application is not happy */
352#define X509_V_ERR_APPLICATION_VERIFICATION 50
353
354/* Certificate verify flags */
355
356/* Send issuer+subject checks to verify_cb */
357#define X509_V_FLAG_CB_ISSUER_CHECK 0x1
358/* Use check time instead of current time */
359#define X509_V_FLAG_USE_CHECK_TIME 0x2
360/* Lookup CRLs */
361#define X509_V_FLAG_CRL_CHECK 0x4
362/* Lookup CRLs for whole chain */
363#define X509_V_FLAG_CRL_CHECK_ALL 0x8
364/* Ignore unhandled critical extensions */
365#define X509_V_FLAG_IGNORE_CRITICAL 0x10
366/* Disable workarounds for broken certificates */
367#define X509_V_FLAG_X509_STRICT 0x20
368/* Enable proxy certificate validation */
369#define X509_V_FLAG_ALLOW_PROXY_CERTS 0x40
370/* Enable policy checking */
371#define X509_V_FLAG_POLICY_CHECK 0x80
372/* Policy variable require-explicit-policy */
373#define X509_V_FLAG_EXPLICIT_POLICY 0x100
374/* Policy variable inhibit-any-policy */
375#define X509_V_FLAG_INHIBIT_ANY 0x200
376/* Policy variable inhibit-policy-mapping */
377#define X509_V_FLAG_INHIBIT_MAP 0x400
378/* Notify callback that policy is OK */
379#define X509_V_FLAG_NOTIFY_POLICY 0x800
380/* Extended CRL features such as indirect CRLs, alternate CRL signing keys */
381#define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000
382/* Delta CRL support */
383#define X509_V_FLAG_USE_DELTAS 0x2000
384/* Check selfsigned CA signature */
385#define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000
386/* Do not check certificate or CRL validity against current time. */
387#define X509_V_FLAG_NO_CHECK_TIME 0x200000
388
389#define X509_VP_FLAG_DEFAULT 0x1
390#define X509_VP_FLAG_OVERWRITE 0x2
391#define X509_VP_FLAG_RESET_FLAGS 0x4
392#define X509_VP_FLAG_LOCKED 0x8
393#define X509_VP_FLAG_ONCE 0x10
394
395/* Internal use: mask of policy related options */
396#define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \
397 | X509_V_FLAG_EXPLICIT_POLICY \
398 | X509_V_FLAG_INHIBIT_ANY \
399 | X509_V_FLAG_INHIBIT_MAP)
400
401int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
402 X509_NAME *name);
403X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,int type,X509_NAME *name);
404X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x);
405void X509_OBJECT_up_ref_count(X509_OBJECT *a);
406void X509_OBJECT_free_contents(X509_OBJECT *a);
407X509_STORE *X509_STORE_new(void );
408void X509_STORE_free(X509_STORE *v);
409
410STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *st, X509_NAME *nm);
411STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *st, X509_NAME *nm);
412int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
413int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
414int X509_STORE_set_trust(X509_STORE *ctx, int trust);
415int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
416
417void X509_STORE_set_verify_cb(X509_STORE *ctx,
418 int (*verify_cb)(int, X509_STORE_CTX *));
419
420X509_STORE_CTX *X509_STORE_CTX_new(void);
421
422int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
423
424void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
425int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
426 X509 *x509, STACK_OF(X509) *chain);
427void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
428void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
429
430X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m);
431
432X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void);
433X509_LOOKUP_METHOD *X509_LOOKUP_file(void);
434X509_LOOKUP_METHOD *X509_LOOKUP_mem(void);
435
436int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
437int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
438
439int X509_STORE_get_by_subject(X509_STORE_CTX *vs,int type,X509_NAME *name,
440 X509_OBJECT *ret);
441
442int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
443 long argl, char **ret);
444
445int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
446int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
447int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
448
449
450X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method);
451void X509_LOOKUP_free(X509_LOOKUP *ctx);
452int X509_LOOKUP_init(X509_LOOKUP *ctx);
453int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
454 X509_OBJECT *ret);
455int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
456 ASN1_INTEGER *serial, X509_OBJECT *ret);
457int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type,
458 unsigned char *bytes, int len, X509_OBJECT *ret);
459int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, char *str,
460 int len, X509_OBJECT *ret);
461int X509_LOOKUP_shutdown(X509_LOOKUP *ctx);
462
463int X509_STORE_load_locations (X509_STORE *ctx,
464 const char *file, const char *dir);
465int X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len);
466int X509_STORE_set_default_paths(X509_STORE *ctx);
467
468int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
469 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
470int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data);
471void * X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
472int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
473void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
474int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
475X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
476X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
477X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
478X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx);
479STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
480STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
481void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
482void X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
483void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c,STACK_OF(X509_CRL) *sk);
484int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
485int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
486int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
487 int purpose, int trust);
488void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags);
489void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
490 time_t t);
491void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
492 int (*verify_cb)(int, X509_STORE_CTX *));
493
494X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx);
495int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx);
496
497X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
498void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
499int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
500
501/* X509_VERIFY_PARAM functions */
502
503X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
504void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);
505int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to,
506 const X509_VERIFY_PARAM *from);
507int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
508 const X509_VERIFY_PARAM *from);
509int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);
510int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
511int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
512 unsigned long flags);
513unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
514int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
515int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
516void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
517void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
518int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
519 ASN1_OBJECT *policy);
520int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
521 STACK_OF(ASN1_OBJECT) *policies);
522int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
523
524int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);
525const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name);
526void X509_VERIFY_PARAM_table_cleanup(void);
527
528int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
529 STACK_OF(X509) *certs,
530 STACK_OF(ASN1_OBJECT) *policy_oids,
531 unsigned int flags);
532
533void X509_policy_tree_free(X509_POLICY_TREE *tree);
534
535int X509_policy_tree_level_count(const X509_POLICY_TREE *tree);
536X509_POLICY_LEVEL *
537 X509_policy_tree_get0_level(const X509_POLICY_TREE *tree, int i);
538
539STACK_OF(X509_POLICY_NODE) *
540 X509_policy_tree_get0_policies(const X509_POLICY_TREE *tree);
541
542STACK_OF(X509_POLICY_NODE) *
543 X509_policy_tree_get0_user_policies(const X509_POLICY_TREE *tree);
544
545int X509_policy_level_node_count(X509_POLICY_LEVEL *level);
546
547X509_POLICY_NODE *X509_policy_level_get0_node(X509_POLICY_LEVEL *level, int i);
548
549const ASN1_OBJECT *X509_policy_node_get0_policy(const X509_POLICY_NODE *node);
550
551STACK_OF(POLICYQUALINFO) *
552 X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node);
553const X509_POLICY_NODE *
554 X509_policy_node_get0_parent(const X509_POLICY_NODE *node);
555
556#ifdef __cplusplus
557}
558#endif
559#endif
560
diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c
deleted file mode 100644
index 8ec972050d..0000000000
--- a/src/lib/libcrypto/x509/x509_vpm.c
+++ /dev/null
@@ -1,449 +0,0 @@
1/* $OpenBSD: x509_vpm.c,v 1.11 2014/09/29 04:16:49 miod Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/buffer.h>
63#include <openssl/crypto.h>
64#include <openssl/lhash.h>
65#include <openssl/x509.h>
66#include <openssl/x509v3.h>
67
68/* X509_VERIFY_PARAM functions */
69
70static void
71x509_verify_param_zero(X509_VERIFY_PARAM *param)
72{
73 if (!param)
74 return;
75 param->name = NULL;
76 param->purpose = 0;
77 param->trust = 0;
78 /*param->inh_flags = X509_VP_FLAG_DEFAULT;*/
79 param->inh_flags = 0;
80 param->flags = 0;
81 param->depth = -1;
82 if (param->policies) {
83 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
84 param->policies = NULL;
85 }
86}
87
88X509_VERIFY_PARAM *
89X509_VERIFY_PARAM_new(void)
90{
91 X509_VERIFY_PARAM *param;
92
93 param = calloc(1, sizeof(X509_VERIFY_PARAM));
94 x509_verify_param_zero(param);
95 return param;
96}
97
98void
99X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
100{
101 x509_verify_param_zero(param);
102 free(param);
103}
104
105/* This function determines how parameters are "inherited" from one structure
106 * to another. There are several different ways this can happen.
107 *
108 * 1. If a child structure needs to have its values initialized from a parent
109 * they are simply copied across. For example SSL_CTX copied to SSL.
110 * 2. If the structure should take on values only if they are currently unset.
111 * For example the values in an SSL structure will take appropriate value
112 * for SSL servers or clients but only if the application has not set new
113 * ones.
114 *
115 * The "inh_flags" field determines how this function behaves.
116 *
117 * Normally any values which are set in the default are not copied from the
118 * destination and verify flags are ORed together.
119 *
120 * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied
121 * to the destination. Effectively the values in "to" become default values
122 * which will be used only if nothing new is set in "from".
123 *
124 * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether
125 * they are set or not. Flags is still Ored though.
126 *
127 * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead
128 * of ORed.
129 *
130 * If X509_VP_FLAG_LOCKED is set then no values are copied.
131 *
132 * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed
133 * after the next call.
134 */
135
136/* Macro to test if a field should be copied from src to dest */
137
138#define test_x509_verify_param_copy(field, def) \
139 (to_overwrite || \
140 ((src->field != def) && (to_default || (dest->field == def))))
141
142/* Macro to test and copy a field if necessary */
143
144#define x509_verify_param_copy(field, def) \
145 if (test_x509_verify_param_copy(field, def)) \
146 dest->field = src->field
147
148
149int
150X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src)
151{
152 unsigned long inh_flags;
153 int to_default, to_overwrite;
154
155 if (!src)
156 return 1;
157 inh_flags = dest->inh_flags | src->inh_flags;
158
159 if (inh_flags & X509_VP_FLAG_ONCE)
160 dest->inh_flags = 0;
161
162 if (inh_flags & X509_VP_FLAG_LOCKED)
163 return 1;
164
165 if (inh_flags & X509_VP_FLAG_DEFAULT)
166 to_default = 1;
167 else
168 to_default = 0;
169
170 if (inh_flags & X509_VP_FLAG_OVERWRITE)
171 to_overwrite = 1;
172 else
173 to_overwrite = 0;
174
175 x509_verify_param_copy(purpose, 0);
176 x509_verify_param_copy(trust, 0);
177 x509_verify_param_copy(depth, -1);
178
179 /* If overwrite or check time not set, copy across */
180
181 if (to_overwrite || !(dest->flags & X509_V_FLAG_USE_CHECK_TIME)) {
182 dest->check_time = src->check_time;
183 dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME;
184 /* Don't need to copy flag: that is done below */
185 }
186
187 if (inh_flags & X509_VP_FLAG_RESET_FLAGS)
188 dest->flags = 0;
189
190 dest->flags |= src->flags;
191
192 if (test_x509_verify_param_copy(policies, NULL)) {
193 if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies))
194 return 0;
195 }
196
197 return 1;
198}
199
200int
201X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, const X509_VERIFY_PARAM *from)
202{
203 unsigned long save_flags = to->inh_flags;
204 int ret;
205
206 to->inh_flags |= X509_VP_FLAG_DEFAULT;
207 ret = X509_VERIFY_PARAM_inherit(to, from);
208 to->inh_flags = save_flags;
209 return ret;
210}
211
212int
213X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)
214{
215 free(param->name);
216 param->name = NULL;
217 if (name == NULL)
218 return 1;
219 param->name = strdup(name);
220 if (param->name)
221 return 1;
222 return 0;
223}
224
225int
226X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
227{
228 param->flags |= flags;
229 if (flags & X509_V_FLAG_POLICY_MASK)
230 param->flags |= X509_V_FLAG_POLICY_CHECK;
231 return 1;
232}
233
234int
235X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags)
236{
237 param->flags &= ~flags;
238 return 1;
239}
240
241unsigned long
242X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param)
243{
244 return param->flags;
245}
246
247int
248X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
249{
250 return X509_PURPOSE_set(&param->purpose, purpose);
251}
252
253int
254X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
255{
256 return X509_TRUST_set(&param->trust, trust);
257}
258
259void
260X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth)
261{
262 param->depth = depth;
263}
264
265void
266X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t)
267{
268 param->check_time = t;
269 param->flags |= X509_V_FLAG_USE_CHECK_TIME;
270}
271
272int
273X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy)
274{
275 if (!param->policies) {
276 param->policies = sk_ASN1_OBJECT_new_null();
277 if (!param->policies)
278 return 0;
279 }
280 if (!sk_ASN1_OBJECT_push(param->policies, policy))
281 return 0;
282 return 1;
283}
284
285int
286X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
287 STACK_OF(ASN1_OBJECT) *policies)
288{
289 int i;
290 ASN1_OBJECT *oid, *doid;
291
292 if (!param)
293 return 0;
294 if (param->policies)
295 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
296
297 if (!policies) {
298 param->policies = NULL;
299 return 1;
300 }
301
302 param->policies = sk_ASN1_OBJECT_new_null();
303 if (!param->policies)
304 return 0;
305
306 for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++) {
307 oid = sk_ASN1_OBJECT_value(policies, i);
308 doid = OBJ_dup(oid);
309 if (!doid)
310 return 0;
311 if (!sk_ASN1_OBJECT_push(param->policies, doid)) {
312 ASN1_OBJECT_free(doid);
313 return 0;
314 }
315 }
316 param->flags |= X509_V_FLAG_POLICY_CHECK;
317 return 1;
318}
319
320int
321X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
322{
323 return param->depth;
324}
325
326/* Default verify parameters: these are used for various
327 * applications and can be overridden by the user specified table.
328 * NB: the 'name' field *must* be in alphabetical order because it
329 * will be searched using OBJ_search.
330 */
331
332static const X509_VERIFY_PARAM default_table[] = {
333 {
334 "default", /* X509 default parameters */
335 0, /* Check time */
336 0, /* internal flags */
337 0, /* flags */
338 0, /* purpose */
339 0, /* trust */
340 100, /* depth */
341 NULL /* policies */
342 },
343 {
344 "pkcs7", /* S/MIME sign parameters */
345 0, /* Check time */
346 0, /* internal flags */
347 0, /* flags */
348 X509_PURPOSE_SMIME_SIGN, /* purpose */
349 X509_TRUST_EMAIL, /* trust */
350 -1, /* depth */
351 NULL /* policies */
352 },
353 {
354 "smime_sign", /* S/MIME sign parameters */
355 0, /* Check time */
356 0, /* internal flags */
357 0, /* flags */
358 X509_PURPOSE_SMIME_SIGN, /* purpose */
359 X509_TRUST_EMAIL, /* trust */
360 -1, /* depth */
361 NULL /* policies */
362 },
363 {
364 "ssl_client", /* SSL/TLS client parameters */
365 0, /* Check time */
366 0, /* internal flags */
367 0, /* flags */
368 X509_PURPOSE_SSL_CLIENT, /* purpose */
369 X509_TRUST_SSL_CLIENT, /* trust */
370 -1, /* depth */
371 NULL /* policies */
372 },
373 {
374 "ssl_server", /* SSL/TLS server parameters */
375 0, /* Check time */
376 0, /* internal flags */
377 0, /* flags */
378 X509_PURPOSE_SSL_SERVER, /* purpose */
379 X509_TRUST_SSL_SERVER, /* trust */
380 -1, /* depth */
381 NULL /* policies */
382 }
383};
384
385static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;
386
387static int
388table_cmp(const X509_VERIFY_PARAM *a, const X509_VERIFY_PARAM *b)
389{
390 return strcmp(a->name, b->name);
391}
392
393DECLARE_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
394IMPLEMENT_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
395
396static int
397param_cmp(const X509_VERIFY_PARAM * const *a,
398 const X509_VERIFY_PARAM * const *b)
399{
400 return strcmp((*a)->name, (*b)->name);
401}
402
403int
404X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
405{
406 int idx;
407 X509_VERIFY_PARAM *ptmp;
408
409 if (!param_table) {
410 param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
411 if (!param_table)
412 return 0;
413 } else {
414 idx = sk_X509_VERIFY_PARAM_find(param_table, param);
415 if (idx != -1) {
416 ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
417 X509_VERIFY_PARAM_free(ptmp);
418 (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
419 }
420 }
421 if (!sk_X509_VERIFY_PARAM_push(param_table, param))
422 return 0;
423 return 1;
424}
425
426const X509_VERIFY_PARAM *
427X509_VERIFY_PARAM_lookup(const char *name)
428{
429 int idx;
430 X509_VERIFY_PARAM pm;
431
432 pm.name = (char *)name;
433 if (param_table) {
434 idx = sk_X509_VERIFY_PARAM_find(param_table, &pm);
435 if (idx != -1)
436 return sk_X509_VERIFY_PARAM_value(param_table, idx);
437 }
438 return OBJ_bsearch_table(&pm, default_table,
439 sizeof(default_table)/sizeof(X509_VERIFY_PARAM));
440}
441
442void
443X509_VERIFY_PARAM_table_cleanup(void)
444{
445 if (param_table)
446 sk_X509_VERIFY_PARAM_pop_free(param_table,
447 X509_VERIFY_PARAM_free);
448 param_table = NULL;
449}
diff --git a/src/lib/libcrypto/x509/x509cset.c b/src/lib/libcrypto/x509/x509cset.c
deleted file mode 100644
index afc1f0f2b3..0000000000
--- a/src/lib/libcrypto/x509/x509cset.c
+++ /dev/null
@@ -1,173 +0,0 @@
1/* $OpenBSD: x509cset.c,v 1.11 2015/09/30 17:49:59 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2001.
4 */
5/* ====================================================================
6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_CRL_set_version(X509_CRL *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 if (x->crl->version == NULL) {
72 if ((x->crl->version = ASN1_INTEGER_new()) == NULL)
73 return (0);
74 }
75 return (ASN1_INTEGER_set(x->crl->version, version));
76}
77
78int
79X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name)
80{
81 if ((x == NULL) || (x->crl == NULL))
82 return (0);
83 return (X509_NAME_set(&x->crl->issuer, name));
84}
85
86int
87X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm)
88{
89 ASN1_TIME *in;
90
91 if (x == NULL)
92 return (0);
93 in = x->crl->lastUpdate;
94 if (in != tm) {
95 in = ASN1_STRING_dup(tm);
96 if (in != NULL) {
97 ASN1_TIME_free(x->crl->lastUpdate);
98 x->crl->lastUpdate = in;
99 }
100 }
101 return (in != NULL);
102}
103
104int
105X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm)
106{
107 ASN1_TIME *in;
108
109 if (x == NULL)
110 return (0);
111 in = x->crl->nextUpdate;
112 if (in != tm) {
113 in = ASN1_STRING_dup(tm);
114 if (in != NULL) {
115 ASN1_TIME_free(x->crl->nextUpdate);
116 x->crl->nextUpdate = in;
117 }
118 }
119 return (in != NULL);
120}
121
122int
123X509_CRL_sort(X509_CRL *c)
124{
125 int i;
126 X509_REVOKED *r;
127
128 /* sort the data so it will be written in serial
129 * number order */
130 sk_X509_REVOKED_sort(c->crl->revoked);
131 for (i = 0; i < sk_X509_REVOKED_num(c->crl->revoked); i++) {
132 r = sk_X509_REVOKED_value(c->crl->revoked, i);
133 r->sequence = i;
134 }
135 c->crl->enc.modified = 1;
136 return 1;
137}
138
139int
140X509_REVOKED_set_revocationDate(X509_REVOKED *x, ASN1_TIME *tm)
141{
142 ASN1_TIME *in;
143
144 if (x == NULL)
145 return (0);
146 in = x->revocationDate;
147 if (in != tm) {
148 in = ASN1_STRING_dup(tm);
149 if (in != NULL) {
150 ASN1_TIME_free(x->revocationDate);
151 x->revocationDate = in;
152 }
153 }
154 return (in != NULL);
155}
156
157int
158X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial)
159{
160 ASN1_INTEGER *in;
161
162 if (x == NULL)
163 return (0);
164 in = x->serialNumber;
165 if (in != serial) {
166 in = ASN1_INTEGER_dup(serial);
167 if (in != NULL) {
168 ASN1_INTEGER_free(x->serialNumber);
169 x->serialNumber = in;
170 }
171 }
172 return (in != NULL);
173}
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
deleted file mode 100644
index 14634013cf..0000000000
--- a/src/lib/libcrypto/x509/x509name.c
+++ /dev/null
@@ -1,410 +0,0 @@
1/* $OpenBSD: x509name.c,v 1.13 2014/09/29 04:17:24 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/err.h>
64#include <openssl/evp.h>
65#include <openssl/objects.h>
66#include <openssl/stack.h>
67#include <openssl/x509.h>
68
69int
70X509_NAME_get_text_by_NID(X509_NAME *name, int nid, char *buf, int len)
71{
72 ASN1_OBJECT *obj;
73
74 obj = OBJ_nid2obj(nid);
75 if (obj == NULL)
76 return (-1);
77 return (X509_NAME_get_text_by_OBJ(name, obj, buf, len));
78}
79
80int
81X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, char *buf,
82 int len)
83{
84 int i;
85 ASN1_STRING *data;
86
87 i = X509_NAME_get_index_by_OBJ(name, obj, -1);
88 if (i < 0)
89 return (-1);
90 data = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
91 i = (data->length > (len - 1)) ? (len - 1) : data->length;
92 if (buf == NULL)
93 return (data->length);
94 if (i >= 0) {
95 memcpy(buf, data->data, i);
96 buf[i] = '\0';
97 }
98 return (i);
99}
100
101int
102X509_NAME_entry_count(X509_NAME *name)
103{
104 if (name == NULL)
105 return (0);
106 return (sk_X509_NAME_ENTRY_num(name->entries));
107}
108
109int
110X509_NAME_get_index_by_NID(X509_NAME *name, int nid, int lastpos)
111{
112 ASN1_OBJECT *obj;
113
114 obj = OBJ_nid2obj(nid);
115 if (obj == NULL)
116 return (-2);
117 return (X509_NAME_get_index_by_OBJ(name, obj, lastpos));
118}
119
120/* NOTE: you should be passsing -1, not 0 as lastpos */
121int
122X509_NAME_get_index_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int lastpos)
123{
124 int n;
125 X509_NAME_ENTRY *ne;
126 STACK_OF(X509_NAME_ENTRY) *sk;
127
128 if (name == NULL)
129 return (-1);
130 if (lastpos < 0)
131 lastpos = -1;
132 sk = name->entries;
133 n = sk_X509_NAME_ENTRY_num(sk);
134 for (lastpos++; lastpos < n; lastpos++) {
135 ne = sk_X509_NAME_ENTRY_value(sk, lastpos);
136 if (OBJ_cmp(ne->object, obj) == 0)
137 return (lastpos);
138 }
139 return (-1);
140}
141
142X509_NAME_ENTRY *
143X509_NAME_get_entry(X509_NAME *name, int loc)
144{
145 if (name == NULL || sk_X509_NAME_ENTRY_num(name->entries) <= loc ||
146 loc < 0)
147 return (NULL);
148 else
149 return (sk_X509_NAME_ENTRY_value(name->entries, loc));
150}
151
152X509_NAME_ENTRY *
153X509_NAME_delete_entry(X509_NAME *name, int loc)
154{
155 X509_NAME_ENTRY *ret;
156 int i, n, set_prev, set_next;
157 STACK_OF(X509_NAME_ENTRY) *sk;
158
159 if (name == NULL || sk_X509_NAME_ENTRY_num(name->entries) <= loc ||
160 loc < 0)
161 return (NULL);
162 sk = name->entries;
163 ret = sk_X509_NAME_ENTRY_delete(sk, loc);
164 n = sk_X509_NAME_ENTRY_num(sk);
165 name->modified = 1;
166 if (loc == n)
167 return (ret);
168
169 /* else we need to fixup the set field */
170 if (loc != 0)
171 set_prev = (sk_X509_NAME_ENTRY_value(sk, loc - 1))->set;
172 else
173 set_prev = ret->set - 1;
174 set_next = sk_X509_NAME_ENTRY_value(sk, loc)->set;
175
176 /* set_prev is the previous set
177 * set is the current set
178 * set_next is the following
179 * prev 1 1 1 1 1 1 1 1
180 * set 1 1 2 2
181 * next 1 1 2 2 2 2 3 2
182 * so basically only if prev and next differ by 2, then
183 * re-number down by 1 */
184 if (set_prev + 1 < set_next)
185 for (i = loc; i < n; i++)
186 sk_X509_NAME_ENTRY_value(sk, i)->set--;
187 return (ret);
188}
189
190int
191X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
192 unsigned char *bytes, int len, int loc, int set)
193{
194 X509_NAME_ENTRY *ne;
195 int ret;
196
197 ne = X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
198 if (!ne)
199 return 0;
200 ret = X509_NAME_add_entry(name, ne, loc, set);
201 X509_NAME_ENTRY_free(ne);
202 return ret;
203}
204
205int
206X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
207 unsigned char *bytes, int len, int loc, int set)
208{
209 X509_NAME_ENTRY *ne;
210 int ret;
211
212 ne = X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
213 if (!ne)
214 return 0;
215 ret = X509_NAME_add_entry(name, ne, loc, set);
216 X509_NAME_ENTRY_free(ne);
217 return ret;
218}
219
220int
221X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
222 const unsigned char *bytes, int len, int loc, int set)
223{
224 X509_NAME_ENTRY *ne;
225 int ret;
226
227 ne = X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
228 if (!ne)
229 return 0;
230 ret = X509_NAME_add_entry(name, ne, loc, set);
231 X509_NAME_ENTRY_free(ne);
232 return ret;
233}
234
235/* if set is -1, append to previous set, 0 'a new one', and 1,
236 * prepend to the guy we are about to stomp on. */
237int
238X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc, int set)
239{
240 X509_NAME_ENTRY *new_name = NULL;
241 int n, i, inc;
242 STACK_OF(X509_NAME_ENTRY) *sk;
243
244 if (name == NULL)
245 return (0);
246 sk = name->entries;
247 n = sk_X509_NAME_ENTRY_num(sk);
248 if (loc > n)
249 loc = n;
250 else if (loc < 0)
251 loc = n;
252
253 name->modified = 1;
254
255 if (set == -1) {
256 if (loc == 0) {
257 set = 0;
258 inc = 1;
259 } else {
260 set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set;
261 inc = 0;
262 }
263 } else /* if (set >= 0) */ {
264 if (loc >= n) {
265 if (loc != 0)
266 set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set + 1;
267 else
268 set = 0;
269 } else
270 set = sk_X509_NAME_ENTRY_value(sk, loc)->set;
271 inc = (set == 0) ? 1 : 0;
272 }
273
274 if ((new_name = X509_NAME_ENTRY_dup(ne)) == NULL)
275 goto err;
276 new_name->set = set;
277 if (!sk_X509_NAME_ENTRY_insert(sk, new_name, loc)) {
278 X509err(X509_F_X509_NAME_ADD_ENTRY, ERR_R_MALLOC_FAILURE);
279 goto err;
280 }
281 if (inc) {
282 n = sk_X509_NAME_ENTRY_num(sk);
283 for (i = loc + 1; i < n; i++)
284 sk_X509_NAME_ENTRY_value(sk, i - 1)->set += 1;
285 }
286 return (1);
287
288err:
289 if (new_name != NULL)
290 X509_NAME_ENTRY_free(new_name);
291 return (0);
292}
293
294X509_NAME_ENTRY *
295X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
296 const char *field, int type, const unsigned char *bytes, int len)
297{
298 ASN1_OBJECT *obj;
299 X509_NAME_ENTRY *nentry;
300
301 obj = OBJ_txt2obj(field, 0);
302 if (obj == NULL) {
303 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
304 X509_R_INVALID_FIELD_NAME);
305 ERR_asprintf_error_data("name=%s", field);
306 return (NULL);
307 }
308 nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
309 ASN1_OBJECT_free(obj);
310 return nentry;
311}
312
313X509_NAME_ENTRY *
314X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid, int type,
315 unsigned char *bytes, int len)
316{
317 ASN1_OBJECT *obj;
318 X509_NAME_ENTRY *nentry;
319
320 obj = OBJ_nid2obj(nid);
321 if (obj == NULL) {
322 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_NID,
323 X509_R_UNKNOWN_NID);
324 return (NULL);
325 }
326 nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
327 ASN1_OBJECT_free(obj);
328 return nentry;
329}
330
331X509_NAME_ENTRY *
332X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne, ASN1_OBJECT *obj, int type,
333 const unsigned char *bytes, int len)
334{
335 X509_NAME_ENTRY *ret;
336
337 if ((ne == NULL) || (*ne == NULL)) {
338 if ((ret = X509_NAME_ENTRY_new()) == NULL)
339 return (NULL);
340 } else
341 ret= *ne;
342
343 if (!X509_NAME_ENTRY_set_object(ret, obj))
344 goto err;
345 if (!X509_NAME_ENTRY_set_data(ret, type, bytes, len))
346 goto err;
347
348 if ((ne != NULL) && (*ne == NULL))
349 *ne = ret;
350 return (ret);
351
352err:
353 if ((ne == NULL) || (ret != *ne))
354 X509_NAME_ENTRY_free(ret);
355 return (NULL);
356}
357
358int
359X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, ASN1_OBJECT *obj)
360{
361 if ((ne == NULL) || (obj == NULL)) {
362 X509err(X509_F_X509_NAME_ENTRY_SET_OBJECT,
363 ERR_R_PASSED_NULL_PARAMETER);
364 return (0);
365 }
366 ASN1_OBJECT_free(ne->object);
367 ne->object = OBJ_dup(obj);
368 return ((ne->object == NULL) ? 0 : 1);
369}
370
371int
372X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
373 const unsigned char *bytes, int len)
374{
375 int i;
376
377 if ((ne == NULL) || ((bytes == NULL) && (len != 0)))
378 return (0);
379 if ((type > 0) && (type & MBSTRING_FLAG))
380 return ASN1_STRING_set_by_NID(&ne->value, bytes, len, type,
381 OBJ_obj2nid(ne->object)) ? 1 : 0;
382 if (len < 0)
383 len = strlen((const char *)bytes);
384 i = ASN1_STRING_set(ne->value, bytes, len);
385 if (!i)
386 return (0);
387 if (type != V_ASN1_UNDEF) {
388 if (type == V_ASN1_APP_CHOOSE)
389 ne->value->type = ASN1_PRINTABLE_type(bytes, len);
390 else
391 ne->value->type = type;
392 }
393 return (1);
394}
395
396ASN1_OBJECT *
397X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne)
398{
399 if (ne == NULL)
400 return (NULL);
401 return (ne->object);
402}
403
404ASN1_STRING *
405X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne)
406{
407 if (ne == NULL)
408 return (NULL);
409 return (ne->value);
410}
diff --git a/src/lib/libcrypto/x509/x509rset.c b/src/lib/libcrypto/x509/x509rset.c
deleted file mode 100644
index cfac977636..0000000000
--- a/src/lib/libcrypto/x509/x509rset.c
+++ /dev/null
@@ -1,88 +0,0 @@
1/* $OpenBSD: x509rset.c,v 1.6 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_REQ_set_version(X509_REQ *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 return (ASN1_INTEGER_set(x->req_info->version, version));
72}
73
74int
75X509_REQ_set_subject_name(X509_REQ *x, X509_NAME *name)
76{
77 if ((x == NULL) || (x->req_info == NULL))
78 return (0);
79 return (X509_NAME_set(&x->req_info->subject, name));
80}
81
82int
83X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey)
84{
85 if ((x == NULL) || (x->req_info == NULL))
86 return (0);
87 return (X509_PUBKEY_set(&x->req_info->pubkey, pkey));
88}
diff --git a/src/lib/libcrypto/x509/x509spki.c b/src/lib/libcrypto/x509/x509spki.c
deleted file mode 100644
index cd29a8138a..0000000000
--- a/src/lib/libcrypto/x509/x509spki.c
+++ /dev/null
@@ -1,132 +0,0 @@
1/* $OpenBSD: x509spki.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/x509.h>
64
65int
66NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey)
67{
68 if ((x == NULL) || (x->spkac == NULL))
69 return (0);
70 return (X509_PUBKEY_set(&(x->spkac->pubkey), pkey));
71}
72
73EVP_PKEY *
74NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
75{
76 if ((x == NULL) || (x->spkac == NULL))
77 return (NULL);
78 return (X509_PUBKEY_get(x->spkac->pubkey));
79}
80
81/* Load a Netscape SPKI from a base64 encoded string */
82
83NETSCAPE_SPKI *
84NETSCAPE_SPKI_b64_decode(const char *str, int len)
85{
86 unsigned char *spki_der;
87 const unsigned char *p;
88 int spki_len;
89 NETSCAPE_SPKI *spki;
90
91 if (len <= 0)
92 len = strlen(str);
93 if (!(spki_der = malloc(len + 1))) {
94 X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
95 return NULL;
96 }
97 spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
98 if (spki_len < 0) {
99 X509err(X509_F_NETSCAPE_SPKI_B64_DECODE,
100 X509_R_BASE64_DECODE_ERROR);
101 free(spki_der);
102 return NULL;
103 }
104 p = spki_der;
105 spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
106 free(spki_der);
107 return spki;
108}
109
110/* Generate a base64 encoded string from an SPKI */
111
112char *
113NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki)
114{
115 unsigned char *der_spki, *p;
116 char *b64_str;
117 int der_len;
118 der_len = i2d_NETSCAPE_SPKI(spki, NULL);
119 der_spki = malloc(der_len);
120 b64_str = reallocarray(NULL, der_len, 2);
121 if (!der_spki || !b64_str) {
122 X509err(X509_F_NETSCAPE_SPKI_B64_ENCODE, ERR_R_MALLOC_FAILURE);
123 free(der_spki);
124 free(b64_str);
125 return NULL;
126 }
127 p = der_spki;
128 i2d_NETSCAPE_SPKI(spki, &p);
129 EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);
130 free(der_spki);
131 return b64_str;
132}
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
deleted file mode 100644
index d0dcffb290..0000000000
--- a/src/lib/libcrypto/x509/x509type.c
+++ /dev/null
@@ -1,130 +0,0 @@
1/* $OpenBSD: x509type.c,v 1.12 2015/06/13 08:38:10 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/evp.h>
62#include <openssl/objects.h>
63#include <openssl/x509.h>
64
65int
66X509_certificate_type(X509 *x, EVP_PKEY *pkey)
67{
68 EVP_PKEY *pk;
69 int ret = 0, i;
70
71 if (x == NULL)
72 return (0);
73
74 if (pkey == NULL)
75 pk = X509_get_pubkey(x);
76 else
77 pk = pkey;
78
79 if (pk == NULL)
80 return (0);
81
82 switch (pk->type) {
83 case EVP_PKEY_RSA:
84 ret = EVP_PK_RSA|EVP_PKT_SIGN;
85/* if (!sign only extension) */
86 ret |= EVP_PKT_ENC;
87 break;
88 case EVP_PKEY_DSA:
89 ret = EVP_PK_DSA|EVP_PKT_SIGN;
90 break;
91 case EVP_PKEY_EC:
92 ret = EVP_PK_EC|EVP_PKT_SIGN|EVP_PKT_EXCH;
93 break;
94 case EVP_PKEY_DH:
95 ret = EVP_PK_DH|EVP_PKT_EXCH;
96 break;
97 case NID_id_GostR3410_94:
98 case NID_id_GostR3410_2001:
99 ret = EVP_PKT_EXCH|EVP_PKT_SIGN;
100 break;
101 default:
102 break;
103 }
104
105 i = OBJ_obj2nid(x->sig_alg->algorithm);
106 if (i && OBJ_find_sigid_algs(i, NULL, &i)) {
107 switch (i) {
108 case NID_rsaEncryption:
109 case NID_rsa:
110 ret |= EVP_PKS_RSA;
111 break;
112 case NID_dsa:
113 case NID_dsa_2:
114 ret |= EVP_PKS_DSA;
115 break;
116 case NID_X9_62_id_ecPublicKey:
117 ret |= EVP_PKS_EC;
118 break;
119 default:
120 break;
121 }
122 }
123
124 /* /8 because it's 1024 bits we look for, not bytes */
125 if (EVP_PKEY_size(pk) <= 1024 / 8)
126 ret |= EVP_PKT_EXP;
127 if (pkey == NULL)
128 EVP_PKEY_free(pk);
129 return (ret);
130}
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
deleted file mode 100644
index 21a8535445..0000000000
--- a/src/lib/libcrypto/x509/x_all.c
+++ /dev/null
@@ -1,602 +0,0 @@
1/* $OpenBSD: x_all.c,v 1.21 2015/10/13 14:03:26 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/asn1.h>
64#include <openssl/buffer.h>
65#include <openssl/evp.h>
66#include <openssl/stack.h>
67#include <openssl/x509.h>
68
69#ifndef OPENSSL_NO_DSA
70#include <openssl/dsa.h>
71#endif
72#ifndef OPENSSL_NO_RSA
73#include <openssl/rsa.h>
74#endif
75
76X509 *
77d2i_X509_bio(BIO *bp, X509 **x509)
78{
79 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509);
80}
81
82int
83i2d_X509_bio(BIO *bp, X509 *x509)
84{
85 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509);
86}
87
88X509 *
89d2i_X509_fp(FILE *fp, X509 **x509)
90{
91 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509);
92}
93
94int
95i2d_X509_fp(FILE *fp, X509 *x509)
96{
97 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509);
98}
99
100X509_CRL *
101d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl)
102{
103 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
104}
105
106int
107i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl)
108{
109 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
110}
111
112X509_CRL *
113d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl)
114{
115 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
116}
117
118int
119i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl)
120{
121 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
122}
123
124PKCS7 *
125d2i_PKCS7_bio(BIO *bp, PKCS7 **p7)
126{
127 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
128}
129
130int
131i2d_PKCS7_bio(BIO *bp, PKCS7 *p7)
132{
133 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
134}
135
136PKCS7 *
137d2i_PKCS7_fp(FILE *fp, PKCS7 **p7)
138{
139 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
140}
141
142int
143i2d_PKCS7_fp(FILE *fp, PKCS7 *p7)
144{
145 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
146}
147
148X509_REQ *
149d2i_X509_REQ_bio(BIO *bp, X509_REQ **req)
150{
151 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
152}
153
154int
155i2d_X509_REQ_bio(BIO *bp, X509_REQ *req)
156{
157 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
158}
159
160X509_REQ *
161d2i_X509_REQ_fp(FILE *fp, X509_REQ **req)
162{
163 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
164}
165
166int
167i2d_X509_REQ_fp(FILE *fp, X509_REQ *req)
168{
169 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
170}
171
172#ifndef OPENSSL_NO_RSA
173RSA *
174d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
175{
176 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
177}
178
179int
180i2d_RSAPrivateKey_bio(BIO *bp, RSA *rsa)
181{
182 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
183}
184
185RSA *
186d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa)
187{
188 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
189}
190
191int
192i2d_RSAPrivateKey_fp(FILE *fp, RSA *rsa)
193{
194 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
195}
196
197RSA *
198d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
199{
200 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
201}
202
203int
204i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
205{
206 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
207}
208
209RSA *
210d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
211{
212 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
213}
214
215int
216i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
217{
218 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
219}
220
221RSA *
222d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
223{
224 return ASN1_d2i_bio_of(RSA, RSA_new, d2i_RSA_PUBKEY, bp, rsa);
225}
226
227int
228i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
229{
230 return ASN1_i2d_bio_of(RSA, i2d_RSA_PUBKEY, bp, rsa);
231}
232
233int
234i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa)
235{
236 return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY, fp, rsa);
237}
238
239RSA *
240d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
241{
242 return ASN1_d2i_fp((void *(*)(void))RSA_new,
243 (D2I_OF(void))d2i_RSA_PUBKEY, fp, (void **)rsa);
244}
245#endif
246
247#ifndef OPENSSL_NO_DSA
248DSA *
249d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
250{
251 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(DSAPrivateKey), bp, dsa);
252}
253
254int
255i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa)
256{
257 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(DSAPrivateKey), bp, dsa);
258}
259
260DSA *
261d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa)
262{
263 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(DSAPrivateKey), fp, dsa);
264}
265
266int
267i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa)
268{
269 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(DSAPrivateKey), fp, dsa);
270}
271
272DSA *
273d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
274{
275 return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSA_PUBKEY, bp, dsa);
276}
277
278int
279i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa)
280{
281 return ASN1_i2d_bio_of(DSA, i2d_DSA_PUBKEY, bp, dsa);
282}
283
284DSA *
285d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
286{
287 return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSA_PUBKEY, fp, dsa);
288}
289
290int
291i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa)
292{
293 return ASN1_i2d_fp_of(DSA, i2d_DSA_PUBKEY, fp, dsa);
294}
295#endif
296
297#ifndef OPENSSL_NO_EC
298EC_KEY *
299d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey)
300{
301 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, bp, eckey);
302}
303
304int
305i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey)
306{
307 return ASN1_i2d_bio_of(EC_KEY, i2d_ECPrivateKey, bp, eckey);
308}
309
310EC_KEY *
311d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey)
312{
313 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, fp, eckey);
314}
315
316int
317i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey)
318{
319 return ASN1_i2d_fp_of(EC_KEY, i2d_ECPrivateKey, fp, eckey);
320}
321
322EC_KEY *
323d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey)
324{
325 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, bp, eckey);
326}
327
328int
329i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *ecdsa)
330{
331 return ASN1_i2d_bio_of(EC_KEY, i2d_EC_PUBKEY, bp, ecdsa);
332}
333EC_KEY *
334d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey)
335{
336 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, fp, eckey);
337}
338
339int
340i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey)
341{
342 return ASN1_i2d_fp_of(EC_KEY, i2d_EC_PUBKEY, fp, eckey);
343}
344#endif
345
346X509_SIG *
347d2i_PKCS8_bio(BIO *bp, X509_SIG **p8)
348{
349 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_SIG), bp, p8);
350}
351
352int
353i2d_PKCS8_bio(BIO *bp, X509_SIG *p8)
354{
355 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_SIG), bp, p8);
356}
357
358X509_SIG *
359d2i_PKCS8_fp(FILE *fp, X509_SIG **p8)
360{
361 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_SIG), fp, p8);
362}
363
364int
365i2d_PKCS8_fp(FILE *fp, X509_SIG *p8)
366{
367 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_SIG), fp, p8);
368}
369
370PKCS8_PRIV_KEY_INFO *
371d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO **p8inf)
372{
373 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), bp,
374 p8inf);
375}
376
377int
378i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf)
379{
380 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), bp,
381 p8inf);
382}
383
384PKCS8_PRIV_KEY_INFO *
385d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO **p8inf)
386{
387 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), fp,
388 p8inf);
389}
390
391int
392i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf)
393{
394 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS8_PRIV_KEY_INFO), fp,
395 p8inf);
396}
397
398EVP_PKEY *
399d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
400{
401 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey,
402 bp, a);
403}
404
405int
406i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey)
407{
408 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PrivateKey, bp, pkey);
409}
410
411EVP_PKEY *
412d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
413{
414 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey,
415 fp, a);
416}
417
418int
419i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey)
420{
421 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PrivateKey, fp, pkey);
422}
423
424EVP_PKEY *
425d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a)
426{
427 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, bp, a);
428}
429
430int
431i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey)
432{
433 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PUBKEY, bp, pkey);
434}
435
436int
437i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey)
438{
439 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PUBKEY, fp, pkey);
440}
441
442EVP_PKEY *
443d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
444{
445 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, fp, a);
446}
447
448int
449i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
450{
451 PKCS8_PRIV_KEY_INFO *p8inf;
452 int ret;
453
454 p8inf = EVP_PKEY2PKCS8(key);
455 if (!p8inf)
456 return 0;
457 ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
458 PKCS8_PRIV_KEY_INFO_free(p8inf);
459 return ret;
460}
461
462int
463i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
464{
465 PKCS8_PRIV_KEY_INFO *p8inf;
466 int ret;
467 p8inf = EVP_PKEY2PKCS8(key);
468 if (!p8inf)
469 return 0;
470 ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
471 PKCS8_PRIV_KEY_INFO_free(p8inf);
472 return ret;
473}
474
475int
476X509_verify(X509 *a, EVP_PKEY *r)
477{
478 if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))
479 return 0;
480 return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), a->sig_alg,
481 a->signature, a->cert_info, r));
482}
483
484int
485X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
486{
487 return (ASN1_item_verify(ASN1_ITEM_rptr(X509_REQ_INFO),
488 a->sig_alg, a->signature, a->req_info, r));
489}
490
491int
492NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
493{
494 return (ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
495 a->sig_algor, a->signature, a->spkac, r));
496}
497
498int
499X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
500{
501 x->cert_info->enc.modified = 1;
502 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF),
503 x->cert_info->signature, x->sig_alg, x->signature,
504 x->cert_info, pkey, md));
505}
506
507int
508X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
509{
510 x->cert_info->enc.modified = 1;
511 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
512 x->cert_info->signature, x->sig_alg, x->signature,
513 x->cert_info, ctx);
514}
515
516int
517X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
518{
519 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO),
520 x->sig_alg, NULL, x->signature, x->req_info, pkey, md));
521}
522
523int
524X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
525{
526 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
527 x->sig_alg, NULL, x->signature, x->req_info, ctx);
528}
529
530int
531X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
532{
533 x->crl->enc.modified = 1;
534 return(ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), x->crl->sig_alg,
535 x->sig_alg, x->signature, x->crl, pkey, md));
536}
537
538int
539X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
540{
541 x->crl->enc.modified = 1;
542 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
543 x->crl->sig_alg, x->sig_alg, x->signature, x->crl, ctx);
544}
545
546int
547NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
548{
549 return (ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
550 x->sig_algor, NULL, x->signature, x->spkac, pkey, md));
551}
552
553int
554X509_pubkey_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
555 unsigned int *len)
556{
557 ASN1_BIT_STRING *key;
558 key = X509_get0_pubkey_bitstr(data);
559 if (!key)
560 return 0;
561 return EVP_Digest(key->data, key->length, md, len, type, NULL);
562}
563
564int
565X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
566 unsigned int *len)
567{
568 return (ASN1_item_digest(ASN1_ITEM_rptr(X509), type, (char *)data,
569 md, len));
570}
571
572int
573X509_CRL_digest(const X509_CRL *data, const EVP_MD *type, unsigned char *md,
574 unsigned int *len)
575{
576 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_CRL), type, (char *)data,
577 md, len));
578}
579
580int
581X509_REQ_digest(const X509_REQ *data, const EVP_MD *type, unsigned char *md,
582 unsigned int *len)
583{
584 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_REQ), type, (char *)data,
585 md, len));
586}
587
588int
589X509_NAME_digest(const X509_NAME *data, const EVP_MD *type, unsigned char *md,
590 unsigned int *len)
591{
592 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_NAME), type, (char *)data,
593 md, len));
594}
595
596int
597PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
598 const EVP_MD *type, unsigned char *md, unsigned int *len)
599{
600 return(ASN1_item_digest(ASN1_ITEM_rptr(PKCS7_ISSUER_AND_SERIAL), type,
601 (char *)data, md, len));
602}
diff --git a/src/lib/libcrypto/x509v3/ext_dat.h b/src/lib/libcrypto/x509v3/ext_dat.h
deleted file mode 100644
index f8bf7916b3..0000000000
--- a/src/lib/libcrypto/x509v3/ext_dat.h
+++ /dev/null
@@ -1,129 +0,0 @@
1/* $OpenBSD: ext_dat.h,v 1.12 2015/02/10 13:28:17 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/opensslconf.h>
60
61/* This file contains a table of "standard" extensions */
62
63extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
64extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet, v3_info, v3_sinfo;
65extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
66extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_crl_invdate;
67extern X509V3_EXT_METHOD v3_delta_crl, v3_cpols, v3_crld, v3_freshest_crl;
68extern X509V3_EXT_METHOD v3_ocsp_nonce, v3_ocsp_accresp, v3_ocsp_acutoff;
69extern X509V3_EXT_METHOD v3_ocsp_crlid, v3_ocsp_nocheck, v3_ocsp_serviceloc;
70extern X509V3_EXT_METHOD v3_crl_hold, v3_pci;
71extern X509V3_EXT_METHOD v3_policy_mappings, v3_policy_constraints;
72extern X509V3_EXT_METHOD v3_name_constraints, v3_inhibit_anyp, v3_idp;
73extern X509V3_EXT_METHOD v3_addr, v3_asid;
74
75/* This table will be searched using OBJ_bsearch so it *must* kept in
76 * order of the ext_nid values.
77 */
78
79static const X509V3_EXT_METHOD *standard_exts[] = {
80 &v3_nscert,
81 &v3_ns_ia5_list[0],
82 &v3_ns_ia5_list[1],
83 &v3_ns_ia5_list[2],
84 &v3_ns_ia5_list[3],
85 &v3_ns_ia5_list[4],
86 &v3_ns_ia5_list[5],
87 &v3_ns_ia5_list[6],
88 &v3_skey_id,
89 &v3_key_usage,
90 &v3_pkey_usage_period,
91 &v3_alt[0],
92 &v3_alt[1],
93 &v3_bcons,
94 &v3_crl_num,
95 &v3_cpols,
96 &v3_akey_id,
97 &v3_crld,
98 &v3_ext_ku,
99 &v3_delta_crl,
100 &v3_crl_reason,
101#ifndef OPENSSL_NO_OCSP
102 &v3_crl_invdate,
103#endif
104 &v3_sxnet,
105 &v3_info,
106#ifndef OPENSSL_NO_OCSP
107 &v3_ocsp_nonce,
108 &v3_ocsp_crlid,
109 &v3_ocsp_accresp,
110 &v3_ocsp_nocheck,
111 &v3_ocsp_acutoff,
112 &v3_ocsp_serviceloc,
113#endif
114 &v3_sinfo,
115 &v3_policy_constraints,
116#ifndef OPENSSL_NO_OCSP
117 &v3_crl_hold,
118#endif
119 &v3_pci,
120 &v3_name_constraints,
121 &v3_policy_mappings,
122 &v3_inhibit_anyp,
123 &v3_idp,
124 &v3_alt[2],
125 &v3_freshest_crl,
126};
127
128/* Number of standard extensions */
129#define STANDARD_EXTENSION_COUNT (sizeof(standard_exts)/sizeof(X509V3_EXT_METHOD *))
diff --git a/src/lib/libcrypto/x509v3/pcy_cache.c b/src/lib/libcrypto/x509v3/pcy_cache.c
deleted file mode 100644
index 9c8ba8298b..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_cache.c
+++ /dev/null
@@ -1,271 +0,0 @@
1/* $OpenBSD: pcy_cache.c,v 1.5 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/x509.h>
60#include <openssl/x509v3.h>
61
62#include "pcy_int.h"
63
64static int policy_data_cmp(const X509_POLICY_DATA * const *a,
65 const X509_POLICY_DATA * const *b);
66static int policy_cache_set_int(long *out, ASN1_INTEGER *value);
67
68/* Set cache entry according to CertificatePolicies extension.
69 * Note: this destroys the passed CERTIFICATEPOLICIES structure.
70 */
71
72static int
73policy_cache_create(X509 *x, CERTIFICATEPOLICIES *policies, int crit)
74{
75 int i;
76 int ret = 0;
77 X509_POLICY_CACHE *cache = x->policy_cache;
78 X509_POLICY_DATA *data = NULL;
79 POLICYINFO *policy;
80
81 if (sk_POLICYINFO_num(policies) == 0)
82 goto bad_policy;
83 cache->data = sk_X509_POLICY_DATA_new(policy_data_cmp);
84 if (!cache->data)
85 goto bad_policy;
86 for (i = 0; i < sk_POLICYINFO_num(policies); i++) {
87 policy = sk_POLICYINFO_value(policies, i);
88 data = policy_data_new(policy, NULL, crit);
89 if (!data)
90 goto bad_policy;
91 /* Duplicate policy OIDs are illegal: reject if matches
92 * found.
93 */
94 if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) {
95 if (cache->anyPolicy) {
96 ret = -1;
97 goto bad_policy;
98 }
99 cache->anyPolicy = data;
100 } else if (sk_X509_POLICY_DATA_find(cache->data, data) != -1) {
101 ret = -1;
102 goto bad_policy;
103 } else if (!sk_X509_POLICY_DATA_push(cache->data, data))
104 goto bad_policy;
105 data = NULL;
106 }
107 ret = 1;
108
109bad_policy:
110 if (ret == -1)
111 x->ex_flags |= EXFLAG_INVALID_POLICY;
112 if (data)
113 policy_data_free(data);
114 sk_POLICYINFO_pop_free(policies, POLICYINFO_free);
115 if (ret <= 0) {
116 sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
117 cache->data = NULL;
118 }
119 return ret;
120}
121
122static int
123policy_cache_new(X509 *x)
124{
125 X509_POLICY_CACHE *cache;
126 ASN1_INTEGER *ext_any = NULL;
127 POLICY_CONSTRAINTS *ext_pcons = NULL;
128 CERTIFICATEPOLICIES *ext_cpols = NULL;
129 POLICY_MAPPINGS *ext_pmaps = NULL;
130 int i;
131
132 cache = malloc(sizeof(X509_POLICY_CACHE));
133 if (!cache)
134 return 0;
135 cache->anyPolicy = NULL;
136 cache->data = NULL;
137 cache->any_skip = -1;
138 cache->explicit_skip = -1;
139 cache->map_skip = -1;
140
141 x->policy_cache = cache;
142
143 /* Handle requireExplicitPolicy *first*. Need to process this
144 * even if we don't have any policies.
145 */
146 ext_pcons = X509_get_ext_d2i(x, NID_policy_constraints, &i, NULL);
147
148 if (!ext_pcons) {
149 if (i != -1)
150 goto bad_cache;
151 } else {
152 if (!ext_pcons->requireExplicitPolicy &&
153 !ext_pcons->inhibitPolicyMapping)
154 goto bad_cache;
155 if (!policy_cache_set_int(&cache->explicit_skip,
156 ext_pcons->requireExplicitPolicy))
157 goto bad_cache;
158 if (!policy_cache_set_int(&cache->map_skip,
159 ext_pcons->inhibitPolicyMapping))
160 goto bad_cache;
161 }
162
163 /* Process CertificatePolicies */
164
165 ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);
166 /* If no CertificatePolicies extension or problem decoding then
167 * there is no point continuing because the valid policies will be
168 * NULL.
169 */
170 if (!ext_cpols) {
171 /* If not absent some problem with extension */
172 if (i != -1)
173 goto bad_cache;
174 return 1;
175 }
176
177 i = policy_cache_create(x, ext_cpols, i);
178
179 /* NB: ext_cpols freed by policy_cache_set_policies */
180
181 if (i <= 0)
182 return i;
183
184 ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);
185
186 if (!ext_pmaps) {
187 /* If not absent some problem with extension */
188 if (i != -1)
189 goto bad_cache;
190 } else {
191 i = policy_cache_set_mapping(x, ext_pmaps);
192 if (i <= 0)
193 goto bad_cache;
194 }
195
196 ext_any = X509_get_ext_d2i(x, NID_inhibit_any_policy, &i, NULL);
197
198 if (!ext_any) {
199 if (i != -1)
200 goto bad_cache;
201 } else if (!policy_cache_set_int(&cache->any_skip, ext_any))
202 goto bad_cache;
203
204 if (0) {
205bad_cache:
206 x->ex_flags |= EXFLAG_INVALID_POLICY;
207 }
208
209 if (ext_pcons)
210 POLICY_CONSTRAINTS_free(ext_pcons);
211
212 if (ext_any)
213 ASN1_INTEGER_free(ext_any);
214
215 return 1;
216}
217
218void
219policy_cache_free(X509_POLICY_CACHE *cache)
220{
221 if (!cache)
222 return;
223 if (cache->anyPolicy)
224 policy_data_free(cache->anyPolicy);
225 if (cache->data)
226 sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
227 free(cache);
228}
229
230const X509_POLICY_CACHE *
231policy_cache_set(X509 *x)
232{
233 if (x->policy_cache == NULL) {
234 CRYPTO_w_lock(CRYPTO_LOCK_X509);
235 policy_cache_new(x);
236 CRYPTO_w_unlock(CRYPTO_LOCK_X509);
237 }
238
239 return x->policy_cache;
240}
241
242X509_POLICY_DATA *
243policy_cache_find_data(const X509_POLICY_CACHE *cache, const ASN1_OBJECT *id)
244{
245 int idx;
246 X509_POLICY_DATA tmp;
247
248 tmp.valid_policy = (ASN1_OBJECT *)id;
249 idx = sk_X509_POLICY_DATA_find(cache->data, &tmp);
250 if (idx == -1)
251 return NULL;
252 return sk_X509_POLICY_DATA_value(cache->data, idx);
253}
254
255static int
256policy_data_cmp(const X509_POLICY_DATA * const *a,
257 const X509_POLICY_DATA * const *b)
258{
259 return OBJ_cmp((*a)->valid_policy, (*b)->valid_policy);
260}
261
262static int
263policy_cache_set_int(long *out, ASN1_INTEGER *value)
264{
265 if (value == NULL)
266 return 1;
267 if (value->type == V_ASN1_NEG_INTEGER)
268 return 0;
269 *out = ASN1_INTEGER_get(value);
270 return 1;
271}
diff --git a/src/lib/libcrypto/x509v3/pcy_data.c b/src/lib/libcrypto/x509v3/pcy_data.c
deleted file mode 100644
index b3699b0280..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_data.c
+++ /dev/null
@@ -1,129 +0,0 @@
1/* $OpenBSD: pcy_data.c,v 1.9 2015/07/15 16:53:42 miod Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/x509.h>
60#include <openssl/x509v3.h>
61
62#include "pcy_int.h"
63
64/* Policy Node routines */
65
66void
67policy_data_free(X509_POLICY_DATA *data)
68{
69 ASN1_OBJECT_free(data->valid_policy);
70 /* Don't free qualifiers if shared */
71 if (!(data->flags & POLICY_DATA_FLAG_SHARED_QUALIFIERS))
72 sk_POLICYQUALINFO_pop_free(data->qualifier_set,
73 POLICYQUALINFO_free);
74 sk_ASN1_OBJECT_pop_free(data->expected_policy_set, ASN1_OBJECT_free);
75 free(data);
76}
77
78/* Create a data based on an existing policy. If 'id' is NULL use the
79 * oid in the policy, otherwise use 'id'. This behaviour covers the two
80 * types of data in RFC3280: data with from a CertificatePolcies extension
81 * and additional data with just the qualifiers of anyPolicy and ID from
82 * another source.
83 */
84
85X509_POLICY_DATA *
86policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *cid, int crit)
87{
88 X509_POLICY_DATA *ret = NULL;
89 ASN1_OBJECT *id = NULL;
90
91 if (policy == NULL && cid == NULL)
92 return NULL;
93 if (cid != NULL) {
94 id = OBJ_dup(cid);
95 if (id == NULL)
96 return NULL;
97 }
98 ret = malloc(sizeof(X509_POLICY_DATA));
99 if (ret == NULL)
100 goto err;
101 ret->expected_policy_set = sk_ASN1_OBJECT_new_null();
102 if (ret->expected_policy_set == NULL)
103 goto err;
104
105 if (crit)
106 ret->flags = POLICY_DATA_FLAG_CRITICAL;
107 else
108 ret->flags = 0;
109
110 if (id != NULL)
111 ret->valid_policy = id;
112 else {
113 ret->valid_policy = policy->policyid;
114 policy->policyid = NULL;
115 }
116
117 if (policy != NULL) {
118 ret->qualifier_set = policy->qualifiers;
119 policy->qualifiers = NULL;
120 } else
121 ret->qualifier_set = NULL;
122
123 return ret;
124
125err:
126 free(ret);
127 ASN1_OBJECT_free(id);
128 return NULL;
129}
diff --git a/src/lib/libcrypto/x509v3/pcy_int.h b/src/lib/libcrypto/x509v3/pcy_int.h
deleted file mode 100644
index 50ed7cbfcf..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_int.h
+++ /dev/null
@@ -1,206 +0,0 @@
1/* $OpenBSD: pcy_int.h,v 1.4 2015/07/18 00:01:05 beck Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59
60typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
61
62DECLARE_STACK_OF(X509_POLICY_DATA)
63
64/* Internal structures */
65
66/* This structure and the field names correspond to the Policy 'node' of
67 * RFC3280. NB this structure contains no pointers to parent or child
68 * data: X509_POLICY_NODE contains that. This means that the main policy data
69 * can be kept static and cached with the certificate.
70 */
71
72struct X509_POLICY_DATA_st {
73 unsigned int flags;
74 /* Policy OID and qualifiers for this data */
75 ASN1_OBJECT *valid_policy;
76 STACK_OF(POLICYQUALINFO) *qualifier_set;
77 STACK_OF(ASN1_OBJECT) *expected_policy_set;
78};
79
80/* X509_POLICY_DATA flags values */
81
82/* This flag indicates the structure has been mapped using a policy mapping
83 * extension. If policy mapping is not active its references get deleted.
84 */
85
86#define POLICY_DATA_FLAG_MAPPED 0x1
87
88/* This flag indicates the data doesn't correspond to a policy in Certificate
89 * Policies: it has been mapped to any policy.
90 */
91
92#define POLICY_DATA_FLAG_MAPPED_ANY 0x2
93
94/* AND with flags to see if any mapping has occurred */
95
96#define POLICY_DATA_FLAG_MAP_MASK 0x3
97
98/* qualifiers are shared and shouldn't be freed */
99
100#define POLICY_DATA_FLAG_SHARED_QUALIFIERS 0x4
101
102/* Parent node is an extra node and should be freed */
103
104#define POLICY_DATA_FLAG_EXTRA_NODE 0x8
105
106/* Corresponding CertificatePolicies is critical */
107
108#define POLICY_DATA_FLAG_CRITICAL 0x10
109
110/* This structure is cached with a certificate */
111
112struct X509_POLICY_CACHE_st {
113 /* anyPolicy data or NULL if no anyPolicy */
114 X509_POLICY_DATA *anyPolicy;
115 /* other policy data */
116 STACK_OF(X509_POLICY_DATA) *data;
117 /* If InhibitAnyPolicy present this is its value or -1 if absent. */
118 long any_skip;
119 /* If policyConstraints and requireExplicitPolicy present this is its
120 * value or -1 if absent.
121 */
122 long explicit_skip;
123 /* If policyConstraints and policyMapping present this is its
124 * value or -1 if absent.
125 */
126 long map_skip;
127};
128
129/*#define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL*/
130
131/* This structure represents the relationship between nodes */
132
133struct X509_POLICY_NODE_st {
134 /* node data this refers to */
135 const X509_POLICY_DATA *data;
136 /* Parent node */
137 X509_POLICY_NODE *parent;
138 /* Number of child nodes */
139 int nchild;
140};
141
142struct X509_POLICY_LEVEL_st {
143 /* Cert for this level */
144 X509 *cert;
145 /* nodes at this level */
146 STACK_OF(X509_POLICY_NODE) *nodes;
147 /* anyPolicy node */
148 X509_POLICY_NODE *anyPolicy;
149 /* Extra data */
150 /*STACK_OF(X509_POLICY_DATA) *extra_data;*/
151 unsigned int flags;
152};
153
154struct X509_POLICY_TREE_st {
155 /* This is the tree 'level' data */
156 X509_POLICY_LEVEL *levels;
157 int nlevel;
158 /* Extra policy data when additional nodes (not from the certificate)
159 * are required.
160 */
161 STACK_OF(X509_POLICY_DATA) *extra_data;
162 /* This is the authority constained policy set */
163 STACK_OF(X509_POLICY_NODE) *auth_policies;
164 STACK_OF(X509_POLICY_NODE) *user_policies;
165 unsigned int flags;
166};
167
168/* Set if anyPolicy present in user policies */
169#define POLICY_FLAG_ANY_POLICY 0x2
170
171/* Useful macros */
172
173#define node_data_critical(data) (data->flags & POLICY_DATA_FLAG_CRITICAL)
174#define node_critical(node) node_data_critical(node->data)
175
176/* Internal functions */
177
178X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
179 int crit);
180void policy_data_free(X509_POLICY_DATA *data);
181
182X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
183 const ASN1_OBJECT *id);
184int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
185
186
187STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
188
189void policy_cache_init(void);
190
191void policy_cache_free(X509_POLICY_CACHE *cache);
192
193X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
194 const X509_POLICY_NODE *parent, const ASN1_OBJECT *id);
195
196X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
197 const ASN1_OBJECT *id);
198
199int level_add_node(X509_POLICY_LEVEL *level,
200 const X509_POLICY_DATA *data, X509_POLICY_NODE *parent,
201 X509_POLICY_TREE *tree, X509_POLICY_NODE **nodep);
202void policy_node_free(X509_POLICY_NODE *node);
203int policy_node_match(const X509_POLICY_LEVEL *lvl,
204 const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
205
206const X509_POLICY_CACHE *policy_cache_set(X509 *x);
diff --git a/src/lib/libcrypto/x509v3/pcy_lib.c b/src/lib/libcrypto/x509v3/pcy_lib.c
deleted file mode 100644
index 6f37064063..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_lib.c
+++ /dev/null
@@ -1,157 +0,0 @@
1/* $OpenBSD: pcy_lib.c,v 1.5 2015/02/07 13:19:15 doug Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/x509.h>
60#include <openssl/x509v3.h>
61
62#include "pcy_int.h"
63
64/* accessor functions */
65
66/* X509_POLICY_TREE stuff */
67
68int
69X509_policy_tree_level_count(const X509_POLICY_TREE *tree)
70{
71 if (!tree)
72 return 0;
73 return tree->nlevel;
74}
75
76X509_POLICY_LEVEL *
77X509_policy_tree_get0_level(const X509_POLICY_TREE *tree, int i)
78{
79 if (!tree || (i < 0) || (i >= tree->nlevel))
80 return NULL;
81 return tree->levels + i;
82}
83
84STACK_OF(X509_POLICY_NODE) *
85X509_policy_tree_get0_policies(const X509_POLICY_TREE *tree)
86{
87 if (!tree)
88 return NULL;
89 return tree->auth_policies;
90}
91
92STACK_OF(X509_POLICY_NODE) *
93X509_policy_tree_get0_user_policies(const X509_POLICY_TREE *tree)
94{
95 if (!tree)
96 return NULL;
97 if (tree->flags & POLICY_FLAG_ANY_POLICY)
98 return tree->auth_policies;
99 else
100 return tree->user_policies;
101}
102
103/* X509_POLICY_LEVEL stuff */
104
105int
106X509_policy_level_node_count(X509_POLICY_LEVEL *level)
107{
108 int n;
109 if (!level)
110 return 0;
111 if (level->anyPolicy)
112 n = 1;
113 else
114 n = 0;
115 if (level->nodes)
116 n += sk_X509_POLICY_NODE_num(level->nodes);
117 return n;
118}
119
120X509_POLICY_NODE *
121X509_policy_level_get0_node(X509_POLICY_LEVEL *level, int i)
122{
123 if (!level)
124 return NULL;
125 if (level->anyPolicy) {
126 if (i == 0)
127 return level->anyPolicy;
128 i--;
129 }
130 return sk_X509_POLICY_NODE_value(level->nodes, i);
131}
132
133/* X509_POLICY_NODE stuff */
134
135const ASN1_OBJECT *
136X509_policy_node_get0_policy(const X509_POLICY_NODE *node)
137{
138 if (!node)
139 return NULL;
140 return node->data->valid_policy;
141}
142
143STACK_OF(POLICYQUALINFO) *
144X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node)
145{
146 if (!node)
147 return NULL;
148 return node->data->qualifier_set;
149}
150
151const X509_POLICY_NODE *
152X509_policy_node_get0_parent(const X509_POLICY_NODE *node)
153{
154 if (!node)
155 return NULL;
156 return node->parent;
157}
diff --git a/src/lib/libcrypto/x509v3/pcy_map.c b/src/lib/libcrypto/x509v3/pcy_map.c
deleted file mode 100644
index 6ee1ffe895..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_map.c
+++ /dev/null
@@ -1,126 +0,0 @@
1/* $OpenBSD: pcy_map.c,v 1.4 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/x509.h>
60#include <openssl/x509v3.h>
61
62#include "pcy_int.h"
63
64/* Set policy mapping entries in cache.
65 * Note: this modifies the passed POLICY_MAPPINGS structure
66 */
67
68int
69policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
70{
71 POLICY_MAPPING *map;
72 X509_POLICY_DATA *data;
73 X509_POLICY_CACHE *cache = x->policy_cache;
74 int i;
75 int ret = 0;
76
77 if (sk_POLICY_MAPPING_num(maps) == 0) {
78 ret = -1;
79 goto bad_mapping;
80 }
81 for (i = 0; i < sk_POLICY_MAPPING_num(maps); i++) {
82 map = sk_POLICY_MAPPING_value(maps, i);
83 /* Reject if map to or from anyPolicy */
84 if ((OBJ_obj2nid(map->subjectDomainPolicy) == NID_any_policy) ||
85 (OBJ_obj2nid(map->issuerDomainPolicy) == NID_any_policy)) {
86 ret = -1;
87 goto bad_mapping;
88 }
89
90 /* Attempt to find matching policy data */
91 data = policy_cache_find_data(cache, map->issuerDomainPolicy);
92 /* If we don't have anyPolicy can't map */
93 if (!data && !cache->anyPolicy)
94 continue;
95
96 /* Create a NODE from anyPolicy */
97 if (!data) {
98 data = policy_data_new(NULL, map->issuerDomainPolicy,
99 cache->anyPolicy->flags &
100 POLICY_DATA_FLAG_CRITICAL);
101 if (!data)
102 goto bad_mapping;
103 data->qualifier_set = cache->anyPolicy->qualifier_set;
104 /*map->issuerDomainPolicy = NULL;*/
105 data->flags |= POLICY_DATA_FLAG_MAPPED_ANY;
106 data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
107 if (!sk_X509_POLICY_DATA_push(cache->data, data)) {
108 policy_data_free(data);
109 goto bad_mapping;
110 }
111 } else
112 data->flags |= POLICY_DATA_FLAG_MAPPED;
113 if (!sk_ASN1_OBJECT_push(data->expected_policy_set,
114 map->subjectDomainPolicy))
115 goto bad_mapping;
116 map->subjectDomainPolicy = NULL;
117 }
118
119 ret = 1;
120
121bad_mapping:
122 if (ret == -1)
123 x->ex_flags |= EXFLAG_INVALID_POLICY;
124 sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
125 return ret;
126}
diff --git a/src/lib/libcrypto/x509v3/pcy_node.c b/src/lib/libcrypto/x509v3/pcy_node.c
deleted file mode 100644
index ba22b267bf..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_node.c
+++ /dev/null
@@ -1,199 +0,0 @@
1/* $OpenBSD: pcy_node.c,v 1.6 2015/07/18 00:01:05 beck Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/asn1.h>
60#include <openssl/x509.h>
61#include <openssl/x509v3.h>
62
63#include "pcy_int.h"
64
65static int
66node_cmp(const X509_POLICY_NODE * const *a, const X509_POLICY_NODE * const *b)
67{
68 return OBJ_cmp((*a)->data->valid_policy, (*b)->data->valid_policy);
69}
70
71STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void)
72{
73 return sk_X509_POLICY_NODE_new(node_cmp);
74}
75
76X509_POLICY_NODE *
77tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes, const ASN1_OBJECT *id)
78{
79 X509_POLICY_DATA n;
80 X509_POLICY_NODE l;
81 int idx;
82
83 n.valid_policy = (ASN1_OBJECT *)id;
84 l.data = &n;
85
86 idx = sk_X509_POLICY_NODE_find(nodes, &l);
87 if (idx == -1)
88 return NULL;
89
90 return sk_X509_POLICY_NODE_value(nodes, idx);
91}
92
93X509_POLICY_NODE *
94level_find_node(const X509_POLICY_LEVEL *level, const X509_POLICY_NODE *parent,
95 const ASN1_OBJECT *id)
96{
97 X509_POLICY_NODE *node;
98 int i;
99
100 for (i = 0; i < sk_X509_POLICY_NODE_num(level->nodes); i++) {
101 node = sk_X509_POLICY_NODE_value(level->nodes, i);
102 if (node->parent == parent) {
103 if (!OBJ_cmp(node->data->valid_policy, id))
104 return node;
105 }
106 }
107 return NULL;
108}
109
110
111int
112level_add_node(X509_POLICY_LEVEL *level, const X509_POLICY_DATA *data,
113 X509_POLICY_NODE *parent, X509_POLICY_TREE *tree, X509_POLICY_NODE **nodep)
114{
115 X509_POLICY_NODE *node = NULL;
116
117 if (level) {
118 node = malloc(sizeof(X509_POLICY_NODE));
119 if (!node)
120 goto node_error;
121 node->data = data;
122 node->parent = parent;
123 node->nchild = 0;
124 if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) {
125 if (level->anyPolicy)
126 goto node_error;
127 level->anyPolicy = node;
128 if (parent)
129 parent->nchild++;
130 } else {
131
132 if (!level->nodes)
133 level->nodes = policy_node_cmp_new();
134 if (!level->nodes)
135 goto node_error;
136 if (!sk_X509_POLICY_NODE_push(level->nodes, node))
137 goto node_error;
138 if (parent)
139 parent->nchild++;
140 }
141 }
142
143 if (tree) {
144 if (!tree->extra_data)
145 tree->extra_data = sk_X509_POLICY_DATA_new_null();
146 if (!tree->extra_data)
147 goto node_error_cond;
148 if (!sk_X509_POLICY_DATA_push(tree->extra_data, data))
149 goto node_error_cond;
150 }
151
152 if (nodep)
153 *nodep = node;
154
155 return 1;
156
157node_error_cond:
158 if (level)
159 node = NULL;
160node_error:
161 policy_node_free(node);
162 node = NULL;
163 if (nodep)
164 *nodep = node;
165 return 0;
166}
167
168void
169policy_node_free(X509_POLICY_NODE *node)
170{
171 free(node);
172}
173
174/* See if a policy node matches a policy OID. If mapping enabled look through
175 * expected policy set otherwise just valid policy.
176 */
177
178int
179policy_node_match(const X509_POLICY_LEVEL *lvl, const X509_POLICY_NODE *node,
180 const ASN1_OBJECT *oid)
181{
182 int i;
183 ASN1_OBJECT *policy_oid;
184 const X509_POLICY_DATA *x = node->data;
185
186 if ((lvl->flags & X509_V_FLAG_INHIBIT_MAP) ||
187 !(x->flags & POLICY_DATA_FLAG_MAP_MASK)) {
188 if (!OBJ_cmp(x->valid_policy, oid))
189 return 1;
190 return 0;
191 }
192
193 for (i = 0; i < sk_ASN1_OBJECT_num(x->expected_policy_set); i++) {
194 policy_oid = sk_ASN1_OBJECT_value(x->expected_policy_set, i);
195 if (!OBJ_cmp(policy_oid, oid))
196 return 1;
197 }
198 return 0;
199}
diff --git a/src/lib/libcrypto/x509v3/pcy_tree.c b/src/lib/libcrypto/x509v3/pcy_tree.c
deleted file mode 100644
index 7b28acbe1f..0000000000
--- a/src/lib/libcrypto/x509v3/pcy_tree.c
+++ /dev/null
@@ -1,768 +0,0 @@
1/* $OpenBSD: pcy_tree.c,v 1.16 2016/03/11 07:08:45 mmcc Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <openssl/x509.h>
60#include <openssl/x509v3.h>
61
62#include "pcy_int.h"
63
64/* Enable this to print out the complete policy tree at various point during
65 * evaluation.
66 */
67
68/*#define OPENSSL_POLICY_DEBUG*/
69
70#ifdef OPENSSL_POLICY_DEBUG
71
72static void
73expected_print(BIO *err, X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node,
74 int indent)
75{
76 if ((lev->flags & X509_V_FLAG_INHIBIT_MAP) ||
77 !(node->data->flags & POLICY_DATA_FLAG_MAP_MASK))
78 BIO_puts(err, " Not Mapped\n");
79 else {
80 int i;
81 STACK_OF(ASN1_OBJECT) *pset = node->data->expected_policy_set;
82 ASN1_OBJECT *oid;
83 BIO_puts(err, " Expected: ");
84 for (i = 0; i < sk_ASN1_OBJECT_num(pset); i++) {
85 oid = sk_ASN1_OBJECT_value(pset, i);
86 if (i)
87 BIO_puts(err, ", ");
88 i2a_ASN1_OBJECT(err, oid);
89 }
90 BIO_puts(err, "\n");
91 }
92}
93
94static void
95tree_print(char *str, X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr)
96{
97 X509_POLICY_LEVEL *plev;
98 X509_POLICY_NODE *node;
99 int i;
100 BIO *err;
101
102 err = BIO_new_fp(stderr, BIO_NOCLOSE);
103 if (!curr)
104 curr = tree->levels + tree->nlevel;
105 else
106 curr++;
107 BIO_printf(err, "Level print after %s\n", str);
108 BIO_printf(err, "Printing Up to Level %ld\n", curr - tree->levels);
109 for (plev = tree->levels; plev != curr; plev++) {
110 BIO_printf(err, "Level %ld, flags = %x\n",
111 plev - tree->levels, plev->flags);
112 for (i = 0; i < sk_X509_POLICY_NODE_num(plev->nodes); i++) {
113 node = sk_X509_POLICY_NODE_value(plev->nodes, i);
114 X509_POLICY_NODE_print(err, node, 2);
115 expected_print(err, plev, node, 2);
116 BIO_printf(err, " Flags: %x\n", node->data->flags);
117 }
118 if (plev->anyPolicy)
119 X509_POLICY_NODE_print(err, plev->anyPolicy, 2);
120 }
121
122 BIO_free(err);
123}
124#else
125
126#define tree_print(a,b,c) /* */
127
128#endif
129
130/* Initialize policy tree. Return values:
131 * 0 Some internal error occured.
132 * -1 Inconsistent or invalid extensions in certificates.
133 * 1 Tree initialized OK.
134 * 2 Policy tree is empty.
135 * 5 Tree OK and requireExplicitPolicy true.
136 * 6 Tree empty and requireExplicitPolicy true.
137 */
138
139static int
140tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, unsigned int flags)
141{
142 X509_POLICY_TREE *tree;
143 X509_POLICY_LEVEL *level;
144 const X509_POLICY_CACHE *cache;
145 X509_POLICY_DATA *data = NULL;
146 X509 *x;
147 int ret = 1;
148 int i, n;
149 int explicit_policy;
150 int any_skip;
151 int map_skip;
152
153 *ptree = NULL;
154 n = sk_X509_num(certs);
155
156 if (flags & X509_V_FLAG_EXPLICIT_POLICY)
157 explicit_policy = 0;
158 else
159 explicit_policy = n + 1;
160
161 if (flags & X509_V_FLAG_INHIBIT_ANY)
162 any_skip = 0;
163 else
164 any_skip = n + 1;
165
166 if (flags & X509_V_FLAG_INHIBIT_MAP)
167 map_skip = 0;
168 else
169 map_skip = n + 1;
170
171 /* Can't do anything with just a trust anchor */
172 if (n == 1)
173 return 1;
174 /* First setup policy cache in all certificates apart from the
175 * trust anchor. Note any bad cache results on the way. Also can
176 * calculate explicit_policy value at this point.
177 */
178 for (i = n - 2; i >= 0; i--) {
179 x = sk_X509_value(certs, i);
180 X509_check_purpose(x, -1, -1);
181 cache = policy_cache_set(x);
182 /* If cache NULL something bad happened: return immediately */
183 if (cache == NULL)
184 return 0;
185 /* If inconsistent extensions keep a note of it but continue */
186 if (x->ex_flags & EXFLAG_INVALID_POLICY)
187 ret = -1;
188 /* Otherwise if we have no data (hence no CertificatePolicies)
189 * and haven't already set an inconsistent code note it.
190 */
191 else if ((ret == 1) && !cache->data)
192 ret = 2;
193 if (explicit_policy > 0) {
194 if (!(x->ex_flags & EXFLAG_SI))
195 explicit_policy--;
196 if ((cache->explicit_skip != -1) &&
197 (cache->explicit_skip < explicit_policy))
198 explicit_policy = cache->explicit_skip;
199 }
200 }
201
202 if (ret != 1) {
203 if (ret == 2 && !explicit_policy)
204 return 6;
205 return ret;
206 }
207
208
209 /* If we get this far initialize the tree */
210
211 tree = malloc(sizeof(X509_POLICY_TREE));
212
213 if (!tree)
214 return 0;
215
216 tree->flags = 0;
217 tree->levels = calloc(n, sizeof(X509_POLICY_LEVEL));
218 tree->nlevel = 0;
219 tree->extra_data = NULL;
220 tree->auth_policies = NULL;
221 tree->user_policies = NULL;
222
223 if (!tree->levels) {
224 free(tree);
225 return 0;
226 }
227
228 tree->nlevel = n;
229
230 level = tree->levels;
231
232 /* Root data: initialize to anyPolicy */
233
234 data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0);
235
236 if (!data || !level_add_node(level, data, NULL, tree, NULL))
237 goto bad_tree;
238
239 for (i = n - 2; i >= 0; i--) {
240 level++;
241 x = sk_X509_value(certs, i);
242 cache = policy_cache_set(x);
243 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
244 level->cert = x;
245
246 if (!cache->anyPolicy)
247 level->flags |= X509_V_FLAG_INHIBIT_ANY;
248
249 /* Determine inhibit any and inhibit map flags */
250 if (any_skip == 0) {
251 /* Any matching allowed if certificate is self
252 * issued and not the last in the chain.
253 */
254 if (!(x->ex_flags & EXFLAG_SI) || (i == 0))
255 level->flags |= X509_V_FLAG_INHIBIT_ANY;
256 } else {
257 if (!(x->ex_flags & EXFLAG_SI))
258 any_skip--;
259 if ((cache->any_skip >= 0) &&
260 (cache->any_skip < any_skip))
261 any_skip = cache->any_skip;
262 }
263
264 if (map_skip == 0)
265 level->flags |= X509_V_FLAG_INHIBIT_MAP;
266 else {
267 if (!(x->ex_flags & EXFLAG_SI))
268 map_skip--;
269 if ((cache->map_skip >= 0) &&
270 (cache->map_skip < map_skip))
271 map_skip = cache->map_skip;
272 }
273
274 }
275
276 *ptree = tree;
277
278 if (explicit_policy)
279 return 1;
280 else
281 return 5;
282
283bad_tree:
284 X509_policy_tree_free(tree);
285
286 return 0;
287}
288
289static int
290tree_link_matching_nodes(X509_POLICY_LEVEL *curr, const X509_POLICY_DATA *data)
291{
292 X509_POLICY_LEVEL *last = curr - 1;
293 X509_POLICY_NODE *node;
294 int i, matched = 0;
295
296 /* Iterate through all in nodes linking matches */
297 for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) {
298 node = sk_X509_POLICY_NODE_value(last->nodes, i);
299 if (policy_node_match(last, node, data->valid_policy)) {
300 if (!level_add_node(curr, data, node, NULL, NULL))
301 return 0;
302 matched = 1;
303 }
304 }
305 if (!matched && last->anyPolicy) {
306 if (!level_add_node(curr, data, last->anyPolicy, NULL, NULL))
307 return 0;
308 }
309 return 1;
310}
311
312/* This corresponds to RFC3280 6.1.3(d)(1):
313 * link any data from CertificatePolicies onto matching parent
314 * or anyPolicy if no match.
315 */
316
317static int
318tree_link_nodes(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache)
319{
320 int i;
321 X509_POLICY_DATA *data;
322
323 for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
324 data = sk_X509_POLICY_DATA_value(cache->data, i);
325 /* Look for matching nodes in previous level */
326 if (!tree_link_matching_nodes(curr, data))
327 return 0;
328 }
329 return 1;
330}
331
332/* This corresponds to RFC3280 6.1.3(d)(2):
333 * Create new data for any unmatched policies in the parent and link
334 * to anyPolicy.
335 */
336
337static int
338tree_add_unmatched(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
339 const ASN1_OBJECT *id, X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
340{
341 X509_POLICY_DATA *data;
342
343 if (id == NULL)
344 id = node->data->valid_policy;
345 /* Create a new node with qualifiers from anyPolicy and
346 * id from unmatched node.
347 */
348 data = policy_data_new(NULL, id, node_critical(node));
349
350 if (data == NULL)
351 return 0;
352 /* Curr may not have anyPolicy */
353 data->qualifier_set = cache->anyPolicy->qualifier_set;
354 data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
355 if (!level_add_node(curr, data, node, tree, NULL)) {
356 policy_data_free(data);
357 return 0;
358 }
359
360 return 1;
361}
362
363static int
364tree_link_unmatched(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
365 X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
366{
367 const X509_POLICY_LEVEL *last = curr - 1;
368 int i;
369
370 if ((last->flags & X509_V_FLAG_INHIBIT_MAP) ||
371 !(node->data->flags & POLICY_DATA_FLAG_MAPPED)) {
372 /* If no policy mapping: matched if one child present */
373 if (node->nchild)
374 return 1;
375 if (!tree_add_unmatched(curr, cache, NULL, node, tree))
376 return 0;
377 /* Add it */
378 } else {
379 /* If mapping: matched if one child per expected policy set */
380 STACK_OF(ASN1_OBJECT) *expset = node->data->expected_policy_set;
381 if (node->nchild == sk_ASN1_OBJECT_num(expset))
382 return 1;
383 /* Locate unmatched nodes */
384 for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) {
385 ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i);
386 if (level_find_node(curr, node, oid))
387 continue;
388 if (!tree_add_unmatched(curr, cache, oid, node, tree))
389 return 0;
390 }
391 }
392
393 return 1;
394}
395
396static int
397tree_link_any(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
398 X509_POLICY_TREE *tree)
399{
400 int i;
401 X509_POLICY_NODE *node;
402 X509_POLICY_LEVEL *last = curr - 1;
403
404 for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) {
405 node = sk_X509_POLICY_NODE_value(last->nodes, i);
406
407 if (!tree_link_unmatched(curr, cache, node, tree))
408 return 0;
409 }
410 /* Finally add link to anyPolicy */
411 if (last->anyPolicy) {
412 if (!level_add_node(curr, cache->anyPolicy,
413 last->anyPolicy, NULL, NULL))
414 return 0;
415 }
416 return 1;
417}
418
419/* Prune the tree: delete any child mapped child data on the current level
420 * then proceed up the tree deleting any data with no children. If we ever
421 * have no data on a level we can halt because the tree will be empty.
422 */
423
424static int
425tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr)
426{
427 STACK_OF(X509_POLICY_NODE) *nodes;
428 X509_POLICY_NODE *node;
429 int i;
430
431 nodes = curr->nodes;
432 if (curr->flags & X509_V_FLAG_INHIBIT_MAP) {
433 for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) {
434 node = sk_X509_POLICY_NODE_value(nodes, i);
435 /* Delete any mapped data: see RFC3280 XXXX */
436 if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK) {
437 node->parent->nchild--;
438 free(node);
439 (void)sk_X509_POLICY_NODE_delete(nodes, i);
440 }
441 }
442 }
443
444 for (;;) {
445 --curr;
446 nodes = curr->nodes;
447 for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) {
448 node = sk_X509_POLICY_NODE_value(nodes, i);
449 if (node->nchild == 0) {
450 node->parent->nchild--;
451 free(node);
452 (void)sk_X509_POLICY_NODE_delete(nodes, i);
453 }
454 }
455 if (curr->anyPolicy && !curr->anyPolicy->nchild) {
456 if (curr->anyPolicy->parent)
457 curr->anyPolicy->parent->nchild--;
458 free(curr->anyPolicy);
459 curr->anyPolicy = NULL;
460 }
461 if (curr == tree->levels) {
462 /* If we zapped anyPolicy at top then tree is empty */
463 if (!curr->anyPolicy)
464 return 2;
465 return 1;
466 }
467 }
468
469 return 1;
470}
471
472static int
473tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes, X509_POLICY_NODE *pcy)
474{
475 if (!*pnodes) {
476 *pnodes = policy_node_cmp_new();
477 if (!*pnodes)
478 return 0;
479 } else if (sk_X509_POLICY_NODE_find(*pnodes, pcy) != -1)
480 return 1;
481
482 if (!sk_X509_POLICY_NODE_push(*pnodes, pcy))
483 return 0;
484
485 return 1;
486}
487
488/* Calculate the authority set based on policy tree.
489 * The 'pnodes' parameter is used as a store for the set of policy nodes
490 * used to calculate the user set. If the authority set is not anyPolicy
491 * then pnodes will just point to the authority set. If however the authority
492 * set is anyPolicy then the set of valid policies (other than anyPolicy)
493 * is store in pnodes. The return value of '2' is used in this case to indicate
494 * that pnodes should be freed.
495 */
496
497static int
498tree_calculate_authority_set(X509_POLICY_TREE *tree,
499 STACK_OF(X509_POLICY_NODE) **pnodes)
500{
501 X509_POLICY_LEVEL *curr;
502 X509_POLICY_NODE *node, *anyptr;
503 STACK_OF(X509_POLICY_NODE) **addnodes;
504 int i, j;
505
506 curr = tree->levels + tree->nlevel - 1;
507
508 /* If last level contains anyPolicy set is anyPolicy */
509 if (curr->anyPolicy) {
510 if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy))
511 return 0;
512 addnodes = pnodes;
513 } else
514 /* Add policies to authority set */
515 addnodes = &tree->auth_policies;
516
517 curr = tree->levels;
518 for (i = 1; i < tree->nlevel; i++) {
519 /* If no anyPolicy node on this this level it can't
520 * appear on lower levels so end search.
521 */
522 if (!(anyptr = curr->anyPolicy))
523 break;
524 curr++;
525 for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++) {
526 node = sk_X509_POLICY_NODE_value(curr->nodes, j);
527 if ((node->parent == anyptr) &&
528 !tree_add_auth_node(addnodes, node))
529 return 0;
530 }
531 }
532
533 if (addnodes == pnodes)
534 return 2;
535
536 *pnodes = tree->auth_policies;
537
538 return 1;
539}
540
541static int
542tree_calculate_user_set(X509_POLICY_TREE *tree,
543 STACK_OF(ASN1_OBJECT) *policy_oids, STACK_OF(X509_POLICY_NODE) *auth_nodes)
544{
545 int i;
546 X509_POLICY_NODE *node;
547 ASN1_OBJECT *oid;
548 X509_POLICY_NODE *anyPolicy;
549 X509_POLICY_DATA *extra;
550
551 /* Check if anyPolicy present in authority constrained policy set:
552 * this will happen if it is a leaf node.
553 */
554
555 if (sk_ASN1_OBJECT_num(policy_oids) <= 0)
556 return 1;
557
558 anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy;
559
560 for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) {
561 oid = sk_ASN1_OBJECT_value(policy_oids, i);
562 if (OBJ_obj2nid(oid) == NID_any_policy) {
563 tree->flags |= POLICY_FLAG_ANY_POLICY;
564 return 1;
565 }
566 }
567
568 for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) {
569 oid = sk_ASN1_OBJECT_value(policy_oids, i);
570 node = tree_find_sk(auth_nodes, oid);
571 if (!node) {
572 if (!anyPolicy)
573 continue;
574 /* Create a new node with policy ID from user set
575 * and qualifiers from anyPolicy.
576 */
577 extra = policy_data_new(NULL, oid,
578 node_critical(anyPolicy));
579 if (!extra)
580 return 0;
581 extra->qualifier_set = anyPolicy->data->qualifier_set;
582 extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS |
583 POLICY_DATA_FLAG_EXTRA_NODE;
584 (void) level_add_node(NULL, extra, anyPolicy->parent,
585 tree, &node);
586 }
587 if (!tree->user_policies) {
588 tree->user_policies = sk_X509_POLICY_NODE_new_null();
589 if (!tree->user_policies)
590 return 1;
591 }
592 if (!sk_X509_POLICY_NODE_push(tree->user_policies, node))
593 return 0;
594 }
595 return 1;
596}
597
598static int
599tree_evaluate(X509_POLICY_TREE *tree)
600{
601 int ret, i;
602 X509_POLICY_LEVEL *curr = tree->levels + 1;
603 const X509_POLICY_CACHE *cache;
604
605 for (i = 1; i < tree->nlevel; i++, curr++) {
606 cache = policy_cache_set(curr->cert);
607 if (!tree_link_nodes(curr, cache))
608 return 0;
609
610 if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY) &&
611 !tree_link_any(curr, cache, tree))
612 return 0;
613 tree_print("before tree_prune()", tree, curr);
614 ret = tree_prune(tree, curr);
615 if (ret != 1)
616 return ret;
617 }
618
619 return 1;
620}
621
622static void
623exnode_free(X509_POLICY_NODE *node)
624{
625 if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE))
626 free(node);
627}
628
629void
630X509_policy_tree_free(X509_POLICY_TREE *tree)
631{
632 X509_POLICY_LEVEL *curr;
633 int i;
634
635 if (!tree)
636 return;
637
638 sk_X509_POLICY_NODE_free(tree->auth_policies);
639 sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free);
640
641 for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) {
642 X509_free(curr->cert);
643 if (curr->nodes)
644 sk_X509_POLICY_NODE_pop_free(curr->nodes,
645 policy_node_free);
646 if (curr->anyPolicy)
647 policy_node_free(curr->anyPolicy);
648 }
649
650 if (tree->extra_data)
651 sk_X509_POLICY_DATA_pop_free(tree->extra_data,
652 policy_data_free);
653
654 free(tree->levels);
655 free(tree);
656}
657
658/* Application policy checking function.
659 * Return codes:
660 * 0 Internal Error.
661 * 1 Successful.
662 * -1 One or more certificates contain invalid or inconsistent extensions
663 * -2 User constrained policy set empty and requireExplicit true.
664 */
665
666int
667X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
668 STACK_OF(X509) *certs, STACK_OF(ASN1_OBJECT) *policy_oids,
669 unsigned int flags)
670{
671 int ret, ret2;
672 X509_POLICY_TREE *tree = NULL;
673 STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL;
674
675 *ptree = NULL;
676 *pexplicit_policy = 0;
677 ret = tree_init(&tree, certs, flags);
678
679 switch (ret) {
680
681 /* Tree empty requireExplicit False: OK */
682 case 2:
683 return 1;
684
685 /* Some internal error */
686 case -1:
687 return -1;
688
689 /* Some internal error */
690 case 0:
691 return 0;
692
693 /* Tree empty requireExplicit True: Error */
694
695 case 6:
696 *pexplicit_policy = 1;
697 return -2;
698
699 /* Tree OK requireExplicit True: OK and continue */
700 case 5:
701 *pexplicit_policy = 1;
702 break;
703
704 /* Tree OK: continue */
705
706 case 1:
707 if (!tree)
708 /*
709 * tree_init() returns success and a null tree
710 * if it's just looking at a trust anchor.
711 * I'm not sure that returning success here is
712 * correct, but I'm sure that reporting this
713 * as an internal error which our caller
714 * interprets as a malloc failure is wrong.
715 */
716 return 1;
717 break;
718 }
719
720 if (!tree)
721 goto error;
722 ret = tree_evaluate(tree);
723
724 tree_print("tree_evaluate()", tree, NULL);
725
726 if (ret <= 0)
727 goto error;
728
729 /* Return value 2 means tree empty */
730 if (ret == 2) {
731 X509_policy_tree_free(tree);
732 if (*pexplicit_policy)
733 return -2;
734 else
735 return 1;
736 }
737
738 /* Tree is not empty: continue */
739
740 ret = tree_calculate_authority_set(tree, &auth_nodes);
741 if (ret == 0)
742 goto error;
743
744 ret2 = tree_calculate_user_set(tree, policy_oids, auth_nodes);
745
746 /* Return value 2 means auth_nodes needs to be freed */
747 if (ret == 2)
748 sk_X509_POLICY_NODE_free(auth_nodes);
749
750 if (ret2 == 0)
751 goto error;
752
753 if (tree)
754 *ptree = tree;
755
756 if (*pexplicit_policy) {
757 nodes = X509_policy_tree_get0_user_policies(tree);
758 if (sk_X509_POLICY_NODE_num(nodes) <= 0)
759 return -2;
760 }
761
762 return 1;
763
764error:
765 X509_policy_tree_free(tree);
766
767 return 0;
768}
diff --git a/src/lib/libcrypto/x509v3/v3_akey.c b/src/lib/libcrypto/x509v3/v3_akey.c
deleted file mode 100644
index 3071baf9ac..0000000000
--- a/src/lib/libcrypto/x509v3/v3_akey.c
+++ /dev/null
@@ -1,215 +0,0 @@
1/* $OpenBSD: v3_akey.c,v 1.17 2015/09/30 18:41:06 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
69 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist);
70static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
71 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
72
73const X509V3_EXT_METHOD v3_akey_id = {
74 .ext_nid = NID_authority_key_identifier,
75 .ext_flags = X509V3_EXT_MULTILINE,
76 .it = ASN1_ITEM_ref(AUTHORITY_KEYID),
77 .ext_new = NULL,
78 .ext_free = NULL,
79 .d2i = NULL,
80 .i2d = NULL,
81 .i2s = NULL,
82 .s2i = NULL,
83 .i2v = (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
84 .v2i = (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
85 .i2r = NULL,
86 .r2i = NULL,
87 .usr_data = NULL,
88};
89
90static
91STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
92 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist)
93{
94 char *tmp;
95
96 if (akeyid->keyid) {
97 tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length);
98 X509V3_add_value("keyid", tmp, &extlist);
99 free(tmp);
100 }
101 if (akeyid->issuer)
102 extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
103 if (akeyid->serial) {
104 tmp = hex_to_string(akeyid->serial->data,
105 akeyid->serial->length);
106 X509V3_add_value("serial", tmp, &extlist);
107 free(tmp);
108 }
109 return extlist;
110}
111
112/* Currently two options:
113 * keyid: use the issuers subject keyid, the value 'always' means its is
114 * an error if the issuer certificate doesn't have a key id.
115 * issuer: use the issuers cert issuer and serial number. The default is
116 * to only use this if keyid is not present. With the option 'always'
117 * this is always included.
118 */
119
120static AUTHORITY_KEYID *
121v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
122 STACK_OF(CONF_VALUE) *values)
123{
124 char keyid = 0, issuer = 0;
125 int i;
126 CONF_VALUE *cnf;
127 ASN1_OCTET_STRING *ikeyid = NULL;
128 X509_NAME *isname = NULL;
129 STACK_OF(GENERAL_NAME) *gens = NULL;
130 GENERAL_NAME *gen = NULL;
131 ASN1_INTEGER *serial = NULL;
132 X509_EXTENSION *ext;
133 X509 *cert;
134 AUTHORITY_KEYID *akeyid = NULL;
135
136 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
137 cnf = sk_CONF_VALUE_value(values, i);
138 if (!strcmp(cnf->name, "keyid")) {
139 keyid = 1;
140 if (cnf->value && !strcmp(cnf->value, "always"))
141 keyid = 2;
142 }
143 else if (!strcmp(cnf->name, "issuer")) {
144 issuer = 1;
145 if (cnf->value && !strcmp(cnf->value, "always"))
146 issuer = 2;
147 } else {
148 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
149 X509V3_R_UNKNOWN_OPTION);
150 ERR_asprintf_error_data("name=%s", cnf->name);
151 return NULL;
152 }
153 }
154
155 if (!ctx || !ctx->issuer_cert) {
156 if (ctx && (ctx->flags == CTX_TEST))
157 return AUTHORITY_KEYID_new();
158 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
159 X509V3_R_NO_ISSUER_CERTIFICATE);
160 return NULL;
161 }
162
163 cert = ctx->issuer_cert;
164
165 if (keyid) {
166 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
167 if ((i >= 0) && (ext = X509_get_ext(cert, i)))
168 ikeyid = X509V3_EXT_d2i(ext);
169 if (keyid == 2 && !ikeyid) {
170 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
171 X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
172 return NULL;
173 }
174 }
175
176 if ((issuer && !ikeyid) || (issuer == 2)) {
177 isname = X509_NAME_dup(X509_get_issuer_name(cert));
178 serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert));
179 if (!isname || !serial) {
180 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
181 X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
182 goto err;
183 }
184 }
185
186 if (!(akeyid = AUTHORITY_KEYID_new()))
187 goto err;
188
189 if (isname) {
190 if (!(gens = sk_GENERAL_NAME_new_null()) ||
191 !(gen = GENERAL_NAME_new()) ||
192 !sk_GENERAL_NAME_push(gens, gen)) {
193 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
194 ERR_R_MALLOC_FAILURE);
195 goto err;
196 }
197 gen->type = GEN_DIRNAME;
198 gen->d.dirn = isname;
199 }
200
201 akeyid->issuer = gens;
202 akeyid->serial = serial;
203 akeyid->keyid = ikeyid;
204
205 return akeyid;
206
207err:
208 AUTHORITY_KEYID_free(akeyid);
209 GENERAL_NAME_free(gen);
210 sk_GENERAL_NAME_free(gens);
211 X509_NAME_free(isname);
212 ASN1_INTEGER_free(serial);
213 ASN1_OCTET_STRING_free(ikeyid);
214 return NULL;
215}
diff --git a/src/lib/libcrypto/x509v3/v3_akeya.c b/src/lib/libcrypto/x509v3/v3_akeya.c
deleted file mode 100644
index 83ef1b5838..0000000000
--- a/src/lib/libcrypto/x509v3/v3_akeya.c
+++ /dev/null
@@ -1,124 +0,0 @@
1/* $OpenBSD: v3_akeya.c,v 1.7 2015/07/25 16:00:14 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/asn1t.h>
63#include <openssl/conf.h>
64#include <openssl/x509v3.h>
65
66static const ASN1_TEMPLATE AUTHORITY_KEYID_seq_tt[] = {
67 {
68 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
69 .tag = 0,
70 .offset = offsetof(AUTHORITY_KEYID, keyid),
71 .field_name = "keyid",
72 .item = &ASN1_OCTET_STRING_it,
73 },
74 {
75 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
76 .tag = 1,
77 .offset = offsetof(AUTHORITY_KEYID, issuer),
78 .field_name = "issuer",
79 .item = &GENERAL_NAME_it,
80 },
81 {
82 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
83 .tag = 2,
84 .offset = offsetof(AUTHORITY_KEYID, serial),
85 .field_name = "serial",
86 .item = &ASN1_INTEGER_it,
87 },
88};
89
90const ASN1_ITEM AUTHORITY_KEYID_it = {
91 .itype = ASN1_ITYPE_SEQUENCE,
92 .utype = V_ASN1_SEQUENCE,
93 .templates = AUTHORITY_KEYID_seq_tt,
94 .tcount = sizeof(AUTHORITY_KEYID_seq_tt) / sizeof(ASN1_TEMPLATE),
95 .funcs = NULL,
96 .size = sizeof(AUTHORITY_KEYID),
97 .sname = "AUTHORITY_KEYID",
98};
99
100
101AUTHORITY_KEYID *
102d2i_AUTHORITY_KEYID(AUTHORITY_KEYID **a, const unsigned char **in, long len)
103{
104 return (AUTHORITY_KEYID *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
105 &AUTHORITY_KEYID_it);
106}
107
108int
109i2d_AUTHORITY_KEYID(AUTHORITY_KEYID *a, unsigned char **out)
110{
111 return ASN1_item_i2d((ASN1_VALUE *)a, out, &AUTHORITY_KEYID_it);
112}
113
114AUTHORITY_KEYID *
115AUTHORITY_KEYID_new(void)
116{
117 return (AUTHORITY_KEYID *)ASN1_item_new(&AUTHORITY_KEYID_it);
118}
119
120void
121AUTHORITY_KEYID_free(AUTHORITY_KEYID *a)
122{
123 ASN1_item_free((ASN1_VALUE *)a, &AUTHORITY_KEYID_it);
124}
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
deleted file mode 100644
index 75c68d3cdb..0000000000
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ /dev/null
@@ -1,671 +0,0 @@
1/* $OpenBSD: v3_alt.c,v 1.25 2015/09/30 18:21:50 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/conf.h>
63#include <openssl/err.h>
64#include <openssl/x509v3.h>
65
66static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
67 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
68static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
70static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
71static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
72static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
73static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
74
75const X509V3_EXT_METHOD v3_alt[] = {
76 {
77 .ext_nid = NID_subject_alt_name,
78 .ext_flags = 0,
79 .it = ASN1_ITEM_ref(GENERAL_NAMES),
80 .ext_new = NULL,
81 .ext_free = NULL,
82 .d2i = NULL,
83 .i2d = NULL,
84 .i2s = NULL,
85 .s2i = NULL,
86 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
87 .v2i = (X509V3_EXT_V2I)v2i_subject_alt,
88 .i2r = NULL,
89 .r2i = NULL,
90 .usr_data = NULL,
91 },
92 {
93 .ext_nid = NID_issuer_alt_name,
94 .ext_flags = 0,
95 .it = ASN1_ITEM_ref(GENERAL_NAMES),
96 .ext_new = NULL,
97 .ext_free = NULL,
98 .d2i = NULL,
99 .i2d = NULL,
100 .i2s = NULL,
101 .s2i = NULL,
102 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
103 .v2i = (X509V3_EXT_V2I)v2i_issuer_alt,
104 .i2r = NULL,
105 .r2i = NULL,
106 .usr_data = NULL,
107 },
108 {
109 .ext_nid = NID_certificate_issuer,
110 .ext_flags = 0,
111 .it = ASN1_ITEM_ref(GENERAL_NAMES),
112 .ext_new = NULL,
113 .ext_free = NULL,
114 .d2i = NULL,
115 .i2d = NULL,
116 .i2s = NULL,
117 .s2i = NULL,
118 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
119 .v2i = NULL,
120 .i2r = NULL,
121 .r2i = NULL,
122 .usr_data = NULL,
123 },
124};
125
126STACK_OF(CONF_VALUE) *
127i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens,
128 STACK_OF(CONF_VALUE) *ret)
129{
130 int i;
131 GENERAL_NAME *gen;
132
133 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
134 gen = sk_GENERAL_NAME_value(gens, i);
135 ret = i2v_GENERAL_NAME(method, gen, ret);
136 }
137 if (!ret)
138 return sk_CONF_VALUE_new_null();
139 return ret;
140}
141
142STACK_OF(CONF_VALUE) *
143i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen,
144 STACK_OF(CONF_VALUE) *ret)
145{
146 unsigned char *p;
147 char oline[256], htmp[5];
148 int i;
149
150 switch (gen->type) {
151 case GEN_OTHERNAME:
152 X509V3_add_value("othername", "<unsupported>", &ret);
153 break;
154
155 case GEN_X400:
156 X509V3_add_value("X400Name", "<unsupported>", &ret);
157 break;
158
159 case GEN_EDIPARTY:
160 X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
161 break;
162
163 case GEN_EMAIL:
164 X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
165 break;
166
167 case GEN_DNS:
168 X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
169 break;
170
171 case GEN_URI:
172 X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
173 break;
174
175 case GEN_DIRNAME:
176 X509_NAME_oneline(gen->d.dirn, oline, 256);
177 X509V3_add_value("DirName", oline, &ret);
178 break;
179
180 case GEN_IPADD:
181 p = gen->d.ip->data;
182 if (gen->d.ip->length == 4)
183 (void) snprintf(oline, sizeof oline,
184 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
185 else if (gen->d.ip->length == 16) {
186 oline[0] = 0;
187 for (i = 0; i < 8; i++) {
188 (void) snprintf(htmp, sizeof htmp,
189 "%X", p[0] << 8 | p[1]);
190 p += 2;
191 strlcat(oline, htmp, sizeof(oline));
192 if (i != 7)
193 strlcat(oline, ":", sizeof(oline));
194 }
195 } else {
196 X509V3_add_value("IP Address", "<invalid>", &ret);
197 break;
198 }
199 X509V3_add_value("IP Address", oline, &ret);
200 break;
201
202 case GEN_RID:
203 i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
204 X509V3_add_value("Registered ID", oline, &ret);
205 break;
206 }
207 return ret;
208}
209
210int
211GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
212{
213 unsigned char *p;
214 int i;
215
216 switch (gen->type) {
217 case GEN_OTHERNAME:
218 BIO_printf(out, "othername:<unsupported>");
219 break;
220
221 case GEN_X400:
222 BIO_printf(out, "X400Name:<unsupported>");
223 break;
224
225 case GEN_EDIPARTY:
226 /* Maybe fix this: it is supported now */
227 BIO_printf(out, "EdiPartyName:<unsupported>");
228 break;
229
230 case GEN_EMAIL:
231 BIO_printf(out, "email:%s", gen->d.ia5->data);
232 break;
233
234 case GEN_DNS:
235 BIO_printf(out, "DNS:%s", gen->d.ia5->data);
236 break;
237
238 case GEN_URI:
239 BIO_printf(out, "URI:%s", gen->d.ia5->data);
240 break;
241
242 case GEN_DIRNAME:
243 BIO_printf(out, "DirName: ");
244 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
245 break;
246
247 case GEN_IPADD:
248 p = gen->d.ip->data;
249 if (gen->d.ip->length == 4)
250 BIO_printf(out, "IP Address:%d.%d.%d.%d",
251 p[0], p[1], p[2], p[3]);
252 else if (gen->d.ip->length == 16) {
253 BIO_printf(out, "IP Address");
254 for (i = 0; i < 8; i++) {
255 BIO_printf(out, ":%X", p[0] << 8 | p[1]);
256 p += 2;
257 }
258 BIO_puts(out, "\n");
259 } else {
260 BIO_printf(out, "IP Address:<invalid>");
261 break;
262 }
263 break;
264
265 case GEN_RID:
266 BIO_printf(out, "Registered ID");
267 i2a_ASN1_OBJECT(out, gen->d.rid);
268 break;
269 }
270 return 1;
271}
272
273static GENERAL_NAMES *
274v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
275 STACK_OF(CONF_VALUE) *nval)
276{
277 GENERAL_NAMES *gens = NULL;
278 CONF_VALUE *cnf;
279 int i;
280
281 if ((gens = sk_GENERAL_NAME_new_null()) == NULL) {
282 X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
283 return NULL;
284 }
285 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
286 cnf = sk_CONF_VALUE_value(nval, i);
287 if (name_cmp(cnf->name, "issuer") == 0 && cnf->value != NULL &&
288 strcmp(cnf->value, "copy") == 0) {
289 if (!copy_issuer(ctx, gens))
290 goto err;
291 } else {
292 GENERAL_NAME *gen;
293 if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
294 goto err;
295 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
296 GENERAL_NAME_free(gen);
297 goto err;
298 }
299 }
300 }
301 return gens;
302
303err:
304 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
305 return NULL;
306}
307
308/* Append subject altname of issuer to issuer alt name of subject */
309
310static int
311copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
312{
313 GENERAL_NAMES *ialt;
314 GENERAL_NAME *gen;
315 X509_EXTENSION *ext;
316 int i;
317
318 if (ctx && (ctx->flags == CTX_TEST))
319 return 1;
320 if (!ctx || !ctx->issuer_cert) {
321 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
322 goto err;
323 }
324 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
325 if (i < 0)
326 return 1;
327 if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
328 !(ialt = X509V3_EXT_d2i(ext))) {
329 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
330 goto err;
331 }
332
333 for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
334 gen = sk_GENERAL_NAME_value(ialt, i);
335 if (!sk_GENERAL_NAME_push(gens, gen)) {
336 X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
337 goto err;
338 }
339 }
340 sk_GENERAL_NAME_free(ialt);
341
342 return 1;
343
344err:
345 return 0;
346
347}
348
349static GENERAL_NAMES *
350v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
351 STACK_OF(CONF_VALUE) *nval)
352{
353 GENERAL_NAMES *gens = NULL;
354 CONF_VALUE *cnf;
355 int i;
356
357 if (!(gens = sk_GENERAL_NAME_new_null())) {
358 X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
359 return NULL;
360 }
361 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
362 cnf = sk_CONF_VALUE_value(nval, i);
363 if (!name_cmp(cnf->name, "email") && cnf->value &&
364 !strcmp(cnf->value, "copy")) {
365 if (!copy_email(ctx, gens, 0))
366 goto err;
367 } else if (!name_cmp(cnf->name, "email") && cnf->value &&
368 !strcmp(cnf->value, "move")) {
369 if (!copy_email(ctx, gens, 1))
370 goto err;
371 } else {
372 GENERAL_NAME *gen;
373 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
374 goto err;
375 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
376 GENERAL_NAME_free(gen);
377 goto err;
378 }
379 }
380 }
381 return gens;
382
383err:
384 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
385 return NULL;
386}
387
388/* Copy any email addresses in a certificate or request to
389 * GENERAL_NAMES
390 */
391
392static int
393copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
394{
395 X509_NAME *nm;
396 ASN1_IA5STRING *email = NULL;
397 X509_NAME_ENTRY *ne;
398 GENERAL_NAME *gen = NULL;
399 int i;
400
401 if (ctx != NULL && ctx->flags == CTX_TEST)
402 return 1;
403 if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
404 X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
405 goto err;
406 }
407 /* Find the subject name */
408 if (ctx->subject_cert)
409 nm = X509_get_subject_name(ctx->subject_cert);
410 else
411 nm = X509_REQ_get_subject_name(ctx->subject_req);
412
413 /* Now add any email address(es) to STACK */
414 i = -1;
415 while ((i = X509_NAME_get_index_by_NID(nm,
416 NID_pkcs9_emailAddress, i)) >= 0) {
417 ne = X509_NAME_get_entry(nm, i);
418 email = ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne));
419 if (move_p) {
420 X509_NAME_delete_entry(nm, i);
421 X509_NAME_ENTRY_free(ne);
422 i--;
423 }
424 if (!email || !(gen = GENERAL_NAME_new())) {
425 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
426 goto err;
427 }
428 gen->d.ia5 = email;
429 email = NULL;
430 gen->type = GEN_EMAIL;
431 if (!sk_GENERAL_NAME_push(gens, gen)) {
432 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
433 goto err;
434 }
435 gen = NULL;
436 }
437
438 return 1;
439
440err:
441 GENERAL_NAME_free(gen);
442 ASN1_IA5STRING_free(email);
443 return 0;
444}
445
446GENERAL_NAMES *
447v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
448 STACK_OF(CONF_VALUE) *nval)
449{
450 GENERAL_NAME *gen;
451 GENERAL_NAMES *gens = NULL;
452 CONF_VALUE *cnf;
453 int i;
454
455 if (!(gens = sk_GENERAL_NAME_new_null())) {
456 X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
457 return NULL;
458 }
459 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
460 cnf = sk_CONF_VALUE_value(nval, i);
461 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
462 goto err;
463 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
464 GENERAL_NAME_free(gen);
465 goto err;
466 }
467 }
468 return gens;
469
470err:
471 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
472 return NULL;
473}
474
475GENERAL_NAME *
476v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
477 CONF_VALUE *cnf)
478{
479 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
480}
481
482GENERAL_NAME *
483a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
484 X509V3_CTX *ctx, int gen_type, char *value, int is_nc)
485{
486 char is_string = 0;
487 GENERAL_NAME *gen = NULL;
488
489 if (!value) {
490 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
491 return NULL;
492 }
493
494 if (out)
495 gen = out;
496 else {
497 gen = GENERAL_NAME_new();
498 if (gen == NULL) {
499 X509V3err(X509V3_F_A2I_GENERAL_NAME,
500 ERR_R_MALLOC_FAILURE);
501 return NULL;
502 }
503 }
504
505 switch (gen_type) {
506 case GEN_URI:
507 case GEN_EMAIL:
508 case GEN_DNS:
509 is_string = 1;
510 break;
511
512 case GEN_RID:
513 {
514 ASN1_OBJECT *obj;
515 if (!(obj = OBJ_txt2obj(value, 0))) {
516 X509V3err(X509V3_F_A2I_GENERAL_NAME,
517 X509V3_R_BAD_OBJECT);
518 ERR_asprintf_error_data("value=%s", value);
519 goto err;
520 }
521 gen->d.rid = obj;
522 }
523 break;
524
525 case GEN_IPADD:
526 if (is_nc)
527 gen->d.ip = a2i_IPADDRESS_NC(value);
528 else
529 gen->d.ip = a2i_IPADDRESS(value);
530 if (gen->d.ip == NULL) {
531 X509V3err(X509V3_F_A2I_GENERAL_NAME,
532 X509V3_R_BAD_IP_ADDRESS);
533 ERR_asprintf_error_data("value=%s", value);
534 goto err;
535 }
536 break;
537
538 case GEN_DIRNAME:
539 if (!do_dirname(gen, value, ctx)) {
540 X509V3err(X509V3_F_A2I_GENERAL_NAME,
541 X509V3_R_DIRNAME_ERROR);
542 goto err;
543 }
544 break;
545
546 case GEN_OTHERNAME:
547 if (!do_othername(gen, value, ctx)) {
548 X509V3err(X509V3_F_A2I_GENERAL_NAME,
549 X509V3_R_OTHERNAME_ERROR);
550 goto err;
551 }
552 break;
553
554 default:
555 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
556 goto err;
557 }
558
559 if (is_string) {
560 if (!(gen->d.ia5 = ASN1_IA5STRING_new()) ||
561 !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
562 strlen(value))) {
563 X509V3err(X509V3_F_A2I_GENERAL_NAME,
564 ERR_R_MALLOC_FAILURE);
565 goto err;
566 }
567 }
568
569 gen->type = gen_type;
570
571 return gen;
572
573err:
574 if (out == NULL)
575 GENERAL_NAME_free(gen);
576 return NULL;
577}
578
579GENERAL_NAME *
580v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
581 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
582{
583 int type;
584 char *name, *value;
585
586 name = cnf->name;
587 value = cnf->value;
588
589 if (!value) {
590 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
591 return NULL;
592 }
593
594 if (!name_cmp(name, "email"))
595 type = GEN_EMAIL;
596 else if (!name_cmp(name, "URI"))
597 type = GEN_URI;
598 else if (!name_cmp(name, "DNS"))
599 type = GEN_DNS;
600 else if (!name_cmp(name, "RID"))
601 type = GEN_RID;
602 else if (!name_cmp(name, "IP"))
603 type = GEN_IPADD;
604 else if (!name_cmp(name, "dirName"))
605 type = GEN_DIRNAME;
606 else if (!name_cmp(name, "otherName"))
607 type = GEN_OTHERNAME;
608 else {
609 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,
610 X509V3_R_UNSUPPORTED_OPTION);
611 ERR_asprintf_error_data("name=%s", name);
612 return NULL;
613 }
614
615 return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
616}
617
618static int
619do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
620{
621 char *objtmp = NULL, *p;
622 int objlen;
623
624 if (!(p = strchr(value, ';')))
625 return 0;
626 if (!(gen->d.otherName = OTHERNAME_new()))
627 return 0;
628 /* Free this up because we will overwrite it.
629 * no need to free type_id because it is static
630 */
631 ASN1_TYPE_free(gen->d.otherName->value);
632 if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
633 return 0;
634 objlen = p - value;
635 objtmp = malloc(objlen + 1);
636 if (objtmp) {
637 strlcpy(objtmp, value, objlen + 1);
638 gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
639 free(objtmp);
640 } else
641 gen->d.otherName->type_id = NULL;
642 if (!gen->d.otherName->type_id)
643 return 0;
644 return 1;
645}
646
647static int
648do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
649{
650 int ret;
651 STACK_OF(CONF_VALUE) *sk;
652 X509_NAME *nm;
653
654 if (!(nm = X509_NAME_new()))
655 return 0;
656 sk = X509V3_get_section(ctx, value);
657 if (!sk) {
658 X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
659 ERR_asprintf_error_data("section=%s", value);
660 X509_NAME_free(nm);
661 return 0;
662 }
663 /* FIXME: should allow other character types... */
664 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
665 if (!ret)
666 X509_NAME_free(nm);
667 gen->d.dirn = nm;
668 X509V3_section_free(ctx, sk);
669
670 return ret;
671}
diff --git a/src/lib/libcrypto/x509v3/v3_bcons.c b/src/lib/libcrypto/x509v3/v3_bcons.c
deleted file mode 100644
index 292705a8d6..0000000000
--- a/src/lib/libcrypto/x509v3/v3_bcons.c
+++ /dev/null
@@ -1,185 +0,0 @@
1/* $OpenBSD: v3_bcons.c,v 1.13 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
69 BASIC_CONSTRAINTS *bcons, STACK_OF(CONF_VALUE) *extlist);
70static BASIC_CONSTRAINTS *v2i_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
71 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
72
73const X509V3_EXT_METHOD v3_bcons = {
74 .ext_nid = NID_basic_constraints,
75 .ext_flags = 0,
76 .it = ASN1_ITEM_ref(BASIC_CONSTRAINTS),
77 .ext_new = NULL,
78 .ext_free = NULL,
79 .d2i = NULL,
80 .i2d = NULL,
81 .i2s = NULL,
82 .s2i = NULL,
83 .i2v = (X509V3_EXT_I2V)i2v_BASIC_CONSTRAINTS,
84 .v2i = (X509V3_EXT_V2I)v2i_BASIC_CONSTRAINTS,
85 .i2r = NULL,
86 .r2i = NULL,
87 .usr_data = NULL,
88};
89
90static const ASN1_TEMPLATE BASIC_CONSTRAINTS_seq_tt[] = {
91 {
92 .flags = ASN1_TFLG_OPTIONAL,
93 .tag = 0,
94 .offset = offsetof(BASIC_CONSTRAINTS, ca),
95 .field_name = "ca",
96 .item = &ASN1_FBOOLEAN_it,
97 },
98 {
99 .flags = ASN1_TFLG_OPTIONAL,
100 .tag = 0,
101 .offset = offsetof(BASIC_CONSTRAINTS, pathlen),
102 .field_name = "pathlen",
103 .item = &ASN1_INTEGER_it,
104 },
105};
106
107const ASN1_ITEM BASIC_CONSTRAINTS_it = {
108 .itype = ASN1_ITYPE_SEQUENCE,
109 .utype = V_ASN1_SEQUENCE,
110 .templates = BASIC_CONSTRAINTS_seq_tt,
111 .tcount = sizeof(BASIC_CONSTRAINTS_seq_tt) / sizeof(ASN1_TEMPLATE),
112 .funcs = NULL,
113 .size = sizeof(BASIC_CONSTRAINTS),
114 .sname = "BASIC_CONSTRAINTS",
115};
116
117
118BASIC_CONSTRAINTS *
119d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a, const unsigned char **in, long len)
120{
121 return (BASIC_CONSTRAINTS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
122 &BASIC_CONSTRAINTS_it);
123}
124
125int
126i2d_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS *a, unsigned char **out)
127{
128 return ASN1_item_i2d((ASN1_VALUE *)a, out, &BASIC_CONSTRAINTS_it);
129}
130
131BASIC_CONSTRAINTS *
132BASIC_CONSTRAINTS_new(void)
133{
134 return (BASIC_CONSTRAINTS *)ASN1_item_new(&BASIC_CONSTRAINTS_it);
135}
136
137void
138BASIC_CONSTRAINTS_free(BASIC_CONSTRAINTS *a)
139{
140 ASN1_item_free((ASN1_VALUE *)a, &BASIC_CONSTRAINTS_it);
141}
142
143
144static STACK_OF(CONF_VALUE) *
145i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method, BASIC_CONSTRAINTS *bcons,
146 STACK_OF(CONF_VALUE) *extlist)
147{
148 X509V3_add_value_bool("CA", bcons->ca, &extlist);
149 X509V3_add_value_int("pathlen", bcons->pathlen, &extlist);
150 return extlist;
151}
152
153static BASIC_CONSTRAINTS *
154v2i_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
155 STACK_OF(CONF_VALUE) *values)
156{
157 BASIC_CONSTRAINTS *bcons = NULL;
158 CONF_VALUE *val;
159 int i;
160
161 if (!(bcons = BASIC_CONSTRAINTS_new())) {
162 X509V3err(X509V3_F_V2I_BASIC_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
163 return NULL;
164 }
165 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
166 val = sk_CONF_VALUE_value(values, i);
167 if (!strcmp(val->name, "CA")) {
168 if (!X509V3_get_value_bool(val, &bcons->ca))
169 goto err;
170 } else if (!strcmp(val->name, "pathlen")) {
171 if (!X509V3_get_value_int(val, &bcons->pathlen))
172 goto err;
173 } else {
174 X509V3err(X509V3_F_V2I_BASIC_CONSTRAINTS,
175 X509V3_R_INVALID_NAME);
176 X509V3_conf_err(val);
177 goto err;
178 }
179 }
180 return bcons;
181
182err:
183 BASIC_CONSTRAINTS_free(bcons);
184 return NULL;
185}
diff --git a/src/lib/libcrypto/x509v3/v3_bitst.c b/src/lib/libcrypto/x509v3/v3_bitst.c
deleted file mode 100644
index 0670aa306e..0000000000
--- a/src/lib/libcrypto/x509v3/v3_bitst.c
+++ /dev/null
@@ -1,175 +0,0 @@
1/* $OpenBSD: v3_bitst.c,v 1.12 2015/09/29 13:54:40 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/conf.h>
63#include <openssl/err.h>
64#include <openssl/x509v3.h>
65
66static BIT_STRING_BITNAME ns_cert_type_table[] = {
67 {0, "SSL Client", "client"},
68 {1, "SSL Server", "server"},
69 {2, "S/MIME", "email"},
70 {3, "Object Signing", "objsign"},
71 {4, "Unused", "reserved"},
72 {5, "SSL CA", "sslCA"},
73 {6, "S/MIME CA", "emailCA"},
74 {7, "Object Signing CA", "objCA"},
75 {-1, NULL, NULL}
76};
77
78static BIT_STRING_BITNAME key_usage_type_table[] = {
79 {0, "Digital Signature", "digitalSignature"},
80 {1, "Non Repudiation", "nonRepudiation"},
81 {2, "Key Encipherment", "keyEncipherment"},
82 {3, "Data Encipherment", "dataEncipherment"},
83 {4, "Key Agreement", "keyAgreement"},
84 {5, "Certificate Sign", "keyCertSign"},
85 {6, "CRL Sign", "cRLSign"},
86 {7, "Encipher Only", "encipherOnly"},
87 {8, "Decipher Only", "decipherOnly"},
88 {-1, NULL, NULL}
89};
90
91const X509V3_EXT_METHOD v3_nscert = {
92 .ext_nid = NID_netscape_cert_type,
93 .ext_flags = 0,
94 .it = ASN1_ITEM_ref(ASN1_BIT_STRING),
95 .ext_new = NULL,
96 .ext_free = NULL,
97 .d2i = NULL,
98 .i2d = NULL,
99 .i2s = NULL,
100 .s2i = NULL,
101 .i2v = (X509V3_EXT_I2V)i2v_ASN1_BIT_STRING,
102 .v2i = (X509V3_EXT_V2I)v2i_ASN1_BIT_STRING,
103 .i2r = NULL,
104 .r2i = NULL,
105 .usr_data = ns_cert_type_table,
106};
107
108const X509V3_EXT_METHOD v3_key_usage = {
109 .ext_nid = NID_key_usage,
110 .ext_flags = 0,
111 .it = ASN1_ITEM_ref(ASN1_BIT_STRING),
112 .ext_new = NULL,
113 .ext_free = NULL,
114 .d2i = NULL,
115 .i2d = NULL,
116 .i2s = NULL,
117 .s2i = NULL,
118 .i2v = (X509V3_EXT_I2V)i2v_ASN1_BIT_STRING,
119 .v2i = (X509V3_EXT_V2I)v2i_ASN1_BIT_STRING,
120 .i2r = NULL,
121 .r2i = NULL,
122 .usr_data = key_usage_type_table,
123};
124
125STACK_OF(CONF_VALUE) *
126i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method, ASN1_BIT_STRING *bits,
127 STACK_OF(CONF_VALUE) *ret)
128{
129 BIT_STRING_BITNAME *bnam;
130
131 for (bnam = method->usr_data; bnam->lname; bnam++) {
132 if (ASN1_BIT_STRING_get_bit(bits, bnam->bitnum))
133 X509V3_add_value(bnam->lname, NULL, &ret);
134 }
135 return ret;
136}
137
138ASN1_BIT_STRING *
139v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
140 STACK_OF(CONF_VALUE) *nval)
141{
142 CONF_VALUE *val;
143 ASN1_BIT_STRING *bs;
144 int i;
145 BIT_STRING_BITNAME *bnam;
146
147 if (!(bs = ASN1_BIT_STRING_new())) {
148 X509V3err(X509V3_F_V2I_ASN1_BIT_STRING, ERR_R_MALLOC_FAILURE);
149 return NULL;
150 }
151 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
152 val = sk_CONF_VALUE_value(nval, i);
153 for (bnam = method->usr_data; bnam->lname; bnam++) {
154 if (!strcmp(bnam->sname, val->name) ||
155 !strcmp(bnam->lname, val->name) ) {
156 if (!ASN1_BIT_STRING_set_bit(bs,
157 bnam->bitnum, 1)) {
158 X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,
159 ERR_R_MALLOC_FAILURE);
160 ASN1_BIT_STRING_free(bs);
161 return NULL;
162 }
163 break;
164 }
165 }
166 if (!bnam->lname) {
167 X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,
168 X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT);
169 X509V3_conf_err(val);
170 ASN1_BIT_STRING_free(bs);
171 return NULL;
172 }
173 }
174 return bs;
175}
diff --git a/src/lib/libcrypto/x509v3/v3_conf.c b/src/lib/libcrypto/x509v3/v3_conf.c
deleted file mode 100644
index 20e156ce87..0000000000
--- a/src/lib/libcrypto/x509v3/v3_conf.c
+++ /dev/null
@@ -1,576 +0,0 @@
1/* $OpenBSD: v3_conf.c,v 1.19 2015/12/14 03:39:14 beck Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2002 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58/* extension creation utilities */
59
60#include <ctype.h>
61#include <stdio.h>
62#include <string.h>
63
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509.h>
67#include <openssl/x509v3.h>
68
69static int v3_check_critical(char **value);
70static int v3_check_generic(char **value);
71static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
72 int crit, char *value);
73static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
74 int crit, int type, X509V3_CTX *ctx);
75static char *conf_lhash_get_string(void *db, char *section, char *value);
76static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section);
77static X509_EXTENSION *do_ext_i2d(const X509V3_EXT_METHOD *method, int ext_nid,
78 int crit, void *ext_struc);
79static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len);
80
81/* CONF *conf: Config file */
82/* char *name: Name */
83/* char *value: Value */
84X509_EXTENSION *
85X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name, char *value)
86{
87 int crit;
88 int ext_type;
89 X509_EXTENSION *ret;
90
91 crit = v3_check_critical(&value);
92 if ((ext_type = v3_check_generic(&value)))
93 return v3_generic_extension(name, value, crit, ext_type, ctx);
94 ret = do_ext_nconf(conf, ctx, OBJ_sn2nid(name), crit, value);
95 if (!ret) {
96 X509V3err(X509V3_F_X509V3_EXT_NCONF,
97 X509V3_R_ERROR_IN_EXTENSION);
98 ERR_asprintf_error_data("name=%s, value=%s", name, value);
99 }
100 return ret;
101}
102
103/* CONF *conf: Config file */
104/* char *value: Value */
105X509_EXTENSION *
106X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, char *value)
107{
108 int crit;
109 int ext_type;
110
111 crit = v3_check_critical(&value);
112 if ((ext_type = v3_check_generic(&value)))
113 return v3_generic_extension(OBJ_nid2sn(ext_nid),
114 value, crit, ext_type, ctx);
115 return do_ext_nconf(conf, ctx, ext_nid, crit, value);
116}
117
118/* CONF *conf: Config file */
119/* char *value: Value */
120static X509_EXTENSION *
121do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value)
122{
123 const X509V3_EXT_METHOD *method;
124 X509_EXTENSION *ext;
125 void *ext_struc;
126
127 if (ext_nid == NID_undef) {
128 X509V3err(X509V3_F_DO_EXT_NCONF,
129 X509V3_R_UNKNOWN_EXTENSION_NAME);
130 return NULL;
131 }
132 if (!(method = X509V3_EXT_get_nid(ext_nid))) {
133 X509V3err(X509V3_F_DO_EXT_NCONF, X509V3_R_UNKNOWN_EXTENSION);
134 return NULL;
135 }
136 /* Now get internal extension representation based on type */
137 if (method->v2i) {
138 STACK_OF(CONF_VALUE) *nval;
139
140 if (*value == '@')
141 nval = NCONF_get_section(conf, value + 1);
142 else
143 nval = X509V3_parse_list(value);
144 if (sk_CONF_VALUE_num(nval) <= 0) {
145 X509V3err(X509V3_F_DO_EXT_NCONF,
146 X509V3_R_INVALID_EXTENSION_STRING);
147 ERR_asprintf_error_data("name=%s,section=%s",
148 OBJ_nid2sn(ext_nid), value);
149 if (*value != '@')
150 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
151 return NULL;
152 }
153 ext_struc = method->v2i(method, ctx, nval);
154 if (*value != '@')
155 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
156 } else if (method->s2i) {
157 ext_struc = method->s2i(method, ctx, value);
158 } else if (method->r2i) {
159 if (!ctx->db || !ctx->db_meth) {
160 X509V3err(X509V3_F_DO_EXT_NCONF,
161 X509V3_R_NO_CONFIG_DATABASE);
162 return NULL;
163 }
164 ext_struc = method->r2i(method, ctx, value);
165 } else {
166 X509V3err(X509V3_F_DO_EXT_NCONF,
167 X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
168 ERR_asprintf_error_data("name=%s", OBJ_nid2sn(ext_nid));
169 return NULL;
170 }
171 if (ext_struc == NULL)
172 return NULL;
173
174 ext = do_ext_i2d(method, ext_nid, crit, ext_struc);
175 if (method->it)
176 ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
177 else
178 method->ext_free(ext_struc);
179 return ext;
180}
181
182static X509_EXTENSION *
183do_ext_i2d(const X509V3_EXT_METHOD *method, int ext_nid, int crit,
184 void *ext_struc)
185{
186 unsigned char *ext_der;
187 int ext_len;
188 ASN1_OCTET_STRING *ext_oct = NULL;
189 X509_EXTENSION *ext;
190
191 /* Convert internal representation to DER */
192 if (method->it) {
193 ext_der = NULL;
194 ext_len = ASN1_item_i2d(ext_struc, &ext_der,
195 ASN1_ITEM_ptr(method->it));
196 if (ext_len < 0)
197 goto merr;
198 } else {
199 unsigned char *p;
200 ext_len = method->i2d(ext_struc, NULL);
201 if (!(ext_der = malloc(ext_len)))
202 goto merr;
203 p = ext_der;
204 method->i2d(ext_struc, &p);
205 }
206 if (!(ext_oct = ASN1_OCTET_STRING_new()))
207 goto merr;
208 ext_oct->data = ext_der;
209 ext_oct->length = ext_len;
210
211 ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
212 if (!ext)
213 goto merr;
214 ASN1_OCTET_STRING_free(ext_oct);
215
216 return ext;
217
218merr:
219 ASN1_OCTET_STRING_free(ext_oct);
220 X509V3err(X509V3_F_DO_EXT_I2D, ERR_R_MALLOC_FAILURE);
221 return NULL;
222
223}
224
225/* Given an internal structure, nid and critical flag create an extension */
226
227X509_EXTENSION *
228X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc)
229{
230 const X509V3_EXT_METHOD *method;
231
232 if (!(method = X509V3_EXT_get_nid(ext_nid))) {
233 X509V3err(X509V3_F_X509V3_EXT_I2D, X509V3_R_UNKNOWN_EXTENSION);
234 return NULL;
235 }
236 return do_ext_i2d(method, ext_nid, crit, ext_struc);
237}
238
239/* Check the extension string for critical flag */
240static int
241v3_check_critical(char **value)
242{
243 char *p = *value;
244
245 if ((strlen(p) < 9) || strncmp(p, "critical,", 9))
246 return 0;
247 p += 9;
248 while (isspace((unsigned char)*p)) p++;
249 *value = p;
250 return 1;
251}
252
253/* Check extension string for generic extension and return the type */
254static int
255v3_check_generic(char **value)
256{
257 int gen_type = 0;
258 char *p = *value;
259
260 if ((strlen(p) >= 4) && !strncmp(p, "DER:", 4)) {
261 p += 4;
262 gen_type = 1;
263 } else if ((strlen(p) >= 5) && !strncmp(p, "ASN1:", 5)) {
264 p += 5;
265 gen_type = 2;
266 } else
267 return 0;
268
269 while (isspace((unsigned char)*p))
270 p++;
271 *value = p;
272 return gen_type;
273}
274
275/* Create a generic extension: for now just handle DER type */
276static X509_EXTENSION *
277v3_generic_extension(const char *ext, char *value, int crit, int gen_type,
278 X509V3_CTX *ctx)
279{
280 unsigned char *ext_der = NULL;
281 long ext_len = 0;
282 ASN1_OBJECT *obj = NULL;
283 ASN1_OCTET_STRING *oct = NULL;
284 X509_EXTENSION *extension = NULL;
285
286 if (!(obj = OBJ_txt2obj(ext, 0))) {
287 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
288 X509V3_R_EXTENSION_NAME_ERROR);
289 ERR_asprintf_error_data("name=%s", ext);
290 goto err;
291 }
292
293 if (gen_type == 1)
294 ext_der = string_to_hex(value, &ext_len);
295 else if (gen_type == 2)
296 ext_der = generic_asn1(value, ctx, &ext_len);
297 else {
298 ERR_asprintf_error_data("Unexpected generic extension type %d", gen_type);
299 goto err;
300 }
301
302 if (ext_der == NULL) {
303 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
304 X509V3_R_EXTENSION_VALUE_ERROR);
305 ERR_asprintf_error_data("value=%s", value);
306 goto err;
307 }
308
309 if (!(oct = ASN1_OCTET_STRING_new())) {
310 X509V3err(X509V3_F_V3_GENERIC_EXTENSION, ERR_R_MALLOC_FAILURE);
311 goto err;
312 }
313
314 oct->data = ext_der;
315 oct->length = ext_len;
316 ext_der = NULL;
317
318 extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
319
320err:
321 ASN1_OBJECT_free(obj);
322 ASN1_OCTET_STRING_free(oct);
323 free(ext_der);
324 return extension;
325}
326
327static unsigned char *
328generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len)
329{
330 ASN1_TYPE *typ;
331 unsigned char *ext_der = NULL;
332
333 typ = ASN1_generate_v3(value, ctx);
334 if (typ == NULL)
335 return NULL;
336 *ext_len = i2d_ASN1_TYPE(typ, &ext_der);
337 ASN1_TYPE_free(typ);
338 return ext_der;
339}
340
341/* This is the main function: add a bunch of extensions based on a config file
342 * section to an extension STACK.
343 */
344
345int
346X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section,
347 STACK_OF(X509_EXTENSION) **sk)
348{
349 X509_EXTENSION *ext;
350 STACK_OF(CONF_VALUE) *nval;
351 CONF_VALUE *val;
352 int i;
353
354 if (!(nval = NCONF_get_section(conf, section)))
355 return 0;
356 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
357 val = sk_CONF_VALUE_value(nval, i);
358 if (!(ext = X509V3_EXT_nconf(conf, ctx, val->name, val->value)))
359 return 0;
360 if (sk)
361 X509v3_add_ext(sk, ext, -1);
362 X509_EXTENSION_free(ext);
363 }
364 return 1;
365}
366
367/* Convenience functions to add extensions to a certificate, CRL and request */
368
369int
370X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509 *cert)
371{
372 STACK_OF(X509_EXTENSION) **sk = NULL;
373
374 if (cert)
375 sk = &cert->cert_info->extensions;
376 return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
377}
378
379/* Same as above but for a CRL */
380
381int
382X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
383 X509_CRL *crl)
384{
385 STACK_OF(X509_EXTENSION) **sk = NULL;
386
387 if (crl)
388 sk = &crl->crl->extensions;
389 return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
390}
391
392/* Add extensions to certificate request */
393
394int
395X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
396 X509_REQ *req)
397{
398 STACK_OF(X509_EXTENSION) *extlist = NULL, **sk = NULL;
399 int i;
400
401 if (req)
402 sk = &extlist;
403 i = X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
404 if (!i || !sk)
405 return i;
406 i = X509_REQ_add_extensions(req, extlist);
407 sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
408 return i;
409}
410
411/* Config database functions */
412
413char *
414X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
415{
416 if (!ctx->db || !ctx->db_meth || !ctx->db_meth->get_string) {
417 X509V3err(X509V3_F_X509V3_GET_STRING,
418 X509V3_R_OPERATION_NOT_DEFINED);
419 return NULL;
420 }
421 if (ctx->db_meth->get_string)
422 return ctx->db_meth->get_string(ctx->db, name, section);
423 return NULL;
424}
425
426STACK_OF(CONF_VALUE) *
427X509V3_get_section(X509V3_CTX *ctx, char *section)
428{
429 if (!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section) {
430 X509V3err(X509V3_F_X509V3_GET_SECTION,
431 X509V3_R_OPERATION_NOT_DEFINED);
432 return NULL;
433 }
434 if (ctx->db_meth->get_section)
435 return ctx->db_meth->get_section(ctx->db, section);
436 return NULL;
437}
438
439void
440X509V3_string_free(X509V3_CTX *ctx, char *str)
441{
442 if (!str)
443 return;
444 if (ctx->db_meth->free_string)
445 ctx->db_meth->free_string(ctx->db, str);
446}
447
448void
449X509V3_section_free(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section)
450{
451 if (!section)
452 return;
453 if (ctx->db_meth->free_section)
454 ctx->db_meth->free_section(ctx->db, section);
455}
456
457static char *
458nconf_get_string(void *db, char *section, char *value)
459{
460 return NCONF_get_string(db, section, value);
461}
462
463static
464STACK_OF(CONF_VALUE) *nconf_get_section(void *db, char *section)
465{
466 return NCONF_get_section(db, section);
467}
468
469static X509V3_CONF_METHOD nconf_method = {
470 nconf_get_string,
471 nconf_get_section,
472 NULL,
473 NULL
474};
475
476void
477X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf)
478{
479 ctx->db_meth = &nconf_method;
480 ctx->db = conf;
481}
482
483void
484X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subj, X509_REQ *req,
485 X509_CRL *crl, int flags)
486{
487 ctx->issuer_cert = issuer;
488 ctx->subject_cert = subj;
489 ctx->crl = crl;
490 ctx->subject_req = req;
491 ctx->flags = flags;
492}
493
494/* Old conf compatibility functions */
495
496X509_EXTENSION *
497X509V3_EXT_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx, char *name,
498 char *value)
499{
500 CONF ctmp;
501
502 CONF_set_nconf(&ctmp, conf);
503 return X509V3_EXT_nconf(&ctmp, ctx, name, value);
504}
505
506/* LHASH *conf: Config file */
507/* char *value: Value */
508X509_EXTENSION *
509X509V3_EXT_conf_nid(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx, int ext_nid,
510 char *value)
511{
512 CONF ctmp;
513
514 CONF_set_nconf(&ctmp, conf);
515 return X509V3_EXT_nconf_nid(&ctmp, ctx, ext_nid, value);
516}
517
518static char *
519conf_lhash_get_string(void *db, char *section, char *value)
520{
521 return CONF_get_string(db, section, value);
522}
523
524static STACK_OF(CONF_VALUE) *
525conf_lhash_get_section(void *db, char *section)
526{
527 return CONF_get_section(db, section);
528}
529
530static X509V3_CONF_METHOD conf_lhash_method = {
531 conf_lhash_get_string,
532 conf_lhash_get_section,
533 NULL,
534 NULL
535};
536
537void
538X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH_OF(CONF_VALUE) *lhash)
539{
540 ctx->db_meth = &conf_lhash_method;
541 ctx->db = lhash;
542}
543
544int
545X509V3_EXT_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx, char *section,
546 X509 *cert)
547{
548 CONF ctmp;
549
550 CONF_set_nconf(&ctmp, conf);
551 return X509V3_EXT_add_nconf(&ctmp, ctx, section, cert);
552}
553
554/* Same as above but for a CRL */
555
556int
557X509V3_EXT_CRL_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
558 char *section, X509_CRL *crl)
559{
560 CONF ctmp;
561
562 CONF_set_nconf(&ctmp, conf);
563 return X509V3_EXT_CRL_add_nconf(&ctmp, ctx, section, crl);
564}
565
566/* Add extensions to certificate request */
567
568int
569X509V3_EXT_REQ_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
570 char *section, X509_REQ *req)
571{
572 CONF ctmp;
573
574 CONF_set_nconf(&ctmp, conf);
575 return X509V3_EXT_REQ_add_nconf(&ctmp, ctx, section, req);
576}
diff --git a/src/lib/libcrypto/x509v3/v3_cpols.c b/src/lib/libcrypto/x509v3/v3_cpols.c
deleted file mode 100644
index 5ca001ad55..0000000000
--- a/src/lib/libcrypto/x509v3/v3_cpols.c
+++ /dev/null
@@ -1,775 +0,0 @@
1/* $OpenBSD: v3_cpols.c,v 1.23 2015/09/30 18:21:50 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68#include "pcy_int.h"
69
70/* Certificate policies extension support: this one is a bit complex... */
71
72static int i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol,
73 BIO *out, int indent);
74static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
75 X509V3_CTX *ctx, char *value);
76static void print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals,
77 int indent);
78static void print_notice(BIO *out, USERNOTICE *notice, int indent);
79static POLICYINFO *policy_section(X509V3_CTX *ctx,
80 STACK_OF(CONF_VALUE) *polstrs, int ia5org);
81static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
82 STACK_OF(CONF_VALUE) *unot, int ia5org);
83static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos);
84
85const X509V3_EXT_METHOD v3_cpols = {
86 .ext_nid = NID_certificate_policies,
87 .ext_flags = 0,
88 .it = ASN1_ITEM_ref(CERTIFICATEPOLICIES),
89 .ext_new = NULL,
90 .ext_free = NULL,
91 .d2i = NULL,
92 .i2d = NULL,
93 .i2s = NULL,
94 .s2i = NULL,
95 .i2v = NULL,
96 .v2i = NULL,
97 .i2r = (X509V3_EXT_I2R)i2r_certpol,
98 .r2i = (X509V3_EXT_R2I)r2i_certpol,
99 .usr_data = NULL,
100};
101
102static const ASN1_TEMPLATE CERTIFICATEPOLICIES_item_tt = {
103 .flags = ASN1_TFLG_SEQUENCE_OF,
104 .tag = 0,
105 .offset = 0,
106 .field_name = "CERTIFICATEPOLICIES",
107 .item = &POLICYINFO_it,
108};
109
110const ASN1_ITEM CERTIFICATEPOLICIES_it = {
111 .itype = ASN1_ITYPE_PRIMITIVE,
112 .utype = -1,
113 .templates = &CERTIFICATEPOLICIES_item_tt,
114 .tcount = 0,
115 .funcs = NULL,
116 .size = 0,
117 .sname = "CERTIFICATEPOLICIES",
118};
119
120
121CERTIFICATEPOLICIES *
122d2i_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES **a, const unsigned char **in, long len)
123{
124 return (CERTIFICATEPOLICIES *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
125 &CERTIFICATEPOLICIES_it);
126}
127
128int
129i2d_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES *a, unsigned char **out)
130{
131 return ASN1_item_i2d((ASN1_VALUE *)a, out, &CERTIFICATEPOLICIES_it);
132}
133
134CERTIFICATEPOLICIES *
135CERTIFICATEPOLICIES_new(void)
136{
137 return (CERTIFICATEPOLICIES *)ASN1_item_new(&CERTIFICATEPOLICIES_it);
138}
139
140void
141CERTIFICATEPOLICIES_free(CERTIFICATEPOLICIES *a)
142{
143 ASN1_item_free((ASN1_VALUE *)a, &CERTIFICATEPOLICIES_it);
144}
145
146static const ASN1_TEMPLATE POLICYINFO_seq_tt[] = {
147 {
148 .flags = 0,
149 .tag = 0,
150 .offset = offsetof(POLICYINFO, policyid),
151 .field_name = "policyid",
152 .item = &ASN1_OBJECT_it,
153 },
154 {
155 .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
156 .tag = 0,
157 .offset = offsetof(POLICYINFO, qualifiers),
158 .field_name = "qualifiers",
159 .item = &POLICYQUALINFO_it,
160 },
161};
162
163const ASN1_ITEM POLICYINFO_it = {
164 .itype = ASN1_ITYPE_SEQUENCE,
165 .utype = V_ASN1_SEQUENCE,
166 .templates = POLICYINFO_seq_tt,
167 .tcount = sizeof(POLICYINFO_seq_tt) / sizeof(ASN1_TEMPLATE),
168 .funcs = NULL,
169 .size = sizeof(POLICYINFO),
170 .sname = "POLICYINFO",
171};
172
173
174POLICYINFO *
175d2i_POLICYINFO(POLICYINFO **a, const unsigned char **in, long len)
176{
177 return (POLICYINFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
178 &POLICYINFO_it);
179}
180
181int
182i2d_POLICYINFO(POLICYINFO *a, unsigned char **out)
183{
184 return ASN1_item_i2d((ASN1_VALUE *)a, out, &POLICYINFO_it);
185}
186
187POLICYINFO *
188POLICYINFO_new(void)
189{
190 return (POLICYINFO *)ASN1_item_new(&POLICYINFO_it);
191}
192
193void
194POLICYINFO_free(POLICYINFO *a)
195{
196 ASN1_item_free((ASN1_VALUE *)a, &POLICYINFO_it);
197}
198
199static const ASN1_TEMPLATE policydefault_tt = {
200 .flags = 0,
201 .tag = 0,
202 .offset = offsetof(POLICYQUALINFO, d.other),
203 .field_name = "d.other",
204 .item = &ASN1_ANY_it,
205};
206
207static const ASN1_ADB_TABLE POLICYQUALINFO_adbtbl[] = {
208 {
209 .value = NID_id_qt_cps,
210 .tt = {
211 .flags = 0,
212 .tag = 0,
213 .offset = offsetof(POLICYQUALINFO, d.cpsuri),
214 .field_name = "d.cpsuri",
215 .item = &ASN1_IA5STRING_it,
216 },
217
218 },
219 {
220 .value = NID_id_qt_unotice,
221 .tt = {
222 .flags = 0,
223 .tag = 0,
224 .offset = offsetof(POLICYQUALINFO, d.usernotice),
225 .field_name = "d.usernotice",
226 .item = &USERNOTICE_it,
227 },
228
229 },
230};
231
232static const ASN1_ADB POLICYQUALINFO_adb = {
233 .flags = 0,
234 .offset = offsetof(POLICYQUALINFO, pqualid),
235 .app_items = 0,
236 .tbl = POLICYQUALINFO_adbtbl,
237 .tblcount = sizeof(POLICYQUALINFO_adbtbl) / sizeof(ASN1_ADB_TABLE),
238 .default_tt = &policydefault_tt,
239 .null_tt = NULL,
240};
241
242static const ASN1_TEMPLATE POLICYQUALINFO_seq_tt[] = {
243 {
244 .flags = 0,
245 .tag = 0,
246 .offset = offsetof(POLICYQUALINFO, pqualid),
247 .field_name = "pqualid",
248 .item = &ASN1_OBJECT_it,
249 },
250 {
251 .flags = ASN1_TFLG_ADB_OID,
252 .tag = -1,
253 .offset = 0,
254 .field_name = "POLICYQUALINFO",
255 .item = (const ASN1_ITEM *)&POLICYQUALINFO_adb,
256 },
257};
258
259const ASN1_ITEM POLICYQUALINFO_it = {
260 .itype = ASN1_ITYPE_SEQUENCE,
261 .utype = V_ASN1_SEQUENCE,
262 .templates = POLICYQUALINFO_seq_tt,
263 .tcount = sizeof(POLICYQUALINFO_seq_tt) / sizeof(ASN1_TEMPLATE),
264 .funcs = NULL,
265 .size = sizeof(POLICYQUALINFO),
266 .sname = "POLICYQUALINFO",
267};
268
269
270POLICYQUALINFO *
271d2i_POLICYQUALINFO(POLICYQUALINFO **a, const unsigned char **in, long len)
272{
273 return (POLICYQUALINFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
274 &POLICYQUALINFO_it);
275}
276
277int
278i2d_POLICYQUALINFO(POLICYQUALINFO *a, unsigned char **out)
279{
280 return ASN1_item_i2d((ASN1_VALUE *)a, out, &POLICYQUALINFO_it);
281}
282
283POLICYQUALINFO *
284POLICYQUALINFO_new(void)
285{
286 return (POLICYQUALINFO *)ASN1_item_new(&POLICYQUALINFO_it);
287}
288
289void
290POLICYQUALINFO_free(POLICYQUALINFO *a)
291{
292 ASN1_item_free((ASN1_VALUE *)a, &POLICYQUALINFO_it);
293}
294
295static const ASN1_TEMPLATE USERNOTICE_seq_tt[] = {
296 {
297 .flags = ASN1_TFLG_OPTIONAL,
298 .tag = 0,
299 .offset = offsetof(USERNOTICE, noticeref),
300 .field_name = "noticeref",
301 .item = &NOTICEREF_it,
302 },
303 {
304 .flags = ASN1_TFLG_OPTIONAL,
305 .tag = 0,
306 .offset = offsetof(USERNOTICE, exptext),
307 .field_name = "exptext",
308 .item = &DISPLAYTEXT_it,
309 },
310};
311
312const ASN1_ITEM USERNOTICE_it = {
313 .itype = ASN1_ITYPE_SEQUENCE,
314 .utype = V_ASN1_SEQUENCE,
315 .templates = USERNOTICE_seq_tt,
316 .tcount = sizeof(USERNOTICE_seq_tt) / sizeof(ASN1_TEMPLATE),
317 .funcs = NULL,
318 .size = sizeof(USERNOTICE),
319 .sname = "USERNOTICE",
320};
321
322
323USERNOTICE *
324d2i_USERNOTICE(USERNOTICE **a, const unsigned char **in, long len)
325{
326 return (USERNOTICE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
327 &USERNOTICE_it);
328}
329
330int
331i2d_USERNOTICE(USERNOTICE *a, unsigned char **out)
332{
333 return ASN1_item_i2d((ASN1_VALUE *)a, out, &USERNOTICE_it);
334}
335
336USERNOTICE *
337USERNOTICE_new(void)
338{
339 return (USERNOTICE *)ASN1_item_new(&USERNOTICE_it);
340}
341
342void
343USERNOTICE_free(USERNOTICE *a)
344{
345 ASN1_item_free((ASN1_VALUE *)a, &USERNOTICE_it);
346}
347
348static const ASN1_TEMPLATE NOTICEREF_seq_tt[] = {
349 {
350 .flags = 0,
351 .tag = 0,
352 .offset = offsetof(NOTICEREF, organization),
353 .field_name = "organization",
354 .item = &DISPLAYTEXT_it,
355 },
356 {
357 .flags = ASN1_TFLG_SEQUENCE_OF,
358 .tag = 0,
359 .offset = offsetof(NOTICEREF, noticenos),
360 .field_name = "noticenos",
361 .item = &ASN1_INTEGER_it,
362 },
363};
364
365const ASN1_ITEM NOTICEREF_it = {
366 .itype = ASN1_ITYPE_SEQUENCE,
367 .utype = V_ASN1_SEQUENCE,
368 .templates = NOTICEREF_seq_tt,
369 .tcount = sizeof(NOTICEREF_seq_tt) / sizeof(ASN1_TEMPLATE),
370 .funcs = NULL,
371 .size = sizeof(NOTICEREF),
372 .sname = "NOTICEREF",
373};
374
375
376NOTICEREF *
377d2i_NOTICEREF(NOTICEREF **a, const unsigned char **in, long len)
378{
379 return (NOTICEREF *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
380 &NOTICEREF_it);
381}
382
383int
384i2d_NOTICEREF(NOTICEREF *a, unsigned char **out)
385{
386 return ASN1_item_i2d((ASN1_VALUE *)a, out, &NOTICEREF_it);
387}
388
389NOTICEREF *
390NOTICEREF_new(void)
391{
392 return (NOTICEREF *)ASN1_item_new(&NOTICEREF_it);
393}
394
395void
396NOTICEREF_free(NOTICEREF *a)
397{
398 ASN1_item_free((ASN1_VALUE *)a, &NOTICEREF_it);
399}
400
401static
402STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
403 char *value)
404{
405 STACK_OF(POLICYINFO) *pols = NULL;
406 char *pstr;
407 POLICYINFO *pol;
408 ASN1_OBJECT *pobj;
409 STACK_OF(CONF_VALUE) *vals;
410 CONF_VALUE *cnf;
411 int i, ia5org;
412
413 pols = sk_POLICYINFO_new_null();
414 if (pols == NULL) {
415 X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_MALLOC_FAILURE);
416 return NULL;
417 }
418 vals = X509V3_parse_list(value);
419 if (vals == NULL) {
420 X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_X509V3_LIB);
421 goto err;
422 }
423 ia5org = 0;
424 for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
425 cnf = sk_CONF_VALUE_value(vals, i);
426 if (cnf->value || !cnf->name) {
427 X509V3err(X509V3_F_R2I_CERTPOL,
428 X509V3_R_INVALID_POLICY_IDENTIFIER);
429 X509V3_conf_err(cnf);
430 goto err;
431 }
432 pstr = cnf->name;
433 if (!strcmp(pstr, "ia5org")) {
434 ia5org = 1;
435 continue;
436 } else if (*pstr == '@') {
437 STACK_OF(CONF_VALUE) *polsect;
438 polsect = X509V3_get_section(ctx, pstr + 1);
439 if (!polsect) {
440 X509V3err(X509V3_F_R2I_CERTPOL,
441 X509V3_R_INVALID_SECTION);
442 X509V3_conf_err(cnf);
443 goto err;
444 }
445 pol = policy_section(ctx, polsect, ia5org);
446 X509V3_section_free(ctx, polsect);
447 if (!pol)
448 goto err;
449 } else {
450 if (!(pobj = OBJ_txt2obj(cnf->name, 0))) {
451 X509V3err(X509V3_F_R2I_CERTPOL,
452 X509V3_R_INVALID_OBJECT_IDENTIFIER);
453 X509V3_conf_err(cnf);
454 goto err;
455 }
456 pol = POLICYINFO_new();
457 pol->policyid = pobj;
458 }
459 if (!sk_POLICYINFO_push(pols, pol)){
460 POLICYINFO_free(pol);
461 X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_MALLOC_FAILURE);
462 goto err;
463 }
464 }
465 sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
466 return pols;
467
468err:
469 sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
470 sk_POLICYINFO_pop_free(pols, POLICYINFO_free);
471 return NULL;
472}
473
474static POLICYINFO *
475policy_section(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *polstrs, int ia5org)
476{
477 int i;
478 CONF_VALUE *cnf;
479 POLICYINFO *pol;
480 POLICYQUALINFO *nqual = NULL;
481
482 if ((pol = POLICYINFO_new()) == NULL)
483 goto merr;
484 for (i = 0; i < sk_CONF_VALUE_num(polstrs); i++) {
485 cnf = sk_CONF_VALUE_value(polstrs, i);
486 if (strcmp(cnf->name, "policyIdentifier") == 0) {
487 ASN1_OBJECT *pobj;
488
489 if ((pobj = OBJ_txt2obj(cnf->value, 0)) == NULL) {
490 X509V3err(X509V3_F_POLICY_SECTION,
491 X509V3_R_INVALID_OBJECT_IDENTIFIER);
492 X509V3_conf_err(cnf);
493 goto err;
494 }
495 pol->policyid = pobj;
496 } else if (name_cmp(cnf->name, "CPS") == 0) {
497 if ((nqual = POLICYQUALINFO_new()) == NULL)
498 goto merr;
499 nqual->pqualid = OBJ_nid2obj(NID_id_qt_cps);
500 nqual->d.cpsuri = ASN1_IA5STRING_new();
501 if (nqual->d.cpsuri == NULL)
502 goto merr;
503 if (ASN1_STRING_set(nqual->d.cpsuri, cnf->value,
504 strlen(cnf->value)) == 0)
505 goto merr;
506
507 if (pol->qualifiers == NULL) {
508 pol->qualifiers = sk_POLICYQUALINFO_new_null();
509 if (pol->qualifiers == NULL)
510 goto merr;
511 }
512 if (sk_POLICYQUALINFO_push(pol->qualifiers, nqual) == 0)
513 goto merr;
514 nqual = NULL;
515 } else if (name_cmp(cnf->name, "userNotice") == 0) {
516 STACK_OF(CONF_VALUE) *unot;
517 POLICYQUALINFO *qual;
518
519 if (*cnf->value != '@') {
520 X509V3err(X509V3_F_POLICY_SECTION,
521 X509V3_R_EXPECTED_A_SECTION_NAME);
522 X509V3_conf_err(cnf);
523 goto err;
524 }
525 unot = X509V3_get_section(ctx, cnf->value + 1);
526 if (unot == NULL) {
527 X509V3err(X509V3_F_POLICY_SECTION,
528 X509V3_R_INVALID_SECTION);
529 X509V3_conf_err(cnf);
530 goto err;
531 }
532 qual = notice_section(ctx, unot, ia5org);
533 X509V3_section_free(ctx, unot);
534 if (qual == NULL)
535 goto err;
536
537 if (pol->qualifiers == NULL) {
538 pol->qualifiers = sk_POLICYQUALINFO_new_null();
539 if (pol->qualifiers == NULL)
540 goto merr;
541 }
542 if (sk_POLICYQUALINFO_push(pol->qualifiers, qual) == 0)
543 goto merr;
544 } else {
545 X509V3err(X509V3_F_POLICY_SECTION,
546 X509V3_R_INVALID_OPTION);
547 X509V3_conf_err(cnf);
548 goto err;
549 }
550 }
551 if (pol->policyid == NULL) {
552 X509V3err(X509V3_F_POLICY_SECTION,
553 X509V3_R_NO_POLICY_IDENTIFIER);
554 goto err;
555 }
556
557 return pol;
558
559merr:
560 X509V3err(X509V3_F_POLICY_SECTION, ERR_R_MALLOC_FAILURE);
561
562err:
563 POLICYQUALINFO_free(nqual);
564 POLICYINFO_free(pol);
565 return NULL;
566}
567
568static POLICYQUALINFO *
569notice_section(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *unot, int ia5org)
570{
571 int i, ret;
572 CONF_VALUE *cnf;
573 USERNOTICE *not;
574 POLICYQUALINFO *qual;
575
576 if (!(qual = POLICYQUALINFO_new()))
577 goto merr;
578 qual->pqualid = OBJ_nid2obj(NID_id_qt_unotice);
579 if (!(not = USERNOTICE_new()))
580 goto merr;
581 qual->d.usernotice = not;
582 for (i = 0; i < sk_CONF_VALUE_num(unot); i++) {
583 cnf = sk_CONF_VALUE_value(unot, i);
584 if (!strcmp(cnf->name, "explicitText")) {
585 if (not->exptext == NULL) {
586 not->exptext = ASN1_VISIBLESTRING_new();
587 if (not->exptext == NULL)
588 goto merr;
589 }
590 if (!ASN1_STRING_set(not->exptext, cnf->value,
591 strlen(cnf->value)))
592 goto merr;
593 } else if (!strcmp(cnf->name, "organization")) {
594 NOTICEREF *nref;
595 if (!not->noticeref) {
596 if (!(nref = NOTICEREF_new()))
597 goto merr;
598 not->noticeref = nref;
599 } else
600 nref = not->noticeref;
601 if (ia5org)
602 nref->organization->type = V_ASN1_IA5STRING;
603 else
604 nref->organization->type = V_ASN1_VISIBLESTRING;
605 if (!ASN1_STRING_set(nref->organization, cnf->value,
606 strlen(cnf->value)))
607 goto merr;
608 } else if (!strcmp(cnf->name, "noticeNumbers")) {
609 NOTICEREF *nref;
610 STACK_OF(CONF_VALUE) *nos;
611 if (!not->noticeref) {
612 if (!(nref = NOTICEREF_new()))
613 goto merr;
614 not->noticeref = nref;
615 } else
616 nref = not->noticeref;
617 nos = X509V3_parse_list(cnf->value);
618 if (!nos || !sk_CONF_VALUE_num(nos)) {
619 X509V3err(X509V3_F_NOTICE_SECTION,
620 X509V3_R_INVALID_NUMBERS);
621 X509V3_conf_err(cnf);
622 if (nos != NULL)
623 sk_CONF_VALUE_pop_free(nos,
624 X509V3_conf_free);
625 goto err;
626 }
627 ret = nref_nos(nref->noticenos, nos);
628 sk_CONF_VALUE_pop_free(nos, X509V3_conf_free);
629 if (!ret)
630 goto err;
631 } else {
632 X509V3err(X509V3_F_NOTICE_SECTION,
633 X509V3_R_INVALID_OPTION);
634 X509V3_conf_err(cnf);
635 goto err;
636 }
637 }
638
639 if (not->noticeref &&
640 (!not->noticeref->noticenos || !not->noticeref->organization)) {
641 X509V3err(X509V3_F_NOTICE_SECTION,
642 X509V3_R_NEED_ORGANIZATION_AND_NUMBERS);
643 goto err;
644 }
645
646 return qual;
647
648merr:
649 X509V3err(X509V3_F_NOTICE_SECTION, ERR_R_MALLOC_FAILURE);
650
651err:
652 POLICYQUALINFO_free(qual);
653 return NULL;
654}
655
656static int
657nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos)
658{
659 CONF_VALUE *cnf;
660 ASN1_INTEGER *aint;
661 int i;
662
663 for (i = 0; i < sk_CONF_VALUE_num(nos); i++) {
664 cnf = sk_CONF_VALUE_value(nos, i);
665 if (!(aint = s2i_ASN1_INTEGER(NULL, cnf->name))) {
666 X509V3err(X509V3_F_NREF_NOS, X509V3_R_INVALID_NUMBER);
667 goto err;
668 }
669 if (!sk_ASN1_INTEGER_push(nnums, aint))
670 goto merr;
671 }
672 return 1;
673
674merr:
675 X509V3err(X509V3_F_NREF_NOS, ERR_R_MALLOC_FAILURE);
676
677err:
678 sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
679 return 0;
680}
681
682static int
683i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol, BIO *out,
684 int indent)
685{
686 int i;
687 POLICYINFO *pinfo;
688
689 /* First print out the policy OIDs */
690 for (i = 0; i < sk_POLICYINFO_num(pol); i++) {
691 pinfo = sk_POLICYINFO_value(pol, i);
692 BIO_printf(out, "%*sPolicy: ", indent, "");
693 i2a_ASN1_OBJECT(out, pinfo->policyid);
694 BIO_puts(out, "\n");
695 if (pinfo->qualifiers)
696 print_qualifiers(out, pinfo->qualifiers, indent + 2);
697 }
698 return 1;
699}
700
701static void
702print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent)
703{
704 POLICYQUALINFO *qualinfo;
705 int i;
706
707 for (i = 0; i < sk_POLICYQUALINFO_num(quals); i++) {
708 qualinfo = sk_POLICYQUALINFO_value(quals, i);
709 switch (OBJ_obj2nid(qualinfo->pqualid)) {
710 case NID_id_qt_cps:
711 BIO_printf(out, "%*sCPS: %s\n", indent, "",
712 qualinfo->d.cpsuri->data);
713 break;
714
715 case NID_id_qt_unotice:
716 BIO_printf(out, "%*sUser Notice:\n", indent, "");
717 print_notice(out, qualinfo->d.usernotice, indent + 2);
718 break;
719
720 default:
721 BIO_printf(out, "%*sUnknown Qualifier: ",
722 indent + 2, "");
723
724 i2a_ASN1_OBJECT(out, qualinfo->pqualid);
725 BIO_puts(out, "\n");
726 break;
727 }
728 }
729}
730
731static void
732print_notice(BIO *out, USERNOTICE *notice, int indent)
733{
734 int i;
735
736 if (notice->noticeref) {
737 NOTICEREF *ref;
738 ref = notice->noticeref;
739 BIO_printf(out, "%*sOrganization: %s\n", indent, "",
740 ref->organization->data);
741 BIO_printf(out, "%*sNumber%s: ", indent, "",
742 sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
743 for (i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
744 ASN1_INTEGER *num;
745 char *tmp;
746 num = sk_ASN1_INTEGER_value(ref->noticenos, i);
747 if (i)
748 BIO_puts(out, ", ");
749 tmp = i2s_ASN1_INTEGER(NULL, num);
750 BIO_puts(out, tmp);
751 free(tmp);
752 }
753 BIO_puts(out, "\n");
754 }
755 if (notice->exptext)
756 BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
757 notice->exptext->data);
758}
759
760void
761X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent)
762{
763 const X509_POLICY_DATA *dat = node->data;
764
765 BIO_printf(out, "%*sPolicy: ", indent, "");
766
767 i2a_ASN1_OBJECT(out, dat->valid_policy);
768 BIO_puts(out, "\n");
769 BIO_printf(out, "%*s%s\n", indent + 2, "",
770 node_data_critical(dat) ? "Critical" : "Non Critical");
771 if (dat->qualifier_set)
772 print_qualifiers(out, dat->qualifier_set, indent + 2);
773 else
774 BIO_printf(out, "%*sNo Qualifiers\n", indent + 2, "");
775}
diff --git a/src/lib/libcrypto/x509v3/v3_crld.c b/src/lib/libcrypto/x509v3/v3_crld.c
deleted file mode 100644
index a72d0ab500..0000000000
--- a/src/lib/libcrypto/x509v3/v3_crld.c
+++ /dev/null
@@ -1,816 +0,0 @@
1/* $OpenBSD: v3_crld.c,v 1.19 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2008 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68static void *v2i_crld(const X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
70static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
71 int indent);
72
73const X509V3_EXT_METHOD v3_crld = {
74 .ext_nid = NID_crl_distribution_points,
75 .ext_flags = 0,
76 .it = ASN1_ITEM_ref(CRL_DIST_POINTS),
77 .ext_new = NULL,
78 .ext_free = NULL,
79 .d2i = NULL,
80 .i2d = NULL,
81 .i2s = NULL,
82 .s2i = NULL,
83 .i2v = NULL,
84 .v2i = v2i_crld,
85 .i2r = i2r_crldp,
86 .r2i = NULL,
87 .usr_data = NULL,
88};
89
90const X509V3_EXT_METHOD v3_freshest_crl = {
91 .ext_nid = NID_freshest_crl,
92 .ext_flags = 0,
93 .it = ASN1_ITEM_ref(CRL_DIST_POINTS),
94 .ext_new = NULL,
95 .ext_free = NULL,
96 .d2i = NULL,
97 .i2d = NULL,
98 .i2s = NULL,
99 .s2i = NULL,
100 .i2v = NULL,
101 .v2i = v2i_crld,
102 .i2r = i2r_crldp,
103 .r2i = NULL,
104 .usr_data = NULL,
105};
106
107static
108STACK_OF(GENERAL_NAME) *gnames_from_sectname(X509V3_CTX *ctx, char *sect)
109{
110 STACK_OF(CONF_VALUE) *gnsect;
111 STACK_OF(GENERAL_NAME) *gens;
112
113 if (*sect == '@')
114 gnsect = X509V3_get_section(ctx, sect + 1);
115 else
116 gnsect = X509V3_parse_list(sect);
117 if (!gnsect) {
118 X509V3err(X509V3_F_GNAMES_FROM_SECTNAME,
119 X509V3_R_SECTION_NOT_FOUND);
120 return NULL;
121 }
122 gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
123 if (*sect == '@')
124 X509V3_section_free(ctx, gnsect);
125 else
126 sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
127 return gens;
128}
129
130static int
131set_dist_point_name(DIST_POINT_NAME **pdp, X509V3_CTX *ctx, CONF_VALUE *cnf)
132{
133 STACK_OF(GENERAL_NAME) *fnm = NULL;
134 STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
135
136 if (!strncmp(cnf->name, "fullname", 9)) {
137 fnm = gnames_from_sectname(ctx, cnf->value);
138 if (!fnm)
139 goto err;
140 } else if (!strcmp(cnf->name, "relativename")) {
141 int ret;
142 STACK_OF(CONF_VALUE) *dnsect;
143 X509_NAME *nm;
144 nm = X509_NAME_new();
145 if (!nm)
146 return -1;
147 dnsect = X509V3_get_section(ctx, cnf->value);
148 if (!dnsect) {
149 X509V3err(X509V3_F_SET_DIST_POINT_NAME,
150 X509V3_R_SECTION_NOT_FOUND);
151 X509_NAME_free(nm);
152 return -1;
153 }
154 ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
155 X509V3_section_free(ctx, dnsect);
156 rnm = nm->entries;
157 nm->entries = NULL;
158 X509_NAME_free(nm);
159 if (!ret || sk_X509_NAME_ENTRY_num(rnm) <= 0)
160 goto err;
161 /* Since its a name fragment can't have more than one
162 * RDNSequence
163 */
164 if (sk_X509_NAME_ENTRY_value(rnm,
165 sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
166 X509V3err(X509V3_F_SET_DIST_POINT_NAME,
167 X509V3_R_INVALID_MULTIPLE_RDNS);
168 goto err;
169 }
170 } else
171 return 0;
172
173 if (*pdp) {
174 X509V3err(X509V3_F_SET_DIST_POINT_NAME,
175 X509V3_R_DISTPOINT_ALREADY_SET);
176 goto err;
177 }
178
179 *pdp = DIST_POINT_NAME_new();
180 if (!*pdp)
181 goto err;
182 if (fnm) {
183 (*pdp)->type = 0;
184 (*pdp)->name.fullname = fnm;
185 } else {
186 (*pdp)->type = 1;
187 (*pdp)->name.relativename = rnm;
188 }
189
190 return 1;
191
192err:
193 if (fnm)
194 sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
195 if (rnm)
196 sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
197 return -1;
198}
199
200static const BIT_STRING_BITNAME reason_flags[] = {
201 {0, "Unused", "unused"},
202 {1, "Key Compromise", "keyCompromise"},
203 {2, "CA Compromise", "CACompromise"},
204 {3, "Affiliation Changed", "affiliationChanged"},
205 {4, "Superseded", "superseded"},
206 {5, "Cessation Of Operation", "cessationOfOperation"},
207 {6, "Certificate Hold", "certificateHold"},
208 {7, "Privilege Withdrawn", "privilegeWithdrawn"},
209 {8, "AA Compromise", "AACompromise"},
210 {-1, NULL, NULL}
211};
212
213static int
214set_reasons(ASN1_BIT_STRING **preas, char *value)
215{
216 STACK_OF(CONF_VALUE) *rsk = NULL;
217 const BIT_STRING_BITNAME *pbn;
218 const char *bnam;
219 int i, ret = 0;
220
221 if (*preas != NULL)
222 return 0;
223 rsk = X509V3_parse_list(value);
224 if (rsk == NULL)
225 return 0;
226 for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
227 bnam = sk_CONF_VALUE_value(rsk, i)->name;
228 if (!*preas) {
229 *preas = ASN1_BIT_STRING_new();
230 if (!*preas)
231 goto err;
232 }
233 for (pbn = reason_flags; pbn->lname; pbn++) {
234 if (!strcmp(pbn->sname, bnam)) {
235 if (!ASN1_BIT_STRING_set_bit(*preas,
236 pbn->bitnum, 1))
237 goto err;
238 break;
239 }
240 }
241 if (!pbn->lname)
242 goto err;
243 }
244 ret = 1;
245
246err:
247 sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
248 return ret;
249}
250
251static int
252print_reasons(BIO *out, const char *rname, ASN1_BIT_STRING *rflags, int indent)
253{
254 int first = 1;
255 const BIT_STRING_BITNAME *pbn;
256
257 BIO_printf(out, "%*s%s:\n%*s", indent, "", rname, indent + 2, "");
258 for (pbn = reason_flags; pbn->lname; pbn++) {
259 if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
260 if (first)
261 first = 0;
262 else
263 BIO_puts(out, ", ");
264 BIO_puts(out, pbn->lname);
265 }
266 }
267 if (first)
268 BIO_puts(out, "<EMPTY>\n");
269 else
270 BIO_puts(out, "\n");
271 return 1;
272}
273
274static DIST_POINT *
275crldp_from_section(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
276{
277 int i;
278 CONF_VALUE *cnf;
279 DIST_POINT *point = NULL;
280
281 point = DIST_POINT_new();
282 if (!point)
283 goto err;
284 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
285 int ret;
286 cnf = sk_CONF_VALUE_value(nval, i);
287 ret = set_dist_point_name(&point->distpoint, ctx, cnf);
288 if (ret > 0)
289 continue;
290 if (ret < 0)
291 goto err;
292 if (!strcmp(cnf->name, "reasons")) {
293 if (!set_reasons(&point->reasons, cnf->value))
294 goto err;
295 }
296 else if (!strcmp(cnf->name, "CRLissuer")) {
297 point->CRLissuer =
298 gnames_from_sectname(ctx, cnf->value);
299 if (!point->CRLissuer)
300 goto err;
301 }
302 }
303
304 return point;
305
306err:
307 if (point)
308 DIST_POINT_free(point);
309 return NULL;
310}
311
312static void *
313v2i_crld(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
314 STACK_OF(CONF_VALUE) *nval)
315{
316 STACK_OF(DIST_POINT) *crld = NULL;
317 GENERAL_NAMES *gens = NULL;
318 GENERAL_NAME *gen = NULL;
319 CONF_VALUE *cnf;
320 int i;
321
322 if (!(crld = sk_DIST_POINT_new_null()))
323 goto merr;
324 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
325 DIST_POINT *point;
326 cnf = sk_CONF_VALUE_value(nval, i);
327 if (!cnf->value) {
328 STACK_OF(CONF_VALUE) *dpsect;
329 dpsect = X509V3_get_section(ctx, cnf->name);
330 if (!dpsect)
331 goto err;
332 point = crldp_from_section(ctx, dpsect);
333 X509V3_section_free(ctx, dpsect);
334 if (!point)
335 goto err;
336 if (!sk_DIST_POINT_push(crld, point)) {
337 DIST_POINT_free(point);
338 goto merr;
339 }
340 } else {
341 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
342 goto err;
343 if (!(gens = GENERAL_NAMES_new()))
344 goto merr;
345 if (!sk_GENERAL_NAME_push(gens, gen))
346 goto merr;
347 gen = NULL;
348 if (!(point = DIST_POINT_new()))
349 goto merr;
350 if (!sk_DIST_POINT_push(crld, point)) {
351 DIST_POINT_free(point);
352 goto merr;
353 }
354 if (!(point->distpoint = DIST_POINT_NAME_new()))
355 goto merr;
356 point->distpoint->name.fullname = gens;
357 point->distpoint->type = 0;
358 gens = NULL;
359 }
360 }
361 return crld;
362
363merr:
364 X509V3err(X509V3_F_V2I_CRLD, ERR_R_MALLOC_FAILURE);
365err:
366 GENERAL_NAME_free(gen);
367 GENERAL_NAMES_free(gens);
368 sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
369 return NULL;
370}
371
372static int
373dpn_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
374{
375 DIST_POINT_NAME *dpn = (DIST_POINT_NAME *)*pval;
376
377 switch (operation) {
378 case ASN1_OP_NEW_POST:
379 dpn->dpname = NULL;
380 break;
381
382 case ASN1_OP_FREE_POST:
383 if (dpn->dpname)
384 X509_NAME_free(dpn->dpname);
385 break;
386 }
387 return 1;
388}
389
390
391static const ASN1_AUX DIST_POINT_NAME_aux = {
392 .app_data = NULL,
393 .flags = 0,
394 .ref_offset = 0,
395 .ref_lock = 0,
396 .asn1_cb = dpn_cb,
397 .enc_offset = 0,
398};
399static const ASN1_TEMPLATE DIST_POINT_NAME_ch_tt[] = {
400 {
401 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF,
402 .tag = 0,
403 .offset = offsetof(DIST_POINT_NAME, name.fullname),
404 .field_name = "name.fullname",
405 .item = &GENERAL_NAME_it,
406 },
407 {
408 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SET_OF,
409 .tag = 1,
410 .offset = offsetof(DIST_POINT_NAME, name.relativename),
411 .field_name = "name.relativename",
412 .item = &X509_NAME_ENTRY_it,
413 },
414};
415
416const ASN1_ITEM DIST_POINT_NAME_it = {
417 .itype = ASN1_ITYPE_CHOICE,
418 .utype = offsetof(DIST_POINT_NAME, type),
419 .templates = DIST_POINT_NAME_ch_tt,
420 .tcount = sizeof(DIST_POINT_NAME_ch_tt) / sizeof(ASN1_TEMPLATE),
421 .funcs = &DIST_POINT_NAME_aux,
422 .size = sizeof(DIST_POINT_NAME),
423 .sname = "DIST_POINT_NAME",
424};
425
426
427
428DIST_POINT_NAME *
429d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, const unsigned char **in, long len)
430{
431 return (DIST_POINT_NAME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
432 &DIST_POINT_NAME_it);
433}
434
435int
436i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **out)
437{
438 return ASN1_item_i2d((ASN1_VALUE *)a, out, &DIST_POINT_NAME_it);
439}
440
441DIST_POINT_NAME *
442DIST_POINT_NAME_new(void)
443{
444 return (DIST_POINT_NAME *)ASN1_item_new(&DIST_POINT_NAME_it);
445}
446
447void
448DIST_POINT_NAME_free(DIST_POINT_NAME *a)
449{
450 ASN1_item_free((ASN1_VALUE *)a, &DIST_POINT_NAME_it);
451}
452
453static const ASN1_TEMPLATE DIST_POINT_seq_tt[] = {
454 {
455 .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
456 .tag = 0,
457 .offset = offsetof(DIST_POINT, distpoint),
458 .field_name = "distpoint",
459 .item = &DIST_POINT_NAME_it,
460 },
461 {
462 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
463 .tag = 1,
464 .offset = offsetof(DIST_POINT, reasons),
465 .field_name = "reasons",
466 .item = &ASN1_BIT_STRING_it,
467 },
468 {
469 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
470 .tag = 2,
471 .offset = offsetof(DIST_POINT, CRLissuer),
472 .field_name = "CRLissuer",
473 .item = &GENERAL_NAME_it,
474 },
475};
476
477const ASN1_ITEM DIST_POINT_it = {
478 .itype = ASN1_ITYPE_SEQUENCE,
479 .utype = V_ASN1_SEQUENCE,
480 .templates = DIST_POINT_seq_tt,
481 .tcount = sizeof(DIST_POINT_seq_tt) / sizeof(ASN1_TEMPLATE),
482 .funcs = NULL,
483 .size = sizeof(DIST_POINT),
484 .sname = "DIST_POINT",
485};
486
487
488DIST_POINT *
489d2i_DIST_POINT(DIST_POINT **a, const unsigned char **in, long len)
490{
491 return (DIST_POINT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
492 &DIST_POINT_it);
493}
494
495int
496i2d_DIST_POINT(DIST_POINT *a, unsigned char **out)
497{
498 return ASN1_item_i2d((ASN1_VALUE *)a, out, &DIST_POINT_it);
499}
500
501DIST_POINT *
502DIST_POINT_new(void)
503{
504 return (DIST_POINT *)ASN1_item_new(&DIST_POINT_it);
505}
506
507void
508DIST_POINT_free(DIST_POINT *a)
509{
510 ASN1_item_free((ASN1_VALUE *)a, &DIST_POINT_it);
511}
512
513static const ASN1_TEMPLATE CRL_DIST_POINTS_item_tt = {
514 .flags = ASN1_TFLG_SEQUENCE_OF,
515 .tag = 0,
516 .offset = 0,
517 .field_name = "CRLDistributionPoints",
518 .item = &DIST_POINT_it,
519};
520
521const ASN1_ITEM CRL_DIST_POINTS_it = {
522 .itype = ASN1_ITYPE_PRIMITIVE,
523 .utype = -1,
524 .templates = &CRL_DIST_POINTS_item_tt,
525 .tcount = 0,
526 .funcs = NULL,
527 .size = 0,
528 .sname = "CRL_DIST_POINTS",
529};
530
531
532CRL_DIST_POINTS *
533d2i_CRL_DIST_POINTS(CRL_DIST_POINTS **a, const unsigned char **in, long len)
534{
535 return (CRL_DIST_POINTS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
536 &CRL_DIST_POINTS_it);
537}
538
539int
540i2d_CRL_DIST_POINTS(CRL_DIST_POINTS *a, unsigned char **out)
541{
542 return ASN1_item_i2d((ASN1_VALUE *)a, out, &CRL_DIST_POINTS_it);
543}
544
545CRL_DIST_POINTS *
546CRL_DIST_POINTS_new(void)
547{
548 return (CRL_DIST_POINTS *)ASN1_item_new(&CRL_DIST_POINTS_it);
549}
550
551void
552CRL_DIST_POINTS_free(CRL_DIST_POINTS *a)
553{
554 ASN1_item_free((ASN1_VALUE *)a, &CRL_DIST_POINTS_it);
555}
556
557static const ASN1_TEMPLATE ISSUING_DIST_POINT_seq_tt[] = {
558 {
559 .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
560 .tag = 0,
561 .offset = offsetof(ISSUING_DIST_POINT, distpoint),
562 .field_name = "distpoint",
563 .item = &DIST_POINT_NAME_it,
564 },
565 {
566 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
567 .tag = 1,
568 .offset = offsetof(ISSUING_DIST_POINT, onlyuser),
569 .field_name = "onlyuser",
570 .item = &ASN1_FBOOLEAN_it,
571 },
572 {
573 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
574 .tag = 2,
575 .offset = offsetof(ISSUING_DIST_POINT, onlyCA),
576 .field_name = "onlyCA",
577 .item = &ASN1_FBOOLEAN_it,
578 },
579 {
580 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
581 .tag = 3,
582 .offset = offsetof(ISSUING_DIST_POINT, onlysomereasons),
583 .field_name = "onlysomereasons",
584 .item = &ASN1_BIT_STRING_it,
585 },
586 {
587 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
588 .tag = 4,
589 .offset = offsetof(ISSUING_DIST_POINT, indirectCRL),
590 .field_name = "indirectCRL",
591 .item = &ASN1_FBOOLEAN_it,
592 },
593 {
594 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
595 .tag = 5,
596 .offset = offsetof(ISSUING_DIST_POINT, onlyattr),
597 .field_name = "onlyattr",
598 .item = &ASN1_FBOOLEAN_it,
599 },
600};
601
602const ASN1_ITEM ISSUING_DIST_POINT_it = {
603 .itype = ASN1_ITYPE_SEQUENCE,
604 .utype = V_ASN1_SEQUENCE,
605 .templates = ISSUING_DIST_POINT_seq_tt,
606 .tcount = sizeof(ISSUING_DIST_POINT_seq_tt) / sizeof(ASN1_TEMPLATE),
607 .funcs = NULL,
608 .size = sizeof(ISSUING_DIST_POINT),
609 .sname = "ISSUING_DIST_POINT",
610};
611
612
613ISSUING_DIST_POINT *
614d2i_ISSUING_DIST_POINT(ISSUING_DIST_POINT **a, const unsigned char **in, long len)
615{
616 return (ISSUING_DIST_POINT *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
617 &ISSUING_DIST_POINT_it);
618}
619
620int
621i2d_ISSUING_DIST_POINT(ISSUING_DIST_POINT *a, unsigned char **out)
622{
623 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ISSUING_DIST_POINT_it);
624}
625
626ISSUING_DIST_POINT *
627ISSUING_DIST_POINT_new(void)
628{
629 return (ISSUING_DIST_POINT *)ASN1_item_new(&ISSUING_DIST_POINT_it);
630}
631
632void
633ISSUING_DIST_POINT_free(ISSUING_DIST_POINT *a)
634{
635 ASN1_item_free((ASN1_VALUE *)a, &ISSUING_DIST_POINT_it);
636}
637
638static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
639 int indent);
640static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
641 STACK_OF(CONF_VALUE) *nval);
642
643const X509V3_EXT_METHOD v3_idp = {
644 NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
645 ASN1_ITEM_ref(ISSUING_DIST_POINT),
646 0, 0, 0, 0,
647 0, 0,
648 0,
649 v2i_idp,
650 i2r_idp, 0,
651 NULL
652};
653
654static void *
655v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
656 STACK_OF(CONF_VALUE) *nval)
657{
658 ISSUING_DIST_POINT *idp = NULL;
659 CONF_VALUE *cnf;
660 char *name, *val;
661 int i, ret;
662
663 idp = ISSUING_DIST_POINT_new();
664 if (!idp)
665 goto merr;
666 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
667 cnf = sk_CONF_VALUE_value(nval, i);
668 name = cnf->name;
669 val = cnf->value;
670 ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
671 if (ret > 0)
672 continue;
673 if (ret < 0)
674 goto err;
675 if (!strcmp(name, "onlyuser")) {
676 if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
677 goto err;
678 }
679 else if (!strcmp(name, "onlyCA")) {
680 if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
681 goto err;
682 }
683 else if (!strcmp(name, "onlyAA")) {
684 if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
685 goto err;
686 }
687 else if (!strcmp(name, "indirectCRL")) {
688 if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
689 goto err;
690 }
691 else if (!strcmp(name, "onlysomereasons")) {
692 if (!set_reasons(&idp->onlysomereasons, val))
693 goto err;
694 } else {
695 X509V3err(X509V3_F_V2I_IDP, X509V3_R_INVALID_NAME);
696 X509V3_conf_err(cnf);
697 goto err;
698 }
699 }
700 return idp;
701
702merr:
703 X509V3err(X509V3_F_V2I_IDP, ERR_R_MALLOC_FAILURE);
704err:
705 ISSUING_DIST_POINT_free(idp);
706 return NULL;
707}
708
709static int
710print_gens(BIO *out, STACK_OF(GENERAL_NAME) *gens, int indent)
711{
712 int i;
713
714 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
715 BIO_printf(out, "%*s", indent + 2, "");
716 GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
717 BIO_puts(out, "\n");
718 }
719 return 1;
720}
721
722static int
723print_distpoint(BIO *out, DIST_POINT_NAME *dpn, int indent)
724{
725 if (dpn->type == 0) {
726 BIO_printf(out, "%*sFull Name:\n", indent, "");
727 print_gens(out, dpn->name.fullname, indent);
728 } else {
729 X509_NAME ntmp;
730 ntmp.entries = dpn->name.relativename;
731 BIO_printf(out, "%*sRelative Name:\n%*s",
732 indent, "", indent + 2, "");
733 X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
734 BIO_puts(out, "\n");
735 }
736 return 1;
737}
738
739static int
740i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out, int indent)
741{
742 ISSUING_DIST_POINT *idp = pidp;
743
744 if (idp->distpoint)
745 print_distpoint(out, idp->distpoint, indent);
746 if (idp->onlyuser > 0)
747 BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
748 if (idp->onlyCA > 0)
749 BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
750 if (idp->indirectCRL > 0)
751 BIO_printf(out, "%*sIndirect CRL\n", indent, "");
752 if (idp->onlysomereasons)
753 print_reasons(out, "Only Some Reasons",
754 idp->onlysomereasons, indent);
755 if (idp->onlyattr > 0)
756 BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
757 if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0) &&
758 (idp->indirectCRL <= 0) && !idp->onlysomereasons &&
759 (idp->onlyattr <= 0))
760 BIO_printf(out, "%*s<EMPTY>\n", indent, "");
761
762 return 1;
763}
764
765static int
766i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out, int indent)
767{
768 STACK_OF(DIST_POINT) *crld = pcrldp;
769 DIST_POINT *point;
770 int i;
771
772 for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
773 BIO_puts(out, "\n");
774 point = sk_DIST_POINT_value(crld, i);
775 if (point->distpoint)
776 print_distpoint(out, point->distpoint, indent);
777 if (point->reasons)
778 print_reasons(out, "Reasons", point->reasons,
779 indent);
780 if (point->CRLissuer) {
781 BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
782 print_gens(out, point->CRLissuer, indent);
783 }
784 }
785 return 1;
786}
787
788int
789DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, X509_NAME *iname)
790{
791 int i;
792 STACK_OF(X509_NAME_ENTRY) *frag;
793 X509_NAME_ENTRY *ne;
794
795 if (!dpn || (dpn->type != 1))
796 return 1;
797 frag = dpn->name.relativename;
798 dpn->dpname = X509_NAME_dup(iname);
799 if (!dpn->dpname)
800 return 0;
801 for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
802 ne = sk_X509_NAME_ENTRY_value(frag, i);
803 if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1)) {
804 X509_NAME_free(dpn->dpname);
805 dpn->dpname = NULL;
806 return 0;
807 }
808 }
809 /* generate cached encoding of name */
810 if (i2d_X509_NAME(dpn->dpname, NULL) < 0) {
811 X509_NAME_free(dpn->dpname);
812 dpn->dpname = NULL;
813 return 0;
814 }
815 return 1;
816}
diff --git a/src/lib/libcrypto/x509v3/v3_enum.c b/src/lib/libcrypto/x509v3/v3_enum.c
deleted file mode 100644
index 7f35a57012..0000000000
--- a/src/lib/libcrypto/x509v3/v3_enum.c
+++ /dev/null
@@ -1,107 +0,0 @@
1/* $OpenBSD: v3_enum.c,v 1.11 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61#include <openssl/x509v3.h>
62
63static ENUMERATED_NAMES crl_reasons[] = {
64 {CRL_REASON_UNSPECIFIED, "Unspecified", "unspecified"},
65 {CRL_REASON_KEY_COMPROMISE, "Key Compromise", "keyCompromise"},
66 {CRL_REASON_CA_COMPROMISE, "CA Compromise", "CACompromise"},
67 {CRL_REASON_AFFILIATION_CHANGED, "Affiliation Changed", "affiliationChanged"},
68 {CRL_REASON_SUPERSEDED, "Superseded", "superseded"},
69 {CRL_REASON_CESSATION_OF_OPERATION,
70 "Cessation Of Operation", "cessationOfOperation"},
71 {CRL_REASON_CERTIFICATE_HOLD, "Certificate Hold", "certificateHold"},
72 {CRL_REASON_REMOVE_FROM_CRL, "Remove From CRL", "removeFromCRL"},
73 {CRL_REASON_PRIVILEGE_WITHDRAWN, "Privilege Withdrawn", "privilegeWithdrawn"},
74 {CRL_REASON_AA_COMPROMISE, "AA Compromise", "AACompromise"},
75 {-1, NULL, NULL}
76};
77
78const X509V3_EXT_METHOD v3_crl_reason = {
79 .ext_nid = NID_crl_reason,
80 .ext_flags = 0,
81 .it = ASN1_ITEM_ref(ASN1_ENUMERATED),
82 .ext_new = NULL,
83 .ext_free = NULL,
84 .d2i = NULL,
85 .i2d = NULL,
86 .i2s = (X509V3_EXT_I2S)i2s_ASN1_ENUMERATED_TABLE,
87 .s2i = NULL,
88 .i2v = NULL,
89 .v2i = NULL,
90 .i2r = NULL,
91 .r2i = NULL,
92 .usr_data = crl_reasons,
93};
94
95char *
96i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *method, ASN1_ENUMERATED *e)
97{
98 ENUMERATED_NAMES *enam;
99 long strval;
100
101 strval = ASN1_ENUMERATED_get(e);
102 for (enam = method->usr_data; enam->lname; enam++) {
103 if (strval == enam->bitnum)
104 return strdup(enam->lname);
105 }
106 return i2s_ASN1_ENUMERATED(method, e);
107}
diff --git a/src/lib/libcrypto/x509v3/v3_extku.c b/src/lib/libcrypto/x509v3/v3_extku.c
deleted file mode 100644
index d502175593..0000000000
--- a/src/lib/libcrypto/x509v3/v3_extku.c
+++ /dev/null
@@ -1,205 +0,0 @@
1/* $OpenBSD: v3_extku.c,v 1.13 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1t.h>
62#include <openssl/conf.h>
63#include <openssl/err.h>
64#include <openssl/x509v3.h>
65
66static void *v2i_EXTENDED_KEY_USAGE(const X509V3_EXT_METHOD *method,
67 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
68static STACK_OF(CONF_VALUE) *i2v_EXTENDED_KEY_USAGE(
69 const X509V3_EXT_METHOD *method, void *eku, STACK_OF(CONF_VALUE) *extlist);
70
71const X509V3_EXT_METHOD v3_ext_ku = {
72 .ext_nid = NID_ext_key_usage,
73 .ext_flags = 0,
74 .it = ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
75 .ext_new = NULL,
76 .ext_free = NULL,
77 .d2i = NULL,
78 .i2d = NULL,
79 .i2s = NULL,
80 .s2i = NULL,
81 .i2v = i2v_EXTENDED_KEY_USAGE,
82 .v2i = v2i_EXTENDED_KEY_USAGE,
83 .i2r = NULL,
84 .r2i = NULL,
85 .usr_data = NULL,
86};
87
88/* NB OCSP acceptable responses also is a SEQUENCE OF OBJECT */
89const X509V3_EXT_METHOD v3_ocsp_accresp = {
90 .ext_nid = NID_id_pkix_OCSP_acceptableResponses,
91 .ext_flags = 0,
92 .it = ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
93 .ext_new = NULL,
94 .ext_free = NULL,
95 .d2i = NULL,
96 .i2d = NULL,
97 .i2s = NULL,
98 .s2i = NULL,
99 .i2v = i2v_EXTENDED_KEY_USAGE,
100 .v2i = v2i_EXTENDED_KEY_USAGE,
101 .i2r = NULL,
102 .r2i = NULL,
103 .usr_data = NULL,
104};
105
106static const ASN1_TEMPLATE EXTENDED_KEY_USAGE_item_tt = {
107 .flags = ASN1_TFLG_SEQUENCE_OF,
108 .tag = 0,
109 .offset = 0,
110 .field_name = "EXTENDED_KEY_USAGE",
111 .item = &ASN1_OBJECT_it,
112};
113
114const ASN1_ITEM EXTENDED_KEY_USAGE_it = {
115 .itype = ASN1_ITYPE_PRIMITIVE,
116 .utype = -1,
117 .templates = &EXTENDED_KEY_USAGE_item_tt,
118 .tcount = 0,
119 .funcs = NULL,
120 .size = 0,
121 .sname = "EXTENDED_KEY_USAGE",
122};
123
124
125EXTENDED_KEY_USAGE *
126d2i_EXTENDED_KEY_USAGE(EXTENDED_KEY_USAGE **a, const unsigned char **in, long len)
127{
128 return (EXTENDED_KEY_USAGE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
129 &EXTENDED_KEY_USAGE_it);
130}
131
132int
133i2d_EXTENDED_KEY_USAGE(EXTENDED_KEY_USAGE *a, unsigned char **out)
134{
135 return ASN1_item_i2d((ASN1_VALUE *)a, out, &EXTENDED_KEY_USAGE_it);
136}
137
138EXTENDED_KEY_USAGE *
139EXTENDED_KEY_USAGE_new(void)
140{
141 return (EXTENDED_KEY_USAGE *)ASN1_item_new(&EXTENDED_KEY_USAGE_it);
142}
143
144void
145EXTENDED_KEY_USAGE_free(EXTENDED_KEY_USAGE *a)
146{
147 ASN1_item_free((ASN1_VALUE *)a, &EXTENDED_KEY_USAGE_it);
148}
149
150static STACK_OF(CONF_VALUE) *
151i2v_EXTENDED_KEY_USAGE(const X509V3_EXT_METHOD *method, void *a,
152 STACK_OF(CONF_VALUE) *ext_list)
153{
154 EXTENDED_KEY_USAGE *eku = a;
155 int i;
156 ASN1_OBJECT *obj;
157 char obj_tmp[80];
158
159 for (i = 0; i < sk_ASN1_OBJECT_num(eku); i++) {
160 obj = sk_ASN1_OBJECT_value(eku, i);
161 i2t_ASN1_OBJECT(obj_tmp, 80, obj);
162 X509V3_add_value(NULL, obj_tmp, &ext_list);
163 }
164 return ext_list;
165}
166
167static void *
168v2i_EXTENDED_KEY_USAGE(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
169 STACK_OF(CONF_VALUE) *nval)
170{
171 EXTENDED_KEY_USAGE *extku;
172 char *extval;
173 ASN1_OBJECT *objtmp;
174 CONF_VALUE *val;
175 int i;
176
177 if (!(extku = sk_ASN1_OBJECT_new_null())) {
178 X509V3err(X509V3_F_V2I_EXTENDED_KEY_USAGE,
179 ERR_R_MALLOC_FAILURE);
180 return NULL;
181 }
182
183 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
184 val = sk_CONF_VALUE_value(nval, i);
185 if (val->value)
186 extval = val->value;
187 else
188 extval = val->name;
189 if (!(objtmp = OBJ_txt2obj(extval, 0))) {
190 sk_ASN1_OBJECT_pop_free(extku, ASN1_OBJECT_free);
191 X509V3err(X509V3_F_V2I_EXTENDED_KEY_USAGE,
192 X509V3_R_INVALID_OBJECT_IDENTIFIER);
193 X509V3_conf_err(val);
194 return NULL;
195 }
196 if (sk_ASN1_OBJECT_push(extku, objtmp) == 0) {
197 ASN1_OBJECT_free(objtmp);
198 sk_ASN1_OBJECT_pop_free(extku, ASN1_OBJECT_free);
199 X509V3err(X509V3_F_V2I_EXTENDED_KEY_USAGE,
200 ERR_R_MALLOC_FAILURE);
201 return NULL;
202 }
203 }
204 return extku;
205}
diff --git a/src/lib/libcrypto/x509v3/v3_genn.c b/src/lib/libcrypto/x509v3/v3_genn.c
deleted file mode 100644
index a6b7a18b17..0000000000
--- a/src/lib/libcrypto/x509v3/v3_genn.c
+++ /dev/null
@@ -1,474 +0,0 @@
1/* $OpenBSD: v3_genn.c,v 1.12 2015/09/26 17:38:41 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2008 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59
60#include <stdio.h>
61
62#include <openssl/asn1t.h>
63#include <openssl/conf.h>
64#include <openssl/x509v3.h>
65
66static const ASN1_TEMPLATE OTHERNAME_seq_tt[] = {
67 {
68 .flags = 0,
69 .tag = 0,
70 .offset = offsetof(OTHERNAME, type_id),
71 .field_name = "type_id",
72 .item = &ASN1_OBJECT_it,
73 },
74 /* Maybe have a true ANY DEFINED BY later */
75 {
76 .flags = ASN1_TFLG_EXPLICIT,
77 .tag = 0,
78 .offset = offsetof(OTHERNAME, value),
79 .field_name = "value",
80 .item = &ASN1_ANY_it,
81 },
82};
83
84const ASN1_ITEM OTHERNAME_it = {
85 .itype = ASN1_ITYPE_SEQUENCE,
86 .utype = V_ASN1_SEQUENCE,
87 .templates = OTHERNAME_seq_tt,
88 .tcount = sizeof(OTHERNAME_seq_tt) / sizeof(ASN1_TEMPLATE),
89 .funcs = NULL,
90 .size = sizeof(OTHERNAME),
91 .sname = "OTHERNAME",
92};
93
94
95OTHERNAME *
96d2i_OTHERNAME(OTHERNAME **a, const unsigned char **in, long len)
97{
98 return (OTHERNAME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
99 &OTHERNAME_it);
100}
101
102int
103i2d_OTHERNAME(OTHERNAME *a, unsigned char **out)
104{
105 return ASN1_item_i2d((ASN1_VALUE *)a, out, &OTHERNAME_it);
106}
107
108OTHERNAME *
109OTHERNAME_new(void)
110{
111 return (OTHERNAME *)ASN1_item_new(&OTHERNAME_it);
112}
113
114void
115OTHERNAME_free(OTHERNAME *a)
116{
117 ASN1_item_free((ASN1_VALUE *)a, &OTHERNAME_it);
118}
119
120static const ASN1_TEMPLATE EDIPARTYNAME_seq_tt[] = {
121 {
122 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
123 .tag = 0,
124 .offset = offsetof(EDIPARTYNAME, nameAssigner),
125 .field_name = "nameAssigner",
126 .item = &DIRECTORYSTRING_it,
127 },
128 {
129 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
130 .tag = 1,
131 .offset = offsetof(EDIPARTYNAME, partyName),
132 .field_name = "partyName",
133 .item = &DIRECTORYSTRING_it,
134 },
135};
136
137const ASN1_ITEM EDIPARTYNAME_it = {
138 .itype = ASN1_ITYPE_SEQUENCE,
139 .utype = V_ASN1_SEQUENCE,
140 .templates = EDIPARTYNAME_seq_tt,
141 .tcount = sizeof(EDIPARTYNAME_seq_tt) / sizeof(ASN1_TEMPLATE),
142 .funcs = NULL,
143 .size = sizeof(EDIPARTYNAME),
144 .sname = "EDIPARTYNAME",
145};
146
147
148EDIPARTYNAME *
149d2i_EDIPARTYNAME(EDIPARTYNAME **a, const unsigned char **in, long len)
150{
151 return (EDIPARTYNAME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
152 &EDIPARTYNAME_it);
153}
154
155int
156i2d_EDIPARTYNAME(EDIPARTYNAME *a, unsigned char **out)
157{
158 return ASN1_item_i2d((ASN1_VALUE *)a, out, &EDIPARTYNAME_it);
159}
160
161EDIPARTYNAME *
162EDIPARTYNAME_new(void)
163{
164 return (EDIPARTYNAME *)ASN1_item_new(&EDIPARTYNAME_it);
165}
166
167void
168EDIPARTYNAME_free(EDIPARTYNAME *a)
169{
170 ASN1_item_free((ASN1_VALUE *)a, &EDIPARTYNAME_it);
171}
172
173static const ASN1_TEMPLATE GENERAL_NAME_ch_tt[] = {
174 {
175 .flags = ASN1_TFLG_IMPLICIT,
176 .tag = GEN_OTHERNAME,
177 .offset = offsetof(GENERAL_NAME, d.otherName),
178 .field_name = "d.otherName",
179 .item = &OTHERNAME_it,
180 },
181 {
182 .flags = ASN1_TFLG_IMPLICIT,
183 .tag = GEN_EMAIL,
184 .offset = offsetof(GENERAL_NAME, d.rfc822Name),
185 .field_name = "d.rfc822Name",
186 .item = &ASN1_IA5STRING_it,
187 },
188 {
189 .flags = ASN1_TFLG_IMPLICIT,
190 .tag = GEN_DNS,
191 .offset = offsetof(GENERAL_NAME, d.dNSName),
192 .field_name = "d.dNSName",
193 .item = &ASN1_IA5STRING_it,
194 },
195 /* Don't decode this */
196 {
197 .flags = ASN1_TFLG_IMPLICIT,
198 .tag = GEN_X400,
199 .offset = offsetof(GENERAL_NAME, d.x400Address),
200 .field_name = "d.x400Address",
201 .item = &ASN1_SEQUENCE_it,
202 },
203 /* X509_NAME is a CHOICE type so use EXPLICIT */
204 {
205 .flags = ASN1_TFLG_EXPLICIT,
206 .tag = GEN_DIRNAME,
207 .offset = offsetof(GENERAL_NAME, d.directoryName),
208 .field_name = "d.directoryName",
209 .item = &X509_NAME_it,
210 },
211 {
212 .flags = ASN1_TFLG_IMPLICIT,
213 .tag = GEN_EDIPARTY,
214 .offset = offsetof(GENERAL_NAME, d.ediPartyName),
215 .field_name = "d.ediPartyName",
216 .item = &EDIPARTYNAME_it,
217 },
218 {
219 .flags = ASN1_TFLG_IMPLICIT,
220 .tag = GEN_URI,
221 .offset = offsetof(GENERAL_NAME, d.uniformResourceIdentifier),
222 .field_name = "d.uniformResourceIdentifier",
223 .item = &ASN1_IA5STRING_it,
224 },
225 {
226 .flags = ASN1_TFLG_IMPLICIT,
227 .tag = GEN_IPADD,
228 .offset = offsetof(GENERAL_NAME, d.iPAddress),
229 .field_name = "d.iPAddress",
230 .item = &ASN1_OCTET_STRING_it,
231 },
232 {
233 .flags = ASN1_TFLG_IMPLICIT,
234 .tag = GEN_RID,
235 .offset = offsetof(GENERAL_NAME, d.registeredID),
236 .field_name = "d.registeredID",
237 .item = &ASN1_OBJECT_it,
238 },
239};
240
241const ASN1_ITEM GENERAL_NAME_it = {
242 .itype = ASN1_ITYPE_CHOICE,
243 .utype = offsetof(GENERAL_NAME, type),
244 .templates = GENERAL_NAME_ch_tt,
245 .tcount = sizeof(GENERAL_NAME_ch_tt) / sizeof(ASN1_TEMPLATE),
246 .funcs = NULL,
247 .size = sizeof(GENERAL_NAME),
248 .sname = "GENERAL_NAME",
249};
250
251
252GENERAL_NAME *
253d2i_GENERAL_NAME(GENERAL_NAME **a, const unsigned char **in, long len)
254{
255 return (GENERAL_NAME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
256 &GENERAL_NAME_it);
257}
258
259int
260i2d_GENERAL_NAME(GENERAL_NAME *a, unsigned char **out)
261{
262 return ASN1_item_i2d((ASN1_VALUE *)a, out, &GENERAL_NAME_it);
263}
264
265GENERAL_NAME *
266GENERAL_NAME_new(void)
267{
268 return (GENERAL_NAME *)ASN1_item_new(&GENERAL_NAME_it);
269}
270
271void
272GENERAL_NAME_free(GENERAL_NAME *a)
273{
274 ASN1_item_free((ASN1_VALUE *)a, &GENERAL_NAME_it);
275}
276
277static const ASN1_TEMPLATE GENERAL_NAMES_item_tt = {
278 .flags = ASN1_TFLG_SEQUENCE_OF,
279 .tag = 0,
280 .offset = 0,
281 .field_name = "GeneralNames",
282 .item = &GENERAL_NAME_it,
283};
284
285const ASN1_ITEM GENERAL_NAMES_it = {
286 .itype = ASN1_ITYPE_PRIMITIVE,
287 .utype = -1,
288 .templates = &GENERAL_NAMES_item_tt,
289 .tcount = 0,
290 .funcs = NULL,
291 .size = 0,
292 .sname = "GENERAL_NAMES",
293};
294
295
296GENERAL_NAMES *
297d2i_GENERAL_NAMES(GENERAL_NAMES **a, const unsigned char **in, long len)
298{
299 return (GENERAL_NAMES *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
300 &GENERAL_NAMES_it);
301}
302
303int
304i2d_GENERAL_NAMES(GENERAL_NAMES *a, unsigned char **out)
305{
306 return ASN1_item_i2d((ASN1_VALUE *)a, out, &GENERAL_NAMES_it);
307}
308
309GENERAL_NAMES *
310GENERAL_NAMES_new(void)
311{
312 return (GENERAL_NAMES *)ASN1_item_new(&GENERAL_NAMES_it);
313}
314
315void
316GENERAL_NAMES_free(GENERAL_NAMES *a)
317{
318 ASN1_item_free((ASN1_VALUE *)a, &GENERAL_NAMES_it);
319}
320
321GENERAL_NAME *
322GENERAL_NAME_dup(GENERAL_NAME *a)
323{
324 return ASN1_item_dup(&GENERAL_NAME_it, a);
325}
326
327/* Returns 0 if they are equal, != 0 otherwise. */
328int
329GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b)
330{
331 int result = -1;
332
333 if (!a || !b || a->type != b->type)
334 return -1;
335 switch (a->type) {
336 case GEN_X400:
337 case GEN_EDIPARTY:
338 result = ASN1_TYPE_cmp(a->d.other, b->d.other);
339 break;
340
341 case GEN_OTHERNAME:
342 result = OTHERNAME_cmp(a->d.otherName, b->d.otherName);
343 break;
344
345 case GEN_EMAIL:
346 case GEN_DNS:
347 case GEN_URI:
348 result = ASN1_STRING_cmp(a->d.ia5, b->d.ia5);
349 break;
350
351 case GEN_DIRNAME:
352 result = X509_NAME_cmp(a->d.dirn, b->d.dirn);
353 break;
354
355 case GEN_IPADD:
356 result = ASN1_OCTET_STRING_cmp(a->d.ip, b->d.ip);
357 break;
358
359 case GEN_RID:
360 result = OBJ_cmp(a->d.rid, b->d.rid);
361 break;
362 }
363 return result;
364}
365
366/* Returns 0 if they are equal, != 0 otherwise. */
367int
368OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b)
369{
370 int result = -1;
371
372 if (!a || !b)
373 return -1;
374 /* Check their type first. */
375 if ((result = OBJ_cmp(a->type_id, b->type_id)) != 0)
376 return result;
377 /* Check the value. */
378 result = ASN1_TYPE_cmp(a->value, b->value);
379 return result;
380}
381
382void
383GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value)
384{
385 switch (type) {
386 case GEN_X400:
387 case GEN_EDIPARTY:
388 a->d.other = value;
389 break;
390
391 case GEN_OTHERNAME:
392 a->d.otherName = value;
393 break;
394
395 case GEN_EMAIL:
396 case GEN_DNS:
397 case GEN_URI:
398 a->d.ia5 = value;
399 break;
400
401 case GEN_DIRNAME:
402 a->d.dirn = value;
403 break;
404
405 case GEN_IPADD:
406 a->d.ip = value;
407 break;
408
409 case GEN_RID:
410 a->d.rid = value;
411 break;
412 }
413 a->type = type;
414}
415
416void *
417GENERAL_NAME_get0_value(GENERAL_NAME *a, int *ptype)
418{
419 if (ptype)
420 *ptype = a->type;
421 switch (a->type) {
422 case GEN_X400:
423 case GEN_EDIPARTY:
424 return a->d.other;
425
426 case GEN_OTHERNAME:
427 return a->d.otherName;
428
429 case GEN_EMAIL:
430 case GEN_DNS:
431 case GEN_URI:
432 return a->d.ia5;
433
434 case GEN_DIRNAME:
435 return a->d.dirn;
436
437 case GEN_IPADD:
438 return a->d.ip;
439
440 case GEN_RID:
441 return a->d.rid;
442
443 default:
444 return NULL;
445 }
446}
447
448int
449GENERAL_NAME_set0_othername(GENERAL_NAME *gen, ASN1_OBJECT *oid,
450 ASN1_TYPE *value)
451{
452 OTHERNAME *oth;
453
454 oth = OTHERNAME_new();
455 if (!oth)
456 return 0;
457 oth->type_id = oid;
458 oth->value = value;
459 GENERAL_NAME_set0_value(gen, GEN_OTHERNAME, oth);
460 return 1;
461}
462
463int
464GENERAL_NAME_get0_otherName(GENERAL_NAME *gen, ASN1_OBJECT **poid,
465 ASN1_TYPE **pvalue)
466{
467 if (gen->type != GEN_OTHERNAME)
468 return 0;
469 if (poid)
470 *poid = gen->d.otherName->type_id;
471 if (pvalue)
472 *pvalue = gen->d.otherName->value;
473 return 1;
474}
diff --git a/src/lib/libcrypto/x509v3/v3_ia5.c b/src/lib/libcrypto/x509v3/v3_ia5.c
deleted file mode 100644
index 20e44ec2b1..0000000000
--- a/src/lib/libcrypto/x509v3/v3_ia5.c
+++ /dev/null
@@ -1,239 +0,0 @@
1/* $OpenBSD: v3_ia5.c,v 1.15 2015/09/30 18:21:50 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/conf.h>
64#include <openssl/err.h>
65#include <openssl/x509v3.h>
66
67static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5);
68static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, char *str);
70
71const X509V3_EXT_METHOD v3_ns_ia5_list[] = {
72 {
73 .ext_nid = NID_netscape_base_url,
74 .ext_flags = 0,
75 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
76 .ext_new = NULL,
77 .ext_free = NULL,
78 .d2i = NULL,
79 .i2d = NULL,
80 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
81 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
82 .i2v = NULL,
83 .v2i = NULL,
84 .i2r = NULL,
85 .r2i = NULL,
86 .usr_data = NULL,
87 },
88 {
89 .ext_nid = NID_netscape_revocation_url,
90 .ext_flags = 0,
91 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
92 .ext_new = NULL,
93 .ext_free = NULL,
94 .d2i = NULL,
95 .i2d = NULL,
96 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
97 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
98 .i2v = NULL,
99 .v2i = NULL,
100 .i2r = NULL,
101 .r2i = NULL,
102 .usr_data = NULL,
103 },
104 {
105 .ext_nid = NID_netscape_ca_revocation_url,
106 .ext_flags = 0,
107 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
108 .ext_new = NULL,
109 .ext_free = NULL,
110 .d2i = NULL,
111 .i2d = NULL,
112 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
113 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
114 .i2v = NULL,
115 .v2i = NULL,
116 .i2r = NULL,
117 .r2i = NULL,
118 .usr_data = NULL,
119 },
120 {
121 .ext_nid = NID_netscape_renewal_url,
122 .ext_flags = 0,
123 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
124 .ext_new = NULL,
125 .ext_free = NULL,
126 .d2i = NULL,
127 .i2d = NULL,
128 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
129 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
130 .i2v = NULL,
131 .v2i = NULL,
132 .i2r = NULL,
133 .r2i = NULL,
134 .usr_data = NULL,
135 },
136 {
137 .ext_nid = NID_netscape_ca_policy_url,
138 .ext_flags = 0,
139 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
140 .ext_new = NULL,
141 .ext_free = NULL,
142 .d2i = NULL,
143 .i2d = NULL,
144 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
145 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
146 .i2v = NULL,
147 .v2i = NULL,
148 .i2r = NULL,
149 .r2i = NULL,
150 .usr_data = NULL,
151 },
152 {
153 .ext_nid = NID_netscape_ssl_server_name,
154 .ext_flags = 0,
155 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
156 .ext_new = NULL,
157 .ext_free = NULL,
158 .d2i = NULL,
159 .i2d = NULL,
160 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
161 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
162 .i2v = NULL,
163 .v2i = NULL,
164 .i2r = NULL,
165 .r2i = NULL,
166 .usr_data = NULL,
167 },
168 {
169 .ext_nid = NID_netscape_comment,
170 .ext_flags = 0,
171 .it = ASN1_ITEM_ref(ASN1_IA5STRING),
172 .ext_new = NULL,
173 .ext_free = NULL,
174 .d2i = NULL,
175 .i2d = NULL,
176 .i2s = (X509V3_EXT_I2S)i2s_ASN1_IA5STRING,
177 .s2i = (X509V3_EXT_S2I)s2i_ASN1_IA5STRING,
178 .i2v = NULL,
179 .v2i = NULL,
180 .i2r = NULL,
181 .r2i = NULL,
182 .usr_data = NULL,
183 },
184 {
185 .ext_nid = -1,
186 .ext_flags = 0,
187 .it = NULL,
188 .ext_new = NULL,
189 .ext_free = NULL,
190 .d2i = NULL,
191 .i2d = NULL,
192 .i2s = NULL,
193 .s2i = NULL,
194 .i2v = NULL,
195 .v2i = NULL,
196 .i2r = NULL,
197 .r2i = NULL,
198 .usr_data = NULL,
199 },
200};
201
202static char *
203i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5)
204{
205 char *tmp;
206
207 if (!ia5 || !ia5->length)
208 return NULL;
209 if (!(tmp = malloc(ia5->length + 1))) {
210 X509V3err(X509V3_F_I2S_ASN1_IA5STRING, ERR_R_MALLOC_FAILURE);
211 return NULL;
212 }
213 memcpy(tmp, ia5->data, ia5->length);
214 tmp[ia5->length] = 0;
215 return tmp;
216}
217
218static ASN1_IA5STRING *
219s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str)
220{
221 ASN1_IA5STRING *ia5;
222 if (!str) {
223 X509V3err(X509V3_F_S2I_ASN1_IA5STRING,
224 X509V3_R_INVALID_NULL_ARGUMENT);
225 return NULL;
226 }
227 if (!(ia5 = ASN1_IA5STRING_new()))
228 goto err;
229 if (!ASN1_STRING_set((ASN1_STRING *)ia5, (unsigned char*)str,
230 strlen(str))) {
231 ASN1_IA5STRING_free(ia5);
232 goto err;
233 }
234 return ia5;
235
236err:
237 X509V3err(X509V3_F_S2I_ASN1_IA5STRING, ERR_R_MALLOC_FAILURE);
238 return NULL;
239}
diff --git a/src/lib/libcrypto/x509v3/v3_info.c b/src/lib/libcrypto/x509v3/v3_info.c
deleted file mode 100644
index 3b96222187..0000000000
--- a/src/lib/libcrypto/x509v3/v3_info.c
+++ /dev/null
@@ -1,307 +0,0 @@
1/* $OpenBSD: v3_info.c,v 1.23 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(
69 X509V3_EXT_METHOD *method, AUTHORITY_INFO_ACCESS *ainfo,
70 STACK_OF(CONF_VALUE) *ret);
71static AUTHORITY_INFO_ACCESS *v2i_AUTHORITY_INFO_ACCESS(
72 X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
73
74const X509V3_EXT_METHOD v3_info = {
75 .ext_nid = NID_info_access,
76 .ext_flags = X509V3_EXT_MULTILINE,
77 .it = ASN1_ITEM_ref(AUTHORITY_INFO_ACCESS),
78 .ext_new = NULL,
79 .ext_free = NULL,
80 .d2i = NULL,
81 .i2d = NULL,
82 .i2s = NULL,
83 .s2i = NULL,
84 .i2v = (X509V3_EXT_I2V)i2v_AUTHORITY_INFO_ACCESS,
85 .v2i = (X509V3_EXT_V2I)v2i_AUTHORITY_INFO_ACCESS,
86 .i2r = NULL,
87 .r2i = NULL,
88 .usr_data = NULL,
89};
90
91const X509V3_EXT_METHOD v3_sinfo = {
92 .ext_nid = NID_sinfo_access,
93 .ext_flags = X509V3_EXT_MULTILINE,
94 .it = ASN1_ITEM_ref(AUTHORITY_INFO_ACCESS),
95 .ext_new = NULL,
96 .ext_free = NULL,
97 .d2i = NULL,
98 .i2d = NULL,
99 .i2s = NULL,
100 .s2i = NULL,
101 .i2v = (X509V3_EXT_I2V)i2v_AUTHORITY_INFO_ACCESS,
102 .v2i = (X509V3_EXT_V2I)v2i_AUTHORITY_INFO_ACCESS,
103 .i2r = NULL,
104 .r2i = NULL,
105 .usr_data = NULL,
106};
107
108static const ASN1_TEMPLATE ACCESS_DESCRIPTION_seq_tt[] = {
109 {
110 .flags = 0,
111 .tag = 0,
112 .offset = offsetof(ACCESS_DESCRIPTION, method),
113 .field_name = "method",
114 .item = &ASN1_OBJECT_it,
115 },
116 {
117 .flags = 0,
118 .tag = 0,
119 .offset = offsetof(ACCESS_DESCRIPTION, location),
120 .field_name = "location",
121 .item = &GENERAL_NAME_it,
122 },
123};
124
125const ASN1_ITEM ACCESS_DESCRIPTION_it = {
126 .itype = ASN1_ITYPE_SEQUENCE,
127 .utype = V_ASN1_SEQUENCE,
128 .templates = ACCESS_DESCRIPTION_seq_tt,
129 .tcount = sizeof(ACCESS_DESCRIPTION_seq_tt) / sizeof(ASN1_TEMPLATE),
130 .funcs = NULL,
131 .size = sizeof(ACCESS_DESCRIPTION),
132 .sname = "ACCESS_DESCRIPTION",
133};
134
135
136ACCESS_DESCRIPTION *
137d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, const unsigned char **in, long len)
138{
139 return (ACCESS_DESCRIPTION *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
140 &ACCESS_DESCRIPTION_it);
141}
142
143int
144i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **out)
145{
146 return ASN1_item_i2d((ASN1_VALUE *)a, out, &ACCESS_DESCRIPTION_it);
147}
148
149ACCESS_DESCRIPTION *
150ACCESS_DESCRIPTION_new(void)
151{
152 return (ACCESS_DESCRIPTION *)ASN1_item_new(&ACCESS_DESCRIPTION_it);
153}
154
155void
156ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a)
157{
158 ASN1_item_free((ASN1_VALUE *)a, &ACCESS_DESCRIPTION_it);
159}
160
161static const ASN1_TEMPLATE AUTHORITY_INFO_ACCESS_item_tt = {
162 .flags = ASN1_TFLG_SEQUENCE_OF,
163 .tag = 0,
164 .offset = 0,
165 .field_name = "GeneralNames",
166 .item = &ACCESS_DESCRIPTION_it,
167};
168
169const ASN1_ITEM AUTHORITY_INFO_ACCESS_it = {
170 .itype = ASN1_ITYPE_PRIMITIVE,
171 .utype = -1,
172 .templates = &AUTHORITY_INFO_ACCESS_item_tt,
173 .tcount = 0,
174 .funcs = NULL,
175 .size = 0,
176 .sname = "AUTHORITY_INFO_ACCESS",
177};
178
179
180AUTHORITY_INFO_ACCESS *
181d2i_AUTHORITY_INFO_ACCESS(AUTHORITY_INFO_ACCESS **a, const unsigned char **in, long len)
182{
183 return (AUTHORITY_INFO_ACCESS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
184 &AUTHORITY_INFO_ACCESS_it);
185}
186
187int
188i2d_AUTHORITY_INFO_ACCESS(AUTHORITY_INFO_ACCESS *a, unsigned char **out)
189{
190 return ASN1_item_i2d((ASN1_VALUE *)a, out, &AUTHORITY_INFO_ACCESS_it);
191}
192
193AUTHORITY_INFO_ACCESS *
194AUTHORITY_INFO_ACCESS_new(void)
195{
196 return (AUTHORITY_INFO_ACCESS *)ASN1_item_new(&AUTHORITY_INFO_ACCESS_it);
197}
198
199void
200AUTHORITY_INFO_ACCESS_free(AUTHORITY_INFO_ACCESS *a)
201{
202 ASN1_item_free((ASN1_VALUE *)a, &AUTHORITY_INFO_ACCESS_it);
203}
204
205static STACK_OF(CONF_VALUE) *
206i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
207 AUTHORITY_INFO_ACCESS *ainfo, STACK_OF(CONF_VALUE) *ret)
208{
209 ACCESS_DESCRIPTION *desc;
210 int i, nlen;
211 char objtmp[80], *ntmp;
212 CONF_VALUE *vtmp;
213
214 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(ainfo); i++) {
215 desc = sk_ACCESS_DESCRIPTION_value(ainfo, i);
216 ret = i2v_GENERAL_NAME(method, desc->location, ret);
217 if (!ret)
218 break;
219 vtmp = sk_CONF_VALUE_value(ret, i);
220 i2t_ASN1_OBJECT(objtmp, sizeof objtmp, desc->method);
221 nlen = strlen(objtmp) + strlen(vtmp->name) + 5;
222 ntmp = malloc(nlen);
223 if (!ntmp) {
224 X509V3err(X509V3_F_I2V_AUTHORITY_INFO_ACCESS,
225 ERR_R_MALLOC_FAILURE);
226 return NULL;
227 }
228 strlcpy(ntmp, objtmp, nlen);
229 strlcat(ntmp, " - ", nlen);
230 strlcat(ntmp, vtmp->name, nlen);
231 free(vtmp->name);
232 vtmp->name = ntmp;
233
234 }
235 if (!ret)
236 return sk_CONF_VALUE_new_null();
237 return ret;
238}
239
240static AUTHORITY_INFO_ACCESS *
241v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
242 STACK_OF(CONF_VALUE) *nval)
243{
244 AUTHORITY_INFO_ACCESS *ainfo = NULL;
245 CONF_VALUE *cnf, ctmp;
246 ACCESS_DESCRIPTION *acc;
247 int i, objlen;
248 char *objtmp, *ptmp;
249
250 if (!(ainfo = sk_ACCESS_DESCRIPTION_new_null())) {
251 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
252 ERR_R_MALLOC_FAILURE);
253 return NULL;
254 }
255 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
256 cnf = sk_CONF_VALUE_value(nval, i);
257 if ((acc = ACCESS_DESCRIPTION_new()) == NULL) {
258 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
259 ERR_R_MALLOC_FAILURE);
260 goto err;
261 }
262 if (sk_ACCESS_DESCRIPTION_push(ainfo, acc) == 0) {
263 ACCESS_DESCRIPTION_free(acc);
264 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
265 ERR_R_MALLOC_FAILURE);
266 goto err;
267 }
268 ptmp = strchr(cnf->name, ';');
269 if (!ptmp) {
270 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
271 X509V3_R_INVALID_SYNTAX);
272 goto err;
273 }
274 objlen = ptmp - cnf->name;
275 ctmp.name = ptmp + 1;
276 ctmp.value = cnf->value;
277 if (!v2i_GENERAL_NAME_ex(acc->location, method, ctx, &ctmp, 0))
278 goto err;
279 if (!(objtmp = malloc(objlen + 1))) {
280 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
281 ERR_R_MALLOC_FAILURE);
282 goto err;
283 }
284 strlcpy(objtmp, cnf->name, objlen + 1);
285 acc->method = OBJ_txt2obj(objtmp, 0);
286 if (!acc->method) {
287 X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
288 X509V3_R_BAD_OBJECT);
289 ERR_asprintf_error_data("value=%s", objtmp);
290 free(objtmp);
291 goto err;
292 }
293 free(objtmp);
294 }
295 return ainfo;
296
297err:
298 sk_ACCESS_DESCRIPTION_pop_free(ainfo, ACCESS_DESCRIPTION_free);
299 return NULL;
300}
301
302int
303i2a_ACCESS_DESCRIPTION(BIO *bp, ACCESS_DESCRIPTION* a)
304{
305 i2a_ASN1_OBJECT(bp, a->method);
306 return 2;
307}
diff --git a/src/lib/libcrypto/x509v3/v3_int.c b/src/lib/libcrypto/x509v3/v3_int.c
deleted file mode 100644
index bd059b7269..0000000000
--- a/src/lib/libcrypto/x509v3/v3_int.c
+++ /dev/null
@@ -1,110 +0,0 @@
1/* $OpenBSD: v3_int.c,v 1.10 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/x509v3.h>
62
63const X509V3_EXT_METHOD v3_crl_num = {
64 .ext_nid = NID_crl_number,
65 .ext_flags = 0,
66 .it = ASN1_ITEM_ref(ASN1_INTEGER),
67 .ext_new = NULL,
68 .ext_free = NULL,
69 .d2i = NULL,
70 .i2d = NULL,
71 .i2s = (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
72 .s2i = NULL,
73 .i2v = NULL,
74 .v2i = NULL,
75 .i2r = NULL,
76 .r2i = NULL,
77 .usr_data = NULL,
78};
79
80const X509V3_EXT_METHOD v3_delta_crl = {
81 .ext_nid = NID_delta_crl,
82 .ext_flags = 0,
83 .it = ASN1_ITEM_ref(ASN1_INTEGER),
84 .ext_new = NULL,
85 .ext_free = NULL,
86 .d2i = NULL,
87 .i2d = NULL,
88 .i2s = (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
89 .s2i = NULL,
90 .i2v = NULL,
91 .v2i = NULL,
92 .i2r = NULL,
93 .r2i = NULL,
94 .usr_data = NULL,
95};
96
97static void *
98s2i_asn1_int(X509V3_EXT_METHOD *meth, X509V3_CTX *ctx, char *value)
99{
100 return s2i_ASN1_INTEGER(meth, value);
101}
102
103const X509V3_EXT_METHOD v3_inhibit_anyp = {
104 NID_inhibit_any_policy, 0, ASN1_ITEM_ref(ASN1_INTEGER),
105 0, 0, 0, 0,
106 (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
107 (X509V3_EXT_S2I)s2i_asn1_int,
108 0, 0, 0, 0,
109 NULL
110};
diff --git a/src/lib/libcrypto/x509v3/v3_lib.c b/src/lib/libcrypto/x509v3/v3_lib.c
deleted file mode 100644
index 7731c7c544..0000000000
--- a/src/lib/libcrypto/x509v3/v3_lib.c
+++ /dev/null
@@ -1,345 +0,0 @@
1/* $OpenBSD: v3_lib.c,v 1.14 2015/02/10 11:22:22 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58/* X509 v3 extension utilities */
59
60#include <stdio.h>
61
62#include <openssl/conf.h>
63#include <openssl/err.h>
64#include <openssl/x509v3.h>
65
66#include "ext_dat.h"
67
68static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
69
70static int ext_cmp(const X509V3_EXT_METHOD * const *a,
71 const X509V3_EXT_METHOD * const *b);
72static void ext_list_free(X509V3_EXT_METHOD *ext);
73
74int
75X509V3_EXT_add(X509V3_EXT_METHOD *ext)
76{
77 if (!ext_list && !(ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp))) {
78 X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
79 return 0;
80 }
81 if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
82 X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
83 return 0;
84 }
85 return 1;
86}
87
88static int
89ext_cmp(const X509V3_EXT_METHOD * const *a, const X509V3_EXT_METHOD * const *b)
90{
91 return ((*a)->ext_nid - (*b)->ext_nid);
92}
93
94DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
95 const X509V3_EXT_METHOD *, ext);
96IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
97 const X509V3_EXT_METHOD *, ext);
98
99const X509V3_EXT_METHOD *
100X509V3_EXT_get_nid(int nid)
101{
102 X509V3_EXT_METHOD tmp;
103 const X509V3_EXT_METHOD *t = &tmp, * const *ret;
104 int idx;
105
106 if (nid < 0)
107 return NULL;
108 tmp.ext_nid = nid;
109 ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
110 if (ret)
111 return *ret;
112 if (!ext_list)
113 return NULL;
114 idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
115 if (idx == -1)
116 return NULL;
117 return sk_X509V3_EXT_METHOD_value(ext_list, idx);
118}
119
120const X509V3_EXT_METHOD *
121X509V3_EXT_get(X509_EXTENSION *ext)
122{
123 int nid;
124
125 if ((nid = OBJ_obj2nid(ext->object)) == NID_undef)
126 return NULL;
127 return X509V3_EXT_get_nid(nid);
128}
129
130int
131X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
132{
133 for (; extlist->ext_nid!=-1; extlist++)
134 if (!X509V3_EXT_add(extlist))
135 return 0;
136 return 1;
137}
138
139int
140X509V3_EXT_add_alias(int nid_to, int nid_from)
141{
142 const X509V3_EXT_METHOD *ext;
143 X509V3_EXT_METHOD *tmpext;
144
145 if (!(ext = X509V3_EXT_get_nid(nid_from))) {
146 X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS,
147 X509V3_R_EXTENSION_NOT_FOUND);
148 return 0;
149 }
150 if (!(tmpext = malloc(sizeof(X509V3_EXT_METHOD)))) {
151 X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS, ERR_R_MALLOC_FAILURE);
152 return 0;
153 }
154 *tmpext = *ext;
155 tmpext->ext_nid = nid_to;
156 tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
157 return X509V3_EXT_add(tmpext);
158}
159
160void
161X509V3_EXT_cleanup(void)
162{
163 sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
164 ext_list = NULL;
165}
166
167static void
168ext_list_free(X509V3_EXT_METHOD *ext)
169{
170 if (ext->ext_flags & X509V3_EXT_DYNAMIC)
171 free(ext);
172}
173
174/* Legacy function: we don't need to add standard extensions
175 * any more because they are now kept in ext_dat.h.
176 */
177
178int
179X509V3_add_standard_extensions(void)
180{
181 return 1;
182}
183
184/* Return an extension internal structure */
185
186void *
187X509V3_EXT_d2i(X509_EXTENSION *ext)
188{
189 const X509V3_EXT_METHOD *method;
190 const unsigned char *p;
191
192 if (!(method = X509V3_EXT_get(ext)))
193 return NULL;
194 p = ext->value->data;
195 if (method->it)
196 return ASN1_item_d2i(NULL, &p, ext->value->length,
197 ASN1_ITEM_ptr(method->it));
198 return method->d2i(NULL, &p, ext->value->length);
199}
200
201/* Get critical flag and decoded version of extension from a NID.
202 * The "idx" variable returns the last found extension and can
203 * be used to retrieve multiple extensions of the same NID.
204 * However multiple extensions with the same NID is usually
205 * due to a badly encoded certificate so if idx is NULL we
206 * choke if multiple extensions exist.
207 * The "crit" variable is set to the critical value.
208 * The return value is the decoded extension or NULL on
209 * error. The actual error can have several different causes,
210 * the value of *crit reflects the cause:
211 * >= 0, extension found but not decoded (reflects critical value).
212 * -1 extension not found.
213 * -2 extension occurs more than once.
214 */
215
216void *
217X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx)
218{
219 int lastpos, i;
220 X509_EXTENSION *ex, *found_ex = NULL;
221
222 if (!x) {
223 if (idx)
224 *idx = -1;
225 if (crit)
226 *crit = -1;
227 return NULL;
228 }
229 if (idx)
230 lastpos = *idx + 1;
231 else
232 lastpos = 0;
233 if (lastpos < 0)
234 lastpos = 0;
235 for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
236 ex = sk_X509_EXTENSION_value(x, i);
237 if (OBJ_obj2nid(ex->object) == nid) {
238 if (idx) {
239 *idx = i;
240 found_ex = ex;
241 break;
242 } else if (found_ex) {
243 /* Found more than one */
244 if (crit)
245 *crit = -2;
246 return NULL;
247 }
248 found_ex = ex;
249 }
250 }
251 if (found_ex) {
252 /* Found it */
253 if (crit)
254 *crit = X509_EXTENSION_get_critical(found_ex);
255 return X509V3_EXT_d2i(found_ex);
256 }
257
258 /* Extension not found */
259 if (idx)
260 *idx = -1;
261 if (crit)
262 *crit = -1;
263 return NULL;
264}
265
266/* This function is a general extension append, replace and delete utility.
267 * The precise operation is governed by the 'flags' value. The 'crit' and
268 * 'value' arguments (if relevant) are the extensions internal structure.
269 */
270
271int
272X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
273 int crit, unsigned long flags)
274{
275 int extidx = -1;
276 int errcode;
277 X509_EXTENSION *ext, *extmp;
278 unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
279
280 /* If appending we don't care if it exists, otherwise
281 * look for existing extension.
282 */
283 if (ext_op != X509V3_ADD_APPEND)
284 extidx = X509v3_get_ext_by_NID(*x, nid, -1);
285
286 /* See if extension exists */
287 if (extidx >= 0) {
288 /* If keep existing, nothing to do */
289 if (ext_op == X509V3_ADD_KEEP_EXISTING)
290 return 1;
291 /* If default then its an error */
292 if (ext_op == X509V3_ADD_DEFAULT) {
293 errcode = X509V3_R_EXTENSION_EXISTS;
294 goto err;
295 }
296 /* If delete, just delete it */
297 if (ext_op == X509V3_ADD_DELETE) {
298 if (!sk_X509_EXTENSION_delete(*x, extidx))
299 return -1;
300 return 1;
301 }
302 } else {
303 /* If replace existing or delete, error since
304 * extension must exist
305 */
306 if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
307 (ext_op == X509V3_ADD_DELETE)) {
308 errcode = X509V3_R_EXTENSION_NOT_FOUND;
309 goto err;
310 }
311 }
312
313 /* If we get this far then we have to create an extension:
314 * could have some flags for alternative encoding schemes...
315 */
316
317 ext = X509V3_EXT_i2d(nid, crit, value);
318
319 if (!ext) {
320 X509V3err(X509V3_F_X509V3_ADD1_I2D,
321 X509V3_R_ERROR_CREATING_EXTENSION);
322 return 0;
323 }
324
325 /* If extension exists replace it.. */
326 if (extidx >= 0) {
327 extmp = sk_X509_EXTENSION_value(*x, extidx);
328 X509_EXTENSION_free(extmp);
329 if (!sk_X509_EXTENSION_set(*x, extidx, ext))
330 return -1;
331 return 1;
332 }
333
334 if (!*x && !(*x = sk_X509_EXTENSION_new_null()))
335 return -1;
336 if (!sk_X509_EXTENSION_push(*x, ext))
337 return -1;
338
339 return 1;
340
341err:
342 if (!(flags & X509V3_ADD_SILENT))
343 X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode);
344 return 0;
345}
diff --git a/src/lib/libcrypto/x509v3/v3_ncons.c b/src/lib/libcrypto/x509v3/v3_ncons.c
deleted file mode 100644
index 2af15726a8..0000000000
--- a/src/lib/libcrypto/x509v3/v3_ncons.c
+++ /dev/null
@@ -1,560 +0,0 @@
1/* $OpenBSD: v3_ncons.c,v 1.9 2015/07/29 16:13:48 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1t.h>
63#include <openssl/conf.h>
64#include <openssl/err.h>
65#include <openssl/x509v3.h>
66
67static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
68 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
69static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
70 void *a, BIO *bp, int ind);
71static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
72 STACK_OF(GENERAL_SUBTREE) *trees, BIO *bp, int ind, char *name);
73static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip);
74
75static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc);
76static int nc_match_single(GENERAL_NAME *sub, GENERAL_NAME *gen);
77static int nc_dn(X509_NAME *sub, X509_NAME *nm);
78static int nc_dns(ASN1_IA5STRING *sub, ASN1_IA5STRING *dns);
79static int nc_email(ASN1_IA5STRING *sub, ASN1_IA5STRING *eml);
80static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base);
81
82const X509V3_EXT_METHOD v3_name_constraints = {
83 .ext_nid = NID_name_constraints,
84 .ext_flags = 0,
85 .it = ASN1_ITEM_ref(NAME_CONSTRAINTS),
86 .ext_new = NULL,
87 .ext_free = NULL,
88 .d2i = NULL,
89 .i2d = NULL,
90 .i2s = NULL,
91 .s2i = NULL,
92 .i2v = NULL,
93 .v2i = v2i_NAME_CONSTRAINTS,
94 .i2r = i2r_NAME_CONSTRAINTS,
95 .r2i = NULL,
96 .usr_data = NULL,
97};
98
99static const ASN1_TEMPLATE GENERAL_SUBTREE_seq_tt[] = {
100 {
101 .flags = 0,
102 .tag = 0,
103 .offset = offsetof(GENERAL_SUBTREE, base),
104 .field_name = "base",
105 .item = &GENERAL_NAME_it,
106 },
107 {
108 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
109 .tag = 0,
110 .offset = offsetof(GENERAL_SUBTREE, minimum),
111 .field_name = "minimum",
112 .item = &ASN1_INTEGER_it,
113 },
114 {
115 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
116 .tag = 1,
117 .offset = offsetof(GENERAL_SUBTREE, maximum),
118 .field_name = "maximum",
119 .item = &ASN1_INTEGER_it,
120 },
121};
122
123const ASN1_ITEM GENERAL_SUBTREE_it = {
124 .itype = ASN1_ITYPE_SEQUENCE,
125 .utype = V_ASN1_SEQUENCE,
126 .templates = GENERAL_SUBTREE_seq_tt,
127 .tcount = sizeof(GENERAL_SUBTREE_seq_tt) / sizeof(ASN1_TEMPLATE),
128 .funcs = NULL,
129 .size = sizeof(GENERAL_SUBTREE),
130 .sname = "GENERAL_SUBTREE",
131};
132
133static const ASN1_TEMPLATE NAME_CONSTRAINTS_seq_tt[] = {
134 {
135 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
136 .tag = 0,
137 .offset = offsetof(NAME_CONSTRAINTS, permittedSubtrees),
138 .field_name = "permittedSubtrees",
139 .item = &GENERAL_SUBTREE_it,
140 },
141 {
142 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
143 .tag = 1,
144 .offset = offsetof(NAME_CONSTRAINTS, excludedSubtrees),
145 .field_name = "excludedSubtrees",
146 .item = &GENERAL_SUBTREE_it,
147 },
148};
149
150const ASN1_ITEM NAME_CONSTRAINTS_it = {
151 .itype = ASN1_ITYPE_SEQUENCE,
152 .utype = V_ASN1_SEQUENCE,
153 .templates = NAME_CONSTRAINTS_seq_tt,
154 .tcount = sizeof(NAME_CONSTRAINTS_seq_tt) / sizeof(ASN1_TEMPLATE),
155 .funcs = NULL,
156 .size = sizeof(NAME_CONSTRAINTS),
157 .sname = "NAME_CONSTRAINTS",
158};
159
160
161GENERAL_SUBTREE *
162GENERAL_SUBTREE_new(void)
163{
164 return (GENERAL_SUBTREE*)ASN1_item_new(&GENERAL_SUBTREE_it);
165}
166
167void
168GENERAL_SUBTREE_free(GENERAL_SUBTREE *a)
169{
170 ASN1_item_free((ASN1_VALUE *)a, &GENERAL_SUBTREE_it);
171}
172
173NAME_CONSTRAINTS *
174NAME_CONSTRAINTS_new(void)
175{
176 return (NAME_CONSTRAINTS*)ASN1_item_new(&NAME_CONSTRAINTS_it);
177}
178
179void
180NAME_CONSTRAINTS_free(NAME_CONSTRAINTS *a)
181{
182 ASN1_item_free((ASN1_VALUE *)a, &NAME_CONSTRAINTS_it);
183}
184
185static void *
186v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
187 STACK_OF(CONF_VALUE) *nval)
188{
189 int i;
190 CONF_VALUE tval, *val;
191 STACK_OF(GENERAL_SUBTREE) **ptree = NULL;
192 NAME_CONSTRAINTS *ncons = NULL;
193 GENERAL_SUBTREE *sub = NULL;
194
195 ncons = NAME_CONSTRAINTS_new();
196 if (!ncons)
197 goto memerr;
198 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
199 val = sk_CONF_VALUE_value(nval, i);
200 if (!strncmp(val->name, "permitted", 9) && val->name[9]) {
201 ptree = &ncons->permittedSubtrees;
202 tval.name = val->name + 10;
203 } else if (!strncmp(val->name, "excluded", 8) && val->name[8]) {
204 ptree = &ncons->excludedSubtrees;
205 tval.name = val->name + 9;
206 } else {
207 X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS,
208 X509V3_R_INVALID_SYNTAX);
209 goto err;
210 }
211 tval.value = val->value;
212 sub = GENERAL_SUBTREE_new();
213 if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1))
214 goto err;
215 if (!*ptree)
216 *ptree = sk_GENERAL_SUBTREE_new_null();
217 if (!*ptree || !sk_GENERAL_SUBTREE_push(*ptree, sub))
218 goto memerr;
219 sub = NULL;
220 }
221
222 return ncons;
223
224memerr:
225 X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
226err:
227 if (ncons)
228 NAME_CONSTRAINTS_free(ncons);
229 if (sub)
230 GENERAL_SUBTREE_free(sub);
231
232 return NULL;
233}
234
235static int
236i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a, BIO *bp, int ind)
237{
238 NAME_CONSTRAINTS *ncons = a;
239
240 do_i2r_name_constraints(method, ncons->permittedSubtrees,
241 bp, ind, "Permitted");
242 do_i2r_name_constraints(method, ncons->excludedSubtrees,
243 bp, ind, "Excluded");
244 return 1;
245}
246
247static int
248do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
249 STACK_OF(GENERAL_SUBTREE) *trees, BIO *bp, int ind, char *name)
250{
251 GENERAL_SUBTREE *tree;
252 int i;
253
254 if (sk_GENERAL_SUBTREE_num(trees) > 0)
255 BIO_printf(bp, "%*s%s:\n", ind, "", name);
256 for (i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) {
257 tree = sk_GENERAL_SUBTREE_value(trees, i);
258 BIO_printf(bp, "%*s", ind + 2, "");
259 if (tree->base->type == GEN_IPADD)
260 print_nc_ipadd(bp, tree->base->d.ip);
261 else
262 GENERAL_NAME_print(bp, tree->base);
263 BIO_puts(bp, "\n");
264 }
265 return 1;
266}
267
268static int
269print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
270{
271 int i, len;
272 unsigned char *p;
273
274 p = ip->data;
275 len = ip->length;
276 BIO_puts(bp, "IP:");
277 if (len == 8) {
278 BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d",
279 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
280 } else if (len == 32) {
281 for (i = 0; i < 16; i++) {
282 BIO_printf(bp, "%X", p[0] << 8 | p[1]);
283 p += 2;
284 if (i == 7)
285 BIO_puts(bp, "/");
286 else if (i != 15)
287 BIO_puts(bp, ":");
288 }
289 } else
290 BIO_printf(bp, "IP Address:<invalid>");
291 return 1;
292}
293
294/* Check a certificate conforms to a specified set of constraints.
295 * Return values:
296 * X509_V_OK: All constraints obeyed.
297 * X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation.
298 * X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation.
299 * X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type.
300 * X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: Unsupported constraint type.
301 * X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax.
302 * X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name
303 */
304
305int
306NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc)
307{
308 int r, i;
309 X509_NAME *nm;
310
311 nm = X509_get_subject_name(x);
312
313 if (X509_NAME_entry_count(nm) > 0) {
314 GENERAL_NAME gntmp;
315 gntmp.type = GEN_DIRNAME;
316 gntmp.d.directoryName = nm;
317
318 r = nc_match(&gntmp, nc);
319
320 if (r != X509_V_OK)
321 return r;
322
323 gntmp.type = GEN_EMAIL;
324
325 /* Process any email address attributes in subject name */
326
327 for (i = -1;;) {
328 X509_NAME_ENTRY *ne;
329 i = X509_NAME_get_index_by_NID(nm,
330 NID_pkcs9_emailAddress, i);
331 if (i == -1)
332 break;
333 ne = X509_NAME_get_entry(nm, i);
334 gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne);
335 if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING)
336 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
337
338 r = nc_match(&gntmp, nc);
339
340 if (r != X509_V_OK)
341 return r;
342 }
343
344 }
345
346 for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++) {
347 GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i);
348 r = nc_match(gen, nc);
349 if (r != X509_V_OK)
350 return r;
351 }
352
353 return X509_V_OK;
354}
355
356static int
357nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc)
358{
359 GENERAL_SUBTREE *sub;
360 int i, r, match = 0;
361
362 /* Permitted subtrees: if any subtrees exist of matching the type
363 * at least one subtree must match.
364 */
365
366 for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) {
367 sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
368 if (gen->type != sub->base->type)
369 continue;
370 if (sub->minimum || sub->maximum)
371 return X509_V_ERR_SUBTREE_MINMAX;
372 /* If we already have a match don't bother trying any more */
373 if (match == 2)
374 continue;
375 if (match == 0)
376 match = 1;
377 r = nc_match_single(gen, sub->base);
378 if (r == X509_V_OK)
379 match = 2;
380 else if (r != X509_V_ERR_PERMITTED_VIOLATION)
381 return r;
382 }
383
384 if (match == 1)
385 return X509_V_ERR_PERMITTED_VIOLATION;
386
387 /* Excluded subtrees: must not match any of these */
388
389 for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++) {
390 sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i);
391 if (gen->type != sub->base->type)
392 continue;
393 if (sub->minimum || sub->maximum)
394 return X509_V_ERR_SUBTREE_MINMAX;
395
396 r = nc_match_single(gen, sub->base);
397 if (r == X509_V_OK)
398 return X509_V_ERR_EXCLUDED_VIOLATION;
399 else if (r != X509_V_ERR_PERMITTED_VIOLATION)
400 return r;
401
402 }
403
404 return X509_V_OK;
405}
406
407static int
408nc_match_single(GENERAL_NAME *gen, GENERAL_NAME *base)
409{
410 switch (base->type) {
411 case GEN_DIRNAME:
412 return nc_dn(gen->d.directoryName, base->d.directoryName);
413
414 case GEN_DNS:
415 return nc_dns(gen->d.dNSName, base->d.dNSName);
416
417 case GEN_EMAIL:
418 return nc_email(gen->d.rfc822Name, base->d.rfc822Name);
419
420 case GEN_URI:
421 return nc_uri(gen->d.uniformResourceIdentifier,
422 base->d.uniformResourceIdentifier);
423
424 default:
425 return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
426 }
427}
428
429/* directoryName name constraint matching.
430 * The canonical encoding of X509_NAME makes this comparison easy. It is
431 * matched if the subtree is a subset of the name.
432 */
433
434static int
435nc_dn(X509_NAME *nm, X509_NAME *base)
436{
437 /* Ensure canonical encodings are up to date. */
438 if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
439 return X509_V_ERR_OUT_OF_MEM;
440 if (base->modified && i2d_X509_NAME(base, NULL) < 0)
441 return X509_V_ERR_OUT_OF_MEM;
442 if (base->canon_enclen > nm->canon_enclen)
443 return X509_V_ERR_PERMITTED_VIOLATION;
444 if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
445 return X509_V_ERR_PERMITTED_VIOLATION;
446 return X509_V_OK;
447}
448
449static int
450nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
451{
452 char *baseptr = (char *)base->data;
453 char *dnsptr = (char *)dns->data;
454
455 /* Empty matches everything */
456 if (!*baseptr)
457 return X509_V_OK;
458 /* Otherwise can add zero or more components on the left so
459 * compare RHS and if dns is longer and expect '.' as preceding
460 * character.
461 */
462 if (dns->length > base->length) {
463 dnsptr += dns->length - base->length;
464 if (dnsptr[-1] != '.')
465 return X509_V_ERR_PERMITTED_VIOLATION;
466 }
467
468 if (strcasecmp(baseptr, dnsptr))
469 return X509_V_ERR_PERMITTED_VIOLATION;
470
471 return X509_V_OK;
472}
473
474static int
475nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
476{
477 const char *baseptr = (char *)base->data;
478 const char *emlptr = (char *)eml->data;
479 const char *baseat = strchr(baseptr, '@');
480 const char *emlat = strchr(emlptr, '@');
481
482 if (!emlat)
483 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
484 /* Special case: inital '.' is RHS match */
485 if (!baseat && (*baseptr == '.')) {
486 if (eml->length > base->length) {
487 emlptr += eml->length - base->length;
488 if (!strcasecmp(baseptr, emlptr))
489 return X509_V_OK;
490 }
491 return X509_V_ERR_PERMITTED_VIOLATION;
492 }
493
494 /* If we have anything before '@' match local part */
495
496 if (baseat) {
497 if (baseat != baseptr) {
498 if ((baseat - baseptr) != (emlat - emlptr))
499 return X509_V_ERR_PERMITTED_VIOLATION;
500 /* Case sensitive match of local part */
501 if (strncmp(baseptr, emlptr, emlat - emlptr))
502 return X509_V_ERR_PERMITTED_VIOLATION;
503 }
504 /* Position base after '@' */
505 baseptr = baseat + 1;
506 }
507 emlptr = emlat + 1;
508 /* Just have hostname left to match: case insensitive */
509 if (strcasecmp(baseptr, emlptr))
510 return X509_V_ERR_PERMITTED_VIOLATION;
511
512 return X509_V_OK;
513}
514
515static int
516nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
517{
518 const char *baseptr = (char *)base->data;
519 const char *hostptr = (char *)uri->data;
520 const char *p = strchr(hostptr, ':');
521 int hostlen;
522
523 /* Check for foo:// and skip past it */
524 if (!p || (p[1] != '/') || (p[2] != '/'))
525 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
526 hostptr = p + 3;
527
528 /* Determine length of hostname part of URI */
529
530 /* Look for a port indicator as end of hostname first */
531
532 p = strchr(hostptr, ':');
533 /* Otherwise look for trailing slash */
534 if (!p)
535 p = strchr(hostptr, '/');
536
537 if (!p)
538 hostlen = strlen(hostptr);
539 else
540 hostlen = p - hostptr;
541
542 if (hostlen == 0)
543 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
544
545 /* Special case: inital '.' is RHS match */
546 if (*baseptr == '.') {
547 if (hostlen > base->length) {
548 p = hostptr + hostlen - base->length;
549 if (!strncasecmp(p, baseptr, base->length))
550 return X509_V_OK;
551 }
552 return X509_V_ERR_PERMITTED_VIOLATION;
553 }
554
555 if ((base->length != (int)hostlen) ||
556 strncasecmp(hostptr, baseptr, hostlen))
557 return X509_V_ERR_PERMITTED_VIOLATION;
558
559 return X509_V_OK;
560}
diff --git a/src/lib/libcrypto/x509v3/v3_ocsp.c b/src/lib/libcrypto/x509v3/v3_ocsp.c
deleted file mode 100644
index 696eee5adc..0000000000
--- a/src/lib/libcrypto/x509v3/v3_ocsp.c
+++ /dev/null
@@ -1,380 +0,0 @@
1/* $OpenBSD: v3_ocsp.c,v 1.13 2015/09/30 18:41:06 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/opensslconf.h>
63
64#ifndef OPENSSL_NO_OCSP
65
66#include <openssl/asn1.h>
67#include <openssl/conf.h>
68#include <openssl/err.h>
69#include <openssl/ocsp.h>
70#include <openssl/x509v3.h>
71
72/* OCSP extensions and a couple of CRL entry extensions
73 */
74
75static int i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *nonce,
76 BIO *out, int indent);
77static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *nonce,
78 BIO *out, int indent);
79static int i2r_object(const X509V3_EXT_METHOD *method, void *obj, BIO *out,
80 int indent);
81
82static void *ocsp_nonce_new(void);
83static int i2d_ocsp_nonce(void *a, unsigned char **pp);
84static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length);
85static void ocsp_nonce_free(void *a);
86static int i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce,
87 BIO *out, int indent);
88
89static int i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method,
90 void *nocheck, BIO *out, int indent);
91static void *s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
92 const char *str);
93static int i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in,
94 BIO *bp, int ind);
95
96const X509V3_EXT_METHOD v3_ocsp_crlid = {
97 .ext_nid = NID_id_pkix_OCSP_CrlID,
98 .ext_flags = 0,
99 .it = ASN1_ITEM_ref(OCSP_CRLID),
100 .ext_new = NULL,
101 .ext_free = NULL,
102 .d2i = NULL,
103 .i2d = NULL,
104 .i2s = NULL,
105 .s2i = NULL,
106 .i2v = NULL,
107 .v2i = NULL,
108 .i2r = i2r_ocsp_crlid,
109 .r2i = NULL,
110 .usr_data = NULL,
111};
112
113const X509V3_EXT_METHOD v3_ocsp_acutoff = {
114 .ext_nid = NID_id_pkix_OCSP_archiveCutoff,
115 .ext_flags = 0,
116 .it = ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
117 .ext_new = NULL,
118 .ext_free = NULL,
119 .d2i = NULL,
120 .i2d = NULL,
121 .i2s = NULL,
122 .s2i = NULL,
123 .i2v = NULL,
124 .v2i = NULL,
125 .i2r = i2r_ocsp_acutoff,
126 .r2i = NULL,
127 .usr_data = NULL,
128};
129
130const X509V3_EXT_METHOD v3_crl_invdate = {
131 .ext_nid = NID_invalidity_date,
132 .ext_flags = 0,
133 .it = ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
134 .ext_new = NULL,
135 .ext_free = NULL,
136 .d2i = NULL,
137 .i2d = NULL,
138 .i2s = NULL,
139 .s2i = NULL,
140 .i2v = NULL,
141 .v2i = NULL,
142 .i2r = i2r_ocsp_acutoff,
143 .r2i = NULL,
144 .usr_data = NULL,
145};
146
147const X509V3_EXT_METHOD v3_crl_hold = {
148 .ext_nid = NID_hold_instruction_code,
149 .ext_flags = 0,
150 .it = ASN1_ITEM_ref(ASN1_OBJECT),
151 .ext_new = NULL,
152 .ext_free = NULL,
153 .d2i = NULL,
154 .i2d = NULL,
155 .i2s = NULL,
156 .s2i = NULL,
157 .i2v = NULL,
158 .v2i = NULL,
159 .i2r = i2r_object,
160 .r2i = NULL,
161 .usr_data = NULL,
162};
163
164const X509V3_EXT_METHOD v3_ocsp_nonce = {
165 .ext_nid = NID_id_pkix_OCSP_Nonce,
166 .ext_flags = 0,
167 .it = NULL,
168 .ext_new = ocsp_nonce_new,
169 .ext_free = ocsp_nonce_free,
170 .d2i = d2i_ocsp_nonce,
171 .i2d = i2d_ocsp_nonce,
172 .i2s = NULL,
173 .s2i = NULL,
174 .i2v = NULL,
175 .v2i = NULL,
176 .i2r = i2r_ocsp_nonce,
177 .r2i = NULL,
178 .usr_data = NULL,
179};
180
181const X509V3_EXT_METHOD v3_ocsp_nocheck = {
182 .ext_nid = NID_id_pkix_OCSP_noCheck,
183 .ext_flags = 0,
184 .it = ASN1_ITEM_ref(ASN1_NULL),
185 .ext_new = NULL,
186 .ext_free = NULL,
187 .d2i = NULL,
188 .i2d = NULL,
189 .i2s = NULL,
190 .s2i = s2i_ocsp_nocheck,
191 .i2v = NULL,
192 .v2i = NULL,
193 .i2r = i2r_ocsp_nocheck,
194 .r2i = NULL,
195 .usr_data = NULL,
196};
197
198const X509V3_EXT_METHOD v3_ocsp_serviceloc = {
199 .ext_nid = NID_id_pkix_OCSP_serviceLocator,
200 .ext_flags = 0,
201 .it = ASN1_ITEM_ref(OCSP_SERVICELOC),
202 .ext_new = NULL,
203 .ext_free = NULL,
204 .d2i = NULL,
205 .i2d = NULL,
206 .i2s = NULL,
207 .s2i = NULL,
208 .i2v = NULL,
209 .v2i = NULL,
210 .i2r = i2r_ocsp_serviceloc,
211 .r2i = NULL,
212 .usr_data = NULL,
213};
214
215static int
216i2r_ocsp_crlid(const X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind)
217{
218 OCSP_CRLID *a = in;
219 if (a->crlUrl) {
220 if (BIO_printf(bp, "%*scrlUrl: ", ind, "") <= 0)
221 goto err;
222 if (!ASN1_STRING_print(bp, (ASN1_STRING*)a->crlUrl))
223 goto err;
224 if (BIO_write(bp, "\n", 1) <= 0)
225 goto err;
226 }
227 if (a->crlNum) {
228 if (BIO_printf(bp, "%*scrlNum: ", ind, "") <= 0)
229 goto err;
230 if (i2a_ASN1_INTEGER(bp, a->crlNum) <= 0)
231 goto err;
232 if (BIO_write(bp, "\n", 1) <= 0)
233 goto err;
234 }
235 if (a->crlTime) {
236 if (BIO_printf(bp, "%*scrlTime: ", ind, "") <= 0)
237 goto err;
238 if (!ASN1_GENERALIZEDTIME_print(bp, a->crlTime))
239 goto err;
240 if (BIO_write(bp, "\n", 1) <= 0)
241 goto err;
242 }
243 return 1;
244
245err:
246 return 0;
247}
248
249static int
250i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *cutoff, BIO *bp,
251 int ind)
252{
253 if (BIO_printf(bp, "%*s", ind, "") <= 0)
254 return 0;
255 if (!ASN1_GENERALIZEDTIME_print(bp, cutoff))
256 return 0;
257 return 1;
258}
259
260static int
261i2r_object(const X509V3_EXT_METHOD *method, void *oid, BIO *bp, int ind)
262{
263 if (BIO_printf(bp, "%*s", ind, "") <= 0)
264 return 0;
265 if (i2a_ASN1_OBJECT(bp, oid) <= 0)
266 return 0;
267 return 1;
268}
269
270/* OCSP nonce. This is needs special treatment because it doesn't have
271 * an ASN1 encoding at all: it just contains arbitrary data.
272 */
273
274static void *
275ocsp_nonce_new(void)
276{
277 return ASN1_OCTET_STRING_new();
278}
279
280static int
281i2d_ocsp_nonce(void *a, unsigned char **pp)
282{
283 ASN1_OCTET_STRING *os = a;
284
285 if (pp) {
286 memcpy(*pp, os->data, os->length);
287 *pp += os->length;
288 }
289 return os->length;
290}
291
292static void *
293d2i_ocsp_nonce(void *a, const unsigned char **pp, long length)
294{
295 ASN1_OCTET_STRING *os, **pos;
296
297 pos = a;
298 if (pos == NULL || *pos == NULL) {
299 os = ASN1_OCTET_STRING_new();
300 if (os == NULL)
301 goto err;
302 } else
303 os = *pos;
304 if (ASN1_OCTET_STRING_set(os, *pp, length) == 0)
305 goto err;
306
307 *pp += length;
308
309 if (pos != NULL)
310 *pos = os;
311 return os;
312
313err:
314 if (pos == NULL || *pos != os)
315 ASN1_OCTET_STRING_free(os);
316 OCSPerr(OCSP_F_D2I_OCSP_NONCE, ERR_R_MALLOC_FAILURE);
317 return NULL;
318}
319
320static void
321ocsp_nonce_free(void *a)
322{
323 ASN1_OCTET_STRING_free(a);
324}
325
326static int
327i2r_ocsp_nonce(const X509V3_EXT_METHOD *method, void *nonce, BIO *out,
328 int indent)
329{
330 if (BIO_printf(out, "%*s", indent, "") <= 0)
331 return 0;
332 if (i2a_ASN1_STRING(out, nonce, V_ASN1_OCTET_STRING) <= 0)
333 return 0;
334 return 1;
335}
336
337/* Nocheck is just a single NULL. Don't print anything and always set it */
338
339static int
340i2r_ocsp_nocheck(const X509V3_EXT_METHOD *method, void *nocheck, BIO *out,
341 int indent)
342{
343 return 1;
344}
345
346static void *
347s2i_ocsp_nocheck(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
348 const char *str)
349{
350 return ASN1_NULL_new();
351}
352
353static int
354i2r_ocsp_serviceloc(const X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind)
355{
356 int i;
357 OCSP_SERVICELOC *a = in;
358 ACCESS_DESCRIPTION *ad;
359
360 if (BIO_printf(bp, "%*sIssuer: ", ind, "") <= 0)
361 goto err;
362 if (X509_NAME_print_ex(bp, a->issuer, 0, XN_FLAG_ONELINE) <= 0)
363 goto err;
364 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(a->locator); i++) {
365 ad = sk_ACCESS_DESCRIPTION_value(a->locator, i);
366 if (BIO_printf(bp, "\n%*s", (2 * ind), "") <= 0)
367 goto err;
368 if (i2a_ASN1_OBJECT(bp, ad->method) <= 0)
369 goto err;
370 if (BIO_puts(bp, " - ") <= 0)
371 goto err;
372 if (GENERAL_NAME_print(bp, ad->location) <= 0)
373 goto err;
374 }
375 return 1;
376
377err:
378 return 0;
379}
380#endif
diff --git a/src/lib/libcrypto/x509v3/v3_pci.c b/src/lib/libcrypto/x509v3/v3_pci.c
deleted file mode 100644
index ff1d087667..0000000000
--- a/src/lib/libcrypto/x509v3/v3_pci.c
+++ /dev/null
@@ -1,332 +0,0 @@
1/* $OpenBSD: v3_pci.c,v 1.10 2015/07/29 16:13:49 jsing Exp $ */
2/* Contributed to the OpenSSL Project 2004
3 * by Richard Levitte (richard@levitte.org)
4 */
5/* Copyright (c) 2004 Kungliga Tekniska Högskolan
6 * (Royal Institute of Technology, Stockholm, Sweden).
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * 3. Neither the name of the Institute nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <stdio.h>
38#include <string.h>
39
40#include <openssl/conf.h>
41#include <openssl/err.h>
42#include <openssl/x509v3.h>
43
44static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *ext,
45 BIO *out, int indent);
46static PROXY_CERT_INFO_EXTENSION *r2i_pci(X509V3_EXT_METHOD *method,
47 X509V3_CTX *ctx, char *str);
48
49const X509V3_EXT_METHOD v3_pci = {
50 .ext_nid = NID_proxyCertInfo,
51 .ext_flags = 0,
52 .it = ASN1_ITEM_ref(PROXY_CERT_INFO_EXTENSION),
53 .ext_new = NULL,
54 .ext_free = NULL,
55 .d2i = NULL,
56 .i2d = NULL,
57 .i2s = NULL,
58 .s2i = NULL,
59 .i2v = NULL,
60 .v2i = NULL,
61 .i2r = (X509V3_EXT_I2R)i2r_pci,
62 .r2i = (X509V3_EXT_R2I)r2i_pci,
63 .usr_data = NULL,
64};
65
66static int
67i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci, BIO *out,
68 int indent)
69{
70 BIO_printf(out, "%*sPath Length Constraint: ", indent, "");
71 if (pci->pcPathLengthConstraint)
72 i2a_ASN1_INTEGER(out, pci->pcPathLengthConstraint);
73 else
74 BIO_printf(out, "infinite");
75 BIO_puts(out, "\n");
76 BIO_printf(out, "%*sPolicy Language: ", indent, "");
77 i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
78 BIO_puts(out, "\n");
79 if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
80 BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
81 pci->proxyPolicy->policy->data);
82 return 1;
83}
84
85static int
86process_pci_value(CONF_VALUE *val, ASN1_OBJECT **language,
87 ASN1_INTEGER **pathlen, ASN1_OCTET_STRING **policy)
88{
89 int free_policy = 0;
90
91 if (strcmp(val->name, "language") == 0) {
92 if (*language) {
93 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
94 X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED);
95 X509V3_conf_err(val);
96 return 0;
97 }
98 if (!(*language = OBJ_txt2obj(val->value, 0))) {
99 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
100 X509V3_R_INVALID_OBJECT_IDENTIFIER);
101 X509V3_conf_err(val);
102 return 0;
103 }
104 }
105 else if (strcmp(val->name, "pathlen") == 0) {
106 if (*pathlen) {
107 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
108 X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED);
109 X509V3_conf_err(val);
110 return 0;
111 }
112 if (!X509V3_get_value_int(val, pathlen)) {
113 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
114 X509V3_R_POLICY_PATH_LENGTH);
115 X509V3_conf_err(val);
116 return 0;
117 }
118 }
119 else if (strcmp(val->name, "policy") == 0) {
120 unsigned char *tmp_data = NULL;
121 long val_len;
122 if (!*policy) {
123 *policy = ASN1_OCTET_STRING_new();
124 if (!*policy) {
125 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
126 ERR_R_MALLOC_FAILURE);
127 X509V3_conf_err(val);
128 return 0;
129 }
130 free_policy = 1;
131 }
132 if (strncmp(val->value, "hex:", 4) == 0) {
133 unsigned char *tmp_data2 =
134 string_to_hex(val->value + 4, &val_len);
135
136 if (!tmp_data2) {
137 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
138 X509V3_R_ILLEGAL_HEX_DIGIT);
139 X509V3_conf_err(val);
140 goto err;
141 }
142
143 tmp_data = realloc((*policy)->data,
144 (*policy)->length + val_len + 1);
145 if (tmp_data) {
146 (*policy)->data = tmp_data;
147 memcpy(&(*policy)->data[(*policy)->length],
148 tmp_data2, val_len);
149 (*policy)->length += val_len;
150 (*policy)->data[(*policy)->length] = '\0';
151 } else {
152 free(tmp_data2);
153 free((*policy)->data);
154 (*policy)->data = NULL;
155 (*policy)->length = 0;
156 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
157 ERR_R_MALLOC_FAILURE);
158 X509V3_conf_err(val);
159 goto err;
160 }
161 free(tmp_data2);
162 }
163 else if (strncmp(val->value, "file:", 5) == 0) {
164 unsigned char buf[2048];
165 int n;
166 BIO *b = BIO_new_file(val->value + 5, "r");
167 if (!b) {
168 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
169 ERR_R_BIO_LIB);
170 X509V3_conf_err(val);
171 goto err;
172 }
173 while ((n = BIO_read(b, buf, sizeof(buf))) > 0 ||
174 (n == 0 && BIO_should_retry(b))) {
175 if (!n)
176 continue;
177
178 tmp_data = realloc((*policy)->data,
179 (*policy)->length + n + 1);
180
181 if (!tmp_data)
182 break;
183
184 (*policy)->data = tmp_data;
185 memcpy(&(*policy)->data[(*policy)->length],
186 buf, n);
187 (*policy)->length += n;
188 (*policy)->data[(*policy)->length] = '\0';
189 }
190 BIO_free_all(b);
191
192 if (n < 0) {
193 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
194 ERR_R_BIO_LIB);
195 X509V3_conf_err(val);
196 goto err;
197 }
198 }
199 else if (strncmp(val->value, "text:", 5) == 0) {
200 val_len = strlen(val->value + 5);
201 tmp_data = realloc((*policy)->data,
202 (*policy)->length + val_len + 1);
203 if (tmp_data) {
204 (*policy)->data = tmp_data;
205 memcpy(&(*policy)->data[(*policy)->length],
206 val->value + 5, val_len);
207 (*policy)->length += val_len;
208 (*policy)->data[(*policy)->length] = '\0';
209 } else {
210 free((*policy)->data);
211 (*policy)->data = NULL;
212 (*policy)->length = 0;
213 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
214 ERR_R_MALLOC_FAILURE);
215 X509V3_conf_err(val);
216 goto err;
217 }
218 } else {
219 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
220 X509V3_R_INCORRECT_POLICY_SYNTAX_TAG);
221 X509V3_conf_err(val);
222 goto err;
223 }
224 if (!tmp_data) {
225 X509V3err(X509V3_F_PROCESS_PCI_VALUE,
226 ERR_R_MALLOC_FAILURE);
227 X509V3_conf_err(val);
228 goto err;
229 }
230 }
231 return 1;
232
233err:
234 if (free_policy) {
235 ASN1_OCTET_STRING_free(*policy);
236 *policy = NULL;
237 }
238 return 0;
239}
240
241static PROXY_CERT_INFO_EXTENSION *
242r2i_pci(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *value)
243{
244 PROXY_CERT_INFO_EXTENSION *pci = NULL;
245 STACK_OF(CONF_VALUE) *vals;
246 ASN1_OBJECT *language = NULL;
247 ASN1_INTEGER *pathlen = NULL;
248 ASN1_OCTET_STRING *policy = NULL;
249 int i, j;
250
251 vals = X509V3_parse_list(value);
252 for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
253 CONF_VALUE *cnf = sk_CONF_VALUE_value(vals, i);
254 if (!cnf->name || (*cnf->name != '@' && !cnf->value)) {
255 X509V3err(X509V3_F_R2I_PCI,
256 X509V3_R_INVALID_PROXY_POLICY_SETTING);
257 X509V3_conf_err(cnf);
258 goto err;
259 }
260 if (*cnf->name == '@') {
261 STACK_OF(CONF_VALUE) *sect;
262 int success_p = 1;
263
264 sect = X509V3_get_section(ctx, cnf->name + 1);
265 if (!sect) {
266 X509V3err(X509V3_F_R2I_PCI,
267 X509V3_R_INVALID_SECTION);
268 X509V3_conf_err(cnf);
269 goto err;
270 }
271 for (j = 0; success_p &&
272 j < sk_CONF_VALUE_num(sect); j++) {
273 success_p = process_pci_value(
274 sk_CONF_VALUE_value(sect, j),
275 &language, &pathlen, &policy);
276 }
277 X509V3_section_free(ctx, sect);
278 if (!success_p)
279 goto err;
280 } else {
281 if (!process_pci_value(cnf,
282 &language, &pathlen, &policy)) {
283 X509V3_conf_err(cnf);
284 goto err;
285 }
286 }
287 }
288
289 /* Language is mandatory */
290 if (!language) {
291 X509V3err(X509V3_F_R2I_PCI,
292 X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED);
293 goto err;
294 }
295 i = OBJ_obj2nid(language);
296 if ((i == NID_Independent || i == NID_id_ppl_inheritAll) && policy) {
297 X509V3err(X509V3_F_R2I_PCI,
298 X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY);
299 goto err;
300 }
301
302 pci = PROXY_CERT_INFO_EXTENSION_new();
303 if (!pci) {
304 X509V3err(X509V3_F_R2I_PCI, ERR_R_MALLOC_FAILURE);
305 goto err;
306 }
307
308 pci->proxyPolicy->policyLanguage = language;
309 language = NULL;
310 pci->proxyPolicy->policy = policy;
311 policy = NULL;
312 pci->pcPathLengthConstraint = pathlen;
313 pathlen = NULL;
314 goto end;
315
316err:
317 if (language) {
318 ASN1_OBJECT_free(language);
319 language = NULL;
320 }
321 if (pathlen) {
322 ASN1_INTEGER_free(pathlen);
323 pathlen = NULL;
324 }
325 if (policy) {
326 ASN1_OCTET_STRING_free(policy);
327 policy = NULL;
328 }
329end:
330 sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
331 return pci;
332}
diff --git a/src/lib/libcrypto/x509v3/v3_pcia.c b/src/lib/libcrypto/x509v3/v3_pcia.c
deleted file mode 100644
index f9ec02c00a..0000000000
--- a/src/lib/libcrypto/x509v3/v3_pcia.c
+++ /dev/null
@@ -1,145 +0,0 @@
1/* $OpenBSD: v3_pcia.c,v 1.6 2015/07/25 16:00:14 jsing Exp $ */
2/* Contributed to the OpenSSL Project 2004
3 * by Richard Levitte (richard@levitte.org)
4 */
5/* Copyright (c) 2004 Kungliga Tekniska Högskolan
6 * (Royal Institute of Technology, Stockholm, Sweden).
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * 3. Neither the name of the Institute nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <openssl/asn1.h>
38#include <openssl/asn1t.h>
39#include <openssl/x509v3.h>
40
41static const ASN1_TEMPLATE PROXY_POLICY_seq_tt[] = {
42 {
43 .flags = 0,
44 .tag = 0,
45 .offset = offsetof(PROXY_POLICY, policyLanguage),
46 .field_name = "policyLanguage",
47 .item = &ASN1_OBJECT_it,
48 },
49 {
50 .flags = ASN1_TFLG_OPTIONAL,
51 .tag = 0,
52 .offset = offsetof(PROXY_POLICY, policy),
53 .field_name = "policy",
54 .item = &ASN1_OCTET_STRING_it,
55 },
56};
57
58const ASN1_ITEM PROXY_POLICY_it = {
59 .itype = ASN1_ITYPE_SEQUENCE,
60 .utype = V_ASN1_SEQUENCE,
61 .templates = PROXY_POLICY_seq_tt,
62 .tcount = sizeof(PROXY_POLICY_seq_tt) / sizeof(ASN1_TEMPLATE),
63 .funcs = NULL,
64 .size = sizeof(PROXY_POLICY),
65 .sname = "PROXY_POLICY",
66};
67
68
69PROXY_POLICY *
70d2i_PROXY_POLICY(PROXY_POLICY **a, const unsigned char **in, long len)
71{
72 return (PROXY_POLICY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
73 &PROXY_POLICY_it);
74}
75
76int
77i2d_PROXY_POLICY(PROXY_POLICY *a, unsigned char **out)
78{
79 return ASN1_item_i2d((ASN1_VALUE *)a, out, &PROXY_POLICY_it);
80}
81
82PROXY_POLICY *
83PROXY_POLICY_new(void)
84{
85 return (PROXY_POLICY *)ASN1_item_new(&PROXY_POLICY_it);
86}
87
88void
89PROXY_POLICY_free(PROXY_POLICY *a)
90{
91 ASN1_item_free((ASN1_VALUE *)a, &PROXY_POLICY_it);
92}
93
94static const ASN1_TEMPLATE PROXY_CERT_INFO_EXTENSION_seq_tt[] = {
95 {
96 .flags = ASN1_TFLG_OPTIONAL,
97 .tag = 0,
98 .offset = offsetof(PROXY_CERT_INFO_EXTENSION, pcPathLengthConstraint),
99 .field_name = "pcPathLengthConstraint",
100 .item = &ASN1_INTEGER_it,
101 },
102 {
103 .flags = 0,
104 .tag = 0,
105 .offset = offsetof(PROXY_CERT_INFO_EXTENSION, proxyPolicy),
106 .field_name = "proxyPolicy",
107 .item = &PROXY_POLICY_it,
108 },
109};
110
111const ASN1_ITEM PROXY_CERT_INFO_EXTENSION_it = {
112 .itype = ASN1_ITYPE_SEQUENCE,
113 .utype = V_ASN1_SEQUENCE,
114 .templates = PROXY_CERT_INFO_EXTENSION_seq_tt,
115 .tcount = sizeof(PROXY_CERT_INFO_EXTENSION_seq_tt) / sizeof(ASN1_TEMPLATE),
116 .funcs = NULL,
117 .size = sizeof(PROXY_CERT_INFO_EXTENSION),
118 .sname = "PROXY_CERT_INFO_EXTENSION",
119};
120
121
122PROXY_CERT_INFO_EXTENSION *
123d2i_PROXY_CERT_INFO_EXTENSION(PROXY_CERT_INFO_EXTENSION **a, const unsigned char **in, long len)
124{
125 return (PROXY_CERT_INFO_EXTENSION *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
126 &PROXY_CERT_INFO_EXTENSION_it);
127}
128
129int
130i2d_PROXY_CERT_INFO_EXTENSION(PROXY_CERT_INFO_EXTENSION *a, unsigned char **out)
131{
132 return ASN1_item_i2d((ASN1_VALUE *)a, out, &PROXY_CERT_INFO_EXTENSION_it);
133}
134
135PROXY_CERT_INFO_EXTENSION *
136PROXY_CERT_INFO_EXTENSION_new(void)
137{
138 return (PROXY_CERT_INFO_EXTENSION *)ASN1_item_new(&PROXY_CERT_INFO_EXTENSION_it);
139}
140
141void
142PROXY_CERT_INFO_EXTENSION_free(PROXY_CERT_INFO_EXTENSION *a)
143{
144 ASN1_item_free((ASN1_VALUE *)a, &PROXY_CERT_INFO_EXTENSION_it);
145}
diff --git a/src/lib/libcrypto/x509v3/v3_pcons.c b/src/lib/libcrypto/x509v3/v3_pcons.c
deleted file mode 100644
index a5a8d8a025..0000000000
--- a/src/lib/libcrypto/x509v3/v3_pcons.c
+++ /dev/null
@@ -1,183 +0,0 @@
1/* $OpenBSD: v3_pcons.c,v 1.9 2015/07/29 16:13:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68static STACK_OF(CONF_VALUE) *
69i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *bcons,
70 STACK_OF(CONF_VALUE) *extlist);
71static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method,
72 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
73
74const X509V3_EXT_METHOD v3_policy_constraints = {
75 .ext_nid = NID_policy_constraints,
76 .ext_flags = 0,
77 .it = ASN1_ITEM_ref(POLICY_CONSTRAINTS),
78 .ext_new = NULL,
79 .ext_free = NULL,
80 .d2i = NULL,
81 .i2d = NULL,
82 .i2s = NULL,
83 .s2i = NULL,
84 .i2v = i2v_POLICY_CONSTRAINTS,
85 .v2i = v2i_POLICY_CONSTRAINTS,
86 .i2r = NULL,
87 .r2i = NULL,
88 .usr_data = NULL,
89};
90
91static const ASN1_TEMPLATE POLICY_CONSTRAINTS_seq_tt[] = {
92 {
93 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
94 .tag = 0,
95 .offset = offsetof(POLICY_CONSTRAINTS, requireExplicitPolicy),
96 .field_name = "requireExplicitPolicy",
97 .item = &ASN1_INTEGER_it,
98 },
99 {
100 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
101 .tag = 1,
102 .offset = offsetof(POLICY_CONSTRAINTS, inhibitPolicyMapping),
103 .field_name = "inhibitPolicyMapping",
104 .item = &ASN1_INTEGER_it,
105 },
106};
107
108const ASN1_ITEM POLICY_CONSTRAINTS_it = {
109 .itype = ASN1_ITYPE_SEQUENCE,
110 .utype = V_ASN1_SEQUENCE,
111 .templates = POLICY_CONSTRAINTS_seq_tt,
112 .tcount = sizeof(POLICY_CONSTRAINTS_seq_tt) / sizeof(ASN1_TEMPLATE),
113 .funcs = NULL,
114 .size = sizeof(POLICY_CONSTRAINTS),
115 .sname = "POLICY_CONSTRAINTS",
116};
117
118
119POLICY_CONSTRAINTS *
120POLICY_CONSTRAINTS_new(void)
121{
122 return (POLICY_CONSTRAINTS*)ASN1_item_new(&POLICY_CONSTRAINTS_it);
123}
124
125void
126POLICY_CONSTRAINTS_free(POLICY_CONSTRAINTS *a)
127{
128 ASN1_item_free((ASN1_VALUE *)a, &POLICY_CONSTRAINTS_it);
129}
130
131static STACK_OF(CONF_VALUE) *
132i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
133 STACK_OF(CONF_VALUE) *extlist)
134{
135 POLICY_CONSTRAINTS *pcons = a;
136
137 X509V3_add_value_int("Require Explicit Policy",
138 pcons->requireExplicitPolicy, &extlist);
139 X509V3_add_value_int("Inhibit Policy Mapping",
140 pcons->inhibitPolicyMapping, &extlist);
141 return extlist;
142}
143
144static void *
145v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
146 STACK_OF(CONF_VALUE) *values)
147{
148 POLICY_CONSTRAINTS *pcons = NULL;
149 CONF_VALUE *val;
150 int i;
151
152 if (!(pcons = POLICY_CONSTRAINTS_new())) {
153 X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS,
154 ERR_R_MALLOC_FAILURE);
155 return NULL;
156 }
157 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
158 val = sk_CONF_VALUE_value(values, i);
159 if (!strcmp(val->name, "requireExplicitPolicy")) {
160 if (!X509V3_get_value_int(val,
161 &pcons->requireExplicitPolicy)) goto err;
162 } else if (!strcmp(val->name, "inhibitPolicyMapping")) {
163 if (!X509V3_get_value_int(val,
164 &pcons->inhibitPolicyMapping)) goto err;
165 } else {
166 X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS,
167 X509V3_R_INVALID_NAME);
168 X509V3_conf_err(val);
169 goto err;
170 }
171 }
172 if (!pcons->inhibitPolicyMapping && !pcons->requireExplicitPolicy) {
173 X509V3err(X509V3_F_V2I_POLICY_CONSTRAINTS,
174 X509V3_R_ILLEGAL_EMPTY_EXTENSION);
175 goto err;
176 }
177
178 return pcons;
179
180err:
181 POLICY_CONSTRAINTS_free(pcons);
182 return NULL;
183}
diff --git a/src/lib/libcrypto/x509v3/v3_pku.c b/src/lib/libcrypto/x509v3/v3_pku.c
deleted file mode 100644
index caa3608859..0000000000
--- a/src/lib/libcrypto/x509v3/v3_pku.c
+++ /dev/null
@@ -1,166 +0,0 @@
1/* $OpenBSD: v3_pku.c,v 1.12 2015/07/29 16:13:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/asn1t.h>
63#include <openssl/x509v3.h>
64
65static int i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method,
66 PKEY_USAGE_PERIOD *usage, BIO *out, int indent);
67/*
68static PKEY_USAGE_PERIOD *v2i_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
69*/
70const X509V3_EXT_METHOD v3_pkey_usage_period = {
71 .ext_nid = NID_private_key_usage_period,
72 .ext_flags = 0,
73 .it = ASN1_ITEM_ref(PKEY_USAGE_PERIOD),
74 .ext_new = NULL,
75 .ext_free = NULL,
76 .d2i = NULL,
77 .i2d = NULL,
78 .i2s = NULL,
79 .s2i = NULL,
80 .i2v = NULL,
81 .v2i = NULL,
82 .i2r = (X509V3_EXT_I2R)i2r_PKEY_USAGE_PERIOD,
83 .r2i = NULL,
84 .usr_data = NULL,
85};
86
87static const ASN1_TEMPLATE PKEY_USAGE_PERIOD_seq_tt[] = {
88 {
89 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
90 .tag = 0,
91 .offset = offsetof(PKEY_USAGE_PERIOD, notBefore),
92 .field_name = "notBefore",
93 .item = &ASN1_GENERALIZEDTIME_it,
94 },
95 {
96 .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
97 .tag = 1,
98 .offset = offsetof(PKEY_USAGE_PERIOD, notAfter),
99 .field_name = "notAfter",
100 .item = &ASN1_GENERALIZEDTIME_it,
101 },
102};
103
104const ASN1_ITEM PKEY_USAGE_PERIOD_it = {
105 .itype = ASN1_ITYPE_SEQUENCE,
106 .utype = V_ASN1_SEQUENCE,
107 .templates = PKEY_USAGE_PERIOD_seq_tt,
108 .tcount = sizeof(PKEY_USAGE_PERIOD_seq_tt) / sizeof(ASN1_TEMPLATE),
109 .funcs = NULL,
110 .size = sizeof(PKEY_USAGE_PERIOD),
111 .sname = "PKEY_USAGE_PERIOD",
112};
113
114
115PKEY_USAGE_PERIOD *
116d2i_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD **a, const unsigned char **in, long len)
117{
118 return (PKEY_USAGE_PERIOD *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
119 &PKEY_USAGE_PERIOD_it);
120}
121
122int
123i2d_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD *a, unsigned char **out)
124{
125 return ASN1_item_i2d((ASN1_VALUE *)a, out, &PKEY_USAGE_PERIOD_it);
126}
127
128PKEY_USAGE_PERIOD *
129PKEY_USAGE_PERIOD_new(void)
130{
131 return (PKEY_USAGE_PERIOD *)ASN1_item_new(&PKEY_USAGE_PERIOD_it);
132}
133
134void
135PKEY_USAGE_PERIOD_free(PKEY_USAGE_PERIOD *a)
136{
137 ASN1_item_free((ASN1_VALUE *)a, &PKEY_USAGE_PERIOD_it);
138}
139
140static int
141i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method, PKEY_USAGE_PERIOD *usage,
142 BIO *out, int indent)
143{
144 BIO_printf(out, "%*s", indent, "");
145 if (usage->notBefore) {
146 BIO_write(out, "Not Before: ", 12);
147 ASN1_GENERALIZEDTIME_print(out, usage->notBefore);
148 if (usage->notAfter)
149 BIO_write(out, ", ", 2);
150 }
151 if (usage->notAfter) {
152 BIO_write(out, "Not After: ", 11);
153 ASN1_GENERALIZEDTIME_print(out, usage->notAfter);
154 }
155 return 1;
156}
157
158/*
159static PKEY_USAGE_PERIOD *v2i_PKEY_USAGE_PERIOD(method, ctx, values)
160X509V3_EXT_METHOD *method;
161X509V3_CTX *ctx;
162STACK_OF(CONF_VALUE) *values;
163{
164return NULL;
165}
166*/
diff --git a/src/lib/libcrypto/x509v3/v3_pmaps.c b/src/lib/libcrypto/x509v3/v3_pmaps.c
deleted file mode 100644
index f2d9090157..0000000000
--- a/src/lib/libcrypto/x509v3/v3_pmaps.c
+++ /dev/null
@@ -1,218 +0,0 @@
1/* $OpenBSD: v3_pmaps.c,v 1.9 2015/07/29 16:13:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59
60#include <stdio.h>
61
62#include <openssl/asn1t.h>
63#include <openssl/conf.h>
64#include <openssl/err.h>
65#include <openssl/x509v3.h>
66
67static void *v2i_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method,
68 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
69static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(
70 const X509V3_EXT_METHOD *method, void *pmps, STACK_OF(CONF_VALUE) *extlist);
71
72const X509V3_EXT_METHOD v3_policy_mappings = {
73 .ext_nid = NID_policy_mappings,
74 .ext_flags = 0,
75 .it = ASN1_ITEM_ref(POLICY_MAPPINGS),
76 .ext_new = NULL,
77 .ext_free = NULL,
78 .d2i = NULL,
79 .i2d = NULL,
80 .i2s = NULL,
81 .s2i = NULL,
82 .i2v = i2v_POLICY_MAPPINGS,
83 .v2i = v2i_POLICY_MAPPINGS,
84 .i2r = NULL,
85 .r2i = NULL,
86 .usr_data = NULL,
87};
88
89static const ASN1_TEMPLATE POLICY_MAPPING_seq_tt[] = {
90 {
91 .flags = 0,
92 .tag = 0,
93 .offset = offsetof(POLICY_MAPPING, issuerDomainPolicy),
94 .field_name = "issuerDomainPolicy",
95 .item = &ASN1_OBJECT_it,
96 },
97 {
98 .flags = 0,
99 .tag = 0,
100 .offset = offsetof(POLICY_MAPPING, subjectDomainPolicy),
101 .field_name = "subjectDomainPolicy",
102 .item = &ASN1_OBJECT_it,
103 },
104};
105
106const ASN1_ITEM POLICY_MAPPING_it = {
107 .itype = ASN1_ITYPE_SEQUENCE,
108 .utype = V_ASN1_SEQUENCE,
109 .templates = POLICY_MAPPING_seq_tt,
110 .tcount = sizeof(POLICY_MAPPING_seq_tt) / sizeof(ASN1_TEMPLATE),
111 .funcs = NULL,
112 .size = sizeof(POLICY_MAPPING),
113 .sname = "POLICY_MAPPING",
114};
115
116static const ASN1_TEMPLATE POLICY_MAPPINGS_item_tt = {
117 .flags = ASN1_TFLG_SEQUENCE_OF,
118 .tag = 0,
119 .offset = 0,
120 .field_name = "POLICY_MAPPINGS",
121 .item = &POLICY_MAPPING_it,
122};
123
124const ASN1_ITEM POLICY_MAPPINGS_it = {
125 .itype = ASN1_ITYPE_PRIMITIVE,
126 .utype = -1,
127 .templates = &POLICY_MAPPINGS_item_tt,
128 .tcount = 0,
129 .funcs = NULL,
130 .size = 0,
131 .sname = "POLICY_MAPPINGS",
132};
133
134
135POLICY_MAPPING *
136POLICY_MAPPING_new(void)
137{
138 return (POLICY_MAPPING*)ASN1_item_new(&POLICY_MAPPING_it);
139}
140
141void
142POLICY_MAPPING_free(POLICY_MAPPING *a)
143{
144 ASN1_item_free((ASN1_VALUE *)a, &POLICY_MAPPING_it);
145}
146
147static STACK_OF(CONF_VALUE) *
148i2v_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method, void *a,
149 STACK_OF(CONF_VALUE) *ext_list)
150{
151 POLICY_MAPPINGS *pmaps = a;
152 POLICY_MAPPING *pmap;
153 int i;
154 char obj_tmp1[80];
155 char obj_tmp2[80];
156
157 for (i = 0; i < sk_POLICY_MAPPING_num(pmaps); i++) {
158 pmap = sk_POLICY_MAPPING_value(pmaps, i);
159 i2t_ASN1_OBJECT(obj_tmp1, 80, pmap->issuerDomainPolicy);
160 i2t_ASN1_OBJECT(obj_tmp2, 80, pmap->subjectDomainPolicy);
161 X509V3_add_value(obj_tmp1, obj_tmp2, &ext_list);
162 }
163 return ext_list;
164}
165
166static void *
167v2i_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
168 STACK_OF(CONF_VALUE) *nval)
169{
170 POLICY_MAPPINGS *pmaps = NULL;
171 POLICY_MAPPING *pmap = NULL;
172 ASN1_OBJECT *obj1 = NULL, *obj2 = NULL;
173 CONF_VALUE *val;
174 int i, rc;
175
176 if (!(pmaps = sk_POLICY_MAPPING_new_null())) {
177 X509V3err(X509V3_F_V2I_POLICY_MAPPINGS, ERR_R_MALLOC_FAILURE);
178 return NULL;
179 }
180
181 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
182 val = sk_CONF_VALUE_value(nval, i);
183 if (!val->value || !val->name) {
184 rc = X509V3_R_INVALID_OBJECT_IDENTIFIER;
185 goto err;
186 }
187 obj1 = OBJ_txt2obj(val->name, 0);
188 obj2 = OBJ_txt2obj(val->value, 0);
189 if (!obj1 || !obj2) {
190 rc = X509V3_R_INVALID_OBJECT_IDENTIFIER;
191 goto err;
192 }
193 pmap = POLICY_MAPPING_new();
194 if (!pmap) {
195 rc = ERR_R_MALLOC_FAILURE;
196 goto err;
197 }
198 pmap->issuerDomainPolicy = obj1;
199 pmap->subjectDomainPolicy = obj2;
200 obj1 = obj2 = NULL;
201 if (sk_POLICY_MAPPING_push(pmaps, pmap) == 0) {
202 rc = ERR_R_MALLOC_FAILURE;
203 goto err;
204 }
205 pmap = NULL;
206 }
207 return pmaps;
208
209err:
210 sk_POLICY_MAPPING_pop_free(pmaps, POLICY_MAPPING_free);
211 X509V3err(X509V3_F_V2I_POLICY_MAPPINGS, rc);
212 if (rc == X509V3_R_INVALID_OBJECT_IDENTIFIER)
213 X509V3_conf_err(val);
214 ASN1_OBJECT_free(obj1);
215 ASN1_OBJECT_free(obj2);
216 POLICY_MAPPING_free(pmap);
217 return NULL;
218}
diff --git a/src/lib/libcrypto/x509v3/v3_prn.c b/src/lib/libcrypto/x509v3/v3_prn.c
deleted file mode 100644
index e2d8dd8c87..0000000000
--- a/src/lib/libcrypto/x509v3/v3_prn.c
+++ /dev/null
@@ -1,225 +0,0 @@
1/* $OpenBSD: v3_prn.c,v 1.18 2015/07/29 14:58:34 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58/* X509 v3 extension utilities */
59
60#include <stdio.h>
61
62#include <openssl/conf.h>
63#include <openssl/x509v3.h>
64
65/* Extension printing routines */
66
67static int unknown_ext_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
68 int indent, int supported);
69
70/* Print out a name+value stack */
71
72void
73X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, int ml)
74{
75 int i;
76 CONF_VALUE *nval;
77
78 if (!val)
79 return;
80 if (!ml || !sk_CONF_VALUE_num(val)) {
81 BIO_printf(out, "%*s", indent, "");
82 if (!sk_CONF_VALUE_num(val))
83 BIO_puts(out, "<EMPTY>\n");
84 }
85 for (i = 0; i < sk_CONF_VALUE_num(val); i++) {
86 if (ml)
87 BIO_printf(out, "%*s", indent, "");
88 else if (i > 0) BIO_printf(out, ", ");
89 nval = sk_CONF_VALUE_value(val, i);
90 if (!nval->name)
91 BIO_puts(out, nval->value);
92 else if (!nval->value)
93 BIO_puts(out, nval->name);
94 else
95 BIO_printf(out, "%s:%s", nval->name, nval->value);
96 if (ml)
97 BIO_puts(out, "\n");
98 }
99}
100
101/* Main routine: print out a general extension */
102
103int
104X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent)
105{
106 void *ext_str = NULL;
107 char *value = NULL;
108 const unsigned char *p;
109 const X509V3_EXT_METHOD *method;
110 STACK_OF(CONF_VALUE) *nval = NULL;
111 int ok = 1;
112
113 if (!(method = X509V3_EXT_get(ext)))
114 return unknown_ext_print(out, ext, flag, indent, 0);
115 p = ext->value->data;
116 if (method->it)
117 ext_str = ASN1_item_d2i(NULL, &p, ext->value->length,
118 ASN1_ITEM_ptr(method->it));
119 else
120 ext_str = method->d2i(NULL, &p, ext->value->length);
121
122 if (!ext_str)
123 return unknown_ext_print(out, ext, flag, indent, 1);
124
125 if (method->i2s) {
126 if (!(value = method->i2s(method, ext_str))) {
127 ok = 0;
128 goto err;
129 }
130 BIO_printf(out, "%*s%s", indent, "", value);
131 } else if (method->i2v) {
132 if (!(nval = method->i2v(method, ext_str, NULL))) {
133 ok = 0;
134 goto err;
135 }
136 X509V3_EXT_val_prn(out, nval, indent,
137 method->ext_flags & X509V3_EXT_MULTILINE);
138 } else if (method->i2r) {
139 if (!method->i2r(method, ext_str, out, indent))
140 ok = 0;
141 } else
142 ok = 0;
143
144err:
145 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
146 free(value);
147 if (method->it)
148 ASN1_item_free(ext_str, ASN1_ITEM_ptr(method->it));
149 else
150 method->ext_free(ext_str);
151 return ok;
152}
153
154int
155X509V3_extensions_print(BIO *bp, char *title, STACK_OF(X509_EXTENSION) *exts,
156 unsigned long flag, int indent)
157{
158 int i, j;
159
160 if (sk_X509_EXTENSION_num(exts) <= 0)
161 return 1;
162
163 if (title) {
164 BIO_printf(bp, "%*s%s:\n",indent, "", title);
165 indent += 4;
166 }
167
168 for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
169 ASN1_OBJECT *obj;
170 X509_EXTENSION *ex;
171 ex = sk_X509_EXTENSION_value(exts, i);
172 if (indent && BIO_printf(bp, "%*s",indent, "") <= 0)
173 return 0;
174 obj = X509_EXTENSION_get_object(ex);
175 i2a_ASN1_OBJECT(bp, obj);
176 j = X509_EXTENSION_get_critical(ex);
177 if (BIO_printf(bp, ": %s\n",j?"critical":"") <= 0)
178 return 0;
179 if (!X509V3_EXT_print(bp, ex, flag, indent + 4)) {
180 BIO_printf(bp, "%*s", indent + 4, "");
181 ASN1_STRING_print(bp, ex->value);
182 }
183 if (BIO_write(bp, "\n",1) <= 0)
184 return 0;
185 }
186 return 1;
187}
188
189static int
190unknown_ext_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
191 int indent, int supported)
192{
193 switch (flag & X509V3_EXT_UNKNOWN_MASK) {
194 case X509V3_EXT_DEFAULT:
195 return 0;
196 case X509V3_EXT_ERROR_UNKNOWN:
197 if (supported)
198 BIO_printf(out, "%*s<Parse Error>", indent, "");
199 else
200 BIO_printf(out, "%*s<Not Supported>", indent, "");
201 return 1;
202 case X509V3_EXT_PARSE_UNKNOWN:
203 return ASN1_parse_dump(out,
204 ext->value->data, ext->value->length, indent, -1);
205 case X509V3_EXT_DUMP_UNKNOWN:
206 return BIO_dump_indent(out, (char *)ext->value->data,
207 ext->value->length, indent);
208 default:
209 return 1;
210 }
211}
212
213
214int
215X509V3_EXT_print_fp(FILE *fp, X509_EXTENSION *ext, int flag, int indent)
216{
217 BIO *bio_tmp;
218 int ret;
219
220 if (!(bio_tmp = BIO_new_fp(fp, BIO_NOCLOSE)))
221 return 0;
222 ret = X509V3_EXT_print(bio_tmp, ext, flag, indent);
223 BIO_free(bio_tmp);
224 return ret;
225}
diff --git a/src/lib/libcrypto/x509v3/v3_purp.c b/src/lib/libcrypto/x509v3/v3_purp.c
deleted file mode 100644
index 69a8d05f26..0000000000
--- a/src/lib/libcrypto/x509v3/v3_purp.c
+++ /dev/null
@@ -1,861 +0,0 @@
1/* $OpenBSD: v3_purp.c,v 1.26 2015/02/10 13:28:17 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2001.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/opensslconf.h>
63
64#include <openssl/err.h>
65#include <openssl/x509v3.h>
66#include <openssl/x509_vfy.h>
67
68static void x509v3_cache_extensions(X509 *x);
69
70static int check_ssl_ca(const X509 *x);
71static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x,
72 int ca);
73static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x,
74 int ca);
75static int check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x,
76 int ca);
77static int purpose_smime(const X509 *x, int ca);
78static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x,
79 int ca);
80static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x,
81 int ca);
82static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x,
83 int ca);
84static int check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x,
85 int ca);
86static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
87static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca);
88
89static int xp_cmp(const X509_PURPOSE * const *a, const X509_PURPOSE * const *b);
90static void xptable_free(X509_PURPOSE *p);
91
92static X509_PURPOSE xstandard[] = {
93 {X509_PURPOSE_SSL_CLIENT, X509_TRUST_SSL_CLIENT, 0, check_purpose_ssl_client, "SSL client", "sslclient", NULL},
94 {X509_PURPOSE_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ssl_server, "SSL server", "sslserver", NULL},
95 {X509_PURPOSE_NS_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ns_ssl_server, "Netscape SSL server", "nssslserver", NULL},
96 {X509_PURPOSE_SMIME_SIGN, X509_TRUST_EMAIL, 0, check_purpose_smime_sign, "S/MIME signing", "smimesign", NULL},
97 {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
98 {X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
99 {X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
100 {X509_PURPOSE_OCSP_HELPER, X509_TRUST_COMPAT, 0, ocsp_helper, "OCSP helper", "ocsphelper", NULL},
101 {X509_PURPOSE_TIMESTAMP_SIGN, X509_TRUST_TSA, 0, check_purpose_timestamp_sign, "Time Stamp signing", "timestampsign", NULL},
102};
103
104#define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
105
106static STACK_OF(X509_PURPOSE) *xptable = NULL;
107
108static int
109xp_cmp(const X509_PURPOSE * const *a, const X509_PURPOSE * const *b)
110{
111 return (*a)->purpose - (*b)->purpose;
112}
113
114/* As much as I'd like to make X509_check_purpose use a "const" X509*
115 * I really can't because it does recalculate hashes and do other non-const
116 * things. */
117int
118X509_check_purpose(X509 *x, int id, int ca)
119{
120 int idx;
121 const X509_PURPOSE *pt;
122
123 if (!(x->ex_flags & EXFLAG_SET)) {
124 CRYPTO_w_lock(CRYPTO_LOCK_X509);
125 x509v3_cache_extensions(x);
126 CRYPTO_w_unlock(CRYPTO_LOCK_X509);
127 }
128 if (id == -1)
129 return 1;
130 idx = X509_PURPOSE_get_by_id(id);
131 if (idx == -1)
132 return -1;
133 pt = X509_PURPOSE_get0(idx);
134 return pt->check_purpose(pt, x, ca);
135}
136
137int
138X509_PURPOSE_set(int *p, int purpose)
139{
140 if (X509_PURPOSE_get_by_id(purpose) == -1) {
141 X509V3err(X509V3_F_X509_PURPOSE_SET, X509V3_R_INVALID_PURPOSE);
142 return 0;
143 }
144 *p = purpose;
145 return 1;
146}
147
148int
149X509_PURPOSE_get_count(void)
150{
151 if (!xptable)
152 return X509_PURPOSE_COUNT;
153 return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
154}
155
156X509_PURPOSE *
157X509_PURPOSE_get0(int idx)
158{
159 if (idx < 0)
160 return NULL;
161 if (idx < (int)X509_PURPOSE_COUNT)
162 return xstandard + idx;
163 return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
164}
165
166int
167X509_PURPOSE_get_by_sname(char *sname)
168{
169 int i;
170 X509_PURPOSE *xptmp;
171
172 for (i = 0; i < X509_PURPOSE_get_count(); i++) {
173 xptmp = X509_PURPOSE_get0(i);
174 if (!strcmp(xptmp->sname, sname))
175 return i;
176 }
177 return -1;
178}
179
180int
181X509_PURPOSE_get_by_id(int purpose)
182{
183 X509_PURPOSE tmp;
184 int idx;
185
186 if ((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
187 return purpose - X509_PURPOSE_MIN;
188 tmp.purpose = purpose;
189 if (!xptable)
190 return -1;
191 idx = sk_X509_PURPOSE_find(xptable, &tmp);
192 if (idx == -1)
193 return -1;
194 return idx + X509_PURPOSE_COUNT;
195}
196
197int
198X509_PURPOSE_add(int id, int trust, int flags,
199 int (*ck)(const X509_PURPOSE *, const X509 *, int), char *name,
200 char *sname, void *arg)
201{
202 int idx;
203 X509_PURPOSE *ptmp;
204 char *name_dup, *sname_dup;
205
206 name_dup = sname_dup = NULL;
207
208 if (name == NULL || sname == NULL) {
209 X509V3err(X509V3_F_X509_PURPOSE_ADD,
210 X509V3_R_INVALID_NULL_ARGUMENT);
211 return 0;
212 }
213
214 /* This is set according to what we change: application can't set it */
215 flags &= ~X509_PURPOSE_DYNAMIC;
216 /* This will always be set for application modified trust entries */
217 flags |= X509_PURPOSE_DYNAMIC_NAME;
218 /* Get existing entry if any */
219 idx = X509_PURPOSE_get_by_id(id);
220 /* Need a new entry */
221 if (idx == -1) {
222 if ((ptmp = malloc(sizeof(X509_PURPOSE))) == NULL) {
223 X509V3err(X509V3_F_X509_PURPOSE_ADD,
224 ERR_R_MALLOC_FAILURE);
225 return 0;
226 }
227 ptmp->flags = X509_PURPOSE_DYNAMIC;
228 } else
229 ptmp = X509_PURPOSE_get0(idx);
230
231 if ((name_dup = strdup(name)) == NULL)
232 goto err;
233 if ((sname_dup = strdup(sname)) == NULL)
234 goto err;
235
236 /* free existing name if dynamic */
237 if (ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
238 free(ptmp->name);
239 free(ptmp->sname);
240 }
241 /* dup supplied name */
242 ptmp->name = name_dup;
243 ptmp->sname = sname_dup;
244 /* Keep the dynamic flag of existing entry */
245 ptmp->flags &= X509_PURPOSE_DYNAMIC;
246 /* Set all other flags */
247 ptmp->flags |= flags;
248
249 ptmp->purpose = id;
250 ptmp->trust = trust;
251 ptmp->check_purpose = ck;
252 ptmp->usr_data = arg;
253
254 /* If its a new entry manage the dynamic table */
255 if (idx == -1) {
256 if (xptable == NULL &&
257 (xptable = sk_X509_PURPOSE_new(xp_cmp)) == NULL)
258 goto err;
259 if (sk_X509_PURPOSE_push(xptable, ptmp) == 0)
260 goto err;
261 }
262 return 1;
263
264err:
265 free(name_dup);
266 free(sname_dup);
267 if (idx == -1)
268 free(ptmp);
269 X509V3err(X509V3_F_X509_PURPOSE_ADD, ERR_R_MALLOC_FAILURE);
270 return 0;
271}
272
273static void
274xptable_free(X509_PURPOSE *p)
275{
276 if (!p)
277 return;
278 if (p->flags & X509_PURPOSE_DYNAMIC) {
279 if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
280 free(p->name);
281 free(p->sname);
282 }
283 free(p);
284 }
285}
286
287void
288X509_PURPOSE_cleanup(void)
289{
290 unsigned int i;
291
292 sk_X509_PURPOSE_pop_free(xptable, xptable_free);
293 for(i = 0; i < X509_PURPOSE_COUNT; i++)
294 xptable_free(xstandard + i);
295 xptable = NULL;
296}
297
298int
299X509_PURPOSE_get_id(X509_PURPOSE *xp)
300{
301 return xp->purpose;
302}
303
304char *
305X509_PURPOSE_get0_name(X509_PURPOSE *xp)
306{
307 return xp->name;
308}
309
310char *
311X509_PURPOSE_get0_sname(X509_PURPOSE *xp)
312{
313 return xp->sname;
314}
315
316int
317X509_PURPOSE_get_trust(X509_PURPOSE *xp)
318{
319 return xp->trust;
320}
321
322static int
323nid_cmp(const int *a, const int *b)
324{
325 return *a - *b;
326}
327
328DECLARE_OBJ_BSEARCH_CMP_FN(int, int, nid);
329IMPLEMENT_OBJ_BSEARCH_CMP_FN(int, int, nid);
330
331int
332X509_supported_extension(X509_EXTENSION *ex)
333{
334 /* This table is a list of the NIDs of supported extensions:
335 * that is those which are used by the verify process. If
336 * an extension is critical and doesn't appear in this list
337 * then the verify process will normally reject the certificate.
338 * The list must be kept in numerical order because it will be
339 * searched using bsearch.
340 */
341
342 static const int supported_nids[] = {
343 NID_netscape_cert_type, /* 71 */
344 NID_key_usage, /* 83 */
345 NID_subject_alt_name, /* 85 */
346 NID_basic_constraints, /* 87 */
347 NID_certificate_policies, /* 89 */
348 NID_ext_key_usage, /* 126 */
349 NID_policy_constraints, /* 401 */
350 NID_proxyCertInfo, /* 663 */
351 NID_name_constraints, /* 666 */
352 NID_policy_mappings, /* 747 */
353 NID_inhibit_any_policy /* 748 */
354 };
355
356 int ex_nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex));
357
358 if (ex_nid == NID_undef)
359 return 0;
360
361 if (OBJ_bsearch_nid(&ex_nid, supported_nids,
362 sizeof(supported_nids) / sizeof(int)))
363 return 1;
364 return 0;
365}
366
367static void
368setup_dp(X509 *x, DIST_POINT *dp)
369{
370 X509_NAME *iname = NULL;
371 int i;
372
373 if (dp->reasons) {
374 if (dp->reasons->length > 0)
375 dp->dp_reasons = dp->reasons->data[0];
376 if (dp->reasons->length > 1)
377 dp->dp_reasons |= (dp->reasons->data[1] << 8);
378 dp->dp_reasons &= CRLDP_ALL_REASONS;
379 } else
380 dp->dp_reasons = CRLDP_ALL_REASONS;
381 if (!dp->distpoint || (dp->distpoint->type != 1))
382 return;
383 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) {
384 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i);
385 if (gen->type == GEN_DIRNAME) {
386 iname = gen->d.directoryName;
387 break;
388 }
389 }
390 if (!iname)
391 iname = X509_get_issuer_name(x);
392
393 DIST_POINT_set_dpname(dp->distpoint, iname);
394
395}
396
397static void
398setup_crldp(X509 *x)
399{
400 int i;
401
402 x->crldp = X509_get_ext_d2i(x, NID_crl_distribution_points, NULL, NULL);
403 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++)
404 setup_dp(x, sk_DIST_POINT_value(x->crldp, i));
405}
406
407static void
408x509v3_cache_extensions(X509 *x)
409{
410 BASIC_CONSTRAINTS *bs;
411 PROXY_CERT_INFO_EXTENSION *pci;
412 ASN1_BIT_STRING *usage;
413 ASN1_BIT_STRING *ns;
414 EXTENDED_KEY_USAGE *extusage;
415 X509_EXTENSION *ex;
416
417 int i;
418 if (x->ex_flags & EXFLAG_SET)
419 return;
420#ifndef OPENSSL_NO_SHA
421 X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
422#endif
423 /* Does subject name match issuer ? */
424 if (!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
425 x->ex_flags |= EXFLAG_SI;
426 /* V1 should mean no extensions ... */
427 if (!X509_get_version(x))
428 x->ex_flags |= EXFLAG_V1;
429 /* Handle basic constraints */
430 if ((bs = X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
431 if (bs->ca)
432 x->ex_flags |= EXFLAG_CA;
433 if (bs->pathlen) {
434 if ((bs->pathlen->type == V_ASN1_NEG_INTEGER) ||
435 !bs->ca) {
436 x->ex_flags |= EXFLAG_INVALID;
437 x->ex_pathlen = 0;
438 } else
439 x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
440 } else
441 x->ex_pathlen = -1;
442 BASIC_CONSTRAINTS_free(bs);
443 x->ex_flags |= EXFLAG_BCONS;
444 }
445 /* Handle proxy certificates */
446 if ((pci = X509_get_ext_d2i(x, NID_proxyCertInfo, NULL, NULL))) {
447 if (x->ex_flags & EXFLAG_CA ||
448 X509_get_ext_by_NID(x, NID_subject_alt_name, -1) >= 0 ||
449 X509_get_ext_by_NID(x, NID_issuer_alt_name, -1) >= 0) {
450 x->ex_flags |= EXFLAG_INVALID;
451 }
452 if (pci->pcPathLengthConstraint) {
453 x->ex_pcpathlen =
454 ASN1_INTEGER_get(pci->pcPathLengthConstraint);
455 } else
456 x->ex_pcpathlen = -1;
457 PROXY_CERT_INFO_EXTENSION_free(pci);
458 x->ex_flags |= EXFLAG_PROXY;
459 }
460 /* Handle key usage */
461 if ((usage = X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
462 if (usage->length > 0) {
463 x->ex_kusage = usage->data[0];
464 if (usage->length > 1)
465 x->ex_kusage |= usage->data[1] << 8;
466 } else
467 x->ex_kusage = 0;
468 x->ex_flags |= EXFLAG_KUSAGE;
469 ASN1_BIT_STRING_free(usage);
470 }
471 x->ex_xkusage = 0;
472 if ((extusage = X509_get_ext_d2i(x, NID_ext_key_usage, NULL, NULL))) {
473 x->ex_flags |= EXFLAG_XKUSAGE;
474 for (i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
475 switch (OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage, i))) {
476 case NID_server_auth:
477 x->ex_xkusage |= XKU_SSL_SERVER;
478 break;
479
480 case NID_client_auth:
481 x->ex_xkusage |= XKU_SSL_CLIENT;
482 break;
483
484 case NID_email_protect:
485 x->ex_xkusage |= XKU_SMIME;
486 break;
487
488 case NID_code_sign:
489 x->ex_xkusage |= XKU_CODE_SIGN;
490 break;
491
492 case NID_ms_sgc:
493 case NID_ns_sgc:
494 x->ex_xkusage |= XKU_SGC;
495 break;
496
497 case NID_OCSP_sign:
498 x->ex_xkusage |= XKU_OCSP_SIGN;
499 break;
500
501 case NID_time_stamp:
502 x->ex_xkusage |= XKU_TIMESTAMP;
503 break;
504
505 case NID_dvcs:
506 x->ex_xkusage |= XKU_DVCS;
507 break;
508 }
509 }
510 sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
511 }
512
513 if ((ns = X509_get_ext_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
514 if (ns->length > 0)
515 x->ex_nscert = ns->data[0];
516 else
517 x->ex_nscert = 0;
518 x->ex_flags |= EXFLAG_NSCERT;
519 ASN1_BIT_STRING_free(ns);
520 }
521
522 x->skid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
523 x->akid = X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);
524 x->altname = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
525 x->nc = X509_get_ext_d2i(x, NID_name_constraints, &i, NULL);
526 if (!x->nc && (i != -1))
527 x->ex_flags |= EXFLAG_INVALID;
528 setup_crldp(x);
529
530 for (i = 0; i < X509_get_ext_count(x); i++) {
531 ex = X509_get_ext(x, i);
532 if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) ==
533 NID_freshest_crl)
534 x->ex_flags |= EXFLAG_FRESHEST;
535 if (!X509_EXTENSION_get_critical(ex))
536 continue;
537 if (!X509_supported_extension(ex)) {
538 x->ex_flags |= EXFLAG_CRITICAL;
539 break;
540 }
541 }
542 x->ex_flags |= EXFLAG_SET;
543}
544
545/* CA checks common to all purposes
546 * return codes:
547 * 0 not a CA
548 * 1 is a CA
549 * 2 basicConstraints absent so "maybe" a CA
550 * 3 basicConstraints absent but self signed V1.
551 * 4 basicConstraints absent but keyUsage present and keyCertSign asserted.
552 */
553
554#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
555#define ku_reject(x, usage) \
556 (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
557#define xku_reject(x, usage) \
558 (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
559#define ns_reject(x, usage) \
560 (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
561
562static int
563check_ca(const X509 *x)
564{
565 /* keyUsage if present should allow cert signing */
566 if (ku_reject(x, KU_KEY_CERT_SIGN))
567 return 0;
568 if (x->ex_flags & EXFLAG_BCONS) {
569 if (x->ex_flags & EXFLAG_CA)
570 return 1;
571 /* If basicConstraints says not a CA then say so */
572 else
573 return 0;
574 } else {
575 /* we support V1 roots for... uh, I don't really know why. */
576 if ((x->ex_flags & V1_ROOT) == V1_ROOT)
577 return 3;
578 /* If key usage present it must have certSign so tolerate it */
579 else if (x->ex_flags & EXFLAG_KUSAGE)
580 return 4;
581 /* Older certificates could have Netscape-specific CA types */
582 else if (x->ex_flags & EXFLAG_NSCERT &&
583 x->ex_nscert & NS_ANY_CA)
584 return 5;
585 /* can this still be regarded a CA certificate? I doubt it */
586 return 0;
587 }
588}
589
590int
591X509_check_ca(X509 *x)
592{
593 if (!(x->ex_flags & EXFLAG_SET)) {
594 CRYPTO_w_lock(CRYPTO_LOCK_X509);
595 x509v3_cache_extensions(x);
596 CRYPTO_w_unlock(CRYPTO_LOCK_X509);
597 }
598
599 return check_ca(x);
600}
601
602/* Check SSL CA: common checks for SSL client and server */
603static int
604check_ssl_ca(const X509 *x)
605{
606 int ca_ret;
607
608 ca_ret = check_ca(x);
609 if (!ca_ret)
610 return 0;
611 /* check nsCertType if present */
612 if (ca_ret != 5 || x->ex_nscert & NS_SSL_CA)
613 return ca_ret;
614 else
615 return 0;
616}
617
618static int
619check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca)
620{
621 if (xku_reject(x, XKU_SSL_CLIENT))
622 return 0;
623 if (ca)
624 return check_ssl_ca(x);
625 /* We need to do digital signatures with it */
626 if (ku_reject(x, KU_DIGITAL_SIGNATURE))
627 return 0;
628 /* nsCertType if present should allow SSL client use */
629 if (ns_reject(x, NS_SSL_CLIENT))
630 return 0;
631 return 1;
632}
633
634static int
635check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)
636{
637 if (xku_reject(x, XKU_SSL_SERVER|XKU_SGC))
638 return 0;
639 if (ca)
640 return check_ssl_ca(x);
641
642 if (ns_reject(x, NS_SSL_SERVER))
643 return 0;
644 /* Now as for keyUsage: we'll at least need to sign OR encipher */
645 if (ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT))
646 return 0;
647
648 return 1;
649}
650
651static int
652check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)
653{
654 int ret;
655
656 ret = check_purpose_ssl_server(xp, x, ca);
657 if (!ret || ca)
658 return ret;
659 /* We need to encipher or Netscape complains */
660 if (ku_reject(x, KU_KEY_ENCIPHERMENT))
661 return 0;
662 return ret;
663}
664
665/* common S/MIME checks */
666static int
667purpose_smime(const X509 *x, int ca)
668{
669 if (xku_reject(x, XKU_SMIME))
670 return 0;
671 if (ca) {
672 int ca_ret;
673 ca_ret = check_ca(x);
674 if (!ca_ret)
675 return 0;
676 /* check nsCertType if present */
677 if (ca_ret != 5 || x->ex_nscert & NS_SMIME_CA)
678 return ca_ret;
679 else
680 return 0;
681 }
682 if (x->ex_flags & EXFLAG_NSCERT) {
683 if (x->ex_nscert & NS_SMIME)
684 return 1;
685 /* Workaround for some buggy certificates */
686 if (x->ex_nscert & NS_SSL_CLIENT)
687 return 2;
688 return 0;
689 }
690 return 1;
691}
692
693static int
694check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
695{
696 int ret;
697
698 ret = purpose_smime(x, ca);
699 if (!ret || ca)
700 return ret;
701 if (ku_reject(x, KU_DIGITAL_SIGNATURE|KU_NON_REPUDIATION))
702 return 0;
703 return ret;
704}
705
706static int
707check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca)
708{
709 int ret;
710
711 ret = purpose_smime(x, ca);
712 if (!ret || ca)
713 return ret;
714 if (ku_reject(x, KU_KEY_ENCIPHERMENT))
715 return 0;
716 return ret;
717}
718
719static int
720check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
721{
722 if (ca) {
723 int ca_ret;
724 if ((ca_ret = check_ca(x)) != 2)
725 return ca_ret;
726 else
727 return 0;
728 }
729 if (ku_reject(x, KU_CRL_SIGN))
730 return 0;
731 return 1;
732}
733
734/* OCSP helper: this is *not* a full OCSP check. It just checks that
735 * each CA is valid. Additional checks must be made on the chain.
736 */
737static int
738ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca)
739{
740 /* Must be a valid CA. Should we really support the "I don't know"
741 value (2)? */
742 if (ca)
743 return check_ca(x);
744 /* leaf certificate is checked in OCSP_verify() */
745 return 1;
746}
747
748static int
749check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
750{
751 int i_ext;
752
753 /* If ca is true we must return if this is a valid CA certificate. */
754 if (ca)
755 return check_ca(x);
756
757 /*
758 * Check the optional key usage field:
759 * if Key Usage is present, it must be one of digitalSignature
760 * and/or nonRepudiation (other values are not consistent and shall
761 * be rejected).
762 */
763 if ((x->ex_flags & EXFLAG_KUSAGE) &&
764 ((x->ex_kusage & ~(KU_NON_REPUDIATION | KU_DIGITAL_SIGNATURE)) ||
765 !(x->ex_kusage & (KU_NON_REPUDIATION | KU_DIGITAL_SIGNATURE))))
766 return 0;
767
768 /* Only time stamp key usage is permitted and it's required. */
769 if (!(x->ex_flags & EXFLAG_XKUSAGE) || x->ex_xkusage != XKU_TIMESTAMP)
770 return 0;
771
772 /* Extended Key Usage MUST be critical */
773 i_ext = X509_get_ext_by_NID((X509 *) x, NID_ext_key_usage, -1);
774 if (i_ext >= 0) {
775 X509_EXTENSION *ext = X509_get_ext((X509 *) x, i_ext);
776 if (!X509_EXTENSION_get_critical(ext))
777 return 0;
778 }
779
780 return 1;
781}
782
783static int
784no_check(const X509_PURPOSE *xp, const X509 *x, int ca)
785{
786 return 1;
787}
788
789/* Various checks to see if one certificate issued the second.
790 * This can be used to prune a set of possible issuer certificates
791 * which have been looked up using some simple method such as by
792 * subject name.
793 * These are:
794 * 1. Check issuer_name(subject) == subject_name(issuer)
795 * 2. If akid(subject) exists check it matches issuer
796 * 3. If key_usage(issuer) exists check it supports certificate signing
797 * returns 0 for OK, positive for reason for mismatch, reasons match
798 * codes for X509_verify_cert()
799 */
800
801int
802X509_check_issued(X509 *issuer, X509 *subject)
803{
804 if (X509_NAME_cmp(X509_get_subject_name(issuer),
805 X509_get_issuer_name(subject)))
806 return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
807 x509v3_cache_extensions(issuer);
808 x509v3_cache_extensions(subject);
809
810 if (subject->akid) {
811 int ret = X509_check_akid(issuer, subject->akid);
812 if (ret != X509_V_OK)
813 return ret;
814 }
815
816 if (subject->ex_flags & EXFLAG_PROXY) {
817 if (ku_reject(issuer, KU_DIGITAL_SIGNATURE))
818 return X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE;
819 } else if (ku_reject(issuer, KU_KEY_CERT_SIGN))
820 return X509_V_ERR_KEYUSAGE_NO_CERTSIGN;
821 return X509_V_OK;
822}
823
824int
825X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid)
826{
827 if (!akid)
828 return X509_V_OK;
829
830 /* Check key ids (if present) */
831 if (akid->keyid && issuer->skid &&
832 ASN1_OCTET_STRING_cmp(akid->keyid, issuer->skid) )
833 return X509_V_ERR_AKID_SKID_MISMATCH;
834 /* Check serial number */
835 if (akid->serial &&
836 ASN1_INTEGER_cmp(X509_get_serialNumber(issuer), akid->serial))
837 return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
838 /* Check issuer name */
839 if (akid->issuer) {
840 /* Ugh, for some peculiar reason AKID includes
841 * SEQUENCE OF GeneralName. So look for a DirName.
842 * There may be more than one but we only take any
843 * notice of the first.
844 */
845 GENERAL_NAMES *gens;
846 GENERAL_NAME *gen;
847 X509_NAME *nm = NULL;
848 int i;
849 gens = akid->issuer;
850 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
851 gen = sk_GENERAL_NAME_value(gens, i);
852 if (gen->type == GEN_DIRNAME) {
853 nm = gen->d.dirn;
854 break;
855 }
856 }
857 if (nm && X509_NAME_cmp(nm, X509_get_issuer_name(issuer)))
858 return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
859 }
860 return X509_V_OK;
861}
diff --git a/src/lib/libcrypto/x509v3/v3_skey.c b/src/lib/libcrypto/x509v3/v3_skey.c
deleted file mode 100644
index f742b67b33..0000000000
--- a/src/lib/libcrypto/x509v3/v3_skey.c
+++ /dev/null
@@ -1,160 +0,0 @@
1/* $OpenBSD: v3_skey.c,v 1.13 2015/09/30 18:41:06 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/x509v3.h>
64
65static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
66 X509V3_CTX *ctx, char *str);
67
68const X509V3_EXT_METHOD v3_skey_id = {
69 .ext_nid = NID_subject_key_identifier,
70 .ext_flags = 0,
71 .it = ASN1_ITEM_ref(ASN1_OCTET_STRING),
72 .ext_new = NULL,
73 .ext_free = NULL,
74 .d2i = NULL,
75 .i2d = NULL,
76 .i2s = (X509V3_EXT_I2S)i2s_ASN1_OCTET_STRING,
77 .s2i = (X509V3_EXT_S2I)s2i_skey_id,
78 .i2v = NULL,
79 .v2i = NULL,
80 .i2r = NULL,
81 .r2i = NULL,
82 .usr_data = NULL,
83};
84
85char *
86i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct)
87{
88 return hex_to_string(oct->data, oct->length);
89}
90
91ASN1_OCTET_STRING *
92s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str)
93{
94 ASN1_OCTET_STRING *oct;
95 long length;
96
97 if (!(oct = ASN1_OCTET_STRING_new())) {
98 X509V3err(X509V3_F_S2I_ASN1_OCTET_STRING, ERR_R_MALLOC_FAILURE);
99 return NULL;
100 }
101
102 if (!(oct->data = string_to_hex(str, &length))) {
103 ASN1_OCTET_STRING_free(oct);
104 return NULL;
105 }
106
107 oct->length = length;
108
109 return oct;
110}
111
112static ASN1_OCTET_STRING *
113s2i_skey_id(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str)
114{
115 ASN1_OCTET_STRING *oct;
116 ASN1_BIT_STRING *pk;
117 unsigned char pkey_dig[EVP_MAX_MD_SIZE];
118 unsigned int diglen;
119
120 if (strcmp(str, "hash"))
121 return s2i_ASN1_OCTET_STRING(method, ctx, str);
122
123 if (!(oct = ASN1_OCTET_STRING_new())) {
124 X509V3err(X509V3_F_S2I_SKEY_ID, ERR_R_MALLOC_FAILURE);
125 return NULL;
126 }
127
128 if (ctx && (ctx->flags == CTX_TEST))
129 return oct;
130
131 if (!ctx || (!ctx->subject_req && !ctx->subject_cert)) {
132 X509V3err(X509V3_F_S2I_SKEY_ID, X509V3_R_NO_PUBLIC_KEY);
133 goto err;
134 }
135
136 if (ctx->subject_req)
137 pk = ctx->subject_req->req_info->pubkey->public_key;
138 else
139 pk = ctx->subject_cert->cert_info->key->public_key;
140
141 if (!pk) {
142 X509V3err(X509V3_F_S2I_SKEY_ID, X509V3_R_NO_PUBLIC_KEY);
143 goto err;
144 }
145
146 if (!EVP_Digest(pk->data, pk->length, pkey_dig, &diglen,
147 EVP_sha1(), NULL))
148 goto err;
149
150 if (!ASN1_STRING_set(oct, pkey_dig, diglen)) {
151 X509V3err(X509V3_F_S2I_SKEY_ID, ERR_R_MALLOC_FAILURE);
152 goto err;
153 }
154
155 return oct;
156
157err:
158 ASN1_OCTET_STRING_free(oct);
159 return NULL;
160}
diff --git a/src/lib/libcrypto/x509v3/v3_sxnet.c b/src/lib/libcrypto/x509v3/v3_sxnet.c
deleted file mode 100644
index 29976b1d68..0000000000
--- a/src/lib/libcrypto/x509v3/v3_sxnet.c
+++ /dev/null
@@ -1,386 +0,0 @@
1/* $OpenBSD: v3_sxnet.c,v 1.17 2015/09/30 17:30:16 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/asn1t.h>
64#include <openssl/conf.h>
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68/* Support for Thawte strong extranet extension */
69
70#define SXNET_TEST
71
72static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
73 int indent);
74#ifdef SXNET_TEST
75static SXNET * sxnet_v2i(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
76 STACK_OF(CONF_VALUE) *nval);
77#endif
78
79const X509V3_EXT_METHOD v3_sxnet = {
80 .ext_nid = NID_sxnet,
81 .ext_flags = X509V3_EXT_MULTILINE,
82 .it = ASN1_ITEM_ref(SXNET),
83 .ext_new = NULL,
84 .ext_free = NULL,
85 .d2i = NULL,
86 .i2d = NULL,
87 .i2s = NULL,
88 .s2i = NULL,
89 .i2v = NULL,
90#ifdef SXNET_TEST
91 .v2i = (X509V3_EXT_V2I)sxnet_v2i,
92#else
93 .v2i = NULL,
94#endif
95 .i2r = (X509V3_EXT_I2R)sxnet_i2r,
96 .r2i = NULL,
97 .usr_data = NULL,
98};
99
100static const ASN1_TEMPLATE SXNETID_seq_tt[] = {
101 {
102 .flags = 0,
103 .tag = 0,
104 .offset = offsetof(SXNETID, zone),
105 .field_name = "zone",
106 .item = &ASN1_INTEGER_it,
107 },
108 {
109 .flags = 0,
110 .tag = 0,
111 .offset = offsetof(SXNETID, user),
112 .field_name = "user",
113 .item = &ASN1_OCTET_STRING_it,
114 },
115};
116
117const ASN1_ITEM SXNETID_it = {
118 .itype = ASN1_ITYPE_SEQUENCE,
119 .utype = V_ASN1_SEQUENCE,
120 .templates = SXNETID_seq_tt,
121 .tcount = sizeof(SXNETID_seq_tt) / sizeof(ASN1_TEMPLATE),
122 .funcs = NULL,
123 .size = sizeof(SXNETID),
124 .sname = "SXNETID",
125};
126
127
128SXNETID *
129d2i_SXNETID(SXNETID **a, const unsigned char **in, long len)
130{
131 return (SXNETID *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
132 &SXNETID_it);
133}
134
135int
136i2d_SXNETID(SXNETID *a, unsigned char **out)
137{
138 return ASN1_item_i2d((ASN1_VALUE *)a, out, &SXNETID_it);
139}
140
141SXNETID *
142SXNETID_new(void)
143{
144 return (SXNETID *)ASN1_item_new(&SXNETID_it);
145}
146
147void
148SXNETID_free(SXNETID *a)
149{
150 ASN1_item_free((ASN1_VALUE *)a, &SXNETID_it);
151}
152
153static const ASN1_TEMPLATE SXNET_seq_tt[] = {
154 {
155 .flags = 0,
156 .tag = 0,
157 .offset = offsetof(SXNET, version),
158 .field_name = "version",
159 .item = &ASN1_INTEGER_it,
160 },
161 {
162 .flags = ASN1_TFLG_SEQUENCE_OF,
163 .tag = 0,
164 .offset = offsetof(SXNET, ids),
165 .field_name = "ids",
166 .item = &SXNETID_it,
167 },
168};
169
170const ASN1_ITEM SXNET_it = {
171 .itype = ASN1_ITYPE_SEQUENCE,
172 .utype = V_ASN1_SEQUENCE,
173 .templates = SXNET_seq_tt,
174 .tcount = sizeof(SXNET_seq_tt) / sizeof(ASN1_TEMPLATE),
175 .funcs = NULL,
176 .size = sizeof(SXNET),
177 .sname = "SXNET",
178};
179
180
181SXNET *
182d2i_SXNET(SXNET **a, const unsigned char **in, long len)
183{
184 return (SXNET *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
185 &SXNET_it);
186}
187
188int
189i2d_SXNET(SXNET *a, unsigned char **out)
190{
191 return ASN1_item_i2d((ASN1_VALUE *)a, out, &SXNET_it);
192}
193
194SXNET *
195SXNET_new(void)
196{
197 return (SXNET *)ASN1_item_new(&SXNET_it);
198}
199
200void
201SXNET_free(SXNET *a)
202{
203 ASN1_item_free((ASN1_VALUE *)a, &SXNET_it);
204}
205
206static int
207sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out, int indent)
208{
209 long v;
210 char *tmp;
211 SXNETID *id;
212 int i;
213
214 v = ASN1_INTEGER_get(sx->version);
215 BIO_printf(out, "%*sVersion: %ld (0x%lX)", indent, "", v + 1, v);
216 for (i = 0; i < sk_SXNETID_num(sx->ids); i++) {
217 id = sk_SXNETID_value(sx->ids, i);
218 tmp = i2s_ASN1_INTEGER(NULL, id->zone);
219 BIO_printf(out, "\n%*sZone: %s, User: ", indent, "", tmp);
220 free(tmp);
221 ASN1_STRING_print(out, id->user);
222 }
223 return 1;
224}
225
226#ifdef SXNET_TEST
227
228/* NBB: this is used for testing only. It should *not* be used for anything
229 * else because it will just take static IDs from the configuration file and
230 * they should really be separate values for each user.
231 */
232
233static SXNET *
234sxnet_v2i(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
235 STACK_OF(CONF_VALUE) *nval)
236{
237 CONF_VALUE *cnf;
238 SXNET *sx = NULL;
239 int i;
240
241 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
242 cnf = sk_CONF_VALUE_value(nval, i);
243 if (!SXNET_add_id_asc(&sx, cnf->name, cnf->value, -1))
244 return NULL;
245 }
246 return sx;
247}
248
249#endif
250
251/* Strong Extranet utility functions */
252
253/* Add an id given the zone as an ASCII number */
254
255int
256SXNET_add_id_asc(SXNET **psx, char *zone, char *user, int userlen)
257{
258 ASN1_INTEGER *izone = NULL;
259
260 if (!(izone = s2i_ASN1_INTEGER(NULL, zone))) {
261 X509V3err(X509V3_F_SXNET_ADD_ID_ASC,
262 X509V3_R_ERROR_CONVERTING_ZONE);
263 return 0;
264 }
265 return SXNET_add_id_INTEGER(psx, izone, user, userlen);
266}
267
268/* Add an id given the zone as an unsigned long */
269
270int
271SXNET_add_id_ulong(SXNET **psx, unsigned long lzone, char *user, int userlen)
272{
273 ASN1_INTEGER *izone = NULL;
274
275 if (!(izone = ASN1_INTEGER_new()) ||
276 !ASN1_INTEGER_set(izone, lzone)) {
277 X509V3err(X509V3_F_SXNET_ADD_ID_ULONG, ERR_R_MALLOC_FAILURE);
278 ASN1_INTEGER_free(izone);
279 return 0;
280 }
281 return SXNET_add_id_INTEGER(psx, izone, user, userlen);
282}
283
284/* Add an id given the zone as an ASN1_INTEGER.
285 * Note this version uses the passed integer and doesn't make a copy so don't
286 * free it up afterwards.
287 */
288
289int
290SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *zone, char *user, int userlen)
291{
292 SXNET *sx = NULL;
293 SXNETID *id = NULL;
294
295 if (!psx || !zone || !user) {
296 X509V3err(X509V3_F_SXNET_ADD_ID_INTEGER,
297 X509V3_R_INVALID_NULL_ARGUMENT);
298 return 0;
299 }
300 if (userlen == -1)
301 userlen = strlen(user);
302 if (userlen > 64) {
303 X509V3err(X509V3_F_SXNET_ADD_ID_INTEGER,
304 X509V3_R_USER_TOO_LONG);
305 return 0;
306 }
307 if (!*psx) {
308 if (!(sx = SXNET_new()))
309 goto err;
310 if (!ASN1_INTEGER_set(sx->version, 0))
311 goto err;
312 *psx = sx;
313 } else
314 sx = *psx;
315 if (SXNET_get_id_INTEGER(sx, zone)) {
316 X509V3err(X509V3_F_SXNET_ADD_ID_INTEGER,
317 X509V3_R_DUPLICATE_ZONE_ID);
318 return 0;
319 }
320
321 if (!(id = SXNETID_new()))
322 goto err;
323 if (userlen == -1)
324 userlen = strlen(user);
325
326 if (!ASN1_STRING_set(id->user, user, userlen))
327 goto err;
328 if (!sk_SXNETID_push(sx->ids, id))
329 goto err;
330 id->zone = zone;
331 return 1;
332
333err:
334 X509V3err(X509V3_F_SXNET_ADD_ID_INTEGER, ERR_R_MALLOC_FAILURE);
335 SXNETID_free(id);
336 SXNET_free(sx);
337 *psx = NULL;
338 return 0;
339}
340
341ASN1_OCTET_STRING *
342SXNET_get_id_asc(SXNET *sx, char *zone)
343{
344 ASN1_INTEGER *izone = NULL;
345 ASN1_OCTET_STRING *oct;
346
347 if (!(izone = s2i_ASN1_INTEGER(NULL, zone))) {
348 X509V3err(X509V3_F_SXNET_GET_ID_ASC,
349 X509V3_R_ERROR_CONVERTING_ZONE);
350 return NULL;
351 }
352 oct = SXNET_get_id_INTEGER(sx, izone);
353 ASN1_INTEGER_free(izone);
354 return oct;
355}
356
357ASN1_OCTET_STRING *
358SXNET_get_id_ulong(SXNET *sx, unsigned long lzone)
359{
360 ASN1_INTEGER *izone = NULL;
361 ASN1_OCTET_STRING *oct;
362
363 if (!(izone = ASN1_INTEGER_new()) ||
364 !ASN1_INTEGER_set(izone, lzone)) {
365 X509V3err(X509V3_F_SXNET_GET_ID_ULONG, ERR_R_MALLOC_FAILURE);
366 ASN1_INTEGER_free(izone);
367 return NULL;
368 }
369 oct = SXNET_get_id_INTEGER(sx, izone);
370 ASN1_INTEGER_free(izone);
371 return oct;
372}
373
374ASN1_OCTET_STRING *
375SXNET_get_id_INTEGER(SXNET *sx, ASN1_INTEGER *zone)
376{
377 SXNETID *id;
378 int i;
379
380 for (i = 0; i < sk_SXNETID_num(sx->ids); i++) {
381 id = sk_SXNETID_value(sx->ids, i);
382 if (!ASN1_STRING_cmp(id->zone, zone))
383 return id->user;
384 }
385 return NULL;
386}
diff --git a/src/lib/libcrypto/x509v3/v3_utl.c b/src/lib/libcrypto/x509v3/v3_utl.c
deleted file mode 100644
index ee135a0b52..0000000000
--- a/src/lib/libcrypto/x509v3/v3_utl.c
+++ /dev/null
@@ -1,925 +0,0 @@
1/* $OpenBSD: v3_utl.c,v 1.24 2015/02/07 13:19:15 doug Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58/* X509 v3 extension utilities */
59
60#include <ctype.h>
61#include <stdio.h>
62#include <string.h>
63
64#include <openssl/bn.h>
65#include <openssl/conf.h>
66#include <openssl/err.h>
67#include <openssl/x509v3.h>
68
69static char *strip_spaces(char *name);
70static int sk_strcmp(const char * const *a, const char * const *b);
71static STACK_OF(OPENSSL_STRING) *get_email(X509_NAME *name,
72 GENERAL_NAMES *gens);
73static void str_free(OPENSSL_STRING str);
74static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, ASN1_IA5STRING *email);
75
76static int ipv4_from_asc(unsigned char *v4, const char *in);
77static int ipv6_from_asc(unsigned char *v6, const char *in);
78static int ipv6_cb(const char *elem, int len, void *usr);
79static int ipv6_hex(unsigned char *out, const char *in, int inlen);
80
81/* Add a CONF_VALUE name value pair to stack */
82
83int
84X509V3_add_value(const char *name, const char *value,
85 STACK_OF(CONF_VALUE) **extlist)
86{
87 CONF_VALUE *vtmp = NULL;
88 char *tname = NULL, *tvalue = NULL;
89
90 if (name && !(tname = strdup(name)))
91 goto err;
92 if (value && !(tvalue = strdup(value)))
93 goto err;
94 if (!(vtmp = malloc(sizeof(CONF_VALUE))))
95 goto err;
96 if (!*extlist && !(*extlist = sk_CONF_VALUE_new_null()))
97 goto err;
98 vtmp->section = NULL;
99 vtmp->name = tname;
100 vtmp->value = tvalue;
101 if (!sk_CONF_VALUE_push(*extlist, vtmp))
102 goto err;
103 return 1;
104
105err:
106 X509V3err(X509V3_F_X509V3_ADD_VALUE, ERR_R_MALLOC_FAILURE);
107 free(vtmp);
108 free(tname);
109 free(tvalue);
110 return 0;
111}
112
113int
114X509V3_add_value_uchar(const char *name, const unsigned char *value,
115 STACK_OF(CONF_VALUE) **extlist)
116{
117 return X509V3_add_value(name, (const char *)value, extlist);
118}
119
120/* Free function for STACK_OF(CONF_VALUE) */
121
122void
123X509V3_conf_free(CONF_VALUE *conf)
124{
125 if (!conf)
126 return;
127 free(conf->name);
128 free(conf->value);
129 free(conf->section);
130 free(conf);
131}
132
133int
134X509V3_add_value_bool(const char *name, int asn1_bool,
135 STACK_OF(CONF_VALUE) **extlist)
136{
137 if (asn1_bool)
138 return X509V3_add_value(name, "TRUE", extlist);
139 return X509V3_add_value(name, "FALSE", extlist);
140}
141
142int
143X509V3_add_value_bool_nf(char *name, int asn1_bool,
144 STACK_OF(CONF_VALUE) **extlist)
145{
146 if (asn1_bool)
147 return X509V3_add_value(name, "TRUE", extlist);
148 return 1;
149}
150
151
152char *
153i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *method, ASN1_ENUMERATED *a)
154{
155 BIGNUM *bntmp = NULL;
156 char *strtmp = NULL;
157
158 if (!a)
159 return NULL;
160 if (!(bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) ||
161 !(strtmp = BN_bn2dec(bntmp)))
162 X509V3err(X509V3_F_I2S_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);
163 BN_free(bntmp);
164 return strtmp;
165}
166
167char *
168i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, ASN1_INTEGER *a)
169{
170 BIGNUM *bntmp = NULL;
171 char *strtmp = NULL;
172
173 if (!a)
174 return NULL;
175 if (!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||
176 !(strtmp = BN_bn2dec(bntmp)))
177 X509V3err(X509V3_F_I2S_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
178 BN_free(bntmp);
179 return strtmp;
180}
181
182ASN1_INTEGER *
183s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
184{
185 BIGNUM *bn = NULL;
186 ASN1_INTEGER *aint;
187 int isneg, ishex;
188 int ret;
189
190 if (!value) {
191 X509V3err(X509V3_F_S2I_ASN1_INTEGER,
192 X509V3_R_INVALID_NULL_VALUE);
193 return 0;
194 }
195 bn = BN_new();
196 if (value[0] == '-') {
197 value++;
198 isneg = 1;
199 } else
200 isneg = 0;
201
202 if (value[0] == '0' && ((value[1] == 'x') || (value[1] == 'X'))) {
203 value += 2;
204 ishex = 1;
205 } else
206 ishex = 0;
207
208 if (ishex)
209 ret = BN_hex2bn(&bn, value);
210 else
211 ret = BN_dec2bn(&bn, value);
212
213 if (!ret || value[ret]) {
214 BN_free(bn);
215 X509V3err(X509V3_F_S2I_ASN1_INTEGER, X509V3_R_BN_DEC2BN_ERROR);
216 return 0;
217 }
218
219 if (isneg && BN_is_zero(bn))
220 isneg = 0;
221
222 aint = BN_to_ASN1_INTEGER(bn, NULL);
223 BN_free(bn);
224 if (!aint) {
225 X509V3err(X509V3_F_S2I_ASN1_INTEGER,
226 X509V3_R_BN_TO_ASN1_INTEGER_ERROR);
227 return 0;
228 }
229 if (isneg)
230 aint->type |= V_ASN1_NEG;
231 return aint;
232}
233
234int
235X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
236 STACK_OF(CONF_VALUE) **extlist)
237{
238 char *strtmp;
239 int ret;
240
241 if (!aint)
242 return 1;
243 if (!(strtmp = i2s_ASN1_INTEGER(NULL, aint)))
244 return 0;
245 ret = X509V3_add_value(name, strtmp, extlist);
246 free(strtmp);
247 return ret;
248}
249
250int
251X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool)
252{
253 char *btmp;
254
255 if (!(btmp = value->value))
256 goto err;
257 if (!strcmp(btmp, "TRUE") || !strcmp(btmp, "true") ||
258 !strcmp(btmp, "Y") || !strcmp(btmp, "y") ||
259 !strcmp(btmp, "YES") || !strcmp(btmp, "yes")) {
260 *asn1_bool = 0xff;
261 return 1;
262 } else if (!strcmp(btmp, "FALSE") || !strcmp(btmp, "false") ||
263 !strcmp(btmp, "N") || !strcmp(btmp, "n") ||
264 !strcmp(btmp, "NO") || !strcmp(btmp, "no")) {
265 *asn1_bool = 0;
266 return 1;
267 }
268
269err:
270 X509V3err(X509V3_F_X509V3_GET_VALUE_BOOL,
271 X509V3_R_INVALID_BOOLEAN_STRING);
272 X509V3_conf_err(value);
273 return 0;
274}
275
276int
277X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint)
278{
279 ASN1_INTEGER *itmp;
280
281 if (!(itmp = s2i_ASN1_INTEGER(NULL, value->value))) {
282 X509V3_conf_err(value);
283 return 0;
284 }
285 *aint = itmp;
286 return 1;
287}
288
289#define HDR_NAME 1
290#define HDR_VALUE 2
291
292/*#define DEBUG*/
293
294STACK_OF(CONF_VALUE) *
295X509V3_parse_list(const char *line)
296{
297 char *p, *q, c;
298 char *ntmp, *vtmp;
299 STACK_OF(CONF_VALUE) *values = NULL;
300 char *linebuf;
301 int state;
302
303 /* We are going to modify the line so copy it first */
304 if ((linebuf = strdup(line)) == NULL) {
305 X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);
306 goto err;
307 }
308 state = HDR_NAME;
309 ntmp = NULL;
310
311 /* Go through all characters */
312 for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') &&
313 (c != '\n'); p++) {
314
315 switch (state) {
316 case HDR_NAME:
317 if (c == ':') {
318 state = HDR_VALUE;
319 *p = 0;
320 ntmp = strip_spaces(q);
321 if (!ntmp) {
322 X509V3err(X509V3_F_X509V3_PARSE_LIST,
323 X509V3_R_INVALID_NULL_NAME);
324 goto err;
325 }
326 q = p + 1;
327 } else if (c == ',') {
328 *p = 0;
329 ntmp = strip_spaces(q);
330 q = p + 1;
331 if (!ntmp) {
332 X509V3err(X509V3_F_X509V3_PARSE_LIST,
333 X509V3_R_INVALID_NULL_NAME);
334 goto err;
335 }
336 X509V3_add_value(ntmp, NULL, &values);
337 }
338 break;
339
340 case HDR_VALUE:
341 if (c == ',') {
342 state = HDR_NAME;
343 *p = 0;
344 vtmp = strip_spaces(q);
345 if (!vtmp) {
346 X509V3err(X509V3_F_X509V3_PARSE_LIST,
347 X509V3_R_INVALID_NULL_VALUE);
348 goto err;
349 }
350 X509V3_add_value(ntmp, vtmp, &values);
351 ntmp = NULL;
352 q = p + 1;
353 }
354
355 }
356 }
357
358 if (state == HDR_VALUE) {
359 vtmp = strip_spaces(q);
360 if (!vtmp) {
361 X509V3err(X509V3_F_X509V3_PARSE_LIST,
362 X509V3_R_INVALID_NULL_VALUE);
363 goto err;
364 }
365 X509V3_add_value(ntmp, vtmp, &values);
366 } else {
367 ntmp = strip_spaces(q);
368 if (!ntmp) {
369 X509V3err(X509V3_F_X509V3_PARSE_LIST,
370 X509V3_R_INVALID_NULL_NAME);
371 goto err;
372 }
373 X509V3_add_value(ntmp, NULL, &values);
374 }
375 free(linebuf);
376 return values;
377
378err:
379 free(linebuf);
380 sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
381 return NULL;
382
383}
384
385/* Delete leading and trailing spaces from a string */
386static char *
387strip_spaces(char *name)
388{
389 char *p, *q;
390
391 /* Skip over leading spaces */
392 p = name;
393 while (*p && isspace((unsigned char)*p))
394 p++;
395 if (!*p)
396 return NULL;
397 q = p + strlen(p) - 1;
398 while ((q != p) && isspace((unsigned char)*q))
399 q--;
400 if (p != q)
401 q[1] = 0;
402 if (!*p)
403 return NULL;
404 return p;
405}
406
407/* hex string utilities */
408
409/* Given a buffer of length 'len' return a malloc'ed string with its
410 * hex representation
411 */
412char *
413hex_to_string(const unsigned char *buffer, long len)
414{
415 char *tmp, *q;
416 const unsigned char *p;
417 int i;
418 static const char hexdig[] = "0123456789ABCDEF";
419
420 if (!buffer || !len)
421 return NULL;
422 if (!(tmp = malloc(len * 3 + 1))) {
423 X509V3err(X509V3_F_HEX_TO_STRING, ERR_R_MALLOC_FAILURE);
424 return NULL;
425 }
426 q = tmp;
427 for (i = 0, p = buffer; i < len; i++, p++) {
428 *q++ = hexdig[(*p >> 4) & 0xf];
429 *q++ = hexdig[*p & 0xf];
430 *q++ = ':';
431 }
432 q[-1] = 0;
433 return tmp;
434}
435
436/* Give a string of hex digits convert to
437 * a buffer
438 */
439
440unsigned char *
441string_to_hex(const char *str, long *len)
442{
443 unsigned char *hexbuf, *q;
444 unsigned char ch, cl, *p;
445 if (!str) {
446 X509V3err(X509V3_F_STRING_TO_HEX,
447 X509V3_R_INVALID_NULL_ARGUMENT);
448 return NULL;
449 }
450 if (!(hexbuf = malloc(strlen(str) >> 1)))
451 goto err;
452 for (p = (unsigned char *)str, q = hexbuf; *p; ) {
453 ch = *p++;
454 if (ch == ':')
455 continue;
456 cl = *p++;
457 if (!cl) {
458 X509V3err(X509V3_F_STRING_TO_HEX,
459 X509V3_R_ODD_NUMBER_OF_DIGITS);
460 free(hexbuf);
461 return NULL;
462 }
463 ch = tolower(ch);
464 cl = tolower(cl);
465
466 if ((ch >= '0') && (ch <= '9'))
467 ch -= '0';
468 else if ((ch >= 'a') && (ch <= 'f'))
469 ch -= 'a' - 10;
470 else
471 goto badhex;
472
473 if ((cl >= '0') && (cl <= '9'))
474 cl -= '0';
475 else if ((cl >= 'a') && (cl <= 'f'))
476 cl -= 'a' - 10;
477 else
478 goto badhex;
479
480 *q++ = (ch << 4) | cl;
481 }
482
483 if (len)
484 *len = q - hexbuf;
485
486 return hexbuf;
487
488err:
489 free(hexbuf);
490 X509V3err(X509V3_F_STRING_TO_HEX, ERR_R_MALLOC_FAILURE);
491 return NULL;
492
493badhex:
494 free(hexbuf);
495 X509V3err(X509V3_F_STRING_TO_HEX, X509V3_R_ILLEGAL_HEX_DIGIT);
496 return NULL;
497}
498
499/* V2I name comparison function: returns zero if 'name' matches
500 * cmp or cmp.*
501 */
502
503int
504name_cmp(const char *name, const char *cmp)
505{
506 int len, ret;
507 char c;
508
509 len = strlen(cmp);
510 if ((ret = strncmp(name, cmp, len)))
511 return ret;
512 c = name[len];
513 if (!c || (c=='.'))
514 return 0;
515 return 1;
516}
517
518static int
519sk_strcmp(const char * const *a, const char * const *b)
520{
521 return strcmp(*a, *b);
522}
523
524STACK_OF(OPENSSL_STRING) *X509_get1_email(X509 *x)
525{
526 GENERAL_NAMES *gens;
527 STACK_OF(OPENSSL_STRING) *ret;
528
529 gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
530 ret = get_email(X509_get_subject_name(x), gens);
531 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
532 return ret;
533}
534
535STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x)
536{
537 AUTHORITY_INFO_ACCESS *info;
538 STACK_OF(OPENSSL_STRING) *ret = NULL;
539 int i;
540
541 info = X509_get_ext_d2i(x, NID_info_access, NULL, NULL);
542 if (!info)
543 return NULL;
544 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++) {
545 ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
546 if (OBJ_obj2nid(ad->method) == NID_ad_OCSP) {
547 if (ad->location->type == GEN_URI) {
548 if (!append_ia5(&ret,
549 ad->location->d.uniformResourceIdentifier))
550 break;
551 }
552 }
553 }
554 AUTHORITY_INFO_ACCESS_free(info);
555 return ret;
556}
557
558STACK_OF(OPENSSL_STRING) *X509_REQ_get1_email(X509_REQ *x)
559{
560 GENERAL_NAMES *gens;
561 STACK_OF(X509_EXTENSION) *exts;
562 STACK_OF(OPENSSL_STRING) *ret;
563
564 exts = X509_REQ_get_extensions(x);
565 gens = X509V3_get_d2i(exts, NID_subject_alt_name, NULL, NULL);
566 ret = get_email(X509_REQ_get_subject_name(x), gens);
567 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
568 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
569 return ret;
570}
571
572
573static
574STACK_OF(OPENSSL_STRING) *get_email(X509_NAME *name, GENERAL_NAMES *gens)
575{
576 STACK_OF(OPENSSL_STRING) *ret = NULL;
577 X509_NAME_ENTRY *ne;
578 ASN1_IA5STRING *email;
579 GENERAL_NAME *gen;
580 int i;
581
582 /* Now add any email address(es) to STACK */
583 i = -1;
584
585 /* First supplied X509_NAME */
586 while ((i = X509_NAME_get_index_by_NID(name,
587 NID_pkcs9_emailAddress, i)) >= 0) {
588 ne = X509_NAME_get_entry(name, i);
589 email = X509_NAME_ENTRY_get_data(ne);
590 if (!append_ia5(&ret, email))
591 return NULL;
592 }
593 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
594 gen = sk_GENERAL_NAME_value(gens, i);
595 if (gen->type != GEN_EMAIL)
596 continue;
597 if (!append_ia5(&ret, gen->d.ia5))
598 return NULL;
599 }
600 return ret;
601}
602
603static void
604str_free(OPENSSL_STRING str)
605{
606 free(str);
607}
608
609static int
610append_ia5(STACK_OF(OPENSSL_STRING) **sk, ASN1_IA5STRING *email)
611{
612 char *emtmp;
613
614 /* First some sanity checks */
615 if (email->type != V_ASN1_IA5STRING)
616 return 1;
617 if (!email->data || !email->length)
618 return 1;
619 if (!*sk)
620 *sk = sk_OPENSSL_STRING_new(sk_strcmp);
621 if (!*sk)
622 return 0;
623 /* Don't add duplicates */
624 if (sk_OPENSSL_STRING_find(*sk, (char *)email->data) != -1)
625 return 1;
626 emtmp = strdup((char *)email->data);
627 if (!emtmp || !sk_OPENSSL_STRING_push(*sk, emtmp)) {
628 X509_email_free(*sk);
629 *sk = NULL;
630 return 0;
631 }
632 return 1;
633}
634
635void
636X509_email_free(STACK_OF(OPENSSL_STRING) *sk)
637{
638 sk_OPENSSL_STRING_pop_free(sk, str_free);
639}
640
641/* Convert IP addresses both IPv4 and IPv6 into an
642 * OCTET STRING compatible with RFC3280.
643 */
644
645ASN1_OCTET_STRING *
646a2i_IPADDRESS(const char *ipasc)
647{
648 unsigned char ipout[16];
649 ASN1_OCTET_STRING *ret;
650 int iplen;
651
652 /* If string contains a ':' assume IPv6 */
653
654 iplen = a2i_ipadd(ipout, ipasc);
655
656 if (!iplen)
657 return NULL;
658
659 ret = ASN1_OCTET_STRING_new();
660 if (!ret)
661 return NULL;
662 if (!ASN1_OCTET_STRING_set(ret, ipout, iplen)) {
663 ASN1_OCTET_STRING_free(ret);
664 return NULL;
665 }
666 return ret;
667}
668
669ASN1_OCTET_STRING *
670a2i_IPADDRESS_NC(const char *ipasc)
671{
672 ASN1_OCTET_STRING *ret = NULL;
673 unsigned char ipout[32];
674 char *iptmp = NULL, *p;
675 int iplen1, iplen2;
676
677 p = strchr(ipasc, '/');
678 if (!p)
679 return NULL;
680 iptmp = strdup(ipasc);
681 if (!iptmp)
682 return NULL;
683 p = iptmp + (p - ipasc);
684 *p++ = 0;
685
686 iplen1 = a2i_ipadd(ipout, iptmp);
687
688 if (!iplen1)
689 goto err;
690
691 iplen2 = a2i_ipadd(ipout + iplen1, p);
692
693 free(iptmp);
694 iptmp = NULL;
695
696 if (!iplen2 || (iplen1 != iplen2))
697 goto err;
698
699 ret = ASN1_OCTET_STRING_new();
700 if (!ret)
701 goto err;
702 if (!ASN1_OCTET_STRING_set(ret, ipout, iplen1 + iplen2))
703 goto err;
704
705 return ret;
706
707err:
708 free(iptmp);
709 if (ret)
710 ASN1_OCTET_STRING_free(ret);
711 return NULL;
712}
713
714
715int
716a2i_ipadd(unsigned char *ipout, const char *ipasc)
717{
718 /* If string contains a ':' assume IPv6 */
719
720 if (strchr(ipasc, ':')) {
721 if (!ipv6_from_asc(ipout, ipasc))
722 return 0;
723 return 16;
724 } else {
725 if (!ipv4_from_asc(ipout, ipasc))
726 return 0;
727 return 4;
728 }
729}
730
731static int
732ipv4_from_asc(unsigned char *v4, const char *in)
733{
734 int a0, a1, a2, a3;
735 if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
736 return 0;
737 if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255) ||
738 (a2 < 0) || (a2 > 255) || (a3 < 0) || (a3 > 255))
739 return 0;
740 v4[0] = a0;
741 v4[1] = a1;
742 v4[2] = a2;
743 v4[3] = a3;
744 return 1;
745}
746
747typedef struct {
748 /* Temporary store for IPV6 output */
749 unsigned char tmp[16];
750 /* Total number of bytes in tmp */
751 int total;
752 /* The position of a zero (corresponding to '::') */
753 int zero_pos;
754 /* Number of zeroes */
755 int zero_cnt;
756} IPV6_STAT;
757
758
759static int
760ipv6_from_asc(unsigned char *v6, const char *in)
761{
762 IPV6_STAT v6stat;
763
764 v6stat.total = 0;
765 v6stat.zero_pos = -1;
766 v6stat.zero_cnt = 0;
767
768 /* Treat the IPv6 representation as a list of values
769 * separated by ':'. The presence of a '::' will parse
770 * as one, two or three zero length elements.
771 */
772 if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
773 return 0;
774
775 /* Now for some sanity checks */
776
777 if (v6stat.zero_pos == -1) {
778 /* If no '::' must have exactly 16 bytes */
779 if (v6stat.total != 16)
780 return 0;
781 } else {
782 /* If '::' must have less than 16 bytes */
783 if (v6stat.total == 16)
784 return 0;
785 /* More than three zeroes is an error */
786 if (v6stat.zero_cnt > 3)
787 return 0;
788 /* Can only have three zeroes if nothing else present */
789 else if (v6stat.zero_cnt == 3) {
790 if (v6stat.total > 0)
791 return 0;
792 }
793 /* Can only have two zeroes if at start or end */
794 else if (v6stat.zero_cnt == 2) {
795 if ((v6stat.zero_pos != 0) &&
796 (v6stat.zero_pos != v6stat.total))
797 return 0;
798 } else
799 /* Can only have one zero if *not* start or end */
800 {
801 if ((v6stat.zero_pos == 0) ||
802 (v6stat.zero_pos == v6stat.total))
803 return 0;
804 }
805 }
806
807 /* Format result */
808
809 if (v6stat.zero_pos >= 0) {
810 /* Copy initial part */
811 memcpy(v6, v6stat.tmp, v6stat.zero_pos);
812 /* Zero middle */
813 memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
814 /* Copy final part */
815 if (v6stat.total != v6stat.zero_pos)
816 memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
817 v6stat.tmp + v6stat.zero_pos,
818 v6stat.total - v6stat.zero_pos);
819 } else
820 memcpy(v6, v6stat.tmp, 16);
821
822 return 1;
823}
824
825static int
826ipv6_cb(const char *elem, int len, void *usr)
827{
828 IPV6_STAT *s = usr;
829
830 /* Error if 16 bytes written */
831 if (s->total == 16)
832 return 0;
833 if (len == 0) {
834 /* Zero length element, corresponds to '::' */
835 if (s->zero_pos == -1)
836 s->zero_pos = s->total;
837 /* If we've already got a :: its an error */
838 else if (s->zero_pos != s->total)
839 return 0;
840 s->zero_cnt++;
841 } else {
842 /* If more than 4 characters could be final a.b.c.d form */
843 if (len > 4) {
844 /* Need at least 4 bytes left */
845 if (s->total > 12)
846 return 0;
847 /* Must be end of string */
848 if (elem[len])
849 return 0;
850 if (!ipv4_from_asc(s->tmp + s->total, elem))
851 return 0;
852 s->total += 4;
853 } else {
854 if (!ipv6_hex(s->tmp + s->total, elem, len))
855 return 0;
856 s->total += 2;
857 }
858 }
859 return 1;
860}
861
862/* Convert a string of up to 4 hex digits into the corresponding
863 * IPv6 form.
864 */
865
866static int
867ipv6_hex(unsigned char *out, const char *in, int inlen)
868{
869 unsigned char c;
870 unsigned int num = 0;
871
872 if (inlen > 4)
873 return 0;
874 while (inlen--) {
875 c = *in++;
876 num <<= 4;
877 if ((c >= '0') && (c <= '9'))
878 num |= c - '0';
879 else if ((c >= 'A') && (c <= 'F'))
880 num |= c - 'A' + 10;
881 else if ((c >= 'a') && (c <= 'f'))
882 num |= c - 'a' + 10;
883 else
884 return 0;
885 }
886 out[0] = num >> 8;
887 out[1] = num & 0xff;
888 return 1;
889}
890
891int
892X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
893 unsigned long chtype)
894{
895 CONF_VALUE *v;
896 int i, mval;
897 char *p, *type;
898
899 if (!nm)
900 return 0;
901
902 for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) {
903 v = sk_CONF_VALUE_value(dn_sk, i);
904 type = v->name;
905 /* Skip past any leading X. X: X, etc to allow for
906 * multiple instances
907 */
908 for (p = type; *p; p++)
909 if ((*p == ':') || (*p == ',') || (*p == '.')) {
910 p++;
911 if (*p)
912 type = p;
913 break;
914 }
915 if (*type == '+') {
916 mval = -1;
917 type++;
918 } else
919 mval = 0;
920 if (!X509_NAME_add_entry_by_txt(nm, type, chtype,
921 (unsigned char *) v->value, -1, -1, mval))
922 return 0;
923 }
924 return 1;
925}
diff --git a/src/lib/libcrypto/x509v3/v3err.c b/src/lib/libcrypto/x509v3/v3err.c
deleted file mode 100644
index a49632a069..0000000000
--- a/src/lib/libcrypto/x509v3/v3err.c
+++ /dev/null
@@ -1,226 +0,0 @@
1/* $OpenBSD: v3err.c,v 1.11 2014/07/10 22:45:58 jsing Exp $ */
2/* ====================================================================
3 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@OpenSSL.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 *
50 * This product includes cryptographic software written by Eric Young
51 * (eay@cryptsoft.com). This product includes software written by Tim
52 * Hudson (tjh@cryptsoft.com).
53 *
54 */
55
56/* NOTE: this file was auto generated by the mkerr.pl script: any changes
57 * made to it will be overwritten when the script next updates this file,
58 * only reason strings will be preserved.
59 */
60
61#include <stdio.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/err.h>
66#include <openssl/x509v3.h>
67
68/* BEGIN ERROR CODES */
69#ifndef OPENSSL_NO_ERR
70
71#define ERR_FUNC(func) ERR_PACK(ERR_LIB_X509V3,func,0)
72#define ERR_REASON(reason) ERR_PACK(ERR_LIB_X509V3,0,reason)
73
74static ERR_STRING_DATA X509V3_str_functs[] = {
75 {ERR_FUNC(X509V3_F_A2I_GENERAL_NAME), "A2I_GENERAL_NAME"},
76 {ERR_FUNC(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE), "ASIDENTIFIERCHOICE_CANONIZE"},
77 {ERR_FUNC(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL), "ASIDENTIFIERCHOICE_IS_CANONICAL"},
78 {ERR_FUNC(X509V3_F_COPY_EMAIL), "COPY_EMAIL"},
79 {ERR_FUNC(X509V3_F_COPY_ISSUER), "COPY_ISSUER"},
80 {ERR_FUNC(X509V3_F_DO_DIRNAME), "DO_DIRNAME"},
81 {ERR_FUNC(X509V3_F_DO_EXT_CONF), "DO_EXT_CONF"},
82 {ERR_FUNC(X509V3_F_DO_EXT_I2D), "DO_EXT_I2D"},
83 {ERR_FUNC(X509V3_F_DO_EXT_NCONF), "DO_EXT_NCONF"},
84 {ERR_FUNC(X509V3_F_DO_I2V_NAME_CONSTRAINTS), "DO_I2V_NAME_CONSTRAINTS"},
85 {ERR_FUNC(X509V3_F_GNAMES_FROM_SECTNAME), "GNAMES_FROM_SECTNAME"},
86 {ERR_FUNC(X509V3_F_HEX_TO_STRING), "hex_to_string"},
87 {ERR_FUNC(X509V3_F_I2S_ASN1_ENUMERATED), "i2s_ASN1_ENUMERATED"},
88 {ERR_FUNC(X509V3_F_I2S_ASN1_IA5STRING), "I2S_ASN1_IA5STRING"},
89 {ERR_FUNC(X509V3_F_I2S_ASN1_INTEGER), "i2s_ASN1_INTEGER"},
90 {ERR_FUNC(X509V3_F_I2V_AUTHORITY_INFO_ACCESS), "I2V_AUTHORITY_INFO_ACCESS"},
91 {ERR_FUNC(X509V3_F_NOTICE_SECTION), "NOTICE_SECTION"},
92 {ERR_FUNC(X509V3_F_NREF_NOS), "NREF_NOS"},
93 {ERR_FUNC(X509V3_F_POLICY_SECTION), "POLICY_SECTION"},
94 {ERR_FUNC(X509V3_F_PROCESS_PCI_VALUE), "PROCESS_PCI_VALUE"},
95 {ERR_FUNC(X509V3_F_R2I_CERTPOL), "R2I_CERTPOL"},
96 {ERR_FUNC(X509V3_F_R2I_PCI), "R2I_PCI"},
97 {ERR_FUNC(X509V3_F_S2I_ASN1_IA5STRING), "S2I_ASN1_IA5STRING"},
98 {ERR_FUNC(X509V3_F_S2I_ASN1_INTEGER), "s2i_ASN1_INTEGER"},
99 {ERR_FUNC(X509V3_F_S2I_ASN1_OCTET_STRING), "s2i_ASN1_OCTET_STRING"},
100 {ERR_FUNC(X509V3_F_S2I_ASN1_SKEY_ID), "S2I_ASN1_SKEY_ID"},
101 {ERR_FUNC(X509V3_F_S2I_SKEY_ID), "S2I_SKEY_ID"},
102 {ERR_FUNC(X509V3_F_SET_DIST_POINT_NAME), "SET_DIST_POINT_NAME"},
103 {ERR_FUNC(X509V3_F_STRING_TO_HEX), "string_to_hex"},
104 {ERR_FUNC(X509V3_F_SXNET_ADD_ID_ASC), "SXNET_add_id_asc"},
105 {ERR_FUNC(X509V3_F_SXNET_ADD_ID_INTEGER), "SXNET_add_id_INTEGER"},
106 {ERR_FUNC(X509V3_F_SXNET_ADD_ID_ULONG), "SXNET_add_id_ulong"},
107 {ERR_FUNC(X509V3_F_SXNET_GET_ID_ASC), "SXNET_get_id_asc"},
108 {ERR_FUNC(X509V3_F_SXNET_GET_ID_ULONG), "SXNET_get_id_ulong"},
109 {ERR_FUNC(X509V3_F_V2I_ASIDENTIFIERS), "V2I_ASIDENTIFIERS"},
110 {ERR_FUNC(X509V3_F_V2I_ASN1_BIT_STRING), "v2i_ASN1_BIT_STRING"},
111 {ERR_FUNC(X509V3_F_V2I_AUTHORITY_INFO_ACCESS), "V2I_AUTHORITY_INFO_ACCESS"},
112 {ERR_FUNC(X509V3_F_V2I_AUTHORITY_KEYID), "V2I_AUTHORITY_KEYID"},
113 {ERR_FUNC(X509V3_F_V2I_BASIC_CONSTRAINTS), "V2I_BASIC_CONSTRAINTS"},
114 {ERR_FUNC(X509V3_F_V2I_CRLD), "V2I_CRLD"},
115 {ERR_FUNC(X509V3_F_V2I_EXTENDED_KEY_USAGE), "V2I_EXTENDED_KEY_USAGE"},
116 {ERR_FUNC(X509V3_F_V2I_GENERAL_NAMES), "v2i_GENERAL_NAMES"},
117 {ERR_FUNC(X509V3_F_V2I_GENERAL_NAME_EX), "v2i_GENERAL_NAME_ex"},
118 {ERR_FUNC(X509V3_F_V2I_IDP), "V2I_IDP"},
119 {ERR_FUNC(X509V3_F_V2I_IPADDRBLOCKS), "V2I_IPADDRBLOCKS"},
120 {ERR_FUNC(X509V3_F_V2I_ISSUER_ALT), "V2I_ISSUER_ALT"},
121 {ERR_FUNC(X509V3_F_V2I_NAME_CONSTRAINTS), "V2I_NAME_CONSTRAINTS"},
122 {ERR_FUNC(X509V3_F_V2I_POLICY_CONSTRAINTS), "V2I_POLICY_CONSTRAINTS"},
123 {ERR_FUNC(X509V3_F_V2I_POLICY_MAPPINGS), "V2I_POLICY_MAPPINGS"},
124 {ERR_FUNC(X509V3_F_V2I_SUBJECT_ALT), "V2I_SUBJECT_ALT"},
125 {ERR_FUNC(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL), "V3_ADDR_VALIDATE_PATH_INTERNAL"},
126 {ERR_FUNC(X509V3_F_V3_GENERIC_EXTENSION), "V3_GENERIC_EXTENSION"},
127 {ERR_FUNC(X509V3_F_X509V3_ADD1_I2D), "X509V3_add1_i2d"},
128 {ERR_FUNC(X509V3_F_X509V3_ADD_VALUE), "X509V3_add_value"},
129 {ERR_FUNC(X509V3_F_X509V3_EXT_ADD), "X509V3_EXT_add"},
130 {ERR_FUNC(X509V3_F_X509V3_EXT_ADD_ALIAS), "X509V3_EXT_add_alias"},
131 {ERR_FUNC(X509V3_F_X509V3_EXT_CONF), "X509V3_EXT_conf"},
132 {ERR_FUNC(X509V3_F_X509V3_EXT_I2D), "X509V3_EXT_i2d"},
133 {ERR_FUNC(X509V3_F_X509V3_EXT_NCONF), "X509V3_EXT_nconf"},
134 {ERR_FUNC(X509V3_F_X509V3_GET_SECTION), "X509V3_get_section"},
135 {ERR_FUNC(X509V3_F_X509V3_GET_STRING), "X509V3_get_string"},
136 {ERR_FUNC(X509V3_F_X509V3_GET_VALUE_BOOL), "X509V3_get_value_bool"},
137 {ERR_FUNC(X509V3_F_X509V3_PARSE_LIST), "X509V3_parse_list"},
138 {ERR_FUNC(X509V3_F_X509_PURPOSE_ADD), "X509_PURPOSE_add"},
139 {ERR_FUNC(X509V3_F_X509_PURPOSE_SET), "X509_PURPOSE_set"},
140 {0, NULL}
141};
142
143static ERR_STRING_DATA X509V3_str_reasons[] = {
144 {ERR_REASON(X509V3_R_BAD_IP_ADDRESS) , "bad ip address"},
145 {ERR_REASON(X509V3_R_BAD_OBJECT) , "bad object"},
146 {ERR_REASON(X509V3_R_BN_DEC2BN_ERROR) , "bn dec2bn error"},
147 {ERR_REASON(X509V3_R_BN_TO_ASN1_INTEGER_ERROR), "bn to asn1 integer error"},
148 {ERR_REASON(X509V3_R_DIRNAME_ERROR) , "dirname error"},
149 {ERR_REASON(X509V3_R_DISTPOINT_ALREADY_SET), "distpoint already set"},
150 {ERR_REASON(X509V3_R_DUPLICATE_ZONE_ID) , "duplicate zone id"},
151 {ERR_REASON(X509V3_R_ERROR_CONVERTING_ZONE), "error converting zone"},
152 {ERR_REASON(X509V3_R_ERROR_CREATING_EXTENSION), "error creating extension"},
153 {ERR_REASON(X509V3_R_ERROR_IN_EXTENSION) , "error in extension"},
154 {ERR_REASON(X509V3_R_EXPECTED_A_SECTION_NAME), "expected a section name"},
155 {ERR_REASON(X509V3_R_EXTENSION_EXISTS) , "extension exists"},
156 {ERR_REASON(X509V3_R_EXTENSION_NAME_ERROR), "extension name error"},
157 {ERR_REASON(X509V3_R_EXTENSION_NOT_FOUND), "extension not found"},
158 {ERR_REASON(X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED), "extension setting not supported"},
159 {ERR_REASON(X509V3_R_EXTENSION_VALUE_ERROR), "extension value error"},
160 {ERR_REASON(X509V3_R_ILLEGAL_EMPTY_EXTENSION), "illegal empty extension"},
161 {ERR_REASON(X509V3_R_ILLEGAL_HEX_DIGIT) , "illegal hex digit"},
162 {ERR_REASON(X509V3_R_INCORRECT_POLICY_SYNTAX_TAG), "incorrect policy syntax tag"},
163 {ERR_REASON(X509V3_R_INVALID_MULTIPLE_RDNS), "invalid multiple rdns"},
164 {ERR_REASON(X509V3_R_INVALID_ASNUMBER) , "invalid asnumber"},
165 {ERR_REASON(X509V3_R_INVALID_ASRANGE) , "invalid asrange"},
166 {ERR_REASON(X509V3_R_INVALID_BOOLEAN_STRING), "invalid boolean string"},
167 {ERR_REASON(X509V3_R_INVALID_EXTENSION_STRING), "invalid extension string"},
168 {ERR_REASON(X509V3_R_INVALID_INHERITANCE), "invalid inheritance"},
169 {ERR_REASON(X509V3_R_INVALID_IPADDRESS) , "invalid ipaddress"},
170 {ERR_REASON(X509V3_R_INVALID_NAME) , "invalid name"},
171 {ERR_REASON(X509V3_R_INVALID_NULL_ARGUMENT), "invalid null argument"},
172 {ERR_REASON(X509V3_R_INVALID_NULL_NAME) , "invalid null name"},
173 {ERR_REASON(X509V3_R_INVALID_NULL_VALUE) , "invalid null value"},
174 {ERR_REASON(X509V3_R_INVALID_NUMBER) , "invalid number"},
175 {ERR_REASON(X509V3_R_INVALID_NUMBERS) , "invalid numbers"},
176 {ERR_REASON(X509V3_R_INVALID_OBJECT_IDENTIFIER), "invalid object identifier"},
177 {ERR_REASON(X509V3_R_INVALID_OPTION) , "invalid option"},
178 {ERR_REASON(X509V3_R_INVALID_POLICY_IDENTIFIER), "invalid policy identifier"},
179 {ERR_REASON(X509V3_R_INVALID_PROXY_POLICY_SETTING), "invalid proxy policy setting"},
180 {ERR_REASON(X509V3_R_INVALID_PURPOSE) , "invalid purpose"},
181 {ERR_REASON(X509V3_R_INVALID_SAFI) , "invalid safi"},
182 {ERR_REASON(X509V3_R_INVALID_SECTION) , "invalid section"},
183 {ERR_REASON(X509V3_R_INVALID_SYNTAX) , "invalid syntax"},
184 {ERR_REASON(X509V3_R_ISSUER_DECODE_ERROR), "issuer decode error"},
185 {ERR_REASON(X509V3_R_MISSING_VALUE) , "missing value"},
186 {ERR_REASON(X509V3_R_NEED_ORGANIZATION_AND_NUMBERS), "need organization and numbers"},
187 {ERR_REASON(X509V3_R_NO_CONFIG_DATABASE) , "no config database"},
188 {ERR_REASON(X509V3_R_NO_ISSUER_CERTIFICATE), "no issuer certificate"},
189 {ERR_REASON(X509V3_R_NO_ISSUER_DETAILS) , "no issuer details"},
190 {ERR_REASON(X509V3_R_NO_POLICY_IDENTIFIER), "no policy identifier"},
191 {ERR_REASON(X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED), "no proxy cert policy language defined"},
192 {ERR_REASON(X509V3_R_NO_PUBLIC_KEY) , "no public key"},
193 {ERR_REASON(X509V3_R_NO_SUBJECT_DETAILS) , "no subject details"},
194 {ERR_REASON(X509V3_R_ODD_NUMBER_OF_DIGITS), "odd number of digits"},
195 {ERR_REASON(X509V3_R_OPERATION_NOT_DEFINED), "operation not defined"},
196 {ERR_REASON(X509V3_R_OTHERNAME_ERROR) , "othername error"},
197 {ERR_REASON(X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED), "policy language already defined"},
198 {ERR_REASON(X509V3_R_POLICY_PATH_LENGTH) , "policy path length"},
199 {ERR_REASON(X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED), "policy path length already defined"},
200 {ERR_REASON(X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED), "policy syntax not currently supported"},
201 {ERR_REASON(X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY), "policy when proxy language requires no policy"},
202 {ERR_REASON(X509V3_R_SECTION_NOT_FOUND) , "section not found"},
203 {ERR_REASON(X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS), "unable to get issuer details"},
204 {ERR_REASON(X509V3_R_UNABLE_TO_GET_ISSUER_KEYID), "unable to get issuer keyid"},
205 {ERR_REASON(X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT), "unknown bit string argument"},
206 {ERR_REASON(X509V3_R_UNKNOWN_EXTENSION) , "unknown extension"},
207 {ERR_REASON(X509V3_R_UNKNOWN_EXTENSION_NAME), "unknown extension name"},
208 {ERR_REASON(X509V3_R_UNKNOWN_OPTION) , "unknown option"},
209 {ERR_REASON(X509V3_R_UNSUPPORTED_OPTION) , "unsupported option"},
210 {ERR_REASON(X509V3_R_UNSUPPORTED_TYPE) , "unsupported type"},
211 {ERR_REASON(X509V3_R_USER_TOO_LONG) , "user too long"},
212 {0, NULL}
213};
214
215#endif
216
217void
218ERR_load_X509V3_strings(void)
219{
220#ifndef OPENSSL_NO_ERR
221 if (ERR_func_error_string(X509V3_str_functs[0].error) == NULL) {
222 ERR_load_strings(0, X509V3_str_functs);
223 ERR_load_strings(0, X509V3_str_reasons);
224 }
225#endif
226}
diff --git a/src/lib/libcrypto/x509v3/x509v3.h b/src/lib/libcrypto/x509v3/x509v3.h
deleted file mode 100644
index b45626a885..0000000000
--- a/src/lib/libcrypto/x509v3/x509v3.h
+++ /dev/null
@@ -1,862 +0,0 @@
1/* $OpenBSD: x509v3.h,v 1.16 2015/02/10 13:28:17 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58#ifndef HEADER_X509V3_H
59#define HEADER_X509V3_H
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/bio.h>
64#include <openssl/x509.h>
65#include <openssl/conf.h>
66
67#ifdef __cplusplus
68extern "C" {
69#endif
70
71/* Forward reference */
72struct v3_ext_method;
73struct v3_ext_ctx;
74
75/* Useful typedefs */
76
77typedef void * (*X509V3_EXT_NEW)(void);
78typedef void (*X509V3_EXT_FREE)(void *);
79typedef void * (*X509V3_EXT_D2I)(void *, const unsigned char ** , long);
80typedef int (*X509V3_EXT_I2D)(void *, unsigned char **);
81typedef STACK_OF(CONF_VALUE) *
82 (*X509V3_EXT_I2V)(const struct v3_ext_method *method, void *ext,
83 STACK_OF(CONF_VALUE) *extlist);
84typedef void * (*X509V3_EXT_V2I)(const struct v3_ext_method *method,
85 struct v3_ext_ctx *ctx,
86 STACK_OF(CONF_VALUE) *values);
87typedef char * (*X509V3_EXT_I2S)(const struct v3_ext_method *method, void *ext);
88typedef void * (*X509V3_EXT_S2I)(const struct v3_ext_method *method,
89 struct v3_ext_ctx *ctx, const char *str);
90typedef int (*X509V3_EXT_I2R)(const struct v3_ext_method *method, void *ext,
91 BIO *out, int indent);
92typedef void * (*X509V3_EXT_R2I)(const struct v3_ext_method *method,
93 struct v3_ext_ctx *ctx, const char *str);
94
95/* V3 extension structure */
96
97struct v3_ext_method {
98int ext_nid;
99int ext_flags;
100/* If this is set the following four fields are ignored */
101ASN1_ITEM_EXP *it;
102/* Old style ASN1 calls */
103X509V3_EXT_NEW ext_new;
104X509V3_EXT_FREE ext_free;
105X509V3_EXT_D2I d2i;
106X509V3_EXT_I2D i2d;
107
108/* The following pair is used for string extensions */
109X509V3_EXT_I2S i2s;
110X509V3_EXT_S2I s2i;
111
112/* The following pair is used for multi-valued extensions */
113X509V3_EXT_I2V i2v;
114X509V3_EXT_V2I v2i;
115
116/* The following are used for raw extensions */
117X509V3_EXT_I2R i2r;
118X509V3_EXT_R2I r2i;
119
120void *usr_data; /* Any extension specific data */
121};
122
123typedef struct X509V3_CONF_METHOD_st {
124char * (*get_string)(void *db, char *section, char *value);
125STACK_OF(CONF_VALUE) * (*get_section)(void *db, char *section);
126void (*free_string)(void *db, char * string);
127void (*free_section)(void *db, STACK_OF(CONF_VALUE) *section);
128} X509V3_CONF_METHOD;
129
130/* Context specific info */
131struct v3_ext_ctx {
132#define CTX_TEST 0x1
133int flags;
134X509 *issuer_cert;
135X509 *subject_cert;
136X509_REQ *subject_req;
137X509_CRL *crl;
138X509V3_CONF_METHOD *db_meth;
139void *db;
140/* Maybe more here */
141};
142
143typedef struct v3_ext_method X509V3_EXT_METHOD;
144
145DECLARE_STACK_OF(X509V3_EXT_METHOD)
146
147/* ext_flags values */
148#define X509V3_EXT_DYNAMIC 0x1
149#define X509V3_EXT_CTX_DEP 0x2
150#define X509V3_EXT_MULTILINE 0x4
151
152typedef BIT_STRING_BITNAME ENUMERATED_NAMES;
153
154typedef struct BASIC_CONSTRAINTS_st {
155int ca;
156ASN1_INTEGER *pathlen;
157} BASIC_CONSTRAINTS;
158
159
160typedef struct PKEY_USAGE_PERIOD_st {
161ASN1_GENERALIZEDTIME *notBefore;
162ASN1_GENERALIZEDTIME *notAfter;
163} PKEY_USAGE_PERIOD;
164
165typedef struct otherName_st {
166ASN1_OBJECT *type_id;
167ASN1_TYPE *value;
168} OTHERNAME;
169
170typedef struct EDIPartyName_st {
171 ASN1_STRING *nameAssigner;
172 ASN1_STRING *partyName;
173} EDIPARTYNAME;
174
175typedef struct GENERAL_NAME_st {
176
177#define GEN_OTHERNAME 0
178#define GEN_EMAIL 1
179#define GEN_DNS 2
180#define GEN_X400 3
181#define GEN_DIRNAME 4
182#define GEN_EDIPARTY 5
183#define GEN_URI 6
184#define GEN_IPADD 7
185#define GEN_RID 8
186
187int type;
188union {
189 char *ptr;
190 OTHERNAME *otherName; /* otherName */
191 ASN1_IA5STRING *rfc822Name;
192 ASN1_IA5STRING *dNSName;
193 ASN1_TYPE *x400Address;
194 X509_NAME *directoryName;
195 EDIPARTYNAME *ediPartyName;
196 ASN1_IA5STRING *uniformResourceIdentifier;
197 ASN1_OCTET_STRING *iPAddress;
198 ASN1_OBJECT *registeredID;
199
200 /* Old names */
201 ASN1_OCTET_STRING *ip; /* iPAddress */
202 X509_NAME *dirn; /* dirn */
203 ASN1_IA5STRING *ia5;/* rfc822Name, dNSName, uniformResourceIdentifier */
204 ASN1_OBJECT *rid; /* registeredID */
205 ASN1_TYPE *other; /* x400Address */
206} d;
207} GENERAL_NAME;
208
209typedef STACK_OF(GENERAL_NAME) GENERAL_NAMES;
210
211typedef struct ACCESS_DESCRIPTION_st {
212 ASN1_OBJECT *method;
213 GENERAL_NAME *location;
214} ACCESS_DESCRIPTION;
215
216typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
217
218typedef STACK_OF(ASN1_OBJECT) EXTENDED_KEY_USAGE;
219
220DECLARE_STACK_OF(GENERAL_NAME)
221DECLARE_ASN1_SET_OF(GENERAL_NAME)
222
223DECLARE_STACK_OF(ACCESS_DESCRIPTION)
224DECLARE_ASN1_SET_OF(ACCESS_DESCRIPTION)
225
226typedef struct DIST_POINT_NAME_st {
227int type;
228union {
229 GENERAL_NAMES *fullname;
230 STACK_OF(X509_NAME_ENTRY) *relativename;
231} name;
232/* If relativename then this contains the full distribution point name */
233X509_NAME *dpname;
234} DIST_POINT_NAME;
235/* All existing reasons */
236#define CRLDP_ALL_REASONS 0x807f
237
238#define CRL_REASON_NONE -1
239#define CRL_REASON_UNSPECIFIED 0
240#define CRL_REASON_KEY_COMPROMISE 1
241#define CRL_REASON_CA_COMPROMISE 2
242#define CRL_REASON_AFFILIATION_CHANGED 3
243#define CRL_REASON_SUPERSEDED 4
244#define CRL_REASON_CESSATION_OF_OPERATION 5
245#define CRL_REASON_CERTIFICATE_HOLD 6
246#define CRL_REASON_REMOVE_FROM_CRL 8
247#define CRL_REASON_PRIVILEGE_WITHDRAWN 9
248#define CRL_REASON_AA_COMPROMISE 10
249
250struct DIST_POINT_st {
251DIST_POINT_NAME *distpoint;
252ASN1_BIT_STRING *reasons;
253GENERAL_NAMES *CRLissuer;
254int dp_reasons;
255};
256
257typedef STACK_OF(DIST_POINT) CRL_DIST_POINTS;
258
259DECLARE_STACK_OF(DIST_POINT)
260DECLARE_ASN1_SET_OF(DIST_POINT)
261
262struct AUTHORITY_KEYID_st {
263ASN1_OCTET_STRING *keyid;
264GENERAL_NAMES *issuer;
265ASN1_INTEGER *serial;
266};
267
268/* Strong extranet structures */
269
270typedef struct SXNET_ID_st {
271 ASN1_INTEGER *zone;
272 ASN1_OCTET_STRING *user;
273} SXNETID;
274
275DECLARE_STACK_OF(SXNETID)
276DECLARE_ASN1_SET_OF(SXNETID)
277
278typedef struct SXNET_st {
279 ASN1_INTEGER *version;
280 STACK_OF(SXNETID) *ids;
281} SXNET;
282
283typedef struct NOTICEREF_st {
284 ASN1_STRING *organization;
285 STACK_OF(ASN1_INTEGER) *noticenos;
286} NOTICEREF;
287
288typedef struct USERNOTICE_st {
289 NOTICEREF *noticeref;
290 ASN1_STRING *exptext;
291} USERNOTICE;
292
293typedef struct POLICYQUALINFO_st {
294 ASN1_OBJECT *pqualid;
295 union {
296 ASN1_IA5STRING *cpsuri;
297 USERNOTICE *usernotice;
298 ASN1_TYPE *other;
299 } d;
300} POLICYQUALINFO;
301
302DECLARE_STACK_OF(POLICYQUALINFO)
303DECLARE_ASN1_SET_OF(POLICYQUALINFO)
304
305typedef struct POLICYINFO_st {
306 ASN1_OBJECT *policyid;
307 STACK_OF(POLICYQUALINFO) *qualifiers;
308} POLICYINFO;
309
310typedef STACK_OF(POLICYINFO) CERTIFICATEPOLICIES;
311
312DECLARE_STACK_OF(POLICYINFO)
313DECLARE_ASN1_SET_OF(POLICYINFO)
314
315typedef struct POLICY_MAPPING_st {
316 ASN1_OBJECT *issuerDomainPolicy;
317 ASN1_OBJECT *subjectDomainPolicy;
318} POLICY_MAPPING;
319
320DECLARE_STACK_OF(POLICY_MAPPING)
321
322typedef STACK_OF(POLICY_MAPPING) POLICY_MAPPINGS;
323
324typedef struct GENERAL_SUBTREE_st {
325 GENERAL_NAME *base;
326 ASN1_INTEGER *minimum;
327 ASN1_INTEGER *maximum;
328} GENERAL_SUBTREE;
329
330DECLARE_STACK_OF(GENERAL_SUBTREE)
331
332struct NAME_CONSTRAINTS_st {
333 STACK_OF(GENERAL_SUBTREE) *permittedSubtrees;
334 STACK_OF(GENERAL_SUBTREE) *excludedSubtrees;
335};
336
337typedef struct POLICY_CONSTRAINTS_st {
338 ASN1_INTEGER *requireExplicitPolicy;
339 ASN1_INTEGER *inhibitPolicyMapping;
340} POLICY_CONSTRAINTS;
341
342/* Proxy certificate structures, see RFC 3820 */
343typedef struct PROXY_POLICY_st
344 {
345 ASN1_OBJECT *policyLanguage;
346 ASN1_OCTET_STRING *policy;
347 } PROXY_POLICY;
348
349typedef struct PROXY_CERT_INFO_EXTENSION_st
350 {
351 ASN1_INTEGER *pcPathLengthConstraint;
352 PROXY_POLICY *proxyPolicy;
353 } PROXY_CERT_INFO_EXTENSION;
354
355DECLARE_ASN1_FUNCTIONS(PROXY_POLICY)
356DECLARE_ASN1_FUNCTIONS(PROXY_CERT_INFO_EXTENSION)
357
358struct ISSUING_DIST_POINT_st
359 {
360 DIST_POINT_NAME *distpoint;
361 int onlyuser;
362 int onlyCA;
363 ASN1_BIT_STRING *onlysomereasons;
364 int indirectCRL;
365 int onlyattr;
366 };
367
368/* Values in idp_flags field */
369/* IDP present */
370#define IDP_PRESENT 0x1
371/* IDP values inconsistent */
372#define IDP_INVALID 0x2
373/* onlyuser true */
374#define IDP_ONLYUSER 0x4
375/* onlyCA true */
376#define IDP_ONLYCA 0x8
377/* onlyattr true */
378#define IDP_ONLYATTR 0x10
379/* indirectCRL true */
380#define IDP_INDIRECT 0x20
381/* onlysomereasons present */
382#define IDP_REASONS 0x40
383
384#define X509V3_conf_err(val) ERR_asprintf_error_data( \
385 "section:%s,name:%s,value:%s", val->section, \
386 val->name, val->value);
387
388#define X509V3_set_ctx_test(ctx) \
389 X509V3_set_ctx(ctx, NULL, NULL, NULL, NULL, CTX_TEST)
390#define X509V3_set_ctx_nodb(ctx) (ctx)->db = NULL;
391
392#define EXT_BITSTRING(nid, table) { nid, 0, ASN1_ITEM_ref(ASN1_BIT_STRING), \
393 0,0,0,0, \
394 0,0, \
395 (X509V3_EXT_I2V)i2v_ASN1_BIT_STRING, \
396 (X509V3_EXT_V2I)v2i_ASN1_BIT_STRING, \
397 NULL, NULL, \
398 table}
399
400#define EXT_IA5STRING(nid) { nid, 0, ASN1_ITEM_ref(ASN1_IA5STRING), \
401 0,0,0,0, \
402 (X509V3_EXT_I2S)i2s_ASN1_IA5STRING, \
403 (X509V3_EXT_S2I)s2i_ASN1_IA5STRING, \
404 0,0,0,0, \
405 NULL}
406
407#define EXT_END { -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
408
409
410/* X509_PURPOSE stuff */
411
412#define EXFLAG_BCONS 0x1
413#define EXFLAG_KUSAGE 0x2
414#define EXFLAG_XKUSAGE 0x4
415#define EXFLAG_NSCERT 0x8
416
417#define EXFLAG_CA 0x10
418/* Really self issued not necessarily self signed */
419#define EXFLAG_SI 0x20
420#define EXFLAG_SS 0x20
421#define EXFLAG_V1 0x40
422#define EXFLAG_INVALID 0x80
423#define EXFLAG_SET 0x100
424#define EXFLAG_CRITICAL 0x200
425#define EXFLAG_PROXY 0x400
426
427#define EXFLAG_INVALID_POLICY 0x800
428#define EXFLAG_FRESHEST 0x1000
429
430#define KU_DIGITAL_SIGNATURE 0x0080
431#define KU_NON_REPUDIATION 0x0040
432#define KU_KEY_ENCIPHERMENT 0x0020
433#define KU_DATA_ENCIPHERMENT 0x0010
434#define KU_KEY_AGREEMENT 0x0008
435#define KU_KEY_CERT_SIGN 0x0004
436#define KU_CRL_SIGN 0x0002
437#define KU_ENCIPHER_ONLY 0x0001
438#define KU_DECIPHER_ONLY 0x8000
439
440#define NS_SSL_CLIENT 0x80
441#define NS_SSL_SERVER 0x40
442#define NS_SMIME 0x20
443#define NS_OBJSIGN 0x10
444#define NS_SSL_CA 0x04
445#define NS_SMIME_CA 0x02
446#define NS_OBJSIGN_CA 0x01
447#define NS_ANY_CA (NS_SSL_CA|NS_SMIME_CA|NS_OBJSIGN_CA)
448
449#define XKU_SSL_SERVER 0x1
450#define XKU_SSL_CLIENT 0x2
451#define XKU_SMIME 0x4
452#define XKU_CODE_SIGN 0x8
453#define XKU_SGC 0x10
454#define XKU_OCSP_SIGN 0x20
455#define XKU_TIMESTAMP 0x40
456#define XKU_DVCS 0x80
457
458#define X509_PURPOSE_DYNAMIC 0x1
459#define X509_PURPOSE_DYNAMIC_NAME 0x2
460
461typedef struct x509_purpose_st {
462 int purpose;
463 int trust; /* Default trust ID */
464 int flags;
465 int (*check_purpose)(const struct x509_purpose_st *,
466 const X509 *, int);
467 char *name;
468 char *sname;
469 void *usr_data;
470} X509_PURPOSE;
471
472#define X509_PURPOSE_SSL_CLIENT 1
473#define X509_PURPOSE_SSL_SERVER 2
474#define X509_PURPOSE_NS_SSL_SERVER 3
475#define X509_PURPOSE_SMIME_SIGN 4
476#define X509_PURPOSE_SMIME_ENCRYPT 5
477#define X509_PURPOSE_CRL_SIGN 6
478#define X509_PURPOSE_ANY 7
479#define X509_PURPOSE_OCSP_HELPER 8
480#define X509_PURPOSE_TIMESTAMP_SIGN 9
481
482#define X509_PURPOSE_MIN 1
483#define X509_PURPOSE_MAX 9
484
485/* Flags for X509V3_EXT_print() */
486
487#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16)
488/* Return error for unknown extensions */
489#define X509V3_EXT_DEFAULT 0
490/* Print error for unknown extensions */
491#define X509V3_EXT_ERROR_UNKNOWN (1L << 16)
492/* ASN1 parse unknown extensions */
493#define X509V3_EXT_PARSE_UNKNOWN (2L << 16)
494/* BIO_dump unknown extensions */
495#define X509V3_EXT_DUMP_UNKNOWN (3L << 16)
496
497/* Flags for X509V3_add1_i2d */
498
499#define X509V3_ADD_OP_MASK 0xfL
500#define X509V3_ADD_DEFAULT 0L
501#define X509V3_ADD_APPEND 1L
502#define X509V3_ADD_REPLACE 2L
503#define X509V3_ADD_REPLACE_EXISTING 3L
504#define X509V3_ADD_KEEP_EXISTING 4L
505#define X509V3_ADD_DELETE 5L
506#define X509V3_ADD_SILENT 0x10
507
508DECLARE_STACK_OF(X509_PURPOSE)
509
510DECLARE_ASN1_FUNCTIONS(BASIC_CONSTRAINTS)
511
512DECLARE_ASN1_FUNCTIONS(SXNET)
513DECLARE_ASN1_FUNCTIONS(SXNETID)
514
515int SXNET_add_id_asc(SXNET **psx, char *zone, char *user, int userlen);
516int SXNET_add_id_ulong(SXNET **psx, unsigned long lzone, char *user, int userlen);
517int SXNET_add_id_INTEGER(SXNET **psx, ASN1_INTEGER *izone, char *user, int userlen);
518
519ASN1_OCTET_STRING *SXNET_get_id_asc(SXNET *sx, char *zone);
520ASN1_OCTET_STRING *SXNET_get_id_ulong(SXNET *sx, unsigned long lzone);
521ASN1_OCTET_STRING *SXNET_get_id_INTEGER(SXNET *sx, ASN1_INTEGER *zone);
522
523DECLARE_ASN1_FUNCTIONS(AUTHORITY_KEYID)
524
525DECLARE_ASN1_FUNCTIONS(PKEY_USAGE_PERIOD)
526
527DECLARE_ASN1_FUNCTIONS(GENERAL_NAME)
528GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a);
529int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b);
530
531
532
533ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
534 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
535STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
536 ASN1_BIT_STRING *bits,
537 STACK_OF(CONF_VALUE) *extlist);
538
539STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret);
540int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen);
541
542DECLARE_ASN1_FUNCTIONS(GENERAL_NAMES)
543
544STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
545 GENERAL_NAMES *gen, STACK_OF(CONF_VALUE) *extlist);
546GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method,
547 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
548
549DECLARE_ASN1_FUNCTIONS(OTHERNAME)
550DECLARE_ASN1_FUNCTIONS(EDIPARTYNAME)
551int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b);
552void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value);
553void *GENERAL_NAME_get0_value(GENERAL_NAME *a, int *ptype);
554int GENERAL_NAME_set0_othername(GENERAL_NAME *gen,
555 ASN1_OBJECT *oid, ASN1_TYPE *value);
556int GENERAL_NAME_get0_otherName(GENERAL_NAME *gen,
557 ASN1_OBJECT **poid, ASN1_TYPE **pvalue);
558
559char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *ia5);
560ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
561
562DECLARE_ASN1_FUNCTIONS(EXTENDED_KEY_USAGE)
563int i2a_ACCESS_DESCRIPTION(BIO *bp, ACCESS_DESCRIPTION* a);
564
565DECLARE_ASN1_FUNCTIONS(CERTIFICATEPOLICIES)
566DECLARE_ASN1_FUNCTIONS(POLICYINFO)
567DECLARE_ASN1_FUNCTIONS(POLICYQUALINFO)
568DECLARE_ASN1_FUNCTIONS(USERNOTICE)
569DECLARE_ASN1_FUNCTIONS(NOTICEREF)
570
571DECLARE_ASN1_FUNCTIONS(CRL_DIST_POINTS)
572DECLARE_ASN1_FUNCTIONS(DIST_POINT)
573DECLARE_ASN1_FUNCTIONS(DIST_POINT_NAME)
574DECLARE_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
575
576int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, X509_NAME *iname);
577
578int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc);
579
580DECLARE_ASN1_FUNCTIONS(ACCESS_DESCRIPTION)
581DECLARE_ASN1_FUNCTIONS(AUTHORITY_INFO_ACCESS)
582
583DECLARE_ASN1_ITEM(POLICY_MAPPING)
584DECLARE_ASN1_ALLOC_FUNCTIONS(POLICY_MAPPING)
585DECLARE_ASN1_ITEM(POLICY_MAPPINGS)
586
587DECLARE_ASN1_ITEM(GENERAL_SUBTREE)
588DECLARE_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
589
590DECLARE_ASN1_ITEM(NAME_CONSTRAINTS)
591DECLARE_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
592
593DECLARE_ASN1_ALLOC_FUNCTIONS(POLICY_CONSTRAINTS)
594DECLARE_ASN1_ITEM(POLICY_CONSTRAINTS)
595
596GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out,
597 const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
598 int gen_type, char *value, int is_nc);
599
600#ifdef HEADER_CONF_H
601GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
602 CONF_VALUE *cnf);
603GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out,
604 const X509V3_EXT_METHOD *method,
605 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc);
606void X509V3_conf_free(CONF_VALUE *val);
607
608X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, char *value);
609X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name, char *value);
610int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section, STACK_OF(X509_EXTENSION) **sk);
611int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509 *cert);
612int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509_REQ *req);
613int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section, X509_CRL *crl);
614
615X509_EXTENSION *X509V3_EXT_conf_nid(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
616 int ext_nid, char *value);
617X509_EXTENSION *X509V3_EXT_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
618 char *name, char *value);
619int X509V3_EXT_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
620 char *section, X509 *cert);
621int X509V3_EXT_REQ_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
622 char *section, X509_REQ *req);
623int X509V3_EXT_CRL_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
624 char *section, X509_CRL *crl);
625
626int X509V3_add_value_bool_nf(char *name, int asn1_bool,
627 STACK_OF(CONF_VALUE) **extlist);
628int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool);
629int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint);
630void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf);
631void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH_OF(CONF_VALUE) *lhash);
632#endif
633
634char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section);
635STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section);
636void X509V3_string_free(X509V3_CTX *ctx, char *str);
637void X509V3_section_free( X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section);
638void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
639 X509_REQ *req, X509_CRL *crl, int flags);
640
641int X509V3_add_value(const char *name, const char *value,
642 STACK_OF(CONF_VALUE) **extlist);
643int X509V3_add_value_uchar(const char *name, const unsigned char *value,
644 STACK_OF(CONF_VALUE) **extlist);
645int X509V3_add_value_bool(const char *name, int asn1_bool,
646 STACK_OF(CONF_VALUE) **extlist);
647int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
648 STACK_OF(CONF_VALUE) **extlist);
649char * i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, ASN1_INTEGER *aint);
650ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, char *value);
651char * i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
652char * i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
653int X509V3_EXT_add(X509V3_EXT_METHOD *ext);
654int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist);
655int X509V3_EXT_add_alias(int nid_to, int nid_from);
656void X509V3_EXT_cleanup(void);
657
658const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext);
659const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid);
660int X509V3_add_standard_extensions(void);
661STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line);
662void *X509V3_EXT_d2i(X509_EXTENSION *ext);
663void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx);
664
665
666X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
667int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value, int crit, unsigned long flags);
668
669char *hex_to_string(const unsigned char *buffer, long len);
670unsigned char *string_to_hex(const char *str, long *len);
671int name_cmp(const char *name, const char *cmp);
672
673void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent,
674 int ml);
675int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent);
676int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
677
678int X509V3_extensions_print(BIO *out, char *title, STACK_OF(X509_EXTENSION) *exts, unsigned long flag, int indent);
679
680int X509_check_ca(X509 *x);
681int X509_check_purpose(X509 *x, int id, int ca);
682int X509_supported_extension(X509_EXTENSION *ex);
683int X509_PURPOSE_set(int *p, int purpose);
684int X509_check_issued(X509 *issuer, X509 *subject);
685int X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid);
686int X509_PURPOSE_get_count(void);
687X509_PURPOSE * X509_PURPOSE_get0(int idx);
688int X509_PURPOSE_get_by_sname(char *sname);
689int X509_PURPOSE_get_by_id(int id);
690int X509_PURPOSE_add(int id, int trust, int flags,
691 int (*ck)(const X509_PURPOSE *, const X509 *, int),
692 char *name, char *sname, void *arg);
693char *X509_PURPOSE_get0_name(X509_PURPOSE *xp);
694char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp);
695int X509_PURPOSE_get_trust(X509_PURPOSE *xp);
696void X509_PURPOSE_cleanup(void);
697int X509_PURPOSE_get_id(X509_PURPOSE *);
698
699STACK_OF(OPENSSL_STRING) *X509_get1_email(X509 *x);
700STACK_OF(OPENSSL_STRING) *X509_REQ_get1_email(X509_REQ *x);
701void X509_email_free(STACK_OF(OPENSSL_STRING) *sk);
702STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x);
703
704ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc);
705ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc);
706int a2i_ipadd(unsigned char *ipout, const char *ipasc);
707int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
708 unsigned long chtype);
709
710void X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent);
711DECLARE_STACK_OF(X509_POLICY_NODE)
712
713
714/* BEGIN ERROR CODES */
715/* The following lines are auto generated by the script mkerr.pl. Any changes
716 * made after this point may be overwritten when the script is next run.
717 */
718void ERR_load_X509V3_strings(void);
719
720/* Error codes for the X509V3 functions. */
721
722/* Function codes. */
723#define X509V3_F_A2I_GENERAL_NAME 164
724#define X509V3_F_ASIDENTIFIERCHOICE_CANONIZE 161
725#define X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL 162
726#define X509V3_F_COPY_EMAIL 122
727#define X509V3_F_COPY_ISSUER 123
728#define X509V3_F_DO_DIRNAME 144
729#define X509V3_F_DO_EXT_CONF 124
730#define X509V3_F_DO_EXT_I2D 135
731#define X509V3_F_DO_EXT_NCONF 151
732#define X509V3_F_DO_I2V_NAME_CONSTRAINTS 148
733#define X509V3_F_GNAMES_FROM_SECTNAME 156
734#define X509V3_F_HEX_TO_STRING 111
735#define X509V3_F_I2S_ASN1_ENUMERATED 121
736#define X509V3_F_I2S_ASN1_IA5STRING 149
737#define X509V3_F_I2S_ASN1_INTEGER 120
738#define X509V3_F_I2V_AUTHORITY_INFO_ACCESS 138
739#define X509V3_F_NOTICE_SECTION 132
740#define X509V3_F_NREF_NOS 133
741#define X509V3_F_POLICY_SECTION 131
742#define X509V3_F_PROCESS_PCI_VALUE 150
743#define X509V3_F_R2I_CERTPOL 130
744#define X509V3_F_R2I_PCI 155
745#define X509V3_F_S2I_ASN1_IA5STRING 100
746#define X509V3_F_S2I_ASN1_INTEGER 108
747#define X509V3_F_S2I_ASN1_OCTET_STRING 112
748#define X509V3_F_S2I_ASN1_SKEY_ID 114
749#define X509V3_F_S2I_SKEY_ID 115
750#define X509V3_F_SET_DIST_POINT_NAME 158
751#define X509V3_F_STRING_TO_HEX 113
752#define X509V3_F_SXNET_ADD_ID_ASC 125
753#define X509V3_F_SXNET_ADD_ID_INTEGER 126
754#define X509V3_F_SXNET_ADD_ID_ULONG 127
755#define X509V3_F_SXNET_GET_ID_ASC 128
756#define X509V3_F_SXNET_GET_ID_ULONG 129
757#define X509V3_F_V2I_ASIDENTIFIERS 163
758#define X509V3_F_V2I_ASN1_BIT_STRING 101
759#define X509V3_F_V2I_AUTHORITY_INFO_ACCESS 139
760#define X509V3_F_V2I_AUTHORITY_KEYID 119
761#define X509V3_F_V2I_BASIC_CONSTRAINTS 102
762#define X509V3_F_V2I_CRLD 134
763#define X509V3_F_V2I_EXTENDED_KEY_USAGE 103
764#define X509V3_F_V2I_GENERAL_NAMES 118
765#define X509V3_F_V2I_GENERAL_NAME_EX 117
766#define X509V3_F_V2I_IDP 157
767#define X509V3_F_V2I_IPADDRBLOCKS 159
768#define X509V3_F_V2I_ISSUER_ALT 153
769#define X509V3_F_V2I_NAME_CONSTRAINTS 147
770#define X509V3_F_V2I_POLICY_CONSTRAINTS 146
771#define X509V3_F_V2I_POLICY_MAPPINGS 145
772#define X509V3_F_V2I_SUBJECT_ALT 154
773#define X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL 160
774#define X509V3_F_V3_GENERIC_EXTENSION 116
775#define X509V3_F_X509V3_ADD1_I2D 140
776#define X509V3_F_X509V3_ADD_VALUE 105
777#define X509V3_F_X509V3_EXT_ADD 104
778#define X509V3_F_X509V3_EXT_ADD_ALIAS 106
779#define X509V3_F_X509V3_EXT_CONF 107
780#define X509V3_F_X509V3_EXT_I2D 136
781#define X509V3_F_X509V3_EXT_NCONF 152
782#define X509V3_F_X509V3_GET_SECTION 142
783#define X509V3_F_X509V3_GET_STRING 143
784#define X509V3_F_X509V3_GET_VALUE_BOOL 110
785#define X509V3_F_X509V3_PARSE_LIST 109
786#define X509V3_F_X509_PURPOSE_ADD 137
787#define X509V3_F_X509_PURPOSE_SET 141
788
789/* Reason codes. */
790#define X509V3_R_BAD_IP_ADDRESS 118
791#define X509V3_R_BAD_OBJECT 119
792#define X509V3_R_BN_DEC2BN_ERROR 100
793#define X509V3_R_BN_TO_ASN1_INTEGER_ERROR 101
794#define X509V3_R_DIRNAME_ERROR 149
795#define X509V3_R_DISTPOINT_ALREADY_SET 160
796#define X509V3_R_DUPLICATE_ZONE_ID 133
797#define X509V3_R_ERROR_CONVERTING_ZONE 131
798#define X509V3_R_ERROR_CREATING_EXTENSION 144
799#define X509V3_R_ERROR_IN_EXTENSION 128
800#define X509V3_R_EXPECTED_A_SECTION_NAME 137
801#define X509V3_R_EXTENSION_EXISTS 145
802#define X509V3_R_EXTENSION_NAME_ERROR 115
803#define X509V3_R_EXTENSION_NOT_FOUND 102
804#define X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED 103
805#define X509V3_R_EXTENSION_VALUE_ERROR 116
806#define X509V3_R_ILLEGAL_EMPTY_EXTENSION 151
807#define X509V3_R_ILLEGAL_HEX_DIGIT 113
808#define X509V3_R_INCORRECT_POLICY_SYNTAX_TAG 152
809#define X509V3_R_INVALID_MULTIPLE_RDNS 161
810#define X509V3_R_INVALID_ASNUMBER 162
811#define X509V3_R_INVALID_ASRANGE 163
812#define X509V3_R_INVALID_BOOLEAN_STRING 104
813#define X509V3_R_INVALID_EXTENSION_STRING 105
814#define X509V3_R_INVALID_INHERITANCE 165
815#define X509V3_R_INVALID_IPADDRESS 166
816#define X509V3_R_INVALID_NAME 106
817#define X509V3_R_INVALID_NULL_ARGUMENT 107
818#define X509V3_R_INVALID_NULL_NAME 108
819#define X509V3_R_INVALID_NULL_VALUE 109
820#define X509V3_R_INVALID_NUMBER 140
821#define X509V3_R_INVALID_NUMBERS 141
822#define X509V3_R_INVALID_OBJECT_IDENTIFIER 110
823#define X509V3_R_INVALID_OPTION 138
824#define X509V3_R_INVALID_POLICY_IDENTIFIER 134
825#define X509V3_R_INVALID_PROXY_POLICY_SETTING 153
826#define X509V3_R_INVALID_PURPOSE 146
827#define X509V3_R_INVALID_SAFI 164
828#define X509V3_R_INVALID_SECTION 135
829#define X509V3_R_INVALID_SYNTAX 143
830#define X509V3_R_ISSUER_DECODE_ERROR 126
831#define X509V3_R_MISSING_VALUE 124
832#define X509V3_R_NEED_ORGANIZATION_AND_NUMBERS 142
833#define X509V3_R_NO_CONFIG_DATABASE 136
834#define X509V3_R_NO_ISSUER_CERTIFICATE 121
835#define X509V3_R_NO_ISSUER_DETAILS 127
836#define X509V3_R_NO_POLICY_IDENTIFIER 139
837#define X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED 154
838#define X509V3_R_NO_PUBLIC_KEY 114
839#define X509V3_R_NO_SUBJECT_DETAILS 125
840#define X509V3_R_ODD_NUMBER_OF_DIGITS 112
841#define X509V3_R_OPERATION_NOT_DEFINED 148
842#define X509V3_R_OTHERNAME_ERROR 147
843#define X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED 155
844#define X509V3_R_POLICY_PATH_LENGTH 156
845#define X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED 157
846#define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED 158
847#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 159
848#define X509V3_R_SECTION_NOT_FOUND 150
849#define X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS 122
850#define X509V3_R_UNABLE_TO_GET_ISSUER_KEYID 123
851#define X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT 111
852#define X509V3_R_UNKNOWN_EXTENSION 129
853#define X509V3_R_UNKNOWN_EXTENSION_NAME 130
854#define X509V3_R_UNKNOWN_OPTION 120
855#define X509V3_R_UNSUPPORTED_OPTION 117
856#define X509V3_R_UNSUPPORTED_TYPE 167
857#define X509V3_R_USER_TOO_LONG 132
858
859#ifdef __cplusplus
860}
861#endif
862#endif
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-11 09:20:40 +0000