summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509
diff options
context:
space:
mode:
authordjm <>2010-10-01 22:59:01 +0000
committerdjm <>2010-10-01 22:59:01 +0000
commit8922d4bc4a8b8893d72a48deb2cdf58215f98505 (patch)
tree939b752540947d33507b3acc48d76a8bfb7c3dc3 /src/lib/libcrypto/x509
parent76262f7bf9262f965142b1b2b2105cb279c5c696 (diff)
downloadopenbsd-8922d4bc4a8b8893d72a48deb2cdf58215f98505.tar.gz
openbsd-8922d4bc4a8b8893d72a48deb2cdf58215f98505.tar.bz2
openbsd-8922d4bc4a8b8893d72a48deb2cdf58215f98505.zip
resolve conflicts, fix local changes
Diffstat (limited to 'src/lib/libcrypto/x509')
-rw-r--r--src/lib/libcrypto/x509/Makefile.ssl594
-rw-r--r--src/lib/libcrypto/x509/by_dir.c226
-rw-r--r--src/lib/libcrypto/x509/by_file.c2
-rw-r--r--src/lib/libcrypto/x509/x509.h258
-rw-r--r--src/lib/libcrypto/x509/x509_cmp.c237
-rw-r--r--src/lib/libcrypto/x509/x509_err.c5
-rw-r--r--src/lib/libcrypto/x509/x509_lu.c215
-rw-r--r--src/lib/libcrypto/x509/x509_obj.c2
-rw-r--r--src/lib/libcrypto/x509/x509_req.c24
-rw-r--r--src/lib/libcrypto/x509/x509_set.c4
-rw-r--r--src/lib/libcrypto/x509/x509_trs.c3
-rw-r--r--src/lib/libcrypto/x509/x509_txt.c24
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.c951
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.h38
-rw-r--r--src/lib/libcrypto/x509/x509cset.c4
-rw-r--r--src/lib/libcrypto/x509/x509name.c2
-rw-r--r--src/lib/libcrypto/x509/x509type.c4
-rw-r--r--src/lib/libcrypto/x509/x_all.c7
18 files changed, 1396 insertions, 1204 deletions
diff --git a/src/lib/libcrypto/x509/Makefile.ssl b/src/lib/libcrypto/x509/Makefile.ssl
deleted file mode 100644
index 3a3452536c..0000000000
--- a/src/lib/libcrypto/x509/Makefile.ssl
+++ /dev/null
@@ -1,594 +0,0 @@
1#
2# SSLeay/crypto/x509/Makefile
3#
4
5DIR= x509
6TOP= ../..
7CC= cc
8INCLUDES= -I.. -I$(TOP) -I../../include
9CFLAG=-g
10INSTALL_PREFIX=
11OPENSSLDIR= /usr/local/ssl
12INSTALLTOP=/usr/local/ssl
13MAKE= make -f Makefile.ssl
14MAKEDEPPROG= makedepend
15MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
16MAKEFILE= Makefile.ssl
17AR= ar r
18
19CFLAGS= $(INCLUDES) $(CFLAG)
20
21GENERAL=Makefile README
22TEST=
23APPS=
24
25LIB=$(TOP)/libcrypto.a
26LIBSRC= x509_def.c x509_d2.c x509_r2x.c x509_cmp.c \
27 x509_obj.c x509_req.c x509spki.c x509_vfy.c \
28 x509_set.c x509cset.c x509rset.c x509_err.c \
29 x509name.c x509_v3.c x509_ext.c x509_att.c \
30 x509type.c x509_lu.c x_all.c x509_txt.c \
31 x509_trs.c by_file.c by_dir.c
32LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \
33 x509_obj.o x509_req.o x509spki.o x509_vfy.o \
34 x509_set.o x509cset.o x509rset.o x509_err.o \
35 x509name.o x509_v3.o x509_ext.o x509_att.o \
36 x509type.o x509_lu.o x_all.o x509_txt.o \
37 x509_trs.o by_file.o by_dir.o
38
39SRC= $(LIBSRC)
40
41EXHEADER= x509.h x509_vfy.h
42HEADER= $(EXHEADER)
43
44ALL= $(GENERAL) $(SRC) $(HEADER)
45
46top:
47 (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
48
49all: lib
50
51lib: $(LIBOBJ)
52 $(AR) $(LIB) $(LIBOBJ)
53 $(RANLIB) $(LIB) || echo Never mind.
54 @touch lib
55
56files:
57 $(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
58
59links:
60 @sh $(TOP)/util/point.sh Makefile.ssl Makefile
61 @$(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
62 @$(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
63 @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
64
65install:
66 @for i in $(EXHEADER) ; \
67 do \
68 (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
69 chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
70 done;
71
72tags:
73 ctags $(SRC)
74
75tests:
76
77lint:
78 lint -DLINT $(INCLUDES) $(SRC)>fluff
79
80depend:
81 $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
82
83dclean:
84 $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
85 mv -f Makefile.new $(MAKEFILE)
86
87clean:
88 rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
89
90# DO NOT DELETE THIS LINE -- make depend depends on it.
91
92by_dir.o: ../../e_os.h ../../include/openssl/aes.h ../../include/openssl/asn1.h
93by_dir.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
94by_dir.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
95by_dir.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
96by_dir.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
97by_dir.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
98by_dir.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
99by_dir.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
100by_dir.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
101by_dir.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
102by_dir.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
103by_dir.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
104by_dir.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
105by_dir.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
106by_dir.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
107by_dir.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
108by_dir.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
109by_dir.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
110by_dir.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
111by_dir.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
112by_dir.o: ../cryptlib.h by_dir.c
113by_file.o: ../../e_os.h ../../include/openssl/aes.h
114by_file.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
115by_file.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
116by_file.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
117by_file.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
118by_file.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
119by_file.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
120by_file.o: ../../include/openssl/err.h ../../include/openssl/evp.h
121by_file.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
122by_file.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
123by_file.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
124by_file.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
125by_file.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
126by_file.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
127by_file.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
128by_file.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
129by_file.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
130by_file.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
131by_file.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
132by_file.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
133by_file.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
134by_file.o: ../../include/openssl/x509_vfy.h ../cryptlib.h by_file.c
135x509_att.o: ../../e_os.h ../../include/openssl/aes.h
136x509_att.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
137x509_att.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
138x509_att.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
139x509_att.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
140x509_att.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
141x509_att.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
142x509_att.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
143x509_att.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
144x509_att.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
145x509_att.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
146x509_att.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
147x509_att.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
148x509_att.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
149x509_att.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
150x509_att.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
151x509_att.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
152x509_att.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
153x509_att.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
154x509_att.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
155x509_att.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
156x509_att.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_att.c
157x509_cmp.o: ../../e_os.h ../../include/openssl/aes.h
158x509_cmp.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
159x509_cmp.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
160x509_cmp.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
161x509_cmp.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
162x509_cmp.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
163x509_cmp.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
164x509_cmp.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
165x509_cmp.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
166x509_cmp.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
167x509_cmp.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
168x509_cmp.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
169x509_cmp.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
170x509_cmp.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
171x509_cmp.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
172x509_cmp.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
173x509_cmp.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
174x509_cmp.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
175x509_cmp.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
176x509_cmp.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
177x509_cmp.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
178x509_cmp.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_cmp.c
179x509_d2.o: ../../e_os.h ../../include/openssl/aes.h
180x509_d2.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
181x509_d2.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
182x509_d2.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
183x509_d2.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
184x509_d2.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
185x509_d2.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
186x509_d2.o: ../../include/openssl/err.h ../../include/openssl/evp.h
187x509_d2.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
188x509_d2.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
189x509_d2.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
190x509_d2.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
191x509_d2.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
192x509_d2.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pkcs7.h
193x509_d2.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
194x509_d2.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
195x509_d2.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
196x509_d2.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
197x509_d2.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
198x509_d2.o: ../../include/openssl/ui_compat.h ../../include/openssl/x509.h
199x509_d2.o: ../../include/openssl/x509_vfy.h ../cryptlib.h x509_d2.c
200x509_def.o: ../../e_os.h ../../include/openssl/aes.h
201x509_def.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
202x509_def.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
203x509_def.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
204x509_def.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
205x509_def.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
206x509_def.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
207x509_def.o: ../../include/openssl/err.h ../../include/openssl/evp.h
208x509_def.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
209x509_def.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
210x509_def.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
211x509_def.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
212x509_def.o: ../../include/openssl/opensslconf.h
213x509_def.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
214x509_def.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
215x509_def.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
216x509_def.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
217x509_def.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
218x509_def.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
219x509_def.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
220x509_def.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
221x509_def.o: ../cryptlib.h x509_def.c
222x509_err.o: ../../include/openssl/aes.h ../../include/openssl/asn1.h
223x509_err.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
224x509_err.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
225x509_err.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
226x509_err.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
227x509_err.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
228x509_err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
229x509_err.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
230x509_err.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
231x509_err.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
232x509_err.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
233x509_err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
234x509_err.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
235x509_err.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
236x509_err.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
237x509_err.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
238x509_err.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
239x509_err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
240x509_err.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
241x509_err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
242x509_err.o: x509_err.c
243x509_ext.o: ../../e_os.h ../../include/openssl/aes.h
244x509_ext.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
245x509_ext.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
246x509_ext.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
247x509_ext.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
248x509_ext.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
249x509_ext.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
250x509_ext.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
251x509_ext.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
252x509_ext.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
253x509_ext.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
254x509_ext.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
255x509_ext.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
256x509_ext.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
257x509_ext.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
258x509_ext.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
259x509_ext.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
260x509_ext.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
261x509_ext.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
262x509_ext.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
263x509_ext.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
264x509_ext.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_ext.c
265x509_lu.o: ../../e_os.h ../../include/openssl/aes.h
266x509_lu.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
267x509_lu.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
268x509_lu.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
269x509_lu.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
270x509_lu.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
271x509_lu.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
272x509_lu.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
273x509_lu.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
274x509_lu.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
275x509_lu.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
276x509_lu.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
277x509_lu.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
278x509_lu.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
279x509_lu.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
280x509_lu.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
281x509_lu.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
282x509_lu.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
283x509_lu.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
284x509_lu.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
285x509_lu.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
286x509_lu.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_lu.c
287x509_obj.o: ../../e_os.h ../../include/openssl/aes.h
288x509_obj.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
289x509_obj.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
290x509_obj.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
291x509_obj.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
292x509_obj.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
293x509_obj.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
294x509_obj.o: ../../include/openssl/err.h ../../include/openssl/evp.h
295x509_obj.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
296x509_obj.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
297x509_obj.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
298x509_obj.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
299x509_obj.o: ../../include/openssl/opensslconf.h
300x509_obj.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
301x509_obj.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
302x509_obj.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
303x509_obj.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
304x509_obj.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
305x509_obj.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
306x509_obj.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
307x509_obj.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
308x509_obj.o: ../cryptlib.h x509_obj.c
309x509_r2x.o: ../../e_os.h ../../include/openssl/aes.h
310x509_r2x.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
311x509_r2x.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
312x509_r2x.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
313x509_r2x.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
314x509_r2x.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
315x509_r2x.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
316x509_r2x.o: ../../include/openssl/err.h ../../include/openssl/evp.h
317x509_r2x.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
318x509_r2x.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
319x509_r2x.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
320x509_r2x.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
321x509_r2x.o: ../../include/openssl/opensslconf.h
322x509_r2x.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
323x509_r2x.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
324x509_r2x.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
325x509_r2x.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
326x509_r2x.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
327x509_r2x.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
328x509_r2x.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
329x509_r2x.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
330x509_r2x.o: ../cryptlib.h x509_r2x.c
331x509_req.o: ../../e_os.h ../../include/openssl/aes.h
332x509_req.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
333x509_req.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
334x509_req.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
335x509_req.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
336x509_req.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
337x509_req.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
338x509_req.o: ../../include/openssl/err.h ../../include/openssl/evp.h
339x509_req.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
340x509_req.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
341x509_req.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
342x509_req.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
343x509_req.o: ../../include/openssl/opensslconf.h
344x509_req.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
345x509_req.o: ../../include/openssl/pem.h ../../include/openssl/pem2.h
346x509_req.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
347x509_req.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
348x509_req.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
349x509_req.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
350x509_req.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
351x509_req.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
352x509_req.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
353x509_req.o: ../cryptlib.h x509_req.c
354x509_set.o: ../../e_os.h ../../include/openssl/aes.h
355x509_set.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
356x509_set.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
357x509_set.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
358x509_set.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
359x509_set.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
360x509_set.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
361x509_set.o: ../../include/openssl/err.h ../../include/openssl/evp.h
362x509_set.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
363x509_set.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
364x509_set.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
365x509_set.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
366x509_set.o: ../../include/openssl/opensslconf.h
367x509_set.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
368x509_set.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
369x509_set.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
370x509_set.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
371x509_set.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
372x509_set.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
373x509_set.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
374x509_set.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
375x509_set.o: ../cryptlib.h x509_set.c
376x509_trs.o: ../../e_os.h ../../include/openssl/aes.h
377x509_trs.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
378x509_trs.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
379x509_trs.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
380x509_trs.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
381x509_trs.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
382x509_trs.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
383x509_trs.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
384x509_trs.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
385x509_trs.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
386x509_trs.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
387x509_trs.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
388x509_trs.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
389x509_trs.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
390x509_trs.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
391x509_trs.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
392x509_trs.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
393x509_trs.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
394x509_trs.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
395x509_trs.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
396x509_trs.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
397x509_trs.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_trs.c
398x509_txt.o: ../../e_os.h ../../include/openssl/aes.h
399x509_txt.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
400x509_txt.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
401x509_txt.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
402x509_txt.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
403x509_txt.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
404x509_txt.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
405x509_txt.o: ../../include/openssl/err.h ../../include/openssl/evp.h
406x509_txt.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
407x509_txt.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
408x509_txt.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
409x509_txt.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
410x509_txt.o: ../../include/openssl/opensslconf.h
411x509_txt.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
412x509_txt.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
413x509_txt.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
414x509_txt.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
415x509_txt.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
416x509_txt.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
417x509_txt.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
418x509_txt.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
419x509_txt.o: ../cryptlib.h x509_txt.c
420x509_v3.o: ../../e_os.h ../../include/openssl/aes.h
421x509_v3.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
422x509_v3.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
423x509_v3.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
424x509_v3.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
425x509_v3.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
426x509_v3.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
427x509_v3.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
428x509_v3.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
429x509_v3.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
430x509_v3.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
431x509_v3.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
432x509_v3.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
433x509_v3.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
434x509_v3.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
435x509_v3.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
436x509_v3.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
437x509_v3.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
438x509_v3.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
439x509_v3.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
440x509_v3.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
441x509_v3.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_v3.c
442x509_vfy.o: ../../e_os.h ../../include/openssl/aes.h
443x509_vfy.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
444x509_vfy.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
445x509_vfy.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
446x509_vfy.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
447x509_vfy.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
448x509_vfy.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
449x509_vfy.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
450x509_vfy.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
451x509_vfy.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
452x509_vfy.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
453x509_vfy.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
454x509_vfy.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
455x509_vfy.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
456x509_vfy.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
457x509_vfy.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
458x509_vfy.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
459x509_vfy.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
460x509_vfy.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
461x509_vfy.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
462x509_vfy.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
463x509_vfy.o: ../../include/openssl/x509v3.h ../cryptlib.h x509_vfy.c
464x509cset.o: ../../e_os.h ../../include/openssl/aes.h
465x509cset.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
466x509cset.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
467x509cset.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
468x509cset.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
469x509cset.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
470x509cset.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
471x509cset.o: ../../include/openssl/err.h ../../include/openssl/evp.h
472x509cset.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
473x509cset.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
474x509cset.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
475x509cset.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
476x509cset.o: ../../include/openssl/opensslconf.h
477x509cset.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
478x509cset.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
479x509cset.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
480x509cset.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
481x509cset.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
482x509cset.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
483x509cset.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
484x509cset.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
485x509cset.o: ../cryptlib.h x509cset.c
486x509name.o: ../../e_os.h ../../include/openssl/aes.h
487x509name.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
488x509name.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
489x509name.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
490x509name.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
491x509name.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
492x509name.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
493x509name.o: ../../include/openssl/err.h ../../include/openssl/evp.h
494x509name.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
495x509name.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
496x509name.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
497x509name.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
498x509name.o: ../../include/openssl/opensslconf.h
499x509name.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
500x509name.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
501x509name.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
502x509name.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
503x509name.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
504x509name.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
505x509name.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
506x509name.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
507x509name.o: ../cryptlib.h x509name.c
508x509rset.o: ../../e_os.h ../../include/openssl/aes.h
509x509rset.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
510x509rset.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
511x509rset.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
512x509rset.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
513x509rset.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
514x509rset.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
515x509rset.o: ../../include/openssl/err.h ../../include/openssl/evp.h
516x509rset.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
517x509rset.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
518x509rset.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
519x509rset.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
520x509rset.o: ../../include/openssl/opensslconf.h
521x509rset.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
522x509rset.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
523x509rset.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
524x509rset.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
525x509rset.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
526x509rset.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
527x509rset.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
528x509rset.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
529x509rset.o: ../cryptlib.h x509rset.c
530x509spki.o: ../../e_os.h ../../include/openssl/aes.h
531x509spki.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
532x509spki.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
533x509spki.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
534x509spki.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
535x509spki.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
536x509spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
537x509spki.o: ../../include/openssl/err.h ../../include/openssl/evp.h
538x509spki.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
539x509spki.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
540x509spki.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
541x509spki.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
542x509spki.o: ../../include/openssl/opensslconf.h
543x509spki.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
544x509spki.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
545x509spki.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
546x509spki.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
547x509spki.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
548x509spki.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
549x509spki.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
550x509spki.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
551x509spki.o: ../cryptlib.h x509spki.c
552x509type.o: ../../e_os.h ../../include/openssl/aes.h
553x509type.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
554x509type.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
555x509type.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
556x509type.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
557x509type.o: ../../include/openssl/des_old.h ../../include/openssl/dh.h
558x509type.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
559x509type.o: ../../include/openssl/err.h ../../include/openssl/evp.h
560x509type.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
561x509type.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
562x509type.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
563x509type.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
564x509type.o: ../../include/openssl/opensslconf.h
565x509type.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
566x509type.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
567x509type.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
568x509type.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
569x509type.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
570x509type.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
571x509type.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
572x509type.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
573x509type.o: ../cryptlib.h x509type.c
574x_all.o: ../../e_os.h ../../include/openssl/aes.h ../../include/openssl/asn1.h
575x_all.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
576x_all.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
577x_all.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
578x_all.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
579x_all.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
580x_all.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
581x_all.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
582x_all.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
583x_all.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
584x_all.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
585x_all.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
586x_all.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
587x_all.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
588x_all.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
589x_all.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
590x_all.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
591x_all.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
592x_all.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
593x_all.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
594x_all.o: ../cryptlib.h x_all.c
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
index 341e0ba6a4..27ca5150c1 100644
--- a/src/lib/libcrypto/x509/by_dir.c
+++ b/src/lib/libcrypto/x509/by_dir.c
@@ -65,28 +65,36 @@
65#ifndef NO_SYS_TYPES_H 65#ifndef NO_SYS_TYPES_H
66# include <sys/types.h> 66# include <sys/types.h>
67#endif 67#endif
68#ifdef MAC_OS_pre_X 68#ifndef OPENSSL_NO_POSIX_IO
69# include <stat.h>
70#else
71# include <sys/stat.h> 69# include <sys/stat.h>
72#endif 70#endif
73 71
74#include <openssl/lhash.h> 72#include <openssl/lhash.h>
75#include <openssl/x509.h> 73#include <openssl/x509.h>
76 74
77#ifdef _WIN32 75
78#define stat _stat 76typedef struct lookup_dir_hashes_st
79#endif 77 {
78 unsigned long hash;
79 int suffix;
80 } BY_DIR_HASH;
81
82typedef struct lookup_dir_entry_st
83 {
84 char *dir;
85 int dir_type;
86 STACK_OF(BY_DIR_HASH) *hashes;
87 } BY_DIR_ENTRY;
80 88
81typedef struct lookup_dir_st 89typedef struct lookup_dir_st
82 { 90 {
83 BUF_MEM *buffer; 91 BUF_MEM *buffer;
84 int num_dirs; 92 STACK_OF(BY_DIR_ENTRY) *dirs;
85 char **dirs;
86 int *dirs_type;
87 int num_dirs_alloced;
88 } BY_DIR; 93 } BY_DIR;
89 94
95DECLARE_STACK_OF(BY_DIR_HASH)
96DECLARE_STACK_OF(BY_DIR_ENTRY)
97
90static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl, 98static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
91 char **ret); 99 char **ret);
92static int new_dir(X509_LOOKUP *lu); 100static int new_dir(X509_LOOKUP *lu);
@@ -127,7 +135,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
127 case X509_L_ADD_DIR: 135 case X509_L_ADD_DIR:
128 if (argl == X509_FILETYPE_DEFAULT) 136 if (argl == X509_FILETYPE_DEFAULT)
129 { 137 {
130 dir=(char *)Getenv(X509_get_default_cert_dir_env()); 138 dir=(char *)getenv(X509_get_default_cert_dir_env());
131 if (dir) 139 if (dir)
132 ret=add_cert_dir(ld,dir,X509_FILETYPE_PEM); 140 ret=add_cert_dir(ld,dir,X509_FILETYPE_PEM);
133 else 141 else
@@ -156,34 +164,51 @@ static int new_dir(X509_LOOKUP *lu)
156 OPENSSL_free(a); 164 OPENSSL_free(a);
157 return(0); 165 return(0);
158 } 166 }
159 a->num_dirs=0;
160 a->dirs=NULL; 167 a->dirs=NULL;
161 a->dirs_type=NULL;
162 a->num_dirs_alloced=0;
163 lu->method_data=(char *)a; 168 lu->method_data=(char *)a;
164 return(1); 169 return(1);
165 } 170 }
166 171
172static void by_dir_hash_free(BY_DIR_HASH *hash)
173 {
174 OPENSSL_free(hash);
175 }
176
177static int by_dir_hash_cmp(const BY_DIR_HASH * const *a,
178 const BY_DIR_HASH * const *b)
179 {
180 if ((*a)->hash > (*b)->hash)
181 return 1;
182 if ((*a)->hash < (*b)->hash)
183 return -1;
184 return 0;
185 }
186
187static void by_dir_entry_free(BY_DIR_ENTRY *ent)
188 {
189 if (ent->dir)
190 OPENSSL_free(ent->dir);
191 if (ent->hashes)
192 sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
193 OPENSSL_free(ent);
194 }
195
167static void free_dir(X509_LOOKUP *lu) 196static void free_dir(X509_LOOKUP *lu)
168 { 197 {
169 BY_DIR *a; 198 BY_DIR *a;
170 int i;
171 199
172 a=(BY_DIR *)lu->method_data; 200 a=(BY_DIR *)lu->method_data;
173 for (i=0; i<a->num_dirs; i++) 201 if (a->dirs != NULL)
174 if (a->dirs[i] != NULL) OPENSSL_free(a->dirs[i]); 202 sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
175 if (a->dirs != NULL) OPENSSL_free(a->dirs); 203 if (a->buffer != NULL)
176 if (a->dirs_type != NULL) OPENSSL_free(a->dirs_type); 204 BUF_MEM_free(a->buffer);
177 if (a->buffer != NULL) BUF_MEM_free(a->buffer);
178 OPENSSL_free(a); 205 OPENSSL_free(a);
179 } 206 }
180 207
181static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) 208static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
182 { 209 {
183 int j,len; 210 int j,len;
184 int *ip;
185 const char *s,*ss,*p; 211 const char *s,*ss,*p;
186 char **pp;
187 212
188 if (dir == NULL || !*dir) 213 if (dir == NULL || !*dir)
189 { 214 {
@@ -197,49 +222,52 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
197 { 222 {
198 if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) 223 if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0'))
199 { 224 {
225 BY_DIR_ENTRY *ent;
200 ss=s; 226 ss=s;
201 s=p+1; 227 s=p+1;
202 len=(int)(p-ss); 228 len=(int)(p-ss);
203 if (len == 0) continue; 229 if (len == 0) continue;
204 for (j=0; j<ctx->num_dirs; j++) 230 for (j=0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++)
205 if (strlen(ctx->dirs[j]) == (size_t)len && 231 {
206 strncmp(ctx->dirs[j],ss,(unsigned int)len) == 0) 232 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
233 if (strlen(ent->dir) == (size_t)len &&
234 strncmp(ent->dir,ss,(unsigned int)len) == 0)
207 break; 235 break;
208 if (j<ctx->num_dirs) 236 }
237 if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
209 continue; 238 continue;
210 if (ctx->num_dirs_alloced < (ctx->num_dirs+1)) 239 if (ctx->dirs == NULL)
211 { 240 {
212 ctx->num_dirs_alloced+=10; 241 ctx->dirs = sk_BY_DIR_ENTRY_new_null();
213 pp=(char **)OPENSSL_malloc(ctx->num_dirs_alloced* 242 if (!ctx->dirs)
214 sizeof(char *));
215 ip=(int *)OPENSSL_malloc(ctx->num_dirs_alloced*
216 sizeof(int));
217 if ((pp == NULL) || (ip == NULL))
218 { 243 {
219 X509err(X509_F_ADD_CERT_DIR,ERR_R_MALLOC_FAILURE); 244 X509err(X509_F_ADD_CERT_DIR,ERR_R_MALLOC_FAILURE);
220 return(0); 245 return 0;
221 } 246 }
222 memcpy(pp,ctx->dirs,(ctx->num_dirs_alloced-10)*
223 sizeof(char *));
224 memcpy(ip,ctx->dirs_type,(ctx->num_dirs_alloced-10)*
225 sizeof(int));
226 if (ctx->dirs != NULL)
227 OPENSSL_free(ctx->dirs);
228 if (ctx->dirs_type != NULL)
229 OPENSSL_free(ctx->dirs_type);
230 ctx->dirs=pp;
231 ctx->dirs_type=ip;
232 } 247 }
233 ctx->dirs_type[ctx->num_dirs]=type; 248 ent = OPENSSL_malloc(sizeof(BY_DIR_ENTRY));
234 ctx->dirs[ctx->num_dirs]=(char *)OPENSSL_malloc((unsigned int)len+1); 249 if (!ent)
235 if (ctx->dirs[ctx->num_dirs] == NULL) return(0); 250 return 0;
236 strncpy(ctx->dirs[ctx->num_dirs],ss,(unsigned int)len); 251 ent->dir_type = type;
237 ctx->dirs[ctx->num_dirs][len]='\0'; 252 ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
238 ctx->num_dirs++; 253 ent->dir = OPENSSL_malloc((unsigned int)len+1);
254 if (!ent->dir || !ent->hashes)
255 {
256 by_dir_entry_free(ent);
257 return 0;
258 }
259 strncpy(ent->dir,ss,(unsigned int)len);
260 ent->dir[len] = '\0';
261 if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent))
262 {
263 by_dir_entry_free(ent);
264 return 0;
265 }
239 } 266 }
240 if (*p == '\0') break; 267 if (*p == '\0')
268 break;
241 } 269 }
242 return(1); 270 return 1;
243 } 271 }
244 272
245static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name, 273static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
@@ -260,7 +288,6 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
260 int i,j,k; 288 int i,j,k;
261 unsigned long h; 289 unsigned long h;
262 BUF_MEM *b=NULL; 290 BUF_MEM *b=NULL;
263 struct stat st;
264 X509_OBJECT stmp,*tmp; 291 X509_OBJECT stmp,*tmp;
265 const char *postfix=""; 292 const char *postfix="";
266 293
@@ -296,20 +323,45 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
296 ctx=(BY_DIR *)xl->method_data; 323 ctx=(BY_DIR *)xl->method_data;
297 324
298 h=X509_NAME_hash(name); 325 h=X509_NAME_hash(name);
299 for (i=0; i<ctx->num_dirs; i++) 326 for (i=0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++)
300 { 327 {
301 j=strlen(ctx->dirs[i])+1+8+6+1+1; 328 BY_DIR_ENTRY *ent;
329 int idx;
330 BY_DIR_HASH htmp, *hent;
331 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
332 j=strlen(ent->dir)+1+8+6+1+1;
302 if (!BUF_MEM_grow(b,j)) 333 if (!BUF_MEM_grow(b,j))
303 { 334 {
304 X509err(X509_F_GET_CERT_BY_SUBJECT,ERR_R_MALLOC_FAILURE); 335 X509err(X509_F_GET_CERT_BY_SUBJECT,ERR_R_MALLOC_FAILURE);
305 goto finish; 336 goto finish;
306 } 337 }
307 k=0; 338 if (type == X509_LU_CRL && ent->hashes)
339 {
340 htmp.hash = h;
341 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
342 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
343 if (idx >= 0)
344 {
345 hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
346 k = hent->suffix;
347 }
348 else
349 {
350 hent = NULL;
351 k=0;
352 }
353 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
354 }
355 else
356 {
357 k = 0;
358 hent = NULL;
359 }
308 for (;;) 360 for (;;)
309 { 361 {
310 char c = '/'; 362 char c = '/';
311#ifdef OPENSSL_SYS_VMS 363#ifdef OPENSSL_SYS_VMS
312 c = ctx->dirs[i][strlen(ctx->dirs[i])-1]; 364 c = ent->dir[strlen(ent->dir)-1];
313 if (c != ':' && c != '>' && c != ']') 365 if (c != ':' && c != '>' && c != ']')
314 { 366 {
315 /* If no separator is present, we assume the 367 /* If no separator is present, we assume the
@@ -330,41 +382,86 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
330 /* This is special. When c == '\0', no 382 /* This is special. When c == '\0', no
331 directory separator should be added. */ 383 directory separator should be added. */
332 BIO_snprintf(b->data,b->max, 384 BIO_snprintf(b->data,b->max,
333 "%s%08lx.%s%d",ctx->dirs[i],h, 385 "%s%08lx.%s%d",ent->dir,h,
334 postfix,k); 386 postfix,k);
335 } 387 }
336 else 388 else
337 { 389 {
338 BIO_snprintf(b->data,b->max, 390 BIO_snprintf(b->data,b->max,
339 "%s%c%08lx.%s%d",ctx->dirs[i],c,h, 391 "%s%c%08lx.%s%d",ent->dir,c,h,
340 postfix,k); 392 postfix,k);
341 } 393 }
342 k++; 394#ifndef OPENSSL_NO_POSIX_IO
395#ifdef _WIN32
396#define stat _stat
397#endif
398 {
399 struct stat st;
343 if (stat(b->data,&st) < 0) 400 if (stat(b->data,&st) < 0)
344 break; 401 break;
402 }
403#endif
345 /* found one. */ 404 /* found one. */
346 if (type == X509_LU_X509) 405 if (type == X509_LU_X509)
347 { 406 {
348 if ((X509_load_cert_file(xl,b->data, 407 if ((X509_load_cert_file(xl,b->data,
349 ctx->dirs_type[i])) == 0) 408 ent->dir_type)) == 0)
350 break; 409 break;
351 } 410 }
352 else if (type == X509_LU_CRL) 411 else if (type == X509_LU_CRL)
353 { 412 {
354 if ((X509_load_crl_file(xl,b->data, 413 if ((X509_load_crl_file(xl,b->data,
355 ctx->dirs_type[i])) == 0) 414 ent->dir_type)) == 0)
356 break; 415 break;
357 } 416 }
358 /* else case will caught higher up */ 417 /* else case will caught higher up */
418 k++;
359 } 419 }
360 420
361 /* we have added it to the cache so now pull 421 /* we have added it to the cache so now pull
362 * it out again */ 422 * it out again */
363 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); 423 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
364 j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp); 424 j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp);
365 if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j); 425 if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j);
366 else tmp = NULL; 426 else tmp = NULL;
367 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); 427 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
428
429
430 /* If a CRL, update the last file suffix added for this */
431
432 if (type == X509_LU_CRL)
433 {
434 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
435 /* Look for entry again in case another thread added
436 * an entry first.
437 */
438 if (!hent)
439 {
440 htmp.hash = h;
441 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
442 if (idx >= 0)
443 hent =
444 sk_BY_DIR_HASH_value(ent->hashes, idx);
445 }
446 if (!hent)
447 {
448 hent = OPENSSL_malloc(sizeof(BY_DIR_HASH));
449 hent->hash = h;
450 hent->suffix = k;
451 if (!sk_BY_DIR_HASH_push(ent->hashes, hent))
452 {
453 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
454 OPENSSL_free(hent);
455 ok = 0;
456 goto finish;
457 }
458 }
459 else if (hent->suffix < k)
460 hent->suffix = k;
461
462 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
463
464 }
368 465
369 if (tmp != NULL) 466 if (tmp != NULL)
370 { 467 {
@@ -383,4 +480,3 @@ finish:
383 if (b != NULL) BUF_MEM_free(b); 480 if (b != NULL) BUF_MEM_free(b);
384 return(ok); 481 return(ok);
385 } 482 }
386
diff --git a/src/lib/libcrypto/x509/by_file.c b/src/lib/libcrypto/x509/by_file.c
index a5e0d4aefa..57b08ee094 100644
--- a/src/lib/libcrypto/x509/by_file.c
+++ b/src/lib/libcrypto/x509/by_file.c
@@ -100,7 +100,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
100 case X509_L_FILE_LOAD: 100 case X509_L_FILE_LOAD:
101 if (argl == X509_FILETYPE_DEFAULT) 101 if (argl == X509_FILETYPE_DEFAULT)
102 { 102 {
103 file = (char *)Getenv(X509_get_default_cert_file_env()); 103 file = (char *)getenv(X509_get_default_cert_file_env());
104 if (file) 104 if (file)
105 ok = (X509_load_cert_crl_file(ctx,file, 105 ok = (X509_load_cert_crl_file(ctx,file,
106 X509_FILETYPE_PEM) != 0); 106 X509_FILETYPE_PEM) != 0);
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
index e71b5257e5..604f4fb27f 100644
--- a/src/lib/libcrypto/x509/x509.h
+++ b/src/lib/libcrypto/x509/x509.h
@@ -116,6 +116,7 @@ extern "C" {
116/* Under Win32 these are defined in wincrypt.h */ 116/* Under Win32 these are defined in wincrypt.h */
117#undef X509_NAME 117#undef X509_NAME
118#undef X509_CERT_PAIR 118#undef X509_CERT_PAIR
119#undef X509_EXTENSIONS
119#endif 120#endif
120 121
121#define X509_FILETYPE_PEM 1 122#define X509_FILETYPE_PEM 1
@@ -156,12 +157,12 @@ typedef struct X509_val_st
156 ASN1_TIME *notAfter; 157 ASN1_TIME *notAfter;
157 } X509_VAL; 158 } X509_VAL;
158 159
159typedef struct X509_pubkey_st 160struct X509_pubkey_st
160 { 161 {
161 X509_ALGOR *algor; 162 X509_ALGOR *algor;
162 ASN1_BIT_STRING *public_key; 163 ASN1_BIT_STRING *public_key;
163 EVP_PKEY *pkey; 164 EVP_PKEY *pkey;
164 } X509_PUBKEY; 165 };
165 166
166typedef struct X509_sig_st 167typedef struct X509_sig_st
167 { 168 {
@@ -190,7 +191,9 @@ struct X509_name_st
190#else 191#else
191 char *bytes; 192 char *bytes;
192#endif 193#endif
193 unsigned long hash; /* Keep the hash around for lookups */ 194/* unsigned long hash; Keep the hash around for lookups */
195 unsigned char *canon_enc;
196 int canon_enclen;
194 } /* X509_NAME */; 197 } /* X509_NAME */;
195 198
196DECLARE_STACK_OF(X509_NAME) 199DECLARE_STACK_OF(X509_NAME)
@@ -289,8 +292,11 @@ struct x509_st
289 unsigned long ex_xkusage; 292 unsigned long ex_xkusage;
290 unsigned long ex_nscert; 293 unsigned long ex_nscert;
291 ASN1_OCTET_STRING *skid; 294 ASN1_OCTET_STRING *skid;
292 struct AUTHORITY_KEYID_st *akid; 295 AUTHORITY_KEYID *akid;
293 X509_POLICY_CACHE *policy_cache; 296 X509_POLICY_CACHE *policy_cache;
297 STACK_OF(DIST_POINT) *crldp;
298 STACK_OF(GENERAL_NAME) *altname;
299 NAME_CONSTRAINTS *nc;
294#ifndef OPENSSL_NO_RFC3779 300#ifndef OPENSSL_NO_RFC3779
295 STACK_OF(IPAddressFamily) *rfc3779_addr; 301 STACK_OF(IPAddressFamily) *rfc3779_addr;
296 struct ASIdentifiers_st *rfc3779_asid; 302 struct ASIdentifiers_st *rfc3779_asid;
@@ -333,10 +339,11 @@ typedef struct x509_cert_pair_st {
333#define X509_TRUST_OBJECT_SIGN 5 339#define X509_TRUST_OBJECT_SIGN 5
334#define X509_TRUST_OCSP_SIGN 6 340#define X509_TRUST_OCSP_SIGN 6
335#define X509_TRUST_OCSP_REQUEST 7 341#define X509_TRUST_OCSP_REQUEST 7
342#define X509_TRUST_TSA 8
336 343
337/* Keep these up to date! */ 344/* Keep these up to date! */
338#define X509_TRUST_MIN 1 345#define X509_TRUST_MIN 1
339#define X509_TRUST_MAX 7 346#define X509_TRUST_MAX 8
340 347
341 348
342/* trust_flags values */ 349/* trust_flags values */
@@ -423,13 +430,17 @@ typedef struct x509_cert_pair_st {
423 XN_FLAG_FN_LN | \ 430 XN_FLAG_FN_LN | \
424 XN_FLAG_FN_ALIGN) 431 XN_FLAG_FN_ALIGN)
425 432
426typedef struct X509_revoked_st 433struct x509_revoked_st
427 { 434 {
428 ASN1_INTEGER *serialNumber; 435 ASN1_INTEGER *serialNumber;
429 ASN1_TIME *revocationDate; 436 ASN1_TIME *revocationDate;
430 STACK_OF(X509_EXTENSION) /* optional */ *extensions; 437 STACK_OF(X509_EXTENSION) /* optional */ *extensions;
438 /* Set up if indirect CRL */
439 STACK_OF(GENERAL_NAME) *issuer;
440 /* Revocation reason */
441 int reason;
431 int sequence; /* load sequence */ 442 int sequence; /* load sequence */
432 } X509_REVOKED; 443 };
433 444
434DECLARE_STACK_OF(X509_REVOKED) 445DECLARE_STACK_OF(X509_REVOKED)
435DECLARE_ASN1_SET_OF(X509_REVOKED) 446DECLARE_ASN1_SET_OF(X509_REVOKED)
@@ -453,6 +464,22 @@ struct X509_crl_st
453 X509_ALGOR *sig_alg; 464 X509_ALGOR *sig_alg;
454 ASN1_BIT_STRING *signature; 465 ASN1_BIT_STRING *signature;
455 int references; 466 int references;
467 int flags;
468 /* Copies of various extensions */
469 AUTHORITY_KEYID *akid;
470 ISSUING_DIST_POINT *idp;
471 /* Convenient breakdown of IDP */
472 int idp_flags;
473 int idp_reasons;
474 /* CRL and base CRL numbers for delta processing */
475 ASN1_INTEGER *crl_number;
476 ASN1_INTEGER *base_crl_number;
477#ifndef OPENSSL_NO_SHA
478 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
479#endif
480 STACK_OF(GENERAL_NAMES) *issuers;
481 const X509_CRL_METHOD *meth;
482 void *meth_data;
456 } /* X509_CRL */; 483 } /* X509_CRL */;
457 484
458DECLARE_STACK_OF(X509_CRL) 485DECLARE_STACK_OF(X509_CRL)
@@ -551,18 +578,19 @@ X509_ALGOR *prf;
551 578
552/* PKCS#8 private key info structure */ 579/* PKCS#8 private key info structure */
553 580
554typedef struct pkcs8_priv_key_info_st 581struct pkcs8_priv_key_info_st
555 { 582 {
556 int broken; /* Flag for various broken formats */ 583 int broken; /* Flag for various broken formats */
557#define PKCS8_OK 0 584#define PKCS8_OK 0
558#define PKCS8_NO_OCTET 1 585#define PKCS8_NO_OCTET 1
559#define PKCS8_EMBEDDED_PARAM 2 586#define PKCS8_EMBEDDED_PARAM 2
560#define PKCS8_NS_DB 3 587#define PKCS8_NS_DB 3
588#define PKCS8_NEG_PRIVKEY 4
561 ASN1_INTEGER *version; 589 ASN1_INTEGER *version;
562 X509_ALGOR *pkeyalg; 590 X509_ALGOR *pkeyalg;
563 ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */ 591 ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
564 STACK_OF(X509_ATTRIBUTE) *attributes; 592 STACK_OF(X509_ATTRIBUTE) *attributes;
565 } PKCS8_PRIV_KEY_INFO; 593 };
566 594
567#ifdef __cplusplus 595#ifdef __cplusplus
568} 596}
@@ -575,151 +603,6 @@ typedef struct pkcs8_priv_key_info_st
575extern "C" { 603extern "C" {
576#endif 604#endif
577 605
578#ifdef SSLEAY_MACROS
579#define X509_verify(a,r) ASN1_verify((int (*)())i2d_X509_CINF,a->sig_alg,\
580 a->signature,(char *)a->cert_info,r)
581#define X509_REQ_verify(a,r) ASN1_verify((int (*)())i2d_X509_REQ_INFO, \
582 a->sig_alg,a->signature,(char *)a->req_info,r)
583#define X509_CRL_verify(a,r) ASN1_verify((int (*)())i2d_X509_CRL_INFO, \
584 a->sig_alg, a->signature,(char *)a->crl,r)
585
586#define X509_sign(x,pkey,md) \
587 ASN1_sign((int (*)())i2d_X509_CINF, x->cert_info->signature, \
588 x->sig_alg, x->signature, (char *)x->cert_info,pkey,md)
589#define X509_REQ_sign(x,pkey,md) \
590 ASN1_sign((int (*)())i2d_X509_REQ_INFO,x->sig_alg, NULL, \
591 x->signature, (char *)x->req_info,pkey,md)
592#define X509_CRL_sign(x,pkey,md) \
593 ASN1_sign((int (*)())i2d_X509_CRL_INFO,x->crl->sig_alg,x->sig_alg, \
594 x->signature, (char *)x->crl,pkey,md)
595#define NETSCAPE_SPKI_sign(x,pkey,md) \
596 ASN1_sign((int (*)())i2d_NETSCAPE_SPKAC, x->sig_algor,NULL, \
597 x->signature, (char *)x->spkac,pkey,md)
598
599#define X509_dup(x509) (X509 *)ASN1_dup((int (*)())i2d_X509, \
600 (char *(*)())d2i_X509,(char *)x509)
601#define X509_ATTRIBUTE_dup(xa) (X509_ATTRIBUTE *)ASN1_dup(\
602 (int (*)())i2d_X509_ATTRIBUTE, \
603 (char *(*)())d2i_X509_ATTRIBUTE,(char *)xa)
604#define X509_EXTENSION_dup(ex) (X509_EXTENSION *)ASN1_dup( \
605 (int (*)())i2d_X509_EXTENSION, \
606 (char *(*)())d2i_X509_EXTENSION,(char *)ex)
607#define d2i_X509_fp(fp,x509) (X509 *)ASN1_d2i_fp((char *(*)())X509_new, \
608 (char *(*)())d2i_X509, (fp),(unsigned char **)(x509))
609#define i2d_X509_fp(fp,x509) ASN1_i2d_fp(i2d_X509,fp,(unsigned char *)x509)
610#define d2i_X509_bio(bp,x509) (X509 *)ASN1_d2i_bio((char *(*)())X509_new, \
611 (char *(*)())d2i_X509, (bp),(unsigned char **)(x509))
612#define i2d_X509_bio(bp,x509) ASN1_i2d_bio(i2d_X509,bp,(unsigned char *)x509)
613
614#define X509_CRL_dup(crl) (X509_CRL *)ASN1_dup((int (*)())i2d_X509_CRL, \
615 (char *(*)())d2i_X509_CRL,(char *)crl)
616#define d2i_X509_CRL_fp(fp,crl) (X509_CRL *)ASN1_d2i_fp((char *(*)()) \
617 X509_CRL_new,(char *(*)())d2i_X509_CRL, (fp),\
618 (unsigned char **)(crl))
619#define i2d_X509_CRL_fp(fp,crl) ASN1_i2d_fp(i2d_X509_CRL,fp,\
620 (unsigned char *)crl)
621#define d2i_X509_CRL_bio(bp,crl) (X509_CRL *)ASN1_d2i_bio((char *(*)()) \
622 X509_CRL_new,(char *(*)())d2i_X509_CRL, (bp),\
623 (unsigned char **)(crl))
624#define i2d_X509_CRL_bio(bp,crl) ASN1_i2d_bio(i2d_X509_CRL,bp,\
625 (unsigned char *)crl)
626
627#define PKCS7_dup(p7) (PKCS7 *)ASN1_dup((int (*)())i2d_PKCS7, \
628 (char *(*)())d2i_PKCS7,(char *)p7)
629#define d2i_PKCS7_fp(fp,p7) (PKCS7 *)ASN1_d2i_fp((char *(*)()) \
630 PKCS7_new,(char *(*)())d2i_PKCS7, (fp),\
631 (unsigned char **)(p7))
632#define i2d_PKCS7_fp(fp,p7) ASN1_i2d_fp(i2d_PKCS7,fp,\
633 (unsigned char *)p7)
634#define d2i_PKCS7_bio(bp,p7) (PKCS7 *)ASN1_d2i_bio((char *(*)()) \
635 PKCS7_new,(char *(*)())d2i_PKCS7, (bp),\
636 (unsigned char **)(p7))
637#define i2d_PKCS7_bio(bp,p7) ASN1_i2d_bio(i2d_PKCS7,bp,\
638 (unsigned char *)p7)
639
640#define X509_REQ_dup(req) (X509_REQ *)ASN1_dup((int (*)())i2d_X509_REQ, \
641 (char *(*)())d2i_X509_REQ,(char *)req)
642#define d2i_X509_REQ_fp(fp,req) (X509_REQ *)ASN1_d2i_fp((char *(*)())\
643 X509_REQ_new, (char *(*)())d2i_X509_REQ, (fp),\
644 (unsigned char **)(req))
645#define i2d_X509_REQ_fp(fp,req) ASN1_i2d_fp(i2d_X509_REQ,fp,\
646 (unsigned char *)req)
647#define d2i_X509_REQ_bio(bp,req) (X509_REQ *)ASN1_d2i_bio((char *(*)())\
648 X509_REQ_new, (char *(*)())d2i_X509_REQ, (bp),\
649 (unsigned char **)(req))
650#define i2d_X509_REQ_bio(bp,req) ASN1_i2d_bio(i2d_X509_REQ,bp,\
651 (unsigned char *)req)
652
653#define RSAPublicKey_dup(rsa) (RSA *)ASN1_dup((int (*)())i2d_RSAPublicKey, \
654 (char *(*)())d2i_RSAPublicKey,(char *)rsa)
655#define RSAPrivateKey_dup(rsa) (RSA *)ASN1_dup((int (*)())i2d_RSAPrivateKey, \
656 (char *(*)())d2i_RSAPrivateKey,(char *)rsa)
657
658#define d2i_RSAPrivateKey_fp(fp,rsa) (RSA *)ASN1_d2i_fp((char *(*)())\
659 RSA_new,(char *(*)())d2i_RSAPrivateKey, (fp), \
660 (unsigned char **)(rsa))
661#define i2d_RSAPrivateKey_fp(fp,rsa) ASN1_i2d_fp(i2d_RSAPrivateKey,fp, \
662 (unsigned char *)rsa)
663#define d2i_RSAPrivateKey_bio(bp,rsa) (RSA *)ASN1_d2i_bio((char *(*)())\
664 RSA_new,(char *(*)())d2i_RSAPrivateKey, (bp), \
665 (unsigned char **)(rsa))
666#define i2d_RSAPrivateKey_bio(bp,rsa) ASN1_i2d_bio(i2d_RSAPrivateKey,bp, \
667 (unsigned char *)rsa)
668
669#define d2i_RSAPublicKey_fp(fp,rsa) (RSA *)ASN1_d2i_fp((char *(*)())\
670 RSA_new,(char *(*)())d2i_RSAPublicKey, (fp), \
671 (unsigned char **)(rsa))
672#define i2d_RSAPublicKey_fp(fp,rsa) ASN1_i2d_fp(i2d_RSAPublicKey,fp, \
673 (unsigned char *)rsa)
674#define d2i_RSAPublicKey_bio(bp,rsa) (RSA *)ASN1_d2i_bio((char *(*)())\
675 RSA_new,(char *(*)())d2i_RSAPublicKey, (bp), \
676 (unsigned char **)(rsa))
677#define i2d_RSAPublicKey_bio(bp,rsa) ASN1_i2d_bio(i2d_RSAPublicKey,bp, \
678 (unsigned char *)rsa)
679
680#define d2i_DSAPrivateKey_fp(fp,dsa) (DSA *)ASN1_d2i_fp((char *(*)())\
681 DSA_new,(char *(*)())d2i_DSAPrivateKey, (fp), \
682 (unsigned char **)(dsa))
683#define i2d_DSAPrivateKey_fp(fp,dsa) ASN1_i2d_fp(i2d_DSAPrivateKey,fp, \
684 (unsigned char *)dsa)
685#define d2i_DSAPrivateKey_bio(bp,dsa) (DSA *)ASN1_d2i_bio((char *(*)())\
686 DSA_new,(char *(*)())d2i_DSAPrivateKey, (bp), \
687 (unsigned char **)(dsa))
688#define i2d_DSAPrivateKey_bio(bp,dsa) ASN1_i2d_bio(i2d_DSAPrivateKey,bp, \
689 (unsigned char *)dsa)
690
691#define d2i_ECPrivateKey_fp(fp,ecdsa) (EC_KEY *)ASN1_d2i_fp((char *(*)())\
692 EC_KEY_new,(char *(*)())d2i_ECPrivateKey, (fp), \
693 (unsigned char **)(ecdsa))
694#define i2d_ECPrivateKey_fp(fp,ecdsa) ASN1_i2d_fp(i2d_ECPrivateKey,fp, \
695 (unsigned char *)ecdsa)
696#define d2i_ECPrivateKey_bio(bp,ecdsa) (EC_KEY *)ASN1_d2i_bio((char *(*)())\
697 EC_KEY_new,(char *(*)())d2i_ECPrivateKey, (bp), \
698 (unsigned char **)(ecdsa))
699#define i2d_ECPrivateKey_bio(bp,ecdsa) ASN1_i2d_bio(i2d_ECPrivateKey,bp, \
700 (unsigned char *)ecdsa)
701
702#define X509_ALGOR_dup(xn) (X509_ALGOR *)ASN1_dup((int (*)())i2d_X509_ALGOR,\
703 (char *(*)())d2i_X509_ALGOR,(char *)xn)
704
705#define X509_NAME_dup(xn) (X509_NAME *)ASN1_dup((int (*)())i2d_X509_NAME, \
706 (char *(*)())d2i_X509_NAME,(char *)xn)
707#define X509_NAME_ENTRY_dup(ne) (X509_NAME_ENTRY *)ASN1_dup( \
708 (int (*)())i2d_X509_NAME_ENTRY, \
709 (char *(*)())d2i_X509_NAME_ENTRY,\
710 (char *)ne)
711
712#define X509_digest(data,type,md,len) \
713 ASN1_digest((int (*)())i2d_X509,type,(char *)data,md,len)
714#define X509_NAME_digest(data,type,md,len) \
715 ASN1_digest((int (*)())i2d_X509_NAME,type,(char *)data,md,len)
716#ifndef PKCS7_ISSUER_AND_SERIAL_digest
717#define PKCS7_ISSUER_AND_SERIAL_digest(data,type,md,len) \
718 ASN1_digest((int (*)())i2d_PKCS7_ISSUER_AND_SERIAL,type,\
719 (char *)data,md,len)
720#endif
721#endif
722
723#define X509_EXT_PACK_UNKNOWN 1 606#define X509_EXT_PACK_UNKNOWN 1
724#define X509_EXT_PACK_STRING 2 607#define X509_EXT_PACK_STRING 2
725 608
@@ -740,6 +623,18 @@ extern "C" {
740#define X509_CRL_get_issuer(x) ((x)->crl->issuer) 623#define X509_CRL_get_issuer(x) ((x)->crl->issuer)
741#define X509_CRL_get_REVOKED(x) ((x)->crl->revoked) 624#define X509_CRL_get_REVOKED(x) ((x)->crl->revoked)
742 625
626void X509_CRL_set_default_method(const X509_CRL_METHOD *meth);
627X509_CRL_METHOD *X509_CRL_METHOD_new(
628 int (*crl_init)(X509_CRL *crl),
629 int (*crl_free)(X509_CRL *crl),
630 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,
631 ASN1_INTEGER *ser, X509_NAME *issuer),
632 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk));
633void X509_CRL_METHOD_free(X509_CRL_METHOD *m);
634
635void X509_CRL_set_meth_data(X509_CRL *crl, void *dat);
636void *X509_CRL_get_meth_data(X509_CRL *crl);
637
743/* This one is only used so that a binary form can output, as in 638/* This one is only used so that a binary form can output, as in
744 * i2d_X509_NAME(X509_get_X509_PUBKEY(x),&buf) */ 639 * i2d_X509_NAME(X509_get_X509_PUBKEY(x),&buf) */
745#define X509_get_X509_PUBKEY(x) ((x)->cert_info->key) 640#define X509_get_X509_PUBKEY(x) ((x)->cert_info->key)
@@ -747,7 +642,6 @@ extern "C" {
747 642
748const char *X509_verify_cert_error_string(long n); 643const char *X509_verify_cert_error_string(long n);
749 644
750#ifndef SSLEAY_MACROS
751#ifndef OPENSSL_NO_EVP 645#ifndef OPENSSL_NO_EVP
752int X509_verify(X509 *a, EVP_PKEY *r); 646int X509_verify(X509 *a, EVP_PKEY *r);
753 647
@@ -872,11 +766,11 @@ void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
872X509_NAME *X509_NAME_dup(X509_NAME *xn); 766X509_NAME *X509_NAME_dup(X509_NAME *xn);
873X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne); 767X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
874 768
875#endif /* !SSLEAY_MACROS */ 769int X509_cmp_time(const ASN1_TIME *s, time_t *t);
876 770int X509_cmp_current_time(const ASN1_TIME *s);
877int X509_cmp_time(ASN1_TIME *s, time_t *t);
878int X509_cmp_current_time(ASN1_TIME *s);
879ASN1_TIME * X509_time_adj(ASN1_TIME *s, long adj, time_t *t); 771ASN1_TIME * X509_time_adj(ASN1_TIME *s, long adj, time_t *t);
772ASN1_TIME * X509_time_adj_ex(ASN1_TIME *s,
773 int offset_day, long offset_sec, time_t *t);
880ASN1_TIME * X509_gmtime_adj(ASN1_TIME *s, long adj); 774ASN1_TIME * X509_gmtime_adj(ASN1_TIME *s, long adj);
881 775
882const char * X509_get_default_cert_area(void ); 776const char * X509_get_default_cert_area(void );
@@ -964,6 +858,9 @@ DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
964DECLARE_ASN1_FUNCTIONS(X509_CRL) 858DECLARE_ASN1_FUNCTIONS(X509_CRL)
965 859
966int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev); 860int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
861int X509_CRL_get0_by_serial(X509_CRL *crl,
862 X509_REVOKED **ret, ASN1_INTEGER *serial);
863int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);
967 864
968X509_PKEY * X509_PKEY_new(void ); 865X509_PKEY * X509_PKEY_new(void );
969void X509_PKEY_free(X509_PKEY *a); 866void X509_PKEY_free(X509_PKEY *a);
@@ -1007,8 +904,8 @@ int X509_set_issuer_name(X509 *x, X509_NAME *name);
1007X509_NAME * X509_get_issuer_name(X509 *a); 904X509_NAME * X509_get_issuer_name(X509 *a);
1008int X509_set_subject_name(X509 *x, X509_NAME *name); 905int X509_set_subject_name(X509 *x, X509_NAME *name);
1009X509_NAME * X509_get_subject_name(X509 *a); 906X509_NAME * X509_get_subject_name(X509 *a);
1010int X509_set_notBefore(X509 *x, ASN1_TIME *tm); 907int X509_set_notBefore(X509 *x, const ASN1_TIME *tm);
1011int X509_set_notAfter(X509 *x, ASN1_TIME *tm); 908int X509_set_notAfter(X509 *x, const ASN1_TIME *tm);
1012int X509_set_pubkey(X509 *x, EVP_PKEY *pkey); 909int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
1013EVP_PKEY * X509_get_pubkey(X509 *x); 910EVP_PKEY * X509_get_pubkey(X509 *x);
1014ASN1_BIT_STRING * X509_get0_pubkey_bitstr(const X509 *x); 911ASN1_BIT_STRING * X509_get0_pubkey_bitstr(const X509 *x);
@@ -1045,8 +942,8 @@ int X509_REQ_add1_attr_by_txt(X509_REQ *req,
1045 942
1046int X509_CRL_set_version(X509_CRL *x, long version); 943int X509_CRL_set_version(X509_CRL *x, long version);
1047int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name); 944int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name);
1048int X509_CRL_set_lastUpdate(X509_CRL *x, ASN1_TIME *tm); 945int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
1049int X509_CRL_set_nextUpdate(X509_CRL *x, ASN1_TIME *tm); 946int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);
1050int X509_CRL_sort(X509_CRL *crl); 947int X509_CRL_sort(X509_CRL *crl);
1051 948
1052int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial); 949int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
@@ -1065,11 +962,18 @@ unsigned long X509_issuer_name_hash(X509 *a);
1065int X509_subject_name_cmp(const X509 *a, const X509 *b); 962int X509_subject_name_cmp(const X509 *a, const X509 *b);
1066unsigned long X509_subject_name_hash(X509 *x); 963unsigned long X509_subject_name_hash(X509 *x);
1067 964
965#ifndef OPENSSL_NO_MD5
966unsigned long X509_issuer_name_hash_old(X509 *a);
967unsigned long X509_subject_name_hash_old(X509 *x);
968#endif
969
1068int X509_cmp(const X509 *a, const X509 *b); 970int X509_cmp(const X509 *a, const X509 *b);
1069int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b); 971int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
1070unsigned long X509_NAME_hash(X509_NAME *x); 972unsigned long X509_NAME_hash(X509_NAME *x);
973unsigned long X509_NAME_hash_old(X509_NAME *x);
1071 974
1072int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b); 975int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
976int X509_CRL_match(const X509_CRL *a, const X509_CRL *b);
1073#ifndef OPENSSL_NO_FP_API 977#ifndef OPENSSL_NO_FP_API
1074int X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag); 978int X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
1075int X509_print_fp(FILE *bp,X509 *x); 979int X509_print_fp(FILE *bp,X509 *x);
@@ -1245,9 +1149,16 @@ DECLARE_ASN1_FUNCTIONS(PBEPARAM)
1245DECLARE_ASN1_FUNCTIONS(PBE2PARAM) 1149DECLARE_ASN1_FUNCTIONS(PBE2PARAM)
1246DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM) 1150DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM)
1247 1151
1248X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt, int saltlen); 1152int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
1153 const unsigned char *salt, int saltlen);
1154
1155X509_ALGOR *PKCS5_pbe_set(int alg, int iter,
1156 const unsigned char *salt, int saltlen);
1249X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, 1157X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
1250 unsigned char *salt, int saltlen); 1158 unsigned char *salt, int saltlen);
1159X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
1160 unsigned char *salt, int saltlen,
1161 unsigned char *aiv, int prf_nid);
1251 1162
1252/* PKCS#8 utilities */ 1163/* PKCS#8 utilities */
1253 1164
@@ -1258,6 +1169,22 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
1258PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken); 1169PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
1259PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken); 1170PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
1260 1171
1172int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
1173 int version, int ptype, void *pval,
1174 unsigned char *penc, int penclen);
1175int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg,
1176 const unsigned char **pk, int *ppklen,
1177 X509_ALGOR **pa,
1178 PKCS8_PRIV_KEY_INFO *p8);
1179
1180int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
1181 int ptype, void *pval,
1182 unsigned char *penc, int penclen);
1183int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
1184 const unsigned char **pk, int *ppklen,
1185 X509_ALGOR **pa,
1186 X509_PUBKEY *pub);
1187
1261int X509_check_trust(X509 *x, int id, int flags); 1188int X509_check_trust(X509 *x, int id, int flags);
1262int X509_TRUST_get_count(void); 1189int X509_TRUST_get_count(void);
1263X509_TRUST * X509_TRUST_get0(int idx); 1190X509_TRUST * X509_TRUST_get0(int idx);
@@ -1337,7 +1264,10 @@ void ERR_load_X509_strings(void);
1337#define X509_R_KEY_VALUES_MISMATCH 116 1264#define X509_R_KEY_VALUES_MISMATCH 116
1338#define X509_R_LOADING_CERT_DIR 103 1265#define X509_R_LOADING_CERT_DIR 103
1339#define X509_R_LOADING_DEFAULTS 104 1266#define X509_R_LOADING_DEFAULTS 104
1267#define X509_R_METHOD_NOT_SUPPORTED 124
1340#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105 1268#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105
1269#define X509_R_PUBLIC_KEY_DECODE_ERROR 125
1270#define X509_R_PUBLIC_KEY_ENCODE_ERROR 126
1341#define X509_R_SHOULD_RETRY 106 1271#define X509_R_SHOULD_RETRY 106
1342#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN 107 1272#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN 107
1343#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY 108 1273#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY 108
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index 2faf92514a..4bc9da07e0 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -116,6 +116,13 @@ int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
116 return(X509_NAME_cmp(a->crl->issuer,b->crl->issuer)); 116 return(X509_NAME_cmp(a->crl->issuer,b->crl->issuer));
117 } 117 }
118 118
119#ifndef OPENSSL_NO_SHA
120int X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
121 {
122 return memcmp(a->sha1_hash, b->sha1_hash, 20);
123 }
124#endif
125
119X509_NAME *X509_get_issuer_name(X509 *a) 126X509_NAME *X509_get_issuer_name(X509 *a)
120 { 127 {
121 return(a->cert_info->issuer); 128 return(a->cert_info->issuer);
@@ -126,6 +133,13 @@ unsigned long X509_issuer_name_hash(X509 *x)
126 return(X509_NAME_hash(x->cert_info->issuer)); 133 return(X509_NAME_hash(x->cert_info->issuer));
127 } 134 }
128 135
136#ifndef OPENSSL_NO_MD5
137unsigned long X509_issuer_name_hash_old(X509 *x)
138 {
139 return(X509_NAME_hash_old(x->cert_info->issuer));
140 }
141#endif
142
129X509_NAME *X509_get_subject_name(X509 *a) 143X509_NAME *X509_get_subject_name(X509 *a)
130 { 144 {
131 return(a->cert_info->subject); 145 return(a->cert_info->subject);
@@ -141,6 +155,13 @@ unsigned long X509_subject_name_hash(X509 *x)
141 return(X509_NAME_hash(x->cert_info->subject)); 155 return(X509_NAME_hash(x->cert_info->subject));
142 } 156 }
143 157
158#ifndef OPENSSL_NO_MD5
159unsigned long X509_subject_name_hash_old(X509 *x)
160 {
161 return(X509_NAME_hash_old(x->cert_info->subject));
162 }
163#endif
164
144#ifndef OPENSSL_NO_SHA 165#ifndef OPENSSL_NO_SHA
145/* Compare two certificates: they must be identical for 166/* Compare two certificates: they must be identical for
146 * this to work. NB: Although "cmp" operations are generally 167 * this to work. NB: Although "cmp" operations are generally
@@ -162,177 +183,63 @@ int X509_cmp(const X509 *a, const X509 *b)
162#endif 183#endif
163 184
164 185
165/* Case insensitive string comparision */ 186int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
166static int nocase_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
167{
168 int i;
169
170 if (a->length != b->length)
171 return (a->length - b->length);
172
173 for (i=0; i<a->length; i++)
174 {
175 int ca, cb;
176
177 ca = tolower(a->data[i]);
178 cb = tolower(b->data[i]);
179
180 if (ca != cb)
181 return(ca-cb);
182 }
183 return 0;
184}
185
186/* Case insensitive string comparision with space normalization
187 * Space normalization - ignore leading, trailing spaces,
188 * multiple spaces between characters are replaced by single space
189 */
190static int nocase_spacenorm_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
191{
192 unsigned char *pa = NULL, *pb = NULL;
193 int la, lb;
194
195 la = a->length;
196 lb = b->length;
197 pa = a->data;
198 pb = b->data;
199
200 /* skip leading spaces */
201 while (la > 0 && isspace(*pa))
202 {
203 la--;
204 pa++;
205 }
206 while (lb > 0 && isspace(*pb))
207 {
208 lb--;
209 pb++;
210 }
211
212 /* skip trailing spaces */
213 while (la > 0 && isspace(pa[la-1]))
214 la--;
215 while (lb > 0 && isspace(pb[lb-1]))
216 lb--;
217
218 /* compare strings with space normalization */
219 while (la > 0 && lb > 0)
220 { 187 {
221 int ca, cb; 188 int ret;
222
223 /* compare character */
224 ca = tolower(*pa);
225 cb = tolower(*pb);
226 if (ca != cb)
227 return (ca - cb);
228 189
229 pa++; pb++; 190 /* Ensure canonical encoding is present and up to date */
230 la--; lb--;
231 191
232 if (la <= 0 || lb <= 0) 192 if (!a->canon_enc || a->modified)
233 break; 193 {
194 ret = i2d_X509_NAME((X509_NAME *)a, NULL);
195 if (ret < 0)
196 return -2;
197 }
234 198
235 /* is white space next character ? */ 199 if (!b->canon_enc || b->modified)
236 if (isspace(*pa) && isspace(*pb))
237 { 200 {
238 /* skip remaining white spaces */ 201 ret = i2d_X509_NAME((X509_NAME *)b, NULL);
239 while (la > 0 && isspace(*pa)) 202 if (ret < 0)
240 { 203 return -2;
241 la--;
242 pa++;
243 }
244 while (lb > 0 && isspace(*pb))
245 {
246 lb--;
247 pb++;
248 }
249 } 204 }
250 }
251 if (la > 0 || lb > 0)
252 return la - lb;
253 205
254 return 0; 206 ret = a->canon_enclen - b->canon_enclen;
255}
256 207
257static int asn1_string_memcmp(ASN1_STRING *a, ASN1_STRING *b) 208 if (ret)
258 { 209 return ret;
259 int j;
260 j = a->length - b->length;
261 if (j)
262 return j;
263 return memcmp(a->data, b->data, a->length);
264 }
265 210
266#define STR_TYPE_CMP (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_UTF8STRING) 211 return memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);
267 212
268int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b) 213 }
269 {
270 int i,j;
271 X509_NAME_ENTRY *na,*nb;
272 214
273 unsigned long nabit, nbbit; 215unsigned long X509_NAME_hash(X509_NAME *x)
216 {
217 unsigned long ret=0;
218 unsigned char md[SHA_DIGEST_LENGTH];
274 219
275 j = sk_X509_NAME_ENTRY_num(a->entries) 220 /* Make sure X509_NAME structure contains valid cached encoding */
276 - sk_X509_NAME_ENTRY_num(b->entries); 221 i2d_X509_NAME(x,NULL);
277 if (j) 222 EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(), NULL);
278 return j;
279 for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--)
280 {
281 na=sk_X509_NAME_ENTRY_value(a->entries,i);
282 nb=sk_X509_NAME_ENTRY_value(b->entries,i);
283 j=na->value->type-nb->value->type;
284 if (j)
285 {
286 nabit = ASN1_tag2bit(na->value->type);
287 nbbit = ASN1_tag2bit(nb->value->type);
288 if (!(nabit & STR_TYPE_CMP) ||
289 !(nbbit & STR_TYPE_CMP))
290 return j;
291 if (!asn1_string_memcmp(na->value, nb->value))
292 j = 0;
293 }
294 else if (na->value->type == V_ASN1_PRINTABLESTRING)
295 j=nocase_spacenorm_cmp(na->value, nb->value);
296 else if (na->value->type == V_ASN1_IA5STRING
297 && OBJ_obj2nid(na->object) == NID_pkcs9_emailAddress)
298 j=nocase_cmp(na->value, nb->value);
299 else
300 j = asn1_string_memcmp(na->value, nb->value);
301 if (j) return(j);
302 j=na->set-nb->set;
303 if (j) return(j);
304 }
305 223
306 /* We will check the object types after checking the values 224 ret=( ((unsigned long)md[0] )|((unsigned long)md[1]<<8L)|
307 * since the values will more often be different than the object 225 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
308 * types. */ 226 )&0xffffffffL;
309 for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--) 227 return(ret);
310 {
311 na=sk_X509_NAME_ENTRY_value(a->entries,i);
312 nb=sk_X509_NAME_ENTRY_value(b->entries,i);
313 j=OBJ_cmp(na->object,nb->object);
314 if (j) return(j);
315 }
316 return(0);
317 } 228 }
318 229
230
319#ifndef OPENSSL_NO_MD5 231#ifndef OPENSSL_NO_MD5
320/* I now DER encode the name and hash it. Since I cache the DER encoding, 232/* I now DER encode the name and hash it. Since I cache the DER encoding,
321 * this is reasonably efficient. */ 233 * this is reasonably efficient. */
322unsigned long X509_NAME_hash(X509_NAME *x) 234
235unsigned long X509_NAME_hash_old(X509_NAME *x)
323 { 236 {
324 unsigned long ret=0; 237 unsigned long ret=0;
325 unsigned char md[16]; 238 unsigned char md[16];
326 EVP_MD_CTX md_ctx;
327 239
328 /* Make sure X509_NAME structure contains valid cached encoding */ 240 /* Make sure X509_NAME structure contains valid cached encoding */
329 i2d_X509_NAME(x,NULL); 241 i2d_X509_NAME(x,NULL);
330 EVP_MD_CTX_init(&md_ctx); 242 EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
331 EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
332 EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL);
333 EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length);
334 EVP_DigestFinal_ex(&md_ctx,md,NULL);
335 EVP_MD_CTX_cleanup(&md_ctx);
336 243
337 ret=( ((unsigned long)md[0] )|((unsigned long)md[1]<<8L)| 244 ret=( ((unsigned long)md[0] )|((unsigned long)md[1]<<8L)|
338 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L) 245 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -393,14 +300,19 @@ ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
393 300
394int X509_check_private_key(X509 *x, EVP_PKEY *k) 301int X509_check_private_key(X509 *x, EVP_PKEY *k)
395 { 302 {
396 EVP_PKEY *xk=NULL; 303 EVP_PKEY *xk;
397 int ok=0; 304 int ret;
398 305
399 xk=X509_get_pubkey(x); 306 xk=X509_get_pubkey(x);
400 switch (EVP_PKEY_cmp(xk, k)) 307
308 if (xk)
309 ret = EVP_PKEY_cmp(xk, k);
310 else
311 ret = -2;
312
313 switch (ret)
401 { 314 {
402 case 1: 315 case 1:
403 ok=1;
404 break; 316 break;
405 case 0: 317 case 0:
406 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH); 318 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
@@ -409,24 +321,11 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
409 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH); 321 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
410 break; 322 break;
411 case -2: 323 case -2:
412#ifndef OPENSSL_NO_EC
413 if (k->type == EVP_PKEY_EC)
414 {
415 X509err(X509_F_X509_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
416 break;
417 }
418#endif
419#ifndef OPENSSL_NO_DH
420 if (k->type == EVP_PKEY_DH)
421 {
422 /* No idea */
423 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
424 break;
425 }
426#endif
427 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE); 324 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
428 } 325 }
429 326 if (xk)
430 EVP_PKEY_free(xk); 327 EVP_PKEY_free(xk);
431 return(ok); 328 if (ret > 0)
329 return 1;
330 return 0;
432 } 331 }
diff --git a/src/lib/libcrypto/x509/x509_err.c b/src/lib/libcrypto/x509/x509_err.c
index fb377292da..a01402f416 100644
--- a/src/lib/libcrypto/x509/x509_err.c
+++ b/src/lib/libcrypto/x509/x509_err.c
@@ -1,6 +1,6 @@
1/* crypto/x509/x509_err.c */ 1/* crypto/x509/x509_err.c */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. 3 * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions 6 * modification, are permitted provided that the following conditions
@@ -132,7 +132,10 @@ static ERR_STRING_DATA X509_str_reasons[]=
132{ERR_REASON(X509_R_KEY_VALUES_MISMATCH) ,"key values mismatch"}, 132{ERR_REASON(X509_R_KEY_VALUES_MISMATCH) ,"key values mismatch"},
133{ERR_REASON(X509_R_LOADING_CERT_DIR) ,"loading cert dir"}, 133{ERR_REASON(X509_R_LOADING_CERT_DIR) ,"loading cert dir"},
134{ERR_REASON(X509_R_LOADING_DEFAULTS) ,"loading defaults"}, 134{ERR_REASON(X509_R_LOADING_DEFAULTS) ,"loading defaults"},
135{ERR_REASON(X509_R_METHOD_NOT_SUPPORTED) ,"method not supported"},
135{ERR_REASON(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY),"no cert set for us to verify"}, 136{ERR_REASON(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY),"no cert set for us to verify"},
137{ERR_REASON(X509_R_PUBLIC_KEY_DECODE_ERROR),"public key decode error"},
138{ERR_REASON(X509_R_PUBLIC_KEY_ENCODE_ERROR),"public key encode error"},
136{ERR_REASON(X509_R_SHOULD_RETRY) ,"should retry"}, 139{ERR_REASON(X509_R_SHOULD_RETRY) ,"should retry"},
137{ERR_REASON(X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN),"unable to find parameters in chain"}, 140{ERR_REASON(X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN),"unable to find parameters in chain"},
138{ERR_REASON(X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY),"unable to get certs public key"}, 141{ERR_REASON(X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY),"unable to get certs public key"},
diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
index cd2cfb6d85..3a6e04a1de 100644
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ b/src/lib/libcrypto/x509/x509_lu.c
@@ -196,9 +196,17 @@ X509_STORE *X509_STORE_new(void)
196 ret->get_crl = 0; 196 ret->get_crl = 0;
197 ret->check_crl = 0; 197 ret->check_crl = 0;
198 ret->cert_crl = 0; 198 ret->cert_crl = 0;
199 ret->lookup_certs = 0;
200 ret->lookup_crls = 0;
199 ret->cleanup = 0; 201 ret->cleanup = 0;
200 202
201 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data); 203 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
204 {
205 sk_X509_OBJECT_free(ret->objs);
206 OPENSSL_free(ret);
207 return NULL;
208 }
209
202 ret->references=1; 210 ret->references=1;
203 return ret; 211 return ret;
204 } 212 }
@@ -286,9 +294,11 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
286 X509_OBJECT stmp,*tmp; 294 X509_OBJECT stmp,*tmp;
287 int i,j; 295 int i,j;
288 296
297 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
289 tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name); 298 tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name);
299 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
290 300
291 if (tmp == NULL) 301 if (tmp == NULL || type == X509_LU_CRL)
292 { 302 {
293 for (i=vs->current_method; i<sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) 303 for (i=vs->current_method; i<sk_X509_LOOKUP_num(ctx->get_cert_methods); i++)
294 { 304 {
@@ -340,7 +350,6 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
340 350
341 X509_OBJECT_up_ref_count(obj); 351 X509_OBJECT_up_ref_count(obj);
342 352
343
344 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) 353 if (X509_OBJECT_retrieve_match(ctx->objs, obj))
345 { 354 {
346 X509_OBJECT_free_contents(obj); 355 X509_OBJECT_free_contents(obj);
@@ -414,14 +423,15 @@ void X509_OBJECT_free_contents(X509_OBJECT *a)
414 } 423 }
415 } 424 }
416 425
417int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type, 426static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
418 X509_NAME *name) 427 X509_NAME *name, int *pnmatch)
419 { 428 {
420 X509_OBJECT stmp; 429 X509_OBJECT stmp;
421 X509 x509_s; 430 X509 x509_s;
422 X509_CINF cinf_s; 431 X509_CINF cinf_s;
423 X509_CRL crl_s; 432 X509_CRL crl_s;
424 X509_CRL_INFO crl_info_s; 433 X509_CRL_INFO crl_info_s;
434 int idx;
425 435
426 stmp.type=type; 436 stmp.type=type;
427 switch (type) 437 switch (type)
@@ -441,41 +451,169 @@ int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
441 return -1; 451 return -1;
442 } 452 }
443 453
444 return sk_X509_OBJECT_find(h,&stmp); 454 idx = sk_X509_OBJECT_find(h,&stmp);
455 if (idx >= 0 && pnmatch)
456 {
457 int tidx;
458 const X509_OBJECT *tobj, *pstmp;
459 *pnmatch = 1;
460 pstmp = &stmp;
461 for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++)
462 {
463 tobj = sk_X509_OBJECT_value(h, tidx);
464 if (x509_object_cmp(&tobj, &pstmp))
465 break;
466 (*pnmatch)++;
467 }
468 }
469 return idx;
470 }
471
472
473int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
474 X509_NAME *name)
475 {
476 return x509_object_idx_cnt(h, type, name, NULL);
445 } 477 }
446 478
447X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type, 479X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
448 X509_NAME *name) 480 X509_NAME *name)
449{ 481 {
450 int idx; 482 int idx;
451 idx = X509_OBJECT_idx_by_subject(h, type, name); 483 idx = X509_OBJECT_idx_by_subject(h, type, name);
452 if (idx==-1) return NULL; 484 if (idx==-1) return NULL;
453 return sk_X509_OBJECT_value(h, idx); 485 return sk_X509_OBJECT_value(h, idx);
454} 486 }
487
488STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
489 {
490 int i, idx, cnt;
491 STACK_OF(X509) *sk;
492 X509 *x;
493 X509_OBJECT *obj;
494 sk = sk_X509_new_null();
495 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
496 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
497 if (idx < 0)
498 {
499 /* Nothing found in cache: do lookup to possibly add new
500 * objects to cache
501 */
502 X509_OBJECT xobj;
503 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
504 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj))
505 {
506 sk_X509_free(sk);
507 return NULL;
508 }
509 X509_OBJECT_free_contents(&xobj);
510 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
511 idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_X509,nm, &cnt);
512 if (idx < 0)
513 {
514 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
515 sk_X509_free(sk);
516 return NULL;
517 }
518 }
519 for (i = 0; i < cnt; i++, idx++)
520 {
521 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
522 x = obj->data.x509;
523 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
524 if (!sk_X509_push(sk, x))
525 {
526 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
527 X509_free(x);
528 sk_X509_pop_free(sk, X509_free);
529 return NULL;
530 }
531 }
532 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
533 return sk;
534
535 }
536
537STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
538 {
539 int i, idx, cnt;
540 STACK_OF(X509_CRL) *sk;
541 X509_CRL *x;
542 X509_OBJECT *obj, xobj;
543 sk = sk_X509_CRL_new_null();
544 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
545 /* Check cache first */
546 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
547
548 /* Always do lookup to possibly add new CRLs to cache
549 */
550 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
551 if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj))
552 {
553 sk_X509_CRL_free(sk);
554 return NULL;
555 }
556 X509_OBJECT_free_contents(&xobj);
557 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
558 idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt);
559 if (idx < 0)
560 {
561 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
562 sk_X509_CRL_free(sk);
563 return NULL;
564 }
565
566 for (i = 0; i < cnt; i++, idx++)
567 {
568 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
569 x = obj->data.crl;
570 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
571 if (!sk_X509_CRL_push(sk, x))
572 {
573 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
574 X509_CRL_free(x);
575 sk_X509_CRL_pop_free(sk, X509_CRL_free);
576 return NULL;
577 }
578 }
579 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
580 return sk;
581 }
455 582
456X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x) 583X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
457{ 584 {
458 int idx, i; 585 int idx, i;
459 X509_OBJECT *obj; 586 X509_OBJECT *obj;
460 idx = sk_X509_OBJECT_find(h, x); 587 idx = sk_X509_OBJECT_find(h, x);
461 if (idx == -1) return NULL; 588 if (idx == -1) return NULL;
462 if (x->type != X509_LU_X509) return sk_X509_OBJECT_value(h, idx); 589 if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
590 return sk_X509_OBJECT_value(h, idx);
463 for (i = idx; i < sk_X509_OBJECT_num(h); i++) 591 for (i = idx; i < sk_X509_OBJECT_num(h); i++)
464 { 592 {
465 obj = sk_X509_OBJECT_value(h, i); 593 obj = sk_X509_OBJECT_value(h, i);
466 if (x509_object_cmp((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x)) 594 if (x509_object_cmp((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x))
467 return NULL; 595 return NULL;
468 if ((x->type != X509_LU_X509) || !X509_cmp(obj->data.x509, x->data.x509)) 596 if (x->type == X509_LU_X509)
597 {
598 if (!X509_cmp(obj->data.x509, x->data.x509))
599 return obj;
600 }
601 else if (x->type == X509_LU_CRL)
602 {
603 if (!X509_CRL_match(obj->data.crl, x->data.crl))
604 return obj;
605 }
606 else
469 return obj; 607 return obj;
470 } 608 }
471 return NULL; 609 return NULL;
472} 610 }
473 611
474 612
475/* Try to get issuer certificate from store. Due to limitations 613/* Try to get issuer certificate from store. Due to limitations
476 * of the API this can only retrieve a single certificate matching 614 * of the API this can only retrieve a single certificate matching
477 * a given subject name. However it will fill the cache with all 615 * a given subject name. However it will fill the cache with all
478 * matching certificates, so we can examine the cache for all 616 * matching certificates, so we can examine the cache for all
479 * matches. 617 * matches.
480 * 618 *
481 * Return values are: 619 * Return values are:
@@ -483,13 +621,11 @@ X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x
483 * 0 certificate not found. 621 * 0 certificate not found.
484 * -1 some other error. 622 * -1 some other error.
485 */ 623 */
486
487
488int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) 624int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
489{ 625 {
490 X509_NAME *xn; 626 X509_NAME *xn;
491 X509_OBJECT obj, *pobj; 627 X509_OBJECT obj, *pobj;
492 int i, ok, idx; 628 int i, ok, idx, ret;
493 xn=X509_get_issuer_name(x); 629 xn=X509_get_issuer_name(x);
494 ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj); 630 ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
495 if (ok != X509_LU_X509) 631 if (ok != X509_LU_X509)
@@ -515,27 +651,34 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
515 return 1; 651 return 1;
516 } 652 }
517 X509_OBJECT_free_contents(&obj); 653 X509_OBJECT_free_contents(&obj);
518 /* Else find index of first matching cert */
519 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
520 /* This shouldn't normally happen since we already have one match */
521 if (idx == -1) return 0;
522 654
523 /* Look through all matching certificates for a suitable issuer */ 655 /* Else find index of first cert accepted by 'check_issued' */
524 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) 656 ret = 0;
657 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
658 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
659 if (idx != -1) /* should be true as we've had at least one match */
525 { 660 {
526 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i); 661 /* Look through all matching certs for suitable issuer */
527 /* See if we've ran out of matches */ 662 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
528 if (pobj->type != X509_LU_X509) return 0;
529 if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
530 if (ctx->check_issued(ctx, x, pobj->data.x509))
531 { 663 {
532 *issuer = pobj->data.x509; 664 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
533 X509_OBJECT_up_ref_count(pobj); 665 /* See if we've run past the matches */
534 return 1; 666 if (pobj->type != X509_LU_X509)
667 break;
668 if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
669 break;
670 if (ctx->check_issued(ctx, x, pobj->data.x509))
671 {
672 *issuer = pobj->data.x509;
673 X509_OBJECT_up_ref_count(pobj);
674 ret = 1;
675 break;
676 }
535 } 677 }
536 } 678 }
537 return 0; 679 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
538} 680 return ret;
681 }
539 682
540int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags) 683int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
541 { 684 {
@@ -563,5 +706,11 @@ int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
563 return X509_VERIFY_PARAM_set1(ctx->param, param); 706 return X509_VERIFY_PARAM_set1(ctx->param, param);
564 } 707 }
565 708
709void X509_STORE_set_verify_cb(X509_STORE *ctx,
710 int (*verify_cb)(int, X509_STORE_CTX *))
711 {
712 ctx->verify_cb = verify_cb;
713 }
714
566IMPLEMENT_STACK_OF(X509_LOOKUP) 715IMPLEMENT_STACK_OF(X509_LOOKUP)
567IMPLEMENT_STACK_OF(X509_OBJECT) 716IMPLEMENT_STACK_OF(X509_OBJECT)
diff --git a/src/lib/libcrypto/x509/x509_obj.c b/src/lib/libcrypto/x509/x509_obj.c
index 1e718f76eb..21fed9f838 100644
--- a/src/lib/libcrypto/x509/x509_obj.c
+++ b/src/lib/libcrypto/x509/x509_obj.c
@@ -72,7 +72,7 @@ int i;
72 char *p; 72 char *p;
73 unsigned char *q; 73 unsigned char *q;
74 BUF_MEM *b=NULL; 74 BUF_MEM *b=NULL;
75 static char hex[17]="0123456789ABCDEF"; 75 static const char hex[17]="0123456789ABCDEF";
76 int gs_doit[4]; 76 int gs_doit[4];
77 char tmp_buf[80]; 77 char tmp_buf[80];
78#ifdef CHARSET_EBCDIC 78#ifdef CHARSET_EBCDIC
diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
index 3872e1fb64..48183dc00c 100644
--- a/src/lib/libcrypto/x509/x509_req.c
+++ b/src/lib/libcrypto/x509/x509_req.c
@@ -61,6 +61,7 @@
61#include <openssl/bn.h> 61#include <openssl/bn.h>
62#include <openssl/evp.h> 62#include <openssl/evp.h>
63#include <openssl/asn1.h> 63#include <openssl/asn1.h>
64#include <openssl/asn1t.h>
64#include <openssl/x509.h> 65#include <openssl/x509.h>
65#include <openssl/objects.h> 66#include <openssl/objects.h>
66#include <openssl/buffer.h> 67#include <openssl/buffer.h>
@@ -205,10 +206,9 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
205 if(!ext || (ext->type != V_ASN1_SEQUENCE)) 206 if(!ext || (ext->type != V_ASN1_SEQUENCE))
206 return NULL; 207 return NULL;
207 p = ext->value.sequence->data; 208 p = ext->value.sequence->data;
208 return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p, 209 return (STACK_OF(X509_EXTENSION) *)
209 ext->value.sequence->length, 210 ASN1_item_d2i(NULL, &p, ext->value.sequence->length,
210 d2i_X509_EXTENSION, X509_EXTENSION_free, 211 ASN1_ITEM_rptr(X509_EXTENSIONS));
211 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
212} 212}
213 213
214/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs 214/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
@@ -218,8 +218,6 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
218int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts, 218int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
219 int nid) 219 int nid)
220{ 220{
221 unsigned char *p = NULL, *q;
222 long len;
223 ASN1_TYPE *at = NULL; 221 ASN1_TYPE *at = NULL;
224 X509_ATTRIBUTE *attr = NULL; 222 X509_ATTRIBUTE *attr = NULL;
225 if(!(at = ASN1_TYPE_new()) || 223 if(!(at = ASN1_TYPE_new()) ||
@@ -227,15 +225,10 @@ int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
227 225
228 at->type = V_ASN1_SEQUENCE; 226 at->type = V_ASN1_SEQUENCE;
229 /* Generate encoding of extensions */ 227 /* Generate encoding of extensions */
230 len = i2d_ASN1_SET_OF_X509_EXTENSION(exts, NULL, i2d_X509_EXTENSION, 228 at->value.sequence->length =
231 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE); 229 ASN1_item_i2d((ASN1_VALUE *)exts,
232 if(!(p = OPENSSL_malloc(len))) goto err; 230 &at->value.sequence->data,
233 q = p; 231 ASN1_ITEM_rptr(X509_EXTENSIONS));
234 i2d_ASN1_SET_OF_X509_EXTENSION(exts, &q, i2d_X509_EXTENSION,
235 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, IS_SEQUENCE);
236 at->value.sequence->data = p;
237 p = NULL;
238 at->value.sequence->length = len;
239 if(!(attr = X509_ATTRIBUTE_new())) goto err; 232 if(!(attr = X509_ATTRIBUTE_new())) goto err;
240 if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err; 233 if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
241 if(!sk_ASN1_TYPE_push(attr->value.set, at)) goto err; 234 if(!sk_ASN1_TYPE_push(attr->value.set, at)) goto err;
@@ -250,7 +243,6 @@ int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
250 if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err; 243 if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err;
251 return 1; 244 return 1;
252 err: 245 err:
253 if(p) OPENSSL_free(p);
254 X509_ATTRIBUTE_free(attr); 246 X509_ATTRIBUTE_free(attr);
255 ASN1_TYPE_free(at); 247 ASN1_TYPE_free(at);
256 return 0; 248 return 0;
diff --git a/src/lib/libcrypto/x509/x509_set.c b/src/lib/libcrypto/x509/x509_set.c
index aaf61ca062..4b94fc5847 100644
--- a/src/lib/libcrypto/x509/x509_set.c
+++ b/src/lib/libcrypto/x509/x509_set.c
@@ -104,7 +104,7 @@ int X509_set_subject_name(X509 *x, X509_NAME *name)
104 return(X509_NAME_set(&x->cert_info->subject,name)); 104 return(X509_NAME_set(&x->cert_info->subject,name));
105 } 105 }
106 106
107int X509_set_notBefore(X509 *x, ASN1_TIME *tm) 107int X509_set_notBefore(X509 *x, const ASN1_TIME *tm)
108 { 108 {
109 ASN1_TIME *in; 109 ASN1_TIME *in;
110 110
@@ -122,7 +122,7 @@ int X509_set_notBefore(X509 *x, ASN1_TIME *tm)
122 return(in != NULL); 122 return(in != NULL);
123 } 123 }
124 124
125int X509_set_notAfter(X509 *x, ASN1_TIME *tm) 125int X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
126 { 126 {
127 ASN1_TIME *in; 127 ASN1_TIME *in;
128 128
diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
index ed18700585..a6cb9c8b1b 100644
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ b/src/lib/libcrypto/x509/x509_trs.c
@@ -84,7 +84,8 @@ static X509_TRUST trstandard[] = {
84{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL}, 84{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
85{X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL}, 85{X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
86{X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL}, 86{X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
87{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL} 87{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
88{X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
88}; 89};
89 90
90#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST)) 91#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index 73a8ec726f..c44f753c46 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -162,8 +162,28 @@ const char *X509_verify_cert_error_string(long n)
162 return("invalid or inconsistent certificate policy extension"); 162 return("invalid or inconsistent certificate policy extension");
163 case X509_V_ERR_NO_EXPLICIT_POLICY: 163 case X509_V_ERR_NO_EXPLICIT_POLICY:
164 return("no explicit policy"); 164 return("no explicit policy");
165 case X509_V_ERR_UNNESTED_RESOURCE: 165 case X509_V_ERR_DIFFERENT_CRL_SCOPE:
166 return("RFC 3779 resource not subset of parent's resources"); 166 return("Different CRL scope");
167 case X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE:
168 return("Unsupported extension feature");
169 case X509_V_ERR_UNNESTED_RESOURCE:
170 return("RFC 3779 resource not subset of parent's resources");
171
172 case X509_V_ERR_PERMITTED_VIOLATION:
173 return("permitted subtree violation");
174 case X509_V_ERR_EXCLUDED_VIOLATION:
175 return("excluded subtree violation");
176 case X509_V_ERR_SUBTREE_MINMAX:
177 return("name constraints minimum and maximum not supported");
178 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:
179 return("unsupported name constraint type");
180 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX:
181 return("unsupported or invalid name constraint syntax");
182 case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX:
183 return("unsupported or invalid name syntax");
184 case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
185 return("CRL path validation error");
186
167 default: 187 default:
168 BIO_snprintf(buf,sizeof buf,"error number %ld",n); 188 BIO_snprintf(buf,sizeof buf,"error number %ld",n);
169 return(buf); 189 return(buf);
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 336c40ddd7..87ebf62525 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -70,14 +70,70 @@
70#include <openssl/x509v3.h> 70#include <openssl/x509v3.h>
71#include <openssl/objects.h> 71#include <openssl/objects.h>
72 72
73/* CRL score values */
74
75/* No unhandled critical extensions */
76
77#define CRL_SCORE_NOCRITICAL 0x100
78
79/* certificate is within CRL scope */
80
81#define CRL_SCORE_SCOPE 0x080
82
83/* CRL times valid */
84
85#define CRL_SCORE_TIME 0x040
86
87/* Issuer name matches certificate */
88
89#define CRL_SCORE_ISSUER_NAME 0x020
90
91/* If this score or above CRL is probably valid */
92
93#define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE)
94
95/* CRL issuer is certificate issuer */
96
97#define CRL_SCORE_ISSUER_CERT 0x018
98
99/* CRL issuer is on certificate path */
100
101#define CRL_SCORE_SAME_PATH 0x008
102
103/* CRL issuer matches CRL AKID */
104
105#define CRL_SCORE_AKID 0x004
106
107/* Have a delta CRL with valid times */
108
109#define CRL_SCORE_TIME_DELTA 0x002
110
73static int null_callback(int ok,X509_STORE_CTX *e); 111static int null_callback(int ok,X509_STORE_CTX *e);
74static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); 112static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
75static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); 113static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);
76static int check_chain_extensions(X509_STORE_CTX *ctx); 114static int check_chain_extensions(X509_STORE_CTX *ctx);
115static int check_name_constraints(X509_STORE_CTX *ctx);
77static int check_trust(X509_STORE_CTX *ctx); 116static int check_trust(X509_STORE_CTX *ctx);
78static int check_revocation(X509_STORE_CTX *ctx); 117static int check_revocation(X509_STORE_CTX *ctx);
79static int check_cert(X509_STORE_CTX *ctx); 118static int check_cert(X509_STORE_CTX *ctx);
80static int check_policy(X509_STORE_CTX *ctx); 119static int check_policy(X509_STORE_CTX *ctx);
120
121static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
122 unsigned int *preasons,
123 X509_CRL *crl, X509 *x);
124static int get_crl_delta(X509_STORE_CTX *ctx,
125 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x);
126static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pcrl_score,
127 X509_CRL *base, STACK_OF(X509_CRL) *crls);
128static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl,
129 X509 **pissuer, int *pcrl_score);
130static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
131 unsigned int *preasons);
132static int check_crl_path(X509_STORE_CTX *ctx, X509 *x);
133static int check_crl_chain(X509_STORE_CTX *ctx,
134 STACK_OF(X509) *cert_path,
135 STACK_OF(X509) *crl_path);
136
81static int internal_verify(X509_STORE_CTX *ctx); 137static int internal_verify(X509_STORE_CTX *ctx);
82const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT; 138const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
83 139
@@ -289,6 +345,12 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
289 345
290 if (!ok) goto end; 346 if (!ok) goto end;
291 347
348 /* Check name constraints */
349
350 ok = check_name_constraints(ctx);
351
352 if (!ok) goto end;
353
292 /* The chain extensions are OK: check trust */ 354 /* The chain extensions are OK: check trust */
293 355
294 if (param->trust > 0) ok = check_trust(ctx); 356 if (param->trust > 0) ok = check_trust(ctx);
@@ -398,8 +460,8 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
398 X509 *x; 460 X509 *x;
399 int (*cb)(int xok,X509_STORE_CTX *xctx); 461 int (*cb)(int xok,X509_STORE_CTX *xctx);
400 int proxy_path_length = 0; 462 int proxy_path_length = 0;
401 int allow_proxy_certs = 463 int purpose;
402 !!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS); 464 int allow_proxy_certs;
403 cb=ctx->verify_cb; 465 cb=ctx->verify_cb;
404 466
405 /* must_be_ca can have 1 of 3 values: 467 /* must_be_ca can have 1 of 3 values:
@@ -412,10 +474,22 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
412 */ 474 */
413 must_be_ca = -1; 475 must_be_ca = -1;
414 476
415 /* A hack to keep people who don't want to modify their software 477 /* CRL path validation */
416 happy */ 478 if (ctx->parent)
417 if (getenv("OPENSSL_ALLOW_PROXY_CERTS")) 479 {
418 allow_proxy_certs = 1; 480 allow_proxy_certs = 0;
481 purpose = X509_PURPOSE_CRL_SIGN;
482 }
483 else
484 {
485 allow_proxy_certs =
486 !!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
487 /* A hack to keep people who don't want to modify their
488 software happy */
489 if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
490 allow_proxy_certs = 1;
491 purpose = ctx->param->purpose;
492 }
419 493
420 /* Check all untrusted certificates */ 494 /* Check all untrusted certificates */
421 for (i = 0; i < ctx->last_untrusted; i++) 495 for (i = 0; i < ctx->last_untrusted; i++)
@@ -482,8 +556,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
482 } 556 }
483 if (ctx->param->purpose > 0) 557 if (ctx->param->purpose > 0)
484 { 558 {
485 ret = X509_check_purpose(x, ctx->param->purpose, 559 ret = X509_check_purpose(x, purpose, must_be_ca > 0);
486 must_be_ca > 0);
487 if ((ret == 0) 560 if ((ret == 0)
488 || ((ctx->param->flags & X509_V_FLAG_X509_STRICT) 561 || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
489 && (ret != 1))) 562 && (ret != 1)))
@@ -536,6 +609,42 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
536#endif 609#endif
537} 610}
538 611
612static int check_name_constraints(X509_STORE_CTX *ctx)
613 {
614 X509 *x;
615 int i, j, rv;
616 /* Check name constraints for all certificates */
617 for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--)
618 {
619 x = sk_X509_value(ctx->chain, i);
620 /* Ignore self issued certs unless last in chain */
621 if (i && (x->ex_flags & EXFLAG_SI))
622 continue;
623 /* Check against constraints for all certificates higher in
624 * chain including trust anchor. Trust anchor not strictly
625 * speaking needed but if it includes constraints it is to be
626 * assumed it expects them to be obeyed.
627 */
628 for (j = sk_X509_num(ctx->chain) - 1; j > i; j--)
629 {
630 NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc;
631 if (nc)
632 {
633 rv = NAME_CONSTRAINTS_check(x, nc);
634 if (rv != X509_V_OK)
635 {
636 ctx->error = rv;
637 ctx->error_depth = i;
638 ctx->current_cert = x;
639 if (!ctx->verify_cb(0,ctx))
640 return 0;
641 }
642 }
643 }
644 }
645 return 1;
646 }
647
539static int check_trust(X509_STORE_CTX *ctx) 648static int check_trust(X509_STORE_CTX *ctx)
540{ 649{
541#ifdef OPENSSL_NO_CHAIN_VERIFY 650#ifdef OPENSSL_NO_CHAIN_VERIFY
@@ -570,7 +679,12 @@ static int check_revocation(X509_STORE_CTX *ctx)
570 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) 679 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
571 last = sk_X509_num(ctx->chain) - 1; 680 last = sk_X509_num(ctx->chain) - 1;
572 else 681 else
682 {
683 /* If checking CRL paths this isn't the EE certificate */
684 if (ctx->parent)
685 return 1;
573 last = 0; 686 last = 0;
687 }
574 for(i = 0; i <= last; i++) 688 for(i = 0; i <= last; i++)
575 { 689 {
576 ctx->error_depth = i; 690 ctx->error_depth = i;
@@ -582,30 +696,65 @@ static int check_revocation(X509_STORE_CTX *ctx)
582 696
583static int check_cert(X509_STORE_CTX *ctx) 697static int check_cert(X509_STORE_CTX *ctx)
584 { 698 {
585 X509_CRL *crl = NULL; 699 X509_CRL *crl = NULL, *dcrl = NULL;
586 X509 *x; 700 X509 *x;
587 int ok, cnum; 701 int ok, cnum;
588 cnum = ctx->error_depth; 702 cnum = ctx->error_depth;
589 x = sk_X509_value(ctx->chain, cnum); 703 x = sk_X509_value(ctx->chain, cnum);
590 ctx->current_cert = x; 704 ctx->current_cert = x;
591 /* Try to retrieve relevant CRL */ 705 ctx->current_issuer = NULL;
592 ok = ctx->get_crl(ctx, &crl, x); 706 ctx->current_reasons = 0;
593 /* If error looking up CRL, nothing we can do except 707 while (ctx->current_reasons != CRLDP_ALL_REASONS)
594 * notify callback
595 */
596 if(!ok)
597 { 708 {
598 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; 709 /* Try to retrieve relevant CRL */
599 ok = ctx->verify_cb(0, ctx); 710 if (ctx->get_crl)
600 goto err; 711 ok = ctx->get_crl(ctx, &crl, x);
712 else
713 ok = get_crl_delta(ctx, &crl, &dcrl, x);
714 /* If error looking up CRL, nothing we can do except
715 * notify callback
716 */
717 if(!ok)
718 {
719 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
720 ok = ctx->verify_cb(0, ctx);
721 goto err;
722 }
723 ctx->current_crl = crl;
724 ok = ctx->check_crl(ctx, crl);
725 if (!ok)
726 goto err;
727
728 if (dcrl)
729 {
730 ok = ctx->check_crl(ctx, dcrl);
731 if (!ok)
732 goto err;
733 ok = ctx->cert_crl(ctx, dcrl, x);
734 if (!ok)
735 goto err;
736 }
737 else
738 ok = 1;
739
740 /* Don't look in full CRL if delta reason is removefromCRL */
741 if (ok != 2)
742 {
743 ok = ctx->cert_crl(ctx, crl, x);
744 if (!ok)
745 goto err;
746 }
747
748 X509_CRL_free(crl);
749 X509_CRL_free(dcrl);
750 crl = NULL;
751 dcrl = NULL;
601 } 752 }
602 ctx->current_crl = crl;
603 ok = ctx->check_crl(ctx, crl);
604 if (!ok) goto err;
605 ok = ctx->cert_crl(ctx, crl, x);
606 err: 753 err:
607 ctx->current_crl = NULL;
608 X509_CRL_free(crl); 754 X509_CRL_free(crl);
755 X509_CRL_free(dcrl);
756
757 ctx->current_crl = NULL;
609 return ok; 758 return ok;
610 759
611 } 760 }
@@ -616,7 +765,8 @@ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
616 { 765 {
617 time_t *ptime; 766 time_t *ptime;
618 int i; 767 int i;
619 ctx->current_crl = crl; 768 if (notify)
769 ctx->current_crl = crl;
620 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) 770 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
621 ptime = &ctx->param->check_time; 771 ptime = &ctx->param->check_time;
622 else 772 else
@@ -625,15 +775,19 @@ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
625 i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime); 775 i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
626 if (i == 0) 776 if (i == 0)
627 { 777 {
778 if (!notify)
779 return 0;
628 ctx->error=X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD; 780 ctx->error=X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;
629 if (!notify || !ctx->verify_cb(0, ctx)) 781 if (!ctx->verify_cb(0, ctx))
630 return 0; 782 return 0;
631 } 783 }
632 784
633 if (i > 0) 785 if (i > 0)
634 { 786 {
787 if (!notify)
788 return 0;
635 ctx->error=X509_V_ERR_CRL_NOT_YET_VALID; 789 ctx->error=X509_V_ERR_CRL_NOT_YET_VALID;
636 if (!notify || !ctx->verify_cb(0, ctx)) 790 if (!ctx->verify_cb(0, ctx))
637 return 0; 791 return 0;
638 } 792 }
639 793
@@ -643,92 +797,545 @@ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
643 797
644 if (i == 0) 798 if (i == 0)
645 { 799 {
800 if (!notify)
801 return 0;
646 ctx->error=X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD; 802 ctx->error=X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;
647 if (!notify || !ctx->verify_cb(0, ctx)) 803 if (!ctx->verify_cb(0, ctx))
648 return 0; 804 return 0;
649 } 805 }
650 806 /* Ignore expiry of base CRL is delta is valid */
651 if (i < 0) 807 if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA))
652 { 808 {
809 if (!notify)
810 return 0;
653 ctx->error=X509_V_ERR_CRL_HAS_EXPIRED; 811 ctx->error=X509_V_ERR_CRL_HAS_EXPIRED;
654 if (!notify || !ctx->verify_cb(0, ctx)) 812 if (!ctx->verify_cb(0, ctx))
655 return 0; 813 return 0;
656 } 814 }
657 } 815 }
658 816
659 ctx->current_crl = NULL; 817 if (notify)
818 ctx->current_crl = NULL;
660 819
661 return 1; 820 return 1;
662 } 821 }
663 822
664/* Lookup CRLs from the supplied list. Look for matching isser name 823static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
665 * and validity. If we can't find a valid CRL return the last one 824 X509 **pissuer, int *pscore, unsigned int *preasons,
666 * with matching name. This gives more meaningful error codes. Otherwise 825 STACK_OF(X509_CRL) *crls)
667 * we'd get a CRL not found error if a CRL existed with matching name but
668 * was invalid.
669 */
670
671static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl,
672 X509_NAME *nm, STACK_OF(X509_CRL) *crls)
673 { 826 {
674 int i; 827 int i, crl_score, best_score = *pscore;
828 unsigned int reasons, best_reasons = 0;
829 X509 *x = ctx->current_cert;
675 X509_CRL *crl, *best_crl = NULL; 830 X509_CRL *crl, *best_crl = NULL;
831 X509 *crl_issuer = NULL, *best_crl_issuer = NULL;
832
676 for (i = 0; i < sk_X509_CRL_num(crls); i++) 833 for (i = 0; i < sk_X509_CRL_num(crls); i++)
677 { 834 {
678 crl = sk_X509_CRL_value(crls, i); 835 crl = sk_X509_CRL_value(crls, i);
679 if (X509_NAME_cmp(nm, X509_CRL_get_issuer(crl))) 836 reasons = *preasons;
680 continue; 837 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
681 if (check_crl_time(ctx, crl, 0)) 838
839 if (crl_score > best_score)
682 { 840 {
683 *pcrl = crl; 841 best_crl = crl;
684 CRYPTO_add(&crl->references, 1, CRYPTO_LOCK_X509); 842 best_crl_issuer = crl_issuer;
685 return 1; 843 best_score = crl_score;
844 best_reasons = reasons;
686 } 845 }
687 best_crl = crl;
688 } 846 }
847
689 if (best_crl) 848 if (best_crl)
690 { 849 {
850 if (*pcrl)
851 X509_CRL_free(*pcrl);
691 *pcrl = best_crl; 852 *pcrl = best_crl;
692 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509); 853 *pissuer = best_crl_issuer;
854 *pscore = best_score;
855 *preasons = best_reasons;
856 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509_CRL);
857 if (*pdcrl)
858 {
859 X509_CRL_free(*pdcrl);
860 *pdcrl = NULL;
861 }
862 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls);
693 } 863 }
694 864
865 if (best_score >= CRL_SCORE_VALID)
866 return 1;
867
695 return 0; 868 return 0;
696 } 869 }
697 870
698/* Retrieve CRL corresponding to certificate: currently just a 871/* Compare two CRL extensions for delta checking purposes. They should be
699 * subject lookup: maybe use AKID later... 872 * both present or both absent. If both present all fields must be identical.
700 */ 873 */
701static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x) 874
875static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid)
702 { 876 {
703 int ok; 877 ASN1_OCTET_STRING *exta, *extb;
704 X509_CRL *crl = NULL; 878 int i;
705 X509_OBJECT xobj; 879 i = X509_CRL_get_ext_by_NID(a, nid, 0);
706 X509_NAME *nm; 880 if (i >= 0)
707 nm = X509_get_issuer_name(x);
708 ok = get_crl_sk(ctx, &crl, nm, ctx->crls);
709 if (ok)
710 { 881 {
711 *pcrl = crl; 882 /* Can't have multiple occurrences */
883 if (X509_CRL_get_ext_by_NID(a, nid, i) != -1)
884 return 0;
885 exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i));
886 }
887 else
888 exta = NULL;
889
890 i = X509_CRL_get_ext_by_NID(b, nid, 0);
891
892 if (i >= 0)
893 {
894
895 if (X509_CRL_get_ext_by_NID(b, nid, i) != -1)
896 return 0;
897 extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i));
898 }
899 else
900 extb = NULL;
901
902 if (!exta && !extb)
712 return 1; 903 return 1;
904
905 if (!exta || !extb)
906 return 0;
907
908
909 if (ASN1_OCTET_STRING_cmp(exta, extb))
910 return 0;
911
912 return 1;
913 }
914
915/* See if a base and delta are compatible */
916
917static int check_delta_base(X509_CRL *delta, X509_CRL *base)
918 {
919 /* Delta CRL must be a delta */
920 if (!delta->base_crl_number)
921 return 0;
922 /* Base must have a CRL number */
923 if (!base->crl_number)
924 return 0;
925 /* Issuer names must match */
926 if (X509_NAME_cmp(X509_CRL_get_issuer(base),
927 X509_CRL_get_issuer(delta)))
928 return 0;
929 /* AKID and IDP must match */
930 if (!crl_extension_match(delta, base, NID_authority_key_identifier))
931 return 0;
932 if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
933 return 0;
934 /* Delta CRL base number must not exceed Full CRL number. */
935 if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
936 return 0;
937 /* Delta CRL number must exceed full CRL number */
938 if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0)
939 return 1;
940 return 0;
941 }
942
943/* For a given base CRL find a delta... maybe extend to delta scoring
944 * or retrieve a chain of deltas...
945 */
946
947static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore,
948 X509_CRL *base, STACK_OF(X509_CRL) *crls)
949 {
950 X509_CRL *delta;
951 int i;
952 if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS))
953 return;
954 if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST))
955 return;
956 for (i = 0; i < sk_X509_CRL_num(crls); i++)
957 {
958 delta = sk_X509_CRL_value(crls, i);
959 if (check_delta_base(delta, base))
960 {
961 if (check_crl_time(ctx, delta, 0))
962 *pscore |= CRL_SCORE_TIME_DELTA;
963 CRYPTO_add(&delta->references, 1, CRYPTO_LOCK_X509_CRL);
964 *dcrl = delta;
965 return;
966 }
967 }
968 *dcrl = NULL;
969 }
970
971/* For a given CRL return how suitable it is for the supplied certificate 'x'.
972 * The return value is a mask of several criteria.
973 * If the issuer is not the certificate issuer this is returned in *pissuer.
974 * The reasons mask is also used to determine if the CRL is suitable: if
975 * no new reasons the CRL is rejected, otherwise reasons is updated.
976 */
977
978static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
979 unsigned int *preasons,
980 X509_CRL *crl, X509 *x)
981 {
982
983 int crl_score = 0;
984 unsigned int tmp_reasons = *preasons, crl_reasons;
985
986 /* First see if we can reject CRL straight away */
987
988 /* Invalid IDP cannot be processed */
989 if (crl->idp_flags & IDP_INVALID)
990 return 0;
991 /* Reason codes or indirect CRLs need extended CRL support */
992 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
993 {
994 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
995 return 0;
996 }
997 else if (crl->idp_flags & IDP_REASONS)
998 {
999 /* If no new reasons reject */
1000 if (!(crl->idp_reasons & ~tmp_reasons))
1001 return 0;
1002 }
1003 /* Don't process deltas at this stage */
1004 else if (crl->base_crl_number)
1005 return 0;
1006 /* If issuer name doesn't match certificate need indirect CRL */
1007 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl)))
1008 {
1009 if (!(crl->idp_flags & IDP_INDIRECT))
1010 return 0;
1011 }
1012 else
1013 crl_score |= CRL_SCORE_ISSUER_NAME;
1014
1015 if (!(crl->flags & EXFLAG_CRITICAL))
1016 crl_score |= CRL_SCORE_NOCRITICAL;
1017
1018 /* Check expiry */
1019 if (check_crl_time(ctx, crl, 0))
1020 crl_score |= CRL_SCORE_TIME;
1021
1022 /* Check authority key ID and locate certificate issuer */
1023 crl_akid_check(ctx, crl, pissuer, &crl_score);
1024
1025 /* If we can't locate certificate issuer at this point forget it */
1026
1027 if (!(crl_score & CRL_SCORE_AKID))
1028 return 0;
1029
1030 /* Check cert for matching CRL distribution points */
1031
1032 if (crl_crldp_check(x, crl, crl_score, &crl_reasons))
1033 {
1034 /* If no new reasons reject */
1035 if (!(crl_reasons & ~tmp_reasons))
1036 return 0;
1037 tmp_reasons |= crl_reasons;
1038 crl_score |= CRL_SCORE_SCOPE;
713 } 1039 }
714 1040
715 ok = X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj); 1041 *preasons = tmp_reasons;
1042
1043 return crl_score;
1044
1045 }
1046
1047static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl,
1048 X509 **pissuer, int *pcrl_score)
1049 {
1050 X509 *crl_issuer = NULL;
1051 X509_NAME *cnm = X509_CRL_get_issuer(crl);
1052 int cidx = ctx->error_depth;
1053 int i;
716 1054
717 if (!ok) 1055 if (cidx != sk_X509_num(ctx->chain) - 1)
1056 cidx++;
1057
1058 crl_issuer = sk_X509_value(ctx->chain, cidx);
1059
1060 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
718 { 1061 {
719 /* If we got a near match from get_crl_sk use that */ 1062 if (*pcrl_score & CRL_SCORE_ISSUER_NAME)
720 if (crl)
721 { 1063 {
722 *pcrl = crl; 1064 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_ISSUER_CERT;
723 return 1; 1065 *pissuer = crl_issuer;
1066 return;
1067 }
1068 }
1069
1070 for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++)
1071 {
1072 crl_issuer = sk_X509_value(ctx->chain, cidx);
1073 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1074 continue;
1075 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
1076 {
1077 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_SAME_PATH;
1078 *pissuer = crl_issuer;
1079 return;
1080 }
1081 }
1082
1083 /* Anything else needs extended CRL support */
1084
1085 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
1086 return;
1087
1088 /* Otherwise the CRL issuer is not on the path. Look for it in the
1089 * set of untrusted certificates.
1090 */
1091 for (i = 0; i < sk_X509_num(ctx->untrusted); i++)
1092 {
1093 crl_issuer = sk_X509_value(ctx->untrusted, i);
1094 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1095 continue;
1096 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
1097 {
1098 *pissuer = crl_issuer;
1099 *pcrl_score |= CRL_SCORE_AKID;
1100 return;
724 } 1101 }
1102 }
1103 }
1104
1105/* Check the path of a CRL issuer certificate. This creates a new
1106 * X509_STORE_CTX and populates it with most of the parameters from the
1107 * parent. This could be optimised somewhat since a lot of path checking
1108 * will be duplicated by the parent, but this will rarely be used in
1109 * practice.
1110 */
1111
1112static int check_crl_path(X509_STORE_CTX *ctx, X509 *x)
1113 {
1114 X509_STORE_CTX crl_ctx;
1115 int ret;
1116 /* Don't allow recursive CRL path validation */
1117 if (ctx->parent)
725 return 0; 1118 return 0;
1119 if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted))
1120 return -1;
1121
1122 crl_ctx.crls = ctx->crls;
1123 /* Copy verify params across */
1124 X509_STORE_CTX_set0_param(&crl_ctx, ctx->param);
1125
1126 crl_ctx.parent = ctx;
1127 crl_ctx.verify_cb = ctx->verify_cb;
1128
1129 /* Verify CRL issuer */
1130 ret = X509_verify_cert(&crl_ctx);
1131
1132 if (ret <= 0)
1133 goto err;
1134
1135 /* Check chain is acceptable */
1136
1137 ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain);
1138 err:
1139 X509_STORE_CTX_cleanup(&crl_ctx);
1140 return ret;
1141 }
1142
1143/* RFC3280 says nothing about the relationship between CRL path
1144 * and certificate path, which could lead to situations where a
1145 * certificate could be revoked or validated by a CA not authorised
1146 * to do so. RFC5280 is more strict and states that the two paths must
1147 * end in the same trust anchor, though some discussions remain...
1148 * until this is resolved we use the RFC5280 version
1149 */
1150
1151static int check_crl_chain(X509_STORE_CTX *ctx,
1152 STACK_OF(X509) *cert_path,
1153 STACK_OF(X509) *crl_path)
1154 {
1155 X509 *cert_ta, *crl_ta;
1156 cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1);
1157 crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1);
1158 if (!X509_cmp(cert_ta, crl_ta))
1159 return 1;
1160 return 0;
1161 }
1162
1163/* Check for match between two dist point names: three separate cases.
1164 * 1. Both are relative names and compare X509_NAME types.
1165 * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES.
1166 * 3. Both are full names and compare two GENERAL_NAMES.
1167 * 4. One is NULL: automatic match.
1168 */
1169
1170
1171static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b)
1172 {
1173 X509_NAME *nm = NULL;
1174 GENERAL_NAMES *gens = NULL;
1175 GENERAL_NAME *gena, *genb;
1176 int i, j;
1177 if (!a || !b)
1178 return 1;
1179 if (a->type == 1)
1180 {
1181 if (!a->dpname)
1182 return 0;
1183 /* Case 1: two X509_NAME */
1184 if (b->type == 1)
1185 {
1186 if (!b->dpname)
1187 return 0;
1188 if (!X509_NAME_cmp(a->dpname, b->dpname))
1189 return 1;
1190 else
1191 return 0;
1192 }
1193 /* Case 2: set name and GENERAL_NAMES appropriately */
1194 nm = a->dpname;
1195 gens = b->name.fullname;
1196 }
1197 else if (b->type == 1)
1198 {
1199 if (!b->dpname)
1200 return 0;
1201 /* Case 2: set name and GENERAL_NAMES appropriately */
1202 gens = a->name.fullname;
1203 nm = b->dpname;
726 } 1204 }
727 1205
728 *pcrl = xobj.data.crl; 1206 /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */
1207 if (nm)
1208 {
1209 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++)
1210 {
1211 gena = sk_GENERAL_NAME_value(gens, i);
1212 if (gena->type != GEN_DIRNAME)
1213 continue;
1214 if (!X509_NAME_cmp(nm, gena->d.directoryName))
1215 return 1;
1216 }
1217 return 0;
1218 }
1219
1220 /* Else case 3: two GENERAL_NAMES */
1221
1222 for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++)
1223 {
1224 gena = sk_GENERAL_NAME_value(a->name.fullname, i);
1225 for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++)
1226 {
1227 genb = sk_GENERAL_NAME_value(b->name.fullname, j);
1228 if (!GENERAL_NAME_cmp(gena, genb))
1229 return 1;
1230 }
1231 }
1232
1233 return 0;
1234
1235 }
1236
1237static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score)
1238 {
1239 int i;
1240 X509_NAME *nm = X509_CRL_get_issuer(crl);
1241 /* If no CRLissuer return is successful iff don't need a match */
1242 if (!dp->CRLissuer)
1243 return !!(crl_score & CRL_SCORE_ISSUER_NAME);
1244 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++)
1245 {
1246 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i);
1247 if (gen->type != GEN_DIRNAME)
1248 continue;
1249 if (!X509_NAME_cmp(gen->d.directoryName, nm))
1250 return 1;
1251 }
1252 return 0;
1253 }
1254
1255/* Check CRLDP and IDP */
1256
1257static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
1258 unsigned int *preasons)
1259 {
1260 int i;
1261 if (crl->idp_flags & IDP_ONLYATTR)
1262 return 0;
1263 if (x->ex_flags & EXFLAG_CA)
1264 {
1265 if (crl->idp_flags & IDP_ONLYUSER)
1266 return 0;
1267 }
1268 else
1269 {
1270 if (crl->idp_flags & IDP_ONLYCA)
1271 return 0;
1272 }
1273 *preasons = crl->idp_reasons;
1274 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++)
1275 {
1276 DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i);
1277 if (crldp_check_crlissuer(dp, crl, crl_score))
1278 {
1279 if (!crl->idp ||
1280 idp_check_dp(dp->distpoint, crl->idp->distpoint))
1281 {
1282 *preasons &= dp->dp_reasons;
1283 return 1;
1284 }
1285 }
1286 }
1287 if ((!crl->idp || !crl->idp->distpoint) && (crl_score & CRL_SCORE_ISSUER_NAME))
1288 return 1;
1289 return 0;
1290 }
1291
1292/* Retrieve CRL corresponding to current certificate.
1293 * If deltas enabled try to find a delta CRL too
1294 */
1295
1296static int get_crl_delta(X509_STORE_CTX *ctx,
1297 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
1298 {
1299 int ok;
1300 X509 *issuer = NULL;
1301 int crl_score = 0;
1302 unsigned int reasons;
1303 X509_CRL *crl = NULL, *dcrl = NULL;
1304 STACK_OF(X509_CRL) *skcrl;
1305 X509_NAME *nm = X509_get_issuer_name(x);
1306 reasons = ctx->current_reasons;
1307 ok = get_crl_sk(ctx, &crl, &dcrl,
1308 &issuer, &crl_score, &reasons, ctx->crls);
1309
1310 if (ok)
1311 goto done;
1312
1313 /* Lookup CRLs from store */
1314
1315 skcrl = ctx->lookup_crls(ctx, nm);
1316
1317 /* If no CRLs found and a near match from get_crl_sk use that */
1318 if (!skcrl && crl)
1319 goto done;
1320
1321 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);
1322
1323 sk_X509_CRL_pop_free(skcrl, X509_CRL_free);
1324
1325 done:
1326
1327 /* If we got any kind of CRL use it and return success */
729 if (crl) 1328 if (crl)
730 X509_CRL_free(crl); 1329 {
731 return 1; 1330 ctx->current_issuer = issuer;
1331 ctx->current_crl_score = crl_score;
1332 ctx->current_reasons = reasons;
1333 *pcrl = crl;
1334 *pdcrl = dcrl;
1335 return 1;
1336 }
1337
1338 return 0;
732 } 1339 }
733 1340
734/* Check CRL validity */ 1341/* Check CRL validity */
@@ -739,10 +1346,14 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
739 int ok = 0, chnum, cnum; 1346 int ok = 0, chnum, cnum;
740 cnum = ctx->error_depth; 1347 cnum = ctx->error_depth;
741 chnum = sk_X509_num(ctx->chain) - 1; 1348 chnum = sk_X509_num(ctx->chain) - 1;
742 /* Find CRL issuer: if not last certificate then issuer 1349 /* if we have an alternative CRL issuer cert use that */
1350 if (ctx->current_issuer)
1351 issuer = ctx->current_issuer;
1352
1353 /* Else find CRL issuer: if not last certificate then issuer
743 * is next certificate in chain. 1354 * is next certificate in chain.
744 */ 1355 */
745 if(cnum < chnum) 1356 else if (cnum < chnum)
746 issuer = sk_X509_value(ctx->chain, cnum + 1); 1357 issuer = sk_X509_value(ctx->chain, cnum + 1);
747 else 1358 else
748 { 1359 {
@@ -758,13 +1369,52 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
758 1369
759 if(issuer) 1370 if(issuer)
760 { 1371 {
761 /* Check for cRLSign bit if keyUsage present */ 1372 /* Skip most tests for deltas because they have already
762 if ((issuer->ex_flags & EXFLAG_KUSAGE) && 1373 * been done
763 !(issuer->ex_kusage & KU_CRL_SIGN)) 1374 */
1375 if (!crl->base_crl_number)
764 { 1376 {
765 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN; 1377 /* Check for cRLSign bit if keyUsage present */
766 ok = ctx->verify_cb(0, ctx); 1378 if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
767 if(!ok) goto err; 1379 !(issuer->ex_kusage & KU_CRL_SIGN))
1380 {
1381 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
1382 ok = ctx->verify_cb(0, ctx);
1383 if(!ok) goto err;
1384 }
1385
1386 if (!(ctx->current_crl_score & CRL_SCORE_SCOPE))
1387 {
1388 ctx->error = X509_V_ERR_DIFFERENT_CRL_SCOPE;
1389 ok = ctx->verify_cb(0, ctx);
1390 if(!ok) goto err;
1391 }
1392
1393 if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH))
1394 {
1395 if (check_crl_path(ctx, ctx->current_issuer) <= 0)
1396 {
1397 ctx->error = X509_V_ERR_CRL_PATH_VALIDATION_ERROR;
1398 ok = ctx->verify_cb(0, ctx);
1399 if(!ok) goto err;
1400 }
1401 }
1402
1403 if (crl->idp_flags & IDP_INVALID)
1404 {
1405 ctx->error = X509_V_ERR_INVALID_EXTENSION;
1406 ok = ctx->verify_cb(0, ctx);
1407 if(!ok) goto err;
1408 }
1409
1410
1411 }
1412
1413 if (!(ctx->current_crl_score & CRL_SCORE_TIME))
1414 {
1415 ok = check_crl_time(ctx, crl, 1);
1416 if (!ok)
1417 goto err;
768 } 1418 }
769 1419
770 /* Attempt to get issuer certificate public key */ 1420 /* Attempt to get issuer certificate public key */
@@ -788,10 +1438,6 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
788 } 1438 }
789 } 1439 }
790 1440
791 ok = check_crl_time(ctx, crl, 1);
792 if (!ok)
793 goto err;
794
795 ok = 1; 1441 ok = 1;
796 1442
797 err: 1443 err:
@@ -802,62 +1448,43 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
802/* Check certificate against CRL */ 1448/* Check certificate against CRL */
803static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) 1449static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
804 { 1450 {
805 int idx, ok; 1451 int ok;
806 X509_REVOKED rtmp; 1452 X509_REVOKED *rev;
807 STACK_OF(X509_EXTENSION) *exts; 1453 /* The rules changed for this... previously if a CRL contained
808 X509_EXTENSION *ext; 1454 * unhandled critical extensions it could still be used to indicate
809 /* Look for serial number of certificate in CRL */ 1455 * a certificate was revoked. This has since been changed since
810 rtmp.serialNumber = X509_get_serialNumber(x); 1456 * critical extension can change the meaning of CRL entries.
811 /* Sort revoked into serial number order if not already sorted. 1457 */
812 * Do this under a lock to avoid race condition. 1458 if (crl->flags & EXFLAG_CRITICAL)
813 */
814 if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked))
815 { 1459 {
816 CRYPTO_w_lock(CRYPTO_LOCK_X509_CRL); 1460 if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
817 sk_X509_REVOKED_sort(crl->crl->revoked); 1461 return 1;
818 CRYPTO_w_unlock(CRYPTO_LOCK_X509_CRL); 1462 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
1463 ok = ctx->verify_cb(0, ctx);
1464 if(!ok)
1465 return 0;
819 } 1466 }
820 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp); 1467 /* Look for serial number of certificate in CRL
821 /* If found assume revoked: want something cleverer than 1468 * If found make sure reason is not removeFromCRL.
822 * this to handle entry extensions in V2 CRLs.
823 */ 1469 */
824 if(idx >= 0) 1470 if (X509_CRL_get0_by_cert(crl, &rev, x))
825 { 1471 {
1472 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
1473 return 2;
826 ctx->error = X509_V_ERR_CERT_REVOKED; 1474 ctx->error = X509_V_ERR_CERT_REVOKED;
827 ok = ctx->verify_cb(0, ctx); 1475 ok = ctx->verify_cb(0, ctx);
828 if (!ok) return 0; 1476 if (!ok)
1477 return 0;
829 } 1478 }
830 1479
831 if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
832 return 1;
833
834 /* See if we have any critical CRL extensions: since we
835 * currently don't handle any CRL extensions the CRL must be
836 * rejected.
837 * This code accesses the X509_CRL structure directly: applications
838 * shouldn't do this.
839 */
840
841 exts = crl->crl->extensions;
842
843 for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++)
844 {
845 ext = sk_X509_EXTENSION_value(exts, idx);
846 if (ext->critical > 0)
847 {
848 ctx->error =
849 X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
850 ok = ctx->verify_cb(0, ctx);
851 if(!ok) return 0;
852 break;
853 }
854 }
855 return 1; 1480 return 1;
856 } 1481 }
857 1482
858static int check_policy(X509_STORE_CTX *ctx) 1483static int check_policy(X509_STORE_CTX *ctx)
859 { 1484 {
860 int ret; 1485 int ret;
1486 if (ctx->parent)
1487 return 1;
861 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, 1488 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
862 ctx->param->policies, ctx->param->flags); 1489 ctx->param->policies, ctx->param->flags);
863 if (ret == 0) 1490 if (ret == 0)
@@ -880,7 +1507,8 @@ static int check_policy(X509_STORE_CTX *ctx)
880 continue; 1507 continue;
881 ctx->current_cert = x; 1508 ctx->current_cert = x;
882 ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION; 1509 ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION;
883 ret = ctx->verify_cb(0, ctx); 1510 if(!ctx->verify_cb(0, ctx))
1511 return 0;
884 } 1512 }
885 return 1; 1513 return 1;
886 } 1514 }
@@ -986,7 +1614,12 @@ static int internal_verify(X509_STORE_CTX *ctx)
986 while (n >= 0) 1614 while (n >= 0)
987 { 1615 {
988 ctx->error_depth=n; 1616 ctx->error_depth=n;
989 if (!xs->valid) 1617
1618 /* Skip signature check for self signed certificates unless
1619 * explicitly asked for. It doesn't add any security and
1620 * just wastes time.
1621 */
1622 if (!xs->valid && (xs != xi || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)))
990 { 1623 {
991 if ((pkey=X509_get_pubkey(xi)) == NULL) 1624 if ((pkey=X509_get_pubkey(xi)) == NULL)
992 { 1625 {
@@ -996,13 +1629,6 @@ static int internal_verify(X509_STORE_CTX *ctx)
996 if (!ok) goto end; 1629 if (!ok) goto end;
997 } 1630 }
998 else if (X509_verify(xs,pkey) <= 0) 1631 else if (X509_verify(xs,pkey) <= 0)
999 /* XXX For the final trusted self-signed cert,
1000 * this is a waste of time. That check should
1001 * optional so that e.g. 'openssl x509' can be
1002 * used to detect invalid self-signatures, but
1003 * we don't verify again and again in SSL
1004 * handshakes and the like once the cert has
1005 * been declared trusted. */
1006 { 1632 {
1007 ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE; 1633 ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
1008 ctx->current_cert=xs; 1634 ctx->current_cert=xs;
@@ -1041,12 +1667,12 @@ end:
1041 return ok; 1667 return ok;
1042 } 1668 }
1043 1669
1044int X509_cmp_current_time(ASN1_TIME *ctm) 1670int X509_cmp_current_time(const ASN1_TIME *ctm)
1045{ 1671{
1046 return X509_cmp_time(ctm, NULL); 1672 return X509_cmp_time(ctm, NULL);
1047} 1673}
1048 1674
1049int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time) 1675int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
1050 { 1676 {
1051 char *str; 1677 char *str;
1052 ASN1_TIME atm; 1678 ASN1_TIME atm;
@@ -1101,6 +1727,7 @@ int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time)
1101 offset= -offset; 1727 offset= -offset;
1102 } 1728 }
1103 atm.type=ctm->type; 1729 atm.type=ctm->type;
1730 atm.flags = 0;
1104 atm.length=sizeof(buff2); 1731 atm.length=sizeof(buff2);
1105 atm.data=(unsigned char *)buff2; 1732 atm.data=(unsigned char *)buff2;
1106 1733
@@ -1129,19 +1756,28 @@ ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj)
1129 return X509_time_adj(s, adj, NULL); 1756 return X509_time_adj(s, adj, NULL);
1130} 1757}
1131 1758
1132ASN1_TIME *X509_time_adj(ASN1_TIME *s, long adj, time_t *in_tm) 1759ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm)
1760 {
1761 return X509_time_adj_ex(s, 0, offset_sec, in_tm);
1762 }
1763
1764ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s,
1765 int offset_day, long offset_sec, time_t *in_tm)
1133 { 1766 {
1134 time_t t; 1767 time_t t;
1135 int type = -1;
1136 1768
1137 if (in_tm) t = *in_tm; 1769 if (in_tm) t = *in_tm;
1138 else time(&t); 1770 else time(&t);
1139 1771
1140 t+=adj; 1772 if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING))
1141 if (s) type = s->type; 1773 {
1142 if (type == V_ASN1_UTCTIME) return ASN1_UTCTIME_set(s,t); 1774 if (s->type == V_ASN1_UTCTIME)
1143 if (type == V_ASN1_GENERALIZEDTIME) return ASN1_GENERALIZEDTIME_set(s, t); 1775 return ASN1_UTCTIME_adj(s,t, offset_day, offset_sec);
1144 return ASN1_TIME_set(s, t); 1776 if (s->type == V_ASN1_GENERALIZEDTIME)
1777 return ASN1_GENERALIZEDTIME_adj(s, t, offset_day,
1778 offset_sec);
1779 }
1780 return ASN1_TIME_adj(s, t, offset_day, offset_sec);
1145 } 1781 }
1146 1782
1147int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) 1783int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain)
@@ -1244,6 +1880,21 @@ STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx)
1244 return chain; 1880 return chain;
1245 } 1881 }
1246 1882
1883X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx)
1884 {
1885 return ctx->current_issuer;
1886 }
1887
1888X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx)
1889 {
1890 return ctx->current_crl;
1891 }
1892
1893X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx)
1894 {
1895 return ctx->parent;
1896 }
1897
1247void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x) 1898void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
1248 { 1899 {
1249 ctx->cert=x; 1900 ctx->cert=x;
@@ -1365,6 +2016,7 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
1365 ctx->current_cert=NULL; 2016 ctx->current_cert=NULL;
1366 ctx->current_issuer=NULL; 2017 ctx->current_issuer=NULL;
1367 ctx->tree = NULL; 2018 ctx->tree = NULL;
2019 ctx->parent = NULL;
1368 2020
1369 ctx->param = X509_VERIFY_PARAM_new(); 2021 ctx->param = X509_VERIFY_PARAM_new();
1370 2022
@@ -1430,7 +2082,7 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
1430 if (store && store->get_crl) 2082 if (store && store->get_crl)
1431 ctx->get_crl = store->get_crl; 2083 ctx->get_crl = store->get_crl;
1432 else 2084 else
1433 ctx->get_crl = get_crl; 2085 ctx->get_crl = NULL;
1434 2086
1435 if (store && store->check_crl) 2087 if (store && store->check_crl)
1436 ctx->check_crl = store->check_crl; 2088 ctx->check_crl = store->check_crl;
@@ -1442,6 +2094,16 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
1442 else 2094 else
1443 ctx->cert_crl = cert_crl; 2095 ctx->cert_crl = cert_crl;
1444 2096
2097 if (store && store->lookup_certs)
2098 ctx->lookup_certs = store->lookup_certs;
2099 else
2100 ctx->lookup_certs = X509_STORE_get1_certs;
2101
2102 if (store && store->lookup_crls)
2103 ctx->lookup_crls = store->lookup_crls;
2104 else
2105 ctx->lookup_crls = X509_STORE_get1_crls;
2106
1445 ctx->check_policy = check_policy; 2107 ctx->check_policy = check_policy;
1446 2108
1447 2109
@@ -1474,7 +2136,8 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
1474 if (ctx->cleanup) ctx->cleanup(ctx); 2136 if (ctx->cleanup) ctx->cleanup(ctx);
1475 if (ctx->param != NULL) 2137 if (ctx->param != NULL)
1476 { 2138 {
1477 X509_VERIFY_PARAM_free(ctx->param); 2139 if (ctx->parent == NULL)
2140 X509_VERIFY_PARAM_free(ctx->param);
1478 ctx->param=NULL; 2141 ctx->param=NULL;
1479 } 2142 }
1480 if (ctx->tree != NULL) 2143 if (ctx->tree != NULL)
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index 76c76e1719..fe09b30aaa 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -77,6 +77,7 @@
77extern "C" { 77extern "C" {
78#endif 78#endif
79 79
80#if 0
80/* Outer object */ 81/* Outer object */
81typedef struct x509_hash_dir_st 82typedef struct x509_hash_dir_st
82 { 83 {
@@ -85,6 +86,7 @@ typedef struct x509_hash_dir_st
85 int *dirs_type; 86 int *dirs_type;
86 int num_dirs_alloced; 87 int num_dirs_alloced;
87 } X509_HASH_DIR_CTX; 88 } X509_HASH_DIR_CTX;
89#endif
88 90
89typedef struct x509_file_st 91typedef struct x509_file_st
90 { 92 {
@@ -198,6 +200,8 @@ struct x509_store_st
198 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */ 200 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
199 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */ 201 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
200 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */ 202 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
203 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
204 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
201 int (*cleanup)(X509_STORE_CTX *ctx); 205 int (*cleanup)(X509_STORE_CTX *ctx);
202 206
203 CRYPTO_EX_DATA ex_data; 207 CRYPTO_EX_DATA ex_data;
@@ -246,6 +250,8 @@ struct x509_store_ctx_st /* X509_STORE_CTX */
246 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */ 250 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
247 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */ 251 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
248 int (*check_policy)(X509_STORE_CTX *ctx); 252 int (*check_policy)(X509_STORE_CTX *ctx);
253 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
254 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
249 int (*cleanup)(X509_STORE_CTX *ctx); 255 int (*cleanup)(X509_STORE_CTX *ctx);
250 256
251 /* The following is built up */ 257 /* The following is built up */
@@ -263,6 +269,11 @@ struct x509_store_ctx_st /* X509_STORE_CTX */
263 X509 *current_issuer; /* cert currently being tested as valid issuer */ 269 X509 *current_issuer; /* cert currently being tested as valid issuer */
264 X509_CRL *current_crl; /* current CRL */ 270 X509_CRL *current_crl; /* current CRL */
265 271
272 int current_crl_score; /* score of current CRL */
273 unsigned int current_reasons; /* Reason mask */
274
275 X509_STORE_CTX *parent; /* For CRL path validation: parent context */
276
266 CRYPTO_EX_DATA ex_data; 277 CRYPTO_EX_DATA ex_data;
267 } /* X509_STORE_CTX */; 278 } /* X509_STORE_CTX */;
268 279
@@ -330,8 +341,18 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
330#define X509_V_ERR_INVALID_EXTENSION 41 341#define X509_V_ERR_INVALID_EXTENSION 41
331#define X509_V_ERR_INVALID_POLICY_EXTENSION 42 342#define X509_V_ERR_INVALID_POLICY_EXTENSION 42
332#define X509_V_ERR_NO_EXPLICIT_POLICY 43 343#define X509_V_ERR_NO_EXPLICIT_POLICY 43
344#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44
345#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45
346
347#define X509_V_ERR_UNNESTED_RESOURCE 46
333 348
334#define X509_V_ERR_UNNESTED_RESOURCE 44 349#define X509_V_ERR_PERMITTED_VIOLATION 47
350#define X509_V_ERR_EXCLUDED_VIOLATION 48
351#define X509_V_ERR_SUBTREE_MINMAX 49
352#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51
353#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52
354#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53
355#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54
335 356
336/* The application is not happy */ 357/* The application is not happy */
337#define X509_V_ERR_APPLICATION_VERIFICATION 50 358#define X509_V_ERR_APPLICATION_VERIFICATION 50
@@ -362,6 +383,13 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
362#define X509_V_FLAG_INHIBIT_MAP 0x400 383#define X509_V_FLAG_INHIBIT_MAP 0x400
363/* Notify callback that policy is OK */ 384/* Notify callback that policy is OK */
364#define X509_V_FLAG_NOTIFY_POLICY 0x800 385#define X509_V_FLAG_NOTIFY_POLICY 0x800
386/* Extended CRL features such as indirect CRLs, alternate CRL signing keys */
387#define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000
388/* Delta CRL support */
389#define X509_V_FLAG_USE_DELTAS 0x2000
390/* Check selfsigned CA signature */
391#define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000
392
365 393
366#define X509_VP_FLAG_DEFAULT 0x1 394#define X509_VP_FLAG_DEFAULT 0x1
367#define X509_VP_FLAG_OVERWRITE 0x2 395#define X509_VP_FLAG_OVERWRITE 0x2
@@ -384,11 +412,16 @@ void X509_OBJECT_free_contents(X509_OBJECT *a);
384X509_STORE *X509_STORE_new(void ); 412X509_STORE *X509_STORE_new(void );
385void X509_STORE_free(X509_STORE *v); 413void X509_STORE_free(X509_STORE *v);
386 414
415STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *st, X509_NAME *nm);
416STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *st, X509_NAME *nm);
387int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); 417int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
388int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); 418int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
389int X509_STORE_set_trust(X509_STORE *ctx, int trust); 419int X509_STORE_set_trust(X509_STORE *ctx, int trust);
390int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm); 420int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
391 421
422void X509_STORE_set_verify_cb(X509_STORE *ctx,
423 int (*verify_cb)(int, X509_STORE_CTX *));
424
392X509_STORE_CTX *X509_STORE_CTX_new(void); 425X509_STORE_CTX *X509_STORE_CTX_new(void);
393 426
394int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); 427int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
@@ -447,6 +480,9 @@ int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
447void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s); 480void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
448int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx); 481int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
449X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx); 482X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
483X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
484X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
485X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx);
450STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx); 486STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
451STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx); 487STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
452void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x); 488void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
diff --git a/src/lib/libcrypto/x509/x509cset.c b/src/lib/libcrypto/x509/x509cset.c
index 7f4004b291..3109defb0b 100644
--- a/src/lib/libcrypto/x509/x509cset.c
+++ b/src/lib/libcrypto/x509/x509cset.c
@@ -81,7 +81,7 @@ int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name)
81 } 81 }
82 82
83 83
84int X509_CRL_set_lastUpdate(X509_CRL *x, ASN1_TIME *tm) 84int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm)
85 { 85 {
86 ASN1_TIME *in; 86 ASN1_TIME *in;
87 87
@@ -99,7 +99,7 @@ int X509_CRL_set_lastUpdate(X509_CRL *x, ASN1_TIME *tm)
99 return(in != NULL); 99 return(in != NULL);
100 } 100 }
101 101
102int X509_CRL_set_nextUpdate(X509_CRL *x, ASN1_TIME *tm) 102int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm)
103 { 103 {
104 ASN1_TIME *in; 104 ASN1_TIME *in;
105 105
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
index 068abfe5f0..27bc4dc9a3 100644
--- a/src/lib/libcrypto/x509/x509name.c
+++ b/src/lib/libcrypto/x509/x509name.c
@@ -356,7 +356,7 @@ int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
356 return ASN1_STRING_set_by_NID(&ne->value, bytes, 356 return ASN1_STRING_set_by_NID(&ne->value, bytes,
357 len, type, 357 len, type,
358 OBJ_obj2nid(ne->object)) ? 1 : 0; 358 OBJ_obj2nid(ne->object)) ? 1 : 0;
359 if (len < 0) len=strlen((char *)bytes); 359 if (len < 0) len=strlen((const char *)bytes);
360 i=ASN1_STRING_set(ne->value,bytes,len); 360 i=ASN1_STRING_set(ne->value,bytes,len);
361 if (!i) return(0); 361 if (!i) return(0);
362 if (type != V_ASN1_UNDEF) 362 if (type != V_ASN1_UNDEF)
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
index 2cd994c5b0..3385ad3f67 100644
--- a/src/lib/libcrypto/x509/x509type.c
+++ b/src/lib/libcrypto/x509/x509type.c
@@ -91,6 +91,10 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
91 break; 91 break;
92 case EVP_PKEY_DH: 92 case EVP_PKEY_DH:
93 ret=EVP_PK_DH|EVP_PKT_EXCH; 93 ret=EVP_PK_DH|EVP_PKT_EXCH;
94 break;
95 case NID_id_GostR3410_94:
96 case NID_id_GostR3410_2001:
97 ret=EVP_PKT_EXCH|EVP_PKT_SIGN;
94 break; 98 break;
95 default: 99 default:
96 break; 100 break;
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
index 9039caad60..ebae30b701 100644
--- a/src/lib/libcrypto/x509/x_all.c
+++ b/src/lib/libcrypto/x509/x_all.c
@@ -57,7 +57,6 @@
57 */ 57 */
58 58
59#include <stdio.h> 59#include <stdio.h>
60#undef SSLEAY_MACROS
61#include <openssl/stack.h> 60#include <openssl/stack.h>
62#include "cryptlib.h" 61#include "cryptlib.h"
63#include <openssl/buffer.h> 62#include <openssl/buffer.h>
@@ -83,12 +82,6 @@ int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
83 a->sig_alg,a->signature,a->req_info,r)); 82 a->sig_alg,a->signature,a->req_info,r));
84 } 83 }
85 84
86int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r)
87 {
88 return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO),
89 a->sig_alg, a->signature,a->crl,r));
90 }
91
92int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r) 85int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
93 { 86 {
94 return(ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC), 87 return(ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-01-07 04:58:36 +0000