Prepare for removing most of the X509_TRUST API

X509_check_trust() is of course used by the verifier. Unfortunately
M2Crypto exposes it. The only other part of the X509_TRUST API that
are still needed are the X509_TRUST_* macros in x509.h, as they are
used via *_set_trust and indirectly via the purpose stuff. The rest
will be removed.

X509_TRUST_add() was defanged recently, in particular it no longer
hangs strdup()'ed strings off the global struct. Nothing ever cleaned
these up. TRUST_cleanup() attempted to do so, but since it checked
the dynamic/dynamic strings flags in the wrong order, that cleanup
call ended up doing nothing, so that code was removed at some point.

As a consequence, the struct can now be made const. Use a CTASSERT()
to ensure size assumptions on X509_TRUST_COUNT, X509_TRUST_MAX, and
X509_TRUST_MIN hold true.

Remove the global variable underlying X509_TRUST_set_default()'s
functionality and move its accessor down to all the other functions
that will be deleted.

Inline a few things in X509_check_trust(), so we can excise the
internals of X509_TRUST_get0(), X509_TRUST_get_by_id(). Since the
default trust function can no longer be changed, call obj_trust()
directly.

ok jsing

1 files changed, 35 insertions, 41 deletions

diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
index efa648c9eb..a6fc4d61c5 100644
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ b/src/lib/libcrypto/x509/x509_trs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_trs.c,v 1.39 2024/01/10 21:34:53 tb Exp $ */
+/* $OpenBSD: x509_trs.c,v 1.40 2024/01/13 19:57:38 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -64,6 +64,7 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
+#include "crypto_internal.h"
 #include "x509_local.h"
 
 static int
@@ -129,7 +130,7 @@ trust_1oid(X509_TRUST *trust, X509 *x, int flags)
  * value to get an index into the table
  */
 
-static X509_TRUST trstandard[] = {
+static const X509_TRUST trstandard[] = {
         {
                 .trust = X509_TRUST_COMPAT,
                 .check_trust = trust_compat,
@@ -181,27 +182,17 @@ static X509_TRUST trstandard[] = {
 
 #define X509_TRUST_COUNT        (sizeof(trstandard) / sizeof(trstandard[0]))
 
-static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
+CTASSERT(X509_TRUST_MIN == 1 && X509_TRUST_MAX == X509_TRUST_COUNT);
 
 int
-(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
-{
-        int (*oldtrust)(int , X509 *, int);
-
-        oldtrust = default_trust;
-        default_trust = trust;
-        return oldtrust;
-}
-LCRYPTO_ALIAS(X509_TRUST_set_default);
-
-int
-X509_check_trust(X509 *x, int id, int flags)
+X509_check_trust(X509 *x, int trust_id, int flags)
 {
-        X509_TRUST *pt;
+        const X509_TRUST *trust;
         int idx;
 
-        if (id == -1)
+        if (trust_id == -1)
                 return 1;
+
         /*
          * XXX beck/jsing This enables self signed certs to be trusted for
          * an unspecified id/trust flag value (this is NOT the
@@ -211,21 +202,36 @@ X509_check_trust(X509 *x, int id, int flags)
          * This should be revisited, but changing the default "not default"
          * may break things.
          */
-        if (id == 0) {
+        if (trust_id == 0) {
                 int rv;
                 rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
                 if (rv != X509_TRUST_UNTRUSTED)
                         return rv;
                 return trust_compat(NULL, x, 0);
         }
-        idx = X509_TRUST_get_by_id(id);
-        if (idx == -1)
-                return default_trust(id, x, flags);
-        pt = X509_TRUST_get0(idx);
-        return pt->check_trust(pt, x, flags);
+
+        if (trust_id < X509_TRUST_MIN || trust_id > X509_TRUST_MAX)
+                return obj_trust(trust_id, x, flags);
+
+        idx = trust_id - X509_TRUST_MIN;
+        trust = &trstandard[idx];
+
+        return trust->check_trust((X509_TRUST *)trust, x, flags);
 }
 LCRYPTO_ALIAS(X509_check_trust);
 
+/*
+ * Remove all the functions below in the next bump.
+ */
+
+int
+(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
+{
+        X509error(ERR_R_DISABLED);
+        return NULL;
+}
+LCRYPTO_ALIAS(X509_TRUST_set_default);
+
 int
 X509_TRUST_get_count(void)
 {
@@ -236,36 +242,24 @@ LCRYPTO_ALIAS(X509_TRUST_get_count);
 X509_TRUST *
 X509_TRUST_get0(int idx)
 {
-        if (idx < 0 || (size_t)idx >= X509_TRUST_COUNT)
-                return NULL;
-
-        return &trstandard[idx];
+        X509error(ERR_R_DISABLED);
+        return NULL;
 }
 LCRYPTO_ALIAS(X509_TRUST_get0);
 
 int
 X509_TRUST_get_by_id(int id)
 {
-        /*
-         * Ensure the trust identifier is between MIN and MAX inclusive.
-         * If so, translate it into an index into the trstandard[] table.
-         */
-        if (id < X509_TRUST_MIN || id > X509_TRUST_MAX)
-                return -1;
-
-        return id - X509_TRUST_MIN;
+        X509error(ERR_R_DISABLED);
+        return -1;
 }
 LCRYPTO_ALIAS(X509_TRUST_get_by_id);
 
 int
 X509_TRUST_set(int *t, int trust)
 {
-        if (X509_TRUST_get_by_id(trust) == -1) {
-                X509error(X509_R_INVALID_TRUST);
-                return 0;
-        }
-        *t = trust;
-        return 1;
+        X509error(ERR_R_DISABLED);
+        return 0;
 }
 LCRYPTO_ALIAS(X509_TRUST_set);