summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libcrypto/evp/digest.c15
-rw-r--r--src/lib/libcrypto/x509/x509_txt.c8
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.c55
-rw-r--r--src/lib/libssl/src/crypto/evp/digest.c15
-rw-r--r--src/lib/libssl/src/crypto/x509/x509_txt.c8
-rw-r--r--src/lib/libssl/src/crypto/x509/x509_vfy.c55
6 files changed, 22 insertions, 134 deletions
diff --git a/src/lib/libcrypto/evp/digest.c b/src/lib/libcrypto/evp/digest.c
index 0623ddf1f0..b22eed4421 100644
--- a/src/lib/libcrypto/evp/digest.c
+++ b/src/lib/libcrypto/evp/digest.c
@@ -248,7 +248,6 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
248 248
249int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) 249int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
250 { 250 {
251 unsigned char *tmp_buf;
252 if ((in == NULL) || (in->digest == NULL)) 251 if ((in == NULL) || (in->digest == NULL))
253 { 252 {
254 EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED); 253 EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED);
@@ -263,22 +262,15 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
263 } 262 }
264#endif 263#endif
265 264
266 if (out->digest == in->digest)
267 {
268 tmp_buf = out->md_data;
269 EVP_MD_CTX_set_flags(out,EVP_MD_CTX_FLAG_REUSE);
270 }
271 else tmp_buf = NULL;
272 EVP_MD_CTX_cleanup(out); 265 EVP_MD_CTX_cleanup(out);
273 memcpy(out,in,sizeof *out); 266 memcpy(out,in,sizeof *out);
274 267
275 if (out->digest->ctx_size) 268 if (out->digest->ctx_size)
276 { 269 {
277 if (tmp_buf) out->md_data = tmp_buf; 270 out->md_data=OPENSSL_malloc(out->digest->ctx_size);
278 else out->md_data=OPENSSL_malloc(out->digest->ctx_size);
279 memcpy(out->md_data,in->md_data,out->digest->ctx_size); 271 memcpy(out->md_data,in->md_data,out->digest->ctx_size);
280 } 272 }
281 273
282 if (out->digest->copy) 274 if (out->digest->copy)
283 return out->digest->copy(out,in); 275 return out->digest->copy(out,in);
284 276
@@ -316,8 +308,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
316 if (ctx->digest && ctx->digest->cleanup 308 if (ctx->digest && ctx->digest->cleanup
317 && !EVP_MD_CTX_test_flags(ctx,EVP_MD_CTX_FLAG_CLEANED)) 309 && !EVP_MD_CTX_test_flags(ctx,EVP_MD_CTX_FLAG_CLEANED))
318 ctx->digest->cleanup(ctx); 310 ctx->digest->cleanup(ctx);
319 if (ctx->digest && ctx->digest->ctx_size && ctx->md_data 311 if (ctx->digest && ctx->digest->ctx_size && ctx->md_data)
320 && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE))
321 { 312 {
322 OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size); 313 OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
323 OPENSSL_free(ctx->md_data); 314 OPENSSL_free(ctx->md_data);
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index e31ebc6741..9d09ae17e8 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -147,14 +147,8 @@ const char *X509_verify_cert_error_string(long n)
147 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION: 147 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
148 return("unhandled critical extension"); 148 return("unhandled critical extension");
149 149
150 case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
151 return("key usage does not include CRL signing");
152
153 case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
154 return("unhandled critical CRL extension");
155
156 default: 150 default:
157 BIO_snprintf(buf,sizeof buf,"error number %ld",n); 151 snprintf(buf,sizeof buf,"error number %ld",n);
158 return(buf); 152 return(buf);
159 } 153 }
160 } 154 }
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 2e4d0b823a..2bb21b443e 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -383,7 +383,6 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
383 /* Check all untrusted certificates */ 383 /* Check all untrusted certificates */
384 for (i = 0; i < ctx->last_untrusted; i++) 384 for (i = 0; i < ctx->last_untrusted; i++)
385 { 385 {
386 int ret;
387 x = sk_X509_value(ctx->chain, i); 386 x = sk_X509_value(ctx->chain, i);
388 if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL) 387 if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
389 && (x->ex_flags & EXFLAG_CRITICAL)) 388 && (x->ex_flags & EXFLAG_CRITICAL))
@@ -394,10 +393,7 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
394 ok=cb(0,ctx); 393 ok=cb(0,ctx);
395 if (!ok) goto end; 394 if (!ok) goto end;
396 } 395 }
397 ret = X509_check_purpose(x, ctx->purpose, i); 396 if (!X509_check_purpose(x, ctx->purpose, i))
398 if ((ret == 0)
399 || ((ctx->flags & X509_V_FLAG_X509_STRICT)
400 && (ret != 1)))
401 { 397 {
402 if (i) 398 if (i)
403 ctx->error = X509_V_ERR_INVALID_CA; 399 ctx->error = X509_V_ERR_INVALID_CA;
@@ -541,14 +537,6 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
541 537
542 if(issuer) 538 if(issuer)
543 { 539 {
544 /* Check for cRLSign bit if keyUsage present */
545 if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
546 !(issuer->ex_kusage & KU_CRL_SIGN))
547 {
548 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
549 ok = ctx->verify_cb(0, ctx);
550 if(!ok) goto err;
551 }
552 540
553 /* Attempt to get issuer certificate public key */ 541 /* Attempt to get issuer certificate public key */
554 ikey = X509_get_pubkey(issuer); 542 ikey = X509_get_pubkey(issuer);
@@ -623,46 +611,17 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
623 { 611 {
624 int idx, ok; 612 int idx, ok;
625 X509_REVOKED rtmp; 613 X509_REVOKED rtmp;
626 STACK_OF(X509_EXTENSION) *exts;
627 X509_EXTENSION *ext;
628 /* Look for serial number of certificate in CRL */ 614 /* Look for serial number of certificate in CRL */
629 rtmp.serialNumber = X509_get_serialNumber(x); 615 rtmp.serialNumber = X509_get_serialNumber(x);
630 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp); 616 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
631 /* If found assume revoked: want something cleverer than 617 /* Not found: OK */
618 if(idx == -1) return 1;
619 /* Otherwise revoked: want something cleverer than
632 * this to handle entry extensions in V2 CRLs. 620 * this to handle entry extensions in V2 CRLs.
633 */ 621 */
634 if(idx >= 0) 622 ctx->error = X509_V_ERR_CERT_REVOKED;
635 { 623 ok = ctx->verify_cb(0, ctx);
636 ctx->error = X509_V_ERR_CERT_REVOKED; 624 return ok;
637 ok = ctx->verify_cb(0, ctx);
638 if (!ok) return 0;
639 }
640
641 if (ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
642 return 1;
643
644 /* See if we have any critical CRL extensions: since we
645 * currently don't handle any CRL extensions the CRL must be
646 * rejected.
647 * This code accesses the X509_CRL structure directly: applications
648 * shouldn't do this.
649 */
650
651 exts = crl->crl->extensions;
652
653 for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++)
654 {
655 ext = sk_X509_EXTENSION_value(exts, idx);
656 if (ext->critical > 0)
657 {
658 ctx->error =
659 X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
660 ok = ctx->verify_cb(0, ctx);
661 if(!ok) return 0;
662 break;
663 }
664 }
665 return 1;
666 } 625 }
667 626
668static int internal_verify(X509_STORE_CTX *ctx) 627static int internal_verify(X509_STORE_CTX *ctx)
diff --git a/src/lib/libssl/src/crypto/evp/digest.c b/src/lib/libssl/src/crypto/evp/digest.c
index 0623ddf1f0..b22eed4421 100644
--- a/src/lib/libssl/src/crypto/evp/digest.c
+++ b/src/lib/libssl/src/crypto/evp/digest.c
@@ -248,7 +248,6 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in)
248 248
249int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) 249int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
250 { 250 {
251 unsigned char *tmp_buf;
252 if ((in == NULL) || (in->digest == NULL)) 251 if ((in == NULL) || (in->digest == NULL))
253 { 252 {
254 EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED); 253 EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED);
@@ -263,22 +262,15 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
263 } 262 }
264#endif 263#endif
265 264
266 if (out->digest == in->digest)
267 {
268 tmp_buf = out->md_data;
269 EVP_MD_CTX_set_flags(out,EVP_MD_CTX_FLAG_REUSE);
270 }
271 else tmp_buf = NULL;
272 EVP_MD_CTX_cleanup(out); 265 EVP_MD_CTX_cleanup(out);
273 memcpy(out,in,sizeof *out); 266 memcpy(out,in,sizeof *out);
274 267
275 if (out->digest->ctx_size) 268 if (out->digest->ctx_size)
276 { 269 {
277 if (tmp_buf) out->md_data = tmp_buf; 270 out->md_data=OPENSSL_malloc(out->digest->ctx_size);
278 else out->md_data=OPENSSL_malloc(out->digest->ctx_size);
279 memcpy(out->md_data,in->md_data,out->digest->ctx_size); 271 memcpy(out->md_data,in->md_data,out->digest->ctx_size);
280 } 272 }
281 273
282 if (out->digest->copy) 274 if (out->digest->copy)
283 return out->digest->copy(out,in); 275 return out->digest->copy(out,in);
284 276
@@ -316,8 +308,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
316 if (ctx->digest && ctx->digest->cleanup 308 if (ctx->digest && ctx->digest->cleanup
317 && !EVP_MD_CTX_test_flags(ctx,EVP_MD_CTX_FLAG_CLEANED)) 309 && !EVP_MD_CTX_test_flags(ctx,EVP_MD_CTX_FLAG_CLEANED))
318 ctx->digest->cleanup(ctx); 310 ctx->digest->cleanup(ctx);
319 if (ctx->digest && ctx->digest->ctx_size && ctx->md_data 311 if (ctx->digest && ctx->digest->ctx_size && ctx->md_data)
320 && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE))
321 { 312 {
322 OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size); 313 OPENSSL_cleanse(ctx->md_data,ctx->digest->ctx_size);
323 OPENSSL_free(ctx->md_data); 314 OPENSSL_free(ctx->md_data);
diff --git a/src/lib/libssl/src/crypto/x509/x509_txt.c b/src/lib/libssl/src/crypto/x509/x509_txt.c
index e31ebc6741..9d09ae17e8 100644
--- a/src/lib/libssl/src/crypto/x509/x509_txt.c
+++ b/src/lib/libssl/src/crypto/x509/x509_txt.c
@@ -147,14 +147,8 @@ const char *X509_verify_cert_error_string(long n)
147 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION: 147 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
148 return("unhandled critical extension"); 148 return("unhandled critical extension");
149 149
150 case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
151 return("key usage does not include CRL signing");
152
153 case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
154 return("unhandled critical CRL extension");
155
156 default: 150 default:
157 BIO_snprintf(buf,sizeof buf,"error number %ld",n); 151 snprintf(buf,sizeof buf,"error number %ld",n);
158 return(buf); 152 return(buf);
159 } 153 }
160 } 154 }
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.c b/src/lib/libssl/src/crypto/x509/x509_vfy.c
index 2e4d0b823a..2bb21b443e 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.c
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.c
@@ -383,7 +383,6 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
383 /* Check all untrusted certificates */ 383 /* Check all untrusted certificates */
384 for (i = 0; i < ctx->last_untrusted; i++) 384 for (i = 0; i < ctx->last_untrusted; i++)
385 { 385 {
386 int ret;
387 x = sk_X509_value(ctx->chain, i); 386 x = sk_X509_value(ctx->chain, i);
388 if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL) 387 if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
389 && (x->ex_flags & EXFLAG_CRITICAL)) 388 && (x->ex_flags & EXFLAG_CRITICAL))
@@ -394,10 +393,7 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
394 ok=cb(0,ctx); 393 ok=cb(0,ctx);
395 if (!ok) goto end; 394 if (!ok) goto end;
396 } 395 }
397 ret = X509_check_purpose(x, ctx->purpose, i); 396 if (!X509_check_purpose(x, ctx->purpose, i))
398 if ((ret == 0)
399 || ((ctx->flags & X509_V_FLAG_X509_STRICT)
400 && (ret != 1)))
401 { 397 {
402 if (i) 398 if (i)
403 ctx->error = X509_V_ERR_INVALID_CA; 399 ctx->error = X509_V_ERR_INVALID_CA;
@@ -541,14 +537,6 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
541 537
542 if(issuer) 538 if(issuer)
543 { 539 {
544 /* Check for cRLSign bit if keyUsage present */
545 if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
546 !(issuer->ex_kusage & KU_CRL_SIGN))
547 {
548 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
549 ok = ctx->verify_cb(0, ctx);
550 if(!ok) goto err;
551 }
552 540
553 /* Attempt to get issuer certificate public key */ 541 /* Attempt to get issuer certificate public key */
554 ikey = X509_get_pubkey(issuer); 542 ikey = X509_get_pubkey(issuer);
@@ -623,46 +611,17 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
623 { 611 {
624 int idx, ok; 612 int idx, ok;
625 X509_REVOKED rtmp; 613 X509_REVOKED rtmp;
626 STACK_OF(X509_EXTENSION) *exts;
627 X509_EXTENSION *ext;
628 /* Look for serial number of certificate in CRL */ 614 /* Look for serial number of certificate in CRL */
629 rtmp.serialNumber = X509_get_serialNumber(x); 615 rtmp.serialNumber = X509_get_serialNumber(x);
630 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp); 616 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
631 /* If found assume revoked: want something cleverer than 617 /* Not found: OK */
618 if(idx == -1) return 1;
619 /* Otherwise revoked: want something cleverer than
632 * this to handle entry extensions in V2 CRLs. 620 * this to handle entry extensions in V2 CRLs.
633 */ 621 */
634 if(idx >= 0) 622 ctx->error = X509_V_ERR_CERT_REVOKED;
635 { 623 ok = ctx->verify_cb(0, ctx);
636 ctx->error = X509_V_ERR_CERT_REVOKED; 624 return ok;
637 ok = ctx->verify_cb(0, ctx);
638 if (!ok) return 0;
639 }
640
641 if (ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
642 return 1;
643
644 /* See if we have any critical CRL extensions: since we
645 * currently don't handle any CRL extensions the CRL must be
646 * rejected.
647 * This code accesses the X509_CRL structure directly: applications
648 * shouldn't do this.
649 */
650
651 exts = crl->crl->extensions;
652
653 for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++)
654 {
655 ext = sk_X509_EXTENSION_value(exts, idx);
656 if (ext->critical > 0)
657 {
658 ctx->error =
659 X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
660 ok = ctx->verify_cb(0, ctx);
661 if(!ok) return 0;
662 break;
663 }
664 }
665 return 1;
666 } 625 }
667 626
668static int internal_verify(X509_STORE_CTX *ctx) 627static int internal_verify(X509_STORE_CTX *ctx)
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 18:26:01 +0000