1 files changed, 33 insertions, 182 deletions

diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
index 3a6e04a1de..cd2cfb6d85 100644
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ b/src/lib/libcrypto/x509/x509_lu.c
@@ -196,17 +196,9 @@ X509_STORE *X509_STORE_new(void)
         ret->get_crl = 0;
         ret->check_crl = 0;
         ret->cert_crl = 0;
-        ret->lookup_certs = 0;
-        ret->lookup_crls = 0;
         ret->cleanup = 0;
 
-        if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
-                {
-                sk_X509_OBJECT_free(ret->objs);
-                OPENSSL_free(ret);
-                return NULL;
-                }
-
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data);
         ret->references=1;
         return ret;
         }
@@ -294,11 +286,9 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
         X509_OBJECT stmp,*tmp;
         int i,j;
 
-        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
         tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name);
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
 
-        if (tmp == NULL || type == X509_LU_CRL)
+        if (tmp == NULL)
                 {
                 for (i=vs->current_method; i<sk_X509_LOOKUP_num(ctx->get_cert_methods); i++)
                         {
@@ -350,6 +340,7 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
 
         X509_OBJECT_up_ref_count(obj);
 
+
         if (X509_OBJECT_retrieve_match(ctx->objs, obj))
                 {
                 X509_OBJECT_free_contents(obj);
@@ -423,15 +414,14 @@ void X509_OBJECT_free_contents(X509_OBJECT *a)
                 }
         }
 
-static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
-             X509_NAME *name, int *pnmatch)
+int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
+             X509_NAME *name)
         {
         X509_OBJECT stmp;
         X509 x509_s;
         X509_CINF cinf_s;
         X509_CRL crl_s;
         X509_CRL_INFO crl_info_s;
-        int idx;
 
         stmp.type=type;
         switch (type)
@@ -451,169 +441,41 @@ static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
                 return -1;
                 }
 
-        idx = sk_X509_OBJECT_find(h,&stmp);
-        if (idx >= 0 && pnmatch)
-                {
-                int tidx;
-                const X509_OBJECT *tobj, *pstmp;
-                *pnmatch = 1;
-                pstmp = &stmp;
-                for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++)
-                        {
-                        tobj = sk_X509_OBJECT_value(h, tidx);
-                        if (x509_object_cmp(&tobj, &pstmp))
-                                break;
-                        (*pnmatch)++;
-                        }
-                }
-        return idx;
-        }
-
-
-int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
-             X509_NAME *name)
-        {
-        return x509_object_idx_cnt(h, type, name, NULL);
+        return sk_X509_OBJECT_find(h,&stmp);
         }
 
 X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
              X509_NAME *name)
-        {
+{
         int idx;
         idx = X509_OBJECT_idx_by_subject(h, type, name);
         if (idx==-1) return NULL;
         return sk_X509_OBJECT_value(h, idx);
-        }
-
-STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
-        {
-        int i, idx, cnt;
-        STACK_OF(X509) *sk;
-        X509 *x;
-        X509_OBJECT *obj;
-        sk = sk_X509_new_null();
-        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
-        idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
-        if (idx < 0)
-                {
-                /* Nothing found in cache: do lookup to possibly add new
-                 * objects to cache
-                 */
-                X509_OBJECT xobj;
-                CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-                if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj))
-                        {
-                        sk_X509_free(sk);
-                        return NULL;
-                        }
-                X509_OBJECT_free_contents(&xobj);
-                CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
-                idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_X509,nm, &cnt);
-                if (idx < 0)
-                        {
-                        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-                        sk_X509_free(sk);
-                        return NULL;
-                        }
-                }
-        for (i = 0; i < cnt; i++, idx++)
-                {
-                obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
-                x = obj->data.x509;
-                CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
-                if (!sk_X509_push(sk, x))
-                        {
-                        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-                        X509_free(x);
-                        sk_X509_pop_free(sk, X509_free);
-                        return NULL;
-                        }
-                }
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-        return sk;
-
-        }
-
-STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
-        {
-        int i, idx, cnt;
-        STACK_OF(X509_CRL) *sk;
-        X509_CRL *x;
-        X509_OBJECT *obj, xobj;
-        sk = sk_X509_CRL_new_null();
-        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
-        /* Check cache first */
-        idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
-
-        /* Always do lookup to possibly add new CRLs to cache
-         */
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-        if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj))
-                {
-                sk_X509_CRL_free(sk);
-                return NULL;
-                }
-        X509_OBJECT_free_contents(&xobj);
-        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
-        idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt);
-        if (idx < 0)
-                {
-                CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-                sk_X509_CRL_free(sk);
-                return NULL;
-                }
-
-        for (i = 0; i < cnt; i++, idx++)
-                {
-                obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
-                x = obj->data.crl;
-                CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
-                if (!sk_X509_CRL_push(sk, x))
-                        {
-                        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-                        X509_CRL_free(x);
-                        sk_X509_CRL_pop_free(sk, X509_CRL_free);
-                        return NULL;
-                        }
-                }
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-        return sk;
-        }
+}
 
 X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
-        {
+{
         int idx, i;
         X509_OBJECT *obj;
         idx = sk_X509_OBJECT_find(h, x);
         if (idx == -1) return NULL;
-        if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
-                return sk_X509_OBJECT_value(h, idx);
+        if (x->type != X509_LU_X509) return sk_X509_OBJECT_value(h, idx);
         for (i = idx; i < sk_X509_OBJECT_num(h); i++)
                 {
                 obj = sk_X509_OBJECT_value(h, i);
                 if (x509_object_cmp((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x))
                         return NULL;
-                if (x->type == X509_LU_X509)
-                        {
-                        if (!X509_cmp(obj->data.x509, x->data.x509))
-                                return obj;
-                        }
-                else if (x->type == X509_LU_CRL)
-                        {
-                        if (!X509_CRL_match(obj->data.crl, x->data.crl))
-                                return obj;
-                        }
-                else
+                if ((x->type != X509_LU_X509) || !X509_cmp(obj->data.x509, x->data.x509))
                         return obj;
                 }
         return NULL;
-        }
+}
 
 
 /* Try to get issuer certificate from store. Due to limitations
  * of the API this can only retrieve a single certificate matching
  * a given subject name. However it will fill the cache with all
- * matching certificates, so we can examine the cache for all
+ * matching certificates, so we can examine the cache for all 
  * matches.
  *
  * Return values are:
@@ -621,11 +483,13 @@ X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x
  *  0 certificate not found.
  * -1 some other error.
  */
+
+
 int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
-        {
+{
         X509_NAME *xn;
         X509_OBJECT obj, *pobj;
-        int i, ok, idx, ret;
+        int i, ok, idx;
         xn=X509_get_issuer_name(x);
         ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
         if (ok != X509_LU_X509)
@@ -651,34 +515,27 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
                 return 1;
                 }
         X509_OBJECT_free_contents(&obj);
-
-        /* Else find index of first cert accepted by 'check_issued' */
-        ret = 0;
-        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
+        /* Else find index of first matching cert */
         idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
-        if (idx != -1) /* should be true as we've had at least one match */
+        /* This shouldn't normally happen since we already have one match */
+        if (idx == -1) return 0;
+
+        /* Look through all matching certificates for a suitable issuer */
+        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
                 {
-                /* Look through all matching certs for suitable issuer */
-                for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
+                pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
+                /* See if we've ran out of matches */
+                if (pobj->type != X509_LU_X509) return 0;
+                if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0;
+                if (ctx->check_issued(ctx, x, pobj->data.x509))
                         {
-                        pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
-                        /* See if we've run past the matches */
-                        if (pobj->type != X509_LU_X509)
-                                break;
-                        if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
-                                break;
-                        if (ctx->check_issued(ctx, x, pobj->data.x509))
-                                {
-                                *issuer = pobj->data.x509;
-                                X509_OBJECT_up_ref_count(pobj);
-                                ret = 1;
-                                break;
-                                }
+                        *issuer = pobj->data.x509;
+                        X509_OBJECT_up_ref_count(pobj);
+                        return 1;
                         }
                 }
-        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
-        return ret;
-        }
+        return 0;
+}
 
 int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
         {
@@ -706,11 +563,5 @@ int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
         return X509_VERIFY_PARAM_set1(ctx->param, param);
         }
 
-void X509_STORE_set_verify_cb(X509_STORE *ctx,
-                                  int (*verify_cb)(int, X509_STORE_CTX *))
-        {
-        ctx->verify_cb = verify_cb;
-        }
-
 IMPLEMENT_STACK_OF(X509_LOOKUP)
 IMPLEMENT_STACK_OF(X509_OBJECT)