diff options
Diffstat (limited to 'src/lib/libcrypto/x509/x509_vfy.c')
-rw-r--r-- | src/lib/libcrypto/x509/x509_vfy.c | 48 |
1 files changed, 19 insertions, 29 deletions
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c index 9dba97bbf8..b81387a237 100644 --- a/src/lib/libcrypto/x509/x509_vfy.c +++ b/src/lib/libcrypto/x509/x509_vfy.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: x509_vfy.c,v 1.59 2017/01/21 01:09:54 beck Exp $ */ | 1 | /* $OpenBSD: x509_vfy.c,v 1.60 2017/01/29 17:49:23 beck Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. | 3 | * All rights reserved. |
4 | * | 4 | * |
@@ -228,8 +228,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
228 | STACK_OF(X509) *sktmp = NULL; | 228 | STACK_OF(X509) *sktmp = NULL; |
229 | 229 | ||
230 | if (ctx->cert == NULL) { | 230 | if (ctx->cert == NULL) { |
231 | X509err(X509_F_X509_VERIFY_CERT, | 231 | X509error(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); |
232 | X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); | ||
233 | ctx->error = X509_V_ERR_INVALID_CALL; | 232 | ctx->error = X509_V_ERR_INVALID_CALL; |
234 | return -1; | 233 | return -1; |
235 | } | 234 | } |
@@ -238,8 +237,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
238 | * This X509_STORE_CTX has already been used to verify | 237 | * This X509_STORE_CTX has already been used to verify |
239 | * a cert. We cannot do another one. | 238 | * a cert. We cannot do another one. |
240 | */ | 239 | */ |
241 | X509err(X509_F_X509_VERIFY_CERT, | 240 | X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
242 | ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
243 | ctx->error = X509_V_ERR_INVALID_CALL; | 241 | ctx->error = X509_V_ERR_INVALID_CALL; |
244 | return -1; | 242 | return -1; |
245 | } | 243 | } |
@@ -247,8 +245,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
247 | /* | 245 | /* |
248 | * This X509_STORE_CTX has not been properly initialized. | 246 | * This X509_STORE_CTX has not been properly initialized. |
249 | */ | 247 | */ |
250 | X509err(X509_F_X509_VERIFY_CERT, | 248 | X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
251 | ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
252 | ctx->error = X509_V_ERR_INVALID_CALL; | 249 | ctx->error = X509_V_ERR_INVALID_CALL; |
253 | return -1; | 250 | return -1; |
254 | } | 251 | } |
@@ -262,7 +259,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
262 | */ | 259 | */ |
263 | ctx->chain = sk_X509_new_null(); | 260 | ctx->chain = sk_X509_new_null(); |
264 | if (ctx->chain == NULL || !sk_X509_push(ctx->chain, ctx->cert)) { | 261 | if (ctx->chain == NULL || !sk_X509_push(ctx->chain, ctx->cert)) { |
265 | X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); | 262 | X509error(ERR_R_MALLOC_FAILURE); |
266 | ctx->error = X509_V_ERR_OUT_OF_MEM; | 263 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
267 | goto end; | 264 | goto end; |
268 | } | 265 | } |
@@ -272,7 +269,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
272 | /* We use a temporary STACK so we can chop and hack at it */ | 269 | /* We use a temporary STACK so we can chop and hack at it */ |
273 | if (ctx->untrusted != NULL && | 270 | if (ctx->untrusted != NULL && |
274 | (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { | 271 | (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { |
275 | X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); | 272 | X509error(ERR_R_MALLOC_FAILURE); |
276 | ctx->error = X509_V_ERR_OUT_OF_MEM; | 273 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
277 | goto end; | 274 | goto end; |
278 | } | 275 | } |
@@ -316,8 +313,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
316 | xtmp = find_issuer(ctx, sktmp, x); | 313 | xtmp = find_issuer(ctx, sktmp, x); |
317 | if (xtmp != NULL) { | 314 | if (xtmp != NULL) { |
318 | if (!sk_X509_push(ctx->chain, xtmp)) { | 315 | if (!sk_X509_push(ctx->chain, xtmp)) { |
319 | X509err(X509_F_X509_VERIFY_CERT, | 316 | X509error(ERR_R_MALLOC_FAILURE); |
320 | ERR_R_MALLOC_FAILURE); | ||
321 | ctx->error = X509_V_ERR_OUT_OF_MEM; | 317 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
322 | ok = 0; | 318 | ok = 0; |
323 | goto end; | 319 | goto end; |
@@ -415,8 +411,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
415 | x = xtmp; | 411 | x = xtmp; |
416 | if (!sk_X509_push(ctx->chain, x)) { | 412 | if (!sk_X509_push(ctx->chain, x)) { |
417 | X509_free(xtmp); | 413 | X509_free(xtmp); |
418 | X509err(X509_F_X509_VERIFY_CERT, | 414 | X509error(ERR_R_MALLOC_FAILURE); |
419 | ERR_R_MALLOC_FAILURE); | ||
420 | ctx->error = X509_V_ERR_OUT_OF_MEM; | 415 | ctx->error = X509_V_ERR_OUT_OF_MEM; |
421 | ok = 0; | 416 | ok = 0; |
422 | goto end; | 417 | goto end; |
@@ -488,7 +483,7 @@ X509_verify_cert(X509_STORE_CTX *ctx) | |||
488 | } else { | 483 | } else { |
489 | if (!sk_X509_push(ctx->chain, chain_ss)) { | 484 | if (!sk_X509_push(ctx->chain, chain_ss)) { |
490 | X509_free(chain_ss); | 485 | X509_free(chain_ss); |
491 | X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); | 486 | X509error(ERR_R_MALLOC_FAILURE); |
492 | return 0; | 487 | return 0; |
493 | } | 488 | } |
494 | num++; | 489 | num++; |
@@ -1669,7 +1664,7 @@ check_policy(X509_STORE_CTX *ctx) | |||
1669 | ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, | 1664 | ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, |
1670 | ctx->param->policies, ctx->param->flags); | 1665 | ctx->param->policies, ctx->param->flags); |
1671 | if (ret == 0) { | 1666 | if (ret == 0) { |
1672 | X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); | 1667 | X509error(ERR_R_MALLOC_FAILURE); |
1673 | return 0; | 1668 | return 0; |
1674 | } | 1669 | } |
1675 | /* Invalid or inconsistent extensions */ | 1670 | /* Invalid or inconsistent extensions */ |
@@ -1941,8 +1936,7 @@ X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) | |||
1941 | for (i = 0; i < sk_X509_num(chain); i++) { | 1936 | for (i = 0; i < sk_X509_num(chain); i++) { |
1942 | ktmp = X509_get_pubkey(sk_X509_value(chain, i)); | 1937 | ktmp = X509_get_pubkey(sk_X509_value(chain, i)); |
1943 | if (ktmp == NULL) { | 1938 | if (ktmp == NULL) { |
1944 | X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, | 1939 | X509error(X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY); |
1945 | X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY); | ||
1946 | return 0; | 1940 | return 0; |
1947 | } | 1941 | } |
1948 | if (!EVP_PKEY_missing_parameters(ktmp)) | 1942 | if (!EVP_PKEY_missing_parameters(ktmp)) |
@@ -1953,8 +1947,7 @@ X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) | |||
1953 | } | 1947 | } |
1954 | } | 1948 | } |
1955 | if (ktmp == NULL) { | 1949 | if (ktmp == NULL) { |
1956 | X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, | 1950 | X509error(X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN); |
1957 | X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN); | ||
1958 | return 0; | 1951 | return 0; |
1959 | } | 1952 | } |
1960 | 1953 | ||
@@ -2109,16 +2102,14 @@ X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, | |||
2109 | X509_PURPOSE *ptmp; | 2102 | X509_PURPOSE *ptmp; |
2110 | idx = X509_PURPOSE_get_by_id(purpose); | 2103 | idx = X509_PURPOSE_get_by_id(purpose); |
2111 | if (idx == -1) { | 2104 | if (idx == -1) { |
2112 | X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, | 2105 | X509error(X509_R_UNKNOWN_PURPOSE_ID); |
2113 | X509_R_UNKNOWN_PURPOSE_ID); | ||
2114 | return 0; | 2106 | return 0; |
2115 | } | 2107 | } |
2116 | ptmp = X509_PURPOSE_get0(idx); | 2108 | ptmp = X509_PURPOSE_get0(idx); |
2117 | if (ptmp->trust == X509_TRUST_DEFAULT) { | 2109 | if (ptmp->trust == X509_TRUST_DEFAULT) { |
2118 | idx = X509_PURPOSE_get_by_id(def_purpose); | 2110 | idx = X509_PURPOSE_get_by_id(def_purpose); |
2119 | if (idx == -1) { | 2111 | if (idx == -1) { |
2120 | X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, | 2112 | X509error(X509_R_UNKNOWN_PURPOSE_ID); |
2121 | X509_R_UNKNOWN_PURPOSE_ID); | ||
2122 | return 0; | 2113 | return 0; |
2123 | } | 2114 | } |
2124 | ptmp = X509_PURPOSE_get0(idx); | 2115 | ptmp = X509_PURPOSE_get0(idx); |
@@ -2130,8 +2121,7 @@ X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, | |||
2130 | if (trust) { | 2121 | if (trust) { |
2131 | idx = X509_TRUST_get_by_id(trust); | 2122 | idx = X509_TRUST_get_by_id(trust); |
2132 | if (idx == -1) { | 2123 | if (idx == -1) { |
2133 | X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, | 2124 | X509error(X509_R_UNKNOWN_TRUST_ID); |
2134 | X509_R_UNKNOWN_TRUST_ID); | ||
2135 | return 0; | 2125 | return 0; |
2136 | } | 2126 | } |
2137 | } | 2127 | } |
@@ -2150,7 +2140,7 @@ X509_STORE_CTX_new(void) | |||
2150 | 2140 | ||
2151 | ctx = calloc(1, sizeof(X509_STORE_CTX)); | 2141 | ctx = calloc(1, sizeof(X509_STORE_CTX)); |
2152 | if (!ctx) { | 2142 | if (!ctx) { |
2153 | X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE); | 2143 | X509error(ERR_R_MALLOC_FAILURE); |
2154 | return NULL; | 2144 | return NULL; |
2155 | } | 2145 | } |
2156 | return ctx; | 2146 | return ctx; |
@@ -2258,7 +2248,7 @@ X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, | |||
2258 | 2248 | ||
2259 | ctx->param = X509_VERIFY_PARAM_new(); | 2249 | ctx->param = X509_VERIFY_PARAM_new(); |
2260 | if (!ctx->param) { | 2250 | if (!ctx->param) { |
2261 | X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); | 2251 | X509error(ERR_R_MALLOC_FAILURE); |
2262 | return 0; | 2252 | return 0; |
2263 | } | 2253 | } |
2264 | 2254 | ||
@@ -2275,13 +2265,13 @@ X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, | |||
2275 | X509_VERIFY_PARAM_lookup("default")); | 2265 | X509_VERIFY_PARAM_lookup("default")); |
2276 | 2266 | ||
2277 | if (param_ret == 0) { | 2267 | if (param_ret == 0) { |
2278 | X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); | 2268 | X509error(ERR_R_MALLOC_FAILURE); |
2279 | return 0; | 2269 | return 0; |
2280 | } | 2270 | } |
2281 | 2271 | ||
2282 | if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, | 2272 | if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, |
2283 | &(ctx->ex_data)) == 0) { | 2273 | &(ctx->ex_data)) == 0) { |
2284 | X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); | 2274 | X509error(ERR_R_MALLOC_FAILURE); |
2285 | return 0; | 2275 | return 0; |
2286 | } | 2276 | } |
2287 | return 1; | 2277 | return 1; |