summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/x509
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/x509')
-rw-r--r--src/lib/libcrypto/x509/by_dir.c428
-rw-r--r--src/lib/libcrypto/x509/by_file.c283
-rw-r--r--src/lib/libcrypto/x509/by_mem.c138
-rw-r--r--src/lib/libcrypto/x509/x509.h1272
-rw-r--r--src/lib/libcrypto/x509/x509_att.c403
-rw-r--r--src/lib/libcrypto/x509/x509_cmp.c369
-rw-r--r--src/lib/libcrypto/x509/x509_d2.c128
-rw-r--r--src/lib/libcrypto/x509/x509_def.c98
-rw-r--r--src/lib/libcrypto/x509/x509_err.c164
-rw-r--r--src/lib/libcrypto/x509/x509_ext.c232
-rw-r--r--src/lib/libcrypto/x509/x509_lcl.h59
-rw-r--r--src/lib/libcrypto/x509/x509_lu.c735
-rw-r--r--src/lib/libcrypto/x509/x509_obj.c179
-rw-r--r--src/lib/libcrypto/x509/x509_r2x.c115
-rw-r--r--src/lib/libcrypto/x509/x509_req.c345
-rw-r--r--src/lib/libcrypto/x509/x509_set.c154
-rw-r--r--src/lib/libcrypto/x509/x509_trs.c332
-rw-r--r--src/lib/libcrypto/x509/x509_txt.c189
-rw-r--r--src/lib/libcrypto/x509/x509_v3.c300
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.c2194
-rw-r--r--src/lib/libcrypto/x509/x509_vfy.h559
-rw-r--r--src/lib/libcrypto/x509/x509_vpm.c449
-rw-r--r--src/lib/libcrypto/x509/x509cset.c173
-rw-r--r--src/lib/libcrypto/x509/x509name.c410
-rw-r--r--src/lib/libcrypto/x509/x509rset.c88
-rw-r--r--src/lib/libcrypto/x509/x509spki.c132
-rw-r--r--src/lib/libcrypto/x509/x509type.c130
-rw-r--r--src/lib/libcrypto/x509/x_all.c609
28 files changed, 0 insertions, 10667 deletions
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
deleted file mode 100644
index 032210424d..0000000000
--- a/src/lib/libcrypto/x509/by_dir.c
+++ /dev/null
@@ -1,428 +0,0 @@
1/* $OpenBSD: by_dir.c,v 1.36 2015/02/12 03:54:07 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <sys/types.h>
60
61#include <errno.h>
62#include <stdio.h>
63#include <string.h>
64#include <time.h>
65#include <unistd.h>
66
67#include <openssl/opensslconf.h>
68
69#include <openssl/err.h>
70#include <openssl/lhash.h>
71#include <openssl/x509.h>
72
73# include <sys/stat.h>
74
75typedef struct lookup_dir_hashes_st {
76 unsigned long hash;
77 int suffix;
78} BY_DIR_HASH;
79
80typedef struct lookup_dir_entry_st {
81 char *dir;
82 int dir_type;
83 STACK_OF(BY_DIR_HASH) *hashes;
84} BY_DIR_ENTRY;
85
86typedef struct lookup_dir_st {
87 BUF_MEM *buffer;
88 STACK_OF(BY_DIR_ENTRY) *dirs;
89} BY_DIR;
90
91DECLARE_STACK_OF(BY_DIR_HASH)
92DECLARE_STACK_OF(BY_DIR_ENTRY)
93
94static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
95 char **ret);
96static int new_dir(X509_LOOKUP *lu);
97static void free_dir(X509_LOOKUP *lu);
98static int add_cert_dir(BY_DIR *ctx, const char *dir, int type);
99static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
100 X509_OBJECT *ret);
101
102static X509_LOOKUP_METHOD x509_dir_lookup = {
103 .name = "Load certs from files in a directory",
104 .new_item = new_dir,
105 .free = free_dir,
106 .init = NULL,
107 .shutdown = NULL,
108 .ctrl = dir_ctrl,
109 .get_by_subject = get_cert_by_subject,
110 .get_by_issuer_serial = NULL,
111 .get_by_fingerprint = NULL,
112 .get_by_alias = NULL,
113};
114
115X509_LOOKUP_METHOD *
116X509_LOOKUP_hash_dir(void)
117{
118 return (&x509_dir_lookup);
119}
120
121static int
122dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
123 char **retp)
124{
125 int ret = 0;
126 BY_DIR *ld;
127 char *dir = NULL;
128
129 ld = (BY_DIR *)ctx->method_data;
130
131 switch (cmd) {
132 case X509_L_ADD_DIR:
133 if (argl == X509_FILETYPE_DEFAULT) {
134 if (issetugid() == 0)
135 dir = getenv(X509_get_default_cert_dir_env());
136 if (dir)
137 ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
138 else
139 ret = add_cert_dir(ld, X509_get_default_cert_dir(),
140 X509_FILETYPE_PEM);
141 if (!ret) {
142 X509err(X509_F_DIR_CTRL, X509_R_LOADING_CERT_DIR);
143 }
144 } else
145 ret = add_cert_dir(ld, argp, (int)argl);
146 break;
147 }
148 return (ret);
149}
150
151static int
152new_dir(X509_LOOKUP *lu)
153{
154 BY_DIR *a;
155
156 if ((a = malloc(sizeof(BY_DIR))) == NULL)
157 return (0);
158 if ((a->buffer = BUF_MEM_new()) == NULL) {
159 free(a);
160 return (0);
161 }
162 a->dirs = NULL;
163 lu->method_data = (char *)a;
164 return (1);
165}
166
167static void
168by_dir_hash_free(BY_DIR_HASH *hash)
169{
170 free(hash);
171}
172
173static int
174by_dir_hash_cmp(const BY_DIR_HASH * const *a,
175 const BY_DIR_HASH * const *b)
176{
177 if ((*a)->hash > (*b)->hash)
178 return 1;
179 if ((*a)->hash < (*b)->hash)
180 return -1;
181 return 0;
182}
183
184static void
185by_dir_entry_free(BY_DIR_ENTRY *ent)
186{
187 free(ent->dir);
188 if (ent->hashes)
189 sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
190 free(ent);
191}
192
193static void
194free_dir(X509_LOOKUP *lu)
195{
196 BY_DIR *a;
197
198 a = (BY_DIR *)lu->method_data;
199 if (a->dirs != NULL)
200 sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
201 if (a->buffer != NULL)
202 BUF_MEM_free(a->buffer);
203 free(a);
204}
205
206static int
207add_cert_dir(BY_DIR *ctx, const char *dir, int type)
208{
209 int j;
210 const char *s, *ss, *p;
211 ptrdiff_t len;
212
213 if (dir == NULL || !*dir) {
214 X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY);
215 return 0;
216 }
217
218 s = dir;
219 p = s;
220 do {
221 if ((*p == ':') || (*p == '\0')) {
222 BY_DIR_ENTRY *ent;
223 ss = s;
224 s = p + 1;
225 len = p - ss;
226 if (len == 0)
227 continue;
228 for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
229 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
230 if (strlen(ent->dir) == (size_t)len &&
231 strncmp(ent->dir, ss, (size_t)len) == 0)
232 break;
233 }
234 if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
235 continue;
236 if (ctx->dirs == NULL) {
237 ctx->dirs = sk_BY_DIR_ENTRY_new_null();
238 if (!ctx->dirs) {
239 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
240 return 0;
241 }
242 }
243 ent = malloc(sizeof(BY_DIR_ENTRY));
244 if (!ent) {
245 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
246 return 0;
247 }
248 ent->dir_type = type;
249 ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
250 ent->dir = strndup(ss, (size_t)len);
251 if (!ent->dir || !ent->hashes) {
252 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
253 by_dir_entry_free(ent);
254 return 0;
255 }
256 if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
257 X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
258 by_dir_entry_free(ent);
259 return 0;
260 }
261 }
262 } while (*p++ != '\0');
263 return 1;
264}
265
266static int
267get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
268 X509_OBJECT *ret)
269{
270 BY_DIR *ctx;
271 union {
272 struct {
273 X509 st_x509;
274 X509_CINF st_x509_cinf;
275 } x509;
276 struct {
277 X509_CRL st_crl;
278 X509_CRL_INFO st_crl_info;
279 } crl;
280 } data;
281 int ok = 0;
282 int i, j, k;
283 unsigned long h;
284 BUF_MEM *b = NULL;
285 X509_OBJECT stmp, *tmp;
286 const char *postfix="";
287
288 if (name == NULL)
289 return (0);
290
291 stmp.type = type;
292 if (type == X509_LU_X509) {
293 data.x509.st_x509.cert_info = &data.x509.st_x509_cinf;
294 data.x509.st_x509_cinf.subject = name;
295 stmp.data.x509 = &data.x509.st_x509;
296 postfix="";
297 } else if (type == X509_LU_CRL) {
298 data.crl.st_crl.crl = &data.crl.st_crl_info;
299 data.crl.st_crl_info.issuer = name;
300 stmp.data.crl = &data.crl.st_crl;
301 postfix="r";
302 } else {
303 X509err(X509_F_GET_CERT_BY_SUBJECT, X509_R_WRONG_LOOKUP_TYPE);
304 goto finish;
305 }
306
307 if ((b = BUF_MEM_new()) == NULL) {
308 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_BUF_LIB);
309 goto finish;
310 }
311
312 ctx = (BY_DIR *)xl->method_data;
313
314 h = X509_NAME_hash(name);
315 for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
316 BY_DIR_ENTRY *ent;
317 int idx;
318 BY_DIR_HASH htmp, *hent;
319 ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
320 j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
321 if (!BUF_MEM_grow(b, j)) {
322 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
323 goto finish;
324 }
325 if (type == X509_LU_CRL && ent->hashes) {
326 htmp.hash = h;
327 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
328 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
329 if (idx >= 0) {
330 hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
331 k = hent->suffix;
332 } else {
333 hent = NULL;
334 k = 0;
335 }
336 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
337 } else {
338 k = 0;
339 hent = NULL;
340 }
341 for (;;) {
342 (void) snprintf(b->data, b->max, "%s/%08lx.%s%d",
343 ent->dir, h, postfix, k);
344
345 {
346 struct stat st;
347 if (stat(b->data, &st) < 0)
348 break;
349 }
350 /* found one. */
351 if (type == X509_LU_X509) {
352 if ((X509_load_cert_file(xl, b->data,
353 ent->dir_type)) == 0)
354 break;
355 } else if (type == X509_LU_CRL) {
356 if ((X509_load_crl_file(xl, b->data,
357 ent->dir_type)) == 0)
358 break;
359 }
360 /* else case will caught higher up */
361 k++;
362 }
363
364 /* we have added it to the cache so now pull it out again */
365 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
366 j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
367 if (j != -1)
368 tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
369 else
370 tmp = NULL;
371 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
372
373 /* If a CRL, update the last file suffix added for this */
374 if (type == X509_LU_CRL) {
375 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
376 /*
377 * Look for entry again in case another thread added
378 * an entry first.
379 */
380 if (!hent) {
381 htmp.hash = h;
382 idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
383 if (idx >= 0)
384 hent = sk_BY_DIR_HASH_value(
385 ent->hashes, idx);
386 }
387 if (!hent) {
388 hent = malloc(sizeof(BY_DIR_HASH));
389 if (!hent) {
390 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
391 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
392 ok = 0;
393 goto finish;
394 }
395 hent->hash = h;
396 hent->suffix = k;
397 if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
398 X509err(X509_F_GET_CERT_BY_SUBJECT, ERR_R_MALLOC_FAILURE);
399 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
400 free(hent);
401 ok = 0;
402 goto finish;
403 }
404 } else if (hent->suffix < k)
405 hent->suffix = k;
406
407 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
408
409 }
410
411 if (tmp != NULL) {
412 ok = 1;
413 ret->type = tmp->type;
414 memcpy(&ret->data, &tmp->data, sizeof(ret->data));
415 /*
416 * If we were going to up the reference count,
417 * we would need to do it on a perl 'type' basis
418 */
419 /* CRYPTO_add(&tmp->data.x509->references,1,
420 CRYPTO_LOCK_X509);*/
421 goto finish;
422 }
423 }
424finish:
425 if (b != NULL)
426 BUF_MEM_free(b);
427 return (ok);
428}
diff --git a/src/lib/libcrypto/x509/by_file.c b/src/lib/libcrypto/x509/by_file.c
deleted file mode 100644
index 91a8e781b2..0000000000
--- a/src/lib/libcrypto/x509/by_file.c
+++ /dev/null
@@ -1,283 +0,0 @@
1/* $OpenBSD: by_file.c,v 1.18 2015/02/05 01:33:22 reyk Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <time.h>
62#include <unistd.h>
63
64#include <openssl/buffer.h>
65#include <openssl/err.h>
66#include <openssl/pem.h>
67#include <openssl/lhash.h>
68#include <openssl/x509.h>
69
70static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
71 long argl, char **ret);
72
73static X509_LOOKUP_METHOD x509_file_lookup = {
74 .name = "Load file into cache",
75 .new_item = NULL,
76 .free = NULL,
77 .init = NULL,
78 .shutdown = NULL,
79 .ctrl = by_file_ctrl,
80 .get_by_subject = NULL,
81 .get_by_issuer_serial = NULL,
82 .get_by_fingerprint = NULL,
83 .get_by_alias = NULL,
84};
85
86X509_LOOKUP_METHOD *
87X509_LOOKUP_file(void)
88{
89 return (&x509_file_lookup);
90}
91
92static int
93by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
94 char **ret)
95{
96 int ok = 0;
97 char *file = NULL;
98
99 switch (cmd) {
100 case X509_L_FILE_LOAD:
101 if (argl == X509_FILETYPE_DEFAULT) {
102 if (issetugid() == 0)
103 file = getenv(X509_get_default_cert_file_env());
104 if (file)
105 ok = (X509_load_cert_crl_file(ctx, file,
106 X509_FILETYPE_PEM) != 0);
107 else
108 ok = (X509_load_cert_crl_file(ctx,
109 X509_get_default_cert_file(),
110 X509_FILETYPE_PEM) != 0);
111
112 if (!ok) {
113 X509err(X509_F_BY_FILE_CTRL,
114 X509_R_LOADING_DEFAULTS);
115 }
116 } else {
117 if (argl == X509_FILETYPE_PEM)
118 ok = (X509_load_cert_crl_file(ctx, argp,
119 X509_FILETYPE_PEM) != 0);
120 else
121 ok = (X509_load_cert_file(ctx,
122 argp, (int)argl) != 0);
123 }
124 break;
125 }
126 return (ok);
127}
128
129int
130X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
131{
132 int ret = 0;
133 BIO *in = NULL;
134 int i, count = 0;
135 X509 *x = NULL;
136
137 if (file == NULL)
138 return (1);
139 in = BIO_new(BIO_s_file_internal());
140
141 if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
142 X509err(X509_F_X509_LOAD_CERT_FILE, ERR_R_SYS_LIB);
143 goto err;
144 }
145
146 if (type == X509_FILETYPE_PEM) {
147 for (;;) {
148 x = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
149 if (x == NULL) {
150 if ((ERR_GET_REASON(ERR_peek_last_error()) ==
151 PEM_R_NO_START_LINE) && (count > 0)) {
152 ERR_clear_error();
153 break;
154 } else {
155 X509err(X509_F_X509_LOAD_CERT_FILE,
156 ERR_R_PEM_LIB);
157 goto err;
158 }
159 }
160 i = X509_STORE_add_cert(ctx->store_ctx, x);
161 if (!i)
162 goto err;
163 count++;
164 X509_free(x);
165 x = NULL;
166 }
167 ret = count;
168 } else if (type == X509_FILETYPE_ASN1) {
169 x = d2i_X509_bio(in, NULL);
170 if (x == NULL) {
171 X509err(X509_F_X509_LOAD_CERT_FILE, ERR_R_ASN1_LIB);
172 goto err;
173 }
174 i = X509_STORE_add_cert(ctx->store_ctx, x);
175 if (!i)
176 goto err;
177 ret = i;
178 } else {
179 X509err(X509_F_X509_LOAD_CERT_FILE, X509_R_BAD_X509_FILETYPE);
180 goto err;
181 }
182err:
183 if (x != NULL)
184 X509_free(x);
185 BIO_free(in);
186 return (ret);
187}
188
189int
190X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type)
191{
192 int ret = 0;
193 BIO *in = NULL;
194 int i, count = 0;
195 X509_CRL *x = NULL;
196
197 if (file == NULL)
198 return (1);
199 in = BIO_new(BIO_s_file_internal());
200
201 if ((in == NULL) || (BIO_read_filename(in, file) <= 0)) {
202 X509err(X509_F_X509_LOAD_CRL_FILE, ERR_R_SYS_LIB);
203 goto err;
204 }
205
206 if (type == X509_FILETYPE_PEM) {
207 for (;;) {
208 x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
209 if (x == NULL) {
210 if ((ERR_GET_REASON(ERR_peek_last_error()) ==
211 PEM_R_NO_START_LINE) && (count > 0)) {
212 ERR_clear_error();
213 break;
214 } else {
215 X509err(X509_F_X509_LOAD_CRL_FILE,
216 ERR_R_PEM_LIB);
217 goto err;
218 }
219 }
220 i = X509_STORE_add_crl(ctx->store_ctx, x);
221 if (!i)
222 goto err;
223 count++;
224 X509_CRL_free(x);
225 x = NULL;
226 }
227 ret = count;
228 } else if (type == X509_FILETYPE_ASN1) {
229 x = d2i_X509_CRL_bio(in, NULL);
230 if (x == NULL) {
231 X509err(X509_F_X509_LOAD_CRL_FILE, ERR_R_ASN1_LIB);
232 goto err;
233 }
234 i = X509_STORE_add_crl(ctx->store_ctx, x);
235 if (!i)
236 goto err;
237 ret = i;
238 } else {
239 X509err(X509_F_X509_LOAD_CRL_FILE, X509_R_BAD_X509_FILETYPE);
240 goto err;
241 }
242err:
243 if (x != NULL)
244 X509_CRL_free(x);
245 BIO_free(in);
246 return (ret);
247}
248
249int
250X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
251{
252 STACK_OF(X509_INFO) *inf;
253 X509_INFO *itmp;
254 BIO *in;
255 int i, count = 0;
256 if (type != X509_FILETYPE_PEM)
257 return X509_load_cert_file(ctx, file, type);
258 in = BIO_new_file(file, "r");
259 if (!in) {
260 X509err(X509_F_X509_LOAD_CERT_CRL_FILE, ERR_R_SYS_LIB);
261 return 0;
262 }
263 inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
264 BIO_free(in);
265 if (!inf) {
266 X509err(X509_F_X509_LOAD_CERT_CRL_FILE, ERR_R_PEM_LIB);
267 return 0;
268 }
269 for (i = 0; i < sk_X509_INFO_num(inf); i++) {
270 itmp = sk_X509_INFO_value(inf, i);
271 if (itmp->x509) {
272 X509_STORE_add_cert(ctx->store_ctx, itmp->x509);
273 count++;
274 }
275 if (itmp->crl) {
276 X509_STORE_add_crl(ctx->store_ctx, itmp->crl);
277 count++;
278 }
279 }
280 sk_X509_INFO_pop_free(inf, X509_INFO_free);
281 return count;
282}
283
diff --git a/src/lib/libcrypto/x509/by_mem.c b/src/lib/libcrypto/x509/by_mem.c
deleted file mode 100644
index ecab813406..0000000000
--- a/src/lib/libcrypto/x509/by_mem.c
+++ /dev/null
@@ -1,138 +0,0 @@
1/* $OpenBSD: by_mem.c,v 1.3 2015/02/05 01:33:22 reyk Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <sys/uio.h>
60#include <errno.h>
61#include <stdio.h>
62#include <time.h>
63#include <unistd.h>
64
65#include <openssl/buffer.h>
66#include <openssl/err.h>
67#include <openssl/pem.h>
68#include <openssl/lhash.h>
69#include <openssl/x509.h>
70
71static int by_mem_ctrl(X509_LOOKUP *, int, const char *, long, char **);
72
73static X509_LOOKUP_METHOD x509_mem_lookup = {
74 .name = "Load cert from memory",
75 .new_item = NULL,
76 .free = NULL,
77 .init = NULL,
78 .shutdown = NULL,
79 .ctrl = by_mem_ctrl,
80 .get_by_subject = NULL,
81 .get_by_issuer_serial = NULL,
82 .get_by_fingerprint = NULL,
83 .get_by_alias = NULL,
84};
85
86X509_LOOKUP_METHOD *
87X509_LOOKUP_mem(void)
88{
89 return (&x509_mem_lookup);
90}
91
92static int
93by_mem_ctrl(X509_LOOKUP *lu, int cmd, const char *buf,
94 long type, char **ret)
95{
96 STACK_OF(X509_INFO) *inf = NULL;
97 const struct iovec *iov;
98 X509_INFO *itmp;
99 BIO *in = NULL;
100 int i, count = 0, ok = 0;
101
102 iov = (const struct iovec *)buf;
103
104 if (!(cmd == X509_L_MEM && type == X509_FILETYPE_PEM))
105 goto done;
106
107 if ((in = BIO_new_mem_buf(iov->iov_base, iov->iov_len)) == NULL)
108 goto done;
109
110 if ((inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL)) == NULL)
111 goto done;
112
113 for (i = 0; i < sk_X509_INFO_num(inf); i++) {
114 itmp = sk_X509_INFO_value(inf, i);
115 if (itmp->x509) {
116 ok = X509_STORE_add_cert(lu->store_ctx, itmp->x509);
117 if (!ok)
118 goto done;
119 count++;
120 }
121 if (itmp->crl) {
122 ok = X509_STORE_add_crl(lu->store_ctx, itmp->crl);
123 if (!ok)
124 goto done;
125 count++;
126 }
127 }
128
129 ok = count != 0;
130 done:
131 if (count == 0)
132 X509err(X509_F_X509_LOAD_CERT_CRL_FILE,ERR_R_PEM_LIB);
133 if (inf != NULL)
134 sk_X509_INFO_pop_free(inf, X509_INFO_free);
135 if (in != NULL)
136 BIO_free(in);
137 return (ok);
138}
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
deleted file mode 100644
index ec6668d35e..0000000000
--- a/src/lib/libcrypto/x509/x509.h
+++ /dev/null
@@ -1,1272 +0,0 @@
1/* $OpenBSD: x509.h,v 1.22 2015/02/11 02:17:59 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58/* ====================================================================
59 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60 * ECDH support in OpenSSL originally developed by
61 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
62 */
63
64#ifndef HEADER_X509_H
65#define HEADER_X509_H
66
67#include <openssl/opensslconf.h>
68
69#ifndef OPENSSL_NO_BUFFER
70#include <openssl/buffer.h>
71#endif
72#ifndef OPENSSL_NO_EVP
73#include <openssl/evp.h>
74#endif
75#ifndef OPENSSL_NO_BIO
76#include <openssl/bio.h>
77#endif
78#include <openssl/stack.h>
79#include <openssl/asn1.h>
80#include <openssl/safestack.h>
81
82#ifndef OPENSSL_NO_EC
83#include <openssl/ec.h>
84#endif
85
86#ifndef OPENSSL_NO_ECDSA
87#include <openssl/ecdsa.h>
88#endif
89
90#ifndef OPENSSL_NO_ECDH
91#include <openssl/ecdh.h>
92#endif
93
94#ifndef OPENSSL_NO_DEPRECATED
95#ifndef OPENSSL_NO_RSA
96#include <openssl/rsa.h>
97#endif
98#ifndef OPENSSL_NO_DSA
99#include <openssl/dsa.h>
100#endif
101#ifndef OPENSSL_NO_DH
102#include <openssl/dh.h>
103#endif
104#endif
105
106#ifndef OPENSSL_NO_SHA
107#include <openssl/sha.h>
108#endif
109#include <openssl/ossl_typ.h>
110
111#ifdef __cplusplus
112extern "C" {
113#endif
114
115#define X509_FILETYPE_PEM 1
116#define X509_FILETYPE_ASN1 2
117#define X509_FILETYPE_DEFAULT 3
118
119#define X509v3_KU_DIGITAL_SIGNATURE 0x0080
120#define X509v3_KU_NON_REPUDIATION 0x0040
121#define X509v3_KU_KEY_ENCIPHERMENT 0x0020
122#define X509v3_KU_DATA_ENCIPHERMENT 0x0010
123#define X509v3_KU_KEY_AGREEMENT 0x0008
124#define X509v3_KU_KEY_CERT_SIGN 0x0004
125#define X509v3_KU_CRL_SIGN 0x0002
126#define X509v3_KU_ENCIPHER_ONLY 0x0001
127#define X509v3_KU_DECIPHER_ONLY 0x8000
128#define X509v3_KU_UNDEF 0xffff
129
130typedef struct X509_objects_st
131 {
132 int nid;
133 int (*a2i)(void);
134 int (*i2a)(void);
135 } X509_OBJECTS;
136
137struct X509_algor_st
138 {
139 ASN1_OBJECT *algorithm;
140 ASN1_TYPE *parameter;
141 } /* X509_ALGOR */;
142
143DECLARE_ASN1_SET_OF(X509_ALGOR)
144
145typedef STACK_OF(X509_ALGOR) X509_ALGORS;
146
147typedef struct X509_val_st
148 {
149 ASN1_TIME *notBefore;
150 ASN1_TIME *notAfter;
151 } X509_VAL;
152
153struct X509_pubkey_st
154 {
155 X509_ALGOR *algor;
156 ASN1_BIT_STRING *public_key;
157 EVP_PKEY *pkey;
158 };
159
160typedef struct X509_sig_st
161 {
162 X509_ALGOR *algor;
163 ASN1_OCTET_STRING *digest;
164 } X509_SIG;
165
166typedef struct X509_name_entry_st
167 {
168 ASN1_OBJECT *object;
169 ASN1_STRING *value;
170 int set;
171 int size; /* temp variable */
172 } X509_NAME_ENTRY;
173
174DECLARE_STACK_OF(X509_NAME_ENTRY)
175DECLARE_ASN1_SET_OF(X509_NAME_ENTRY)
176
177/* we always keep X509_NAMEs in 2 forms. */
178struct X509_name_st
179 {
180 STACK_OF(X509_NAME_ENTRY) *entries;
181 int modified; /* true if 'bytes' needs to be built */
182#ifndef OPENSSL_NO_BUFFER
183 BUF_MEM *bytes;
184#else
185 char *bytes;
186#endif
187/* unsigned long hash; Keep the hash around for lookups */
188 unsigned char *canon_enc;
189 int canon_enclen;
190 } /* X509_NAME */;
191
192DECLARE_STACK_OF(X509_NAME)
193
194#define X509_EX_V_NETSCAPE_HACK 0x8000
195#define X509_EX_V_INIT 0x0001
196typedef struct X509_extension_st
197 {
198 ASN1_OBJECT *object;
199 ASN1_BOOLEAN critical;
200 ASN1_OCTET_STRING *value;
201 } X509_EXTENSION;
202
203typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS;
204
205DECLARE_STACK_OF(X509_EXTENSION)
206DECLARE_ASN1_SET_OF(X509_EXTENSION)
207
208/* a sequence of these are used */
209typedef struct x509_attributes_st
210 {
211 ASN1_OBJECT *object;
212 int single; /* 0 for a set, 1 for a single item (which is wrong) */
213 union {
214 char *ptr;
215/* 0 */ STACK_OF(ASN1_TYPE) *set;
216/* 1 */ ASN1_TYPE *single;
217 } value;
218 } X509_ATTRIBUTE;
219
220DECLARE_STACK_OF(X509_ATTRIBUTE)
221DECLARE_ASN1_SET_OF(X509_ATTRIBUTE)
222
223
224typedef struct X509_req_info_st
225 {
226 ASN1_ENCODING enc;
227 ASN1_INTEGER *version;
228 X509_NAME *subject;
229 X509_PUBKEY *pubkey;
230 /* d=2 hl=2 l= 0 cons: cont: 00 */
231 STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */
232 } X509_REQ_INFO;
233
234typedef struct X509_req_st
235 {
236 X509_REQ_INFO *req_info;
237 X509_ALGOR *sig_alg;
238 ASN1_BIT_STRING *signature;
239 int references;
240 } X509_REQ;
241
242typedef struct x509_cinf_st
243 {
244 ASN1_INTEGER *version; /* [ 0 ] default of v1 */
245 ASN1_INTEGER *serialNumber;
246 X509_ALGOR *signature;
247 X509_NAME *issuer;
248 X509_VAL *validity;
249 X509_NAME *subject;
250 X509_PUBKEY *key;
251 ASN1_BIT_STRING *issuerUID; /* [ 1 ] optional in v2 */
252 ASN1_BIT_STRING *subjectUID; /* [ 2 ] optional in v2 */
253 STACK_OF(X509_EXTENSION) *extensions; /* [ 3 ] optional in v3 */
254 ASN1_ENCODING enc;
255 } X509_CINF;
256
257/* This stuff is certificate "auxiliary info"
258 * it contains details which are useful in certificate
259 * stores and databases. When used this is tagged onto
260 * the end of the certificate itself
261 */
262
263typedef struct x509_cert_aux_st
264 {
265 STACK_OF(ASN1_OBJECT) *trust; /* trusted uses */
266 STACK_OF(ASN1_OBJECT) *reject; /* rejected uses */
267 ASN1_UTF8STRING *alias; /* "friendly name" */
268 ASN1_OCTET_STRING *keyid; /* key id of private key */
269 STACK_OF(X509_ALGOR) *other; /* other unspecified info */
270 } X509_CERT_AUX;
271
272struct x509_st
273 {
274 X509_CINF *cert_info;
275 X509_ALGOR *sig_alg;
276 ASN1_BIT_STRING *signature;
277 int valid;
278 int references;
279 char *name;
280 CRYPTO_EX_DATA ex_data;
281 /* These contain copies of various extension values */
282 long ex_pathlen;
283 long ex_pcpathlen;
284 unsigned long ex_flags;
285 unsigned long ex_kusage;
286 unsigned long ex_xkusage;
287 unsigned long ex_nscert;
288 ASN1_OCTET_STRING *skid;
289 AUTHORITY_KEYID *akid;
290 X509_POLICY_CACHE *policy_cache;
291 STACK_OF(DIST_POINT) *crldp;
292 STACK_OF(GENERAL_NAME) *altname;
293 NAME_CONSTRAINTS *nc;
294#ifndef OPENSSL_NO_SHA
295 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
296#endif
297 X509_CERT_AUX *aux;
298 } /* X509 */;
299
300DECLARE_STACK_OF(X509)
301DECLARE_ASN1_SET_OF(X509)
302
303/* This is used for a table of trust checking functions */
304
305typedef struct x509_trust_st {
306 int trust;
307 int flags;
308 int (*check_trust)(struct x509_trust_st *, X509 *, int);
309 char *name;
310 int arg1;
311 void *arg2;
312} X509_TRUST;
313
314DECLARE_STACK_OF(X509_TRUST)
315
316typedef struct x509_cert_pair_st {
317 X509 *forward;
318 X509 *reverse;
319} X509_CERT_PAIR;
320
321/* standard trust ids */
322
323#define X509_TRUST_DEFAULT -1 /* Only valid in purpose settings */
324
325#define X509_TRUST_COMPAT 1
326#define X509_TRUST_SSL_CLIENT 2
327#define X509_TRUST_SSL_SERVER 3
328#define X509_TRUST_EMAIL 4
329#define X509_TRUST_OBJECT_SIGN 5
330#define X509_TRUST_OCSP_SIGN 6
331#define X509_TRUST_OCSP_REQUEST 7
332#define X509_TRUST_TSA 8
333
334/* Keep these up to date! */
335#define X509_TRUST_MIN 1
336#define X509_TRUST_MAX 8
337
338
339/* trust_flags values */
340#define X509_TRUST_DYNAMIC 1
341#define X509_TRUST_DYNAMIC_NAME 2
342
343/* check_trust return codes */
344
345#define X509_TRUST_TRUSTED 1
346#define X509_TRUST_REJECTED 2
347#define X509_TRUST_UNTRUSTED 3
348
349/* Flags for X509_print_ex() */
350
351#define X509_FLAG_COMPAT 0
352#define X509_FLAG_NO_HEADER 1L
353#define X509_FLAG_NO_VERSION (1L << 1)
354#define X509_FLAG_NO_SERIAL (1L << 2)
355#define X509_FLAG_NO_SIGNAME (1L << 3)
356#define X509_FLAG_NO_ISSUER (1L << 4)
357#define X509_FLAG_NO_VALIDITY (1L << 5)
358#define X509_FLAG_NO_SUBJECT (1L << 6)
359#define X509_FLAG_NO_PUBKEY (1L << 7)
360#define X509_FLAG_NO_EXTENSIONS (1L << 8)
361#define X509_FLAG_NO_SIGDUMP (1L << 9)
362#define X509_FLAG_NO_AUX (1L << 10)
363#define X509_FLAG_NO_ATTRIBUTES (1L << 11)
364
365/* Flags specific to X509_NAME_print_ex() */
366
367/* The field separator information */
368
369#define XN_FLAG_SEP_MASK (0xf << 16)
370
371#define XN_FLAG_COMPAT 0 /* Traditional SSLeay: use old X509_NAME_print */
372#define XN_FLAG_SEP_COMMA_PLUS (1 << 16) /* RFC2253 ,+ */
373#define XN_FLAG_SEP_CPLUS_SPC (2 << 16) /* ,+ spaced: more readable */
374#define XN_FLAG_SEP_SPLUS_SPC (3 << 16) /* ;+ spaced */
375#define XN_FLAG_SEP_MULTILINE (4 << 16) /* One line per field */
376
377#define XN_FLAG_DN_REV (1 << 20) /* Reverse DN order */
378
379/* How the field name is shown */
380
381#define XN_FLAG_FN_MASK (0x3 << 21)
382
383#define XN_FLAG_FN_SN 0 /* Object short name */
384#define XN_FLAG_FN_LN (1 << 21) /* Object long name */
385#define XN_FLAG_FN_OID (2 << 21) /* Always use OIDs */
386#define XN_FLAG_FN_NONE (3 << 21) /* No field names */
387
388#define XN_FLAG_SPC_EQ (1 << 23) /* Put spaces round '=' */
389
390/* This determines if we dump fields we don't recognise:
391 * RFC2253 requires this.
392 */
393
394#define XN_FLAG_DUMP_UNKNOWN_FIELDS (1 << 24)
395
396#define XN_FLAG_FN_ALIGN (1 << 25) /* Align field names to 20 characters */
397
398/* Complete set of RFC2253 flags */
399
400#define XN_FLAG_RFC2253 (ASN1_STRFLGS_RFC2253 | \
401 XN_FLAG_SEP_COMMA_PLUS | \
402 XN_FLAG_DN_REV | \
403 XN_FLAG_FN_SN | \
404 XN_FLAG_DUMP_UNKNOWN_FIELDS)
405
406/* readable oneline form */
407
408#define XN_FLAG_ONELINE (ASN1_STRFLGS_RFC2253 | \
409 ASN1_STRFLGS_ESC_QUOTE | \
410 XN_FLAG_SEP_CPLUS_SPC | \
411 XN_FLAG_SPC_EQ | \
412 XN_FLAG_FN_SN)
413
414/* readable multiline form */
415
416#define XN_FLAG_MULTILINE (ASN1_STRFLGS_ESC_CTRL | \
417 ASN1_STRFLGS_ESC_MSB | \
418 XN_FLAG_SEP_MULTILINE | \
419 XN_FLAG_SPC_EQ | \
420 XN_FLAG_FN_LN | \
421 XN_FLAG_FN_ALIGN)
422
423struct x509_revoked_st
424 {
425 ASN1_INTEGER *serialNumber;
426 ASN1_TIME *revocationDate;
427 STACK_OF(X509_EXTENSION) /* optional */ *extensions;
428 /* Set up if indirect CRL */
429 STACK_OF(GENERAL_NAME) *issuer;
430 /* Revocation reason */
431 int reason;
432 int sequence; /* load sequence */
433 };
434
435DECLARE_STACK_OF(X509_REVOKED)
436DECLARE_ASN1_SET_OF(X509_REVOKED)
437
438typedef struct X509_crl_info_st
439 {
440 ASN1_INTEGER *version;
441 X509_ALGOR *sig_alg;
442 X509_NAME *issuer;
443 ASN1_TIME *lastUpdate;
444 ASN1_TIME *nextUpdate;
445 STACK_OF(X509_REVOKED) *revoked;
446 STACK_OF(X509_EXTENSION) /* [0] */ *extensions;
447 ASN1_ENCODING enc;
448 } X509_CRL_INFO;
449
450struct X509_crl_st
451 {
452 /* actual signature */
453 X509_CRL_INFO *crl;
454 X509_ALGOR *sig_alg;
455 ASN1_BIT_STRING *signature;
456 int references;
457 int flags;
458 /* Copies of various extensions */
459 AUTHORITY_KEYID *akid;
460 ISSUING_DIST_POINT *idp;
461 /* Convenient breakdown of IDP */
462 int idp_flags;
463 int idp_reasons;
464 /* CRL and base CRL numbers for delta processing */
465 ASN1_INTEGER *crl_number;
466 ASN1_INTEGER *base_crl_number;
467#ifndef OPENSSL_NO_SHA
468 unsigned char sha1_hash[SHA_DIGEST_LENGTH];
469#endif
470 STACK_OF(GENERAL_NAMES) *issuers;
471 const X509_CRL_METHOD *meth;
472 void *meth_data;
473 } /* X509_CRL */;
474
475DECLARE_STACK_OF(X509_CRL)
476DECLARE_ASN1_SET_OF(X509_CRL)
477
478typedef struct private_key_st
479 {
480 int version;
481 /* The PKCS#8 data types */
482 X509_ALGOR *enc_algor;
483 ASN1_OCTET_STRING *enc_pkey; /* encrypted pub key */
484
485 /* When decrypted, the following will not be NULL */
486 EVP_PKEY *dec_pkey;
487
488 /* used to encrypt and decrypt */
489 int key_length;
490 char *key_data;
491 int key_free; /* true if we should auto free key_data */
492
493 /* expanded version of 'enc_algor' */
494 EVP_CIPHER_INFO cipher;
495
496 int references;
497 } X509_PKEY;
498
499#ifndef OPENSSL_NO_EVP
500typedef struct X509_info_st
501 {
502 X509 *x509;
503 X509_CRL *crl;
504 X509_PKEY *x_pkey;
505
506 EVP_CIPHER_INFO enc_cipher;
507 int enc_len;
508 char *enc_data;
509
510 int references;
511 } X509_INFO;
512
513DECLARE_STACK_OF(X509_INFO)
514#endif
515
516/* The next 2 structures and their 8 routines were sent to me by
517 * Pat Richard <patr@x509.com> and are used to manipulate
518 * Netscapes spki structures - useful if you are writing a CA web page
519 */
520typedef struct Netscape_spkac_st
521 {
522 X509_PUBKEY *pubkey;
523 ASN1_IA5STRING *challenge; /* challenge sent in atlas >= PR2 */
524 } NETSCAPE_SPKAC;
525
526typedef struct Netscape_spki_st
527 {
528 NETSCAPE_SPKAC *spkac; /* signed public key and challenge */
529 X509_ALGOR *sig_algor;
530 ASN1_BIT_STRING *signature;
531 } NETSCAPE_SPKI;
532
533/* Netscape certificate sequence structure */
534typedef struct Netscape_certificate_sequence
535 {
536 ASN1_OBJECT *type;
537 STACK_OF(X509) *certs;
538 } NETSCAPE_CERT_SEQUENCE;
539
540/* Unused (and iv length is wrong)
541typedef struct CBCParameter_st
542 {
543 unsigned char iv[8];
544 } CBC_PARAM;
545*/
546
547/* Password based encryption structure */
548
549typedef struct PBEPARAM_st {
550ASN1_OCTET_STRING *salt;
551ASN1_INTEGER *iter;
552} PBEPARAM;
553
554/* Password based encryption V2 structures */
555
556typedef struct PBE2PARAM_st {
557X509_ALGOR *keyfunc;
558X509_ALGOR *encryption;
559} PBE2PARAM;
560
561typedef struct PBKDF2PARAM_st {
562ASN1_TYPE *salt; /* Usually OCTET STRING but could be anything */
563ASN1_INTEGER *iter;
564ASN1_INTEGER *keylength;
565X509_ALGOR *prf;
566} PBKDF2PARAM;
567
568
569/* PKCS#8 private key info structure */
570
571struct pkcs8_priv_key_info_st
572 {
573 int broken; /* Flag for various broken formats */
574#define PKCS8_OK 0
575#define PKCS8_NO_OCTET 1
576#define PKCS8_EMBEDDED_PARAM 2
577#define PKCS8_NS_DB 3
578#define PKCS8_NEG_PRIVKEY 4
579 ASN1_INTEGER *version;
580 X509_ALGOR *pkeyalg;
581 ASN1_TYPE *pkey; /* Should be OCTET STRING but some are broken */
582 STACK_OF(X509_ATTRIBUTE) *attributes;
583 };
584
585#ifdef __cplusplus
586}
587#endif
588
589#include <openssl/x509_vfy.h>
590#include <openssl/pkcs7.h>
591
592#ifdef __cplusplus
593extern "C" {
594#endif
595
596#define X509_EXT_PACK_UNKNOWN 1
597#define X509_EXT_PACK_STRING 2
598
599#define X509_get_version(x) ASN1_INTEGER_get((x)->cert_info->version)
600/* #define X509_get_serialNumber(x) ((x)->cert_info->serialNumber) */
601#define X509_get_notBefore(x) ((x)->cert_info->validity->notBefore)
602#define X509_get_notAfter(x) ((x)->cert_info->validity->notAfter)
603#define X509_extract_key(x) X509_get_pubkey(x) /*****/
604#define X509_REQ_get_version(x) ASN1_INTEGER_get((x)->req_info->version)
605#define X509_REQ_get_subject_name(x) ((x)->req_info->subject)
606#define X509_REQ_extract_key(a) X509_REQ_get_pubkey(a)
607#define X509_name_cmp(a,b) X509_NAME_cmp((a),(b))
608#define X509_get_signature_type(x) EVP_PKEY_type(OBJ_obj2nid((x)->sig_alg->algorithm))
609
610#define X509_CRL_get_version(x) ASN1_INTEGER_get((x)->crl->version)
611#define X509_CRL_get_lastUpdate(x) ((x)->crl->lastUpdate)
612#define X509_CRL_get_nextUpdate(x) ((x)->crl->nextUpdate)
613#define X509_CRL_get_issuer(x) ((x)->crl->issuer)
614#define X509_CRL_get_REVOKED(x) ((x)->crl->revoked)
615
616void X509_CRL_set_default_method(const X509_CRL_METHOD *meth);
617X509_CRL_METHOD *X509_CRL_METHOD_new(
618 int (*crl_init)(X509_CRL *crl),
619 int (*crl_free)(X509_CRL *crl),
620 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,
621 ASN1_INTEGER *ser, X509_NAME *issuer),
622 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk));
623void X509_CRL_METHOD_free(X509_CRL_METHOD *m);
624
625void X509_CRL_set_meth_data(X509_CRL *crl, void *dat);
626void *X509_CRL_get_meth_data(X509_CRL *crl);
627
628/* This one is only used so that a binary form can output, as in
629 * i2d_X509_NAME(X509_get_X509_PUBKEY(x),&buf) */
630#define X509_get_X509_PUBKEY(x) ((x)->cert_info->key)
631
632
633const char *X509_verify_cert_error_string(long n);
634
635#ifndef OPENSSL_NO_EVP
636int X509_verify(X509 *a, EVP_PKEY *r);
637
638int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
639int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
640int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
641
642NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len);
643char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *x);
644EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x);
645int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey);
646
647int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki);
648
649int X509_signature_dump(BIO *bp,const ASN1_STRING *sig, int indent);
650int X509_signature_print(BIO *bp,X509_ALGOR *alg, ASN1_STRING *sig);
651
652int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
653int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);
654int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
655int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);
656int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
657int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);
658int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
659
660int X509_pubkey_digest(const X509 *data,const EVP_MD *type,
661 unsigned char *md, unsigned int *len);
662int X509_digest(const X509 *data,const EVP_MD *type,
663 unsigned char *md, unsigned int *len);
664int X509_CRL_digest(const X509_CRL *data,const EVP_MD *type,
665 unsigned char *md, unsigned int *len);
666int X509_REQ_digest(const X509_REQ *data,const EVP_MD *type,
667 unsigned char *md, unsigned int *len);
668int X509_NAME_digest(const X509_NAME *data,const EVP_MD *type,
669 unsigned char *md, unsigned int *len);
670#endif
671
672X509 *d2i_X509_fp(FILE *fp, X509 **x509);
673int i2d_X509_fp(FILE *fp,X509 *x509);
674X509_CRL *d2i_X509_CRL_fp(FILE *fp,X509_CRL **crl);
675int i2d_X509_CRL_fp(FILE *fp,X509_CRL *crl);
676X509_REQ *d2i_X509_REQ_fp(FILE *fp,X509_REQ **req);
677int i2d_X509_REQ_fp(FILE *fp,X509_REQ *req);
678#ifndef OPENSSL_NO_RSA
679RSA *d2i_RSAPrivateKey_fp(FILE *fp,RSA **rsa);
680int i2d_RSAPrivateKey_fp(FILE *fp,RSA *rsa);
681RSA *d2i_RSAPublicKey_fp(FILE *fp,RSA **rsa);
682int i2d_RSAPublicKey_fp(FILE *fp,RSA *rsa);
683RSA *d2i_RSA_PUBKEY_fp(FILE *fp,RSA **rsa);
684int i2d_RSA_PUBKEY_fp(FILE *fp,RSA *rsa);
685#endif
686#ifndef OPENSSL_NO_DSA
687DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa);
688int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa);
689int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa);
690#endif
691#ifndef OPENSSL_NO_EC
692EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey);
693int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey);
694EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey);
695int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey);
696#endif
697X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8);
698int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8);
699PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
700 PKCS8_PRIV_KEY_INFO **p8inf);
701int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,PKCS8_PRIV_KEY_INFO *p8inf);
702int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key);
703int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey);
704EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a);
705int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey);
706EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a);
707
708#ifndef OPENSSL_NO_BIO
709X509 *d2i_X509_bio(BIO *bp,X509 **x509);
710int i2d_X509_bio(BIO *bp,X509 *x509);
711X509_CRL *d2i_X509_CRL_bio(BIO *bp,X509_CRL **crl);
712int i2d_X509_CRL_bio(BIO *bp,X509_CRL *crl);
713X509_REQ *d2i_X509_REQ_bio(BIO *bp,X509_REQ **req);
714int i2d_X509_REQ_bio(BIO *bp,X509_REQ *req);
715#ifndef OPENSSL_NO_RSA
716RSA *d2i_RSAPrivateKey_bio(BIO *bp,RSA **rsa);
717int i2d_RSAPrivateKey_bio(BIO *bp,RSA *rsa);
718RSA *d2i_RSAPublicKey_bio(BIO *bp,RSA **rsa);
719int i2d_RSAPublicKey_bio(BIO *bp,RSA *rsa);
720RSA *d2i_RSA_PUBKEY_bio(BIO *bp,RSA **rsa);
721int i2d_RSA_PUBKEY_bio(BIO *bp,RSA *rsa);
722#endif
723#ifndef OPENSSL_NO_DSA
724DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa);
725int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa);
726DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa);
727int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa);
728#endif
729#ifndef OPENSSL_NO_EC
730EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey);
731int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey);
732EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey);
733int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey);
734#endif
735X509_SIG *d2i_PKCS8_bio(BIO *bp,X509_SIG **p8);
736int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8);
737PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
738 PKCS8_PRIV_KEY_INFO **p8inf);
739int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,PKCS8_PRIV_KEY_INFO *p8inf);
740int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key);
741int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey);
742EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a);
743int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey);
744EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a);
745#endif
746
747X509 *X509_dup(X509 *x509);
748X509_ATTRIBUTE *X509_ATTRIBUTE_dup(X509_ATTRIBUTE *xa);
749X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex);
750X509_CRL *X509_CRL_dup(X509_CRL *crl);
751X509_REQ *X509_REQ_dup(X509_REQ *req);
752X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
753int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);
754void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
755 X509_ALGOR *algor);
756void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md);
757int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b);
758
759X509_NAME *X509_NAME_dup(X509_NAME *xn);
760X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
761
762int X509_cmp_time(const ASN1_TIME *s, time_t *t);
763int X509_cmp_current_time(const ASN1_TIME *s);
764ASN1_TIME * X509_time_adj(ASN1_TIME *s, long adj, time_t *t);
765ASN1_TIME * X509_time_adj_ex(ASN1_TIME *s,
766 int offset_day, long offset_sec, time_t *t);
767ASN1_TIME * X509_gmtime_adj(ASN1_TIME *s, long adj);
768
769const char * X509_get_default_cert_area(void );
770const char * X509_get_default_cert_dir(void );
771const char * X509_get_default_cert_file(void );
772const char * X509_get_default_cert_dir_env(void );
773const char * X509_get_default_cert_file_env(void );
774const char * X509_get_default_private_dir(void );
775
776X509_REQ * X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
777X509 * X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
778
779DECLARE_ASN1_FUNCTIONS(X509_ALGOR)
780DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)
781DECLARE_ASN1_FUNCTIONS(X509_VAL)
782
783DECLARE_ASN1_FUNCTIONS(X509_PUBKEY)
784
785int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
786EVP_PKEY * X509_PUBKEY_get(X509_PUBKEY *key);
787int X509_get_pubkey_parameters(EVP_PKEY *pkey,
788 STACK_OF(X509) *chain);
789int i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp);
790EVP_PKEY * d2i_PUBKEY(EVP_PKEY **a,const unsigned char **pp,
791 long length);
792#ifndef OPENSSL_NO_RSA
793int i2d_RSA_PUBKEY(RSA *a,unsigned char **pp);
794RSA * d2i_RSA_PUBKEY(RSA **a,const unsigned char **pp,
795 long length);
796#endif
797#ifndef OPENSSL_NO_DSA
798int i2d_DSA_PUBKEY(DSA *a,unsigned char **pp);
799DSA * d2i_DSA_PUBKEY(DSA **a,const unsigned char **pp,
800 long length);
801#endif
802#ifndef OPENSSL_NO_EC
803int i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp);
804EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp,
805 long length);
806#endif
807
808DECLARE_ASN1_FUNCTIONS(X509_SIG)
809DECLARE_ASN1_FUNCTIONS(X509_REQ_INFO)
810DECLARE_ASN1_FUNCTIONS(X509_REQ)
811
812DECLARE_ASN1_FUNCTIONS(X509_ATTRIBUTE)
813X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value);
814
815DECLARE_ASN1_FUNCTIONS(X509_EXTENSION)
816DECLARE_ASN1_ENCODE_FUNCTIONS(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
817
818DECLARE_ASN1_FUNCTIONS(X509_NAME_ENTRY)
819
820DECLARE_ASN1_FUNCTIONS(X509_NAME)
821
822int X509_NAME_set(X509_NAME **xn, X509_NAME *name);
823
824DECLARE_ASN1_FUNCTIONS(X509_CINF)
825
826DECLARE_ASN1_FUNCTIONS(X509)
827DECLARE_ASN1_FUNCTIONS(X509_CERT_AUX)
828
829DECLARE_ASN1_FUNCTIONS(X509_CERT_PAIR)
830
831int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
832 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
833int X509_set_ex_data(X509 *r, int idx, void *arg);
834void *X509_get_ex_data(X509 *r, int idx);
835int i2d_X509_AUX(X509 *a,unsigned char **pp);
836X509 * d2i_X509_AUX(X509 **a,const unsigned char **pp,long length);
837
838int X509_alias_set1(X509 *x, unsigned char *name, int len);
839int X509_keyid_set1(X509 *x, unsigned char *id, int len);
840unsigned char * X509_alias_get0(X509 *x, int *len);
841unsigned char * X509_keyid_get0(X509 *x, int *len);
842int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int);
843int X509_TRUST_set(int *t, int trust);
844int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
845int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj);
846void X509_trust_clear(X509 *x);
847void X509_reject_clear(X509 *x);
848
849DECLARE_ASN1_FUNCTIONS(X509_REVOKED)
850DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
851DECLARE_ASN1_FUNCTIONS(X509_CRL)
852
853int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
854int X509_CRL_get0_by_serial(X509_CRL *crl,
855 X509_REVOKED **ret, ASN1_INTEGER *serial);
856int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);
857
858X509_PKEY * X509_PKEY_new(void );
859void X509_PKEY_free(X509_PKEY *a);
860int i2d_X509_PKEY(X509_PKEY *a,unsigned char **pp);
861X509_PKEY * d2i_X509_PKEY(X509_PKEY **a,const unsigned char **pp,long length);
862
863DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKI)
864DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
865DECLARE_ASN1_FUNCTIONS(NETSCAPE_CERT_SEQUENCE)
866
867#ifndef OPENSSL_NO_EVP
868X509_INFO * X509_INFO_new(void);
869void X509_INFO_free(X509_INFO *a);
870char * X509_NAME_oneline(X509_NAME *a,char *buf,int size);
871
872int ASN1_item_digest(const ASN1_ITEM *it,const EVP_MD *type,void *data,
873 unsigned char *md,unsigned int *len);
874
875int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *algor1,
876 ASN1_BIT_STRING *signature,void *data,EVP_PKEY *pkey);
877
878int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
879 ASN1_BIT_STRING *signature,
880 void *data, EVP_PKEY *pkey, const EVP_MD *type);
881int ASN1_item_sign_ctx(const ASN1_ITEM *it,
882 X509_ALGOR *algor1, X509_ALGOR *algor2,
883 ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx);
884#endif
885
886int X509_set_version(X509 *x,long version);
887int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial);
888ASN1_INTEGER * X509_get_serialNumber(X509 *x);
889int X509_set_issuer_name(X509 *x, X509_NAME *name);
890X509_NAME * X509_get_issuer_name(X509 *a);
891int X509_set_subject_name(X509 *x, X509_NAME *name);
892X509_NAME * X509_get_subject_name(X509 *a);
893int X509_set_notBefore(X509 *x, const ASN1_TIME *tm);
894int X509_set_notAfter(X509 *x, const ASN1_TIME *tm);
895int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
896EVP_PKEY * X509_get_pubkey(X509 *x);
897ASN1_BIT_STRING * X509_get0_pubkey_bitstr(const X509 *x);
898int X509_certificate_type(X509 *x,EVP_PKEY *pubkey /* optional */);
899
900int X509_REQ_set_version(X509_REQ *x,long version);
901int X509_REQ_set_subject_name(X509_REQ *req,X509_NAME *name);
902int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
903EVP_PKEY * X509_REQ_get_pubkey(X509_REQ *req);
904int X509_REQ_extension_nid(int nid);
905int * X509_REQ_get_extension_nids(void);
906void X509_REQ_set_extension_nids(int *nids);
907STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req);
908int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
909 int nid);
910int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts);
911int X509_REQ_get_attr_count(const X509_REQ *req);
912int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid,
913 int lastpos);
914int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj,
915 int lastpos);
916X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc);
917X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc);
918int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr);
919int X509_REQ_add1_attr_by_OBJ(X509_REQ *req,
920 const ASN1_OBJECT *obj, int type,
921 const unsigned char *bytes, int len);
922int X509_REQ_add1_attr_by_NID(X509_REQ *req,
923 int nid, int type,
924 const unsigned char *bytes, int len);
925int X509_REQ_add1_attr_by_txt(X509_REQ *req,
926 const char *attrname, int type,
927 const unsigned char *bytes, int len);
928
929int X509_CRL_set_version(X509_CRL *x, long version);
930int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name);
931int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
932int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);
933int X509_CRL_sort(X509_CRL *crl);
934
935int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
936int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);
937
938int X509_REQ_check_private_key(X509_REQ *x509,EVP_PKEY *pkey);
939
940int X509_check_private_key(X509 *x509,EVP_PKEY *pkey);
941
942int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b);
943unsigned long X509_issuer_and_serial_hash(X509 *a);
944
945int X509_issuer_name_cmp(const X509 *a, const X509 *b);
946unsigned long X509_issuer_name_hash(X509 *a);
947
948int X509_subject_name_cmp(const X509 *a, const X509 *b);
949unsigned long X509_subject_name_hash(X509 *x);
950
951#ifndef OPENSSL_NO_MD5
952unsigned long X509_issuer_name_hash_old(X509 *a);
953unsigned long X509_subject_name_hash_old(X509 *x);
954#endif
955
956int X509_cmp(const X509 *a, const X509 *b);
957int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
958unsigned long X509_NAME_hash(X509_NAME *x);
959unsigned long X509_NAME_hash_old(X509_NAME *x);
960
961int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
962int X509_CRL_match(const X509_CRL *a, const X509_CRL *b);
963int X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
964int X509_print_fp(FILE *bp,X509 *x);
965int X509_CRL_print_fp(FILE *bp,X509_CRL *x);
966int X509_REQ_print_fp(FILE *bp,X509_REQ *req);
967int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags);
968
969#ifndef OPENSSL_NO_BIO
970int X509_NAME_print(BIO *bp, X509_NAME *name, int obase);
971int X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags);
972int X509_print_ex(BIO *bp,X509 *x, unsigned long nmflag, unsigned long cflag);
973int X509_print(BIO *bp,X509 *x);
974int X509_ocspid_print(BIO *bp,X509 *x);
975int X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent);
976int X509_CRL_print(BIO *bp,X509_CRL *x);
977int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, unsigned long cflag);
978int X509_REQ_print(BIO *bp,X509_REQ *req);
979#endif
980
981int X509_NAME_entry_count(X509_NAME *name);
982int X509_NAME_get_text_by_NID(X509_NAME *name, int nid,
983 char *buf,int len);
984int X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj,
985 char *buf,int len);
986
987/* NOTE: you should be passsing -1, not 0 as lastpos. The functions that use
988 * lastpos, search after that position on. */
989int X509_NAME_get_index_by_NID(X509_NAME *name,int nid,int lastpos);
990int X509_NAME_get_index_by_OBJ(X509_NAME *name,ASN1_OBJECT *obj,
991 int lastpos);
992X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
993X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);
994int X509_NAME_add_entry(X509_NAME *name,X509_NAME_ENTRY *ne,
995 int loc, int set);
996int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
997 unsigned char *bytes, int len, int loc, int set);
998int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
999 unsigned char *bytes, int len, int loc, int set);
1000X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
1001 const char *field, int type, const unsigned char *bytes, int len);
1002X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
1003 int type,unsigned char *bytes, int len);
1004int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
1005 const unsigned char *bytes, int len, int loc, int set);
1006X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
1007 ASN1_OBJECT *obj, int type,const unsigned char *bytes,
1008 int len);
1009int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne,
1010 ASN1_OBJECT *obj);
1011int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
1012 const unsigned char *bytes, int len);
1013ASN1_OBJECT * X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne);
1014ASN1_STRING * X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
1015
1016int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x);
1017int X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x,
1018 int nid, int lastpos);
1019int X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *x,
1020 ASN1_OBJECT *obj,int lastpos);
1021int X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *x,
1022 int crit, int lastpos);
1023X509_EXTENSION *X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc);
1024X509_EXTENSION *X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc);
1025STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
1026 X509_EXTENSION *ex, int loc);
1027
1028int X509_get_ext_count(X509 *x);
1029int X509_get_ext_by_NID(X509 *x, int nid, int lastpos);
1030int X509_get_ext_by_OBJ(X509 *x,ASN1_OBJECT *obj,int lastpos);
1031int X509_get_ext_by_critical(X509 *x, int crit, int lastpos);
1032X509_EXTENSION *X509_get_ext(X509 *x, int loc);
1033X509_EXTENSION *X509_delete_ext(X509 *x, int loc);
1034int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
1035void * X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
1036int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit,
1037 unsigned long flags);
1038
1039int X509_CRL_get_ext_count(X509_CRL *x);
1040int X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos);
1041int X509_CRL_get_ext_by_OBJ(X509_CRL *x,ASN1_OBJECT *obj,int lastpos);
1042int X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos);
1043X509_EXTENSION *X509_CRL_get_ext(X509_CRL *x, int loc);
1044X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc);
1045int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc);
1046void * X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx);
1047int X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, int crit,
1048 unsigned long flags);
1049
1050int X509_REVOKED_get_ext_count(X509_REVOKED *x);
1051int X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos);
1052int X509_REVOKED_get_ext_by_OBJ(X509_REVOKED *x,ASN1_OBJECT *obj,int lastpos);
1053int X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos);
1054X509_EXTENSION *X509_REVOKED_get_ext(X509_REVOKED *x, int loc);
1055X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, int loc);
1056int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc);
1057void * X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx);
1058int X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, void *value, int crit,
1059 unsigned long flags);
1060
1061X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
1062 int nid, int crit, ASN1_OCTET_STRING *data);
1063X509_EXTENSION *X509_EXTENSION_create_by_OBJ(X509_EXTENSION **ex,
1064 ASN1_OBJECT *obj,int crit,ASN1_OCTET_STRING *data);
1065int X509_EXTENSION_set_object(X509_EXTENSION *ex,ASN1_OBJECT *obj);
1066int X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit);
1067int X509_EXTENSION_set_data(X509_EXTENSION *ex,
1068 ASN1_OCTET_STRING *data);
1069ASN1_OBJECT * X509_EXTENSION_get_object(X509_EXTENSION *ex);
1070ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne);
1071int X509_EXTENSION_get_critical(X509_EXTENSION *ex);
1072
1073int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x);
1074int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
1075 int lastpos);
1076int X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
1077 int lastpos);
1078X509_ATTRIBUTE *X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc);
1079X509_ATTRIBUTE *X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc);
1080STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
1081 X509_ATTRIBUTE *attr);
1082STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x,
1083 const ASN1_OBJECT *obj, int type,
1084 const unsigned char *bytes, int len);
1085STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
1086 int nid, int type,
1087 const unsigned char *bytes, int len);
1088STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
1089 const char *attrname, int type,
1090 const unsigned char *bytes, int len);
1091void *X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x,
1092 ASN1_OBJECT *obj, int lastpos, int type);
1093X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
1094 int atrtype, const void *data, int len);
1095X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
1096 const ASN1_OBJECT *obj, int atrtype, const void *data, int len);
1097X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
1098 const char *atrname, int type, const unsigned char *bytes, int len);
1099int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj);
1100int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data, int len);
1101void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx,
1102 int atrtype, void *data);
1103int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr);
1104ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr);
1105ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx);
1106
1107int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
1108int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid,
1109 int lastpos);
1110int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, ASN1_OBJECT *obj,
1111 int lastpos);
1112X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
1113X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
1114int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
1115int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
1116 const ASN1_OBJECT *obj, int type,
1117 const unsigned char *bytes, int len);
1118int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
1119 int nid, int type,
1120 const unsigned char *bytes, int len);
1121int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
1122 const char *attrname, int type,
1123 const unsigned char *bytes, int len);
1124
1125int X509_verify_cert(X509_STORE_CTX *ctx);
1126
1127/* lookup a cert from a X509 STACK */
1128X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk,X509_NAME *name,
1129 ASN1_INTEGER *serial);
1130X509 *X509_find_by_subject(STACK_OF(X509) *sk,X509_NAME *name);
1131
1132DECLARE_ASN1_FUNCTIONS(PBEPARAM)
1133DECLARE_ASN1_FUNCTIONS(PBE2PARAM)
1134DECLARE_ASN1_FUNCTIONS(PBKDF2PARAM)
1135
1136int PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
1137 const unsigned char *salt, int saltlen);
1138
1139X509_ALGOR *PKCS5_pbe_set(int alg, int iter,
1140 const unsigned char *salt, int saltlen);
1141X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
1142 unsigned char *salt, int saltlen);
1143X509_ALGOR *PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter,
1144 unsigned char *salt, int saltlen,
1145 unsigned char *aiv, int prf_nid);
1146
1147X509_ALGOR *PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen,
1148 int prf_nid, int keylen);
1149
1150/* PKCS#8 utilities */
1151
1152DECLARE_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
1153
1154EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8);
1155PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey);
1156PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken);
1157PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken);
1158
1159int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj,
1160 int version, int ptype, void *pval,
1161 unsigned char *penc, int penclen);
1162int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg,
1163 const unsigned char **pk, int *ppklen,
1164 X509_ALGOR **pa,
1165 PKCS8_PRIV_KEY_INFO *p8);
1166
1167int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
1168 int ptype, void *pval,
1169 unsigned char *penc, int penclen);
1170int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
1171 const unsigned char **pk, int *ppklen,
1172 X509_ALGOR **pa,
1173 X509_PUBKEY *pub);
1174
1175int X509_check_trust(X509 *x, int id, int flags);
1176int X509_TRUST_get_count(void);
1177X509_TRUST * X509_TRUST_get0(int idx);
1178int X509_TRUST_get_by_id(int id);
1179int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
1180 char *name, int arg1, void *arg2);
1181void X509_TRUST_cleanup(void);
1182int X509_TRUST_get_flags(X509_TRUST *xp);
1183char *X509_TRUST_get0_name(X509_TRUST *xp);
1184int X509_TRUST_get_trust(X509_TRUST *xp);
1185
1186/* BEGIN ERROR CODES */
1187/* The following lines are auto generated by the script mkerr.pl. Any changes
1188 * made after this point may be overwritten when the script is next run.
1189 */
1190void ERR_load_X509_strings(void);
1191
1192/* Error codes for the X509 functions. */
1193
1194/* Function codes. */
1195#define X509_F_ADD_CERT_DIR 100
1196#define X509_F_BY_FILE_CTRL 101
1197#define X509_F_CHECK_POLICY 145
1198#define X509_F_DIR_CTRL 102
1199#define X509_F_GET_CERT_BY_SUBJECT 103
1200#define X509_F_NETSCAPE_SPKI_B64_DECODE 129
1201#define X509_F_NETSCAPE_SPKI_B64_ENCODE 130
1202#define X509_F_X509AT_ADD1_ATTR 135
1203#define X509_F_X509V3_ADD_EXT 104
1204#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID 136
1205#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ 137
1206#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT 140
1207#define X509_F_X509_ATTRIBUTE_GET0_DATA 139
1208#define X509_F_X509_ATTRIBUTE_SET1_DATA 138
1209#define X509_F_X509_CHECK_PRIVATE_KEY 128
1210#define X509_F_X509_CRL_PRINT_FP 147
1211#define X509_F_X509_EXTENSION_CREATE_BY_NID 108
1212#define X509_F_X509_EXTENSION_CREATE_BY_OBJ 109
1213#define X509_F_X509_GET_PUBKEY_PARAMETERS 110
1214#define X509_F_X509_LOAD_CERT_CRL_FILE 132
1215#define X509_F_X509_LOAD_CERT_FILE 111
1216#define X509_F_X509_LOAD_CRL_FILE 112
1217#define X509_F_X509_NAME_ADD_ENTRY 113
1218#define X509_F_X509_NAME_ENTRY_CREATE_BY_NID 114
1219#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT 131
1220#define X509_F_X509_NAME_ENTRY_SET_OBJECT 115
1221#define X509_F_X509_NAME_ONELINE 116
1222#define X509_F_X509_NAME_PRINT 117
1223#define X509_F_X509_PRINT_EX_FP 118
1224#define X509_F_X509_PUBKEY_GET 119
1225#define X509_F_X509_PUBKEY_SET 120
1226#define X509_F_X509_REQ_CHECK_PRIVATE_KEY 144
1227#define X509_F_X509_REQ_PRINT_EX 121
1228#define X509_F_X509_REQ_PRINT_FP 122
1229#define X509_F_X509_REQ_TO_X509 123
1230#define X509_F_X509_STORE_ADD_CERT 124
1231#define X509_F_X509_STORE_ADD_CRL 125
1232#define X509_F_X509_STORE_CTX_GET1_ISSUER 146
1233#define X509_F_X509_STORE_CTX_INIT 143
1234#define X509_F_X509_STORE_CTX_NEW 142
1235#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT 134
1236#define X509_F_X509_TO_X509_REQ 126
1237#define X509_F_X509_TRUST_ADD 133
1238#define X509_F_X509_TRUST_SET 141
1239#define X509_F_X509_VERIFY_CERT 127
1240
1241/* Reason codes. */
1242#define X509_R_BAD_X509_FILETYPE 100
1243#define X509_R_BASE64_DECODE_ERROR 118
1244#define X509_R_CANT_CHECK_DH_KEY 114
1245#define X509_R_CERT_ALREADY_IN_HASH_TABLE 101
1246#define X509_R_ERR_ASN1_LIB 102
1247#define X509_R_INVALID_DIRECTORY 113
1248#define X509_R_INVALID_FIELD_NAME 119
1249#define X509_R_INVALID_TRUST 123
1250#define X509_R_KEY_TYPE_MISMATCH 115
1251#define X509_R_KEY_VALUES_MISMATCH 116
1252#define X509_R_LOADING_CERT_DIR 103
1253#define X509_R_LOADING_DEFAULTS 104
1254#define X509_R_METHOD_NOT_SUPPORTED 124
1255#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105
1256#define X509_R_PUBLIC_KEY_DECODE_ERROR 125
1257#define X509_R_PUBLIC_KEY_ENCODE_ERROR 126
1258#define X509_R_SHOULD_RETRY 106
1259#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN 107
1260#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY 108
1261#define X509_R_UNKNOWN_KEY_TYPE 117
1262#define X509_R_UNKNOWN_NID 109
1263#define X509_R_UNKNOWN_PURPOSE_ID 121
1264#define X509_R_UNKNOWN_TRUST_ID 120
1265#define X509_R_UNSUPPORTED_ALGORITHM 111
1266#define X509_R_WRONG_LOOKUP_TYPE 112
1267#define X509_R_WRONG_TYPE 122
1268
1269#ifdef __cplusplus
1270}
1271#endif
1272#endif
diff --git a/src/lib/libcrypto/x509/x509_att.c b/src/lib/libcrypto/x509/x509_att.c
deleted file mode 100644
index 5e5cf4e384..0000000000
--- a/src/lib/libcrypto/x509/x509_att.c
+++ /dev/null
@@ -1,403 +0,0 @@
1/* $OpenBSD: x509_att.c,v 1.13 2014/09/29 16:20:40 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/err.h>
63#include <openssl/evp.h>
64#include <openssl/objects.h>
65#include <openssl/stack.h>
66#include <openssl/x509.h>
67#include <openssl/x509v3.h>
68
69int
70X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x)
71{
72 return sk_X509_ATTRIBUTE_num(x);
73}
74
75int
76X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid, int lastpos)
77{
78 ASN1_OBJECT *obj;
79
80 obj = OBJ_nid2obj(nid);
81 if (obj == NULL)
82 return (-2);
83 return (X509at_get_attr_by_OBJ(x, obj, lastpos));
84}
85
86int
87X509at_get_attr_by_OBJ(const STACK_OF(X509_ATTRIBUTE) *sk, ASN1_OBJECT *obj,
88 int lastpos)
89{
90 int n;
91 X509_ATTRIBUTE *ex;
92
93 if (sk == NULL)
94 return (-1);
95 lastpos++;
96 if (lastpos < 0)
97 lastpos = 0;
98 n = sk_X509_ATTRIBUTE_num(sk);
99 for (; lastpos < n; lastpos++) {
100 ex = sk_X509_ATTRIBUTE_value(sk, lastpos);
101 if (OBJ_cmp(ex->object, obj) == 0)
102 return (lastpos);
103 }
104 return (-1);
105}
106
107X509_ATTRIBUTE *
108X509at_get_attr(const STACK_OF(X509_ATTRIBUTE) *x, int loc)
109{
110 if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
111 return NULL;
112 else
113 return sk_X509_ATTRIBUTE_value(x, loc);
114}
115
116X509_ATTRIBUTE *
117X509at_delete_attr(STACK_OF(X509_ATTRIBUTE) *x, int loc)
118{
119 X509_ATTRIBUTE *ret;
120
121 if (x == NULL || sk_X509_ATTRIBUTE_num(x) <= loc || loc < 0)
122 return (NULL);
123 ret = sk_X509_ATTRIBUTE_delete(x, loc);
124 return (ret);
125}
126
127STACK_OF(X509_ATTRIBUTE) *
128X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x, X509_ATTRIBUTE *attr)
129{
130 X509_ATTRIBUTE *new_attr = NULL;
131 STACK_OF(X509_ATTRIBUTE) *sk = NULL;
132
133 if (x == NULL) {
134 X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_PASSED_NULL_PARAMETER);
135 return (NULL);
136 }
137
138 if (*x == NULL) {
139 if ((sk = sk_X509_ATTRIBUTE_new_null()) == NULL)
140 goto err;
141 } else
142 sk = *x;
143
144 if ((new_attr = X509_ATTRIBUTE_dup(attr)) == NULL)
145 goto err2;
146 if (!sk_X509_ATTRIBUTE_push(sk, new_attr))
147 goto err;
148 if (*x == NULL)
149 *x = sk;
150 return (sk);
151
152err:
153 X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_MALLOC_FAILURE);
154err2:
155 if (new_attr != NULL)
156 X509_ATTRIBUTE_free(new_attr);
157 if (sk != NULL && sk != *x)
158 sk_X509_ATTRIBUTE_free(sk);
159 return (NULL);
160}
161
162STACK_OF(X509_ATTRIBUTE) *
163X509at_add1_attr_by_OBJ(STACK_OF(X509_ATTRIBUTE) **x, const ASN1_OBJECT *obj,
164 int type, const unsigned char *bytes, int len)
165{
166 X509_ATTRIBUTE *attr;
167 STACK_OF(X509_ATTRIBUTE) *ret;
168
169 attr = X509_ATTRIBUTE_create_by_OBJ(NULL, obj, type, bytes, len);
170 if (!attr)
171 return 0;
172 ret = X509at_add1_attr(x, attr);
173 X509_ATTRIBUTE_free(attr);
174 return ret;
175}
176
177STACK_OF(X509_ATTRIBUTE) *
178X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x, int nid, int type,
179 const unsigned char *bytes, int len)
180{
181 X509_ATTRIBUTE *attr;
182 STACK_OF(X509_ATTRIBUTE) *ret;
183
184 attr = X509_ATTRIBUTE_create_by_NID(NULL, nid, type, bytes, len);
185 if (!attr)
186 return 0;
187 ret = X509at_add1_attr(x, attr);
188 X509_ATTRIBUTE_free(attr);
189 return ret;
190}
191
192STACK_OF(X509_ATTRIBUTE) *
193X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x, const char *attrname,
194 int type, const unsigned char *bytes, int len)
195{
196 X509_ATTRIBUTE *attr;
197 STACK_OF(X509_ATTRIBUTE) *ret;
198
199 attr = X509_ATTRIBUTE_create_by_txt(NULL, attrname, type, bytes, len);
200 if (!attr)
201 return 0;
202 ret = X509at_add1_attr(x, attr);
203 X509_ATTRIBUTE_free(attr);
204 return ret;
205}
206
207void *
208X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x, ASN1_OBJECT *obj,
209 int lastpos, int type)
210{
211 int i;
212 X509_ATTRIBUTE *at;
213
214 i = X509at_get_attr_by_OBJ(x, obj, lastpos);
215 if (i == -1)
216 return NULL;
217 if ((lastpos <= -2) && (X509at_get_attr_by_OBJ(x, obj, i) != -1))
218 return NULL;
219 at = X509at_get_attr(x, i);
220 if (lastpos <= -3 && (X509_ATTRIBUTE_count(at) != 1))
221 return NULL;
222 return X509_ATTRIBUTE_get0_data(at, 0, type, NULL);
223}
224
225X509_ATTRIBUTE *
226X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid, int atrtype,
227 const void *data, int len)
228{
229 ASN1_OBJECT *obj;
230 X509_ATTRIBUTE *ret;
231
232 obj = OBJ_nid2obj(nid);
233 if (obj == NULL) {
234 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_NID,
235 X509_R_UNKNOWN_NID);
236 return (NULL);
237 }
238 ret = X509_ATTRIBUTE_create_by_OBJ(attr, obj, atrtype, data, len);
239 if (ret == NULL)
240 ASN1_OBJECT_free(obj);
241 return (ret);
242}
243
244X509_ATTRIBUTE *
245X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr, const ASN1_OBJECT *obj,
246 int atrtype, const void *data, int len)
247{
248 X509_ATTRIBUTE *ret;
249
250 if ((attr == NULL) || (*attr == NULL)) {
251 if ((ret = X509_ATTRIBUTE_new()) == NULL) {
252 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ,
253 ERR_R_MALLOC_FAILURE);
254 return (NULL);
255 }
256 } else
257 ret= *attr;
258
259 if (!X509_ATTRIBUTE_set1_object(ret, obj))
260 goto err;
261 if (!X509_ATTRIBUTE_set1_data(ret, atrtype, data, len))
262 goto err;
263
264 if ((attr != NULL) && (*attr == NULL))
265 *attr = ret;
266 return (ret);
267
268err:
269 if ((attr == NULL) || (ret != *attr))
270 X509_ATTRIBUTE_free(ret);
271 return (NULL);
272}
273
274X509_ATTRIBUTE *
275X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr, const char *atrname,
276 int type, const unsigned char *bytes, int len)
277{
278 ASN1_OBJECT *obj;
279 X509_ATTRIBUTE *nattr;
280
281 obj = OBJ_txt2obj(atrname, 0);
282 if (obj == NULL) {
283 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
284 X509_R_INVALID_FIELD_NAME);
285 ERR_asprintf_error_data("name=%s", atrname);
286 return (NULL);
287 }
288 nattr = X509_ATTRIBUTE_create_by_OBJ(attr, obj, type, bytes, len);
289 ASN1_OBJECT_free(obj);
290 return nattr;
291}
292
293int
294X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj)
295{
296 if ((attr == NULL) || (obj == NULL))
297 return (0);
298 ASN1_OBJECT_free(attr->object);
299 attr->object = OBJ_dup(obj);
300 return (1);
301}
302
303int
304X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data,
305 int len)
306{
307 ASN1_TYPE *ttmp = NULL;
308 ASN1_STRING *stmp = NULL;
309 int atype = 0;
310
311 if (!attr)
312 return 0;
313 if (attrtype & MBSTRING_FLAG) {
314 stmp = ASN1_STRING_set_by_NID(NULL, data, len, attrtype,
315 OBJ_obj2nid(attr->object));
316 if (!stmp) {
317 X509err(X509_F_X509_ATTRIBUTE_SET1_DATA,
318 ERR_R_ASN1_LIB);
319 return 0;
320 }
321 atype = stmp->type;
322 } else if (len != -1){
323 if (!(stmp = ASN1_STRING_type_new(attrtype)))
324 goto err;
325 if (!ASN1_STRING_set(stmp, data, len))
326 goto err;
327 atype = attrtype;
328 }
329 if (!(attr->value.set = sk_ASN1_TYPE_new_null()))
330 goto err;
331 attr->single = 0;
332 /* This is a bit naughty because the attribute should really have
333 * at least one value but some types use and zero length SET and
334 * require this.
335 */
336 if (attrtype == 0) {
337 ASN1_STRING_free(stmp);
338 return 1;
339 }
340
341 if (!(ttmp = ASN1_TYPE_new()))
342 goto err;
343 if ((len == -1) && !(attrtype & MBSTRING_FLAG)) {
344 if (!ASN1_TYPE_set1(ttmp, attrtype, data))
345 goto err;
346 } else
347 ASN1_TYPE_set(ttmp, atype, stmp);
348 if (!sk_ASN1_TYPE_push(attr->value.set, ttmp))
349 goto err;
350 return 1;
351
352err:
353 ASN1_TYPE_free(ttmp);
354 ASN1_STRING_free(stmp);
355 X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_MALLOC_FAILURE);
356 return 0;
357}
358
359int
360X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr)
361{
362 if (!attr->single)
363 return sk_ASN1_TYPE_num(attr->value.set);
364 if (attr->value.single)
365 return 1;
366 return 0;
367}
368
369ASN1_OBJECT *
370X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr)
371{
372 if (attr == NULL)
373 return (NULL);
374 return (attr->object);
375}
376
377void *
378X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx, int atrtype, void *data)
379{
380 ASN1_TYPE *ttmp;
381
382 ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
383 if (!ttmp)
384 return NULL;
385 if (atrtype != ASN1_TYPE_get(ttmp)){
386 X509err(X509_F_X509_ATTRIBUTE_GET0_DATA, X509_R_WRONG_TYPE);
387 return NULL;
388 }
389 return ttmp->value.ptr;
390}
391
392ASN1_TYPE *
393X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx)
394{
395 if (attr == NULL)
396 return (NULL);
397 if (idx >= X509_ATTRIBUTE_count(attr))
398 return NULL;
399 if (!attr->single)
400 return sk_ASN1_TYPE_value(attr->value.set, idx);
401 else
402 return attr->value.single;
403}
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
deleted file mode 100644
index 030e29bde7..0000000000
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ /dev/null
@@ -1,369 +0,0 @@
1/* $OpenBSD: x509_cmp.c,v 1.25 2014/09/26 19:31:09 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <ctype.h>
60#include <stdio.h>
61#include <string.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/asn1.h>
66#include <openssl/err.h>
67#include <openssl/objects.h>
68#include <openssl/x509.h>
69#include <openssl/x509v3.h>
70
71int
72X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
73{
74 int i;
75 X509_CINF *ai, *bi;
76
77 ai = a->cert_info;
78 bi = b->cert_info;
79 i = M_ASN1_INTEGER_cmp(ai->serialNumber, bi->serialNumber);
80 if (i)
81 return (i);
82 return (X509_NAME_cmp(ai->issuer, bi->issuer));
83}
84
85#ifndef OPENSSL_NO_MD5
86unsigned long
87X509_issuer_and_serial_hash(X509 *a)
88{
89 unsigned long ret = 0;
90 EVP_MD_CTX ctx;
91 unsigned char md[16];
92 char *f;
93
94 EVP_MD_CTX_init(&ctx);
95 f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0);
96 if (f == NULL)
97 goto err;
98 if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
99 goto err;
100 if (!EVP_DigestUpdate(&ctx, (unsigned char *)f, strlen(f)))
101 goto err;
102 free(f);
103 f = NULL;
104 if (!EVP_DigestUpdate(&ctx,
105 (unsigned char *)a->cert_info->serialNumber->data,
106 (unsigned long)a->cert_info->serialNumber->length))
107 goto err;
108 if (!EVP_DigestFinal_ex(&ctx, &(md[0]), NULL))
109 goto err;
110 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
111 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
112 0xffffffffL;
113
114err:
115 EVP_MD_CTX_cleanup(&ctx);
116 free(f);
117 return (ret);
118}
119#endif
120
121int
122X509_issuer_name_cmp(const X509 *a, const X509 *b)
123{
124 return (X509_NAME_cmp(a->cert_info->issuer, b->cert_info->issuer));
125}
126
127int
128X509_subject_name_cmp(const X509 *a, const X509 *b)
129{
130 return (X509_NAME_cmp(a->cert_info->subject, b->cert_info->subject));
131}
132
133int
134X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
135{
136 return (X509_NAME_cmp(a->crl->issuer, b->crl->issuer));
137}
138
139#ifndef OPENSSL_NO_SHA
140int
141X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
142{
143 return memcmp(a->sha1_hash, b->sha1_hash, 20);
144}
145#endif
146
147X509_NAME *
148X509_get_issuer_name(X509 *a)
149{
150 return (a->cert_info->issuer);
151}
152
153unsigned long
154X509_issuer_name_hash(X509 *x)
155{
156 return (X509_NAME_hash(x->cert_info->issuer));
157}
158
159#ifndef OPENSSL_NO_MD5
160unsigned long
161X509_issuer_name_hash_old(X509 *x)
162{
163 return (X509_NAME_hash_old(x->cert_info->issuer));
164}
165#endif
166
167X509_NAME *
168X509_get_subject_name(X509 *a)
169{
170 return (a->cert_info->subject);
171}
172
173ASN1_INTEGER *
174X509_get_serialNumber(X509 *a)
175{
176 return (a->cert_info->serialNumber);
177}
178
179unsigned long
180X509_subject_name_hash(X509 *x)
181{
182 return (X509_NAME_hash(x->cert_info->subject));
183}
184
185#ifndef OPENSSL_NO_MD5
186unsigned long
187X509_subject_name_hash_old(X509 *x)
188{
189 return (X509_NAME_hash_old(x->cert_info->subject));
190}
191#endif
192
193#ifndef OPENSSL_NO_SHA
194/* Compare two certificates: they must be identical for
195 * this to work. NB: Although "cmp" operations are generally
196 * prototyped to take "const" arguments (eg. for use in
197 * STACKs), the way X509 handling is - these operations may
198 * involve ensuring the hashes are up-to-date and ensuring
199 * certain cert information is cached. So this is the point
200 * where the "depth-first" constification tree has to halt
201 * with an evil cast.
202 */
203int
204X509_cmp(const X509 *a, const X509 *b)
205{
206 /* ensure hash is valid */
207 X509_check_purpose((X509 *)a, -1, 0);
208 X509_check_purpose((X509 *)b, -1, 0);
209
210 return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
211}
212#endif
213
214int
215X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
216{
217 int ret;
218
219 /* Ensure canonical encoding is present and up to date */
220 if (!a->canon_enc || a->modified) {
221 ret = i2d_X509_NAME((X509_NAME *)a, NULL);
222 if (ret < 0)
223 return -2;
224 }
225 if (!b->canon_enc || b->modified) {
226 ret = i2d_X509_NAME((X509_NAME *)b, NULL);
227 if (ret < 0)
228 return -2;
229 }
230 ret = a->canon_enclen - b->canon_enclen;
231 if (ret)
232 return ret;
233 return memcmp(a->canon_enc, b->canon_enc, a->canon_enclen);
234}
235
236unsigned long
237X509_NAME_hash(X509_NAME *x)
238{
239 unsigned long ret = 0;
240 unsigned char md[SHA_DIGEST_LENGTH];
241
242 /* Make sure X509_NAME structure contains valid cached encoding */
243 i2d_X509_NAME(x, NULL);
244 if (!EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(),
245 NULL))
246 return 0;
247
248 ret = (((unsigned long)md[0]) | ((unsigned long)md[1] << 8L) |
249 ((unsigned long)md[2] << 16L) | ((unsigned long)md[3] << 24L)) &
250 0xffffffffL;
251 return (ret);
252}
253
254
255#ifndef OPENSSL_NO_MD5
256/* I now DER encode the name and hash it. Since I cache the DER encoding,
257 * this is reasonably efficient. */
258
259unsigned long
260X509_NAME_hash_old(X509_NAME *x)
261{
262 EVP_MD_CTX md_ctx;
263 unsigned long ret = 0;
264 unsigned char md[16];
265
266 /* Make sure X509_NAME structure contains valid cached encoding */
267 i2d_X509_NAME(x, NULL);
268 EVP_MD_CTX_init(&md_ctx);
269 if (EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL) &&
270 EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length) &&
271 EVP_DigestFinal_ex(&md_ctx, md, NULL))
272 ret = (((unsigned long)md[0]) |
273 ((unsigned long)md[1] << 8L) |
274 ((unsigned long)md[2] << 16L) |
275 ((unsigned long)md[3] << 24L)) &
276 0xffffffffL;
277 EVP_MD_CTX_cleanup(&md_ctx);
278
279 return (ret);
280}
281#endif
282
283/* Search a stack of X509 for a match */
284X509 *
285X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
286 ASN1_INTEGER *serial)
287{
288 int i;
289 X509_CINF cinf;
290 X509 x, *x509 = NULL;
291
292 if (!sk)
293 return NULL;
294
295 x.cert_info = &cinf;
296 cinf.serialNumber = serial;
297 cinf.issuer = name;
298
299 for (i = 0; i < sk_X509_num(sk); i++) {
300 x509 = sk_X509_value(sk, i);
301 if (X509_issuer_and_serial_cmp(x509, &x) == 0)
302 return (x509);
303 }
304 return (NULL);
305}
306
307X509 *
308X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name)
309{
310 X509 *x509;
311 int i;
312
313 for (i = 0; i < sk_X509_num(sk); i++) {
314 x509 = sk_X509_value(sk, i);
315 if (X509_NAME_cmp(X509_get_subject_name(x509), name) == 0)
316 return (x509);
317 }
318 return (NULL);
319}
320
321EVP_PKEY *
322X509_get_pubkey(X509 *x)
323{
324 if ((x == NULL) || (x->cert_info == NULL))
325 return (NULL);
326 return (X509_PUBKEY_get(x->cert_info->key));
327}
328
329ASN1_BIT_STRING *
330X509_get0_pubkey_bitstr(const X509 *x)
331{
332 if (!x)
333 return NULL;
334 return x->cert_info->key->public_key;
335}
336
337int
338X509_check_private_key(X509 *x, EVP_PKEY *k)
339{
340 EVP_PKEY *xk;
341 int ret;
342
343 xk = X509_get_pubkey(x);
344
345 if (xk)
346 ret = EVP_PKEY_cmp(xk, k);
347 else
348 ret = -2;
349
350 switch (ret) {
351 case 1:
352 break;
353 case 0:
354 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
355 X509_R_KEY_VALUES_MISMATCH);
356 break;
357 case -1:
358 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
359 X509_R_KEY_TYPE_MISMATCH);
360 break;
361 case -2:
362 X509err(X509_F_X509_CHECK_PRIVATE_KEY,
363 X509_R_UNKNOWN_KEY_TYPE);
364 }
365 EVP_PKEY_free(xk);
366 if (ret > 0)
367 return 1;
368 return 0;
369}
diff --git a/src/lib/libcrypto/x509/x509_d2.c b/src/lib/libcrypto/x509/x509_d2.c
deleted file mode 100644
index 5b0f80adda..0000000000
--- a/src/lib/libcrypto/x509/x509_d2.c
+++ /dev/null
@@ -1,128 +0,0 @@
1/* $OpenBSD: x509_d2.c,v 1.10 2015/01/22 09:06:39 reyk Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <sys/uio.h>
61
62#include <openssl/crypto.h>
63#include <openssl/err.h>
64#include <openssl/x509.h>
65
66int
67X509_STORE_set_default_paths(X509_STORE *ctx)
68{
69 X509_LOOKUP *lookup;
70
71 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
72 if (lookup == NULL)
73 return (0);
74 X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
75
76 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
77 if (lookup == NULL)
78 return (0);
79 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
80
81 /* clear any errors */
82 ERR_clear_error();
83
84 return (1);
85}
86
87int
88X509_STORE_load_locations(X509_STORE *ctx, const char *file, const char *path)
89{
90 X509_LOOKUP *lookup;
91
92 if (file != NULL) {
93 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
94 if (lookup == NULL)
95 return (0);
96 if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)
97 return (0);
98 }
99 if (path != NULL) {
100 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
101 if (lookup == NULL)
102 return (0);
103 if (X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1)
104 return (0);
105 }
106 if ((path == NULL) && (file == NULL))
107 return (0);
108 return (1);
109}
110
111int
112X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len)
113{
114 X509_LOOKUP *lookup;
115 struct iovec iov;
116
117 lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_mem());
118 if (lookup == NULL)
119 return (0);
120
121 iov.iov_base = buf;
122 iov.iov_len = len;
123
124 if (X509_LOOKUP_add_mem(lookup, &iov, X509_FILETYPE_PEM) != 1)
125 return (0);
126
127 return (1);
128}
diff --git a/src/lib/libcrypto/x509/x509_def.c b/src/lib/libcrypto/x509/x509_def.c
deleted file mode 100644
index 5e570eb9a2..0000000000
--- a/src/lib/libcrypto/x509/x509_def.c
+++ /dev/null
@@ -1,98 +0,0 @@
1/* $OpenBSD: x509_def.c,v 1.5 2014/06/12 15:49:31 deraadt Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include "cryptlib.h"
61#include <openssl/crypto.h>
62#include <openssl/x509.h>
63
64const char *
65X509_get_default_private_dir(void)
66{
67 return (X509_PRIVATE_DIR);
68}
69
70const char *
71X509_get_default_cert_area(void)
72{
73 return (X509_CERT_AREA);
74}
75
76const char *
77X509_get_default_cert_dir(void)
78{
79 return (X509_CERT_DIR);
80}
81
82const char *
83X509_get_default_cert_file(void)
84{
85 return (X509_CERT_FILE);
86}
87
88const char *
89X509_get_default_cert_dir_env(void)
90{
91 return (X509_CERT_DIR_EVP);
92}
93
94const char *
95X509_get_default_cert_file_env(void)
96{
97 return (X509_CERT_FILE_EVP);
98}
diff --git a/src/lib/libcrypto/x509/x509_err.c b/src/lib/libcrypto/x509/x509_err.c
deleted file mode 100644
index 6a15ac9fd0..0000000000
--- a/src/lib/libcrypto/x509/x509_err.c
+++ /dev/null
@@ -1,164 +0,0 @@
1/* $OpenBSD: x509_err.c,v 1.12 2014/07/10 22:45:58 jsing Exp $ */
2/* ====================================================================
3 * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@OpenSSL.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 *
50 * This product includes cryptographic software written by Eric Young
51 * (eay@cryptsoft.com). This product includes software written by Tim
52 * Hudson (tjh@cryptsoft.com).
53 *
54 */
55
56/* NOTE: this file was auto generated by the mkerr.pl script: any changes
57 * made to it will be overwritten when the script next updates this file,
58 * only reason strings will be preserved.
59 */
60
61#include <stdio.h>
62
63#include <openssl/opensslconf.h>
64
65#include <openssl/err.h>
66#include <openssl/x509.h>
67
68/* BEGIN ERROR CODES */
69#ifndef OPENSSL_NO_ERR
70
71#define ERR_FUNC(func) ERR_PACK(ERR_LIB_X509,func,0)
72#define ERR_REASON(reason) ERR_PACK(ERR_LIB_X509,0,reason)
73
74static ERR_STRING_DATA X509_str_functs[] = {
75 {ERR_FUNC(X509_F_ADD_CERT_DIR), "ADD_CERT_DIR"},
76 {ERR_FUNC(X509_F_BY_FILE_CTRL), "BY_FILE_CTRL"},
77 {ERR_FUNC(X509_F_CHECK_POLICY), "CHECK_POLICY"},
78 {ERR_FUNC(X509_F_DIR_CTRL), "DIR_CTRL"},
79 {ERR_FUNC(X509_F_GET_CERT_BY_SUBJECT), "GET_CERT_BY_SUBJECT"},
80 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_DECODE), "NETSCAPE_SPKI_b64_decode"},
81 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_ENCODE), "NETSCAPE_SPKI_b64_encode"},
82 {ERR_FUNC(X509_F_X509AT_ADD1_ATTR), "X509at_add1_attr"},
83 {ERR_FUNC(X509_F_X509V3_ADD_EXT), "X509v3_add_ext"},
84 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_NID), "X509_ATTRIBUTE_create_by_NID"},
85 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ), "X509_ATTRIBUTE_create_by_OBJ"},
86 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT), "X509_ATTRIBUTE_create_by_txt"},
87 {ERR_FUNC(X509_F_X509_ATTRIBUTE_GET0_DATA), "X509_ATTRIBUTE_get0_data"},
88 {ERR_FUNC(X509_F_X509_ATTRIBUTE_SET1_DATA), "X509_ATTRIBUTE_set1_data"},
89 {ERR_FUNC(X509_F_X509_CHECK_PRIVATE_KEY), "X509_check_private_key"},
90 {ERR_FUNC(X509_F_X509_CRL_PRINT_FP), "X509_CRL_print_fp"},
91 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_NID), "X509_EXTENSION_create_by_NID"},
92 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_OBJ), "X509_EXTENSION_create_by_OBJ"},
93 {ERR_FUNC(X509_F_X509_GET_PUBKEY_PARAMETERS), "X509_get_pubkey_parameters"},
94 {ERR_FUNC(X509_F_X509_LOAD_CERT_CRL_FILE), "X509_load_cert_crl_file"},
95 {ERR_FUNC(X509_F_X509_LOAD_CERT_FILE), "X509_load_cert_file"},
96 {ERR_FUNC(X509_F_X509_LOAD_CRL_FILE), "X509_load_crl_file"},
97 {ERR_FUNC(X509_F_X509_NAME_ADD_ENTRY), "X509_NAME_add_entry"},
98 {ERR_FUNC(X509_F_X509_NAME_ENTRY_CREATE_BY_NID), "X509_NAME_ENTRY_create_by_NID"},
99 {ERR_FUNC(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT), "X509_NAME_ENTRY_create_by_txt"},
100 {ERR_FUNC(X509_F_X509_NAME_ENTRY_SET_OBJECT), "X509_NAME_ENTRY_set_object"},
101 {ERR_FUNC(X509_F_X509_NAME_ONELINE), "X509_NAME_oneline"},
102 {ERR_FUNC(X509_F_X509_NAME_PRINT), "X509_NAME_print"},
103 {ERR_FUNC(X509_F_X509_PRINT_EX_FP), "X509_print_ex_fp"},
104 {ERR_FUNC(X509_F_X509_PUBKEY_GET), "X509_PUBKEY_get"},
105 {ERR_FUNC(X509_F_X509_PUBKEY_SET), "X509_PUBKEY_set"},
106 {ERR_FUNC(X509_F_X509_REQ_CHECK_PRIVATE_KEY), "X509_REQ_check_private_key"},
107 {ERR_FUNC(X509_F_X509_REQ_PRINT_EX), "X509_REQ_print_ex"},
108 {ERR_FUNC(X509_F_X509_REQ_PRINT_FP), "X509_REQ_print_fp"},
109 {ERR_FUNC(X509_F_X509_REQ_TO_X509), "X509_REQ_to_X509"},
110 {ERR_FUNC(X509_F_X509_STORE_ADD_CERT), "X509_STORE_add_cert"},
111 {ERR_FUNC(X509_F_X509_STORE_ADD_CRL), "X509_STORE_add_crl"},
112 {ERR_FUNC(X509_F_X509_STORE_CTX_GET1_ISSUER), "X509_STORE_CTX_get1_issuer"},
113 {ERR_FUNC(X509_F_X509_STORE_CTX_INIT), "X509_STORE_CTX_init"},
114 {ERR_FUNC(X509_F_X509_STORE_CTX_NEW), "X509_STORE_CTX_new"},
115 {ERR_FUNC(X509_F_X509_STORE_CTX_PURPOSE_INHERIT), "X509_STORE_CTX_purpose_inherit"},
116 {ERR_FUNC(X509_F_X509_TO_X509_REQ), "X509_to_X509_REQ"},
117 {ERR_FUNC(X509_F_X509_TRUST_ADD), "X509_TRUST_add"},
118 {ERR_FUNC(X509_F_X509_TRUST_SET), "X509_TRUST_set"},
119 {ERR_FUNC(X509_F_X509_VERIFY_CERT), "X509_verify_cert"},
120 {0, NULL}
121};
122
123static ERR_STRING_DATA X509_str_reasons[] = {
124 {ERR_REASON(X509_R_BAD_X509_FILETYPE) , "bad x509 filetype"},
125 {ERR_REASON(X509_R_BASE64_DECODE_ERROR) , "base64 decode error"},
126 {ERR_REASON(X509_R_CANT_CHECK_DH_KEY) , "cant check dh key"},
127 {ERR_REASON(X509_R_CERT_ALREADY_IN_HASH_TABLE), "cert already in hash table"},
128 {ERR_REASON(X509_R_ERR_ASN1_LIB) , "err asn1 lib"},
129 {ERR_REASON(X509_R_INVALID_DIRECTORY) , "invalid directory"},
130 {ERR_REASON(X509_R_INVALID_FIELD_NAME) , "invalid field name"},
131 {ERR_REASON(X509_R_INVALID_TRUST) , "invalid trust"},
132 {ERR_REASON(X509_R_KEY_TYPE_MISMATCH) , "key type mismatch"},
133 {ERR_REASON(X509_R_KEY_VALUES_MISMATCH) , "key values mismatch"},
134 {ERR_REASON(X509_R_LOADING_CERT_DIR) , "loading cert dir"},
135 {ERR_REASON(X509_R_LOADING_DEFAULTS) , "loading defaults"},
136 {ERR_REASON(X509_R_METHOD_NOT_SUPPORTED) , "method not supported"},
137 {ERR_REASON(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY), "no cert set for us to verify"},
138 {ERR_REASON(X509_R_PUBLIC_KEY_DECODE_ERROR), "public key decode error"},
139 {ERR_REASON(X509_R_PUBLIC_KEY_ENCODE_ERROR), "public key encode error"},
140 {ERR_REASON(X509_R_SHOULD_RETRY) , "should retry"},
141 {ERR_REASON(X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN), "unable to find parameters in chain"},
142 {ERR_REASON(X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY), "unable to get certs public key"},
143 {ERR_REASON(X509_R_UNKNOWN_KEY_TYPE) , "unknown key type"},
144 {ERR_REASON(X509_R_UNKNOWN_NID) , "unknown nid"},
145 {ERR_REASON(X509_R_UNKNOWN_PURPOSE_ID) , "unknown purpose id"},
146 {ERR_REASON(X509_R_UNKNOWN_TRUST_ID) , "unknown trust id"},
147 {ERR_REASON(X509_R_UNSUPPORTED_ALGORITHM), "unsupported algorithm"},
148 {ERR_REASON(X509_R_WRONG_LOOKUP_TYPE) , "wrong lookup type"},
149 {ERR_REASON(X509_R_WRONG_TYPE) , "wrong type"},
150 {0, NULL}
151};
152
153#endif
154
155void
156ERR_load_X509_strings(void)
157{
158#ifndef OPENSSL_NO_ERR
159 if (ERR_func_error_string(X509_str_functs[0].error) == NULL) {
160 ERR_load_strings(0, X509_str_functs);
161 ERR_load_strings(0, X509_str_reasons);
162 }
163#endif
164}
diff --git a/src/lib/libcrypto/x509/x509_ext.c b/src/lib/libcrypto/x509/x509_ext.c
deleted file mode 100644
index e90befaba1..0000000000
--- a/src/lib/libcrypto/x509/x509_ext.c
+++ /dev/null
@@ -1,232 +0,0 @@
1/* $OpenBSD: x509_ext.c,v 1.9 2015/02/10 08:33:10 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/stack.h>
65#include <openssl/x509.h>
66#include <openssl/x509v3.h>
67
68int
69X509_CRL_get_ext_count(X509_CRL *x)
70{
71 return (X509v3_get_ext_count(x->crl->extensions));
72}
73
74int
75X509_CRL_get_ext_by_NID(X509_CRL *x, int nid, int lastpos)
76{
77 return (X509v3_get_ext_by_NID(x->crl->extensions, nid, lastpos));
78}
79
80int
81X509_CRL_get_ext_by_OBJ(X509_CRL *x, ASN1_OBJECT *obj, int lastpos)
82{
83 return (X509v3_get_ext_by_OBJ(x->crl->extensions, obj, lastpos));
84}
85
86int
87X509_CRL_get_ext_by_critical(X509_CRL *x, int crit, int lastpos)
88{
89 return (X509v3_get_ext_by_critical(x->crl->extensions, crit, lastpos));
90}
91
92X509_EXTENSION *
93X509_CRL_get_ext(X509_CRL *x, int loc)
94{
95 return (X509v3_get_ext(x->crl->extensions, loc));
96}
97
98X509_EXTENSION *
99X509_CRL_delete_ext(X509_CRL *x, int loc)
100{
101 return (X509v3_delete_ext(x->crl->extensions, loc));
102}
103
104void *
105X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx)
106{
107 return X509V3_get_d2i(x->crl->extensions, nid, crit, idx);
108}
109
110int
111X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, int crit,
112 unsigned long flags)
113{
114 return X509V3_add1_i2d(&x->crl->extensions, nid, value, crit, flags);
115}
116
117int
118X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc)
119{
120 return (X509v3_add_ext(&(x->crl->extensions), ex, loc) != NULL);
121}
122
123int
124X509_get_ext_count(X509 *x)
125{
126 return (X509v3_get_ext_count(x->cert_info->extensions));
127}
128
129int
130X509_get_ext_by_NID(X509 *x, int nid, int lastpos)
131{
132 return (X509v3_get_ext_by_NID(x->cert_info->extensions, nid, lastpos));
133}
134
135int
136X509_get_ext_by_OBJ(X509 *x, ASN1_OBJECT *obj, int lastpos)
137{
138 return (X509v3_get_ext_by_OBJ(x->cert_info->extensions, obj, lastpos));
139}
140
141int
142X509_get_ext_by_critical(X509 *x, int crit, int lastpos)
143{
144 return (X509v3_get_ext_by_critical(x->cert_info->extensions, crit,
145 lastpos));
146}
147
148X509_EXTENSION *
149X509_get_ext(X509 *x, int loc)
150{
151 return (X509v3_get_ext(x->cert_info->extensions, loc));
152}
153
154X509_EXTENSION *
155X509_delete_ext(X509 *x, int loc)
156{
157 return (X509v3_delete_ext(x->cert_info->extensions, loc));
158}
159
160int
161X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc)
162{
163 return (X509v3_add_ext(&(x->cert_info->extensions), ex, loc) != NULL);
164}
165
166void *
167X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
168{
169 return X509V3_get_d2i(x->cert_info->extensions, nid, crit, idx);
170}
171
172int
173X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit, unsigned long flags)
174{
175 return X509V3_add1_i2d(&x->cert_info->extensions, nid, value, crit,
176 flags);
177}
178
179int
180X509_REVOKED_get_ext_count(X509_REVOKED *x)
181{
182 return (X509v3_get_ext_count(x->extensions));
183}
184
185int
186X509_REVOKED_get_ext_by_NID(X509_REVOKED *x, int nid, int lastpos)
187{
188 return (X509v3_get_ext_by_NID(x->extensions, nid, lastpos));
189}
190
191int
192X509_REVOKED_get_ext_by_OBJ(X509_REVOKED *x, ASN1_OBJECT *obj, int lastpos)
193{
194 return (X509v3_get_ext_by_OBJ(x->extensions, obj, lastpos));
195}
196
197int
198X509_REVOKED_get_ext_by_critical(X509_REVOKED *x, int crit, int lastpos)
199{
200 return (X509v3_get_ext_by_critical(x->extensions, crit, lastpos));
201}
202
203X509_EXTENSION *
204X509_REVOKED_get_ext(X509_REVOKED *x, int loc)
205{
206 return (X509v3_get_ext(x->extensions, loc));
207}
208
209X509_EXTENSION *
210X509_REVOKED_delete_ext(X509_REVOKED *x, int loc)
211{
212 return (X509v3_delete_ext(x->extensions, loc));
213}
214
215int
216X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc)
217{
218 return (X509v3_add_ext(&(x->extensions), ex, loc) != NULL);
219}
220
221void *
222X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx)
223{
224 return X509V3_get_d2i(x->extensions, nid, crit, idx);
225}
226
227int
228X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, void *value, int crit,
229 unsigned long flags)
230{
231 return X509V3_add1_i2d(&x->extensions, nid, value, crit, flags);
232}
diff --git a/src/lib/libcrypto/x509/x509_lcl.h b/src/lib/libcrypto/x509/x509_lcl.h
deleted file mode 100644
index b16df78ad7..0000000000
--- a/src/lib/libcrypto/x509/x509_lcl.h
+++ /dev/null
@@ -1,59 +0,0 @@
1/* x509_lcl.h */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2013.
4 */
5/* ====================================================================
6 * Copyright (c) 2013 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet);
diff --git a/src/lib/libcrypto/x509/x509_lu.c b/src/lib/libcrypto/x509/x509_lu.c
deleted file mode 100644
index e8151b774a..0000000000
--- a/src/lib/libcrypto/x509/x509_lu.c
+++ /dev/null
@@ -1,735 +0,0 @@
1/* $OpenBSD: x509_lu.c,v 1.19 2015/02/10 11:22:21 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/err.h>
62#include <openssl/lhash.h>
63#include <openssl/x509.h>
64#include <openssl/x509v3.h>
65#include "x509_lcl.h"
66
67X509_LOOKUP *
68X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
69{
70 X509_LOOKUP *ret;
71
72 ret = malloc(sizeof(X509_LOOKUP));
73 if (ret == NULL)
74 return NULL;
75
76 ret->init = 0;
77 ret->skip = 0;
78 ret->method = method;
79 ret->method_data = NULL;
80 ret->store_ctx = NULL;
81 if ((method->new_item != NULL) && !method->new_item(ret)) {
82 free(ret);
83 return NULL;
84 }
85 return ret;
86}
87
88void
89X509_LOOKUP_free(X509_LOOKUP *ctx)
90{
91 if (ctx == NULL)
92 return;
93 if ((ctx->method != NULL) && (ctx->method->free != NULL))
94 (*ctx->method->free)(ctx);
95 free(ctx);
96}
97
98int
99X509_LOOKUP_init(X509_LOOKUP *ctx)
100{
101 if (ctx->method == NULL)
102 return 0;
103 if (ctx->method->init != NULL)
104 return ctx->method->init(ctx);
105 else
106 return 1;
107}
108
109int
110X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
111{
112 if (ctx->method == NULL)
113 return 0;
114 if (ctx->method->shutdown != NULL)
115 return ctx->method->shutdown(ctx);
116 else
117 return 1;
118}
119
120int
121X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
122 char **ret)
123{
124 if (ctx->method == NULL)
125 return -1;
126 if (ctx->method->ctrl != NULL)
127 return ctx->method->ctrl(ctx, cmd, argc, argl, ret);
128 else
129 return 1;
130}
131
132int
133X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
134 X509_OBJECT *ret)
135{
136 if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
137 return X509_LU_FAIL;
138 if (ctx->skip)
139 return 0;
140 return ctx->method->get_by_subject(ctx, type, name, ret);
141}
142
143int
144X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
145 ASN1_INTEGER *serial, X509_OBJECT *ret)
146{
147 if ((ctx->method == NULL) ||
148 (ctx->method->get_by_issuer_serial == NULL))
149 return X509_LU_FAIL;
150 return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret);
151}
152
153int
154X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type, unsigned char *bytes,
155 int len, X509_OBJECT *ret)
156{
157 if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL))
158 return X509_LU_FAIL;
159 return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret);
160}
161
162int
163X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, char *str, int len,
164 X509_OBJECT *ret)
165{
166 if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL))
167 return X509_LU_FAIL;
168 return ctx->method->get_by_alias(ctx, type, str, len, ret);
169}
170
171static int
172x509_object_cmp(const X509_OBJECT * const *a, const X509_OBJECT * const *b)
173{
174 int ret;
175
176 ret = ((*a)->type - (*b)->type);
177 if (ret)
178 return ret;
179 switch ((*a)->type) {
180 case X509_LU_X509:
181 ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);
182 break;
183 case X509_LU_CRL:
184 ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);
185 break;
186 default:
187 /* abort(); */
188 return 0;
189 }
190 return ret;
191}
192
193X509_STORE *
194X509_STORE_new(void)
195{
196 X509_STORE *ret;
197
198 if ((ret = malloc(sizeof(X509_STORE))) == NULL)
199 return NULL;
200 ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
201 ret->cache = 1;
202 ret->get_cert_methods = sk_X509_LOOKUP_new_null();
203 ret->verify = 0;
204 ret->verify_cb = 0;
205
206 if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
207 goto err;
208
209 ret->get_issuer = 0;
210 ret->check_issued = 0;
211 ret->check_revocation = 0;
212 ret->get_crl = 0;
213 ret->check_crl = 0;
214 ret->cert_crl = 0;
215 ret->lookup_certs = 0;
216 ret->lookup_crls = 0;
217 ret->cleanup = 0;
218
219 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
220 goto err;
221
222 ret->references = 1;
223 return ret;
224
225err:
226 X509_VERIFY_PARAM_free(ret->param);
227 sk_X509_LOOKUP_free(ret->get_cert_methods);
228 sk_X509_OBJECT_free(ret->objs);
229 free(ret);
230 return NULL;
231}
232
233static void
234cleanup(X509_OBJECT *a)
235{
236 if (a->type == X509_LU_X509) {
237 X509_free(a->data.x509);
238 } else if (a->type == X509_LU_CRL) {
239 X509_CRL_free(a->data.crl);
240 } else {
241 /* abort(); */
242 }
243
244 free(a);
245}
246
247void
248X509_STORE_free(X509_STORE *vfy)
249{
250 int i;
251 STACK_OF(X509_LOOKUP) *sk;
252 X509_LOOKUP *lu;
253
254 if (vfy == NULL)
255 return;
256
257 sk = vfy->get_cert_methods;
258 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
259 lu = sk_X509_LOOKUP_value(sk, i);
260 X509_LOOKUP_shutdown(lu);
261 X509_LOOKUP_free(lu);
262 }
263 sk_X509_LOOKUP_free(sk);
264 sk_X509_OBJECT_pop_free(vfy->objs, cleanup);
265
266 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
267 X509_VERIFY_PARAM_free(vfy->param);
268 free(vfy);
269}
270
271X509_LOOKUP *
272X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
273{
274 int i;
275 STACK_OF(X509_LOOKUP) *sk;
276 X509_LOOKUP *lu;
277
278 sk = v->get_cert_methods;
279 for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
280 lu = sk_X509_LOOKUP_value(sk, i);
281 if (m == lu->method) {
282 return lu;
283 }
284 }
285 /* a new one */
286 lu = X509_LOOKUP_new(m);
287 if (lu == NULL)
288 return NULL;
289 else {
290 lu->store_ctx = v;
291 if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))
292 return lu;
293 else {
294 X509_LOOKUP_free(lu);
295 return NULL;
296 }
297 }
298}
299
300int
301X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
302 X509_OBJECT *ret)
303{
304 X509_STORE *ctx = vs->ctx;
305 X509_LOOKUP *lu;
306 X509_OBJECT stmp, *tmp;
307 int i, j;
308
309 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
310 tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
311 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
312
313 if (tmp == NULL || type == X509_LU_CRL) {
314 for (i = vs->current_method;
315 i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
316 lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
317 j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
318 if (j < 0) {
319 vs->current_method = j;
320 return j;
321 } else if (j) {
322 tmp = &stmp;
323 break;
324 }
325 }
326 vs->current_method = 0;
327 if (tmp == NULL)
328 return 0;
329 }
330
331/* if (ret->data.ptr != NULL)
332 X509_OBJECT_free_contents(ret); */
333
334 ret->type = tmp->type;
335 ret->data.ptr = tmp->data.ptr;
336
337 X509_OBJECT_up_ref_count(ret);
338
339 return 1;
340}
341
342int
343X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
344{
345 X509_OBJECT *obj;
346 int ret = 1;
347
348 if (x == NULL)
349 return 0;
350 obj = malloc(sizeof(X509_OBJECT));
351 if (obj == NULL) {
352 X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
353 return 0;
354 }
355 obj->type = X509_LU_X509;
356 obj->data.x509 = x;
357
358 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
359
360 X509_OBJECT_up_ref_count(obj);
361
362 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
363 X509_OBJECT_free_contents(obj);
364 free(obj);
365 X509err(X509_F_X509_STORE_ADD_CERT,
366 X509_R_CERT_ALREADY_IN_HASH_TABLE);
367 ret = 0;
368 } else
369 sk_X509_OBJECT_push(ctx->objs, obj);
370
371 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
372
373 return ret;
374}
375
376int
377X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
378{
379 X509_OBJECT *obj;
380 int ret = 1;
381
382 if (x == NULL)
383 return 0;
384 obj = malloc(sizeof(X509_OBJECT));
385 if (obj == NULL) {
386 X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
387 return 0;
388 }
389 obj->type = X509_LU_CRL;
390 obj->data.crl = x;
391
392 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
393
394 X509_OBJECT_up_ref_count(obj);
395
396 if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
397 X509_OBJECT_free_contents(obj);
398 free(obj);
399 X509err(X509_F_X509_STORE_ADD_CRL,
400 X509_R_CERT_ALREADY_IN_HASH_TABLE);
401 ret = 0;
402 } else
403 sk_X509_OBJECT_push(ctx->objs, obj);
404
405 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
406
407 return ret;
408}
409
410void
411X509_OBJECT_up_ref_count(X509_OBJECT *a)
412{
413 switch (a->type) {
414 case X509_LU_X509:
415 CRYPTO_add(&a->data.x509->references, 1, CRYPTO_LOCK_X509);
416 break;
417 case X509_LU_CRL:
418 CRYPTO_add(&a->data.crl->references, 1, CRYPTO_LOCK_X509_CRL);
419 break;
420 }
421}
422
423void
424X509_OBJECT_free_contents(X509_OBJECT *a)
425{
426 switch (a->type) {
427 case X509_LU_X509:
428 X509_free(a->data.x509);
429 break;
430 case X509_LU_CRL:
431 X509_CRL_free(a->data.crl);
432 break;
433 }
434}
435
436static int
437x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name,
438 int *pnmatch)
439{
440 X509_OBJECT stmp;
441 X509 x509_s;
442 X509_CINF cinf_s;
443 X509_CRL crl_s;
444 X509_CRL_INFO crl_info_s;
445 int idx;
446
447 stmp.type = type;
448 switch (type) {
449 case X509_LU_X509:
450 stmp.data.x509 = &x509_s;
451 x509_s.cert_info = &cinf_s;
452 cinf_s.subject = name;
453 break;
454 case X509_LU_CRL:
455 stmp.data.crl = &crl_s;
456 crl_s.crl = &crl_info_s;
457 crl_info_s.issuer = name;
458 break;
459 default:
460 /* abort(); */
461 return -1;
462 }
463
464 idx = sk_X509_OBJECT_find(h, &stmp);
465 if (idx >= 0 && pnmatch) {
466 int tidx;
467 const X509_OBJECT *tobj, *pstmp;
468 *pnmatch = 1;
469 pstmp = &stmp;
470 for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
471 tobj = sk_X509_OBJECT_value(h, tidx);
472 if (x509_object_cmp(&tobj, &pstmp))
473 break;
474 (*pnmatch)++;
475 }
476 }
477 return idx;
478}
479
480int
481X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type, X509_NAME *name)
482{
483 return x509_object_idx_cnt(h, type, name, NULL);
484}
485
486X509_OBJECT *
487X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
488 X509_NAME *name)
489{
490 int idx;
491
492 idx = X509_OBJECT_idx_by_subject(h, type, name);
493 if (idx == -1)
494 return NULL;
495 return sk_X509_OBJECT_value(h, idx);
496}
497
498STACK_OF(X509) *
499X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
500{
501 int i, idx, cnt;
502 STACK_OF(X509) *sk;
503 X509 *x;
504 X509_OBJECT *obj;
505
506 sk = sk_X509_new_null();
507 if (sk == NULL)
508 return NULL;
509 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
510 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
511 if (idx < 0) {
512 /* Nothing found in cache: do lookup to possibly add new
513 * objects to cache
514 */
515 X509_OBJECT xobj;
516 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
517 if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
518 sk_X509_free(sk);
519 return NULL;
520 }
521 X509_OBJECT_free_contents(&xobj);
522 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
523 idx = x509_object_idx_cnt(ctx->ctx->objs,
524 X509_LU_X509, nm, &cnt);
525 if (idx < 0) {
526 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
527 sk_X509_free(sk);
528 return NULL;
529 }
530 }
531 for (i = 0; i < cnt; i++, idx++) {
532 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
533 x = obj->data.x509;
534 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
535 if (!sk_X509_push(sk, x)) {
536 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
537 X509_free(x);
538 sk_X509_pop_free(sk, X509_free);
539 return NULL;
540 }
541 }
542 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
543 return sk;
544
545}
546
547STACK_OF(X509_CRL) *
548X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
549{
550 int i, idx, cnt;
551 STACK_OF(X509_CRL) *sk;
552 X509_CRL *x;
553 X509_OBJECT *obj, xobj;
554
555 sk = sk_X509_CRL_new_null();
556 if (sk == NULL)
557 return NULL;
558 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
559 /* Check cache first */
560 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
561
562 /* Always do lookup to possibly add new CRLs to cache
563 */
564 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
565 if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
566 sk_X509_CRL_free(sk);
567 return NULL;
568 }
569 X509_OBJECT_free_contents(&xobj);
570 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
571 idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
572 if (idx < 0) {
573 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
574 sk_X509_CRL_free(sk);
575 return NULL;
576 }
577
578 for (i = 0; i < cnt; i++, idx++) {
579 obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
580 x = obj->data.crl;
581 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
582 if (!sk_X509_CRL_push(sk, x)) {
583 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
584 X509_CRL_free(x);
585 sk_X509_CRL_pop_free(sk, X509_CRL_free);
586 return NULL;
587 }
588 }
589 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
590 return sk;
591}
592
593X509_OBJECT *
594X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
595{
596 int idx, i;
597 X509_OBJECT *obj;
598
599 idx = sk_X509_OBJECT_find(h, x);
600 if (idx == -1)
601 return NULL;
602 if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
603 return sk_X509_OBJECT_value(h, idx);
604 for (i = idx; i < sk_X509_OBJECT_num(h); i++) {
605 obj = sk_X509_OBJECT_value(h, i);
606 if (x509_object_cmp((const X509_OBJECT **)&obj,
607 (const X509_OBJECT **)&x))
608 return NULL;
609 if (x->type == X509_LU_X509) {
610 if (!X509_cmp(obj->data.x509, x->data.x509))
611 return obj;
612 } else if (x->type == X509_LU_CRL) {
613 if (!X509_CRL_match(obj->data.crl, x->data.crl))
614 return obj;
615 } else
616 return obj;
617 }
618 return NULL;
619}
620
621
622/* Try to get issuer certificate from store. Due to limitations
623 * of the API this can only retrieve a single certificate matching
624 * a given subject name. However it will fill the cache with all
625 * matching certificates, so we can examine the cache for all
626 * matches.
627 *
628 * Return values are:
629 * 1 lookup successful.
630 * 0 certificate not found.
631 * -1 some other error.
632 */
633int
634X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
635{
636 X509_NAME *xn;
637 X509_OBJECT obj, *pobj;
638 int i, ok, idx, ret;
639
640 *issuer = NULL;
641 xn = X509_get_issuer_name(x);
642 ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
643 if (ok != X509_LU_X509) {
644 if (ok == X509_LU_RETRY) {
645 X509_OBJECT_free_contents(&obj);
646 X509err(X509_F_X509_STORE_CTX_GET1_ISSUER,
647 X509_R_SHOULD_RETRY);
648 return -1;
649 } else if (ok != X509_LU_FAIL) {
650 X509_OBJECT_free_contents(&obj);
651 /* not good :-(, break anyway */
652 return -1;
653 }
654 return 0;
655 }
656 /* If certificate matches all OK */
657 if (ctx->check_issued(ctx, x, obj.data.x509)) {
658 if (x509_check_cert_time(ctx, obj.data.x509, 1)) {
659 *issuer = obj.data.x509;
660 return 1;
661 }
662 }
663 X509_OBJECT_free_contents(&obj);
664
665 /* Else find index of first cert accepted by 'check_issued' */
666 ret = 0;
667 CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
668 idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
669 if (idx != -1) /* should be true as we've had at least one match */ {
670 /* Look through all matching certs for suitable issuer */
671 for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
672 pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
673 /* See if we've run past the matches */
674 if (pobj->type != X509_LU_X509)
675 break;
676 if (X509_NAME_cmp(xn,
677 X509_get_subject_name(pobj->data.x509)))
678 break;
679 if (ctx->check_issued(ctx, x, pobj->data.x509)) {
680 *issuer = pobj->data.x509;
681 ret = 1;
682 /*
683 * If times check, exit with match,
684 * otherwise keep looking. Leave last
685 * match in issuer so we return nearest
686 * match if no certificate time is OK.
687 */
688 if (x509_check_cert_time(ctx, *issuer, 1))
689 break;
690 }
691 }
692 }
693 CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
694 if (*issuer)
695 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
696 return ret;
697}
698
699int
700X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
701{
702 return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
703}
704
705int
706X509_STORE_set_depth(X509_STORE *ctx, int depth)
707{
708 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
709 return 1;
710}
711
712int
713X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
714{
715 return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
716}
717
718int
719X509_STORE_set_trust(X509_STORE *ctx, int trust)
720{
721 return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
722}
723
724int
725X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
726{
727 return X509_VERIFY_PARAM_set1(ctx->param, param);
728}
729
730void
731X509_STORE_set_verify_cb(X509_STORE *ctx,
732 int (*verify_cb)(int, X509_STORE_CTX *))
733{
734 ctx->verify_cb = verify_cb;
735}
diff --git a/src/lib/libcrypto/x509/x509_obj.c b/src/lib/libcrypto/x509/x509_obj.c
deleted file mode 100644
index f7f2a380a1..0000000000
--- a/src/lib/libcrypto/x509/x509_obj.c
+++ /dev/null
@@ -1,179 +0,0 @@
1/* $OpenBSD: x509_obj.c,v 1.16 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/buffer.h>
63#include <openssl/err.h>
64#include <openssl/lhash.h>
65#include <openssl/objects.h>
66#include <openssl/x509.h>
67
68char *
69X509_NAME_oneline(X509_NAME *a, char *buf, int len)
70{
71 X509_NAME_ENTRY *ne;
72 int i;
73 int n, lold, l, l1, l2, num, j, type;
74 const char *s;
75 char *p;
76 unsigned char *q;
77 BUF_MEM *b = NULL;
78 static const char hex[17] = "0123456789ABCDEF";
79 int gs_doit[4];
80 char tmp_buf[80];
81
82 if (buf == NULL) {
83 if ((b = BUF_MEM_new()) == NULL)
84 goto err;
85 if (!BUF_MEM_grow(b, 200))
86 goto err;
87 b->data[0] = '\0';
88 len = 200;
89 }
90 if (a == NULL) {
91 if (b) {
92 buf = b->data;
93 free(b);
94 }
95 strlcpy(buf, "NO X509_NAME", len);
96 return buf;
97 }
98
99 len--; /* space for '\0' */
100 l = 0;
101 for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
102 ne = sk_X509_NAME_ENTRY_value(a->entries, i);
103 n = OBJ_obj2nid(ne->object);
104 if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {
105 i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);
106 s = tmp_buf;
107 }
108 l1 = strlen(s);
109
110 type = ne->value->type;
111 num = ne->value->length;
112 q = ne->value->data;
113 if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {
114 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;
115 for (j = 0; j < num; j++)
116 if (q[j] != 0)
117 gs_doit[j & 3] = 1;
118
119 if (gs_doit[0]|gs_doit[1]|gs_doit[2])
120 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
121 else {
122 gs_doit[0] = gs_doit[1] = gs_doit[2] = 0;
123 gs_doit[3] = 1;
124 }
125 } else
126 gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 1;
127
128 for (l2 = j=0; j < num; j++) {
129 if (!gs_doit[j&3])
130 continue;
131 l2++;
132 if ((q[j] < ' ') || (q[j] > '~'))
133 l2 += 3;
134 }
135
136 lold = l;
137 l += 1 + l1 + 1 + l2;
138 if (b != NULL) {
139 if (!BUF_MEM_grow(b, l + 1))
140 goto err;
141 p = &(b->data[lold]);
142 } else if (l > len) {
143 break;
144 } else
145 p = &(buf[lold]);
146 *(p++) = '/';
147 memcpy(p, s, l1);
148 p += l1;
149 *(p++) = '=';
150 q = ne->value->data;
151 for (j = 0; j < num; j++) {
152 if (!gs_doit[j & 3])
153 continue;
154 n = q[j];
155 if ((n < ' ') || (n > '~')) {
156 *(p++) = '\\';
157 *(p++) = 'x';
158 *(p++) = hex[(n >> 4) & 0x0f];
159 *(p++) = hex[n & 0x0f];
160 } else
161 *(p++) = n;
162 }
163 *p = '\0';
164 }
165 if (b != NULL) {
166 p = b->data;
167 free(b);
168 } else
169 p = buf;
170 if (i == 0)
171 *p = '\0';
172 return (p);
173
174err:
175 X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
176 if (b != NULL)
177 BUF_MEM_free(b);
178 return (NULL);
179}
diff --git a/src/lib/libcrypto/x509/x509_r2x.c b/src/lib/libcrypto/x509/x509_r2x.c
deleted file mode 100644
index 9a9a59d9bb..0000000000
--- a/src/lib/libcrypto/x509/x509_r2x.c
+++ /dev/null
@@ -1,115 +0,0 @@
1/* $OpenBSD: x509_r2x.c,v 1.9 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/bn.h>
63#include <openssl/buffer.h>
64#include <openssl/err.h>
65#include <openssl/evp.h>
66#include <openssl/objects.h>
67#include <openssl/x509.h>
68
69X509 *
70X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
71{
72 X509 *ret = NULL;
73 X509_CINF *xi = NULL;
74 X509_NAME *xn;
75
76 if ((ret = X509_new()) == NULL) {
77 X509err(X509_F_X509_REQ_TO_X509, ERR_R_MALLOC_FAILURE);
78 goto err;
79 }
80
81 /* duplicate the request */
82 xi = ret->cert_info;
83
84 if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0) {
85 if ((xi->version = M_ASN1_INTEGER_new()) == NULL)
86 goto err;
87 if (!ASN1_INTEGER_set(xi->version, 2))
88 goto err;
89/* xi->extensions=ri->attributes; <- bad, should not ever be done
90 ri->attributes=NULL; */
91 }
92
93 xn = X509_REQ_get_subject_name(r);
94 if (X509_set_subject_name(ret, X509_NAME_dup(xn)) == 0)
95 goto err;
96 if (X509_set_issuer_name(ret, X509_NAME_dup(xn)) == 0)
97 goto err;
98
99 if (X509_gmtime_adj(xi->validity->notBefore, 0) == NULL)
100 goto err;
101 if (X509_gmtime_adj(xi->validity->notAfter,
102 (long)60 * 60 * 24 * days) == NULL)
103 goto err;
104
105 X509_set_pubkey(ret, X509_REQ_get_pubkey(r));
106
107 if (!X509_sign(ret, pkey, EVP_md5()))
108 goto err;
109 if (0) {
110err:
111 X509_free(ret);
112 ret = NULL;
113 }
114 return (ret);
115}
diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
deleted file mode 100644
index 452ce0a512..0000000000
--- a/src/lib/libcrypto/x509/x509_req.c
+++ /dev/null
@@ -1,345 +0,0 @@
1/* $OpenBSD: x509_req.c,v 1.16 2014/09/28 10:50:33 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/asn1.h>
64#include <openssl/asn1t.h>
65#include <openssl/bn.h>
66#include <openssl/buffer.h>
67#include <openssl/err.h>
68#include <openssl/evp.h>
69#include <openssl/objects.h>
70#include <openssl/pem.h>
71#include <openssl/x509.h>
72
73X509_REQ *
74X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
75{
76 X509_REQ *ret;
77 X509_REQ_INFO *ri;
78 int i;
79 EVP_PKEY *pktmp;
80
81 ret = X509_REQ_new();
82 if (ret == NULL) {
83 X509err(X509_F_X509_TO_X509_REQ, ERR_R_MALLOC_FAILURE);
84 goto err;
85 }
86
87 ri = ret->req_info;
88
89 if ((ri->version = M_ASN1_INTEGER_new()) == NULL)
90 goto err;
91 if (ASN1_INTEGER_set(ri->version, 0) == 0)
92 goto err;
93
94 if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
95 goto err;
96
97 pktmp = X509_get_pubkey(x);
98 i = X509_REQ_set_pubkey(ret, pktmp);
99 EVP_PKEY_free(pktmp);
100 if (!i)
101 goto err;
102
103 if (pkey != NULL) {
104 if (!X509_REQ_sign(ret, pkey, md))
105 goto err;
106 }
107 return (ret);
108
109err:
110 X509_REQ_free(ret);
111 return (NULL);
112}
113
114EVP_PKEY *
115X509_REQ_get_pubkey(X509_REQ *req)
116{
117 if ((req == NULL) || (req->req_info == NULL))
118 return (NULL);
119 return (X509_PUBKEY_get(req->req_info->pubkey));
120}
121
122int
123X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
124{
125 EVP_PKEY *xk = NULL;
126 int ok = 0;
127
128 xk = X509_REQ_get_pubkey(x);
129 switch (EVP_PKEY_cmp(xk, k)) {
130 case 1:
131 ok = 1;
132 break;
133 case 0:
134 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
135 X509_R_KEY_VALUES_MISMATCH);
136 break;
137 case -1:
138 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
139 X509_R_KEY_TYPE_MISMATCH);
140 break;
141 case -2:
142#ifndef OPENSSL_NO_EC
143 if (k->type == EVP_PKEY_EC) {
144 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
145 ERR_R_EC_LIB);
146 break;
147 }
148#endif
149#ifndef OPENSSL_NO_DH
150 if (k->type == EVP_PKEY_DH) {
151 /* No idea */
152 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
153 X509_R_CANT_CHECK_DH_KEY);
154 break;
155 }
156#endif
157 X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,
158 X509_R_UNKNOWN_KEY_TYPE);
159 }
160
161 EVP_PKEY_free(xk);
162 return (ok);
163}
164
165/* It seems several organisations had the same idea of including a list of
166 * extensions in a certificate request. There are at least two OIDs that are
167 * used and there may be more: so the list is configurable.
168 */
169
170static int ext_nid_list[] = {NID_ext_req, NID_ms_ext_req, NID_undef};
171
172static int *ext_nids = ext_nid_list;
173
174int
175X509_REQ_extension_nid(int req_nid)
176{
177 int i, nid;
178
179 for (i = 0; ; i++) {
180 nid = ext_nids[i];
181 if (nid == NID_undef)
182 return 0;
183 else if (req_nid == nid)
184 return 1;
185 }
186}
187
188int *
189X509_REQ_get_extension_nids(void)
190{
191 return ext_nids;
192}
193
194void
195X509_REQ_set_extension_nids(int *nids)
196{
197 ext_nids = nids;
198}
199
200STACK_OF(X509_EXTENSION) *
201X509_REQ_get_extensions(X509_REQ *req)
202{
203 X509_ATTRIBUTE *attr;
204 ASN1_TYPE *ext = NULL;
205 int idx, *pnid;
206 const unsigned char *p;
207
208 if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
209 return (NULL);
210 for (pnid = ext_nids; *pnid != NID_undef; pnid++) {
211 idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
212 if (idx == -1)
213 continue;
214 attr = X509_REQ_get_attr(req, idx);
215 if (attr->single)
216 ext = attr->value.single;
217 else if (sk_ASN1_TYPE_num(attr->value.set))
218 ext = sk_ASN1_TYPE_value(attr->value.set, 0);
219 break;
220 }
221 if (!ext || (ext->type != V_ASN1_SEQUENCE))
222 return NULL;
223 p = ext->value.sequence->data;
224 return (STACK_OF(X509_EXTENSION) *)ASN1_item_d2i(NULL, &p,
225 ext->value.sequence->length, ASN1_ITEM_rptr(X509_EXTENSIONS));
226}
227
228/* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
229 * in case we want to create a non standard one.
230 */
231
232int
233X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
234 int nid)
235{
236 ASN1_TYPE *at = NULL;
237 X509_ATTRIBUTE *attr = NULL;
238
239 if (!(at = ASN1_TYPE_new()) ||
240 !(at->value.sequence = ASN1_STRING_new()))
241 goto err;
242
243 at->type = V_ASN1_SEQUENCE;
244 /* Generate encoding of extensions */
245 at->value.sequence->length = ASN1_item_i2d((ASN1_VALUE *)exts,
246 &at->value.sequence->data, ASN1_ITEM_rptr(X509_EXTENSIONS));
247 if (!(attr = X509_ATTRIBUTE_new()))
248 goto err;
249 if (!(attr->value.set = sk_ASN1_TYPE_new_null()))
250 goto err;
251 if (!sk_ASN1_TYPE_push(attr->value.set, at))
252 goto err;
253 at = NULL;
254 attr->single = 0;
255 attr->object = OBJ_nid2obj(nid);
256 if (!req->req_info->attributes) {
257 if (!(req->req_info->attributes = sk_X509_ATTRIBUTE_new_null()))
258 goto err;
259 }
260 if (!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr))
261 goto err;
262 return 1;
263
264err:
265 X509_ATTRIBUTE_free(attr);
266 ASN1_TYPE_free(at);
267 return 0;
268}
269
270/* This is the normal usage: use the "official" OID */
271int
272X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts)
273{
274 return X509_REQ_add_extensions_nid(req, exts, NID_ext_req);
275}
276
277/* Request attribute functions */
278
279int
280X509_REQ_get_attr_count(const X509_REQ *req)
281{
282 return X509at_get_attr_count(req->req_info->attributes);
283}
284
285int
286X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos)
287{
288 return X509at_get_attr_by_NID(req->req_info->attributes, nid, lastpos);
289}
290
291int
292X509_REQ_get_attr_by_OBJ(const X509_REQ *req, ASN1_OBJECT *obj, int lastpos)
293{
294 return X509at_get_attr_by_OBJ(req->req_info->attributes, obj, lastpos);
295}
296
297X509_ATTRIBUTE *
298X509_REQ_get_attr(const X509_REQ *req, int loc)
299{
300 return X509at_get_attr(req->req_info->attributes, loc);
301}
302
303X509_ATTRIBUTE *
304X509_REQ_delete_attr(X509_REQ *req, int loc)
305{
306 return X509at_delete_attr(req->req_info->attributes, loc);
307}
308
309int
310X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr)
311{
312 if (X509at_add1_attr(&req->req_info->attributes, attr))
313 return 1;
314 return 0;
315}
316
317int
318X509_REQ_add1_attr_by_OBJ(X509_REQ *req, const ASN1_OBJECT *obj, int type,
319 const unsigned char *bytes, int len)
320{
321 if (X509at_add1_attr_by_OBJ(&req->req_info->attributes, obj,
322 type, bytes, len))
323 return 1;
324 return 0;
325}
326
327int
328X509_REQ_add1_attr_by_NID(X509_REQ *req, int nid, int type,
329 const unsigned char *bytes, int len)
330{
331 if (X509at_add1_attr_by_NID(&req->req_info->attributes, nid,
332 type, bytes, len))
333 return 1;
334 return 0;
335}
336
337int
338X509_REQ_add1_attr_by_txt(X509_REQ *req, const char *attrname, int type,
339 const unsigned char *bytes, int len)
340{
341 if (X509at_add1_attr_by_txt(&req->req_info->attributes, attrname,
342 type, bytes, len))
343 return 1;
344 return 0;
345}
diff --git a/src/lib/libcrypto/x509/x509_set.c b/src/lib/libcrypto/x509/x509_set.c
deleted file mode 100644
index 3be557cbc0..0000000000
--- a/src/lib/libcrypto/x509/x509_set.c
+++ /dev/null
@@ -1,154 +0,0 @@
1/* $OpenBSD: x509_set.c,v 1.9 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_set_version(X509 *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 if (x->cert_info->version == NULL) {
72 if ((x->cert_info->version = M_ASN1_INTEGER_new()) == NULL)
73 return (0);
74 }
75 return (ASN1_INTEGER_set(x->cert_info->version, version));
76}
77
78int
79X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
80{
81 ASN1_INTEGER *in;
82
83 if (x == NULL)
84 return (0);
85 in = x->cert_info->serialNumber;
86 if (in != serial) {
87 in = M_ASN1_INTEGER_dup(serial);
88 if (in != NULL) {
89 M_ASN1_INTEGER_free(x->cert_info->serialNumber);
90 x->cert_info->serialNumber = in;
91 }
92 }
93 return (in != NULL);
94}
95
96int
97X509_set_issuer_name(X509 *x, X509_NAME *name)
98{
99 if ((x == NULL) || (x->cert_info == NULL))
100 return (0);
101 return (X509_NAME_set(&x->cert_info->issuer, name));
102}
103
104int
105X509_set_subject_name(X509 *x, X509_NAME *name)
106{
107 if ((x == NULL) || (x->cert_info == NULL))
108 return (0);
109 return (X509_NAME_set(&x->cert_info->subject, name));
110}
111
112int
113X509_set_notBefore(X509 *x, const ASN1_TIME *tm)
114{
115 ASN1_TIME *in;
116
117 if ((x == NULL) || (x->cert_info->validity == NULL))
118 return (0);
119 in = x->cert_info->validity->notBefore;
120 if (in != tm) {
121 in = M_ASN1_TIME_dup(tm);
122 if (in != NULL) {
123 M_ASN1_TIME_free(x->cert_info->validity->notBefore);
124 x->cert_info->validity->notBefore = in;
125 }
126 }
127 return (in != NULL);
128}
129
130int
131X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
132{
133 ASN1_TIME *in;
134
135 if ((x == NULL) || (x->cert_info->validity == NULL))
136 return (0);
137 in = x->cert_info->validity->notAfter;
138 if (in != tm) {
139 in = M_ASN1_TIME_dup(tm);
140 if (in != NULL) {
141 M_ASN1_TIME_free(x->cert_info->validity->notAfter);
142 x->cert_info->validity->notAfter = in;
143 }
144 }
145 return (in != NULL);
146}
147
148int
149X509_set_pubkey(X509 *x, EVP_PKEY *pkey)
150{
151 if ((x == NULL) || (x->cert_info == NULL))
152 return (0);
153 return (X509_PUBKEY_set(&(x->cert_info->key), pkey));
154}
diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
deleted file mode 100644
index 42fb97f571..0000000000
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ /dev/null
@@ -1,332 +0,0 @@
1/* $OpenBSD: x509_trs.c,v 1.20 2015/02/10 11:22:21 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/x509v3.h>
64
65static int tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b);
66static void trtable_free(X509_TRUST *p);
67
68static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
69static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
70static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
71
72static int obj_trust(int id, X509 *x, int flags);
73static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
74
75/* WARNING: the following table should be kept in order of trust
76 * and without any gaps so we can just subtract the minimum trust
77 * value to get an index into the table
78 */
79
80static X509_TRUST trstandard[] = {
81 {X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
82 {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
83 {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
84 {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
85 {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
86 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
87 {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
88 {X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
89};
90
91#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
92
93static STACK_OF(X509_TRUST) *trtable = NULL;
94
95static int
96tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b)
97{
98 return (*a)->trust - (*b)->trust;
99}
100
101int
102(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
103{
104 int (*oldtrust)(int , X509 *, int);
105
106 oldtrust = default_trust;
107 default_trust = trust;
108 return oldtrust;
109}
110
111int
112X509_check_trust(X509 *x, int id, int flags)
113{
114 X509_TRUST *pt;
115 int idx;
116
117 if (id == -1)
118 return 1;
119 idx = X509_TRUST_get_by_id(id);
120 if (idx == -1)
121 return default_trust(id, x, flags);
122 pt = X509_TRUST_get0(idx);
123 return pt->check_trust(pt, x, flags);
124}
125
126int
127X509_TRUST_get_count(void)
128{
129 if (!trtable)
130 return X509_TRUST_COUNT;
131 return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
132}
133
134X509_TRUST *
135X509_TRUST_get0(int idx)
136{
137 if (idx < 0)
138 return NULL;
139 if (idx < (int)X509_TRUST_COUNT)
140 return trstandard + idx;
141 return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
142}
143
144int
145X509_TRUST_get_by_id(int id)
146{
147 X509_TRUST tmp;
148 int idx;
149
150 if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
151 return id - X509_TRUST_MIN;
152 tmp.trust = id;
153 if (!trtable)
154 return -1;
155 idx = sk_X509_TRUST_find(trtable, &tmp);
156 if (idx == -1)
157 return -1;
158 return idx + X509_TRUST_COUNT;
159}
160
161int
162X509_TRUST_set(int *t, int trust)
163{
164 if (X509_TRUST_get_by_id(trust) == -1) {
165 X509err(X509_F_X509_TRUST_SET, X509_R_INVALID_TRUST);
166 return 0;
167 }
168 *t = trust;
169 return 1;
170}
171
172int
173X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
174 char *name, int arg1, void *arg2)
175{
176 int idx;
177 X509_TRUST *trtmp;
178 char *name_dup;
179
180 /* This is set according to what we change: application can't set it */
181 flags &= ~X509_TRUST_DYNAMIC;
182 /* This will always be set for application modified trust entries */
183 flags |= X509_TRUST_DYNAMIC_NAME;
184 /* Get existing entry if any */
185 idx = X509_TRUST_get_by_id(id);
186 /* Need a new entry */
187 if (idx == -1) {
188 if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
189 X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
190 return 0;
191 }
192 trtmp->flags = X509_TRUST_DYNAMIC;
193 } else {
194 trtmp = X509_TRUST_get0(idx);
195 if (trtmp == NULL) {
196 X509err(X509_F_X509_TRUST_ADD, X509_R_INVALID_TRUST);
197 return 0;
198 }
199 }
200
201 if ((name_dup = strdup(name)) == NULL)
202 goto err;
203
204 /* free existing name if dynamic */
205 if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
206 free(trtmp->name);
207 /* dup supplied name */
208 trtmp->name = name_dup;
209 /* Keep the dynamic flag of existing entry */
210 trtmp->flags &= X509_TRUST_DYNAMIC;
211 /* Set all other flags */
212 trtmp->flags |= flags;
213
214 trtmp->trust = id;
215 trtmp->check_trust = ck;
216 trtmp->arg1 = arg1;
217 trtmp->arg2 = arg2;
218
219 /* If it's a new entry, manage the dynamic table */
220 if (idx == -1) {
221 if (trtable == NULL &&
222 (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
223 goto err;
224 if (sk_X509_TRUST_push(trtable, trtmp) == 0)
225 goto err;
226 }
227 return 1;
228
229err:
230 free(name_dup);
231 if (idx == -1)
232 free(trtmp);
233 X509err(X509_F_X509_TRUST_ADD, ERR_R_MALLOC_FAILURE);
234 return 0;
235}
236
237static void
238trtable_free(X509_TRUST *p)
239{
240 if (!p)
241 return;
242 if (p->flags & X509_TRUST_DYNAMIC) {
243 if (p->flags & X509_TRUST_DYNAMIC_NAME)
244 free(p->name);
245 free(p);
246 }
247}
248
249void
250X509_TRUST_cleanup(void)
251{
252 unsigned int i;
253
254 for (i = 0; i < X509_TRUST_COUNT; i++)
255 trtable_free(trstandard + i);
256 sk_X509_TRUST_pop_free(trtable, trtable_free);
257 trtable = NULL;
258}
259
260int
261X509_TRUST_get_flags(X509_TRUST *xp)
262{
263 return xp->flags;
264}
265
266char *
267X509_TRUST_get0_name(X509_TRUST *xp)
268{
269 return xp->name;
270}
271
272int
273X509_TRUST_get_trust(X509_TRUST *xp)
274{
275 return xp->trust;
276}
277
278static int
279trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
280{
281 if (x->aux && (x->aux->trust || x->aux->reject))
282 return obj_trust(trust->arg1, x, flags);
283 /* we don't have any trust settings: for compatibility
284 * we return trusted if it is self signed
285 */
286 return trust_compat(trust, x, flags);
287}
288
289static int
290trust_1oid(X509_TRUST *trust, X509 *x, int flags)
291{
292 if (x->aux)
293 return obj_trust(trust->arg1, x, flags);
294 return X509_TRUST_UNTRUSTED;
295}
296
297static int
298trust_compat(X509_TRUST *trust, X509 *x, int flags)
299{
300 X509_check_purpose(x, -1, 0);
301 if (x->ex_flags & EXFLAG_SS)
302 return X509_TRUST_TRUSTED;
303 else
304 return X509_TRUST_UNTRUSTED;
305}
306
307static int
308obj_trust(int id, X509 *x, int flags)
309{
310 ASN1_OBJECT *obj;
311 int i;
312 X509_CERT_AUX *ax;
313
314 ax = x->aux;
315 if (!ax)
316 return X509_TRUST_UNTRUSTED;
317 if (ax->reject) {
318 for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
319 obj = sk_ASN1_OBJECT_value(ax->reject, i);
320 if (OBJ_obj2nid(obj) == id)
321 return X509_TRUST_REJECTED;
322 }
323 }
324 if (ax->trust) {
325 for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
326 obj = sk_ASN1_OBJECT_value(ax->trust, i);
327 if (OBJ_obj2nid(obj) == id)
328 return X509_TRUST_TRUSTED;
329 }
330 }
331 return X509_TRUST_UNTRUSTED;
332}
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
deleted file mode 100644
index 14fa2378c4..0000000000
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ /dev/null
@@ -1,189 +0,0 @@
1/* $OpenBSD: x509_txt.c,v 1.19 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <time.h>
62
63#include <openssl/asn1.h>
64#include <openssl/buffer.h>
65#include <openssl/evp.h>
66#include <openssl/lhash.h>
67#include <openssl/objects.h>
68#include <openssl/x509.h>
69
70const char *
71X509_verify_cert_error_string(long n)
72{
73 static char buf[100];
74
75 switch ((int)n) {
76 case X509_V_OK:
77 return("ok");
78 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
79 return("unable to get issuer certificate");
80 case X509_V_ERR_UNABLE_TO_GET_CRL:
81 return("unable to get certificate CRL");
82 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
83 return("unable to decrypt certificate's signature");
84 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
85 return("unable to decrypt CRL's signature");
86 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
87 return("unable to decode issuer public key");
88 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
89 return("certificate signature failure");
90 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
91 return("CRL signature failure");
92 case X509_V_ERR_CERT_NOT_YET_VALID:
93 return("certificate is not yet valid");
94 case X509_V_ERR_CRL_NOT_YET_VALID:
95 return("CRL is not yet valid");
96 case X509_V_ERR_CERT_HAS_EXPIRED:
97 return("certificate has expired");
98 case X509_V_ERR_CRL_HAS_EXPIRED:
99 return("CRL has expired");
100 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
101 return("format error in certificate's notBefore field");
102 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
103 return("format error in certificate's notAfter field");
104 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
105 return("format error in CRL's lastUpdate field");
106 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
107 return("format error in CRL's nextUpdate field");
108 case X509_V_ERR_OUT_OF_MEM:
109 return("out of memory");
110 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
111 return("self signed certificate");
112 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
113 return("self signed certificate in certificate chain");
114 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
115 return("unable to get local issuer certificate");
116 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
117 return("unable to verify the first certificate");
118 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
119 return("certificate chain too long");
120 case X509_V_ERR_CERT_REVOKED:
121 return("certificate revoked");
122 case X509_V_ERR_INVALID_CA:
123 return ("invalid CA certificate");
124 case X509_V_ERR_INVALID_NON_CA:
125 return ("invalid non-CA certificate (has CA markings)");
126 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
127 return ("path length constraint exceeded");
128 case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
129 return("proxy path length constraint exceeded");
130 case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
131 return("proxy certificates not allowed, please set the appropriate flag");
132 case X509_V_ERR_INVALID_PURPOSE:
133 return ("unsupported certificate purpose");
134 case X509_V_ERR_CERT_UNTRUSTED:
135 return ("certificate not trusted");
136 case X509_V_ERR_CERT_REJECTED:
137 return ("certificate rejected");
138 case X509_V_ERR_APPLICATION_VERIFICATION:
139 return("application verification failure");
140 case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
141 return("subject issuer mismatch");
142 case X509_V_ERR_AKID_SKID_MISMATCH:
143 return("authority and subject key identifier mismatch");
144 case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
145 return("authority and issuer serial number mismatch");
146 case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
147 return("key usage does not include certificate signing");
148 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
149 return("unable to get CRL issuer certificate");
150 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
151 return("unhandled critical extension");
152 case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
153 return("key usage does not include CRL signing");
154 case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
155 return("key usage does not include digital signature");
156 case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
157 return("unhandled critical CRL extension");
158 case X509_V_ERR_INVALID_EXTENSION:
159 return("invalid or inconsistent certificate extension");
160 case X509_V_ERR_INVALID_POLICY_EXTENSION:
161 return("invalid or inconsistent certificate policy extension");
162 case X509_V_ERR_NO_EXPLICIT_POLICY:
163 return("no explicit policy");
164 case X509_V_ERR_DIFFERENT_CRL_SCOPE:
165 return("Different CRL scope");
166 case X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE:
167 return("Unsupported extension feature");
168 case X509_V_ERR_UNNESTED_RESOURCE:
169 return("RFC 3779 resource not subset of parent's resources");
170 case X509_V_ERR_PERMITTED_VIOLATION:
171 return("permitted subtree violation");
172 case X509_V_ERR_EXCLUDED_VIOLATION:
173 return("excluded subtree violation");
174 case X509_V_ERR_SUBTREE_MINMAX:
175 return("name constraints minimum and maximum not supported");
176 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:
177 return("unsupported name constraint type");
178 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX:
179 return("unsupported or invalid name constraint syntax");
180 case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX:
181 return("unsupported or invalid name syntax");
182 case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
183 return("CRL path validation error");
184
185 default:
186 (void) snprintf(buf, sizeof buf, "error number %ld", n);
187 return(buf);
188 }
189}
diff --git a/src/lib/libcrypto/x509/x509_v3.c b/src/lib/libcrypto/x509/x509_v3.c
deleted file mode 100644
index 3d3a96f59b..0000000000
--- a/src/lib/libcrypto/x509/x509_v3.c
+++ /dev/null
@@ -1,300 +0,0 @@
1/* $OpenBSD: x509_v3.c,v 1.11 2014/09/28 10:53:57 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/err.h>
63#include <openssl/evp.h>
64#include <openssl/objects.h>
65#include <openssl/stack.h>
66#include <openssl/x509.h>
67#include <openssl/x509v3.h>
68
69int
70X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x)
71{
72 if (x == NULL)
73 return (0);
74 return (sk_X509_EXTENSION_num(x));
75}
76
77int
78X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x, int nid, int lastpos)
79{
80 ASN1_OBJECT *obj;
81
82 obj = OBJ_nid2obj(nid);
83 if (obj == NULL)
84 return (-2);
85 return (X509v3_get_ext_by_OBJ(x, obj, lastpos));
86}
87
88int
89X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *sk, ASN1_OBJECT *obj,
90 int lastpos)
91{
92 int n;
93 X509_EXTENSION *ex;
94
95 if (sk == NULL)
96 return (-1);
97 lastpos++;
98 if (lastpos < 0)
99 lastpos = 0;
100 n = sk_X509_EXTENSION_num(sk);
101 for (; lastpos < n; lastpos++) {
102 ex = sk_X509_EXTENSION_value(sk, lastpos);
103 if (OBJ_cmp(ex->object, obj) == 0)
104 return (lastpos);
105 }
106 return (-1);
107}
108
109int
110X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *sk, int crit,
111 int lastpos)
112{
113 int n;
114 X509_EXTENSION *ex;
115
116 if (sk == NULL)
117 return (-1);
118 lastpos++;
119 if (lastpos < 0)
120 lastpos = 0;
121 n = sk_X509_EXTENSION_num(sk);
122 for (; lastpos < n; lastpos++) {
123 ex = sk_X509_EXTENSION_value(sk, lastpos);
124 if (((ex->critical > 0) && crit) ||
125 ((ex->critical <= 0) && !crit))
126 return (lastpos);
127 }
128 return (-1);
129}
130
131X509_EXTENSION *
132X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc)
133{
134 if (x == NULL || sk_X509_EXTENSION_num(x) <= loc || loc < 0)
135 return NULL;
136 else
137 return sk_X509_EXTENSION_value(x, loc);
138}
139
140X509_EXTENSION *
141X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc)
142{
143 X509_EXTENSION *ret;
144
145 if (x == NULL || sk_X509_EXTENSION_num(x) <= loc || loc < 0)
146 return (NULL);
147 ret = sk_X509_EXTENSION_delete(x, loc);
148 return (ret);
149}
150
151STACK_OF(X509_EXTENSION) *
152X509v3_add_ext(STACK_OF(X509_EXTENSION) **x, X509_EXTENSION *ex, int loc)
153{
154 X509_EXTENSION *new_ex = NULL;
155 int n;
156 STACK_OF(X509_EXTENSION) *sk = NULL;
157
158 if (x == NULL) {
159 X509err(X509_F_X509V3_ADD_EXT, ERR_R_PASSED_NULL_PARAMETER);
160 goto err2;
161 }
162
163 if (*x == NULL) {
164 if ((sk = sk_X509_EXTENSION_new_null()) == NULL)
165 goto err;
166 } else
167 sk= *x;
168
169 n = sk_X509_EXTENSION_num(sk);
170 if (loc > n)
171 loc = n;
172 else if (loc < 0)
173 loc = n;
174
175 if ((new_ex = X509_EXTENSION_dup(ex)) == NULL)
176 goto err2;
177 if (!sk_X509_EXTENSION_insert(sk, new_ex, loc))
178 goto err;
179 if (*x == NULL)
180 *x = sk;
181 return (sk);
182
183err:
184 X509err(X509_F_X509V3_ADD_EXT, ERR_R_MALLOC_FAILURE);
185err2:
186 if (new_ex != NULL)
187 X509_EXTENSION_free(new_ex);
188 if (sk != NULL && (x != NULL && sk != *x))
189 sk_X509_EXTENSION_free(sk);
190 return (NULL);
191}
192
193X509_EXTENSION *
194X509_EXTENSION_create_by_NID(X509_EXTENSION **ex, int nid, int crit,
195 ASN1_OCTET_STRING *data)
196{
197 ASN1_OBJECT *obj;
198 X509_EXTENSION *ret;
199
200 obj = OBJ_nid2obj(nid);
201 if (obj == NULL) {
202 X509err(X509_F_X509_EXTENSION_CREATE_BY_NID,
203 X509_R_UNKNOWN_NID);
204 return (NULL);
205 }
206 ret = X509_EXTENSION_create_by_OBJ(ex, obj, crit, data);
207 if (ret == NULL)
208 ASN1_OBJECT_free(obj);
209 return (ret);
210}
211
212X509_EXTENSION *
213X509_EXTENSION_create_by_OBJ(X509_EXTENSION **ex, ASN1_OBJECT *obj, int crit,
214 ASN1_OCTET_STRING *data)
215{
216 X509_EXTENSION *ret;
217
218 if ((ex == NULL) || (*ex == NULL)) {
219 if ((ret = X509_EXTENSION_new()) == NULL) {
220 X509err(X509_F_X509_EXTENSION_CREATE_BY_OBJ,
221 ERR_R_MALLOC_FAILURE);
222 return (NULL);
223 }
224 } else
225 ret= *ex;
226
227 if (!X509_EXTENSION_set_object(ret, obj))
228 goto err;
229 if (!X509_EXTENSION_set_critical(ret, crit))
230 goto err;
231 if (!X509_EXTENSION_set_data(ret, data))
232 goto err;
233
234 if ((ex != NULL) && (*ex == NULL))
235 *ex = ret;
236 return (ret);
237
238err:
239 if ((ex == NULL) || (ret != *ex))
240 X509_EXTENSION_free(ret);
241 return (NULL);
242}
243
244int
245X509_EXTENSION_set_object(X509_EXTENSION *ex, ASN1_OBJECT *obj)
246{
247 if ((ex == NULL) || (obj == NULL))
248 return (0);
249 ASN1_OBJECT_free(ex->object);
250 ex->object = OBJ_dup(obj);
251 return (1);
252}
253
254int
255X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit)
256{
257 if (ex == NULL)
258 return (0);
259 ex->critical = (crit) ? 0xFF : -1;
260 return (1);
261}
262
263int
264X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data)
265{
266 int i;
267
268 if (ex == NULL)
269 return (0);
270 i = M_ASN1_OCTET_STRING_set(ex->value, data->data, data->length);
271 if (!i)
272 return (0);
273 return (1);
274}
275
276ASN1_OBJECT *
277X509_EXTENSION_get_object(X509_EXTENSION *ex)
278{
279 if (ex == NULL)
280 return (NULL);
281 return (ex->object);
282}
283
284ASN1_OCTET_STRING *
285X509_EXTENSION_get_data(X509_EXTENSION *ex)
286{
287 if (ex == NULL)
288 return (NULL);
289 return (ex->value);
290}
291
292int
293X509_EXTENSION_get_critical(X509_EXTENSION *ex)
294{
295 if (ex == NULL)
296 return (0);
297 if (ex->critical > 0)
298 return 1;
299 return 0;
300}
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
deleted file mode 100644
index c383fda4f2..0000000000
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ /dev/null
@@ -1,2194 +0,0 @@
1/* $OpenBSD: x509_vfy.c,v 1.40 2015/02/11 02:17:59 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <errno.h>
60#include <stdio.h>
61#include <string.h>
62#include <time.h>
63#include <unistd.h>
64
65#include <openssl/opensslconf.h>
66
67#include <openssl/asn1.h>
68#include <openssl/buffer.h>
69#include <openssl/crypto.h>
70#include <openssl/err.h>
71#include <openssl/evp.h>
72#include <openssl/lhash.h>
73#include <openssl/objects.h>
74#include <openssl/x509.h>
75#include <openssl/x509v3.h>
76#include "x509_lcl.h"
77
78/* CRL score values */
79
80/* No unhandled critical extensions */
81
82#define CRL_SCORE_NOCRITICAL 0x100
83
84/* certificate is within CRL scope */
85
86#define CRL_SCORE_SCOPE 0x080
87
88/* CRL times valid */
89
90#define CRL_SCORE_TIME 0x040
91
92/* Issuer name matches certificate */
93
94#define CRL_SCORE_ISSUER_NAME 0x020
95
96/* If this score or above CRL is probably valid */
97
98#define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE)
99
100/* CRL issuer is certificate issuer */
101
102#define CRL_SCORE_ISSUER_CERT 0x018
103
104/* CRL issuer is on certificate path */
105
106#define CRL_SCORE_SAME_PATH 0x008
107
108/* CRL issuer matches CRL AKID */
109
110#define CRL_SCORE_AKID 0x004
111
112/* Have a delta CRL with valid times */
113
114#define CRL_SCORE_TIME_DELTA 0x002
115
116static int null_callback(int ok, X509_STORE_CTX *e);
117static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
118static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);
119static int check_chain_extensions(X509_STORE_CTX *ctx);
120static int check_name_constraints(X509_STORE_CTX *ctx);
121static int check_trust(X509_STORE_CTX *ctx);
122static int check_revocation(X509_STORE_CTX *ctx);
123static int check_cert(X509_STORE_CTX *ctx);
124static int check_policy(X509_STORE_CTX *ctx);
125
126static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
127 unsigned int *preasons, X509_CRL *crl, X509 *x);
128static int get_crl_delta(X509_STORE_CTX *ctx,
129 X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x);
130static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pcrl_score,
131 X509_CRL *base, STACK_OF(X509_CRL) *crls);
132static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer,
133 int *pcrl_score);
134static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
135 unsigned int *preasons);
136static int check_crl_path(X509_STORE_CTX *ctx, X509 *x);
137static int check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path,
138 STACK_OF(X509) *crl_path);
139
140static int internal_verify(X509_STORE_CTX *ctx);
141
142static int
143null_callback(int ok, X509_STORE_CTX *e)
144{
145 return ok;
146}
147
148#if 0
149static int
150x509_subject_cmp(X509 **a, X509 **b)
151{
152 return X509_subject_name_cmp(*a, *b);
153}
154#endif
155
156int
157X509_verify_cert(X509_STORE_CTX *ctx)
158{
159 X509 *x, *xtmp, *chain_ss = NULL;
160 int bad_chain = 0;
161 X509_VERIFY_PARAM *param = ctx->param;
162 int depth, i, ok = 0;
163 int num;
164 int (*cb)(int xok, X509_STORE_CTX *xctx);
165 STACK_OF(X509) *sktmp = NULL;
166
167 if (ctx->cert == NULL) {
168 X509err(X509_F_X509_VERIFY_CERT,
169 X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
170 return -1;
171 }
172
173 cb = ctx->verify_cb;
174
175 /* first we make sure the chain we are going to build is
176 * present and that the first entry is in place */
177 if (ctx->chain == NULL) {
178 if (((ctx->chain = sk_X509_new_null()) == NULL) ||
179 (!sk_X509_push(ctx->chain, ctx->cert))) {
180 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
181 goto end;
182 }
183 CRYPTO_add(&ctx->cert->references, 1, CRYPTO_LOCK_X509);
184 ctx->last_untrusted = 1;
185 }
186
187 /* We use a temporary STACK so we can chop and hack at it */
188 if (ctx->untrusted != NULL &&
189 (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
190 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
191 goto end;
192 }
193
194 num = sk_X509_num(ctx->chain);
195 x = sk_X509_value(ctx->chain, num - 1);
196 depth = param->depth;
197
198 for (;;) {
199 /* If we have enough, we break */
200 if (depth < num)
201 break; /* FIXME: If this happens, we should take
202 * note of it and, if appropriate, use the
203 * X509_V_ERR_CERT_CHAIN_TOO_LONG error
204 * code later.
205 */
206
207 /* If we are self signed, we break */
208 if (ctx->check_issued(ctx, x, x))
209 break;
210
211 /* If we were passed a cert chain, use it first */
212 if (ctx->untrusted != NULL) {
213 xtmp = find_issuer(ctx, sktmp, x);
214 if (xtmp != NULL) {
215 if (!sk_X509_push(ctx->chain, xtmp)) {
216 X509err(X509_F_X509_VERIFY_CERT,
217 ERR_R_MALLOC_FAILURE);
218 goto end;
219 }
220 CRYPTO_add(&xtmp->references, 1,
221 CRYPTO_LOCK_X509);
222 (void)sk_X509_delete_ptr(sktmp, xtmp);
223 ctx->last_untrusted++;
224 x = xtmp;
225 num++;
226 /* reparse the full chain for
227 * the next one */
228 continue;
229 }
230 }
231 break;
232 }
233 sk_X509_free(sktmp);
234 sktmp = NULL;
235
236 /* at this point, chain should contain a list of untrusted
237 * certificates. We now need to add at least one trusted one,
238 * if possible, otherwise we complain. */
239
240 /* Examine last certificate in chain and see if it
241 * is self signed.
242 */
243
244 i = sk_X509_num(ctx->chain);
245 x = sk_X509_value(ctx->chain, i - 1);
246 if (ctx->check_issued(ctx, x, x)) {
247 /* we have a self signed certificate */
248 if (sk_X509_num(ctx->chain) == 1) {
249 /* We have a single self signed certificate: see if
250 * we can find it in the store. We must have an exact
251 * match to avoid possible impersonation.
252 */
253 ok = ctx->get_issuer(&xtmp, ctx, x);
254 if ((ok <= 0) || X509_cmp(x, xtmp)) {
255 ctx->error =
256 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
257 ctx->current_cert = x;
258 ctx->error_depth = i - 1;
259 if (ok == 1)
260 X509_free(xtmp);
261 bad_chain = 1;
262 ok = cb(0, ctx);
263 if (!ok)
264 goto end;
265 } else {
266 /* We have a match: replace certificate with store version
267 * so we get any trust settings.
268 */
269 X509_free(x);
270 x = xtmp;
271 (void)sk_X509_set(ctx->chain, i - 1, x);
272 ctx->last_untrusted = 0;
273 }
274 } else {
275 /* extract and save self signed certificate for later use */
276 chain_ss = sk_X509_pop(ctx->chain);
277 ctx->last_untrusted--;
278 num--;
279 x = sk_X509_value(ctx->chain, num - 1);
280 }
281 }
282
283 /* We now lookup certs from the certificate store */
284 for (;;) {
285 /* If we have enough, we break */
286 if (depth < num)
287 break;
288
289 /* If we are self signed, we break */
290 if (ctx->check_issued(ctx, x, x))
291 break;
292
293 ok = ctx->get_issuer(&xtmp, ctx, x);
294 if (ok < 0)
295 return ok;
296 if (ok == 0)
297 break;
298
299 x = xtmp;
300 if (!sk_X509_push(ctx->chain, x)) {
301 X509_free(xtmp);
302 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
303 return 0;
304 }
305 num++;
306 }
307
308 /* we now have our chain, lets check it... */
309
310 /* Is last certificate looked up self signed? */
311 if (!ctx->check_issued(ctx, x, x)) {
312 if ((chain_ss == NULL) ||
313 !ctx->check_issued(ctx, x, chain_ss)) {
314 if (ctx->last_untrusted >= num)
315 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
316 else
317 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
318 ctx->current_cert = x;
319 } else {
320
321 if (!sk_X509_push(ctx->chain, chain_ss)) {
322 X509_free(chain_ss);
323 X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE);
324 return 0;
325 }
326 num++;
327 ctx->last_untrusted = num;
328 ctx->current_cert = chain_ss;
329 ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
330 chain_ss = NULL;
331 }
332
333 ctx->error_depth = num - 1;
334 bad_chain = 1;
335 ok = cb(0, ctx);
336 if (!ok)
337 goto end;
338 }
339
340 /* We have the chain complete: now we need to check its purpose */
341 ok = check_chain_extensions(ctx);
342
343 if (!ok)
344 goto end;
345
346 /* Check name constraints */
347
348 ok = check_name_constraints(ctx);
349
350 if (!ok)
351 goto end;
352
353 /* The chain extensions are OK: check trust */
354
355 if (param->trust > 0)
356 ok = check_trust(ctx);
357
358 if (!ok)
359 goto end;
360
361 /* We may as well copy down any DSA parameters that are required */
362 X509_get_pubkey_parameters(NULL, ctx->chain);
363
364 /* Check revocation status: we do this after copying parameters
365 * because they may be needed for CRL signature verification.
366 */
367
368 ok = ctx->check_revocation(ctx);
369 if (!ok)
370 goto end;
371
372 /* At this point, we have a chain and need to verify it */
373 if (ctx->verify != NULL)
374 ok = ctx->verify(ctx);
375 else
376 ok = internal_verify(ctx);
377 if (!ok)
378 goto end;
379
380 /* If we get this far evaluate policies */
381 if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK))
382 ok = ctx->check_policy(ctx);
383 if (!ok)
384 goto end;
385 if (0) {
386end:
387 X509_get_pubkey_parameters(NULL, ctx->chain);
388 }
389 if (sktmp != NULL)
390 sk_X509_free(sktmp);
391 if (chain_ss != NULL)
392 X509_free(chain_ss);
393 return ok;
394}
395
396
397/* Given a STACK_OF(X509) find the issuer of cert (if any)
398 */
399
400static X509 *
401find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x)
402{
403 int i;
404 X509 *issuer, *rv = NULL;
405
406 for (i = 0; i < sk_X509_num(sk); i++) {
407 issuer = sk_X509_value(sk, i);
408 if (ctx->check_issued(ctx, x, issuer)) {
409 rv = issuer;
410 if (x509_check_cert_time(ctx, rv, 1))
411 break;
412 }
413 }
414 return rv;
415}
416
417/* Given a possible certificate and issuer check them */
418
419static int
420check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
421{
422 int ret;
423
424 ret = X509_check_issued(issuer, x);
425 if (ret == X509_V_OK)
426 return 1;
427 /* If we haven't asked for issuer errors don't set ctx */
428 if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK))
429 return 0;
430
431 ctx->error = ret;
432 ctx->current_cert = x;
433 ctx->current_issuer = issuer;
434 return ctx->verify_cb(0, ctx);
435}
436
437/* Alternative lookup method: look from a STACK stored in other_ctx */
438
439static int
440get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
441{
442 *issuer = find_issuer(ctx, ctx->other_ctx, x);
443 if (*issuer) {
444 CRYPTO_add(&(*issuer)->references, 1, CRYPTO_LOCK_X509);
445 return 1;
446 } else
447 return 0;
448}
449
450/* Check a certificate chains extensions for consistency
451 * with the supplied purpose
452 */
453
454static int
455check_chain_extensions(X509_STORE_CTX *ctx)
456{
457#ifdef OPENSSL_NO_CHAIN_VERIFY
458 return 1;
459#else
460 int i, ok = 0, must_be_ca, plen = 0;
461 X509 *x;
462 int (*cb)(int xok, X509_STORE_CTX *xctx);
463 int proxy_path_length = 0;
464 int purpose;
465 int allow_proxy_certs;
466
467 cb = ctx->verify_cb;
468
469 /* must_be_ca can have 1 of 3 values:
470 -1: we accept both CA and non-CA certificates, to allow direct
471 use of self-signed certificates (which are marked as CA).
472 0: we only accept non-CA certificates. This is currently not
473 used, but the possibility is present for future extensions.
474 1: we only accept CA certificates. This is currently used for
475 all certificates in the chain except the leaf certificate.
476 */
477 must_be_ca = -1;
478
479 /* CRL path validation */
480 if (ctx->parent) {
481 allow_proxy_certs = 0;
482 purpose = X509_PURPOSE_CRL_SIGN;
483 } else {
484 allow_proxy_certs =
485 !!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
486#if 0
487 /* A hack to keep people who don't want to modify their
488 software happy */
489 if (issetugid() == 0 && getenv("OPENSSL_ALLOW_PROXY_CERTS"))
490 allow_proxy_certs = 1;
491#endif
492 purpose = ctx->param->purpose;
493 }
494
495 /* Check all untrusted certificates */
496 for (i = 0; i < ctx->last_untrusted; i++) {
497 int ret;
498 x = sk_X509_value(ctx->chain, i);
499 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) &&
500 (x->ex_flags & EXFLAG_CRITICAL)) {
501 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
502 ctx->error_depth = i;
503 ctx->current_cert = x;
504 ok = cb(0, ctx);
505 if (!ok)
506 goto end;
507 }
508 if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) {
509 ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
510 ctx->error_depth = i;
511 ctx->current_cert = x;
512 ok = cb(0, ctx);
513 if (!ok)
514 goto end;
515 }
516 ret = X509_check_ca(x);
517 switch (must_be_ca) {
518 case -1:
519 if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
520 (ret != 1) && (ret != 0)) {
521 ret = 0;
522 ctx->error = X509_V_ERR_INVALID_CA;
523 } else
524 ret = 1;
525 break;
526 case 0:
527 if (ret != 0) {
528 ret = 0;
529 ctx->error = X509_V_ERR_INVALID_NON_CA;
530 } else
531 ret = 1;
532 break;
533 default:
534 if ((ret == 0) ||
535 ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
536 (ret != 1))) {
537 ret = 0;
538 ctx->error = X509_V_ERR_INVALID_CA;
539 } else
540 ret = 1;
541 break;
542 }
543 if (ret == 0) {
544 ctx->error_depth = i;
545 ctx->current_cert = x;
546 ok = cb(0, ctx);
547 if (!ok)
548 goto end;
549 }
550 if (ctx->param->purpose > 0) {
551 ret = X509_check_purpose(x, purpose, must_be_ca > 0);
552 if ((ret == 0) ||
553 ((ctx->param->flags & X509_V_FLAG_X509_STRICT) &&
554 (ret != 1))) {
555 ctx->error = X509_V_ERR_INVALID_PURPOSE;
556 ctx->error_depth = i;
557 ctx->current_cert = x;
558 ok = cb(0, ctx);
559 if (!ok)
560 goto end;
561 }
562 }
563 /* Check pathlen if not self issued */
564 if ((i > 1) && !(x->ex_flags & EXFLAG_SI) &&
565 (x->ex_pathlen != -1) &&
566 (plen > (x->ex_pathlen + proxy_path_length + 1))) {
567 ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
568 ctx->error_depth = i;
569 ctx->current_cert = x;
570 ok = cb(0, ctx);
571 if (!ok)
572 goto end;
573 }
574 /* Increment path length if not self issued */
575 if (!(x->ex_flags & EXFLAG_SI))
576 plen++;
577 /* If this certificate is a proxy certificate, the next
578 certificate must be another proxy certificate or a EE
579 certificate. If not, the next certificate must be a
580 CA certificate. */
581 if (x->ex_flags & EXFLAG_PROXY) {
582 if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen) {
583 ctx->error =
584 X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
585 ctx->error_depth = i;
586 ctx->current_cert = x;
587 ok = cb(0, ctx);
588 if (!ok)
589 goto end;
590 }
591 proxy_path_length++;
592 must_be_ca = 0;
593 } else
594 must_be_ca = 1;
595 }
596 ok = 1;
597
598end:
599 return ok;
600#endif
601}
602
603static int
604check_name_constraints(X509_STORE_CTX *ctx)
605{
606 X509 *x;
607 int i, j, rv;
608
609 /* Check name constraints for all certificates */
610 for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) {
611 x = sk_X509_value(ctx->chain, i);
612 /* Ignore self issued certs unless last in chain */
613 if (i && (x->ex_flags & EXFLAG_SI))
614 continue;
615 /* Check against constraints for all certificates higher in
616 * chain including trust anchor. Trust anchor not strictly
617 * speaking needed but if it includes constraints it is to be
618 * assumed it expects them to be obeyed.
619 */
620 for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) {
621 NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc;
622 if (nc) {
623 rv = NAME_CONSTRAINTS_check(x, nc);
624 if (rv != X509_V_OK) {
625 ctx->error = rv;
626 ctx->error_depth = i;
627 ctx->current_cert = x;
628 if (!ctx->verify_cb(0, ctx))
629 return 0;
630 }
631 }
632 }
633 }
634 return 1;
635}
636
637static int
638check_trust(X509_STORE_CTX *ctx)
639{
640#ifdef OPENSSL_NO_CHAIN_VERIFY
641 return 1;
642#else
643 int i, ok;
644 X509 *x;
645 int (*cb)(int xok, X509_STORE_CTX *xctx);
646
647 cb = ctx->verify_cb;
648 /* For now just check the last certificate in the chain */
649 i = sk_X509_num(ctx->chain) - 1;
650 x = sk_X509_value(ctx->chain, i);
651 ok = X509_check_trust(x, ctx->param->trust, 0);
652 if (ok == X509_TRUST_TRUSTED)
653 return 1;
654 ctx->error_depth = i;
655 ctx->current_cert = x;
656 if (ok == X509_TRUST_REJECTED)
657 ctx->error = X509_V_ERR_CERT_REJECTED;
658 else
659 ctx->error = X509_V_ERR_CERT_UNTRUSTED;
660 ok = cb(0, ctx);
661 return ok;
662#endif
663}
664
665static int
666check_revocation(X509_STORE_CTX *ctx)
667{
668 int i, last, ok;
669
670 if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK))
671 return 1;
672 if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
673 last = sk_X509_num(ctx->chain) - 1;
674 else {
675 /* If checking CRL paths this isn't the EE certificate */
676 if (ctx->parent)
677 return 1;
678 last = 0;
679 }
680 for (i = 0; i <= last; i++) {
681 ctx->error_depth = i;
682 ok = check_cert(ctx);
683 if (!ok)
684 return ok;
685 }
686 return 1;
687}
688
689static int
690check_cert(X509_STORE_CTX *ctx)
691{
692 X509_CRL *crl = NULL, *dcrl = NULL;
693 X509 *x;
694 int ok, cnum;
695 unsigned int last_reasons;
696
697 cnum = ctx->error_depth;
698 x = sk_X509_value(ctx->chain, cnum);
699 ctx->current_cert = x;
700 ctx->current_issuer = NULL;
701 ctx->current_crl_score = 0;
702 ctx->current_reasons = 0;
703 while (ctx->current_reasons != CRLDP_ALL_REASONS) {
704 last_reasons = ctx->current_reasons;
705 /* Try to retrieve relevant CRL */
706 if (ctx->get_crl)
707 ok = ctx->get_crl(ctx, &crl, x);
708 else
709 ok = get_crl_delta(ctx, &crl, &dcrl, x);
710 /* If error looking up CRL, nothing we can do except
711 * notify callback
712 */
713 if (!ok) {
714 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
715 ok = ctx->verify_cb(0, ctx);
716 goto err;
717 }
718 ctx->current_crl = crl;
719 ok = ctx->check_crl(ctx, crl);
720 if (!ok)
721 goto err;
722
723 if (dcrl) {
724 ok = ctx->check_crl(ctx, dcrl);
725 if (!ok)
726 goto err;
727 ok = ctx->cert_crl(ctx, dcrl, x);
728 if (!ok)
729 goto err;
730 } else
731 ok = 1;
732
733 /* Don't look in full CRL if delta reason is removefromCRL */
734 if (ok != 2) {
735 ok = ctx->cert_crl(ctx, crl, x);
736 if (!ok)
737 goto err;
738 }
739
740 ctx->current_crl = NULL;
741 X509_CRL_free(crl);
742 X509_CRL_free(dcrl);
743 crl = NULL;
744 dcrl = NULL;
745 /* If reasons not updated we wont get anywhere by
746 * another iteration, so exit loop.
747 */
748 if (last_reasons == ctx->current_reasons) {
749 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
750 ok = ctx->verify_cb(0, ctx);
751 goto err;
752 }
753 }
754
755err:
756 ctx->current_crl = NULL;
757 X509_CRL_free(crl);
758 X509_CRL_free(dcrl);
759 return ok;
760}
761
762/* Check CRL times against values in X509_STORE_CTX */
763
764static int
765check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
766{
767 time_t *ptime;
768 int i;
769
770 if (notify)
771 ctx->current_crl = crl;
772 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
773 ptime = &ctx->param->check_time;
774 else
775 ptime = NULL;
776
777 i = X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
778 if (i == 0) {
779 if (!notify)
780 return 0;
781 ctx->error = X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;
782 if (!ctx->verify_cb(0, ctx))
783 return 0;
784 }
785
786 if (i > 0) {
787 if (!notify)
788 return 0;
789 ctx->error = X509_V_ERR_CRL_NOT_YET_VALID;
790 if (!ctx->verify_cb(0, ctx))
791 return 0;
792 }
793
794 if (X509_CRL_get_nextUpdate(crl)) {
795 i = X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);
796
797 if (i == 0) {
798 if (!notify)
799 return 0;
800 ctx->error = X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;
801 if (!ctx->verify_cb(0, ctx))
802 return 0;
803 }
804 /* Ignore expiry of base CRL is delta is valid */
805 if ((i < 0) &&
806 !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) {
807 if (!notify)
808 return 0;
809 ctx->error = X509_V_ERR_CRL_HAS_EXPIRED;
810 if (!ctx->verify_cb(0, ctx))
811 return 0;
812 }
813 }
814
815 if (notify)
816 ctx->current_crl = NULL;
817
818 return 1;
819}
820
821static int
822get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
823 X509 **pissuer, int *pscore, unsigned int *preasons,
824 STACK_OF(X509_CRL) *crls)
825{
826 int i, crl_score, best_score = *pscore;
827 unsigned int reasons, best_reasons = 0;
828 X509 *x = ctx->current_cert;
829 X509_CRL *crl, *best_crl = NULL;
830 X509 *crl_issuer = NULL, *best_crl_issuer = NULL;
831
832 for (i = 0; i < sk_X509_CRL_num(crls); i++) {
833 crl = sk_X509_CRL_value(crls, i);
834 reasons = *preasons;
835 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
836
837 if (crl_score > best_score) {
838 best_crl = crl;
839 best_crl_issuer = crl_issuer;
840 best_score = crl_score;
841 best_reasons = reasons;
842 }
843 }
844
845 if (best_crl) {
846 if (*pcrl)
847 X509_CRL_free(*pcrl);
848 *pcrl = best_crl;
849 *pissuer = best_crl_issuer;
850 *pscore = best_score;
851 *preasons = best_reasons;
852 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509_CRL);
853 if (*pdcrl) {
854 X509_CRL_free(*pdcrl);
855 *pdcrl = NULL;
856 }
857 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls);
858 }
859
860 if (best_score >= CRL_SCORE_VALID)
861 return 1;
862
863 return 0;
864}
865
866/* Compare two CRL extensions for delta checking purposes. They should be
867 * both present or both absent. If both present all fields must be identical.
868 */
869
870static int
871crl_extension_match(X509_CRL *a, X509_CRL *b, int nid)
872{
873 ASN1_OCTET_STRING *exta, *extb;
874 int i;
875
876 i = X509_CRL_get_ext_by_NID(a, nid, -1);
877 if (i >= 0) {
878 /* Can't have multiple occurrences */
879 if (X509_CRL_get_ext_by_NID(a, nid, i) != -1)
880 return 0;
881 exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i));
882 } else
883 exta = NULL;
884
885 i = X509_CRL_get_ext_by_NID(b, nid, -1);
886
887 if (i >= 0) {
888 if (X509_CRL_get_ext_by_NID(b, nid, i) != -1)
889 return 0;
890 extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i));
891 } else
892 extb = NULL;
893
894 if (!exta && !extb)
895 return 1;
896
897 if (!exta || !extb)
898 return 0;
899
900 if (ASN1_OCTET_STRING_cmp(exta, extb))
901 return 0;
902
903 return 1;
904}
905
906/* See if a base and delta are compatible */
907
908static int
909check_delta_base(X509_CRL *delta, X509_CRL *base)
910{
911 /* Delta CRL must be a delta */
912 if (!delta->base_crl_number)
913 return 0;
914 /* Base must have a CRL number */
915 if (!base->crl_number)
916 return 0;
917 /* Issuer names must match */
918 if (X509_NAME_cmp(X509_CRL_get_issuer(base),
919 X509_CRL_get_issuer(delta)))
920 return 0;
921 /* AKID and IDP must match */
922 if (!crl_extension_match(delta, base, NID_authority_key_identifier))
923 return 0;
924 if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
925 return 0;
926 /* Delta CRL base number must not exceed Full CRL number. */
927 if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
928 return 0;
929 /* Delta CRL number must exceed full CRL number */
930 if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0)
931 return 1;
932 return 0;
933}
934
935/* For a given base CRL find a delta... maybe extend to delta scoring
936 * or retrieve a chain of deltas...
937 */
938
939static void
940get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, X509_CRL *base,
941 STACK_OF(X509_CRL) *crls)
942{
943 X509_CRL *delta;
944 int i;
945
946 if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS))
947 return;
948 if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST))
949 return;
950 for (i = 0; i < sk_X509_CRL_num(crls); i++) {
951 delta = sk_X509_CRL_value(crls, i);
952 if (check_delta_base(delta, base)) {
953 if (check_crl_time(ctx, delta, 0))
954 *pscore |= CRL_SCORE_TIME_DELTA;
955 CRYPTO_add(&delta->references, 1, CRYPTO_LOCK_X509_CRL);
956 *dcrl = delta;
957 return;
958 }
959 }
960 *dcrl = NULL;
961}
962
963/* For a given CRL return how suitable it is for the supplied certificate 'x'.
964 * The return value is a mask of several criteria.
965 * If the issuer is not the certificate issuer this is returned in *pissuer.
966 * The reasons mask is also used to determine if the CRL is suitable: if
967 * no new reasons the CRL is rejected, otherwise reasons is updated.
968 */
969
970static int
971get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, unsigned int *preasons,
972 X509_CRL *crl, X509 *x)
973{
974 int crl_score = 0;
975 unsigned int tmp_reasons = *preasons, crl_reasons;
976
977 /* First see if we can reject CRL straight away */
978
979 /* Invalid IDP cannot be processed */
980 if (crl->idp_flags & IDP_INVALID)
981 return 0;
982 /* Reason codes or indirect CRLs need extended CRL support */
983 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) {
984 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
985 return 0;
986 } else if (crl->idp_flags & IDP_REASONS) {
987 /* If no new reasons reject */
988 if (!(crl->idp_reasons & ~tmp_reasons))
989 return 0;
990 }
991 /* Don't process deltas at this stage */
992 else if (crl->base_crl_number)
993 return 0;
994 /* If issuer name doesn't match certificate need indirect CRL */
995 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) {
996 if (!(crl->idp_flags & IDP_INDIRECT))
997 return 0;
998 } else
999 crl_score |= CRL_SCORE_ISSUER_NAME;
1000
1001 if (!(crl->flags & EXFLAG_CRITICAL))
1002 crl_score |= CRL_SCORE_NOCRITICAL;
1003
1004 /* Check expiry */
1005 if (check_crl_time(ctx, crl, 0))
1006 crl_score |= CRL_SCORE_TIME;
1007
1008 /* Check authority key ID and locate certificate issuer */
1009 crl_akid_check(ctx, crl, pissuer, &crl_score);
1010
1011 /* If we can't locate certificate issuer at this point forget it */
1012
1013 if (!(crl_score & CRL_SCORE_AKID))
1014 return 0;
1015
1016 /* Check cert for matching CRL distribution points */
1017
1018 if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) {
1019 /* If no new reasons reject */
1020 if (!(crl_reasons & ~tmp_reasons))
1021 return 0;
1022 tmp_reasons |= crl_reasons;
1023 crl_score |= CRL_SCORE_SCOPE;
1024 }
1025
1026 *preasons = tmp_reasons;
1027
1028 return crl_score;
1029}
1030
1031static void
1032crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer,
1033 int *pcrl_score)
1034{
1035 X509 *crl_issuer = NULL;
1036 X509_NAME *cnm = X509_CRL_get_issuer(crl);
1037 int cidx = ctx->error_depth;
1038 int i;
1039
1040 if (cidx != sk_X509_num(ctx->chain) - 1)
1041 cidx++;
1042
1043 crl_issuer = sk_X509_value(ctx->chain, cidx);
1044
1045 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1046 if (*pcrl_score & CRL_SCORE_ISSUER_NAME) {
1047 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_ISSUER_CERT;
1048 *pissuer = crl_issuer;
1049 return;
1050 }
1051 }
1052
1053 for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) {
1054 crl_issuer = sk_X509_value(ctx->chain, cidx);
1055 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1056 continue;
1057 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1058 *pcrl_score |= CRL_SCORE_AKID|CRL_SCORE_SAME_PATH;
1059 *pissuer = crl_issuer;
1060 return;
1061 }
1062 }
1063
1064 /* Anything else needs extended CRL support */
1065
1066 if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT))
1067 return;
1068
1069 /* Otherwise the CRL issuer is not on the path. Look for it in the
1070 * set of untrusted certificates.
1071 */
1072 for (i = 0; i < sk_X509_num(ctx->untrusted); i++) {
1073 crl_issuer = sk_X509_value(ctx->untrusted, i);
1074 if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm))
1075 continue;
1076 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) {
1077 *pissuer = crl_issuer;
1078 *pcrl_score |= CRL_SCORE_AKID;
1079 return;
1080 }
1081 }
1082}
1083
1084/* Check the path of a CRL issuer certificate. This creates a new
1085 * X509_STORE_CTX and populates it with most of the parameters from the
1086 * parent. This could be optimised somewhat since a lot of path checking
1087 * will be duplicated by the parent, but this will rarely be used in
1088 * practice.
1089 */
1090
1091static int
1092check_crl_path(X509_STORE_CTX *ctx, X509 *x)
1093{
1094 X509_STORE_CTX crl_ctx;
1095 int ret;
1096
1097 /* Don't allow recursive CRL path validation */
1098 if (ctx->parent)
1099 return 0;
1100 if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted))
1101 return -1;
1102
1103 crl_ctx.crls = ctx->crls;
1104 /* Copy verify params across */
1105 X509_STORE_CTX_set0_param(&crl_ctx, ctx->param);
1106
1107 crl_ctx.parent = ctx;
1108 crl_ctx.verify_cb = ctx->verify_cb;
1109
1110 /* Verify CRL issuer */
1111 ret = X509_verify_cert(&crl_ctx);
1112
1113 if (ret <= 0)
1114 goto err;
1115
1116 /* Check chain is acceptable */
1117 ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain);
1118
1119err:
1120 X509_STORE_CTX_cleanup(&crl_ctx);
1121 return ret;
1122}
1123
1124/* RFC3280 says nothing about the relationship between CRL path
1125 * and certificate path, which could lead to situations where a
1126 * certificate could be revoked or validated by a CA not authorised
1127 * to do so. RFC5280 is more strict and states that the two paths must
1128 * end in the same trust anchor, though some discussions remain...
1129 * until this is resolved we use the RFC5280 version
1130 */
1131
1132static int
1133check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path,
1134 STACK_OF(X509) *crl_path)
1135{
1136 X509 *cert_ta, *crl_ta;
1137
1138 cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1);
1139 crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1);
1140 if (!X509_cmp(cert_ta, crl_ta))
1141 return 1;
1142 return 0;
1143}
1144
1145/* Check for match between two dist point names: three separate cases.
1146 * 1. Both are relative names and compare X509_NAME types.
1147 * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES.
1148 * 3. Both are full names and compare two GENERAL_NAMES.
1149 * 4. One is NULL: automatic match.
1150 */
1151
1152static int
1153idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b)
1154{
1155 X509_NAME *nm = NULL;
1156 GENERAL_NAMES *gens = NULL;
1157 GENERAL_NAME *gena, *genb;
1158 int i, j;
1159
1160 if (!a || !b)
1161 return 1;
1162 if (a->type == 1) {
1163 if (!a->dpname)
1164 return 0;
1165 /* Case 1: two X509_NAME */
1166 if (b->type == 1) {
1167 if (!b->dpname)
1168 return 0;
1169 if (!X509_NAME_cmp(a->dpname, b->dpname))
1170 return 1;
1171 else
1172 return 0;
1173 }
1174 /* Case 2: set name and GENERAL_NAMES appropriately */
1175 nm = a->dpname;
1176 gens = b->name.fullname;
1177 } else if (b->type == 1) {
1178 if (!b->dpname)
1179 return 0;
1180 /* Case 2: set name and GENERAL_NAMES appropriately */
1181 gens = a->name.fullname;
1182 nm = b->dpname;
1183 }
1184
1185 /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */
1186 if (nm) {
1187 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
1188 gena = sk_GENERAL_NAME_value(gens, i);
1189 if (gena->type != GEN_DIRNAME)
1190 continue;
1191 if (!X509_NAME_cmp(nm, gena->d.directoryName))
1192 return 1;
1193 }
1194 return 0;
1195 }
1196
1197 /* Else case 3: two GENERAL_NAMES */
1198
1199 for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) {
1200 gena = sk_GENERAL_NAME_value(a->name.fullname, i);
1201 for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) {
1202 genb = sk_GENERAL_NAME_value(b->name.fullname, j);
1203 if (!GENERAL_NAME_cmp(gena, genb))
1204 return 1;
1205 }
1206 }
1207
1208 return 0;
1209}
1210
1211static int
1212crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score)
1213{
1214 int i;
1215 X509_NAME *nm = X509_CRL_get_issuer(crl);
1216
1217 /* If no CRLissuer return is successful iff don't need a match */
1218 if (!dp->CRLissuer)
1219 return !!(crl_score & CRL_SCORE_ISSUER_NAME);
1220 for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) {
1221 GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i);
1222 if (gen->type != GEN_DIRNAME)
1223 continue;
1224 if (!X509_NAME_cmp(gen->d.directoryName, nm))
1225 return 1;
1226 }
1227 return 0;
1228}
1229
1230/* Check CRLDP and IDP */
1231
1232static int
1233crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, unsigned int *preasons)
1234{
1235 int i;
1236
1237 if (crl->idp_flags & IDP_ONLYATTR)
1238 return 0;
1239 if (x->ex_flags & EXFLAG_CA) {
1240 if (crl->idp_flags & IDP_ONLYUSER)
1241 return 0;
1242 } else {
1243 if (crl->idp_flags & IDP_ONLYCA)
1244 return 0;
1245 }
1246 *preasons = crl->idp_reasons;
1247 for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) {
1248 DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i);
1249 if (crldp_check_crlissuer(dp, crl, crl_score)) {
1250 if (!crl->idp ||
1251 idp_check_dp(dp->distpoint, crl->idp->distpoint)) {
1252 *preasons &= dp->dp_reasons;
1253 return 1;
1254 }
1255 }
1256 }
1257 if ((!crl->idp || !crl->idp->distpoint) &&
1258 (crl_score & CRL_SCORE_ISSUER_NAME))
1259 return 1;
1260 return 0;
1261}
1262
1263/* Retrieve CRL corresponding to current certificate.
1264 * If deltas enabled try to find a delta CRL too
1265 */
1266
1267static int
1268get_crl_delta(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x)
1269{
1270 int ok;
1271 X509 *issuer = NULL;
1272 int crl_score = 0;
1273 unsigned int reasons;
1274 X509_CRL *crl = NULL, *dcrl = NULL;
1275 STACK_OF(X509_CRL) *skcrl;
1276 X509_NAME *nm = X509_get_issuer_name(x);
1277
1278 reasons = ctx->current_reasons;
1279 ok = get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons,
1280 ctx->crls);
1281 if (ok)
1282 goto done;
1283
1284 /* Lookup CRLs from store */
1285 skcrl = ctx->lookup_crls(ctx, nm);
1286
1287 /* If no CRLs found and a near match from get_crl_sk use that */
1288 if (!skcrl && crl)
1289 goto done;
1290
1291 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);
1292
1293 sk_X509_CRL_pop_free(skcrl, X509_CRL_free);
1294
1295done:
1296
1297 /* If we got any kind of CRL use it and return success */
1298 if (crl) {
1299 ctx->current_issuer = issuer;
1300 ctx->current_crl_score = crl_score;
1301 ctx->current_reasons = reasons;
1302 *pcrl = crl;
1303 *pdcrl = dcrl;
1304 return 1;
1305 }
1306
1307 return 0;
1308}
1309
1310/* Check CRL validity */
1311static int
1312check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
1313{
1314 X509 *issuer = NULL;
1315 EVP_PKEY *ikey = NULL;
1316 int ok = 0, chnum, cnum;
1317
1318 cnum = ctx->error_depth;
1319 chnum = sk_X509_num(ctx->chain) - 1;
1320 /* if we have an alternative CRL issuer cert use that */
1321 if (ctx->current_issuer) {
1322 issuer = ctx->current_issuer;
1323 } else if (cnum < chnum) {
1324 /* Else find CRL issuer: if not last certificate then issuer
1325 * is next certificate in chain.
1326 */
1327 issuer = sk_X509_value(ctx->chain, cnum + 1);
1328 } else {
1329 issuer = sk_X509_value(ctx->chain, chnum);
1330 /* If not self signed, can't check signature */
1331 if (!ctx->check_issued(ctx, issuer, issuer)) {
1332 ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER;
1333 ok = ctx->verify_cb(0, ctx);
1334 if (!ok)
1335 goto err;
1336 }
1337 }
1338
1339 if (issuer) {
1340 /* Skip most tests for deltas because they have already
1341 * been done
1342 */
1343 if (!crl->base_crl_number) {
1344 /* Check for cRLSign bit if keyUsage present */
1345 if ((issuer->ex_flags & EXFLAG_KUSAGE) &&
1346 !(issuer->ex_kusage & KU_CRL_SIGN)) {
1347 ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN;
1348 ok = ctx->verify_cb(0, ctx);
1349 if (!ok)
1350 goto err;
1351 }
1352
1353 if (!(ctx->current_crl_score & CRL_SCORE_SCOPE)) {
1354 ctx->error = X509_V_ERR_DIFFERENT_CRL_SCOPE;
1355 ok = ctx->verify_cb(0, ctx);
1356 if (!ok)
1357 goto err;
1358 }
1359
1360 if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH)) {
1361 if (check_crl_path(ctx,
1362 ctx->current_issuer) <= 0) {
1363 ctx->error = X509_V_ERR_CRL_PATH_VALIDATION_ERROR;
1364 ok = ctx->verify_cb(0, ctx);
1365 if (!ok)
1366 goto err;
1367 }
1368 }
1369
1370 if (crl->idp_flags & IDP_INVALID) {
1371 ctx->error = X509_V_ERR_INVALID_EXTENSION;
1372 ok = ctx->verify_cb(0, ctx);
1373 if (!ok)
1374 goto err;
1375 }
1376
1377
1378 }
1379
1380 if (!(ctx->current_crl_score & CRL_SCORE_TIME)) {
1381 ok = check_crl_time(ctx, crl, 1);
1382 if (!ok)
1383 goto err;
1384 }
1385
1386 /* Attempt to get issuer certificate public key */
1387 ikey = X509_get_pubkey(issuer);
1388
1389 if (!ikey) {
1390 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
1391 ok = ctx->verify_cb(0, ctx);
1392 if (!ok)
1393 goto err;
1394 } else {
1395 /* Verify CRL signature */
1396 if (X509_CRL_verify(crl, ikey) <= 0) {
1397 ctx->error = X509_V_ERR_CRL_SIGNATURE_FAILURE;
1398 ok = ctx->verify_cb(0, ctx);
1399 if (!ok)
1400 goto err;
1401 }
1402 }
1403 }
1404
1405 ok = 1;
1406
1407err:
1408 EVP_PKEY_free(ikey);
1409 return ok;
1410}
1411
1412/* Check certificate against CRL */
1413static int
1414cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
1415{
1416 int ok;
1417 X509_REVOKED *rev;
1418
1419 /* The rules changed for this... previously if a CRL contained
1420 * unhandled critical extensions it could still be used to indicate
1421 * a certificate was revoked. This has since been changed since
1422 * critical extension can change the meaning of CRL entries.
1423 */
1424 if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) &&
1425 (crl->flags & EXFLAG_CRITICAL)) {
1426 ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
1427 ok = ctx->verify_cb(0, ctx);
1428 if (!ok)
1429 return 0;
1430 }
1431 /* Look for serial number of certificate in CRL
1432 * If found make sure reason is not removeFromCRL.
1433 */
1434 if (X509_CRL_get0_by_cert(crl, &rev, x)) {
1435 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
1436 return 2;
1437 ctx->error = X509_V_ERR_CERT_REVOKED;
1438 ok = ctx->verify_cb(0, ctx);
1439 if (!ok)
1440 return 0;
1441 }
1442
1443 return 1;
1444}
1445
1446static int
1447check_policy(X509_STORE_CTX *ctx)
1448{
1449 int ret;
1450
1451 if (ctx->parent)
1452 return 1;
1453 ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
1454 ctx->param->policies, ctx->param->flags);
1455 if (ret == 0) {
1456 X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
1457 return 0;
1458 }
1459 /* Invalid or inconsistent extensions */
1460 if (ret == -1) {
1461 /* Locate certificates with bad extensions and notify
1462 * callback.
1463 */
1464 X509 *x;
1465 int i;
1466 for (i = 1; i < sk_X509_num(ctx->chain); i++) {
1467 x = sk_X509_value(ctx->chain, i);
1468 if (!(x->ex_flags & EXFLAG_INVALID_POLICY))
1469 continue;
1470 ctx->current_cert = x;
1471 ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION;
1472 if (!ctx->verify_cb(0, ctx))
1473 return 0;
1474 }
1475 return 1;
1476 }
1477 if (ret == -2) {
1478 ctx->current_cert = NULL;
1479 ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY;
1480 return ctx->verify_cb(0, ctx);
1481 }
1482
1483 if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) {
1484 ctx->current_cert = NULL;
1485 ctx->error = X509_V_OK;
1486 if (!ctx->verify_cb(2, ctx))
1487 return 0;
1488 }
1489
1490 return 1;
1491}
1492
1493int
1494x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet)
1495{
1496 time_t *ptime;
1497 int i;
1498
1499 if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
1500 ptime = &ctx->param->check_time;
1501 else
1502 ptime = NULL;
1503
1504 i = X509_cmp_time(X509_get_notBefore(x), ptime);
1505 if (i == 0) {
1506 if (quiet)
1507 return 0;
1508 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
1509 ctx->current_cert = x;
1510 if (!ctx->verify_cb(0, ctx))
1511 return 0;
1512 }
1513
1514 if (i > 0) {
1515 if (quiet)
1516 return 0;
1517 ctx->error = X509_V_ERR_CERT_NOT_YET_VALID;
1518 ctx->current_cert = x;
1519 if (!ctx->verify_cb(0, ctx))
1520 return 0;
1521 }
1522
1523 i = X509_cmp_time(X509_get_notAfter(x), ptime);
1524 if (i == 0) {
1525 if (quiet)
1526 return 0;
1527 ctx->error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
1528 ctx->current_cert = x;
1529 if (!ctx->verify_cb(0, ctx))
1530 return 0;
1531 }
1532
1533 if (i < 0) {
1534 if (quiet)
1535 return 0;
1536 ctx->error = X509_V_ERR_CERT_HAS_EXPIRED;
1537 ctx->current_cert = x;
1538 if (!ctx->verify_cb(0, ctx))
1539 return 0;
1540 }
1541
1542 return 1;
1543}
1544
1545static int
1546internal_verify(X509_STORE_CTX *ctx)
1547{
1548 int ok = 0, n;
1549 X509 *xs, *xi;
1550 EVP_PKEY *pkey = NULL;
1551 int (*cb)(int xok, X509_STORE_CTX *xctx);
1552
1553 cb = ctx->verify_cb;
1554
1555 n = sk_X509_num(ctx->chain);
1556 ctx->error_depth = n - 1;
1557 n--;
1558 xi = sk_X509_value(ctx->chain, n);
1559
1560 if (ctx->check_issued(ctx, xi, xi))
1561 xs = xi;
1562 else {
1563 if (n <= 0) {
1564 ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
1565 ctx->current_cert = xi;
1566 ok = cb(0, ctx);
1567 goto end;
1568 } else {
1569 n--;
1570 ctx->error_depth = n;
1571 xs = sk_X509_value(ctx->chain, n);
1572 }
1573 }
1574
1575/* ctx->error=0; not needed */
1576 while (n >= 0) {
1577 ctx->error_depth = n;
1578
1579 /* Skip signature check for self signed certificates unless
1580 * explicitly asked for. It doesn't add any security and
1581 * just wastes time.
1582 */
1583 if (!xs->valid && (xs != xi ||
1584 (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE))) {
1585 if ((pkey = X509_get_pubkey(xi)) == NULL) {
1586 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
1587 ctx->current_cert = xi;
1588 ok = (*cb)(0, ctx);
1589 if (!ok)
1590 goto end;
1591 } else if (X509_verify(xs, pkey) <= 0) {
1592 ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE;
1593 ctx->current_cert = xs;
1594 ok = (*cb)(0, ctx);
1595 if (!ok) {
1596 EVP_PKEY_free(pkey);
1597 goto end;
1598 }
1599 }
1600 EVP_PKEY_free(pkey);
1601 pkey = NULL;
1602 }
1603
1604 xs->valid = 1;
1605
1606 ok = x509_check_cert_time(ctx, xs, 0);
1607 if (!ok)
1608 goto end;
1609
1610 /* The last error (if any) is still in the error value */
1611 ctx->current_issuer = xi;
1612 ctx->current_cert = xs;
1613 ok = (*cb)(1, ctx);
1614 if (!ok)
1615 goto end;
1616
1617 n--;
1618 if (n >= 0) {
1619 xi = xs;
1620 xs = sk_X509_value(ctx->chain, n);
1621 }
1622 }
1623 ok = 1;
1624
1625end:
1626 return ok;
1627}
1628
1629int
1630X509_cmp_current_time(const ASN1_TIME *ctm)
1631{
1632 return X509_cmp_time(ctm, NULL);
1633}
1634
1635int
1636X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
1637{
1638 char *str;
1639 ASN1_TIME atm;
1640 long offset;
1641 char buff1[24], buff2[24], *p;
1642 int i, j;
1643
1644 p = buff1;
1645 i = ctm->length;
1646 str = (char *)ctm->data;
1647 if (ctm->type == V_ASN1_UTCTIME) {
1648 if ((i < 11) || (i > 17))
1649 return 0;
1650 memcpy(p, str, 10);
1651 p += 10;
1652 str += 10;
1653 } else {
1654 if (i < 13)
1655 return 0;
1656 memcpy(p, str, 12);
1657 p += 12;
1658 str += 12;
1659 }
1660
1661 if ((*str == 'Z') || (*str == '-') || (*str == '+')) {
1662 *(p++) = '0';
1663 *(p++) = '0';
1664 } else {
1665 *(p++) = *(str++);
1666 *(p++) = *(str++);
1667 /* Skip any fractional seconds... */
1668 if (*str == '.') {
1669 str++;
1670 while ((*str >= '0') && (*str <= '9'))
1671 str++;
1672 }
1673 }
1674 *(p++) = 'Z';
1675 *(p++) = '\0';
1676
1677 if (*str == 'Z')
1678 offset = 0;
1679 else {
1680 if ((*str != '+') && (*str != '-'))
1681 return 0;
1682 offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60;
1683 offset += (str[3] - '0') * 10 + (str[4] - '0');
1684 if (*str == '-')
1685 offset = -offset;
1686 }
1687 atm.type = ctm->type;
1688 atm.flags = 0;
1689 atm.length = sizeof(buff2);
1690 atm.data = (unsigned char *)buff2;
1691
1692 if (X509_time_adj(&atm, offset * 60, cmp_time) == NULL)
1693 return 0;
1694
1695 if (ctm->type == V_ASN1_UTCTIME) {
1696 i = (buff1[0] - '0') * 10 + (buff1[1] - '0');
1697 if (i < 50)
1698 i += 100; /* cf. RFC 2459 */
1699 j = (buff2[0] - '0') * 10 + (buff2[1] - '0');
1700 if (j < 50)
1701 j += 100;
1702 if (i < j)
1703 return -1;
1704 if (i > j)
1705 return 1;
1706 }
1707 i = strcmp(buff1, buff2);
1708 if (i == 0) /* wait a second then return younger :-) */
1709 return -1;
1710 else
1711 return i;
1712}
1713
1714ASN1_TIME *
1715X509_gmtime_adj(ASN1_TIME *s, long adj)
1716{
1717 return X509_time_adj(s, adj, NULL);
1718}
1719
1720ASN1_TIME *
1721X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm)
1722{
1723 return X509_time_adj_ex(s, 0, offset_sec, in_tm);
1724}
1725
1726ASN1_TIME *
1727X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, time_t *in_tm)
1728{
1729 time_t t;
1730
1731 if (in_tm)
1732 t = *in_tm;
1733 else
1734 time(&t);
1735
1736 if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) {
1737 if (s->type == V_ASN1_UTCTIME)
1738 return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec);
1739 if (s->type == V_ASN1_GENERALIZEDTIME)
1740 return ASN1_GENERALIZEDTIME_adj(s, t, offset_day,
1741 offset_sec);
1742 }
1743 return ASN1_TIME_adj(s, t, offset_day, offset_sec);
1744}
1745
1746int
1747X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain)
1748{
1749 EVP_PKEY *ktmp = NULL, *ktmp2;
1750 int i, j;
1751
1752 if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey))
1753 return 1;
1754
1755 for (i = 0; i < sk_X509_num(chain); i++) {
1756 ktmp = X509_get_pubkey(sk_X509_value(chain, i));
1757 if (ktmp == NULL) {
1758 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
1759 X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY);
1760 return 0;
1761 }
1762 if (!EVP_PKEY_missing_parameters(ktmp))
1763 break;
1764 else {
1765 EVP_PKEY_free(ktmp);
1766 ktmp = NULL;
1767 }
1768 }
1769 if (ktmp == NULL) {
1770 X509err(X509_F_X509_GET_PUBKEY_PARAMETERS,
1771 X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN);
1772 return 0;
1773 }
1774
1775 /* first, populate the other certs */
1776 for (j = i - 1; j >= 0; j--) {
1777 ktmp2 = X509_get_pubkey(sk_X509_value(chain, j));
1778 EVP_PKEY_copy_parameters(ktmp2, ktmp);
1779 EVP_PKEY_free(ktmp2);
1780 }
1781
1782 if (pkey != NULL)
1783 EVP_PKEY_copy_parameters(pkey, ktmp);
1784 EVP_PKEY_free(ktmp);
1785 return 1;
1786}
1787
1788int
1789X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
1790 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
1791{
1792 /* This function is (usually) called only once, by
1793 * SSL_get_ex_data_X509_STORE_CTX_idx (ssl/ssl_cert.c). */
1794 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE_CTX,
1795 argl, argp, new_func, dup_func, free_func);
1796}
1797
1798int
1799X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data)
1800{
1801 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
1802}
1803
1804void *
1805X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx)
1806{
1807 return CRYPTO_get_ex_data(&ctx->ex_data, idx);
1808}
1809
1810int
1811X509_STORE_CTX_get_error(X509_STORE_CTX *ctx)
1812{
1813 return ctx->error;
1814}
1815
1816void
1817X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err)
1818{
1819 ctx->error = err;
1820}
1821
1822int
1823X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx)
1824{
1825 return ctx->error_depth;
1826}
1827
1828X509 *
1829X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx)
1830{
1831 return ctx->current_cert;
1832}
1833
1834STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx)
1835{
1836 return ctx->chain;
1837}
1838
1839STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx)
1840{
1841 int i;
1842 X509 *x;
1843 STACK_OF(X509) *chain;
1844
1845 if (!ctx->chain || !(chain = sk_X509_dup(ctx->chain)))
1846 return NULL;
1847 for (i = 0; i < sk_X509_num(chain); i++) {
1848 x = sk_X509_value(chain, i);
1849 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
1850 }
1851 return chain;
1852}
1853
1854X509 *
1855X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx)
1856{
1857 return ctx->current_issuer;
1858}
1859
1860X509_CRL *
1861X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx)
1862{
1863 return ctx->current_crl;
1864}
1865
1866X509_STORE_CTX *
1867X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx)
1868{
1869 return ctx->parent;
1870}
1871
1872void
1873X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x)
1874{
1875 ctx->cert = x;
1876}
1877
1878void
1879X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
1880{
1881 ctx->untrusted = sk;
1882}
1883
1884void
1885X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk)
1886{
1887 ctx->crls = sk;
1888}
1889
1890int
1891X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
1892{
1893 return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
1894}
1895
1896int
1897X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
1898{
1899 return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
1900}
1901
1902/* This function is used to set the X509_STORE_CTX purpose and trust
1903 * values. This is intended to be used when another structure has its
1904 * own trust and purpose values which (if set) will be inherited by
1905 * the ctx. If they aren't set then we will usually have a default
1906 * purpose in mind which should then be used to set the trust value.
1907 * An example of this is SSL use: an SSL structure will have its own
1908 * purpose and trust settings which the application can set: if they
1909 * aren't set then we use the default of SSL client/server.
1910 */
1911
1912int
1913X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
1914 int purpose, int trust)
1915{
1916 int idx;
1917
1918 /* If purpose not set use default */
1919 if (!purpose)
1920 purpose = def_purpose;
1921 /* If we have a purpose then check it is valid */
1922 if (purpose) {
1923 X509_PURPOSE *ptmp;
1924 idx = X509_PURPOSE_get_by_id(purpose);
1925 if (idx == -1) {
1926 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1927 X509_R_UNKNOWN_PURPOSE_ID);
1928 return 0;
1929 }
1930 ptmp = X509_PURPOSE_get0(idx);
1931 if (ptmp->trust == X509_TRUST_DEFAULT) {
1932 idx = X509_PURPOSE_get_by_id(def_purpose);
1933 if (idx == -1) {
1934 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1935 X509_R_UNKNOWN_PURPOSE_ID);
1936 return 0;
1937 }
1938 ptmp = X509_PURPOSE_get0(idx);
1939 }
1940 /* If trust not set then get from purpose default */
1941 if (!trust)
1942 trust = ptmp->trust;
1943 }
1944 if (trust) {
1945 idx = X509_TRUST_get_by_id(trust);
1946 if (idx == -1) {
1947 X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
1948 X509_R_UNKNOWN_TRUST_ID);
1949 return 0;
1950 }
1951 }
1952
1953 if (purpose && !ctx->param->purpose)
1954 ctx->param->purpose = purpose;
1955 if (trust && !ctx->param->trust)
1956 ctx->param->trust = trust;
1957 return 1;
1958}
1959
1960X509_STORE_CTX *
1961X509_STORE_CTX_new(void)
1962{
1963 X509_STORE_CTX *ctx;
1964
1965 ctx = calloc(1, sizeof(X509_STORE_CTX));
1966 if (!ctx) {
1967 X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE);
1968 return NULL;
1969 }
1970 return ctx;
1971}
1972
1973void
1974X509_STORE_CTX_free(X509_STORE_CTX *ctx)
1975{
1976 if (ctx == NULL)
1977 return;
1978
1979 X509_STORE_CTX_cleanup(ctx);
1980 free(ctx);
1981}
1982
1983int
1984X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
1985 STACK_OF(X509) *chain)
1986{
1987 int ret = 1;
1988
1989 ctx->ctx = store;
1990 ctx->current_method = 0;
1991 ctx->cert = x509;
1992 ctx->untrusted = chain;
1993 ctx->crls = NULL;
1994 ctx->last_untrusted = 0;
1995 ctx->other_ctx = NULL;
1996 ctx->valid = 0;
1997 ctx->chain = NULL;
1998 ctx->error = 0;
1999 ctx->explicit_policy = 0;
2000 ctx->error_depth = 0;
2001 ctx->current_cert = NULL;
2002 ctx->current_issuer = NULL;
2003 ctx->current_crl = NULL;
2004 ctx->current_crl_score = 0;
2005 ctx->current_reasons = 0;
2006 ctx->tree = NULL;
2007 ctx->parent = NULL;
2008
2009 ctx->param = X509_VERIFY_PARAM_new();
2010
2011 if (!ctx->param) {
2012 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2013 return 0;
2014 }
2015
2016 /* Inherit callbacks and flags from X509_STORE if not set
2017 * use defaults.
2018 */
2019
2020 if (store)
2021 ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param);
2022 else
2023 ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT|X509_VP_FLAG_ONCE;
2024
2025 if (store) {
2026 ctx->verify_cb = store->verify_cb;
2027 ctx->cleanup = store->cleanup;
2028 } else
2029 ctx->cleanup = 0;
2030
2031 if (ret)
2032 ret = X509_VERIFY_PARAM_inherit(ctx->param,
2033 X509_VERIFY_PARAM_lookup("default"));
2034
2035 if (ret == 0) {
2036 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2037 return 0;
2038 }
2039
2040 if (store && store->check_issued)
2041 ctx->check_issued = store->check_issued;
2042 else
2043 ctx->check_issued = check_issued;
2044
2045 if (store && store->get_issuer)
2046 ctx->get_issuer = store->get_issuer;
2047 else
2048 ctx->get_issuer = X509_STORE_CTX_get1_issuer;
2049
2050 if (store && store->verify_cb)
2051 ctx->verify_cb = store->verify_cb;
2052 else
2053 ctx->verify_cb = null_callback;
2054
2055 if (store && store->verify)
2056 ctx->verify = store->verify;
2057 else
2058 ctx->verify = internal_verify;
2059
2060 if (store && store->check_revocation)
2061 ctx->check_revocation = store->check_revocation;
2062 else
2063 ctx->check_revocation = check_revocation;
2064
2065 if (store && store->get_crl)
2066 ctx->get_crl = store->get_crl;
2067 else
2068 ctx->get_crl = NULL;
2069
2070 if (store && store->check_crl)
2071 ctx->check_crl = store->check_crl;
2072 else
2073 ctx->check_crl = check_crl;
2074
2075 if (store && store->cert_crl)
2076 ctx->cert_crl = store->cert_crl;
2077 else
2078 ctx->cert_crl = cert_crl;
2079
2080 if (store && store->lookup_certs)
2081 ctx->lookup_certs = store->lookup_certs;
2082 else
2083 ctx->lookup_certs = X509_STORE_get1_certs;
2084
2085 if (store && store->lookup_crls)
2086 ctx->lookup_crls = store->lookup_crls;
2087 else
2088 ctx->lookup_crls = X509_STORE_get1_crls;
2089
2090 ctx->check_policy = check_policy;
2091
2092
2093 if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx,
2094 &(ctx->ex_data)) == 0) {
2095 X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE);
2096 return 0;
2097 }
2098 return 1;
2099}
2100
2101/* Set alternative lookup method: just a STACK of trusted certificates.
2102 * This avoids X509_STORE nastiness where it isn't needed.
2103 */
2104
2105void
2106X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
2107{
2108 ctx->other_ctx = sk;
2109 ctx->get_issuer = get_issuer_sk;
2110}
2111
2112void
2113X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
2114{
2115 if (ctx->cleanup)
2116 ctx->cleanup(ctx);
2117 if (ctx->param != NULL) {
2118 if (ctx->parent == NULL)
2119 X509_VERIFY_PARAM_free(ctx->param);
2120 ctx->param = NULL;
2121 }
2122 if (ctx->tree != NULL) {
2123 X509_policy_tree_free(ctx->tree);
2124 ctx->tree = NULL;
2125 }
2126 if (ctx->chain != NULL) {
2127 sk_X509_pop_free(ctx->chain, X509_free);
2128 ctx->chain = NULL;
2129 }
2130 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX,
2131 ctx, &(ctx->ex_data));
2132 memset(&ctx->ex_data, 0, sizeof(CRYPTO_EX_DATA));
2133}
2134
2135void
2136X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth)
2137{
2138 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
2139}
2140
2141void
2142X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags)
2143{
2144 X509_VERIFY_PARAM_set_flags(ctx->param, flags);
2145}
2146
2147void
2148X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, time_t t)
2149{
2150 X509_VERIFY_PARAM_set_time(ctx->param, t);
2151}
2152
2153void
2154X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
2155 int (*verify_cb)(int, X509_STORE_CTX *))
2156{
2157 ctx->verify_cb = verify_cb;
2158}
2159
2160X509_POLICY_TREE *
2161X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx)
2162{
2163 return ctx->tree;
2164}
2165
2166int
2167X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx)
2168{
2169 return ctx->explicit_policy;
2170}
2171
2172int
2173X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name)
2174{
2175 const X509_VERIFY_PARAM *param;
2176 param = X509_VERIFY_PARAM_lookup(name);
2177 if (!param)
2178 return 0;
2179 return X509_VERIFY_PARAM_inherit(ctx->param, param);
2180}
2181
2182X509_VERIFY_PARAM *
2183X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx)
2184{
2185 return ctx->param;
2186}
2187
2188void
2189X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param)
2190{
2191 if (ctx->param)
2192 X509_VERIFY_PARAM_free(ctx->param);
2193 ctx->param = param;
2194}
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
deleted file mode 100644
index e760279b52..0000000000
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ /dev/null
@@ -1,559 +0,0 @@
1/* $OpenBSD: x509_vfy.h,v 1.15 2015/02/07 13:19:15 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_X509_H
60#include <openssl/x509.h>
61/* openssl/x509.h ends up #include-ing this file at about the only
62 * appropriate moment. */
63#endif
64
65#ifndef HEADER_X509_VFY_H
66#define HEADER_X509_VFY_H
67
68#include <openssl/opensslconf.h>
69
70#ifndef OPENSSL_NO_LHASH
71#include <openssl/lhash.h>
72#endif
73#include <openssl/bio.h>
74#include <openssl/crypto.h>
75
76#ifdef __cplusplus
77extern "C" {
78#endif
79
80typedef struct x509_file_st
81 {
82 int num_paths; /* number of paths to files or directories */
83 int num_alloced;
84 char **paths; /* the list of paths or directories */
85 int *path_type;
86 } X509_CERT_FILE_CTX;
87
88/*******************************/
89/*
90SSL_CTX -> X509_STORE
91 -> X509_LOOKUP
92 ->X509_LOOKUP_METHOD
93 -> X509_LOOKUP
94 ->X509_LOOKUP_METHOD
95
96SSL -> X509_STORE_CTX
97 ->X509_STORE
98
99The X509_STORE holds the tables etc for verification stuff.
100A X509_STORE_CTX is used while validating a single certificate.
101The X509_STORE has X509_LOOKUPs for looking up certs.
102The X509_STORE then calls a function to actually verify the
103certificate chain.
104*/
105
106#define X509_LU_RETRY -1
107#define X509_LU_FAIL 0
108#define X509_LU_X509 1
109#define X509_LU_CRL 2
110#define X509_LU_PKEY 3
111
112typedef struct x509_object_st
113 {
114 /* one of the above types */
115 int type;
116 union {
117 char *ptr;
118 X509 *x509;
119 X509_CRL *crl;
120 EVP_PKEY *pkey;
121 } data;
122 } X509_OBJECT;
123
124typedef struct x509_lookup_st X509_LOOKUP;
125
126DECLARE_STACK_OF(X509_LOOKUP)
127DECLARE_STACK_OF(X509_OBJECT)
128
129/* This is a static that defines the function interface */
130typedef struct x509_lookup_method_st
131 {
132 const char *name;
133 int (*new_item)(X509_LOOKUP *ctx);
134 void (*free)(X509_LOOKUP *ctx);
135 int (*init)(X509_LOOKUP *ctx);
136 int (*shutdown)(X509_LOOKUP *ctx);
137 int (*ctrl)(X509_LOOKUP *ctx,int cmd,const char *argc,long argl,
138 char **ret);
139 int (*get_by_subject)(X509_LOOKUP *ctx,int type,X509_NAME *name,
140 X509_OBJECT *ret);
141 int (*get_by_issuer_serial)(X509_LOOKUP *ctx,int type,X509_NAME *name,
142 ASN1_INTEGER *serial,X509_OBJECT *ret);
143 int (*get_by_fingerprint)(X509_LOOKUP *ctx,int type,
144 unsigned char *bytes,int len,
145 X509_OBJECT *ret);
146 int (*get_by_alias)(X509_LOOKUP *ctx,int type,char *str,int len,
147 X509_OBJECT *ret);
148 } X509_LOOKUP_METHOD;
149
150/* This structure hold all parameters associated with a verify operation
151 * by including an X509_VERIFY_PARAM structure in related structures the
152 * parameters used can be customized
153 */
154
155typedef struct X509_VERIFY_PARAM_st
156 {
157 char *name;
158 time_t check_time; /* Time to use */
159 unsigned long inh_flags; /* Inheritance flags */
160 unsigned long flags; /* Various verify flags */
161 int purpose; /* purpose to check untrusted certificates */
162 int trust; /* trust setting to check */
163 int depth; /* Verify depth */
164 STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */
165 } X509_VERIFY_PARAM;
166
167DECLARE_STACK_OF(X509_VERIFY_PARAM)
168
169/* This is used to hold everything. It is used for all certificate
170 * validation. Once we have a certificate chain, the 'verify'
171 * function is then called to actually check the cert chain. */
172struct x509_store_st
173 {
174 /* The following is a cache of trusted certs */
175 int cache; /* if true, stash any hits */
176 STACK_OF(X509_OBJECT) *objs; /* Cache of all objects */
177
178 /* These are external lookup methods */
179 STACK_OF(X509_LOOKUP) *get_cert_methods;
180
181 X509_VERIFY_PARAM *param;
182
183 /* Callbacks for various operations */
184 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
185 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
186 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
187 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
188 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
189 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
190 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
191 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
192 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
193 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
194 int (*cleanup)(X509_STORE_CTX *ctx);
195
196 CRYPTO_EX_DATA ex_data;
197 int references;
198 } /* X509_STORE */;
199
200int X509_STORE_set_depth(X509_STORE *store, int depth);
201
202#define X509_STORE_set_verify_cb_func(ctx,func) ((ctx)->verify_cb=(func))
203#define X509_STORE_set_verify_func(ctx,func) ((ctx)->verify=(func))
204
205/* This is the functions plus an instance of the local variables. */
206struct x509_lookup_st
207 {
208 int init; /* have we been started */
209 int skip; /* don't use us. */
210 X509_LOOKUP_METHOD *method; /* the functions */
211 char *method_data; /* method data */
212
213 X509_STORE *store_ctx; /* who owns us */
214 } /* X509_LOOKUP */;
215
216/* This is a used when verifying cert chains. Since the
217 * gathering of the cert chain can take some time (and have to be
218 * 'retried', this needs to be kept and passed around. */
219struct x509_store_ctx_st /* X509_STORE_CTX */
220 {
221 X509_STORE *ctx;
222 int current_method; /* used when looking up certs */
223
224 /* The following are set by the caller */
225 X509 *cert; /* The cert to check */
226 STACK_OF(X509) *untrusted; /* chain of X509s - untrusted - passed in */
227 STACK_OF(X509_CRL) *crls; /* set of CRLs passed in */
228
229 X509_VERIFY_PARAM *param;
230 void *other_ctx; /* Other info for use with get_issuer() */
231
232 /* Callbacks for various operations */
233 int (*verify)(X509_STORE_CTX *ctx); /* called to verify a certificate */
234 int (*verify_cb)(int ok,X509_STORE_CTX *ctx); /* error callback */
235 int (*get_issuer)(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); /* get issuers cert from ctx */
236 int (*check_issued)(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); /* check issued */
237 int (*check_revocation)(X509_STORE_CTX *ctx); /* Check revocation status of chain */
238 int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
239 int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
240 int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
241 int (*check_policy)(X509_STORE_CTX *ctx);
242 STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX *ctx, X509_NAME *nm);
243 STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX *ctx, X509_NAME *nm);
244 int (*cleanup)(X509_STORE_CTX *ctx);
245
246 /* The following is built up */
247 int valid; /* if 0, rebuild chain */
248 int last_untrusted; /* index of last untrusted cert */
249 STACK_OF(X509) *chain; /* chain of X509s - built up and trusted */
250 X509_POLICY_TREE *tree; /* Valid policy tree */
251
252 int explicit_policy; /* Require explicit policy value */
253
254 /* When something goes wrong, this is why */
255 int error_depth;
256 int error;
257 X509 *current_cert;
258 X509 *current_issuer; /* cert currently being tested as valid issuer */
259 X509_CRL *current_crl; /* current CRL */
260
261 int current_crl_score; /* score of current CRL */
262 unsigned int current_reasons; /* Reason mask */
263
264 X509_STORE_CTX *parent; /* For CRL path validation: parent context */
265
266 CRYPTO_EX_DATA ex_data;
267 } /* X509_STORE_CTX */;
268
269void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
270
271#define X509_STORE_CTX_set_app_data(ctx,data) \
272 X509_STORE_CTX_set_ex_data(ctx,0,data)
273#define X509_STORE_CTX_get_app_data(ctx) \
274 X509_STORE_CTX_get_ex_data(ctx,0)
275
276#define X509_L_FILE_LOAD 1
277#define X509_L_ADD_DIR 2
278#define X509_L_MEM 3
279
280#define X509_LOOKUP_load_file(x,name,type) \
281 X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL)
282
283#define X509_LOOKUP_add_dir(x,name,type) \
284 X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL)
285
286#define X509_LOOKUP_add_mem(x,iov,type) \
287 X509_LOOKUP_ctrl((x),X509_L_MEM,(const char *)(iov),\
288 (long)(type),NULL)
289
290#define X509_V_OK 0
291/* illegal error (for uninitialized values, to avoid X509_V_OK): 1 */
292
293#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2
294#define X509_V_ERR_UNABLE_TO_GET_CRL 3
295#define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4
296#define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5
297#define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6
298#define X509_V_ERR_CERT_SIGNATURE_FAILURE 7
299#define X509_V_ERR_CRL_SIGNATURE_FAILURE 8
300#define X509_V_ERR_CERT_NOT_YET_VALID 9
301#define X509_V_ERR_CERT_HAS_EXPIRED 10
302#define X509_V_ERR_CRL_NOT_YET_VALID 11
303#define X509_V_ERR_CRL_HAS_EXPIRED 12
304#define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13
305#define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14
306#define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15
307#define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16
308#define X509_V_ERR_OUT_OF_MEM 17
309#define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18
310#define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19
311#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20
312#define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21
313#define X509_V_ERR_CERT_CHAIN_TOO_LONG 22
314#define X509_V_ERR_CERT_REVOKED 23
315#define X509_V_ERR_INVALID_CA 24
316#define X509_V_ERR_PATH_LENGTH_EXCEEDED 25
317#define X509_V_ERR_INVALID_PURPOSE 26
318#define X509_V_ERR_CERT_UNTRUSTED 27
319#define X509_V_ERR_CERT_REJECTED 28
320/* These are 'informational' when looking for issuer cert */
321#define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29
322#define X509_V_ERR_AKID_SKID_MISMATCH 30
323#define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31
324#define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32
325
326#define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33
327#define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34
328#define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35
329#define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36
330#define X509_V_ERR_INVALID_NON_CA 37
331#define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38
332#define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39
333#define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40
334
335#define X509_V_ERR_INVALID_EXTENSION 41
336#define X509_V_ERR_INVALID_POLICY_EXTENSION 42
337#define X509_V_ERR_NO_EXPLICIT_POLICY 43
338#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44
339#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45
340
341#define X509_V_ERR_UNNESTED_RESOURCE 46
342
343#define X509_V_ERR_PERMITTED_VIOLATION 47
344#define X509_V_ERR_EXCLUDED_VIOLATION 48
345#define X509_V_ERR_SUBTREE_MINMAX 49
346#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51
347#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52
348#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53
349#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54
350
351/* The application is not happy */
352#define X509_V_ERR_APPLICATION_VERIFICATION 50
353
354/* Certificate verify flags */
355
356/* Send issuer+subject checks to verify_cb */
357#define X509_V_FLAG_CB_ISSUER_CHECK 0x1
358/* Use check time instead of current time */
359#define X509_V_FLAG_USE_CHECK_TIME 0x2
360/* Lookup CRLs */
361#define X509_V_FLAG_CRL_CHECK 0x4
362/* Lookup CRLs for whole chain */
363#define X509_V_FLAG_CRL_CHECK_ALL 0x8
364/* Ignore unhandled critical extensions */
365#define X509_V_FLAG_IGNORE_CRITICAL 0x10
366/* Disable workarounds for broken certificates */
367#define X509_V_FLAG_X509_STRICT 0x20
368/* Enable proxy certificate validation */
369#define X509_V_FLAG_ALLOW_PROXY_CERTS 0x40
370/* Enable policy checking */
371#define X509_V_FLAG_POLICY_CHECK 0x80
372/* Policy variable require-explicit-policy */
373#define X509_V_FLAG_EXPLICIT_POLICY 0x100
374/* Policy variable inhibit-any-policy */
375#define X509_V_FLAG_INHIBIT_ANY 0x200
376/* Policy variable inhibit-policy-mapping */
377#define X509_V_FLAG_INHIBIT_MAP 0x400
378/* Notify callback that policy is OK */
379#define X509_V_FLAG_NOTIFY_POLICY 0x800
380/* Extended CRL features such as indirect CRLs, alternate CRL signing keys */
381#define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000
382/* Delta CRL support */
383#define X509_V_FLAG_USE_DELTAS 0x2000
384/* Check selfsigned CA signature */
385#define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000
386
387
388#define X509_VP_FLAG_DEFAULT 0x1
389#define X509_VP_FLAG_OVERWRITE 0x2
390#define X509_VP_FLAG_RESET_FLAGS 0x4
391#define X509_VP_FLAG_LOCKED 0x8
392#define X509_VP_FLAG_ONCE 0x10
393
394/* Internal use: mask of policy related options */
395#define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \
396 | X509_V_FLAG_EXPLICIT_POLICY \
397 | X509_V_FLAG_INHIBIT_ANY \
398 | X509_V_FLAG_INHIBIT_MAP)
399
400int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
401 X509_NAME *name);
402X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,int type,X509_NAME *name);
403X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x);
404void X509_OBJECT_up_ref_count(X509_OBJECT *a);
405void X509_OBJECT_free_contents(X509_OBJECT *a);
406X509_STORE *X509_STORE_new(void );
407void X509_STORE_free(X509_STORE *v);
408
409STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *st, X509_NAME *nm);
410STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *st, X509_NAME *nm);
411int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
412int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
413int X509_STORE_set_trust(X509_STORE *ctx, int trust);
414int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
415
416void X509_STORE_set_verify_cb(X509_STORE *ctx,
417 int (*verify_cb)(int, X509_STORE_CTX *));
418
419X509_STORE_CTX *X509_STORE_CTX_new(void);
420
421int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
422
423void X509_STORE_CTX_free(X509_STORE_CTX *ctx);
424int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store,
425 X509 *x509, STACK_OF(X509) *chain);
426void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
427void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx);
428
429X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m);
430
431X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void);
432X509_LOOKUP_METHOD *X509_LOOKUP_file(void);
433X509_LOOKUP_METHOD *X509_LOOKUP_mem(void);
434
435int X509_STORE_add_cert(X509_STORE *ctx, X509 *x);
436int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x);
437
438int X509_STORE_get_by_subject(X509_STORE_CTX *vs,int type,X509_NAME *name,
439 X509_OBJECT *ret);
440
441int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
442 long argl, char **ret);
443
444int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
445int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
446int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type);
447
448
449X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method);
450void X509_LOOKUP_free(X509_LOOKUP *ctx);
451int X509_LOOKUP_init(X509_LOOKUP *ctx);
452int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
453 X509_OBJECT *ret);
454int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
455 ASN1_INTEGER *serial, X509_OBJECT *ret);
456int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type,
457 unsigned char *bytes, int len, X509_OBJECT *ret);
458int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, char *str,
459 int len, X509_OBJECT *ret);
460int X509_LOOKUP_shutdown(X509_LOOKUP *ctx);
461
462int X509_STORE_load_locations (X509_STORE *ctx,
463 const char *file, const char *dir);
464int X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len);
465int X509_STORE_set_default_paths(X509_STORE *ctx);
466
467int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
468 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
469int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data);
470void * X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
471int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
472void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s);
473int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
474X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
475X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
476X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
477X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx);
478STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
479STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
480void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
481void X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
482void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c,STACK_OF(X509_CRL) *sk);
483int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
484int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
485int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
486 int purpose, int trust);
487void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags);
488void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
489 time_t t);
490void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
491 int (*verify_cb)(int, X509_STORE_CTX *));
492
493X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx);
494int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx);
495
496X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
497void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
498int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
499
500/* X509_VERIFY_PARAM functions */
501
502X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
503void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);
504int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to,
505 const X509_VERIFY_PARAM *from);
506int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
507 const X509_VERIFY_PARAM *from);
508int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);
509int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
510int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
511 unsigned long flags);
512unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
513int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
514int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
515void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
516void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
517int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
518 ASN1_OBJECT *policy);
519int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
520 STACK_OF(ASN1_OBJECT) *policies);
521int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
522
523int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);
524const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name);
525void X509_VERIFY_PARAM_table_cleanup(void);
526
527int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
528 STACK_OF(X509) *certs,
529 STACK_OF(ASN1_OBJECT) *policy_oids,
530 unsigned int flags);
531
532void X509_policy_tree_free(X509_POLICY_TREE *tree);
533
534int X509_policy_tree_level_count(const X509_POLICY_TREE *tree);
535X509_POLICY_LEVEL *
536 X509_policy_tree_get0_level(const X509_POLICY_TREE *tree, int i);
537
538STACK_OF(X509_POLICY_NODE) *
539 X509_policy_tree_get0_policies(const X509_POLICY_TREE *tree);
540
541STACK_OF(X509_POLICY_NODE) *
542 X509_policy_tree_get0_user_policies(const X509_POLICY_TREE *tree);
543
544int X509_policy_level_node_count(X509_POLICY_LEVEL *level);
545
546X509_POLICY_NODE *X509_policy_level_get0_node(X509_POLICY_LEVEL *level, int i);
547
548const ASN1_OBJECT *X509_policy_node_get0_policy(const X509_POLICY_NODE *node);
549
550STACK_OF(POLICYQUALINFO) *
551 X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node);
552const X509_POLICY_NODE *
553 X509_policy_node_get0_parent(const X509_POLICY_NODE *node);
554
555#ifdef __cplusplus
556}
557#endif
558#endif
559
diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c
deleted file mode 100644
index 8ec972050d..0000000000
--- a/src/lib/libcrypto/x509/x509_vpm.c
+++ /dev/null
@@ -1,449 +0,0 @@
1/* $OpenBSD: x509_vpm.c,v 1.11 2014/09/29 04:16:49 miod Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2004.
4 */
5/* ====================================================================
6 * Copyright (c) 2004 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/buffer.h>
63#include <openssl/crypto.h>
64#include <openssl/lhash.h>
65#include <openssl/x509.h>
66#include <openssl/x509v3.h>
67
68/* X509_VERIFY_PARAM functions */
69
70static void
71x509_verify_param_zero(X509_VERIFY_PARAM *param)
72{
73 if (!param)
74 return;
75 param->name = NULL;
76 param->purpose = 0;
77 param->trust = 0;
78 /*param->inh_flags = X509_VP_FLAG_DEFAULT;*/
79 param->inh_flags = 0;
80 param->flags = 0;
81 param->depth = -1;
82 if (param->policies) {
83 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
84 param->policies = NULL;
85 }
86}
87
88X509_VERIFY_PARAM *
89X509_VERIFY_PARAM_new(void)
90{
91 X509_VERIFY_PARAM *param;
92
93 param = calloc(1, sizeof(X509_VERIFY_PARAM));
94 x509_verify_param_zero(param);
95 return param;
96}
97
98void
99X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
100{
101 x509_verify_param_zero(param);
102 free(param);
103}
104
105/* This function determines how parameters are "inherited" from one structure
106 * to another. There are several different ways this can happen.
107 *
108 * 1. If a child structure needs to have its values initialized from a parent
109 * they are simply copied across. For example SSL_CTX copied to SSL.
110 * 2. If the structure should take on values only if they are currently unset.
111 * For example the values in an SSL structure will take appropriate value
112 * for SSL servers or clients but only if the application has not set new
113 * ones.
114 *
115 * The "inh_flags" field determines how this function behaves.
116 *
117 * Normally any values which are set in the default are not copied from the
118 * destination and verify flags are ORed together.
119 *
120 * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied
121 * to the destination. Effectively the values in "to" become default values
122 * which will be used only if nothing new is set in "from".
123 *
124 * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether
125 * they are set or not. Flags is still Ored though.
126 *
127 * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead
128 * of ORed.
129 *
130 * If X509_VP_FLAG_LOCKED is set then no values are copied.
131 *
132 * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed
133 * after the next call.
134 */
135
136/* Macro to test if a field should be copied from src to dest */
137
138#define test_x509_verify_param_copy(field, def) \
139 (to_overwrite || \
140 ((src->field != def) && (to_default || (dest->field == def))))
141
142/* Macro to test and copy a field if necessary */
143
144#define x509_verify_param_copy(field, def) \
145 if (test_x509_verify_param_copy(field, def)) \
146 dest->field = src->field
147
148
149int
150X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src)
151{
152 unsigned long inh_flags;
153 int to_default, to_overwrite;
154
155 if (!src)
156 return 1;
157 inh_flags = dest->inh_flags | src->inh_flags;
158
159 if (inh_flags & X509_VP_FLAG_ONCE)
160 dest->inh_flags = 0;
161
162 if (inh_flags & X509_VP_FLAG_LOCKED)
163 return 1;
164
165 if (inh_flags & X509_VP_FLAG_DEFAULT)
166 to_default = 1;
167 else
168 to_default = 0;
169
170 if (inh_flags & X509_VP_FLAG_OVERWRITE)
171 to_overwrite = 1;
172 else
173 to_overwrite = 0;
174
175 x509_verify_param_copy(purpose, 0);
176 x509_verify_param_copy(trust, 0);
177 x509_verify_param_copy(depth, -1);
178
179 /* If overwrite or check time not set, copy across */
180
181 if (to_overwrite || !(dest->flags & X509_V_FLAG_USE_CHECK_TIME)) {
182 dest->check_time = src->check_time;
183 dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME;
184 /* Don't need to copy flag: that is done below */
185 }
186
187 if (inh_flags & X509_VP_FLAG_RESET_FLAGS)
188 dest->flags = 0;
189
190 dest->flags |= src->flags;
191
192 if (test_x509_verify_param_copy(policies, NULL)) {
193 if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies))
194 return 0;
195 }
196
197 return 1;
198}
199
200int
201X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, const X509_VERIFY_PARAM *from)
202{
203 unsigned long save_flags = to->inh_flags;
204 int ret;
205
206 to->inh_flags |= X509_VP_FLAG_DEFAULT;
207 ret = X509_VERIFY_PARAM_inherit(to, from);
208 to->inh_flags = save_flags;
209 return ret;
210}
211
212int
213X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)
214{
215 free(param->name);
216 param->name = NULL;
217 if (name == NULL)
218 return 1;
219 param->name = strdup(name);
220 if (param->name)
221 return 1;
222 return 0;
223}
224
225int
226X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
227{
228 param->flags |= flags;
229 if (flags & X509_V_FLAG_POLICY_MASK)
230 param->flags |= X509_V_FLAG_POLICY_CHECK;
231 return 1;
232}
233
234int
235X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags)
236{
237 param->flags &= ~flags;
238 return 1;
239}
240
241unsigned long
242X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param)
243{
244 return param->flags;
245}
246
247int
248X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
249{
250 return X509_PURPOSE_set(&param->purpose, purpose);
251}
252
253int
254X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
255{
256 return X509_TRUST_set(&param->trust, trust);
257}
258
259void
260X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth)
261{
262 param->depth = depth;
263}
264
265void
266X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t)
267{
268 param->check_time = t;
269 param->flags |= X509_V_FLAG_USE_CHECK_TIME;
270}
271
272int
273X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy)
274{
275 if (!param->policies) {
276 param->policies = sk_ASN1_OBJECT_new_null();
277 if (!param->policies)
278 return 0;
279 }
280 if (!sk_ASN1_OBJECT_push(param->policies, policy))
281 return 0;
282 return 1;
283}
284
285int
286X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
287 STACK_OF(ASN1_OBJECT) *policies)
288{
289 int i;
290 ASN1_OBJECT *oid, *doid;
291
292 if (!param)
293 return 0;
294 if (param->policies)
295 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
296
297 if (!policies) {
298 param->policies = NULL;
299 return 1;
300 }
301
302 param->policies = sk_ASN1_OBJECT_new_null();
303 if (!param->policies)
304 return 0;
305
306 for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++) {
307 oid = sk_ASN1_OBJECT_value(policies, i);
308 doid = OBJ_dup(oid);
309 if (!doid)
310 return 0;
311 if (!sk_ASN1_OBJECT_push(param->policies, doid)) {
312 ASN1_OBJECT_free(doid);
313 return 0;
314 }
315 }
316 param->flags |= X509_V_FLAG_POLICY_CHECK;
317 return 1;
318}
319
320int
321X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
322{
323 return param->depth;
324}
325
326/* Default verify parameters: these are used for various
327 * applications and can be overridden by the user specified table.
328 * NB: the 'name' field *must* be in alphabetical order because it
329 * will be searched using OBJ_search.
330 */
331
332static const X509_VERIFY_PARAM default_table[] = {
333 {
334 "default", /* X509 default parameters */
335 0, /* Check time */
336 0, /* internal flags */
337 0, /* flags */
338 0, /* purpose */
339 0, /* trust */
340 100, /* depth */
341 NULL /* policies */
342 },
343 {
344 "pkcs7", /* S/MIME sign parameters */
345 0, /* Check time */
346 0, /* internal flags */
347 0, /* flags */
348 X509_PURPOSE_SMIME_SIGN, /* purpose */
349 X509_TRUST_EMAIL, /* trust */
350 -1, /* depth */
351 NULL /* policies */
352 },
353 {
354 "smime_sign", /* S/MIME sign parameters */
355 0, /* Check time */
356 0, /* internal flags */
357 0, /* flags */
358 X509_PURPOSE_SMIME_SIGN, /* purpose */
359 X509_TRUST_EMAIL, /* trust */
360 -1, /* depth */
361 NULL /* policies */
362 },
363 {
364 "ssl_client", /* SSL/TLS client parameters */
365 0, /* Check time */
366 0, /* internal flags */
367 0, /* flags */
368 X509_PURPOSE_SSL_CLIENT, /* purpose */
369 X509_TRUST_SSL_CLIENT, /* trust */
370 -1, /* depth */
371 NULL /* policies */
372 },
373 {
374 "ssl_server", /* SSL/TLS server parameters */
375 0, /* Check time */
376 0, /* internal flags */
377 0, /* flags */
378 X509_PURPOSE_SSL_SERVER, /* purpose */
379 X509_TRUST_SSL_SERVER, /* trust */
380 -1, /* depth */
381 NULL /* policies */
382 }
383};
384
385static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;
386
387static int
388table_cmp(const X509_VERIFY_PARAM *a, const X509_VERIFY_PARAM *b)
389{
390 return strcmp(a->name, b->name);
391}
392
393DECLARE_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
394IMPLEMENT_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
395
396static int
397param_cmp(const X509_VERIFY_PARAM * const *a,
398 const X509_VERIFY_PARAM * const *b)
399{
400 return strcmp((*a)->name, (*b)->name);
401}
402
403int
404X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
405{
406 int idx;
407 X509_VERIFY_PARAM *ptmp;
408
409 if (!param_table) {
410 param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
411 if (!param_table)
412 return 0;
413 } else {
414 idx = sk_X509_VERIFY_PARAM_find(param_table, param);
415 if (idx != -1) {
416 ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
417 X509_VERIFY_PARAM_free(ptmp);
418 (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
419 }
420 }
421 if (!sk_X509_VERIFY_PARAM_push(param_table, param))
422 return 0;
423 return 1;
424}
425
426const X509_VERIFY_PARAM *
427X509_VERIFY_PARAM_lookup(const char *name)
428{
429 int idx;
430 X509_VERIFY_PARAM pm;
431
432 pm.name = (char *)name;
433 if (param_table) {
434 idx = sk_X509_VERIFY_PARAM_find(param_table, &pm);
435 if (idx != -1)
436 return sk_X509_VERIFY_PARAM_value(param_table, idx);
437 }
438 return OBJ_bsearch_table(&pm, default_table,
439 sizeof(default_table)/sizeof(X509_VERIFY_PARAM));
440}
441
442void
443X509_VERIFY_PARAM_table_cleanup(void)
444{
445 if (param_table)
446 sk_X509_VERIFY_PARAM_pop_free(param_table,
447 X509_VERIFY_PARAM_free);
448 param_table = NULL;
449}
diff --git a/src/lib/libcrypto/x509/x509cset.c b/src/lib/libcrypto/x509/x509cset.c
deleted file mode 100644
index a4442632f6..0000000000
--- a/src/lib/libcrypto/x509/x509cset.c
+++ /dev/null
@@ -1,173 +0,0 @@
1/* $OpenBSD: x509cset.c,v 1.8 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2001.
4 */
5/* ====================================================================
6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_CRL_set_version(X509_CRL *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 if (x->crl->version == NULL) {
72 if ((x->crl->version = M_ASN1_INTEGER_new()) == NULL)
73 return (0);
74 }
75 return (ASN1_INTEGER_set(x->crl->version, version));
76}
77
78int
79X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name)
80{
81 if ((x == NULL) || (x->crl == NULL))
82 return (0);
83 return (X509_NAME_set(&x->crl->issuer, name));
84}
85
86int
87X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm)
88{
89 ASN1_TIME *in;
90
91 if (x == NULL)
92 return (0);
93 in = x->crl->lastUpdate;
94 if (in != tm) {
95 in = M_ASN1_TIME_dup(tm);
96 if (in != NULL) {
97 M_ASN1_TIME_free(x->crl->lastUpdate);
98 x->crl->lastUpdate = in;
99 }
100 }
101 return (in != NULL);
102}
103
104int
105X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm)
106{
107 ASN1_TIME *in;
108
109 if (x == NULL)
110 return (0);
111 in = x->crl->nextUpdate;
112 if (in != tm) {
113 in = M_ASN1_TIME_dup(tm);
114 if (in != NULL) {
115 M_ASN1_TIME_free(x->crl->nextUpdate);
116 x->crl->nextUpdate = in;
117 }
118 }
119 return (in != NULL);
120}
121
122int
123X509_CRL_sort(X509_CRL *c)
124{
125 int i;
126 X509_REVOKED *r;
127
128 /* sort the data so it will be written in serial
129 * number order */
130 sk_X509_REVOKED_sort(c->crl->revoked);
131 for (i = 0; i < sk_X509_REVOKED_num(c->crl->revoked); i++) {
132 r = sk_X509_REVOKED_value(c->crl->revoked, i);
133 r->sequence = i;
134 }
135 c->crl->enc.modified = 1;
136 return 1;
137}
138
139int
140X509_REVOKED_set_revocationDate(X509_REVOKED *x, ASN1_TIME *tm)
141{
142 ASN1_TIME *in;
143
144 if (x == NULL)
145 return (0);
146 in = x->revocationDate;
147 if (in != tm) {
148 in = M_ASN1_TIME_dup(tm);
149 if (in != NULL) {
150 M_ASN1_TIME_free(x->revocationDate);
151 x->revocationDate = in;
152 }
153 }
154 return (in != NULL);
155}
156
157int
158X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial)
159{
160 ASN1_INTEGER *in;
161
162 if (x == NULL)
163 return (0);
164 in = x->serialNumber;
165 if (in != serial) {
166 in = M_ASN1_INTEGER_dup(serial);
167 if (in != NULL) {
168 M_ASN1_INTEGER_free(x->serialNumber);
169 x->serialNumber = in;
170 }
171 }
172 return (in != NULL);
173}
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
deleted file mode 100644
index 14634013cf..0000000000
--- a/src/lib/libcrypto/x509/x509name.c
+++ /dev/null
@@ -1,410 +0,0 @@
1/* $OpenBSD: x509name.c,v 1.13 2014/09/29 04:17:24 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/err.h>
64#include <openssl/evp.h>
65#include <openssl/objects.h>
66#include <openssl/stack.h>
67#include <openssl/x509.h>
68
69int
70X509_NAME_get_text_by_NID(X509_NAME *name, int nid, char *buf, int len)
71{
72 ASN1_OBJECT *obj;
73
74 obj = OBJ_nid2obj(nid);
75 if (obj == NULL)
76 return (-1);
77 return (X509_NAME_get_text_by_OBJ(name, obj, buf, len));
78}
79
80int
81X509_NAME_get_text_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, char *buf,
82 int len)
83{
84 int i;
85 ASN1_STRING *data;
86
87 i = X509_NAME_get_index_by_OBJ(name, obj, -1);
88 if (i < 0)
89 return (-1);
90 data = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
91 i = (data->length > (len - 1)) ? (len - 1) : data->length;
92 if (buf == NULL)
93 return (data->length);
94 if (i >= 0) {
95 memcpy(buf, data->data, i);
96 buf[i] = '\0';
97 }
98 return (i);
99}
100
101int
102X509_NAME_entry_count(X509_NAME *name)
103{
104 if (name == NULL)
105 return (0);
106 return (sk_X509_NAME_ENTRY_num(name->entries));
107}
108
109int
110X509_NAME_get_index_by_NID(X509_NAME *name, int nid, int lastpos)
111{
112 ASN1_OBJECT *obj;
113
114 obj = OBJ_nid2obj(nid);
115 if (obj == NULL)
116 return (-2);
117 return (X509_NAME_get_index_by_OBJ(name, obj, lastpos));
118}
119
120/* NOTE: you should be passsing -1, not 0 as lastpos */
121int
122X509_NAME_get_index_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int lastpos)
123{
124 int n;
125 X509_NAME_ENTRY *ne;
126 STACK_OF(X509_NAME_ENTRY) *sk;
127
128 if (name == NULL)
129 return (-1);
130 if (lastpos < 0)
131 lastpos = -1;
132 sk = name->entries;
133 n = sk_X509_NAME_ENTRY_num(sk);
134 for (lastpos++; lastpos < n; lastpos++) {
135 ne = sk_X509_NAME_ENTRY_value(sk, lastpos);
136 if (OBJ_cmp(ne->object, obj) == 0)
137 return (lastpos);
138 }
139 return (-1);
140}
141
142X509_NAME_ENTRY *
143X509_NAME_get_entry(X509_NAME *name, int loc)
144{
145 if (name == NULL || sk_X509_NAME_ENTRY_num(name->entries) <= loc ||
146 loc < 0)
147 return (NULL);
148 else
149 return (sk_X509_NAME_ENTRY_value(name->entries, loc));
150}
151
152X509_NAME_ENTRY *
153X509_NAME_delete_entry(X509_NAME *name, int loc)
154{
155 X509_NAME_ENTRY *ret;
156 int i, n, set_prev, set_next;
157 STACK_OF(X509_NAME_ENTRY) *sk;
158
159 if (name == NULL || sk_X509_NAME_ENTRY_num(name->entries) <= loc ||
160 loc < 0)
161 return (NULL);
162 sk = name->entries;
163 ret = sk_X509_NAME_ENTRY_delete(sk, loc);
164 n = sk_X509_NAME_ENTRY_num(sk);
165 name->modified = 1;
166 if (loc == n)
167 return (ret);
168
169 /* else we need to fixup the set field */
170 if (loc != 0)
171 set_prev = (sk_X509_NAME_ENTRY_value(sk, loc - 1))->set;
172 else
173 set_prev = ret->set - 1;
174 set_next = sk_X509_NAME_ENTRY_value(sk, loc)->set;
175
176 /* set_prev is the previous set
177 * set is the current set
178 * set_next is the following
179 * prev 1 1 1 1 1 1 1 1
180 * set 1 1 2 2
181 * next 1 1 2 2 2 2 3 2
182 * so basically only if prev and next differ by 2, then
183 * re-number down by 1 */
184 if (set_prev + 1 < set_next)
185 for (i = loc; i < n; i++)
186 sk_X509_NAME_ENTRY_value(sk, i)->set--;
187 return (ret);
188}
189
190int
191X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
192 unsigned char *bytes, int len, int loc, int set)
193{
194 X509_NAME_ENTRY *ne;
195 int ret;
196
197 ne = X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
198 if (!ne)
199 return 0;
200 ret = X509_NAME_add_entry(name, ne, loc, set);
201 X509_NAME_ENTRY_free(ne);
202 return ret;
203}
204
205int
206X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
207 unsigned char *bytes, int len, int loc, int set)
208{
209 X509_NAME_ENTRY *ne;
210 int ret;
211
212 ne = X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
213 if (!ne)
214 return 0;
215 ret = X509_NAME_add_entry(name, ne, loc, set);
216 X509_NAME_ENTRY_free(ne);
217 return ret;
218}
219
220int
221X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
222 const unsigned char *bytes, int len, int loc, int set)
223{
224 X509_NAME_ENTRY *ne;
225 int ret;
226
227 ne = X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
228 if (!ne)
229 return 0;
230 ret = X509_NAME_add_entry(name, ne, loc, set);
231 X509_NAME_ENTRY_free(ne);
232 return ret;
233}
234
235/* if set is -1, append to previous set, 0 'a new one', and 1,
236 * prepend to the guy we are about to stomp on. */
237int
238X509_NAME_add_entry(X509_NAME *name, X509_NAME_ENTRY *ne, int loc, int set)
239{
240 X509_NAME_ENTRY *new_name = NULL;
241 int n, i, inc;
242 STACK_OF(X509_NAME_ENTRY) *sk;
243
244 if (name == NULL)
245 return (0);
246 sk = name->entries;
247 n = sk_X509_NAME_ENTRY_num(sk);
248 if (loc > n)
249 loc = n;
250 else if (loc < 0)
251 loc = n;
252
253 name->modified = 1;
254
255 if (set == -1) {
256 if (loc == 0) {
257 set = 0;
258 inc = 1;
259 } else {
260 set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set;
261 inc = 0;
262 }
263 } else /* if (set >= 0) */ {
264 if (loc >= n) {
265 if (loc != 0)
266 set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set + 1;
267 else
268 set = 0;
269 } else
270 set = sk_X509_NAME_ENTRY_value(sk, loc)->set;
271 inc = (set == 0) ? 1 : 0;
272 }
273
274 if ((new_name = X509_NAME_ENTRY_dup(ne)) == NULL)
275 goto err;
276 new_name->set = set;
277 if (!sk_X509_NAME_ENTRY_insert(sk, new_name, loc)) {
278 X509err(X509_F_X509_NAME_ADD_ENTRY, ERR_R_MALLOC_FAILURE);
279 goto err;
280 }
281 if (inc) {
282 n = sk_X509_NAME_ENTRY_num(sk);
283 for (i = loc + 1; i < n; i++)
284 sk_X509_NAME_ENTRY_value(sk, i - 1)->set += 1;
285 }
286 return (1);
287
288err:
289 if (new_name != NULL)
290 X509_NAME_ENTRY_free(new_name);
291 return (0);
292}
293
294X509_NAME_ENTRY *
295X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
296 const char *field, int type, const unsigned char *bytes, int len)
297{
298 ASN1_OBJECT *obj;
299 X509_NAME_ENTRY *nentry;
300
301 obj = OBJ_txt2obj(field, 0);
302 if (obj == NULL) {
303 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
304 X509_R_INVALID_FIELD_NAME);
305 ERR_asprintf_error_data("name=%s", field);
306 return (NULL);
307 }
308 nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
309 ASN1_OBJECT_free(obj);
310 return nentry;
311}
312
313X509_NAME_ENTRY *
314X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid, int type,
315 unsigned char *bytes, int len)
316{
317 ASN1_OBJECT *obj;
318 X509_NAME_ENTRY *nentry;
319
320 obj = OBJ_nid2obj(nid);
321 if (obj == NULL) {
322 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_NID,
323 X509_R_UNKNOWN_NID);
324 return (NULL);
325 }
326 nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
327 ASN1_OBJECT_free(obj);
328 return nentry;
329}
330
331X509_NAME_ENTRY *
332X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne, ASN1_OBJECT *obj, int type,
333 const unsigned char *bytes, int len)
334{
335 X509_NAME_ENTRY *ret;
336
337 if ((ne == NULL) || (*ne == NULL)) {
338 if ((ret = X509_NAME_ENTRY_new()) == NULL)
339 return (NULL);
340 } else
341 ret= *ne;
342
343 if (!X509_NAME_ENTRY_set_object(ret, obj))
344 goto err;
345 if (!X509_NAME_ENTRY_set_data(ret, type, bytes, len))
346 goto err;
347
348 if ((ne != NULL) && (*ne == NULL))
349 *ne = ret;
350 return (ret);
351
352err:
353 if ((ne == NULL) || (ret != *ne))
354 X509_NAME_ENTRY_free(ret);
355 return (NULL);
356}
357
358int
359X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, ASN1_OBJECT *obj)
360{
361 if ((ne == NULL) || (obj == NULL)) {
362 X509err(X509_F_X509_NAME_ENTRY_SET_OBJECT,
363 ERR_R_PASSED_NULL_PARAMETER);
364 return (0);
365 }
366 ASN1_OBJECT_free(ne->object);
367 ne->object = OBJ_dup(obj);
368 return ((ne->object == NULL) ? 0 : 1);
369}
370
371int
372X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
373 const unsigned char *bytes, int len)
374{
375 int i;
376
377 if ((ne == NULL) || ((bytes == NULL) && (len != 0)))
378 return (0);
379 if ((type > 0) && (type & MBSTRING_FLAG))
380 return ASN1_STRING_set_by_NID(&ne->value, bytes, len, type,
381 OBJ_obj2nid(ne->object)) ? 1 : 0;
382 if (len < 0)
383 len = strlen((const char *)bytes);
384 i = ASN1_STRING_set(ne->value, bytes, len);
385 if (!i)
386 return (0);
387 if (type != V_ASN1_UNDEF) {
388 if (type == V_ASN1_APP_CHOOSE)
389 ne->value->type = ASN1_PRINTABLE_type(bytes, len);
390 else
391 ne->value->type = type;
392 }
393 return (1);
394}
395
396ASN1_OBJECT *
397X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne)
398{
399 if (ne == NULL)
400 return (NULL);
401 return (ne->object);
402}
403
404ASN1_STRING *
405X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne)
406{
407 if (ne == NULL)
408 return (NULL);
409 return (ne->value);
410}
diff --git a/src/lib/libcrypto/x509/x509rset.c b/src/lib/libcrypto/x509/x509rset.c
deleted file mode 100644
index cfac977636..0000000000
--- a/src/lib/libcrypto/x509/x509rset.c
+++ /dev/null
@@ -1,88 +0,0 @@
1/* $OpenBSD: x509rset.c,v 1.6 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/asn1.h>
62#include <openssl/evp.h>
63#include <openssl/objects.h>
64#include <openssl/x509.h>
65
66int
67X509_REQ_set_version(X509_REQ *x, long version)
68{
69 if (x == NULL)
70 return (0);
71 return (ASN1_INTEGER_set(x->req_info->version, version));
72}
73
74int
75X509_REQ_set_subject_name(X509_REQ *x, X509_NAME *name)
76{
77 if ((x == NULL) || (x->req_info == NULL))
78 return (0);
79 return (X509_NAME_set(&x->req_info->subject, name));
80}
81
82int
83X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey)
84{
85 if ((x == NULL) || (x->req_info == NULL))
86 return (0);
87 return (X509_PUBKEY_set(&x->req_info->pubkey, pkey));
88}
diff --git a/src/lib/libcrypto/x509/x509spki.c b/src/lib/libcrypto/x509/x509spki.c
deleted file mode 100644
index cd29a8138a..0000000000
--- a/src/lib/libcrypto/x509/x509spki.c
+++ /dev/null
@@ -1,132 +0,0 @@
1/* $OpenBSD: x509spki.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5/* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/err.h>
63#include <openssl/x509.h>
64
65int
66NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey)
67{
68 if ((x == NULL) || (x->spkac == NULL))
69 return (0);
70 return (X509_PUBKEY_set(&(x->spkac->pubkey), pkey));
71}
72
73EVP_PKEY *
74NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
75{
76 if ((x == NULL) || (x->spkac == NULL))
77 return (NULL);
78 return (X509_PUBKEY_get(x->spkac->pubkey));
79}
80
81/* Load a Netscape SPKI from a base64 encoded string */
82
83NETSCAPE_SPKI *
84NETSCAPE_SPKI_b64_decode(const char *str, int len)
85{
86 unsigned char *spki_der;
87 const unsigned char *p;
88 int spki_len;
89 NETSCAPE_SPKI *spki;
90
91 if (len <= 0)
92 len = strlen(str);
93 if (!(spki_der = malloc(len + 1))) {
94 X509err(X509_F_NETSCAPE_SPKI_B64_DECODE, ERR_R_MALLOC_FAILURE);
95 return NULL;
96 }
97 spki_len = EVP_DecodeBlock(spki_der, (const unsigned char *)str, len);
98 if (spki_len < 0) {
99 X509err(X509_F_NETSCAPE_SPKI_B64_DECODE,
100 X509_R_BASE64_DECODE_ERROR);
101 free(spki_der);
102 return NULL;
103 }
104 p = spki_der;
105 spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
106 free(spki_der);
107 return spki;
108}
109
110/* Generate a base64 encoded string from an SPKI */
111
112char *
113NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki)
114{
115 unsigned char *der_spki, *p;
116 char *b64_str;
117 int der_len;
118 der_len = i2d_NETSCAPE_SPKI(spki, NULL);
119 der_spki = malloc(der_len);
120 b64_str = reallocarray(NULL, der_len, 2);
121 if (!der_spki || !b64_str) {
122 X509err(X509_F_NETSCAPE_SPKI_B64_ENCODE, ERR_R_MALLOC_FAILURE);
123 free(der_spki);
124 free(b64_str);
125 return NULL;
126 }
127 p = der_spki;
128 i2d_NETSCAPE_SPKI(spki, &p);
129 EVP_EncodeBlock((unsigned char *)b64_str, der_spki, der_len);
130 free(der_spki);
131 return b64_str;
132}
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
deleted file mode 100644
index 58335b4e64..0000000000
--- a/src/lib/libcrypto/x509/x509type.c
+++ /dev/null
@@ -1,130 +0,0 @@
1/* $OpenBSD: x509type.c,v 1.11 2014/07/11 08:44:49 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/evp.h>
62#include <openssl/objects.h>
63#include <openssl/x509.h>
64
65int
66X509_certificate_type(X509 *x, EVP_PKEY *pkey)
67{
68 EVP_PKEY *pk;
69 int ret = 0, i;
70
71 if (x == NULL)
72 return (0);
73
74 if (pkey == NULL)
75 pk = X509_get_pubkey(x);
76 else
77 pk = pkey;
78
79 if (pk == NULL)
80 return (0);
81
82 switch (pk->type) {
83 case EVP_PKEY_RSA:
84 ret = EVP_PK_RSA|EVP_PKT_SIGN;
85/* if (!sign only extension) */
86 ret |= EVP_PKT_ENC;
87 break;
88 case EVP_PKEY_DSA:
89 ret = EVP_PK_DSA|EVP_PKT_SIGN;
90 break;
91 case EVP_PKEY_EC:
92 ret = EVP_PK_EC|EVP_PKT_SIGN|EVP_PKT_EXCH;
93 break;
94 case EVP_PKEY_DH:
95 ret = EVP_PK_DH|EVP_PKT_EXCH;
96 break;
97 case NID_id_GostR3410_94:
98 case NID_id_GostR3410_2001:
99 ret = EVP_PKT_EXCH|EVP_PKT_SIGN;
100 break;
101 default:
102 break;
103 }
104
105 i = OBJ_obj2nid(x->sig_alg->algorithm);
106 if (i && OBJ_find_sigid_algs(i, NULL, &i)) {
107 switch (i) {
108 case NID_rsaEncryption:
109 case NID_rsa:
110 ret |= EVP_PKS_RSA;
111 break;
112 case NID_dsa:
113 case NID_dsa_2:
114 ret |= EVP_PKS_DSA;
115 break;
116 case NID_X9_62_id_ecPublicKey:
117 ret |= EVP_PKS_EC;
118 break;
119 default:
120 break;
121 }
122 }
123
124 if (EVP_PKEY_size(pk) <= 1024/8)/* /8 because it's 1024 bits we look
125 for, not bytes */
126 ret |= EVP_PKT_EXP;
127 if (pkey == NULL)
128 EVP_PKEY_free(pk);
129 return (ret);
130}
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
deleted file mode 100644
index 28a81c14a7..0000000000
--- a/src/lib/libcrypto/x509/x_all.c
+++ /dev/null
@@ -1,609 +0,0 @@
1/* $OpenBSD: x_all.c,v 1.19 2015/01/28 04:14:31 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60
61#include <openssl/opensslconf.h>
62
63#include <openssl/asn1.h>
64#include <openssl/buffer.h>
65#include <openssl/evp.h>
66#include <openssl/stack.h>
67#include <openssl/x509.h>
68
69#ifndef OPENSSL_NO_DSA
70#include <openssl/dsa.h>
71#endif
72#ifndef OPENSSL_NO_RSA
73#include <openssl/rsa.h>
74#endif
75
76int
77X509_verify(X509 *a, EVP_PKEY *r)
78{
79 if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))
80 return 0;
81 return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), a->sig_alg,
82 a->signature, a->cert_info, r));
83}
84
85int
86X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
87{
88 return( ASN1_item_verify(ASN1_ITEM_rptr(X509_REQ_INFO),
89 a->sig_alg, a->signature, a->req_info, r));
90}
91
92int
93NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
94{
95 return(ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
96 a->sig_algor, a->signature, a->spkac, r));
97}
98
99int
100X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
101{
102 x->cert_info->enc.modified = 1;
103 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF),
104 x->cert_info->signature, x->sig_alg, x->signature,
105 x->cert_info, pkey, md));
106}
107
108int
109X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
110{
111 x->cert_info->enc.modified = 1;
112 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
113 x->cert_info->signature, x->sig_alg, x->signature,
114 x->cert_info, ctx);
115}
116
117int
118X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
119{
120 return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO),
121 x->sig_alg, NULL, x->signature, x->req_info, pkey, md));
122}
123
124int
125X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx)
126{
127 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO),
128 x->sig_alg, NULL, x->signature, x->req_info, ctx);
129}
130
131int
132X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
133{
134 x->crl->enc.modified = 1;
135 return(ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), x->crl->sig_alg,
136 x->sig_alg, x->signature, x->crl, pkey, md));
137}
138
139int
140X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
141{
142 x->crl->enc.modified = 1;
143 return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
144 x->crl->sig_alg, x->sig_alg, x->signature, x->crl, ctx);
145}
146
147int
148NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md)
149{
150 return (ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC),
151 x->sig_algor, NULL, x->signature, x->spkac, pkey, md));
152}
153
154X509 *
155d2i_X509_fp(FILE *fp, X509 **x509)
156{
157 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509), fp, x509);
158}
159
160int
161i2d_X509_fp(FILE *fp, X509 *x509)
162{
163 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509), fp, x509);
164}
165
166X509 *
167d2i_X509_bio(BIO *bp, X509 **x509)
168{
169 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509), bp, x509);
170}
171
172int
173i2d_X509_bio(BIO *bp, X509 *x509)
174{
175 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509), bp, x509);
176}
177
178X509_CRL *
179d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl)
180{
181 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
182}
183
184int
185i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl)
186{
187 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
188}
189
190X509_CRL *
191d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl)
192{
193 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
194}
195
196int
197i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl)
198{
199 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
200}
201
202PKCS7 *
203d2i_PKCS7_fp(FILE *fp, PKCS7 **p7)
204{
205 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
206}
207
208int
209i2d_PKCS7_fp(FILE *fp, PKCS7 *p7)
210{
211 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS7), fp, p7);
212}
213
214PKCS7 *
215d2i_PKCS7_bio(BIO *bp, PKCS7 **p7)
216{
217 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
218}
219
220int
221i2d_PKCS7_bio(BIO *bp, PKCS7 *p7)
222{
223 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS7), bp, p7);
224}
225
226X509_REQ *
227d2i_X509_REQ_fp(FILE *fp, X509_REQ **req)
228{
229 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
230}
231
232int
233i2d_X509_REQ_fp(FILE *fp, X509_REQ *req)
234{
235 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
236}
237
238X509_REQ *
239d2i_X509_REQ_bio(BIO *bp, X509_REQ **req)
240{
241 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
242}
243
244int
245i2d_X509_REQ_bio(BIO *bp, X509_REQ *req)
246{
247 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
248}
249
250#ifndef OPENSSL_NO_RSA
251
252RSA *
253d2i_RSAPrivateKey_fp(FILE *fp, RSA **rsa)
254{
255 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
256}
257
258int
259i2d_RSAPrivateKey_fp(FILE *fp, RSA *rsa)
260{
261 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPrivateKey), fp, rsa);
262}
263
264RSA *
265d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
266{
267 return ASN1_item_d2i_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
268}
269
270
271RSA *
272d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
273{
274 return ASN1_d2i_fp((void *(*)(void))RSA_new,
275 (D2I_OF(void))d2i_RSA_PUBKEY, fp, (void **)rsa);
276}
277
278int
279i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
280{
281 return ASN1_item_i2d_fp(ASN1_ITEM_rptr(RSAPublicKey), fp, rsa);
282}
283
284int
285i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa)
286{
287 return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY, fp, rsa);
288}
289
290RSA *
291d2i_RSAPrivateKey_bio(BIO *bp, RSA **rsa)
292{
293 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
294}
295
296int
297i2d_RSAPrivateKey_bio(BIO *bp, RSA *rsa)
298{
299 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPrivateKey), bp, rsa);
300}
301
302RSA *
303d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
304{
305 return ASN1_item_d2i_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
306}
307
308
309RSA *
310d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
311{
312 return ASN1_d2i_bio_of(RSA, RSA_new, d2i_RSA_PUBKEY, bp, rsa);
313}
314
315int
316i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
317{
318 return ASN1_item_i2d_bio(ASN1_ITEM_rptr(RSAPublicKey), bp, rsa);
319}
320
321int
322i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
323{
324 return ASN1_i2d_bio_of(RSA, i2d_RSA_PUBKEY, bp, rsa);
325}
326#endif
327
328#ifndef OPENSSL_NO_DSA
329DSA *
330d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa)
331{
332 return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSAPrivateKey, fp, dsa);
333}
334
335int
336i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa)
337{
338 return ASN1_i2d_fp_of_const(DSA, i2d_DSAPrivateKey, fp, dsa);
339}
340
341DSA *
342d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
343{
344 return ASN1_d2i_fp_of(DSA, DSA_new, d2i_DSA_PUBKEY, fp, dsa);
345}
346
347int
348i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa)
349{
350 return ASN1_i2d_fp_of(DSA, i2d_DSA_PUBKEY, fp, dsa);
351}
352
353DSA *
354d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
355{
356 return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSAPrivateKey, bp, dsa);
357}
358
359int
360i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa)
361{
362 return ASN1_i2d_bio_of_const(DSA, i2d_DSAPrivateKey, bp, dsa);
363}
364
365DSA *
366d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
367{
368 return ASN1_d2i_bio_of(DSA, DSA_new, d2i_DSA_PUBKEY, bp, dsa);
369}
370
371int
372i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa)
373{
374 return ASN1_i2d_bio_of(DSA, i2d_DSA_PUBKEY, bp, dsa);
375}
376
377#endif
378
379#ifndef OPENSSL_NO_EC
380EC_KEY *
381d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey)
382{
383 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, fp, eckey);
384}
385
386int
387i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey)
388{
389 return ASN1_i2d_fp_of(EC_KEY, i2d_EC_PUBKEY, fp, eckey);
390}
391
392EC_KEY *
393d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey)
394{
395 return ASN1_d2i_fp_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, fp, eckey);
396}
397
398int
399i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey)
400{
401 return ASN1_i2d_fp_of(EC_KEY, i2d_ECPrivateKey, fp, eckey);
402}
403EC_KEY *
404d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey)
405{
406 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_EC_PUBKEY, bp, eckey);
407}
408
409int
410i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *ecdsa)
411{
412 return ASN1_i2d_bio_of(EC_KEY, i2d_EC_PUBKEY, bp, ecdsa);
413}
414
415EC_KEY *
416d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey)
417{
418 return ASN1_d2i_bio_of(EC_KEY, EC_KEY_new, d2i_ECPrivateKey, bp, eckey);
419}
420
421int
422i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey)
423{
424 return ASN1_i2d_bio_of(EC_KEY, i2d_ECPrivateKey, bp, eckey);
425}
426#endif
427
428
429int
430X509_pubkey_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
431 unsigned int *len)
432{
433 ASN1_BIT_STRING *key;
434 key = X509_get0_pubkey_bitstr(data);
435 if (!key)
436 return 0;
437 return EVP_Digest(key->data, key->length, md, len, type, NULL);
438}
439
440int
441X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
442 unsigned int *len)
443{
444 return (ASN1_item_digest(ASN1_ITEM_rptr(X509), type, (char *)data,
445 md, len));
446}
447
448int
449X509_CRL_digest(const X509_CRL *data, const EVP_MD *type, unsigned char *md,
450 unsigned int *len)
451{
452 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_CRL), type, (char *)data,
453 md, len));
454}
455
456int
457X509_REQ_digest(const X509_REQ *data, const EVP_MD *type, unsigned char *md,
458 unsigned int *len)
459{
460 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_REQ), type, (char *)data,
461 md, len));
462}
463
464int
465X509_NAME_digest(const X509_NAME *data, const EVP_MD *type, unsigned char *md,
466 unsigned int *len)
467{
468 return (ASN1_item_digest(ASN1_ITEM_rptr(X509_NAME), type, (char *)data,
469 md, len));
470}
471
472int
473PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
474 const EVP_MD *type, unsigned char *md, unsigned int *len)
475{
476 return(ASN1_item_digest(ASN1_ITEM_rptr(PKCS7_ISSUER_AND_SERIAL), type,
477 (char *)data, md, len));
478}
479
480
481X509_SIG *
482d2i_PKCS8_fp(FILE *fp, X509_SIG **p8)
483{
484 return ASN1_d2i_fp_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, fp, p8);
485}
486
487int
488i2d_PKCS8_fp(FILE *fp, X509_SIG *p8)
489{
490 return ASN1_i2d_fp_of(X509_SIG, i2d_X509_SIG, fp, p8);
491}
492
493X509_SIG *
494d2i_PKCS8_bio(BIO *bp, X509_SIG **p8)
495{
496 return ASN1_d2i_bio_of(X509_SIG, X509_SIG_new, d2i_X509_SIG, bp, p8);
497}
498
499int
500i2d_PKCS8_bio(BIO *bp, X509_SIG *p8)
501{
502 return ASN1_i2d_bio_of(X509_SIG, i2d_X509_SIG, bp, p8);
503}
504
505PKCS8_PRIV_KEY_INFO *
506d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO **p8inf)
507{
508 return ASN1_d2i_fp_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
509 d2i_PKCS8_PRIV_KEY_INFO, fp, p8inf);
510}
511
512int
513i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf)
514{
515 return ASN1_i2d_fp_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO,
516 fp, p8inf);
517}
518
519int
520i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
521{
522 PKCS8_PRIV_KEY_INFO *p8inf;
523 int ret;
524 p8inf = EVP_PKEY2PKCS8(key);
525 if (!p8inf)
526 return 0;
527 ret = i2d_PKCS8_PRIV_KEY_INFO_fp(fp, p8inf);
528 PKCS8_PRIV_KEY_INFO_free(p8inf);
529 return ret;
530}
531
532int
533i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey)
534{
535 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PrivateKey, fp, pkey);
536}
537
538EVP_PKEY *
539d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
540{
541 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey,
542 fp, a);
543}
544
545int
546i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey)
547{
548 return ASN1_i2d_fp_of(EVP_PKEY, i2d_PUBKEY, fp, pkey);
549}
550
551EVP_PKEY *
552d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
553{
554 return ASN1_d2i_fp_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, fp, a);
555}
556
557
558PKCS8_PRIV_KEY_INFO *
559d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO **p8inf)
560{
561 return ASN1_d2i_bio_of(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_new,
562 d2i_PKCS8_PRIV_KEY_INFO, bp, p8inf);
563}
564
565int
566i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf)
567{
568 return ASN1_i2d_bio_of(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO,
569 bp, p8inf);
570}
571
572int
573i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
574{
575 PKCS8_PRIV_KEY_INFO *p8inf;
576 int ret;
577
578 p8inf = EVP_PKEY2PKCS8(key);
579 if (!p8inf)
580 return 0;
581 ret = i2d_PKCS8_PRIV_KEY_INFO_bio(bp, p8inf);
582 PKCS8_PRIV_KEY_INFO_free(p8inf);
583 return ret;
584}
585
586int
587i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey)
588{
589 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PrivateKey, bp, pkey);
590}
591
592EVP_PKEY *
593d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
594{
595 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_AutoPrivateKey,
596 bp, a);
597}
598
599int
600i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey)
601{
602 return ASN1_i2d_bio_of(EVP_PKEY, i2d_PUBKEY, bp, pkey);
603}
604
605EVP_PKEY *
606d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a)
607{
608 return ASN1_d2i_bio_of(EVP_PKEY, EVP_PKEY_new, d2i_PUBKEY, bp, a);
609}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-15 00:53:58 +0000