OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update main-with-bazel from master branch

Browse Source
This commit is contained in:
BoringSSL Robot
2024-01-04 17:45:27 +00:00
parent 2846eca62d 1749dc9a70
commit 87a02429b7
3 changed files with 15 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto/x509/internal.h
+2 -2
View File
@@ -386,10 +386,10 @@ struct x509_store_ctx_st {
int error_depth;
int error;
X509 *current_cert;
X509 *current_issuer; // cert currently being tested as valid issuer
X509_CRL *current_crl; // current CRL
int current_crl_score; // score of current CRL
X509 *current_crl_issuer; // issuer of current CRL
int current_crl_score; // score of current CRL
CRYPTO_EX_DATA ex_data;
} /* X509_STORE_CTX */;
src/crypto/x509/x509_vfy.c
+13 -17
View File
@@ -508,7 +508,6 @@ int x509_check_issued_with_callback(X509_STORE_CTX *ctx, X509 *x,
ctx->error = ret;
ctx->current_cert = x;
ctx->current_issuer = issuer;
return ctx->verify_cb(0, ctx);
}
@@ -802,10 +801,15 @@ static int check_cert(X509_STORE_CTX *ctx) {
int ok = 0, cnum = ctx->error_depth;
X509 *x = sk_X509_value(ctx->chain, cnum);
ctx->current_cert = x;
ctx->current_issuer = NULL;
ctx->current_crl_issuer = NULL;
ctx->current_crl_score = 0;
// Try to retrieve relevant CRL
// Try to retrieve the relevant CRL. Note that |get_crl| sets
// |current_crl_issuer| and |current_crl_score|, which |check_crl| then reads.
//
// TODO(davidben): Remove these callbacks. gRPC currently sets them, but
// implements them incorrectly. It is not actually possible to implement
// |get_crl| from outside the library.
ok = ctx->get_crl(ctx, &crl, x);
// If error looking up CRL, nothing we can do except notify callback
if (!ok) {
@@ -1159,7 +1163,7 @@ done:
// If we got any kind of CRL use it and return success
if (crl) {
ctx->current_issuer = issuer;
ctx->current_crl_issuer = issuer;
ctx->current_crl_score = crl_score;
*pcrl = crl;
return 1;
@@ -1173,14 +1177,11 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) {
X509 *issuer = NULL;
int cnum = ctx->error_depth;
int chnum = (int)sk_X509_num(ctx->chain) - 1;
// if we have an alternative CRL issuer cert use that
if (ctx->current_issuer) {
issuer = ctx->current_issuer;
}
// Else find CRL issuer: if not last certificate then issuer is next
// certificate in chain.
else if (cnum < chnum) {
// If we have an alternative CRL issuer cert use that. Otherwise, it is the
// issuer of the current certificate.
if (ctx->current_crl_issuer) {
issuer = ctx->current_crl_issuer;
} else if (cnum < chnum) {
issuer = sk_X509_value(ctx->chain, cnum + 1);
} else {
issuer = sk_X509_value(ctx->chain, chnum);
@@ -1409,7 +1410,6 @@ static int internal_verify(X509_STORE_CTX *ctx) {
}
// The last error (if any) is still in the error value
ctx->current_issuer = xi;
ctx->current_cert = xs;
ok = ctx->verify_cb(1, ctx);
if (!ok) {
@@ -1517,10 +1517,6 @@ STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx) {
return X509_chain_up_ref(ctx->chain);
}
X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx) {
return ctx->current_issuer;
}
X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx) {
return ctx->current_crl;
}
src/include/openssl/x509.h
-1
View File
@@ -3857,7 +3857,6 @@ OPENSSL_EXPORT int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx);
OPENSSL_EXPORT void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int s);
OPENSSL_EXPORT int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
OPENSSL_EXPORT X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
OPENSSL_EXPORT X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx);
OPENSSL_EXPORT X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx);
OPENSSL_EXPORT STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
OPENSSL_EXPORT STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *ctx);