OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update main-with-bazel from master branch

Browse Source
This commit is contained in:
BoringSSL Robot
2023-12-06 21:34:13 +00:00
parent 7a94071425 396f2ef085
commit 90fbb0a89f
3 changed files with 11 additions and 281 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto/x509/v3_purp.c
+5 -132
View File
@@ -94,9 +94,6 @@ static int check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x,
static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca);
static int xp_cmp(const X509_PURPOSE *const *a, const X509_PURPOSE *const *b);
static void xptable_free(X509_PURPOSE *p);
static X509_PURPOSE xstandard[] = {
{X509_PURPOSE_SSL_CLIENT, X509_TRUST_SSL_CLIENT, 0,
check_purpose_ssl_client, (char *)"SSL client", (char *)"sslclient", NULL},
@@ -121,14 +118,6 @@ static X509_PURPOSE xstandard[] = {
(char *)"timestampsign", NULL},
};
#define X509_PURPOSE_COUNT (sizeof(xstandard) / sizeof(X509_PURPOSE))
static STACK_OF(X509_PURPOSE) *xptable = NULL;
static int xp_cmp(const X509_PURPOSE *const *a, const X509_PURPOSE *const *b) {
return (*a)->purpose - (*b)->purpose;
}
// As much as I'd like to make X509_check_purpose use a "const" X509* I
// really can't because it does recalculate hashes and do other non-const
// things.
@@ -159,21 +148,13 @@ int X509_PURPOSE_set(int *p, int purpose) {
return 1;
}
int X509_PURPOSE_get_count(void) {
if (!xptable) {
return X509_PURPOSE_COUNT;
}
return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
}
int X509_PURPOSE_get_count(void) { return OPENSSL_ARRAY_SIZE(xstandard); }
X509_PURPOSE *X509_PURPOSE_get0(int idx) {
if (idx < 0) {
if (idx < 0 || (size_t)idx >= OPENSSL_ARRAY_SIZE(xstandard)) {
return NULL;
}
if (idx < (int)X509_PURPOSE_COUNT) {
return xstandard + idx;
}
return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
return xstandard + idx;
}
int X509_PURPOSE_get_by_sname(const char *sname) {
@@ -188,118 +169,10 @@ int X509_PURPOSE_get_by_sname(const char *sname) {
}
int X509_PURPOSE_get_by_id(int purpose) {
X509_PURPOSE tmp;
size_t idx;
if ((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX)) {
if (purpose >= X509_PURPOSE_MIN && purpose <= X509_PURPOSE_MAX) {
return purpose - X509_PURPOSE_MIN;
}
tmp.purpose = purpose;
if (!xptable) {
return -1;
}
if (!sk_X509_PURPOSE_find(xptable, &idx, &tmp)) {
return -1;
}
return idx + X509_PURPOSE_COUNT;
}
int X509_PURPOSE_add(int id, int trust, int flags,
int (*ck)(const X509_PURPOSE *, const X509 *, int),
const char *name, const char *sname, void *arg) {
X509_PURPOSE *ptmp;
char *name_dup, *sname_dup;
// This is set according to what we change: application can't set it
flags &= ~X509_PURPOSE_DYNAMIC;
// This will always be set for application modified trust entries
flags |= X509_PURPOSE_DYNAMIC_NAME;
// Get existing entry if any
int idx = X509_PURPOSE_get_by_id(id);
// Need a new entry
if (idx == -1) {
if (!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {
return 0;
}
ptmp->flags = X509_PURPOSE_DYNAMIC;
} else {
ptmp = X509_PURPOSE_get0(idx);
}
// Duplicate the supplied names.
name_dup = OPENSSL_strdup(name);
sname_dup = OPENSSL_strdup(sname);
if (name_dup == NULL || sname_dup == NULL) {
if (name_dup != NULL) {
OPENSSL_free(name_dup);
}
if (sname_dup != NULL) {
OPENSSL_free(sname_dup);
}
if (idx == -1) {
OPENSSL_free(ptmp);
}
return 0;
}
// OPENSSL_free existing name if dynamic
if (ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
OPENSSL_free(ptmp->name);
OPENSSL_free(ptmp->sname);
}
// dup supplied name
ptmp->name = name_dup;
ptmp->sname = sname_dup;
// Keep the dynamic flag of existing entry
ptmp->flags &= X509_PURPOSE_DYNAMIC;
// Set all other flags
ptmp->flags |= flags;
ptmp->purpose = id;
ptmp->trust = trust;
ptmp->check_purpose = ck;
ptmp->usr_data = arg;
// If its a new entry manage the dynamic table
if (idx == -1) {
// TODO(davidben): This should be locked. Alternatively, remove the dynamic
// registration mechanism entirely. The trouble is there no way to pass in
// the various parameters into an |X509_VERIFY_PARAM| directly. You can only
// register it in the global table and get an ID.
if (!xptable && !(xptable = sk_X509_PURPOSE_new(xp_cmp))) {
xptable_free(ptmp);
return 0;
}
if (!sk_X509_PURPOSE_push(xptable, ptmp)) {
xptable_free(ptmp);
return 0;
}
sk_X509_PURPOSE_sort(xptable);
}
return 1;
}
static void xptable_free(X509_PURPOSE *p) {
if (!p) {
return;
}
if (p->flags & X509_PURPOSE_DYNAMIC) {
if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
OPENSSL_free(p->name);
OPENSSL_free(p->sname);
}
OPENSSL_free(p);
}
}
void X509_PURPOSE_cleanup(void) {
unsigned int i;
sk_X509_PURPOSE_pop_free(xptable, xptable_free);
for (i = 0; i < X509_PURPOSE_COUNT; i++) {
xptable_free(xstandard + i);
}
xptable = NULL;
return -1;
}
int X509_PURPOSE_get_id(const X509_PURPOSE *xp) { return xp->purpose; }
src/crypto/x509/x509_trs.c
+6 -120
View File
@@ -59,12 +59,10 @@
#include <openssl/obj.h>
#include <openssl/x509.h>
#include "../internal.h"
#include "internal.h"
static int tr_cmp(const X509_TRUST *const *a, const X509_TRUST *const *b);
static void trtable_free(X509_TRUST *p);
static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
@@ -92,14 +90,6 @@ static X509_TRUST trstandard[] = {
{X509_TRUST_TSA, 0, trust_1oidany, (char *)"TSA server", NID_time_stamp,
NULL}};
#define X509_TRUST_COUNT (sizeof(trstandard) / sizeof(X509_TRUST))
static STACK_OF(X509_TRUST) *trtable = NULL;
static int tr_cmp(const X509_TRUST *const *a, const X509_TRUST *const *b) {
return (*a)->trust - (*b)->trust;
}
int X509_check_trust(X509 *x, int id, int flags) {
X509_TRUST *pt;
int idx;
@@ -123,38 +113,20 @@ int X509_check_trust(X509 *x, int id, int flags) {
return pt->check_trust(pt, x, flags);
}
int X509_TRUST_get_count(void) {
if (!trtable) {
return X509_TRUST_COUNT;
}
return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
}
int X509_TRUST_get_count(void) { return OPENSSL_ARRAY_SIZE(trstandard); }
X509_TRUST *X509_TRUST_get0(int idx) {
if (idx < 0) {
if (idx < 0 || (size_t)idx >= OPENSSL_ARRAY_SIZE(trstandard)) {
return NULL;
}
if (idx < (int)X509_TRUST_COUNT) {
return trstandard + idx;
}
return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
return trstandard + idx;
}
int X509_TRUST_get_by_id(int id) {
X509_TRUST tmp;
size_t idx;
if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX)) {
if (id >= X509_TRUST_MIN && id <= X509_TRUST_MAX) {
return id - X509_TRUST_MIN;
}
tmp.trust = id;
if (!trtable) {
return -1;
}
if (!sk_X509_TRUST_find(trtable, &idx, &tmp)) {
return -1;
}
return idx + X509_TRUST_COUNT;
return -1;
}
int X509_TRUST_set(int *t, int trust) {
@@ -166,92 +138,6 @@ int X509_TRUST_set(int *t, int trust) {
return 1;
}
int X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
const char *name, int arg1, void *arg2) {
int idx;
X509_TRUST *trtmp;
char *name_dup;
// This is set according to what we change: application can't set it
flags &= ~X509_TRUST_DYNAMIC;
// This will always be set for application modified trust entries
flags |= X509_TRUST_DYNAMIC_NAME;
// Get existing entry if any
idx = X509_TRUST_get_by_id(id);
// Need a new entry
if (idx == -1) {
if (!(trtmp = OPENSSL_malloc(sizeof(X509_TRUST)))) {
return 0;
}
trtmp->flags = X509_TRUST_DYNAMIC;
} else {
trtmp = X509_TRUST_get0(idx);
}
// Duplicate the supplied name.
name_dup = OPENSSL_strdup(name);
if (name_dup == NULL) {
if (idx == -1) {
OPENSSL_free(trtmp);
}
return 0;
}
// OPENSSL_free existing name if dynamic
if (trtmp->flags & X509_TRUST_DYNAMIC_NAME) {
OPENSSL_free(trtmp->name);
}
trtmp->name = name_dup;
// Keep the dynamic flag of existing entry
trtmp->flags &= X509_TRUST_DYNAMIC;
// Set all other flags
trtmp->flags |= flags;
trtmp->trust = id;
trtmp->check_trust = ck;
trtmp->arg1 = arg1;
trtmp->arg2 = arg2;
// If its a new entry manage the dynamic table
if (idx == -1) {
// TODO(davidben): This should be locked. Alternatively, remove the dynamic
// registration mechanism entirely. The trouble is there no way to pass in
// the various parameters into an |X509_VERIFY_PARAM| directly. You can only
// register it in the global table and get an ID.
if (!trtable && !(trtable = sk_X509_TRUST_new(tr_cmp))) {
trtable_free(trtmp);
return 0;
}
if (!sk_X509_TRUST_push(trtable, trtmp)) {
trtable_free(trtmp);
return 0;
}
sk_X509_TRUST_sort(trtable);
}
return 1;
}
static void trtable_free(X509_TRUST *p) {
if (!p) {
return;
}
if (p->flags & X509_TRUST_DYNAMIC) {
if (p->flags & X509_TRUST_DYNAMIC_NAME) {
OPENSSL_free(p->name);
}
OPENSSL_free(p);
}
}
void X509_TRUST_cleanup(void) {
unsigned int i;
for (i = 0; i < X509_TRUST_COUNT; i++) {
trtable_free(trstandard + i);
}
sk_X509_TRUST_pop_free(trtable, trtable_free);
trtable = NULL;
}
int X509_TRUST_get_flags(const X509_TRUST *xp) { return xp->flags; }
char *X509_TRUST_get0_name(const X509_TRUST *xp) { return xp->name; }
src/include/openssl/x509.h
-29
View File
@@ -3088,17 +3088,6 @@ OPENSSL_EXPORT int X509V3_add_standard_extensions(void);
#define X509_STORE_get1_certs X509_STORE_CTX_get1_certs
#define X509_STORE_get1_crls X509_STORE_CTX_get1_crls
// The following constants are legacy aliases for |X509v3_KU_*|.
#define KU_DIGITAL_SIGNATURE X509v3_KU_DIGITAL_SIGNATURE
#define KU_NON_REPUDIATION X509v3_KU_NON_REPUDIATION
#define KU_KEY_ENCIPHERMENT X509v3_KU_KEY_ENCIPHERMENT
#define KU_DATA_ENCIPHERMENT X509v3_KU_DATA_ENCIPHERMENT
#define KU_KEY_AGREEMENT X509v3_KU_KEY_AGREEMENT
#define KU_KEY_CERT_SIGN X509v3_KU_KEY_CERT_SIGN
#define KU_CRL_SIGN X509v3_KU_CRL_SIGN
#define KU_ENCIPHER_ONLY X509v3_KU_ENCIPHER_ONLY
#define KU_DECIPHER_ONLY X509v3_KU_DECIPHER_ONLY
// Private structures.
@@ -3148,11 +3137,6 @@ DEFINE_STACK_OF(X509_TRUST)
#define X509_TRUST_MIN 1
#define X509_TRUST_MAX 8
// trust_flags values
#define X509_TRUST_DYNAMIC 1
#define X509_TRUST_DYNAMIC_NAME 2
// check_trust return codes
#define X509_TRUST_TRUSTED 1
@@ -3195,10 +3179,6 @@ OPENSSL_EXPORT int X509_check_trust(X509 *x, int id, int flags);
OPENSSL_EXPORT int X509_TRUST_get_count(void);
OPENSSL_EXPORT X509_TRUST *X509_TRUST_get0(int idx);
OPENSSL_EXPORT int X509_TRUST_get_by_id(int id);
OPENSSL_EXPORT int X509_TRUST_add(int id, int flags,
int (*ck)(X509_TRUST *, X509 *, int),
const char *name, int arg1, void *arg2);
OPENSSL_EXPORT void X509_TRUST_cleanup(void);
OPENSSL_EXPORT int X509_TRUST_get_flags(const X509_TRUST *xp);
OPENSSL_EXPORT char *X509_TRUST_get0_name(const X509_TRUST *xp);
OPENSSL_EXPORT int X509_TRUST_get_trust(const X509_TRUST *xp);
@@ -3978,9 +3958,6 @@ struct ISSUING_DIST_POINT_st {
#define NS_OBJSIGN_CA 0x01
#define NS_ANY_CA (NS_SSL_CA | NS_SMIME_CA | NS_OBJSIGN_CA)
#define X509_PURPOSE_DYNAMIC 0x1
#define X509_PURPOSE_DYNAMIC_NAME 0x2
typedef struct x509_purpose_st {
int purpose;
int trust; // Default trust ID
@@ -4248,15 +4225,9 @@ OPENSSL_EXPORT int X509_PURPOSE_get_count(void);
OPENSSL_EXPORT X509_PURPOSE *X509_PURPOSE_get0(int idx);
OPENSSL_EXPORT int X509_PURPOSE_get_by_sname(const char *sname);
OPENSSL_EXPORT int X509_PURPOSE_get_by_id(int id);
OPENSSL_EXPORT int X509_PURPOSE_add(int id, int trust, int flags,
int (*ck)(const X509_PURPOSE *,
const X509 *, int),
const char *name, const char *sname,
void *arg);
OPENSSL_EXPORT char *X509_PURPOSE_get0_name(const X509_PURPOSE *xp);
OPENSSL_EXPORT char *X509_PURPOSE_get0_sname(const X509_PURPOSE *xp);
OPENSSL_EXPORT int X509_PURPOSE_get_trust(const X509_PURPOSE *xp);
OPENSSL_EXPORT void X509_PURPOSE_cleanup(void);
OPENSSL_EXPORT int X509_PURPOSE_get_id(const X509_PURPOSE *);
// Flags for X509_check_* functions