generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Remove X509_VERIFY_PARAM_ID

Browse Source 
Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer
needed.

Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Dr. Stephen Henson
2015-05-02 17:44:08 +01:00
parent 3bbd1d63e2
commit 9689a6aeed
4 changed files with 49 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/x509/x509_lcl.h
View File

@@ -72,12 +72,7 @@ struct X509_VERIFY_PARAM_st {
int trust; /* trust setting to check */ int trust; /* trust setting to check */
int depth; /* Verify depth */ int depth; /* Verify depth */
STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */ STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */
X509_VERIFY_PARAM_ID *id; /* opaque ID data */ /* Peer identity details */
};
/* internal only structure to hold additional X509_VERIFY_PARAM data */
struct X509_VERIFY_PARAM_ID_st {
STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */ STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */
unsigned int hostflags; /* Flags to control matching features */ unsigned int hostflags; /* Flags to control matching features */
char *peername; /* Matching hostname in peer certificate */ char *peername; /* Matching hostname in peer certificate */

21
crypto/x509/x509_vfy.c
View File

@@ -764,19 +764,19 @@ static int check_id_error(X509_STORE_CTX *ctx, int errcode)
return ctx->verify_cb(0, ctx); return ctx->verify_cb(0, ctx);
} }
static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id) static int check_hosts(X509 *x, X509_VERIFY_PARAM *vpm)
{ {
int i; int i;
int n = sk_OPENSSL_STRING_num(id->hosts); int n = sk_OPENSSL_STRING_num(vpm->hosts);
char *name; char *name;
if (id->peername != NULL) { if (vpm->peername != NULL) {
OPENSSL_free(id->peername); OPENSSL_free(vpm->peername);
id->peername = NULL; vpm->peername = NULL;
} }
for (i = 0; i < n; ++i) { for (i = 0; i < n; ++i) {
name = sk_OPENSSL_STRING_value(id->hosts, i); name = sk_OPENSSL_STRING_value(vpm->hosts, i);
if (X509_check_host(x, name, 0, id->hostflags, &id->peername) > 0) if (X509_check_host(x, name, 0, vpm->hostflags, &vpm->peername) > 0)
return 1; return 1;
} }
return n == 0; return n == 0;
@@ -785,17 +785,16 @@ static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id)
static int check_id(X509_STORE_CTX *ctx) static int check_id(X509_STORE_CTX *ctx)
{ {
X509_VERIFY_PARAM *vpm = ctx->param; X509_VERIFY_PARAM *vpm = ctx->param;
X509_VERIFY_PARAM_ID *id = vpm->id;
X509 *x = ctx->cert; X509 *x = ctx->cert;
if (id->hosts && check_hosts(x, id) <= 0) { if (vpm->hosts && check_hosts(x, vpm) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH)) if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))
return 0; return 0;
} }
if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0) { if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH)) if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))
return 0; return 0;
} }
if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0) { if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH)) if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
return 0; return 0;
} }

94
crypto/x509/x509_vpm.c
View File

@@ -83,7 +83,7 @@ static void str_free(char *s)
OPENSSL_free(s); OPENSSL_free(s);
} }
static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode, static int int_x509_param_set_hosts(X509_VERIFY_PARAM *vpm, int mode,
const char *name, size_t namelen) const char *name, size_t namelen)
{ {
char *copy; char *copy;
@@ -100,8 +100,8 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,
--namelen; --namelen;
if (mode == SET_HOST) { if (mode == SET_HOST) {
sk_OPENSSL_STRING_pop_free(id->hosts, str_free); sk_OPENSSL_STRING_pop_free(vpm->hosts, str_free);
id->hosts = NULL; vpm->hosts = NULL;
} }
if (name == NULL || namelen == 0) if (name == NULL || namelen == 0)
return 1; return 1;
@@ -110,17 +110,17 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,
if (copy == NULL) if (copy == NULL)
return 0; return 0;
if (id->hosts == NULL && if (vpm->hosts == NULL &&
(id->hosts = sk_OPENSSL_STRING_new_null()) == NULL) { (vpm->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {
OPENSSL_free(copy); OPENSSL_free(copy);
return 0; return 0;
} }
if (!sk_OPENSSL_STRING_push(id->hosts, copy)) { if (!sk_OPENSSL_STRING_push(vpm->hosts, copy)) {
OPENSSL_free(copy); OPENSSL_free(copy);
if (sk_OPENSSL_STRING_num(id->hosts) == 0) { if (sk_OPENSSL_STRING_num(vpm->hosts) == 0) {
sk_OPENSSL_STRING_free(id->hosts); sk_OPENSSL_STRING_free(vpm->hosts);
id->hosts = NULL; vpm->hosts = NULL;
} }
return 0; return 0;
} }
@@ -130,7 +130,6 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,
static void x509_verify_param_zero(X509_VERIFY_PARAM *param) static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
{ {
X509_VERIFY_PARAM_ID *paramid;
if (!param) if (!param)
return; return;
param->name = NULL; param->name = NULL;
@@ -144,32 +143,25 @@ static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
param->depth = -1; param->depth = -1;
sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free); sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
param->policies = NULL; param->policies = NULL;
paramid = param->id; sk_OPENSSL_STRING_pop_free(param->hosts, str_free);
sk_OPENSSL_STRING_pop_free(paramid->hosts, str_free); param->hosts = NULL;
paramid->hosts = NULL; OPENSSL_free(param->peername);
OPENSSL_free(paramid->peername); param->peername = NULL;
paramid->peername = NULL; OPENSSL_free(param->email);
OPENSSL_free(paramid->email); param->email = NULL;
paramid->email = NULL; param->emaillen = 0;
paramid->emaillen = 0; OPENSSL_free(param->ip);
OPENSSL_free(paramid->ip); param->ip = NULL;
paramid->ip = NULL; param->iplen = 0;
paramid->iplen = 0;
} }
X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void) X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
{ {
X509_VERIFY_PARAM *param; X509_VERIFY_PARAM *param;
X509_VERIFY_PARAM_ID *paramid;
param = OPENSSL_zalloc(sizeof(*param)); param = OPENSSL_zalloc(sizeof(*param));
if (param == NULL) if (param == NULL)
return NULL; return NULL;
param->id = paramid = OPENSSL_zalloc(sizeof(*paramid));
if (paramid == NULL) {
OPENSSL_free(param);
return NULL;
}
x509_verify_param_zero(param); x509_verify_param_zero(param);
return param; return param;
} }
@@ -179,7 +171,6 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
if (!param) if (!param)
return; return;
x509_verify_param_zero(param); x509_verify_param_zero(param);
OPENSSL_free(param->id);
OPENSSL_free(param); OPENSSL_free(param);
} }
@@ -221,11 +212,6 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
(to_overwrite || \ (to_overwrite || \
((src->field != def) && (to_default || (dest->field == def)))) ((src->field != def) && (to_default || (dest->field == def))))
/* As above but for ID fields */
#define test_x509_verify_param_copy_id(idf, def) \
test_x509_verify_param_copy(id->idf, def)
/* Macro to test and copy a field if necessary */ /* Macro to test and copy a field if necessary */
#define x509_verify_param_copy(field, def) \ #define x509_verify_param_copy(field, def) \
@@ -237,10 +223,8 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
{ {
unsigned long inh_flags; unsigned long inh_flags;
int to_default, to_overwrite; int to_default, to_overwrite;
X509_VERIFY_PARAM_ID *id;
if (!src) if (!src)
return 1; return 1;
id = src->id;
inh_flags = dest->inh_flags | src->inh_flags; inh_flags = dest->inh_flags | src->inh_flags;
if (inh_flags & X509_VP_FLAG_ONCE) if (inh_flags & X509_VP_FLAG_ONCE)
@@ -282,25 +266,25 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
} }
/* Copy the host flags if and only if we're copying the host list */ /* Copy the host flags if and only if we're copying the host list */
if (test_x509_verify_param_copy_id(hosts, NULL)) { if (test_x509_verify_param_copy(hosts, NULL)) {
sk_OPENSSL_STRING_pop_free(dest->id->hosts, str_free); sk_OPENSSL_STRING_pop_free(dest->hosts, str_free);
dest->id->hosts = NULL; dest->hosts = NULL;
if (id->hosts) { if (src->hosts) {
dest->id->hosts = dest->hosts =
sk_OPENSSL_STRING_deep_copy(id->hosts, str_copy, str_free); sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);
if (dest->id->hosts == NULL) if (dest->hosts == NULL)
return 0; return 0;
dest->id->hostflags = id->hostflags; dest->hostflags = src->hostflags;
} }
} }
if (test_x509_verify_param_copy_id(email, NULL)) { if (test_x509_verify_param_copy(email, NULL)) {
if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen)) if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))
return 0; return 0;
} }
if (test_x509_verify_param_copy_id(ip, NULL)) { if (test_x509_verify_param_copy(ip, NULL)) {
if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen)) if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))
return 0; return 0;
} }
@@ -440,30 +424,30 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
const char *name, size_t namelen) const char *name, size_t namelen)
{ {
return int_x509_param_set_hosts(param->id, SET_HOST, name, namelen); return int_x509_param_set_hosts(param, SET_HOST, name, namelen);
} }
int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param, int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,
const char *name, size_t namelen) const char *name, size_t namelen)
{ {
return int_x509_param_set_hosts(param->id, ADD_HOST, name, namelen); return int_x509_param_set_hosts(param, ADD_HOST, name, namelen);
} }
void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
unsigned int flags) unsigned int flags)
{ {
param->id->hostflags = flags; param->hostflags = flags;
} }
char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param) char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param)
{ {
return param->id->peername; return param->peername;
} }
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
const char *email, size_t emaillen) const char *email, size_t emaillen)
{ {
return int_x509_param_set1(&param->id->email, &param->id->emaillen, return int_x509_param_set1(&param->email, &param->emaillen,
email, emaillen); email, emaillen);
} }
@@ -472,7 +456,7 @@ int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
{ {
if (iplen != 0 && iplen != 4 && iplen != 16) if (iplen != 0 && iplen != 4 && iplen != 16)
return 0; return 0;
return int_x509_param_set1((char **)&param->id->ip, &param->id->iplen, return int_x509_param_set1((char **)&param->ip, &param->iplen,
(char *)ip, iplen); (char *)ip, iplen);
} }
@@ -497,9 +481,7 @@ const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param)
return param->name; return param->name;
} }
static X509_VERIFY_PARAM_ID _empty_id = { NULL, 0U, NULL, NULL, 0, NULL, 0 }; #define vpm_empty_id NULL, 0U, NULL, NULL, 0, NULL, 0
#define vpm_empty_id (X509_VERIFY_PARAM_ID *)&_empty_id
/* /*
* Default verify parameters: these are used for various applications and can * Default verify parameters: these are used for various applications and can

1
include/openssl/x509_vfy.h
View File

@@ -143,7 +143,6 @@ typedef struct x509_lookup_method_st {
X509_OBJECT *ret); X509_OBJECT *ret);
} X509_LOOKUP_METHOD; } X509_LOOKUP_METHOD;
typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID;
typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM; typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM;
DECLARE_STACK_OF(X509_VERIFY_PARAM) DECLARE_STACK_OF(X509_VERIFY_PARAM)