Commit 9689a6ae authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Remove X509_VERIFY_PARAM_ID 



Now that X509_VERIFY_PARAM is opaque X509_VERIFY_PARAM_ID is no longer
needed.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
parent 3bbd1d63

crypto/x509/x509_lcl.h

+1 −6
Original line number Diff line number Diff line
@@ -72,12 +72,7 @@ struct X509_VERIFY_PARAM_st { 
    int trust;                  /* trust setting to check */

    int depth;                  /* Verify depth */

    STACK_OF(ASN1_OBJECT) *policies; /* Permissible policies */

    X509_VERIFY_PARAM_ID *id;   /* opaque ID data */

};



/* internal only structure to hold additional X509_VERIFY_PARAM data */



struct X509_VERIFY_PARAM_ID_st {

    /* Peer identity details */

    STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */

    unsigned int hostflags;     /* Flags to control matching features */

    char *peername;             /* Matching hostname in peer certificate */

crypto/x509/x509_vfy.c

+10 −11
Original line number Diff line number Diff line
@@ -764,19 +764,19 @@ static int check_id_error(X509_STORE_CTX *ctx, int errcode) 
    return ctx->verify_cb(0, ctx);

}



static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id)

static int check_hosts(X509 *x, X509_VERIFY_PARAM *vpm)

{

    int i;

    int n = sk_OPENSSL_STRING_num(id->hosts);

    int n = sk_OPENSSL_STRING_num(vpm->hosts);

    char *name;



    if (id->peername != NULL) {

        OPENSSL_free(id->peername);

        id->peername = NULL;

    if (vpm->peername != NULL) {

        OPENSSL_free(vpm->peername);

        vpm->peername = NULL;

    }

    for (i = 0; i < n; ++i) {

        name = sk_OPENSSL_STRING_value(id->hosts, i);

        if (X509_check_host(x, name, 0, id->hostflags, &id->peername) > 0)

        name = sk_OPENSSL_STRING_value(vpm->hosts, i);

        if (X509_check_host(x, name, 0, vpm->hostflags, &vpm->peername) > 0)

            return 1;

    }

    return n == 0;
@@ -785,17 +785,16 @@ static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id) 
static int check_id(X509_STORE_CTX *ctx)

{

    X509_VERIFY_PARAM *vpm = ctx->param;

    X509_VERIFY_PARAM_ID *id = vpm->id;

    X509 *x = ctx->cert;

    if (id->hosts && check_hosts(x, id) <= 0) {

    if (vpm->hosts && check_hosts(x, vpm) <= 0) {

        if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))

            return 0;

    }

    if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0) {

    if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) {

        if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))

            return 0;

    }

    if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0) {

    if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) {

        if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))

            return 0;

    }

crypto/x509/x509_vpm.c

+38 −56
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ static void str_free(char *s) 
    OPENSSL_free(s);

}



static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,

static int int_x509_param_set_hosts(X509_VERIFY_PARAM *vpm, int mode,

                                    const char *name, size_t namelen)

{

    char *copy;
@@ -100,8 +100,8 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode, 
        --namelen;



    if (mode == SET_HOST) {

        sk_OPENSSL_STRING_pop_free(id->hosts, str_free);

        id->hosts = NULL;

        sk_OPENSSL_STRING_pop_free(vpm->hosts, str_free);

        vpm->hosts = NULL;

    }

    if (name == NULL || namelen == 0)

        return 1;
@@ -110,17 +110,17 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode, 
    if (copy == NULL)

        return 0;



    if (id->hosts == NULL &&

        (id->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {

    if (vpm->hosts == NULL &&

        (vpm->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {

        OPENSSL_free(copy);

        return 0;

    }



    if (!sk_OPENSSL_STRING_push(id->hosts, copy)) {

    if (!sk_OPENSSL_STRING_push(vpm->hosts, copy)) {

        OPENSSL_free(copy);

        if (sk_OPENSSL_STRING_num(id->hosts) == 0) {

            sk_OPENSSL_STRING_free(id->hosts);

            id->hosts = NULL;

        if (sk_OPENSSL_STRING_num(vpm->hosts) == 0) {

            sk_OPENSSL_STRING_free(vpm->hosts);

            vpm->hosts = NULL;

        }

        return 0;

    }
@@ -130,7 +130,6 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode, 


static void x509_verify_param_zero(X509_VERIFY_PARAM *param)

{

    X509_VERIFY_PARAM_ID *paramid;

    if (!param)

        return;

    param->name = NULL;
@@ -144,32 +143,25 @@ static void x509_verify_param_zero(X509_VERIFY_PARAM *param) 
    param->depth = -1;

    sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);

    param->policies = NULL;

    paramid = param->id;

    sk_OPENSSL_STRING_pop_free(paramid->hosts, str_free);

    paramid->hosts = NULL;

    OPENSSL_free(paramid->peername);

    paramid->peername = NULL;

    OPENSSL_free(paramid->email);

    paramid->email = NULL;

    paramid->emaillen = 0;

    OPENSSL_free(paramid->ip);

    paramid->ip = NULL;

    paramid->iplen = 0;

    sk_OPENSSL_STRING_pop_free(param->hosts, str_free);

    param->hosts = NULL;

    OPENSSL_free(param->peername);

    param->peername = NULL;

    OPENSSL_free(param->email);

    param->email = NULL;

    param->emaillen = 0;

    OPENSSL_free(param->ip);

    param->ip = NULL;

    param->iplen = 0;

}



X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)

{

    X509_VERIFY_PARAM *param;

    X509_VERIFY_PARAM_ID *paramid;



    param = OPENSSL_zalloc(sizeof(*param));

    if (param == NULL)

        return NULL;

    param->id = paramid = OPENSSL_zalloc(sizeof(*paramid));

    if (paramid == NULL) {

        OPENSSL_free(param);

        return NULL;

    }

    x509_verify_param_zero(param);

    return param;

}
@@ -179,7 +171,6 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param) 
    if (!param)

        return;

    x509_verify_param_zero(param);

    OPENSSL_free(param->id);

    OPENSSL_free(param);

}
@@ -221,11 +212,6 @@ void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param) 
        (to_overwrite || \

                ((src->field != def) && (to_default || (dest->field == def))))



/* As above but for ID fields */



#define test_x509_verify_param_copy_id(idf, def) \

        test_x509_verify_param_copy(id->idf, def)



/* Macro to test and copy a field if necessary */



#define x509_verify_param_copy(field, def) \
@@ -237,10 +223,8 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, 
{

    unsigned long inh_flags;

    int to_default, to_overwrite;

    X509_VERIFY_PARAM_ID *id;

    if (!src)

        return 1;

    id = src->id;

    inh_flags = dest->inh_flags | src->inh_flags;



    if (inh_flags & X509_VP_FLAG_ONCE)
@@ -282,25 +266,25 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, 
    }



    /* Copy the host flags if and only if we're copying the host list */

    if (test_x509_verify_param_copy_id(hosts, NULL)) {

        sk_OPENSSL_STRING_pop_free(dest->id->hosts, str_free);

        dest->id->hosts = NULL;

        if (id->hosts) {

            dest->id->hosts =

                sk_OPENSSL_STRING_deep_copy(id->hosts, str_copy, str_free);

            if (dest->id->hosts == NULL)

    if (test_x509_verify_param_copy(hosts, NULL)) {

        sk_OPENSSL_STRING_pop_free(dest->hosts, str_free);

        dest->hosts = NULL;

        if (src->hosts) {

            dest->hosts =

                sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);

            if (dest->hosts == NULL)

                return 0;

            dest->id->hostflags = id->hostflags;

            dest->hostflags = src->hostflags;

        }

    }



    if (test_x509_verify_param_copy_id(email, NULL)) {

        if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen))

    if (test_x509_verify_param_copy(email, NULL)) {

        if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))

            return 0;

    }



    if (test_x509_verify_param_copy_id(ip, NULL)) {

        if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen))

    if (test_x509_verify_param_copy(ip, NULL)) {

        if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))

            return 0;

    }
@@ -440,30 +424,30 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,

                                const char *name, size_t namelen)

{

    return int_x509_param_set_hosts(param->id, SET_HOST, name, namelen);

    return int_x509_param_set_hosts(param, SET_HOST, name, namelen);

}



int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,

                                const char *name, size_t namelen)

{

    return int_x509_param_set_hosts(param->id, ADD_HOST, name, namelen);

    return int_x509_param_set_hosts(param, ADD_HOST, name, namelen);

}



void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,

                                     unsigned int flags)

{

    param->id->hostflags = flags;

    param->hostflags = flags;

}



char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param)

{

    return param->id->peername;

    return param->peername;

}



int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,

                                 const char *email, size_t emaillen)

{

    return int_x509_param_set1(&param->id->email, &param->id->emaillen,

    return int_x509_param_set1(&param->email, &param->emaillen,

                               email, emaillen);

}
@@ -472,7 +456,7 @@ int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, 
{

    if (iplen != 0 && iplen != 4 && iplen != 16)

        return 0;

    return int_x509_param_set1((char **)&param->id->ip, &param->id->iplen,

    return int_x509_param_set1((char **)&param->ip, &param->iplen,

                               (char *)ip, iplen);

}
@@ -497,9 +481,7 @@ const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param) 
    return param->name;

}



static X509_VERIFY_PARAM_ID _empty_id = { NULL, 0U, NULL, NULL, 0, NULL, 0 };



#define vpm_empty_id (X509_VERIFY_PARAM_ID *)&_empty_id

#define vpm_empty_id NULL, 0U, NULL, NULL, 0, NULL, 0



/*

 * Default verify parameters: these are used for various applications and can

include/openssl/x509_vfy.h

+0 −1
Original line number Diff line number Diff line
@@ -143,7 +143,6 @@ typedef struct x509_lookup_method_st { 
                         X509_OBJECT *ret);

} X509_LOOKUP_METHOD;



typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID;

typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM;



DECLARE_STACK_OF(X509_VERIFY_PARAM)