Extend attribute setting routines to support non-string types.

[openssl.git] / crypto / x509 / x509_vfy.c

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 2292b27ff772df06cffdb51b612fb9515c5dc183..609606c13eb1f7e16652b473c4bcc84d8164641f 100644 (file)
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -81,7 +81,7 @@ static int check_policy(X509_STORE_CTX *ctx);
 static int crl_akid_check(X509_STORE_CTX *ctx, AUTHORITY_KEYID *akid);
 static int idp_check_scope(X509 *x, X509_CRL *crl);
 static int internal_verify(X509_STORE_CTX *ctx);
-const char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
+const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
 
 
 static int null_callback(int ok, X509_STORE_CTX *e)
@@ -166,7 +166,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                                        goto end;
                                        }
                                CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
-                               sk_X509_delete_ptr(sktmp,xtmp);
+                               (void)sk_X509_delete_ptr(sktmp,xtmp);
                                ctx->last_untrusted++;
                                x=xtmp;
                                num++;
@@ -314,6 +314,14 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                ok=internal_verify(ctx);
        if(!ok) goto end;
 
+#ifndef OPENSSL_NO_RFC3779
+       /* RFC 3779 path validation, now that CRL check has been done */
+       ok = v3_asid_validate_path(ctx);
+       if (!ok) goto end;
+       ok = v3_addr_validate_path(ctx);
+       if (!ok) goto end;
+#endif
+
        /* If we get this far evaluate policies */
        if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK))
                ok = ctx->check_policy(ctx);
@@ -937,60 +945,29 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
 /* Check certificate against CRL */
 static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
        {
-       int idx, ok;
-       X509_REVOKED rtmp;
-       STACK_OF(X509_EXTENSION) *exts;
-       X509_EXTENSION *ext;
-       /* Look for serial number of certificate in CRL */
-       rtmp.serialNumber = X509_get_serialNumber(x);
-       /* Sort revoked into serial number order if not already sorted.
-        * Do this under a lock to avoid race condition.
-        */
-       if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked))
-               {
-               CRYPTO_w_lock(CRYPTO_LOCK_X509_CRL);
-               sk_X509_REVOKED_sort(crl->crl->revoked);
-               CRYPTO_w_unlock(CRYPTO_LOCK_X509_CRL);
-               }
-       idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
-       /* If found assume revoked: want something cleverer than
+       int ok;
+       /* Look for serial number of certificate in CRL
+        * If found assume revoked: want something cleverer than
         * this to handle entry extensions in V2 CRLs.
         */
-       if(idx >= 0)
+       if (X509_CRL_get0_by_serial(crl, NULL, X509_get_serialNumber(x)) > 0)
                {
                ctx->error = X509_V_ERR_CERT_REVOKED;
                ok = ctx->verify_cb(0, ctx);
-               if (!ok) return 0;
+               if (!ok)
+                       return 0;
                }
 
-       if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
-               return 1;
-
-       /* See if we have any critical CRL extensions: since we
-        * currently don't handle any CRL extensions the CRL must be
-        * rejected. 
-        * This code accesses the X509_CRL structure directly: applications
-        * shouldn't do this.
-        */
-
-       exts = crl->crl->extensions;
-
-       for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++)
+       if (crl->flags & EXFLAG_CRITICAL)
                {
-               ext = sk_X509_EXTENSION_value(exts, idx);
-               if (ext->critical > 0)
-                       {
-                       /* We handle IDP now so permit it */
-                       if (OBJ_obj2nid(ext->object) ==
-                               NID_issuing_distribution_point)
-                               continue;
-                       ctx->error =
-                               X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
-                       ok = ctx->verify_cb(0, ctx);
-                       if(!ok) return 0;
-                       break;
-                       }
+               if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
+                       return 1;
+               ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
+               ok = ctx->verify_cb(0, ctx);
+               if(!ok)
+                       return 0;
                }
+
        return 1;
        }
 
@@ -1180,12 +1157,12 @@ end:
        return ok;
        }
 
-int X509_cmp_current_time(ASN1_TIME *ctm)
+int X509_cmp_current_time(const ASN1_TIME *ctm)
 {
        return X509_cmp_time(ctm, NULL);
 }
 
-int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time)
+int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
        {
        char *str;
        ASN1_TIME atm;
@@ -1621,9 +1598,16 @@ void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
        {
        if (ctx->cleanup) ctx->cleanup(ctx);
-       X509_VERIFY_PARAM_free(ctx->param);
-       if (ctx->tree)
+       if (ctx->param != NULL)
+               {
+               X509_VERIFY_PARAM_free(ctx->param);
+               ctx->param=NULL;
+               }
+       if (ctx->tree != NULL)
+               {
                X509_policy_tree_free(ctx->tree);
+               ctx->tree=NULL;
+               }
        if (ctx->chain != NULL)
                {
                sk_X509_pop_free(ctx->chain,X509_free);