gcm128.c: make it work with no-sse2.

[openssl.git] / crypto / x509v3 / v3_purp.c

diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
index 7bb6658b9053bf652e446f30de49715203c33dc2..e7cf7011604af0ea94ecbfa96686d4d19f94ac53 100644 (file)
--- a/crypto/x509v3/v3_purp.c
+++ b/crypto/x509v3/v3_purp.c
@@ -1,5 +1,5 @@
 /* v3_purp.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
 /* ====================================================================
@@ -267,11 +267,14 @@ int X509_PURPOSE_get_trust(X509_PURPOSE *xp)
        return xp->trust;
 }
 
-static int nid_cmp(int *a, int *b)
+static int nid_cmp(const int *a, const int *b)
        {
        return *a - *b;
        }
 
+DECLARE_OBJ_BSEARCH_CMP_FN(int, int, nid);
+IMPLEMENT_OBJ_BSEARCH_CMP_FN(int, int, nid);
+
 int X509_supported_extension(X509_EXTENSION *ex)
        {
        /* This table is a list of the NIDs of supported extensions:
@@ -282,7 +285,7 @@ int X509_supported_extension(X509_EXTENSION *ex)
         * searched using bsearch.
         */
 
-       static int supported_nids[] = {
+       static const int supported_nids[] = {
                NID_netscape_cert_type, /* 71 */
                NID_key_usage,          /* 83 */
                NID_subject_alt_name,   /* 85 */
@@ -296,19 +299,17 @@ int X509_supported_extension(X509_EXTENSION *ex)
                NID_policy_constraints, /* 401 */
                NID_proxyCertInfo,      /* 663 */
                NID_name_constraints,   /* 666 */
+               NID_policy_mappings,    /* 747 */
                NID_inhibit_any_policy  /* 748 */
        };
 
-       int ex_nid;
-
-       ex_nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex));
+       int ex_nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex));
 
        if (ex_nid == NID_undef) 
                return 0;
 
-       if (OBJ_bsearch((char *)&ex_nid, (char *)supported_nids,
-               sizeof(supported_nids)/sizeof(int), sizeof(int),
-               (int (*)(const void *, const void *))nid_cmp))
+       if (OBJ_bsearch_nid(&ex_nid, supported_nids,
+                       sizeof(supported_nids)/sizeof(int)))
                return 1;
        return 0;
        }
@@ -317,6 +318,16 @@ static void setup_dp(X509 *x, DIST_POINT *dp)
        {
        X509_NAME *iname = NULL;
        int i;
+       if (dp->reasons)
+               {
+               if (dp->reasons->length > 0)
+                       dp->dp_reasons = dp->reasons->data[0];
+               if (dp->reasons->length > 1)
+                       dp->dp_reasons |= (dp->reasons->data[1] << 8);
+               dp->dp_reasons &= CRLDP_ALL_REASONS;
+               }
+       else
+               dp->dp_reasons = CRLDP_ALL_REASONS;
        if (!dp->distpoint || (dp->distpoint->type != 1))
                return;
        for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++)
@@ -357,9 +368,6 @@ static void x509v3_cache_extensions(X509 *x)
 #ifndef OPENSSL_NO_SHA
        X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
 #endif
-       /* Does subject name match issuer ? */
-       if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
-                        x->ex_flags |= EXFLAG_SI;
        /* V1 should mean no extensions ... */
        if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
        /* Handle basic constraints */
@@ -436,6 +444,10 @@ static void x509v3_cache_extensions(X509 *x)
                                case NID_dvcs:
                                x->ex_xkusage |= XKU_DVCS;
                                break;
+
+                               case NID_anyExtendedKeyUsage:
+                               x->ex_xkusage |= XKU_ANYEKU;
+                               break;
                        }
                }
                sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
@@ -449,13 +461,20 @@ static void x509v3_cache_extensions(X509 *x)
        }
        x->skid =X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
        x->akid =X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);
+       /* Does subject name match issuer ? */
+       if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
+                       {
+                       x->ex_flags |= EXFLAG_SI;
+                       /* If SKID matches AKID also indicate self signed */
+                       if (X509_check_akid(x, x->akid) == X509_V_OK)
+                               x->ex_flags |= EXFLAG_SS;
+                       }
        x->altname = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
        x->nc = X509_get_ext_d2i(x, NID_name_constraints, &i, NULL);
        if (!x->nc && (i != -1))
                x->ex_flags |= EXFLAG_INVALID;
        setup_crldp(x);
-                       
-                       
+
 #ifndef OPENSSL_NO_RFC3779
        x->rfc3779_addr =X509_get_ext_d2i(x, NID_sbgp_ipAddrBlock, NULL, NULL);
        x->rfc3779_asid =X509_get_ext_d2i(x, NID_sbgp_autonomousSysNum,
@@ -466,6 +485,9 @@ static void x509v3_cache_extensions(X509 *x)
                ex = X509_get_ext(x, i);
                if (!X509_EXTENSION_get_critical(ex))
                        continue;
+               if (OBJ_obj2nid(X509_EXTENSION_get_object(ex))
+                                       == NID_freshest_crl)
+                       x->ex_flags |= EXFLAG_FRESHEST;
                if (!X509_supported_extension(ex))
                        {
                        x->ex_flags |= EXFLAG_CRITICAL;