+int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
+ {
+ return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
+ }
+
+int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust)
+ {
+ return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust);
+ }
+
+/* This function is used to set the X509_STORE_CTX purpose and trust
+ * values. This is intended to be used when another structure has its
+ * own trust and purpose values which (if set) will be inherited by
+ * the ctx. If they aren't set then we will usually have a default
+ * purpose in mind which should then be used to set the trust value.
+ * An example of this is SSL use: an SSL structure will have its own
+ * purpose and trust settings which the application can set: if they
+ * aren't set then we use the default of SSL client/server.
+ */
+
+int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
+ int purpose, int trust)
+{
+ int idx;
+ /* If purpose not set use default */
+ if (!purpose) purpose = def_purpose;
+ /* If we have a purpose then check it is valid */
+ if (purpose)
+ {
+ X509_PURPOSE *ptmp;
+ idx = X509_PURPOSE_get_by_id(purpose);
+ if (idx == -1)
+ {
+ X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+ X509_R_UNKNOWN_PURPOSE_ID);
+ return 0;
+ }
+ ptmp = X509_PURPOSE_get0(idx);
+ if (ptmp->trust == X509_TRUST_DEFAULT)
+ {
+ idx = X509_PURPOSE_get_by_id(def_purpose);
+ if (idx == -1)
+ {
+ X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+ X509_R_UNKNOWN_PURPOSE_ID);
+ return 0;
+ }
+ ptmp = X509_PURPOSE_get0(idx);
+ }
+ /* If trust not set then get from purpose default */
+ if (!trust) trust = ptmp->trust;
+ }
+ if (trust)
+ {
+ idx = X509_TRUST_get_by_id(trust);
+ if (idx == -1)
+ {
+ X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+ X509_R_UNKNOWN_TRUST_ID);
+ return 0;
+ }
+ }
+
+ if (purpose) ctx->purpose = purpose;
+ if (trust) ctx->trust = trust;
+ return 1;
+}
+
+X509_STORE_CTX *X509_STORE_CTX_new(void)
+{
+ X509_STORE_CTX *ctx;
+ ctx = (X509_STORE_CTX *)OPENSSL_malloc(sizeof(X509_STORE_CTX));
+ if (ctx) memset(ctx, 0, sizeof(X509_STORE_CTX));
+ return ctx;
+}
+
+void X509_STORE_CTX_free(X509_STORE_CTX *ctx)
+{
+ X509_STORE_CTX_cleanup(ctx);
+ OPENSSL_free(ctx);
+}
+
+void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
+ STACK_OF(X509) *chain)
+ {
+ ctx->ctx=store;
+ ctx->current_method=0;
+ ctx->cert=x509;
+ ctx->untrusted=chain;
+ ctx->last_untrusted=0;
+ ctx->purpose=0;
+ ctx->trust=0;
+ ctx->check_time=0;
+ ctx->flags=0;
+ ctx->other_ctx=NULL;
+ ctx->valid=0;
+ ctx->chain=NULL;
+ ctx->depth=9;
+ ctx->error=0;
+ ctx->error_depth=0;
+ ctx->current_cert=NULL;
+ ctx->current_issuer=NULL;
+ ctx->check_issued = check_issued;
+ ctx->get_issuer = X509_STORE_CTX_get1_issuer;
+ ctx->verify_cb = store->verify_cb;
+ ctx->verify = store->verify;
+ ctx->cleanup = 0;
+ memset(&(ctx->ex_data),0,sizeof(CRYPTO_EX_DATA));
+ }
+
+/* Set alternative lookup method: just a STACK of trusted certificates.
+ * This avoids X509_STORE nastiness where it isn't needed.
+ */
+
+void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
+{
+ ctx->other_ctx = sk;
+ ctx->get_issuer = get_issuer_sk;
+}
+
+void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
+ {
+ if (ctx->cleanup) ctx->cleanup(ctx);
+ if (ctx->chain != NULL)
+ {
+ sk_X509_pop_free(ctx->chain,X509_free);
+ ctx->chain=NULL;
+ }
+ CRYPTO_free_ex_data(x509_store_ctx_method,ctx,&(ctx->ex_data));
+ memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));
+ }
+
+void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, long flags)
+ {
+ ctx->flags |= flags;
+ }
+
+void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, long flags, time_t t)
+ {
+ ctx->check_time = t;
+ ctx->flags |= X509_V_FLAG_USE_CHECK_TIME;
+ }
+