Document SSL_library_init() and it's aliases. Lutz Jaenicke <Lutz.Jaenicke@aet.TU...

[openssl.git] / crypto / x509 / x509_cmp.c

diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index bc645d1a862bd9352893793d656feff2efd2a98f..b147d573d2f9613788a66f11ef2e3bd11d1eed0c 100644 (file)
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c
@@ -57,21 +57,20 @@
  */
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
-int X509_issuer_and_serial_cmp(X509 *a, X509 *b)
+int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
        {
        int i;
        X509_CINF *ai,*bi;
 
        ai=a->cert_info;
        bi=b->cert_info;
-       i=ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
+       i=M_ASN1_INTEGER_cmp(ai->serialNumber,bi->serialNumber);
        if (i) return(i);
        return(X509_NAME_cmp(ai->issuer,bi->issuer));
        }
@@ -98,17 +97,17 @@ unsigned long X509_issuer_and_serial_hash(X509 *a)
        }
 #endif
        
-int X509_issuer_name_cmp(X509 *a, X509 *b)
+int X509_issuer_name_cmp(const X509 *a, const X509 *b)
        {
        return(X509_NAME_cmp(a->cert_info->issuer,b->cert_info->issuer));
        }
 
-int X509_subject_name_cmp(X509 *a, X509 *b)
+int X509_subject_name_cmp(const X509 *a, const X509 *b)
        {
        return(X509_NAME_cmp(a->cert_info->subject,b->cert_info->subject));
        }
 
-int X509_CRL_cmp(X509_CRL *a, X509_CRL *b)
+int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
        {
        return(X509_NAME_cmp(a->crl->issuer,b->crl->issuer));
        }
@@ -138,17 +137,39 @@ unsigned long X509_subject_name_hash(X509 *x)
        return(X509_NAME_hash(x->cert_info->subject));
        }
 
-int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
+#ifndef NO_SHA
+/* Compare two certificates: they must be identical for
+ * this to work. NB: Although "cmp" operations are generally
+ * prototyped to take "const" arguments (eg. for use in
+ * STACKs), the way X509 handling is - these operations may
+ * involve ensuring the hashes are up-to-date and ensuring
+ * certain cert information is cached. So this is the point
+ * where the "depth-first" constification tree has to halt
+ * with an evil cast.
+ */
+int X509_cmp(const X509 *a, const X509 *b)
+{
+       /* ensure hash is valid */
+       X509_check_purpose((X509 *)a, -1, 0);
+       X509_check_purpose((X509 *)b, -1, 0);
+
+       return memcmp(a->sha1_hash, b->sha1_hash, SHA_DIGEST_LENGTH);
+}
+#endif
+
+int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
        {
        int i,j;
        X509_NAME_ENTRY *na,*nb;
 
-       if (sk_num(a->entries) != sk_num(b->entries))
-               return(sk_num(a->entries)-sk_num(b->entries));
-       for (i=sk_num(a->entries)-1; i>=0; i--)
+       if (sk_X509_NAME_ENTRY_num(a->entries)
+           != sk_X509_NAME_ENTRY_num(b->entries))
+               return sk_X509_NAME_ENTRY_num(a->entries)
+                 -sk_X509_NAME_ENTRY_num(b->entries);
+       for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--)
                {
-               na=(X509_NAME_ENTRY *)sk_value(a->entries,i);
-               nb=(X509_NAME_ENTRY *)sk_value(b->entries,i);
+               na=sk_X509_NAME_ENTRY_value(a->entries,i);
+               nb=sk_X509_NAME_ENTRY_value(b->entries,i);
                j=na->value->length-nb->value->length;
                if (j) return(j);
                j=memcmp(na->value->data,nb->value->data,
@@ -161,10 +182,10 @@ int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
        /* We will check the object types after checking the values
         * since the values will more often be different than the object
         * types. */
-       for (i=sk_num(a->entries)-1; i>=0; i--)
+       for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--)
                {
-               na=(X509_NAME_ENTRY *)sk_value(a->entries,i);
-               nb=(X509_NAME_ENTRY *)sk_value(b->entries,i);
+               na=sk_X509_NAME_ENTRY_value(a->entries,i);
+               nb=sk_X509_NAME_ENTRY_value(b->entries,i);
                j=OBJ_cmp(na->object,nb->object);
                if (j) return(j);
                }
@@ -173,7 +194,7 @@ int X509_NAME_cmp(X509_NAME *a, X509_NAME *b)
 
 #ifndef NO_MD5
 /* I now DER encode the name and hash it.  Since I cache the DER encoding,
- * this is reasonably effiecent. */
+ * this is reasonably efficient. */
 unsigned long X509_NAME_hash(X509_NAME *x)
        {
        unsigned long ret=0;
@@ -183,14 +204,14 @@ unsigned long X509_NAME_hash(X509_NAME *x)
 
        i=i2d_X509_NAME(x,NULL);
        if (i > sizeof(str))
-               p=Malloc(i);
+               p=OPENSSL_malloc(i);
        else
                p=str;
 
        pp=p;
        i2d_X509_NAME(x,&pp);
        MD5((unsigned char *)p,i,&(md[0]));
-       if (p != str) Free(p);
+       if (p != str) OPENSSL_free(p);
 
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -207,6 +228,8 @@ X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
        X509_CINF cinf;
        X509 x,*x509=NULL;
 
+       if(!sk) return NULL;
+
        x.cert_info= &cinf;
        cinf.serialNumber=serial;
        cinf.issuer=name;
@@ -249,7 +272,7 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
        xk=X509_get_pubkey(x);
        if (xk->type != k->type)
            {
-           SSLerr(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
+           X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
            goto err;
            }
        switch (k->type)
@@ -259,7 +282,7 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
                if (BN_cmp(xk->pkey.rsa->n,k->pkey.rsa->n) != 0
                    || BN_cmp(xk->pkey.rsa->e,k->pkey.rsa->e) != 0)
                    {
-                   SSLerr(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
+                   X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
                    goto err;
                    }
                break;
@@ -268,7 +291,7 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
        case EVP_PKEY_DSA:
                if (BN_cmp(xk->pkey.dsa->pub_key,k->pkey.dsa->pub_key) != 0)
                    {
-                   SSLerr(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
+                   X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
                    goto err;
                    }
                break;
@@ -276,11 +299,11 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
 #ifndef NO_DH
        case EVP_PKEY_DH:
                /* No idea */
-               SSLerr(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
+               X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
                goto err;
 #endif
        default:
-               SSLerr(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
+               X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
                goto err;
                }