static void x509v3_cache_extensions(X509 *x);
static int ca_check(X509 *x);
+static int check_ssl_ca(X509 *x);
static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca);
+static int no_check(X509_PURPOSE *xp, X509 *x, int ca);
static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b);
static void xptable_free(X509_PURPOSE *p);
{X509_PURPOSE_NS_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ns_ssl_server, "Netscape SSL server", "nssslserver", NULL},
{X509_PURPOSE_SMIME_SIGN, X509_TRUST_EMAIL, 0, check_purpose_smime_sign, "S/MIME signing", "smimesign", NULL},
{X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
- {X509_PURPOSE_CRL_SIGN, X509_TRUST_ANY, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
+ {X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
+ {X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
};
#define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
if(id == -1) return 1;
idx = X509_PURPOSE_get_by_id(id);
if(idx == -1) return -1;
- pt = X509_PURPOSE_iget(idx);
+ pt = X509_PURPOSE_get0(idx);
return pt->check_purpose(pt, x, ca);
}
return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
}
-X509_PURPOSE * X509_PURPOSE_iget(int idx)
+X509_PURPOSE * X509_PURPOSE_get0(int idx)
{
if(idx < 0) return NULL;
if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
int i;
X509_PURPOSE *xptmp;
for(i = 0; i < X509_PURPOSE_get_count(); i++) {
- xptmp = X509_PURPOSE_iget(i);
+ xptmp = X509_PURPOSE_get0(i);
if(!strcmp(xptmp->sname, sname)) return i;
}
return -1;
return 0;
}
ptmp->flags = X509_PURPOSE_DYNAMIC;
- } else ptmp = X509_PURPOSE_iget(idx);
+ } else ptmp = X509_PURPOSE_get0(idx);
/* Free existing name if dynamic */
if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
return xp->purpose;
}
-char *X509_PURPOSE_iget_name(X509_PURPOSE *xp)
+char *X509_PURPOSE_get0_name(X509_PURPOSE *xp)
{
return xp->name;
}
-char *X509_PURPOSE_iget_sname(X509_PURPOSE *xp)
+char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp)
{
return xp->sname;
}
/* V1 should mean no extensions ... */
if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
/* Handle basic constraints */
- if((bs=X509V3_X509_get_d2i(x, NID_basic_constraints, NULL, NULL))) {
+ if((bs=X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
if(bs->ca) x->ex_flags |= EXFLAG_CA;
if(bs->pathlen) {
if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
x->ex_flags |= EXFLAG_BCONS;
}
/* Handle key usage */
- if((usage=X509V3_X509_get_d2i(x, NID_key_usage, NULL, NULL))) {
+ if((usage=X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
if(usage->length > 0) {
x->ex_kusage = usage->data[0];
if(usage->length > 1)
ASN1_BIT_STRING_free(usage);
}
x->ex_xkusage = 0;
- if((extusage=X509V3_X509_get_d2i(x, NID_ext_key_usage, NULL, NULL))) {
+ if((extusage=X509_get_ext_d2i(x, NID_ext_key_usage, NULL, NULL))) {
x->ex_flags |= EXFLAG_XKUSAGE;
for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
}
- if((ns=X509V3_X509_get_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
+ if((ns=X509_get_ext_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
if(ns->length > 0) x->ex_nscert = ns->data[0];
else x->ex_nscert = 0;
x->ex_flags |= EXFLAG_NSCERT;
}
}
+/* Check SSL CA: common checks for SSL client and server */
+static int check_ssl_ca(X509 *x)
+{
+ int ca_ret;
+ ca_ret = ca_check(x);
+ if(!ca_ret) return 0;
+ /* check nsCertType if present */
+ if(x->ex_flags & EXFLAG_NSCERT) {
+ if(x->ex_nscert & NS_SSL_CA) return ca_ret;
+ return 0;
+ }
+ if(ca_ret != 2) return ca_ret;
+ else return 0;
+}
+
static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
{
if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
- if(ca) {
- int ca_ret;
- ca_ret = ca_check(x);
- if(!ca_ret) return 0;
- /* check nsCertType if present */
- if(x->ex_flags & EXFLAG_NSCERT) {
- if(x->ex_nscert & NS_SSL_CA) return ca_ret;
- return 0;
- }
- if(ca_ret != 2) return ca_ret;
- else return 0;
- }
+ if(ca) return check_ssl_ca(x);
/* We need to do digital signatures with it */
if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
/* nsCertType if present should allow SSL client use */
static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
{
if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
- /* Otherwise same as SSL client for a CA */
- if(ca) return check_purpose_ssl_client(xp, x, 1);
+ if(ca) return check_ssl_ca(x);
if(ns_reject(x, NS_SSL_SERVER)) return 0;
/* Now as for keyUsage: we'll at least need to sign OR encipher */
if(ku_reject(x, KU_CRL_SIGN)) return 0;
return 1;
}
+
+static int no_check(X509_PURPOSE *xp, X509 *x, int ca)
+{
+ return 1;
+}