xref: /openssl/crypto/x509/x509_vpm.c (revision da1c088f)
1 /*
2  * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <stdio.h>
11 
12 #include "internal/cryptlib.h"
13 #include <openssl/crypto.h>
14 #include <openssl/buffer.h>
15 #include <openssl/x509.h>
16 #include <openssl/x509v3.h>
17 #include "crypto/x509.h"
18 
19 #include "x509_local.h"
20 
21 /* X509_VERIFY_PARAM functions */
22 
23 #define SET_HOST 0
24 #define ADD_HOST 1
25 
str_copy(const char * s)26 static char *str_copy(const char *s)
27 {
28     return OPENSSL_strdup(s);
29 }
30 
str_free(char * s)31 static void str_free(char *s)
32 {
33     OPENSSL_free(s);
34 }
35 
int_x509_param_set_hosts(X509_VERIFY_PARAM * vpm,int mode,const char * name,size_t namelen)36 static int int_x509_param_set_hosts(X509_VERIFY_PARAM *vpm, int mode,
37                                     const char *name, size_t namelen)
38 {
39     char *copy;
40 
41     /*
42      * Refuse names with embedded NUL bytes, except perhaps as final byte.
43      * XXX: Do we need to push an error onto the error stack?
44      */
45     if (namelen == 0 || name == NULL)
46         namelen = name ? strlen(name) : 0;
47     else if (name != NULL
48              && memchr(name, '\0', namelen > 1 ? namelen - 1 : namelen) != NULL)
49         return 0;
50     if (namelen > 0 && name[namelen - 1] == '\0')
51         --namelen;
52 
53     if (mode == SET_HOST) {
54         sk_OPENSSL_STRING_pop_free(vpm->hosts, str_free);
55         vpm->hosts = NULL;
56     }
57     if (name == NULL || namelen == 0)
58         return 1;
59 
60     copy = OPENSSL_strndup(name, namelen);
61     if (copy == NULL)
62         return 0;
63 
64     if (vpm->hosts == NULL &&
65         (vpm->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {
66         OPENSSL_free(copy);
67         return 0;
68     }
69 
70     if (!sk_OPENSSL_STRING_push(vpm->hosts, copy)) {
71         OPENSSL_free(copy);
72         if (sk_OPENSSL_STRING_num(vpm->hosts) == 0) {
73             sk_OPENSSL_STRING_free(vpm->hosts);
74             vpm->hosts = NULL;
75         }
76         return 0;
77     }
78 
79     return 1;
80 }
81 
X509_VERIFY_PARAM_new(void)82 X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
83 {
84     X509_VERIFY_PARAM *param;
85 
86     param = OPENSSL_zalloc(sizeof(*param));
87     if (param == NULL)
88         return NULL;
89     param->trust = X509_TRUST_DEFAULT;
90     /* param->inh_flags = X509_VP_FLAG_DEFAULT; */
91     param->depth = -1;
92     param->auth_level = -1; /* -1 means unset, 0 is explicit */
93     return param;
94 }
95 
X509_VERIFY_PARAM_free(X509_VERIFY_PARAM * param)96 void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
97 {
98     if (param == NULL)
99         return;
100     sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
101     sk_OPENSSL_STRING_pop_free(param->hosts, str_free);
102     OPENSSL_free(param->peername);
103     OPENSSL_free(param->email);
104     OPENSSL_free(param->ip);
105     OPENSSL_free(param);
106 }
107 
108 /*-
109  * This function determines how parameters are "inherited" from one structure
110  * to another. There are several different ways this can happen.
111  *
112  * 1. If a child structure needs to have its values initialized from a parent
113  *    they are simply copied across. For example SSL_CTX copied to SSL.
114  * 2. If the structure should take on values only if they are currently unset.
115  *    For example the values in an SSL structure will take appropriate value
116  *    for SSL servers or clients but only if the application has not set new
117  *    ones.
118  *
119  * The "inh_flags" field determines how this function behaves.
120  *
121  * Normally any values which are set in the default are not copied from the
122  * destination and verify flags are ORed together.
123  *
124  * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied
125  * to the destination. Effectively the values in "to" become default values
126  * which will be used only if nothing new is set in "from".
127  *
128  * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether
129  * they are set or not. Flags is still Ored though.
130  *
131  * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead
132  * of ORed.
133  *
134  * If X509_VP_FLAG_LOCKED is set then no values are copied.
135  *
136  * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed
137  * after the next call.
138  */
139 
140 /* Macro to test if a field should be copied from src to dest */
141 
142 #define test_x509_verify_param_copy(field, def) \
143     (to_overwrite || (src->field != def && (to_default || dest->field == def)))
144 
145 /* Macro to test and copy a field if necessary */
146 
147 #define x509_verify_param_copy(field, def) \
148     if (test_x509_verify_param_copy(field, def)) \
149         dest->field = src->field;
150 
X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM * dest,const X509_VERIFY_PARAM * src)151 int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
152                               const X509_VERIFY_PARAM *src)
153 {
154     unsigned long inh_flags;
155     int to_default, to_overwrite;
156 
157     if (src == NULL)
158         return 1;
159     inh_flags = dest->inh_flags | src->inh_flags;
160 
161     if ((inh_flags & X509_VP_FLAG_ONCE) != 0)
162         dest->inh_flags = 0;
163 
164     if ((inh_flags & X509_VP_FLAG_LOCKED) != 0)
165         return 1;
166 
167     to_default = (inh_flags & X509_VP_FLAG_DEFAULT) != 0;
168     to_overwrite = (inh_flags & X509_VP_FLAG_OVERWRITE) != 0;
169 
170     x509_verify_param_copy(purpose, 0);
171     x509_verify_param_copy(trust, X509_TRUST_DEFAULT);
172     x509_verify_param_copy(depth, -1);
173     x509_verify_param_copy(auth_level, -1);
174 
175     /* If overwrite or check time not set, copy across */
176 
177     if (to_overwrite || (dest->flags & X509_V_FLAG_USE_CHECK_TIME) == 0) {
178         dest->check_time = src->check_time;
179         dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME;
180         /* Don't need to copy flag: that is done below */
181     }
182 
183     if ((inh_flags & X509_VP_FLAG_RESET_FLAGS) != 0)
184         dest->flags = 0;
185 
186     dest->flags |= src->flags;
187 
188     if (test_x509_verify_param_copy(policies, NULL)) {
189         if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies))
190             return 0;
191     }
192 
193     x509_verify_param_copy(hostflags, 0);
194 
195     if (test_x509_verify_param_copy(hosts, NULL)) {
196         sk_OPENSSL_STRING_pop_free(dest->hosts, str_free);
197         dest->hosts = NULL;
198         if (src->hosts != NULL) {
199             dest->hosts =
200                 sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);
201             if (dest->hosts == NULL)
202                 return 0;
203         }
204     }
205 
206     if (test_x509_verify_param_copy(email, NULL)) {
207         if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))
208             return 0;
209     }
210 
211     if (test_x509_verify_param_copy(ip, NULL)) {
212         if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))
213             return 0;
214     }
215 
216     return 1;
217 }
218 
X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM * to,const X509_VERIFY_PARAM * from)219 int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
220                            const X509_VERIFY_PARAM *from)
221 {
222     unsigned long save_flags;
223     int ret;
224 
225     if (to == NULL) {
226         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
227         return 0;
228     }
229     save_flags = to->inh_flags;
230     to->inh_flags |= X509_VP_FLAG_DEFAULT;
231     ret = X509_VERIFY_PARAM_inherit(to, from);
232     to->inh_flags = save_flags;
233     return ret;
234 }
235 
int_x509_param_set1(char ** pdest,size_t * pdestlen,const char * src,size_t srclen)236 static int int_x509_param_set1(char **pdest, size_t *pdestlen,
237                                const char *src, size_t srclen)
238 {
239     char *tmp;
240 
241     if (src != NULL) {
242         if (srclen == 0)
243             srclen = strlen(src);
244 
245         tmp = OPENSSL_malloc(srclen + 1);
246         if (tmp == NULL)
247             return 0;
248         memcpy(tmp, src, srclen);
249         tmp[srclen] = '\0'; /* enforce NUL termination */
250     } else {
251         tmp = NULL;
252         srclen = 0;
253     }
254     OPENSSL_free(*pdest);
255     *pdest = tmp;
256     if (pdestlen != NULL)
257         *pdestlen = srclen;
258     return 1;
259 }
260 
X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM * param,const char * name)261 int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)
262 {
263     OPENSSL_free(param->name);
264     param->name = OPENSSL_strdup(name);
265     return param->name != NULL;
266 }
267 
X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM * param,unsigned long flags)268 int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
269 {
270     param->flags |= flags;
271     if ((flags & X509_V_FLAG_POLICY_MASK) != 0)
272         param->flags |= X509_V_FLAG_POLICY_CHECK;
273     return 1;
274 }
275 
X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM * param,unsigned long flags)276 int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
277                                   unsigned long flags)
278 {
279     param->flags &= ~flags;
280     return 1;
281 }
282 
X509_VERIFY_PARAM_get_flags(const X509_VERIFY_PARAM * param)283 unsigned long X509_VERIFY_PARAM_get_flags(const X509_VERIFY_PARAM *param)
284 {
285     return param->flags;
286 }
287 
X509_VERIFY_PARAM_get_inh_flags(const X509_VERIFY_PARAM * param)288 uint32_t X509_VERIFY_PARAM_get_inh_flags(const X509_VERIFY_PARAM *param)
289 {
290     return param->inh_flags;
291 }
292 
X509_VERIFY_PARAM_set_inh_flags(X509_VERIFY_PARAM * param,uint32_t flags)293 int X509_VERIFY_PARAM_set_inh_flags(X509_VERIFY_PARAM *param, uint32_t flags)
294 {
295     param->inh_flags = flags;
296     return 1;
297 }
298 
X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM * param,int purpose)299 int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
300 {
301     return X509_PURPOSE_set(&param->purpose, purpose);
302 }
303 
X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM * param,int trust)304 int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
305 {
306     return X509_TRUST_set(&param->trust, trust);
307 }
308 
X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM * param,int depth)309 void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth)
310 {
311     param->depth = depth;
312 }
313 
X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM * param,int auth_level)314 void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, int auth_level)
315 {
316     param->auth_level = auth_level;
317 }
318 
X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM * param)319 time_t X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM *param)
320 {
321     return param->check_time;
322 }
323 
X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM * param,time_t t)324 void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t)
325 {
326     param->check_time = t;
327     param->flags |= X509_V_FLAG_USE_CHECK_TIME;
328 }
329 
X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM * param,ASN1_OBJECT * policy)330 int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
331                                   ASN1_OBJECT *policy)
332 {
333     if (param->policies == NULL) {
334         param->policies = sk_ASN1_OBJECT_new_null();
335         if (param->policies == NULL)
336             return 0;
337     }
338 
339     if (sk_ASN1_OBJECT_push(param->policies, policy) <= 0)
340         return 0;
341     return 1;
342 }
343 
X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM * param,STACK_OF (ASN1_OBJECT)* policies)344 int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
345                                     STACK_OF(ASN1_OBJECT) *policies)
346 {
347     int i;
348     ASN1_OBJECT *oid, *doid;
349 
350     if (param == NULL) {
351         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
352         return 0;
353     }
354     sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
355 
356     if (policies == NULL) {
357         param->policies = NULL;
358         return 1;
359     }
360 
361     param->policies = sk_ASN1_OBJECT_new_null();
362     if (param->policies == NULL)
363         return 0;
364 
365     for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++) {
366         oid = sk_ASN1_OBJECT_value(policies, i);
367         doid = OBJ_dup(oid);
368         if (doid == NULL)
369             return 0;
370         if (!sk_ASN1_OBJECT_push(param->policies, doid)) {
371             ASN1_OBJECT_free(doid);
372             return 0;
373         }
374     }
375     param->flags |= X509_V_FLAG_POLICY_CHECK;
376     return 1;
377 }
378 
X509_VERIFY_PARAM_get0_host(X509_VERIFY_PARAM * param,int idx)379 char *X509_VERIFY_PARAM_get0_host(X509_VERIFY_PARAM *param, int idx)
380 {
381     return sk_OPENSSL_STRING_value(param->hosts, idx);
382 }
383 
X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM * param,const char * name,size_t namelen)384 int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
385                                 const char *name, size_t namelen)
386 {
387     return int_x509_param_set_hosts(param, SET_HOST, name, namelen);
388 }
389 
X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM * param,const char * name,size_t namelen)390 int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,
391                                 const char *name, size_t namelen)
392 {
393     return int_x509_param_set_hosts(param, ADD_HOST, name, namelen);
394 }
395 
X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM * param,unsigned int flags)396 void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
397                                      unsigned int flags)
398 {
399     param->hostflags = flags;
400 }
401 
X509_VERIFY_PARAM_get_hostflags(const X509_VERIFY_PARAM * param)402 unsigned int X509_VERIFY_PARAM_get_hostflags(const X509_VERIFY_PARAM *param)
403 {
404     return param->hostflags;
405 }
406 
X509_VERIFY_PARAM_get0_peername(const X509_VERIFY_PARAM * param)407 char *X509_VERIFY_PARAM_get0_peername(const X509_VERIFY_PARAM *param)
408 {
409     return param->peername;
410 }
411 
412 /*
413  * Move peername from one param structure to another, freeing any name present
414  * at the target.  If the source is a NULL parameter structure, free and zero
415  * the target peername.
416  */
X509_VERIFY_PARAM_move_peername(X509_VERIFY_PARAM * to,X509_VERIFY_PARAM * from)417 void X509_VERIFY_PARAM_move_peername(X509_VERIFY_PARAM *to,
418                                      X509_VERIFY_PARAM *from)
419 {
420     char *peername = (from != NULL) ? from->peername : NULL;
421 
422     if (to->peername != peername) {
423         OPENSSL_free(to->peername);
424         to->peername = peername;
425     }
426     if (from != NULL)
427         from->peername = NULL;
428 }
429 
X509_VERIFY_PARAM_get0_email(X509_VERIFY_PARAM * param)430 char *X509_VERIFY_PARAM_get0_email(X509_VERIFY_PARAM *param)
431 {
432     return param->email;
433 }
434 
X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM * param,const char * email,size_t emaillen)435 int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
436                                  const char *email, size_t emaillen)
437 {
438     return int_x509_param_set1(&param->email, &param->emaillen,
439                                email, emaillen);
440 }
441 
442 static unsigned char
int_X509_VERIFY_PARAM_get0_ip(X509_VERIFY_PARAM * param,size_t * plen)443 *int_X509_VERIFY_PARAM_get0_ip(X509_VERIFY_PARAM *param, size_t *plen)
444 {
445     if (param == NULL || param->ip == NULL) {
446         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
447         return NULL;
448     }
449     if (plen != NULL)
450         *plen = param->iplen;
451     return param->ip;
452 }
453 
X509_VERIFY_PARAM_get1_ip_asc(X509_VERIFY_PARAM * param)454 char *X509_VERIFY_PARAM_get1_ip_asc(X509_VERIFY_PARAM *param)
455 {
456     size_t iplen;
457     unsigned char *ip = int_X509_VERIFY_PARAM_get0_ip(param, &iplen);
458 
459     return ip == NULL ? NULL : ossl_ipaddr_to_asc(ip, iplen);
460 }
461 
X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM * param,const unsigned char * ip,size_t iplen)462 int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
463                               const unsigned char *ip, size_t iplen)
464 {
465     if (iplen != 0 && iplen != 4 && iplen != 16) {
466         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_INVALID_ARGUMENT);
467         return 0;
468     }
469     return int_x509_param_set1((char **)&param->ip, &param->iplen,
470                                (char *)ip, iplen);
471 }
472 
X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM * param,const char * ipasc)473 int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)
474 {
475     unsigned char ipout[16];
476     size_t iplen = (size_t)ossl_a2i_ipadd(ipout, ipasc);
477 
478     if (iplen == 0)
479         return 0;
480     return X509_VERIFY_PARAM_set1_ip(param, ipout, iplen);
481 }
482 
X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM * param)483 int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
484 {
485     return param->depth;
486 }
487 
X509_VERIFY_PARAM_get_auth_level(const X509_VERIFY_PARAM * param)488 int X509_VERIFY_PARAM_get_auth_level(const X509_VERIFY_PARAM *param)
489 {
490     return param->auth_level;
491 }
492 
X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM * param)493 const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param)
494 {
495     return param->name;
496 }
497 
498 #define vpm_empty_id NULL, 0U, NULL, NULL, 0, NULL, 0
499 
500 /*
501  * Default verify parameters: these are used for various applications and can
502  * be overridden by the user specified table. NB: the 'name' field *must* be
503  * in alphabetical order because it will be searched using OBJ_search.
504  */
505 
506 static const X509_VERIFY_PARAM default_table[] = {
507     {
508      "code_sign",               /* Code sign parameters */
509      0,                         /* check time to use */
510      0,                         /* inheritance flags */
511      0,                         /* flags */
512      X509_PURPOSE_CODE_SIGN,    /* purpose */
513      X509_TRUST_OBJECT_SIGN,    /* trust */
514      -1,                        /* depth */
515      -1,                        /* auth_level */
516      NULL,                      /* policies */
517      vpm_empty_id
518     },
519     {
520      "default",                 /* X509 default parameters */
521      0,                         /* check time to use */
522      0,                         /* inheritance flags */
523      X509_V_FLAG_TRUSTED_FIRST, /* flags */
524      0,                         /* purpose */
525      0,                         /* trust */
526      100,                       /* depth */
527      -1,                        /* auth_level */
528      NULL,                      /* policies */
529      vpm_empty_id
530     },
531     {
532      "pkcs7",                   /* S/MIME sign parameters */
533      0,                         /* check time to use */
534      0,                         /* inheritance flags */
535      0,                         /* flags */
536      X509_PURPOSE_SMIME_SIGN,   /* purpose */
537      X509_TRUST_EMAIL,          /* trust */
538      -1,                        /* depth */
539      -1,                        /* auth_level */
540      NULL,                      /* policies */
541      vpm_empty_id
542     },
543     {
544      "smime_sign",              /* S/MIME sign parameters */
545      0,                         /* check time to use */
546      0,                         /* inheritance flags */
547      0,                         /* flags */
548      X509_PURPOSE_SMIME_SIGN,   /* purpose */
549      X509_TRUST_EMAIL,          /* trust */
550      -1,                        /* depth */
551      -1,                        /* auth_level */
552      NULL,                      /* policies */
553      vpm_empty_id
554     },
555     {
556      "ssl_client",              /* SSL/TLS client parameters */
557      0,                         /* check time to use */
558      0,                         /* inheritance flags */
559      0,                         /* flags */
560      X509_PURPOSE_SSL_CLIENT,   /* purpose */
561      X509_TRUST_SSL_CLIENT,     /* trust */
562      -1,                        /* depth */
563      -1,                        /* auth_level */
564      NULL,                      /* policies */
565      vpm_empty_id
566     },
567     {
568      "ssl_server",              /* SSL/TLS server parameters */
569      0,                         /* check time to use */
570      0,                         /* inheritance flags */
571      0,                         /* flags */
572      X509_PURPOSE_SSL_SERVER,   /* purpose */
573      X509_TRUST_SSL_SERVER,     /* trust */
574      -1,                        /* depth */
575      -1,                        /* auth_level */
576      NULL,                      /* policies */
577      vpm_empty_id
578     }
579 };
580 
581 static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;
582 
table_cmp(const X509_VERIFY_PARAM * a,const X509_VERIFY_PARAM * b)583 static int table_cmp(const X509_VERIFY_PARAM *a, const X509_VERIFY_PARAM *b)
584 {
585     return strcmp(a->name, b->name);
586 }
587 
588 DECLARE_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
589 IMPLEMENT_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM, table);
590 
param_cmp(const X509_VERIFY_PARAM * const * a,const X509_VERIFY_PARAM * const * b)591 static int param_cmp(const X509_VERIFY_PARAM *const *a,
592                      const X509_VERIFY_PARAM *const *b)
593 {
594     return strcmp((*a)->name, (*b)->name);
595 }
596 
X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM * param)597 int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
598 {
599     int idx;
600     X509_VERIFY_PARAM *ptmp;
601 
602     if (param_table == NULL) {
603         param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
604         if (param_table == NULL)
605             return 0;
606     } else {
607         idx = sk_X509_VERIFY_PARAM_find(param_table, param);
608         if (idx >= 0) {
609             ptmp = sk_X509_VERIFY_PARAM_delete(param_table, idx);
610             X509_VERIFY_PARAM_free(ptmp);
611         }
612     }
613 
614     if (sk_X509_VERIFY_PARAM_push(param_table, param) <= 0)
615         return 0;
616     return 1;
617 }
618 
X509_VERIFY_PARAM_get_count(void)619 int X509_VERIFY_PARAM_get_count(void)
620 {
621     int num = OSSL_NELEM(default_table);
622 
623     if (param_table != NULL)
624         num += sk_X509_VERIFY_PARAM_num(param_table);
625     return num;
626 }
627 
X509_VERIFY_PARAM_get0(int id)628 const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id)
629 {
630     int num = OSSL_NELEM(default_table);
631 
632     if (id < num)
633         return default_table + id;
634     return sk_X509_VERIFY_PARAM_value(param_table, id - num);
635 }
636 
X509_VERIFY_PARAM_lookup(const char * name)637 const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name)
638 {
639     int idx;
640     X509_VERIFY_PARAM pm;
641 
642     pm.name = (char *)name;
643     if (param_table != NULL) {
644         /* Ideally, this would be done under a lock */
645         sk_X509_VERIFY_PARAM_sort(param_table);
646         idx = sk_X509_VERIFY_PARAM_find(param_table, &pm);
647         if (idx >= 0)
648             return sk_X509_VERIFY_PARAM_value(param_table, idx);
649     }
650     return OBJ_bsearch_table(&pm, default_table, OSSL_NELEM(default_table));
651 }
652 
X509_VERIFY_PARAM_table_cleanup(void)653 void X509_VERIFY_PARAM_table_cleanup(void)
654 {
655     sk_X509_VERIFY_PARAM_pop_free(param_table, X509_VERIFY_PARAM_free);
656     param_table = NULL;
657 }
658