|
|
|
@ -125,7 +125,7 @@ static int verify_chain(SSL *ssl, STACK_OF(X509) *chain)
|
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
|
|
if (!X509_STORE_CTX_init(store_ctx, store, cert, chain))
|
|
|
|
|
return 0;
|
|
|
|
|
return 0;
|
|
|
|
|
X509_STORE_CTX_set_ex_data(store_ctx, store_ctx_idx, ssl);
|
|
|
|
|
|
|
|
|
|
X509_STORE_CTX_set_default(store_ctx,
|
|
|
|
@ -135,7 +135,7 @@ static int verify_chain(SSL *ssl, STACK_OF(X509) *chain)
|
|
|
|
|
store_ctx_dane_init(store_ctx, ssl);
|
|
|
|
|
|
|
|
|
|
if (SSL_get_verify_callback(ssl))
|
|
|
|
|
X509_STORE_CTX_set_verify_cb(store_ctx, SSL_get_verify_callback(ssl));
|
|
|
|
|
X509_STORE_CTX_set_verify_cb(store_ctx, SSL_get_verify_callback(ssl));
|
|
|
|
|
|
|
|
|
|
ret = X509_verify_cert(store_ctx);
|
|
|
|
|
|
|
|
|
@ -153,49 +153,49 @@ static STACK_OF(X509) *load_chain(BIO *fp, int nelem)
|
|
|
|
|
char *header = 0;
|
|
|
|
|
unsigned char *data = 0;
|
|
|
|
|
long len;
|
|
|
|
|
char *errtype = 0; /* if error: cert or pkey? */
|
|
|
|
|
char *errtype = 0; /* if error: cert or pkey? */
|
|
|
|
|
STACK_OF(X509) *chain;
|
|
|
|
|
typedef X509 *(*d2i_X509_t)(X509 **, const unsigned char **, long);
|
|
|
|
|
|
|
|
|
|
if ((chain = sk_X509_new_null()) == 0) {
|
|
|
|
|
perror("malloc");
|
|
|
|
|
exit(1);
|
|
|
|
|
perror("malloc");
|
|
|
|
|
exit(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
for (count = 0;
|
|
|
|
|
count < nelem && errtype == 0
|
|
|
|
|
count < nelem && errtype == 0
|
|
|
|
|
&& PEM_read_bio(fp, &name, &header, &data, &len);
|
|
|
|
|
++count) {
|
|
|
|
|
const unsigned char *p = data;
|
|
|
|
|
|
|
|
|
|
if (strcmp(name, PEM_STRING_X509) == 0
|
|
|
|
|
|| strcmp(name, PEM_STRING_X509_TRUSTED) == 0
|
|
|
|
|
|| strcmp(name, PEM_STRING_X509_OLD) == 0) {
|
|
|
|
|
d2i_X509_t d = strcmp(name, PEM_STRING_X509_TRUSTED) ?
|
|
|
|
|
d2i_X509_AUX : d2i_X509;
|
|
|
|
|
X509 *cert = d(0, &p, len);
|
|
|
|
|
|
|
|
|
|
if (cert == 0 || (p - data) != len)
|
|
|
|
|
errtype = "certificate";
|
|
|
|
|
else if (sk_X509_push(chain, cert) == 0) {
|
|
|
|
|
perror("malloc");
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
fprintf(stderr, "unexpected chain file object: %s\n", name);
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* If any of these were null, PEM_read() would have failed.
|
|
|
|
|
*/
|
|
|
|
|
OPENSSL_free(name);
|
|
|
|
|
OPENSSL_free(header);
|
|
|
|
|
OPENSSL_free(data);
|
|
|
|
|
++count) {
|
|
|
|
|
const unsigned char *p = data;
|
|
|
|
|
|
|
|
|
|
if (strcmp(name, PEM_STRING_X509) == 0
|
|
|
|
|
|| strcmp(name, PEM_STRING_X509_TRUSTED) == 0
|
|
|
|
|
|| strcmp(name, PEM_STRING_X509_OLD) == 0) {
|
|
|
|
|
d2i_X509_t d = strcmp(name, PEM_STRING_X509_TRUSTED) ?
|
|
|
|
|
d2i_X509_AUX : d2i_X509;
|
|
|
|
|
X509 *cert = d(0, &p, len);
|
|
|
|
|
|
|
|
|
|
if (cert == 0 || (p - data) != len)
|
|
|
|
|
errtype = "certificate";
|
|
|
|
|
else if (sk_X509_push(chain, cert) == 0) {
|
|
|
|
|
perror("malloc");
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
fprintf(stderr, "unexpected chain file object: %s\n", name);
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* If any of these were null, PEM_read() would have failed.
|
|
|
|
|
*/
|
|
|
|
|
OPENSSL_free(name);
|
|
|
|
|
OPENSSL_free(header);
|
|
|
|
|
OPENSSL_free(data);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (errtype) {
|
|
|
|
|
fprintf(stderr, "error reading: malformed %s\n", errtype);
|
|
|
|
|
fprintf(stderr, "error reading: malformed %s\n", errtype);
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|