mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-04-06 20:20:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

Introduce an internal version of X509_check_issued()

Browse Source 
The internal version is library context aware.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11507)
This commit is contained in:
Matt Caswell 2020-04-06 12:14:30 +01:00
parent 0820217441
commit 465f34ed27
3 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
crypto/x509/v3_purp.c
View File

@ -811,14 +811,15 @@ static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca)
* codes for X509_verify_cert()
*/
int X509_check_issued(X509 *issuer, X509 *subject)
int x509_check_issued_int(X509 *issuer, X509 *subject, OPENSSL_CTX *libctx,
const char *propq)
{
if (X509_NAME_cmp(X509_get_subject_name(issuer),
X509_get_issuer_name(subject)))
return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
if (!X509v3_cache_extensions(issuer, NULL, NULL)
|| !X509v3_cache_extensions(subject, NULL, NULL))
if (!X509v3_cache_extensions(issuer, libctx, propq)
|| !X509v3_cache_extensions(subject, libctx, propq))
return X509_V_ERR_UNSPECIFIED;
if (subject->akid) {
@ -853,6 +854,11 @@ int X509_check_issued(X509 *issuer, X509 *subject)
return X509_V_OK;
}
int X509_check_issued(X509 *issuer, X509 *subject)
{
return x509_check_issued_int(issuer, subject, NULL, NULL);
}
int X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid)
{

2
crypto/x509/x509_vfy.c
View File

@ -334,7 +334,7 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
return ss;
}
ret = X509_check_issued(issuer, x);
ret = x509_check_issued_int(issuer, x, ctx->libctx, ctx->propq);
if (ret == X509_V_OK) {
int i;
X509 *ch;

4
include/crypto/x509.h
View File

@ -297,3 +297,7 @@ int x509_set1_time(ASN1_TIME **ptm, const ASN1_TIME *tm);
int x509_print_ex_brief(BIO *bio, X509 *cert, unsigned long neg_cflags);
void x509_init_sig_info(X509 *x);
int x509_check_issued_int(X509 *issuer, X509 *subject, OPENSSL_CTX *libctx,
const char *propq);