If not checking all certificates don't attempt to find a CRL

[oweals/openssl.git] / crypto / x509 / x509_lu.c

diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index fad7ea06899095a9d47ce7f9c1879a7f0e21b3a5..fb7d23bbd0ade78ed981a8fd0564da9bad62422d 100644 (file)
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -196,6 +196,8 @@ X509_STORE *X509_STORE_new(void)
        ret->get_crl = 0;
        ret->check_crl = 0;
        ret->cert_crl = 0;
+       ret->lookup_certs = 0;
+       ret->lookup_crls = 0;
        ret->cleanup = 0;
 
        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data);
@@ -288,7 +290,7 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
 
        tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name);
 
-       if (tmp == NULL)
+       if (tmp == NULL || type == X509_LU_CRL)
                {
                for (i=vs->current_method; i<sk_X509_LOOKUP_num(ctx->get_cert_methods); i++)
                        {
@@ -530,33 +532,30 @@ STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
        int i, idx, cnt;
        STACK_OF(X509_CRL) *sk;
        X509_CRL *x;
-       X509_OBJECT *obj;
+       X509_OBJECT *obj, xobj;
        sk = sk_X509_CRL_new_null();
        CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
        /* Check cache first */
        idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
+
+       /* Always do lookup to possibly add new CRLs to cache
+        */
+       CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
+       if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj))
+               {
+               sk_X509_CRL_free(sk);
+               return NULL;
+               }
+       X509_OBJECT_free_contents(&xobj);
+       CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
+       idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt);
        if (idx < 0)
                {
-               /* Nothing found in cache: do lookup to possibly add new
-                * objects to cache
-                */
-               X509_OBJECT xobj;
                CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
-               if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj))
-                       {
-                       sk_X509_CRL_free(sk);
-                       return NULL;
-                       }
-               X509_OBJECT_free_contents(&xobj);
-               CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
-               idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt);
-               if (idx < 0)
-                       {
-                       CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
-                       sk_X509_CRL_free(sk);
-                       return NULL;
-                       }
+               sk_X509_CRL_free(sk);
+               return NULL;
                }
+
        for (i = 0; i < cnt; i++, idx++)
                {
                obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
@@ -696,5 +695,11 @@ int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
        return X509_VERIFY_PARAM_set1(ctx->param, param);
        }
 
+void X509_STORE_set_verify_cb(X509_STORE *ctx,
+                                 int (*verify_cb)(int, X509_STORE_CTX *))
+       {
+       ctx->verify_cb = verify_cb;
+       }
+
 IMPLEMENT_STACK_OF(X509_LOOKUP)
 IMPLEMENT_STACK_OF(X509_OBJECT)