-/* crypto/x509/x509_vfy.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
static int verify_chain(X509_STORE_CTX *ctx)
{
- int (*cb) (int xok, X509_STORE_CTX *xctx) = ctx->verify_cb;
int err;
int ok;
if (err != X509_V_OK) {
ctx->error = err;
ctx->current_cert = sk_X509_value(ctx->chain, ctx->error_depth);
- if ((ok = cb(0, ctx)) == 0)
+ if ((ok = ctx->verify_cb(0, ctx)) == 0)
return ok;
}
{
int i, ok = 0, must_be_ca, plen = 0;
X509 *x;
- int (*cb) (int xok, X509_STORE_CTX *xctx);
int proxy_path_length = 0;
int purpose;
int allow_proxy_certs;
- cb = ctx->verify_cb;
/*-
* must_be_ca can have 1 of 3 values:
ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
if (ret == 0) {
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
ctx->error = X509_V_ERR_INVALID_PURPOSE;
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
ctx->error_depth = i;
ctx->current_cert = x;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
int i, ok = 0;
X509 *x = NULL;
X509 *mx;
- int (*cb) (int xok, X509_STORE_CTX *xctx) = ctx->verify_cb;
struct dane_st *dane = (struct dane_st *)ctx->dane;
int num = sk_X509_num(ctx->chain);
int trust;
ctx->error_depth = i;
ctx->current_cert = x;
ctx->error = X509_V_ERR_CERT_REJECTED;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
return X509_TRUST_REJECTED;
return X509_TRUST_UNTRUSTED;
int ok = 0, n;
X509 *xs, *xi;
EVP_PKEY *pkey = NULL;
- int (*cb) (int xok, X509_STORE_CTX *xctx);
-
- cb = ctx->verify_cb;
n = sk_X509_num(ctx->chain) - 1;
ctx->error_depth = n;
if (n <= 0) {
ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
ctx->current_cert = xi;
- ok = cb(0, ctx);
+ ok = ctx->verify_cb(0, ctx);
goto end;
} else {
n--;
* explicitly asked for. It doesn't add any security and just wastes
* time.
*/
- if (!xs->valid
- && (xs != xi
- || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE))) {
+ if (xs != xi || (ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)) {
if ((pkey = X509_get0_pubkey(xi)) == NULL) {
ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
ctx->current_cert = xi;
- ok = (*cb) (0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
} else if (X509_verify(xs, pkey) <= 0) {
ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE;
ctx->current_cert = xs;
- ok = (*cb) (0, ctx);
+ ok = ctx->verify_cb(0, ctx);
if (!ok)
goto end;
}
}
- xs->valid = 1;
-
check_cert:
ok = x509_check_cert_time(ctx, xs, 0);
if (!ok)
/* The last error (if any) is still in the error value */
ctx->current_issuer = xi;
ctx->current_cert = xs;
- ok = (*cb) (1, ctx);
+ ok = ctx->verify_cb(1, ctx);
if (!ok)
goto end;
dane->pdpth = -1;
}
+static int check_leaf_suiteb(X509_STORE_CTX *ctx, X509 *cert)
+{
+ int err = X509_chain_check_suiteb(NULL, cert, NULL, ctx->param->flags);
+
+ if (err == X509_V_OK)
+ return 1;
+ ctx->current_cert = cert;
+ ctx->error_depth = 0;
+ ctx->error = err;
+ return ctx->verify_cb(0, ctx);
+}
+
static int dane_verify(X509_STORE_CTX *ctx)
{
X509 *cert = ctx->cert;
- int (*cb)(int xok, X509_STORE_CTX *xctx) = ctx->verify_cb;
struct dane_st *dane = (struct dane_st *)ctx->dane;
int matched;
int done;
X509_get_pubkey_parameters(NULL, ctx->chain);
if (matched > 0) {
+ if (!check_leaf_suiteb(ctx, cert))
+ return 0;
ctx->error_depth = 0;
ctx->current_cert = cert;
- return cb(1, ctx);
+ return ctx->verify_cb(1, ctx);
}
if (matched < 0) {
if (done) {
/* Fail early, TA-based success is not possible */
+ if (!check_leaf_suiteb(ctx, cert))
+ return 0;
ctx->current_cert = cert;
ctx->error_depth = 0;
ctx->error = X509_V_ERR_CERT_UNTRUSTED;
- return cb(0, ctx);
+ return ctx->verify_cb(0, ctx);
}
/*
static int build_chain(X509_STORE_CTX *ctx)
{
struct dane_st *dane = (struct dane_st *)ctx->dane;
- int (*cb) (int, X509_STORE_CTX *) = ctx->verify_cb;
int num = sk_X509_num(ctx->chain);
X509 *cert = sk_X509_value(ctx->chain, num - 1);
int ss = cert_self_signed(cert);
ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
if (DANETLS_ENABLED(dane))
dane_reset(dane);
- return cb(0, ctx);
+ return ctx->verify_cb(0, ctx);
}
}