Fold X509_VERIFY_PARAM_ID into X509_VERIFY_PARAM.
See also upstream's 9689a6aeed4ef7a2357cb95191b4313175440e4c.
X509_VERIFY_PARAM_ID made sense as a separate structure when
X509_VERIFY_PARAM was public, but now the struct is unexported.
Change-Id: I93bac64d33b76aa020fae07bba71b04f1505fdc4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/48128
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/x509/internal.h b/crypto/x509/internal.h
index d984805..32a6a9f 100644
--- a/crypto/x509/internal.h
+++ b/crypto/x509/internal.h
@@ -112,20 +112,6 @@
CRYPTO_refcount_t references;
} /* X509_REQ */;
-// TODO(davidben): This was historically a separate struct because
-// |X509_VERIFY_PARAM| used to be exported. Now that it is also opaque, embed it
-// directly.
-typedef struct {
- STACK_OF(OPENSSL_STRING) *hosts; /* Set of acceptable names */
- unsigned int hostflags; /* Flags to control matching features */
- char *peername; /* Matching hostname in peer certificate */
- char *email; /* If not NULL email address to match */
- size_t emaillen;
- unsigned char *ip; /* If not NULL IP address to match */
- size_t iplen; /* Length of IP address */
- unsigned char poison; /* Fail all verifications */
-} X509_VERIFY_PARAM_ID;
-
struct X509_VERIFY_PARAM_st {
char *name;
time_t check_time; // Time to use
@@ -135,7 +121,15 @@
int trust; // trust setting to check
int depth; // Verify depth
STACK_OF(ASN1_OBJECT) *policies; // Permissible policies
- X509_VERIFY_PARAM_ID *id; // opaque ID data
+ // The following fields specify acceptable peer identities.
+ STACK_OF(OPENSSL_STRING) *hosts; // Set of acceptable names
+ unsigned int hostflags; // Flags to control matching features
+ char *peername; // Matching hostname in peer certificate
+ char *email; // If not NULL email address to match
+ size_t emaillen;
+ unsigned char *ip; // If not NULL IP address to match
+ size_t iplen; // Length of IP address
+ unsigned char poison; // Fail all verifications at name checking
} /* X509_VERIFY_PARAM */;
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index f7785c6..2387de3 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -835,20 +835,20 @@
return ctx->verify_cb(0, ctx);
}
-static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id)
+static int check_hosts(X509 *x, X509_VERIFY_PARAM *param)
{
size_t i;
- size_t n = sk_OPENSSL_STRING_num(id->hosts);
+ size_t n = sk_OPENSSL_STRING_num(param->hosts);
char *name;
- if (id->peername != NULL) {
- OPENSSL_free(id->peername);
- id->peername = NULL;
+ if (param->peername != NULL) {
+ OPENSSL_free(param->peername);
+ param->peername = NULL;
}
for (i = 0; i < n; ++i) {
- name = sk_OPENSSL_STRING_value(id->hosts, i);
- if (X509_check_host(x, name, strlen(name), id->hostflags,
- &id->peername) > 0)
+ name = sk_OPENSSL_STRING_value(param->hosts, i);
+ if (X509_check_host(x, name, strlen(name), param->hostflags,
+ ¶m->peername) > 0)
return 1;
}
return n == 0;
@@ -857,21 +857,20 @@
static int check_id(X509_STORE_CTX *ctx)
{
X509_VERIFY_PARAM *vpm = ctx->param;
- X509_VERIFY_PARAM_ID *id = vpm->id;
X509 *x = ctx->cert;
- if (id->poison) {
+ if (vpm->poison) {
if (!check_id_error(ctx, X509_V_ERR_INVALID_CALL))
return 0;
}
- if (id->hosts && check_hosts(x, id) <= 0) {
+ if (vpm->hosts && check_hosts(x, vpm) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH))
return 0;
}
- if (id->email && X509_check_email(x, id->email, id->emaillen, 0) <= 0) {
+ if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH))
return 0;
}
- if (id->ip && X509_check_ip(x, id->ip, id->iplen, 0) <= 0) {
+ if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) {
if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH))
return 0;
}
diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index c3c2426..ae3a7e8 100644
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c
@@ -83,7 +83,7 @@
#define string_stack_free(sk) sk_OPENSSL_STRING_pop_free(sk, str_free)
-static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,
+static int int_x509_param_set_hosts(X509_VERIFY_PARAM *param, int mode,
const char *name, size_t namelen)
{
char *copy;
@@ -100,26 +100,26 @@
if (name && OPENSSL_memchr(name, '\0', namelen))
return 0;
- if (mode == SET_HOST && id->hosts) {
- string_stack_free(id->hosts);
- id->hosts = NULL;
+ if (mode == SET_HOST && param->hosts) {
+ string_stack_free(param->hosts);
+ param->hosts = NULL;
}
copy = OPENSSL_strndup(name, namelen);
if (copy == NULL)
return 0;
- if (id->hosts == NULL &&
- (id->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {
+ if (param->hosts == NULL &&
+ (param->hosts = sk_OPENSSL_STRING_new_null()) == NULL) {
OPENSSL_free(copy);
return 0;
}
- if (!sk_OPENSSL_STRING_push(id->hosts, copy)) {
+ if (!sk_OPENSSL_STRING_push(param->hosts, copy)) {
OPENSSL_free(copy);
- if (sk_OPENSSL_STRING_num(id->hosts) == 0) {
- sk_OPENSSL_STRING_free(id->hosts);
- id->hosts = NULL;
+ if (sk_OPENSSL_STRING_num(param->hosts) == 0) {
+ sk_OPENSSL_STRING_free(param->hosts);
+ param->hosts = NULL;
}
return 0;
}
@@ -129,7 +129,6 @@
static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
{
- X509_VERIFY_PARAM_ID *paramid;
if (!param)
return;
param->name = NULL;
@@ -145,43 +144,34 @@
sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
param->policies = NULL;
}
- paramid = param->id;
- if (paramid->hosts) {
- string_stack_free(paramid->hosts);
- paramid->hosts = NULL;
+ if (param->hosts) {
+ string_stack_free(param->hosts);
+ param->hosts = NULL;
}
- if (paramid->peername) {
- OPENSSL_free(paramid->peername);
- paramid->peername = NULL;
+ if (param->peername) {
+ OPENSSL_free(param->peername);
+ param->peername = NULL;
}
- if (paramid->email) {
- OPENSSL_free(paramid->email);
- paramid->email = NULL;
- paramid->emaillen = 0;
+ if (param->email) {
+ OPENSSL_free(param->email);
+ param->email = NULL;
+ param->emaillen = 0;
}
- if (paramid->ip) {
- OPENSSL_free(paramid->ip);
- paramid->ip = NULL;
- paramid->iplen = 0;
+ if (param->ip) {
+ OPENSSL_free(param->ip);
+ param->ip = NULL;
+ param->iplen = 0;
}
- paramid->poison = 0;
+ param->poison = 0;
}
X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
{
X509_VERIFY_PARAM *param;
- X509_VERIFY_PARAM_ID *paramid;
param = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
if (!param)
return NULL;
- paramid = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM_ID));
- if (!paramid) {
- OPENSSL_free(param);
- return NULL;
- }
OPENSSL_memset(param, 0, sizeof(X509_VERIFY_PARAM));
- OPENSSL_memset(paramid, 0, sizeof(X509_VERIFY_PARAM_ID));
- param->id = paramid;
x509_verify_param_zero(param);
return param;
}
@@ -191,7 +181,6 @@
if (param == NULL)
return;
x509_verify_param_zero(param);
- OPENSSL_free(param->id);
OPENSSL_free(param);
}
@@ -233,11 +222,6 @@
(to_overwrite || \
((src->field != (def)) && (to_default || (dest->field == (def)))))
-/* As above but for ID fields */
-
-#define test_x509_verify_param_copy_id(idf, def) \
- test_x509_verify_param_copy(id->idf, def)
-
/* Macro to test and copy a field if necessary */
#define x509_verify_param_copy(field, def) \
@@ -249,10 +233,8 @@
{
unsigned long inh_flags;
int to_default, to_overwrite;
- X509_VERIFY_PARAM_ID *id;
if (!src)
return 1;
- id = src->id;
inh_flags = dest->inh_flags | src->inh_flags;
if (inh_flags & X509_VP_FLAG_ONCE)
@@ -294,31 +276,31 @@
}
/* Copy the host flags if and only if we're copying the host list */
- if (test_x509_verify_param_copy_id(hosts, NULL)) {
- if (dest->id->hosts) {
- string_stack_free(dest->id->hosts);
- dest->id->hosts = NULL;
+ if (test_x509_verify_param_copy(hosts, NULL)) {
+ if (dest->hosts) {
+ string_stack_free(dest->hosts);
+ dest->hosts = NULL;
}
- if (id->hosts) {
- dest->id->hosts =
- sk_OPENSSL_STRING_deep_copy(id->hosts, str_copy, str_free);
- if (dest->id->hosts == NULL)
+ if (src->hosts) {
+ dest->hosts =
+ sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);
+ if (dest->hosts == NULL)
return 0;
- dest->id->hostflags = id->hostflags;
+ dest->hostflags = src->hostflags;
}
}
- if (test_x509_verify_param_copy_id(email, NULL)) {
- if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen))
+ if (test_x509_verify_param_copy(email, NULL)) {
+ if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen))
return 0;
}
- if (test_x509_verify_param_copy_id(ip, NULL)) {
- if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen))
+ if (test_x509_verify_param_copy(ip, NULL)) {
+ if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen))
return 0;
}
- dest->id->poison = src->id->poison;
+ dest->poison = src->poison;
return 1;
}
@@ -457,8 +439,8 @@
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
const char *name, size_t namelen)
{
- if (!int_x509_param_set_hosts(param->id, SET_HOST, name, namelen)) {
- param->id->poison = 1;
+ if (!int_x509_param_set_hosts(param, SET_HOST, name, namelen)) {
+ param->poison = 1;
return 0;
}
return 1;
@@ -467,8 +449,8 @@
int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,
const char *name, size_t namelen)
{
- if (!int_x509_param_set_hosts(param->id, ADD_HOST, name, namelen)) {
- param->id->poison = 1;
+ if (!int_x509_param_set_hosts(param, ADD_HOST, name, namelen)) {
+ param->poison = 1;
return 0;
}
return 1;
@@ -477,21 +459,21 @@
void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
unsigned int flags)
{
- param->id->hostflags = flags;
+ param->hostflags = flags;
}
char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param)
{
- return param->id->peername;
+ return param->peername;
}
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
const char *email, size_t emaillen)
{
if (OPENSSL_memchr(email, '\0', emaillen) != NULL ||
- !int_x509_param_set1(¶m->id->email, ¶m->id->emaillen,
+ !int_x509_param_set1(¶m->email, ¶m->emaillen,
email, emaillen)) {
- param->id->poison = 1;
+ param->poison = 1;
return 0;
}
@@ -502,9 +484,9 @@
const unsigned char *ip, size_t iplen)
{
if ((iplen != 4 && iplen != 16) ||
- !int_x509_param_set1((char **)¶m->id->ip, ¶m->id->iplen,
+ !int_x509_param_set1((char **)¶m->ip, ¶m->iplen,
(char *)ip, iplen)) {
- param->id->poison = 1;
+ param->poison = 1;
return 0;
}
@@ -532,10 +514,7 @@
return param->name;
}
-static const X509_VERIFY_PARAM_ID _empty_id =
- { NULL, 0U, NULL, NULL, 0, NULL, 0, 0 };
-
-#define vpm_empty_id ((X509_VERIFY_PARAM_ID *)&_empty_id)
+#define vpm_empty_id NULL, 0U, NULL, NULL, 0, NULL, 0, 0
/*
* Default verify parameters: these are used for various applications and can
