diff options
author | Shane Lontis <shane.lontis@oracle.com> | 2020-07-24 22:53:27 +1000 |
---|---|---|
committer | Shane Lontis <shane.lontis@oracle.com> | 2020-07-24 22:53:27 +1000 |
commit | 6725682d77510bf6d499957897d7be124d603f40 (patch) | |
tree | 447e5bce5607b4873f7f018df1b2e4c21a394e92 /apps/lib | |
parent | ae89578be2930c726d6ef56451233757a89f224f (diff) |
Add X509 related libctx changes.
- In order to not add many X509_XXXX_with_libctx() functions the libctx and propq may be stored in the X509 object via a call to X509_new_with_libctx().
- Loading via PEM_read_bio_X509() or d2i_X509() should pass in a created cert using X509_new_with_libctx().
- Renamed some XXXX_ex() to XXX_with_libctx() for X509 API's.
- Removed the extra parameters in check_purpose..
- X509_digest() has been modified so that it expects a const EVP_MD object() and then internally it does the fetch when it needs to (via ASN1_item_digest_with_libctx()).
- Added API's that set the libctx when they load such as X509_STORE_new_with_libctx() so that the cert chains can be verified.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12153)
Diffstat (limited to 'apps/lib')
-rw-r--r-- | apps/lib/apps.c | 33 |
1 files changed, 25 insertions, 8 deletions
diff --git a/apps/lib/apps.c b/apps/lib/apps.c index ba40e9bc7e..cf99ca0ebf 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -342,6 +342,12 @@ OPENSSL_CTX *app_get0_libctx(void) return app_libctx; } +/* TODO(3.0): Make this an environment variable if required */ +const char *app_get0_propq(void) +{ + return NULL; +} + OPENSSL_CTX *app_create_libctx(void) { /* @@ -657,9 +663,11 @@ static int load_certs_crls(const char *file, int format, if (bio == NULL) return 0; - xis = PEM_X509_INFO_read_bio(bio, NULL, - (pem_password_cb *)password_callback, - &cb_data); + xis = PEM_X509_INFO_read_bio_with_libctx(bio, NULL, + (pem_password_cb *)password_callback, + &cb_data, + app_get0_libctx(), + app_get0_propq()); BIO_free(bio); @@ -765,6 +773,8 @@ int load_key_cert_crl(const char *uri, int maybe_stdin, { PW_CB_DATA uidata; OSSL_STORE_CTX *ctx = NULL; + OPENSSL_CTX *libctx = app_get0_libctx(); + const char *propq = app_get0_propq(); int ret = 0; /* TODO make use of the engine reference 'eng' when loading pkeys */ @@ -791,11 +801,12 @@ int load_key_cert_crl(const char *uri, int maybe_stdin, unbuffer(stdin); bio = BIO_new_fp(stdin, 0); if (bio != NULL) - ctx = OSSL_STORE_attach(bio, NULL, "file", NULL, + ctx = OSSL_STORE_attach(bio, "file", libctx, propq, get_ui_method(), &uidata, NULL, NULL); uri = "<stdin>"; } else { - ctx = OSSL_STORE_open(uri, get_ui_method(), &uidata, NULL, NULL); + ctx = OSSL_STORE_open_with_libctx(uri, libctx, propq, get_ui_method(), + &uidata, NULL, NULL); } if (ctx == NULL) { BIO_printf(bio_err, "Could not open file or uri %s for loading %s\n", @@ -1099,6 +1110,8 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile, { X509_STORE *store = X509_STORE_new(); X509_LOOKUP *lookup; + OPENSSL_CTX *libctx = app_get0_libctx(); + const char *propq = app_get0_propq(); if (store == NULL) goto end; @@ -1108,12 +1121,16 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile, if (lookup == NULL) goto end; if (CAfile != NULL) { - if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) { + if (!X509_LOOKUP_load_file_with_libctx(lookup, CAfile, + X509_FILETYPE_PEM, + libctx, propq)) { BIO_printf(bio_err, "Error loading file %s\n", CAfile); goto end; } } else { - X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT); + X509_LOOKUP_load_file_with_libctx(lookup, NULL, + X509_FILETYPE_DEFAULT, + libctx, propq); } } @@ -1135,7 +1152,7 @@ X509_STORE *setup_verify(const char *CAfile, int noCAfile, lookup = X509_STORE_add_lookup(store, X509_LOOKUP_store()); if (lookup == NULL) goto end; - if (!X509_LOOKUP_add_store(lookup, CAstore)) { + if (!X509_LOOKUP_add_store_with_libctx(lookup, CAstore, libctx, propq)) { if (CAstore != NULL) BIO_printf(bio_err, "Error loading store URI %s\n", CAstore); goto end; |