crypto/x509v3/pcy_tree.c

67  * Enable this to print out the complete policy tree at various point during
98 static void tree_print(char *str, X509_POLICY_TREE *tree,
107         curr = tree->levels + tree->nlevel;
111     BIO_printf(err, "Printing Up to Level %ld\n", curr - tree->levels);
112     for (plev = tree->levels; plev != curr; plev++) {
114                    plev - tree->levels, plev->flags);
135  * Initialize policy tree. Return values:
139  *  2 Policy tree is empty.
147     X509_POLICY_TREE *tree;
221     /* If we get this far initialize the tree */
223     tree = OPENSSL_malloc(sizeof(X509_POLICY_TREE));
225     if (!tree)
228     tree->flags = 0;
229     tree->levels = OPENSSL_malloc(sizeof(X509_POLICY_LEVEL) * n);
230     tree->nlevel = 0;
231     tree->extra_data = NULL;
232     tree->auth_policies = NULL;
233     tree->user_policies = NULL;
235     if (!tree->levels) {
236         OPENSSL_free(tree);
240     memset(tree->levels, 0, n * sizeof(X509_POLICY_LEVEL));
242     tree->nlevel = n;
244     level = tree->levels;
250     if (!data || !level_add_node(level, data, NULL, tree))
291     *ptree = tree;
300     X509_policy_tree_free(tree);
369                               X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
385     if (!level_add_node(curr, data, node, tree)) {
395                                X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
405         if (!tree_add_unmatched(curr, cache, NULL, node, tree))
418             if (!tree_add_unmatched(curr, cache, oid, node, tree))
430                          X509_POLICY_TREE *tree)
442         if (!tree_link_unmatched(curr, cache, node, tree))
467         if (!level_add_node(curr, data, node, tree)) {
483  * Prune the tree: delete any child mapped child data on the current level
484  * then proceed up the tree deleting any data with no children. If we ever
485  * have no data on a level we can halt because the tree will be empty.
488 static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr)
523         if (curr == tree->levels) {
524             /* If we zapped anyPolicy at top then tree is empty */
553  * Calculate the authority set based on policy tree. The 'pnodes' parameter
561 static int tree_calculate_authority_set(X509_POLICY_TREE *tree,
568     curr = tree->levels + tree->nlevel - 1;
572         if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy))
577         addnodes = &tree->auth_policies;
579     curr = tree->levels;
580     for (i = 1; i < tree->nlevel; i++) {
599     *pnodes = tree->auth_policies;
604 static int tree_calculate_user_set(X509_POLICY_TREE *tree,
623     anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy;
628             tree->flags |= POLICY_FLAG_ANY_POLICY;
649             node = level_add_node(NULL, extra, anyPolicy->parent, tree);
651         if (!tree->user_policies) {
652             tree->user_policies = sk_X509_POLICY_NODE_new_null();
653             if (!tree->user_policies)
656         if (!sk_X509_POLICY_NODE_push(tree->user_policies, node))
663 static int tree_evaluate(X509_POLICY_TREE *tree)
666     X509_POLICY_LEVEL *curr = tree->levels + 1;
669     for (i = 1; i < tree->nlevel; i++, curr++) {
675             && !tree_link_any(curr, cache, tree))
677         tree_print("before tree_prune()", tree, curr);
678         ret = tree_prune(tree, curr);
693 void X509_policy_tree_free(X509_POLICY_TREE *tree)
698     if (!tree)
701     sk_X509_POLICY_NODE_free(tree->auth_policies);
702     sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free);
704     for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) {
713     if (tree->extra_data)
714         sk_X509_POLICY_DATA_pop_free(tree->extra_data, policy_data_free);
716     OPENSSL_free(tree->levels);
717     OPENSSL_free(tree);
735     X509_POLICY_TREE *tree = NULL;
740     ret = tree_init(&tree, certs, flags);
770         if (!tree)
772              * tree_init() returns success and a null tree
783     if (!tree)
785     ret = tree_evaluate(tree);
787     tree_print("tree_evaluate()", tree, NULL);
792     /* Return value 2 means tree empty */
794         X509_policy_tree_free(tree);
803     ret = tree_calculate_authority_set(tree, &auth_nodes);
808     if (!tree_calculate_user_set(tree, policy_oids, auth_nodes))
814     if (tree)
815         *ptree = tree;
818         nodes = X509_policy_tree_get0_user_policies(tree);
827     X509_policy_tree_free(tree);