x509_lu.c revision 337982 
1/* crypto/x509/x509_lu.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to.  The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 *    notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 *    notice, this list of conditions and the following disclaimer in the
30 *    documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 *    must display the following acknowledgement:
33 *    "This product includes cryptographic software written by
34 *     Eric Young (eay@cryptsoft.com)"
35 *    The word 'cryptographic' can be left out if the rouines from the library
36 *    being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 *    the apps directory (application code) you must include an acknowledgement:
39 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed.  i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include "cryptlib.h"
61#include <openssl/lhash.h>
62#include <openssl/x509.h>
63#include <openssl/x509v3.h>
64
65X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
66{
67    X509_LOOKUP *ret;
68
69    ret = (X509_LOOKUP *)OPENSSL_malloc(sizeof(X509_LOOKUP));
70    if (ret == NULL)
71        return NULL;
72
73    ret->init = 0;
74    ret->skip = 0;
75    ret->method = method;
76    ret->method_data = NULL;
77    ret->store_ctx = NULL;
78    if ((method->new_item != NULL) && !method->new_item(ret)) {
79        OPENSSL_free(ret);
80        return NULL;
81    }
82    return ret;
83}
84
85void X509_LOOKUP_free(X509_LOOKUP *ctx)
86{
87    if (ctx == NULL)
88        return;
89    if ((ctx->method != NULL) && (ctx->method->free != NULL))
90        (*ctx->method->free) (ctx);
91    OPENSSL_free(ctx);
92}
93
94int X509_LOOKUP_init(X509_LOOKUP *ctx)
95{
96    if (ctx->method == NULL)
97        return 0;
98    if (ctx->method->init != NULL)
99        return ctx->method->init(ctx);
100    else
101        return 1;
102}
103
104int X509_LOOKUP_shutdown(X509_LOOKUP *ctx)
105{
106    if (ctx->method == NULL)
107        return 0;
108    if (ctx->method->shutdown != NULL)
109        return ctx->method->shutdown(ctx);
110    else
111        return 1;
112}
113
114int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
115                     char **ret)
116{
117    if (ctx->method == NULL)
118        return -1;
119    if (ctx->method->ctrl != NULL)
120        return ctx->method->ctrl(ctx, cmd, argc, argl, ret);
121    else
122        return 1;
123}
124
125int X509_LOOKUP_by_subject(X509_LOOKUP *ctx, int type, X509_NAME *name,
126                           X509_OBJECT *ret)
127{
128    if ((ctx->method == NULL) || (ctx->method->get_by_subject == NULL))
129        return X509_LU_FAIL;
130    if (ctx->skip)
131        return 0;
132    return ctx->method->get_by_subject(ctx, type, name, ret);
133}
134
135int X509_LOOKUP_by_issuer_serial(X509_LOOKUP *ctx, int type, X509_NAME *name,
136                                 ASN1_INTEGER *serial, X509_OBJECT *ret)
137{
138    if ((ctx->method == NULL) || (ctx->method->get_by_issuer_serial == NULL))
139        return X509_LU_FAIL;
140    return ctx->method->get_by_issuer_serial(ctx, type, name, serial, ret);
141}
142
143int X509_LOOKUP_by_fingerprint(X509_LOOKUP *ctx, int type,
144                               unsigned char *bytes, int len,
145                               X509_OBJECT *ret)
146{
147    if ((ctx->method == NULL) || (ctx->method->get_by_fingerprint == NULL))
148        return X509_LU_FAIL;
149    return ctx->method->get_by_fingerprint(ctx, type, bytes, len, ret);
150}
151
152int X509_LOOKUP_by_alias(X509_LOOKUP *ctx, int type, char *str, int len,
153                         X509_OBJECT *ret)
154{
155    if ((ctx->method == NULL) || (ctx->method->get_by_alias == NULL))
156        return X509_LU_FAIL;
157    return ctx->method->get_by_alias(ctx, type, str, len, ret);
158}
159
160static int x509_object_cmp(const X509_OBJECT *const *a,
161                           const X509_OBJECT *const *b)
162{
163    int ret;
164
165    ret = ((*a)->type - (*b)->type);
166    if (ret)
167        return ret;
168    switch ((*a)->type) {
169    case X509_LU_X509:
170        ret = X509_subject_name_cmp((*a)->data.x509, (*b)->data.x509);
171        break;
172    case X509_LU_CRL:
173        ret = X509_CRL_cmp((*a)->data.crl, (*b)->data.crl);
174        break;
175    default:
176        /* abort(); */
177        return 0;
178    }
179    return ret;
180}
181
182X509_STORE *X509_STORE_new(void)
183{
184    X509_STORE *ret;
185
186    if ((ret = (X509_STORE *)OPENSSL_malloc(sizeof(X509_STORE))) == NULL)
187        return NULL;
188    if ((ret->objs = sk_X509_OBJECT_new(x509_object_cmp)) == NULL)
189        goto err0;
190    ret->cache = 1;
191    if ((ret->get_cert_methods = sk_X509_LOOKUP_new_null()) == NULL)
192        goto err1;
193    ret->verify = 0;
194    ret->verify_cb = 0;
195
196    if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
197        goto err2;
198
199    ret->get_issuer = 0;
200    ret->check_issued = 0;
201    ret->check_revocation = 0;
202    ret->get_crl = 0;
203    ret->check_crl = 0;
204    ret->cert_crl = 0;
205    ret->lookup_certs = 0;
206    ret->lookup_crls = 0;
207    ret->cleanup = 0;
208
209    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data))
210       goto err3;
211
212    ret->references = 1;
213    return ret;
214
215 err3:
216    X509_VERIFY_PARAM_free(ret->param);
217 err2:
218    sk_X509_LOOKUP_free(ret->get_cert_methods);
219 err1:
220    sk_X509_OBJECT_free(ret->objs);
221 err0:
222    OPENSSL_free(ret);
223    return NULL;
224}
225
226static void cleanup(X509_OBJECT *a)
227{
228    if (!a)
229        return;
230    if (a->type == X509_LU_X509) {
231        X509_free(a->data.x509);
232    } else if (a->type == X509_LU_CRL) {
233        X509_CRL_free(a->data.crl);
234    } else {
235        /* abort(); */
236    }
237
238    OPENSSL_free(a);
239}
240
241void X509_STORE_free(X509_STORE *vfy)
242{
243    int i;
244    STACK_OF(X509_LOOKUP) *sk;
245    X509_LOOKUP *lu;
246
247    if (vfy == NULL)
248        return;
249
250    i = CRYPTO_add(&vfy->references, -1, CRYPTO_LOCK_X509_STORE);
251#ifdef REF_PRINT
252    REF_PRINT("X509_STORE", vfy);
253#endif
254    if (i > 0)
255        return;
256#ifdef REF_CHECK
257    if (i < 0) {
258        fprintf(stderr, "X509_STORE_free, bad reference count\n");
259        abort();                /* ok */
260    }
261#endif
262
263    sk = vfy->get_cert_methods;
264    for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
265        lu = sk_X509_LOOKUP_value(sk, i);
266        X509_LOOKUP_shutdown(lu);
267        X509_LOOKUP_free(lu);
268    }
269    sk_X509_LOOKUP_free(sk);
270    sk_X509_OBJECT_pop_free(vfy->objs, cleanup);
271
272    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
273    if (vfy->param)
274        X509_VERIFY_PARAM_free(vfy->param);
275    OPENSSL_free(vfy);
276}
277
278X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, X509_LOOKUP_METHOD *m)
279{
280    int i;
281    STACK_OF(X509_LOOKUP) *sk;
282    X509_LOOKUP *lu;
283
284    sk = v->get_cert_methods;
285    for (i = 0; i < sk_X509_LOOKUP_num(sk); i++) {
286        lu = sk_X509_LOOKUP_value(sk, i);
287        if (m == lu->method) {
288            return lu;
289        }
290    }
291    /* a new one */
292    lu = X509_LOOKUP_new(m);
293    if (lu == NULL)
294        return NULL;
295    else {
296        lu->store_ctx = v;
297        if (sk_X509_LOOKUP_push(v->get_cert_methods, lu))
298            return lu;
299        else {
300            X509_LOOKUP_free(lu);
301            return NULL;
302        }
303    }
304}
305
306int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
307                              X509_OBJECT *ret)
308{
309    X509_STORE *ctx = vs->ctx;
310    X509_LOOKUP *lu;
311    X509_OBJECT stmp, *tmp;
312    int i, j;
313
314    if (ctx == NULL)
315        return 0;
316
317    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
318
319    tmp = X509_OBJECT_retrieve_by_subject(ctx->objs, type, name);
320    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
321
322    if (tmp == NULL || type == X509_LU_CRL) {
323        for (i = vs->current_method;
324             i < sk_X509_LOOKUP_num(ctx->get_cert_methods); i++) {
325            lu = sk_X509_LOOKUP_value(ctx->get_cert_methods, i);
326            j = X509_LOOKUP_by_subject(lu, type, name, &stmp);
327            if (j < 0) {
328                vs->current_method = j;
329                return j;
330            } else if (j) {
331                tmp = &stmp;
332                break;
333            }
334        }
335        vs->current_method = 0;
336        if (tmp == NULL)
337            return 0;
338    }
339
340/*- if (ret->data.ptr != NULL)
341            X509_OBJECT_free_contents(ret); */
342
343    ret->type = tmp->type;
344    ret->data.ptr = tmp->data.ptr;
345
346    X509_OBJECT_up_ref_count(ret);
347
348    return 1;
349}
350
351int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
352{
353    X509_OBJECT *obj;
354    int ret = 1;
355
356    if (x == NULL)
357        return 0;
358    obj = (X509_OBJECT *)OPENSSL_malloc(sizeof(X509_OBJECT));
359    if (obj == NULL) {
360        X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
361        return 0;
362    }
363    obj->type = X509_LU_X509;
364    obj->data.x509 = x;
365
366    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
367
368    X509_OBJECT_up_ref_count(obj);
369
370    if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
371        X509_OBJECT_free_contents(obj);
372        OPENSSL_free(obj);
373        X509err(X509_F_X509_STORE_ADD_CERT,
374                X509_R_CERT_ALREADY_IN_HASH_TABLE);
375        ret = 0;
376    } else if (!sk_X509_OBJECT_push(ctx->objs, obj)) {
377        X509_OBJECT_free_contents(obj);
378        OPENSSL_free(obj);
379        X509err(X509_F_X509_STORE_ADD_CERT, ERR_R_MALLOC_FAILURE);
380        ret = 0;
381    }
382
383    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
384
385    return ret;
386}
387
388int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x)
389{
390    X509_OBJECT *obj;
391    int ret = 1;
392
393    if (x == NULL)
394        return 0;
395    obj = (X509_OBJECT *)OPENSSL_malloc(sizeof(X509_OBJECT));
396    if (obj == NULL) {
397        X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
398        return 0;
399    }
400    obj->type = X509_LU_CRL;
401    obj->data.crl = x;
402
403    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
404
405    X509_OBJECT_up_ref_count(obj);
406
407    if (X509_OBJECT_retrieve_match(ctx->objs, obj)) {
408        X509_OBJECT_free_contents(obj);
409        OPENSSL_free(obj);
410        X509err(X509_F_X509_STORE_ADD_CRL, X509_R_CERT_ALREADY_IN_HASH_TABLE);
411        ret = 0;
412    } else if (!sk_X509_OBJECT_push(ctx->objs, obj)) {
413        X509_OBJECT_free_contents(obj);
414        OPENSSL_free(obj);
415        X509err(X509_F_X509_STORE_ADD_CRL, ERR_R_MALLOC_FAILURE);
416        ret = 0;
417    }
418
419    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
420
421    return ret;
422}
423
424void X509_OBJECT_up_ref_count(X509_OBJECT *a)
425{
426    switch (a->type) {
427    case X509_LU_X509:
428        CRYPTO_add(&a->data.x509->references, 1, CRYPTO_LOCK_X509);
429        break;
430    case X509_LU_CRL:
431        CRYPTO_add(&a->data.crl->references, 1, CRYPTO_LOCK_X509_CRL);
432        break;
433    }
434}
435
436void X509_OBJECT_free_contents(X509_OBJECT *a)
437{
438    switch (a->type) {
439    case X509_LU_X509:
440        X509_free(a->data.x509);
441        break;
442    case X509_LU_CRL:
443        X509_CRL_free(a->data.crl);
444        break;
445    }
446}
447
448static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
449                               X509_NAME *name, int *pnmatch)
450{
451    X509_OBJECT stmp;
452    X509 x509_s;
453    X509_CINF cinf_s;
454    X509_CRL crl_s;
455    X509_CRL_INFO crl_info_s;
456    int idx;
457
458    stmp.type = type;
459    switch (type) {
460    case X509_LU_X509:
461        stmp.data.x509 = &x509_s;
462        x509_s.cert_info = &cinf_s;
463        cinf_s.subject = name;
464        break;
465    case X509_LU_CRL:
466        stmp.data.crl = &crl_s;
467        crl_s.crl = &crl_info_s;
468        crl_info_s.issuer = name;
469        break;
470    default:
471        /* abort(); */
472        return -1;
473    }
474
475    idx = sk_X509_OBJECT_find(h, &stmp);
476    if (idx >= 0 && pnmatch) {
477        int tidx;
478        const X509_OBJECT *tobj, *pstmp;
479        *pnmatch = 1;
480        pstmp = &stmp;
481        for (tidx = idx + 1; tidx < sk_X509_OBJECT_num(h); tidx++) {
482            tobj = sk_X509_OBJECT_value(h, tidx);
483            if (x509_object_cmp(&tobj, &pstmp))
484                break;
485            (*pnmatch)++;
486        }
487    }
488    return idx;
489}
490
491int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
492                               X509_NAME *name)
493{
494    return x509_object_idx_cnt(h, type, name, NULL);
495}
496
497X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h,
498                                             int type, X509_NAME *name)
499{
500    int idx;
501    idx = X509_OBJECT_idx_by_subject(h, type, name);
502    if (idx == -1)
503        return NULL;
504    return sk_X509_OBJECT_value(h, idx);
505}
506
507STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
508{
509    int i, idx, cnt;
510    STACK_OF(X509) *sk;
511    X509 *x;
512    X509_OBJECT *obj;
513
514    if (ctx->ctx == NULL)
515        return NULL;
516
517    sk = sk_X509_new_null();
518    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
519    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
520    if (idx < 0) {
521        /*
522         * Nothing found in cache: do lookup to possibly add new objects to
523         * cache
524         */
525        X509_OBJECT xobj;
526        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
527        if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) {
528            sk_X509_free(sk);
529            return NULL;
530        }
531        X509_OBJECT_free_contents(&xobj);
532        CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
533        idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
534        if (idx < 0) {
535            CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
536            sk_X509_free(sk);
537            return NULL;
538        }
539    }
540    for (i = 0; i < cnt; i++, idx++) {
541        obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
542        x = obj->data.x509;
543        CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
544        if (!sk_X509_push(sk, x)) {
545            CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
546            X509_free(x);
547            sk_X509_pop_free(sk, X509_free);
548            return NULL;
549        }
550    }
551    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
552    return sk;
553
554}
555
556STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
557{
558    int i, idx, cnt;
559    STACK_OF(X509_CRL) *sk;
560    X509_CRL *x;
561    X509_OBJECT *obj, xobj;
562
563
564    if (ctx->ctx == NULL)
565        return NULL;
566
567    sk = sk_X509_CRL_new_null();
568    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
569
570    /*
571     * Always do lookup to possibly add new CRLs to cache
572     */
573    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
574    if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) {
575        sk_X509_CRL_free(sk);
576        return NULL;
577    }
578    X509_OBJECT_free_contents(&xobj);
579    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
580    idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
581    if (idx < 0) {
582        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
583        sk_X509_CRL_free(sk);
584        return NULL;
585    }
586
587    for (i = 0; i < cnt; i++, idx++) {
588        obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
589        x = obj->data.crl;
590        CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
591        if (!sk_X509_CRL_push(sk, x)) {
592            CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
593            X509_CRL_free(x);
594            sk_X509_CRL_pop_free(sk, X509_CRL_free);
595            return NULL;
596        }
597    }
598    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
599    return sk;
600}
601
602X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h,
603                                        X509_OBJECT *x)
604{
605    int idx, i;
606    X509_OBJECT *obj;
607    idx = sk_X509_OBJECT_find(h, x);
608    if (idx == -1)
609        return NULL;
610    if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
611        return sk_X509_OBJECT_value(h, idx);
612    for (i = idx; i < sk_X509_OBJECT_num(h); i++) {
613        obj = sk_X509_OBJECT_value(h, i);
614        if (x509_object_cmp
615            ((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x))
616            return NULL;
617        if (x->type == X509_LU_X509) {
618            if (!X509_cmp(obj->data.x509, x->data.x509))
619                return obj;
620        } else if (x->type == X509_LU_CRL) {
621            if (!X509_CRL_match(obj->data.crl, x->data.crl))
622                return obj;
623        } else
624            return obj;
625    }
626    return NULL;
627}
628
629/*-
630 * Try to get issuer certificate from store. Due to limitations
631 * of the API this can only retrieve a single certificate matching
632 * a given subject name. However it will fill the cache with all
633 * matching certificates, so we can examine the cache for all
634 * matches.
635 *
636 * Return values are:
637 *  1 lookup successful.
638 *  0 certificate not found.
639 * -1 some other error.
640 */
641int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
642{
643    X509_NAME *xn;
644    X509_OBJECT obj, *pobj;
645    int i, ok, idx, ret;
646    xn = X509_get_issuer_name(x);
647    ok = X509_STORE_get_by_subject(ctx, X509_LU_X509, xn, &obj);
648    if (ok != X509_LU_X509) {
649        if (ok == X509_LU_RETRY) {
650            X509_OBJECT_free_contents(&obj);
651            X509err(X509_F_X509_STORE_CTX_GET1_ISSUER, X509_R_SHOULD_RETRY);
652            return -1;
653        } else if (ok != X509_LU_FAIL) {
654            X509_OBJECT_free_contents(&obj);
655            /* not good :-(, break anyway */
656            return -1;
657        }
658        return 0;
659    }
660    /* If certificate matches all OK */
661    if (ctx->check_issued(ctx, x, obj.data.x509)) {
662        *issuer = obj.data.x509;
663        return 1;
664    }
665    X509_OBJECT_free_contents(&obj);
666
667    if (ctx->ctx == NULL)
668        return 0;
669
670    /* Else find index of first cert accepted by 'check_issued' */
671    ret = 0;
672    CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
673    idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
674    if (idx != -1) {            /* should be true as we've had at least one
675                                 * match */
676        /* Look through all matching certs for suitable issuer */
677        for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) {
678            pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
679            /* See if we've run past the matches */
680            if (pobj->type != X509_LU_X509)
681                break;
682            if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
683                break;
684            if (ctx->check_issued(ctx, x, pobj->data.x509)) {
685                *issuer = pobj->data.x509;
686                X509_OBJECT_up_ref_count(pobj);
687                ret = 1;
688                break;
689            }
690        }
691    }
692    CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
693    return ret;
694}
695
696int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
697{
698    return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
699}
700
701int X509_STORE_set_depth(X509_STORE *ctx, int depth)
702{
703    X509_VERIFY_PARAM_set_depth(ctx->param, depth);
704    return 1;
705}
706
707int X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
708{
709    return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
710}
711
712int X509_STORE_set_trust(X509_STORE *ctx, int trust)
713{
714    return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
715}
716
717int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
718{
719    return X509_VERIFY_PARAM_set1(ctx->param, param);
720}
721
722void X509_STORE_set_verify_cb(X509_STORE *ctx,
723                              int (*verify_cb) (int, X509_STORE_CTX *))
724{
725    ctx->verify_cb = verify_cb;
726}
727
728void X509_STORE_set_lookup_crls_cb(X509_STORE *ctx,
729                                   STACK_OF(X509_CRL) *(*cb) (X509_STORE_CTX
730                                                              *ctx,
731                                                              X509_NAME *nm))
732{
733    ctx->lookup_crls = cb;
734}
735
736X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *ctx)
737{
738    return ctx->ctx;
739}
740
741IMPLEMENT_STACK_OF(X509_LOOKUP)
742
743IMPLEMENT_STACK_OF(X509_OBJECT)
744