OpenCoverage

ocsp_vfy.c

Absolute File Name:/home/opencoverage/opencoverage/guest-scripts/libressl/src/crypto/ocsp/ocsp_vfy.c
Source codeSwitch to Preprocessed file
LineSourceCount
1/* $OpenBSD: ocsp_vfy.c,v 1.15 2017/01/29 17:49:23 beck Exp $ */-
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL-
3 * project 2000.-
4 */-
5/* ====================================================================-
6 * Copyright (c) 2000-2004 The OpenSSL Project. All rights reserved.-
7 *-
8 * Redistribution and use in source and binary forms, with or without-
9 * modification, are permitted provided that the following conditions-
10 * are met:-
11 *-
12 * 1. Redistributions of source code must retain the above copyright-
13 * notice, this list of conditions and the following disclaimer.-
14 *-
15 * 2. Redistributions in binary form must reproduce the above copyright-
16 * notice, this list of conditions and the following disclaimer in-
17 * the documentation and/or other materials provided with the-
18 * distribution.-
19 *-
20 * 3. All advertising materials mentioning features or use of this-
21 * software must display the following acknowledgment:-
22 * "This product includes software developed by the OpenSSL Project-
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"-
24 *-
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to-
26 * endorse or promote products derived from this software without-
27 * prior written permission. For written permission, please contact-
28 * licensing@OpenSSL.org.-
29 *-
30 * 5. Products derived from this software may not be called "OpenSSL"-
31 * nor may "OpenSSL" appear in their names without prior written-
32 * permission of the OpenSSL Project.-
33 *-
34 * 6. Redistributions of any form whatsoever must retain the following-
35 * acknowledgment:-
36 * "This product includes software developed by the OpenSSL Project-
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"-
38 *-
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY-
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE-
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR-
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR-
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,-
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT-
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;-
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)-
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,-
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)-
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED-
50 * OF THE POSSIBILITY OF SUCH DAMAGE.-
51 * ====================================================================-
52 *-
53 * This product includes cryptographic software written by Eric Young-
54 * (eay@cryptsoft.com). This product includes software written by Tim-
55 * Hudson (tjh@cryptsoft.com).-
56 *-
57 */-
58-
59#include <openssl/ocsp.h>-
60#include <openssl/err.h>-
61#include <string.h>-
62-
63static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,-
64 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags);-
65static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id);-
66static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,-
67 unsigned long flags);-
68static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret);-
69static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,-
70 STACK_OF(OCSP_SINGLERESP) *sresp);-
71static int ocsp_check_delegated(X509 *x, int flags);-
72static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req,-
73 X509_NAME *nm, STACK_OF(X509) *certs, X509_STORE *st,-
74 unsigned long flags);-
75-
76/* Verify a basic response message */-
77int-
78OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, X509_STORE *st,-
79 unsigned long flags)-
80{-
81 X509 *signer, *x;-
82 STACK_OF(X509) *chain = NULL;-
83 STACK_OF(X509) *untrusted = NULL;-
84 X509_STORE_CTX ctx;-
85 int i, ret = 0;-
86-
87 ret = ocsp_find_signer(&signer, bs, certs, st, flags);-
88 if (!ret) {
!retDescription
TRUEnever evaluated
FALSEnever evaluated
0
89 OCSPerror(OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);-
90 goto end;
never executed: goto end;
0
91 }-
92 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
(ret == 2)Description
TRUEnever evaluated
FALSEnever evaluated
(flags & 0x200)Description
TRUEnever evaluated
FALSEnever evaluated
0
93 flags |= OCSP_NOVERIFY;
never executed: flags |= 0x10;
0
94 if (!(flags & OCSP_NOSIGS)) {
!(flags & 0x4)Description
TRUEnever evaluated
FALSEnever evaluated
0
95 EVP_PKEY *skey;-
96-
97 skey = X509_get_pubkey(signer);-
98 if (skey) {
skeyDescription
TRUEnever evaluated
FALSEnever evaluated
0
99 ret = OCSP_BASICRESP_verify(bs, skey, 0);-
100 EVP_PKEY_free(skey);-
101 }
never executed: end of block
0
102 if (!skey || ret <= 0) {
!skeyDescription
TRUEnever evaluated
FALSEnever evaluated
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
103 OCSPerror(OCSP_R_SIGNATURE_FAILURE);-
104 goto end;
never executed: goto end;
0
105 }-
106 }
never executed: end of block
0
107 if (!(flags & OCSP_NOVERIFY)) {
!(flags & 0x10)Description
TRUEnever evaluated
FALSEnever evaluated
0
108 int init_res;-
109-
110 if (flags & OCSP_NOCHAIN) {
flags & 0x8Description
TRUEnever evaluated
FALSEnever evaluated
0
111 untrusted = NULL;-
112 } else if (bs->certs && certs) {
never executed: end of block
bs->certsDescription
TRUEnever evaluated
FALSEnever evaluated
certsDescription
TRUEnever evaluated
FALSEnever evaluated
0
113 untrusted = sk_X509_dup(bs->certs);-
114 for (i = 0; i < sk_X509_num(certs); i++) {
i < sk_num(((_..._st_X509*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
115 if (!sk_X509_push(untrusted,
!sk_push(((_ST... : (X509*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
116 sk_X509_value(certs, i))) {-
117 OCSPerror(ERR_R_MALLOC_FAILURE);-
118 goto end;
never executed: goto end;
0
119 }-
120 }
never executed: end of block
0
121 } else
never executed: end of block
0
122 untrusted = bs->certs;
never executed: untrusted = bs->certs;
0
123 init_res = X509_STORE_CTX_init(&ctx, st, signer, untrusted);-
124 if (!init_res) {
!init_resDescription
TRUEnever evaluated
FALSEnever evaluated
0
125 ret = -1;-
126 OCSPerror(ERR_R_X509_LIB);-
127 goto end;
never executed: goto end;
0
128 }-
129-
130 if (X509_STORE_CTX_set_purpose(&ctx,
X509_STORE_CTX...(&ctx, 8) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
131 X509_PURPOSE_OCSP_HELPER) == 0) {
X509_STORE_CTX...(&ctx, 8) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
132 X509_STORE_CTX_cleanup(&ctx);-
133 ret = -1;-
134 goto end;
never executed: goto end;
0
135 }-
136 ret = X509_verify_cert(&ctx);-
137 chain = X509_STORE_CTX_get1_chain(&ctx);-
138 X509_STORE_CTX_cleanup(&ctx);-
139 if (ret <= 0) {
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
140 i = X509_STORE_CTX_get_error(&ctx);-
141 OCSPerror(OCSP_R_CERTIFICATE_VERIFY_ERROR);-
142 ERR_asprintf_error_data("Verify error:%s",-
143 X509_verify_cert_error_string(i));-
144 goto end;
never executed: goto end;
0
145 }-
146 if (flags & OCSP_NOCHECKS) {
flags & 0x100Description
TRUEnever evaluated
FALSEnever evaluated
0
147 ret = 1;-
148 goto end;
never executed: goto end;
0
149 }-
150 /* At this point we have a valid certificate chain-
151 * need to verify it against the OCSP issuer criteria.-
152 */-
153 ret = ocsp_check_issuer(bs, chain, flags);-
154-
155 /* If fatal error or valid match then finish */-
156 if (ret != 0)
ret != 0Description
TRUEnever evaluated
FALSEnever evaluated
0
157 goto end;
never executed: goto end;
0
158-
159 /* Easy case: explicitly trusted. Get root CA and-
160 * check for explicit trust-
161 */-
162 if (flags & OCSP_NOEXPLICIT)
flags & 0x20Description
TRUEnever evaluated
FALSEnever evaluated
0
163 goto end;
never executed: goto end;
0
164-
165 x = sk_X509_value(chain, sk_X509_num(chain) - 1);-
166 if (X509_check_trust(x, NID_OCSP_sign, 0) !=
X509_check_tru..., 180, 0) != 1Description
TRUEnever evaluated
FALSEnever evaluated
0
167 X509_TRUST_TRUSTED) {
X509_check_tru..., 180, 0) != 1Description
TRUEnever evaluated
FALSEnever evaluated
0
168 OCSPerror(OCSP_R_ROOT_CA_NOT_TRUSTED);-
169 goto end;
never executed: goto end;
0
170 }-
171 ret = 1;-
172 }
never executed: end of block
0
173-
174end:
code before this statement never executed: end:
0
175 if (chain)
chainDescription
TRUEnever evaluated
FALSEnever evaluated
0
176 sk_X509_pop_free(chain, X509_free);
never executed: sk_pop_free(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0)), ((void (*)(void *)) ((1 ? (X509_free) : (void (*)(X509 *))0))));
0
177 if (bs->certs && certs)
bs->certsDescription
TRUEnever evaluated
FALSEnever evaluated
certsDescription
TRUEnever evaluated
FALSEnever evaluated
0
178 sk_X509_free(untrusted);
never executed: sk_free(((_STACK*) (1 ? (untrusted) : (struct stack_st_X509*)0)));
0
179 return ret;
never executed: return ret;
0
180}-
181-
182static int-
183ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,-
184 X509_STORE *st, unsigned long flags)-
185{-
186 X509 *signer;-
187 OCSP_RESPID *rid = bs->tbsResponseData->responderId;-
188-
189 if ((signer = ocsp_find_signer_sk(certs, rid))) {
(signer = ocsp...k(certs, rid))Description
TRUEnever evaluated
FALSEnever evaluated
0
190 *psigner = signer;-
191 return 2;
never executed: return 2;
0
192 }-
193 if (!(flags & OCSP_NOINTERN) &&
!(flags & 0x2)Description
TRUEnever evaluated
FALSEnever evaluated
0
194 (signer = ocsp_find_signer_sk(bs->certs, rid))) {
(signer = ocsp...->certs, rid))Description
TRUEnever evaluated
FALSEnever evaluated
0
195 *psigner = signer;-
196 return 1;
never executed: return 1;
0
197 }-
198 /* Maybe lookup from store if by subject name */-
199-
200 *psigner = NULL;-
201 return 0;
never executed: return 0;
0
202}-
203-
204static X509 *-
205ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)-
206{-
207 int i;-
208 unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash;-
209 X509 *x;-
210-
211 /* Easy if lookup by name */-
212 if (id->type == V_OCSP_RESPID_NAME)
id->type == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
213 return X509_find_by_subject(certs, id->value.byName);
never executed: return X509_find_by_subject(certs, id->value.byName);
0
214-
215 /* Lookup by key hash */-
216-
217 /* If key hash isn't SHA1 length then forget it */-
218 if (id->value.byKey->length != SHA_DIGEST_LENGTH)
id->value.byKey->length != 20Description
TRUEnever evaluated
FALSEnever evaluated
0
219 return NULL;
never executed: return ((void *)0) ;
0
220 keyhash = id->value.byKey->data;-
221 /* Calculate hash of each key and compare */-
222 for (i = 0; i < sk_X509_num(certs); i++) {
i < sk_num(((_..._st_X509*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
223 x = sk_X509_value(certs, i);-
224 X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);-
225 if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
!memcmp(keyhash, tmphash, 20)Description
TRUEnever evaluated
FALSEnever evaluated
0
226 return x;
never executed: return x;
0
227 }
never executed: end of block
0
228 return NULL;
never executed: return ((void *)0) ;
0
229}-
230-
231static int-
232ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,-
233 unsigned long flags)-
234{-
235 STACK_OF(OCSP_SINGLERESP) *sresp;-
236 X509 *signer, *sca;-
237 OCSP_CERTID *caid = NULL;-
238 int i;-
239-
240 sresp = bs->tbsResponseData->responses;-
241-
242 if (sk_X509_num(chain) <= 0) {
sk_num(((_STAC...509*)0))) <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
243 OCSPerror(OCSP_R_NO_CERTIFICATES_IN_CHAIN);-
244 return -1;
never executed: return -1;
0
245 }-
246-
247 /* See if the issuer IDs match. */-
248 i = ocsp_check_ids(sresp, &caid);-
249-
250 /* If ID mismatch or other error then return */-
251 if (i <= 0)
i <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
252 return i;
never executed: return i;
0
253-
254 signer = sk_X509_value(chain, 0);-
255 /* Check to see if OCSP responder CA matches request CA */-
256 if (sk_X509_num(chain) > 1) {
sk_num(((_STAC...X509*)0))) > 1Description
TRUEnever evaluated
FALSEnever evaluated
0
257 sca = sk_X509_value(chain, 1);-
258 i = ocsp_match_issuerid(sca, caid, sresp);-
259 if (i < 0)
i < 0Description
TRUEnever evaluated
FALSEnever evaluated
0
260 return i;
never executed: return i;
0
261 if (i) {
iDescription
TRUEnever evaluated
FALSEnever evaluated
0
262 /* We have a match, if extensions OK then success */-
263 if (ocsp_check_delegated(signer, flags))
ocsp_check_del...signer, flags)Description
TRUEnever evaluated
FALSEnever evaluated
0
264 return 1;
never executed: return 1;
0
265 return 0;
never executed: return 0;
0
266 }-
267 }
never executed: end of block
0
268-
269 /* Otherwise check if OCSP request signed directly by request CA */-
270 return ocsp_match_issuerid(signer, caid, sresp);
never executed: return ocsp_match_issuerid(signer, caid, sresp);
0
271}-
272-
273/* Check the issuer certificate IDs for equality. If there is a mismatch with the same-
274 * algorithm then there's no point trying to match any certificates against the issuer.-
275 * If the issuer IDs all match then we just need to check equality against one of them.-
276 */-
277static int-
278ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret)-
279{-
280 OCSP_CERTID *tmpid, *cid;-
281 int i, idcount;-
282-
283 idcount = sk_OCSP_SINGLERESP_num(sresp);-
284 if (idcount <= 0) {
idcount <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
285 OCSPerror(OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA);-
286 return -1;
never executed: return -1;
0
287 }-
288-
289 cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;-
290-
291 *ret = NULL;-
292-
293 for (i = 1; i < idcount; i++) {
i < idcountDescription
TRUEnever evaluated
FALSEnever evaluated
0
294 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;-
295 /* Check to see if IDs match */-
296 if (OCSP_id_issuer_cmp(cid, tmpid)) {
OCSP_id_issuer_cmp(cid, tmpid)Description
TRUEnever evaluated
FALSEnever evaluated
0
297 return 0;
never executed: return 0;
0
298 }-
299 }
never executed: end of block
0
300-
301 /* All IDs match: only need to check one ID */-
302 *ret = cid;-
303 return 1;
never executed: return 1;
0
304}-
305-
306static int-
307ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,-
308 STACK_OF(OCSP_SINGLERESP) *sresp)-
309{-
310 /* If only one ID to match then do it */-
311 if (cid) {
cidDescription
TRUEnever evaluated
FALSEnever evaluated
0
312 const EVP_MD *dgst;-
313 X509_NAME *iname;-
314 int mdlen;-
315 unsigned char md[EVP_MAX_MD_SIZE];-
316-
317 if (!(dgst =
!(dgst = EVP_g...>algorithm))))Description
TRUEnever evaluated
FALSEnever evaluated
0
318 EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) {
!(dgst = EVP_g...>algorithm))))Description
TRUEnever evaluated
FALSEnever evaluated
0
319 OCSPerror(OCSP_R_UNKNOWN_MESSAGE_DIGEST);-
320 return -1;
never executed: return -1;
0
321 }-
322-
323 mdlen = EVP_MD_size(dgst);-
324 if (mdlen < 0)
mdlen < 0Description
TRUEnever evaluated
FALSEnever evaluated
0
325 return -1;
never executed: return -1;
0
326 if (cid->issuerNameHash->length != mdlen ||
cid->issuerNam...ength != mdlenDescription
TRUEnever evaluated
FALSEnever evaluated
0
327 cid->issuerKeyHash->length != mdlen)
cid->issuerKey...ength != mdlenDescription
TRUEnever evaluated
FALSEnever evaluated
0
328 return 0;
never executed: return 0;
0
329 iname = X509_get_subject_name(cert);-
330 if (!X509_NAME_digest(iname, dgst, md, NULL))
!X509_NAME_dig... ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
0
331 return -1;
never executed: return -1;
0
332 if (memcmp(md, cid->issuerNameHash->data, mdlen))
memcmp(md, cid...->data, mdlen)Description
TRUEnever evaluated
FALSEnever evaluated
0
333 return 0;
never executed: return 0;
0
334 X509_pubkey_digest(cert, dgst, md, NULL);-
335 if (memcmp(md, cid->issuerKeyHash->data, mdlen))
memcmp(md, cid...->data, mdlen)Description
TRUEnever evaluated
FALSEnever evaluated
0
336 return 0;
never executed: return 0;
0
337-
338 return 1;
never executed: return 1;
0
339 } else {-
340 /* We have to match the whole lot */-
341 int i, ret;-
342 OCSP_CERTID *tmpid;-
343-
344 for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
i < sk_num(((_...NGLERESP*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
345 tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;-
346 ret = ocsp_match_issuerid(cert, tmpid, NULL);-
347 if (ret <= 0)
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
348 return ret;
never executed: return ret;
0
349 }
never executed: end of block
0
350 return 1;
never executed: return 1;
0
351 }-
352}-
353-
354static int-
355ocsp_check_delegated(X509 *x, int flags)-
356{-
357 X509_check_purpose(x, -1, 0);-
358 if ((x->ex_flags & EXFLAG_XKUSAGE) && (x->ex_xkusage & XKU_OCSP_SIGN))
(x->ex_flags & 0x0004)Description
TRUEnever evaluated
FALSEnever evaluated
(x->ex_xkusage & 0x20)Description
TRUEnever evaluated
FALSEnever evaluated
0
359 return 1;
never executed: return 1;
0
360 OCSPerror(OCSP_R_MISSING_OCSPSIGNING_USAGE);-
361 return 0;
never executed: return 0;
0
362}-
363-
364/* Verify an OCSP request. This is fortunately much easier than OCSP-
365 * response verify. Just find the signers certificate and verify it-
366 * against a given trust value.-
367 */-
368int-
369OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store,-
370 unsigned long flags)-
371{-
372 X509 *signer;-
373 X509_NAME *nm;-
374 GENERAL_NAME *gen;-
375 int ret;-
376 X509_STORE_CTX ctx;-
377-
378 if (!req->optionalSignature) {
!req->optionalSignatureDescription
TRUEnever evaluated
FALSEnever evaluated
0
379 OCSPerror(OCSP_R_REQUEST_NOT_SIGNED);-
380 return 0;
never executed: return 0;
0
381 }-
382 gen = req->tbsRequest->requestorName;-
383 if (!gen || gen->type != GEN_DIRNAME) {
!genDescription
TRUEnever evaluated
FALSEnever evaluated
gen->type != 4Description
TRUEnever evaluated
FALSEnever evaluated
0
384 OCSPerror(OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE);-
385 return 0;
never executed: return 0;
0
386 }-
387 nm = gen->d.directoryName;-
388 ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags);-
389 if (ret <= 0) {
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
390 OCSPerror(OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);-
391 return 0;
never executed: return 0;
0
392 }-
393 if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
(ret == 2)Description
TRUEnever evaluated
FALSEnever evaluated
(flags & 0x200)Description
TRUEnever evaluated
FALSEnever evaluated
0
394 flags |= OCSP_NOVERIFY;
never executed: flags |= 0x10;
0
395 if (!(flags & OCSP_NOSIGS)) {
!(flags & 0x4)Description
TRUEnever evaluated
FALSEnever evaluated
0
396 EVP_PKEY *skey;-
397-
398 skey = X509_get_pubkey(signer);-
399 ret = OCSP_REQUEST_verify(req, skey);-
400 EVP_PKEY_free(skey);-
401 if (ret <= 0) {
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
402 OCSPerror(OCSP_R_SIGNATURE_FAILURE);-
403 return 0;
never executed: return 0;
0
404 }-
405 }
never executed: end of block
0
406 if (!(flags & OCSP_NOVERIFY)) {
!(flags & 0x10)Description
TRUEnever evaluated
FALSEnever evaluated
0
407 int init_res;-
408-
409 if (flags & OCSP_NOCHAIN)
flags & 0x8Description
TRUEnever evaluated
FALSEnever evaluated
0
410 init_res = X509_STORE_CTX_init(&ctx, store, signer,
never executed: init_res = X509_STORE_CTX_init(&ctx, store, signer, ((void *)0) );
0
411 NULL);
never executed: init_res = X509_STORE_CTX_init(&ctx, store, signer, ((void *)0) );
0
412 else-
413 init_res = X509_STORE_CTX_init(&ctx, store, signer,
never executed: init_res = X509_STORE_CTX_init(&ctx, store, signer, req->optionalSignature->certs);
0
414 req->optionalSignature->certs);
never executed: init_res = X509_STORE_CTX_init(&ctx, store, signer, req->optionalSignature->certs);
0
415 if (!init_res) {
!init_resDescription
TRUEnever evaluated
FALSEnever evaluated
0
416 OCSPerror(ERR_R_X509_LIB);-
417 return 0;
never executed: return 0;
0
418 }-
419-
420 if (X509_STORE_CTX_set_purpose(&ctx,
X509_STORE_CTX...(&ctx, 8) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
421 X509_PURPOSE_OCSP_HELPER) == 0 ||
X509_STORE_CTX...(&ctx, 8) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
422 X509_STORE_CTX_set_trust(&ctx,
X509_STORE_CTX...(&ctx, 7) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
423 X509_TRUST_OCSP_REQUEST) == 0) {
X509_STORE_CTX...(&ctx, 7) == 0Description
TRUEnever evaluated
FALSEnever evaluated
0
424 X509_STORE_CTX_cleanup(&ctx);-
425 return 0;
never executed: return 0;
0
426 }-
427 ret = X509_verify_cert(&ctx);-
428 X509_STORE_CTX_cleanup(&ctx);-
429 if (ret <= 0) {
ret <= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
430 ret = X509_STORE_CTX_get_error(&ctx);-
431 OCSPerror(OCSP_R_CERTIFICATE_VERIFY_ERROR);-
432 ERR_asprintf_error_data("Verify error:%s",-
433 X509_verify_cert_error_string(ret));-
434 return 0;
never executed: return 0;
0
435 }-
436 }
never executed: end of block
0
437 return 1;
never executed: return 1;
0
438}-
439-
440static int-
441ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm,-
442 STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags)-
443{-
444 X509 *signer;-
445-
446 if (!(flags & OCSP_NOINTERN)) {
!(flags & 0x2)Description
TRUEnever evaluated
FALSEnever evaluated
0
447 signer = X509_find_by_subject(req->optionalSignature->certs, nm);-
448 if (signer) {
signerDescription
TRUEnever evaluated
FALSEnever evaluated
0
449 *psigner = signer;-
450 return 1;
never executed: return 1;
0
451 }-
452 }
never executed: end of block
0
453-
454 signer = X509_find_by_subject(certs, nm);-
455 if (signer) {
signerDescription
TRUEnever evaluated
FALSEnever evaluated
0
456 *psigner = signer;-
457 return 2;
never executed: return 2;
0
458 }-
459 return 0;
never executed: return 0;
0
460}-
Source codeSwitch to Preprocessed file
Generated by Squish Coco 4.2.2