OpenCoverage

ssl_cert.c

Absolute File Name:/home/opencoverage/opencoverage/guest-scripts/libressl/src/ssl/ssl_cert.c
Source codeSwitch to Preprocessed file
LineSourceCount
1/* $OpenBSD: ssl_cert.c,v 1.67 2018/04/25 07:10:39 tb Exp $ */-
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)-
3 * All rights reserved.-
4 *-
5 * This package is an SSL implementation written-
6 * by Eric Young (eay@cryptsoft.com).-
7 * The implementation was written so as to conform with Netscapes SSL.-
8 *-
9 * This library is free for commercial and non-commercial use as long as-
10 * the following conditions are aheared to. The following conditions-
11 * apply to all code found in this distribution, be it the RC4, RSA,-
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation-
13 * included with this distribution is covered by the same copyright terms-
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).-
15 *-
16 * Copyright remains Eric Young's, and as such any Copyright notices in-
17 * the code are not to be removed.-
18 * If this package is used in a product, Eric Young should be given attribution-
19 * as the author of the parts of the library used.-
20 * This can be in the form of a textual message at program startup or-
21 * in documentation (online or textual) provided with the package.-
22 *-
23 * Redistribution and use in source and binary forms, with or without-
24 * modification, are permitted provided that the following conditions-
25 * are met:-
26 * 1. Redistributions of source code must retain the copyright-
27 * notice, this list of conditions and the following disclaimer.-
28 * 2. Redistributions in binary form must reproduce the above copyright-
29 * notice, this list of conditions and the following disclaimer in the-
30 * documentation and/or other materials provided with the distribution.-
31 * 3. All advertising materials mentioning features or use of this software-
32 * must display the following acknowledgement:-
33 * "This product includes cryptographic software written by-
34 * Eric Young (eay@cryptsoft.com)"-
35 * The word 'cryptographic' can be left out if the rouines from the library-
36 * being used are not cryptographic related :-).-
37 * 4. If you include any Windows specific code (or a derivative thereof) from-
38 * the apps directory (application code) you must include an acknowledgement:-
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"-
40 *-
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND-
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE-
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE-
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE-
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL-
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS-
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)-
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT-
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY-
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF-
51 * SUCH DAMAGE.-
52 *-
53 * The licence and distribution terms for any publically available version or-
54 * derivative of this code cannot be changed. i.e. this code cannot simply be-
55 * copied and put under another distribution licence-
56 * [including the GNU Public Licence.]-
57 */-
58/* ====================================================================-
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.-
60 *-
61 * Redistribution and use in source and binary forms, with or without-
62 * modification, are permitted provided that the following conditions-
63 * are met:-
64 *-
65 * 1. Redistributions of source code must retain the above copyright-
66 * notice, this list of conditions and the following disclaimer.-
67 *-
68 * 2. Redistributions in binary form must reproduce the above copyright-
69 * notice, this list of conditions and the following disclaimer in-
70 * the documentation and/or other materials provided with the-
71 * distribution.-
72 *-
73 * 3. All advertising materials mentioning features or use of this-
74 * software must display the following acknowledgment:-
75 * "This product includes software developed by the OpenSSL Project-
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"-
77 *-
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to-
79 * endorse or promote products derived from this software without-
80 * prior written permission. For written permission, please contact-
81 * openssl-core@openssl.org.-
82 *-
83 * 5. Products derived from this software may not be called "OpenSSL"-
84 * nor may "OpenSSL" appear in their names without prior written-
85 * permission of the OpenSSL Project.-
86 *-
87 * 6. Redistributions of any form whatsoever must retain the following-
88 * acknowledgment:-
89 * "This product includes software developed by the OpenSSL Project-
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"-
91 *-
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY-
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE-
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR-
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR-
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,-
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT-
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;-
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)-
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,-
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)-
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED-
103 * OF THE POSSIBILITY OF SUCH DAMAGE.-
104 * ====================================================================-
105 *-
106 * This product includes cryptographic software written by Eric Young-
107 * (eay@cryptsoft.com). This product includes software written by Tim-
108 * Hudson (tjh@cryptsoft.com).-
109 *-
110 */-
111/* ====================================================================-
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.-
113 * ECC cipher suite support in OpenSSL originally developed by-
114 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.-
115 */-
116-
117#include <sys/types.h>-
118-
119#include <dirent.h>-
120#include <stdio.h>-
121#include <unistd.h>-
122-
123#include <openssl/bio.h>-
124#include <openssl/bn.h>-
125#include <openssl/dh.h>-
126#include <openssl/objects.h>-
127#include <openssl/opensslconf.h>-
128#include <openssl/pem.h>-
129#include <openssl/x509v3.h>-
130-
131#include "ssl_locl.h"-
132-
133int-
134SSL_get_ex_data_X509_STORE_CTX_idx(void)-
135{-
136 static volatile int ssl_x509_store_ctx_idx = -1;-
137 int got_write_lock = 0;-
138-
139 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);-
140-
141 if (ssl_x509_store_ctx_idx < 0) {
ssl_x509_store_ctx_idx < 0Description
TRUEevaluated 63 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
FALSEevaluated 211 times by 8 tests
Evaluated by:
  • cipherstest
  • clienttest
  • servertest
  • ssl_versions
  • ssltest
  • tls_prf
  • tlsexttest
  • tlstest
63-211
142 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);-
143 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);-
144 got_write_lock = 1;-
145-
146 if (ssl_x509_store_ctx_idx < 0) {
ssl_x509_store_ctx_idx < 0Description
TRUEevaluated 63 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
FALSEnever evaluated
0-63
147 ssl_x509_store_ctx_idx =-
148 X509_STORE_CTX_get_ex_new_index(-
149 0, "SSL for verify callback", NULL, NULL, NULL);-
150 }
executed 63 times by 13 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
63
151 }
executed 63 times by 13 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
63
152-
153 if (got_write_lock)
got_write_lockDescription
TRUEevaluated 63 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
FALSEevaluated 211 times by 8 tests
Evaluated by:
  • cipherstest
  • clienttest
  • servertest
  • ssl_versions
  • ssltest
  • tls_prf
  • tlsexttest
  • tlstest
63-211
154 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
executed 63 times by 13 tests: CRYPTO_lock(2|8,12,__FILE__,154);
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
63
155 else-
156 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
executed 211 times by 8 tests: CRYPTO_lock(2|4,12,__FILE__,156);
Executed by:
  • cipherstest
  • clienttest
  • servertest
  • ssl_versions
  • ssltest
  • tls_prf
  • tlsexttest
  • tlstest
211
157-
158 return ssl_x509_store_ctx_idx;
executed 274 times by 13 tests: return ssl_x509_store_ctx_idx;
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
274
159}-
160-
161static void-
162ssl_cert_set_default_md(CERT *cert)-
163{-
164 /* Set digest values to defaults */-
165 cert->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();-
166 cert->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();-
167 cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();-
168#ifndef OPENSSL_NO_GOST-
169 cert->pkeys[SSL_PKEY_GOST01].digest = EVP_gostr341194();-
170#endif-
171}
executed 416 times by 13 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
416
172-
173CERT *-
174ssl_cert_new(void)-
175{-
176 CERT *ret;-
177-
178 ret = calloc(1, sizeof(CERT));-
179 if (ret == NULL) {
ret == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 214 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
0-214
180 SSLerrorx(ERR_R_MALLOC_FAILURE);-
181 return (NULL);
never executed: return ( ((void *)0) );
0
182 }-
183 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);-
184 ret->references = 1;-
185 ssl_cert_set_default_md(ret);-
186 return (ret);
executed 214 times by 13 tests: return (ret);
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
214
187}-
188-
189CERT *-
190ssl_cert_dup(CERT *cert)-
191{-
192 CERT *ret;-
193 int i;-
194-
195 ret = calloc(1, sizeof(CERT));-
196 if (ret == NULL) {
ret == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 202 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
0-202
197 SSLerrorx(ERR_R_MALLOC_FAILURE);-
198 return (NULL);
never executed: return ( ((void *)0) );
0
199 }-
200-
201 /*-
202 * same as ret->key = ret->pkeys + (cert->key - cert->pkeys),-
203 * if you find that more readable-
204 */-
205 ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];-
206-
207 ret->valid = cert->valid;-
208 ret->mask_k = cert->mask_k;-
209 ret->mask_a = cert->mask_a;-
210-
211 if (cert->dh_tmp != NULL) {
cert->dh_tmp != ((void *)0)Description
TRUEevaluated 49 times by 1 test
Evaluated by:
  • ssltest
FALSEevaluated 153 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
49-153
212 ret->dh_tmp = DHparams_dup(cert->dh_tmp);-
213 if (ret->dh_tmp == NULL) {
ret->dh_tmp == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 49 times by 1 test
Evaluated by:
  • ssltest
0-49
214 SSLerrorx(ERR_R_DH_LIB);-
215 goto err;
never executed: goto err;
0
216 }-
217 if (cert->dh_tmp->priv_key) {
cert->dh_tmp->priv_keyDescription
TRUEnever evaluated
FALSEevaluated 49 times by 1 test
Evaluated by:
  • ssltest
0-49
218 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);-
219 if (!b) {
!bDescription
TRUEnever evaluated
FALSEnever evaluated
0
220 SSLerrorx(ERR_R_BN_LIB);-
221 goto err;
never executed: goto err;
0
222 }-
223 ret->dh_tmp->priv_key = b;-
224 }
never executed: end of block
0
225 if (cert->dh_tmp->pub_key) {
cert->dh_tmp->pub_keyDescription
TRUEnever evaluated
FALSEevaluated 49 times by 1 test
Evaluated by:
  • ssltest
0-49
226 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);-
227 if (!b) {
!bDescription
TRUEnever evaluated
FALSEnever evaluated
0
228 SSLerrorx(ERR_R_BN_LIB);-
229 goto err;
never executed: goto err;
0
230 }-
231 ret->dh_tmp->pub_key = b;-
232 }
never executed: end of block
0
233 }
executed 49 times by 1 test: end of block
Executed by:
  • ssltest
49
234 ret->dh_tmp_cb = cert->dh_tmp_cb;-
235 ret->dh_tmp_auto = cert->dh_tmp_auto;-
236-
237 if (cert->ecdh_tmp) {
cert->ecdh_tmpDescription
TRUEnever evaluated
FALSEevaluated 202 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
0-202
238 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);-
239 if (ret->ecdh_tmp == NULL) {
ret->ecdh_tmp == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
240 SSLerrorx(ERR_R_EC_LIB);-
241 goto err;
never executed: goto err;
0
242 }-
243 }
never executed: end of block
0
244-
245 for (i = 0; i < SSL_PKEY_NUM; i++) {
i < 5Description
TRUEevaluated 1010 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
FALSEevaluated 202 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
202-1010
246 if (cert->pkeys[i].x509 != NULL) {
cert->pkeys[i]...!= ((void *)0)Description
TRUEevaluated 63 times by 3 tests
Evaluated by:
  • servertest
  • ssltest
  • tlstest
FALSEevaluated 947 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
63-947
247 ret->pkeys[i].x509 = cert->pkeys[i].x509;-
248 CRYPTO_add(&ret->pkeys[i].x509->references, 1,-
249 CRYPTO_LOCK_X509);-
250 }
executed 63 times by 3 tests: end of block
Executed by:
  • servertest
  • ssltest
  • tlstest
63
251-
252 if (cert->pkeys[i].privatekey != NULL) {
cert->pkeys[i]...!= ((void *)0)Description
TRUEevaluated 63 times by 3 tests
Evaluated by:
  • servertest
  • ssltest
  • tlstest
FALSEevaluated 947 times by 11 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
63-947
253 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey;-
254 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1,-
255 CRYPTO_LOCK_EVP_PKEY);-
256-
257 switch (i) {-
258 /*-
259 * If there was anything special to do for-
260 * certain types of keys, we'd do it here.-
261 * (Nothing at the moment, I think.)-
262 */-
263-
264 case SSL_PKEY_RSA_ENC:
executed 63 times by 3 tests: case 0:
Executed by:
  • servertest
  • ssltest
  • tlstest
63
265 case SSL_PKEY_RSA_SIGN:
never executed: case 1:
0
266 /* We have an RSA key. */-
267 break;
executed 63 times by 3 tests: break;
Executed by:
  • servertest
  • ssltest
  • tlstest
63
268-
269 case SSL_PKEY_DH_RSA:
never executed: case 2:
0
270 /* We have a DH key. */-
271 break;
never executed: break;
0
272-
273 case SSL_PKEY_ECC:
never executed: case 3:
0
274 /* We have an ECC key */-
275 break;
never executed: break;
0
276-
277 default:
never executed: default:
0
278 /* Can't happen. */-
279 SSLerrorx(SSL_R_LIBRARY_BUG);-
280 }
never executed: end of block
0
281 }-
282 }
executed 1010 times by 11 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
1010
283-
284 /*-
285 * ret->extra_certs *should* exist, but currently the own certificate-
286 * chain is held inside SSL_CTX-
287 */-
288-
289 ret->references = 1;-
290 /*-
291 * Set digests to defaults. NB: we don't copy existing values-
292 * as they will be set during handshake.-
293 */-
294 ssl_cert_set_default_md(ret);-
295-
296 return (ret);
executed 202 times by 11 tests: return (ret);
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
202
297-
298err:-
299 DH_free(ret->dh_tmp);-
300 EC_KEY_free(ret->ecdh_tmp);-
301-
302 for (i = 0; i < SSL_PKEY_NUM; i++) {
i < 5Description
TRUEnever evaluated
FALSEnever evaluated
0
303 X509_free(ret->pkeys[i].x509);-
304 EVP_PKEY_free(ret->pkeys[i].privatekey);-
305 }
never executed: end of block
0
306 free (ret);-
307 return NULL;
never executed: return ((void *)0) ;
0
308}-
309-
310-
311void-
312ssl_cert_free(CERT *c)-
313{-
314 int i;-
315-
316 if (c == NULL)
c == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 402 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
0-402
317 return;
never executed: return;
0
318-
319 i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT);-
320 if (i > 0)
i > 0Description
TRUEnever evaluated
FALSEevaluated 402 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
0-402
321 return;
never executed: return;
0
322-
323 DH_free(c->dh_tmp);-
324 EC_KEY_free(c->ecdh_tmp);-
325-
326 for (i = 0; i < SSL_PKEY_NUM; i++) {
i < 5Description
TRUEevaluated 2010 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
FALSEevaluated 402 times by 13 tests
Evaluated by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
402-2010
327 X509_free(c->pkeys[i].x509);-
328 EVP_PKEY_free(c->pkeys[i].privatekey);-
329 }
executed 2010 times by 13 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
2010
330-
331 free(c);-
332}
executed 402 times by 13 tests: end of block
Executed by:
  • cipher_list
  • cipherstest
  • clienttest
  • configtest
  • libssl.so.46.0.1
  • servertest
  • ssl_versions
  • ssltest
  • tls_ext_alpn
  • tls_prf
  • tlsexttest
  • tlstest
  • verifytest
402
333-
334int-
335ssl_cert_inst(CERT **o)-
336{-
337 /*-
338 * Create a CERT if there isn't already one-
339 * (which cannot really happen, as it is initially created in-
340 * SSL_CTX_new; but the earlier code usually allows for that one-
341 * being non-existant, so we follow that behaviour, as it might-
342 * turn out that there actually is a reason for it -- but I'm-
343 * not sure that *all* of the existing code could cope with-
344 * s->cert being NULL, otherwise we could do without the-
345 * initialization in SSL_CTX_new).-
346 */-
347-
348 if (o == NULL) {
o == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 126 times by 3 tests
Evaluated by:
  • servertest
  • ssltest
  • tlstest
0-126
349 SSLerrorx(ERR_R_PASSED_NULL_PARAMETER);-
350 return (0);
never executed: return (0);
0
351 }-
352 if (*o == NULL) {
*o == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 126 times by 3 tests
Evaluated by:
  • servertest
  • ssltest
  • tlstest
0-126
353 if ((*o = ssl_cert_new()) == NULL) {
(*o = ssl_cert...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
354 SSLerrorx(ERR_R_MALLOC_FAILURE);-
355 return (0);
never executed: return (0);
0
356 }-
357 }
never executed: end of block
0
358 return (1);
executed 126 times by 3 tests: return (1);
Executed by:
  • servertest
  • ssltest
  • tlstest
126
359}-
360-
361-
362SESS_CERT *-
363ssl_sess_cert_new(void)-
364{-
365 SESS_CERT *ret;-
366-
367 ret = calloc(1, sizeof *ret);-
368 if (ret == NULL) {
ret == ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 70 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-70
369 SSLerrorx(ERR_R_MALLOC_FAILURE);-
370 return NULL;
never executed: return ((void *)0) ;
0
371 }-
372 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);-
373 ret->references = 1;-
374-
375 return ret;
executed 70 times by 2 tests: return ret;
Executed by:
  • ssltest
  • tlstest
70
376}-
377-
378void-
379ssl_sess_cert_free(SESS_CERT *sc)-
380{-
381 int i;-
382-
383 if (sc == NULL)
sc == ((void *)0)Description
TRUEevaluated 140 times by 5 tests
Evaluated by:
  • clienttest
  • servertest
  • ssltest
  • tlsexttest
  • tlstest
FALSEevaluated 70 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
70-140
384 return;
executed 140 times by 5 tests: return;
Executed by:
  • clienttest
  • servertest
  • ssltest
  • tlsexttest
  • tlstest
140
385-
386 i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);-
387 if (i > 0)
i > 0Description
TRUEnever evaluated
FALSEevaluated 70 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-70
388 return;
never executed: return;
0
389-
390 sk_X509_pop_free(sc->cert_chain, X509_free);-
391 for (i = 0; i < SSL_PKEY_NUM; i++)
i < 5Description
TRUEevaluated 350 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEevaluated 70 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
70-350
392 X509_free(sc->peer_pkeys[i].x509);
executed 350 times by 2 tests: X509_free(sc->peer_pkeys[i].x509);
Executed by:
  • ssltest
  • tlstest
350
393-
394 DH_free(sc->peer_dh_tmp);-
395 EC_KEY_free(sc->peer_ecdh_tmp);-
396 free(sc->peer_x25519_tmp);-
397-
398 free(sc);-
399}
executed 70 times by 2 tests: end of block
Executed by:
  • ssltest
  • tlstest
70
400-
401int-
402ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)-
403{-
404 X509_STORE_CTX ctx;-
405 X509 *x;-
406 int ret;-
407-
408 if ((sk == NULL) || (sk_X509_num(sk) == 0))
(sk == ((void *)0) )Description
TRUEnever evaluated
FALSEevaluated 60 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
(sk_num(((_STA...09*)0))) == 0)Description
TRUEnever evaluated
FALSEevaluated 60 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-60
409 return (0);
never executed: return (0);
0
410-
411 x = sk_X509_value(sk, 0);-
412 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
!X509_STORE_CT..._store, x, sk)Description
TRUEnever evaluated
FALSEevaluated 60 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
0-60
413 SSLerror(s, ERR_R_X509_LIB);-
414 return (0);
never executed: return (0);
0
415 }-
416 X509_STORE_CTX_set_ex_data(&ctx,-
417 SSL_get_ex_data_X509_STORE_CTX_idx(), s);-
418-
419 /*-
420 * We need to inherit the verify parameters. These can be-
421 * determined by the context: if its a server it will verify-
422 * SSL client certificates or vice versa.-
423 */-
424 X509_STORE_CTX_set_default(&ctx,-
425 s->server ? "ssl_client" : "ssl_server");-
426-
427 /*-
428 * Anything non-default in "param" should overwrite anything-
429 * in the ctx.-
430 */-
431 X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx), s->param);-
432-
433 if (s->internal->verify_callback)
s->internal->verify_callbackDescription
TRUEevaluated 14 times by 1 test
Evaluated by:
  • ssltest
FALSEevaluated 46 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
14-46
434 X509_STORE_CTX_set_verify_cb(&ctx, s->internal->verify_callback);
executed 14 times by 1 test: X509_STORE_CTX_set_verify_cb(&ctx, s->internal->verify_callback);
Executed by:
  • ssltest
14
435-
436 if (s->ctx->internal->app_verify_callback != NULL)
s->ctx->intern...!= ((void *)0)Description
TRUEevaluated 18 times by 2 tests
Evaluated by:
  • ssltest
  • tlstest
FALSEevaluated 42 times by 1 test
Evaluated by:
  • ssltest
18-42
437 ret = s->ctx->internal->app_verify_callback(&ctx,
executed 18 times by 2 tests: ret = s->ctx->internal->app_verify_callback(&ctx, s->ctx->internal->app_verify_arg);
Executed by:
  • ssltest
  • tlstest
18
438 s->ctx->internal->app_verify_arg);
executed 18 times by 2 tests: ret = s->ctx->internal->app_verify_callback(&ctx, s->ctx->internal->app_verify_arg);
Executed by:
  • ssltest
  • tlstest
18
439 else-
440 ret = X509_verify_cert(&ctx);
executed 42 times by 1 test: ret = X509_verify_cert(&ctx);
Executed by:
  • ssltest
42
441-
442 s->verify_result = ctx.error;-
443 X509_STORE_CTX_cleanup(&ctx);-
444-
445 return (ret);
executed 60 times by 2 tests: return (ret);
Executed by:
  • ssltest
  • tlstest
60
446}-
447-
448static void-
449set_client_CA_list(STACK_OF(X509_NAME) **ca_list,-
450 STACK_OF(X509_NAME) *name_list)-
451{-
452 sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);-
453 *ca_list = name_list;-
454}
never executed: end of block
0
455-
456STACK_OF(X509_NAME) *-
457SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk)-
458{-
459 int i;-
460 STACK_OF(X509_NAME) *ret;-
461 X509_NAME *name;-
462-
463 ret = sk_X509_NAME_new_null();-
464 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
i < sk_num(((_...509_NAME*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
465 name = X509_NAME_dup(sk_X509_NAME_value(sk, i));-
466 if ((name == NULL) || !sk_X509_NAME_push(ret, name)) {
(name == ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
!sk_push(((_ST...509_NAME*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
467 sk_X509_NAME_pop_free(ret, X509_NAME_free);-
468 return (NULL);
never executed: return ( ((void *)0) );
0
469 }-
470 }
never executed: end of block
0
471 return (ret);
never executed: return (ret);
0
472}-
473-
474void-
475SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)-
476{-
477 set_client_CA_list(&(s->internal->client_CA), name_list);-
478}
never executed: end of block
0
479-
480void-
481SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)-
482{-
483 set_client_CA_list(&(ctx->internal->client_CA), name_list);-
484}
never executed: end of block
0
485-
486STACK_OF(X509_NAME) *-
487SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)-
488{-
489 return (ctx->internal->client_CA);
never executed: return (ctx->internal->client_CA);
0
490}-
491-
492STACK_OF(X509_NAME) *-
493SSL_get_client_CA_list(const SSL *s)-
494{-
495 if (s->internal->type == SSL_ST_CONNECT) {
s->internal->type == 0x1000Description
TRUEnever evaluated
FALSEevaluated 7 times by 1 test
Evaluated by:
  • ssltest
0-7
496 /* We are in the client. */-
497 if (((s->version >> 8) == SSL3_VERSION_MAJOR) &&
((s->version >> 8) == 0x03)Description
TRUEnever evaluated
FALSEnever evaluated
0
498 (s->s3 != NULL))
(s->s3 != ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
0
499 return (S3I(s)->tmp.ca_names);
never executed: return ((s->s3->internal)->tmp.ca_names);
0
500 else-
501 return (NULL);
never executed: return ( ((void *)0) );
0
502 } else {-
503 if (s->internal->client_CA != NULL)
s->internal->c...!= ((void *)0)Description
TRUEnever evaluated
FALSEevaluated 7 times by 1 test
Evaluated by:
  • ssltest
0-7
504 return (s->internal->client_CA);
never executed: return (s->internal->client_CA);
0
505 else-
506 return (s->ctx->internal->client_CA);
executed 7 times by 1 test: return (s->ctx->internal->client_CA);
Executed by:
  • ssltest
7
507 }-
508}-
509-
510static int-
511add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x)-
512{-
513 X509_NAME *name;-
514-
515 if (x == NULL)
x == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
516 return (0);
never executed: return (0);
0
517 if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL))
(*sk == ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
((*sk = ((stru... ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
0
518 return (0);
never executed: return (0);
0
519-
520 if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL)
(name = X509_N...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
521 return (0);
never executed: return (0);
0
522-
523 if (!sk_X509_NAME_push(*sk, name)) {
!sk_push(((_ST...509_NAME*)0)))Description
TRUEnever evaluated
FALSEnever evaluated
0
524 X509_NAME_free(name);-
525 return (0);
never executed: return (0);
0
526 }-
527 return (1);
never executed: return (1);
0
528}-
529-
530int-
531SSL_add_client_CA(SSL *ssl, X509 *x)-
532{-
533 return (add_client_CA(&(ssl->internal->client_CA), x));
never executed: return (add_client_CA(&(ssl->internal->client_CA), x));
0
534}-
535-
536int-
537SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)-
538{-
539 return (add_client_CA(&(ctx->internal->client_CA), x));
never executed: return (add_client_CA(&(ctx->internal->client_CA), x));
0
540}-
541-
542static int-
543xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)-
544{-
545 return (X509_NAME_cmp(*a, *b));
never executed: return (X509_NAME_cmp(*a, *b));
0
546}-
547-
548/*!-
549 * Load CA certs from a file into a ::STACK. Note that it is somewhat misnamed;-
550 * it doesn't really have anything to do with clients (except that a common use-
551 * for a stack of CAs is to send it to the client). Actually, it doesn't have-
552 * much to do with CAs, either, since it will load any old cert.-
553 * \param file the file containing one or more certs.-
554 * \return a ::STACK containing the certs.-
555 */-
556STACK_OF(X509_NAME) *-
557SSL_load_client_CA_file(const char *file)-
558{-
559 BIO *in;-
560 X509 *x = NULL;-
561 X509_NAME *xn = NULL;-
562 STACK_OF(X509_NAME) *ret = NULL, *sk;-
563-
564 sk = sk_X509_NAME_new(xname_cmp);-
565-
566 in = BIO_new(BIO_s_file_internal());-
567-
568 if ((sk == NULL) || (in == NULL)) {
(sk == ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
(in == ((void *)0) )Description
TRUEnever evaluated
FALSEnever evaluated
0
569 SSLerrorx(ERR_R_MALLOC_FAILURE);-
570 goto err;
never executed: goto err;
0
571 }-
572-
573 if (!BIO_read_filename(in, file))
!BIO_ctrl(in,1...,(char *)file)Description
TRUEnever evaluated
FALSEnever evaluated
0
574 goto err;
never executed: goto err;
0
575-
576 for (;;) {-
577 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
PEM_read_bio_X...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
578 break;
never executed: break;
0
579 if (ret == NULL) {
ret == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
580 ret = sk_X509_NAME_new_null();-
581 if (ret == NULL) {
ret == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
582 SSLerrorx(ERR_R_MALLOC_FAILURE);-
583 goto err;
never executed: goto err;
0
584 }-
585 }
never executed: end of block
0
586 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
never executed: goto err;
(xn = X509_get...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
587 /* check for duplicates */-
588 xn = X509_NAME_dup(xn);-
589 if (xn == NULL)
xn == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
590 goto err;
never executed: goto err;
0
591 if (sk_X509_NAME_find(sk, xn) >= 0)
sk_find(((_STA...AME*)0))) >= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
592 X509_NAME_free(xn);
never executed: X509_NAME_free(xn);
0
593 else {-
594 sk_X509_NAME_push(sk, xn);-
595 sk_X509_NAME_push(ret, xn);-
596 }
never executed: end of block
0
597 }-
598-
599 if (0) {-
600err:-
601 sk_X509_NAME_pop_free(ret, X509_NAME_free);-
602 ret = NULL;-
603 }
never executed: end of block
0
604 sk_X509_NAME_free(sk);-
605 BIO_free(in);-
606 X509_free(x);-
607 if (ret != NULL)
ret != ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
608 ERR_clear_error();
never executed: ERR_clear_error();
0
609-
610 return (ret);
never executed: return (ret);
0
611}-
612-
613/*!-
614 * Add a file of certs to a stack.-
615 * \param stack the stack to add to.-
616 * \param file the file to add from. All certs in this file that are not-
617 * already in the stack will be added.-
618 * \return 1 for success, 0 for failure. Note that in the case of failure some-
619 * certs may have been added to \c stack.-
620 */-
621-
622int-
623SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,-
624 const char *file)-
625{-
626 BIO *in;-
627 X509 *x = NULL;-
628 X509_NAME *xn = NULL;-
629 int ret = 1;-
630 int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b);-
631-
632 oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);-
633-
634 in = BIO_new(BIO_s_file_internal());-
635-
636 if (in == NULL) {
in == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
637 SSLerrorx(ERR_R_MALLOC_FAILURE);-
638 goto err;
never executed: goto err;
0
639 }-
640-
641 if (!BIO_read_filename(in, file))
!BIO_ctrl(in,1...,(char *)file)Description
TRUEnever evaluated
FALSEnever evaluated
0
642 goto err;
never executed: goto err;
0
643-
644 for (;;) {-
645 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
PEM_read_bio_X...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
646 break;
never executed: break;
0
647 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
never executed: goto err;
(xn = X509_get...== ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
648 xn = X509_NAME_dup(xn);-
649 if (xn == NULL)
xn == ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
650 goto err;
never executed: goto err;
0
651 if (sk_X509_NAME_find(stack, xn) >= 0)
sk_find(((_STA...AME*)0))) >= 0Description
TRUEnever evaluated
FALSEnever evaluated
0
652 X509_NAME_free(xn);
never executed: X509_NAME_free(xn);
0
653 else-
654 sk_X509_NAME_push(stack, xn);
never executed: sk_push(((_STACK*) (1 ? (stack) : (struct stack_st_X509_NAME*)0)), ((void*) (1 ? (xn) : (X509_NAME*)0)));
0
655 }-
656-
657 ERR_clear_error();-
658-
659 if (0) {-
660err:-
661 ret = 0;-
662 }
never executed: end of block
0
663 BIO_free(in);-
664 X509_free(x);-
665-
666 (void)sk_X509_NAME_set_cmp_func(stack, oldcmp);-
667-
668 return ret;
never executed: return ret;
0
669}-
670-
671/*!-
672 * Add a directory of certs to a stack.-
673 * \param stack the stack to append to.-
674 * \param dir the directory to append from. All files in this directory will be-
675 * examined as potential certs. Any that are acceptable to-
676 * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will-
677 * be included.-
678 * \return 1 for success, 0 for failure. Note that in the case of failure some-
679 * certs may have been added to \c stack.-
680 */-
681-
682int-
683SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, const char *dir)-
684{-
685 DIR *dirp = NULL;-
686 char *path = NULL;-
687 int ret = 0;-
688-
689 dirp = opendir(dir);-
690 if (dirp) {
dirpDescription
TRUEnever evaluated
FALSEnever evaluated
0
691 struct dirent *dp;-
692 while ((dp = readdir(dirp)) != NULL) {
(dp = readdir(...!= ((void *)0)Description
TRUEnever evaluated
FALSEnever evaluated
0
693 if (asprintf(&path, "%s/%s", dir, dp->d_name) != -1) {
asprintf(&path...>d_name) != -1Description
TRUEnever evaluated
FALSEnever evaluated
0
694 ret = SSL_add_file_cert_subjects_to_stack(-
695 stack, path);-
696 free(path);-
697 }
never executed: end of block
0
698 if (!ret)
!retDescription
TRUEnever evaluated
FALSEnever evaluated
0
699 break;
never executed: break;
0
700 }
never executed: end of block
0
701 (void) closedir(dirp);-
702 }
never executed: end of block
0
703 if (!ret) {
!retDescription
TRUEnever evaluated
FALSEnever evaluated
0
704 SYSerror(errno);-
705 ERR_asprintf_error_data("opendir ('%s')", dir);-
706 SSLerrorx(ERR_R_SYS_LIB);-
707 }
never executed: end of block
0
708 return ret;
never executed: return ret;
0
709}-
Source codeSwitch to Preprocessed file
Generated by Squish Coco 4.2.2