From b54cab31d2593421198f75e715b5f851ce24fe6b Mon Sep 17 00:00:00 2001
From: Shane Lontis <shane.lontis@oracle.com>
Date: Tue, 9 Mar 2021 13:23:45 +1000
Subject: [PATCH] Add ossl_ symbol to x509 policy
Partial fix for #12964
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14473)
---
crypto/x509/pcy_cache.c | 20 +++++++++---------
crypto/x509/pcy_data.c | 6 +++---
crypto/x509/pcy_local.h | 44 ++++++++++++++++++--------------------
crypto/x509/pcy_map.c | 12 +++++------
crypto/x509/pcy_node.c | 30 +++++++++++++-------------
crypto/x509/pcy_tree.c | 47 ++++++++++++++++++++++-------------------
crypto/x509/x_x509.c | 6 +++---
7 files changed, 83 insertions(+), 82 deletions(-)
diff --git a/crypto/x509/pcy_cache.c b/crypto/x509/pcy_cache.c
index 22cf431895..dfb757f67f 100644
--- a/crypto/x509/pcy_cache.c
+++ b/crypto/x509/pcy_cache.c
@@ -40,7 +40,7 @@ static int policy_cache_create(X509 *x,
}
for (i = 0; i < num; i++) {
policy = sk_POLICYINFO_value(policies, i);
- data = policy_data_new(policy, NULL, crit);
+ data = ossl_policy_data_new(policy, NULL, crit);
if (data == NULL) {
ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
goto just_cleanup;
@@ -68,11 +68,11 @@ static int policy_cache_create(X509 *x,
bad_policy:
if (ret == -1)
x->ex_flags |= EXFLAG_INVALID_POLICY;
- policy_data_free(data);
+ ossl_policy_data_free(data);
just_cleanup:
sk_POLICYINFO_pop_free(policies, POLICYINFO_free);
if (ret <= 0) {
- sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
+ sk_X509_POLICY_DATA_pop_free(cache->data, ossl_policy_data_free);
cache->data = NULL;
}
return ret;
@@ -151,7 +151,7 @@ static int policy_cache_new(X509 *x)
if (i != -1)
goto bad_cache;
} else {
- i = policy_cache_set_mapping(x, ext_pmaps);
+ i = ossl_policy_cache_set_mapping(x, ext_pmaps);
if (i <= 0)
goto bad_cache;
}
@@ -175,16 +175,16 @@ static int policy_cache_new(X509 *x)
}
-void policy_cache_free(X509_POLICY_CACHE *cache)
+void ossl_policy_cache_free(X509_POLICY_CACHE *cache)
{
if (!cache)
return;
- policy_data_free(cache->anyPolicy);
- sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
+ ossl_policy_data_free(cache->anyPolicy);
+ sk_X509_POLICY_DATA_pop_free(cache->data, ossl_policy_data_free);
OPENSSL_free(cache);
}
-const X509_POLICY_CACHE *policy_cache_set(X509 *x)
+const X509_POLICY_CACHE *ossl_policy_cache_set(X509 *x)
{
if (x->policy_cache == NULL) {
@@ -198,8 +198,8 @@ const X509_POLICY_CACHE *policy_cache_set(X509 *x)
}
-X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
- const ASN1_OBJECT *id)
+X509_POLICY_DATA *ossl_policy_cache_find_data(const X509_POLICY_CACHE *cache,
+ const ASN1_OBJECT *id)
{
int idx;
X509_POLICY_DATA tmp;
diff --git a/crypto/x509/pcy_data.c b/crypto/x509/pcy_data.c
index 584ac1c2dd..7db465bbf6 100644
--- a/crypto/x509/pcy_data.c
+++ b/crypto/x509/pcy_data.c
@@ -15,7 +15,7 @@
/* Policy Node routines */
-void policy_data_free(X509_POLICY_DATA *data)
+void ossl_policy_data_free(X509_POLICY_DATA *data)
{
if (data == NULL)
return;
@@ -35,8 +35,8 @@ void policy_data_free(X509_POLICY_DATA *data)
* source.
*/
-X509_POLICY_DATA *policy_data_new(POLICYINFO *policy,
- const ASN1_OBJECT *cid, int crit)
+X509_POLICY_DATA *ossl_policy_data_new(POLICYINFO *policy,
+ const ASN1_OBJECT *cid, int crit)
{
X509_POLICY_DATA *ret;
ASN1_OBJECT *id;
diff --git a/crypto/x509/pcy_local.h b/crypto/x509/pcy_local.h
index 0deee52c1b..893b5cc51d 100644
--- a/crypto/x509/pcy_local.h
+++ b/crypto/x509/pcy_local.h
@@ -135,33 +135,31 @@ struct X509_POLICY_TREE_st {
/* Internal functions */
-X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
- int crit);
-void policy_data_free(X509_POLICY_DATA *data);
+X509_POLICY_DATA *ossl_policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
+ int crit);
+void ossl_policy_data_free(X509_POLICY_DATA *data);
-X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
- const ASN1_OBJECT *id);
-int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
+X509_POLICY_DATA *ossl_policy_cache_find_data(const X509_POLICY_CACHE *cache,
+ const ASN1_OBJECT *id);
+int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
-STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
+STACK_OF(X509_POLICY_NODE) *ossl_policy_node_cmp_new(void);
-void policy_cache_init(void);
+void ossl_policy_cache_free(X509_POLICY_CACHE *cache);
-void policy_cache_free(X509_POLICY_CACHE *cache);
+X509_POLICY_NODE *ossl_policy_level_find_node(const X509_POLICY_LEVEL *level,
+ const X509_POLICY_NODE *parent,
+ const ASN1_OBJECT *id);
-X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
- const X509_POLICY_NODE *parent,
- const ASN1_OBJECT *id);
+X509_POLICY_NODE *ossl_policy_tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
+ const ASN1_OBJECT *id);
-X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
- const ASN1_OBJECT *id);
+X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
+ X509_POLICY_DATA *data,
+ X509_POLICY_NODE *parent,
+ X509_POLICY_TREE *tree);
+void ossl_policy_node_free(X509_POLICY_NODE *node);
+int ossl_policy_node_match(const X509_POLICY_LEVEL *lvl,
+ const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
-X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
- X509_POLICY_DATA *data,
- X509_POLICY_NODE *parent,
- X509_POLICY_TREE *tree);
-void policy_node_free(X509_POLICY_NODE *node);
-int policy_node_match(const X509_POLICY_LEVEL *lvl,
- const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
-
-const X509_POLICY_CACHE *policy_cache_set(X509 *x);
+const X509_POLICY_CACHE *ossl_policy_cache_set(X509 *x);
diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
index a1210ef37f..b599ff9804 100644
--- a/crypto/x509/pcy_map.c
+++ b/crypto/x509/pcy_map.c
@@ -19,7 +19,7 @@
* POLICY_MAPPINGS structure
*/
-int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
+int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
{
POLICY_MAPPING *map;
X509_POLICY_DATA *data;
@@ -40,16 +40,16 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
}
/* Attempt to find matching policy data */
- data = policy_cache_find_data(cache, map->issuerDomainPolicy);
+ data = ossl_policy_cache_find_data(cache, map->issuerDomainPolicy);
/* If we don't have anyPolicy can't map */
if (data == NULL && !cache->anyPolicy)
continue;
/* Create a NODE from anyPolicy */
if (data == NULL) {
- data = policy_data_new(NULL, map->issuerDomainPolicy,
- cache->anyPolicy->flags
- & POLICY_DATA_FLAG_CRITICAL);
+ data = ossl_policy_data_new(NULL, map->issuerDomainPolicy,
+ cache->anyPolicy->flags
+ & POLICY_DATA_FLAG_CRITICAL);
if (data == NULL)
goto bad_mapping;
data->qualifier_set = cache->anyPolicy->qualifier_set;
@@ -59,7 +59,7 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
data->flags |= POLICY_DATA_FLAG_MAPPED_ANY;
data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
if (!sk_X509_POLICY_DATA_push(cache->data, data)) {
- policy_data_free(data);
+ ossl_policy_data_free(data);
goto bad_mapping;
}
} else
diff --git a/crypto/x509/pcy_node.c b/crypto/x509/pcy_node.c
index 75207e0a10..c69ccd7b23 100644
--- a/crypto/x509/pcy_node.c
+++ b/crypto/x509/pcy_node.c
@@ -20,13 +20,13 @@ static int node_cmp(const X509_POLICY_NODE *const *a,
return OBJ_cmp((*a)->data->valid_policy, (*b)->data->valid_policy);
}
-STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void)
+STACK_OF(X509_POLICY_NODE) *ossl_policy_node_cmp_new(void)
{
return sk_X509_POLICY_NODE_new(node_cmp);
}
-X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes,
- const ASN1_OBJECT *id)
+X509_POLICY_NODE *ossl_policy_tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes,
+ const ASN1_OBJECT *id)
{
X509_POLICY_DATA n;
X509_POLICY_NODE l;
@@ -40,9 +40,9 @@ X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes,
}
-X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
- const X509_POLICY_NODE *parent,
- const ASN1_OBJECT *id)
+X509_POLICY_NODE *ossl_policy_level_find_node(const X509_POLICY_LEVEL *level,
+ const X509_POLICY_NODE *parent,
+ const ASN1_OBJECT *id)
{
X509_POLICY_NODE *node;
int i;
@@ -56,10 +56,10 @@ X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
return NULL;
}
-X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
- X509_POLICY_DATA *data,
- X509_POLICY_NODE *parent,
- X509_POLICY_TREE *tree)
+X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
+ X509_POLICY_DATA *data,
+ X509_POLICY_NODE *parent,
+ X509_POLICY_TREE *tree)
{
X509_POLICY_NODE *node;
@@ -78,7 +78,7 @@ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
} else {
if (level->nodes == NULL)
- level->nodes = policy_node_cmp_new();
+ level->nodes = ossl_policy_node_cmp_new();
if (level->nodes == NULL) {
ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
goto node_error;
@@ -109,11 +109,11 @@ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
return node;
node_error:
- policy_node_free(node);
+ ossl_policy_node_free(node);
return NULL;
}
-void policy_node_free(X509_POLICY_NODE *node)
+void ossl_policy_node_free(X509_POLICY_NODE *node)
{
OPENSSL_free(node);
}
@@ -123,8 +123,8 @@ void policy_node_free(X509_POLICY_NODE *node)
* expected policy set otherwise just valid policy.
*/
-int policy_node_match(const X509_POLICY_LEVEL *lvl,
- const X509_POLICY_NODE *node, const ASN1_OBJECT *oid)
+int ossl_policy_node_match(const X509_POLICY_LEVEL *lvl,
+ const X509_POLICY_NODE *node, const ASN1_OBJECT *oid)
{
int i;
ASN1_OBJECT *policy_oid;
diff --git a/crypto/x509/pcy_tree.c b/crypto/x509/pcy_tree.c
index ab5c677ea1..fa45da5117 100644
--- a/crypto/x509/pcy_tree.c
+++ b/crypto/x509/pcy_tree.c
@@ -113,7 +113,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
X509_check_purpose(x, -1, 0);
/* If cache is NULL, likely ENOMEM: return immediately */
- if (policy_cache_set(x) == NULL)
+ if (ossl_policy_cache_set(x) == NULL)
return X509_PCY_TREE_INTERNAL;
}
@@ -139,7 +139,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
return X509_PCY_TREE_INVALID;
/* Access the cache which we now know exists */
- cache = policy_cache_set(x);
+ cache = ossl_policy_cache_set(x);
if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL)
ret = X509_PCY_TREE_EMPTY;
@@ -177,10 +177,11 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
}
tree->nlevel = n+1;
level = tree->levels;
- if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
+ if ((data = ossl_policy_data_new(NULL,
+ OBJ_nid2obj(NID_any_policy), 0)) == NULL)
goto bad_tree;
- if (level_add_node(level, data, NULL, tree) == NULL) {
- policy_data_free(data);
+ if (ossl_policy_level_add_node(level, data, NULL, tree) == NULL) {
+ ossl_policy_data_free(data);
goto bad_tree;
}
@@ -193,7 +194,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
uint32_t ex_flags = X509_get_extension_flags(x);
/* Access the cache which we now know exists */
- cache = policy_cache_set(x);
+ cache = ossl_policy_cache_set(x);
X509_up_ref(x);
(++level)->cert = x;
@@ -247,14 +248,14 @@ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) {
X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i);
- if (policy_node_match(last, node, data->valid_policy)) {
- if (level_add_node(curr, data, node, NULL) == NULL)
+ if (ossl_policy_node_match(last, node, data->valid_policy)) {
+ if (ossl_policy_level_add_node(curr, data, node, NULL) == NULL)
return 0;
matched = 1;
}
}
if (!matched && last->anyPolicy) {
- if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL)
+ if (ossl_policy_level_add_node(curr, data, last->anyPolicy, NULL) == NULL)
return 0;
}
return 1;
@@ -300,14 +301,14 @@ static int tree_add_unmatched(X509_POLICY_LEVEL *curr,
* Create a new node with qualifiers from anyPolicy and id from unmatched
* node.
*/
- if ((data = policy_data_new(NULL, id, node_critical(node))) == NULL)
+ if ((data = ossl_policy_data_new(NULL, id, node_critical(node))) == NULL)
return 0;
/* Curr may not have anyPolicy */
data->qualifier_set = cache->anyPolicy->qualifier_set;
data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
- if (level_add_node(curr, data, node, tree) == NULL) {
- policy_data_free(data);
+ if (ossl_policy_level_add_node(curr, data, node, tree) == NULL) {
+ ossl_policy_data_free(data);
return 0;
}
return 1;
@@ -339,7 +340,7 @@ static int tree_link_unmatched(X509_POLICY_LEVEL *curr,
/* Locate unmatched nodes */
for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) {
ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i);
- if (level_find_node(curr, node, oid))
+ if (ossl_policy_level_find_node(curr, node, oid))
continue;
if (!tree_add_unmatched(curr, cache, oid, node, tree))
return 0;
@@ -368,7 +369,8 @@ static int tree_link_any(X509_POLICY_LEVEL *curr,
}
/* Finally add link to anyPolicy */
if (last->anyPolicy &&
- level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL)
+ ossl_policy_level_add_node(curr, cache->anyPolicy,
+ last->anyPolicy, NULL) == NULL)
return 0;
return 1;
}
@@ -435,7 +437,7 @@ static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes,
X509_POLICY_NODE *pcy)
{
if (*pnodes == NULL &&
- (*pnodes = policy_node_cmp_new()) == NULL)
+ (*pnodes = ossl_policy_node_cmp_new()) == NULL)
return 0;
if (sk_X509_POLICY_NODE_find(*pnodes, pcy) >= 0)
return 1;
@@ -536,7 +538,7 @@ static int tree_calculate_user_set(X509_POLICY_TREE *tree,
for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) {
oid = sk_ASN1_OBJECT_value(policy_oids, i);
- node = tree_find_sk(auth_nodes, oid);
+ node = ossl_policy_tree_find_sk(auth_nodes, oid);
if (!node) {
if (!anyPolicy)
continue;
@@ -544,13 +546,14 @@ static int tree_calculate_user_set(X509_POLICY_TREE *tree,
* Create a new node with policy ID from user set and qualifiers
* from anyPolicy.
*/
- extra = policy_data_new(NULL, oid, node_critical(anyPolicy));
+ extra = ossl_policy_data_new(NULL, oid, node_critical(anyPolicy));
if (extra == NULL)
return 0;
extra->qualifier_set = anyPolicy->data->qualifier_set;
extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS
| POLICY_DATA_FLAG_EXTRA_NODE;
- node = level_add_node(NULL, extra, anyPolicy->parent, tree);
+ node = ossl_policy_level_add_node(NULL, extra, anyPolicy->parent,
+ tree);
}
if (!tree->user_policies) {
tree->user_policies = sk_X509_POLICY_NODE_new_null();
@@ -576,7 +579,7 @@ static int tree_evaluate(X509_POLICY_TREE *tree)
const X509_POLICY_CACHE *cache;
for (i = 1; i < tree->nlevel; i++, curr++) {
- cache = policy_cache_set(curr->cert);
+ cache = ossl_policy_cache_set(curr->cert);
if (!tree_link_nodes(curr, cache))
return X509_PCY_TREE_INTERNAL;
@@ -610,11 +613,11 @@ void X509_policy_tree_free(X509_POLICY_TREE *tree)
for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) {
X509_free(curr->cert);
- sk_X509_POLICY_NODE_pop_free(curr->nodes, policy_node_free);
- policy_node_free(curr->anyPolicy);
+ sk_X509_POLICY_NODE_pop_free(curr->nodes, ossl_policy_node_free);
+ ossl_policy_node_free(curr->anyPolicy);
}
- sk_X509_POLICY_DATA_pop_free(tree->extra_data, policy_data_free);
+ sk_X509_POLICY_DATA_pop_free(tree->extra_data, ossl_policy_data_free);
OPENSSL_free(tree->levels);
OPENSSL_free(tree);
diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c
index 8597614259..b6f9f043b8 100644
--- a/crypto/x509/x_x509.c
+++ b/crypto/x509/x_x509.c
@@ -31,7 +31,7 @@ ASN1_SEQUENCE_enc(X509_CINF, enc, 0) = {
IMPLEMENT_ASN1_FUNCTIONS(X509_CINF)
/* X509 top level structure needs a bit of customisation */
-extern void policy_cache_free(X509_POLICY_CACHE *cache);
+extern void ossl_policy_cache_free(X509_POLICY_CACHE *cache);
static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
void *exarg)
@@ -46,7 +46,7 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
ASN1_OCTET_STRING_free(ret->skid);
AUTHORITY_KEYID_free(ret->akid);
CRL_DIST_POINTS_free(ret->crldp);
- policy_cache_free(ret->policy_cache);
+ ossl_policy_cache_free(ret->policy_cache);
GENERAL_NAMES_free(ret->altname);
NAME_CONSTRAINTS_free(ret->nc);
#ifndef OPENSSL_NO_RFC3779
@@ -87,7 +87,7 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
ASN1_OCTET_STRING_free(ret->skid);
AUTHORITY_KEYID_free(ret->akid);
CRL_DIST_POINTS_free(ret->crldp);
- policy_cache_free(ret->policy_cache);
+ ossl_policy_cache_free(ret->policy_cache);
GENERAL_NAMES_free(ret->altname);
NAME_CONSTRAINTS_free(ret->nc);
#ifndef OPENSSL_NO_RFC3779