aboutsummaryrefslogtreecommitdiffstats
path: root/src/_cffi_src/openssl/x509_vfy.py
diff options
context:
space:
mode:
Diffstat (limited to 'src/_cffi_src/openssl/x509_vfy.py')
-rw-r--r--src/_cffi_src/openssl/x509_vfy.py208
1 files changed, 69 insertions, 139 deletions
diff --git a/src/_cffi_src/openssl/x509_vfy.py b/src/_cffi_src/openssl/x509_vfy.py
index 23ac8483..d2bc5f4e 100644
--- a/src/_cffi_src/openssl/x509_vfy.py
+++ b/src/_cffi_src/openssl/x509_vfy.py
@@ -15,36 +15,23 @@ INCLUDES = """
* Note that the result is an opaque type.
*/
typedef STACK_OF(ASN1_OBJECT) Cryptography_STACK_OF_ASN1_OBJECT;
+typedef STACK_OF(X509_OBJECT) Cryptography_STACK_OF_X509_OBJECT;
"""
TYPES = """
-static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES;
-static const long Cryptography_HAS_102_VERIFICATION_PARAMS;
-static const long Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST;
-static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN;
-static const long Cryptography_HAS_100_VERIFICATION_ERROR_CODES;
-static const long Cryptography_HAS_100_VERIFICATION_PARAMS;
-static const long Cryptography_HAS_X509_V_FLAG_CHECK_SS_SIGNATURE;
+static const long Cryptography_HAS_102_VERIFICATION;
+static const long Cryptography_HAS_110_VERIFICATION_PARAMS;
+static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER;
typedef ... Cryptography_STACK_OF_ASN1_OBJECT;
+typedef ... Cryptography_STACK_OF_X509_OBJECT;
+typedef ... X509_OBJECT;
typedef ... X509_STORE;
typedef ... X509_VERIFY_PARAM;
+typedef ... X509_STORE_CTX;
-typedef struct x509_store_ctx_st X509_STORE_CTX;
-struct x509_store_ctx_st {
- X509_STORE *ctx;
- int current_method;
- X509 *cert;
- Cryptography_STACK_OF_X509 *untrusted;
- Cryptography_STACK_OF_X509_CRL *crls;
- X509_VERIFY_PARAM *param;
- void *other_ctx;
- int (*verify)(X509_STORE_CTX *);
- int (*verify_cb)(int, X509_STORE_CTX *);
- int (*get_issuer)(X509 **, X509_STORE_CTX *, X509 *);
- ...;
-};
+typedef int (*X509_STORE_CTX_get_issuer_fn)(X509 **, X509_STORE_CTX *, X509 *);
/* While these are defined in the source as ints, they're tagged here
as longs, just in case they ever grow to large, such as what we saw
@@ -136,6 +123,16 @@ static const long X509_V_FLAG_SUITEB_128_LOS_ONLY;
static const long X509_V_FLAG_SUITEB_192_LOS;
static const long X509_V_FLAG_SUITEB_128_LOS;
static const long X509_V_FLAG_PARTIAL_CHAIN;
+
+static const long X509_LU_X509;
+static const long X509_LU_CRL;
+
+static const long X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT;
+static const long X509_CHECK_FLAG_NO_WILDCARDS;
+static const long X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
+static const long X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS;
+static const long X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS;
+static const long X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
"""
FUNCTIONS = """
@@ -151,7 +148,6 @@ int X509_STORE_set_default_paths(X509_STORE *);
int X509_STORE_set_flags(X509_STORE *, unsigned long);
void X509_STORE_free(X509_STORE *);
-
/* X509_STORE_CTX */
X509_STORE_CTX *X509_STORE_CTX_new(void);
void X509_STORE_CTX_cleanup(X509_STORE_CTX *);
@@ -175,6 +171,7 @@ int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *);
X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *);
int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *, int, void *);
void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *, int);
+int X509_STORE_CTX_get1_issuer(X509 **, X509_STORE_CTX *, X509 *);
/* X509_VERIFY_PARAM */
X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
@@ -189,9 +186,11 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *,
Cryptography_STACK_OF_ASN1_OBJECT *);
void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *, int);
int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *);
-"""
+void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *);
+/* this CRYPTO_EX_DATA function became a macro in 1.1.0 */
+int X509_STORE_CTX_get_ex_new_index(long, void *, CRYPTO_EX_new *,
+ CRYPTO_EX_dup *, CRYPTO_EX_free *);
-MACROS = """
/* X509_STORE_CTX */
void X509_STORE_CTX_set0_crls(X509_STORE_CTX *,
Cryptography_STACK_OF_X509_CRL *);
@@ -205,143 +204,74 @@ int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *, const char *,
int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *, const unsigned char *,
size_t);
int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *, const char *);
+
+int sk_X509_OBJECT_num(Cryptography_STACK_OF_X509_OBJECT *);
+X509_OBJECT *sk_X509_OBJECT_value(Cryptography_STACK_OF_X509_OBJECT *, int);
+X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *);
+Cryptography_STACK_OF_X509_OBJECT *X509_STORE_get0_objects(X509_STORE *);
+X509 *X509_OBJECT_get0_X509(X509_OBJECT *);
+int X509_OBJECT_get_type(const X509_OBJECT *);
+
+/* added in 1.1.0 */
+X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *);
+X509_STORE_CTX_get_issuer_fn X509_STORE_get_get_issuer(X509_STORE *);
+void X509_STORE_set_get_issuer(X509_STORE *, X509_STORE_CTX_get_issuer_fn);
"""
CUSTOMIZATIONS = """
-/* OpenSSL 1.0.2+ verification error codes */
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
-static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES = 1;
+#if !CRYPTOGRAPHY_IS_LIBRESSL
+static const long Cryptography_HAS_102_VERIFICATION = 1;
#else
-static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES = 0;
+static const long Cryptography_HAS_102_VERIFICATION = 0;
static const long X509_V_ERR_SUITE_B_INVALID_VERSION = 0;
static const long X509_V_ERR_SUITE_B_INVALID_ALGORITHM = 0;
static const long X509_V_ERR_SUITE_B_INVALID_CURVE = 0;
static const long X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM = 0;
static const long X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED = 0;
static const long X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 = 0;
-static const long X509_V_ERR_HOSTNAME_MISMATCH = 0;
-static const long X509_V_ERR_EMAIL_MISMATCH = 0;
-static const long X509_V_ERR_IP_ADDRESS_MISMATCH = 0;
-#endif
-
-/* OpenSSL 1.0.2+ verification parameters */
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
-static const long Cryptography_HAS_102_VERIFICATION_PARAMS = 1;
-#else
-static const long Cryptography_HAS_102_VERIFICATION_PARAMS = 0;
-/* X509_V_FLAG_TRUSTED_FIRST is also new in 1.0.2+, but it is added separately
- below because it shows up in some earlier 3rd party OpenSSL packages. */
static const long X509_V_FLAG_SUITEB_128_LOS_ONLY = 0;
static const long X509_V_FLAG_SUITEB_192_LOS = 0;
static const long X509_V_FLAG_SUITEB_128_LOS = 0;
-
-int (*X509_VERIFY_PARAM_set1_host)(X509_VERIFY_PARAM *, const char *,
- size_t) = NULL;
-int (*X509_VERIFY_PARAM_set1_email)(X509_VERIFY_PARAM *, const char *,
- size_t) = NULL;
-int (*X509_VERIFY_PARAM_set1_ip)(X509_VERIFY_PARAM *, const unsigned char *,
- size_t) = NULL;
-int (*X509_VERIFY_PARAM_set1_ip_asc)(X509_VERIFY_PARAM *, const char *) = NULL;
-void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *,
- unsigned int) = NULL;
#endif
-/* OpenSSL 1.0.2+ or Solaris's backport */
-#ifdef X509_V_FLAG_PARTIAL_CHAIN
-static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN = 1;
-#else
-static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN = 0;
-static const long X509_V_FLAG_PARTIAL_CHAIN = 0;
+#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 || CRYPTOGRAPHY_IS_LIBRESSL
+static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 0;
+#ifndef X509_CHECK_FLAG_NEVER_CHECK_SUBJECT
+static const long X509_CHECK_FLAG_NEVER_CHECK_SUBJECT = 0;
#endif
-
-/* OpenSSL 1.0.2+, *or* Fedora 20's flavor of OpenSSL 1.0.1e... */
-#ifdef X509_V_FLAG_TRUSTED_FIRST
-static const long Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST = 1;
#else
-static const long Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST = 0;
-static const long X509_V_FLAG_TRUSTED_FIRST = 0;
+static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 1;
#endif
-/* OpenSSL 1.0.0+ verification error codes */
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
-static const long Cryptography_HAS_100_VERIFICATION_ERROR_CODES = 1;
-#else
-static const long Cryptography_HAS_100_VERIFICATION_ERROR_CODES = 0;
-static const long X509_V_ERR_DIFFERENT_CRL_SCOPE = 0;
-static const long X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE = 0;
-static const long X509_V_ERR_PERMITTED_VIOLATION = 0;
-static const long X509_V_ERR_EXCLUDED_VIOLATION = 0;
-static const long X509_V_ERR_SUBTREE_MINMAX = 0;
-static const long X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE = 0;
-static const long X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX = 0;
-static const long X509_V_ERR_UNSUPPORTED_NAME_SYNTAX = 0;
-static const long X509_V_ERR_CRL_PATH_VALIDATION_ERROR = 0;
-#endif
+#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 && !CRYPTOGRAPHY_IS_LIBRESSL
+Cryptography_STACK_OF_X509_OBJECT *X509_STORE_get0_objects(X509_STORE *ctx) {
+ return ctx->objs;
+}
+X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *store) {
+ return store->param;
+}
+int X509_OBJECT_get_type(const X509_OBJECT *x) {
+ return x->type;
+}
-/* OpenSSL 1.0.0+ verification parameters */
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
-static const long Cryptography_HAS_100_VERIFICATION_PARAMS = 1;
-#else
-static const long Cryptography_HAS_100_VERIFICATION_PARAMS = 0;
-static const long X509_V_FLAG_EXTENDED_CRL_SUPPORT = 0;
-static const long X509_V_FLAG_USE_DELTAS = 0;
+/* from x509/x509_vfy.c */
+X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx)
+{
+ return ctx->cert;
+}
+
+X509 *X509_OBJECT_get0_X509(X509_OBJECT *x) {
+ return x->data.x509;
+}
#endif
-/* OpenSSL 0.9.8recent+ */
-#ifdef X509_V_FLAG_CHECK_SS_SIGNATURE
-static const long Cryptography_HAS_X509_V_FLAG_CHECK_SS_SIGNATURE = 1;
+#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110
+static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER = 0;
+typedef void *X509_STORE_CTX_get_issuer_fn;
+X509_STORE_CTX_get_issuer_fn (*X509_STORE_get_get_issuer)(X509_STORE *) = NULL;
+void (*X509_STORE_set_get_issuer)(X509_STORE *,
+ X509_STORE_CTX_get_issuer_fn) = NULL;
#else
-static const long Cryptography_HAS_X509_V_FLAG_CHECK_SS_SIGNATURE = 0;
-static const long X509_V_FLAG_CHECK_SS_SIGNATURE = 0;
+static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER = 1;
#endif
"""
-
-CONDITIONAL_NAMES = {
- "Cryptography_HAS_102_VERIFICATION_ERROR_CODES": [
- 'X509_V_ERR_SUITE_B_INVALID_VERSION',
- 'X509_V_ERR_SUITE_B_INVALID_ALGORITHM',
- 'X509_V_ERR_SUITE_B_INVALID_CURVE',
- 'X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM',
- 'X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED',
- 'X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256',
- 'X509_V_ERR_HOSTNAME_MISMATCH',
- 'X509_V_ERR_EMAIL_MISMATCH',
- 'X509_V_ERR_IP_ADDRESS_MISMATCH'
- ],
- "Cryptography_HAS_102_VERIFICATION_PARAMS": [
- "X509_V_FLAG_SUITEB_128_LOS_ONLY",
- "X509_V_FLAG_SUITEB_192_LOS",
- "X509_V_FLAG_SUITEB_128_LOS",
- "X509_VERIFY_PARAM_set1_host",
- "X509_VERIFY_PARAM_set1_email",
- "X509_VERIFY_PARAM_set1_ip",
- "X509_VERIFY_PARAM_set1_ip_asc",
- "X509_VERIFY_PARAM_set_hostflags",
- ],
- "Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST": [
- "X509_V_FLAG_TRUSTED_FIRST",
- ],
- "Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN": [
- "X509_V_FLAG_PARTIAL_CHAIN",
- ],
- "Cryptography_HAS_100_VERIFICATION_ERROR_CODES": [
- 'X509_V_ERR_DIFFERENT_CRL_SCOPE',
- 'X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE',
- 'X509_V_ERR_UNNESTED_RESOURCE',
- 'X509_V_ERR_PERMITTED_VIOLATION',
- 'X509_V_ERR_EXCLUDED_VIOLATION',
- 'X509_V_ERR_SUBTREE_MINMAX',
- 'X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE',
- 'X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX',
- 'X509_V_ERR_UNSUPPORTED_NAME_SYNTAX',
- 'X509_V_ERR_CRL_PATH_VALIDATION_ERROR',
- ],
- "Cryptography_HAS_100_VERIFICATION_PARAMS": [
- "Cryptography_HAS_100_VERIFICATION_PARAMS",
- "X509_V_FLAG_EXTENDED_CRL_SUPPORT",
- "X509_V_FLAG_USE_DELTAS",
- ],
- "Cryptography_HAS_X509_V_FLAG_CHECK_SS_SIGNATURE": [
- "X509_V_FLAG_CHECK_SS_SIGNATURE",
- ]
-}
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-17 00:57:25 +0000