/src/openssl/crypto/x509/by_dir.c

Source (jump to first uncovered line)
/*
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#if defined (__TANDEM) && defined (_SPT_MODEL_)
  /*
   * These definitions have to come first in SPT due to scoping of the
   * declarations in c99 associated with SPT use of stat.
   */
# include <sys/types.h>
# include <sys/stat.h>
#endif

#include "internal/e_os.h"
#include "internal/cryptlib.h"
#include <stdio.h>
#include <time.h>
#include <errno.h>
#include <sys/types.h>

#ifndef OPENSSL_NO_POSIX_IO
# include <sys/stat.h>
#endif

#include <openssl/x509.h>
#include "crypto/x509.h"
#include "x509_local.h"

struct lookup_dir_hashes_st {
    unsigned long hash;
    int suffix;
};

struct lookup_dir_entry_st {
    char *dir;
    int dir_type;
    STACK_OF(BY_DIR_HASH) *hashes;
};

typedef struct lookup_dir_st {
    BUF_MEM *buffer;
    STACK_OF(BY_DIR_ENTRY) *dirs;
    CRYPTO_RWLOCK *lock;
} BY_DIR;

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp);

static int new_dir(X509_LOOKUP *lu);
static void free_dir(X509_LOOKUP *lu);
static int add_cert_dir(BY_DIR *ctx, const char *dir, int type);
static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret);
static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                                  const X509_NAME *name, X509_OBJECT *ret,
                                  OSSL_LIB_CTX *libctx, const char *propq);
static X509_LOOKUP_METHOD x509_dir_lookup = {
    "Load certs from files in a directory",
    new_dir,                         /* new_item */
    free_dir,                        /* free */
    NULL,                            /* init */
    NULL,                            /* shutdown */
    dir_ctrl,                        /* ctrl */
    get_cert_by_subject,             /* get_by_subject */
    NULL,                            /* get_by_issuer_serial */
    NULL,                            /* get_by_fingerprint */
    NULL,                            /* get_by_alias */
    get_cert_by_subject_ex,          /* get_by_subject_ex */
    NULL,                            /* ctrl_ex */
};

X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
{
    return &x509_dir_lookup;
}

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp)
{
    int ret = 0;
    BY_DIR *ld = (BY_DIR *)ctx->method_data;

    switch (cmd) {
    case X509_L_ADD_DIR:
        if (argl == X509_FILETYPE_DEFAULT) {
            const char *dir = ossl_safe_getenv(X509_get_default_cert_dir_env());

            if (dir)
                ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
            else
                ret = add_cert_dir(ld, X509_get_default_cert_dir(),
                                   X509_FILETYPE_PEM);
            if (!ret) {
                ERR_raise(ERR_LIB_X509, X509_R_LOADING_CERT_DIR);
            }
        } else
            ret = add_cert_dir(ld, argp, (int)argl);
        break;
    }
    return ret;
}

static int new_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = OPENSSL_malloc(sizeof(*a));

    if (a == NULL)
        return 0;

    if ((a->buffer = BUF_MEM_new()) == NULL) {
        ERR_raise(ERR_LIB_X509, ERR_R_BN_LIB);
        goto err;
    }
    a->dirs = NULL;
    a->lock = CRYPTO_THREAD_lock_new();
    if (a->lock == NULL) {
        BUF_MEM_free(a->buffer);
        ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
        goto err;
    }
    lu->method_data = a;
    return 1;

 err:
    OPENSSL_free(a);
    return 0;
}

static void by_dir_hash_free(BY_DIR_HASH *hash)
{
    OPENSSL_free(hash);
}

static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
                           const BY_DIR_HASH *const *b)
{
    if ((*a)->hash > (*b)->hash)
        return 1;
    if ((*a)->hash < (*b)->hash)
        return -1;
    return 0;
}

static void by_dir_entry_free(BY_DIR_ENTRY *ent)
{
    OPENSSL_free(ent->dir);
    sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
    OPENSSL_free(ent);
}

static void free_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = (BY_DIR *)lu->method_data;

    sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
    BUF_MEM_free(a->buffer);
    CRYPTO_THREAD_lock_free(a->lock);
    OPENSSL_free(a);
}

static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
{
    int j;
    size_t len;
    const char *s, *ss, *p;

    if (dir == NULL || *dir == '\0') {
        ERR_raise(ERR_LIB_X509, X509_R_INVALID_DIRECTORY);
        return 0;
    }

    s = dir;
    p = s;
    do {
        if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) {
            BY_DIR_ENTRY *ent;

            ss = s;
            s = p + 1;
            len = p - ss;
            if (len == 0)
                continue;
            for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
                ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
                if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
                    break;
            }
            if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
                continue;
            if (ctx->dirs == NULL) {
                ctx->dirs = sk_BY_DIR_ENTRY_new_null();
                if (!ctx->dirs) {
                    ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                    return 0;
                }
            }
            ent = OPENSSL_malloc(sizeof(*ent));
            if (ent == NULL)
                return 0;
            ent->dir_type = type;
            ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
            ent->dir = OPENSSL_strndup(ss, len);
            if (ent->dir == NULL || ent->hashes == NULL) {
                by_dir_entry_free(ent);
                return 0;
            }
            if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
                by_dir_entry_free(ent);
                ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                return 0;
            }
        }
    } while (*p++ != '\0');
    return 1;
}

static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                                  const X509_NAME *name, X509_OBJECT *ret,
                                  OSSL_LIB_CTX *libctx, const char *propq)
{
    BY_DIR *ctx;
    union {
        X509 st_x509;
        X509_CRL crl;
    } data;
    int ok = 0;
    int i, j, k;
    unsigned long h;
    BUF_MEM *b = NULL;
    X509_OBJECT stmp, *tmp;
    const char *postfix = "";

    if (name == NULL)
        return 0;

    stmp.type = type;
    if (type == X509_LU_X509) {
        data.st_x509.cert_info.subject = (X509_NAME *)name; /* won't modify it */
        stmp.data.x509 = &data.st_x509;
    } else if (type == X509_LU_CRL) {
        data.crl.crl.issuer = (X509_NAME *)name; /* won't modify it */
        stmp.data.crl = &data.crl;
        postfix = "r";
    } else {
        ERR_raise(ERR_LIB_X509, X509_R_WRONG_LOOKUP_TYPE);
        goto finish;
    }

    if ((b = BUF_MEM_new()) == NULL) {
        ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
        goto finish;
    }

    ctx = (BY_DIR *)xl->method_data;
    h = X509_NAME_hash_ex(name, libctx, propq, &i);
    if (i == 0)
        goto finish;
    for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
        BY_DIR_ENTRY *ent;
        int idx;
        BY_DIR_HASH htmp, *hent;

        ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
        j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
        if (!BUF_MEM_grow(b, j)) {
            ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
            goto finish;
        }
        if (type == X509_LU_CRL && ent->hashes) {
            htmp.hash = h;
            if (!CRYPTO_THREAD_read_lock(ctx->lock))
                goto finish;
            idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
            if (idx >= 0) {
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
                k = hent->suffix;
            } else {
                hent = NULL;
                k = 0;
            }
            CRYPTO_THREAD_unlock(ctx->lock);
        } else {
            k = 0;
            hent = NULL;
        }
        for (;;) {
            char c = '/';

#ifdef OPENSSL_SYS_VMS
            c = ent->dir[strlen(ent->dir) - 1];
            if (c != ':' && c != '>' && c != ']') {
                /*
                 * If no separator is present, we assume the directory
                 * specifier is a logical name, and add a colon.  We really
                 * should use better VMS routines for merging things like
                 * this, but this will do for now... -- Richard Levitte
                 */
                c = ':';
            } else {
                c = '\0';
            }

            if (c == '\0') {
                /*
                 * This is special.  When c == '\0', no directory separator
                 * should be added.
                 */
                BIO_snprintf(b->data, b->max,
                             "%s%08lx.%s%d", ent->dir, h, postfix, k);
            } else
#endif
            {
                BIO_snprintf(b->data, b->max,
                             "%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
            }
#ifndef OPENSSL_NO_POSIX_IO
# ifdef _WIN32
#  define stat _stat
# endif
            {
                struct stat st;
                if (stat(b->data, &st) < 0)
                    break;
            }
#endif
            /* found one. */
            if (type == X509_LU_X509) {
                if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx,
                                            propq)) == 0)
                    break;
            } else if (type == X509_LU_CRL) {
                if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
                    break;
            }
            /* else case will caught higher up */
            k++;
        }

        /*
         * we have added it to the cache so now pull it out again
         *
         * Note: quadratic time find here since the objects won't generally be
         *       sorted and sorting the would result in O(n^2 log n) complexity.
         */
        if (k > 0) {
            if (!X509_STORE_lock(xl->store_ctx))
                goto finish;
            j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
            tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
            X509_STORE_unlock(xl->store_ctx);
        } else {
            tmp = NULL;
        }
        /*
         * If a CRL, update the last file suffix added for this.
         * We don't need to add an entry if k is 0 as this is the initial value.
         * This avoids the need for a write lock and sort operation in the
         * simple case where no CRL is present for a hash.
         */
        if (type == X509_LU_CRL && k > 0) {
            if (!CRYPTO_THREAD_write_lock(ctx->lock))
                goto finish;
            /*
             * Look for entry again in case another thread added an entry
             * first.
             */
            if (hent == NULL) {
                htmp.hash = h;
                idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
            }
            if (hent == NULL) {
                hent = OPENSSL_malloc(sizeof(*hent));
                if (hent == NULL) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    ok = 0;
                    goto finish;
                }
                hent->hash = h;
                hent->suffix = k;
                if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    OPENSSL_free(hent);
                    ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                    ok = 0;
                    goto finish;
                }

                /*
                 * Ensure stack is sorted so that subsequent sk_BY_DIR_HASH_find
                 * will not mutate the stack and therefore require a write lock.
                 */
                sk_BY_DIR_HASH_sort(ent->hashes);
            } else if (hent->suffix < k) {
                hent->suffix = k;
            }

            CRYPTO_THREAD_unlock(ctx->lock);

        }

        if (tmp != NULL) {
            ok = 1;
            ret->type = tmp->type;
            memcpy(&ret->data, &tmp->data, sizeof(ret->data));

            /*
             * Clear any errors that might have been raised processing empty
             * or malformed files.
             */
            ERR_clear_error();

            goto finish;
        }
    }
 finish:
    /* If we changed anything, resort the objects for faster lookup */
    if (X509_STORE_lock(xl->store_ctx)) {
        if (!sk_X509_OBJECT_is_sorted(xl->store_ctx->objs)) {
            sk_X509_OBJECT_sort(xl->store_ctx->objs);
        }
        X509_STORE_unlock(xl->store_ctx);
    }

    BUF_MEM_free(b);
    return ok;
}

static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret)
{
    return get_cert_by_subject_ex(xl, type, name, ret, NULL, NULL);
}

Coverage Report

Created: 2025-06-13 06:57

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#if defined (__TANDEM) && defined (_SPT_MODEL_)
11		/*
12		* These definitions have to come first in SPT due to scoping of the
13		* declarations in c99 associated with SPT use of stat.
14		*/
15		# include <sys/types.h>
16		# include <sys/stat.h>
17		#endif
18
19		#include "internal/e_os.h"
20		#include "internal/cryptlib.h"
21		#include <stdio.h>
22		#include <time.h>
23		#include <errno.h>
24		#include <sys/types.h>
25
26		#ifndef OPENSSL_NO_POSIX_IO
27		# include <sys/stat.h>
28		#endif
29
30		#include <openssl/x509.h>
31		#include "crypto/x509.h"
32		#include "x509_local.h"
33
34		struct lookup_dir_hashes_st {
35		unsigned long hash;
36		int suffix;
37		};
38
39		struct lookup_dir_entry_st {
40		char *dir;
41		int dir_type;
42		STACK_OF(BY_DIR_HASH) *hashes;
43		};
44
45		typedef struct lookup_dir_st {
46		BUF_MEM *buffer;
47		STACK_OF(BY_DIR_ENTRY) *dirs;
48		CRYPTO_RWLOCK *lock;
49		} BY_DIR;
50
51		static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
52		char **retp);
53
54		static int new_dir(X509_LOOKUP *lu);
55		static void free_dir(X509_LOOKUP *lu);
56		static int add_cert_dir(BY_DIR ctx, const char dir, int type);
57		static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
58		const X509_NAME name, X509_OBJECT ret);
59		static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
60		const X509_NAME name, X509_OBJECT ret,
61		OSSL_LIB_CTX libctx, const char propq);
62		static X509_LOOKUP_METHOD x509_dir_lookup = {
63		"Load certs from files in a directory",
64		new_dir, /* new_item */
65		free_dir, /* free */
66		NULL, /* init */
67		NULL, /* shutdown */
68		dir_ctrl, /* ctrl */
69		get_cert_by_subject, /* get_by_subject */
70		NULL, /* get_by_issuer_serial */
71		NULL, /* get_by_fingerprint */
72		NULL, /* get_by_alias */
73		get_cert_by_subject_ex, /* get_by_subject_ex */
74		NULL, /* ctrl_ex */
75		};
76
77		X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
78	0	{
79	0	return &x509_dir_lookup;
80	0	}
81
82		static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
83		char **retp)
84	0	{
85	0	int ret = 0;
86	0	BY_DIR ld = (BY_DIR )ctx->method_data;
87
88	0	switch (cmd) {
89	0	case X509_L_ADD_DIR:
90	0	if (argl == X509_FILETYPE_DEFAULT) {
91	0	const char *dir = ossl_safe_getenv(X509_get_default_cert_dir_env());
92
93	0	if (dir)
94	0	ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
95	0	else
96	0	ret = add_cert_dir(ld, X509_get_default_cert_dir(),
97	0	X509_FILETYPE_PEM);
98	0	if (!ret) {
99	0	ERR_raise(ERR_LIB_X509, X509_R_LOADING_CERT_DIR);
100	0	}
101	0	} else
102	0	ret = add_cert_dir(ld, argp, (int)argl);
103	0	break;
104	0	}
105	0	return ret;
106	0	}
107
108		static int new_dir(X509_LOOKUP *lu)
109	0	{
110	0	BY_DIR a = OPENSSL_malloc(sizeof(a));
111
112	0	if (a == NULL)
113	0	return 0;
114
115	0	if ((a->buffer = BUF_MEM_new()) == NULL) {
116	0	ERR_raise(ERR_LIB_X509, ERR_R_BN_LIB);
117	0	goto err;
118	0	}
119	0	a->dirs = NULL;
120	0	a->lock = CRYPTO_THREAD_lock_new();
121	0	if (a->lock == NULL) {
122	0	BUF_MEM_free(a->buffer);
123	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
124	0	goto err;
125	0	}
126	0	lu->method_data = a;
127	0	return 1;
128
129	0	err:
130	0	OPENSSL_free(a);
131	0	return 0;
132	0	}
133
134		static void by_dir_hash_free(BY_DIR_HASH *hash)
135	0	{
136	0	OPENSSL_free(hash);
137	0	}
138
139		static int by_dir_hash_cmp(const BY_DIR_HASH const a,
140		const BY_DIR_HASH const b)
141	0	{
142	0	if ((a)->hash > (b)->hash)
143	0	return 1;
144	0	if ((a)->hash < (b)->hash)
145	0	return -1;
146	0	return 0;
147	0	}
148
149		static void by_dir_entry_free(BY_DIR_ENTRY *ent)
150	0	{
151	0	OPENSSL_free(ent->dir);
152	0	sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
153	0	OPENSSL_free(ent);
154	0	}
155
156		static void free_dir(X509_LOOKUP *lu)
157	0	{
158	0	BY_DIR a = (BY_DIR )lu->method_data;
159
160	0	sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
161	0	BUF_MEM_free(a->buffer);
162	0	CRYPTO_THREAD_lock_free(a->lock);
163	0	OPENSSL_free(a);
164	0	}
165
166		static int add_cert_dir(BY_DIR ctx, const char dir, int type)
167	0	{
168	0	int j;
169	0	size_t len;
170	0	const char s, ss, *p;
171
172	0	if (dir == NULL \|\| *dir == '\0') {
173	0	ERR_raise(ERR_LIB_X509, X509_R_INVALID_DIRECTORY);
174	0	return 0;
175	0	}
176
177	0	s = dir;
178	0	p = s;
179	0	do {
180	0	if ((p == LIST_SEPARATOR_CHAR) \|\| (p == '\0')) {
181	0	BY_DIR_ENTRY *ent;
182
183	0	ss = s;
184	0	s = p + 1;
185	0	len = p - ss;
186	0	if (len == 0)
187	0	continue;
188	0	for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
189	0	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
190	0	if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
191	0	break;
192	0	}
193	0	if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
194	0	continue;
195	0	if (ctx->dirs == NULL) {
196	0	ctx->dirs = sk_BY_DIR_ENTRY_new_null();
197	0	if (!ctx->dirs) {
198	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
199	0	return 0;
200	0	}
201	0	}
202	0	ent = OPENSSL_malloc(sizeof(*ent));
203	0	if (ent == NULL)
204	0	return 0;
205	0	ent->dir_type = type;
206	0	ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
207	0	ent->dir = OPENSSL_strndup(ss, len);
208	0	if (ent->dir == NULL \|\| ent->hashes == NULL) {
209	0	by_dir_entry_free(ent);
210	0	return 0;
211	0	}
212	0	if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
213	0	by_dir_entry_free(ent);
214	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
215	0	return 0;
216	0	}
217	0	}
218	0	} while (*p++ != '\0');
219	0	return 1;
220	0	}
221
222		static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
223		const X509_NAME name, X509_OBJECT ret,
224		OSSL_LIB_CTX libctx, const char propq)
225	0	{
226	0	BY_DIR *ctx;
227	0	union {
228	0	X509 st_x509;
229	0	X509_CRL crl;
230	0	} data;
231	0	int ok = 0;
232	0	int i, j, k;
233	0	unsigned long h;
234	0	BUF_MEM *b = NULL;
235	0	X509_OBJECT stmp, *tmp;
236	0	const char *postfix = "";
237
238	0	if (name == NULL)
239	0	return 0;
240
241	0	stmp.type = type;
242	0	if (type == X509_LU_X509) {
243	0	data.st_x509.cert_info.subject = (X509_NAME )name; / won't modify it */
244	0	stmp.data.x509 = &data.st_x509;
245	0	} else if (type == X509_LU_CRL) {
246	0	data.crl.crl.issuer = (X509_NAME )name; / won't modify it */
247	0	stmp.data.crl = &data.crl;
248	0	postfix = "r";
249	0	} else {
250	0	ERR_raise(ERR_LIB_X509, X509_R_WRONG_LOOKUP_TYPE);
251	0	goto finish;
252	0	}
253
254	0	if ((b = BUF_MEM_new()) == NULL) {
255	0	ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
256	0	goto finish;
257	0	}
258
259	0	ctx = (BY_DIR *)xl->method_data;
260	0	h = X509_NAME_hash_ex(name, libctx, propq, &i);
261	0	if (i == 0)
262	0	goto finish;
263	0	for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
264	0	BY_DIR_ENTRY *ent;
265	0	int idx;
266	0	BY_DIR_HASH htmp, *hent;
267
268	0	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
269	0	j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
270	0	if (!BUF_MEM_grow(b, j)) {
271	0	ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
272	0	goto finish;
273	0	}
274	0	if (type == X509_LU_CRL && ent->hashes) {
275	0	htmp.hash = h;
276	0	if (!CRYPTO_THREAD_read_lock(ctx->lock))
277	0	goto finish;
278	0	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
279	0	if (idx >= 0) {
280	0	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
281	0	k = hent->suffix;
282	0	} else {
283	0	hent = NULL;
284	0	k = 0;
285	0	}
286	0	CRYPTO_THREAD_unlock(ctx->lock);
287	0	} else {
288	0	k = 0;
289	0	hent = NULL;
290	0	}
291	0	for (;;) {
292	0	char c = '/';
293
294		#ifdef OPENSSL_SYS_VMS
295		c = ent->dir[strlen(ent->dir) - 1];
296		if (c != ':' && c != '>' && c != ']') {
297		/*
298		* If no separator is present, we assume the directory
299		* specifier is a logical name, and add a colon. We really
300		* should use better VMS routines for merging things like
301		* this, but this will do for now... -- Richard Levitte
302		*/
303		c = ':';
304		} else {
305		c = '\0';
306		}
307
308		if (c == '\0') {
309		/*
310		* This is special. When c == '\0', no directory separator
311		* should be added.
312		*/
313		BIO_snprintf(b->data, b->max,
314		"%s%08lx.%s%d", ent->dir, h, postfix, k);
315		} else
316		#endif
317	0	{
318	0	BIO_snprintf(b->data, b->max,
319	0	"%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
320	0	}
321	0	#ifndef OPENSSL_NO_POSIX_IO
322		# ifdef _WIN32
323		# define stat _stat
324		# endif
325	0	{
326	0	struct stat st;
327	0	if (stat(b->data, &st) < 0)
328	0	break;
329	0	}
330	0	#endif
331		/* found one. */
332	0	if (type == X509_LU_X509) {
333	0	if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx,
334	0	propq)) == 0)
335	0	break;
336	0	} else if (type == X509_LU_CRL) {
337	0	if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
338	0	break;
339	0	}
340		/* else case will caught higher up */
341	0	k++;
342	0	}
343
344		/*
345		* we have added it to the cache so now pull it out again
346		*
347		* Note: quadratic time find here since the objects won't generally be
348		* sorted and sorting the would result in O(n^2 log n) complexity.
349		*/
350	0	if (k > 0) {
351	0	if (!X509_STORE_lock(xl->store_ctx))
352	0	goto finish;
353	0	j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
354	0	tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
355	0	X509_STORE_unlock(xl->store_ctx);
356	0	} else {
357	0	tmp = NULL;
358	0	}
359		/*
360		* If a CRL, update the last file suffix added for this.
361		* We don't need to add an entry if k is 0 as this is the initial value.
362		* This avoids the need for a write lock and sort operation in the
363		* simple case where no CRL is present for a hash.
364		*/
365	0	if (type == X509_LU_CRL && k > 0) {
366	0	if (!CRYPTO_THREAD_write_lock(ctx->lock))
367	0	goto finish;
368		/*
369		* Look for entry again in case another thread added an entry
370		* first.
371		*/
372	0	if (hent == NULL) {
373	0	htmp.hash = h;
374	0	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
375	0	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
376	0	}
377	0	if (hent == NULL) {
378	0	hent = OPENSSL_malloc(sizeof(*hent));
379	0	if (hent == NULL) {
380	0	CRYPTO_THREAD_unlock(ctx->lock);
381	0	ok = 0;
382	0	goto finish;
383	0	}
384	0	hent->hash = h;
385	0	hent->suffix = k;
386	0	if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
387	0	CRYPTO_THREAD_unlock(ctx->lock);
388	0	OPENSSL_free(hent);
389	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
390	0	ok = 0;
391	0	goto finish;
392	0	}
393
394		/*
395		* Ensure stack is sorted so that subsequent sk_BY_DIR_HASH_find
396		* will not mutate the stack and therefore require a write lock.
397		*/
398	0	sk_BY_DIR_HASH_sort(ent->hashes);
399	0	} else if (hent->suffix < k) {
400	0	hent->suffix = k;
401	0	}
402
403	0	CRYPTO_THREAD_unlock(ctx->lock);
404
405	0	}
406
407	0	if (tmp != NULL) {
408	0	ok = 1;
409	0	ret->type = tmp->type;
410	0	memcpy(&ret->data, &tmp->data, sizeof(ret->data));
411
412		/*
413		* Clear any errors that might have been raised processing empty
414		* or malformed files.
415		*/
416	0	ERR_clear_error();
417
418	0	goto finish;
419	0	}
420	0	}
421	0	finish:
422		/* If we changed anything, resort the objects for faster lookup */
423	0	if (X509_STORE_lock(xl->store_ctx)) {
424	0	if (!sk_X509_OBJECT_is_sorted(xl->store_ctx->objs)) {
425	0	sk_X509_OBJECT_sort(xl->store_ctx->objs);
426	0	}
427	0	X509_STORE_unlock(xl->store_ctx);
428	0	}
429
430	0	BUF_MEM_free(b);
431	0	return ok;
432	0	}
433
434		static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
435		const X509_NAME name, X509_OBJECT ret)
436	0	{
437	0	return get_cert_by_subject_ex(xl, type, name, ret, NULL, NULL);
438	0	}