/src/openssl/crypto/x509/by_dir.c

Source (jump to first uncovered line)
/*
 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#if defined (__TANDEM) && defined (_SPT_MODEL_)
  /*
   * These definitions have to come first in SPT due to scoping of the
   * declarations in c99 associated with SPT use of stat.
   */
# include <sys/types.h>
# include <sys/stat.h>
#endif

#include "internal/e_os.h"
#include "internal/cryptlib.h"
#include <stdio.h>
#include <time.h>
#include <errno.h>
#include <sys/types.h>

#ifndef OPENSSL_NO_POSIX_IO
# include <sys/stat.h>
#endif

#include <openssl/x509.h>
#include "crypto/x509.h"
#include "x509_local.h"

struct lookup_dir_hashes_st {
    unsigned long hash;
    int suffix;
};

struct lookup_dir_entry_st {
    char *dir;
    int dir_type;
    STACK_OF(BY_DIR_HASH) *hashes;
};

typedef struct lookup_dir_st {
    BUF_MEM *buffer;
    STACK_OF(BY_DIR_ENTRY) *dirs;
    CRYPTO_RWLOCK *lock;
} BY_DIR;

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp);

static int new_dir(X509_LOOKUP *lu);
static void free_dir(X509_LOOKUP *lu);
static int add_cert_dir(BY_DIR *ctx, const char *dir, int type);
static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret);
static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                                  const X509_NAME *name, X509_OBJECT *ret,
                                  OSSL_LIB_CTX *libctx, const char *propq);
static X509_LOOKUP_METHOD x509_dir_lookup = {
    "Load certs from files in a directory",
    new_dir,                         /* new_item */
    free_dir,                        /* free */
    NULL,                            /* init */
    NULL,                            /* shutdown */
    dir_ctrl,                        /* ctrl */
    get_cert_by_subject,             /* get_by_subject */
    NULL,                            /* get_by_issuer_serial */
    NULL,                            /* get_by_fingerprint */
    NULL,                            /* get_by_alias */
    get_cert_by_subject_ex,          /* get_by_subject_ex */
    NULL,                            /* ctrl_ex */
};

X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
{
    return &x509_dir_lookup;
}

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp)
{
    int ret = 0;
    BY_DIR *ld = (BY_DIR *)ctx->method_data;

    switch (cmd) {
    case X509_L_ADD_DIR:
        if (argl == X509_FILETYPE_DEFAULT) {
            /* If SSL_CERT_PATH is provided and non-empty, use that. */
            const char *dir = ossl_safe_getenv(X509_get_default_cert_path_env());

            /* Fallback to SSL_CERT_DIR. */
            if (dir == NULL)
                dir = ossl_safe_getenv(X509_get_default_cert_dir_env());

            /* Fallback to built-in default. */
            if (dir == NULL)
                dir = X509_get_default_cert_dir();

            ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
            if (!ret) {
                ERR_raise(ERR_LIB_X509, X509_R_LOADING_CERT_DIR);
            }
        } else
            ret = add_cert_dir(ld, argp, (int)argl);
        break;
    }
    return ret;
}

static int new_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = OPENSSL_malloc(sizeof(*a));

    if (a == NULL)
        return 0;

    if ((a->buffer = BUF_MEM_new()) == NULL) {
        ERR_raise(ERR_LIB_X509, ERR_R_BN_LIB);
        goto err;
    }
    a->dirs = NULL;
    a->lock = CRYPTO_THREAD_lock_new();
    if (a->lock == NULL) {
        BUF_MEM_free(a->buffer);
        ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
        goto err;
    }
    lu->method_data = a;
    return 1;

 err:
    OPENSSL_free(a);
    return 0;
}

static void by_dir_hash_free(BY_DIR_HASH *hash)
{
    OPENSSL_free(hash);
}

static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
                           const BY_DIR_HASH *const *b)
{
    if ((*a)->hash > (*b)->hash)
        return 1;
    if ((*a)->hash < (*b)->hash)
        return -1;
    return 0;
}

static void by_dir_entry_free(BY_DIR_ENTRY *ent)
{
    OPENSSL_free(ent->dir);
    sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
    OPENSSL_free(ent);
}

static void free_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = (BY_DIR *)lu->method_data;

    sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
    BUF_MEM_free(a->buffer);
    CRYPTO_THREAD_lock_free(a->lock);
    OPENSSL_free(a);
}

static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
{
    int j;
    size_t len;
    const char *s, *ss, *p;

    if (dir == NULL || *dir == '\0') {
        ERR_raise(ERR_LIB_X509, X509_R_INVALID_DIRECTORY);
        return 0;
    }

    s = dir;
    p = s;
    do {
        if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) {
            BY_DIR_ENTRY *ent;

            ss = s;
            s = p + 1;
            len = p - ss;
            if (len == 0)
                continue;
            for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
                ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
                if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
                    break;
            }
            if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
                continue;
            if (ctx->dirs == NULL) {
                ctx->dirs = sk_BY_DIR_ENTRY_new_null();
                if (!ctx->dirs) {
                    ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                    return 0;
                }
            }
            ent = OPENSSL_malloc(sizeof(*ent));
            if (ent == NULL)
                return 0;
            ent->dir_type = type;
            ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
            ent->dir = OPENSSL_strndup(ss, len);
            if (ent->dir == NULL || ent->hashes == NULL) {
                by_dir_entry_free(ent);
                return 0;
            }
            if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
                by_dir_entry_free(ent);
                ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                return 0;
            }
        }
    } while (*p++ != '\0');
    return 1;
}

static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                                  const X509_NAME *name, X509_OBJECT *ret,
                                  OSSL_LIB_CTX *libctx, const char *propq)
{
    BY_DIR *ctx;
    union {
        X509 st_x509;
        X509_CRL crl;
    } data;
    int ok = 0;
    int i, j, k;
    unsigned long h;
    BUF_MEM *b = NULL;
    X509_OBJECT stmp, *tmp;
    const char *postfix = "";

    if (name == NULL)
        return 0;

    stmp.type = type;
    if (type == X509_LU_X509) {
        data.st_x509.cert_info.subject = (X509_NAME *)name; /* won't modify it */
        stmp.data.x509 = &data.st_x509;
    } else if (type == X509_LU_CRL) {
        data.crl.crl.issuer = (X509_NAME *)name; /* won't modify it */
        stmp.data.crl = &data.crl;
        postfix = "r";
    } else {
        ERR_raise(ERR_LIB_X509, X509_R_WRONG_LOOKUP_TYPE);
        goto finish;
    }

    if ((b = BUF_MEM_new()) == NULL) {
        ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
        goto finish;
    }

    ctx = (BY_DIR *)xl->method_data;
    h = X509_NAME_hash_ex(name, libctx, propq, &i);
    if (i == 0)
        goto finish;
    for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
        BY_DIR_ENTRY *ent;
        int idx;
        BY_DIR_HASH htmp, *hent;

        ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
        j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
        if (!BUF_MEM_grow(b, j)) {
            ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
            goto finish;
        }
        if (type == X509_LU_CRL && ent->hashes) {
            htmp.hash = h;
            if (!CRYPTO_THREAD_read_lock(ctx->lock))
                goto finish;
            idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
            if (idx >= 0) {
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
                k = hent->suffix;
            } else {
                hent = NULL;
                k = 0;
            }
            CRYPTO_THREAD_unlock(ctx->lock);
        } else {
            k = 0;
            hent = NULL;
        }
        for (;;) {
            char c = '/';

#ifdef OPENSSL_SYS_VMS
            c = ent->dir[strlen(ent->dir) - 1];
            if (c != ':' && c != '>' && c != ']') {
                /*
                 * If no separator is present, we assume the directory
                 * specifier is a logical name, and add a colon.  We really
                 * should use better VMS routines for merging things like
                 * this, but this will do for now... -- Richard Levitte
                 */
                c = ':';
            } else {
                c = '\0';
            }

            if (c == '\0') {
                /*
                 * This is special.  When c == '\0', no directory separator
                 * should be added.
                 */
                BIO_snprintf(b->data, b->max,
                             "%s%08lx.%s%d", ent->dir, h, postfix, k);
            } else
#endif
            {
                BIO_snprintf(b->data, b->max,
                             "%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
            }
#ifndef OPENSSL_NO_POSIX_IO
# ifdef _WIN32
#  define stat _stat
# endif
            {
                struct stat st;
                if (stat(b->data, &st) < 0)
                    break;
            }
#endif
            /* found one. */
            if (type == X509_LU_X509) {
                if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx,
                                            propq)) == 0)
                    break;
            } else if (type == X509_LU_CRL) {
                if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
                    break;
            }
            /* else case will caught higher up */
            k++;
        }

        /*
         * we have added it to the cache so now pull it out again
         */
        X509_STORE_lock(xl->store_ctx);
        j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
        tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
        X509_STORE_unlock(xl->store_ctx);

        /*
         * If a CRL, update the last file suffix added for this.
         * We don't need to add an entry if k is 0 as this is the initial value.
         * This avoids the need for a write lock and sort operation in the
         * simple case where no CRL is present for a hash.
         */
        if (type == X509_LU_CRL && k > 0) {
            if (!CRYPTO_THREAD_write_lock(ctx->lock))
                goto finish;
            /*
             * Look for entry again in case another thread added an entry
             * first.
             */
            if (hent == NULL) {
                htmp.hash = h;
                idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
            }
            if (hent == NULL) {
                hent = OPENSSL_malloc(sizeof(*hent));
                if (hent == NULL) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    ok = 0;
                    goto finish;
                }
                hent->hash = h;
                hent->suffix = k;
                if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    OPENSSL_free(hent);
                    ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
                    ok = 0;
                    goto finish;
                }

                /*
                 * Ensure stack is sorted so that subsequent sk_BY_DIR_HASH_find
                 * will not mutate the stack and therefore require a write lock.
                 */
                sk_BY_DIR_HASH_sort(ent->hashes);
            } else if (hent->suffix < k) {
                hent->suffix = k;
            }

            CRYPTO_THREAD_unlock(ctx->lock);

        }

        if (tmp != NULL) {
            ok = 1;
            ret->type = tmp->type;
            memcpy(&ret->data, &tmp->data, sizeof(ret->data));

            /*
             * Clear any errors that might have been raised processing empty
             * or malformed files.
             */
            ERR_clear_error();

            goto finish;
        }
    }
 finish:
    BUF_MEM_free(b);
    return ok;
}

static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret)
{
    return get_cert_by_subject_ex(xl, type, name, ret, NULL, NULL);
}

Coverage Report

Created: 2023-04-12 06:22

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#if defined (__TANDEM) && defined (_SPT_MODEL_)
11		/*
12		* These definitions have to come first in SPT due to scoping of the
13		* declarations in c99 associated with SPT use of stat.
14		*/
15		# include <sys/types.h>
16		# include <sys/stat.h>
17		#endif
18
19		#include "internal/e_os.h"
20		#include "internal/cryptlib.h"
21		#include <stdio.h>
22		#include <time.h>
23		#include <errno.h>
24		#include <sys/types.h>
25
26		#ifndef OPENSSL_NO_POSIX_IO
27		# include <sys/stat.h>
28		#endif
29
30		#include <openssl/x509.h>
31		#include "crypto/x509.h"
32		#include "x509_local.h"
33
34		struct lookup_dir_hashes_st {
35		unsigned long hash;
36		int suffix;
37		};
38
39		struct lookup_dir_entry_st {
40		char *dir;
41		int dir_type;
42		STACK_OF(BY_DIR_HASH) *hashes;
43		};
44
45		typedef struct lookup_dir_st {
46		BUF_MEM *buffer;
47		STACK_OF(BY_DIR_ENTRY) *dirs;
48		CRYPTO_RWLOCK *lock;
49		} BY_DIR;
50
51		static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
52		char **retp);
53
54		static int new_dir(X509_LOOKUP *lu);
55		static void free_dir(X509_LOOKUP *lu);
56		static int add_cert_dir(BY_DIR ctx, const char dir, int type);
57		static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
58		const X509_NAME name, X509_OBJECT ret);
59		static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
60		const X509_NAME name, X509_OBJECT ret,
61		OSSL_LIB_CTX libctx, const char propq);
62		static X509_LOOKUP_METHOD x509_dir_lookup = {
63		"Load certs from files in a directory",
64		new_dir, /* new_item */
65		free_dir, /* free */
66		NULL, /* init */
67		NULL, /* shutdown */
68		dir_ctrl, /* ctrl */
69		get_cert_by_subject, /* get_by_subject */
70		NULL, /* get_by_issuer_serial */
71		NULL, /* get_by_fingerprint */
72		NULL, /* get_by_alias */
73		get_cert_by_subject_ex, /* get_by_subject_ex */
74		NULL, /* ctrl_ex */
75		};
76
77		X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
78	0	{
79	0	return &x509_dir_lookup;
80	0	}
81
82		static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
83		char **retp)
84	0	{
85	0	int ret = 0;
86	0	BY_DIR ld = (BY_DIR )ctx->method_data;
87
88	0	switch (cmd) {
89	0	case X509_L_ADD_DIR:
90	0	if (argl == X509_FILETYPE_DEFAULT) {
91		/* If SSL_CERT_PATH is provided and non-empty, use that. */
92	0	const char *dir = ossl_safe_getenv(X509_get_default_cert_path_env());
93
94		/* Fallback to SSL_CERT_DIR. */
95	0	if (dir == NULL)
96	0	dir = ossl_safe_getenv(X509_get_default_cert_dir_env());
97
98		/* Fallback to built-in default. */
99	0	if (dir == NULL)
100	0	dir = X509_get_default_cert_dir();
101
102	0	ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
103	0	if (!ret) {
104	0	ERR_raise(ERR_LIB_X509, X509_R_LOADING_CERT_DIR);
105	0	}
106	0	} else
107	0	ret = add_cert_dir(ld, argp, (int)argl);
108	0	break;
109	0	}
110	0	return ret;
111	0	}
112
113		static int new_dir(X509_LOOKUP *lu)
114	0	{
115	0	BY_DIR a = OPENSSL_malloc(sizeof(a));
116
117	0	if (a == NULL)
118	0	return 0;
119
120	0	if ((a->buffer = BUF_MEM_new()) == NULL) {
121	0	ERR_raise(ERR_LIB_X509, ERR_R_BN_LIB);
122	0	goto err;
123	0	}
124	0	a->dirs = NULL;
125	0	a->lock = CRYPTO_THREAD_lock_new();
126	0	if (a->lock == NULL) {
127	0	BUF_MEM_free(a->buffer);
128	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
129	0	goto err;
130	0	}
131	0	lu->method_data = a;
132	0	return 1;
133
134	0	err:
135	0	OPENSSL_free(a);
136	0	return 0;
137	0	}
138
139		static void by_dir_hash_free(BY_DIR_HASH *hash)
140	0	{
141	0	OPENSSL_free(hash);
142	0	}
143
144		static int by_dir_hash_cmp(const BY_DIR_HASH const a,
145		const BY_DIR_HASH const b)
146	0	{
147	0	if ((a)->hash > (b)->hash)
148	0	return 1;
149	0	if ((a)->hash < (b)->hash)
150	0	return -1;
151	0	return 0;
152	0	}
153
154		static void by_dir_entry_free(BY_DIR_ENTRY *ent)
155	0	{
156	0	OPENSSL_free(ent->dir);
157	0	sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
158	0	OPENSSL_free(ent);
159	0	}
160
161		static void free_dir(X509_LOOKUP *lu)
162	0	{
163	0	BY_DIR a = (BY_DIR )lu->method_data;
164
165	0	sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
166	0	BUF_MEM_free(a->buffer);
167	0	CRYPTO_THREAD_lock_free(a->lock);
168	0	OPENSSL_free(a);
169	0	}
170
171		static int add_cert_dir(BY_DIR ctx, const char dir, int type)
172	0	{
173	0	int j;
174	0	size_t len;
175	0	const char s, ss, *p;
176
177	0	if (dir == NULL \|\| *dir == '\0') {
178	0	ERR_raise(ERR_LIB_X509, X509_R_INVALID_DIRECTORY);
179	0	return 0;
180	0	}
181
182	0	s = dir;
183	0	p = s;
184	0	do {
185	0	if ((p == LIST_SEPARATOR_CHAR) \|\| (p == '\0')) {
186	0	BY_DIR_ENTRY *ent;
187
188	0	ss = s;
189	0	s = p + 1;
190	0	len = p - ss;
191	0	if (len == 0)
192	0	continue;
193	0	for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
194	0	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
195	0	if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
196	0	break;
197	0	}
198	0	if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
199	0	continue;
200	0	if (ctx->dirs == NULL) {
201	0	ctx->dirs = sk_BY_DIR_ENTRY_new_null();
202	0	if (!ctx->dirs) {
203	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
204	0	return 0;
205	0	}
206	0	}
207	0	ent = OPENSSL_malloc(sizeof(*ent));
208	0	if (ent == NULL)
209	0	return 0;
210	0	ent->dir_type = type;
211	0	ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
212	0	ent->dir = OPENSSL_strndup(ss, len);
213	0	if (ent->dir == NULL \|\| ent->hashes == NULL) {
214	0	by_dir_entry_free(ent);
215	0	return 0;
216	0	}
217	0	if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
218	0	by_dir_entry_free(ent);
219	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
220	0	return 0;
221	0	}
222	0	}
223	0	} while (*p++ != '\0');
224	0	return 1;
225	0	}
226
227		static int get_cert_by_subject_ex(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
228		const X509_NAME name, X509_OBJECT ret,
229		OSSL_LIB_CTX libctx, const char propq)
230	0	{
231	0	BY_DIR *ctx;
232	0	union {
233	0	X509 st_x509;
234	0	X509_CRL crl;
235	0	} data;
236	0	int ok = 0;
237	0	int i, j, k;
238	0	unsigned long h;
239	0	BUF_MEM *b = NULL;
240	0	X509_OBJECT stmp, *tmp;
241	0	const char *postfix = "";
242
243	0	if (name == NULL)
244	0	return 0;
245
246	0	stmp.type = type;
247	0	if (type == X509_LU_X509) {
248	0	data.st_x509.cert_info.subject = (X509_NAME )name; / won't modify it */
249	0	stmp.data.x509 = &data.st_x509;
250	0	} else if (type == X509_LU_CRL) {
251	0	data.crl.crl.issuer = (X509_NAME )name; / won't modify it */
252	0	stmp.data.crl = &data.crl;
253	0	postfix = "r";
254	0	} else {
255	0	ERR_raise(ERR_LIB_X509, X509_R_WRONG_LOOKUP_TYPE);
256	0	goto finish;
257	0	}
258
259	0	if ((b = BUF_MEM_new()) == NULL) {
260	0	ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
261	0	goto finish;
262	0	}
263
264	0	ctx = (BY_DIR *)xl->method_data;
265	0	h = X509_NAME_hash_ex(name, libctx, propq, &i);
266	0	if (i == 0)
267	0	goto finish;
268	0	for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
269	0	BY_DIR_ENTRY *ent;
270	0	int idx;
271	0	BY_DIR_HASH htmp, *hent;
272
273	0	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
274	0	j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
275	0	if (!BUF_MEM_grow(b, j)) {
276	0	ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
277	0	goto finish;
278	0	}
279	0	if (type == X509_LU_CRL && ent->hashes) {
280	0	htmp.hash = h;
281	0	if (!CRYPTO_THREAD_read_lock(ctx->lock))
282	0	goto finish;
283	0	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
284	0	if (idx >= 0) {
285	0	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
286	0	k = hent->suffix;
287	0	} else {
288	0	hent = NULL;
289	0	k = 0;
290	0	}
291	0	CRYPTO_THREAD_unlock(ctx->lock);
292	0	} else {
293	0	k = 0;
294	0	hent = NULL;
295	0	}
296	0	for (;;) {
297	0	char c = '/';
298
299		#ifdef OPENSSL_SYS_VMS
300		c = ent->dir[strlen(ent->dir) - 1];
301		if (c != ':' && c != '>' && c != ']') {
302		/*
303		* If no separator is present, we assume the directory
304		* specifier is a logical name, and add a colon. We really
305		* should use better VMS routines for merging things like
306		* this, but this will do for now... -- Richard Levitte
307		*/
308		c = ':';
309		} else {
310		c = '\0';
311		}
312
313		if (c == '\0') {
314		/*
315		* This is special. When c == '\0', no directory separator
316		* should be added.
317		*/
318		BIO_snprintf(b->data, b->max,
319		"%s%08lx.%s%d", ent->dir, h, postfix, k);
320		} else
321		#endif
322	0	{
323	0	BIO_snprintf(b->data, b->max,
324	0	"%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
325	0	}
326	0	#ifndef OPENSSL_NO_POSIX_IO
327		# ifdef _WIN32
328		# define stat _stat
329		# endif
330	0	{
331	0	struct stat st;
332	0	if (stat(b->data, &st) < 0)
333	0	break;
334	0	}
335	0	#endif
336		/* found one. */
337	0	if (type == X509_LU_X509) {
338	0	if ((X509_load_cert_file_ex(xl, b->data, ent->dir_type, libctx,
339	0	propq)) == 0)
340	0	break;
341	0	} else if (type == X509_LU_CRL) {
342	0	if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
343	0	break;
344	0	}
345		/* else case will caught higher up */
346	0	k++;
347	0	}
348
349		/*
350		* we have added it to the cache so now pull it out again
351		*/
352	0	X509_STORE_lock(xl->store_ctx);
353	0	j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
354	0	tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
355	0	X509_STORE_unlock(xl->store_ctx);
356
357		/*
358		* If a CRL, update the last file suffix added for this.
359		* We don't need to add an entry if k is 0 as this is the initial value.
360		* This avoids the need for a write lock and sort operation in the
361		* simple case where no CRL is present for a hash.
362		*/
363	0	if (type == X509_LU_CRL && k > 0) {
364	0	if (!CRYPTO_THREAD_write_lock(ctx->lock))
365	0	goto finish;
366		/*
367		* Look for entry again in case another thread added an entry
368		* first.
369		*/
370	0	if (hent == NULL) {
371	0	htmp.hash = h;
372	0	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
373	0	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
374	0	}
375	0	if (hent == NULL) {
376	0	hent = OPENSSL_malloc(sizeof(*hent));
377	0	if (hent == NULL) {
378	0	CRYPTO_THREAD_unlock(ctx->lock);
379	0	ok = 0;
380	0	goto finish;
381	0	}
382	0	hent->hash = h;
383	0	hent->suffix = k;
384	0	if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
385	0	CRYPTO_THREAD_unlock(ctx->lock);
386	0	OPENSSL_free(hent);
387	0	ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
388	0	ok = 0;
389	0	goto finish;
390	0	}
391
392		/*
393		* Ensure stack is sorted so that subsequent sk_BY_DIR_HASH_find
394		* will not mutate the stack and therefore require a write lock.
395		*/
396	0	sk_BY_DIR_HASH_sort(ent->hashes);
397	0	} else if (hent->suffix < k) {
398	0	hent->suffix = k;
399	0	}
400
401	0	CRYPTO_THREAD_unlock(ctx->lock);
402
403	0	}
404
405	0	if (tmp != NULL) {
406	0	ok = 1;
407	0	ret->type = tmp->type;
408	0	memcpy(&ret->data, &tmp->data, sizeof(ret->data));
409
410		/*
411		* Clear any errors that might have been raised processing empty
412		* or malformed files.
413		*/
414	0	ERR_clear_error();
415
416	0	goto finish;
417	0	}
418	0	}
419	0	finish:
420	0	BUF_MEM_free(b);
421	0	return ok;
422	0	}
423
424		static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
425		const X509_NAME name, X509_OBJECT ret)
426	0	{
427	0	return get_cert_by_subject_ex(xl, type, name, ret, NULL, NULL);
428	0	}