/src/wolfssl-heapmath/src/x509_str.c

Source
/* x509_str.c
 *
 * Copyright (C) 2006-2026 wolfSSL Inc.
 *
 * This file is part of wolfSSL.
 *
 * wolfSSL is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * wolfSSL is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#if !defined(WOLFSSL_X509_STORE_INCLUDED)
    #ifndef WOLFSSL_IGNORE_FILE_WARN
        #warning x509_str.c does not need to be compiled separately from ssl.c
    #endif
#else

#ifndef WOLFCRYPT_ONLY

#ifndef NO_CERTS

#ifdef OPENSSL_EXTRA
static int X509StoreGetIssuerEx(WOLFSSL_X509 **issuer,
                            WOLFSSL_STACK *certs, WOLFSSL_X509 *x);
static int X509StoreGetIssuerSkip(WOLFSSL_X509 **issuer,
                            WOLFSSL_STACK *certs, WOLFSSL_X509 *x,
                            WOLF_STACK_OF(WOLFSSL_X509)* skip);
static int X509StoreAddCa(WOLFSSL_X509_STORE* store,
                                          WOLFSSL_X509* x509, int type);
#endif

/* Based on OpenSSL default max depth */
#ifndef WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH
#define WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH 100
#endif

/******************************************************************************
 * START OF X509_STORE_CTX APIs
 *****************************************************************************/

/* This API is necessary outside of OPENSSL_EXTRA because it is used in
 * SetupStoreCtxCallback */
WOLFSSL_X509_STORE_CTX* wolfSSL_X509_STORE_CTX_new_ex(void* heap)
{
    WOLFSSL_X509_STORE_CTX* ctx;
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_new_ex");

    ctx = (WOLFSSL_X509_STORE_CTX*)XMALLOC(sizeof(WOLFSSL_X509_STORE_CTX), heap,
                                    DYNAMIC_TYPE_X509_CTX);
    if (ctx != NULL) {
        XMEMSET(ctx, 0, sizeof(WOLFSSL_X509_STORE_CTX));
        ctx->heap = heap;
#ifdef OPENSSL_EXTRA
        if (wolfSSL_X509_STORE_CTX_init(ctx, NULL, NULL, NULL) !=
                WOLFSSL_SUCCESS) {
            wolfSSL_X509_STORE_CTX_free(ctx);
            ctx = NULL;
        }
#endif
    }

    return ctx;
}

/* This API is necessary outside of OPENSSL_EXTRA because it is used in
 * SetupStoreCtxCallback */
/* free's extra data */
void wolfSSL_X509_STORE_CTX_free(WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_free");
    if (ctx != NULL) {
#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
        wolfSSL_CRYPTO_cleanup_ex_data(&ctx->ex_data);
#endif

#ifdef OPENSSL_EXTRA
        XFREE(ctx->param, ctx->heap, DYNAMIC_TYPE_OPENSSL);
        ctx->param = NULL;

        if (ctx->chain != NULL) {
            wolfSSL_sk_X509_pop_free(ctx->chain, NULL);
        }
        if (ctx->owned != NULL) {
            wolfSSL_sk_X509_pop_free(ctx->owned, NULL);
        }

        if (ctx->current_issuer != NULL) {
            wolfSSL_X509_free(ctx->current_issuer);
            ctx->current_issuer = NULL;
        }
#endif

        XFREE(ctx, ctx->heap, DYNAMIC_TYPE_X509_CTX);
    }
}

#ifdef OPENSSL_EXTRA

#if defined(SESSION_CERTS) || defined(WOLFSSL_SIGNER_DER_CERT)

/**
 * Find the issuing cert of the input cert. On a self-issued cert (issuer name
 * equals subject name) this function will return an error.
 * @param issuer The issuer x509 struct is returned here
 * @param cm     The cert manager that is queried for the issuer
 * @param x      This cert's issuer will be queried in cm
 * @return       WOLFSSL_SUCCESS on success
 *               WOLFSSL_FAILURE on error
 */
static int x509GetIssuerFromCM(WOLFSSL_X509 **issuer, WOLFSSL_CERT_MANAGER* cm,
        WOLFSSL_X509 *x)
{
    Signer* ca = NULL;
    WC_DECLARE_VAR(cert, DecodedCert, 1, 0);

    if (cm == NULL || x == NULL || x->derCert == NULL) {
        WOLFSSL_MSG("No cert DER buffer or NULL cm. Defining "
                    "WOLFSSL_SIGNER_DER_CERT could solve the issue");
        return WOLFSSL_FAILURE;
    }

    WC_ALLOC_VAR_EX(cert, DecodedCert, 1, NULL, DYNAMIC_TYPE_DCERT,
        return WOLFSSL_FAILURE);

    /* Use existing CA retrieval APIs that use DecodedCert. */
    InitDecodedCert(cert, x->derCert->buffer, x->derCert->length, cm->heap);
    if (ParseCertRelative(cert, CERT_TYPE, 0, NULL, NULL) == 0
            && !cert->selfIssued) {
    #ifndef NO_SKID
        if (cert->extAuthKeyIdSet)
            ca = GetCA(cm, cert->extAuthKeyId);
        if (ca == NULL)
            ca = GetCAByName(cm, cert->issuerHash);
    #else /* NO_SKID */
        ca = GetCA(cm, cert->issuerHash);
    #endif /* NO SKID */
    }
    FreeDecodedCert(cert);
    WC_FREE_VAR_EX(cert, NULL, DYNAMIC_TYPE_DCERT);

    if (ca == NULL)
        return WOLFSSL_FAILURE;

#ifdef WOLFSSL_SIGNER_DER_CERT
    /* populate issuer with Signer DER. A signer restored from a cert cache
     * (cm_restore_cert_row()) carries no DER, so fall back to the empty
     * certificate below rather than dereferencing NULL. */
    if ((ca->derCert != NULL) && (ca->derCert->buffer != NULL)) {
        if (wolfSSL_X509_d2i_ex(issuer, ca->derCert->buffer,
                ca->derCert->length, cm->heap) == NULL)
            return WOLFSSL_FAILURE;
    }
    else
#endif
    {
        /* Create an empty certificate as CA doesn't have a certificate. */
        *issuer = (WOLFSSL_X509 *)XMALLOC(sizeof(WOLFSSL_X509), 0,
            DYNAMIC_TYPE_OPENSSL);
        if (*issuer == NULL)
            return WOLFSSL_FAILURE;

        InitX509((*issuer), 1, NULL);
    }

    return WOLFSSL_SUCCESS;
}
#endif /* SESSION_CERTS || WOLFSSL_SIGNER_DER_CERT */

WOLFSSL_X509_STORE_CTX* wolfSSL_X509_STORE_CTX_new(void)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_new");
    return wolfSSL_X509_STORE_CTX_new_ex(NULL);
}

int wolfSSL_X509_STORE_CTX_init(WOLFSSL_X509_STORE_CTX* ctx,
     WOLFSSL_X509_STORE* store, WOLFSSL_X509* x509,
     WOLF_STACK_OF(WOLFSSL_X509)* sk)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_init");

    if (ctx != NULL) {
        ctx->store = store;
        #ifndef WOLFSSL_X509_STORE_CERTS
        ctx->current_cert = x509;
        #else
        if(x509 != NULL){
            ctx->current_cert = wolfSSL_X509_d2i_ex(NULL,
                    x509->derCert->buffer,
                    x509->derCert->length,
                    x509->heap);
            if(ctx->current_cert == NULL)
                return WOLFSSL_FAILURE;
        } else
            ctx->current_cert = NULL;
        #endif

        ctx->ctxIntermediates = sk;
        ctx->setTrustedSk = NULL;
#ifdef HAVE_CRL
        ctx->crls = NULL;
#endif
        if (ctx->chain != NULL) {
            wolfSSL_sk_X509_pop_free(ctx->chain, NULL);
            ctx->chain = NULL;
        }
        /* Release the issuers retained by the previous verification and start
         * a fresh stack. X509StoreVerifyCert() drops the issuer it decodes
         * when this is NULL, so the context must always carry one. */
        wolfSSL_sk_X509_pop_free(ctx->owned, NULL);
        ctx->owned = wolfSSL_sk_X509_new_null();
        if (ctx->owned == NULL) {
            WOLFSSL_MSG("wolfSSL_X509_STORE_CTX_init failed");
            return WOLFSSL_FAILURE;
        }
#ifdef SESSION_CERTS
        ctx->sesChain = NULL;
#endif
        ctx->domain = NULL;
#ifdef HAVE_EX_DATA
        XMEMSET(&ctx->ex_data, 0, sizeof(ctx->ex_data));
#endif
#if defined(WOLFSSL_APACHE_HTTPD) || defined(OPENSSL_EXTRA)
        ctx->depth = WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH;
#endif

        ctx->userCtx = NULL;
        ctx->verify_cb = NULL;
        ctx->error = 0;
        ctx->error_depth = 0;
        ctx->discardSessionCerts = 0;

        if (ctx->param == NULL) {
            ctx->param = (WOLFSSL_X509_VERIFY_PARAM*)XMALLOC(
                           sizeof(WOLFSSL_X509_VERIFY_PARAM),
                           ctx->heap, DYNAMIC_TYPE_OPENSSL);
            if (ctx->param == NULL){
                WOLFSSL_MSG("wolfSSL_X509_STORE_CTX_init failed");
                return WOLFSSL_FAILURE;
            }
        }
        XMEMSET(ctx->param, 0, sizeof(*ctx->param));

        /* Inherit the store's parameters, including the hostname / IP the
         * caller expects the peer to present. */
        if (store != NULL && store->param != NULL) {
            if (wolfSSL_X509_VERIFY_PARAM_set1(ctx->param, store->param)
                    != WOLFSSL_SUCCESS) {
                WOLFSSL_MSG("wolfSSL_X509_STORE_CTX_init failed");
                return WOLFSSL_FAILURE;
            }
        }

        return WOLFSSL_SUCCESS;
    }
    return WOLFSSL_FAILURE;
}

/* Its recommended to use a full free -> init cycle of all the objects
 * because wolfSSL_X509_STORE_CTX_init may modify the store too which doesn't
 * get reset here. */
void wolfSSL_X509_STORE_CTX_cleanup(WOLFSSL_X509_STORE_CTX* ctx)
{
    if (ctx != NULL) {

        XFREE(ctx->param, ctx->heap, DYNAMIC_TYPE_OPENSSL);
        ctx->param = NULL;

        wolfSSL_X509_STORE_CTX_init(ctx, NULL, NULL, NULL);
    }
}


#ifdef HAVE_CRL
/* Set the CRLs to use during certificate verification. The stack is not
 * copied. The caller keeps ownership and has to keep the stack valid as long
 * as it is set on the ctx. */
void wolfSSL_X509_STORE_CTX_set0_crls(WOLFSSL_X509_STORE_CTX *ctx,
                                      WOLF_STACK_OF(WOLFSSL_X509_CRL) *sk)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set0_crls");
    if (ctx != NULL) {
        ctx->crls = sk;
    }
}
#endif

void wolfSSL_X509_STORE_CTX_trusted_stack(WOLFSSL_X509_STORE_CTX *ctx,
                                          WOLF_STACK_OF(WOLFSSL_X509) *sk)
{
    if (ctx != NULL) {
        ctx->setTrustedSk = sk;
    }
}


#endif /* OPENSSL_EXTRA */

#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
/* Returns corresponding X509 error from internal ASN error <e> */
int GetX509Error(int e)
{
    switch (e) {
        case WC_NO_ERR_TRACE(ASN_BEFORE_DATE_E):
            return WOLFSSL_X509_V_ERR_CERT_NOT_YET_VALID;
        case WC_NO_ERR_TRACE(ASN_AFTER_DATE_E):
            return WOLFSSL_X509_V_ERR_CERT_HAS_EXPIRED;
        case WC_NO_ERR_TRACE(ASN_NO_SIGNER_E):
            /* get issuer error if no CA found locally */
            return WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
        case WC_NO_ERR_TRACE(RPK_UNTRUSTED_E):
            /* RFC 7250 Raw Public Key not trusted out of band. Distinct from
             * the X.509 issuer-lookup error above so verify callbacks that
             * accept ASN_NO_SIGNER_E / UNABLE_TO_GET_ISSUER_CERT_LOCALLY do not
             * accidentally accept an unauthenticated RPK. */
            return WOLFSSL_X509_V_ERR_RPK_UNTRUSTED;
        case WC_NO_ERR_TRACE(DOMAIN_NAME_MISMATCH):
            return WOLFSSL_X509_V_ERR_HOSTNAME_MISMATCH;
        case WC_NO_ERR_TRACE(IPADDR_MISMATCH):
            return WOLFSSL_X509_V_ERR_IP_ADDRESS_MISMATCH;
        case WC_NO_ERR_TRACE(ASN_SELF_SIGNED_E):
            return WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
        case WC_NO_ERR_TRACE(ASN_PATHLEN_INV_E):
        case WC_NO_ERR_TRACE(ASN_PATHLEN_SIZE_E):
            return WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED;
        case WC_NO_ERR_TRACE(ASN_SIG_OID_E):
        case WC_NO_ERR_TRACE(ASN_SIG_CONFIRM_E):
        case WC_NO_ERR_TRACE(ASN_SIG_HASH_E):
        case WC_NO_ERR_TRACE(ASN_SIG_KEY_E):
            return WOLFSSL_X509_V_ERR_CERT_SIGNATURE_FAILURE;
        /* We can't disambiguate if its the before or after date that caused
         * the error. Assume expired. */
        case WC_NO_ERR_TRACE(CRL_CERT_DATE_ERR):
            return WOLFSSL_X509_V_ERR_CRL_HAS_EXPIRED;
        case WC_NO_ERR_TRACE(CRL_CERT_REVOKED):
            return WOLFSSL_X509_V_ERR_CERT_REVOKED;
        case WC_NO_ERR_TRACE(CRL_MISSING):
            return WOLFSSL_X509_V_ERR_UNABLE_TO_GET_CRL;
        case WC_NO_ERR_TRACE(EXTKEYUSE_AUTH_E):
            return WOLFSSL_X509_V_ERR_INVALID_PURPOSE;
        /* <e> is an internal wolfSSL return code, not an X509_V_* code, so 1
         * here is WOLFSSL_SUCCESS - it does not collide with
         * WOLFSSL_X509_V_ERR_UNSPECIFIED, which shares the value but never
         * reaches this function. */
        case 0:
        case 1:
            return 0;
        default:
#ifdef HAVE_WOLFSSL_MSG_EX
            WOLFSSL_MSG_EX("Error not configured or implemented yet: %d", e);
#else
            WOLFSSL_MSG("Error not configured or implemented yet");
#endif
            return e;
    }
}
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */

#ifdef OPENSSL_EXTRA

static void SetupStoreCtxError_ex(WOLFSSL_X509_STORE_CTX* ctx, int ret,
                                                                    int depth)
{
    int error = GetX509Error(ret);

    /* Do not overwrite a previously recorded error with success; preserve
     * the worst-seen error across the chain walk. */
    if (error == 0 && ctx->error != 0)
        return;

    wolfSSL_X509_STORE_CTX_set_error(ctx, error);
    wolfSSL_X509_STORE_CTX_set_error_depth(ctx, depth);
}

static void SetupStoreCtxError(WOLFSSL_X509_STORE_CTX* ctx, int ret)
{
    int depth = 0;

    /* Set error depth */
    if (ctx->chain)
        depth = (int)ctx->chain->num;

    SetupStoreCtxError_ex(ctx, ret, depth);
}

#ifndef NO_ASN_TIME
/* Post certificate validation date handling. This function is called after the
 * certificate has been verified by the certificate manager. It then checks if
 * X509 store parameters are set for date validation override.
 * @param ctx The certificate store context
 * @param ret The return value from the certificate manager verify
 * @return The return value for the certificate date validation after override
 */
static int X509StoreVerifyCertDate(WOLFSSL_X509_STORE_CTX* ctx, int ret)
{
    byte *afterDate  = ctx->current_cert->notAfter.data;
    byte *beforeDate = ctx->current_cert->notBefore.data;

    /* Only override existing date errors or WOLFSSL_SUCCESS. */
    if (ret == WC_NO_ERR_TRACE(ASN_BEFORE_DATE_E) ||
            ret == WC_NO_ERR_TRACE(ASN_AFTER_DATE_E) ||
            ret == WC_NO_ERR_TRACE(WOLFSSL_SUCCESS)) {
#ifdef USE_WOLF_VALIDDATE
        WOLFSSL_X509_VERIFY_PARAM* param = NULL;

        /* If no external XVALIDATE_DATE was defined then use param for date
           validation overrides. */
        if (ctx->param != NULL) {
            param = ctx->param;
        }
        else if (ctx->store != NULL && ctx->store->param != NULL) {
            param = ctx->store->param;
        }

        if (param != NULL) {
            if ((param->flags & WOLFSSL_NO_CHECK_TIME) != 0) {
                WOLFSSL_MSG("Overriding date validation WOLFSSL_NO_CHECK_TIME");
                ret = WOLFSSL_SUCCESS;
            }
            else if ((param->flags & WOLFSSL_USE_CHECK_TIME) != 0 &&
                (param->check_time != 0)) {
                time_t checkTime = param->check_time;
                ret = WOLFSSL_SUCCESS; /* override date error and use custom set
                                        time for validating certificate dates */
                WOLFSSL_MSG("Override date validation, WOLFSSL_USE_CHECK_TIME");
                if (wc_ValidateDateWithTime(afterDate,
                    (byte)ctx->current_cert->notAfter.type, ASN_AFTER,
                    checkTime, ctx->current_cert->notAfter.length) < 1) {
                    ret = ASN_AFTER_DATE_E;
                }
                else if (wc_ValidateDateWithTime(beforeDate,
                    (byte)ctx->current_cert->notBefore.type, ASN_BEFORE,
                    checkTime, ctx->current_cert->notBefore.length) < 1) {
                    ret = ASN_BEFORE_DATE_E;
                }
            }
        #if defined(OPENSSL_ALL)
            else {
                WOLFSSL_MSG("Using system time for date validation");
                /* use system time for date validation */
                if (wc_ValidateDate(afterDate,
                        (byte)ctx->current_cert->notAfter.type, ASN_AFTER,
                        ctx->current_cert->notAfter.length) < 1) {
                    ret = ASN_AFTER_DATE_E;
                }
                else if (wc_ValidateDate(beforeDate,
                        (byte)ctx->current_cert->notBefore.type, ASN_BEFORE,
                        ctx->current_cert->notBefore.length) < 1) {
                    ret = ASN_BEFORE_DATE_E;
                }
            }
        #endif
        }
#else
        if (XVALIDATE_DATE(afterDate,
                (byte)ctx->current_cert->notAfter.type, ASN_AFTER,
                ctx->current_cert->notAfter.length) < 1) {
            ret = ASN_AFTER_DATE_E;
        }
        else if (XVALIDATE_DATE(beforeDate,
                (byte)ctx->current_cert->notBefore.type, ASN_BEFORE,
                ctx->current_cert->notBefore.length) < 1) {
            ret = ASN_BEFORE_DATE_E;
        }
#endif /* USE_WOLF_VALIDDATE */
    }

    return ret;
}
#endif /* NO_ASN_TIME */

#ifdef HAVE_CRL
/* Check ctx->current_cert against the CRLs set with
 * X509_STORE_CTX_set0_crls.
 * Returns WOLFSSL_SUCCESS if a CRL for the cert's issuer is in the stack and
 * the cert is not revoked. Returns CRL_MISSING if the stack has no CRL for
 * the issuer. Returns a negative error on revocation or CRL failure. */
static int X509StoreCheckCtxCrls(WOLFSSL_X509_STORE_CTX* ctx)
{
    int ret = WC_NO_ERR_TRACE(CRL_MISSING);
    int found = 0;
    int dateErr = 0;
    int i;
    int numCrls;
    WC_DECLARE_VAR(cert, DecodedCert, 1, 0);

    numCrls = wolfSSL_sk_X509_CRL_num(ctx->crls);
    if (numCrls <= 0)
        return ret;

    WC_ALLOC_VAR_EX(cert, DecodedCert, 1, ctx->heap, DYNAMIC_TYPE_DCERT,
        return MEMORY_E);

    InitDecodedCert(cert, ctx->current_cert->derCert->buffer,
        ctx->current_cert->derCert->length, ctx->heap);
    /* The cert signature is verified by the CertManager. Only the issuer and
     * serial info is needed here. */
    if (ParseCertRelative(cert, CERT_TYPE, NO_VERIFY, ctx->store->cm, NULL)
            == 0) {
        /* Check all CRLs in the stack. A revocation in any of them wins over
         * a CRL that does not list the cert, like in the CertManager. */
        for (i = 0; i < numCrls; i++) {
            WOLFSSL_X509_CRL* crl = wolfSSL_sk_X509_CRL_value(ctx->crls, i);
            if (crl == NULL)
                continue;
            /* Use the store's cm to verify the CRL. The caller-owned crl is
             * not modified. */
            ret = CheckCertCRLFromCm(ctx->store->cm, crl, cert);
            if (ret == 0)
                found = 1;
            else if (ret == WC_NO_ERR_TRACE(CRL_CERT_DATE_ERR))
                dateErr = 1; /* stale CRL, another CRL can still vouch */
            else if (ret != WC_NO_ERR_TRACE(CRL_MISSING))
                break;
        }
    }
    FreeDecodedCert(cert);
    WC_FREE_VAR_EX(cert, ctx->heap, DYNAMIC_TYPE_DCERT);

    if (ret == 0 || ret == WC_NO_ERR_TRACE(CRL_MISSING) ||
            ret == WC_NO_ERR_TRACE(CRL_CERT_DATE_ERR)) {
        if (found)
            ret = WOLFSSL_SUCCESS;
        else if (dateErr)
            ret = WC_NO_ERR_TRACE(CRL_CERT_DATE_ERR);
        else
            ret = WC_NO_ERR_TRACE(CRL_MISSING);
    }
    return ret;
}
#endif /* HAVE_CRL */

/* Get the verification callback that applies to this context, or NULL when
 * none is installed. A callback set with wolfSSL_X509_STORE_CTX_set_verify_cb
 * takes precedence over one set on the store, matching OpenSSL.
 *
 * The context callback is settable in every OPENSSL_EXTRA build, so the
 * pathLen and INVALID_CA overrides driven from here are now reachable there
 * too, not just under OPENSSL_ALL or WOLFSSL_QT. */
static WOLFSSL_X509_STORE_CTX_verify_cb X509StoreGetVerifyCb(
        WOLFSSL_X509_STORE_CTX* ctx)
{
    if (ctx == NULL)
        return NULL;

    if (ctx->verify_cb != NULL)
        return ctx->verify_cb;

#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
    if (ctx->store != NULL)
        return ctx->store->verify_cb;
#endif

    return NULL;
}

/* Verify ctx->current_cert against the store.
 *
 * <cbRejected> is an out-parameter, never NULL. It is set to 1 when the
 * application's per-context verify callback explicitly rejected a certificate
 * the verification itself accepted, and to 0 otherwise. The rejection is
 * reported out of band rather than as a return value so that it cannot be
 * confused with any of the internal error codes this function passes through.
 *
 * A caller must stop chain building when it is set: a veto must not be turned
 * into a retry with another issuer, and must not be cleared by the
 * partial-chain fallback in wolfSSL_X509_verify_cert(). */
static int X509StoreVerifyCert(WOLFSSL_X509_STORE_CTX* ctx, int* cbRejected,
        WOLFSSL_X509_STORE_CTX_verify_cb verifyCb)
{
    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
    int crlRet = 0;
    int datesChecked = 0;
    WOLFSSL_ENTER("X509StoreVerifyCert");

    *cbRejected = 0;

    if (ctx->current_cert != NULL && ctx->current_cert->derCert != NULL) {
        ret = CM_VerifyBuffer_ex(ctx->store->cm,
                    ctx->current_cert->derCert->buffer,
                    ctx->current_cert->derCert->length,
                    WOLFSSL_FILETYPE_ASN1, 0, &crlRet);
        datesChecked = (ret == WOLFSSL_SUCCESS) ||
            (ret == WC_NO_ERR_TRACE(ASN_BEFORE_DATE_E)) ||
            (ret == WC_NO_ERR_TRACE(ASN_AFTER_DATE_E));
#ifdef HAVE_CRL
        /* The CRLs set with X509_STORE_CTX_set0_crls can revoke a cert the
         * CertManager accepted, or supply the CRL its own store lacked. */
        if (ctx->crls != NULL && ctx->store->cm->crlEnabled && datesChecked &&
                (crlRet == 0 || crlRet == WC_NO_ERR_TRACE(CRL_MISSING))) {
            int ctxCrlRet = X509StoreCheckCtxCrls(ctx);
            if (ctxCrlRet == WOLFSSL_SUCCESS) {
                crlRet = 0;
            }
            else if (ctxCrlRet != WC_NO_ERR_TRACE(CRL_MISSING)) {
                crlRet = ctxCrlRet;
            }
        }
        /* Revocation is reported before the dates, as OpenSSL does. */
        if (crlRet != 0) {
            SetupStoreCtxError(ctx, crlRet);
            if ((verifyCb == NULL) || (verifyCb(0, ctx) != 1)) {
                return crlRet;
            }
        }
#endif
    #ifndef NO_ASN_TIME
        /* update return value with any date validation overrides */
        ret = X509StoreVerifyCertDate(ctx, ret);
    #endif
        SetupStoreCtxError(ctx, ret);
        if (verifyCb != NULL) {
            /* Snapshot the error so the rejection below can tell one the
             * callback recorded itself from one left over from an earlier
             * certificate in the chain - SetupStoreCtxError() preserves the
             * worst error seen so far, so ctx->error is not necessarily
             * WOLFSSL_X509_V_OK on entry even when this certificate
             * verified. */
            int preCbError = ctx->error;

            if (verifyCb(ret >= 0 ? 1 : 0, ctx) == 1) {
                ret = WOLFSSL_SUCCESS;
            }
            else if (ret >= 0 && ctx->verify_cb != NULL) {
                /* Returning 0 must reject a chain the cert manager accepted. */
                if (ctx->error == preCbError) {
                    /* Keep an error the callback recorded itself; otherwise
                     * the rejection has no error to report. */
                    wolfSSL_X509_STORE_CTX_set_error(ctx,
                        WOLFSSL_X509_V_ERR_UNSPECIFIED);
                }
                *cbRejected = 1;
                ret = WOLFSSL_FAILURE;
            }
        #if !defined(NO_ASN_TIME) && defined(OPENSSL_ALL)
            else if (ret >= 0) {
                /* A store callback may reject one too, without a veto. */
                ret = WOLFSSL_FATAL_ERROR;
            }
        #endif
        }
    }
#if !defined(NO_ASN_TIME) && defined(OPENSSL_ALL)
    /* Skipped once the callback has rejected: the decision is already made,
     * and re-running the date check would consult the callback a second time,
     * which could overturn the rejection. */
    if (*cbRejected == 0 && !datesChecked && ret == WOLFSSL_SUCCESS) {
        /* With OpenSSL, we need to check the certificate's date
        * after certificate manager verification,
        * as it skips date validation when other errors are present.
        */
        ret = X509StoreVerifyCertDate(ctx, ret);
        SetupStoreCtxError(ctx, ret);
        ret = ret == WOLFSSL_SUCCESS ? 1 : 0;
        if (verifyCb != NULL) {
            if (verifyCb(ret, ctx) == 1) {
                ret = WOLFSSL_SUCCESS;
            }
            else {
                ret = -1;
            }
        }
    }
#endif
    (void)datesChecked;
    return ret;
}

static int addAllButSelfSigned(WOLF_STACK_OF(WOLFSSL_X509)*to,
                               WOLF_STACK_OF(WOLFSSL_X509)*from, int *numAdded)
{
    int ret = WOLFSSL_SUCCESS;
    int i = 0;
    int cnt = 0;
    WOLFSSL_X509 *x = NULL;

    for (i = 0; i < wolfSSL_sk_X509_num(from); i++) {
        x = wolfSSL_sk_X509_value(from, i);
        if (wolfSSL_X509_NAME_cmp(&x->issuer, &x->subject) != 0) {
            if (wolfSSL_sk_X509_push(to, x) <= 0) {
                ret = WOLFSSL_FAILURE;
                goto exit;
            }
            cnt++;
        }
    }

exit:
    if (numAdded != NULL) {
        *numAdded = cnt;
    }
    return ret;
}

static int X509StoreMoveCert(WOLFSSL_STACK *certs_stack,
                             WOLFSSL_STACK *dest_stack,
                             WOLFSSL_X509 *cert) {
    int i;

    if (certs_stack == NULL || dest_stack == NULL || cert == NULL)
        return WOLFSSL_FATAL_ERROR;

    for (i = 0; i < wolfSSL_sk_X509_num(certs_stack); i++) {
        if (wolfSSL_sk_X509_value(certs_stack, i) == cert) {
            wolfSSL_sk_X509_push(dest_stack,
                                 (WOLFSSL_X509*)wolfSSL_sk_pop_node(certs_stack, i));
            return WOLFSSL_SUCCESS;
        }
    }

    return WOLFSSL_FAILURE;
}

/* Push x509 onto the ctx chain with its own reference, like OpenSSL.
 * The chain owns a reference to each of its certs. */
static int X509StoreChainPush(WOLF_STACK_OF(WOLFSSL_X509)* chain,
                              WOLFSSL_X509* x509)
{
    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);

    if (x509 == NULL || wolfSSL_X509_up_ref(x509) != WOLFSSL_SUCCESS)
        return ret;
    ret = wolfSSL_sk_X509_push(chain, x509) > 0 ? WOLFSSL_SUCCESS :
        WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
    if (ret != WOLFSSL_SUCCESS)
        wolfSSL_X509_free(x509);
    return ret;
}

/* Returns 1 if `cert` (by pointer identity) is present in `stack`, else 0.
 * Used to keep a candidate that already failed verification off the reported
 * chain. */
static int X509StoreCertInStack(WOLF_STACK_OF(WOLFSSL_X509)* stack,
        WOLFSSL_X509* cert)
{
    int i;
    int num;

    if (stack == NULL || cert == NULL)
        return 0;

    /* Index by logical position like the other helpers in this file rather
     * than walking raw nodes. */
    num = wolfSSL_sk_X509_num(stack);
    for (i = 0; i < num; i++) {
        if (wolfSSL_sk_X509_value(stack, i) == cert)
            return 1;
    }

    return 0;
}

/* Current certificate failed, but it is possible there is an
 * alternative cert with the same subject key which will work.
 * Retry until all possible candidate certs are exhausted.
 * The temporary CAs of the abandoned path are not removed here: the caller
 * drops all of them before it verifies the next link. */
static void X509VerifyCertSetupRetry(WOLFSSL_X509_STORE_CTX* ctx,
    WOLF_STACK_OF(WOLFSSL_X509)* certs, WOLF_STACK_OF(WOLFSSL_X509)* failed,
    int* depth, int origDepth) {
    WOLFSSL_MSG("X509_verify_cert current cert failed, "
                "retrying with other certs.");
    X509StoreMoveCert(certs, failed, ctx->current_cert);
    ctx->current_cert = wolfSSL_sk_X509_pop(ctx->chain);
    /* Release the chain's reference. The cert stays valid through its
     * original owner. */
    wolfSSL_X509_free(ctx->current_cert);
    if (*depth < origDepth)
        *depth += 1;
}

/* Returns 1 if cur and x509 have identical DER encodings, 0 otherwise. */
static int X509DerEquals(WOLFSSL_X509* cur, WOLFSSL_X509* x509)
{
    if (cur == NULL || cur->derCert == NULL ||
        x509 == NULL || x509->derCert == NULL) {
        return 0;
    }
    if (cur->derCert->length != x509->derCert->length)
        return 0;
    return XMEMCMP(cur->derCert->buffer, x509->derCert->buffer,
                   x509->derCert->length) == 0;
}

/* Returns 1 if x509's DER matches an entry in either origTrustedSk (an
 * immutable snapshot of the caller's trusted set - store->certs or the
 * set0_trusted_stack override - captured before any intermediates were
 * injected for this verification call) or in store->trusted.  Returns 0
 * otherwise.  Used by the X509_V_FLAG_PARTIAL_CHAIN fallback to confirm that
 * a chain actually terminates at a caller-trusted certificate.
 * NOTE: origTrustedSk is a private snapshot, but store->trusted is read live
 * and unlocked here (as it is at the terminal issuer lookup); this mitigation
 * is deliberately asymmetric, so a single X509_STORE must not be shared across
 * threads verifying concurrently. */
static int X509StoreCertIsTrusted(WOLFSSL_X509_STORE* store,
        WOLFSSL_X509* x509, WOLF_STACK_OF(WOLFSSL_X509)* origTrustedSk)
{
    int i;
    int n;

    if (x509 == NULL || x509->derCert == NULL)
        return 0;

    if (origTrustedSk != NULL) {
        n = wolfSSL_sk_X509_num(origTrustedSk);
        for (i = 0; i < n; i++) {
            if (X509DerEquals(wolfSSL_sk_X509_value(origTrustedSk, i), x509))
                return 1;
        }
    }

    if (store != NULL && store->trusted != NULL) {
        n = wolfSSL_sk_X509_num(store->trusted);
        for (i = 0; i < n; i++) {
            if (X509DerEquals(wolfSSL_sk_X509_value(store->trusted, i), x509))
                return 1;
        }
    }

    return 0;
}

/* Enforce the BasicConstraints pathLenConstraint (RFC 5280 sec. 4.2.1.9 and
 * the path validation rules in sec. 6.1.4 (l)/(m)) over the certification path
 * assembled in ctx->chain.
 *
 * wolfSSL_X509_verify_cert() authenticates each certificate individually via
 * the CertManager, which parses every certificate as CERT_TYPE.  The issuer
 * pathLen check in ParseCertRelative() is gated on a non-CERT_TYPE certificate
 * type (it is reached on the TLS handshake path via CHAIN_CERT_TYPE), so the
 * OpenSSL-compatibility path never enforced it.  Re-create that check here over
 * the completed path so that a CA asserting pathlen:N cannot issue more than N
 * subordinate intermediate CAs.
 *
 * ctx->chain is ordered leaf first (index 0) up to the trust anchor (highest
 * index).  Walk from the trust anchor down toward the leaf, tracking the
 * remaining number of non-self-issued intermediate certificates permitted.
 * The budget is only enforced once some CA in the path actually asserts a
 * pathLenConstraint; an explicit "haveConstraint" flag tracks that, so every
 * value 0..WOLFSSL_MAX_PATH_LEN (the parser's hard cap on pathLenConstraint)
 * is a usable budget rather than overloading the cap as a "no constraint"
 * sentinel.  The leaf (index 0) issues nothing and is therefore not subject to
 * the constraint.
 *
 * Returns WOLFSSL_SUCCESS if the path satisfies every pathLenConstraint, or
 * WOLFSSL_FAILURE (with ctx->error set) on the first violation. */
static int X509StoreCheckPathLen(WOLFSSL_X509_STORE_CTX* ctx,
        WOLFSSL_X509_STORE_CTX_verify_cb verifyCb)
{
    int num;
    int i;
    word32 maxPathLen = 0;
    byte haveConstraint = 0;
    WOLFSSL_X509* anchor;

    if (ctx == NULL || ctx->chain == NULL)
        return WOLFSSL_SUCCESS;

    num = wolfSSL_sk_X509_num(ctx->chain);
    /* A pathLen violation requires at least one intermediate between the leaf
     * (index 0) and the trust anchor, i.e. a chain of three or more. */
    if (num < 3)
        return WOLFSSL_SUCCESS;

    /* The trust anchor (top of chain) is not part of the prospective
     * certification path (RFC 5280 sec. 6.1): it does not consume path-length
     * budget, and the loop below runs from num-2 down to 1 so the anchor is
     * never processed as an intermediate. A self-signed anchor that asserts its
     * own pathLenConstraint does still bound the path, matching
     * ParseCertRelative()'s trust-anchor handling, so seed the budget from
     * it. */
    anchor = wolfSSL_sk_X509_value(ctx->chain, num - 1);
    if (anchor != NULL && anchor->isCa && anchor->basicConstPlSet) {
        maxPathLen = (word32)anchor->pathLength;
        haveConstraint = 1;
    }

    for (i = num - 2; i >= 1; i--) {
        WOLFSSL_X509* cert = wolfSSL_sk_X509_value(ctx->chain, i);
        int selfIssued;

        if (cert == NULL)
            continue;

        selfIssued =
            (wolfSSL_X509_NAME_cmp(&cert->issuer, &cert->subject) == 0);

        /* RFC 5280 sec. 6.1.4 (l): a non-self-issued *CA* certificate consumes
         * one unit of the issuer's remaining path length budget. Gate on isCa
         * to match ParseCertRelative() (wolfcrypt/src/asn.c) and the (m) step
         * below, so a non-CA intermediate tolerated via verify_cb does not
         * trigger a false PATH_LENGTH_EXCEEDED. Only meaningful once a CA above
         * has asserted a constraint (haveConstraint). */
        if (!selfIssued && cert->isCa && haveConstraint) {
            if (maxPathLen == 0) {
                SetupStoreCtxError_ex(ctx,
                    WOLFSSL_X509_V_ERR_PATH_LENGTH_EXCEEDED, i);
                /* Allow an application verify callback to override, matching
                 * the INVALID_CA handling in wolfSSL_X509_verify_cert(). */
                if (verifyCb != NULL && verifyCb(0, ctx) == 1) {
                    /* Overridden: keep walking without decrementing (budget is
                     * already exhausted). */
                    continue;
                }
                return WOLFSSL_FAILURE;
            }
            maxPathLen--;
        }

        /* RFC 5280 sec. 6.1.4 (m): tighten the budget with this CA's own
         * pathLenConstraint, if present. The first constraint encountered seeds
         * the budget; subsequent ones only ever lower it. */
        if (cert->isCa && cert->basicConstPlSet &&
                (!haveConstraint || (word32)cert->pathLength < maxPathLen)) {
            maxPathLen = (word32)cert->pathLength;
            haveConstraint = 1;
        }
    }

    return WOLFSSL_SUCCESS;
}

/* Returns 1 if X509_V_FLAG_PARTIAL_CHAIN is set on ctx or on its store,
 * otherwise 0.  ctx and ctx->store must be non-NULL. */
static int X509StoreCertPartialChainEnabled(WOLFSSL_X509_STORE_CTX* ctx)
{
    /* PARTIAL_CHAIN lets any trusted cert end the path */
    if (ctx->flags & WOLFSSL_PARTIAL_CHAIN) {
        return 1;
    }
    if (ctx->store->param != NULL &&
            (ctx->store->param->flags & WOLFSSL_PARTIAL_CHAIN)) {
        return 1;
    }
    return 0;
}

/* Verifies certificate chain using WOLFSSL_X509_STORE_CTX
 * returns 1 on success or <= 0 on failure.
 */
int wolfSSL_X509_verify_cert(WOLFSSL_X509_STORE_CTX* ctx)
{
    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
    int done = 0;
    int depth = 0;
    int origDepth = 0;
    int cbRejected = 0;
    WOLFSSL_X509 *issuer = NULL;
    WOLFSSL_X509 *orig = NULL;
    WOLF_STACK_OF(WOLFSSL_X509)* callerTrusted = NULL;
    WOLF_STACK_OF(WOLFSSL_X509)* certsToUse = NULL;
    WOLF_STACK_OF(WOLFSSL_X509)* failedCerts = NULL;
    WOLF_STACK_OF(WOLFSSL_X509)* origTrustedSk = NULL;
    WOLFSSL_X509_STORE_CTX_verify_cb verifyCb;
    WOLFSSL_ENTER("wolfSSL_X509_verify_cert");

    if (ctx == NULL || ctx->store == NULL || ctx->store->cm == NULL
         || ctx->current_cert == NULL || ctx->current_cert->derCert == NULL) {
        return WOLFSSL_FATAL_ERROR;
    }

    verifyCb = X509StoreGetVerifyCb(ctx);

    /* Chain building mutates the working stack: caller-supplied intermediates
     * are appended and X509VerifyCertSetupRetry moves failed certs out of it.
     * store->certs is shared by every connection using this store and
     * setTrustedSk is owned by the caller, so build a per-verification shallow
     * copy (certsToUse) and leave both untouched. This removes the write-side
     * corruption a concurrent verification used to inflict on those stacks, but
     * it does NOT make concurrent use of one X509_STORE safe: the dup is itself
     * an unlocked read, and store->trusted is still walked live (see the NOTE
     * below). A single store must not be shared across threads that verify
     * concurrently.
     *
     * The X509_V_FLAG_PARTIAL_CHAIN fallback needs the set of certs that were
     * caller-trusted before any intermediates were injected. Snapshot it from
     * certsToUse - the private copy, taken before addAllButSelfSigned() injects
     * intermediates - rather than walking the shared stack a second time, so
     * the two snapshots are provably identical. Both dups hold borrowed
     * references and are shallow-freed at exit. */
    callerTrusted = ctx->store->certs;
    if (ctx->setTrustedSk != NULL) {
        callerTrusted = ctx->setTrustedSk;
    }

    if (callerTrusted != NULL) {
        certsToUse = wolfSSL_shallow_sk_dup(callerTrusted);
        if (certsToUse != NULL)
            origTrustedSk = wolfSSL_shallow_sk_dup(certsToUse);
        if (origTrustedSk == NULL) {
            ret = WOLFSSL_FAILURE;
            goto exit;
        }
    }
    else {
        certsToUse = wolfSSL_sk_X509_new_null();
    }
    if (certsToUse == NULL) {
        ret = WOLFSSL_FAILURE;
        goto exit;
    }
    /* Add the intermediates provided on init to the list of untrusted
     * intermediates to be used. */
    ret = addAllButSelfSigned(certsToUse, ctx->ctxIntermediates, NULL);
    if (ret != WOLFSSL_SUCCESS) {
        goto exit;
    }

    if (ctx->chain != NULL) {
        wolfSSL_sk_X509_pop_free(ctx->chain, NULL);
    }
    ctx->chain = wolfSSL_sk_X509_new_null();
    if (ctx->chain == NULL) {
        ret = WOLFSSL_FAILURE;
        goto exit;
    }

    failedCerts = wolfSSL_sk_X509_new_null();
    if (!failedCerts) {
        /* Fail closed: ret is still WOLFSSL_SUCCESS from the checks above, so
         * an unset error here would make the function report a verified chain
         * after an allocation failure. */
        ret = WOLFSSL_FAILURE;
        goto exit;
    }
    /* An explicit negative depth leaves no room for any chain,
     * not even a trusted leaf: reject before building one. */
    if (ctx->depth < 0) {
        SetupStoreCtxError_ex(ctx, WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG, 0);
        ret = WOLFSSL_FAILURE;
        goto exit;
    }
    /* The struct is public, so also honor a positive depth written directly
     * (no setter). Clamp so the + 1 can't overflow. */
    depth = (ctx->depth < INT_MAX) ? ctx->depth + 1 : INT_MAX;

    orig = ctx->current_cert;
    origDepth = depth;
    while(done == 0 && depth > 0) {
        issuer = NULL;

        /* Try to find an untrusted issuer first. Skip certs already on the
         * path so an issuer cycle (A <- B <- A) ends the search instead of
         * running until the depth budget is spent. current_cert is not on
         * ctx->chain yet, so a self-issued terminus is still found. */
        ret = X509StoreGetIssuerSkip(&issuer, certsToUse,
                                     ctx->current_cert, ctx->chain);
        if (ret == WOLFSSL_SUCCESS) {
            if (ctx->current_cert == issuer) {
                X509StoreChainPush(ctx->chain, ctx->current_cert);
                break;
            }

            /* We found our issuer in the non-trusted cert list, add it
             * to the CM and verify the current cert against it */
        #ifndef WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE
            /* RFC 5280 4.2.1.9: reject non-CA issuer. verify_cb may
             * suppress the INVALID_CA error to keep building the chain,
             * but the leaf signature must still be verified against the
             * issuer below - never skip X509StoreVerifyCert. */
            if (!issuer->isCa) {
                /* error depth is current depth + 1 */
                SetupStoreCtxError_ex(ctx, WOLFSSL_X509_V_ERR_INVALID_CA,
                                (ctx->chain) ? (int)(ctx->chain->num + 1) : 1);
                if (verifyCb != NULL) {
                    ret = verifyCb(0, ctx);
                    if (ret != WOLFSSL_SUCCESS) {
                        ret = WOLFSSL_FAILURE;
                        goto exit;
                    }
                }
                else {
                    ret = WOLFSSL_FAILURE;
                    goto exit;
                }
            }
        #endif
            /* The CertManager picks the signer itself, by key id or name, from
             * everything it holds. Drop the intermediates loaded for the links
             * below and for abandoned candidates, so that issuer is the only
             * untrusted signer this link can verify against. Otherwise a cert
             * signed by one of those would pass here while the path goes on
             * with issuer, a same-named cert that never signed it. */
            if (wolfSSL_CertManagerUnloadTempIntermediateCerts(ctx->store->cm)
                    != WOLFSSL_SUCCESS) {
                ret = WOLFSSL_FATAL_ERROR;
                goto exit;
            }
            /* NOTE: this loads the caller-supplied intermediate into the
             * shared ctx->store->cm as a WOLFSSL_TEMP_CA, and the unload paths
             * drop *all* WOLFSSL_TEMP_CA signers in that CertManager, not only
             * the ones added here.  This copy removes the working-stack race,
             * but two threads running X509_verify_cert() against the same
             * X509_STORE still contend on store->cm.  Concurrent verification
             * on a single shared store therefore remains unsupported; callers
             * needing it must use a store per thread. */
            ret = X509StoreAddCa(ctx->store, issuer, WOLFSSL_TEMP_CA);
            if (ret != WOLFSSL_SUCCESS) {
                X509VerifyCertSetupRetry(ctx, certsToUse, failedCerts,
                    &depth, origDepth);
                continue;
            }
            ret = X509StoreVerifyCert(ctx, &cbRejected, verifyCb);
            if (cbRejected) {
                /* The application vetoed this certificate.  Stop instead of
                 * looking for another issuer: the decision is the
                 * application's and retrying would only ask it again. */
                ret = WOLFSSL_FAILURE;
                goto exit;
            }
            if (ret != WOLFSSL_SUCCESS) {
                X509VerifyCertSetupRetry(ctx, certsToUse, failedCerts,
                    &depth, origDepth);
                continue;
            }
            /* Add it to the current chain and look at the issuer cert next */
            X509StoreChainPush(ctx->chain, ctx->current_cert);
            ctx->current_cert = issuer;
        }
        else if (ret == WC_NO_ERR_TRACE(WOLFSSL_FAILURE)) {
            /* Could not find in untrusted list, only place left is
             * a trusted CA in the CM. Drop any caller-supplied untrusted
             * intermediates that were temporarily loaded into the CertManager
             * to authenticate child certificates, so the current certificate
             * must verify against a genuinely trusted CA. They must not be
             * allowed to anchor the path: otherwise a chain that never reaches
             * a configured trust anchor (or whose intermediate signature is
             * invalid) would be accepted. */
            if (wolfSSL_CertManagerUnloadTempIntermediateCerts(ctx->store->cm)
                    != WOLFSSL_SUCCESS) {
                /* Could not guarantee the temporary intermediates were
                 * dropped; fail closed rather than risk verifying the current
                 * certificate against one. */
                ret = WOLFSSL_FATAL_ERROR;
                goto exit;
            }
            ret = X509StoreVerifyCert(ctx, &cbRejected, verifyCb);
            if (cbRejected) {
                /* An application veto is final.  The partial-chain fallback
                 * below must not accept the chain here and clear ctx->error:
                 * the certificate verified, the application rejected it. */
                ret = WOLFSSL_FAILURE;
                goto exit;
            }
            if (ret != WOLFSSL_SUCCESS) {
                /* WOLFSSL_PARTIAL_CHAIN may only terminate the chain at a
                 * certificate the caller actually trusts, so verify that
                 * ctx->current_cert is itself in the original trust set. */
                if (X509StoreCertPartialChainEnabled(ctx) &&
                    X509StoreCertIsTrusted(ctx->store, ctx->current_cert,
                        origTrustedSk)) {
                    X509StoreChainPush(ctx->chain, ctx->current_cert);
                    /* Clear error set by the failed X509StoreVerifyCert
                     * attempt; the partial-chain fallback accepted the
                     * chain at a caller-trusted certificate. */
                    ctx->error = 0;
                    ret = WOLFSSL_SUCCESS;
                    /* The caller-trusted certificate terminates the path:
                     * it is the anchor, so stop here rather than falling
                     * through to the "finish building the chain" push below,
                     * which would add ctx->current_cert to ctx->chain a
                     * second time.  Mirrors the self-issued terminus break
                     * above; the depth>0/done==0 success path accepts it. */
                    break;
                } else {
                    X509VerifyCertSetupRetry(ctx, certsToUse, failedCerts,
                        &depth, origDepth);
                    continue;
                }
            }

            /* Cert verified, finish building the chain */
            X509StoreChainPush(ctx->chain, ctx->current_cert);
            issuer = NULL;
    #ifdef WOLFSSL_SIGNER_DER_CERT
            x509GetIssuerFromCM(&issuer, ctx->store->cm, ctx->current_cert);
            if (issuer != NULL && ctx->owned != NULL) {
                wolfSSL_sk_X509_push(ctx->owned, issuer);
            }
    #else
            /* A candidate that already failed verification (moved to
             * failedCerts by the retry path) must not terminate the reported
             * chain.  setTrustedSk / store->trusted are searched by name+AKID,
             * not by signature, and setTrustedSk is no longer pruned during
             * chain building, so a same-subject cert that was tried and
             * rejected can match here.  Skip those entries and keep scanning so
             * a genuine anchor further down the stack is still found. */
            if (ctx->setTrustedSk == NULL) {
                X509StoreGetIssuerSkip(&issuer,
                    ctx->store->trusted, ctx->current_cert, failedCerts);
            }
            else {
                X509StoreGetIssuerSkip(&issuer,
                    ctx->setTrustedSk, ctx->current_cert, failedCerts);
            }
    #endif
            if (issuer != NULL) {
                X509StoreChainPush(ctx->chain, issuer);
            }

            done = 1;
        }
        else {
            goto exit;
        }

        depth--;
    }

    /* Success requires the path to have reached a configured trust anchor
     * (done == 1), to have terminated at a caller-trusted self-signed
     * certificate via the break above (done == 0 with depth still > 0), or
     * to have spent its depth budget exactly on a trust anchor (below).  A
     * loop that ran out of its depth budget (depth <= 0) without completing
     * must fail with CERT_CHAIN_TOO_LONG unless the cert it stopped on is
     * caller-trusted and either self-issued or accepted by
     * X509_V_FLAG_PARTIAL_CHAIN: the trust anchor never counts against depth.
     * ret may still be WOLFSSL_SUCCESS from the last link, so it cannot be
     * relied on here. */
    if (ret == WOLFSSL_SUCCESS && done == 0 && depth <= 0) {
        int anchorEndsPath = 0;

        /* A trusted anchor from certsToUse is not an intermediate, so accept
         * it here if it ends the path instead of counting it against depth. */
        if (X509StoreCertIsTrusted(ctx->store, ctx->current_cert,
                origTrustedSk)) {
            /* self-issued anchor: ends the path without a verify */
            if (wolfSSL_X509_check_issued(ctx->current_cert,
                        ctx->current_cert) == WOLFSSL_X509_V_OK) {
                anchorEndsPath = 1;
            }
            else if (X509StoreCertPartialChainEnabled(ctx)) {
                /* verify the anchor so the verify callback sees it and
                 * can veto it. */
                if (wolfSSL_CertManagerUnloadTempIntermediateCerts(
                        ctx->store->cm) != WOLFSSL_SUCCESS) {
                    ret = WOLFSSL_FATAL_ERROR;
                    goto exit;
                }
                ret = X509StoreVerifyCert(ctx, &cbRejected, verifyCb);
                if (cbRejected) {
                    ret = WOLFSSL_FAILURE;
                    goto exit;
                }
                if (ret != WOLFSSL_SUCCESS) {
                    /* the partial chain is accepted at a caller-trusted
                     * cert; clear the error from the failed verify */
                    ctx->error = 0;
                }
                anchorEndsPath = 1;
            }
        }

        if (anchorEndsPath) {
            ret = X509StoreChainPush(ctx->chain, ctx->current_cert);
        }
        else {
            SetupStoreCtxError_ex(ctx, WOLFSSL_X509_V_ERR_CERT_CHAIN_TOO_LONG,
                wolfSSL_sk_X509_num(ctx->chain));
            ret = WOLFSSL_FAILURE;
        }
    }

    /* RFC 5280 sec. 6.1.4: the per-certificate CertManager verification above
     * does not enforce the issuer's BasicConstraints pathLenConstraint on this
     * API path, so check it over the assembled path before reporting success. */
    if (ret == WOLFSSL_SUCCESS) {
        ret = X509StoreCheckPathLen(ctx, verifyCb);
    }

    /* Enforce hostname / IP verification from X509_VERIFY_PARAM if set.
     * Always check against the leaf (end-entity) certificate, captured in
     * orig before the chain-building loop modified ctx->current_cert.
     *
     * A mismatch is reported to the application verify callback the way
     * OpenSSL's check_id_error() does: record error, error_depth and
     * current_cert, then call it with ok=0, and let a return of 1 override.
     * Without that call a callback installed to inspect or override
     * verification errors never sees a hostname or IP mismatch. */
    if (ctx->param != NULL) {
        if (ret == WOLFSSL_SUCCESS && ctx->param->hostName[0] != '\0') {
            if (wolfSSL_X509_check_host(orig,
                    ctx->param->hostName,
                    XSTRLEN(ctx->param->hostName),
                    ctx->param->hostFlags, NULL) != WOLFSSL_SUCCESS) {
                ctx->error = WOLFSSL_X509_V_ERR_HOSTNAME_MISMATCH;
                ctx->error_depth = 0;
                ctx->current_cert = orig;
                if (verifyCb == NULL || verifyCb(0, ctx) != 1) {
                    ret = WOLFSSL_FAILURE;
                }
            }
        }
        if (ret == WOLFSSL_SUCCESS && ctx->param->ipasc[0] != '\0') {
            if (wolfSSL_X509_check_ip_asc(orig,
                    ctx->param->ipasc,
                    ctx->param->hostFlags) != WOLFSSL_SUCCESS) {
                ctx->error = WOLFSSL_X509_V_ERR_IP_ADDRESS_MISMATCH;
                ctx->error_depth = 0;
                ctx->current_cert = orig;
                if (verifyCb == NULL || verifyCb(0, ctx) != 1) {
                    ret = WOLFSSL_FAILURE;
                }
            }
        }
    }

exit:
    /* failedCerts, certsToUse and origTrustedSk hold only borrowed references;
     * free the stack nodes, not the certs.  All three are per-verification
     * stacks (certsToUse/origTrustedSk are shallow dups of the caller's set),
     * so none of the caller's own stacks are touched here. */
    wolfSSL_sk_X509_free(failedCerts);

    /* Remove intermediates added to CM. Unconditional: a "did we add one" flag
     * is cleared by the same failure paths that leave one resident. Clears all
     * TEMP_CAs, so concurrent verifies on one store are unsupported. */
    if (ctx != NULL) {
        if (ctx->store != NULL) {
            if (wolfSSL_CertManagerUnloadTempIntermediateCerts(ctx->store->cm)
                    != WOLFSSL_SUCCESS) {
                WOLFSSL_MSG("Failed to unload temporary intermediates");
                /* Residue would anchor later verifications. */
                if (ret == WOLFSSL_SUCCESS)
                    ret = WOLFSSL_FAILURE;
            }
        }
        if (orig != NULL) {
            ctx->current_cert = orig;
        }
    }
    wolfSSL_sk_X509_free(certsToUse);
    wolfSSL_sk_X509_free(origTrustedSk);

    /* Fail closed on the way out: every failure has to be reportable through
     * X509_STORE_CTX_get_error(), or the application is told the chain was
     * fine while this function reports failure. Not all of them record one -
     * a verify callback that rejects a chain the verification accepted, an
     * allocation failure, or a chain-building error that never reached
     * SetupStoreCtxError() all leave ctx->error at X509_V_OK. This is a
     * deliberate blanket fallback for that whole class; it is applied only
     * when nothing more specific was recorded, so an error the callback or
     * the verification did set survives untouched. */
    if (ret != WOLFSSL_SUCCESS && ctx->error == WOLFSSL_X509_V_OK) {
        ctx->error = WOLFSSL_X509_V_ERR_UNSPECIFIED;
    }

    return ret == WOLFSSL_SUCCESS ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
}

#endif /* OPENSSL_EXTRA */

#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get_current_cert(
                                            WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_current_cert");
    if (ctx)
        return ctx->current_cert;
    return NULL;
}

/* get X509_STORE_CTX ex_data, max idx is MAX_EX_DATA */
void* wolfSSL_X509_STORE_CTX_get_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_ex_data");
#ifdef HAVE_EX_DATA
    if (ctx != NULL) {
        return wolfSSL_CRYPTO_get_ex_data(&ctx->ex_data, idx);
    }
#else
    (void)ctx;
    (void)idx;
#endif
    return NULL;
}
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */


    int wolfSSL_X509_STORE_CTX_get_error(WOLFSSL_X509_STORE_CTX* ctx)
    {
        WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_error");
        if (ctx != NULL)
            return ctx->error;
        return 0;
    }

    int wolfSSL_X509_STORE_CTX_get_error_depth(WOLFSSL_X509_STORE_CTX* ctx)
    {
        WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_error_depth");
        if (ctx)
            return ctx->error_depth;
        return WOLFSSL_FATAL_ERROR;
    }

#ifdef OPENSSL_EXTRA
    void wolfSSL_X509_STORE_CTX_set_verify_cb(WOLFSSL_X509_STORE_CTX *ctx,
                                  WOLFSSL_X509_STORE_CTX_verify_cb verify_cb)
    {
        WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_verify_cb");
        if(ctx == NULL)
            return;
        ctx->verify_cb = verify_cb;
    }

/* Gets pointer to X509_STORE that was used to create context.
 *
 * Return valid pointer on success, NULL if ctx was NULL or not initialized
 */
WOLFSSL_X509_STORE* wolfSSL_X509_STORE_CTX_get0_store(
        WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get0_store");

    if (ctx == NULL)
        return NULL;

    return ctx->store;
}

WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get0_cert(WOLFSSL_X509_STORE_CTX* ctx)
{
    if (ctx == NULL)
        return NULL;

    return ctx->current_cert;
}

void wolfSSL_X509_STORE_CTX_set_time(WOLFSSL_X509_STORE_CTX* ctx,
                                    unsigned long flags,
                                    time_t t)
{
    (void)flags;

    if (ctx == NULL || ctx->param == NULL)
        return;

    ctx->param->check_time = t;
    ctx->param->flags |= WOLFSSL_USE_CHECK_TIME;
}

#if defined(WOLFSSL_QT) || defined(OPENSSL_ALL)
#ifndef NO_WOLFSSL_STUB
int wolfSSL_X509_STORE_CTX_set_purpose(WOLFSSL_X509_STORE_CTX *ctx,
                                       int purpose)
{
    (void)ctx;
    (void)purpose;
    WOLFSSL_STUB("wolfSSL_X509_STORE_CTX_set_purpose (not implemented)");
    return 0;
}
#endif /* !NO_WOLFSSL_STUB */

#endif /* WOLFSSL_QT || OPENSSL_ALL */
#endif /* OPENSSL_EXTRA */

#ifdef OPENSSL_EXTRA

void wolfSSL_X509_STORE_CTX_set_flags(WOLFSSL_X509_STORE_CTX *ctx,
        unsigned long flags)
{
    if ((ctx != NULL) && (flags & WOLFSSL_PARTIAL_CHAIN)){
        ctx->flags |= WOLFSSL_PARTIAL_CHAIN;
    }
}

/* set X509_STORE_CTX ex_data, max idx is MAX_EX_DATA. Return WOLFSSL_SUCCESS
 * on success, WOLFSSL_FAILURE on error. */
int wolfSSL_X509_STORE_CTX_set_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx,
                                       void *data)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_ex_data");
#ifdef HAVE_EX_DATA
    if (ctx != NULL)
    {
        return wolfSSL_CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
    }
#else
    (void)ctx;
    (void)idx;
    (void)data;
#endif
    return WOLFSSL_FAILURE;
}

#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
/* set X509_STORE_CTX ex_data, max idx is MAX_EX_DATA. Return WOLFSSL_SUCCESS
 * on success, WOLFSSL_FAILURE on error. */
int wolfSSL_X509_STORE_CTX_set_ex_data_with_cleanup(
    WOLFSSL_X509_STORE_CTX* ctx,
    int idx,
    void *data,
    wolfSSL_ex_data_cleanup_routine_t cleanup_routine)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_ex_data_with_cleanup");
    if (ctx != NULL)
    {
        return wolfSSL_CRYPTO_set_ex_data_with_cleanup(&ctx->ex_data, idx,
                                                        data, cleanup_routine);
    }
    return WOLFSSL_FAILURE;
}
#endif /* HAVE_EX_DATA_CLEANUP_HOOKS */

#if defined(WOLFSSL_APACHE_HTTPD) || defined(OPENSSL_EXTRA)
/* Set the maximum number of intermediate CAs allowed between the leaf and the
 * trust anchor; neither the leaf nor the anchor counts, so 0 allows none.
 * A negative depth rejects every chain. X509_STORE_CTX_init() resets
 * the depth, so call this after init. */
void wolfSSL_X509_STORE_CTX_set_depth(WOLFSSL_X509_STORE_CTX* ctx, int depth)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_depth");
    if (ctx != NULL) {
        ctx->depth = depth;
    }
}
#endif

WOLFSSL_X509* wolfSSL_X509_STORE_CTX_get0_current_issuer(
        WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_STACK* node;
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get0_current_issuer");

    if (ctx == NULL)
        return NULL;

    /* get0 only checks currently built chain */
    if (ctx->chain != NULL) {
        for (node = ctx->chain; node != NULL; node = node->next) {
            if (wolfSSL_X509_check_issued(node->data.x509,
                                          ctx->current_cert) ==
                                                WOLFSSL_X509_V_OK) {
                return node->data.x509;
            }
        }
    }

    return NULL;
}

/* Set an error stat in the X509 STORE CTX
 *
 */
void wolfSSL_X509_STORE_CTX_set_error(WOLFSSL_X509_STORE_CTX* ctx, int er)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_error");

    if (ctx != NULL) {
        ctx->error = er;
    }
}

/* Set the error depth in the X509 STORE CTX */
void wolfSSL_X509_STORE_CTX_set_error_depth(WOLFSSL_X509_STORE_CTX* ctx,
                                                                    int depth)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_set_error_depth");

    if (ctx != NULL) {
        ctx->error_depth = depth;
    }
}

WOLFSSL_STACK* wolfSSL_X509_STORE_CTX_get_chain(WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_chain");

    if (ctx == NULL) {
        return NULL;
    }

#ifdef SESSION_CERTS
    /* if chain is null but sesChain is available then populate stack */
    if (ctx->chain == NULL && ctx->sesChain != NULL) {
        int i;
        int error = 0;
        int lastIdx = -1;
        WOLFSSL_X509_CHAIN* c = ctx->sesChain;
        WOLFSSL_STACK*     sk = wolfSSL_sk_new_node(ctx->heap);

        if (sk == NULL)
            return NULL;

        for (i = 0; i < c->count; i++) {
            WOLFSSL_X509* x509;

            /* A certificate too large to keep leaves its slot empty. An
             * issuer must never slide into the leaf's slot. */
            if (c->certs[i].length == 0) {
                if (i == 0) {
                    WOLFSSL_MSG("Peer cert missing from session chain");
                    error = 1;
                    break;
                }
                continue;
            }

            x509 = wolfSSL_get_chain_X509(c, i);
            if (x509 == NULL) {
                WOLFSSL_MSG("Unable to get x509 from chain");
                error = 1;
                break;
            }

            if (wolfSSL_sk_X509_push(sk, x509) <= 0) {
                WOLFSSL_MSG("Unable to load x509 into stack");
                wolfSSL_X509_free(x509);
                x509 = NULL;
                error = 1;
                break;
            }
            lastIdx = i;
        }

#if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
    defined(OPENSSL_EXTRA)
        /* add CA used to verify top of chain to the list */
        if (!error && lastIdx >= 0) {
            WOLFSSL_X509* x509 = wolfSSL_get_chain_X509(c, lastIdx);
            WOLFSSL_X509* issuer = NULL;
            if (x509 != NULL) {
                if (wolfSSL_X509_STORE_CTX_get1_issuer(&issuer, ctx, x509)
                        == WOLFSSL_SUCCESS) {
                    /* check that the certificate being looked up is not self
                     * signed and that a issuer was found */
                    if (issuer != NULL && wolfSSL_X509_NAME_cmp(&x509->issuer,
                                &x509->subject) != 0) {
                        if (wolfSSL_sk_X509_push(sk, issuer) <= 0) {
                            WOLFSSL_MSG("Unable to load CA x509 into stack");
                            error = 1;
                            wolfSSL_X509_free(issuer);
                            issuer = NULL;
                        }
                    }
                    else {
                        WOLFSSL_MSG("Certificate is self signed");
                        wolfSSL_X509_free(issuer);
                        issuer = NULL;
                    }
                }
                else {
                    WOLFSSL_MSG("Could not find CA for certificate");
                }
            }
            wolfSSL_X509_free(x509);
            x509 = NULL;
        }
#endif
        if (error) {
            wolfSSL_sk_X509_pop_free(sk, NULL);
            return NULL;
        }
        ctx->chain = sk;
    }
#endif /* SESSION_CERTS */

    return ctx->chain;
}

/* like X509_STORE_CTX_get_chain(), but return a copy with data reference
   counts increased */
WOLFSSL_STACK* wolfSSL_X509_STORE_CTX_get1_chain(WOLFSSL_X509_STORE_CTX* ctx)
{
    WOLFSSL_STACK* ref;

    if (ctx == NULL) {
        return NULL;
    }

    /* get chain in ctx */
    ref = wolfSSL_X509_STORE_CTX_get_chain(ctx);
    if (ref == NULL) {
        return ref;
    }

    /* create duplicate of ctx chain */
    return wolfSSL_sk_dup(ref);
}

#ifndef NO_WOLFSSL_STUB
WOLFSSL_X509_STORE_CTX *wolfSSL_X509_STORE_CTX_get0_parent_ctx(
                                                   WOLFSSL_X509_STORE_CTX *ctx)
{
    (void)ctx;
    WOLFSSL_STUB("wolfSSL_X509_STORE_CTX_get0_parent_ctx");
    return NULL;
}

int wolfSSL_X509_STORE_get_by_subject(WOLFSSL_X509_STORE_CTX* ctx, int idx,
                            WOLFSSL_X509_NAME* name, WOLFSSL_X509_OBJECT* obj)
{
    (void)ctx;
    (void)idx;
    (void)name;
    (void)obj;
    WOLFSSL_STUB("X509_STORE_get_by_subject");
    return 0;
}
#endif

WOLFSSL_X509_VERIFY_PARAM *wolfSSL_X509_STORE_CTX_get0_param(
        WOLFSSL_X509_STORE_CTX *ctx)
{
    if (ctx == NULL)
        return NULL;

    return ctx->param;
}

#endif /* OPENSSL_EXTRA */

#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM)
#if defined(WOLFSSL_SIGNER_DER_CERT)
WOLF_STACK_OF(WOLFSSL_X509)* wolfSSL_X509_STORE_get1_certs(
    WOLFSSL_X509_STORE_CTX* ctx, WOLFSSL_X509_NAME* name)
{
    WOLF_STACK_OF(WOLFSSL_X509)* ret = NULL;
    int err = 0;
    WOLFSSL_X509_STORE* store = NULL;
    WOLFSSL_STACK* sk = NULL;
    WOLFSSL_STACK* certToFilter = NULL;
    WOLFSSL_X509_NAME* certToFilterName = NULL;
    WOLF_STACK_OF(WOLFSSL_X509)* filteredCerts = NULL;
    WOLFSSL_X509* filteredCert = NULL;

    WOLFSSL_ENTER("wolfSSL_X509_STORE_get1_certs");

    if (name == NULL) {
        err = 1;
    }

    if (err == 0) {
        store = wolfSSL_X509_STORE_CTX_get0_store(ctx);
        if (store == NULL) {
            err = 1;
        }
    }

    if (err == 0) {
        filteredCerts = wolfSSL_sk_X509_new_null();
        if (filteredCerts == NULL) {
            err = 1;
        }
    }

    if (err == 0) {
        sk = wolfSSL_CertManagerGetCerts(store->cm);
        if (sk == NULL) {
            err = 1;
        }
    }

    if (err == 0) {
        certToFilter = sk;
        while (certToFilter != NULL) {
            certToFilterName = wolfSSL_X509_get_subject_name(
                                    certToFilter->data.x509);
            if (certToFilterName != NULL) {
                if (wolfSSL_X509_NAME_cmp(certToFilterName, name) == 0) {
                    filteredCert = wolfSSL_X509_dup(certToFilter->data.x509);
                    if (filteredCert == NULL ||
                            wolfSSL_sk_X509_push(filteredCerts, filteredCert)
                                <= 0) {
                        err = 1;
                        wolfSSL_X509_free(filteredCert);
                        filteredCert = NULL;
                        break;
                    }
                }
            }
            certToFilter = certToFilter->next;
        }
    }

    if (err == 1) {
        if (filteredCerts != NULL) {
            wolfSSL_sk_X509_pop_free(filteredCerts, NULL);
        }
        ret = NULL;
    }
    else {
        ret = filteredCerts;
    }

    if (sk != NULL) {
        wolfSSL_sk_X509_pop_free(sk, NULL);
    }

    return ret;
}
#endif /* WOLFSSL_SIGNER_DER_CERT */

#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM */

#if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
    defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
int wolfSSL_X509_STORE_CTX_get1_issuer(WOLFSSL_X509 **issuer,
    WOLFSSL_X509_STORE_CTX *ctx, WOLFSSL_X509 *x)
{
    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
    WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get1_issuer");

    if (issuer == NULL || ctx == NULL || x == NULL)
        return WOLFSSL_FATAL_ERROR;

    ret = X509StoreGetIssuerEx(issuer, ctx->store->certs, x);
    if ((ret == WOLFSSL_SUCCESS) && (*issuer != NULL)) {
        return wolfSSL_X509_up_ref(*issuer);
    }

#ifdef WOLFSSL_SIGNER_DER_CERT
    ret = x509GetIssuerFromCM(issuer, ctx->store->cm, x);
#else
    ret = X509StoreGetIssuerEx(issuer, ctx->store->trusted, x);
    if ((ret == WOLFSSL_SUCCESS) && (*issuer != NULL)) {
        return wolfSSL_X509_up_ref(*issuer);
    }
#endif

    return ret;
}
#endif /* WOLFSSL_NGINX || WOLFSSL_HAPROXY || OPENSSL_EXTRA || OPENSSL_ALL */

#ifdef OPENSSL_EXTRA

/* Like X509StoreGetIssuerEx, but candidates present in `skip` are passed over
 * and the scan continues, so a rejected same-subject cert does not hide a
 * genuine issuer further down the stack. */
static int X509StoreGetIssuerSkip(WOLFSSL_X509 **issuer,
                            WOLFSSL_STACK * certs, WOLFSSL_X509 *x,
                            WOLF_STACK_OF(WOLFSSL_X509)* skip)
{
    int i;

    if (issuer == NULL || x == NULL)
        return WOLFSSL_FATAL_ERROR;

    if (certs != NULL) {
        for (i = 0; i < wolfSSL_sk_X509_num(certs); i++) {
            WOLFSSL_X509* cand = wolfSSL_sk_X509_value(certs, i);

            if (X509StoreCertInStack(skip, cand))
                continue;
            if (wolfSSL_X509_check_issued(cand, x) == WOLFSSL_X509_V_OK) {
                *issuer = cand;
                return WOLFSSL_SUCCESS;
            }
        }
    }

    return WOLFSSL_FAILURE;
}

static int X509StoreGetIssuerEx(WOLFSSL_X509 **issuer,
                            WOLFSSL_STACK * certs, WOLFSSL_X509 *x)
{
    return X509StoreGetIssuerSkip(issuer, certs, x, NULL);
}

#endif

/******************************************************************************
 * END OF X509_STORE_CTX APIs
 *****************************************************************************/

/******************************************************************************
 * START OF X509_STORE APIs
 *****************************************************************************/

#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || \
    defined(WOLFSSL_WPAS_SMALL)
WOLFSSL_X509_STORE* wolfSSL_X509_STORE_new(void)
{
    int ret;
    WOLFSSL_X509_STORE* store = NULL;
    WOLFSSL_ENTER("wolfSSL_X509_STORE_new");

    if ((store = (WOLFSSL_X509_STORE*)XMALLOC(sizeof(WOLFSSL_X509_STORE), NULL,
                                    DYNAMIC_TYPE_X509_STORE)) == NULL)
        goto err_exit;

    XMEMSET(store, 0, sizeof(WOLFSSL_X509_STORE));
    store->isDynamic = 1;

    wolfSSL_RefInit(&store->ref, &ret);
#ifdef WOLFSSL_REFCNT_ERROR_RETURN
    if (ret != 0)
        goto err_exit;
#else
    (void)ret;
#endif

    if ((store->cm = wolfSSL_CertManagerNew()) == NULL)
        goto err_exit;

#ifdef OPENSSL_EXTRA
    if ((store->certs = wolfSSL_sk_X509_new_null()) == NULL)
        goto err_exit;

    if ((store->owned = wolfSSL_sk_X509_new_null()) == NULL)
        goto err_exit;

    if ((store->trusted = wolfSSL_sk_X509_new_null()) == NULL)
        goto err_exit;
#endif

#ifdef HAVE_CRL
    store->crl = store->cm->crl;
#endif

#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)

    /* Link store's new Certificate Manager to self by default */
    store->cm->x509_store_p = store;

    if ((store->param = (WOLFSSL_X509_VERIFY_PARAM*)XMALLOC(
                           sizeof(WOLFSSL_X509_VERIFY_PARAM),
                           NULL, DYNAMIC_TYPE_OPENSSL)) == NULL) {
        goto err_exit;
    }
    XMEMSET(store->param, 0, sizeof(WOLFSSL_X509_VERIFY_PARAM));
    if ((store->lookup.dirs = (WOLFSSL_BY_DIR*)XMALLOC(sizeof(WOLFSSL_BY_DIR),
                           NULL, DYNAMIC_TYPE_OPENSSL)) == NULL) {
        WOLFSSL_MSG("store->lookup.dir memory allocation error");
        goto err_exit;
    }
    XMEMSET(store->lookup.dirs, 0, sizeof(WOLFSSL_BY_DIR));
    if (wc_InitMutex(&store->lookup.dirs->lock) != 0) {
            WOLFSSL_MSG("Bad mutex init");
            goto err_exit;
    }
#endif

    return store;

err_exit:
    if (store == NULL)
        return NULL;

    wolfSSL_X509_STORE_free(store);

    return NULL;
}

void wolfSSL_X509_STORE_free(WOLFSSL_X509_STORE* store)
{
    int doFree = 0;
    if (store != NULL && store->isDynamic) {
        int ret;
        wolfSSL_RefDec(&store->ref, &doFree, &ret);
    #ifdef WOLFSSL_REFCNT_ERROR_RETURN
        if (ret != 0) {
            WOLFSSL_MSG("Couldn't lock store mutex");
        }
    #else
        (void)ret;
    #endif

        if (doFree) {
#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
            wolfSSL_CRYPTO_cleanup_ex_data(&store->ex_data);
#endif
            if (store->cm != NULL) {
                /* The manager may point back at this store, and can outlive
                 * it when something else holds a reference to it. Break the
                 * link before the store goes away so nothing is left
                 * pointing at freed memory. The back-pointer is only a field
                 * of the manager in the builds that can set it. */
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
                if (store->cm->x509_store_p == store) {
                    store->cm->x509_store_p = NULL;
                }
#endif
                wolfSSL_CertManagerFree(store->cm);
                store->cm = NULL;
            }
#if defined(OPENSSL_EXTRA)
            if (store->certs != NULL) {
                wolfSSL_sk_X509_pop_free(store->certs, NULL);
                store->certs = NULL;
            }
            if (store->owned != NULL) {
                wolfSSL_sk_X509_pop_free(store->owned, NULL);
                store->owned = NULL;
            }
            if (store->trusted != NULL) {
                wolfSSL_sk_X509_pop_free(store->trusted, NULL);
                store->trusted = NULL;
            }
#endif
#ifdef OPENSSL_ALL
            if (store->objs != NULL) {
                wolfSSL_sk_X509_OBJECT_pop_free(store->objs, NULL);
            }
#endif
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
            XFREE(store->param, NULL, DYNAMIC_TYPE_OPENSSL);
            store->param = NULL;

            if (store->lookup.dirs != NULL) {
#if defined(OPENSSL_ALL) && !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
                if (store->lookup.dirs->dir_entry) {
                    wolfSSL_sk_BY_DIR_entry_free(
                        store->lookup.dirs->dir_entry);
                }
#endif
                wc_FreeMutex(&store->lookup.dirs->lock);
                XFREE(store->lookup.dirs, NULL, DYNAMIC_TYPE_OPENSSL);
                store->lookup.dirs = NULL;
            }
#endif
            wolfSSL_RefFree(&store->ref);
            XFREE(store, NULL, DYNAMIC_TYPE_X509_STORE);
        }
    }
}

/**
 * Get ex_data in WOLFSSL_STORE at given index
 * @param store a pointer to WOLFSSL_X509_STORE structure
 * @param idx   Index of ex_data to get data from
 * @return void pointer to ex_data on success or NULL on failure
 */
void* wolfSSL_X509_STORE_get_ex_data(WOLFSSL_X509_STORE* store, int idx)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_get_ex_data");
#ifdef HAVE_EX_DATA
    if (store != NULL && idx < MAX_EX_DATA && idx >= 0) {
        return wolfSSL_CRYPTO_get_ex_data(&store->ex_data, idx);
    }
#else
    (void)store;
    (void)idx;
#endif
    return NULL;
}

/* Take a reference to a certificate store.
 *
 * Only a store allocated by wolfSSL_X509_STORE_new() is reference counted. A
 * store that is part of another object - the one a context returns from
 * wolfSSL_CTX_get_cert_store() when none has been set on it, for example -
 * has no count to take, and its lifetime is that of the object holding it.
 * Success is still reported for such a store, so unlike OpenSSL's
 * X509_STORE_up_ref() a successful return does not by itself mean the caller
 * now owns something that keeps the store alive. A caller that intends to
 * outlive the object the store belongs to cannot rely on this call and must
 * use a store of its own.
 *
 * @param [in, out] store  Certificate store.
 * @return  1 on success, including for a store that has no reference count.
 * @return  0 when store is NULL, or when the count could not be taken.
 */
int wolfSSL_X509_STORE_up_ref(WOLFSSL_X509_STORE* store)
{
    if (store == NULL) {
        return WOLFSSL_FAILURE;
    }

    /* A store that is part of another object, such as the one in a context,
     * is not reference counted - its reference count was never initialized
     * and its lifetime is that of the object holding it. Nothing to do, as
     * in wolfSSL_X509_STORE_free(). */
    if (store->isDynamic) {
        int ret;
        wolfSSL_RefInc(&store->ref, &ret);
    #ifdef WOLFSSL_REFCNT_ERROR_RETURN
        if (ret != 0) {
            WOLFSSL_MSG("Failed to lock store mutex");
            return WOLFSSL_FAILURE;
        }
    #else
        (void)ret;
    #endif
    }

    return WOLFSSL_SUCCESS;
}

/**
 * Set ex_data for WOLFSSL_STORE
 * @param store a pointer to WOLFSSL_X509_STORE structure
 * @param idx   Index of ex data to set
 * @param data  Data to set in ex data
 * @return WOLFSSL_SUCCESS on success or WOLFSSL_FAILURE on failure
 */
int wolfSSL_X509_STORE_set_ex_data(WOLFSSL_X509_STORE* store, int idx,
                                                                void *data)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_ex_data");
#ifdef HAVE_EX_DATA
    if (store != NULL && idx < MAX_EX_DATA) {
        return wolfSSL_CRYPTO_set_ex_data(&store->ex_data, idx, data);
    }
#else
    (void)store;
    (void)idx;
    (void)data;
#endif
    return WOLFSSL_FAILURE;
}

#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
/**
 * Set ex_data for WOLFSSL_STORE
 * @param store a pointer to WOLFSSL_X509_STORE structure
 * @param idx   Index of ex data to set
 * @param data  Data to set in ex data
 * @return WOLFSSL_SUCCESS on success or WOLFSSL_FAILURE on failure
 */
int wolfSSL_X509_STORE_set_ex_data_with_cleanup(
    WOLFSSL_X509_STORE* store,
    int idx,
    void *data,
    wolfSSL_ex_data_cleanup_routine_t cleanup_routine)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_ex_data_with_cleanup");
    if (store != NULL && idx < MAX_EX_DATA) {
        return wolfSSL_CRYPTO_set_ex_data_with_cleanup(&store->ex_data, idx,
                                                       data, cleanup_routine);
    }
    return WOLFSSL_FAILURE;
}

#endif /* HAVE_EX_DATA_CLEANUP_HOOKS */

#endif /* OPENSSL_EXTRA || HAVE_WEBSERVER || WOLFSSL_WPAS_SMALL */

#ifdef OPENSSL_EXTRA

#if defined(WOLFSSL_QT) || defined(OPENSSL_ALL)
void wolfSSL_X509_STORE_set_verify_cb(WOLFSSL_X509_STORE *st,
        WOLFSSL_X509_STORE_CTX_verify_cb verify_cb)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_verify_cb");
    if (st != NULL) {
        st->verify_cb = verify_cb;
    }
}

void wolfSSL_X509_STORE_set_get_crl(WOLFSSL_X509_STORE *st,
        WOLFSSL_X509_STORE_CTX_get_crl_cb get_cb)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_get_crl");
    if (st != NULL) {
        st->get_crl_cb = get_cb;
    }
}

#ifndef NO_WOLFSSL_STUB
void wolfSSL_X509_STORE_set_check_crl(WOLFSSL_X509_STORE *st,
        WOLFSSL_X509_STORE_CTX_check_crl_cb check_crl)
{
    (void)st;
    (void)check_crl;
    WOLFSSL_STUB("wolfSSL_X509_STORE_set_check_crl (not implemented)");
}
#endif
#endif /* WOLFSSL_QT || OPENSSL_ALL */

WOLFSSL_X509_LOOKUP* wolfSSL_X509_STORE_add_lookup(WOLFSSL_X509_STORE* store,
                                               WOLFSSL_X509_LOOKUP_METHOD* m)
{
    WOLFSSL_ENTER("wolfSSL_X509_STORE_add_lookup");
    if (store == NULL || m == NULL)
        return NULL;

    /* Make sure the lookup has a back reference to the store. */
    store->lookup.store = store;
    /* store a type to know which method wants to be used for */
    store->lookup.type = m->type;
    return &store->lookup;
}

static int X509StoreAddCa(WOLFSSL_X509_STORE* store,
                                          WOLFSSL_X509* x509, int type)
{
    int result = WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR);
    DerBuffer* derCert = NULL;
    int verify = VERIFY;

    WOLFSSL_ENTER("X509StoreAddCa");
    if (store != NULL && x509 != NULL && x509->derCert != NULL) {
        /* Check if NO_CHECK_TIME flag is set - if so, skip date validation */
        if (store->param != NULL &&
            (store->param->flags & WOLFSSL_NO_CHECK_TIME) != 0) {
            verify = VERIFY_SKIP_DATE;
        }
        result = AllocDer(&derCert, x509->derCert->length,
            x509->derCert->type, NULL);
        if (result == 0) {
            /* AddCA() frees the buffer. */
            XMEMCPY(derCert->buffer,
                            x509->derCert->buffer, x509->derCert->length);
            result = AddCA(store->cm, &derCert, type, verify);
        }
    }

    return result;
}

/* Push certificates from the store's X509 stacks (certs and trusted) into the
 * CertManager, then free and NULL the stacks to signal that this store is now
 * owned by an SSL_CTX.
 *
 * This is needed when an X509_STORE is attached to an SSL_CTX via
 * SSL_CTX_set_cert_store: self-signed CAs are already in the CM (added by
 * X509StoreAddCa during X509_STORE_add_cert), but non-self-signed intermediates
 * are only in store->certs and must be explicitly added to the CM so that all
 * verification paths (including CertManagerVerify) can find them. */
WOLFSSL_LOCAL int X509StorePushCertsToCM(WOLFSSL_X509_STORE* store)
{
    int i;
    int num;
    int ret;
    int anyFail = 0;
    WOLFSSL_X509* x509;

    WOLFSSL_ENTER("X509StorePushCertsToCM");

    if (store == NULL || store->cm == NULL)
        return WOLFSSL_SUCCESS;

    /* Push non-self-signed intermediates from store->certs into the CM. */
    if (store->certs != NULL) {
        num = wolfSSL_sk_X509_num(store->certs);
        for (i = 0; i < num; i++) {
            x509 = wolfSSL_sk_X509_value(store->certs, i);
            if (x509 != NULL) {
                ret = X509StoreAddCa(store, x509, WOLFSSL_USER_CA);
                if (ret != WOLFSSL_SUCCESS) {
                    WOLFSSL_MSG("X509StorePushCertsToCM: failed to add cert");
                    anyFail = 1;
                }
            }
        }
        /* Free and NULL to mark store as CTX-owned. Future add_cert calls
         * will go directly to the CertManager. */
        wolfSSL_sk_X509_pop_free(store->certs, NULL);
        store->certs = NULL;
    }

    /* Push trusted certs too. Self-signed CAs are typically already in the CM
     * (added during X509_STORE_add_cert), but AddCA handles duplicates. */
    if (store->trusted != NULL) {
        num = wolfSSL_sk_X509_num(store->trusted);
        for (i = 0; i < num; i++) {
            x509 = wolfSSL_sk_X509_value(store->trusted, i);
            if (x509 != NULL) {
                ret = X509StoreAddCa(store, x509, WOLFSSL_USER_CA);
                if (ret != WOLFSSL_SUCCESS) {
                    WOLFSSL_MSG("X509StorePushCertsToCM: failed to add "
                                "trusted cert");
                    anyFail = 1;
                }
            }
        }
        wolfSSL_sk_X509_pop_free(store->trusted, NULL);
        store->trusted = NULL;
    }

    if (anyFail) {
        return WOLFSSL_FATAL_ERROR;
    }
    return WOLFSSL_SUCCESS;
}

int wolfSSL_X509_STORE_add_cert(WOLFSSL_X509_STORE* store, WOLFSSL_X509* x509)
{
    int result = WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR);

    WOLFSSL_ENTER("wolfSSL_X509_STORE_add_cert");
    if (store != NULL && store->cm != NULL && x509 != NULL
                                                && x509->derCert != NULL) {
        /* Mimic the openssl behavior, must be self signed to be considered
         * trusted, addCA() internals will do additional checks for
         * CA=TRUE */
        if (wolfSSL_X509_NAME_cmp(&x509->issuer, &x509->subject) == 0) {
            result = X509StoreAddCa(store, x509, WOLFSSL_USER_CA);
            if (result == WOLFSSL_SUCCESS && store->trusted != NULL) {
                result = wolfSSL_X509_up_ref(x509);
                if (result == WOLFSSL_SUCCESS) {
                    result = wolfSSL_sk_X509_push(store->trusted, x509);
                    if (result > 0) {
                        result = WOLFSSL_SUCCESS;
                    }
                    else {
                        result = WOLFSSL_FATAL_ERROR;
                        wolfSSL_X509_free(x509);
                        x509 = NULL;
                    }
                }
            }
        }
        else {
            if (store->certs != NULL) {
                result = wolfSSL_X509_up_ref(x509);
                if (result == WOLFSSL_SUCCESS) {
                    result = wolfSSL_sk_X509_push(store->certs, x509);
                    if (result > 0) {
                        result = WOLFSSL_SUCCESS;
                    }
                    else {
                        result = WOLFSSL_FATAL_ERROR;
                        wolfSSL_X509_free(x509);
                        x509 = NULL;
                    }
                }
            }
            else {
                /* If store->certs is NULL, this is an X509_STORE managed by an
                 * SSL_CTX, preserve behavior and always add as USER_CA */
                result = X509StoreAddCa(
                            store, x509, WOLFSSL_USER_CA);
            }
        }
    }

    WOLFSSL_LEAVE("wolfSSL_X509_STORE_add_cert", result);

    if (result != WOLFSSL_SUCCESS) {
        result = WOLFSSL_FATAL_ERROR;
    }

    return result;
}

int wolfSSL_X509_STORE_set_flags(WOLFSSL_X509_STORE* store, unsigned long flag)
{
    int ret = WOLFSSL_SUCCESS;
    int crlOpts = 0;

    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_flags");

    if (store == NULL)
        return WOLFSSL_FAILURE;

    /* X509_V_FLAG_CRL_CHECK(_ALL), and the native WOLFSSL_CRL_CHECK(ALL)
     * options for compatibility. */
    if (flag & (WOLFSSL_X509_V_FLAG_CRL_CHECK | WOLFSSL_CRL_CHECK)) {
        crlOpts |= WOLFSSL_CRL_CHECK;
    }
    if (flag & (WOLFSSL_X509_V_FLAG_CRL_CHECK_ALL | WOLFSSL_CRL_CHECKALL)) {
        crlOpts |= WOLFSSL_CRL_CHECKALL;
    }

    if (crlOpts != 0) {
        ret = wolfSSL_CertManagerEnableCRL(store->cm, crlOpts);
    }
#if defined(OPENSSL_COMPATIBLE_DEFAULTS)
    else if (flag == 0) {
        ret = wolfSSL_CertManagerDisableCRL(store->cm);
    }
#endif
    if (flag & WOLFSSL_PARTIAL_CHAIN) {
        store->param->flags |= WOLFSSL_PARTIAL_CHAIN;
    }
    return ret;
}

int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str,
                                        byte *buf, word32 bufLen, int type)
{
    int ret = WOLFSSL_SUCCESS;
    WOLFSSL_X509 *x509 = NULL;

    if (str == NULL || buf == NULL) {
        return WOLFSSL_FAILURE;
    }

    /* OpenSSL X509_STORE_load_file fails on DER file, we will as well */
    x509 = wolfSSL_X509_load_certificate_buffer(buf, bufLen, type);
    if (x509 != NULL) {
        ret = wolfSSL_X509_STORE_add_cert(str, x509);
        if (ret != WOLFSSL_SUCCESS) {
            WOLFSSL_MSG("Failed to load file");
            ret = WOLFSSL_FAILURE;
        }
        if (ret == WOLFSSL_SUCCESS && str->owned != NULL) {
            if (wolfSSL_sk_X509_push(str->owned, x509) <= 0) {
                ret = WOLFSSL_FAILURE;
            }
            else {
                x509 = NULL;
            }
        }
        wolfSSL_X509_free(x509);
        x509 = NULL;
    }
    else {
        ret = WOLFSSL_FAILURE;
    }

    return ret;
}

#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)

static int X509StoreReadFile(const char *fname,
                StaticBuffer *content, word32 *bytesRead, int *type)
{
    int ret = -1;
    long sz = 0;
#ifdef HAVE_CRL
    const char* header = NULL;
    const char* footer = NULL;
#endif

    ret = wolfssl_read_file_static(fname, content, NULL, DYNAMIC_TYPE_FILE,
        &sz);
    if (ret == 0) {
        *type = CERT_TYPE;
        *bytesRead = (word32)sz;
#ifdef HAVE_CRL
        /* Look for CRL header and footer. */
        if (wc_PemGetHeaderFooter(CRL_TYPE, &header, &footer) == 0 &&
                (XSTRNSTR((char*)content->buffer, header, sz) !=
                    NULL)) {
            *type = CRL_TYPE;
        }
#endif
    }

    return (ret == 0 ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE);
}

static int X509StoreLoadFile(WOLFSSL_X509_STORE *str,
                                        const char *fname)
{
    int ret = WOLFSSL_SUCCESS;
    int type = 0;
#ifndef WOLFSSL_SMALL_STACK
    byte   stackBuffer[FILE_BUFFER_SIZE];
#endif
    StaticBuffer content;
    word32 contentLen = 0;

#ifdef WOLFSSL_SMALL_STACK
    static_buffer_init(&content);
#else
    static_buffer_init(&content, stackBuffer, FILE_BUFFER_SIZE);
#endif

    WOLFSSL_MSG_EX("X509StoreLoadFile: Loading file: %s", fname);

    ret = X509StoreReadFile(fname, &content, &contentLen, &type);
    if (ret != WOLFSSL_SUCCESS) {
        WOLFSSL_MSG("Failed to load file");
        ret = WOLFSSL_FAILURE;
    }

    if ((ret == WOLFSSL_SUCCESS) && (type == CERT_TYPE)) {
        ret = X509StoreLoadCertBuffer(str, content.buffer,
                                        contentLen, WOLFSSL_FILETYPE_PEM);
    }
#ifdef HAVE_CRL
    else if ((ret == WOLFSSL_SUCCESS) && (type == CRL_TYPE)) {
        ret = BufferLoadCRL(str->cm->crl, content.buffer, contentLen,
                                        WOLFSSL_FILETYPE_PEM, 0);
    }
#endif

    static_buffer_free(&content, NULL, DYNAMIC_TYPE_FILE);
    return ret;
}

/* Loads certificate(s) files in pem format into X509_STORE struct from either
 * a file or directory.
 * Returns WOLFSSL_SUCCESS on success or WOLFSSL_FAILURE if an error occurs.
 */
int wolfSSL_X509_STORE_load_locations(WOLFSSL_X509_STORE *str,
                                            const char *file, const char *dir)
{
    WOLFSSL_CTX* ctx;
    char *name = NULL;
    int ret = WOLFSSL_SUCCESS;
    WC_DECLARE_VAR(readCtx, ReadDirCtx, 1, 0);

    WOLFSSL_ENTER("wolfSSL_X509_STORE_load_locations");

    if (str == NULL || str->cm == NULL || (file == NULL  && dir == NULL))
        return WOLFSSL_FAILURE;

    /* tmp ctx for setting our cert manager */
    ctx = wolfSSL_CTX_new_ex(cm_pick_method(str->cm->heap), str->cm->heap);
    if (ctx == NULL)
        return WOLFSSL_FAILURE;

    wolfSSL_CertManagerFree(ctx->cm);
    ctx->cm = str->cm;

#ifdef HAVE_CRL
    if (str->cm->crl == NULL) {
        /* Workaround to allocate the internals to load CRL's but don't enable
         * CRL checking by default */
        if (wolfSSL_CertManagerEnableCRL(str->cm, WOLFSSL_CRL_CHECK)
                != WOLFSSL_SUCCESS ||
                wolfSSL_CertManagerDisableCRL(str->cm) != WOLFSSL_SUCCESS) {
            WOLFSSL_MSG("Enable CRL failed");
            wolfSSL_CTX_free(ctx);
            return WOLFSSL_FAILURE;
        }
    }
#endif

    /* Load individual file */
    if (file) {
        ret = X509StoreLoadFile(str, file);
        if (ret != WOLFSSL_SUCCESS) {
            WOLFSSL_MSG("Failed to load file");
            ret = WOLFSSL_FAILURE;
        }
    }

    /* Load files in dir */
    if (dir && ret == WOLFSSL_SUCCESS) {
        int successes = 0;

        #ifdef WOLFSSL_SMALL_STACK
            readCtx = (ReadDirCtx*)XMALLOC(sizeof(ReadDirCtx), ctx->heap,
                                                    DYNAMIC_TYPE_TMP_BUFFER);
            if (readCtx == NULL) {
                WOLFSSL_MSG("Memory error");
                wolfSSL_CTX_free(ctx);
                return WOLFSSL_FAILURE;
            }
        #endif

        /* try to load each regular file in dir */
        ret = wc_ReadDirFirst(readCtx, dir, &name);
        while (ret == 0 && name) {
            WOLFSSL_MSG(name);

            ret = X509StoreLoadFile(str, name);
            /* Not failing on load errors */
            if (ret != WOLFSSL_SUCCESS)
                WOLFSSL_MSG("Failed to load file in path, continuing");
            else
                successes++;

            ret = wc_ReadDirNext(readCtx, dir, &name);
        }
        wc_ReadDirClose(readCtx);

        /* Success if at least one file in dir was loaded */
        if (successes > 0)
            ret = WOLFSSL_SUCCESS;
        else {
            WOLFSSL_ERROR(ret);
            ret = WOLFSSL_FAILURE;
        }

            WC_FREE_VAR_EX(readCtx, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
    }

    ctx->cm = NULL;
    wolfSSL_CTX_free(ctx);

    return ret;
}

#if defined(XGETENV) && !defined(NO_GETENV)
int wolfSSL_X509_STORE_set_default_paths(WOLFSSL_X509_STORE *str)
{
    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
    char* certDir = NULL;
    char* certFile = NULL;

    WOLFSSL_ENTER("wolfSSL_X509_STORE_set_default_paths");

    certFile = wc_strdup_ex(XGETENV("SSL_CERT_FILE"), DYNAMIC_TYPE_TMP_BUFFER);
    certDir = wc_strdup_ex(XGETENV("SSL_CERT_DIR"), DYNAMIC_TYPE_TMP_BUFFER);

    ret = wolfSSL_X509_STORE_load_locations(str, certFile, certDir);

    XFREE(certFile, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    XFREE(certDir, NULL, DYNAMIC_TYPE_TMP_BUFFER);
    return ret;
}
#endif /* XGETENV && !NO_GETENV */

#endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */

int wolfSSL_X509_CA_num(WOLFSSL_X509_STORE* store)
{
    int cnt_ret = 0;
    Signer **table;

    WOLFSSL_ENTER("wolfSSL_X509_CA_num");
    if (store == NULL || store->cm == NULL){
        WOLFSSL_MSG("invalid parameter");
        return WOLFSSL_FAILURE;
    }

    table = store->cm->caTable;
    if (table || (store->certs != NULL)){
        if (wc_LockMutex(&store->cm->caLock) == 0){
            if (table) {
                int i = 0;
                for (i = 0; i < CA_TABLE_SIZE; i++) {
                    Signer* signer = table[i];
                    while (signer) {
                        Signer* next = signer->next;
                        cnt_ret++;
                        signer = next;
                    }
                }
            }

            if (store->certs != NULL) {
                cnt_ret += wolfSSL_sk_X509_num(store->certs);
            }
            wc_UnLockMutex(&store->cm->caLock);
        }
    }

    return cnt_ret;
}

/******************************************************************************
* wolfSSL_X509_STORE_GetCerts - retrieve stack of X509 in a certificate
*                               store ctx
*
* This API can be used in SSL verify callback function to view cert chain
* See examples/client/client.c and myVerify() function in test.h
*
* RETURNS:
* returns stack of X509 certs on success, otherwise returns a NULL.
*/
WOLFSSL_STACK* wolfSSL_X509_STORE_GetCerts(WOLFSSL_X509_STORE_CTX* s)
{
    int  certIdx = 0;
    WOLFSSL_BUFFER_INFO* cert = NULL;
    DecodedCert* dCert = NULL;
    WOLFSSL_X509* x509 = NULL;
    WOLFSSL_STACK* sk = NULL;
    int found = 0;

    if (s == NULL) {
        return NULL;
    }

    sk = wolfSSL_sk_X509_new_null();

    if (sk == NULL) {
        return NULL;
    }

    for (certIdx = s->totalCerts - 1; certIdx >= 0; certIdx--) {
        /* get certificate buffer */
        cert = &s->certs[certIdx];

        dCert = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
                                                DYNAMIC_TYPE_DCERT);

        if (dCert == NULL) {
            goto error;
        }
        XMEMSET(dCert, 0, sizeof(DecodedCert));

        InitDecodedCert(dCert, cert->buffer, cert->length, NULL);

        /* Parse Certificate */
        if (ParseCert(dCert, CERT_TYPE, NO_VERIFY, NULL)){
            goto error;
        }
        x509 = wolfSSL_X509_new();

        if (x509 == NULL) {
            goto error;
        }
        InitX509(x509, 1, NULL);

        if (CopyDecodedToX509(x509, dCert) == 0) {

            if (wolfSSL_sk_X509_push(sk, x509) <= 0) {
                WOLFSSL_MSG("Unable to load x509 into stack");
                wolfSSL_X509_free(x509);
                x509 = NULL;
                goto error;
            }
        }
        else {
            wolfSSL_X509_free(x509);
            x509 = NULL;
            goto error;
        }
        found = 1;

        FreeDecodedCert(dCert);
        XFREE(dCert, NULL, DYNAMIC_TYPE_DCERT);
        dCert = NULL;
    }

    if (!found) {
        wolfSSL_sk_X509_pop_free(sk, NULL);
        sk = NULL;
    }
    return sk;

error:
    if (dCert) {
        FreeDecodedCert(dCert);
        XFREE(dCert, NULL, DYNAMIC_TYPE_DCERT);
    }

    if (sk)
        wolfSSL_sk_X509_pop_free(sk, NULL);

    return NULL;
}
#endif /* OPENSSL_EXTRA */

#ifdef OPENSSL_ALL
WOLF_STACK_OF(WOLFSSL_X509_OBJECT)* wolfSSL_X509_STORE_get0_objects(
    WOLFSSL_X509_STORE* store)
{
    WOLFSSL_STACK* ret = NULL;
    WOLFSSL_STACK* cert_stack = NULL;
#if ((defined(WOLFSSL_SIGNER_DER_CERT) && !defined(NO_FILESYSTEM)) || \
     (defined(HAVE_CRL)))
    WOLFSSL_X509_OBJECT* obj = NULL;
#endif
#if defined(WOLFSSL_SIGNER_DER_CERT) && !defined(NO_FILESYSTEM)
    WOLFSSL_X509* x509 = NULL;
    int i = 0;
#endif
    WOLFSSL_ENTER("wolfSSL_X509_STORE_get0_objects");

    if (store == NULL || store->cm == NULL) {
        WOLFSSL_MSG("Missing or empty store");
        return NULL;
    }

    if (store->objs != NULL) {
#if defined(WOLFSSL_SIGNER_DER_CERT) && !defined(NO_FILESYSTEM)
        /* want to update objs stack by cm stack again before returning it*/
        wolfSSL_sk_X509_OBJECT_pop_free(store->objs, NULL);
        store->objs = NULL;
#else
        if (wolfSSL_sk_X509_OBJECT_num(store->objs) == 0) {
            /* Let's try generating the stack again */
            wolfSSL_sk_X509_OBJECT_pop_free(store->objs, NULL);
            store->objs = NULL;
        }
        else
            return store->objs;
#endif
    }

    if ((ret = wolfSSL_sk_X509_OBJECT_new()) == NULL) {
        WOLFSSL_MSG("wolfSSL_sk_X509_OBJECT_new error");
        goto err_cleanup;
    }

#if defined(WOLFSSL_SIGNER_DER_CERT) && !defined(NO_FILESYSTEM)
    cert_stack = wolfSSL_CertManagerGetCerts(store->cm);
    if (cert_stack == NULL && wolfSSL_sk_X509_num(store->certs) > 0) {
        cert_stack = wolfSSL_sk_X509_new_null();
        if (cert_stack == NULL) {
            WOLFSSL_MSG("wolfSSL_sk_X509_OBJECT_new error");
            goto err_cleanup;
        }
    }
    /* Reference borrowed certs so cert_stack owns every entry. */
    for (i = 0; i < wolfSSL_sk_X509_num(store->certs); i++) {
        x509 = wolfSSL_sk_X509_value(store->certs, i);
        if (wolfSSL_X509_up_ref(x509) != WOLFSSL_SUCCESS) {
            WOLFSSL_MSG("wolfSSL_X509_up_ref error");
            goto err_cleanup;
        }
        if (wolfSSL_sk_X509_push(cert_stack, x509) <= 0) {
            WOLFSSL_MSG("wolfSSL_sk_X509_push error");
            wolfSSL_X509_free(x509);
            goto err_cleanup;
        }
    }
    for (i = 0; i < wolfSSL_sk_X509_num(cert_stack); i++) {
        x509 = (WOLFSSL_X509 *)wolfSSL_sk_value(cert_stack, i);
        obj  = wolfSSL_X509_OBJECT_new();
        if (obj == NULL) {
            WOLFSSL_MSG("wolfSSL_X509_OBJECT_new error");
            goto err_cleanup;
        }
        /* Push first so cleanup frees the object if the up_ref fails. */
        if (wolfSSL_sk_X509_OBJECT_push(ret, obj) <= 0) {
            WOLFSSL_MSG("wolfSSL_sk_X509_OBJECT_push error");
            wolfSSL_X509_OBJECT_free(obj);
            goto err_cleanup;
        }
        /* Object owns a reference, so the list frees independently. */
        if (wolfSSL_X509_up_ref(x509) != WOLFSSL_SUCCESS) {
            WOLFSSL_MSG("wolfSSL_X509_up_ref error");
            goto err_cleanup;
        }
        obj->type = WOLFSSL_X509_LU_X509;
        obj->data.x509 = x509;
    }
#endif

#ifdef HAVE_CRL
    if (store->cm->crl != NULL) {
        int res;
        obj = wolfSSL_X509_OBJECT_new();
        if (obj == NULL) {
            WOLFSSL_MSG("wolfSSL_X509_OBJECT_new error");
            goto err_cleanup;
        }
        if (wolfSSL_sk_X509_OBJECT_push(ret, obj) <= 0) {
            WOLFSSL_MSG("wolfSSL_sk_X509_OBJECT_push error");
            wolfSSL_X509_OBJECT_free(obj);
            goto err_cleanup;
        }
        /* Reference first, so the object only claims what it can free. */
        wolfSSL_RefInc(&store->cm->crl->ref, &res);
        if (res != 0) {
            WOLFSSL_MSG("Failed to lock crl mutex");
            goto err_cleanup;
        }
        obj->type = WOLFSSL_X509_LU_CRL;
        obj->data.crl = store->cm->crl;
    }
#endif

    if (cert_stack != NULL)
        wolfSSL_sk_X509_pop_free(cert_stack, NULL);
    store->objs = ret;
    return ret;
err_cleanup:
    /* Objects own their contents, so one pop_free releases everything. */
    if (ret != NULL)
        wolfSSL_sk_X509_OBJECT_pop_free(ret, NULL);
    if (cert_stack != NULL)
        wolfSSL_sk_X509_pop_free(cert_stack, NULL);
    return NULL;
}
#endif /* OPENSSL_ALL */

#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || \
    defined(WOLFSSL_WPAS_SMALL)
WOLFSSL_X509_VERIFY_PARAM *wolfSSL_X509_STORE_get0_param(
        const WOLFSSL_X509_STORE *ctx)
{
    if (ctx == NULL)
        return NULL;
    return ctx->param;
}

#ifdef OPENSSL_EXTRA
int wolfSSL_X509_STORE_set1_param(WOLFSSL_X509_STORE *ctx,
        WOLFSSL_X509_VERIFY_PARAM *param)
{
    if (ctx == NULL)
        return WOLFSSL_FAILURE;
    return wolfSSL_X509_VERIFY_PARAM_set1(ctx->param, param);
}
#endif
#endif

/******************************************************************************
 * END OF X509_STORE APIs
 *****************************************************************************/

#endif /* NO_CERTS */

#endif /* !WOLFCRYPT_ONLY */

#endif /* !WOLFSSL_X509_STORE_INCLUDED */

Coverage Report

Created: 2026-11-12 06:59