x509_vpm.c 16.9 KB
Newer Older
1
/* x509_vpm.c */
2
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
 * project 2004.
 */
/* ====================================================================
 * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <stdio.h>

#include "cryptlib.h"
#include <openssl/crypto.h>
#include <openssl/lhash.h>
#include <openssl/buffer.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>

68
#include "x509_lcl.h"
D
Dr. Stephen Henson 已提交
69

70 71
/* X509_VERIFY_PARAM functions */

72 73 74 75 76 77 78 79 80
#define SET_HOST 0
#define ADD_HOST 1

static char *str_copy(const char *s) { return OPENSSL_strdup(s); }
static void str_free(char *s) { OPENSSL_free(s); }

#define string_stack_free(sk) sk_OPENSSL_STRING_pop_free(sk, str_free)

static int int_x509_param_set_hosts(X509_VERIFY_PARAM_ID *id, int mode,
81
				    const char *name, size_t namelen)
82 83 84 85 86 87 88 89
	{
	char *copy;

	/*
	 * Refuse names with embedded NUL bytes, except perhaps as final byte.
	 * XXX: Do we need to push an error onto the error stack?
	 */
	if (namelen == 0)
90
		namelen = name ? strlen(name) : 0;
91 92 93 94 95 96 97 98 99 100 101 102 103
	else if (name && memchr(name, '\0', namelen > 1 ? namelen-1 : namelen))
		 return 0;
	if (name && name[namelen-1] == '\0')
		--namelen;

	if (mode == SET_HOST && id->hosts)
		{
		string_stack_free(id->hosts);
		id->hosts = NULL;
		}
	if (name == NULL || namelen == 0)
		return 1;

104
	copy = BUF_strndup(name, namelen);
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128
	if (copy == NULL)
		return 0;

	if (id->hosts == NULL &&
	    (id->hosts = sk_OPENSSL_STRING_new_null()) == NULL)
		{
		OPENSSL_free(copy);
		return 0;
		}

	if (!sk_OPENSSL_STRING_push(id->hosts, copy))
		{
		OPENSSL_free(copy);
		if (sk_OPENSSL_STRING_num(id->hosts) == 0)
			{
			sk_OPENSSL_STRING_free(id->hosts);
			id->hosts = NULL;
			}
		return 0;
		}

	return 1;
	}

129 130
static void x509_verify_param_zero(X509_VERIFY_PARAM *param)
	{
D
Dr. Stephen Henson 已提交
131
	X509_VERIFY_PARAM_ID *paramid;
132 133 134 135 136
	if (!param)
		return;
	param->name = NULL;
	param->purpose = 0;
	param->trust = 0;
D
Dr. Stephen Henson 已提交
137 138
	/*param->inh_flags = X509_VP_FLAG_DEFAULT;*/
	param->inh_flags = 0;
139 140 141 142 143 144 145
	param->flags = 0;
	param->depth = -1;
	if (param->policies)
		{
		sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
		param->policies = NULL;
		}
D
Dr. Stephen Henson 已提交
146
	paramid = param->id;
147
	if (paramid->hosts)
148
		{
149 150
		string_stack_free(paramid->hosts);
		paramid->hosts = NULL;
151
		}
152 153
	if (paramid->peername)
		OPENSSL_free(paramid->peername);
D
Dr. Stephen Henson 已提交
154
	if (paramid->email)
155
		{
D
Dr. Stephen Henson 已提交
156 157 158
		OPENSSL_free(paramid->email);
		paramid->email = NULL;
		paramid->emaillen = 0;
159
		}
D
Dr. Stephen Henson 已提交
160
	if (paramid->ip)
161
		{
D
Dr. Stephen Henson 已提交
162 163 164
		OPENSSL_free(paramid->ip);
		paramid->ip = NULL;
		paramid->iplen = 0;
165
		}
D
Dr. Stephen Henson 已提交
166

167 168 169 170 171
	}

X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void)
	{
	X509_VERIFY_PARAM *param;
D
Dr. Stephen Henson 已提交
172
	X509_VERIFY_PARAM_ID *paramid;
173
	param = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
D
Dr. Stephen Henson 已提交
174 175 176 177 178 179 180 181
	if (!param)
		return NULL;
	paramid = OPENSSL_malloc(sizeof(X509_VERIFY_PARAM));
	if (!paramid)
		{
		OPENSSL_free(param);
		return NULL;
		}
182
	memset(param, 0, sizeof(X509_VERIFY_PARAM));
D
Dr. Stephen Henson 已提交
183 184
	memset(paramid, 0, sizeof(X509_VERIFY_PARAM_ID));
	param->id = paramid;
185 186 187 188 189 190 191
	x509_verify_param_zero(param);
	return param;
	}

void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param)
	{
	x509_verify_param_zero(param);
D
Dr. Stephen Henson 已提交
192
	OPENSSL_free(param->id);
193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232
	OPENSSL_free(param);
	}

/* This function determines how parameters are "inherited" from one structure
 * to another. There are several different ways this can happen.
 *
 * 1. If a child structure needs to have its values initialized from a parent
 *    they are simply copied across. For example SSL_CTX copied to SSL.
 * 2. If the structure should take on values only if they are currently unset.
 *    For example the values in an SSL structure will take appropriate value
 *    for SSL servers or clients but only if the application has not set new
 *    ones.
 *
 * The "inh_flags" field determines how this function behaves. 
 *
 * Normally any values which are set in the default are not copied from the
 * destination and verify flags are ORed together.
 *
 * If X509_VP_FLAG_DEFAULT is set then anything set in the source is copied
 * to the destination. Effectively the values in "to" become default values
 * which will be used only if nothing new is set in "from".
 *
 * If X509_VP_FLAG_OVERWRITE is set then all value are copied across whether
 * they are set or not. Flags is still Ored though.
 *
 * If X509_VP_FLAG_RESET_FLAGS is set then the flags value is copied instead
 * of ORed.
 *
 * If X509_VP_FLAG_LOCKED is set then no values are copied.
 *
 * If X509_VP_FLAG_ONCE is set then the current inh_flags setting is zeroed
 * after the next call.
 */

/* Macro to test if a field should be copied from src to dest */

#define test_x509_verify_param_copy(field, def) \
	(to_overwrite || \
		((src->field != def) && (to_default || (dest->field == def))))

D
Dr. Stephen Henson 已提交
233 234 235 236 237
/* As above but for ID fields */

#define test_x509_verify_param_copy_id(idf, def) \
	test_x509_verify_param_copy(id->idf, def)

238 239 240 241 242
/* Macro to test and copy a field if necessary */

#define x509_verify_param_copy(field, def) \
	if (test_x509_verify_param_copy(field, def)) \
		dest->field = src->field
D
Dr. Stephen Henson 已提交
243

244 245 246 247 248 249

int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
						const X509_VERIFY_PARAM *src)
	{
	unsigned long inh_flags;
	int to_default, to_overwrite;
D
Dr. Stephen Henson 已提交
250
	X509_VERIFY_PARAM_ID *id;
251 252
	if (!src)
		return 1;
D
Dr. Stephen Henson 已提交
253
	id = src->id;
254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275
	inh_flags = dest->inh_flags | src->inh_flags;

	if (inh_flags & X509_VP_FLAG_ONCE)
		dest->inh_flags = 0;

	if (inh_flags & X509_VP_FLAG_LOCKED)
		return 1;

	if (inh_flags & X509_VP_FLAG_DEFAULT)
		to_default = 1;
	else
		to_default = 0;

	if (inh_flags & X509_VP_FLAG_OVERWRITE)
		to_overwrite = 1;
	else
		to_overwrite = 0;

	x509_verify_param_copy(purpose, 0);
	x509_verify_param_copy(trust, 0);
	x509_verify_param_copy(depth, -1);

D
Dr. Stephen Henson 已提交
276 277 278 279 280 281 282 283 284
	/* If overwrite or check time not set, copy across */

	if (to_overwrite || !(dest->flags & X509_V_FLAG_USE_CHECK_TIME))
		{
		dest->check_time = src->check_time;
		dest->flags &= ~X509_V_FLAG_USE_CHECK_TIME;
		/* Don't need to copy flag: that is done below */
		}

285 286 287 288 289 290 291 292 293 294 295
	if (inh_flags & X509_VP_FLAG_RESET_FLAGS)
		dest->flags = 0;

	dest->flags |= src->flags;

	if (test_x509_verify_param_copy(policies, NULL))
		{
		if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies))
			return 0;
		}

296 297
	/* Copy the host flags if and only if we're copying the host list */
	if (test_x509_verify_param_copy_id(hosts, NULL))
298
		{
299 300 301 302 303 304 305 306 307 308 309 310 311 312
		if (dest->id->hosts)
			{
			string_stack_free(dest->id->hosts);
			dest->id->hosts = NULL;
			}
		if (id->hosts)
			{
			dest->id->hosts =
			    sk_OPENSSL_STRING_deep_copy(id->hosts,
							str_copy, str_free);
			if (dest->id->hosts == NULL)
				return 0;
			dest->id->hostflags = id->hostflags;
			}
313 314
		}

D
Dr. Stephen Henson 已提交
315
	if (test_x509_verify_param_copy_id(email, NULL))
316
		{
D
Dr. Stephen Henson 已提交
317
		if (!X509_VERIFY_PARAM_set1_email(dest, id->email, id->emaillen))
318 319 320
			return 0;
		}

D
Dr. Stephen Henson 已提交
321
	if (test_x509_verify_param_copy_id(ip, NULL))
322
		{
D
Dr. Stephen Henson 已提交
323
		if (!X509_VERIFY_PARAM_set1_ip(dest, id->ip, id->iplen))
324 325 326
			return 0;
		}

327 328 329 330 331 332
	return 1;
	}

int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
						const X509_VERIFY_PARAM *from)
	{
D
Dr. Stephen Henson 已提交
333 334
	unsigned long save_flags = to->inh_flags;
	int ret;
335
	to->inh_flags |= X509_VP_FLAG_DEFAULT;
D
Dr. Stephen Henson 已提交
336 337 338
	ret = X509_VERIFY_PARAM_inherit(to, from);
	to->inh_flags = save_flags;
	return ret;
339 340
	}

341 342
static int int_x509_param_set1(char **pdest, size_t *pdestlen,
				const char *src, size_t srclen)
343 344 345 346 347 348
	{
	void *tmp;
	if (src)
		{
		if (srclen == 0)
			{
349 350
			tmp = BUF_strdup(src);
			srclen = strlen(src);
351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369
			}
		else
			tmp = BUF_memdup(src, srclen);
		if (!tmp)
			return 0;
		}
	else
		{
		tmp = NULL;
		srclen = 0;
		}
	if (*pdest)
		OPENSSL_free(*pdest);
	*pdest = tmp;
	if (pdestlen)
		*pdestlen = srclen;
	return 1;
	}

370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387
int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)
	{
	if (param->name)
		OPENSSL_free(param->name);
	param->name = BUF_strdup(name);
	if (param->name)
		return 1;
	return 0;
	}

int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
	{
	param->flags |= flags;
	if (flags & X509_V_FLAG_POLICY_MASK)
		param->flags |= X509_V_FLAG_POLICY_CHECK;
	return 1;
	}

388 389 390 391 392 393 394 395 396 397 398
int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, unsigned long flags)
	{
	param->flags &= ~flags;
	return 1;
	}

unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param)
	{
	return param->flags;
	}

399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468
int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
	{
	return X509_PURPOSE_set(&param->purpose, purpose);
	}

int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
	{
	return X509_TRUST_set(&param->trust, trust);
	}

void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth)
	{
	param->depth = depth;
	}

void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t)
	{
	param->check_time = t;
	param->flags |= X509_V_FLAG_USE_CHECK_TIME;
	}

int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, ASN1_OBJECT *policy)
	{
	if (!param->policies)
		{
		param->policies = sk_ASN1_OBJECT_new_null();
		if (!param->policies)
			return 0;
		}
	if (!sk_ASN1_OBJECT_push(param->policies, policy))
		return 0;
	return 1;
	}

int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 
					STACK_OF(ASN1_OBJECT) *policies)
	{
	int i;
	ASN1_OBJECT *oid, *doid;
	if (!param)
		return 0;
	if (param->policies)
		sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);

	if (!policies)
		{
		param->policies = NULL;
		return 1;
		}

	param->policies = sk_ASN1_OBJECT_new_null();
	if (!param->policies)
		return 0;

	for (i = 0; i < sk_ASN1_OBJECT_num(policies); i++)
		{
		oid = sk_ASN1_OBJECT_value(policies, i);
		doid = OBJ_dup(oid);
		if (!doid)
			return 0;
		if (!sk_ASN1_OBJECT_push(param->policies, doid))
			{
			ASN1_OBJECT_free(doid);
			return 0;
			}
		}
	param->flags |= X509_V_FLAG_POLICY_CHECK;
	return 1;
	}

469
int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param,
470
				const char *name, size_t namelen)
471
	{
472 473 474 475
	return int_x509_param_set_hosts(param->id, SET_HOST, name, namelen);
	}

int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param,
476
				const char *name, size_t namelen)
477 478
	{
	return int_x509_param_set_hosts(param->id, ADD_HOST, name, namelen);
479 480
	}

V
Viktor Dukhovni 已提交
481 482 483 484 485 486
void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
					unsigned int flags)
	{
	param->id->hostflags = flags;
	}

487 488 489 490 491
char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param)
	{
	return param->id->peername;
	}

492
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
493
				const char *email, size_t emaillen)
494
	{
D
Dr. Stephen Henson 已提交
495
	return int_x509_param_set1(&param->id->email, &param->id->emaillen,
496 497 498 499 500 501 502 503
					email, emaillen);
	}

int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
					const unsigned char *ip, size_t iplen)
	{
	if (iplen != 0 && iplen != 4 && iplen != 16)
		return 0;
504 505
	return int_x509_param_set1((char **)&param->id->ip, &param->id->iplen,
				   (char *)ip, iplen);
506 507 508 509 510
	}

int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)
	{
	unsigned char ipout[16];
511 512 513
	size_t iplen;

	iplen = (size_t) a2i_ipadd(ipout, ipasc);
514 515
	if (iplen == 0)
		return 0;
516
	return X509_VERIFY_PARAM_set1_ip(param, ipout, iplen);
517 518
	}

519 520 521 522 523
int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param)
	{
	return param->depth;
	}

524 525 526 527 528
const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param)
	{
	return param->name;
	}

529
static X509_VERIFY_PARAM_ID _empty_id = {NULL, 0U, NULL, NULL, 0, NULL, 0};
D
Dr. Stephen Henson 已提交
530 531 532 533

#define vpm_empty_id (X509_VERIFY_PARAM_ID *)&_empty_id


534 535 536 537 538 539 540 541 542 543 544 545 546 547
/* Default verify parameters: these are used for various
 * applications and can be overridden by the user specified table.
 * NB: the 'name' field *must* be in alphabetical order because it
 * will be searched using OBJ_search.
 */

static const X509_VERIFY_PARAM default_table[] = {
	{
	"default",	/* X509 default parameters */
	0,		/* Check time */
	0,		/* internal flags */
	0,		/* flags */
	0,		/* purpose */
	0,		/* trust */
D
Dr. Stephen Henson 已提交
548
	100,		/* depth */
D
Dr. Stephen Henson 已提交
549 550
	NULL,		/* policies */
	vpm_empty_id
551 552
	},
	{
D
Dr. Stephen Henson 已提交
553 554 555 556 557 558 559
	"pkcs7",			/* S/MIME sign parameters */
	0,				/* Check time */
	0,				/* internal flags */
	0,				/* flags */
	X509_PURPOSE_SMIME_SIGN,	/* purpose */
	X509_TRUST_EMAIL,		/* trust */
	-1,				/* depth */
D
Dr. Stephen Henson 已提交
560 561
	NULL,				/* policies */
	vpm_empty_id
D
Dr. Stephen Henson 已提交
562 563 564
	},
	{
	"smime_sign",			/* S/MIME sign parameters */
565 566 567 568 569 570
	0,				/* Check time */
	0,				/* internal flags */
	0,				/* flags */
	X509_PURPOSE_SMIME_SIGN,	/* purpose */
	X509_TRUST_EMAIL,		/* trust */
	-1,				/* depth */
D
Dr. Stephen Henson 已提交
571 572
	NULL,				/* policies */
	vpm_empty_id
573 574 575 576 577 578 579 580 581
	},
	{
	"ssl_client",			/* SSL/TLS client parameters */
	0,				/* Check time */
	0,				/* internal flags */
	0,				/* flags */
	X509_PURPOSE_SSL_CLIENT,	/* purpose */
	X509_TRUST_SSL_CLIENT,		/* trust */
	-1,				/* depth */
D
Dr. Stephen Henson 已提交
582 583
	NULL,				/* policies */
	vpm_empty_id
584 585 586 587 588 589 590 591 592
	},
	{
	"ssl_server",			/* SSL/TLS server parameters */
	0,				/* Check time */
	0,				/* internal flags */
	0,				/* flags */
	X509_PURPOSE_SSL_SERVER,	/* purpose */
	X509_TRUST_SSL_SERVER,		/* trust */
	-1,				/* depth */
D
Dr. Stephen Henson 已提交
593 594
	NULL,				/* policies */
	vpm_empty_id
595 596 597 598
	}};

static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;

599 600
static int table_cmp(const X509_VERIFY_PARAM *a, const X509_VERIFY_PARAM *b)

601 602 603 604
	{
	return strcmp(a->name, b->name);
	}

D
Dr. Stephen Henson 已提交
605
DECLARE_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM,
606
			   table);
D
Dr. Stephen Henson 已提交
607
IMPLEMENT_OBJ_BSEARCH_CMP_FN(X509_VERIFY_PARAM, X509_VERIFY_PARAM,
608
			     table);
609

610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632
static int param_cmp(const X509_VERIFY_PARAM * const *a,
			const X509_VERIFY_PARAM * const *b)
	{
	return strcmp((*a)->name, (*b)->name);
	}

int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param)
	{
	int idx;
	X509_VERIFY_PARAM *ptmp;
	if (!param_table)
		{
		param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
		if (!param_table)
			return 0;
		}
	else
		{
		idx = sk_X509_VERIFY_PARAM_find(param_table, param);
		if (idx != -1)
			{
			ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
			X509_VERIFY_PARAM_free(ptmp);
633
			(void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
634 635 636 637 638 639 640
			}
		}
	if (!sk_X509_VERIFY_PARAM_push(param_table, param))
		return 0;
	return 1;
	}

641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656
int X509_VERIFY_PARAM_get_count(void)
	{
	int num = sizeof(default_table)/sizeof(X509_VERIFY_PARAM);
	if (param_table)
		num += sk_X509_VERIFY_PARAM_num(param_table);
	return num;
	}

const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id)
	{
	int num = sizeof(default_table)/sizeof(X509_VERIFY_PARAM);
	if (id < num)
		return default_table + id;
	return sk_X509_VERIFY_PARAM_value(param_table, id - num);
	}

657 658 659 660
const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name)
	{
	int idx;
	X509_VERIFY_PARAM pm;
661

662 663 664 665 666 667 668
	pm.name = (char *)name;
	if (param_table)
		{
		idx = sk_X509_VERIFY_PARAM_find(param_table, &pm);
		if (idx != -1)
			return sk_X509_VERIFY_PARAM_value(param_table, idx);
		}
669 670
	return OBJ_bsearch_table(&pm, default_table,
			   sizeof(default_table)/sizeof(X509_VERIFY_PARAM));
671 672 673 674 675 676 677 678 679
	}

void X509_VERIFY_PARAM_table_cleanup(void)
	{
	if (param_table)
		sk_X509_VERIFY_PARAM_pop_free(param_table,
						X509_VERIFY_PARAM_free);
	param_table = NULL;
	}