[thirdparty/openssl.git] / crypto / x509 / by_dir.c

/*
 * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include "e_os.h"
#include "internal/cryptlib.h"
#include <stdio.h>
#include <time.h>
#include <errno.h>
#include <sys/types.h>

#ifndef OPENSSL_NO_POSIX_IO
# include <sys/stat.h>
#endif

#include <openssl/x509.h>
#include "crypto/x509.h"
#include "x509_local.h"

DEFINE_STACK_OF(X509_OBJECT)

struct lookup_dir_hashes_st {
    unsigned long hash;
    int suffix;
};

struct lookup_dir_entry_st {
    char *dir;
    int dir_type;
    STACK_OF(BY_DIR_HASH) *hashes;
};

typedef struct lookup_dir_st {
    BUF_MEM *buffer;
    STACK_OF(BY_DIR_ENTRY) *dirs;
    CRYPTO_RWLOCK *lock;
} BY_DIR;

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp);

static int new_dir(X509_LOOKUP *lu);
static void free_dir(X509_LOOKUP *lu);
static int add_cert_dir(BY_DIR *ctx, const char *dir, int type);
static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret);
static int get_cert_by_subject_with_libctx(X509_LOOKUP *xl,
                                           X509_LOOKUP_TYPE type,
                                           const X509_NAME *name,
                                           X509_OBJECT *ret,
                                           OPENSSL_CTX *libctx,
                                           const char *propq);
static X509_LOOKUP_METHOD x509_dir_lookup = {
    "Load certs from files in a directory",
    new_dir,                         /* new_item */
    free_dir,                        /* free */
    NULL,                            /* init */
    NULL,                            /* shutdown */
    dir_ctrl,                        /* ctrl */
    get_cert_by_subject,             /* get_by_subject */
    NULL,                            /* get_by_issuer_serial */
    NULL,                            /* get_by_fingerprint */
    NULL,                            /* get_by_alias */
    get_cert_by_subject_with_libctx, /* get_by_subject_with_libctx */
    NULL,                            /* ctrl_with_libctx */
};

X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
{
    return &x509_dir_lookup;
}

static int dir_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
                    char **retp)
{
    int ret = 0;
    BY_DIR *ld = (BY_DIR *)ctx->method_data;

    switch (cmd) {
    case X509_L_ADD_DIR:
        if (argl == X509_FILETYPE_DEFAULT) {
            const char *dir = ossl_safe_getenv(X509_get_default_cert_dir_env());

            if (dir)
                ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
            else
                ret = add_cert_dir(ld, X509_get_default_cert_dir(),
                                   X509_FILETYPE_PEM);
            if (!ret) {
                X509err(X509_F_DIR_CTRL, X509_R_LOADING_CERT_DIR);
            }
        } else
            ret = add_cert_dir(ld, argp, (int)argl);
        break;
    }
    return ret;
}

static int new_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = OPENSSL_malloc(sizeof(*a));

    if (a == NULL) {
        X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
        return 0;
    }

    if ((a->buffer = BUF_MEM_new()) == NULL) {
        X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    a->dirs = NULL;
    a->lock = CRYPTO_THREAD_lock_new();
    if (a->lock == NULL) {
        BUF_MEM_free(a->buffer);
        X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    lu->method_data = a;
    return 1;

 err:
    OPENSSL_free(a);
    return 0;
}

static void by_dir_hash_free(BY_DIR_HASH *hash)
{
    OPENSSL_free(hash);
}

static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
                           const BY_DIR_HASH *const *b)
{
    if ((*a)->hash > (*b)->hash)
        return 1;
    if ((*a)->hash < (*b)->hash)
        return -1;
    return 0;
}

static void by_dir_entry_free(BY_DIR_ENTRY *ent)
{
    OPENSSL_free(ent->dir);
    sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
    OPENSSL_free(ent);
}

static void free_dir(X509_LOOKUP *lu)
{
    BY_DIR *a = (BY_DIR *)lu->method_data;

    sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
    BUF_MEM_free(a->buffer);
    CRYPTO_THREAD_lock_free(a->lock);
    OPENSSL_free(a);
}

static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
{
    int j;
    size_t len;
    const char *s, *ss, *p;

    if (dir == NULL || *dir == '\0') {
        X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY);
        return 0;
    }

    s = dir;
    p = s;
    do {
        if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0')) {
            BY_DIR_ENTRY *ent;

            ss = s;
            s = p + 1;
            len = p - ss;
            if (len == 0)
                continue;
            for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
                ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
                if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
                    break;
            }
            if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
                continue;
            if (ctx->dirs == NULL) {
                ctx->dirs = sk_BY_DIR_ENTRY_new_null();
                if (!ctx->dirs) {
                    X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
                    return 0;
                }
            }
            ent = OPENSSL_malloc(sizeof(*ent));
            if (ent == NULL) {
                X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
                return 0;
            }
            ent->dir_type = type;
            ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
            ent->dir = OPENSSL_strndup(ss, len);
            if (ent->dir == NULL || ent->hashes == NULL) {
                by_dir_entry_free(ent);
                return 0;
            }
            if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
                by_dir_entry_free(ent);
                X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
                return 0;
            }
        }
    } while (*p++ != '\0');
    return 1;
}

static int get_cert_by_subject_with_libctx(X509_LOOKUP *xl,
                                           X509_LOOKUP_TYPE type,
                                           const X509_NAME *name,
                                           X509_OBJECT *ret,
                                           OPENSSL_CTX *libctx,
                                           const char *propq)
{
    BY_DIR *ctx;
    union {
        X509 st_x509;
        X509_CRL crl;
    } data;
    int ok = 0;
    int i, j, k;
    unsigned long h;
    BUF_MEM *b = NULL;
    X509_OBJECT stmp, *tmp;
    const char *postfix = "";

    if (name == NULL)
        return 0;

    stmp.type = type;
    if (type == X509_LU_X509) {
        data.st_x509.cert_info.subject = (X509_NAME *)name; /* won't modify it */
        stmp.data.x509 = &data.st_x509;
        postfix = "";
    } else if (type == X509_LU_CRL) {
        data.crl.crl.issuer = (X509_NAME *)name; /* won't modify it */
        stmp.data.crl = &data.crl;
        postfix = "r";
    } else {
        X509err(0, X509_R_WRONG_LOOKUP_TYPE);
        goto finish;
    }

    if ((b = BUF_MEM_new()) == NULL) {
        X509err(0, ERR_R_BUF_LIB);
        goto finish;
    }

    ctx = (BY_DIR *)xl->method_data;

    h = X509_NAME_hash(name);
    for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
        BY_DIR_ENTRY *ent;
        int idx;
        BY_DIR_HASH htmp, *hent;

        ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
        j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
        if (!BUF_MEM_grow(b, j)) {
            X509err(0, ERR_R_MALLOC_FAILURE);
            goto finish;
        }
        if (type == X509_LU_CRL && ent->hashes) {
            htmp.hash = h;
            CRYPTO_THREAD_read_lock(ctx->lock);
            idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
            if (idx >= 0) {
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
                k = hent->suffix;
            } else {
                hent = NULL;
                k = 0;
            }
            CRYPTO_THREAD_unlock(ctx->lock);
        } else {
            k = 0;
            hent = NULL;
        }
        for (;;) {
            char c = '/';
#ifdef OPENSSL_SYS_VMS
            c = ent->dir[strlen(ent->dir) - 1];
            if (c != ':' && c != '>' && c != ']') {
                /*
                 * If no separator is present, we assume the directory
                 * specifier is a logical name, and add a colon.  We really
                 * should use better VMS routines for merging things like
                 * this, but this will do for now... -- Richard Levitte
                 */
                c = ':';
            } else {
                c = '\0';
            }
#endif
            if (c == '\0') {
                /*
                 * This is special.  When c == '\0', no directory separator
                 * should be added.
                 */
                BIO_snprintf(b->data, b->max,
                             "%s%08lx.%s%d", ent->dir, h, postfix, k);
            } else {
                BIO_snprintf(b->data, b->max,
                             "%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
            }
#ifndef OPENSSL_NO_POSIX_IO
# ifdef _WIN32
#  define stat _stat
# endif
            {
                struct stat st;
                if (stat(b->data, &st) < 0)
                    break;
            }
#endif
            /* found one. */
            if (type == X509_LU_X509) {
                if ((X509_load_cert_file_with_libctx(xl, b->data, ent->dir_type,
                                                     libctx, propq)) == 0)
                    break;
            } else if (type == X509_LU_CRL) {
                if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
                    break;
            }
            /* else case will caught higher up */
            k++;
        }

        /*
         * we have added it to the cache so now pull it out again
         */
        X509_STORE_lock(xl->store_ctx);
        j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
        tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
        X509_STORE_unlock(xl->store_ctx);

        /* If a CRL, update the last file suffix added for this */

        if (type == X509_LU_CRL) {
            CRYPTO_THREAD_write_lock(ctx->lock);
            /*
             * Look for entry again in case another thread added an entry
             * first.
             */
            if (hent == NULL) {
                htmp.hash = h;
                idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
                hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
            }
            if (hent == NULL) {
                hent = OPENSSL_malloc(sizeof(*hent));
                if (hent == NULL) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    X509err(0, ERR_R_MALLOC_FAILURE);
                    ok = 0;
                    goto finish;
                }
                hent->hash = h;
                hent->suffix = k;
                if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
                    CRYPTO_THREAD_unlock(ctx->lock);
                    OPENSSL_free(hent);
                    X509err(0, ERR_R_MALLOC_FAILURE);
                    ok = 0;
                    goto finish;
                }
            } else if (hent->suffix < k) {
                hent->suffix = k;
            }

            CRYPTO_THREAD_unlock(ctx->lock);

        }

        if (tmp != NULL) {
            ok = 1;
            ret->type = tmp->type;
            memcpy(&ret->data, &tmp->data, sizeof(ret->data));

            /*
             * Clear any errors that might have been raised processing empty
             * or malformed files.
             */
            ERR_clear_error();

            goto finish;
        }
    }
 finish:
    BUF_MEM_free(b);
    return ok;
}

static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
                               const X509_NAME *name, X509_OBJECT *ret)
{
    return get_cert_by_subject_with_libctx(xl, type, name, ret, NULL, NULL);
}
Commit	Line	Data
b1322259	1	/*
33388b44	2	* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
d02b48c6	3	*
3e4b43b9	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
b1322259 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
d02b48c6 RE	8	*/
d02b48c6 RE	9
07016a8a P	10	#include "e_os.h"
07016a8a P	11	#include "internal/cryptlib.h"
d02b48c6 RE	12	#include <stdio.h>
	13	#include <time.h>
	14	#include <errno.h>
b379fe6c	15	#include <sys/types.h>
d02b48c6	16
49e3c9d8	17	#ifndef OPENSSL_NO_POSIX_IO
17f389bb AP	18	# include <sys/stat.h>
	19	#endif
	20
ec577822	21	#include <openssl/x509.h>
25f2138b	22	#include "crypto/x509.h"
706457b7	23	#include "x509_local.h"
d02b48c6	24
852c2ed2 RS	25	DEFINE_STACK_OF(X509_OBJECT)
852c2ed2 RS	26
4a1f3f27	27	struct lookup_dir_hashes_st {
0f113f3e MC	28	unsigned long hash;
0f113f3e MC	29	int suffix;
4a1f3f27	30	};
5d20c4fb	31
4a1f3f27	32	struct lookup_dir_entry_st {
0f113f3e MC	33	char *dir;
	34	int dir_type;
	35	STACK_OF(BY_DIR_HASH) *hashes;
4a1f3f27	36	};
5d20c4fb	37
0f113f3e MC	38	typedef struct lookup_dir_st {
	39	BUF_MEM *buffer;
	40	STACK_OF(BY_DIR_ENTRY) *dirs;
4fc4faa7	41	CRYPTO_RWLOCK *lock;
0f113f3e	42	} BY_DIR;
d02b48c6	43
303c0028	44	static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
6725682d SL	45	char **retp);
6725682d SL	46
d02b48c6 RE	47	static int new_dir(X509_LOOKUP *lu);
d02b48c6 RE	48	static void free_dir(X509_LOOKUP *lu);
0f113f3e	49	static int add_cert_dir(BY_DIR ctx, const char dir, int type);
0946a198	50	static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
8cc86b81	51	const X509_NAME name, X509_OBJECT ret);
6725682d SL	52	static int get_cert_by_subject_with_libctx(X509_LOOKUP *xl,
	53	X509_LOOKUP_TYPE type,
	54	const X509_NAME *name,
	55	X509_OBJECT *ret,
	56	OPENSSL_CTX *libctx,
	57	const char *propq);
df2ee0e2	58	static X509_LOOKUP_METHOD x509_dir_lookup = {
0f113f3e	59	"Load certs from files in a directory",
6725682d SL	60	new_dir, /* new_item */
	61	free_dir, /* free */
	62	NULL, /* init */
	63	NULL, /* shutdown */
	64	dir_ctrl, /* ctrl */
	65	get_cert_by_subject, /* get_by_subject */
	66	NULL, /* get_by_issuer_serial */
	67	NULL, /* get_by_fingerprint */
	68	NULL, /* get_by_alias */
	69	get_cert_by_subject_with_libctx, /* get_by_subject_with_libctx */
	70	NULL, /* ctrl_with_libctx */
0f113f3e	71	};
d02b48c6	72
6b691a5c	73	X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void)
0f113f3e	74	{
26a7d938	75	return &x509_dir_lookup;
0f113f3e	76	}
d02b48c6	77
303c0028	78	static int dir_ctrl(X509_LOOKUP ctx, int cmd, const char argp, long argl,
0f113f3e MC	79	char **retp)
	80	{
	81	int ret = 0;
7fcdbd83	82	BY_DIR ld = (BY_DIR )ctx->method_data;
0f113f3e MC	83
	84	switch (cmd) {
	85	case X509_L_ADD_DIR:
	86	if (argl == X509_FILETYPE_DEFAULT) {
5c39a55d	87	const char *dir = ossl_safe_getenv(X509_get_default_cert_dir_env());
7fcdbd83	88
0f113f3e MC	89	if (dir)
	90	ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
	91	else
	92	ret = add_cert_dir(ld, X509_get_default_cert_dir(),
	93	X509_FILETYPE_PEM);
	94	if (!ret) {
	95	X509err(X509_F_DIR_CTRL, X509_R_LOADING_CERT_DIR);
	96	}
	97	} else
	98	ret = add_cert_dir(ld, argp, (int)argl);
	99	break;
	100	}
26a7d938	101	return ret;
0f113f3e	102	}
d02b48c6	103
6b691a5c	104	static int new_dir(X509_LOOKUP *lu)
0f113f3e	105	{
7fcdbd83	106	BY_DIR a = OPENSSL_malloc(sizeof(a));
0f113f3e	107
7fcdbd83 F	108	if (a == NULL) {
7fcdbd83 F	109	X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
4fc4faa7	110	return 0;
7fcdbd83 F	111	}
7fcdbd83 F	112
0f113f3e	113	if ((a->buffer = BUF_MEM_new()) == NULL) {
7fcdbd83 F	114	X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
7fcdbd83 F	115	goto err;
0f113f3e MC	116	}
0f113f3e MC	117	a->dirs = NULL;
4fc4faa7 MC	118	a->lock = CRYPTO_THREAD_lock_new();
	119	if (a->lock == NULL) {
	120	BUF_MEM_free(a->buffer);
7fcdbd83 F	121	X509err(X509_F_NEW_DIR, ERR_R_MALLOC_FAILURE);
7fcdbd83 F	122	goto err;
4fc4faa7	123	}
0124f32a	124	lu->method_data = a;
4fc4faa7	125	return 1;
7fcdbd83 F	126
	127	err:
	128	OPENSSL_free(a);
	129	return 0;
0f113f3e	130	}
d02b48c6	131
5d20c4fb	132	static void by_dir_hash_free(BY_DIR_HASH *hash)
0f113f3e MC	133	{
	134	OPENSSL_free(hash);
	135	}
	136
	137	static int by_dir_hash_cmp(const BY_DIR_HASH const a,
	138	const BY_DIR_HASH const b)
	139	{
	140	if ((a)->hash > (b)->hash)
	141	return 1;
	142	if ((a)->hash < (b)->hash)
	143	return -1;
	144	return 0;
	145	}
5d20c4fb DSH	146
5d20c4fb DSH	147	static void by_dir_entry_free(BY_DIR_ENTRY *ent)
0f113f3e	148	{
b548a1f1	149	OPENSSL_free(ent->dir);
25aaa98a	150	sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
0f113f3e MC	151	OPENSSL_free(ent);
0f113f3e MC	152	}
5d20c4fb	153
6b691a5c	154	static void free_dir(X509_LOOKUP *lu)
0f113f3e	155	{
7fcdbd83	156	BY_DIR a = (BY_DIR )lu->method_data;
d02b48c6	157
25aaa98a RS	158	sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
25aaa98a RS	159	BUF_MEM_free(a->buffer);
4fc4faa7	160	CRYPTO_THREAD_lock_free(a->lock);
0f113f3e MC	161	OPENSSL_free(a);
0f113f3e MC	162	}
d02b48c6	163
6b691a5c	164	static int add_cert_dir(BY_DIR ctx, const char dir, int type)
0f113f3e	165	{
53a73768 P	166	int j;
53a73768 P	167	size_t len;
582e2ed2	168	const char s, ss, *p;
0f113f3e	169
12a765a5	170	if (dir == NULL \|\| *dir == '\0') {
0f113f3e MC	171	X509err(X509_F_ADD_CERT_DIR, X509_R_INVALID_DIRECTORY);
	172	return 0;
	173	}
	174
	175	s = dir;
	176	p = s;
	177	do {
	178	if ((p == LIST_SEPARATOR_CHAR) \|\| (p == '\0')) {
	179	BY_DIR_ENTRY *ent;
7fcdbd83	180
582e2ed2	181	ss = s;
0f113f3e	182	s = p + 1;
53a73768	183	len = p - ss;
0f113f3e MC	184	if (len == 0)
	185	continue;
	186	for (j = 0; j < sk_BY_DIR_ENTRY_num(ctx->dirs); j++) {
	187	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, j);
6ffaf15d	188	if (strlen(ent->dir) == len && strncmp(ent->dir, ss, len) == 0)
0f113f3e MC	189	break;
	190	}
	191	if (j < sk_BY_DIR_ENTRY_num(ctx->dirs))
	192	continue;
	193	if (ctx->dirs == NULL) {
	194	ctx->dirs = sk_BY_DIR_ENTRY_new_null();
	195	if (!ctx->dirs) {
	196	X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
	197	return 0;
	198	}
	199	}
b4faea50	200	ent = OPENSSL_malloc(sizeof(*ent));
7fcdbd83 F	201	if (ent == NULL) {
7fcdbd83 F	202	X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
0f113f3e	203	return 0;
7fcdbd83	204	}
0f113f3e MC	205	ent->dir_type = type;
0f113f3e MC	206	ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
6ffaf15d	207	ent->dir = OPENSSL_strndup(ss, len);
90945fa3	208	if (ent->dir == NULL \|\| ent->hashes == NULL) {
0f113f3e MC	209	by_dir_entry_free(ent);
	210	return 0;
	211	}
0f113f3e MC	212	if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
0f113f3e MC	213	by_dir_entry_free(ent);
7fcdbd83	214	X509err(X509_F_ADD_CERT_DIR, ERR_R_MALLOC_FAILURE);
0f113f3e MC	215	return 0;
	216	}
	217	}
	218	} while (*p++ != '\0');
	219	return 1;
	220	}
d02b48c6	221
6725682d SL	222	static int get_cert_by_subject_with_libctx(X509_LOOKUP *xl,
	223	X509_LOOKUP_TYPE type,
	224	const X509_NAME *name,
	225	X509_OBJECT *ret,
	226	OPENSSL_CTX *libctx,
	227	const char *propq)
0f113f3e MC	228	{
	229	BY_DIR *ctx;
	230	union {
5cf6abd8	231	X509 st_x509;
7aef39a7	232	X509_CRL crl;
0f113f3e MC	233	} data;
	234	int ok = 0;
	235	int i, j, k;
	236	unsigned long h;
	237	BUF_MEM *b = NULL;
	238	X509_OBJECT stmp, *tmp;
	239	const char *postfix = "";
	240
	241	if (name == NULL)
26a7d938	242	return 0;
0f113f3e MC	243
	244	stmp.type = type;
	245	if (type == X509_LU_X509) {
8cc86b81	246	data.st_x509.cert_info.subject = (X509_NAME )name; / won't modify it */
5cf6abd8	247	stmp.data.x509 = &data.st_x509;
0f113f3e MC	248	postfix = "";
0f113f3e MC	249	} else if (type == X509_LU_CRL) {
8cc86b81	250	data.crl.crl.issuer = (X509_NAME )name; / won't modify it */
7aef39a7	251	stmp.data.crl = &data.crl;
0f113f3e MC	252	postfix = "r";
0f113f3e MC	253	} else {
6725682d	254	X509err(0, X509_R_WRONG_LOOKUP_TYPE);
0f113f3e MC	255	goto finish;
	256	}
	257
	258	if ((b = BUF_MEM_new()) == NULL) {
6725682d	259	X509err(0, ERR_R_BUF_LIB);
0f113f3e MC	260	goto finish;
	261	}
	262
	263	ctx = (BY_DIR *)xl->method_data;
	264
	265	h = X509_NAME_hash(name);
	266	for (i = 0; i < sk_BY_DIR_ENTRY_num(ctx->dirs); i++) {
	267	BY_DIR_ENTRY *ent;
	268	int idx;
	269	BY_DIR_HASH htmp, *hent;
7fcdbd83	270
0f113f3e MC	271	ent = sk_BY_DIR_ENTRY_value(ctx->dirs, i);
	272	j = strlen(ent->dir) + 1 + 8 + 6 + 1 + 1;
	273	if (!BUF_MEM_grow(b, j)) {
6725682d	274	X509err(0, ERR_R_MALLOC_FAILURE);
0f113f3e MC	275	goto finish;
	276	}
	277	if (type == X509_LU_CRL && ent->hashes) {
	278	htmp.hash = h;
4fc4faa7	279	CRYPTO_THREAD_read_lock(ctx->lock);
0f113f3e MC	280	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
	281	if (idx >= 0) {
	282	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
	283	k = hent->suffix;
	284	} else {
	285	hent = NULL;
	286	k = 0;
	287	}
4fc4faa7	288	CRYPTO_THREAD_unlock(ctx->lock);
0f113f3e MC	289	} else {
	290	k = 0;
	291	hent = NULL;
	292	}
	293	for (;;) {
	294	char c = '/';
af6dab9b	295	#ifdef OPENSSL_SYS_VMS
0f113f3e MC	296	c = ent->dir[strlen(ent->dir) - 1];
	297	if (c != ':' && c != '>' && c != ']') {
	298	/*
	299	* If no separator is present, we assume the directory
	300	* specifier is a logical name, and add a colon. We really
	301	* should use better VMS routines for merging things like
	302	* this, but this will do for now... -- Richard Levitte
	303	*/
	304	c = ':';
	305	} else {
	306	c = '\0';
	307	}
af6dab9b	308	#endif
0f113f3e MC	309	if (c == '\0') {
	310	/*
	311	* This is special. When c == '\0', no directory separator
	312	* should be added.
	313	*/
	314	BIO_snprintf(b->data, b->max,
	315	"%s%08lx.%s%d", ent->dir, h, postfix, k);
	316	} else {
a2371fa9 P	317	BIO_snprintf(b->data, b->max,
a2371fa9 P	318	"%s%c%08lx.%s%d", ent->dir, c, h, postfix, k);
0f113f3e	319	}
49e3c9d8	320	#ifndef OPENSSL_NO_POSIX_IO
0f113f3e MC	321	# ifdef _WIN32
	322	# define stat _stat
	323	# endif
	324	{
	325	struct stat st;
	326	if (stat(b->data, &st) < 0)
	327	break;
	328	}
49e3c9d8	329	#endif
0f113f3e MC	330	/* found one. */
0f113f3e MC	331	if (type == X509_LU_X509) {
6725682d SL	332	if ((X509_load_cert_file_with_libctx(xl, b->data, ent->dir_type,
6725682d SL	333	libctx, propq)) == 0)
0f113f3e MC	334	break;
	335	} else if (type == X509_LU_CRL) {
	336	if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0)
	337	break;
	338	}
	339	/* else case will caught higher up */
	340	k++;
	341	}
	342
	343	/*
	344	* we have added it to the cache so now pull it out again
	345	*/
a161738a	346	X509_STORE_lock(xl->store_ctx);
0f113f3e	347	j = sk_X509_OBJECT_find(xl->store_ctx->objs, &stmp);
5b37fef0	348	tmp = sk_X509_OBJECT_value(xl->store_ctx->objs, j);
a161738a	349	X509_STORE_unlock(xl->store_ctx);
0f113f3e MC	350
	351	/* If a CRL, update the last file suffix added for this */
	352
	353	if (type == X509_LU_CRL) {
4fc4faa7	354	CRYPTO_THREAD_write_lock(ctx->lock);
0f113f3e MC	355	/*
	356	* Look for entry again in case another thread added an entry
	357	* first.
	358	*/
5b37fef0	359	if (hent == NULL) {
0f113f3e MC	360	htmp.hash = h;
0f113f3e MC	361	idx = sk_BY_DIR_HASH_find(ent->hashes, &htmp);
5b37fef0	362	hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
0f113f3e	363	}
7fcdbd83	364	if (hent == NULL) {
b4faea50	365	hent = OPENSSL_malloc(sizeof(*hent));
0f113f3e	366	if (hent == NULL) {
4fc4faa7	367	CRYPTO_THREAD_unlock(ctx->lock);
6725682d	368	X509err(0, ERR_R_MALLOC_FAILURE);
0f113f3e MC	369	ok = 0;
	370	goto finish;
	371	}
	372	hent->hash = h;
	373	hent->suffix = k;
	374	if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
4fc4faa7	375	CRYPTO_THREAD_unlock(ctx->lock);
0f113f3e	376	OPENSSL_free(hent);
6725682d	377	X509err(0, ERR_R_MALLOC_FAILURE);
0f113f3e MC	378	ok = 0;
	379	goto finish;
	380	}
4fc4faa7	381	} else if (hent->suffix < k) {
0f113f3e	382	hent->suffix = k;
4fc4faa7	383	}
0f113f3e	384
4fc4faa7	385	CRYPTO_THREAD_unlock(ctx->lock);
0f113f3e MC	386
	387	}
	388
	389	if (tmp != NULL) {
	390	ok = 1;
	391	ret->type = tmp->type;
	392	memcpy(&ret->data, &tmp->data, sizeof(ret->data));
c0452248 RS	393
	394	/*
	395	* Clear any errors that might have been raised processing empty
	396	* or malformed files.
	397	*/
	398	ERR_clear_error();
	399
0f113f3e MC	400	goto finish;
	401	}
	402	}
	403	finish:
25aaa98a	404	BUF_MEM_free(b);
26a7d938	405	return ok;
0f113f3e	406	}
6725682d SL	407
	408	static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
	409	const X509_NAME name, X509_OBJECT ret)
	410	{
	411	return get_cert_by_subject_with_libctx(xl, type, name, ret, NULL, NULL);
	412	}