Add function X509_VERIFY_PARAM_get_purpose()

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25132)

diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index 8ed41b78673060224cf0b2c51cbac17aeea2d095..2e25acb4a069566b0662a5bf58d7f00828611035 100644 (file)
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c
@@ -302,6 +302,11 @@ int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose)
     return X509_PURPOSE_set(&param->purpose, purpose);
 }
 
+int X509_VERIFY_PARAM_get_purpose(const X509_VERIFY_PARAM *param)
+{
+    return param->purpose;
+}
+
 int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust)
 {
     return X509_TRUST_set(&param->trust, trust);

diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod
index d35c2e2202e8c6cacbfedebb0e738d87b8b59b6e..8c32eb7c2720fa9dbb81154119ae1c98b0a4c367 100644 (file)
--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod
+++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod
@@ -4,6 +4,7 @@
 
 X509_VERIFY_PARAM_set_flags, X509_VERIFY_PARAM_clear_flags,
 X509_VERIFY_PARAM_get_flags, X509_VERIFY_PARAM_set_purpose,
+X509_VERIFY_PARAM_get_purpose,
 X509_VERIFY_PARAM_get_inh_flags, X509_VERIFY_PARAM_set_inh_flags,
 X509_VERIFY_PARAM_set_trust, X509_VERIFY_PARAM_set_depth,
 X509_VERIFY_PARAM_get_depth, X509_VERIFY_PARAM_set_auth_level,
@@ -35,6 +36,7 @@ X509_VERIFY_PARAM_set1_ip_asc
  uint32_t X509_VERIFY_PARAM_get_inh_flags(const X509_VERIFY_PARAM *param);
 
  int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
+ int X509_VERIFY_PARAM_get_purpose(X509_VERIFY_PARAM *param);
  int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
 
  void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
@@ -92,6 +94,8 @@ to B<purpose>. This determines the acceptable purpose of the certificate
 chain, for example B<X509_PURPOSE_SSL_CLIENT>.
 The purpose requirement is cleared if B<purpose> is X509_PURPOSE_DEFAULT_ANY.
 
+X509_VERIFY_PARAM_get_purpose() returns the purpose in B<param>.
+
 X509_VERIFY_PARAM_set_trust() sets the trust setting in B<param> to
 B<trust>.
 
@@ -408,6 +412,8 @@ The function X509_VERIFY_PARAM_add0_policy() was historically documented as
 enabling policy checking however the implementation has never done this.
 The documentation was changed to align with the implementation.
 
+The X509_VERIFY_PARAM_get_purpose() function was added in OpenSSL 3.5.
+
 =head1 COPYRIGHT
 
 Copyright 2009-2023 The OpenSSL Project Authors. All Rights Reserved.

diff --git a/include/openssl/x509_vfy.h.in b/include/openssl/x509_vfy.h.in
index a396193b86d13164a472b25eb2c8c2513413d6b6..ff919f49e70f615005cb99262608749041b51e76 100644 (file)
--- a/include/openssl/x509_vfy.h.in
+++ b/include/openssl/x509_vfy.h.in
@@ -715,6 +715,7 @@ int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
                                   unsigned long flags);
 unsigned long X509_VERIFY_PARAM_get_flags(const X509_VERIFY_PARAM *param);
 int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
+int X509_VERIFY_PARAM_get_purpose(const X509_VERIFY_PARAM *param);
 int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
 void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
 void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, int auth_level);

diff --git a/util/libcrypto.num b/util/libcrypto.num
index 6e9a8a121a3b79f161431c1507e4d8a11795bc8d..2e2046f4129e3567485a42142f6a3dab06b11580 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5734,6 +5734,7 @@ EVP_CIPHER_CTX_get_algor                5861      3_4_0   EXIST::FUNCTION:
 EVP_PKEY_CTX_set_algor_params           5862   3_4_0   EXIST::FUNCTION:
 EVP_PKEY_CTX_get_algor_params           5863   3_4_0   EXIST::FUNCTION:
 EVP_PKEY_CTX_get_algor                  5864   3_4_0   EXIST::FUNCTION:
+X509_VERIFY_PARAM_get_purpose           ?      3_5_0   EXIST::FUNCTION:
 d2i_OSSL_CRMF_ENCRYPTEDKEY              ?      3_5_0   EXIST::FUNCTION:CRMF
 i2d_OSSL_CRMF_ENCRYPTEDKEY              ?      3_5_0   EXIST::FUNCTION:CRMF
 OSSL_CRMF_ENCRYPTEDKEY_free             ?      3_5_0   EXIST::FUNCTION:CRMF