text: /*
   * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
   *
   * Licensed under the OpenSSL license (the "License").  You may not use
   * this file except in compliance with the License.  You can obtain a copy
   * in the file LICENSE in the source distribution or at
   * https://www.openssl.org/source/license.html
   */
  
  #include "internal/refcount.h"
  
  /* Internal X509 structures and functions: not for application use */
  
  /* Note: unless otherwise stated a field pointer is mandatory and should
   * never be set to NULL: the ASN.1 code and accessors rely on mandatory
   * fields never being NULL.
   */
  
  /*
   * name entry structure, equivalent to AttributeTypeAndValue defined
   * in RFC5280 et al.
   */
  struct X509_name_entry_st
  {
      ASN1_OBJECT* object; /* AttributeType */
      ASN1_STRING* value;  /* AttributeValue */
      int set;             /* index of RDNSequence for this entry */
      int size;            /* temp variable */
  };
  
  /* Name from RFC 5280. */
  struct X509_name_st
  {
      STACK_OF(X509_NAME_ENTRY) * entries; /* DN components */
      int modified;                        /* true if 'bytes' needs to be built */
      BUF_MEM* bytes;                      /* cached encoding: cannot be NULL */
      /* canonical encoding used for rapid Name comparison */
      unsigned char* canon_enc;
      int canon_enclen;
  } /* X509_NAME */;
  
  /* Signature info structure */
  
  struct x509_sig_info_st
  {
      /* NID of message digest */
      int mdnid;
      /* NID of public key algorithm */
      int pknid;
      /* Security bits */
      int secbits;
      /* Various flags */
      uint32_t flags;
  };
  
  /* PKCS#10 certificate request */
  
  struct X509_req_info_st
  {
      ASN1_ENCODING enc;     /* cached encoding of signed part */
      ASN1_INTEGER* version; /* version, defaults to v1(0) so can be NULL */
      X509_NAME* subject;    /* certificate request DN */
      X509_PUBKEY* pubkey;   /* public key of request */
      /*
       * Zero or more attributes.
       * NB: although attributes is a mandatory field some broken
       * encodings omit it so this may be NULL in that case.
       */
      STACK_OF(X509_ATTRIBUTE) * attributes;
  };
  
  struct X509_req_st
  {
      X509_REQ_INFO req_info;     /* signed certificate request data */
      X509_ALGOR sig_alg;         /* signature algorithm */
      ASN1_BIT_STRING* signature; /* signature */
      CRYPTO_REF_COUNT references;
      CRYPTO_RWLOCK* lock;
  };
  
  struct X509_crl_info_st
  {
      ASN1_INTEGER* version; /* version: defaults to v1(0) so may be NULL */
      X509_ALGOR sig_alg;    /* signature algorithm */
      X509_NAME* issuer;     /* CRL issuer name */
      ASN1_TIME* lastUpdate; /* lastUpdate field */
      ASN1_TIME* nextUpdate; /* nextUpdate field: optional */
      STACK_OF(X509_REVOKED) * revoked;      /* revoked entries: optional */
      STACK_OF(X509_EXTENSION) * extensions; /* extensions: optional */
      ASN1_ENCODING enc; /* encoding of signed portion of CRL */
  };
  
  struct X509_crl_st
  {
      X509_CRL_INFO crl;         /* signed CRL data */
      X509_ALGOR sig_alg;        /* CRL signature algorithm */
      ASN1_BIT_STRING signature; /* CRL signature */
      CRYPTO_REF_COUNT references;
      int flags;
      /*
       * Cached copies of decoded extension values, since extensions
       * are optional any of these can be NULL.
       */
      AUTHORITY_KEYID* akid;
      ISSUING_DIST_POINT* idp;
      /* Convenient breakdown of IDP */
      int idp_flags;
      int idp_reasons;
      /* CRL and base CRL numbers for delta processing */
      ASN1_INTEGER* crl_number;
      ASN1_INTEGER* base_crl_number;
      STACK_OF(GENERAL_NAMES) * issuers;
      /* hash of CRL */
      unsigned char sha1_hash[SHA_DIGEST_LENGTH];
      /* alternative method to handle this CRL */
      const X509_CRL_METHOD* meth;
      void* meth_data;
      CRYPTO_RWLOCK* lock;
  };
  
  struct x509_revoked_st
  {
      ASN1_INTEGER serialNumber;             /* revoked entry serial number */
      ASN1_TIME* revocationDate;             /* revocation date */
      STACK_OF(X509_EXTENSION) * extensions; /* CRL entry extensions: optional */
      /* decoded value of CRLissuer extension: set if indirect CRL */
      STACK_OF(GENERAL_NAME) * issuer;
      /* revocation reason: set to CRL_REASON_NONE if reason extension absent */
      int reason;
      /*
       * CRL entries are reordered for faster lookup of serial numbers. This
       * field contains the original load sequence for this entry.
       */
      int sequence;
  };
  
  /*
   * This stuff is certificate "auxiliary info": it contains details which are
   * useful in certificate stores and databases. When used this is tagged onto
   * the end of the certificate itself. OpenSSL specific structure not defined
   * in any RFC.
   */
  
  struct x509_cert_aux_st
  {
      STACK_OF(ASN1_OBJECT) * trust;  /* trusted uses */
      STACK_OF(ASN1_OBJECT) * reject; /* rejected uses */
      ASN1_UTF8STRING* alias;         /* "friendly name" */
      ASN1_OCTET_STRING* keyid;       /* key id of private key */
      STACK_OF(X509_ALGOR) * other;   /* other unspecified info */
  };
  
  struct x509_cinf_st
  {
      ASN1_INTEGER* version; /* [ 0 ] default of v1 */
      ASN1_INTEGER serialNumber;
      X509_ALGOR signature;
      X509_NAME* issuer;
      X509_VAL validity;
      X509_NAME* subject;
      X509_PUBKEY* key;
      ASN1_BIT_STRING* issuerUID;            /* [ 1 ] optional in v2 */
      ASN1_BIT_STRING* subjectUID;           /* [ 2 ] optional in v2 */
      STACK_OF(X509_EXTENSION) * extensions; /* [ 3 ] optional in v3 */
      ASN1_ENCODING enc;
  };
  
  struct x509_st
  {
      X509_CINF cert_info;
      X509_ALGOR sig_alg;
      ASN1_BIT_STRING signature;
      X509_SIG_INFO siginf;
      CRYPTO_REF_COUNT references;
      CRYPTO_EX_DATA ex_data;
      /* These contain copies of various extension values */
      long ex_pathlen;
      long ex_pcpathlen;
      uint32_t ex_flags;
      uint32_t ex_kusage;
      uint32_t ex_xkusage;
      uint32_t ex_nscert;
      ASN1_OCTET_STRING* skid;
      AUTHORITY_KEYID* akid;
      X509_POLICY_CACHE* policy_cache;
      STACK_OF(DIST_POINT) * crldp;
      STACK_OF(GENERAL_NAME) * altname;
      NAME_CONSTRAINTS* nc;
  #ifndef OPENSSL_NO_RFC3779
      STACK_OF(IPAddressFamily) * rfc3779_addr;
      struct ASIdentifiers_st* rfc3779_asid;
  #endif
      unsigned char sha1_hash[SHA_DIGEST_LENGTH];
      X509_CERT_AUX* aux;
      CRYPTO_RWLOCK* lock;
      volatile int ex_cached;
  } /* X509 */;
  
  /*
   * This is a used when verifying cert chains.  Since the gathering of the
   * cert chain can take some time (and have to be 'retried', this needs to be
   * kept and passed around.
   */
  struct x509_store_ctx_st
  { /* X509_STORE_CTX */
      X509_STORE* ctx;
      /* The following are set by the caller */
      /* The cert to check */
      X509* cert;
      /* chain of X509s - untrusted - passed in */
      STACK_OF(X509) * untrusted;
      /* set of CRLs passed in */
      STACK_OF(X509_CRL) * crls;
      X509_VERIFY_PARAM* param;
      /* Other info for use with get_issuer() */
      void* other_ctx;
      /* Callbacks for various operations */
      /* called to verify a certificate */
      int (*verify)(X509_STORE_CTX* ctx);
      /* error callback */
      int (*verify_cb)(int ok, X509_STORE_CTX* ctx);
      /* get issuers cert from ctx */
      int (*get_issuer)(X509** issuer, X509_STORE_CTX* ctx, X509* x);
      /* check issued */
      int (*check_issued)(X509_STORE_CTX* ctx, X509* x, X509* issuer);
      /* Check revocation status of chain */
      int (*check_revocation)(X509_STORE_CTX* ctx);
      /* retrieve CRL */
      int (*get_crl)(X509_STORE_CTX* ctx, X509_CRL** crl, X509* x);
      /* Check CRL validity */
      int (*check_crl)(X509_STORE_CTX* ctx, X509_CRL* crl);
      /* Check certificate against CRL */
      int (*cert_crl)(X509_STORE_CTX* ctx, X509_CRL* crl, X509* x);
      /* Check policy status of the chain */
      int (*check_policy)(X509_STORE_CTX* ctx);
      STACK_OF(X509) * (*lookup_certs)(X509_STORE_CTX* ctx, X509_NAME* nm);
      STACK_OF(X509_CRL) * (*lookup_crls)(X509_STORE_CTX* ctx, X509_NAME* nm);
      int (*cleanup)(X509_STORE_CTX* ctx);
      /* The following is built up */
      /* if 0, rebuild chain */
      int valid;
      /* number of untrusted certs */
      int num_untrusted;
      /* chain of X509s - built up and trusted */
      STACK_OF(X509) * chain;
      /* Valid policy tree */
      X509_POLICY_TREE* tree;
      /* Require explicit policy value */
      int explicit_policy;
      /* When something goes wrong, this is why */
      int error_depth;
      int error;
      X509* current_cert;
      /* cert currently being tested as valid issuer */
      X509* current_issuer;
      /* current CRL */
      X509_CRL* current_crl;
      /* score of current CRL */
      int current_crl_score;
      /* Reason mask */
      unsigned int current_reasons;
      /* For CRL path validation: parent context */
      X509_STORE_CTX* parent;
      CRYPTO_EX_DATA ex_data;
      SSL_DANE* dane;
      /* signed via bare TA public key, rather than CA certificate */
      int bare_ta_signed;
  };
  
  /* PKCS#8 private key info structure */
  
  struct pkcs8_priv_key_info_st
  {
      ASN1_INTEGER* version;
      X509_ALGOR* pkeyalg;
      ASN1_OCTET_STRING* pkey;
      STACK_OF(X509_ATTRIBUTE) * attributes;
  };
  
  struct X509_sig_st
  {
      X509_ALGOR* algor;
      ASN1_OCTET_STRING* digest;
  };
  
  struct x509_object_st
  {
      /* one of the above types */
      X509_LOOKUP_TYPE type;
      union
      {
          char* ptr;
          X509* x509;
          X509_CRL* crl;
          EVP_PKEY* pkey;
      } data;
  };
  
  int a2i_ipadd(unsigned char* ipout, const char* ipasc);
  int x509_set1_time(ASN1_TIME** ptm, const ASN1_TIME* tm);
  
  void x509_init_sig_info(X509* x);
  