1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: x509_trs.c,v 1.25 2021/11/01 20:53:08 tb Exp $ */
2f5b1c8a1SJohn Marino /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3f5b1c8a1SJohn Marino * project 1999.
4f5b1c8a1SJohn Marino */
5f5b1c8a1SJohn Marino /* ====================================================================
6f5b1c8a1SJohn Marino * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7f5b1c8a1SJohn Marino *
8f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
9f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
10f5b1c8a1SJohn Marino * are met:
11f5b1c8a1SJohn Marino *
12f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the above copyright
13f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
14f5b1c8a1SJohn Marino *
15f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
16f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in
17f5b1c8a1SJohn Marino * the documentation and/or other materials provided with the
18f5b1c8a1SJohn Marino * distribution.
19f5b1c8a1SJohn Marino *
20f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this
21f5b1c8a1SJohn Marino * software must display the following acknowledgment:
22f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
23f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24f5b1c8a1SJohn Marino *
25f5b1c8a1SJohn Marino * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26f5b1c8a1SJohn Marino * endorse or promote products derived from this software without
27f5b1c8a1SJohn Marino * prior written permission. For written permission, please contact
28f5b1c8a1SJohn Marino * licensing@OpenSSL.org.
29f5b1c8a1SJohn Marino *
30f5b1c8a1SJohn Marino * 5. Products derived from this software may not be called "OpenSSL"
31f5b1c8a1SJohn Marino * nor may "OpenSSL" appear in their names without prior written
32f5b1c8a1SJohn Marino * permission of the OpenSSL Project.
33f5b1c8a1SJohn Marino *
34f5b1c8a1SJohn Marino * 6. Redistributions of any form whatsoever must retain the following
35f5b1c8a1SJohn Marino * acknowledgment:
36f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
37f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38f5b1c8a1SJohn Marino *
39f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40f5b1c8a1SJohn Marino * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42f5b1c8a1SJohn Marino * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43f5b1c8a1SJohn Marino * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44f5b1c8a1SJohn Marino * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45f5b1c8a1SJohn Marino * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46f5b1c8a1SJohn Marino * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48f5b1c8a1SJohn Marino * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49f5b1c8a1SJohn Marino * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50f5b1c8a1SJohn Marino * OF THE POSSIBILITY OF SUCH DAMAGE.
51f5b1c8a1SJohn Marino * ====================================================================
52f5b1c8a1SJohn Marino *
53f5b1c8a1SJohn Marino * This product includes cryptographic software written by Eric Young
54f5b1c8a1SJohn Marino * (eay@cryptsoft.com). This product includes software written by Tim
55f5b1c8a1SJohn Marino * Hudson (tjh@cryptsoft.com).
56f5b1c8a1SJohn Marino *
57f5b1c8a1SJohn Marino */
58f5b1c8a1SJohn Marino
59f5b1c8a1SJohn Marino #include <stdio.h>
60f5b1c8a1SJohn Marino #include <string.h>
61f5b1c8a1SJohn Marino
62f5b1c8a1SJohn Marino #include <openssl/err.h>
63f5b1c8a1SJohn Marino #include <openssl/x509v3.h>
64f5b1c8a1SJohn Marino
65*de0e0e4dSAntonio Huete Jimenez #include "x509_lcl.h"
66*de0e0e4dSAntonio Huete Jimenez
67f5b1c8a1SJohn Marino static int tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b);
68f5b1c8a1SJohn Marino static void trtable_free(X509_TRUST *p);
69f5b1c8a1SJohn Marino
70f5b1c8a1SJohn Marino static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
71f5b1c8a1SJohn Marino static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
72f5b1c8a1SJohn Marino static int trust_compat(X509_TRUST *trust, X509 *x, int flags);
73f5b1c8a1SJohn Marino
74f5b1c8a1SJohn Marino static int obj_trust(int id, X509 *x, int flags);
75f5b1c8a1SJohn Marino static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;
76f5b1c8a1SJohn Marino
77f5b1c8a1SJohn Marino /* WARNING: the following table should be kept in order of trust
78f5b1c8a1SJohn Marino * and without any gaps so we can just subtract the minimum trust
79f5b1c8a1SJohn Marino * value to get an index into the table
80f5b1c8a1SJohn Marino */
81f5b1c8a1SJohn Marino
82f5b1c8a1SJohn Marino static X509_TRUST trstandard[] = {
83f5b1c8a1SJohn Marino {X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
84f5b1c8a1SJohn Marino {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
85f5b1c8a1SJohn Marino {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
86f5b1c8a1SJohn Marino {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
87f5b1c8a1SJohn Marino {X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
88f5b1c8a1SJohn Marino {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
89f5b1c8a1SJohn Marino {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
90f5b1c8a1SJohn Marino {X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
91f5b1c8a1SJohn Marino };
92f5b1c8a1SJohn Marino
93f5b1c8a1SJohn Marino #define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
94f5b1c8a1SJohn Marino
95f5b1c8a1SJohn Marino static STACK_OF(X509_TRUST) *trtable = NULL;
96f5b1c8a1SJohn Marino
97f5b1c8a1SJohn Marino static int
tr_cmp(const X509_TRUST * const * a,const X509_TRUST * const * b)98f5b1c8a1SJohn Marino tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b)
99f5b1c8a1SJohn Marino {
100f5b1c8a1SJohn Marino return (*a)->trust - (*b)->trust;
101f5b1c8a1SJohn Marino }
102f5b1c8a1SJohn Marino
103f5b1c8a1SJohn Marino int
X509_TRUST_set_default(int (* trust)(int,X509 *,int))104f5b1c8a1SJohn Marino (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
105f5b1c8a1SJohn Marino {
106f5b1c8a1SJohn Marino int (*oldtrust)(int , X509 *, int);
107f5b1c8a1SJohn Marino
108f5b1c8a1SJohn Marino oldtrust = default_trust;
109f5b1c8a1SJohn Marino default_trust = trust;
110f5b1c8a1SJohn Marino return oldtrust;
111f5b1c8a1SJohn Marino }
112f5b1c8a1SJohn Marino
113f5b1c8a1SJohn Marino int
X509_check_trust(X509 * x,int id,int flags)114f5b1c8a1SJohn Marino X509_check_trust(X509 *x, int id, int flags)
115f5b1c8a1SJohn Marino {
116f5b1c8a1SJohn Marino X509_TRUST *pt;
117f5b1c8a1SJohn Marino int idx;
118f5b1c8a1SJohn Marino
119f5b1c8a1SJohn Marino if (id == -1)
120f5b1c8a1SJohn Marino return 1;
12172c33676SMaxim Ag /*
12272c33676SMaxim Ag * XXX beck/jsing This enables self signed certs to be trusted for
12372c33676SMaxim Ag * an unspecified id/trust flag value (this is NOT the
12472c33676SMaxim Ag * X509_TRUST_DEFAULT), which was the longstanding
12572c33676SMaxim Ag * openssl behaviour. boringssl does not have this behaviour.
12672c33676SMaxim Ag *
12772c33676SMaxim Ag * This should be revisited, but changing the default "not default"
12872c33676SMaxim Ag * may break things.
12972c33676SMaxim Ag */
13072c33676SMaxim Ag if (id == 0) {
13172c33676SMaxim Ag int rv;
13272c33676SMaxim Ag rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
13372c33676SMaxim Ag if (rv != X509_TRUST_UNTRUSTED)
13472c33676SMaxim Ag return rv;
13572c33676SMaxim Ag return trust_compat(NULL, x, 0);
13672c33676SMaxim Ag }
137f5b1c8a1SJohn Marino idx = X509_TRUST_get_by_id(id);
138f5b1c8a1SJohn Marino if (idx == -1)
139f5b1c8a1SJohn Marino return default_trust(id, x, flags);
140f5b1c8a1SJohn Marino pt = X509_TRUST_get0(idx);
141f5b1c8a1SJohn Marino return pt->check_trust(pt, x, flags);
142f5b1c8a1SJohn Marino }
143f5b1c8a1SJohn Marino
144f5b1c8a1SJohn Marino int
X509_TRUST_get_count(void)145f5b1c8a1SJohn Marino X509_TRUST_get_count(void)
146f5b1c8a1SJohn Marino {
147f5b1c8a1SJohn Marino if (!trtable)
148f5b1c8a1SJohn Marino return X509_TRUST_COUNT;
149f5b1c8a1SJohn Marino return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
150f5b1c8a1SJohn Marino }
151f5b1c8a1SJohn Marino
152f5b1c8a1SJohn Marino X509_TRUST *
X509_TRUST_get0(int idx)153f5b1c8a1SJohn Marino X509_TRUST_get0(int idx)
154f5b1c8a1SJohn Marino {
155f5b1c8a1SJohn Marino if (idx < 0)
156f5b1c8a1SJohn Marino return NULL;
157f5b1c8a1SJohn Marino if (idx < (int)X509_TRUST_COUNT)
158f5b1c8a1SJohn Marino return trstandard + idx;
159f5b1c8a1SJohn Marino return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
160f5b1c8a1SJohn Marino }
161f5b1c8a1SJohn Marino
162f5b1c8a1SJohn Marino int
X509_TRUST_get_by_id(int id)163f5b1c8a1SJohn Marino X509_TRUST_get_by_id(int id)
164f5b1c8a1SJohn Marino {
165f5b1c8a1SJohn Marino X509_TRUST tmp;
166f5b1c8a1SJohn Marino int idx;
167f5b1c8a1SJohn Marino
168f5b1c8a1SJohn Marino if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
169f5b1c8a1SJohn Marino return id - X509_TRUST_MIN;
170f5b1c8a1SJohn Marino tmp.trust = id;
171f5b1c8a1SJohn Marino if (!trtable)
172f5b1c8a1SJohn Marino return -1;
173f5b1c8a1SJohn Marino idx = sk_X509_TRUST_find(trtable, &tmp);
174f5b1c8a1SJohn Marino if (idx == -1)
175f5b1c8a1SJohn Marino return -1;
176f5b1c8a1SJohn Marino return idx + X509_TRUST_COUNT;
177f5b1c8a1SJohn Marino }
178f5b1c8a1SJohn Marino
179f5b1c8a1SJohn Marino int
X509_TRUST_set(int * t,int trust)180f5b1c8a1SJohn Marino X509_TRUST_set(int *t, int trust)
181f5b1c8a1SJohn Marino {
182f5b1c8a1SJohn Marino if (X509_TRUST_get_by_id(trust) == -1) {
18372c33676SMaxim Ag X509error(X509_R_INVALID_TRUST);
184f5b1c8a1SJohn Marino return 0;
185f5b1c8a1SJohn Marino }
186f5b1c8a1SJohn Marino *t = trust;
187f5b1c8a1SJohn Marino return 1;
188f5b1c8a1SJohn Marino }
189f5b1c8a1SJohn Marino
190f5b1c8a1SJohn Marino int
X509_TRUST_add(int id,int flags,int (* ck)(X509_TRUST *,X509 *,int),const char * name,int arg1,void * arg2)191f5b1c8a1SJohn Marino X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
19272c33676SMaxim Ag const char *name, int arg1, void *arg2)
193f5b1c8a1SJohn Marino {
194f5b1c8a1SJohn Marino int idx;
195f5b1c8a1SJohn Marino X509_TRUST *trtmp;
196f5b1c8a1SJohn Marino char *name_dup;
197f5b1c8a1SJohn Marino
198f5b1c8a1SJohn Marino /* This is set according to what we change: application can't set it */
199f5b1c8a1SJohn Marino flags &= ~X509_TRUST_DYNAMIC;
200f5b1c8a1SJohn Marino /* This will always be set for application modified trust entries */
201f5b1c8a1SJohn Marino flags |= X509_TRUST_DYNAMIC_NAME;
202f5b1c8a1SJohn Marino /* Get existing entry if any */
203f5b1c8a1SJohn Marino idx = X509_TRUST_get_by_id(id);
204f5b1c8a1SJohn Marino /* Need a new entry */
205f5b1c8a1SJohn Marino if (idx == -1) {
206f5b1c8a1SJohn Marino if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
20772c33676SMaxim Ag X509error(ERR_R_MALLOC_FAILURE);
208f5b1c8a1SJohn Marino return 0;
209f5b1c8a1SJohn Marino }
210f5b1c8a1SJohn Marino trtmp->flags = X509_TRUST_DYNAMIC;
211f5b1c8a1SJohn Marino } else {
212f5b1c8a1SJohn Marino trtmp = X509_TRUST_get0(idx);
213f5b1c8a1SJohn Marino if (trtmp == NULL) {
21472c33676SMaxim Ag X509error(X509_R_INVALID_TRUST);
215f5b1c8a1SJohn Marino return 0;
216f5b1c8a1SJohn Marino }
217f5b1c8a1SJohn Marino }
218f5b1c8a1SJohn Marino
219f5b1c8a1SJohn Marino if ((name_dup = strdup(name)) == NULL)
220f5b1c8a1SJohn Marino goto err;
221f5b1c8a1SJohn Marino
222f5b1c8a1SJohn Marino /* free existing name if dynamic */
223f5b1c8a1SJohn Marino if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
224f5b1c8a1SJohn Marino free(trtmp->name);
225f5b1c8a1SJohn Marino /* dup supplied name */
226f5b1c8a1SJohn Marino trtmp->name = name_dup;
227f5b1c8a1SJohn Marino /* Keep the dynamic flag of existing entry */
228f5b1c8a1SJohn Marino trtmp->flags &= X509_TRUST_DYNAMIC;
229f5b1c8a1SJohn Marino /* Set all other flags */
230f5b1c8a1SJohn Marino trtmp->flags |= flags;
231f5b1c8a1SJohn Marino
232f5b1c8a1SJohn Marino trtmp->trust = id;
233f5b1c8a1SJohn Marino trtmp->check_trust = ck;
234f5b1c8a1SJohn Marino trtmp->arg1 = arg1;
235f5b1c8a1SJohn Marino trtmp->arg2 = arg2;
236f5b1c8a1SJohn Marino
237f5b1c8a1SJohn Marino /* If it's a new entry, manage the dynamic table */
238f5b1c8a1SJohn Marino if (idx == -1) {
239f5b1c8a1SJohn Marino if (trtable == NULL &&
240f5b1c8a1SJohn Marino (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
241f5b1c8a1SJohn Marino goto err;
242f5b1c8a1SJohn Marino if (sk_X509_TRUST_push(trtable, trtmp) == 0)
243f5b1c8a1SJohn Marino goto err;
244f5b1c8a1SJohn Marino }
245f5b1c8a1SJohn Marino return 1;
246f5b1c8a1SJohn Marino
247f5b1c8a1SJohn Marino err:
248f5b1c8a1SJohn Marino free(name_dup);
249f5b1c8a1SJohn Marino if (idx == -1)
250f5b1c8a1SJohn Marino free(trtmp);
25172c33676SMaxim Ag X509error(ERR_R_MALLOC_FAILURE);
252f5b1c8a1SJohn Marino return 0;
253f5b1c8a1SJohn Marino }
254f5b1c8a1SJohn Marino
255f5b1c8a1SJohn Marino static void
trtable_free(X509_TRUST * p)256f5b1c8a1SJohn Marino trtable_free(X509_TRUST *p)
257f5b1c8a1SJohn Marino {
258f5b1c8a1SJohn Marino if (!p)
259f5b1c8a1SJohn Marino return;
260f5b1c8a1SJohn Marino if (p->flags & X509_TRUST_DYNAMIC) {
261f5b1c8a1SJohn Marino if (p->flags & X509_TRUST_DYNAMIC_NAME)
262f5b1c8a1SJohn Marino free(p->name);
263f5b1c8a1SJohn Marino free(p);
264f5b1c8a1SJohn Marino }
265f5b1c8a1SJohn Marino }
266f5b1c8a1SJohn Marino
267f5b1c8a1SJohn Marino void
X509_TRUST_cleanup(void)268f5b1c8a1SJohn Marino X509_TRUST_cleanup(void)
269f5b1c8a1SJohn Marino {
270f5b1c8a1SJohn Marino sk_X509_TRUST_pop_free(trtable, trtable_free);
271f5b1c8a1SJohn Marino trtable = NULL;
272f5b1c8a1SJohn Marino }
273f5b1c8a1SJohn Marino
274f5b1c8a1SJohn Marino int
X509_TRUST_get_flags(const X509_TRUST * xp)27572c33676SMaxim Ag X509_TRUST_get_flags(const X509_TRUST *xp)
276f5b1c8a1SJohn Marino {
277f5b1c8a1SJohn Marino return xp->flags;
278f5b1c8a1SJohn Marino }
279f5b1c8a1SJohn Marino
280f5b1c8a1SJohn Marino char *
X509_TRUST_get0_name(const X509_TRUST * xp)28172c33676SMaxim Ag X509_TRUST_get0_name(const X509_TRUST *xp)
282f5b1c8a1SJohn Marino {
283f5b1c8a1SJohn Marino return xp->name;
284f5b1c8a1SJohn Marino }
285f5b1c8a1SJohn Marino
286f5b1c8a1SJohn Marino int
X509_TRUST_get_trust(const X509_TRUST * xp)28772c33676SMaxim Ag X509_TRUST_get_trust(const X509_TRUST *xp)
288f5b1c8a1SJohn Marino {
289f5b1c8a1SJohn Marino return xp->trust;
290f5b1c8a1SJohn Marino }
291f5b1c8a1SJohn Marino
292f5b1c8a1SJohn Marino static int
trust_1oidany(X509_TRUST * trust,X509 * x,int flags)293f5b1c8a1SJohn Marino trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
294f5b1c8a1SJohn Marino {
295f5b1c8a1SJohn Marino if (x->aux && (x->aux->trust || x->aux->reject))
296f5b1c8a1SJohn Marino return obj_trust(trust->arg1, x, flags);
297f5b1c8a1SJohn Marino /* we don't have any trust settings: for compatibility
298f5b1c8a1SJohn Marino * we return trusted if it is self signed
299f5b1c8a1SJohn Marino */
300f5b1c8a1SJohn Marino return trust_compat(trust, x, flags);
301f5b1c8a1SJohn Marino }
302f5b1c8a1SJohn Marino
303f5b1c8a1SJohn Marino static int
trust_1oid(X509_TRUST * trust,X509 * x,int flags)304f5b1c8a1SJohn Marino trust_1oid(X509_TRUST *trust, X509 *x, int flags)
305f5b1c8a1SJohn Marino {
306f5b1c8a1SJohn Marino if (x->aux)
307f5b1c8a1SJohn Marino return obj_trust(trust->arg1, x, flags);
308f5b1c8a1SJohn Marino return X509_TRUST_UNTRUSTED;
309f5b1c8a1SJohn Marino }
310f5b1c8a1SJohn Marino
311f5b1c8a1SJohn Marino static int
trust_compat(X509_TRUST * trust,X509 * x,int flags)312f5b1c8a1SJohn Marino trust_compat(X509_TRUST *trust, X509 *x, int flags)
313f5b1c8a1SJohn Marino {
314f5b1c8a1SJohn Marino X509_check_purpose(x, -1, 0);
315f5b1c8a1SJohn Marino if (x->ex_flags & EXFLAG_SS)
316f5b1c8a1SJohn Marino return X509_TRUST_TRUSTED;
317f5b1c8a1SJohn Marino else
318f5b1c8a1SJohn Marino return X509_TRUST_UNTRUSTED;
319f5b1c8a1SJohn Marino }
320f5b1c8a1SJohn Marino
321f5b1c8a1SJohn Marino static int
obj_trust(int id,X509 * x,int flags)322f5b1c8a1SJohn Marino obj_trust(int id, X509 *x, int flags)
323f5b1c8a1SJohn Marino {
324f5b1c8a1SJohn Marino ASN1_OBJECT *obj;
325f5b1c8a1SJohn Marino int i;
326f5b1c8a1SJohn Marino X509_CERT_AUX *ax;
327f5b1c8a1SJohn Marino
328f5b1c8a1SJohn Marino ax = x->aux;
329f5b1c8a1SJohn Marino if (!ax)
330f5b1c8a1SJohn Marino return X509_TRUST_UNTRUSTED;
331f5b1c8a1SJohn Marino if (ax->reject) {
332f5b1c8a1SJohn Marino for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
333f5b1c8a1SJohn Marino obj = sk_ASN1_OBJECT_value(ax->reject, i);
334f5b1c8a1SJohn Marino if (OBJ_obj2nid(obj) == id)
335f5b1c8a1SJohn Marino return X509_TRUST_REJECTED;
336f5b1c8a1SJohn Marino }
337f5b1c8a1SJohn Marino }
338f5b1c8a1SJohn Marino if (ax->trust) {
339f5b1c8a1SJohn Marino for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
340f5b1c8a1SJohn Marino obj = sk_ASN1_OBJECT_value(ax->trust, i);
341f5b1c8a1SJohn Marino if (OBJ_obj2nid(obj) == id)
342f5b1c8a1SJohn Marino return X509_TRUST_TRUSTED;
343f5b1c8a1SJohn Marino }
344f5b1c8a1SJohn Marino }
345f5b1c8a1SJohn Marino return X509_TRUST_UNTRUSTED;
346f5b1c8a1SJohn Marino }
347