649 lines
34 KiB
Diff
649 lines
34 KiB
Diff
From 49dc6e515d9ec0db1841e5d2d86f52916d35f667 Mon Sep 17 00:00:00 2001
|
|
From: Jeremy Barton <jbarton@microsoft.com>
|
|
Date: Mon, 5 Apr 2021 11:07:29 -0700
|
|
Subject: [PATCH 04/11] Support compiling against OpenSSL 3 headers
|
|
|
|
Building against OpenSSL 3's headers fails to compile, as X509_V_ERR_INVALID_CA has changed from 24 to 79, tripping a static assert.
|
|
|
|
* Rename the managed X509VerifyStatusCode enum to X509VerifyStatusCodeUniversal, to represent the name/values that are present in all current versions of OpenSSL (1.0.2, 1.1.1, 3.0 alpha)
|
|
* Add new enums for the name/value pairs that are unique to a given version
|
|
* Add an X509VerifyStatusCode struct that just wraps the int and is a faux-union of the various enums
|
|
* Use the OpenSSL runtime version to determine which mapping table to use (after the Universal table fails)
|
|
|
|
In addition to that, there are a few const-related changes in the 3.0 headers that are addressed.
|
|
|
|
`corefx/src/Native$ ./build_native.sh -portablebuild=false` on systems where find_package(OpenSSL) maps to 3.0 succeeds with these changes. Portable builds still fail.
|
|
|
|
Not all tests pass with OpenSSL 3.0 (alpha 13) with these changes, but it does reduce to three categories of error:
|
|
|
|
* ICryptoTransform reset/reuse tests fail (OpenSSL regression is open)
|
|
* DSA small key generation fails (OpenSSL has fixed the regression for the next alpha/beta release)
|
|
* Some OuterLoop X.509 tests are failing as positively revoked when they expect ambiguous revocation states (investigation pending)
|
|
---
|
|
.../Interop.OCSP.cs | 4 +-
|
|
.../Interop.X509.cs | 109 +++++++++++-
|
|
.../pal_evp_pkey_rsa.c | 8 +-
|
|
.../pal_x509.c | 24 ++-
|
|
.../pal_x509.h | 29 +++-
|
|
.../Pal.Unix/OpenSslX509ChainProcessor.cs | 155 ++++++++++++------
|
|
6 files changed, 266 insertions(+), 63 deletions(-)
|
|
|
|
diff --git a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OCSP.cs b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OCSP.cs
|
|
index bcf9e2af48..8be162e284 100644
|
|
--- a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OCSP.cs
|
|
+++ b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OCSP.cs
|
|
@@ -43,7 +43,7 @@ internal static X509VerifyStatusCode X509ChainGetCachedOcspStatus(SafeX509StoreC
|
|
{
|
|
X509VerifyStatusCode response = CryptoNative_X509ChainGetCachedOcspStatus(ctx, cachePath);
|
|
|
|
- if (response < 0)
|
|
+ if (response.Code < 0)
|
|
{
|
|
Debug.Fail($"Unexpected response from X509ChainGetCachedOcspSuccess: {response}");
|
|
throw new CryptographicException();
|
|
@@ -67,7 +67,7 @@ internal static X509VerifyStatusCode X509ChainGetCachedOcspStatus(SafeX509StoreC
|
|
{
|
|
X509VerifyStatusCode response = CryptoNative_X509ChainVerifyOcsp(ctx, req, resp, cachePath);
|
|
|
|
- if (response < 0)
|
|
+ if (response.Code < 0)
|
|
{
|
|
Debug.Fail($"Unexpected response from X509ChainGetCachedOcspSuccess: {response}");
|
|
throw new CryptographicException();
|
|
diff --git a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509.cs b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509.cs
|
|
index 8ffc70af6a..99747c276b 100644
|
|
--- a/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509.cs
|
|
+++ b/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.X509.cs
|
|
@@ -216,13 +216,13 @@ internal static bool X509StoreCtxRebuildChain(SafeX509StoreCtxHandle ctx)
|
|
[DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_X509StoreCtxSetVerifyCallback")]
|
|
internal static extern void X509StoreCtxSetVerifyCallback(SafeX509StoreCtxHandle ctx, X509StoreVerifyCallback callback);
|
|
|
|
- internal static string GetX509VerifyCertErrorString(X509VerifyStatusCode n)
|
|
+ internal static string GetX509VerifyCertErrorString(int n)
|
|
{
|
|
return Marshal.PtrToStringAnsi(X509VerifyCertErrorString(n));
|
|
}
|
|
|
|
[DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_X509VerifyCertErrorString")]
|
|
- private static extern IntPtr X509VerifyCertErrorString(X509VerifyStatusCode n);
|
|
+ private static extern IntPtr X509VerifyCertErrorString(int n);
|
|
|
|
[DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_X509CrlDestroy")]
|
|
internal static extern void X509CrlDestroy(IntPtr a);
|
|
@@ -239,11 +239,13 @@ internal static string GetX509VerifyCertErrorString(X509VerifyStatusCode n)
|
|
[DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_EncodeX509SubjectPublicKeyInfo")]
|
|
internal static extern int EncodeX509SubjectPublicKeyInfo(SafeX509Handle x509, byte[] buf);
|
|
|
|
- internal enum X509VerifyStatusCode : int
|
|
+ internal enum X509VerifyStatusCodeUniversal
|
|
{
|
|
X509_V_OK = 0,
|
|
+ X509_V_ERR_UNSPECIFIED = 1,
|
|
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT = 2,
|
|
X509_V_ERR_UNABLE_TO_GET_CRL = 3,
|
|
+ X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE = 4,
|
|
X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE = 5,
|
|
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY = 6,
|
|
X509_V_ERR_CERT_SIGNATURE_FAILURE = 7,
|
|
@@ -263,18 +265,25 @@ internal enum X509VerifyStatusCode : int
|
|
X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE = 21,
|
|
X509_V_ERR_CERT_CHAIN_TOO_LONG = 22,
|
|
X509_V_ERR_CERT_REVOKED = 23,
|
|
- X509_V_ERR_INVALID_CA = 24,
|
|
+
|
|
+ // Code 24 varies.
|
|
+
|
|
X509_V_ERR_PATH_LENGTH_EXCEEDED = 25,
|
|
X509_V_ERR_INVALID_PURPOSE = 26,
|
|
X509_V_ERR_CERT_UNTRUSTED = 27,
|
|
X509_V_ERR_CERT_REJECTED = 28,
|
|
+ X509_V_ERR_SUBJECT_ISSUER_MISMATCH = 29,
|
|
+ X509_V_ERR_AKID_SKID_MISMATCH = 30,
|
|
+ X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH = 31,
|
|
X509_V_ERR_KEYUSAGE_NO_CERTSIGN = 32,
|
|
X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER = 33,
|
|
X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION = 34,
|
|
X509_V_ERR_KEYUSAGE_NO_CRL_SIGN = 35,
|
|
X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION = 36,
|
|
X509_V_ERR_INVALID_NON_CA = 37,
|
|
+ X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED = 38,
|
|
X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE = 39,
|
|
+ X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED = 40,
|
|
X509_V_ERR_INVALID_EXTENSION = 41,
|
|
X509_V_ERR_INVALID_POLICY_EXTENSION = 42,
|
|
X509_V_ERR_NO_EXPLICIT_POLICY = 43,
|
|
@@ -289,7 +298,6 @@ internal enum X509VerifyStatusCode : int
|
|
X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX = 52,
|
|
X509_V_ERR_UNSUPPORTED_NAME_SYNTAX = 53,
|
|
X509_V_ERR_CRL_PATH_VALIDATION_ERROR = 54,
|
|
- X509_V_ERR_PATH_LOOP = 55,
|
|
X509_V_ERR_SUITE_B_INVALID_VERSION = 56,
|
|
X509_V_ERR_SUITE_B_INVALID_ALGORITHM = 57,
|
|
X509_V_ERR_SUITE_B_INVALID_CURVE = 58,
|
|
@@ -299,6 +307,41 @@ internal enum X509VerifyStatusCode : int
|
|
X509_V_ERR_HOSTNAME_MISMATCH = 62,
|
|
X509_V_ERR_EMAIL_MISMATCH = 63,
|
|
X509_V_ERR_IP_ADDRESS_MISMATCH = 64,
|
|
+ }
|
|
+ internal enum X509VerifyStatusCode102
|
|
+ {
|
|
+ X509_V_ERR_INVALID_CA = 24,
|
|
+
|
|
+ X509_V_ERR_INVALID_CALL = 65,
|
|
+ X509_V_ERR_STORE_LOOKUP = 66,
|
|
+ X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION = 67,
|
|
+ }
|
|
+
|
|
+ internal enum X509VerifyStatusCode111
|
|
+ {
|
|
+ X509_V_ERR_INVALID_CA = 24,
|
|
+
|
|
+ X509_V_ERR_DANE_NO_MATCH = 65,
|
|
+ X509_V_ERR_EE_KEY_TOO_SMALL = 66,
|
|
+ X509_V_ERR_CA_KEY_TOO_SMALL = 67,
|
|
+ X509_V_ERR_CA_MD_TOO_WEAK = 68,
|
|
+ X509_V_ERR_INVALID_CALL = 69,
|
|
+ X509_V_ERR_STORE_LOOKUP = 70,
|
|
+ X509_V_ERR_NO_VALID_SCTS = 71,
|
|
+ X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION = 72,
|
|
+ X509_V_ERR_OCSP_VERIFY_NEEDED = 73,
|
|
+ X509_V_ERR_OCSP_VERIFY_FAILED = 74,
|
|
+ X509_V_ERR_OCSP_CERT_UNKNOWN = 75,
|
|
+ X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH = 76,
|
|
+ X509_V_ERR_NO_ISSUER_PUBLIC_KEY = 77,
|
|
+ X509_V_ERR_UNSUPPORTED_SIGNATURE_ALGORITHM = 78,
|
|
+ X509_V_ERR_EC_KEY_EXPLICIT_PARAMS = 79,
|
|
+ }
|
|
+
|
|
+ internal enum X509VerifyStatusCode30
|
|
+ {
|
|
+ X509_V_ERR_NO_ISSUER_PUBLIC_KEY = 24,
|
|
+
|
|
X509_V_ERR_DANE_NO_MATCH = 65,
|
|
X509_V_ERR_EE_KEY_TOO_SMALL = 66,
|
|
X509_V_ERR_CA_KEY_TOO_SMALL = 67,
|
|
@@ -310,6 +353,62 @@ internal enum X509VerifyStatusCode : int
|
|
X509_V_ERR_OCSP_VERIFY_NEEDED = 73,
|
|
X509_V_ERR_OCSP_VERIFY_FAILED = 74,
|
|
X509_V_ERR_OCSP_CERT_UNKNOWN = 75,
|
|
+ X509_V_ERR_UNSUPPORTED_SIGNATURE_ALGORITHM = 76,
|
|
+ X509_V_ERR_SIGNATURE_ALGORITHM_MISMATCH = 77,
|
|
+ X509_V_ERR_SIGNATURE_ALGORITHM_INCONSISTENCY = 78,
|
|
+ X509_V_ERR_INVALID_CA = 79,
|
|
+ X509_V_ERR_PATHLEN_INVALID_FOR_NON_CA = 80,
|
|
+ X509_V_ERR_PATHLEN_WITHOUT_KU_KEY_CERT_SIGN = 81,
|
|
+ X509_V_ERR_KU_KEY_CERT_SIGN_INVALID_FOR_NON_CA = 82,
|
|
+ X509_V_ERR_ISSUER_NAME_EMPTY = 83,
|
|
+ X509_V_ERR_SUBJECT_NAME_EMPTY = 84,
|
|
+ X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER = 85,
|
|
+ X509_V_ERR_MISSING_SUBJECT_KEY_IDENTIFIER = 86,
|
|
+ X509_V_ERR_EMPTY_SUBJECT_ALT_NAME = 87,
|
|
+ X509_V_ERR_EMPTY_SUBJECT_SAN_NOT_CRITICAL = 88,
|
|
+ X509_V_ERR_CA_BCONS_NOT_CRITICAL = 89,
|
|
+ X509_V_ERR_AUTHORITY_KEY_IDENTIFIER_CRITICAL = 90,
|
|
+ X509_V_ERR_SUBJECT_KEY_IDENTIFIER_CRITICAL = 91,
|
|
+ X509_V_ERR_CA_CERT_MISSING_KEY_USAGE = 92,
|
|
+ X509_V_ERR_EXTENSIONS_REQUIRE_VERSION_3 = 93,
|
|
+ X509_V_ERR_EC_KEY_EXPLICIT_PARAMS = 94,
|
|
+ }
|
|
+
|
|
+ internal readonly struct X509VerifyStatusCode : IEquatable<X509VerifyStatusCode>
|
|
+ {
|
|
+ internal static readonly X509VerifyStatusCode X509_V_OK = X509VerifyStatusCodeUniversal.X509_V_OK;
|
|
+
|
|
+ public int Code { get; }
|
|
+
|
|
+ internal X509VerifyStatusCode(int code)
|
|
+ {
|
|
+ Code = code;
|
|
+ }
|
|
+
|
|
+ public X509VerifyStatusCodeUniversal UniversalCode => (X509VerifyStatusCodeUniversal)Code;
|
|
+ public X509VerifyStatusCode102 Code102 => (X509VerifyStatusCode102)Code;
|
|
+ public X509VerifyStatusCode111 Code111 => (X509VerifyStatusCode111)Code;
|
|
+ public X509VerifyStatusCode30 Code30 => (X509VerifyStatusCode30)Code;
|
|
+
|
|
+ public bool Equals(X509VerifyStatusCode other) => Code == other.Code;
|
|
+
|
|
+ public override bool Equals(object obj) => obj is X509VerifyStatusCode other && Equals(other);
|
|
+
|
|
+ public override int GetHashCode() => Code.GetHashCode();
|
|
+
|
|
+ public static bool operator ==(X509VerifyStatusCode left, X509VerifyStatusCode right) => left.Equals(right);
|
|
+
|
|
+ public static bool operator !=(X509VerifyStatusCode left, X509VerifyStatusCode right) => !left.Equals(right);
|
|
+
|
|
+ public static explicit operator X509VerifyStatusCode(int code)
|
|
+ {
|
|
+ return new X509VerifyStatusCode(code);
|
|
+ }
|
|
+
|
|
+ public static implicit operator X509VerifyStatusCode(X509VerifyStatusCodeUniversal code)
|
|
+ {
|
|
+ return new X509VerifyStatusCode((int)code);
|
|
+ }
|
|
}
|
|
}
|
|
}
|
|
diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c
|
|
index 68b6a34a5d..02b31b4737 100644
|
|
--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c
|
|
+++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c
|
|
@@ -6,7 +6,7 @@
|
|
#include "pal_utilities.h"
|
|
#include <assert.h>
|
|
|
|
-static int HasNoPrivateKey(RSA* rsa);
|
|
+static int HasNoPrivateKey(const RSA* rsa);
|
|
|
|
EVP_PKEY* CryptoNative_RsaGenerateKey(int keySize)
|
|
{
|
|
@@ -86,7 +86,7 @@ int32_t CryptoNative_RsaDecrypt(EVP_PKEY* pkey,
|
|
|
|
// This check may no longer be needed on OpenSSL 3.0
|
|
{
|
|
- RSA* rsa = EVP_PKEY_get0_RSA(pkey);
|
|
+ const RSA* rsa = EVP_PKEY_get0_RSA(pkey);
|
|
|
|
if (rsa == NULL || HasNoPrivateKey(rsa))
|
|
{
|
|
@@ -161,7 +161,7 @@ int32_t CryptoNative_RsaSignHash(EVP_PKEY* pkey,
|
|
|
|
// This check may no longer be needed on OpenSSL 3.0
|
|
{
|
|
- RSA* rsa = EVP_PKEY_get0_RSA(pkey);
|
|
+ const RSA* rsa = EVP_PKEY_get0_RSA(pkey);
|
|
|
|
if (rsa == NULL || HasNoPrivateKey(rsa))
|
|
{
|
|
@@ -196,7 +196,7 @@ int32_t CryptoNative_EvpPkeySetRsa(EVP_PKEY* pkey, RSA* rsa)
|
|
return EVP_PKEY_set1_RSA(pkey, rsa);
|
|
}
|
|
|
|
-static int HasNoPrivateKey(RSA* rsa)
|
|
+static int HasNoPrivateKey(const RSA* rsa)
|
|
{
|
|
if (rsa == NULL)
|
|
return 1;
|
|
diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.c b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.c
|
|
index 5dd31d0e62..0554c8d3e8 100644
|
|
--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.c
|
|
+++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.c
|
|
@@ -33,7 +33,6 @@ c_static_assert(PAL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY == X509_V_ERR_U
|
|
c_static_assert(PAL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
|
|
c_static_assert(PAL_X509_V_ERR_CERT_CHAIN_TOO_LONG == X509_V_ERR_CERT_CHAIN_TOO_LONG);
|
|
c_static_assert(PAL_X509_V_ERR_CERT_REVOKED == X509_V_ERR_CERT_REVOKED);
|
|
-c_static_assert(PAL_X509_V_ERR_INVALID_CA == X509_V_ERR_INVALID_CA);
|
|
c_static_assert(PAL_X509_V_ERR_PATH_LENGTH_EXCEEDED == X509_V_ERR_PATH_LENGTH_EXCEEDED);
|
|
c_static_assert(PAL_X509_V_ERR_INVALID_PURPOSE == X509_V_ERR_INVALID_PURPOSE);
|
|
c_static_assert(PAL_X509_V_ERR_CERT_UNTRUSTED == X509_V_ERR_CERT_UNTRUSTED);
|
|
@@ -48,6 +47,26 @@ c_static_assert(PAL_X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE == X509_V_ERR_KEYUS
|
|
c_static_assert(PAL_X509_V_ERR_INVALID_EXTENSION == X509_V_ERR_INVALID_EXTENSION);
|
|
c_static_assert(PAL_X509_V_ERR_INVALID_POLICY_EXTENSION == X509_V_ERR_INVALID_POLICY_EXTENSION);
|
|
c_static_assert(PAL_X509_V_ERR_NO_EXPLICIT_POLICY == X509_V_ERR_NO_EXPLICIT_POLICY);
|
|
+c_static_assert(PAL_X509_V_ERR_DIFFERENT_CRL_SCOPE == X509_V_ERR_DIFFERENT_CRL_SCOPE);
|
|
+c_static_assert(PAL_X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE == X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE);
|
|
+c_static_assert(PAL_X509_V_ERR_UNNESTED_RESOURCE == X509_V_ERR_UNNESTED_RESOURCE);
|
|
+c_static_assert(PAL_X509_V_ERR_PERMITTED_VIOLATION == X509_V_ERR_PERMITTED_VIOLATION);
|
|
+c_static_assert(PAL_X509_V_ERR_EXCLUDED_VIOLATION == X509_V_ERR_EXCLUDED_VIOLATION);
|
|
+c_static_assert(PAL_X509_V_ERR_SUBTREE_MINMAX == X509_V_ERR_SUBTREE_MINMAX);
|
|
+c_static_assert(PAL_X509_V_ERR_APPLICATION_VERIFICATION == X509_V_ERR_APPLICATION_VERIFICATION);
|
|
+c_static_assert(PAL_X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE == X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE);
|
|
+c_static_assert(PAL_X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX == X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX);
|
|
+c_static_assert(PAL_X509_V_ERR_UNSUPPORTED_NAME_SYNTAX == X509_V_ERR_UNSUPPORTED_NAME_SYNTAX);
|
|
+c_static_assert(PAL_X509_V_ERR_CRL_PATH_VALIDATION_ERROR == X509_V_ERR_CRL_PATH_VALIDATION_ERROR);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_INVALID_VERSION == X509_V_ERR_SUITE_B_INVALID_VERSION);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_INVALID_ALGORITHM == X509_V_ERR_SUITE_B_INVALID_ALGORITHM);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_INVALID_CURVE == X509_V_ERR_SUITE_B_INVALID_CURVE);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM == X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED == X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED);
|
|
+c_static_assert(PAL_X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 == X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256);
|
|
+c_static_assert(PAL_X509_V_ERR_HOSTNAME_MISMATCH == X509_V_ERR_HOSTNAME_MISMATCH);
|
|
+c_static_assert(PAL_X509_V_ERR_EMAIL_MISMATCH == X509_V_ERR_EMAIL_MISMATCH);
|
|
+c_static_assert(PAL_X509_V_ERR_IP_ADDRESS_MISMATCH == X509_V_ERR_IP_ADDRESS_MISMATCH);
|
|
|
|
EVP_PKEY* CryptoNative_GetX509EvpPublicKey(X509* x509)
|
|
{
|
|
@@ -1109,7 +1128,10 @@ CryptoNative_X509ChainVerifyOcsp(X509_STORE_CTX* storeCtx, OCSP_REQUEST* req, OC
|
|
|
|
if (bio != NULL)
|
|
{
|
|
+#pragma clang diagnostic push
|
|
+#pragma clang diagnostic ignored "-Wcast-qual"
|
|
if (i2d_OCSP_RESPONSE_bio(bio, resp))
|
|
+#pragma clang diagnostic pop
|
|
{
|
|
clearErr = 0;
|
|
}
|
|
diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.h b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.h
|
|
index 7f242b4c2e..f7114e9642 100644
|
|
--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.h
|
|
+++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_x509.h
|
|
@@ -18,7 +18,10 @@ typedef enum {
|
|
/*
|
|
The error codes used when verifying X509 certificate chains.
|
|
|
|
-These values should be kept in sync with Interop.Crypto.X509VerifyStatusCode.
|
|
+These values should be kept in sync with Interop.Crypto.X509VerifyStatusCodeUniversal.
|
|
+
|
|
+Codes specific to specific versions of OpenSSL can also be returned,
|
|
+but are not represented in this enum due to their non-constant nature.
|
|
*/
|
|
typedef enum {
|
|
PAL_X509_V_OK = 0,
|
|
@@ -43,7 +46,9 @@ typedef enum {
|
|
PAL_X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE = 21,
|
|
PAL_X509_V_ERR_CERT_CHAIN_TOO_LONG = 22,
|
|
PAL_X509_V_ERR_CERT_REVOKED = 23,
|
|
- PAL_X509_V_ERR_INVALID_CA = 24,
|
|
+
|
|
+ // Code 24 varies
|
|
+
|
|
PAL_X509_V_ERR_PATH_LENGTH_EXCEEDED = 25,
|
|
PAL_X509_V_ERR_INVALID_PURPOSE = 26,
|
|
PAL_X509_V_ERR_CERT_UNTRUSTED = 27,
|
|
@@ -58,6 +63,26 @@ typedef enum {
|
|
PAL_X509_V_ERR_INVALID_EXTENSION = 41,
|
|
PAL_X509_V_ERR_INVALID_POLICY_EXTENSION = 42,
|
|
PAL_X509_V_ERR_NO_EXPLICIT_POLICY = 43,
|
|
+ PAL_X509_V_ERR_DIFFERENT_CRL_SCOPE = 44,
|
|
+ PAL_X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE = 45,
|
|
+ PAL_X509_V_ERR_UNNESTED_RESOURCE = 46,
|
|
+ PAL_X509_V_ERR_PERMITTED_VIOLATION = 47,
|
|
+ PAL_X509_V_ERR_EXCLUDED_VIOLATION = 48,
|
|
+ PAL_X509_V_ERR_SUBTREE_MINMAX = 49,
|
|
+ PAL_X509_V_ERR_APPLICATION_VERIFICATION = 50,
|
|
+ PAL_X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE = 51,
|
|
+ PAL_X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX = 52,
|
|
+ PAL_X509_V_ERR_UNSUPPORTED_NAME_SYNTAX = 53,
|
|
+ PAL_X509_V_ERR_CRL_PATH_VALIDATION_ERROR = 54,
|
|
+ PAL_X509_V_ERR_SUITE_B_INVALID_VERSION = 56,
|
|
+ PAL_X509_V_ERR_SUITE_B_INVALID_ALGORITHM = 57,
|
|
+ PAL_X509_V_ERR_SUITE_B_INVALID_CURVE = 58,
|
|
+ PAL_X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM = 59,
|
|
+ PAL_X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED = 60,
|
|
+ PAL_X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 = 61,
|
|
+ PAL_X509_V_ERR_HOSTNAME_MISMATCH = 62,
|
|
+ PAL_X509_V_ERR_EMAIL_MISMATCH = 63,
|
|
+ PAL_X509_V_ERR_IP_ADDRESS_MISMATCH = 64,
|
|
} X509VerifyStatusCode;
|
|
|
|
typedef int32_t (*X509StoreVerifyCallback)(int32_t, X509_STORE_CTX*);
|
|
diff --git a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/OpenSslX509ChainProcessor.cs b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/OpenSslX509ChainProcessor.cs
|
|
index d28286f016..a7f777261e 100644
|
|
--- a/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/OpenSslX509ChainProcessor.cs
|
|
+++ b/src/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Unix/OpenSslX509ChainProcessor.cs
|
|
@@ -13,10 +13,14 @@
|
|
using System.Security.Cryptography.X509Certificates.Asn1;
|
|
using Microsoft.Win32.SafeHandles;
|
|
|
|
+using X509VerifyStatusCodeUniversal = Interop.Crypto.X509VerifyStatusCodeUniversal;
|
|
+
|
|
namespace Internal.Cryptography.Pal
|
|
{
|
|
internal sealed class OpenSslX509ChainProcessor : IChainPal
|
|
{
|
|
+ private delegate X509ChainStatusFlags MapVersionSpecificCode(Interop.Crypto.X509VerifyStatusCode code);
|
|
+
|
|
// The average chain is 3 (End-Entity, Intermediate, Root)
|
|
// 10 is plenty big.
|
|
private const int DefaultChainCapacity = 10;
|
|
@@ -30,6 +34,8 @@ internal sealed class OpenSslX509ChainProcessor : IChainPal
|
|
private static readonly CachedDirectoryStoreProvider s_userPersonalStore =
|
|
new CachedDirectoryStoreProvider(X509Store.MyStoreName);
|
|
|
|
+ private static readonly MapVersionSpecificCode s_mapVersionSpecificCode = GetVersionLookup();
|
|
+
|
|
private SafeX509Handle _leafHandle;
|
|
private SafeX509StoreHandle _store;
|
|
private readonly SafeX509StackHandle _untrustedLookup;
|
|
@@ -156,10 +162,10 @@ internal Interop.Crypto.X509VerifyStatusCode FindFirstChain(X509Certificate2Coll
|
|
|
|
internal static bool IsCompleteChain(Interop.Crypto.X509VerifyStatusCode statusCode)
|
|
{
|
|
- switch (statusCode)
|
|
+ switch (statusCode.UniversalCode)
|
|
{
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
|
return false;
|
|
default:
|
|
return true;
|
|
@@ -173,7 +179,7 @@ internal static bool IsCompleteChain(Interop.Crypto.X509VerifyStatusCode statusC
|
|
SafeX509StoreCtxHandle storeCtx = _storeCtx;
|
|
|
|
Interop.Crypto.X509VerifyStatusCode statusCode =
|
|
- Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
|
|
+ X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
|
|
|
|
while (!IsCompleteChain(statusCode))
|
|
{
|
|
@@ -426,7 +432,7 @@ private Interop.Crypto.X509VerifyStatusCode CheckOcsp()
|
|
Interop.Crypto.X509VerifyStatusCode status =
|
|
Interop.Crypto.X509ChainGetCachedOcspStatus(_storeCtx, ocspCache);
|
|
|
|
- if (status != Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_CRL)
|
|
+ if (status != X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_CRL)
|
|
{
|
|
return status;
|
|
}
|
|
@@ -468,7 +474,7 @@ private Interop.Crypto.X509VerifyStatusCode CheckOcsp()
|
|
{
|
|
if (resp == null || resp.IsInvalid)
|
|
{
|
|
- return Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_CRL;
|
|
+ return X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_CRL;
|
|
}
|
|
|
|
try
|
|
@@ -744,77 +750,111 @@ private static void AddUniqueStatus(IList<X509ChainStatus> list, ref X509ChainSt
|
|
|
|
private static X509ChainStatusFlags MapVerifyErrorToChainStatus(Interop.Crypto.X509VerifyStatusCode code)
|
|
{
|
|
- switch (code)
|
|
+ switch (code.UniversalCode)
|
|
{
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_OK:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_OK:
|
|
return X509ChainStatusFlags.NoError;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_NOT_YET_VALID:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_HAS_EXPIRED:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_NOT_YET_VALID:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_HAS_EXPIRED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
|
|
return X509ChainStatusFlags.NotTimeValid;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_REVOKED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_REVOKED:
|
|
return X509ChainStatusFlags.Revoked;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_SIGNATURE_FAILURE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_SIGNATURE_FAILURE:
|
|
return X509ChainStatusFlags.NotSignatureValid;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_UNTRUSTED:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_UNTRUSTED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
|
|
return X509ChainStatusFlags.UntrustedRoot;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CRL_HAS_EXPIRED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CRL_HAS_EXPIRED:
|
|
return X509ChainStatusFlags.OfflineRevocation;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CRL_NOT_YET_VALID:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CRL_SIGNATURE_FAILURE:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_CRL:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CRL_NOT_YET_VALID:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CRL_SIGNATURE_FAILURE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_CRL:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
|
|
return X509ChainStatusFlags.RevocationStatusUnknown;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_INVALID_EXTENSION:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_INVALID_EXTENSION:
|
|
return X509ChainStatusFlags.InvalidExtension;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
|
|
return X509ChainStatusFlags.PartialChain;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_INVALID_PURPOSE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_INVALID_PURPOSE:
|
|
return X509ChainStatusFlags.NotValidForUsage;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_INVALID_CA:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_INVALID_NON_CA:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_PATH_LENGTH_EXCEEDED:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_INVALID_NON_CA:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_PATH_LENGTH_EXCEEDED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
|
|
return X509ChainStatusFlags.InvalidBasicConstraints;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_INVALID_POLICY_EXTENSION:
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_NO_EXPLICIT_POLICY:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_INVALID_POLICY_EXTENSION:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_NO_EXPLICIT_POLICY:
|
|
return X509ChainStatusFlags.InvalidPolicyConstraints;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_REJECTED:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_REJECTED:
|
|
return X509ChainStatusFlags.ExplicitDistrust;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
|
|
return X509ChainStatusFlags.HasNotSupportedCriticalExtension;
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_CHAIN_TOO_LONG:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_CHAIN_TOO_LONG:
|
|
throw new CryptographicException();
|
|
|
|
- case Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_OUT_OF_MEM:
|
|
+ case X509VerifyStatusCodeUniversal.X509_V_ERR_OUT_OF_MEM:
|
|
throw new OutOfMemoryException();
|
|
|
|
+ default:
|
|
+ return s_mapVersionSpecificCode(code);
|
|
+ }
|
|
+ }
|
|
+
|
|
+ private static X509ChainStatusFlags MapOpenSsl30Code(Interop.Crypto.X509VerifyStatusCode code)
|
|
+ {
|
|
+ switch (code.Code30)
|
|
+ {
|
|
+ case Interop.Crypto.X509VerifyStatusCode30.X509_V_ERR_INVALID_CA:
|
|
+ return X509ChainStatusFlags.InvalidBasicConstraints;
|
|
+ default:
|
|
+ Debug.Fail("Unrecognized X509VerifyStatusCode:" + code);
|
|
+ throw new CryptographicException();
|
|
+ }
|
|
+ }
|
|
+
|
|
+ private static X509ChainStatusFlags MapOpenSsl102Code(Interop.Crypto.X509VerifyStatusCode code)
|
|
+ {
|
|
+ switch (code.Code102)
|
|
+ {
|
|
+ case Interop.Crypto.X509VerifyStatusCode102.X509_V_ERR_INVALID_CA:
|
|
+ return X509ChainStatusFlags.InvalidBasicConstraints;
|
|
+ default:
|
|
+ Debug.Fail("Unrecognized X509VerifyStatusCode:" + code);
|
|
+ throw new CryptographicException();
|
|
+ }
|
|
+ }
|
|
+
|
|
+ private static X509ChainStatusFlags MapOpenSsl111Code(Interop.Crypto.X509VerifyStatusCode code)
|
|
+ {
|
|
+ switch (code.Code111)
|
|
+ {
|
|
+ case Interop.Crypto.X509VerifyStatusCode111.X509_V_ERR_INVALID_CA:
|
|
+ return X509ChainStatusFlags.InvalidBasicConstraints;
|
|
default:
|
|
Debug.Fail("Unrecognized X509VerifyStatusCode:" + code);
|
|
throw new CryptographicException();
|
|
@@ -969,7 +1009,7 @@ internal int VerifyCallback(int ok, IntPtr ctx)
|
|
int errorDepth = Interop.Crypto.X509StoreCtxGetErrorDepth(storeCtx);
|
|
|
|
if (AbortOnSignatureError &&
|
|
- errorCode == Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CERT_SIGNATURE_FAILURE)
|
|
+ errorCode == X509VerifyStatusCodeUniversal.X509_V_ERR_CERT_SIGNATURE_FAILURE)
|
|
{
|
|
AbortedForSignatureError = true;
|
|
return 0;
|
|
@@ -979,9 +1019,9 @@ internal int VerifyCallback(int ok, IntPtr ctx)
|
|
// * For compatibility with Windows / .NET Framework, do not report X509_V_CRL_NOT_YET_VALID.
|
|
// * X509_V_ERR_DIFFERENT_CRL_SCOPE will result in X509_V_ERR_UNABLE_TO_GET_CRL
|
|
// which will trigger OCSP, so is ignorable.
|
|
- if (errorCode != Interop.Crypto.X509VerifyStatusCode.X509_V_OK &&
|
|
- errorCode != Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_CRL_NOT_YET_VALID &&
|
|
- errorCode != Interop.Crypto.X509VerifyStatusCode.X509_V_ERR_DIFFERENT_CRL_SCOPE)
|
|
+ if (errorCode != X509VerifyStatusCodeUniversal.X509_V_OK &&
|
|
+ errorCode != X509VerifyStatusCodeUniversal.X509_V_ERR_CRL_NOT_YET_VALID &&
|
|
+ errorCode != X509VerifyStatusCodeUniversal.X509_V_ERR_DIFFERENT_CRL_SCOPE)
|
|
{
|
|
if (_errors == null)
|
|
{
|
|
@@ -1016,6 +1056,23 @@ internal int VerifyCallback(int ok, IntPtr ctx)
|
|
}
|
|
}
|
|
|
|
+ private static MapVersionSpecificCode GetVersionLookup()
|
|
+ {
|
|
+ // 3.0+ are M_NN_00_PP_p (Major, Minor, 0, Patch, Preview)
|
|
+ // 1.x.y are 1_XX_YY_PP_p
|
|
+ if (SafeEvpPKeyHandle.OpenSslVersion >= 0x3_00_00_00_0)
|
|
+ {
|
|
+ return MapOpenSsl30Code;
|
|
+ }
|
|
+
|
|
+ if (SafeEvpPKeyHandle.OpenSslVersion >= 0x1_01_01_00_0)
|
|
+ {
|
|
+ return MapOpenSsl111Code;
|
|
+ }
|
|
+
|
|
+ return MapOpenSsl102Code;
|
|
+ }
|
|
+
|
|
private unsafe struct ErrorCollection
|
|
{
|
|
// As of OpenSSL 1.1.1 there are 75 defined X509_V_ERR values,
|
|
@@ -1059,7 +1116,7 @@ public Enumerator GetEnumerator()
|
|
|
|
private static int FindBucket(Interop.Crypto.X509VerifyStatusCode statusCode, out int bitValue)
|
|
{
|
|
- int val = (int)statusCode;
|
|
+ int val = statusCode.Code;
|
|
|
|
int bucket;
|
|
|
|
--
|
|
2.31.1
|
|
|