translation_unit
comment "/*\n * Copyright 1995-2026 The OpenSSL Project Authors. All R"...
preproc_def
#define "#define"
identifier "OPENSSL_SUPPRESS_DEPRECATED"
preproc_include
#include "#include"
string_literal
" "\""
string_content "internal/deprecated.h"
" "\""
preproc_include
#include "#include"
system_lib_string "<stdio.h>"
preproc_include
#include "#include"
system_lib_string "<time.h>"
preproc_include
#include "#include"
system_lib_string "<errno.h>"
preproc_include
#include "#include"
system_lib_string "<limits.h>"
preproc_include
#include "#include"
string_literal
" "\""
string_content "crypto/ctype.h"
" "\""
preproc_include
#include "#include"
string_literal
" "\""
string_content "internal/cryptlib.h"
" "\""
preproc_include
#include "#include"
system_lib_string "<openssl/crypto.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/buffer.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/evp.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/asn1.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/x509.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/x509v3.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/ocsp.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/objects.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/posix_time.h>"
preproc_include
#include "#include"
system_lib_string "<openssl/core_names.h>"
preproc_include
#include "#include"
string_literal
" "\""
string_content "internal/dane.h"
" "\""
preproc_include
#include "#include"
string_literal
" "\""
string_content "crypto/x509.h"
" "\""
preproc_include
#include "#include"
string_literal
" "\""
string_content "x509_local.h"
" "\""
comment "/* CRL score values */"
preproc_def
#define "#define"
identifier "CRL_SCORE_NOCRITICAL"
preproc_arg "0x100 "
comment "/* No unhandled critical extensions */"
preproc_def
#define "#define"
identifier "CRL_SCORE_SCOPE"
preproc_arg "0x080 "
comment "/* certificate is within CRL scope */"
preproc_def
#define "#define"
identifier "CRL_SCORE_TIME"
preproc_arg "0x040 "
comment "/* CRL times valid */"
preproc_def
#define "#define"
identifier "CRL_SCORE_ISSUER_NAME"
preproc_arg "0x020 "
comment "/* Issuer name matches certificate */"
preproc_def
#define "#define"
identifier "CRL_SCORE_VALID"
comment "/* If this score or above CRL is probably valid */"
preproc_arg "(CRL_SCORE_NOCRITICAL | CRL_SCORE_TIME | CRL_SCORE_SCOPE)"
preproc_def
#define "#define"
identifier "CRL_SCORE_ISSUER_CERT"
preproc_arg "0x018 "
comment "/* CRL issuer is certificate issuer */"
preproc_def
#define "#define"
identifier "CRL_SCORE_SAME_PATH"
preproc_arg "0x008 "
comment "/* CRL issuer is on certificate path */"
preproc_def
#define "#define"
identifier "CRL_SCORE_AKID"
preproc_arg "0x004 "
comment "/* CRL issuer matches CRL AKID */"
preproc_def
#define "#define"
identifier "CRL_SCORE_TIME_DELTA"
preproc_arg "0x002 "
comment "/* Have a delta CRL with valid times */"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "x509_verify_x509"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "x509_verify_rpk"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "build_chain"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "verify_chain"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "verify_rpk"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "dane_verify"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "dane_verify_rpk"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "null_callback"
parameter_list
( "("
parameter_declaration
primitive_type "int"
identifier "ok"
, ","
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "e"
) ")"
; ";"
declaration (+31 nodes collapsed)
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_extensions"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_name_constraints"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_id"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_trust"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
, ","
parameter_declaration
primitive_type "int"
identifier "num_untrusted"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_revocation"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
preproc_ifdef
#ifndef "#ifndef"
identifier "OPENSSL_NO_OCSP"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_cert_ocsp_resp"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
#endif "#endif"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_cert_crl"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_policy"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_dane_issuer"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
, ","
parameter_declaration
primitive_type "int"
identifier "depth"
) ")"
; ";"
declaration (+21 nodes collapsed)
declaration (+21 nodes collapsed)
declaration (+21 nodes collapsed)
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_curve"
parameter_list
( "("
parameter_declaration
type_identifier "X509"
pointer_declarator
* "*"
identifier "cert"
) ")"
; ";"
declaration (+43 nodes collapsed)
declaration (+37 nodes collapsed)
declaration (+46 nodes collapsed)
declaration (+35 nodes collapsed)
declaration (+33 nodes collapsed)
declaration (+21 nodes collapsed)
declaration (+37 nodes collapsed)
declaration
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "internal_verify"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
; ";"
function_definition (+25 nodes collapsed)
comment "/*-\n * Return 1 if given cert is considered self-signed, 0 i"...
function_definition (+135 nodes collapsed)
comment "/*\n * Given a certificate, try and find an exact match in th"...
function_definition (+242 nodes collapsed)
comment "/*-\n * Inform the verify callback of an error.\n * The error "...
function_definition (+129 nodes collapsed)
preproc_function_def
#define "#define"
identifier "CB_FAIL_IF"
preproc_params
( "("
identifier "cond"
, ","
identifier "ctx"
, ","
identifier "cert"
, ","
identifier "depth"
, ","
identifier "err"
) ")"
preproc_arg "if ((cond) && verify_cb_cert(ctx, cert, depth, err) == 0) \\\n"...
comment "/*-\n * Inform the verify callback of an error, CRL-specific "...
function_definition (+44 nodes collapsed)
preproc_ifdef (+49 nodes collapsed)
comment "/* Sadly, returns 0 also on internal error in ctx->verify_cb"...
function_definition (+165 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+67 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+365 nodes collapsed)
function_definition (+119 nodes collapsed)
function_definition (+71 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+133 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+243 nodes collapsed)
function_definition (+90 nodes collapsed)
comment "/*-\n * Find in |sk| an issuer cert of cert |x| accepted by |"...
comment "/*\n * Note: so far, we do not check during chain building\n *"...
function_definition (+265 nodes collapsed)
comment "/*-\n * Try to get issuer cert from |ctx->store| accepted by "...
function_definition (+322 nodes collapsed)
comment "/* Check that the given certificate |x| is issued by the cer"...
function_definition (+67 nodes collapsed)
comment "/*-\n * Alternative get_issuer method: look up from a STACK_O"...
function_definition (+90 nodes collapsed)
comment "/*-\n * Alternative lookup method: look from a STACK stored i"...
function_definition (+182 nodes collapsed)
comment "/*\n * Check EE or CA certificate purpose. For trusted certi"...
function_definition (+198 nodes collapsed)
comment "/*-\n * Check extensions of a cert chain for consistency with"...
function_definition (+1344 nodes collapsed)
function_definition (+147 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+694 nodes collapsed)
function_definition (+39 nodes collapsed)
function_definition (+194 nodes collapsed)
function_definition (+262 nodes collapsed)
function_definition (+141 nodes collapsed)
function_definition (+178 nodes collapsed)
comment "/*\n * Returns 1 is an ASN1 time is valid for an RFC5280 cert"...
function_definition (+257 nodes collapsed)
comment "/* Validate and convert certificate time to a posix time */"
function_definition (+94 nodes collapsed)
comment "/* Returns -1 on internal error */"
function_definition (+531 nodes collapsed)
comment "/* Sadly, returns 0 also on internal error. */"
function_definition (+580 nodes collapsed)
preproc_ifdef
#ifndef "#ifndef"
identifier "OPENSSL_NO_OCSP"
function_definition
storage_class_specifier
static "static"
primitive_type "int"
function_declarator
identifier "check_cert_ocsp_resp"
parameter_list
( "("
parameter_declaration
type_identifier "X509_STORE_CTX"
pointer_declarator
* "*"
identifier "ctx"
) ")"
compound_statement
{ "{"
declaration
primitive_type "int"
identifier "cert_status"
, ","
identifier "crl_reason"
; ";"
declaration
primitive_type "int"
identifier "i"
; ";"
declaration
type_identifier "OCSP_RESPONSE"
init_declarator
pointer_declarator
* "*"
identifier "resp"
= "="
null
NULL "NULL"
; ";"
declaration
type_identifier "OCSP_BASICRESP"
init_declarator
pointer_declarator
* "*"
identifier "bs"
= "="
null
NULL "NULL"
; ";"
declaration
type_identifier "OCSP_SINGLERESP"
init_declarator
pointer_declarator
* "*"
identifier "sr"
= "="
null
NULL "NULL"
; ";"
declaration
type_identifier "OCSP_CERTID"
init_declarator
pointer_declarator
* "*"
identifier "sr_cert_id"
= "="
null
NULL "NULL"
; ";"
declaration
type_identifier "ASN1_GENERALIZEDTIME"
pointer_declarator
* "*"
identifier "rev"
, ","
pointer_declarator
* "*"
identifier "thisupd"
, ","
pointer_declarator
* "*"
identifier "nextupd"
; ";"
declaration
type_identifier "ASN1_OBJECT"
pointer_declarator
* "*"
identifier "cert_id_md_oid"
; ";"
declaration
type_identifier "EVP_MD"
pointer_declarator
* "*"
identifier "cert_id_md"
; ";"
declaration
type_identifier "OCSP_CERTID"
init_declarator
pointer_declarator
* "*"
identifier "cert_id"
= "="
null
NULL "NULL"
; ";"
declaration
primitive_type "int"
init_declarator
identifier "ret"
= "="
identifier "V_OCSP_CERTSTATUS_UNKNOWN"
; ";"
declaration
primitive_type "int"
identifier "num"
; ";"
expression_statement
assignment_expression
identifier "num"
= "="
call_expression
identifier "sk_OCSP_RESPONSE_num"
argument_list
( "("
field_expression
identifier "ctx"
-> "->"
field_identifier "ocsp_resp"
) ")"
; ";"
if_statement (+22 nodes collapsed)
if_statement (+68 nodes collapsed)
if_statement (+35 nodes collapsed)
if_statement
if "if"
parenthesized_expression
( "("
binary_expression
call_expression
identifier "OCSP_basic_verify"
argument_list
( "("
identifier "bs"
, ","
field_expression
identifier "ctx"
-> "->"
field_identifier "chain"
, ","
field_expression
identifier "ctx"
-> "->"
field_identifier "store"
, ","
identifier "OCSP_TRUSTOTHER"
) ")"
<= "<="
number_literal "0"
) ")"
compound_statement
{ "{"
expression_statement
assignment_expression
identifier "ret"
= "="
identifier "X509_V_ERR_OCSP_SIGNATURE_FAILURE"
; ";"
goto_statement
goto "goto"
statement_identifier "end"
; ";"
} "}"
comment "/* find the right single response in the OCSP response */"
for_statement (+188 nodes collapsed)
if_statement (+23 nodes collapsed)
if_statement (+49 nodes collapsed)
if_statement (+57 nodes collapsed)
labeled_statement
statement_identifier "end"
: ":"
expression_statement
call_expression
identifier "OCSP_CERTID_free"
argument_list
( "("
identifier "cert_id"
) ")"
; ";"
expression_statement
call_expression
identifier "OCSP_BASICRESP_free"
argument_list
( "("
identifier "bs"
) ")"
; ";"
return_statement
return "return"
identifier "ret"
; ";"
} "}"
#endif "#endif"
comment "/* Sadly, returns 0 also on internal error. */"
function_definition (+604 nodes collapsed)
comment "/*\n * returns 1 and sets verification time if time should be"...
function_definition (+105 nodes collapsed)
comment "/* Check CRL times against values in X509_STORE_CTX */"
function_definition (+293 nodes collapsed)
function_definition (+451 nodes collapsed)
comment "/*\n * Compare two CRL extensions for delta checking purposes"...
function_definition (+239 nodes collapsed)
comment "/* See if a base and delta are compatible */"
function_definition (+181 nodes collapsed)
comment "/*\n * For a given base CRL find a delta... maybe extend to d"...
function_definition (+240 nodes collapsed)
comment "/*\n * For a given CRL return how suitable it is for the supp"...
function_definition (+419 nodes collapsed)
function_definition (+419 nodes collapsed)
comment "/*\n * Check the path of a CRL issuer certificate. This creat"...
function_definition (+201 nodes collapsed)
comment "/*\n * RFC3280 says nothing about the relationship between CR"...
function_definition (+101 nodes collapsed)
comment "/*-\n * Check for match between two dist point names: three s"...
function_definition (+465 nodes collapsed)
function_definition (+166 nodes collapsed)
comment "/* Check CRLDP and IDP */"
function_definition (+296 nodes collapsed)
comment "/*\n * Retrieve CRL corresponding to current certificate. If "...
function_definition (+313 nodes collapsed)
comment "/* Check CRL validity */"
function_definition (+589 nodes collapsed)
comment "/* Check certificate against CRL */"
function_definition (+148 nodes collapsed)
comment "/* Sadly, returns 0 also on internal error in ctx->verify_cb"...
function_definition (+473 nodes collapsed)
comment "/*-\n * Check certificate validity times.\n *\n * Returns 1 if "...
function_definition (+254 nodes collapsed)
comment "/*-\n * Check certificate validity times.\n * If depth >= 0, i"...
function_definition (+320 nodes collapsed)
comment "/*\n * Verify the issuer signatures and cert times of ctx->ch"...
function_definition (+599 nodes collapsed)
preproc_if (+334 nodes collapsed)
comment "/* !defined(OPENSSL_NO_DEPRECATED_4_0) */"
function_definition (+36 nodes collapsed)
function_definition (+45 nodes collapsed)
function_definition (+161 nodes collapsed)
comment "/* Copy any missing public key parameters up the chain towar"...
function_definition (+278 nodes collapsed)
comment "/*\n * Make a delta CRL as the difference between two full CR"...
function_definition (+897 nodes collapsed)
function_definition (+43 nodes collapsed)
function_definition (+39 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+28 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+28 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+30 nodes collapsed)
function_definition (+31 nodes collapsed)
function_definition (+54 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+30 nodes collapsed)
function_definition (+30 nodes collapsed)
function_definition (+35 nodes collapsed)
preproc_ifdef (+39 nodes collapsed)
function_definition (+35 nodes collapsed)
function_definition (+35 nodes collapsed)
comment "/*\n * Use this function to set the X509_STORE_CTX purpose an"...
function_definition (+333 nodes collapsed)
function_definition (+130 nodes collapsed)
function_definition (+27 nodes collapsed)
function_definition (+56 nodes collapsed)
function_definition (+65 nodes collapsed)
function_definition (+1074 nodes collapsed)
comment "/*\n * Set alternative get_issuer method: just from a STACK o"...
function_definition (+53 nodes collapsed)
function_definition (+191 nodes collapsed)
function_definition (+32 nodes collapsed)
function_definition (+34 nodes collapsed)
function_definition (+38 nodes collapsed)
function_definition (+30 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+31 nodes collapsed)
function_definition (+35 nodes collapsed)
function_definition (+46 nodes collapsed)
function_definition (+28 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+28 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+28 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+24 nodes collapsed)
function_definition (+90 nodes collapsed)
function_definition (+26 nodes collapsed)
function_definition (+41 nodes collapsed)
function_definition (+30 nodes collapsed)
function_definition (+179 nodes collapsed)
preproc_def
#define "#define"
identifier "DANETLS_NONE"
preproc_arg "256 "
comment "/* impossible uint8_t */"
comment "/* Returns -1 on internal error */"
function_definition (+754 nodes collapsed)
comment "/* Returns -1 on internal error */"
function_definition (+153 nodes collapsed)
function_definition (+279 nodes collapsed)
comment "/*\n * Only DANE-EE and SPKI are supported\n * Returns -1 on i"...
function_definition (+424 nodes collapsed)
function_definition (+67 nodes collapsed)
comment "/* Sadly, returns 0 also on internal error in ctx->verify_cb"...
function_definition (+72 nodes collapsed)
comment "/* Returns -1 on internal error */"
function_definition (+130 nodes collapsed)
comment "/* Returns -1 on internal error */"
function_definition (+328 nodes collapsed)
comment "/*\n * Get trusted issuer, without duplicate suppression\n * R"...
function_definition (+93 nodes collapsed)
comment "/*-\n * Returns -1 on internal error.\n * Sadly, returns 0 als"...
function_definition (+1875 nodes collapsed)
function_definition (+360 nodes collapsed)
comment "/*\n * note that there's a corresponding minbits_table in ssl"...
declaration (+25 nodes collapsed)
declaration
storage_class_specifier
static "static"
type_qualifier
const "const"
primitive_type "int"
init_declarator
identifier "NUM_AUTH_LEVELS"
= "="
call_expression
identifier "OSSL_NELEM"
argument_list
( "("
identifier "minbits_table"
) ")"
; ";"
comment "/*-\n * Check whether the given public key meets the security"...
function_definition (+99 nodes collapsed)
comment "/*-\n * Check whether the public key of `cert` meets the secu"...
function_definition (+39 nodes collapsed)
comment "/*-\n * Check whether the public key of ``cert`` does not use"...
function_definition (+101 nodes collapsed)
comment "/*-\n * Check whether the signature digest algorithm of ``cer"...
function_definition (+115 nodes collapsed)