Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update, add TLS 1.3 session time configuration.

Browse Source
This commit is contained in:
Hakase
2019-04-13 23:25:53 +09:00
parent 48ec086472
commit 704c3822e0
166 changed files with 3539 additions and 1083 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/ecparam.c
+17 -2
View File
@@ -30,7 +30,7 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE,
OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
OPT_R_ENUM
} OPTION_CHOICE;
@@ -43,6 +43,8 @@ const OPTIONS ecparam_options[] = {
{"text", OPT_TEXT, '-', "Print the ec parameters in text form"},
{"C", OPT_C, '-', "Print a 'C' function creating the parameters"},
{"check", OPT_CHECK, '-', "Validate the ec parameters"},
{"check_named", OPT_CHECK_NAMED, '-',
"Check that named EC curve parameters have not been modified"},
{"list_curves", OPT_LIST_CURVES, '-',
"Prints a list of all curve 'short names'"},
{"no_seed", OPT_NO_SEED, '-',
@@ -90,7 +92,7 @@ int ecparam_main(int argc, char **argv)
int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
int ret = 1, private = 0;
int list_curves = 0, no_seed = 0, check = 0, new_form = 0;
int text = 0, i, genkey = 0;
int text = 0, i, genkey = 0, check_named = 0;
prog = opt_init(argc, argv, ecparam_options);
while ((o = opt_next()) != OPT_EOF) {
@@ -127,6 +129,9 @@ int ecparam_main(int argc, char **argv)
case OPT_CHECK:
check = 1;
break;
case OPT_CHECK_NAMED:
check_named = 1;
break;
case OPT_LIST_CURVES:
list_curves = 1;
break;
@@ -266,6 +271,16 @@ int ecparam_main(int argc, char **argv)
goto end;
}
if (check_named) {
BIO_printf(bio_err, "validating named elliptic curve parameters: ");
if (EC_GROUP_check_named_curve(group, 0) <= 0) {
BIO_printf(bio_err, "failed\n");
ERR_print_errors(bio_err);
goto end;
}
BIO_printf(bio_err, "ok\n");
}
if (check) {
BIO_printf(bio_err, "checking elliptic curve parameters: ");
if (!EC_GROUP_check(group, NULL)) {
apps/enc.c
+1 -1
View File
@@ -500,7 +500,7 @@ int enc_main(int argc, char **argv)
if (hiv != NULL) {
int siz = EVP_CIPHER_iv_length(cipher);
if (siz == 0) {
BIO_printf(bio_err, "warning: iv not use by this cipher\n");
BIO_printf(bio_err, "warning: iv not used by this cipher\n");
} else if (!set_hex(hiv, iv, siz)) {
BIO_printf(bio_err, "invalid hex iv value\n");
goto end;
apps/include/fmt.h
+2 -2
View File
@@ -32,8 +32,8 @@
# define FORMAT_PKCS12 6
# define FORMAT_SMIME (7 | B_FORMAT_TEXT)
# define FORMAT_ENGINE 8 /* Not really a file format */
# define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPubicKey format */
# define FORMAT_ASN1RSA 10 /* DER RSAPubicKey format */
# define FORMAT_PEMRSA (9 | B_FORMAT_TEXT) /* PEM RSAPublicKey format */
# define FORMAT_ASN1RSA 10 /* DER RSAPublicKey format */
# define FORMAT_MSBLOB 11 /* MS Key blob format */
# define FORMAT_PVK 12 /* MS PVK file format */
# define FORMAT_HTTP 13 /* Download using HTTP */
apps/ocsp.c
+27 -7
View File
@@ -99,7 +99,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
EVP_PKEY *rkey, const EVP_MD *md,
STACK_OF(OPENSSL_STRING) *sigopts,
STACK_OF(X509) *rother, unsigned long flags,
int nmin, int ndays, int badsig);
int nmin, int ndays, int badsig,
const EVP_MD *resp_md);
static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
static BIO *init_responder(const char *port);
@@ -138,6 +139,7 @@ typedef enum OPTION_choice {
OPT_RESPOUT, OPT_PATH, OPT_ISSUER, OPT_CERT, OPT_SERIAL,
OPT_INDEX, OPT_CA, OPT_NMIN, OPT_REQUEST, OPT_NDAYS, OPT_RSIGNER,
OPT_RKEY, OPT_ROTHER, OPT_RMD, OPT_RSIGOPT, OPT_HEADER,
OPT_RCID,
OPT_V_ENUM,
OPT_MD,
OPT_MULTI
@@ -220,6 +222,7 @@ const OPTIONS ocsp_options[] = {
{"rmd", OPT_RMD, 's', "Digest Algorithm to use in signature of OCSP response"},
{"rsigopt", OPT_RSIGOPT, 's', "OCSP response signature parameter in n:v form"},
{"header", OPT_HEADER, 's', "key=value header to add"},
{"rcid", OPT_RCID, 's', "Use specified algorithm for cert id in response"},
{"", OPT_MD, '-', "Any supported digest algorithm (sha1,sha256, ... )"},
OPT_V_OPTIONS,
{NULL}
@@ -243,6 +246,7 @@ int ocsp_main(int argc, char **argv)
STACK_OF(X509) *issuers = NULL;
X509 *issuer = NULL, *cert = NULL;
STACK_OF(X509) *rca_cert = NULL;
const EVP_MD *resp_certid_md = NULL;
X509 *signer = NULL, *rsigner = NULL;
X509_STORE *store = NULL;
X509_VERIFY_PARAM *vpm = NULL;
@@ -499,6 +503,11 @@ int ocsp_main(int argc, char **argv)
if (!X509V3_add_value(header, value, &headers))
goto end;
break;
case OPT_RCID:
resp_certid_md = EVP_get_digestbyname(opt_arg());
if (resp_certid_md == NULL)
goto opthelp;
break;
case OPT_MD:
if (trailing_md) {
BIO_printf(bio_err,
@@ -684,7 +693,8 @@ redo_accept:
if (rdb != NULL) {
make_ocsp_response(bio_err, &resp, req, rdb, rca_cert, rsigner, rkey,
rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig);
rsign_md, rsign_sigopts, rother, rflags, nmin, ndays, badsig,
resp_certid_md);
if (cbio != NULL)
send_ocsp_response(cbio, resp);
} else if (host != NULL) {
@@ -1138,7 +1148,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
EVP_PKEY *rkey, const EVP_MD *rmd,
STACK_OF(OPENSSL_STRING) *sigopts,
STACK_OF(X509) *rother, unsigned long flags,
int nmin, int ndays, int badsig)
int nmin, int ndays, int badsig,
const EVP_MD *resp_md)
{
ASN1_TIME *thisupd = NULL, *nextupd = NULL;
OCSP_CERTID *cid;
@@ -1169,6 +1180,8 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
int found = 0;
ASN1_OBJECT *cert_id_md_oid;
const EVP_MD *cert_id_md;
OCSP_CERTID *cid_resp_md = NULL;
one = OCSP_request_onereq_get0(req, i);
cid = OCSP_onereq_get0_id(one);
@@ -1184,11 +1197,18 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
X509 *ca_cert = sk_X509_value(ca, jj);
OCSP_CERTID *ca_id = OCSP_cert_to_id(cert_id_md, NULL, ca_cert);
if (OCSP_id_issuer_cmp(ca_id, cid) == 0)
if (OCSP_id_issuer_cmp(ca_id, cid) == 0) {
found = 1;
if (resp_md != NULL)
cid_resp_md = OCSP_cert_to_id(resp_md, NULL, ca_cert);
}
OCSP_CERTID_free(ca_id);
}
OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
inf = lookup_serial(db, serial);
/* at this point, we can have cid be an alias of cid_resp_md */
cid = (cid_resp_md != NULL) ? cid_resp_md : cid;
if (!found) {
OCSP_basic_add1_status(bs, cid,
@@ -1196,8 +1216,6 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
0, NULL, thisupd, nextupd);
continue;
}
OCSP_id_get0_info(NULL, NULL, NULL, &serial, cid);
inf = lookup_serial(db, serial);
if (inf == NULL) {
OCSP_basic_add1_status(bs, cid,
V_OCSP_CERTSTATUS_UNKNOWN,
@@ -1212,6 +1230,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
ASN1_GENERALIZEDTIME *invtm = NULL;
OCSP_SINGLERESP *single;
int reason = -1;
unpack_revinfo(&revtm, &reason, &inst, &invtm, inf[DB_rev_date]);
single = OCSP_basic_add1_status(bs, cid,
V_OCSP_CERTSTATUS_REVOKED,
@@ -1227,6 +1246,7 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
ASN1_TIME_free(revtm);
ASN1_GENERALIZEDTIME_free(invtm);
}
OCSP_CERTID_free(cid_resp_md);
}
OCSP_copy_nonce(bs, req);
apps/pkeyutl.c
+2 -2
View File
@@ -688,7 +688,7 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx,
if (filesize < 0) {
BIO_printf(bio_err,
"Error: unable to determine file size for oneshot operation\n");
return rv;
goto end;
}
mbuf = app_malloc(filesize, "oneshot sign/verify buffer");
switch(pkey_op) {
@@ -717,7 +717,6 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx,
}
break;
}
OPENSSL_free(mbuf);
goto end;
}
@@ -767,6 +766,7 @@ static int do_raw_keyop(int pkey_op, EVP_PKEY_CTX *ctx,
}
end:
OPENSSL_free(mbuf);
EVP_MD_CTX_free(mctx);
return rv;
}
apps/s_client.c
+3 -1
View File
@@ -2277,7 +2277,7 @@ int s_client_main(int argc, char **argv)
do {
mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
}
while (mbuf_len > 3 && mbuf[3] == '-');
while (mbuf_len > 3 && (!isdigit(mbuf[0]) || !isdigit(mbuf[1]) || !isdigit(mbuf[2]) || mbuf[3] != ' '));
(void)BIO_flush(fbio);
BIO_pop(fbio);
BIO_free(fbio);
@@ -3313,6 +3313,8 @@ static void print_stuff(BIO *bio, SSL *s, int full)
#ifndef OPENSSL_NO_KTLS
if (BIO_get_ktls_send(SSL_get_wbio(s)))
BIO_printf(bio_err, "Using Kernel TLS for sending\n");
if (BIO_get_ktls_recv(SSL_get_rbio(s)))
BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
#endif
if (OSSL_TRACE_ENABLED(TLS)) {
apps/s_server.c
+2
View File
@@ -2921,6 +2921,8 @@ static void print_connection_info(SSL *con)
#ifndef OPENSSL_NO_KTLS
if (BIO_get_ktls_send(SSL_get_wbio(con)))
BIO_printf(bio_err, "Using Kernel TLS for sending\n");
if (BIO_get_ktls_recv(SSL_get_rbio(con)))
BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
#endif
(void)BIO_flush(bio_s_out);
apps/speed.c
+94 -5
View File
@@ -57,6 +57,9 @@
# include <openssl/md5.h>
#endif
#include <openssl/hmac.h>
#ifndef OPENSSL_NO_CMAC
#include <openssl/cmac.h>
#endif
#include <openssl/sha.h>
#ifndef OPENSSL_NO_RMD160
# include <openssl/ripemd.h>
@@ -163,10 +166,12 @@ static int DES_ede3_cbc_encrypt_loop(void *args);
#endif
static int AES_cbc_128_encrypt_loop(void *args);
static int AES_cbc_192_encrypt_loop(void *args);
static int AES_ige_128_encrypt_loop(void *args);
static int AES_cbc_256_encrypt_loop(void *args);
#if !OPENSSL_API_3
static int AES_ige_128_encrypt_loop(void *args);
static int AES_ige_192_encrypt_loop(void *args);
static int AES_ige_256_encrypt_loop(void *args);
#endif
static int CRYPTO_gcm128_aad_loop(void *args);
static int RAND_bytes_loop(void *args);
static int EVP_Update_loop(void *args);
@@ -300,7 +305,7 @@ typedef enum OPTION_choice {
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI,
OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM,
OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD
OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC
} OPTION_CHOICE;
const OPTIONS speed_options[] = {
@@ -309,6 +314,9 @@ const OPTIONS speed_options[] = {
{"help", OPT_HELP, '-', "Display this summary"},
{"evp", OPT_EVP, 's', "Use EVP-named cipher or digest"},
{"hmac", OPT_HMAC, 's', "HMAC using EVP-named digest"},
#ifndef OPENSSL_NO_CMAC
{"cmac", OPT_CMAC, 's', "CMAC using EVP-named cipher"},
#endif
{"decrypt", OPT_DECRYPT, '-',
"Time decryption instead of encryption (only EVP)"},
{"aead", OPT_AEAD, '-',
@@ -371,6 +379,7 @@ const OPTIONS speed_options[] = {
#define D_GHASH 29
#define D_RAND 30
#define D_EVP_HMAC 31
#define D_EVP_CMAC 32
/* name of algorithms to test */
static const char *names[] = {
@@ -381,7 +390,7 @@ static const char *names[] = {
"camellia-128 cbc", "camellia-192 cbc", "camellia-256 cbc",
"evp", "sha256", "sha512", "whirlpool",
"aes-128 ige", "aes-192 ige", "aes-256 ige", "ghash",
"rand", "hmac"
"rand", "hmac", "cmac"
};
#define ALGOR_NUM OSSL_NELEM(names)
@@ -421,9 +430,11 @@ static const OPT_PAIR doit_choices[] = {
{"aes-128-cbc", D_CBC_128_AES},
{"aes-192-cbc", D_CBC_192_AES},
{"aes-256-cbc", D_CBC_256_AES},
#if !OPENSSL_API_3
{"aes-128-ige", D_IGE_128_AES},
{"aes-192-ige", D_IGE_192_AES},
{"aes-256-ige", D_IGE_256_AES},
#endif
#ifndef OPENSSL_NO_RC2
{"rc2-cbc", D_CBC_RC2},
{"rc2", D_CBC_RC2},
@@ -629,6 +640,9 @@ typedef struct loopargs_st {
#endif
EVP_CIPHER_CTX *ctx;
HMAC_CTX *hctx;
#ifndef OPENSSL_NO_CMAC
CMAC_CTX *cmac_ctx;
#endif
GCM128_CONTEXT *gcm_ctx;
} loopargs_t;
static int run_benchmark(int async_jobs, int (*loop_function) (void *),
@@ -859,6 +873,7 @@ static int AES_cbc_256_encrypt_loop(void *args)
return count;
}
#if !OPENSSL_API_3
static int AES_ige_128_encrypt_loop(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
@@ -894,6 +909,7 @@ static int AES_ige_256_encrypt_loop(void *args)
(size_t)lengths[testnum], &aes_ks3, iv, AES_ENCRYPT);
return count;
}
#endif
static int CRYPTO_gcm128_aad_loop(void *args)
{
@@ -1064,6 +1080,33 @@ static int EVP_HMAC_loop(void *args)
return count;
}
#ifndef OPENSSL_NO_CMAC
static const EVP_CIPHER *evp_cmac_cipher = NULL;
static char *evp_cmac_name = NULL;
static int EVP_CMAC_loop(void *args)
{
loopargs_t *tempargs = *(loopargs_t **) args;
unsigned char *buf = tempargs->buf;
CMAC_CTX *cmac_ctx = tempargs->cmac_ctx;
static const char key[16] = "This is a key...";
unsigned char mac[16];
size_t len = sizeof(mac);
int count;
#ifndef SIGALRM
int nb_iter = save_count * 4 * lengths[0] / lengths[testnum];
#endif
for (count = 0; COND(nb_iter); count++) {
if (!CMAC_Init(cmac_ctx, key, sizeof(key), evp_cmac_cipher, NULL)
|| !CMAC_Update(cmac_ctx, buf, lengths[testnum])
|| !CMAC_Final(cmac_ctx, mac, &len))
return -1;
}
return count;
}
#endif
#ifndef OPENSSL_NO_RSA
static long rsa_c[RSA_NUM][2]; /* # RSA iteration test */
@@ -1610,6 +1653,17 @@ int speed_main(int argc, char **argv)
}
doit[D_EVP_HMAC] = 1;
break;
case OPT_CMAC:
#ifndef OPENSSL_NO_CMAC
evp_cmac_cipher = EVP_get_cipherbyname(opt_arg());
if (evp_cmac_cipher == NULL) {
BIO_printf(bio_err, "%s: %s is an unknown cipher\n",
prog, opt_arg());
goto end;
}
doit[D_EVP_CMAC] = 1;
#endif
break;
case OPT_DECRYPT:
decrypt = 1;
break;
@@ -1848,9 +1902,9 @@ int speed_main(int argc, char **argv)
e = setup_engine(engine_id, 0);
/* No parameters; turn on everything. */
if (argc == 0 && !doit[D_EVP] && !doit[D_EVP_HMAC]) {
if (argc == 0 && !doit[D_EVP] && !doit[D_EVP_HMAC] && !doit[D_EVP_CMAC]) {
for (i = 0; i < ALGOR_NUM; i++)
if (i != D_EVP && i != D_EVP_HMAC)
if (i != D_EVP && i != D_EVP_HMAC && i != D_EVP_CMAC)
doit[i] = 1;
#ifndef OPENSSL_NO_RSA
for (i = 0; i < RSA_NUM; i++)
@@ -2381,6 +2435,7 @@ int speed_main(int argc, char **argv)
}
}
#if !OPENSSL_API_3
if (doit[D_IGE_128_AES]) {
for (testnum = 0; testnum < size_num; testnum++) {
print_message(names[D_IGE_128_AES], c[D_IGE_128_AES][testnum],
@@ -2414,6 +2469,7 @@ int speed_main(int argc, char **argv)
print_result(D_IGE_256_AES, testnum, count, d);
}
}
#endif
if (doit[D_GHASH]) {
for (i = 0; i < loopargs_len; i++) {
loopargs[i].gcm_ctx =
@@ -2719,6 +2775,36 @@ int speed_main(int argc, char **argv)
}
}
#ifndef OPENSSL_NO_CMAC
if (doit[D_EVP_CMAC]) {
if (evp_cmac_cipher != NULL) {
const char *cipher_name = OBJ_nid2ln(EVP_CIPHER_type(evp_cmac_cipher));
evp_cmac_name = app_malloc(sizeof("CMAC()") + strlen(cipher_name),
"CMAC name");
sprintf(evp_cmac_name, "CMAC(%s)", cipher_name);
names[D_EVP_CMAC] = evp_cmac_name;
for (i = 0; i < loopargs_len; i++) {
loopargs[i].cmac_ctx = CMAC_CTX_new();
if (loopargs[i].cmac_ctx == NULL) {
BIO_printf(bio_err, "CMAC malloc failure, exiting...");
exit(1);
}
}
for (testnum = 0; testnum < size_num; testnum++) {
print_message(names[D_EVP_CMAC], save_count, lengths[testnum],
seconds.sym);
Time_F(START);
count = run_benchmark(async_jobs, EVP_CMAC_loop, loopargs);
d = Time_F(STOP);
print_result(D_EVP_CMAC, testnum, count, d);
}
for (i = 0; i < loopargs_len; i++)
CMAC_CTX_free(loopargs[i].cmac_ctx);
}
}
#endif
for (i = 0; i < loopargs_len; i++)
if (RAND_bytes(loopargs[i].buf, 36) <= 0)
goto end;
@@ -3418,6 +3504,9 @@ int speed_main(int argc, char **argv)
#endif
}
OPENSSL_free(evp_hmac_name);
#ifndef OPENSSL_NO_CMAC
OPENSSL_free(evp_cmac_name);
#endif
if (async_jobs > 0) {
for (i = 0; i < loopargs_len; i++)
apps/verify.c
+26 -14
View File
@@ -246,27 +246,37 @@ static int check(X509_STORE *ctx, const char *file,
if (sm2id != NULL) {
#ifndef OPENSSL_NO_SM2
ASN1_OCTET_STRING v;
ASN1_OCTET_STRING *v;
v.data = sm2id;
v.length = sm2idlen;
v = ASN1_OCTET_STRING_new();
if (v == NULL) {
BIO_printf(bio_err, "error: SM2 ID allocation failed\n");
goto end;
}
X509_set_sm2_id(x, &v);
if (!ASN1_OCTET_STRING_set(v, sm2id, sm2idlen)) {
BIO_printf(bio_err, "error: setting SM2 ID failed\n");
ASN1_OCTET_STRING_free(v);
goto end;
}
X509_set0_sm2_id(x, v);
#endif
}
csc = X509_STORE_CTX_new();
if (csc == NULL) {
printf("error %s: X.509 store context allocation failed\n",
(file == NULL) ? "stdin" : file);
BIO_printf(bio_err, "error %s: X.509 store context allocation failed\n",
(file == NULL) ? "stdin" : file);
goto end;
}
X509_STORE_set_flags(ctx, vflags);
if (!X509_STORE_CTX_init(csc, ctx, x, uchain)) {
X509_STORE_CTX_free(csc);
printf("error %s: X.509 store context initialization failed\n",
(file == NULL) ? "stdin" : file);
BIO_printf(bio_err,
"error %s: X.509 store context initialization failed\n",
(file == NULL) ? "stdin" : file);
goto end;
}
if (tchain != NULL)
@@ -275,28 +285,30 @@ static int check(X509_STORE *ctx, const char *file,
X509_STORE_CTX_set0_crls(csc, crls);
i = X509_verify_cert(csc);
if (i > 0 && X509_STORE_CTX_get_error(csc) == X509_V_OK) {
printf("%s: OK\n", (file == NULL) ? "stdin" : file);
BIO_printf(bio_out, "%s: OK\n", (file == NULL) ? "stdin" : file);
ret = 1;
if (show_chain) {
int j;
chain = X509_STORE_CTX_get1_chain(csc);
num_untrusted = X509_STORE_CTX_get_num_untrusted(csc);
printf("Chain:\n");
BIO_printf(bio_out, "Chain:\n");
for (j = 0; j < sk_X509_num(chain); j++) {
X509 *cert = sk_X509_value(chain, j);
printf("depth=%d: ", j);
BIO_printf(bio_out, "depth=%d: ", j);
X509_NAME_print_ex_fp(stdout,
X509_get_subject_name(cert),
0, get_nameopt());
if (j < num_untrusted)
printf(" (untrusted)");
printf("\n");
BIO_printf(bio_out, " (untrusted)");
BIO_printf(bio_out, "\n");
}
sk_X509_pop_free(chain, X509_free);
}
} else {
printf("error %s: verification failed\n", (file == NULL) ? "stdin" : file);
BIO_printf(bio_err,
"error %s: verification failed\n",
(file == NULL) ? "stdin" : file);
}
X509_STORE_CTX_free(csc);