Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	lib/libcrypto/x509/x509_trs.c	Lines:	30	114	26.3 %
Date:	2017-11-07	Branches:	12	74	16.2 %


/* $OpenBSD: x509_trs.c,v 1.22 2017/01/29 17:49:23 beck Exp $ */
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 1999.
 */
/* ====================================================================
 * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <stdio.h>
#include <string.h>

#include <openssl/err.h>
#include <openssl/x509v3.h>

static int tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b);
static void trtable_free(X509_TRUST *p);

static int trust_1oidany(X509_TRUST *trust, X509 *x, int flags);
static int trust_1oid(X509_TRUST *trust, X509 *x, int flags);
static int trust_compat(X509_TRUST *trust, X509 *x, int flags);

static int obj_trust(int id, X509 *x, int flags);
static int (*default_trust)(int id, X509 *x, int flags) = obj_trust;

/* WARNING: the following table should be kept in order of trust
 * and without any gaps so we can just subtract the minimum trust
 * value to get an index into the table
 */

static X509_TRUST trstandard[] = {
	{X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
	{X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
	{X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
	{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
	{X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
	{X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
	{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
	{X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
};

#define X509_TRUST_COUNT	(sizeof(trstandard)/sizeof(X509_TRUST))

static STACK_OF(X509_TRUST) *trtable = NULL;

static int
tr_cmp(const X509_TRUST * const *a, const X509_TRUST * const *b)
{
	return (*a)->trust - (*b)->trust;
}

int
(*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int)
{
	int (*oldtrust)(int , X509 *, int);

	oldtrust = default_trust;
	default_trust = trust;
	return oldtrust;
}

int
X509_check_trust(X509 *x, int id, int flags)
{
	X509_TRUST *pt;
	int idx;

	if (id == -1)
		return 1;
	/*
	 * XXX beck/jsing This enables self signed certs to be trusted for
	 * an unspecified id/trust flag value (this is NOT the
	 * X509_TRUST_DEFAULT), which was the longstanding
	 * openssl behaviour. boringssl does not have this behaviour.
	 *
	 * This should be revisited, but changing the default "not default"
	 * may break things.
	 */
	if (id == 0) {
		int rv;
		rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
		if (rv != X509_TRUST_UNTRUSTED)
			return rv;
		return trust_compat(NULL, x, 0);
	}
	idx = X509_TRUST_get_by_id(id);
	if (idx == -1)
		return default_trust(id, x, flags);
	pt = X509_TRUST_get0(idx);
	return pt->check_trust(pt, x, flags);
}

int
X509_TRUST_get_count(void)
{
	if (!trtable)
		return X509_TRUST_COUNT;
	return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
}

X509_TRUST *
X509_TRUST_get0(int idx)
{
	if (idx < 0)
		return NULL;
	if (idx < (int)X509_TRUST_COUNT)
		return trstandard + idx;
	return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
}

int
X509_TRUST_get_by_id(int id)
{
	X509_TRUST tmp;
	int idx;

	if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
		return id - X509_TRUST_MIN;
	tmp.trust = id;
	if (!trtable)
		return -1;
	idx = sk_X509_TRUST_find(trtable, &tmp);
	if (idx == -1)
		return -1;
	return idx + X509_TRUST_COUNT;
}

int
X509_TRUST_set(int *t, int trust)
{
	if (X509_TRUST_get_by_id(trust) == -1) {
		X509error(X509_R_INVALID_TRUST);
		return 0;
	}
	*t = trust;
	return 1;
}

int
X509_TRUST_add(int id, int flags, int (*ck)(X509_TRUST *, X509 *, int),
    char *name, int arg1, void *arg2)
{
	int idx;
	X509_TRUST *trtmp;
	char *name_dup;

	/* This is set according to what we change: application can't set it */
	flags &= ~X509_TRUST_DYNAMIC;
	/* This will always be set for application modified trust entries */
	flags |= X509_TRUST_DYNAMIC_NAME;
	/* Get existing entry if any */
	idx = X509_TRUST_get_by_id(id);
	/* Need a new entry */
	if (idx == -1) {
		if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
			X509error(ERR_R_MALLOC_FAILURE);
			return 0;
		}
		trtmp->flags = X509_TRUST_DYNAMIC;
	} else {
		trtmp = X509_TRUST_get0(idx);
		if (trtmp == NULL) {
			X509error(X509_R_INVALID_TRUST);
			return 0;
		}
	}

	if ((name_dup = strdup(name)) == NULL)
		goto err;

	/* free existing name if dynamic */
	if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
		free(trtmp->name);
	/* dup supplied name */
	trtmp->name = name_dup;
	/* Keep the dynamic flag of existing entry */
	trtmp->flags &= X509_TRUST_DYNAMIC;
	/* Set all other flags */
	trtmp->flags |= flags;

	trtmp->trust = id;
	trtmp->check_trust = ck;
	trtmp->arg1 = arg1;
	trtmp->arg2 = arg2;

	/* If it's a new entry, manage the dynamic table */
	if (idx == -1) {
		if (trtable == NULL &&
		    (trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
			goto err;
		if (sk_X509_TRUST_push(trtable, trtmp) == 0)
			goto err;
	}
	return 1;

err:
	free(name_dup);
	if (idx == -1)
		free(trtmp);
	X509error(ERR_R_MALLOC_FAILURE);
	return 0;
}

static void
trtable_free(X509_TRUST *p)
{
	if (!p)
		return;
	if (p->flags & X509_TRUST_DYNAMIC) {
		if (p->flags & X509_TRUST_DYNAMIC_NAME)
			free(p->name);
		free(p);
	}
}

void
X509_TRUST_cleanup(void)
{
	unsigned int i;

	for (i = 0; i < X509_TRUST_COUNT; i++)
		trtable_free(trstandard + i);
	sk_X509_TRUST_pop_free(trtable, trtable_free);
	trtable = NULL;
}

int
X509_TRUST_get_flags(X509_TRUST *xp)
{
	return xp->flags;
}

char *
X509_TRUST_get0_name(X509_TRUST *xp)
{
	return xp->name;
}

int
X509_TRUST_get_trust(X509_TRUST *xp)
{
	return xp->trust;
}

static int
trust_1oidany(X509_TRUST *trust, X509 *x, int flags)
{
	if (x->aux && (x->aux->trust || x->aux->reject))
		return obj_trust(trust->arg1, x, flags);
	/* we don't have any trust settings: for compatibility
	 * we return trusted if it is self signed
	 */
	return trust_compat(trust, x, flags);
}

static int
trust_1oid(X509_TRUST *trust, X509 *x, int flags)
{
	if (x->aux)
		return obj_trust(trust->arg1, x, flags);
	return X509_TRUST_UNTRUSTED;
}

static int
trust_compat(X509_TRUST *trust, X509 *x, int flags)
{
	X509_check_purpose(x, -1, 0);
	if (x->ex_flags & EXFLAG_SS)
		return X509_TRUST_TRUSTED;
	else
		return X509_TRUST_UNTRUSTED;
}

static int
obj_trust(int id, X509 *x, int flags)
{
	ASN1_OBJECT *obj;
	int i;
	X509_CERT_AUX *ax;

	ax = x->aux;
	if (!ax)
		return X509_TRUST_UNTRUSTED;
	if (ax->reject) {
		for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
			obj = sk_ASN1_OBJECT_value(ax->reject, i);
			if (OBJ_obj2nid(obj) == id)
				return X509_TRUST_REJECTED;
		}
	}
	if (ax->trust) {
		for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
			obj = sk_ASN1_OBJECT_value(ax->trust, i);
			if (OBJ_obj2nid(obj) == id)
				return X509_TRUST_TRUSTED;
		}
	}
	return X509_TRUST_UNTRUSTED;
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: x509_trs.c,v 1.22 2017/01/29 17:49:23 beck Exp $ */
2			/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3			* project 1999.
4			*/
5			/* ====================================================================
6			* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7			*
8			* Redistribution and use in source and binary forms, with or without
9			* modification, are permitted provided that the following conditions
10			* are met:
11			*
12			* 1. Redistributions of source code must retain the above copyright
13			* notice, this list of conditions and the following disclaimer.
14			*
15			* 2. Redistributions in binary form must reproduce the above copyright
16			* notice, this list of conditions and the following disclaimer in
17			* the documentation and/or other materials provided with the
18			* distribution.
19			*
20			* 3. All advertising materials mentioning features or use of this
21			* software must display the following acknowledgment:
22			* "This product includes software developed by the OpenSSL Project
23			* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24			*
25			* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26			* endorse or promote products derived from this software without
27			* prior written permission. For written permission, please contact
28			* licensing@OpenSSL.org.
29			*
30			* 5. Products derived from this software may not be called "OpenSSL"
31			* nor may "OpenSSL" appear in their names without prior written
32			* permission of the OpenSSL Project.
33			*
34			* 6. Redistributions of any form whatsoever must retain the following
35			* acknowledgment:
36			* "This product includes software developed by the OpenSSL Project
37			* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38			*
39			* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40			* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41			* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42			* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43			* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44			* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45			* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46			* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47			* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48			* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49			* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50			* OF THE POSSIBILITY OF SUCH DAMAGE.
51			* ====================================================================
52			*
53			* This product includes cryptographic software written by Eric Young
54			* (eay@cryptsoft.com). This product includes software written by Tim
55			* Hudson (tjh@cryptsoft.com).
56			*
57			*/
58
59			#include <stdio.h>
60			#include <string.h>
61
62			#include <openssl/err.h>
63			#include <openssl/x509v3.h>
64
65			static int tr_cmp(const X509_TRUST * const a, const X509_TRUST const *b);
66			static void trtable_free(X509_TRUST *p);
67
68			static int trust_1oidany(X509_TRUST trust, X509 x, int flags);
69			static int trust_1oid(X509_TRUST trust, X509 x, int flags);
70			static int trust_compat(X509_TRUST trust, X509 x, int flags);
71
72			static int obj_trust(int id, X509 *x, int flags);
73			static int (default_trust)(int id, X509 x, int flags) = obj_trust;
74
75			/* WARNING: the following table should be kept in order of trust
76			* and without any gaps so we can just subtract the minimum trust
77			* value to get an index into the table
78			*/
79
80			static X509_TRUST trstandard[] = {
81			{X509_TRUST_COMPAT, 0, trust_compat, "compatible", 0, NULL},
82			{X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
83			{X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
84			{X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
85			{X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
86			{X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
87			{X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL},
88			{X509_TRUST_TSA, 0, trust_1oidany, "TSA server", NID_time_stamp, NULL}
89			};
90
91			#define X509_TRUST_COUNT (sizeof(trstandard)/sizeof(X509_TRUST))
92
93			static STACK_OF(X509_TRUST) *trtable = NULL;
94
95			static int
96			tr_cmp(const X509_TRUST * const a, const X509_TRUST const *b)
97			{
98			return (a)->trust - (b)->trust;
99			}
100
101			int
102			(X509_TRUST_set_default(int (trust)(int , X509 , int)))(int, X509 , int)
103			{
104			int (oldtrust)(int , X509 , int);
105
106			oldtrust = default_trust;
107			default_trust = trust;
108			return oldtrust;
109			}
110
111			int
112			X509_check_trust(X509 *x, int id, int flags)
113			{
114			X509_TRUST *pt;
115			int idx;
116
117	✗✓	2238	if (id == -1)
118			return 1;
119			/*
120			* XXX beck/jsing This enables self signed certs to be trusted for
121			* an unspecified id/trust flag value (this is NOT the
122			* X509_TRUST_DEFAULT), which was the longstanding
123			* openssl behaviour. boringssl does not have this behaviour.
124			*
125			* This should be revisited, but changing the default "not default"
126			* may break things.
127			*/
128	✓✓	1119	if (id == 0) {
129			int rv;
130		140	rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);
131	✗✓	140	if (rv != X509_TRUST_UNTRUSTED)
132			return rv;
133		140	return trust_compat(NULL, x, 0);
134			}
135		979	idx = X509_TRUST_get_by_id(id);
136	✗✓	979	if (idx == -1)
137			return default_trust(id, x, flags);
138		979	pt = X509_TRUST_get0(idx);
139		979	return pt->check_trust(pt, x, flags);
140		1119	}
141
142			int
143			X509_TRUST_get_count(void)
144			{
145			if (!trtable)
146			return X509_TRUST_COUNT;
147			return sk_X509_TRUST_num(trtable) + X509_TRUST_COUNT;
148			}
149
150			X509_TRUST *
151			X509_TRUST_get0(int idx)
152			{
153	✗✓	1958	if (idx < 0)
154			return NULL;
155	✓✗	979	if (idx < (int)X509_TRUST_COUNT)
156		979	return trstandard + idx;
157			return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
158		979	}
159
160			int
161			X509_TRUST_get_by_id(int id)
162			{
163		1970	X509_TRUST tmp;
164			int idx;
165
166	✓✗	985	if ((id >= X509_TRUST_MIN) && (id <= X509_TRUST_MAX))
167		985	return id - X509_TRUST_MIN;
168			tmp.trust = id;
169			if (!trtable)
170			return -1;
171			idx = sk_X509_TRUST_find(trtable, &tmp);
172			if (idx == -1)
173			return -1;
174			return idx + X509_TRUST_COUNT;
175		985	}
176
177			int
178			X509_TRUST_set(int *t, int trust)
179			{
180			if (X509_TRUST_get_by_id(trust) == -1) {
181			X509error(X509_R_INVALID_TRUST);
182			return 0;
183			}
184			*t = trust;
185			return 1;
186			}
187
188			int
189			X509_TRUST_add(int id, int flags, int (ck)(X509_TRUST , X509 *, int),
190			char name, int arg1, void arg2)
191			{
192			int idx;
193			X509_TRUST *trtmp;
194			char *name_dup;
195
196			/* This is set according to what we change: application can't set it */
197			flags &= ~X509_TRUST_DYNAMIC;
198			/* This will always be set for application modified trust entries */
199			flags \|= X509_TRUST_DYNAMIC_NAME;
200			/* Get existing entry if any */
201			idx = X509_TRUST_get_by_id(id);
202			/* Need a new entry */
203			if (idx == -1) {
204			if (!(trtmp = malloc(sizeof(X509_TRUST)))) {
205			X509error(ERR_R_MALLOC_FAILURE);
206			return 0;
207			}
208			trtmp->flags = X509_TRUST_DYNAMIC;
209			} else {
210			trtmp = X509_TRUST_get0(idx);
211			if (trtmp == NULL) {
212			X509error(X509_R_INVALID_TRUST);
213			return 0;
214			}
215			}
216
217			if ((name_dup = strdup(name)) == NULL)
218			goto err;
219
220			/* free existing name if dynamic */
221			if (trtmp->flags & X509_TRUST_DYNAMIC_NAME)
222			free(trtmp->name);
223			/* dup supplied name */
224			trtmp->name = name_dup;
225			/* Keep the dynamic flag of existing entry */
226			trtmp->flags &= X509_TRUST_DYNAMIC;
227			/* Set all other flags */
228			trtmp->flags \|= flags;
229
230			trtmp->trust = id;
231			trtmp->check_trust = ck;
232			trtmp->arg1 = arg1;
233			trtmp->arg2 = arg2;
234
235			/* If it's a new entry, manage the dynamic table */
236			if (idx == -1) {
237			if (trtable == NULL &&
238			(trtable = sk_X509_TRUST_new(tr_cmp)) == NULL)
239			goto err;
240			if (sk_X509_TRUST_push(trtable, trtmp) == 0)
241			goto err;
242			}
243			return 1;
244
245			err:
246			free(name_dup);
247			if (idx == -1)
248			free(trtmp);
249			X509error(ERR_R_MALLOC_FAILURE);
250			return 0;
251			}
252
253			static void
254			trtable_free(X509_TRUST *p)
255			{
256			if (!p)
257			return;
258			if (p->flags & X509_TRUST_DYNAMIC) {
259			if (p->flags & X509_TRUST_DYNAMIC_NAME)
260			free(p->name);
261			free(p);
262			}
263			}
264
265			void
266			X509_TRUST_cleanup(void)
267			{
268			unsigned int i;
269
270			for (i = 0; i < X509_TRUST_COUNT; i++)
271			trtable_free(trstandard + i);
272			sk_X509_TRUST_pop_free(trtable, trtable_free);
273			trtable = NULL;
274			}
275
276			int
277			X509_TRUST_get_flags(X509_TRUST *xp)
278			{
279			return xp->flags;
280			}
281
282			char *
283			X509_TRUST_get0_name(X509_TRUST *xp)
284			{
285			return xp->name;
286			}
287
288			int
289			X509_TRUST_get_trust(X509_TRUST *xp)
290			{
291			return xp->trust;
292			}
293
294			static int
295			trust_1oidany(X509_TRUST trust, X509 x, int flags)
296			{
297	✗✓✗✗ ✗✗	1950	if (x->aux && (x->aux->trust \|\| x->aux->reject))
298			return obj_trust(trust->arg1, x, flags);
299			/* we don't have any trust settings: for compatibility
300			* we return trusted if it is self signed
301			*/
302		975	return trust_compat(trust, x, flags);
303		975	}
304
305			static int
306			trust_1oid(X509_TRUST trust, X509 x, int flags)
307			{
308			if (x->aux)
309			return obj_trust(trust->arg1, x, flags);
310			return X509_TRUST_UNTRUSTED;
311			}
312
313			static int
314			trust_compat(X509_TRUST trust, X509 x, int flags)
315			{
316		2238	X509_check_purpose(x, -1, 0);
317	✓✓	1119	if (x->ex_flags & EXFLAG_SS)
318		1035	return X509_TRUST_TRUSTED;
319			else
320		84	return X509_TRUST_UNTRUSTED;
321		1119	}
322
323			static int
324			obj_trust(int id, X509 *x, int flags)
325			{
326			ASN1_OBJECT *obj;
327			int i;
328			X509_CERT_AUX *ax;
329
330		280	ax = x->aux;
331	✓✗	140	if (!ax)
332		140	return X509_TRUST_UNTRUSTED;
333			if (ax->reject) {
334			for (i = 0; i < sk_ASN1_OBJECT_num(ax->reject); i++) {
335			obj = sk_ASN1_OBJECT_value(ax->reject, i);
336			if (OBJ_obj2nid(obj) == id)
337			return X509_TRUST_REJECTED;
338			}
339			}
340			if (ax->trust) {
341			for (i = 0; i < sk_ASN1_OBJECT_num(ax->trust); i++) {
342			obj = sk_ASN1_OBJECT_value(ax->trust, i);
343			if (OBJ_obj2nid(obj) == id)
344			return X509_TRUST_TRUSTED;
345			}
346			}
347			return X509_TRUST_UNTRUSTED;
348		140	}