Changeset 745 for trunk/server/source4/heimdal/lib/hx509

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/heimdal/lib/hx509/ca.c (modified) (12 diffs)
• source4/heimdal/lib/hx509/cert.c (modified) (20 diffs)
• source4/heimdal/lib/hx509/char_map.h (copied) (copied from vendor/current/source4/heimdal/lib/hx509/char_map.h )
• source4/heimdal/lib/hx509/cms.c (modified) (12 diffs)
• source4/heimdal/lib/hx509/collector.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/crypto.c (modified) (83 diffs)
• source4/heimdal/lib/hx509/error.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/file.c (modified) (3 diffs)
• source4/heimdal/lib/hx509/hx509.h (modified) (4 diffs)
• source4/heimdal/lib/hx509/hx509_err.et (modified) (1 diff)
• source4/heimdal/lib/hx509/hx_locl.h (modified) (3 diffs)
• source4/heimdal/lib/hx509/keyset.c (modified) (7 diffs)
• source4/heimdal/lib/hx509/ks_dir.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/ks_file.c (modified) (17 diffs)
• source4/heimdal/lib/hx509/ks_keychain.c (modified) (3 diffs)
• source4/heimdal/lib/hx509/ks_mem.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/ks_p11.c (modified) (5 diffs)
• source4/heimdal/lib/hx509/ks_p12.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/lex.yy.c (copied) (copied from vendor/current/source4/heimdal/lib/hx509/lex.yy.c )
• source4/heimdal/lib/hx509/lock.c (modified) (1 diff)
• source4/heimdal/lib/hx509/name.c (modified) (19 diffs)
• source4/heimdal/lib/hx509/peer.c (modified) (2 diffs)
• source4/heimdal/lib/hx509/print.c (modified) (1 diff)
• source4/heimdal/lib/hx509/req.c (modified) (11 diffs)
• source4/heimdal/lib/hx509/revoke.c (modified) (6 diffs)
• source4/heimdal/lib/hx509/sel-gram.c (modified) (37 diffs)
• source4/heimdal/lib/hx509/sel-gram.h (modified) (3 diffs)
• source4/heimdal/lib/hx509/sel-lex.c (modified) (18 diffs)
• source4/heimdal/lib/hx509/sel-lex.l (modified) (1 diff)
• source4/heimdal/lib/hx509/sel.c (modified) (1 diff)

trunk/server/source4/heimdal/lib/hx509/ca.c

@@ -1 +1 @@
 /*
- * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2010 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
@@ -54 +54 @@
         unsigned int serial:1;
         unsigned int domaincontroller:1;
+        unsigned int xUniqueID:1;
     } flags;
     time_t notBefore;
@@ -59 +60 @@
     int pathLenConstraint; /* both for CA and Proxy */
     CRLDistributionPoints crldp;
+    heim_bit_string subjectUniqueID;
+    heim_bit_string issuerUniqueID;
+
 };
 
@@ -80 +84 @@
     if (*tbs == NULL)
         return ENOMEM;
-
-    (*tbs)->subject = NULL;
-    (*tbs)->san.len = 0;
-    (*tbs)->san.val = NULL;
-    (*tbs)->eku.len = 0;
-    (*tbs)->eku.val = NULL;
-    (*tbs)->pathLenConstraint = 0;
-    (*tbs)->crldp.len = 0;
-    (*tbs)->crldp.val = NULL;
 
     return 0;
@@ -112 +107 @@
     der_free_heim_integer(&(*tbs)->serial);
     free_CRLDistributionPoints(&(*tbs)->crldp);
-
+    der_free_bit_string(&(*tbs)->subjectUniqueID);
+    der_free_bit_string(&(*tbs)->issuerUniqueID);
     hx509_name_free(&(*tbs)->subject);
 
@@ -486 +482 @@
 
         gn.element = choice_GeneralName_uniformResourceIdentifier;
-        gn.u.uniformResourceIdentifier = rk_UNCONST(uri);
+        gn.u.uniformResourceIdentifier.data = rk_UNCONST(uri);
+        gn.u.uniformResourceIdentifier.length = strlen(uri);
 
         ASN1_MALLOC_ENCODE(DistributionPointName,
@@ -786 +783 @@
     memset(&gn, 0, sizeof(gn));
     gn.element = choice_GeneralName_dNSName;
-    gn.u.dNSName = rk_UNCONST(dnsname);
+    gn.u.dNSName.data = rk_UNCONST(dnsname);
+    gn.u.dNSName.length = strlen(dnsname);
 
     return add_GeneralNames(&tbs->san, &gn);
@@ -813 +811 @@
     memset(&gn, 0, sizeof(gn));
     gn.element = choice_GeneralName_rfc822Name;
-    gn.u.rfc822Name = rk_UNCONST(rfc822Name);
+    gn.u.rfc822Name.data = rk_UNCONST(rfc822Name);
+    gn.u.rfc822Name.length = strlen(rfc822Name);
 
     return add_GeneralNames(&tbs->san, &gn);
@@ -841 +840 @@
 
 /**
+ * Set the issuerUniqueID and subjectUniqueID
+ *
+ * These are only supposed to be used considered with version 2
+ * certificates, replaced by the two extensions SubjectKeyIdentifier
+ * and IssuerKeyIdentifier. This function is to allow application
+ * using legacy protocol to issue them.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ * @param issuerUniqueID to be set
+ * @param subjectUniqueID to be set
+ *
+ * @return An hx509 error code, see hx509_get_error_string().
+ *
+ * @ingroup hx509_ca
+ */
+
+int
+hx509_ca_tbs_set_unique(hx509_context context,
+                        hx509_ca_tbs tbs,
+                        const heim_bit_string *subjectUniqueID,
+                        const heim_bit_string *issuerUniqueID)
+{
+    int ret;
+
+    der_free_bit_string(&tbs->subjectUniqueID);
+    der_free_bit_string(&tbs->issuerUniqueID);
+    
+    if (subjectUniqueID) {
+        ret = der_copy_bit_string(subjectUniqueID, &tbs->subjectUniqueID);
+        if (ret)
+            return ret;
+    }
+
+    if (issuerUniqueID) {
+        ret = der_copy_bit_string(issuerUniqueID, &tbs->issuerUniqueID);
+        if (ret)
+            return ret;
+    }
+
+    return 0;
+}
+
+/**
  * Expand the the subject name in the to-be-signed certificate object
  * using hx509_name_expand().
@@ -861 +904 @@
     return hx509_name_expand(context, tbs->subject, env);
 }
+
+/*
+ *
+ */
 
 static int
@@ -1091 +1138 @@
     }
     /* issuerUniqueID  [1]  IMPLICIT BIT STRING OPTIONAL */
+    if (tbs->issuerUniqueID.length) {
+        tbsc->issuerUniqueID = calloc(1, sizeof(*tbsc->issuerUniqueID));
+        if (tbsc->issuerUniqueID == NULL) {
+            ret = ENOMEM;
+            hx509_set_error_string(context, 0, ret, "Out of memory");
+            goto out;
+        }
+        ret = der_copy_bit_string(&tbs->issuerUniqueID, tbsc->issuerUniqueID);
+        if (ret) {
+            hx509_set_error_string(context, 0, ret, "Out of memory");
+            goto out;
+        }
+    }
     /* subjectUniqueID [2]  IMPLICIT BIT STRING OPTIONAL */
+    if (tbs->subjectUniqueID.length) {
+        tbsc->subjectUniqueID = calloc(1, sizeof(*tbsc->subjectUniqueID));
+        if (tbsc->subjectUniqueID == NULL) {
+            ret = ENOMEM;
+            hx509_set_error_string(context, 0, ret, "Out of memory");
+            goto out;
+        }
+
+        ret = der_copy_bit_string(&tbs->subjectUniqueID, tbsc->subjectUniqueID);
+        if (ret) {
+            hx509_set_error_string(context, 0, ret, "Out of memory");
+            goto out;
+        }
+    }
+
     /* extensions      [3]  EXPLICIT Extensions OPTIONAL */
     tbsc->extensions = calloc(1, sizeof(*tbsc->extensions));
@@ -1194 +1269 @@
 
         {
-            SHA_CTX m;
-        
-            SHA1_Init(&m);
-            SHA1_Update(&m, tbs->spki.subjectPublicKey.data,
-                        tbs->spki.subjectPublicKey.length / 8);
-            SHA1_Final (hash, &m);
+            EVP_MD_CTX *ctx;
+
+            ctx = EVP_MD_CTX_create();
+            EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
+            EVP_DigestUpdate(ctx, tbs->spki.subjectPublicKey.data,
+                             tbs->spki.subjectPublicKey.length / 8);
+            EVP_DigestFinal_ex(ctx, hash, NULL);
+            EVP_MD_CTX_destroy(ctx);
         }
 

trunk/server/source4/heimdal/lib/hx509/cert.c

@@ -284 +284 @@
     }
     if (size != len) {
+        free_Certificate(&t);
         hx509_set_error_string(context, 0, HX509_EXTRA_DATA_AFTER_STRUCTURE,
                                "Extra data after certificate");
@@ -310 +311 @@
 {
     if (cert->private_key)
-        _hx509_private_key_free(&cert->private_key);
+        hx509_private_key_free(&cert->private_key);
     cert->private_key = _hx509_private_key_ref(private_key);
     return 0;
@@ -341 +342 @@
 
     if (cert->private_key)
-        _hx509_private_key_free(&cert->private_key);
+        hx509_private_key_free(&cert->private_key);
 
     free_Certificate(cert->data);
@@ -446 +447 @@
     if (ctx->trust_anchors)
         hx509_certs_free(&ctx->trust_anchors);
-    ctx->trust_anchors = _hx509_certs_ref(set);
+    ctx->trust_anchors = hx509_certs_ref(set);
 }
 
@@ -1023 +1024 @@
                           &cert->tbsCertificate.issuer, &diff);
     *self_signed = (diff == 0);
-    if (ret)
+    if (ret) {
         hx509_set_error_string(context, 0, ret,
                                "Failed to check if self signed");
+    } else
+        ret = _hx509_self_signed_valid(context, &cert->signatureAlgorithm);
+
     return ret;
 }
@@ -1507 +1511 @@
 }
 
+static int
+get_x_unique_id(hx509_context context, const char *name, 
+                const heim_bit_string *cert, heim_bit_string *subject)
+{
+    int ret;
+
+    if (cert == NULL) {
+        ret = HX509_EXTENSION_NOT_FOUND;
+        hx509_set_error_string(context, 0, ret, "%s unique id doesn't exists", name);
+        return ret;
+    }
+    ret = der_copy_bit_string(cert, subject);
+    if (ret) {
+        hx509_set_error_string(context, 0, ret, "malloc out of memory", name);
+        return ret;
+    }
+    return 0;
+}
+
+/**
+ * Get a copy of the Issuer Unique ID
+ *
+ * @param context a hx509_context
+ * @param p a hx509 certificate
+ * @param issuer the issuer id returned, free with der_free_bit_string()
+ *
+ * @return An hx509 error code, see hx509_get_error_string(). The
+ * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
+ * doesn't have a issuerUniqueID
+ *
+ * @ingroup hx509_cert
+ */
+
+int
+hx509_cert_get_issuer_unique_id(hx509_context context, hx509_cert p, heim_bit_string *issuer)
+{
+    return get_x_unique_id(context, "issuer", p->data->tbsCertificate.issuerUniqueID, issuer);
+}
+
+/**
+ * Get a copy of the Subect Unique ID
+ *
+ * @param context a hx509_context
+ * @param p a hx509 certificate
+ * @param subject the subject id returned, free with der_free_bit_string()
+ *
+ * @return An hx509 error code, see hx509_get_error_string(). The
+ * error code HX509_EXTENSION_NOT_FOUND is returned if the certificate
+ * doesn't have a subjectUniqueID
+ *
+ * @ingroup hx509_cert
+ */
+
+int
+hx509_cert_get_subject_unique_id(hx509_context context, hx509_cert p, heim_bit_string *subject)
+{
+    return get_x_unique_id(context, "subject", p->data->tbsCertificate.subjectUniqueID, subject);
+}
+
 
 hx509_private_key
@@ -1545 +1608 @@
     }
 
-    return _hx509_private_key_private_decrypt(context,
+    return hx509_private_key_private_decrypt(context,
                                               ciphertext,
                                               encryption_oid,
@@ -1553 +1616 @@
 
 int
-_hx509_cert_public_encrypt(hx509_context context,
+hx509_cert_public_encrypt(hx509_context context,
                            const heim_octet_string *cleartext,
                            const hx509_cert p,
@@ -1693 +1756 @@
         const char *s;
         size_t len1, len2;
-        s = strchr(c->u.rfc822Name, '@');
+        s = memchr(c->u.rfc822Name.data, '@', c->u.rfc822Name.length);
         if (s) {
-            if (strcasecmp(c->u.rfc822Name, n->u.rfc822Name) != 0)
+            if (der_printable_string_cmp(&c->u.rfc822Name, &n->u.rfc822Name) != 0)
                 return HX509_NAME_CONSTRAINT_ERROR;
         } else {
-            s = strchr(n->u.rfc822Name, '@');
+            s = memchr(n->u.rfc822Name.data, '@', n->u.rfc822Name.length);
             if (s == NULL)
                 return HX509_NAME_CONSTRAINT_ERROR;
-            len1 = strlen(c->u.rfc822Name);
-            len2 = strlen(s + 1);
+            len1 = c->u.rfc822Name.length;
+            len2 = n->u.rfc822Name.length -
+                (s - ((char *)n->u.rfc822Name.data));
             if (len1 > len2)
                 return HX509_NAME_CONSTRAINT_ERROR;
-            if (strcasecmp(s + 1 + len2 - len1, c->u.rfc822Name) != 0)
+            if (memcmp(s + 1 + len2 - len1, c->u.rfc822Name.data, len1) != 0)
                 return HX509_NAME_CONSTRAINT_ERROR;
             if (len1 < len2 && s[len2 - len1 + 1] != '.')
@@ -1715 +1779 @@
     case choice_GeneralName_dNSName: {
         size_t lenc, lenn;
-
-        lenc = strlen(c->u.dNSName);
-        lenn = strlen(n->u.dNSName);
+        char *ptr;
+
+        lenc = c->u.dNSName.length;
+        lenn = n->u.dNSName.length;
         if (lenc > lenn)
             return HX509_NAME_CONSTRAINT_ERROR;
-        if (strcasecmp(&n->u.dNSName[lenn - lenc], c->u.dNSName) != 0)
+        ptr = n->u.dNSName.data;
+        if (memcmp(&ptr[lenn - lenc], c->u.dNSName.data, lenc) != 0)
             return HX509_NAME_CONSTRAINT_ERROR;
-        if (lenc != lenn && n->u.dNSName[lenn - lenc - 1] != '.')
+        if (lenn != lenc && ptr[lenn - lenc - 1] != '.')
             return HX509_NAME_CONSTRAINT_ERROR;
         *match = 1;
@@ -1927 +1993 @@
      */
     if (ctx->trust_anchors)
-        anchors = _hx509_certs_ref(ctx->trust_anchors);
+        anchors = hx509_certs_ref(ctx->trust_anchors);
     else if (context->default_trust_anchors && ALLOW_DEF_TA(ctx))
-        anchors = _hx509_certs_ref(context->default_trust_anchors);
+        anchors = hx509_certs_ref(context->default_trust_anchors);
     else {
         ret = hx509_certs_init(context, "MEMORY:no-TA", 0, NULL, &anchors);
@@ -2244 +2310 @@
 
     for (i = path.len - 1; i >= 0; i--) {
-        Certificate *signer, *c;
+        hx509_cert signer;
+        Certificate *c;
 
         c = _hx509_get_cert(path.val[i]);
@@ -2252 +2319 @@
             int selfsigned;
 
-            signer = path.val[i]->data;
-
-            ret = certificate_is_self_signed(context, signer, &selfsigned);
+            signer = path.val[i];
+
+            ret = certificate_is_self_signed(context, signer->data, &selfsigned);
             if (ret)
                 goto out;
@@ -2263 +2330 @@
         } else {
             /* take next certificate in chain */
-            signer = path.val[i + 1]->data;
+            signer = path.val[i + 1];
         }
 
@@ -2327 +2394 @@
                        const heim_octet_string *sig)
 {
-    return _hx509_verify_signature(context, signer->data, alg, data, sig);
-}
+    return _hx509_verify_signature(context, signer, alg, data, sig);
+}
+
+int
+_hx509_verify_signature_bitstring(hx509_context context,
+                                  const hx509_cert signer,
+                                  const AlgorithmIdentifier *alg,
+                                  const heim_octet_string *data,
+                                  const heim_bit_string *sig)
+{
+    heim_octet_string os;
+
+    if (sig->length & 7) {
+        hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
+                               "signature not multiple of 8 bits");
+        return HX509_CRYPTO_SIG_INVALID_FORMAT;
+    }
+
+    os.data = sig->data;
+    os.length = sig->length / 8;
+
+    return _hx509_verify_signature(context, signer, alg, data, &os);
+}
+
 
 
@@ -2379 +2468 @@
         for (j = 0; j < san.len; j++) {
             switch (san.val[j].element) {
-            case choice_GeneralName_dNSName:
-                if (strcasecmp(san.val[j].u.dNSName, hostname) == 0) {
+            case choice_GeneralName_dNSName: {
+                heim_printable_string hn;
+                hn.data = rk_UNCONST(hostname);
+                hn.length = strlen(hostname);
+                
+                if (der_printable_string_cmp(&san.val[j].u.dNSName, &hn) == 0) {
                     free_GeneralNames(&san);
                     return 0;
                 }
                 break;
+            }
             default:
                 break;
@@ -2402 +2496 @@
                 DirectoryString *ds = &n->value;
                 switch (ds->element) {
-                case choice_DirectoryString_printableString:
-                    if (strcasecmp(ds->u.printableString, hostname) == 0)
+                case choice_DirectoryString_printableString: {
+                    heim_printable_string hn;
+                    hn.data = rk_UNCONST(hostname);
+                    hn.length = strlen(hostname);
+
+                    if (der_printable_string_cmp(&ds->u.printableString, &hn) == 0)
                         return 0;
                     break;
-                case choice_DirectoryString_ia5String:
-                    if (strcasecmp(ds->u.ia5String, hostname) == 0)
-                    return 0;
+                }
+                case choice_DirectoryString_ia5String: {
+                    heim_ia5_string hn;
+                    hn.data = rk_UNCONST(hostname);
+                    hn.length = strlen(hostname);
+
+                    if (der_ia5_string_cmp(&ds->u.ia5String, &hn) == 0)
+                        return 0;
                     break;
+                }
                 case choice_DirectoryString_utf8String:
                     if (strcasecmp(ds->u.utf8String, hostname) == 0)
@@ -3228 +3332 @@
  * @param c the certificate to encode.
  * @param os the encode certificate, set to NULL, 0 on case of
- * error. Free the returned structure with hx509_xfree().
+ * error. Free the os->data with hx509_xfree().
  *
  * @return An hx509 error code, see hx509_get_error_string().
@@ -3384 +3488 @@
         heim_octet_string os, sig;
         hx509_env envhash = NULL;
-        char *buf;
 
         os.data = c->tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.data;
@@ -3430 +3533 @@
     return ret;
 }
+
+/**
+ * Print a simple representation of a certificate
+ *
+ * @param context A hx509 context, can be NULL
+ * @param cert certificate to print
+ * @param out the stdio output stream, if NULL, stdout is used
+ *
+ * @return An hx509 error code
+ *
+ * @ingroup hx509_cert
+ */
+
+int
+hx509_print_cert(hx509_context context, hx509_cert cert, FILE *out)
+{
+    hx509_name name;
+    char *str;
+    int ret;
+
+    if (out == NULL)
+        out = stderr;
+
+    ret = hx509_cert_get_issuer(cert, &name);
+    if (ret)
+        return ret;
+    hx509_name_to_string(name, &str);
+    hx509_name_free(&name);
+    fprintf(out, "    issuer:  \"%s\"\n", str);
+    free(str);
+
+    ret = hx509_cert_get_subject(cert, &name);
+    if (ret)
+        return ret;
+    hx509_name_to_string(name, &str);
+    hx509_name_free(&name);
+    fprintf(out, "    subject: \"%s\"\n", str);
+    free(str);
+
+    {
+        heim_integer serialNumber;
+
+        ret = hx509_cert_get_serialnumber(cert, &serialNumber);
+        if (ret)
+            return ret;
+        ret = der_print_hex_heim_integer(&serialNumber, &str);
+        if (ret)
+            return ret;
+        der_free_heim_integer(&serialNumber);
+        fprintf(out, "    serial: %s\n", str);
+        free(str);
+    }
+
+    printf("    keyusage: ");
+    ret = hx509_cert_keyusage_print(context, cert, &str);
+    if (ret == 0) {
+        fprintf(out, "%s\n", str);
+        free(str);
+    } else
+        fprintf(out, "no");
+
+    return 0;
+}

trunk/server/source4/heimdal/lib/hx509/cms.c

@@ -533 +533 @@
  *    - HX509_CMS_EV_NO_KU_CHECK - Dont check KU on certificate
  *    - HX509_CMS_EV_ALLOW_WEAK - Allow weak crytpo
+ *    - HX509_CMS_EV_ID_NAME - prefer issuer name and serial number
  * @param cert Certificate to encrypt the EnvelopedData encryption key
  * with.
@@ -560 +561 @@
     heim_octet_string key;
     hx509_crypto crypto = NULL;
+    int ret, cmsidflag;
     EnvelopedData ed;
     size_t size;
-    int ret;
 
     memset(&ivec, 0, sizeof(ivec));
@@ -649 +650 @@
     ri = &ed.recipientInfos.val[0];
 
-    ri->version = 0;
-    ret = fill_CMSIdentifier(cert, CMS_ID_SKI, &ri->rid);
+    if (flags & HX509_CMS_EV_ID_NAME) {
+        ri->version = 0;
+        cmsidflag = CMS_ID_NAME;
+    } else {
+        ri->version = 2;
+        cmsidflag = CMS_ID_SKI;
+    }
+        
+    ret = fill_CMSIdentifier(cert, cmsidflag, &ri->rid);
     if (ret) {
         hx509_set_error_string(context, 0, ret,
@@ -658 +666 @@
     }
 
-    ret = _hx509_cert_public_encrypt(context,
+    ret = hx509_cert_public_encrypt(context,
                                      &key, cert,
                                      &ri->keyEncryptionAlgorithm.algorithm,
@@ -1171 +1179 @@
     hx509_peer_info peer;
     int cmsidflag;
+    int leafonly;
     hx509_certs certs;
     hx509_certs anchors;
@@ -1361 +1370 @@
         unsigned int i;
 
-        if (sigctx->pool) {
+        if (sigctx->pool && sigctx->leafonly == 0) {
             _hx509_calculate_path(context,
                                   HX509_CALCULATE_PATH_NO_ANCHOR,
@@ -1416 +1425 @@
 }
 
+static int
+cmp_AlgorithmIdentifier(const AlgorithmIdentifier *p, const AlgorithmIdentifier *q)
+{
+    return der_heim_oid_cmp(&p->algorithm, &q->algorithm);
+}
+
 int
 hx509_cms_create_signed(hx509_context context,
@@ -1428 +1443 @@
                         heim_octet_string *signed_data)
 {
-    unsigned int i;
+    unsigned int i, j;
     hx509_name name;
     int ret;
@@ -1455 +1470 @@
         sigctx.cmsidflag = CMS_ID_SKI;
 
-    ret = hx509_certs_init(context, "MEMORY:certs", 0, NULL, &sigctx.certs);
-    if (ret)
-        return ret;
+    /**
+     * Use HX509_CMS_SIGNATURE_LEAF_ONLY to only request leaf
+     * certificates to be added to the SignedData.
+     */
+    sigctx.leafonly = (flags & HX509_CMS_SIGNATURE_LEAF_ONLY) ? 1 : 0;
+
+    /**
+     * Use HX509_CMS_NO_CERTS to make the SignedData contain no
+     * certificates, overrides HX509_CMS_SIGNATURE_LEAF_ONLY.
+     */
+
+    if ((flags & HX509_CMS_SIGNATURE_NO_CERTS) == 0) {
+        ret = hx509_certs_init(context, "MEMORY:certs", 0, NULL, &sigctx.certs);
+        if (ret)
+            return ret;
+    }
 
     sigctx.anchors = anchors;
@@ -1492 +1520 @@
      */
     if ((flags & HX509_CMS_SIGNATURE_NO_SIGNER) == 0) {
-        ret = hx509_certs_iter(context, certs, sig_process, &sigctx);
+        ret = hx509_certs_iter_f(context, certs, sig_process, &sigctx);
         if (ret)
             goto out;
@@ -1498 +1526 @@
 
     if (sigctx.sd.signerInfos.len) {
-        ALLOC_SEQ(&sigctx.sd.digestAlgorithms, sigctx.sd.signerInfos.len);
-        if (sigctx.sd.digestAlgorithms.val == NULL) {
-            ret = ENOMEM;
-            hx509_clear_error_string(context);
-            goto out;
-        }
-        
-        /* XXX remove dups */
         for (i = 0; i < sigctx.sd.signerInfos.len; i++) {
             AlgorithmIdentifier *di =
                 &sigctx.sd.signerInfos.val[i].digestAlgorithm;
-            ret = copy_AlgorithmIdentifier(di,
-                                           &sigctx.sd.digestAlgorithms.val[i]);
-            if (ret) {
-                hx509_clear_error_string(context);
-                goto out;
+
+            for (j = 0; j < sigctx.sd.digestAlgorithms.len; j++)
+                if (cmp_AlgorithmIdentifier(di, &sigctx.sd.digestAlgorithms.val[j]) == 0)
+                    break;
+            if (j < sigctx.sd.digestAlgorithms.len) {
+                ret = add_DigestAlgorithmIdentifiers(&sigctx.sd.digestAlgorithms, di);
+                if (ret) {
+                    hx509_clear_error_string(context);
+                    goto out;
+                }
             }
         }
@@ -1526 +1551 @@
         }
 
-        ret = hx509_certs_iter(context, sigctx.certs, cert_process, &sigctx);
+        ret = hx509_certs_iter_f(context, sigctx.certs, cert_process, &sigctx);
         if (ret)
             goto out;

trunk/server/source4/heimdal/lib/hx509/collector.c

@@ -106 +106 @@
     free_AlgorithmIdentifier(&key->alg);
     if (key->private_key)
-        _hx509_private_key_free(&key->private_key);
+        hx509_private_key_free(&key->private_key);
     der_free_octet_string(&key->localKeyId);
     free(key);
@@ -144 +144 @@
         key->private_key = private_key;
     } else {
-        ret = _hx509_parse_private_key(context, alg,
+        ret = hx509_parse_private_key(context, alg,
                                        key_data->data, key_data->length,
+                                       HX509_KEY_FORMAT_DER,
                                        &key->private_key);
         if (ret)

trunk/server/source4/heimdal/lib/hx509/crypto.c

@@ -54 +54 @@
     int (*export)(hx509_context context,
                   const hx509_private_key,
+                  hx509_key_format_t,
                   heim_octet_string *);
     int (*import)(hx509_context, const AlgorithmIdentifier *,
-                  const void *, size_t, hx509_private_key);
+                  const void *, size_t, hx509_key_format_t,
+                  hx509_private_key);
     int (*generate_private_key)(hx509_context,
                                 struct hx509_generate_private_context *,
@@ -88 +90 @@
     const AlgorithmIdentifier *digest_alg;
     int flags;
-#define PROVIDE_CONF 1
-#define REQUIRE_SIGNER 2
+#define PROVIDE_CONF    0x1
+#define REQUIRE_SIGNER  0x2
+#define SELF_SIGNED_OK  0x4
 
 #define SIG_DIGEST      0x100
@@ -98 +101 @@
 
     time_t best_before; /* refuse signature made after best before date */
+    const EVP_MD *(*evp_md)(void);
     int (*verify_signature)(hx509_context context,
                             const struct signature_alg *,
@@ -148 +152 @@
 };
 
-static const unsigned md2_oid_tree[] = { 1, 2, 840, 113549, 2, 2 };
-const AlgorithmIdentifier _hx509_signature_md2_data = {
-    { 6, rk_UNCONST(md2_oid_tree) }, rk_UNCONST(&null_entry_oid)
-};
-
 static const unsigned ecPublicKey[] ={ 1, 2, 840, 10045, 2, 1 };
 const AlgorithmIdentifier _hx509_signature_ecPublicKey = {
@@ -191 +190 @@
 const AlgorithmIdentifier _hx509_signature_rsa_with_md5_data = {
     { 7, rk_UNCONST(rsa_with_md5_oid) }, NULL
-};
-
-static const unsigned rsa_with_md2_oid[] ={ 1, 2, 840, 113549, 1, 1, 2 };
-const AlgorithmIdentifier _hx509_signature_rsa_with_md2_data = {
-    { 7, rk_UNCONST(rsa_with_md2_oid) }, NULL
 };
 
@@ -282 +276 @@
      */
 
-    if (der_heim_oid_cmp(oid, &asn1_oid_id_ec_group_secp256r1) == 0)
+    if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP256R1) == 0)
         return NID_X9_62_prime256v1;
-    else if (der_heim_oid_cmp(oid, &asn1_oid_id_ec_group_secp160r1) == 0)
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R1) == 0)
         return NID_secp160r1;
-    else if (der_heim_oid_cmp(oid, &asn1_oid_id_ec_group_secp160r2) == 0)
+    else if (der_heim_oid_cmp(oid, ASN1_OID_ID_EC_GROUP_SECP160R2) == 0)
         return NID_secp160r2;
 
@@ -369 +363 @@
     spi = &signer->tbsCertificate.subjectPublicKeyInfo;
 
-    if (der_heim_oid_cmp(&spi->algorithm.algorithm, &asn1_oid_id_ecPublicKey) != 0)
+    if (der_heim_oid_cmp(&spi->algorithm.algorithm, ASN1_OID_ID_ECPUBLICKEY) != 0)
         return HX509_CRYPTO_SIG_INVALID_FORMAT;
 
@@ -430 +424 @@
     int ret;
 
-    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, &asn1_oid_id_ecPublicKey) != 0)
+    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) != 0)
         _hx509_abort("internal error passing private key to wrong ops");
 
@@ -550 +544 @@
     int ret;
     RSA *rsa;
-    RSAPublicKey pk;
     size_t size;
+    const unsigned char *p;
 
     memset(&di, 0, sizeof(di));
@@ -557 +551 @@
     spi = &signer->tbsCertificate.subjectPublicKeyInfo;
 
-    rsa = RSA_new();
+    p = spi->subjectPublicKey.data;
+    size = spi->subjectPublicKey.length / 8;
+    
+    rsa = d2i_RSAPublicKey(NULL, &p, size);
     if (rsa == NULL) {
-        hx509_set_error_string(context, 0, ENOMEM, "out of memory");
-        return ENOMEM;
-    }
-    ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
-                              spi->subjectPublicKey.length / 8,
-                              &pk, &size);
-    if (ret) {
-        hx509_set_error_string(context, 0, ret, "Failed to decode RSAPublicKey");
-        goto out;
-    }
-
-    rsa->n = heim_int2BN(&pk.modulus);
-    rsa->e = heim_int2BN(&pk.publicExponent);
-
-    free_RSAPublicKey(&pk);
-
-    if (rsa->n == NULL || rsa->e == NULL) {
         ret = ENOMEM;
         hx509_set_error_string(context, 0, ret, "out of memory");
@@ -642 +622 @@
     } else {
         if (retsize != data->length ||
-            memcmp(to, data->data, retsize) != 0)
+            ct_memcmp(to, data->data, retsize) != 0)
         {
             ret = HX509_CRYPTO_SIG_INVALID_FORMAT;
@@ -650 +630 @@
         free(to);
     }
+    ret = 0;
 
  out:
     free_DigestInfo(&di);
-    RSA_free(rsa);
+    if (rsa)
+        RSA_free(rsa);
     return ret;
 }
@@ -672 +654 @@
     int ret;
 
-    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, &asn1_oid_id_pkcs1_rsaEncryption) != 0)
+    if (signer->ops && der_heim_oid_cmp(signer->ops->key_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) != 0)
         return HX509_ALG_NOT_SUPP;
 
@@ -680 +662 @@
         sig_oid = signer->signature_alg;
 
-    if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_pkcs1_sha256WithRSAEncryption) == 0) {
+    if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_SHA512WITHRSAENCRYPTION) == 0) {
+        digest_alg = hx509_signature_sha512();
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_SHA384WITHRSAENCRYPTION) == 0) {
+        digest_alg = hx509_signature_sha384();
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_SHA256WITHRSAENCRYPTION) == 0) {
         digest_alg = hx509_signature_sha256();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_pkcs1_sha1WithRSAEncryption) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_SHA1WITHRSAENCRYPTION) == 0) {
         digest_alg = hx509_signature_sha1();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_pkcs1_md5WithRSAEncryption) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_MD5WITHRSAENCRYPTION) == 0) {
         digest_alg = hx509_signature_md5();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_pkcs1_md5WithRSAEncryption) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_MD5WITHRSAENCRYPTION) == 0) {
         digest_alg = hx509_signature_md5();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_dsa_with_sha1) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_DSA_WITH_SHA1) == 0) {
         digest_alg = hx509_signature_sha1();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_pkcs1_rsaEncryption) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) == 0) {
         digest_alg = hx509_signature_sha1();
-    } else if (der_heim_oid_cmp(sig_oid, &asn1_oid_id_heim_rsa_pkcs1_x509) == 0) {
+    } else if (der_heim_oid_cmp(sig_oid, ASN1_OID_ID_HEIM_RSA_PKCS1_X509) == 0) {
         digest_alg = NULL;
     } else
@@ -751 +737 @@
         ret = HX509_CMS_FAILED_CREATE_SIGATURE;
         hx509_set_error_string(context, 0, ret,
-                               "RSA private decrypt failed: %d", ret);
+                               "RSA private encrypt failed: %d", ret);
         return ret;
     }
@@ -767 +753 @@
                        const void *data,
                        size_t len,
+                       hx509_key_format_t format,
                        hx509_private_key private_key)
 {
-    const unsigned char *p = data;
-
-    private_key->private_key.rsa =
-        d2i_RSAPrivateKey(NULL, &p, len);
-    if (private_key->private_key.rsa == NULL) {
-        hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
-                               "Failed to parse RSA key");
-        return HX509_PARSING_KEY_FAILED;
-    }
-    private_key->signature_alg = &asn1_oid_id_pkcs1_sha1WithRSAEncryption;
+    switch (format) {
+    case HX509_KEY_FORMAT_DER: {
+        const unsigned char *p = data;
+
+        private_key->private_key.rsa =
+            d2i_RSAPrivateKey(NULL, &p, len);
+        if (private_key->private_key.rsa == NULL) {
+            hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
+                                   "Failed to parse RSA key");
+            return HX509_PARSING_KEY_FAILED;
+        }
+        private_key->signature_alg = ASN1_OID_ID_PKCS1_SHA1WITHRSAENCRYPTION;
+        break;
+
+    }
+    default:
+        return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
+    }
 
     return 0;
@@ -801 +796 @@
     spki->subjectPublicKey.length = len * 8;
 
-    ret = set_digest_alg(&spki->algorithm, &asn1_oid_id_pkcs1_rsaEncryption,
+    ret = set_digest_alg(&spki->algorithm, ASN1_OID_ID_PKCS1_RSAENCRYPTION,
                          "\x05\x00", 2);
     if (ret) {
@@ -829 +824 @@
 
     static const int default_rsa_e = 65537;
-    static const int default_rsa_bits = 1024;
+    static const int default_rsa_bits = 2048;
 
     private_key->private_key.rsa = RSA_new();
@@ -845 +840 @@
     if (ctx->num_bits)
         bits = ctx->num_bits;
-    else if (ctx->isCA)
-        bits *= 2;
 
     ret = RSA_generate_key_ex(private_key->private_key.rsa, bits, e, NULL);
@@ -855 +848 @@
         return HX509_PARSING_KEY_FAILED;
     }
-    private_key->signature_alg = &asn1_oid_id_pkcs1_sha1WithRSAEncryption;
+    private_key->signature_alg = ASN1_OID_ID_PKCS1_SHA1WITHRSAENCRYPTION;
 
     return 0;
@@ -863 +856 @@
 rsa_private_key_export(hx509_context context,
                        const hx509_private_key key,
+                       hx509_key_format_t format,
                        heim_octet_string *data)
 {
@@ -870 +864 @@
     data->length = 0;
 
-    ret = i2d_RSAPrivateKey(key->private_key.rsa, NULL);
-    if (ret <= 0) {
-        ret = EINVAL;
-        hx509_set_error_string(context, 0, ret,
+    switch (format) {
+    case HX509_KEY_FORMAT_DER:
+
+        ret = i2d_RSAPrivateKey(key->private_key.rsa, NULL);
+        if (ret <= 0) {
+            ret = EINVAL;
+            hx509_set_error_string(context, 0, ret,
                                "Private key is not exportable");
-        return ret;
-    }
-
-    data->data = malloc(ret);
-    if (data->data == NULL) {
-        ret = ENOMEM;
-        hx509_set_error_string(context, 0, ret, "malloc out of memory");
-        return ret;
-    }
-    data->length = ret;
-
-    {
-        unsigned char *p = data->data;
-        i2d_RSAPrivateKey(key->private_key.rsa, &p);
+            return ret;
+        }
+
+        data->data = malloc(ret);
+        if (data->data == NULL) {
+            ret = ENOMEM;
+            hx509_set_error_string(context, 0, ret, "malloc out of memory");
+            return ret;
+        }
+        data->length = ret;
+
+        {
+            unsigned char *p = data->data;
+            i2d_RSAPrivateKey(key->private_key.rsa, &p);
+        }
+        break;
+    default:
+        return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
     }
 
@@ -911 +912 @@
 static hx509_private_key_ops rsa_private_key_ops = {
     "RSA PRIVATE KEY",
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     NULL,
     rsa_private_key2SPKI,
@@ -934 +935 @@
 ecdsa_private_key_export(hx509_context context,
                          const hx509_private_key key,
+                         hx509_key_format_t format,
                          heim_octet_string *data)
 {
-    return ENOMEM;
+    return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
 }
 
@@ -944 +946 @@
                          const void *data,
                          size_t len,
+                         hx509_key_format_t format,
                          hx509_private_key private_key)
 {
@@ -978 +981 @@
     }
 
-    private_key->private_key.ecdsa = d2i_ECPrivateKey(pkey, &p, len);
-    if (private_key->private_key.ecdsa == NULL) {
-        hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
-                               "Failed to parse EC private key");
-        return HX509_PARSING_KEY_FAILED;
-    }
-    private_key->signature_alg = &asn1_oid_id_ecdsa_with_SHA256;
+    switch (format) {
+    case HX509_KEY_FORMAT_DER:
+
+        private_key->private_key.ecdsa = d2i_ECPrivateKey(pkey, &p, len);
+        if (private_key->private_key.ecdsa == NULL) {
+            hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
+                                   "Failed to parse EC private key");
+            return HX509_PARSING_KEY_FAILED;
+        }
+        private_key->signature_alg = ASN1_OID_ID_ECDSA_WITH_SHA256;
+        break;
+
+    default:
+        return HX509_CRYPTO_KEY_FORMAT_UNSUPPORTED;
+    }
 
     return 0;
@@ -1008 +1019 @@
 static hx509_private_key_ops ecdsa_private_key_ops = {
     "EC PRIVATE KEY",
-    &asn1_oid_id_ecPublicKey,
+    ASN1_OID_ID_ECPUBLICKEY,
     ecdsa_available,
     ecdsa_private_key2SPKI,
@@ -1121 +1132 @@
     if (private_key->private_key.dsa == NULL)
         return EINVAL;
-    private_key->signature_alg = &asn1_oid_id_dsa_with_sha1;
+    private_key->signature_alg = ASN1_OID_ID_DSA_WITH_SHA1;
 
     return 0;
@@ -1131 +1142 @@
 #endif
 
-
 static int
-sha1_verify_signature(hx509_context context,
-                      const struct signature_alg *sig_alg,
-                      const Certificate *signer,
-                      const AlgorithmIdentifier *alg,
-                      const heim_octet_string *data,
-                      const heim_octet_string *sig)
-{
-    unsigned char digest[SHA_DIGEST_LENGTH];
-    SHA_CTX m;
-
-    if (sig->length != SHA_DIGEST_LENGTH) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
-                               "SHA1 sigature have wrong length");
-        return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-
-    SHA1_Init(&m);
-    SHA1_Update(&m, data->data, data->length);
-    SHA1_Final (digest, &m);
-        
-    if (memcmp(digest, sig->data, SHA_DIGEST_LENGTH) != 0) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
-                               "Bad SHA1 sigature");
-        return HX509_CRYPTO_BAD_SIGNATURE;
-    }
-
-    return 0;
-}
-
-static int
-sha256_create_signature(hx509_context context,
+evp_md_create_signature(hx509_context context,
                         const struct signature_alg *sig_alg,
                         const hx509_private_key signer,
@@ -1171 +1151 @@
                         heim_octet_string *sig)
 {
-    SHA256_CTX m;
+    size_t sigsize = EVP_MD_size(sig_alg->evp_md());
+    EVP_MD_CTX *ctx;
 
     memset(sig, 0, sizeof(*sig));
@@ -1184 +1165 @@
         
 
-    sig->data = malloc(SHA256_DIGEST_LENGTH);
+    sig->data = malloc(sigsize);
     if (sig->data == NULL) {
         sig->length = 0;
         return ENOMEM;
     }
-    sig->length = SHA256_DIGEST_LENGTH;
-
-    SHA256_Init(&m);
-    SHA256_Update(&m, data->data, data->length);
-    SHA256_Final (sig->data, &m);
+    sig->length = sigsize;
+
+    ctx = EVP_MD_CTX_create();
+    EVP_DigestInit_ex(ctx, sig_alg->evp_md(), NULL);
+    EVP_DigestUpdate(ctx, data->data, data->length);
+    EVP_DigestFinal_ex(ctx, sig->data, NULL);
+    EVP_MD_CTX_destroy(ctx);
+
 
     return 0;
@@ -1199 +1183 @@
 
 static int
-sha256_verify_signature(hx509_context context,
+evp_md_verify_signature(hx509_context context,
                         const struct signature_alg *sig_alg,
                         const Certificate *signer,
@@ -1206 +1190 @@
                         const heim_octet_string *sig)
 {
-    unsigned char digest[SHA256_DIGEST_LENGTH];
-    SHA256_CTX m;
-
-    if (sig->length != SHA256_DIGEST_LENGTH) {
+    unsigned char digest[EVP_MAX_MD_SIZE];
+    EVP_MD_CTX *ctx;
+    size_t sigsize = EVP_MD_size(sig_alg->evp_md());
+
+    if (sig->length != sigsize || sigsize > sizeof(digest)) {
         hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
                                "SHA256 sigature have wrong length");
@@ -1215 +1200 @@
     }
 
-    SHA256_Init(&m);
-    SHA256_Update(&m, data->data, data->length);
-    SHA256_Final (digest, &m);
-        
-    if (memcmp(digest, sig->data, SHA256_DIGEST_LENGTH) != 0) {
+    ctx = EVP_MD_CTX_create();
+    EVP_DigestInit_ex(ctx, sig_alg->evp_md(), NULL);
+    EVP_DigestUpdate(ctx, data->data, data->length);
+    EVP_DigestFinal_ex(ctx, digest, NULL);
+    EVP_MD_CTX_destroy(ctx);
+
+    if (ct_memcmp(digest, sig->data, sigsize) != 0) {
         hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
-                               "Bad SHA256 sigature");
-        return HX509_CRYPTO_BAD_SIGNATURE;
-    }
-
-    return 0;
-}
-
-static int
-sha1_create_signature(hx509_context context,
-                      const struct signature_alg *sig_alg,
-                      const hx509_private_key signer,
-                      const AlgorithmIdentifier *alg,
-                      const heim_octet_string *data,
-                      AlgorithmIdentifier *signatureAlgorithm,
-                      heim_octet_string *sig)
-{
-    SHA_CTX m;
-
-    memset(sig, 0, sizeof(*sig));
-
-    if (signatureAlgorithm) {
-        int ret;
-        ret = set_digest_alg(signatureAlgorithm, sig_alg->sig_oid,
-                             "\x05\x00", 2);
-        if (ret)
-            return ret;
-    }
-        
-
-    sig->data = malloc(SHA_DIGEST_LENGTH);
-    if (sig->data == NULL) {
-        sig->length = 0;
-        return ENOMEM;
-    }
-    sig->length = SHA_DIGEST_LENGTH;
-
-    SHA1_Init(&m);
-    SHA1_Update(&m, data->data, data->length);
-    SHA1_Final (sig->data, &m);
-
-    return 0;
-}
-
-static int
-md5_verify_signature(hx509_context context,
-                     const struct signature_alg *sig_alg,
-                     const Certificate *signer,
-                     const AlgorithmIdentifier *alg,
-                     const heim_octet_string *data,
-                     const heim_octet_string *sig)
-{
-    unsigned char digest[MD5_DIGEST_LENGTH];
-    MD5_CTX m;
-
-    if (sig->length != MD5_DIGEST_LENGTH) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
-                               "MD5 sigature have wrong length");
-        return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-
-    MD5_Init(&m);
-    MD5_Update(&m, data->data, data->length);
-    MD5_Final (digest, &m);
-        
-    if (memcmp(digest, sig->data, MD5_DIGEST_LENGTH) != 0) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
-                               "Bad MD5 sigature");
-        return HX509_CRYPTO_BAD_SIGNATURE;
-    }
-
-    return 0;
-}
-
-static int
-md2_verify_signature(hx509_context context,
-                     const struct signature_alg *sig_alg,
-                     const Certificate *signer,
-                     const AlgorithmIdentifier *alg,
-                     const heim_octet_string *data,
-                     const heim_octet_string *sig)
-{
-    unsigned char digest[MD2_DIGEST_LENGTH];
-    MD2_CTX m;
-
-    if (sig->length != MD2_DIGEST_LENGTH) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
-                               "MD2 sigature have wrong length");
-        return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-
-    MD2_Init(&m);
-    MD2_Update(&m, data->data, data->length);
-    MD2_Final (digest, &m);
-        
-    if (memcmp(digest, sig->data, MD2_DIGEST_LENGTH) != 0) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_BAD_SIGNATURE,
-                               "Bad MD2 sigature");
+                               "Bad %s sigature", sig_alg->name);
         return HX509_CRYPTO_BAD_SIGNATURE;
     }
@@ -1328 +1219 @@
 static const struct signature_alg ecdsa_with_sha256_alg = {
     "ecdsa-with-sha256",
-    &asn1_oid_id_ecdsa_with_SHA256,
+    ASN1_OID_ID_ECDSA_WITH_SHA256,
     &_hx509_signature_ecdsa_with_sha256_data,
-    &asn1_oid_id_ecPublicKey,
+    ASN1_OID_ID_ECPUBLICKEY,
     &_hx509_signature_sha256_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
     0,
+    NULL,
     ecdsa_verify_signature,
     ecdsa_create_signature,
@@ -1341 +1233 @@
 static const struct signature_alg ecdsa_with_sha1_alg = {
     "ecdsa-with-sha1",
-    &asn1_oid_id_ecdsa_with_SHA1,
+    ASN1_OID_ID_ECDSA_WITH_SHA1,
     &_hx509_signature_ecdsa_with_sha1_data,
-    &asn1_oid_id_ecPublicKey,
+    ASN1_OID_ID_ECPUBLICKEY,
     &_hx509_signature_sha1_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
     0,
+    NULL,
     ecdsa_verify_signature,
     ecdsa_create_signature,
@@ -1356 +1249 @@
 static const struct signature_alg heim_rsa_pkcs1_x509 = {
     "rsa-pkcs1-x509",
-    &asn1_oid_id_heim_rsa_pkcs1_x509,
+    ASN1_OID_ID_HEIM_RSA_PKCS1_X509,
     &_hx509_signature_rsa_pkcs1_x509_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     NULL,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     0,
+    NULL,
     rsa_verify_signature,
     rsa_create_signature
@@ -1368 +1262 @@
 static const struct signature_alg pkcs1_rsa_sha1_alg = {
     "rsa",
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     &_hx509_signature_rsa_with_sha1_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     NULL,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
     0,
+    NULL,
     rsa_verify_signature,
     rsa_create_signature
 };
 
+static const struct signature_alg rsa_with_sha512_alg = {
+    "rsa-with-sha512",
+    ASN1_OID_ID_PKCS1_SHA512WITHRSAENCRYPTION,
+    &_hx509_signature_rsa_with_sha512_data,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
+    &_hx509_signature_sha512_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    rsa_verify_signature,
+    rsa_create_signature
+};
+
+static const struct signature_alg rsa_with_sha384_alg = {
+    "rsa-with-sha384",
+    ASN1_OID_ID_PKCS1_SHA384WITHRSAENCRYPTION,
+    &_hx509_signature_rsa_with_sha384_data,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
+    &_hx509_signature_sha384_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    rsa_verify_signature,
+    rsa_create_signature
+};
+
 static const struct signature_alg rsa_with_sha256_alg = {
     "rsa-with-sha256",
-    &asn1_oid_id_pkcs1_sha256WithRSAEncryption,
+    ASN1_OID_ID_PKCS1_SHA256WITHRSAENCRYPTION,
     &_hx509_signature_rsa_with_sha256_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     &_hx509_signature_sha256_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
     0,
+    NULL,
     rsa_verify_signature,
     rsa_create_signature
@@ -1392 +1314 @@
 static const struct signature_alg rsa_with_sha1_alg = {
     "rsa-with-sha1",
-    &asn1_oid_id_pkcs1_sha1WithRSAEncryption,
+    ASN1_OID_ID_PKCS1_SHA1WITHRSAENCRYPTION,
     &_hx509_signature_rsa_with_sha1_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     &_hx509_signature_sha1_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
     0,
+    NULL,
     rsa_verify_signature,
     rsa_create_signature
 };
 
+static const struct signature_alg rsa_with_sha1_alg_secsig = {
+    "rsa-with-sha1",
+    ASN1_OID_ID_SECSIG_SHA_1WITHRSAENCRYPTION,
+    &_hx509_signature_rsa_with_sha1_data,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
+    &_hx509_signature_sha1_data,
+    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|SELF_SIGNED_OK,
+    0,
+    NULL,
+    rsa_verify_signature,
+    rsa_create_signature
+};
+
 static const struct signature_alg rsa_with_md5_alg = {
     "rsa-with-md5",
-    &asn1_oid_id_pkcs1_md5WithRSAEncryption,
+    ASN1_OID_ID_PKCS1_MD5WITHRSAENCRYPTION,
     &_hx509_signature_rsa_with_md5_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
+    ASN1_OID_ID_PKCS1_RSAENCRYPTION,
     &_hx509_signature_md5_data,
     PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
     1230739889,
+    NULL,
     rsa_verify_signature,
     rsa_create_signature
 };
 
-static const struct signature_alg rsa_with_md2_alg = {
-    "rsa-with-md2",
-    &asn1_oid_id_pkcs1_md2WithRSAEncryption,
-    &_hx509_signature_rsa_with_md2_data,
-    &asn1_oid_id_pkcs1_rsaEncryption,
-    &_hx509_signature_md2_data,
-    PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG,
-    1230739889,
-    rsa_verify_signature,
-    rsa_create_signature
-};
-
 static const struct signature_alg dsa_sha1_alg = {
     "dsa-with-sha1",
-    &asn1_oid_id_dsa_with_sha1,
+    ASN1_OID_ID_DSA_WITH_SHA1,
     NULL,
-    &asn1_oid_id_dsa,
+    ASN1_OID_ID_DSA,
     &_hx509_signature_sha1_data,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     0,
+    NULL,
     dsa_verify_signature,
     /* create_signature */ NULL,
 };
 
+static const struct signature_alg sha512_alg = {
+    "sha-512",
+    ASN1_OID_ID_SHA512,
+    &_hx509_signature_sha512_data,
+    NULL,
+    NULL,
+    SIG_DIGEST,
+    0,
+    EVP_sha512,
+    evp_md_verify_signature,
+    evp_md_create_signature
+};
+
+static const struct signature_alg sha384_alg = {
+    "sha-384",
+    ASN1_OID_ID_SHA512,
+    &_hx509_signature_sha384_data,
+    NULL,
+    NULL,
+    SIG_DIGEST,
+    0,
+    EVP_sha384,
+    evp_md_verify_signature,
+    evp_md_create_signature
+};
+
 static const struct signature_alg sha256_alg = {
     "sha-256",
-    &asn1_oid_id_sha256,
+    ASN1_OID_ID_SHA256,
     &_hx509_signature_sha256_data,
     NULL,
@@ -1446 +1398 @@
     SIG_DIGEST,
     0,
-    sha256_verify_signature,
-    sha256_create_signature
+    EVP_sha256,
+    evp_md_verify_signature,
+    evp_md_create_signature
 };
 
 static const struct signature_alg sha1_alg = {
     "sha1",
-    &asn1_oid_id_secsig_sha_1,
+    ASN1_OID_ID_SECSIG_SHA_1,
     &_hx509_signature_sha1_data,
     NULL,
@@ -1458 +1411 @@
     SIG_DIGEST,
     0,
-    sha1_verify_signature,
-    sha1_create_signature
+    EVP_sha1,
+    evp_md_verify_signature,
+    evp_md_create_signature
 };
 
 static const struct signature_alg md5_alg = {
     "rsa-md5",
-    &asn1_oid_id_rsa_digest_md5,
+    ASN1_OID_ID_RSA_DIGEST_MD5,
     &_hx509_signature_md5_data,
     NULL,
@@ -1470 +1424 @@
     SIG_DIGEST,
     0,
-    md5_verify_signature
-};
-
-static const struct signature_alg md2_alg = {
-    "rsa-md2",
-    &asn1_oid_id_rsa_digest_md2,
-    &_hx509_signature_md2_data,
-    NULL,
-    NULL,
-    SIG_DIGEST,
-    0,
-    md2_verify_signature
+    EVP_md5,
+    evp_md_verify_signature,
+    NULL
 };
 
@@ -1494 +1439 @@
     &ecdsa_with_sha1_alg,
 #endif
+    &rsa_with_sha512_alg,
+    &rsa_with_sha384_alg,
     &rsa_with_sha256_alg,
     &rsa_with_sha1_alg,
+    &rsa_with_sha1_alg_secsig,
     &pkcs1_rsa_sha1_alg,
     &rsa_with_md5_alg,
-    &rsa_with_md2_alg,
     &heim_rsa_pkcs1_x509,
     &dsa_sha1_alg,
+    &sha512_alg,
+    &sha384_alg,
     &sha256_alg,
     &sha1_alg,
     &md5_alg,
-    &md2_alg,
     NULL
 };
@@ -1559 +1507 @@
 };
 
-static hx509_private_key_ops *
-find_private_alg(const heim_oid *oid)
+hx509_private_key_ops *
+hx509_find_private_alg(const heim_oid *oid)
 {
     int i;
@@ -1599 +1547 @@
 
 int
-_hx509_verify_signature(hx509_context context,
-                        const Certificate *signer,
-                        const AlgorithmIdentifier *alg,
-                        const heim_octet_string *data,
-                        const heim_octet_string *sig)
+_hx509_self_signed_valid(hx509_context context,
+                         const AlgorithmIdentifier *alg)
 {
     const struct signature_alg *md;
@@ -1612 +1557 @@
         return HX509_SIG_ALG_NO_SUPPORTED;
     }
+    if ((md->flags & SELF_SIGNED_OK) == 0) {
+        hx509_set_error_string(context, 0, HX509_CRYPTO_ALGORITHM_BEST_BEFORE,
+                               "Algorithm %s not trusted for self signatures",
+                               md->name);
+        return HX509_CRYPTO_ALGORITHM_BEST_BEFORE;
+    }
+    return 0;
+}
+
+
+int
+_hx509_verify_signature(hx509_context context,
+                        const hx509_cert cert,
+                        const AlgorithmIdentifier *alg,
+                        const heim_octet_string *data,
+                        const heim_octet_string *sig)
+{
+    const struct signature_alg *md;
+    const Certificate *signer = NULL;
+
+    if (cert)
+        signer = _hx509_get_cert(cert);
+
+    md = find_sig_alg(&alg->algorithm);
+    if (md == NULL) {
+        hx509_clear_error_string(context);
+        return HX509_SIG_ALG_NO_SUPPORTED;
+    }
     if (signer && (md->flags & PROVIDE_CONF) == 0) {
         hx509_clear_error_string(context);
@@ -1630 +1603 @@
     }
     return (*md->verify_signature)(context, md, signer, alg, data, sig);
-}
-
-int
-_hx509_verify_signature_bitstring(hx509_context context,
-                                  const Certificate *signer,
-                                  const AlgorithmIdentifier *alg,
-                                  const heim_octet_string *data,
-                                  const heim_bit_string *sig)
-{
-    heim_octet_string os;
-
-    if (sig->length & 7) {
-        hx509_set_error_string(context, 0, HX509_CRYPTO_SIG_INVALID_FORMAT,
-                               "signature not multiple of 8 bits");
-        return HX509_CRYPTO_SIG_INVALID_FORMAT;
-    }
-
-    os.data = sig->data;
-    os.length = sig->length / 8;
-
-    return _hx509_verify_signature(context, signer, alg, data, &os);
 }
 
@@ -1712 +1664 @@
     int ret;
     RSA *rsa;
-    RSAPublicKey pk;
     size_t size;
+    const unsigned char *p;
 
     ciphertext->data = NULL;
@@ -1720 +1672 @@
     spi = &cert->tbsCertificate.subjectPublicKeyInfo;
 
-    rsa = RSA_new();
+    p = spi->subjectPublicKey.data;
+    size = spi->subjectPublicKey.length / 8;
+    
+    rsa = d2i_RSAPublicKey(NULL, &p, size);
     if (rsa == NULL) {
-        hx509_set_error_string(context, 0, ENOMEM, "out of memory");
-        return ENOMEM;
-    }
-
-    ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
-                              spi->subjectPublicKey.length / 8,
-                              &pk, &size);
-    if (ret) {
-        RSA_free(rsa);
-        hx509_set_error_string(context, 0, ret, "RSAPublicKey decode failure");
-        return ret;
-    }
-    rsa->n = heim_int2BN(&pk.modulus);
-    rsa->e = heim_int2BN(&pk.publicExponent);
-
-    free_RSAPublicKey(&pk);
-
-    if (rsa->n == NULL || rsa->e == NULL) {
-        RSA_free(rsa);
         hx509_set_error_string(context, 0, ENOMEM, "out of memory");
         return ENOMEM;
@@ -1769 +1705 @@
     ciphertext->data = to;
 
-    ret = der_copy_oid(&asn1_oid_id_pkcs1_rsaEncryption, encryption_oid);
+    ret = der_copy_oid(ASN1_OID_ID_PKCS1_RSAENCRYPTION, encryption_oid);
     if (ret) {
         der_free_octet_string(ciphertext);
@@ -1780 +1716 @@
 
 int
-_hx509_private_key_private_decrypt(hx509_context context,
+hx509_private_key_private_decrypt(hx509_context context,
                                    const heim_octet_string *ciphertext,
                                    const heim_oid *encryption_oid,
@@ -1823 +1759 @@
 
 int
-_hx509_parse_private_key(hx509_context context,
+hx509_parse_private_key(hx509_context context,
                          const AlgorithmIdentifier *keyai,
                          const void *data,
                          size_t len,
+                         hx509_key_format_t format,
                          hx509_private_key *private_key)
 {
@@ -1834 +1771 @@
     *private_key = NULL;
 
-    ops = find_private_alg(&keyai->algorithm);
+    ops = hx509_find_private_alg(&keyai->algorithm);
     if (ops == NULL) {
         hx509_clear_error_string(context);
@@ -1840 +1777 @@
     }
 
-    ret = _hx509_private_key_init(private_key, ops, NULL);
+    ret = hx509_private_key_init(private_key, ops, NULL);
     if (ret) {
         hx509_set_error_string(context, 0, ret, "out of memory");
@@ -1846 +1783 @@
     }
 
-    ret = (*ops->import)(context, keyai, data, len, *private_key);
+    ret = (*ops->import)(context, keyai, data, len, format, *private_key);
     if (ret)
-        _hx509_private_key_free(private_key);
+        hx509_private_key_free(private_key);
 
     return ret;
@@ -1858 +1795 @@
 
 int
-_hx509_private_key2SPKI(hx509_context context,
+hx509_private_key2SPKI(hx509_context context,
                         hx509_private_key private_key,
                         SubjectPublicKeyInfo *spki)
@@ -1878 +1815 @@
     *ctx = NULL;
 
-    if (der_heim_oid_cmp(oid, &asn1_oid_id_pkcs1_rsaEncryption) != 0) {
+    if (der_heim_oid_cmp(oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) != 0) {
         hx509_set_error_string(context, 0, EINVAL,
                                "private key not an RSA key");
@@ -1929 +1866 @@
     *private_key = NULL;
 
-    ops = find_private_alg(ctx->key_oid);
+    ops = hx509_find_private_alg(ctx->key_oid);
     if (ops == NULL) {
         hx509_clear_error_string(context);
@@ -1935 +1872 @@
     }
 
-    ret = _hx509_private_key_init(private_key, ops, NULL);
+    ret = hx509_private_key_init(private_key, ops, NULL);
     if (ret) {
         hx509_set_error_string(context, 0, ret, "out of memory");
@@ -1943 +1880 @@
     ret = (*ops->generate_private_key)(context, ctx, *private_key);
     if (ret)
-        _hx509_private_key_free(private_key);
+        hx509_private_key_free(private_key);
 
     return ret;
@@ -1973 +1910 @@
 
 const AlgorithmIdentifier *
-hx509_signature_md2(void)
-{ return &_hx509_signature_md2_data; }
-
-const AlgorithmIdentifier *
 hx509_signature_ecPublicKey(void)
 { return &_hx509_signature_ecPublicKey; }
@@ -2007 +1940 @@
 hx509_signature_rsa_with_md5(void)
 { return &_hx509_signature_rsa_with_md5_data; }
-
-const AlgorithmIdentifier *
-hx509_signature_rsa_with_md2(void)
-{ return &_hx509_signature_rsa_with_md2_data; }
 
 const AlgorithmIdentifier *
@@ -2048 +1977 @@
 
 int
-_hx509_private_key_init(hx509_private_key *key,
+hx509_private_key_init(hx509_private_key *key,
                         hx509_private_key_ops *ops,
                         void *keydata)
@@ -2079 +2008 @@
 
 int
-_hx509_private_key_free(hx509_private_key *key)
+hx509_private_key_free(hx509_private_key *key)
 {
     if (key == NULL || *key == NULL)
@@ -2089 +2018 @@
         return 0;
 
-    if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, &asn1_oid_id_pkcs1_rsaEncryption) == 0) {
+    if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) == 0) {
         if ((*key)->private_key.rsa)
             RSA_free((*key)->private_key.rsa);
 #ifdef HAVE_OPENSSL
-    } else if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, &asn1_oid_id_ecPublicKey) == 0) {
+    } else if ((*key)->ops && der_heim_oid_cmp((*key)->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) == 0) {
         if ((*key)->private_key.ecdsa)
             EC_KEY_free((*key)->private_key.ecdsa);
@@ -2105 +2034 @@
 
 void
-_hx509_private_key_assign_rsa(hx509_private_key key, void *ptr)
+hx509_private_key_assign_rsa(hx509_private_key key, void *ptr)
 {
     if (key->private_key.rsa)
         RSA_free(key->private_key.rsa);
     key->private_key.rsa = ptr;
-    key->signature_alg = &asn1_oid_id_pkcs1_sha1WithRSAEncryption;
+    key->signature_alg = ASN1_OID_ID_PKCS1_SHA1WITHRSAENCRYPTION;
     key->md = &pkcs1_rsa_sha1_alg;
 }
@@ -2147 +2076 @@
 _hx509_private_key_export(hx509_context context,
                           const hx509_private_key key,
+                          hx509_key_format_t format,
                           heim_octet_string *data)
 {
@@ -2153 +2083 @@
         return HX509_UNIMPLEMENTED_OPERATION;
     }
-    return (*key->ops->export)(context, key, data);
+    return (*key->ops->export)(context, key, format, data);
 }
 
@@ -2176 +2106 @@
     char *name;
     int flags;
-#define ALLOW_WEAK 1
+#define ALLOW_WEAK      1
+
+#define PADDING_NONE    2
+#define PADDING_PKCS7   4
+#define PADDING_FLAGS   (2|4)
     const struct hx509cipher *cipher;
     const EVP_CIPHER *c;
@@ -2332 +2266 @@
         "rc2-cbc",
         CIPHER_WEAK,
-        &asn1_oid_id_pkcs3_rc2_cbc,
+        ASN1_OID_ID_PKCS3_RC2_CBC,
         NULL,
         EVP_rc2_cbc,
@@ -2341 +2275 @@
         "rc2-cbc",
         CIPHER_WEAK,
-        &asn1_oid_id_rsadsi_rc2_cbc,
+        ASN1_OID_ID_RSADSI_RC2_CBC,
         NULL,
         EVP_rc2_cbc,
@@ -2359 +2293 @@
         "des-ede3-cbc",
         0,
-        &asn1_oid_id_pkcs3_des_ede3_cbc,
+        ASN1_OID_ID_PKCS3_DES_EDE3_CBC,
         NULL,
         EVP_des_ede3_cbc,
@@ -2368 +2302 @@
         "des-ede3-cbc",
         0,
-        &asn1_oid_id_rsadsi_des_ede3_cbc,
+        ASN1_OID_ID_RSADSI_DES_EDE3_CBC,
         hx509_crypto_des_rsdi_ede3_cbc,
         EVP_des_ede3_cbc,
@@ -2377 +2311 @@
         "aes-128-cbc",
         0,
-        &asn1_oid_id_aes_128_cbc,
+        ASN1_OID_ID_AES_128_CBC,
         hx509_crypto_aes128_cbc,
         EVP_aes_128_cbc,
@@ -2386 +2320 @@
         "aes-192-cbc",
         0,
-        &asn1_oid_id_aes_192_cbc,
+        ASN1_OID_ID_AES_192_CBC,
         NULL,
         EVP_aes_192_cbc,
@@ -2395 +2329 @@
         "aes-256-cbc",
         0,
-        &asn1_oid_id_aes_256_cbc,
+        ASN1_OID_ID_AES_256_CBC,
         hx509_crypto_aes256_cbc,
         EVP_aes_256_cbc,
@@ -2462 +2396 @@
     }
 
+    (*crypto)->flags = PADDING_PKCS7;
     (*crypto)->cipher = cipher;
     (*crypto)->c = (*cipher->evp_func)();
@@ -2507 +2442 @@
 }
 
+void
+hx509_crypto_set_padding(hx509_crypto crypto, int padding_type)
+{
+    switch (padding_type) {
+    case HX509_CRYPTO_PADDING_PKCS7:
+        crypto->flags &= ~PADDING_FLAGS;
+        crypto->flags |= PADDING_PKCS7;
+        break;
+    case HX509_CRYPTO_PADDING_NONE:
+        crypto->flags &= ~PADDING_FLAGS;
+        crypto->flags |= PADDING_NONE;
+        break;
+    default:
+        _hx509_abort("Invalid padding");
+    }
+}
+
 int
 hx509_crypto_set_key_data(hx509_crypto crypto, const void *data, size_t length)
@@ -2598 +2550 @@
 {
     EVP_CIPHER_CTX evp;
-    size_t padsize;
+    size_t padsize, bsize;
     int ret;
 
@@ -2625 +2577 @@
     }
 
-    if (EVP_CIPHER_block_size(crypto->c) == 1) {
-        padsize = 0;
-    } else {
-        int bsize = EVP_CIPHER_block_size(crypto->c);
-        padsize = bsize - (length % bsize);
-    }
+    assert(crypto->flags & PADDING_FLAGS);
+
+    bsize = EVP_CIPHER_block_size(crypto->c);
+    padsize = 0;
+
+    if (crypto->flags & PADDING_NONE) {
+        if (bsize != 1 && (length % bsize) != 0)
+            return HX509_CMS_PADDING_ERROR;
+    } else if (crypto->flags & PADDING_PKCS7) {
+        if (bsize != 1)
+            padsize = bsize - (length % bsize);
+    }
+
     (*ciphertext)->length = length + padsize;
     (*ciphertext)->data = malloc(length + padsize);
@@ -2720 +2679 @@
     EVP_CIPHER_CTX_cleanup(&evp);
 
-    if (EVP_CIPHER_block_size(crypto->c) > 1) {
+    if ((crypto->flags & PADDING_PKCS7) && EVP_CIPHER_block_size(crypto->c) > 1) {
         int padsize;
         unsigned char *p;
@@ -2832 +2791 @@
                 PBE_string2key_func *s2k)
 {
-    if (der_heim_oid_cmp(oid, &asn1_oid_id_pbewithSHAAnd40BitRC2_CBC) == 0) {
+    if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND40BITRC2_CBC) == 0) {
         *c = EVP_rc2_40_cbc();
         *md = EVP_sha1();
         *s2k = PBE_string2key;
         return &asn1_oid_private_rc2_40;
-    } else if (der_heim_oid_cmp(oid, &asn1_oid_id_pbeWithSHAAnd128BitRC2_CBC) == 0) {
+    } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND128BITRC2_CBC) == 0) {
         *c = EVP_rc2_cbc();
         *md = EVP_sha1();
         *s2k = PBE_string2key;
-        return &asn1_oid_id_pkcs3_rc2_cbc;
+        return ASN1_OID_ID_PKCS3_RC2_CBC;
 #if 0
-    } else if (der_heim_oid_cmp(oid, &asn1_oid_id_pbeWithSHAAnd40BitRC4) == 0) {
+    } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND40BITRC4) == 0) {
         *c = EVP_rc4_40();
         *md = EVP_sha1();
         *s2k = PBE_string2key;
         return NULL;
-    } else if (der_heim_oid_cmp(oid, &asn1_oid_id_pbeWithSHAAnd128BitRC4) == 0) {
+    } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND128BITRC4) == 0) {
         *c = EVP_rc4();
         *md = EVP_sha1();
         *s2k = PBE_string2key;
-        return &asn1_oid_id_pkcs3_rc4;
+        return ASN1_OID_ID_PKCS3_RC4;
 #endif
-    } else if (der_heim_oid_cmp(oid, &asn1_oid_id_pbeWithSHAAnd3_KeyTripleDES_CBC) == 0) {
+    } else if (der_heim_oid_cmp(oid, ASN1_OID_ID_PBEWITHSHAAND3_KEYTRIPLEDES_CBC) == 0) {
         *c = EVP_des_ede3_cbc();
         *md = EVP_sha1();
         *s2k = PBE_string2key;
-        return &asn1_oid_id_pkcs3_des_ede3_cbc;
+        return ASN1_OID_ID_PKCS3_DES_EDE3_CBC;
     }
 
@@ -3035 +2994 @@
 _hx509_match_keys(hx509_cert c, hx509_private_key key)
 {
-    if (der_heim_oid_cmp(key->ops->key_oid, &asn1_oid_id_pkcs1_rsaEncryption) == 0)
+    if (der_heim_oid_cmp(key->ops->key_oid, ASN1_OID_ID_PKCS1_RSAENCRYPTION) == 0)
         return match_keys_rsa(c, key);
-    if (der_heim_oid_cmp(key->ops->key_oid, &asn1_oid_id_ecPublicKey) == 0)
+    if (der_heim_oid_cmp(key->ops->key_oid, ASN1_OID_ID_ECPUBLICKEY) == 0)
         return match_keys_ec(c, key);
     return 0;

trunk/server/source4/heimdal/lib/hx509/error.c

@@ -68 +68 @@
 hx509_clear_error_string(hx509_context context)
 {
-    free_error_string(context->error);
-    context->error = NULL;
+    if (context) {
+        free_error_string(context->error);
+        context->error = NULL;
+    }
 }
 
@@ -91 +93 @@
 {
     hx509_error msg;
+
+    if (context == NULL)
+        return;
 
     msg = calloc(1, sizeof(*msg));

trunk/server/source4/heimdal/lib/hx509/file.c

@@ -67 +67 @@
 
 static void
-header(FILE *f, const char *type, const char *str)
+print_pem_stamp(FILE *f, const char *type, const char *str)
 {
     fprintf(f, "-----%s %s-----\n", type, str);
@@ -83 +83 @@
 #define ENCODE_LINE_LENGTH      54
 
-    header(f, "BEGIN", type);
+    print_pem_stamp(f, "BEGIN", type);
 
     while (headers) {
@@ -111 +111 @@
     }
 
-    header(f, "END", type);
+    print_pem_stamp(f, "END", type);
 
     return 0;

trunk/server/source4/heimdal/lib/hx509/hx509.h

@@ -49 +49 @@
 typedef struct hx509_name_data *hx509_name;
 typedef struct hx509_private_key *hx509_private_key;
+typedef struct hx509_private_key_ops hx509_private_key_ops;
 typedef struct hx509_validate_ctx_data *hx509_validate_ctx;
 typedef struct hx509_verify_ctx_data *hx509_verify_ctx;
@@ -71 +72 @@
     HX509_VALIDATE_F_VERBOSE = 2
 };
+
+enum {
+    HX509_CRYPTO_PADDING_PKCS7 = 0,
+    HX509_CRYPTO_PADDING_NONE = 1
+};
+
+enum {
+    HX509_KEY_FORMAT_GUESS = 0,
+    HX509_KEY_FORMAT_DER = 1,
+    HX509_KEY_FORMAT_WIN_BACKUPKEY = 2
+};
+typedef uint32_t hx509_key_format_t;
 
 struct hx509_cert_attribute_data {
@@ -131 +144 @@
 #define HX509_CMS_EV_NO_KU_CHECK                        0x01
 #define HX509_CMS_EV_ALLOW_WEAK                         0x02
+#define HX509_CMS_EV_ID_NAME                            0x04
 
 /* flags to hx509_cms_verify_signed */
@@ -158 +172 @@
 #define HX509_CMS_SIGNATURE_ID_NAME                     0x02
 #define HX509_CMS_SIGNATURE_NO_SIGNER                   0x04
+#define HX509_CMS_SIGNATURE_LEAF_ONLY                   0x08
+#define HX509_CMS_SIGNATURE_NO_CERTS                    0x10
 
 /* hx509_verify_hostname nametype */

trunk/server/source4/heimdal/lib/hx509/hx509_err.et

@@ -67 +67 @@
 error_code RSA_PRIVATE_DECRYPT, "RSA private decryption failed"
 error_code ALGORITHM_BEST_BEFORE, "Algorithm has passed its best before date"
+error_code KEY_FORMAT_UNSUPPORTED, "Key format is unsupported"
 
 # revoke related errors

trunk/server/source4/heimdal/lib/hx509/hx_locl.h

@@ -40 +40 @@
 #include <ctype.h>
 #include <errno.h>
+#ifdef HAVE_STRINGS_H
 #include <strings.h>
+#endif
 #include <assert.h>
 #include <stdarg.h>
@@ -46 +48 @@
 #include <limits.h>
 
+#include <roken.h>
+
 #include <getarg.h>
 #include <base64.h>
 #include <hex.h>
-#include <roken.h>
 #include <com_err.h>
 #include <parse_units.h>
@@ -80 +83 @@
 typedef void (*_hx509_cert_release_func)(struct hx509_cert_data *, void *);
 
-typedef struct hx509_private_key_ops hx509_private_key_ops;
 
 #include "sel.h"

trunk/server/source4/heimdal/lib/hx509/keyset.c

@@ -3 +3 @@
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -199 +201 @@
 
 hx509_certs
-_hx509_certs_ref(hx509_certs certs)
+hx509_certs_ref(hx509_certs certs)
 {
     if (certs == NULL)
@@ -324 +326 @@
  * @param func function to call for each certificate. The function
  * should return non-zero to abort the iteration, that value is passed
- * back to te caller of hx509_certs_iter().
+ * back to the caller of hx509_certs_iter_f().
  * @param ctx context variable that will passed to the function.
  *
@@ -333 +335 @@
 
 int
-hx509_certs_iter(hx509_context context,
-                 hx509_certs certs,
-                 int (*func)(hx509_context, void *, hx509_cert),
-                 void *ctx)
+hx509_certs_iter_f(hx509_context context,
+                   hx509_certs certs,
+                   int (*func)(hx509_context, void *, hx509_cert),
+                   void *ctx)
 {
     hx509_cursor cursor;
@@ -365 +367 @@
 }
 
-
-/**
- * Function to use to hx509_certs_iter() as a function argument, the
- * ctx variable to hx509_certs_iter() should be a FILE file descriptor.
- *
- * @param context a hx509 context.
- * @param ctx used by hx509_certs_iter().
+/**
+ * Iterate over all certificates in a keystore and call an function
+ * for each fo them.
+ *
+ * @param context a hx509 context.
+ * @param certs certificate store to iterate over.
+ * @param func function to call for each certificate. The function
+ * should return non-zero to abort the iteration, that value is passed
+ * back to the caller of hx509_certs_iter().
+ *
+ * @return Returns an hx509 error code.
+ *
+ * @ingroup hx509_keyset
+ */
+
+#ifdef __BLOCKS__
+
+static int
+certs_iter(hx509_context context, void *ctx, hx509_cert cert)
+{
+    int (^func)(hx509_cert) = ctx;
+    return func(cert);
+}
+
+int
+hx509_certs_iter(hx509_context context,
+                 hx509_certs certs,
+                 int (^func)(hx509_cert))
+{
+    return hx509_certs_iter_f(context, certs, certs_iter, func);
+}
+#endif
+
+
+/**
+ * Function to use to hx509_certs_iter_f() as a function argument, the
+ * ctx variable to hx509_certs_iter_f() should be a FILE file descriptor.
+ *
+ * @param context a hx509 context.
+ * @param ctx used by hx509_certs_iter_f().
  * @param c a certificate
  *
@@ -588 +623 @@
     if (from == NULL)
         return 0;
-    return hx509_certs_iter(context, from, certs_merge_func, to);
+    return hx509_certs_iter_f(context, from, certs_merge_func, to);
 }
 
@@ -747 +782 @@
     int i;
     for (i = 0; keys[i]; i++)
-        _hx509_private_key_free(&keys[i]);
+        hx509_private_key_free(&keys[i]);
     free(keys);
 }

trunk/server/source4/heimdal/lib/hx509/ks_dir.c

@@ -94 +94 @@
 }
 
-
-
 static int
 dir_iter_start(hx509_context context,
@@ -116 +114 @@
         return errno;
     }
-    rk_cloexec(dirfd(d->dir));
+    rk_cloexec_dir(d->dir);
     d->certs = NULL;
     d->iter = NULL;

trunk/server/source4/heimdal/lib/hx509/ks_file.c

@@ -368 +368 @@
 {
     char *p, *pnext;
-    struct ks_file *f = NULL;
+    struct ks_file *ksf = NULL;
     hx509_private_key *keys = NULL;
     int ret;
@@ -381 +381 @@
         lock = _hx509_empty_lock;
 
-    f = calloc(1, sizeof(*f));
-    if (f == NULL) {
+    ksf = calloc(1, sizeof(*ksf));
+    if (ksf == NULL) {
         hx509_clear_error_string(context);
         return ENOMEM;
     }
-    f->format = format;
-
-    f->fn = strdup(residue);
-    if (f->fn == NULL) {
+    ksf->format = format;
+
+    ksf->fn = strdup(residue);
+    if (ksf->fn == NULL) {
         hx509_clear_error_string(context);
         ret = ENOMEM;
@@ -402 +402 @@
     if (flags & HX509_CERTS_CREATE) {
         ret = hx509_certs_init(context, "MEMORY:ks-file-create",
-                               0, lock, &f->certs);
+                               0, lock, &ksf->certs);
         if (ret)
             goto out;
-        *data = f;
+        *data = ksf;
         return 0;
     }
@@ -413 +413 @@
         goto out;
 
-    for (p = f->fn; p != NULL; p = pnext) {
+    for (p = ksf->fn; p != NULL; p = pnext) {
         FILE *f;
 
@@ -462 +462 @@
     }
 
-    ret = _hx509_collector_collect_certs(context, pem_ctx.c, &f->certs);
+    ret = _hx509_collector_collect_certs(context, pem_ctx.c, &ksf->certs);
     if (ret)
         goto out;
@@ -471 +471 @@
 
         for (i = 0; keys[i]; i++)
-            _hx509_certs_keys_add(context, f->certs, keys[i]);
+            _hx509_certs_keys_add(context, ksf->certs, keys[i]);
         _hx509_certs_keys_free(context, keys);
     }
@@ -477 +477 @@
 out:
     if (ret == 0)
-        *data = f;
+        *data = ksf;
     else {
-        if (f->fn)
-            free(f->fn);
-        free(f);
+        if (ksf->fn)
+            free(ksf->fn);
+        free(ksf);
     }
     if (pem_ctx.c)
@@ -508 +508 @@
 file_free(hx509_certs certs, void *data)
 {
-    struct ks_file *f = data;
-    hx509_certs_free(&f->certs);
-    free(f->fn);
-    free(f);
+    struct ks_file *ksf = data;
+    hx509_certs_free(&ksf->certs);
+    free(ksf->fn);
+    free(ksf);
     return 0;
 }
@@ -542 +542 @@
         if (_hx509_cert_private_key_exportable(c)) {
             hx509_private_key key = _hx509_cert_private_key(c);
-            ret = _hx509_private_key_export(context, key, &data);
+            ret = _hx509_private_key_export(context, key,
+                                            HX509_KEY_FORMAT_DER, &data);
             if (ret)
                 break;
@@ -559 +560 @@
            hx509_certs certs, void *data, int flags, hx509_lock lock)
 {
-    struct ks_file *f = data;
+    struct ks_file *ksf = data;
     struct store_ctx sc;
     int ret;
 
-    sc.f = fopen(f->fn, "w");
+    sc.f = fopen(ksf->fn, "w");
     if (sc.f == NULL) {
         hx509_set_error_string(context, 0, ENOENT,
@@ -570 +571 @@
     }
     rk_cloexec_file(sc.f);
-    sc.format = f->format;
-
-    ret = hx509_certs_iter(context, f->certs, store_func, &sc);
+    sc.format = ksf->format;
+
+    ret = hx509_certs_iter_f(context, ksf->certs, store_func, &sc);
     fclose(sc.f);
     return ret;
@@ -580 +581 @@
 file_add(hx509_context context, hx509_certs certs, void *data, hx509_cert c)
 {
-    struct ks_file *f = data;
-    return hx509_certs_add(context, f->certs, c);
+    struct ks_file *ksf = data;
+    return hx509_certs_add(context, ksf->certs, c);
 }
 
@@ -588 +589 @@
                 hx509_certs certs, void *data, void **cursor)
 {
-    struct ks_file *f = data;
-    return hx509_certs_start_seq(context, f->certs, cursor);
+    struct ks_file *ksf = data;
+    return hx509_certs_start_seq(context, ksf->certs, cursor);
 }
 
@@ -596 +597 @@
           hx509_certs certs, void *data, void *iter, hx509_cert *cert)
 {
-    struct ks_file *f = data;
-    return hx509_certs_next_cert(context, f->certs, iter, cert);
+    struct ks_file *ksf = data;
+    return hx509_certs_next_cert(context, ksf->certs, iter, cert);
 }
 
@@ -606 +607 @@
               void *cursor)
 {
-    struct ks_file *f = data;
-    return hx509_certs_end_seq(context, f->certs, cursor);
+    struct ks_file *ksf = data;
+    return hx509_certs_end_seq(context, ksf->certs, cursor);
 }
 
@@ -616 +617 @@
              hx509_private_key **keys)
 {
-    struct ks_file *f = data;
-    return _hx509_certs_keys_get(context, f->certs, keys);
+    struct ks_file *ksf = data;
+    return _hx509_certs_keys_get(context, ksf->certs, keys);
 }
 
@@ -626 +627 @@
              hx509_private_key key)
 {
-    struct ks_file *f = data;
-    return _hx509_certs_keys_add(context, f->certs, key);
+    struct ks_file *ksf = data;
+    return _hx509_certs_keys_add(context, ksf->certs, key);
 }
 

trunk/server/source4/heimdal/lib/hx509/ks_keychain.c

@@ -44 +44 @@
                               int, const CSSM_ACCESS_CREDENTIALS **);
 #define kSecCredentialTypeDefault 0
+#define CSSM_SIZE uint32_t
 #endif
 
@@ -259 +260 @@
     int ret;
 
-    ret = _hx509_private_key_init(&key, NULL, NULL);
+    ret = hx509_private_key_init(&key, NULL, NULL);
     if (ret)
         return ret;
@@ -302 +303 @@
         _hx509_abort("RSA_set_app_data");
 
-    _hx509_private_key_assign_rsa(key, rsa);
+    hx509_private_key_assign_rsa(key, rsa);
     _hx509_cert_assign_key(cert, key);
 

trunk/server/source4/heimdal/lib/hx509/ks_mem.c

@@ -79 +79 @@
     free(mem->certs.val);
     for (i = 0; mem->keys && mem->keys[i]; i++)
-        _hx509_private_key_free(&mem->keys[i]);
+        hx509_private_key_free(&mem->keys[i]);
     free(mem->keys);
     free(mem->name);
@@ -168 +168 @@
         if ((*keys)[i] == NULL) {
             while (--i >= 0)
-                _hx509_private_key_free(&(*keys)[i]);
+                hx509_private_key_free(&(*keys)[i]);
             hx509_set_error_string(context, 0, ENOMEM, "out of memory");
             return ENOMEM;

trunk/server/source4/heimdal/lib/hx509/ks_p11.c

@@ -614 +614 @@
     localKeyId.length = query[0].ulValueLen;
 
-    ret = _hx509_private_key_init(&key, NULL, NULL);
+    ret = hx509_private_key_init(&key, NULL, NULL);
     if (ret)
         return ret;
@@ -649 +649 @@
         _hx509_abort("RSA_set_app_data");
 
-    _hx509_private_key_assign_rsa(key, rsa);
+    hx509_private_key_assign_rsa(key, rsa);
 
     ret = _hx509_collector_private_key_add(context,
@@ -659 +659 @@
 
     if (ret) {
-        _hx509_private_key_free(&key);
+        hx509_private_key_free(&key);
         return ret;
     }
@@ -836 +836 @@
     }
 
-    getFuncs = dlsym(p->dl_handle, "C_GetFunctionList");
+    getFuncs = (CK_C_GetFunctionList) dlsym(p->dl_handle, "C_GetFunctionList");
     if (getFuncs == NULL) {
         ret = HX509_PKCS11_LOAD;
@@ -1140 +1140 @@
                 MECHNAME(CKM_SHA_1, "sha1");
                 MECHNAME(CKM_MD5, "md5");
-                MECHNAME(CKM_MD2, "md2");
                 MECHNAME(CKM_RIPEMD160, "ripemd-160");
                 MECHNAME(CKM_DES_ECB, "des-ecb");

trunk/server/source4/heimdal/lib/hx509/ks_p12.c

@@ -536 +536 @@
         ret = _hx509_private_key_export(context,
                                         _hx509_cert_private_key(c),
+                                        HX509_KEY_FORMAT_DER,
                                         &pki.privateKey);
         if (ret) {
@@ -572 +573 @@
     memset(&pfx, 0, sizeof(pfx));
 
-    ret = hx509_certs_iter(context, p12->certs, store_func, &as);
+    ret = hx509_certs_iter_f(context, p12->certs, store_func, &as);
     if (ret)
         goto out;

trunk/server/source4/heimdal/lib/hx509/lock.c

@@ -215 +215 @@
 hx509_lock_free(hx509_lock lock)
 {
-    hx509_certs_free(&lock->certs);
-    hx509_lock_reset_passwords(lock);
-    memset(lock, 0, sizeof(*lock));
-    free(lock);
+    if (lock) {
+        hx509_certs_free(&lock->certs);
+        hx509_lock_reset_passwords(lock);
+        memset(lock, 0, sizeof(*lock));
+        free(lock);
+    }
 }
 

trunk/server/source4/heimdal/lib/hx509/name.c

@@ -34 +34 @@
 #include "hx_locl.h"
 #include <wind.h>
+#include "char_map.h"
 
 /**
@@ -44 +45 @@
  * types are defined by OID and have long and short description. For
  * example id-at-commonName (2.5.4.3) have the long name CommonName
- * and short name CN. The string itself can be of serveral encoding,
+ * and short name CN. The string itself can be of several encoding,
  * UTF8, UTF16, Teltex string, etc. The type limit what encoding
  * should be used.
@@ -80 +81 @@
 
 static char *
-quote_string(const char *f, size_t len, size_t *rlen)
+quote_string(const char *f, size_t len, int flags, size_t *rlen)
 {
     size_t i, j, tolen;
-    const char *from = f;
-    char *to;
+    const unsigned char *from = (const unsigned char *)f;
+    unsigned char *to;
 
     tolen = len * 3 + 1;
@@ -92 +93 @@
 
     for (i = 0, j = 0; i < len; i++) {
-        if (from[i] == ' ' && i + 1 < len)
-            to[j++] = from[i];
-        else if (from[i] == ',' || from[i] == '=' || from[i] == '+' ||
-                 from[i] == '<' || from[i] == '>' || from[i] == '#' ||
-                 from[i] == ';' || from[i] == ' ')
-        {
+        unsigned char map = char_map[from[i]] & flags;
+        if (i == 0 && (map & Q_RFC2253_QUOTE_FIRST)) {
             to[j++] = '\\';
             to[j++] = from[i];
-        } else if (((unsigned char)from[i]) >= 32 && ((unsigned char)from[i]) <= 127) {
+        } else if ((i + 1) == len && (map & Q_RFC2253_QUOTE_LAST)) {
+
+            to[j++] = '\\';
             to[j++] = from[i];
-        } else {
-            int l = snprintf(&to[j], tolen - j - 1,
+        } else if (map & Q_RFC2253_QUOTE) {
+            to[j++] = '\\';
+            to[j++] = from[i];
+        } else if (map & Q_RFC2253_HEX) {
+            int l = snprintf((char *)&to[j], tolen - j - 1,
                              "#%02x", (unsigned char)from[i]);
             j += l;
+        } else {
+            to[j++] = from[i];
         }
     }
@@ -111 +115 @@
     assert(j < tolen);
     *rlen = j;
-    return to;
+    return (char *)to;
 }
 
@@ -122 +126 @@
 
     if (quote)
-        qs = quote_string(ss, len, &len);
+        qs = quote_string(ss, len, Q_RFC2253, &len);
     else
         qs = rk_UNCONST(ss);
@@ -204 +208 @@
 
     for (i = n->u.rdnSequence.len - 1 ; i >= 0 ; i--) {
-        int len;
+        size_t len;
 
         for (j = 0; j < n->u.rdnSequence.val[i].len; j++) {
@@ -215 +219 @@
             switch(ds->element) {
             case choice_DirectoryString_ia5String:
-                ss = ds->u.ia5String;
+                ss = ds->u.ia5String.data;
+                len = ds->u.ia5String.length;
                 break;
             case choice_DirectoryString_printableString:
-                ss = ds->u.printableString;
+                ss = ds->u.printableString.data;
+                len = ds->u.printableString.length;
                 break;
             case choice_DirectoryString_utf8String:
                 ss = ds->u.utf8String;
+                len = strlen(ss);
                 break;
             case choice_DirectoryString_bmpString: {
@@ -241 +248 @@
                 }
                 ss[k] = '\0';
+                len = k;
                 break;
             }
             case choice_DirectoryString_teletexString:
-                ss = malloc(ds->u.teletexString.length + 1);
-                if (ss == NULL)
-                    _hx509_abort("allocation failure"); /* XXX */
-                memcpy(ss, ds->u.teletexString.data, ds->u.teletexString.length);
-                ss[ds->u.teletexString.length] = '\0';
+                ss = ds->u.teletexString;
+                len = strlen(ss);
                 break;
             case choice_DirectoryString_universalString: {
@@ -268 +273 @@
                 }
                 ss[k] = '\0';
+                len = k;
                 break;
             }
@@ -277 +283 @@
             free(oidname);
             append_string(str, &total_len, "=", 1, 0);
-            len = strlen(ss);
             append_string(str, &total_len, ss, len, 1);
-            if (ds->element == choice_DirectoryString_universalString ||
-                ds->element == choice_DirectoryString_bmpString ||
-                ds->element == choice_DirectoryString_teletexString)
+            if (ds->element == choice_DirectoryString_bmpString ||
+                ds->element == choice_DirectoryString_universalString)
             {
                 free(ss);
@@ -325 +329 @@
 dsstringprep(const DirectoryString *ds, uint32_t **rname, size_t *rlen)
 {
-    wind_profile_flags flags = 0;
+    wind_profile_flags flags;
     size_t i, len;
     int ret;
@@ -335 +339 @@
     switch(ds->element) {
     case choice_DirectoryString_ia5String:
-        COPYCHARARRAY(ds, ia5String, len, name);
+        flags = WIND_PROFILE_LDAP;
+        COPYVOIDARRAY(ds, ia5String, len, name);
         break;
     case choice_DirectoryString_printableString:
-        flags = WIND_PROFILE_LDAP_CASE_EXACT_ATTRIBUTE;
-        COPYCHARARRAY(ds, printableString, len, name);
+        flags = WIND_PROFILE_LDAP;
+        flags |= WIND_PROFILE_LDAP_CASE_EXACT_ATTRIBUTE;
+        COPYVOIDARRAY(ds, printableString, len, name);
         break;
     case choice_DirectoryString_teletexString:
-        COPYVOIDARRAY(ds, teletexString, len, name);
+        flags = WIND_PROFILE_LDAP_CASE;
+        COPYCHARARRAY(ds, teletexString, len, name);
         break;
     case choice_DirectoryString_bmpString:
+        flags = WIND_PROFILE_LDAP;
         COPYVALARRAY(ds, bmpString, len, name);
         break;
     case choice_DirectoryString_universalString:
+        flags = WIND_PROFILE_LDAP;
         COPYVALARRAY(ds, universalString, len, name);
         break;
     case choice_DirectoryString_utf8String:
+        flags = WIND_PROFILE_LDAP;
         ret = wind_utf8ucs4_length(ds->u.utf8String, &len);
         if (ret)
@@ -373 +383 @@
         *rname = malloc(*rlen * sizeof((*rname)[0]));
 
-        ret = wind_stringprep(name, len, *rname, rlen,
-                              WIND_PROFILE_LDAP|flags);
+        ret = wind_stringprep(name, len, *rname, rlen, flags);
         if (ret == WIND_ERR_OVERRUN) {
             free(*rname);
@@ -400 +409 @@
 {
     uint32_t *ds1lp, *ds2lp;
-    size_t ds1len, ds2len;
+    size_t ds1len, ds2len, i;
     int ret;
 
@@ -414 +423 @@
     if (ds1len != ds2len)
         *diff = ds1len - ds2len;
-    else
-        *diff = memcmp(ds1lp, ds2lp, ds1len * sizeof(ds1lp[0]));
-
+    else {
+        for (i = 0; i < ds1len; i++) {
+            *diff = ds1lp[i] - ds2lp[i];
+            if (*diff)
+                break;
+        }
+    }
     free(ds1lp);
     free(ds2lp);
@@ -927 +940 @@
     switch (name->element) {
     case choice_GeneralName_otherName: {
-        char *str;
-        hx509_oid_sprint(&name->u.otherName.type_id, &str);
-        if (str == NULL)
+        char *oid;
+        hx509_oid_sprint(&name->u.otherName.type_id, &oid);
+        if (oid == NULL)
             return ENOMEM;
-        strpool = rk_strpoolprintf(strpool, "otherName: %s", str);
-        free(str);
+        strpool = rk_strpoolprintf(strpool, "otherName: %s", oid);
+        free(oid);
         break;
     }
     case choice_GeneralName_rfc822Name:
-        strpool = rk_strpoolprintf(strpool, "rfc822Name: %s\n",
-                                   name->u.rfc822Name);
+        strpool = rk_strpoolprintf(strpool, "rfc822Name: %.*s\n",
+                                   (int)name->u.rfc822Name.length,
+                                   (char *)name->u.rfc822Name.data);
         break;
     case choice_GeneralName_dNSName:
-        strpool = rk_strpoolprintf(strpool, "dNSName: %s\n",
-                                   name->u.dNSName);
+        strpool = rk_strpoolprintf(strpool, "dNSName: %.*s\n",
+                                   (int)name->u.dNSName.length,
+                                   (char *)name->u.dNSName.data);
         break;
     case choice_GeneralName_directoryName: {
@@ -958 +973 @@
     }
     case choice_GeneralName_uniformResourceIdentifier:
-        strpool = rk_strpoolprintf(strpool, "URI: %s",
-                                   name->u.uniformResourceIdentifier);
+        strpool = rk_strpoolprintf(strpool, "URI: %.*s",
+                                   (int)name->u.uniformResourceIdentifier.length,
+                                   (char *)name->u.uniformResourceIdentifier.data);
         break;
     case choice_GeneralName_iPAddress: {
@@ -987 +1003 @@
     }
     case choice_GeneralName_registeredID: {
-        char *str;
-        hx509_oid_sprint(&name->u.registeredID, &str);
-        if (str == NULL)
+        char *oid;
+        hx509_oid_sprint(&name->u.registeredID, &oid);
+        if (oid == NULL)
             return ENOMEM;
-        strpool = rk_strpoolprintf(strpool, "registeredID: %s", str);
-        free(str);
+        strpool = rk_strpoolprintf(strpool, "registeredID: %s", oid);
+        free(oid);
         break;
     }

trunk/server/source4/heimdal/lib/hx509/peer.c

@@ -3 +3 @@
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -145 +147 @@
         return ENOMEM;
     }
+    peer->val = ptr;
     ret = copy_AlgorithmIdentifier(val, &peer->val[peer->len]);
     if (ret == 0)

trunk/server/source4/heimdal/lib/hx509/print.c

@@ -1018 +1018 @@
     if (status.selfsigned) {
         ret = _hx509_verify_signature_bitstring(context,
-                                                c,
+                                                cert,
                                                 &c->signatureAlgorithm,
                                                 &c->tbsCertificate._save,

trunk/server/source4/heimdal/lib/hx509/req.c

@@ -47 +47 @@
 
 int
-_hx509_request_init(hx509_context context, hx509_request *req)
+hx509_request_init(hx509_context context, hx509_request *req)
 {
     *req = calloc(1, sizeof(**req));
@@ -57 +57 @@
 
 void
-_hx509_request_free(hx509_request *req)
+hx509_request_free(hx509_request *req)
 {
     if ((*req)->name)
@@ -70 +70 @@
 
 int
-_hx509_request_set_name(hx509_context context,
+hx509_request_set_name(hx509_context context,
                         hx509_request req,
                         hx509_name name)
@@ -85 +85 @@
 
 int
-_hx509_request_get_name(hx509_context context,
+hx509_request_get_name(hx509_context context,
                         hx509_request req,
                         hx509_name *name)
@@ -97 +97 @@
 
 int
-_hx509_request_set_SubjectPublicKeyInfo(hx509_context context,
+hx509_request_set_SubjectPublicKeyInfo(hx509_context context,
                                         hx509_request req,
                                         const SubjectPublicKeyInfo *key)
@@ -106 +106 @@
 
 int
-_hx509_request_get_SubjectPublicKeyInfo(hx509_context context,
+hx509_request_get_SubjectPublicKeyInfo(hx509_context context,
                                         hx509_request req,
                                         SubjectPublicKeyInfo *key)
@@ -144 +144 @@
     memset(&name, 0, sizeof(name));
     name.element = choice_GeneralName_dNSName;
-    name.u.dNSName = rk_UNCONST(hostname);
+    name.u.dNSName.data = rk_UNCONST(hostname);
+    name.u.dNSName.length = strlen(hostname);
 
     return add_GeneralNames(&req->san, &name);
@@ -158 +159 @@
     memset(&name, 0, sizeof(name));
     name.element = choice_GeneralName_rfc822Name;
-    name.u.dNSName = rk_UNCONST(email);
+    name.u.dNSName.data = rk_UNCONST(email);
+    name.u.dNSName.length = strlen(email);
 
     return add_GeneralNames(&req->san, &name);
@@ -270 +272 @@
     }
 
-    ret = _hx509_request_init(context, req);
+    ret = hx509_request_init(context, req);
     if (ret) {
         free_CertificationRequest(&r);
@@ -278 +280 @@
     rinfo = &r.certificationRequestInfo;
 
-    ret = _hx509_request_set_SubjectPublicKeyInfo(context, *req,
+    ret = hx509_request_set_SubjectPublicKeyInfo(context, *req,
                                                   &rinfo->subjectPKInfo);
     if (ret) {
         free_CertificationRequest(&r);
-        _hx509_request_free(req);
+        hx509_request_free(req);
         return ret;
     }
@@ -289 +291 @@
     if (ret) {
         free_CertificationRequest(&r);
-        _hx509_request_free(req);
-        return ret;
-    }
-    ret = _hx509_request_set_name(context, *req, subject);
+        hx509_request_free(req);
+        return ret;
+    }
+    ret = hx509_request_set_name(context, *req, subject);
     hx509_name_free(&subject);
     free_CertificationRequest(&r);
     if (ret) {
-        _hx509_request_free(req);
+        hx509_request_free(req);
         return ret;
     }

trunk/server/source4/heimdal/lib/hx509/revoke.c

@@ -224 +224 @@
 
         ret = _hx509_verify_signature_bitstring(context,
-                                                p,
+                                                parent,
                                                 &s->signatureAlgorithm,
                                                 &s->tbsCertificate._save,
@@ -241 +241 @@
 
     ret = _hx509_verify_signature_bitstring(context,
-                                            _hx509_get_cert(signer),
+                                            signer,
                                             &ocsp->ocsp.signatureAlgorithm,
                                             &ocsp->ocsp.tbsResponseData._save,
@@ -507 +507 @@
 
     ret = _hx509_verify_signature_bitstring(context,
-                                            _hx509_get_cert(signer),
+                                            signer,
                                             &crl->signatureAlgorithm,
                                             &crl->tbsCertList._save,
@@ -990 +990 @@
     ctx.parent = NULL;
 
-    ret = hx509_certs_iter(context, reqcerts, add_to_req, &ctx);
+    ret = hx509_certs_iter_f(context, reqcerts, add_to_req, &ctx);
     hx509_cert_free(ctx.parent);
     if (ret)
@@ -1154 +1154 @@
     fprintf(out, "appended certs:\n");
     if (ocsp.certs)
-        ret = hx509_certs_iter(context, ocsp.certs, hx509_ci_print_names, out);
+        ret = hx509_certs_iter_f(context, ocsp.certs, hx509_ci_print_names, out);
 
     free_ocsp(&ocsp);
@@ -1487 +1487 @@
     c.tbsCertList.crlExtensions = NULL;
 
-    ret = hx509_certs_iter(context, crl->revoked, add_revoked, &c.tbsCertList);
+    ret = hx509_certs_iter_f(context, crl->revoked, add_revoked, &c.tbsCertList);
     if (ret)
         goto out;

trunk/server/source4/heimdal/lib/hx509/sel-gram.c

@@ -1 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
 /* Skeleton implementation for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
@@ -30 +29 @@
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
@@ -48 +47 @@
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
@@ -56 +55 @@
 #define YYPURE 0
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 0
 
+
+
+/* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
+#line 34 "sel-gram.c"
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <hx_locl.h>
+
+
+
+
+/* Line 189 of yacc.c  */
+#line 85 "sel-gram.c"
+
+/* Enabling traces.  */
+#ifndef YYDEBUG
+# define YYDEBUG 0
+#endif
+
+/* Enabling verbose error messages.  */
+#ifdef YYERROR_VERBOSE
+# undef YYERROR_VERBOSE
+# define YYERROR_VERBOSE 1
+#else
+# define YYERROR_VERBOSE 0
+#endif
+
+/* Enabling the token table.  */
+#ifndef YYTOKEN_TABLE
+# define YYTOKEN_TABLE 0
+#endif
 
 
@@ -92 +134 @@
 
 
-/* Copy the first part of user declarations.  */
-#line 34 "heimdal/lib/hx509/sel-gram.y"
-
-#ifdef HAVE_CONFIG_H
-#include <config.h>
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <hx_locl.h>
-
-
-
-
-/* Enabling traces.  */
-#ifndef YYDEBUG
-# define YYDEBUG 0
-#endif
-
-/* Enabling verbose error messages.  */
-#ifdef YYERROR_VERBOSE
-# undef YYERROR_VERBOSE
-# define YYERROR_VERBOSE 1
-#else
-# define YYERROR_VERBOSE 0
-#endif
-
-/* Enabling the token table.  */
-#ifndef YYTOKEN_TABLE
-# define YYTOKEN_TABLE 0
-#endif
-
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 45 "heimdal/lib/hx509/sel-gram.y"
-{
+{
+
+/* Line 214 of yacc.c  */
+#line 45 "sel-gram.c"
+
     char *string;
     struct hx_expr *expr;
-}
-/* Line 187 of yacc.c.  */
-#line 134 "heimdal/lib/hx509/sel-gram.y"
-        YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 150 "sel-gram.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
-#endif
-
+#endif
 
 
@@ -143 +158 @@
 
 
-/* Line 216 of yacc.c.  */
-#line 147 "heimdal/lib/hx509/sel-gram.y"
+/* Line 264 of yacc.c  */
+#line 162 "sel-gram.c"
 
 #ifdef short
@@ -219 +234 @@
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
-#endif
-{
-  return i;
+YYID (yyi)
+    int yyi;
+#endif
+{
+  return yyi;
 }
 #endif
@@ -307 +322 @@
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-  };
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+};
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -343 +358 @@
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)                                        \
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)                           \
     do                                                                  \
       {                                                                 \
         YYSIZE_T yynewbytes;                                            \
-        YYCOPY (&yyptr->Stack, Stack, yysize);                          \
-        Stack = &yyptr->Stack;                                          \
+        YYCOPY (&yyptr->Stack_alloc, Stack, yysize);                    \
+        Stack = &yyptr->Stack_alloc;                                    \
         yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
         yyptr += yynewbytes / sizeof (*yyptr);                          \
@@ -738 +753 @@
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
@@ -782 +800 @@
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
                        &(yyvsp[(yyi + 1) - (yynrhs)])
                                        );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
@@ -1069 +1087 @@
 }
 
-
-
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
@@ -1088 +1103 @@
 
 
-
-/* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
@@ -1100 +1114 @@
 
 
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
@@ -1126 +1140 @@
 #endif
 {
-  
-  int yystate;
+
+
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
+
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
+
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
+
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
+
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
+
+    YYSIZE_T yystacksize;
+
   int yyn;
   int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
+  /* The variables used to return semantic value and location from the
+     action routines.  */
+  YYSTYPE yyval;
+
 #if YYERROR_VERBOSE
   /* Buffer for error messages, and its allocated size.  */
@@ -1141 +1180 @@
 #endif
 
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
-
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
-
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
-
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
-
-
-
 #define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))
-
-  YYSIZE_T yystacksize = YYINITDEPTH;
-
-  /* The variables used to return semantic value and location from the
-     action routines.  */
-  YYSTYPE yyval;
-
 
   /* The number of symbols on the RHS of the reduced rule.
@@ -1174 +1186 @@
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
@@ -1179 +1196 @@
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;             /* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
@@ -1185 +1202 @@
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
@@ -1215 +1231 @@
         yytype_int16 *yyss1 = yyss;
 
-
         /* Each stack pointer address is followed by the size of the
            data in use in that stack, in bytes.  This used to be a
@@ -1223 +1238 @@
                     &yyss1, yysize * sizeof (*yyssp),
                     &yyvs1, yysize * sizeof (*yyvsp),
-
                     &yystacksize);
 
@@ -1246 +1260 @@
         if (! yyptr)
           goto yyexhaustedlab;
-        YYSTACK_RELOCATE (yyss);
-        YYSTACK_RELOCATE (yyvs);
-
+        YYSTACK_RELOCATE (yyss_alloc, yyss);
+        YYSTACK_RELOCATE (yyvs_alloc, yyvs);
 #  undef YYSTACK_RELOCATE
         if (yyss1 != yyssa)
@@ -1259 +1272 @@
       yyvsp = yyvs + yysize - 1;
 
-
       YYDPRINTF ((stderr, "Stack size increased to %lu\n",
                   (unsigned long int) yystacksize));
@@ -1268 +1280 @@
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
+
+  if (yystate == YYFINAL)
+    YYACCEPT;
 
   goto yybackup;
@@ -1277 +1292 @@
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
-
-  /* First try to decide what to do without reference to look-ahead token.  */
+     lookahead token if we need one and don't already have one.  */
+
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
-
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* Not known => get a lookahead token if don't already have one.  */
+
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
@@ -1318 +1333 @@
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
@@ -1326 +1338 @@
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
@@ -1371 +1382 @@
     {
         case 2:
-#line 73 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 73 "sel-gram.c"
     { _hx509_expr_input.expr = (yyvsp[(1) - (1)].expr); }
     break;
 
   case 3:
-#line 75 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 75 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_TRUE, NULL, NULL); }
     break;
 
   case 4:
-#line 76 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 76 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_FALSE, NULL, NULL); }
     break;
 
   case 5:
-#line 77 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 77 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_NOT, (yyvsp[(2) - (2)].expr), NULL); }
     break;
 
   case 6:
-#line 78 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 78 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_AND, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); }
     break;
 
   case 7:
-#line 79 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 79 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_OR, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); }
     break;
 
   case 8:
-#line 80 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 80 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(2) - (3)].expr); }
     break;
 
   case 9:
-#line 81 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 81 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(op_COMP, (yyvsp[(1) - (1)].expr), NULL); }
     break;
 
   case 10:
-#line 84 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 84 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(expr_WORDS, (yyvsp[(1) - (1)].expr), NULL); }
     break;
 
   case 11:
-#line 85 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 85 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(expr_WORDS, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); }
     break;
 
   case 12:
-#line 88 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 88 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(comp_EQ, (yyvsp[(1) - (4)].expr), (yyvsp[(4) - (4)].expr)); }
     break;
 
   case 13:
-#line 89 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 89 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(comp_NE, (yyvsp[(1) - (4)].expr), (yyvsp[(4) - (4)].expr)); }
     break;
 
   case 14:
-#line 90 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 90 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(comp_TAILEQ, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); }
     break;
 
   case 15:
-#line 91 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 91 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(comp_IN, (yyvsp[(1) - (5)].expr), (yyvsp[(4) - (5)].expr)); }
     break;
 
   case 16:
-#line 92 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 92 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(comp_IN, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); }
     break;
 
   case 17:
-#line 95 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 95 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(1) - (1)].expr); }
     break;
 
   case 18:
-#line 96 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 96 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(1) - (1)].expr); }
     break;
 
   case 19:
-#line 97 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 97 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(1) - (1)].expr); }
     break;
 
   case 20:
-#line 98 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 98 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(1) - (1)].expr); }
     break;
 
   case 21:
-#line 101 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 101 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(expr_NUMBER, (yyvsp[(1) - (1)].string), NULL); }
     break;
 
   case 22:
-#line 102 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 102 "sel-gram.c"
     { (yyval.expr) = _hx509_make_expr(expr_STRING, (yyvsp[(1) - (1)].string), NULL); }
     break;
 
   case 23:
-#line 104 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 104 "sel-gram.c"
     {
                         (yyval.expr) = _hx509_make_expr(expr_FUNCTION, (yyvsp[(1) - (4)].string), (yyvsp[(3) - (4)].expr)); }
@@ -1482 +1537 @@
 
   case 24:
-#line 107 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 107 "sel-gram.c"
     { (yyval.expr) = (yyvsp[(3) - (4)].expr); }
     break;
 
   case 25:
-#line 110 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 110 "sel-gram.c"
     {
                         (yyval.expr) = _hx509_make_expr(expr_VAR, (yyvsp[(1) - (3)].string), (yyvsp[(3) - (3)].expr)); }
@@ -1493 +1552 @@
 
   case 26:
-#line 112 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 112 "sel-gram.c"
     {
                         (yyval.expr) = _hx509_make_expr(expr_VAR, (yyvsp[(1) - (1)].string), NULL); }
@@ -1499 +1560 @@
 
 
-/* Line 1267 of yacc.c.  */
-#line 1500 "heimdal/lib/hx509/sel-gram.y"
+
+/* Line 1455 of yacc.c  */
+#line 1563 "sel-gram.c"
       default: break;
     }
@@ -1510 +1572 @@
 
   *++yyvsp = yyval;
-
 
   /* Now `shift' the result of the reduction.  Determine what state
@@ -1576 +1637 @@
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
          error, discard it.  */
 
@@ -1593 +1654 @@
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
@@ -1650 +1711 @@
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
@@ -1677 +1735 @@
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
@@ -1688 +1746 @@
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
                  yytoken, &yylval);

trunk/server/source4/heimdal/lib/hx509/sel-gram.h

@@ -1 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
@@ -30 +29 @@
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
+
 
 /* Tokens.  */
@@ -67 +67 @@
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 45 "heimdal/lib/hx509/sel-gram.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 45 "sel-gram.c"
+
     char *string;
     struct hx_expr *expr;
-}
-/* Line 1489 of yacc.c.  */
-#line 76 "heimdal/lib/hx509/sel-gram.y"
-        YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 81 "sel-gram.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 extern YYSTYPE yylval;
 
+

trunk/server/source4/heimdal/lib/hx509/sel-lex.c

@@ -1 +1 @@
 #include "config.h"
 
-#line 3 "heimdal/lib/hx509/sel-lex.c"
+#line 3 "sel-lex.c"
 
 #define  YY_INT_ALIGNED short int
@@ -10 +10 @@
 #define YY_FLEX_MAJOR_VERSION 2
 #define YY_FLEX_MINOR_VERSION 5
-#define YY_FLEX_SUBMINOR_VERSION 34
+#define YY_FLEX_SUBMINOR_VERSION 35
 #if YY_FLEX_SUBMINOR_VERSION > 0
 #define FLEX_BETA
@@ -55 +55 @@
 typedef unsigned short int flex_uint16_t;
 typedef unsigned int flex_uint32_t;
-#endif /* ! C99 */
 
 /* Limits of integral types. */
@@ -85 +84 @@
 #define UINT32_MAX             (4294967295U)
 #endif
+
+#endif /* ! C99 */
 
 #endif /* ! FLEXINT_H */
@@ -142 +143 @@
 /* Size of default input buffer. */
 #ifndef YY_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k.
+ * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case.
+ * Ditto for the __ia64__ case accordingly.
+ */
+#define YY_BUF_SIZE 32768
+#else
 #define YY_BUF_SIZE 16384
+#endif /* __ia64__ */
 #endif
 
@@ -179 +188 @@
 
 #define unput(c) yyunput( c, (yytext_ptr)  )
-
-/* The following is because we cannot portably get our hands on size_t
- * (without autoconf's help, which isn't available because we want
- * flex-generated scanners to compile on their own).
- * Given that the standard has decreed that size_t exists since 1989,
- * I guess we can afford to depend on it. Manoj.
- */
 
 #ifndef YY_TYPEDEF_YY_SIZE_T
@@ -532 +534 @@
 struct hx_expr_input _hx509_expr_input;
 
+#ifndef YY_NULL
+#define YY_NULL 0
+#endif
+
 #define YY_NO_UNPUT 1
 
@@ -539 +545 @@
 #undef ECHO
 
-#line 541 "heimdal/lib/hx509/sel-lex.c"
+#line 547 "sel-lex.c"
 
 #define INITIAL 0
@@ -556 +562 @@
 
 static int yy_init_globals (void );
+
+/* Accessor methods to globals.
+   These are made visible to non-reentrant scanners for convenience. */
+
+int yylex_destroy (void );
+
+int yyget_debug (void );
+
+void yyset_debug (int debug_flag  );
+
+YY_EXTRA_TYPE yyget_extra (void );
+
+void yyset_extra (YY_EXTRA_TYPE user_defined  );
+
+FILE *yyget_in (void );
+
+void yyset_in  (FILE * in_str  );
+
+FILE *yyget_out (void );
+
+void yyset_out  (FILE * out_str  );
+
+int yyget_leng (void );
+
+char *yyget_text (void );
+
+int yyget_lineno (void );
+
+void yyset_lineno (int line_number  );
 
 /* Macros after this point can all be overridden by user definitions in
@@ -591 +626 @@
 /* Amount of stuff to slurp up with each read. */
 #ifndef YY_READ_BUF_SIZE
+#ifdef __ia64__
+/* On IA-64, the buffer size is 16k, not 8k */
+#define YY_READ_BUF_SIZE 16384
+#else
 #define YY_READ_BUF_SIZE 8192
+#endif /* __ia64__ */
 #endif
 
@@ -599 +639 @@
  * we now use fwrite().
  */
-#define ECHO fwrite( yytext, yyleng, 1, yyout )
+#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
 #endif
 
@@ -610 +650 @@
                 { \
                 int c = '*'; \
-                int n; \
+                size_t n; \
                 for ( n = 0; n < max_size && \
                              (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
@@ -692 +732 @@
         register int yy_act;
     
-#line 64 "sel-lex.l"
-
-
-#line 697 "heimdal/lib/hx509/sel-lex.c"
+#line 68 "sel-lex.l"
+
+
+#line 737 "sel-lex.c"
 
         if ( !(yy_init) )
@@ -780 +820 @@
 case 1:
 YY_RULE_SETUP
-#line 66 "sel-lex.l"
+#line 70 "sel-lex.l"
 { return kw_TRUE; }
         YY_BREAK
 case 2:
 YY_RULE_SETUP
-#line 67 "sel-lex.l"
+#line 71 "sel-lex.l"
 { return kw_FALSE; }
         YY_BREAK
 case 3:
 YY_RULE_SETUP
-#line 68 "sel-lex.l"
+#line 72 "sel-lex.l"
 { return kw_AND; }
         YY_BREAK
 case 4:
 YY_RULE_SETUP
-#line 69 "sel-lex.l"
+#line 73 "sel-lex.l"
 { return kw_OR; }
         YY_BREAK
 case 5:
 YY_RULE_SETUP
-#line 70 "sel-lex.l"
+#line 74 "sel-lex.l"
 { return kw_IN; }
         YY_BREAK
 case 6:
 YY_RULE_SETUP
-#line 71 "sel-lex.l"
+#line 75 "sel-lex.l"
 { return kw_TAILMATCH; }
         YY_BREAK
 case 7:
 YY_RULE_SETUP
-#line 73 "sel-lex.l"
+#line 77 "sel-lex.l"
 {
                           yylval.string = strdup ((const char *)yytext);
@@ -818 +858 @@
 case 8:
 YY_RULE_SETUP
-#line 77 "sel-lex.l"
+#line 81 "sel-lex.l"
 { yylval.string = handle_string(); return STRING; }
         YY_BREAK
@@ -824 +864 @@
 /* rule 9 can match eol */
 YY_RULE_SETUP
-#line 78 "sel-lex.l"
+#line 82 "sel-lex.l"
 { ++lineno; }
         YY_BREAK
 case 10:
 YY_RULE_SETUP
-#line 79 "sel-lex.l"
+#line 83 "sel-lex.l"
 { return *yytext; }
         YY_BREAK
 case 11:
 YY_RULE_SETUP
-#line 80 "sel-lex.l"
+#line 84 "sel-lex.l"
 ;
         YY_BREAK
 case 12:
 YY_RULE_SETUP
-#line 81 "sel-lex.l"
+#line 85 "sel-lex.l"
 ECHO;
         YY_BREAK
-#line 844 "heimdal/lib/hx509/sel-lex.c"
+#line 884 "sel-lex.c"
 case YY_STATE_EOF(INITIAL):
         yyterminate();
@@ -1600 +1640 @@
 /** Setup the input buffer state to scan the given bytes. The next call to yylex() will
  * scan from a @e copy of @a bytes.
- * @param bytes the byte buffer to scan
- * @param len the number of bytes in the buffer pointed to by @a bytes.
+ * @param yybytes the byte buffer to scan
+ * @param _yybytes_len the number of bytes in the buffer pointed to by @a bytes.
  * 
  * @return the newly allocated buffer state object.
@@ -1840 +1880 @@
 #define YYTABLES_NAME "yytables"
 
-#line 81 "sel-lex.l"
+#line 85 "sel-lex.l"
 
 

trunk/server/source4/heimdal/lib/hx509/sel-lex.l

@@ -53 +53 @@
 
 struct hx_expr_input _hx509_expr_input;
+
+#ifndef YY_NULL
+#define YY_NULL 0
+#endif
 
 #define YY_NO_UNPUT 1

trunk/server/source4/heimdal/lib/hx509/sel.c

@@ -176 +176 @@
     default:
         _hx509_abort("hx509 eval expr with unknown op: %d", (int)expr->op);
+        UNREACHABLE(return 0);
     }
 }