Print this page 
4853 illumos-gate is not lint-clean when built with openssl 1.0 (fix openssl 0.9.8 lint)
Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c
          +++ new/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c
↓ open down ↓ 2491 lines elided ↑ open up ↑ 
2492 2492  
2493 2493          /* Lookup by key hash */
2494 2494  
2495 2495          /* If key hash isn't SHA1 length then forget it */
2496 2496          if (id->value.byKey->length != SHA_DIGEST_LENGTH)
2497 2497                  return (NULL);
2498 2498  
2499 2499          keyhash = id->value.byKey->data;
2500 2500          /* Calculate hash of each key and compare */
2501 2501          for (i = 0; i < sk_X509_num(certs); i++) {
     2502 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
2502 2503                  X509 *x = sk_X509_value(certs, i);
2503 2504                  /* Use pubkey_digest to get the key ID value */
2504 2505                  (void) X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);
2505 2506                  if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
2506 2507                          return (x);
2507 2508          }
2508 2509          return (NULL);
2509 2510  }
2510 2511  
2511 2512  /* ocsp_find_signer() is copied from openssl source */
↓ open down ↓ 1119 lines elided ↑ open up ↑ 
3631 3632          }
3632 3633          cert_infos = (X509_INFO **)malloc(sk_X509_INFO_num(x509_info_stack) *
3633 3634              sizeof (X509_INFO *));
3634 3635          if (cert_infos == NULL) {
3635 3636                  (void) fclose(fp);
3636 3637                  rv = KMF_ERR_MEMORY;
3637 3638                  goto err;
3638 3639          }
3639 3640  
3640 3641          for (i = 0; i < sk_X509_INFO_num(x509_info_stack); i++) {
     3642 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
3641 3643                  cert_infos[ncerts] = sk_X509_INFO_value(x509_info_stack, i);
3642 3644                  ncerts++;
3643 3645          }
3644 3646  
3645 3647          if (ncerts == 0) {
3646 3648                  (void) fclose(fp);
3647 3649                  rv = KMF_ERR_CERT_NOT_FOUND;
3648 3650                  goto err;
3649 3651          }
3650 3652
↓ open down ↓ 61 lines elided ↑ open up ↑ 
3712 3714          }
3713 3715  
3714 3716          if (priv_key == NULL && pkey != NULL)
3715 3717                  EVP_PKEY_free(pkey);
3716 3718          else if (priv_key != NULL && pkey != NULL)
3717 3719                  *priv_key = pkey;
3718 3720  
3719 3721  err:
3720 3722          /* Cleanup the stack of X509 info records */
3721 3723          for (i = 0; i < sk_X509_INFO_num(x509_info_stack); i++) {
     3724 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
3722 3725                  info = (X509_INFO *)sk_X509_INFO_value(x509_info_stack, i);
3723 3726                  X509_INFO_free(info);
3724 3727          }
3725 3728          if (x509_info_stack)
3726 3729                  sk_X509_INFO_free(x509_info_stack);
3727 3730  
3728 3731          if (cert_infos != NULL)
3729 3732                  free(cert_infos);
3730 3733  
3731 3734          return (rv);
3732 3735  }
3733 3736  
3734 3737  static KMF_RETURN
3735 3738  openssl_parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *pin,
3736 3739          STACK_OF(EVP_PKEY) *keys, STACK_OF(X509) *certs)
3737 3740  {
3738 3741          KMF_RETURN ret;
3739 3742          int i;
3740 3743  
3741 3744          for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
     3745 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
3742 3746                  PKCS12_SAFEBAG *bag = sk_PKCS12_SAFEBAG_value(bags, i);
3743 3747                  ret = openssl_parse_bag(bag, pin, (pin ? strlen(pin) : 0),
3744 3748                      keys, certs);
3745 3749  
3746 3750                  if (ret != KMF_OK)
3747 3751                          return (ret);
3748 3752          }
3749 3753  
3750 3754          return (ret);
3751 3755  }
↓ open down ↓ 10 lines elided ↑ open up ↑ 
3762 3766                  pkey->attributes = sk_X509_ATTRIBUTE_new_null();
3763 3767                  if (pkey->attributes == NULL)
3764 3768                          return (KMF_ERR_MEMORY);
3765 3769          }
3766 3770          attr = X509_ATTRIBUTE_create(nid, attrib->type, attrib->value.ptr);
3767 3771          if (attr != NULL) {
3768 3772                  int i;
3769 3773                  X509_ATTRIBUTE *a;
3770 3774                  for (i = 0;
3771 3775                      i < sk_X509_ATTRIBUTE_num(pkey->attributes); i++) {
     3776 +                        /* LINTED E_BAD_PTR_CASE_ALIGN */
3772 3777                          a = sk_X509_ATTRIBUTE_value(pkey->attributes, i);
3773 3778                          if (OBJ_obj2nid(a->object) == nid) {
3774 3779                                  X509_ATTRIBUTE_free(a);
     3780 +                                /* LINTED E_BAD_PTR_CAST_ALIGN */
3775 3781                                  (void) sk_X509_ATTRIBUTE_set(pkey->attributes,
3776 3782                                      i, attr);
3777 3783                                  return (KMF_OK);
3778 3784                          }
3779 3785                  }
3780 3786                  if (sk_X509_ATTRIBUTE_push(pkey->attributes, attr) == NULL) {
3781 3787                          X509_ATTRIBUTE_free(attr);
3782 3788                          return (KMF_ERR_MEMORY);
3783 3789                  }
3784 3790          } else {
↓ open down ↓ 157 lines elided ↑ open up ↑ 
3942 3948                  }
3943 3949          } else if (!PKCS12_verify_mac(p12, pin, -1)) {
3944 3950                  return (KMF_ERR_AUTH_FAILED);
3945 3951          }
3946 3952  
3947 3953          if ((asafes = PKCS12_unpack_authsafes(p12)) == NULL)
3948 3954                  return (KMF_ERR_PKCS12_FORMAT);
3949 3955  
3950 3956          for (i = 0; ret == KMF_OK && i < sk_PKCS7_num(asafes); i++) {
3951 3957                  bags = NULL;
     3958 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
3952 3959                  p7 = sk_PKCS7_value(asafes, i);
3953 3960                  bagnid = OBJ_obj2nid(p7->type);
3954 3961  
3955 3962                  if (bagnid == NID_pkcs7_data) {
3956 3963                          bags = PKCS12_unpack_p7data(p7);
3957 3964                  } else if (bagnid == NID_pkcs7_encrypted) {
3958 3965                          bags = PKCS12_unpack_p7encdata(p7, pin,
3959 3966                              (pin ? strlen(pin) : 0));
3960 3967                  } else {
3961 3968                          continue;
↓ open down ↓ 257 lines elided ↑ open up ↑ 
4219 4226  static X509_ATTRIBUTE *
4220 4227  find_attr(STACK_OF(X509_ATTRIBUTE) *attrs, int nid)
4221 4228  {
4222 4229          X509_ATTRIBUTE *a;
4223 4230          int i;
4224 4231  
4225 4232          if (attrs == NULL)
4226 4233                  return (NULL);
4227 4234  
4228 4235          for (i = 0; i < sk_X509_ATTRIBUTE_num(attrs); i++) {
     4236 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
4229 4237                  a = sk_X509_ATTRIBUTE_value(attrs, i);
4230 4238                  if (OBJ_obj2nid(a->object) == nid)
4231 4239                          return (a);
4232 4240          }
4233 4241          return (NULL);
4234 4242  }
4235 4243  
4236 4244  static KMF_RETURN
4237 4245  convertToRawKey(EVP_PKEY *pkey, KMF_RAW_KEY_DATA *key)
4238 4246  {
↓ open down ↓ 20 lines elided ↑ open up ↑ 
4259 4267                          return (KMF_ERR_BAD_PARAMETER);
4260 4268          }
4261 4269          /*
4262 4270           * If friendlyName, add it to record.
4263 4271           */
4264 4272          attr = find_attr(pkey->attributes, NID_friendlyName);
4265 4273          if (attr != NULL) {
4266 4274                  ASN1_TYPE *ty = NULL;
4267 4275                  int numattr = sk_ASN1_TYPE_num(attr->value.set);
4268 4276                  if (attr->single == 0 && numattr > 0) {
     4277 +                        /* LINTED E_BAD_PTR_CAST_ALIGN */
4269 4278                          ty = sk_ASN1_TYPE_value(attr->value.set, 0);
4270 4279                  }
4271 4280                  if (ty != NULL) {
4272 4281  #if OPENSSL_VERSION_NUMBER < 0x10000000L
4273 4282                          key->label = uni2asc(ty->value.bmpstring->data,
4274 4283                              ty->value.bmpstring->length);
4275 4284  #else
4276 4285                          key->label = OPENSSL_uni2asc(ty->value.bmpstring->data,
4277 4286                              ty->value.bmpstring->length);
4278 4287  #endif
↓ open down ↓ 3 lines elided ↑ open up ↑ 
4282 4291          }
4283 4292  
4284 4293          /*
4285 4294           * If KeyID, add it to record as a KMF_DATA object.
4286 4295           */
4287 4296          attr = find_attr(pkey->attributes, NID_localKeyID);
4288 4297          if (attr != NULL) {
4289 4298                  ASN1_TYPE *ty = NULL;
4290 4299                  int numattr = sk_ASN1_TYPE_num(attr->value.set);
4291 4300                  if (attr->single == 0 && numattr > 0) {
     4301 +                        /* LINTED E_BAD_PTR_CAST_ALIGN */
4292 4302                          ty = sk_ASN1_TYPE_value(attr->value.set, 0);
4293 4303                  }
4294 4304                  key->id.Data = (uchar_t *)malloc(
4295 4305                      ty->value.octet_string->length);
4296 4306                  if (key->id.Data == NULL)
4297 4307                          return (KMF_ERR_MEMORY);
4298 4308                  (void) memcpy(key->id.Data, ty->value.octet_string->data,
4299 4309                      ty->value.octet_string->length);
4300 4310                  key->id.Length = ty->value.octet_string->length;
4301 4311          } else {
↓ open down ↓ 10 lines elided ↑ open up ↑ 
4312 4322          STACK_OF(X509) *sslcert,
4313 4323          STACK_OF(X509) *sslcacerts,
4314 4324          KMF_RAW_KEY_DATA **keylist, int *nkeys,
4315 4325          KMF_X509_DER_CERT **certlist, int *ncerts)
4316 4326  {
4317 4327          KMF_RETURN rv = KMF_OK;
4318 4328          KMF_RAW_KEY_DATA key;
4319 4329          int i;
4320 4330  
4321 4331          for (i = 0; sslkeys != NULL && i < sk_EVP_PKEY_num(sslkeys); i++) {
     4332 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
4322 4333                  EVP_PKEY *pkey = sk_EVP_PKEY_value(sslkeys, i);
4323 4334                  rv = convertToRawKey(pkey, &key);
4324 4335                  if (rv == KMF_OK)
4325 4336                          rv = add_key_to_list(keylist, &key, nkeys);
4326 4337  
4327 4338                  if (rv != KMF_OK)
4328 4339                          return (rv);
4329 4340          }
4330 4341  
4331 4342          /* Now add the certificate to the certlist */
4332 4343          for (i = 0; sslcert != NULL && i < sk_X509_num(sslcert); i++) {
     4344 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
4333 4345                  X509 *cert = sk_X509_value(sslcert, i);
4334 4346                  rv = add_cert_to_list(kmfh, cert, certlist, ncerts);
4335 4347                  if (rv != KMF_OK)
4336 4348                          return (rv);
4337 4349          }
4338 4350  
4339 4351          /* Also add any included CA certs to the list */
4340 4352          for (i = 0; sslcacerts != NULL && i < sk_X509_num(sslcacerts); i++) {
4341 4353                  X509 *c;
4342 4354                  /*
4343 4355                   * sk_X509_value() is macro that embeds a cast to (X509 *).
4344 4356                   * Here it translates into ((X509 *)sk_value((ca), (i))).
4345 4357                   * Lint is complaining about the embedded casting, and
4346 4358                   * to fix it, you need to fix openssl header files.
4347 4359                   */
     4360 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
4348 4361                  c = sk_X509_value(sslcacerts, i);
4349 4362  
4350 4363                  /* Now add the ca cert to the certlist */
4351 4364                  rv = add_cert_to_list(kmfh, c, certlist, ncerts);
4352 4365                  if (rv != KMF_OK)
4353 4366                          return (rv);
4354 4367          }
4355 4368          return (rv);
4356 4369  }
4357 4370
↓ open down ↓ 1046 lines elided ↑ open up ↑ 
5404 5417          /* Check to see if the certificate serial number is revoked */
5405 5418          revoke_stack = X509_CRL_get_REVOKED(xcrl);
5406 5419          if (sk_X509_REVOKED_num(revoke_stack) <= 0) {
5407 5420                  /* No revoked certificates in the CRL file */
5408 5421                  SET_ERROR(kmfh, ERR_get_error());
5409 5422                  ret = KMF_ERR_EMPTY_CRL;
5410 5423                  goto end;
5411 5424          }
5412 5425  
5413 5426          for (i = 0; i < sk_X509_REVOKED_num(revoke_stack); i++) {
     5427 +                /* LINTED E_BAD_PTR_CAST_ALIGN */
5414 5428                  revoke = sk_X509_REVOKED_value(revoke_stack, i);
5415 5429                  if (ASN1_INTEGER_cmp(xcert->cert_info->serialNumber,
5416 5430                      revoke->serialNumber) == 0) {
5417 5431                          break;
5418 5432                  }
5419 5433          }
5420 5434  
5421 5435          if (i < sk_X509_REVOKED_num(revoke_stack)) {
5422 5436                  ret = KMF_OK;
5423 5437          } else {
↓ open down ↓ 160 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX