Skip to content

Commit 2f11e6a

Browse files
piyush-jenapiyush-jena
committed
packages: add aws-lc patches
Signed-off-by: Piyush Jena <[email protected]>
1 parent 0402f3d commit 2f11e6a

5 files changed

+3826
-1
lines changed

‎packages/libcrypto/1013-cherry-pick-Add-back-X509_STORE_get_verify_cb-and-X5.patch‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
From c9723d6b75f415c8ba46f95876b8fa14ca787857 Mon Sep 17 00:00:00 2001
2+
From: Sean McGrail <[email protected]>
3+
Date: Thu, 31 Jul 2025 15:13:47 -0700
4+
Subject: [PATCH] [cherry-pick] Add back X509_STORE_get_verify_cb and
5+
X509_STORE_set_lookup_crls_cb (#2587)
6+
7+
Cherry-picks https://github.com/aws/aws-lc/pull/2581
8+
9+
This change is outside of the FIPS module and does not affect its hash.
10+
11+
---
12+
13+
### Issues:
14+
Addresses V1681685441
15+
16+
### Description of changes:
17+
The following symbols were removed as part of two upstream merges in
18+
2024, which broke the ability to build the Azure SDK for C++ on both
19+
main and in the FIPS 3.x release. This was previously supported in the
20+
FIPS 2.x line, and was a bit unexpected. This partially reverts these
21+
commits to include back the necessary symbols.
22+
23+
X509_STORE_get_verify_cb:
24+
25+
https://github.com/aws/aws-lc/commit/884ad006425903bea38cf249352dd74f9f0597f7
26+
X509_STORE_set_lookup_crls_cb:
27+
28+
https://github.com/aws/aws-lc/commit/d0c25d154621528a50fcf2e01095460d6459da8c
29+
30+
https://github.com/aws/aws-lc/pull/1527 and
31+
https://github.com/aws/aws-lc/pull/1621
32+
33+
By submitting this pull request, I confirm that my contribution is made
34+
under the terms of the Apache 2.0 license and the ISC license.
35+
---
36+
crypto/x509/internal.h | 2 ++
37+
crypto/x509/x509_lu.c | 13 +++++++++++++
38+
crypto/x509/x509_test.cc | 39 +++++++++++++++++++++++++++++++++++++++
39+
crypto/x509/x509_vfy.c | 8 +++++++-
40+
include/openssl/x509.h | 13 +++++++++++++
41+
5 files changed, 74 insertions(+), 1 deletion(-)
42+
43+
diff --git a/crypto/x509/internal.h b/crypto/x509/internal.h
44+
index 2bb1fd45f..c72d97d1e 100644
45+
--- a/crypto/x509/internal.h
46+
+++ b/crypto/x509/internal.h
47+
@@ -308,6 +308,7 @@ struct x509_store_st {
48+
49+
// Callbacks for various operations
50+
X509_STORE_CTX_verify_cb verify_cb; // error callback
51+
+ X509_STORE_CTX_lookup_crls_fn lookup_crls;
52+
X509_STORE_CTX_get_crl_fn get_crl; // retrieve CRL
53+
X509_STORE_CTX_check_crl_fn check_crl; // Check CRL validity
54+
55+
@@ -342,6 +343,7 @@ struct x509_store_ctx_st {
56+
57+
// Callbacks for various operations
58+
X509_STORE_CTX_verify_cb verify_cb; // error callback
59+
+ X509_STORE_CTX_lookup_crls_fn lookup_crls;
60+
X509_STORE_CTX_get_crl_fn get_crl; // retrieve CRL
61+
X509_STORE_CTX_check_crl_fn check_crl; // Check CRL validity
62+
X509_STORE_CTX_verify_crit_oids_cb
63+
diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
64+
index 6daed4501..976d68845 100644
65+
--- a/crypto/x509/x509_lu.c
66+
+++ b/crypto/x509/x509_lu.c
67+
@@ -642,6 +642,19 @@ void X509_STORE_set_verify_cb(X509_STORE *ctx,
68+
ctx->verify_cb = verify_cb;
69+
}
70+
71+
+X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx) {
72+
+ return ctx->verify_cb;
73+
+}
74+
+
75+
+X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx) {
76+
+ return ctx->lookup_crls;
77+
+}
78+
+
79+
+void X509_STORE_set_lookup_crls(X509_STORE *ctx,
80+
+ X509_STORE_CTX_lookup_crls_fn lookup_crls) {
81+
+ ctx->lookup_crls = lookup_crls;
82+
+}
83+
+
84+
void X509_STORE_set_get_crl(X509_STORE *ctx,
85+
X509_STORE_CTX_get_crl_fn get_crl) {
86+
ctx->get_crl = get_crl;
87+
diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
88+
index 5a1eb32a1..11995c8fa 100644
89+
--- a/crypto/x509/x509_test.cc
90+
+++ b/crypto/x509/x509_test.cc
91+
@@ -31,6 +31,7 @@
92+
#include <openssl/err.h>
93+
#include <openssl/nid.h>
94+
#include <openssl/pem.h>
95+
+#include <openssl/pkcs7.h>
96+
#include <openssl/pool.h>
97+
#include <openssl/rand.h>
98+
#include <openssl/x509.h>
99+
@@ -8384,3 +8385,41 @@ TEST(X509Test, X509MultipleCustomExtensions) {
100+
// Check that |EXFLAG_CRITICAL| has been removed after validation.
101+
EXPECT_FALSE(X509_get_extension_flags(cert.get()) & EXFLAG_CRITICAL);
102+
}
103+
+
104+
+TEST(X509Test, StoreVerifyCallback) {
105+
+ bssl::UniquePtr<X509_STORE> store(X509_STORE_new());
106+
+ ASSERT_TRUE(store);
107+
+
108+
+ // Initially verify callback should be null
109+
+ EXPECT_EQ(nullptr, X509_STORE_get_verify_cb(store.get()));
110+
+
111+
+ // Store the callback pointer for comparison
112+
+ X509_STORE_CTX_verify_cb verify_cb = [](int ok, X509_STORE_CTX *ctx) -> int {
113+
+ return 1;
114+
+ };
115+
+
116+
+ // Set a custom verify callback
117+
+ X509_STORE_set_verify_cb(store.get(), verify_cb);
118+
+
119+
+ // Verify callback should now be set and match the stored pointer
120+
+ EXPECT_EQ(verify_cb, X509_STORE_get_verify_cb(store.get()));
121+
+}
122+
+
123+
+TEST(X509Test, StoreLookupCRLs) {
124+
+ bssl::UniquePtr<X509_STORE> store(X509_STORE_new());
125+
+ ASSERT_TRUE(store);
126+
+
127+
+ // Initially lookup_crls callback should be null
128+
+ EXPECT_EQ(nullptr, X509_STORE_get_lookup_crls(store.get()));
129+
+
130+
+ X509_STORE_CTX_lookup_crls_fn lookup_crls = [](X509_STORE_CTX *ctx,
131+
+ X509_NAME *nm) {
132+
+ return sk_X509_CRL_new_null();
133+
+ };
134+
+
135+
+ // Set the custom lookup_crls callback
136+
+ X509_STORE_set_lookup_crls(store.get(), lookup_crls);
137+
+
138+
+ // Lookup_crls callback should now be set and match the stored pointer
139+
+ EXPECT_EQ(lookup_crls, X509_STORE_get_lookup_crls(store.get()));
140+
+}
141+
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
142+
index f9fde323e..84fc5d6cb 100644
143+
--- a/crypto/x509/x509_vfy.c
144+
+++ b/crypto/x509/x509_vfy.c
145+
@@ -1257,7 +1257,7 @@ static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x) {
146+
}
147+
148+
// Lookup CRLs from store
149+
- skcrl = X509_STORE_CTX_get1_crls(ctx, nm);
150+
+ skcrl = ctx->lookup_crls(ctx, nm);
151+
152+
// If no CRLs found and a near match from get_crl_sk use that
153+
if (!skcrl && crl) {
154+
@@ -1760,6 +1760,12 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
155+
ctx->check_crl = check_crl;
156+
}
157+
158+
+ if (store->lookup_crls) {
159+
+ ctx->lookup_crls = store->lookup_crls;
160+
+ } else {
161+
+ ctx->lookup_crls = X509_STORE_get1_crls;
162+
+ }
163+
+
164+
ctx->verify_custom_crit_oids = null_verify_custom_crit_oids_callback;
165+
166+
return 1;
167+
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
168+
index 8a8247279..607409046 100644
169+
--- a/include/openssl/x509.h
170+
+++ b/include/openssl/x509.h
171+
@@ -2369,6 +2369,17 @@ OPENSSL_EXPORT int X509_STORE_set_purpose(X509_STORE *store, int purpose);
172+
OPENSSL_EXPORT int X509_STORE_set_trust(X509_STORE *store, int trust);
173+
174+
175+
+typedef STACK_OF(X509_CRL) *(*X509_STORE_CTX_lookup_crls_fn)(
176+
+ X509_STORE_CTX *ctx, X509_NAME *nm);
177+
+
178+
+OPENSSL_EXPORT X509_STORE_CTX_lookup_crls_fn X509_STORE_get_lookup_crls(X509_STORE *ctx);
179+
+
180+
+OPENSSL_EXPORT void X509_STORE_set_lookup_crls(
181+
+ X509_STORE *ctx, X509_STORE_CTX_lookup_crls_fn lookup_crls);
182+
+
183+
+#define X509_STORE_set_lookup_crls_cb(ctx, func) \
184+
+ X509_STORE_set_lookup_crls((ctx), (func))
185+
+
186+
// Certificate verification.
187+
//
188+
// An |X509_STORE_CTX| object represents a single certificate verification
189+
@@ -4344,6 +4355,8 @@ typedef int (*X509_STORE_CTX_verify_cb)(int, X509_STORE_CTX *);
190+
OPENSSL_EXPORT void X509_STORE_CTX_set_verify_cb(
191+
X509_STORE_CTX *ctx, int (*verify_cb)(int ok, X509_STORE_CTX *ctx));
192+
193+
+OPENSSL_EXPORT X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *ctx);
194+
+
195+
// X509_STORE_set_verify_cb acts like |X509_STORE_CTX_set_verify_cb| but sets
196+
// the verify callback for any |X509_STORE_CTX| created from this |X509_STORE|
197+
//

0 commit comments

Comments
 (0)