1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
// OpenVPN -- An application to securely tunnel IP networks
// over a single port, with support for SSL/TLS-based
// session authentication and key exchange,
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012- OpenVPN Inc.
//
// SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-only WITH openvpn3-openssl-exception
//
// Wrap an OpenSSL X509Store object
#pragma once
#include <openvpn/common/size.hpp>
#include <openvpn/common/exception.hpp>
#include <openvpn/pki/cclist.hpp>
#include <openvpn/openssl/util/error.hpp>
#include <openvpn/openssl/pki/x509.hpp>
#include <openvpn/openssl/pki/crl.hpp>
namespace openvpn::OpenSSLPKI {
class X509Store
{
public:
OPENVPN_EXCEPTION(x509_store_error);
typedef CertCRLListTemplate<X509List, CRLList> CertCRLList;
X509Store()
: x509_store_(nullptr)
{
}
explicit X509Store(const CertCRLList &cc)
{
init();
// Load cert list
{
for (const auto &e : cc.certs)
{
if (!::X509_STORE_add_cert(x509_store_, e.obj()))
throw x509_store_error("X509_STORE_add_cert(");
}
}
// Load CRL list
{
if (cc.crls.defined())
{
::X509_STORE_set_flags(x509_store_, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
for (const auto &e : cc.crls)
{
if (!::X509_STORE_add_crl(x509_store_, e.obj()))
throw x509_store_error("X509_STORE_add_crl");
}
}
}
}
X509_STORE *obj() const
{
return x509_store_;
}
X509_STORE *release()
{
X509_STORE *ret = x509_store_;
x509_store_ = nullptr;
return ret;
}
~X509Store()
{
if (x509_store_)
::X509_STORE_free(x509_store_);
}
private:
void init()
{
x509_store_ = ::X509_STORE_new();
if (!x509_store_)
throw x509_store_error("X509_STORE_new");
}
::X509_STORE *x509_store_;
};
} // namespace openvpn::OpenSSLPKI
|
