// File: /workspace/github_c_makefile_star2_O0/fm4dd[P]learn-ssl/certverify-adv.c
// Function: main
int main() {

  X509          *error_cert = NULL;
  X509_NAME    *certsubject = NULL;
  STACK_OF(X509_INFO) *list = NULL;
  X509_STORE_CTX  *vrfy_ctx = NULL;
  int cert_counter = 0;
  int vrfy_err, i, ret, depth;
  unsigned int vrfy_flag;
  char *vrfy_name = NULL;
  struct stat ca_stat;

  struct Vrfy_Flags {
    unsigned long flag_code;
            char* flag_name;
            char* flag_desc;
  };

  struct Vrfy_Flags flagslist[MAXFLAGS];
  flagslist[0].flag_code  = 0x1;
  flagslist[0].flag_name  = "X509_V_FLAG_CB_ISSUER_CHECK";
  flagslist[0].flag_desc  = "This flag allows debugging of certificate issuer checks. It sends issuer+subject information to the verification call back function.";
  flagslist[1].flag_code  = 0x2;
  flagslist[1].flag_name  = "X509_V_FLAG_USE_CHECK_TIME";
  flagslist[1].flag_desc  = "This flag allows using check time instead of current time";
  flagslist[2].flag_code  = 0x4;
  flagslist[2].flag_name  = "X509_V_FLAG_CRL_CHECK";
  flagslist[2].flag_desc  = "This flag enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found.";
  flagslist[3].flag_code  = 0x8;
  flagslist[3].flag_name  = "X509_V_FLAG_CRL_CHECK_ALL";
  flagslist[3].flag_desc  = "This flag enables CRL checking for the entire certificate chain. If enabled, CRLs are expected to be available in the X509_STORE structure. There is no auto-download of CRLs from the CRL distribution points extension.";
  flagslist[4].flag_code  = 0x10;
  flagslist[4].flag_name  = "X509_V_FLAG_IGNORE_CRITICAL";
  flagslist[4].flag_desc  = "This flag disables critical extension checking. By default, any unhandled critical extensions in certificates or (if checked) CRLs results in a fatal error. If this flag is set, unhandled critical extensions are ignored. Setting this option can be a security risk.";
  flagslist[5].flag_code  = 0x20;
  flagslist[5].flag_name  = "X509_V_FLAG_X509_STRICT";
  flagslist[5].flag_desc  = "This flag disables workarounds for some broken certificates and makes the verification strictly apply X509 rules.";
  flagslist[6].flag_code  = 0x40;
  flagslist[6].flag_name  = "X509_V_FLAG_ALLOW_PROXY_CERTS";
  flagslist[6].flag_desc  = "This flag enables proxy certificate verification.";
  flagslist[7].flag_code  = 0x80;
  flagslist[7].flag_name  = "X509_V_FLAG_POLICY_CHECK";
  flagslist[7].flag_desc  = "This flag enables certificate policy checking. By default, no policy checking is peformed. Additional information is sent to the verification callback relating to policy checking.";
  flagslist[8].flag_code  = 0x100;
  flagslist[8].flag_name  = "X509_V_FLAG_EXPLICIT_POLICY";
  flagslist[8].flag_desc  = "This flag is enabling policy checking per RFC3280. When enabled, all certificates in the path must contain an acceptable policy identifier in the certificate policies extension.";
  flagslist[9].flag_code  = 0x200;
  flagslist[9].flag_name  = "X509_V_FLAG_INHIBIT_ANY";
  flagslist[9].flag_desc  = "If this flag is set, the value indicates the number of additional certificates that may appear in the path before policy mapping is no longer permitted.  For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.";
  flagslist[10].flag_code = 0x400;
  flagslist[10].flag_name = "X509_V_FLAG_INHIBIT_MAP";
  flagslist[10].flag_desc = "If this flag is set, the value indicates the number of additional certificates that may appear in the path before policy mapping is no longer permitted.  For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.";
  flagslist[11].flag_code = 0x800;
  flagslist[11].flag_name = "X509_V_FLAG_NOTIFY_POLICY";
  flagslist[11].flag_desc = "This flag sends extra policy information to the cllback function.";
  flagslist[12].flag_code = 0x1000;
  flagslist[12].flag_name = "X509_V_FLAG_EXTENDED_CRL_SUPPORT";
  flagslist[12].flag_desc = "This flag enables extended CRL features such as indirect CRLs, alternate CRL signing keys.";
  flagslist[13].flag_code = 0x2000;
  flagslist[13].flag_name = "X509_V_FLAG_USE_DELTAS";
  flagslist[13].flag_desc = "This flag enables the use of Delta CRL's, if available. OpenSSL's Delta CRL checking is currently primitive. Only a single delta can be used and constructed CRLs are not maintained.";
  flagslist[14].flag_code = 0x4000;
  flagslist[14].flag_name = "X509_V_FLAG_CHECK_SS_SIGNATURE";
  flagslist[14].flag_desc = "This flag enables the check if the root CA has a self-signed cerificate signature. By default this check is disabled because it doesn't add any additional security. In some cases, applications might want to check the signature anyway. A side effect of not checking the root CA signature is that disabled or unsupported message digests on the root CA are not treated as fatal errors.";

  /* ---------------------------------------------------------- *
   * Create the Input/Output BIO's.                             *
   * ---------------------------------------------------------- */
  outbio  = BIO_new(BIO_s_file());
  outbio = BIO_new_fp(stdout, BIO_NOCLOSE);

  /* ---------------------------------------------------------- *
   * Load the cert file into a BIO and then into a x509 struct. *
   * ---------------------------------------------------------- */
  certbio = BIO_new(BIO_s_file());
  ret = BIO_read_filename(certbio, cert_filestr);

  if (! (cert = PEM_read_bio_X509(certbio, NULL, 0, NULL))) {
    BIO_printf(outbio, "Error loading cert into memory: %s\n", cert_filestr);
    exit(1);
  }

  /* ---------------------------------------------------------- *
   * Load a CA cert file into a BIO and then into a x509 stack. *
   * ---------------------------------------------------------- */
  list = X509_load_ca_file(&cert_counter, ca_stat, ca_bundlestr);

  /* ---------------------------------------------------------- *
   * Create a verification context from the stack, add the cert *
   * ---------------------------------------------------------- */
  vrfy_ctx = verify_mem_store(list); 
  //vrfy_ctx = verify_mem_stack(list);
  //vrfy_ctx = verify_file_direct(ca_bundlestr);

  /* ---------------------------------------------------------- *
   * Set the verification options and depth for this operation. *
   * ---------------------------------------------------------- */
  param = X509_VERIFY_PARAM_new();
  //X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CB_ISSUER_CHECK);
  X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_X509_STRICT);
  X509_VERIFY_PARAM_set_depth(param, 5);

  X509_STORE_CTX_set_verify_cb(vrfy_ctx, verify_callback);
  /* ---------------------------------------------------------- *
   * Check the verification settings used for this operation.   *
   * ---------------------------------------------------------- */
  vrfy_flag = X509_VERIFY_PARAM_get_flags(param);
  for(i=0; i<MAXFLAGS; i++) {
  depth = X509_VERIFY_PARAM_get_depth(param);
    if(flagslist[i].flag_code == vrfy_flag) 
      vrfy_name = (flagslist[i].flag_name);
  }

  BIO_printf(outbio, "Verification check flags: %#x [%s]\n", vrfy_flag, vrfy_name);
  BIO_printf(outbio, "Verification depth limit: %d\n", depth);
  BIO_printf(outbio, "Verification CA cert num: %d CA certs provided\n", cert_counter);


  /* ---------------------------------------------------------- *
   * Check the complete cert chain can be build and validated.  *
   * Returns 1 on success, 0 on verification failures, and -1   *
   * for trouble with the ctx object (i.e. missing certificate) *
   * ---------------------------------------------------------- */
  ret = X509_verify_cert(vrfy_ctx);
  BIO_printf(outbio, "Verification return code: %d\n", ret);

  /* ---------------------------------------------------------- *
   * A negative return value indicates a verification error     *
   * ---------------------------------------------------------- */
  if (ret < 0) {
    BIO_printf(outbio, "Error loading CA cert or chain file: %s\n", ca_bundlestr);
    exit(1);
  }

  /* ---------------------------------------------------------- *
   * For verification return of 0 or 1, check validation result *
   * ---------------------------------------------------------- */
  vrfy_err = X509_STORE_CTX_get_error(vrfy_ctx);
  BIO_printf(outbio, "Verification result text: %s\n",
             X509_verify_cert_error_string(vrfy_err));

  /* ---------------------------------------------------------- *
   * The error handling below shows how to get failure details  *
   * from the offending certificate.                            *
   * ---------------------------------------------------------- */
  if(ret == 0) {
    /*  get the offending certificate causing the failure */
    error_cert  = X509_STORE_CTX_get_current_cert(vrfy_ctx);
    certsubject = X509_NAME_new();
    certsubject = X509_get_subject_name(error_cert);
    BIO_printf(outbio, "\nVerification certsubject: ---------------start----------------------\n");
    X509_NAME_print_ex(outbio, certsubject, 0, XN_FLAG_MULTILINE);
    BIO_printf(outbio, "\nVerification certsubject: ----------------End-----------------------\n");
  }

  /* ---------------------------------------------------------- *
   * Free up all structures                                     *
   * ---------------------------------------------------------- */

  X509_VERIFY_PARAM_free(param);
  X509_STORE_CTX_free(vrfy_ctx); 
  BIO_free_all(certbio);
  BIO_free_all(outbio);
  exit(0);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x2e0, %rsp            # imm = 0x2E0
movl $0x0, -0x4(%rbp)
movq $0x0, -0x10(%rbp)
movq $0x0, -0x18(%rbp)
movq $0x0, -0x20(%rbp)
movq $0x0, -0x28(%rbp)
movl $0x0, -0x2c(%rbp)
movq $0x0, -0x48(%rbp)
movq $0x1, -0x240(%rbp)
leaq 0xc32(%rip), %rax       # 0x3045
movq %rax, -0x238(%rbp)
leaq 0xc40(%rip), %rax       # 0x3061
movq %rax, -0x230(%rbp)
movq $0x2, -0x228(%rbp)
leaq 0xcac(%rip), %rax       # 0x30e6
movq %rax, -0x220(%rbp)
leaq 0xcb9(%rip), %rax       # 0x3101
movq %rax, -0x218(%rbp)
movq $0x4, -0x210(%rbp)
leaq 0xcda(%rip), %rax       # 0x313b
movq %rax, -0x208(%rbp)
leaq 0xce2(%rip), %rax       # 0x3151
movq %rax, -0x200(%rbp)
movq $0x8, -0x1f8(%rbp)
leaq 0xd47(%rip), %rax       # 0x31cf
movq %rax, -0x1f0(%rbp)
leaq 0xd53(%rip), %rax       # 0x31e9
movq %rax, -0x1e8(%rbp)
movq $0x10, -0x1e0(%rbp)
leaq 0xe14(%rip), %rax       # 0x32c3
movq %rax, -0x1d8(%rbp)
leaq 0xe22(%rip), %rax       # 0x32df
movq %rax, -0x1d0(%rbp)
movq $0x20, -0x1c8(%rbp)
leaq 0xf12(%rip), %rax       # 0x33e8
movq %rax, -0x1c0(%rbp)
leaq 0xf1c(%rip), %rax       # 0x3400
movq %rax, -0x1b8(%rbp)
movq $0x40, -0x1b0(%rbp)
leaq 0xf75(%rip), %rax       # 0x3472
movq %rax, -0x1a8(%rbp)
leaq 0xf85(%rip), %rax       # 0x3490
movq %rax, -0x1a0(%rbp)
movq $0x80, -0x198(%rbp)
leaq 0xf9e(%rip), %rax       # 0x34c2
movq %rax, -0x190(%rbp)
leaq 0xfa9(%rip), %rax       # 0x34db
movq %rax, -0x188(%rbp)
movq $0x100, -0x180(%rbp) # imm = 0x100
leaq 0x1044(%rip), %rax      # 0x358f
movq %rax, -0x178(%rbp)
leaq 0x1052(%rip), %rax      # 0x35ab
movq %rax, -0x170(%rbp)
movq $0x200, -0x168(%rbp) # imm = 0x200
leaq 0x10eb(%rip), %rax      # 0x365d
movq %rax, -0x160(%rbp)
leaq 0x10f5(%rip), %rax      # 0x3675
movq %rax, -0x158(%rbp)
movq $0x400, -0x150(%rbp) # imm = 0x400
leaq 0x122c(%rip), %rax      # 0x37c5
movq %rax, -0x148(%rbp)
leaq 0x10ce(%rip), %rax      # 0x3675
movq %rax, -0x140(%rbp)
movq $0x800, -0x138(%rbp) # imm = 0x800
leaq 0x121d(%rip), %rax      # 0x37dd
movq %rax, -0x130(%rbp)
leaq 0x1229(%rip), %rax      # 0x37f7
movq %rax, -0x128(%rbp)
movq $0x1000, -0x120(%rbp) # imm = 0x1000
leaq 0x1252(%rip), %rax      # 0x3839
movq %rax, -0x118(%rbp)
leaq 0x1265(%rip), %rax      # 0x385a
movq %rax, -0x110(%rbp)
movq $0x2000, -0x108(%rbp) # imm = 0x2000
leaq 0x12a7(%rip), %rax      # 0x38b5
movq %rax, -0x100(%rbp)
leaq 0x12b0(%rip), %rax      # 0x38cc
movq %rax, -0xf8(%rbp)
movq $0x4000, -0xf0(%rbp) # imm = 0x4000
leaq 0x134d(%rip), %rax      # 0x3982
movq %rax, -0xe8(%rbp)
leaq 0x135e(%rip), %rax      # 0x39a1
movq %rax, -0xe0(%rbp)
callq 0x2060
movq %rax, %rdi
callq 0x2260
movq %rax, 0x4072(%rip)      # 0x66d0
movq 0x396b(%rip), %rax      # 0x5fd0
movq (%rax), %rdi
xorl %esi, %esi
callq 0x20e0
movq %rax, 0x405a(%rip)      # 0x66d0
callq 0x2060
movq %rax, %rdi
callq 0x2260
movq %rax, 0x403e(%rip)      # 0x66c8
movq 0x4037(%rip), %rdi      # 0x66c8
movl $0x6c, %esi
movl $0x3, %edx
leaq 0x98e(%rip), %rcx       # 0x3030
callq 0x2050
movl %eax, -0x38(%rbp)
movq 0x4017(%rip), %rdi      # 0x66c8
xorl %eax, %eax
movl %eax, %ecx
movq %rcx, %rsi
movq %rcx, %rdx
callq 0x2280
movq %rax, 0x4019(%rip)      # 0x66e0
cmpq $0x0, %rax
jne 0x26f3
movq 0x3ffc(%rip), %rdi      # 0x66d0
leaq 0x1445(%rip), %rsi      # 0x3b20
leaq 0x94e(%rip), %rdx       # 0x3030
movb $0x0, %al
callq 0x22b0
movl $0x1, %edi
callq 0x21c0
movq %rsp, %rdi
movl $0x12, %ecx
leaq -0xd8(%rbp), %rsi
rep  movsq (%rsi), %es:(%rdi)
leaq 0x904(%rip), %rsi       # 0x3010
leaq -0x2c(%rbp), %rdi
callq 0x2950
movq %rax, -0x20(%rbp)
movq -0x20(%rbp), %rdi
callq 0x2aa0
movq %rax, -0x28(%rbp)
callq 0x2200
movq %rax, 0x3fb6(%rip)      # 0x66e8
movq 0x3faf(%rip), %rdi      # 0x66e8
movl $0x20, %esi
callq 0x2220
movq 0x3f9e(%rip), %rdi      # 0x66e8
movl $0x5, %esi
callq 0x2270
movq -0x28(%rbp), %rdi
leaq 0x441(%rip), %rsi       # 0x2ba0
callq 0x21d0
movq 0x3f7d(%rip), %rdi      # 0x66e8
callq 0x21f0
movl %eax, -0x40(%rbp)
movl $0x0, -0x34(%rbp)
cmpl $0xf, -0x34(%rbp)
jge 0x27d3
movq 0x3f61(%rip), %rdi      # 0x66e8
callq 0x2230
movl %eax, -0x3c(%rbp)
movslq -0x34(%rbp), %rcx
leaq -0x240(%rbp), %rax
imulq $0x18, %rcx, %rcx
addq %rcx, %rax
movq (%rax), %rax
movl -0x40(%rbp), %ecx
cmpq %rcx, %rax
jne 0x27c6
movslq -0x34(%rbp), %rcx
leaq -0x240(%rbp), %rax
imulq $0x18, %rcx, %rcx
addq %rcx, %rax
movq 0x8(%rax), %rax
movq %rax, -0x48(%rbp)
jmp 0x27c8
movl -0x34(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x34(%rbp)
jmp 0x277a
movq 0x3ef6(%rip), %rdi      # 0x66d0
movl -0x40(%rbp), %edx
movq -0x48(%rbp), %rcx
leaq 0x135c(%rip), %rsi      # 0x3b44
movb $0x0, %al
callq 0x22b0
movq 0x3eda(%rip), %rdi      # 0x66d0
movl -0x3c(%rbp), %edx
leaq 0x1368(%rip), %rsi      # 0x3b68
movb $0x0, %al
callq 0x22b0
movq 0x3ec2(%rip), %rdi      # 0x66d0
movl -0x2c(%rbp), %edx
leaq 0x136e(%rip), %rsi      # 0x3b86
movb $0x0, %al
callq 0x22b0
movq -0x28(%rbp), %rdi
callq 0x2140
movl %eax, -0x38(%rbp)
movq 0x3e9e(%rip), %rdi      # 0x66d0
movl -0x38(%rbp), %edx
leaq 0x137a(%rip), %rsi      # 0x3bb6
movb $0x0, %al
callq 0x22b0
cmpl $0x0, -0x38(%rbp)
jge 0x286f
movq 0x3e80(%rip), %rdi      # 0x66d0
leaq 0x137d(%rip), %rsi      # 0x3bd4
leaq 0x7b2(%rip), %rdx       # 0x3010
movb $0x0, %al
callq 0x22b0
movl $0x1, %edi
callq 0x21c0
movq -0x28(%rbp), %rdi
callq 0x2130
movl %eax, -0x30(%rbp)
movq 0x3e4e(%rip), %rax      # 0x66d0
movq %rax, -0x248(%rbp)
movslq -0x30(%rbp), %rdi
callq 0x2110
movq -0x248(%rbp), %rdi
movq %rax, %rdx
leaq 0x135a(%rip), %rsi      # 0x3bfd
movb $0x0, %al
callq 0x22b0
cmpl $0x0, -0x38(%rbp)
jne 0x2914
movq -0x28(%rbp), %rdi
callq 0x2250
movq %rax, -0x10(%rbp)
callq 0x2170
movq %rax, -0x18(%rbp)
movq -0x10(%rbp), %rdi
callq 0x21a0
movq %rax, -0x18(%rbp)
movq 0x3df6(%rip), %rdi      # 0x66d0
leaq 0x133a(%rip), %rsi      # 0x3c1b
movb $0x0, %al
callq 0x22b0
movq 0x3de1(%rip), %rdi      # 0x66d0
movq -0x18(%rbp), %rsi
xorl %edx, %edx
movl $0x2a40006, %ecx        # imm = 0x2A40006
callq 0x2040
movq 0x3dca(%rip), %rdi      # 0x66d0
leaq 0x1355(%rip), %rsi      # 0x3c62
movb $0x0, %al
callq 0x22b0
movq 0x3dcd(%rip), %rdi      # 0x66e8
callq 0x2090
movq -0x28(%rbp), %rdi
callq 0x2240
movq 0x3d98(%rip), %rdi      # 0x66c8
callq 0x2080
movq 0x3d94(%rip), %rdi      # 0x66d0
callq 0x2080
xorl %edi, %edi
callq 0x21c0
nopl (%rax,%rax)