// File: /workspace/github_c_makefile_star2_O2/fm4dd[P]learn-ssl/certverify-adv.c
// Function: main
int main() {

  X509          *error_cert = NULL;
  X509_NAME    *certsubject = NULL;
  STACK_OF(X509_INFO) *list = NULL;
  X509_STORE_CTX  *vrfy_ctx = NULL;
  int cert_counter = 0;
  int vrfy_err, i, ret, depth;
  unsigned int vrfy_flag;
  char *vrfy_name = NULL;
  struct stat ca_stat;

  struct Vrfy_Flags {
    unsigned long flag_code;
            char* flag_name;
            char* flag_desc;
  };

  struct Vrfy_Flags flagslist[MAXFLAGS];
  flagslist[0].flag_code  = 0x1;
  flagslist[0].flag_name  = "X509_V_FLAG_CB_ISSUER_CHECK";
  flagslist[0].flag_desc  = "This flag allows debugging of certificate issuer checks. It sends issuer+subject information to the verification call back function.";
  flagslist[1].flag_code  = 0x2;
  flagslist[1].flag_name  = "X509_V_FLAG_USE_CHECK_TIME";
  flagslist[1].flag_desc  = "This flag allows using check time instead of current time";
  flagslist[2].flag_code  = 0x4;
  flagslist[2].flag_name  = "X509_V_FLAG_CRL_CHECK";
  flagslist[2].flag_desc  = "This flag enables CRL checking for the certificate chain leaf certificate. An error occurs if a suitable CRL cannot be found.";
  flagslist[3].flag_code  = 0x8;
  flagslist[3].flag_name  = "X509_V_FLAG_CRL_CHECK_ALL";
  flagslist[3].flag_desc  = "This flag enables CRL checking for the entire certificate chain. If enabled, CRLs are expected to be available in the X509_STORE structure. There is no auto-download of CRLs from the CRL distribution points extension.";
  flagslist[4].flag_code  = 0x10;
  flagslist[4].flag_name  = "X509_V_FLAG_IGNORE_CRITICAL";
  flagslist[4].flag_desc  = "This flag disables critical extension checking. By default, any unhandled critical extensions in certificates or (if checked) CRLs results in a fatal error. If this flag is set, unhandled critical extensions are ignored. Setting this option can be a security risk.";
  flagslist[5].flag_code  = 0x20;
  flagslist[5].flag_name  = "X509_V_FLAG_X509_STRICT";
  flagslist[5].flag_desc  = "This flag disables workarounds for some broken certificates and makes the verification strictly apply X509 rules.";
  flagslist[6].flag_code  = 0x40;
  flagslist[6].flag_name  = "X509_V_FLAG_ALLOW_PROXY_CERTS";
  flagslist[6].flag_desc  = "This flag enables proxy certificate verification.";
  flagslist[7].flag_code  = 0x80;
  flagslist[7].flag_name  = "X509_V_FLAG_POLICY_CHECK";
  flagslist[7].flag_desc  = "This flag enables certificate policy checking. By default, no policy checking is peformed. Additional information is sent to the verification callback relating to policy checking.";
  flagslist[8].flag_code  = 0x100;
  flagslist[8].flag_name  = "X509_V_FLAG_EXPLICIT_POLICY";
  flagslist[8].flag_desc  = "This flag is enabling policy checking per RFC3280. When enabled, all certificates in the path must contain an acceptable policy identifier in the certificate policies extension.";
  flagslist[9].flag_code  = 0x200;
  flagslist[9].flag_name  = "X509_V_FLAG_INHIBIT_ANY";
  flagslist[9].flag_desc  = "If this flag is set, the value indicates the number of additional certificates that may appear in the path before policy mapping is no longer permitted.  For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.";
  flagslist[10].flag_code = 0x400;
  flagslist[10].flag_name = "X509_V_FLAG_INHIBIT_MAP";
  flagslist[10].flag_desc = "If this flag is set, the value indicates the number of additional certificates that may appear in the path before policy mapping is no longer permitted.  For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.";
  flagslist[11].flag_code = 0x800;
  flagslist[11].flag_name = "X509_V_FLAG_NOTIFY_POLICY";
  flagslist[11].flag_desc = "This flag sends extra policy information to the cllback function.";
  flagslist[12].flag_code = 0x1000;
  flagslist[12].flag_name = "X509_V_FLAG_EXTENDED_CRL_SUPPORT";
  flagslist[12].flag_desc = "This flag enables extended CRL features such as indirect CRLs, alternate CRL signing keys.";
  flagslist[13].flag_code = 0x2000;
  flagslist[13].flag_name = "X509_V_FLAG_USE_DELTAS";
  flagslist[13].flag_desc = "This flag enables the use of Delta CRL's, if available. OpenSSL's Delta CRL checking is currently primitive. Only a single delta can be used and constructed CRLs are not maintained.";
  flagslist[14].flag_code = 0x4000;
  flagslist[14].flag_name = "X509_V_FLAG_CHECK_SS_SIGNATURE";
  flagslist[14].flag_desc = "This flag enables the check if the root CA has a self-signed cerificate signature. By default this check is disabled because it doesn't add any additional security. In some cases, applications might want to check the signature anyway. A side effect of not checking the root CA signature is that disabled or unsupported message digests on the root CA are not treated as fatal errors.";

  /* ---------------------------------------------------------- *
   * Create the Input/Output BIO's.                             *
   * ---------------------------------------------------------- */
  outbio  = BIO_new(BIO_s_file());
  outbio = BIO_new_fp(stdout, BIO_NOCLOSE);

  /* ---------------------------------------------------------- *
   * Load the cert file into a BIO and then into a x509 struct. *
   * ---------------------------------------------------------- */
  certbio = BIO_new(BIO_s_file());
  ret = BIO_read_filename(certbio, cert_filestr);

  if (! (cert = PEM_read_bio_X509(certbio, NULL, 0, NULL))) {
    BIO_printf(outbio, "Error loading cert into memory: %s\n", cert_filestr);
    exit(1);
  }

  /* ---------------------------------------------------------- *
   * Load a CA cert file into a BIO and then into a x509 stack. *
   * ---------------------------------------------------------- */
  list = X509_load_ca_file(&cert_counter, ca_stat, ca_bundlestr);

  /* ---------------------------------------------------------- *
   * Create a verification context from the stack, add the cert *
   * ---------------------------------------------------------- */
  vrfy_ctx = verify_mem_store(list); 
  //vrfy_ctx = verify_mem_stack(list);
  //vrfy_ctx = verify_file_direct(ca_bundlestr);

  /* ---------------------------------------------------------- *
   * Set the verification options and depth for this operation. *
   * ---------------------------------------------------------- */
  param = X509_VERIFY_PARAM_new();
  //X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CB_ISSUER_CHECK);
  X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_X509_STRICT);
  X509_VERIFY_PARAM_set_depth(param, 5);

  X509_STORE_CTX_set_verify_cb(vrfy_ctx, verify_callback);
  /* ---------------------------------------------------------- *
   * Check the verification settings used for this operation.   *
   * ---------------------------------------------------------- */
  vrfy_flag = X509_VERIFY_PARAM_get_flags(param);
  for(i=0; i<MAXFLAGS; i++) {
  depth = X509_VERIFY_PARAM_get_depth(param);
    if(flagslist[i].flag_code == vrfy_flag) 
      vrfy_name = (flagslist[i].flag_name);
  }

  BIO_printf(outbio, "Verification check flags: %#x [%s]\n", vrfy_flag, vrfy_name);
  BIO_printf(outbio, "Verification depth limit: %d\n", depth);
  BIO_printf(outbio, "Verification CA cert num: %d CA certs provided\n", cert_counter);


  /* ---------------------------------------------------------- *
   * Check the complete cert chain can be build and validated.  *
   * Returns 1 on success, 0 on verification failures, and -1   *
   * for trouble with the ctx object (i.e. missing certificate) *
   * ---------------------------------------------------------- */
  ret = X509_verify_cert(vrfy_ctx);
  BIO_printf(outbio, "Verification return code: %d\n", ret);

  /* ---------------------------------------------------------- *
   * A negative return value indicates a verification error     *
   * ---------------------------------------------------------- */
  if (ret < 0) {
    BIO_printf(outbio, "Error loading CA cert or chain file: %s\n", ca_bundlestr);
    exit(1);
  }

  /* ---------------------------------------------------------- *
   * For verification return of 0 or 1, check validation result *
   * ---------------------------------------------------------- */
  vrfy_err = X509_STORE_CTX_get_error(vrfy_ctx);
  BIO_printf(outbio, "Verification result text: %s\n",
             X509_verify_cert_error_string(vrfy_err));

  /* ---------------------------------------------------------- *
   * The error handling below shows how to get failure details  *
   * from the offending certificate.                            *
   * ---------------------------------------------------------- */
  if(ret == 0) {
    /*  get the offending certificate causing the failure */
    error_cert  = X509_STORE_CTX_get_current_cert(vrfy_ctx);
    certsubject = X509_NAME_new();
    certsubject = X509_get_subject_name(error_cert);
    BIO_printf(outbio, "\nVerification certsubject: ---------------start----------------------\n");
    X509_NAME_print_ex(outbio, certsubject, 0, XN_FLAG_MULTILINE);
    BIO_printf(outbio, "\nVerification certsubject: ----------------End-----------------------\n");
  }

  /* ---------------------------------------------------------- *
   * Free up all structures                                     *
   * ---------------------------------------------------------- */

  X509_VERIFY_PARAM_free(param);
  X509_STORE_CTX_free(vrfy_ctx); 
  BIO_free_all(certbio);
  BIO_free_all(outbio);
  exit(0);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x298, %rsp            # imm = 0x298
andl $0x0, 0x9c(%rsp)
movq $0x1, 0xa0(%rsp)
leaq 0xc5d(%rip), %rax       # 0x3045
movq %rax, 0xa8(%rsp)
movq $0x2, 0xb8(%rsp)
leaq 0xc5e(%rip), %rax       # 0x3061
movq %rax, 0xc0(%rsp)
movq $0x4, 0xd0(%rsp)
leaq 0xc5e(%rip), %rax       # 0x307c
movq %rax, 0xd8(%rsp)
movq $0x8, 0xe8(%rsp)
leaq 0xc59(%rip), %rax       # 0x3092
movq %rax, 0xf0(%rsp)
movq $0x10, 0x100(%rsp)
leaq 0xc58(%rip), %rax       # 0x30ac
movq %rax, 0x108(%rsp)
movq $0x20, 0x118(%rsp)
leaq 0xc59(%rip), %rax       # 0x30c8
movq %rax, 0x120(%rsp)
movq $0x40, 0x130(%rsp)
leaq 0xc56(%rip), %rax       # 0x30e0
movq %rax, 0x138(%rsp)
movq $0x80, 0x148(%rsp)
leaq 0xc59(%rip), %rax       # 0x30fe
movq %rax, 0x150(%rsp)
movq $0x100, 0x160(%rsp) # imm = 0x100
leaq 0xc57(%rip), %rax       # 0x3117
movq %rax, 0x168(%rsp)
movq $0x200, 0x178(%rsp) # imm = 0x200
leaq 0xc58(%rip), %rax       # 0x3133
movq %rax, 0x180(%rsp)
movq $0x400, 0x190(%rsp) # imm = 0x400
leaq 0xc55(%rip), %rax       # 0x314b
movq %rax, 0x198(%rsp)
movq $0x800, 0x1a8(%rsp) # imm = 0x800
leaq 0xc52(%rip), %rax       # 0x3163
movq %rax, 0x1b0(%rsp)
movq $0x1000, 0x1c0(%rsp) # imm = 0x1000
leaq 0xc51(%rip), %rax       # 0x317d
movq %rax, 0x1c8(%rsp)
movq $0x2000, 0x1d8(%rsp) # imm = 0x2000
leaq 0xc57(%rip), %rax       # 0x319e
movq %rax, 0x1e0(%rsp)
movq $0x4000, 0x1f0(%rsp) # imm = 0x4000
leaq 0xc53(%rip), %rax       # 0x31b5
movq %rax, 0x1f8(%rsp)
callq 0x2060
movq %rax, %rdi
callq 0x2260
movq %rax, 0x3152(%rip)      # 0x56d0
movq 0x2a4b(%rip), %rax      # 0x4fd0
movq (%rax), %rdi
xorl %esi, %esi
callq 0x20e0
movq %rax, 0x313a(%rip)      # 0x56d0
callq 0x2060
movq %rax, %rdi
callq 0x2260
movq %rax, 0x311e(%rip)      # 0x56c8
leaq 0xa7f(%rip), %rcx       # 0x3030
pushq $0x6c
popq %rsi
pushq $0x3
popq %rdx
movq %rax, %rdi
callq 0x2050
movq 0x3102(%rip), %rdi      # 0x56c8
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
callq 0x2280
movq %rax, 0x3108(%rip)      # 0x56e0
testq %rax, %rax
jne 0x25f7
movq 0x30ec(%rip), %rdi      # 0x56d0
leaq 0xbe9(%rip), %rsi       # 0x31d4
leaq 0xa3e(%rip), %rdx       # 0x3030
jmp 0x272c
pushq $0x12
popq %rcx
leaq 0x208(%rsp), %rsi
movq %rsp, %rdi
rep  movsq (%rsi), %es:(%rdi)
leaq 0xa01(%rip), %rsi       # 0x3010
leaq 0x9c(%rsp), %rdi
callq 0x27f8
movq %rax, %rdi
callq 0x28ee
movq %rax, %rbx
callq 0x2200
movq %rax, 0x30b5(%rip)      # 0x56e8
pushq $0x20
popq %rsi
movq %rax, %rdi
callq 0x2220
movq 0x30a3(%rip), %rdi      # 0x56e8
pushq $0x5
popq %rsi
callq 0x2270
leaq 0x33d(%rip), %rsi       # 0x2991
movq %rbx, %rdi
callq 0x21d0
movq 0x3085(%rip), %rdi      # 0x56e8
callq 0x21f0
movq %rax, %r14
movl %r14d, %r12d
pushq $0x8
popq %r13
xorl %r15d, %r15d
cmpq $0x170, %r13            # imm = 0x170
je 0x26a4
movq 0x3063(%rip), %rdi      # 0x56e8
callq 0x2230
movl %eax, %ebp
cmpq %r12, 0x98(%rsp,%r13)
jne 0x269e
movq 0xa0(%rsp,%r13), %r15
addq $0x18, %r13
jmp 0x2675
movq 0x3025(%rip), %rdi      # 0x56d0
leaq 0xb46(%rip), %rsi       # 0x31f8
movl %r14d, %edx
movq %r15, %rcx
xorl %eax, %eax
callq 0x22b0
movq 0x300a(%rip), %rdi      # 0x56d0
leaq 0xb4f(%rip), %rsi       # 0x321c
movl %ebp, %edx
xorl %eax, %eax
callq 0x22b0
movq 0x2ff3(%rip), %rdi      # 0x56d0
movl 0x9c(%rsp), %edx
leaq 0xb4f(%rip), %rsi       # 0x323a
xorl %eax, %eax
callq 0x22b0
movq %rbx, %rdi
callq 0x2140
movl %eax, %ebp
movq 0x2fcd(%rip), %rdi      # 0x56d0
leaq 0xb60(%rip), %rsi       # 0x326a
movl %eax, %edx
xorl %eax, %eax
callq 0x22b0
testl %ebp, %ebp
jns 0x273b
movq 0x2fb2(%rip), %rdi      # 0x56d0
leaq 0xb63(%rip), %rsi       # 0x3288
leaq 0x8e4(%rip), %rdx       # 0x3010
xorl %eax, %eax
callq 0x22b0
pushq $0x1
popq %rdi
callq 0x21c0
movq %rbx, %rdi
callq 0x2130
movq 0x2f86(%rip), %r14      # 0x56d0
movslq %eax, %rdi
callq 0x2110
leaq 0xb58(%rip), %rsi       # 0x32b1
movq %r14, %rdi
movq %rax, %rdx
xorl %eax, %eax
callq 0x22b0
testl %ebp, %ebp
jne 0x27c5
movq %rbx, %rdi
callq 0x2250
movq %rax, %r14
callq 0x2170
movq %r14, %rdi
callq 0x21a0
movq %rax, %r14
movq 0x2f44(%rip), %rdi      # 0x56d0
leaq 0xb3c(%rip), %rsi       # 0x32cf
xorl %eax, %eax
callq 0x22b0
movq 0x2f2f(%rip), %rdi      # 0x56d0
movl $0x2a40006, %ecx        # imm = 0x2A40006
movq %r14, %rsi
xorl %edx, %edx
callq 0x2040
movq 0x2f19(%rip), %rdi      # 0x56d0
leaq 0xb58(%rip), %rsi       # 0x3316
xorl %eax, %eax
callq 0x22b0
movq 0x2f1c(%rip), %rdi      # 0x56e8
callq 0x2090
movq %rbx, %rdi
callq 0x2240
movq 0x2ee8(%rip), %rdi      # 0x56c8
callq 0x2080
movq 0x2ee4(%rip), %rdi      # 0x56d0
callq 0x2080
xorl %edi, %edi
callq 0x21c0