1160814Ssimon/* pcy_int.h */
2280304Sjkim/*
3280304Sjkim * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
4280304Sjkim * 2004.
5160814Ssimon */
6160814Ssimon/* ====================================================================
7160814Ssimon * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
8160814Ssimon *
9160814Ssimon * Redistribution and use in source and binary forms, with or without
10160814Ssimon * modification, are permitted provided that the following conditions
11160814Ssimon * are met:
12160814Ssimon *
13160814Ssimon * 1. Redistributions of source code must retain the above copyright
14280304Sjkim *    notice, this list of conditions and the following disclaimer.
15160814Ssimon *
16160814Ssimon * 2. Redistributions in binary form must reproduce the above copyright
17160814Ssimon *    notice, this list of conditions and the following disclaimer in
18160814Ssimon *    the documentation and/or other materials provided with the
19160814Ssimon *    distribution.
20160814Ssimon *
21160814Ssimon * 3. All advertising materials mentioning features or use of this
22160814Ssimon *    software must display the following acknowledgment:
23160814Ssimon *    "This product includes software developed by the OpenSSL Project
24160814Ssimon *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25160814Ssimon *
26160814Ssimon * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27160814Ssimon *    endorse or promote products derived from this software without
28160814Ssimon *    prior written permission. For written permission, please contact
29160814Ssimon *    licensing@OpenSSL.org.
30160814Ssimon *
31160814Ssimon * 5. Products derived from this software may not be called "OpenSSL"
32160814Ssimon *    nor may "OpenSSL" appear in their names without prior written
33160814Ssimon *    permission of the OpenSSL Project.
34160814Ssimon *
35160814Ssimon * 6. Redistributions of any form whatsoever must retain the following
36160814Ssimon *    acknowledgment:
37160814Ssimon *    "This product includes software developed by the OpenSSL Project
38160814Ssimon *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39160814Ssimon *
40160814Ssimon * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41160814Ssimon * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42160814Ssimon * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43160814Ssimon * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
44160814Ssimon * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45160814Ssimon * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46160814Ssimon * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47160814Ssimon * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48160814Ssimon * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49160814Ssimon * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50160814Ssimon * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51160814Ssimon * OF THE POSSIBILITY OF SUCH DAMAGE.
52160814Ssimon * ====================================================================
53160814Ssimon *
54160814Ssimon * This product includes cryptographic software written by Eric Young
55160814Ssimon * (eay@cryptsoft.com).  This product includes software written by Tim
56160814Ssimon * Hudson (tjh@cryptsoft.com).
57160814Ssimon *
58160814Ssimon */
59160814Ssimon
60160814Ssimontypedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
61160814Ssimon
62238405SjkimDECLARE_STACK_OF(X509_POLICY_DATA)
63238405Sjkim
64160814Ssimon/* Internal structures */
65160814Ssimon
66280304Sjkim/*
67280304Sjkim * This structure and the field names correspond to the Policy 'node' of
68280304Sjkim * RFC3280. NB this structure contains no pointers to parent or child data:
69280304Sjkim * X509_POLICY_NODE contains that. This means that the main policy data can
70280304Sjkim * be kept static and cached with the certificate.
71160814Ssimon */
72160814Ssimon
73280304Sjkimstruct X509_POLICY_DATA_st {
74280304Sjkim    unsigned int flags;
75280304Sjkim    /* Policy OID and qualifiers for this data */
76280304Sjkim    ASN1_OBJECT *valid_policy;
77280304Sjkim    STACK_OF(POLICYQUALINFO) *qualifier_set;
78280304Sjkim    STACK_OF(ASN1_OBJECT) *expected_policy_set;
79280304Sjkim};
80160814Ssimon
81160814Ssimon/* X509_POLICY_DATA flags values */
82160814Ssimon
83280304Sjkim/*
84280304Sjkim * This flag indicates the structure has been mapped using a policy mapping
85280304Sjkim * extension. If policy mapping is not active its references get deleted.
86160814Ssimon */
87160814Ssimon
88280304Sjkim#define POLICY_DATA_FLAG_MAPPED                 0x1
89160814Ssimon
90280304Sjkim/*
91280304Sjkim * This flag indicates the data doesn't correspond to a policy in Certificate
92160814Ssimon * Policies: it has been mapped to any policy.
93160814Ssimon */
94160814Ssimon
95280304Sjkim#define POLICY_DATA_FLAG_MAPPED_ANY             0x2
96160814Ssimon
97160814Ssimon/* AND with flags to see if any mapping has occurred */
98160814Ssimon
99280304Sjkim#define POLICY_DATA_FLAG_MAP_MASK               0x3
100160814Ssimon
101160814Ssimon/* qualifiers are shared and shouldn't be freed */
102160814Ssimon
103280304Sjkim#define POLICY_DATA_FLAG_SHARED_QUALIFIERS      0x4
104160814Ssimon
105160814Ssimon/* Parent node is an extra node and should be freed */
106160814Ssimon
107280304Sjkim#define POLICY_DATA_FLAG_EXTRA_NODE             0x8
108160814Ssimon
109160814Ssimon/* Corresponding CertificatePolicies is critical */
110160814Ssimon
111280304Sjkim#define POLICY_DATA_FLAG_CRITICAL               0x10
112160814Ssimon
113160814Ssimon/* This structure is cached with a certificate */
114160814Ssimon
115160814Ssimonstruct X509_POLICY_CACHE_st {
116280304Sjkim    /* anyPolicy data or NULL if no anyPolicy */
117280304Sjkim    X509_POLICY_DATA *anyPolicy;
118280304Sjkim    /* other policy data */
119280304Sjkim    STACK_OF(X509_POLICY_DATA) *data;
120280304Sjkim    /* If InhibitAnyPolicy present this is its value or -1 if absent. */
121280304Sjkim    long any_skip;
122280304Sjkim    /*
123280304Sjkim     * If policyConstraints and requireExplicitPolicy present this is its
124280304Sjkim     * value or -1 if absent.
125280304Sjkim     */
126280304Sjkim    long explicit_skip;
127280304Sjkim    /*
128280304Sjkim     * If policyConstraints and policyMapping present this is its value or -1
129280304Sjkim     * if absent.
130280304Sjkim     */
131280304Sjkim    long map_skip;
132280304Sjkim};
133160814Ssimon
134280304Sjkim/*
135280304Sjkim * #define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL
136280304Sjkim */
137160814Ssimon
138160814Ssimon/* This structure represents the relationship between nodes */
139160814Ssimon
140280304Sjkimstruct X509_POLICY_NODE_st {
141280304Sjkim    /* node data this refers to */
142280304Sjkim    const X509_POLICY_DATA *data;
143280304Sjkim    /* Parent node */
144280304Sjkim    X509_POLICY_NODE *parent;
145280304Sjkim    /* Number of child nodes */
146280304Sjkim    int nchild;
147280304Sjkim};
148160814Ssimon
149280304Sjkimstruct X509_POLICY_LEVEL_st {
150280304Sjkim    /* Cert for this level */
151280304Sjkim    X509 *cert;
152280304Sjkim    /* nodes at this level */
153280304Sjkim    STACK_OF(X509_POLICY_NODE) *nodes;
154280304Sjkim    /* anyPolicy node */
155280304Sjkim    X509_POLICY_NODE *anyPolicy;
156280304Sjkim    /* Extra data */
157280304Sjkim    /*
158280304Sjkim     * STACK_OF(X509_POLICY_DATA) *extra_data;
159280304Sjkim     */
160280304Sjkim    unsigned int flags;
161280304Sjkim};
162160814Ssimon
163280304Sjkimstruct X509_POLICY_TREE_st {
164280304Sjkim    /* This is the tree 'level' data */
165280304Sjkim    X509_POLICY_LEVEL *levels;
166280304Sjkim    int nlevel;
167280304Sjkim    /*
168280304Sjkim     * Extra policy data when additional nodes (not from the certificate) are
169280304Sjkim     * required.
170280304Sjkim     */
171280304Sjkim    STACK_OF(X509_POLICY_DATA) *extra_data;
172280304Sjkim    /* This is the authority constained policy set */
173280304Sjkim    STACK_OF(X509_POLICY_NODE) *auth_policies;
174280304Sjkim    STACK_OF(X509_POLICY_NODE) *user_policies;
175280304Sjkim    unsigned int flags;
176280304Sjkim};
177160814Ssimon
178160814Ssimon/* Set if anyPolicy present in user policies */
179280304Sjkim#define POLICY_FLAG_ANY_POLICY          0x2
180160814Ssimon
181160814Ssimon/* Useful macros */
182160814Ssimon
183160814Ssimon#define node_data_critical(data) (data->flags & POLICY_DATA_FLAG_CRITICAL)
184160814Ssimon#define node_critical(node) node_data_critical(node->data)
185160814Ssimon
186160814Ssimon/* Internal functions */
187160814Ssimon
188238405SjkimX509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
189280304Sjkim                                  int crit);
190160814Ssimonvoid policy_data_free(X509_POLICY_DATA *data);
191160814Ssimon
192160814SsimonX509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
193280304Sjkim                                         const ASN1_OBJECT *id);
194160814Ssimonint policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
195160814Ssimon
196160814SsimonSTACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
197160814Ssimon
198160814Ssimonvoid policy_cache_init(void);
199160814Ssimon
200160814Ssimonvoid policy_cache_free(X509_POLICY_CACHE *cache);
201160814Ssimon
202160814SsimonX509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
203280304Sjkim                                  const X509_POLICY_NODE *parent,
204280304Sjkim                                  const ASN1_OBJECT *id);
205160814Ssimon
206160814SsimonX509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
207280304Sjkim                               const ASN1_OBJECT *id);
208160814Ssimon
209160814SsimonX509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
210280304Sjkim                                 const X509_POLICY_DATA *data,
211280304Sjkim                                 X509_POLICY_NODE *parent,
212280304Sjkim                                 X509_POLICY_TREE *tree);
213160814Ssimonvoid policy_node_free(X509_POLICY_NODE *node);
214238405Sjkimint policy_node_match(const X509_POLICY_LEVEL *lvl,
215280304Sjkim                      const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
216160814Ssimon
217160814Ssimonconst X509_POLICY_CACHE *policy_cache_set(X509 *x);
218