v3_alt.c revision 352193 
1/* v3_alt.c */
2/*
3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
4 * project.
5 */
6/* ====================================================================
7 * Copyright (c) 1999-2019 The OpenSSL Project.  All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in
18 *    the documentation and/or other materials provided with the
19 *    distribution.
20 *
21 * 3. All advertising materials mentioning features or use of this
22 *    software must display the following acknowledgment:
23 *    "This product includes software developed by the OpenSSL Project
24 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 *
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 *    endorse or promote products derived from this software without
28 *    prior written permission. For written permission, please contact
29 *    licensing@OpenSSL.org.
30 *
31 * 5. Products derived from this software may not be called "OpenSSL"
32 *    nor may "OpenSSL" appear in their names without prior written
33 *    permission of the OpenSSL Project.
34 *
35 * 6. Redistributions of any form whatsoever must retain the following
36 *    acknowledgment:
37 *    "This product includes software developed by the OpenSSL Project
38 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
53 *
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com).  This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
57 *
58 */
59
60#include <stdio.h>
61#include "cryptlib.h"
62#include <openssl/conf.h>
63#include <openssl/x509v3.h>
64
65static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
66                                      X509V3_CTX *ctx,
67                                      STACK_OF(CONF_VALUE) *nval);
68static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
69                                     X509V3_CTX *ctx,
70                                     STACK_OF(CONF_VALUE) *nval);
71static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
72static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
73static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
74static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
75
76const X509V3_EXT_METHOD v3_alt[] = {
77    {NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
78     0, 0, 0, 0,
79     0, 0,
80     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
81     (X509V3_EXT_V2I)v2i_subject_alt,
82     NULL, NULL, NULL},
83
84    {NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
85     0, 0, 0, 0,
86     0, 0,
87     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
88     (X509V3_EXT_V2I)v2i_issuer_alt,
89     NULL, NULL, NULL},
90
91    {NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
92     0, 0, 0, 0,
93     0, 0,
94     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
95     NULL, NULL, NULL, NULL},
96};
97
98STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
99                                        GENERAL_NAMES *gens,
100                                        STACK_OF(CONF_VALUE) *ret)
101{
102    int i;
103    GENERAL_NAME *gen;
104    for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
105        gen = sk_GENERAL_NAME_value(gens, i);
106        ret = i2v_GENERAL_NAME(method, gen, ret);
107    }
108    if (!ret)
109        return sk_CONF_VALUE_new_null();
110    return ret;
111}
112
113STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
114                                       GENERAL_NAME *gen,
115                                       STACK_OF(CONF_VALUE) *ret)
116{
117    unsigned char *p;
118    char oline[256], htmp[5];
119    int i;
120    switch (gen->type) {
121    case GEN_OTHERNAME:
122        if (!X509V3_add_value("othername", "<unsupported>", &ret))
123            return NULL;
124        break;
125
126    case GEN_X400:
127        if (!X509V3_add_value("X400Name", "<unsupported>", &ret))
128            return NULL;
129        break;
130
131    case GEN_EDIPARTY:
132        if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret))
133            return NULL;
134        break;
135
136    case GEN_EMAIL:
137        if (!X509V3_add_value_uchar("email", gen->d.ia5->data, &ret))
138            return NULL;
139        break;
140
141    case GEN_DNS:
142        if (!X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret))
143            return NULL;
144        break;
145
146    case GEN_URI:
147        if (!X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret))
148            return NULL;
149        break;
150
151    case GEN_DIRNAME:
152        if (X509_NAME_oneline(gen->d.dirn, oline, 256) == NULL
153                || !X509V3_add_value("DirName", oline, &ret))
154            return NULL;
155        break;
156
157    case GEN_IPADD:
158        p = gen->d.ip->data;
159        if (gen->d.ip->length == 4)
160            BIO_snprintf(oline, sizeof(oline),
161                         "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
162        else if (gen->d.ip->length == 16) {
163            oline[0] = 0;
164            for (i = 0; i < 8; i++) {
165                BIO_snprintf(htmp, sizeof(htmp), "%X", p[0] << 8 | p[1]);
166                p += 2;
167                strcat(oline, htmp);
168                if (i != 7)
169                    strcat(oline, ":");
170            }
171        } else {
172            if (!X509V3_add_value("IP Address", "<invalid>", &ret))
173                return NULL;
174            break;
175        }
176        if (!X509V3_add_value("IP Address", oline, &ret))
177            return NULL;
178        break;
179
180    case GEN_RID:
181        i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
182        if (!X509V3_add_value("Registered ID", oline, &ret))
183            return NULL;
184        break;
185    }
186    return ret;
187}
188
189int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
190{
191    unsigned char *p;
192    int i;
193    switch (gen->type) {
194    case GEN_OTHERNAME:
195        BIO_printf(out, "othername:<unsupported>");
196        break;
197
198    case GEN_X400:
199        BIO_printf(out, "X400Name:<unsupported>");
200        break;
201
202    case GEN_EDIPARTY:
203        /* Maybe fix this: it is supported now */
204        BIO_printf(out, "EdiPartyName:<unsupported>");
205        break;
206
207    case GEN_EMAIL:
208        BIO_printf(out, "email:");
209        ASN1_STRING_print(out, gen->d.ia5);
210        break;
211
212    case GEN_DNS:
213        BIO_printf(out, "DNS:");
214        ASN1_STRING_print(out, gen->d.ia5);
215        break;
216
217    case GEN_URI:
218        BIO_printf(out, "URI:");
219        ASN1_STRING_print(out, gen->d.ia5);
220        break;
221
222    case GEN_DIRNAME:
223        BIO_printf(out, "DirName: ");
224        X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
225        break;
226
227    case GEN_IPADD:
228        p = gen->d.ip->data;
229        if (gen->d.ip->length == 4)
230            BIO_printf(out, "IP Address:%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
231        else if (gen->d.ip->length == 16) {
232            BIO_printf(out, "IP Address");
233            for (i = 0; i < 8; i++) {
234                BIO_printf(out, ":%X", p[0] << 8 | p[1]);
235                p += 2;
236            }
237            BIO_puts(out, "\n");
238        } else {
239            BIO_printf(out, "IP Address:<invalid>");
240            break;
241        }
242        break;
243
244    case GEN_RID:
245        BIO_printf(out, "Registered ID");
246        i2a_ASN1_OBJECT(out, gen->d.rid);
247        break;
248    }
249    return 1;
250}
251
252static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
253                                     X509V3_CTX *ctx,
254                                     STACK_OF(CONF_VALUE) *nval)
255{
256    GENERAL_NAMES *gens = NULL;
257    CONF_VALUE *cnf;
258    int i;
259    if (!(gens = sk_GENERAL_NAME_new_null())) {
260        X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
261        return NULL;
262    }
263    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
264        cnf = sk_CONF_VALUE_value(nval, i);
265        if (!name_cmp(cnf->name, "issuer") && cnf->value &&
266            !strcmp(cnf->value, "copy")) {
267            if (!copy_issuer(ctx, gens))
268                goto err;
269        } else {
270            GENERAL_NAME *gen;
271            if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
272                goto err;
273            sk_GENERAL_NAME_push(gens, gen);
274        }
275    }
276    return gens;
277 err:
278    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
279    return NULL;
280}
281
282/* Append subject altname of issuer to issuer alt name of subject */
283
284static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
285{
286    GENERAL_NAMES *ialt;
287    GENERAL_NAME *gen;
288    X509_EXTENSION *ext;
289    int i;
290    if (ctx && (ctx->flags == CTX_TEST))
291        return 1;
292    if (!ctx || !ctx->issuer_cert) {
293        X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
294        goto err;
295    }
296    i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
297    if (i < 0)
298        return 1;
299    if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
300        !(ialt = X509V3_EXT_d2i(ext))) {
301        X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
302        goto err;
303    }
304
305    for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
306        gen = sk_GENERAL_NAME_value(ialt, i);
307        if (!sk_GENERAL_NAME_push(gens, gen)) {
308            X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
309            goto err;
310        }
311    }
312    sk_GENERAL_NAME_free(ialt);
313
314    return 1;
315
316 err:
317    return 0;
318
319}
320
321static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
322                                      X509V3_CTX *ctx,
323                                      STACK_OF(CONF_VALUE) *nval)
324{
325    GENERAL_NAMES *gens = NULL;
326    CONF_VALUE *cnf;
327    int i;
328    if (!(gens = sk_GENERAL_NAME_new_null())) {
329        X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
330        return NULL;
331    }
332    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
333        cnf = sk_CONF_VALUE_value(nval, i);
334        if (!name_cmp(cnf->name, "email") && cnf->value &&
335            !strcmp(cnf->value, "copy")) {
336            if (!copy_email(ctx, gens, 0))
337                goto err;
338        } else if (!name_cmp(cnf->name, "email") && cnf->value &&
339                   !strcmp(cnf->value, "move")) {
340            if (!copy_email(ctx, gens, 1))
341                goto err;
342        } else {
343            GENERAL_NAME *gen;
344            if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
345                goto err;
346            sk_GENERAL_NAME_push(gens, gen);
347        }
348    }
349    return gens;
350 err:
351    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
352    return NULL;
353}
354
355/*
356 * Copy any email addresses in a certificate or request to GENERAL_NAMES
357 */
358
359static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
360{
361    X509_NAME *nm;
362    ASN1_IA5STRING *email = NULL;
363    X509_NAME_ENTRY *ne;
364    GENERAL_NAME *gen = NULL;
365    int i;
366    if (ctx != NULL && ctx->flags == CTX_TEST)
367        return 1;
368    if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
369        X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
370        goto err;
371    }
372    /* Find the subject name */
373    if (ctx->subject_cert)
374        nm = X509_get_subject_name(ctx->subject_cert);
375    else
376        nm = X509_REQ_get_subject_name(ctx->subject_req);
377
378    /* Now add any email address(es) to STACK */
379    i = -1;
380    while ((i = X509_NAME_get_index_by_NID(nm,
381                                           NID_pkcs9_emailAddress, i)) >= 0) {
382        ne = X509_NAME_get_entry(nm, i);
383        email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
384        if (move_p) {
385            X509_NAME_delete_entry(nm, i);
386            X509_NAME_ENTRY_free(ne);
387            i--;
388        }
389        if (!email || !(gen = GENERAL_NAME_new())) {
390            X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
391            goto err;
392        }
393        gen->d.ia5 = email;
394        email = NULL;
395        gen->type = GEN_EMAIL;
396        if (!sk_GENERAL_NAME_push(gens, gen)) {
397            X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
398            goto err;
399        }
400        gen = NULL;
401    }
402
403    return 1;
404
405 err:
406    GENERAL_NAME_free(gen);
407    M_ASN1_IA5STRING_free(email);
408    return 0;
409
410}
411
412GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method,
413                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
414{
415    GENERAL_NAME *gen;
416    GENERAL_NAMES *gens = NULL;
417    CONF_VALUE *cnf;
418    int i;
419    if (!(gens = sk_GENERAL_NAME_new_null())) {
420        X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
421        return NULL;
422    }
423    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
424        cnf = sk_CONF_VALUE_value(nval, i);
425        if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
426            goto err;
427        sk_GENERAL_NAME_push(gens, gen);
428    }
429    return gens;
430 err:
431    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
432    return NULL;
433}
434
435GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method,
436                               X509V3_CTX *ctx, CONF_VALUE *cnf)
437{
438    return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
439}
440
441GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out,
442                               const X509V3_EXT_METHOD *method,
443                               X509V3_CTX *ctx, int gen_type, char *value,
444                               int is_nc)
445{
446    char is_string = 0;
447    GENERAL_NAME *gen = NULL;
448
449    if (!value) {
450        X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
451        return NULL;
452    }
453
454    if (out)
455        gen = out;
456    else {
457        gen = GENERAL_NAME_new();
458        if (gen == NULL) {
459            X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
460            return NULL;
461        }
462    }
463
464    switch (gen_type) {
465    case GEN_URI:
466    case GEN_EMAIL:
467    case GEN_DNS:
468        is_string = 1;
469        break;
470
471    case GEN_RID:
472        {
473            ASN1_OBJECT *obj;
474            if (!(obj = OBJ_txt2obj(value, 0))) {
475                X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_OBJECT);
476                ERR_add_error_data(2, "value=", value);
477                goto err;
478            }
479            gen->d.rid = obj;
480        }
481        break;
482
483    case GEN_IPADD:
484        if (is_nc)
485            gen->d.ip = a2i_IPADDRESS_NC(value);
486        else
487            gen->d.ip = a2i_IPADDRESS(value);
488        if (gen->d.ip == NULL) {
489            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_IP_ADDRESS);
490            ERR_add_error_data(2, "value=", value);
491            goto err;
492        }
493        break;
494
495    case GEN_DIRNAME:
496        if (!do_dirname(gen, value, ctx)) {
497            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_DIRNAME_ERROR);
498            goto err;
499        }
500        break;
501
502    case GEN_OTHERNAME:
503        if (!do_othername(gen, value, ctx)) {
504            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_OTHERNAME_ERROR);
505            goto err;
506        }
507        break;
508    default:
509        X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
510        goto err;
511    }
512
513    if (is_string) {
514        if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
515            !ASN1_STRING_set(gen->d.ia5, (unsigned char *)value,
516                             strlen(value))) {
517            X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
518            goto err;
519        }
520    }
521
522    gen->type = gen_type;
523
524    return gen;
525
526 err:
527    if (!out)
528        GENERAL_NAME_free(gen);
529    return NULL;
530}
531
532GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out,
533                                  const X509V3_EXT_METHOD *method,
534                                  X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
535{
536    int type;
537
538    char *name, *value;
539
540    name = cnf->name;
541    value = cnf->value;
542
543    if (!value) {
544        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
545        return NULL;
546    }
547
548    if (!name_cmp(name, "email"))
549        type = GEN_EMAIL;
550    else if (!name_cmp(name, "URI"))
551        type = GEN_URI;
552    else if (!name_cmp(name, "DNS"))
553        type = GEN_DNS;
554    else if (!name_cmp(name, "RID"))
555        type = GEN_RID;
556    else if (!name_cmp(name, "IP"))
557        type = GEN_IPADD;
558    else if (!name_cmp(name, "dirName"))
559        type = GEN_DIRNAME;
560    else if (!name_cmp(name, "otherName"))
561        type = GEN_OTHERNAME;
562    else {
563        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION);
564        ERR_add_error_data(2, "name=", name);
565        return NULL;
566    }
567
568    return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
569
570}
571
572static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
573{
574    char *objtmp = NULL, *p;
575    int objlen;
576    if (!(p = strchr(value, ';')))
577        return 0;
578    if (!(gen->d.otherName = OTHERNAME_new()))
579        return 0;
580    /*
581     * Free this up because we will overwrite it. no need to free type_id
582     * because it is static
583     */
584    ASN1_TYPE_free(gen->d.otherName->value);
585    if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
586        return 0;
587    objlen = p - value;
588    objtmp = OPENSSL_malloc(objlen + 1);
589    if (objtmp == NULL)
590        return 0;
591    strncpy(objtmp, value, objlen);
592    objtmp[objlen] = 0;
593    gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
594    OPENSSL_free(objtmp);
595    if (!gen->d.otherName->type_id)
596        return 0;
597    return 1;
598}
599
600static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
601{
602    int ret = 0;
603    STACK_OF(CONF_VALUE) *sk = NULL;
604    X509_NAME *nm = NULL;
605    if (!(nm = X509_NAME_new()))
606        goto err;
607    sk = X509V3_get_section(ctx, value);
608    if (!sk) {
609        X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
610        ERR_add_error_data(2, "section=", value);
611        goto err;
612    }
613    /* FIXME: should allow other character types... */
614    ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
615    if (!ret)
616        goto err;
617    gen->d.dirn = nm;
618
619err:
620    if (ret == 0)
621        X509_NAME_free(nm);
622    X509V3_section_free(ctx, sk);
623    return ret;
624}
625