1/*
2 * Copyright (c) 2003-2006,2008,2010-2012,2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 *
23 * nameTemplates.c - ASN1 templates for X509 Name, GeneralName, etc.
24 */
25
26#include "SecAsn1Templates.h"
27#include "nameTemplates.h"
28#include "X509Templates.h"
29#include "keyTemplates.h"
30#include <stddef.h>
31#include <assert.h>
32
33typedef struct {
34    SecAsn1Oid typeId;
35    SecAsn1Item value; // unparsed, BER-encoded
36} CE_OtherName;
37
38// MARK: ----- Generalized NSS_TaggedItem template chooser support -----
39
40/*
41 * Generalized Template chooser.
42 */
43const SecAsn1Template * SecAsn1TaggedTemplateChooser(
44	/* Four args passed to specific SecAsn1TemplateChooser */
45	void *arg, 				// currently not used
46	Boolean enc,
47	const char *buf,
48	void *dest,
49	/* array of tag/template pairs */
50	const NSS_TagChoice *chooser)
51{
52	unsigned char tag = 0;
53	const SecAsn1Template *templ = NULL;
54	NSS_TaggedItem *item = (NSS_TaggedItem *)dest;
55
56	assert(item != NULL);
57	assert((chooser != NULL) && (chooser->templ != NULL));
58
59	if(enc) {
60		/* encoding: tag from an NSS_TaggedItem at *dest */
61		tag = item->tag;
62	}
63	else {
64		/* decoding: tag from raw bytes being decoded */
65		tag = buf[0] & SEC_ASN1_TAGNUM_MASK;
66		/* and tell caller what's coming */
67		item->tag = tag;
68	}
69
70	/* infer template from tag */
71	const NSS_TagChoice *thisChoice;
72	for(thisChoice=chooser; thisChoice->templ != NULL; thisChoice++) {
73		if(tag == thisChoice->tag) {
74			templ = thisChoice->templ;
75			break;
76		}
77	}
78	if(templ == NULL) {
79		/*
80		 * Tag not found. On decoding, this is the caller's fault
81		 * and they'll have to deal with it.
82		 * On decode, pick a template guaranteed to cause a decoding
83		 * failure - the template from the first array of
84		 * NSS_TagChoices should do the trick since its tag didn't match.
85		 */
86		templ = chooser[0].templ;
87	}
88	return templ;
89}
90
91// MARK: ----- X509 Name, RDN ------
92
93/* AttributeTypeAndValue */
94
95/*
96 * NSS_ATV Template chooser.
97 */
98static const NSS_TagChoice atvChoices[] = {
99	{ SEC_ASN1_PRINTABLE_STRING, kSecAsn1PrintableStringTemplate} ,
100	{ SEC_ASN1_TELETEX_STRING, kSecAsn1TeletexStringTemplate },
101	{ SEC_ASN1_UNIVERSAL_STRING, kSecAsn1UniversalStringTemplate },
102	{ SEC_ASN1_UTF8_STRING, kSecAsn1UTF8StringTemplate },
103	{ SEC_ASN1_BMP_STRING, kSecAsn1BMPStringTemplate },
104	{ SEC_ASN1_IA5_STRING, kSecAsn1IA5StringTemplate },
105	{ 0, NULL}
106};
107
108static const SecAsn1Template * NSS_ATVChooser(
109	void *arg,
110	Boolean enc,
111	const char *buf,
112	void *dest)
113{
114	return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, atvChoices);
115}
116
117static const SecAsn1TemplateChooserPtr NSS_ATVChooserPtr = NSS_ATVChooser;
118
119const SecAsn1Template kSecAsn1ATVTemplate[] = {
120    { SEC_ASN1_SEQUENCE,
121	  0, NULL, sizeof(NSS_ATV) },
122    { SEC_ASN1_OBJECT_ID,
123	  offsetof(NSS_ATV,type), },
124    { SEC_ASN1_INLINE | SEC_ASN1_DYNAMIC,
125	  offsetof(NSS_ATV,value),
126	  &NSS_ATVChooserPtr },
127    { 0, }
128};
129
130/* RelativeDistinguishedName */
131const SecAsn1Template kSecAsn1RDNTemplate[] = {
132    { SEC_ASN1_SET_OF,
133	  offsetof(NSS_RDN,atvs), kSecAsn1ATVTemplate, sizeof(NSS_RDN) }
134};
135
136/* X509 Name */
137const SecAsn1Template kSecAsn1NameTemplate[] = {
138    { SEC_ASN1_SEQUENCE_OF,
139	  offsetof(NSS_Name,rdns), kSecAsn1RDNTemplate, sizeof(NSS_Name) }
140};
141
142// MARK: ----- OtherName, GeneralizedName -----
143
144/*
145 * CE_OtherName.value expressed as ASN_ANY, not en/decoded.
146 */
147const SecAsn1Template NSS_OtherNameTemplate[] = {
148    { SEC_ASN1_SEQUENCE,
149	  0, NULL, sizeof(CE_OtherName) },
150    { SEC_ASN1_OBJECT_ID,
151	  offsetof(CE_OtherName,typeId), },
152    { SEC_ASN1_ANY,
153	  offsetof(CE_OtherName,value), },
154    { 0, }
155};
156
157/*
158 * For decoding an OtherName when it's a context-specific CHOICE
159 * of a GeneralName.
160 */
161const SecAsn1Template kSecAsn1GenNameOtherNameTemplate[] = {
162    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName,
163	  0, NSS_OtherNameTemplate, sizeof(CE_OtherName) }
164};
165
166/*
167 * NSS_GeneralName template chooser.
168 * First, a crufty set of templates specific to this context.
169 * All offsets are zero (the fundamental type is a NSS_TaggedItem).
170 *
171 * NOTE WELL: RFC2459 says that all of the choices within a
172 * GeneralName (which these templates implement) have implicit
173 * context-specific tags.
174 * HOWEVER: RFC2538 and the real world indicate that the directoryName
175 * choice is EXPLICITLY tagged. This causes an extra layer of DER -
176 * the "thing" is wrapped in a header consisting of the tag byte
177 * (SEC_ASN1_CONTEXT_SPECIFIC plus context tag plus SEC_ASN1_CONSTRUCTED)
178 * and the length field.
179 *
180 * To actually implement this in the current pile-of-cruft context,
181 * the directoryName and otherName choices are processed here with
182 * NSS_InnerAnyTemplate which strips off the explicit tag layer, leaving
183 * further processing to the app.
184 *
185 * I sure hope we don't find certs that actually conform to RFC2459 on
186 * this. We might have to handle both. Be forewarned.
187 */
188
189/* inner contents of an ASN_ANY */
190
191#define NSS_GEN_NAME_OFFSET	(offsetof(NSS_GeneralName,item))
192#define NSS_GEN_NAME_SIZE	(sizeof(NSS_GeneralName))
193
194const SecAsn1Template kSecAsn1OtherNameTemplate[] = {
195    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName,
196      NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE }
197};
198const SecAsn1Template kSecAsn1RFC822NameTemplate[] = {
199    { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RFC822Name,
200      NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE }
201};
202const SecAsn1Template kSecAsn1DNSNameTemplate[] = {
203    { SEC_ASN1_CONTEXT_SPECIFIC | NGT_DNSName,
204      NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE }
205};
206const SecAsn1Template kSecAsn1X400AddressTemplate[] = {
207    { SEC_ASN1_CONTEXT_SPECIFIC |  SEC_ASN1_CONSTRUCTED | NGT_X400Address,
208      NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE }
209};
210const SecAsn1Template kSecAsn1DirectoryNameTemplate[] = {
211    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED |
212	  SEC_ASN1_EXPLICIT | NGT_DirectoryName,
213      NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE }
214	};
215const SecAsn1Template kSecAsn1EdiPartyNameTemplate[] = {
216    { SEC_ASN1_CONTEXT_SPECIFIC |  SEC_ASN1_CONSTRUCTED | NGT_EdiPartyName,
217      NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE }
218};
219const SecAsn1Template kSecAsn1URITemplate[] = {
220    { SEC_ASN1_CONTEXT_SPECIFIC | NGT_URI,
221      NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE }
222};
223const SecAsn1Template kSecAsn1IPAddressTemplate[] = {
224    { SEC_ASN1_CONTEXT_SPECIFIC | NGT_IPAddress,
225      NSS_GEN_NAME_OFFSET, kSecAsn1OctetStringTemplate, NSS_GEN_NAME_SIZE }
226};
227const SecAsn1Template kSecAsn1RegisteredIDTemplate[] = {
228    { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RegisteredID,
229      NSS_GEN_NAME_OFFSET, kSecAsn1ObjectIDTemplate, NSS_GEN_NAME_SIZE }
230};
231
232static const NSS_TagChoice genNameChoices[] = {
233	{ NGT_OtherName, kSecAsn1OtherNameTemplate} ,
234	{ NGT_RFC822Name, kSecAsn1RFC822NameTemplate },
235	{ NGT_DNSName, kSecAsn1DNSNameTemplate },
236	{ NGT_X400Address, kSecAsn1X400AddressTemplate },
237	{ NGT_DirectoryName, kSecAsn1DirectoryNameTemplate },
238	{ NGT_EdiPartyName, kSecAsn1EdiPartyNameTemplate },
239	{ NGT_URI, kSecAsn1URITemplate },
240	{ NGT_IPAddress, kSecAsn1IPAddressTemplate },
241	{ NGT_RegisteredID, kSecAsn1RegisteredIDTemplate },
242	{ 0, NULL}
243};
244
245static const SecAsn1Template * NSS_genNameChooser(
246	void *arg,
247	Boolean enc,
248	const char *buf,
249	void *dest)
250{
251	return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, genNameChoices);
252}
253
254static const SecAsn1TemplateChooserPtr NSS_genNameChooserPtr =
255	NSS_genNameChooser;
256
257const SecAsn1Template kSecAsn1GeneralNameTemplate[] = {
258    { SEC_ASN1_DYNAMIC | SEC_ASN1_CONTEXT_SPECIFIC,
259	  offsetof(NSS_GeneralName,item),		// Needed?
260	  &NSS_genNameChooserPtr },
261    { 0, }									// Needed?
262};
263