1/* 2 * Copyright (c) 2003-2006,2008,2010-2012,2014 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 * 23 * nameTemplates.c - ASN1 templates for X509 Name, GeneralName, etc. 24 */ 25 26#include "SecAsn1Templates.h" 27#include "nameTemplates.h" 28#include "X509Templates.h" 29#include "keyTemplates.h" 30#include <stddef.h> 31#include <assert.h> 32 33typedef struct { 34 SecAsn1Oid typeId; 35 SecAsn1Item value; // unparsed, BER-encoded 36} CE_OtherName; 37 38// MARK: ----- Generalized NSS_TaggedItem template chooser support ----- 39 40/* 41 * Generalized Template chooser. 42 */ 43const SecAsn1Template * SecAsn1TaggedTemplateChooser( 44 /* Four args passed to specific SecAsn1TemplateChooser */ 45 void *arg, // currently not used 46 Boolean enc, 47 const char *buf, 48 void *dest, 49 /* array of tag/template pairs */ 50 const NSS_TagChoice *chooser) 51{ 52 unsigned char tag = 0; 53 const SecAsn1Template *templ = NULL; 54 NSS_TaggedItem *item = (NSS_TaggedItem *)dest; 55 56 assert(item != NULL); 57 assert((chooser != NULL) && (chooser->templ != NULL)); 58 59 if(enc) { 60 /* encoding: tag from an NSS_TaggedItem at *dest */ 61 tag = item->tag; 62 } 63 else { 64 /* decoding: tag from raw bytes being decoded */ 65 tag = buf[0] & SEC_ASN1_TAGNUM_MASK; 66 /* and tell caller what's coming */ 67 item->tag = tag; 68 } 69 70 /* infer template from tag */ 71 const NSS_TagChoice *thisChoice; 72 for(thisChoice=chooser; thisChoice->templ != NULL; thisChoice++) { 73 if(tag == thisChoice->tag) { 74 templ = thisChoice->templ; 75 break; 76 } 77 } 78 if(templ == NULL) { 79 /* 80 * Tag not found. On decoding, this is the caller's fault 81 * and they'll have to deal with it. 82 * On decode, pick a template guaranteed to cause a decoding 83 * failure - the template from the first array of 84 * NSS_TagChoices should do the trick since its tag didn't match. 85 */ 86 templ = chooser[0].templ; 87 } 88 return templ; 89} 90 91// MARK: ----- X509 Name, RDN ------ 92 93/* AttributeTypeAndValue */ 94 95/* 96 * NSS_ATV Template chooser. 97 */ 98static const NSS_TagChoice atvChoices[] = { 99 { SEC_ASN1_PRINTABLE_STRING, kSecAsn1PrintableStringTemplate} , 100 { SEC_ASN1_TELETEX_STRING, kSecAsn1TeletexStringTemplate }, 101 { SEC_ASN1_UNIVERSAL_STRING, kSecAsn1UniversalStringTemplate }, 102 { SEC_ASN1_UTF8_STRING, kSecAsn1UTF8StringTemplate }, 103 { SEC_ASN1_BMP_STRING, kSecAsn1BMPStringTemplate }, 104 { SEC_ASN1_IA5_STRING, kSecAsn1IA5StringTemplate }, 105 { 0, NULL} 106}; 107 108static const SecAsn1Template * NSS_ATVChooser( 109 void *arg, 110 Boolean enc, 111 const char *buf, 112 void *dest) 113{ 114 return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, atvChoices); 115} 116 117static const SecAsn1TemplateChooserPtr NSS_ATVChooserPtr = NSS_ATVChooser; 118 119const SecAsn1Template kSecAsn1ATVTemplate[] = { 120 { SEC_ASN1_SEQUENCE, 121 0, NULL, sizeof(NSS_ATV) }, 122 { SEC_ASN1_OBJECT_ID, 123 offsetof(NSS_ATV,type), }, 124 { SEC_ASN1_INLINE | SEC_ASN1_DYNAMIC, 125 offsetof(NSS_ATV,value), 126 &NSS_ATVChooserPtr }, 127 { 0, } 128}; 129 130/* RelativeDistinguishedName */ 131const SecAsn1Template kSecAsn1RDNTemplate[] = { 132 { SEC_ASN1_SET_OF, 133 offsetof(NSS_RDN,atvs), kSecAsn1ATVTemplate, sizeof(NSS_RDN) } 134}; 135 136/* X509 Name */ 137const SecAsn1Template kSecAsn1NameTemplate[] = { 138 { SEC_ASN1_SEQUENCE_OF, 139 offsetof(NSS_Name,rdns), kSecAsn1RDNTemplate, sizeof(NSS_Name) } 140}; 141 142// MARK: ----- OtherName, GeneralizedName ----- 143 144/* 145 * CE_OtherName.value expressed as ASN_ANY, not en/decoded. 146 */ 147const SecAsn1Template NSS_OtherNameTemplate[] = { 148 { SEC_ASN1_SEQUENCE, 149 0, NULL, sizeof(CE_OtherName) }, 150 { SEC_ASN1_OBJECT_ID, 151 offsetof(CE_OtherName,typeId), }, 152 { SEC_ASN1_ANY, 153 offsetof(CE_OtherName,value), }, 154 { 0, } 155}; 156 157/* 158 * For decoding an OtherName when it's a context-specific CHOICE 159 * of a GeneralName. 160 */ 161const SecAsn1Template kSecAsn1GenNameOtherNameTemplate[] = { 162 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName, 163 0, NSS_OtherNameTemplate, sizeof(CE_OtherName) } 164}; 165 166/* 167 * NSS_GeneralName template chooser. 168 * First, a crufty set of templates specific to this context. 169 * All offsets are zero (the fundamental type is a NSS_TaggedItem). 170 * 171 * NOTE WELL: RFC2459 says that all of the choices within a 172 * GeneralName (which these templates implement) have implicit 173 * context-specific tags. 174 * HOWEVER: RFC2538 and the real world indicate that the directoryName 175 * choice is EXPLICITLY tagged. This causes an extra layer of DER - 176 * the "thing" is wrapped in a header consisting of the tag byte 177 * (SEC_ASN1_CONTEXT_SPECIFIC plus context tag plus SEC_ASN1_CONSTRUCTED) 178 * and the length field. 179 * 180 * To actually implement this in the current pile-of-cruft context, 181 * the directoryName and otherName choices are processed here with 182 * NSS_InnerAnyTemplate which strips off the explicit tag layer, leaving 183 * further processing to the app. 184 * 185 * I sure hope we don't find certs that actually conform to RFC2459 on 186 * this. We might have to handle both. Be forewarned. 187 */ 188 189/* inner contents of an ASN_ANY */ 190 191#define NSS_GEN_NAME_OFFSET (offsetof(NSS_GeneralName,item)) 192#define NSS_GEN_NAME_SIZE (sizeof(NSS_GeneralName)) 193 194const SecAsn1Template kSecAsn1OtherNameTemplate[] = { 195 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName, 196 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 197}; 198const SecAsn1Template kSecAsn1RFC822NameTemplate[] = { 199 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RFC822Name, 200 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 201}; 202const SecAsn1Template kSecAsn1DNSNameTemplate[] = { 203 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_DNSName, 204 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 205}; 206const SecAsn1Template kSecAsn1X400AddressTemplate[] = { 207 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_X400Address, 208 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 209}; 210const SecAsn1Template kSecAsn1DirectoryNameTemplate[] = { 211 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 212 SEC_ASN1_EXPLICIT | NGT_DirectoryName, 213 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 214 }; 215const SecAsn1Template kSecAsn1EdiPartyNameTemplate[] = { 216 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_EdiPartyName, 217 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 218}; 219const SecAsn1Template kSecAsn1URITemplate[] = { 220 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_URI, 221 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 222}; 223const SecAsn1Template kSecAsn1IPAddressTemplate[] = { 224 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_IPAddress, 225 NSS_GEN_NAME_OFFSET, kSecAsn1OctetStringTemplate, NSS_GEN_NAME_SIZE } 226}; 227const SecAsn1Template kSecAsn1RegisteredIDTemplate[] = { 228 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RegisteredID, 229 NSS_GEN_NAME_OFFSET, kSecAsn1ObjectIDTemplate, NSS_GEN_NAME_SIZE } 230}; 231 232static const NSS_TagChoice genNameChoices[] = { 233 { NGT_OtherName, kSecAsn1OtherNameTemplate} , 234 { NGT_RFC822Name, kSecAsn1RFC822NameTemplate }, 235 { NGT_DNSName, kSecAsn1DNSNameTemplate }, 236 { NGT_X400Address, kSecAsn1X400AddressTemplate }, 237 { NGT_DirectoryName, kSecAsn1DirectoryNameTemplate }, 238 { NGT_EdiPartyName, kSecAsn1EdiPartyNameTemplate }, 239 { NGT_URI, kSecAsn1URITemplate }, 240 { NGT_IPAddress, kSecAsn1IPAddressTemplate }, 241 { NGT_RegisteredID, kSecAsn1RegisteredIDTemplate }, 242 { 0, NULL} 243}; 244 245static const SecAsn1Template * NSS_genNameChooser( 246 void *arg, 247 Boolean enc, 248 const char *buf, 249 void *dest) 250{ 251 return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, genNameChoices); 252} 253 254static const SecAsn1TemplateChooserPtr NSS_genNameChooserPtr = 255 NSS_genNameChooser; 256 257const SecAsn1Template kSecAsn1GeneralNameTemplate[] = { 258 { SEC_ASN1_DYNAMIC | SEC_ASN1_CONTEXT_SPECIFIC, 259 offsetof(NSS_GeneralName,item), // Needed? 260 &NSS_genNameChooserPtr }, 261 { 0, } // Needed? 262}; 263