1/* 2 * Copyright (c) 2003-2006,2008,2010 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 * 23 * nameTemplates.c - ASN1 templates for X509 Name, GeneralName, etc. 24 */ 25 26#include "SecAsn1Templates.h" 27#include "nameTemplates.h" 28#include "X509Templates.h" 29#include "keyTemplates.h" 30#include <stddef.h> 31#include <assert.h> 32 33typedef struct { 34 SecAsn1Oid typeId; 35 SecAsn1Item value; // unparsed, BER-encoded 36} CE_OtherName; 37 38// MARK: ----- Generalized NSS_TaggedItem template chooser support ----- 39 40/* 41 * Generalized Template chooser. 42 */ 43const SecAsn1Template * SecAsn1TaggedTemplateChooser( 44 /* Four args passed to specific SecAsn1TemplateChooser */ 45 void *arg, // currently not used 46 Boolean enc, 47 const char *buf, 48 void *dest, 49 /* array of tag/template pairs */ 50 const NSS_TagChoice *chooser) 51{ 52 unsigned char tag = 0; 53 const SecAsn1Template *templ = NULL; 54 NSS_TaggedItem *item = (NSS_TaggedItem *)dest; 55 56 assert(item != NULL); 57 assert((chooser != NULL) && (chooser->templ != NULL)); 58 59 if(enc) { 60 /* encoding: tag from an NSS_TaggedItem at *dest */ 61 tag = item->tag; 62 } 63 else { 64 /* decoding: tag from raw bytes being decoded */ 65 tag = buf[0] & SEC_ASN1_TAGNUM_MASK; 66 /* and tell caller what's coming */ 67 item->tag = tag; 68 } 69 70 /* infer template from tag */ 71 const NSS_TagChoice *thisChoice; 72 for(thisChoice=chooser; thisChoice->templ != NULL; thisChoice++) { 73 if(tag == thisChoice->tag) { 74 templ = thisChoice->templ; 75 break; 76 } 77 } 78 if(templ == NULL) { 79 /* 80 * Tag not found. On decoding, this is the caller's fault 81 * and they'll have to deal with it. 82 * On decode, pick a template guaranteed to cause a decoding 83 * failure - the template from the first array of 84 * NSS_TagChoices should do the trick since its tag didn't match. 85 */ 86 templ = chooser[0].templ; 87 } 88 return templ; 89} 90 91// MARK: ----- X509 Name, RDN ------ 92 93/* AttributeTypeAndValue */ 94 95/* 96 * NSS_ATV Template chooser. 97 */ 98static const NSS_TagChoice atvChoices[] = { 99 { SEC_ASN1_PRINTABLE_STRING, kSecAsn1PrintableStringTemplate} , 100 { SEC_ASN1_TELETEX_STRING, kSecAsn1TeletexStringTemplate }, 101 { SEC_ASN1_UNIVERSAL_STRING, kSecAsn1UniversalStringTemplate }, 102 { SEC_ASN1_UTF8_STRING, kSecAsn1UTF8StringTemplate }, 103 { SEC_ASN1_BMP_STRING, kSecAsn1BMPStringTemplate }, 104 { SEC_ASN1_IA5_STRING, kSecAsn1IA5StringTemplate }, 105 { 0, NULL} 106}; 107 108static const SecAsn1Template * NSS_ATVChooser( 109 void *arg, 110 Boolean enc, 111 const char *buf, 112 void *dest) 113{ 114 return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, atvChoices); 115} 116 117static const SecAsn1TemplateChooserPtr NSS_ATVChooserPtr = NSS_ATVChooser; 118 119const SecAsn1Template kSecAsn1ATVTemplate[] = { 120 { SEC_ASN1_SEQUENCE, 121 0, NULL, sizeof(NSS_ATV) }, 122 { SEC_ASN1_OBJECT_ID, 123 offsetof(NSS_ATV,type), }, 124 { SEC_ASN1_INLINE | SEC_ASN1_DYNAMIC, 125 offsetof(NSS_ATV,value), 126 &NSS_ATVChooserPtr }, 127 { 0, } 128}; 129 130/* RelativeDistinguishedName */ 131const SecAsn1Template kSecAsn1RDNTemplate[] = { 132 { SEC_ASN1_SET_OF, 133 offsetof(NSS_RDN,atvs), kSecAsn1ATVTemplate, sizeof(NSS_RDN) } 134}; 135 136/* X509 Name */ 137const SecAsn1Template kSecAsn1NameTemplate[] = { 138 { SEC_ASN1_SEQUENCE_OF, 139 offsetof(NSS_Name,rdns), kSecAsn1RDNTemplate, sizeof(NSS_Name) } 140}; 141 142// MARK: ----- OtherName, GeneralizedName ----- 143 144/* 145 * CE_OtherName.value expressed as ASN_ANY, not en/decoded. 146 */ 147const SecAsn1Template NSS_OtherNameTemplate[] = { 148 { SEC_ASN1_SEQUENCE, 149 0, NULL, sizeof(CE_OtherName) }, 150 { SEC_ASN1_OBJECT_ID, 151 offsetof(CE_OtherName,typeId), }, 152 { SEC_ASN1_ANY, 153 offsetof(CE_OtherName,value), }, 154 { 0, } 155}; 156 157/* 158 * For decoding an OtherName when it's a context-specific CHOICE 159 * of a GeneralName. 160 */ 161const SecAsn1Template kSecAsn1GenNameOtherNameTemplate[] = { 162 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName, 163 0, NSS_OtherNameTemplate, sizeof(CE_OtherName) } 164}; 165 166/* 167 * NSS_GeneralName template chooser. 168 * First, a crufty set of templates specific to this context. 169 * All offsets are zero (the fundamental type is a NSS_TaggedItem). 170 * 171 * NOTE WELL: RFC2459 says that all of the choices within a 172 * GeneralName (which these templates implement) have implicit 173 * context-specific tags. 174 * HOWEVER: RFC2538 and the real world indicate that the directoryName 175 * choice is EXPLICITLY tagged. This causes an extra layer of DER - 176 * the "thing" is wrapped in a header consisting of the tag byte 177 * (SEC_ASN1_CONTEXT_SPECIFIC plus context tag plus SEC_ASN1_CONSTRUCTED) 178 * and the length field. 179 * 180 * To actually implement this in the current pile-of-cruft context, 181 * the directoryName and otherName choices are processed here with 182 * NSS_InnerAnyTemplate which strips off the explicit tag layer, leaving 183 * further processing to the app. 184 * 185 * I sure hope we don't find certs that actually conform to RFC2459 on 186 * this. We might have to handle both. Be forewarned. 187 */ 188 189/* inner contents of an ASN_ANY */ 190static const SecAsn1Template kSecAsn1InnerAnyTemplate[] = { 191 { SEC_ASN1_ANY | SEC_ASN1_INNER, 0, NULL, sizeof(SecAsn1Item) } 192}; 193 194#define NSS_GEN_NAME_OFFSET (offsetof(NSS_GeneralName,item)) 195#define NSS_GEN_NAME_SIZE (sizeof(NSS_GeneralName)) 196 197const SecAsn1Template kSecAsn1OtherNameTemplate[] = { 198 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_OtherName, 199 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 200}; 201const SecAsn1Template kSecAsn1RFC822NameTemplate[] = { 202 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RFC822Name, 203 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 204}; 205const SecAsn1Template kSecAsn1DNSNameTemplate[] = { 206 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_DNSName, 207 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 208}; 209const SecAsn1Template kSecAsn1X400AddressTemplate[] = { 210 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_X400Address, 211 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 212}; 213#if 0 214const SecAsn1Template kSecAsn1DirectoryNameTemplate[] = { 215 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_DirectoryName, 216 NSS_GEN_NAME_OFFSET, kSecAsn1InnerAnyTemplate, NSS_GEN_NAME_SIZE } 217}; 218#else 219const SecAsn1Template kSecAsn1DirectoryNameTemplate[] = { 220 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 221 SEC_ASN1_EXPLICIT | NGT_DirectoryName, 222 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 223 }; 224#endif 225const SecAsn1Template kSecAsn1EdiPartyNameTemplate[] = { 226 { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | NGT_EdiPartyName, 227 NSS_GEN_NAME_OFFSET, kSecAsn1AnyTemplate, NSS_GEN_NAME_SIZE } 228}; 229const SecAsn1Template kSecAsn1URITemplate[] = { 230 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_URI, 231 NSS_GEN_NAME_OFFSET, kSecAsn1IA5StringTemplate, NSS_GEN_NAME_SIZE } 232}; 233const SecAsn1Template kSecAsn1IPAddressTemplate[] = { 234 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_IPAddress, 235 NSS_GEN_NAME_OFFSET, kSecAsn1OctetStringTemplate, NSS_GEN_NAME_SIZE } 236}; 237const SecAsn1Template kSecAsn1RegisteredIDTemplate[] = { 238 { SEC_ASN1_CONTEXT_SPECIFIC | NGT_RegisteredID, 239 NSS_GEN_NAME_OFFSET, kSecAsn1ObjectIDTemplate, NSS_GEN_NAME_SIZE } 240}; 241 242static const NSS_TagChoice genNameChoices[] = { 243 { NGT_OtherName, kSecAsn1OtherNameTemplate} , 244 { NGT_RFC822Name, kSecAsn1RFC822NameTemplate }, 245 { NGT_DNSName, kSecAsn1DNSNameTemplate }, 246 { NGT_X400Address, kSecAsn1X400AddressTemplate }, 247 { NGT_DirectoryName, kSecAsn1DirectoryNameTemplate }, 248 { NGT_EdiPartyName, kSecAsn1EdiPartyNameTemplate }, 249 { NGT_URI, kSecAsn1URITemplate }, 250 { NGT_IPAddress, kSecAsn1IPAddressTemplate }, 251 { NGT_RegisteredID, kSecAsn1RegisteredIDTemplate }, 252 { 0, NULL} 253}; 254 255static const SecAsn1Template * NSS_genNameChooser( 256 void *arg, 257 Boolean enc, 258 const char *buf, 259 void *dest) 260{ 261 return SecAsn1TaggedTemplateChooser(arg, enc, buf, dest, genNameChoices); 262} 263 264static const SecAsn1TemplateChooserPtr NSS_genNameChooserPtr = 265 NSS_genNameChooser; 266 267const SecAsn1Template kSecAsn1GeneralNameTemplate[] = { 268 { SEC_ASN1_DYNAMIC | SEC_ASN1_CONTEXT_SPECIFIC, 269 offsetof(NSS_GeneralName,item), // Needed? 270 &NSS_genNameChooserPtr }, 271 { 0, } // Needed? 272}; 273