2
0

v3_addr.c 35 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293
  1. /*
  2. * Contributed to the OpenSSL Project by the American Registry for
  3. * Internet Numbers ("ARIN").
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. */
  57. /*
  58. * Implementation of RFC 3779 section 2.2.
  59. */
  60. #include <stdio.h>
  61. #include <stdlib.h>
  62. #include "cryptlib.h"
  63. #include <openssl/conf.h>
  64. #include <openssl/asn1.h>
  65. #include <openssl/asn1t.h>
  66. #include <openssl/buffer.h>
  67. #include <openssl/x509v3.h>
  68. #ifndef OPENSSL_NO_RFC3779
  69. /*
  70. * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
  71. */
  72. ASN1_SEQUENCE(IPAddressRange) = {
  73. ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
  74. ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
  75. } ASN1_SEQUENCE_END(IPAddressRange)
  76. ASN1_CHOICE(IPAddressOrRange) = {
  77. ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
  78. ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
  79. } ASN1_CHOICE_END(IPAddressOrRange)
  80. ASN1_CHOICE(IPAddressChoice) = {
  81. ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
  82. ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
  83. } ASN1_CHOICE_END(IPAddressChoice)
  84. ASN1_SEQUENCE(IPAddressFamily) = {
  85. ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
  86. ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
  87. } ASN1_SEQUENCE_END(IPAddressFamily)
  88. ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
  89. ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  90. IPAddrBlocks, IPAddressFamily)
  91. ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
  92. IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
  93. IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
  94. IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
  95. IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
  96. /*
  97. * How much buffer space do we need for a raw address?
  98. */
  99. #define ADDR_RAW_BUF_LEN 16
  100. /*
  101. * What's the address length associated with this AFI?
  102. */
  103. static int length_from_afi(const unsigned afi)
  104. {
  105. switch (afi) {
  106. case IANA_AFI_IPV4:
  107. return 4;
  108. case IANA_AFI_IPV6:
  109. return 16;
  110. default:
  111. return 0;
  112. }
  113. }
  114. /*
  115. * Extract the AFI from an IPAddressFamily.
  116. */
  117. unsigned int v3_addr_get_afi(const IPAddressFamily *f)
  118. {
  119. return ((f != NULL &&
  120. f->addressFamily != NULL &&
  121. f->addressFamily->data != NULL)
  122. ? ((f->addressFamily->data[0] << 8) |
  123. (f->addressFamily->data[1]))
  124. : 0);
  125. }
  126. /*
  127. * Expand the bitstring form of an address into a raw byte array.
  128. * At the moment this is coded for simplicity, not speed.
  129. */
  130. static void addr_expand(unsigned char *addr,
  131. const ASN1_BIT_STRING *bs,
  132. const int length,
  133. const unsigned char fill)
  134. {
  135. OPENSSL_assert(bs->length >= 0 && bs->length <= length);
  136. if (bs->length > 0) {
  137. memcpy(addr, bs->data, bs->length);
  138. if ((bs->flags & 7) != 0) {
  139. unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
  140. if (fill == 0)
  141. addr[bs->length - 1] &= ~mask;
  142. else
  143. addr[bs->length - 1] |= mask;
  144. }
  145. }
  146. memset(addr + bs->length, fill, length - bs->length);
  147. }
  148. /*
  149. * Extract the prefix length from a bitstring.
  150. */
  151. #define addr_prefixlen(bs) ((int) ((bs)->length * 8 - ((bs)->flags & 7)))
  152. /*
  153. * i2r handler for one address bitstring.
  154. */
  155. static int i2r_address(BIO *out,
  156. const unsigned afi,
  157. const unsigned char fill,
  158. const ASN1_BIT_STRING *bs)
  159. {
  160. unsigned char addr[ADDR_RAW_BUF_LEN];
  161. int i, n;
  162. if (bs->length < 0)
  163. return 0;
  164. switch (afi) {
  165. case IANA_AFI_IPV4:
  166. if (bs->length > 4)
  167. return 0;
  168. addr_expand(addr, bs, 4, fill);
  169. BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
  170. break;
  171. case IANA_AFI_IPV6:
  172. if (bs->length > 16)
  173. return 0;
  174. addr_expand(addr, bs, 16, fill);
  175. for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2)
  176. ;
  177. for (i = 0; i < n; i += 2)
  178. BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i+1], (i < 14 ? ":" : ""));
  179. if (i < 16)
  180. BIO_puts(out, ":");
  181. if (i == 0)
  182. BIO_puts(out, ":");
  183. break;
  184. default:
  185. for (i = 0; i < bs->length; i++)
  186. BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
  187. BIO_printf(out, "[%d]", (int) (bs->flags & 7));
  188. break;
  189. }
  190. return 1;
  191. }
  192. /*
  193. * i2r handler for a sequence of addresses and ranges.
  194. */
  195. static int i2r_IPAddressOrRanges(BIO *out,
  196. const int indent,
  197. const IPAddressOrRanges *aors,
  198. const unsigned afi)
  199. {
  200. int i;
  201. for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
  202. const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
  203. BIO_printf(out, "%*s", indent, "");
  204. switch (aor->type) {
  205. case IPAddressOrRange_addressPrefix:
  206. if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
  207. return 0;
  208. BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
  209. continue;
  210. case IPAddressOrRange_addressRange:
  211. if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
  212. return 0;
  213. BIO_puts(out, "-");
  214. if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
  215. return 0;
  216. BIO_puts(out, "\n");
  217. continue;
  218. }
  219. }
  220. return 1;
  221. }
  222. /*
  223. * i2r handler for an IPAddrBlocks extension.
  224. */
  225. static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
  226. void *ext,
  227. BIO *out,
  228. int indent)
  229. {
  230. const IPAddrBlocks *addr = ext;
  231. int i;
  232. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  233. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  234. const unsigned int afi = v3_addr_get_afi(f);
  235. switch (afi) {
  236. case IANA_AFI_IPV4:
  237. BIO_printf(out, "%*sIPv4", indent, "");
  238. break;
  239. case IANA_AFI_IPV6:
  240. BIO_printf(out, "%*sIPv6", indent, "");
  241. break;
  242. default:
  243. BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
  244. break;
  245. }
  246. if (f->addressFamily->length > 2) {
  247. switch (f->addressFamily->data[2]) {
  248. case 1:
  249. BIO_puts(out, " (Unicast)");
  250. break;
  251. case 2:
  252. BIO_puts(out, " (Multicast)");
  253. break;
  254. case 3:
  255. BIO_puts(out, " (Unicast/Multicast)");
  256. break;
  257. case 4:
  258. BIO_puts(out, " (MPLS)");
  259. break;
  260. case 64:
  261. BIO_puts(out, " (Tunnel)");
  262. break;
  263. case 65:
  264. BIO_puts(out, " (VPLS)");
  265. break;
  266. case 66:
  267. BIO_puts(out, " (BGP MDT)");
  268. break;
  269. case 128:
  270. BIO_puts(out, " (MPLS-labeled VPN)");
  271. break;
  272. default:
  273. BIO_printf(out, " (Unknown SAFI %u)",
  274. (unsigned) f->addressFamily->data[2]);
  275. break;
  276. }
  277. }
  278. switch (f->ipAddressChoice->type) {
  279. case IPAddressChoice_inherit:
  280. BIO_puts(out, ": inherit\n");
  281. break;
  282. case IPAddressChoice_addressesOrRanges:
  283. BIO_puts(out, ":\n");
  284. if (!i2r_IPAddressOrRanges(out,
  285. indent + 2,
  286. f->ipAddressChoice->u.addressesOrRanges,
  287. afi))
  288. return 0;
  289. break;
  290. }
  291. }
  292. return 1;
  293. }
  294. /*
  295. * Sort comparison function for a sequence of IPAddressOrRange
  296. * elements.
  297. */
  298. static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
  299. const IPAddressOrRange *b,
  300. const int length)
  301. {
  302. unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
  303. int prefixlen_a = 0, prefixlen_b = 0;
  304. int r;
  305. switch (a->type) {
  306. case IPAddressOrRange_addressPrefix:
  307. addr_expand(addr_a, a->u.addressPrefix, length, 0x00);
  308. prefixlen_a = addr_prefixlen(a->u.addressPrefix);
  309. break;
  310. case IPAddressOrRange_addressRange:
  311. addr_expand(addr_a, a->u.addressRange->min, length, 0x00);
  312. prefixlen_a = length * 8;
  313. break;
  314. }
  315. switch (b->type) {
  316. case IPAddressOrRange_addressPrefix:
  317. addr_expand(addr_b, b->u.addressPrefix, length, 0x00);
  318. prefixlen_b = addr_prefixlen(b->u.addressPrefix);
  319. break;
  320. case IPAddressOrRange_addressRange:
  321. addr_expand(addr_b, b->u.addressRange->min, length, 0x00);
  322. prefixlen_b = length * 8;
  323. break;
  324. }
  325. if ((r = memcmp(addr_a, addr_b, length)) != 0)
  326. return r;
  327. else
  328. return prefixlen_a - prefixlen_b;
  329. }
  330. /*
  331. * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
  332. * comparision routines are only allowed two arguments.
  333. */
  334. static int v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
  335. const IPAddressOrRange * const *b)
  336. {
  337. return IPAddressOrRange_cmp(*a, *b, 4);
  338. }
  339. /*
  340. * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
  341. * comparision routines are only allowed two arguments.
  342. */
  343. static int v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
  344. const IPAddressOrRange * const *b)
  345. {
  346. return IPAddressOrRange_cmp(*a, *b, 16);
  347. }
  348. /*
  349. * Calculate whether a range collapses to a prefix.
  350. * See last paragraph of RFC 3779 2.2.3.7.
  351. */
  352. static int range_should_be_prefix(const unsigned char *min,
  353. const unsigned char *max,
  354. const int length)
  355. {
  356. unsigned char mask;
  357. int i, j;
  358. for (i = 0; i < length && min[i] == max[i]; i++)
  359. ;
  360. for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--)
  361. ;
  362. if (i < j)
  363. return -1;
  364. if (i > j)
  365. return i * 8;
  366. mask = min[i] ^ max[i];
  367. switch (mask) {
  368. case 0x01: j = 7; break;
  369. case 0x03: j = 6; break;
  370. case 0x07: j = 5; break;
  371. case 0x0F: j = 4; break;
  372. case 0x1F: j = 3; break;
  373. case 0x3F: j = 2; break;
  374. case 0x7F: j = 1; break;
  375. default: return -1;
  376. }
  377. if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
  378. return -1;
  379. else
  380. return i * 8 + j;
  381. }
  382. /*
  383. * Construct a prefix.
  384. */
  385. static int make_addressPrefix(IPAddressOrRange **result,
  386. unsigned char *addr,
  387. const int prefixlen)
  388. {
  389. int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
  390. IPAddressOrRange *aor = IPAddressOrRange_new();
  391. if (aor == NULL)
  392. return 0;
  393. aor->type = IPAddressOrRange_addressPrefix;
  394. if (aor->u.addressPrefix == NULL &&
  395. (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
  396. goto err;
  397. if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
  398. goto err;
  399. aor->u.addressPrefix->flags &= ~7;
  400. aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  401. if (bitlen > 0) {
  402. aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
  403. aor->u.addressPrefix->flags |= 8 - bitlen;
  404. }
  405. *result = aor;
  406. return 1;
  407. err:
  408. IPAddressOrRange_free(aor);
  409. return 0;
  410. }
  411. /*
  412. * Construct a range. If it can be expressed as a prefix,
  413. * return a prefix instead. Doing this here simplifies
  414. * the rest of the code considerably.
  415. */
  416. static int make_addressRange(IPAddressOrRange **result,
  417. unsigned char *min,
  418. unsigned char *max,
  419. const int length)
  420. {
  421. IPAddressOrRange *aor;
  422. int i, prefixlen;
  423. if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
  424. return make_addressPrefix(result, min, prefixlen);
  425. if ((aor = IPAddressOrRange_new()) == NULL)
  426. return 0;
  427. aor->type = IPAddressOrRange_addressRange;
  428. OPENSSL_assert(aor->u.addressRange == NULL);
  429. if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
  430. goto err;
  431. if (aor->u.addressRange->min == NULL &&
  432. (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
  433. goto err;
  434. if (aor->u.addressRange->max == NULL &&
  435. (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
  436. goto err;
  437. for (i = length; i > 0 && min[i - 1] == 0x00; --i)
  438. ;
  439. if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
  440. goto err;
  441. aor->u.addressRange->min->flags &= ~7;
  442. aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  443. if (i > 0) {
  444. unsigned char b = min[i - 1];
  445. int j = 1;
  446. while ((b & (0xFFU >> j)) != 0)
  447. ++j;
  448. aor->u.addressRange->min->flags |= 8 - j;
  449. }
  450. for (i = length; i > 0 && max[i - 1] == 0xFF; --i)
  451. ;
  452. if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
  453. goto err;
  454. aor->u.addressRange->max->flags &= ~7;
  455. aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  456. if (i > 0) {
  457. unsigned char b = max[i - 1];
  458. int j = 1;
  459. while ((b & (0xFFU >> j)) != (0xFFU >> j))
  460. ++j;
  461. aor->u.addressRange->max->flags |= 8 - j;
  462. }
  463. *result = aor;
  464. return 1;
  465. err:
  466. IPAddressOrRange_free(aor);
  467. return 0;
  468. }
  469. /*
  470. * Construct a new address family or find an existing one.
  471. */
  472. static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
  473. const unsigned afi,
  474. const unsigned *safi)
  475. {
  476. IPAddressFamily *f;
  477. unsigned char key[3];
  478. unsigned keylen;
  479. int i;
  480. key[0] = (afi >> 8) & 0xFF;
  481. key[1] = afi & 0xFF;
  482. if (safi != NULL) {
  483. key[2] = *safi & 0xFF;
  484. keylen = 3;
  485. } else {
  486. keylen = 2;
  487. }
  488. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  489. f = sk_IPAddressFamily_value(addr, i);
  490. OPENSSL_assert(f->addressFamily->data != NULL);
  491. if (f->addressFamily->length == keylen &&
  492. !memcmp(f->addressFamily->data, key, keylen))
  493. return f;
  494. }
  495. if ((f = IPAddressFamily_new()) == NULL)
  496. goto err;
  497. if (f->ipAddressChoice == NULL &&
  498. (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
  499. goto err;
  500. if (f->addressFamily == NULL &&
  501. (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
  502. goto err;
  503. if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
  504. goto err;
  505. if (!sk_IPAddressFamily_push(addr, f))
  506. goto err;
  507. return f;
  508. err:
  509. IPAddressFamily_free(f);
  510. return NULL;
  511. }
  512. /*
  513. * Add an inheritance element.
  514. */
  515. int v3_addr_add_inherit(IPAddrBlocks *addr,
  516. const unsigned afi,
  517. const unsigned *safi)
  518. {
  519. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  520. if (f == NULL ||
  521. f->ipAddressChoice == NULL ||
  522. (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  523. f->ipAddressChoice->u.addressesOrRanges != NULL))
  524. return 0;
  525. if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  526. f->ipAddressChoice->u.inherit != NULL)
  527. return 1;
  528. if (f->ipAddressChoice->u.inherit == NULL &&
  529. (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
  530. return 0;
  531. f->ipAddressChoice->type = IPAddressChoice_inherit;
  532. return 1;
  533. }
  534. /*
  535. * Construct an IPAddressOrRange sequence, or return an existing one.
  536. */
  537. static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
  538. const unsigned afi,
  539. const unsigned *safi)
  540. {
  541. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  542. IPAddressOrRanges *aors = NULL;
  543. if (f == NULL ||
  544. f->ipAddressChoice == NULL ||
  545. (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  546. f->ipAddressChoice->u.inherit != NULL))
  547. return NULL;
  548. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
  549. aors = f->ipAddressChoice->u.addressesOrRanges;
  550. if (aors != NULL)
  551. return aors;
  552. if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
  553. return NULL;
  554. switch (afi) {
  555. case IANA_AFI_IPV4:
  556. sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
  557. break;
  558. case IANA_AFI_IPV6:
  559. sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
  560. break;
  561. }
  562. f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
  563. f->ipAddressChoice->u.addressesOrRanges = aors;
  564. return aors;
  565. }
  566. /*
  567. * Add a prefix.
  568. */
  569. int v3_addr_add_prefix(IPAddrBlocks *addr,
  570. const unsigned afi,
  571. const unsigned *safi,
  572. unsigned char *a,
  573. const int prefixlen)
  574. {
  575. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  576. IPAddressOrRange *aor;
  577. if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
  578. return 0;
  579. if (sk_IPAddressOrRange_push(aors, aor))
  580. return 1;
  581. IPAddressOrRange_free(aor);
  582. return 0;
  583. }
  584. /*
  585. * Add a range.
  586. */
  587. int v3_addr_add_range(IPAddrBlocks *addr,
  588. const unsigned afi,
  589. const unsigned *safi,
  590. unsigned char *min,
  591. unsigned char *max)
  592. {
  593. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  594. IPAddressOrRange *aor;
  595. int length = length_from_afi(afi);
  596. if (aors == NULL)
  597. return 0;
  598. if (!make_addressRange(&aor, min, max, length))
  599. return 0;
  600. if (sk_IPAddressOrRange_push(aors, aor))
  601. return 1;
  602. IPAddressOrRange_free(aor);
  603. return 0;
  604. }
  605. /*
  606. * Extract min and max values from an IPAddressOrRange.
  607. */
  608. static void extract_min_max(IPAddressOrRange *aor,
  609. unsigned char *min,
  610. unsigned char *max,
  611. int length)
  612. {
  613. OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
  614. switch (aor->type) {
  615. case IPAddressOrRange_addressPrefix:
  616. addr_expand(min, aor->u.addressPrefix, length, 0x00);
  617. addr_expand(max, aor->u.addressPrefix, length, 0xFF);
  618. return;
  619. case IPAddressOrRange_addressRange:
  620. addr_expand(min, aor->u.addressRange->min, length, 0x00);
  621. addr_expand(max, aor->u.addressRange->max, length, 0xFF);
  622. return;
  623. }
  624. }
  625. /*
  626. * Public wrapper for extract_min_max().
  627. */
  628. int v3_addr_get_range(IPAddressOrRange *aor,
  629. const unsigned afi,
  630. unsigned char *min,
  631. unsigned char *max,
  632. const int length)
  633. {
  634. int afi_length = length_from_afi(afi);
  635. if (aor == NULL || min == NULL || max == NULL ||
  636. afi_length == 0 || length < afi_length ||
  637. (aor->type != IPAddressOrRange_addressPrefix &&
  638. aor->type != IPAddressOrRange_addressRange))
  639. return 0;
  640. extract_min_max(aor, min, max, afi_length);
  641. return afi_length;
  642. }
  643. /*
  644. * Sort comparision function for a sequence of IPAddressFamily.
  645. *
  646. * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
  647. * the ordering: I can read it as meaning that IPv6 without a SAFI
  648. * comes before IPv4 with a SAFI, which seems pretty weird. The
  649. * examples in appendix B suggest that the author intended the
  650. * null-SAFI rule to apply only within a single AFI, which is what I
  651. * would have expected and is what the following code implements.
  652. */
  653. static int IPAddressFamily_cmp(const IPAddressFamily * const *a_,
  654. const IPAddressFamily * const *b_)
  655. {
  656. const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
  657. const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
  658. int len = ((a->length <= b->length) ? a->length : b->length);
  659. int cmp = memcmp(a->data, b->data, len);
  660. return cmp ? cmp : a->length - b->length;
  661. }
  662. /*
  663. * Check whether an IPAddrBLocks is in canonical form.
  664. */
  665. int v3_addr_is_canonical(IPAddrBlocks *addr)
  666. {
  667. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  668. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  669. IPAddressOrRanges *aors;
  670. int i, j, k;
  671. /*
  672. * Empty extension is cannonical.
  673. */
  674. if (addr == NULL)
  675. return 1;
  676. /*
  677. * Check whether the top-level list is in order.
  678. */
  679. for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
  680. const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
  681. const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
  682. if (IPAddressFamily_cmp(&a, &b) >= 0)
  683. return 0;
  684. }
  685. /*
  686. * Top level's ok, now check each address family.
  687. */
  688. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  689. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  690. int length = length_from_afi(v3_addr_get_afi(f));
  691. /*
  692. * Inheritance is canonical. Anything other than inheritance or
  693. * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
  694. */
  695. if (f == NULL || f->ipAddressChoice == NULL)
  696. return 0;
  697. switch (f->ipAddressChoice->type) {
  698. case IPAddressChoice_inherit:
  699. continue;
  700. case IPAddressChoice_addressesOrRanges:
  701. break;
  702. default:
  703. return 0;
  704. }
  705. /*
  706. * It's an IPAddressOrRanges sequence, check it.
  707. */
  708. aors = f->ipAddressChoice->u.addressesOrRanges;
  709. if (sk_IPAddressOrRange_num(aors) == 0)
  710. return 0;
  711. for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
  712. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  713. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
  714. extract_min_max(a, a_min, a_max, length);
  715. extract_min_max(b, b_min, b_max, length);
  716. /*
  717. * Punt misordered list, overlapping start, or inverted range.
  718. */
  719. if (memcmp(a_min, b_min, length) >= 0 ||
  720. memcmp(a_min, a_max, length) > 0 ||
  721. memcmp(b_min, b_max, length) > 0)
  722. return 0;
  723. /*
  724. * Punt if adjacent or overlapping. Check for adjacency by
  725. * subtracting one from b_min first.
  726. */
  727. for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--)
  728. ;
  729. if (memcmp(a_max, b_min, length) >= 0)
  730. return 0;
  731. /*
  732. * Check for range that should be expressed as a prefix.
  733. */
  734. if (a->type == IPAddressOrRange_addressRange &&
  735. range_should_be_prefix(a_min, a_max, length) >= 0)
  736. return 0;
  737. }
  738. /*
  739. * Check final range to see if it should be a prefix.
  740. */
  741. j = sk_IPAddressOrRange_num(aors) - 1;
  742. {
  743. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  744. if (a->type == IPAddressOrRange_addressRange) {
  745. extract_min_max(a, a_min, a_max, length);
  746. if (range_should_be_prefix(a_min, a_max, length) >= 0)
  747. return 0;
  748. }
  749. }
  750. }
  751. /*
  752. * If we made it through all that, we're happy.
  753. */
  754. return 1;
  755. }
  756. /*
  757. * Whack an IPAddressOrRanges into canonical form.
  758. */
  759. static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
  760. const unsigned afi)
  761. {
  762. int i, j, length = length_from_afi(afi);
  763. /*
  764. * Sort the IPAddressOrRanges sequence.
  765. */
  766. sk_IPAddressOrRange_sort(aors);
  767. /*
  768. * Clean up representation issues, punt on duplicates or overlaps.
  769. */
  770. for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
  771. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
  772. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
  773. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  774. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  775. extract_min_max(a, a_min, a_max, length);
  776. extract_min_max(b, b_min, b_max, length);
  777. /*
  778. * Punt overlaps.
  779. */
  780. if (memcmp(a_max, b_min, length) >= 0)
  781. return 0;
  782. /*
  783. * Merge if a and b are adjacent. We check for
  784. * adjacency by subtracting one from b_min first.
  785. */
  786. for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--)
  787. ;
  788. if (memcmp(a_max, b_min, length) == 0) {
  789. IPAddressOrRange *merged;
  790. if (!make_addressRange(&merged, a_min, b_max, length))
  791. return 0;
  792. sk_IPAddressOrRange_set(aors, i, merged);
  793. sk_IPAddressOrRange_delete(aors, i + 1);
  794. IPAddressOrRange_free(a);
  795. IPAddressOrRange_free(b);
  796. --i;
  797. continue;
  798. }
  799. }
  800. return 1;
  801. }
  802. /*
  803. * Whack an IPAddrBlocks extension into canonical form.
  804. */
  805. int v3_addr_canonize(IPAddrBlocks *addr)
  806. {
  807. int i;
  808. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  809. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  810. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  811. !IPAddressOrRanges_canonize(f->ipAddressChoice->u.addressesOrRanges,
  812. v3_addr_get_afi(f)))
  813. return 0;
  814. }
  815. sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
  816. sk_IPAddressFamily_sort(addr);
  817. OPENSSL_assert(v3_addr_is_canonical(addr));
  818. return 1;
  819. }
  820. /*
  821. * v2i handler for the IPAddrBlocks extension.
  822. */
  823. static void *v2i_IPAddrBlocks(const struct v3_ext_method *method,
  824. struct v3_ext_ctx *ctx,
  825. STACK_OF(CONF_VALUE) *values)
  826. {
  827. static const char v4addr_chars[] = "0123456789.";
  828. static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
  829. IPAddrBlocks *addr = NULL;
  830. char *s = NULL, *t;
  831. int i;
  832. if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
  833. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  834. return NULL;
  835. }
  836. for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
  837. CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
  838. unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
  839. unsigned afi, *safi = NULL, safi_;
  840. const char *addr_chars;
  841. int prefixlen, i1, i2, delim, length;
  842. if ( !name_cmp(val->name, "IPv4")) {
  843. afi = IANA_AFI_IPV4;
  844. } else if (!name_cmp(val->name, "IPv6")) {
  845. afi = IANA_AFI_IPV6;
  846. } else if (!name_cmp(val->name, "IPv4-SAFI")) {
  847. afi = IANA_AFI_IPV4;
  848. safi = &safi_;
  849. } else if (!name_cmp(val->name, "IPv6-SAFI")) {
  850. afi = IANA_AFI_IPV6;
  851. safi = &safi_;
  852. } else {
  853. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_NAME_ERROR);
  854. X509V3_conf_err(val);
  855. goto err;
  856. }
  857. switch (afi) {
  858. case IANA_AFI_IPV4:
  859. addr_chars = v4addr_chars;
  860. break;
  861. case IANA_AFI_IPV6:
  862. addr_chars = v6addr_chars;
  863. break;
  864. }
  865. length = length_from_afi(afi);
  866. /*
  867. * Handle SAFI, if any, and BUF_strdup() so we can null-terminate
  868. * the other input values.
  869. */
  870. if (safi != NULL) {
  871. *safi = strtoul(val->value, &t, 0);
  872. t += strspn(t, " \t");
  873. if (*safi > 0xFF || *t++ != ':') {
  874. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI);
  875. X509V3_conf_err(val);
  876. goto err;
  877. }
  878. t += strspn(t, " \t");
  879. s = BUF_strdup(t);
  880. } else {
  881. s = BUF_strdup(val->value);
  882. }
  883. if (s == NULL) {
  884. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  885. goto err;
  886. }
  887. /*
  888. * Check for inheritance. Not worth additional complexity to
  889. * optimize this (seldom-used) case.
  890. */
  891. if (!strcmp(s, "inherit")) {
  892. if (!v3_addr_add_inherit(addr, afi, safi)) {
  893. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_INHERITANCE);
  894. X509V3_conf_err(val);
  895. goto err;
  896. }
  897. OPENSSL_free(s);
  898. s = NULL;
  899. continue;
  900. }
  901. i1 = strspn(s, addr_chars);
  902. i2 = i1 + strspn(s + i1, " \t");
  903. delim = s[i2++];
  904. s[i1] = '\0';
  905. if (a2i_ipadd(min, s) != length) {
  906. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
  907. X509V3_conf_err(val);
  908. goto err;
  909. }
  910. switch (delim) {
  911. case '/':
  912. prefixlen = (int) strtoul(s + i2, &t, 10);
  913. if (t == s + i2 || *t != '\0') {
  914. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  915. X509V3_conf_err(val);
  916. goto err;
  917. }
  918. if (!v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
  919. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  920. goto err;
  921. }
  922. break;
  923. case '-':
  924. i1 = i2 + strspn(s + i2, " \t");
  925. i2 = i1 + strspn(s + i1, addr_chars);
  926. if (i1 == i2 || s[i2] != '\0') {
  927. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  928. X509V3_conf_err(val);
  929. goto err;
  930. }
  931. if (a2i_ipadd(max, s + i1) != length) {
  932. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
  933. X509V3_conf_err(val);
  934. goto err;
  935. }
  936. if (!v3_addr_add_range(addr, afi, safi, min, max)) {
  937. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  938. goto err;
  939. }
  940. break;
  941. case '\0':
  942. if (!v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
  943. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  944. goto err;
  945. }
  946. break;
  947. default:
  948. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  949. X509V3_conf_err(val);
  950. goto err;
  951. }
  952. OPENSSL_free(s);
  953. s = NULL;
  954. }
  955. /*
  956. * Canonize the result, then we're done.
  957. */
  958. if (!v3_addr_canonize(addr))
  959. goto err;
  960. return addr;
  961. err:
  962. OPENSSL_free(s);
  963. sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
  964. return NULL;
  965. }
  966. /*
  967. * OpenSSL dispatch
  968. */
  969. const X509V3_EXT_METHOD v3_addr = {
  970. NID_sbgp_ipAddrBlock, /* nid */
  971. 0, /* flags */
  972. ASN1_ITEM_ref(IPAddrBlocks), /* template */
  973. 0, 0, 0, 0, /* old functions, ignored */
  974. 0, /* i2s */
  975. 0, /* s2i */
  976. 0, /* i2v */
  977. v2i_IPAddrBlocks, /* v2i */
  978. i2r_IPAddrBlocks, /* i2r */
  979. 0, /* r2i */
  980. NULL /* extension-specific data */
  981. };
  982. /*
  983. * Figure out whether extension sues inheritance.
  984. */
  985. int v3_addr_inherits(IPAddrBlocks *addr)
  986. {
  987. int i;
  988. if (addr == NULL)
  989. return 0;
  990. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  991. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  992. if (f->ipAddressChoice->type == IPAddressChoice_inherit)
  993. return 1;
  994. }
  995. return 0;
  996. }
  997. /*
  998. * Figure out whether parent contains child.
  999. */
  1000. static int addr_contains(IPAddressOrRanges *parent,
  1001. IPAddressOrRanges *child,
  1002. int length)
  1003. {
  1004. unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
  1005. unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
  1006. int p, c;
  1007. if (child == NULL || parent == child)
  1008. return 1;
  1009. if (parent == NULL)
  1010. return 0;
  1011. p = 0;
  1012. for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
  1013. extract_min_max(sk_IPAddressOrRange_value(child, c),
  1014. c_min, c_max, length);
  1015. for (;; p++) {
  1016. if (p >= sk_IPAddressOrRange_num(parent))
  1017. return 0;
  1018. extract_min_max(sk_IPAddressOrRange_value(parent, p),
  1019. p_min, p_max, length);
  1020. if (memcmp(p_max, c_max, length) < 0)
  1021. continue;
  1022. if (memcmp(p_min, c_min, length) > 0)
  1023. return 0;
  1024. break;
  1025. }
  1026. }
  1027. return 1;
  1028. }
  1029. /*
  1030. * Test whether a is a subset of b.
  1031. */
  1032. int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
  1033. {
  1034. int i;
  1035. if (a == NULL || a == b)
  1036. return 1;
  1037. if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b))
  1038. return 0;
  1039. sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
  1040. for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
  1041. IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
  1042. int j = sk_IPAddressFamily_find(b, fa);
  1043. IPAddressFamily *fb;
  1044. fb = sk_IPAddressFamily_value(b, j);
  1045. if (fb == NULL)
  1046. return 0;
  1047. if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
  1048. fa->ipAddressChoice->u.addressesOrRanges,
  1049. length_from_afi(v3_addr_get_afi(fb))))
  1050. return 0;
  1051. }
  1052. return 1;
  1053. }
  1054. /*
  1055. * Validation error handling via callback.
  1056. */
  1057. #define validation_err(_err_) \
  1058. do { \
  1059. if (ctx != NULL) { \
  1060. ctx->error = _err_; \
  1061. ctx->error_depth = i; \
  1062. ctx->current_cert = x; \
  1063. ret = ctx->verify_cb(0, ctx); \
  1064. } else { \
  1065. ret = 0; \
  1066. } \
  1067. if (!ret) \
  1068. goto done; \
  1069. } while (0)
  1070. /*
  1071. * Core code for RFC 3779 2.3 path validation.
  1072. */
  1073. static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx,
  1074. STACK_OF(X509) *chain,
  1075. IPAddrBlocks *ext)
  1076. {
  1077. IPAddrBlocks *child = NULL;
  1078. int i, j, ret = 1;
  1079. X509 *x;
  1080. OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
  1081. OPENSSL_assert(ctx != NULL || ext != NULL);
  1082. OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
  1083. /*
  1084. * Figure out where to start. If we don't have an extension to
  1085. * check, we're done. Otherwise, check canonical form and
  1086. * set up for walking up the chain.
  1087. */
  1088. if (ext != NULL) {
  1089. i = -1;
  1090. x = NULL;
  1091. } else {
  1092. i = 0;
  1093. x = sk_X509_value(chain, i);
  1094. OPENSSL_assert(x != NULL);
  1095. if ((ext = x->rfc3779_addr) == NULL)
  1096. goto done;
  1097. }
  1098. if (!v3_addr_is_canonical(ext))
  1099. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1100. sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
  1101. if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
  1102. X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL, ERR_R_MALLOC_FAILURE);
  1103. ret = 0;
  1104. goto done;
  1105. }
  1106. /*
  1107. * Now walk up the chain. No cert may list resources that its
  1108. * parent doesn't list.
  1109. */
  1110. for (i++; i < sk_X509_num(chain); i++) {
  1111. x = sk_X509_value(chain, i);
  1112. OPENSSL_assert(x != NULL);
  1113. if (!v3_addr_is_canonical(x->rfc3779_addr))
  1114. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1115. if (x->rfc3779_addr == NULL) {
  1116. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1117. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1118. if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
  1119. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1120. break;
  1121. }
  1122. }
  1123. continue;
  1124. }
  1125. sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr, IPAddressFamily_cmp);
  1126. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1127. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1128. int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
  1129. IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, k);
  1130. if (fp == NULL) {
  1131. if (fc->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
  1132. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1133. break;
  1134. }
  1135. continue;
  1136. }
  1137. if (fp->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
  1138. if (fc->ipAddressChoice->type == IPAddressChoice_inherit ||
  1139. addr_contains(fp->ipAddressChoice->u.addressesOrRanges,
  1140. fc->ipAddressChoice->u.addressesOrRanges,
  1141. length_from_afi(v3_addr_get_afi(fc))))
  1142. sk_IPAddressFamily_set(child, j, fp);
  1143. else
  1144. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1145. }
  1146. }
  1147. }
  1148. /*
  1149. * Trust anchor can't inherit.
  1150. */
  1151. OPENSSL_assert(x != NULL);
  1152. if (x->rfc3779_addr != NULL) {
  1153. for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
  1154. IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j);
  1155. if (fp->ipAddressChoice->type == IPAddressChoice_inherit &&
  1156. sk_IPAddressFamily_find(child, fp) >= 0)
  1157. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1158. }
  1159. }
  1160. done:
  1161. sk_IPAddressFamily_free(child);
  1162. return ret;
  1163. }
  1164. #undef validation_err
  1165. /*
  1166. * RFC 3779 2.3 path validation -- called from X509_verify_cert().
  1167. */
  1168. int v3_addr_validate_path(X509_STORE_CTX *ctx)
  1169. {
  1170. return v3_addr_validate_path_internal(ctx, ctx->chain, NULL);
  1171. }
  1172. /*
  1173. * RFC 3779 2.3 path validation of an extension.
  1174. * Test whether chain covers extension.
  1175. */
  1176. int v3_addr_validate_resource_set(STACK_OF(X509) *chain,
  1177. IPAddrBlocks *ext,
  1178. int allow_inheritance)
  1179. {
  1180. if (ext == NULL)
  1181. return 1;
  1182. if (chain == NULL || sk_X509_num(chain) == 0)
  1183. return 0;
  1184. if (!allow_inheritance && v3_addr_inherits(ext))
  1185. return 0;
  1186. return v3_addr_validate_path_internal(NULL, chain, ext);
  1187. }
  1188. #endif /* OPENSSL_NO_RFC3779 */