v3_addr.c 35 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281
  1. /*
  2. * Contributed to the OpenSSL Project by the American Registry for
  3. * Internet Numbers ("ARIN").
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. */
  57. /*
  58. * Implementation of RFC 3779 section 2.2.
  59. */
  60. #include <stdio.h>
  61. #include <stdlib.h>
  62. #include <assert.h>
  63. #include "cryptlib.h"
  64. #include <openssl/conf.h>
  65. #include <openssl/asn1.h>
  66. #include <openssl/asn1t.h>
  67. #include <openssl/buffer.h>
  68. #include <openssl/x509v3.h>
  69. #ifndef OPENSSL_NO_RFC3779
  70. /*
  71. * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
  72. */
  73. ASN1_SEQUENCE(IPAddressRange) = {
  74. ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
  75. ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
  76. } ASN1_SEQUENCE_END(IPAddressRange)
  77. ASN1_CHOICE(IPAddressOrRange) = {
  78. ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
  79. ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
  80. } ASN1_CHOICE_END(IPAddressOrRange)
  81. ASN1_CHOICE(IPAddressChoice) = {
  82. ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
  83. ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
  84. } ASN1_CHOICE_END(IPAddressChoice)
  85. ASN1_SEQUENCE(IPAddressFamily) = {
  86. ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
  87. ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
  88. } ASN1_SEQUENCE_END(IPAddressFamily)
  89. ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
  90. ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  91. IPAddrBlocks, IPAddressFamily)
  92. ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
  93. IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
  94. IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
  95. IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
  96. IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
  97. /*
  98. * How much buffer space do we need for a raw address?
  99. */
  100. #define ADDR_RAW_BUF_LEN 16
  101. /*
  102. * What's the address length associated with this AFI?
  103. */
  104. static int length_from_afi(const unsigned afi)
  105. {
  106. switch (afi) {
  107. case IANA_AFI_IPV4:
  108. return 4;
  109. case IANA_AFI_IPV6:
  110. return 16;
  111. default:
  112. return 0;
  113. }
  114. }
  115. /*
  116. * Extract the AFI from an IPAddressFamily.
  117. */
  118. unsigned v3_addr_get_afi(const IPAddressFamily *f)
  119. {
  120. return ((f != NULL &&
  121. f->addressFamily != NULL &&
  122. f->addressFamily->data != NULL)
  123. ? ((f->addressFamily->data[0] << 8) |
  124. (f->addressFamily->data[1]))
  125. : 0);
  126. }
  127. /*
  128. * Expand the bitstring form of an address into a raw byte array.
  129. * At the moment this is coded for simplicity, not speed.
  130. */
  131. static void addr_expand(unsigned char *addr,
  132. const ASN1_BIT_STRING *bs,
  133. const int length,
  134. const unsigned char fill)
  135. {
  136. assert(bs->length >= 0 && bs->length <= length);
  137. if (bs->length > 0) {
  138. memcpy(addr, bs->data, bs->length);
  139. if ((bs->flags & 7) != 0) {
  140. unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
  141. if (fill == 0)
  142. addr[bs->length - 1] &= ~mask;
  143. else
  144. addr[bs->length - 1] |= mask;
  145. }
  146. }
  147. memset(addr + bs->length, fill, length - bs->length);
  148. }
  149. /*
  150. * Extract the prefix length from a bitstring.
  151. */
  152. #define addr_prefixlen(bs) ((int) ((bs)->length * 8 - ((bs)->flags & 7)))
  153. /*
  154. * i2r handler for one address bitstring.
  155. */
  156. static int i2r_address(BIO *out,
  157. const unsigned afi,
  158. const unsigned char fill,
  159. const ASN1_BIT_STRING *bs)
  160. {
  161. unsigned char addr[ADDR_RAW_BUF_LEN];
  162. int i, n;
  163. switch (afi) {
  164. case IANA_AFI_IPV4:
  165. addr_expand(addr, bs, 4, fill);
  166. BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
  167. break;
  168. case IANA_AFI_IPV6:
  169. addr_expand(addr, bs, 16, fill);
  170. for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2)
  171. ;
  172. for (i = 0; i < n; i += 2)
  173. BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i+1], (i < 14 ? ":" : ""));
  174. if (i < 16)
  175. BIO_puts(out, ":");
  176. break;
  177. default:
  178. for (i = 0; i < bs->length; i++)
  179. BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
  180. BIO_printf(out, "[%d]", (int) (bs->flags & 7));
  181. break;
  182. }
  183. return 1;
  184. }
  185. /*
  186. * i2r handler for a sequence of addresses and ranges.
  187. */
  188. static int i2r_IPAddressOrRanges(BIO *out,
  189. const int indent,
  190. const IPAddressOrRanges *aors,
  191. const unsigned afi)
  192. {
  193. int i;
  194. for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
  195. const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
  196. BIO_printf(out, "%*s", indent, "");
  197. switch (aor->type) {
  198. case IPAddressOrRange_addressPrefix:
  199. if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
  200. return 0;
  201. BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
  202. continue;
  203. case IPAddressOrRange_addressRange:
  204. if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
  205. return 0;
  206. BIO_puts(out, "-");
  207. if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
  208. return 0;
  209. BIO_puts(out, "\n");
  210. continue;
  211. }
  212. }
  213. return 1;
  214. }
  215. /*
  216. * i2r handler for an IPAddrBlocks extension.
  217. */
  218. static int i2r_IPAddrBlocks(X509V3_EXT_METHOD *method,
  219. void *ext,
  220. BIO *out,
  221. int indent)
  222. {
  223. const IPAddrBlocks *addr = ext;
  224. int i;
  225. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  226. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  227. const unsigned afi = v3_addr_get_afi(f);
  228. switch (afi) {
  229. case IANA_AFI_IPV4:
  230. BIO_printf(out, "%*sIPv4", indent, "");
  231. break;
  232. case IANA_AFI_IPV6:
  233. BIO_printf(out, "%*sIPv6", indent, "");
  234. break;
  235. default:
  236. BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
  237. break;
  238. }
  239. if (f->addressFamily->length > 2) {
  240. switch (f->addressFamily->data[2]) {
  241. case 1:
  242. BIO_puts(out, " (Unicast)");
  243. break;
  244. case 2:
  245. BIO_puts(out, " (Multicast)");
  246. break;
  247. case 3:
  248. BIO_puts(out, " (Unicast/Multicast)");
  249. break;
  250. case 4:
  251. BIO_puts(out, " (MPLS)");
  252. break;
  253. case 64:
  254. BIO_puts(out, " (Tunnel)");
  255. break;
  256. case 65:
  257. BIO_puts(out, " (VPLS)");
  258. break;
  259. case 66:
  260. BIO_puts(out, " (BGP MDT)");
  261. break;
  262. case 128:
  263. BIO_puts(out, " (MPLS-labeled VPN)");
  264. break;
  265. default:
  266. BIO_printf(out, " (Unknown SAFI %u)",
  267. (unsigned) f->addressFamily->data[2]);
  268. break;
  269. }
  270. }
  271. switch (f->ipAddressChoice->type) {
  272. case IPAddressChoice_inherit:
  273. BIO_puts(out, ": inherit\n");
  274. break;
  275. case IPAddressChoice_addressesOrRanges:
  276. BIO_puts(out, ":\n");
  277. if (!i2r_IPAddressOrRanges(out,
  278. indent + 2,
  279. f->ipAddressChoice->u.addressesOrRanges,
  280. afi))
  281. return 0;
  282. break;
  283. }
  284. }
  285. return 1;
  286. }
  287. /*
  288. * Sort comparison function for a sequence of IPAddressOrRange
  289. * elements.
  290. */
  291. static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
  292. const IPAddressOrRange *b,
  293. const int length)
  294. {
  295. unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
  296. int prefixlen_a = 0, prefixlen_b = 0;
  297. int r;
  298. switch (a->type) {
  299. case IPAddressOrRange_addressPrefix:
  300. addr_expand(addr_a, a->u.addressPrefix, length, 0x00);
  301. prefixlen_a = addr_prefixlen(a->u.addressPrefix);
  302. break;
  303. case IPAddressOrRange_addressRange:
  304. addr_expand(addr_a, a->u.addressRange->min, length, 0x00);
  305. prefixlen_a = length * 8;
  306. break;
  307. }
  308. switch (b->type) {
  309. case IPAddressOrRange_addressPrefix:
  310. addr_expand(addr_b, b->u.addressPrefix, length, 0x00);
  311. prefixlen_b = addr_prefixlen(b->u.addressPrefix);
  312. break;
  313. case IPAddressOrRange_addressRange:
  314. addr_expand(addr_b, b->u.addressRange->min, length, 0x00);
  315. prefixlen_b = length * 8;
  316. break;
  317. }
  318. if ((r = memcmp(addr_a, addr_b, length)) != 0)
  319. return r;
  320. else
  321. return prefixlen_a - prefixlen_b;
  322. }
  323. /*
  324. * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
  325. * comparision routines are only allowed two arguments.
  326. */
  327. static int v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
  328. const IPAddressOrRange * const *b)
  329. {
  330. return IPAddressOrRange_cmp(*a, *b, 4);
  331. }
  332. /*
  333. * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
  334. * comparision routines are only allowed two arguments.
  335. */
  336. static int v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
  337. const IPAddressOrRange * const *b)
  338. {
  339. return IPAddressOrRange_cmp(*a, *b, 16);
  340. }
  341. /*
  342. * Calculate whether a range collapses to a prefix.
  343. * See last paragraph of RFC 3779 2.2.3.7.
  344. */
  345. static int range_should_be_prefix(const unsigned char *min,
  346. const unsigned char *max,
  347. const int length)
  348. {
  349. unsigned char mask;
  350. int i, j;
  351. for (i = 0; i < length && min[i] == max[i]; i++)
  352. ;
  353. for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--)
  354. ;
  355. if (i < j)
  356. return -1;
  357. if (i > j)
  358. return i * 8;
  359. mask = min[i] ^ max[i];
  360. switch (mask) {
  361. case 0x01: j = 7; break;
  362. case 0x03: j = 6; break;
  363. case 0x07: j = 5; break;
  364. case 0x0F: j = 4; break;
  365. case 0x1F: j = 3; break;
  366. case 0x3F: j = 2; break;
  367. case 0x7F: j = 1; break;
  368. default: return -1;
  369. }
  370. if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
  371. return -1;
  372. else
  373. return i * 8 + j;
  374. }
  375. /*
  376. * Construct a prefix.
  377. */
  378. static int make_addressPrefix(IPAddressOrRange **result,
  379. unsigned char *addr,
  380. const int prefixlen)
  381. {
  382. int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
  383. IPAddressOrRange *aor = IPAddressOrRange_new();
  384. if (aor == NULL)
  385. return 0;
  386. aor->type = IPAddressOrRange_addressPrefix;
  387. if (aor->u.addressPrefix == NULL &&
  388. (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
  389. goto err;
  390. if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
  391. goto err;
  392. aor->u.addressPrefix->flags &= ~7;
  393. aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  394. if (bitlen > 0) {
  395. aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
  396. aor->u.addressPrefix->flags |= 8 - bitlen;
  397. }
  398. *result = aor;
  399. return 1;
  400. err:
  401. IPAddressOrRange_free(aor);
  402. return 0;
  403. }
  404. /*
  405. * Construct a range. If it can be expressed as a prefix,
  406. * return a prefix instead. Doing this here simplifies
  407. * the rest of the code considerably.
  408. */
  409. static int make_addressRange(IPAddressOrRange **result,
  410. unsigned char *min,
  411. unsigned char *max,
  412. const int length)
  413. {
  414. IPAddressOrRange *aor;
  415. int i, prefixlen;
  416. if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
  417. return make_addressPrefix(result, min, prefixlen);
  418. if ((aor = IPAddressOrRange_new()) == NULL)
  419. return 0;
  420. aor->type = IPAddressOrRange_addressRange;
  421. assert(aor->u.addressRange == NULL);
  422. if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
  423. goto err;
  424. if (aor->u.addressRange->min == NULL &&
  425. (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
  426. goto err;
  427. if (aor->u.addressRange->max == NULL &&
  428. (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
  429. goto err;
  430. for (i = length; i > 0 && min[i - 1] == 0x00; --i)
  431. ;
  432. if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
  433. goto err;
  434. aor->u.addressRange->min->flags &= ~7;
  435. aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  436. if (i > 0) {
  437. unsigned char b = min[i - 1];
  438. int j = 1;
  439. while ((b & (0xFFU >> j)) != 0)
  440. ++j;
  441. aor->u.addressRange->min->flags |= 8 - j;
  442. }
  443. for (i = length; i > 0 && max[i - 1] == 0xFF; --i)
  444. ;
  445. if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
  446. goto err;
  447. aor->u.addressRange->max->flags &= ~7;
  448. aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  449. if (i > 0) {
  450. unsigned char b = max[i - 1];
  451. int j = 1;
  452. while ((b & (0xFFU >> j)) != (0xFFU >> j))
  453. ++j;
  454. aor->u.addressRange->max->flags |= 8 - j;
  455. }
  456. *result = aor;
  457. return 1;
  458. err:
  459. IPAddressOrRange_free(aor);
  460. return 0;
  461. }
  462. /*
  463. * Construct a new address family or find an existing one.
  464. */
  465. static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
  466. const unsigned afi,
  467. const unsigned *safi)
  468. {
  469. IPAddressFamily *f;
  470. unsigned char key[3];
  471. unsigned keylen;
  472. int i;
  473. key[0] = (afi >> 8) & 0xFF;
  474. key[1] = afi & 0xFF;
  475. if (safi != NULL) {
  476. key[2] = *safi & 0xFF;
  477. keylen = 3;
  478. } else {
  479. keylen = 2;
  480. }
  481. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  482. f = sk_IPAddressFamily_value(addr, i);
  483. assert(f->addressFamily->data != NULL);
  484. if (f->addressFamily->length == keylen &&
  485. !memcmp(f->addressFamily->data, key, keylen))
  486. return f;
  487. }
  488. if ((f = IPAddressFamily_new()) == NULL)
  489. goto err;
  490. if (f->ipAddressChoice == NULL &&
  491. (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
  492. goto err;
  493. if (f->addressFamily == NULL &&
  494. (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
  495. goto err;
  496. if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
  497. goto err;
  498. if (!sk_IPAddressFamily_push(addr, f))
  499. goto err;
  500. return f;
  501. err:
  502. IPAddressFamily_free(f);
  503. return NULL;
  504. }
  505. /*
  506. * Add an inheritance element.
  507. */
  508. int v3_addr_add_inherit(IPAddrBlocks *addr,
  509. const unsigned afi,
  510. const unsigned *safi)
  511. {
  512. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  513. if (f == NULL ||
  514. f->ipAddressChoice == NULL ||
  515. (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  516. f->ipAddressChoice->u.addressesOrRanges != NULL))
  517. return 0;
  518. if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  519. f->ipAddressChoice->u.inherit != NULL)
  520. return 1;
  521. if (f->ipAddressChoice->u.inherit == NULL &&
  522. (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
  523. return 0;
  524. f->ipAddressChoice->type = IPAddressChoice_inherit;
  525. return 1;
  526. }
  527. /*
  528. * Construct an IPAddressOrRange sequence, or return an existing one.
  529. */
  530. static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
  531. const unsigned afi,
  532. const unsigned *safi)
  533. {
  534. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  535. IPAddressOrRanges *aors = NULL;
  536. if (f == NULL ||
  537. f->ipAddressChoice == NULL ||
  538. (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  539. f->ipAddressChoice->u.inherit != NULL))
  540. return NULL;
  541. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
  542. aors = f->ipAddressChoice->u.addressesOrRanges;
  543. if (aors != NULL)
  544. return aors;
  545. if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
  546. return NULL;
  547. switch (afi) {
  548. case IANA_AFI_IPV4:
  549. sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
  550. break;
  551. case IANA_AFI_IPV6:
  552. sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
  553. break;
  554. }
  555. f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
  556. f->ipAddressChoice->u.addressesOrRanges = aors;
  557. return aors;
  558. }
  559. /*
  560. * Add a prefix.
  561. */
  562. int v3_addr_add_prefix(IPAddrBlocks *addr,
  563. const unsigned afi,
  564. const unsigned *safi,
  565. unsigned char *a,
  566. const int prefixlen)
  567. {
  568. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  569. IPAddressOrRange *aor;
  570. if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
  571. return 0;
  572. if (sk_IPAddressOrRange_push(aors, aor))
  573. return 1;
  574. IPAddressOrRange_free(aor);
  575. return 0;
  576. }
  577. /*
  578. * Add a range.
  579. */
  580. int v3_addr_add_range(IPAddrBlocks *addr,
  581. const unsigned afi,
  582. const unsigned *safi,
  583. unsigned char *min,
  584. unsigned char *max)
  585. {
  586. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  587. IPAddressOrRange *aor;
  588. int length = length_from_afi(afi);
  589. if (aors == NULL)
  590. return 0;
  591. if (!make_addressRange(&aor, min, max, length))
  592. return 0;
  593. if (sk_IPAddressOrRange_push(aors, aor))
  594. return 1;
  595. IPAddressOrRange_free(aor);
  596. return 0;
  597. }
  598. /*
  599. * Extract min and max values from an IPAddressOrRange.
  600. */
  601. static void extract_min_max(IPAddressOrRange *aor,
  602. unsigned char *min,
  603. unsigned char *max,
  604. int length)
  605. {
  606. assert(aor != NULL && min != NULL && max != NULL);
  607. switch (aor->type) {
  608. case IPAddressOrRange_addressPrefix:
  609. addr_expand(min, aor->u.addressPrefix, length, 0x00);
  610. addr_expand(max, aor->u.addressPrefix, length, 0xFF);
  611. return;
  612. case IPAddressOrRange_addressRange:
  613. addr_expand(min, aor->u.addressRange->min, length, 0x00);
  614. addr_expand(max, aor->u.addressRange->max, length, 0xFF);
  615. return;
  616. }
  617. }
  618. /*
  619. * Public wrapper for extract_min_max().
  620. */
  621. int v3_addr_get_range(IPAddressOrRange *aor,
  622. const unsigned afi,
  623. unsigned char *min,
  624. unsigned char *max,
  625. const int length)
  626. {
  627. int afi_length = length_from_afi(afi);
  628. if (aor == NULL || min == NULL || max == NULL ||
  629. afi_length == 0 || length < afi_length ||
  630. (aor->type != IPAddressOrRange_addressPrefix &&
  631. aor->type != IPAddressOrRange_addressRange))
  632. return 0;
  633. extract_min_max(aor, min, max, afi_length);
  634. return afi_length;
  635. }
  636. /*
  637. * Sort comparision function for a sequence of IPAddressFamily.
  638. *
  639. * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
  640. * the ordering: I can read it as meaning that IPv6 without a SAFI
  641. * comes before IPv4 with a SAFI, which seems pretty weird. The
  642. * examples in appendix B suggest that the author intended the
  643. * null-SAFI rule to apply only within a single AFI, which is what I
  644. * would have expected and is what the following code implements.
  645. */
  646. static int IPAddressFamily_cmp(const IPAddressFamily * const *a_,
  647. const IPAddressFamily * const *b_)
  648. {
  649. const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
  650. const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
  651. int len = ((a->length <= b->length) ? a->length : b->length);
  652. int cmp = memcmp(a->data, b->data, len);
  653. return cmp ? cmp : a->length - b->length;
  654. }
  655. /*
  656. * Check whether an IPAddrBLocks is in canonical form.
  657. */
  658. int v3_addr_is_canonical(IPAddrBlocks *addr)
  659. {
  660. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  661. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  662. IPAddressOrRanges *aors;
  663. int i, j, k;
  664. /*
  665. * Empty extension is cannonical.
  666. */
  667. if (addr == NULL)
  668. return 1;
  669. /*
  670. * Check whether the top-level list is in order.
  671. */
  672. for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
  673. const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
  674. const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
  675. if (IPAddressFamily_cmp(&a, &b) >= 0)
  676. return 0;
  677. }
  678. /*
  679. * Top level's ok, now check each address family.
  680. */
  681. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  682. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  683. int length = length_from_afi(v3_addr_get_afi(f));
  684. /*
  685. * Inheritance is canonical. Anything other than inheritance or
  686. * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
  687. */
  688. if (f == NULL || f->ipAddressChoice == NULL)
  689. return 0;
  690. switch (f->ipAddressChoice->type) {
  691. case IPAddressChoice_inherit:
  692. continue;
  693. case IPAddressChoice_addressesOrRanges:
  694. break;
  695. default:
  696. return 0;
  697. }
  698. /*
  699. * It's an IPAddressOrRanges sequence, check it.
  700. */
  701. aors = f->ipAddressChoice->u.addressesOrRanges;
  702. if (sk_IPAddressOrRange_num(aors) == 0)
  703. return 0;
  704. for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
  705. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  706. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
  707. extract_min_max(a, a_min, a_max, length);
  708. extract_min_max(b, b_min, b_max, length);
  709. /*
  710. * Punt misordered list, overlapping start, or inverted range.
  711. */
  712. if (memcmp(a_min, b_min, length) >= 0 ||
  713. memcmp(a_min, a_max, length) > 0 ||
  714. memcmp(b_min, b_max, length) > 0)
  715. return 0;
  716. /*
  717. * Punt if adjacent or overlapping. Check for adjacency by
  718. * subtracting one from b_min first.
  719. */
  720. for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--)
  721. ;
  722. if (memcmp(a_max, b_min, length) >= 0)
  723. return 0;
  724. /*
  725. * Check for range that should be expressed as a prefix.
  726. */
  727. if (a->type == IPAddressOrRange_addressRange &&
  728. range_should_be_prefix(a_min, a_max, length) >= 0)
  729. return 0;
  730. }
  731. /*
  732. * Check final range to see if it should be a prefix.
  733. */
  734. j = sk_IPAddressOrRange_num(aors) - 1;
  735. {
  736. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  737. if (a->type == IPAddressOrRange_addressRange) {
  738. extract_min_max(a, a_min, a_max, length);
  739. if (range_should_be_prefix(a_min, a_max, length) >= 0)
  740. return 0;
  741. }
  742. }
  743. }
  744. /*
  745. * If we made it through all that, we're happy.
  746. */
  747. return 1;
  748. }
  749. /*
  750. * Whack an IPAddressOrRanges into canonical form.
  751. */
  752. static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
  753. const unsigned afi)
  754. {
  755. int i, j, length = length_from_afi(afi);
  756. /*
  757. * Sort the IPAddressOrRanges sequence.
  758. */
  759. sk_IPAddressOrRange_sort(aors);
  760. /*
  761. * Clean up representation issues, punt on duplicates or overlaps.
  762. */
  763. for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
  764. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
  765. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
  766. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  767. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  768. extract_min_max(a, a_min, a_max, length);
  769. extract_min_max(b, b_min, b_max, length);
  770. /*
  771. * Punt overlaps.
  772. */
  773. if (memcmp(a_max, b_min, length) >= 0)
  774. return 0;
  775. /*
  776. * Merge if a and b are adjacent. We check for
  777. * adjacency by subtracting one from b_min first.
  778. */
  779. for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--)
  780. ;
  781. if (memcmp(a_max, b_min, length) == 0) {
  782. IPAddressOrRange *merged;
  783. if (!make_addressRange(&merged, a_min, b_max, length))
  784. return 0;
  785. sk_IPAddressOrRange_set(aors, i, merged);
  786. sk_IPAddressOrRange_delete(aors, i + 1);
  787. IPAddressOrRange_free(a);
  788. IPAddressOrRange_free(b);
  789. --i;
  790. continue;
  791. }
  792. }
  793. return 1;
  794. }
  795. /*
  796. * Whack an IPAddrBlocks extension into canonical form.
  797. */
  798. int v3_addr_canonize(IPAddrBlocks *addr)
  799. {
  800. int i;
  801. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  802. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  803. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  804. !IPAddressOrRanges_canonize(f->ipAddressChoice->u.addressesOrRanges,
  805. v3_addr_get_afi(f)))
  806. return 0;
  807. }
  808. sk_IPAddressFamily_sort(addr);
  809. assert(v3_addr_is_canonical(addr));
  810. return 1;
  811. }
  812. /*
  813. * v2i handler for the IPAddrBlocks extension.
  814. */
  815. static void *v2i_IPAddrBlocks(struct v3_ext_method *method,
  816. struct v3_ext_ctx *ctx,
  817. STACK_OF(CONF_VALUE) *values)
  818. {
  819. static const char v4addr_chars[] = "0123456789.";
  820. static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
  821. IPAddrBlocks *addr = NULL;
  822. char *s = NULL, *t;
  823. int i;
  824. if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
  825. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  826. return NULL;
  827. }
  828. for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
  829. CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
  830. unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
  831. unsigned afi, *safi = NULL, safi_;
  832. const char *addr_chars;
  833. int prefixlen, i1, i2, delim, length;
  834. if ( !name_cmp(val->name, "IPv4")) {
  835. afi = IANA_AFI_IPV4;
  836. } else if (!name_cmp(val->name, "IPv6")) {
  837. afi = IANA_AFI_IPV6;
  838. } else if (!name_cmp(val->name, "IPv4-SAFI")) {
  839. afi = IANA_AFI_IPV4;
  840. safi = &safi_;
  841. } else if (!name_cmp(val->name, "IPv6-SAFI")) {
  842. afi = IANA_AFI_IPV6;
  843. safi = &safi_;
  844. } else {
  845. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_NAME_ERROR);
  846. X509V3_conf_err(val);
  847. goto err;
  848. }
  849. switch (afi) {
  850. case IANA_AFI_IPV4:
  851. addr_chars = v4addr_chars;
  852. break;
  853. case IANA_AFI_IPV6:
  854. addr_chars = v6addr_chars;
  855. break;
  856. }
  857. length = length_from_afi(afi);
  858. /*
  859. * Handle SAFI, if any, and BUF_strdup() so we can null-terminate
  860. * the other input values.
  861. */
  862. if (safi != NULL) {
  863. *safi = strtoul(val->value, &t, 0);
  864. t += strspn(t, " \t");
  865. if (*safi > 0xFF || *t++ != ':') {
  866. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI);
  867. X509V3_conf_err(val);
  868. goto err;
  869. }
  870. t += strspn(t, " \t");
  871. s = BUF_strdup(t);
  872. } else {
  873. s = BUF_strdup(val->value);
  874. }
  875. if (s == NULL) {
  876. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  877. goto err;
  878. }
  879. /*
  880. * Check for inheritance. Not worth additional complexity to
  881. * optimize this (seldom-used) case.
  882. */
  883. if (!strcmp(s, "inherit")) {
  884. if (!v3_addr_add_inherit(addr, afi, safi)) {
  885. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_INHERITANCE);
  886. X509V3_conf_err(val);
  887. goto err;
  888. }
  889. OPENSSL_free(s);
  890. s = NULL;
  891. continue;
  892. }
  893. i1 = strspn(s, addr_chars);
  894. i2 = i1 + strspn(s + i1, " \t");
  895. delim = s[i2++];
  896. s[i1] = '\0';
  897. if (a2i_ipadd(min, s) != length) {
  898. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
  899. X509V3_conf_err(val);
  900. goto err;
  901. }
  902. switch (delim) {
  903. case '/':
  904. prefixlen = (int) strtoul(s + i2, &t, 10);
  905. if (t == s + i2 || *t != '\0') {
  906. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  907. X509V3_conf_err(val);
  908. goto err;
  909. }
  910. if (!v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
  911. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  912. goto err;
  913. }
  914. break;
  915. case '-':
  916. i1 = i2 + strspn(s + i2, " \t");
  917. i2 = i1 + strspn(s + i1, addr_chars);
  918. if (i1 == i2 || s[i2] != '\0') {
  919. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  920. X509V3_conf_err(val);
  921. goto err;
  922. }
  923. if (a2i_ipadd(max, s + i1) != length) {
  924. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
  925. X509V3_conf_err(val);
  926. goto err;
  927. }
  928. if (!v3_addr_add_range(addr, afi, safi, min, max)) {
  929. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  930. goto err;
  931. }
  932. break;
  933. case '\0':
  934. if (!v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
  935. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
  936. goto err;
  937. }
  938. break;
  939. default:
  940. X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR);
  941. X509V3_conf_err(val);
  942. goto err;
  943. }
  944. OPENSSL_free(s);
  945. s = NULL;
  946. }
  947. /*
  948. * Canonize the result, then we're done.
  949. */
  950. if (!v3_addr_canonize(addr))
  951. goto err;
  952. return addr;
  953. err:
  954. OPENSSL_free(s);
  955. sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
  956. return NULL;
  957. }
  958. /*
  959. * OpenSSL dispatch
  960. */
  961. const X509V3_EXT_METHOD v3_addr = {
  962. NID_sbgp_ipAddrBlock, /* nid */
  963. 0, /* flags */
  964. ASN1_ITEM_ref(IPAddrBlocks), /* template */
  965. 0, 0, 0, 0, /* old functions, ignored */
  966. 0, /* i2s */
  967. 0, /* s2i */
  968. 0, /* i2v */
  969. v2i_IPAddrBlocks, /* v2i */
  970. i2r_IPAddrBlocks, /* i2r */
  971. 0, /* r2i */
  972. NULL /* extension-specific data */
  973. };
  974. /*
  975. * Figure out whether extension sues inheritance.
  976. */
  977. int v3_addr_inherits(IPAddrBlocks *addr)
  978. {
  979. int i;
  980. if (addr == NULL)
  981. return 0;
  982. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  983. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  984. if (f->ipAddressChoice->type == IPAddressChoice_inherit)
  985. return 1;
  986. }
  987. return 0;
  988. }
  989. /*
  990. * Figure out whether parent contains child.
  991. */
  992. static int addr_contains(IPAddressOrRanges *parent,
  993. IPAddressOrRanges *child,
  994. int length)
  995. {
  996. unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
  997. unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
  998. int p, c;
  999. if (child == NULL || parent == child)
  1000. return 1;
  1001. if (parent == NULL)
  1002. return 0;
  1003. p = 0;
  1004. for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
  1005. extract_min_max(sk_IPAddressOrRange_value(child, c),
  1006. c_min, c_max, length);
  1007. for (;; p++) {
  1008. if (p >= sk_IPAddressOrRange_num(parent))
  1009. return 0;
  1010. extract_min_max(sk_IPAddressOrRange_value(parent, p),
  1011. p_min, p_max, length);
  1012. if (memcmp(p_max, c_max, length) < 0)
  1013. continue;
  1014. if (memcmp(p_min, c_min, length) > 0)
  1015. return 0;
  1016. break;
  1017. }
  1018. }
  1019. return 1;
  1020. }
  1021. /*
  1022. * Test whether a is a subset of b.
  1023. */
  1024. int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
  1025. {
  1026. int i;
  1027. if (a == NULL || a == b)
  1028. return 1;
  1029. if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b))
  1030. return 0;
  1031. sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
  1032. for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
  1033. IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
  1034. int j = sk_IPAddressFamily_find(b, fa);
  1035. IPAddressFamily *fb = sk_IPAddressFamily_value(b, j);
  1036. if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
  1037. fa->ipAddressChoice->u.addressesOrRanges,
  1038. length_from_afi(v3_addr_get_afi(fb))))
  1039. return 0;
  1040. }
  1041. return 1;
  1042. }
  1043. /*
  1044. * Validation error handling via callback.
  1045. */
  1046. #define validation_err(_err_) \
  1047. do { \
  1048. if (ctx != NULL) { \
  1049. ctx->error = _err_; \
  1050. ctx->error_depth = i; \
  1051. ctx->current_cert = x; \
  1052. ret = ctx->verify_cb(0, ctx); \
  1053. } else { \
  1054. ret = 0; \
  1055. } \
  1056. if (!ret) \
  1057. goto done; \
  1058. } while (0)
  1059. /*
  1060. * Core code for RFC 3779 2.3 path validation.
  1061. */
  1062. static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx,
  1063. STACK_OF(X509) *chain,
  1064. IPAddrBlocks *ext)
  1065. {
  1066. IPAddrBlocks *child = NULL;
  1067. int i, j, ret = 1;
  1068. X509 *x;
  1069. assert(chain != NULL && sk_X509_num(chain) > 0);
  1070. assert(ctx != NULL || ext != NULL);
  1071. assert(ctx == NULL || ctx->verify_cb != NULL);
  1072. /*
  1073. * Figure out where to start. If we don't have an extension to
  1074. * check, we're done. Otherwise, check canonical form and
  1075. * set up for walking up the chain.
  1076. */
  1077. if (ext != NULL) {
  1078. i = -1;
  1079. x = NULL;
  1080. } else {
  1081. i = 0;
  1082. x = sk_X509_value(chain, i);
  1083. assert(x != NULL);
  1084. if ((ext = x->rfc3779_addr) == NULL)
  1085. goto done;
  1086. }
  1087. if (!v3_addr_is_canonical(ext))
  1088. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1089. sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
  1090. if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
  1091. X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL, ERR_R_MALLOC_FAILURE);
  1092. ret = 0;
  1093. goto done;
  1094. }
  1095. /*
  1096. * Now walk up the chain. No cert may list resources that its
  1097. * parent doesn't list.
  1098. */
  1099. for (i++; i < sk_X509_num(chain); i++) {
  1100. x = sk_X509_value(chain, i);
  1101. assert(x != NULL);
  1102. if (!v3_addr_is_canonical(x->rfc3779_addr))
  1103. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1104. if (x->rfc3779_addr == NULL) {
  1105. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1106. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1107. if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
  1108. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1109. break;
  1110. }
  1111. }
  1112. continue;
  1113. }
  1114. sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr, IPAddressFamily_cmp);
  1115. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1116. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1117. int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
  1118. IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, k);
  1119. if (fp == NULL) {
  1120. if (fc->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
  1121. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1122. break;
  1123. }
  1124. continue;
  1125. }
  1126. if (fp->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
  1127. if (fc->ipAddressChoice->type == IPAddressChoice_inherit ||
  1128. addr_contains(fp->ipAddressChoice->u.addressesOrRanges,
  1129. fc->ipAddressChoice->u.addressesOrRanges,
  1130. length_from_afi(v3_addr_get_afi(fc))))
  1131. sk_IPAddressFamily_set(child, j, fp);
  1132. else
  1133. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1134. }
  1135. }
  1136. }
  1137. /*
  1138. * Trust anchor can't inherit.
  1139. */
  1140. assert(x != NULL);
  1141. if (x->rfc3779_addr != NULL) {
  1142. for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
  1143. IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j);
  1144. if (fp->ipAddressChoice->type == IPAddressChoice_inherit &&
  1145. sk_IPAddressFamily_find(child, fp) >= 0)
  1146. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1147. }
  1148. }
  1149. done:
  1150. sk_IPAddressFamily_free(child);
  1151. return ret;
  1152. }
  1153. #undef validation_err
  1154. /*
  1155. * RFC 3779 2.3 path validation -- called from X509_verify_cert().
  1156. */
  1157. int v3_addr_validate_path(X509_STORE_CTX *ctx)
  1158. {
  1159. return v3_addr_validate_path_internal(ctx, ctx->chain, NULL);
  1160. }
  1161. /*
  1162. * RFC 3779 2.3 path validation of an extension.
  1163. * Test whether chain covers extension.
  1164. */
  1165. int v3_addr_validate_resource_set(STACK_OF(X509) *chain,
  1166. IPAddrBlocks *ext,
  1167. int allow_inheritance)
  1168. {
  1169. if (ext == NULL)
  1170. return 1;
  1171. if (chain == NULL || sk_X509_num(chain) == 0)
  1172. return 0;
  1173. if (!allow_inheritance && v3_addr_inherits(ext))
  1174. return 0;
  1175. return v3_addr_validate_path_internal(NULL, chain, ext);
  1176. }
  1177. #endif /* OPENSSL_NO_RFC3779 */