v3_conf.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525
  1. /* v3_conf.c */
  2. /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
  3. * project 1999.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 1999-2002 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. *
  57. */
  58. /* extension creation utilities */
  59. #include <stdio.h>
  60. #include <ctype.h>
  61. #include "cryptlib.h"
  62. #include <openssl/conf.h>
  63. #include <openssl/x509.h>
  64. #include <openssl/x509v3.h>
  65. static int v3_check_critical(char **value);
  66. static int v3_check_generic(char **value);
  67. static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value);
  68. static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type, X509V3_CTX *ctx);
  69. static char *conf_lhash_get_string(void *db, char *section, char *value);
  70. static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section);
  71. static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
  72. int crit, void *ext_struc);
  73. static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len);
  74. /* CONF *conf: Config file */
  75. /* char *name: Name */
  76. /* char *value: Value */
  77. X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name,
  78. char *value)
  79. {
  80. int crit;
  81. int ext_type;
  82. X509_EXTENSION *ret;
  83. crit = v3_check_critical(&value);
  84. if ((ext_type = v3_check_generic(&value)))
  85. return v3_generic_extension(name, value, crit, ext_type, ctx);
  86. ret = do_ext_nconf(conf, ctx, OBJ_sn2nid(name), crit, value);
  87. if (!ret)
  88. {
  89. X509V3err(X509V3_F_X509V3_EXT_NCONF,X509V3_R_ERROR_IN_EXTENSION);
  90. ERR_add_error_data(4,"name=", name, ", value=", value);
  91. }
  92. return ret;
  93. }
  94. /* CONF *conf: Config file */
  95. /* char *value: Value */
  96. X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
  97. char *value)
  98. {
  99. int crit;
  100. int ext_type;
  101. crit = v3_check_critical(&value);
  102. if ((ext_type = v3_check_generic(&value)))
  103. return v3_generic_extension(OBJ_nid2sn(ext_nid),
  104. value, crit, ext_type, ctx);
  105. return do_ext_nconf(conf, ctx, ext_nid, crit, value);
  106. }
  107. /* CONF *conf: Config file */
  108. /* char *value: Value */
  109. static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
  110. int crit, char *value)
  111. {
  112. X509V3_EXT_METHOD *method;
  113. X509_EXTENSION *ext;
  114. STACK_OF(CONF_VALUE) *nval;
  115. void *ext_struc;
  116. if (ext_nid == NID_undef)
  117. {
  118. X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_UNKNOWN_EXTENSION_NAME);
  119. return NULL;
  120. }
  121. if (!(method = X509V3_EXT_get_nid(ext_nid)))
  122. {
  123. X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_UNKNOWN_EXTENSION);
  124. return NULL;
  125. }
  126. /* Now get internal extension representation based on type */
  127. if (method->v2i)
  128. {
  129. if(*value == '@') nval = NCONF_get_section(conf, value + 1);
  130. else nval = X509V3_parse_list(value);
  131. if(sk_CONF_VALUE_num(nval) <= 0)
  132. {
  133. X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_INVALID_EXTENSION_STRING);
  134. ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=", value);
  135. return NULL;
  136. }
  137. ext_struc = method->v2i(method, ctx, nval);
  138. if(*value != '@') sk_CONF_VALUE_pop_free(nval,
  139. X509V3_conf_free);
  140. if(!ext_struc) return NULL;
  141. }
  142. else if(method->s2i)
  143. {
  144. if(!(ext_struc = method->s2i(method, ctx, value))) return NULL;
  145. }
  146. else if(method->r2i)
  147. {
  148. if(!ctx->db || !ctx->db_meth)
  149. {
  150. X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_NO_CONFIG_DATABASE);
  151. return NULL;
  152. }
  153. if(!(ext_struc = method->r2i(method, ctx, value))) return NULL;
  154. }
  155. else
  156. {
  157. X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
  158. ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));
  159. return NULL;
  160. }
  161. ext = do_ext_i2d(method, ext_nid, crit, ext_struc);
  162. if(method->it) ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
  163. else method->ext_free(ext_struc);
  164. return ext;
  165. }
  166. static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
  167. int crit, void *ext_struc)
  168. {
  169. unsigned char *ext_der;
  170. int ext_len;
  171. ASN1_OCTET_STRING *ext_oct;
  172. X509_EXTENSION *ext;
  173. /* Convert internal representation to DER */
  174. if (method->it)
  175. {
  176. ext_der = NULL;
  177. ext_len = ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it));
  178. if (ext_len < 0) goto merr;
  179. }
  180. else
  181. {
  182. unsigned char *p;
  183. ext_len = method->i2d(ext_struc, NULL);
  184. if(!(ext_der = OPENSSL_malloc(ext_len))) goto merr;
  185. p = ext_der;
  186. method->i2d(ext_struc, &p);
  187. }
  188. if (!(ext_oct = M_ASN1_OCTET_STRING_new())) goto merr;
  189. ext_oct->data = ext_der;
  190. ext_oct->length = ext_len;
  191. ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
  192. if (!ext) goto merr;
  193. M_ASN1_OCTET_STRING_free(ext_oct);
  194. return ext;
  195. merr:
  196. X509V3err(X509V3_F_DO_EXT_I2D,ERR_R_MALLOC_FAILURE);
  197. return NULL;
  198. }
  199. /* Given an internal structure, nid and critical flag create an extension */
  200. X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc)
  201. {
  202. X509V3_EXT_METHOD *method;
  203. if (!(method = X509V3_EXT_get_nid(ext_nid))) {
  204. X509V3err(X509V3_F_X509V3_EXT_I2D,X509V3_R_UNKNOWN_EXTENSION);
  205. return NULL;
  206. }
  207. return do_ext_i2d(method, ext_nid, crit, ext_struc);
  208. }
  209. /* Check the extension string for critical flag */
  210. static int v3_check_critical(char **value)
  211. {
  212. char *p = *value;
  213. if ((strlen(p) < 9) || strncmp(p, "critical,", 9)) return 0;
  214. p+=9;
  215. while(isspace((unsigned char)*p)) p++;
  216. *value = p;
  217. return 1;
  218. }
  219. /* Check extension string for generic extension and return the type */
  220. static int v3_check_generic(char **value)
  221. {
  222. int gen_type = 0;
  223. char *p = *value;
  224. if ((strlen(p) >= 4) && !strncmp(p, "DER:", 4))
  225. {
  226. p+=4;
  227. gen_type = 1;
  228. }
  229. else if ((strlen(p) >= 5) && !strncmp(p, "ASN1:", 5))
  230. {
  231. p+=5;
  232. gen_type = 2;
  233. }
  234. else
  235. return 0;
  236. while (isspace((unsigned char)*p)) p++;
  237. *value = p;
  238. return gen_type;
  239. }
  240. /* Create a generic extension: for now just handle DER type */
  241. static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
  242. int crit, int gen_type,
  243. X509V3_CTX *ctx)
  244. {
  245. unsigned char *ext_der=NULL;
  246. long ext_len;
  247. ASN1_OBJECT *obj=NULL;
  248. ASN1_OCTET_STRING *oct=NULL;
  249. X509_EXTENSION *extension=NULL;
  250. if (!(obj = OBJ_txt2obj(ext, 0)))
  251. {
  252. X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_NAME_ERROR);
  253. ERR_add_error_data(2, "name=", ext);
  254. goto err;
  255. }
  256. if (gen_type == 1)
  257. ext_der = string_to_hex(value, &ext_len);
  258. else if (gen_type == 2)
  259. ext_der = generic_asn1(value, ctx, &ext_len);
  260. if (ext_der == NULL)
  261. {
  262. X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_VALUE_ERROR);
  263. ERR_add_error_data(2, "value=", value);
  264. goto err;
  265. }
  266. if (!(oct = M_ASN1_OCTET_STRING_new()))
  267. {
  268. X509V3err(X509V3_F_V3_GENERIC_EXTENSION,ERR_R_MALLOC_FAILURE);
  269. goto err;
  270. }
  271. oct->data = ext_der;
  272. oct->length = ext_len;
  273. ext_der = NULL;
  274. extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
  275. err:
  276. ASN1_OBJECT_free(obj);
  277. M_ASN1_OCTET_STRING_free(oct);
  278. if(ext_der) OPENSSL_free(ext_der);
  279. return extension;
  280. }
  281. static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len)
  282. {
  283. ASN1_TYPE *typ;
  284. unsigned char *ext_der = NULL;
  285. typ = ASN1_generate_v3(value, ctx);
  286. if (typ == NULL)
  287. return NULL;
  288. *ext_len = i2d_ASN1_TYPE(typ, &ext_der);
  289. ASN1_TYPE_free(typ);
  290. return ext_der;
  291. }
  292. /* This is the main function: add a bunch of extensions based on a config file
  293. * section to an extension STACK.
  294. */
  295. int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section,
  296. STACK_OF(X509_EXTENSION) **sk)
  297. {
  298. X509_EXTENSION *ext;
  299. STACK_OF(CONF_VALUE) *nval;
  300. CONF_VALUE *val;
  301. int i;
  302. if (!(nval = NCONF_get_section(conf, section))) return 0;
  303. for (i = 0; i < sk_CONF_VALUE_num(nval); i++)
  304. {
  305. val = sk_CONF_VALUE_value(nval, i);
  306. if (!(ext = X509V3_EXT_nconf(conf, ctx, val->name, val->value)))
  307. return 0;
  308. if (sk) X509v3_add_ext(sk, ext, -1);
  309. X509_EXTENSION_free(ext);
  310. }
  311. return 1;
  312. }
  313. /* Convenience functions to add extensions to a certificate, CRL and request */
  314. int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
  315. X509 *cert)
  316. {
  317. STACK_OF(X509_EXTENSION) **sk = NULL;
  318. if (cert)
  319. sk = &cert->cert_info->extensions;
  320. return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
  321. }
  322. /* Same as above but for a CRL */
  323. int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
  324. X509_CRL *crl)
  325. {
  326. STACK_OF(X509_EXTENSION) **sk = NULL;
  327. if (crl)
  328. sk = &crl->crl->extensions;
  329. return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
  330. }
  331. /* Add extensions to certificate request */
  332. int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
  333. X509_REQ *req)
  334. {
  335. STACK_OF(X509_EXTENSION) *extlist = NULL, **sk = NULL;
  336. int i;
  337. if (req)
  338. sk = &extlist;
  339. i = X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
  340. if (!i || !sk)
  341. return i;
  342. i = X509_REQ_add_extensions(req, extlist);
  343. sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
  344. return i;
  345. }
  346. /* Config database functions */
  347. char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
  348. {
  349. if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_string)
  350. {
  351. X509V3err(X509V3_F_X509V3_GET_STRING,X509V3_R_OPERATION_NOT_DEFINED);
  352. return NULL;
  353. }
  354. if (ctx->db_meth->get_string)
  355. return ctx->db_meth->get_string(ctx->db, name, section);
  356. return NULL;
  357. }
  358. STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
  359. {
  360. if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)
  361. {
  362. X509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);
  363. return NULL;
  364. }
  365. if (ctx->db_meth->get_section)
  366. return ctx->db_meth->get_section(ctx->db, section);
  367. return NULL;
  368. }
  369. void X509V3_string_free(X509V3_CTX *ctx, char *str)
  370. {
  371. if (!str) return;
  372. if (ctx->db_meth->free_string)
  373. ctx->db_meth->free_string(ctx->db, str);
  374. }
  375. void X509V3_section_free(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section)
  376. {
  377. if (!section) return;
  378. if (ctx->db_meth->free_section)
  379. ctx->db_meth->free_section(ctx->db, section);
  380. }
  381. static char *nconf_get_string(void *db, char *section, char *value)
  382. {
  383. return NCONF_get_string(db, section, value);
  384. }
  385. static STACK_OF(CONF_VALUE) *nconf_get_section(void *db, char *section)
  386. {
  387. return NCONF_get_section(db, section);
  388. }
  389. static X509V3_CONF_METHOD nconf_method = {
  390. nconf_get_string,
  391. nconf_get_section,
  392. NULL,
  393. NULL
  394. };
  395. void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf)
  396. {
  397. ctx->db_meth = &nconf_method;
  398. ctx->db = conf;
  399. }
  400. void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subj, X509_REQ *req,
  401. X509_CRL *crl, int flags)
  402. {
  403. ctx->issuer_cert = issuer;
  404. ctx->subject_cert = subj;
  405. ctx->crl = crl;
  406. ctx->subject_req = req;
  407. ctx->flags = flags;
  408. }
  409. /* Old conf compatibility functions */
  410. X509_EXTENSION *X509V3_EXT_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
  411. char *name, char *value)
  412. {
  413. CONF ctmp;
  414. CONF_set_nconf(&ctmp, conf);
  415. return X509V3_EXT_nconf(&ctmp, ctx, name, value);
  416. }
  417. /* LHASH *conf: Config file */
  418. /* char *value: Value */
  419. X509_EXTENSION *X509V3_EXT_conf_nid(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
  420. int ext_nid, char *value)
  421. {
  422. CONF ctmp;
  423. CONF_set_nconf(&ctmp, conf);
  424. return X509V3_EXT_nconf_nid(&ctmp, ctx, ext_nid, value);
  425. }
  426. static char *conf_lhash_get_string(void *db, char *section, char *value)
  427. {
  428. return CONF_get_string(db, section, value);
  429. }
  430. static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section)
  431. {
  432. return CONF_get_section(db, section);
  433. }
  434. static X509V3_CONF_METHOD conf_lhash_method = {
  435. conf_lhash_get_string,
  436. conf_lhash_get_section,
  437. NULL,
  438. NULL
  439. };
  440. void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH_OF(CONF_VALUE) *lhash)
  441. {
  442. ctx->db_meth = &conf_lhash_method;
  443. ctx->db = lhash;
  444. }
  445. int X509V3_EXT_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
  446. char *section, X509 *cert)
  447. {
  448. CONF ctmp;
  449. CONF_set_nconf(&ctmp, conf);
  450. return X509V3_EXT_add_nconf(&ctmp, ctx, section, cert);
  451. }
  452. /* Same as above but for a CRL */
  453. int X509V3_EXT_CRL_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
  454. char *section, X509_CRL *crl)
  455. {
  456. CONF ctmp;
  457. CONF_set_nconf(&ctmp, conf);
  458. return X509V3_EXT_CRL_add_nconf(&ctmp, ctx, section, crl);
  459. }
  460. /* Add extensions to certificate request */
  461. int X509V3_EXT_REQ_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
  462. char *section, X509_REQ *req)
  463. {
  464. CONF ctmp;
  465. CONF_set_nconf(&ctmp, conf);
  466. return X509V3_EXT_REQ_add_nconf(&ctmp, ctx, section, req);
  467. }