v3_lib.c 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302
  1. /*
  2. * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /* X509 v3 extension utilities */
  10. #include <stdio.h>
  11. #include "internal/cryptlib.h"
  12. #include <openssl/conf.h>
  13. #include <openssl/x509v3.h>
  14. #include "ext_dat.h"
  15. static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
  16. static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  17. const X509V3_EXT_METHOD *const *b);
  18. static void ext_list_free(X509V3_EXT_METHOD *ext);
  19. int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
  20. {
  21. if (ext_list == NULL
  22. && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) {
  23. ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
  24. return 0;
  25. }
  26. if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
  27. ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
  28. return 0;
  29. }
  30. return 1;
  31. }
  32. static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  33. const X509V3_EXT_METHOD *const *b)
  34. {
  35. return ((*a)->ext_nid - (*b)->ext_nid);
  36. }
  37. DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  38. const X509V3_EXT_METHOD *, ext);
  39. IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  40. const X509V3_EXT_METHOD *, ext);
  41. #include "standard_exts.h"
  42. const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
  43. {
  44. X509V3_EXT_METHOD tmp;
  45. const X509V3_EXT_METHOD *t = &tmp, *const *ret;
  46. int idx;
  47. if (nid < 0)
  48. return NULL;
  49. tmp.ext_nid = nid;
  50. ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
  51. if (ret)
  52. return *ret;
  53. if (!ext_list)
  54. return NULL;
  55. idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
  56. return sk_X509V3_EXT_METHOD_value(ext_list, idx);
  57. }
  58. const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
  59. {
  60. int nid;
  61. if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef)
  62. return NULL;
  63. return X509V3_EXT_get_nid(nid);
  64. }
  65. int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
  66. {
  67. for (; extlist->ext_nid != -1; extlist++)
  68. if (!X509V3_EXT_add(extlist))
  69. return 0;
  70. return 1;
  71. }
  72. int X509V3_EXT_add_alias(int nid_to, int nid_from)
  73. {
  74. const X509V3_EXT_METHOD *ext;
  75. X509V3_EXT_METHOD *tmpext;
  76. if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) {
  77. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND);
  78. return 0;
  79. }
  80. if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL)
  81. return 0;
  82. *tmpext = *ext;
  83. tmpext->ext_nid = nid_to;
  84. tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
  85. return X509V3_EXT_add(tmpext);
  86. }
  87. void X509V3_EXT_cleanup(void)
  88. {
  89. sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
  90. ext_list = NULL;
  91. }
  92. static void ext_list_free(X509V3_EXT_METHOD *ext)
  93. {
  94. if (ext->ext_flags & X509V3_EXT_DYNAMIC)
  95. OPENSSL_free(ext);
  96. }
  97. /*
  98. * Legacy function: we don't need to add standard extensions any more because
  99. * they are now kept in ext_dat.h.
  100. */
  101. int X509V3_add_standard_extensions(void)
  102. {
  103. return 1;
  104. }
  105. /* Return an extension internal structure */
  106. void *X509V3_EXT_d2i(X509_EXTENSION *ext)
  107. {
  108. const X509V3_EXT_METHOD *method;
  109. const unsigned char *p;
  110. ASN1_STRING *extvalue;
  111. int extlen;
  112. if ((method = X509V3_EXT_get(ext)) == NULL)
  113. return NULL;
  114. extvalue = X509_EXTENSION_get_data(ext);
  115. p = ASN1_STRING_get0_data(extvalue);
  116. extlen = ASN1_STRING_length(extvalue);
  117. if (method->it)
  118. return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it));
  119. return method->d2i(NULL, &p, extlen);
  120. }
  121. /*-
  122. * Get critical flag and decoded version of extension from a NID.
  123. * The "idx" variable returns the last found extension and can
  124. * be used to retrieve multiple extensions of the same NID.
  125. * However multiple extensions with the same NID is usually
  126. * due to a badly encoded certificate so if idx is NULL we
  127. * choke if multiple extensions exist.
  128. * The "crit" variable is set to the critical value.
  129. * The return value is the decoded extension or NULL on
  130. * error. The actual error can have several different causes,
  131. * the value of *crit reflects the cause:
  132. * >= 0, extension found but not decoded (reflects critical value).
  133. * -1 extension not found.
  134. * -2 extension occurs more than once.
  135. */
  136. void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
  137. int *idx)
  138. {
  139. int lastpos, i;
  140. X509_EXTENSION *ex, *found_ex = NULL;
  141. if (!x) {
  142. if (idx)
  143. *idx = -1;
  144. if (crit)
  145. *crit = -1;
  146. return NULL;
  147. }
  148. if (idx)
  149. lastpos = *idx + 1;
  150. else
  151. lastpos = 0;
  152. if (lastpos < 0)
  153. lastpos = 0;
  154. for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
  155. ex = sk_X509_EXTENSION_value(x, i);
  156. if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) {
  157. if (idx) {
  158. *idx = i;
  159. found_ex = ex;
  160. break;
  161. } else if (found_ex) {
  162. /* Found more than one */
  163. if (crit)
  164. *crit = -2;
  165. return NULL;
  166. }
  167. found_ex = ex;
  168. }
  169. }
  170. if (found_ex) {
  171. /* Found it */
  172. if (crit)
  173. *crit = X509_EXTENSION_get_critical(found_ex);
  174. return X509V3_EXT_d2i(found_ex);
  175. }
  176. /* Extension not found */
  177. if (idx)
  178. *idx = -1;
  179. if (crit)
  180. *crit = -1;
  181. return NULL;
  182. }
  183. /*
  184. * This function is a general extension append, replace and delete utility.
  185. * The precise operation is governed by the 'flags' value. The 'crit' and
  186. * 'value' arguments (if relevant) are the extensions internal structure.
  187. */
  188. int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
  189. int crit, unsigned long flags)
  190. {
  191. int errcode, extidx = -1;
  192. X509_EXTENSION *ext = NULL, *extmp;
  193. STACK_OF(X509_EXTENSION) *ret = NULL;
  194. unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
  195. /*
  196. * If appending we don't care if it exists, otherwise look for existing
  197. * extension.
  198. */
  199. if (ext_op != X509V3_ADD_APPEND)
  200. extidx = X509v3_get_ext_by_NID(*x, nid, -1);
  201. /* See if extension exists */
  202. if (extidx >= 0) {
  203. /* If keep existing, nothing to do */
  204. if (ext_op == X509V3_ADD_KEEP_EXISTING)
  205. return 1;
  206. /* If default then its an error */
  207. if (ext_op == X509V3_ADD_DEFAULT) {
  208. errcode = X509V3_R_EXTENSION_EXISTS;
  209. goto err;
  210. }
  211. /* If delete, just delete it */
  212. if (ext_op == X509V3_ADD_DELETE) {
  213. extmp = sk_X509_EXTENSION_delete(*x, extidx);
  214. if (extmp == NULL)
  215. return -1;
  216. X509_EXTENSION_free(extmp);
  217. return 1;
  218. }
  219. } else {
  220. /*
  221. * If replace existing or delete, error since extension must exist
  222. */
  223. if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
  224. (ext_op == X509V3_ADD_DELETE)) {
  225. errcode = X509V3_R_EXTENSION_NOT_FOUND;
  226. goto err;
  227. }
  228. }
  229. /*
  230. * If we get this far then we have to create an extension: could have
  231. * some flags for alternative encoding schemes...
  232. */
  233. ext = X509V3_EXT_i2d(nid, crit, value);
  234. if (!ext) {
  235. ERR_raise(ERR_LIB_X509V3, X509V3_R_ERROR_CREATING_EXTENSION);
  236. return 0;
  237. }
  238. /* If extension exists replace it.. */
  239. if (extidx >= 0) {
  240. extmp = sk_X509_EXTENSION_value(*x, extidx);
  241. X509_EXTENSION_free(extmp);
  242. if (!sk_X509_EXTENSION_set(*x, extidx, ext))
  243. return -1;
  244. return 1;
  245. }
  246. ret = *x;
  247. if (*x == NULL
  248. && (ret = sk_X509_EXTENSION_new_null()) == NULL)
  249. goto m_fail;
  250. if (!sk_X509_EXTENSION_push(ret, ext))
  251. goto m_fail;
  252. *x = ret;
  253. return 1;
  254. m_fail:
  255. /* ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB); */
  256. if (ret != *x)
  257. sk_X509_EXTENSION_free(ret);
  258. X509_EXTENSION_free(ext);
  259. return -1;
  260. err:
  261. if (!(flags & X509V3_ADD_SILENT))
  262. ERR_raise(ERR_LIB_X509V3, errcode);
  263. return 0;
  264. }