ct_x509v3.c 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104
  1. /*
  2. * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifdef OPENSSL_NO_CT
  10. # error "CT is disabled"
  11. #endif
  12. #include "ct_local.h"
  13. static char *i2s_poison(const X509V3_EXT_METHOD *method, void *val)
  14. {
  15. return OPENSSL_strdup("NULL");
  16. }
  17. static void *s2i_poison(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str)
  18. {
  19. return ASN1_NULL_new();
  20. }
  21. static int i2r_SCT_LIST(X509V3_EXT_METHOD *method, STACK_OF(SCT) *sct_list,
  22. BIO *out, int indent)
  23. {
  24. SCT_LIST_print(sct_list, out, indent, "\n", NULL);
  25. return 1;
  26. }
  27. static int set_sct_list_source(STACK_OF(SCT) *s, sct_source_t source)
  28. {
  29. if (s != NULL) {
  30. int i;
  31. for (i = 0; i < sk_SCT_num(s); i++) {
  32. int res = SCT_set_source(sk_SCT_value(s, i), source);
  33. if (res != 1) {
  34. return 0;
  35. }
  36. }
  37. }
  38. return 1;
  39. }
  40. static STACK_OF(SCT) *x509_ext_d2i_SCT_LIST(STACK_OF(SCT) **a,
  41. const unsigned char **pp,
  42. long len)
  43. {
  44. STACK_OF(SCT) *s = d2i_SCT_LIST(a, pp, len);
  45. if (set_sct_list_source(s, SCT_SOURCE_X509V3_EXTENSION) != 1) {
  46. SCT_LIST_free(s);
  47. *a = NULL;
  48. return NULL;
  49. }
  50. return s;
  51. }
  52. static STACK_OF(SCT) *ocsp_ext_d2i_SCT_LIST(STACK_OF(SCT) **a,
  53. const unsigned char **pp,
  54. long len)
  55. {
  56. STACK_OF(SCT) *s = d2i_SCT_LIST(a, pp, len);
  57. if (set_sct_list_source(s, SCT_SOURCE_OCSP_STAPLED_RESPONSE) != 1) {
  58. SCT_LIST_free(s);
  59. *a = NULL;
  60. return NULL;
  61. }
  62. return s;
  63. }
  64. /* Handlers for X509v3/OCSP Certificate Transparency extensions */
  65. const X509V3_EXT_METHOD ossl_v3_ct_scts[3] = {
  66. /* X509v3 extension in certificates that contains SCTs */
  67. { NID_ct_precert_scts, 0, NULL,
  68. NULL, (X509V3_EXT_FREE)SCT_LIST_free,
  69. (X509V3_EXT_D2I)x509_ext_d2i_SCT_LIST, (X509V3_EXT_I2D)i2d_SCT_LIST,
  70. NULL, NULL,
  71. NULL, NULL,
  72. (X509V3_EXT_I2R)i2r_SCT_LIST, NULL,
  73. NULL },
  74. /* X509v3 extension to mark a certificate as a pre-certificate */
  75. { NID_ct_precert_poison, 0, ASN1_ITEM_ref(ASN1_NULL),
  76. NULL, NULL, NULL, NULL,
  77. i2s_poison, s2i_poison,
  78. NULL, NULL,
  79. NULL, NULL,
  80. NULL },
  81. /* OCSP extension that contains SCTs */
  82. { NID_ct_cert_scts, 0, NULL,
  83. 0, (X509V3_EXT_FREE)SCT_LIST_free,
  84. (X509V3_EXT_D2I)ocsp_ext_d2i_SCT_LIST, (X509V3_EXT_I2D)i2d_SCT_LIST,
  85. NULL, NULL,
  86. NULL, NULL,
  87. (X509V3_EXT_I2R)i2r_SCT_LIST, NULL,
  88. NULL },
  89. };