pcy_tree.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694
  1. /*
  2. * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include "internal/cryptlib.h"
  10. #include <openssl/trace.h>
  11. #include <openssl/x509.h>
  12. #include <openssl/x509v3.h>
  13. #include "pcy_local.h"
  14. static void expected_print(BIO *channel,
  15. X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node,
  16. int indent)
  17. {
  18. if ((lev->flags & X509_V_FLAG_INHIBIT_MAP)
  19. || !(node->data->flags & POLICY_DATA_FLAG_MAP_MASK))
  20. BIO_puts(channel, " Not Mapped\n");
  21. else {
  22. int i;
  23. STACK_OF(ASN1_OBJECT) *pset = node->data->expected_policy_set;
  24. ASN1_OBJECT *oid;
  25. BIO_puts(channel, " Expected: ");
  26. for (i = 0; i < sk_ASN1_OBJECT_num(pset); i++) {
  27. oid = sk_ASN1_OBJECT_value(pset, i);
  28. if (i)
  29. BIO_puts(channel, ", ");
  30. i2a_ASN1_OBJECT(channel, oid);
  31. }
  32. BIO_puts(channel, "\n");
  33. }
  34. }
  35. static void tree_print(BIO *channel,
  36. char *str, X509_POLICY_TREE *tree,
  37. X509_POLICY_LEVEL *curr)
  38. {
  39. X509_POLICY_LEVEL *plev;
  40. if (!curr)
  41. curr = tree->levels + tree->nlevel;
  42. else
  43. curr++;
  44. BIO_printf(channel, "Level print after %s\n", str);
  45. BIO_printf(channel, "Printing Up to Level %zd\n",
  46. curr - tree->levels);
  47. for (plev = tree->levels; plev != curr; plev++) {
  48. int i;
  49. BIO_printf(channel, "Level %ld, flags = %x\n",
  50. (long)(plev - tree->levels), plev->flags);
  51. for (i = 0; i < sk_X509_POLICY_NODE_num(plev->nodes); i++) {
  52. X509_POLICY_NODE *node =
  53. sk_X509_POLICY_NODE_value(plev->nodes, i);
  54. X509_POLICY_NODE_print(channel, node, 2);
  55. expected_print(channel, plev, node, 2);
  56. BIO_printf(channel, " Flags: %x\n", node->data->flags);
  57. }
  58. if (plev->anyPolicy)
  59. X509_POLICY_NODE_print(channel, plev->anyPolicy, 2);
  60. }
  61. }
  62. #define TREE_PRINT(str, tree, curr) \
  63. OSSL_TRACE_BEGIN(X509V3_POLICY) { \
  64. tree_print(trc_out, "before tree_prune()", tree, curr); \
  65. } OSSL_TRACE_END(X509V3_POLICY)
  66. /*-
  67. * Return value: <= 0 on error, or positive bit mask:
  68. *
  69. * X509_PCY_TREE_VALID: valid tree
  70. * X509_PCY_TREE_EMPTY: empty tree (including bare TA case)
  71. * X509_PCY_TREE_EXPLICIT: explicit policy required
  72. */
  73. static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
  74. unsigned int flags)
  75. {
  76. X509_POLICY_TREE *tree;
  77. X509_POLICY_LEVEL *level;
  78. const X509_POLICY_CACHE *cache;
  79. X509_POLICY_DATA *data = NULL;
  80. int ret = X509_PCY_TREE_VALID;
  81. int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */
  82. int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1;
  83. int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1;
  84. int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1;
  85. int i;
  86. *ptree = NULL;
  87. /* Can't do anything with just a trust anchor */
  88. if (n == 0)
  89. return X509_PCY_TREE_EMPTY;
  90. /*
  91. * First setup the policy cache in all n non-TA certificates, this will be
  92. * used in X509_verify_cert() which will invoke the verify callback for all
  93. * certificates with invalid policy extensions.
  94. */
  95. for (i = n - 1; i >= 0; i--) {
  96. X509 *x = sk_X509_value(certs, i);
  97. /* Call for side-effect of computing hash and caching extensions */
  98. X509_check_purpose(x, -1, 0);
  99. /* If cache is NULL, likely ENOMEM: return immediately */
  100. if (policy_cache_set(x) == NULL)
  101. return X509_PCY_TREE_INTERNAL;
  102. }
  103. /*
  104. * At this point check for invalid policies and required explicit policy.
  105. * Note that the explicit_policy counter is a count-down to zero, with the
  106. * requirement kicking in if and once it does that. The counter is
  107. * decremented for every non-self-issued certificate in the path, but may
  108. * be further reduced by policy constraints in a non-leaf certificate.
  109. *
  110. * The ultimate policy set is the intersection of all the policies along
  111. * the path, if we hit a certificate with an empty policy set, and explicit
  112. * policy is required we're done.
  113. */
  114. for (i = n - 1;
  115. i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0);
  116. i--) {
  117. X509 *x = sk_X509_value(certs, i);
  118. uint32_t ex_flags = X509_get_extension_flags(x);
  119. /* All the policies are already cached, we can return early */
  120. if (ex_flags & EXFLAG_INVALID_POLICY)
  121. return X509_PCY_TREE_INVALID;
  122. /* Access the cache which we now know exists */
  123. cache = policy_cache_set(x);
  124. if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL)
  125. ret = X509_PCY_TREE_EMPTY;
  126. if (explicit_policy > 0) {
  127. if (!(ex_flags & EXFLAG_SI))
  128. explicit_policy--;
  129. if ((cache->explicit_skip >= 0)
  130. && (cache->explicit_skip < explicit_policy))
  131. explicit_policy = cache->explicit_skip;
  132. }
  133. }
  134. if (explicit_policy == 0)
  135. ret |= X509_PCY_TREE_EXPLICIT;
  136. if ((ret & X509_PCY_TREE_VALID) == 0)
  137. return ret;
  138. /* If we get this far initialize the tree */
  139. if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL) {
  140. X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE);
  141. return X509_PCY_TREE_INTERNAL;
  142. }
  143. /*
  144. * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3.
  145. *
  146. * The top level is implicitly for the trust anchor with valid expected
  147. * policies of anyPolicy. (RFC 5280 has the TA at depth 0 and the leaf at
  148. * depth n, we have the leaf at depth 0 and the TA at depth n).
  149. */
  150. if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) {
  151. OPENSSL_free(tree);
  152. X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE);
  153. return X509_PCY_TREE_INTERNAL;
  154. }
  155. tree->nlevel = n+1;
  156. level = tree->levels;
  157. if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL)
  158. goto bad_tree;
  159. if (level_add_node(level, data, NULL, tree) == NULL) {
  160. policy_data_free(data);
  161. goto bad_tree;
  162. }
  163. /*
  164. * In this pass initialize all the tree levels and whether anyPolicy and
  165. * policy mapping are inhibited at each level.
  166. */
  167. for (i = n - 1; i >= 0; i--) {
  168. X509 *x = sk_X509_value(certs, i);
  169. uint32_t ex_flags = X509_get_extension_flags(x);
  170. /* Access the cache which we now know exists */
  171. cache = policy_cache_set(x);
  172. X509_up_ref(x);
  173. (++level)->cert = x;
  174. if (!cache->anyPolicy)
  175. level->flags |= X509_V_FLAG_INHIBIT_ANY;
  176. /* Determine inhibit any and inhibit map flags */
  177. if (any_skip == 0) {
  178. /*
  179. * Any matching allowed only if certificate is self issued and not
  180. * the last in the chain.
  181. */
  182. if (!(ex_flags & EXFLAG_SI) || (i == 0))
  183. level->flags |= X509_V_FLAG_INHIBIT_ANY;
  184. } else {
  185. if (!(ex_flags & EXFLAG_SI))
  186. any_skip--;
  187. if ((cache->any_skip >= 0) && (cache->any_skip < any_skip))
  188. any_skip = cache->any_skip;
  189. }
  190. if (map_skip == 0)
  191. level->flags |= X509_V_FLAG_INHIBIT_MAP;
  192. else {
  193. if (!(ex_flags & EXFLAG_SI))
  194. map_skip--;
  195. if ((cache->map_skip >= 0) && (cache->map_skip < map_skip))
  196. map_skip = cache->map_skip;
  197. }
  198. }
  199. *ptree = tree;
  200. return ret;
  201. bad_tree:
  202. X509_policy_tree_free(tree);
  203. return X509_PCY_TREE_INTERNAL;
  204. }
  205. /*
  206. * Return value: 1 on success, 0 otherwise
  207. */
  208. static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
  209. X509_POLICY_DATA *data)
  210. {
  211. X509_POLICY_LEVEL *last = curr - 1;
  212. int i, matched = 0;
  213. /* Iterate through all in nodes linking matches */
  214. for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) {
  215. X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i);
  216. if (policy_node_match(last, node, data->valid_policy)) {
  217. if (level_add_node(curr, data, node, NULL) == NULL)
  218. return 0;
  219. matched = 1;
  220. }
  221. }
  222. if (!matched && last->anyPolicy) {
  223. if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL)
  224. return 0;
  225. }
  226. return 1;
  227. }
  228. /*
  229. * This corresponds to RFC3280 6.1.3(d)(1): link any data from
  230. * CertificatePolicies onto matching parent or anyPolicy if no match.
  231. *
  232. * Return value: 1 on success, 0 otherwise.
  233. */
  234. static int tree_link_nodes(X509_POLICY_LEVEL *curr,
  235. const X509_POLICY_CACHE *cache)
  236. {
  237. int i;
  238. for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
  239. X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i);
  240. /* Look for matching nodes in previous level */
  241. if (!tree_link_matching_nodes(curr, data))
  242. return 0;
  243. }
  244. return 1;
  245. }
  246. /*
  247. * This corresponds to RFC3280 6.1.3(d)(2): Create new data for any unmatched
  248. * policies in the parent and link to anyPolicy.
  249. *
  250. * Return value: 1 on success, 0 otherwise.
  251. */
  252. static int tree_add_unmatched(X509_POLICY_LEVEL *curr,
  253. const X509_POLICY_CACHE *cache,
  254. const ASN1_OBJECT *id,
  255. X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
  256. {
  257. X509_POLICY_DATA *data;
  258. if (id == NULL)
  259. id = node->data->valid_policy;
  260. /*
  261. * Create a new node with qualifiers from anyPolicy and id from unmatched
  262. * node.
  263. */
  264. if ((data = policy_data_new(NULL, id, node_critical(node))) == NULL)
  265. return 0;
  266. /* Curr may not have anyPolicy */
  267. data->qualifier_set = cache->anyPolicy->qualifier_set;
  268. data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
  269. if (level_add_node(curr, data, node, tree) == NULL) {
  270. policy_data_free(data);
  271. return 0;
  272. }
  273. return 1;
  274. }
  275. /*
  276. * Return value: 1 on success, 0 otherwise.
  277. */
  278. static int tree_link_unmatched(X509_POLICY_LEVEL *curr,
  279. const X509_POLICY_CACHE *cache,
  280. X509_POLICY_NODE *node, X509_POLICY_TREE *tree)
  281. {
  282. const X509_POLICY_LEVEL *last = curr - 1;
  283. int i;
  284. if ((last->flags & X509_V_FLAG_INHIBIT_MAP)
  285. || !(node->data->flags & POLICY_DATA_FLAG_MAPPED)) {
  286. /* If no policy mapping: matched if one child present */
  287. if (node->nchild)
  288. return 1;
  289. if (!tree_add_unmatched(curr, cache, NULL, node, tree))
  290. return 0;
  291. /* Add it */
  292. } else {
  293. /* If mapping: matched if one child per expected policy set */
  294. STACK_OF(ASN1_OBJECT) *expset = node->data->expected_policy_set;
  295. if (node->nchild == sk_ASN1_OBJECT_num(expset))
  296. return 1;
  297. /* Locate unmatched nodes */
  298. for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) {
  299. ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i);
  300. if (level_find_node(curr, node, oid))
  301. continue;
  302. if (!tree_add_unmatched(curr, cache, oid, node, tree))
  303. return 0;
  304. }
  305. }
  306. return 1;
  307. }
  308. /*
  309. * Return value: 1 on success, 0 otherwise
  310. */
  311. static int tree_link_any(X509_POLICY_LEVEL *curr,
  312. const X509_POLICY_CACHE *cache,
  313. X509_POLICY_TREE *tree)
  314. {
  315. int i;
  316. X509_POLICY_NODE *node;
  317. X509_POLICY_LEVEL *last = curr - 1;
  318. for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) {
  319. node = sk_X509_POLICY_NODE_value(last->nodes, i);
  320. if (!tree_link_unmatched(curr, cache, node, tree))
  321. return 0;
  322. }
  323. /* Finally add link to anyPolicy */
  324. if (last->anyPolicy &&
  325. level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL)
  326. return 0;
  327. return 1;
  328. }
  329. /*-
  330. * Prune the tree: delete any child mapped child data on the current level then
  331. * proceed up the tree deleting any data with no children. If we ever have no
  332. * data on a level we can halt because the tree will be empty.
  333. *
  334. * Return value: <= 0 error, otherwise one of:
  335. *
  336. * X509_PCY_TREE_VALID: valid tree
  337. * X509_PCY_TREE_EMPTY: empty tree
  338. */
  339. static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr)
  340. {
  341. STACK_OF(X509_POLICY_NODE) *nodes;
  342. X509_POLICY_NODE *node;
  343. int i;
  344. nodes = curr->nodes;
  345. if (curr->flags & X509_V_FLAG_INHIBIT_MAP) {
  346. for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) {
  347. node = sk_X509_POLICY_NODE_value(nodes, i);
  348. /* Delete any mapped data: see RFC3280 XXXX */
  349. if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK) {
  350. node->parent->nchild--;
  351. OPENSSL_free(node);
  352. (void)sk_X509_POLICY_NODE_delete(nodes, i);
  353. }
  354. }
  355. }
  356. for (;;) {
  357. --curr;
  358. nodes = curr->nodes;
  359. for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) {
  360. node = sk_X509_POLICY_NODE_value(nodes, i);
  361. if (node->nchild == 0) {
  362. node->parent->nchild--;
  363. OPENSSL_free(node);
  364. (void)sk_X509_POLICY_NODE_delete(nodes, i);
  365. }
  366. }
  367. if (curr->anyPolicy && !curr->anyPolicy->nchild) {
  368. if (curr->anyPolicy->parent)
  369. curr->anyPolicy->parent->nchild--;
  370. OPENSSL_free(curr->anyPolicy);
  371. curr->anyPolicy = NULL;
  372. }
  373. if (curr == tree->levels) {
  374. /* If we zapped anyPolicy at top then tree is empty */
  375. if (!curr->anyPolicy)
  376. return X509_PCY_TREE_EMPTY;
  377. break;
  378. }
  379. }
  380. return X509_PCY_TREE_VALID;
  381. }
  382. /*
  383. * Return value: 1 on success, 0 otherwise.
  384. */
  385. static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes,
  386. X509_POLICY_NODE *pcy)
  387. {
  388. if (*pnodes == NULL &&
  389. (*pnodes = policy_node_cmp_new()) == NULL)
  390. return 0;
  391. if (sk_X509_POLICY_NODE_find(*pnodes, pcy) >= 0)
  392. return 1;
  393. return sk_X509_POLICY_NODE_push(*pnodes, pcy) != 0;
  394. }
  395. #define TREE_CALC_FAILURE 0
  396. #define TREE_CALC_OK_NOFREE 1
  397. #define TREE_CALC_OK_DOFREE 2
  398. /*-
  399. * Calculate the authority set based on policy tree. The 'pnodes' parameter is
  400. * used as a store for the set of policy nodes used to calculate the user set.
  401. * If the authority set is not anyPolicy then pnodes will just point to the
  402. * authority set. If however the authority set is anyPolicy then the set of
  403. * valid policies (other than anyPolicy) is store in pnodes.
  404. *
  405. * Return value:
  406. * TREE_CALC_FAILURE on failure,
  407. * TREE_CALC_OK_NOFREE on success and pnodes need not be freed,
  408. * TREE_CALC_OK_DOFREE on success and pnodes needs to be freed
  409. */
  410. static int tree_calculate_authority_set(X509_POLICY_TREE *tree,
  411. STACK_OF(X509_POLICY_NODE) **pnodes)
  412. {
  413. X509_POLICY_LEVEL *curr;
  414. X509_POLICY_NODE *node, *anyptr;
  415. STACK_OF(X509_POLICY_NODE) **addnodes;
  416. int i, j;
  417. curr = tree->levels + tree->nlevel - 1;
  418. /* If last level contains anyPolicy set is anyPolicy */
  419. if (curr->anyPolicy) {
  420. if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy))
  421. return TREE_CALC_FAILURE;
  422. addnodes = pnodes;
  423. } else
  424. /* Add policies to authority set */
  425. addnodes = &tree->auth_policies;
  426. curr = tree->levels;
  427. for (i = 1; i < tree->nlevel; i++) {
  428. /*
  429. * If no anyPolicy node on this this level it can't appear on lower
  430. * levels so end search.
  431. */
  432. if ((anyptr = curr->anyPolicy) == NULL)
  433. break;
  434. curr++;
  435. for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++) {
  436. node = sk_X509_POLICY_NODE_value(curr->nodes, j);
  437. if ((node->parent == anyptr)
  438. && !tree_add_auth_node(addnodes, node)) {
  439. if (addnodes == pnodes) {
  440. sk_X509_POLICY_NODE_free(*pnodes);
  441. *pnodes = NULL;
  442. }
  443. return TREE_CALC_FAILURE;
  444. }
  445. }
  446. }
  447. if (addnodes == pnodes)
  448. return TREE_CALC_OK_DOFREE;
  449. *pnodes = tree->auth_policies;
  450. return TREE_CALC_OK_NOFREE;
  451. }
  452. /*
  453. * Return value: 1 on success, 0 otherwise.
  454. */
  455. static int tree_calculate_user_set(X509_POLICY_TREE *tree,
  456. STACK_OF(ASN1_OBJECT) *policy_oids,
  457. STACK_OF(X509_POLICY_NODE) *auth_nodes)
  458. {
  459. int i;
  460. X509_POLICY_NODE *node;
  461. ASN1_OBJECT *oid;
  462. X509_POLICY_NODE *anyPolicy;
  463. X509_POLICY_DATA *extra;
  464. /*
  465. * Check if anyPolicy present in authority constrained policy set: this
  466. * will happen if it is a leaf node.
  467. */
  468. if (sk_ASN1_OBJECT_num(policy_oids) <= 0)
  469. return 1;
  470. anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy;
  471. for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) {
  472. oid = sk_ASN1_OBJECT_value(policy_oids, i);
  473. if (OBJ_obj2nid(oid) == NID_any_policy) {
  474. tree->flags |= POLICY_FLAG_ANY_POLICY;
  475. return 1;
  476. }
  477. }
  478. for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) {
  479. oid = sk_ASN1_OBJECT_value(policy_oids, i);
  480. node = tree_find_sk(auth_nodes, oid);
  481. if (!node) {
  482. if (!anyPolicy)
  483. continue;
  484. /*
  485. * Create a new node with policy ID from user set and qualifiers
  486. * from anyPolicy.
  487. */
  488. extra = policy_data_new(NULL, oid, node_critical(anyPolicy));
  489. if (extra == NULL)
  490. return 0;
  491. extra->qualifier_set = anyPolicy->data->qualifier_set;
  492. extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS
  493. | POLICY_DATA_FLAG_EXTRA_NODE;
  494. node = level_add_node(NULL, extra, anyPolicy->parent, tree);
  495. }
  496. if (!tree->user_policies) {
  497. tree->user_policies = sk_X509_POLICY_NODE_new_null();
  498. if (!tree->user_policies)
  499. return 1;
  500. }
  501. if (!sk_X509_POLICY_NODE_push(tree->user_policies, node))
  502. return 0;
  503. }
  504. return 1;
  505. }
  506. /*-
  507. * Return value: <= 0 error, otherwise one of:
  508. * X509_PCY_TREE_VALID: valid tree
  509. * X509_PCY_TREE_EMPTY: empty tree
  510. * (see tree_prune()).
  511. */
  512. static int tree_evaluate(X509_POLICY_TREE *tree)
  513. {
  514. int ret, i;
  515. X509_POLICY_LEVEL *curr = tree->levels + 1;
  516. const X509_POLICY_CACHE *cache;
  517. for (i = 1; i < tree->nlevel; i++, curr++) {
  518. cache = policy_cache_set(curr->cert);
  519. if (!tree_link_nodes(curr, cache))
  520. return X509_PCY_TREE_INTERNAL;
  521. if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
  522. && !tree_link_any(curr, cache, tree))
  523. return X509_PCY_TREE_INTERNAL;
  524. TREE_PRINT("before tree_prune()", tree, curr);
  525. ret = tree_prune(tree, curr);
  526. if (ret != X509_PCY_TREE_VALID)
  527. return ret;
  528. }
  529. return X509_PCY_TREE_VALID;
  530. }
  531. static void exnode_free(X509_POLICY_NODE *node)
  532. {
  533. if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE))
  534. OPENSSL_free(node);
  535. }
  536. void X509_policy_tree_free(X509_POLICY_TREE *tree)
  537. {
  538. X509_POLICY_LEVEL *curr;
  539. int i;
  540. if (!tree)
  541. return;
  542. sk_X509_POLICY_NODE_free(tree->auth_policies);
  543. sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free);
  544. for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) {
  545. X509_free(curr->cert);
  546. sk_X509_POLICY_NODE_pop_free(curr->nodes, policy_node_free);
  547. policy_node_free(curr->anyPolicy);
  548. }
  549. sk_X509_POLICY_DATA_pop_free(tree->extra_data, policy_data_free);
  550. OPENSSL_free(tree->levels);
  551. OPENSSL_free(tree);
  552. }
  553. /*-
  554. * Application policy checking function.
  555. * Return codes:
  556. * X509_PCY_TREE_FAILURE: Failure to satisfy explicit policy
  557. * X509_PCY_TREE_INVALID: Inconsistent or invalid extensions
  558. * X509_PCY_TREE_INTERNAL: Internal error, most likely malloc
  559. * X509_PCY_TREE_VALID: Success (null tree if empty or bare TA)
  560. */
  561. int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
  562. STACK_OF(X509) *certs,
  563. STACK_OF(ASN1_OBJECT) *policy_oids, unsigned int flags)
  564. {
  565. int init_ret;
  566. int ret;
  567. int calc_ret;
  568. X509_POLICY_TREE *tree = NULL;
  569. STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL;
  570. *ptree = NULL;
  571. *pexplicit_policy = 0;
  572. init_ret = tree_init(&tree, certs, flags);
  573. if (init_ret <= 0)
  574. return init_ret;
  575. if ((init_ret & X509_PCY_TREE_EXPLICIT) == 0) {
  576. if (init_ret & X509_PCY_TREE_EMPTY) {
  577. X509_policy_tree_free(tree);
  578. return X509_PCY_TREE_VALID;
  579. }
  580. } else {
  581. *pexplicit_policy = 1;
  582. /* Tree empty and requireExplicit True: Error */
  583. if (init_ret & X509_PCY_TREE_EMPTY)
  584. return X509_PCY_TREE_FAILURE;
  585. }
  586. ret = tree_evaluate(tree);
  587. TREE_PRINT("tree_evaluate()", tree, NULL);
  588. if (ret <= 0)
  589. goto error;
  590. if (ret == X509_PCY_TREE_EMPTY) {
  591. X509_policy_tree_free(tree);
  592. if (init_ret & X509_PCY_TREE_EXPLICIT)
  593. return X509_PCY_TREE_FAILURE;
  594. return X509_PCY_TREE_VALID;
  595. }
  596. /* Tree is not empty: continue */
  597. if ((calc_ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0)
  598. goto error;
  599. ret = tree_calculate_user_set(tree, policy_oids, auth_nodes);
  600. if (calc_ret == TREE_CALC_OK_DOFREE)
  601. sk_X509_POLICY_NODE_free(auth_nodes);
  602. if (!ret)
  603. goto error;
  604. *ptree = tree;
  605. if (init_ret & X509_PCY_TREE_EXPLICIT) {
  606. nodes = X509_policy_tree_get0_user_policies(tree);
  607. if (sk_X509_POLICY_NODE_num(nodes) <= 0)
  608. return X509_PCY_TREE_FAILURE;
  609. }
  610. return X509_PCY_TREE_VALID;
  611. error:
  612. X509_policy_tree_free(tree);
  613. return X509_PCY_TREE_INTERNAL;
  614. }