v3_addr.c 42 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374
  1. /*
  2. * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Implementation of RFC 3779 section 2.2.
  11. */
  12. #include <stdio.h>
  13. #include <stdlib.h>
  14. #include <assert.h>
  15. #include <string.h>
  16. #include <openssl/conf.h>
  17. #include <openssl/asn1.h>
  18. #include <openssl/asn1t.h>
  19. #include <openssl/buffer.h>
  20. #include <openssl/x509v3.h>
  21. #include "internal/cryptlib.h"
  22. #include "crypto/asn1.h"
  23. #include "crypto/x509.h"
  24. #include "ext_dat.h"
  25. #include "x509_local.h"
  26. #ifndef OPENSSL_NO_RFC3779
  27. /*
  28. * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
  29. */
  30. ASN1_SEQUENCE(IPAddressRange) = {
  31. ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
  32. ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
  33. } ASN1_SEQUENCE_END(IPAddressRange)
  34. ASN1_CHOICE(IPAddressOrRange) = {
  35. ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
  36. ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
  37. } ASN1_CHOICE_END(IPAddressOrRange)
  38. ASN1_CHOICE(IPAddressChoice) = {
  39. ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
  40. ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
  41. } ASN1_CHOICE_END(IPAddressChoice)
  42. ASN1_SEQUENCE(IPAddressFamily) = {
  43. ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
  44. ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
  45. } ASN1_SEQUENCE_END(IPAddressFamily)
  46. ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
  47. ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  48. IPAddrBlocks, IPAddressFamily)
  49. static_ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
  50. IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
  51. IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
  52. IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
  53. IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
  54. /*
  55. * How much buffer space do we need for a raw address?
  56. */
  57. # define ADDR_RAW_BUF_LEN 16
  58. /*
  59. * What's the address length associated with this AFI?
  60. */
  61. static int length_from_afi(const unsigned afi)
  62. {
  63. switch (afi) {
  64. case IANA_AFI_IPV4:
  65. return 4;
  66. case IANA_AFI_IPV6:
  67. return 16;
  68. default:
  69. return 0;
  70. }
  71. }
  72. /*
  73. * Extract the AFI from an IPAddressFamily.
  74. */
  75. unsigned int X509v3_addr_get_afi(const IPAddressFamily *f)
  76. {
  77. if (f == NULL
  78. || f->addressFamily == NULL
  79. || f->addressFamily->data == NULL
  80. || f->addressFamily->length < 2)
  81. return 0;
  82. return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
  83. }
  84. /*
  85. * Expand the bitstring form of an address into a raw byte array.
  86. * At the moment this is coded for simplicity, not speed.
  87. */
  88. static int addr_expand(unsigned char *addr,
  89. const ASN1_BIT_STRING *bs,
  90. const int length, const unsigned char fill)
  91. {
  92. if (bs->length < 0 || bs->length > length)
  93. return 0;
  94. if (bs->length > 0) {
  95. memcpy(addr, bs->data, bs->length);
  96. if ((bs->flags & 7) != 0) {
  97. unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
  98. if (fill == 0)
  99. addr[bs->length - 1] &= ~mask;
  100. else
  101. addr[bs->length - 1] |= mask;
  102. }
  103. }
  104. memset(addr + bs->length, fill, length - bs->length);
  105. return 1;
  106. }
  107. /*
  108. * Extract the prefix length from a bitstring.
  109. */
  110. # define addr_prefixlen(bs) ((int)((bs)->length * 8 - ((bs)->flags & 7)))
  111. /*
  112. * i2r handler for one address bitstring.
  113. */
  114. static int i2r_address(BIO *out,
  115. const unsigned afi,
  116. const unsigned char fill, const ASN1_BIT_STRING *bs)
  117. {
  118. unsigned char addr[ADDR_RAW_BUF_LEN];
  119. int i, n;
  120. if (bs->length < 0)
  121. return 0;
  122. switch (afi) {
  123. case IANA_AFI_IPV4:
  124. if (!addr_expand(addr, bs, 4, fill))
  125. return 0;
  126. BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
  127. break;
  128. case IANA_AFI_IPV6:
  129. if (!addr_expand(addr, bs, 16, fill))
  130. return 0;
  131. for (n = 16; n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00;
  132. n -= 2) ;
  133. for (i = 0; i < n; i += 2)
  134. BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i + 1],
  135. (i < 14 ? ":" : ""));
  136. if (i < 16)
  137. BIO_puts(out, ":");
  138. if (i == 0)
  139. BIO_puts(out, ":");
  140. break;
  141. default:
  142. for (i = 0; i < bs->length; i++)
  143. BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
  144. BIO_printf(out, "[%d]", (int)(bs->flags & 7));
  145. break;
  146. }
  147. return 1;
  148. }
  149. /*
  150. * i2r handler for a sequence of addresses and ranges.
  151. */
  152. static int i2r_IPAddressOrRanges(BIO *out,
  153. const int indent,
  154. const IPAddressOrRanges *aors,
  155. const unsigned afi)
  156. {
  157. int i;
  158. for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
  159. const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
  160. BIO_printf(out, "%*s", indent, "");
  161. switch (aor->type) {
  162. case IPAddressOrRange_addressPrefix:
  163. if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
  164. return 0;
  165. BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
  166. continue;
  167. case IPAddressOrRange_addressRange:
  168. if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
  169. return 0;
  170. BIO_puts(out, "-");
  171. if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
  172. return 0;
  173. BIO_puts(out, "\n");
  174. continue;
  175. }
  176. }
  177. return 1;
  178. }
  179. /*
  180. * i2r handler for an IPAddrBlocks extension.
  181. */
  182. static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
  183. void *ext, BIO *out, int indent)
  184. {
  185. const IPAddrBlocks *addr = ext;
  186. int i;
  187. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  188. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  189. const unsigned int afi = X509v3_addr_get_afi(f);
  190. switch (afi) {
  191. case IANA_AFI_IPV4:
  192. BIO_printf(out, "%*sIPv4", indent, "");
  193. break;
  194. case IANA_AFI_IPV6:
  195. BIO_printf(out, "%*sIPv6", indent, "");
  196. break;
  197. default:
  198. BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
  199. break;
  200. }
  201. if (f->addressFamily->length > 2) {
  202. switch (f->addressFamily->data[2]) {
  203. case 1:
  204. BIO_puts(out, " (Unicast)");
  205. break;
  206. case 2:
  207. BIO_puts(out, " (Multicast)");
  208. break;
  209. case 3:
  210. BIO_puts(out, " (Unicast/Multicast)");
  211. break;
  212. case 4:
  213. BIO_puts(out, " (MPLS)");
  214. break;
  215. case 64:
  216. BIO_puts(out, " (Tunnel)");
  217. break;
  218. case 65:
  219. BIO_puts(out, " (VPLS)");
  220. break;
  221. case 66:
  222. BIO_puts(out, " (BGP MDT)");
  223. break;
  224. case 128:
  225. BIO_puts(out, " (MPLS-labeled VPN)");
  226. break;
  227. default:
  228. BIO_printf(out, " (Unknown SAFI %u)",
  229. (unsigned)f->addressFamily->data[2]);
  230. break;
  231. }
  232. }
  233. switch (f->ipAddressChoice->type) {
  234. case IPAddressChoice_inherit:
  235. BIO_puts(out, ": inherit\n");
  236. break;
  237. case IPAddressChoice_addressesOrRanges:
  238. BIO_puts(out, ":\n");
  239. if (!i2r_IPAddressOrRanges(out,
  240. indent + 2,
  241. f->ipAddressChoice->
  242. u.addressesOrRanges, afi))
  243. return 0;
  244. break;
  245. }
  246. }
  247. return 1;
  248. }
  249. /*
  250. * Sort comparison function for a sequence of IPAddressOrRange
  251. * elements.
  252. *
  253. * There's no sane answer we can give if addr_expand() fails, and an
  254. * assertion failure on externally supplied data is seriously uncool,
  255. * so we just arbitrarily declare that if given invalid inputs this
  256. * function returns -1. If this messes up your preferred sort order
  257. * for garbage input, tough noogies.
  258. */
  259. static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
  260. const IPAddressOrRange *b, const int length)
  261. {
  262. unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
  263. int prefixlen_a = 0, prefixlen_b = 0;
  264. int r;
  265. switch (a->type) {
  266. case IPAddressOrRange_addressPrefix:
  267. if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00))
  268. return -1;
  269. prefixlen_a = addr_prefixlen(a->u.addressPrefix);
  270. break;
  271. case IPAddressOrRange_addressRange:
  272. if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00))
  273. return -1;
  274. prefixlen_a = length * 8;
  275. break;
  276. }
  277. switch (b->type) {
  278. case IPAddressOrRange_addressPrefix:
  279. if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00))
  280. return -1;
  281. prefixlen_b = addr_prefixlen(b->u.addressPrefix);
  282. break;
  283. case IPAddressOrRange_addressRange:
  284. if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00))
  285. return -1;
  286. prefixlen_b = length * 8;
  287. break;
  288. }
  289. if ((r = memcmp(addr_a, addr_b, length)) != 0)
  290. return r;
  291. else
  292. return prefixlen_a - prefixlen_b;
  293. }
  294. /*
  295. * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
  296. * comparison routines are only allowed two arguments.
  297. */
  298. static int v4IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
  299. const IPAddressOrRange *const *b)
  300. {
  301. return IPAddressOrRange_cmp(*a, *b, 4);
  302. }
  303. /*
  304. * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
  305. * comparison routines are only allowed two arguments.
  306. */
  307. static int v6IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
  308. const IPAddressOrRange *const *b)
  309. {
  310. return IPAddressOrRange_cmp(*a, *b, 16);
  311. }
  312. /*
  313. * Calculate whether a range collapses to a prefix.
  314. * See last paragraph of RFC 3779 2.2.3.7.
  315. */
  316. static int range_should_be_prefix(const unsigned char *min,
  317. const unsigned char *max, const int length)
  318. {
  319. unsigned char mask;
  320. int i, j;
  321. /*
  322. * It is the responsibility of the caller to confirm min <= max. We don't
  323. * use ossl_assert() here since we have no way of signalling an error from
  324. * this function - so we just use a plain assert instead.
  325. */
  326. assert(memcmp(min, max, length) <= 0);
  327. for (i = 0; i < length && min[i] == max[i]; i++) ;
  328. for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) ;
  329. if (i < j)
  330. return -1;
  331. if (i > j)
  332. return i * 8;
  333. mask = min[i] ^ max[i];
  334. switch (mask) {
  335. case 0x01:
  336. j = 7;
  337. break;
  338. case 0x03:
  339. j = 6;
  340. break;
  341. case 0x07:
  342. j = 5;
  343. break;
  344. case 0x0F:
  345. j = 4;
  346. break;
  347. case 0x1F:
  348. j = 3;
  349. break;
  350. case 0x3F:
  351. j = 2;
  352. break;
  353. case 0x7F:
  354. j = 1;
  355. break;
  356. default:
  357. return -1;
  358. }
  359. if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
  360. return -1;
  361. else
  362. return i * 8 + j;
  363. }
  364. /*
  365. * Construct a prefix.
  366. */
  367. static int make_addressPrefix(IPAddressOrRange **result, unsigned char *addr,
  368. const int prefixlen, const int afilen)
  369. {
  370. int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
  371. IPAddressOrRange *aor = IPAddressOrRange_new();
  372. if (prefixlen < 0 || prefixlen > (afilen * 8))
  373. return 0;
  374. if (aor == NULL)
  375. return 0;
  376. aor->type = IPAddressOrRange_addressPrefix;
  377. if (aor->u.addressPrefix == NULL &&
  378. (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
  379. goto err;
  380. if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
  381. goto err;
  382. if (bitlen > 0)
  383. aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
  384. ossl_asn1_string_set_bits_left(aor->u.addressPrefix, 8 - bitlen);
  385. *result = aor;
  386. return 1;
  387. err:
  388. IPAddressOrRange_free(aor);
  389. return 0;
  390. }
  391. /*
  392. * Construct a range. If it can be expressed as a prefix,
  393. * return a prefix instead. Doing this here simplifies
  394. * the rest of the code considerably.
  395. */
  396. static int make_addressRange(IPAddressOrRange **result,
  397. unsigned char *min,
  398. unsigned char *max, const int length)
  399. {
  400. IPAddressOrRange *aor;
  401. int i, prefixlen;
  402. if (memcmp(min, max, length) > 0)
  403. return 0;
  404. if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
  405. return make_addressPrefix(result, min, prefixlen, length);
  406. if ((aor = IPAddressOrRange_new()) == NULL)
  407. return 0;
  408. aor->type = IPAddressOrRange_addressRange;
  409. if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
  410. goto err;
  411. if (aor->u.addressRange->min == NULL &&
  412. (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
  413. goto err;
  414. if (aor->u.addressRange->max == NULL &&
  415. (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
  416. goto err;
  417. for (i = length; i > 0 && min[i - 1] == 0x00; --i) ;
  418. if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
  419. goto err;
  420. ossl_asn1_string_set_bits_left(aor->u.addressRange->min, 0);
  421. if (i > 0) {
  422. unsigned char b = min[i - 1];
  423. int j = 1;
  424. while ((b & (0xFFU >> j)) != 0)
  425. ++j;
  426. aor->u.addressRange->min->flags |= 8 - j;
  427. }
  428. for (i = length; i > 0 && max[i - 1] == 0xFF; --i) ;
  429. if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
  430. goto err;
  431. ossl_asn1_string_set_bits_left(aor->u.addressRange->max, 0);
  432. if (i > 0) {
  433. unsigned char b = max[i - 1];
  434. int j = 1;
  435. while ((b & (0xFFU >> j)) != (0xFFU >> j))
  436. ++j;
  437. aor->u.addressRange->max->flags |= 8 - j;
  438. }
  439. *result = aor;
  440. return 1;
  441. err:
  442. IPAddressOrRange_free(aor);
  443. return 0;
  444. }
  445. /*
  446. * Construct a new address family or find an existing one.
  447. */
  448. static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
  449. const unsigned afi,
  450. const unsigned *safi)
  451. {
  452. IPAddressFamily *f;
  453. unsigned char key[3];
  454. int keylen;
  455. int i;
  456. key[0] = (afi >> 8) & 0xFF;
  457. key[1] = afi & 0xFF;
  458. if (safi != NULL) {
  459. key[2] = *safi & 0xFF;
  460. keylen = 3;
  461. } else {
  462. keylen = 2;
  463. }
  464. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  465. f = sk_IPAddressFamily_value(addr, i);
  466. if (f->addressFamily->length == keylen &&
  467. !memcmp(f->addressFamily->data, key, keylen))
  468. return f;
  469. }
  470. if ((f = IPAddressFamily_new()) == NULL)
  471. goto err;
  472. if (f->ipAddressChoice == NULL &&
  473. (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
  474. goto err;
  475. if (f->addressFamily == NULL &&
  476. (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
  477. goto err;
  478. if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
  479. goto err;
  480. if (!sk_IPAddressFamily_push(addr, f))
  481. goto err;
  482. return f;
  483. err:
  484. IPAddressFamily_free(f);
  485. return NULL;
  486. }
  487. /*
  488. * Add an inheritance element.
  489. */
  490. int X509v3_addr_add_inherit(IPAddrBlocks *addr,
  491. const unsigned afi, const unsigned *safi)
  492. {
  493. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  494. if (f == NULL ||
  495. f->ipAddressChoice == NULL ||
  496. (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  497. f->ipAddressChoice->u.addressesOrRanges != NULL))
  498. return 0;
  499. if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  500. f->ipAddressChoice->u.inherit != NULL)
  501. return 1;
  502. if (f->ipAddressChoice->u.inherit == NULL &&
  503. (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
  504. return 0;
  505. f->ipAddressChoice->type = IPAddressChoice_inherit;
  506. return 1;
  507. }
  508. /*
  509. * Construct an IPAddressOrRange sequence, or return an existing one.
  510. */
  511. static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
  512. const unsigned afi,
  513. const unsigned *safi)
  514. {
  515. IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
  516. IPAddressOrRanges *aors = NULL;
  517. if (f == NULL ||
  518. f->ipAddressChoice == NULL ||
  519. (f->ipAddressChoice->type == IPAddressChoice_inherit &&
  520. f->ipAddressChoice->u.inherit != NULL))
  521. return NULL;
  522. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
  523. aors = f->ipAddressChoice->u.addressesOrRanges;
  524. if (aors != NULL)
  525. return aors;
  526. if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
  527. return NULL;
  528. switch (afi) {
  529. case IANA_AFI_IPV4:
  530. (void)sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
  531. break;
  532. case IANA_AFI_IPV6:
  533. (void)sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
  534. break;
  535. }
  536. f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
  537. f->ipAddressChoice->u.addressesOrRanges = aors;
  538. return aors;
  539. }
  540. /*
  541. * Add a prefix.
  542. */
  543. int X509v3_addr_add_prefix(IPAddrBlocks *addr,
  544. const unsigned afi,
  545. const unsigned *safi,
  546. unsigned char *a, const int prefixlen)
  547. {
  548. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  549. IPAddressOrRange *aor;
  550. if (aors == NULL
  551. || !make_addressPrefix(&aor, a, prefixlen, length_from_afi(afi)))
  552. return 0;
  553. if (sk_IPAddressOrRange_push(aors, aor))
  554. return 1;
  555. IPAddressOrRange_free(aor);
  556. return 0;
  557. }
  558. /*
  559. * Add a range.
  560. */
  561. int X509v3_addr_add_range(IPAddrBlocks *addr,
  562. const unsigned afi,
  563. const unsigned *safi,
  564. unsigned char *min, unsigned char *max)
  565. {
  566. IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
  567. IPAddressOrRange *aor;
  568. int length = length_from_afi(afi);
  569. if (aors == NULL)
  570. return 0;
  571. if (!make_addressRange(&aor, min, max, length))
  572. return 0;
  573. if (sk_IPAddressOrRange_push(aors, aor))
  574. return 1;
  575. IPAddressOrRange_free(aor);
  576. return 0;
  577. }
  578. /*
  579. * Extract min and max values from an IPAddressOrRange.
  580. */
  581. static int extract_min_max(IPAddressOrRange *aor,
  582. unsigned char *min, unsigned char *max, int length)
  583. {
  584. if (aor == NULL || min == NULL || max == NULL)
  585. return 0;
  586. switch (aor->type) {
  587. case IPAddressOrRange_addressPrefix:
  588. return (addr_expand(min, aor->u.addressPrefix, length, 0x00) &&
  589. addr_expand(max, aor->u.addressPrefix, length, 0xFF));
  590. case IPAddressOrRange_addressRange:
  591. return (addr_expand(min, aor->u.addressRange->min, length, 0x00) &&
  592. addr_expand(max, aor->u.addressRange->max, length, 0xFF));
  593. }
  594. return 0;
  595. }
  596. /*
  597. * Public wrapper for extract_min_max().
  598. */
  599. int X509v3_addr_get_range(IPAddressOrRange *aor,
  600. const unsigned afi,
  601. unsigned char *min,
  602. unsigned char *max, const int length)
  603. {
  604. int afi_length = length_from_afi(afi);
  605. if (aor == NULL || min == NULL || max == NULL ||
  606. afi_length == 0 || length < afi_length ||
  607. (aor->type != IPAddressOrRange_addressPrefix &&
  608. aor->type != IPAddressOrRange_addressRange) ||
  609. !extract_min_max(aor, min, max, afi_length))
  610. return 0;
  611. return afi_length;
  612. }
  613. /*
  614. * Sort comparison function for a sequence of IPAddressFamily.
  615. *
  616. * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
  617. * the ordering: I can read it as meaning that IPv6 without a SAFI
  618. * comes before IPv4 with a SAFI, which seems pretty weird. The
  619. * examples in appendix B suggest that the author intended the
  620. * null-SAFI rule to apply only within a single AFI, which is what I
  621. * would have expected and is what the following code implements.
  622. */
  623. static int IPAddressFamily_cmp(const IPAddressFamily *const *a_,
  624. const IPAddressFamily *const *b_)
  625. {
  626. const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
  627. const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
  628. int len = ((a->length <= b->length) ? a->length : b->length);
  629. int cmp = memcmp(a->data, b->data, len);
  630. return cmp ? cmp : a->length - b->length;
  631. }
  632. static int IPAddressFamily_check_len(const IPAddressFamily *f)
  633. {
  634. if (f->addressFamily->length < 2 || f->addressFamily->length > 3)
  635. return 0;
  636. else
  637. return 1;
  638. }
  639. /*
  640. * Check whether an IPAddrBLocks is in canonical form.
  641. */
  642. int X509v3_addr_is_canonical(IPAddrBlocks *addr)
  643. {
  644. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  645. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  646. IPAddressOrRanges *aors;
  647. int i, j, k;
  648. /*
  649. * Empty extension is canonical.
  650. */
  651. if (addr == NULL)
  652. return 1;
  653. /*
  654. * Check whether the top-level list is in order.
  655. */
  656. for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
  657. const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
  658. const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
  659. if (!IPAddressFamily_check_len(a) || !IPAddressFamily_check_len(b))
  660. return 0;
  661. if (IPAddressFamily_cmp(&a, &b) >= 0)
  662. return 0;
  663. }
  664. /*
  665. * Top level's ok, now check each address family.
  666. */
  667. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  668. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  669. int length = length_from_afi(X509v3_addr_get_afi(f));
  670. /*
  671. * Inheritance is canonical. Anything other than inheritance or
  672. * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
  673. */
  674. if (f == NULL || f->ipAddressChoice == NULL)
  675. return 0;
  676. switch (f->ipAddressChoice->type) {
  677. case IPAddressChoice_inherit:
  678. continue;
  679. case IPAddressChoice_addressesOrRanges:
  680. break;
  681. default:
  682. return 0;
  683. }
  684. if (!IPAddressFamily_check_len(f))
  685. return 0;
  686. /*
  687. * It's an IPAddressOrRanges sequence, check it.
  688. */
  689. aors = f->ipAddressChoice->u.addressesOrRanges;
  690. if (sk_IPAddressOrRange_num(aors) == 0)
  691. return 0;
  692. for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
  693. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  694. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
  695. if (!extract_min_max(a, a_min, a_max, length) ||
  696. !extract_min_max(b, b_min, b_max, length))
  697. return 0;
  698. /*
  699. * Punt misordered list, overlapping start, or inverted range.
  700. */
  701. if (memcmp(a_min, b_min, length) >= 0 ||
  702. memcmp(a_min, a_max, length) > 0 ||
  703. memcmp(b_min, b_max, length) > 0)
  704. return 0;
  705. /*
  706. * Punt if adjacent or overlapping. Check for adjacency by
  707. * subtracting one from b_min first.
  708. */
  709. for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) ;
  710. if (memcmp(a_max, b_min, length) >= 0)
  711. return 0;
  712. /*
  713. * Check for range that should be expressed as a prefix.
  714. */
  715. if (a->type == IPAddressOrRange_addressRange &&
  716. range_should_be_prefix(a_min, a_max, length) >= 0)
  717. return 0;
  718. }
  719. /*
  720. * Check range to see if it's inverted or should be a
  721. * prefix.
  722. */
  723. j = sk_IPAddressOrRange_num(aors) - 1;
  724. {
  725. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  726. if (a != NULL && a->type == IPAddressOrRange_addressRange) {
  727. if (!extract_min_max(a, a_min, a_max, length))
  728. return 0;
  729. if (memcmp(a_min, a_max, length) > 0 ||
  730. range_should_be_prefix(a_min, a_max, length) >= 0)
  731. return 0;
  732. }
  733. }
  734. }
  735. /*
  736. * If we made it through all that, we're happy.
  737. */
  738. return 1;
  739. }
  740. /*
  741. * Whack an IPAddressOrRanges into canonical form.
  742. */
  743. static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
  744. const unsigned afi)
  745. {
  746. int i, j, length = length_from_afi(afi);
  747. /*
  748. * Sort the IPAddressOrRanges sequence.
  749. */
  750. sk_IPAddressOrRange_sort(aors);
  751. /*
  752. * Clean up representation issues, punt on duplicates or overlaps.
  753. */
  754. for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
  755. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
  756. IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
  757. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  758. unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
  759. if (!extract_min_max(a, a_min, a_max, length) ||
  760. !extract_min_max(b, b_min, b_max, length))
  761. return 0;
  762. /*
  763. * Punt inverted ranges.
  764. */
  765. if (memcmp(a_min, a_max, length) > 0 ||
  766. memcmp(b_min, b_max, length) > 0)
  767. return 0;
  768. /*
  769. * Punt overlaps.
  770. */
  771. if (memcmp(a_max, b_min, length) >= 0)
  772. return 0;
  773. /*
  774. * Merge if a and b are adjacent. We check for
  775. * adjacency by subtracting one from b_min first.
  776. */
  777. for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) ;
  778. if (memcmp(a_max, b_min, length) == 0) {
  779. IPAddressOrRange *merged;
  780. if (!make_addressRange(&merged, a_min, b_max, length))
  781. return 0;
  782. (void)sk_IPAddressOrRange_set(aors, i, merged);
  783. (void)sk_IPAddressOrRange_delete(aors, i + 1);
  784. IPAddressOrRange_free(a);
  785. IPAddressOrRange_free(b);
  786. --i;
  787. continue;
  788. }
  789. }
  790. /*
  791. * Check for inverted final range.
  792. */
  793. j = sk_IPAddressOrRange_num(aors) - 1;
  794. {
  795. IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
  796. if (a != NULL && a->type == IPAddressOrRange_addressRange) {
  797. unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
  798. if (!extract_min_max(a, a_min, a_max, length))
  799. return 0;
  800. if (memcmp(a_min, a_max, length) > 0)
  801. return 0;
  802. }
  803. }
  804. return 1;
  805. }
  806. /*
  807. * Whack an IPAddrBlocks extension into canonical form.
  808. */
  809. int X509v3_addr_canonize(IPAddrBlocks *addr)
  810. {
  811. int i;
  812. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  813. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  814. if (!IPAddressFamily_check_len(f))
  815. return 0;
  816. if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
  817. !IPAddressOrRanges_canonize(f->ipAddressChoice->
  818. u.addressesOrRanges,
  819. X509v3_addr_get_afi(f)))
  820. return 0;
  821. }
  822. (void)sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
  823. sk_IPAddressFamily_sort(addr);
  824. if (!ossl_assert(X509v3_addr_is_canonical(addr)))
  825. return 0;
  826. return 1;
  827. }
  828. /*
  829. * v2i handler for the IPAddrBlocks extension.
  830. */
  831. static void *v2i_IPAddrBlocks(const struct v3_ext_method *method,
  832. struct v3_ext_ctx *ctx,
  833. STACK_OF(CONF_VALUE) *values)
  834. {
  835. static const char v4addr_chars[] = "0123456789.";
  836. static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
  837. IPAddrBlocks *addr = NULL;
  838. char *s = NULL, *t;
  839. int i;
  840. if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
  841. ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
  842. return NULL;
  843. }
  844. for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
  845. CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
  846. unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
  847. unsigned afi, *safi = NULL, safi_;
  848. const char *addr_chars = NULL;
  849. int prefixlen, i1, i2, delim, length;
  850. if (!ossl_v3_name_cmp(val->name, "IPv4")) {
  851. afi = IANA_AFI_IPV4;
  852. } else if (!ossl_v3_name_cmp(val->name, "IPv6")) {
  853. afi = IANA_AFI_IPV6;
  854. } else if (!ossl_v3_name_cmp(val->name, "IPv4-SAFI")) {
  855. afi = IANA_AFI_IPV4;
  856. safi = &safi_;
  857. } else if (!ossl_v3_name_cmp(val->name, "IPv6-SAFI")) {
  858. afi = IANA_AFI_IPV6;
  859. safi = &safi_;
  860. } else {
  861. ERR_raise_data(ERR_LIB_X509V3, X509V3_R_EXTENSION_NAME_ERROR,
  862. "%s", val->name);
  863. goto err;
  864. }
  865. switch (afi) {
  866. case IANA_AFI_IPV4:
  867. addr_chars = v4addr_chars;
  868. break;
  869. case IANA_AFI_IPV6:
  870. addr_chars = v6addr_chars;
  871. break;
  872. }
  873. length = length_from_afi(afi);
  874. /*
  875. * Handle SAFI, if any, and OPENSSL_strdup() so we can null-terminate
  876. * the other input values.
  877. */
  878. if (safi != NULL) {
  879. *safi = strtoul(val->value, &t, 0);
  880. t += strspn(t, " \t");
  881. if (*safi > 0xFF || *t++ != ':') {
  882. ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_SAFI);
  883. X509V3_conf_add_error_name_value(val);
  884. goto err;
  885. }
  886. t += strspn(t, " \t");
  887. s = OPENSSL_strdup(t);
  888. } else {
  889. s = OPENSSL_strdup(val->value);
  890. }
  891. if (s == NULL)
  892. goto err;
  893. /*
  894. * Check for inheritance. Not worth additional complexity to
  895. * optimize this (seldom-used) case.
  896. */
  897. if (strcmp(s, "inherit") == 0) {
  898. if (!X509v3_addr_add_inherit(addr, afi, safi)) {
  899. ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_INHERITANCE);
  900. X509V3_conf_add_error_name_value(val);
  901. goto err;
  902. }
  903. OPENSSL_free(s);
  904. s = NULL;
  905. continue;
  906. }
  907. i1 = strspn(s, addr_chars);
  908. i2 = i1 + strspn(s + i1, " \t");
  909. delim = s[i2++];
  910. s[i1] = '\0';
  911. if (ossl_a2i_ipadd(min, s) != length) {
  912. ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_IPADDRESS);
  913. X509V3_conf_add_error_name_value(val);
  914. goto err;
  915. }
  916. switch (delim) {
  917. case '/':
  918. prefixlen = (int)strtoul(s + i2, &t, 10);
  919. if (t == s + i2
  920. || *t != '\0'
  921. || prefixlen > (length * 8)
  922. || prefixlen < 0) {
  923. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
  924. X509V3_conf_add_error_name_value(val);
  925. goto err;
  926. }
  927. if (!X509v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
  928. ERR_raise(ERR_LIB_X509V3, ERR_R_X509V3_LIB);
  929. goto err;
  930. }
  931. break;
  932. case '-':
  933. i1 = i2 + strspn(s + i2, " \t");
  934. i2 = i1 + strspn(s + i1, addr_chars);
  935. if (i1 == i2 || s[i2] != '\0') {
  936. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
  937. X509V3_conf_add_error_name_value(val);
  938. goto err;
  939. }
  940. if (ossl_a2i_ipadd(max, s + i1) != length) {
  941. ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_IPADDRESS);
  942. X509V3_conf_add_error_name_value(val);
  943. goto err;
  944. }
  945. if (memcmp(min, max, length_from_afi(afi)) > 0) {
  946. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
  947. X509V3_conf_add_error_name_value(val);
  948. goto err;
  949. }
  950. if (!X509v3_addr_add_range(addr, afi, safi, min, max)) {
  951. ERR_raise(ERR_LIB_X509V3, ERR_R_X509V3_LIB);
  952. goto err;
  953. }
  954. break;
  955. case '\0':
  956. if (!X509v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
  957. ERR_raise(ERR_LIB_X509V3, ERR_R_X509V3_LIB);
  958. goto err;
  959. }
  960. break;
  961. default:
  962. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
  963. X509V3_conf_add_error_name_value(val);
  964. goto err;
  965. }
  966. OPENSSL_free(s);
  967. s = NULL;
  968. }
  969. /*
  970. * Canonize the result, then we're done.
  971. */
  972. if (!X509v3_addr_canonize(addr))
  973. goto err;
  974. return addr;
  975. err:
  976. OPENSSL_free(s);
  977. sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
  978. return NULL;
  979. }
  980. /*
  981. * OpenSSL dispatch
  982. */
  983. const X509V3_EXT_METHOD ossl_v3_addr = {
  984. NID_sbgp_ipAddrBlock, /* nid */
  985. 0, /* flags */
  986. ASN1_ITEM_ref(IPAddrBlocks), /* template */
  987. 0, 0, 0, 0, /* old functions, ignored */
  988. 0, /* i2s */
  989. 0, /* s2i */
  990. 0, /* i2v */
  991. v2i_IPAddrBlocks, /* v2i */
  992. i2r_IPAddrBlocks, /* i2r */
  993. 0, /* r2i */
  994. NULL /* extension-specific data */
  995. };
  996. /*
  997. * Figure out whether extension sues inheritance.
  998. */
  999. int X509v3_addr_inherits(IPAddrBlocks *addr)
  1000. {
  1001. int i;
  1002. if (addr == NULL)
  1003. return 0;
  1004. for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
  1005. IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
  1006. if (f->ipAddressChoice->type == IPAddressChoice_inherit)
  1007. return 1;
  1008. }
  1009. return 0;
  1010. }
  1011. /*
  1012. * Figure out whether parent contains child.
  1013. */
  1014. static int addr_contains(IPAddressOrRanges *parent,
  1015. IPAddressOrRanges *child, int length)
  1016. {
  1017. unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
  1018. unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
  1019. int p, c;
  1020. if (child == NULL || parent == child)
  1021. return 1;
  1022. if (parent == NULL)
  1023. return 0;
  1024. p = 0;
  1025. for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
  1026. if (!extract_min_max(sk_IPAddressOrRange_value(child, c),
  1027. c_min, c_max, length))
  1028. return 0;
  1029. for (;; p++) {
  1030. if (p >= sk_IPAddressOrRange_num(parent))
  1031. return 0;
  1032. if (!extract_min_max(sk_IPAddressOrRange_value(parent, p),
  1033. p_min, p_max, length))
  1034. return 0;
  1035. if (memcmp(p_max, c_max, length) < 0)
  1036. continue;
  1037. if (memcmp(p_min, c_min, length) > 0)
  1038. return 0;
  1039. break;
  1040. }
  1041. }
  1042. return 1;
  1043. }
  1044. /*
  1045. * Test whether a is a subset of b.
  1046. */
  1047. int X509v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
  1048. {
  1049. int i;
  1050. if (a == NULL || a == b)
  1051. return 1;
  1052. if (b == NULL || X509v3_addr_inherits(a) || X509v3_addr_inherits(b))
  1053. return 0;
  1054. (void)sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
  1055. sk_IPAddressFamily_sort(b);
  1056. /* Could sort a here too and get O(|a|) running time instead of O(|a| ln |b|) */
  1057. for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
  1058. IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
  1059. int j = sk_IPAddressFamily_find(b, fa);
  1060. IPAddressFamily *fb = sk_IPAddressFamily_value(b, j);
  1061. if (fb == NULL)
  1062. return 0;
  1063. if (!IPAddressFamily_check_len(fa) || !IPAddressFamily_check_len(fb))
  1064. return 0;
  1065. if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
  1066. fa->ipAddressChoice->u.addressesOrRanges,
  1067. length_from_afi(X509v3_addr_get_afi(fb))))
  1068. return 0;
  1069. }
  1070. return 1;
  1071. }
  1072. /*
  1073. * Validation error handling via callback.
  1074. */
  1075. # define validation_err(_err_) \
  1076. do { \
  1077. if (ctx != NULL) { \
  1078. ctx->error = _err_; \
  1079. ctx->error_depth = i; \
  1080. ctx->current_cert = x; \
  1081. rv = ctx->verify_cb(0, ctx); \
  1082. } else { \
  1083. rv = 0; \
  1084. } \
  1085. if (rv == 0) \
  1086. goto done; \
  1087. } while (0)
  1088. /*
  1089. * Core code for RFC 3779 2.3 path validation.
  1090. *
  1091. * Returns 1 for success, 0 on error.
  1092. *
  1093. * When returning 0, ctx->error MUST be set to an appropriate value other than
  1094. * X509_V_OK.
  1095. */
  1096. static int addr_validate_path_internal(X509_STORE_CTX *ctx,
  1097. STACK_OF(X509) *chain,
  1098. IPAddrBlocks *ext)
  1099. {
  1100. IPAddrBlocks *child = NULL;
  1101. int i, j, ret = 0, rv;
  1102. X509 *x;
  1103. if (!ossl_assert(chain != NULL && sk_X509_num(chain) > 0)
  1104. || !ossl_assert(ctx != NULL || ext != NULL)
  1105. || !ossl_assert(ctx == NULL || ctx->verify_cb != NULL)) {
  1106. if (ctx != NULL)
  1107. ctx->error = X509_V_ERR_UNSPECIFIED;
  1108. return 0;
  1109. }
  1110. /*
  1111. * Figure out where to start. If we don't have an extension to
  1112. * check, we're done. Otherwise, check canonical form and
  1113. * set up for walking up the chain.
  1114. */
  1115. if (ext != NULL) {
  1116. i = -1;
  1117. x = NULL;
  1118. } else {
  1119. i = 0;
  1120. x = sk_X509_value(chain, i);
  1121. if ((ext = x->rfc3779_addr) == NULL)
  1122. return 1; /* Return success */
  1123. }
  1124. if (!X509v3_addr_is_canonical(ext))
  1125. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1126. (void)sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
  1127. if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
  1128. ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
  1129. if (ctx != NULL)
  1130. ctx->error = X509_V_ERR_OUT_OF_MEM;
  1131. goto done;
  1132. }
  1133. sk_IPAddressFamily_sort(child);
  1134. /*
  1135. * Now walk up the chain. No cert may list resources that its
  1136. * parent doesn't list.
  1137. */
  1138. for (i++; i < sk_X509_num(chain); i++) {
  1139. x = sk_X509_value(chain, i);
  1140. if (!X509v3_addr_is_canonical(x->rfc3779_addr))
  1141. validation_err(X509_V_ERR_INVALID_EXTENSION);
  1142. if (x->rfc3779_addr == NULL) {
  1143. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1144. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1145. if (!IPAddressFamily_check_len(fc))
  1146. goto done;
  1147. if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
  1148. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1149. break;
  1150. }
  1151. }
  1152. continue;
  1153. }
  1154. (void)sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr,
  1155. IPAddressFamily_cmp);
  1156. sk_IPAddressFamily_sort(x->rfc3779_addr);
  1157. for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
  1158. IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
  1159. int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
  1160. IPAddressFamily *fp =
  1161. sk_IPAddressFamily_value(x->rfc3779_addr, k);
  1162. if (fp == NULL) {
  1163. if (fc->ipAddressChoice->type ==
  1164. IPAddressChoice_addressesOrRanges) {
  1165. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1166. break;
  1167. }
  1168. continue;
  1169. }
  1170. if (!IPAddressFamily_check_len(fc) || !IPAddressFamily_check_len(fp))
  1171. goto done;
  1172. if (fp->ipAddressChoice->type ==
  1173. IPAddressChoice_addressesOrRanges) {
  1174. if (fc->ipAddressChoice->type == IPAddressChoice_inherit
  1175. || addr_contains(fp->ipAddressChoice->u.addressesOrRanges,
  1176. fc->ipAddressChoice->u.addressesOrRanges,
  1177. length_from_afi(X509v3_addr_get_afi(fc))))
  1178. (void)sk_IPAddressFamily_set(child, j, fp);
  1179. else
  1180. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1181. }
  1182. }
  1183. }
  1184. /*
  1185. * Trust anchor can't inherit.
  1186. */
  1187. if (x->rfc3779_addr != NULL) {
  1188. for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
  1189. IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j);
  1190. if (!IPAddressFamily_check_len(fp))
  1191. goto done;
  1192. if (fp->ipAddressChoice->type == IPAddressChoice_inherit
  1193. && sk_IPAddressFamily_find(child, fp) >= 0)
  1194. validation_err(X509_V_ERR_UNNESTED_RESOURCE);
  1195. }
  1196. }
  1197. ret = 1;
  1198. done:
  1199. sk_IPAddressFamily_free(child);
  1200. return ret;
  1201. }
  1202. # undef validation_err
  1203. /*
  1204. * RFC 3779 2.3 path validation -- called from X509_verify_cert().
  1205. */
  1206. int X509v3_addr_validate_path(X509_STORE_CTX *ctx)
  1207. {
  1208. if (ctx->chain == NULL
  1209. || sk_X509_num(ctx->chain) == 0
  1210. || ctx->verify_cb == NULL) {
  1211. ctx->error = X509_V_ERR_UNSPECIFIED;
  1212. return 0;
  1213. }
  1214. return addr_validate_path_internal(ctx, ctx->chain, NULL);
  1215. }
  1216. /*
  1217. * RFC 3779 2.3 path validation of an extension.
  1218. * Test whether chain covers extension.
  1219. */
  1220. int X509v3_addr_validate_resource_set(STACK_OF(X509) *chain,
  1221. IPAddrBlocks *ext, int allow_inheritance)
  1222. {
  1223. if (ext == NULL)
  1224. return 1;
  1225. if (chain == NULL || sk_X509_num(chain) == 0)
  1226. return 0;
  1227. if (!allow_inheritance && X509v3_addr_inherits(ext))
  1228. return 0;
  1229. return addr_validate_path_internal(NULL, chain, ext);
  1230. }
  1231. #endif /* OPENSSL_NO_RFC3779 */