v3_lib.c 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304
  1. /*
  2. * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /* X509 v3 extension utilities */
  10. #include <stdio.h>
  11. #include "internal/cryptlib.h"
  12. #include <openssl/conf.h>
  13. #include <openssl/x509v3.h>
  14. #include "ext_dat.h"
  15. static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
  16. static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  17. const X509V3_EXT_METHOD *const *b);
  18. static void ext_list_free(X509V3_EXT_METHOD *ext);
  19. int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
  20. {
  21. if (ext_list == NULL
  22. && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) {
  23. ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
  24. return 0;
  25. }
  26. if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
  27. ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
  28. return 0;
  29. }
  30. return 1;
  31. }
  32. static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  33. const X509V3_EXT_METHOD *const *b)
  34. {
  35. return ((*a)->ext_nid - (*b)->ext_nid);
  36. }
  37. DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  38. const X509V3_EXT_METHOD *, ext);
  39. IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  40. const X509V3_EXT_METHOD *, ext);
  41. #include "standard_exts.h"
  42. const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
  43. {
  44. X509V3_EXT_METHOD tmp;
  45. const X509V3_EXT_METHOD *t = &tmp, *const *ret;
  46. int idx;
  47. if (nid < 0)
  48. return NULL;
  49. tmp.ext_nid = nid;
  50. ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
  51. if (ret)
  52. return *ret;
  53. if (!ext_list)
  54. return NULL;
  55. idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
  56. return sk_X509V3_EXT_METHOD_value(ext_list, idx);
  57. }
  58. const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
  59. {
  60. int nid;
  61. if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef)
  62. return NULL;
  63. return X509V3_EXT_get_nid(nid);
  64. }
  65. int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
  66. {
  67. for (; extlist->ext_nid != -1; extlist++)
  68. if (!X509V3_EXT_add(extlist))
  69. return 0;
  70. return 1;
  71. }
  72. int X509V3_EXT_add_alias(int nid_to, int nid_from)
  73. {
  74. const X509V3_EXT_METHOD *ext;
  75. X509V3_EXT_METHOD *tmpext;
  76. if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) {
  77. ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND);
  78. return 0;
  79. }
  80. if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL) {
  81. ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
  82. return 0;
  83. }
  84. *tmpext = *ext;
  85. tmpext->ext_nid = nid_to;
  86. tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
  87. return X509V3_EXT_add(tmpext);
  88. }
  89. void X509V3_EXT_cleanup(void)
  90. {
  91. sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
  92. ext_list = NULL;
  93. }
  94. static void ext_list_free(X509V3_EXT_METHOD *ext)
  95. {
  96. if (ext->ext_flags & X509V3_EXT_DYNAMIC)
  97. OPENSSL_free(ext);
  98. }
  99. /*
  100. * Legacy function: we don't need to add standard extensions any more because
  101. * they are now kept in ext_dat.h.
  102. */
  103. int X509V3_add_standard_extensions(void)
  104. {
  105. return 1;
  106. }
  107. /* Return an extension internal structure */
  108. void *X509V3_EXT_d2i(X509_EXTENSION *ext)
  109. {
  110. const X509V3_EXT_METHOD *method;
  111. const unsigned char *p;
  112. ASN1_STRING *extvalue;
  113. int extlen;
  114. if ((method = X509V3_EXT_get(ext)) == NULL)
  115. return NULL;
  116. extvalue = X509_EXTENSION_get_data(ext);
  117. p = ASN1_STRING_get0_data(extvalue);
  118. extlen = ASN1_STRING_length(extvalue);
  119. if (method->it)
  120. return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it));
  121. return method->d2i(NULL, &p, extlen);
  122. }
  123. /*-
  124. * Get critical flag and decoded version of extension from a NID.
  125. * The "idx" variable returns the last found extension and can
  126. * be used to retrieve multiple extensions of the same NID.
  127. * However multiple extensions with the same NID is usually
  128. * due to a badly encoded certificate so if idx is NULL we
  129. * choke if multiple extensions exist.
  130. * The "crit" variable is set to the critical value.
  131. * The return value is the decoded extension or NULL on
  132. * error. The actual error can have several different causes,
  133. * the value of *crit reflects the cause:
  134. * >= 0, extension found but not decoded (reflects critical value).
  135. * -1 extension not found.
  136. * -2 extension occurs more than once.
  137. */
  138. void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
  139. int *idx)
  140. {
  141. int lastpos, i;
  142. X509_EXTENSION *ex, *found_ex = NULL;
  143. if (!x) {
  144. if (idx)
  145. *idx = -1;
  146. if (crit)
  147. *crit = -1;
  148. return NULL;
  149. }
  150. if (idx)
  151. lastpos = *idx + 1;
  152. else
  153. lastpos = 0;
  154. if (lastpos < 0)
  155. lastpos = 0;
  156. for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
  157. ex = sk_X509_EXTENSION_value(x, i);
  158. if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) {
  159. if (idx) {
  160. *idx = i;
  161. found_ex = ex;
  162. break;
  163. } else if (found_ex) {
  164. /* Found more than one */
  165. if (crit)
  166. *crit = -2;
  167. return NULL;
  168. }
  169. found_ex = ex;
  170. }
  171. }
  172. if (found_ex) {
  173. /* Found it */
  174. if (crit)
  175. *crit = X509_EXTENSION_get_critical(found_ex);
  176. return X509V3_EXT_d2i(found_ex);
  177. }
  178. /* Extension not found */
  179. if (idx)
  180. *idx = -1;
  181. if (crit)
  182. *crit = -1;
  183. return NULL;
  184. }
  185. /*
  186. * This function is a general extension append, replace and delete utility.
  187. * The precise operation is governed by the 'flags' value. The 'crit' and
  188. * 'value' arguments (if relevant) are the extensions internal structure.
  189. */
  190. int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
  191. int crit, unsigned long flags)
  192. {
  193. int errcode, extidx = -1;
  194. X509_EXTENSION *ext = NULL, *extmp;
  195. STACK_OF(X509_EXTENSION) *ret = NULL;
  196. unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
  197. /*
  198. * If appending we don't care if it exists, otherwise look for existing
  199. * extension.
  200. */
  201. if (ext_op != X509V3_ADD_APPEND)
  202. extidx = X509v3_get_ext_by_NID(*x, nid, -1);
  203. /* See if extension exists */
  204. if (extidx >= 0) {
  205. /* If keep existing, nothing to do */
  206. if (ext_op == X509V3_ADD_KEEP_EXISTING)
  207. return 1;
  208. /* If default then its an error */
  209. if (ext_op == X509V3_ADD_DEFAULT) {
  210. errcode = X509V3_R_EXTENSION_EXISTS;
  211. goto err;
  212. }
  213. /* If delete, just delete it */
  214. if (ext_op == X509V3_ADD_DELETE) {
  215. extmp = sk_X509_EXTENSION_delete(*x, extidx);
  216. if (extmp == NULL)
  217. return -1;
  218. X509_EXTENSION_free(extmp);
  219. return 1;
  220. }
  221. } else {
  222. /*
  223. * If replace existing or delete, error since extension must exist
  224. */
  225. if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
  226. (ext_op == X509V3_ADD_DELETE)) {
  227. errcode = X509V3_R_EXTENSION_NOT_FOUND;
  228. goto err;
  229. }
  230. }
  231. /*
  232. * If we get this far then we have to create an extension: could have
  233. * some flags for alternative encoding schemes...
  234. */
  235. ext = X509V3_EXT_i2d(nid, crit, value);
  236. if (!ext) {
  237. ERR_raise(ERR_LIB_X509V3, X509V3_R_ERROR_CREATING_EXTENSION);
  238. return 0;
  239. }
  240. /* If extension exists replace it.. */
  241. if (extidx >= 0) {
  242. extmp = sk_X509_EXTENSION_value(*x, extidx);
  243. X509_EXTENSION_free(extmp);
  244. if (!sk_X509_EXTENSION_set(*x, extidx, ext))
  245. return -1;
  246. return 1;
  247. }
  248. ret = *x;
  249. if (*x == NULL
  250. && (ret = sk_X509_EXTENSION_new_null()) == NULL)
  251. goto m_fail;
  252. if (!sk_X509_EXTENSION_push(ret, ext))
  253. goto m_fail;
  254. *x = ret;
  255. return 1;
  256. m_fail:
  257. /* ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE); */
  258. if (ret != *x)
  259. sk_X509_EXTENSION_free(ret);
  260. X509_EXTENSION_free(ext);
  261. return -1;
  262. err:
  263. if (!(flags & X509V3_ADD_SILENT))
  264. ERR_raise(ERR_LIB_X509V3, errcode);
  265. return 0;
  266. }