[thirdparty/openssl.git] / crypto / x509v3 / v3_ncons.c

/* v3_ncons.c */
/*
 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project.
 */
/* ====================================================================
 * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/asn1t.h>
#include <openssl/conf.h>
#include <openssl/x509v3.h>

#include "internal/x509_int.h"

static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
                                  X509V3_CTX *ctx,
                                  STACK_OF(CONF_VALUE) *nval);
static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
                                BIO *bp, int ind);
static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
                                   STACK_OF(GENERAL_SUBTREE) *trees, BIO *bp,
                                   int ind, char *name);
static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip);

static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc);
static int nc_match_single(GENERAL_NAME *sub, GENERAL_NAME *gen);
static int nc_dn(X509_NAME *sub, X509_NAME *nm);
static int nc_dns(ASN1_IA5STRING *sub, ASN1_IA5STRING *dns);
static int nc_email(ASN1_IA5STRING *sub, ASN1_IA5STRING *eml);
static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base);
static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base);

const X509V3_EXT_METHOD v3_name_constraints = {
    NID_name_constraints, 0,
    ASN1_ITEM_ref(NAME_CONSTRAINTS),
    0, 0, 0, 0,
    0, 0,
    0, v2i_NAME_CONSTRAINTS,
    i2r_NAME_CONSTRAINTS, 0,
    NULL
};

ASN1_SEQUENCE(GENERAL_SUBTREE) = {
        ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
        ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
        ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1)
} ASN1_SEQUENCE_END(GENERAL_SUBTREE)

ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
        ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees,
                                                        GENERAL_SUBTREE, 0),
        ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees,
                                                        GENERAL_SUBTREE, 1),
} ASN1_SEQUENCE_END(NAME_CONSTRAINTS)


IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)

static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
                                  X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
{
    int i;
    CONF_VALUE tval, *val;
    STACK_OF(GENERAL_SUBTREE) **ptree = NULL;
    NAME_CONSTRAINTS *ncons = NULL;
    GENERAL_SUBTREE *sub = NULL;
    ncons = NAME_CONSTRAINTS_new();
    if (!ncons)
        goto memerr;
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
        val = sk_CONF_VALUE_value(nval, i);
        if (!strncmp(val->name, "permitted", 9) && val->name[9]) {
            ptree = &ncons->permittedSubtrees;
            tval.name = val->name + 10;
        } else if (!strncmp(val->name, "excluded", 8) && val->name[8]) {
            ptree = &ncons->excludedSubtrees;
            tval.name = val->name + 9;
        } else {
            X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, X509V3_R_INVALID_SYNTAX);
            goto err;
        }
        tval.value = val->value;
        sub = GENERAL_SUBTREE_new();
        if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1))
            goto err;
        if (!*ptree)
            *ptree = sk_GENERAL_SUBTREE_new_null();
        if (!*ptree || !sk_GENERAL_SUBTREE_push(*ptree, sub))
            goto memerr;
        sub = NULL;
    }

    return ncons;

 memerr:
    X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
 err:
    NAME_CONSTRAINTS_free(ncons);
    GENERAL_SUBTREE_free(sub);

    return NULL;
}

static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
                                BIO *bp, int ind)
{
    NAME_CONSTRAINTS *ncons = a;
    do_i2r_name_constraints(method, ncons->permittedSubtrees,
                            bp, ind, "Permitted");
    do_i2r_name_constraints(method, ncons->excludedSubtrees,
                            bp, ind, "Excluded");
    return 1;
}

static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
                                   STACK_OF(GENERAL_SUBTREE) *trees,
                                   BIO *bp, int ind, char *name)
{
    GENERAL_SUBTREE *tree;
    int i;
    if (sk_GENERAL_SUBTREE_num(trees) > 0)
        BIO_printf(bp, "%*s%s:\n", ind, "", name);
    for (i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) {
        tree = sk_GENERAL_SUBTREE_value(trees, i);
        BIO_printf(bp, "%*s", ind + 2, "");
        if (tree->base->type == GEN_IPADD)
            print_nc_ipadd(bp, tree->base->d.ip);
        else
            GENERAL_NAME_print(bp, tree->base);
        BIO_puts(bp, "\n");
    }
    return 1;
}

static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
{
    int i, len;
    unsigned char *p;
    p = ip->data;
    len = ip->length;
    BIO_puts(bp, "IP:");
    if (len == 8) {
        BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d",
                   p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
    } else if (len == 32) {
        for (i = 0; i < 16; i++) {
            BIO_printf(bp, "%X", p[0] << 8 | p[1]);
            p += 2;
            if (i == 7)
                BIO_puts(bp, "/");
            else if (i != 15)
                BIO_puts(bp, ":");
        }
    } else
        BIO_printf(bp, "IP Address:<invalid>");
    return 1;
}

/*-
 * Check a certificate conforms to a specified set of constraints.
 * Return values:
 *  X509_V_OK: All constraints obeyed.
 *  X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation.
 *  X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation.
 *  X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type.
 *  X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:  Unsupported constraint type.
 *  X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax.
 *  X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name
 */

int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc)
{
    int r, i;
    X509_NAME *nm;

    nm = X509_get_subject_name(x);

    if (X509_NAME_entry_count(nm) > 0) {
        GENERAL_NAME gntmp;
        gntmp.type = GEN_DIRNAME;
        gntmp.d.directoryName = nm;

        r = nc_match(&gntmp, nc);

        if (r != X509_V_OK)
            return r;

        gntmp.type = GEN_EMAIL;

        /* Process any email address attributes in subject name */

        for (i = -1;;) {
            X509_NAME_ENTRY *ne;
            i = X509_NAME_get_index_by_NID(nm, NID_pkcs9_emailAddress, i);
            if (i == -1)
                break;
            ne = X509_NAME_get_entry(nm, i);
            gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne);
            if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING)
                return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;

            r = nc_match(&gntmp, nc);

            if (r != X509_V_OK)
                return r;
        }

    }

    for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++) {
        GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i);
        r = nc_match(gen, nc);
        if (r != X509_V_OK)
            return r;
    }

    return X509_V_OK;

}

static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc)
{
    GENERAL_SUBTREE *sub;
    int i, r, match = 0;

    /*
     * Permitted subtrees: if any subtrees exist of matching the type at
     * least one subtree must match.
     */

    for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) {
        sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
        if (gen->type != sub->base->type)
            continue;
        if (sub->minimum || sub->maximum)
            return X509_V_ERR_SUBTREE_MINMAX;
        /* If we already have a match don't bother trying any more */
        if (match == 2)
            continue;
        if (match == 0)
            match = 1;
        r = nc_match_single(gen, sub->base);
        if (r == X509_V_OK)
            match = 2;
        else if (r != X509_V_ERR_PERMITTED_VIOLATION)
            return r;
    }

    if (match == 1)
        return X509_V_ERR_PERMITTED_VIOLATION;

    /* Excluded subtrees: must not match any of these */

    for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++) {
        sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i);
        if (gen->type != sub->base->type)
            continue;
        if (sub->minimum || sub->maximum)
            return X509_V_ERR_SUBTREE_MINMAX;

        r = nc_match_single(gen, sub->base);
        if (r == X509_V_OK)
            return X509_V_ERR_EXCLUDED_VIOLATION;
        else if (r != X509_V_ERR_PERMITTED_VIOLATION)
            return r;

    }

    return X509_V_OK;

}

static int nc_match_single(GENERAL_NAME *gen, GENERAL_NAME *base)
{
    switch (base->type) {
    case GEN_DIRNAME:
        return nc_dn(gen->d.directoryName, base->d.directoryName);

    case GEN_DNS:
        return nc_dns(gen->d.dNSName, base->d.dNSName);

    case GEN_EMAIL:
        return nc_email(gen->d.rfc822Name, base->d.rfc822Name);

    case GEN_URI:
        return nc_uri(gen->d.uniformResourceIdentifier,
                      base->d.uniformResourceIdentifier);

    case GEN_IPADD:
        return nc_ip(gen->d.iPAddress, base->d.iPAddress);

    default:
        return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
    }

}

/*
 * directoryName name constraint matching. The canonical encoding of
 * X509_NAME makes this comparison easy. It is matched if the subtree is a
 * subset of the name.
 */

static int nc_dn(X509_NAME *nm, X509_NAME *base)
{
    /* Ensure canonical encodings are up to date.  */
    if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
        return X509_V_ERR_OUT_OF_MEM;
    if (base->modified && i2d_X509_NAME(base, NULL) < 0)
        return X509_V_ERR_OUT_OF_MEM;
    if (base->canon_enclen > nm->canon_enclen)
        return X509_V_ERR_PERMITTED_VIOLATION;
    if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
        return X509_V_ERR_PERMITTED_VIOLATION;
    return X509_V_OK;
}

static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
{
    char *baseptr = (char *)base->data;
    char *dnsptr = (char *)dns->data;
    /* Empty matches everything */
    if (!*baseptr)
        return X509_V_OK;
    /*
     * Otherwise can add zero or more components on the left so compare RHS
     * and if dns is longer and expect '.' as preceding character.
     */
    if (dns->length > base->length) {
        dnsptr += dns->length - base->length;
        if (*baseptr != '.' && dnsptr[-1] != '.')
            return X509_V_ERR_PERMITTED_VIOLATION;
    }

    if (strcasecmp(baseptr, dnsptr))
        return X509_V_ERR_PERMITTED_VIOLATION;

    return X509_V_OK;

}

static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
{
    const char *baseptr = (char *)base->data;
    const char *emlptr = (char *)eml->data;

    const char *baseat = strchr(baseptr, '@');
    const char *emlat = strchr(emlptr, '@');
    if (!emlat)
        return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
    /* Special case: inital '.' is RHS match */
    if (!baseat && (*baseptr == '.')) {
        if (eml->length > base->length) {
            emlptr += eml->length - base->length;
            if (!strcasecmp(baseptr, emlptr))
                return X509_V_OK;
        }
        return X509_V_ERR_PERMITTED_VIOLATION;
    }

    /* If we have anything before '@' match local part */

    if (baseat) {
        if (baseat != baseptr) {
            if ((baseat - baseptr) != (emlat - emlptr))
                return X509_V_ERR_PERMITTED_VIOLATION;
            /* Case sensitive match of local part */
            if (strncmp(baseptr, emlptr, emlat - emlptr))
                return X509_V_ERR_PERMITTED_VIOLATION;
        }
        /* Position base after '@' */
        baseptr = baseat + 1;
    }
    emlptr = emlat + 1;
    /* Just have hostname left to match: case insensitive */
    if (strcasecmp(baseptr, emlptr))
        return X509_V_ERR_PERMITTED_VIOLATION;

    return X509_V_OK;

}

static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
{
    const char *baseptr = (char *)base->data;
    const char *hostptr = (char *)uri->data;
    const char *p = strchr(hostptr, ':');
    int hostlen;
    /* Check for foo:// and skip past it */
    if (!p || (p[1] != '/') || (p[2] != '/'))
        return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
    hostptr = p + 3;

    /* Determine length of hostname part of URI */

    /* Look for a port indicator as end of hostname first */

    p = strchr(hostptr, ':');
    /* Otherwise look for trailing slash */
    if (!p)
        p = strchr(hostptr, '/');

    if (!p)
        hostlen = strlen(hostptr);
    else
        hostlen = p - hostptr;

    if (hostlen == 0)
        return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;

    /* Special case: inital '.' is RHS match */
    if (*baseptr == '.') {
        if (hostlen > base->length) {
            p = hostptr + hostlen - base->length;
            if (!strncasecmp(p, baseptr, base->length))
                return X509_V_OK;
        }
        return X509_V_ERR_PERMITTED_VIOLATION;
    }

    if ((base->length != (int)hostlen)
        || strncasecmp(hostptr, baseptr, hostlen))
        return X509_V_ERR_PERMITTED_VIOLATION;

    return X509_V_OK;

}

static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base)
{
    int hostlen, baselen, i;
    unsigned char *hostptr, *baseptr, *maskptr;
    hostptr = ip->data;
    hostlen = ip->length;
    baseptr = base->data;
    baselen = base->length;

    /* Invalid if not IPv4 or IPv6 */
    if (!((hostlen == 4) || (hostlen == 16)))
        return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
    if (!((baselen == 8) || (baselen == 32)))
        return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;

    /* Do not match IPv4 with IPv6 */
    if (hostlen * 2 != baselen)
        return X509_V_ERR_PERMITTED_VIOLATION;

    maskptr = base->data + hostlen;

    /* Considering possible not aligned base ipAddress */
    /* Not checking for wrong mask definition: i.e.: 255.0.255.0 */
    for (i = 0; i < hostlen; i++)
        if ((hostptr[i] & maskptr[i]) != (baseptr[i] & maskptr[i]))
            return X509_V_ERR_PERMITTED_VIOLATION;

    return X509_V_OK;

}
Commit	Line	Data
520b76ff	1	/* v3_ncons.c */
0f113f3e MC	2	/*
0f113f3e MC	3	* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
520b76ff DSH	4	* project.
	5	*/
	6	/* ====================================================================
	7	* Copyright (c) 2003 The OpenSSL Project. All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	*
	13	* 1. Redistributions of source code must retain the above copyright
0f113f3e	14	* notice, this list of conditions and the following disclaimer.
520b76ff DSH	15	*
	16	* 2. Redistributions in binary form must reproduce the above copyright
	17	* notice, this list of conditions and the following disclaimer in
	18	* the documentation and/or other materials provided with the
	19	* distribution.
	20	*
	21	* 3. All advertising materials mentioning features or use of this
	22	* software must display the following acknowledgment:
	23	* "This product includes software developed by the OpenSSL Project
	24	* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
	25	*
	26	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	27	* endorse or promote products derived from this software without
	28	* prior written permission. For written permission, please contact
	29	* licensing@OpenSSL.org.
	30	*
	31	* 5. Products derived from this software may not be called "OpenSSL"
	32	* nor may "OpenSSL" appear in their names without prior written
	33	* permission of the OpenSSL Project.
	34	*
	35	* 6. Redistributions of any form whatsoever must retain the following
	36	* acknowledgment:
	37	* "This product includes software developed by the OpenSSL Project
	38	* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
	39	*
	40	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	41	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	42	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	43	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	44	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	45	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	46	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	47	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	49	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	50	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	51	* OF THE POSSIBILITY OF SUCH DAMAGE.
	52	* ====================================================================
	53	*
	54	* This product includes cryptographic software written by Eric Young
	55	* (eay@cryptsoft.com). This product includes software written by Tim
	56	* Hudson (tjh@cryptsoft.com).
	57	*
	58	*/
	59
520b76ff DSH	60	#include <stdio.h>
	61	#include "cryptlib.h"
	62	#include <openssl/asn1t.h>
	63	#include <openssl/conf.h>
	64	#include <openssl/x509v3.h>
	65
2743e38c DSH	66	#include "internal/x509_int.h"
2743e38c DSH	67
babb3798	68	static void v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD method,
0f113f3e MC	69	X509V3_CTX *ctx,
	70	STACK_OF(CONF_VALUE) *nval);
	71	static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD method, void a,
	72	BIO *bp, int ind);
babb3798	73	static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
0f113f3e MC	74	STACK_OF(GENERAL_SUBTREE) trees, BIO bp,
0f113f3e MC	75	int ind, char *name);
520b76ff DSH	76	static int print_nc_ipadd(BIO bp, ASN1_OCTET_STRING ip);
520b76ff DSH	77
e9746e03 DSH	78	static int nc_match(GENERAL_NAME gen, NAME_CONSTRAINTS nc);
	79	static int nc_match_single(GENERAL_NAME sub, GENERAL_NAME gen);
	80	static int nc_dn(X509_NAME sub, X509_NAME nm);
	81	static int nc_dns(ASN1_IA5STRING sub, ASN1_IA5STRING dns);
	82	static int nc_email(ASN1_IA5STRING sub, ASN1_IA5STRING eml);
	83	static int nc_uri(ASN1_IA5STRING uri, ASN1_IA5STRING base);
dd36fce0	84	static int nc_ip(ASN1_OCTET_STRING ip, ASN1_OCTET_STRING base);
e9746e03	85
560b79cb	86	const X509V3_EXT_METHOD v3_name_constraints = {
0f113f3e MC	87	NID_name_constraints, 0,
	88	ASN1_ITEM_ref(NAME_CONSTRAINTS),
	89	0, 0, 0, 0,
	90	0, 0,
	91	0, v2i_NAME_CONSTRAINTS,
	92	i2r_NAME_CONSTRAINTS, 0,
	93	NULL
520b76ff DSH	94	};
	95
	96	ASN1_SEQUENCE(GENERAL_SUBTREE) = {
0f113f3e MC	97	ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
	98	ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
	99	ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1)
520b76ff DSH	100	} ASN1_SEQUENCE_END(GENERAL_SUBTREE)
	101
	102	ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
0f113f3e MC	103	ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees,
	104	GENERAL_SUBTREE, 0),
	105	ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees,
	106	GENERAL_SUBTREE, 1),
520b76ff	107	} ASN1_SEQUENCE_END(NAME_CONSTRAINTS)
0f113f3e	108
520b76ff DSH	109
	110	IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
	111	IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
	112
babb3798	113	static void v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD method,
0f113f3e MC	114	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval)
	115	{
	116	int i;
	117	CONF_VALUE tval, *val;
	118	STACK_OF(GENERAL_SUBTREE) **ptree = NULL;
	119	NAME_CONSTRAINTS *ncons = NULL;
	120	GENERAL_SUBTREE *sub = NULL;
	121	ncons = NAME_CONSTRAINTS_new();
	122	if (!ncons)
	123	goto memerr;
	124	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
	125	val = sk_CONF_VALUE_value(nval, i);
	126	if (!strncmp(val->name, "permitted", 9) && val->name[9]) {
	127	ptree = &ncons->permittedSubtrees;
	128	tval.name = val->name + 10;
	129	} else if (!strncmp(val->name, "excluded", 8) && val->name[8]) {
	130	ptree = &ncons->excludedSubtrees;
	131	tval.name = val->name + 9;
	132	} else {
	133	X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, X509V3_R_INVALID_SYNTAX);
	134	goto err;
	135	}
	136	tval.value = val->value;
	137	sub = GENERAL_SUBTREE_new();
	138	if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1))
	139	goto err;
	140	if (!*ptree)
	141	*ptree = sk_GENERAL_SUBTREE_new_null();
	142	if (!ptree \|\| !sk_GENERAL_SUBTREE_push(ptree, sub))
	143	goto memerr;
	144	sub = NULL;
	145	}
	146
	147	return ncons;
	148
	149	memerr:
	150	X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE);
	151	err:
895cba19 RS	152	NAME_CONSTRAINTS_free(ncons);
895cba19 RS	153	GENERAL_SUBTREE_free(sub);
0f113f3e MC	154
	155	return NULL;
	156	}
520b76ff	157
babb3798	158	static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD method, void a,
0f113f3e MC	159	BIO *bp, int ind)
	160	{
	161	NAME_CONSTRAINTS *ncons = a;
	162	do_i2r_name_constraints(method, ncons->permittedSubtrees,
	163	bp, ind, "Permitted");
	164	do_i2r_name_constraints(method, ncons->excludedSubtrees,
	165	bp, ind, "Excluded");
	166	return 1;
	167	}
520b76ff	168
babb3798	169	static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
0f113f3e MC	170	STACK_OF(GENERAL_SUBTREE) *trees,
	171	BIO bp, int ind, char name)
	172	{
	173	GENERAL_SUBTREE *tree;
	174	int i;
	175	if (sk_GENERAL_SUBTREE_num(trees) > 0)
	176	BIO_printf(bp, "%*s%s:\n", ind, "", name);
	177	for (i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) {
	178	tree = sk_GENERAL_SUBTREE_value(trees, i);
	179	BIO_printf(bp, "%*s", ind + 2, "");
	180	if (tree->base->type == GEN_IPADD)
	181	print_nc_ipadd(bp, tree->base->d.ip);
	182	else
	183	GENERAL_NAME_print(bp, tree->base);
	184	BIO_puts(bp, "\n");
	185	}
	186	return 1;
	187	}
520b76ff DSH	188
520b76ff DSH	189	static int print_nc_ipadd(BIO bp, ASN1_OCTET_STRING ip)
0f113f3e MC	190	{
	191	int i, len;
	192	unsigned char *p;
	193	p = ip->data;
	194	len = ip->length;
	195	BIO_puts(bp, "IP:");
	196	if (len == 8) {
	197	BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d",
	198	p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
	199	} else if (len == 32) {
	200	for (i = 0; i < 16; i++) {
	201	BIO_printf(bp, "%X", p[0] << 8 \| p[1]);
	202	p += 2;
	203	if (i == 7)
	204	BIO_puts(bp, "/");
	205	else if (i != 15)
	206	BIO_puts(bp, ":");
	207	}
	208	} else
	209	BIO_printf(bp, "IP Address:<invalid>");
	210	return 1;
	211	}
520b76ff	212
1d97c843 TH	213	/*-
1d97c843 TH	214	* Check a certificate conforms to a specified set of constraints.
e9746e03 DSH	215	* Return values:
	216	* X509_V_OK: All constraints obeyed.
	217	* X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation.
	218	* X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation.
	219	* X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type.
	220	* X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: Unsupported constraint type.
	221	* X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax.
	222	* X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name
e9746e03 DSH	223	*/
	224
	225	int NAME_CONSTRAINTS_check(X509 x, NAME_CONSTRAINTS nc)
0f113f3e MC	226	{
	227	int r, i;
	228	X509_NAME *nm;
e9746e03	229
0f113f3e	230	nm = X509_get_subject_name(x);
e9746e03	231
0f113f3e MC	232	if (X509_NAME_entry_count(nm) > 0) {
	233	GENERAL_NAME gntmp;
	234	gntmp.type = GEN_DIRNAME;
	235	gntmp.d.directoryName = nm;
e9746e03	236
0f113f3e	237	r = nc_match(&gntmp, nc);
e9746e03	238
0f113f3e MC	239	if (r != X509_V_OK)
0f113f3e MC	240	return r;
e9746e03	241
0f113f3e	242	gntmp.type = GEN_EMAIL;
e9746e03	243
0f113f3e	244	/* Process any email address attributes in subject name */
e9746e03	245
0f113f3e MC	246	for (i = -1;;) {
	247	X509_NAME_ENTRY *ne;
	248	i = X509_NAME_get_index_by_NID(nm, NID_pkcs9_emailAddress, i);
	249	if (i == -1)
	250	break;
	251	ne = X509_NAME_get_entry(nm, i);
	252	gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne);
	253	if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING)
	254	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
e9746e03	255
0f113f3e	256	r = nc_match(&gntmp, nc);
e9746e03	257
0f113f3e MC	258	if (r != X509_V_OK)
	259	return r;
	260	}
e9746e03	261
0f113f3e	262	}
e9746e03	263
0f113f3e MC	264	for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++) {
	265	GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i);
	266	r = nc_match(gen, nc);
	267	if (r != X509_V_OK)
	268	return r;
	269	}
e9746e03	270
0f113f3e	271	return X509_V_OK;
e9746e03	272
0f113f3e	273	}
e9746e03 DSH	274
e9746e03 DSH	275	static int nc_match(GENERAL_NAME gen, NAME_CONSTRAINTS nc)
0f113f3e MC	276	{
	277	GENERAL_SUBTREE *sub;
	278	int i, r, match = 0;
	279
	280	/*
	281	* Permitted subtrees: if any subtrees exist of matching the type at
	282	* least one subtree must match.
	283	*/
	284
	285	for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) {
	286	sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
	287	if (gen->type != sub->base->type)
	288	continue;
	289	if (sub->minimum \|\| sub->maximum)
	290	return X509_V_ERR_SUBTREE_MINMAX;
	291	/* If we already have a match don't bother trying any more */
	292	if (match == 2)
	293	continue;
	294	if (match == 0)
	295	match = 1;
	296	r = nc_match_single(gen, sub->base);
	297	if (r == X509_V_OK)
	298	match = 2;
	299	else if (r != X509_V_ERR_PERMITTED_VIOLATION)
	300	return r;
	301	}
	302
	303	if (match == 1)
	304	return X509_V_ERR_PERMITTED_VIOLATION;
	305
	306	/* Excluded subtrees: must not match any of these */
	307
	308	for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++) {
	309	sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i);
	310	if (gen->type != sub->base->type)
	311	continue;
	312	if (sub->minimum \|\| sub->maximum)
	313	return X509_V_ERR_SUBTREE_MINMAX;
	314
	315	r = nc_match_single(gen, sub->base);
	316	if (r == X509_V_OK)
	317	return X509_V_ERR_EXCLUDED_VIOLATION;
	318	else if (r != X509_V_ERR_PERMITTED_VIOLATION)
	319	return r;
	320
	321	}
	322
	323	return X509_V_OK;
	324
	325	}
e9746e03 DSH	326
e9746e03 DSH	327	static int nc_match_single(GENERAL_NAME gen, GENERAL_NAME base)
0f113f3e MC	328	{
	329	switch (base->type) {
	330	case GEN_DIRNAME:
	331	return nc_dn(gen->d.directoryName, base->d.directoryName);
e9746e03	332
0f113f3e MC	333	case GEN_DNS:
0f113f3e MC	334	return nc_dns(gen->d.dNSName, base->d.dNSName);
e9746e03	335
0f113f3e MC	336	case GEN_EMAIL:
0f113f3e MC	337	return nc_email(gen->d.rfc822Name, base->d.rfc822Name);
e9746e03	338
0f113f3e MC	339	case GEN_URI:
	340	return nc_uri(gen->d.uniformResourceIdentifier,
	341	base->d.uniformResourceIdentifier);
e9746e03	342
0f113f3e MC	343	case GEN_IPADD:
0f113f3e MC	344	return nc_ip(gen->d.iPAddress, base->d.iPAddress);
dd36fce0	345
0f113f3e MC	346	default:
	347	return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
	348	}
e9746e03	349
0f113f3e	350	}
e9746e03	351
0f113f3e MC	352	/*
	353	* directoryName name constraint matching. The canonical encoding of
	354	* X509_NAME makes this comparison easy. It is matched if the subtree is a
	355	* subset of the name.
e9746e03 DSH	356	*/
	357
	358	static int nc_dn(X509_NAME nm, X509_NAME base)
0f113f3e MC	359	{
	360	/* Ensure canonical encodings are up to date. */
	361	if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
	362	return X509_V_ERR_OUT_OF_MEM;
	363	if (base->modified && i2d_X509_NAME(base, NULL) < 0)
	364	return X509_V_ERR_OUT_OF_MEM;
	365	if (base->canon_enclen > nm->canon_enclen)
	366	return X509_V_ERR_PERMITTED_VIOLATION;
	367	if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
	368	return X509_V_ERR_PERMITTED_VIOLATION;
	369	return X509_V_OK;
	370	}
e9746e03 DSH	371
e9746e03 DSH	372	static int nc_dns(ASN1_IA5STRING dns, ASN1_IA5STRING base)
0f113f3e MC	373	{
	374	char baseptr = (char )base->data;
	375	char dnsptr = (char )dns->data;
	376	/* Empty matches everything */
	377	if (!*baseptr)
	378	return X509_V_OK;
	379	/*
	380	* Otherwise can add zero or more components on the left so compare RHS
	381	* and if dns is longer and expect '.' as preceding character.
	382	*/
	383	if (dns->length > base->length) {
	384	dnsptr += dns->length - base->length;
	385	if (*baseptr != '.' && dnsptr[-1] != '.')
	386	return X509_V_ERR_PERMITTED_VIOLATION;
	387	}
	388
	389	if (strcasecmp(baseptr, dnsptr))
	390	return X509_V_ERR_PERMITTED_VIOLATION;
	391
	392	return X509_V_OK;
	393
	394	}
e9746e03 DSH	395
e9746e03 DSH	396	static int nc_email(ASN1_IA5STRING eml, ASN1_IA5STRING base)
0f113f3e MC	397	{
	398	const char baseptr = (char )base->data;
	399	const char emlptr = (char )eml->data;
	400
	401	const char *baseat = strchr(baseptr, '@');
	402	const char *emlat = strchr(emlptr, '@');
	403	if (!emlat)
	404	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
	405	/* Special case: inital '.' is RHS match */
	406	if (!baseat && (*baseptr == '.')) {
	407	if (eml->length > base->length) {
	408	emlptr += eml->length - base->length;
	409	if (!strcasecmp(baseptr, emlptr))
	410	return X509_V_OK;
	411	}
	412	return X509_V_ERR_PERMITTED_VIOLATION;
	413	}
	414
	415	/* If we have anything before '@' match local part */
	416
	417	if (baseat) {
	418	if (baseat != baseptr) {
	419	if ((baseat - baseptr) != (emlat - emlptr))
	420	return X509_V_ERR_PERMITTED_VIOLATION;
	421	/* Case sensitive match of local part */
	422	if (strncmp(baseptr, emlptr, emlat - emlptr))
	423	return X509_V_ERR_PERMITTED_VIOLATION;
	424	}
	425	/* Position base after '@' */
	426	baseptr = baseat + 1;
	427	}
	428	emlptr = emlat + 1;
	429	/* Just have hostname left to match: case insensitive */
	430	if (strcasecmp(baseptr, emlptr))
	431	return X509_V_ERR_PERMITTED_VIOLATION;
	432
	433	return X509_V_OK;
	434
	435	}
e9746e03 DSH	436
e9746e03 DSH	437	static int nc_uri(ASN1_IA5STRING uri, ASN1_IA5STRING base)
0f113f3e MC	438	{
	439	const char baseptr = (char )base->data;
	440	const char hostptr = (char )uri->data;
	441	const char *p = strchr(hostptr, ':');
	442	int hostlen;
	443	/* Check for foo:// and skip past it */
	444	if (!p \|\| (p[1] != '/') \|\| (p[2] != '/'))
	445	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
	446	hostptr = p + 3;
	447
	448	/* Determine length of hostname part of URI */
	449
	450	/* Look for a port indicator as end of hostname first */
	451
	452	p = strchr(hostptr, ':');
	453	/* Otherwise look for trailing slash */
	454	if (!p)
	455	p = strchr(hostptr, '/');
	456
	457	if (!p)
	458	hostlen = strlen(hostptr);
	459	else
	460	hostlen = p - hostptr;
	461
	462	if (hostlen == 0)
	463	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
	464
	465	/* Special case: inital '.' is RHS match */
	466	if (*baseptr == '.') {
	467	if (hostlen > base->length) {
	468	p = hostptr + hostlen - base->length;
	469	if (!strncasecmp(p, baseptr, base->length))
	470	return X509_V_OK;
	471	}
	472	return X509_V_ERR_PERMITTED_VIOLATION;
	473	}
	474
	475	if ((base->length != (int)hostlen)
	476	\|\| strncasecmp(hostptr, baseptr, hostlen))
	477	return X509_V_ERR_PERMITTED_VIOLATION;
	478
	479	return X509_V_OK;
	480
	481	}
dd36fce0 LADL	482
dd36fce0 LADL	483	static int nc_ip(ASN1_OCTET_STRING ip, ASN1_OCTET_STRING base)
0f113f3e MC	484	{
	485	int hostlen, baselen, i;
	486	unsigned char hostptr, baseptr, *maskptr;
	487	hostptr = ip->data;
	488	hostlen = ip->length;
	489	baseptr = base->data;
	490	baselen = base->length;
	491
	492	/* Invalid if not IPv4 or IPv6 */
	493	if (!((hostlen == 4) \|\| (hostlen == 16)))
	494	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
	495	if (!((baselen == 8) \|\| (baselen == 32)))
	496	return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
	497
	498	/* Do not match IPv4 with IPv6 */
	499	if (hostlen * 2 != baselen)
	500	return X509_V_ERR_PERMITTED_VIOLATION;
	501
	502	maskptr = base->data + hostlen;
	503
	504	/* Considering possible not aligned base ipAddress */
	505	/* Not checking for wrong mask definition: i.e.: 255.0.255.0 */
	506	for (i = 0; i < hostlen; i++)
	507	if ((hostptr[i] & maskptr[i]) != (baseptr[i] & maskptr[i]))
	508	return X509_V_ERR_PERMITTED_VIOLATION;
	509
	510	return X509_V_OK;
	511
	512	}