[thirdparty/openssl.git] / crypto / x509v3 / v3_purp.c

/* v3_purp.c */
/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
 * project 1999.
 */
/* ====================================================================
 * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/x509v3.h>


static int x509_purpose_get_idx(int id);
void x509v3_cache_extensions(X509 *x);

static int ca_check(X509 *x);
static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca);
static int purpose_smime(X509 *x, int ca);
static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca);
static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca);

static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b);

static X509_PURPOSE xstandard[] = {
{1, check_purpose_ssl_client, "SSL client", NULL},
{2, check_purpose_ssl_server, "SSL server", NULL},
{3, check_purpose_ns_ssl_server, "Netscape SSL server", NULL},
{4, check_purpose_smime_sign, "S/MIME signing", NULL},
{5, check_purpose_smime_encrypt, "S/MIME encryption", NULL},
{6, check_purpose_crl_sign, "CRL signing", NULL},
{-1, NULL, NULL, NULL}
};

IMPLEMENT_STACK_OF(X509_PURPOSE)

static STACK_OF(X509_PURPOSE) *xptable;

static int xp_cmp(X509_PURPOSE **a, X509_PURPOSE **b)
{
	return (*a)->purpose_id - (*b)->purpose_id;
}

int X509_check_purpose(X509 *x, int id, int ca)
{
	int idx;
	X509_PURPOSE *pt;
	if(!(x->ex_flags & EXFLAG_SET)) {
		CRYPTO_w_lock(CRYPTO_LOCK_X509);
		x509v3_cache_extensions(x);
		CRYPTO_w_unlock(CRYPTO_LOCK_X509);
	}
	idx = x509_purpose_get_idx(id);
	if(idx == -1) return -1;
	pt = sk_X509_PURPOSE_value(xptable, idx);
	return pt->check_purpose(pt, x,ca);
}
			
	
static int x509_purpose_get_idx(int id)
{
	X509_PURPOSE tmp;
	tmp.purpose_id = id;
	if(!xptable) return -1;
	return sk_X509_PURPOSE_find(xptable, &tmp);
}

int X509_PURPOSE_add(X509_PURPOSE *xp)
{
	int idx;
	if(!xptable) xptable = sk_X509_PURPOSE_new(xp_cmp);
	idx = x509_purpose_get_idx(xp->purpose_id);
	if(idx != -1) sk_X509_PURPOSE_set(xptable, idx, xp);
	else sk_X509_PURPOSE_push(xptable, xp);
	return 1;
}

void X509_PURPOSE_add_standard(void)
{
	X509_PURPOSE *xp;
	for(xp = xstandard; xp->purpose_name; xp++)
		X509_PURPOSE_add(xp);
}

int X509_PURPOSE_enum(int (*efunc)(X509_PURPOSE *, void *), void *usr)
{
	int i;
	X509_PURPOSE *xp;
	if(!xptable) return 0;
	for(i = 0; i < sk_X509_PURPOSE_num(xptable); i++) {
		xp = sk_X509_PURPOSE_value(xptable, i);
		if(!efunc(xp, usr)) return i;
	}
	return i;
}


int X509_PURPOSE_get_id(X509_PURPOSE *xp)
{
	return xp->purpose_id;
}

char *X509_PURPOSE_get_name(X509_PURPOSE *xp)
{
	return xp->purpose_name;
}

void x509v3_cache_extensions(X509 *x)
{
	BASIC_CONSTRAINTS *bs;
	ASN1_BIT_STRING *usage;
	ASN1_BIT_STRING *ns;
	STACK_OF(ASN1_OBJECT) *extusage;
	int i;
	if(x->ex_flags & EXFLAG_SET) return;
	/* Does subject name match issuer ? */
	if(X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
			 x->ex_flags |= EXFLAG_SS;
	/* V1 should mean no extensions ... */
	if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
	/* Handle basic constraints */
	if((bs=X509V3_X509_get_d2i(x, NID_basic_constraints, NULL, NULL))) {
		if(bs->ca) x->ex_flags |= EXFLAG_CA;
		if(bs->pathlen) {
			if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
						|| !bs->ca) {
				x->ex_flags |= EXFLAG_INVALID;
				x->ex_pathlen = 0;
			} else x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
		} else x->ex_pathlen = -1;
		BASIC_CONSTRAINTS_free(bs);
		x->ex_flags |= EXFLAG_BCONS;
	}
	/* Handle key usage */
	if((usage=X509V3_X509_get_d2i(x, NID_key_usage, NULL, NULL))) {
		if(usage->length > 0) {
			x->ex_kusage = usage->data[0];
			if(usage->length > 1) 
				x->ex_kusage |= usage->data[1] << 8;
		} else x->ex_kusage = 0;
		x->ex_flags |= EXFLAG_KUSAGE;
		ASN1_BIT_STRING_free(usage);
	}
	x->ex_xkusage = 0;
	if((extusage=X509V3_X509_get_d2i(x, NID_ext_key_usage, NULL, NULL))) {
		x->ex_flags |= EXFLAG_XKUSAGE;
		for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
			switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
				case NID_server_auth:
				x->ex_xkusage |= XKU_SSL_SERVER;
				break;

				case NID_client_auth:
				x->ex_xkusage |= XKU_SSL_CLIENT;
				break;

				case NID_email_protect:
				x->ex_xkusage |= XKU_SMIME;
				break;

				case NID_code_sign:
				x->ex_xkusage |= XKU_CODE_SIGN;
				break;

				case NID_ms_sgc:
				case NID_ns_sgc:
				x->ex_xkusage |= XKU_SGC;
			}
		}
		sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
	}

	if((ns=X509V3_X509_get_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
		if(ns->length > 0) x->ex_nscert = ns->data[0];
		else x->ex_nscert = 0;
		x->ex_flags |= EXFLAG_NSCERT;
		ASN1_BIT_STRING_free(ns);
	}
	x->ex_flags |= EXFLAG_SET;
}

/* CA checks common to all purposes
 * return codes:
 * 0 not a CA
 * 1 is a CA
 * 2 basicConstraints absent so "maybe" a CA
 * 3 basicConstraints absent but self signed V1.
 */

#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
#define ku_reject(x, usage) \
	(((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
#define xku_reject(x, usage) \
	(((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
#define ns_reject(x, usage) \
	(((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))

static int ca_check(X509 *x)
{
	/* keyUsage if present should allow cert signing */
	if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
	if(x->ex_flags & EXFLAG_BCONS) {
		if(x->ex_flags & EXFLAG_CA) return 1;
		/* If basicConstraints says not a CA then say so */
		else return 0;
	} else {
		if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
		else return 2;
	}
}


static int check_purpose_ssl_client(X509_PURPOSE *xp, X509 *x, int ca)
{
	if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
	if(ca) {
		int ca_ret;
		ca_ret = ca_check(x);
		if(!ca_ret) return 0;
		/* check nsCertType if present */
		if(x->ex_flags & EXFLAG_NSCERT) {
			if(x->ex_nscert & NS_SSL_CA) return ca_ret;
			return 0;
		}
		if(ca_ret != 2) return ca_ret;
		else return 0;
	}
	/* We need to do digital signatures with it */
	if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
	/* nsCertType if present should allow SSL client use */	
	if(ns_reject(x, NS_SSL_CLIENT)) return 0;
	return 1;
}

static int check_purpose_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
{
	if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
	/* Otherwise same as SSL client for a CA */
	if(ca) return check_purpose_ssl_client(xp, x, 1);

	if(ns_reject(x, NS_SSL_SERVER)) return 0;
	/* Now as for keyUsage: we'll at least need to sign OR encipher */
	if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0;
	
	return 1;

}

static int check_purpose_ns_ssl_server(X509_PURPOSE *xp, X509 *x, int ca)
{
	int ret;
	ret = check_purpose_ssl_server(xp, x, ca);
	if(!ret || ca) return ret;
	/* We need to encipher or Netscape complains */
	if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
	return ret;
}

/* common S/MIME checks */
static int purpose_smime(X509 *x, int ca)
{
	if(xku_reject(x,XKU_SMIME)) return 0;
	if(ca) {
		int ca_ret;
		ca_ret = ca_check(x);
		if(!ca_ret) return 0;
		/* check nsCertType if present */
		if(x->ex_flags & EXFLAG_NSCERT) {
			if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
			return 0;
		}
		if(ca_ret != 2) return ca_ret;
		else return 0;
	}
	if(x->ex_flags & EXFLAG_NSCERT) {
		if(x->ex_nscert & NS_SMIME) return 1;
		/* Workaround for some buggy certificates */
		if(x->ex_nscert & NS_SSL_CLIENT) return 2;
		return 0;
	}
	return 1;
}

static int check_purpose_smime_sign(X509_PURPOSE *xp, X509 *x, int ca)
{
	int ret;
	ret = purpose_smime(x, ca);
	if(!ret || ca) return ret;
	if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
	return ret;
}

static int check_purpose_smime_encrypt(X509_PURPOSE *xp, X509 *x, int ca)
{
	int ret;
	ret = purpose_smime(x, ca);
	if(!ret || ca) return ret;
	if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
	return ret;
}

static int check_purpose_crl_sign(X509_PURPOSE *xp, X509 *x, int ca)
{
	if(ca) {
		int ca_ret;
		if((ca_ret = ca_check(x)) != 2) return ca_ret;
		else return 0;
	}
	if(ku_reject(x, KU_CRL_SIGN)) return 0;
	return 1;
}
Commit	Line	Data
673b102c DSH	1	/* v3_purp.c */
	2	/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
	3	* project 1999.
	4	*/
	5	/* ====================================================================
	6	* Copyright (c) 1999 The OpenSSL Project. All rights reserved.
	7	*
	8	* Redistribution and use in source and binary forms, with or without
	9	* modification, are permitted provided that the following conditions
	10	* are met:
	11	*
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	*
	15	* 2. Redistributions in binary form must reproduce the above copyright
	16	* notice, this list of conditions and the following disclaimer in
	17	* the documentation and/or other materials provided with the
	18	* distribution.
	19	*
	20	* 3. All advertising materials mentioning features or use of this
	21	* software must display the following acknowledgment:
	22	* "This product includes software developed by the OpenSSL Project
	23	* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
	24	*
	25	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	26	* endorse or promote products derived from this software without
	27	* prior written permission. For written permission, please contact
	28	* licensing@OpenSSL.org.
	29	*
	30	* 5. Products derived from this software may not be called "OpenSSL"
	31	* nor may "OpenSSL" appear in their names without prior written
	32	* permission of the OpenSSL Project.
	33	*
	34	* 6. Redistributions of any form whatsoever must retain the following
	35	* acknowledgment:
	36	* "This product includes software developed by the OpenSSL Project
	37	* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
	38	*
	39	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	40	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	41	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	42	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	43	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	44	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	45	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	46	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	47	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	48	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	49	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	50	* OF THE POSSIBILITY OF SUCH DAMAGE.
	51	* ====================================================================
	52	*
	53	* This product includes cryptographic software written by Eric Young
	54	* (eay@cryptsoft.com). This product includes software written by Tim
	55	* Hudson (tjh@cryptsoft.com).
	56	*
	57	*/
	58
	59	#include <stdio.h>
	60	#include "cryptlib.h"
	61	#include <openssl/x509v3.h>
	62
	63
	64	static int x509_purpose_get_idx(int id);
65	void x509v3_cache_extensions(X509 *x);
66
67	static int ca_check(X509 *x);
68	static int check_purpose_ssl_client(X509_PURPOSE xp, X509 x, int ca);
69	static int check_purpose_ssl_server(X509_PURPOSE xp, X509 x, int ca);
70	static int check_purpose_ns_ssl_server(X509_PURPOSE xp, X509 x, int ca);
71	static int purpose_smime(X509 *x, int ca);
72	static int check_purpose_smime_sign(X509_PURPOSE xp, X509 x, int ca);
73	static int check_purpose_smime_encrypt(X509_PURPOSE xp, X509 x, int ca);
74	static int check_purpose_crl_sign(X509_PURPOSE xp, X509 x, int ca);
75
76	static int xp_cmp(X509_PURPOSE a, X509_PURPOSE b);
77
78	static X509_PURPOSE xstandard[] = {
79	{1, check_purpose_ssl_client, "SSL client", NULL},
80	{2, check_purpose_ssl_server, "SSL server", NULL},
81	{3, check_purpose_ns_ssl_server, "Netscape SSL server", NULL},
82	{4, check_purpose_smime_sign, "S/MIME signing", NULL},
83	{5, check_purpose_smime_encrypt, "S/MIME encryption", NULL},
84	{6, check_purpose_crl_sign, "CRL signing", NULL},
85	{-1, NULL, NULL, NULL}
86	};
87
88	IMPLEMENT_STACK_OF(X509_PURPOSE)
89
90	static STACK_OF(X509_PURPOSE) *xptable;
91
92	static int xp_cmp(X509_PURPOSE a, X509_PURPOSE b)
93	{
94	return (a)->purpose_id - (b)->purpose_id;
95	}
96
97	int X509_check_purpose(X509 *x, int id, int ca)
98	{
99	int idx;
100	X509_PURPOSE *pt;
101	if(!(x->ex_flags & EXFLAG_SET)) {
102	CRYPTO_w_lock(CRYPTO_LOCK_X509);
103	x509v3_cache_extensions(x);
104	CRYPTO_w_unlock(CRYPTO_LOCK_X509);
105	}
106	idx = x509_purpose_get_idx(id);
107	if(idx == -1) return -1;
108	pt = sk_X509_PURPOSE_value(xptable, idx);
109	return pt->check_purpose(pt, x,ca);
110	}
111
112
113
114
115	static int x509_purpose_get_idx(int id)
116	{
117	X509_PURPOSE tmp;
118	tmp.purpose_id = id;
119	if(!xptable) return -1;
120	return sk_X509_PURPOSE_find(xptable, &tmp);
121	}
122
123	int X509_PURPOSE_add(X509_PURPOSE *xp)
124	{
125	int idx;
126	if(!xptable) xptable = sk_X509_PURPOSE_new(xp_cmp);
127	idx = x509_purpose_get_idx(xp->purpose_id);
128	if(idx != -1) sk_X509_PURPOSE_set(xptable, idx, xp);
129	else sk_X509_PURPOSE_push(xptable, xp);
130	return 1;
131	}
132
133	void X509_PURPOSE_add_standard(void)
134	{
135	X509_PURPOSE *xp;
136	for(xp = xstandard; xp->purpose_name; xp++)
137	X509_PURPOSE_add(xp);
138	}
139
140	int X509_PURPOSE_enum(int (efunc)(X509_PURPOSE , void ), void usr)
141	{
142	int i;
143	X509_PURPOSE *xp;
144	if(!xptable) return 0;
145	for(i = 0; i < sk_X509_PURPOSE_num(xptable); i++) {
146	xp = sk_X509_PURPOSE_value(xptable, i);
147	if(!efunc(xp, usr)) return i;
148	}
149	return i;
150	}
151
152
153	int X509_PURPOSE_get_id(X509_PURPOSE *xp)
154	{
155	return xp->purpose_id;
156	}
157
158	char X509_PURPOSE_get_name(X509_PURPOSE xp)
159	{
160	return xp->purpose_name;
161	}
162
163	void x509v3_cache_extensions(X509 *x)
164	{
165	BASIC_CONSTRAINTS *bs;
166	ASN1_BIT_STRING *usage;
167	ASN1_BIT_STRING *ns;
168	STACK_OF(ASN1_OBJECT) *extusage;
169	int i;
170	if(x->ex_flags & EXFLAG_SET) return;
171	/* Does subject name match issuer ? */
172	if(X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
173	x->ex_flags \|= EXFLAG_SS;
174	/* V1 should mean no extensions ... */
175	if(!X509_get_version(x)) x->ex_flags \|= EXFLAG_V1;
176	/* Handle basic constraints */
177	if((bs=X509V3_X509_get_d2i(x, NID_basic_constraints, NULL, NULL))) {
178	if(bs->ca) x->ex_flags \|= EXFLAG_CA;
179	if(bs->pathlen) {
180	if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
181	\|\| !bs->ca) {
182	x->ex_flags \|= EXFLAG_INVALID;
183	x->ex_pathlen = 0;
184	} else x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
185	} else x->ex_pathlen = -1;
186	BASIC_CONSTRAINTS_free(bs);
187	x->ex_flags \|= EXFLAG_BCONS;
188	}
189	/* Handle key usage */
190	if((usage=X509V3_X509_get_d2i(x, NID_key_usage, NULL, NULL))) {
191	if(usage->length > 0) {
192	x->ex_kusage = usage->data[0];
193	if(usage->length > 1)
194	x->ex_kusage \|= usage->data[1] << 8;
195	} else x->ex_kusage = 0;
196	x->ex_flags \|= EXFLAG_KUSAGE;
197	ASN1_BIT_STRING_free(usage);
198	}
199	x->ex_xkusage = 0;
200	if((extusage=X509V3_X509_get_d2i(x, NID_ext_key_usage, NULL, NULL))) {
201	x->ex_flags \|= EXFLAG_XKUSAGE;
202	for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
203	switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
204	case NID_server_auth:
205	x->ex_xkusage \|= XKU_SSL_SERVER;
206	break;
207
208	case NID_client_auth:
209	x->ex_xkusage \|= XKU_SSL_CLIENT;
210	break;
211
212	case NID_email_protect:
213	x->ex_xkusage \|= XKU_SMIME;
214	break;
215
216	case NID_code_sign:
217	x->ex_xkusage \|= XKU_CODE_SIGN;
218	break;
219
220	case NID_ms_sgc:
221	case NID_ns_sgc:
222	x->ex_xkusage \|= XKU_SGC;
223	}
224	}
225	sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
226	}
227
228	if((ns=X509V3_X509_get_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
229	if(ns->length > 0) x->ex_nscert = ns->data[0];
230	else x->ex_nscert = 0;
231	x->ex_flags \|= EXFLAG_NSCERT;
232	ASN1_BIT_STRING_free(ns);
233	}
234	x->ex_flags \|= EXFLAG_SET;
235	}
236
237	/* CA checks common to all purposes
238	* return codes:
239	* 0 not a CA
240	* 1 is a CA
241	* 2 basicConstraints absent so "maybe" a CA
242	* 3 basicConstraints absent but self signed V1.
243	*/
244
245	#define V1_ROOT (EXFLAG_V1\|EXFLAG_SS)
246	#define ku_reject(x, usage) \
247	(((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
248	#define xku_reject(x, usage) \
249	(((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
250	#define ns_reject(x, usage) \
251	(((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
252
253	static int ca_check(X509 *x)
254	{
255	/* keyUsage if present should allow cert signing */
256	if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
257	if(x->ex_flags & EXFLAG_BCONS) {
258	if(x->ex_flags & EXFLAG_CA) return 1;
259	/* If basicConstraints says not a CA then say so */
260	else return 0;
261	} else {
262	if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
263	else return 2;
264	}
265	}
266
267
268	static int check_purpose_ssl_client(X509_PURPOSE xp, X509 x, int ca)
269	{
270	if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
271	if(ca) {
272	int ca_ret;
273	ca_ret = ca_check(x);
274	if(!ca_ret) return 0;
275	/* check nsCertType if present */
276	if(x->ex_flags & EXFLAG_NSCERT) {
277	if(x->ex_nscert & NS_SSL_CA) return ca_ret;
278	return 0;
279	}
280	if(ca_ret != 2) return ca_ret;
281	else return 0;
282	}
283	/* We need to do digital signatures with it */
284	if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
285	/* nsCertType if present should allow SSL client use */
286	if(ns_reject(x, NS_SSL_CLIENT)) return 0;
287	return 1;
288	}
289
290	static int check_purpose_ssl_server(X509_PURPOSE xp, X509 x, int ca)
291	{
292	if(xku_reject(x,XKU_SSL_SERVER\|XKU_SGC)) return 0;
293	/* Otherwise same as SSL client for a CA */
294	if(ca) return check_purpose_ssl_client(xp, x, 1);
295
296	if(ns_reject(x, NS_SSL_SERVER)) return 0;
297	/* Now as for keyUsage: we'll at least need to sign OR encipher */
298	if(ku_reject(x, KU_DIGITAL_SIGNATURE\|KU_KEY_ENCIPHERMENT)) return 0;
299
300	return 1;
301
302	}
303
304	static int check_purpose_ns_ssl_server(X509_PURPOSE xp, X509 x, int ca)
305	{
306	int ret;
307	ret = check_purpose_ssl_server(xp, x, ca);
308	if(!ret \|\| ca) return ret;
309	/* We need to encipher or Netscape complains */
310	if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
311	return ret;
312	}
313
314	/* common S/MIME checks */
315	static int purpose_smime(X509 *x, int ca)
316	{
317	if(xku_reject(x,XKU_SMIME)) return 0;
318	if(ca) {
319	int ca_ret;
320	ca_ret = ca_check(x);
321	if(!ca_ret) return 0;
322	/* check nsCertType if present */
323	if(x->ex_flags & EXFLAG_NSCERT) {
324	if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
325	return 0;
326	}
327	if(ca_ret != 2) return ca_ret;
328	else return 0;
329	}
330	if(x->ex_flags & EXFLAG_NSCERT) {
331	if(x->ex_nscert & NS_SMIME) return 1;
332	/* Workaround for some buggy certificates */
333	if(x->ex_nscert & NS_SSL_CLIENT) return 2;
334	return 0;
335	}
336	return 1;
337	}
338
339	static int check_purpose_smime_sign(X509_PURPOSE xp, X509 x, int ca)
340	{
341	int ret;
342	ret = purpose_smime(x, ca);
343	if(!ret \|\| ca) return ret;
344	if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
345	return ret;
346	}
347
348	static int check_purpose_smime_encrypt(X509_PURPOSE xp, X509 x, int ca)
349	{
350	int ret;
351	ret = purpose_smime(x, ca);
352	if(!ret \|\| ca) return ret;
353	if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
354	return ret;
355	}
356
357	static int check_purpose_crl_sign(X509_PURPOSE xp, X509 x, int ca)
358	{
359	if(ca) {
360	int ca_ret;
361	if((ca_ret = ca_check(x)) != 2) return ca_ret;
362	else return 0;
363	}
364	if(ku_reject(x, KU_CRL_SIGN)) return 0;
365	return 1;
366	}