crypto/x509/v3_lib.c

   1 /*
   2  * Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /* X509 v3 extension utilities */
  11
  12 #include <stdio.h>
  13 #include "internal/cryptlib.h"
  14 #include <openssl/conf.h>
  15 #include <openssl/x509v3.h>
  16
  17 #include "ext_dat.h"
  18
  19 static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
  20
  21 static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  22                    const X509V3_EXT_METHOD *const *b);
  23 static void ext_list_free(X509V3_EXT_METHOD *ext);
  24
  25 int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
  26 {
  27     if (ext_list == NULL
  28         && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) {
  29         X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
  30         return 0;
  31     }
  32     if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
  33         X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
  34         return 0;
  35     }
  36     return 1;
  37 }
  38
  39 static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  40                    const X509V3_EXT_METHOD *const *b)
  41 {
  42     return ((*a)->ext_nid - (*b)->ext_nid);
  43 }
  44
  45 DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  46                            const X509V3_EXT_METHOD *, ext);
  47 IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  48                              const X509V3_EXT_METHOD *, ext);
  49
  50 #include "standard_exts.h"
  51
  52 const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
  53 {
  54     X509V3_EXT_METHOD tmp;
  55     const X509V3_EXT_METHOD *t = &tmp, *const *ret;
  56     int idx;
  57
  58     if (nid < 0)
  59         return NULL;
  60     tmp.ext_nid = nid;
  61     ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
  62     if (ret)
  63         return *ret;
  64     if (!ext_list)
  65         return NULL;
  66     idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
  67     return sk_X509V3_EXT_METHOD_value(ext_list, idx);
  68 }
  69
  70 const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
  71 {
  72     int nid;
  73     if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef)
  74         return NULL;
  75     return X509V3_EXT_get_nid(nid);
  76 }
  77
  78 int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
  79 {
  80     for (; extlist->ext_nid != -1; extlist++)
  81         if (!X509V3_EXT_add(extlist))
  82             return 0;
  83     return 1;
  84 }
  85
  86 int X509V3_EXT_add_alias(int nid_to, int nid_from)
  87 {
  88     const X509V3_EXT_METHOD *ext;
  89     X509V3_EXT_METHOD *tmpext;
  90
  91     if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) {
  92         X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS, X509V3_R_EXTENSION_NOT_FOUND);
  93         return 0;
  94     }
  95     if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL) {
  96         X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS, ERR_R_MALLOC_FAILURE);
  97         return 0;
  98     }
  99     *tmpext = *ext;
 100     tmpext->ext_nid = nid_to;
 101     tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
 102     return X509V3_EXT_add(tmpext);
 103 }
 104
 105 void X509V3_EXT_cleanup(void)
 106 {
 107     sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
 108     ext_list = NULL;
 109 }
 110
 111 static void ext_list_free(X509V3_EXT_METHOD *ext)
 112 {
 113     if (ext->ext_flags & X509V3_EXT_DYNAMIC)
 114         OPENSSL_free(ext);
 115 }
 116
 117 /*
 118  * Legacy function: we don't need to add standard extensions any more because
 119  * they are now kept in ext_dat.h.
 120  */
 121
 122 int X509V3_add_standard_extensions(void)
 123 {
 124     return 1;
 125 }
 126
 127 /* Return an extension internal structure */
 128
 129 void *X509V3_EXT_d2i(X509_EXTENSION *ext)
 130 {
 131     const X509V3_EXT_METHOD *method;
 132     const unsigned char *p;
 133     ASN1_STRING *extvalue;
 134     int extlen;
 135
 136     if ((method = X509V3_EXT_get(ext)) == NULL)
 137         return NULL;
 138     extvalue = X509_EXTENSION_get_data(ext);
 139     p = ASN1_STRING_get0_data(extvalue);
 140     extlen = ASN1_STRING_length(extvalue);
 141     if (method->it)
 142         return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it));
 143     return method->d2i(NULL, &p, extlen);
 144 }
 145
 146 /*-
 147  * Get critical flag and decoded version of extension from a NID.
 148  * The "idx" variable returns the last found extension and can
 149  * be used to retrieve multiple extensions of the same NID.
 150  * However multiple extensions with the same NID is usually
 151  * due to a badly encoded certificate so if idx is NULL we
 152  * choke if multiple extensions exist.
 153  * The "crit" variable is set to the critical value.
 154  * The return value is the decoded extension or NULL on
 155  * error. The actual error can have several different causes,
 156  * the value of *crit reflects the cause:
 157  * >= 0, extension found but not decoded (reflects critical value).
 158  * -1 extension not found.
 159  * -2 extension occurs more than once.
 160  */
 161
 162 void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
 163                      int *idx)
 164 {
 165     int lastpos, i;
 166     X509_EXTENSION *ex, *found_ex = NULL;
 167
 168     if (!x) {
 169         if (idx)
 170             *idx = -1;
 171         if (crit)
 172             *crit = -1;
 173         return NULL;
 174     }
 175     if (idx)
 176         lastpos = *idx + 1;
 177     else
 178         lastpos = 0;
 179     if (lastpos < 0)
 180         lastpos = 0;
 181     for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
 182         ex = sk_X509_EXTENSION_value(x, i);
 183         if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) {
 184             if (idx) {
 185                 *idx = i;
 186                 found_ex = ex;
 187                 break;
 188             } else if (found_ex) {
 189                 /* Found more than one */
 190                 if (crit)
 191                     *crit = -2;
 192                 return NULL;
 193             }
 194             found_ex = ex;
 195         }
 196     }
 197     if (found_ex) {
 198         /* Found it */
 199         if (crit)
 200             *crit = X509_EXTENSION_get_critical(found_ex);
 201         return X509V3_EXT_d2i(found_ex);
 202     }
 203
 204     /* Extension not found */
 205     if (idx)
 206         *idx = -1;
 207     if (crit)
 208         *crit = -1;
 209     return NULL;
 210 }
 211
 212 /*
 213  * This function is a general extension append, replace and delete utility.
 214  * The precise operation is governed by the 'flags' value. The 'crit' and
 215  * 'value' arguments (if relevant) are the extensions internal structure.
 216  */
 217
 218 int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
 219                     int crit, unsigned long flags)
 220 {
 221     int errcode, extidx = -1;
 222     X509_EXTENSION *ext = NULL, *extmp;
 223     STACK_OF(X509_EXTENSION) *ret = NULL;
 224     unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
 225
 226     /*
 227      * If appending we don't care if it exists, otherwise look for existing
 228      * extension.
 229      */
 230     if (ext_op != X509V3_ADD_APPEND)
 231         extidx = X509v3_get_ext_by_NID(*x, nid, -1);
 232
 233     /* See if extension exists */
 234     if (extidx >= 0) {
 235         /* If keep existing, nothing to do */
 236         if (ext_op == X509V3_ADD_KEEP_EXISTING)
 237             return 1;
 238         /* If default then its an error */
 239         if (ext_op == X509V3_ADD_DEFAULT) {
 240             errcode = X509V3_R_EXTENSION_EXISTS;
 241             goto err;
 242         }
 243         /* If delete, just delete it */
 244         if (ext_op == X509V3_ADD_DELETE) {
 245             if (!sk_X509_EXTENSION_delete(*x, extidx))
 246                 return -1;
 247             return 1;
 248         }
 249     } else {
 250         /*
 251          * If replace existing or delete, error since extension must exist
 252          */
 253         if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
 254             (ext_op == X509V3_ADD_DELETE)) {
 255             errcode = X509V3_R_EXTENSION_NOT_FOUND;
 256             goto err;
 257         }
 258     }
 259
 260     /*
 261      * If we get this far then we have to create an extension: could have
 262      * some flags for alternative encoding schemes...
 263      */
 264
 265     ext = X509V3_EXT_i2d(nid, crit, value);
 266
 267     if (!ext) {
 268         X509V3err(X509V3_F_X509V3_ADD1_I2D,
 269                   X509V3_R_ERROR_CREATING_EXTENSION);
 270         return 0;
 271     }
 272
 273     /* If extension exists replace it.. */
 274     if (extidx >= 0) {
 275         extmp = sk_X509_EXTENSION_value(*x, extidx);
 276         X509_EXTENSION_free(extmp);
 277         if (!sk_X509_EXTENSION_set(*x, extidx, ext))
 278             return -1;
 279         return 1;
 280     }
 281
 282     ret = *x;
 283     if (*x == NULL
 284         && (ret = sk_X509_EXTENSION_new_null()) == NULL)
 285         goto m_fail;
 286     if (!sk_X509_EXTENSION_push(ret, ext))
 287         goto m_fail;
 288
 289     *x = ret;
 290     return 1;
 291
 292  m_fail:
 293     /* X509V3err(X509V3_F_X509V3_ADD1_I2D, ERR_R_MALLOC_FAILURE); */
 294     if (ret != *x)
 295         sk_X509_EXTENSION_free(ret);
 296     X509_EXTENSION_free(ext);
 297     return -1;
 298
 299  err:
 300     if (!(flags & X509V3_ADD_SILENT))
 301         X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode);
 302     return 0;
 303 }