2 * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include "crypto/x509.h"
13 #include <openssl/conf.h>
14 #include <openssl/x509v3.h>
15 #include <openssl/bio.h>
18 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
20 STACK_OF(CONF_VALUE
) *nval
);
21 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
23 STACK_OF(CONF_VALUE
) *nval
);
24 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
);
25 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
);
26 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
27 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
29 const X509V3_EXT_METHOD ossl_v3_alt
[3] = {
30 {NID_subject_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
33 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
34 (X509V3_EXT_V2I
)v2i_subject_alt
,
37 {NID_issuer_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
40 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
41 (X509V3_EXT_V2I
)v2i_issuer_alt
,
44 {NID_certificate_issuer
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
47 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
48 NULL
, NULL
, NULL
, NULL
},
51 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD
*method
,
53 STACK_OF(CONF_VALUE
) *ret
)
57 STACK_OF(CONF_VALUE
) *tmpret
= NULL
, *origret
= ret
;
59 for (i
= 0; i
< sk_GENERAL_NAME_num(gens
); i
++) {
60 gen
= sk_GENERAL_NAME_value(gens
, i
);
62 * i2v_GENERAL_NAME allocates ret if it is NULL. If something goes
63 * wrong we need to free the stack - but only if it was empty when we
64 * originally entered this function.
66 tmpret
= i2v_GENERAL_NAME(method
, gen
, ret
);
69 sk_CONF_VALUE_pop_free(ret
, X509V3_conf_free
);
75 return sk_CONF_VALUE_new_null();
79 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAME(X509V3_EXT_METHOD
*method
,
81 STACK_OF(CONF_VALUE
) *ret
)
84 char oline
[256], *tmp
;
88 switch (OBJ_obj2nid(gen
->d
.otherName
->type_id
)) {
89 case NID_id_on_SmtpUTF8Mailbox
:
90 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
91 || !x509v3_add_len_value_uchar("othername: SmtpUTF8Mailbox:",
92 gen
->d
.otherName
->value
->value
.utf8string
->data
,
93 gen
->d
.otherName
->value
->value
.utf8string
->length
,
98 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
99 || !x509v3_add_len_value_uchar("othername: XmppAddr:",
100 gen
->d
.otherName
->value
->value
.utf8string
->data
,
101 gen
->d
.otherName
->value
->value
.utf8string
->length
,
106 if (gen
->d
.otherName
->value
->type
!= V_ASN1_IA5STRING
107 || !x509v3_add_len_value_uchar("othername: SRVName:",
108 gen
->d
.otherName
->value
->value
.ia5string
->data
,
109 gen
->d
.otherName
->value
->value
.ia5string
->length
,
114 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
115 || !x509v3_add_len_value_uchar("othername: UPN:",
116 gen
->d
.otherName
->value
->value
.utf8string
->data
,
117 gen
->d
.otherName
->value
->value
.utf8string
->length
,
122 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
123 || !x509v3_add_len_value_uchar("othername: NAIRealm:",
124 gen
->d
.otherName
->value
->value
.utf8string
->data
,
125 gen
->d
.otherName
->value
->value
.utf8string
->length
,
130 if (OBJ_obj2txt(oline
, sizeof(oline
), gen
->d
.otherName
->type_id
, 0) > 0)
131 BIO_snprintf(othername
, sizeof(othername
), "othername: %s:",
134 OPENSSL_strlcpy(othername
, "othername:", sizeof(othername
));
136 /* check if the value is something printable */
137 if (gen
->d
.otherName
->value
->type
== V_ASN1_IA5STRING
) {
138 if (x509v3_add_len_value_uchar(othername
,
139 gen
->d
.otherName
->value
->value
.ia5string
->data
,
140 gen
->d
.otherName
->value
->value
.ia5string
->length
,
144 if (gen
->d
.otherName
->value
->type
== V_ASN1_UTF8STRING
) {
145 if (x509v3_add_len_value_uchar(othername
,
146 gen
->d
.otherName
->value
->value
.utf8string
->data
,
147 gen
->d
.otherName
->value
->value
.utf8string
->length
,
151 if (!X509V3_add_value(othername
, "<unsupported>", &ret
))
158 if (!X509V3_add_value("X400Name", "<unsupported>", &ret
))
163 if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret
))
168 if (!x509v3_add_len_value_uchar("email", gen
->d
.ia5
->data
,
169 gen
->d
.ia5
->length
, &ret
))
174 if (!x509v3_add_len_value_uchar("DNS", gen
->d
.ia5
->data
,
175 gen
->d
.ia5
->length
, &ret
))
180 if (!x509v3_add_len_value_uchar("URI", gen
->d
.ia5
->data
,
181 gen
->d
.ia5
->length
, &ret
))
186 if (X509_NAME_oneline(gen
->d
.dirn
, oline
, sizeof(oline
)) == NULL
187 || !X509V3_add_value("DirName", oline
, &ret
))
192 tmp
= ossl_ipaddr_to_asc(gen
->d
.ip
->data
, gen
->d
.ip
->length
);
193 if (tmp
== NULL
|| !X509V3_add_value("IP Address", tmp
, &ret
))
199 i2t_ASN1_OBJECT(oline
, 256, gen
->d
.rid
);
200 if (!X509V3_add_value("Registered ID", oline
, &ret
))
207 int GENERAL_NAME_print(BIO
*out
, GENERAL_NAME
*gen
)
214 nid
= OBJ_obj2nid(gen
->d
.otherName
->type_id
);
215 /* Validate the types are as we expect before we use them */
216 if ((nid
== NID_SRVName
217 && gen
->d
.otherName
->value
->type
!= V_ASN1_IA5STRING
)
218 || (nid
!= NID_SRVName
219 && gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
)) {
220 BIO_printf(out
, "othername:<unsupported>");
225 case NID_id_on_SmtpUTF8Mailbox
:
226 BIO_printf(out
, "othername:SmtpUTF8Mailbox:%.*s",
227 gen
->d
.otherName
->value
->value
.utf8string
->length
,
228 gen
->d
.otherName
->value
->value
.utf8string
->data
);
231 BIO_printf(out
, "othername:XmppAddr:%.*s",
232 gen
->d
.otherName
->value
->value
.utf8string
->length
,
233 gen
->d
.otherName
->value
->value
.utf8string
->data
);
236 BIO_printf(out
, "othername:SRVName:%.*s",
237 gen
->d
.otherName
->value
->value
.ia5string
->length
,
238 gen
->d
.otherName
->value
->value
.ia5string
->data
);
241 BIO_printf(out
, "othername:UPN:%.*s",
242 gen
->d
.otherName
->value
->value
.utf8string
->length
,
243 gen
->d
.otherName
->value
->value
.utf8string
->data
);
246 BIO_printf(out
, "othername:NAIRealm:%.*s",
247 gen
->d
.otherName
->value
->value
.utf8string
->length
,
248 gen
->d
.otherName
->value
->value
.utf8string
->data
);
251 BIO_printf(out
, "othername:<unsupported>");
257 BIO_printf(out
, "X400Name:<unsupported>");
261 /* Maybe fix this: it is supported now */
262 BIO_printf(out
, "EdiPartyName:<unsupported>");
266 BIO_printf(out
, "email:");
267 ASN1_STRING_print(out
, gen
->d
.ia5
);
271 BIO_printf(out
, "DNS:");
272 ASN1_STRING_print(out
, gen
->d
.ia5
);
276 BIO_printf(out
, "URI:");
277 ASN1_STRING_print(out
, gen
->d
.ia5
);
281 BIO_printf(out
, "DirName:");
282 X509_NAME_print_ex(out
, gen
->d
.dirn
, 0, XN_FLAG_ONELINE
);
286 tmp
= ossl_ipaddr_to_asc(gen
->d
.ip
->data
, gen
->d
.ip
->length
);
289 BIO_printf(out
, "IP Address:%s", tmp
);
294 BIO_printf(out
, "Registered ID:");
295 i2a_ASN1_OBJECT(out
, gen
->d
.rid
);
301 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
303 STACK_OF(CONF_VALUE
) *nval
)
305 const int num
= sk_CONF_VALUE_num(nval
);
306 GENERAL_NAMES
*gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
310 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
311 sk_GENERAL_NAME_free(gens
);
314 for (i
= 0; i
< num
; i
++) {
315 CONF_VALUE
*cnf
= sk_CONF_VALUE_value(nval
, i
);
317 if (!ossl_v3_name_cmp(cnf
->name
, "issuer")
318 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
319 if (!copy_issuer(ctx
, gens
))
322 GENERAL_NAME
*gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
);
326 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
331 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
335 /* Append subject altname of issuer to issuer alt name of subject */
337 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
)
344 if (ctx
!= NULL
&& (ctx
->flags
& X509V3_CTX_TEST
) != 0)
346 if (!ctx
|| !ctx
->issuer_cert
) {
347 ERR_raise(ERR_LIB_X509V3
, X509V3_R_NO_ISSUER_DETAILS
);
350 i
= X509_get_ext_by_NID(ctx
->issuer_cert
, NID_subject_alt_name
, -1);
353 if ((ext
= X509_get_ext(ctx
->issuer_cert
, i
)) == NULL
354 || (ialt
= X509V3_EXT_d2i(ext
)) == NULL
) {
355 ERR_raise(ERR_LIB_X509V3
, X509V3_R_ISSUER_DECODE_ERROR
);
359 num
= sk_GENERAL_NAME_num(ialt
);
360 if (!sk_GENERAL_NAME_reserve(gens
, num
)) {
361 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
365 for (i
= 0; i
< num
; i
++) {
366 gen
= sk_GENERAL_NAME_value(ialt
, i
);
367 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
369 sk_GENERAL_NAME_free(ialt
);
378 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
380 STACK_OF(CONF_VALUE
) *nval
)
384 const int num
= sk_CONF_VALUE_num(nval
);
387 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
389 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
390 sk_GENERAL_NAME_free(gens
);
394 for (i
= 0; i
< num
; i
++) {
395 cnf
= sk_CONF_VALUE_value(nval
, i
);
396 if (ossl_v3_name_cmp(cnf
->name
, "email") == 0
397 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
398 if (!copy_email(ctx
, gens
, 0))
400 } else if (ossl_v3_name_cmp(cnf
->name
, "email") == 0
401 && cnf
->value
&& strcmp(cnf
->value
, "move") == 0) {
402 if (!copy_email(ctx
, gens
, 1))
406 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
408 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
413 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
418 * Copy any email addresses in a certificate or request to GENERAL_NAMES
421 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
)
424 ASN1_IA5STRING
*email
= NULL
;
426 GENERAL_NAME
*gen
= NULL
;
429 if (ctx
!= NULL
&& (ctx
->flags
& X509V3_CTX_TEST
) != 0)
432 || (ctx
->subject_cert
== NULL
&& ctx
->subject_req
== NULL
)) {
433 ERR_raise(ERR_LIB_X509V3
, X509V3_R_NO_SUBJECT_DETAILS
);
436 /* Find the subject name */
437 nm
= ctx
->subject_cert
!= NULL
?
438 X509_get_subject_name(ctx
->subject_cert
) :
439 X509_REQ_get_subject_name(ctx
->subject_req
);
441 /* Now add any email address(es) to STACK */
442 while ((i
= X509_NAME_get_index_by_NID(nm
,
443 NID_pkcs9_emailAddress
, i
)) >= 0) {
444 ne
= X509_NAME_get_entry(nm
, i
);
445 email
= ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne
));
447 X509_NAME_delete_entry(nm
, i
);
448 X509_NAME_ENTRY_free(ne
);
451 if (email
== NULL
|| (gen
= GENERAL_NAME_new()) == NULL
) {
452 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
457 gen
->type
= GEN_EMAIL
;
458 if (!sk_GENERAL_NAME_push(gens
, gen
)) {
459 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
468 GENERAL_NAME_free(gen
);
469 ASN1_IA5STRING_free(email
);
474 GENERAL_NAMES
*v2i_GENERAL_NAMES(const X509V3_EXT_METHOD
*method
,
475 X509V3_CTX
*ctx
, STACK_OF(CONF_VALUE
) *nval
)
480 const int num
= sk_CONF_VALUE_num(nval
);
483 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
485 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
486 sk_GENERAL_NAME_free(gens
);
490 for (i
= 0; i
< num
; i
++) {
491 cnf
= sk_CONF_VALUE_value(nval
, i
);
492 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
494 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
498 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
502 GENERAL_NAME
*v2i_GENERAL_NAME(const X509V3_EXT_METHOD
*method
,
503 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
)
505 return v2i_GENERAL_NAME_ex(NULL
, method
, ctx
, cnf
, 0);
508 GENERAL_NAME
*a2i_GENERAL_NAME(GENERAL_NAME
*out
,
509 const X509V3_EXT_METHOD
*method
,
510 X509V3_CTX
*ctx
, int gen_type
, const char *value
,
514 GENERAL_NAME
*gen
= NULL
;
517 ERR_raise(ERR_LIB_X509V3
, X509V3_R_MISSING_VALUE
);
524 gen
= GENERAL_NAME_new();
526 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
541 if ((obj
= OBJ_txt2obj(value
, 0)) == NULL
) {
542 ERR_raise_data(ERR_LIB_X509V3
, X509V3_R_BAD_OBJECT
,
552 gen
->d
.ip
= a2i_IPADDRESS_NC(value
);
554 gen
->d
.ip
= a2i_IPADDRESS(value
);
555 if (gen
->d
.ip
== NULL
) {
556 ERR_raise_data(ERR_LIB_X509V3
, X509V3_R_BAD_IP_ADDRESS
,
563 if (!do_dirname(gen
, value
, ctx
)) {
564 ERR_raise(ERR_LIB_X509V3
, X509V3_R_DIRNAME_ERROR
);
570 if (!do_othername(gen
, value
, ctx
)) {
571 ERR_raise(ERR_LIB_X509V3
, X509V3_R_OTHERNAME_ERROR
);
576 ERR_raise(ERR_LIB_X509V3
, X509V3_R_UNSUPPORTED_TYPE
);
581 if ((gen
->d
.ia5
= ASN1_IA5STRING_new()) == NULL
||
582 !ASN1_STRING_set(gen
->d
.ia5
, (unsigned char *)value
,
584 ERR_raise(ERR_LIB_X509V3
, ERR_R_MALLOC_FAILURE
);
589 gen
->type
= gen_type
;
595 GENERAL_NAME_free(gen
);
599 GENERAL_NAME
*v2i_GENERAL_NAME_ex(GENERAL_NAME
*out
,
600 const X509V3_EXT_METHOD
*method
,
601 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
, int is_nc
)
611 ERR_raise(ERR_LIB_X509V3
, X509V3_R_MISSING_VALUE
);
615 if (!ossl_v3_name_cmp(name
, "email"))
617 else if (!ossl_v3_name_cmp(name
, "URI"))
619 else if (!ossl_v3_name_cmp(name
, "DNS"))
621 else if (!ossl_v3_name_cmp(name
, "RID"))
623 else if (!ossl_v3_name_cmp(name
, "IP"))
625 else if (!ossl_v3_name_cmp(name
, "dirName"))
627 else if (!ossl_v3_name_cmp(name
, "otherName"))
628 type
= GEN_OTHERNAME
;
630 ERR_raise_data(ERR_LIB_X509V3
, X509V3_R_UNSUPPORTED_OPTION
,
635 return a2i_GENERAL_NAME(out
, method
, ctx
, type
, value
, is_nc
);
639 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
641 char *objtmp
= NULL
, *p
;
644 if ((p
= strchr(value
, ';')) == NULL
)
646 if ((gen
->d
.otherName
= OTHERNAME_new()) == NULL
)
649 * Free this up because we will overwrite it. no need to free type_id
650 * because it is static
652 ASN1_TYPE_free(gen
->d
.otherName
->value
);
653 if ((gen
->d
.otherName
->value
= ASN1_generate_v3(p
+ 1, ctx
)) == NULL
)
656 objtmp
= OPENSSL_strndup(value
, objlen
);
659 gen
->d
.otherName
->type_id
= OBJ_txt2obj(objtmp
, 0);
660 OPENSSL_free(objtmp
);
661 if (!gen
->d
.otherName
->type_id
)
666 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
669 STACK_OF(CONF_VALUE
) *sk
= NULL
;
672 if ((nm
= X509_NAME_new()) == NULL
)
674 sk
= X509V3_get_section(ctx
, value
);
676 ERR_raise_data(ERR_LIB_X509V3
, X509V3_R_SECTION_NOT_FOUND
,
677 "section=%s", value
);
680 /* FIXME: should allow other character types... */
681 ret
= X509V3_NAME_from_section(nm
, sk
, MBSTRING_ASC
);
689 X509V3_section_free(ctx
, sk
);