]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
da1c088f | 2 | * Copyright 2004-2023 The OpenSSL Project Authors. All Rights Reserved. |
4acc3e90 | 3 | * |
4286ca47 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
d2e9e320 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4acc3e90 DSH |
8 | */ |
9 | ||
b39fc560 | 10 | #include "internal/cryptlib.h" |
b9ce85f6 | 11 | #include <openssl/trace.h> |
4acc3e90 DSH |
12 | #include <openssl/x509.h> |
13 | #include <openssl/x509v3.h> | |
14 | ||
706457b7 | 15 | #include "pcy_local.h" |
4acc3e90 | 16 | |
3a81370f P |
17 | /* |
18 | * If the maximum number of nodes in the policy tree isn't defined, set it to | |
19 | * a generous default of 1000 nodes. | |
20 | * | |
21 | * Defining this to be zero means unlimited policy tree growth which opens the | |
22 | * door on CVE-2023-0464. | |
23 | */ | |
24 | #ifndef OPENSSL_POLICY_TREE_NODES_MAX | |
25 | # define OPENSSL_POLICY_TREE_NODES_MAX 1000 | |
26 | #endif | |
27 | ||
95a8aa6d CL |
28 | static void exnode_free(X509_POLICY_NODE *node); |
29 | ||
b9ce85f6 RL |
30 | static void expected_print(BIO *channel, |
31 | X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node, | |
32 | int indent) | |
0f113f3e MC |
33 | { |
34 | if ((lev->flags & X509_V_FLAG_INHIBIT_MAP) | |
35 | || !(node->data->flags & POLICY_DATA_FLAG_MAP_MASK)) | |
b9ce85f6 | 36 | BIO_puts(channel, " Not Mapped\n"); |
0f113f3e MC |
37 | else { |
38 | int i; | |
b9ce85f6 | 39 | |
0f113f3e MC |
40 | STACK_OF(ASN1_OBJECT) *pset = node->data->expected_policy_set; |
41 | ASN1_OBJECT *oid; | |
b9ce85f6 | 42 | BIO_puts(channel, " Expected: "); |
0f113f3e MC |
43 | for (i = 0; i < sk_ASN1_OBJECT_num(pset); i++) { |
44 | oid = sk_ASN1_OBJECT_value(pset, i); | |
45 | if (i) | |
b9ce85f6 RL |
46 | BIO_puts(channel, ", "); |
47 | i2a_ASN1_OBJECT(channel, oid); | |
0f113f3e | 48 | } |
b9ce85f6 | 49 | BIO_puts(channel, "\n"); |
0f113f3e MC |
50 | } |
51 | } | |
002e66c0 | 52 | |
b9ce85f6 RL |
53 | static void tree_print(BIO *channel, |
54 | char *str, X509_POLICY_TREE *tree, | |
0f113f3e MC |
55 | X509_POLICY_LEVEL *curr) |
56 | { | |
57 | X509_POLICY_LEVEL *plev; | |
895c2f84 | 58 | |
0f113f3e MC |
59 | if (!curr) |
60 | curr = tree->levels + tree->nlevel; | |
61 | else | |
62 | curr++; | |
895c2f84 | 63 | |
b9ce85f6 | 64 | BIO_printf(channel, "Level print after %s\n", str); |
e774adb5 PS |
65 | BIO_printf(channel, "Printing Up to Level %ld\n", |
66 | (long)(curr - tree->levels)); | |
0f113f3e | 67 | for (plev = tree->levels; plev != curr; plev++) { |
895c2f84 VD |
68 | int i; |
69 | ||
b9ce85f6 | 70 | BIO_printf(channel, "Level %ld, flags = %x\n", |
895c2f84 | 71 | (long)(plev - tree->levels), plev->flags); |
0f113f3e | 72 | for (i = 0; i < sk_X509_POLICY_NODE_num(plev->nodes); i++) { |
b9ce85f6 RL |
73 | X509_POLICY_NODE *node = |
74 | sk_X509_POLICY_NODE_value(plev->nodes, i); | |
895c2f84 | 75 | |
b9ce85f6 RL |
76 | X509_POLICY_NODE_print(channel, node, 2); |
77 | expected_print(channel, plev, node, 2); | |
78 | BIO_printf(channel, " Flags: %x\n", node->data->flags); | |
0f113f3e MC |
79 | } |
80 | if (plev->anyPolicy) | |
b9ce85f6 | 81 | X509_POLICY_NODE_print(channel, plev->anyPolicy, 2); |
0f113f3e | 82 | } |
0f113f3e | 83 | } |
b9ce85f6 RL |
84 | |
85 | #define TREE_PRINT(str, tree, curr) \ | |
86 | OSSL_TRACE_BEGIN(X509V3_POLICY) { \ | |
87 | tree_print(trc_out, "before tree_prune()", tree, curr); \ | |
88 | } OSSL_TRACE_END(X509V3_POLICY) | |
002e66c0 | 89 | |
3a83462d | 90 | /*- |
895c2f84 VD |
91 | * Return value: <= 0 on error, or positive bit mask: |
92 | * | |
93 | * X509_PCY_TREE_VALID: valid tree | |
94 | * X509_PCY_TREE_EMPTY: empty tree (including bare TA case) | |
95 | * X509_PCY_TREE_EXPLICIT: explicit policy required | |
4acc3e90 | 96 | */ |
4acc3e90 | 97 | static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, |
0f113f3e MC |
98 | unsigned int flags) |
99 | { | |
100 | X509_POLICY_TREE *tree; | |
101 | X509_POLICY_LEVEL *level; | |
102 | const X509_POLICY_CACHE *cache; | |
103 | X509_POLICY_DATA *data = NULL; | |
895c2f84 VD |
104 | int ret = X509_PCY_TREE_VALID; |
105 | int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */ | |
106 | int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1; | |
107 | int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1; | |
108 | int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1; | |
109 | int i; | |
7aa0b022 | 110 | |
0f113f3e | 111 | *ptree = NULL; |
4acc3e90 | 112 | |
895c2f84 VD |
113 | /* Can't do anything with just a trust anchor */ |
114 | if (n == 0) | |
115 | return X509_PCY_TREE_EMPTY; | |
0f113f3e | 116 | |
895c2f84 VD |
117 | /* |
118 | * First setup the policy cache in all n non-TA certificates, this will be | |
119 | * used in X509_verify_cert() which will invoke the verify callback for all | |
120 | * certificates with invalid policy extensions. | |
121 | */ | |
122 | for (i = n - 1; i >= 0; i--) { | |
123 | X509 *x = sk_X509_value(certs, i); | |
0f113f3e | 124 | |
895c2f84 VD |
125 | /* Call for side-effect of computing hash and caching extensions */ |
126 | X509_check_purpose(x, -1, 0); | |
127 | ||
128 | /* If cache is NULL, likely ENOMEM: return immediately */ | |
b54cab31 | 129 | if (ossl_policy_cache_set(x) == NULL) |
895c2f84 VD |
130 | return X509_PCY_TREE_INTERNAL; |
131 | } | |
0f113f3e | 132 | |
0f113f3e | 133 | /* |
895c2f84 VD |
134 | * At this point check for invalid policies and required explicit policy. |
135 | * Note that the explicit_policy counter is a count-down to zero, with the | |
136 | * requirement kicking in if and once it does that. The counter is | |
137 | * decremented for every non-self-issued certificate in the path, but may | |
138 | * be further reduced by policy constraints in a non-leaf certificate. | |
139 | * | |
60250017 | 140 | * The ultimate policy set is the intersection of all the policies along |
895c2f84 VD |
141 | * the path, if we hit a certificate with an empty policy set, and explicit |
142 | * policy is required we're done. | |
0f113f3e | 143 | */ |
895c2f84 VD |
144 | for (i = n - 1; |
145 | i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0); | |
146 | i--) { | |
147 | X509 *x = sk_X509_value(certs, i); | |
148 | uint32_t ex_flags = X509_get_extension_flags(x); | |
bc8c34d7 | 149 | |
895c2f84 | 150 | /* All the policies are already cached, we can return early */ |
a8d8e06b | 151 | if (ex_flags & EXFLAG_INVALID_POLICY) |
895c2f84 VD |
152 | return X509_PCY_TREE_INVALID; |
153 | ||
154 | /* Access the cache which we now know exists */ | |
b54cab31 | 155 | cache = ossl_policy_cache_set(x); |
895c2f84 VD |
156 | |
157 | if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL) | |
158 | ret = X509_PCY_TREE_EMPTY; | |
0f113f3e | 159 | if (explicit_policy > 0) { |
a8d8e06b | 160 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 161 | explicit_policy--; |
895c2f84 | 162 | if ((cache->explicit_skip >= 0) |
0f113f3e MC |
163 | && (cache->explicit_skip < explicit_policy)) |
164 | explicit_policy = cache->explicit_skip; | |
165 | } | |
166 | } | |
167 | ||
895c2f84 VD |
168 | if (explicit_policy == 0) |
169 | ret |= X509_PCY_TREE_EXPLICIT; | |
170 | if ((ret & X509_PCY_TREE_VALID) == 0) | |
0f113f3e | 171 | return ret; |
0f113f3e MC |
172 | |
173 | /* If we get this far initialize the tree */ | |
e077455e | 174 | if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL) |
895c2f84 VD |
175 | return X509_PCY_TREE_INTERNAL; |
176 | ||
3a81370f P |
177 | /* Limit the growth of the tree to mitigate CVE-2023-0464 */ |
178 | tree->node_maximum = OPENSSL_POLICY_TREE_NODES_MAX; | |
179 | ||
895c2f84 VD |
180 | /* |
181 | * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3. | |
182 | * | |
183 | * The top level is implicitly for the trust anchor with valid expected | |
184 | * policies of anyPolicy. (RFC 5280 has the TA at depth 0 and the leaf at | |
185 | * depth n, we have the leaf at depth 0 and the TA at depth n). | |
186 | */ | |
187 | if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) { | |
0f113f3e | 188 | OPENSSL_free(tree); |
895c2f84 | 189 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 190 | } |
895c2f84 | 191 | tree->nlevel = n+1; |
0f113f3e | 192 | level = tree->levels; |
b54cab31 SL |
193 | if ((data = ossl_policy_data_new(NULL, |
194 | OBJ_nid2obj(NID_any_policy), 0)) == NULL) | |
0f113f3e | 195 | goto bad_tree; |
3a81370f | 196 | if (ossl_policy_level_add_node(level, data, NULL, tree, 1) == NULL) { |
b54cab31 | 197 | ossl_policy_data_free(data); |
895c2f84 VD |
198 | goto bad_tree; |
199 | } | |
0f113f3e | 200 | |
895c2f84 VD |
201 | /* |
202 | * In this pass initialize all the tree levels and whether anyPolicy and | |
203 | * policy mapping are inhibited at each level. | |
204 | */ | |
205 | for (i = n - 1; i >= 0; i--) { | |
206 | X509 *x = sk_X509_value(certs, i); | |
207 | uint32_t ex_flags = X509_get_extension_flags(x); | |
208 | ||
209 | /* Access the cache which we now know exists */ | |
b54cab31 | 210 | cache = ossl_policy_cache_set(x); |
895c2f84 | 211 | |
05f0fb9f | 212 | X509_up_ref(x); |
895c2f84 | 213 | (++level)->cert = x; |
0f113f3e MC |
214 | |
215 | if (!cache->anyPolicy) | |
216 | level->flags |= X509_V_FLAG_INHIBIT_ANY; | |
217 | ||
218 | /* Determine inhibit any and inhibit map flags */ | |
219 | if (any_skip == 0) { | |
220 | /* | |
895c2f84 VD |
221 | * Any matching allowed only if certificate is self issued and not |
222 | * the last in the chain. | |
0f113f3e | 223 | */ |
a8d8e06b | 224 | if (!(ex_flags & EXFLAG_SI) || (i == 0)) |
0f113f3e MC |
225 | level->flags |= X509_V_FLAG_INHIBIT_ANY; |
226 | } else { | |
a8d8e06b | 227 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 228 | any_skip--; |
895c2f84 | 229 | if ((cache->any_skip >= 0) && (cache->any_skip < any_skip)) |
0f113f3e MC |
230 | any_skip = cache->any_skip; |
231 | } | |
232 | ||
233 | if (map_skip == 0) | |
234 | level->flags |= X509_V_FLAG_INHIBIT_MAP; | |
235 | else { | |
a8d8e06b | 236 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 237 | map_skip--; |
895c2f84 | 238 | if ((cache->map_skip >= 0) && (cache->map_skip < map_skip)) |
0f113f3e MC |
239 | map_skip = cache->map_skip; |
240 | } | |
0f113f3e MC |
241 | } |
242 | ||
243 | *ptree = tree; | |
895c2f84 | 244 | return ret; |
0f113f3e MC |
245 | |
246 | bad_tree: | |
0f113f3e | 247 | X509_policy_tree_free(tree); |
895c2f84 | 248 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 249 | } |
4acc3e90 | 250 | |
895c2f84 VD |
251 | /* |
252 | * Return value: 1 on success, 0 otherwise | |
253 | */ | |
002e66c0 | 254 | static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, |
3a81370f P |
255 | X509_POLICY_DATA *data, |
256 | X509_POLICY_TREE *tree) | |
0f113f3e MC |
257 | { |
258 | X509_POLICY_LEVEL *last = curr - 1; | |
0f113f3e | 259 | int i, matched = 0; |
895c2f84 | 260 | |
0f113f3e MC |
261 | /* Iterate through all in nodes linking matches */ |
262 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { | |
895c2f84 VD |
263 | X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i); |
264 | ||
b54cab31 | 265 | if (ossl_policy_node_match(last, node, data->valid_policy)) { |
3a81370f | 266 | if (ossl_policy_level_add_node(curr, data, node, tree, 0) == NULL) |
0f113f3e MC |
267 | return 0; |
268 | matched = 1; | |
269 | } | |
270 | } | |
271 | if (!matched && last->anyPolicy) { | |
3a81370f | 272 | if (ossl_policy_level_add_node(curr, data, last->anyPolicy, tree, 0) == NULL) |
0f113f3e MC |
273 | return 0; |
274 | } | |
275 | return 1; | |
276 | } | |
277 | ||
278 | /* | |
279 | * This corresponds to RFC3280 6.1.3(d)(1): link any data from | |
280 | * CertificatePolicies onto matching parent or anyPolicy if no match. | |
895c2f84 VD |
281 | * |
282 | * Return value: 1 on success, 0 otherwise. | |
4acc3e90 | 283 | */ |
4acc3e90 | 284 | static int tree_link_nodes(X509_POLICY_LEVEL *curr, |
3a81370f P |
285 | const X509_POLICY_CACHE *cache, |
286 | X509_POLICY_TREE *tree) | |
0f113f3e MC |
287 | { |
288 | int i; | |
0f113f3e MC |
289 | |
290 | for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) { | |
895c2f84 VD |
291 | X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i); |
292 | ||
0f113f3e | 293 | /* Look for matching nodes in previous level */ |
3a81370f | 294 | if (!tree_link_matching_nodes(curr, data, tree)) |
0f113f3e MC |
295 | return 0; |
296 | } | |
297 | return 1; | |
298 | } | |
299 | ||
300 | /* | |
301 | * This corresponds to RFC3280 6.1.3(d)(2): Create new data for any unmatched | |
302 | * policies in the parent and link to anyPolicy. | |
895c2f84 VD |
303 | * |
304 | * Return value: 1 on success, 0 otherwise. | |
4acc3e90 | 305 | */ |
002e66c0 | 306 | static int tree_add_unmatched(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
307 | const X509_POLICY_CACHE *cache, |
308 | const ASN1_OBJECT *id, | |
309 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) | |
310 | { | |
311 | X509_POLICY_DATA *data; | |
895c2f84 | 312 | |
0f113f3e MC |
313 | if (id == NULL) |
314 | id = node->data->valid_policy; | |
315 | /* | |
316 | * Create a new node with qualifiers from anyPolicy and id from unmatched | |
317 | * node. | |
318 | */ | |
b54cab31 | 319 | if ((data = ossl_policy_data_new(NULL, id, node_critical(node))) == NULL) |
0f113f3e | 320 | return 0; |
895c2f84 | 321 | |
0f113f3e MC |
322 | /* Curr may not have anyPolicy */ |
323 | data->qualifier_set = cache->anyPolicy->qualifier_set; | |
324 | data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; | |
3a81370f | 325 | if (ossl_policy_level_add_node(curr, data, node, tree, 1) == NULL) { |
b54cab31 | 326 | ossl_policy_data_free(data); |
0f113f3e MC |
327 | return 0; |
328 | } | |
0f113f3e MC |
329 | return 1; |
330 | } | |
002e66c0 | 331 | |
895c2f84 VD |
332 | /* |
333 | * Return value: 1 on success, 0 otherwise. | |
334 | */ | |
002e66c0 | 335 | static int tree_link_unmatched(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
336 | const X509_POLICY_CACHE *cache, |
337 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) | |
338 | { | |
339 | const X509_POLICY_LEVEL *last = curr - 1; | |
340 | int i; | |
341 | ||
342 | if ((last->flags & X509_V_FLAG_INHIBIT_MAP) | |
343 | || !(node->data->flags & POLICY_DATA_FLAG_MAPPED)) { | |
344 | /* If no policy mapping: matched if one child present */ | |
345 | if (node->nchild) | |
346 | return 1; | |
347 | if (!tree_add_unmatched(curr, cache, NULL, node, tree)) | |
348 | return 0; | |
349 | /* Add it */ | |
350 | } else { | |
351 | /* If mapping: matched if one child per expected policy set */ | |
352 | STACK_OF(ASN1_OBJECT) *expset = node->data->expected_policy_set; | |
353 | if (node->nchild == sk_ASN1_OBJECT_num(expset)) | |
354 | return 1; | |
355 | /* Locate unmatched nodes */ | |
356 | for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) { | |
357 | ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i); | |
b54cab31 | 358 | if (ossl_policy_level_find_node(curr, node, oid)) |
0f113f3e MC |
359 | continue; |
360 | if (!tree_add_unmatched(curr, cache, oid, node, tree)) | |
361 | return 0; | |
362 | } | |
363 | ||
364 | } | |
0f113f3e | 365 | return 1; |
0f113f3e | 366 | } |
002e66c0 | 367 | |
895c2f84 VD |
368 | /* |
369 | * Return value: 1 on success, 0 otherwise | |
370 | */ | |
4acc3e90 | 371 | static int tree_link_any(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
372 | const X509_POLICY_CACHE *cache, |
373 | X509_POLICY_TREE *tree) | |
374 | { | |
375 | int i; | |
0f113f3e MC |
376 | X509_POLICY_NODE *node; |
377 | X509_POLICY_LEVEL *last = curr - 1; | |
378 | ||
379 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { | |
380 | node = sk_X509_POLICY_NODE_value(last->nodes, i); | |
381 | ||
382 | if (!tree_link_unmatched(curr, cache, node, tree)) | |
383 | return 0; | |
0f113f3e MC |
384 | } |
385 | /* Finally add link to anyPolicy */ | |
895c2f84 | 386 | if (last->anyPolicy && |
b54cab31 | 387 | ossl_policy_level_add_node(curr, cache->anyPolicy, |
3a81370f | 388 | last->anyPolicy, tree, 0) == NULL) |
895c2f84 | 389 | return 0; |
0f113f3e MC |
390 | return 1; |
391 | } | |
392 | ||
895c2f84 VD |
393 | /*- |
394 | * Prune the tree: delete any child mapped child data on the current level then | |
395 | * proceed up the tree deleting any data with no children. If we ever have no | |
396 | * data on a level we can halt because the tree will be empty. | |
397 | * | |
398 | * Return value: <= 0 error, otherwise one of: | |
399 | * | |
400 | * X509_PCY_TREE_VALID: valid tree | |
401 | * X509_PCY_TREE_EMPTY: empty tree | |
4acc3e90 | 402 | */ |
4acc3e90 | 403 | static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr) |
0f113f3e MC |
404 | { |
405 | STACK_OF(X509_POLICY_NODE) *nodes; | |
406 | X509_POLICY_NODE *node; | |
407 | int i; | |
408 | nodes = curr->nodes; | |
409 | if (curr->flags & X509_V_FLAG_INHIBIT_MAP) { | |
410 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { | |
411 | node = sk_X509_POLICY_NODE_value(nodes, i); | |
412 | /* Delete any mapped data: see RFC3280 XXXX */ | |
413 | if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK) { | |
414 | node->parent->nchild--; | |
415 | OPENSSL_free(node); | |
416 | (void)sk_X509_POLICY_NODE_delete(nodes, i); | |
417 | } | |
418 | } | |
419 | } | |
420 | ||
421 | for (;;) { | |
422 | --curr; | |
423 | nodes = curr->nodes; | |
424 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { | |
425 | node = sk_X509_POLICY_NODE_value(nodes, i); | |
426 | if (node->nchild == 0) { | |
427 | node->parent->nchild--; | |
428 | OPENSSL_free(node); | |
429 | (void)sk_X509_POLICY_NODE_delete(nodes, i); | |
430 | } | |
431 | } | |
432 | if (curr->anyPolicy && !curr->anyPolicy->nchild) { | |
433 | if (curr->anyPolicy->parent) | |
434 | curr->anyPolicy->parent->nchild--; | |
435 | OPENSSL_free(curr->anyPolicy); | |
436 | curr->anyPolicy = NULL; | |
437 | } | |
438 | if (curr == tree->levels) { | |
439 | /* If we zapped anyPolicy at top then tree is empty */ | |
440 | if (!curr->anyPolicy) | |
895c2f84 VD |
441 | return X509_PCY_TREE_EMPTY; |
442 | break; | |
0f113f3e MC |
443 | } |
444 | } | |
895c2f84 | 445 | return X509_PCY_TREE_VALID; |
0f113f3e | 446 | } |
4acc3e90 | 447 | |
895c2f84 VD |
448 | /* |
449 | * Return value: 1 on success, 0 otherwise. | |
450 | */ | |
4acc3e90 | 451 | static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes, |
0f113f3e MC |
452 | X509_POLICY_NODE *pcy) |
453 | { | |
895c2f84 | 454 | if (*pnodes == NULL && |
b54cab31 | 455 | (*pnodes = ossl_policy_node_cmp_new()) == NULL) |
0f113f3e | 456 | return 0; |
5b37fef0 | 457 | if (sk_X509_POLICY_NODE_find(*pnodes, pcy) >= 0) |
895c2f84 VD |
458 | return 1; |
459 | return sk_X509_POLICY_NODE_push(*pnodes, pcy) != 0; | |
0f113f3e MC |
460 | } |
461 | ||
895c2f84 VD |
462 | #define TREE_CALC_FAILURE 0 |
463 | #define TREE_CALC_OK_NOFREE 1 | |
464 | #define TREE_CALC_OK_DOFREE 2 | |
4acc3e90 | 465 | |
895c2f84 VD |
466 | /*- |
467 | * Calculate the authority set based on policy tree. The 'pnodes' parameter is | |
468 | * used as a store for the set of policy nodes used to calculate the user set. | |
469 | * If the authority set is not anyPolicy then pnodes will just point to the | |
470 | * authority set. If however the authority set is anyPolicy then the set of | |
471 | * valid policies (other than anyPolicy) is store in pnodes. | |
472 | * | |
473 | * Return value: | |
474 | * TREE_CALC_FAILURE on failure, | |
475 | * TREE_CALC_OK_NOFREE on success and pnodes need not be freed, | |
476 | * TREE_CALC_OK_DOFREE on success and pnodes needs to be freed | |
477 | */ | |
4acc3e90 | 478 | static int tree_calculate_authority_set(X509_POLICY_TREE *tree, |
0f113f3e MC |
479 | STACK_OF(X509_POLICY_NODE) **pnodes) |
480 | { | |
481 | X509_POLICY_LEVEL *curr; | |
482 | X509_POLICY_NODE *node, *anyptr; | |
483 | STACK_OF(X509_POLICY_NODE) **addnodes; | |
484 | int i, j; | |
485 | curr = tree->levels + tree->nlevel - 1; | |
486 | ||
487 | /* If last level contains anyPolicy set is anyPolicy */ | |
488 | if (curr->anyPolicy) { | |
489 | if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy)) | |
895c2f84 | 490 | return TREE_CALC_FAILURE; |
0f113f3e MC |
491 | addnodes = pnodes; |
492 | } else | |
493 | /* Add policies to authority set */ | |
494 | addnodes = &tree->auth_policies; | |
495 | ||
496 | curr = tree->levels; | |
497 | for (i = 1; i < tree->nlevel; i++) { | |
498 | /* | |
3e6a0d57 | 499 | * If no anyPolicy node on this level it can't appear on lower |
0f113f3e MC |
500 | * levels so end search. |
501 | */ | |
75ebbd9a | 502 | if ((anyptr = curr->anyPolicy) == NULL) |
0f113f3e MC |
503 | break; |
504 | curr++; | |
505 | for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++) { | |
506 | node = sk_X509_POLICY_NODE_value(curr->nodes, j); | |
507 | if ((node->parent == anyptr) | |
895c2f84 VD |
508 | && !tree_add_auth_node(addnodes, node)) { |
509 | if (addnodes == pnodes) { | |
510 | sk_X509_POLICY_NODE_free(*pnodes); | |
511 | *pnodes = NULL; | |
512 | } | |
513 | return TREE_CALC_FAILURE; | |
514 | } | |
0f113f3e MC |
515 | } |
516 | } | |
0f113f3e | 517 | if (addnodes == pnodes) |
895c2f84 | 518 | return TREE_CALC_OK_DOFREE; |
0f113f3e MC |
519 | |
520 | *pnodes = tree->auth_policies; | |
895c2f84 | 521 | return TREE_CALC_OK_NOFREE; |
0f113f3e | 522 | } |
4acc3e90 | 523 | |
895c2f84 VD |
524 | /* |
525 | * Return value: 1 on success, 0 otherwise. | |
526 | */ | |
4acc3e90 | 527 | static int tree_calculate_user_set(X509_POLICY_TREE *tree, |
0f113f3e MC |
528 | STACK_OF(ASN1_OBJECT) *policy_oids, |
529 | STACK_OF(X509_POLICY_NODE) *auth_nodes) | |
530 | { | |
531 | int i; | |
532 | X509_POLICY_NODE *node; | |
533 | ASN1_OBJECT *oid; | |
0f113f3e MC |
534 | X509_POLICY_NODE *anyPolicy; |
535 | X509_POLICY_DATA *extra; | |
536 | ||
537 | /* | |
538 | * Check if anyPolicy present in authority constrained policy set: this | |
539 | * will happen if it is a leaf node. | |
540 | */ | |
0f113f3e MC |
541 | if (sk_ASN1_OBJECT_num(policy_oids) <= 0) |
542 | return 1; | |
543 | ||
544 | anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy; | |
545 | ||
546 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { | |
547 | oid = sk_ASN1_OBJECT_value(policy_oids, i); | |
548 | if (OBJ_obj2nid(oid) == NID_any_policy) { | |
549 | tree->flags |= POLICY_FLAG_ANY_POLICY; | |
550 | return 1; | |
551 | } | |
552 | } | |
553 | ||
554 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { | |
555 | oid = sk_ASN1_OBJECT_value(policy_oids, i); | |
b54cab31 | 556 | node = ossl_policy_tree_find_sk(auth_nodes, oid); |
0f113f3e MC |
557 | if (!node) { |
558 | if (!anyPolicy) | |
559 | continue; | |
560 | /* | |
561 | * Create a new node with policy ID from user set and qualifiers | |
562 | * from anyPolicy. | |
563 | */ | |
b54cab31 | 564 | extra = ossl_policy_data_new(NULL, oid, node_critical(anyPolicy)); |
90945fa3 | 565 | if (extra == NULL) |
0f113f3e MC |
566 | return 0; |
567 | extra->qualifier_set = anyPolicy->data->qualifier_set; | |
568 | extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS | |
569 | | POLICY_DATA_FLAG_EXTRA_NODE; | |
b54cab31 | 570 | node = ossl_policy_level_add_node(NULL, extra, anyPolicy->parent, |
3a81370f | 571 | tree, 1); |
95a8aa6d CL |
572 | if (node == NULL) { |
573 | ossl_policy_data_free(extra); | |
574 | return 0; | |
575 | } | |
0f113f3e MC |
576 | } |
577 | if (!tree->user_policies) { | |
578 | tree->user_policies = sk_X509_POLICY_NODE_new_null(); | |
95a8aa6d CL |
579 | if (!tree->user_policies) { |
580 | exnode_free(node); | |
581 | return 0; | |
582 | } | |
0f113f3e | 583 | } |
95a8aa6d CL |
584 | if (!sk_X509_POLICY_NODE_push(tree->user_policies, node)) { |
585 | exnode_free(node); | |
0f113f3e | 586 | return 0; |
95a8aa6d | 587 | } |
0f113f3e MC |
588 | } |
589 | return 1; | |
0f113f3e | 590 | } |
4acc3e90 | 591 | |
895c2f84 VD |
592 | /*- |
593 | * Return value: <= 0 error, otherwise one of: | |
594 | * X509_PCY_TREE_VALID: valid tree | |
595 | * X509_PCY_TREE_EMPTY: empty tree | |
596 | * (see tree_prune()). | |
597 | */ | |
4acc3e90 | 598 | static int tree_evaluate(X509_POLICY_TREE *tree) |
0f113f3e MC |
599 | { |
600 | int ret, i; | |
601 | X509_POLICY_LEVEL *curr = tree->levels + 1; | |
602 | const X509_POLICY_CACHE *cache; | |
4acc3e90 | 603 | |
0f113f3e | 604 | for (i = 1; i < tree->nlevel; i++, curr++) { |
b54cab31 | 605 | cache = ossl_policy_cache_set(curr->cert); |
3a81370f | 606 | if (!tree_link_nodes(curr, cache, tree)) |
895c2f84 | 607 | return X509_PCY_TREE_INTERNAL; |
0f113f3e MC |
608 | |
609 | if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY) | |
610 | && !tree_link_any(curr, cache, tree)) | |
895c2f84 | 611 | return X509_PCY_TREE_INTERNAL; |
b9ce85f6 | 612 | TREE_PRINT("before tree_prune()", tree, curr); |
0f113f3e | 613 | ret = tree_prune(tree, curr); |
895c2f84 | 614 | if (ret != X509_PCY_TREE_VALID) |
0f113f3e MC |
615 | return ret; |
616 | } | |
895c2f84 | 617 | return X509_PCY_TREE_VALID; |
0f113f3e MC |
618 | } |
619 | ||
620 | static void exnode_free(X509_POLICY_NODE *node) | |
621 | { | |
622 | if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE)) | |
623 | OPENSSL_free(node); | |
624 | } | |
4acc3e90 DSH |
625 | |
626 | void X509_policy_tree_free(X509_POLICY_TREE *tree) | |
0f113f3e MC |
627 | { |
628 | X509_POLICY_LEVEL *curr; | |
629 | int i; | |
4acc3e90 | 630 | |
0f113f3e MC |
631 | if (!tree) |
632 | return; | |
4acc3e90 | 633 | |
0f113f3e MC |
634 | sk_X509_POLICY_NODE_free(tree->auth_policies); |
635 | sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free); | |
4acc3e90 | 636 | |
0f113f3e | 637 | for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) { |
222561fe | 638 | X509_free(curr->cert); |
b54cab31 SL |
639 | sk_X509_POLICY_NODE_pop_free(curr->nodes, ossl_policy_node_free); |
640 | ossl_policy_node_free(curr->anyPolicy); | |
0f113f3e | 641 | } |
4acc3e90 | 642 | |
b54cab31 | 643 | sk_X509_POLICY_DATA_pop_free(tree->extra_data, ossl_policy_data_free); |
0f113f3e MC |
644 | OPENSSL_free(tree->levels); |
645 | OPENSSL_free(tree); | |
4acc3e90 | 646 | |
0f113f3e | 647 | } |
4acc3e90 | 648 | |
1d97c843 TH |
649 | /*- |
650 | * Application policy checking function. | |
4acc3e90 | 651 | * Return codes: |
895c2f84 VD |
652 | * X509_PCY_TREE_FAILURE: Failure to satisfy explicit policy |
653 | * X509_PCY_TREE_INVALID: Inconsistent or invalid extensions | |
654 | * X509_PCY_TREE_INTERNAL: Internal error, most likely malloc | |
655 | * X509_PCY_TREE_VALID: Success (null tree if empty or bare TA) | |
4acc3e90 | 656 | */ |
b6a5fdb8 | 657 | int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy, |
0f113f3e MC |
658 | STACK_OF(X509) *certs, |
659 | STACK_OF(ASN1_OBJECT) *policy_oids, unsigned int flags) | |
660 | { | |
895c2f84 | 661 | int init_ret; |
0f113f3e | 662 | int ret; |
67f060ac | 663 | int calc_ret; |
0f113f3e MC |
664 | X509_POLICY_TREE *tree = NULL; |
665 | STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL; | |
4acc3e90 | 666 | |
895c2f84 | 667 | *ptree = NULL; |
0f113f3e | 668 | *pexplicit_policy = 0; |
895c2f84 | 669 | init_ret = tree_init(&tree, certs, flags); |
4acc3e90 | 670 | |
895c2f84 VD |
671 | if (init_ret <= 0) |
672 | return init_ret; | |
002e66c0 | 673 | |
895c2f84 VD |
674 | if ((init_ret & X509_PCY_TREE_EXPLICIT) == 0) { |
675 | if (init_ret & X509_PCY_TREE_EMPTY) { | |
676 | X509_policy_tree_free(tree); | |
677 | return X509_PCY_TREE_VALID; | |
678 | } | |
679 | } else { | |
0f113f3e | 680 | *pexplicit_policy = 1; |
895c2f84 VD |
681 | /* Tree empty and requireExplicit True: Error */ |
682 | if (init_ret & X509_PCY_TREE_EMPTY) | |
683 | return X509_PCY_TREE_FAILURE; | |
0f113f3e | 684 | } |
4acc3e90 | 685 | |
0f113f3e | 686 | ret = tree_evaluate(tree); |
b9ce85f6 | 687 | TREE_PRINT("tree_evaluate()", tree, NULL); |
0f113f3e MC |
688 | if (ret <= 0) |
689 | goto error; | |
4acc3e90 | 690 | |
895c2f84 | 691 | if (ret == X509_PCY_TREE_EMPTY) { |
0f113f3e | 692 | X509_policy_tree_free(tree); |
895c2f84 VD |
693 | if (init_ret & X509_PCY_TREE_EXPLICIT) |
694 | return X509_PCY_TREE_FAILURE; | |
695 | return X509_PCY_TREE_VALID; | |
0f113f3e | 696 | } |
4acc3e90 | 697 | |
0f113f3e | 698 | /* Tree is not empty: continue */ |
67f060ac RL |
699 | |
700 | if ((calc_ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0) | |
0f113f3e | 701 | goto error; |
efe0222f | 702 | sk_X509_POLICY_NODE_sort(auth_nodes); |
67f060ac RL |
703 | ret = tree_calculate_user_set(tree, policy_oids, auth_nodes); |
704 | if (calc_ret == TREE_CALC_OK_DOFREE) | |
0f113f3e | 705 | sk_X509_POLICY_NODE_free(auth_nodes); |
67f060ac RL |
706 | if (!ret) |
707 | goto error; | |
4acc3e90 | 708 | |
895c2f84 | 709 | *ptree = tree; |
4acc3e90 | 710 | |
895c2f84 | 711 | if (init_ret & X509_PCY_TREE_EXPLICIT) { |
0f113f3e MC |
712 | nodes = X509_policy_tree_get0_user_policies(tree); |
713 | if (sk_X509_POLICY_NODE_num(nodes) <= 0) | |
895c2f84 | 714 | return X509_PCY_TREE_FAILURE; |
0f113f3e | 715 | } |
895c2f84 | 716 | return X509_PCY_TREE_VALID; |
4acc3e90 | 717 | |
0f113f3e | 718 | error: |
0f113f3e | 719 | X509_policy_tree_free(tree); |
895c2f84 | 720 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 721 | } |