]>
Commit | Line | Data |
---|---|---|
0f113f3e | 1 | /* |
6ec5fce2 | 2 | * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. |
4acc3e90 | 3 | * |
d2e9e320 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
4acc3e90 DSH |
8 | */ |
9 | ||
b39fc560 | 10 | #include "internal/cryptlib.h" |
4acc3e90 DSH |
11 | #include <openssl/x509.h> |
12 | #include <openssl/x509v3.h> | |
13 | ||
14 | #include "pcy_int.h" | |
15 | ||
0f113f3e MC |
16 | /* |
17 | * Enable this to print out the complete policy tree at various point during | |
002e66c0 DSH |
18 | * evaluation. |
19 | */ | |
20 | ||
0f113f3e MC |
21 | /* |
22 | * #define OPENSSL_POLICY_DEBUG | |
23 | */ | |
002e66c0 DSH |
24 | |
25 | #ifdef OPENSSL_POLICY_DEBUG | |
26 | ||
27 | static void expected_print(BIO *err, X509_POLICY_LEVEL *lev, | |
0f113f3e MC |
28 | X509_POLICY_NODE *node, int indent) |
29 | { | |
30 | if ((lev->flags & X509_V_FLAG_INHIBIT_MAP) | |
31 | || !(node->data->flags & POLICY_DATA_FLAG_MAP_MASK)) | |
32 | BIO_puts(err, " Not Mapped\n"); | |
33 | else { | |
34 | int i; | |
35 | STACK_OF(ASN1_OBJECT) *pset = node->data->expected_policy_set; | |
36 | ASN1_OBJECT *oid; | |
37 | BIO_puts(err, " Expected: "); | |
38 | for (i = 0; i < sk_ASN1_OBJECT_num(pset); i++) { | |
39 | oid = sk_ASN1_OBJECT_value(pset, i); | |
40 | if (i) | |
41 | BIO_puts(err, ", "); | |
42 | i2a_ASN1_OBJECT(err, oid); | |
43 | } | |
44 | BIO_puts(err, "\n"); | |
45 | } | |
46 | } | |
002e66c0 DSH |
47 | |
48 | static void tree_print(char *str, X509_POLICY_TREE *tree, | |
0f113f3e MC |
49 | X509_POLICY_LEVEL *curr) |
50 | { | |
895c2f84 | 51 | BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE); |
0f113f3e | 52 | X509_POLICY_LEVEL *plev; |
895c2f84 | 53 | |
0f113f3e MC |
54 | if (err == NULL) |
55 | return; | |
56 | if (!curr) | |
57 | curr = tree->levels + tree->nlevel; | |
58 | else | |
59 | curr++; | |
895c2f84 | 60 | |
0f113f3e MC |
61 | BIO_printf(err, "Level print after %s\n", str); |
62 | BIO_printf(err, "Printing Up to Level %ld\n", curr - tree->levels); | |
63 | for (plev = tree->levels; plev != curr; plev++) { | |
895c2f84 VD |
64 | int i; |
65 | ||
0f113f3e | 66 | BIO_printf(err, "Level %ld, flags = %x\n", |
895c2f84 | 67 | (long)(plev - tree->levels), plev->flags); |
0f113f3e | 68 | for (i = 0; i < sk_X509_POLICY_NODE_num(plev->nodes); i++) { |
895c2f84 VD |
69 | X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(plev->nodes, i); |
70 | ||
0f113f3e MC |
71 | X509_POLICY_NODE_print(err, node, 2); |
72 | expected_print(err, plev, node, 2); | |
73 | BIO_printf(err, " Flags: %x\n", node->data->flags); | |
74 | } | |
75 | if (plev->anyPolicy) | |
76 | X509_POLICY_NODE_print(err, plev->anyPolicy, 2); | |
77 | } | |
0f113f3e | 78 | BIO_free(err); |
0f113f3e | 79 | } |
002e66c0 DSH |
80 | #endif |
81 | ||
3a83462d | 82 | /*- |
895c2f84 VD |
83 | * Return value: <= 0 on error, or positive bit mask: |
84 | * | |
85 | * X509_PCY_TREE_VALID: valid tree | |
86 | * X509_PCY_TREE_EMPTY: empty tree (including bare TA case) | |
87 | * X509_PCY_TREE_EXPLICIT: explicit policy required | |
4acc3e90 | 88 | */ |
4acc3e90 | 89 | static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, |
0f113f3e MC |
90 | unsigned int flags) |
91 | { | |
92 | X509_POLICY_TREE *tree; | |
93 | X509_POLICY_LEVEL *level; | |
94 | const X509_POLICY_CACHE *cache; | |
95 | X509_POLICY_DATA *data = NULL; | |
895c2f84 VD |
96 | int ret = X509_PCY_TREE_VALID; |
97 | int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */ | |
98 | int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1; | |
99 | int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1; | |
100 | int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1; | |
101 | int i; | |
7aa0b022 | 102 | |
0f113f3e | 103 | *ptree = NULL; |
4acc3e90 | 104 | |
895c2f84 VD |
105 | /* Can't do anything with just a trust anchor */ |
106 | if (n == 0) | |
107 | return X509_PCY_TREE_EMPTY; | |
0f113f3e | 108 | |
895c2f84 VD |
109 | /* |
110 | * First setup the policy cache in all n non-TA certificates, this will be | |
111 | * used in X509_verify_cert() which will invoke the verify callback for all | |
112 | * certificates with invalid policy extensions. | |
113 | */ | |
114 | for (i = n - 1; i >= 0; i--) { | |
115 | X509 *x = sk_X509_value(certs, i); | |
0f113f3e | 116 | |
895c2f84 VD |
117 | /* Call for side-effect of computing hash and caching extensions */ |
118 | X509_check_purpose(x, -1, 0); | |
119 | ||
120 | /* If cache is NULL, likely ENOMEM: return immediately */ | |
b2e8bd7b | 121 | if (policy_cache_set(x) == NULL) |
895c2f84 VD |
122 | return X509_PCY_TREE_INTERNAL; |
123 | } | |
0f113f3e | 124 | |
0f113f3e | 125 | /* |
895c2f84 VD |
126 | * At this point check for invalid policies and required explicit policy. |
127 | * Note that the explicit_policy counter is a count-down to zero, with the | |
128 | * requirement kicking in if and once it does that. The counter is | |
129 | * decremented for every non-self-issued certificate in the path, but may | |
130 | * be further reduced by policy constraints in a non-leaf certificate. | |
131 | * | |
60250017 | 132 | * The ultimate policy set is the intersection of all the policies along |
895c2f84 VD |
133 | * the path, if we hit a certificate with an empty policy set, and explicit |
134 | * policy is required we're done. | |
0f113f3e | 135 | */ |
895c2f84 VD |
136 | for (i = n - 1; |
137 | i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0); | |
138 | i--) { | |
139 | X509 *x = sk_X509_value(certs, i); | |
140 | uint32_t ex_flags = X509_get_extension_flags(x); | |
bc8c34d7 | 141 | |
895c2f84 | 142 | /* All the policies are already cached, we can return early */ |
a8d8e06b | 143 | if (ex_flags & EXFLAG_INVALID_POLICY) |
895c2f84 VD |
144 | return X509_PCY_TREE_INVALID; |
145 | ||
146 | /* Access the cache which we now know exists */ | |
147 | cache = policy_cache_set(x); | |
148 | ||
149 | if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL) | |
150 | ret = X509_PCY_TREE_EMPTY; | |
0f113f3e | 151 | if (explicit_policy > 0) { |
a8d8e06b | 152 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 153 | explicit_policy--; |
895c2f84 | 154 | if ((cache->explicit_skip >= 0) |
0f113f3e MC |
155 | && (cache->explicit_skip < explicit_policy)) |
156 | explicit_policy = cache->explicit_skip; | |
157 | } | |
158 | } | |
159 | ||
895c2f84 VD |
160 | if (explicit_policy == 0) |
161 | ret |= X509_PCY_TREE_EXPLICIT; | |
162 | if ((ret & X509_PCY_TREE_VALID) == 0) | |
0f113f3e | 163 | return ret; |
0f113f3e MC |
164 | |
165 | /* If we get this far initialize the tree */ | |
f06080cb F |
166 | if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL) { |
167 | X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE); | |
895c2f84 | 168 | return X509_PCY_TREE_INTERNAL; |
f06080cb | 169 | } |
895c2f84 VD |
170 | |
171 | /* | |
172 | * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3. | |
173 | * | |
174 | * The top level is implicitly for the trust anchor with valid expected | |
175 | * policies of anyPolicy. (RFC 5280 has the TA at depth 0 and the leaf at | |
176 | * depth n, we have the leaf at depth 0 and the TA at depth n). | |
177 | */ | |
178 | if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) { | |
0f113f3e | 179 | OPENSSL_free(tree); |
f06080cb | 180 | X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE); |
895c2f84 | 181 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 182 | } |
895c2f84 | 183 | tree->nlevel = n+1; |
0f113f3e | 184 | level = tree->levels; |
895c2f84 | 185 | if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL) |
0f113f3e | 186 | goto bad_tree; |
895c2f84 VD |
187 | if (level_add_node(level, data, NULL, tree) == NULL) { |
188 | policy_data_free(data); | |
189 | goto bad_tree; | |
190 | } | |
0f113f3e | 191 | |
895c2f84 VD |
192 | /* |
193 | * In this pass initialize all the tree levels and whether anyPolicy and | |
194 | * policy mapping are inhibited at each level. | |
195 | */ | |
196 | for (i = n - 1; i >= 0; i--) { | |
197 | X509 *x = sk_X509_value(certs, i); | |
198 | uint32_t ex_flags = X509_get_extension_flags(x); | |
199 | ||
200 | /* Access the cache which we now know exists */ | |
0f113f3e | 201 | cache = policy_cache_set(x); |
895c2f84 | 202 | |
05f0fb9f | 203 | X509_up_ref(x); |
895c2f84 | 204 | (++level)->cert = x; |
0f113f3e MC |
205 | |
206 | if (!cache->anyPolicy) | |
207 | level->flags |= X509_V_FLAG_INHIBIT_ANY; | |
208 | ||
209 | /* Determine inhibit any and inhibit map flags */ | |
210 | if (any_skip == 0) { | |
211 | /* | |
895c2f84 VD |
212 | * Any matching allowed only if certificate is self issued and not |
213 | * the last in the chain. | |
0f113f3e | 214 | */ |
a8d8e06b | 215 | if (!(ex_flags & EXFLAG_SI) || (i == 0)) |
0f113f3e MC |
216 | level->flags |= X509_V_FLAG_INHIBIT_ANY; |
217 | } else { | |
a8d8e06b | 218 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 219 | any_skip--; |
895c2f84 | 220 | if ((cache->any_skip >= 0) && (cache->any_skip < any_skip)) |
0f113f3e MC |
221 | any_skip = cache->any_skip; |
222 | } | |
223 | ||
224 | if (map_skip == 0) | |
225 | level->flags |= X509_V_FLAG_INHIBIT_MAP; | |
226 | else { | |
a8d8e06b | 227 | if (!(ex_flags & EXFLAG_SI)) |
0f113f3e | 228 | map_skip--; |
895c2f84 | 229 | if ((cache->map_skip >= 0) && (cache->map_skip < map_skip)) |
0f113f3e MC |
230 | map_skip = cache->map_skip; |
231 | } | |
0f113f3e MC |
232 | } |
233 | ||
234 | *ptree = tree; | |
895c2f84 | 235 | return ret; |
0f113f3e MC |
236 | |
237 | bad_tree: | |
0f113f3e | 238 | X509_policy_tree_free(tree); |
895c2f84 | 239 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 240 | } |
4acc3e90 | 241 | |
895c2f84 VD |
242 | /* |
243 | * Return value: 1 on success, 0 otherwise | |
244 | */ | |
002e66c0 | 245 | static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, |
4a640fb6 | 246 | X509_POLICY_DATA *data) |
0f113f3e MC |
247 | { |
248 | X509_POLICY_LEVEL *last = curr - 1; | |
0f113f3e | 249 | int i, matched = 0; |
895c2f84 | 250 | |
0f113f3e MC |
251 | /* Iterate through all in nodes linking matches */ |
252 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { | |
895c2f84 VD |
253 | X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i); |
254 | ||
0f113f3e | 255 | if (policy_node_match(last, node, data->valid_policy)) { |
895c2f84 | 256 | if (level_add_node(curr, data, node, NULL) == NULL) |
0f113f3e MC |
257 | return 0; |
258 | matched = 1; | |
259 | } | |
260 | } | |
261 | if (!matched && last->anyPolicy) { | |
895c2f84 | 262 | if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL) |
0f113f3e MC |
263 | return 0; |
264 | } | |
265 | return 1; | |
266 | } | |
267 | ||
268 | /* | |
269 | * This corresponds to RFC3280 6.1.3(d)(1): link any data from | |
270 | * CertificatePolicies onto matching parent or anyPolicy if no match. | |
895c2f84 VD |
271 | * |
272 | * Return value: 1 on success, 0 otherwise. | |
4acc3e90 | 273 | */ |
4acc3e90 | 274 | static int tree_link_nodes(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
275 | const X509_POLICY_CACHE *cache) |
276 | { | |
277 | int i; | |
0f113f3e MC |
278 | |
279 | for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) { | |
895c2f84 VD |
280 | X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i); |
281 | ||
0f113f3e MC |
282 | /* Look for matching nodes in previous level */ |
283 | if (!tree_link_matching_nodes(curr, data)) | |
284 | return 0; | |
285 | } | |
286 | return 1; | |
287 | } | |
288 | ||
289 | /* | |
290 | * This corresponds to RFC3280 6.1.3(d)(2): Create new data for any unmatched | |
291 | * policies in the parent and link to anyPolicy. | |
895c2f84 VD |
292 | * |
293 | * Return value: 1 on success, 0 otherwise. | |
4acc3e90 | 294 | */ |
002e66c0 | 295 | static int tree_add_unmatched(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
296 | const X509_POLICY_CACHE *cache, |
297 | const ASN1_OBJECT *id, | |
298 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) | |
299 | { | |
300 | X509_POLICY_DATA *data; | |
895c2f84 | 301 | |
0f113f3e MC |
302 | if (id == NULL) |
303 | id = node->data->valid_policy; | |
304 | /* | |
305 | * Create a new node with qualifiers from anyPolicy and id from unmatched | |
306 | * node. | |
307 | */ | |
895c2f84 | 308 | if ((data = policy_data_new(NULL, id, node_critical(node))) == NULL) |
0f113f3e | 309 | return 0; |
895c2f84 | 310 | |
0f113f3e MC |
311 | /* Curr may not have anyPolicy */ |
312 | data->qualifier_set = cache->anyPolicy->qualifier_set; | |
313 | data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; | |
895c2f84 | 314 | if (level_add_node(curr, data, node, tree) == NULL) { |
0f113f3e MC |
315 | policy_data_free(data); |
316 | return 0; | |
317 | } | |
0f113f3e MC |
318 | return 1; |
319 | } | |
002e66c0 | 320 | |
895c2f84 VD |
321 | /* |
322 | * Return value: 1 on success, 0 otherwise. | |
323 | */ | |
002e66c0 | 324 | static int tree_link_unmatched(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
325 | const X509_POLICY_CACHE *cache, |
326 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) | |
327 | { | |
328 | const X509_POLICY_LEVEL *last = curr - 1; | |
329 | int i; | |
330 | ||
331 | if ((last->flags & X509_V_FLAG_INHIBIT_MAP) | |
332 | || !(node->data->flags & POLICY_DATA_FLAG_MAPPED)) { | |
333 | /* If no policy mapping: matched if one child present */ | |
334 | if (node->nchild) | |
335 | return 1; | |
336 | if (!tree_add_unmatched(curr, cache, NULL, node, tree)) | |
337 | return 0; | |
338 | /* Add it */ | |
339 | } else { | |
340 | /* If mapping: matched if one child per expected policy set */ | |
341 | STACK_OF(ASN1_OBJECT) *expset = node->data->expected_policy_set; | |
342 | if (node->nchild == sk_ASN1_OBJECT_num(expset)) | |
343 | return 1; | |
344 | /* Locate unmatched nodes */ | |
345 | for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) { | |
346 | ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i); | |
347 | if (level_find_node(curr, node, oid)) | |
348 | continue; | |
349 | if (!tree_add_unmatched(curr, cache, oid, node, tree)) | |
350 | return 0; | |
351 | } | |
352 | ||
353 | } | |
0f113f3e | 354 | return 1; |
0f113f3e | 355 | } |
002e66c0 | 356 | |
895c2f84 VD |
357 | /* |
358 | * Return value: 1 on success, 0 otherwise | |
359 | */ | |
4acc3e90 | 360 | static int tree_link_any(X509_POLICY_LEVEL *curr, |
0f113f3e MC |
361 | const X509_POLICY_CACHE *cache, |
362 | X509_POLICY_TREE *tree) | |
363 | { | |
364 | int i; | |
0f113f3e MC |
365 | X509_POLICY_NODE *node; |
366 | X509_POLICY_LEVEL *last = curr - 1; | |
367 | ||
368 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { | |
369 | node = sk_X509_POLICY_NODE_value(last->nodes, i); | |
370 | ||
371 | if (!tree_link_unmatched(curr, cache, node, tree)) | |
372 | return 0; | |
0f113f3e MC |
373 | } |
374 | /* Finally add link to anyPolicy */ | |
895c2f84 VD |
375 | if (last->anyPolicy && |
376 | level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL) | |
377 | return 0; | |
0f113f3e MC |
378 | return 1; |
379 | } | |
380 | ||
895c2f84 VD |
381 | /*- |
382 | * Prune the tree: delete any child mapped child data on the current level then | |
383 | * proceed up the tree deleting any data with no children. If we ever have no | |
384 | * data on a level we can halt because the tree will be empty. | |
385 | * | |
386 | * Return value: <= 0 error, otherwise one of: | |
387 | * | |
388 | * X509_PCY_TREE_VALID: valid tree | |
389 | * X509_PCY_TREE_EMPTY: empty tree | |
4acc3e90 | 390 | */ |
4acc3e90 | 391 | static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr) |
0f113f3e MC |
392 | { |
393 | STACK_OF(X509_POLICY_NODE) *nodes; | |
394 | X509_POLICY_NODE *node; | |
395 | int i; | |
396 | nodes = curr->nodes; | |
397 | if (curr->flags & X509_V_FLAG_INHIBIT_MAP) { | |
398 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { | |
399 | node = sk_X509_POLICY_NODE_value(nodes, i); | |
400 | /* Delete any mapped data: see RFC3280 XXXX */ | |
401 | if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK) { | |
402 | node->parent->nchild--; | |
403 | OPENSSL_free(node); | |
404 | (void)sk_X509_POLICY_NODE_delete(nodes, i); | |
405 | } | |
406 | } | |
407 | } | |
408 | ||
409 | for (;;) { | |
410 | --curr; | |
411 | nodes = curr->nodes; | |
412 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { | |
413 | node = sk_X509_POLICY_NODE_value(nodes, i); | |
414 | if (node->nchild == 0) { | |
415 | node->parent->nchild--; | |
416 | OPENSSL_free(node); | |
417 | (void)sk_X509_POLICY_NODE_delete(nodes, i); | |
418 | } | |
419 | } | |
420 | if (curr->anyPolicy && !curr->anyPolicy->nchild) { | |
421 | if (curr->anyPolicy->parent) | |
422 | curr->anyPolicy->parent->nchild--; | |
423 | OPENSSL_free(curr->anyPolicy); | |
424 | curr->anyPolicy = NULL; | |
425 | } | |
426 | if (curr == tree->levels) { | |
427 | /* If we zapped anyPolicy at top then tree is empty */ | |
428 | if (!curr->anyPolicy) | |
895c2f84 VD |
429 | return X509_PCY_TREE_EMPTY; |
430 | break; | |
0f113f3e MC |
431 | } |
432 | } | |
895c2f84 | 433 | return X509_PCY_TREE_VALID; |
0f113f3e | 434 | } |
4acc3e90 | 435 | |
895c2f84 VD |
436 | /* |
437 | * Return value: 1 on success, 0 otherwise. | |
438 | */ | |
4acc3e90 | 439 | static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes, |
0f113f3e MC |
440 | X509_POLICY_NODE *pcy) |
441 | { | |
895c2f84 VD |
442 | if (*pnodes == NULL && |
443 | (*pnodes = policy_node_cmp_new()) == NULL) | |
0f113f3e | 444 | return 0; |
895c2f84 VD |
445 | if (sk_X509_POLICY_NODE_find(*pnodes, pcy) != -1) |
446 | return 1; | |
447 | return sk_X509_POLICY_NODE_push(*pnodes, pcy) != 0; | |
0f113f3e MC |
448 | } |
449 | ||
895c2f84 VD |
450 | #define TREE_CALC_FAILURE 0 |
451 | #define TREE_CALC_OK_NOFREE 1 | |
452 | #define TREE_CALC_OK_DOFREE 2 | |
4acc3e90 | 453 | |
895c2f84 VD |
454 | /*- |
455 | * Calculate the authority set based on policy tree. The 'pnodes' parameter is | |
456 | * used as a store for the set of policy nodes used to calculate the user set. | |
457 | * If the authority set is not anyPolicy then pnodes will just point to the | |
458 | * authority set. If however the authority set is anyPolicy then the set of | |
459 | * valid policies (other than anyPolicy) is store in pnodes. | |
460 | * | |
461 | * Return value: | |
462 | * TREE_CALC_FAILURE on failure, | |
463 | * TREE_CALC_OK_NOFREE on success and pnodes need not be freed, | |
464 | * TREE_CALC_OK_DOFREE on success and pnodes needs to be freed | |
465 | */ | |
4acc3e90 | 466 | static int tree_calculate_authority_set(X509_POLICY_TREE *tree, |
0f113f3e MC |
467 | STACK_OF(X509_POLICY_NODE) **pnodes) |
468 | { | |
469 | X509_POLICY_LEVEL *curr; | |
470 | X509_POLICY_NODE *node, *anyptr; | |
471 | STACK_OF(X509_POLICY_NODE) **addnodes; | |
472 | int i, j; | |
473 | curr = tree->levels + tree->nlevel - 1; | |
474 | ||
475 | /* If last level contains anyPolicy set is anyPolicy */ | |
476 | if (curr->anyPolicy) { | |
477 | if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy)) | |
895c2f84 | 478 | return TREE_CALC_FAILURE; |
0f113f3e MC |
479 | addnodes = pnodes; |
480 | } else | |
481 | /* Add policies to authority set */ | |
482 | addnodes = &tree->auth_policies; | |
483 | ||
484 | curr = tree->levels; | |
485 | for (i = 1; i < tree->nlevel; i++) { | |
486 | /* | |
487 | * If no anyPolicy node on this this level it can't appear on lower | |
488 | * levels so end search. | |
489 | */ | |
75ebbd9a | 490 | if ((anyptr = curr->anyPolicy) == NULL) |
0f113f3e MC |
491 | break; |
492 | curr++; | |
493 | for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++) { | |
494 | node = sk_X509_POLICY_NODE_value(curr->nodes, j); | |
495 | if ((node->parent == anyptr) | |
895c2f84 VD |
496 | && !tree_add_auth_node(addnodes, node)) { |
497 | if (addnodes == pnodes) { | |
498 | sk_X509_POLICY_NODE_free(*pnodes); | |
499 | *pnodes = NULL; | |
500 | } | |
501 | return TREE_CALC_FAILURE; | |
502 | } | |
0f113f3e MC |
503 | } |
504 | } | |
0f113f3e | 505 | if (addnodes == pnodes) |
895c2f84 | 506 | return TREE_CALC_OK_DOFREE; |
0f113f3e MC |
507 | |
508 | *pnodes = tree->auth_policies; | |
895c2f84 | 509 | return TREE_CALC_OK_NOFREE; |
0f113f3e | 510 | } |
4acc3e90 | 511 | |
895c2f84 VD |
512 | /* |
513 | * Return value: 1 on success, 0 otherwise. | |
514 | */ | |
4acc3e90 | 515 | static int tree_calculate_user_set(X509_POLICY_TREE *tree, |
0f113f3e MC |
516 | STACK_OF(ASN1_OBJECT) *policy_oids, |
517 | STACK_OF(X509_POLICY_NODE) *auth_nodes) | |
518 | { | |
519 | int i; | |
520 | X509_POLICY_NODE *node; | |
521 | ASN1_OBJECT *oid; | |
0f113f3e MC |
522 | X509_POLICY_NODE *anyPolicy; |
523 | X509_POLICY_DATA *extra; | |
524 | ||
525 | /* | |
526 | * Check if anyPolicy present in authority constrained policy set: this | |
527 | * will happen if it is a leaf node. | |
528 | */ | |
0f113f3e MC |
529 | if (sk_ASN1_OBJECT_num(policy_oids) <= 0) |
530 | return 1; | |
531 | ||
532 | anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy; | |
533 | ||
534 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { | |
535 | oid = sk_ASN1_OBJECT_value(policy_oids, i); | |
536 | if (OBJ_obj2nid(oid) == NID_any_policy) { | |
537 | tree->flags |= POLICY_FLAG_ANY_POLICY; | |
538 | return 1; | |
539 | } | |
540 | } | |
541 | ||
542 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { | |
543 | oid = sk_ASN1_OBJECT_value(policy_oids, i); | |
544 | node = tree_find_sk(auth_nodes, oid); | |
545 | if (!node) { | |
546 | if (!anyPolicy) | |
547 | continue; | |
548 | /* | |
549 | * Create a new node with policy ID from user set and qualifiers | |
550 | * from anyPolicy. | |
551 | */ | |
552 | extra = policy_data_new(NULL, oid, node_critical(anyPolicy)); | |
90945fa3 | 553 | if (extra == NULL) |
0f113f3e MC |
554 | return 0; |
555 | extra->qualifier_set = anyPolicy->data->qualifier_set; | |
556 | extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS | |
557 | | POLICY_DATA_FLAG_EXTRA_NODE; | |
558 | node = level_add_node(NULL, extra, anyPolicy->parent, tree); | |
559 | } | |
560 | if (!tree->user_policies) { | |
561 | tree->user_policies = sk_X509_POLICY_NODE_new_null(); | |
562 | if (!tree->user_policies) | |
563 | return 1; | |
564 | } | |
565 | if (!sk_X509_POLICY_NODE_push(tree->user_policies, node)) | |
566 | return 0; | |
567 | } | |
568 | return 1; | |
0f113f3e | 569 | } |
4acc3e90 | 570 | |
895c2f84 VD |
571 | /*- |
572 | * Return value: <= 0 error, otherwise one of: | |
573 | * X509_PCY_TREE_VALID: valid tree | |
574 | * X509_PCY_TREE_EMPTY: empty tree | |
575 | * (see tree_prune()). | |
576 | */ | |
4acc3e90 | 577 | static int tree_evaluate(X509_POLICY_TREE *tree) |
0f113f3e MC |
578 | { |
579 | int ret, i; | |
580 | X509_POLICY_LEVEL *curr = tree->levels + 1; | |
581 | const X509_POLICY_CACHE *cache; | |
4acc3e90 | 582 | |
0f113f3e MC |
583 | for (i = 1; i < tree->nlevel; i++, curr++) { |
584 | cache = policy_cache_set(curr->cert); | |
585 | if (!tree_link_nodes(curr, cache)) | |
895c2f84 | 586 | return X509_PCY_TREE_INTERNAL; |
0f113f3e MC |
587 | |
588 | if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY) | |
589 | && !tree_link_any(curr, cache, tree)) | |
895c2f84 VD |
590 | return X509_PCY_TREE_INTERNAL; |
591 | #ifdef OPENSSL_POLICY_DEBUG | |
0f113f3e | 592 | tree_print("before tree_prune()", tree, curr); |
895c2f84 | 593 | #endif |
0f113f3e | 594 | ret = tree_prune(tree, curr); |
895c2f84 | 595 | if (ret != X509_PCY_TREE_VALID) |
0f113f3e MC |
596 | return ret; |
597 | } | |
895c2f84 | 598 | return X509_PCY_TREE_VALID; |
0f113f3e MC |
599 | } |
600 | ||
601 | static void exnode_free(X509_POLICY_NODE *node) | |
602 | { | |
603 | if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE)) | |
604 | OPENSSL_free(node); | |
605 | } | |
4acc3e90 DSH |
606 | |
607 | void X509_policy_tree_free(X509_POLICY_TREE *tree) | |
0f113f3e MC |
608 | { |
609 | X509_POLICY_LEVEL *curr; | |
610 | int i; | |
4acc3e90 | 611 | |
0f113f3e MC |
612 | if (!tree) |
613 | return; | |
4acc3e90 | 614 | |
0f113f3e MC |
615 | sk_X509_POLICY_NODE_free(tree->auth_policies); |
616 | sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free); | |
4acc3e90 | 617 | |
0f113f3e | 618 | for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) { |
222561fe RS |
619 | X509_free(curr->cert); |
620 | sk_X509_POLICY_NODE_pop_free(curr->nodes, policy_node_free); | |
25aaa98a | 621 | policy_node_free(curr->anyPolicy); |
0f113f3e | 622 | } |
4acc3e90 | 623 | |
222561fe | 624 | sk_X509_POLICY_DATA_pop_free(tree->extra_data, policy_data_free); |
0f113f3e MC |
625 | OPENSSL_free(tree->levels); |
626 | OPENSSL_free(tree); | |
4acc3e90 | 627 | |
0f113f3e | 628 | } |
4acc3e90 | 629 | |
1d97c843 TH |
630 | /*- |
631 | * Application policy checking function. | |
4acc3e90 | 632 | * Return codes: |
895c2f84 VD |
633 | * X509_PCY_TREE_FAILURE: Failure to satisfy explicit policy |
634 | * X509_PCY_TREE_INVALID: Inconsistent or invalid extensions | |
635 | * X509_PCY_TREE_INTERNAL: Internal error, most likely malloc | |
636 | * X509_PCY_TREE_VALID: Success (null tree if empty or bare TA) | |
4acc3e90 | 637 | */ |
b6a5fdb8 | 638 | int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy, |
0f113f3e MC |
639 | STACK_OF(X509) *certs, |
640 | STACK_OF(ASN1_OBJECT) *policy_oids, unsigned int flags) | |
641 | { | |
895c2f84 | 642 | int init_ret; |
0f113f3e | 643 | int ret; |
67f060ac | 644 | int calc_ret; |
0f113f3e MC |
645 | X509_POLICY_TREE *tree = NULL; |
646 | STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL; | |
4acc3e90 | 647 | |
895c2f84 | 648 | *ptree = NULL; |
0f113f3e | 649 | *pexplicit_policy = 0; |
895c2f84 | 650 | init_ret = tree_init(&tree, certs, flags); |
4acc3e90 | 651 | |
895c2f84 VD |
652 | if (init_ret <= 0) |
653 | return init_ret; | |
002e66c0 | 654 | |
895c2f84 VD |
655 | if ((init_ret & X509_PCY_TREE_EXPLICIT) == 0) { |
656 | if (init_ret & X509_PCY_TREE_EMPTY) { | |
657 | X509_policy_tree_free(tree); | |
658 | return X509_PCY_TREE_VALID; | |
659 | } | |
660 | } else { | |
0f113f3e | 661 | *pexplicit_policy = 1; |
895c2f84 VD |
662 | /* Tree empty and requireExplicit True: Error */ |
663 | if (init_ret & X509_PCY_TREE_EMPTY) | |
664 | return X509_PCY_TREE_FAILURE; | |
0f113f3e | 665 | } |
4acc3e90 | 666 | |
0f113f3e | 667 | ret = tree_evaluate(tree); |
895c2f84 | 668 | #ifdef OPENSSL_POLICY_DEBUG |
0f113f3e | 669 | tree_print("tree_evaluate()", tree, NULL); |
895c2f84 | 670 | #endif |
0f113f3e MC |
671 | if (ret <= 0) |
672 | goto error; | |
4acc3e90 | 673 | |
895c2f84 | 674 | if (ret == X509_PCY_TREE_EMPTY) { |
0f113f3e | 675 | X509_policy_tree_free(tree); |
895c2f84 VD |
676 | if (init_ret & X509_PCY_TREE_EXPLICIT) |
677 | return X509_PCY_TREE_FAILURE; | |
678 | return X509_PCY_TREE_VALID; | |
0f113f3e | 679 | } |
4acc3e90 | 680 | |
0f113f3e | 681 | /* Tree is not empty: continue */ |
67f060ac RL |
682 | |
683 | if ((calc_ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0) | |
0f113f3e | 684 | goto error; |
67f060ac RL |
685 | ret = tree_calculate_user_set(tree, policy_oids, auth_nodes); |
686 | if (calc_ret == TREE_CALC_OK_DOFREE) | |
0f113f3e | 687 | sk_X509_POLICY_NODE_free(auth_nodes); |
67f060ac RL |
688 | if (!ret) |
689 | goto error; | |
4acc3e90 | 690 | |
895c2f84 | 691 | *ptree = tree; |
4acc3e90 | 692 | |
895c2f84 | 693 | if (init_ret & X509_PCY_TREE_EXPLICIT) { |
0f113f3e MC |
694 | nodes = X509_policy_tree_get0_user_policies(tree); |
695 | if (sk_X509_POLICY_NODE_num(nodes) <= 0) | |
895c2f84 | 696 | return X509_PCY_TREE_FAILURE; |
0f113f3e | 697 | } |
895c2f84 | 698 | return X509_PCY_TREE_VALID; |
4acc3e90 | 699 | |
0f113f3e | 700 | error: |
0f113f3e | 701 | X509_policy_tree_free(tree); |
895c2f84 | 702 | return X509_PCY_TREE_INTERNAL; |
0f113f3e | 703 | } |