[thirdparty/openssl.git] / crypto / x509v3 / v3_alt.c

/* v3_alt.c */
/*
 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project.
 */
/* ====================================================================
 * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/conf.h>
#include <openssl/x509v3.h>

static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
                                      X509V3_CTX *ctx,
                                      STACK_OF(CONF_VALUE) *nval);
static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
                                     X509V3_CTX *ctx,
                                     STACK_OF(CONF_VALUE) *nval);
static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);

const X509V3_EXT_METHOD v3_alt[] = {
    {NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
     0, 0, 0, 0,
     0, 0,
     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
     (X509V3_EXT_V2I)v2i_subject_alt,
     NULL, NULL, NULL},

    {NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
     0, 0, 0, 0,
     0, 0,
     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
     (X509V3_EXT_V2I)v2i_issuer_alt,
     NULL, NULL, NULL},

    {NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
     0, 0, 0, 0,
     0, 0,
     (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
     NULL, NULL, NULL, NULL},
};

STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
                                        GENERAL_NAMES *gens,
                                        STACK_OF(CONF_VALUE) *ret)
{
    int i;
    GENERAL_NAME *gen;
    for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
        gen = sk_GENERAL_NAME_value(gens, i);
        ret = i2v_GENERAL_NAME(method, gen, ret);
    }
    if (!ret)
        return sk_CONF_VALUE_new_null();
    return ret;
}

STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                                       GENERAL_NAME *gen,
                                       STACK_OF(CONF_VALUE) *ret)
{
    unsigned char *p;
    char oline[256], htmp[5];
    int i;
    switch (gen->type) {
    case GEN_OTHERNAME:
        X509V3_add_value("othername", "<unsupported>", &ret);
        break;

    case GEN_X400:
        X509V3_add_value("X400Name", "<unsupported>", &ret);
        break;

    case GEN_EDIPARTY:
        X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
        break;

    case GEN_EMAIL:
        X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
        break;

    case GEN_DNS:
        X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
        break;

    case GEN_URI:
        X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
        break;

    case GEN_DIRNAME:
        X509_NAME_oneline(gen->d.dirn, oline, 256);
        X509V3_add_value("DirName", oline, &ret);
        break;

    case GEN_IPADD:
        p = gen->d.ip->data;
        if (gen->d.ip->length == 4)
            BIO_snprintf(oline, sizeof oline,
                         "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
        else if (gen->d.ip->length == 16) {
            oline[0] = 0;
            for (i = 0; i < 8; i++) {
                BIO_snprintf(htmp, sizeof htmp, "%X", p[0] << 8 | p[1]);
                p += 2;
                strcat(oline, htmp);
                if (i != 7)
                    strcat(oline, ":");
            }
        } else {
            X509V3_add_value("IP Address", "<invalid>", &ret);
            break;
        }
        X509V3_add_value("IP Address", oline, &ret);
        break;

    case GEN_RID:
        i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
        X509V3_add_value("Registered ID", oline, &ret);
        break;
    }
    return ret;
}

int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
{
    unsigned char *p;
    int i;
    switch (gen->type) {
    case GEN_OTHERNAME:
        BIO_printf(out, "othername:<unsupported>");
        break;

    case GEN_X400:
        BIO_printf(out, "X400Name:<unsupported>");
        break;

    case GEN_EDIPARTY:
        /* Maybe fix this: it is supported now */
        BIO_printf(out, "EdiPartyName:<unsupported>");
        break;

    case GEN_EMAIL:
        BIO_printf(out, "email:%s", gen->d.ia5->data);
        break;

    case GEN_DNS:
        BIO_printf(out, "DNS:%s", gen->d.ia5->data);
        break;

    case GEN_URI:
        BIO_printf(out, "URI:%s", gen->d.ia5->data);
        break;

    case GEN_DIRNAME:
        BIO_printf(out, "DirName: ");
        X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
        break;

    case GEN_IPADD:
        p = gen->d.ip->data;
        if (gen->d.ip->length == 4)
            BIO_printf(out, "IP Address:%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
        else if (gen->d.ip->length == 16) {
            BIO_printf(out, "IP Address");
            for (i = 0; i < 8; i++) {
                BIO_printf(out, ":%X", p[0] << 8 | p[1]);
                p += 2;
            }
            BIO_puts(out, "\n");
        } else {
            BIO_printf(out, "IP Address:<invalid>");
            break;
        }
        break;

    case GEN_RID:
        BIO_printf(out, "Registered ID");
        i2a_ASN1_OBJECT(out, gen->d.rid);
        break;
    }
    return 1;
}

static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
                                     X509V3_CTX *ctx,
                                     STACK_OF(CONF_VALUE) *nval)
{
    GENERAL_NAMES *gens = NULL;
    CONF_VALUE *cnf;
    int i;
    if (!(gens = sk_GENERAL_NAME_new_null())) {
        X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
        cnf = sk_CONF_VALUE_value(nval, i);
        if (!name_cmp(cnf->name, "issuer") && cnf->value &&
            !strcmp(cnf->value, "copy")) {
            if (!copy_issuer(ctx, gens))
                goto err;
        } else {
            GENERAL_NAME *gen;
            if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
                goto err;
            sk_GENERAL_NAME_push(gens, gen);
        }
    }
    return gens;
 err:
    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
    return NULL;
}

/* Append subject altname of issuer to issuer alt name of subject */

static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
{
    GENERAL_NAMES *ialt;
    GENERAL_NAME *gen;
    X509_EXTENSION *ext;
    int i;
    if (ctx && (ctx->flags == CTX_TEST))
        return 1;
    if (!ctx || !ctx->issuer_cert) {
        X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
        goto err;
    }
    i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
    if (i < 0)
        return 1;
    if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
        !(ialt = X509V3_EXT_d2i(ext))) {
        X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
        goto err;
    }

    for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
        gen = sk_GENERAL_NAME_value(ialt, i);
        if (!sk_GENERAL_NAME_push(gens, gen)) {
            X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
            goto err;
        }
    }
    sk_GENERAL_NAME_free(ialt);

    return 1;

 err:
    return 0;

}

static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
                                      X509V3_CTX *ctx,
                                      STACK_OF(CONF_VALUE) *nval)
{
    GENERAL_NAMES *gens = NULL;
    CONF_VALUE *cnf;
    int i;
    if (!(gens = sk_GENERAL_NAME_new_null())) {
        X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
        cnf = sk_CONF_VALUE_value(nval, i);
        if (!name_cmp(cnf->name, "email") && cnf->value &&
            !strcmp(cnf->value, "copy")) {
            if (!copy_email(ctx, gens, 0))
                goto err;
        } else if (!name_cmp(cnf->name, "email") && cnf->value &&
                   !strcmp(cnf->value, "move")) {
            if (!copy_email(ctx, gens, 1))
                goto err;
        } else {
            GENERAL_NAME *gen;
            if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
                goto err;
            sk_GENERAL_NAME_push(gens, gen);
        }
    }
    return gens;
 err:
    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
    return NULL;
}

/*
 * Copy any email addresses in a certificate or request to GENERAL_NAMES
 */

static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
{
    X509_NAME *nm;
    ASN1_IA5STRING *email = NULL;
    X509_NAME_ENTRY *ne;
    GENERAL_NAME *gen = NULL;
    int i;
    if (ctx != NULL && ctx->flags == CTX_TEST)
        return 1;
    if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
        X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
        goto err;
    }
    /* Find the subject name */
    if (ctx->subject_cert)
        nm = X509_get_subject_name(ctx->subject_cert);
    else
        nm = X509_REQ_get_subject_name(ctx->subject_req);

    /* Now add any email address(es) to STACK */
    i = -1;
    while ((i = X509_NAME_get_index_by_NID(nm,
                                           NID_pkcs9_emailAddress, i)) >= 0) {
        ne = X509_NAME_get_entry(nm, i);
        email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
        if (move_p) {
            X509_NAME_delete_entry(nm, i);
            X509_NAME_ENTRY_free(ne);
            i--;
        }
        if (!email || !(gen = GENERAL_NAME_new())) {
            X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        gen->d.ia5 = email;
        email = NULL;
        gen->type = GEN_EMAIL;
        if (!sk_GENERAL_NAME_push(gens, gen)) {
            X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
            goto err;
        }
        gen = NULL;
    }

    return 1;

 err:
    GENERAL_NAME_free(gen);
    M_ASN1_IA5STRING_free(email);
    return 0;

}

GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
{
    GENERAL_NAME *gen;
    GENERAL_NAMES *gens = NULL;
    CONF_VALUE *cnf;
    int i;
    if (!(gens = sk_GENERAL_NAME_new_null())) {
        X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
        cnf = sk_CONF_VALUE_value(nval, i);
        if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
            goto err;
        sk_GENERAL_NAME_push(gens, gen);
    }
    return gens;
 err:
    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
    return NULL;
}

GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method,
                               X509V3_CTX *ctx, CONF_VALUE *cnf)
{
    return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
}

GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out,
                               const X509V3_EXT_METHOD *method,
                               X509V3_CTX *ctx, int gen_type, char *value,
                               int is_nc)
{
    char is_string = 0;
    GENERAL_NAME *gen = NULL;

    if (!value) {
        X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
        return NULL;
    }

    if (out)
        gen = out;
    else {
        gen = GENERAL_NAME_new();
        if (gen == NULL) {
            X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
            return NULL;
        }
    }

    switch (gen_type) {
    case GEN_URI:
    case GEN_EMAIL:
    case GEN_DNS:
        is_string = 1;
        break;

    case GEN_RID:
        {
            ASN1_OBJECT *obj;
            if (!(obj = OBJ_txt2obj(value, 0))) {
                X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_OBJECT);
                ERR_add_error_data(2, "value=", value);
                goto err;
            }
            gen->d.rid = obj;
        }
        break;

    case GEN_IPADD:
        if (is_nc)
            gen->d.ip = a2i_IPADDRESS_NC(value);
        else
            gen->d.ip = a2i_IPADDRESS(value);
        if (gen->d.ip == NULL) {
            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_IP_ADDRESS);
            ERR_add_error_data(2, "value=", value);
            goto err;
        }
        break;

    case GEN_DIRNAME:
        if (!do_dirname(gen, value, ctx)) {
            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_DIRNAME_ERROR);
            goto err;
        }
        break;

    case GEN_OTHERNAME:
        if (!do_othername(gen, value, ctx)) {
            X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_OTHERNAME_ERROR);
            goto err;
        }
        break;
    default:
        X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
        goto err;
    }

    if (is_string) {
        if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
            !ASN1_STRING_set(gen->d.ia5, (unsigned char *)value,
                             strlen(value))) {
            X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
            goto err;
        }
    }

    gen->type = gen_type;

    return gen;

 err:
    if (!out)
        GENERAL_NAME_free(gen);
    return NULL;
}

GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out,
                                  const X509V3_EXT_METHOD *method,
                                  X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
{
    int type;

    char *name, *value;

    name = cnf->name;
    value = cnf->value;

    if (!value) {
        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
        return NULL;
    }

    if (!name_cmp(name, "email"))
        type = GEN_EMAIL;
    else if (!name_cmp(name, "URI"))
        type = GEN_URI;
    else if (!name_cmp(name, "DNS"))
        type = GEN_DNS;
    else if (!name_cmp(name, "RID"))
        type = GEN_RID;
    else if (!name_cmp(name, "IP"))
        type = GEN_IPADD;
    else if (!name_cmp(name, "dirName"))
        type = GEN_DIRNAME;
    else if (!name_cmp(name, "otherName"))
        type = GEN_OTHERNAME;
    else {
        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION);
        ERR_add_error_data(2, "name=", name);
        return NULL;
    }

    return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);

}

static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
{
    char *objtmp = NULL, *p;
    int objlen;
    if (!(p = strchr(value, ';')))
        return 0;
    if (!(gen->d.otherName = OTHERNAME_new()))
        return 0;
    /*
     * Free this up because we will overwrite it. no need to free type_id
     * because it is static
     */
    ASN1_TYPE_free(gen->d.otherName->value);
    if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
        return 0;
    objlen = p - value;
    objtmp = OPENSSL_malloc(objlen + 1);
    if (objtmp == NULL)
        return 0;
    strncpy(objtmp, value, objlen);
    objtmp[objlen] = 0;
    gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
    OPENSSL_free(objtmp);
    if (!gen->d.otherName->type_id)
        return 0;
    return 1;
}

static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
{
    int ret;
    STACK_OF(CONF_VALUE) *sk;
    X509_NAME *nm;
    if (!(nm = X509_NAME_new()))
        return 0;
    sk = X509V3_get_section(ctx, value);
    if (!sk) {
        X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
        ERR_add_error_data(2, "section=", value);
        X509_NAME_free(nm);
        return 0;
    }
    /* FIXME: should allow other character types... */
    ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
    if (!ret)
        X509_NAME_free(nm);
    gen->d.dirn = nm;
    X509V3_section_free(ctx, sk);

    return ret;
}
Commit	Line	Data
643aaa19	1	/* v3_alt.c */
0f113f3e MC	2	/*
0f113f3e MC	3	* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
4e5d3a7f	4	* project.
142fcca8 DSH	5	*/
142fcca8 DSH	6	/* ====================================================================
4e5d3a7f	7	* Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved.
142fcca8 DSH	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	*
	13	* 1. Redistributions of source code must retain the above copyright
0f113f3e	14	* notice, this list of conditions and the following disclaimer.
142fcca8 DSH	15	*
	16	* 2. Redistributions in binary form must reproduce the above copyright
	17	* notice, this list of conditions and the following disclaimer in
	18	* the documentation and/or other materials provided with the
	19	* distribution.
	20	*
	21	* 3. All advertising materials mentioning features or use of this
	22	* software must display the following acknowledgment:
	23	* "This product includes software developed by the OpenSSL Project
	24	* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
	25	*
	26	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	27	* endorse or promote products derived from this software without
	28	* prior written permission. For written permission, please contact
	29	* licensing@OpenSSL.org.
	30	*
	31	* 5. Products derived from this software may not be called "OpenSSL"
	32	* nor may "OpenSSL" appear in their names without prior written
	33	* permission of the OpenSSL Project.
	34	*
	35	* 6. Redistributions of any form whatsoever must retain the following
	36	* acknowledgment:
	37	* "This product includes software developed by the OpenSSL Project
	38	* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
	39	*
	40	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	41	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	42	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	43	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	44	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	45	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	46	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	47	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	49	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	50	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	51	* OF THE POSSIBILITY OF SUCH DAMAGE.
	52	* ====================================================================
	53	*
	54	* This product includes cryptographic software written by Eric Young
	55	* (eay@cryptsoft.com). This product includes software written by Tim
	56	* Hudson (tjh@cryptsoft.com).
	57	*
	58	*/
	59
	60	#include <stdio.h>
e527ba09	61	#include "cryptlib.h"
ec577822 BM	62	#include <openssl/conf.h>
ec577822 BM	63	#include <openssl/x509v3.h>
142fcca8	64
0f113f3e MC	65	static GENERAL_NAMES v2i_subject_alt(X509V3_EXT_METHOD method,
	66	X509V3_CTX *ctx,
	67	STACK_OF(CONF_VALUE) *nval);
	68	static GENERAL_NAMES v2i_issuer_alt(X509V3_EXT_METHOD method,
	69	X509V3_CTX *ctx,
	70	STACK_OF(CONF_VALUE) *nval);
c9fd77e9	71	static int copy_email(X509V3_CTX ctx, GENERAL_NAMES gens, int move_p);
9d6b1ce6	72	static int copy_issuer(X509V3_CTX ctx, GENERAL_NAMES gens);
9ea1b878	73	static int do_othername(GENERAL_NAME gen, char value, X509V3_CTX *ctx);
f0dc08e6	74	static int do_dirname(GENERAL_NAME gen, char value, X509V3_CTX *ctx);
9ea1b878	75
560b79cb	76	const X509V3_EXT_METHOD v3_alt[] = {
0f113f3e MC	77	{NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
	78	0, 0, 0, 0,
	79	0, 0,
	80	(X509V3_EXT_I2V) i2v_GENERAL_NAMES,
	81	(X509V3_EXT_V2I)v2i_subject_alt,
	82	NULL, NULL, NULL},
	83
	84	{NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
	85	0, 0, 0, 0,
	86	0, 0,
	87	(X509V3_EXT_I2V) i2v_GENERAL_NAMES,
	88	(X509V3_EXT_V2I)v2i_issuer_alt,
	89	NULL, NULL, NULL},
	90
	91	{NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
	92	0, 0, 0, 0,
	93	0, 0,
	94	(X509V3_EXT_I2V) i2v_GENERAL_NAMES,
	95	NULL, NULL, NULL, NULL},
142fcca8 DSH	96	};
142fcca8 DSH	97
ba404b5e	98	STACK_OF(CONF_VALUE) i2v_GENERAL_NAMES(X509V3_EXT_METHOD method,
0f113f3e MC	99	GENERAL_NAMES *gens,
0f113f3e MC	100	STACK_OF(CONF_VALUE) *ret)
142fcca8	101	{
0f113f3e MC	102	int i;
	103	GENERAL_NAME *gen;
	104	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
	105	gen = sk_GENERAL_NAME_value(gens, i);
	106	ret = i2v_GENERAL_NAME(method, gen, ret);
	107	}
	108	if (!ret)
	109	return sk_CONF_VALUE_new_null();
	110	return ret;
d08d8da4 DSH	111	}
d08d8da4 DSH	112
ba404b5e	113	STACK_OF(CONF_VALUE) i2v_GENERAL_NAME(X509V3_EXT_METHOD method,
0f113f3e MC	114	GENERAL_NAME *gen,
0f113f3e MC	115	STACK_OF(CONF_VALUE) *ret)
d08d8da4	116	{
0f113f3e MC	117	unsigned char *p;
	118	char oline[256], htmp[5];
	119	int i;
	120	switch (gen->type) {
	121	case GEN_OTHERNAME:
	122	X509V3_add_value("othername", "<unsupported>", &ret);
	123	break;
	124
	125	case GEN_X400:
	126	X509V3_add_value("X400Name", "<unsupported>", &ret);
	127	break;
	128
	129	case GEN_EDIPARTY:
	130	X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
	131	break;
	132
	133	case GEN_EMAIL:
	134	X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
	135	break;
	136
	137	case GEN_DNS:
	138	X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
	139	break;
	140
	141	case GEN_URI:
	142	X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
	143	break;
	144
	145	case GEN_DIRNAME:
	146	X509_NAME_oneline(gen->d.dirn, oline, 256);
	147	X509V3_add_value("DirName", oline, &ret);
	148	break;
	149
	150	case GEN_IPADD:
	151	p = gen->d.ip->data;
	152	if (gen->d.ip->length == 4)
	153	BIO_snprintf(oline, sizeof oline,
	154	"%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
	155	else if (gen->d.ip->length == 16) {
	156	oline[0] = 0;
	157	for (i = 0; i < 8; i++) {
	158	BIO_snprintf(htmp, sizeof htmp, "%X", p[0] << 8 \| p[1]);
	159	p += 2;
	160	strcat(oline, htmp);
	161	if (i != 7)
	162	strcat(oline, ":");
	163	}
	164	} else {
	165	X509V3_add_value("IP Address", "<invalid>", &ret);
	166	break;
	167	}
	168	X509V3_add_value("IP Address", oline, &ret);
	169	break;
	170
	171	case GEN_RID:
	172	i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
	173	X509V3_add_value("Registered ID", oline, &ret);
	174	break;
	175	}
	176	return ret;
2c15d426 DSH	177	}
	178
	179	int GENERAL_NAME_print(BIO out, GENERAL_NAME gen)
	180	{
0f113f3e MC	181	unsigned char *p;
	182	int i;
	183	switch (gen->type) {
	184	case GEN_OTHERNAME:
	185	BIO_printf(out, "othername:<unsupported>");
	186	break;
	187
	188	case GEN_X400:
	189	BIO_printf(out, "X400Name:<unsupported>");
	190	break;
	191
	192	case GEN_EDIPARTY:
	193	/* Maybe fix this: it is supported now */
	194	BIO_printf(out, "EdiPartyName:<unsupported>");
	195	break;
	196
	197	case GEN_EMAIL:
	198	BIO_printf(out, "email:%s", gen->d.ia5->data);
	199	break;
	200
	201	case GEN_DNS:
	202	BIO_printf(out, "DNS:%s", gen->d.ia5->data);
	203	break;
	204
	205	case GEN_URI:
	206	BIO_printf(out, "URI:%s", gen->d.ia5->data);
	207	break;
	208
	209	case GEN_DIRNAME:
	210	BIO_printf(out, "DirName: ");
	211	X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
	212	break;
	213
	214	case GEN_IPADD:
	215	p = gen->d.ip->data;
	216	if (gen->d.ip->length == 4)
	217	BIO_printf(out, "IP Address:%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
	218	else if (gen->d.ip->length == 16) {
	219	BIO_printf(out, "IP Address");
	220	for (i = 0; i < 8; i++) {
	221	BIO_printf(out, ":%X", p[0] << 8 \| p[1]);
	222	p += 2;
	223	}
	224	BIO_puts(out, "\n");
	225	} else {
	226	BIO_printf(out, "IP Address:<invalid>");
	227	break;
	228	}
	229	break;
	230
	231	case GEN_RID:
	232	BIO_printf(out, "Registered ID");
	233	i2a_ASN1_OBJECT(out, gen->d.rid);
	234	break;
	235	}
	236	return 1;
142fcca8 DSH	237	}
142fcca8 DSH	238
9d6b1ce6	239	static GENERAL_NAMES v2i_issuer_alt(X509V3_EXT_METHOD method,
0f113f3e MC	240	X509V3_CTX *ctx,
0f113f3e MC	241	STACK_OF(CONF_VALUE) *nval)
aa066b9e	242	{
0f113f3e MC	243	GENERAL_NAMES *gens = NULL;
	244	CONF_VALUE *cnf;
	245	int i;
	246	if (!(gens = sk_GENERAL_NAME_new_null())) {
	247	X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
	248	return NULL;
	249	}
	250	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
	251	cnf = sk_CONF_VALUE_value(nval, i);
	252	if (!name_cmp(cnf->name, "issuer") && cnf->value &&
	253	!strcmp(cnf->value, "copy")) {
	254	if (!copy_issuer(ctx, gens))
	255	goto err;
	256	} else {
	257	GENERAL_NAME *gen;
	258	if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
	259	goto err;
	260	sk_GENERAL_NAME_push(gens, gen);
	261	}
	262	}
	263	return gens;
	264	err:
	265	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
	266	return NULL;
aa066b9e DSH	267	}
	268
	269	/* Append subject altname of issuer to issuer alt name of subject */
	270
9d6b1ce6	271	static int copy_issuer(X509V3_CTX ctx, GENERAL_NAMES gens)
aa066b9e	272	{
0f113f3e MC	273	GENERAL_NAMES *ialt;
	274	GENERAL_NAME *gen;
	275	X509_EXTENSION *ext;
	276	int i;
	277	if (ctx && (ctx->flags == CTX_TEST))
	278	return 1;
	279	if (!ctx \|\| !ctx->issuer_cert) {
	280	X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
	281	goto err;
	282	}
	283	i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
	284	if (i < 0)
	285	return 1;
	286	if (!(ext = X509_get_ext(ctx->issuer_cert, i)) \|\|
	287	!(ialt = X509V3_EXT_d2i(ext))) {
	288	X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
	289	goto err;
	290	}
	291
	292	for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
	293	gen = sk_GENERAL_NAME_value(ialt, i);
	294	if (!sk_GENERAL_NAME_push(gens, gen)) {
	295	X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
	296	goto err;
	297	}
	298	}
	299	sk_GENERAL_NAME_free(ialt);
	300
	301	return 1;
	302
	303	err:
	304	return 0;
	305
aa066b9e DSH	306	}
aa066b9e DSH	307
9d6b1ce6	308	static GENERAL_NAMES v2i_subject_alt(X509V3_EXT_METHOD method,
0f113f3e MC	309	X509V3_CTX *ctx,
0f113f3e MC	310	STACK_OF(CONF_VALUE) *nval)
aa066b9e	311	{
0f113f3e MC	312	GENERAL_NAMES *gens = NULL;
	313	CONF_VALUE *cnf;
	314	int i;
	315	if (!(gens = sk_GENERAL_NAME_new_null())) {
	316	X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
	317	return NULL;
	318	}
	319	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
	320	cnf = sk_CONF_VALUE_value(nval, i);
	321	if (!name_cmp(cnf->name, "email") && cnf->value &&
	322	!strcmp(cnf->value, "copy")) {
	323	if (!copy_email(ctx, gens, 0))
	324	goto err;
	325	} else if (!name_cmp(cnf->name, "email") && cnf->value &&
	326	!strcmp(cnf->value, "move")) {
	327	if (!copy_email(ctx, gens, 1))
	328	goto err;
	329	} else {
	330	GENERAL_NAME *gen;
	331	if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
	332	goto err;
	333	sk_GENERAL_NAME_push(gens, gen);
	334	}
	335	}
	336	return gens;
	337	err:
	338	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
	339	return NULL;
aa066b9e DSH	340	}
aa066b9e DSH	341
0f113f3e MC	342	/*
0f113f3e MC	343	* Copy any email addresses in a certificate or request to GENERAL_NAMES
aa066b9e DSH	344	*/
aa066b9e DSH	345
c9fd77e9	346	static int copy_email(X509V3_CTX ctx, GENERAL_NAMES gens, int move_p)
aa066b9e	347	{
0f113f3e MC	348	X509_NAME *nm;
	349	ASN1_IA5STRING *email = NULL;
	350	X509_NAME_ENTRY *ne;
	351	GENERAL_NAME *gen = NULL;
	352	int i;
	353	if (ctx != NULL && ctx->flags == CTX_TEST)
	354	return 1;
	355	if (!ctx \|\| (!ctx->subject_cert && !ctx->subject_req)) {
	356	X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
	357	goto err;
	358	}
	359	/* Find the subject name */
	360	if (ctx->subject_cert)
	361	nm = X509_get_subject_name(ctx->subject_cert);
	362	else
	363	nm = X509_REQ_get_subject_name(ctx->subject_req);
	364
	365	/* Now add any email address(es) to STACK */
	366	i = -1;
	367	while ((i = X509_NAME_get_index_by_NID(nm,
	368	NID_pkcs9_emailAddress, i)) >= 0) {
	369	ne = X509_NAME_get_entry(nm, i);
	370	email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
	371	if (move_p) {
	372	X509_NAME_delete_entry(nm, i);
	373	X509_NAME_ENTRY_free(ne);
	374	i--;
	375	}
	376	if (!email \|\| !(gen = GENERAL_NAME_new())) {
	377	X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
	378	goto err;
	379	}
	380	gen->d.ia5 = email;
	381	email = NULL;
	382	gen->type = GEN_EMAIL;
	383	if (!sk_GENERAL_NAME_push(gens, gen)) {
	384	X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
	385	goto err;
	386	}
	387	gen = NULL;
	388	}
	389
	390	return 1;
	391
	392	err:
	393	GENERAL_NAME_free(gen);
	394	M_ASN1_IA5STRING_free(email);
	395	return 0;
	396
aa066b9e DSH	397	}
aa066b9e DSH	398
babb3798	399	GENERAL_NAMES v2i_GENERAL_NAMES(const X509V3_EXT_METHOD method,
0f113f3e	400	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval)
d08d8da4	401	{
0f113f3e MC	402	GENERAL_NAME *gen;
	403	GENERAL_NAMES *gens = NULL;
	404	CONF_VALUE *cnf;
	405	int i;
	406	if (!(gens = sk_GENERAL_NAME_new_null())) {
	407	X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
	408	return NULL;
	409	}
	410	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
	411	cnf = sk_CONF_VALUE_value(nval, i);
	412	if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
	413	goto err;
	414	sk_GENERAL_NAME_push(gens, gen);
	415	}
	416	return gens;
	417	err:
	418	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
	419	return NULL;
d08d8da4 DSH	420	}
d08d8da4 DSH	421
0f113f3e MC	422	GENERAL_NAME v2i_GENERAL_NAME(const X509V3_EXT_METHOD method,
	423	X509V3_CTX ctx, CONF_VALUE cnf)
	424	{
	425	return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
	426	}
d08d8da4	427
be86c7fc	428	GENERAL_NAME a2i_GENERAL_NAME(GENERAL_NAME out,
0f113f3e MC	429	const X509V3_EXT_METHOD *method,
	430	X509V3_CTX ctx, int gen_type, char value,
	431	int is_nc)
	432	{
	433	char is_string = 0;
	434	GENERAL_NAME *gen = NULL;
	435
	436	if (!value) {
	437	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
	438	return NULL;
	439	}
	440
	441	if (out)
	442	gen = out;
	443	else {
	444	gen = GENERAL_NAME_new();
	445	if (gen == NULL) {
	446	X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
	447	return NULL;
	448	}
	449	}
	450
	451	switch (gen_type) {
	452	case GEN_URI:
	453	case GEN_EMAIL:
	454	case GEN_DNS:
	455	is_string = 1;
	456	break;
	457
	458	case GEN_RID:
	459	{
	460	ASN1_OBJECT *obj;
	461	if (!(obj = OBJ_txt2obj(value, 0))) {
	462	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_OBJECT);
	463	ERR_add_error_data(2, "value=", value);
	464	goto err;
	465	}
	466	gen->d.rid = obj;
	467	}
	468	break;
	469
	470	case GEN_IPADD:
	471	if (is_nc)
	472	gen->d.ip = a2i_IPADDRESS_NC(value);
	473	else
	474	gen->d.ip = a2i_IPADDRESS(value);
	475	if (gen->d.ip == NULL) {
	476	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_IP_ADDRESS);
	477	ERR_add_error_data(2, "value=", value);
	478	goto err;
	479	}
	480	break;
	481
	482	case GEN_DIRNAME:
	483	if (!do_dirname(gen, value, ctx)) {
	484	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_DIRNAME_ERROR);
	485	goto err;
	486	}
	487	break;
	488
	489	case GEN_OTHERNAME:
	490	if (!do_othername(gen, value, ctx)) {
	491	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_OTHERNAME_ERROR);
	492	goto err;
493	}
494	break;
495	default:
496	X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
497	goto err;
498	}
499
500	if (is_string) {
501	if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) \|\|
502	!ASN1_STRING_set(gen->d.ia5, (unsigned char *)value,
503	strlen(value))) {
504	X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
505	goto err;
506	}
507	}
508
509	gen->type = gen_type;
510
511	return gen;
512
513	err:
514	if (!out)
515	GENERAL_NAME_free(gen);
516	return NULL;
517	}
9ea1b878	518
be86c7fc	519	GENERAL_NAME v2i_GENERAL_NAME_ex(GENERAL_NAME out,
0f113f3e MC	520	const X509V3_EXT_METHOD *method,
	521	X509V3_CTX ctx, CONF_VALUE cnf, int is_nc)
	522	{
	523	int type;
	524
	525	char name, value;
	526
	527	name = cnf->name;
	528	value = cnf->value;
	529
	530	if (!value) {
	531	X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
	532	return NULL;
	533	}
	534
	535	if (!name_cmp(name, "email"))
	536	type = GEN_EMAIL;
	537	else if (!name_cmp(name, "URI"))
	538	type = GEN_URI;
	539	else if (!name_cmp(name, "DNS"))
	540	type = GEN_DNS;
	541	else if (!name_cmp(name, "RID"))
	542	type = GEN_RID;
	543	else if (!name_cmp(name, "IP"))
	544	type = GEN_IPADD;
	545	else if (!name_cmp(name, "dirName"))
	546	type = GEN_DIRNAME;
	547	else if (!name_cmp(name, "otherName"))
	548	type = GEN_OTHERNAME;
	549	else {
	550	X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION);
	551	ERR_add_error_data(2, "name=", name);
	552	return NULL;
	553	}
	554
	555	return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
	556
	557	}
be86c7fc	558
9ea1b878	559	static int do_othername(GENERAL_NAME gen, char value, X509V3_CTX *ctx)
0f113f3e MC	560	{
	561	char objtmp = NULL, p;
	562	int objlen;
	563	if (!(p = strchr(value, ';')))
	564	return 0;
	565	if (!(gen->d.otherName = OTHERNAME_new()))
	566	return 0;
	567	/*
	568	* Free this up because we will overwrite it. no need to free type_id
	569	* because it is static
	570	*/
	571	ASN1_TYPE_free(gen->d.otherName->value);
	572	if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
	573	return 0;
	574	objlen = p - value;
	575	objtmp = OPENSSL_malloc(objlen + 1);
	576	if (objtmp == NULL)
	577	return 0;
	578	strncpy(objtmp, value, objlen);
	579	objtmp[objlen] = 0;
	580	gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
	581	OPENSSL_free(objtmp);
	582	if (!gen->d.otherName->type_id)
	583	return 0;
	584	return 1;
	585	}
f0dc08e6 DSH	586
f0dc08e6 DSH	587	static int do_dirname(GENERAL_NAME gen, char value, X509V3_CTX *ctx)
0f113f3e MC	588	{
	589	int ret;
	590	STACK_OF(CONF_VALUE) *sk;
	591	X509_NAME *nm;
	592	if (!(nm = X509_NAME_new()))
	593	return 0;
	594	sk = X509V3_get_section(ctx, value);
	595	if (!sk) {
	596	X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
	597	ERR_add_error_data(2, "section=", value);
	598	X509_NAME_free(nm);
	599	return 0;
	600	}
	601	/* FIXME: should allow other character types... */
	602	ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
	603	if (!ret)
	604	X509_NAME_free(nm);
	605	gen->d.dirn = nm;
	606	X509V3_section_free(ctx, sk);
	607
	608	return ret;
	609	}