2 * Copyright 1999-2017 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include <openssl/conf.h>
13 #include <openssl/x509v3.h>
14 #include <openssl/bio.h>
17 DEFINE_STACK_OF(CONF_VALUE
)
18 DEFINE_STACK_OF(GENERAL_NAME
)
20 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
22 STACK_OF(CONF_VALUE
) *nval
);
23 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
25 STACK_OF(CONF_VALUE
) *nval
);
26 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
);
27 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
);
28 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
29 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
31 const X509V3_EXT_METHOD v3_alt
[3] = {
32 {NID_subject_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
35 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
36 (X509V3_EXT_V2I
)v2i_subject_alt
,
39 {NID_issuer_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
42 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
43 (X509V3_EXT_V2I
)v2i_issuer_alt
,
46 {NID_certificate_issuer
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
49 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
50 NULL
, NULL
, NULL
, NULL
},
53 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD
*method
,
55 STACK_OF(CONF_VALUE
) *ret
)
59 STACK_OF(CONF_VALUE
) *tmpret
= NULL
, *origret
= ret
;
61 for (i
= 0; i
< sk_GENERAL_NAME_num(gens
); i
++) {
62 gen
= sk_GENERAL_NAME_value(gens
, i
);
64 * i2v_GENERAL_NAME allocates ret if it is NULL. If something goes
65 * wrong we need to free the stack - but only if it was empty when we
66 * originally entered this function.
68 tmpret
= i2v_GENERAL_NAME(method
, gen
, ret
);
71 sk_CONF_VALUE_pop_free(ret
, X509V3_conf_free
);
77 return sk_CONF_VALUE_new_null();
81 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAME(X509V3_EXT_METHOD
*method
,
83 STACK_OF(CONF_VALUE
) *ret
)
87 char oline
[256], htmp
[5];
92 switch (OBJ_obj2nid(gen
->d
.otherName
->type_id
)) {
93 case NID_id_on_SmtpUTF8Mailbox
:
94 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
95 || !X509V3_add_value_uchar("othername: SmtpUTF8Mailbox:",
96 gen
->d
.otherName
->value
->value
.utf8string
->data
,
101 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
102 || !X509V3_add_value_uchar("othername: XmppAddr:",
103 gen
->d
.otherName
->value
->value
.utf8string
->data
,
108 if (gen
->d
.otherName
->value
->type
!= V_ASN1_IA5STRING
109 || !X509V3_add_value_uchar("othername: SRVName:",
110 gen
->d
.otherName
->value
->value
.ia5string
->data
,
115 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
116 || !X509V3_add_value_uchar("othername: UPN:",
117 gen
->d
.otherName
->value
->value
.utf8string
->data
,
122 if (gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
123 || !X509V3_add_value_uchar("othername: NAIRealm:",
124 gen
->d
.otherName
->value
->value
.utf8string
->data
,
129 if (OBJ_obj2txt(oline
, sizeof(oline
), gen
->d
.otherName
->type_id
, 0) > 0)
130 BIO_snprintf(othername
, sizeof(othername
), "othername: %s:",
133 strncpy(othername
, "othername:", sizeof(othername
));
135 /* check if the value is something printable */
136 if (gen
->d
.otherName
->value
->type
== V_ASN1_IA5STRING
) {
137 if (X509V3_add_value_uchar(othername
,
138 gen
->d
.otherName
->value
->value
.ia5string
->data
,
142 if (gen
->d
.otherName
->value
->type
== V_ASN1_UTF8STRING
) {
143 if (X509V3_add_value_uchar(othername
,
144 gen
->d
.otherName
->value
->value
.utf8string
->data
,
148 if (!X509V3_add_value(othername
, "<unsupported>", &ret
))
155 if (!X509V3_add_value("X400Name", "<unsupported>", &ret
))
160 if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret
))
165 if (!X509V3_add_value_uchar("email", gen
->d
.ia5
->data
, &ret
))
170 if (!X509V3_add_value_uchar("DNS", gen
->d
.ia5
->data
, &ret
))
175 if (!X509V3_add_value_uchar("URI", gen
->d
.ia5
->data
, &ret
))
180 if (X509_NAME_oneline(gen
->d
.dirn
, oline
, sizeof(oline
)) == NULL
181 || !X509V3_add_value("DirName", oline
, &ret
))
187 if (gen
->d
.ip
->length
== 4)
188 BIO_snprintf(oline
, sizeof(oline
), "%d.%d.%d.%d",
189 p
[0], p
[1], p
[2], p
[3]);
190 else if (gen
->d
.ip
->length
== 16) {
192 for (i
= 0; i
< 8; i
++) {
193 BIO_snprintf(htmp
, sizeof(htmp
), "%X", p
[0] << 8 | p
[1]);
200 if (!X509V3_add_value("IP Address", "<invalid>", &ret
))
204 if (!X509V3_add_value("IP Address", oline
, &ret
))
209 i2t_ASN1_OBJECT(oline
, 256, gen
->d
.rid
);
210 if (!X509V3_add_value("Registered ID", oline
, &ret
))
217 int GENERAL_NAME_print(BIO
*out
, GENERAL_NAME
*gen
)
224 nid
= OBJ_obj2nid(gen
->d
.otherName
->type_id
);
225 /* Validate the types are as we expect before we use them */
226 if ((nid
== NID_SRVName
227 && gen
->d
.otherName
->value
->type
!= V_ASN1_IA5STRING
)
228 || (nid
!= NID_SRVName
229 && gen
->d
.otherName
->value
->type
!= V_ASN1_UTF8STRING
)) {
230 BIO_printf(out
, "othername:<unsupported>");
235 case NID_id_on_SmtpUTF8Mailbox
:
236 BIO_printf(out
, "othername:SmtpUTF8Mailbox:%s",
237 gen
->d
.otherName
->value
->value
.utf8string
->data
);
240 BIO_printf(out
, "othername:XmppAddr:%s",
241 gen
->d
.otherName
->value
->value
.utf8string
->data
);
244 BIO_printf(out
, "othername:SRVName:%s",
245 gen
->d
.otherName
->value
->value
.ia5string
->data
);
248 BIO_printf(out
, "othername:UPN:%s",
249 gen
->d
.otherName
->value
->value
.utf8string
->data
);
252 BIO_printf(out
, "othername:NAIRealm:%s",
253 gen
->d
.otherName
->value
->value
.utf8string
->data
);
256 BIO_printf(out
, "othername:<unsupported>");
262 BIO_printf(out
, "X400Name:<unsupported>");
266 /* Maybe fix this: it is supported now */
267 BIO_printf(out
, "EdiPartyName:<unsupported>");
271 BIO_printf(out
, "email:");
272 ASN1_STRING_print(out
, gen
->d
.ia5
);
276 BIO_printf(out
, "DNS:");
277 ASN1_STRING_print(out
, gen
->d
.ia5
);
281 BIO_printf(out
, "URI:");
282 ASN1_STRING_print(out
, gen
->d
.ia5
);
286 BIO_printf(out
, "DirName:");
287 X509_NAME_print_ex(out
, gen
->d
.dirn
, 0, XN_FLAG_ONELINE
);
292 if (gen
->d
.ip
->length
== 4)
293 BIO_printf(out
, "IP Address:%d.%d.%d.%d", p
[0], p
[1], p
[2], p
[3]);
294 else if (gen
->d
.ip
->length
== 16) {
295 BIO_printf(out
, "IP Address");
296 for (i
= 0; i
< 8; i
++) {
297 BIO_printf(out
, ":%X", p
[0] << 8 | p
[1]);
301 BIO_printf(out
, "IP Address:<invalid>");
307 BIO_printf(out
, "Registered ID:");
308 i2a_ASN1_OBJECT(out
, gen
->d
.rid
);
314 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
316 STACK_OF(CONF_VALUE
) *nval
)
318 const int num
= sk_CONF_VALUE_num(nval
);
319 GENERAL_NAMES
*gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
323 X509V3err(X509V3_F_V2I_ISSUER_ALT
, ERR_R_MALLOC_FAILURE
);
324 sk_GENERAL_NAME_free(gens
);
327 for (i
= 0; i
< num
; i
++) {
328 CONF_VALUE
*cnf
= sk_CONF_VALUE_value(nval
, i
);
330 if (!v3_name_cmp(cnf
->name
, "issuer")
331 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
332 if (!copy_issuer(ctx
, gens
))
335 GENERAL_NAME
*gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
);
339 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
344 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
348 /* Append subject altname of issuer to issuer alt name of subject */
350 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
)
357 if (ctx
&& (ctx
->flags
== CTX_TEST
))
359 if (!ctx
|| !ctx
->issuer_cert
) {
360 X509V3err(X509V3_F_COPY_ISSUER
, X509V3_R_NO_ISSUER_DETAILS
);
363 i
= X509_get_ext_by_NID(ctx
->issuer_cert
, NID_subject_alt_name
, -1);
366 if ((ext
= X509_get_ext(ctx
->issuer_cert
, i
)) == NULL
367 || (ialt
= X509V3_EXT_d2i(ext
)) == NULL
) {
368 X509V3err(X509V3_F_COPY_ISSUER
, X509V3_R_ISSUER_DECODE_ERROR
);
372 num
= sk_GENERAL_NAME_num(ialt
);
373 if (!sk_GENERAL_NAME_reserve(gens
, num
)) {
374 X509V3err(X509V3_F_COPY_ISSUER
, ERR_R_MALLOC_FAILURE
);
378 for (i
= 0; i
< num
; i
++) {
379 gen
= sk_GENERAL_NAME_value(ialt
, i
);
380 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
382 sk_GENERAL_NAME_free(ialt
);
391 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
393 STACK_OF(CONF_VALUE
) *nval
)
397 const int num
= sk_CONF_VALUE_num(nval
);
400 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
402 X509V3err(X509V3_F_V2I_SUBJECT_ALT
, ERR_R_MALLOC_FAILURE
);
403 sk_GENERAL_NAME_free(gens
);
407 for (i
= 0; i
< num
; i
++) {
408 cnf
= sk_CONF_VALUE_value(nval
, i
);
409 if (!v3_name_cmp(cnf
->name
, "email")
410 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
411 if (!copy_email(ctx
, gens
, 0))
413 } else if (!v3_name_cmp(cnf
->name
, "email")
414 && cnf
->value
&& strcmp(cnf
->value
, "move") == 0) {
415 if (!copy_email(ctx
, gens
, 1))
419 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
421 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
426 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
431 * Copy any email addresses in a certificate or request to GENERAL_NAMES
434 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
)
437 ASN1_IA5STRING
*email
= NULL
;
439 GENERAL_NAME
*gen
= NULL
;
442 if (ctx
!= NULL
&& ctx
->flags
== CTX_TEST
)
445 || (ctx
->subject_cert
== NULL
&& ctx
->subject_req
== NULL
)) {
446 X509V3err(X509V3_F_COPY_EMAIL
, X509V3_R_NO_SUBJECT_DETAILS
);
449 /* Find the subject name */
450 if (ctx
->subject_cert
)
451 nm
= X509_get_subject_name(ctx
->subject_cert
);
453 nm
= X509_REQ_get_subject_name(ctx
->subject_req
);
455 /* Now add any email address(es) to STACK */
456 while ((i
= X509_NAME_get_index_by_NID(nm
,
457 NID_pkcs9_emailAddress
, i
)) >= 0) {
458 ne
= X509_NAME_get_entry(nm
, i
);
459 email
= ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne
));
461 X509_NAME_delete_entry(nm
, i
);
462 X509_NAME_ENTRY_free(ne
);
465 if (email
== NULL
|| (gen
= GENERAL_NAME_new()) == NULL
) {
466 X509V3err(X509V3_F_COPY_EMAIL
, ERR_R_MALLOC_FAILURE
);
471 gen
->type
= GEN_EMAIL
;
472 if (!sk_GENERAL_NAME_push(gens
, gen
)) {
473 X509V3err(X509V3_F_COPY_EMAIL
, ERR_R_MALLOC_FAILURE
);
482 GENERAL_NAME_free(gen
);
483 ASN1_IA5STRING_free(email
);
488 GENERAL_NAMES
*v2i_GENERAL_NAMES(const X509V3_EXT_METHOD
*method
,
489 X509V3_CTX
*ctx
, STACK_OF(CONF_VALUE
) *nval
)
494 const int num
= sk_CONF_VALUE_num(nval
);
497 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
499 X509V3err(X509V3_F_V2I_GENERAL_NAMES
, ERR_R_MALLOC_FAILURE
);
500 sk_GENERAL_NAME_free(gens
);
504 for (i
= 0; i
< num
; i
++) {
505 cnf
= sk_CONF_VALUE_value(nval
, i
);
506 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
508 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
512 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
516 GENERAL_NAME
*v2i_GENERAL_NAME(const X509V3_EXT_METHOD
*method
,
517 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
)
519 return v2i_GENERAL_NAME_ex(NULL
, method
, ctx
, cnf
, 0);
522 GENERAL_NAME
*a2i_GENERAL_NAME(GENERAL_NAME
*out
,
523 const X509V3_EXT_METHOD
*method
,
524 X509V3_CTX
*ctx
, int gen_type
, const char *value
,
528 GENERAL_NAME
*gen
= NULL
;
531 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_MISSING_VALUE
);
538 gen
= GENERAL_NAME_new();
540 X509V3err(X509V3_F_A2I_GENERAL_NAME
, ERR_R_MALLOC_FAILURE
);
555 if ((obj
= OBJ_txt2obj(value
, 0)) == NULL
) {
556 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_BAD_OBJECT
);
557 ERR_add_error_data(2, "value=", value
);
566 gen
->d
.ip
= a2i_IPADDRESS_NC(value
);
568 gen
->d
.ip
= a2i_IPADDRESS(value
);
569 if (gen
->d
.ip
== NULL
) {
570 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_BAD_IP_ADDRESS
);
571 ERR_add_error_data(2, "value=", value
);
577 if (!do_dirname(gen
, value
, ctx
)) {
578 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_DIRNAME_ERROR
);
584 if (!do_othername(gen
, value
, ctx
)) {
585 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_OTHERNAME_ERROR
);
590 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_UNSUPPORTED_TYPE
);
595 if ((gen
->d
.ia5
= ASN1_IA5STRING_new()) == NULL
||
596 !ASN1_STRING_set(gen
->d
.ia5
, (unsigned char *)value
,
598 X509V3err(X509V3_F_A2I_GENERAL_NAME
, ERR_R_MALLOC_FAILURE
);
603 gen
->type
= gen_type
;
609 GENERAL_NAME_free(gen
);
613 GENERAL_NAME
*v2i_GENERAL_NAME_ex(GENERAL_NAME
*out
,
614 const X509V3_EXT_METHOD
*method
,
615 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
, int is_nc
)
625 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX
, X509V3_R_MISSING_VALUE
);
629 if (!v3_name_cmp(name
, "email"))
631 else if (!v3_name_cmp(name
, "URI"))
633 else if (!v3_name_cmp(name
, "DNS"))
635 else if (!v3_name_cmp(name
, "RID"))
637 else if (!v3_name_cmp(name
, "IP"))
639 else if (!v3_name_cmp(name
, "dirName"))
641 else if (!v3_name_cmp(name
, "otherName"))
642 type
= GEN_OTHERNAME
;
644 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX
, X509V3_R_UNSUPPORTED_OPTION
);
645 ERR_add_error_data(2, "name=", name
);
649 return a2i_GENERAL_NAME(out
, method
, ctx
, type
, value
, is_nc
);
653 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
655 char *objtmp
= NULL
, *p
;
658 if ((p
= strchr(value
, ';')) == NULL
)
660 if ((gen
->d
.otherName
= OTHERNAME_new()) == NULL
)
663 * Free this up because we will overwrite it. no need to free type_id
664 * because it is static
666 ASN1_TYPE_free(gen
->d
.otherName
->value
);
667 if ((gen
->d
.otherName
->value
= ASN1_generate_v3(p
+ 1, ctx
)) == NULL
)
670 objtmp
= OPENSSL_strndup(value
, objlen
);
673 gen
->d
.otherName
->type_id
= OBJ_txt2obj(objtmp
, 0);
674 OPENSSL_free(objtmp
);
675 if (!gen
->d
.otherName
->type_id
)
680 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
683 STACK_OF(CONF_VALUE
) *sk
= NULL
;
686 if ((nm
= X509_NAME_new()) == NULL
)
688 sk
= X509V3_get_section(ctx
, value
);
690 X509V3err(X509V3_F_DO_DIRNAME
, X509V3_R_SECTION_NOT_FOUND
);
691 ERR_add_error_data(2, "section=", value
);
694 /* FIXME: should allow other character types... */
695 ret
= X509V3_NAME_from_section(nm
, sk
, MBSTRING_ASC
);
703 X509V3_section_free(ctx
, sk
);