2 * Copyright 1999-2017 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include <openssl/conf.h>
13 #include <openssl/x509v3.h>
16 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
18 STACK_OF(CONF_VALUE
) *nval
);
19 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
21 STACK_OF(CONF_VALUE
) *nval
);
22 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
);
23 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
);
24 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
25 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
);
27 const X509V3_EXT_METHOD v3_alt
[3] = {
28 {NID_subject_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
31 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
32 (X509V3_EXT_V2I
)v2i_subject_alt
,
35 {NID_issuer_alt_name
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
38 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
39 (X509V3_EXT_V2I
)v2i_issuer_alt
,
42 {NID_certificate_issuer
, 0, ASN1_ITEM_ref(GENERAL_NAMES
),
45 (X509V3_EXT_I2V
) i2v_GENERAL_NAMES
,
46 NULL
, NULL
, NULL
, NULL
},
49 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD
*method
,
51 STACK_OF(CONF_VALUE
) *ret
)
55 for (i
= 0; i
< sk_GENERAL_NAME_num(gens
); i
++) {
56 gen
= sk_GENERAL_NAME_value(gens
, i
);
57 ret
= i2v_GENERAL_NAME(method
, gen
, ret
);
60 return sk_CONF_VALUE_new_null();
64 STACK_OF(CONF_VALUE
) *i2v_GENERAL_NAME(X509V3_EXT_METHOD
*method
,
66 STACK_OF(CONF_VALUE
) *ret
)
69 char oline
[256], htmp
[5];
74 if (!X509V3_add_value("othername", "<unsupported>", &ret
))
79 if (!X509V3_add_value("X400Name", "<unsupported>", &ret
))
84 if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret
))
89 if (!X509V3_add_value_uchar("email", gen
->d
.ia5
->data
, &ret
))
94 if (!X509V3_add_value_uchar("DNS", gen
->d
.ia5
->data
, &ret
))
99 if (!X509V3_add_value_uchar("URI", gen
->d
.ia5
->data
, &ret
))
104 if (X509_NAME_oneline(gen
->d
.dirn
, oline
, sizeof(oline
)) == NULL
105 || !X509V3_add_value("DirName", oline
, &ret
))
111 if (gen
->d
.ip
->length
== 4)
112 BIO_snprintf(oline
, sizeof(oline
), "%d.%d.%d.%d",
113 p
[0], p
[1], p
[2], p
[3]);
114 else if (gen
->d
.ip
->length
== 16) {
116 for (i
= 0; i
< 8; i
++) {
117 BIO_snprintf(htmp
, sizeof(htmp
), "%X", p
[0] << 8 | p
[1]);
124 if (!X509V3_add_value("IP Address", "<invalid>", &ret
))
128 if (!X509V3_add_value("IP Address", oline
, &ret
))
133 i2t_ASN1_OBJECT(oline
, 256, gen
->d
.rid
);
134 if (!X509V3_add_value("Registered ID", oline
, &ret
))
141 int GENERAL_NAME_print(BIO
*out
, GENERAL_NAME
*gen
)
147 BIO_printf(out
, "othername:<unsupported>");
151 BIO_printf(out
, "X400Name:<unsupported>");
155 /* Maybe fix this: it is supported now */
156 BIO_printf(out
, "EdiPartyName:<unsupported>");
160 BIO_printf(out
, "email:%s", gen
->d
.ia5
->data
);
164 BIO_printf(out
, "DNS:%s", gen
->d
.ia5
->data
);
168 BIO_printf(out
, "URI:%s", gen
->d
.ia5
->data
);
172 BIO_printf(out
, "DirName:");
173 X509_NAME_print_ex(out
, gen
->d
.dirn
, 0, XN_FLAG_ONELINE
);
178 if (gen
->d
.ip
->length
== 4)
179 BIO_printf(out
, "IP Address:%d.%d.%d.%d", p
[0], p
[1], p
[2], p
[3]);
180 else if (gen
->d
.ip
->length
== 16) {
181 BIO_printf(out
, "IP Address");
182 for (i
= 0; i
< 8; i
++) {
183 BIO_printf(out
, ":%X", p
[0] << 8 | p
[1]);
187 BIO_printf(out
, "IP Address:<invalid>");
193 BIO_printf(out
, "Registered ID:");
194 i2a_ASN1_OBJECT(out
, gen
->d
.rid
);
200 static GENERAL_NAMES
*v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
202 STACK_OF(CONF_VALUE
) *nval
)
204 const int num
= sk_CONF_VALUE_num(nval
);
205 GENERAL_NAMES
*gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
209 X509V3err(X509V3_F_V2I_ISSUER_ALT
, ERR_R_MALLOC_FAILURE
);
210 sk_GENERAL_NAME_free(gens
);
213 for (i
= 0; i
< num
; i
++) {
214 CONF_VALUE
*cnf
= sk_CONF_VALUE_value(nval
, i
);
216 if (!name_cmp(cnf
->name
, "issuer")
217 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
218 if (!copy_issuer(ctx
, gens
))
221 GENERAL_NAME
*gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
);
225 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
230 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
234 /* Append subject altname of issuer to issuer alt name of subject */
236 static int copy_issuer(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
)
243 if (ctx
&& (ctx
->flags
== CTX_TEST
))
245 if (!ctx
|| !ctx
->issuer_cert
) {
246 X509V3err(X509V3_F_COPY_ISSUER
, X509V3_R_NO_ISSUER_DETAILS
);
249 i
= X509_get_ext_by_NID(ctx
->issuer_cert
, NID_subject_alt_name
, -1);
252 if ((ext
= X509_get_ext(ctx
->issuer_cert
, i
)) == NULL
253 || (ialt
= X509V3_EXT_d2i(ext
)) == NULL
) {
254 X509V3err(X509V3_F_COPY_ISSUER
, X509V3_R_ISSUER_DECODE_ERROR
);
258 num
= sk_GENERAL_NAME_num(ialt
);
259 if (!sk_GENERAL_NAME_reserve(gens
, num
)) {
260 X509V3err(X509V3_F_COPY_ISSUER
, ERR_R_MALLOC_FAILURE
);
264 for (i
= 0; i
< num
; i
++) {
265 gen
= sk_GENERAL_NAME_value(ialt
, i
);
266 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
268 sk_GENERAL_NAME_free(ialt
);
277 static GENERAL_NAMES
*v2i_subject_alt(X509V3_EXT_METHOD
*method
,
279 STACK_OF(CONF_VALUE
) *nval
)
283 const int num
= sk_CONF_VALUE_num(nval
);
286 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
288 X509V3err(X509V3_F_V2I_SUBJECT_ALT
, ERR_R_MALLOC_FAILURE
);
289 sk_GENERAL_NAME_free(gens
);
293 for (i
= 0; i
< num
; i
++) {
294 cnf
= sk_CONF_VALUE_value(nval
, i
);
295 if (!name_cmp(cnf
->name
, "email")
296 && cnf
->value
&& strcmp(cnf
->value
, "copy") == 0) {
297 if (!copy_email(ctx
, gens
, 0))
299 } else if (!name_cmp(cnf
->name
, "email")
300 && cnf
->value
&& strcmp(cnf
->value
, "move") == 0) {
301 if (!copy_email(ctx
, gens
, 1))
305 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
307 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
312 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
317 * Copy any email addresses in a certificate or request to GENERAL_NAMES
320 static int copy_email(X509V3_CTX
*ctx
, GENERAL_NAMES
*gens
, int move_p
)
323 ASN1_IA5STRING
*email
= NULL
;
325 GENERAL_NAME
*gen
= NULL
;
328 if (ctx
!= NULL
&& ctx
->flags
== CTX_TEST
)
331 || (ctx
->subject_cert
== NULL
&& ctx
->subject_req
== NULL
)) {
332 X509V3err(X509V3_F_COPY_EMAIL
, X509V3_R_NO_SUBJECT_DETAILS
);
335 /* Find the subject name */
336 if (ctx
->subject_cert
)
337 nm
= X509_get_subject_name(ctx
->subject_cert
);
339 nm
= X509_REQ_get_subject_name(ctx
->subject_req
);
341 /* Now add any email address(es) to STACK */
342 while ((i
= X509_NAME_get_index_by_NID(nm
,
343 NID_pkcs9_emailAddress
, i
)) >= 0) {
344 ne
= X509_NAME_get_entry(nm
, i
);
345 email
= ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne
));
347 X509_NAME_delete_entry(nm
, i
);
348 X509_NAME_ENTRY_free(ne
);
351 if (email
== NULL
|| (gen
= GENERAL_NAME_new()) == NULL
) {
352 X509V3err(X509V3_F_COPY_EMAIL
, ERR_R_MALLOC_FAILURE
);
357 gen
->type
= GEN_EMAIL
;
358 if (!sk_GENERAL_NAME_push(gens
, gen
)) {
359 X509V3err(X509V3_F_COPY_EMAIL
, ERR_R_MALLOC_FAILURE
);
368 GENERAL_NAME_free(gen
);
369 ASN1_IA5STRING_free(email
);
374 GENERAL_NAMES
*v2i_GENERAL_NAMES(const X509V3_EXT_METHOD
*method
,
375 X509V3_CTX
*ctx
, STACK_OF(CONF_VALUE
) *nval
)
380 const int num
= sk_CONF_VALUE_num(nval
);
383 gens
= sk_GENERAL_NAME_new_reserve(NULL
, num
);
385 X509V3err(X509V3_F_V2I_GENERAL_NAMES
, ERR_R_MALLOC_FAILURE
);
386 sk_GENERAL_NAME_free(gens
);
390 for (i
= 0; i
< num
; i
++) {
391 cnf
= sk_CONF_VALUE_value(nval
, i
);
392 if ((gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)) == NULL
)
394 sk_GENERAL_NAME_push(gens
, gen
); /* no failure as it was reserved */
398 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
402 GENERAL_NAME
*v2i_GENERAL_NAME(const X509V3_EXT_METHOD
*method
,
403 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
)
405 return v2i_GENERAL_NAME_ex(NULL
, method
, ctx
, cnf
, 0);
408 GENERAL_NAME
*a2i_GENERAL_NAME(GENERAL_NAME
*out
,
409 const X509V3_EXT_METHOD
*method
,
410 X509V3_CTX
*ctx
, int gen_type
, const char *value
,
414 GENERAL_NAME
*gen
= NULL
;
417 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_MISSING_VALUE
);
424 gen
= GENERAL_NAME_new();
426 X509V3err(X509V3_F_A2I_GENERAL_NAME
, ERR_R_MALLOC_FAILURE
);
441 if ((obj
= OBJ_txt2obj(value
, 0)) == NULL
) {
442 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_BAD_OBJECT
);
443 ERR_add_error_data(2, "value=", value
);
452 gen
->d
.ip
= a2i_IPADDRESS_NC(value
);
454 gen
->d
.ip
= a2i_IPADDRESS(value
);
455 if (gen
->d
.ip
== NULL
) {
456 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_BAD_IP_ADDRESS
);
457 ERR_add_error_data(2, "value=", value
);
463 if (!do_dirname(gen
, value
, ctx
)) {
464 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_DIRNAME_ERROR
);
470 if (!do_othername(gen
, value
, ctx
)) {
471 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_OTHERNAME_ERROR
);
476 X509V3err(X509V3_F_A2I_GENERAL_NAME
, X509V3_R_UNSUPPORTED_TYPE
);
481 if ((gen
->d
.ia5
= ASN1_IA5STRING_new()) == NULL
||
482 !ASN1_STRING_set(gen
->d
.ia5
, (unsigned char *)value
,
484 X509V3err(X509V3_F_A2I_GENERAL_NAME
, ERR_R_MALLOC_FAILURE
);
489 gen
->type
= gen_type
;
495 GENERAL_NAME_free(gen
);
499 GENERAL_NAME
*v2i_GENERAL_NAME_ex(GENERAL_NAME
*out
,
500 const X509V3_EXT_METHOD
*method
,
501 X509V3_CTX
*ctx
, CONF_VALUE
*cnf
, int is_nc
)
511 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX
, X509V3_R_MISSING_VALUE
);
515 if (!name_cmp(name
, "email"))
517 else if (!name_cmp(name
, "URI"))
519 else if (!name_cmp(name
, "DNS"))
521 else if (!name_cmp(name
, "RID"))
523 else if (!name_cmp(name
, "IP"))
525 else if (!name_cmp(name
, "dirName"))
527 else if (!name_cmp(name
, "otherName"))
528 type
= GEN_OTHERNAME
;
530 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX
, X509V3_R_UNSUPPORTED_OPTION
);
531 ERR_add_error_data(2, "name=", name
);
535 return a2i_GENERAL_NAME(out
, method
, ctx
, type
, value
, is_nc
);
539 static int do_othername(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
541 char *objtmp
= NULL
, *p
;
544 if ((p
= strchr(value
, ';')) == NULL
)
546 if ((gen
->d
.otherName
= OTHERNAME_new()) == NULL
)
549 * Free this up because we will overwrite it. no need to free type_id
550 * because it is static
552 ASN1_TYPE_free(gen
->d
.otherName
->value
);
553 if ((gen
->d
.otherName
->value
= ASN1_generate_v3(p
+ 1, ctx
)) == NULL
)
556 objtmp
= OPENSSL_strndup(value
, objlen
);
559 gen
->d
.otherName
->type_id
= OBJ_txt2obj(objtmp
, 0);
560 OPENSSL_free(objtmp
);
561 if (!gen
->d
.otherName
->type_id
)
566 static int do_dirname(GENERAL_NAME
*gen
, const char *value
, X509V3_CTX
*ctx
)
569 STACK_OF(CONF_VALUE
) *sk
= NULL
;
572 if ((nm
= X509_NAME_new()) == NULL
)
574 sk
= X509V3_get_section(ctx
, value
);
576 X509V3err(X509V3_F_DO_DIRNAME
, X509V3_R_SECTION_NOT_FOUND
);
577 ERR_add_error_data(2, "section=", value
);
580 /* FIXME: should allow other character types... */
581 ret
= X509V3_NAME_from_section(nm
, sk
, MBSTRING_ASC
);
589 X509V3_section_free(ctx
, sk
);