crypto/x509v3/pcy_cache.c

   1 /*
   2  * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "internal/cryptlib.h"
  11 #include <openssl/x509.h>
  12 #include <openssl/x509v3.h>
  13 #include "internal/x509_int.h"
  14
  15 #include "pcy_int.h"
  16
  17 static int policy_data_cmp(const X509_POLICY_DATA *const *a,
  18                            const X509_POLICY_DATA *const *b);
  19 static int policy_cache_set_int(long *out, ASN1_INTEGER *value);
  20
  21 /*
  22  * Set cache entry according to CertificatePolicies extension. Note: this
  23  * destroys the passed CERTIFICATEPOLICIES structure.
  24  */
  25
  26 static int policy_cache_create(X509 *x,
  27                                CERTIFICATEPOLICIES *policies, int crit)
  28 {
  29     int i;
  30     int ret = 0;
  31     X509_POLICY_CACHE *cache = x->policy_cache;
  32     X509_POLICY_DATA *data = NULL;
  33     POLICYINFO *policy;
  34     if (sk_POLICYINFO_num(policies) == 0)
  35         goto bad_policy;
  36     cache->data = sk_X509_POLICY_DATA_new(policy_data_cmp);
  37     if (cache->data == NULL)
  38         goto bad_policy;
  39     for (i = 0; i < sk_POLICYINFO_num(policies); i++) {
  40         policy = sk_POLICYINFO_value(policies, i);
  41         data = policy_data_new(policy, NULL, crit);
  42         if (data == NULL)
  43             goto bad_policy;
  44         /*
  45          * Duplicate policy OIDs are illegal: reject if matches found.
  46          */
  47         if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) {
  48             if (cache->anyPolicy) {
  49                 ret = -1;
  50                 goto bad_policy;
  51             }
  52             cache->anyPolicy = data;
  53         } else if (sk_X509_POLICY_DATA_find(cache->data, data) != -1) {
  54             ret = -1;
  55             goto bad_policy;
  56         } else if (!sk_X509_POLICY_DATA_push(cache->data, data))
  57             goto bad_policy;
  58         data = NULL;
  59     }
  60     ret = 1;
  61  bad_policy:
  62     if (ret == -1)
  63         x->ex_flags |= EXFLAG_INVALID_POLICY;
  64     policy_data_free(data);
  65     sk_POLICYINFO_pop_free(policies, POLICYINFO_free);
  66     if (ret <= 0) {
  67         sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
  68         cache->data = NULL;
  69     }
  70     return ret;
  71 }
  72
  73 static int policy_cache_new(X509 *x)
  74 {
  75     X509_POLICY_CACHE *cache;
  76     ASN1_INTEGER *ext_any = NULL;
  77     POLICY_CONSTRAINTS *ext_pcons = NULL;
  78     CERTIFICATEPOLICIES *ext_cpols = NULL;
  79     POLICY_MAPPINGS *ext_pmaps = NULL;
  80     int i;
  81     cache = OPENSSL_malloc(sizeof(*cache));
  82     if (cache == NULL)
  83         return 0;
  84     cache->anyPolicy = NULL;
  85     cache->data = NULL;
  86     cache->any_skip = -1;
  87     cache->explicit_skip = -1;
  88     cache->map_skip = -1;
  89
  90     x->policy_cache = cache;
  91
  92     /*
  93      * Handle requireExplicitPolicy *first*. Need to process this even if we
  94      * don't have any policies.
  95      */
  96     ext_pcons = X509_get_ext_d2i(x, NID_policy_constraints, &i, NULL);
  97
  98     if (!ext_pcons) {
  99         if (i != -1)
 100             goto bad_cache;
 101     } else {
 102         if (!ext_pcons->requireExplicitPolicy
 103             && !ext_pcons->inhibitPolicyMapping)
 104             goto bad_cache;
 105         if (!policy_cache_set_int(&cache->explicit_skip,
 106                                   ext_pcons->requireExplicitPolicy))
 107             goto bad_cache;
 108         if (!policy_cache_set_int(&cache->map_skip,
 109                                   ext_pcons->inhibitPolicyMapping))
 110             goto bad_cache;
 111     }
 112
 113     /* Process CertificatePolicies */
 114
 115     ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);
 116     /*
 117      * If no CertificatePolicies extension or problem decoding then there is
 118      * no point continuing because the valid policies will be NULL.
 119      */
 120     if (!ext_cpols) {
 121         /* If not absent some problem with extension */
 122         if (i != -1)
 123             goto bad_cache;
 124         return 1;
 125     }
 126
 127     i = policy_cache_create(x, ext_cpols, i);
 128
 129     /* NB: ext_cpols freed by policy_cache_set_policies */
 130
 131     if (i <= 0)
 132         return i;
 133
 134     ext_pmaps = X509_get_ext_d2i(x, NID_policy_mappings, &i, NULL);
 135
 136     if (!ext_pmaps) {
 137         /* If not absent some problem with extension */
 138         if (i != -1)
 139             goto bad_cache;
 140     } else {
 141         i = policy_cache_set_mapping(x, ext_pmaps);
 142         if (i <= 0)
 143             goto bad_cache;
 144     }
 145
 146     ext_any = X509_get_ext_d2i(x, NID_inhibit_any_policy, &i, NULL);
 147
 148     if (!ext_any) {
 149         if (i != -1)
 150             goto bad_cache;
 151     } else if (!policy_cache_set_int(&cache->any_skip, ext_any))
 152         goto bad_cache;
 153     goto just_cleanup;
 154
 155  bad_cache:
 156     x->ex_flags |= EXFLAG_INVALID_POLICY;
 157
 158  just_cleanup:
 159     POLICY_CONSTRAINTS_free(ext_pcons);
 160     ASN1_INTEGER_free(ext_any);
 161     return 1;
 162
 163 }
 164
 165 void policy_cache_free(X509_POLICY_CACHE *cache)
 166 {
 167     if (!cache)
 168         return;
 169     policy_data_free(cache->anyPolicy);
 170     sk_X509_POLICY_DATA_pop_free(cache->data, policy_data_free);
 171     OPENSSL_free(cache);
 172 }
 173
 174 const X509_POLICY_CACHE *policy_cache_set(X509 *x)
 175 {
 176
 177     if (x->policy_cache == NULL) {
 178         CRYPTO_THREAD_write_lock(x->lock);
 179         policy_cache_new(x);
 180         CRYPTO_THREAD_unlock(x->lock);
 181     }
 182
 183     return x->policy_cache;
 184
 185 }
 186
 187 X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
 188                                          const ASN1_OBJECT *id)
 189 {
 190     int idx;
 191     X509_POLICY_DATA tmp;
 192     tmp.valid_policy = (ASN1_OBJECT *)id;
 193     idx = sk_X509_POLICY_DATA_find(cache->data, &tmp);
 194     if (idx == -1)
 195         return NULL;
 196     return sk_X509_POLICY_DATA_value(cache->data, idx);
 197 }
 198
 199 static int policy_data_cmp(const X509_POLICY_DATA *const *a,
 200                            const X509_POLICY_DATA *const *b)
 201 {
 202     return OBJ_cmp((*a)->valid_policy, (*b)->valid_policy);
 203 }
 204
 205 static int policy_cache_set_int(long *out, ASN1_INTEGER *value)
 206 {
 207     if (value == NULL)
 208         return 1;
 209     if (value->type == V_ASN1_NEG_INTEGER)
 210         return 0;
 211     *out = ASN1_INTEGER_get(value);
 212     return 1;
 213 }