2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
5 /* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
34 * 6. Redistributions of any form whatsoever must retain the following
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
65 static STACK_OF(GENERAL_NAME
) *v2i_subject_alt(X509V3_EXT_METHOD
*method
, X509V3_CTX
*ctx
, STACK
*nval
);
66 static STACK_OF(GENERAL_NAME
) *v2i_issuer_alt(X509V3_EXT_METHOD
*method
, X509V3_CTX
*ctx
, STACK
*nval
);
67 static int copy_email(X509V3_CTX
*ctx
, STACK_OF(GENERAL_NAME
) *gens
);
68 static int copy_issuer(X509V3_CTX
*ctx
, STACK_OF(GENERAL_NAME
) *gens
);
70 static STACK
*v2i_issuer_alt();
71 static STACK
*v2i_subject_alt();
72 static int copy_email();
73 static int copy_issuer();
76 X509V3_EXT_METHOD v3_alt
[] = {
77 { NID_subject_alt_name
, 0,
78 (X509V3_EXT_NEW
)GENERAL_NAMES_new
,
80 (X509V3_EXT_D2I
)d2i_GENERAL_NAMES
,
83 (X509V3_EXT_I2V
)i2v_GENERAL_NAMES
,
84 (X509V3_EXT_V2I
)v2i_subject_alt
,
86 { NID_issuer_alt_name
, 0,
87 (X509V3_EXT_NEW
)GENERAL_NAMES_new
,
89 (X509V3_EXT_D2I
)d2i_GENERAL_NAMES
,
92 (X509V3_EXT_I2V
)i2v_GENERAL_NAMES
,
93 (X509V3_EXT_V2I
)v2i_issuer_alt
,
98 STACK
*i2v_GENERAL_NAMES(X509V3_EXT_METHOD
*method
,
99 STACK_OF(GENERAL_NAME
) *gens
, STACK
*ret
)
103 for(i
= 0; i
< sk_GENERAL_NAME_num(gens
); i
++) {
104 gen
= sk_GENERAL_NAME_value(gens
, i
);
105 ret
= i2v_GENERAL_NAME(method
, gen
, ret
);
110 STACK
*i2v_GENERAL_NAME(X509V3_EXT_METHOD
*method
, GENERAL_NAME
*gen
,
118 X509V3_add_value("othername","<unsupported>", &ret
);
122 X509V3_add_value("X400Name","<unsupported>", &ret
);
126 X509V3_add_value("EdiPartyName","<unsupported>", &ret
);
130 X509V3_add_value("email",gen
->d
.ia5
->data
, &ret
);
134 X509V3_add_value("DNS",gen
->d
.ia5
->data
, &ret
);
138 X509V3_add_value("URI",gen
->d
.ia5
->data
, &ret
);
142 X509_NAME_oneline(gen
->d
.dirn
, oline
, 256);
143 X509V3_add_value("DirName",oline
, &ret
);
148 /* BUG: doesn't support IPV6 */
149 if(gen
->d
.ip
->length
!= 4) {
150 X509V3_add_value("IP Address","<invalid>", &ret
);
153 sprintf(oline
, "%d.%d.%d.%d", p
[0], p
[1], p
[2], p
[3]);
154 X509V3_add_value("IP Address",oline
, &ret
);
158 i2t_ASN1_OBJECT(oline
, 256, gen
->d
.rid
);
159 X509V3_add_value("Registered ID",oline
, &ret
);
165 static STACK_OF(GENERAL_NAME
) *v2i_issuer_alt(X509V3_EXT_METHOD
*method
,
166 X509V3_CTX
*ctx
, STACK
*nval
)
168 STACK_OF(GENERAL_NAME
) *gens
= NULL
;
171 if(!(gens
= sk_GENERAL_NAME_new(NULL
))) {
172 X509V3err(X509V3_F_V2I_GENERAL_NAMES
,ERR_R_MALLOC_FAILURE
);
175 for(i
= 0; i
< sk_num(nval
); i
++) {
176 cnf
= (CONF_VALUE
*)sk_value(nval
, i
);
177 if(!name_cmp(cnf
->name
, "issuer") && cnf
->value
&&
178 !strcmp(cnf
->value
, "copy")) {
179 if(!copy_issuer(ctx
, gens
)) goto err
;
182 if(!(gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)))
184 sk_GENERAL_NAME_push(gens
, gen
);
189 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
193 /* Append subject altname of issuer to issuer alt name of subject */
195 static int copy_issuer(X509V3_CTX
*ctx
, STACK_OF(GENERAL_NAME
) *gens
)
197 STACK_OF(GENERAL_NAME
) *ialt
;
201 if(ctx
&& (ctx
->flags
== CTX_TEST
)) return 1;
202 if(!ctx
|| !ctx
->issuer_cert
) {
203 X509V3err(X509V3_F_COPY_ISSUER
,X509V3_R_NO_ISSUER_DETAILS
);
206 i
= X509_get_ext_by_NID(ctx
->issuer_cert
, NID_subject_alt_name
, -1);
208 if(!(ext
= X509_get_ext(ctx
->issuer_cert
, i
)) ||
209 !(ialt
= X509V3_EXT_d2i(ext
)) ) {
210 X509V3err(X509V3_F_COPY_ISSUER
,X509V3_R_ISSUER_DECODE_ERROR
);
214 for(i
= 0; i
< sk_GENERAL_NAME_num(ialt
); i
++) {
215 gen
= sk_GENERAL_NAME_value(ialt
, i
);
216 if(!sk_GENERAL_NAME_push(gens
, gen
)) {
217 X509V3err(X509V3_F_COPY_ISSUER
,ERR_R_MALLOC_FAILURE
);
221 sk_GENERAL_NAME_free(ialt
);
230 static STACK_OF(GENERAL_NAME
) *v2i_subject_alt(X509V3_EXT_METHOD
*method
,
231 X509V3_CTX
*ctx
, STACK
*nval
)
233 STACK_OF(GENERAL_NAME
) *gens
= NULL
;
236 if(!(gens
= sk_GENERAL_NAME_new(NULL
))) {
237 X509V3err(X509V3_F_V2I_GENERAL_NAMES
,ERR_R_MALLOC_FAILURE
);
240 for(i
= 0; i
< sk_num(nval
); i
++) {
241 cnf
= (CONF_VALUE
*)sk_value(nval
, i
);
242 if(!name_cmp(cnf
->name
, "email") && cnf
->value
&&
243 !strcmp(cnf
->value
, "copy")) {
244 if(!copy_email(ctx
, gens
)) goto err
;
247 if(!(gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
)))
249 sk_GENERAL_NAME_push(gens
, gen
);
254 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
258 /* Copy any email addresses in a certificate or request to
262 static int copy_email(X509V3_CTX
*ctx
, STACK_OF(GENERAL_NAME
) *gens
)
265 ASN1_IA5STRING
*email
= NULL
;
267 GENERAL_NAME
*gen
= NULL
;
269 if(ctx
->flags
== CTX_TEST
) return 1;
270 if(!ctx
|| (!ctx
->subject_cert
&& !ctx
->subject_req
)) {
271 X509V3err(X509V3_F_COPY_EMAIL
,X509V3_R_NO_SUBJECT_DETAILS
);
274 /* Find the subject name */
275 if(ctx
->subject_cert
) nm
= X509_get_subject_name(ctx
->subject_cert
);
276 else nm
= X509_REQ_get_subject_name(ctx
->subject_req
);
278 /* Now add any email address(es) to STACK */
280 while((i
= X509_NAME_get_index_by_NID(nm
,
281 NID_pkcs9_emailAddress
, i
)) > 0) {
282 ne
= X509_NAME_get_entry(nm
, i
);
283 email
= ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne
));
284 if(!email
|| !(gen
= GENERAL_NAME_new())) {
285 X509V3err(X509V3_F_COPY_EMAIL
,ERR_R_MALLOC_FAILURE
);
290 gen
->type
= GEN_EMAIL
;
291 if(!sk_GENERAL_NAME_push(gens
, gen
)) {
292 X509V3err(X509V3_F_COPY_EMAIL
,ERR_R_MALLOC_FAILURE
);
302 GENERAL_NAME_free(gen
);
303 ASN1_IA5STRING_free(email
);
308 STACK_OF(GENERAL_NAME
) *v2i_GENERAL_NAMES(X509V3_EXT_METHOD
*method
,
309 X509V3_CTX
*ctx
, STACK
*nval
)
312 STACK_OF(GENERAL_NAME
) *gens
= NULL
;
315 if(!(gens
= sk_GENERAL_NAME_new(NULL
))) {
316 X509V3err(X509V3_F_V2I_GENERAL_NAMES
,ERR_R_MALLOC_FAILURE
);
319 for(i
= 0; i
< sk_num(nval
); i
++) {
320 cnf
= (CONF_VALUE
*)sk_value(nval
, i
);
321 if(!(gen
= v2i_GENERAL_NAME(method
, ctx
, cnf
))) goto err
;
322 sk_GENERAL_NAME_push(gens
, gen
);
326 sk_GENERAL_NAME_pop_free(gens
, GENERAL_NAME_free
);
330 GENERAL_NAME
*v2i_GENERAL_NAME(X509V3_EXT_METHOD
*method
, X509V3_CTX
*ctx
,
335 GENERAL_NAME
*gen
= NULL
;
343 X509V3err(X509V3_F_V2I_GENERAL_NAME
,X509V3_R_MISSING_VALUE
);
347 if(!(gen
= GENERAL_NAME_new())) {
348 X509V3err(X509V3_F_V2I_GENERAL_NAME
,ERR_R_MALLOC_FAILURE
);
352 if(!name_cmp(name
, "email")) {
355 } else if(!name_cmp(name
, "URI")) {
358 } else if(!name_cmp(name
, "DNS")) {
361 } else if(!name_cmp(name
, "RID")) {
363 if(!(obj
= OBJ_txt2obj(value
,0))) {
364 X509V3err(X509V3_F_V2I_GENERAL_NAME
,X509V3_R_BAD_OBJECT
);
365 ERR_add_error_data(2, "value=", value
);
370 } else if(!name_cmp(name
, "IP")) {
373 if((sscanf(value
, "%d.%d.%d.%d",&i1
,&i2
,&i3
,&i4
) != 4) ||
374 (i1
< 0) || (i1
> 255) || (i2
< 0) || (i2
> 255) ||
375 (i3
< 0) || (i3
> 255) || (i4
< 0) || (i4
> 255) ) {
376 X509V3err(X509V3_F_V2I_GENERAL_NAME
,X509V3_R_BAD_IP_ADDRESS
);
377 ERR_add_error_data(2, "value=", value
);
380 ip
[0] = i1
; ip
[1] = i2
; ip
[2] = i3
; ip
[3] = i4
;
381 if(!(gen
->d
.ip
= ASN1_OCTET_STRING_new()) ||
382 !ASN1_STRING_set(gen
->d
.ip
, ip
, 4)) {
383 X509V3err(X509V3_F_V2I_GENERAL_NAME
,ERR_R_MALLOC_FAILURE
);
388 X509V3err(X509V3_F_V2I_GENERAL_NAME
,X509V3_R_UNSUPPORTED_OPTION
);
389 ERR_add_error_data(2, "name=", name
);
394 if(!(gen
->d
.ia5
= ASN1_IA5STRING_new()) ||
395 !ASN1_STRING_set(gen
->d
.ia5
, value
, strlen(value
))) {
396 X509V3err(X509V3_F_V2I_GENERAL_NAME
,ERR_R_MALLOC_FAILURE
);
406 GENERAL_NAME_free(gen
);