crypto/x509/v3_lib.c

   1 /*
   2  * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /* X509 v3 extension utilities */
  11
  12 #include <stdio.h>
  13 #include "internal/cryptlib.h"
  14 #include <openssl/conf.h>
  15 #include <openssl/x509v3.h>
  16
  17 #include "ext_dat.h"
  18
  19 DEFINE_STACK_OF(X509V3_EXT_METHOD)
  20
  21 static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
  22
  23 static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  24                    const X509V3_EXT_METHOD *const *b);
  25 static void ext_list_free(X509V3_EXT_METHOD *ext);
  26
  27 int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
  28 {
  29     if (ext_list == NULL
  30         && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) {
  31         X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
  32         return 0;
  33     }
  34     if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
  35         X509V3err(X509V3_F_X509V3_EXT_ADD, ERR_R_MALLOC_FAILURE);
  36         return 0;
  37     }
  38     return 1;
  39 }
  40
  41 static int ext_cmp(const X509V3_EXT_METHOD *const *a,
  42                    const X509V3_EXT_METHOD *const *b)
  43 {
  44     return ((*a)->ext_nid - (*b)->ext_nid);
  45 }
  46
  47 DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  48                            const X509V3_EXT_METHOD *, ext);
  49 IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
  50                              const X509V3_EXT_METHOD *, ext);
  51
  52 #include "standard_exts.h"
  53
  54 const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
  55 {
  56     X509V3_EXT_METHOD tmp;
  57     const X509V3_EXT_METHOD *t = &tmp, *const *ret;
  58     int idx;
  59
  60     if (nid < 0)
  61         return NULL;
  62     tmp.ext_nid = nid;
  63     ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
  64     if (ret)
  65         return *ret;
  66     if (!ext_list)
  67         return NULL;
  68     idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
  69     return sk_X509V3_EXT_METHOD_value(ext_list, idx);
  70 }
  71
  72 const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
  73 {
  74     int nid;
  75     if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef)
  76         return NULL;
  77     return X509V3_EXT_get_nid(nid);
  78 }
  79
  80 int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
  81 {
  82     for (; extlist->ext_nid != -1; extlist++)
  83         if (!X509V3_EXT_add(extlist))
  84             return 0;
  85     return 1;
  86 }
  87
  88 int X509V3_EXT_add_alias(int nid_to, int nid_from)
  89 {
  90     const X509V3_EXT_METHOD *ext;
  91     X509V3_EXT_METHOD *tmpext;
  92
  93     if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) {
  94         X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS, X509V3_R_EXTENSION_NOT_FOUND);
  95         return 0;
  96     }
  97     if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL) {
  98         X509V3err(X509V3_F_X509V3_EXT_ADD_ALIAS, ERR_R_MALLOC_FAILURE);
  99         return 0;
 100     }
 101     *tmpext = *ext;
 102     tmpext->ext_nid = nid_to;
 103     tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
 104     return X509V3_EXT_add(tmpext);
 105 }
 106
 107 void X509V3_EXT_cleanup(void)
 108 {
 109     sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
 110     ext_list = NULL;
 111 }
 112
 113 static void ext_list_free(X509V3_EXT_METHOD *ext)
 114 {
 115     if (ext->ext_flags & X509V3_EXT_DYNAMIC)
 116         OPENSSL_free(ext);
 117 }
 118
 119 /*
 120  * Legacy function: we don't need to add standard extensions any more because
 121  * they are now kept in ext_dat.h.
 122  */
 123
 124 int X509V3_add_standard_extensions(void)
 125 {
 126     return 1;
 127 }
 128
 129 /* Return an extension internal structure */
 130
 131 void *X509V3_EXT_d2i(X509_EXTENSION *ext)
 132 {
 133     const X509V3_EXT_METHOD *method;
 134     const unsigned char *p;
 135     ASN1_STRING *extvalue;
 136     int extlen;
 137
 138     if ((method = X509V3_EXT_get(ext)) == NULL)
 139         return NULL;
 140     extvalue = X509_EXTENSION_get_data(ext);
 141     p = ASN1_STRING_get0_data(extvalue);
 142     extlen = ASN1_STRING_length(extvalue);
 143     if (method->it)
 144         return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it));
 145     return method->d2i(NULL, &p, extlen);
 146 }
 147
 148 /*-
 149  * Get critical flag and decoded version of extension from a NID.
 150  * The "idx" variable returns the last found extension and can
 151  * be used to retrieve multiple extensions of the same NID.
 152  * However multiple extensions with the same NID is usually
 153  * due to a badly encoded certificate so if idx is NULL we
 154  * choke if multiple extensions exist.
 155  * The "crit" variable is set to the critical value.
 156  * The return value is the decoded extension or NULL on
 157  * error. The actual error can have several different causes,
 158  * the value of *crit reflects the cause:
 159  * >= 0, extension found but not decoded (reflects critical value).
 160  * -1 extension not found.
 161  * -2 extension occurs more than once.
 162  */
 163
 164 void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
 165                      int *idx)
 166 {
 167     int lastpos, i;
 168     X509_EXTENSION *ex, *found_ex = NULL;
 169
 170     if (!x) {
 171         if (idx)
 172             *idx = -1;
 173         if (crit)
 174             *crit = -1;
 175         return NULL;
 176     }
 177     if (idx)
 178         lastpos = *idx + 1;
 179     else
 180         lastpos = 0;
 181     if (lastpos < 0)
 182         lastpos = 0;
 183     for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
 184         ex = sk_X509_EXTENSION_value(x, i);
 185         if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) {
 186             if (idx) {
 187                 *idx = i;
 188                 found_ex = ex;
 189                 break;
 190             } else if (found_ex) {
 191                 /* Found more than one */
 192                 if (crit)
 193                     *crit = -2;
 194                 return NULL;
 195             }
 196             found_ex = ex;
 197         }
 198     }
 199     if (found_ex) {
 200         /* Found it */
 201         if (crit)
 202             *crit = X509_EXTENSION_get_critical(found_ex);
 203         return X509V3_EXT_d2i(found_ex);
 204     }
 205
 206     /* Extension not found */
 207     if (idx)
 208         *idx = -1;
 209     if (crit)
 210         *crit = -1;
 211     return NULL;
 212 }
 213
 214 /*
 215  * This function is a general extension append, replace and delete utility.
 216  * The precise operation is governed by the 'flags' value. The 'crit' and
 217  * 'value' arguments (if relevant) are the extensions internal structure.
 218  */
 219
 220 int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
 221                     int crit, unsigned long flags)
 222 {
 223     int errcode, extidx = -1;
 224     X509_EXTENSION *ext = NULL, *extmp;
 225     STACK_OF(X509_EXTENSION) *ret = NULL;
 226     unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
 227
 228     /*
 229      * If appending we don't care if it exists, otherwise look for existing
 230      * extension.
 231      */
 232     if (ext_op != X509V3_ADD_APPEND)
 233         extidx = X509v3_get_ext_by_NID(*x, nid, -1);
 234
 235     /* See if extension exists */
 236     if (extidx >= 0) {
 237         /* If keep existing, nothing to do */
 238         if (ext_op == X509V3_ADD_KEEP_EXISTING)
 239             return 1;
 240         /* If default then its an error */
 241         if (ext_op == X509V3_ADD_DEFAULT) {
 242             errcode = X509V3_R_EXTENSION_EXISTS;
 243             goto err;
 244         }
 245         /* If delete, just delete it */
 246         if (ext_op == X509V3_ADD_DELETE) {
 247             if (!sk_X509_EXTENSION_delete(*x, extidx))
 248                 return -1;
 249             return 1;
 250         }
 251     } else {
 252         /*
 253          * If replace existing or delete, error since extension must exist
 254          */
 255         if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
 256             (ext_op == X509V3_ADD_DELETE)) {
 257             errcode = X509V3_R_EXTENSION_NOT_FOUND;
 258             goto err;
 259         }
 260     }
 261
 262     /*
 263      * If we get this far then we have to create an extension: could have
 264      * some flags for alternative encoding schemes...
 265      */
 266
 267     ext = X509V3_EXT_i2d(nid, crit, value);
 268
 269     if (!ext) {
 270         X509V3err(X509V3_F_X509V3_ADD1_I2D,
 271                   X509V3_R_ERROR_CREATING_EXTENSION);
 272         return 0;
 273     }
 274
 275     /* If extension exists replace it.. */
 276     if (extidx >= 0) {
 277         extmp = sk_X509_EXTENSION_value(*x, extidx);
 278         X509_EXTENSION_free(extmp);
 279         if (!sk_X509_EXTENSION_set(*x, extidx, ext))
 280             return -1;
 281         return 1;
 282     }
 283
 284     ret = *x;
 285     if (*x == NULL
 286         && (ret = sk_X509_EXTENSION_new_null()) == NULL)
 287         goto m_fail;
 288     if (!sk_X509_EXTENSION_push(ret, ext))
 289         goto m_fail;
 290
 291     *x = ret;
 292     return 1;
 293
 294  m_fail:
 295     /* X509V3err(X509V3_F_X509V3_ADD1_I2D, ERR_R_MALLOC_FAILURE); */
 296     if (ret != *x)
 297         sk_X509_EXTENSION_free(ret);
 298     X509_EXTENSION_free(ext);
 299     return -1;
 300
 301  err:
 302     if (!(flags & X509V3_ADD_SILENT))
 303         X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode);
 304     return 0;
 305 }