[331] | 1 | /*
|
---|
| 2 | * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | /*
|
---|
| 11 | * Implementation of RFC 3779 section 2.2.
|
---|
| 12 | */
|
---|
| 13 |
|
---|
| 14 | #include <stdio.h>
|
---|
| 15 | #include <stdlib.h>
|
---|
| 16 |
|
---|
| 17 | #include "internal/cryptlib.h"
|
---|
| 18 | #include <openssl/conf.h>
|
---|
| 19 | #include <openssl/asn1.h>
|
---|
| 20 | #include <openssl/asn1t.h>
|
---|
| 21 | #include <openssl/buffer.h>
|
---|
| 22 | #include <openssl/x509v3.h>
|
---|
| 23 | #include "internal/x509_int.h"
|
---|
| 24 | #include "ext_dat.h"
|
---|
| 25 |
|
---|
| 26 | #ifndef OPENSSL_NO_RFC3779
|
---|
| 27 |
|
---|
| 28 | /*
|
---|
| 29 | * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
|
---|
| 30 | */
|
---|
| 31 |
|
---|
| 32 | ASN1_SEQUENCE(IPAddressRange) = {
|
---|
| 33 | ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
|
---|
| 34 | ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
|
---|
| 35 | } ASN1_SEQUENCE_END(IPAddressRange)
|
---|
| 36 |
|
---|
| 37 | ASN1_CHOICE(IPAddressOrRange) = {
|
---|
| 38 | ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
|
---|
| 39 | ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
|
---|
| 40 | } ASN1_CHOICE_END(IPAddressOrRange)
|
---|
| 41 |
|
---|
| 42 | ASN1_CHOICE(IPAddressChoice) = {
|
---|
| 43 | ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
|
---|
| 44 | ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
|
---|
| 45 | } ASN1_CHOICE_END(IPAddressChoice)
|
---|
| 46 |
|
---|
| 47 | ASN1_SEQUENCE(IPAddressFamily) = {
|
---|
| 48 | ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
|
---|
| 49 | ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
|
---|
| 50 | } ASN1_SEQUENCE_END(IPAddressFamily)
|
---|
| 51 |
|
---|
| 52 | ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
|
---|
| 53 | ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
|
---|
| 54 | IPAddrBlocks, IPAddressFamily)
|
---|
| 55 | static_ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
|
---|
| 56 |
|
---|
| 57 | IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
|
---|
| 58 | IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
|
---|
| 59 | IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
|
---|
| 60 | IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
|
---|
| 61 |
|
---|
| 62 | /*
|
---|
| 63 | * How much buffer space do we need for a raw address?
|
---|
| 64 | */
|
---|
| 65 | #define ADDR_RAW_BUF_LEN 16
|
---|
| 66 |
|
---|
| 67 | /*
|
---|
| 68 | * What's the address length associated with this AFI?
|
---|
| 69 | */
|
---|
| 70 | static int length_from_afi(const unsigned afi)
|
---|
| 71 | {
|
---|
| 72 | switch (afi) {
|
---|
| 73 | case IANA_AFI_IPV4:
|
---|
| 74 | return 4;
|
---|
| 75 | case IANA_AFI_IPV6:
|
---|
| 76 | return 16;
|
---|
| 77 | default:
|
---|
| 78 | return 0;
|
---|
| 79 | }
|
---|
| 80 | }
|
---|
| 81 |
|
---|
| 82 | /*
|
---|
| 83 | * Extract the AFI from an IPAddressFamily.
|
---|
| 84 | */
|
---|
| 85 | unsigned int X509v3_addr_get_afi(const IPAddressFamily *f)
|
---|
| 86 | {
|
---|
| 87 | return ((f != NULL &&
|
---|
| 88 | f->addressFamily != NULL && f->addressFamily->data != NULL)
|
---|
| 89 | ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
|
---|
| 90 | : 0);
|
---|
| 91 | }
|
---|
| 92 |
|
---|
| 93 | /*
|
---|
| 94 | * Expand the bitstring form of an address into a raw byte array.
|
---|
| 95 | * At the moment this is coded for simplicity, not speed.
|
---|
| 96 | */
|
---|
| 97 | static int addr_expand(unsigned char *addr,
|
---|
| 98 | const ASN1_BIT_STRING *bs,
|
---|
| 99 | const int length, const unsigned char fill)
|
---|
| 100 | {
|
---|
| 101 | if (bs->length < 0 || bs->length > length)
|
---|
| 102 | return 0;
|
---|
| 103 | if (bs->length > 0) {
|
---|
| 104 | memcpy(addr, bs->data, bs->length);
|
---|
| 105 | if ((bs->flags & 7) != 0) {
|
---|
| 106 | unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
|
---|
| 107 | if (fill == 0)
|
---|
| 108 | addr[bs->length - 1] &= ~mask;
|
---|
| 109 | else
|
---|
| 110 | addr[bs->length - 1] |= mask;
|
---|
| 111 | }
|
---|
| 112 | }
|
---|
| 113 | memset(addr + bs->length, fill, length - bs->length);
|
---|
| 114 | return 1;
|
---|
| 115 | }
|
---|
| 116 |
|
---|
| 117 | /*
|
---|
| 118 | * Extract the prefix length from a bitstring.
|
---|
| 119 | */
|
---|
| 120 | #define addr_prefixlen(bs) ((int) ((bs)->length * 8 - ((bs)->flags & 7)))
|
---|
| 121 |
|
---|
| 122 | /*
|
---|
| 123 | * i2r handler for one address bitstring.
|
---|
| 124 | */
|
---|
| 125 | static int i2r_address(BIO *out,
|
---|
| 126 | const unsigned afi,
|
---|
| 127 | const unsigned char fill, const ASN1_BIT_STRING *bs)
|
---|
| 128 | {
|
---|
| 129 | unsigned char addr[ADDR_RAW_BUF_LEN];
|
---|
| 130 | int i, n;
|
---|
| 131 |
|
---|
| 132 | if (bs->length < 0)
|
---|
| 133 | return 0;
|
---|
| 134 | switch (afi) {
|
---|
| 135 | case IANA_AFI_IPV4:
|
---|
| 136 | if (!addr_expand(addr, bs, 4, fill))
|
---|
| 137 | return 0;
|
---|
| 138 | BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
|
---|
| 139 | break;
|
---|
| 140 | case IANA_AFI_IPV6:
|
---|
| 141 | if (!addr_expand(addr, bs, 16, fill))
|
---|
| 142 | return 0;
|
---|
| 143 | for (n = 16; n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00;
|
---|
| 144 | n -= 2) ;
|
---|
| 145 | for (i = 0; i < n; i += 2)
|
---|
| 146 | BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i + 1],
|
---|
| 147 | (i < 14 ? ":" : ""));
|
---|
| 148 | if (i < 16)
|
---|
| 149 | BIO_puts(out, ":");
|
---|
| 150 | if (i == 0)
|
---|
| 151 | BIO_puts(out, ":");
|
---|
| 152 | break;
|
---|
| 153 | default:
|
---|
| 154 | for (i = 0; i < bs->length; i++)
|
---|
| 155 | BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
|
---|
| 156 | BIO_printf(out, "[%d]", (int)(bs->flags & 7));
|
---|
| 157 | break;
|
---|
| 158 | }
|
---|
| 159 | return 1;
|
---|
| 160 | }
|
---|
| 161 |
|
---|
| 162 | /*
|
---|
| 163 | * i2r handler for a sequence of addresses and ranges.
|
---|
| 164 | */
|
---|
| 165 | static int i2r_IPAddressOrRanges(BIO *out,
|
---|
| 166 | const int indent,
|
---|
| 167 | const IPAddressOrRanges *aors,
|
---|
| 168 | const unsigned afi)
|
---|
| 169 | {
|
---|
| 170 | int i;
|
---|
| 171 | for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
|
---|
| 172 | const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
|
---|
| 173 | BIO_printf(out, "%*s", indent, "");
|
---|
| 174 | switch (aor->type) {
|
---|
| 175 | case IPAddressOrRange_addressPrefix:
|
---|
| 176 | if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
|
---|
| 177 | return 0;
|
---|
| 178 | BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
|
---|
| 179 | continue;
|
---|
| 180 | case IPAddressOrRange_addressRange:
|
---|
| 181 | if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
|
---|
| 182 | return 0;
|
---|
| 183 | BIO_puts(out, "-");
|
---|
| 184 | if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
|
---|
| 185 | return 0;
|
---|
| 186 | BIO_puts(out, "\n");
|
---|
| 187 | continue;
|
---|
| 188 | }
|
---|
| 189 | }
|
---|
| 190 | return 1;
|
---|
| 191 | }
|
---|
| 192 |
|
---|
| 193 | /*
|
---|
| 194 | * i2r handler for an IPAddrBlocks extension.
|
---|
| 195 | */
|
---|
| 196 | static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
|
---|
| 197 | void *ext, BIO *out, int indent)
|
---|
| 198 | {
|
---|
| 199 | const IPAddrBlocks *addr = ext;
|
---|
| 200 | int i;
|
---|
| 201 | for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
|
---|
| 202 | IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
|
---|
| 203 | const unsigned int afi = X509v3_addr_get_afi(f);
|
---|
| 204 | switch (afi) {
|
---|
| 205 | case IANA_AFI_IPV4:
|
---|
| 206 | BIO_printf(out, "%*sIPv4", indent, "");
|
---|
| 207 | break;
|
---|
| 208 | case IANA_AFI_IPV6:
|
---|
| 209 | BIO_printf(out, "%*sIPv6", indent, "");
|
---|
| 210 | break;
|
---|
| 211 | default:
|
---|
| 212 | BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
|
---|
| 213 | break;
|
---|
| 214 | }
|
---|
| 215 | if (f->addressFamily->length > 2) {
|
---|
| 216 | switch (f->addressFamily->data[2]) {
|
---|
| 217 | case 1:
|
---|
| 218 | BIO_puts(out, " (Unicast)");
|
---|
| 219 | break;
|
---|
| 220 | case 2:
|
---|
| 221 | BIO_puts(out, " (Multicast)");
|
---|
| 222 | break;
|
---|
| 223 | case 3:
|
---|
| 224 | BIO_puts(out, " (Unicast/Multicast)");
|
---|
| 225 | break;
|
---|
| 226 | case 4:
|
---|
| 227 | BIO_puts(out, " (MPLS)");
|
---|
| 228 | break;
|
---|
| 229 | case 64:
|
---|
| 230 | BIO_puts(out, " (Tunnel)");
|
---|
| 231 | break;
|
---|
| 232 | case 65:
|
---|
| 233 | BIO_puts(out, " (VPLS)");
|
---|
| 234 | break;
|
---|
| 235 | case 66:
|
---|
| 236 | BIO_puts(out, " (BGP MDT)");
|
---|
| 237 | break;
|
---|
| 238 | case 128:
|
---|
| 239 | BIO_puts(out, " (MPLS-labeled VPN)");
|
---|
| 240 | break;
|
---|
| 241 | default:
|
---|
| 242 | BIO_printf(out, " (Unknown SAFI %u)",
|
---|
| 243 | (unsigned)f->addressFamily->data[2]);
|
---|
| 244 | break;
|
---|
| 245 | }
|
---|
| 246 | }
|
---|
| 247 | switch (f->ipAddressChoice->type) {
|
---|
| 248 | case IPAddressChoice_inherit:
|
---|
| 249 | BIO_puts(out, ": inherit\n");
|
---|
| 250 | break;
|
---|
| 251 | case IPAddressChoice_addressesOrRanges:
|
---|
| 252 | BIO_puts(out, ":\n");
|
---|
| 253 | if (!i2r_IPAddressOrRanges(out,
|
---|
| 254 | indent + 2,
|
---|
| 255 | f->ipAddressChoice->
|
---|
| 256 | u.addressesOrRanges, afi))
|
---|
| 257 | return 0;
|
---|
| 258 | break;
|
---|
| 259 | }
|
---|
| 260 | }
|
---|
| 261 | return 1;
|
---|
| 262 | }
|
---|
| 263 |
|
---|
| 264 | /*
|
---|
| 265 | * Sort comparison function for a sequence of IPAddressOrRange
|
---|
| 266 | * elements.
|
---|
| 267 | *
|
---|
| 268 | * There's no sane answer we can give if addr_expand() fails, and an
|
---|
| 269 | * assertion failure on externally supplied data is seriously uncool,
|
---|
| 270 | * so we just arbitrarily declare that if given invalid inputs this
|
---|
| 271 | * function returns -1. If this messes up your preferred sort order
|
---|
| 272 | * for garbage input, tough noogies.
|
---|
| 273 | */
|
---|
| 274 | static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
|
---|
| 275 | const IPAddressOrRange *b, const int length)
|
---|
| 276 | {
|
---|
| 277 | unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
|
---|
| 278 | int prefixlen_a = 0, prefixlen_b = 0;
|
---|
| 279 | int r;
|
---|
| 280 |
|
---|
| 281 | switch (a->type) {
|
---|
| 282 | case IPAddressOrRange_addressPrefix:
|
---|
| 283 | if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00))
|
---|
| 284 | return -1;
|
---|
| 285 | prefixlen_a = addr_prefixlen(a->u.addressPrefix);
|
---|
| 286 | break;
|
---|
| 287 | case IPAddressOrRange_addressRange:
|
---|
| 288 | if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00))
|
---|
| 289 | return -1;
|
---|
| 290 | prefixlen_a = length * 8;
|
---|
| 291 | break;
|
---|
| 292 | }
|
---|
| 293 |
|
---|
| 294 | switch (b->type) {
|
---|
| 295 | case IPAddressOrRange_addressPrefix:
|
---|
| 296 | if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00))
|
---|
| 297 | return -1;
|
---|
| 298 | prefixlen_b = addr_prefixlen(b->u.addressPrefix);
|
---|
| 299 | break;
|
---|
| 300 | case IPAddressOrRange_addressRange:
|
---|
| 301 | if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00))
|
---|
| 302 | return -1;
|
---|
| 303 | prefixlen_b = length * 8;
|
---|
| 304 | break;
|
---|
| 305 | }
|
---|
| 306 |
|
---|
| 307 | if ((r = memcmp(addr_a, addr_b, length)) != 0)
|
---|
| 308 | return r;
|
---|
| 309 | else
|
---|
| 310 | return prefixlen_a - prefixlen_b;
|
---|
| 311 | }
|
---|
| 312 |
|
---|
| 313 | /*
|
---|
| 314 | * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
|
---|
| 315 | * comparison routines are only allowed two arguments.
|
---|
| 316 | */
|
---|
| 317 | static int v4IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
|
---|
| 318 | const IPAddressOrRange *const *b)
|
---|
| 319 | {
|
---|
| 320 | return IPAddressOrRange_cmp(*a, *b, 4);
|
---|
| 321 | }
|
---|
| 322 |
|
---|
| 323 | /*
|
---|
| 324 | * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
|
---|
| 325 | * comparison routines are only allowed two arguments.
|
---|
| 326 | */
|
---|
| 327 | static int v6IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
|
---|
| 328 | const IPAddressOrRange *const *b)
|
---|
| 329 | {
|
---|
| 330 | return IPAddressOrRange_cmp(*a, *b, 16);
|
---|
| 331 | }
|
---|
| 332 |
|
---|
| 333 | /*
|
---|
| 334 | * Calculate whether a range collapses to a prefix.
|
---|
| 335 | * See last paragraph of RFC 3779 2.2.3.7.
|
---|
| 336 | */
|
---|
| 337 | static int range_should_be_prefix(const unsigned char *min,
|
---|
| 338 | const unsigned char *max, const int length)
|
---|
| 339 | {
|
---|
| 340 | unsigned char mask;
|
---|
| 341 | int i, j;
|
---|
| 342 |
|
---|
| 343 | OPENSSL_assert(memcmp(min, max, length) <= 0);
|
---|
| 344 | for (i = 0; i < length && min[i] == max[i]; i++) ;
|
---|
| 345 | for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) ;
|
---|
| 346 | if (i < j)
|
---|
| 347 | return -1;
|
---|
| 348 | if (i > j)
|
---|
| 349 | return i * 8;
|
---|
| 350 | mask = min[i] ^ max[i];
|
---|
| 351 | switch (mask) {
|
---|
| 352 | case 0x01:
|
---|
| 353 | j = 7;
|
---|
| 354 | break;
|
---|
| 355 | case 0x03:
|
---|
| 356 | j = 6;
|
---|
| 357 | break;
|
---|
| 358 | case 0x07:
|
---|
| 359 | j = 5;
|
---|
| 360 | break;
|
---|
| 361 | case 0x0F:
|
---|
| 362 | j = 4;
|
---|
| 363 | break;
|
---|
| 364 | case 0x1F:
|
---|
| 365 | j = 3;
|
---|
| 366 | break;
|
---|
| 367 | case 0x3F:
|
---|
| 368 | j = 2;
|
---|
| 369 | break;
|
---|
| 370 | case 0x7F:
|
---|
| 371 | j = 1;
|
---|
| 372 | break;
|
---|
| 373 | default:
|
---|
| 374 | return -1;
|
---|
| 375 | }
|
---|
| 376 | if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
|
---|
| 377 | return -1;
|
---|
| 378 | else
|
---|
| 379 | return i * 8 + j;
|
---|
| 380 | }
|
---|
| 381 |
|
---|
| 382 | /*
|
---|
| 383 | * Construct a prefix.
|
---|
| 384 | */
|
---|
| 385 | static int make_addressPrefix(IPAddressOrRange **result,
|
---|
| 386 | unsigned char *addr, const int prefixlen)
|
---|
| 387 | {
|
---|
| 388 | int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
|
---|
| 389 | IPAddressOrRange *aor = IPAddressOrRange_new();
|
---|
| 390 |
|
---|
| 391 | if (aor == NULL)
|
---|
| 392 | return 0;
|
---|
| 393 | aor->type = IPAddressOrRange_addressPrefix;
|
---|
| 394 | if (aor->u.addressPrefix == NULL &&
|
---|
| 395 | (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
|
---|
| 396 | goto err;
|
---|
| 397 | if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
|
---|
| 398 | goto err;
|
---|
| 399 | aor->u.addressPrefix->flags &= ~7;
|
---|
| 400 | aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
|
---|
| 401 | if (bitlen > 0) {
|
---|
| 402 | aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
|
---|
| 403 | aor->u.addressPrefix->flags |= 8 - bitlen;
|
---|
| 404 | }
|
---|
| 405 |
|
---|
| 406 | *result = aor;
|
---|
| 407 | return 1;
|
---|
| 408 |
|
---|
| 409 | err:
|
---|
| 410 | IPAddressOrRange_free(aor);
|
---|
| 411 | return 0;
|
---|
| 412 | }
|
---|
| 413 |
|
---|
| 414 | /*
|
---|
| 415 | * Construct a range. If it can be expressed as a prefix,
|
---|
| 416 | * return a prefix instead. Doing this here simplifies
|
---|
| 417 | * the rest of the code considerably.
|
---|
| 418 | */
|
---|
| 419 | static int make_addressRange(IPAddressOrRange **result,
|
---|
| 420 | unsigned char *min,
|
---|
| 421 | unsigned char *max, const int length)
|
---|
| 422 | {
|
---|
| 423 | IPAddressOrRange *aor;
|
---|
| 424 | int i, prefixlen;
|
---|
| 425 |
|
---|
| 426 | if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
|
---|
| 427 | return make_addressPrefix(result, min, prefixlen);
|
---|
| 428 |
|
---|
| 429 | if ((aor = IPAddressOrRange_new()) == NULL)
|
---|
| 430 | return 0;
|
---|
| 431 | aor->type = IPAddressOrRange_addressRange;
|
---|
| 432 | OPENSSL_assert(aor->u.addressRange == NULL);
|
---|
| 433 | if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
|
---|
| 434 | goto err;
|
---|
| 435 | if (aor->u.addressRange->min == NULL &&
|
---|
| 436 | (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
|
---|
| 437 | goto err;
|
---|
| 438 | if (aor->u.addressRange->max == NULL &&
|
---|
| 439 | (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
|
---|
| 440 | goto err;
|
---|
| 441 |
|
---|
| 442 | for (i = length; i > 0 && min[i - 1] == 0x00; --i) ;
|
---|
| 443 | if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
|
---|
| 444 | goto err;
|
---|
| 445 | aor->u.addressRange->min->flags &= ~7;
|
---|
| 446 | aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
|
---|
| 447 | if (i > 0) {
|
---|
| 448 | unsigned char b = min[i - 1];
|
---|
| 449 | int j = 1;
|
---|
| 450 | while ((b & (0xFFU >> j)) != 0)
|
---|
| 451 | ++j;
|
---|
| 452 | aor->u.addressRange->min->flags |= 8 - j;
|
---|
| 453 | }
|
---|
| 454 |
|
---|
| 455 | for (i = length; i > 0 && max[i - 1] == 0xFF; --i) ;
|
---|
| 456 | if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
|
---|
| 457 | goto err;
|
---|
| 458 | aor->u.addressRange->max->flags &= ~7;
|
---|
| 459 | aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
|
---|
| 460 | if (i > 0) {
|
---|
| 461 | unsigned char b = max[i - 1];
|
---|
| 462 | int j = 1;
|
---|
| 463 | while ((b & (0xFFU >> j)) != (0xFFU >> j))
|
---|
| 464 | ++j;
|
---|
| 465 | aor->u.addressRange->max->flags |= 8 - j;
|
---|
| 466 | }
|
---|
| 467 |
|
---|
| 468 | *result = aor;
|
---|
| 469 | return 1;
|
---|
| 470 |
|
---|
| 471 | err:
|
---|
| 472 | IPAddressOrRange_free(aor);
|
---|
| 473 | return 0;
|
---|
| 474 | }
|
---|
| 475 |
|
---|
| 476 | /*
|
---|
| 477 | * Construct a new address family or find an existing one.
|
---|
| 478 | */
|
---|
| 479 | static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
|
---|
| 480 | const unsigned afi,
|
---|
| 481 | const unsigned *safi)
|
---|
| 482 | {
|
---|
| 483 | IPAddressFamily *f;
|
---|
| 484 | unsigned char key[3];
|
---|
| 485 | int keylen;
|
---|
| 486 | int i;
|
---|
| 487 |
|
---|
| 488 | key[0] = (afi >> 8) & 0xFF;
|
---|
| 489 | key[1] = afi & 0xFF;
|
---|
| 490 | if (safi != NULL) {
|
---|
| 491 | key[2] = *safi & 0xFF;
|
---|
| 492 | keylen = 3;
|
---|
| 493 | } else {
|
---|
| 494 | keylen = 2;
|
---|
| 495 | }
|
---|
| 496 |
|
---|
| 497 | for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
|
---|
| 498 | f = sk_IPAddressFamily_value(addr, i);
|
---|
| 499 | OPENSSL_assert(f->addressFamily->data != NULL);
|
---|
| 500 | if (f->addressFamily->length == keylen &&
|
---|
| 501 | !memcmp(f->addressFamily->data, key, keylen))
|
---|
| 502 | return f;
|
---|
| 503 | }
|
---|
| 504 |
|
---|
| 505 | if ((f = IPAddressFamily_new()) == NULL)
|
---|
| 506 | goto err;
|
---|
| 507 | if (f->ipAddressChoice == NULL &&
|
---|
| 508 | (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
|
---|
| 509 | goto err;
|
---|
| 510 | if (f->addressFamily == NULL &&
|
---|
| 511 | (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
|
---|
| 512 | goto err;
|
---|
| 513 | if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
|
---|
| 514 | goto err;
|
---|
| 515 | if (!sk_IPAddressFamily_push(addr, f))
|
---|
| 516 | goto err;
|
---|
| 517 |
|
---|
| 518 | return f;
|
---|
| 519 |
|
---|
| 520 | err:
|
---|
| 521 | IPAddressFamily_free(f);
|
---|
| 522 | return NULL;
|
---|
| 523 | }
|
---|
| 524 |
|
---|
| 525 | /*
|
---|
| 526 | * Add an inheritance element.
|
---|
| 527 | */
|
---|
| 528 | int X509v3_addr_add_inherit(IPAddrBlocks *addr,
|
---|
| 529 | const unsigned afi, const unsigned *safi)
|
---|
| 530 | {
|
---|
| 531 | IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
|
---|
| 532 | if (f == NULL ||
|
---|
| 533 | f->ipAddressChoice == NULL ||
|
---|
| 534 | (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
|
---|
| 535 | f->ipAddressChoice->u.addressesOrRanges != NULL))
|
---|
| 536 | return 0;
|
---|
| 537 | if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
|
---|
| 538 | f->ipAddressChoice->u.inherit != NULL)
|
---|
| 539 | return 1;
|
---|
| 540 | if (f->ipAddressChoice->u.inherit == NULL &&
|
---|
| 541 | (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
|
---|
| 542 | return 0;
|
---|
| 543 | f->ipAddressChoice->type = IPAddressChoice_inherit;
|
---|
| 544 | return 1;
|
---|
| 545 | }
|
---|
| 546 |
|
---|
| 547 | /*
|
---|
| 548 | * Construct an IPAddressOrRange sequence, or return an existing one.
|
---|
| 549 | */
|
---|
| 550 | static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
|
---|
| 551 | const unsigned afi,
|
---|
| 552 | const unsigned *safi)
|
---|
| 553 | {
|
---|
| 554 | IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
|
---|
| 555 | IPAddressOrRanges *aors = NULL;
|
---|
| 556 |
|
---|
| 557 | if (f == NULL ||
|
---|
| 558 | f->ipAddressChoice == NULL ||
|
---|
| 559 | (f->ipAddressChoice->type == IPAddressChoice_inherit &&
|
---|
| 560 | f->ipAddressChoice->u.inherit != NULL))
|
---|
| 561 | return NULL;
|
---|
| 562 | if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
|
---|
| 563 | aors = f->ipAddressChoice->u.addressesOrRanges;
|
---|
| 564 | if (aors != NULL)
|
---|
| 565 | return aors;
|
---|
| 566 | if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
|
---|
| 567 | return NULL;
|
---|
| 568 | switch (afi) {
|
---|
| 569 | case IANA_AFI_IPV4:
|
---|
| 570 | (void)sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
|
---|
| 571 | break;
|
---|
| 572 | case IANA_AFI_IPV6:
|
---|
| 573 | (void)sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
|
---|
| 574 | break;
|
---|
| 575 | }
|
---|
| 576 | f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
|
---|
| 577 | f->ipAddressChoice->u.addressesOrRanges = aors;
|
---|
| 578 | return aors;
|
---|
| 579 | }
|
---|
| 580 |
|
---|
| 581 | /*
|
---|
| 582 | * Add a prefix.
|
---|
| 583 | */
|
---|
| 584 | int X509v3_addr_add_prefix(IPAddrBlocks *addr,
|
---|
| 585 | const unsigned afi,
|
---|
| 586 | const unsigned *safi,
|
---|
| 587 | unsigned char *a, const int prefixlen)
|
---|
| 588 | {
|
---|
| 589 | IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
|
---|
| 590 | IPAddressOrRange *aor;
|
---|
| 591 | if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
|
---|
| 592 | return 0;
|
---|
| 593 | if (sk_IPAddressOrRange_push(aors, aor))
|
---|
| 594 | return 1;
|
---|
| 595 | IPAddressOrRange_free(aor);
|
---|
| 596 | return 0;
|
---|
| 597 | }
|
---|
| 598 |
|
---|
| 599 | /*
|
---|
| 600 | * Add a range.
|
---|
| 601 | */
|
---|
| 602 | int X509v3_addr_add_range(IPAddrBlocks *addr,
|
---|
| 603 | const unsigned afi,
|
---|
| 604 | const unsigned *safi,
|
---|
| 605 | unsigned char *min, unsigned char *max)
|
---|
| 606 | {
|
---|
| 607 | IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
|
---|
| 608 | IPAddressOrRange *aor;
|
---|
| 609 | int length = length_from_afi(afi);
|
---|
| 610 | if (aors == NULL)
|
---|
| 611 | return 0;
|
---|
| 612 | if (!make_addressRange(&aor, min, max, length))
|
---|
| 613 | return 0;
|
---|
| 614 | if (sk_IPAddressOrRange_push(aors, aor))
|
---|
| 615 | return 1;
|
---|
| 616 | IPAddressOrRange_free(aor);
|
---|
| 617 | return 0;
|
---|
| 618 | }
|
---|
| 619 |
|
---|
| 620 | /*
|
---|
| 621 | * Extract min and max values from an IPAddressOrRange.
|
---|
| 622 | */
|
---|
| 623 | static int extract_min_max(IPAddressOrRange *aor,
|
---|
| 624 | unsigned char *min, unsigned char *max, int length)
|
---|
| 625 | {
|
---|
| 626 | if (aor == NULL || min == NULL || max == NULL)
|
---|
| 627 | return 0;
|
---|
| 628 | switch (aor->type) {
|
---|
| 629 | case IPAddressOrRange_addressPrefix:
|
---|
| 630 | return (addr_expand(min, aor->u.addressPrefix, length, 0x00) &&
|
---|
| 631 | addr_expand(max, aor->u.addressPrefix, length, 0xFF));
|
---|
| 632 | case IPAddressOrRange_addressRange:
|
---|
| 633 | return (addr_expand(min, aor->u.addressRange->min, length, 0x00) &&
|
---|
| 634 | addr_expand(max, aor->u.addressRange->max, length, 0xFF));
|
---|
| 635 | }
|
---|
| 636 | return 0;
|
---|
| 637 | }
|
---|
| 638 |
|
---|
| 639 | /*
|
---|
| 640 | * Public wrapper for extract_min_max().
|
---|
| 641 | */
|
---|
| 642 | int X509v3_addr_get_range(IPAddressOrRange *aor,
|
---|
| 643 | const unsigned afi,
|
---|
| 644 | unsigned char *min,
|
---|
| 645 | unsigned char *max, const int length)
|
---|
| 646 | {
|
---|
| 647 | int afi_length = length_from_afi(afi);
|
---|
| 648 | if (aor == NULL || min == NULL || max == NULL ||
|
---|
| 649 | afi_length == 0 || length < afi_length ||
|
---|
| 650 | (aor->type != IPAddressOrRange_addressPrefix &&
|
---|
| 651 | aor->type != IPAddressOrRange_addressRange) ||
|
---|
| 652 | !extract_min_max(aor, min, max, afi_length))
|
---|
| 653 | return 0;
|
---|
| 654 |
|
---|
| 655 | return afi_length;
|
---|
| 656 | }
|
---|
| 657 |
|
---|
| 658 | /*
|
---|
| 659 | * Sort comparison function for a sequence of IPAddressFamily.
|
---|
| 660 | *
|
---|
| 661 | * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
|
---|
| 662 | * the ordering: I can read it as meaning that IPv6 without a SAFI
|
---|
| 663 | * comes before IPv4 with a SAFI, which seems pretty weird. The
|
---|
| 664 | * examples in appendix B suggest that the author intended the
|
---|
| 665 | * null-SAFI rule to apply only within a single AFI, which is what I
|
---|
| 666 | * would have expected and is what the following code implements.
|
---|
| 667 | */
|
---|
| 668 | static int IPAddressFamily_cmp(const IPAddressFamily *const *a_,
|
---|
| 669 | const IPAddressFamily *const *b_)
|
---|
| 670 | {
|
---|
| 671 | const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
|
---|
| 672 | const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
|
---|
| 673 | int len = ((a->length <= b->length) ? a->length : b->length);
|
---|
| 674 | int cmp = memcmp(a->data, b->data, len);
|
---|
| 675 | return cmp ? cmp : a->length - b->length;
|
---|
| 676 | }
|
---|
| 677 |
|
---|
| 678 | /*
|
---|
| 679 | * Check whether an IPAddrBLocks is in canonical form.
|
---|
| 680 | */
|
---|
| 681 | int X509v3_addr_is_canonical(IPAddrBlocks *addr)
|
---|
| 682 | {
|
---|
| 683 | unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
|
---|
| 684 | unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
|
---|
| 685 | IPAddressOrRanges *aors;
|
---|
| 686 | int i, j, k;
|
---|
| 687 |
|
---|
| 688 | /*
|
---|
| 689 | * Empty extension is canonical.
|
---|
| 690 | */
|
---|
| 691 | if (addr == NULL)
|
---|
| 692 | return 1;
|
---|
| 693 |
|
---|
| 694 | /*
|
---|
| 695 | * Check whether the top-level list is in order.
|
---|
| 696 | */
|
---|
| 697 | for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
|
---|
| 698 | const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
|
---|
| 699 | const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
|
---|
| 700 | if (IPAddressFamily_cmp(&a, &b) >= 0)
|
---|
| 701 | return 0;
|
---|
| 702 | }
|
---|
| 703 |
|
---|
| 704 | /*
|
---|
| 705 | * Top level's ok, now check each address family.
|
---|
| 706 | */
|
---|
| 707 | for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
|
---|
| 708 | IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
|
---|
| 709 | int length = length_from_afi(X509v3_addr_get_afi(f));
|
---|
| 710 |
|
---|
| 711 | /*
|
---|
| 712 | * Inheritance is canonical. Anything other than inheritance or
|
---|
| 713 | * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
|
---|
| 714 | */
|
---|
| 715 | if (f == NULL || f->ipAddressChoice == NULL)
|
---|
| 716 | return 0;
|
---|
| 717 | switch (f->ipAddressChoice->type) {
|
---|
| 718 | case IPAddressChoice_inherit:
|
---|
| 719 | continue;
|
---|
| 720 | case IPAddressChoice_addressesOrRanges:
|
---|
| 721 | break;
|
---|
| 722 | default:
|
---|
| 723 | return 0;
|
---|
| 724 | }
|
---|
| 725 |
|
---|
| 726 | /*
|
---|
| 727 | * It's an IPAddressOrRanges sequence, check it.
|
---|
| 728 | */
|
---|
| 729 | aors = f->ipAddressChoice->u.addressesOrRanges;
|
---|
| 730 | if (sk_IPAddressOrRange_num(aors) == 0)
|
---|
| 731 | return 0;
|
---|
| 732 | for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
|
---|
| 733 | IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
|
---|
| 734 | IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
|
---|
| 735 |
|
---|
| 736 | if (!extract_min_max(a, a_min, a_max, length) ||
|
---|
| 737 | !extract_min_max(b, b_min, b_max, length))
|
---|
| 738 | return 0;
|
---|
| 739 |
|
---|
| 740 | /*
|
---|
| 741 | * Punt misordered list, overlapping start, or inverted range.
|
---|
| 742 | */
|
---|
| 743 | if (memcmp(a_min, b_min, length) >= 0 ||
|
---|
| 744 | memcmp(a_min, a_max, length) > 0 ||
|
---|
| 745 | memcmp(b_min, b_max, length) > 0)
|
---|
| 746 | return 0;
|
---|
| 747 |
|
---|
| 748 | /*
|
---|
| 749 | * Punt if adjacent or overlapping. Check for adjacency by
|
---|
| 750 | * subtracting one from b_min first.
|
---|
| 751 | */
|
---|
| 752 | for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) ;
|
---|
| 753 | if (memcmp(a_max, b_min, length) >= 0)
|
---|
| 754 | return 0;
|
---|
| 755 |
|
---|
| 756 | /*
|
---|
| 757 | * Check for range that should be expressed as a prefix.
|
---|
| 758 | */
|
---|
| 759 | if (a->type == IPAddressOrRange_addressRange &&
|
---|
| 760 | range_should_be_prefix(a_min, a_max, length) >= 0)
|
---|
| 761 | return 0;
|
---|
| 762 | }
|
---|
| 763 |
|
---|
| 764 | /*
|
---|
| 765 | * Check range to see if it's inverted or should be a
|
---|
| 766 | * prefix.
|
---|
| 767 | */
|
---|
| 768 | j = sk_IPAddressOrRange_num(aors) - 1;
|
---|
| 769 | {
|
---|
| 770 | IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
|
---|
| 771 | if (a != NULL && a->type == IPAddressOrRange_addressRange) {
|
---|
| 772 | if (!extract_min_max(a, a_min, a_max, length))
|
---|
| 773 | return 0;
|
---|
| 774 | if (memcmp(a_min, a_max, length) > 0 ||
|
---|
| 775 | range_should_be_prefix(a_min, a_max, length) >= 0)
|
---|
| 776 | return 0;
|
---|
| 777 | }
|
---|
| 778 | }
|
---|
| 779 | }
|
---|
| 780 |
|
---|
| 781 | /*
|
---|
| 782 | * If we made it through all that, we're happy.
|
---|
| 783 | */
|
---|
| 784 | return 1;
|
---|
| 785 | }
|
---|
| 786 |
|
---|
| 787 | /*
|
---|
| 788 | * Whack an IPAddressOrRanges into canonical form.
|
---|
| 789 | */
|
---|
| 790 | static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
|
---|
| 791 | const unsigned afi)
|
---|
| 792 | {
|
---|
| 793 | int i, j, length = length_from_afi(afi);
|
---|
| 794 |
|
---|
| 795 | /*
|
---|
| 796 | * Sort the IPAddressOrRanges sequence.
|
---|
| 797 | */
|
---|
| 798 | sk_IPAddressOrRange_sort(aors);
|
---|
| 799 |
|
---|
| 800 | /*
|
---|
| 801 | * Clean up representation issues, punt on duplicates or overlaps.
|
---|
| 802 | */
|
---|
| 803 | for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
|
---|
| 804 | IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
|
---|
| 805 | IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
|
---|
| 806 | unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
|
---|
| 807 | unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
|
---|
| 808 |
|
---|
| 809 | if (!extract_min_max(a, a_min, a_max, length) ||
|
---|
| 810 | !extract_min_max(b, b_min, b_max, length))
|
---|
| 811 | return 0;
|
---|
| 812 |
|
---|
| 813 | /*
|
---|
| 814 | * Punt inverted ranges.
|
---|
| 815 | */
|
---|
| 816 | if (memcmp(a_min, a_max, length) > 0 ||
|
---|
| 817 | memcmp(b_min, b_max, length) > 0)
|
---|
| 818 | return 0;
|
---|
| 819 |
|
---|
| 820 | /*
|
---|
| 821 | * Punt overlaps.
|
---|
| 822 | */
|
---|
| 823 | if (memcmp(a_max, b_min, length) >= 0)
|
---|
| 824 | return 0;
|
---|
| 825 |
|
---|
| 826 | /*
|
---|
| 827 | * Merge if a and b are adjacent. We check for
|
---|
| 828 | * adjacency by subtracting one from b_min first.
|
---|
| 829 | */
|
---|
| 830 | for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) ;
|
---|
| 831 | if (memcmp(a_max, b_min, length) == 0) {
|
---|
| 832 | IPAddressOrRange *merged;
|
---|
| 833 | if (!make_addressRange(&merged, a_min, b_max, length))
|
---|
| 834 | return 0;
|
---|
| 835 | (void)sk_IPAddressOrRange_set(aors, i, merged);
|
---|
| 836 | (void)sk_IPAddressOrRange_delete(aors, i + 1);
|
---|
| 837 | IPAddressOrRange_free(a);
|
---|
| 838 | IPAddressOrRange_free(b);
|
---|
| 839 | --i;
|
---|
| 840 | continue;
|
---|
| 841 | }
|
---|
| 842 | }
|
---|
| 843 |
|
---|
| 844 | /*
|
---|
| 845 | * Check for inverted final range.
|
---|
| 846 | */
|
---|
| 847 | j = sk_IPAddressOrRange_num(aors) - 1;
|
---|
| 848 | {
|
---|
| 849 | IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
|
---|
| 850 | if (a != NULL && a->type == IPAddressOrRange_addressRange) {
|
---|
| 851 | unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
|
---|
| 852 | if (!extract_min_max(a, a_min, a_max, length))
|
---|
| 853 | return 0;
|
---|
| 854 | if (memcmp(a_min, a_max, length) > 0)
|
---|
| 855 | return 0;
|
---|
| 856 | }
|
---|
| 857 | }
|
---|
| 858 |
|
---|
| 859 | return 1;
|
---|
| 860 | }
|
---|
| 861 |
|
---|
| 862 | /*
|
---|
| 863 | * Whack an IPAddrBlocks extension into canonical form.
|
---|
| 864 | */
|
---|
| 865 | int X509v3_addr_canonize(IPAddrBlocks *addr)
|
---|
| 866 | {
|
---|
| 867 | int i;
|
---|
| 868 | for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
|
---|
| 869 | IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
|
---|
| 870 | if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
|
---|
| 871 | !IPAddressOrRanges_canonize(f->ipAddressChoice->
|
---|
| 872 | u.addressesOrRanges,
|
---|
| 873 | X509v3_addr_get_afi(f)))
|
---|
| 874 | return 0;
|
---|
| 875 | }
|
---|
| 876 | (void)sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
|
---|
| 877 | sk_IPAddressFamily_sort(addr);
|
---|
| 878 | OPENSSL_assert(X509v3_addr_is_canonical(addr));
|
---|
| 879 | return 1;
|
---|
| 880 | }
|
---|
| 881 |
|
---|
| 882 | /*
|
---|
| 883 | * v2i handler for the IPAddrBlocks extension.
|
---|
| 884 | */
|
---|
| 885 | static void *v2i_IPAddrBlocks(const struct v3_ext_method *method,
|
---|
| 886 | struct v3_ext_ctx *ctx,
|
---|
| 887 | STACK_OF(CONF_VALUE) *values)
|
---|
| 888 | {
|
---|
| 889 | static const char v4addr_chars[] = "0123456789.";
|
---|
| 890 | static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
|
---|
| 891 | IPAddrBlocks *addr = NULL;
|
---|
| 892 | char *s = NULL, *t;
|
---|
| 893 | int i;
|
---|
| 894 |
|
---|
| 895 | if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
|
---|
| 896 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
|
---|
| 897 | return NULL;
|
---|
| 898 | }
|
---|
| 899 |
|
---|
| 900 | for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
|
---|
| 901 | CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
|
---|
| 902 | unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
|
---|
| 903 | unsigned afi, *safi = NULL, safi_;
|
---|
| 904 | const char *addr_chars = NULL;
|
---|
| 905 | int prefixlen, i1, i2, delim, length;
|
---|
| 906 |
|
---|
| 907 | if (!name_cmp(val->name, "IPv4")) {
|
---|
| 908 | afi = IANA_AFI_IPV4;
|
---|
| 909 | } else if (!name_cmp(val->name, "IPv6")) {
|
---|
| 910 | afi = IANA_AFI_IPV6;
|
---|
| 911 | } else if (!name_cmp(val->name, "IPv4-SAFI")) {
|
---|
| 912 | afi = IANA_AFI_IPV4;
|
---|
| 913 | safi = &safi_;
|
---|
| 914 | } else if (!name_cmp(val->name, "IPv6-SAFI")) {
|
---|
| 915 | afi = IANA_AFI_IPV6;
|
---|
| 916 | safi = &safi_;
|
---|
| 917 | } else {
|
---|
| 918 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 919 | X509V3_R_EXTENSION_NAME_ERROR);
|
---|
| 920 | X509V3_conf_err(val);
|
---|
| 921 | goto err;
|
---|
| 922 | }
|
---|
| 923 |
|
---|
| 924 | switch (afi) {
|
---|
| 925 | case IANA_AFI_IPV4:
|
---|
| 926 | addr_chars = v4addr_chars;
|
---|
| 927 | break;
|
---|
| 928 | case IANA_AFI_IPV6:
|
---|
| 929 | addr_chars = v6addr_chars;
|
---|
| 930 | break;
|
---|
| 931 | }
|
---|
| 932 |
|
---|
| 933 | length = length_from_afi(afi);
|
---|
| 934 |
|
---|
| 935 | /*
|
---|
| 936 | * Handle SAFI, if any, and OPENSSL_strdup() so we can null-terminate
|
---|
| 937 | * the other input values.
|
---|
| 938 | */
|
---|
| 939 | if (safi != NULL) {
|
---|
| 940 | *safi = strtoul(val->value, &t, 0);
|
---|
| 941 | t += strspn(t, " \t");
|
---|
| 942 | if (*safi > 0xFF || *t++ != ':') {
|
---|
| 943 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI);
|
---|
| 944 | X509V3_conf_err(val);
|
---|
| 945 | goto err;
|
---|
| 946 | }
|
---|
| 947 | t += strspn(t, " \t");
|
---|
| 948 | s = OPENSSL_strdup(t);
|
---|
| 949 | } else {
|
---|
| 950 | s = OPENSSL_strdup(val->value);
|
---|
| 951 | }
|
---|
| 952 | if (s == NULL) {
|
---|
| 953 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
|
---|
| 954 | goto err;
|
---|
| 955 | }
|
---|
| 956 |
|
---|
| 957 | /*
|
---|
| 958 | * Check for inheritance. Not worth additional complexity to
|
---|
| 959 | * optimize this (seldom-used) case.
|
---|
| 960 | */
|
---|
| 961 | if (strcmp(s, "inherit") == 0) {
|
---|
| 962 | if (!X509v3_addr_add_inherit(addr, afi, safi)) {
|
---|
| 963 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 964 | X509V3_R_INVALID_INHERITANCE);
|
---|
| 965 | X509V3_conf_err(val);
|
---|
| 966 | goto err;
|
---|
| 967 | }
|
---|
| 968 | OPENSSL_free(s);
|
---|
| 969 | s = NULL;
|
---|
| 970 | continue;
|
---|
| 971 | }
|
---|
| 972 |
|
---|
| 973 | i1 = strspn(s, addr_chars);
|
---|
| 974 | i2 = i1 + strspn(s + i1, " \t");
|
---|
| 975 | delim = s[i2++];
|
---|
| 976 | s[i1] = '\0';
|
---|
| 977 |
|
---|
| 978 | if (a2i_ipadd(min, s) != length) {
|
---|
| 979 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
|
---|
| 980 | X509V3_conf_err(val);
|
---|
| 981 | goto err;
|
---|
| 982 | }
|
---|
| 983 |
|
---|
| 984 | switch (delim) {
|
---|
| 985 | case '/':
|
---|
| 986 | prefixlen = (int)strtoul(s + i2, &t, 10);
|
---|
| 987 | if (t == s + i2 || *t != '\0') {
|
---|
| 988 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 989 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 990 | X509V3_conf_err(val);
|
---|
| 991 | goto err;
|
---|
| 992 | }
|
---|
| 993 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
|
---|
| 994 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
|
---|
| 995 | goto err;
|
---|
| 996 | }
|
---|
| 997 | break;
|
---|
| 998 | case '-':
|
---|
| 999 | i1 = i2 + strspn(s + i2, " \t");
|
---|
| 1000 | i2 = i1 + strspn(s + i1, addr_chars);
|
---|
| 1001 | if (i1 == i2 || s[i2] != '\0') {
|
---|
| 1002 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 1003 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 1004 | X509V3_conf_err(val);
|
---|
| 1005 | goto err;
|
---|
| 1006 | }
|
---|
| 1007 | if (a2i_ipadd(max, s + i1) != length) {
|
---|
| 1008 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 1009 | X509V3_R_INVALID_IPADDRESS);
|
---|
| 1010 | X509V3_conf_err(val);
|
---|
| 1011 | goto err;
|
---|
| 1012 | }
|
---|
| 1013 | if (memcmp(min, max, length_from_afi(afi)) > 0) {
|
---|
| 1014 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 1015 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 1016 | X509V3_conf_err(val);
|
---|
| 1017 | goto err;
|
---|
| 1018 | }
|
---|
| 1019 | if (!X509v3_addr_add_range(addr, afi, safi, min, max)) {
|
---|
| 1020 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
|
---|
| 1021 | goto err;
|
---|
| 1022 | }
|
---|
| 1023 | break;
|
---|
| 1024 | case '\0':
|
---|
| 1025 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
|
---|
| 1026 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
|
---|
| 1027 | goto err;
|
---|
| 1028 | }
|
---|
| 1029 | break;
|
---|
| 1030 | default:
|
---|
| 1031 | X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
|
---|
| 1032 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 1033 | X509V3_conf_err(val);
|
---|
| 1034 | goto err;
|
---|
| 1035 | }
|
---|
| 1036 |
|
---|
| 1037 | OPENSSL_free(s);
|
---|
| 1038 | s = NULL;
|
---|
| 1039 | }
|
---|
| 1040 |
|
---|
| 1041 | /*
|
---|
| 1042 | * Canonize the result, then we're done.
|
---|
| 1043 | */
|
---|
| 1044 | if (!X509v3_addr_canonize(addr))
|
---|
| 1045 | goto err;
|
---|
| 1046 | return addr;
|
---|
| 1047 |
|
---|
| 1048 | err:
|
---|
| 1049 | OPENSSL_free(s);
|
---|
| 1050 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
|
---|
| 1051 | return NULL;
|
---|
| 1052 | }
|
---|
| 1053 |
|
---|
| 1054 | /*
|
---|
| 1055 | * OpenSSL dispatch
|
---|
| 1056 | */
|
---|
| 1057 | const X509V3_EXT_METHOD v3_addr = {
|
---|
| 1058 | NID_sbgp_ipAddrBlock, /* nid */
|
---|
| 1059 | 0, /* flags */
|
---|
| 1060 | ASN1_ITEM_ref(IPAddrBlocks), /* template */
|
---|
| 1061 | 0, 0, 0, 0, /* old functions, ignored */
|
---|
| 1062 | 0, /* i2s */
|
---|
| 1063 | 0, /* s2i */
|
---|
| 1064 | 0, /* i2v */
|
---|
| 1065 | v2i_IPAddrBlocks, /* v2i */
|
---|
| 1066 | i2r_IPAddrBlocks, /* i2r */
|
---|
| 1067 | 0, /* r2i */
|
---|
| 1068 | NULL /* extension-specific data */
|
---|
| 1069 | };
|
---|
| 1070 |
|
---|
| 1071 | /*
|
---|
| 1072 | * Figure out whether extension sues inheritance.
|
---|
| 1073 | */
|
---|
| 1074 | int X509v3_addr_inherits(IPAddrBlocks *addr)
|
---|
| 1075 | {
|
---|
| 1076 | int i;
|
---|
| 1077 | if (addr == NULL)
|
---|
| 1078 | return 0;
|
---|
| 1079 | for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
|
---|
| 1080 | IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
|
---|
| 1081 | if (f->ipAddressChoice->type == IPAddressChoice_inherit)
|
---|
| 1082 | return 1;
|
---|
| 1083 | }
|
---|
| 1084 | return 0;
|
---|
| 1085 | }
|
---|
| 1086 |
|
---|
| 1087 | /*
|
---|
| 1088 | * Figure out whether parent contains child.
|
---|
| 1089 | */
|
---|
| 1090 | static int addr_contains(IPAddressOrRanges *parent,
|
---|
| 1091 | IPAddressOrRanges *child, int length)
|
---|
| 1092 | {
|
---|
| 1093 | unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
|
---|
| 1094 | unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
|
---|
| 1095 | int p, c;
|
---|
| 1096 |
|
---|
| 1097 | if (child == NULL || parent == child)
|
---|
| 1098 | return 1;
|
---|
| 1099 | if (parent == NULL)
|
---|
| 1100 | return 0;
|
---|
| 1101 |
|
---|
| 1102 | p = 0;
|
---|
| 1103 | for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
|
---|
| 1104 | if (!extract_min_max(sk_IPAddressOrRange_value(child, c),
|
---|
| 1105 | c_min, c_max, length))
|
---|
| 1106 | return -1;
|
---|
| 1107 | for (;; p++) {
|
---|
| 1108 | if (p >= sk_IPAddressOrRange_num(parent))
|
---|
| 1109 | return 0;
|
---|
| 1110 | if (!extract_min_max(sk_IPAddressOrRange_value(parent, p),
|
---|
| 1111 | p_min, p_max, length))
|
---|
| 1112 | return 0;
|
---|
| 1113 | if (memcmp(p_max, c_max, length) < 0)
|
---|
| 1114 | continue;
|
---|
| 1115 | if (memcmp(p_min, c_min, length) > 0)
|
---|
| 1116 | return 0;
|
---|
| 1117 | break;
|
---|
| 1118 | }
|
---|
| 1119 | }
|
---|
| 1120 |
|
---|
| 1121 | return 1;
|
---|
| 1122 | }
|
---|
| 1123 |
|
---|
| 1124 | /*
|
---|
| 1125 | * Test whether a is a subset of b.
|
---|
| 1126 | */
|
---|
| 1127 | int X509v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
|
---|
| 1128 | {
|
---|
| 1129 | int i;
|
---|
| 1130 | if (a == NULL || a == b)
|
---|
| 1131 | return 1;
|
---|
| 1132 | if (b == NULL || X509v3_addr_inherits(a) || X509v3_addr_inherits(b))
|
---|
| 1133 | return 0;
|
---|
| 1134 | (void)sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
|
---|
| 1135 | for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
|
---|
| 1136 | IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
|
---|
| 1137 | int j = sk_IPAddressFamily_find(b, fa);
|
---|
| 1138 | IPAddressFamily *fb;
|
---|
| 1139 | fb = sk_IPAddressFamily_value(b, j);
|
---|
| 1140 | if (fb == NULL)
|
---|
| 1141 | return 0;
|
---|
| 1142 | if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
|
---|
| 1143 | fa->ipAddressChoice->u.addressesOrRanges,
|
---|
| 1144 | length_from_afi(X509v3_addr_get_afi(fb))))
|
---|
| 1145 | return 0;
|
---|
| 1146 | }
|
---|
| 1147 | return 1;
|
---|
| 1148 | }
|
---|
| 1149 |
|
---|
| 1150 | /*
|
---|
| 1151 | * Validation error handling via callback.
|
---|
| 1152 | */
|
---|
| 1153 | #define validation_err(_err_) \
|
---|
| 1154 | do { \
|
---|
| 1155 | if (ctx != NULL) { \
|
---|
| 1156 | ctx->error = _err_; \
|
---|
| 1157 | ctx->error_depth = i; \
|
---|
| 1158 | ctx->current_cert = x; \
|
---|
| 1159 | ret = ctx->verify_cb(0, ctx); \
|
---|
| 1160 | } else { \
|
---|
| 1161 | ret = 0; \
|
---|
| 1162 | } \
|
---|
| 1163 | if (!ret) \
|
---|
| 1164 | goto done; \
|
---|
| 1165 | } while (0)
|
---|
| 1166 |
|
---|
| 1167 | /*
|
---|
| 1168 | * Core code for RFC 3779 2.3 path validation.
|
---|
| 1169 | *
|
---|
| 1170 | * Returns 1 for success, 0 on error.
|
---|
| 1171 | *
|
---|
| 1172 | * When returning 0, ctx->error MUST be set to an appropriate value other than
|
---|
| 1173 | * X509_V_OK.
|
---|
| 1174 | */
|
---|
| 1175 | static int addr_validate_path_internal(X509_STORE_CTX *ctx,
|
---|
| 1176 | STACK_OF(X509) *chain,
|
---|
| 1177 | IPAddrBlocks *ext)
|
---|
| 1178 | {
|
---|
| 1179 | IPAddrBlocks *child = NULL;
|
---|
| 1180 | int i, j, ret = 1;
|
---|
| 1181 | X509 *x;
|
---|
| 1182 |
|
---|
| 1183 | OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
|
---|
| 1184 | OPENSSL_assert(ctx != NULL || ext != NULL);
|
---|
| 1185 | OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
|
---|
| 1186 |
|
---|
| 1187 | /*
|
---|
| 1188 | * Figure out where to start. If we don't have an extension to
|
---|
| 1189 | * check, we're done. Otherwise, check canonical form and
|
---|
| 1190 | * set up for walking up the chain.
|
---|
| 1191 | */
|
---|
| 1192 | if (ext != NULL) {
|
---|
| 1193 | i = -1;
|
---|
| 1194 | x = NULL;
|
---|
| 1195 | } else {
|
---|
| 1196 | i = 0;
|
---|
| 1197 | x = sk_X509_value(chain, i);
|
---|
| 1198 | OPENSSL_assert(x != NULL);
|
---|
| 1199 | if ((ext = x->rfc3779_addr) == NULL)
|
---|
| 1200 | goto done;
|
---|
| 1201 | }
|
---|
| 1202 | if (!X509v3_addr_is_canonical(ext))
|
---|
| 1203 | validation_err(X509_V_ERR_INVALID_EXTENSION);
|
---|
| 1204 | (void)sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
|
---|
| 1205 | if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
|
---|
| 1206 | X509V3err(X509V3_F_ADDR_VALIDATE_PATH_INTERNAL,
|
---|
| 1207 | ERR_R_MALLOC_FAILURE);
|
---|
| 1208 | ctx->error = X509_V_ERR_OUT_OF_MEM;
|
---|
| 1209 | ret = 0;
|
---|
| 1210 | goto done;
|
---|
| 1211 | }
|
---|
| 1212 |
|
---|
| 1213 | /*
|
---|
| 1214 | * Now walk up the chain. No cert may list resources that its
|
---|
| 1215 | * parent doesn't list.
|
---|
| 1216 | */
|
---|
| 1217 | for (i++; i < sk_X509_num(chain); i++) {
|
---|
| 1218 | x = sk_X509_value(chain, i);
|
---|
| 1219 | OPENSSL_assert(x != NULL);
|
---|
| 1220 | if (!X509v3_addr_is_canonical(x->rfc3779_addr))
|
---|
| 1221 | validation_err(X509_V_ERR_INVALID_EXTENSION);
|
---|
| 1222 | if (x->rfc3779_addr == NULL) {
|
---|
| 1223 | for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
|
---|
| 1224 | IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
|
---|
| 1225 | if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
|
---|
| 1226 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 1227 | break;
|
---|
| 1228 | }
|
---|
| 1229 | }
|
---|
| 1230 | continue;
|
---|
| 1231 | }
|
---|
| 1232 | (void)sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr,
|
---|
| 1233 | IPAddressFamily_cmp);
|
---|
| 1234 | for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
|
---|
| 1235 | IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
|
---|
| 1236 | int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
|
---|
| 1237 | IPAddressFamily *fp =
|
---|
| 1238 | sk_IPAddressFamily_value(x->rfc3779_addr, k);
|
---|
| 1239 | if (fp == NULL) {
|
---|
| 1240 | if (fc->ipAddressChoice->type ==
|
---|
| 1241 | IPAddressChoice_addressesOrRanges) {
|
---|
| 1242 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 1243 | break;
|
---|
| 1244 | }
|
---|
| 1245 | continue;
|
---|
| 1246 | }
|
---|
| 1247 | if (fp->ipAddressChoice->type ==
|
---|
| 1248 | IPAddressChoice_addressesOrRanges) {
|
---|
| 1249 | if (fc->ipAddressChoice->type == IPAddressChoice_inherit
|
---|
| 1250 | || addr_contains(fp->ipAddressChoice->u.addressesOrRanges,
|
---|
| 1251 | fc->ipAddressChoice->u.addressesOrRanges,
|
---|
| 1252 | length_from_afi(X509v3_addr_get_afi(fc))))
|
---|
| 1253 | sk_IPAddressFamily_set(child, j, fp);
|
---|
| 1254 | else
|
---|
| 1255 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 1256 | }
|
---|
| 1257 | }
|
---|
| 1258 | }
|
---|
| 1259 |
|
---|
| 1260 | /*
|
---|
| 1261 | * Trust anchor can't inherit.
|
---|
| 1262 | */
|
---|
| 1263 | OPENSSL_assert(x != NULL);
|
---|
| 1264 | if (x->rfc3779_addr != NULL) {
|
---|
| 1265 | for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
|
---|
| 1266 | IPAddressFamily *fp =
|
---|
| 1267 | sk_IPAddressFamily_value(x->rfc3779_addr, j);
|
---|
| 1268 | if (fp->ipAddressChoice->type == IPAddressChoice_inherit
|
---|
| 1269 | && sk_IPAddressFamily_find(child, fp) >= 0)
|
---|
| 1270 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 1271 | }
|
---|
| 1272 | }
|
---|
| 1273 |
|
---|
| 1274 | done:
|
---|
| 1275 | sk_IPAddressFamily_free(child);
|
---|
| 1276 | return ret;
|
---|
| 1277 | }
|
---|
| 1278 |
|
---|
| 1279 | #undef validation_err
|
---|
| 1280 |
|
---|
| 1281 | /*
|
---|
| 1282 | * RFC 3779 2.3 path validation -- called from X509_verify_cert().
|
---|
| 1283 | */
|
---|
| 1284 | int X509v3_addr_validate_path(X509_STORE_CTX *ctx)
|
---|
| 1285 | {
|
---|
| 1286 | return addr_validate_path_internal(ctx, ctx->chain, NULL);
|
---|
| 1287 | }
|
---|
| 1288 |
|
---|
| 1289 | /*
|
---|
| 1290 | * RFC 3779 2.3 path validation of an extension.
|
---|
| 1291 | * Test whether chain covers extension.
|
---|
| 1292 | */
|
---|
| 1293 | int X509v3_addr_validate_resource_set(STACK_OF(X509) *chain,
|
---|
| 1294 | IPAddrBlocks *ext, int allow_inheritance)
|
---|
| 1295 | {
|
---|
| 1296 | if (ext == NULL)
|
---|
| 1297 | return 1;
|
---|
| 1298 | if (chain == NULL || sk_X509_num(chain) == 0)
|
---|
| 1299 | return 0;
|
---|
| 1300 | if (!allow_inheritance && X509v3_addr_inherits(ext))
|
---|
| 1301 | return 0;
|
---|
| 1302 | return addr_validate_path_internal(NULL, chain, ext);
|
---|
| 1303 | }
|
---|
| 1304 |
|
---|
| 1305 | #endif /* OPENSSL_NO_RFC3779 */
|
---|