[331] | 1 | /*
|
---|
| 2 | * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | /*
|
---|
| 11 | * Implementation of RFC 3779 section 3.2.
|
---|
| 12 | */
|
---|
| 13 |
|
---|
| 14 | #include <stdio.h>
|
---|
| 15 | #include <string.h>
|
---|
| 16 | #include "internal/cryptlib.h"
|
---|
| 17 | #include <openssl/conf.h>
|
---|
| 18 | #include <openssl/asn1.h>
|
---|
| 19 | #include <openssl/asn1t.h>
|
---|
| 20 | #include <openssl/x509v3.h>
|
---|
| 21 | #include <openssl/x509.h>
|
---|
| 22 | #include "internal/x509_int.h"
|
---|
| 23 | #include <openssl/bn.h>
|
---|
| 24 | #include "ext_dat.h"
|
---|
| 25 |
|
---|
| 26 | #ifndef OPENSSL_NO_RFC3779
|
---|
| 27 |
|
---|
| 28 | /*
|
---|
| 29 | * OpenSSL ASN.1 template translation of RFC 3779 3.2.3.
|
---|
| 30 | */
|
---|
| 31 |
|
---|
| 32 | ASN1_SEQUENCE(ASRange) = {
|
---|
| 33 | ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
|
---|
| 34 | ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
|
---|
| 35 | } ASN1_SEQUENCE_END(ASRange)
|
---|
| 36 |
|
---|
| 37 | ASN1_CHOICE(ASIdOrRange) = {
|
---|
| 38 | ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER),
|
---|
| 39 | ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
|
---|
| 40 | } ASN1_CHOICE_END(ASIdOrRange)
|
---|
| 41 |
|
---|
| 42 | ASN1_CHOICE(ASIdentifierChoice) = {
|
---|
| 43 | ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL),
|
---|
| 44 | ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
|
---|
| 45 | } ASN1_CHOICE_END(ASIdentifierChoice)
|
---|
| 46 |
|
---|
| 47 | ASN1_SEQUENCE(ASIdentifiers) = {
|
---|
| 48 | ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
|
---|
| 49 | ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1)
|
---|
| 50 | } ASN1_SEQUENCE_END(ASIdentifiers)
|
---|
| 51 |
|
---|
| 52 | IMPLEMENT_ASN1_FUNCTIONS(ASRange)
|
---|
| 53 | IMPLEMENT_ASN1_FUNCTIONS(ASIdOrRange)
|
---|
| 54 | IMPLEMENT_ASN1_FUNCTIONS(ASIdentifierChoice)
|
---|
| 55 | IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
|
---|
| 56 |
|
---|
| 57 | /*
|
---|
| 58 | * i2r method for an ASIdentifierChoice.
|
---|
| 59 | */
|
---|
| 60 | static int i2r_ASIdentifierChoice(BIO *out,
|
---|
| 61 | ASIdentifierChoice *choice,
|
---|
| 62 | int indent, const char *msg)
|
---|
| 63 | {
|
---|
| 64 | int i;
|
---|
| 65 | char *s;
|
---|
| 66 | if (choice == NULL)
|
---|
| 67 | return 1;
|
---|
| 68 | BIO_printf(out, "%*s%s:\n", indent, "", msg);
|
---|
| 69 | switch (choice->type) {
|
---|
| 70 | case ASIdentifierChoice_inherit:
|
---|
| 71 | BIO_printf(out, "%*sinherit\n", indent + 2, "");
|
---|
| 72 | break;
|
---|
| 73 | case ASIdentifierChoice_asIdsOrRanges:
|
---|
| 74 | for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) {
|
---|
| 75 | ASIdOrRange *aor =
|
---|
| 76 | sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
|
---|
| 77 | switch (aor->type) {
|
---|
| 78 | case ASIdOrRange_id:
|
---|
| 79 | if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL)
|
---|
| 80 | return 0;
|
---|
| 81 | BIO_printf(out, "%*s%s\n", indent + 2, "", s);
|
---|
| 82 | OPENSSL_free(s);
|
---|
| 83 | break;
|
---|
| 84 | case ASIdOrRange_range:
|
---|
| 85 | if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL)
|
---|
| 86 | return 0;
|
---|
| 87 | BIO_printf(out, "%*s%s-", indent + 2, "", s);
|
---|
| 88 | OPENSSL_free(s);
|
---|
| 89 | if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL)
|
---|
| 90 | return 0;
|
---|
| 91 | BIO_printf(out, "%s\n", s);
|
---|
| 92 | OPENSSL_free(s);
|
---|
| 93 | break;
|
---|
| 94 | default:
|
---|
| 95 | return 0;
|
---|
| 96 | }
|
---|
| 97 | }
|
---|
| 98 | break;
|
---|
| 99 | default:
|
---|
| 100 | return 0;
|
---|
| 101 | }
|
---|
| 102 | return 1;
|
---|
| 103 | }
|
---|
| 104 |
|
---|
| 105 | /*
|
---|
| 106 | * i2r method for an ASIdentifier extension.
|
---|
| 107 | */
|
---|
| 108 | static int i2r_ASIdentifiers(const X509V3_EXT_METHOD *method,
|
---|
| 109 | void *ext, BIO *out, int indent)
|
---|
| 110 | {
|
---|
| 111 | ASIdentifiers *asid = ext;
|
---|
| 112 | return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
|
---|
| 113 | "Autonomous System Numbers") &&
|
---|
| 114 | i2r_ASIdentifierChoice(out, asid->rdi, indent,
|
---|
| 115 | "Routing Domain Identifiers"));
|
---|
| 116 | }
|
---|
| 117 |
|
---|
| 118 | /*
|
---|
| 119 | * Sort comparison function for a sequence of ASIdOrRange elements.
|
---|
| 120 | */
|
---|
| 121 | static int ASIdOrRange_cmp(const ASIdOrRange *const *a_,
|
---|
| 122 | const ASIdOrRange *const *b_)
|
---|
| 123 | {
|
---|
| 124 | const ASIdOrRange *a = *a_, *b = *b_;
|
---|
| 125 |
|
---|
| 126 | OPENSSL_assert((a->type == ASIdOrRange_id && a->u.id != NULL) ||
|
---|
| 127 | (a->type == ASIdOrRange_range && a->u.range != NULL &&
|
---|
| 128 | a->u.range->min != NULL && a->u.range->max != NULL));
|
---|
| 129 |
|
---|
| 130 | OPENSSL_assert((b->type == ASIdOrRange_id && b->u.id != NULL) ||
|
---|
| 131 | (b->type == ASIdOrRange_range && b->u.range != NULL &&
|
---|
| 132 | b->u.range->min != NULL && b->u.range->max != NULL));
|
---|
| 133 |
|
---|
| 134 | if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
|
---|
| 135 | return ASN1_INTEGER_cmp(a->u.id, b->u.id);
|
---|
| 136 |
|
---|
| 137 | if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
|
---|
| 138 | int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
|
---|
| 139 | return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max,
|
---|
| 140 | b->u.range->max);
|
---|
| 141 | }
|
---|
| 142 |
|
---|
| 143 | if (a->type == ASIdOrRange_id)
|
---|
| 144 | return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
|
---|
| 145 | else
|
---|
| 146 | return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
|
---|
| 147 | }
|
---|
| 148 |
|
---|
| 149 | /*
|
---|
| 150 | * Add an inherit element.
|
---|
| 151 | */
|
---|
| 152 | int X509v3_asid_add_inherit(ASIdentifiers *asid, int which)
|
---|
| 153 | {
|
---|
| 154 | ASIdentifierChoice **choice;
|
---|
| 155 | if (asid == NULL)
|
---|
| 156 | return 0;
|
---|
| 157 | switch (which) {
|
---|
| 158 | case V3_ASID_ASNUM:
|
---|
| 159 | choice = &asid->asnum;
|
---|
| 160 | break;
|
---|
| 161 | case V3_ASID_RDI:
|
---|
| 162 | choice = &asid->rdi;
|
---|
| 163 | break;
|
---|
| 164 | default:
|
---|
| 165 | return 0;
|
---|
| 166 | }
|
---|
| 167 | if (*choice == NULL) {
|
---|
| 168 | if ((*choice = ASIdentifierChoice_new()) == NULL)
|
---|
| 169 | return 0;
|
---|
| 170 | OPENSSL_assert((*choice)->u.inherit == NULL);
|
---|
| 171 | if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL)
|
---|
| 172 | return 0;
|
---|
| 173 | (*choice)->type = ASIdentifierChoice_inherit;
|
---|
| 174 | }
|
---|
| 175 | return (*choice)->type == ASIdentifierChoice_inherit;
|
---|
| 176 | }
|
---|
| 177 |
|
---|
| 178 | /*
|
---|
| 179 | * Add an ID or range to an ASIdentifierChoice.
|
---|
| 180 | */
|
---|
| 181 | int X509v3_asid_add_id_or_range(ASIdentifiers *asid,
|
---|
| 182 | int which, ASN1_INTEGER *min, ASN1_INTEGER *max)
|
---|
| 183 | {
|
---|
| 184 | ASIdentifierChoice **choice;
|
---|
| 185 | ASIdOrRange *aor;
|
---|
| 186 | if (asid == NULL)
|
---|
| 187 | return 0;
|
---|
| 188 | switch (which) {
|
---|
| 189 | case V3_ASID_ASNUM:
|
---|
| 190 | choice = &asid->asnum;
|
---|
| 191 | break;
|
---|
| 192 | case V3_ASID_RDI:
|
---|
| 193 | choice = &asid->rdi;
|
---|
| 194 | break;
|
---|
| 195 | default:
|
---|
| 196 | return 0;
|
---|
| 197 | }
|
---|
| 198 | if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit)
|
---|
| 199 | return 0;
|
---|
| 200 | if (*choice == NULL) {
|
---|
| 201 | if ((*choice = ASIdentifierChoice_new()) == NULL)
|
---|
| 202 | return 0;
|
---|
| 203 | OPENSSL_assert((*choice)->u.asIdsOrRanges == NULL);
|
---|
| 204 | (*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp);
|
---|
| 205 | if ((*choice)->u.asIdsOrRanges == NULL)
|
---|
| 206 | return 0;
|
---|
| 207 | (*choice)->type = ASIdentifierChoice_asIdsOrRanges;
|
---|
| 208 | }
|
---|
| 209 | if ((aor = ASIdOrRange_new()) == NULL)
|
---|
| 210 | return 0;
|
---|
| 211 | if (max == NULL) {
|
---|
| 212 | aor->type = ASIdOrRange_id;
|
---|
| 213 | aor->u.id = min;
|
---|
| 214 | } else {
|
---|
| 215 | aor->type = ASIdOrRange_range;
|
---|
| 216 | if ((aor->u.range = ASRange_new()) == NULL)
|
---|
| 217 | goto err;
|
---|
| 218 | ASN1_INTEGER_free(aor->u.range->min);
|
---|
| 219 | aor->u.range->min = min;
|
---|
| 220 | ASN1_INTEGER_free(aor->u.range->max);
|
---|
| 221 | aor->u.range->max = max;
|
---|
| 222 | }
|
---|
| 223 | if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
|
---|
| 224 | goto err;
|
---|
| 225 | return 1;
|
---|
| 226 |
|
---|
| 227 | err:
|
---|
| 228 | ASIdOrRange_free(aor);
|
---|
| 229 | return 0;
|
---|
| 230 | }
|
---|
| 231 |
|
---|
| 232 | /*
|
---|
| 233 | * Extract min and max values from an ASIdOrRange.
|
---|
| 234 | */
|
---|
| 235 | static void extract_min_max(ASIdOrRange *aor,
|
---|
| 236 | ASN1_INTEGER **min, ASN1_INTEGER **max)
|
---|
| 237 | {
|
---|
| 238 | OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
|
---|
| 239 | switch (aor->type) {
|
---|
| 240 | case ASIdOrRange_id:
|
---|
| 241 | *min = aor->u.id;
|
---|
| 242 | *max = aor->u.id;
|
---|
| 243 | return;
|
---|
| 244 | case ASIdOrRange_range:
|
---|
| 245 | *min = aor->u.range->min;
|
---|
| 246 | *max = aor->u.range->max;
|
---|
| 247 | return;
|
---|
| 248 | }
|
---|
| 249 | }
|
---|
| 250 |
|
---|
| 251 | /*
|
---|
| 252 | * Check whether an ASIdentifierChoice is in canonical form.
|
---|
| 253 | */
|
---|
| 254 | static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
|
---|
| 255 | {
|
---|
| 256 | ASN1_INTEGER *a_max_plus_one = NULL;
|
---|
| 257 | BIGNUM *bn = NULL;
|
---|
| 258 | int i, ret = 0;
|
---|
| 259 |
|
---|
| 260 | /*
|
---|
| 261 | * Empty element or inheritance is canonical.
|
---|
| 262 | */
|
---|
| 263 | if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
|
---|
| 264 | return 1;
|
---|
| 265 |
|
---|
| 266 | /*
|
---|
| 267 | * If not a list, or if empty list, it's broken.
|
---|
| 268 | */
|
---|
| 269 | if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
|
---|
| 270 | sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
|
---|
| 271 | return 0;
|
---|
| 272 |
|
---|
| 273 | /*
|
---|
| 274 | * It's a list, check it.
|
---|
| 275 | */
|
---|
| 276 | for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
|
---|
| 277 | ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
|
---|
| 278 | ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
|
---|
| 279 | ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
|
---|
| 280 | NULL;
|
---|
| 281 |
|
---|
| 282 | extract_min_max(a, &a_min, &a_max);
|
---|
| 283 | extract_min_max(b, &b_min, &b_max);
|
---|
| 284 |
|
---|
| 285 | /*
|
---|
| 286 | * Punt misordered list, overlapping start, or inverted range.
|
---|
| 287 | */
|
---|
| 288 | if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
|
---|
| 289 | ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
|
---|
| 290 | ASN1_INTEGER_cmp(b_min, b_max) > 0)
|
---|
| 291 | goto done;
|
---|
| 292 |
|
---|
| 293 | /*
|
---|
| 294 | * Calculate a_max + 1 to check for adjacency.
|
---|
| 295 | */
|
---|
| 296 | if ((bn == NULL && (bn = BN_new()) == NULL) ||
|
---|
| 297 | ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
|
---|
| 298 | !BN_add_word(bn, 1) ||
|
---|
| 299 | (a_max_plus_one =
|
---|
| 300 | BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
|
---|
| 301 | X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
|
---|
| 302 | ERR_R_MALLOC_FAILURE);
|
---|
| 303 | goto done;
|
---|
| 304 | }
|
---|
| 305 |
|
---|
| 306 | /*
|
---|
| 307 | * Punt if adjacent or overlapping.
|
---|
| 308 | */
|
---|
| 309 | if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
|
---|
| 310 | goto done;
|
---|
| 311 | }
|
---|
| 312 |
|
---|
| 313 | /*
|
---|
| 314 | * Check for inverted range.
|
---|
| 315 | */
|
---|
| 316 | i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
|
---|
| 317 | {
|
---|
| 318 | ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
|
---|
| 319 | ASN1_INTEGER *a_min, *a_max;
|
---|
| 320 | if (a != NULL && a->type == ASIdOrRange_range) {
|
---|
| 321 | extract_min_max(a, &a_min, &a_max);
|
---|
| 322 | if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
|
---|
| 323 | goto done;
|
---|
| 324 | }
|
---|
| 325 | }
|
---|
| 326 |
|
---|
| 327 | ret = 1;
|
---|
| 328 |
|
---|
| 329 | done:
|
---|
| 330 | ASN1_INTEGER_free(a_max_plus_one);
|
---|
| 331 | BN_free(bn);
|
---|
| 332 | return ret;
|
---|
| 333 | }
|
---|
| 334 |
|
---|
| 335 | /*
|
---|
| 336 | * Check whether an ASIdentifier extension is in canonical form.
|
---|
| 337 | */
|
---|
| 338 | int X509v3_asid_is_canonical(ASIdentifiers *asid)
|
---|
| 339 | {
|
---|
| 340 | return (asid == NULL ||
|
---|
| 341 | (ASIdentifierChoice_is_canonical(asid->asnum) &&
|
---|
| 342 | ASIdentifierChoice_is_canonical(asid->rdi)));
|
---|
| 343 | }
|
---|
| 344 |
|
---|
| 345 | /*
|
---|
| 346 | * Whack an ASIdentifierChoice into canonical form.
|
---|
| 347 | */
|
---|
| 348 | static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
|
---|
| 349 | {
|
---|
| 350 | ASN1_INTEGER *a_max_plus_one = NULL;
|
---|
| 351 | BIGNUM *bn = NULL;
|
---|
| 352 | int i, ret = 0;
|
---|
| 353 |
|
---|
| 354 | /*
|
---|
| 355 | * Nothing to do for empty element or inheritance.
|
---|
| 356 | */
|
---|
| 357 | if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
|
---|
| 358 | return 1;
|
---|
| 359 |
|
---|
| 360 | /*
|
---|
| 361 | * If not a list, or if empty list, it's broken.
|
---|
| 362 | */
|
---|
| 363 | if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
|
---|
| 364 | sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
|
---|
| 365 | X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
|
---|
| 366 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 367 | return 0;
|
---|
| 368 | }
|
---|
| 369 |
|
---|
| 370 | /*
|
---|
| 371 | * We have a non-empty list. Sort it.
|
---|
| 372 | */
|
---|
| 373 | sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
|
---|
| 374 |
|
---|
| 375 | /*
|
---|
| 376 | * Now check for errors and suboptimal encoding, rejecting the
|
---|
| 377 | * former and fixing the latter.
|
---|
| 378 | */
|
---|
| 379 | for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
|
---|
| 380 | ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
|
---|
| 381 | ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
|
---|
| 382 | ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
|
---|
| 383 | NULL;
|
---|
| 384 |
|
---|
| 385 | extract_min_max(a, &a_min, &a_max);
|
---|
| 386 | extract_min_max(b, &b_min, &b_max);
|
---|
| 387 |
|
---|
| 388 | /*
|
---|
| 389 | * Make sure we're properly sorted (paranoia).
|
---|
| 390 | */
|
---|
| 391 | OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
|
---|
| 392 |
|
---|
| 393 | /*
|
---|
| 394 | * Punt inverted ranges.
|
---|
| 395 | */
|
---|
| 396 | if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
|
---|
| 397 | ASN1_INTEGER_cmp(b_min, b_max) > 0)
|
---|
| 398 | goto done;
|
---|
| 399 |
|
---|
| 400 | /*
|
---|
| 401 | * Check for overlaps.
|
---|
| 402 | */
|
---|
| 403 | if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
|
---|
| 404 | X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
|
---|
| 405 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 406 | goto done;
|
---|
| 407 | }
|
---|
| 408 |
|
---|
| 409 | /*
|
---|
| 410 | * Calculate a_max + 1 to check for adjacency.
|
---|
| 411 | */
|
---|
| 412 | if ((bn == NULL && (bn = BN_new()) == NULL) ||
|
---|
| 413 | ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
|
---|
| 414 | !BN_add_word(bn, 1) ||
|
---|
| 415 | (a_max_plus_one =
|
---|
| 416 | BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
|
---|
| 417 | X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
|
---|
| 418 | ERR_R_MALLOC_FAILURE);
|
---|
| 419 | goto done;
|
---|
| 420 | }
|
---|
| 421 |
|
---|
| 422 | /*
|
---|
| 423 | * If a and b are adjacent, merge them.
|
---|
| 424 | */
|
---|
| 425 | if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
|
---|
| 426 | ASRange *r;
|
---|
| 427 | switch (a->type) {
|
---|
| 428 | case ASIdOrRange_id:
|
---|
| 429 | if ((r = OPENSSL_malloc(sizeof(*r))) == NULL) {
|
---|
| 430 | X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
|
---|
| 431 | ERR_R_MALLOC_FAILURE);
|
---|
| 432 | goto done;
|
---|
| 433 | }
|
---|
| 434 | r->min = a_min;
|
---|
| 435 | r->max = b_max;
|
---|
| 436 | a->type = ASIdOrRange_range;
|
---|
| 437 | a->u.range = r;
|
---|
| 438 | break;
|
---|
| 439 | case ASIdOrRange_range:
|
---|
| 440 | ASN1_INTEGER_free(a->u.range->max);
|
---|
| 441 | a->u.range->max = b_max;
|
---|
| 442 | break;
|
---|
| 443 | }
|
---|
| 444 | switch (b->type) {
|
---|
| 445 | case ASIdOrRange_id:
|
---|
| 446 | b->u.id = NULL;
|
---|
| 447 | break;
|
---|
| 448 | case ASIdOrRange_range:
|
---|
| 449 | b->u.range->max = NULL;
|
---|
| 450 | break;
|
---|
| 451 | }
|
---|
| 452 | ASIdOrRange_free(b);
|
---|
| 453 | (void)sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
|
---|
| 454 | i--;
|
---|
| 455 | continue;
|
---|
| 456 | }
|
---|
| 457 | }
|
---|
| 458 |
|
---|
| 459 | /*
|
---|
| 460 | * Check for final inverted range.
|
---|
| 461 | */
|
---|
| 462 | i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
|
---|
| 463 | {
|
---|
| 464 | ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
|
---|
| 465 | ASN1_INTEGER *a_min, *a_max;
|
---|
| 466 | if (a != NULL && a->type == ASIdOrRange_range) {
|
---|
| 467 | extract_min_max(a, &a_min, &a_max);
|
---|
| 468 | if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
|
---|
| 469 | goto done;
|
---|
| 470 | }
|
---|
| 471 | }
|
---|
| 472 |
|
---|
| 473 | OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
|
---|
| 474 |
|
---|
| 475 | ret = 1;
|
---|
| 476 |
|
---|
| 477 | done:
|
---|
| 478 | ASN1_INTEGER_free(a_max_plus_one);
|
---|
| 479 | BN_free(bn);
|
---|
| 480 | return ret;
|
---|
| 481 | }
|
---|
| 482 |
|
---|
| 483 | /*
|
---|
| 484 | * Whack an ASIdentifier extension into canonical form.
|
---|
| 485 | */
|
---|
| 486 | int X509v3_asid_canonize(ASIdentifiers *asid)
|
---|
| 487 | {
|
---|
| 488 | return (asid == NULL ||
|
---|
| 489 | (ASIdentifierChoice_canonize(asid->asnum) &&
|
---|
| 490 | ASIdentifierChoice_canonize(asid->rdi)));
|
---|
| 491 | }
|
---|
| 492 |
|
---|
| 493 | /*
|
---|
| 494 | * v2i method for an ASIdentifier extension.
|
---|
| 495 | */
|
---|
| 496 | static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
|
---|
| 497 | struct v3_ext_ctx *ctx,
|
---|
| 498 | STACK_OF(CONF_VALUE) *values)
|
---|
| 499 | {
|
---|
| 500 | ASN1_INTEGER *min = NULL, *max = NULL;
|
---|
| 501 | ASIdentifiers *asid = NULL;
|
---|
| 502 | int i;
|
---|
| 503 |
|
---|
| 504 | if ((asid = ASIdentifiers_new()) == NULL) {
|
---|
| 505 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
|
---|
| 506 | return NULL;
|
---|
| 507 | }
|
---|
| 508 |
|
---|
| 509 | for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
|
---|
| 510 | CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
|
---|
| 511 | int i1 = 0, i2 = 0, i3 = 0, is_range = 0, which = 0;
|
---|
| 512 |
|
---|
| 513 | /*
|
---|
| 514 | * Figure out whether this is an AS or an RDI.
|
---|
| 515 | */
|
---|
| 516 | if (!name_cmp(val->name, "AS")) {
|
---|
| 517 | which = V3_ASID_ASNUM;
|
---|
| 518 | } else if (!name_cmp(val->name, "RDI")) {
|
---|
| 519 | which = V3_ASID_RDI;
|
---|
| 520 | } else {
|
---|
| 521 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
|
---|
| 522 | X509V3_R_EXTENSION_NAME_ERROR);
|
---|
| 523 | X509V3_conf_err(val);
|
---|
| 524 | goto err;
|
---|
| 525 | }
|
---|
| 526 |
|
---|
| 527 | /*
|
---|
| 528 | * Handle inheritance.
|
---|
| 529 | */
|
---|
| 530 | if (strcmp(val->value, "inherit") == 0) {
|
---|
| 531 | if (X509v3_asid_add_inherit(asid, which))
|
---|
| 532 | continue;
|
---|
| 533 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
|
---|
| 534 | X509V3_R_INVALID_INHERITANCE);
|
---|
| 535 | X509V3_conf_err(val);
|
---|
| 536 | goto err;
|
---|
| 537 | }
|
---|
| 538 |
|
---|
| 539 | /*
|
---|
| 540 | * Number, range, or mistake, pick it apart and figure out which.
|
---|
| 541 | */
|
---|
| 542 | i1 = strspn(val->value, "0123456789");
|
---|
| 543 | if (val->value[i1] == '\0') {
|
---|
| 544 | is_range = 0;
|
---|
| 545 | } else {
|
---|
| 546 | is_range = 1;
|
---|
| 547 | i2 = i1 + strspn(val->value + i1, " \t");
|
---|
| 548 | if (val->value[i2] != '-') {
|
---|
| 549 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
|
---|
| 550 | X509V3_R_INVALID_ASNUMBER);
|
---|
| 551 | X509V3_conf_err(val);
|
---|
| 552 | goto err;
|
---|
| 553 | }
|
---|
| 554 | i2++;
|
---|
| 555 | i2 = i2 + strspn(val->value + i2, " \t");
|
---|
| 556 | i3 = i2 + strspn(val->value + i2, "0123456789");
|
---|
| 557 | if (val->value[i3] != '\0') {
|
---|
| 558 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
|
---|
| 559 | X509V3_R_INVALID_ASRANGE);
|
---|
| 560 | X509V3_conf_err(val);
|
---|
| 561 | goto err;
|
---|
| 562 | }
|
---|
| 563 | }
|
---|
| 564 |
|
---|
| 565 | /*
|
---|
| 566 | * Syntax is ok, read and add it.
|
---|
| 567 | */
|
---|
| 568 | if (!is_range) {
|
---|
| 569 | if (!X509V3_get_value_int(val, &min)) {
|
---|
| 570 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
|
---|
| 571 | goto err;
|
---|
| 572 | }
|
---|
| 573 | } else {
|
---|
| 574 | char *s = OPENSSL_strdup(val->value);
|
---|
| 575 | if (s == NULL) {
|
---|
| 576 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
|
---|
| 577 | goto err;
|
---|
| 578 | }
|
---|
| 579 | s[i1] = '\0';
|
---|
| 580 | min = s2i_ASN1_INTEGER(NULL, s);
|
---|
| 581 | max = s2i_ASN1_INTEGER(NULL, s + i2);
|
---|
| 582 | OPENSSL_free(s);
|
---|
| 583 | if (min == NULL || max == NULL) {
|
---|
| 584 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
|
---|
| 585 | goto err;
|
---|
| 586 | }
|
---|
| 587 | if (ASN1_INTEGER_cmp(min, max) > 0) {
|
---|
| 588 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
|
---|
| 589 | X509V3_R_EXTENSION_VALUE_ERROR);
|
---|
| 590 | goto err;
|
---|
| 591 | }
|
---|
| 592 | }
|
---|
| 593 | if (!X509v3_asid_add_id_or_range(asid, which, min, max)) {
|
---|
| 594 | X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
|
---|
| 595 | goto err;
|
---|
| 596 | }
|
---|
| 597 | min = max = NULL;
|
---|
| 598 | }
|
---|
| 599 |
|
---|
| 600 | /*
|
---|
| 601 | * Canonize the result, then we're done.
|
---|
| 602 | */
|
---|
| 603 | if (!X509v3_asid_canonize(asid))
|
---|
| 604 | goto err;
|
---|
| 605 | return asid;
|
---|
| 606 |
|
---|
| 607 | err:
|
---|
| 608 | ASIdentifiers_free(asid);
|
---|
| 609 | ASN1_INTEGER_free(min);
|
---|
| 610 | ASN1_INTEGER_free(max);
|
---|
| 611 | return NULL;
|
---|
| 612 | }
|
---|
| 613 |
|
---|
| 614 | /*
|
---|
| 615 | * OpenSSL dispatch.
|
---|
| 616 | */
|
---|
| 617 | const X509V3_EXT_METHOD v3_asid = {
|
---|
| 618 | NID_sbgp_autonomousSysNum, /* nid */
|
---|
| 619 | 0, /* flags */
|
---|
| 620 | ASN1_ITEM_ref(ASIdentifiers), /* template */
|
---|
| 621 | 0, 0, 0, 0, /* old functions, ignored */
|
---|
| 622 | 0, /* i2s */
|
---|
| 623 | 0, /* s2i */
|
---|
| 624 | 0, /* i2v */
|
---|
| 625 | v2i_ASIdentifiers, /* v2i */
|
---|
| 626 | i2r_ASIdentifiers, /* i2r */
|
---|
| 627 | 0, /* r2i */
|
---|
| 628 | NULL /* extension-specific data */
|
---|
| 629 | };
|
---|
| 630 |
|
---|
| 631 | /*
|
---|
| 632 | * Figure out whether extension uses inheritance.
|
---|
| 633 | */
|
---|
| 634 | int X509v3_asid_inherits(ASIdentifiers *asid)
|
---|
| 635 | {
|
---|
| 636 | return (asid != NULL &&
|
---|
| 637 | ((asid->asnum != NULL &&
|
---|
| 638 | asid->asnum->type == ASIdentifierChoice_inherit) ||
|
---|
| 639 | (asid->rdi != NULL &&
|
---|
| 640 | asid->rdi->type == ASIdentifierChoice_inherit)));
|
---|
| 641 | }
|
---|
| 642 |
|
---|
| 643 | /*
|
---|
| 644 | * Figure out whether parent contains child.
|
---|
| 645 | */
|
---|
| 646 | static int asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child)
|
---|
| 647 | {
|
---|
| 648 | ASN1_INTEGER *p_min = NULL, *p_max = NULL, *c_min = NULL, *c_max = NULL;
|
---|
| 649 | int p, c;
|
---|
| 650 |
|
---|
| 651 | if (child == NULL || parent == child)
|
---|
| 652 | return 1;
|
---|
| 653 | if (parent == NULL)
|
---|
| 654 | return 0;
|
---|
| 655 |
|
---|
| 656 | p = 0;
|
---|
| 657 | for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
|
---|
| 658 | extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max);
|
---|
| 659 | for (;; p++) {
|
---|
| 660 | if (p >= sk_ASIdOrRange_num(parent))
|
---|
| 661 | return 0;
|
---|
| 662 | extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min, &p_max);
|
---|
| 663 | if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
|
---|
| 664 | continue;
|
---|
| 665 | if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
|
---|
| 666 | return 0;
|
---|
| 667 | break;
|
---|
| 668 | }
|
---|
| 669 | }
|
---|
| 670 |
|
---|
| 671 | return 1;
|
---|
| 672 | }
|
---|
| 673 |
|
---|
| 674 | /*
|
---|
| 675 | * Test whether a is a subset of b.
|
---|
| 676 | */
|
---|
| 677 | int X509v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
|
---|
| 678 | {
|
---|
| 679 | return (a == NULL ||
|
---|
| 680 | a == b ||
|
---|
| 681 | (b != NULL &&
|
---|
| 682 | !X509v3_asid_inherits(a) &&
|
---|
| 683 | !X509v3_asid_inherits(b) &&
|
---|
| 684 | asid_contains(b->asnum->u.asIdsOrRanges,
|
---|
| 685 | a->asnum->u.asIdsOrRanges) &&
|
---|
| 686 | asid_contains(b->rdi->u.asIdsOrRanges,
|
---|
| 687 | a->rdi->u.asIdsOrRanges)));
|
---|
| 688 | }
|
---|
| 689 |
|
---|
| 690 | /*
|
---|
| 691 | * Validation error handling via callback.
|
---|
| 692 | */
|
---|
| 693 | #define validation_err(_err_) \
|
---|
| 694 | do { \
|
---|
| 695 | if (ctx != NULL) { \
|
---|
| 696 | ctx->error = _err_; \
|
---|
| 697 | ctx->error_depth = i; \
|
---|
| 698 | ctx->current_cert = x; \
|
---|
| 699 | ret = ctx->verify_cb(0, ctx); \
|
---|
| 700 | } else { \
|
---|
| 701 | ret = 0; \
|
---|
| 702 | } \
|
---|
| 703 | if (!ret) \
|
---|
| 704 | goto done; \
|
---|
| 705 | } while (0)
|
---|
| 706 |
|
---|
| 707 | /*
|
---|
| 708 | * Core code for RFC 3779 3.3 path validation.
|
---|
| 709 | */
|
---|
| 710 | static int asid_validate_path_internal(X509_STORE_CTX *ctx,
|
---|
| 711 | STACK_OF(X509) *chain,
|
---|
| 712 | ASIdentifiers *ext)
|
---|
| 713 | {
|
---|
| 714 | ASIdOrRanges *child_as = NULL, *child_rdi = NULL;
|
---|
| 715 | int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
|
---|
| 716 | X509 *x;
|
---|
| 717 |
|
---|
| 718 | OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
|
---|
| 719 | OPENSSL_assert(ctx != NULL || ext != NULL);
|
---|
| 720 | OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
|
---|
| 721 |
|
---|
| 722 | /*
|
---|
| 723 | * Figure out where to start. If we don't have an extension to
|
---|
| 724 | * check, we're done. Otherwise, check canonical form and
|
---|
| 725 | * set up for walking up the chain.
|
---|
| 726 | */
|
---|
| 727 | if (ext != NULL) {
|
---|
| 728 | i = -1;
|
---|
| 729 | x = NULL;
|
---|
| 730 | } else {
|
---|
| 731 | i = 0;
|
---|
| 732 | x = sk_X509_value(chain, i);
|
---|
| 733 | OPENSSL_assert(x != NULL);
|
---|
| 734 | if ((ext = x->rfc3779_asid) == NULL)
|
---|
| 735 | goto done;
|
---|
| 736 | }
|
---|
| 737 | if (!X509v3_asid_is_canonical(ext))
|
---|
| 738 | validation_err(X509_V_ERR_INVALID_EXTENSION);
|
---|
| 739 | if (ext->asnum != NULL) {
|
---|
| 740 | switch (ext->asnum->type) {
|
---|
| 741 | case ASIdentifierChoice_inherit:
|
---|
| 742 | inherit_as = 1;
|
---|
| 743 | break;
|
---|
| 744 | case ASIdentifierChoice_asIdsOrRanges:
|
---|
| 745 | child_as = ext->asnum->u.asIdsOrRanges;
|
---|
| 746 | break;
|
---|
| 747 | }
|
---|
| 748 | }
|
---|
| 749 | if (ext->rdi != NULL) {
|
---|
| 750 | switch (ext->rdi->type) {
|
---|
| 751 | case ASIdentifierChoice_inherit:
|
---|
| 752 | inherit_rdi = 1;
|
---|
| 753 | break;
|
---|
| 754 | case ASIdentifierChoice_asIdsOrRanges:
|
---|
| 755 | child_rdi = ext->rdi->u.asIdsOrRanges;
|
---|
| 756 | break;
|
---|
| 757 | }
|
---|
| 758 | }
|
---|
| 759 |
|
---|
| 760 | /*
|
---|
| 761 | * Now walk up the chain. Extensions must be in canonical form, no
|
---|
| 762 | * cert may list resources that its parent doesn't list.
|
---|
| 763 | */
|
---|
| 764 | for (i++; i < sk_X509_num(chain); i++) {
|
---|
| 765 | x = sk_X509_value(chain, i);
|
---|
| 766 | OPENSSL_assert(x != NULL);
|
---|
| 767 | if (x->rfc3779_asid == NULL) {
|
---|
| 768 | if (child_as != NULL || child_rdi != NULL)
|
---|
| 769 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 770 | continue;
|
---|
| 771 | }
|
---|
| 772 | if (!X509v3_asid_is_canonical(x->rfc3779_asid))
|
---|
| 773 | validation_err(X509_V_ERR_INVALID_EXTENSION);
|
---|
| 774 | if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
|
---|
| 775 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 776 | child_as = NULL;
|
---|
| 777 | inherit_as = 0;
|
---|
| 778 | }
|
---|
| 779 | if (x->rfc3779_asid->asnum != NULL &&
|
---|
| 780 | x->rfc3779_asid->asnum->type ==
|
---|
| 781 | ASIdentifierChoice_asIdsOrRanges) {
|
---|
| 782 | if (inherit_as
|
---|
| 783 | || asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges,
|
---|
| 784 | child_as)) {
|
---|
| 785 | child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
|
---|
| 786 | inherit_as = 0;
|
---|
| 787 | } else {
|
---|
| 788 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 789 | }
|
---|
| 790 | }
|
---|
| 791 | if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
|
---|
| 792 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 793 | child_rdi = NULL;
|
---|
| 794 | inherit_rdi = 0;
|
---|
| 795 | }
|
---|
| 796 | if (x->rfc3779_asid->rdi != NULL &&
|
---|
| 797 | x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) {
|
---|
| 798 | if (inherit_rdi ||
|
---|
| 799 | asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges,
|
---|
| 800 | child_rdi)) {
|
---|
| 801 | child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
|
---|
| 802 | inherit_rdi = 0;
|
---|
| 803 | } else {
|
---|
| 804 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 805 | }
|
---|
| 806 | }
|
---|
| 807 | }
|
---|
| 808 |
|
---|
| 809 | /*
|
---|
| 810 | * Trust anchor can't inherit.
|
---|
| 811 | */
|
---|
| 812 | OPENSSL_assert(x != NULL);
|
---|
| 813 | if (x->rfc3779_asid != NULL) {
|
---|
| 814 | if (x->rfc3779_asid->asnum != NULL &&
|
---|
| 815 | x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
|
---|
| 816 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 817 | if (x->rfc3779_asid->rdi != NULL &&
|
---|
| 818 | x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
|
---|
| 819 | validation_err(X509_V_ERR_UNNESTED_RESOURCE);
|
---|
| 820 | }
|
---|
| 821 |
|
---|
| 822 | done:
|
---|
| 823 | return ret;
|
---|
| 824 | }
|
---|
| 825 |
|
---|
| 826 | #undef validation_err
|
---|
| 827 |
|
---|
| 828 | /*
|
---|
| 829 | * RFC 3779 3.3 path validation -- called from X509_verify_cert().
|
---|
| 830 | */
|
---|
| 831 | int X509v3_asid_validate_path(X509_STORE_CTX *ctx)
|
---|
| 832 | {
|
---|
| 833 | return asid_validate_path_internal(ctx, ctx->chain, NULL);
|
---|
| 834 | }
|
---|
| 835 |
|
---|
| 836 | /*
|
---|
| 837 | * RFC 3779 3.3 path validation of an extension.
|
---|
| 838 | * Test whether chain covers extension.
|
---|
| 839 | */
|
---|
| 840 | int X509v3_asid_validate_resource_set(STACK_OF(X509) *chain,
|
---|
| 841 | ASIdentifiers *ext, int allow_inheritance)
|
---|
| 842 | {
|
---|
| 843 | if (ext == NULL)
|
---|
| 844 | return 1;
|
---|
| 845 | if (chain == NULL || sk_X509_num(chain) == 0)
|
---|
| 846 | return 0;
|
---|
| 847 | if (!allow_inheritance && X509v3_asid_inherits(ext))
|
---|
| 848 | return 0;
|
---|
| 849 | return asid_validate_path_internal(NULL, chain, ext);
|
---|
| 850 | }
|
---|
| 851 |
|
---|
| 852 | #endif /* OPENSSL_NO_RFC3779 */
|
---|