v3_utl.c@ 69890

Last change on this file since 69890 was 69890, checked in by vboxsync, 7 years ago
Added OpenSSL 1.1.0g with unneeded files removed, otherwise unmodified. bugref:8070: src/libs maintenance
Property svn:eol-style set to `native`
File size: 33.7 KB

Line
1	/*
2	* Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the OpenSSL license (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	/* X509 v3 extension utilities */
11
12	#include <stdio.h>
13	#include <ctype.h>
14	#include "internal/cryptlib.h"
15	#include <openssl/conf.h>
16	#include <openssl/x509v3.h>
17	#include "internal/x509_int.h"
18	#include <openssl/bn.h>
19	#include "ext_dat.h"
20
21	static char strip_spaces(char name);
22	static int sk_strcmp(const char const a, const char const b);
23	static STACK_OF(OPENSSL_STRING) get_email(X509_NAME name,
24	GENERAL_NAMES *gens);
25	static void str_free(OPENSSL_STRING str);
26	static int append_ia5(STACK_OF(OPENSSL_STRING) *sk, const ASN1_IA5STRING email);
27
28	static int ipv4_from_asc(unsigned char v4, const char in);
29	static int ipv6_from_asc(unsigned char v6, const char in);
30	static int ipv6_cb(const char elem, int len, void usr);
31	static int ipv6_hex(unsigned char out, const char in, int inlen);
32
33	/* Add a CONF_VALUE name value pair to stack */
34
35	int X509V3_add_value(const char name, const char value,
36	STACK_OF(CONF_VALUE) **extlist)
37	{
38	CONF_VALUE *vtmp = NULL;
39	char tname = NULL, tvalue = NULL;
40	int sk_allocated = (*extlist == NULL);
41
42	if (name && (tname = OPENSSL_strdup(name)) == NULL)
43	goto err;
44	if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
45	goto err;
46	if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
47	goto err;
48	if (sk_allocated && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
49	goto err;
50	vtmp->section = NULL;
51	vtmp->name = tname;
52	vtmp->value = tvalue;
53	if (!sk_CONF_VALUE_push(*extlist, vtmp))
54	goto err;
55	return 1;
56	err:
57	X509V3err(X509V3_F_X509V3_ADD_VALUE, ERR_R_MALLOC_FAILURE);
58	if (sk_allocated) {
59	sk_CONF_VALUE_free(*extlist);
60	*extlist = NULL;
61	}
62	OPENSSL_free(vtmp);
63	OPENSSL_free(tname);
64	OPENSSL_free(tvalue);
65	return 0;
66	}
67
68	int X509V3_add_value_uchar(const char name, const unsigned char value,
69	STACK_OF(CONF_VALUE) **extlist)
70	{
71	return X509V3_add_value(name, (const char *)value, extlist);
72	}
73
74	/* Free function for STACK_OF(CONF_VALUE) */
75
76	void X509V3_conf_free(CONF_VALUE *conf)
77	{
78	if (!conf)
79	return;
80	OPENSSL_free(conf->name);
81	OPENSSL_free(conf->value);
82	OPENSSL_free(conf->section);
83	OPENSSL_free(conf);
84	}
85
86	int X509V3_add_value_bool(const char *name, int asn1_bool,
87	STACK_OF(CONF_VALUE) **extlist)
88	{
89	if (asn1_bool)
90	return X509V3_add_value(name, "TRUE", extlist);
91	return X509V3_add_value(name, "FALSE", extlist);
92	}
93
94	int X509V3_add_value_bool_nf(const char *name, int asn1_bool,
95	STACK_OF(CONF_VALUE) **extlist)
96	{
97	if (asn1_bool)
98	return X509V3_add_value(name, "TRUE", extlist);
99	return 1;
100	}
101
102	char i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD method, const ASN1_ENUMERATED *a)
103	{
104	BIGNUM *bntmp = NULL;
105	char *strtmp = NULL;
106
107	if (!a)
108	return NULL;
109	if ((bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) == NULL
110	\|\| (strtmp = BN_bn2dec(bntmp)) == NULL)
111	X509V3err(X509V3_F_I2S_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);
112	BN_free(bntmp);
113	return strtmp;
114	}
115
116	char i2s_ASN1_INTEGER(X509V3_EXT_METHOD method, const ASN1_INTEGER *a)
117	{
118	BIGNUM *bntmp = NULL;
119	char *strtmp = NULL;
120
121	if (!a)
122	return NULL;
123	if ((bntmp = ASN1_INTEGER_to_BN(a, NULL)) == NULL
124	\|\| (strtmp = BN_bn2dec(bntmp)) == NULL)
125	X509V3err(X509V3_F_I2S_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
126	BN_free(bntmp);
127	return strtmp;
128	}
129
130	ASN1_INTEGER s2i_ASN1_INTEGER(X509V3_EXT_METHOD method, const char *value)
131	{
132	BIGNUM *bn = NULL;
133	ASN1_INTEGER *aint;
134	int isneg, ishex;
135	int ret;
136	if (value == NULL) {
137	X509V3err(X509V3_F_S2I_ASN1_INTEGER, X509V3_R_INVALID_NULL_VALUE);
138	return NULL;
139	}
140	bn = BN_new();
141	if (bn == NULL) {
142	X509V3err(X509V3_F_S2I_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
143	return NULL;
144	}
145	if (value[0] == '-') {
146	value++;
147	isneg = 1;
148	} else
149	isneg = 0;
150
151	if (value[0] == '0' && ((value[1] == 'x') \|\| (value[1] == 'X'))) {
152	value += 2;
153	ishex = 1;
154	} else
155	ishex = 0;
156
157	if (ishex)
158	ret = BN_hex2bn(&bn, value);
159	else
160	ret = BN_dec2bn(&bn, value);
161
162	if (!ret \|\| value[ret]) {
163	BN_free(bn);
164	X509V3err(X509V3_F_S2I_ASN1_INTEGER, X509V3_R_BN_DEC2BN_ERROR);
165	return NULL;
166	}
167
168	if (isneg && BN_is_zero(bn))
169	isneg = 0;
170
171	aint = BN_to_ASN1_INTEGER(bn, NULL);
172	BN_free(bn);
173	if (!aint) {
174	X509V3err(X509V3_F_S2I_ASN1_INTEGER,
175	X509V3_R_BN_TO_ASN1_INTEGER_ERROR);
176	return NULL;
177	}
178	if (isneg)
179	aint->type \|= V_ASN1_NEG;
180	return aint;
181	}
182
183	int X509V3_add_value_int(const char name, const ASN1_INTEGER aint,
184	STACK_OF(CONF_VALUE) **extlist)
185	{
186	char *strtmp;
187	int ret;
188
189	if (!aint)
190	return 1;
191	if ((strtmp = i2s_ASN1_INTEGER(NULL, aint)) == NULL)
192	return 0;
193	ret = X509V3_add_value(name, strtmp, extlist);
194	OPENSSL_free(strtmp);
195	return ret;
196	}
197
198	int X509V3_get_value_bool(const CONF_VALUE value, int asn1_bool)
199	{
200	const char *btmp;
201
202	if ((btmp = value->value) == NULL)
203	goto err;
204	if (strcmp(btmp, "TRUE") == 0
205	\|\| strcmp(btmp, "true") == 0
206	\|\| strcmp(btmp, "Y") == 0
207	\|\| strcmp(btmp, "y") == 0
208	\|\| strcmp(btmp, "YES") == 0
209	\|\| strcmp(btmp, "yes") == 0) {
210	*asn1_bool = 0xff;
211	return 1;
212	}
213	if (strcmp(btmp, "FALSE") == 0
214	\|\| strcmp(btmp, "false") == 0
215	\|\| strcmp(btmp, "N") == 0
216	\|\| strcmp(btmp, "n") == 0
217	\|\| strcmp(btmp, "NO") == 0
218	\|\| strcmp(btmp, "no") == 0) {
219	*asn1_bool = 0;
220	return 1;
221	}
222	err:
223	X509V3err(X509V3_F_X509V3_GET_VALUE_BOOL,
224	X509V3_R_INVALID_BOOLEAN_STRING);
225	X509V3_conf_err(value);
226	return 0;
227	}
228
229	int X509V3_get_value_int(const CONF_VALUE value, ASN1_INTEGER *aint)
230	{
231	ASN1_INTEGER *itmp;
232
233	if ((itmp = s2i_ASN1_INTEGER(NULL, value->value)) == NULL) {
234	X509V3_conf_err(value);
235	return 0;
236	}
237	*aint = itmp;
238	return 1;
239	}
240
241	#define HDR_NAME 1
242	#define HDR_VALUE 2
243
244	/*
245	* #define DEBUG
246	*/
247
248	STACK_OF(CONF_VALUE) X509V3_parse_list(const char line)
249	{
250	char p, q, c;
251	char ntmp, vtmp;
252	STACK_OF(CONF_VALUE) *values = NULL;
253	char *linebuf;
254	int state;
255	/* We are going to modify the line so copy it first */
256	linebuf = OPENSSL_strdup(line);
257	if (linebuf == NULL) {
258	X509V3err(X509V3_F_X509V3_PARSE_LIST, ERR_R_MALLOC_FAILURE);
259	goto err;
260	}
261	state = HDR_NAME;
262	ntmp = NULL;
263	/* Go through all characters */
264	for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
265	p++) {
266
267	switch (state) {
268	case HDR_NAME:
269	if (c == ':') {
270	state = HDR_VALUE;
271	*p = 0;
272	ntmp = strip_spaces(q);
273	if (!ntmp) {
274	X509V3err(X509V3_F_X509V3_PARSE_LIST,
275	X509V3_R_INVALID_NULL_NAME);
276	goto err;
277	}
278	q = p + 1;
279	} else if (c == ',') {
280	*p = 0;
281	ntmp = strip_spaces(q);
282	q = p + 1;
283	if (!ntmp) {
284	X509V3err(X509V3_F_X509V3_PARSE_LIST,
285	X509V3_R_INVALID_NULL_NAME);
286	goto err;
287	}
288	X509V3_add_value(ntmp, NULL, &values);
289	}
290	break;
291
292	case HDR_VALUE:
293	if (c == ',') {
294	state = HDR_NAME;
295	*p = 0;
296	vtmp = strip_spaces(q);
297	if (!vtmp) {
298	X509V3err(X509V3_F_X509V3_PARSE_LIST,
299	X509V3_R_INVALID_NULL_VALUE);
300	goto err;
301	}
302	X509V3_add_value(ntmp, vtmp, &values);
303	ntmp = NULL;
304	q = p + 1;
305	}
306
307	}
308	}
309
310	if (state == HDR_VALUE) {
311	vtmp = strip_spaces(q);
312	if (!vtmp) {
313	X509V3err(X509V3_F_X509V3_PARSE_LIST,
314	X509V3_R_INVALID_NULL_VALUE);
315	goto err;
316	}
317	X509V3_add_value(ntmp, vtmp, &values);
318	} else {
319	ntmp = strip_spaces(q);
320	if (!ntmp) {
321	X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
322	goto err;
323	}
324	X509V3_add_value(ntmp, NULL, &values);
325	}
326	OPENSSL_free(linebuf);
327	return values;
328
329	err:
330	OPENSSL_free(linebuf);
331	sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
332	return NULL;
333
334	}
335
336	/* Delete leading and trailing spaces from a string */
337	static char strip_spaces(char name)
338	{
339	char p, q;
340	/* Skip over leading spaces */
341	p = name;
342	while (p && isspace((unsigned char)p))
343	p++;
344	if (!*p)
345	return NULL;
346	q = p + strlen(p) - 1;
347	while ((q != p) && isspace((unsigned char)*q))
348	q--;
349	if (p != q)
350	q[1] = 0;
351	if (!*p)
352	return NULL;
353	return p;
354	}
355
356
357	/*
358	* V2I name comparison function: returns zero if 'name' matches cmp or cmp.*
359	*/
360
361	int name_cmp(const char name, const char cmp)
362	{
363	int len, ret;
364	char c;
365	len = strlen(cmp);
366	if ((ret = strncmp(name, cmp, len)))
367	return ret;
368	c = name[len];
369	if (!c \|\| (c == '.'))
370	return 0;
371	return 1;
372	}
373
374	static int sk_strcmp(const char const a, const char const b)
375	{
376	return strcmp(a, b);
377	}
378
379	STACK_OF(OPENSSL_STRING) X509_get1_email(X509 x)
380	{
381	GENERAL_NAMES *gens;
382	STACK_OF(OPENSSL_STRING) *ret;
383
384	gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
385	ret = get_email(X509_get_subject_name(x), gens);
386	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
387	return ret;
388	}
389
390	STACK_OF(OPENSSL_STRING) X509_get1_ocsp(X509 x)
391	{
392	AUTHORITY_INFO_ACCESS *info;
393	STACK_OF(OPENSSL_STRING) *ret = NULL;
394	int i;
395
396	info = X509_get_ext_d2i(x, NID_info_access, NULL, NULL);
397	if (!info)
398	return NULL;
399	for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++) {
400	ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
401	if (OBJ_obj2nid(ad->method) == NID_ad_OCSP) {
402	if (ad->location->type == GEN_URI) {
403	if (!append_ia5
404	(&ret, ad->location->d.uniformResourceIdentifier))
405	break;
406	}
407	}
408	}
409	AUTHORITY_INFO_ACCESS_free(info);
410	return ret;
411	}
412
413	STACK_OF(OPENSSL_STRING) X509_REQ_get1_email(X509_REQ x)
414	{
415	GENERAL_NAMES *gens;
416	STACK_OF(X509_EXTENSION) *exts;
417	STACK_OF(OPENSSL_STRING) *ret;
418
419	exts = X509_REQ_get_extensions(x);
420	gens = X509V3_get_d2i(exts, NID_subject_alt_name, NULL, NULL);
421	ret = get_email(X509_REQ_get_subject_name(x), gens);
422	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
423	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
424	return ret;
425	}
426
427	static STACK_OF(OPENSSL_STRING) get_email(X509_NAME name,
428	GENERAL_NAMES *gens)
429	{
430	STACK_OF(OPENSSL_STRING) *ret = NULL;
431	X509_NAME_ENTRY *ne;
432	ASN1_IA5STRING *email;
433	GENERAL_NAME *gen;
434	int i;
435	/* Now add any email address(es) to STACK */
436	i = -1;
437	/* First supplied X509_NAME */
438	while ((i = X509_NAME_get_index_by_NID(name,
439	NID_pkcs9_emailAddress, i)) >= 0) {
440	ne = X509_NAME_get_entry(name, i);
441	email = X509_NAME_ENTRY_get_data(ne);
442	if (!append_ia5(&ret, email))
443	return NULL;
444	}
445	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
446	gen = sk_GENERAL_NAME_value(gens, i);
447	if (gen->type != GEN_EMAIL)
448	continue;
449	if (!append_ia5(&ret, gen->d.ia5))
450	return NULL;
451	}
452	return ret;
453	}
454
455	static void str_free(OPENSSL_STRING str)
456	{
457	OPENSSL_free(str);
458	}
459
460	static int append_ia5(STACK_OF(OPENSSL_STRING) *sk, const ASN1_IA5STRING email)
461	{
462	char *emtmp;
463	/* First some sanity checks */
464	if (email->type != V_ASN1_IA5STRING)
465	return 1;
466	if (!email->data \|\| !email->length)
467	return 1;
468	if (*sk == NULL)
469	*sk = sk_OPENSSL_STRING_new(sk_strcmp);
470	if (*sk == NULL)
471	return 0;
472	/* Don't add duplicates */
473	if (sk_OPENSSL_STRING_find(sk, (char )email->data) != -1)
474	return 1;
475	emtmp = OPENSSL_strdup((char *)email->data);
476	if (emtmp == NULL \|\| !sk_OPENSSL_STRING_push(*sk, emtmp)) {
477	OPENSSL_free(emtmp); /* free on push failure */
478	X509_email_free(*sk);
479	*sk = NULL;
480	return 0;
481	}
482	return 1;
483	}
484
485	void X509_email_free(STACK_OF(OPENSSL_STRING) *sk)
486	{
487	sk_OPENSSL_STRING_pop_free(sk, str_free);
488	}
489
490	typedef int (equal_fn) (const unsigned char pattern, size_t pattern_len,
491	const unsigned char *subject, size_t subject_len,
492	unsigned int flags);
493
494	/* Skip pattern prefix to match "wildcard" subject */
495	static void skip_prefix(const unsigned char *p, size_t plen,
496	size_t subject_len,
497	unsigned int flags)
498	{
499	const unsigned char pattern = p;
500	size_t pattern_len = *plen;
501
502	/*
503	* If subject starts with a leading '.' followed by more octets, and
504	* pattern is longer, compare just an equal-length suffix with the
505	* full subject (starting at the '.'), provided the prefix contains
506	* no NULs.
507	*/
508	if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0)
509	return;
510
511	while (pattern_len > subject_len && *pattern) {
512	if ((flags & X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS) &&
513	*pattern == '.')
514	break;
515	++pattern;
516	--pattern_len;
517	}
518
519	/* Skip if entire prefix acceptable */
520	if (pattern_len == subject_len) {
521	*p = pattern;
522	*plen = pattern_len;
523	}
524	}
525
526	/* Compare while ASCII ignoring case. */
527	static int equal_nocase(const unsigned char *pattern, size_t pattern_len,
528	const unsigned char *subject, size_t subject_len,
529	unsigned int flags)
530	{
531	skip_prefix(&pattern, &pattern_len, subject_len, flags);
532	if (pattern_len != subject_len)
533	return 0;
534	while (pattern_len) {
535	unsigned char l = *pattern;
536	unsigned char r = *subject;
537	/* The pattern must not contain NUL characters. */
538	if (l == 0)
539	return 0;
540	if (l != r) {
541	if ('A' <= l && l <= 'Z')
542	l = (l - 'A') + 'a';
543	if ('A' <= r && r <= 'Z')
544	r = (r - 'A') + 'a';
545	if (l != r)
546	return 0;
547	}
548	++pattern;
549	++subject;
550	--pattern_len;
551	}
552	return 1;
553	}
554
555	/* Compare using memcmp. */
556	static int equal_case(const unsigned char *pattern, size_t pattern_len,
557	const unsigned char *subject, size_t subject_len,
558	unsigned int flags)
559	{
560	skip_prefix(&pattern, &pattern_len, subject_len, flags);
561	if (pattern_len != subject_len)
562	return 0;
563	return !memcmp(pattern, subject, pattern_len);
564	}
565
566	/*
567	* RFC 5280, section 7.5, requires that only the domain is compared in a
568	* case-insensitive manner.
569	*/
570	static int equal_email(const unsigned char *a, size_t a_len,
571	const unsigned char *b, size_t b_len,
572	unsigned int unused_flags)
573	{
574	size_t i = a_len;
575	if (a_len != b_len)
576	return 0;
577	/*
578	* We search backwards for the '@' character, so that we do not have to
579	* deal with quoted local-parts. The domain part is compared in a
580	* case-insensitive manner.
581	*/
582	while (i > 0) {
583	--i;
584	if (a[i] == '@' \|\| b[i] == '@') {
585	if (!equal_nocase(a + i, a_len - i, b + i, a_len - i, 0))
586	return 0;
587	break;
588	}
589	}
590	if (i == 0)
591	i = a_len;
592	return equal_case(a, i, b, i, 0);
593	}
594
595	/*
596	* Compare the prefix and suffix with the subject, and check that the
597	* characters in-between are valid.
598	*/
599	static int wildcard_match(const unsigned char *prefix, size_t prefix_len,
600	const unsigned char *suffix, size_t suffix_len,
601	const unsigned char *subject, size_t subject_len,
602	unsigned int flags)
603	{
604	const unsigned char *wildcard_start;
605	const unsigned char *wildcard_end;
606	const unsigned char *p;
607	int allow_multi = 0;
608	int allow_idna = 0;
609
610	if (subject_len < prefix_len + suffix_len)
611	return 0;
612	if (!equal_nocase(prefix, prefix_len, subject, prefix_len, flags))
613	return 0;
614	wildcard_start = subject + prefix_len;
615	wildcard_end = subject + (subject_len - suffix_len);
616	if (!equal_nocase(wildcard_end, suffix_len, suffix, suffix_len, flags))
617	return 0;
618	/*
619	* If the wildcard makes up the entire first label, it must match at
620	* least one character.
621	*/
622	if (prefix_len == 0 && *suffix == '.') {
623	if (wildcard_start == wildcard_end)
624	return 0;
625	allow_idna = 1;
626	if (flags & X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS)
627	allow_multi = 1;
628	}
629	/* IDNA labels cannot match partial wildcards */
630	if (!allow_idna &&
631	subject_len >= 4 && strncasecmp((char *)subject, "xn--", 4) == 0)
632	return 0;
633	/* The wildcard may match a literal '' /
634	if (wildcard_end == wildcard_start + 1 && wildcard_start == '')
635	return 1;
636	/*
637	* Check that the part matched by the wildcard contains only
638	* permitted characters and only matches a single label unless
639	* allow_multi is set.
640	*/
641	for (p = wildcard_start; p != wildcard_end; ++p)
642	if (!(('0' <= p && p <= '9') \|\|
643	('A' <= p && p <= 'Z') \|\|
644	('a' <= p && p <= 'z') \|\|
645	p == '-' \|\| (allow_multi && p == '.')))
646	return 0;
647	return 1;
648	}
649
650	#define LABEL_START (1 << 0)
651	#define LABEL_END (1 << 1)
652	#define LABEL_HYPHEN (1 << 2)
653	#define LABEL_IDNA (1 << 3)
654
655	static const unsigned char valid_star(const unsigned char p, size_t len,
656	unsigned int flags)
657	{
658	const unsigned char *star = 0;
659	size_t i;
660	int state = LABEL_START;
661	int dots = 0;
662	for (i = 0; i < len; ++i) {
663	/*
664	* Locate first and only legal wildcard, either at the start
665	* or end of a non-IDNA first and not final label.
666	*/
667	if (p[i] == '*') {
668	int atstart = (state & LABEL_START);
669	int atend = (i == len - 1 \|\| p[i + 1] == '.');
670	/*-
671	* At most one wildcard per pattern.
672	* No wildcards in IDNA labels.
673	* No wildcards after the first label.
674	*/
675	if (star != NULL \|\| (state & LABEL_IDNA) != 0 \|\| dots)
676	return NULL;
677	/* Only full-label '.example.com' wildcards? /
678	if ((flags & X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)
679	&& (!atstart \|\| !atend))
680	return NULL;
681	/* No 'foobar' wildcards /
682	if (!atstart && !atend)
683	return NULL;
684	star = &p[i];
685	state &= ~LABEL_START;
686	} else if (('a' <= p[i] && p[i] <= 'z')
687	\|\| ('A' <= p[i] && p[i] <= 'Z')
688	\|\| ('0' <= p[i] && p[i] <= '9')) {
689	if ((state & LABEL_START) != 0
690	&& len - i >= 4 && strncasecmp((char *)&p[i], "xn--", 4) == 0)
691	state \|= LABEL_IDNA;
692	state &= ~(LABEL_HYPHEN \| LABEL_START);
693	} else if (p[i] == '.') {
694	if ((state & (LABEL_HYPHEN \| LABEL_START)) != 0)
695	return NULL;
696	state = LABEL_START;
697	++dots;
698	} else if (p[i] == '-') {
699	/* no domain/subdomain starts with '-' */
700	if ((state & LABEL_START) != 0)
701	return NULL;
702	state \|= LABEL_HYPHEN;
703	} else
704	return NULL;
705	}
706
707	/*
708	* The final label must not end in a hyphen or ".", and
709	* there must be at least two dots after the star.
710	*/
711	if ((state & (LABEL_START \| LABEL_HYPHEN)) != 0 \|\| dots < 2)
712	return NULL;
713	return star;
714	}
715
716	/* Compare using wildcards. */
717	static int equal_wildcard(const unsigned char *pattern, size_t pattern_len,
718	const unsigned char *subject, size_t subject_len,
719	unsigned int flags)
720	{
721	const unsigned char *star = NULL;
722
723	/*
724	* Subject names starting with '.' can only match a wildcard pattern
725	* via a subject sub-domain pattern suffix match.
726	*/
727	if (!(subject_len > 1 && subject[0] == '.'))
728	star = valid_star(pattern, pattern_len, flags);
729	if (star == NULL)
730	return equal_nocase(pattern, pattern_len,
731	subject, subject_len, flags);
732	return wildcard_match(pattern, star - pattern,
733	star + 1, (pattern + pattern_len) - star - 1,
734	subject, subject_len, flags);
735	}
736
737	/*
738	* Compare an ASN1_STRING to a supplied string. If they match return 1. If
739	* cmp_type > 0 only compare if string matches the type, otherwise convert it
740	* to UTF8.
741	*/
742
743	static int do_check_string(const ASN1_STRING *a, int cmp_type, equal_fn equal,
744	unsigned int flags, const char *b, size_t blen,
745	char **peername)
746	{
747	int rv = 0;
748
749	if (!a->data \|\| !a->length)
750	return 0;
751	if (cmp_type > 0) {
752	if (cmp_type != a->type)
753	return 0;
754	if (cmp_type == V_ASN1_IA5STRING)
755	rv = equal(a->data, a->length, (unsigned char *)b, blen, flags);
756	else if (a->length == (int)blen && !memcmp(a->data, b, blen))
757	rv = 1;
758	if (rv > 0 && peername)
759	peername = OPENSSL_strndup((char )a->data, a->length);
760	} else {
761	int astrlen;
762	unsigned char *astr;
763	astrlen = ASN1_STRING_to_UTF8(&astr, a);
764	if (astrlen < 0) {
765	/*
766	* -1 could be an internal malloc failure or a decoding error from
767	* malformed input; we can't distinguish.
768	*/
769	return -1;
770	}
771	rv = equal(astr, astrlen, (unsigned char *)b, blen, flags);
772	if (rv > 0 && peername)
773	peername = OPENSSL_strndup((char )astr, astrlen);
774	OPENSSL_free(astr);
775	}
776	return rv;
777	}
778
779	static int do_x509_check(X509 x, const char chk, size_t chklen,
780	unsigned int flags, int check_type, char **peername)
781	{
782	GENERAL_NAMES *gens = NULL;
783	X509_NAME *name = NULL;
784	int i;
785	int cnid = NID_undef;
786	int alt_type;
787	int san_present = 0;
788	int rv = 0;
789	equal_fn equal;
790
791	/* See below, this flag is internal-only */
792	flags &= ~_X509_CHECK_FLAG_DOT_SUBDOMAINS;
793	if (check_type == GEN_EMAIL) {
794	cnid = NID_pkcs9_emailAddress;
795	alt_type = V_ASN1_IA5STRING;
796	equal = equal_email;
797	} else if (check_type == GEN_DNS) {
798	cnid = NID_commonName;
799	/* Implicit client-side DNS sub-domain pattern */
800	if (chklen > 1 && chk[0] == '.')
801	flags \|= _X509_CHECK_FLAG_DOT_SUBDOMAINS;
802	alt_type = V_ASN1_IA5STRING;
803	if (flags & X509_CHECK_FLAG_NO_WILDCARDS)
804	equal = equal_nocase;
805	else
806	equal = equal_wildcard;
807	} else {
808	alt_type = V_ASN1_OCTET_STRING;
809	equal = equal_case;
810	}
811
812	if (chklen == 0)
813	chklen = strlen(chk);
814
815	gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
816	if (gens) {
817	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
818	GENERAL_NAME *gen;
819	ASN1_STRING *cstr;
820	gen = sk_GENERAL_NAME_value(gens, i);
821	if (gen->type != check_type)
822	continue;
823	san_present = 1;
824	if (check_type == GEN_EMAIL)
825	cstr = gen->d.rfc822Name;
826	else if (check_type == GEN_DNS)
827	cstr = gen->d.dNSName;
828	else
829	cstr = gen->d.iPAddress;
830	/* Positive on success, negative on error! */
831	if ((rv = do_check_string(cstr, alt_type, equal, flags,
832	chk, chklen, peername)) != 0)
833	break;
834	}
835	GENERAL_NAMES_free(gens);
836	if (rv != 0)
837	return rv;
838	if (san_present && !(flags & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT))
839	return 0;
840	}
841
842	/* We're done if CN-ID is not pertinent */
843	if (cnid == NID_undef \|\| (flags & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT))
844	return 0;
845
846	i = -1;
847	name = X509_get_subject_name(x);
848	while ((i = X509_NAME_get_index_by_NID(name, cnid, i)) >= 0) {
849	const X509_NAME_ENTRY *ne = X509_NAME_get_entry(name, i);
850	const ASN1_STRING *str = X509_NAME_ENTRY_get_data(ne);
851
852	/* Positive on success, negative on error! */
853	if ((rv = do_check_string(str, -1, equal, flags,
854	chk, chklen, peername)) != 0)
855	return rv;
856	}
857	return 0;
858	}
859
860	int X509_check_host(X509 x, const char chk, size_t chklen,
861	unsigned int flags, char **peername)
862	{
863	if (chk == NULL)
864	return -2;
865	/*
866	* Embedded NULs are disallowed, except as the last character of a
867	* string of length 2 or more (tolerate caller including terminating
868	* NUL in string length).
869	*/
870	if (chklen == 0)
871	chklen = strlen(chk);
872	else if (memchr(chk, '\0', chklen > 1 ? chklen - 1 : chklen))
873	return -2;
874	if (chklen > 1 && chk[chklen - 1] == '\0')
875	--chklen;
876	return do_x509_check(x, chk, chklen, flags, GEN_DNS, peername);
877	}
878
879	int X509_check_email(X509 x, const char chk, size_t chklen,
880	unsigned int flags)
881	{
882	if (chk == NULL)
883	return -2;
884	/*
885	* Embedded NULs are disallowed, except as the last character of a
886	* string of length 2 or more (tolerate caller including terminating
887	* NUL in string length).
888	*/
889	if (chklen == 0)
890	chklen = strlen((char *)chk);
891	else if (memchr(chk, '\0', chklen > 1 ? chklen - 1 : chklen))
892	return -2;
893	if (chklen > 1 && chk[chklen - 1] == '\0')
894	--chklen;
895	return do_x509_check(x, chk, chklen, flags, GEN_EMAIL, NULL);
896	}
897
898	int X509_check_ip(X509 x, const unsigned char chk, size_t chklen,
899	unsigned int flags)
900	{
901	if (chk == NULL)
902	return -2;
903	return do_x509_check(x, (char *)chk, chklen, flags, GEN_IPADD, NULL);
904	}
905
906	int X509_check_ip_asc(X509 x, const char ipasc, unsigned int flags)
907	{
908	unsigned char ipout[16];
909	size_t iplen;
910
911	if (ipasc == NULL)
912	return -2;
913	iplen = (size_t)a2i_ipadd(ipout, ipasc);
914	if (iplen == 0)
915	return -2;
916	return do_x509_check(x, (char *)ipout, iplen, flags, GEN_IPADD, NULL);
917	}
918
919	/*
920	* Convert IP addresses both IPv4 and IPv6 into an OCTET STRING compatible
921	* with RFC3280.
922	*/
923
924	ASN1_OCTET_STRING a2i_IPADDRESS(const char ipasc)
925	{
926	unsigned char ipout[16];
927	ASN1_OCTET_STRING *ret;
928	int iplen;
929
930	/* If string contains a ':' assume IPv6 */
931
932	iplen = a2i_ipadd(ipout, ipasc);
933
934	if (!iplen)
935	return NULL;
936
937	ret = ASN1_OCTET_STRING_new();
938	if (ret == NULL)
939	return NULL;
940	if (!ASN1_OCTET_STRING_set(ret, ipout, iplen)) {
941	ASN1_OCTET_STRING_free(ret);
942	return NULL;
943	}
944	return ret;
945	}
946
947	ASN1_OCTET_STRING a2i_IPADDRESS_NC(const char ipasc)
948	{
949	ASN1_OCTET_STRING *ret = NULL;
950	unsigned char ipout[32];
951	char iptmp = NULL, p;
952	int iplen1, iplen2;
953	p = strchr(ipasc, '/');
954	if (!p)
955	return NULL;
956	iptmp = OPENSSL_strdup(ipasc);
957	if (!iptmp)
958	return NULL;
959	p = iptmp + (p - ipasc);
960	*p++ = 0;
961
962	iplen1 = a2i_ipadd(ipout, iptmp);
963
964	if (!iplen1)
965	goto err;
966
967	iplen2 = a2i_ipadd(ipout + iplen1, p);
968
969	OPENSSL_free(iptmp);
970	iptmp = NULL;
971
972	if (!iplen2 \|\| (iplen1 != iplen2))
973	goto err;
974
975	ret = ASN1_OCTET_STRING_new();
976	if (ret == NULL)
977	goto err;
978	if (!ASN1_OCTET_STRING_set(ret, ipout, iplen1 + iplen2))
979	goto err;
980
981	return ret;
982
983	err:
984	OPENSSL_free(iptmp);
985	ASN1_OCTET_STRING_free(ret);
986	return NULL;
987	}
988
989	int a2i_ipadd(unsigned char ipout, const char ipasc)
990	{
991	/* If string contains a ':' assume IPv6 */
992
993	if (strchr(ipasc, ':')) {
994	if (!ipv6_from_asc(ipout, ipasc))
995	return 0;
996	return 16;
997	} else {
998	if (!ipv4_from_asc(ipout, ipasc))
999	return 0;
1000	return 4;
1001	}
1002	}
1003
1004	static int ipv4_from_asc(unsigned char v4, const char in)
1005	{
1006	int a0, a1, a2, a3;
1007	if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
1008	return 0;
1009	if ((a0 < 0) \|\| (a0 > 255) \|\| (a1 < 0) \|\| (a1 > 255)
1010	\|\| (a2 < 0) \|\| (a2 > 255) \|\| (a3 < 0) \|\| (a3 > 255))
1011	return 0;
1012	v4[0] = a0;
1013	v4[1] = a1;
1014	v4[2] = a2;
1015	v4[3] = a3;
1016	return 1;
1017	}
1018
1019	typedef struct {
1020	/* Temporary store for IPV6 output */
1021	unsigned char tmp[16];
1022	/* Total number of bytes in tmp */
1023	int total;
1024	/* The position of a zero (corresponding to '::') */
1025	int zero_pos;
1026	/* Number of zeroes */
1027	int zero_cnt;
1028	} IPV6_STAT;
1029
1030	static int ipv6_from_asc(unsigned char v6, const char in)
1031	{
1032	IPV6_STAT v6stat;
1033	v6stat.total = 0;
1034	v6stat.zero_pos = -1;
1035	v6stat.zero_cnt = 0;
1036	/*
1037	* Treat the IPv6 representation as a list of values separated by ':'.
1038	* The presence of a '::' will parse as one, two or three zero length
1039	* elements.
1040	*/
1041	if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
1042	return 0;
1043
1044	/* Now for some sanity checks */
1045
1046	if (v6stat.zero_pos == -1) {
1047	/* If no '::' must have exactly 16 bytes */
1048	if (v6stat.total != 16)
1049	return 0;
1050	} else {
1051	/* If '::' must have less than 16 bytes */
1052	if (v6stat.total == 16)
1053	return 0;
1054	/* More than three zeroes is an error */
1055	if (v6stat.zero_cnt > 3)
1056	return 0;
1057	/* Can only have three zeroes if nothing else present */
1058	else if (v6stat.zero_cnt == 3) {
1059	if (v6stat.total > 0)
1060	return 0;
1061	}
1062	/* Can only have two zeroes if at start or end */
1063	else if (v6stat.zero_cnt == 2) {
1064	if ((v6stat.zero_pos != 0)
1065	&& (v6stat.zero_pos != v6stat.total))
1066	return 0;
1067	} else
1068	/* Can only have one zero if not start or end */
1069	{
1070	if ((v6stat.zero_pos == 0)
1071	\|\| (v6stat.zero_pos == v6stat.total))
1072	return 0;
1073	}
1074	}
1075
1076	/* Format result */
1077
1078	if (v6stat.zero_pos >= 0) {
1079	/* Copy initial part */
1080	memcpy(v6, v6stat.tmp, v6stat.zero_pos);
1081	/* Zero middle */
1082	memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
1083	/* Copy final part */
1084	if (v6stat.total != v6stat.zero_pos)
1085	memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
1086	v6stat.tmp + v6stat.zero_pos,
1087	v6stat.total - v6stat.zero_pos);
1088	} else
1089	memcpy(v6, v6stat.tmp, 16);
1090
1091	return 1;
1092	}
1093
1094	static int ipv6_cb(const char elem, int len, void usr)
1095	{
1096	IPV6_STAT *s = usr;
1097	/* Error if 16 bytes written */
1098	if (s->total == 16)
1099	return 0;
1100	if (len == 0) {
1101	/* Zero length element, corresponds to '::' */
1102	if (s->zero_pos == -1)
1103	s->zero_pos = s->total;
1104	/* If we've already got a :: its an error */
1105	else if (s->zero_pos != s->total)
1106	return 0;
1107	s->zero_cnt++;
1108	} else {
1109	/* If more than 4 characters could be final a.b.c.d form */
1110	if (len > 4) {
1111	/* Need at least 4 bytes left */
1112	if (s->total > 12)
1113	return 0;
1114	/* Must be end of string */
1115	if (elem[len])
1116	return 0;
1117	if (!ipv4_from_asc(s->tmp + s->total, elem))
1118	return 0;
1119	s->total += 4;
1120	} else {
1121	if (!ipv6_hex(s->tmp + s->total, elem, len))
1122	return 0;
1123	s->total += 2;
1124	}
1125	}
1126	return 1;
1127	}
1128
1129	/*
1130	* Convert a string of up to 4 hex digits into the corresponding IPv6 form.
1131	*/
1132
1133	static int ipv6_hex(unsigned char out, const char in, int inlen)
1134	{
1135	unsigned char c;
1136	unsigned int num = 0;
1137	int x;
1138
1139	if (inlen > 4)
1140	return 0;
1141	while (inlen--) {
1142	c = *in++;
1143	num <<= 4;
1144	x = OPENSSL_hexchar2int(c);
1145	if (x < 0)
1146	return 0;
1147	num \|= (char)x;
1148	}
1149	out[0] = num >> 8;
1150	out[1] = num & 0xff;
1151	return 1;
1152	}
1153
1154	int X509V3_NAME_from_section(X509_NAME nm, STACK_OF(CONF_VALUE) dn_sk,
1155	unsigned long chtype)
1156	{
1157	CONF_VALUE *v;
1158	int i, mval, spec_char, plus_char;
1159	char p, type;
1160	if (!nm)
1161	return 0;
1162
1163	for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) {
1164	v = sk_CONF_VALUE_value(dn_sk, i);
1165	type = v->name;
1166	/*
1167	* Skip past any leading X. X: X, etc to allow for multiple instances
1168	*/
1169	for (p = type; *p; p++) {
1170	#ifndef CHARSET_EBCDIC
1171	spec_char = ((p == ':') \|\| (p == ',') \|\| (*p == '.'));
1172	#else
1173	spec_char = ((p == os_toascii[':']) \|\| (p == os_toascii[','])
1174	\|\| (*p == os_toascii['.']));
1175	#endif
1176	if (spec_char) {
1177	p++;
1178	if (*p)
1179	type = p;
1180	break;
1181	}
1182	}
1183	#ifndef CHARSET_EBCDIC
1184	plus_char = (*type == '+');
1185	#else
1186	plus_char = (*type == os_toascii['+']);
1187	#endif
1188	if (plus_char) {
1189	mval = -1;
1190	type++;
1191	} else
1192	mval = 0;
1193	if (!X509_NAME_add_entry_by_txt(nm, type, chtype,
1194	(unsigned char *)v->value, -1, -1,
1195	mval))
1196	return 0;
1197
1198	}
1199	return 1;
1200	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-1.1.0g/crypto/x509v3/v3_utl.c@ 69890

Download in other formats: