1 | /* |
2 | * Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include "internal/cryptlib.h" |
11 | #include <openssl/asn1.h> |
12 | #include <openssl/x509v3.h> |
13 | |
14 | #define ASN1_GEN_FLAG 0x10000 |
15 | #define ASN1_GEN_FLAG_IMP (ASN1_GEN_FLAG|1) |
16 | #define ASN1_GEN_FLAG_EXP (ASN1_GEN_FLAG|2) |
17 | #define ASN1_GEN_FLAG_TAG (ASN1_GEN_FLAG|3) |
18 | #define ASN1_GEN_FLAG_BITWRAP (ASN1_GEN_FLAG|4) |
19 | #define ASN1_GEN_FLAG_OCTWRAP (ASN1_GEN_FLAG|5) |
20 | #define ASN1_GEN_FLAG_SEQWRAP (ASN1_GEN_FLAG|6) |
21 | #define ASN1_GEN_FLAG_SETWRAP (ASN1_GEN_FLAG|7) |
22 | #define ASN1_GEN_FLAG_FORMAT (ASN1_GEN_FLAG|8) |
23 | |
24 | #define ASN1_GEN_STR(str,val) {str, sizeof(str) - 1, val} |
25 | |
26 | #define ASN1_FLAG_EXP_MAX 20 |
27 | /* Maximum number of nested sequences */ |
28 | #define ASN1_GEN_SEQ_MAX_DEPTH 50 |
29 | |
30 | /* Input formats */ |
31 | |
32 | /* ASCII: default */ |
33 | #define ASN1_GEN_FORMAT_ASCII 1 |
34 | /* UTF8 */ |
35 | #define ASN1_GEN_FORMAT_UTF8 2 |
36 | /* Hex */ |
37 | #define ASN1_GEN_FORMAT_HEX 3 |
38 | /* List of bits */ |
39 | #define ASN1_GEN_FORMAT_BITLIST 4 |
40 | |
41 | struct tag_name_st { |
42 | const char *strnam; |
43 | int len; |
44 | int tag; |
45 | }; |
46 | |
47 | typedef struct { |
48 | int exp_tag; |
49 | int exp_class; |
50 | int exp_constructed; |
51 | int exp_pad; |
52 | long exp_len; |
53 | } tag_exp_type; |
54 | |
55 | typedef struct { |
56 | int imp_tag; |
57 | int imp_class; |
58 | int utype; |
59 | int format; |
60 | const char *str; |
61 | tag_exp_type exp_list[ASN1_FLAG_EXP_MAX]; |
62 | int exp_count; |
63 | } tag_exp_arg; |
64 | |
65 | static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth, |
66 | int *perr); |
67 | static int bitstr_cb(const char *elem, int len, void *bitstr); |
68 | static int asn1_cb(const char *elem, int len, void *bitstr); |
69 | static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class, |
70 | int exp_constructed, int exp_pad, int imp_ok); |
71 | static int parse_tagging(const char *vstart, int vlen, int *ptag, |
72 | int *pclass); |
73 | static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf, |
74 | int depth, int *perr); |
75 | static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype); |
76 | static int asn1_str2tag(const char *tagstr, int len); |
77 | |
78 | ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf) |
79 | { |
80 | X509V3_CTX cnf; |
81 | |
82 | if (!nconf) |
83 | return ASN1_generate_v3(str, NULL); |
84 | |
85 | X509V3_set_nconf(&cnf, nconf); |
86 | return ASN1_generate_v3(str, &cnf); |
87 | } |
88 | |
89 | ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf) |
90 | { |
91 | int err = 0; |
92 | ASN1_TYPE *ret = generate_v3(str, cnf, 0, &err); |
93 | if (err) |
94 | ASN1err(ASN1_F_ASN1_GENERATE_V3, err); |
95 | return ret; |
96 | } |
97 | |
98 | static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth, |
99 | int *perr) |
100 | { |
101 | ASN1_TYPE *ret; |
102 | tag_exp_arg asn1_tags; |
103 | tag_exp_type *etmp; |
104 | |
105 | int i, len; |
106 | |
107 | unsigned char *orig_der = NULL, *new_der = NULL; |
108 | const unsigned char *cpy_start; |
109 | unsigned char *p; |
110 | const unsigned char *cp; |
111 | int cpy_len; |
112 | long hdr_len = 0; |
113 | int hdr_constructed = 0, hdr_tag, hdr_class; |
114 | int r; |
115 | |
116 | asn1_tags.imp_tag = -1; |
117 | asn1_tags.imp_class = -1; |
118 | asn1_tags.format = ASN1_GEN_FORMAT_ASCII; |
119 | asn1_tags.exp_count = 0; |
120 | if (CONF_parse_list(str, ',', 1, asn1_cb, &asn1_tags) != 0) { |
121 | *perr = ASN1_R_UNKNOWN_TAG; |
122 | return NULL; |
123 | } |
124 | |
125 | if ((asn1_tags.utype == V_ASN1_SEQUENCE) |
126 | || (asn1_tags.utype == V_ASN1_SET)) { |
127 | if (!cnf) { |
128 | *perr = ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG; |
129 | return NULL; |
130 | } |
131 | if (depth >= ASN1_GEN_SEQ_MAX_DEPTH) { |
132 | *perr = ASN1_R_ILLEGAL_NESTED_TAGGING; |
133 | return NULL; |
134 | } |
135 | ret = asn1_multi(asn1_tags.utype, asn1_tags.str, cnf, depth, perr); |
136 | } else |
137 | ret = asn1_str2type(asn1_tags.str, asn1_tags.format, asn1_tags.utype); |
138 | |
139 | if (!ret) |
140 | return NULL; |
141 | |
142 | /* If no tagging return base type */ |
143 | if ((asn1_tags.imp_tag == -1) && (asn1_tags.exp_count == 0)) |
144 | return ret; |
145 | |
146 | /* Generate the encoding */ |
147 | cpy_len = i2d_ASN1_TYPE(ret, &orig_der); |
148 | ASN1_TYPE_free(ret); |
149 | ret = NULL; |
150 | /* Set point to start copying for modified encoding */ |
151 | cpy_start = orig_der; |
152 | |
153 | /* Do we need IMPLICIT tagging? */ |
154 | if (asn1_tags.imp_tag != -1) { |
155 | /* If IMPLICIT we will replace the underlying tag */ |
156 | /* Skip existing tag+len */ |
157 | r = ASN1_get_object(&cpy_start, &hdr_len, &hdr_tag, &hdr_class, |
158 | cpy_len); |
159 | if (r & 0x80) |
160 | goto err; |
161 | /* Update copy length */ |
162 | cpy_len -= cpy_start - orig_der; |
163 | /* |
164 | * For IMPLICIT tagging the length should match the original length |
165 | * and constructed flag should be consistent. |
166 | */ |
167 | if (r & 0x1) { |
168 | /* Indefinite length constructed */ |
169 | hdr_constructed = 2; |
170 | hdr_len = 0; |
171 | } else |
172 | /* Just retain constructed flag */ |
173 | hdr_constructed = r & V_ASN1_CONSTRUCTED; |
174 | /* |
175 | * Work out new length with IMPLICIT tag: ignore constructed because |
176 | * it will mess up if indefinite length |
177 | */ |
178 | len = ASN1_object_size(0, hdr_len, asn1_tags.imp_tag); |
179 | } else |
180 | len = cpy_len; |
181 | |
182 | /* Work out length in any EXPLICIT, starting from end */ |
183 | |
184 | for (i = 0, etmp = asn1_tags.exp_list + asn1_tags.exp_count - 1; |
185 | i < asn1_tags.exp_count; i++, etmp--) { |
186 | /* Content length: number of content octets + any padding */ |
187 | len += etmp->exp_pad; |
188 | etmp->exp_len = len; |
189 | /* Total object length: length including new header */ |
190 | len = ASN1_object_size(0, len, etmp->exp_tag); |
191 | } |
192 | |
193 | /* Allocate buffer for new encoding */ |
194 | |
195 | new_der = OPENSSL_malloc(len); |
196 | if (new_der == NULL) |
197 | goto err; |
198 | |
199 | /* Generate tagged encoding */ |
200 | |
201 | p = new_der; |
202 | |
203 | /* Output explicit tags first */ |
204 | |
205 | for (i = 0, etmp = asn1_tags.exp_list; i < asn1_tags.exp_count; |
206 | i++, etmp++) { |
207 | ASN1_put_object(&p, etmp->exp_constructed, etmp->exp_len, |
208 | etmp->exp_tag, etmp->exp_class); |
209 | if (etmp->exp_pad) |
210 | *p++ = 0; |
211 | } |
212 | |
213 | /* If IMPLICIT, output tag */ |
214 | |
215 | if (asn1_tags.imp_tag != -1) { |
216 | if (asn1_tags.imp_class == V_ASN1_UNIVERSAL |
217 | && (asn1_tags.imp_tag == V_ASN1_SEQUENCE |
218 | || asn1_tags.imp_tag == V_ASN1_SET)) |
219 | hdr_constructed = V_ASN1_CONSTRUCTED; |
220 | ASN1_put_object(&p, hdr_constructed, hdr_len, |
221 | asn1_tags.imp_tag, asn1_tags.imp_class); |
222 | } |
223 | |
224 | /* Copy across original encoding */ |
225 | memcpy(p, cpy_start, cpy_len); |
226 | |
227 | cp = new_der; |
228 | |
229 | /* Obtain new ASN1_TYPE structure */ |
230 | ret = d2i_ASN1_TYPE(NULL, &cp, len); |
231 | |
232 | err: |
233 | OPENSSL_free(orig_der); |
234 | OPENSSL_free(new_der); |
235 | |
236 | return ret; |
237 | |
238 | } |
239 | |
240 | static int asn1_cb(const char *elem, int len, void *bitstr) |
241 | { |
242 | tag_exp_arg *arg = bitstr; |
243 | int i; |
244 | int utype; |
245 | int vlen = 0; |
246 | const char *p, *vstart = NULL; |
247 | |
248 | int tmp_tag, tmp_class; |
249 | |
250 | if (elem == NULL) |
251 | return -1; |
252 | |
253 | for (i = 0, p = elem; i < len; p++, i++) { |
254 | /* Look for the ':' in name value pairs */ |
255 | if (*p == ':') { |
256 | vstart = p + 1; |
257 | vlen = len - (vstart - elem); |
258 | len = p - elem; |
259 | break; |
260 | } |
261 | } |
262 | |
263 | utype = asn1_str2tag(elem, len); |
264 | |
265 | if (utype == -1) { |
266 | ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_TAG); |
267 | ERR_add_error_data(2, "tag=" , elem); |
268 | return -1; |
269 | } |
270 | |
271 | /* If this is not a modifier mark end of string and exit */ |
272 | if (!(utype & ASN1_GEN_FLAG)) { |
273 | arg->utype = utype; |
274 | arg->str = vstart; |
275 | /* If no value and not end of string, error */ |
276 | if (!vstart && elem[len]) { |
277 | ASN1err(ASN1_F_ASN1_CB, ASN1_R_MISSING_VALUE); |
278 | return -1; |
279 | } |
280 | return 0; |
281 | } |
282 | |
283 | switch (utype) { |
284 | |
285 | case ASN1_GEN_FLAG_IMP: |
286 | /* Check for illegal multiple IMPLICIT tagging */ |
287 | if (arg->imp_tag != -1) { |
288 | ASN1err(ASN1_F_ASN1_CB, ASN1_R_ILLEGAL_NESTED_TAGGING); |
289 | return -1; |
290 | } |
291 | if (!parse_tagging(vstart, vlen, &arg->imp_tag, &arg->imp_class)) |
292 | return -1; |
293 | break; |
294 | |
295 | case ASN1_GEN_FLAG_EXP: |
296 | |
297 | if (!parse_tagging(vstart, vlen, &tmp_tag, &tmp_class)) |
298 | return -1; |
299 | if (!append_exp(arg, tmp_tag, tmp_class, 1, 0, 0)) |
300 | return -1; |
301 | break; |
302 | |
303 | case ASN1_GEN_FLAG_SEQWRAP: |
304 | if (!append_exp(arg, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, 1, 0, 1)) |
305 | return -1; |
306 | break; |
307 | |
308 | case ASN1_GEN_FLAG_SETWRAP: |
309 | if (!append_exp(arg, V_ASN1_SET, V_ASN1_UNIVERSAL, 1, 0, 1)) |
310 | return -1; |
311 | break; |
312 | |
313 | case ASN1_GEN_FLAG_BITWRAP: |
314 | if (!append_exp(arg, V_ASN1_BIT_STRING, V_ASN1_UNIVERSAL, 0, 1, 1)) |
315 | return -1; |
316 | break; |
317 | |
318 | case ASN1_GEN_FLAG_OCTWRAP: |
319 | if (!append_exp(arg, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL, 0, 0, 1)) |
320 | return -1; |
321 | break; |
322 | |
323 | case ASN1_GEN_FLAG_FORMAT: |
324 | if (!vstart) { |
325 | ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_FORMAT); |
326 | return -1; |
327 | } |
328 | if (strncmp(vstart, "ASCII" , 5) == 0) |
329 | arg->format = ASN1_GEN_FORMAT_ASCII; |
330 | else if (strncmp(vstart, "UTF8" , 4) == 0) |
331 | arg->format = ASN1_GEN_FORMAT_UTF8; |
332 | else if (strncmp(vstart, "HEX" , 3) == 0) |
333 | arg->format = ASN1_GEN_FORMAT_HEX; |
334 | else if (strncmp(vstart, "BITLIST" , 7) == 0) |
335 | arg->format = ASN1_GEN_FORMAT_BITLIST; |
336 | else { |
337 | ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_FORMAT); |
338 | return -1; |
339 | } |
340 | break; |
341 | |
342 | } |
343 | |
344 | return 1; |
345 | |
346 | } |
347 | |
348 | static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass) |
349 | { |
350 | char erch[2]; |
351 | long tag_num; |
352 | char *eptr; |
353 | if (!vstart) |
354 | return 0; |
355 | tag_num = strtoul(vstart, &eptr, 10); |
356 | /* Check we haven't gone past max length: should be impossible */ |
357 | if (eptr && *eptr && (eptr > vstart + vlen)) |
358 | return 0; |
359 | if (tag_num < 0) { |
360 | ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_NUMBER); |
361 | return 0; |
362 | } |
363 | *ptag = tag_num; |
364 | /* If we have non numeric characters, parse them */ |
365 | if (eptr) |
366 | vlen -= eptr - vstart; |
367 | else |
368 | vlen = 0; |
369 | if (vlen) { |
370 | switch (*eptr) { |
371 | |
372 | case 'U': |
373 | *pclass = V_ASN1_UNIVERSAL; |
374 | break; |
375 | |
376 | case 'A': |
377 | *pclass = V_ASN1_APPLICATION; |
378 | break; |
379 | |
380 | case 'P': |
381 | *pclass = V_ASN1_PRIVATE; |
382 | break; |
383 | |
384 | case 'C': |
385 | *pclass = V_ASN1_CONTEXT_SPECIFIC; |
386 | break; |
387 | |
388 | default: |
389 | erch[0] = *eptr; |
390 | erch[1] = 0; |
391 | ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_MODIFIER); |
392 | ERR_add_error_data(2, "Char=" , erch); |
393 | return 0; |
394 | |
395 | } |
396 | } else |
397 | *pclass = V_ASN1_CONTEXT_SPECIFIC; |
398 | |
399 | return 1; |
400 | |
401 | } |
402 | |
403 | /* Handle multiple types: SET and SEQUENCE */ |
404 | |
405 | static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf, |
406 | int depth, int *perr) |
407 | { |
408 | ASN1_TYPE *ret = NULL; |
409 | STACK_OF(ASN1_TYPE) *sk = NULL; |
410 | STACK_OF(CONF_VALUE) *sect = NULL; |
411 | unsigned char *der = NULL; |
412 | int derlen; |
413 | int i; |
414 | sk = sk_ASN1_TYPE_new_null(); |
415 | if (!sk) |
416 | goto bad; |
417 | if (section) { |
418 | if (!cnf) |
419 | goto bad; |
420 | sect = X509V3_get_section(cnf, (char *)section); |
421 | if (!sect) |
422 | goto bad; |
423 | for (i = 0; i < sk_CONF_VALUE_num(sect); i++) { |
424 | ASN1_TYPE *typ = |
425 | generate_v3(sk_CONF_VALUE_value(sect, i)->value, cnf, |
426 | depth + 1, perr); |
427 | if (!typ) |
428 | goto bad; |
429 | if (!sk_ASN1_TYPE_push(sk, typ)) |
430 | goto bad; |
431 | } |
432 | } |
433 | |
434 | /* |
435 | * Now we has a STACK of the components, convert to the correct form |
436 | */ |
437 | |
438 | if (utype == V_ASN1_SET) |
439 | derlen = i2d_ASN1_SET_ANY(sk, &der); |
440 | else |
441 | derlen = i2d_ASN1_SEQUENCE_ANY(sk, &der); |
442 | |
443 | if (derlen < 0) |
444 | goto bad; |
445 | if ((ret = ASN1_TYPE_new()) == NULL) |
446 | goto bad; |
447 | if ((ret->value.asn1_string = ASN1_STRING_type_new(utype)) == NULL) |
448 | goto bad; |
449 | |
450 | ret->type = utype; |
451 | ret->value.asn1_string->data = der; |
452 | ret->value.asn1_string->length = derlen; |
453 | |
454 | der = NULL; |
455 | |
456 | bad: |
457 | |
458 | OPENSSL_free(der); |
459 | |
460 | sk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free); |
461 | X509V3_section_free(cnf, sect); |
462 | |
463 | return ret; |
464 | } |
465 | |
466 | static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class, |
467 | int exp_constructed, int exp_pad, int imp_ok) |
468 | { |
469 | tag_exp_type *exp_tmp; |
470 | /* Can only have IMPLICIT if permitted */ |
471 | if ((arg->imp_tag != -1) && !imp_ok) { |
472 | ASN1err(ASN1_F_APPEND_EXP, ASN1_R_ILLEGAL_IMPLICIT_TAG); |
473 | return 0; |
474 | } |
475 | |
476 | if (arg->exp_count == ASN1_FLAG_EXP_MAX) { |
477 | ASN1err(ASN1_F_APPEND_EXP, ASN1_R_DEPTH_EXCEEDED); |
478 | return 0; |
479 | } |
480 | |
481 | exp_tmp = &arg->exp_list[arg->exp_count++]; |
482 | |
483 | /* |
484 | * If IMPLICIT set tag to implicit value then reset implicit tag since it |
485 | * has been used. |
486 | */ |
487 | if (arg->imp_tag != -1) { |
488 | exp_tmp->exp_tag = arg->imp_tag; |
489 | exp_tmp->exp_class = arg->imp_class; |
490 | arg->imp_tag = -1; |
491 | arg->imp_class = -1; |
492 | } else { |
493 | exp_tmp->exp_tag = exp_tag; |
494 | exp_tmp->exp_class = exp_class; |
495 | } |
496 | exp_tmp->exp_constructed = exp_constructed; |
497 | exp_tmp->exp_pad = exp_pad; |
498 | |
499 | return 1; |
500 | } |
501 | |
502 | static int asn1_str2tag(const char *tagstr, int len) |
503 | { |
504 | unsigned int i; |
505 | static const struct tag_name_st *tntmp, tnst[] = { |
506 | ASN1_GEN_STR("BOOL" , V_ASN1_BOOLEAN), |
507 | ASN1_GEN_STR("BOOLEAN" , V_ASN1_BOOLEAN), |
508 | ASN1_GEN_STR("NULL" , V_ASN1_NULL), |
509 | ASN1_GEN_STR("INT" , V_ASN1_INTEGER), |
510 | ASN1_GEN_STR("INTEGER" , V_ASN1_INTEGER), |
511 | ASN1_GEN_STR("ENUM" , V_ASN1_ENUMERATED), |
512 | ASN1_GEN_STR("ENUMERATED" , V_ASN1_ENUMERATED), |
513 | ASN1_GEN_STR("OID" , V_ASN1_OBJECT), |
514 | ASN1_GEN_STR("OBJECT" , V_ASN1_OBJECT), |
515 | ASN1_GEN_STR("UTCTIME" , V_ASN1_UTCTIME), |
516 | ASN1_GEN_STR("UTC" , V_ASN1_UTCTIME), |
517 | ASN1_GEN_STR("GENERALIZEDTIME" , V_ASN1_GENERALIZEDTIME), |
518 | ASN1_GEN_STR("GENTIME" , V_ASN1_GENERALIZEDTIME), |
519 | ASN1_GEN_STR("OCT" , V_ASN1_OCTET_STRING), |
520 | ASN1_GEN_STR("OCTETSTRING" , V_ASN1_OCTET_STRING), |
521 | ASN1_GEN_STR("BITSTR" , V_ASN1_BIT_STRING), |
522 | ASN1_GEN_STR("BITSTRING" , V_ASN1_BIT_STRING), |
523 | ASN1_GEN_STR("UNIVERSALSTRING" , V_ASN1_UNIVERSALSTRING), |
524 | ASN1_GEN_STR("UNIV" , V_ASN1_UNIVERSALSTRING), |
525 | ASN1_GEN_STR("IA5" , V_ASN1_IA5STRING), |
526 | ASN1_GEN_STR("IA5STRING" , V_ASN1_IA5STRING), |
527 | ASN1_GEN_STR("UTF8" , V_ASN1_UTF8STRING), |
528 | ASN1_GEN_STR("UTF8String" , V_ASN1_UTF8STRING), |
529 | ASN1_GEN_STR("BMP" , V_ASN1_BMPSTRING), |
530 | ASN1_GEN_STR("BMPSTRING" , V_ASN1_BMPSTRING), |
531 | ASN1_GEN_STR("VISIBLESTRING" , V_ASN1_VISIBLESTRING), |
532 | ASN1_GEN_STR("VISIBLE" , V_ASN1_VISIBLESTRING), |
533 | ASN1_GEN_STR("PRINTABLESTRING" , V_ASN1_PRINTABLESTRING), |
534 | ASN1_GEN_STR("PRINTABLE" , V_ASN1_PRINTABLESTRING), |
535 | ASN1_GEN_STR("T61" , V_ASN1_T61STRING), |
536 | ASN1_GEN_STR("T61STRING" , V_ASN1_T61STRING), |
537 | ASN1_GEN_STR("TELETEXSTRING" , V_ASN1_T61STRING), |
538 | ASN1_GEN_STR("GeneralString" , V_ASN1_GENERALSTRING), |
539 | ASN1_GEN_STR("GENSTR" , V_ASN1_GENERALSTRING), |
540 | ASN1_GEN_STR("NUMERIC" , V_ASN1_NUMERICSTRING), |
541 | ASN1_GEN_STR("NUMERICSTRING" , V_ASN1_NUMERICSTRING), |
542 | |
543 | /* Special cases */ |
544 | ASN1_GEN_STR("SEQUENCE" , V_ASN1_SEQUENCE), |
545 | ASN1_GEN_STR("SEQ" , V_ASN1_SEQUENCE), |
546 | ASN1_GEN_STR("SET" , V_ASN1_SET), |
547 | /* type modifiers */ |
548 | /* Explicit tag */ |
549 | ASN1_GEN_STR("EXP" , ASN1_GEN_FLAG_EXP), |
550 | ASN1_GEN_STR("EXPLICIT" , ASN1_GEN_FLAG_EXP), |
551 | /* Implicit tag */ |
552 | ASN1_GEN_STR("IMP" , ASN1_GEN_FLAG_IMP), |
553 | ASN1_GEN_STR("IMPLICIT" , ASN1_GEN_FLAG_IMP), |
554 | /* OCTET STRING wrapper */ |
555 | ASN1_GEN_STR("OCTWRAP" , ASN1_GEN_FLAG_OCTWRAP), |
556 | /* SEQUENCE wrapper */ |
557 | ASN1_GEN_STR("SEQWRAP" , ASN1_GEN_FLAG_SEQWRAP), |
558 | /* SET wrapper */ |
559 | ASN1_GEN_STR("SETWRAP" , ASN1_GEN_FLAG_SETWRAP), |
560 | /* BIT STRING wrapper */ |
561 | ASN1_GEN_STR("BITWRAP" , ASN1_GEN_FLAG_BITWRAP), |
562 | ASN1_GEN_STR("FORM" , ASN1_GEN_FLAG_FORMAT), |
563 | ASN1_GEN_STR("FORMAT" , ASN1_GEN_FLAG_FORMAT), |
564 | }; |
565 | |
566 | if (len == -1) |
567 | len = strlen(tagstr); |
568 | |
569 | tntmp = tnst; |
570 | for (i = 0; i < OSSL_NELEM(tnst); i++, tntmp++) { |
571 | if ((len == tntmp->len) && (strncmp(tntmp->strnam, tagstr, len) == 0)) |
572 | return tntmp->tag; |
573 | } |
574 | |
575 | return -1; |
576 | } |
577 | |
578 | static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype) |
579 | { |
580 | ASN1_TYPE *atmp = NULL; |
581 | CONF_VALUE vtmp; |
582 | unsigned char *rdata; |
583 | long rdlen; |
584 | int no_unused = 1; |
585 | |
586 | if ((atmp = ASN1_TYPE_new()) == NULL) { |
587 | ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE); |
588 | return NULL; |
589 | } |
590 | |
591 | if (!str) |
592 | str = "" ; |
593 | |
594 | switch (utype) { |
595 | |
596 | case V_ASN1_NULL: |
597 | if (str && *str) { |
598 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_NULL_VALUE); |
599 | goto bad_form; |
600 | } |
601 | break; |
602 | |
603 | case V_ASN1_BOOLEAN: |
604 | if (format != ASN1_GEN_FORMAT_ASCII) { |
605 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_NOT_ASCII_FORMAT); |
606 | goto bad_form; |
607 | } |
608 | vtmp.name = NULL; |
609 | vtmp.section = NULL; |
610 | vtmp.value = (char *)str; |
611 | if (!X509V3_get_value_bool(&vtmp, &atmp->value.boolean)) { |
612 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_BOOLEAN); |
613 | goto bad_str; |
614 | } |
615 | break; |
616 | |
617 | case V_ASN1_INTEGER: |
618 | case V_ASN1_ENUMERATED: |
619 | if (format != ASN1_GEN_FORMAT_ASCII) { |
620 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_INTEGER_NOT_ASCII_FORMAT); |
621 | goto bad_form; |
622 | } |
623 | if ((atmp->value.integer |
624 | = s2i_ASN1_INTEGER(NULL, str)) == NULL) { |
625 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_INTEGER); |
626 | goto bad_str; |
627 | } |
628 | break; |
629 | |
630 | case V_ASN1_OBJECT: |
631 | if (format != ASN1_GEN_FORMAT_ASCII) { |
632 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_OBJECT_NOT_ASCII_FORMAT); |
633 | goto bad_form; |
634 | } |
635 | if ((atmp->value.object = OBJ_txt2obj(str, 0)) == NULL) { |
636 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_OBJECT); |
637 | goto bad_str; |
638 | } |
639 | break; |
640 | |
641 | case V_ASN1_UTCTIME: |
642 | case V_ASN1_GENERALIZEDTIME: |
643 | if (format != ASN1_GEN_FORMAT_ASCII) { |
644 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_TIME_NOT_ASCII_FORMAT); |
645 | goto bad_form; |
646 | } |
647 | if ((atmp->value.asn1_string = ASN1_STRING_new()) == NULL) { |
648 | ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE); |
649 | goto bad_str; |
650 | } |
651 | if (!ASN1_STRING_set(atmp->value.asn1_string, str, -1)) { |
652 | ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE); |
653 | goto bad_str; |
654 | } |
655 | atmp->value.asn1_string->type = utype; |
656 | if (!ASN1_TIME_check(atmp->value.asn1_string)) { |
657 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_TIME_VALUE); |
658 | goto bad_str; |
659 | } |
660 | |
661 | break; |
662 | |
663 | case V_ASN1_BMPSTRING: |
664 | case V_ASN1_PRINTABLESTRING: |
665 | case V_ASN1_IA5STRING: |
666 | case V_ASN1_T61STRING: |
667 | case V_ASN1_UTF8STRING: |
668 | case V_ASN1_VISIBLESTRING: |
669 | case V_ASN1_UNIVERSALSTRING: |
670 | case V_ASN1_GENERALSTRING: |
671 | case V_ASN1_NUMERICSTRING: |
672 | if (format == ASN1_GEN_FORMAT_ASCII) |
673 | format = MBSTRING_ASC; |
674 | else if (format == ASN1_GEN_FORMAT_UTF8) |
675 | format = MBSTRING_UTF8; |
676 | else { |
677 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_FORMAT); |
678 | goto bad_form; |
679 | } |
680 | |
681 | if (ASN1_mbstring_copy(&atmp->value.asn1_string, (unsigned char *)str, |
682 | -1, format, ASN1_tag2bit(utype)) <= 0) { |
683 | ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE); |
684 | goto bad_str; |
685 | } |
686 | |
687 | break; |
688 | |
689 | case V_ASN1_BIT_STRING: |
690 | case V_ASN1_OCTET_STRING: |
691 | if ((atmp->value.asn1_string = ASN1_STRING_new()) == NULL) { |
692 | ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE); |
693 | goto bad_form; |
694 | } |
695 | |
696 | if (format == ASN1_GEN_FORMAT_HEX) { |
697 | if ((rdata = OPENSSL_hexstr2buf(str, &rdlen)) == NULL) { |
698 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_HEX); |
699 | goto bad_str; |
700 | } |
701 | atmp->value.asn1_string->data = rdata; |
702 | atmp->value.asn1_string->length = rdlen; |
703 | atmp->value.asn1_string->type = utype; |
704 | } else if (format == ASN1_GEN_FORMAT_ASCII) |
705 | ASN1_STRING_set(atmp->value.asn1_string, str, -1); |
706 | else if ((format == ASN1_GEN_FORMAT_BITLIST) |
707 | && (utype == V_ASN1_BIT_STRING)) { |
708 | if (!CONF_parse_list |
709 | (str, ',', 1, bitstr_cb, atmp->value.bit_string)) { |
710 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_LIST_ERROR); |
711 | goto bad_str; |
712 | } |
713 | no_unused = 0; |
714 | |
715 | } else { |
716 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_BITSTRING_FORMAT); |
717 | goto bad_form; |
718 | } |
719 | |
720 | if ((utype == V_ASN1_BIT_STRING) && no_unused) { |
721 | atmp->value.asn1_string->flags |
722 | &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); |
723 | atmp->value.asn1_string->flags |= ASN1_STRING_FLAG_BITS_LEFT; |
724 | } |
725 | |
726 | break; |
727 | |
728 | default: |
729 | ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_UNSUPPORTED_TYPE); |
730 | goto bad_str; |
731 | } |
732 | |
733 | atmp->type = utype; |
734 | return atmp; |
735 | |
736 | bad_str: |
737 | ERR_add_error_data(2, "string=" , str); |
738 | bad_form: |
739 | |
740 | ASN1_TYPE_free(atmp); |
741 | return NULL; |
742 | |
743 | } |
744 | |
745 | static int bitstr_cb(const char *elem, int len, void *bitstr) |
746 | { |
747 | long bitnum; |
748 | char *eptr; |
749 | if (!elem) |
750 | return 0; |
751 | bitnum = strtoul(elem, &eptr, 10); |
752 | if (eptr && *eptr && (eptr != elem + len)) |
753 | return 0; |
754 | if (bitnum < 0) { |
755 | ASN1err(ASN1_F_BITSTR_CB, ASN1_R_INVALID_NUMBER); |
756 | return 0; |
757 | } |
758 | if (!ASN1_BIT_STRING_set_bit(bitstr, bitnum, 1)) { |
759 | ASN1err(ASN1_F_BITSTR_CB, ERR_R_MALLOC_FAILURE); |
760 | return 0; |
761 | } |
762 | return 1; |
763 | } |
764 | |
765 | static int mask_cb(const char *elem, int len, void *arg) |
766 | { |
767 | unsigned long *pmask = arg, tmpmask; |
768 | int tag; |
769 | if (elem == NULL) |
770 | return 0; |
771 | if ((len == 3) && (strncmp(elem, "DIR" , 3) == 0)) { |
772 | *pmask |= B_ASN1_DIRECTORYSTRING; |
773 | return 1; |
774 | } |
775 | tag = asn1_str2tag(elem, len); |
776 | if (!tag || (tag & ASN1_GEN_FLAG)) |
777 | return 0; |
778 | tmpmask = ASN1_tag2bit(tag); |
779 | if (!tmpmask) |
780 | return 0; |
781 | *pmask |= tmpmask; |
782 | return 1; |
783 | } |
784 | |
785 | int ASN1_str2mask(const char *str, unsigned long *pmask) |
786 | { |
787 | *pmask = 0; |
788 | return CONF_parse_list(str, '|', 1, mask_cb, pmask); |
789 | } |
790 | |