1 | /* |
2 | * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | typedef struct X509_POLICY_DATA_st X509_POLICY_DATA; |
11 | |
12 | DEFINE_STACK_OF(X509_POLICY_DATA) |
13 | |
14 | /* Internal structures */ |
15 | |
16 | /* |
17 | * This structure and the field names correspond to the Policy 'node' of |
18 | * RFC3280. NB this structure contains no pointers to parent or child data: |
19 | * X509_POLICY_NODE contains that. This means that the main policy data can |
20 | * be kept static and cached with the certificate. |
21 | */ |
22 | |
23 | struct X509_POLICY_DATA_st { |
24 | unsigned int flags; |
25 | /* Policy OID and qualifiers for this data */ |
26 | ASN1_OBJECT *valid_policy; |
27 | STACK_OF(POLICYQUALINFO) *qualifier_set; |
28 | STACK_OF(ASN1_OBJECT) *expected_policy_set; |
29 | }; |
30 | |
31 | /* X509_POLICY_DATA flags values */ |
32 | |
33 | /* |
34 | * This flag indicates the structure has been mapped using a policy mapping |
35 | * extension. If policy mapping is not active its references get deleted. |
36 | */ |
37 | |
38 | #define POLICY_DATA_FLAG_MAPPED 0x1 |
39 | |
40 | /* |
41 | * This flag indicates the data doesn't correspond to a policy in Certificate |
42 | * Policies: it has been mapped to any policy. |
43 | */ |
44 | |
45 | #define POLICY_DATA_FLAG_MAPPED_ANY 0x2 |
46 | |
47 | /* AND with flags to see if any mapping has occurred */ |
48 | |
49 | #define POLICY_DATA_FLAG_MAP_MASK 0x3 |
50 | |
51 | /* qualifiers are shared and shouldn't be freed */ |
52 | |
53 | #define POLICY_DATA_FLAG_SHARED_QUALIFIERS 0x4 |
54 | |
55 | /* Parent node is an extra node and should be freed */ |
56 | |
57 | #define 0x8 |
58 | |
59 | /* Corresponding CertificatePolicies is critical */ |
60 | |
61 | #define POLICY_DATA_FLAG_CRITICAL 0x10 |
62 | |
63 | /* This structure is cached with a certificate */ |
64 | |
65 | struct X509_POLICY_CACHE_st { |
66 | /* anyPolicy data or NULL if no anyPolicy */ |
67 | X509_POLICY_DATA *anyPolicy; |
68 | /* other policy data */ |
69 | STACK_OF(X509_POLICY_DATA) *data; |
70 | /* If InhibitAnyPolicy present this is its value or -1 if absent. */ |
71 | long any_skip; |
72 | /* |
73 | * If policyConstraints and requireExplicitPolicy present this is its |
74 | * value or -1 if absent. |
75 | */ |
76 | long explicit_skip; |
77 | /* |
78 | * If policyConstraints and policyMapping present this is its value or -1 |
79 | * if absent. |
80 | */ |
81 | long map_skip; |
82 | }; |
83 | |
84 | /* |
85 | * #define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL |
86 | */ |
87 | |
88 | /* This structure represents the relationship between nodes */ |
89 | |
90 | struct X509_POLICY_NODE_st { |
91 | /* node data this refers to */ |
92 | const X509_POLICY_DATA *data; |
93 | /* Parent node */ |
94 | X509_POLICY_NODE *parent; |
95 | /* Number of child nodes */ |
96 | int nchild; |
97 | }; |
98 | |
99 | struct X509_POLICY_LEVEL_st { |
100 | /* Cert for this level */ |
101 | X509 *cert; |
102 | /* nodes at this level */ |
103 | STACK_OF(X509_POLICY_NODE) *nodes; |
104 | /* anyPolicy node */ |
105 | X509_POLICY_NODE *anyPolicy; |
106 | /* Extra data */ |
107 | /* |
108 | * STACK_OF(X509_POLICY_DATA) *extra_data; |
109 | */ |
110 | unsigned int flags; |
111 | }; |
112 | |
113 | struct X509_POLICY_TREE_st { |
114 | /* This is the tree 'level' data */ |
115 | X509_POLICY_LEVEL *levels; |
116 | int nlevel; |
117 | /* |
118 | * Extra policy data when additional nodes (not from the certificate) are |
119 | * required. |
120 | */ |
121 | STACK_OF(X509_POLICY_DATA) *; |
122 | /* This is the authority constrained policy set */ |
123 | STACK_OF(X509_POLICY_NODE) *auth_policies; |
124 | STACK_OF(X509_POLICY_NODE) *user_policies; |
125 | unsigned int flags; |
126 | }; |
127 | |
128 | /* Set if anyPolicy present in user policies */ |
129 | #define POLICY_FLAG_ANY_POLICY 0x2 |
130 | |
131 | /* Useful macros */ |
132 | |
133 | #define node_data_critical(data) (data->flags & POLICY_DATA_FLAG_CRITICAL) |
134 | #define node_critical(node) node_data_critical(node->data) |
135 | |
136 | /* Internal functions */ |
137 | |
138 | X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id, |
139 | int crit); |
140 | void policy_data_free(X509_POLICY_DATA *data); |
141 | |
142 | X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache, |
143 | const ASN1_OBJECT *id); |
144 | int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps); |
145 | |
146 | STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void); |
147 | |
148 | void policy_cache_init(void); |
149 | |
150 | void policy_cache_free(X509_POLICY_CACHE *cache); |
151 | |
152 | X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level, |
153 | const X509_POLICY_NODE *parent, |
154 | const ASN1_OBJECT *id); |
155 | |
156 | X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk, |
157 | const ASN1_OBJECT *id); |
158 | |
159 | X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, |
160 | X509_POLICY_DATA *data, |
161 | X509_POLICY_NODE *parent, |
162 | X509_POLICY_TREE *tree); |
163 | void policy_node_free(X509_POLICY_NODE *node); |
164 | int policy_node_match(const X509_POLICY_LEVEL *lvl, |
165 | const X509_POLICY_NODE *node, const ASN1_OBJECT *oid); |
166 | |
167 | const X509_POLICY_CACHE *policy_cache_set(X509 *x); |
168 | |