1 | /* |
2 | * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include "internal/cryptlib.h" |
11 | #include <openssl/trace.h> |
12 | #include <openssl/x509.h> |
13 | #include <openssl/x509v3.h> |
14 | |
15 | #include "pcy_local.h" |
16 | |
17 | static void expected_print(BIO *channel, |
18 | X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node, |
19 | int indent) |
20 | { |
21 | if ((lev->flags & X509_V_FLAG_INHIBIT_MAP) |
22 | || !(node->data->flags & POLICY_DATA_FLAG_MAP_MASK)) |
23 | BIO_puts(channel, " Not Mapped\n" ); |
24 | else { |
25 | int i; |
26 | |
27 | STACK_OF(ASN1_OBJECT) *pset = node->data->expected_policy_set; |
28 | ASN1_OBJECT *oid; |
29 | BIO_puts(channel, " Expected: " ); |
30 | for (i = 0; i < sk_ASN1_OBJECT_num(pset); i++) { |
31 | oid = sk_ASN1_OBJECT_value(pset, i); |
32 | if (i) |
33 | BIO_puts(channel, ", " ); |
34 | i2a_ASN1_OBJECT(channel, oid); |
35 | } |
36 | BIO_puts(channel, "\n" ); |
37 | } |
38 | } |
39 | |
40 | static void tree_print(BIO *channel, |
41 | char *str, X509_POLICY_TREE *tree, |
42 | X509_POLICY_LEVEL *curr) |
43 | { |
44 | X509_POLICY_LEVEL *plev; |
45 | |
46 | if (!curr) |
47 | curr = tree->levels + tree->nlevel; |
48 | else |
49 | curr++; |
50 | |
51 | BIO_printf(channel, "Level print after %s\n" , str); |
52 | BIO_printf(channel, "Printing Up to Level %ld\n" , |
53 | (long)(curr - tree->levels)); |
54 | for (plev = tree->levels; plev != curr; plev++) { |
55 | int i; |
56 | |
57 | BIO_printf(channel, "Level %ld, flags = %x\n" , |
58 | (long)(plev - tree->levels), plev->flags); |
59 | for (i = 0; i < sk_X509_POLICY_NODE_num(plev->nodes); i++) { |
60 | X509_POLICY_NODE *node = |
61 | sk_X509_POLICY_NODE_value(plev->nodes, i); |
62 | |
63 | X509_POLICY_NODE_print(channel, node, 2); |
64 | expected_print(channel, plev, node, 2); |
65 | BIO_printf(channel, " Flags: %x\n" , node->data->flags); |
66 | } |
67 | if (plev->anyPolicy) |
68 | X509_POLICY_NODE_print(channel, plev->anyPolicy, 2); |
69 | } |
70 | } |
71 | |
72 | #define TREE_PRINT(str, tree, curr) \ |
73 | OSSL_TRACE_BEGIN(X509V3_POLICY) { \ |
74 | tree_print(trc_out, "before tree_prune()", tree, curr); \ |
75 | } OSSL_TRACE_END(X509V3_POLICY) |
76 | |
77 | /*- |
78 | * Return value: <= 0 on error, or positive bit mask: |
79 | * |
80 | * X509_PCY_TREE_VALID: valid tree |
81 | * X509_PCY_TREE_EMPTY: empty tree (including bare TA case) |
82 | * X509_PCY_TREE_EXPLICIT: explicit policy required |
83 | */ |
84 | static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, |
85 | unsigned int flags) |
86 | { |
87 | X509_POLICY_TREE *tree; |
88 | X509_POLICY_LEVEL *level; |
89 | const X509_POLICY_CACHE *cache; |
90 | X509_POLICY_DATA *data = NULL; |
91 | int ret = X509_PCY_TREE_VALID; |
92 | int n = sk_X509_num(certs) - 1; /* RFC5280 paths omit the TA */ |
93 | int explicit_policy = (flags & X509_V_FLAG_EXPLICIT_POLICY) ? 0 : n+1; |
94 | int any_skip = (flags & X509_V_FLAG_INHIBIT_ANY) ? 0 : n+1; |
95 | int map_skip = (flags & X509_V_FLAG_INHIBIT_MAP) ? 0 : n+1; |
96 | int i; |
97 | |
98 | *ptree = NULL; |
99 | |
100 | /* Can't do anything with just a trust anchor */ |
101 | if (n == 0) |
102 | return X509_PCY_TREE_EMPTY; |
103 | |
104 | /* |
105 | * First setup the policy cache in all n non-TA certificates, this will be |
106 | * used in X509_verify_cert() which will invoke the verify callback for all |
107 | * certificates with invalid policy extensions. |
108 | */ |
109 | for (i = n - 1; i >= 0; i--) { |
110 | X509 *x = sk_X509_value(certs, i); |
111 | |
112 | /* Call for side-effect of computing hash and caching extensions */ |
113 | X509_check_purpose(x, -1, 0); |
114 | |
115 | /* If cache is NULL, likely ENOMEM: return immediately */ |
116 | if (policy_cache_set(x) == NULL) |
117 | return X509_PCY_TREE_INTERNAL; |
118 | } |
119 | |
120 | /* |
121 | * At this point check for invalid policies and required explicit policy. |
122 | * Note that the explicit_policy counter is a count-down to zero, with the |
123 | * requirement kicking in if and once it does that. The counter is |
124 | * decremented for every non-self-issued certificate in the path, but may |
125 | * be further reduced by policy constraints in a non-leaf certificate. |
126 | * |
127 | * The ultimate policy set is the intersection of all the policies along |
128 | * the path, if we hit a certificate with an empty policy set, and explicit |
129 | * policy is required we're done. |
130 | */ |
131 | for (i = n - 1; |
132 | i >= 0 && (explicit_policy > 0 || (ret & X509_PCY_TREE_EMPTY) == 0); |
133 | i--) { |
134 | X509 *x = sk_X509_value(certs, i); |
135 | uint32_t ex_flags = X509_get_extension_flags(x); |
136 | |
137 | /* All the policies are already cached, we can return early */ |
138 | if (ex_flags & EXFLAG_INVALID_POLICY) |
139 | return X509_PCY_TREE_INVALID; |
140 | |
141 | /* Access the cache which we now know exists */ |
142 | cache = policy_cache_set(x); |
143 | |
144 | if ((ret & X509_PCY_TREE_VALID) && cache->data == NULL) |
145 | ret = X509_PCY_TREE_EMPTY; |
146 | if (explicit_policy > 0) { |
147 | if (!(ex_flags & EXFLAG_SI)) |
148 | explicit_policy--; |
149 | if ((cache->explicit_skip >= 0) |
150 | && (cache->explicit_skip < explicit_policy)) |
151 | explicit_policy = cache->explicit_skip; |
152 | } |
153 | } |
154 | |
155 | if (explicit_policy == 0) |
156 | ret |= X509_PCY_TREE_EXPLICIT; |
157 | if ((ret & X509_PCY_TREE_VALID) == 0) |
158 | return ret; |
159 | |
160 | /* If we get this far initialize the tree */ |
161 | if ((tree = OPENSSL_zalloc(sizeof(*tree))) == NULL) { |
162 | X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE); |
163 | return X509_PCY_TREE_INTERNAL; |
164 | } |
165 | |
166 | /* |
167 | * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3. |
168 | * |
169 | * The top level is implicitly for the trust anchor with valid expected |
170 | * policies of anyPolicy. (RFC 5280 has the TA at depth 0 and the leaf at |
171 | * depth n, we have the leaf at depth 0 and the TA at depth n). |
172 | */ |
173 | if ((tree->levels = OPENSSL_zalloc(sizeof(*tree->levels)*(n+1))) == NULL) { |
174 | OPENSSL_free(tree); |
175 | X509V3err(X509V3_F_TREE_INIT, ERR_R_MALLOC_FAILURE); |
176 | return X509_PCY_TREE_INTERNAL; |
177 | } |
178 | tree->nlevel = n+1; |
179 | level = tree->levels; |
180 | if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL) |
181 | goto bad_tree; |
182 | if (level_add_node(level, data, NULL, tree) == NULL) { |
183 | policy_data_free(data); |
184 | goto bad_tree; |
185 | } |
186 | |
187 | /* |
188 | * In this pass initialize all the tree levels and whether anyPolicy and |
189 | * policy mapping are inhibited at each level. |
190 | */ |
191 | for (i = n - 1; i >= 0; i--) { |
192 | X509 *x = sk_X509_value(certs, i); |
193 | uint32_t ex_flags = X509_get_extension_flags(x); |
194 | |
195 | /* Access the cache which we now know exists */ |
196 | cache = policy_cache_set(x); |
197 | |
198 | X509_up_ref(x); |
199 | (++level)->cert = x; |
200 | |
201 | if (!cache->anyPolicy) |
202 | level->flags |= X509_V_FLAG_INHIBIT_ANY; |
203 | |
204 | /* Determine inhibit any and inhibit map flags */ |
205 | if (any_skip == 0) { |
206 | /* |
207 | * Any matching allowed only if certificate is self issued and not |
208 | * the last in the chain. |
209 | */ |
210 | if (!(ex_flags & EXFLAG_SI) || (i == 0)) |
211 | level->flags |= X509_V_FLAG_INHIBIT_ANY; |
212 | } else { |
213 | if (!(ex_flags & EXFLAG_SI)) |
214 | any_skip--; |
215 | if ((cache->any_skip >= 0) && (cache->any_skip < any_skip)) |
216 | any_skip = cache->any_skip; |
217 | } |
218 | |
219 | if (map_skip == 0) |
220 | level->flags |= X509_V_FLAG_INHIBIT_MAP; |
221 | else { |
222 | if (!(ex_flags & EXFLAG_SI)) |
223 | map_skip--; |
224 | if ((cache->map_skip >= 0) && (cache->map_skip < map_skip)) |
225 | map_skip = cache->map_skip; |
226 | } |
227 | } |
228 | |
229 | *ptree = tree; |
230 | return ret; |
231 | |
232 | bad_tree: |
233 | X509_policy_tree_free(tree); |
234 | return X509_PCY_TREE_INTERNAL; |
235 | } |
236 | |
237 | /* |
238 | * Return value: 1 on success, 0 otherwise |
239 | */ |
240 | static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, |
241 | X509_POLICY_DATA *data) |
242 | { |
243 | X509_POLICY_LEVEL *last = curr - 1; |
244 | int i, matched = 0; |
245 | |
246 | /* Iterate through all in nodes linking matches */ |
247 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { |
248 | X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i); |
249 | |
250 | if (policy_node_match(last, node, data->valid_policy)) { |
251 | if (level_add_node(curr, data, node, NULL) == NULL) |
252 | return 0; |
253 | matched = 1; |
254 | } |
255 | } |
256 | if (!matched && last->anyPolicy) { |
257 | if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL) |
258 | return 0; |
259 | } |
260 | return 1; |
261 | } |
262 | |
263 | /* |
264 | * This corresponds to RFC3280 6.1.3(d)(1): link any data from |
265 | * CertificatePolicies onto matching parent or anyPolicy if no match. |
266 | * |
267 | * Return value: 1 on success, 0 otherwise. |
268 | */ |
269 | static int tree_link_nodes(X509_POLICY_LEVEL *curr, |
270 | const X509_POLICY_CACHE *cache) |
271 | { |
272 | int i; |
273 | |
274 | for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) { |
275 | X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i); |
276 | |
277 | /* Look for matching nodes in previous level */ |
278 | if (!tree_link_matching_nodes(curr, data)) |
279 | return 0; |
280 | } |
281 | return 1; |
282 | } |
283 | |
284 | /* |
285 | * This corresponds to RFC3280 6.1.3(d)(2): Create new data for any unmatched |
286 | * policies in the parent and link to anyPolicy. |
287 | * |
288 | * Return value: 1 on success, 0 otherwise. |
289 | */ |
290 | static int tree_add_unmatched(X509_POLICY_LEVEL *curr, |
291 | const X509_POLICY_CACHE *cache, |
292 | const ASN1_OBJECT *id, |
293 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) |
294 | { |
295 | X509_POLICY_DATA *data; |
296 | |
297 | if (id == NULL) |
298 | id = node->data->valid_policy; |
299 | /* |
300 | * Create a new node with qualifiers from anyPolicy and id from unmatched |
301 | * node. |
302 | */ |
303 | if ((data = policy_data_new(NULL, id, node_critical(node))) == NULL) |
304 | return 0; |
305 | |
306 | /* Curr may not have anyPolicy */ |
307 | data->qualifier_set = cache->anyPolicy->qualifier_set; |
308 | data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; |
309 | if (level_add_node(curr, data, node, tree) == NULL) { |
310 | policy_data_free(data); |
311 | return 0; |
312 | } |
313 | return 1; |
314 | } |
315 | |
316 | /* |
317 | * Return value: 1 on success, 0 otherwise. |
318 | */ |
319 | static int tree_link_unmatched(X509_POLICY_LEVEL *curr, |
320 | const X509_POLICY_CACHE *cache, |
321 | X509_POLICY_NODE *node, X509_POLICY_TREE *tree) |
322 | { |
323 | const X509_POLICY_LEVEL *last = curr - 1; |
324 | int i; |
325 | |
326 | if ((last->flags & X509_V_FLAG_INHIBIT_MAP) |
327 | || !(node->data->flags & POLICY_DATA_FLAG_MAPPED)) { |
328 | /* If no policy mapping: matched if one child present */ |
329 | if (node->nchild) |
330 | return 1; |
331 | if (!tree_add_unmatched(curr, cache, NULL, node, tree)) |
332 | return 0; |
333 | /* Add it */ |
334 | } else { |
335 | /* If mapping: matched if one child per expected policy set */ |
336 | STACK_OF(ASN1_OBJECT) *expset = node->data->expected_policy_set; |
337 | if (node->nchild == sk_ASN1_OBJECT_num(expset)) |
338 | return 1; |
339 | /* Locate unmatched nodes */ |
340 | for (i = 0; i < sk_ASN1_OBJECT_num(expset); i++) { |
341 | ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(expset, i); |
342 | if (level_find_node(curr, node, oid)) |
343 | continue; |
344 | if (!tree_add_unmatched(curr, cache, oid, node, tree)) |
345 | return 0; |
346 | } |
347 | |
348 | } |
349 | return 1; |
350 | } |
351 | |
352 | /* |
353 | * Return value: 1 on success, 0 otherwise |
354 | */ |
355 | static int tree_link_any(X509_POLICY_LEVEL *curr, |
356 | const X509_POLICY_CACHE *cache, |
357 | X509_POLICY_TREE *tree) |
358 | { |
359 | int i; |
360 | X509_POLICY_NODE *node; |
361 | X509_POLICY_LEVEL *last = curr - 1; |
362 | |
363 | for (i = 0; i < sk_X509_POLICY_NODE_num(last->nodes); i++) { |
364 | node = sk_X509_POLICY_NODE_value(last->nodes, i); |
365 | |
366 | if (!tree_link_unmatched(curr, cache, node, tree)) |
367 | return 0; |
368 | } |
369 | /* Finally add link to anyPolicy */ |
370 | if (last->anyPolicy && |
371 | level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL) |
372 | return 0; |
373 | return 1; |
374 | } |
375 | |
376 | /*- |
377 | * Prune the tree: delete any child mapped child data on the current level then |
378 | * proceed up the tree deleting any data with no children. If we ever have no |
379 | * data on a level we can halt because the tree will be empty. |
380 | * |
381 | * Return value: <= 0 error, otherwise one of: |
382 | * |
383 | * X509_PCY_TREE_VALID: valid tree |
384 | * X509_PCY_TREE_EMPTY: empty tree |
385 | */ |
386 | static int tree_prune(X509_POLICY_TREE *tree, X509_POLICY_LEVEL *curr) |
387 | { |
388 | STACK_OF(X509_POLICY_NODE) *nodes; |
389 | X509_POLICY_NODE *node; |
390 | int i; |
391 | nodes = curr->nodes; |
392 | if (curr->flags & X509_V_FLAG_INHIBIT_MAP) { |
393 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { |
394 | node = sk_X509_POLICY_NODE_value(nodes, i); |
395 | /* Delete any mapped data: see RFC3280 XXXX */ |
396 | if (node->data->flags & POLICY_DATA_FLAG_MAP_MASK) { |
397 | node->parent->nchild--; |
398 | OPENSSL_free(node); |
399 | (void)sk_X509_POLICY_NODE_delete(nodes, i); |
400 | } |
401 | } |
402 | } |
403 | |
404 | for (;;) { |
405 | --curr; |
406 | nodes = curr->nodes; |
407 | for (i = sk_X509_POLICY_NODE_num(nodes) - 1; i >= 0; i--) { |
408 | node = sk_X509_POLICY_NODE_value(nodes, i); |
409 | if (node->nchild == 0) { |
410 | node->parent->nchild--; |
411 | OPENSSL_free(node); |
412 | (void)sk_X509_POLICY_NODE_delete(nodes, i); |
413 | } |
414 | } |
415 | if (curr->anyPolicy && !curr->anyPolicy->nchild) { |
416 | if (curr->anyPolicy->parent) |
417 | curr->anyPolicy->parent->nchild--; |
418 | OPENSSL_free(curr->anyPolicy); |
419 | curr->anyPolicy = NULL; |
420 | } |
421 | if (curr == tree->levels) { |
422 | /* If we zapped anyPolicy at top then tree is empty */ |
423 | if (!curr->anyPolicy) |
424 | return X509_PCY_TREE_EMPTY; |
425 | break; |
426 | } |
427 | } |
428 | return X509_PCY_TREE_VALID; |
429 | } |
430 | |
431 | /* |
432 | * Return value: 1 on success, 0 otherwise. |
433 | */ |
434 | static int tree_add_auth_node(STACK_OF(X509_POLICY_NODE) **pnodes, |
435 | X509_POLICY_NODE *pcy) |
436 | { |
437 | if (*pnodes == NULL && |
438 | (*pnodes = policy_node_cmp_new()) == NULL) |
439 | return 0; |
440 | if (sk_X509_POLICY_NODE_find(*pnodes, pcy) >= 0) |
441 | return 1; |
442 | return sk_X509_POLICY_NODE_push(*pnodes, pcy) != 0; |
443 | } |
444 | |
445 | #define TREE_CALC_FAILURE 0 |
446 | #define TREE_CALC_OK_NOFREE 1 |
447 | #define TREE_CALC_OK_DOFREE 2 |
448 | |
449 | /*- |
450 | * Calculate the authority set based on policy tree. The 'pnodes' parameter is |
451 | * used as a store for the set of policy nodes used to calculate the user set. |
452 | * If the authority set is not anyPolicy then pnodes will just point to the |
453 | * authority set. If however the authority set is anyPolicy then the set of |
454 | * valid policies (other than anyPolicy) is store in pnodes. |
455 | * |
456 | * Return value: |
457 | * TREE_CALC_FAILURE on failure, |
458 | * TREE_CALC_OK_NOFREE on success and pnodes need not be freed, |
459 | * TREE_CALC_OK_DOFREE on success and pnodes needs to be freed |
460 | */ |
461 | static int tree_calculate_authority_set(X509_POLICY_TREE *tree, |
462 | STACK_OF(X509_POLICY_NODE) **pnodes) |
463 | { |
464 | X509_POLICY_LEVEL *curr; |
465 | X509_POLICY_NODE *node, *anyptr; |
466 | STACK_OF(X509_POLICY_NODE) **addnodes; |
467 | int i, j; |
468 | curr = tree->levels + tree->nlevel - 1; |
469 | |
470 | /* If last level contains anyPolicy set is anyPolicy */ |
471 | if (curr->anyPolicy) { |
472 | if (!tree_add_auth_node(&tree->auth_policies, curr->anyPolicy)) |
473 | return TREE_CALC_FAILURE; |
474 | addnodes = pnodes; |
475 | } else |
476 | /* Add policies to authority set */ |
477 | addnodes = &tree->auth_policies; |
478 | |
479 | curr = tree->levels; |
480 | for (i = 1; i < tree->nlevel; i++) { |
481 | /* |
482 | * If no anyPolicy node on this this level it can't appear on lower |
483 | * levels so end search. |
484 | */ |
485 | if ((anyptr = curr->anyPolicy) == NULL) |
486 | break; |
487 | curr++; |
488 | for (j = 0; j < sk_X509_POLICY_NODE_num(curr->nodes); j++) { |
489 | node = sk_X509_POLICY_NODE_value(curr->nodes, j); |
490 | if ((node->parent == anyptr) |
491 | && !tree_add_auth_node(addnodes, node)) { |
492 | if (addnodes == pnodes) { |
493 | sk_X509_POLICY_NODE_free(*pnodes); |
494 | *pnodes = NULL; |
495 | } |
496 | return TREE_CALC_FAILURE; |
497 | } |
498 | } |
499 | } |
500 | if (addnodes == pnodes) |
501 | return TREE_CALC_OK_DOFREE; |
502 | |
503 | *pnodes = tree->auth_policies; |
504 | return TREE_CALC_OK_NOFREE; |
505 | } |
506 | |
507 | /* |
508 | * Return value: 1 on success, 0 otherwise. |
509 | */ |
510 | static int tree_calculate_user_set(X509_POLICY_TREE *tree, |
511 | STACK_OF(ASN1_OBJECT) *policy_oids, |
512 | STACK_OF(X509_POLICY_NODE) *auth_nodes) |
513 | { |
514 | int i; |
515 | X509_POLICY_NODE *node; |
516 | ASN1_OBJECT *oid; |
517 | X509_POLICY_NODE *anyPolicy; |
518 | X509_POLICY_DATA *; |
519 | |
520 | /* |
521 | * Check if anyPolicy present in authority constrained policy set: this |
522 | * will happen if it is a leaf node. |
523 | */ |
524 | if (sk_ASN1_OBJECT_num(policy_oids) <= 0) |
525 | return 1; |
526 | |
527 | anyPolicy = tree->levels[tree->nlevel - 1].anyPolicy; |
528 | |
529 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { |
530 | oid = sk_ASN1_OBJECT_value(policy_oids, i); |
531 | if (OBJ_obj2nid(oid) == NID_any_policy) { |
532 | tree->flags |= POLICY_FLAG_ANY_POLICY; |
533 | return 1; |
534 | } |
535 | } |
536 | |
537 | for (i = 0; i < sk_ASN1_OBJECT_num(policy_oids); i++) { |
538 | oid = sk_ASN1_OBJECT_value(policy_oids, i); |
539 | node = tree_find_sk(auth_nodes, oid); |
540 | if (!node) { |
541 | if (!anyPolicy) |
542 | continue; |
543 | /* |
544 | * Create a new node with policy ID from user set and qualifiers |
545 | * from anyPolicy. |
546 | */ |
547 | extra = policy_data_new(NULL, oid, node_critical(anyPolicy)); |
548 | if (extra == NULL) |
549 | return 0; |
550 | extra->qualifier_set = anyPolicy->data->qualifier_set; |
551 | extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS |
552 | | POLICY_DATA_FLAG_EXTRA_NODE; |
553 | node = level_add_node(NULL, extra, anyPolicy->parent, tree); |
554 | } |
555 | if (!tree->user_policies) { |
556 | tree->user_policies = sk_X509_POLICY_NODE_new_null(); |
557 | if (!tree->user_policies) |
558 | return 1; |
559 | } |
560 | if (!sk_X509_POLICY_NODE_push(tree->user_policies, node)) |
561 | return 0; |
562 | } |
563 | return 1; |
564 | } |
565 | |
566 | /*- |
567 | * Return value: <= 0 error, otherwise one of: |
568 | * X509_PCY_TREE_VALID: valid tree |
569 | * X509_PCY_TREE_EMPTY: empty tree |
570 | * (see tree_prune()). |
571 | */ |
572 | static int tree_evaluate(X509_POLICY_TREE *tree) |
573 | { |
574 | int ret, i; |
575 | X509_POLICY_LEVEL *curr = tree->levels + 1; |
576 | const X509_POLICY_CACHE *cache; |
577 | |
578 | for (i = 1; i < tree->nlevel; i++, curr++) { |
579 | cache = policy_cache_set(curr->cert); |
580 | if (!tree_link_nodes(curr, cache)) |
581 | return X509_PCY_TREE_INTERNAL; |
582 | |
583 | if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY) |
584 | && !tree_link_any(curr, cache, tree)) |
585 | return X509_PCY_TREE_INTERNAL; |
586 | TREE_PRINT("before tree_prune()" , tree, curr); |
587 | ret = tree_prune(tree, curr); |
588 | if (ret != X509_PCY_TREE_VALID) |
589 | return ret; |
590 | } |
591 | return X509_PCY_TREE_VALID; |
592 | } |
593 | |
594 | static void exnode_free(X509_POLICY_NODE *node) |
595 | { |
596 | if (node->data && (node->data->flags & POLICY_DATA_FLAG_EXTRA_NODE)) |
597 | OPENSSL_free(node); |
598 | } |
599 | |
600 | void X509_policy_tree_free(X509_POLICY_TREE *tree) |
601 | { |
602 | X509_POLICY_LEVEL *curr; |
603 | int i; |
604 | |
605 | if (!tree) |
606 | return; |
607 | |
608 | sk_X509_POLICY_NODE_free(tree->auth_policies); |
609 | sk_X509_POLICY_NODE_pop_free(tree->user_policies, exnode_free); |
610 | |
611 | for (i = 0, curr = tree->levels; i < tree->nlevel; i++, curr++) { |
612 | X509_free(curr->cert); |
613 | sk_X509_POLICY_NODE_pop_free(curr->nodes, policy_node_free); |
614 | policy_node_free(curr->anyPolicy); |
615 | } |
616 | |
617 | sk_X509_POLICY_DATA_pop_free(tree->extra_data, policy_data_free); |
618 | OPENSSL_free(tree->levels); |
619 | OPENSSL_free(tree); |
620 | |
621 | } |
622 | |
623 | /*- |
624 | * Application policy checking function. |
625 | * Return codes: |
626 | * X509_PCY_TREE_FAILURE: Failure to satisfy explicit policy |
627 | * X509_PCY_TREE_INVALID: Inconsistent or invalid extensions |
628 | * X509_PCY_TREE_INTERNAL: Internal error, most likely malloc |
629 | * X509_PCY_TREE_VALID: Success (null tree if empty or bare TA) |
630 | */ |
631 | int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy, |
632 | STACK_OF(X509) *certs, |
633 | STACK_OF(ASN1_OBJECT) *policy_oids, unsigned int flags) |
634 | { |
635 | int init_ret; |
636 | int ret; |
637 | int calc_ret; |
638 | X509_POLICY_TREE *tree = NULL; |
639 | STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL; |
640 | |
641 | *ptree = NULL; |
642 | *pexplicit_policy = 0; |
643 | init_ret = tree_init(&tree, certs, flags); |
644 | |
645 | if (init_ret <= 0) |
646 | return init_ret; |
647 | |
648 | if ((init_ret & X509_PCY_TREE_EXPLICIT) == 0) { |
649 | if (init_ret & X509_PCY_TREE_EMPTY) { |
650 | X509_policy_tree_free(tree); |
651 | return X509_PCY_TREE_VALID; |
652 | } |
653 | } else { |
654 | *pexplicit_policy = 1; |
655 | /* Tree empty and requireExplicit True: Error */ |
656 | if (init_ret & X509_PCY_TREE_EMPTY) |
657 | return X509_PCY_TREE_FAILURE; |
658 | } |
659 | |
660 | ret = tree_evaluate(tree); |
661 | TREE_PRINT("tree_evaluate()" , tree, NULL); |
662 | if (ret <= 0) |
663 | goto error; |
664 | |
665 | if (ret == X509_PCY_TREE_EMPTY) { |
666 | X509_policy_tree_free(tree); |
667 | if (init_ret & X509_PCY_TREE_EXPLICIT) |
668 | return X509_PCY_TREE_FAILURE; |
669 | return X509_PCY_TREE_VALID; |
670 | } |
671 | |
672 | /* Tree is not empty: continue */ |
673 | |
674 | if ((calc_ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0) |
675 | goto error; |
676 | ret = tree_calculate_user_set(tree, policy_oids, auth_nodes); |
677 | if (calc_ret == TREE_CALC_OK_DOFREE) |
678 | sk_X509_POLICY_NODE_free(auth_nodes); |
679 | if (!ret) |
680 | goto error; |
681 | |
682 | *ptree = tree; |
683 | |
684 | if (init_ret & X509_PCY_TREE_EXPLICIT) { |
685 | nodes = X509_policy_tree_get0_user_policies(tree); |
686 | if (sk_X509_POLICY_NODE_num(nodes) <= 0) |
687 | return X509_PCY_TREE_FAILURE; |
688 | } |
689 | return X509_PCY_TREE_VALID; |
690 | |
691 | error: |
692 | X509_policy_tree_free(tree); |
693 | return X509_PCY_TREE_INTERNAL; |
694 | } |
695 | |