1 | /* |
2 | * Copyright 1999-2017 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include "internal/cryptlib.h" |
12 | #include <openssl/conf.h> |
13 | #include <openssl/x509v3.h> |
14 | #include "ext_dat.h" |
15 | |
16 | static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, |
17 | X509V3_CTX *ctx, |
18 | STACK_OF(CONF_VALUE) *nval); |
19 | static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, |
20 | X509V3_CTX *ctx, |
21 | STACK_OF(CONF_VALUE) *nval); |
22 | static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p); |
23 | static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens); |
24 | static int do_othername(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx); |
25 | static int do_dirname(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx); |
26 | |
27 | const X509V3_EXT_METHOD v3_alt[3] = { |
28 | {NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), |
29 | 0, 0, 0, 0, |
30 | 0, 0, |
31 | (X509V3_EXT_I2V) i2v_GENERAL_NAMES, |
32 | (X509V3_EXT_V2I)v2i_subject_alt, |
33 | NULL, NULL, NULL}, |
34 | |
35 | {NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), |
36 | 0, 0, 0, 0, |
37 | 0, 0, |
38 | (X509V3_EXT_I2V) i2v_GENERAL_NAMES, |
39 | (X509V3_EXT_V2I)v2i_issuer_alt, |
40 | NULL, NULL, NULL}, |
41 | |
42 | {NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES), |
43 | 0, 0, 0, 0, |
44 | 0, 0, |
45 | (X509V3_EXT_I2V) i2v_GENERAL_NAMES, |
46 | NULL, NULL, NULL, NULL}, |
47 | }; |
48 | |
49 | STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, |
50 | GENERAL_NAMES *gens, |
51 | STACK_OF(CONF_VALUE) *ret) |
52 | { |
53 | int i; |
54 | GENERAL_NAME *gen; |
55 | STACK_OF(CONF_VALUE) *tmpret = NULL, *origret = ret; |
56 | |
57 | for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { |
58 | gen = sk_GENERAL_NAME_value(gens, i); |
59 | /* |
60 | * i2v_GENERAL_NAME allocates ret if it is NULL. If something goes |
61 | * wrong we need to free the stack - but only if it was empty when we |
62 | * originally entered this function. |
63 | */ |
64 | tmpret = i2v_GENERAL_NAME(method, gen, ret); |
65 | if (tmpret == NULL) { |
66 | if (origret == NULL) |
67 | sk_CONF_VALUE_pop_free(ret, X509V3_conf_free); |
68 | return NULL; |
69 | } |
70 | ret = tmpret; |
71 | } |
72 | if (ret == NULL) |
73 | return sk_CONF_VALUE_new_null(); |
74 | return ret; |
75 | } |
76 | |
77 | STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, |
78 | GENERAL_NAME *gen, |
79 | STACK_OF(CONF_VALUE) *ret) |
80 | { |
81 | unsigned char *p; |
82 | char oline[256], htmp[5]; |
83 | int i; |
84 | |
85 | switch (gen->type) { |
86 | case GEN_OTHERNAME: |
87 | switch (OBJ_obj2nid(gen->d.otherName->type_id)) { |
88 | case NID_id_on_SmtpUTF8Mailbox: |
89 | if (gen->d.otherName->value->type != V_ASN1_UTF8STRING |
90 | || !X509V3_add_value_uchar("othername: SmtpUTF8Mailbox:" , |
91 | gen->d.otherName->value->value.utf8string->data, |
92 | &ret)) |
93 | return NULL; |
94 | break; |
95 | case NID_XmppAddr: |
96 | if (gen->d.otherName->value->type != V_ASN1_UTF8STRING |
97 | || !X509V3_add_value_uchar("othername: XmppAddr:" , |
98 | gen->d.otherName->value->value.utf8string->data, |
99 | &ret)) |
100 | return NULL; |
101 | break; |
102 | case NID_SRVName: |
103 | if (gen->d.otherName->value->type != V_ASN1_IA5STRING |
104 | || !X509V3_add_value_uchar("othername: SRVName:" , |
105 | gen->d.otherName->value->value.ia5string->data, |
106 | &ret)) |
107 | return NULL; |
108 | break; |
109 | case NID_ms_upn: |
110 | if (gen->d.otherName->value->type != V_ASN1_UTF8STRING |
111 | || !X509V3_add_value_uchar("othername: UPN:" , |
112 | gen->d.otherName->value->value.utf8string->data, |
113 | &ret)) |
114 | return NULL; |
115 | break; |
116 | case NID_NAIRealm: |
117 | if (gen->d.otherName->value->type != V_ASN1_UTF8STRING |
118 | || !X509V3_add_value_uchar("othername: NAIRealm:" , |
119 | gen->d.otherName->value->value.utf8string->data, |
120 | &ret)) |
121 | return NULL; |
122 | break; |
123 | default: |
124 | if (!X509V3_add_value("othername" , "<unsupported>" , &ret)) |
125 | return NULL; |
126 | break; |
127 | } |
128 | break; |
129 | |
130 | case GEN_X400: |
131 | if (!X509V3_add_value("X400Name" , "<unsupported>" , &ret)) |
132 | return NULL; |
133 | break; |
134 | |
135 | case GEN_EDIPARTY: |
136 | if (!X509V3_add_value("EdiPartyName" , "<unsupported>" , &ret)) |
137 | return NULL; |
138 | break; |
139 | |
140 | case GEN_EMAIL: |
141 | if (!X509V3_add_value_uchar("email" , gen->d.ia5->data, &ret)) |
142 | return NULL; |
143 | break; |
144 | |
145 | case GEN_DNS: |
146 | if (!X509V3_add_value_uchar("DNS" , gen->d.ia5->data, &ret)) |
147 | return NULL; |
148 | break; |
149 | |
150 | case GEN_URI: |
151 | if (!X509V3_add_value_uchar("URI" , gen->d.ia5->data, &ret)) |
152 | return NULL; |
153 | break; |
154 | |
155 | case GEN_DIRNAME: |
156 | if (X509_NAME_oneline(gen->d.dirn, oline, sizeof(oline)) == NULL |
157 | || !X509V3_add_value("DirName" , oline, &ret)) |
158 | return NULL; |
159 | break; |
160 | |
161 | case GEN_IPADD: |
162 | p = gen->d.ip->data; |
163 | if (gen->d.ip->length == 4) |
164 | BIO_snprintf(oline, sizeof(oline), "%d.%d.%d.%d" , |
165 | p[0], p[1], p[2], p[3]); |
166 | else if (gen->d.ip->length == 16) { |
167 | oline[0] = 0; |
168 | for (i = 0; i < 8; i++) { |
169 | BIO_snprintf(htmp, sizeof(htmp), "%X" , p[0] << 8 | p[1]); |
170 | p += 2; |
171 | strcat(oline, htmp); |
172 | if (i != 7) |
173 | strcat(oline, ":" ); |
174 | } |
175 | } else { |
176 | if (!X509V3_add_value("IP Address" , "<invalid>" , &ret)) |
177 | return NULL; |
178 | break; |
179 | } |
180 | if (!X509V3_add_value("IP Address" , oline, &ret)) |
181 | return NULL; |
182 | break; |
183 | |
184 | case GEN_RID: |
185 | i2t_ASN1_OBJECT(oline, 256, gen->d.rid); |
186 | if (!X509V3_add_value("Registered ID" , oline, &ret)) |
187 | return NULL; |
188 | break; |
189 | } |
190 | return ret; |
191 | } |
192 | |
193 | int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen) |
194 | { |
195 | unsigned char *p; |
196 | int i, nid; |
197 | |
198 | switch (gen->type) { |
199 | case GEN_OTHERNAME: |
200 | nid = OBJ_obj2nid(gen->d.otherName->type_id); |
201 | /* Validate the types are as we expect before we use them */ |
202 | if ((nid == NID_SRVName |
203 | && gen->d.otherName->value->type != V_ASN1_IA5STRING) |
204 | || (nid != NID_SRVName |
205 | && gen->d.otherName->value->type != V_ASN1_UTF8STRING)) { |
206 | BIO_printf(out, "othername:<unsupported>" ); |
207 | break; |
208 | } |
209 | |
210 | switch (nid) { |
211 | case NID_id_on_SmtpUTF8Mailbox: |
212 | BIO_printf(out, "othername:SmtpUTF8Mailbox:%s" , |
213 | gen->d.otherName->value->value.utf8string->data); |
214 | break; |
215 | case NID_XmppAddr: |
216 | BIO_printf(out, "othername:XmppAddr:%s" , |
217 | gen->d.otherName->value->value.utf8string->data); |
218 | break; |
219 | case NID_SRVName: |
220 | BIO_printf(out, "othername:SRVName:%s" , |
221 | gen->d.otherName->value->value.ia5string->data); |
222 | break; |
223 | case NID_ms_upn: |
224 | BIO_printf(out, "othername:UPN:%s" , |
225 | gen->d.otherName->value->value.utf8string->data); |
226 | break; |
227 | case NID_NAIRealm: |
228 | BIO_printf(out, "othername:NAIRealm:%s" , |
229 | gen->d.otherName->value->value.utf8string->data); |
230 | break; |
231 | default: |
232 | BIO_printf(out, "othername:<unsupported>" ); |
233 | break; |
234 | } |
235 | break; |
236 | |
237 | case GEN_X400: |
238 | BIO_printf(out, "X400Name:<unsupported>" ); |
239 | break; |
240 | |
241 | case GEN_EDIPARTY: |
242 | /* Maybe fix this: it is supported now */ |
243 | BIO_printf(out, "EdiPartyName:<unsupported>" ); |
244 | break; |
245 | |
246 | case GEN_EMAIL: |
247 | BIO_printf(out, "email:" ); |
248 | ASN1_STRING_print(out, gen->d.ia5); |
249 | break; |
250 | |
251 | case GEN_DNS: |
252 | BIO_printf(out, "DNS:" ); |
253 | ASN1_STRING_print(out, gen->d.ia5); |
254 | break; |
255 | |
256 | case GEN_URI: |
257 | BIO_printf(out, "URI:" ); |
258 | ASN1_STRING_print(out, gen->d.ia5); |
259 | break; |
260 | |
261 | case GEN_DIRNAME: |
262 | BIO_printf(out, "DirName:" ); |
263 | X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE); |
264 | break; |
265 | |
266 | case GEN_IPADD: |
267 | p = gen->d.ip->data; |
268 | if (gen->d.ip->length == 4) |
269 | BIO_printf(out, "IP Address:%d.%d.%d.%d" , p[0], p[1], p[2], p[3]); |
270 | else if (gen->d.ip->length == 16) { |
271 | BIO_printf(out, "IP Address" ); |
272 | for (i = 0; i < 8; i++) { |
273 | BIO_printf(out, ":%X" , p[0] << 8 | p[1]); |
274 | p += 2; |
275 | } |
276 | } else { |
277 | BIO_printf(out, "IP Address:<invalid>" ); |
278 | break; |
279 | } |
280 | break; |
281 | |
282 | case GEN_RID: |
283 | BIO_printf(out, "Registered ID:" ); |
284 | i2a_ASN1_OBJECT(out, gen->d.rid); |
285 | break; |
286 | } |
287 | return 1; |
288 | } |
289 | |
290 | static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, |
291 | X509V3_CTX *ctx, |
292 | STACK_OF(CONF_VALUE) *nval) |
293 | { |
294 | const int num = sk_CONF_VALUE_num(nval); |
295 | GENERAL_NAMES *gens = sk_GENERAL_NAME_new_reserve(NULL, num); |
296 | int i; |
297 | |
298 | if (gens == NULL) { |
299 | X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE); |
300 | sk_GENERAL_NAME_free(gens); |
301 | return NULL; |
302 | } |
303 | for (i = 0; i < num; i++) { |
304 | CONF_VALUE *cnf = sk_CONF_VALUE_value(nval, i); |
305 | |
306 | if (!v3_name_cmp(cnf->name, "issuer" ) |
307 | && cnf->value && strcmp(cnf->value, "copy" ) == 0) { |
308 | if (!copy_issuer(ctx, gens)) |
309 | goto err; |
310 | } else { |
311 | GENERAL_NAME *gen = v2i_GENERAL_NAME(method, ctx, cnf); |
312 | |
313 | if (gen == NULL) |
314 | goto err; |
315 | sk_GENERAL_NAME_push(gens, gen); /* no failure as it was reserved */ |
316 | } |
317 | } |
318 | return gens; |
319 | err: |
320 | sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); |
321 | return NULL; |
322 | } |
323 | |
324 | /* Append subject altname of issuer to issuer alt name of subject */ |
325 | |
326 | static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens) |
327 | { |
328 | GENERAL_NAMES *ialt; |
329 | GENERAL_NAME *gen; |
330 | X509_EXTENSION *ext; |
331 | int i, num; |
332 | |
333 | if (ctx && (ctx->flags == CTX_TEST)) |
334 | return 1; |
335 | if (!ctx || !ctx->issuer_cert) { |
336 | X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS); |
337 | goto err; |
338 | } |
339 | i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1); |
340 | if (i < 0) |
341 | return 1; |
342 | if ((ext = X509_get_ext(ctx->issuer_cert, i)) == NULL |
343 | || (ialt = X509V3_EXT_d2i(ext)) == NULL) { |
344 | X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR); |
345 | goto err; |
346 | } |
347 | |
348 | num = sk_GENERAL_NAME_num(ialt); |
349 | if (!sk_GENERAL_NAME_reserve(gens, num)) { |
350 | X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE); |
351 | goto err; |
352 | } |
353 | |
354 | for (i = 0; i < num; i++) { |
355 | gen = sk_GENERAL_NAME_value(ialt, i); |
356 | sk_GENERAL_NAME_push(gens, gen); /* no failure as it was reserved */ |
357 | } |
358 | sk_GENERAL_NAME_free(ialt); |
359 | |
360 | return 1; |
361 | |
362 | err: |
363 | return 0; |
364 | |
365 | } |
366 | |
367 | static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, |
368 | X509V3_CTX *ctx, |
369 | STACK_OF(CONF_VALUE) *nval) |
370 | { |
371 | GENERAL_NAMES *gens; |
372 | CONF_VALUE *cnf; |
373 | const int num = sk_CONF_VALUE_num(nval); |
374 | int i; |
375 | |
376 | gens = sk_GENERAL_NAME_new_reserve(NULL, num); |
377 | if (gens == NULL) { |
378 | X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE); |
379 | sk_GENERAL_NAME_free(gens); |
380 | return NULL; |
381 | } |
382 | |
383 | for (i = 0; i < num; i++) { |
384 | cnf = sk_CONF_VALUE_value(nval, i); |
385 | if (!v3_name_cmp(cnf->name, "email" ) |
386 | && cnf->value && strcmp(cnf->value, "copy" ) == 0) { |
387 | if (!copy_email(ctx, gens, 0)) |
388 | goto err; |
389 | } else if (!v3_name_cmp(cnf->name, "email" ) |
390 | && cnf->value && strcmp(cnf->value, "move" ) == 0) { |
391 | if (!copy_email(ctx, gens, 1)) |
392 | goto err; |
393 | } else { |
394 | GENERAL_NAME *gen; |
395 | if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL) |
396 | goto err; |
397 | sk_GENERAL_NAME_push(gens, gen); /* no failure as it was reserved */ |
398 | } |
399 | } |
400 | return gens; |
401 | err: |
402 | sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); |
403 | return NULL; |
404 | } |
405 | |
406 | /* |
407 | * Copy any email addresses in a certificate or request to GENERAL_NAMES |
408 | */ |
409 | |
410 | static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p) |
411 | { |
412 | X509_NAME *nm; |
413 | ASN1_IA5STRING *email = NULL; |
414 | X509_NAME_ENTRY *ne; |
415 | GENERAL_NAME *gen = NULL; |
416 | int i = -1; |
417 | |
418 | if (ctx != NULL && ctx->flags == CTX_TEST) |
419 | return 1; |
420 | if (ctx == NULL |
421 | || (ctx->subject_cert == NULL && ctx->subject_req == NULL)) { |
422 | X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS); |
423 | goto err; |
424 | } |
425 | /* Find the subject name */ |
426 | if (ctx->subject_cert) |
427 | nm = X509_get_subject_name(ctx->subject_cert); |
428 | else |
429 | nm = X509_REQ_get_subject_name(ctx->subject_req); |
430 | |
431 | /* Now add any email address(es) to STACK */ |
432 | while ((i = X509_NAME_get_index_by_NID(nm, |
433 | NID_pkcs9_emailAddress, i)) >= 0) { |
434 | ne = X509_NAME_get_entry(nm, i); |
435 | email = ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne)); |
436 | if (move_p) { |
437 | X509_NAME_delete_entry(nm, i); |
438 | X509_NAME_ENTRY_free(ne); |
439 | i--; |
440 | } |
441 | if (email == NULL || (gen = GENERAL_NAME_new()) == NULL) { |
442 | X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE); |
443 | goto err; |
444 | } |
445 | gen->d.ia5 = email; |
446 | email = NULL; |
447 | gen->type = GEN_EMAIL; |
448 | if (!sk_GENERAL_NAME_push(gens, gen)) { |
449 | X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE); |
450 | goto err; |
451 | } |
452 | gen = NULL; |
453 | } |
454 | |
455 | return 1; |
456 | |
457 | err: |
458 | GENERAL_NAME_free(gen); |
459 | ASN1_IA5STRING_free(email); |
460 | return 0; |
461 | |
462 | } |
463 | |
464 | GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, |
465 | X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) |
466 | { |
467 | GENERAL_NAME *gen; |
468 | GENERAL_NAMES *gens; |
469 | CONF_VALUE *cnf; |
470 | const int num = sk_CONF_VALUE_num(nval); |
471 | int i; |
472 | |
473 | gens = sk_GENERAL_NAME_new_reserve(NULL, num); |
474 | if (gens == NULL) { |
475 | X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE); |
476 | sk_GENERAL_NAME_free(gens); |
477 | return NULL; |
478 | } |
479 | |
480 | for (i = 0; i < num; i++) { |
481 | cnf = sk_CONF_VALUE_value(nval, i); |
482 | if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL) |
483 | goto err; |
484 | sk_GENERAL_NAME_push(gens, gen); /* no failure as it was reserved */ |
485 | } |
486 | return gens; |
487 | err: |
488 | sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); |
489 | return NULL; |
490 | } |
491 | |
492 | GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, |
493 | X509V3_CTX *ctx, CONF_VALUE *cnf) |
494 | { |
495 | return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0); |
496 | } |
497 | |
498 | GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out, |
499 | const X509V3_EXT_METHOD *method, |
500 | X509V3_CTX *ctx, int gen_type, const char *value, |
501 | int is_nc) |
502 | { |
503 | char is_string = 0; |
504 | GENERAL_NAME *gen = NULL; |
505 | |
506 | if (!value) { |
507 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE); |
508 | return NULL; |
509 | } |
510 | |
511 | if (out) |
512 | gen = out; |
513 | else { |
514 | gen = GENERAL_NAME_new(); |
515 | if (gen == NULL) { |
516 | X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE); |
517 | return NULL; |
518 | } |
519 | } |
520 | |
521 | switch (gen_type) { |
522 | case GEN_URI: |
523 | case GEN_EMAIL: |
524 | case GEN_DNS: |
525 | is_string = 1; |
526 | break; |
527 | |
528 | case GEN_RID: |
529 | { |
530 | ASN1_OBJECT *obj; |
531 | if ((obj = OBJ_txt2obj(value, 0)) == NULL) { |
532 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_OBJECT); |
533 | ERR_add_error_data(2, "value=" , value); |
534 | goto err; |
535 | } |
536 | gen->d.rid = obj; |
537 | } |
538 | break; |
539 | |
540 | case GEN_IPADD: |
541 | if (is_nc) |
542 | gen->d.ip = a2i_IPADDRESS_NC(value); |
543 | else |
544 | gen->d.ip = a2i_IPADDRESS(value); |
545 | if (gen->d.ip == NULL) { |
546 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_IP_ADDRESS); |
547 | ERR_add_error_data(2, "value=" , value); |
548 | goto err; |
549 | } |
550 | break; |
551 | |
552 | case GEN_DIRNAME: |
553 | if (!do_dirname(gen, value, ctx)) { |
554 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_DIRNAME_ERROR); |
555 | goto err; |
556 | } |
557 | break; |
558 | |
559 | case GEN_OTHERNAME: |
560 | if (!do_othername(gen, value, ctx)) { |
561 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_OTHERNAME_ERROR); |
562 | goto err; |
563 | } |
564 | break; |
565 | default: |
566 | X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE); |
567 | goto err; |
568 | } |
569 | |
570 | if (is_string) { |
571 | if ((gen->d.ia5 = ASN1_IA5STRING_new()) == NULL || |
572 | !ASN1_STRING_set(gen->d.ia5, (unsigned char *)value, |
573 | strlen(value))) { |
574 | X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE); |
575 | goto err; |
576 | } |
577 | } |
578 | |
579 | gen->type = gen_type; |
580 | |
581 | return gen; |
582 | |
583 | err: |
584 | if (!out) |
585 | GENERAL_NAME_free(gen); |
586 | return NULL; |
587 | } |
588 | |
589 | GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, |
590 | const X509V3_EXT_METHOD *method, |
591 | X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc) |
592 | { |
593 | int type; |
594 | |
595 | char *name, *value; |
596 | |
597 | name = cnf->name; |
598 | value = cnf->value; |
599 | |
600 | if (!value) { |
601 | X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE); |
602 | return NULL; |
603 | } |
604 | |
605 | if (!v3_name_cmp(name, "email" )) |
606 | type = GEN_EMAIL; |
607 | else if (!v3_name_cmp(name, "URI" )) |
608 | type = GEN_URI; |
609 | else if (!v3_name_cmp(name, "DNS" )) |
610 | type = GEN_DNS; |
611 | else if (!v3_name_cmp(name, "RID" )) |
612 | type = GEN_RID; |
613 | else if (!v3_name_cmp(name, "IP" )) |
614 | type = GEN_IPADD; |
615 | else if (!v3_name_cmp(name, "dirName" )) |
616 | type = GEN_DIRNAME; |
617 | else if (!v3_name_cmp(name, "otherName" )) |
618 | type = GEN_OTHERNAME; |
619 | else { |
620 | X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION); |
621 | ERR_add_error_data(2, "name=" , name); |
622 | return NULL; |
623 | } |
624 | |
625 | return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc); |
626 | |
627 | } |
628 | |
629 | static int do_othername(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx) |
630 | { |
631 | char *objtmp = NULL, *p; |
632 | int objlen; |
633 | |
634 | if ((p = strchr(value, ';')) == NULL) |
635 | return 0; |
636 | if ((gen->d.otherName = OTHERNAME_new()) == NULL) |
637 | return 0; |
638 | /* |
639 | * Free this up because we will overwrite it. no need to free type_id |
640 | * because it is static |
641 | */ |
642 | ASN1_TYPE_free(gen->d.otherName->value); |
643 | if ((gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)) == NULL) |
644 | return 0; |
645 | objlen = p - value; |
646 | objtmp = OPENSSL_strndup(value, objlen); |
647 | if (objtmp == NULL) |
648 | return 0; |
649 | gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0); |
650 | OPENSSL_free(objtmp); |
651 | if (!gen->d.otherName->type_id) |
652 | return 0; |
653 | return 1; |
654 | } |
655 | |
656 | static int do_dirname(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx) |
657 | { |
658 | int ret = 0; |
659 | STACK_OF(CONF_VALUE) *sk = NULL; |
660 | X509_NAME *nm; |
661 | |
662 | if ((nm = X509_NAME_new()) == NULL) |
663 | goto err; |
664 | sk = X509V3_get_section(ctx, value); |
665 | if (!sk) { |
666 | X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND); |
667 | ERR_add_error_data(2, "section=" , value); |
668 | goto err; |
669 | } |
670 | /* FIXME: should allow other character types... */ |
671 | ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC); |
672 | if (!ret) |
673 | goto err; |
674 | gen->d.dirn = nm; |
675 | |
676 | err: |
677 | if (ret == 0) |
678 | X509_NAME_free(nm); |
679 | X509V3_section_free(ctx, sk); |
680 | return ret; |
681 | } |
682 | |