1 | /* |
2 | * Copyright 2003-2018 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include "internal/cryptlib.h" |
11 | #include "internal/numbers.h" |
12 | #include <stdio.h> |
13 | #include "crypto/asn1.h" |
14 | #include <openssl/asn1t.h> |
15 | #include <openssl/conf.h> |
16 | #include <openssl/x509v3.h> |
17 | #include <openssl/bn.h> |
18 | |
19 | #include "crypto/x509.h" |
20 | #include "ext_dat.h" |
21 | |
22 | static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, |
23 | X509V3_CTX *ctx, |
24 | STACK_OF(CONF_VALUE) *nval); |
25 | static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a, |
26 | BIO *bp, int ind); |
27 | static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method, |
28 | STACK_OF(GENERAL_SUBTREE) *trees, BIO *bp, |
29 | int ind, const char *name); |
30 | static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip); |
31 | |
32 | static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc); |
33 | static int nc_match_single(GENERAL_NAME *sub, GENERAL_NAME *gen); |
34 | static int nc_dn(X509_NAME *sub, X509_NAME *nm); |
35 | static int nc_dns(ASN1_IA5STRING *sub, ASN1_IA5STRING *dns); |
36 | static int nc_email(ASN1_IA5STRING *sub, ASN1_IA5STRING *eml); |
37 | static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base); |
38 | static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base); |
39 | |
40 | const X509V3_EXT_METHOD v3_name_constraints = { |
41 | NID_name_constraints, 0, |
42 | ASN1_ITEM_ref(NAME_CONSTRAINTS), |
43 | 0, 0, 0, 0, |
44 | 0, 0, |
45 | 0, v2i_NAME_CONSTRAINTS, |
46 | i2r_NAME_CONSTRAINTS, 0, |
47 | NULL |
48 | }; |
49 | |
50 | ASN1_SEQUENCE(GENERAL_SUBTREE) = { |
51 | ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME), |
52 | ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0), |
53 | ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1) |
54 | } ASN1_SEQUENCE_END(GENERAL_SUBTREE) |
55 | |
56 | ASN1_SEQUENCE(NAME_CONSTRAINTS) = { |
57 | ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees, |
58 | GENERAL_SUBTREE, 0), |
59 | ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees, |
60 | GENERAL_SUBTREE, 1), |
61 | } ASN1_SEQUENCE_END(NAME_CONSTRAINTS) |
62 | |
63 | |
64 | IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE) |
65 | IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS) |
66 | |
67 | /* |
68 | * We cannot use strncasecmp here because that applies locale specific rules. |
69 | * For example in Turkish 'I' is not the uppercase character for 'i'. We need to |
70 | * do a simple ASCII case comparison ignoring the locale (that is why we use |
71 | * numeric constants below). |
72 | */ |
73 | static int ia5ncasecmp(const char *s1, const char *s2, size_t n) |
74 | { |
75 | for (; n > 0; n--, s1++, s2++) { |
76 | if (*s1 != *s2) { |
77 | unsigned char c1 = (unsigned char)*s1, c2 = (unsigned char)*s2; |
78 | |
79 | /* Convert to lower case */ |
80 | if (c1 >= 0x41 /* A */ && c1 <= 0x5A /* Z */) |
81 | c1 += 0x20; |
82 | if (c2 >= 0x41 /* A */ && c2 <= 0x5A /* Z */) |
83 | c2 += 0x20; |
84 | |
85 | if (c1 == c2) |
86 | continue; |
87 | |
88 | if (c1 < c2) |
89 | return -1; |
90 | |
91 | /* c1 > c2 */ |
92 | return 1; |
93 | } else if (*s1 == 0) { |
94 | /* If we get here we know that *s2 == 0 too */ |
95 | return 0; |
96 | } |
97 | } |
98 | |
99 | return 0; |
100 | } |
101 | |
102 | static int ia5casecmp(const char *s1, const char *s2) |
103 | { |
104 | return ia5ncasecmp(s1, s2, SIZE_MAX); |
105 | } |
106 | |
107 | static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, |
108 | X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) |
109 | { |
110 | int i; |
111 | CONF_VALUE tval, *val; |
112 | STACK_OF(GENERAL_SUBTREE) **ptree = NULL; |
113 | NAME_CONSTRAINTS *ncons = NULL; |
114 | GENERAL_SUBTREE *sub = NULL; |
115 | |
116 | ncons = NAME_CONSTRAINTS_new(); |
117 | if (ncons == NULL) |
118 | goto memerr; |
119 | for (i = 0; i < sk_CONF_VALUE_num(nval); i++) { |
120 | val = sk_CONF_VALUE_value(nval, i); |
121 | if (strncmp(val->name, "permitted" , 9) == 0 && val->name[9]) { |
122 | ptree = &ncons->permittedSubtrees; |
123 | tval.name = val->name + 10; |
124 | } else if (strncmp(val->name, "excluded" , 8) == 0 && val->name[8]) { |
125 | ptree = &ncons->excludedSubtrees; |
126 | tval.name = val->name + 9; |
127 | } else { |
128 | X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, X509V3_R_INVALID_SYNTAX); |
129 | goto err; |
130 | } |
131 | tval.value = val->value; |
132 | sub = GENERAL_SUBTREE_new(); |
133 | if (sub == NULL) |
134 | goto memerr; |
135 | if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1)) |
136 | goto err; |
137 | if (*ptree == NULL) |
138 | *ptree = sk_GENERAL_SUBTREE_new_null(); |
139 | if (*ptree == NULL || !sk_GENERAL_SUBTREE_push(*ptree, sub)) |
140 | goto memerr; |
141 | sub = NULL; |
142 | } |
143 | |
144 | return ncons; |
145 | |
146 | memerr: |
147 | X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE); |
148 | err: |
149 | NAME_CONSTRAINTS_free(ncons); |
150 | GENERAL_SUBTREE_free(sub); |
151 | |
152 | return NULL; |
153 | } |
154 | |
155 | static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a, |
156 | BIO *bp, int ind) |
157 | { |
158 | NAME_CONSTRAINTS *ncons = a; |
159 | do_i2r_name_constraints(method, ncons->permittedSubtrees, |
160 | bp, ind, "Permitted" ); |
161 | if (ncons->permittedSubtrees && ncons->excludedSubtrees) |
162 | BIO_puts(bp, "\n" ); |
163 | do_i2r_name_constraints(method, ncons->excludedSubtrees, |
164 | bp, ind, "Excluded" ); |
165 | return 1; |
166 | } |
167 | |
168 | static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method, |
169 | STACK_OF(GENERAL_SUBTREE) *trees, |
170 | BIO *bp, int ind, const char *name) |
171 | { |
172 | GENERAL_SUBTREE *tree; |
173 | int i; |
174 | if (sk_GENERAL_SUBTREE_num(trees) > 0) |
175 | BIO_printf(bp, "%*s%s:\n" , ind, "" , name); |
176 | for (i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) { |
177 | if (i > 0) |
178 | BIO_puts(bp, "\n" ); |
179 | tree = sk_GENERAL_SUBTREE_value(trees, i); |
180 | BIO_printf(bp, "%*s" , ind + 2, "" ); |
181 | if (tree->base->type == GEN_IPADD) |
182 | print_nc_ipadd(bp, tree->base->d.ip); |
183 | else |
184 | GENERAL_NAME_print(bp, tree->base); |
185 | } |
186 | return 1; |
187 | } |
188 | |
189 | static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip) |
190 | { |
191 | int i, len; |
192 | unsigned char *p; |
193 | p = ip->data; |
194 | len = ip->length; |
195 | BIO_puts(bp, "IP:" ); |
196 | if (len == 8) { |
197 | BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d" , |
198 | p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]); |
199 | } else if (len == 32) { |
200 | for (i = 0; i < 16; i++) { |
201 | BIO_printf(bp, "%X" , p[0] << 8 | p[1]); |
202 | p += 2; |
203 | if (i == 7) |
204 | BIO_puts(bp, "/" ); |
205 | else if (i != 15) |
206 | BIO_puts(bp, ":" ); |
207 | } |
208 | } else |
209 | BIO_printf(bp, "IP Address:<invalid>" ); |
210 | return 1; |
211 | } |
212 | |
213 | #define NAME_CHECK_MAX (1 << 20) |
214 | |
215 | static int add_lengths(int *out, int a, int b) |
216 | { |
217 | /* sk_FOO_num(NULL) returns -1 but is effectively 0 when iterating. */ |
218 | if (a < 0) |
219 | a = 0; |
220 | if (b < 0) |
221 | b = 0; |
222 | |
223 | if (a > INT_MAX - b) |
224 | return 0; |
225 | *out = a + b; |
226 | return 1; |
227 | } |
228 | |
229 | /*- |
230 | * Check a certificate conforms to a specified set of constraints. |
231 | * Return values: |
232 | * X509_V_OK: All constraints obeyed. |
233 | * X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation. |
234 | * X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation. |
235 | * X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type. |
236 | * X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: Unsupported constraint type. |
237 | * X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax. |
238 | * X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name |
239 | */ |
240 | |
241 | int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc) |
242 | { |
243 | int r, i, name_count, constraint_count; |
244 | X509_NAME *nm; |
245 | |
246 | nm = X509_get_subject_name(x); |
247 | |
248 | /* |
249 | * Guard against certificates with an excessive number of names or |
250 | * constraints causing a computationally expensive name constraints check. |
251 | */ |
252 | if (!add_lengths(&name_count, X509_NAME_entry_count(nm), |
253 | sk_GENERAL_NAME_num(x->altname)) |
254 | || !add_lengths(&constraint_count, |
255 | sk_GENERAL_SUBTREE_num(nc->permittedSubtrees), |
256 | sk_GENERAL_SUBTREE_num(nc->excludedSubtrees)) |
257 | || (name_count > 0 && constraint_count > NAME_CHECK_MAX / name_count)) |
258 | return X509_V_ERR_UNSPECIFIED; |
259 | |
260 | if (X509_NAME_entry_count(nm) > 0) { |
261 | GENERAL_NAME gntmp; |
262 | gntmp.type = GEN_DIRNAME; |
263 | gntmp.d.directoryName = nm; |
264 | |
265 | r = nc_match(&gntmp, nc); |
266 | |
267 | if (r != X509_V_OK) |
268 | return r; |
269 | |
270 | gntmp.type = GEN_EMAIL; |
271 | |
272 | /* Process any email address attributes in subject name */ |
273 | |
274 | for (i = -1;;) { |
275 | const X509_NAME_ENTRY *ne; |
276 | |
277 | i = X509_NAME_get_index_by_NID(nm, NID_pkcs9_emailAddress, i); |
278 | if (i == -1) |
279 | break; |
280 | ne = X509_NAME_get_entry(nm, i); |
281 | gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne); |
282 | if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING) |
283 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
284 | |
285 | r = nc_match(&gntmp, nc); |
286 | |
287 | if (r != X509_V_OK) |
288 | return r; |
289 | } |
290 | |
291 | } |
292 | |
293 | for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++) { |
294 | GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i); |
295 | r = nc_match(gen, nc); |
296 | if (r != X509_V_OK) |
297 | return r; |
298 | } |
299 | |
300 | return X509_V_OK; |
301 | |
302 | } |
303 | |
304 | static int cn2dnsid(ASN1_STRING *cn, unsigned char **dnsid, size_t *idlen) |
305 | { |
306 | int utf8_length; |
307 | unsigned char *utf8_value; |
308 | int i; |
309 | int isdnsname = 0; |
310 | |
311 | /* Don't leave outputs uninitialized */ |
312 | *dnsid = NULL; |
313 | *idlen = 0; |
314 | |
315 | /*- |
316 | * Per RFC 6125, DNS-IDs representing internationalized domain names appear |
317 | * in certificates in A-label encoded form: |
318 | * |
319 | * https://tools.ietf.org/html/rfc6125#section-6.4.2 |
320 | * |
321 | * The same applies to CNs which are intended to represent DNS names. |
322 | * However, while in the SAN DNS-IDs are IA5Strings, as CNs they may be |
323 | * needlessly encoded in 16-bit Unicode. We perform a conversion to UTF-8 |
324 | * to ensure that we get an ASCII representation of any CNs that are |
325 | * representable as ASCII, but just not encoded as ASCII. The UTF-8 form |
326 | * may contain some non-ASCII octets, and that's fine, such CNs are not |
327 | * valid legacy DNS names. |
328 | * |
329 | * Note, 'int' is the return type of ASN1_STRING_to_UTF8() so that's what |
330 | * we must use for 'utf8_length'. |
331 | */ |
332 | if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0) |
333 | return X509_V_ERR_OUT_OF_MEM; |
334 | |
335 | /* |
336 | * Some certificates have had names that include a *trailing* NUL byte. |
337 | * Remove these harmless NUL characters. They would otherwise yield false |
338 | * alarms with the following embedded NUL check. |
339 | */ |
340 | while (utf8_length > 0 && utf8_value[utf8_length - 1] == '\0') |
341 | --utf8_length; |
342 | |
343 | /* Reject *embedded* NULs */ |
344 | if ((size_t)utf8_length != strlen((char *)utf8_value)) { |
345 | OPENSSL_free(utf8_value); |
346 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
347 | } |
348 | |
349 | /* |
350 | * XXX: Deviation from strict DNS name syntax, also check names with '_' |
351 | * Check DNS name syntax, any '-' or '.' must be internal, |
352 | * and on either side of each '.' we can't have a '-' or '.'. |
353 | * |
354 | * If the name has just one label, we don't consider it a DNS name. This |
355 | * means that "CN=sometld" cannot be precluded by DNS name constraints, but |
356 | * that is not a problem. |
357 | */ |
358 | for (i = 0; i < utf8_length; ++i) { |
359 | unsigned char c = utf8_value[i]; |
360 | |
361 | if ((c >= 'a' && c <= 'z') |
362 | || (c >= 'A' && c <= 'Z') |
363 | || (c >= '0' && c <= '9') |
364 | || c == '_') |
365 | continue; |
366 | |
367 | /* Dot and hyphen cannot be first or last. */ |
368 | if (i > 0 && i < utf8_length - 1) { |
369 | if (c == '-') |
370 | continue; |
371 | /* |
372 | * Next to a dot the preceding and following characters must not be |
373 | * another dot or a hyphen. Otherwise, record that the name is |
374 | * plausible, since it has two or more labels. |
375 | */ |
376 | if (c == '.' |
377 | && utf8_value[i + 1] != '.' |
378 | && utf8_value[i - 1] != '-' |
379 | && utf8_value[i + 1] != '-') { |
380 | isdnsname = 1; |
381 | continue; |
382 | } |
383 | } |
384 | isdnsname = 0; |
385 | break; |
386 | } |
387 | |
388 | if (isdnsname) { |
389 | *dnsid = utf8_value; |
390 | *idlen = (size_t)utf8_length; |
391 | return X509_V_OK; |
392 | } |
393 | OPENSSL_free(utf8_value); |
394 | return X509_V_OK; |
395 | } |
396 | |
397 | /* |
398 | * Check CN against DNS-ID name constraints. |
399 | */ |
400 | int NAME_CONSTRAINTS_check_CN(X509 *x, NAME_CONSTRAINTS *nc) |
401 | { |
402 | int r, i; |
403 | X509_NAME *nm = X509_get_subject_name(x); |
404 | ASN1_STRING stmp; |
405 | GENERAL_NAME gntmp; |
406 | |
407 | stmp.flags = 0; |
408 | stmp.type = V_ASN1_IA5STRING; |
409 | gntmp.type = GEN_DNS; |
410 | gntmp.d.dNSName = &stmp; |
411 | |
412 | /* Process any commonName attributes in subject name */ |
413 | |
414 | for (i = -1;;) { |
415 | X509_NAME_ENTRY *ne; |
416 | ASN1_STRING *cn; |
417 | unsigned char *idval; |
418 | size_t idlen; |
419 | |
420 | i = X509_NAME_get_index_by_NID(nm, NID_commonName, i); |
421 | if (i == -1) |
422 | break; |
423 | ne = X509_NAME_get_entry(nm, i); |
424 | cn = X509_NAME_ENTRY_get_data(ne); |
425 | |
426 | /* Only process attributes that look like host names */ |
427 | if ((r = cn2dnsid(cn, &idval, &idlen)) != X509_V_OK) |
428 | return r; |
429 | if (idlen == 0) |
430 | continue; |
431 | |
432 | stmp.length = idlen; |
433 | stmp.data = idval; |
434 | r = nc_match(&gntmp, nc); |
435 | OPENSSL_free(idval); |
436 | if (r != X509_V_OK) |
437 | return r; |
438 | } |
439 | return X509_V_OK; |
440 | } |
441 | |
442 | /* |
443 | * Return nonzero if the GeneralSubtree has valid 'minimum' field |
444 | * (must be absent or 0) and valid 'maximum' field (must be absent). |
445 | */ |
446 | static int nc_minmax_valid(GENERAL_SUBTREE *sub) { |
447 | BIGNUM *bn = NULL; |
448 | int ok = 1; |
449 | |
450 | if (sub->maximum) |
451 | ok = 0; |
452 | |
453 | if (sub->minimum) { |
454 | bn = ASN1_INTEGER_to_BN(sub->minimum, NULL); |
455 | if (bn == NULL || !BN_is_zero(bn)) |
456 | ok = 0; |
457 | BN_free(bn); |
458 | } |
459 | |
460 | return ok; |
461 | } |
462 | |
463 | static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc) |
464 | { |
465 | GENERAL_SUBTREE *sub; |
466 | int i, r, match = 0; |
467 | |
468 | /* |
469 | * Permitted subtrees: if any subtrees exist of matching the type at |
470 | * least one subtree must match. |
471 | */ |
472 | |
473 | for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) { |
474 | sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i); |
475 | if (gen->type != sub->base->type) |
476 | continue; |
477 | if (!nc_minmax_valid(sub)) |
478 | return X509_V_ERR_SUBTREE_MINMAX; |
479 | /* If we already have a match don't bother trying any more */ |
480 | if (match == 2) |
481 | continue; |
482 | if (match == 0) |
483 | match = 1; |
484 | r = nc_match_single(gen, sub->base); |
485 | if (r == X509_V_OK) |
486 | match = 2; |
487 | else if (r != X509_V_ERR_PERMITTED_VIOLATION) |
488 | return r; |
489 | } |
490 | |
491 | if (match == 1) |
492 | return X509_V_ERR_PERMITTED_VIOLATION; |
493 | |
494 | /* Excluded subtrees: must not match any of these */ |
495 | |
496 | for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++) { |
497 | sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i); |
498 | if (gen->type != sub->base->type) |
499 | continue; |
500 | if (!nc_minmax_valid(sub)) |
501 | return X509_V_ERR_SUBTREE_MINMAX; |
502 | |
503 | r = nc_match_single(gen, sub->base); |
504 | if (r == X509_V_OK) |
505 | return X509_V_ERR_EXCLUDED_VIOLATION; |
506 | else if (r != X509_V_ERR_PERMITTED_VIOLATION) |
507 | return r; |
508 | |
509 | } |
510 | |
511 | return X509_V_OK; |
512 | |
513 | } |
514 | |
515 | static int nc_match_single(GENERAL_NAME *gen, GENERAL_NAME *base) |
516 | { |
517 | switch (base->type) { |
518 | case GEN_DIRNAME: |
519 | return nc_dn(gen->d.directoryName, base->d.directoryName); |
520 | |
521 | case GEN_DNS: |
522 | return nc_dns(gen->d.dNSName, base->d.dNSName); |
523 | |
524 | case GEN_EMAIL: |
525 | return nc_email(gen->d.rfc822Name, base->d.rfc822Name); |
526 | |
527 | case GEN_URI: |
528 | return nc_uri(gen->d.uniformResourceIdentifier, |
529 | base->d.uniformResourceIdentifier); |
530 | |
531 | case GEN_IPADD: |
532 | return nc_ip(gen->d.iPAddress, base->d.iPAddress); |
533 | |
534 | default: |
535 | return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE; |
536 | } |
537 | |
538 | } |
539 | |
540 | /* |
541 | * directoryName name constraint matching. The canonical encoding of |
542 | * X509_NAME makes this comparison easy. It is matched if the subtree is a |
543 | * subset of the name. |
544 | */ |
545 | |
546 | static int nc_dn(X509_NAME *nm, X509_NAME *base) |
547 | { |
548 | /* Ensure canonical encodings are up to date. */ |
549 | if (nm->modified && i2d_X509_NAME(nm, NULL) < 0) |
550 | return X509_V_ERR_OUT_OF_MEM; |
551 | if (base->modified && i2d_X509_NAME(base, NULL) < 0) |
552 | return X509_V_ERR_OUT_OF_MEM; |
553 | if (base->canon_enclen > nm->canon_enclen) |
554 | return X509_V_ERR_PERMITTED_VIOLATION; |
555 | if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen)) |
556 | return X509_V_ERR_PERMITTED_VIOLATION; |
557 | return X509_V_OK; |
558 | } |
559 | |
560 | static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base) |
561 | { |
562 | char *baseptr = (char *)base->data; |
563 | char *dnsptr = (char *)dns->data; |
564 | |
565 | /* Empty matches everything */ |
566 | if (*baseptr == '\0') |
567 | return X509_V_OK; |
568 | /* |
569 | * Otherwise can add zero or more components on the left so compare RHS |
570 | * and if dns is longer and expect '.' as preceding character. |
571 | */ |
572 | if (dns->length > base->length) { |
573 | dnsptr += dns->length - base->length; |
574 | if (*baseptr != '.' && dnsptr[-1] != '.') |
575 | return X509_V_ERR_PERMITTED_VIOLATION; |
576 | } |
577 | |
578 | if (ia5casecmp(baseptr, dnsptr)) |
579 | return X509_V_ERR_PERMITTED_VIOLATION; |
580 | |
581 | return X509_V_OK; |
582 | |
583 | } |
584 | |
585 | static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base) |
586 | { |
587 | const char *baseptr = (char *)base->data; |
588 | const char *emlptr = (char *)eml->data; |
589 | |
590 | const char *baseat = strchr(baseptr, '@'); |
591 | const char *emlat = strchr(emlptr, '@'); |
592 | if (!emlat) |
593 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
594 | /* Special case: initial '.' is RHS match */ |
595 | if (!baseat && (*baseptr == '.')) { |
596 | if (eml->length > base->length) { |
597 | emlptr += eml->length - base->length; |
598 | if (ia5casecmp(baseptr, emlptr) == 0) |
599 | return X509_V_OK; |
600 | } |
601 | return X509_V_ERR_PERMITTED_VIOLATION; |
602 | } |
603 | |
604 | /* If we have anything before '@' match local part */ |
605 | |
606 | if (baseat) { |
607 | if (baseat != baseptr) { |
608 | if ((baseat - baseptr) != (emlat - emlptr)) |
609 | return X509_V_ERR_PERMITTED_VIOLATION; |
610 | /* Case sensitive match of local part */ |
611 | if (strncmp(baseptr, emlptr, emlat - emlptr)) |
612 | return X509_V_ERR_PERMITTED_VIOLATION; |
613 | } |
614 | /* Position base after '@' */ |
615 | baseptr = baseat + 1; |
616 | } |
617 | emlptr = emlat + 1; |
618 | /* Just have hostname left to match: case insensitive */ |
619 | if (ia5casecmp(baseptr, emlptr)) |
620 | return X509_V_ERR_PERMITTED_VIOLATION; |
621 | |
622 | return X509_V_OK; |
623 | |
624 | } |
625 | |
626 | static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base) |
627 | { |
628 | const char *baseptr = (char *)base->data; |
629 | const char *hostptr = (char *)uri->data; |
630 | const char *p = strchr(hostptr, ':'); |
631 | int hostlen; |
632 | |
633 | /* Check for foo:// and skip past it */ |
634 | if (p == NULL || p[1] != '/' || p[2] != '/') |
635 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
636 | hostptr = p + 3; |
637 | |
638 | /* Determine length of hostname part of URI */ |
639 | |
640 | /* Look for a port indicator as end of hostname first */ |
641 | |
642 | p = strchr(hostptr, ':'); |
643 | /* Otherwise look for trailing slash */ |
644 | if (p == NULL) |
645 | p = strchr(hostptr, '/'); |
646 | |
647 | if (p == NULL) |
648 | hostlen = strlen(hostptr); |
649 | else |
650 | hostlen = p - hostptr; |
651 | |
652 | if (hostlen == 0) |
653 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
654 | |
655 | /* Special case: initial '.' is RHS match */ |
656 | if (*baseptr == '.') { |
657 | if (hostlen > base->length) { |
658 | p = hostptr + hostlen - base->length; |
659 | if (ia5ncasecmp(p, baseptr, base->length) == 0) |
660 | return X509_V_OK; |
661 | } |
662 | return X509_V_ERR_PERMITTED_VIOLATION; |
663 | } |
664 | |
665 | if ((base->length != (int)hostlen) |
666 | || ia5ncasecmp(hostptr, baseptr, hostlen)) |
667 | return X509_V_ERR_PERMITTED_VIOLATION; |
668 | |
669 | return X509_V_OK; |
670 | |
671 | } |
672 | |
673 | static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base) |
674 | { |
675 | int hostlen, baselen, i; |
676 | unsigned char *hostptr, *baseptr, *maskptr; |
677 | hostptr = ip->data; |
678 | hostlen = ip->length; |
679 | baseptr = base->data; |
680 | baselen = base->length; |
681 | |
682 | /* Invalid if not IPv4 or IPv6 */ |
683 | if (!((hostlen == 4) || (hostlen == 16))) |
684 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
685 | if (!((baselen == 8) || (baselen == 32))) |
686 | return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX; |
687 | |
688 | /* Do not match IPv4 with IPv6 */ |
689 | if (hostlen * 2 != baselen) |
690 | return X509_V_ERR_PERMITTED_VIOLATION; |
691 | |
692 | maskptr = base->data + hostlen; |
693 | |
694 | /* Considering possible not aligned base ipAddress */ |
695 | /* Not checking for wrong mask definition: i.e.: 255.0.255.0 */ |
696 | for (i = 0; i < hostlen; i++) |
697 | if ((hostptr[i] & maskptr[i]) != (baseptr[i] & maskptr[i])) |
698 | return X509_V_ERR_PERMITTED_VIOLATION; |
699 | |
700 | return X509_V_OK; |
701 | |
702 | } |
703 | |