1/* v3_utl.c */
2/*
3 * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
4 * project.
5 */
6/* ====================================================================
7 * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
19 * distribution.
20 *
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 *
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * licensing@OpenSSL.org.
30 *
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
34 *
35 * 6. Redistributions of any form whatsoever must retain the following
36 * acknowledgment:
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
53 *
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
57 *
58 */
59/* X509 v3 extension utilities */
60
61#include <ctype.h>
62#include <stdio.h>
63#include <string.h>
64
65#include <openssl/bn.h>
66#include <openssl/buf.h>
67#include <openssl/conf.h>
68#include <openssl/err.h>
69#include <openssl/mem.h>
70#include <openssl/obj.h>
71#include <openssl/x509v3.h>
72
73#include "../conf/internal.h"
74#include "../internal.h"
75#include "internal.h"
76
77
78static char *strip_spaces(char *name);
79static int sk_strcmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b);
80static STACK_OF(OPENSSL_STRING) *get_email(X509_NAME *name,
81 GENERAL_NAMES *gens);
82static void str_free(OPENSSL_STRING str);
83static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, ASN1_IA5STRING *email);
84
85static int ipv4_from_asc(unsigned char *v4, const char *in);
86static int ipv6_from_asc(unsigned char *v6, const char *in);
87static int ipv6_cb(const char *elem, int len, void *usr);
88static int ipv6_hex(unsigned char *out, const char *in, int inlen);
89
90/* Add a CONF_VALUE name value pair to stack */
91
92int X509V3_add_value(const char *name, const char *value,
93 STACK_OF(CONF_VALUE) **extlist)
94{
95 CONF_VALUE *vtmp = NULL;
96 char *tname = NULL, *tvalue = NULL;
97 if (name && !(tname = BUF_strdup(name)))
98 goto err;
99 if (value && !(tvalue = BUF_strdup(value)))
100 goto err;
101 if (!(vtmp = CONF_VALUE_new()))
102 goto err;
103 if (!*extlist && !(*extlist = sk_CONF_VALUE_new_null()))
104 goto err;
105 vtmp->section = NULL;
106 vtmp->name = tname;
107 vtmp->value = tvalue;
108 if (!sk_CONF_VALUE_push(*extlist, vtmp))
109 goto err;
110 return 1;
111 err:
112 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
113 if (vtmp)
114 OPENSSL_free(vtmp);
115 if (tname)
116 OPENSSL_free(tname);
117 if (tvalue)
118 OPENSSL_free(tvalue);
119 return 0;
120}
121
122int X509V3_add_value_uchar(const char *name, const unsigned char *value,
123 STACK_OF(CONF_VALUE) **extlist)
124{
125 return X509V3_add_value(name, (const char *)value, extlist);
126}
127
128/* Free function for STACK_OF(CONF_VALUE) */
129
130void X509V3_conf_free(CONF_VALUE *conf)
131{
132 if (!conf)
133 return;
134 if (conf->name)
135 OPENSSL_free(conf->name);
136 if (conf->value)
137 OPENSSL_free(conf->value);
138 if (conf->section)
139 OPENSSL_free(conf->section);
140 OPENSSL_free(conf);
141}
142
143int X509V3_add_value_bool(const char *name, int asn1_bool,
144 STACK_OF(CONF_VALUE) **extlist)
145{
146 if (asn1_bool)
147 return X509V3_add_value(name, "TRUE", extlist);
148 return X509V3_add_value(name, "FALSE", extlist);
149}
150
151int X509V3_add_value_bool_nf(char *name, int asn1_bool,
152 STACK_OF(CONF_VALUE) **extlist)
153{
154 if (asn1_bool)
155 return X509V3_add_value(name, "TRUE", extlist);
156 return 1;
157}
158
159static char *bignum_to_string(const BIGNUM *bn)
160{
161 char *tmp, *ret;
162 size_t len;
163
164 /*
165 * Display large numbers in hex and small numbers in decimal. Converting to
166 * decimal takes quadratic time and is no more useful than hex for large
167 * numbers.
168 */
169 if (BN_num_bits(bn) < 32) {
170 return BN_bn2dec(bn);
171 }
172
173 tmp = BN_bn2hex(bn);
174 if (tmp == NULL) {
175 return NULL;
176 }
177
178 len = strlen(tmp) + 3;
179 ret = OPENSSL_malloc(len);
180 if (ret == NULL) {
181 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
182 OPENSSL_free(tmp);
183 return NULL;
184 }
185
186 /* Prepend "0x", but place it after the "-" if negative. */
187 if (tmp[0] == '-') {
188 BUF_strlcpy(ret, "-0x", len);
189 BUF_strlcat(ret, tmp + 1, len);
190 } else {
191 BUF_strlcpy(ret, "0x", len);
192 BUF_strlcat(ret, tmp, len);
193 }
194 OPENSSL_free(tmp);
195 return ret;
196}
197
198char *i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *method, ASN1_ENUMERATED *a)
199{
200 BIGNUM *bntmp = NULL;
201 char *strtmp = NULL;
202 if (!a)
203 return NULL;
204 if (!(bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) ||
205 !(strtmp = bignum_to_string(bntmp)))
206 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
207 BN_free(bntmp);
208 return strtmp;
209}
210
211char *i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, ASN1_INTEGER *a)
212{
213 BIGNUM *bntmp = NULL;
214 char *strtmp = NULL;
215 if (!a)
216 return NULL;
217 if (!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||
218 !(strtmp = bignum_to_string(bntmp)))
219 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
220 BN_free(bntmp);
221 return strtmp;
222}
223
224ASN1_INTEGER *s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
225{
226 BIGNUM *bn = NULL;
227 ASN1_INTEGER *aint;
228 int isneg, ishex;
229 int ret;
230 if (!value) {
231 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_VALUE);
232 return 0;
233 }
234 bn = BN_new();
235 if (value[0] == '-') {
236 value++;
237 isneg = 1;
238 } else
239 isneg = 0;
240
241 if (value[0] == '0' && ((value[1] == 'x') || (value[1] == 'X'))) {
242 value += 2;
243 ishex = 1;
244 } else
245 ishex = 0;
246
247 if (ishex)
248 ret = BN_hex2bn(&bn, value);
249 else
250 ret = BN_dec2bn(&bn, value);
251
252 if (!ret || value[ret]) {
253 BN_free(bn);
254 OPENSSL_PUT_ERROR(X509V3, X509V3_R_BN_DEC2BN_ERROR);
255 return 0;
256 }
257
258 if (isneg && BN_is_zero(bn))
259 isneg = 0;
260
261 aint = BN_to_ASN1_INTEGER(bn, NULL);
262 BN_free(bn);
263 if (!aint) {
264 OPENSSL_PUT_ERROR(X509V3, X509V3_R_BN_TO_ASN1_INTEGER_ERROR);
265 return 0;
266 }
267 if (isneg)
268 aint->type |= V_ASN1_NEG;
269 return aint;
270}
271
272int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
273 STACK_OF(CONF_VALUE) **extlist)
274{
275 char *strtmp;
276 int ret;
277 if (!aint)
278 return 1;
279 if (!(strtmp = i2s_ASN1_INTEGER(NULL, aint)))
280 return 0;
281 ret = X509V3_add_value(name, strtmp, extlist);
282 OPENSSL_free(strtmp);
283 return ret;
284}
285
286int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool)
287{
288 char *btmp;
289 if (!(btmp = value->value))
290 goto err;
291 if (!strcmp(btmp, "TRUE") || !strcmp(btmp, "true")
292 || !strcmp(btmp, "Y") || !strcmp(btmp, "y")
293 || !strcmp(btmp, "YES") || !strcmp(btmp, "yes")) {
294 *asn1_bool = 0xff;
295 return 1;
296 } else if (!strcmp(btmp, "FALSE") || !strcmp(btmp, "false")
297 || !strcmp(btmp, "N") || !strcmp(btmp, "n")
298 || !strcmp(btmp, "NO") || !strcmp(btmp, "no")) {
299 *asn1_bool = 0;
300 return 1;
301 }
302 err:
303 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_BOOLEAN_STRING);
304 X509V3_conf_err(value);
305 return 0;
306}
307
308int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint)
309{
310 ASN1_INTEGER *itmp;
311 if (!(itmp = s2i_ASN1_INTEGER(NULL, value->value))) {
312 X509V3_conf_err(value);
313 return 0;
314 }
315 *aint = itmp;
316 return 1;
317}
318
319#define HDR_NAME 1
320#define HDR_VALUE 2
321
322/*
323 * #define DEBUG
324 */
325
326STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)
327{
328 char *p, *q, c;
329 char *ntmp, *vtmp;
330 STACK_OF(CONF_VALUE) *values = NULL;
331 char *linebuf;
332 int state;
333 /* We are going to modify the line so copy it first */
334 linebuf = BUF_strdup(line);
335 if (linebuf == NULL) {
336 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
337 goto err;
338 }
339 state = HDR_NAME;
340 ntmp = NULL;
341 /* Go through all characters */
342 for (p = linebuf, q = linebuf; (c = *p) && (c != '\r') && (c != '\n');
343 p++) {
344
345 switch (state) {
346 case HDR_NAME:
347 if (c == ':') {
348 state = HDR_VALUE;
349 *p = 0;
350 ntmp = strip_spaces(q);
351 if (!ntmp) {
352 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_NAME);
353 goto err;
354 }
355 q = p + 1;
356 } else if (c == ',') {
357 *p = 0;
358 ntmp = strip_spaces(q);
359 q = p + 1;
360#if 0
361 printf("%s\n", ntmp);
362#endif
363 if (!ntmp) {
364 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_NAME);
365 goto err;
366 }
367 X509V3_add_value(ntmp, NULL, &values);
368 }
369 break;
370
371 case HDR_VALUE:
372 if (c == ',') {
373 state = HDR_NAME;
374 *p = 0;
375 vtmp = strip_spaces(q);
376#if 0
377 printf("%s\n", ntmp);
378#endif
379 if (!vtmp) {
380 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_VALUE);
381 goto err;
382 }
383 X509V3_add_value(ntmp, vtmp, &values);
384 ntmp = NULL;
385 q = p + 1;
386 }
387
388 }
389 }
390
391 if (state == HDR_VALUE) {
392 vtmp = strip_spaces(q);
393#if 0
394 printf("%s=%s\n", ntmp, vtmp);
395#endif
396 if (!vtmp) {
397 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_VALUE);
398 goto err;
399 }
400 X509V3_add_value(ntmp, vtmp, &values);
401 } else {
402 ntmp = strip_spaces(q);
403#if 0
404 printf("%s\n", ntmp);
405#endif
406 if (!ntmp) {
407 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_NAME);
408 goto err;
409 }
410 X509V3_add_value(ntmp, NULL, &values);
411 }
412 OPENSSL_free(linebuf);
413 return values;
414
415 err:
416 OPENSSL_free(linebuf);
417 sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
418 return NULL;
419
420}
421
422/* Delete leading and trailing spaces from a string */
423static char *strip_spaces(char *name)
424{
425 char *p, *q;
426 /* Skip over leading spaces */
427 p = name;
428 while (*p && isspace((unsigned char)*p))
429 p++;
430 if (!*p)
431 return NULL;
432 q = p + strlen(p) - 1;
433 while ((q != p) && isspace((unsigned char)*q))
434 q--;
435 if (p != q)
436 q[1] = 0;
437 if (!*p)
438 return NULL;
439 return p;
440}
441
442/* hex string utilities */
443
444/*
445 * Given a buffer of length 'len' return a OPENSSL_malloc'ed string with its
446 * hex representation @@@ (Contents of buffer are always kept in ASCII, also
447 * on EBCDIC machines)
448 */
449
450char *x509v3_bytes_to_hex(const unsigned char *buffer, long len)
451{
452 char *tmp, *q;
453 const unsigned char *p;
454 int i;
455 static const char hexdig[] = "0123456789ABCDEF";
456 if (!buffer || !len)
457 return NULL;
458 if (!(tmp = OPENSSL_malloc(len * 3 + 1))) {
459 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
460 return NULL;
461 }
462 q = tmp;
463 for (i = 0, p = buffer; i < len; i++, p++) {
464 *q++ = hexdig[(*p >> 4) & 0xf];
465 *q++ = hexdig[*p & 0xf];
466 *q++ = ':';
467 }
468 q[-1] = 0;
469
470 return tmp;
471}
472
473unsigned char *x509v3_hex_to_bytes(const char *str, long *len)
474{
475 unsigned char *hexbuf, *q;
476 unsigned char ch, cl, *p;
477 if (!str) {
478 OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NULL_ARGUMENT);
479 return NULL;
480 }
481 if (!(hexbuf = OPENSSL_malloc(strlen(str) >> 1)))
482 goto err;
483 for (p = (unsigned char *)str, q = hexbuf; *p;) {
484 ch = *p++;
485 if (ch == ':')
486 continue;
487 cl = *p++;
488 if (!cl) {
489 OPENSSL_PUT_ERROR(X509V3, X509V3_R_ODD_NUMBER_OF_DIGITS);
490 OPENSSL_free(hexbuf);
491 return NULL;
492 }
493
494 if ((ch >= '0') && (ch <= '9'))
495 ch -= '0';
496 else if ((ch >= 'a') && (ch <= 'f'))
497 ch -= 'a' - 10;
498 else if ((ch >= 'A') && (ch <= 'F'))
499 ch -= 'A' - 10;
500 else
501 goto badhex;
502
503 if ((cl >= '0') && (cl <= '9'))
504 cl -= '0';
505 else if ((cl >= 'a') && (cl <= 'f'))
506 cl -= 'a' - 10;
507 else if ((cl >= 'A') && (cl <= 'F'))
508 cl -= 'A' - 10;
509 else
510 goto badhex;
511
512 *q++ = (ch << 4) | cl;
513 }
514
515 if (len)
516 *len = q - hexbuf;
517
518 return hexbuf;
519
520 err:
521 if (hexbuf)
522 OPENSSL_free(hexbuf);
523 OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
524 return NULL;
525
526 badhex:
527 OPENSSL_free(hexbuf);
528 OPENSSL_PUT_ERROR(X509V3, X509V3_R_ILLEGAL_HEX_DIGIT);
529 return NULL;
530
531}
532
533int x509v3_name_cmp(const char *name, const char *cmp)
534{
535 int len, ret;
536 char c;
537 len = strlen(cmp);
538 if ((ret = strncmp(name, cmp, len)))
539 return ret;
540 c = name[len];
541 if (!c || (c == '.'))
542 return 0;
543 return 1;
544}
545
546static int sk_strcmp(const OPENSSL_STRING *a, const OPENSSL_STRING *b)
547{
548 return strcmp(*a, *b);
549}
550
551STACK_OF(OPENSSL_STRING) *X509_get1_email(X509 *x)
552{
553 GENERAL_NAMES *gens;
554 STACK_OF(OPENSSL_STRING) *ret;
555
556 gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
557 ret = get_email(X509_get_subject_name(x), gens);
558 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
559 return ret;
560}
561
562STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x)
563{
564 AUTHORITY_INFO_ACCESS *info;
565 STACK_OF(OPENSSL_STRING) *ret = NULL;
566 size_t i;
567
568 info = X509_get_ext_d2i(x, NID_info_access, NULL, NULL);
569 if (!info)
570 return NULL;
571 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++) {
572 ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
573 if (OBJ_obj2nid(ad->method) == NID_ad_OCSP) {
574 if (ad->location->type == GEN_URI) {
575 if (!append_ia5
576 (&ret, ad->location->d.uniformResourceIdentifier))
577 break;
578 }
579 }
580 }
581 AUTHORITY_INFO_ACCESS_free(info);
582 return ret;
583}
584
585STACK_OF(OPENSSL_STRING) *X509_REQ_get1_email(X509_REQ *x)
586{
587 GENERAL_NAMES *gens;
588 STACK_OF(X509_EXTENSION) *exts;
589 STACK_OF(OPENSSL_STRING) *ret;
590
591 exts = X509_REQ_get_extensions(x);
592 gens = X509V3_get_d2i(exts, NID_subject_alt_name, NULL, NULL);
593 ret = get_email(X509_REQ_get_subject_name(x), gens);
594 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
595 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
596 return ret;
597}
598
599static STACK_OF(OPENSSL_STRING) *get_email(X509_NAME *name,
600 GENERAL_NAMES *gens)
601{
602 STACK_OF(OPENSSL_STRING) *ret = NULL;
603 X509_NAME_ENTRY *ne;
604 ASN1_IA5STRING *email;
605 GENERAL_NAME *gen;
606 int i;
607 size_t j;
608 /* Now add any email address(es) to STACK */
609 i = -1;
610 /* First supplied X509_NAME */
611 while ((i = X509_NAME_get_index_by_NID(name,
612 NID_pkcs9_emailAddress, i)) >= 0) {
613 ne = X509_NAME_get_entry(name, i);
614 email = X509_NAME_ENTRY_get_data(ne);
615 if (!append_ia5(&ret, email))
616 return NULL;
617 }
618 for (j = 0; j < sk_GENERAL_NAME_num(gens); j++) {
619 gen = sk_GENERAL_NAME_value(gens, j);
620 if (gen->type != GEN_EMAIL)
621 continue;
622 if (!append_ia5(&ret, gen->d.ia5))
623 return NULL;
624 }
625 return ret;
626}
627
628static void str_free(OPENSSL_STRING str)
629{
630 OPENSSL_free(str);
631}
632
633static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, ASN1_IA5STRING *email)
634{
635 char *emtmp;
636 /* First some sanity checks */
637 if (email->type != V_ASN1_IA5STRING)
638 return 1;
639 if (!email->data || !email->length)
640 return 1;
641 if (!*sk)
642 *sk = sk_OPENSSL_STRING_new(sk_strcmp);
643 if (!*sk)
644 return 0;
645 /* Don't add duplicates */
646 sk_OPENSSL_STRING_sort(*sk);
647 if (sk_OPENSSL_STRING_find(*sk, NULL, (char *)email->data))
648 return 1;
649 emtmp = BUF_strdup((char *)email->data);
650 if (!emtmp || !sk_OPENSSL_STRING_push(*sk, emtmp)) {
651 X509_email_free(*sk);
652 *sk = NULL;
653 return 0;
654 }
655 return 1;
656}
657
658void X509_email_free(STACK_OF(OPENSSL_STRING) *sk)
659{
660 sk_OPENSSL_STRING_pop_free(sk, str_free);
661}
662
663typedef int (*equal_fn) (const unsigned char *pattern, size_t pattern_len,
664 const unsigned char *subject, size_t subject_len,
665 unsigned int flags);
666
667/* Skip pattern prefix to match "wildcard" subject */
668static void skip_prefix(const unsigned char **p, size_t *plen,
669 const unsigned char *subject, size_t subject_len,
670 unsigned int flags)
671{
672 const unsigned char *pattern = *p;
673 size_t pattern_len = *plen;
674
675 /*
676 * If subject starts with a leading '.' followed by more octets, and
677 * pattern is longer, compare just an equal-length suffix with the
678 * full subject (starting at the '.'), provided the prefix contains
679 * no NULs.
680 */
681 if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0)
682 return;
683
684 while (pattern_len > subject_len && *pattern) {
685 if ((flags & X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS) &&
686 *pattern == '.')
687 break;
688 ++pattern;
689 --pattern_len;
690 }
691
692 /* Skip if entire prefix acceptable */
693 if (pattern_len == subject_len) {
694 *p = pattern;
695 *plen = pattern_len;
696 }
697}
698
699/* Compare while ASCII ignoring case. */
700static int equal_nocase(const unsigned char *pattern, size_t pattern_len,
701 const unsigned char *subject, size_t subject_len,
702 unsigned int flags)
703{
704 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
705 if (pattern_len != subject_len)
706 return 0;
707 while (pattern_len) {
708 unsigned char l = *pattern;
709 unsigned char r = *subject;
710 /* The pattern must not contain NUL characters. */
711 if (l == 0)
712 return 0;
713 if (l != r) {
714 if ('A' <= l && l <= 'Z')
715 l = (l - 'A') + 'a';
716 if ('A' <= r && r <= 'Z')
717 r = (r - 'A') + 'a';
718 if (l != r)
719 return 0;
720 }
721 ++pattern;
722 ++subject;
723 --pattern_len;
724 }
725 return 1;
726}
727
728/* Compare using OPENSSL_memcmp. */
729static int equal_case(const unsigned char *pattern, size_t pattern_len,
730 const unsigned char *subject, size_t subject_len,
731 unsigned int flags)
732{
733 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
734 if (pattern_len != subject_len)
735 return 0;
736 return !OPENSSL_memcmp(pattern, subject, pattern_len);
737}
738
739/*
740 * RFC 5280, section 7.5, requires that only the domain is compared in a
741 * case-insensitive manner.
742 */
743static int equal_email(const unsigned char *a, size_t a_len,
744 const unsigned char *b, size_t b_len,
745 unsigned int unused_flags)
746{
747 size_t i = a_len;
748 if (a_len != b_len)
749 return 0;
750 /*
751 * We search backwards for the '@' character, so that we do not have to
752 * deal with quoted local-parts. The domain part is compared in a
753 * case-insensitive manner.
754 */
755 while (i > 0) {
756 --i;
757 if (a[i] == '@' || b[i] == '@') {
758 if (!equal_nocase(a + i, a_len - i, b + i, a_len - i, 0))
759 return 0;
760 break;
761 }
762 }
763 if (i == 0)
764 i = a_len;
765 return equal_case(a, i, b, i, 0);
766}
767
768/*
769 * Compare the prefix and suffix with the subject, and check that the
770 * characters in-between are valid.
771 */
772static int wildcard_match(const unsigned char *prefix, size_t prefix_len,
773 const unsigned char *suffix, size_t suffix_len,
774 const unsigned char *subject, size_t subject_len,
775 unsigned int flags)
776{
777 const unsigned char *wildcard_start;
778 const unsigned char *wildcard_end;
779 const unsigned char *p;
780 int allow_multi = 0;
781 int allow_idna = 0;
782
783 if (subject_len < prefix_len + suffix_len)
784 return 0;
785 if (!equal_nocase(prefix, prefix_len, subject, prefix_len, flags))
786 return 0;
787 wildcard_start = subject + prefix_len;
788 wildcard_end = subject + (subject_len - suffix_len);
789 if (!equal_nocase(wildcard_end, suffix_len, suffix, suffix_len, flags))
790 return 0;
791 /*
792 * If the wildcard makes up the entire first label, it must match at
793 * least one character.
794 */
795 if (prefix_len == 0 && *suffix == '.') {
796 if (wildcard_start == wildcard_end)
797 return 0;
798 allow_idna = 1;
799 if (flags & X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS)
800 allow_multi = 1;
801 }
802 /* IDNA labels cannot match partial wildcards */
803 if (!allow_idna &&
804 subject_len >= 4
805 && OPENSSL_strncasecmp((char *)subject, "xn--", 4) == 0)
806 return 0;
807 /* The wildcard may match a literal '*' */
808 if (wildcard_end == wildcard_start + 1 && *wildcard_start == '*')
809 return 1;
810 /*
811 * Check that the part matched by the wildcard contains only
812 * permitted characters and only matches a single label unless
813 * allow_multi is set.
814 */
815 for (p = wildcard_start; p != wildcard_end; ++p)
816 if (!(('0' <= *p && *p <= '9') ||
817 ('A' <= *p && *p <= 'Z') ||
818 ('a' <= *p && *p <= 'z') ||
819 *p == '-' || (allow_multi && *p == '.')))
820 return 0;
821 return 1;
822}
823
824#define LABEL_START (1 << 0)
825#define LABEL_END (1 << 1)
826#define LABEL_HYPHEN (1 << 2)
827#define LABEL_IDNA (1 << 3)
828
829static const unsigned char *valid_star(const unsigned char *p, size_t len,
830 unsigned int flags)
831{
832 const unsigned char *star = 0;
833 size_t i;
834 int state = LABEL_START;
835 int dots = 0;
836 for (i = 0; i < len; ++i) {
837 /*
838 * Locate first and only legal wildcard, either at the start
839 * or end of a non-IDNA first and not final label.
840 */
841 if (p[i] == '*') {
842 int atstart = (state & LABEL_START);
843 int atend = (i == len - 1 || p[i + 1] == '.');
844 /*
845 * At most one wildcard per pattern.
846 * No wildcards in IDNA labels.
847 * No wildcards after the first label.
848 */
849 if (star != NULL || (state & LABEL_IDNA) != 0 || dots)
850 return NULL;
851 /* Only full-label '*.example.com' wildcards? */
852 if ((flags & X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)
853 && (!atstart || !atend))
854 return NULL;
855 /* No 'foo*bar' wildcards */
856 if (!atstart && !atend)
857 return NULL;
858 star = &p[i];
859 state &= ~LABEL_START;
860 } else if (('a' <= p[i] && p[i] <= 'z')
861 || ('A' <= p[i] && p[i] <= 'Z')
862 || ('0' <= p[i] && p[i] <= '9')) {
863 if ((state & LABEL_START) != 0
864 && len - i >= 4
865 && OPENSSL_strncasecmp((char *)&p[i], "xn--", 4) == 0)
866 state |= LABEL_IDNA;
867 state &= ~(LABEL_HYPHEN | LABEL_START);
868 } else if (p[i] == '.') {
869 if ((state & (LABEL_HYPHEN | LABEL_START)) != 0)
870 return NULL;
871 state = LABEL_START;
872 ++dots;
873 } else if (p[i] == '-') {
874 /* no domain/subdomain starts with '-' */
875 if ((state & LABEL_START) != 0)
876 return NULL;
877 state |= LABEL_HYPHEN;
878 } else
879 return NULL;
880 }
881
882 /*
883 * The final label must not end in a hyphen or ".", and
884 * there must be at least two dots after the star.
885 */
886 if ((state & (LABEL_START | LABEL_HYPHEN)) != 0 || dots < 2)
887 return NULL;
888 return star;
889}
890
891/* Compare using wildcards. */
892static int equal_wildcard(const unsigned char *pattern, size_t pattern_len,
893 const unsigned char *subject, size_t subject_len,
894 unsigned int flags)
895{
896 const unsigned char *star = NULL;
897
898 /*
899 * Subject names starting with '.' can only match a wildcard pattern
900 * via a subject sub-domain pattern suffix match.
901 */
902 if (!(subject_len > 1 && subject[0] == '.'))
903 star = valid_star(pattern, pattern_len, flags);
904 if (star == NULL)
905 return equal_nocase(pattern, pattern_len,
906 subject, subject_len, flags);
907 return wildcard_match(pattern, star - pattern,
908 star + 1, (pattern + pattern_len) - star - 1,
909 subject, subject_len, flags);
910}
911
912int x509v3_looks_like_dns_name(const unsigned char *in, size_t len) {
913 /* This function is used as a heuristic for whether a common name is a
914 * hostname to be matched, or merely a decorative name to describe the
915 * subject. This heuristic must be applied to both name constraints and the
916 * common name fallback, so it must be loose enough to accept hostname
917 * common names, and tight enough to reject decorative common names. */
918
919 if (len > 0 && in[len - 1] == '.') {
920 len--;
921 }
922
923 /* Wildcards are allowed in front. */
924 if (len >= 2 && in[0] == '*' && in[1] == '.') {
925 in += 2;
926 len -= 2;
927 }
928
929 if (len == 0) {
930 return 0;
931 }
932
933 size_t label_start = 0;
934 for (size_t i = 0; i < len; i++) {
935 unsigned char c = in[i];
936 if ((c >= 'a' && c <= 'z') ||
937 (c >= '0' && c <= '9') ||
938 (c >= 'A' && c <= 'Z') ||
939 (c == '-' && i > label_start) ||
940 /* These are not valid characters in hostnames, but commonly found
941 * in deployments outside the Web PKI. */
942 c == '_' ||
943 c == ':') {
944 continue;
945 }
946
947 /* Labels must not be empty. */
948 if (c == '.' && i > label_start && i < len - 1) {
949 label_start = i + 1;
950 continue;
951 }
952
953 return 0;
954 }
955
956 return 1;
957}
958
959/*
960 * Compare an ASN1_STRING to a supplied string. If they match return 1. If
961 * cmp_type > 0 only compare if string matches the type, otherwise convert it
962 * to UTF8.
963 */
964
965static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal,
966 unsigned int flags, int check_type, const char *b,
967 size_t blen, char **peername)
968{
969 int rv = 0;
970
971 if (!a->data || !a->length)
972 return 0;
973 if (cmp_type > 0) {
974 if (cmp_type != a->type)
975 return 0;
976 if (cmp_type == V_ASN1_IA5STRING)
977 rv = equal(a->data, a->length, (unsigned char *)b, blen, flags);
978 else if (a->length == (int)blen && !OPENSSL_memcmp(a->data, b, blen))
979 rv = 1;
980 if (rv > 0 && peername)
981 *peername = BUF_strndup((char *)a->data, a->length);
982 } else {
983 int astrlen;
984 unsigned char *astr;
985 astrlen = ASN1_STRING_to_UTF8(&astr, a);
986 if (astrlen < 0)
987 return -1;
988 /*
989 * We check the common name against DNS name constraints if it passes
990 * |x509v3_looks_like_dns_name|. Thus we must not consider common names
991 * for DNS fallbacks if they fail this check.
992 */
993 if (check_type == GEN_DNS &&
994 !x509v3_looks_like_dns_name(astr, astrlen)) {
995 rv = 0;
996 } else {
997 rv = equal(astr, astrlen, (unsigned char *)b, blen, flags);
998 }
999 if (rv > 0 && peername)
1000 *peername = BUF_strndup((char *)astr, astrlen);
1001 OPENSSL_free(astr);
1002 }
1003 return rv;
1004}
1005
1006static int do_x509_check(X509 *x, const char *chk, size_t chklen,
1007 unsigned int flags, int check_type, char **peername)
1008{
1009 GENERAL_NAMES *gens = NULL;
1010 X509_NAME *name = NULL;
1011 size_t i;
1012 int j;
1013 int cnid = NID_undef;
1014 int alt_type;
1015 int rv = 0;
1016 equal_fn equal;
1017
1018 /* See below, this flag is internal-only */
1019 flags &= ~_X509_CHECK_FLAG_DOT_SUBDOMAINS;
1020 if (check_type == GEN_EMAIL) {
1021 cnid = NID_pkcs9_emailAddress;
1022 alt_type = V_ASN1_IA5STRING;
1023 equal = equal_email;
1024 } else if (check_type == GEN_DNS) {
1025 cnid = NID_commonName;
1026 /* Implicit client-side DNS sub-domain pattern */
1027 if (chklen > 1 && chk[0] == '.')
1028 flags |= _X509_CHECK_FLAG_DOT_SUBDOMAINS;
1029 alt_type = V_ASN1_IA5STRING;
1030 if (flags & X509_CHECK_FLAG_NO_WILDCARDS)
1031 equal = equal_nocase;
1032 else
1033 equal = equal_wildcard;
1034 } else {
1035 alt_type = V_ASN1_OCTET_STRING;
1036 equal = equal_case;
1037 }
1038
1039 gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
1040 if (gens) {
1041 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
1042 GENERAL_NAME *gen;
1043 ASN1_STRING *cstr;
1044 gen = sk_GENERAL_NAME_value(gens, i);
1045 if (gen->type != check_type)
1046 continue;
1047 if (check_type == GEN_EMAIL)
1048 cstr = gen->d.rfc822Name;
1049 else if (check_type == GEN_DNS)
1050 cstr = gen->d.dNSName;
1051 else
1052 cstr = gen->d.iPAddress;
1053 /* Positive on success, negative on error! */
1054 if ((rv = do_check_string(cstr, alt_type, equal, flags, check_type,
1055 chk, chklen, peername)) != 0)
1056 break;
1057 }
1058 GENERAL_NAMES_free(gens);
1059 return rv;
1060 }
1061
1062 /* We're done if CN-ID is not pertinent */
1063 if (cnid == NID_undef || (flags & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT))
1064 return 0;
1065
1066 j = -1;
1067 name = X509_get_subject_name(x);
1068 while ((j = X509_NAME_get_index_by_NID(name, cnid, j)) >= 0) {
1069 X509_NAME_ENTRY *ne;
1070 ASN1_STRING *str;
1071 ne = X509_NAME_get_entry(name, j);
1072 str = X509_NAME_ENTRY_get_data(ne);
1073 /* Positive on success, negative on error! */
1074 if ((rv = do_check_string(str, -1, equal, flags, check_type,
1075 chk, chklen, peername)) != 0)
1076 return rv;
1077 }
1078 return 0;
1079}
1080
1081int X509_check_host(X509 *x, const char *chk, size_t chklen,
1082 unsigned int flags, char **peername)
1083{
1084 if (chk == NULL)
1085 return -2;
1086 if (OPENSSL_memchr(chk, '\0', chklen))
1087 return -2;
1088 return do_x509_check(x, chk, chklen, flags, GEN_DNS, peername);
1089}
1090
1091int X509_check_email(X509 *x, const char *chk, size_t chklen,
1092 unsigned int flags)
1093{
1094 if (chk == NULL)
1095 return -2;
1096 if (OPENSSL_memchr(chk, '\0', chklen))
1097 return -2;
1098 return do_x509_check(x, chk, chklen, flags, GEN_EMAIL, NULL);
1099}
1100
1101int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
1102 unsigned int flags)
1103{
1104 if (chk == NULL)
1105 return -2;
1106 return do_x509_check(x, (char *)chk, chklen, flags, GEN_IPADD, NULL);
1107}
1108
1109int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
1110{
1111 unsigned char ipout[16];
1112 size_t iplen;
1113
1114 if (ipasc == NULL)
1115 return -2;
1116 iplen = (size_t)a2i_ipadd(ipout, ipasc);
1117 if (iplen == 0)
1118 return -2;
1119 return do_x509_check(x, (char *)ipout, iplen, flags, GEN_IPADD, NULL);
1120}
1121
1122/*
1123 * Convert IP addresses both IPv4 and IPv6 into an OCTET STRING compatible
1124 * with RFC3280.
1125 */
1126
1127ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc)
1128{
1129 unsigned char ipout[16];
1130 ASN1_OCTET_STRING *ret;
1131 int iplen;
1132
1133 /* If string contains a ':' assume IPv6 */
1134
1135 iplen = a2i_ipadd(ipout, ipasc);
1136
1137 if (!iplen)
1138 return NULL;
1139
1140 ret = ASN1_OCTET_STRING_new();
1141 if (!ret)
1142 return NULL;
1143 if (!ASN1_OCTET_STRING_set(ret, ipout, iplen)) {
1144 ASN1_OCTET_STRING_free(ret);
1145 return NULL;
1146 }
1147 return ret;
1148}
1149
1150ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc)
1151{
1152 ASN1_OCTET_STRING *ret = NULL;
1153 unsigned char ipout[32];
1154 char *iptmp = NULL, *p;
1155 int iplen1, iplen2;
1156 p = strchr(ipasc, '/');
1157 if (!p)
1158 return NULL;
1159 iptmp = BUF_strdup(ipasc);
1160 if (!iptmp)
1161 return NULL;
1162 p = iptmp + (p - ipasc);
1163 *p++ = 0;
1164
1165 iplen1 = a2i_ipadd(ipout, iptmp);
1166
1167 if (!iplen1)
1168 goto err;
1169
1170 iplen2 = a2i_ipadd(ipout + iplen1, p);
1171
1172 OPENSSL_free(iptmp);
1173 iptmp = NULL;
1174
1175 if (!iplen2 || (iplen1 != iplen2))
1176 goto err;
1177
1178 ret = ASN1_OCTET_STRING_new();
1179 if (!ret)
1180 goto err;
1181 if (!ASN1_OCTET_STRING_set(ret, ipout, iplen1 + iplen2))
1182 goto err;
1183
1184 return ret;
1185
1186 err:
1187 if (iptmp)
1188 OPENSSL_free(iptmp);
1189 if (ret)
1190 ASN1_OCTET_STRING_free(ret);
1191 return NULL;
1192}
1193
1194int a2i_ipadd(unsigned char *ipout, const char *ipasc)
1195{
1196 /* If string contains a ':' assume IPv6 */
1197
1198 if (strchr(ipasc, ':')) {
1199 if (!ipv6_from_asc(ipout, ipasc))
1200 return 0;
1201 return 16;
1202 } else {
1203 if (!ipv4_from_asc(ipout, ipasc))
1204 return 0;
1205 return 4;
1206 }
1207}
1208
1209static int ipv4_from_asc(unsigned char *v4, const char *in)
1210{
1211 int a0, a1, a2, a3;
1212 if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
1213 return 0;
1214 if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255)
1215 || (a2 < 0) || (a2 > 255) || (a3 < 0) || (a3 > 255))
1216 return 0;
1217 v4[0] = a0;
1218 v4[1] = a1;
1219 v4[2] = a2;
1220 v4[3] = a3;
1221 return 1;
1222}
1223
1224typedef struct {
1225 /* Temporary store for IPV6 output */
1226 unsigned char tmp[16];
1227 /* Total number of bytes in tmp */
1228 int total;
1229 /* The position of a zero (corresponding to '::') */
1230 int zero_pos;
1231 /* Number of zeroes */
1232 int zero_cnt;
1233} IPV6_STAT;
1234
1235static int ipv6_from_asc(unsigned char *v6, const char *in)
1236{
1237 IPV6_STAT v6stat;
1238 v6stat.total = 0;
1239 v6stat.zero_pos = -1;
1240 v6stat.zero_cnt = 0;
1241 /*
1242 * Treat the IPv6 representation as a list of values separated by ':'.
1243 * The presence of a '::' will parse as one, two or three zero length
1244 * elements.
1245 */
1246 if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
1247 return 0;
1248
1249 /* Now for some sanity checks */
1250
1251 if (v6stat.zero_pos == -1) {
1252 /* If no '::' must have exactly 16 bytes */
1253 if (v6stat.total != 16)
1254 return 0;
1255 } else {
1256 /* If '::' must have less than 16 bytes */
1257 if (v6stat.total == 16)
1258 return 0;
1259 /* More than three zeroes is an error */
1260 if (v6stat.zero_cnt > 3)
1261 return 0;
1262 /* Can only have three zeroes if nothing else present */
1263 else if (v6stat.zero_cnt == 3) {
1264 if (v6stat.total > 0)
1265 return 0;
1266 }
1267 /* Can only have two zeroes if at start or end */
1268 else if (v6stat.zero_cnt == 2) {
1269 if ((v6stat.zero_pos != 0)
1270 && (v6stat.zero_pos != v6stat.total))
1271 return 0;
1272 } else
1273 /* Can only have one zero if *not* start or end */
1274 {
1275 if ((v6stat.zero_pos == 0)
1276 || (v6stat.zero_pos == v6stat.total))
1277 return 0;
1278 }
1279 }
1280
1281 /* Format result */
1282
1283 if (v6stat.zero_pos >= 0) {
1284 /* Copy initial part */
1285 OPENSSL_memcpy(v6, v6stat.tmp, v6stat.zero_pos);
1286 /* Zero middle */
1287 OPENSSL_memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
1288 /* Copy final part */
1289 if (v6stat.total != v6stat.zero_pos)
1290 OPENSSL_memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
1291 v6stat.tmp + v6stat.zero_pos,
1292 v6stat.total - v6stat.zero_pos);
1293 } else
1294 OPENSSL_memcpy(v6, v6stat.tmp, 16);
1295
1296 return 1;
1297}
1298
1299static int ipv6_cb(const char *elem, int len, void *usr)
1300{
1301 IPV6_STAT *s = usr;
1302 /* Error if 16 bytes written */
1303 if (s->total == 16)
1304 return 0;
1305 if (len == 0) {
1306 /* Zero length element, corresponds to '::' */
1307 if (s->zero_pos == -1)
1308 s->zero_pos = s->total;
1309 /* If we've already got a :: its an error */
1310 else if (s->zero_pos != s->total)
1311 return 0;
1312 s->zero_cnt++;
1313 } else {
1314 /* If more than 4 characters could be final a.b.c.d form */
1315 if (len > 4) {
1316 /* Need at least 4 bytes left */
1317 if (s->total > 12)
1318 return 0;
1319 /* Must be end of string */
1320 if (elem[len])
1321 return 0;
1322 if (!ipv4_from_asc(s->tmp + s->total, elem))
1323 return 0;
1324 s->total += 4;
1325 } else {
1326 if (!ipv6_hex(s->tmp + s->total, elem, len))
1327 return 0;
1328 s->total += 2;
1329 }
1330 }
1331 return 1;
1332}
1333
1334/*
1335 * Convert a string of up to 4 hex digits into the corresponding IPv6 form.
1336 */
1337
1338static int ipv6_hex(unsigned char *out, const char *in, int inlen)
1339{
1340 unsigned char c;
1341 unsigned int num = 0;
1342 if (inlen > 4)
1343 return 0;
1344 while (inlen--) {
1345 c = *in++;
1346 num <<= 4;
1347 if ((c >= '0') && (c <= '9'))
1348 num |= c - '0';
1349 else if ((c >= 'A') && (c <= 'F'))
1350 num |= c - 'A' + 10;
1351 else if ((c >= 'a') && (c <= 'f'))
1352 num |= c - 'a' + 10;
1353 else
1354 return 0;
1355 }
1356 out[0] = num >> 8;
1357 out[1] = num & 0xff;
1358 return 1;
1359}
1360
1361int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF (CONF_VALUE) * dn_sk,
1362 unsigned long chtype)
1363{
1364 CONF_VALUE *v;
1365 int mval;
1366 size_t i;
1367 char *p, *type;
1368 if (!nm)
1369 return 0;
1370
1371 for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) {
1372 v = sk_CONF_VALUE_value(dn_sk, i);
1373 type = v->name;
1374 /*
1375 * Skip past any leading X. X: X, etc to allow for multiple instances
1376 */
1377 for (p = type; *p; p++)
1378 if ((*p == ':') || (*p == ',') || (*p == '.')) {
1379 p++;
1380 if (*p)
1381 type = p;
1382 break;
1383 }
1384 if (*type == '+') {
1385 mval = -1;
1386 type++;
1387 } else
1388 mval = 0;
1389 if (!X509_NAME_add_entry_by_txt(nm, type, chtype,
1390 (unsigned char *)v->value, -1, -1,
1391 mval))
1392 return 0;
1393
1394 }
1395 return 1;
1396}
1397