v3_crld.c@ 91772

最後變更在這個檔案從91772是 91772,由 vboxsync 提交於 3 年前
openssl-1.1.1l: Applied and adjusted our OpenSSL changes to 1.1.1l. bugref:10126
檔案大小: 15.1 KB

行
1	/*
2	* Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the OpenSSL license (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stdio.h>
11	#include "internal/cryptlib.h"
12	#include <openssl/conf.h>
13	#include <openssl/asn1.h>
14	#include <openssl/asn1t.h>
15	#include <openssl/x509v3.h>
16
17	#include "crypto/x509.h"
18	#include "ext_dat.h"
19
20	static void v2i_crld(const X509V3_EXT_METHOD method,
21	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval);
22	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
23	int indent);
24
25	const X509V3_EXT_METHOD v3_crld = {
26	NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
27	0, 0, 0, 0,
28	0, 0,
29	0,
30	v2i_crld,
31	i2r_crldp, 0,
32	NULL
33	};
34
35	const X509V3_EXT_METHOD v3_freshest_crl = {
36	NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
37	0, 0, 0, 0,
38	0, 0,
39	0,
40	v2i_crld,
41	i2r_crldp, 0,
42	NULL
43	};
44
45	static STACK_OF(GENERAL_NAME) gnames_from_sectname(X509V3_CTX ctx,
46	char *sect)
47	{
48	STACK_OF(CONF_VALUE) *gnsect;
49	STACK_OF(GENERAL_NAME) *gens;
50	if (*sect == '@')
51	gnsect = X509V3_get_section(ctx, sect + 1);
52	else
53	gnsect = X509V3_parse_list(sect);
54	if (!gnsect) {
55	X509V3err(X509V3_F_GNAMES_FROM_SECTNAME, X509V3_R_SECTION_NOT_FOUND);
56	return NULL;
57	}
58	gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
59	if (*sect == '@')
60	X509V3_section_free(ctx, gnsect);
61	else
62	sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
63	return gens;
64	}
65
66	static int set_dist_point_name(DIST_POINT_NAME *pdp, X509V3_CTX ctx,
67	CONF_VALUE *cnf)
68	{
69	STACK_OF(GENERAL_NAME) *fnm = NULL;
70	STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
71
72	if (strncmp(cnf->name, "fullname", 9) == 0) {
73	fnm = gnames_from_sectname(ctx, cnf->value);
74	if (!fnm)
75	goto err;
76	} else if (strcmp(cnf->name, "relativename") == 0) {
77	int ret;
78	STACK_OF(CONF_VALUE) *dnsect;
79	X509_NAME *nm;
80	nm = X509_NAME_new();
81	if (nm == NULL)
82	return -1;
83	dnsect = X509V3_get_section(ctx, cnf->value);
84	if (!dnsect) {
85	X509V3err(X509V3_F_SET_DIST_POINT_NAME,
86	X509V3_R_SECTION_NOT_FOUND);
87	return -1;
88	}
89	ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
90	X509V3_section_free(ctx, dnsect);
91	rnm = nm->entries;
92	nm->entries = NULL;
93	X509_NAME_free(nm);
94	if (!ret \|\| sk_X509_NAME_ENTRY_num(rnm) <= 0)
95	goto err;
96	/*
97	* Since its a name fragment can't have more than one RDNSequence
98	*/
99	if (sk_X509_NAME_ENTRY_value(rnm,
100	sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
101	X509V3err(X509V3_F_SET_DIST_POINT_NAME,
102	X509V3_R_INVALID_MULTIPLE_RDNS);
103	goto err;
104	}
105	} else
106	return 0;
107
108	if (*pdp) {
109	X509V3err(X509V3_F_SET_DIST_POINT_NAME,
110	X509V3_R_DISTPOINT_ALREADY_SET);
111	goto err;
112	}
113
114	*pdp = DIST_POINT_NAME_new();
115	if (*pdp == NULL)
116	goto err;
117	if (fnm) {
118	(*pdp)->type = 0;
119	(*pdp)->name.fullname = fnm;
120	} else {
121	(*pdp)->type = 1;
122	(*pdp)->name.relativename = rnm;
123	}
124
125	return 1;
126
127	err:
128	sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
129	sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
130	return -1;
131	}
132
133	static const BIT_STRING_BITNAME reason_flags[] = {
134	{0, "Unused", "unused"},
135	{1, "Key Compromise", "keyCompromise"},
136	{2, "CA Compromise", "CACompromise"},
137	{3, "Affiliation Changed", "affiliationChanged"},
138	{4, "Superseded", "superseded"},
139	{5, "Cessation Of Operation", "cessationOfOperation"},
140	{6, "Certificate Hold", "certificateHold"},
141	{7, "Privilege Withdrawn", "privilegeWithdrawn"},
142	{8, "AA Compromise", "AACompromise"},
143	{-1, NULL, NULL}
144	};
145
146	static int set_reasons(ASN1_BIT_STRING *preas, char value)
147	{
148	STACK_OF(CONF_VALUE) *rsk = NULL;
149	const BIT_STRING_BITNAME *pbn;
150	const char *bnam;
151	int i, ret = 0;
152	rsk = X509V3_parse_list(value);
153	if (rsk == NULL)
154	return 0;
155	if (*preas != NULL)
156	goto err;
157	for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
158	bnam = sk_CONF_VALUE_value(rsk, i)->name;
159	if (*preas == NULL) {
160	*preas = ASN1_BIT_STRING_new();
161	if (*preas == NULL)
162	goto err;
163	}
164	for (pbn = reason_flags; pbn->lname; pbn++) {
165	if (strcmp(pbn->sname, bnam) == 0) {
166	if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
167	goto err;
168	break;
169	}
170	}
171	if (!pbn->lname)
172	goto err;
173	}
174	ret = 1;
175
176	err:
177	sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
178	return ret;
179	}
180
181	static int print_reasons(BIO out, const char rname,
182	ASN1_BIT_STRING *rflags, int indent)
183	{
184	int first = 1;
185	const BIT_STRING_BITNAME *pbn;
186	BIO_printf(out, "%s%s:\n%s", indent, "", rname, indent + 2, "");
187	for (pbn = reason_flags; pbn->lname; pbn++) {
188	if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
189	if (first)
190	first = 0;
191	else
192	BIO_puts(out, ", ");
193	BIO_puts(out, pbn->lname);
194	}
195	}
196	if (first)
197	BIO_puts(out, "<EMPTY>\n");
198	else
199	BIO_puts(out, "\n");
200	return 1;
201	}
202
203	static DIST_POINT crldp_from_section(X509V3_CTX ctx,
204	STACK_OF(CONF_VALUE) *nval)
205	{
206	int i;
207	CONF_VALUE *cnf;
208	DIST_POINT *point = DIST_POINT_new();
209
210	if (point == NULL)
211	goto err;
212	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
213	int ret;
214	cnf = sk_CONF_VALUE_value(nval, i);
215	ret = set_dist_point_name(&point->distpoint, ctx, cnf);
216	if (ret > 0)
217	continue;
218	if (ret < 0)
219	goto err;
220	if (strcmp(cnf->name, "reasons") == 0) {
221	if (!set_reasons(&point->reasons, cnf->value))
222	goto err;
223	} else if (strcmp(cnf->name, "CRLissuer") == 0) {
224	point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
225	if (!point->CRLissuer)
226	goto err;
227	}
228	}
229
230	return point;
231
232	err:
233	DIST_POINT_free(point);
234	return NULL;
235	}
236
237	static void v2i_crld(const X509V3_EXT_METHOD method,
238	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval)
239	{
240	STACK_OF(DIST_POINT) *crld;
241	GENERAL_NAMES *gens = NULL;
242	GENERAL_NAME *gen = NULL;
243	CONF_VALUE *cnf;
244	const int num = sk_CONF_VALUE_num(nval);
245	int i;
246
247	crld = sk_DIST_POINT_new_reserve(NULL, num);
248	if (crld == NULL)
249	goto merr;
250	for (i = 0; i < num; i++) {
251	DIST_POINT *point;
252
253	cnf = sk_CONF_VALUE_value(nval, i);
254	if (!cnf->value) {
255	STACK_OF(CONF_VALUE) *dpsect;
256	dpsect = X509V3_get_section(ctx, cnf->name);
257	if (!dpsect)
258	goto err;
259	point = crldp_from_section(ctx, dpsect);
260	X509V3_section_free(ctx, dpsect);
261	if (!point)
262	goto err;
263	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
264	} else {
265	if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
266	goto err;
267	if ((gens = GENERAL_NAMES_new()) == NULL)
268	goto merr;
269	if (!sk_GENERAL_NAME_push(gens, gen))
270	goto merr;
271	gen = NULL;
272	if ((point = DIST_POINT_new()) == NULL)
273	goto merr;
274	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
275	if ((point->distpoint = DIST_POINT_NAME_new()) == NULL)
276	goto merr;
277	point->distpoint->name.fullname = gens;
278	point->distpoint->type = 0;
279	gens = NULL;
280	}
281	}
282	return crld;
283
284	merr:
285	X509V3err(X509V3_F_V2I_CRLD, ERR_R_MALLOC_FAILURE);
286	err:
287	GENERAL_NAME_free(gen);
288	GENERAL_NAMES_free(gens);
289	sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
290	return NULL;
291	}
292
293	static int dpn_cb(int operation, ASN1_VALUE *pval, const ASN1_ITEM it,
294	void *exarg)
295	{
296	DIST_POINT_NAME dpn = (DIST_POINT_NAME )*pval;
297
298	switch (operation) {
299	case ASN1_OP_NEW_POST:
300	dpn->dpname = NULL;
301	break;
302
303	case ASN1_OP_FREE_POST:
304	X509_NAME_free(dpn->dpname);
305	break;
306	}
307	return 1;
308	}
309
310
311	ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
312	ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
313	ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
314	} ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
315
316
317	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
318
319	ASN1_SEQUENCE(DIST_POINT) = {
320	ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
321	ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
322	ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
323	} ASN1_SEQUENCE_END(DIST_POINT)
324
325	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
326
327	ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
328	ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
329	ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
330
331	IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
332
333	ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
334	ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
335	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
336	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
337	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
338	ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
339	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
340	} ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
341
342	IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
343
344	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
345	int indent);
346	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
347	STACK_OF(CONF_VALUE) *nval);
348
349	const X509V3_EXT_METHOD v3_idp = {
350	NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
351	ASN1_ITEM_ref(ISSUING_DIST_POINT),
352	0, 0, 0, 0,
353	0, 0,
354	0,
355	v2i_idp,
356	i2r_idp, 0,
357	NULL
358	};
359
360	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
361	STACK_OF(CONF_VALUE) *nval)
362	{
363	ISSUING_DIST_POINT *idp = NULL;
364	CONF_VALUE *cnf;
365	char name, val;
366	int i, ret;
367	idp = ISSUING_DIST_POINT_new();
368	if (idp == NULL)
369	goto merr;
370	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
371	cnf = sk_CONF_VALUE_value(nval, i);
372	name = cnf->name;
373	val = cnf->value;
374	ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
375	if (ret > 0)
376	continue;
377	if (ret < 0)
378	goto err;
379	if (strcmp(name, "onlyuser") == 0) {
380	if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
381	goto err;
382	} else if (strcmp(name, "onlyCA") == 0) {
383	if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
384	goto err;
385	} else if (strcmp(name, "onlyAA") == 0) {
386	if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
387	goto err;
388	} else if (strcmp(name, "indirectCRL") == 0) {
389	if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
390	goto err;
391	} else if (strcmp(name, "onlysomereasons") == 0) {
392	if (!set_reasons(&idp->onlysomereasons, val))
393	goto err;
394	} else {
395	X509V3err(X509V3_F_V2I_IDP, X509V3_R_INVALID_NAME);
396	X509V3_conf_err(cnf);
397	goto err;
398	}
399	}
400	return idp;
401
402	merr:
403	X509V3err(X509V3_F_V2I_IDP, ERR_R_MALLOC_FAILURE);
404	err:
405	ISSUING_DIST_POINT_free(idp);
406	return NULL;
407	}
408
409	static int print_gens(BIO out, STACK_OF(GENERAL_NAME) gens, int indent)
410	{
411	int i;
412	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
413	BIO_printf(out, "%*s", indent + 2, "");
414	GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
415	BIO_puts(out, "\n");
416	}
417	return 1;
418	}
419
420	static int print_distpoint(BIO out, DIST_POINT_NAME dpn, int indent)
421	{
422	if (dpn->type == 0) {
423	BIO_printf(out, "%*sFull Name:\n", indent, "");
424	print_gens(out, dpn->name.fullname, indent);
425	} else {
426	X509_NAME ntmp;
427	ntmp.entries = dpn->name.relativename;
428	BIO_printf(out, "%sRelative Name:\n%s", indent, "", indent + 2, "");
429	X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
430	BIO_puts(out, "\n");
431	}
432	return 1;
433	}
434
435	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
436	int indent)
437	{
438	ISSUING_DIST_POINT *idp = pidp;
439	if (idp->distpoint)
440	print_distpoint(out, idp->distpoint, indent);
441	if (idp->onlyuser > 0)
442	BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
443	if (idp->onlyCA > 0)
444	BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
445	if (idp->indirectCRL > 0)
446	BIO_printf(out, "%*sIndirect CRL\n", indent, "");
447	if (idp->onlysomereasons)
448	print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
449	if (idp->onlyattr > 0)
450	BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
451	if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
452	&& (idp->indirectCRL <= 0) && !idp->onlysomereasons
453	&& (idp->onlyattr <= 0))
454	BIO_printf(out, "%*s<EMPTY>\n", indent, "");
455
456	return 1;
457	}
458
459	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
460	int indent)
461	{
462	STACK_OF(DIST_POINT) *crld = pcrldp;
463	DIST_POINT *point;
464	int i;
465	for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
466	BIO_puts(out, "\n");
467	point = sk_DIST_POINT_value(crld, i);
468	if (point->distpoint)
469	print_distpoint(out, point->distpoint, indent);
470	if (point->reasons)
471	print_reasons(out, "Reasons", point->reasons, indent);
472	if (point->CRLissuer) {
473	BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
474	print_gens(out, point->CRLissuer, indent);
475	}
476	}
477	return 1;
478	}
479
480	int DIST_POINT_set_dpname(DIST_POINT_NAME dpn, X509_NAME iname)
481	{
482	int i;
483	STACK_OF(X509_NAME_ENTRY) *frag;
484	X509_NAME_ENTRY *ne;
485	if (!dpn \|\| (dpn->type != 1))
486	return 1;
487	frag = dpn->name.relativename;
488	dpn->dpname = X509_NAME_dup(iname);
489	if (!dpn->dpname)
490	return 0;
491	for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
492	ne = sk_X509_NAME_ENTRY_value(frag, i);
493	if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1)) {
494	X509_NAME_free(dpn->dpname);
495	dpn->dpname = NULL;
496	return 0;
497	}
498	}
499	/* generate cached encoding of name */
500	if (i2d_X509_NAME(dpn->dpname, NULL) < 0) {
501	X509_NAME_free(dpn->dpname);
502	dpn->dpname = NULL;
503	return 0;
504	}
505	return 1;
506	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-1.1.1l/crypto/x509v3/v3_crld.c@ 91772

以其他格式下載: