VirtualBox

source: vbox/trunk/src/libs/openssl-3.3.2/crypto/x509/v3_conf.c@ 108358

最後變更 在這個檔案從108358是 108206,由 vboxsync 提交於 6 週 前

openssl-3.3.2: Exported all files to OSE and removed .scm-settings ​bugref:10757
  • 屬性 svn:eol-style 設為 native
  • 屬性 svn:keywords 設為 Author Date Id Revision
檔案大小: 17.6 KB
行 
1/*
2 * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/* extension creation utilities */
11
12#include <stdio.h>
13#include "crypto/ctype.h"
14#include "internal/cryptlib.h"
15#include <openssl/conf.h>
16#include <openssl/x509.h>
17#include "crypto/x509.h"
18#include <openssl/x509v3.h>
19
20static int v3_check_critical(const char **value);
21static int v3_check_generic(const char **value);
22static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
23 int crit, const char *value);
24static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
25 int crit, int type,
26 X509V3_CTX *ctx);
27static char *conf_lhash_get_string(void *db, const char *section, const char *value);
28static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, const char *section);
29static X509_EXTENSION *do_ext_i2d(const X509V3_EXT_METHOD *method,
30 int ext_nid, int crit, void *ext_struc);
31static unsigned char *generic_asn1(const char *value, X509V3_CTX *ctx,
32 long *ext_len);
33
34static X509_EXTENSION *X509V3_EXT_nconf_int(CONF *conf, X509V3_CTX *ctx,
35 const char *section,
36 const char *name, const char *value)
37{
38 int crit;
39 int ext_type;
40 X509_EXTENSION *ret;
41
42 crit = v3_check_critical(&value);
43 if ((ext_type = v3_check_generic(&value)))
44 return v3_generic_extension(name, value, crit, ext_type, ctx);
45 ret = do_ext_nconf(conf, ctx, OBJ_sn2nid(name), crit, value);
46 if (!ret) {
47 if (section != NULL)
48 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_ERROR_IN_EXTENSION,
49 "section=%s, name=%s, value=%s",
50 section, name, value);
51 else
52 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_ERROR_IN_EXTENSION,
53 "name=%s, value=%s", name, value);
54 }
55 return ret;
56}
57
58X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, const char *name,
59 const char *value)
60{
61 return X509V3_EXT_nconf_int(conf, ctx, NULL, name, value);
62}
63
64X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
65 const char *value)
66{
67 int crit;
68 int ext_type;
69
70 crit = v3_check_critical(&value);
71 if ((ext_type = v3_check_generic(&value)))
72 return v3_generic_extension(OBJ_nid2sn(ext_nid),
73 value, crit, ext_type, ctx);
74 return do_ext_nconf(conf, ctx, ext_nid, crit, value);
75}
76
77/* CONF *conf: Config file */
78/* char *value: Value */
79static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
80 int crit, const char *value)
81{
82 const X509V3_EXT_METHOD *method;
83 X509_EXTENSION *ext;
84 STACK_OF(CONF_VALUE) *nval;
85 void *ext_struc;
86
87 if (ext_nid == NID_undef) {
88 ERR_raise(ERR_LIB_X509V3, X509V3_R_UNKNOWN_EXTENSION_NAME);
89 return NULL;
90 }
91 if ((method = X509V3_EXT_get_nid(ext_nid)) == NULL) {
92 ERR_raise(ERR_LIB_X509V3, X509V3_R_UNKNOWN_EXTENSION);
93 return NULL;
94 }
95 /* Now get internal extension representation based on type */
96 if (method->v2i) {
97 if (*value == '@')
98 nval = NCONF_get_section(conf, value + 1);
99 else
100 nval = X509V3_parse_list(value);
101 if (nval == NULL || sk_CONF_VALUE_num(nval) <= 0) {
102 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_INVALID_EXTENSION_STRING,
103 "name=%s,section=%s", OBJ_nid2sn(ext_nid), value);
104 if (*value != '@')
105 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
106 return NULL;
107 }
108 ext_struc = method->v2i(method, ctx, nval);
109 if (*value != '@')
110 sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
111 if (!ext_struc)
112 return NULL;
113 } else if (method->s2i) {
114 if ((ext_struc = method->s2i(method, ctx, value)) == NULL)
115 return NULL;
116 } else if (method->r2i) {
117 if (!ctx->db || !ctx->db_meth) {
118 ERR_raise(ERR_LIB_X509V3, X509V3_R_NO_CONFIG_DATABASE);
119 return NULL;
120 }
121 if ((ext_struc = method->r2i(method, ctx, value)) == NULL)
122 return NULL;
123 } else {
124 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED,
125 "name=%s", OBJ_nid2sn(ext_nid));
126 return NULL;
127 }
128
129 ext = do_ext_i2d(method, ext_nid, crit, ext_struc);
130 if (method->it)
131 ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
132 else
133 method->ext_free(ext_struc);
134 return ext;
135
136}
137
138static X509_EXTENSION *do_ext_i2d(const X509V3_EXT_METHOD *method,
139 int ext_nid, int crit, void *ext_struc)
140{
141 unsigned char *ext_der = NULL;
142 int ext_len;
143 ASN1_OCTET_STRING *ext_oct = NULL;
144 X509_EXTENSION *ext;
145
146 /* Convert internal representation to DER */
147 if (method->it) {
148 ext_der = NULL;
149 ext_len =
150 ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it));
151 if (ext_len < 0) {
152 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
153 goto err;
154 }
155 } else {
156 unsigned char *p;
157
158 ext_len = method->i2d(ext_struc, NULL);
159 if (ext_len <= 0) {
160 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
161 goto err;
162 }
163 if ((ext_der = OPENSSL_malloc(ext_len)) == NULL)
164 goto err;
165 p = ext_der;
166 method->i2d(ext_struc, &p);
167 }
168 if ((ext_oct = ASN1_OCTET_STRING_new()) == NULL) {
169 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
170 goto err;
171 }
172 ext_oct->data = ext_der;
173 ext_der = NULL;
174 ext_oct->length = ext_len;
175
176 ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
177 if (!ext) {
178 ERR_raise(ERR_LIB_X509V3, ERR_R_X509V3_LIB);
179 goto err;
180 }
181 ASN1_OCTET_STRING_free(ext_oct);
182
183 return ext;
184
185 err:
186 OPENSSL_free(ext_der);
187 ASN1_OCTET_STRING_free(ext_oct);
188 return NULL;
189
190}
191
192/* Given an internal structure, nid and critical flag create an extension */
193
194X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc)
195{
196 const X509V3_EXT_METHOD *method;
197
198 if ((method = X509V3_EXT_get_nid(ext_nid)) == NULL) {
199 ERR_raise(ERR_LIB_X509V3, X509V3_R_UNKNOWN_EXTENSION);
200 return NULL;
201 }
202 return do_ext_i2d(method, ext_nid, crit, ext_struc);
203}
204
205/* Check the extension string for critical flag */
206static int v3_check_critical(const char **value)
207{
208 const char *p = *value;
209
210 if (!CHECK_AND_SKIP_PREFIX(p, "critical,"))
211 return 0;
212 while (ossl_isspace(*p))
213 p++;
214 *value = p;
215 return 1;
216}
217
218/* Check extension string for generic extension and return the type */
219static int v3_check_generic(const char **value)
220{
221 int gen_type = 0;
222 const char *p = *value;
223
224 if (CHECK_AND_SKIP_PREFIX(p, "DER:")) {
225 gen_type = 1;
226 } else if (CHECK_AND_SKIP_PREFIX(p, "ASN1:")) {
227 gen_type = 2;
228 } else
229 return 0;
230
231 while (ossl_isspace(*p))
232 p++;
233 *value = p;
234 return gen_type;
235}
236
237/* Create a generic extension: for now just handle DER type */
238static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
239 int crit, int gen_type,
240 X509V3_CTX *ctx)
241{
242 unsigned char *ext_der = NULL;
243 long ext_len = 0;
244 ASN1_OBJECT *obj = NULL;
245 ASN1_OCTET_STRING *oct = NULL;
246 X509_EXTENSION *extension = NULL;
247
248 if ((obj = OBJ_txt2obj(ext, 0)) == NULL) {
249 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_EXTENSION_NAME_ERROR,
250 "name=%s", ext);
251 goto err;
252 }
253
254 if (gen_type == 1)
255 ext_der = OPENSSL_hexstr2buf(value, &ext_len);
256 else if (gen_type == 2)
257 ext_der = generic_asn1(value, ctx, &ext_len);
258
259 if (ext_der == NULL) {
260 ERR_raise_data(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR,
261 "value=%s", value);
262 goto err;
263 }
264
265 if ((oct = ASN1_OCTET_STRING_new()) == NULL) {
266 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
267 goto err;
268 }
269
270 oct->data = ext_der;
271 oct->length = ext_len;
272 ext_der = NULL;
273
274 extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
275
276 err:
277 ASN1_OBJECT_free(obj);
278 ASN1_OCTET_STRING_free(oct);
279 OPENSSL_free(ext_der);
280 return extension;
281
282}
283
284static unsigned char *generic_asn1(const char *value, X509V3_CTX *ctx,
285 long *ext_len)
286{
287 ASN1_TYPE *typ;
288 unsigned char *ext_der = NULL;
289
290 typ = ASN1_generate_v3(value, ctx);
291 if (typ == NULL)
292 return NULL;
293 *ext_len = i2d_ASN1_TYPE(typ, &ext_der);
294 ASN1_TYPE_free(typ);
295 return ext_der;
296}
297
298static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
299{
300 int idx;
301 ASN1_OBJECT *obj;
302
303 obj = X509_EXTENSION_get_object(dext);
304 while ((idx = X509v3_get_ext_by_OBJ(sk, obj, -1)) >= 0)
305 X509_EXTENSION_free(X509v3_delete_ext(sk, idx));
306}
307
308/*
309 * This is the main function: add a bunch of extensions based on a config
310 * file section to an extension STACK. Just check in case sk == NULL.
311 * Note that on error new elements may have been added to *sk if sk != NULL.
312 */
313int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, const char *section,
314 STACK_OF(X509_EXTENSION) **sk)
315{
316 X509_EXTENSION *ext;
317 STACK_OF(CONF_VALUE) *nval;
318 const CONF_VALUE *val;
319 int i, akid = -1, skid = -1;
320
321 if ((nval = NCONF_get_section(conf, section)) == NULL)
322 return 0;
323 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
324 val = sk_CONF_VALUE_value(nval, i);
325 if (strcmp(val->name, "authorityKeyIdentifier") == 0)
326 akid = i;
327 else if (strcmp(val->name, "subjectKeyIdentifier") == 0)
328 skid = i;
329 }
330 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
331 val = sk_CONF_VALUE_value(nval, i);
332 if (skid > akid && akid >= 0) {
333 /* make sure SKID is handled before AKID */
334 if (i == akid)
335 val = sk_CONF_VALUE_value(nval, skid);
336 else if (i == skid)
337 val = sk_CONF_VALUE_value(nval, akid);
338 }
339 if ((ext = X509V3_EXT_nconf_int(conf, ctx, val->section,
340 val->name, val->value)) == NULL)
341 return 0;
342 if (sk != NULL) {
343 if (ctx->flags == X509V3_CTX_REPLACE)
344 delete_ext(*sk, ext);
345 if (X509v3_add_ext(sk, ext, -1) == NULL) {
346 X509_EXTENSION_free(ext);
347 return 0;
348 }
349 }
350 X509_EXTENSION_free(ext);
351 }
352 return 1;
353}
354
355/*
356 * Add extensions to a certificate. Just check in case cert == NULL.
357 * Note that on error new elements may remain added to cert if cert != NULL.
358 */
359int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section,
360 X509 *cert)
361{
362 STACK_OF(X509_EXTENSION) **sk = NULL;
363 if (cert != NULL)
364 sk = &cert->cert_info.extensions;
365 return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
366}
367
368/*
369 * Add extensions to a CRL. Just check in case crl == NULL.
370 * Note that on error new elements may remain added to crl if crl != NULL.
371 */
372int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section,
373 X509_CRL *crl)
374{
375 STACK_OF(X509_EXTENSION) **sk = NULL;
376 if (crl != NULL)
377 sk = &crl->crl.extensions;
378 return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
379}
380
381/*
382 * Add extensions to certificate request. Just check in case req is NULL.
383 * Note that on error new elements may remain added to req if req != NULL.
384 */
385int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section,
386 X509_REQ *req)
387{
388 STACK_OF(X509_EXTENSION) *exts = NULL;
389 int ret = X509V3_EXT_add_nconf_sk(conf, ctx, section, &exts);
390
391 if (ret && req != NULL && exts != NULL)
392 ret = X509_REQ_add_extensions(req, exts);
393 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
394 return ret;
395}
396
397/* Config database functions */
398
399char *X509V3_get_string(X509V3_CTX *ctx, const char *name, const char *section)
400{
401 if (!ctx->db || !ctx->db_meth || !ctx->db_meth->get_string) {
402 ERR_raise(ERR_LIB_X509V3, X509V3_R_OPERATION_NOT_DEFINED);
403 return NULL;
404 }
405 if (ctx->db_meth->get_string)
406 return ctx->db_meth->get_string(ctx->db, name, section);
407 return NULL;
408}
409
410STACK_OF(CONF_VALUE) *X509V3_get_section(X509V3_CTX *ctx, const char *section)
411{
412 if (!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section) {
413 ERR_raise(ERR_LIB_X509V3, X509V3_R_OPERATION_NOT_DEFINED);
414 return NULL;
415 }
416 if (ctx->db_meth->get_section)
417 return ctx->db_meth->get_section(ctx->db, section);
418 return NULL;
419}
420
421void X509V3_string_free(X509V3_CTX *ctx, char *str)
422{
423 if (!str)
424 return;
425 if (ctx->db_meth->free_string)
426 ctx->db_meth->free_string(ctx->db, str);
427}
428
429void X509V3_section_free(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section)
430{
431 if (!section)
432 return;
433 if (ctx->db_meth->free_section)
434 ctx->db_meth->free_section(ctx->db, section);
435}
436
437static char *nconf_get_string(void *db, const char *section, const char *value)
438{
439 return NCONF_get_string(db, section, value);
440}
441
442static STACK_OF(CONF_VALUE) *nconf_get_section(void *db, const char *section)
443{
444 return NCONF_get_section(db, section);
445}
446
447static X509V3_CONF_METHOD nconf_method = {
448 nconf_get_string,
449 nconf_get_section,
450 NULL,
451 NULL
452};
453
454void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf)
455{
456 if (ctx == NULL) {
457 ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_NULL_PARAMETER);
458 return;
459 }
460 ctx->db_meth = &nconf_method;
461 ctx->db = conf;
462}
463
464void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subj, X509_REQ *req,
465 X509_CRL *crl, int flags)
466{
467 if (ctx == NULL) {
468 ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_NULL_PARAMETER);
469 return;
470 }
471 ctx->flags = flags;
472 ctx->issuer_cert = issuer;
473 ctx->subject_cert = subj;
474 ctx->subject_req = req;
475 ctx->crl = crl;
476 ctx->db_meth = NULL;
477 ctx->db = NULL;
478 ctx->issuer_pkey = NULL;
479}
480
481/* For API backward compatibility, this is separate from X509V3_set_ctx() */
482int X509V3_set_issuer_pkey(X509V3_CTX *ctx, EVP_PKEY *pkey)
483{
484 if (ctx == NULL) {
485 ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_NULL_PARAMETER);
486 return 0;
487 }
488 if (ctx->subject_cert == NULL && pkey != NULL) {
489 ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_INVALID_ARGUMENT);
490 return 0;
491 }
492 ctx->issuer_pkey = pkey;
493 return 1;
494}
495
496/* Old conf compatibility functions */
497
498X509_EXTENSION *X509V3_EXT_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
499 const char *name, const char *value)
500{
501 CONF *ctmp;
502 X509_EXTENSION *ret;
503
504 if ((ctmp = NCONF_new(NULL)) == NULL)
505 return NULL;
506 CONF_set_nconf(ctmp, conf);
507 ret = X509V3_EXT_nconf(ctmp, ctx, name, value);
508 CONF_set_nconf(ctmp, NULL);
509 NCONF_free(ctmp);
510 return ret;
511}
512
513X509_EXTENSION *X509V3_EXT_conf_nid(LHASH_OF(CONF_VALUE) *conf,
514 X509V3_CTX *ctx, int ext_nid, const char *value)
515{
516 CONF *ctmp;
517 X509_EXTENSION *ret;
518
519 if ((ctmp = NCONF_new(NULL)) == NULL)
520 return NULL;
521 CONF_set_nconf(ctmp, conf);
522 ret = X509V3_EXT_nconf_nid(ctmp, ctx, ext_nid, value);
523 CONF_set_nconf(ctmp, NULL);
524 NCONF_free(ctmp);
525 return ret;
526}
527
528static char *conf_lhash_get_string(void *db, const char *section, const char *value)
529{
530 return CONF_get_string(db, section, value);
531}
532
533static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, const char *section)
534{
535 return CONF_get_section(db, section);
536}
537
538static X509V3_CONF_METHOD conf_lhash_method = {
539 conf_lhash_get_string,
540 conf_lhash_get_section,
541 NULL,
542 NULL
543};
544
545void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH_OF(CONF_VALUE) *lhash)
546{
547 if (ctx == NULL) {
548 ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_NULL_PARAMETER);
549 return;
550 }
551 ctx->db_meth = &conf_lhash_method;
552 ctx->db = lhash;
553}
554
555int X509V3_EXT_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
556 const char *section, X509 *cert)
557{
558 CONF *ctmp;
559 int ret;
560
561 if ((ctmp = NCONF_new(NULL)) == NULL)
562 return 0;
563 CONF_set_nconf(ctmp, conf);
564 ret = X509V3_EXT_add_nconf(ctmp, ctx, section, cert);
565 CONF_set_nconf(ctmp, NULL);
566 NCONF_free(ctmp);
567 return ret;
568}
569
570/* Same as above but for a CRL */
571
572int X509V3_EXT_CRL_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
573 const char *section, X509_CRL *crl)
574{
575 CONF *ctmp;
576 int ret;
577
578 if ((ctmp = NCONF_new(NULL)) == NULL)
579 return 0;
580 CONF_set_nconf(ctmp, conf);
581 ret = X509V3_EXT_CRL_add_nconf(ctmp, ctx, section, crl);
582 CONF_set_nconf(ctmp, NULL);
583 NCONF_free(ctmp);
584 return ret;
585}
586
587/* Add extensions to certificate request */
588
589int X509V3_EXT_REQ_add_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx,
590 const char *section, X509_REQ *req)
591{
592 CONF *ctmp;
593 int ret;
594
595 if ((ctmp = NCONF_new(NULL)) == NULL)
596 return 0;
597 CONF_set_nconf(ctmp, conf);
598 ret = X509V3_EXT_REQ_add_nconf(ctmp, ctx, section, req);
599 CONF_set_nconf(ctmp, NULL);
600 NCONF_free(ctmp);
601 return ret;
602}
注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette