v3_crld.c@ 108358

最後變更在這個檔案從108358是 108206,由 vboxsync 提交於 6 週前
openssl-3.3.2: Exported all files to OSE and removed .scm-settings bugref:10757
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 15.6 KB

行
1	/*
2	* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stdio.h>
11	#include "internal/cryptlib.h"
12	#include <openssl/conf.h>
13	#include <openssl/asn1.h>
14	#include <openssl/asn1t.h>
15	#include <openssl/x509v3.h>
16
17	#include "crypto/x509.h"
18	#include "ext_dat.h"
19	#include "x509_local.h"
20
21	static void v2i_crld(const X509V3_EXT_METHOD method,
22	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval);
23	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
24	int indent);
25
26	const X509V3_EXT_METHOD ossl_v3_crld = {
27	NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
28	0, 0, 0, 0,
29	0, 0,
30	0,
31	v2i_crld,
32	i2r_crldp, 0,
33	NULL
34	};
35
36	const X509V3_EXT_METHOD ossl_v3_freshest_crl = {
37	NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
38	0, 0, 0, 0,
39	0, 0,
40	0,
41	v2i_crld,
42	i2r_crldp, 0,
43	NULL
44	};
45
46	static STACK_OF(GENERAL_NAME) gnames_from_sectname(X509V3_CTX ctx,
47	char *sect)
48	{
49	STACK_OF(CONF_VALUE) *gnsect;
50	STACK_OF(GENERAL_NAME) *gens;
51	if (*sect == '@')
52	gnsect = X509V3_get_section(ctx, sect + 1);
53	else
54	gnsect = X509V3_parse_list(sect);
55	if (!gnsect) {
56	ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
57	return NULL;
58	}
59	gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
60	if (*sect == '@')
61	X509V3_section_free(ctx, gnsect);
62	else
63	sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
64	return gens;
65	}
66
67	static int set_dist_point_name(DIST_POINT_NAME *pdp, X509V3_CTX ctx,
68	CONF_VALUE *cnf)
69	{
70	STACK_OF(GENERAL_NAME) *fnm = NULL;
71	STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
72
73	if (cnf->value == NULL) {
74	ERR_raise(ERR_LIB_X509V3, X509V3_R_MISSING_VALUE);
75	goto err;
76	}
77
78	if (HAS_PREFIX(cnf->name, "fullname")) {
79	fnm = gnames_from_sectname(ctx, cnf->value);
80	if (!fnm)
81	goto err;
82	} else if (strcmp(cnf->name, "relativename") == 0) {
83	int ret;
84	STACK_OF(CONF_VALUE) *dnsect;
85	X509_NAME *nm;
86	nm = X509_NAME_new();
87	if (nm == NULL)
88	return -1;
89	dnsect = X509V3_get_section(ctx, cnf->value);
90	if (!dnsect) {
91	X509_NAME_free(nm);
92	ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
93	return -1;
94	}
95	ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
96	X509V3_section_free(ctx, dnsect);
97	rnm = nm->entries;
98	nm->entries = NULL;
99	X509_NAME_free(nm);
100	if (!ret \|\| sk_X509_NAME_ENTRY_num(rnm) <= 0)
101	goto err;
102	/*
103	* Since its a name fragment can't have more than one RDNSequence
104	*/
105	if (sk_X509_NAME_ENTRY_value(rnm,
106	sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
107	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_MULTIPLE_RDNS);
108	goto err;
109	}
110	} else
111	return 0;
112
113	if (*pdp) {
114	ERR_raise(ERR_LIB_X509V3, X509V3_R_DISTPOINT_ALREADY_SET);
115	goto err;
116	}
117
118	*pdp = DIST_POINT_NAME_new();
119	if (*pdp == NULL)
120	goto err;
121	if (fnm) {
122	(*pdp)->type = 0;
123	(*pdp)->name.fullname = fnm;
124	} else {
125	(*pdp)->type = 1;
126	(*pdp)->name.relativename = rnm;
127	}
128
129	return 1;
130
131	err:
132	sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
133	sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
134	return -1;
135	}
136
137	static const BIT_STRING_BITNAME reason_flags[] = {
138	{0, "Unused", "unused"},
139	{1, "Key Compromise", "keyCompromise"},
140	{2, "CA Compromise", "CACompromise"},
141	{3, "Affiliation Changed", "affiliationChanged"},
142	{4, "Superseded", "superseded"},
143	{5, "Cessation Of Operation", "cessationOfOperation"},
144	{6, "Certificate Hold", "certificateHold"},
145	{7, "Privilege Withdrawn", "privilegeWithdrawn"},
146	{8, "AA Compromise", "AACompromise"},
147	{-1, NULL, NULL}
148	};
149
150	static int set_reasons(ASN1_BIT_STRING *preas, char value)
151	{
152	STACK_OF(CONF_VALUE) *rsk = NULL;
153	const BIT_STRING_BITNAME *pbn;
154	const char *bnam;
155	int i, ret = 0;
156	rsk = X509V3_parse_list(value);
157	if (rsk == NULL)
158	return 0;
159	if (*preas != NULL)
160	goto err;
161	for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
162	bnam = sk_CONF_VALUE_value(rsk, i)->name;
163	if (*preas == NULL) {
164	*preas = ASN1_BIT_STRING_new();
165	if (*preas == NULL)
166	goto err;
167	}
168	for (pbn = reason_flags; pbn->lname; pbn++) {
169	if (strcmp(pbn->sname, bnam) == 0) {
170	if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
171	goto err;
172	break;
173	}
174	}
175	if (pbn->lname == NULL)
176	goto err;
177	}
178	ret = 1;
179
180	err:
181	sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
182	return ret;
183	}
184
185	static int print_reasons(BIO out, const char rname,
186	ASN1_BIT_STRING *rflags, int indent)
187	{
188	int first = 1;
189	const BIT_STRING_BITNAME *pbn;
190	BIO_printf(out, "%s%s:\n%s", indent, "", rname, indent + 2, "");
191	for (pbn = reason_flags; pbn->lname; pbn++) {
192	if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
193	if (first)
194	first = 0;
195	else
196	BIO_puts(out, ", ");
197	BIO_puts(out, pbn->lname);
198	}
199	}
200	if (first)
201	BIO_puts(out, "<EMPTY>\n");
202	else
203	BIO_puts(out, "\n");
204	return 1;
205	}
206
207	static DIST_POINT crldp_from_section(X509V3_CTX ctx,
208	STACK_OF(CONF_VALUE) *nval)
209	{
210	int i;
211	CONF_VALUE *cnf;
212	DIST_POINT *point = DIST_POINT_new();
213
214	if (point == NULL)
215	goto err;
216	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
217	int ret;
218	cnf = sk_CONF_VALUE_value(nval, i);
219	ret = set_dist_point_name(&point->distpoint, ctx, cnf);
220	if (ret > 0)
221	continue;
222	if (ret < 0)
223	goto err;
224	if (strcmp(cnf->name, "reasons") == 0) {
225	if (!set_reasons(&point->reasons, cnf->value))
226	goto err;
227	} else if (strcmp(cnf->name, "CRLissuer") == 0) {
228	point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
229	if (point->CRLissuer == NULL)
230	goto err;
231	}
232	}
233
234	return point;
235
236	err:
237	DIST_POINT_free(point);
238	return NULL;
239	}
240
241	static void v2i_crld(const X509V3_EXT_METHOD method,
242	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval)
243	{
244	STACK_OF(DIST_POINT) *crld;
245	GENERAL_NAMES *gens = NULL;
246	GENERAL_NAME *gen = NULL;
247	CONF_VALUE *cnf;
248	const int num = sk_CONF_VALUE_num(nval);
249	int i;
250
251	crld = sk_DIST_POINT_new_reserve(NULL, num);
252	if (crld == NULL) {
253	ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
254	goto err;
255	}
256	for (i = 0; i < num; i++) {
257	DIST_POINT *point;
258
259	cnf = sk_CONF_VALUE_value(nval, i);
260	if (cnf->value == NULL) {
261	STACK_OF(CONF_VALUE) *dpsect;
262	dpsect = X509V3_get_section(ctx, cnf->name);
263	if (!dpsect)
264	goto err;
265	point = crldp_from_section(ctx, dpsect);
266	X509V3_section_free(ctx, dpsect);
267	if (point == NULL)
268	goto err;
269	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
270	} else {
271	if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
272	goto err;
273	if ((gens = GENERAL_NAMES_new()) == NULL) {
274	ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
275	goto err;
276	}
277	if (!sk_GENERAL_NAME_push(gens, gen)) {
278	ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
279	goto err;
280	}
281	gen = NULL;
282	if ((point = DIST_POINT_new()) == NULL) {
283	ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
284	goto err;
285	}
286	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
287	if ((point->distpoint = DIST_POINT_NAME_new()) == NULL) {
288	ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
289	goto err;
290	}
291	point->distpoint->name.fullname = gens;
292	point->distpoint->type = 0;
293	gens = NULL;
294	}
295	}
296	return crld;
297
298	err:
299	GENERAL_NAME_free(gen);
300	GENERAL_NAMES_free(gens);
301	sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
302	return NULL;
303	}
304
305	static int dpn_cb(int operation, ASN1_VALUE *pval, const ASN1_ITEM it,
306	void *exarg)
307	{
308	DIST_POINT_NAME dpn = (DIST_POINT_NAME )*pval;
309
310	switch (operation) {
311	case ASN1_OP_NEW_POST:
312	dpn->dpname = NULL;
313	break;
314
315	case ASN1_OP_FREE_POST:
316	X509_NAME_free(dpn->dpname);
317	break;
318	}
319	return 1;
320	}
321
322
323	ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
324	ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
325	ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
326	} ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
327
328
329	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
330
331	ASN1_SEQUENCE(DIST_POINT) = {
332	ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
333	ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
334	ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
335	} ASN1_SEQUENCE_END(DIST_POINT)
336
337	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
338
339	ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
340	ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
341	ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
342
343	IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
344
345	ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
346	ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
347	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
348	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
349	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
350	ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
351	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
352	} ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
353
354	IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
355
356	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
357	int indent);
358	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
359	STACK_OF(CONF_VALUE) *nval);
360
361	const X509V3_EXT_METHOD ossl_v3_idp = {
362	NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
363	ASN1_ITEM_ref(ISSUING_DIST_POINT),
364	0, 0, 0, 0,
365	0, 0,
366	0,
367	v2i_idp,
368	i2r_idp, 0,
369	NULL
370	};
371
372	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
373	STACK_OF(CONF_VALUE) *nval)
374	{
375	ISSUING_DIST_POINT *idp = NULL;
376	CONF_VALUE *cnf;
377	char name, val;
378	int i, ret;
379	idp = ISSUING_DIST_POINT_new();
380	if (idp == NULL) {
381	ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
382	goto err;
383	}
384	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
385	cnf = sk_CONF_VALUE_value(nval, i);
386	name = cnf->name;
387	val = cnf->value;
388	ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
389	if (ret > 0)
390	continue;
391	if (ret < 0)
392	goto err;
393	if (strcmp(name, "onlyuser") == 0) {
394	if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
395	goto err;
396	} else if (strcmp(name, "onlyCA") == 0) {
397	if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
398	goto err;
399	} else if (strcmp(name, "onlyAA") == 0) {
400	if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
401	goto err;
402	} else if (strcmp(name, "indirectCRL") == 0) {
403	if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
404	goto err;
405	} else if (strcmp(name, "onlysomereasons") == 0) {
406	if (!set_reasons(&idp->onlysomereasons, val))
407	goto err;
408	} else {
409	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME);
410	X509V3_conf_add_error_name_value(cnf);
411	goto err;
412	}
413	}
414	return idp;
415
416	err:
417	ISSUING_DIST_POINT_free(idp);
418	return NULL;
419	}
420
421	static int print_gens(BIO out, STACK_OF(GENERAL_NAME) gens, int indent)
422	{
423	int i;
424	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
425	if (i > 0)
426	BIO_puts(out, "\n");
427	BIO_printf(out, "%*s", indent + 2, "");
428	GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
429	}
430	return 1;
431	}
432
433	static int print_distpoint(BIO out, DIST_POINT_NAME dpn, int indent)
434	{
435	if (dpn->type == 0) {
436	BIO_printf(out, "%*sFull Name:\n", indent, "");
437	print_gens(out, dpn->name.fullname, indent);
438	} else {
439	X509_NAME ntmp;
440	ntmp.entries = dpn->name.relativename;
441	BIO_printf(out, "%sRelative Name:\n%s", indent, "", indent + 2, "");
442	X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
443	BIO_puts(out, "\n");
444	}
445	return 1;
446	}
447
448	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
449	int indent)
450	{
451	ISSUING_DIST_POINT *idp = pidp;
452	if (idp->distpoint)
453	print_distpoint(out, idp->distpoint, indent);
454	if (idp->onlyuser > 0)
455	BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
456	if (idp->onlyCA > 0)
457	BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
458	if (idp->indirectCRL > 0)
459	BIO_printf(out, "%*sIndirect CRL\n", indent, "");
460	if (idp->onlysomereasons)
461	print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
462	if (idp->onlyattr > 0)
463	BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
464	if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
465	&& (idp->indirectCRL <= 0) && !idp->onlysomereasons
466	&& (idp->onlyattr <= 0))
467	BIO_printf(out, "%*s<EMPTY>\n", indent, "");
468
469	return 1;
470	}
471
472	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
473	int indent)
474	{
475	STACK_OF(DIST_POINT) *crld = pcrldp;
476	DIST_POINT *point;
477	int i;
478	for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
479	if (i > 0)
480	BIO_puts(out, "\n");
481	point = sk_DIST_POINT_value(crld, i);
482	if (point->distpoint)
483	print_distpoint(out, point->distpoint, indent);
484	if (point->reasons)
485	print_reasons(out, "Reasons", point->reasons, indent);
486	if (point->CRLissuer) {
487	BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
488	print_gens(out, point->CRLissuer, indent);
489	}
490	}
491	return 1;
492	}
493
494	/* Append any nameRelativeToCRLIssuer in dpn to iname, set in dpn->dpname */
495	int DIST_POINT_set_dpname(DIST_POINT_NAME dpn, const X509_NAME iname)
496	{
497	int i;
498	STACK_OF(X509_NAME_ENTRY) *frag;
499	X509_NAME_ENTRY *ne;
500
501	if (dpn == NULL \|\| dpn->type != 1)
502	return 1;
503	frag = dpn->name.relativename;
504	X509_NAME_free(dpn->dpname); /* just in case it was already set */
505	dpn->dpname = X509_NAME_dup(iname);
506	if (dpn->dpname == NULL)
507	return 0;
508	for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
509	ne = sk_X509_NAME_ENTRY_value(frag, i);
510	if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1))
511	goto err;
512	}
513	/* generate cached encoding of name */
514	if (i2d_X509_NAME(dpn->dpname, NULL) >= 0)
515	return 1;
516
517	err:
518	X509_NAME_free(dpn->dpname);
519	dpn->dpname = NULL;
520	return 0;
521	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.3.2/crypto/x509/v3_crld.c@ 108358

以其他格式下載: