v3_asid.c@ 107278

最後變更在這個檔案從107278是 104078,由 vboxsync 提交於 11 月前
openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
檔案大小: 26.7 KB

行
1	/*
2	* Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	/*
11	* Implementation of RFC 3779 section 3.2.
12	*/
13
14	#include <assert.h>
15	#include <stdio.h>
16	#include <string.h>
17	#include "internal/cryptlib.h"
18	#include <openssl/conf.h>
19	#include <openssl/asn1.h>
20	#include <openssl/asn1t.h>
21	#include <openssl/x509v3.h>
22	#include <openssl/x509.h>
23	#include "crypto/x509.h"
24	#include <openssl/bn.h>
25	#include "ext_dat.h"
26	#include "x509_local.h"
27
28	#ifndef OPENSSL_NO_RFC3779
29
30	/*
31	* OpenSSL ASN.1 template translation of RFC 3779 3.2.3.
32	*/
33
34	ASN1_SEQUENCE(ASRange) = {
35	ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
36	ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
37	} ASN1_SEQUENCE_END(ASRange)
38
39	ASN1_CHOICE(ASIdOrRange) = {
40	ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER),
41	ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
42	} ASN1_CHOICE_END(ASIdOrRange)
43
44	ASN1_CHOICE(ASIdentifierChoice) = {
45	ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL),
46	ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
47	} ASN1_CHOICE_END(ASIdentifierChoice)
48
49	ASN1_SEQUENCE(ASIdentifiers) = {
50	ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
51	ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1)
52	} ASN1_SEQUENCE_END(ASIdentifiers)
53
54	IMPLEMENT_ASN1_FUNCTIONS(ASRange)
55	IMPLEMENT_ASN1_FUNCTIONS(ASIdOrRange)
56	IMPLEMENT_ASN1_FUNCTIONS(ASIdentifierChoice)
57	IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
58
59	/*
60	* i2r method for an ASIdentifierChoice.
61	*/
62	static int i2r_ASIdentifierChoice(BIO *out,
63	ASIdentifierChoice *choice,
64	int indent, const char *msg)
65	{
66	int i;
67	char *s;
68	if (choice == NULL)
69	return 1;
70	BIO_printf(out, "%*s%s:\n", indent, "", msg);
71	switch (choice->type) {
72	case ASIdentifierChoice_inherit:
73	BIO_printf(out, "%*sinherit\n", indent + 2, "");
74	break;
75	case ASIdentifierChoice_asIdsOrRanges:
76	for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) {
77	ASIdOrRange *aor =
78	sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
79	switch (aor->type) {
80	case ASIdOrRange_id:
81	if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL)
82	return 0;
83	BIO_printf(out, "%*s%s\n", indent + 2, "", s);
84	OPENSSL_free(s);
85	break;
86	case ASIdOrRange_range:
87	if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL)
88	return 0;
89	BIO_printf(out, "%*s%s-", indent + 2, "", s);
90	OPENSSL_free(s);
91	if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL)
92	return 0;
93	BIO_printf(out, "%s\n", s);
94	OPENSSL_free(s);
95	break;
96	default:
97	return 0;
98	}
99	}
100	break;
101	default:
102	return 0;
103	}
104	return 1;
105	}
106
107	/*
108	* i2r method for an ASIdentifier extension.
109	*/
110	static int i2r_ASIdentifiers(const X509V3_EXT_METHOD *method,
111	void ext, BIO out, int indent)
112	{
113	ASIdentifiers *asid = ext;
114	return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
115	"Autonomous System Numbers") &&
116	i2r_ASIdentifierChoice(out, asid->rdi, indent,
117	"Routing Domain Identifiers"));
118	}
119
120	/*
121	* Sort comparison function for a sequence of ASIdOrRange elements.
122	*/
123	static int ASIdOrRange_cmp(const ASIdOrRange const a_,
124	const ASIdOrRange const b_)
125	{
126	const ASIdOrRange a = a_, b = b_;
127
128	assert((a->type == ASIdOrRange_id && a->u.id != NULL) \|\|
129	(a->type == ASIdOrRange_range && a->u.range != NULL &&
130	a->u.range->min != NULL && a->u.range->max != NULL));
131
132	assert((b->type == ASIdOrRange_id && b->u.id != NULL) \|\|
133	(b->type == ASIdOrRange_range && b->u.range != NULL &&
134	b->u.range->min != NULL && b->u.range->max != NULL));
135
136	if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
137	return ASN1_INTEGER_cmp(a->u.id, b->u.id);
138
139	if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
140	int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
141	return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max,
142	b->u.range->max);
143	}
144
145	if (a->type == ASIdOrRange_id)
146	return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
147	else
148	return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
149	}
150
151	/*
152	* Add an inherit element.
153	*/
154	int X509v3_asid_add_inherit(ASIdentifiers *asid, int which)
155	{
156	ASIdentifierChoice **choice;
157	if (asid == NULL)
158	return 0;
159	switch (which) {
160	case V3_ASID_ASNUM:
161	choice = &asid->asnum;
162	break;
163	case V3_ASID_RDI:
164	choice = &asid->rdi;
165	break;
166	default:
167	return 0;
168	}
169	if (*choice == NULL) {
170	if ((*choice = ASIdentifierChoice_new()) == NULL)
171	return 0;
172	if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL) {
173	ASIdentifierChoice_free(*choice);
174	*choice = NULL;
175	return 0;
176	}
177	(*choice)->type = ASIdentifierChoice_inherit;
178	}
179	return (*choice)->type == ASIdentifierChoice_inherit;
180	}
181
182	/*
183	* Add an ID or range to an ASIdentifierChoice.
184	*/
185	int X509v3_asid_add_id_or_range(ASIdentifiers *asid,
186	int which, ASN1_INTEGER min, ASN1_INTEGER max)
187	{
188	ASIdentifierChoice **choice;
189	ASIdOrRange *aor;
190	if (asid == NULL)
191	return 0;
192	switch (which) {
193	case V3_ASID_ASNUM:
194	choice = &asid->asnum;
195	break;
196	case V3_ASID_RDI:
197	choice = &asid->rdi;
198	break;
199	default:
200	return 0;
201	}
202	if (choice != NULL && (choice)->type != ASIdentifierChoice_asIdsOrRanges)
203	return 0;
204	if (*choice == NULL) {
205	if ((*choice = ASIdentifierChoice_new()) == NULL)
206	return 0;
207	(*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp);
208	if ((*choice)->u.asIdsOrRanges == NULL) {
209	ASIdentifierChoice_free(*choice);
210	*choice = NULL;
211	return 0;
212	}
213	(*choice)->type = ASIdentifierChoice_asIdsOrRanges;
214	}
215	if ((aor = ASIdOrRange_new()) == NULL)
216	return 0;
217	if (!sk_ASIdOrRange_reserve((*choice)->u.asIdsOrRanges, 1))
218	goto err;
219	if (max == NULL) {
220	aor->type = ASIdOrRange_id;
221	aor->u.id = min;
222	} else {
223	aor->type = ASIdOrRange_range;
224	if ((aor->u.range = ASRange_new()) == NULL)
225	goto err;
226	ASN1_INTEGER_free(aor->u.range->min);
227	aor->u.range->min = min;
228	ASN1_INTEGER_free(aor->u.range->max);
229	aor->u.range->max = max;
230	}
231	/* Cannot fail due to the reservation above */
232	if (!ossl_assert(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
233	goto err;
234	return 1;
235
236	err:
237	ASIdOrRange_free(aor);
238	return 0;
239	}
240
241	/*
242	* Extract min and max values from an ASIdOrRange.
243	*/
244	static int extract_min_max(ASIdOrRange *aor,
245	ASN1_INTEGER min, ASN1_INTEGER max)
246	{
247	if (!ossl_assert(aor != NULL))
248	return 0;
249	switch (aor->type) {
250	case ASIdOrRange_id:
251	*min = aor->u.id;
252	*max = aor->u.id;
253	return 1;
254	case ASIdOrRange_range:
255	*min = aor->u.range->min;
256	*max = aor->u.range->max;
257	return 1;
258	}
259
260	return 0;
261	}
262
263	/*
264	* Check whether an ASIdentifierChoice is in canonical form.
265	*/
266	static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
267	{
268	ASN1_INTEGER *a_max_plus_one = NULL;
269	ASN1_INTEGER *orig;
270	BIGNUM *bn = NULL;
271	int i, ret = 0;
272
273	/*
274	* Empty element or inheritance is canonical.
275	*/
276	if (choice == NULL \|\| choice->type == ASIdentifierChoice_inherit)
277	return 1;
278
279	/*
280	* If not a list, or if empty list, it's broken.
281	*/
282	if (choice->type != ASIdentifierChoice_asIdsOrRanges \|\|
283	sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
284	return 0;
285
286	/*
287	* It's a list, check it.
288	*/
289	for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
290	ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
291	ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
292	ASN1_INTEGER a_min = NULL, a_max = NULL, b_min = NULL, b_max =
293	NULL;
294
295	if (!extract_min_max(a, &a_min, &a_max)
296	\|\| !extract_min_max(b, &b_min, &b_max))
297	goto done;
298
299	/*
300	* Punt misordered list, overlapping start, or inverted range.
301	*/
302	if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 \|\|
303	ASN1_INTEGER_cmp(a_min, a_max) > 0 \|\|
304	ASN1_INTEGER_cmp(b_min, b_max) > 0)
305	goto done;
306
307	/*
308	* Calculate a_max + 1 to check for adjacency.
309	*/
310	if ((bn == NULL && (bn = BN_new()) == NULL) \|\|
311	ASN1_INTEGER_to_BN(a_max, bn) == NULL \|\|
312	!BN_add_word(bn, 1)) {
313	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
314	goto done;
315	}
316
317	if ((a_max_plus_one =
318	BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
319	a_max_plus_one = orig;
320	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
321	goto done;
322	}
323
324	/*
325	* Punt if adjacent or overlapping.
326	*/
327	if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
328	goto done;
329	}
330
331	/*
332	* Check for inverted range.
333	*/
334	i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
335	{
336	ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
337	ASN1_INTEGER a_min, a_max;
338	if (a != NULL && a->type == ASIdOrRange_range) {
339	if (!extract_min_max(a, &a_min, &a_max)
340	\|\| ASN1_INTEGER_cmp(a_min, a_max) > 0)
341	goto done;
342	}
343	}
344
345	ret = 1;
346
347	done:
348	ASN1_INTEGER_free(a_max_plus_one);
349	BN_free(bn);
350	return ret;
351	}
352
353	/*
354	* Check whether an ASIdentifier extension is in canonical form.
355	*/
356	int X509v3_asid_is_canonical(ASIdentifiers *asid)
357	{
358	return (asid == NULL \|\|
359	(ASIdentifierChoice_is_canonical(asid->asnum) &&
360	ASIdentifierChoice_is_canonical(asid->rdi)));
361	}
362
363	/*
364	* Whack an ASIdentifierChoice into canonical form.
365	*/
366	static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
367	{
368	ASN1_INTEGER *a_max_plus_one = NULL;
369	ASN1_INTEGER *orig;
370	BIGNUM *bn = NULL;
371	int i, ret = 0;
372
373	/*
374	* Nothing to do for empty element or inheritance.
375	*/
376	if (choice == NULL \|\| choice->type == ASIdentifierChoice_inherit)
377	return 1;
378
379	/*
380	* If not a list, or if empty list, it's broken.
381	*/
382	if (choice->type != ASIdentifierChoice_asIdsOrRanges \|\|
383	sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
384	ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
385	return 0;
386	}
387
388	/*
389	* We have a non-empty list. Sort it.
390	*/
391	sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
392
393	/*
394	* Now check for errors and suboptimal encoding, rejecting the
395	* former and fixing the latter.
396	*/
397	for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
398	ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
399	ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
400	ASN1_INTEGER a_min = NULL, a_max = NULL, b_min = NULL, b_max =
401	NULL;
402
403	if (!extract_min_max(a, &a_min, &a_max)
404	\|\| !extract_min_max(b, &b_min, &b_max))
405	goto done;
406
407	/*
408	* Make sure we're properly sorted (paranoia).
409	*/
410	if (!ossl_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0))
411	goto done;
412
413	/*
414	* Punt inverted ranges.
415	*/
416	if (ASN1_INTEGER_cmp(a_min, a_max) > 0 \|\|
417	ASN1_INTEGER_cmp(b_min, b_max) > 0)
418	goto done;
419
420	/*
421	* Check for overlaps.
422	*/
423	if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
424	ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
425	goto done;
426	}
427
428	/*
429	* Calculate a_max + 1 to check for adjacency.
430	*/
431	if ((bn == NULL && (bn = BN_new()) == NULL) \|\|
432	ASN1_INTEGER_to_BN(a_max, bn) == NULL \|\|
433	!BN_add_word(bn, 1)) {
434	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
435	goto done;
436	}
437
438	if ((a_max_plus_one =
439	BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
440	a_max_plus_one = orig;
441	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
442	goto done;
443	}
444
445	/*
446	* If a and b are adjacent, merge them.
447	*/
448	if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
449	ASRange *r;
450	switch (a->type) {
451	case ASIdOrRange_id:
452	if ((r = OPENSSL_malloc(sizeof(*r))) == NULL) {
453	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
454	goto done;
455	}
456	r->min = a_min;
457	r->max = b_max;
458	a->type = ASIdOrRange_range;
459	a->u.range = r;
460	break;
461	case ASIdOrRange_range:
462	ASN1_INTEGER_free(a->u.range->max);
463	a->u.range->max = b_max;
464	break;
465	}
466	switch (b->type) {
467	case ASIdOrRange_id:
468	b->u.id = NULL;
469	break;
470	case ASIdOrRange_range:
471	b->u.range->max = NULL;
472	break;
473	}
474	ASIdOrRange_free(b);
475	(void)sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
476	i--;
477	continue;
478	}
479	}
480
481	/*
482	* Check for final inverted range.
483	*/
484	i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
485	{
486	ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
487	ASN1_INTEGER a_min, a_max;
488	if (a != NULL && a->type == ASIdOrRange_range) {
489	if (!extract_min_max(a, &a_min, &a_max)
490	\|\| ASN1_INTEGER_cmp(a_min, a_max) > 0)
491	goto done;
492	}
493	}
494
495	/* Paranoia */
496	if (!ossl_assert(ASIdentifierChoice_is_canonical(choice)))
497	goto done;
498
499	ret = 1;
500
501	done:
502	ASN1_INTEGER_free(a_max_plus_one);
503	BN_free(bn);
504	return ret;
505	}
506
507	/*
508	* Whack an ASIdentifier extension into canonical form.
509	*/
510	int X509v3_asid_canonize(ASIdentifiers *asid)
511	{
512	return (asid == NULL \|\|
513	(ASIdentifierChoice_canonize(asid->asnum) &&
514	ASIdentifierChoice_canonize(asid->rdi)));
515	}
516
517	/*
518	* v2i method for an ASIdentifier extension.
519	*/
520	static void v2i_ASIdentifiers(const struct v3_ext_method method,
521	struct v3_ext_ctx *ctx,
522	STACK_OF(CONF_VALUE) *values)
523	{
524	ASN1_INTEGER min = NULL, max = NULL;
525	ASIdentifiers *asid = NULL;
526	int i;
527
528	if ((asid = ASIdentifiers_new()) == NULL) {
529	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
530	return NULL;
531	}
532
533	for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
534	CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
535	int i1 = 0, i2 = 0, i3 = 0, is_range = 0, which = 0;
536
537	/*
538	* Figure out whether this is an AS or an RDI.
539	*/
540	if (!ossl_v3_name_cmp(val->name, "AS")) {
541	which = V3_ASID_ASNUM;
542	} else if (!ossl_v3_name_cmp(val->name, "RDI")) {
543	which = V3_ASID_RDI;
544	} else {
545	ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_NAME_ERROR);
546	X509V3_conf_add_error_name_value(val);
547	goto err;
548	}
549
550	if (val->value == NULL) {
551	ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
552	goto err;
553	}
554
555	/*
556	* Handle inheritance.
557	*/
558	if (strcmp(val->value, "inherit") == 0) {
559	if (X509v3_asid_add_inherit(asid, which))
560	continue;
561	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_INHERITANCE);
562	X509V3_conf_add_error_name_value(val);
563	goto err;
564	}
565
566	/*
567	* Number, range, or mistake, pick it apart and figure out which.
568	*/
569	i1 = strspn(val->value, "0123456789");
570	if (val->value[i1] == '\0') {
571	is_range = 0;
572	} else {
573	is_range = 1;
574	i2 = i1 + strspn(val->value + i1, " \t");
575	if (val->value[i2] != '-') {
576	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_ASNUMBER);
577	X509V3_conf_add_error_name_value(val);
578	goto err;
579	}
580	i2++;
581	i2 = i2 + strspn(val->value + i2, " \t");
582	i3 = i2 + strspn(val->value + i2, "0123456789");
583	if (val->value[i3] != '\0') {
584	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_ASRANGE);
585	X509V3_conf_add_error_name_value(val);
586	goto err;
587	}
588	}
589
590	/*
591	* Syntax is ok, read and add it.
592	*/
593	if (!is_range) {
594	if (!X509V3_get_value_int(val, &min)) {
595	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
596	goto err;
597	}
598	} else {
599	char *s = OPENSSL_strdup(val->value);
600	if (s == NULL) {
601	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
602	goto err;
603	}
604	s[i1] = '\0';
605	min = s2i_ASN1_INTEGER(NULL, s);
606	max = s2i_ASN1_INTEGER(NULL, s + i2);
607	OPENSSL_free(s);
608	if (min == NULL \|\| max == NULL) {
609	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
610	goto err;
611	}
612	if (ASN1_INTEGER_cmp(min, max) > 0) {
613	ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
614	goto err;
615	}
616	}
617	if (!X509v3_asid_add_id_or_range(asid, which, min, max)) {
618	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
619	goto err;
620	}
621	min = max = NULL;
622	}
623
624	/*
625	* Canonize the result, then we're done.
626	*/
627	if (!X509v3_asid_canonize(asid))
628	goto err;
629	return asid;
630
631	err:
632	ASIdentifiers_free(asid);
633	ASN1_INTEGER_free(min);
634	ASN1_INTEGER_free(max);
635	return NULL;
636	}
637
638	/*
639	* OpenSSL dispatch.
640	*/
641	const X509V3_EXT_METHOD ossl_v3_asid = {
642	NID_sbgp_autonomousSysNum, /* nid */
643	0, /* flags */
644	ASN1_ITEM_ref(ASIdentifiers), /* template */
645	0, 0, 0, 0, /* old functions, ignored */
646	0, /* i2s */
647	0, /* s2i */
648	0, /* i2v */
649	v2i_ASIdentifiers, /* v2i */
650	i2r_ASIdentifiers, /* i2r */
651	0, /* r2i */
652	NULL /* extension-specific data */
653	};
654
655	/*
656	* Figure out whether extension uses inheritance.
657	*/
658	int X509v3_asid_inherits(ASIdentifiers *asid)
659	{
660	return (asid != NULL &&
661	((asid->asnum != NULL &&
662	asid->asnum->type == ASIdentifierChoice_inherit) \|\|
663	(asid->rdi != NULL &&
664	asid->rdi->type == ASIdentifierChoice_inherit)));
665	}
666
667	/*
668	* Figure out whether parent contains child.
669	*/
670	static int asid_contains(ASIdOrRanges parent, ASIdOrRanges child)
671	{
672	ASN1_INTEGER p_min = NULL, p_max = NULL, c_min = NULL, c_max = NULL;
673	int p, c;
674
675	if (child == NULL \|\| parent == child)
676	return 1;
677	if (parent == NULL)
678	return 0;
679
680	p = 0;
681	for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
682	if (!extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max))
683	return 0;
684	for (;; p++) {
685	if (p >= sk_ASIdOrRange_num(parent))
686	return 0;
687	if (!extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min,
688	&p_max))
689	return 0;
690	if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
691	continue;
692	if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
693	return 0;
694	break;
695	}
696	}
697
698	return 1;
699	}
700
701	/*
702	* Test whether a is a subset of b.
703	*/
704	int X509v3_asid_subset(ASIdentifiers a, ASIdentifiers b)
705	{
706	int subset;
707
708	if (a == NULL \|\| a == b)
709	return 1;
710
711	if (b == NULL)
712	return 0;
713
714	if (X509v3_asid_inherits(a) \|\| X509v3_asid_inherits(b))
715	return 0;
716
717	subset = a->asnum == NULL
718	\|\| (b->asnum != NULL
719	&& asid_contains(b->asnum->u.asIdsOrRanges,
720	a->asnum->u.asIdsOrRanges));
721	if (!subset)
722	return 0;
723
724	return a->rdi == NULL
725	\|\| (b->rdi != NULL
726	&& asid_contains(b->rdi->u.asIdsOrRanges,
727	a->rdi->u.asIdsOrRanges));
728	}
729
730	/*
731	* Validation error handling via callback.
732	*/
733	#define validation_err(_err_) \
734	do { \
735	if (ctx != NULL) { \
736	ctx->error = _err_; \
737	ctx->error_depth = i; \
738	ctx->current_cert = x; \
739	ret = ctx->verify_cb(0, ctx); \
740	} else { \
741	ret = 0; \
742	} \
743	if (!ret) \
744	goto done; \
745	} while (0)
746
747	/*
748	* Core code for RFC 3779 3.3 path validation.
749	*/
750	static int asid_validate_path_internal(X509_STORE_CTX *ctx,
751	STACK_OF(X509) *chain,
752	ASIdentifiers *ext)
753	{
754	ASIdOrRanges child_as = NULL, child_rdi = NULL;
755	int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
756	X509 *x;
757
758	if (!ossl_assert(chain != NULL && sk_X509_num(chain) > 0)
759	\|\| !ossl_assert(ctx != NULL \|\| ext != NULL)
760	\|\| !ossl_assert(ctx == NULL \|\| ctx->verify_cb != NULL)) {
761	if (ctx != NULL)
762	ctx->error = X509_V_ERR_UNSPECIFIED;
763	return 0;
764	}
765
766
767	/*
768	* Figure out where to start. If we don't have an extension to
769	* check, we're done. Otherwise, check canonical form and
770	* set up for walking up the chain.
771	*/
772	if (ext != NULL) {
773	i = -1;
774	x = NULL;
775	} else {
776	i = 0;
777	x = sk_X509_value(chain, i);
778	if ((ext = x->rfc3779_asid) == NULL)
779	goto done;
780	}
781	if (!X509v3_asid_is_canonical(ext))
782	validation_err(X509_V_ERR_INVALID_EXTENSION);
783	if (ext->asnum != NULL) {
784	switch (ext->asnum->type) {
785	case ASIdentifierChoice_inherit:
786	inherit_as = 1;
787	break;
788	case ASIdentifierChoice_asIdsOrRanges:
789	child_as = ext->asnum->u.asIdsOrRanges;
790	break;
791	}
792	}
793	if (ext->rdi != NULL) {
794	switch (ext->rdi->type) {
795	case ASIdentifierChoice_inherit:
796	inherit_rdi = 1;
797	break;
798	case ASIdentifierChoice_asIdsOrRanges:
799	child_rdi = ext->rdi->u.asIdsOrRanges;
800	break;
801	}
802	}
803
804	/*
805	* Now walk up the chain. Extensions must be in canonical form, no
806	* cert may list resources that its parent doesn't list.
807	*/
808	for (i++; i < sk_X509_num(chain); i++) {
809	x = sk_X509_value(chain, i);
810	if (!ossl_assert(x != NULL)) {
811	if (ctx != NULL)
812	ctx->error = X509_V_ERR_UNSPECIFIED;
813	return 0;
814	}
815	if (x->rfc3779_asid == NULL) {
816	if (child_as != NULL \|\| child_rdi != NULL)
817	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
818	continue;
819	}
820	if (!X509v3_asid_is_canonical(x->rfc3779_asid))
821	validation_err(X509_V_ERR_INVALID_EXTENSION);
822	if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
823	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
824	child_as = NULL;
825	inherit_as = 0;
826	}
827	if (x->rfc3779_asid->asnum != NULL &&
828	x->rfc3779_asid->asnum->type ==
829	ASIdentifierChoice_asIdsOrRanges) {
830	if (inherit_as
831	\|\| asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges,
832	child_as)) {
833	child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
834	inherit_as = 0;
835	} else {
836	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
837	}
838	}
839	if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
840	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
841	child_rdi = NULL;
842	inherit_rdi = 0;
843	}
844	if (x->rfc3779_asid->rdi != NULL &&
845	x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) {
846	if (inherit_rdi \|\|
847	asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges,
848	child_rdi)) {
849	child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
850	inherit_rdi = 0;
851	} else {
852	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
853	}
854	}
855	}
856
857	/*
858	* Trust anchor can't inherit.
859	*/
860	if (!ossl_assert(x != NULL)) {
861	if (ctx != NULL)
862	ctx->error = X509_V_ERR_UNSPECIFIED;
863	return 0;
864	}
865	if (x->rfc3779_asid != NULL) {
866	if (x->rfc3779_asid->asnum != NULL &&
867	x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
868	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
869	if (x->rfc3779_asid->rdi != NULL &&
870	x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
871	validation_err(X509_V_ERR_UNNESTED_RESOURCE);
872	}
873
874	done:
875	return ret;
876	}
877
878	#undef validation_err
879
880	/*
881	* RFC 3779 3.3 path validation -- called from X509_verify_cert().
882	*/
883	int X509v3_asid_validate_path(X509_STORE_CTX *ctx)
884	{
885	if (ctx->chain == NULL
886	\|\| sk_X509_num(ctx->chain) == 0
887	\|\| ctx->verify_cb == NULL) {
888	ctx->error = X509_V_ERR_UNSPECIFIED;
889	return 0;
890	}
891	return asid_validate_path_internal(ctx, ctx->chain, NULL);
892	}
893
894	/*
895	* RFC 3779 3.3 path validation of an extension.
896	* Test whether chain covers extension.
897	*/
898	int X509v3_asid_validate_resource_set(STACK_OF(X509) *chain,
899	ASIdentifiers *ext, int allow_inheritance)
900	{
901	if (ext == NULL)
902	return 1;
903	if (chain == NULL \|\| sk_X509_num(chain) == 0)
904	return 0;
905	if (!allow_inheritance && X509v3_asid_inherits(ext))
906	return 0;
907	return asid_validate_path_internal(NULL, chain, ext);
908	}
909
910	#endif /* OPENSSL_NO_RFC3779 */

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.1.7/crypto/x509/v3_asid.c@ 107278

以其他格式下載: