v3_crld.c@ 105945

最後變更在這個檔案從105945是 104078,由 vboxsync 提交於 8 月前
openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
檔案大小: 15.3 KB

行
1	/*
2	* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stdio.h>
11	#include "internal/cryptlib.h"
12	#include <openssl/conf.h>
13	#include <openssl/asn1.h>
14	#include <openssl/asn1t.h>
15	#include <openssl/x509v3.h>
16
17	#include "crypto/x509.h"
18	#include "ext_dat.h"
19	#include "x509_local.h"
20
21	static void v2i_crld(const X509V3_EXT_METHOD method,
22	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval);
23	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
24	int indent);
25
26	const X509V3_EXT_METHOD ossl_v3_crld = {
27	NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
28	0, 0, 0, 0,
29	0, 0,
30	0,
31	v2i_crld,
32	i2r_crldp, 0,
33	NULL
34	};
35
36	const X509V3_EXT_METHOD ossl_v3_freshest_crl = {
37	NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
38	0, 0, 0, 0,
39	0, 0,
40	0,
41	v2i_crld,
42	i2r_crldp, 0,
43	NULL
44	};
45
46	static STACK_OF(GENERAL_NAME) gnames_from_sectname(X509V3_CTX ctx,
47	char *sect)
48	{
49	STACK_OF(CONF_VALUE) *gnsect;
50	STACK_OF(GENERAL_NAME) *gens;
51	if (*sect == '@')
52	gnsect = X509V3_get_section(ctx, sect + 1);
53	else
54	gnsect = X509V3_parse_list(sect);
55	if (!gnsect) {
56	ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
57	return NULL;
58	}
59	gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
60	if (*sect == '@')
61	X509V3_section_free(ctx, gnsect);
62	else
63	sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
64	return gens;
65	}
66
67	static int set_dist_point_name(DIST_POINT_NAME *pdp, X509V3_CTX ctx,
68	CONF_VALUE *cnf)
69	{
70	STACK_OF(GENERAL_NAME) *fnm = NULL;
71	STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
72
73	if (cnf->value == NULL) {
74	ERR_raise(ERR_LIB_X509V3, X509V3_R_MISSING_VALUE);
75	goto err;
76	}
77
78	if (strncmp(cnf->name, "fullname", 9) == 0) {
79	fnm = gnames_from_sectname(ctx, cnf->value);
80	if (!fnm)
81	goto err;
82	} else if (strcmp(cnf->name, "relativename") == 0) {
83	int ret;
84	STACK_OF(CONF_VALUE) *dnsect;
85	X509_NAME *nm;
86	nm = X509_NAME_new();
87	if (nm == NULL)
88	return -1;
89	dnsect = X509V3_get_section(ctx, cnf->value);
90	if (!dnsect) {
91	X509_NAME_free(nm);
92	ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
93	return -1;
94	}
95	ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
96	X509V3_section_free(ctx, dnsect);
97	rnm = nm->entries;
98	nm->entries = NULL;
99	X509_NAME_free(nm);
100	if (!ret \|\| sk_X509_NAME_ENTRY_num(rnm) <= 0)
101	goto err;
102	/*
103	* Since its a name fragment can't have more than one RDNSequence
104	*/
105	if (sk_X509_NAME_ENTRY_value(rnm,
106	sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
107	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_MULTIPLE_RDNS);
108	goto err;
109	}
110	} else
111	return 0;
112
113	if (*pdp) {
114	ERR_raise(ERR_LIB_X509V3, X509V3_R_DISTPOINT_ALREADY_SET);
115	goto err;
116	}
117
118	*pdp = DIST_POINT_NAME_new();
119	if (*pdp == NULL)
120	goto err;
121	if (fnm) {
122	(*pdp)->type = 0;
123	(*pdp)->name.fullname = fnm;
124	} else {
125	(*pdp)->type = 1;
126	(*pdp)->name.relativename = rnm;
127	}
128
129	return 1;
130
131	err:
132	sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
133	sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
134	return -1;
135	}
136
137	static const BIT_STRING_BITNAME reason_flags[] = {
138	{0, "Unused", "unused"},
139	{1, "Key Compromise", "keyCompromise"},
140	{2, "CA Compromise", "CACompromise"},
141	{3, "Affiliation Changed", "affiliationChanged"},
142	{4, "Superseded", "superseded"},
143	{5, "Cessation Of Operation", "cessationOfOperation"},
144	{6, "Certificate Hold", "certificateHold"},
145	{7, "Privilege Withdrawn", "privilegeWithdrawn"},
146	{8, "AA Compromise", "AACompromise"},
147	{-1, NULL, NULL}
148	};
149
150	static int set_reasons(ASN1_BIT_STRING *preas, char value)
151	{
152	STACK_OF(CONF_VALUE) *rsk = NULL;
153	const BIT_STRING_BITNAME *pbn;
154	const char *bnam;
155	int i, ret = 0;
156	rsk = X509V3_parse_list(value);
157	if (rsk == NULL)
158	return 0;
159	if (*preas != NULL)
160	goto err;
161	for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
162	bnam = sk_CONF_VALUE_value(rsk, i)->name;
163	if (*preas == NULL) {
164	*preas = ASN1_BIT_STRING_new();
165	if (*preas == NULL)
166	goto err;
167	}
168	for (pbn = reason_flags; pbn->lname; pbn++) {
169	if (strcmp(pbn->sname, bnam) == 0) {
170	if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
171	goto err;
172	break;
173	}
174	}
175	if (pbn->lname == NULL)
176	goto err;
177	}
178	ret = 1;
179
180	err:
181	sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
182	return ret;
183	}
184
185	static int print_reasons(BIO out, const char rname,
186	ASN1_BIT_STRING *rflags, int indent)
187	{
188	int first = 1;
189	const BIT_STRING_BITNAME *pbn;
190	BIO_printf(out, "%s%s:\n%s", indent, "", rname, indent + 2, "");
191	for (pbn = reason_flags; pbn->lname; pbn++) {
192	if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
193	if (first)
194	first = 0;
195	else
196	BIO_puts(out, ", ");
197	BIO_puts(out, pbn->lname);
198	}
199	}
200	if (first)
201	BIO_puts(out, "<EMPTY>\n");
202	else
203	BIO_puts(out, "\n");
204	return 1;
205	}
206
207	static DIST_POINT crldp_from_section(X509V3_CTX ctx,
208	STACK_OF(CONF_VALUE) *nval)
209	{
210	int i;
211	CONF_VALUE *cnf;
212	DIST_POINT *point = DIST_POINT_new();
213
214	if (point == NULL)
215	goto err;
216	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
217	int ret;
218	cnf = sk_CONF_VALUE_value(nval, i);
219	ret = set_dist_point_name(&point->distpoint, ctx, cnf);
220	if (ret > 0)
221	continue;
222	if (ret < 0)
223	goto err;
224	if (strcmp(cnf->name, "reasons") == 0) {
225	if (!set_reasons(&point->reasons, cnf->value))
226	goto err;
227	} else if (strcmp(cnf->name, "CRLissuer") == 0) {
228	point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
229	if (point->CRLissuer == NULL)
230	goto err;
231	}
232	}
233
234	return point;
235
236	err:
237	DIST_POINT_free(point);
238	return NULL;
239	}
240
241	static void v2i_crld(const X509V3_EXT_METHOD method,
242	X509V3_CTX ctx, STACK_OF(CONF_VALUE) nval)
243	{
244	STACK_OF(DIST_POINT) *crld;
245	GENERAL_NAMES *gens = NULL;
246	GENERAL_NAME *gen = NULL;
247	CONF_VALUE *cnf;
248	const int num = sk_CONF_VALUE_num(nval);
249	int i;
250
251	crld = sk_DIST_POINT_new_reserve(NULL, num);
252	if (crld == NULL)
253	goto merr;
254	for (i = 0; i < num; i++) {
255	DIST_POINT *point;
256
257	cnf = sk_CONF_VALUE_value(nval, i);
258	if (cnf->value == NULL) {
259	STACK_OF(CONF_VALUE) *dpsect;
260	dpsect = X509V3_get_section(ctx, cnf->name);
261	if (!dpsect)
262	goto err;
263	point = crldp_from_section(ctx, dpsect);
264	X509V3_section_free(ctx, dpsect);
265	if (point == NULL)
266	goto err;
267	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
268	} else {
269	if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
270	goto err;
271	if ((gens = GENERAL_NAMES_new()) == NULL)
272	goto merr;
273	if (!sk_GENERAL_NAME_push(gens, gen))
274	goto merr;
275	gen = NULL;
276	if ((point = DIST_POINT_new()) == NULL)
277	goto merr;
278	sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
279	if ((point->distpoint = DIST_POINT_NAME_new()) == NULL)
280	goto merr;
281	point->distpoint->name.fullname = gens;
282	point->distpoint->type = 0;
283	gens = NULL;
284	}
285	}
286	return crld;
287
288	merr:
289	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
290	err:
291	GENERAL_NAME_free(gen);
292	GENERAL_NAMES_free(gens);
293	sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
294	return NULL;
295	}
296
297	static int dpn_cb(int operation, ASN1_VALUE *pval, const ASN1_ITEM it,
298	void *exarg)
299	{
300	DIST_POINT_NAME dpn = (DIST_POINT_NAME )*pval;
301
302	switch (operation) {
303	case ASN1_OP_NEW_POST:
304	dpn->dpname = NULL;
305	break;
306
307	case ASN1_OP_FREE_POST:
308	X509_NAME_free(dpn->dpname);
309	break;
310	}
311	return 1;
312	}
313
314
315	ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
316	ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
317	ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
318	} ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
319
320
321	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
322
323	ASN1_SEQUENCE(DIST_POINT) = {
324	ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
325	ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
326	ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
327	} ASN1_SEQUENCE_END(DIST_POINT)
328
329	IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
330
331	ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
332	ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
333	ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
334
335	IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
336
337	ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
338	ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
339	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
340	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
341	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
342	ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
343	ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
344	} ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
345
346	IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
347
348	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
349	int indent);
350	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
351	STACK_OF(CONF_VALUE) *nval);
352
353	const X509V3_EXT_METHOD ossl_v3_idp = {
354	NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
355	ASN1_ITEM_ref(ISSUING_DIST_POINT),
356	0, 0, 0, 0,
357	0, 0,
358	0,
359	v2i_idp,
360	i2r_idp, 0,
361	NULL
362	};
363
364	static void v2i_idp(const X509V3_EXT_METHOD method, X509V3_CTX *ctx,
365	STACK_OF(CONF_VALUE) *nval)
366	{
367	ISSUING_DIST_POINT *idp = NULL;
368	CONF_VALUE *cnf;
369	char name, val;
370	int i, ret;
371	idp = ISSUING_DIST_POINT_new();
372	if (idp == NULL)
373	goto merr;
374	for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
375	cnf = sk_CONF_VALUE_value(nval, i);
376	name = cnf->name;
377	val = cnf->value;
378	ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
379	if (ret > 0)
380	continue;
381	if (ret < 0)
382	goto err;
383	if (strcmp(name, "onlyuser") == 0) {
384	if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
385	goto err;
386	} else if (strcmp(name, "onlyCA") == 0) {
387	if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
388	goto err;
389	} else if (strcmp(name, "onlyAA") == 0) {
390	if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
391	goto err;
392	} else if (strcmp(name, "indirectCRL") == 0) {
393	if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
394	goto err;
395	} else if (strcmp(name, "onlysomereasons") == 0) {
396	if (!set_reasons(&idp->onlysomereasons, val))
397	goto err;
398	} else {
399	ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME);
400	X509V3_conf_add_error_name_value(cnf);
401	goto err;
402	}
403	}
404	return idp;
405
406	merr:
407	ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
408	err:
409	ISSUING_DIST_POINT_free(idp);
410	return NULL;
411	}
412
413	static int print_gens(BIO out, STACK_OF(GENERAL_NAME) gens, int indent)
414	{
415	int i;
416	for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
417	if (i > 0)
418	BIO_puts(out, "\n");
419	BIO_printf(out, "%*s", indent + 2, "");
420	GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
421	}
422	return 1;
423	}
424
425	static int print_distpoint(BIO out, DIST_POINT_NAME dpn, int indent)
426	{
427	if (dpn->type == 0) {
428	BIO_printf(out, "%*sFull Name:\n", indent, "");
429	print_gens(out, dpn->name.fullname, indent);
430	} else {
431	X509_NAME ntmp;
432	ntmp.entries = dpn->name.relativename;
433	BIO_printf(out, "%sRelative Name:\n%s", indent, "", indent + 2, "");
434	X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
435	BIO_puts(out, "\n");
436	}
437	return 1;
438	}
439
440	static int i2r_idp(const X509V3_EXT_METHOD method, void pidp, BIO *out,
441	int indent)
442	{
443	ISSUING_DIST_POINT *idp = pidp;
444	if (idp->distpoint)
445	print_distpoint(out, idp->distpoint, indent);
446	if (idp->onlyuser > 0)
447	BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
448	if (idp->onlyCA > 0)
449	BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
450	if (idp->indirectCRL > 0)
451	BIO_printf(out, "%*sIndirect CRL\n", indent, "");
452	if (idp->onlysomereasons)
453	print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
454	if (idp->onlyattr > 0)
455	BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
456	if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
457	&& (idp->indirectCRL <= 0) && !idp->onlysomereasons
458	&& (idp->onlyattr <= 0))
459	BIO_printf(out, "%*s<EMPTY>\n", indent, "");
460
461	return 1;
462	}
463
464	static int i2r_crldp(const X509V3_EXT_METHOD method, void pcrldp, BIO *out,
465	int indent)
466	{
467	STACK_OF(DIST_POINT) *crld = pcrldp;
468	DIST_POINT *point;
469	int i;
470	for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
471	if (i > 0)
472	BIO_puts(out, "\n");
473	point = sk_DIST_POINT_value(crld, i);
474	if (point->distpoint)
475	print_distpoint(out, point->distpoint, indent);
476	if (point->reasons)
477	print_reasons(out, "Reasons", point->reasons, indent);
478	if (point->CRLissuer) {
479	BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
480	print_gens(out, point->CRLissuer, indent);
481	}
482	}
483	return 1;
484	}
485
486	/* Append any nameRelativeToCRLIssuer in dpn to iname, set in dpn->dpname */
487	int DIST_POINT_set_dpname(DIST_POINT_NAME dpn, const X509_NAME iname)
488	{
489	int i;
490	STACK_OF(X509_NAME_ENTRY) *frag;
491	X509_NAME_ENTRY *ne;
492
493	if (dpn == NULL \|\| dpn->type != 1)
494	return 1;
495	frag = dpn->name.relativename;
496	X509_NAME_free(dpn->dpname); /* just in case it was already set */
497	dpn->dpname = X509_NAME_dup(iname);
498	if (dpn->dpname == NULL)
499	return 0;
500	for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
501	ne = sk_X509_NAME_ENTRY_value(frag, i);
502	if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1))
503	goto err;
504	}
505	/* generate cached encoding of name */
506	if (i2d_X509_NAME(dpn->dpname, NULL) >= 0)
507	return 1;
508
509	err:
510	X509_NAME_free(dpn->dpname);
511	dpn->dpname = NULL;
512	return 0;
513	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.1.7/crypto/x509/v3_crld.c@ 105945

以其他格式下載: