1 /* $OpenBSD: x509_alt.c,v 1.12 2022/03/26 16:34:21 tb Exp $ */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project.
4 */
5 /* ====================================================================
6 * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59 #include <stdio.h>
60 #include <string.h>
61
62 #include <openssl/conf.h>
63 #include <openssl/err.h>
64 #include <openssl/x509v3.h>
65
66 #include "x509_internal.h"
67
68 static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
70 static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
71 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
72 static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
73 static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
74 static int do_othername(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx);
75 static int do_dirname(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx);
76
77 const X509V3_EXT_METHOD v3_alt[] = {
78 {
79 .ext_nid = NID_subject_alt_name,
80 .ext_flags = 0,
81 .it = &GENERAL_NAMES_it,
82 .ext_new = NULL,
83 .ext_free = NULL,
84 .d2i = NULL,
85 .i2d = NULL,
86 .i2s = NULL,
87 .s2i = NULL,
88 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
89 .v2i = (X509V3_EXT_V2I)v2i_subject_alt,
90 .i2r = NULL,
91 .r2i = NULL,
92 .usr_data = NULL,
93 },
94 {
95 .ext_nid = NID_issuer_alt_name,
96 .ext_flags = 0,
97 .it = &GENERAL_NAMES_it,
98 .ext_new = NULL,
99 .ext_free = NULL,
100 .d2i = NULL,
101 .i2d = NULL,
102 .i2s = NULL,
103 .s2i = NULL,
104 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
105 .v2i = (X509V3_EXT_V2I)v2i_issuer_alt,
106 .i2r = NULL,
107 .r2i = NULL,
108 .usr_data = NULL,
109 },
110 {
111 .ext_nid = NID_certificate_issuer,
112 .ext_flags = 0,
113 .it = &GENERAL_NAMES_it,
114 .ext_new = NULL,
115 .ext_free = NULL,
116 .d2i = NULL,
117 .i2d = NULL,
118 .i2s = NULL,
119 .s2i = NULL,
120 .i2v = (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
121 .v2i = NULL,
122 .i2r = NULL,
123 .r2i = NULL,
124 .usr_data = NULL,
125 },
126 };
127
STACK_OF(CONF_VALUE)128 STACK_OF(CONF_VALUE) *
129 i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens,
130 STACK_OF(CONF_VALUE) *ret)
131 {
132 STACK_OF(CONF_VALUE) *free_ret = NULL;
133 GENERAL_NAME *gen;
134 int i;
135
136 if (ret == NULL) {
137 if ((free_ret = ret = sk_CONF_VALUE_new_null()) == NULL)
138 return NULL;
139 }
140
141 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
142 if ((gen = sk_GENERAL_NAME_value(gens, i)) == NULL)
143 goto err;
144 if ((ret = i2v_GENERAL_NAME(method, gen, ret)) == NULL)
145 goto err;
146 }
147
148 return ret;
149
150 err:
151 sk_CONF_VALUE_pop_free(free_ret, X509V3_conf_free);
152
153 return NULL;
154 }
155
STACK_OF(CONF_VALUE)156 STACK_OF(CONF_VALUE) *
157 i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen,
158 STACK_OF(CONF_VALUE) *ret)
159 {
160 STACK_OF(CONF_VALUE) *free_ret = NULL;
161 unsigned char *p;
162 char oline[256], htmp[5];
163 int i;
164
165 if (ret == NULL) {
166 if ((free_ret = ret = sk_CONF_VALUE_new_null()) == NULL)
167 return NULL;
168 }
169
170 switch (gen->type) {
171 case GEN_OTHERNAME:
172 if (!X509V3_add_value("othername", "<unsupported>", &ret))
173 goto err;
174 break;
175
176 case GEN_X400:
177 if (!X509V3_add_value("X400Name", "<unsupported>", &ret))
178 goto err;
179 break;
180
181 case GEN_EDIPARTY:
182 if (!X509V3_add_value("EdiPartyName", "<unsupported>", &ret))
183 goto err;
184 break;
185
186 case GEN_EMAIL:
187 if (!X509V3_add_value_uchar("email", gen->d.ia5->data, &ret))
188 goto err;
189 break;
190
191 case GEN_DNS:
192 if (!X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret))
193 goto err;
194 break;
195
196 case GEN_URI:
197 if (!X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret))
198 goto err;
199 break;
200
201 case GEN_DIRNAME:
202 if (X509_NAME_oneline(gen->d.dirn, oline, 256) == NULL)
203 goto err;
204 if (!X509V3_add_value("DirName", oline, &ret))
205 goto err;
206 break;
207
208 case GEN_IPADD: /* XXX */
209 p = gen->d.ip->data;
210 if (gen->d.ip->length == 4)
211 (void) snprintf(oline, sizeof oline,
212 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
213 else if (gen->d.ip->length == 16) {
214 oline[0] = 0;
215 for (i = 0; i < 8; i++) {
216 (void) snprintf(htmp, sizeof htmp,
217 "%X", p[0] << 8 | p[1]);
218 p += 2;
219 strlcat(oline, htmp, sizeof(oline));
220 if (i != 7)
221 strlcat(oline, ":", sizeof(oline));
222 }
223 } else {
224 if (!X509V3_add_value("IP Address", "<invalid>", &ret))
225 goto err;
226 break;
227 }
228 if (!X509V3_add_value("IP Address", oline, &ret))
229 goto err;
230 break;
231
232 case GEN_RID:
233 if (!i2t_ASN1_OBJECT(oline, 256, gen->d.rid))
234 goto err;
235 if (!X509V3_add_value("Registered ID", oline, &ret))
236 goto err;
237 break;
238 }
239
240 return ret;
241
242 err:
243 sk_CONF_VALUE_pop_free(free_ret, X509V3_conf_free);
244
245 return NULL;
246 }
247
248 int
GENERAL_NAME_print(BIO * out,GENERAL_NAME * gen)249 GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
250 {
251 unsigned char *p;
252 int i;
253
254 switch (gen->type) {
255 case GEN_OTHERNAME:
256 BIO_printf(out, "othername:<unsupported>");
257 break;
258
259 case GEN_X400:
260 BIO_printf(out, "X400Name:<unsupported>");
261 break;
262
263 case GEN_EDIPARTY:
264 /* Maybe fix this: it is supported now */
265 BIO_printf(out, "EdiPartyName:<unsupported>");
266 break;
267
268 case GEN_EMAIL:
269 BIO_printf(out, "email:%.*s", gen->d.ia5->length,
270 gen->d.ia5->data);
271 break;
272
273 case GEN_DNS:
274 BIO_printf(out, "DNS:%.*s", gen->d.ia5->length,
275 gen->d.ia5->data);
276 break;
277
278 case GEN_URI:
279 BIO_printf(out, "URI:%.*s", gen->d.ia5->length,
280 gen->d.ia5->data);
281 break;
282
283 case GEN_DIRNAME:
284 BIO_printf(out, "DirName: ");
285 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
286 break;
287
288 case GEN_IPADD:
289 p = gen->d.ip->data;
290 if (gen->d.ip->length == 4)
291 BIO_printf(out, "IP Address:%d.%d.%d.%d",
292 p[0], p[1], p[2], p[3]);
293 else if (gen->d.ip->length == 16) {
294 BIO_printf(out, "IP Address");
295 for (i = 0; i < 8; i++) {
296 BIO_printf(out, ":%X", p[0] << 8 | p[1]);
297 p += 2;
298 }
299 BIO_puts(out, "\n");
300 } else {
301 BIO_printf(out, "IP Address:<invalid>");
302 break;
303 }
304 break;
305
306 case GEN_RID:
307 BIO_printf(out, "Registered ID");
308 i2a_ASN1_OBJECT(out, gen->d.rid);
309 break;
310 }
311 return 1;
312 }
313
314 static GENERAL_NAMES *
v2i_issuer_alt(X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)315 v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
316 STACK_OF(CONF_VALUE) *nval)
317 {
318 GENERAL_NAMES *gens = NULL;
319 CONF_VALUE *cnf;
320 int i;
321
322 if ((gens = sk_GENERAL_NAME_new_null()) == NULL) {
323 X509V3error(ERR_R_MALLOC_FAILURE);
324 return NULL;
325 }
326 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
327 cnf = sk_CONF_VALUE_value(nval, i);
328 if (name_cmp(cnf->name, "issuer") == 0 && cnf->value != NULL &&
329 strcmp(cnf->value, "copy") == 0) {
330 if (!copy_issuer(ctx, gens))
331 goto err;
332 } else {
333 GENERAL_NAME *gen;
334 if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
335 goto err;
336 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
337 GENERAL_NAME_free(gen);
338 goto err;
339 }
340 }
341 }
342 return gens;
343
344 err:
345 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
346 return NULL;
347 }
348
349 /* Append subject altname of issuer to issuer alt name of subject */
350
351 static int
copy_issuer(X509V3_CTX * ctx,GENERAL_NAMES * gens)352 copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
353 {
354 GENERAL_NAMES *ialt;
355 GENERAL_NAME *gen;
356 X509_EXTENSION *ext;
357 int i;
358
359 if (ctx && (ctx->flags == CTX_TEST))
360 return 1;
361 if (!ctx || !ctx->issuer_cert) {
362 X509V3error(X509V3_R_NO_ISSUER_DETAILS);
363 goto err;
364 }
365 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
366 if (i < 0)
367 return 1;
368 if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
369 !(ialt = X509V3_EXT_d2i(ext))) {
370 X509V3error(X509V3_R_ISSUER_DECODE_ERROR);
371 goto err;
372 }
373
374 for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
375 gen = sk_GENERAL_NAME_value(ialt, i);
376 if (!sk_GENERAL_NAME_push(gens, gen)) {
377 X509V3error(ERR_R_MALLOC_FAILURE);
378 goto err;
379 }
380 }
381 sk_GENERAL_NAME_free(ialt);
382
383 return 1;
384
385 err:
386 return 0;
387
388 }
389
390 static GENERAL_NAMES *
v2i_subject_alt(X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)391 v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
392 STACK_OF(CONF_VALUE) *nval)
393 {
394 GENERAL_NAMES *gens = NULL;
395 CONF_VALUE *cnf;
396 int i;
397
398 if (!(gens = sk_GENERAL_NAME_new_null())) {
399 X509V3error(ERR_R_MALLOC_FAILURE);
400 return NULL;
401 }
402 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
403 cnf = sk_CONF_VALUE_value(nval, i);
404 if (!name_cmp(cnf->name, "email") && cnf->value &&
405 !strcmp(cnf->value, "copy")) {
406 if (!copy_email(ctx, gens, 0))
407 goto err;
408 } else if (!name_cmp(cnf->name, "email") && cnf->value &&
409 !strcmp(cnf->value, "move")) {
410 if (!copy_email(ctx, gens, 1))
411 goto err;
412 } else {
413 GENERAL_NAME *gen;
414 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
415 goto err;
416 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
417 GENERAL_NAME_free(gen);
418 goto err;
419 }
420 }
421 }
422 return gens;
423
424 err:
425 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
426 return NULL;
427 }
428
429 /* Copy any email addresses in a certificate or request to
430 * GENERAL_NAMES
431 */
432
433 static int
copy_email(X509V3_CTX * ctx,GENERAL_NAMES * gens,int move_p)434 copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
435 {
436 X509_NAME *nm;
437 ASN1_IA5STRING *email = NULL;
438 X509_NAME_ENTRY *ne;
439 GENERAL_NAME *gen = NULL;
440 int i;
441
442 if (ctx != NULL && ctx->flags == CTX_TEST)
443 return 1;
444 if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
445 X509V3error(X509V3_R_NO_SUBJECT_DETAILS);
446 goto err;
447 }
448 /* Find the subject name */
449 if (ctx->subject_cert)
450 nm = X509_get_subject_name(ctx->subject_cert);
451 else
452 nm = X509_REQ_get_subject_name(ctx->subject_req);
453
454 /* Now add any email address(es) to STACK */
455 i = -1;
456 while ((i = X509_NAME_get_index_by_NID(nm,
457 NID_pkcs9_emailAddress, i)) >= 0) {
458 ne = X509_NAME_get_entry(nm, i);
459 email = ASN1_STRING_dup(X509_NAME_ENTRY_get_data(ne));
460 if (move_p) {
461 X509_NAME_delete_entry(nm, i);
462 X509_NAME_ENTRY_free(ne);
463 i--;
464 }
465 if (!email || !(gen = GENERAL_NAME_new())) {
466 X509V3error(ERR_R_MALLOC_FAILURE);
467 goto err;
468 }
469 gen->d.ia5 = email;
470 email = NULL;
471 gen->type = GEN_EMAIL;
472 if (!sk_GENERAL_NAME_push(gens, gen)) {
473 X509V3error(ERR_R_MALLOC_FAILURE);
474 goto err;
475 }
476 gen = NULL;
477 }
478
479 return 1;
480
481 err:
482 GENERAL_NAME_free(gen);
483 ASN1_IA5STRING_free(email);
484 return 0;
485 }
486
487 GENERAL_NAMES *
v2i_GENERAL_NAMES(const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)488 v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
489 STACK_OF(CONF_VALUE) *nval)
490 {
491 GENERAL_NAME *gen;
492 GENERAL_NAMES *gens = NULL;
493 CONF_VALUE *cnf;
494 int i;
495
496 if (!(gens = sk_GENERAL_NAME_new_null())) {
497 X509V3error(ERR_R_MALLOC_FAILURE);
498 return NULL;
499 }
500 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
501 cnf = sk_CONF_VALUE_value(nval, i);
502 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
503 goto err;
504 if (sk_GENERAL_NAME_push(gens, gen) == 0) {
505 GENERAL_NAME_free(gen);
506 goto err;
507 }
508 }
509 return gens;
510
511 err:
512 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
513 return NULL;
514 }
515
516 GENERAL_NAME *
v2i_GENERAL_NAME(const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,CONF_VALUE * cnf)517 v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
518 CONF_VALUE *cnf)
519 {
520 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
521 }
522
523 GENERAL_NAME *
a2i_GENERAL_NAME(GENERAL_NAME * out,const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,int gen_type,const char * value,int is_nc)524 a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
525 X509V3_CTX *ctx, int gen_type, const char *value, int is_nc)
526 {
527 char is_string = 0;
528 GENERAL_NAME *gen = NULL;
529
530 if (!value) {
531 X509V3error(X509V3_R_MISSING_VALUE);
532 return NULL;
533 }
534
535 if (out)
536 gen = out;
537 else {
538 gen = GENERAL_NAME_new();
539 if (gen == NULL) {
540 X509V3error(ERR_R_MALLOC_FAILURE);
541 return NULL;
542 }
543 }
544
545 switch (gen_type) {
546 case GEN_URI:
547 case GEN_EMAIL:
548 case GEN_DNS:
549 is_string = 1;
550 break;
551
552 case GEN_RID:
553 {
554 ASN1_OBJECT *obj;
555 if (!(obj = OBJ_txt2obj(value, 0))) {
556 X509V3error(X509V3_R_BAD_OBJECT);
557 ERR_asprintf_error_data("value=%s", value);
558 goto err;
559 }
560 gen->d.rid = obj;
561 }
562 break;
563
564 case GEN_IPADD:
565 if (is_nc)
566 gen->d.ip = a2i_IPADDRESS_NC(value);
567 else
568 gen->d.ip = a2i_IPADDRESS(value);
569 if (gen->d.ip == NULL) {
570 X509V3error(X509V3_R_BAD_IP_ADDRESS);
571 ERR_asprintf_error_data("value=%s", value);
572 goto err;
573 }
574 break;
575
576 case GEN_DIRNAME:
577 if (!do_dirname(gen, value, ctx)) {
578 X509V3error(X509V3_R_DIRNAME_ERROR);
579 goto err;
580 }
581 break;
582
583 case GEN_OTHERNAME:
584 if (!do_othername(gen, value, ctx)) {
585 X509V3error(X509V3_R_OTHERNAME_ERROR);
586 goto err;
587 }
588 break;
589
590 default:
591 X509V3error(X509V3_R_UNSUPPORTED_TYPE);
592 goto err;
593 }
594
595 if (is_string) {
596 if (!(gen->d.ia5 = ASN1_IA5STRING_new()) ||
597 !ASN1_STRING_set(gen->d.ia5, value, strlen(value))) {
598 X509V3error(ERR_R_MALLOC_FAILURE);
599 goto err;
600 }
601 }
602
603 gen->type = gen_type;
604
605 return gen;
606
607 err:
608 if (out == NULL)
609 GENERAL_NAME_free(gen);
610 return NULL;
611 }
612
613 GENERAL_NAME *
v2i_GENERAL_NAME_ex(GENERAL_NAME * out,const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,CONF_VALUE * cnf,int is_nc)614 v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
615 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
616 {
617 uint8_t *bytes = NULL;
618 char *name, *value;
619 GENERAL_NAME *ret;
620 size_t len = 0;
621 int type;
622
623 name = cnf->name;
624 value = cnf->value;
625
626 if (!value) {
627 X509V3error(X509V3_R_MISSING_VALUE);
628 return NULL;
629 }
630
631 if (!name_cmp(name, "email"))
632 type = GEN_EMAIL;
633 else if (!name_cmp(name, "URI"))
634 type = GEN_URI;
635 else if (!name_cmp(name, "DNS"))
636 type = GEN_DNS;
637 else if (!name_cmp(name, "RID"))
638 type = GEN_RID;
639 else if (!name_cmp(name, "IP"))
640 type = GEN_IPADD;
641 else if (!name_cmp(name, "dirName"))
642 type = GEN_DIRNAME;
643 else if (!name_cmp(name, "otherName"))
644 type = GEN_OTHERNAME;
645 else {
646 X509V3error(X509V3_R_UNSUPPORTED_OPTION);
647 ERR_asprintf_error_data("name=%s", name);
648 return NULL;
649 }
650
651 ret = a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
652 if (ret == NULL)
653 return NULL;
654
655 /*
656 * Validate what we have for sanity.
657 */
658
659 if (is_nc) {
660 struct x509_constraints_name *constraints_name = NULL;
661
662 if (!x509_constraints_validate(ret, &constraints_name, NULL)) {
663 X509V3error(X509V3_R_BAD_OBJECT);
664 ERR_asprintf_error_data("name=%s", name);
665 goto err;
666 }
667 x509_constraints_name_free(constraints_name);
668 return ret;
669 }
670
671 type = x509_constraints_general_to_bytes(ret, &bytes, &len);
672 switch (type) {
673 case GEN_DNS:
674 if (!x509_constraints_valid_sandns(bytes, len)) {
675 X509V3error(X509V3_R_BAD_OBJECT);
676 ERR_asprintf_error_data("name=%s value='%.*s'", name,
677 (int)len, bytes);
678 goto err;
679 }
680 break;
681 case GEN_URI:
682 if (!x509_constraints_uri_host(bytes, len, NULL)) {
683 X509V3error(X509V3_R_BAD_OBJECT);
684 ERR_asprintf_error_data("name=%s value='%.*s'", name,
685 (int)len, bytes);
686 goto err;
687 }
688 break;
689 case GEN_EMAIL:
690 if (!x509_constraints_parse_mailbox(bytes, len, NULL)) {
691 X509V3error(X509V3_R_BAD_OBJECT);
692 ERR_asprintf_error_data("name=%s value='%.*s'", name,
693 (int)len, bytes);
694 goto err;
695 }
696 break;
697 case GEN_IPADD:
698 if (len != 4 && len != 16) {
699 X509V3error(X509V3_R_BAD_IP_ADDRESS);
700 ERR_asprintf_error_data("name=%s len=%zu", name, len);
701 goto err;
702 }
703 break;
704 default:
705 break;
706 }
707 return ret;
708 err:
709 if (out == NULL)
710 GENERAL_NAME_free(ret);
711 return NULL;
712 }
713
714 static int
do_othername(GENERAL_NAME * gen,const char * value,X509V3_CTX * ctx)715 do_othername(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx)
716 {
717 char *objtmp = NULL, *p;
718 int objlen;
719
720 if (!(p = strchr(value, ';')))
721 return 0;
722 if (!(gen->d.otherName = OTHERNAME_new()))
723 return 0;
724 /* Free this up because we will overwrite it.
725 * no need to free type_id because it is static
726 */
727 ASN1_TYPE_free(gen->d.otherName->value);
728 if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
729 return 0;
730 objlen = p - value;
731 objtmp = malloc(objlen + 1);
732 if (objtmp) {
733 strlcpy(objtmp, value, objlen + 1);
734 gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
735 free(objtmp);
736 } else
737 gen->d.otherName->type_id = NULL;
738 if (!gen->d.otherName->type_id)
739 return 0;
740 return 1;
741 }
742
743 static int
do_dirname(GENERAL_NAME * gen,const char * value,X509V3_CTX * ctx)744 do_dirname(GENERAL_NAME *gen, const char *value, X509V3_CTX *ctx)
745 {
746 int ret;
747 STACK_OF(CONF_VALUE) *sk;
748 X509_NAME *nm;
749
750 if (!(nm = X509_NAME_new()))
751 return 0;
752 sk = X509V3_get_section(ctx, value);
753 if (!sk) {
754 X509V3error(X509V3_R_SECTION_NOT_FOUND);
755 ERR_asprintf_error_data("section=%s", value);
756 X509_NAME_free(nm);
757 return 0;
758 }
759 /* FIXME: should allow other character types... */
760 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
761 if (!ret)
762 X509_NAME_free(nm);
763 gen->d.dirn = nm;
764 X509V3_section_free(ctx, sk);
765
766 return ret;
767 }
768