1 /* $OpenBSD: x509_akey.c,v 1.3 2024/08/31 10:03:03 tb Exp $ */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 1999.
4 */
5 /* ====================================================================
6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * 3. All advertising materials mentioning features or use of this
21 * software must display the following acknowledgment:
22 * "This product includes software developed by the OpenSSL Project
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24 *
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26 * endorse or promote products derived from this software without
27 * prior written permission. For written permission, please contact
28 * licensing@OpenSSL.org.
29 *
30 * 5. Products derived from this software may not be called "OpenSSL"
31 * nor may "OpenSSL" appear in their names without prior written
32 * permission of the OpenSSL Project.
33 *
34 * 6. Redistributions of any form whatsoever must retain the following
35 * acknowledgment:
36 * "This product includes software developed by the OpenSSL Project
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38 *
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50 * OF THE POSSIBILITY OF SUCH DAMAGE.
51 * ====================================================================
52 *
53 * This product includes cryptographic software written by Eric Young
54 * (eay@cryptsoft.com). This product includes software written by Tim
55 * Hudson (tjh@cryptsoft.com).
56 *
57 */
58
59 #include <stdio.h>
60 #include <string.h>
61
62 #include <openssl/asn1.h>
63 #include <openssl/asn1t.h>
64 #include <openssl/conf.h>
65 #include <openssl/err.h>
66 #include <openssl/x509v3.h>
67
68 #include "x509_local.h"
69
70 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
71 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist);
72 static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
73 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
74
75 static const X509V3_EXT_METHOD x509v3_ext_authority_key_identifier = {
76 .ext_nid = NID_authority_key_identifier,
77 .ext_flags = X509V3_EXT_MULTILINE,
78 .it = &AUTHORITY_KEYID_it,
79 .ext_new = NULL,
80 .ext_free = NULL,
81 .d2i = NULL,
82 .i2d = NULL,
83 .i2s = NULL,
84 .s2i = NULL,
85 .i2v = (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
86 .v2i = (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
87 .i2r = NULL,
88 .r2i = NULL,
89 .usr_data = NULL,
90 };
91
92 const X509V3_EXT_METHOD *
x509v3_ext_method_authority_key_identifier(void)93 x509v3_ext_method_authority_key_identifier(void)
94 {
95 return &x509v3_ext_authority_key_identifier;
96 }
97
STACK_OF(CONF_VALUE)98 static STACK_OF(CONF_VALUE) *
99 i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, AUTHORITY_KEYID *akeyid,
100 STACK_OF(CONF_VALUE) *extlist)
101 {
102 STACK_OF(CONF_VALUE) *free_extlist = NULL;
103 char *tmpstr = NULL;
104
105 if (extlist == NULL) {
106 if ((free_extlist = extlist = sk_CONF_VALUE_new_null()) == NULL)
107 return NULL;
108 }
109
110 if (akeyid->keyid != NULL) {
111 if ((tmpstr = hex_to_string(akeyid->keyid->data,
112 akeyid->keyid->length)) == NULL)
113 goto err;
114 if (!X509V3_add_value("keyid", tmpstr, &extlist))
115 goto err;
116 free(tmpstr);
117 tmpstr = NULL;
118 }
119
120 if (akeyid->issuer != NULL) {
121 if ((extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer,
122 extlist)) == NULL)
123 goto err;
124 }
125
126 if (akeyid->serial != NULL) {
127 if ((tmpstr = hex_to_string(akeyid->serial->data,
128 akeyid->serial->length)) == NULL)
129 goto err;
130 if (!X509V3_add_value("serial", tmpstr, &extlist))
131 goto err;
132 free(tmpstr);
133 tmpstr = NULL;
134 }
135
136 if (sk_CONF_VALUE_num(extlist) <= 0)
137 goto err;
138
139 return extlist;
140
141 err:
142 free(tmpstr);
143 sk_CONF_VALUE_pop_free(free_extlist, X509V3_conf_free);
144
145 return NULL;
146 }
147
148 /*
149 * Currently two options:
150 * keyid: use the issuers subject keyid, the value 'always' means its is
151 * an error if the issuer certificate doesn't have a key id.
152 * issuer: use the issuers cert issuer and serial number. The default is
153 * to only use this if keyid is not present. With the option 'always'
154 * this is always included.
155 */
156 static AUTHORITY_KEYID *
v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* values)157 v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
158 STACK_OF(CONF_VALUE) *values)
159 {
160 char keyid = 0, issuer = 0;
161 int i;
162 CONF_VALUE *cnf;
163 ASN1_OCTET_STRING *ikeyid = NULL;
164 X509_NAME *isname = NULL;
165 STACK_OF(GENERAL_NAME) *gens = NULL;
166 GENERAL_NAME *gen = NULL;
167 ASN1_INTEGER *serial = NULL;
168 X509_EXTENSION *ext;
169 X509 *cert;
170 AUTHORITY_KEYID *akeyid = NULL;
171
172 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
173 cnf = sk_CONF_VALUE_value(values, i);
174 if (!strcmp(cnf->name, "keyid")) {
175 keyid = 1;
176 if (cnf->value && !strcmp(cnf->value, "always"))
177 keyid = 2;
178 } else if (!strcmp(cnf->name, "issuer")) {
179 issuer = 1;
180 if (cnf->value && !strcmp(cnf->value, "always"))
181 issuer = 2;
182 } else {
183 X509V3error(X509V3_R_UNKNOWN_OPTION);
184 ERR_asprintf_error_data("name=%s", cnf->name);
185 return NULL;
186 }
187 }
188
189 if (!ctx || !ctx->issuer_cert) {
190 if (ctx && (ctx->flags == CTX_TEST))
191 return AUTHORITY_KEYID_new();
192 X509V3error(X509V3_R_NO_ISSUER_CERTIFICATE);
193 return NULL;
194 }
195
196 cert = ctx->issuer_cert;
197
198 if (keyid) {
199 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
200 if ((i >= 0) && (ext = X509_get_ext(cert, i)))
201 ikeyid = X509V3_EXT_d2i(ext);
202 if (keyid == 2 && !ikeyid) {
203 X509V3error(X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
204 return NULL;
205 }
206 }
207
208 if ((issuer && !ikeyid) || (issuer == 2)) {
209 isname = X509_NAME_dup(X509_get_issuer_name(cert));
210 serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert));
211 if (!isname || !serial) {
212 X509V3error(X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
213 goto err;
214 }
215 }
216
217 if (!(akeyid = AUTHORITY_KEYID_new()))
218 goto err;
219
220 if (isname) {
221 if (!(gens = sk_GENERAL_NAME_new_null()) ||
222 !(gen = GENERAL_NAME_new()) ||
223 !sk_GENERAL_NAME_push(gens, gen)) {
224 X509V3error(ERR_R_MALLOC_FAILURE);
225 goto err;
226 }
227 gen->type = GEN_DIRNAME;
228 gen->d.dirn = isname;
229 }
230
231 akeyid->issuer = gens;
232 akeyid->serial = serial;
233 akeyid->keyid = ikeyid;
234
235 return akeyid;
236
237 err:
238 AUTHORITY_KEYID_free(akeyid);
239 GENERAL_NAME_free(gen);
240 sk_GENERAL_NAME_free(gens);
241 X509_NAME_free(isname);
242 ASN1_INTEGER_free(serial);
243 ASN1_OCTET_STRING_free(ikeyid);
244 return NULL;
245 }
246