1 /* $OpenBSD: x509_pcons.c,v 1.1 2020/06/04 15:19:32 jsing Exp $ */
2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3  * project.
4  */
5 /* ====================================================================
6  * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * (eay@cryptsoft.com).  This product includes software written by Tim
55  * Hudson (tjh@cryptsoft.com).
56  *
57  */
58 
59 #include <stdio.h>
60 #include <string.h>
61 
62 #include <openssl/asn1.h>
63 #include <openssl/asn1t.h>
64 #include <openssl/conf.h>
65 #include <openssl/err.h>
66 #include <openssl/x509v3.h>
67 
68 static STACK_OF(CONF_VALUE) *
69 i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *bcons,
70     STACK_OF(CONF_VALUE) *extlist);
71 static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method,
72     X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
73 
74 const X509V3_EXT_METHOD v3_policy_constraints = {
75 	.ext_nid = NID_policy_constraints,
76 	.ext_flags = 0,
77 	.it = &POLICY_CONSTRAINTS_it,
78 	.ext_new = NULL,
79 	.ext_free = NULL,
80 	.d2i = NULL,
81 	.i2d = NULL,
82 	.i2s = NULL,
83 	.s2i = NULL,
84 	.i2v = i2v_POLICY_CONSTRAINTS,
85 	.v2i = v2i_POLICY_CONSTRAINTS,
86 	.i2r = NULL,
87 	.r2i = NULL,
88 	.usr_data = NULL,
89 };
90 
91 static const ASN1_TEMPLATE POLICY_CONSTRAINTS_seq_tt[] = {
92 	{
93 		.flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
94 		.tag = 0,
95 		.offset = offsetof(POLICY_CONSTRAINTS, requireExplicitPolicy),
96 		.field_name = "requireExplicitPolicy",
97 		.item = &ASN1_INTEGER_it,
98 	},
99 	{
100 		.flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
101 		.tag = 1,
102 		.offset = offsetof(POLICY_CONSTRAINTS, inhibitPolicyMapping),
103 		.field_name = "inhibitPolicyMapping",
104 		.item = &ASN1_INTEGER_it,
105 	},
106 };
107 
108 const ASN1_ITEM POLICY_CONSTRAINTS_it = {
109 	.itype = ASN1_ITYPE_SEQUENCE,
110 	.utype = V_ASN1_SEQUENCE,
111 	.templates = POLICY_CONSTRAINTS_seq_tt,
112 	.tcount = sizeof(POLICY_CONSTRAINTS_seq_tt) / sizeof(ASN1_TEMPLATE),
113 	.funcs = NULL,
114 	.size = sizeof(POLICY_CONSTRAINTS),
115 	.sname = "POLICY_CONSTRAINTS",
116 };
117 
118 
119 POLICY_CONSTRAINTS *
120 POLICY_CONSTRAINTS_new(void)
121 {
122 	return (POLICY_CONSTRAINTS*)ASN1_item_new(&POLICY_CONSTRAINTS_it);
123 }
124 
125 void
126 POLICY_CONSTRAINTS_free(POLICY_CONSTRAINTS *a)
127 {
128 	ASN1_item_free((ASN1_VALUE *)a, &POLICY_CONSTRAINTS_it);
129 }
130 
131 static STACK_OF(CONF_VALUE) *
132 i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
133     STACK_OF(CONF_VALUE) *extlist)
134 {
135 	POLICY_CONSTRAINTS *pcons = a;
136 	STACK_OF(CONF_VALUE) *free_extlist = NULL;
137 
138 	if (extlist == NULL) {
139 		if ((free_extlist = extlist = sk_CONF_VALUE_new_null()) == NULL)
140 			return NULL;
141 	}
142 
143 	if (!X509V3_add_value_int("Require Explicit Policy",
144 	    pcons->requireExplicitPolicy, &extlist))
145 		goto err;
146 	if (!X509V3_add_value_int("Inhibit Policy Mapping",
147 	    pcons->inhibitPolicyMapping, &extlist))
148 		goto err;
149 
150 	return extlist;
151 
152  err:
153 	sk_CONF_VALUE_pop_free(free_extlist, X509V3_conf_free);
154 
155 	return NULL;
156 }
157 
158 static void *
159 v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
160     STACK_OF(CONF_VALUE) *values)
161 {
162 	POLICY_CONSTRAINTS *pcons = NULL;
163 	CONF_VALUE *val;
164 	int i;
165 
166 	if (!(pcons = POLICY_CONSTRAINTS_new())) {
167 		X509V3error(ERR_R_MALLOC_FAILURE);
168 		return NULL;
169 	}
170 	for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
171 		val = sk_CONF_VALUE_value(values, i);
172 		if (!strcmp(val->name, "requireExplicitPolicy")) {
173 			if (!X509V3_get_value_int(val,
174 			    &pcons->requireExplicitPolicy)) goto err;
175 		} else if (!strcmp(val->name, "inhibitPolicyMapping")) {
176 			if (!X509V3_get_value_int(val,
177 			    &pcons->inhibitPolicyMapping)) goto err;
178 		} else {
179 			X509V3error(X509V3_R_INVALID_NAME);
180 			X509V3_conf_err(val);
181 			goto err;
182 		}
183 	}
184 	if (!pcons->inhibitPolicyMapping && !pcons->requireExplicitPolicy) {
185 		X509V3error(X509V3_R_ILLEGAL_EMPTY_EXTENSION);
186 		goto err;
187 	}
188 
189 	return pcons;
190 
191 err:
192 	POLICY_CONSTRAINTS_free(pcons);
193 	return NULL;
194 }
195