1*b077aed3SPierre Pronchery /* 2*b077aed3SPierre Pronchery * Copyright 2004-2021 The OpenSSL Project Authors. All Rights Reserved. 3*b077aed3SPierre Pronchery * 4*b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use 5*b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy 6*b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at 7*b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html 8*b077aed3SPierre Pronchery */ 9*b077aed3SPierre Pronchery 10*b077aed3SPierre Pronchery #include "internal/cryptlib.h" 11*b077aed3SPierre Pronchery #include <openssl/x509.h> 12*b077aed3SPierre Pronchery #include <openssl/x509v3.h> 13*b077aed3SPierre Pronchery #include "crypto/x509.h" 14*b077aed3SPierre Pronchery 15*b077aed3SPierre Pronchery #include "pcy_local.h" 16*b077aed3SPierre Pronchery 17*b077aed3SPierre Pronchery /* 18*b077aed3SPierre Pronchery * Set policy mapping entries in cache. Note: this modifies the passed 19*b077aed3SPierre Pronchery * POLICY_MAPPINGS structure 20*b077aed3SPierre Pronchery */ 21*b077aed3SPierre Pronchery ossl_policy_cache_set_mapping(X509 * x,POLICY_MAPPINGS * maps)22*b077aed3SPierre Proncheryint ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) 23*b077aed3SPierre Pronchery { 24*b077aed3SPierre Pronchery POLICY_MAPPING *map; 25*b077aed3SPierre Pronchery X509_POLICY_DATA *data; 26*b077aed3SPierre Pronchery X509_POLICY_CACHE *cache = x->policy_cache; 27*b077aed3SPierre Pronchery int i; 28*b077aed3SPierre Pronchery int ret = 0; 29*b077aed3SPierre Pronchery if (sk_POLICY_MAPPING_num(maps) == 0) { 30*b077aed3SPierre Pronchery ret = -1; 31*b077aed3SPierre Pronchery goto bad_mapping; 32*b077aed3SPierre Pronchery } 33*b077aed3SPierre Pronchery for (i = 0; i < sk_POLICY_MAPPING_num(maps); i++) { 34*b077aed3SPierre Pronchery map = sk_POLICY_MAPPING_value(maps, i); 35*b077aed3SPierre Pronchery /* Reject if map to or from anyPolicy */ 36*b077aed3SPierre Pronchery if ((OBJ_obj2nid(map->subjectDomainPolicy) == NID_any_policy) 37*b077aed3SPierre Pronchery || (OBJ_obj2nid(map->issuerDomainPolicy) == NID_any_policy)) { 38*b077aed3SPierre Pronchery ret = -1; 39*b077aed3SPierre Pronchery goto bad_mapping; 40*b077aed3SPierre Pronchery } 41*b077aed3SPierre Pronchery 42*b077aed3SPierre Pronchery /* Attempt to find matching policy data */ 43*b077aed3SPierre Pronchery data = ossl_policy_cache_find_data(cache, map->issuerDomainPolicy); 44*b077aed3SPierre Pronchery /* If we don't have anyPolicy can't map */ 45*b077aed3SPierre Pronchery if (data == NULL && !cache->anyPolicy) 46*b077aed3SPierre Pronchery continue; 47*b077aed3SPierre Pronchery 48*b077aed3SPierre Pronchery /* Create a NODE from anyPolicy */ 49*b077aed3SPierre Pronchery if (data == NULL) { 50*b077aed3SPierre Pronchery data = ossl_policy_data_new(NULL, map->issuerDomainPolicy, 51*b077aed3SPierre Pronchery cache->anyPolicy->flags 52*b077aed3SPierre Pronchery & POLICY_DATA_FLAG_CRITICAL); 53*b077aed3SPierre Pronchery if (data == NULL) 54*b077aed3SPierre Pronchery goto bad_mapping; 55*b077aed3SPierre Pronchery data->qualifier_set = cache->anyPolicy->qualifier_set; 56*b077aed3SPierre Pronchery /* 57*b077aed3SPierre Pronchery * map->issuerDomainPolicy = NULL; 58*b077aed3SPierre Pronchery */ 59*b077aed3SPierre Pronchery data->flags |= POLICY_DATA_FLAG_MAPPED_ANY; 60*b077aed3SPierre Pronchery data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; 61*b077aed3SPierre Pronchery if (!sk_X509_POLICY_DATA_push(cache->data, data)) { 62*b077aed3SPierre Pronchery ossl_policy_data_free(data); 63*b077aed3SPierre Pronchery goto bad_mapping; 64*b077aed3SPierre Pronchery } 65*b077aed3SPierre Pronchery } else 66*b077aed3SPierre Pronchery data->flags |= POLICY_DATA_FLAG_MAPPED; 67*b077aed3SPierre Pronchery if (!sk_ASN1_OBJECT_push(data->expected_policy_set, 68*b077aed3SPierre Pronchery map->subjectDomainPolicy)) 69*b077aed3SPierre Pronchery goto bad_mapping; 70*b077aed3SPierre Pronchery map->subjectDomainPolicy = NULL; 71*b077aed3SPierre Pronchery 72*b077aed3SPierre Pronchery } 73*b077aed3SPierre Pronchery 74*b077aed3SPierre Pronchery ret = 1; 75*b077aed3SPierre Pronchery bad_mapping: 76*b077aed3SPierre Pronchery sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); 77*b077aed3SPierre Pronchery return ret; 78*b077aed3SPierre Pronchery 79*b077aed3SPierre Pronchery } 80