1/* 2 * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10/* X509 v3 extension utilities */ 11 12#include <stdio.h> 13#include "internal/cryptlib.h" 14#include <openssl/conf.h> 15#include <openssl/x509v3.h> 16 17#include "ext_dat.h" 18 19static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL; 20 21static int ext_cmp(const X509V3_EXT_METHOD *const *a, 22 const X509V3_EXT_METHOD *const *b); 23static void ext_list_free(X509V3_EXT_METHOD *ext); 24 25int X509V3_EXT_add(X509V3_EXT_METHOD *ext) 26{ 27 if (ext_list == NULL 28 && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) { 29 ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE); 30 return 0; 31 } 32 if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) { 33 ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE); 34 return 0; 35 } 36 return 1; 37} 38 39static int ext_cmp(const X509V3_EXT_METHOD *const *a, 40 const X509V3_EXT_METHOD *const *b) 41{ 42 return ((*a)->ext_nid - (*b)->ext_nid); 43} 44 45DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *, 46 const X509V3_EXT_METHOD *, ext); 47IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *, 48 const X509V3_EXT_METHOD *, ext); 49 50#include "standard_exts.h" 51 52const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid) 53{ 54 X509V3_EXT_METHOD tmp; 55 const X509V3_EXT_METHOD *t = &tmp, *const *ret; 56 int idx; 57 58 if (nid < 0) 59 return NULL; 60 tmp.ext_nid = nid; 61 ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT); 62 if (ret) 63 return *ret; 64 if (!ext_list) 65 return NULL; 66 idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp); 67 return sk_X509V3_EXT_METHOD_value(ext_list, idx); 68} 69 70const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext) 71{ 72 int nid; 73 if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef) 74 return NULL; 75 return X509V3_EXT_get_nid(nid); 76} 77 78int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist) 79{ 80 for (; extlist->ext_nid != -1; extlist++) 81 if (!X509V3_EXT_add(extlist)) 82 return 0; 83 return 1; 84} 85 86int X509V3_EXT_add_alias(int nid_to, int nid_from) 87{ 88 const X509V3_EXT_METHOD *ext; 89 X509V3_EXT_METHOD *tmpext; 90 91 if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) { 92 ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND); 93 return 0; 94 } 95 if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL) { 96 ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE); 97 return 0; 98 } 99 *tmpext = *ext; 100 tmpext->ext_nid = nid_to; 101 tmpext->ext_flags |= X509V3_EXT_DYNAMIC; 102 return X509V3_EXT_add(tmpext); 103} 104 105void X509V3_EXT_cleanup(void) 106{ 107 sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free); 108 ext_list = NULL; 109} 110 111static void ext_list_free(X509V3_EXT_METHOD *ext) 112{ 113 if (ext->ext_flags & X509V3_EXT_DYNAMIC) 114 OPENSSL_free(ext); 115} 116 117/* 118 * Legacy function: we don't need to add standard extensions any more because 119 * they are now kept in ext_dat.h. 120 */ 121 122int X509V3_add_standard_extensions(void) 123{ 124 return 1; 125} 126 127/* Return an extension internal structure */ 128 129void *X509V3_EXT_d2i(X509_EXTENSION *ext) 130{ 131 const X509V3_EXT_METHOD *method; 132 const unsigned char *p; 133 ASN1_STRING *extvalue; 134 int extlen; 135 136 if ((method = X509V3_EXT_get(ext)) == NULL) 137 return NULL; 138 extvalue = X509_EXTENSION_get_data(ext); 139 p = ASN1_STRING_get0_data(extvalue); 140 extlen = ASN1_STRING_length(extvalue); 141 if (method->it) 142 return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it)); 143 return method->d2i(NULL, &p, extlen); 144} 145 146/*- 147 * Get critical flag and decoded version of extension from a NID. 148 * The "idx" variable returns the last found extension and can 149 * be used to retrieve multiple extensions of the same NID. 150 * However multiple extensions with the same NID is usually 151 * due to a badly encoded certificate so if idx is NULL we 152 * choke if multiple extensions exist. 153 * The "crit" variable is set to the critical value. 154 * The return value is the decoded extension or NULL on 155 * error. The actual error can have several different causes, 156 * the value of *crit reflects the cause: 157 * >= 0, extension found but not decoded (reflects critical value). 158 * -1 extension not found. 159 * -2 extension occurs more than once. 160 */ 161 162void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit, 163 int *idx) 164{ 165 int lastpos, i; 166 X509_EXTENSION *ex, *found_ex = NULL; 167 168 if (!x) { 169 if (idx) 170 *idx = -1; 171 if (crit) 172 *crit = -1; 173 return NULL; 174 } 175 if (idx) 176 lastpos = *idx + 1; 177 else 178 lastpos = 0; 179 if (lastpos < 0) 180 lastpos = 0; 181 for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) { 182 ex = sk_X509_EXTENSION_value(x, i); 183 if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) { 184 if (idx) { 185 *idx = i; 186 found_ex = ex; 187 break; 188 } else if (found_ex) { 189 /* Found more than one */ 190 if (crit) 191 *crit = -2; 192 return NULL; 193 } 194 found_ex = ex; 195 } 196 } 197 if (found_ex) { 198 /* Found it */ 199 if (crit) 200 *crit = X509_EXTENSION_get_critical(found_ex); 201 return X509V3_EXT_d2i(found_ex); 202 } 203 204 /* Extension not found */ 205 if (idx) 206 *idx = -1; 207 if (crit) 208 *crit = -1; 209 return NULL; 210} 211 212/* 213 * This function is a general extension append, replace and delete utility. 214 * The precise operation is governed by the 'flags' value. The 'crit' and 215 * 'value' arguments (if relevant) are the extensions internal structure. 216 */ 217 218int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value, 219 int crit, unsigned long flags) 220{ 221 int errcode, extidx = -1; 222 X509_EXTENSION *ext = NULL, *extmp; 223 STACK_OF(X509_EXTENSION) *ret = NULL; 224 unsigned long ext_op = flags & X509V3_ADD_OP_MASK; 225 226 /* 227 * If appending we don't care if it exists, otherwise look for existing 228 * extension. 229 */ 230 if (ext_op != X509V3_ADD_APPEND) 231 extidx = X509v3_get_ext_by_NID(*x, nid, -1); 232 233 /* See if extension exists */ 234 if (extidx >= 0) { 235 /* If keep existing, nothing to do */ 236 if (ext_op == X509V3_ADD_KEEP_EXISTING) 237 return 1; 238 /* If default then its an error */ 239 if (ext_op == X509V3_ADD_DEFAULT) { 240 errcode = X509V3_R_EXTENSION_EXISTS; 241 goto err; 242 } 243 /* If delete, just delete it */ 244 if (ext_op == X509V3_ADD_DELETE) { 245 extmp = sk_X509_EXTENSION_delete(*x, extidx); 246 if (extmp == NULL) 247 return -1; 248 X509_EXTENSION_free(extmp); 249 return 1; 250 } 251 } else { 252 /* 253 * If replace existing or delete, error since extension must exist 254 */ 255 if ((ext_op == X509V3_ADD_REPLACE_EXISTING) || 256 (ext_op == X509V3_ADD_DELETE)) { 257 errcode = X509V3_R_EXTENSION_NOT_FOUND; 258 goto err; 259 } 260 } 261 262 /* 263 * If we get this far then we have to create an extension: could have 264 * some flags for alternative encoding schemes... 265 */ 266 267 ext = X509V3_EXT_i2d(nid, crit, value); 268 269 if (!ext) { 270 ERR_raise(ERR_LIB_X509V3, X509V3_R_ERROR_CREATING_EXTENSION); 271 return 0; 272 } 273 274 /* If extension exists replace it.. */ 275 if (extidx >= 0) { 276 extmp = sk_X509_EXTENSION_value(*x, extidx); 277 X509_EXTENSION_free(extmp); 278 if (!sk_X509_EXTENSION_set(*x, extidx, ext)) 279 return -1; 280 return 1; 281 } 282 283 ret = *x; 284 if (*x == NULL 285 && (ret = sk_X509_EXTENSION_new_null()) == NULL) 286 goto m_fail; 287 if (!sk_X509_EXTENSION_push(ret, ext)) 288 goto m_fail; 289 290 *x = ret; 291 return 1; 292 293 m_fail: 294 /* ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE); */ 295 if (ret != *x) 296 sk_X509_EXTENSION_free(ret); 297 X509_EXTENSION_free(ext); 298 return -1; 299 300 err: 301 if (!(flags & X509V3_ADD_SILENT)) 302 ERR_raise(ERR_LIB_X509V3, errcode); 303 return 0; 304} 305