summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libcrypto/x509v3/v3_addr.c2068
-rw-r--r--src/lib/libcrypto/x509v3/v3_akey.c122
-rw-r--r--src/lib/libcrypto/x509v3/v3_akeya.c2
-rw-r--r--src/lib/libcrypto/x509v3/v3_alt.c517
-rw-r--r--src/lib/libcrypto/x509v3/v3_asid.c1354
-rw-r--r--src/lib/libssl/src/crypto/x509v3/v3_addr.c2068
-rw-r--r--src/lib/libssl/src/crypto/x509v3/v3_akey.c122
-rw-r--r--src/lib/libssl/src/crypto/x509v3/v3_akeya.c2
-rw-r--r--src/lib/libssl/src/crypto/x509v3/v3_alt.c517
-rw-r--r--src/lib/libssl/src/crypto/x509v3/v3_asid.c1354
10 files changed, 4184 insertions, 3942 deletions
diff --git a/src/lib/libcrypto/x509v3/v3_addr.c b/src/lib/libcrypto/x509v3/v3_addr.c
index 179f08d222..084209f5a1 100644
--- a/src/lib/libcrypto/x509v3/v3_addr.c
+++ b/src/lib/libcrypto/x509v3/v3_addr.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -76,28 +76,28 @@
76 */ 76 */
77 77
78ASN1_SEQUENCE(IPAddressRange) = { 78ASN1_SEQUENCE(IPAddressRange) = {
79 ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING), 79 ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
80 ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING) 80 ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
81} ASN1_SEQUENCE_END(IPAddressRange) 81} ASN1_SEQUENCE_END(IPAddressRange)
82 82
83ASN1_CHOICE(IPAddressOrRange) = { 83ASN1_CHOICE(IPAddressOrRange) = {
84 ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING), 84 ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
85 ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange) 85 ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
86} ASN1_CHOICE_END(IPAddressOrRange) 86} ASN1_CHOICE_END(IPAddressOrRange)
87 87
88ASN1_CHOICE(IPAddressChoice) = { 88ASN1_CHOICE(IPAddressChoice) = {
89 ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL), 89 ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
90 ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange) 90 ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
91} ASN1_CHOICE_END(IPAddressChoice) 91} ASN1_CHOICE_END(IPAddressChoice)
92 92
93ASN1_SEQUENCE(IPAddressFamily) = { 93ASN1_SEQUENCE(IPAddressFamily) = {
94 ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING), 94 ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
95 ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice) 95 ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
96} ASN1_SEQUENCE_END(IPAddressFamily) 96} ASN1_SEQUENCE_END(IPAddressFamily)
97 97
98ASN1_ITEM_TEMPLATE(IPAddrBlocks) = 98ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
99 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, 99 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
100 IPAddrBlocks, IPAddressFamily) 100 IPAddrBlocks, IPAddressFamily)
101ASN1_ITEM_TEMPLATE_END(IPAddrBlocks) 101ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
102 102
103IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange) 103IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
@@ -113,54 +113,53 @@ IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
113/* 113/*
114 * What's the address length associated with this AFI? 114 * What's the address length associated with this AFI?
115 */ 115 */
116static int length_from_afi(const unsigned afi) 116static int
117length_from_afi(const unsigned afi)
117{ 118{
118 switch (afi) { 119 switch (afi) {
119 case IANA_AFI_IPV4: 120 case IANA_AFI_IPV4:
120 return 4; 121 return 4;
121 case IANA_AFI_IPV6: 122 case IANA_AFI_IPV6:
122 return 16; 123 return 16;
123 default: 124 default:
124 return 0; 125 return 0;
125 } 126 }
126} 127}
127 128
128/* 129/*
129 * Extract the AFI from an IPAddressFamily. 130 * Extract the AFI from an IPAddressFamily.
130 */ 131 */
131unsigned int v3_addr_get_afi(const IPAddressFamily *f) 132unsigned int
133v3_addr_get_afi(const IPAddressFamily *f)
132{ 134{
133 return ((f != NULL && 135 return ((f != NULL && f->addressFamily != NULL &&
134 f->addressFamily != NULL && 136 f->addressFamily->data != NULL) ?
135 f->addressFamily->data != NULL) 137 ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1])) :
136 ? ((f->addressFamily->data[0] << 8) | 138 0);
137 (f->addressFamily->data[1]))
138 : 0);
139} 139}
140 140
141/* 141/*
142 * Expand the bitstring form of an address into a raw byte array. 142 * Expand the bitstring form of an address into a raw byte array.
143 * At the moment this is coded for simplicity, not speed. 143 * At the moment this is coded for simplicity, not speed.
144 */ 144 */
145static int addr_expand(unsigned char *addr, 145static int
146 const ASN1_BIT_STRING *bs, 146addr_expand(unsigned char *addr, const ASN1_BIT_STRING *bs, const int length,
147 const int length, 147 const unsigned char fill)
148 const unsigned char fill)
149{ 148{
150 if (bs->length < 0 || bs->length > length) 149 if (bs->length < 0 || bs->length > length)
151 return 0; 150 return 0;
152 if (bs->length > 0) { 151 if (bs->length > 0) {
153 memcpy(addr, bs->data, bs->length); 152 memcpy(addr, bs->data, bs->length);
154 if ((bs->flags & 7) != 0) { 153 if ((bs->flags & 7) != 0) {
155 unsigned char mask = 0xFF >> (8 - (bs->flags & 7)); 154 unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
156 if (fill == 0) 155 if (fill == 0)
157 addr[bs->length - 1] &= ~mask; 156 addr[bs->length - 1] &= ~mask;
158 else 157 else
159 addr[bs->length - 1] |= mask; 158 addr[bs->length - 1] |= mask;
160 } 159 }
161 } 160 }
162 memset(addr + bs->length, fill, length - bs->length); 161 memset(addr + bs->length, fill, length - bs->length);
163 return 1; 162 return 1;
164} 163}
165 164
166/* 165/*
@@ -171,145 +170,150 @@ static int addr_expand(unsigned char *addr,
171/* 170/*
172 * i2r handler for one address bitstring. 171 * i2r handler for one address bitstring.
173 */ 172 */
174static int i2r_address(BIO *out, 173static int
175 const unsigned afi, 174i2r_address(BIO *out, const unsigned afi, const unsigned char fill,
176 const unsigned char fill, 175 const ASN1_BIT_STRING *bs)
177 const ASN1_BIT_STRING *bs)
178{ 176{
179 unsigned char addr[ADDR_RAW_BUF_LEN]; 177 unsigned char addr[ADDR_RAW_BUF_LEN];
180 int i, n; 178 int i, n;
181 179
182 if (bs->length < 0) 180 if (bs->length < 0)
183 return 0; 181 return 0;
184 switch (afi) { 182 switch (afi) {
185 case IANA_AFI_IPV4: 183 case IANA_AFI_IPV4:
186 if (!addr_expand(addr, bs, 4, fill)) 184 if (!addr_expand(addr, bs, 4, fill))
187 return 0; 185 return 0;
188 BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]); 186 BIO_printf(out, "%d.%d.%d.%d",
189 break; 187 addr[0], addr[1], addr[2], addr[3]);
190 case IANA_AFI_IPV6: 188 break;
191 if (!addr_expand(addr, bs, 16, fill)) 189 case IANA_AFI_IPV6:
192 return 0; 190 if (!addr_expand(addr, bs, 16, fill))
193 for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2) 191 return 0;
194 ; 192 for (n = 16;
195 for (i = 0; i < n; i += 2) 193 n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00; n -= 2)
196 BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i+1], (i < 14 ? ":" : "")); 194 ;
197 if (i < 16) 195 for (i = 0; i < n; i += 2)
198 BIO_puts(out, ":"); 196 BIO_printf(out, "%x%s",
199 if (i == 0) 197 (addr[i] << 8) | addr[i + 1], (i < 14 ? ":" : ""));
200 BIO_puts(out, ":"); 198 if (i < 16)
201 break; 199 BIO_puts(out, ":");
202 default: 200 if (i == 0)
203 for (i = 0; i < bs->length; i++) 201 BIO_puts(out, ":");
204 BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]); 202 break;
205 BIO_printf(out, "[%d]", (int) (bs->flags & 7)); 203 default:
206 break; 204 for (i = 0; i < bs->length; i++)
207 } 205 BIO_printf(out, "%s%02x",
208 return 1; 206 (i > 0 ? ":" : ""), bs->data[i]);
207 BIO_printf(out, "[%d]", (int)(bs->flags & 7));
208 break;
209 }
210 return 1;
209} 211}
210 212
211/* 213/*
212 * i2r handler for a sequence of addresses and ranges. 214 * i2r handler for a sequence of addresses and ranges.
213 */ 215 */
214static int i2r_IPAddressOrRanges(BIO *out, 216static int
215 const int indent, 217i2r_IPAddressOrRanges(BIO *out, const int indent, const IPAddressOrRanges *aors,
216 const IPAddressOrRanges *aors, 218 const unsigned afi)
217 const unsigned afi)
218{ 219{
219 int i; 220 int i;
220 for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) { 221
221 const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i); 222 for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
222 BIO_printf(out, "%*s", indent, ""); 223 const IPAddressOrRange *aor =
223 switch (aor->type) { 224 sk_IPAddressOrRange_value(aors, i);
224 case IPAddressOrRange_addressPrefix: 225 BIO_printf(out, "%*s", indent, "");
225 if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix)) 226 switch (aor->type) {
226 return 0; 227 case IPAddressOrRange_addressPrefix:
227 BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix)); 228 if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
228 continue; 229 return 0;
229 case IPAddressOrRange_addressRange: 230 BIO_printf(out, "/%d\n",
230 if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min)) 231 addr_prefixlen(aor->u.addressPrefix));
231 return 0; 232 continue;
232 BIO_puts(out, "-"); 233 case IPAddressOrRange_addressRange:
233 if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max)) 234 if (!i2r_address(out, afi, 0x00,
234 return 0; 235 aor->u.addressRange->min))
235 BIO_puts(out, "\n"); 236 return 0;
236 continue; 237 BIO_puts(out, "-");
237 } 238 if (!i2r_address(out, afi, 0xFF,
238 } 239 aor->u.addressRange->max))
239 return 1; 240 return 0;
241 BIO_puts(out, "\n");
242 continue;
243 }
244 }
245 return 1;
240} 246}
241 247
242/* 248/*
243 * i2r handler for an IPAddrBlocks extension. 249 * i2r handler for an IPAddrBlocks extension.
244 */ 250 */
245static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, 251static int
246 void *ext, 252i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, void *ext, BIO *out,
247 BIO *out, 253 int indent)
248 int indent)
249{ 254{
250 const IPAddrBlocks *addr = ext; 255 const IPAddrBlocks *addr = ext;
251 int i; 256 int i;
252 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 257
253 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 258 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
254 const unsigned int afi = v3_addr_get_afi(f); 259 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
255 switch (afi) { 260 const unsigned int afi = v3_addr_get_afi(f);
256 case IANA_AFI_IPV4: 261 switch (afi) {
257 BIO_printf(out, "%*sIPv4", indent, ""); 262 case IANA_AFI_IPV4:
258 break; 263 BIO_printf(out, "%*sIPv4", indent, "");
259 case IANA_AFI_IPV6: 264 break;
260 BIO_printf(out, "%*sIPv6", indent, ""); 265 case IANA_AFI_IPV6:
261 break; 266 BIO_printf(out, "%*sIPv6", indent, "");
262 default: 267 break;
263 BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi); 268 default:
264 break; 269 BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
265 } 270 break;
266 if (f->addressFamily->length > 2) { 271 }
267 switch (f->addressFamily->data[2]) { 272 if (f->addressFamily->length > 2) {
268 case 1: 273 switch (f->addressFamily->data[2]) {
269 BIO_puts(out, " (Unicast)"); 274 case 1:
270 break; 275 BIO_puts(out, " (Unicast)");
271 case 2: 276 break;
272 BIO_puts(out, " (Multicast)"); 277 case 2:
273 break; 278 BIO_puts(out, " (Multicast)");
274 case 3: 279 break;
275 BIO_puts(out, " (Unicast/Multicast)"); 280 case 3:
276 break; 281 BIO_puts(out, " (Unicast/Multicast)");
277 case 4: 282 break;
278 BIO_puts(out, " (MPLS)"); 283 case 4:
279 break; 284 BIO_puts(out, " (MPLS)");
280 case 64: 285 break;
281 BIO_puts(out, " (Tunnel)"); 286 case 64:
282 break; 287 BIO_puts(out, " (Tunnel)");
283 case 65: 288 break;
284 BIO_puts(out, " (VPLS)"); 289 case 65:
285 break; 290 BIO_puts(out, " (VPLS)");
286 case 66: 291 break;
287 BIO_puts(out, " (BGP MDT)"); 292 case 66:
288 break; 293 BIO_puts(out, " (BGP MDT)");
289 case 128: 294 break;
290 BIO_puts(out, " (MPLS-labeled VPN)"); 295 case 128:
291 break; 296 BIO_puts(out, " (MPLS-labeled VPN)");
292 default: 297 break;
293 BIO_printf(out, " (Unknown SAFI %u)", 298 default:
294 (unsigned) f->addressFamily->data[2]); 299 BIO_printf(out, " (Unknown SAFI %u)",
295 break; 300 (unsigned)f->addressFamily->data[2]);
296 } 301 break;
297 } 302 }
298 switch (f->ipAddressChoice->type) { 303 }
299 case IPAddressChoice_inherit: 304 switch (f->ipAddressChoice->type) {
300 BIO_puts(out, ": inherit\n"); 305 case IPAddressChoice_inherit:
301 break; 306 BIO_puts(out, ": inherit\n");
302 case IPAddressChoice_addressesOrRanges: 307 break;
303 BIO_puts(out, ":\n"); 308 case IPAddressChoice_addressesOrRanges:
304 if (!i2r_IPAddressOrRanges(out, 309 BIO_puts(out, ":\n");
305 indent + 2, 310 if (!i2r_IPAddressOrRanges(out, indent + 2,
306 f->ipAddressChoice->u.addressesOrRanges, 311 f->ipAddressChoice->u.addressesOrRanges, afi))
307 afi)) 312 return 0;
308 return 0; 313 break;
309 break; 314 }
310 } 315 }
311 } 316 return 1;
312 return 1;
313} 317}
314 318
315/* 319/*
@@ -322,134 +326,151 @@ static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
322 * function returns -1. If this messes up your preferred sort order 326 * function returns -1. If this messes up your preferred sort order
323 * for garbage input, tough noogies. 327 * for garbage input, tough noogies.
324 */ 328 */
325static int IPAddressOrRange_cmp(const IPAddressOrRange *a, 329static int
326 const IPAddressOrRange *b, 330IPAddressOrRange_cmp(const IPAddressOrRange *a, const IPAddressOrRange *b,
327 const int length) 331 const int length)
328{ 332{
329 unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN]; 333 unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
330 int prefixlen_a = 0, prefixlen_b = 0; 334 int prefixlen_a = 0, prefixlen_b = 0;
331 int r; 335 int r;
332 336
333 switch (a->type) { 337 switch (a->type) {
334 case IPAddressOrRange_addressPrefix: 338 case IPAddressOrRange_addressPrefix:
335 if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00)) 339 if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00))
336 return -1; 340 return -1;
337 prefixlen_a = addr_prefixlen(a->u.addressPrefix); 341 prefixlen_a = addr_prefixlen(a->u.addressPrefix);
338 break; 342 break;
339 case IPAddressOrRange_addressRange: 343 case IPAddressOrRange_addressRange:
340 if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00)) 344 if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00))
341 return -1; 345 return -1;
342 prefixlen_a = length * 8; 346 prefixlen_a = length * 8;
343 break; 347 break;
344 } 348 }
345 349
346 switch (b->type) { 350 switch (b->type) {
347 case IPAddressOrRange_addressPrefix: 351 case IPAddressOrRange_addressPrefix:
348 if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00)) 352 if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00))
349 return -1; 353 return -1;
350 prefixlen_b = addr_prefixlen(b->u.addressPrefix); 354 prefixlen_b = addr_prefixlen(b->u.addressPrefix);
351 break; 355 break;
352 case IPAddressOrRange_addressRange: 356 case IPAddressOrRange_addressRange:
353 if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00)) 357 if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00))
354 return -1; 358 return -1;
355 prefixlen_b = length * 8; 359 prefixlen_b = length * 8;
356 break; 360 break;
357 } 361 }
358 362
359 if ((r = memcmp(addr_a, addr_b, length)) != 0) 363 if ((r = memcmp(addr_a, addr_b, length)) != 0)
360 return r; 364 return r;
361 else 365 else
362 return prefixlen_a - prefixlen_b; 366 return prefixlen_a - prefixlen_b;
363} 367}
364 368
365/* 369/*
366 * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort() 370 * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
367 * comparision routines are only allowed two arguments. 371 * comparision routines are only allowed two arguments.
368 */ 372 */
369static int v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a, 373static int
370 const IPAddressOrRange * const *b) 374v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
375 const IPAddressOrRange * const *b)
371{ 376{
372 return IPAddressOrRange_cmp(*a, *b, 4); 377 return IPAddressOrRange_cmp(*a, *b, 4);
373} 378}
374 379
375/* 380/*
376 * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort() 381 * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
377 * comparision routines are only allowed two arguments. 382 * comparision routines are only allowed two arguments.
378 */ 383 */
379static int v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a, 384static int
380 const IPAddressOrRange * const *b) 385v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
386 const IPAddressOrRange * const *b)
381{ 387{
382 return IPAddressOrRange_cmp(*a, *b, 16); 388 return IPAddressOrRange_cmp(*a, *b, 16);
383} 389}
384 390
385/* 391/*
386 * Calculate whether a range collapses to a prefix. 392 * Calculate whether a range collapses to a prefix.
387 * See last paragraph of RFC 3779 2.2.3.7. 393 * See last paragraph of RFC 3779 2.2.3.7.
388 */ 394 */
389static int range_should_be_prefix(const unsigned char *min, 395static int
390 const unsigned char *max, 396range_should_be_prefix(const unsigned char *min, const unsigned char *max,
391 const int length) 397 const int length)
392{ 398{
393 unsigned char mask; 399 unsigned char mask;
394 int i, j; 400 int i, j;
395 401
396 OPENSSL_assert(memcmp(min, max, length) <= 0); 402 OPENSSL_assert(memcmp(min, max, length) <= 0);
397 for (i = 0; i < length && min[i] == max[i]; i++) 403 for (i = 0; i < length && min[i] == max[i]; i++)
398 ; 404 ;
399 for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) 405 for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--)
400 ; 406 ;
401 if (i < j) 407 if (i < j)
402 return -1; 408 return -1;
403 if (i > j) 409 if (i > j)
404 return i * 8; 410 return i * 8;
405 mask = min[i] ^ max[i]; 411 mask = min[i] ^ max[i];
406 switch (mask) { 412 switch (mask) {
407 case 0x01: j = 7; break; 413 case 0x01:
408 case 0x03: j = 6; break; 414 j = 7;
409 case 0x07: j = 5; break; 415 break;
410 case 0x0F: j = 4; break; 416 case 0x03:
411 case 0x1F: j = 3; break; 417 j = 6;
412 case 0x3F: j = 2; break; 418 break;
413 case 0x7F: j = 1; break; 419 case 0x07:
414 default: return -1; 420 j = 5;
415 } 421 break;
416 if ((min[i] & mask) != 0 || (max[i] & mask) != mask) 422 case 0x0F:
417 return -1; 423 j = 4;
418 else 424 break;
419 return i * 8 + j; 425 case 0x1F:
426 j = 3;
427 break;
428 case 0x3F:
429 j = 2;
430 break;
431 case 0x7F:
432 j = 1;
433 break;
434 default:
435 return -1;
436 }
437 if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
438 return -1;
439 else
440 return i * 8 + j;
420} 441}
421 442
422/* 443/*
423 * Construct a prefix. 444 * Construct a prefix.
424 */ 445 */
425static int make_addressPrefix(IPAddressOrRange **result, 446static int
426 unsigned char *addr, 447make_addressPrefix(IPAddressOrRange **result, unsigned char *addr,
427 const int prefixlen) 448 const int prefixlen)
428{ 449{
429 int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8; 450 int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
430 IPAddressOrRange *aor = IPAddressOrRange_new(); 451 IPAddressOrRange *aor = IPAddressOrRange_new();
431 452
432 if (aor == NULL) 453 if (aor == NULL)
433 return 0; 454 return 0;
434 aor->type = IPAddressOrRange_addressPrefix; 455 aor->type = IPAddressOrRange_addressPrefix;
435 if (aor->u.addressPrefix == NULL && 456 if (aor->u.addressPrefix == NULL &&
436 (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL) 457 (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
437 goto err; 458 goto err;
438 if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen)) 459 if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
439 goto err; 460 goto err;
440 aor->u.addressPrefix->flags &= ~7; 461 aor->u.addressPrefix->flags &= ~7;
441 aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT; 462 aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
442 if (bitlen > 0) { 463 if (bitlen > 0) {
443 aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen); 464 aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
444 aor->u.addressPrefix->flags |= 8 - bitlen; 465 aor->u.addressPrefix->flags |= 8 - bitlen;
445 } 466 }
446 467
447 *result = aor; 468 *result = aor;
448 return 1; 469 return 1;
449 470
450 err: 471err:
451 IPAddressOrRange_free(aor); 472 IPAddressOrRange_free(aor);
452 return 0; 473 return 0;
453} 474}
454 475
455/* 476/*
@@ -457,252 +478,251 @@ static int make_addressPrefix(IPAddressOrRange **result,
457 * return a prefix instead. Doing this here simplifies 478 * return a prefix instead. Doing this here simplifies
458 * the rest of the code considerably. 479 * the rest of the code considerably.
459 */ 480 */
460static int make_addressRange(IPAddressOrRange **result, 481static int
461 unsigned char *min, 482make_addressRange(IPAddressOrRange **result, unsigned char *min,
462 unsigned char *max, 483 unsigned char *max, const int length)
463 const int length)
464{ 484{
465 IPAddressOrRange *aor; 485 IPAddressOrRange *aor;
466 int i, prefixlen; 486 int i, prefixlen;
467 487
468 if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0) 488 if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
469 return make_addressPrefix(result, min, prefixlen); 489 return make_addressPrefix(result, min, prefixlen);
470 490
471 if ((aor = IPAddressOrRange_new()) == NULL) 491 if ((aor = IPAddressOrRange_new()) == NULL)
472 return 0; 492 return 0;
473 aor->type = IPAddressOrRange_addressRange; 493 aor->type = IPAddressOrRange_addressRange;
474 OPENSSL_assert(aor->u.addressRange == NULL); 494 OPENSSL_assert(aor->u.addressRange == NULL);
475 if ((aor->u.addressRange = IPAddressRange_new()) == NULL) 495 if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
476 goto err; 496 goto err;
477 if (aor->u.addressRange->min == NULL && 497 if (aor->u.addressRange->min == NULL &&
478 (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL) 498 (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
479 goto err; 499 goto err;
480 if (aor->u.addressRange->max == NULL && 500 if (aor->u.addressRange->max == NULL &&
481 (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL) 501 (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
482 goto err; 502 goto err;
483 503
484 for (i = length; i > 0 && min[i - 1] == 0x00; --i) 504 for (i = length; i > 0 && min[i - 1] == 0x00; --i)
485 ; 505 ;
486 if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i)) 506 if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
487 goto err; 507 goto err;
488 aor->u.addressRange->min->flags &= ~7; 508 aor->u.addressRange->min->flags &= ~7;
489 aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT; 509 aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
490 if (i > 0) { 510 if (i > 0) {
491 unsigned char b = min[i - 1]; 511 unsigned char b = min[i - 1];
492 int j = 1; 512 int j = 1;
493 while ((b & (0xFFU >> j)) != 0) 513 while ((b & (0xFFU >> j)) != 0)
494 ++j; 514 ++j;
495 aor->u.addressRange->min->flags |= 8 - j; 515 aor->u.addressRange->min->flags |= 8 - j;
496 } 516 }
497 517
498 for (i = length; i > 0 && max[i - 1] == 0xFF; --i) 518 for (i = length; i > 0 && max[i - 1] == 0xFF; --i)
499 ; 519 ;
500 if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i)) 520 if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
501 goto err; 521 goto err;
502 aor->u.addressRange->max->flags &= ~7; 522 aor->u.addressRange->max->flags &= ~7;
503 aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT; 523 aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
504 if (i > 0) { 524 if (i > 0) {
505 unsigned char b = max[i - 1]; 525 unsigned char b = max[i - 1];
506 int j = 1; 526 int j = 1;
507 while ((b & (0xFFU >> j)) != (0xFFU >> j)) 527 while ((b & (0xFFU >> j)) != (0xFFU >> j))
508 ++j; 528 ++j;
509 aor->u.addressRange->max->flags |= 8 - j; 529 aor->u.addressRange->max->flags |= 8 - j;
510 } 530 }
511 531
512 *result = aor; 532 *result = aor;
513 return 1; 533 return 1;
514 534
515 err: 535err:
516 IPAddressOrRange_free(aor); 536 IPAddressOrRange_free(aor);
517 return 0; 537 return 0;
518} 538}
519 539
520/* 540/*
521 * Construct a new address family or find an existing one. 541 * Construct a new address family or find an existing one.
522 */ 542 */
523static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr, 543static IPAddressFamily *
524 const unsigned afi, 544make_IPAddressFamily(IPAddrBlocks *addr, const unsigned afi,
525 const unsigned *safi) 545 const unsigned *safi)
526{ 546{
527 IPAddressFamily *f; 547 IPAddressFamily *f;
528 unsigned char key[3]; 548 unsigned char key[3];
529 unsigned keylen; 549 unsigned keylen;
530 int i; 550 int i;
531 551
532 key[0] = (afi >> 8) & 0xFF; 552 key[0] = (afi >> 8) & 0xFF;
533 key[1] = afi & 0xFF; 553 key[1] = afi & 0xFF;
534 if (safi != NULL) { 554 if (safi != NULL) {
535 key[2] = *safi & 0xFF; 555 key[2] = *safi & 0xFF;
536 keylen = 3; 556 keylen = 3;
537 } else { 557 } else {
538 keylen = 2; 558 keylen = 2;
539 } 559 }
540 560
541 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 561 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
542 f = sk_IPAddressFamily_value(addr, i); 562 f = sk_IPAddressFamily_value(addr, i);
543 OPENSSL_assert(f->addressFamily->data != NULL); 563 OPENSSL_assert(f->addressFamily->data != NULL);
544 if (f->addressFamily->length == keylen && 564 if (f->addressFamily->length == keylen &&
545 !memcmp(f->addressFamily->data, key, keylen)) 565 !memcmp(f->addressFamily->data, key, keylen))
546 return f; 566 return f;
547 } 567 }
548 568
549 if ((f = IPAddressFamily_new()) == NULL) 569 if ((f = IPAddressFamily_new()) == NULL)
550 goto err; 570 goto err;
551 if (f->ipAddressChoice == NULL && 571 if (f->ipAddressChoice == NULL &&
552 (f->ipAddressChoice = IPAddressChoice_new()) == NULL) 572 (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
553 goto err; 573 goto err;
554 if (f->addressFamily == NULL && 574 if (f->addressFamily == NULL &&
555 (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL) 575 (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
556 goto err; 576 goto err;
557 if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen)) 577 if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
558 goto err; 578 goto err;
559 if (!sk_IPAddressFamily_push(addr, f)) 579 if (!sk_IPAddressFamily_push(addr, f))
560 goto err; 580 goto err;
561 581
562 return f; 582 return f;
563 583
564 err: 584err:
565 IPAddressFamily_free(f); 585 IPAddressFamily_free(f);
566 return NULL; 586 return NULL;
567} 587}
568 588
569/* 589/*
570 * Add an inheritance element. 590 * Add an inheritance element.
571 */ 591 */
572int v3_addr_add_inherit(IPAddrBlocks *addr, 592int
573 const unsigned afi, 593v3_addr_add_inherit(IPAddrBlocks *addr, const unsigned afi,
574 const unsigned *safi) 594 const unsigned *safi)
575{ 595{
576 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi); 596 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
577 if (f == NULL || 597
578 f->ipAddressChoice == NULL || 598 if (f == NULL ||
579 (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges && 599 f->ipAddressChoice == NULL ||
580 f->ipAddressChoice->u.addressesOrRanges != NULL)) 600 (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
581 return 0; 601 f->ipAddressChoice->u.addressesOrRanges != NULL))
582 if (f->ipAddressChoice->type == IPAddressChoice_inherit && 602 return 0;
583 f->ipAddressChoice->u.inherit != NULL) 603 if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
584 return 1; 604 f->ipAddressChoice->u.inherit != NULL)
585 if (f->ipAddressChoice->u.inherit == NULL && 605 return 1;
586 (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL) 606 if (f->ipAddressChoice->u.inherit == NULL &&
587 return 0; 607 (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
588 f->ipAddressChoice->type = IPAddressChoice_inherit; 608 return 0;
589 return 1; 609 f->ipAddressChoice->type = IPAddressChoice_inherit;
610 return 1;
590} 611}
591 612
592/* 613/*
593 * Construct an IPAddressOrRange sequence, or return an existing one. 614 * Construct an IPAddressOrRange sequence, or return an existing one.
594 */ 615 */
595static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr, 616static IPAddressOrRanges *
596 const unsigned afi, 617make_prefix_or_range(IPAddrBlocks *addr, const unsigned afi,
597 const unsigned *safi) 618 const unsigned *safi)
598{ 619{
599 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi); 620 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
600 IPAddressOrRanges *aors = NULL; 621 IPAddressOrRanges *aors = NULL;
601 622
602 if (f == NULL || 623 if (f == NULL ||
603 f->ipAddressChoice == NULL || 624 f->ipAddressChoice == NULL ||
604 (f->ipAddressChoice->type == IPAddressChoice_inherit && 625 (f->ipAddressChoice->type == IPAddressChoice_inherit &&
605 f->ipAddressChoice->u.inherit != NULL)) 626 f->ipAddressChoice->u.inherit != NULL))
606 return NULL; 627 return NULL;
607 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) 628 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
608 aors = f->ipAddressChoice->u.addressesOrRanges; 629 aors = f->ipAddressChoice->u.addressesOrRanges;
609 if (aors != NULL) 630 if (aors != NULL)
610 return aors; 631 return aors;
611 if ((aors = sk_IPAddressOrRange_new_null()) == NULL) 632 if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
612 return NULL; 633 return NULL;
613 switch (afi) { 634 switch (afi) {
614 case IANA_AFI_IPV4: 635 case IANA_AFI_IPV4:
615 (void) sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp); 636 (void) sk_IPAddressOrRange_set_cmp_func(aors,
616 break; 637 v4IPAddressOrRange_cmp);
617 case IANA_AFI_IPV6: 638 break;
618 (void) sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp); 639 case IANA_AFI_IPV6:
619 break; 640 (void) sk_IPAddressOrRange_set_cmp_func(aors,
620 } 641 v6IPAddressOrRange_cmp);
621 f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges; 642 break;
622 f->ipAddressChoice->u.addressesOrRanges = aors; 643 }
623 return aors; 644 f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
645 f->ipAddressChoice->u.addressesOrRanges = aors;
646 return aors;
624} 647}
625 648
626/* 649/*
627 * Add a prefix. 650 * Add a prefix.
628 */ 651 */
629int v3_addr_add_prefix(IPAddrBlocks *addr, 652int
630 const unsigned afi, 653v3_addr_add_prefix(IPAddrBlocks *addr, const unsigned afi,
631 const unsigned *safi, 654 const unsigned *safi, unsigned char *a, const int prefixlen)
632 unsigned char *a,
633 const int prefixlen)
634{ 655{
635 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi); 656 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
636 IPAddressOrRange *aor; 657 IPAddressOrRange *aor;
637 if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen)) 658
638 return 0; 659 if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
639 if (sk_IPAddressOrRange_push(aors, aor)) 660 return 0;
640 return 1; 661 if (sk_IPAddressOrRange_push(aors, aor))
641 IPAddressOrRange_free(aor); 662 return 1;
642 return 0; 663 IPAddressOrRange_free(aor);
664 return 0;
643} 665}
644 666
645/* 667/*
646 * Add a range. 668 * Add a range.
647 */ 669 */
648int v3_addr_add_range(IPAddrBlocks *addr, 670int
649 const unsigned afi, 671v3_addr_add_range(IPAddrBlocks *addr, const unsigned afi, const unsigned *safi,
650 const unsigned *safi, 672 unsigned char *min, unsigned char *max)
651 unsigned char *min,
652 unsigned char *max)
653{ 673{
654 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi); 674 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
655 IPAddressOrRange *aor; 675 IPAddressOrRange *aor;
656 int length = length_from_afi(afi); 676 int length = length_from_afi(afi);
657 if (aors == NULL) 677
658 return 0; 678 if (aors == NULL)
659 if (!make_addressRange(&aor, min, max, length)) 679 return 0;
660 return 0; 680 if (!make_addressRange(&aor, min, max, length))
661 if (sk_IPAddressOrRange_push(aors, aor)) 681 return 0;
662 return 1; 682 if (sk_IPAddressOrRange_push(aors, aor))
663 IPAddressOrRange_free(aor); 683 return 1;
664 return 0; 684 IPAddressOrRange_free(aor);
685 return 0;
665} 686}
666 687
667/* 688/*
668 * Extract min and max values from an IPAddressOrRange. 689 * Extract min and max values from an IPAddressOrRange.
669 */ 690 */
670static int extract_min_max(IPAddressOrRange *aor, 691static int
671 unsigned char *min, 692extract_min_max(IPAddressOrRange *aor, unsigned char *min, unsigned char *max,
672 unsigned char *max, 693 int length)
673 int length)
674{ 694{
675 if (aor == NULL || min == NULL || max == NULL) 695 if (aor == NULL || min == NULL || max == NULL)
676 return 0; 696 return 0;
677 switch (aor->type) { 697 switch (aor->type) {
678 case IPAddressOrRange_addressPrefix: 698 case IPAddressOrRange_addressPrefix:
679 return (addr_expand(min, aor->u.addressPrefix, length, 0x00) && 699 return (addr_expand(min, aor->u.addressPrefix, length, 0x00) &&
680 addr_expand(max, aor->u.addressPrefix, length, 0xFF)); 700 addr_expand(max, aor->u.addressPrefix, length, 0xFF));
681 case IPAddressOrRange_addressRange: 701 case IPAddressOrRange_addressRange:
682 return (addr_expand(min, aor->u.addressRange->min, length, 0x00) && 702 return (
683 addr_expand(max, aor->u.addressRange->max, length, 0xFF)); 703 addr_expand(min, aor->u.addressRange->min, length, 0x00) &&
684 } 704 addr_expand(max, aor->u.addressRange->max, length, 0xFF));
685 return 0; 705 }
706 return 0;
686} 707}
687 708
688/* 709/*
689 * Public wrapper for extract_min_max(). 710 * Public wrapper for extract_min_max().
690 */ 711 */
691int v3_addr_get_range(IPAddressOrRange *aor, 712int
692 const unsigned afi, 713v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
693 unsigned char *min, 714 unsigned char *min, unsigned char *max, const int length)
694 unsigned char *max,
695 const int length)
696{ 715{
697 int afi_length = length_from_afi(afi); 716 int afi_length = length_from_afi(afi);
698 if (aor == NULL || min == NULL || max == NULL || 717
699 afi_length == 0 || length < afi_length || 718 if (aor == NULL || min == NULL || max == NULL ||
700 (aor->type != IPAddressOrRange_addressPrefix && 719 afi_length == 0 || length < afi_length ||
701 aor->type != IPAddressOrRange_addressRange) || 720 (aor->type != IPAddressOrRange_addressPrefix &&
702 !extract_min_max(aor, min, max, afi_length)) 721 aor->type != IPAddressOrRange_addressRange) ||
703 return 0; 722 !extract_min_max(aor, min, max, afi_length))
704 723 return 0;
705 return afi_length; 724
725 return afi_length;
706} 726}
707 727
708/* 728/*
@@ -715,480 +735,513 @@ int v3_addr_get_range(IPAddressOrRange *aor,
715 * null-SAFI rule to apply only within a single AFI, which is what I 735 * null-SAFI rule to apply only within a single AFI, which is what I
716 * would have expected and is what the following code implements. 736 * would have expected and is what the following code implements.
717 */ 737 */
718static int IPAddressFamily_cmp(const IPAddressFamily * const *a_, 738static int
719 const IPAddressFamily * const *b_) 739IPAddressFamily_cmp(const IPAddressFamily * const *a_,
740 const IPAddressFamily * const *b_)
720{ 741{
721 const ASN1_OCTET_STRING *a = (*a_)->addressFamily; 742 const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
722 const ASN1_OCTET_STRING *b = (*b_)->addressFamily; 743 const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
723 int len = ((a->length <= b->length) ? a->length : b->length); 744 int len = ((a->length <= b->length) ? a->length : b->length);
724 int cmp = memcmp(a->data, b->data, len); 745 int cmp = memcmp(a->data, b->data, len);
725 return cmp ? cmp : a->length - b->length; 746
747 return cmp ? cmp : a->length - b->length;
726} 748}
727 749
728/* 750/*
729 * Check whether an IPAddrBLocks is in canonical form. 751 * Check whether an IPAddrBLocks is in canonical form.
730 */ 752 */
731int v3_addr_is_canonical(IPAddrBlocks *addr) 753int
754v3_addr_is_canonical(IPAddrBlocks *addr)
732{ 755{
733 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 756 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
734 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN]; 757 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
735 IPAddressOrRanges *aors; 758 IPAddressOrRanges *aors;
736 int i, j, k; 759 int i, j, k;
737 760
738 /* 761 /*
739 * Empty extension is cannonical. 762 * Empty extension is cannonical.
740 */ 763 */
741 if (addr == NULL) 764 if (addr == NULL)
742 return 1; 765 return 1;
743 766
744 /* 767 /*
745 * Check whether the top-level list is in order. 768 * Check whether the top-level list is in order.
746 */ 769 */
747 for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) { 770 for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
748 const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i); 771 const IPAddressFamily *a =
749 const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1); 772 sk_IPAddressFamily_value(addr, i);
750 if (IPAddressFamily_cmp(&a, &b) >= 0) 773 const IPAddressFamily *b =
751 return 0; 774 sk_IPAddressFamily_value(addr, i + 1);
752 } 775 if (IPAddressFamily_cmp(&a, &b) >= 0)
753 776 return 0;
754 /* 777 }
755 * Top level's ok, now check each address family.
756 */
757 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
758 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
759 int length = length_from_afi(v3_addr_get_afi(f));
760
761 /*
762 * Inheritance is canonical. Anything other than inheritance or
763 * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
764 */
765 if (f == NULL || f->ipAddressChoice == NULL)
766 return 0;
767 switch (f->ipAddressChoice->type) {
768 case IPAddressChoice_inherit:
769 continue;
770 case IPAddressChoice_addressesOrRanges:
771 break;
772 default:
773 return 0;
774 }
775
776 /*
777 * It's an IPAddressOrRanges sequence, check it.
778 */
779 aors = f->ipAddressChoice->u.addressesOrRanges;
780 if (sk_IPAddressOrRange_num(aors) == 0)
781 return 0;
782 for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
783 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
784 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
785
786 if (!extract_min_max(a, a_min, a_max, length) ||
787 !extract_min_max(b, b_min, b_max, length))
788 return 0;
789
790 /*
791 * Punt misordered list, overlapping start, or inverted range.
792 */
793 if (memcmp(a_min, b_min, length) >= 0 ||
794 memcmp(a_min, a_max, length) > 0 ||
795 memcmp(b_min, b_max, length) > 0)
796 return 0;
797 778
798 /* 779 /*
799 * Punt if adjacent or overlapping. Check for adjacency by 780 * Top level's ok, now check each address family.
800 * subtracting one from b_min first. 781 */
801 */ 782 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
802 for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) 783 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
803 ; 784 int length = length_from_afi(v3_addr_get_afi(f));
804 if (memcmp(a_max, b_min, length) >= 0) 785
805 return 0; 786 /*
787 * Inheritance is canonical. Anything other than inheritance or
788 * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
789 */
790 if (f == NULL || f->ipAddressChoice == NULL)
791 return 0;
792 switch (f->ipAddressChoice->type) {
793 case IPAddressChoice_inherit:
794 continue;
795 case IPAddressChoice_addressesOrRanges:
796 break;
797 default:
798 return 0;
799 }
800
801 /*
802 * It's an IPAddressOrRanges sequence, check it.
803 */
804 aors = f->ipAddressChoice->u.addressesOrRanges;
805 if (sk_IPAddressOrRange_num(aors) == 0)
806 return 0;
807 for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
808 IPAddressOrRange *a =
809 sk_IPAddressOrRange_value(aors, j);
810 IPAddressOrRange *b =
811 sk_IPAddressOrRange_value(aors, j + 1);
812
813 if (!extract_min_max(a, a_min, a_max, length) ||
814 !extract_min_max(b, b_min, b_max, length))
815 return 0;
816
817 /*
818 * Punt misordered list, overlapping start, or inverted range.
819 */
820 if (memcmp(a_min, b_min, length) >= 0 ||
821 memcmp(a_min, a_max, length) > 0 ||
822 memcmp(b_min, b_max, length) > 0)
823 return 0;
824
825 /*
826 * Punt if adjacent or overlapping. Check for adjacency by
827 * subtracting one from b_min first.
828 */
829 for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--)
830 ;
831 if (memcmp(a_max, b_min, length) >= 0)
832 return 0;
833
834 /*
835 * Check for range that should be expressed as a prefix.
836 */
837 if (a->type == IPAddressOrRange_addressRange &&
838 range_should_be_prefix(a_min, a_max, length) >= 0)
839 return 0;
840 }
841
842 /*
843 * Check range to see if it's inverted or should be a
844 * prefix.
845 */
846 j = sk_IPAddressOrRange_num(aors) - 1;
847 {
848 IPAddressOrRange *a =
849 sk_IPAddressOrRange_value(aors, j);
850 if (a != NULL &&
851 a->type == IPAddressOrRange_addressRange) {
852 if (!extract_min_max(a, a_min, a_max, length))
853 return 0;
854 if (memcmp(a_min, a_max, length) > 0 ||
855 range_should_be_prefix(a_min, a_max,
856 length) >= 0)
857 return 0;
858 }
859 }
860 }
806 861
807 /* 862 /*
808 * Check for range that should be expressed as a prefix. 863 * If we made it through all that, we're happy.
809 */ 864 */
810 if (a->type == IPAddressOrRange_addressRange && 865 return 1;
811 range_should_be_prefix(a_min, a_max, length) >= 0)
812 return 0;
813 }
814
815 /*
816 * Check range to see if it's inverted or should be a
817 * prefix.
818 */
819 j = sk_IPAddressOrRange_num(aors) - 1;
820 {
821 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
822 if (a != NULL && a->type == IPAddressOrRange_addressRange) {
823 if (!extract_min_max(a, a_min, a_max, length))
824 return 0;
825 if (memcmp(a_min, a_max, length) > 0 ||
826 range_should_be_prefix(a_min, a_max, length) >= 0)
827 return 0;
828 }
829 }
830 }
831
832 /*
833 * If we made it through all that, we're happy.
834 */
835 return 1;
836} 866}
837 867
838/* 868/*
839 * Whack an IPAddressOrRanges into canonical form. 869 * Whack an IPAddressOrRanges into canonical form.
840 */ 870 */
841static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors, 871static int
842 const unsigned afi) 872IPAddressOrRanges_canonize(IPAddressOrRanges *aors, const unsigned afi)
843{ 873{
844 int i, j, length = length_from_afi(afi); 874 int i, j, length = length_from_afi(afi);
845 875
846 /* 876 /*
847 * Sort the IPAddressOrRanges sequence. 877 * Sort the IPAddressOrRanges sequence.
848 */ 878 */
849 sk_IPAddressOrRange_sort(aors); 879 sk_IPAddressOrRange_sort(aors);
850 880
851 /* 881 /*
852 * Clean up representation issues, punt on duplicates or overlaps. 882 * Clean up representation issues, punt on duplicates or overlaps.
853 */ 883 */
854 for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) { 884 for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
855 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i); 885 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
856 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1); 886 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
857 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 887 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
858 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN]; 888 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
859 889
860 if (!extract_min_max(a, a_min, a_max, length) || 890 if (!extract_min_max(a, a_min, a_max, length) ||
861 !extract_min_max(b, b_min, b_max, length)) 891 !extract_min_max(b, b_min, b_max, length))
862 return 0; 892 return 0;
863 893
864 /* 894 /*
865 * Punt inverted ranges. 895 * Punt inverted ranges.
866 */ 896 */
867 if (memcmp(a_min, a_max, length) > 0 || 897 if (memcmp(a_min, a_max, length) > 0 ||
868 memcmp(b_min, b_max, length) > 0) 898 memcmp(b_min, b_max, length) > 0)
869 return 0; 899 return 0;
870 900
871 /* 901 /*
872 * Punt overlaps. 902 * Punt overlaps.
873 */ 903 */
874 if (memcmp(a_max, b_min, length) >= 0) 904 if (memcmp(a_max, b_min, length) >= 0)
875 return 0; 905 return 0;
876 906
877 /* 907 /*
878 * Merge if a and b are adjacent. We check for 908 * Merge if a and b are adjacent. We check for
879 * adjacency by subtracting one from b_min first. 909 * adjacency by subtracting one from b_min first.
880 */ 910 */
881 for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) 911 for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--)
882 ; 912 ;
883 if (memcmp(a_max, b_min, length) == 0) { 913 if (memcmp(a_max, b_min, length) == 0) {
884 IPAddressOrRange *merged; 914 IPAddressOrRange *merged;
885 if (!make_addressRange(&merged, a_min, b_max, length)) 915 if (!make_addressRange(&merged, a_min, b_max, length))
886 return 0; 916 return 0;
887 (void) sk_IPAddressOrRange_set(aors, i, merged); 917 (void) sk_IPAddressOrRange_set(aors, i, merged);
888 (void) sk_IPAddressOrRange_delete(aors, i + 1); 918 (void) sk_IPAddressOrRange_delete(aors, i + 1);
889 IPAddressOrRange_free(a); 919 IPAddressOrRange_free(a);
890 IPAddressOrRange_free(b); 920 IPAddressOrRange_free(b);
891 --i; 921 --i;
892 continue; 922 continue;
893 } 923 }
894 } 924 }
895 925
896 /* 926 /*
897 * Check for inverted final range. 927 * Check for inverted final range.
898 */ 928 */
899 j = sk_IPAddressOrRange_num(aors) - 1; 929 j = sk_IPAddressOrRange_num(aors) - 1;
900 { 930 {
901 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j); 931 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
902 if (a != NULL && a->type == IPAddressOrRange_addressRange) { 932 if (a != NULL && a->type == IPAddressOrRange_addressRange) {
903 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 933 unsigned char a_min[ADDR_RAW_BUF_LEN],
904 extract_min_max(a, a_min, a_max, length); 934 a_max[ADDR_RAW_BUF_LEN];
905 if (memcmp(a_min, a_max, length) > 0) 935 extract_min_max(a, a_min, a_max, length);
906 return 0; 936 if (memcmp(a_min, a_max, length) > 0)
907 } 937 return 0;
908 } 938 }
939 }
909 940
910 return 1; 941 return 1;
911} 942}
912 943
913/* 944/*
914 * Whack an IPAddrBlocks extension into canonical form. 945 * Whack an IPAddrBlocks extension into canonical form.
915 */ 946 */
916int v3_addr_canonize(IPAddrBlocks *addr) 947int
948v3_addr_canonize(IPAddrBlocks *addr)
917{ 949{
918 int i; 950 int i;
919 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 951 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
920 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 952 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
921 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges && 953 if (f->ipAddressChoice->type ==
922 !IPAddressOrRanges_canonize(f->ipAddressChoice->u.addressesOrRanges, 954 IPAddressChoice_addressesOrRanges &&
923 v3_addr_get_afi(f))) 955 !IPAddressOrRanges_canonize(
924 return 0; 956 f->ipAddressChoice->u.addressesOrRanges,
925 } 957 v3_addr_get_afi(f)))
926 (void) sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp); 958 return 0;
927 sk_IPAddressFamily_sort(addr); 959 }
928 OPENSSL_assert(v3_addr_is_canonical(addr)); 960 (void) sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
929 return 1; 961 sk_IPAddressFamily_sort(addr);
962 OPENSSL_assert(v3_addr_is_canonical(addr));
963 return 1;
930} 964}
931 965
932/* 966/*
933 * v2i handler for the IPAddrBlocks extension. 967 * v2i handler for the IPAddrBlocks extension.
934 */ 968 */
935static void *v2i_IPAddrBlocks(const struct v3_ext_method *method, 969static void *
936 struct v3_ext_ctx *ctx, 970v2i_IPAddrBlocks(const struct v3_ext_method *method, struct v3_ext_ctx *ctx,
937 STACK_OF(CONF_VALUE) *values) 971 STACK_OF(CONF_VALUE) *values)
938{ 972{
939 static const char v4addr_chars[] = "0123456789."; 973 static const char v4addr_chars[] = "0123456789.";
940 static const char v6addr_chars[] = "0123456789.:abcdefABCDEF"; 974 static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
941 IPAddrBlocks *addr = NULL; 975 IPAddrBlocks *addr = NULL;
942 char *s = NULL, *t; 976 char *s = NULL, *t;
943 int i; 977 int i;
944 978
945 if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) { 979 if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
946 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 980 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
947 return NULL; 981 return NULL;
948 } 982 }
949 983
950 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 984 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
951 CONF_VALUE *val = sk_CONF_VALUE_value(values, i); 985 CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
952 unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN]; 986 unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
953 unsigned afi, *safi = NULL, safi_; 987 unsigned afi, *safi = NULL, safi_;
954 const char *addr_chars; 988 const char *addr_chars;
955 int prefixlen, i1, i2, delim, length; 989 int prefixlen, i1, i2, delim, length;
956 990
957 if ( !name_cmp(val->name, "IPv4")) { 991 if (!name_cmp(val->name, "IPv4")) {
958 afi = IANA_AFI_IPV4; 992 afi = IANA_AFI_IPV4;
959 } else if (!name_cmp(val->name, "IPv6")) { 993 } else if (!name_cmp(val->name, "IPv6")) {
960 afi = IANA_AFI_IPV6; 994 afi = IANA_AFI_IPV6;
961 } else if (!name_cmp(val->name, "IPv4-SAFI")) { 995 } else if (!name_cmp(val->name, "IPv4-SAFI")) {
962 afi = IANA_AFI_IPV4; 996 afi = IANA_AFI_IPV4;
963 safi = &safi_; 997 safi = &safi_;
964 } else if (!name_cmp(val->name, "IPv6-SAFI")) { 998 } else if (!name_cmp(val->name, "IPv6-SAFI")) {
965 afi = IANA_AFI_IPV6; 999 afi = IANA_AFI_IPV6;
966 safi = &safi_; 1000 safi = &safi_;
967 } else { 1001 } else {
968 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_NAME_ERROR); 1002 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
969 X509V3_conf_err(val); 1003 X509V3_R_EXTENSION_NAME_ERROR);
970 goto err; 1004 X509V3_conf_err(val);
971 } 1005 goto err;
972 1006 }
973 switch (afi) { 1007
974 case IANA_AFI_IPV4: 1008 switch (afi) {
975 addr_chars = v4addr_chars; 1009 case IANA_AFI_IPV4:
976 break; 1010 addr_chars = v4addr_chars;
977 case IANA_AFI_IPV6: 1011 break;
978 addr_chars = v6addr_chars; 1012 case IANA_AFI_IPV6:
979 break; 1013 addr_chars = v6addr_chars;
980 } 1014 break;
981 1015 }
982 length = length_from_afi(afi); 1016
983 1017 length = length_from_afi(afi);
984 /* 1018
985 * Handle SAFI, if any, and BUF_strdup() so we can null-terminate 1019 /*
986 * the other input values. 1020 * Handle SAFI, if any, and BUF_strdup() so we can null-terminate
987 */ 1021 * the other input values.
988 if (safi != NULL) { 1022 */
989 *safi = strtoul(val->value, &t, 0); 1023 if (safi != NULL) {
990 t += strspn(t, " \t"); 1024 *safi = strtoul(val->value, &t, 0);
991 if (*safi > 0xFF || *t++ != ':') { 1025 t += strspn(t, " \t");
992 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI); 1026 if (*safi > 0xFF || *t++ != ':') {
993 X509V3_conf_err(val); 1027 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
994 goto err; 1028 X509V3_R_INVALID_SAFI);
995 } 1029 X509V3_conf_err(val);
996 t += strspn(t, " \t"); 1030 goto err;
997 s = BUF_strdup(t); 1031 }
998 } else { 1032 t += strspn(t, " \t");
999 s = BUF_strdup(val->value); 1033 s = BUF_strdup(t);
1000 } 1034 } else {
1001 if (s == NULL) { 1035 s = BUF_strdup(val->value);
1002 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1036 }
1003 goto err; 1037 if (s == NULL) {
1004 } 1038 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1005 1039 ERR_R_MALLOC_FAILURE);
1006 /* 1040 goto err;
1007 * Check for inheritance. Not worth additional complexity to 1041 }
1008 * optimize this (seldom-used) case. 1042
1009 */ 1043 /*
1010 if (!strcmp(s, "inherit")) { 1044 * Check for inheritance. Not worth additional complexity to
1011 if (!v3_addr_add_inherit(addr, afi, safi)) { 1045 * optimize this (seldom-used) case.
1012 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_INHERITANCE); 1046 */
1013 X509V3_conf_err(val); 1047 if (!strcmp(s, "inherit")) {
1014 goto err; 1048 if (!v3_addr_add_inherit(addr, afi, safi)) {
1015 } 1049 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1016 free(s); 1050 X509V3_R_INVALID_INHERITANCE);
1017 s = NULL; 1051 X509V3_conf_err(val);
1018 continue; 1052 goto err;
1019 } 1053 }
1020 1054 free(s);
1021 i1 = strspn(s, addr_chars); 1055 s = NULL;
1022 i2 = i1 + strspn(s + i1, " \t"); 1056 continue;
1023 delim = s[i2++]; 1057 }
1024 s[i1] = '\0'; 1058
1025 1059 i1 = strspn(s, addr_chars);
1026 if (a2i_ipadd(min, s) != length) { 1060 i2 = i1 + strspn(s + i1, " \t");
1027 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS); 1061 delim = s[i2++];
1028 X509V3_conf_err(val); 1062 s[i1] = '\0';
1029 goto err; 1063
1030 } 1064 if (a2i_ipadd(min, s) != length) {
1031 1065 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1032 switch (delim) { 1066 X509V3_R_INVALID_IPADDRESS);
1033 case '/': 1067 X509V3_conf_err(val);
1034 prefixlen = (int) strtoul(s + i2, &t, 10); 1068 goto err;
1035 if (t == s + i2 || *t != '\0') { 1069 }
1036 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1070
1037 X509V3_conf_err(val); 1071 switch (delim) {
1038 goto err; 1072 case '/':
1039 } 1073 prefixlen = (int) strtoul(s + i2, &t, 10);
1040 if (!v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) { 1074 if (t == s + i2 || *t != '\0') {
1041 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1075 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1042 goto err; 1076 X509V3_R_EXTENSION_VALUE_ERROR);
1043 } 1077 X509V3_conf_err(val);
1044 break; 1078 goto err;
1045 case '-': 1079 }
1046 i1 = i2 + strspn(s + i2, " \t"); 1080 if (!v3_addr_add_prefix(addr, afi, safi, min,
1047 i2 = i1 + strspn(s + i1, addr_chars); 1081 prefixlen)) {
1048 if (i1 == i2 || s[i2] != '\0') { 1082 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1049 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1083 ERR_R_MALLOC_FAILURE);
1050 X509V3_conf_err(val); 1084 goto err;
1051 goto err; 1085 }
1052 } 1086 break;
1053 if (a2i_ipadd(max, s + i1) != length) { 1087 case '-':
1054 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS); 1088 i1 = i2 + strspn(s + i2, " \t");
1055 X509V3_conf_err(val); 1089 i2 = i1 + strspn(s + i1, addr_chars);
1056 goto err; 1090 if (i1 == i2 || s[i2] != '\0') {
1057 } 1091 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1058 if (memcmp(min, max, length_from_afi(afi)) > 0) { 1092 X509V3_R_EXTENSION_VALUE_ERROR);
1059 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1093 X509V3_conf_err(val);
1060 X509V3_conf_err(val); 1094 goto err;
1061 goto err; 1095 }
1062 } 1096 if (a2i_ipadd(max, s + i1) != length) {
1063 if (!v3_addr_add_range(addr, afi, safi, min, max)) { 1097 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1064 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1098 X509V3_R_INVALID_IPADDRESS);
1065 goto err; 1099 X509V3_conf_err(val);
1066 } 1100 goto err;
1067 break; 1101 }
1068 case '\0': 1102 if (memcmp(min, max, length_from_afi(afi)) > 0) {
1069 if (!v3_addr_add_prefix(addr, afi, safi, min, length * 8)) { 1103 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1070 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1104 X509V3_R_EXTENSION_VALUE_ERROR);
1071 goto err; 1105 X509V3_conf_err(val);
1072 } 1106 goto err;
1073 break; 1107 }
1074 default: 1108 if (!v3_addr_add_range(addr, afi, safi, min, max)) {
1075 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1109 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1076 X509V3_conf_err(val); 1110 ERR_R_MALLOC_FAILURE);
1077 goto err; 1111 goto err;
1078 } 1112 }
1079 1113 break;
1080 free(s); 1114 case '\0':
1081 s = NULL; 1115 if (!v3_addr_add_prefix(addr, afi, safi, min,
1082 } 1116 length * 8)) {
1083 1117 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1084 /* 1118 ERR_R_MALLOC_FAILURE);
1085 * Canonize the result, then we're done. 1119 goto err;
1086 */ 1120 }
1087 if (!v3_addr_canonize(addr)) 1121 break;
1088 goto err; 1122 default:
1089 return addr; 1123 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1090 1124 X509V3_R_EXTENSION_VALUE_ERROR);
1091 err: 1125 X509V3_conf_err(val);
1092 free(s); 1126 goto err;
1093 sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free); 1127 }
1094 return NULL; 1128
1129 free(s);
1130 s = NULL;
1131 }
1132
1133 /*
1134 * Canonize the result, then we're done.
1135 */
1136 if (!v3_addr_canonize(addr))
1137 goto err;
1138 return addr;
1139
1140err:
1141 free(s);
1142 sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
1143 return NULL;
1095} 1144}
1096 1145
1097/* 1146/*
1098 * OpenSSL dispatch 1147 * OpenSSL dispatch
1099 */ 1148 */
1100const X509V3_EXT_METHOD v3_addr = { 1149const X509V3_EXT_METHOD v3_addr = {
1101 NID_sbgp_ipAddrBlock, /* nid */ 1150 NID_sbgp_ipAddrBlock, /* nid */
1102 0, /* flags */ 1151 0, /* flags */
1103 ASN1_ITEM_ref(IPAddrBlocks), /* template */ 1152 ASN1_ITEM_ref(IPAddrBlocks), /* template */
1104 0, 0, 0, 0, /* old functions, ignored */ 1153 0, 0, 0, 0, /* old functions, ignored */
1105 0, /* i2s */ 1154 0, /* i2s */
1106 0, /* s2i */ 1155 0, /* s2i */
1107 0, /* i2v */ 1156 0, /* i2v */
1108 v2i_IPAddrBlocks, /* v2i */ 1157 v2i_IPAddrBlocks, /* v2i */
1109 i2r_IPAddrBlocks, /* i2r */ 1158 i2r_IPAddrBlocks, /* i2r */
1110 0, /* r2i */ 1159 0, /* r2i */
1111 NULL /* extension-specific data */ 1160 NULL /* extension-specific data */
1112}; 1161};
1113 1162
1114/* 1163/*
1115 * Figure out whether extension sues inheritance. 1164 * Figure out whether extension sues inheritance.
1116 */ 1165 */
1117int v3_addr_inherits(IPAddrBlocks *addr) 1166int
1167v3_addr_inherits(IPAddrBlocks *addr)
1118{ 1168{
1119 int i; 1169 int i;
1120 if (addr == NULL) 1170
1121 return 0; 1171 if (addr == NULL)
1122 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 1172 return 0;
1123 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 1173 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
1124 if (f->ipAddressChoice->type == IPAddressChoice_inherit) 1174 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
1125 return 1; 1175 if (f->ipAddressChoice->type == IPAddressChoice_inherit)
1126 } 1176 return 1;
1127 return 0; 1177 }
1178 return 0;
1128} 1179}
1129 1180
1130/* 1181/*
1131 * Figure out whether parent contains child. 1182 * Figure out whether parent contains child.
1132 */ 1183 */
1133static int addr_contains(IPAddressOrRanges *parent, 1184static int
1134 IPAddressOrRanges *child, 1185addr_contains(IPAddressOrRanges *parent, IPAddressOrRanges *child, int length)
1135 int length)
1136{ 1186{
1137 unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN]; 1187 unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
1138 unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN]; 1188 unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
1139 int p, c; 1189 int p, c;
1140 1190
1141 if (child == NULL || parent == child) 1191 if (child == NULL || parent == child)
1142 return 1; 1192 return 1;
1143 if (parent == NULL) 1193 if (parent == NULL)
1144 return 0; 1194 return 0;
1145 1195
1146 p = 0; 1196 p = 0;
1147 for (c = 0; c < sk_IPAddressOrRange_num(child); c++) { 1197 for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
1148 if (!extract_min_max(sk_IPAddressOrRange_value(child, c), 1198 if (!extract_min_max(sk_IPAddressOrRange_value(child, c),
1149 c_min, c_max, length)) 1199 c_min, c_max, length))
1150 return -1; 1200 return -1;
1151 for (;; p++) { 1201 for (; ; p++) {
1152 if (p >= sk_IPAddressOrRange_num(parent)) 1202 if (p >= sk_IPAddressOrRange_num(parent))
1153 return 0; 1203 return 0;
1154 if (!extract_min_max(sk_IPAddressOrRange_value(parent, p), 1204 if (!extract_min_max(
1155 p_min, p_max, length)) 1205 sk_IPAddressOrRange_value(parent, p),
1156 return 0; 1206 p_min, p_max, length))
1157 if (memcmp(p_max, c_max, length) < 0) 1207 return 0;
1158 continue; 1208 if (memcmp(p_max, c_max, length) < 0)
1159 if (memcmp(p_min, c_min, length) > 0) 1209 continue;
1160 return 0; 1210 if (memcmp(p_min, c_min, length) > 0)
1161 break; 1211 return 0;
1162 } 1212 break;
1163 } 1213 }
1214 }
1164 1215
1165 return 1; 1216 return 1;
1166} 1217}
1167 1218
1168/* 1219/*
1169 * Test whether a is a subset of b. 1220 * Test whether a is a subset of b.
1170 */ 1221 */
1171int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b) 1222int
1223v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
1172{ 1224{
1173 int i; 1225 int i;
1174 if (a == NULL || a == b) 1226
1175 return 1; 1227 if (a == NULL || a == b)
1176 if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b)) 1228 return 1;
1177 return 0; 1229 if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b))
1178 (void) sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp); 1230 return 0;
1179 for (i = 0; i < sk_IPAddressFamily_num(a); i++) { 1231 (void) sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
1180 IPAddressFamily *fa = sk_IPAddressFamily_value(a, i); 1232 for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
1181 int j = sk_IPAddressFamily_find(b, fa); 1233 IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
1182 IPAddressFamily *fb; 1234 int j = sk_IPAddressFamily_find(b, fa);
1183 fb = sk_IPAddressFamily_value(b, j); 1235 IPAddressFamily *fb;
1184 if (fb == NULL) 1236 fb = sk_IPAddressFamily_value(b, j);
1185 return 0; 1237 if (fb == NULL)
1186 if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges, 1238 return 0;
1187 fa->ipAddressChoice->u.addressesOrRanges, 1239 if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
1188 length_from_afi(v3_addr_get_afi(fb)))) 1240 fa->ipAddressChoice->u.addressesOrRanges,
1189 return 0; 1241 length_from_afi(v3_addr_get_afi(fb))))
1190 } 1242 return 0;
1191 return 1; 1243 }
1244 return 1;
1192} 1245}
1193 1246
1194/* 1247/*
@@ -1211,101 +1264,115 @@ int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
1211/* 1264/*
1212 * Core code for RFC 3779 2.3 path validation. 1265 * Core code for RFC 3779 2.3 path validation.
1213 */ 1266 */
1214static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx, 1267static int
1215 STACK_OF(X509) *chain, 1268v3_addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
1216 IPAddrBlocks *ext) 1269 IPAddrBlocks *ext)
1217{ 1270{
1218 IPAddrBlocks *child = NULL; 1271 IPAddrBlocks *child = NULL;
1219 int i, j, ret = 1; 1272 int i, j, ret = 1;
1220 X509 *x; 1273 X509 *x;
1221 1274
1222 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0); 1275 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
1223 OPENSSL_assert(ctx != NULL || ext != NULL); 1276 OPENSSL_assert(ctx != NULL || ext != NULL);
1224 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL); 1277 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
1225 1278
1226 /* 1279 /*
1227 * Figure out where to start. If we don't have an extension to 1280 * Figure out where to start. If we don't have an extension to
1228 * check, we're done. Otherwise, check canonical form and 1281 * check, we're done. Otherwise, check canonical form and
1229 * set up for walking up the chain. 1282 * set up for walking up the chain.
1230 */ 1283 */
1231 if (ext != NULL) { 1284 if (ext != NULL) {
1232 i = -1; 1285 i = -1;
1233 x = NULL; 1286 x = NULL;
1234 } else { 1287 } else {
1235 i = 0; 1288 i = 0;
1236 x = sk_X509_value(chain, i); 1289 x = sk_X509_value(chain, i);
1237 OPENSSL_assert(x != NULL); 1290 OPENSSL_assert(x != NULL);
1238 if ((ext = x->rfc3779_addr) == NULL) 1291 if ((ext = x->rfc3779_addr) == NULL)
1239 goto done; 1292 goto done;
1240 }
1241 if (!v3_addr_is_canonical(ext))
1242 validation_err(X509_V_ERR_INVALID_EXTENSION);
1243 (void) sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
1244 if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
1245 X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL, ERR_R_MALLOC_FAILURE);
1246 ret = 0;
1247 goto done;
1248 }
1249
1250 /*
1251 * Now walk up the chain. No cert may list resources that its
1252 * parent doesn't list.
1253 */
1254 for (i++; i < sk_X509_num(chain); i++) {
1255 x = sk_X509_value(chain, i);
1256 OPENSSL_assert(x != NULL);
1257 if (!v3_addr_is_canonical(x->rfc3779_addr))
1258 validation_err(X509_V_ERR_INVALID_EXTENSION);
1259 if (x->rfc3779_addr == NULL) {
1260 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1261 IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
1262 if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
1263 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1264 break;
1265 } 1293 }
1266 } 1294 if (!v3_addr_is_canonical(ext))
1267 continue; 1295 validation_err(X509_V_ERR_INVALID_EXTENSION);
1268 } 1296 (void) sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
1269 (void) sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr, IPAddressFamily_cmp); 1297 if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
1270 for (j = 0; j < sk_IPAddressFamily_num(child); j++) { 1298 X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL,
1271 IPAddressFamily *fc = sk_IPAddressFamily_value(child, j); 1299 ERR_R_MALLOC_FAILURE);
1272 int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc); 1300 ret = 0;
1273 IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, k); 1301 goto done;
1274 if (fp == NULL) {
1275 if (fc->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
1276 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1277 break;
1278 } 1302 }
1279 continue; 1303
1280 } 1304 /*
1281 if (fp->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) { 1305 * Now walk up the chain. No cert may list resources that its
1282 if (fc->ipAddressChoice->type == IPAddressChoice_inherit || 1306 * parent doesn't list.
1283 addr_contains(fp->ipAddressChoice->u.addressesOrRanges, 1307 */
1284 fc->ipAddressChoice->u.addressesOrRanges, 1308 for (i++; i < sk_X509_num(chain); i++) {
1285 length_from_afi(v3_addr_get_afi(fc)))) 1309 x = sk_X509_value(chain, i);
1286 sk_IPAddressFamily_set(child, j, fp); 1310 OPENSSL_assert(x != NULL);
1287 else 1311 if (!v3_addr_is_canonical(x->rfc3779_addr))
1288 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 1312 validation_err(X509_V_ERR_INVALID_EXTENSION);
1289 } 1313 if (x->rfc3779_addr == NULL) {
1290 } 1314 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1291 } 1315 IPAddressFamily *fc =
1292 1316 sk_IPAddressFamily_value(child, j);
1293 /* 1317 if (fc->ipAddressChoice->type !=
1294 * Trust anchor can't inherit. 1318 IPAddressChoice_inherit) {
1295 */ 1319 validation_err(
1296 OPENSSL_assert(x != NULL); 1320 X509_V_ERR_UNNESTED_RESOURCE);
1297 if (x->rfc3779_addr != NULL) { 1321 break;
1298 for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) { 1322 }
1299 IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j); 1323 }
1300 if (fp->ipAddressChoice->type == IPAddressChoice_inherit && 1324 continue;
1301 sk_IPAddressFamily_find(child, fp) >= 0) 1325 }
1302 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 1326 (void) sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr,
1303 } 1327 IPAddressFamily_cmp);
1304 } 1328 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1305 1329 IPAddressFamily *fc =
1306 done: 1330 sk_IPAddressFamily_value(child, j);
1307 sk_IPAddressFamily_free(child); 1331 int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
1308 return ret; 1332 IPAddressFamily *fp =
1333 sk_IPAddressFamily_value(x->rfc3779_addr, k);
1334 if (fp == NULL) {
1335 if (fc->ipAddressChoice->type ==
1336 IPAddressChoice_addressesOrRanges) {
1337 validation_err(
1338 X509_V_ERR_UNNESTED_RESOURCE);
1339 break;
1340 }
1341 continue;
1342 }
1343 if (fp->ipAddressChoice->type ==
1344 IPAddressChoice_addressesOrRanges) {
1345 if (fc->ipAddressChoice->type ==
1346 IPAddressChoice_inherit || addr_contains(
1347 fp->ipAddressChoice->u.addressesOrRanges,
1348 fc->ipAddressChoice->u.addressesOrRanges,
1349 length_from_afi(v3_addr_get_afi(fc))))
1350 sk_IPAddressFamily_set(child, j, fp);
1351 else
1352 validation_err(
1353 X509_V_ERR_UNNESTED_RESOURCE);
1354 }
1355 }
1356 }
1357
1358 /*
1359 * Trust anchor can't inherit.
1360 */
1361 OPENSSL_assert(x != NULL);
1362 if (x->rfc3779_addr != NULL) {
1363 for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
1364 IPAddressFamily *fp =
1365 sk_IPAddressFamily_value(x->rfc3779_addr, j);
1366 if (fp->ipAddressChoice->type ==
1367 IPAddressChoice_inherit &&
1368 sk_IPAddressFamily_find(child, fp) >= 0)
1369 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1370 }
1371 }
1372
1373done:
1374 sk_IPAddressFamily_free(child);
1375 return ret;
1309} 1376}
1310 1377
1311#undef validation_err 1378#undef validation_err
@@ -1313,26 +1380,27 @@ static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx,
1313/* 1380/*
1314 * RFC 3779 2.3 path validation -- called from X509_verify_cert(). 1381 * RFC 3779 2.3 path validation -- called from X509_verify_cert().
1315 */ 1382 */
1316int v3_addr_validate_path(X509_STORE_CTX *ctx) 1383int
1384v3_addr_validate_path(X509_STORE_CTX *ctx)
1317{ 1385{
1318 return v3_addr_validate_path_internal(ctx, ctx->chain, NULL); 1386 return v3_addr_validate_path_internal(ctx, ctx->chain, NULL);
1319} 1387}
1320 1388
1321/* 1389/*
1322 * RFC 3779 2.3 path validation of an extension. 1390 * RFC 3779 2.3 path validation of an extension.
1323 * Test whether chain covers extension. 1391 * Test whether chain covers extension.
1324 */ 1392 */
1325int v3_addr_validate_resource_set(STACK_OF(X509) *chain, 1393int
1326 IPAddrBlocks *ext, 1394v3_addr_validate_resource_set(STACK_OF(X509) *chain, IPAddrBlocks *ext,
1327 int allow_inheritance) 1395 int allow_inheritance)
1328{ 1396{
1329 if (ext == NULL) 1397 if (ext == NULL)
1330 return 1; 1398 return 1;
1331 if (chain == NULL || sk_X509_num(chain) == 0) 1399 if (chain == NULL || sk_X509_num(chain) == 0)
1332 return 0; 1400 return 0;
1333 if (!allow_inheritance && v3_addr_inherits(ext)) 1401 if (!allow_inheritance && v3_addr_inherits(ext))
1334 return 0; 1402 return 0;
1335 return v3_addr_validate_path_internal(NULL, chain, ext); 1403 return v3_addr_validate_path_internal(NULL, chain, ext);
1336} 1404}
1337 1405
1338#endif /* OPENSSL_NO_RFC3779 */ 1406#endif /* OPENSSL_NO_RFC3779 */
diff --git a/src/lib/libcrypto/x509v3/v3_akey.c b/src/lib/libcrypto/x509v3/v3_akey.c
index 04e1fb9544..6d5c576e23 100644
--- a/src/lib/libcrypto/x509v3/v3_akey.c
+++ b/src/lib/libcrypto/x509v3/v3_akey.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -64,36 +64,37 @@
64#include <openssl/x509v3.h> 64#include <openssl/x509v3.h>
65 65
66static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 66static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
67 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist); 67 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist);
68static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 68static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values); 69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
70 70
71const X509V3_EXT_METHOD v3_akey_id = 71const X509V3_EXT_METHOD v3_akey_id = {
72 {
73 NID_authority_key_identifier, 72 NID_authority_key_identifier,
74 X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID), 73 X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID),
75 0,0,0,0, 74 0, 0,0, 0,
76 0,0, 75 0, 0,
77 (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID, 76 (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
78 (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID, 77 (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
79 0,0, 78 0, 0,
80 NULL 79 NULL
81 }; 80};
82 81
83static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 82static
84 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist) 83STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
84 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist)
85{ 85{
86 char *tmp; 86 char *tmp;
87 if(akeyid->keyid) { 87
88 if (akeyid->keyid) {
88 tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length); 89 tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length);
89 X509V3_add_value("keyid", tmp, &extlist); 90 X509V3_add_value("keyid", tmp, &extlist);
90 free(tmp); 91 free(tmp);
91 } 92 }
92 if(akeyid->issuer) 93 if (akeyid->issuer)
93 extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist); 94 extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
94 if(akeyid->serial) { 95 if (akeyid->serial) {
95 tmp = hex_to_string(akeyid->serial->data, 96 tmp = hex_to_string(akeyid->serial->data,
96 akeyid->serial->length); 97 akeyid->serial->length);
97 X509V3_add_value("serial", tmp, &extlist); 98 X509V3_add_value("serial", tmp, &extlist);
98 free(tmp); 99 free(tmp);
99 } 100 }
@@ -108,10 +109,11 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
108 * this is always included. 109 * this is always included.
109 */ 110 */
110 111
111static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 112static AUTHORITY_KEYID *
112 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values) 113v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
113 { 114 STACK_OF(CONF_VALUE) *values)
114 char keyid=0, issuer=0; 115{
116 char keyid = 0, issuer = 0;
115 int i; 117 int i;
116 CONF_VALUE *cnf; 118 CONF_VALUE *cnf;
117 ASN1_OCTET_STRING *ikeyid = NULL; 119 ASN1_OCTET_STRING *ikeyid = NULL;
@@ -123,76 +125,70 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
123 X509 *cert; 125 X509 *cert;
124 AUTHORITY_KEYID *akeyid; 126 AUTHORITY_KEYID *akeyid;
125 127
126 for(i = 0; i < sk_CONF_VALUE_num(values); i++) 128 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
127 {
128 cnf = sk_CONF_VALUE_value(values, i); 129 cnf = sk_CONF_VALUE_value(values, i);
129 if(!strcmp(cnf->name, "keyid")) 130 if (!strcmp(cnf->name, "keyid")) {
130 {
131 keyid = 1; 131 keyid = 1;
132 if(cnf->value && !strcmp(cnf->value, "always")) 132 if (cnf->value && !strcmp(cnf->value, "always"))
133 keyid = 2; 133 keyid = 2;
134 } 134 }
135 else if(!strcmp(cnf->name, "issuer")) 135 else if (!strcmp(cnf->name, "issuer")) {
136 {
137 issuer = 1; 136 issuer = 1;
138 if(cnf->value && !strcmp(cnf->value, "always")) 137 if (cnf->value && !strcmp(cnf->value, "always"))
139 issuer = 2; 138 issuer = 2;
140 } 139 } else {
141 else 140 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
142 { 141 X509V3_R_UNKNOWN_OPTION);
143 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNKNOWN_OPTION);
144 ERR_add_error_data(2, "name=", cnf->name); 142 ERR_add_error_data(2, "name=", cnf->name);
145 return NULL; 143 return NULL;
146 }
147 } 144 }
145 }
148 146
149 if(!ctx || !ctx->issuer_cert) 147 if (!ctx || !ctx->issuer_cert) {
150 { 148 if (ctx && (ctx->flags == CTX_TEST))
151 if(ctx && (ctx->flags==CTX_TEST))
152 return AUTHORITY_KEYID_new(); 149 return AUTHORITY_KEYID_new();
153 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_NO_ISSUER_CERTIFICATE); 150 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
151 X509V3_R_NO_ISSUER_CERTIFICATE);
154 return NULL; 152 return NULL;
155 } 153 }
156 154
157 cert = ctx->issuer_cert; 155 cert = ctx->issuer_cert;
158 156
159 if(keyid) 157 if (keyid) {
160 {
161 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1); 158 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
162 if((i >= 0) && (ext = X509_get_ext(cert, i))) 159 if ((i >= 0) && (ext = X509_get_ext(cert, i)))
163 ikeyid = X509V3_EXT_d2i(ext); 160 ikeyid = X509V3_EXT_d2i(ext);
164 if(keyid==2 && !ikeyid) 161 if (keyid == 2 && !ikeyid) {
165 { 162 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
166 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_KEYID); 163 X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
167 return NULL; 164 return NULL;
168 }
169 } 165 }
166 }
170 167
171 if((issuer && !ikeyid) || (issuer == 2)) 168 if ((issuer && !ikeyid) || (issuer == 2)) {
172 {
173 isname = X509_NAME_dup(X509_get_issuer_name(cert)); 169 isname = X509_NAME_dup(X509_get_issuer_name(cert));
174 serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert)); 170 serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
175 if(!isname || !serial) 171 if (!isname || !serial) {
176 { 172 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
177 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS); 173 X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
178 goto err; 174 goto err;
179 }
180 } 175 }
176 }
181 177
182 if(!(akeyid = AUTHORITY_KEYID_new())) goto err; 178 if (!(akeyid = AUTHORITY_KEYID_new()))
179 goto err;
183 180
184 if(isname) 181 if (isname) {
185 { 182 if (!(gens = sk_GENERAL_NAME_new_null()) ||
186 if(!(gens = sk_GENERAL_NAME_new_null()) 183 !(gen = GENERAL_NAME_new()) ||
187 || !(gen = GENERAL_NAME_new()) 184 !sk_GENERAL_NAME_push(gens, gen)) {
188 || !sk_GENERAL_NAME_push(gens, gen)) 185 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
189 { 186 ERR_R_MALLOC_FAILURE);
190 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,ERR_R_MALLOC_FAILURE);
191 goto err; 187 goto err;
192 } 188 }
193 gen->type = GEN_DIRNAME; 189 gen->type = GEN_DIRNAME;
194 gen->d.dirn = isname; 190 gen->d.dirn = isname;
195 } 191 }
196 192
197 akeyid->issuer = gens; 193 akeyid->issuer = gens;
198 akeyid->serial = serial; 194 akeyid->serial = serial;
@@ -200,9 +196,9 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
200 196
201 return akeyid; 197 return akeyid;
202 198
203 err: 199err:
204 X509_NAME_free(isname); 200 X509_NAME_free(isname);
205 M_ASN1_INTEGER_free(serial); 201 M_ASN1_INTEGER_free(serial);
206 M_ASN1_OCTET_STRING_free(ikeyid); 202 M_ASN1_OCTET_STRING_free(ikeyid);
207 return NULL; 203 return NULL;
208 } 204}
diff --git a/src/lib/libcrypto/x509v3/v3_akeya.c b/src/lib/libcrypto/x509v3/v3_akeya.c
index 2c50f7360e..2bf84b4f1b 100644
--- a/src/lib/libcrypto/x509v3/v3_akeya.c
+++ b/src/lib/libcrypto/x509v3/v3_akeya.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
index 636677df94..e61ed673c0 100644
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ b/src/lib/libcrypto/x509v3/v3_alt.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -61,178 +61,181 @@
61#include <openssl/conf.h> 61#include <openssl/conf.h>
62#include <openssl/x509v3.h> 62#include <openssl/x509v3.h>
63 63
64static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); 64static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
65static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); 65 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
66static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
67 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
66static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p); 68static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
67static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens); 69static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
68static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx); 70static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
69static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx); 71static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
70 72
71const X509V3_EXT_METHOD v3_alt[] = { 73const X509V3_EXT_METHOD v3_alt[] = {
72{ NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), 74 {
730,0,0,0, 75 NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
740,0, 76 0, 0, 0, 0,
75(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 77 0, 0,
76(X509V3_EXT_V2I)v2i_subject_alt, 78 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
77NULL, NULL, NULL}, 79 (X509V3_EXT_V2I)v2i_subject_alt,
78 80 NULL, NULL, NULL
79{ NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), 81 },
800,0,0,0, 82 {
810,0, 83 NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
82(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 84 0, 0, 0, 0,
83(X509V3_EXT_V2I)v2i_issuer_alt, 85 0, 0,
84NULL, NULL, NULL}, 86 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
85 87 (X509V3_EXT_V2I)v2i_issuer_alt,
86{ NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES), 88 NULL, NULL, NULL
870,0,0,0, 89 },
880,0, 90 {
89(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 91 NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
90NULL, NULL, NULL, NULL}, 92 0, 0, 0, 0,
93 0, 0,
94 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
95 NULL, NULL, NULL, NULL
96 },
91}; 97};
92 98
93STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, 99STACK_OF(CONF_VALUE) *
94 GENERAL_NAMES *gens, STACK_OF(CONF_VALUE) *ret) 100i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens,
101 STACK_OF(CONF_VALUE) *ret)
95{ 102{
96 int i; 103 int i;
97 GENERAL_NAME *gen; 104 GENERAL_NAME *gen;
98 for(i = 0; i < sk_GENERAL_NAME_num(gens); i++) { 105
106 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
99 gen = sk_GENERAL_NAME_value(gens, i); 107 gen = sk_GENERAL_NAME_value(gens, i);
100 ret = i2v_GENERAL_NAME(method, gen, ret); 108 ret = i2v_GENERAL_NAME(method, gen, ret);
101 } 109 }
102 if(!ret) return sk_CONF_VALUE_new_null(); 110 if (!ret)
111 return sk_CONF_VALUE_new_null();
103 return ret; 112 return ret;
104} 113}
105 114
106STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, 115STACK_OF(CONF_VALUE) *
107 GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret) 116i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen,
117 STACK_OF(CONF_VALUE) *ret)
108{ 118{
109 unsigned char *p; 119 unsigned char *p;
110 char oline[256], htmp[5]; 120 char oline[256], htmp[5];
111 int i; 121 int i;
112 switch (gen->type) 122
113 { 123 switch (gen->type) {
114 case GEN_OTHERNAME: 124 case GEN_OTHERNAME:
115 X509V3_add_value("othername","<unsupported>", &ret); 125 X509V3_add_value("othername", "<unsupported>", &ret);
116 break; 126 break;
117 127
118 case GEN_X400: 128 case GEN_X400:
119 X509V3_add_value("X400Name","<unsupported>", &ret); 129 X509V3_add_value("X400Name", "<unsupported>", &ret);
120 break; 130 break;
121 131
122 case GEN_EDIPARTY: 132 case GEN_EDIPARTY:
123 X509V3_add_value("EdiPartyName","<unsupported>", &ret); 133 X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
124 break; 134 break;
125 135
126 case GEN_EMAIL: 136 case GEN_EMAIL:
127 X509V3_add_value_uchar("email",gen->d.ia5->data, &ret); 137 X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
128 break; 138 break;
129 139
130 case GEN_DNS: 140 case GEN_DNS:
131 X509V3_add_value_uchar("DNS",gen->d.ia5->data, &ret); 141 X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
132 break; 142 break;
133 143
134 case GEN_URI: 144 case GEN_URI:
135 X509V3_add_value_uchar("URI",gen->d.ia5->data, &ret); 145 X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
136 break; 146 break;
137 147
138 case GEN_DIRNAME: 148 case GEN_DIRNAME:
139 X509_NAME_oneline(gen->d.dirn, oline, 256); 149 X509_NAME_oneline(gen->d.dirn, oline, 256);
140 X509V3_add_value("DirName",oline, &ret); 150 X509V3_add_value("DirName", oline, &ret);
141 break; 151 break;
142 152
143 case GEN_IPADD: 153 case GEN_IPADD:
144 p = gen->d.ip->data; 154 p = gen->d.ip->data;
145 if(gen->d.ip->length == 4) 155 if (gen->d.ip->length == 4)
146 (void) snprintf(oline, sizeof oline, 156 (void) snprintf(oline, sizeof oline,
147 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]); 157 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
148 else if(gen->d.ip->length == 16) 158 else if (gen->d.ip->length == 16) {
149 {
150 oline[0] = 0; 159 oline[0] = 0;
151 for (i = 0; i < 8; i++) 160 for (i = 0; i < 8; i++) {
152 {
153 (void) snprintf(htmp, sizeof htmp, 161 (void) snprintf(htmp, sizeof htmp,
154 "%X", p[0] << 8 | p[1]); 162 "%X", p[0] << 8 | p[1]);
155 p += 2; 163 p += 2;
156 strlcat(oline, htmp, sizeof(oline)); 164 strlcat(oline, htmp, sizeof(oline));
157 if (i != 7) 165 if (i != 7)
158 strlcat(oline, ":", sizeof(oline)); 166 strlcat(oline, ":", sizeof(oline));
159 }
160 } 167 }
161 else 168 } else {
162 { 169 X509V3_add_value("IP Address", "<invalid>", &ret);
163 X509V3_add_value("IP Address","<invalid>", &ret);
164 break; 170 break;
165 } 171 }
166 X509V3_add_value("IP Address",oline, &ret); 172 X509V3_add_value("IP Address", oline, &ret);
167 break; 173 break;
168 174
169 case GEN_RID: 175 case GEN_RID:
170 i2t_ASN1_OBJECT(oline, 256, gen->d.rid); 176 i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
171 X509V3_add_value("Registered ID",oline, &ret); 177 X509V3_add_value("Registered ID", oline, &ret);
172 break; 178 break;
173 } 179 }
174 return ret; 180 return ret;
175} 181}
176 182
177int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen) 183int
184GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
178{ 185{
179 unsigned char *p; 186 unsigned char *p;
180 int i; 187 int i;
181 switch (gen->type) 188
182 { 189 switch (gen->type) {
183 case GEN_OTHERNAME: 190 case GEN_OTHERNAME:
184 BIO_printf(out, "othername:<unsupported>"); 191 BIO_printf(out, "othername:<unsupported>");
185 break; 192 break;
186 193
187 case GEN_X400: 194 case GEN_X400:
188 BIO_printf(out, "X400Name:<unsupported>"); 195 BIO_printf(out, "X400Name:<unsupported>");
189 break; 196 break;
190 197
191 case GEN_EDIPARTY: 198 case GEN_EDIPARTY:
192 /* Maybe fix this: it is supported now */ 199 /* Maybe fix this: it is supported now */
193 BIO_printf(out, "EdiPartyName:<unsupported>"); 200 BIO_printf(out, "EdiPartyName:<unsupported>");
194 break; 201 break;
195 202
196 case GEN_EMAIL: 203 case GEN_EMAIL:
197 BIO_printf(out, "email:%s",gen->d.ia5->data); 204 BIO_printf(out, "email:%s", gen->d.ia5->data);
198 break; 205 break;
199 206
200 case GEN_DNS: 207 case GEN_DNS:
201 BIO_printf(out, "DNS:%s",gen->d.ia5->data); 208 BIO_printf(out, "DNS:%s", gen->d.ia5->data);
202 break; 209 break;
203 210
204 case GEN_URI: 211 case GEN_URI:
205 BIO_printf(out, "URI:%s",gen->d.ia5->data); 212 BIO_printf(out, "URI:%s", gen->d.ia5->data);
206 break; 213 break;
207 214
208 case GEN_DIRNAME: 215 case GEN_DIRNAME:
209 BIO_printf(out, "DirName: "); 216 BIO_printf(out, "DirName: ");
210 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE); 217 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
211 break; 218 break;
212 219
213 case GEN_IPADD: 220 case GEN_IPADD:
214 p = gen->d.ip->data; 221 p = gen->d.ip->data;
215 if(gen->d.ip->length == 4) 222 if (gen->d.ip->length == 4)
216 BIO_printf(out, "IP Address:%d.%d.%d.%d", 223 BIO_printf(out, "IP Address:%d.%d.%d.%d",
217 p[0], p[1], p[2], p[3]); 224 p[0], p[1], p[2], p[3]);
218 else if(gen->d.ip->length == 16) 225 else if (gen->d.ip->length == 16) {
219 {
220 BIO_printf(out, "IP Address"); 226 BIO_printf(out, "IP Address");
221 for (i = 0; i < 8; i++) 227 for (i = 0; i < 8; i++) {
222 {
223 BIO_printf(out, ":%X", p[0] << 8 | p[1]); 228 BIO_printf(out, ":%X", p[0] << 8 | p[1]);
224 p += 2; 229 p += 2;
225 }
226 BIO_puts(out, "\n");
227 } 230 }
228 else 231 BIO_puts(out, "\n");
229 { 232 } else {
230 BIO_printf(out,"IP Address:<invalid>"); 233 BIO_printf(out, "IP Address:<invalid>");
231 break; 234 break;
232 } 235 }
233 break; 236 break;
234 237
235 case GEN_RID: 238 case GEN_RID:
236 BIO_printf(out, "Registered ID"); 239 BIO_printf(out, "Registered ID");
237 i2a_ASN1_OBJECT(out, gen->d.rid); 240 i2a_ASN1_OBJECT(out, gen->d.rid);
238 break; 241 break;
@@ -240,333 +243,348 @@ int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
240 return 1; 243 return 1;
241} 244}
242 245
243static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, 246static GENERAL_NAMES *
244 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 247v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
248 STACK_OF(CONF_VALUE) *nval)
245{ 249{
246 GENERAL_NAMES *gens = NULL; 250 GENERAL_NAMES *gens = NULL;
247 CONF_VALUE *cnf; 251 CONF_VALUE *cnf;
248 int i; 252 int i;
249 if(!(gens = sk_GENERAL_NAME_new_null())) { 253
250 X509V3err(X509V3_F_V2I_ISSUER_ALT,ERR_R_MALLOC_FAILURE); 254 if (!(gens = sk_GENERAL_NAME_new_null())) {
255 X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
251 return NULL; 256 return NULL;
252 } 257 }
253 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 258 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
254 cnf = sk_CONF_VALUE_value(nval, i); 259 cnf = sk_CONF_VALUE_value(nval, i);
255 if(!name_cmp(cnf->name, "issuer") && cnf->value && 260 if (!name_cmp(cnf->name, "issuer") && cnf->value &&
256 !strcmp(cnf->value, "copy")) { 261 !strcmp(cnf->value, "copy")) {
257 if(!copy_issuer(ctx, gens)) goto err; 262 if (!copy_issuer(ctx, gens))
263 goto err;
258 } else { 264 } else {
259 GENERAL_NAME *gen; 265 GENERAL_NAME *gen;
260 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) 266 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
261 goto err; 267 goto err;
262 sk_GENERAL_NAME_push(gens, gen); 268 sk_GENERAL_NAME_push(gens, gen);
263 } 269 }
264 } 270 }
265 return gens; 271 return gens;
266 err: 272
273err:
267 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 274 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
268 return NULL; 275 return NULL;
269} 276}
270 277
271/* Append subject altname of issuer to issuer alt name of subject */ 278/* Append subject altname of issuer to issuer alt name of subject */
272 279
273static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens) 280static int
281copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
274{ 282{
275 GENERAL_NAMES *ialt; 283 GENERAL_NAMES *ialt;
276 GENERAL_NAME *gen; 284 GENERAL_NAME *gen;
277 X509_EXTENSION *ext; 285 X509_EXTENSION *ext;
278 int i; 286 int i;
279 if(ctx && (ctx->flags == CTX_TEST)) return 1; 287
280 if(!ctx || !ctx->issuer_cert) { 288 if (ctx && (ctx->flags == CTX_TEST))
281 X509V3err(X509V3_F_COPY_ISSUER,X509V3_R_NO_ISSUER_DETAILS); 289 return 1;
290 if (!ctx || !ctx->issuer_cert) {
291 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
282 goto err; 292 goto err;
283 } 293 }
284 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1); 294 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
285 if(i < 0) return 1; 295 if (i < 0)
286 if(!(ext = X509_get_ext(ctx->issuer_cert, i)) || 296 return 1;
287 !(ialt = X509V3_EXT_d2i(ext)) ) { 297 if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
288 X509V3err(X509V3_F_COPY_ISSUER,X509V3_R_ISSUER_DECODE_ERROR); 298 !(ialt = X509V3_EXT_d2i(ext))) {
299 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
289 goto err; 300 goto err;
290 } 301 }
291 302
292 for(i = 0; i < sk_GENERAL_NAME_num(ialt); i++) { 303 for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
293 gen = sk_GENERAL_NAME_value(ialt, i); 304 gen = sk_GENERAL_NAME_value(ialt, i);
294 if(!sk_GENERAL_NAME_push(gens, gen)) { 305 if (!sk_GENERAL_NAME_push(gens, gen)) {
295 X509V3err(X509V3_F_COPY_ISSUER,ERR_R_MALLOC_FAILURE); 306 X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
296 goto err; 307 goto err;
297 } 308 }
298 } 309 }
299 sk_GENERAL_NAME_free(ialt); 310 sk_GENERAL_NAME_free(ialt);
300 311
301 return 1; 312 return 1;
302 313
303 err: 314err:
304 return 0; 315 return 0;
305 316
306} 317}
307 318
308static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, 319static GENERAL_NAMES *
309 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 320v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
321 STACK_OF(CONF_VALUE) *nval)
310{ 322{
311 GENERAL_NAMES *gens = NULL; 323 GENERAL_NAMES *gens = NULL;
312 CONF_VALUE *cnf; 324 CONF_VALUE *cnf;
313 int i; 325 int i;
314 if(!(gens = sk_GENERAL_NAME_new_null())) { 326
315 X509V3err(X509V3_F_V2I_SUBJECT_ALT,ERR_R_MALLOC_FAILURE); 327 if (!(gens = sk_GENERAL_NAME_new_null())) {
328 X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
316 return NULL; 329 return NULL;
317 } 330 }
318 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 331 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
319 cnf = sk_CONF_VALUE_value(nval, i); 332 cnf = sk_CONF_VALUE_value(nval, i);
320 if(!name_cmp(cnf->name, "email") && cnf->value && 333 if (!name_cmp(cnf->name, "email") && cnf->value &&
321 !strcmp(cnf->value, "copy")) { 334 !strcmp(cnf->value, "copy")) {
322 if(!copy_email(ctx, gens, 0)) goto err; 335 if (!copy_email(ctx, gens, 0))
323 } else if(!name_cmp(cnf->name, "email") && cnf->value && 336 goto err;
324 !strcmp(cnf->value, "move")) { 337 } else if (!name_cmp(cnf->name, "email") && cnf->value &&
325 if(!copy_email(ctx, gens, 1)) goto err; 338 !strcmp(cnf->value, "move")) {
339 if (!copy_email(ctx, gens, 1))
340 goto err;
326 } else { 341 } else {
327 GENERAL_NAME *gen; 342 GENERAL_NAME *gen;
328 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) 343 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
329 goto err; 344 goto err;
330 sk_GENERAL_NAME_push(gens, gen); 345 sk_GENERAL_NAME_push(gens, gen);
331 } 346 }
332 } 347 }
333 return gens; 348 return gens;
334 err: 349
350err:
335 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 351 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
336 return NULL; 352 return NULL;
337} 353}
338 354
339/* Copy any email addresses in a certificate or request to 355/* Copy any email addresses in a certificate or request to
340 * GENERAL_NAMES 356 * GENERAL_NAMES
341 */ 357 */
342 358
343static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p) 359static int
360copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
344{ 361{
345 X509_NAME *nm; 362 X509_NAME *nm;
346 ASN1_IA5STRING *email = NULL; 363 ASN1_IA5STRING *email = NULL;
347 X509_NAME_ENTRY *ne; 364 X509_NAME_ENTRY *ne;
348 GENERAL_NAME *gen = NULL; 365 GENERAL_NAME *gen = NULL;
349 int i; 366 int i;
350 if(ctx != NULL && ctx->flags == CTX_TEST) 367
368 if (ctx != NULL && ctx->flags == CTX_TEST)
351 return 1; 369 return 1;
352 if(!ctx || (!ctx->subject_cert && !ctx->subject_req)) { 370 if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
353 X509V3err(X509V3_F_COPY_EMAIL,X509V3_R_NO_SUBJECT_DETAILS); 371 X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
354 goto err; 372 goto err;
355 } 373 }
356 /* Find the subject name */ 374 /* Find the subject name */
357 if(ctx->subject_cert) nm = X509_get_subject_name(ctx->subject_cert); 375 if (ctx->subject_cert)
358 else nm = X509_REQ_get_subject_name(ctx->subject_req); 376 nm = X509_get_subject_name(ctx->subject_cert);
377 else
378 nm = X509_REQ_get_subject_name(ctx->subject_req);
359 379
360 /* Now add any email address(es) to STACK */ 380 /* Now add any email address(es) to STACK */
361 i = -1; 381 i = -1;
362 while((i = X509_NAME_get_index_by_NID(nm, 382 while ((i = X509_NAME_get_index_by_NID(nm,
363 NID_pkcs9_emailAddress, i)) >= 0) { 383 NID_pkcs9_emailAddress, i)) >= 0) {
364 ne = X509_NAME_get_entry(nm, i); 384 ne = X509_NAME_get_entry(nm, i);
365 email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne)); 385 email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
366 if (move_p) 386 if (move_p) {
367 { 387 X509_NAME_delete_entry(nm, i);
368 X509_NAME_delete_entry(nm, i);
369 X509_NAME_ENTRY_free(ne); 388 X509_NAME_ENTRY_free(ne);
370 i--; 389 i--;
371 } 390 }
372 if(!email || !(gen = GENERAL_NAME_new())) { 391 if (!email || !(gen = GENERAL_NAME_new())) {
373 X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE); 392 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
374 goto err; 393 goto err;
375 } 394 }
376 gen->d.ia5 = email; 395 gen->d.ia5 = email;
377 email = NULL; 396 email = NULL;
378 gen->type = GEN_EMAIL; 397 gen->type = GEN_EMAIL;
379 if(!sk_GENERAL_NAME_push(gens, gen)) { 398 if (!sk_GENERAL_NAME_push(gens, gen)) {
380 X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE); 399 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
381 goto err; 400 goto err;
382 } 401 }
383 gen = NULL; 402 gen = NULL;
384 } 403 }
385 404
386
387 return 1; 405 return 1;
388 406
389 err: 407err:
390 GENERAL_NAME_free(gen); 408 GENERAL_NAME_free(gen);
391 M_ASN1_IA5STRING_free(email); 409 M_ASN1_IA5STRING_free(email);
392 return 0; 410 return 0;
393
394} 411}
395 412
396GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, 413GENERAL_NAMES *
397 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 414v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
415 STACK_OF(CONF_VALUE) *nval)
398{ 416{
399 GENERAL_NAME *gen; 417 GENERAL_NAME *gen;
400 GENERAL_NAMES *gens = NULL; 418 GENERAL_NAMES *gens = NULL;
401 CONF_VALUE *cnf; 419 CONF_VALUE *cnf;
402 int i; 420 int i;
403 if(!(gens = sk_GENERAL_NAME_new_null())) { 421
404 X509V3err(X509V3_F_V2I_GENERAL_NAMES,ERR_R_MALLOC_FAILURE); 422 if (!(gens = sk_GENERAL_NAME_new_null())) {
423 X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
405 return NULL; 424 return NULL;
406 } 425 }
407 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 426 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
408 cnf = sk_CONF_VALUE_value(nval, i); 427 cnf = sk_CONF_VALUE_value(nval, i);
409 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) goto err; 428 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
429 goto err;
410 sk_GENERAL_NAME_push(gens, gen); 430 sk_GENERAL_NAME_push(gens, gen);
411 } 431 }
412 return gens; 432 return gens;
413 err: 433
434err:
414 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 435 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
415 return NULL; 436 return NULL;
416} 437}
417 438
418GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, 439GENERAL_NAME *
419 CONF_VALUE *cnf) 440v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
420 { 441 CONF_VALUE *cnf)
442{
421 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0); 443 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
422 } 444}
423 445
424GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out, 446GENERAL_NAME *
425 const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, 447a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
426 int gen_type, char *value, int is_nc) 448 X509V3_CTX *ctx, int gen_type, char *value, int is_nc)
427 { 449{
428 char is_string = 0; 450 char is_string = 0;
429 GENERAL_NAME *gen = NULL; 451 GENERAL_NAME *gen = NULL;
430 452
431 if(!value) 453 if (!value) {
432 { 454 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
433 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_MISSING_VALUE);
434 return NULL; 455 return NULL;
435 } 456 }
436 457
437 if (out) 458 if (out)
438 gen = out; 459 gen = out;
439 else 460 else {
440 {
441 gen = GENERAL_NAME_new(); 461 gen = GENERAL_NAME_new();
442 if(gen == NULL) 462 if (gen == NULL) {
443 { 463 X509V3err(X509V3_F_A2I_GENERAL_NAME,
444 X509V3err(X509V3_F_A2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE); 464 ERR_R_MALLOC_FAILURE);
445 return NULL; 465 return NULL;
446 }
447 } 466 }
467 }
448 468
449 switch (gen_type) 469 switch (gen_type) {
450 { 470 case GEN_URI:
451 case GEN_URI: 471 case GEN_EMAIL:
452 case GEN_EMAIL: 472 case GEN_DNS:
453 case GEN_DNS:
454 is_string = 1; 473 is_string = 1;
455 break; 474 break;
456 475
457 case GEN_RID: 476 case GEN_RID:
458 { 477 {
459 ASN1_OBJECT *obj; 478 ASN1_OBJECT *obj;
460 if(!(obj = OBJ_txt2obj(value,0))) 479 if (!(obj = OBJ_txt2obj(value, 0))) {
461 { 480 X509V3err(X509V3_F_A2I_GENERAL_NAME,
462 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_BAD_OBJECT); 481 X509V3_R_BAD_OBJECT);
463 ERR_add_error_data(2, "value=", value); 482 ERR_add_error_data(2, "value=", value);
464 goto err; 483 goto err;
465 } 484 }
466 gen->d.rid = obj; 485 gen->d.rid = obj;
467 } 486 }
468 break; 487 break;
469 488
470 case GEN_IPADD: 489 case GEN_IPADD:
471 if (is_nc) 490 if (is_nc)
472 gen->d.ip = a2i_IPADDRESS_NC(value); 491 gen->d.ip = a2i_IPADDRESS_NC(value);
473 else 492 else
474 gen->d.ip = a2i_IPADDRESS(value); 493 gen->d.ip = a2i_IPADDRESS(value);
475 if(gen->d.ip == NULL) 494 if (gen->d.ip == NULL) {
476 { 495 X509V3err(X509V3_F_A2I_GENERAL_NAME,
477 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_BAD_IP_ADDRESS); 496 X509V3_R_BAD_IP_ADDRESS);
478 ERR_add_error_data(2, "value=", value); 497 ERR_add_error_data(2, "value=", value);
479 goto err; 498 goto err;
480 } 499 }
481 break; 500 break;
482 501
483 case GEN_DIRNAME: 502 case GEN_DIRNAME:
484 if (!do_dirname(gen, value, ctx)) 503 if (!do_dirname(gen, value, ctx)) {
485 { 504 X509V3err(X509V3_F_A2I_GENERAL_NAME,
486 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_DIRNAME_ERROR); 505 X509V3_R_DIRNAME_ERROR);
487 goto err; 506 goto err;
488 } 507 }
489 break; 508 break;
490 509
491 case GEN_OTHERNAME: 510 case GEN_OTHERNAME:
492 if (!do_othername(gen, value, ctx)) 511 if (!do_othername(gen, value, ctx)) {
493 { 512 X509V3err(X509V3_F_A2I_GENERAL_NAME,
494 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_OTHERNAME_ERROR); 513 X509V3_R_OTHERNAME_ERROR);
495 goto err; 514 goto err;
496 } 515 }
497 break; 516 break;
498 default: 517
499 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_UNSUPPORTED_TYPE); 518 default:
519 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
500 goto err; 520 goto err;
501 } 521 }
502 522
503 if(is_string) 523 if (is_string) {
504 { 524 if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
505 if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) || 525 !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
506 !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value, 526 strlen(value))) {
507 strlen(value))) 527 X509V3err(X509V3_F_A2I_GENERAL_NAME,
508 { 528 ERR_R_MALLOC_FAILURE);
509 X509V3err(X509V3_F_A2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
510 goto err; 529 goto err;
511 }
512 } 530 }
531 }
513 532
514 gen->type = gen_type; 533 gen->type = gen_type;
515 534
516 return gen; 535 return gen;
517 536
518 err: 537err:
519 if (!out) 538 if (!out)
520 GENERAL_NAME_free(gen); 539 GENERAL_NAME_free(gen);
521 return NULL; 540 return NULL;
522 } 541}
523 542
524GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, 543GENERAL_NAME *
525 const X509V3_EXT_METHOD *method, 544v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
526 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc) 545 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
527 { 546{
528 int type; 547 int type;
529
530 char *name, *value; 548 char *name, *value;
531 549
532 name = cnf->name; 550 name = cnf->name;
533 value = cnf->value; 551 value = cnf->value;
534 552
535 if(!value) 553 if (!value) {
536 { 554 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
537 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_MISSING_VALUE);
538 return NULL; 555 return NULL;
539 } 556 }
540 557
541 if(!name_cmp(name, "email")) 558 if (!name_cmp(name, "email"))
542 type = GEN_EMAIL; 559 type = GEN_EMAIL;
543 else if(!name_cmp(name, "URI")) 560 else if (!name_cmp(name, "URI"))
544 type = GEN_URI; 561 type = GEN_URI;
545 else if(!name_cmp(name, "DNS")) 562 else if (!name_cmp(name, "DNS"))
546 type = GEN_DNS; 563 type = GEN_DNS;
547 else if(!name_cmp(name, "RID")) 564 else if (!name_cmp(name, "RID"))
548 type = GEN_RID; 565 type = GEN_RID;
549 else if(!name_cmp(name, "IP")) 566 else if (!name_cmp(name, "IP"))
550 type = GEN_IPADD; 567 type = GEN_IPADD;
551 else if(!name_cmp(name, "dirName")) 568 else if (!name_cmp(name, "dirName"))
552 type = GEN_DIRNAME; 569 type = GEN_DIRNAME;
553 else if(!name_cmp(name, "otherName")) 570 else if (!name_cmp(name, "otherName"))
554 type = GEN_OTHERNAME; 571 type = GEN_OTHERNAME;
555 else 572 else {
556 { 573 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,
557 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_UNSUPPORTED_OPTION); 574 X509V3_R_UNSUPPORTED_OPTION);
558 ERR_add_error_data(2, "name=", name); 575 ERR_add_error_data(2, "name=", name);
559 return NULL; 576 return NULL;
560 } 577 }
561 578
562 return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc); 579 return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
580}
563 581
564 } 582static int
565 583do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
566static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx) 584{
567 {
568 char *objtmp = NULL, *p; 585 char *objtmp = NULL, *p;
569 int objlen; 586 int objlen;
587
570 if (!(p = strchr(value, ';'))) 588 if (!(p = strchr(value, ';')))
571 return 0; 589 return 0;
572 if (!(gen->d.otherName = OTHERNAME_new())) 590 if (!(gen->d.otherName = OTHERNAME_new()))
@@ -588,29 +606,30 @@ static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
588 if (!gen->d.otherName->type_id) 606 if (!gen->d.otherName->type_id)
589 return 0; 607 return 0;
590 return 1; 608 return 1;
591 } 609}
592 610
593static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx) 611static int
594 { 612do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
613{
595 int ret; 614 int ret;
596 STACK_OF(CONF_VALUE) *sk; 615 STACK_OF(CONF_VALUE) *sk;
597 X509_NAME *nm; 616 X509_NAME *nm;
617
598 if (!(nm = X509_NAME_new())) 618 if (!(nm = X509_NAME_new()))
599 return 0; 619 return 0;
600 sk = X509V3_get_section(ctx, value); 620 sk = X509V3_get_section(ctx, value);
601 if (!sk) 621 if (!sk) {
602 { 622 X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
603 X509V3err(X509V3_F_DO_DIRNAME,X509V3_R_SECTION_NOT_FOUND);
604 ERR_add_error_data(2, "section=", value); 623 ERR_add_error_data(2, "section=", value);
605 X509_NAME_free(nm); 624 X509_NAME_free(nm);
606 return 0; 625 return 0;
607 } 626 }
608 /* FIXME: should allow other character types... */ 627 /* FIXME: should allow other character types... */
609 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC); 628 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
610 if (!ret) 629 if (!ret)
611 X509_NAME_free(nm); 630 X509_NAME_free(nm);
612 gen->d.dirn = nm; 631 gen->d.dirn = nm;
613 X509V3_section_free(ctx, sk); 632 X509V3_section_free(ctx, sk);
614 633
615 return ret; 634 return ret;
616 } 635}
diff --git a/src/lib/libcrypto/x509v3/v3_asid.c b/src/lib/libcrypto/x509v3/v3_asid.c
index 325c8e0406..6335a31d19 100644
--- a/src/lib/libcrypto/x509v3/v3_asid.c
+++ b/src/lib/libcrypto/x509v3/v3_asid.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -76,23 +76,23 @@
76 */ 76 */
77 77
78ASN1_SEQUENCE(ASRange) = { 78ASN1_SEQUENCE(ASRange) = {
79 ASN1_SIMPLE(ASRange, min, ASN1_INTEGER), 79 ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
80 ASN1_SIMPLE(ASRange, max, ASN1_INTEGER) 80 ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
81} ASN1_SEQUENCE_END(ASRange) 81} ASN1_SEQUENCE_END(ASRange)
82 82
83ASN1_CHOICE(ASIdOrRange) = { 83ASN1_CHOICE(ASIdOrRange) = {
84 ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER), 84 ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER),
85 ASN1_SIMPLE(ASIdOrRange, u.range, ASRange) 85 ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
86} ASN1_CHOICE_END(ASIdOrRange) 86} ASN1_CHOICE_END(ASIdOrRange)
87 87
88ASN1_CHOICE(ASIdentifierChoice) = { 88ASN1_CHOICE(ASIdentifierChoice) = {
89 ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL), 89 ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL),
90 ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange) 90 ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
91} ASN1_CHOICE_END(ASIdentifierChoice) 91} ASN1_CHOICE_END(ASIdentifierChoice)
92 92
93ASN1_SEQUENCE(ASIdentifiers) = { 93ASN1_SEQUENCE(ASIdentifiers) = {
94 ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0), 94 ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
95 ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1) 95 ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1)
96} ASN1_SEQUENCE_END(ASIdentifiers) 96} ASN1_SEQUENCE_END(ASIdentifiers)
97 97
98IMPLEMENT_ASN1_FUNCTIONS(ASRange) 98IMPLEMENT_ASN1_FUNCTIONS(ASRange)
@@ -103,628 +103,662 @@ IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
103/* 103/*
104 * i2r method for an ASIdentifierChoice. 104 * i2r method for an ASIdentifierChoice.
105 */ 105 */
106static int i2r_ASIdentifierChoice(BIO *out, 106static int
107 ASIdentifierChoice *choice, 107i2r_ASIdentifierChoice(BIO *out, ASIdentifierChoice *choice, int indent,
108 int indent, 108 const char *msg)
109 const char *msg)
110{ 109{
111 int i; 110 int i;
112 char *s; 111 char *s;
113 if (choice == NULL) 112
114 return 1; 113 if (choice == NULL)
115 BIO_printf(out, "%*s%s:\n", indent, "", msg); 114 return 1;
116 switch (choice->type) { 115 BIO_printf(out, "%*s%s:\n", indent, "", msg);
117 case ASIdentifierChoice_inherit: 116 switch (choice->type) {
118 BIO_printf(out, "%*sinherit\n", indent + 2, ""); 117 case ASIdentifierChoice_inherit:
119 break; 118 BIO_printf(out, "%*sinherit\n", indent + 2, "");
120 case ASIdentifierChoice_asIdsOrRanges: 119 break;
121 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) { 120 case ASIdentifierChoice_asIdsOrRanges:
122 ASIdOrRange *aor = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 121 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges);
123 switch (aor->type) { 122 i++) {
124 case ASIdOrRange_id: 123 ASIdOrRange *aor =
125 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL) 124 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
126 return 0; 125 switch (aor->type) {
127 BIO_printf(out, "%*s%s\n", indent + 2, "", s); 126 case ASIdOrRange_id:
128 free(s); 127 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) ==
129 break; 128 NULL)
130 case ASIdOrRange_range: 129 return 0;
131 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL) 130 BIO_printf(out, "%*s%s\n", indent + 2, "", s);
132 return 0; 131 free(s);
133 BIO_printf(out, "%*s%s-", indent + 2, "", s); 132 break;
134 free(s); 133 case ASIdOrRange_range:
135 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL) 134 if ((s = i2s_ASN1_INTEGER(NULL,
136 return 0; 135 aor->u.range->min)) == NULL)
137 BIO_printf(out, "%s\n", s); 136 return 0;
138 free(s); 137 BIO_printf(out, "%*s%s-", indent + 2, "", s);
139 break; 138 free(s);
140 default: 139 if ((s = i2s_ASN1_INTEGER(NULL,
141 return 0; 140 aor->u.range->max)) == NULL)
142 } 141 return 0;
143 } 142 BIO_printf(out, "%s\n", s);
144 break; 143 free(s);
145 default: 144 break;
146 return 0; 145 default:
147 } 146 return 0;
148 return 1; 147 }
148 }
149 break;
150
151 default:
152 return 0;
153 }
154 return 1;
149} 155}
150 156
151/* 157/*
152 * i2r method for an ASIdentifier extension. 158 * i2r method for an ASIdentifier extension.
153 */ 159 */
154static int i2r_ASIdentifiers(const X509V3_EXT_METHOD *method, 160static int
155 void *ext, 161i2r_ASIdentifiers(const X509V3_EXT_METHOD *method, void *ext, BIO *out,
156 BIO *out, 162 int indent)
157 int indent)
158{ 163{
159 ASIdentifiers *asid = ext; 164 ASIdentifiers *asid = ext;
160 return (i2r_ASIdentifierChoice(out, asid->asnum, indent, 165
161 "Autonomous System Numbers") && 166 return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
162 i2r_ASIdentifierChoice(out, asid->rdi, indent, 167 "Autonomous System Numbers") &&
163 "Routing Domain Identifiers")); 168 i2r_ASIdentifierChoice(out, asid->rdi, indent,
169 "Routing Domain Identifiers"));
164} 170}
165 171
166/* 172/*
167 * Sort comparision function for a sequence of ASIdOrRange elements. 173 * Sort comparision function for a sequence of ASIdOrRange elements.
168 */ 174 */
169static int ASIdOrRange_cmp(const ASIdOrRange * const *a_, 175static int
170 const ASIdOrRange * const *b_) 176ASIdOrRange_cmp(const ASIdOrRange * const *a_, const ASIdOrRange * const *b_)
171{ 177{
172 const ASIdOrRange *a = *a_, *b = *b_; 178 const ASIdOrRange *a = *a_, *b = *b_;
173 179
174 OPENSSL_assert((a->type == ASIdOrRange_id && a->u.id != NULL) || 180 OPENSSL_assert((a->type == ASIdOrRange_id && a->u.id != NULL) ||
175 (a->type == ASIdOrRange_range && a->u.range != NULL && 181 (a->type == ASIdOrRange_range && a->u.range != NULL &&
176 a->u.range->min != NULL && a->u.range->max != NULL)); 182 a->u.range->min != NULL && a->u.range->max != NULL));
177 183
178 OPENSSL_assert((b->type == ASIdOrRange_id && b->u.id != NULL) || 184 OPENSSL_assert((b->type == ASIdOrRange_id && b->u.id != NULL) ||
179 (b->type == ASIdOrRange_range && b->u.range != NULL && 185 (b->type == ASIdOrRange_range && b->u.range != NULL &&
180 b->u.range->min != NULL && b->u.range->max != NULL)); 186 b->u.range->min != NULL && b->u.range->max != NULL));
181 187
182 if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id) 188 if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
183 return ASN1_INTEGER_cmp(a->u.id, b->u.id); 189 return ASN1_INTEGER_cmp(a->u.id, b->u.id);
184 190
185 if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) { 191 if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
186 int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min); 192 int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
187 return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max, b->u.range->max); 193 return r != 0 ? r :
188 } 194 ASN1_INTEGER_cmp(a->u.range->max, b->u.range->max);
195 }
189 196
190 if (a->type == ASIdOrRange_id) 197 if (a->type == ASIdOrRange_id)
191 return ASN1_INTEGER_cmp(a->u.id, b->u.range->min); 198 return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
192 else 199 else
193 return ASN1_INTEGER_cmp(a->u.range->min, b->u.id); 200 return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
194} 201}
195 202
196/* 203/*
197 * Add an inherit element. 204 * Add an inherit element.
198 */ 205 */
199int v3_asid_add_inherit(ASIdentifiers *asid, int which) 206int
207v3_asid_add_inherit(ASIdentifiers *asid, int which)
200{ 208{
201 ASIdentifierChoice **choice; 209 ASIdentifierChoice **choice;
202 if (asid == NULL) 210
203 return 0; 211 if (asid == NULL)
204 switch (which) { 212 return 0;
205 case V3_ASID_ASNUM: 213 switch (which) {
206 choice = &asid->asnum; 214 case V3_ASID_ASNUM:
207 break; 215 choice = &asid->asnum;
208 case V3_ASID_RDI: 216 break;
209 choice = &asid->rdi; 217 case V3_ASID_RDI:
210 break; 218 choice = &asid->rdi;
211 default: 219 break;
212 return 0; 220 default:
213 } 221 return 0;
214 if (*choice == NULL) { 222 }
215 if ((*choice = ASIdentifierChoice_new()) == NULL) 223 if (*choice == NULL) {
216 return 0; 224 if ((*choice = ASIdentifierChoice_new()) == NULL)
217 OPENSSL_assert((*choice)->u.inherit == NULL); 225 return 0;
218 if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL) 226 OPENSSL_assert((*choice)->u.inherit == NULL);
219 return 0; 227 if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL)
220 (*choice)->type = ASIdentifierChoice_inherit; 228 return 0;
221 } 229 (*choice)->type = ASIdentifierChoice_inherit;
222 return (*choice)->type == ASIdentifierChoice_inherit; 230 }
231 return (*choice)->type == ASIdentifierChoice_inherit;
223} 232}
224 233
225/* 234/*
226 * Add an ID or range to an ASIdentifierChoice. 235 * Add an ID or range to an ASIdentifierChoice.
227 */ 236 */
228int v3_asid_add_id_or_range(ASIdentifiers *asid, 237int
229 int which, 238v3_asid_add_id_or_range(ASIdentifiers *asid, int which, ASN1_INTEGER *min,
230 ASN1_INTEGER *min, 239 ASN1_INTEGER *max)
231 ASN1_INTEGER *max)
232{ 240{
233 ASIdentifierChoice **choice; 241 ASIdentifierChoice **choice;
234 ASIdOrRange *aor; 242 ASIdOrRange *aor;
235 if (asid == NULL) 243
236 return 0; 244 if (asid == NULL)
237 switch (which) { 245 return 0;
238 case V3_ASID_ASNUM: 246 switch (which) {
239 choice = &asid->asnum; 247 case V3_ASID_ASNUM:
240 break; 248 choice = &asid->asnum;
241 case V3_ASID_RDI: 249 break;
242 choice = &asid->rdi; 250 case V3_ASID_RDI:
243 break; 251 choice = &asid->rdi;
244 default: 252 break;
245 return 0; 253 default:
246 } 254 return 0;
247 if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit) 255 }
248 return 0; 256 if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit)
249 if (*choice == NULL) { 257 return 0;
250 if ((*choice = ASIdentifierChoice_new()) == NULL) 258 if (*choice == NULL) {
251 return 0; 259 if ((*choice = ASIdentifierChoice_new()) == NULL)
252 OPENSSL_assert((*choice)->u.asIdsOrRanges == NULL); 260 return 0;
253 (*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp); 261 OPENSSL_assert((*choice)->u.asIdsOrRanges == NULL);
254 if ((*choice)->u.asIdsOrRanges == NULL) 262 (*choice)->u.asIdsOrRanges =
255 return 0; 263 sk_ASIdOrRange_new(ASIdOrRange_cmp);
256 (*choice)->type = ASIdentifierChoice_asIdsOrRanges; 264 if ((*choice)->u.asIdsOrRanges == NULL)
257 } 265 return 0;
258 if ((aor = ASIdOrRange_new()) == NULL) 266 (*choice)->type = ASIdentifierChoice_asIdsOrRanges;
259 return 0; 267 }
260 if (max == NULL) { 268 if ((aor = ASIdOrRange_new()) == NULL)
261 aor->type = ASIdOrRange_id; 269 return 0;
262 aor->u.id = min; 270 if (max == NULL) {
263 } else { 271 aor->type = ASIdOrRange_id;
264 aor->type = ASIdOrRange_range; 272 aor->u.id = min;
265 if ((aor->u.range = ASRange_new()) == NULL) 273 } else {
266 goto err; 274 aor->type = ASIdOrRange_range;
267 ASN1_INTEGER_free(aor->u.range->min); 275 if ((aor->u.range = ASRange_new()) == NULL)
268 aor->u.range->min = min; 276 goto err;
269 ASN1_INTEGER_free(aor->u.range->max); 277 ASN1_INTEGER_free(aor->u.range->min);
270 aor->u.range->max = max; 278 aor->u.range->min = min;
271 } 279 ASN1_INTEGER_free(aor->u.range->max);
272 if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor))) 280 aor->u.range->max = max;
273 goto err; 281 }
274 return 1; 282 if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
275 283 goto err;
276 err: 284 return 1;
277 ASIdOrRange_free(aor); 285
278 return 0; 286err:
287 ASIdOrRange_free(aor);
288 return 0;
279} 289}
280 290
281/* 291/*
282 * Extract min and max values from an ASIdOrRange. 292 * Extract min and max values from an ASIdOrRange.
283 */ 293 */
284static void extract_min_max(ASIdOrRange *aor, 294static void
285 ASN1_INTEGER **min, 295extract_min_max(ASIdOrRange *aor, ASN1_INTEGER **min, ASN1_INTEGER **max)
286 ASN1_INTEGER **max)
287{ 296{
288 OPENSSL_assert(aor != NULL && min != NULL && max != NULL); 297 OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
289 switch (aor->type) { 298
290 case ASIdOrRange_id: 299 switch (aor->type) {
291 *min = aor->u.id; 300 case ASIdOrRange_id:
292 *max = aor->u.id; 301 *min = aor->u.id;
293 return; 302 *max = aor->u.id;
294 case ASIdOrRange_range: 303 return;
295 *min = aor->u.range->min; 304 case ASIdOrRange_range:
296 *max = aor->u.range->max; 305 *min = aor->u.range->min;
297 return; 306 *max = aor->u.range->max;
298 } 307 return;
308 }
299} 309}
300 310
301/* 311/*
302 * Check whether an ASIdentifierChoice is in canonical form. 312 * Check whether an ASIdentifierChoice is in canonical form.
303 */ 313 */
304static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice) 314static int
315ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
305{ 316{
306 ASN1_INTEGER *a_max_plus_one = NULL; 317 ASN1_INTEGER *a_max_plus_one = NULL;
307 BIGNUM *bn = NULL; 318 BIGNUM *bn = NULL;
308 int i, ret = 0; 319 int i, ret = 0;
309 320
310 /* 321 /*
311 * Empty element or inheritance is canonical. 322 * Empty element or inheritance is canonical.
312 */ 323 */
313 if (choice == NULL || choice->type == ASIdentifierChoice_inherit) 324 if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
314 return 1; 325 return 1;
315 326
316 /* 327 /*
317 * If not a list, or if empty list, it's broken. 328 * If not a list, or if empty list, it's broken.
318 */ 329 */
319 if (choice->type != ASIdentifierChoice_asIdsOrRanges || 330 if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
320 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) 331 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
321 return 0; 332 return 0;
322 333
323 /* 334 /*
324 * It's a list, check it. 335 * It's a list, check it.
325 */ 336 */
326 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) { 337 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
327 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 338 ASIdOrRange *a =
328 ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1); 339 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
329 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max; 340 ASIdOrRange *b =
330 341 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
331 extract_min_max(a, &a_min, &a_max); 342 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
332 extract_min_max(b, &b_min, &b_max); 343
333 344 extract_min_max(a, &a_min, &a_max);
334 /* 345 extract_min_max(b, &b_min, &b_max);
335 * Punt misordered list, overlapping start, or inverted range. 346
336 */ 347 /*
337 if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 || 348 * Punt misordered list, overlapping start, or inverted range.
338 ASN1_INTEGER_cmp(a_min, a_max) > 0 || 349 */
339 ASN1_INTEGER_cmp(b_min, b_max) > 0) 350 if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
340 goto done; 351 ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
341 352 ASN1_INTEGER_cmp(b_min, b_max) > 0)
342 /* 353 goto done;
343 * Calculate a_max + 1 to check for adjacency. 354
344 */ 355 /*
345 if ((bn == NULL && (bn = BN_new()) == NULL) || 356 * Calculate a_max + 1 to check for adjacency.
346 ASN1_INTEGER_to_BN(a_max, bn) == NULL || 357 */
347 !BN_add_word(bn, 1) || 358 if ((bn == NULL && (bn = BN_new()) == NULL) ||
348 (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) { 359 ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
349 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL, 360 !BN_add_word(bn, 1) || (a_max_plus_one =
350 ERR_R_MALLOC_FAILURE); 361 BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
351 goto done; 362 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
352 } 363 ERR_R_MALLOC_FAILURE);
353 364 goto done;
354 /* 365 }
355 * Punt if adjacent or overlapping. 366
356 */ 367 /*
357 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0) 368 * Punt if adjacent or overlapping.
358 goto done; 369 */
359 } 370 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
360 371 goto done;
361 /* 372 }
362 * Check for inverted range. 373
363 */ 374 /*
364 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; 375 * Check for inverted range.
365 { 376 */
366 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 377 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
367 ASN1_INTEGER *a_min, *a_max; 378 {
368 if (a != NULL && a->type == ASIdOrRange_range) { 379 ASIdOrRange *a =
369 extract_min_max(a, &a_min, &a_max); 380 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
370 if (ASN1_INTEGER_cmp(a_min, a_max) > 0) 381 ASN1_INTEGER *a_min, *a_max;
371 goto done; 382
372 } 383 if (a != NULL && a->type == ASIdOrRange_range) {
373 } 384 extract_min_max(a, &a_min, &a_max);
374 385 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
375 ret = 1; 386 goto done;
376 387 }
377 done: 388 }
378 ASN1_INTEGER_free(a_max_plus_one); 389
379 BN_free(bn); 390 ret = 1;
380 return ret; 391
392done:
393 ASN1_INTEGER_free(a_max_plus_one);
394 BN_free(bn);
395 return ret;
381} 396}
382 397
383/* 398/*
384 * Check whether an ASIdentifier extension is in canonical form. 399 * Check whether an ASIdentifier extension is in canonical form.
385 */ 400 */
386int v3_asid_is_canonical(ASIdentifiers *asid) 401int
402v3_asid_is_canonical(ASIdentifiers *asid)
387{ 403{
388 return (asid == NULL || 404 return (asid == NULL ||
389 (ASIdentifierChoice_is_canonical(asid->asnum) && 405 (ASIdentifierChoice_is_canonical(asid->asnum) &&
390 ASIdentifierChoice_is_canonical(asid->rdi))); 406 ASIdentifierChoice_is_canonical(asid->rdi)));
391} 407}
392 408
393/* 409/*
394 * Whack an ASIdentifierChoice into canonical form. 410 * Whack an ASIdentifierChoice into canonical form.
395 */ 411 */
396static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice) 412static int
413ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
397{ 414{
398 ASN1_INTEGER *a_max_plus_one = NULL; 415 ASN1_INTEGER *a_max_plus_one = NULL;
399 BIGNUM *bn = NULL; 416 BIGNUM *bn = NULL;
400 int i, ret = 0; 417 int i, ret = 0;
401 418
402 /* 419 /*
403 * Nothing to do for empty element or inheritance. 420 * Nothing to do for empty element or inheritance.
404 */ 421 */
405 if (choice == NULL || choice->type == ASIdentifierChoice_inherit) 422 if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
406 return 1; 423 return 1;
407 424
408 /* 425 /*
409 * If not a list, or if empty list, it's broken. 426 * If not a list, or if empty list, it's broken.
410 */ 427 */
411 if (choice->type != ASIdentifierChoice_asIdsOrRanges || 428 if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
412 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) { 429 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
413 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, 430 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
414 X509V3_R_EXTENSION_VALUE_ERROR);
415 return 0;
416 }
417
418 /*
419 * We have a non-empty list. Sort it.
420 */
421 sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
422
423 /*
424 * Now check for errors and suboptimal encoding, rejecting the
425 * former and fixing the latter.
426 */
427 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
428 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
429 ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
430 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
431
432 extract_min_max(a, &a_min, &a_max);
433 extract_min_max(b, &b_min, &b_max);
434
435 /*
436 * Make sure we're properly sorted (paranoia).
437 */
438 OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
439
440 /*
441 * Punt inverted ranges.
442 */
443 if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
444 ASN1_INTEGER_cmp(b_min, b_max) > 0)
445 goto done;
446
447 /*
448 * Check for overlaps.
449 */
450 if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
451 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
452 X509V3_R_EXTENSION_VALUE_ERROR); 431 X509V3_R_EXTENSION_VALUE_ERROR);
453 goto done; 432 return 0;
454 } 433 }
455 434
456 /* 435 /*
457 * Calculate a_max + 1 to check for adjacency. 436 * We have a non-empty list. Sort it.
458 */ 437 */
459 if ((bn == NULL && (bn = BN_new()) == NULL) || 438 sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
460 ASN1_INTEGER_to_BN(a_max, bn) == NULL || 439
461 !BN_add_word(bn, 1) || 440 /*
462 (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) { 441 * Now check for errors and suboptimal encoding, rejecting the
463 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, ERR_R_MALLOC_FAILURE); 442 * former and fixing the latter.
464 goto done; 443 */
465 } 444 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
466 445 ASIdOrRange *a =
467 /* 446 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
468 * If a and b are adjacent, merge them. 447 ASIdOrRange *b =
469 */ 448 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
470 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) { 449 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
471 ASRange *r; 450
472 switch (a->type) { 451 extract_min_max(a, &a_min, &a_max);
473 case ASIdOrRange_id: 452 extract_min_max(b, &b_min, &b_max);
474 if ((r = malloc(sizeof(ASRange))) == NULL) { 453
475 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, 454 /*
476 ERR_R_MALLOC_FAILURE); 455 * Make sure we're properly sorted (paranoia).
477 goto done; 456 */
457 OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
458
459 /*
460 * Punt inverted ranges.
461 */
462 if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
463 ASN1_INTEGER_cmp(b_min, b_max) > 0)
464 goto done;
465
466 /*
467 * Check for overlaps.
468 */
469 if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
470 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
471 X509V3_R_EXTENSION_VALUE_ERROR);
472 goto done;
473 }
474
475 /*
476 * Calculate a_max + 1 to check for adjacency.
477 */
478 if ((bn == NULL && (bn = BN_new()) == NULL) ||
479 ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
480 !BN_add_word(bn, 1) || (a_max_plus_one =
481 BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
482 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
483 ERR_R_MALLOC_FAILURE);
484 goto done;
485 }
486
487 /*
488 * If a and b are adjacent, merge them.
489 */
490 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
491 ASRange *r;
492 switch (a->type) {
493 case ASIdOrRange_id:
494 if ((r = malloc(sizeof(ASRange))) == NULL) {
495 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
496 ERR_R_MALLOC_FAILURE);
497 goto done;
498 }
499 r->min = a_min;
500 r->max = b_max;
501 a->type = ASIdOrRange_range;
502 a->u.range = r;
503 break;
504 case ASIdOrRange_range:
505 ASN1_INTEGER_free(a->u.range->max);
506 a->u.range->max = b_max;
507 break;
508 }
509 switch (b->type) {
510 case ASIdOrRange_id:
511 b->u.id = NULL;
512 break;
513 case ASIdOrRange_range:
514 b->u.range->max = NULL;
515 break;
516 }
517 ASIdOrRange_free(b);
518 (void) sk_ASIdOrRange_delete(
519 choice->u.asIdsOrRanges, i + 1);
520 i--;
521 continue;
522 }
523 }
524
525 /*
526 * Check for final inverted range.
527 */
528 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
529 {
530 ASIdOrRange *a =
531 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
532 ASN1_INTEGER *a_min, *a_max;
533 if (a != NULL && a->type == ASIdOrRange_range) {
534 extract_min_max(a, &a_min, &a_max);
535 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
536 goto done;
537 }
478 } 538 }
479 r->min = a_min; 539
480 r->max = b_max; 540 OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
481 a->type = ASIdOrRange_range; 541
482 a->u.range = r; 542 ret = 1;
483 break; 543
484 case ASIdOrRange_range: 544done:
485 ASN1_INTEGER_free(a->u.range->max); 545 ASN1_INTEGER_free(a_max_plus_one);
486 a->u.range->max = b_max; 546 BN_free(bn);
487 break; 547 return ret;
488 }
489 switch (b->type) {
490 case ASIdOrRange_id:
491 b->u.id = NULL;
492 break;
493 case ASIdOrRange_range:
494 b->u.range->max = NULL;
495 break;
496 }
497 ASIdOrRange_free(b);
498 (void) sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
499 i--;
500 continue;
501 }
502 }
503
504 /*
505 * Check for final inverted range.
506 */
507 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
508 {
509 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
510 ASN1_INTEGER *a_min, *a_max;
511 if (a != NULL && a->type == ASIdOrRange_range) {
512 extract_min_max(a, &a_min, &a_max);
513 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
514 goto done;
515 }
516 }
517
518 OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
519
520 ret = 1;
521
522 done:
523 ASN1_INTEGER_free(a_max_plus_one);
524 BN_free(bn);
525 return ret;
526} 548}
527 549
528/* 550/*
529 * Whack an ASIdentifier extension into canonical form. 551 * Whack an ASIdentifier extension into canonical form.
530 */ 552 */
531int v3_asid_canonize(ASIdentifiers *asid) 553int
554v3_asid_canonize(ASIdentifiers *asid)
532{ 555{
533 return (asid == NULL || 556 return (asid == NULL ||
534 (ASIdentifierChoice_canonize(asid->asnum) && 557 (ASIdentifierChoice_canonize(asid->asnum) &&
535 ASIdentifierChoice_canonize(asid->rdi))); 558 ASIdentifierChoice_canonize(asid->rdi)));
536} 559}
537 560
538/* 561/*
539 * v2i method for an ASIdentifier extension. 562 * v2i method for an ASIdentifier extension.
540 */ 563 */
541static void *v2i_ASIdentifiers(const struct v3_ext_method *method, 564static void *
542 struct v3_ext_ctx *ctx, 565v2i_ASIdentifiers(const struct v3_ext_method *method, struct v3_ext_ctx *ctx,
543 STACK_OF(CONF_VALUE) *values) 566 STACK_OF(CONF_VALUE) *values)
544{ 567{
545 ASN1_INTEGER *min = NULL, *max = NULL; 568 ASN1_INTEGER *min = NULL, *max = NULL;
546 ASIdentifiers *asid = NULL; 569 ASIdentifiers *asid = NULL;
547 int i; 570 int i;
548 571
549 if ((asid = ASIdentifiers_new()) == NULL) { 572 if ((asid = ASIdentifiers_new()) == NULL) {
550 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 573 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
551 return NULL; 574 return NULL;
552 } 575 }
553 576
554 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 577 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
555 CONF_VALUE *val = sk_CONF_VALUE_value(values, i); 578 CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
556 int i1, i2, i3, is_range, which; 579 int i1, i2, i3, is_range, which;
557 580
558 /* 581 /*
559 * Figure out whether this is an AS or an RDI. 582 * Figure out whether this is an AS or an RDI.
560 */ 583 */
561 if ( !name_cmp(val->name, "AS")) { 584 if (!name_cmp(val->name, "AS")) {
562 which = V3_ASID_ASNUM; 585 which = V3_ASID_ASNUM;
563 } else if (!name_cmp(val->name, "RDI")) { 586 } else if (!name_cmp(val->name, "RDI")) {
564 which = V3_ASID_RDI; 587 which = V3_ASID_RDI;
565 } else { 588 } else {
566 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_NAME_ERROR); 589 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
567 X509V3_conf_err(val); 590 X509V3_R_EXTENSION_NAME_ERROR);
568 goto err; 591 X509V3_conf_err(val);
569 } 592 goto err;
570 593 }
571 /* 594
572 * Handle inheritance. 595 /*
573 */ 596 * Handle inheritance.
574 if (!strcmp(val->value, "inherit")) { 597 */
575 if (v3_asid_add_inherit(asid, which)) 598 if (!strcmp(val->value, "inherit")) {
576 continue; 599 if (v3_asid_add_inherit(asid, which))
577 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_INHERITANCE); 600 continue;
578 X509V3_conf_err(val); 601 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
579 goto err; 602 X509V3_R_INVALID_INHERITANCE);
580 } 603 X509V3_conf_err(val);
581 604 goto err;
582 /* 605 }
583 * Number, range, or mistake, pick it apart and figure out which. 606
584 */ 607 /*
585 i1 = strspn(val->value, "0123456789"); 608 * Number, range, or mistake, pick it apart and figure out which.
586 if (val->value[i1] == '\0') { 609 */
587 is_range = 0; 610 i1 = strspn(val->value, "0123456789");
588 } else { 611 if (val->value[i1] == '\0') {
589 is_range = 1; 612 is_range = 0;
590 i2 = i1 + strspn(val->value + i1, " \t"); 613 } else {
591 if (val->value[i2] != '-') { 614 is_range = 1;
592 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASNUMBER); 615 i2 = i1 + strspn(val->value + i1, " \t");
593 X509V3_conf_err(val); 616 if (val->value[i2] != '-') {
594 goto err; 617 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
595 } 618 X509V3_R_INVALID_ASNUMBER);
596 i2++; 619 X509V3_conf_err(val);
597 i2 = i2 + strspn(val->value + i2, " \t"); 620 goto err;
598 i3 = i2 + strspn(val->value + i2, "0123456789"); 621 }
599 if (val->value[i3] != '\0') { 622 i2++;
600 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASRANGE); 623 i2 = i2 + strspn(val->value + i2, " \t");
601 X509V3_conf_err(val); 624 i3 = i2 + strspn(val->value + i2, "0123456789");
602 goto err; 625 if (val->value[i3] != '\0') {
603 } 626 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
604 } 627 X509V3_R_INVALID_ASRANGE);
605 628 X509V3_conf_err(val);
606 /* 629 goto err;
607 * Syntax is ok, read and add it. 630 }
608 */ 631 }
609 if (!is_range) { 632
610 if (!X509V3_get_value_int(val, &min)) { 633 /*
611 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 634 * Syntax is ok, read and add it.
612 goto err; 635 */
613 } 636 if (!is_range) {
614 } else { 637 if (!X509V3_get_value_int(val, &min)) {
615 char *s = BUF_strdup(val->value); 638 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
616 if (s == NULL) { 639 ERR_R_MALLOC_FAILURE);
617 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 640 goto err;
618 goto err; 641 }
619 } 642 } else {
620 s[i1] = '\0'; 643 char *s = BUF_strdup(val->value);
621 min = s2i_ASN1_INTEGER(NULL, s); 644 if (s == NULL) {
622 max = s2i_ASN1_INTEGER(NULL, s + i2); 645 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
623 free(s); 646 ERR_R_MALLOC_FAILURE);
624 if (min == NULL || max == NULL) { 647 goto err;
625 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 648 }
626 goto err; 649 s[i1] = '\0';
627 } 650 min = s2i_ASN1_INTEGER(NULL, s);
628 if (ASN1_INTEGER_cmp(min, max) > 0) { 651 max = s2i_ASN1_INTEGER(NULL, s + i2);
629 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_VALUE_ERROR); 652 free(s);
630 goto err; 653 if (min == NULL || max == NULL) {
631 } 654 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
632 } 655 ERR_R_MALLOC_FAILURE);
633 if (!v3_asid_add_id_or_range(asid, which, min, max)) { 656 goto err;
634 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 657 }
635 goto err; 658 if (ASN1_INTEGER_cmp(min, max) > 0) {
636 } 659 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
637 min = max = NULL; 660 X509V3_R_EXTENSION_VALUE_ERROR);
638 } 661 goto err;
639 662 }
640 /* 663 }
641 * Canonize the result, then we're done. 664 if (!v3_asid_add_id_or_range(asid, which, min, max)) {
642 */ 665 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
643 if (!v3_asid_canonize(asid)) 666 ERR_R_MALLOC_FAILURE);
644 goto err; 667 goto err;
645 return asid; 668 }
646 669 min = max = NULL;
647 err: 670 }
648 ASIdentifiers_free(asid); 671
649 ASN1_INTEGER_free(min); 672 /*
650 ASN1_INTEGER_free(max); 673 * Canonize the result, then we're done.
651 return NULL; 674 */
675 if (!v3_asid_canonize(asid))
676 goto err;
677 return asid;
678
679err:
680 ASIdentifiers_free(asid);
681 ASN1_INTEGER_free(min);
682 ASN1_INTEGER_free(max);
683 return NULL;
652} 684}
653 685
654/* 686/*
655 * OpenSSL dispatch. 687 * OpenSSL dispatch.
656 */ 688 */
657const X509V3_EXT_METHOD v3_asid = { 689const X509V3_EXT_METHOD v3_asid = {
658 NID_sbgp_autonomousSysNum, /* nid */ 690 NID_sbgp_autonomousSysNum, /* nid */
659 0, /* flags */ 691 0, /* flags */
660 ASN1_ITEM_ref(ASIdentifiers), /* template */ 692 ASN1_ITEM_ref(ASIdentifiers), /* template */
661 0, 0, 0, 0, /* old functions, ignored */ 693 0, 0, 0, 0, /* old functions, ignored */
662 0, /* i2s */ 694 0, /* i2s */
663 0, /* s2i */ 695 0, /* s2i */
664 0, /* i2v */ 696 0, /* i2v */
665 v2i_ASIdentifiers, /* v2i */ 697 v2i_ASIdentifiers, /* v2i */
666 i2r_ASIdentifiers, /* i2r */ 698 i2r_ASIdentifiers, /* i2r */
667 0, /* r2i */ 699 0, /* r2i */
668 NULL /* extension-specific data */ 700 NULL /* extension-specific data */
669}; 701};
670 702
671/* 703/*
672 * Figure out whether extension uses inheritance. 704 * Figure out whether extension uses inheritance.
673 */ 705 */
674int v3_asid_inherits(ASIdentifiers *asid) 706int
707v3_asid_inherits(ASIdentifiers *asid)
675{ 708{
676 return (asid != NULL && 709 return (asid != NULL &&
677 ((asid->asnum != NULL && 710 ((asid->asnum != NULL &&
678 asid->asnum->type == ASIdentifierChoice_inherit) || 711 asid->asnum->type == ASIdentifierChoice_inherit) ||
679 (asid->rdi != NULL && 712 (asid->rdi != NULL &&
680 asid->rdi->type == ASIdentifierChoice_inherit))); 713 asid->rdi->type == ASIdentifierChoice_inherit)));
681} 714}
682 715
683/* 716/*
684 * Figure out whether parent contains child. 717 * Figure out whether parent contains child.
685 */ 718 */
686static int asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child) 719static int
720asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child)
687{ 721{
688 ASN1_INTEGER *p_min, *p_max, *c_min, *c_max; 722 ASN1_INTEGER *p_min, *p_max, *c_min, *c_max;
689 int p, c; 723 int p, c;
690 724
691 if (child == NULL || parent == child) 725 if (child == NULL || parent == child)
692 return 1; 726 return 1;
693 if (parent == NULL) 727 if (parent == NULL)
694 return 0; 728 return 0;
695 729
696 p = 0; 730 p = 0;
697 for (c = 0; c < sk_ASIdOrRange_num(child); c++) { 731 for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
698 extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max); 732 extract_min_max(sk_ASIdOrRange_value(child, c),
699 for (;; p++) { 733 &c_min, &c_max);
700 if (p >= sk_ASIdOrRange_num(parent)) 734 for (; ; p++) {
701 return 0; 735 if (p >= sk_ASIdOrRange_num(parent))
702 extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min, &p_max); 736 return 0;
703 if (ASN1_INTEGER_cmp(p_max, c_max) < 0) 737 extract_min_max(sk_ASIdOrRange_value(parent, p),
704 continue; 738 &p_min, &p_max);
705 if (ASN1_INTEGER_cmp(p_min, c_min) > 0) 739 if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
706 return 0; 740 continue;
707 break; 741 if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
708 } 742 return 0;
709 } 743 break;
744 }
745 }
710 746
711 return 1; 747 return 1;
712} 748}
713 749
714/* 750/*
715 * Test whether a is a subet of b. 751 * Test whether a is a subet of b.
716 */ 752 */
717int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b) 753int
754v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
718{ 755{
719 return (a == NULL || 756 return (a == NULL || a == b ||
720 a == b || 757 (b != NULL && !v3_asid_inherits(a) && !v3_asid_inherits(b) &&
721 (b != NULL && 758 asid_contains(b->asnum->u.asIdsOrRanges,
722 !v3_asid_inherits(a) && 759 a->asnum->u.asIdsOrRanges) &&
723 !v3_asid_inherits(b) && 760 asid_contains(b->rdi->u.asIdsOrRanges,
724 asid_contains(b->asnum->u.asIdsOrRanges, 761 a->rdi->u.asIdsOrRanges)));
725 a->asnum->u.asIdsOrRanges) &&
726 asid_contains(b->rdi->u.asIdsOrRanges,
727 a->rdi->u.asIdsOrRanges)));
728} 762}
729 763
730/* 764/*
@@ -747,117 +781,120 @@ int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
747/* 781/*
748 * Core code for RFC 3779 3.3 path validation. 782 * Core code for RFC 3779 3.3 path validation.
749 */ 783 */
750static int v3_asid_validate_path_internal(X509_STORE_CTX *ctx, 784static int
751 STACK_OF(X509) *chain, 785v3_asid_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
752 ASIdentifiers *ext) 786 ASIdentifiers *ext)
753{ 787{
754 ASIdOrRanges *child_as = NULL, *child_rdi = NULL; 788 ASIdOrRanges *child_as = NULL, *child_rdi = NULL;
755 int i, ret = 1, inherit_as = 0, inherit_rdi = 0; 789 int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
756 X509 *x; 790 X509 *x;
757 791
758 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0); 792 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
759 OPENSSL_assert(ctx != NULL || ext != NULL); 793 OPENSSL_assert(ctx != NULL || ext != NULL);
760 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL); 794 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
761 795
762 /* 796 /*
763 * Figure out where to start. If we don't have an extension to 797 * Figure out where to start. If we don't have an extension to
764 * check, we're done. Otherwise, check canonical form and 798 * check, we're done. Otherwise, check canonical form and
765 * set up for walking up the chain. 799 * set up for walking up the chain.
766 */ 800 */
767 if (ext != NULL) { 801 if (ext != NULL) {
768 i = -1; 802 i = -1;
769 x = NULL; 803 x = NULL;
770 } else { 804 } else {
771 i = 0; 805 i = 0;
772 x = sk_X509_value(chain, i); 806 x = sk_X509_value(chain, i);
773 OPENSSL_assert(x != NULL); 807 OPENSSL_assert(x != NULL);
774 if ((ext = x->rfc3779_asid) == NULL) 808 if ((ext = x->rfc3779_asid) == NULL)
775 goto done; 809 goto done;
776 } 810 }
777 if (!v3_asid_is_canonical(ext)) 811 if (!v3_asid_is_canonical(ext))
778 validation_err(X509_V_ERR_INVALID_EXTENSION); 812 validation_err(X509_V_ERR_INVALID_EXTENSION);
779 if (ext->asnum != NULL) { 813 if (ext->asnum != NULL) {
780 switch (ext->asnum->type) { 814 switch (ext->asnum->type) {
781 case ASIdentifierChoice_inherit: 815 case ASIdentifierChoice_inherit:
782 inherit_as = 1; 816 inherit_as = 1;
783 break; 817 break;
784 case ASIdentifierChoice_asIdsOrRanges: 818 case ASIdentifierChoice_asIdsOrRanges:
785 child_as = ext->asnum->u.asIdsOrRanges; 819 child_as = ext->asnum->u.asIdsOrRanges;
786 break; 820 break;
787 } 821 }
788 } 822 }
789 if (ext->rdi != NULL) { 823 if (ext->rdi != NULL) {
790 switch (ext->rdi->type) { 824 switch (ext->rdi->type) {
791 case ASIdentifierChoice_inherit: 825 case ASIdentifierChoice_inherit:
792 inherit_rdi = 1; 826 inherit_rdi = 1;
793 break; 827 break;
794 case ASIdentifierChoice_asIdsOrRanges: 828 case ASIdentifierChoice_asIdsOrRanges:
795 child_rdi = ext->rdi->u.asIdsOrRanges; 829 child_rdi = ext->rdi->u.asIdsOrRanges;
796 break; 830 break;
797 } 831 }
798 } 832 }
799 833
800 /* 834 /*
801 * Now walk up the chain. Extensions must be in canonical form, no 835 * Now walk up the chain. Extensions must be in canonical form, no
802 * cert may list resources that its parent doesn't list. 836 * cert may list resources that its parent doesn't list.
803 */ 837 */
804 for (i++; i < sk_X509_num(chain); i++) { 838 for (i++; i < sk_X509_num(chain); i++) {
805 x = sk_X509_value(chain, i); 839 x = sk_X509_value(chain, i);
806 OPENSSL_assert(x != NULL); 840 OPENSSL_assert(x != NULL);
807 if (x->rfc3779_asid == NULL) { 841 if (x->rfc3779_asid == NULL) {
808 if (child_as != NULL || child_rdi != NULL) 842 if (child_as != NULL || child_rdi != NULL)
809 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 843 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
810 continue; 844 continue;
811 } 845 }
812 if (!v3_asid_is_canonical(x->rfc3779_asid)) 846 if (!v3_asid_is_canonical(x->rfc3779_asid))
813 validation_err(X509_V_ERR_INVALID_EXTENSION); 847 validation_err(X509_V_ERR_INVALID_EXTENSION);
814 if (x->rfc3779_asid->asnum == NULL && child_as != NULL) { 848 if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
815 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 849 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
816 child_as = NULL; 850 child_as = NULL;
817 inherit_as = 0; 851 inherit_as = 0;
818 } 852 }
819 if (x->rfc3779_asid->asnum != NULL && 853 if (x->rfc3779_asid->asnum != NULL &&
820 x->rfc3779_asid->asnum->type == ASIdentifierChoice_asIdsOrRanges) { 854 x->rfc3779_asid->asnum->type ==
821 if (inherit_as || 855 ASIdentifierChoice_asIdsOrRanges) {
822 asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges, child_as)) { 856 if (inherit_as || asid_contains(
823 child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges; 857 x->rfc3779_asid->asnum->u.asIdsOrRanges,
824 inherit_as = 0; 858 child_as)) {
825 } else { 859 child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
826 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 860 inherit_as = 0;
827 } 861 } else {
828 } 862 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
829 if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) { 863 }
830 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 864 }
831 child_rdi = NULL; 865 if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
832 inherit_rdi = 0; 866 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
833 } 867 child_rdi = NULL;
834 if (x->rfc3779_asid->rdi != NULL && 868 inherit_rdi = 0;
835 x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) { 869 }
836 if (inherit_rdi || 870 if (x->rfc3779_asid->rdi != NULL &&
837 asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges, child_rdi)) { 871 x->rfc3779_asid->rdi->type ==
838 child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges; 872 ASIdentifierChoice_asIdsOrRanges) {
839 inherit_rdi = 0; 873 if (inherit_rdi || asid_contains(
840 } else { 874 x->rfc3779_asid->rdi->u.asIdsOrRanges, child_rdi)) {
841 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 875 child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
842 } 876 inherit_rdi = 0;
843 } 877 } else {
844 } 878 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
845 879 }
846 /* 880 }
847 * Trust anchor can't inherit. 881 }
848 */ 882
849 OPENSSL_assert(x != NULL); 883 /*
850 if (x->rfc3779_asid != NULL) { 884 * Trust anchor can't inherit.
851 if (x->rfc3779_asid->asnum != NULL && 885 */
852 x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit) 886 OPENSSL_assert(x != NULL);
853 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 887 if (x->rfc3779_asid != NULL) {
854 if (x->rfc3779_asid->rdi != NULL && 888 if (x->rfc3779_asid->asnum != NULL &&
855 x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit) 889 x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
856 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 890 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
857 } 891 if (x->rfc3779_asid->rdi != NULL &&
858 892 x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
859 done: 893 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
860 return ret; 894 }
895
896done:
897 return ret;
861} 898}
862 899
863#undef validation_err 900#undef validation_err
@@ -865,26 +902,27 @@ static int v3_asid_validate_path_internal(X509_STORE_CTX *ctx,
865/* 902/*
866 * RFC 3779 3.3 path validation -- called from X509_verify_cert(). 903 * RFC 3779 3.3 path validation -- called from X509_verify_cert().
867 */ 904 */
868int v3_asid_validate_path(X509_STORE_CTX *ctx) 905int
906v3_asid_validate_path(X509_STORE_CTX *ctx)
869{ 907{
870 return v3_asid_validate_path_internal(ctx, ctx->chain, NULL); 908 return v3_asid_validate_path_internal(ctx, ctx->chain, NULL);
871} 909}
872 910
873/* 911/*
874 * RFC 3779 3.3 path validation of an extension. 912 * RFC 3779 3.3 path validation of an extension.
875 * Test whether chain covers extension. 913 * Test whether chain covers extension.
876 */ 914 */
877int v3_asid_validate_resource_set(STACK_OF(X509) *chain, 915int
878 ASIdentifiers *ext, 916v3_asid_validate_resource_set(STACK_OF(X509) *chain, ASIdentifiers *ext,
879 int allow_inheritance) 917 int allow_inheritance)
880{ 918{
881 if (ext == NULL) 919 if (ext == NULL)
882 return 1; 920 return 1;
883 if (chain == NULL || sk_X509_num(chain) == 0) 921 if (chain == NULL || sk_X509_num(chain) == 0)
884 return 0; 922 return 0;
885 if (!allow_inheritance && v3_asid_inherits(ext)) 923 if (!allow_inheritance && v3_asid_inherits(ext))
886 return 0; 924 return 0;
887 return v3_asid_validate_path_internal(NULL, chain, ext); 925 return v3_asid_validate_path_internal(NULL, chain, ext);
888} 926}
889 927
890#endif /* OPENSSL_NO_RFC3779 */ 928#endif /* OPENSSL_NO_RFC3779 */
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_addr.c b/src/lib/libssl/src/crypto/x509v3/v3_addr.c
index 179f08d222..084209f5a1 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_addr.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_addr.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -76,28 +76,28 @@
76 */ 76 */
77 77
78ASN1_SEQUENCE(IPAddressRange) = { 78ASN1_SEQUENCE(IPAddressRange) = {
79 ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING), 79 ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
80 ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING) 80 ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
81} ASN1_SEQUENCE_END(IPAddressRange) 81} ASN1_SEQUENCE_END(IPAddressRange)
82 82
83ASN1_CHOICE(IPAddressOrRange) = { 83ASN1_CHOICE(IPAddressOrRange) = {
84 ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING), 84 ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
85 ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange) 85 ASN1_SIMPLE(IPAddressOrRange, u.addressRange, IPAddressRange)
86} ASN1_CHOICE_END(IPAddressOrRange) 86} ASN1_CHOICE_END(IPAddressOrRange)
87 87
88ASN1_CHOICE(IPAddressChoice) = { 88ASN1_CHOICE(IPAddressChoice) = {
89 ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL), 89 ASN1_SIMPLE(IPAddressChoice, u.inherit, ASN1_NULL),
90 ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange) 90 ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
91} ASN1_CHOICE_END(IPAddressChoice) 91} ASN1_CHOICE_END(IPAddressChoice)
92 92
93ASN1_SEQUENCE(IPAddressFamily) = { 93ASN1_SEQUENCE(IPAddressFamily) = {
94 ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING), 94 ASN1_SIMPLE(IPAddressFamily, addressFamily, ASN1_OCTET_STRING),
95 ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice) 95 ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
96} ASN1_SEQUENCE_END(IPAddressFamily) 96} ASN1_SEQUENCE_END(IPAddressFamily)
97 97
98ASN1_ITEM_TEMPLATE(IPAddrBlocks) = 98ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
99 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, 99 ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
100 IPAddrBlocks, IPAddressFamily) 100 IPAddrBlocks, IPAddressFamily)
101ASN1_ITEM_TEMPLATE_END(IPAddrBlocks) 101ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
102 102
103IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange) 103IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
@@ -113,54 +113,53 @@ IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
113/* 113/*
114 * What's the address length associated with this AFI? 114 * What's the address length associated with this AFI?
115 */ 115 */
116static int length_from_afi(const unsigned afi) 116static int
117length_from_afi(const unsigned afi)
117{ 118{
118 switch (afi) { 119 switch (afi) {
119 case IANA_AFI_IPV4: 120 case IANA_AFI_IPV4:
120 return 4; 121 return 4;
121 case IANA_AFI_IPV6: 122 case IANA_AFI_IPV6:
122 return 16; 123 return 16;
123 default: 124 default:
124 return 0; 125 return 0;
125 } 126 }
126} 127}
127 128
128/* 129/*
129 * Extract the AFI from an IPAddressFamily. 130 * Extract the AFI from an IPAddressFamily.
130 */ 131 */
131unsigned int v3_addr_get_afi(const IPAddressFamily *f) 132unsigned int
133v3_addr_get_afi(const IPAddressFamily *f)
132{ 134{
133 return ((f != NULL && 135 return ((f != NULL && f->addressFamily != NULL &&
134 f->addressFamily != NULL && 136 f->addressFamily->data != NULL) ?
135 f->addressFamily->data != NULL) 137 ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1])) :
136 ? ((f->addressFamily->data[0] << 8) | 138 0);
137 (f->addressFamily->data[1]))
138 : 0);
139} 139}
140 140
141/* 141/*
142 * Expand the bitstring form of an address into a raw byte array. 142 * Expand the bitstring form of an address into a raw byte array.
143 * At the moment this is coded for simplicity, not speed. 143 * At the moment this is coded for simplicity, not speed.
144 */ 144 */
145static int addr_expand(unsigned char *addr, 145static int
146 const ASN1_BIT_STRING *bs, 146addr_expand(unsigned char *addr, const ASN1_BIT_STRING *bs, const int length,
147 const int length, 147 const unsigned char fill)
148 const unsigned char fill)
149{ 148{
150 if (bs->length < 0 || bs->length > length) 149 if (bs->length < 0 || bs->length > length)
151 return 0; 150 return 0;
152 if (bs->length > 0) { 151 if (bs->length > 0) {
153 memcpy(addr, bs->data, bs->length); 152 memcpy(addr, bs->data, bs->length);
154 if ((bs->flags & 7) != 0) { 153 if ((bs->flags & 7) != 0) {
155 unsigned char mask = 0xFF >> (8 - (bs->flags & 7)); 154 unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
156 if (fill == 0) 155 if (fill == 0)
157 addr[bs->length - 1] &= ~mask; 156 addr[bs->length - 1] &= ~mask;
158 else 157 else
159 addr[bs->length - 1] |= mask; 158 addr[bs->length - 1] |= mask;
160 } 159 }
161 } 160 }
162 memset(addr + bs->length, fill, length - bs->length); 161 memset(addr + bs->length, fill, length - bs->length);
163 return 1; 162 return 1;
164} 163}
165 164
166/* 165/*
@@ -171,145 +170,150 @@ static int addr_expand(unsigned char *addr,
171/* 170/*
172 * i2r handler for one address bitstring. 171 * i2r handler for one address bitstring.
173 */ 172 */
174static int i2r_address(BIO *out, 173static int
175 const unsigned afi, 174i2r_address(BIO *out, const unsigned afi, const unsigned char fill,
176 const unsigned char fill, 175 const ASN1_BIT_STRING *bs)
177 const ASN1_BIT_STRING *bs)
178{ 176{
179 unsigned char addr[ADDR_RAW_BUF_LEN]; 177 unsigned char addr[ADDR_RAW_BUF_LEN];
180 int i, n; 178 int i, n;
181 179
182 if (bs->length < 0) 180 if (bs->length < 0)
183 return 0; 181 return 0;
184 switch (afi) { 182 switch (afi) {
185 case IANA_AFI_IPV4: 183 case IANA_AFI_IPV4:
186 if (!addr_expand(addr, bs, 4, fill)) 184 if (!addr_expand(addr, bs, 4, fill))
187 return 0; 185 return 0;
188 BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]); 186 BIO_printf(out, "%d.%d.%d.%d",
189 break; 187 addr[0], addr[1], addr[2], addr[3]);
190 case IANA_AFI_IPV6: 188 break;
191 if (!addr_expand(addr, bs, 16, fill)) 189 case IANA_AFI_IPV6:
192 return 0; 190 if (!addr_expand(addr, bs, 16, fill))
193 for (n = 16; n > 1 && addr[n-1] == 0x00 && addr[n-2] == 0x00; n -= 2) 191 return 0;
194 ; 192 for (n = 16;
195 for (i = 0; i < n; i += 2) 193 n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00; n -= 2)
196 BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i+1], (i < 14 ? ":" : "")); 194 ;
197 if (i < 16) 195 for (i = 0; i < n; i += 2)
198 BIO_puts(out, ":"); 196 BIO_printf(out, "%x%s",
199 if (i == 0) 197 (addr[i] << 8) | addr[i + 1], (i < 14 ? ":" : ""));
200 BIO_puts(out, ":"); 198 if (i < 16)
201 break; 199 BIO_puts(out, ":");
202 default: 200 if (i == 0)
203 for (i = 0; i < bs->length; i++) 201 BIO_puts(out, ":");
204 BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]); 202 break;
205 BIO_printf(out, "[%d]", (int) (bs->flags & 7)); 203 default:
206 break; 204 for (i = 0; i < bs->length; i++)
207 } 205 BIO_printf(out, "%s%02x",
208 return 1; 206 (i > 0 ? ":" : ""), bs->data[i]);
207 BIO_printf(out, "[%d]", (int)(bs->flags & 7));
208 break;
209 }
210 return 1;
209} 211}
210 212
211/* 213/*
212 * i2r handler for a sequence of addresses and ranges. 214 * i2r handler for a sequence of addresses and ranges.
213 */ 215 */
214static int i2r_IPAddressOrRanges(BIO *out, 216static int
215 const int indent, 217i2r_IPAddressOrRanges(BIO *out, const int indent, const IPAddressOrRanges *aors,
216 const IPAddressOrRanges *aors, 218 const unsigned afi)
217 const unsigned afi)
218{ 219{
219 int i; 220 int i;
220 for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) { 221
221 const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i); 222 for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
222 BIO_printf(out, "%*s", indent, ""); 223 const IPAddressOrRange *aor =
223 switch (aor->type) { 224 sk_IPAddressOrRange_value(aors, i);
224 case IPAddressOrRange_addressPrefix: 225 BIO_printf(out, "%*s", indent, "");
225 if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix)) 226 switch (aor->type) {
226 return 0; 227 case IPAddressOrRange_addressPrefix:
227 BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix)); 228 if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
228 continue; 229 return 0;
229 case IPAddressOrRange_addressRange: 230 BIO_printf(out, "/%d\n",
230 if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min)) 231 addr_prefixlen(aor->u.addressPrefix));
231 return 0; 232 continue;
232 BIO_puts(out, "-"); 233 case IPAddressOrRange_addressRange:
233 if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max)) 234 if (!i2r_address(out, afi, 0x00,
234 return 0; 235 aor->u.addressRange->min))
235 BIO_puts(out, "\n"); 236 return 0;
236 continue; 237 BIO_puts(out, "-");
237 } 238 if (!i2r_address(out, afi, 0xFF,
238 } 239 aor->u.addressRange->max))
239 return 1; 240 return 0;
241 BIO_puts(out, "\n");
242 continue;
243 }
244 }
245 return 1;
240} 246}
241 247
242/* 248/*
243 * i2r handler for an IPAddrBlocks extension. 249 * i2r handler for an IPAddrBlocks extension.
244 */ 250 */
245static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, 251static int
246 void *ext, 252i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, void *ext, BIO *out,
247 BIO *out, 253 int indent)
248 int indent)
249{ 254{
250 const IPAddrBlocks *addr = ext; 255 const IPAddrBlocks *addr = ext;
251 int i; 256 int i;
252 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 257
253 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 258 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
254 const unsigned int afi = v3_addr_get_afi(f); 259 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
255 switch (afi) { 260 const unsigned int afi = v3_addr_get_afi(f);
256 case IANA_AFI_IPV4: 261 switch (afi) {
257 BIO_printf(out, "%*sIPv4", indent, ""); 262 case IANA_AFI_IPV4:
258 break; 263 BIO_printf(out, "%*sIPv4", indent, "");
259 case IANA_AFI_IPV6: 264 break;
260 BIO_printf(out, "%*sIPv6", indent, ""); 265 case IANA_AFI_IPV6:
261 break; 266 BIO_printf(out, "%*sIPv6", indent, "");
262 default: 267 break;
263 BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi); 268 default:
264 break; 269 BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
265 } 270 break;
266 if (f->addressFamily->length > 2) { 271 }
267 switch (f->addressFamily->data[2]) { 272 if (f->addressFamily->length > 2) {
268 case 1: 273 switch (f->addressFamily->data[2]) {
269 BIO_puts(out, " (Unicast)"); 274 case 1:
270 break; 275 BIO_puts(out, " (Unicast)");
271 case 2: 276 break;
272 BIO_puts(out, " (Multicast)"); 277 case 2:
273 break; 278 BIO_puts(out, " (Multicast)");
274 case 3: 279 break;
275 BIO_puts(out, " (Unicast/Multicast)"); 280 case 3:
276 break; 281 BIO_puts(out, " (Unicast/Multicast)");
277 case 4: 282 break;
278 BIO_puts(out, " (MPLS)"); 283 case 4:
279 break; 284 BIO_puts(out, " (MPLS)");
280 case 64: 285 break;
281 BIO_puts(out, " (Tunnel)"); 286 case 64:
282 break; 287 BIO_puts(out, " (Tunnel)");
283 case 65: 288 break;
284 BIO_puts(out, " (VPLS)"); 289 case 65:
285 break; 290 BIO_puts(out, " (VPLS)");
286 case 66: 291 break;
287 BIO_puts(out, " (BGP MDT)"); 292 case 66:
288 break; 293 BIO_puts(out, " (BGP MDT)");
289 case 128: 294 break;
290 BIO_puts(out, " (MPLS-labeled VPN)"); 295 case 128:
291 break; 296 BIO_puts(out, " (MPLS-labeled VPN)");
292 default: 297 break;
293 BIO_printf(out, " (Unknown SAFI %u)", 298 default:
294 (unsigned) f->addressFamily->data[2]); 299 BIO_printf(out, " (Unknown SAFI %u)",
295 break; 300 (unsigned)f->addressFamily->data[2]);
296 } 301 break;
297 } 302 }
298 switch (f->ipAddressChoice->type) { 303 }
299 case IPAddressChoice_inherit: 304 switch (f->ipAddressChoice->type) {
300 BIO_puts(out, ": inherit\n"); 305 case IPAddressChoice_inherit:
301 break; 306 BIO_puts(out, ": inherit\n");
302 case IPAddressChoice_addressesOrRanges: 307 break;
303 BIO_puts(out, ":\n"); 308 case IPAddressChoice_addressesOrRanges:
304 if (!i2r_IPAddressOrRanges(out, 309 BIO_puts(out, ":\n");
305 indent + 2, 310 if (!i2r_IPAddressOrRanges(out, indent + 2,
306 f->ipAddressChoice->u.addressesOrRanges, 311 f->ipAddressChoice->u.addressesOrRanges, afi))
307 afi)) 312 return 0;
308 return 0; 313 break;
309 break; 314 }
310 } 315 }
311 } 316 return 1;
312 return 1;
313} 317}
314 318
315/* 319/*
@@ -322,134 +326,151 @@ static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
322 * function returns -1. If this messes up your preferred sort order 326 * function returns -1. If this messes up your preferred sort order
323 * for garbage input, tough noogies. 327 * for garbage input, tough noogies.
324 */ 328 */
325static int IPAddressOrRange_cmp(const IPAddressOrRange *a, 329static int
326 const IPAddressOrRange *b, 330IPAddressOrRange_cmp(const IPAddressOrRange *a, const IPAddressOrRange *b,
327 const int length) 331 const int length)
328{ 332{
329 unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN]; 333 unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
330 int prefixlen_a = 0, prefixlen_b = 0; 334 int prefixlen_a = 0, prefixlen_b = 0;
331 int r; 335 int r;
332 336
333 switch (a->type) { 337 switch (a->type) {
334 case IPAddressOrRange_addressPrefix: 338 case IPAddressOrRange_addressPrefix:
335 if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00)) 339 if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00))
336 return -1; 340 return -1;
337 prefixlen_a = addr_prefixlen(a->u.addressPrefix); 341 prefixlen_a = addr_prefixlen(a->u.addressPrefix);
338 break; 342 break;
339 case IPAddressOrRange_addressRange: 343 case IPAddressOrRange_addressRange:
340 if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00)) 344 if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00))
341 return -1; 345 return -1;
342 prefixlen_a = length * 8; 346 prefixlen_a = length * 8;
343 break; 347 break;
344 } 348 }
345 349
346 switch (b->type) { 350 switch (b->type) {
347 case IPAddressOrRange_addressPrefix: 351 case IPAddressOrRange_addressPrefix:
348 if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00)) 352 if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00))
349 return -1; 353 return -1;
350 prefixlen_b = addr_prefixlen(b->u.addressPrefix); 354 prefixlen_b = addr_prefixlen(b->u.addressPrefix);
351 break; 355 break;
352 case IPAddressOrRange_addressRange: 356 case IPAddressOrRange_addressRange:
353 if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00)) 357 if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00))
354 return -1; 358 return -1;
355 prefixlen_b = length * 8; 359 prefixlen_b = length * 8;
356 break; 360 break;
357 } 361 }
358 362
359 if ((r = memcmp(addr_a, addr_b, length)) != 0) 363 if ((r = memcmp(addr_a, addr_b, length)) != 0)
360 return r; 364 return r;
361 else 365 else
362 return prefixlen_a - prefixlen_b; 366 return prefixlen_a - prefixlen_b;
363} 367}
364 368
365/* 369/*
366 * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort() 370 * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
367 * comparision routines are only allowed two arguments. 371 * comparision routines are only allowed two arguments.
368 */ 372 */
369static int v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a, 373static int
370 const IPAddressOrRange * const *b) 374v4IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
375 const IPAddressOrRange * const *b)
371{ 376{
372 return IPAddressOrRange_cmp(*a, *b, 4); 377 return IPAddressOrRange_cmp(*a, *b, 4);
373} 378}
374 379
375/* 380/*
376 * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort() 381 * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
377 * comparision routines are only allowed two arguments. 382 * comparision routines are only allowed two arguments.
378 */ 383 */
379static int v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a, 384static int
380 const IPAddressOrRange * const *b) 385v6IPAddressOrRange_cmp(const IPAddressOrRange * const *a,
386 const IPAddressOrRange * const *b)
381{ 387{
382 return IPAddressOrRange_cmp(*a, *b, 16); 388 return IPAddressOrRange_cmp(*a, *b, 16);
383} 389}
384 390
385/* 391/*
386 * Calculate whether a range collapses to a prefix. 392 * Calculate whether a range collapses to a prefix.
387 * See last paragraph of RFC 3779 2.2.3.7. 393 * See last paragraph of RFC 3779 2.2.3.7.
388 */ 394 */
389static int range_should_be_prefix(const unsigned char *min, 395static int
390 const unsigned char *max, 396range_should_be_prefix(const unsigned char *min, const unsigned char *max,
391 const int length) 397 const int length)
392{ 398{
393 unsigned char mask; 399 unsigned char mask;
394 int i, j; 400 int i, j;
395 401
396 OPENSSL_assert(memcmp(min, max, length) <= 0); 402 OPENSSL_assert(memcmp(min, max, length) <= 0);
397 for (i = 0; i < length && min[i] == max[i]; i++) 403 for (i = 0; i < length && min[i] == max[i]; i++)
398 ; 404 ;
399 for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) 405 for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--)
400 ; 406 ;
401 if (i < j) 407 if (i < j)
402 return -1; 408 return -1;
403 if (i > j) 409 if (i > j)
404 return i * 8; 410 return i * 8;
405 mask = min[i] ^ max[i]; 411 mask = min[i] ^ max[i];
406 switch (mask) { 412 switch (mask) {
407 case 0x01: j = 7; break; 413 case 0x01:
408 case 0x03: j = 6; break; 414 j = 7;
409 case 0x07: j = 5; break; 415 break;
410 case 0x0F: j = 4; break; 416 case 0x03:
411 case 0x1F: j = 3; break; 417 j = 6;
412 case 0x3F: j = 2; break; 418 break;
413 case 0x7F: j = 1; break; 419 case 0x07:
414 default: return -1; 420 j = 5;
415 } 421 break;
416 if ((min[i] & mask) != 0 || (max[i] & mask) != mask) 422 case 0x0F:
417 return -1; 423 j = 4;
418 else 424 break;
419 return i * 8 + j; 425 case 0x1F:
426 j = 3;
427 break;
428 case 0x3F:
429 j = 2;
430 break;
431 case 0x7F:
432 j = 1;
433 break;
434 default:
435 return -1;
436 }
437 if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
438 return -1;
439 else
440 return i * 8 + j;
420} 441}
421 442
422/* 443/*
423 * Construct a prefix. 444 * Construct a prefix.
424 */ 445 */
425static int make_addressPrefix(IPAddressOrRange **result, 446static int
426 unsigned char *addr, 447make_addressPrefix(IPAddressOrRange **result, unsigned char *addr,
427 const int prefixlen) 448 const int prefixlen)
428{ 449{
429 int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8; 450 int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
430 IPAddressOrRange *aor = IPAddressOrRange_new(); 451 IPAddressOrRange *aor = IPAddressOrRange_new();
431 452
432 if (aor == NULL) 453 if (aor == NULL)
433 return 0; 454 return 0;
434 aor->type = IPAddressOrRange_addressPrefix; 455 aor->type = IPAddressOrRange_addressPrefix;
435 if (aor->u.addressPrefix == NULL && 456 if (aor->u.addressPrefix == NULL &&
436 (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL) 457 (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
437 goto err; 458 goto err;
438 if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen)) 459 if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
439 goto err; 460 goto err;
440 aor->u.addressPrefix->flags &= ~7; 461 aor->u.addressPrefix->flags &= ~7;
441 aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT; 462 aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
442 if (bitlen > 0) { 463 if (bitlen > 0) {
443 aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen); 464 aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
444 aor->u.addressPrefix->flags |= 8 - bitlen; 465 aor->u.addressPrefix->flags |= 8 - bitlen;
445 } 466 }
446 467
447 *result = aor; 468 *result = aor;
448 return 1; 469 return 1;
449 470
450 err: 471err:
451 IPAddressOrRange_free(aor); 472 IPAddressOrRange_free(aor);
452 return 0; 473 return 0;
453} 474}
454 475
455/* 476/*
@@ -457,252 +478,251 @@ static int make_addressPrefix(IPAddressOrRange **result,
457 * return a prefix instead. Doing this here simplifies 478 * return a prefix instead. Doing this here simplifies
458 * the rest of the code considerably. 479 * the rest of the code considerably.
459 */ 480 */
460static int make_addressRange(IPAddressOrRange **result, 481static int
461 unsigned char *min, 482make_addressRange(IPAddressOrRange **result, unsigned char *min,
462 unsigned char *max, 483 unsigned char *max, const int length)
463 const int length)
464{ 484{
465 IPAddressOrRange *aor; 485 IPAddressOrRange *aor;
466 int i, prefixlen; 486 int i, prefixlen;
467 487
468 if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0) 488 if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
469 return make_addressPrefix(result, min, prefixlen); 489 return make_addressPrefix(result, min, prefixlen);
470 490
471 if ((aor = IPAddressOrRange_new()) == NULL) 491 if ((aor = IPAddressOrRange_new()) == NULL)
472 return 0; 492 return 0;
473 aor->type = IPAddressOrRange_addressRange; 493 aor->type = IPAddressOrRange_addressRange;
474 OPENSSL_assert(aor->u.addressRange == NULL); 494 OPENSSL_assert(aor->u.addressRange == NULL);
475 if ((aor->u.addressRange = IPAddressRange_new()) == NULL) 495 if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
476 goto err; 496 goto err;
477 if (aor->u.addressRange->min == NULL && 497 if (aor->u.addressRange->min == NULL &&
478 (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL) 498 (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
479 goto err; 499 goto err;
480 if (aor->u.addressRange->max == NULL && 500 if (aor->u.addressRange->max == NULL &&
481 (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL) 501 (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
482 goto err; 502 goto err;
483 503
484 for (i = length; i > 0 && min[i - 1] == 0x00; --i) 504 for (i = length; i > 0 && min[i - 1] == 0x00; --i)
485 ; 505 ;
486 if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i)) 506 if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
487 goto err; 507 goto err;
488 aor->u.addressRange->min->flags &= ~7; 508 aor->u.addressRange->min->flags &= ~7;
489 aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT; 509 aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
490 if (i > 0) { 510 if (i > 0) {
491 unsigned char b = min[i - 1]; 511 unsigned char b = min[i - 1];
492 int j = 1; 512 int j = 1;
493 while ((b & (0xFFU >> j)) != 0) 513 while ((b & (0xFFU >> j)) != 0)
494 ++j; 514 ++j;
495 aor->u.addressRange->min->flags |= 8 - j; 515 aor->u.addressRange->min->flags |= 8 - j;
496 } 516 }
497 517
498 for (i = length; i > 0 && max[i - 1] == 0xFF; --i) 518 for (i = length; i > 0 && max[i - 1] == 0xFF; --i)
499 ; 519 ;
500 if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i)) 520 if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
501 goto err; 521 goto err;
502 aor->u.addressRange->max->flags &= ~7; 522 aor->u.addressRange->max->flags &= ~7;
503 aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT; 523 aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
504 if (i > 0) { 524 if (i > 0) {
505 unsigned char b = max[i - 1]; 525 unsigned char b = max[i - 1];
506 int j = 1; 526 int j = 1;
507 while ((b & (0xFFU >> j)) != (0xFFU >> j)) 527 while ((b & (0xFFU >> j)) != (0xFFU >> j))
508 ++j; 528 ++j;
509 aor->u.addressRange->max->flags |= 8 - j; 529 aor->u.addressRange->max->flags |= 8 - j;
510 } 530 }
511 531
512 *result = aor; 532 *result = aor;
513 return 1; 533 return 1;
514 534
515 err: 535err:
516 IPAddressOrRange_free(aor); 536 IPAddressOrRange_free(aor);
517 return 0; 537 return 0;
518} 538}
519 539
520/* 540/*
521 * Construct a new address family or find an existing one. 541 * Construct a new address family or find an existing one.
522 */ 542 */
523static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr, 543static IPAddressFamily *
524 const unsigned afi, 544make_IPAddressFamily(IPAddrBlocks *addr, const unsigned afi,
525 const unsigned *safi) 545 const unsigned *safi)
526{ 546{
527 IPAddressFamily *f; 547 IPAddressFamily *f;
528 unsigned char key[3]; 548 unsigned char key[3];
529 unsigned keylen; 549 unsigned keylen;
530 int i; 550 int i;
531 551
532 key[0] = (afi >> 8) & 0xFF; 552 key[0] = (afi >> 8) & 0xFF;
533 key[1] = afi & 0xFF; 553 key[1] = afi & 0xFF;
534 if (safi != NULL) { 554 if (safi != NULL) {
535 key[2] = *safi & 0xFF; 555 key[2] = *safi & 0xFF;
536 keylen = 3; 556 keylen = 3;
537 } else { 557 } else {
538 keylen = 2; 558 keylen = 2;
539 } 559 }
540 560
541 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 561 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
542 f = sk_IPAddressFamily_value(addr, i); 562 f = sk_IPAddressFamily_value(addr, i);
543 OPENSSL_assert(f->addressFamily->data != NULL); 563 OPENSSL_assert(f->addressFamily->data != NULL);
544 if (f->addressFamily->length == keylen && 564 if (f->addressFamily->length == keylen &&
545 !memcmp(f->addressFamily->data, key, keylen)) 565 !memcmp(f->addressFamily->data, key, keylen))
546 return f; 566 return f;
547 } 567 }
548 568
549 if ((f = IPAddressFamily_new()) == NULL) 569 if ((f = IPAddressFamily_new()) == NULL)
550 goto err; 570 goto err;
551 if (f->ipAddressChoice == NULL && 571 if (f->ipAddressChoice == NULL &&
552 (f->ipAddressChoice = IPAddressChoice_new()) == NULL) 572 (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
553 goto err; 573 goto err;
554 if (f->addressFamily == NULL && 574 if (f->addressFamily == NULL &&
555 (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL) 575 (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
556 goto err; 576 goto err;
557 if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen)) 577 if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
558 goto err; 578 goto err;
559 if (!sk_IPAddressFamily_push(addr, f)) 579 if (!sk_IPAddressFamily_push(addr, f))
560 goto err; 580 goto err;
561 581
562 return f; 582 return f;
563 583
564 err: 584err:
565 IPAddressFamily_free(f); 585 IPAddressFamily_free(f);
566 return NULL; 586 return NULL;
567} 587}
568 588
569/* 589/*
570 * Add an inheritance element. 590 * Add an inheritance element.
571 */ 591 */
572int v3_addr_add_inherit(IPAddrBlocks *addr, 592int
573 const unsigned afi, 593v3_addr_add_inherit(IPAddrBlocks *addr, const unsigned afi,
574 const unsigned *safi) 594 const unsigned *safi)
575{ 595{
576 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi); 596 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
577 if (f == NULL || 597
578 f->ipAddressChoice == NULL || 598 if (f == NULL ||
579 (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges && 599 f->ipAddressChoice == NULL ||
580 f->ipAddressChoice->u.addressesOrRanges != NULL)) 600 (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
581 return 0; 601 f->ipAddressChoice->u.addressesOrRanges != NULL))
582 if (f->ipAddressChoice->type == IPAddressChoice_inherit && 602 return 0;
583 f->ipAddressChoice->u.inherit != NULL) 603 if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
584 return 1; 604 f->ipAddressChoice->u.inherit != NULL)
585 if (f->ipAddressChoice->u.inherit == NULL && 605 return 1;
586 (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL) 606 if (f->ipAddressChoice->u.inherit == NULL &&
587 return 0; 607 (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
588 f->ipAddressChoice->type = IPAddressChoice_inherit; 608 return 0;
589 return 1; 609 f->ipAddressChoice->type = IPAddressChoice_inherit;
610 return 1;
590} 611}
591 612
592/* 613/*
593 * Construct an IPAddressOrRange sequence, or return an existing one. 614 * Construct an IPAddressOrRange sequence, or return an existing one.
594 */ 615 */
595static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr, 616static IPAddressOrRanges *
596 const unsigned afi, 617make_prefix_or_range(IPAddrBlocks *addr, const unsigned afi,
597 const unsigned *safi) 618 const unsigned *safi)
598{ 619{
599 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi); 620 IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
600 IPAddressOrRanges *aors = NULL; 621 IPAddressOrRanges *aors = NULL;
601 622
602 if (f == NULL || 623 if (f == NULL ||
603 f->ipAddressChoice == NULL || 624 f->ipAddressChoice == NULL ||
604 (f->ipAddressChoice->type == IPAddressChoice_inherit && 625 (f->ipAddressChoice->type == IPAddressChoice_inherit &&
605 f->ipAddressChoice->u.inherit != NULL)) 626 f->ipAddressChoice->u.inherit != NULL))
606 return NULL; 627 return NULL;
607 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) 628 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
608 aors = f->ipAddressChoice->u.addressesOrRanges; 629 aors = f->ipAddressChoice->u.addressesOrRanges;
609 if (aors != NULL) 630 if (aors != NULL)
610 return aors; 631 return aors;
611 if ((aors = sk_IPAddressOrRange_new_null()) == NULL) 632 if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
612 return NULL; 633 return NULL;
613 switch (afi) { 634 switch (afi) {
614 case IANA_AFI_IPV4: 635 case IANA_AFI_IPV4:
615 (void) sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp); 636 (void) sk_IPAddressOrRange_set_cmp_func(aors,
616 break; 637 v4IPAddressOrRange_cmp);
617 case IANA_AFI_IPV6: 638 break;
618 (void) sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp); 639 case IANA_AFI_IPV6:
619 break; 640 (void) sk_IPAddressOrRange_set_cmp_func(aors,
620 } 641 v6IPAddressOrRange_cmp);
621 f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges; 642 break;
622 f->ipAddressChoice->u.addressesOrRanges = aors; 643 }
623 return aors; 644 f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
645 f->ipAddressChoice->u.addressesOrRanges = aors;
646 return aors;
624} 647}
625 648
626/* 649/*
627 * Add a prefix. 650 * Add a prefix.
628 */ 651 */
629int v3_addr_add_prefix(IPAddrBlocks *addr, 652int
630 const unsigned afi, 653v3_addr_add_prefix(IPAddrBlocks *addr, const unsigned afi,
631 const unsigned *safi, 654 const unsigned *safi, unsigned char *a, const int prefixlen)
632 unsigned char *a,
633 const int prefixlen)
634{ 655{
635 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi); 656 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
636 IPAddressOrRange *aor; 657 IPAddressOrRange *aor;
637 if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen)) 658
638 return 0; 659 if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
639 if (sk_IPAddressOrRange_push(aors, aor)) 660 return 0;
640 return 1; 661 if (sk_IPAddressOrRange_push(aors, aor))
641 IPAddressOrRange_free(aor); 662 return 1;
642 return 0; 663 IPAddressOrRange_free(aor);
664 return 0;
643} 665}
644 666
645/* 667/*
646 * Add a range. 668 * Add a range.
647 */ 669 */
648int v3_addr_add_range(IPAddrBlocks *addr, 670int
649 const unsigned afi, 671v3_addr_add_range(IPAddrBlocks *addr, const unsigned afi, const unsigned *safi,
650 const unsigned *safi, 672 unsigned char *min, unsigned char *max)
651 unsigned char *min,
652 unsigned char *max)
653{ 673{
654 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi); 674 IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
655 IPAddressOrRange *aor; 675 IPAddressOrRange *aor;
656 int length = length_from_afi(afi); 676 int length = length_from_afi(afi);
657 if (aors == NULL) 677
658 return 0; 678 if (aors == NULL)
659 if (!make_addressRange(&aor, min, max, length)) 679 return 0;
660 return 0; 680 if (!make_addressRange(&aor, min, max, length))
661 if (sk_IPAddressOrRange_push(aors, aor)) 681 return 0;
662 return 1; 682 if (sk_IPAddressOrRange_push(aors, aor))
663 IPAddressOrRange_free(aor); 683 return 1;
664 return 0; 684 IPAddressOrRange_free(aor);
685 return 0;
665} 686}
666 687
667/* 688/*
668 * Extract min and max values from an IPAddressOrRange. 689 * Extract min and max values from an IPAddressOrRange.
669 */ 690 */
670static int extract_min_max(IPAddressOrRange *aor, 691static int
671 unsigned char *min, 692extract_min_max(IPAddressOrRange *aor, unsigned char *min, unsigned char *max,
672 unsigned char *max, 693 int length)
673 int length)
674{ 694{
675 if (aor == NULL || min == NULL || max == NULL) 695 if (aor == NULL || min == NULL || max == NULL)
676 return 0; 696 return 0;
677 switch (aor->type) { 697 switch (aor->type) {
678 case IPAddressOrRange_addressPrefix: 698 case IPAddressOrRange_addressPrefix:
679 return (addr_expand(min, aor->u.addressPrefix, length, 0x00) && 699 return (addr_expand(min, aor->u.addressPrefix, length, 0x00) &&
680 addr_expand(max, aor->u.addressPrefix, length, 0xFF)); 700 addr_expand(max, aor->u.addressPrefix, length, 0xFF));
681 case IPAddressOrRange_addressRange: 701 case IPAddressOrRange_addressRange:
682 return (addr_expand(min, aor->u.addressRange->min, length, 0x00) && 702 return (
683 addr_expand(max, aor->u.addressRange->max, length, 0xFF)); 703 addr_expand(min, aor->u.addressRange->min, length, 0x00) &&
684 } 704 addr_expand(max, aor->u.addressRange->max, length, 0xFF));
685 return 0; 705 }
706 return 0;
686} 707}
687 708
688/* 709/*
689 * Public wrapper for extract_min_max(). 710 * Public wrapper for extract_min_max().
690 */ 711 */
691int v3_addr_get_range(IPAddressOrRange *aor, 712int
692 const unsigned afi, 713v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
693 unsigned char *min, 714 unsigned char *min, unsigned char *max, const int length)
694 unsigned char *max,
695 const int length)
696{ 715{
697 int afi_length = length_from_afi(afi); 716 int afi_length = length_from_afi(afi);
698 if (aor == NULL || min == NULL || max == NULL || 717
699 afi_length == 0 || length < afi_length || 718 if (aor == NULL || min == NULL || max == NULL ||
700 (aor->type != IPAddressOrRange_addressPrefix && 719 afi_length == 0 || length < afi_length ||
701 aor->type != IPAddressOrRange_addressRange) || 720 (aor->type != IPAddressOrRange_addressPrefix &&
702 !extract_min_max(aor, min, max, afi_length)) 721 aor->type != IPAddressOrRange_addressRange) ||
703 return 0; 722 !extract_min_max(aor, min, max, afi_length))
704 723 return 0;
705 return afi_length; 724
725 return afi_length;
706} 726}
707 727
708/* 728/*
@@ -715,480 +735,513 @@ int v3_addr_get_range(IPAddressOrRange *aor,
715 * null-SAFI rule to apply only within a single AFI, which is what I 735 * null-SAFI rule to apply only within a single AFI, which is what I
716 * would have expected and is what the following code implements. 736 * would have expected and is what the following code implements.
717 */ 737 */
718static int IPAddressFamily_cmp(const IPAddressFamily * const *a_, 738static int
719 const IPAddressFamily * const *b_) 739IPAddressFamily_cmp(const IPAddressFamily * const *a_,
740 const IPAddressFamily * const *b_)
720{ 741{
721 const ASN1_OCTET_STRING *a = (*a_)->addressFamily; 742 const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
722 const ASN1_OCTET_STRING *b = (*b_)->addressFamily; 743 const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
723 int len = ((a->length <= b->length) ? a->length : b->length); 744 int len = ((a->length <= b->length) ? a->length : b->length);
724 int cmp = memcmp(a->data, b->data, len); 745 int cmp = memcmp(a->data, b->data, len);
725 return cmp ? cmp : a->length - b->length; 746
747 return cmp ? cmp : a->length - b->length;
726} 748}
727 749
728/* 750/*
729 * Check whether an IPAddrBLocks is in canonical form. 751 * Check whether an IPAddrBLocks is in canonical form.
730 */ 752 */
731int v3_addr_is_canonical(IPAddrBlocks *addr) 753int
754v3_addr_is_canonical(IPAddrBlocks *addr)
732{ 755{
733 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 756 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
734 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN]; 757 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
735 IPAddressOrRanges *aors; 758 IPAddressOrRanges *aors;
736 int i, j, k; 759 int i, j, k;
737 760
738 /* 761 /*
739 * Empty extension is cannonical. 762 * Empty extension is cannonical.
740 */ 763 */
741 if (addr == NULL) 764 if (addr == NULL)
742 return 1; 765 return 1;
743 766
744 /* 767 /*
745 * Check whether the top-level list is in order. 768 * Check whether the top-level list is in order.
746 */ 769 */
747 for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) { 770 for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
748 const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i); 771 const IPAddressFamily *a =
749 const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1); 772 sk_IPAddressFamily_value(addr, i);
750 if (IPAddressFamily_cmp(&a, &b) >= 0) 773 const IPAddressFamily *b =
751 return 0; 774 sk_IPAddressFamily_value(addr, i + 1);
752 } 775 if (IPAddressFamily_cmp(&a, &b) >= 0)
753 776 return 0;
754 /* 777 }
755 * Top level's ok, now check each address family.
756 */
757 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
758 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
759 int length = length_from_afi(v3_addr_get_afi(f));
760
761 /*
762 * Inheritance is canonical. Anything other than inheritance or
763 * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
764 */
765 if (f == NULL || f->ipAddressChoice == NULL)
766 return 0;
767 switch (f->ipAddressChoice->type) {
768 case IPAddressChoice_inherit:
769 continue;
770 case IPAddressChoice_addressesOrRanges:
771 break;
772 default:
773 return 0;
774 }
775
776 /*
777 * It's an IPAddressOrRanges sequence, check it.
778 */
779 aors = f->ipAddressChoice->u.addressesOrRanges;
780 if (sk_IPAddressOrRange_num(aors) == 0)
781 return 0;
782 for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
783 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
784 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
785
786 if (!extract_min_max(a, a_min, a_max, length) ||
787 !extract_min_max(b, b_min, b_max, length))
788 return 0;
789
790 /*
791 * Punt misordered list, overlapping start, or inverted range.
792 */
793 if (memcmp(a_min, b_min, length) >= 0 ||
794 memcmp(a_min, a_max, length) > 0 ||
795 memcmp(b_min, b_max, length) > 0)
796 return 0;
797 778
798 /* 779 /*
799 * Punt if adjacent or overlapping. Check for adjacency by 780 * Top level's ok, now check each address family.
800 * subtracting one from b_min first. 781 */
801 */ 782 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
802 for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) 783 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
803 ; 784 int length = length_from_afi(v3_addr_get_afi(f));
804 if (memcmp(a_max, b_min, length) >= 0) 785
805 return 0; 786 /*
787 * Inheritance is canonical. Anything other than inheritance or
788 * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
789 */
790 if (f == NULL || f->ipAddressChoice == NULL)
791 return 0;
792 switch (f->ipAddressChoice->type) {
793 case IPAddressChoice_inherit:
794 continue;
795 case IPAddressChoice_addressesOrRanges:
796 break;
797 default:
798 return 0;
799 }
800
801 /*
802 * It's an IPAddressOrRanges sequence, check it.
803 */
804 aors = f->ipAddressChoice->u.addressesOrRanges;
805 if (sk_IPAddressOrRange_num(aors) == 0)
806 return 0;
807 for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
808 IPAddressOrRange *a =
809 sk_IPAddressOrRange_value(aors, j);
810 IPAddressOrRange *b =
811 sk_IPAddressOrRange_value(aors, j + 1);
812
813 if (!extract_min_max(a, a_min, a_max, length) ||
814 !extract_min_max(b, b_min, b_max, length))
815 return 0;
816
817 /*
818 * Punt misordered list, overlapping start, or inverted range.
819 */
820 if (memcmp(a_min, b_min, length) >= 0 ||
821 memcmp(a_min, a_max, length) > 0 ||
822 memcmp(b_min, b_max, length) > 0)
823 return 0;
824
825 /*
826 * Punt if adjacent or overlapping. Check for adjacency by
827 * subtracting one from b_min first.
828 */
829 for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--)
830 ;
831 if (memcmp(a_max, b_min, length) >= 0)
832 return 0;
833
834 /*
835 * Check for range that should be expressed as a prefix.
836 */
837 if (a->type == IPAddressOrRange_addressRange &&
838 range_should_be_prefix(a_min, a_max, length) >= 0)
839 return 0;
840 }
841
842 /*
843 * Check range to see if it's inverted or should be a
844 * prefix.
845 */
846 j = sk_IPAddressOrRange_num(aors) - 1;
847 {
848 IPAddressOrRange *a =
849 sk_IPAddressOrRange_value(aors, j);
850 if (a != NULL &&
851 a->type == IPAddressOrRange_addressRange) {
852 if (!extract_min_max(a, a_min, a_max, length))
853 return 0;
854 if (memcmp(a_min, a_max, length) > 0 ||
855 range_should_be_prefix(a_min, a_max,
856 length) >= 0)
857 return 0;
858 }
859 }
860 }
806 861
807 /* 862 /*
808 * Check for range that should be expressed as a prefix. 863 * If we made it through all that, we're happy.
809 */ 864 */
810 if (a->type == IPAddressOrRange_addressRange && 865 return 1;
811 range_should_be_prefix(a_min, a_max, length) >= 0)
812 return 0;
813 }
814
815 /*
816 * Check range to see if it's inverted or should be a
817 * prefix.
818 */
819 j = sk_IPAddressOrRange_num(aors) - 1;
820 {
821 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
822 if (a != NULL && a->type == IPAddressOrRange_addressRange) {
823 if (!extract_min_max(a, a_min, a_max, length))
824 return 0;
825 if (memcmp(a_min, a_max, length) > 0 ||
826 range_should_be_prefix(a_min, a_max, length) >= 0)
827 return 0;
828 }
829 }
830 }
831
832 /*
833 * If we made it through all that, we're happy.
834 */
835 return 1;
836} 866}
837 867
838/* 868/*
839 * Whack an IPAddressOrRanges into canonical form. 869 * Whack an IPAddressOrRanges into canonical form.
840 */ 870 */
841static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors, 871static int
842 const unsigned afi) 872IPAddressOrRanges_canonize(IPAddressOrRanges *aors, const unsigned afi)
843{ 873{
844 int i, j, length = length_from_afi(afi); 874 int i, j, length = length_from_afi(afi);
845 875
846 /* 876 /*
847 * Sort the IPAddressOrRanges sequence. 877 * Sort the IPAddressOrRanges sequence.
848 */ 878 */
849 sk_IPAddressOrRange_sort(aors); 879 sk_IPAddressOrRange_sort(aors);
850 880
851 /* 881 /*
852 * Clean up representation issues, punt on duplicates or overlaps. 882 * Clean up representation issues, punt on duplicates or overlaps.
853 */ 883 */
854 for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) { 884 for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
855 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i); 885 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
856 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1); 886 IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
857 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 887 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
858 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN]; 888 unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
859 889
860 if (!extract_min_max(a, a_min, a_max, length) || 890 if (!extract_min_max(a, a_min, a_max, length) ||
861 !extract_min_max(b, b_min, b_max, length)) 891 !extract_min_max(b, b_min, b_max, length))
862 return 0; 892 return 0;
863 893
864 /* 894 /*
865 * Punt inverted ranges. 895 * Punt inverted ranges.
866 */ 896 */
867 if (memcmp(a_min, a_max, length) > 0 || 897 if (memcmp(a_min, a_max, length) > 0 ||
868 memcmp(b_min, b_max, length) > 0) 898 memcmp(b_min, b_max, length) > 0)
869 return 0; 899 return 0;
870 900
871 /* 901 /*
872 * Punt overlaps. 902 * Punt overlaps.
873 */ 903 */
874 if (memcmp(a_max, b_min, length) >= 0) 904 if (memcmp(a_max, b_min, length) >= 0)
875 return 0; 905 return 0;
876 906
877 /* 907 /*
878 * Merge if a and b are adjacent. We check for 908 * Merge if a and b are adjacent. We check for
879 * adjacency by subtracting one from b_min first. 909 * adjacency by subtracting one from b_min first.
880 */ 910 */
881 for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) 911 for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--)
882 ; 912 ;
883 if (memcmp(a_max, b_min, length) == 0) { 913 if (memcmp(a_max, b_min, length) == 0) {
884 IPAddressOrRange *merged; 914 IPAddressOrRange *merged;
885 if (!make_addressRange(&merged, a_min, b_max, length)) 915 if (!make_addressRange(&merged, a_min, b_max, length))
886 return 0; 916 return 0;
887 (void) sk_IPAddressOrRange_set(aors, i, merged); 917 (void) sk_IPAddressOrRange_set(aors, i, merged);
888 (void) sk_IPAddressOrRange_delete(aors, i + 1); 918 (void) sk_IPAddressOrRange_delete(aors, i + 1);
889 IPAddressOrRange_free(a); 919 IPAddressOrRange_free(a);
890 IPAddressOrRange_free(b); 920 IPAddressOrRange_free(b);
891 --i; 921 --i;
892 continue; 922 continue;
893 } 923 }
894 } 924 }
895 925
896 /* 926 /*
897 * Check for inverted final range. 927 * Check for inverted final range.
898 */ 928 */
899 j = sk_IPAddressOrRange_num(aors) - 1; 929 j = sk_IPAddressOrRange_num(aors) - 1;
900 { 930 {
901 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j); 931 IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
902 if (a != NULL && a->type == IPAddressOrRange_addressRange) { 932 if (a != NULL && a->type == IPAddressOrRange_addressRange) {
903 unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN]; 933 unsigned char a_min[ADDR_RAW_BUF_LEN],
904 extract_min_max(a, a_min, a_max, length); 934 a_max[ADDR_RAW_BUF_LEN];
905 if (memcmp(a_min, a_max, length) > 0) 935 extract_min_max(a, a_min, a_max, length);
906 return 0; 936 if (memcmp(a_min, a_max, length) > 0)
907 } 937 return 0;
908 } 938 }
939 }
909 940
910 return 1; 941 return 1;
911} 942}
912 943
913/* 944/*
914 * Whack an IPAddrBlocks extension into canonical form. 945 * Whack an IPAddrBlocks extension into canonical form.
915 */ 946 */
916int v3_addr_canonize(IPAddrBlocks *addr) 947int
948v3_addr_canonize(IPAddrBlocks *addr)
917{ 949{
918 int i; 950 int i;
919 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 951 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
920 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 952 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
921 if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges && 953 if (f->ipAddressChoice->type ==
922 !IPAddressOrRanges_canonize(f->ipAddressChoice->u.addressesOrRanges, 954 IPAddressChoice_addressesOrRanges &&
923 v3_addr_get_afi(f))) 955 !IPAddressOrRanges_canonize(
924 return 0; 956 f->ipAddressChoice->u.addressesOrRanges,
925 } 957 v3_addr_get_afi(f)))
926 (void) sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp); 958 return 0;
927 sk_IPAddressFamily_sort(addr); 959 }
928 OPENSSL_assert(v3_addr_is_canonical(addr)); 960 (void) sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
929 return 1; 961 sk_IPAddressFamily_sort(addr);
962 OPENSSL_assert(v3_addr_is_canonical(addr));
963 return 1;
930} 964}
931 965
932/* 966/*
933 * v2i handler for the IPAddrBlocks extension. 967 * v2i handler for the IPAddrBlocks extension.
934 */ 968 */
935static void *v2i_IPAddrBlocks(const struct v3_ext_method *method, 969static void *
936 struct v3_ext_ctx *ctx, 970v2i_IPAddrBlocks(const struct v3_ext_method *method, struct v3_ext_ctx *ctx,
937 STACK_OF(CONF_VALUE) *values) 971 STACK_OF(CONF_VALUE) *values)
938{ 972{
939 static const char v4addr_chars[] = "0123456789."; 973 static const char v4addr_chars[] = "0123456789.";
940 static const char v6addr_chars[] = "0123456789.:abcdefABCDEF"; 974 static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
941 IPAddrBlocks *addr = NULL; 975 IPAddrBlocks *addr = NULL;
942 char *s = NULL, *t; 976 char *s = NULL, *t;
943 int i; 977 int i;
944 978
945 if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) { 979 if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
946 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 980 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
947 return NULL; 981 return NULL;
948 } 982 }
949 983
950 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 984 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
951 CONF_VALUE *val = sk_CONF_VALUE_value(values, i); 985 CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
952 unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN]; 986 unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
953 unsigned afi, *safi = NULL, safi_; 987 unsigned afi, *safi = NULL, safi_;
954 const char *addr_chars; 988 const char *addr_chars;
955 int prefixlen, i1, i2, delim, length; 989 int prefixlen, i1, i2, delim, length;
956 990
957 if ( !name_cmp(val->name, "IPv4")) { 991 if (!name_cmp(val->name, "IPv4")) {
958 afi = IANA_AFI_IPV4; 992 afi = IANA_AFI_IPV4;
959 } else if (!name_cmp(val->name, "IPv6")) { 993 } else if (!name_cmp(val->name, "IPv6")) {
960 afi = IANA_AFI_IPV6; 994 afi = IANA_AFI_IPV6;
961 } else if (!name_cmp(val->name, "IPv4-SAFI")) { 995 } else if (!name_cmp(val->name, "IPv4-SAFI")) {
962 afi = IANA_AFI_IPV4; 996 afi = IANA_AFI_IPV4;
963 safi = &safi_; 997 safi = &safi_;
964 } else if (!name_cmp(val->name, "IPv6-SAFI")) { 998 } else if (!name_cmp(val->name, "IPv6-SAFI")) {
965 afi = IANA_AFI_IPV6; 999 afi = IANA_AFI_IPV6;
966 safi = &safi_; 1000 safi = &safi_;
967 } else { 1001 } else {
968 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_NAME_ERROR); 1002 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
969 X509V3_conf_err(val); 1003 X509V3_R_EXTENSION_NAME_ERROR);
970 goto err; 1004 X509V3_conf_err(val);
971 } 1005 goto err;
972 1006 }
973 switch (afi) { 1007
974 case IANA_AFI_IPV4: 1008 switch (afi) {
975 addr_chars = v4addr_chars; 1009 case IANA_AFI_IPV4:
976 break; 1010 addr_chars = v4addr_chars;
977 case IANA_AFI_IPV6: 1011 break;
978 addr_chars = v6addr_chars; 1012 case IANA_AFI_IPV6:
979 break; 1013 addr_chars = v6addr_chars;
980 } 1014 break;
981 1015 }
982 length = length_from_afi(afi); 1016
983 1017 length = length_from_afi(afi);
984 /* 1018
985 * Handle SAFI, if any, and BUF_strdup() so we can null-terminate 1019 /*
986 * the other input values. 1020 * Handle SAFI, if any, and BUF_strdup() so we can null-terminate
987 */ 1021 * the other input values.
988 if (safi != NULL) { 1022 */
989 *safi = strtoul(val->value, &t, 0); 1023 if (safi != NULL) {
990 t += strspn(t, " \t"); 1024 *safi = strtoul(val->value, &t, 0);
991 if (*safi > 0xFF || *t++ != ':') { 1025 t += strspn(t, " \t");
992 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI); 1026 if (*safi > 0xFF || *t++ != ':') {
993 X509V3_conf_err(val); 1027 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
994 goto err; 1028 X509V3_R_INVALID_SAFI);
995 } 1029 X509V3_conf_err(val);
996 t += strspn(t, " \t"); 1030 goto err;
997 s = BUF_strdup(t); 1031 }
998 } else { 1032 t += strspn(t, " \t");
999 s = BUF_strdup(val->value); 1033 s = BUF_strdup(t);
1000 } 1034 } else {
1001 if (s == NULL) { 1035 s = BUF_strdup(val->value);
1002 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1036 }
1003 goto err; 1037 if (s == NULL) {
1004 } 1038 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1005 1039 ERR_R_MALLOC_FAILURE);
1006 /* 1040 goto err;
1007 * Check for inheritance. Not worth additional complexity to 1041 }
1008 * optimize this (seldom-used) case. 1042
1009 */ 1043 /*
1010 if (!strcmp(s, "inherit")) { 1044 * Check for inheritance. Not worth additional complexity to
1011 if (!v3_addr_add_inherit(addr, afi, safi)) { 1045 * optimize this (seldom-used) case.
1012 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_INHERITANCE); 1046 */
1013 X509V3_conf_err(val); 1047 if (!strcmp(s, "inherit")) {
1014 goto err; 1048 if (!v3_addr_add_inherit(addr, afi, safi)) {
1015 } 1049 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1016 free(s); 1050 X509V3_R_INVALID_INHERITANCE);
1017 s = NULL; 1051 X509V3_conf_err(val);
1018 continue; 1052 goto err;
1019 } 1053 }
1020 1054 free(s);
1021 i1 = strspn(s, addr_chars); 1055 s = NULL;
1022 i2 = i1 + strspn(s + i1, " \t"); 1056 continue;
1023 delim = s[i2++]; 1057 }
1024 s[i1] = '\0'; 1058
1025 1059 i1 = strspn(s, addr_chars);
1026 if (a2i_ipadd(min, s) != length) { 1060 i2 = i1 + strspn(s + i1, " \t");
1027 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS); 1061 delim = s[i2++];
1028 X509V3_conf_err(val); 1062 s[i1] = '\0';
1029 goto err; 1063
1030 } 1064 if (a2i_ipadd(min, s) != length) {
1031 1065 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1032 switch (delim) { 1066 X509V3_R_INVALID_IPADDRESS);
1033 case '/': 1067 X509V3_conf_err(val);
1034 prefixlen = (int) strtoul(s + i2, &t, 10); 1068 goto err;
1035 if (t == s + i2 || *t != '\0') { 1069 }
1036 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1070
1037 X509V3_conf_err(val); 1071 switch (delim) {
1038 goto err; 1072 case '/':
1039 } 1073 prefixlen = (int) strtoul(s + i2, &t, 10);
1040 if (!v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) { 1074 if (t == s + i2 || *t != '\0') {
1041 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1075 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1042 goto err; 1076 X509V3_R_EXTENSION_VALUE_ERROR);
1043 } 1077 X509V3_conf_err(val);
1044 break; 1078 goto err;
1045 case '-': 1079 }
1046 i1 = i2 + strspn(s + i2, " \t"); 1080 if (!v3_addr_add_prefix(addr, afi, safi, min,
1047 i2 = i1 + strspn(s + i1, addr_chars); 1081 prefixlen)) {
1048 if (i1 == i2 || s[i2] != '\0') { 1082 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1049 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1083 ERR_R_MALLOC_FAILURE);
1050 X509V3_conf_err(val); 1084 goto err;
1051 goto err; 1085 }
1052 } 1086 break;
1053 if (a2i_ipadd(max, s + i1) != length) { 1087 case '-':
1054 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS); 1088 i1 = i2 + strspn(s + i2, " \t");
1055 X509V3_conf_err(val); 1089 i2 = i1 + strspn(s + i1, addr_chars);
1056 goto err; 1090 if (i1 == i2 || s[i2] != '\0') {
1057 } 1091 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1058 if (memcmp(min, max, length_from_afi(afi)) > 0) { 1092 X509V3_R_EXTENSION_VALUE_ERROR);
1059 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1093 X509V3_conf_err(val);
1060 X509V3_conf_err(val); 1094 goto err;
1061 goto err; 1095 }
1062 } 1096 if (a2i_ipadd(max, s + i1) != length) {
1063 if (!v3_addr_add_range(addr, afi, safi, min, max)) { 1097 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1064 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1098 X509V3_R_INVALID_IPADDRESS);
1065 goto err; 1099 X509V3_conf_err(val);
1066 } 1100 goto err;
1067 break; 1101 }
1068 case '\0': 1102 if (memcmp(min, max, length_from_afi(afi)) > 0) {
1069 if (!v3_addr_add_prefix(addr, afi, safi, min, length * 8)) { 1103 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1070 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE); 1104 X509V3_R_EXTENSION_VALUE_ERROR);
1071 goto err; 1105 X509V3_conf_err(val);
1072 } 1106 goto err;
1073 break; 1107 }
1074 default: 1108 if (!v3_addr_add_range(addr, afi, safi, min, max)) {
1075 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_EXTENSION_VALUE_ERROR); 1109 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1076 X509V3_conf_err(val); 1110 ERR_R_MALLOC_FAILURE);
1077 goto err; 1111 goto err;
1078 } 1112 }
1079 1113 break;
1080 free(s); 1114 case '\0':
1081 s = NULL; 1115 if (!v3_addr_add_prefix(addr, afi, safi, min,
1082 } 1116 length * 8)) {
1083 1117 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1084 /* 1118 ERR_R_MALLOC_FAILURE);
1085 * Canonize the result, then we're done. 1119 goto err;
1086 */ 1120 }
1087 if (!v3_addr_canonize(addr)) 1121 break;
1088 goto err; 1122 default:
1089 return addr; 1123 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1090 1124 X509V3_R_EXTENSION_VALUE_ERROR);
1091 err: 1125 X509V3_conf_err(val);
1092 free(s); 1126 goto err;
1093 sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free); 1127 }
1094 return NULL; 1128
1129 free(s);
1130 s = NULL;
1131 }
1132
1133 /*
1134 * Canonize the result, then we're done.
1135 */
1136 if (!v3_addr_canonize(addr))
1137 goto err;
1138 return addr;
1139
1140err:
1141 free(s);
1142 sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
1143 return NULL;
1095} 1144}
1096 1145
1097/* 1146/*
1098 * OpenSSL dispatch 1147 * OpenSSL dispatch
1099 */ 1148 */
1100const X509V3_EXT_METHOD v3_addr = { 1149const X509V3_EXT_METHOD v3_addr = {
1101 NID_sbgp_ipAddrBlock, /* nid */ 1150 NID_sbgp_ipAddrBlock, /* nid */
1102 0, /* flags */ 1151 0, /* flags */
1103 ASN1_ITEM_ref(IPAddrBlocks), /* template */ 1152 ASN1_ITEM_ref(IPAddrBlocks), /* template */
1104 0, 0, 0, 0, /* old functions, ignored */ 1153 0, 0, 0, 0, /* old functions, ignored */
1105 0, /* i2s */ 1154 0, /* i2s */
1106 0, /* s2i */ 1155 0, /* s2i */
1107 0, /* i2v */ 1156 0, /* i2v */
1108 v2i_IPAddrBlocks, /* v2i */ 1157 v2i_IPAddrBlocks, /* v2i */
1109 i2r_IPAddrBlocks, /* i2r */ 1158 i2r_IPAddrBlocks, /* i2r */
1110 0, /* r2i */ 1159 0, /* r2i */
1111 NULL /* extension-specific data */ 1160 NULL /* extension-specific data */
1112}; 1161};
1113 1162
1114/* 1163/*
1115 * Figure out whether extension sues inheritance. 1164 * Figure out whether extension sues inheritance.
1116 */ 1165 */
1117int v3_addr_inherits(IPAddrBlocks *addr) 1166int
1167v3_addr_inherits(IPAddrBlocks *addr)
1118{ 1168{
1119 int i; 1169 int i;
1120 if (addr == NULL) 1170
1121 return 0; 1171 if (addr == NULL)
1122 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) { 1172 return 0;
1123 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i); 1173 for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
1124 if (f->ipAddressChoice->type == IPAddressChoice_inherit) 1174 IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
1125 return 1; 1175 if (f->ipAddressChoice->type == IPAddressChoice_inherit)
1126 } 1176 return 1;
1127 return 0; 1177 }
1178 return 0;
1128} 1179}
1129 1180
1130/* 1181/*
1131 * Figure out whether parent contains child. 1182 * Figure out whether parent contains child.
1132 */ 1183 */
1133static int addr_contains(IPAddressOrRanges *parent, 1184static int
1134 IPAddressOrRanges *child, 1185addr_contains(IPAddressOrRanges *parent, IPAddressOrRanges *child, int length)
1135 int length)
1136{ 1186{
1137 unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN]; 1187 unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
1138 unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN]; 1188 unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
1139 int p, c; 1189 int p, c;
1140 1190
1141 if (child == NULL || parent == child) 1191 if (child == NULL || parent == child)
1142 return 1; 1192 return 1;
1143 if (parent == NULL) 1193 if (parent == NULL)
1144 return 0; 1194 return 0;
1145 1195
1146 p = 0; 1196 p = 0;
1147 for (c = 0; c < sk_IPAddressOrRange_num(child); c++) { 1197 for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
1148 if (!extract_min_max(sk_IPAddressOrRange_value(child, c), 1198 if (!extract_min_max(sk_IPAddressOrRange_value(child, c),
1149 c_min, c_max, length)) 1199 c_min, c_max, length))
1150 return -1; 1200 return -1;
1151 for (;; p++) { 1201 for (; ; p++) {
1152 if (p >= sk_IPAddressOrRange_num(parent)) 1202 if (p >= sk_IPAddressOrRange_num(parent))
1153 return 0; 1203 return 0;
1154 if (!extract_min_max(sk_IPAddressOrRange_value(parent, p), 1204 if (!extract_min_max(
1155 p_min, p_max, length)) 1205 sk_IPAddressOrRange_value(parent, p),
1156 return 0; 1206 p_min, p_max, length))
1157 if (memcmp(p_max, c_max, length) < 0) 1207 return 0;
1158 continue; 1208 if (memcmp(p_max, c_max, length) < 0)
1159 if (memcmp(p_min, c_min, length) > 0) 1209 continue;
1160 return 0; 1210 if (memcmp(p_min, c_min, length) > 0)
1161 break; 1211 return 0;
1162 } 1212 break;
1163 } 1213 }
1214 }
1164 1215
1165 return 1; 1216 return 1;
1166} 1217}
1167 1218
1168/* 1219/*
1169 * Test whether a is a subset of b. 1220 * Test whether a is a subset of b.
1170 */ 1221 */
1171int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b) 1222int
1223v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
1172{ 1224{
1173 int i; 1225 int i;
1174 if (a == NULL || a == b) 1226
1175 return 1; 1227 if (a == NULL || a == b)
1176 if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b)) 1228 return 1;
1177 return 0; 1229 if (b == NULL || v3_addr_inherits(a) || v3_addr_inherits(b))
1178 (void) sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp); 1230 return 0;
1179 for (i = 0; i < sk_IPAddressFamily_num(a); i++) { 1231 (void) sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
1180 IPAddressFamily *fa = sk_IPAddressFamily_value(a, i); 1232 for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
1181 int j = sk_IPAddressFamily_find(b, fa); 1233 IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
1182 IPAddressFamily *fb; 1234 int j = sk_IPAddressFamily_find(b, fa);
1183 fb = sk_IPAddressFamily_value(b, j); 1235 IPAddressFamily *fb;
1184 if (fb == NULL) 1236 fb = sk_IPAddressFamily_value(b, j);
1185 return 0; 1237 if (fb == NULL)
1186 if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges, 1238 return 0;
1187 fa->ipAddressChoice->u.addressesOrRanges, 1239 if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
1188 length_from_afi(v3_addr_get_afi(fb)))) 1240 fa->ipAddressChoice->u.addressesOrRanges,
1189 return 0; 1241 length_from_afi(v3_addr_get_afi(fb))))
1190 } 1242 return 0;
1191 return 1; 1243 }
1244 return 1;
1192} 1245}
1193 1246
1194/* 1247/*
@@ -1211,101 +1264,115 @@ int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
1211/* 1264/*
1212 * Core code for RFC 3779 2.3 path validation. 1265 * Core code for RFC 3779 2.3 path validation.
1213 */ 1266 */
1214static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx, 1267static int
1215 STACK_OF(X509) *chain, 1268v3_addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
1216 IPAddrBlocks *ext) 1269 IPAddrBlocks *ext)
1217{ 1270{
1218 IPAddrBlocks *child = NULL; 1271 IPAddrBlocks *child = NULL;
1219 int i, j, ret = 1; 1272 int i, j, ret = 1;
1220 X509 *x; 1273 X509 *x;
1221 1274
1222 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0); 1275 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
1223 OPENSSL_assert(ctx != NULL || ext != NULL); 1276 OPENSSL_assert(ctx != NULL || ext != NULL);
1224 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL); 1277 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
1225 1278
1226 /* 1279 /*
1227 * Figure out where to start. If we don't have an extension to 1280 * Figure out where to start. If we don't have an extension to
1228 * check, we're done. Otherwise, check canonical form and 1281 * check, we're done. Otherwise, check canonical form and
1229 * set up for walking up the chain. 1282 * set up for walking up the chain.
1230 */ 1283 */
1231 if (ext != NULL) { 1284 if (ext != NULL) {
1232 i = -1; 1285 i = -1;
1233 x = NULL; 1286 x = NULL;
1234 } else { 1287 } else {
1235 i = 0; 1288 i = 0;
1236 x = sk_X509_value(chain, i); 1289 x = sk_X509_value(chain, i);
1237 OPENSSL_assert(x != NULL); 1290 OPENSSL_assert(x != NULL);
1238 if ((ext = x->rfc3779_addr) == NULL) 1291 if ((ext = x->rfc3779_addr) == NULL)
1239 goto done; 1292 goto done;
1240 }
1241 if (!v3_addr_is_canonical(ext))
1242 validation_err(X509_V_ERR_INVALID_EXTENSION);
1243 (void) sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
1244 if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
1245 X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL, ERR_R_MALLOC_FAILURE);
1246 ret = 0;
1247 goto done;
1248 }
1249
1250 /*
1251 * Now walk up the chain. No cert may list resources that its
1252 * parent doesn't list.
1253 */
1254 for (i++; i < sk_X509_num(chain); i++) {
1255 x = sk_X509_value(chain, i);
1256 OPENSSL_assert(x != NULL);
1257 if (!v3_addr_is_canonical(x->rfc3779_addr))
1258 validation_err(X509_V_ERR_INVALID_EXTENSION);
1259 if (x->rfc3779_addr == NULL) {
1260 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1261 IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
1262 if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
1263 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1264 break;
1265 } 1293 }
1266 } 1294 if (!v3_addr_is_canonical(ext))
1267 continue; 1295 validation_err(X509_V_ERR_INVALID_EXTENSION);
1268 } 1296 (void) sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
1269 (void) sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr, IPAddressFamily_cmp); 1297 if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
1270 for (j = 0; j < sk_IPAddressFamily_num(child); j++) { 1298 X509V3err(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL,
1271 IPAddressFamily *fc = sk_IPAddressFamily_value(child, j); 1299 ERR_R_MALLOC_FAILURE);
1272 int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc); 1300 ret = 0;
1273 IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, k); 1301 goto done;
1274 if (fp == NULL) {
1275 if (fc->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) {
1276 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1277 break;
1278 } 1302 }
1279 continue; 1303
1280 } 1304 /*
1281 if (fp->ipAddressChoice->type == IPAddressChoice_addressesOrRanges) { 1305 * Now walk up the chain. No cert may list resources that its
1282 if (fc->ipAddressChoice->type == IPAddressChoice_inherit || 1306 * parent doesn't list.
1283 addr_contains(fp->ipAddressChoice->u.addressesOrRanges, 1307 */
1284 fc->ipAddressChoice->u.addressesOrRanges, 1308 for (i++; i < sk_X509_num(chain); i++) {
1285 length_from_afi(v3_addr_get_afi(fc)))) 1309 x = sk_X509_value(chain, i);
1286 sk_IPAddressFamily_set(child, j, fp); 1310 OPENSSL_assert(x != NULL);
1287 else 1311 if (!v3_addr_is_canonical(x->rfc3779_addr))
1288 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 1312 validation_err(X509_V_ERR_INVALID_EXTENSION);
1289 } 1313 if (x->rfc3779_addr == NULL) {
1290 } 1314 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1291 } 1315 IPAddressFamily *fc =
1292 1316 sk_IPAddressFamily_value(child, j);
1293 /* 1317 if (fc->ipAddressChoice->type !=
1294 * Trust anchor can't inherit. 1318 IPAddressChoice_inherit) {
1295 */ 1319 validation_err(
1296 OPENSSL_assert(x != NULL); 1320 X509_V_ERR_UNNESTED_RESOURCE);
1297 if (x->rfc3779_addr != NULL) { 1321 break;
1298 for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) { 1322 }
1299 IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j); 1323 }
1300 if (fp->ipAddressChoice->type == IPAddressChoice_inherit && 1324 continue;
1301 sk_IPAddressFamily_find(child, fp) >= 0) 1325 }
1302 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 1326 (void) sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr,
1303 } 1327 IPAddressFamily_cmp);
1304 } 1328 for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1305 1329 IPAddressFamily *fc =
1306 done: 1330 sk_IPAddressFamily_value(child, j);
1307 sk_IPAddressFamily_free(child); 1331 int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
1308 return ret; 1332 IPAddressFamily *fp =
1333 sk_IPAddressFamily_value(x->rfc3779_addr, k);
1334 if (fp == NULL) {
1335 if (fc->ipAddressChoice->type ==
1336 IPAddressChoice_addressesOrRanges) {
1337 validation_err(
1338 X509_V_ERR_UNNESTED_RESOURCE);
1339 break;
1340 }
1341 continue;
1342 }
1343 if (fp->ipAddressChoice->type ==
1344 IPAddressChoice_addressesOrRanges) {
1345 if (fc->ipAddressChoice->type ==
1346 IPAddressChoice_inherit || addr_contains(
1347 fp->ipAddressChoice->u.addressesOrRanges,
1348 fc->ipAddressChoice->u.addressesOrRanges,
1349 length_from_afi(v3_addr_get_afi(fc))))
1350 sk_IPAddressFamily_set(child, j, fp);
1351 else
1352 validation_err(
1353 X509_V_ERR_UNNESTED_RESOURCE);
1354 }
1355 }
1356 }
1357
1358 /*
1359 * Trust anchor can't inherit.
1360 */
1361 OPENSSL_assert(x != NULL);
1362 if (x->rfc3779_addr != NULL) {
1363 for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
1364 IPAddressFamily *fp =
1365 sk_IPAddressFamily_value(x->rfc3779_addr, j);
1366 if (fp->ipAddressChoice->type ==
1367 IPAddressChoice_inherit &&
1368 sk_IPAddressFamily_find(child, fp) >= 0)
1369 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1370 }
1371 }
1372
1373done:
1374 sk_IPAddressFamily_free(child);
1375 return ret;
1309} 1376}
1310 1377
1311#undef validation_err 1378#undef validation_err
@@ -1313,26 +1380,27 @@ static int v3_addr_validate_path_internal(X509_STORE_CTX *ctx,
1313/* 1380/*
1314 * RFC 3779 2.3 path validation -- called from X509_verify_cert(). 1381 * RFC 3779 2.3 path validation -- called from X509_verify_cert().
1315 */ 1382 */
1316int v3_addr_validate_path(X509_STORE_CTX *ctx) 1383int
1384v3_addr_validate_path(X509_STORE_CTX *ctx)
1317{ 1385{
1318 return v3_addr_validate_path_internal(ctx, ctx->chain, NULL); 1386 return v3_addr_validate_path_internal(ctx, ctx->chain, NULL);
1319} 1387}
1320 1388
1321/* 1389/*
1322 * RFC 3779 2.3 path validation of an extension. 1390 * RFC 3779 2.3 path validation of an extension.
1323 * Test whether chain covers extension. 1391 * Test whether chain covers extension.
1324 */ 1392 */
1325int v3_addr_validate_resource_set(STACK_OF(X509) *chain, 1393int
1326 IPAddrBlocks *ext, 1394v3_addr_validate_resource_set(STACK_OF(X509) *chain, IPAddrBlocks *ext,
1327 int allow_inheritance) 1395 int allow_inheritance)
1328{ 1396{
1329 if (ext == NULL) 1397 if (ext == NULL)
1330 return 1; 1398 return 1;
1331 if (chain == NULL || sk_X509_num(chain) == 0) 1399 if (chain == NULL || sk_X509_num(chain) == 0)
1332 return 0; 1400 return 0;
1333 if (!allow_inheritance && v3_addr_inherits(ext)) 1401 if (!allow_inheritance && v3_addr_inherits(ext))
1334 return 0; 1402 return 0;
1335 return v3_addr_validate_path_internal(NULL, chain, ext); 1403 return v3_addr_validate_path_internal(NULL, chain, ext);
1336} 1404}
1337 1405
1338#endif /* OPENSSL_NO_RFC3779 */ 1406#endif /* OPENSSL_NO_RFC3779 */
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_akey.c b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
index 04e1fb9544..6d5c576e23 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_akey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -64,36 +64,37 @@
64#include <openssl/x509v3.h> 64#include <openssl/x509v3.h>
65 65
66static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 66static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
67 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist); 67 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist);
68static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 68static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values); 69 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
70 70
71const X509V3_EXT_METHOD v3_akey_id = 71const X509V3_EXT_METHOD v3_akey_id = {
72 {
73 NID_authority_key_identifier, 72 NID_authority_key_identifier,
74 X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID), 73 X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID),
75 0,0,0,0, 74 0, 0,0, 0,
76 0,0, 75 0, 0,
77 (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID, 76 (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
78 (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID, 77 (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
79 0,0, 78 0, 0,
80 NULL 79 NULL
81 }; 80};
82 81
83static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 82static
84 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist) 83STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
84 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist)
85{ 85{
86 char *tmp; 86 char *tmp;
87 if(akeyid->keyid) { 87
88 if (akeyid->keyid) {
88 tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length); 89 tmp = hex_to_string(akeyid->keyid->data, akeyid->keyid->length);
89 X509V3_add_value("keyid", tmp, &extlist); 90 X509V3_add_value("keyid", tmp, &extlist);
90 free(tmp); 91 free(tmp);
91 } 92 }
92 if(akeyid->issuer) 93 if (akeyid->issuer)
93 extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist); 94 extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
94 if(akeyid->serial) { 95 if (akeyid->serial) {
95 tmp = hex_to_string(akeyid->serial->data, 96 tmp = hex_to_string(akeyid->serial->data,
96 akeyid->serial->length); 97 akeyid->serial->length);
97 X509V3_add_value("serial", tmp, &extlist); 98 X509V3_add_value("serial", tmp, &extlist);
98 free(tmp); 99 free(tmp);
99 } 100 }
@@ -108,10 +109,11 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
108 * this is always included. 109 * this is always included.
109 */ 110 */
110 111
111static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 112static AUTHORITY_KEYID *
112 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values) 113v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
113 { 114 STACK_OF(CONF_VALUE) *values)
114 char keyid=0, issuer=0; 115{
116 char keyid = 0, issuer = 0;
115 int i; 117 int i;
116 CONF_VALUE *cnf; 118 CONF_VALUE *cnf;
117 ASN1_OCTET_STRING *ikeyid = NULL; 119 ASN1_OCTET_STRING *ikeyid = NULL;
@@ -123,76 +125,70 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
123 X509 *cert; 125 X509 *cert;
124 AUTHORITY_KEYID *akeyid; 126 AUTHORITY_KEYID *akeyid;
125 127
126 for(i = 0; i < sk_CONF_VALUE_num(values); i++) 128 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
127 {
128 cnf = sk_CONF_VALUE_value(values, i); 129 cnf = sk_CONF_VALUE_value(values, i);
129 if(!strcmp(cnf->name, "keyid")) 130 if (!strcmp(cnf->name, "keyid")) {
130 {
131 keyid = 1; 131 keyid = 1;
132 if(cnf->value && !strcmp(cnf->value, "always")) 132 if (cnf->value && !strcmp(cnf->value, "always"))
133 keyid = 2; 133 keyid = 2;
134 } 134 }
135 else if(!strcmp(cnf->name, "issuer")) 135 else if (!strcmp(cnf->name, "issuer")) {
136 {
137 issuer = 1; 136 issuer = 1;
138 if(cnf->value && !strcmp(cnf->value, "always")) 137 if (cnf->value && !strcmp(cnf->value, "always"))
139 issuer = 2; 138 issuer = 2;
140 } 139 } else {
141 else 140 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
142 { 141 X509V3_R_UNKNOWN_OPTION);
143 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNKNOWN_OPTION);
144 ERR_add_error_data(2, "name=", cnf->name); 142 ERR_add_error_data(2, "name=", cnf->name);
145 return NULL; 143 return NULL;
146 }
147 } 144 }
145 }
148 146
149 if(!ctx || !ctx->issuer_cert) 147 if (!ctx || !ctx->issuer_cert) {
150 { 148 if (ctx && (ctx->flags == CTX_TEST))
151 if(ctx && (ctx->flags==CTX_TEST))
152 return AUTHORITY_KEYID_new(); 149 return AUTHORITY_KEYID_new();
153 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_NO_ISSUER_CERTIFICATE); 150 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
151 X509V3_R_NO_ISSUER_CERTIFICATE);
154 return NULL; 152 return NULL;
155 } 153 }
156 154
157 cert = ctx->issuer_cert; 155 cert = ctx->issuer_cert;
158 156
159 if(keyid) 157 if (keyid) {
160 {
161 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1); 158 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
162 if((i >= 0) && (ext = X509_get_ext(cert, i))) 159 if ((i >= 0) && (ext = X509_get_ext(cert, i)))
163 ikeyid = X509V3_EXT_d2i(ext); 160 ikeyid = X509V3_EXT_d2i(ext);
164 if(keyid==2 && !ikeyid) 161 if (keyid == 2 && !ikeyid) {
165 { 162 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
166 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_KEYID); 163 X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
167 return NULL; 164 return NULL;
168 }
169 } 165 }
166 }
170 167
171 if((issuer && !ikeyid) || (issuer == 2)) 168 if ((issuer && !ikeyid) || (issuer == 2)) {
172 {
173 isname = X509_NAME_dup(X509_get_issuer_name(cert)); 169 isname = X509_NAME_dup(X509_get_issuer_name(cert));
174 serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert)); 170 serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
175 if(!isname || !serial) 171 if (!isname || !serial) {
176 { 172 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
177 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS); 173 X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
178 goto err; 174 goto err;
179 }
180 } 175 }
176 }
181 177
182 if(!(akeyid = AUTHORITY_KEYID_new())) goto err; 178 if (!(akeyid = AUTHORITY_KEYID_new()))
179 goto err;
183 180
184 if(isname) 181 if (isname) {
185 { 182 if (!(gens = sk_GENERAL_NAME_new_null()) ||
186 if(!(gens = sk_GENERAL_NAME_new_null()) 183 !(gen = GENERAL_NAME_new()) ||
187 || !(gen = GENERAL_NAME_new()) 184 !sk_GENERAL_NAME_push(gens, gen)) {
188 || !sk_GENERAL_NAME_push(gens, gen)) 185 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
189 { 186 ERR_R_MALLOC_FAILURE);
190 X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,ERR_R_MALLOC_FAILURE);
191 goto err; 187 goto err;
192 } 188 }
193 gen->type = GEN_DIRNAME; 189 gen->type = GEN_DIRNAME;
194 gen->d.dirn = isname; 190 gen->d.dirn = isname;
195 } 191 }
196 192
197 akeyid->issuer = gens; 193 akeyid->issuer = gens;
198 akeyid->serial = serial; 194 akeyid->serial = serial;
@@ -200,9 +196,9 @@ static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
200 196
201 return akeyid; 197 return akeyid;
202 198
203 err: 199err:
204 X509_NAME_free(isname); 200 X509_NAME_free(isname);
205 M_ASN1_INTEGER_free(serial); 201 M_ASN1_INTEGER_free(serial);
206 M_ASN1_OCTET_STRING_free(ikeyid); 202 M_ASN1_OCTET_STRING_free(ikeyid);
207 return NULL; 203 return NULL;
208 } 204}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_akeya.c b/src/lib/libssl/src/crypto/x509v3/v3_akeya.c
index 2c50f7360e..2bf84b4f1b 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_akeya.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_akeya.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_alt.c b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
index 636677df94..e61ed673c0 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_alt.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -61,178 +61,181 @@
61#include <openssl/conf.h> 61#include <openssl/conf.h>
62#include <openssl/x509v3.h> 62#include <openssl/x509v3.h>
63 63
64static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); 64static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
65static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); 65 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
66static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
67 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
66static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p); 68static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
67static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens); 69static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
68static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx); 70static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
69static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx); 71static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
70 72
71const X509V3_EXT_METHOD v3_alt[] = { 73const X509V3_EXT_METHOD v3_alt[] = {
72{ NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), 74 {
730,0,0,0, 75 NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
740,0, 76 0, 0, 0, 0,
75(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 77 0, 0,
76(X509V3_EXT_V2I)v2i_subject_alt, 78 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
77NULL, NULL, NULL}, 79 (X509V3_EXT_V2I)v2i_subject_alt,
78 80 NULL, NULL, NULL
79{ NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES), 81 },
800,0,0,0, 82 {
810,0, 83 NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
82(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 84 0, 0, 0, 0,
83(X509V3_EXT_V2I)v2i_issuer_alt, 85 0, 0,
84NULL, NULL, NULL}, 86 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
85 87 (X509V3_EXT_V2I)v2i_issuer_alt,
86{ NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES), 88 NULL, NULL, NULL
870,0,0,0, 89 },
880,0, 90 {
89(X509V3_EXT_I2V)i2v_GENERAL_NAMES, 91 NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
90NULL, NULL, NULL, NULL}, 92 0, 0, 0, 0,
93 0, 0,
94 (X509V3_EXT_I2V)i2v_GENERAL_NAMES,
95 NULL, NULL, NULL, NULL
96 },
91}; 97};
92 98
93STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, 99STACK_OF(CONF_VALUE) *
94 GENERAL_NAMES *gens, STACK_OF(CONF_VALUE) *ret) 100i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens,
101 STACK_OF(CONF_VALUE) *ret)
95{ 102{
96 int i; 103 int i;
97 GENERAL_NAME *gen; 104 GENERAL_NAME *gen;
98 for(i = 0; i < sk_GENERAL_NAME_num(gens); i++) { 105
106 for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
99 gen = sk_GENERAL_NAME_value(gens, i); 107 gen = sk_GENERAL_NAME_value(gens, i);
100 ret = i2v_GENERAL_NAME(method, gen, ret); 108 ret = i2v_GENERAL_NAME(method, gen, ret);
101 } 109 }
102 if(!ret) return sk_CONF_VALUE_new_null(); 110 if (!ret)
111 return sk_CONF_VALUE_new_null();
103 return ret; 112 return ret;
104} 113}
105 114
106STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, 115STACK_OF(CONF_VALUE) *
107 GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret) 116i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen,
117 STACK_OF(CONF_VALUE) *ret)
108{ 118{
109 unsigned char *p; 119 unsigned char *p;
110 char oline[256], htmp[5]; 120 char oline[256], htmp[5];
111 int i; 121 int i;
112 switch (gen->type) 122
113 { 123 switch (gen->type) {
114 case GEN_OTHERNAME: 124 case GEN_OTHERNAME:
115 X509V3_add_value("othername","<unsupported>", &ret); 125 X509V3_add_value("othername", "<unsupported>", &ret);
116 break; 126 break;
117 127
118 case GEN_X400: 128 case GEN_X400:
119 X509V3_add_value("X400Name","<unsupported>", &ret); 129 X509V3_add_value("X400Name", "<unsupported>", &ret);
120 break; 130 break;
121 131
122 case GEN_EDIPARTY: 132 case GEN_EDIPARTY:
123 X509V3_add_value("EdiPartyName","<unsupported>", &ret); 133 X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
124 break; 134 break;
125 135
126 case GEN_EMAIL: 136 case GEN_EMAIL:
127 X509V3_add_value_uchar("email",gen->d.ia5->data, &ret); 137 X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
128 break; 138 break;
129 139
130 case GEN_DNS: 140 case GEN_DNS:
131 X509V3_add_value_uchar("DNS",gen->d.ia5->data, &ret); 141 X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
132 break; 142 break;
133 143
134 case GEN_URI: 144 case GEN_URI:
135 X509V3_add_value_uchar("URI",gen->d.ia5->data, &ret); 145 X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
136 break; 146 break;
137 147
138 case GEN_DIRNAME: 148 case GEN_DIRNAME:
139 X509_NAME_oneline(gen->d.dirn, oline, 256); 149 X509_NAME_oneline(gen->d.dirn, oline, 256);
140 X509V3_add_value("DirName",oline, &ret); 150 X509V3_add_value("DirName", oline, &ret);
141 break; 151 break;
142 152
143 case GEN_IPADD: 153 case GEN_IPADD:
144 p = gen->d.ip->data; 154 p = gen->d.ip->data;
145 if(gen->d.ip->length == 4) 155 if (gen->d.ip->length == 4)
146 (void) snprintf(oline, sizeof oline, 156 (void) snprintf(oline, sizeof oline,
147 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]); 157 "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
148 else if(gen->d.ip->length == 16) 158 else if (gen->d.ip->length == 16) {
149 {
150 oline[0] = 0; 159 oline[0] = 0;
151 for (i = 0; i < 8; i++) 160 for (i = 0; i < 8; i++) {
152 {
153 (void) snprintf(htmp, sizeof htmp, 161 (void) snprintf(htmp, sizeof htmp,
154 "%X", p[0] << 8 | p[1]); 162 "%X", p[0] << 8 | p[1]);
155 p += 2; 163 p += 2;
156 strlcat(oline, htmp, sizeof(oline)); 164 strlcat(oline, htmp, sizeof(oline));
157 if (i != 7) 165 if (i != 7)
158 strlcat(oline, ":", sizeof(oline)); 166 strlcat(oline, ":", sizeof(oline));
159 }
160 } 167 }
161 else 168 } else {
162 { 169 X509V3_add_value("IP Address", "<invalid>", &ret);
163 X509V3_add_value("IP Address","<invalid>", &ret);
164 break; 170 break;
165 } 171 }
166 X509V3_add_value("IP Address",oline, &ret); 172 X509V3_add_value("IP Address", oline, &ret);
167 break; 173 break;
168 174
169 case GEN_RID: 175 case GEN_RID:
170 i2t_ASN1_OBJECT(oline, 256, gen->d.rid); 176 i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
171 X509V3_add_value("Registered ID",oline, &ret); 177 X509V3_add_value("Registered ID", oline, &ret);
172 break; 178 break;
173 } 179 }
174 return ret; 180 return ret;
175} 181}
176 182
177int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen) 183int
184GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
178{ 185{
179 unsigned char *p; 186 unsigned char *p;
180 int i; 187 int i;
181 switch (gen->type) 188
182 { 189 switch (gen->type) {
183 case GEN_OTHERNAME: 190 case GEN_OTHERNAME:
184 BIO_printf(out, "othername:<unsupported>"); 191 BIO_printf(out, "othername:<unsupported>");
185 break; 192 break;
186 193
187 case GEN_X400: 194 case GEN_X400:
188 BIO_printf(out, "X400Name:<unsupported>"); 195 BIO_printf(out, "X400Name:<unsupported>");
189 break; 196 break;
190 197
191 case GEN_EDIPARTY: 198 case GEN_EDIPARTY:
192 /* Maybe fix this: it is supported now */ 199 /* Maybe fix this: it is supported now */
193 BIO_printf(out, "EdiPartyName:<unsupported>"); 200 BIO_printf(out, "EdiPartyName:<unsupported>");
194 break; 201 break;
195 202
196 case GEN_EMAIL: 203 case GEN_EMAIL:
197 BIO_printf(out, "email:%s",gen->d.ia5->data); 204 BIO_printf(out, "email:%s", gen->d.ia5->data);
198 break; 205 break;
199 206
200 case GEN_DNS: 207 case GEN_DNS:
201 BIO_printf(out, "DNS:%s",gen->d.ia5->data); 208 BIO_printf(out, "DNS:%s", gen->d.ia5->data);
202 break; 209 break;
203 210
204 case GEN_URI: 211 case GEN_URI:
205 BIO_printf(out, "URI:%s",gen->d.ia5->data); 212 BIO_printf(out, "URI:%s", gen->d.ia5->data);
206 break; 213 break;
207 214
208 case GEN_DIRNAME: 215 case GEN_DIRNAME:
209 BIO_printf(out, "DirName: "); 216 BIO_printf(out, "DirName: ");
210 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE); 217 X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
211 break; 218 break;
212 219
213 case GEN_IPADD: 220 case GEN_IPADD:
214 p = gen->d.ip->data; 221 p = gen->d.ip->data;
215 if(gen->d.ip->length == 4) 222 if (gen->d.ip->length == 4)
216 BIO_printf(out, "IP Address:%d.%d.%d.%d", 223 BIO_printf(out, "IP Address:%d.%d.%d.%d",
217 p[0], p[1], p[2], p[3]); 224 p[0], p[1], p[2], p[3]);
218 else if(gen->d.ip->length == 16) 225 else if (gen->d.ip->length == 16) {
219 {
220 BIO_printf(out, "IP Address"); 226 BIO_printf(out, "IP Address");
221 for (i = 0; i < 8; i++) 227 for (i = 0; i < 8; i++) {
222 {
223 BIO_printf(out, ":%X", p[0] << 8 | p[1]); 228 BIO_printf(out, ":%X", p[0] << 8 | p[1]);
224 p += 2; 229 p += 2;
225 }
226 BIO_puts(out, "\n");
227 } 230 }
228 else 231 BIO_puts(out, "\n");
229 { 232 } else {
230 BIO_printf(out,"IP Address:<invalid>"); 233 BIO_printf(out, "IP Address:<invalid>");
231 break; 234 break;
232 } 235 }
233 break; 236 break;
234 237
235 case GEN_RID: 238 case GEN_RID:
236 BIO_printf(out, "Registered ID"); 239 BIO_printf(out, "Registered ID");
237 i2a_ASN1_OBJECT(out, gen->d.rid); 240 i2a_ASN1_OBJECT(out, gen->d.rid);
238 break; 241 break;
@@ -240,333 +243,348 @@ int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
240 return 1; 243 return 1;
241} 244}
242 245
243static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, 246static GENERAL_NAMES *
244 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 247v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
248 STACK_OF(CONF_VALUE) *nval)
245{ 249{
246 GENERAL_NAMES *gens = NULL; 250 GENERAL_NAMES *gens = NULL;
247 CONF_VALUE *cnf; 251 CONF_VALUE *cnf;
248 int i; 252 int i;
249 if(!(gens = sk_GENERAL_NAME_new_null())) { 253
250 X509V3err(X509V3_F_V2I_ISSUER_ALT,ERR_R_MALLOC_FAILURE); 254 if (!(gens = sk_GENERAL_NAME_new_null())) {
255 X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
251 return NULL; 256 return NULL;
252 } 257 }
253 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 258 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
254 cnf = sk_CONF_VALUE_value(nval, i); 259 cnf = sk_CONF_VALUE_value(nval, i);
255 if(!name_cmp(cnf->name, "issuer") && cnf->value && 260 if (!name_cmp(cnf->name, "issuer") && cnf->value &&
256 !strcmp(cnf->value, "copy")) { 261 !strcmp(cnf->value, "copy")) {
257 if(!copy_issuer(ctx, gens)) goto err; 262 if (!copy_issuer(ctx, gens))
263 goto err;
258 } else { 264 } else {
259 GENERAL_NAME *gen; 265 GENERAL_NAME *gen;
260 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) 266 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
261 goto err; 267 goto err;
262 sk_GENERAL_NAME_push(gens, gen); 268 sk_GENERAL_NAME_push(gens, gen);
263 } 269 }
264 } 270 }
265 return gens; 271 return gens;
266 err: 272
273err:
267 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 274 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
268 return NULL; 275 return NULL;
269} 276}
270 277
271/* Append subject altname of issuer to issuer alt name of subject */ 278/* Append subject altname of issuer to issuer alt name of subject */
272 279
273static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens) 280static int
281copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
274{ 282{
275 GENERAL_NAMES *ialt; 283 GENERAL_NAMES *ialt;
276 GENERAL_NAME *gen; 284 GENERAL_NAME *gen;
277 X509_EXTENSION *ext; 285 X509_EXTENSION *ext;
278 int i; 286 int i;
279 if(ctx && (ctx->flags == CTX_TEST)) return 1; 287
280 if(!ctx || !ctx->issuer_cert) { 288 if (ctx && (ctx->flags == CTX_TEST))
281 X509V3err(X509V3_F_COPY_ISSUER,X509V3_R_NO_ISSUER_DETAILS); 289 return 1;
290 if (!ctx || !ctx->issuer_cert) {
291 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
282 goto err; 292 goto err;
283 } 293 }
284 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1); 294 i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
285 if(i < 0) return 1; 295 if (i < 0)
286 if(!(ext = X509_get_ext(ctx->issuer_cert, i)) || 296 return 1;
287 !(ialt = X509V3_EXT_d2i(ext)) ) { 297 if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
288 X509V3err(X509V3_F_COPY_ISSUER,X509V3_R_ISSUER_DECODE_ERROR); 298 !(ialt = X509V3_EXT_d2i(ext))) {
299 X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
289 goto err; 300 goto err;
290 } 301 }
291 302
292 for(i = 0; i < sk_GENERAL_NAME_num(ialt); i++) { 303 for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
293 gen = sk_GENERAL_NAME_value(ialt, i); 304 gen = sk_GENERAL_NAME_value(ialt, i);
294 if(!sk_GENERAL_NAME_push(gens, gen)) { 305 if (!sk_GENERAL_NAME_push(gens, gen)) {
295 X509V3err(X509V3_F_COPY_ISSUER,ERR_R_MALLOC_FAILURE); 306 X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
296 goto err; 307 goto err;
297 } 308 }
298 } 309 }
299 sk_GENERAL_NAME_free(ialt); 310 sk_GENERAL_NAME_free(ialt);
300 311
301 return 1; 312 return 1;
302 313
303 err: 314err:
304 return 0; 315 return 0;
305 316
306} 317}
307 318
308static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, 319static GENERAL_NAMES *
309 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 320v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
321 STACK_OF(CONF_VALUE) *nval)
310{ 322{
311 GENERAL_NAMES *gens = NULL; 323 GENERAL_NAMES *gens = NULL;
312 CONF_VALUE *cnf; 324 CONF_VALUE *cnf;
313 int i; 325 int i;
314 if(!(gens = sk_GENERAL_NAME_new_null())) { 326
315 X509V3err(X509V3_F_V2I_SUBJECT_ALT,ERR_R_MALLOC_FAILURE); 327 if (!(gens = sk_GENERAL_NAME_new_null())) {
328 X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
316 return NULL; 329 return NULL;
317 } 330 }
318 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 331 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
319 cnf = sk_CONF_VALUE_value(nval, i); 332 cnf = sk_CONF_VALUE_value(nval, i);
320 if(!name_cmp(cnf->name, "email") && cnf->value && 333 if (!name_cmp(cnf->name, "email") && cnf->value &&
321 !strcmp(cnf->value, "copy")) { 334 !strcmp(cnf->value, "copy")) {
322 if(!copy_email(ctx, gens, 0)) goto err; 335 if (!copy_email(ctx, gens, 0))
323 } else if(!name_cmp(cnf->name, "email") && cnf->value && 336 goto err;
324 !strcmp(cnf->value, "move")) { 337 } else if (!name_cmp(cnf->name, "email") && cnf->value &&
325 if(!copy_email(ctx, gens, 1)) goto err; 338 !strcmp(cnf->value, "move")) {
339 if (!copy_email(ctx, gens, 1))
340 goto err;
326 } else { 341 } else {
327 GENERAL_NAME *gen; 342 GENERAL_NAME *gen;
328 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) 343 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
329 goto err; 344 goto err;
330 sk_GENERAL_NAME_push(gens, gen); 345 sk_GENERAL_NAME_push(gens, gen);
331 } 346 }
332 } 347 }
333 return gens; 348 return gens;
334 err: 349
350err:
335 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 351 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
336 return NULL; 352 return NULL;
337} 353}
338 354
339/* Copy any email addresses in a certificate or request to 355/* Copy any email addresses in a certificate or request to
340 * GENERAL_NAMES 356 * GENERAL_NAMES
341 */ 357 */
342 358
343static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p) 359static int
360copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
344{ 361{
345 X509_NAME *nm; 362 X509_NAME *nm;
346 ASN1_IA5STRING *email = NULL; 363 ASN1_IA5STRING *email = NULL;
347 X509_NAME_ENTRY *ne; 364 X509_NAME_ENTRY *ne;
348 GENERAL_NAME *gen = NULL; 365 GENERAL_NAME *gen = NULL;
349 int i; 366 int i;
350 if(ctx != NULL && ctx->flags == CTX_TEST) 367
368 if (ctx != NULL && ctx->flags == CTX_TEST)
351 return 1; 369 return 1;
352 if(!ctx || (!ctx->subject_cert && !ctx->subject_req)) { 370 if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
353 X509V3err(X509V3_F_COPY_EMAIL,X509V3_R_NO_SUBJECT_DETAILS); 371 X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
354 goto err; 372 goto err;
355 } 373 }
356 /* Find the subject name */ 374 /* Find the subject name */
357 if(ctx->subject_cert) nm = X509_get_subject_name(ctx->subject_cert); 375 if (ctx->subject_cert)
358 else nm = X509_REQ_get_subject_name(ctx->subject_req); 376 nm = X509_get_subject_name(ctx->subject_cert);
377 else
378 nm = X509_REQ_get_subject_name(ctx->subject_req);
359 379
360 /* Now add any email address(es) to STACK */ 380 /* Now add any email address(es) to STACK */
361 i = -1; 381 i = -1;
362 while((i = X509_NAME_get_index_by_NID(nm, 382 while ((i = X509_NAME_get_index_by_NID(nm,
363 NID_pkcs9_emailAddress, i)) >= 0) { 383 NID_pkcs9_emailAddress, i)) >= 0) {
364 ne = X509_NAME_get_entry(nm, i); 384 ne = X509_NAME_get_entry(nm, i);
365 email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne)); 385 email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
366 if (move_p) 386 if (move_p) {
367 { 387 X509_NAME_delete_entry(nm, i);
368 X509_NAME_delete_entry(nm, i);
369 X509_NAME_ENTRY_free(ne); 388 X509_NAME_ENTRY_free(ne);
370 i--; 389 i--;
371 } 390 }
372 if(!email || !(gen = GENERAL_NAME_new())) { 391 if (!email || !(gen = GENERAL_NAME_new())) {
373 X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE); 392 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
374 goto err; 393 goto err;
375 } 394 }
376 gen->d.ia5 = email; 395 gen->d.ia5 = email;
377 email = NULL; 396 email = NULL;
378 gen->type = GEN_EMAIL; 397 gen->type = GEN_EMAIL;
379 if(!sk_GENERAL_NAME_push(gens, gen)) { 398 if (!sk_GENERAL_NAME_push(gens, gen)) {
380 X509V3err(X509V3_F_COPY_EMAIL,ERR_R_MALLOC_FAILURE); 399 X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
381 goto err; 400 goto err;
382 } 401 }
383 gen = NULL; 402 gen = NULL;
384 } 403 }
385 404
386
387 return 1; 405 return 1;
388 406
389 err: 407err:
390 GENERAL_NAME_free(gen); 408 GENERAL_NAME_free(gen);
391 M_ASN1_IA5STRING_free(email); 409 M_ASN1_IA5STRING_free(email);
392 return 0; 410 return 0;
393
394} 411}
395 412
396GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, 413GENERAL_NAMES *
397 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) 414v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
415 STACK_OF(CONF_VALUE) *nval)
398{ 416{
399 GENERAL_NAME *gen; 417 GENERAL_NAME *gen;
400 GENERAL_NAMES *gens = NULL; 418 GENERAL_NAMES *gens = NULL;
401 CONF_VALUE *cnf; 419 CONF_VALUE *cnf;
402 int i; 420 int i;
403 if(!(gens = sk_GENERAL_NAME_new_null())) { 421
404 X509V3err(X509V3_F_V2I_GENERAL_NAMES,ERR_R_MALLOC_FAILURE); 422 if (!(gens = sk_GENERAL_NAME_new_null())) {
423 X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
405 return NULL; 424 return NULL;
406 } 425 }
407 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) { 426 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
408 cnf = sk_CONF_VALUE_value(nval, i); 427 cnf = sk_CONF_VALUE_value(nval, i);
409 if(!(gen = v2i_GENERAL_NAME(method, ctx, cnf))) goto err; 428 if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
429 goto err;
410 sk_GENERAL_NAME_push(gens, gen); 430 sk_GENERAL_NAME_push(gens, gen);
411 } 431 }
412 return gens; 432 return gens;
413 err: 433
434err:
414 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 435 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
415 return NULL; 436 return NULL;
416} 437}
417 438
418GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, 439GENERAL_NAME *
419 CONF_VALUE *cnf) 440v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
420 { 441 CONF_VALUE *cnf)
442{
421 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0); 443 return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
422 } 444}
423 445
424GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out, 446GENERAL_NAME *
425 const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, 447a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
426 int gen_type, char *value, int is_nc) 448 X509V3_CTX *ctx, int gen_type, char *value, int is_nc)
427 { 449{
428 char is_string = 0; 450 char is_string = 0;
429 GENERAL_NAME *gen = NULL; 451 GENERAL_NAME *gen = NULL;
430 452
431 if(!value) 453 if (!value) {
432 { 454 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
433 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_MISSING_VALUE);
434 return NULL; 455 return NULL;
435 } 456 }
436 457
437 if (out) 458 if (out)
438 gen = out; 459 gen = out;
439 else 460 else {
440 {
441 gen = GENERAL_NAME_new(); 461 gen = GENERAL_NAME_new();
442 if(gen == NULL) 462 if (gen == NULL) {
443 { 463 X509V3err(X509V3_F_A2I_GENERAL_NAME,
444 X509V3err(X509V3_F_A2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE); 464 ERR_R_MALLOC_FAILURE);
445 return NULL; 465 return NULL;
446 }
447 } 466 }
467 }
448 468
449 switch (gen_type) 469 switch (gen_type) {
450 { 470 case GEN_URI:
451 case GEN_URI: 471 case GEN_EMAIL:
452 case GEN_EMAIL: 472 case GEN_DNS:
453 case GEN_DNS:
454 is_string = 1; 473 is_string = 1;
455 break; 474 break;
456 475
457 case GEN_RID: 476 case GEN_RID:
458 { 477 {
459 ASN1_OBJECT *obj; 478 ASN1_OBJECT *obj;
460 if(!(obj = OBJ_txt2obj(value,0))) 479 if (!(obj = OBJ_txt2obj(value, 0))) {
461 { 480 X509V3err(X509V3_F_A2I_GENERAL_NAME,
462 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_BAD_OBJECT); 481 X509V3_R_BAD_OBJECT);
463 ERR_add_error_data(2, "value=", value); 482 ERR_add_error_data(2, "value=", value);
464 goto err; 483 goto err;
465 } 484 }
466 gen->d.rid = obj; 485 gen->d.rid = obj;
467 } 486 }
468 break; 487 break;
469 488
470 case GEN_IPADD: 489 case GEN_IPADD:
471 if (is_nc) 490 if (is_nc)
472 gen->d.ip = a2i_IPADDRESS_NC(value); 491 gen->d.ip = a2i_IPADDRESS_NC(value);
473 else 492 else
474 gen->d.ip = a2i_IPADDRESS(value); 493 gen->d.ip = a2i_IPADDRESS(value);
475 if(gen->d.ip == NULL) 494 if (gen->d.ip == NULL) {
476 { 495 X509V3err(X509V3_F_A2I_GENERAL_NAME,
477 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_BAD_IP_ADDRESS); 496 X509V3_R_BAD_IP_ADDRESS);
478 ERR_add_error_data(2, "value=", value); 497 ERR_add_error_data(2, "value=", value);
479 goto err; 498 goto err;
480 } 499 }
481 break; 500 break;
482 501
483 case GEN_DIRNAME: 502 case GEN_DIRNAME:
484 if (!do_dirname(gen, value, ctx)) 503 if (!do_dirname(gen, value, ctx)) {
485 { 504 X509V3err(X509V3_F_A2I_GENERAL_NAME,
486 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_DIRNAME_ERROR); 505 X509V3_R_DIRNAME_ERROR);
487 goto err; 506 goto err;
488 } 507 }
489 break; 508 break;
490 509
491 case GEN_OTHERNAME: 510 case GEN_OTHERNAME:
492 if (!do_othername(gen, value, ctx)) 511 if (!do_othername(gen, value, ctx)) {
493 { 512 X509V3err(X509V3_F_A2I_GENERAL_NAME,
494 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_OTHERNAME_ERROR); 513 X509V3_R_OTHERNAME_ERROR);
495 goto err; 514 goto err;
496 } 515 }
497 break; 516 break;
498 default: 517
499 X509V3err(X509V3_F_A2I_GENERAL_NAME,X509V3_R_UNSUPPORTED_TYPE); 518 default:
519 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
500 goto err; 520 goto err;
501 } 521 }
502 522
503 if(is_string) 523 if (is_string) {
504 { 524 if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
505 if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) || 525 !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
506 !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value, 526 strlen(value))) {
507 strlen(value))) 527 X509V3err(X509V3_F_A2I_GENERAL_NAME,
508 { 528 ERR_R_MALLOC_FAILURE);
509 X509V3err(X509V3_F_A2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
510 goto err; 529 goto err;
511 }
512 } 530 }
531 }
513 532
514 gen->type = gen_type; 533 gen->type = gen_type;
515 534
516 return gen; 535 return gen;
517 536
518 err: 537err:
519 if (!out) 538 if (!out)
520 GENERAL_NAME_free(gen); 539 GENERAL_NAME_free(gen);
521 return NULL; 540 return NULL;
522 } 541}
523 542
524GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, 543GENERAL_NAME *
525 const X509V3_EXT_METHOD *method, 544v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
526 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc) 545 X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
527 { 546{
528 int type; 547 int type;
529
530 char *name, *value; 548 char *name, *value;
531 549
532 name = cnf->name; 550 name = cnf->name;
533 value = cnf->value; 551 value = cnf->value;
534 552
535 if(!value) 553 if (!value) {
536 { 554 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
537 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_MISSING_VALUE);
538 return NULL; 555 return NULL;
539 } 556 }
540 557
541 if(!name_cmp(name, "email")) 558 if (!name_cmp(name, "email"))
542 type = GEN_EMAIL; 559 type = GEN_EMAIL;
543 else if(!name_cmp(name, "URI")) 560 else if (!name_cmp(name, "URI"))
544 type = GEN_URI; 561 type = GEN_URI;
545 else if(!name_cmp(name, "DNS")) 562 else if (!name_cmp(name, "DNS"))
546 type = GEN_DNS; 563 type = GEN_DNS;
547 else if(!name_cmp(name, "RID")) 564 else if (!name_cmp(name, "RID"))
548 type = GEN_RID; 565 type = GEN_RID;
549 else if(!name_cmp(name, "IP")) 566 else if (!name_cmp(name, "IP"))
550 type = GEN_IPADD; 567 type = GEN_IPADD;
551 else if(!name_cmp(name, "dirName")) 568 else if (!name_cmp(name, "dirName"))
552 type = GEN_DIRNAME; 569 type = GEN_DIRNAME;
553 else if(!name_cmp(name, "otherName")) 570 else if (!name_cmp(name, "otherName"))
554 type = GEN_OTHERNAME; 571 type = GEN_OTHERNAME;
555 else 572 else {
556 { 573 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,
557 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_UNSUPPORTED_OPTION); 574 X509V3_R_UNSUPPORTED_OPTION);
558 ERR_add_error_data(2, "name=", name); 575 ERR_add_error_data(2, "name=", name);
559 return NULL; 576 return NULL;
560 } 577 }
561 578
562 return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc); 579 return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
580}
563 581
564 } 582static int
565 583do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
566static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx) 584{
567 {
568 char *objtmp = NULL, *p; 585 char *objtmp = NULL, *p;
569 int objlen; 586 int objlen;
587
570 if (!(p = strchr(value, ';'))) 588 if (!(p = strchr(value, ';')))
571 return 0; 589 return 0;
572 if (!(gen->d.otherName = OTHERNAME_new())) 590 if (!(gen->d.otherName = OTHERNAME_new()))
@@ -588,29 +606,30 @@ static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
588 if (!gen->d.otherName->type_id) 606 if (!gen->d.otherName->type_id)
589 return 0; 607 return 0;
590 return 1; 608 return 1;
591 } 609}
592 610
593static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx) 611static int
594 { 612do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
613{
595 int ret; 614 int ret;
596 STACK_OF(CONF_VALUE) *sk; 615 STACK_OF(CONF_VALUE) *sk;
597 X509_NAME *nm; 616 X509_NAME *nm;
617
598 if (!(nm = X509_NAME_new())) 618 if (!(nm = X509_NAME_new()))
599 return 0; 619 return 0;
600 sk = X509V3_get_section(ctx, value); 620 sk = X509V3_get_section(ctx, value);
601 if (!sk) 621 if (!sk) {
602 { 622 X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
603 X509V3err(X509V3_F_DO_DIRNAME,X509V3_R_SECTION_NOT_FOUND);
604 ERR_add_error_data(2, "section=", value); 623 ERR_add_error_data(2, "section=", value);
605 X509_NAME_free(nm); 624 X509_NAME_free(nm);
606 return 0; 625 return 0;
607 } 626 }
608 /* FIXME: should allow other character types... */ 627 /* FIXME: should allow other character types... */
609 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC); 628 ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
610 if (!ret) 629 if (!ret)
611 X509_NAME_free(nm); 630 X509_NAME_free(nm);
612 gen->d.dirn = nm; 631 gen->d.dirn = nm;
613 X509V3_section_free(ctx, sk); 632 X509V3_section_free(ctx, sk);
614 633
615 return ret; 634 return ret;
616 } 635}
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_asid.c b/src/lib/libssl/src/crypto/x509v3/v3_asid.c
index 325c8e0406..6335a31d19 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_asid.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_asid.c
@@ -10,7 +10,7 @@
10 * are met: 10 * are met:
11 * 11 *
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 14 *
15 * 2. Redistributions in binary form must reproduce the above copyright 15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in 16 * notice, this list of conditions and the following disclaimer in
@@ -76,23 +76,23 @@
76 */ 76 */
77 77
78ASN1_SEQUENCE(ASRange) = { 78ASN1_SEQUENCE(ASRange) = {
79 ASN1_SIMPLE(ASRange, min, ASN1_INTEGER), 79 ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
80 ASN1_SIMPLE(ASRange, max, ASN1_INTEGER) 80 ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
81} ASN1_SEQUENCE_END(ASRange) 81} ASN1_SEQUENCE_END(ASRange)
82 82
83ASN1_CHOICE(ASIdOrRange) = { 83ASN1_CHOICE(ASIdOrRange) = {
84 ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER), 84 ASN1_SIMPLE(ASIdOrRange, u.id, ASN1_INTEGER),
85 ASN1_SIMPLE(ASIdOrRange, u.range, ASRange) 85 ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
86} ASN1_CHOICE_END(ASIdOrRange) 86} ASN1_CHOICE_END(ASIdOrRange)
87 87
88ASN1_CHOICE(ASIdentifierChoice) = { 88ASN1_CHOICE(ASIdentifierChoice) = {
89 ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL), 89 ASN1_SIMPLE(ASIdentifierChoice, u.inherit, ASN1_NULL),
90 ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange) 90 ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
91} ASN1_CHOICE_END(ASIdentifierChoice) 91} ASN1_CHOICE_END(ASIdentifierChoice)
92 92
93ASN1_SEQUENCE(ASIdentifiers) = { 93ASN1_SEQUENCE(ASIdentifiers) = {
94 ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0), 94 ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
95 ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1) 95 ASN1_EXP_OPT(ASIdentifiers, rdi, ASIdentifierChoice, 1)
96} ASN1_SEQUENCE_END(ASIdentifiers) 96} ASN1_SEQUENCE_END(ASIdentifiers)
97 97
98IMPLEMENT_ASN1_FUNCTIONS(ASRange) 98IMPLEMENT_ASN1_FUNCTIONS(ASRange)
@@ -103,628 +103,662 @@ IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
103/* 103/*
104 * i2r method for an ASIdentifierChoice. 104 * i2r method for an ASIdentifierChoice.
105 */ 105 */
106static int i2r_ASIdentifierChoice(BIO *out, 106static int
107 ASIdentifierChoice *choice, 107i2r_ASIdentifierChoice(BIO *out, ASIdentifierChoice *choice, int indent,
108 int indent, 108 const char *msg)
109 const char *msg)
110{ 109{
111 int i; 110 int i;
112 char *s; 111 char *s;
113 if (choice == NULL) 112
114 return 1; 113 if (choice == NULL)
115 BIO_printf(out, "%*s%s:\n", indent, "", msg); 114 return 1;
116 switch (choice->type) { 115 BIO_printf(out, "%*s%s:\n", indent, "", msg);
117 case ASIdentifierChoice_inherit: 116 switch (choice->type) {
118 BIO_printf(out, "%*sinherit\n", indent + 2, ""); 117 case ASIdentifierChoice_inherit:
119 break; 118 BIO_printf(out, "%*sinherit\n", indent + 2, "");
120 case ASIdentifierChoice_asIdsOrRanges: 119 break;
121 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) { 120 case ASIdentifierChoice_asIdsOrRanges:
122 ASIdOrRange *aor = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 121 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges);
123 switch (aor->type) { 122 i++) {
124 case ASIdOrRange_id: 123 ASIdOrRange *aor =
125 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL) 124 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
126 return 0; 125 switch (aor->type) {
127 BIO_printf(out, "%*s%s\n", indent + 2, "", s); 126 case ASIdOrRange_id:
128 free(s); 127 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) ==
129 break; 128 NULL)
130 case ASIdOrRange_range: 129 return 0;
131 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL) 130 BIO_printf(out, "%*s%s\n", indent + 2, "", s);
132 return 0; 131 free(s);
133 BIO_printf(out, "%*s%s-", indent + 2, "", s); 132 break;
134 free(s); 133 case ASIdOrRange_range:
135 if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL) 134 if ((s = i2s_ASN1_INTEGER(NULL,
136 return 0; 135 aor->u.range->min)) == NULL)
137 BIO_printf(out, "%s\n", s); 136 return 0;
138 free(s); 137 BIO_printf(out, "%*s%s-", indent + 2, "", s);
139 break; 138 free(s);
140 default: 139 if ((s = i2s_ASN1_INTEGER(NULL,
141 return 0; 140 aor->u.range->max)) == NULL)
142 } 141 return 0;
143 } 142 BIO_printf(out, "%s\n", s);
144 break; 143 free(s);
145 default: 144 break;
146 return 0; 145 default:
147 } 146 return 0;
148 return 1; 147 }
148 }
149 break;
150
151 default:
152 return 0;
153 }
154 return 1;
149} 155}
150 156
151/* 157/*
152 * i2r method for an ASIdentifier extension. 158 * i2r method for an ASIdentifier extension.
153 */ 159 */
154static int i2r_ASIdentifiers(const X509V3_EXT_METHOD *method, 160static int
155 void *ext, 161i2r_ASIdentifiers(const X509V3_EXT_METHOD *method, void *ext, BIO *out,
156 BIO *out, 162 int indent)
157 int indent)
158{ 163{
159 ASIdentifiers *asid = ext; 164 ASIdentifiers *asid = ext;
160 return (i2r_ASIdentifierChoice(out, asid->asnum, indent, 165
161 "Autonomous System Numbers") && 166 return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
162 i2r_ASIdentifierChoice(out, asid->rdi, indent, 167 "Autonomous System Numbers") &&
163 "Routing Domain Identifiers")); 168 i2r_ASIdentifierChoice(out, asid->rdi, indent,
169 "Routing Domain Identifiers"));
164} 170}
165 171
166/* 172/*
167 * Sort comparision function for a sequence of ASIdOrRange elements. 173 * Sort comparision function for a sequence of ASIdOrRange elements.
168 */ 174 */
169static int ASIdOrRange_cmp(const ASIdOrRange * const *a_, 175static int
170 const ASIdOrRange * const *b_) 176ASIdOrRange_cmp(const ASIdOrRange * const *a_, const ASIdOrRange * const *b_)
171{ 177{
172 const ASIdOrRange *a = *a_, *b = *b_; 178 const ASIdOrRange *a = *a_, *b = *b_;
173 179
174 OPENSSL_assert((a->type == ASIdOrRange_id && a->u.id != NULL) || 180 OPENSSL_assert((a->type == ASIdOrRange_id && a->u.id != NULL) ||
175 (a->type == ASIdOrRange_range && a->u.range != NULL && 181 (a->type == ASIdOrRange_range && a->u.range != NULL &&
176 a->u.range->min != NULL && a->u.range->max != NULL)); 182 a->u.range->min != NULL && a->u.range->max != NULL));
177 183
178 OPENSSL_assert((b->type == ASIdOrRange_id && b->u.id != NULL) || 184 OPENSSL_assert((b->type == ASIdOrRange_id && b->u.id != NULL) ||
179 (b->type == ASIdOrRange_range && b->u.range != NULL && 185 (b->type == ASIdOrRange_range && b->u.range != NULL &&
180 b->u.range->min != NULL && b->u.range->max != NULL)); 186 b->u.range->min != NULL && b->u.range->max != NULL));
181 187
182 if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id) 188 if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
183 return ASN1_INTEGER_cmp(a->u.id, b->u.id); 189 return ASN1_INTEGER_cmp(a->u.id, b->u.id);
184 190
185 if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) { 191 if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
186 int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min); 192 int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
187 return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max, b->u.range->max); 193 return r != 0 ? r :
188 } 194 ASN1_INTEGER_cmp(a->u.range->max, b->u.range->max);
195 }
189 196
190 if (a->type == ASIdOrRange_id) 197 if (a->type == ASIdOrRange_id)
191 return ASN1_INTEGER_cmp(a->u.id, b->u.range->min); 198 return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
192 else 199 else
193 return ASN1_INTEGER_cmp(a->u.range->min, b->u.id); 200 return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
194} 201}
195 202
196/* 203/*
197 * Add an inherit element. 204 * Add an inherit element.
198 */ 205 */
199int v3_asid_add_inherit(ASIdentifiers *asid, int which) 206int
207v3_asid_add_inherit(ASIdentifiers *asid, int which)
200{ 208{
201 ASIdentifierChoice **choice; 209 ASIdentifierChoice **choice;
202 if (asid == NULL) 210
203 return 0; 211 if (asid == NULL)
204 switch (which) { 212 return 0;
205 case V3_ASID_ASNUM: 213 switch (which) {
206 choice = &asid->asnum; 214 case V3_ASID_ASNUM:
207 break; 215 choice = &asid->asnum;
208 case V3_ASID_RDI: 216 break;
209 choice = &asid->rdi; 217 case V3_ASID_RDI:
210 break; 218 choice = &asid->rdi;
211 default: 219 break;
212 return 0; 220 default:
213 } 221 return 0;
214 if (*choice == NULL) { 222 }
215 if ((*choice = ASIdentifierChoice_new()) == NULL) 223 if (*choice == NULL) {
216 return 0; 224 if ((*choice = ASIdentifierChoice_new()) == NULL)
217 OPENSSL_assert((*choice)->u.inherit == NULL); 225 return 0;
218 if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL) 226 OPENSSL_assert((*choice)->u.inherit == NULL);
219 return 0; 227 if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL)
220 (*choice)->type = ASIdentifierChoice_inherit; 228 return 0;
221 } 229 (*choice)->type = ASIdentifierChoice_inherit;
222 return (*choice)->type == ASIdentifierChoice_inherit; 230 }
231 return (*choice)->type == ASIdentifierChoice_inherit;
223} 232}
224 233
225/* 234/*
226 * Add an ID or range to an ASIdentifierChoice. 235 * Add an ID or range to an ASIdentifierChoice.
227 */ 236 */
228int v3_asid_add_id_or_range(ASIdentifiers *asid, 237int
229 int which, 238v3_asid_add_id_or_range(ASIdentifiers *asid, int which, ASN1_INTEGER *min,
230 ASN1_INTEGER *min, 239 ASN1_INTEGER *max)
231 ASN1_INTEGER *max)
232{ 240{
233 ASIdentifierChoice **choice; 241 ASIdentifierChoice **choice;
234 ASIdOrRange *aor; 242 ASIdOrRange *aor;
235 if (asid == NULL) 243
236 return 0; 244 if (asid == NULL)
237 switch (which) { 245 return 0;
238 case V3_ASID_ASNUM: 246 switch (which) {
239 choice = &asid->asnum; 247 case V3_ASID_ASNUM:
240 break; 248 choice = &asid->asnum;
241 case V3_ASID_RDI: 249 break;
242 choice = &asid->rdi; 250 case V3_ASID_RDI:
243 break; 251 choice = &asid->rdi;
244 default: 252 break;
245 return 0; 253 default:
246 } 254 return 0;
247 if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit) 255 }
248 return 0; 256 if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit)
249 if (*choice == NULL) { 257 return 0;
250 if ((*choice = ASIdentifierChoice_new()) == NULL) 258 if (*choice == NULL) {
251 return 0; 259 if ((*choice = ASIdentifierChoice_new()) == NULL)
252 OPENSSL_assert((*choice)->u.asIdsOrRanges == NULL); 260 return 0;
253 (*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp); 261 OPENSSL_assert((*choice)->u.asIdsOrRanges == NULL);
254 if ((*choice)->u.asIdsOrRanges == NULL) 262 (*choice)->u.asIdsOrRanges =
255 return 0; 263 sk_ASIdOrRange_new(ASIdOrRange_cmp);
256 (*choice)->type = ASIdentifierChoice_asIdsOrRanges; 264 if ((*choice)->u.asIdsOrRanges == NULL)
257 } 265 return 0;
258 if ((aor = ASIdOrRange_new()) == NULL) 266 (*choice)->type = ASIdentifierChoice_asIdsOrRanges;
259 return 0; 267 }
260 if (max == NULL) { 268 if ((aor = ASIdOrRange_new()) == NULL)
261 aor->type = ASIdOrRange_id; 269 return 0;
262 aor->u.id = min; 270 if (max == NULL) {
263 } else { 271 aor->type = ASIdOrRange_id;
264 aor->type = ASIdOrRange_range; 272 aor->u.id = min;
265 if ((aor->u.range = ASRange_new()) == NULL) 273 } else {
266 goto err; 274 aor->type = ASIdOrRange_range;
267 ASN1_INTEGER_free(aor->u.range->min); 275 if ((aor->u.range = ASRange_new()) == NULL)
268 aor->u.range->min = min; 276 goto err;
269 ASN1_INTEGER_free(aor->u.range->max); 277 ASN1_INTEGER_free(aor->u.range->min);
270 aor->u.range->max = max; 278 aor->u.range->min = min;
271 } 279 ASN1_INTEGER_free(aor->u.range->max);
272 if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor))) 280 aor->u.range->max = max;
273 goto err; 281 }
274 return 1; 282 if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
275 283 goto err;
276 err: 284 return 1;
277 ASIdOrRange_free(aor); 285
278 return 0; 286err:
287 ASIdOrRange_free(aor);
288 return 0;
279} 289}
280 290
281/* 291/*
282 * Extract min and max values from an ASIdOrRange. 292 * Extract min and max values from an ASIdOrRange.
283 */ 293 */
284static void extract_min_max(ASIdOrRange *aor, 294static void
285 ASN1_INTEGER **min, 295extract_min_max(ASIdOrRange *aor, ASN1_INTEGER **min, ASN1_INTEGER **max)
286 ASN1_INTEGER **max)
287{ 296{
288 OPENSSL_assert(aor != NULL && min != NULL && max != NULL); 297 OPENSSL_assert(aor != NULL && min != NULL && max != NULL);
289 switch (aor->type) { 298
290 case ASIdOrRange_id: 299 switch (aor->type) {
291 *min = aor->u.id; 300 case ASIdOrRange_id:
292 *max = aor->u.id; 301 *min = aor->u.id;
293 return; 302 *max = aor->u.id;
294 case ASIdOrRange_range: 303 return;
295 *min = aor->u.range->min; 304 case ASIdOrRange_range:
296 *max = aor->u.range->max; 305 *min = aor->u.range->min;
297 return; 306 *max = aor->u.range->max;
298 } 307 return;
308 }
299} 309}
300 310
301/* 311/*
302 * Check whether an ASIdentifierChoice is in canonical form. 312 * Check whether an ASIdentifierChoice is in canonical form.
303 */ 313 */
304static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice) 314static int
315ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
305{ 316{
306 ASN1_INTEGER *a_max_plus_one = NULL; 317 ASN1_INTEGER *a_max_plus_one = NULL;
307 BIGNUM *bn = NULL; 318 BIGNUM *bn = NULL;
308 int i, ret = 0; 319 int i, ret = 0;
309 320
310 /* 321 /*
311 * Empty element or inheritance is canonical. 322 * Empty element or inheritance is canonical.
312 */ 323 */
313 if (choice == NULL || choice->type == ASIdentifierChoice_inherit) 324 if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
314 return 1; 325 return 1;
315 326
316 /* 327 /*
317 * If not a list, or if empty list, it's broken. 328 * If not a list, or if empty list, it's broken.
318 */ 329 */
319 if (choice->type != ASIdentifierChoice_asIdsOrRanges || 330 if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
320 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) 331 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
321 return 0; 332 return 0;
322 333
323 /* 334 /*
324 * It's a list, check it. 335 * It's a list, check it.
325 */ 336 */
326 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) { 337 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
327 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 338 ASIdOrRange *a =
328 ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1); 339 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
329 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max; 340 ASIdOrRange *b =
330 341 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
331 extract_min_max(a, &a_min, &a_max); 342 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
332 extract_min_max(b, &b_min, &b_max); 343
333 344 extract_min_max(a, &a_min, &a_max);
334 /* 345 extract_min_max(b, &b_min, &b_max);
335 * Punt misordered list, overlapping start, or inverted range. 346
336 */ 347 /*
337 if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 || 348 * Punt misordered list, overlapping start, or inverted range.
338 ASN1_INTEGER_cmp(a_min, a_max) > 0 || 349 */
339 ASN1_INTEGER_cmp(b_min, b_max) > 0) 350 if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
340 goto done; 351 ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
341 352 ASN1_INTEGER_cmp(b_min, b_max) > 0)
342 /* 353 goto done;
343 * Calculate a_max + 1 to check for adjacency. 354
344 */ 355 /*
345 if ((bn == NULL && (bn = BN_new()) == NULL) || 356 * Calculate a_max + 1 to check for adjacency.
346 ASN1_INTEGER_to_BN(a_max, bn) == NULL || 357 */
347 !BN_add_word(bn, 1) || 358 if ((bn == NULL && (bn = BN_new()) == NULL) ||
348 (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) { 359 ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
349 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL, 360 !BN_add_word(bn, 1) || (a_max_plus_one =
350 ERR_R_MALLOC_FAILURE); 361 BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
351 goto done; 362 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
352 } 363 ERR_R_MALLOC_FAILURE);
353 364 goto done;
354 /* 365 }
355 * Punt if adjacent or overlapping. 366
356 */ 367 /*
357 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0) 368 * Punt if adjacent or overlapping.
358 goto done; 369 */
359 } 370 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
360 371 goto done;
361 /* 372 }
362 * Check for inverted range. 373
363 */ 374 /*
364 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; 375 * Check for inverted range.
365 { 376 */
366 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i); 377 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
367 ASN1_INTEGER *a_min, *a_max; 378 {
368 if (a != NULL && a->type == ASIdOrRange_range) { 379 ASIdOrRange *a =
369 extract_min_max(a, &a_min, &a_max); 380 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
370 if (ASN1_INTEGER_cmp(a_min, a_max) > 0) 381 ASN1_INTEGER *a_min, *a_max;
371 goto done; 382
372 } 383 if (a != NULL && a->type == ASIdOrRange_range) {
373 } 384 extract_min_max(a, &a_min, &a_max);
374 385 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
375 ret = 1; 386 goto done;
376 387 }
377 done: 388 }
378 ASN1_INTEGER_free(a_max_plus_one); 389
379 BN_free(bn); 390 ret = 1;
380 return ret; 391
392done:
393 ASN1_INTEGER_free(a_max_plus_one);
394 BN_free(bn);
395 return ret;
381} 396}
382 397
383/* 398/*
384 * Check whether an ASIdentifier extension is in canonical form. 399 * Check whether an ASIdentifier extension is in canonical form.
385 */ 400 */
386int v3_asid_is_canonical(ASIdentifiers *asid) 401int
402v3_asid_is_canonical(ASIdentifiers *asid)
387{ 403{
388 return (asid == NULL || 404 return (asid == NULL ||
389 (ASIdentifierChoice_is_canonical(asid->asnum) && 405 (ASIdentifierChoice_is_canonical(asid->asnum) &&
390 ASIdentifierChoice_is_canonical(asid->rdi))); 406 ASIdentifierChoice_is_canonical(asid->rdi)));
391} 407}
392 408
393/* 409/*
394 * Whack an ASIdentifierChoice into canonical form. 410 * Whack an ASIdentifierChoice into canonical form.
395 */ 411 */
396static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice) 412static int
413ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
397{ 414{
398 ASN1_INTEGER *a_max_plus_one = NULL; 415 ASN1_INTEGER *a_max_plus_one = NULL;
399 BIGNUM *bn = NULL; 416 BIGNUM *bn = NULL;
400 int i, ret = 0; 417 int i, ret = 0;
401 418
402 /* 419 /*
403 * Nothing to do for empty element or inheritance. 420 * Nothing to do for empty element or inheritance.
404 */ 421 */
405 if (choice == NULL || choice->type == ASIdentifierChoice_inherit) 422 if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
406 return 1; 423 return 1;
407 424
408 /* 425 /*
409 * If not a list, or if empty list, it's broken. 426 * If not a list, or if empty list, it's broken.
410 */ 427 */
411 if (choice->type != ASIdentifierChoice_asIdsOrRanges || 428 if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
412 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) { 429 sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
413 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, 430 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
414 X509V3_R_EXTENSION_VALUE_ERROR);
415 return 0;
416 }
417
418 /*
419 * We have a non-empty list. Sort it.
420 */
421 sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
422
423 /*
424 * Now check for errors and suboptimal encoding, rejecting the
425 * former and fixing the latter.
426 */
427 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
428 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
429 ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
430 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
431
432 extract_min_max(a, &a_min, &a_max);
433 extract_min_max(b, &b_min, &b_max);
434
435 /*
436 * Make sure we're properly sorted (paranoia).
437 */
438 OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
439
440 /*
441 * Punt inverted ranges.
442 */
443 if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
444 ASN1_INTEGER_cmp(b_min, b_max) > 0)
445 goto done;
446
447 /*
448 * Check for overlaps.
449 */
450 if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
451 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
452 X509V3_R_EXTENSION_VALUE_ERROR); 431 X509V3_R_EXTENSION_VALUE_ERROR);
453 goto done; 432 return 0;
454 } 433 }
455 434
456 /* 435 /*
457 * Calculate a_max + 1 to check for adjacency. 436 * We have a non-empty list. Sort it.
458 */ 437 */
459 if ((bn == NULL && (bn = BN_new()) == NULL) || 438 sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
460 ASN1_INTEGER_to_BN(a_max, bn) == NULL || 439
461 !BN_add_word(bn, 1) || 440 /*
462 (a_max_plus_one = BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) { 441 * Now check for errors and suboptimal encoding, rejecting the
463 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, ERR_R_MALLOC_FAILURE); 442 * former and fixing the latter.
464 goto done; 443 */
465 } 444 for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
466 445 ASIdOrRange *a =
467 /* 446 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
468 * If a and b are adjacent, merge them. 447 ASIdOrRange *b =
469 */ 448 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
470 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) { 449 ASN1_INTEGER *a_min, *a_max, *b_min, *b_max;
471 ASRange *r; 450
472 switch (a->type) { 451 extract_min_max(a, &a_min, &a_max);
473 case ASIdOrRange_id: 452 extract_min_max(b, &b_min, &b_max);
474 if ((r = malloc(sizeof(ASRange))) == NULL) { 453
475 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE, 454 /*
476 ERR_R_MALLOC_FAILURE); 455 * Make sure we're properly sorted (paranoia).
477 goto done; 456 */
457 OPENSSL_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0);
458
459 /*
460 * Punt inverted ranges.
461 */
462 if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
463 ASN1_INTEGER_cmp(b_min, b_max) > 0)
464 goto done;
465
466 /*
467 * Check for overlaps.
468 */
469 if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
470 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
471 X509V3_R_EXTENSION_VALUE_ERROR);
472 goto done;
473 }
474
475 /*
476 * Calculate a_max + 1 to check for adjacency.
477 */
478 if ((bn == NULL && (bn = BN_new()) == NULL) ||
479 ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
480 !BN_add_word(bn, 1) || (a_max_plus_one =
481 BN_to_ASN1_INTEGER(bn, a_max_plus_one)) == NULL) {
482 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
483 ERR_R_MALLOC_FAILURE);
484 goto done;
485 }
486
487 /*
488 * If a and b are adjacent, merge them.
489 */
490 if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
491 ASRange *r;
492 switch (a->type) {
493 case ASIdOrRange_id:
494 if ((r = malloc(sizeof(ASRange))) == NULL) {
495 X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
496 ERR_R_MALLOC_FAILURE);
497 goto done;
498 }
499 r->min = a_min;
500 r->max = b_max;
501 a->type = ASIdOrRange_range;
502 a->u.range = r;
503 break;
504 case ASIdOrRange_range:
505 ASN1_INTEGER_free(a->u.range->max);
506 a->u.range->max = b_max;
507 break;
508 }
509 switch (b->type) {
510 case ASIdOrRange_id:
511 b->u.id = NULL;
512 break;
513 case ASIdOrRange_range:
514 b->u.range->max = NULL;
515 break;
516 }
517 ASIdOrRange_free(b);
518 (void) sk_ASIdOrRange_delete(
519 choice->u.asIdsOrRanges, i + 1);
520 i--;
521 continue;
522 }
523 }
524
525 /*
526 * Check for final inverted range.
527 */
528 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
529 {
530 ASIdOrRange *a =
531 sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
532 ASN1_INTEGER *a_min, *a_max;
533 if (a != NULL && a->type == ASIdOrRange_range) {
534 extract_min_max(a, &a_min, &a_max);
535 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
536 goto done;
537 }
478 } 538 }
479 r->min = a_min; 539
480 r->max = b_max; 540 OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
481 a->type = ASIdOrRange_range; 541
482 a->u.range = r; 542 ret = 1;
483 break; 543
484 case ASIdOrRange_range: 544done:
485 ASN1_INTEGER_free(a->u.range->max); 545 ASN1_INTEGER_free(a_max_plus_one);
486 a->u.range->max = b_max; 546 BN_free(bn);
487 break; 547 return ret;
488 }
489 switch (b->type) {
490 case ASIdOrRange_id:
491 b->u.id = NULL;
492 break;
493 case ASIdOrRange_range:
494 b->u.range->max = NULL;
495 break;
496 }
497 ASIdOrRange_free(b);
498 (void) sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
499 i--;
500 continue;
501 }
502 }
503
504 /*
505 * Check for final inverted range.
506 */
507 i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
508 {
509 ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
510 ASN1_INTEGER *a_min, *a_max;
511 if (a != NULL && a->type == ASIdOrRange_range) {
512 extract_min_max(a, &a_min, &a_max);
513 if (ASN1_INTEGER_cmp(a_min, a_max) > 0)
514 goto done;
515 }
516 }
517
518 OPENSSL_assert(ASIdentifierChoice_is_canonical(choice)); /* Paranoia */
519
520 ret = 1;
521
522 done:
523 ASN1_INTEGER_free(a_max_plus_one);
524 BN_free(bn);
525 return ret;
526} 548}
527 549
528/* 550/*
529 * Whack an ASIdentifier extension into canonical form. 551 * Whack an ASIdentifier extension into canonical form.
530 */ 552 */
531int v3_asid_canonize(ASIdentifiers *asid) 553int
554v3_asid_canonize(ASIdentifiers *asid)
532{ 555{
533 return (asid == NULL || 556 return (asid == NULL ||
534 (ASIdentifierChoice_canonize(asid->asnum) && 557 (ASIdentifierChoice_canonize(asid->asnum) &&
535 ASIdentifierChoice_canonize(asid->rdi))); 558 ASIdentifierChoice_canonize(asid->rdi)));
536} 559}
537 560
538/* 561/*
539 * v2i method for an ASIdentifier extension. 562 * v2i method for an ASIdentifier extension.
540 */ 563 */
541static void *v2i_ASIdentifiers(const struct v3_ext_method *method, 564static void *
542 struct v3_ext_ctx *ctx, 565v2i_ASIdentifiers(const struct v3_ext_method *method, struct v3_ext_ctx *ctx,
543 STACK_OF(CONF_VALUE) *values) 566 STACK_OF(CONF_VALUE) *values)
544{ 567{
545 ASN1_INTEGER *min = NULL, *max = NULL; 568 ASN1_INTEGER *min = NULL, *max = NULL;
546 ASIdentifiers *asid = NULL; 569 ASIdentifiers *asid = NULL;
547 int i; 570 int i;
548 571
549 if ((asid = ASIdentifiers_new()) == NULL) { 572 if ((asid = ASIdentifiers_new()) == NULL) {
550 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 573 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
551 return NULL; 574 return NULL;
552 } 575 }
553 576
554 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 577 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
555 CONF_VALUE *val = sk_CONF_VALUE_value(values, i); 578 CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
556 int i1, i2, i3, is_range, which; 579 int i1, i2, i3, is_range, which;
557 580
558 /* 581 /*
559 * Figure out whether this is an AS or an RDI. 582 * Figure out whether this is an AS or an RDI.
560 */ 583 */
561 if ( !name_cmp(val->name, "AS")) { 584 if (!name_cmp(val->name, "AS")) {
562 which = V3_ASID_ASNUM; 585 which = V3_ASID_ASNUM;
563 } else if (!name_cmp(val->name, "RDI")) { 586 } else if (!name_cmp(val->name, "RDI")) {
564 which = V3_ASID_RDI; 587 which = V3_ASID_RDI;
565 } else { 588 } else {
566 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_NAME_ERROR); 589 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
567 X509V3_conf_err(val); 590 X509V3_R_EXTENSION_NAME_ERROR);
568 goto err; 591 X509V3_conf_err(val);
569 } 592 goto err;
570 593 }
571 /* 594
572 * Handle inheritance. 595 /*
573 */ 596 * Handle inheritance.
574 if (!strcmp(val->value, "inherit")) { 597 */
575 if (v3_asid_add_inherit(asid, which)) 598 if (!strcmp(val->value, "inherit")) {
576 continue; 599 if (v3_asid_add_inherit(asid, which))
577 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_INHERITANCE); 600 continue;
578 X509V3_conf_err(val); 601 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
579 goto err; 602 X509V3_R_INVALID_INHERITANCE);
580 } 603 X509V3_conf_err(val);
581 604 goto err;
582 /* 605 }
583 * Number, range, or mistake, pick it apart and figure out which. 606
584 */ 607 /*
585 i1 = strspn(val->value, "0123456789"); 608 * Number, range, or mistake, pick it apart and figure out which.
586 if (val->value[i1] == '\0') { 609 */
587 is_range = 0; 610 i1 = strspn(val->value, "0123456789");
588 } else { 611 if (val->value[i1] == '\0') {
589 is_range = 1; 612 is_range = 0;
590 i2 = i1 + strspn(val->value + i1, " \t"); 613 } else {
591 if (val->value[i2] != '-') { 614 is_range = 1;
592 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASNUMBER); 615 i2 = i1 + strspn(val->value + i1, " \t");
593 X509V3_conf_err(val); 616 if (val->value[i2] != '-') {
594 goto err; 617 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
595 } 618 X509V3_R_INVALID_ASNUMBER);
596 i2++; 619 X509V3_conf_err(val);
597 i2 = i2 + strspn(val->value + i2, " \t"); 620 goto err;
598 i3 = i2 + strspn(val->value + i2, "0123456789"); 621 }
599 if (val->value[i3] != '\0') { 622 i2++;
600 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_INVALID_ASRANGE); 623 i2 = i2 + strspn(val->value + i2, " \t");
601 X509V3_conf_err(val); 624 i3 = i2 + strspn(val->value + i2, "0123456789");
602 goto err; 625 if (val->value[i3] != '\0') {
603 } 626 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
604 } 627 X509V3_R_INVALID_ASRANGE);
605 628 X509V3_conf_err(val);
606 /* 629 goto err;
607 * Syntax is ok, read and add it. 630 }
608 */ 631 }
609 if (!is_range) { 632
610 if (!X509V3_get_value_int(val, &min)) { 633 /*
611 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 634 * Syntax is ok, read and add it.
612 goto err; 635 */
613 } 636 if (!is_range) {
614 } else { 637 if (!X509V3_get_value_int(val, &min)) {
615 char *s = BUF_strdup(val->value); 638 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
616 if (s == NULL) { 639 ERR_R_MALLOC_FAILURE);
617 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 640 goto err;
618 goto err; 641 }
619 } 642 } else {
620 s[i1] = '\0'; 643 char *s = BUF_strdup(val->value);
621 min = s2i_ASN1_INTEGER(NULL, s); 644 if (s == NULL) {
622 max = s2i_ASN1_INTEGER(NULL, s + i2); 645 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
623 free(s); 646 ERR_R_MALLOC_FAILURE);
624 if (min == NULL || max == NULL) { 647 goto err;
625 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 648 }
626 goto err; 649 s[i1] = '\0';
627 } 650 min = s2i_ASN1_INTEGER(NULL, s);
628 if (ASN1_INTEGER_cmp(min, max) > 0) { 651 max = s2i_ASN1_INTEGER(NULL, s + i2);
629 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, X509V3_R_EXTENSION_VALUE_ERROR); 652 free(s);
630 goto err; 653 if (min == NULL || max == NULL) {
631 } 654 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
632 } 655 ERR_R_MALLOC_FAILURE);
633 if (!v3_asid_add_id_or_range(asid, which, min, max)) { 656 goto err;
634 X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE); 657 }
635 goto err; 658 if (ASN1_INTEGER_cmp(min, max) > 0) {
636 } 659 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
637 min = max = NULL; 660 X509V3_R_EXTENSION_VALUE_ERROR);
638 } 661 goto err;
639 662 }
640 /* 663 }
641 * Canonize the result, then we're done. 664 if (!v3_asid_add_id_or_range(asid, which, min, max)) {
642 */ 665 X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
643 if (!v3_asid_canonize(asid)) 666 ERR_R_MALLOC_FAILURE);
644 goto err; 667 goto err;
645 return asid; 668 }
646 669 min = max = NULL;
647 err: 670 }
648 ASIdentifiers_free(asid); 671
649 ASN1_INTEGER_free(min); 672 /*
650 ASN1_INTEGER_free(max); 673 * Canonize the result, then we're done.
651 return NULL; 674 */
675 if (!v3_asid_canonize(asid))
676 goto err;
677 return asid;
678
679err:
680 ASIdentifiers_free(asid);
681 ASN1_INTEGER_free(min);
682 ASN1_INTEGER_free(max);
683 return NULL;
652} 684}
653 685
654/* 686/*
655 * OpenSSL dispatch. 687 * OpenSSL dispatch.
656 */ 688 */
657const X509V3_EXT_METHOD v3_asid = { 689const X509V3_EXT_METHOD v3_asid = {
658 NID_sbgp_autonomousSysNum, /* nid */ 690 NID_sbgp_autonomousSysNum, /* nid */
659 0, /* flags */ 691 0, /* flags */
660 ASN1_ITEM_ref(ASIdentifiers), /* template */ 692 ASN1_ITEM_ref(ASIdentifiers), /* template */
661 0, 0, 0, 0, /* old functions, ignored */ 693 0, 0, 0, 0, /* old functions, ignored */
662 0, /* i2s */ 694 0, /* i2s */
663 0, /* s2i */ 695 0, /* s2i */
664 0, /* i2v */ 696 0, /* i2v */
665 v2i_ASIdentifiers, /* v2i */ 697 v2i_ASIdentifiers, /* v2i */
666 i2r_ASIdentifiers, /* i2r */ 698 i2r_ASIdentifiers, /* i2r */
667 0, /* r2i */ 699 0, /* r2i */
668 NULL /* extension-specific data */ 700 NULL /* extension-specific data */
669}; 701};
670 702
671/* 703/*
672 * Figure out whether extension uses inheritance. 704 * Figure out whether extension uses inheritance.
673 */ 705 */
674int v3_asid_inherits(ASIdentifiers *asid) 706int
707v3_asid_inherits(ASIdentifiers *asid)
675{ 708{
676 return (asid != NULL && 709 return (asid != NULL &&
677 ((asid->asnum != NULL && 710 ((asid->asnum != NULL &&
678 asid->asnum->type == ASIdentifierChoice_inherit) || 711 asid->asnum->type == ASIdentifierChoice_inherit) ||
679 (asid->rdi != NULL && 712 (asid->rdi != NULL &&
680 asid->rdi->type == ASIdentifierChoice_inherit))); 713 asid->rdi->type == ASIdentifierChoice_inherit)));
681} 714}
682 715
683/* 716/*
684 * Figure out whether parent contains child. 717 * Figure out whether parent contains child.
685 */ 718 */
686static int asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child) 719static int
720asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child)
687{ 721{
688 ASN1_INTEGER *p_min, *p_max, *c_min, *c_max; 722 ASN1_INTEGER *p_min, *p_max, *c_min, *c_max;
689 int p, c; 723 int p, c;
690 724
691 if (child == NULL || parent == child) 725 if (child == NULL || parent == child)
692 return 1; 726 return 1;
693 if (parent == NULL) 727 if (parent == NULL)
694 return 0; 728 return 0;
695 729
696 p = 0; 730 p = 0;
697 for (c = 0; c < sk_ASIdOrRange_num(child); c++) { 731 for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
698 extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max); 732 extract_min_max(sk_ASIdOrRange_value(child, c),
699 for (;; p++) { 733 &c_min, &c_max);
700 if (p >= sk_ASIdOrRange_num(parent)) 734 for (; ; p++) {
701 return 0; 735 if (p >= sk_ASIdOrRange_num(parent))
702 extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min, &p_max); 736 return 0;
703 if (ASN1_INTEGER_cmp(p_max, c_max) < 0) 737 extract_min_max(sk_ASIdOrRange_value(parent, p),
704 continue; 738 &p_min, &p_max);
705 if (ASN1_INTEGER_cmp(p_min, c_min) > 0) 739 if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
706 return 0; 740 continue;
707 break; 741 if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
708 } 742 return 0;
709 } 743 break;
744 }
745 }
710 746
711 return 1; 747 return 1;
712} 748}
713 749
714/* 750/*
715 * Test whether a is a subet of b. 751 * Test whether a is a subet of b.
716 */ 752 */
717int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b) 753int
754v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
718{ 755{
719 return (a == NULL || 756 return (a == NULL || a == b ||
720 a == b || 757 (b != NULL && !v3_asid_inherits(a) && !v3_asid_inherits(b) &&
721 (b != NULL && 758 asid_contains(b->asnum->u.asIdsOrRanges,
722 !v3_asid_inherits(a) && 759 a->asnum->u.asIdsOrRanges) &&
723 !v3_asid_inherits(b) && 760 asid_contains(b->rdi->u.asIdsOrRanges,
724 asid_contains(b->asnum->u.asIdsOrRanges, 761 a->rdi->u.asIdsOrRanges)));
725 a->asnum->u.asIdsOrRanges) &&
726 asid_contains(b->rdi->u.asIdsOrRanges,
727 a->rdi->u.asIdsOrRanges)));
728} 762}
729 763
730/* 764/*
@@ -747,117 +781,120 @@ int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
747/* 781/*
748 * Core code for RFC 3779 3.3 path validation. 782 * Core code for RFC 3779 3.3 path validation.
749 */ 783 */
750static int v3_asid_validate_path_internal(X509_STORE_CTX *ctx, 784static int
751 STACK_OF(X509) *chain, 785v3_asid_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
752 ASIdentifiers *ext) 786 ASIdentifiers *ext)
753{ 787{
754 ASIdOrRanges *child_as = NULL, *child_rdi = NULL; 788 ASIdOrRanges *child_as = NULL, *child_rdi = NULL;
755 int i, ret = 1, inherit_as = 0, inherit_rdi = 0; 789 int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
756 X509 *x; 790 X509 *x;
757 791
758 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0); 792 OPENSSL_assert(chain != NULL && sk_X509_num(chain) > 0);
759 OPENSSL_assert(ctx != NULL || ext != NULL); 793 OPENSSL_assert(ctx != NULL || ext != NULL);
760 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL); 794 OPENSSL_assert(ctx == NULL || ctx->verify_cb != NULL);
761 795
762 /* 796 /*
763 * Figure out where to start. If we don't have an extension to 797 * Figure out where to start. If we don't have an extension to
764 * check, we're done. Otherwise, check canonical form and 798 * check, we're done. Otherwise, check canonical form and
765 * set up for walking up the chain. 799 * set up for walking up the chain.
766 */ 800 */
767 if (ext != NULL) { 801 if (ext != NULL) {
768 i = -1; 802 i = -1;
769 x = NULL; 803 x = NULL;
770 } else { 804 } else {
771 i = 0; 805 i = 0;
772 x = sk_X509_value(chain, i); 806 x = sk_X509_value(chain, i);
773 OPENSSL_assert(x != NULL); 807 OPENSSL_assert(x != NULL);
774 if ((ext = x->rfc3779_asid) == NULL) 808 if ((ext = x->rfc3779_asid) == NULL)
775 goto done; 809 goto done;
776 } 810 }
777 if (!v3_asid_is_canonical(ext)) 811 if (!v3_asid_is_canonical(ext))
778 validation_err(X509_V_ERR_INVALID_EXTENSION); 812 validation_err(X509_V_ERR_INVALID_EXTENSION);
779 if (ext->asnum != NULL) { 813 if (ext->asnum != NULL) {
780 switch (ext->asnum->type) { 814 switch (ext->asnum->type) {
781 case ASIdentifierChoice_inherit: 815 case ASIdentifierChoice_inherit:
782 inherit_as = 1; 816 inherit_as = 1;
783 break; 817 break;
784 case ASIdentifierChoice_asIdsOrRanges: 818 case ASIdentifierChoice_asIdsOrRanges:
785 child_as = ext->asnum->u.asIdsOrRanges; 819 child_as = ext->asnum->u.asIdsOrRanges;
786 break; 820 break;
787 } 821 }
788 } 822 }
789 if (ext->rdi != NULL) { 823 if (ext->rdi != NULL) {
790 switch (ext->rdi->type) { 824 switch (ext->rdi->type) {
791 case ASIdentifierChoice_inherit: 825 case ASIdentifierChoice_inherit:
792 inherit_rdi = 1; 826 inherit_rdi = 1;
793 break; 827 break;
794 case ASIdentifierChoice_asIdsOrRanges: 828 case ASIdentifierChoice_asIdsOrRanges:
795 child_rdi = ext->rdi->u.asIdsOrRanges; 829 child_rdi = ext->rdi->u.asIdsOrRanges;
796 break; 830 break;
797 } 831 }
798 } 832 }
799 833
800 /* 834 /*
801 * Now walk up the chain. Extensions must be in canonical form, no 835 * Now walk up the chain. Extensions must be in canonical form, no
802 * cert may list resources that its parent doesn't list. 836 * cert may list resources that its parent doesn't list.
803 */ 837 */
804 for (i++; i < sk_X509_num(chain); i++) { 838 for (i++; i < sk_X509_num(chain); i++) {
805 x = sk_X509_value(chain, i); 839 x = sk_X509_value(chain, i);
806 OPENSSL_assert(x != NULL); 840 OPENSSL_assert(x != NULL);
807 if (x->rfc3779_asid == NULL) { 841 if (x->rfc3779_asid == NULL) {
808 if (child_as != NULL || child_rdi != NULL) 842 if (child_as != NULL || child_rdi != NULL)
809 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 843 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
810 continue; 844 continue;
811 } 845 }
812 if (!v3_asid_is_canonical(x->rfc3779_asid)) 846 if (!v3_asid_is_canonical(x->rfc3779_asid))
813 validation_err(X509_V_ERR_INVALID_EXTENSION); 847 validation_err(X509_V_ERR_INVALID_EXTENSION);
814 if (x->rfc3779_asid->asnum == NULL && child_as != NULL) { 848 if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
815 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 849 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
816 child_as = NULL; 850 child_as = NULL;
817 inherit_as = 0; 851 inherit_as = 0;
818 } 852 }
819 if (x->rfc3779_asid->asnum != NULL && 853 if (x->rfc3779_asid->asnum != NULL &&
820 x->rfc3779_asid->asnum->type == ASIdentifierChoice_asIdsOrRanges) { 854 x->rfc3779_asid->asnum->type ==
821 if (inherit_as || 855 ASIdentifierChoice_asIdsOrRanges) {
822 asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges, child_as)) { 856 if (inherit_as || asid_contains(
823 child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges; 857 x->rfc3779_asid->asnum->u.asIdsOrRanges,
824 inherit_as = 0; 858 child_as)) {
825 } else { 859 child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
826 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 860 inherit_as = 0;
827 } 861 } else {
828 } 862 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
829 if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) { 863 }
830 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 864 }
831 child_rdi = NULL; 865 if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
832 inherit_rdi = 0; 866 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
833 } 867 child_rdi = NULL;
834 if (x->rfc3779_asid->rdi != NULL && 868 inherit_rdi = 0;
835 x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) { 869 }
836 if (inherit_rdi || 870 if (x->rfc3779_asid->rdi != NULL &&
837 asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges, child_rdi)) { 871 x->rfc3779_asid->rdi->type ==
838 child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges; 872 ASIdentifierChoice_asIdsOrRanges) {
839 inherit_rdi = 0; 873 if (inherit_rdi || asid_contains(
840 } else { 874 x->rfc3779_asid->rdi->u.asIdsOrRanges, child_rdi)) {
841 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 875 child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
842 } 876 inherit_rdi = 0;
843 } 877 } else {
844 } 878 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
845 879 }
846 /* 880 }
847 * Trust anchor can't inherit. 881 }
848 */ 882
849 OPENSSL_assert(x != NULL); 883 /*
850 if (x->rfc3779_asid != NULL) { 884 * Trust anchor can't inherit.
851 if (x->rfc3779_asid->asnum != NULL && 885 */
852 x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit) 886 OPENSSL_assert(x != NULL);
853 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 887 if (x->rfc3779_asid != NULL) {
854 if (x->rfc3779_asid->rdi != NULL && 888 if (x->rfc3779_asid->asnum != NULL &&
855 x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit) 889 x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
856 validation_err(X509_V_ERR_UNNESTED_RESOURCE); 890 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
857 } 891 if (x->rfc3779_asid->rdi != NULL &&
858 892 x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
859 done: 893 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
860 return ret; 894 }
895
896done:
897 return ret;
861} 898}
862 899
863#undef validation_err 900#undef validation_err
@@ -865,26 +902,27 @@ static int v3_asid_validate_path_internal(X509_STORE_CTX *ctx,
865/* 902/*
866 * RFC 3779 3.3 path validation -- called from X509_verify_cert(). 903 * RFC 3779 3.3 path validation -- called from X509_verify_cert().
867 */ 904 */
868int v3_asid_validate_path(X509_STORE_CTX *ctx) 905int
906v3_asid_validate_path(X509_STORE_CTX *ctx)
869{ 907{
870 return v3_asid_validate_path_internal(ctx, ctx->chain, NULL); 908 return v3_asid_validate_path_internal(ctx, ctx->chain, NULL);
871} 909}
872 910
873/* 911/*
874 * RFC 3779 3.3 path validation of an extension. 912 * RFC 3779 3.3 path validation of an extension.
875 * Test whether chain covers extension. 913 * Test whether chain covers extension.
876 */ 914 */
877int v3_asid_validate_resource_set(STACK_OF(X509) *chain, 915int
878 ASIdentifiers *ext, 916v3_asid_validate_resource_set(STACK_OF(X509) *chain, ASIdentifiers *ext,
879 int allow_inheritance) 917 int allow_inheritance)
880{ 918{
881 if (ext == NULL) 919 if (ext == NULL)
882 return 1; 920 return 1;
883 if (chain == NULL || sk_X509_num(chain) == 0) 921 if (chain == NULL || sk_X509_num(chain) == 0)
884 return 0; 922 return 0;
885 if (!allow_inheritance && v3_asid_inherits(ext)) 923 if (!allow_inheritance && v3_asid_inherits(ext))
886 return 0; 924 return 0;
887 return v3_asid_validate_path_internal(NULL, chain, ext); 925 return v3_asid_validate_path_internal(NULL, chain, ext);
888} 926}
889 927
890#endif /* OPENSSL_NO_RFC3779 */ 928#endif /* OPENSSL_NO_RFC3779 */
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 19:25:12 +0000