|
1 /* v3_ncons.c */ |
|
2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL |
|
3 * project. |
|
4 */ |
|
5 /* ==================================================================== |
|
6 * Copyright (c) 2003 The OpenSSL Project. All rights reserved. |
|
7 * |
|
8 * Redistribution and use in source and binary forms, with or without |
|
9 * modification, are permitted provided that the following conditions |
|
10 * are met: |
|
11 * |
|
12 * 1. Redistributions of source code must retain the above copyright |
|
13 * notice, this list of conditions and the following disclaimer. |
|
14 * |
|
15 * 2. Redistributions in binary form must reproduce the above copyright |
|
16 * notice, this list of conditions and the following disclaimer in |
|
17 * the documentation and/or other materials provided with the |
|
18 * distribution. |
|
19 * |
|
20 * 3. All advertising materials mentioning features or use of this |
|
21 * software must display the following acknowledgment: |
|
22 * "This product includes software developed by the OpenSSL Project |
|
23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" |
|
24 * |
|
25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
|
26 * endorse or promote products derived from this software without |
|
27 * prior written permission. For written permission, please contact |
|
28 * licensing@OpenSSL.org. |
|
29 * |
|
30 * 5. Products derived from this software may not be called "OpenSSL" |
|
31 * nor may "OpenSSL" appear in their names without prior written |
|
32 * permission of the OpenSSL Project. |
|
33 * |
|
34 * 6. Redistributions of any form whatsoever must retain the following |
|
35 * acknowledgment: |
|
36 * "This product includes software developed by the OpenSSL Project |
|
37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" |
|
38 * |
|
39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
|
40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
|
41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
|
42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
|
43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
|
44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
|
45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
|
46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
|
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
|
48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
|
49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
|
50 * OF THE POSSIBILITY OF SUCH DAMAGE. |
|
51 * ==================================================================== |
|
52 * |
|
53 * This product includes cryptographic software written by Eric Young |
|
54 * (eay@cryptsoft.com). This product includes software written by Tim |
|
55 * Hudson (tjh@cryptsoft.com). |
|
56 * |
|
57 */ |
|
58 /* |
|
59 © Portions copyright (c) 2006 Nokia Corporation. All rights reserved. |
|
60 */ |
|
61 |
|
62 |
|
63 |
|
64 |
|
65 #include <stdio.h> |
|
66 #include "cryptlib.h" |
|
67 #include <openssl/asn1t.h> |
|
68 #include <openssl/conf.h> |
|
69 #include <openssl/x509v3.h> |
|
70 #if (defined(SYMBIAN) && (defined(__WINSCW__) || defined(__WINS__))) |
|
71 #include "libcrypto_wsd_macros.h" |
|
72 #include "libcrypto_wsd.h" |
|
73 #endif |
|
74 |
|
75 static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, |
|
76 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); |
|
77 static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, |
|
78 void *a, BIO *bp, int ind); |
|
79 static int do_i2r_name_constraints(X509V3_EXT_METHOD *method, |
|
80 STACK_OF(GENERAL_SUBTREE) *trees, |
|
81 BIO *bp, int ind, char *name); |
|
82 static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip); |
|
83 |
|
84 #ifndef EMULATOR |
|
85 X509V3_EXT_METHOD v3_name_constraints = { |
|
86 NID_name_constraints, 0, |
|
87 ASN1_ITEM_ref(NAME_CONSTRAINTS), |
|
88 0,0,0,0, |
|
89 0,0, |
|
90 0, v2i_NAME_CONSTRAINTS, |
|
91 i2r_NAME_CONSTRAINTS,0, |
|
92 NULL |
|
93 }; |
|
94 #else |
|
95 const X509V3_EXT_METHOD v3_name_constraints = { |
|
96 NID_name_constraints, 0, |
|
97 ASN1_ITEM_ref(NAME_CONSTRAINTS), |
|
98 0,0,0,0, |
|
99 0,0, |
|
100 0, v2i_NAME_CONSTRAINTS, |
|
101 i2r_NAME_CONSTRAINTS,0, |
|
102 NULL |
|
103 }; |
|
104 #endif |
|
105 ASN1_SEQUENCE(GENERAL_SUBTREE) = { |
|
106 ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME), |
|
107 ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0), |
|
108 ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1) |
|
109 } ASN1_SEQUENCE_END(GENERAL_SUBTREE) |
|
110 |
|
111 ASN1_SEQUENCE(NAME_CONSTRAINTS) = { |
|
112 ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees, |
|
113 GENERAL_SUBTREE, 0), |
|
114 ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees, |
|
115 GENERAL_SUBTREE, 1), |
|
116 } ASN1_SEQUENCE_END(NAME_CONSTRAINTS) |
|
117 |
|
118 |
|
119 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE) |
|
120 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS) |
|
121 |
|
122 static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, |
|
123 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval) |
|
124 { |
|
125 int i; |
|
126 CONF_VALUE tval, *val; |
|
127 STACK_OF(GENERAL_SUBTREE) **ptree = NULL; |
|
128 NAME_CONSTRAINTS *ncons = NULL; |
|
129 GENERAL_SUBTREE *sub = NULL; |
|
130 ncons = NAME_CONSTRAINTS_new(); |
|
131 if (!ncons) |
|
132 goto memerr; |
|
133 for(i = 0; i < sk_CONF_VALUE_num(nval); i++) |
|
134 { |
|
135 val = sk_CONF_VALUE_value(nval, i); |
|
136 if (!strncmp(val->name, "permitted", 9) && val->name[9]) |
|
137 { |
|
138 ptree = &ncons->permittedSubtrees; |
|
139 tval.name = val->name + 10; |
|
140 } |
|
141 else if (!strncmp(val->name, "excluded", 8) && val->name[8]) |
|
142 { |
|
143 ptree = &ncons->excludedSubtrees; |
|
144 tval.name = val->name + 9; |
|
145 } |
|
146 else |
|
147 { |
|
148 X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, X509V3_R_INVALID_SYNTAX); |
|
149 goto err; |
|
150 } |
|
151 tval.value = val->value; |
|
152 sub = GENERAL_SUBTREE_new(); |
|
153 if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1)) |
|
154 goto err; |
|
155 if (!*ptree) |
|
156 *ptree = sk_GENERAL_SUBTREE_new_null(); |
|
157 if (!*ptree || !sk_GENERAL_SUBTREE_push(*ptree, sub)) |
|
158 goto memerr; |
|
159 sub = NULL; |
|
160 } |
|
161 |
|
162 return ncons; |
|
163 |
|
164 memerr: |
|
165 X509V3err(X509V3_F_V2I_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE); |
|
166 err: |
|
167 if (ncons) |
|
168 NAME_CONSTRAINTS_free(ncons); |
|
169 if (sub) |
|
170 GENERAL_SUBTREE_free(sub); |
|
171 |
|
172 return NULL; |
|
173 } |
|
174 |
|
175 |
|
176 |
|
177 |
|
178 static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, |
|
179 void *a, BIO *bp, int ind) |
|
180 { |
|
181 NAME_CONSTRAINTS *ncons = a; |
|
182 do_i2r_name_constraints(method, ncons->permittedSubtrees, |
|
183 bp, ind, "Permitted"); |
|
184 do_i2r_name_constraints(method, ncons->excludedSubtrees, |
|
185 bp, ind, "Excluded"); |
|
186 return 1; |
|
187 } |
|
188 |
|
189 static int do_i2r_name_constraints(X509V3_EXT_METHOD *method, |
|
190 STACK_OF(GENERAL_SUBTREE) *trees, |
|
191 BIO *bp, int ind, char *name) |
|
192 { |
|
193 GENERAL_SUBTREE *tree; |
|
194 int i; |
|
195 if (sk_GENERAL_SUBTREE_num(trees) > 0) |
|
196 BIO_printf(bp, "%*s%s:\n", ind, "", name); |
|
197 for(i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) |
|
198 { |
|
199 tree = sk_GENERAL_SUBTREE_value(trees, i); |
|
200 BIO_printf(bp, "%*s", ind + 2, ""); |
|
201 if (tree->base->type == GEN_IPADD) |
|
202 print_nc_ipadd(bp, tree->base->d.ip); |
|
203 else |
|
204 GENERAL_NAME_print(bp, tree->base); |
|
205 tree = sk_GENERAL_SUBTREE_value(trees, i); |
|
206 BIO_puts(bp, "\n"); |
|
207 } |
|
208 return 1; |
|
209 } |
|
210 |
|
211 static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip) |
|
212 { |
|
213 int i, len; |
|
214 unsigned char *p; |
|
215 p = ip->data; |
|
216 len = ip->length; |
|
217 BIO_puts(bp, "IP:"); |
|
218 if(len == 8) |
|
219 { |
|
220 BIO_printf(bp, "%d.%d.%d.%d/%d.%d.%d.%d", |
|
221 p[0], p[1], p[2], p[3], |
|
222 p[4], p[5], p[6], p[7]); |
|
223 } |
|
224 else if(len == 32) |
|
225 { |
|
226 for (i = 0; i < 16; i++) |
|
227 { |
|
228 BIO_printf(bp, "%X", p[0] << 8 | p[1]); |
|
229 p += 2; |
|
230 if (i == 7) |
|
231 BIO_puts(bp, "/"); |
|
232 else if (i != 15) |
|
233 BIO_puts(bp, ":"); |
|
234 } |
|
235 } |
|
236 else |
|
237 BIO_printf(bp, "IP Address:<invalid>"); |
|
238 return 1; |
|
239 } |
|
240 |