crypto/x509/v3_addr.c

   1 /*
   2  * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * Implementation of RFC 3779 section 2.2.
  12  */
  13
  14 #include <stdio.h>
  15 #include <stdlib.h>
  16
  17 #include "internal/cryptlib.h"
  18 #include <openssl/conf.h>
  19 #include <openssl/asn1.h>
  20 #include <openssl/asn1t.h>
  21 #include <openssl/buffer.h>
  22 #include <openssl/x509v3.h>
  23 #include "crypto/x509.h"
  24 #include "ext_dat.h"
  25
  26 #ifndef OPENSSL_NO_RFC3779
  27
  28 DEFINE_STACK_OF(IPAddressOrRange)
  29 DEFINE_STACK_OF(IPAddressFamily)
  30 DEFINE_STACK_OF(CONF_VALUE)
  31 DEFINE_STACK_OF(X509)
  32
  33 /*
  34  * OpenSSL ASN.1 template translation of RFC 3779 2.2.3.
  35  */
  36
  37 ASN1_SEQUENCE(IPAddressRange) = {
  38   ASN1_SIMPLE(IPAddressRange, min, ASN1_BIT_STRING),
  39   ASN1_SIMPLE(IPAddressRange, max, ASN1_BIT_STRING)
  40 } ASN1_SEQUENCE_END(IPAddressRange)
  41
  42 ASN1_CHOICE(IPAddressOrRange) = {
  43   ASN1_SIMPLE(IPAddressOrRange, u.addressPrefix, ASN1_BIT_STRING),
  44   ASN1_SIMPLE(IPAddressOrRange, u.addressRange,  IPAddressRange)
  45 } ASN1_CHOICE_END(IPAddressOrRange)
  46
  47 ASN1_CHOICE(IPAddressChoice) = {
  48   ASN1_SIMPLE(IPAddressChoice,      u.inherit,           ASN1_NULL),
  49   ASN1_SEQUENCE_OF(IPAddressChoice, u.addressesOrRanges, IPAddressOrRange)
  50 } ASN1_CHOICE_END(IPAddressChoice)
  51
  52 ASN1_SEQUENCE(IPAddressFamily) = {
  53   ASN1_SIMPLE(IPAddressFamily, addressFamily,   ASN1_OCTET_STRING),
  54   ASN1_SIMPLE(IPAddressFamily, ipAddressChoice, IPAddressChoice)
  55 } ASN1_SEQUENCE_END(IPAddressFamily)
  56
  57 ASN1_ITEM_TEMPLATE(IPAddrBlocks) =
  58   ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0,
  59                         IPAddrBlocks, IPAddressFamily)
  60 static_ASN1_ITEM_TEMPLATE_END(IPAddrBlocks)
  61
  62 IMPLEMENT_ASN1_FUNCTIONS(IPAddressRange)
  63 IMPLEMENT_ASN1_FUNCTIONS(IPAddressOrRange)
  64 IMPLEMENT_ASN1_FUNCTIONS(IPAddressChoice)
  65 IMPLEMENT_ASN1_FUNCTIONS(IPAddressFamily)
  66
  67 /*
  68  * How much buffer space do we need for a raw address?
  69  */
  70 #define ADDR_RAW_BUF_LEN        16
  71
  72 /*
  73  * What's the address length associated with this AFI?
  74  */
  75 static int length_from_afi(const unsigned afi)
  76 {
  77     switch (afi) {
  78     case IANA_AFI_IPV4:
  79         return 4;
  80     case IANA_AFI_IPV6:
  81         return 16;
  82     default:
  83         return 0;
  84     }
  85 }
  86
  87 /*
  88  * Extract the AFI from an IPAddressFamily.
  89  */
  90 unsigned int X509v3_addr_get_afi(const IPAddressFamily *f)
  91 {
  92     if (f == NULL
  93             || f->addressFamily == NULL
  94             || f->addressFamily->data == NULL
  95             || f->addressFamily->length < 2)
  96         return 0;
  97     return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
  98 }
  99
 100 /*
 101  * Expand the bitstring form of an address into a raw byte array.
 102  * At the moment this is coded for simplicity, not speed.
 103  */
 104 static int addr_expand(unsigned char *addr,
 105                        const ASN1_BIT_STRING *bs,
 106                        const int length, const unsigned char fill)
 107 {
 108     if (bs->length < 0 || bs->length > length)
 109         return 0;
 110     if (bs->length > 0) {
 111         memcpy(addr, bs->data, bs->length);
 112         if ((bs->flags & 7) != 0) {
 113             unsigned char mask = 0xFF >> (8 - (bs->flags & 7));
 114             if (fill == 0)
 115                 addr[bs->length - 1] &= ~mask;
 116             else
 117                 addr[bs->length - 1] |= mask;
 118         }
 119     }
 120     memset(addr + bs->length, fill, length - bs->length);
 121     return 1;
 122 }
 123
 124 /*
 125  * Extract the prefix length from a bitstring.
 126  */
 127 #define addr_prefixlen(bs) ((int) ((bs)->length * 8 - ((bs)->flags & 7)))
 128
 129 /*
 130  * i2r handler for one address bitstring.
 131  */
 132 static int i2r_address(BIO *out,
 133                        const unsigned afi,
 134                        const unsigned char fill, const ASN1_BIT_STRING *bs)
 135 {
 136     unsigned char addr[ADDR_RAW_BUF_LEN];
 137     int i, n;
 138
 139     if (bs->length < 0)
 140         return 0;
 141     switch (afi) {
 142     case IANA_AFI_IPV4:
 143         if (!addr_expand(addr, bs, 4, fill))
 144             return 0;
 145         BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]);
 146         break;
 147     case IANA_AFI_IPV6:
 148         if (!addr_expand(addr, bs, 16, fill))
 149             return 0;
 150         for (n = 16; n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00;
 151              n -= 2) ;
 152         for (i = 0; i < n; i += 2)
 153             BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i + 1],
 154                        (i < 14 ? ":" : ""));
 155         if (i < 16)
 156             BIO_puts(out, ":");
 157         if (i == 0)
 158             BIO_puts(out, ":");
 159         break;
 160     default:
 161         for (i = 0; i < bs->length; i++)
 162             BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), bs->data[i]);
 163         BIO_printf(out, "[%d]", (int)(bs->flags & 7));
 164         break;
 165     }
 166     return 1;
 167 }
 168
 169 /*
 170  * i2r handler for a sequence of addresses and ranges.
 171  */
 172 static int i2r_IPAddressOrRanges(BIO *out,
 173                                  const int indent,
 174                                  const IPAddressOrRanges *aors,
 175                                  const unsigned afi)
 176 {
 177     int i;
 178     for (i = 0; i < sk_IPAddressOrRange_num(aors); i++) {
 179         const IPAddressOrRange *aor = sk_IPAddressOrRange_value(aors, i);
 180         BIO_printf(out, "%*s", indent, "");
 181         switch (aor->type) {
 182         case IPAddressOrRange_addressPrefix:
 183             if (!i2r_address(out, afi, 0x00, aor->u.addressPrefix))
 184                 return 0;
 185             BIO_printf(out, "/%d\n", addr_prefixlen(aor->u.addressPrefix));
 186             continue;
 187         case IPAddressOrRange_addressRange:
 188             if (!i2r_address(out, afi, 0x00, aor->u.addressRange->min))
 189                 return 0;
 190             BIO_puts(out, "-");
 191             if (!i2r_address(out, afi, 0xFF, aor->u.addressRange->max))
 192                 return 0;
 193             BIO_puts(out, "\n");
 194             continue;
 195         }
 196     }
 197     return 1;
 198 }
 199
 200 /*
 201  * i2r handler for an IPAddrBlocks extension.
 202  */
 203 static int i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method,
 204                             void *ext, BIO *out, int indent)
 205 {
 206     const IPAddrBlocks *addr = ext;
 207     int i;
 208     for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
 209         IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
 210         const unsigned int afi = X509v3_addr_get_afi(f);
 211         switch (afi) {
 212         case IANA_AFI_IPV4:
 213             BIO_printf(out, "%*sIPv4", indent, "");
 214             break;
 215         case IANA_AFI_IPV6:
 216             BIO_printf(out, "%*sIPv6", indent, "");
 217             break;
 218         default:
 219             BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi);
 220             break;
 221         }
 222         if (f->addressFamily->length > 2) {
 223             switch (f->addressFamily->data[2]) {
 224             case 1:
 225                 BIO_puts(out, " (Unicast)");
 226                 break;
 227             case 2:
 228                 BIO_puts(out, " (Multicast)");
 229                 break;
 230             case 3:
 231                 BIO_puts(out, " (Unicast/Multicast)");
 232                 break;
 233             case 4:
 234                 BIO_puts(out, " (MPLS)");
 235                 break;
 236             case 64:
 237                 BIO_puts(out, " (Tunnel)");
 238                 break;
 239             case 65:
 240                 BIO_puts(out, " (VPLS)");
 241                 break;
 242             case 66:
 243                 BIO_puts(out, " (BGP MDT)");
 244                 break;
 245             case 128:
 246                 BIO_puts(out, " (MPLS-labeled VPN)");
 247                 break;
 248             default:
 249                 BIO_printf(out, " (Unknown SAFI %u)",
 250                            (unsigned)f->addressFamily->data[2]);
 251                 break;
 252             }
 253         }
 254         switch (f->ipAddressChoice->type) {
 255         case IPAddressChoice_inherit:
 256             BIO_puts(out, ": inherit\n");
 257             break;
 258         case IPAddressChoice_addressesOrRanges:
 259             BIO_puts(out, ":\n");
 260             if (!i2r_IPAddressOrRanges(out,
 261                                        indent + 2,
 262                                        f->ipAddressChoice->
 263                                        u.addressesOrRanges, afi))
 264                 return 0;
 265             break;
 266         }
 267     }
 268     return 1;
 269 }
 270
 271 /*
 272  * Sort comparison function for a sequence of IPAddressOrRange
 273  * elements.
 274  *
 275  * There's no sane answer we can give if addr_expand() fails, and an
 276  * assertion failure on externally supplied data is seriously uncool,
 277  * so we just arbitrarily declare that if given invalid inputs this
 278  * function returns -1.  If this messes up your preferred sort order
 279  * for garbage input, tough noogies.
 280  */
 281 static int IPAddressOrRange_cmp(const IPAddressOrRange *a,
 282                                 const IPAddressOrRange *b, const int length)
 283 {
 284     unsigned char addr_a[ADDR_RAW_BUF_LEN], addr_b[ADDR_RAW_BUF_LEN];
 285     int prefixlen_a = 0, prefixlen_b = 0;
 286     int r;
 287
 288     switch (a->type) {
 289     case IPAddressOrRange_addressPrefix:
 290         if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00))
 291             return -1;
 292         prefixlen_a = addr_prefixlen(a->u.addressPrefix);
 293         break;
 294     case IPAddressOrRange_addressRange:
 295         if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00))
 296             return -1;
 297         prefixlen_a = length * 8;
 298         break;
 299     }
 300
 301     switch (b->type) {
 302     case IPAddressOrRange_addressPrefix:
 303         if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00))
 304             return -1;
 305         prefixlen_b = addr_prefixlen(b->u.addressPrefix);
 306         break;
 307     case IPAddressOrRange_addressRange:
 308         if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00))
 309             return -1;
 310         prefixlen_b = length * 8;
 311         break;
 312     }
 313
 314     if ((r = memcmp(addr_a, addr_b, length)) != 0)
 315         return r;
 316     else
 317         return prefixlen_a - prefixlen_b;
 318 }
 319
 320 /*
 321  * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort()
 322  * comparison routines are only allowed two arguments.
 323  */
 324 static int v4IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
 325                                   const IPAddressOrRange *const *b)
 326 {
 327     return IPAddressOrRange_cmp(*a, *b, 4);
 328 }
 329
 330 /*
 331  * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort()
 332  * comparison routines are only allowed two arguments.
 333  */
 334 static int v6IPAddressOrRange_cmp(const IPAddressOrRange *const *a,
 335                                   const IPAddressOrRange *const *b)
 336 {
 337     return IPAddressOrRange_cmp(*a, *b, 16);
 338 }
 339
 340 /*
 341  * Calculate whether a range collapses to a prefix.
 342  * See last paragraph of RFC 3779 2.2.3.7.
 343  */
 344 static int range_should_be_prefix(const unsigned char *min,
 345                                   const unsigned char *max, const int length)
 346 {
 347     unsigned char mask;
 348     int i, j;
 349
 350     if (memcmp(min, max, length) <= 0)
 351         return -1;
 352     for (i = 0; i < length && min[i] == max[i]; i++) ;
 353     for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xFF; j--) ;
 354     if (i < j)
 355         return -1;
 356     if (i > j)
 357         return i * 8;
 358     mask = min[i] ^ max[i];
 359     switch (mask) {
 360     case 0x01:
 361         j = 7;
 362         break;
 363     case 0x03:
 364         j = 6;
 365         break;
 366     case 0x07:
 367         j = 5;
 368         break;
 369     case 0x0F:
 370         j = 4;
 371         break;
 372     case 0x1F:
 373         j = 3;
 374         break;
 375     case 0x3F:
 376         j = 2;
 377         break;
 378     case 0x7F:
 379         j = 1;
 380         break;
 381     default:
 382         return -1;
 383     }
 384     if ((min[i] & mask) != 0 || (max[i] & mask) != mask)
 385         return -1;
 386     else
 387         return i * 8 + j;
 388 }
 389
 390 /*
 391  * Construct a prefix.
 392  */
 393 static int make_addressPrefix(IPAddressOrRange **result,
 394                               unsigned char *addr, const int prefixlen)
 395 {
 396     int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
 397     IPAddressOrRange *aor = IPAddressOrRange_new();
 398
 399     if (aor == NULL)
 400         return 0;
 401     aor->type = IPAddressOrRange_addressPrefix;
 402     if (aor->u.addressPrefix == NULL &&
 403         (aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL)
 404         goto err;
 405     if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, bytelen))
 406         goto err;
 407     aor->u.addressPrefix->flags &= ~7;
 408     aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 409     if (bitlen > 0) {
 410         aor->u.addressPrefix->data[bytelen - 1] &= ~(0xFF >> bitlen);
 411         aor->u.addressPrefix->flags |= 8 - bitlen;
 412     }
 413
 414     *result = aor;
 415     return 1;
 416
 417  err:
 418     IPAddressOrRange_free(aor);
 419     return 0;
 420 }
 421
 422 /*
 423  * Construct a range.  If it can be expressed as a prefix,
 424  * return a prefix instead.  Doing this here simplifies
 425  * the rest of the code considerably.
 426  */
 427 static int make_addressRange(IPAddressOrRange **result,
 428                              unsigned char *min,
 429                              unsigned char *max, const int length)
 430 {
 431     IPAddressOrRange *aor;
 432     int i, prefixlen;
 433
 434     if ((prefixlen = range_should_be_prefix(min, max, length)) >= 0)
 435         return make_addressPrefix(result, min, prefixlen);
 436
 437     if ((aor = IPAddressOrRange_new()) == NULL)
 438         return 0;
 439     aor->type = IPAddressOrRange_addressRange;
 440     if ((aor->u.addressRange = IPAddressRange_new()) == NULL)
 441         goto err;
 442     if (aor->u.addressRange->min == NULL &&
 443         (aor->u.addressRange->min = ASN1_BIT_STRING_new()) == NULL)
 444         goto err;
 445     if (aor->u.addressRange->max == NULL &&
 446         (aor->u.addressRange->max = ASN1_BIT_STRING_new()) == NULL)
 447         goto err;
 448
 449     for (i = length; i > 0 && min[i - 1] == 0x00; --i) ;
 450     if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i))
 451         goto err;
 452     aor->u.addressRange->min->flags &= ~7;
 453     aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 454     if (i > 0) {
 455         unsigned char b = min[i - 1];
 456         int j = 1;
 457         while ((b & (0xFFU >> j)) != 0)
 458             ++j;
 459         aor->u.addressRange->min->flags |= 8 - j;
 460     }
 461
 462     for (i = length; i > 0 && max[i - 1] == 0xFF; --i) ;
 463     if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i))
 464         goto err;
 465     aor->u.addressRange->max->flags &= ~7;
 466     aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT;
 467     if (i > 0) {
 468         unsigned char b = max[i - 1];
 469         int j = 1;
 470         while ((b & (0xFFU >> j)) != (0xFFU >> j))
 471             ++j;
 472         aor->u.addressRange->max->flags |= 8 - j;
 473     }
 474
 475     *result = aor;
 476     return 1;
 477
 478  err:
 479     IPAddressOrRange_free(aor);
 480     return 0;
 481 }
 482
 483 /*
 484  * Construct a new address family or find an existing one.
 485  */
 486 static IPAddressFamily *make_IPAddressFamily(IPAddrBlocks *addr,
 487                                              const unsigned afi,
 488                                              const unsigned *safi)
 489 {
 490     IPAddressFamily *f;
 491     unsigned char key[3];
 492     int keylen;
 493     int i;
 494
 495     key[0] = (afi >> 8) & 0xFF;
 496     key[1] = afi & 0xFF;
 497     if (safi != NULL) {
 498         key[2] = *safi & 0xFF;
 499         keylen = 3;
 500     } else {
 501         keylen = 2;
 502     }
 503
 504     for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
 505         f = sk_IPAddressFamily_value(addr, i);
 506         if (f->addressFamily->length == keylen &&
 507             !memcmp(f->addressFamily->data, key, keylen))
 508             return f;
 509     }
 510
 511     if ((f = IPAddressFamily_new()) == NULL)
 512         goto err;
 513     if (f->ipAddressChoice == NULL &&
 514         (f->ipAddressChoice = IPAddressChoice_new()) == NULL)
 515         goto err;
 516     if (f->addressFamily == NULL &&
 517         (f->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
 518         goto err;
 519     if (!ASN1_OCTET_STRING_set(f->addressFamily, key, keylen))
 520         goto err;
 521     if (!sk_IPAddressFamily_push(addr, f))
 522         goto err;
 523
 524     return f;
 525
 526  err:
 527     IPAddressFamily_free(f);
 528     return NULL;
 529 }
 530
 531 /*
 532  * Add an inheritance element.
 533  */
 534 int X509v3_addr_add_inherit(IPAddrBlocks *addr,
 535                             const unsigned afi, const unsigned *safi)
 536 {
 537     IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
 538     if (f == NULL ||
 539         f->ipAddressChoice == NULL ||
 540         (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
 541          f->ipAddressChoice->u.addressesOrRanges != NULL))
 542         return 0;
 543     if (f->ipAddressChoice->type == IPAddressChoice_inherit &&
 544         f->ipAddressChoice->u.inherit != NULL)
 545         return 1;
 546     if (f->ipAddressChoice->u.inherit == NULL &&
 547         (f->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL)
 548         return 0;
 549     f->ipAddressChoice->type = IPAddressChoice_inherit;
 550     return 1;
 551 }
 552
 553 /*
 554  * Construct an IPAddressOrRange sequence, or return an existing one.
 555  */
 556 static IPAddressOrRanges *make_prefix_or_range(IPAddrBlocks *addr,
 557                                                const unsigned afi,
 558                                                const unsigned *safi)
 559 {
 560     IPAddressFamily *f = make_IPAddressFamily(addr, afi, safi);
 561     IPAddressOrRanges *aors = NULL;
 562
 563     if (f == NULL ||
 564         f->ipAddressChoice == NULL ||
 565         (f->ipAddressChoice->type == IPAddressChoice_inherit &&
 566          f->ipAddressChoice->u.inherit != NULL))
 567         return NULL;
 568     if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges)
 569         aors = f->ipAddressChoice->u.addressesOrRanges;
 570     if (aors != NULL)
 571         return aors;
 572     if ((aors = sk_IPAddressOrRange_new_null()) == NULL)
 573         return NULL;
 574     switch (afi) {
 575     case IANA_AFI_IPV4:
 576         (void)sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp);
 577         break;
 578     case IANA_AFI_IPV6:
 579         (void)sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp);
 580         break;
 581     }
 582     f->ipAddressChoice->type = IPAddressChoice_addressesOrRanges;
 583     f->ipAddressChoice->u.addressesOrRanges = aors;
 584     return aors;
 585 }
 586
 587 /*
 588  * Add a prefix.
 589  */
 590 int X509v3_addr_add_prefix(IPAddrBlocks *addr,
 591                            const unsigned afi,
 592                            const unsigned *safi,
 593                            unsigned char *a, const int prefixlen)
 594 {
 595     IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
 596     IPAddressOrRange *aor;
 597     if (aors == NULL || !make_addressPrefix(&aor, a, prefixlen))
 598         return 0;
 599     if (sk_IPAddressOrRange_push(aors, aor))
 600         return 1;
 601     IPAddressOrRange_free(aor);
 602     return 0;
 603 }
 604
 605 /*
 606  * Add a range.
 607  */
 608 int X509v3_addr_add_range(IPAddrBlocks *addr,
 609                           const unsigned afi,
 610                           const unsigned *safi,
 611                           unsigned char *min, unsigned char *max)
 612 {
 613     IPAddressOrRanges *aors = make_prefix_or_range(addr, afi, safi);
 614     IPAddressOrRange *aor;
 615     int length = length_from_afi(afi);
 616     if (aors == NULL)
 617         return 0;
 618     if (!make_addressRange(&aor, min, max, length))
 619         return 0;
 620     if (sk_IPAddressOrRange_push(aors, aor))
 621         return 1;
 622     IPAddressOrRange_free(aor);
 623     return 0;
 624 }
 625
 626 /*
 627  * Extract min and max values from an IPAddressOrRange.
 628  */
 629 static int extract_min_max(IPAddressOrRange *aor,
 630                            unsigned char *min, unsigned char *max, int length)
 631 {
 632     if (aor == NULL || min == NULL || max == NULL)
 633         return 0;
 634     switch (aor->type) {
 635     case IPAddressOrRange_addressPrefix:
 636         return (addr_expand(min, aor->u.addressPrefix, length, 0x00) &&
 637                 addr_expand(max, aor->u.addressPrefix, length, 0xFF));
 638     case IPAddressOrRange_addressRange:
 639         return (addr_expand(min, aor->u.addressRange->min, length, 0x00) &&
 640                 addr_expand(max, aor->u.addressRange->max, length, 0xFF));
 641     }
 642     return 0;
 643 }
 644
 645 /*
 646  * Public wrapper for extract_min_max().
 647  */
 648 int X509v3_addr_get_range(IPAddressOrRange *aor,
 649                           const unsigned afi,
 650                           unsigned char *min,
 651                           unsigned char *max, const int length)
 652 {
 653     int afi_length = length_from_afi(afi);
 654     if (aor == NULL || min == NULL || max == NULL ||
 655         afi_length == 0 || length < afi_length ||
 656         (aor->type != IPAddressOrRange_addressPrefix &&
 657          aor->type != IPAddressOrRange_addressRange) ||
 658         !extract_min_max(aor, min, max, afi_length))
 659         return 0;
 660
 661     return afi_length;
 662 }
 663
 664 /*
 665  * Sort comparison function for a sequence of IPAddressFamily.
 666  *
 667  * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about
 668  * the ordering: I can read it as meaning that IPv6 without a SAFI
 669  * comes before IPv4 with a SAFI, which seems pretty weird.  The
 670  * examples in appendix B suggest that the author intended the
 671  * null-SAFI rule to apply only within a single AFI, which is what I
 672  * would have expected and is what the following code implements.
 673  */
 674 static int IPAddressFamily_cmp(const IPAddressFamily *const *a_,
 675                                const IPAddressFamily *const *b_)
 676 {
 677     const ASN1_OCTET_STRING *a = (*a_)->addressFamily;
 678     const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
 679     int len = ((a->length <= b->length) ? a->length : b->length);
 680     int cmp = memcmp(a->data, b->data, len);
 681     return cmp ? cmp : a->length - b->length;
 682 }
 683
 684 /*
 685  * Check whether an IPAddrBLocks is in canonical form.
 686  */
 687 int X509v3_addr_is_canonical(IPAddrBlocks *addr)
 688 {
 689     unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
 690     unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
 691     IPAddressOrRanges *aors;
 692     int i, j, k;
 693
 694     /*
 695      * Empty extension is canonical.
 696      */
 697     if (addr == NULL)
 698         return 1;
 699
 700     /*
 701      * Check whether the top-level list is in order.
 702      */
 703     for (i = 0; i < sk_IPAddressFamily_num(addr) - 1; i++) {
 704         const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
 705         const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
 706         if (IPAddressFamily_cmp(&a, &b) >= 0)
 707             return 0;
 708     }
 709
 710     /*
 711      * Top level's ok, now check each address family.
 712      */
 713     for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
 714         IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
 715         int length = length_from_afi(X509v3_addr_get_afi(f));
 716
 717         /*
 718          * Inheritance is canonical.  Anything other than inheritance or
 719          * a SEQUENCE OF IPAddressOrRange is an ASN.1 error or something.
 720          */
 721         if (f == NULL || f->ipAddressChoice == NULL)
 722             return 0;
 723         switch (f->ipAddressChoice->type) {
 724         case IPAddressChoice_inherit:
 725             continue;
 726         case IPAddressChoice_addressesOrRanges:
 727             break;
 728         default:
 729             return 0;
 730         }
 731
 732         /*
 733          * It's an IPAddressOrRanges sequence, check it.
 734          */
 735         aors = f->ipAddressChoice->u.addressesOrRanges;
 736         if (sk_IPAddressOrRange_num(aors) == 0)
 737             return 0;
 738         for (j = 0; j < sk_IPAddressOrRange_num(aors) - 1; j++) {
 739             IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
 740             IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, j + 1);
 741
 742             if (!extract_min_max(a, a_min, a_max, length) ||
 743                 !extract_min_max(b, b_min, b_max, length))
 744                 return 0;
 745
 746             /*
 747              * Punt misordered list, overlapping start, or inverted range.
 748              */
 749             if (memcmp(a_min, b_min, length) >= 0 ||
 750                 memcmp(a_min, a_max, length) > 0 ||
 751                 memcmp(b_min, b_max, length) > 0)
 752                 return 0;
 753
 754             /*
 755              * Punt if adjacent or overlapping.  Check for adjacency by
 756              * subtracting one from b_min first.
 757              */
 758             for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) ;
 759             if (memcmp(a_max, b_min, length) >= 0)
 760                 return 0;
 761
 762             /*
 763              * Check for range that should be expressed as a prefix.
 764              */
 765             if (a->type == IPAddressOrRange_addressRange &&
 766                 range_should_be_prefix(a_min, a_max, length) >= 0)
 767                 return 0;
 768         }
 769
 770         /*
 771          * Check range to see if it's inverted or should be a
 772          * prefix.
 773          */
 774         j = sk_IPAddressOrRange_num(aors) - 1;
 775         {
 776             IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
 777             if (a != NULL && a->type == IPAddressOrRange_addressRange) {
 778                 if (!extract_min_max(a, a_min, a_max, length))
 779                     return 0;
 780                 if (memcmp(a_min, a_max, length) > 0 ||
 781                     range_should_be_prefix(a_min, a_max, length) >= 0)
 782                     return 0;
 783             }
 784         }
 785     }
 786
 787     /*
 788      * If we made it through all that, we're happy.
 789      */
 790     return 1;
 791 }
 792
 793 /*
 794  * Whack an IPAddressOrRanges into canonical form.
 795  */
 796 static int IPAddressOrRanges_canonize(IPAddressOrRanges *aors,
 797                                       const unsigned afi)
 798 {
 799     int i, j, length = length_from_afi(afi);
 800
 801     /*
 802      * Sort the IPAddressOrRanges sequence.
 803      */
 804     sk_IPAddressOrRange_sort(aors);
 805
 806     /*
 807      * Clean up representation issues, punt on duplicates or overlaps.
 808      */
 809     for (i = 0; i < sk_IPAddressOrRange_num(aors) - 1; i++) {
 810         IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, i);
 811         IPAddressOrRange *b = sk_IPAddressOrRange_value(aors, i + 1);
 812         unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
 813         unsigned char b_min[ADDR_RAW_BUF_LEN], b_max[ADDR_RAW_BUF_LEN];
 814
 815         if (!extract_min_max(a, a_min, a_max, length) ||
 816             !extract_min_max(b, b_min, b_max, length))
 817             return 0;
 818
 819         /*
 820          * Punt inverted ranges.
 821          */
 822         if (memcmp(a_min, a_max, length) > 0 ||
 823             memcmp(b_min, b_max, length) > 0)
 824             return 0;
 825
 826         /*
 827          * Punt overlaps.
 828          */
 829         if (memcmp(a_max, b_min, length) >= 0)
 830             return 0;
 831
 832         /*
 833          * Merge if a and b are adjacent.  We check for
 834          * adjacency by subtracting one from b_min first.
 835          */
 836         for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) ;
 837         if (memcmp(a_max, b_min, length) == 0) {
 838             IPAddressOrRange *merged;
 839             if (!make_addressRange(&merged, a_min, b_max, length))
 840                 return 0;
 841             (void)sk_IPAddressOrRange_set(aors, i, merged);
 842             (void)sk_IPAddressOrRange_delete(aors, i + 1);
 843             IPAddressOrRange_free(a);
 844             IPAddressOrRange_free(b);
 845             --i;
 846             continue;
 847         }
 848     }
 849
 850     /*
 851      * Check for inverted final range.
 852      */
 853     j = sk_IPAddressOrRange_num(aors) - 1;
 854     {
 855         IPAddressOrRange *a = sk_IPAddressOrRange_value(aors, j);
 856         if (a != NULL && a->type == IPAddressOrRange_addressRange) {
 857             unsigned char a_min[ADDR_RAW_BUF_LEN], a_max[ADDR_RAW_BUF_LEN];
 858             if (!extract_min_max(a, a_min, a_max, length))
 859                 return 0;
 860             if (memcmp(a_min, a_max, length) > 0)
 861                 return 0;
 862         }
 863     }
 864
 865     return 1;
 866 }
 867
 868 /*
 869  * Whack an IPAddrBlocks extension into canonical form.
 870  */
 871 int X509v3_addr_canonize(IPAddrBlocks *addr)
 872 {
 873     int i;
 874     for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
 875         IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
 876         if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
 877             !IPAddressOrRanges_canonize(f->ipAddressChoice->
 878                                         u.addressesOrRanges,
 879                                         X509v3_addr_get_afi(f)))
 880             return 0;
 881     }
 882     (void)sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp);
 883     sk_IPAddressFamily_sort(addr);
 884     if (!ossl_assert(X509v3_addr_is_canonical(addr)))
 885         return 0;
 886     return 1;
 887 }
 888
 889 /*
 890  * v2i handler for the IPAddrBlocks extension.
 891  */
 892 static void *v2i_IPAddrBlocks(const struct v3_ext_method *method,
 893                               struct v3_ext_ctx *ctx,
 894                               STACK_OF(CONF_VALUE) *values)
 895 {
 896     static const char v4addr_chars[] = "0123456789.";
 897     static const char v6addr_chars[] = "0123456789.:abcdefABCDEF";
 898     IPAddrBlocks *addr = NULL;
 899     char *s = NULL, *t;
 900     int i;
 901
 902     if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)) == NULL) {
 903         X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
 904         return NULL;
 905     }
 906
 907     for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
 908         CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
 909         unsigned char min[ADDR_RAW_BUF_LEN], max[ADDR_RAW_BUF_LEN];
 910         unsigned afi, *safi = NULL, safi_;
 911         const char *addr_chars = NULL;
 912         int prefixlen, i1, i2, delim, length;
 913
 914         if (!v3_name_cmp(val->name, "IPv4")) {
 915             afi = IANA_AFI_IPV4;
 916         } else if (!v3_name_cmp(val->name, "IPv6")) {
 917             afi = IANA_AFI_IPV6;
 918         } else if (!v3_name_cmp(val->name, "IPv4-SAFI")) {
 919             afi = IANA_AFI_IPV4;
 920             safi = &safi_;
 921         } else if (!v3_name_cmp(val->name, "IPv6-SAFI")) {
 922             afi = IANA_AFI_IPV6;
 923             safi = &safi_;
 924         } else {
 925             X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
 926                       X509V3_R_EXTENSION_NAME_ERROR);
 927             X509V3_conf_err(val);
 928             goto err;
 929         }
 930
 931         switch (afi) {
 932         case IANA_AFI_IPV4:
 933             addr_chars = v4addr_chars;
 934             break;
 935         case IANA_AFI_IPV6:
 936             addr_chars = v6addr_chars;
 937             break;
 938         }
 939
 940         length = length_from_afi(afi);
 941
 942         /*
 943          * Handle SAFI, if any, and OPENSSL_strdup() so we can null-terminate
 944          * the other input values.
 945          */
 946         if (safi != NULL) {
 947             *safi = strtoul(val->value, &t, 0);
 948             t += strspn(t, " \t");
 949             if (*safi > 0xFF || *t++ != ':') {
 950                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_SAFI);
 951                 X509V3_conf_err(val);
 952                 goto err;
 953             }
 954             t += strspn(t, " \t");
 955             s = OPENSSL_strdup(t);
 956         } else {
 957             s = OPENSSL_strdup(val->value);
 958         }
 959         if (s == NULL) {
 960             X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
 961             goto err;
 962         }
 963
 964         /*
 965          * Check for inheritance.  Not worth additional complexity to
 966          * optimize this (seldom-used) case.
 967          */
 968         if (strcmp(s, "inherit") == 0) {
 969             if (!X509v3_addr_add_inherit(addr, afi, safi)) {
 970                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
 971                           X509V3_R_INVALID_INHERITANCE);
 972                 X509V3_conf_err(val);
 973                 goto err;
 974             }
 975             OPENSSL_free(s);
 976             s = NULL;
 977             continue;
 978         }
 979
 980         i1 = strspn(s, addr_chars);
 981         i2 = i1 + strspn(s + i1, " \t");
 982         delim = s[i2++];
 983         s[i1] = '\0';
 984
 985         if (a2i_ipadd(min, s) != length) {
 986             X509V3err(X509V3_F_V2I_IPADDRBLOCKS, X509V3_R_INVALID_IPADDRESS);
 987             X509V3_conf_err(val);
 988             goto err;
 989         }
 990
 991         switch (delim) {
 992         case '/':
 993             prefixlen = (int)strtoul(s + i2, &t, 10);
 994             if (t == s + i2 || *t != '\0') {
 995                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
 996                           X509V3_R_EXTENSION_VALUE_ERROR);
 997                 X509V3_conf_err(val);
 998                 goto err;
 999             }
1000             if (!X509v3_addr_add_prefix(addr, afi, safi, min, prefixlen)) {
1001                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
1002                 goto err;
1003             }
1004             break;
1005         case '-':
1006             i1 = i2 + strspn(s + i2, " \t");
1007             i2 = i1 + strspn(s + i1, addr_chars);
1008             if (i1 == i2 || s[i2] != '\0') {
1009                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1010                           X509V3_R_EXTENSION_VALUE_ERROR);
1011                 X509V3_conf_err(val);
1012                 goto err;
1013             }
1014             if (a2i_ipadd(max, s + i1) != length) {
1015                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1016                           X509V3_R_INVALID_IPADDRESS);
1017                 X509V3_conf_err(val);
1018                 goto err;
1019             }
1020             if (memcmp(min, max, length_from_afi(afi)) > 0) {
1021                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1022                           X509V3_R_EXTENSION_VALUE_ERROR);
1023                 X509V3_conf_err(val);
1024                 goto err;
1025             }
1026             if (!X509v3_addr_add_range(addr, afi, safi, min, max)) {
1027                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
1028                 goto err;
1029             }
1030             break;
1031         case '\0':
1032             if (!X509v3_addr_add_prefix(addr, afi, safi, min, length * 8)) {
1033                 X509V3err(X509V3_F_V2I_IPADDRBLOCKS, ERR_R_MALLOC_FAILURE);
1034                 goto err;
1035             }
1036             break;
1037         default:
1038             X509V3err(X509V3_F_V2I_IPADDRBLOCKS,
1039                       X509V3_R_EXTENSION_VALUE_ERROR);
1040             X509V3_conf_err(val);
1041             goto err;
1042         }
1043
1044         OPENSSL_free(s);
1045         s = NULL;
1046     }
1047
1048     /*
1049      * Canonize the result, then we're done.
1050      */
1051     if (!X509v3_addr_canonize(addr))
1052         goto err;
1053     return addr;
1054
1055  err:
1056     OPENSSL_free(s);
1057     sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
1058     return NULL;
1059 }
1060
1061 /*
1062  * OpenSSL dispatch
1063  */
1064 const X509V3_EXT_METHOD v3_addr = {
1065     NID_sbgp_ipAddrBlock,       /* nid */
1066     0,                          /* flags */
1067     ASN1_ITEM_ref(IPAddrBlocks), /* template */
1068     0, 0, 0, 0,                 /* old functions, ignored */
1069     0,                          /* i2s */
1070     0,                          /* s2i */
1071     0,                          /* i2v */
1072     v2i_IPAddrBlocks,           /* v2i */
1073     i2r_IPAddrBlocks,           /* i2r */
1074     0,                          /* r2i */
1075     NULL                        /* extension-specific data */
1076 };
1077
1078 /*
1079  * Figure out whether extension sues inheritance.
1080  */
1081 int X509v3_addr_inherits(IPAddrBlocks *addr)
1082 {
1083     int i;
1084     if (addr == NULL)
1085         return 0;
1086     for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
1087         IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
1088         if (f->ipAddressChoice->type == IPAddressChoice_inherit)
1089             return 1;
1090     }
1091     return 0;
1092 }
1093
1094 /*
1095  * Figure out whether parent contains child.
1096  */
1097 static int addr_contains(IPAddressOrRanges *parent,
1098                          IPAddressOrRanges *child, int length)
1099 {
1100     unsigned char p_min[ADDR_RAW_BUF_LEN], p_max[ADDR_RAW_BUF_LEN];
1101     unsigned char c_min[ADDR_RAW_BUF_LEN], c_max[ADDR_RAW_BUF_LEN];
1102     int p, c;
1103
1104     if (child == NULL || parent == child)
1105         return 1;
1106     if (parent == NULL)
1107         return 0;
1108
1109     p = 0;
1110     for (c = 0; c < sk_IPAddressOrRange_num(child); c++) {
1111         if (!extract_min_max(sk_IPAddressOrRange_value(child, c),
1112                              c_min, c_max, length))
1113             return -1;
1114         for (;; p++) {
1115             if (p >= sk_IPAddressOrRange_num(parent))
1116                 return 0;
1117             if (!extract_min_max(sk_IPAddressOrRange_value(parent, p),
1118                                  p_min, p_max, length))
1119                 return 0;
1120             if (memcmp(p_max, c_max, length) < 0)
1121                 continue;
1122             if (memcmp(p_min, c_min, length) > 0)
1123                 return 0;
1124             break;
1125         }
1126     }
1127
1128     return 1;
1129 }
1130
1131 /*
1132  * Test whether a is a subset of b.
1133  */
1134 int X509v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b)
1135 {
1136     int i;
1137     if (a == NULL || a == b)
1138         return 1;
1139     if (b == NULL || X509v3_addr_inherits(a) || X509v3_addr_inherits(b))
1140         return 0;
1141     (void)sk_IPAddressFamily_set_cmp_func(b, IPAddressFamily_cmp);
1142     for (i = 0; i < sk_IPAddressFamily_num(a); i++) {
1143         IPAddressFamily *fa = sk_IPAddressFamily_value(a, i);
1144         int j = sk_IPAddressFamily_find(b, fa);
1145         IPAddressFamily *fb;
1146         fb = sk_IPAddressFamily_value(b, j);
1147         if (fb == NULL)
1148             return 0;
1149         if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
1150                            fa->ipAddressChoice->u.addressesOrRanges,
1151                            length_from_afi(X509v3_addr_get_afi(fb))))
1152             return 0;
1153     }
1154     return 1;
1155 }
1156
1157 /*
1158  * Validation error handling via callback.
1159  */
1160 #define validation_err(_err_)           \
1161   do {                                  \
1162     if (ctx != NULL) {                  \
1163       ctx->error = _err_;               \
1164       ctx->error_depth = i;             \
1165       ctx->current_cert = x;            \
1166       ret = ctx->verify_cb(0, ctx);     \
1167     } else {                            \
1168       ret = 0;                          \
1169     }                                   \
1170     if (!ret)                           \
1171       goto done;                        \
1172   } while (0)
1173
1174 /*
1175  * Core code for RFC 3779 2.3 path validation.
1176  *
1177  * Returns 1 for success, 0 on error.
1178  *
1179  * When returning 0, ctx->error MUST be set to an appropriate value other than
1180  * X509_V_OK.
1181  */
1182 static int addr_validate_path_internal(X509_STORE_CTX *ctx,
1183                                        STACK_OF(X509) *chain,
1184                                        IPAddrBlocks *ext)
1185 {
1186     IPAddrBlocks *child = NULL;
1187     int i, j, ret = 1;
1188     X509 *x;
1189
1190     if (!ossl_assert(chain != NULL && sk_X509_num(chain) > 0)
1191             || !ossl_assert(ctx != NULL || ext != NULL)
1192             || !ossl_assert(ctx == NULL || ctx->verify_cb != NULL)) {
1193         if (ctx != NULL)
1194             ctx->error = X509_V_ERR_UNSPECIFIED;
1195         return 0;
1196     }
1197
1198     /*
1199      * Figure out where to start.  If we don't have an extension to
1200      * check, we're done.  Otherwise, check canonical form and
1201      * set up for walking up the chain.
1202      */
1203     if (ext != NULL) {
1204         i = -1;
1205         x = NULL;
1206     } else {
1207         i = 0;
1208         x = sk_X509_value(chain, i);
1209         if ((ext = x->rfc3779_addr) == NULL)
1210             goto done;
1211     }
1212     if (!X509v3_addr_is_canonical(ext))
1213         validation_err(X509_V_ERR_INVALID_EXTENSION);
1214     (void)sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp);
1215     if ((child = sk_IPAddressFamily_dup(ext)) == NULL) {
1216         X509V3err(X509V3_F_ADDR_VALIDATE_PATH_INTERNAL,
1217                   ERR_R_MALLOC_FAILURE);
1218         if (ctx != NULL)
1219             ctx->error = X509_V_ERR_OUT_OF_MEM;
1220         ret = 0;
1221         goto done;
1222     }
1223
1224     /*
1225      * Now walk up the chain.  No cert may list resources that its
1226      * parent doesn't list.
1227      */
1228     for (i++; i < sk_X509_num(chain); i++) {
1229         x = sk_X509_value(chain, i);
1230         if (!X509v3_addr_is_canonical(x->rfc3779_addr))
1231             validation_err(X509_V_ERR_INVALID_EXTENSION);
1232         if (x->rfc3779_addr == NULL) {
1233             for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1234                 IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
1235                 if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
1236                     validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1237                     break;
1238                 }
1239             }
1240             continue;
1241         }
1242         (void)sk_IPAddressFamily_set_cmp_func(x->rfc3779_addr,
1243                                               IPAddressFamily_cmp);
1244         for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
1245             IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
1246             int k = sk_IPAddressFamily_find(x->rfc3779_addr, fc);
1247             IPAddressFamily *fp =
1248                 sk_IPAddressFamily_value(x->rfc3779_addr, k);
1249             if (fp == NULL) {
1250                 if (fc->ipAddressChoice->type ==
1251                     IPAddressChoice_addressesOrRanges) {
1252                     validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1253                     break;
1254                 }
1255                 continue;
1256             }
1257             if (fp->ipAddressChoice->type ==
1258                 IPAddressChoice_addressesOrRanges) {
1259                 if (fc->ipAddressChoice->type == IPAddressChoice_inherit
1260                     || addr_contains(fp->ipAddressChoice->u.addressesOrRanges,
1261                                      fc->ipAddressChoice->u.addressesOrRanges,
1262                                      length_from_afi(X509v3_addr_get_afi(fc))))
1263                     sk_IPAddressFamily_set(child, j, fp);
1264                 else
1265                     validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1266             }
1267         }
1268     }
1269
1270     /*
1271      * Trust anchor can't inherit.
1272      */
1273     if (x->rfc3779_addr != NULL) {
1274         for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
1275             IPAddressFamily *fp =
1276                 sk_IPAddressFamily_value(x->rfc3779_addr, j);
1277             if (fp->ipAddressChoice->type == IPAddressChoice_inherit
1278                 && sk_IPAddressFamily_find(child, fp) >= 0)
1279                 validation_err(X509_V_ERR_UNNESTED_RESOURCE);
1280         }
1281     }
1282
1283  done:
1284     sk_IPAddressFamily_free(child);
1285     return ret;
1286 }
1287
1288 #undef validation_err
1289
1290 /*
1291  * RFC 3779 2.3 path validation -- called from X509_verify_cert().
1292  */
1293 int X509v3_addr_validate_path(X509_STORE_CTX *ctx)
1294 {
1295     if (ctx->chain == NULL
1296             || sk_X509_num(ctx->chain) == 0
1297             || ctx->verify_cb == NULL) {
1298         ctx->error = X509_V_ERR_UNSPECIFIED;
1299         return 0;
1300     }
1301     return addr_validate_path_internal(ctx, ctx->chain, NULL);
1302 }
1303
1304 /*
1305  * RFC 3779 2.3 path validation of an extension.
1306  * Test whether chain covers extension.
1307  */
1308 int X509v3_addr_validate_resource_set(STACK_OF(X509) *chain,
1309                                   IPAddrBlocks *ext, int allow_inheritance)
1310 {
1311     if (ext == NULL)
1312         return 1;
1313     if (chain == NULL || sk_X509_num(chain) == 0)
1314         return 0;
1315     if (!allow_inheritance && X509v3_addr_inherits(ext))
1316         return 0;
1317     return addr_validate_path_internal(NULL, chain, ext);
1318 }
1319
1320 #endif                          /* OPENSSL_NO_RFC3779 */