crypto/x509/v3_crld.c

   1 /*
   2  * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include "internal/cryptlib.h"
  12 #include <openssl/conf.h>
  13 #include <openssl/asn1.h>
  14 #include <openssl/asn1t.h>
  15 #include <openssl/x509v3.h>
  16
  17 #include "crypto/x509.h"
  18 #include "ext_dat.h"
  19
  20 DEFINE_STACK_OF(CONF_VALUE)
  21 DEFINE_STACK_OF(GENERAL_NAME)
  22 DEFINE_STACK_OF(DIST_POINT)
  23 DEFINE_STACK_OF(X509_NAME_ENTRY)
  24
  25 static void *v2i_crld(const X509V3_EXT_METHOD *method,
  26                       X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
  27 static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
  28                      int indent);
  29
  30 const X509V3_EXT_METHOD v3_crld = {
  31     NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
  32     0, 0, 0, 0,
  33     0, 0,
  34     0,
  35     v2i_crld,
  36     i2r_crldp, 0,
  37     NULL
  38 };
  39
  40 const X509V3_EXT_METHOD v3_freshest_crl = {
  41     NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
  42     0, 0, 0, 0,
  43     0, 0,
  44     0,
  45     v2i_crld,
  46     i2r_crldp, 0,
  47     NULL
  48 };
  49
  50 static STACK_OF(GENERAL_NAME) *gnames_from_sectname(X509V3_CTX *ctx,
  51                                                     char *sect)
  52 {
  53     STACK_OF(CONF_VALUE) *gnsect;
  54     STACK_OF(GENERAL_NAME) *gens;
  55     if (*sect == '@')
  56         gnsect = X509V3_get_section(ctx, sect + 1);
  57     else
  58         gnsect = X509V3_parse_list(sect);
  59     if (!gnsect) {
  60         X509V3err(X509V3_F_GNAMES_FROM_SECTNAME, X509V3_R_SECTION_NOT_FOUND);
  61         return NULL;
  62     }
  63     gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
  64     if (*sect == '@')
  65         X509V3_section_free(ctx, gnsect);
  66     else
  67         sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
  68     return gens;
  69 }
  70
  71 static int set_dist_point_name(DIST_POINT_NAME **pdp, X509V3_CTX *ctx,
  72                                CONF_VALUE *cnf)
  73 {
  74     STACK_OF(GENERAL_NAME) *fnm = NULL;
  75     STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
  76
  77     if (strncmp(cnf->name, "fullname", 9) == 0) {
  78         fnm = gnames_from_sectname(ctx, cnf->value);
  79         if (!fnm)
  80             goto err;
  81     } else if (strcmp(cnf->name, "relativename") == 0) {
  82         int ret;
  83         STACK_OF(CONF_VALUE) *dnsect;
  84         X509_NAME *nm;
  85         nm = X509_NAME_new();
  86         if (nm == NULL)
  87             return -1;
  88         dnsect = X509V3_get_section(ctx, cnf->value);
  89         if (!dnsect) {
  90             X509V3err(X509V3_F_SET_DIST_POINT_NAME,
  91                       X509V3_R_SECTION_NOT_FOUND);
  92             return -1;
  93         }
  94         ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
  95         X509V3_section_free(ctx, dnsect);
  96         rnm = nm->entries;
  97         nm->entries = NULL;
  98         X509_NAME_free(nm);
  99         if (!ret || sk_X509_NAME_ENTRY_num(rnm) <= 0)
 100             goto err;
 101         /*
 102          * Since its a name fragment can't have more than one RDNSequence
 103          */
 104         if (sk_X509_NAME_ENTRY_value(rnm,
 105                                      sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
 106             X509V3err(X509V3_F_SET_DIST_POINT_NAME,
 107                       X509V3_R_INVALID_MULTIPLE_RDNS);
 108             goto err;
 109         }
 110     } else
 111         return 0;
 112
 113     if (*pdp) {
 114         X509V3err(X509V3_F_SET_DIST_POINT_NAME,
 115                   X509V3_R_DISTPOINT_ALREADY_SET);
 116         goto err;
 117     }
 118
 119     *pdp = DIST_POINT_NAME_new();
 120     if (*pdp == NULL)
 121         goto err;
 122     if (fnm) {
 123         (*pdp)->type = 0;
 124         (*pdp)->name.fullname = fnm;
 125     } else {
 126         (*pdp)->type = 1;
 127         (*pdp)->name.relativename = rnm;
 128     }
 129
 130     return 1;
 131
 132  err:
 133     sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
 134     sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
 135     return -1;
 136 }
 137
 138 static const BIT_STRING_BITNAME reason_flags[] = {
 139     {0, "Unused", "unused"},
 140     {1, "Key Compromise", "keyCompromise"},
 141     {2, "CA Compromise", "CACompromise"},
 142     {3, "Affiliation Changed", "affiliationChanged"},
 143     {4, "Superseded", "superseded"},
 144     {5, "Cessation Of Operation", "cessationOfOperation"},
 145     {6, "Certificate Hold", "certificateHold"},
 146     {7, "Privilege Withdrawn", "privilegeWithdrawn"},
 147     {8, "AA Compromise", "AACompromise"},
 148     {-1, NULL, NULL}
 149 };
 150
 151 static int set_reasons(ASN1_BIT_STRING **preas, char *value)
 152 {
 153     STACK_OF(CONF_VALUE) *rsk = NULL;
 154     const BIT_STRING_BITNAME *pbn;
 155     const char *bnam;
 156     int i, ret = 0;
 157     rsk = X509V3_parse_list(value);
 158     if (rsk == NULL)
 159         return 0;
 160     if (*preas != NULL)
 161         goto err;
 162     for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
 163         bnam = sk_CONF_VALUE_value(rsk, i)->name;
 164         if (*preas == NULL) {
 165             *preas = ASN1_BIT_STRING_new();
 166             if (*preas == NULL)
 167                 goto err;
 168         }
 169         for (pbn = reason_flags; pbn->lname; pbn++) {
 170             if (strcmp(pbn->sname, bnam) == 0) {
 171                 if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
 172                     goto err;
 173                 break;
 174             }
 175         }
 176         if (pbn->lname == NULL)
 177             goto err;
 178     }
 179     ret = 1;
 180
 181  err:
 182     sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
 183     return ret;
 184 }
 185
 186 static int print_reasons(BIO *out, const char *rname,
 187                          ASN1_BIT_STRING *rflags, int indent)
 188 {
 189     int first = 1;
 190     const BIT_STRING_BITNAME *pbn;
 191     BIO_printf(out, "%*s%s:\n%*s", indent, "", rname, indent + 2, "");
 192     for (pbn = reason_flags; pbn->lname; pbn++) {
 193         if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
 194             if (first)
 195                 first = 0;
 196             else
 197                 BIO_puts(out, ", ");
 198             BIO_puts(out, pbn->lname);
 199         }
 200     }
 201     if (first)
 202         BIO_puts(out, "<EMPTY>\n");
 203     else
 204         BIO_puts(out, "\n");
 205     return 1;
 206 }
 207
 208 static DIST_POINT *crldp_from_section(X509V3_CTX *ctx,
 209                                       STACK_OF(CONF_VALUE) *nval)
 210 {
 211     int i;
 212     CONF_VALUE *cnf;
 213     DIST_POINT *point = DIST_POINT_new();
 214
 215     if (point == NULL)
 216         goto err;
 217     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
 218         int ret;
 219         cnf = sk_CONF_VALUE_value(nval, i);
 220         ret = set_dist_point_name(&point->distpoint, ctx, cnf);
 221         if (ret > 0)
 222             continue;
 223         if (ret < 0)
 224             goto err;
 225         if (strcmp(cnf->name, "reasons") == 0) {
 226             if (!set_reasons(&point->reasons, cnf->value))
 227                 goto err;
 228         } else if (strcmp(cnf->name, "CRLissuer") == 0) {
 229             point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
 230             if (point->CRLissuer == NULL)
 231                 goto err;
 232         }
 233     }
 234
 235     return point;
 236
 237  err:
 238     DIST_POINT_free(point);
 239     return NULL;
 240 }
 241
 242 static void *v2i_crld(const X509V3_EXT_METHOD *method,
 243                       X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
 244 {
 245     STACK_OF(DIST_POINT) *crld;
 246     GENERAL_NAMES *gens = NULL;
 247     GENERAL_NAME *gen = NULL;
 248     CONF_VALUE *cnf;
 249     const int num = sk_CONF_VALUE_num(nval);
 250     int i;
 251
 252     crld = sk_DIST_POINT_new_reserve(NULL, num);
 253     if (crld == NULL)
 254         goto merr;
 255     for (i = 0; i < num; i++) {
 256         DIST_POINT *point;
 257
 258         cnf = sk_CONF_VALUE_value(nval, i);
 259         if (!cnf->value) {
 260             STACK_OF(CONF_VALUE) *dpsect;
 261             dpsect = X509V3_get_section(ctx, cnf->name);
 262             if (!dpsect)
 263                 goto err;
 264             point = crldp_from_section(ctx, dpsect);
 265             X509V3_section_free(ctx, dpsect);
 266             if (point == NULL)
 267                 goto err;
 268             sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
 269         } else {
 270             if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
 271                 goto err;
 272             if ((gens = GENERAL_NAMES_new()) == NULL)
 273                 goto merr;
 274             if (!sk_GENERAL_NAME_push(gens, gen))
 275                 goto merr;
 276             gen = NULL;
 277             if ((point = DIST_POINT_new()) == NULL)
 278                 goto merr;
 279             sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
 280             if ((point->distpoint = DIST_POINT_NAME_new()) == NULL)
 281                 goto merr;
 282             point->distpoint->name.fullname = gens;
 283             point->distpoint->type = 0;
 284             gens = NULL;
 285         }
 286     }
 287     return crld;
 288
 289  merr:
 290     X509V3err(X509V3_F_V2I_CRLD, ERR_R_MALLOC_FAILURE);
 291  err:
 292     GENERAL_NAME_free(gen);
 293     GENERAL_NAMES_free(gens);
 294     sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
 295     return NULL;
 296 }
 297
 298 static int dpn_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 299                   void *exarg)
 300 {
 301     DIST_POINT_NAME *dpn = (DIST_POINT_NAME *)*pval;
 302
 303     switch (operation) {
 304     case ASN1_OP_NEW_POST:
 305         dpn->dpname = NULL;
 306         break;
 307
 308     case ASN1_OP_FREE_POST:
 309         X509_NAME_free(dpn->dpname);
 310         break;
 311     }
 312     return 1;
 313 }
 314
 315
 316 ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
 317         ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
 318         ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
 319 } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
 320
 321
 322 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
 323
 324 ASN1_SEQUENCE(DIST_POINT) = {
 325         ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
 326         ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
 327         ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
 328 } ASN1_SEQUENCE_END(DIST_POINT)
 329
 330 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
 331
 332 ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
 333         ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
 334 ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
 335
 336 IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
 337
 338 ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
 339         ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
 340         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
 341         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
 342         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
 343         ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
 344         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
 345 } ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
 346
 347 IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
 348
 349 static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
 350                    int indent);
 351 static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
 352                      STACK_OF(CONF_VALUE) *nval);
 353
 354 const X509V3_EXT_METHOD v3_idp = {
 355     NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
 356     ASN1_ITEM_ref(ISSUING_DIST_POINT),
 357     0, 0, 0, 0,
 358     0, 0,
 359     0,
 360     v2i_idp,
 361     i2r_idp, 0,
 362     NULL
 363 };
 364
 365 static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
 366                      STACK_OF(CONF_VALUE) *nval)
 367 {
 368     ISSUING_DIST_POINT *idp = NULL;
 369     CONF_VALUE *cnf;
 370     char *name, *val;
 371     int i, ret;
 372     idp = ISSUING_DIST_POINT_new();
 373     if (idp == NULL)
 374         goto merr;
 375     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
 376         cnf = sk_CONF_VALUE_value(nval, i);
 377         name = cnf->name;
 378         val = cnf->value;
 379         ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
 380         if (ret > 0)
 381             continue;
 382         if (ret < 0)
 383             goto err;
 384         if (strcmp(name, "onlyuser") == 0) {
 385             if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
 386                 goto err;
 387         } else if (strcmp(name, "onlyCA") == 0) {
 388             if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
 389                 goto err;
 390         } else if (strcmp(name, "onlyAA") == 0) {
 391             if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
 392                 goto err;
 393         } else if (strcmp(name, "indirectCRL") == 0) {
 394             if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
 395                 goto err;
 396         } else if (strcmp(name, "onlysomereasons") == 0) {
 397             if (!set_reasons(&idp->onlysomereasons, val))
 398                 goto err;
 399         } else {
 400             X509V3err(X509V3_F_V2I_IDP, X509V3_R_INVALID_NAME);
 401             X509V3_conf_err(cnf);
 402             goto err;
 403         }
 404     }
 405     return idp;
 406
 407  merr:
 408     X509V3err(X509V3_F_V2I_IDP, ERR_R_MALLOC_FAILURE);
 409  err:
 410     ISSUING_DIST_POINT_free(idp);
 411     return NULL;
 412 }
 413
 414 static int print_gens(BIO *out, STACK_OF(GENERAL_NAME) *gens, int indent)
 415 {
 416     int i;
 417     for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
 418         if (i > 0)
 419             BIO_puts(out, "\n");
 420         BIO_printf(out, "%*s", indent + 2, "");
 421         GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
 422     }
 423     return 1;
 424 }
 425
 426 static int print_distpoint(BIO *out, DIST_POINT_NAME *dpn, int indent)
 427 {
 428     if (dpn->type == 0) {
 429         BIO_printf(out, "%*sFull Name:\n", indent, "");
 430         print_gens(out, dpn->name.fullname, indent);
 431     } else {
 432         X509_NAME ntmp;
 433         ntmp.entries = dpn->name.relativename;
 434         BIO_printf(out, "%*sRelative Name:\n%*s", indent, "", indent + 2, "");
 435         X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
 436         BIO_puts(out, "\n");
 437     }
 438     return 1;
 439 }
 440
 441 static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
 442                    int indent)
 443 {
 444     ISSUING_DIST_POINT *idp = pidp;
 445     if (idp->distpoint)
 446         print_distpoint(out, idp->distpoint, indent);
 447     if (idp->onlyuser > 0)
 448         BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
 449     if (idp->onlyCA > 0)
 450         BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
 451     if (idp->indirectCRL > 0)
 452         BIO_printf(out, "%*sIndirect CRL\n", indent, "");
 453     if (idp->onlysomereasons)
 454         print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
 455     if (idp->onlyattr > 0)
 456         BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
 457     if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
 458         && (idp->indirectCRL <= 0) && !idp->onlysomereasons
 459         && (idp->onlyattr <= 0))
 460         BIO_printf(out, "%*s<EMPTY>\n", indent, "");
 461
 462     return 1;
 463 }
 464
 465 static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
 466                      int indent)
 467 {
 468     STACK_OF(DIST_POINT) *crld = pcrldp;
 469     DIST_POINT *point;
 470     int i;
 471     for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
 472         if (i > 0)
 473             BIO_puts(out, "\n");
 474         point = sk_DIST_POINT_value(crld, i);
 475         if (point->distpoint)
 476             print_distpoint(out, point->distpoint, indent);
 477         if (point->reasons)
 478             print_reasons(out, "Reasons", point->reasons, indent);
 479         if (point->CRLissuer) {
 480             BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
 481             print_gens(out, point->CRLissuer, indent);
 482         }
 483     }
 484     return 1;
 485 }
 486
 487 int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, const X509_NAME *iname)
 488 {
 489     int i;
 490     STACK_OF(X509_NAME_ENTRY) *frag;
 491     X509_NAME_ENTRY *ne;
 492     if (!dpn || (dpn->type != 1))
 493         return 1;
 494     frag = dpn->name.relativename;
 495     dpn->dpname = X509_NAME_dup(iname);
 496     if (!dpn->dpname)
 497         return 0;
 498     for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
 499         ne = sk_X509_NAME_ENTRY_value(frag, i);
 500         if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1)) {
 501             X509_NAME_free(dpn->dpname);
 502             dpn->dpname = NULL;
 503             return 0;
 504         }
 505     }
 506     /* generate cached encoding of name */
 507     if (i2d_X509_NAME(dpn->dpname, NULL) < 0) {
 508         X509_NAME_free(dpn->dpname);
 509         dpn->dpname = NULL;
 510         return 0;
 511     }
 512     return 1;
 513 }