The previous commit to crypto/stack/*.[ch] pulled the type-safety strings
[openssl.git] / crypto / x509v3 / v3_purp.c
1 /* v3_purp.c */
2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
3  * project 1999.
4  */
5 /* ====================================================================
6  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer. 
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * (eay@cryptsoft.com).  This product includes software written by Tim
55  * Hudson (tjh@cryptsoft.com).
56  *
57  */
58
59 #include <stdio.h>
60 #include "cryptlib.h"
61 #include <openssl/x509v3.h>
62
63
64 static void x509v3_cache_extensions(X509 *x);
65
66 static int ca_check(const X509 *x);
67 static int check_ssl_ca(const X509 *x);
68 static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca);
69 static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca);
70 static int check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca);
71 static int purpose_smime(const X509 *x, int ca);
72 static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
73 static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca);
74 static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca);
75 static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
76
77 static int xp_cmp(const X509_PURPOSE * const *a,
78                 const X509_PURPOSE * const *b);
79 static void xptable_free(X509_PURPOSE *p);
80
81 static X509_PURPOSE xstandard[] = {
82         {X509_PURPOSE_SSL_CLIENT, X509_TRUST_SSL_CLIENT, 0, check_purpose_ssl_client, "SSL client", "sslclient", NULL},
83         {X509_PURPOSE_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ssl_server, "SSL server", "sslserver", NULL},
84         {X509_PURPOSE_NS_SSL_SERVER, X509_TRUST_SSL_SERVER, 0, check_purpose_ns_ssl_server, "Netscape SSL server", "nssslserver", NULL},
85         {X509_PURPOSE_SMIME_SIGN, X509_TRUST_EMAIL, 0, check_purpose_smime_sign, "S/MIME signing", "smimesign", NULL},
86         {X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
87         {X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
88         {X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
89 };
90
91 #define X509_PURPOSE_COUNT (sizeof(xstandard)/sizeof(X509_PURPOSE))
92
93 IMPLEMENT_STACK_OF(X509_PURPOSE)
94
95 static STACK_OF(X509_PURPOSE) *xptable = NULL;
96
97 static int xp_cmp(const X509_PURPOSE * const *a,
98                 const X509_PURPOSE * const *b)
99 {
100         return (*a)->purpose - (*b)->purpose;
101 }
102
103 /* As much as I'd like to make X509_check_purpose use a "const" X509*
104  * I really can't because it does recalculate hashes and do other non-const
105  * things. */
106 int X509_check_purpose(X509 *x, int id, int ca)
107 {
108         int idx;
109         const X509_PURPOSE *pt;
110         if(!(x->ex_flags & EXFLAG_SET)) {
111                 CRYPTO_w_lock(CRYPTO_LOCK_X509);
112                 x509v3_cache_extensions(x);
113                 CRYPTO_w_unlock(CRYPTO_LOCK_X509);
114         }
115         if(id == -1) return 1;
116         idx = X509_PURPOSE_get_by_id(id);
117         if(idx == -1) return -1;
118         pt = X509_PURPOSE_get0(idx);
119         return pt->check_purpose(pt, x, ca);
120 }
121
122 int X509_PURPOSE_get_count(void)
123 {
124         if(!xptable) return X509_PURPOSE_COUNT;
125         return sk_X509_PURPOSE_num(xptable) + X509_PURPOSE_COUNT;
126 }
127
128 X509_PURPOSE * X509_PURPOSE_get0(int idx)
129 {
130         if(idx < 0) return NULL;
131         if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
132         return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
133 }
134
135 int X509_PURPOSE_get_by_sname(char *sname)
136 {
137         int i;
138         X509_PURPOSE *xptmp;
139         for(i = 0; i < X509_PURPOSE_get_count(); i++) {
140                 xptmp = X509_PURPOSE_get0(i);
141                 if(!strcmp(xptmp->sname, sname)) return i;
142         }
143         return -1;
144 }
145
146
147 int X509_PURPOSE_get_by_id(int purpose)
148 {
149         X509_PURPOSE tmp;
150         int idx;
151         if((purpose >= X509_PURPOSE_MIN) && (purpose <= X509_PURPOSE_MAX))
152                 return purpose - X509_PURPOSE_MIN;
153         tmp.purpose = purpose;
154         if(!xptable) return -1;
155         idx = sk_X509_PURPOSE_find(xptable, &tmp);
156         if(idx == -1) return -1;
157         return idx + X509_PURPOSE_COUNT;
158 }
159
160 int X509_PURPOSE_add(int id, int trust, int flags,
161                         int (*ck)(const X509_PURPOSE *, const X509 *, int),
162                                         char *name, char *sname, void *arg)
163 {
164         int idx;
165         X509_PURPOSE *ptmp;
166         /* This is set according to what we change: application can't set it */
167         flags &= ~X509_PURPOSE_DYNAMIC;
168         /* This will always be set for application modified trust entries */
169         flags |= X509_PURPOSE_DYNAMIC_NAME;
170         /* Get existing entry if any */
171         idx = X509_PURPOSE_get_by_id(id);
172         /* Need a new entry */
173         if(idx == -1) {
174                 if(!(ptmp = Malloc(sizeof(X509_PURPOSE)))) {
175                         X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
176                         return 0;
177                 }
178                 ptmp->flags = X509_PURPOSE_DYNAMIC;
179         } else ptmp = X509_PURPOSE_get0(idx);
180
181         /* Free existing name if dynamic */
182         if(ptmp->flags & X509_PURPOSE_DYNAMIC_NAME) {
183                 Free(ptmp->name);
184                 Free(ptmp->sname);
185         }
186         /* dup supplied name */
187         ptmp->name = BUF_strdup(name);
188         ptmp->sname = BUF_strdup(sname);
189         if(!ptmp->name || !ptmp->sname) {
190                 X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
191                 return 0;
192         }
193         /* Keep the dynamic flag of existing entry */
194         ptmp->flags &= X509_PURPOSE_DYNAMIC;
195         /* Set all other flags */
196         ptmp->flags |= flags;
197
198         ptmp->purpose = id;
199         ptmp->trust = trust;
200         ptmp->check_purpose = ck;
201         ptmp->usr_data = arg;
202
203         /* If its a new entry manage the dynamic table */
204         if(idx == -1) {
205                 if(!xptable && !(xptable = sk_X509_PURPOSE_new(xp_cmp))) {
206                         X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
207                         return 0;
208                 }
209                 if (!sk_X509_PURPOSE_push(xptable, ptmp)) {
210                         X509V3err(X509V3_F_X509_PURPOSE_ADD,ERR_R_MALLOC_FAILURE);
211                         return 0;
212                 }
213         }
214         return 1;
215 }
216
217 static void xptable_free(X509_PURPOSE *p)
218         {
219         if(!p) return;
220         if (p->flags & X509_PURPOSE_DYNAMIC) 
221                 {
222                 if (p->flags & X509_PURPOSE_DYNAMIC_NAME) {
223                         Free(p->name);
224                         Free(p->sname);
225                 }
226                 Free(p);
227                 }
228         }
229
230 void X509_PURPOSE_cleanup(void)
231 {
232         int i;
233         sk_X509_PURPOSE_pop_free(xptable, xptable_free);
234         for(i = 0; i < X509_PURPOSE_COUNT; i++) xptable_free(xstandard + i);
235         xptable = NULL;
236 }
237
238 int X509_PURPOSE_get_id(X509_PURPOSE *xp)
239 {
240         return xp->purpose;
241 }
242
243 char *X509_PURPOSE_get0_name(X509_PURPOSE *xp)
244 {
245         return xp->name;
246 }
247
248 char *X509_PURPOSE_get0_sname(X509_PURPOSE *xp)
249 {
250         return xp->sname;
251 }
252
253 int X509_PURPOSE_get_trust(X509_PURPOSE *xp)
254 {
255         return xp->trust;
256 }
257
258 #ifndef NO_SHA
259 static void x509v3_cache_extensions(X509 *x)
260 {
261         BASIC_CONSTRAINTS *bs;
262         ASN1_BIT_STRING *usage;
263         ASN1_BIT_STRING *ns;
264         STACK_OF(ASN1_OBJECT) *extusage;
265         int i;
266         if(x->ex_flags & EXFLAG_SET) return;
267         X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
268         /* Does subject name match issuer ? */
269         if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
270                          x->ex_flags |= EXFLAG_SS;
271         /* V1 should mean no extensions ... */
272         if(!X509_get_version(x)) x->ex_flags |= EXFLAG_V1;
273         /* Handle basic constraints */
274         if((bs=X509_get_ext_d2i(x, NID_basic_constraints, NULL, NULL))) {
275                 if(bs->ca) x->ex_flags |= EXFLAG_CA;
276                 if(bs->pathlen) {
277                         if((bs->pathlen->type == V_ASN1_NEG_INTEGER)
278                                                 || !bs->ca) {
279                                 x->ex_flags |= EXFLAG_INVALID;
280                                 x->ex_pathlen = 0;
281                         } else x->ex_pathlen = ASN1_INTEGER_get(bs->pathlen);
282                 } else x->ex_pathlen = -1;
283                 BASIC_CONSTRAINTS_free(bs);
284                 x->ex_flags |= EXFLAG_BCONS;
285         }
286         /* Handle key usage */
287         if((usage=X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
288                 if(usage->length > 0) {
289                         x->ex_kusage = usage->data[0];
290                         if(usage->length > 1) 
291                                 x->ex_kusage |= usage->data[1] << 8;
292                 } else x->ex_kusage = 0;
293                 x->ex_flags |= EXFLAG_KUSAGE;
294                 ASN1_BIT_STRING_free(usage);
295         }
296         x->ex_xkusage = 0;
297         if((extusage=X509_get_ext_d2i(x, NID_ext_key_usage, NULL, NULL))) {
298                 x->ex_flags |= EXFLAG_XKUSAGE;
299                 for(i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
300                         switch(OBJ_obj2nid(sk_ASN1_OBJECT_value(extusage,i))) {
301                                 case NID_server_auth:
302                                 x->ex_xkusage |= XKU_SSL_SERVER;
303                                 break;
304
305                                 case NID_client_auth:
306                                 x->ex_xkusage |= XKU_SSL_CLIENT;
307                                 break;
308
309                                 case NID_email_protect:
310                                 x->ex_xkusage |= XKU_SMIME;
311                                 break;
312
313                                 case NID_code_sign:
314                                 x->ex_xkusage |= XKU_CODE_SIGN;
315                                 break;
316
317                                 case NID_ms_sgc:
318                                 case NID_ns_sgc:
319                                 x->ex_xkusage |= XKU_SGC;
320                         }
321                 }
322                 sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
323         }
324
325         if((ns=X509_get_ext_d2i(x, NID_netscape_cert_type, NULL, NULL))) {
326                 if(ns->length > 0) x->ex_nscert = ns->data[0];
327                 else x->ex_nscert = 0;
328                 x->ex_flags |= EXFLAG_NSCERT;
329                 ASN1_BIT_STRING_free(ns);
330         }
331         x->ex_flags |= EXFLAG_SET;
332 }
333 #endif
334
335 /* CA checks common to all purposes
336  * return codes:
337  * 0 not a CA
338  * 1 is a CA
339  * 2 basicConstraints absent so "maybe" a CA
340  * 3 basicConstraints absent but self signed V1.
341  */
342
343 #define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
344 #define ku_reject(x, usage) \
345         (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
346 #define xku_reject(x, usage) \
347         (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
348 #define ns_reject(x, usage) \
349         (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
350
351 static int ca_check(const X509 *x)
352 {
353         /* keyUsage if present should allow cert signing */
354         if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
355         if(x->ex_flags & EXFLAG_BCONS) {
356                 if(x->ex_flags & EXFLAG_CA) return 1;
357                 /* If basicConstraints says not a CA then say so */
358                 else return 0;
359         } else {
360                 if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
361                 else return 2;
362         }
363 }
364
365 /* Check SSL CA: common checks for SSL client and server */
366 static int check_ssl_ca(const X509 *x)
367 {
368         int ca_ret;
369         ca_ret = ca_check(x);
370         if(!ca_ret) return 0;
371         /* check nsCertType if present */
372         if(x->ex_flags & EXFLAG_NSCERT) {
373                 if(x->ex_nscert & NS_SSL_CA) return ca_ret;
374                 return 0;
375         }
376         if(ca_ret != 2) return ca_ret;
377         else return 0;
378 }
379         
380
381 static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca)
382 {
383         if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
384         if(ca) return check_ssl_ca(x);
385         /* We need to do digital signatures with it */
386         if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
387         /* nsCertType if present should allow SSL client use */ 
388         if(ns_reject(x, NS_SSL_CLIENT)) return 0;
389         return 1;
390 }
391
392 static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)
393 {
394         if(xku_reject(x,XKU_SSL_SERVER|XKU_SGC)) return 0;
395         if(ca) return check_ssl_ca(x);
396
397         if(ns_reject(x, NS_SSL_SERVER)) return 0;
398         /* Now as for keyUsage: we'll at least need to sign OR encipher */
399         if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0;
400         
401         return 1;
402
403 }
404
405 static int check_purpose_ns_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)
406 {
407         int ret;
408         ret = check_purpose_ssl_server(xp, x, ca);
409         if(!ret || ca) return ret;
410         /* We need to encipher or Netscape complains */
411         if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
412         return ret;
413 }
414
415 /* common S/MIME checks */
416 static int purpose_smime(const X509 *x, int ca)
417 {
418         if(xku_reject(x,XKU_SMIME)) return 0;
419         if(ca) {
420                 int ca_ret;
421                 ca_ret = ca_check(x);
422                 if(!ca_ret) return 0;
423                 /* check nsCertType if present */
424                 if(x->ex_flags & EXFLAG_NSCERT) {
425                         if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
426                         return 0;
427                 }
428                 if(ca_ret != 2) return ca_ret;
429                 else return 0;
430         }
431         if(x->ex_flags & EXFLAG_NSCERT) {
432                 if(x->ex_nscert & NS_SMIME) return 1;
433                 /* Workaround for some buggy certificates */
434                 if(x->ex_nscert & NS_SSL_CLIENT) return 2;
435                 return 0;
436         }
437         return 1;
438 }
439
440 static int check_purpose_smime_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
441 {
442         int ret;
443         ret = purpose_smime(x, ca);
444         if(!ret || ca) return ret;
445         if(ku_reject(x, KU_DIGITAL_SIGNATURE)) return 0;
446         return ret;
447 }
448
449 static int check_purpose_smime_encrypt(const X509_PURPOSE *xp, const X509 *x, int ca)
450 {
451         int ret;
452         ret = purpose_smime(x, ca);
453         if(!ret || ca) return ret;
454         if(ku_reject(x, KU_KEY_ENCIPHERMENT)) return 0;
455         return ret;
456 }
457
458 static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
459 {
460         if(ca) {
461                 int ca_ret;
462                 if((ca_ret = ca_check(x)) != 2) return ca_ret;
463                 else return 0;
464         }
465         if(ku_reject(x, KU_CRL_SIGN)) return 0;
466         return 1;
467 }
468
469 static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca)
470 {
471         return 1;
472 }