v3_utl.c 20.4 KB
Newer Older
1
/* v3_utl.c */
2
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3
 * project.
4 5
 */
/* ====================================================================
6
 * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
/* X509 v3 extension utilities */

60 61

#include <stdio.h>
62
#include <ctype.h>
63
#include "cryptlib.h"
64 65
#include <openssl/conf.h>
#include <openssl/x509v3.h>
66
#include <openssl/bn.h>
67 68

static char *strip_spaces(char *name);
69
static int sk_strcmp(const char * const *a, const char * const *b);
B
Ben Laurie 已提交
70 71 72
static STACK_OF(STRING) *get_email(X509_NAME *name, GENERAL_NAMES *gens);
static void str_free(STRING str);
static int append_ia5(STACK_OF(STRING) **sk, ASN1_IA5STRING *email);
73

74 75 76 77 78
static int ipv4_from_asc(unsigned char *v4, const char *in);
static int ipv6_from_asc(unsigned char *v6, const char *in);
static int ipv6_cb(const char *elem, int len, void *usr);
static int ipv6_hex(unsigned char *out, const char *in, int inlen);

79 80
/* Add a CONF_VALUE name value pair to stack */

81 82
int X509V3_add_value(const char *name, const char *value,
						STACK_OF(CONF_VALUE) **extlist)
83 84 85
{
	CONF_VALUE *vtmp = NULL;
	char *tname = NULL, *tvalue = NULL;
86 87
	if(name && !(tname = BUF_strdup(name))) goto err;
	if(value && !(tvalue = BUF_strdup(value))) goto err;;
88
	if(!(vtmp = (CONF_VALUE *)OPENSSL_malloc(sizeof(CONF_VALUE)))) goto err;
89
	if(!*extlist && !(*extlist = sk_CONF_VALUE_new_null())) goto err;
90 91 92
	vtmp->section = NULL;
	vtmp->name = tname;
	vtmp->value = tvalue;
93
	if(!sk_CONF_VALUE_push(*extlist, vtmp)) goto err;
94 95 96
	return 1;
	err:
	X509V3err(X509V3_F_X509V3_ADD_VALUE,ERR_R_MALLOC_FAILURE);
97 98 99
	if(vtmp) OPENSSL_free(vtmp);
	if(tname) OPENSSL_free(tname);
	if(tvalue) OPENSSL_free(tvalue);
100 101 102
	return 0;
}

B
Ben Laurie 已提交
103
int X509V3_add_value_uchar(const char *name, const unsigned char *value,
104
			   STACK_OF(CONF_VALUE) **extlist)
B
Ben Laurie 已提交
105 106 107 108
    {
    return X509V3_add_value(name,(const char *)value,extlist);
    }

109
/* Free function for STACK_OF(CONF_VALUE) */
110

U
Ulf Möller 已提交
111
void X509V3_conf_free(CONF_VALUE *conf)
112 113
{
	if(!conf) return;
114 115 116 117
	if(conf->name) OPENSSL_free(conf->name);
	if(conf->value) OPENSSL_free(conf->value);
	if(conf->section) OPENSSL_free(conf->section);
	OPENSSL_free(conf);
118 119
}

120 121
int X509V3_add_value_bool(const char *name, int asn1_bool,
						STACK_OF(CONF_VALUE) **extlist)
122 123 124 125 126
{
	if(asn1_bool) return X509V3_add_value(name, "TRUE", extlist);
	return X509V3_add_value(name, "FALSE", extlist);
}

127 128
int X509V3_add_value_bool_nf(char *name, int asn1_bool,
						STACK_OF(CONF_VALUE) **extlist)
129 130 131 132 133
{
	if(asn1_bool) return X509V3_add_value(name, "TRUE", extlist);
	return 1;
}

134

U
Ulf Möller 已提交
135
char *i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *method, ASN1_ENUMERATED *a)
136 137 138 139 140 141 142 143 144 145 146
{
	BIGNUM *bntmp = NULL;
	char *strtmp = NULL;
	if(!a) return NULL;
	if(!(bntmp = ASN1_ENUMERATED_to_BN(a, NULL)) ||
	    !(strtmp = BN_bn2dec(bntmp)) )
		X509V3err(X509V3_F_I2S_ASN1_ENUMERATED,ERR_R_MALLOC_FAILURE);
	BN_free(bntmp);
	return strtmp;
}

U
Ulf Möller 已提交
147
char *i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, ASN1_INTEGER *a)
148 149 150 151 152 153 154 155 156 157 158
{
	BIGNUM *bntmp = NULL;
	char *strtmp = NULL;
	if(!a) return NULL;
	if(!(bntmp = ASN1_INTEGER_to_BN(a, NULL)) ||
	    !(strtmp = BN_bn2dec(bntmp)) )
		X509V3err(X509V3_F_I2S_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
	BN_free(bntmp);
	return strtmp;
}

U
Ulf Möller 已提交
159
ASN1_INTEGER *s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
160 161 162
{
	BIGNUM *bn = NULL;
	ASN1_INTEGER *aint;
163 164 165
	int isneg, ishex;
	int ret;
	if (!value) {
166 167 168
		X509V3err(X509V3_F_S2I_ASN1_INTEGER,X509V3_R_INVALID_NULL_VALUE);
		return 0;
	}
D
 
Dr. Stephen Henson 已提交
169
	bn = BN_new();
170 171 172 173 174 175 176 177 178 179 180 181 182
	if (value[0] == '-') {
		value++;
		isneg = 1;
	} else isneg = 0;

	if (value[0] == '0' && ((value[1] == 'x') || (value[1] == 'X'))) {
		value += 2;
		ishex = 1;
	} else ishex = 0;

	if (ishex) ret = BN_hex2bn(&bn, value);
	else ret = BN_dec2bn(&bn, value);

D
 
Dr. Stephen Henson 已提交
183 184
	if (!ret || value[ret]) {
		BN_free(bn);
185 186 187 188
		X509V3err(X509V3_F_S2I_ASN1_INTEGER,X509V3_R_BN_DEC2BN_ERROR);
		return 0;
	}

189 190 191 192 193
	if (isneg && BN_is_zero(bn)) isneg = 0;

	aint = BN_to_ASN1_INTEGER(bn, NULL);
	BN_free(bn);
	if (!aint) {
194 195 196
		X509V3err(X509V3_F_S2I_ASN1_INTEGER,X509V3_R_BN_TO_ASN1_INTEGER_ERROR);
		return 0;
	}
197
	if (isneg) aint->type |= V_ASN1_NEG;
198 199 200
	return aint;
}

U
Ulf Möller 已提交
201
int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
202
	     STACK_OF(CONF_VALUE) **extlist)
203 204 205 206
{
	char *strtmp;
	int ret;
	if(!aint) return 1;
207
	if(!(strtmp = i2s_ASN1_INTEGER(NULL, aint))) return 0;
208
	ret = X509V3_add_value(name, strtmp, extlist);
209
	OPENSSL_free(strtmp);
210 211 212
	return ret;
}

U
Ulf Möller 已提交
213
int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool)
214 215 216 217 218 219 220 221 222 223 224 225 226 227 228
{
	char *btmp;
	if(!(btmp = value->value)) goto err;
	if(!strcmp(btmp, "TRUE") || !strcmp(btmp, "true")
		 || !strcmp(btmp, "Y") || !strcmp(btmp, "y")
		|| !strcmp(btmp, "YES") || !strcmp(btmp, "yes")) {
		*asn1_bool = 0xff;
		return 1;
	} else if(!strcmp(btmp, "FALSE") || !strcmp(btmp, "false")
		 || !strcmp(btmp, "N") || !strcmp(btmp, "n")
		|| !strcmp(btmp, "NO") || !strcmp(btmp, "no")) {
		*asn1_bool = 0;
		return 1;
	}
	err:
229
	X509V3err(X509V3_F_X509V3_GET_VALUE_BOOL,X509V3_R_INVALID_BOOLEAN_STRING);
230 231 232 233
	X509V3_conf_err(value);
	return 0;
}

U
Ulf Möller 已提交
234
int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint)
235
{
236 237
	ASN1_INTEGER *itmp;
	if(!(itmp = s2i_ASN1_INTEGER(NULL, value->value))) {
238 239 240
		X509V3_conf_err(value);
		return 0;
	}
241
	*aint = itmp;
242 243 244 245 246 247 248 249
	return 1;
}

#define HDR_NAME	1
#define HDR_VALUE	2

/*#define DEBUG*/

D
 
Dr. Stephen Henson 已提交
250
STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line)
251 252 253
{
	char *p, *q, c;
	char *ntmp, *vtmp;
254
	STACK_OF(CONF_VALUE) *values = NULL;
255 256 257
	char *linebuf;
	int state;
	/* We are going to modify the line so copy it first */
258
	linebuf = BUF_strdup(line);
259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278
	state = HDR_NAME;
	ntmp = NULL;
	/* Go through all characters */
	for(p = linebuf, q = linebuf; (c = *p) && (c!='\r') && (c!='\n'); p++) {

		switch(state) {
			case HDR_NAME:
			if(c == ':') {
				state = HDR_VALUE;
				*p = 0;
				ntmp = strip_spaces(q);
				if(!ntmp) {
					X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
					goto err;
				}
				q = p + 1;
			} else if(c == ',') {
				*p = 0;
				ntmp = strip_spaces(q);
				q = p + 1;
B
Bodo Möller 已提交
279
#if 0
280 281 282 283 284 285 286 287 288 289 290 291 292 293 294
				printf("%s\n", ntmp);
#endif
				if(!ntmp) {
					X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
					goto err;
				}
				X509V3_add_value(ntmp, NULL, &values);
			}
			break ;

			case HDR_VALUE:
			if(c == ',') {
				state = HDR_NAME;
				*p = 0;
				vtmp = strip_spaces(q);
B
Bodo Möller 已提交
295
#if 0
296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311
				printf("%s\n", ntmp);
#endif
				if(!vtmp) {
					X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_VALUE);
					goto err;
				}
				X509V3_add_value(ntmp, vtmp, &values);
				ntmp = NULL;
				q = p + 1;
			}

		}
	}

	if(state == HDR_VALUE) {
		vtmp = strip_spaces(q);
B
Bodo Möller 已提交
312
#if 0
313 314 315 316 317 318 319 320 321
		printf("%s=%s\n", ntmp, vtmp);
#endif
		if(!vtmp) {
			X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_VALUE);
			goto err;
		}
		X509V3_add_value(ntmp, vtmp, &values);
	} else {
		ntmp = strip_spaces(q);
B
Bodo Möller 已提交
322
#if 0
323 324 325 326 327 328 329 330
		printf("%s\n", ntmp);
#endif
		if(!ntmp) {
			X509V3err(X509V3_F_X509V3_PARSE_LIST, X509V3_R_INVALID_NULL_NAME);
			goto err;
		}
		X509V3_add_value(ntmp, NULL, &values);
	}
331
OPENSSL_free(linebuf);
332 333 334
return values;

err:
335
OPENSSL_free(linebuf);
336
sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
337 338 339 340 341
return NULL;

}

/* Delete leading and trailing spaces from a string */
U
Ulf Möller 已提交
342
static char *strip_spaces(char *name)
343 344 345 346
{
	char *p, *q;
	/* Skip over leading spaces */
	p = name;
347
	while(*p && isspace((unsigned char)*p)) p++;
348 349
	if(!*p) return NULL;
	q = p + strlen(p) - 1;
350
	while((q != p) && isspace((unsigned char)*q)) q--;
351 352 353 354
	if(p != q) q[1] = 0;
	if(!*p) return NULL;
	return p;
}
355 356 357

/* hex string utilities */

358
/* Given a buffer of length 'len' return a OPENSSL_malloc'ed string with its
359
 * hex representation
360
 * @@@ (Contents of buffer are always kept in ASCII, also on EBCDIC machines)
361 362
 */

D
Dr. Stephen Henson 已提交
363
char *hex_to_string(const unsigned char *buffer, long len)
364 365
{
	char *tmp, *q;
D
Dr. Stephen Henson 已提交
366
	const unsigned char *p;
367
	int i;
D
Dr. Stephen Henson 已提交
368
	const static char hexdig[] = "0123456789ABCDEF";
369
	if(!buffer || !len) return NULL;
370
	if(!(tmp = OPENSSL_malloc(len * 3 + 1))) {
371 372 373 374 375 376 377 378 379 380
		X509V3err(X509V3_F_HEX_TO_STRING,ERR_R_MALLOC_FAILURE);
		return NULL;
	}
	q = tmp;
	for(i = 0, p = buffer; i < len; i++,p++) {
		*q++ = hexdig[(*p >> 4) & 0xf];
		*q++ = hexdig[*p & 0xf];
		*q++ = ':';
	}
	q[-1] = 0;
381 382 383 384
#ifdef CHARSET_EBCDIC
	ebcdic2ascii(tmp, tmp, q - tmp - 1);
#endif

385 386 387 388 389 390 391
	return tmp;
}

/* Give a string of hex digits convert to
 * a buffer
 */

D
Dr. Stephen Henson 已提交
392
unsigned char *string_to_hex(const char *str, long *len)
393 394 395 396 397 398 399
{
	unsigned char *hexbuf, *q;
	unsigned char ch, cl, *p;
	if(!str) {
		X509V3err(X509V3_F_STRING_TO_HEX,X509V3_R_INVALID_NULL_ARGUMENT);
		return NULL;
	}
400
	if(!(hexbuf = OPENSSL_malloc(strlen(str) >> 1))) goto err;
401 402
	for(p = (unsigned char *)str, q = hexbuf; *p;) {
		ch = *p++;
403 404 405
#ifdef CHARSET_EBCDIC
		ch = os_toebcdic[ch];
#endif
406 407
		if(ch == ':') continue;
		cl = *p++;
408 409 410
#ifdef CHARSET_EBCDIC
		cl = os_toebcdic[cl];
#endif
411 412
		if(!cl) {
			X509V3err(X509V3_F_STRING_TO_HEX,X509V3_R_ODD_NUMBER_OF_DIGITS);
413
			OPENSSL_free(hexbuf);
414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434
			return NULL;
		}
		if(isupper(ch)) ch = tolower(ch);
		if(isupper(cl)) cl = tolower(cl);

		if((ch >= '0') && (ch <= '9')) ch -= '0';
		else if ((ch >= 'a') && (ch <= 'f')) ch -= 'a' - 10;
		else goto badhex;

		if((cl >= '0') && (cl <= '9')) cl -= '0';
		else if ((cl >= 'a') && (cl <= 'f')) cl -= 'a' - 10;
		else goto badhex;

		*q++ = (ch << 4) | cl;
	}

	if(len) *len = q - hexbuf;

	return hexbuf;

	err:
435
	if(hexbuf) OPENSSL_free(hexbuf);
436 437 438 439
	X509V3err(X509V3_F_STRING_TO_HEX,ERR_R_MALLOC_FAILURE);
	return NULL;

	badhex:
440
	OPENSSL_free(hexbuf);
441 442 443 444
	X509V3err(X509V3_F_STRING_TO_HEX,X509V3_R_ILLEGAL_HEX_DIGIT);
	return NULL;

}
445 446 447 448 449

/* V2I name comparison function: returns zero if 'name' matches
 * cmp or cmp.*
 */

U
Ulf Möller 已提交
450
int name_cmp(const char *name, const char *cmp)
451 452 453 454 455 456 457 458 459
{
	int len, ret;
	char c;
	len = strlen(cmp);
	if((ret = strncmp(name, cmp, len))) return ret;
	c = name[len];
	if(!c || (c=='.')) return 0;
	return 1;
}
460 461 462 463 464 465

static int sk_strcmp(const char * const *a, const char * const *b)
{
	return strcmp(*a, *b);
}

B
Ben Laurie 已提交
466
STACK_OF(STRING) *X509_get1_email(X509 *x)
467
{
D
 
Dr. Stephen Henson 已提交
468
	GENERAL_NAMES *gens;
B
Ben Laurie 已提交
469 470
	STACK_OF(STRING) *ret;

471 472 473 474 475 476
	gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
	ret = get_email(X509_get_subject_name(x), gens);
	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
	return ret;
}

B
Ben Laurie 已提交
477
STACK_OF(STRING) *X509_get1_ocsp(X509 *x)
478 479
{
	AUTHORITY_INFO_ACCESS *info;
B
Ben Laurie 已提交
480
	STACK_OF(STRING) *ret = NULL;
481
	int i;
B
Ben Laurie 已提交
482

483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501
	info = X509_get_ext_d2i(x, NID_info_access, NULL, NULL);
	if (!info)
		return NULL;
	for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++)
		{
		ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
		if (OBJ_obj2nid(ad->method) == NID_ad_OCSP)
			{
			if (ad->location->type == GEN_URI)
				{
				if (!append_ia5(&ret, ad->location->d.uniformResourceIdentifier))
					break;
				}
			}
		}
	AUTHORITY_INFO_ACCESS_free(info);
	return ret;
}

B
Ben Laurie 已提交
502
STACK_OF(STRING) *X509_REQ_get1_email(X509_REQ *x)
503
{
D
 
Dr. Stephen Henson 已提交
504
	GENERAL_NAMES *gens;
505
	STACK_OF(X509_EXTENSION) *exts;
B
Ben Laurie 已提交
506 507
	STACK_OF(STRING) *ret;

508 509 510 511 512 513 514 515 516
	exts = X509_REQ_get_extensions(x);
	gens = X509V3_get_d2i(exts, NID_subject_alt_name, NULL, NULL);
	ret = get_email(X509_REQ_get_subject_name(x), gens);
	sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
	return ret;
}


B
Ben Laurie 已提交
517
static STACK_OF(STRING) *get_email(X509_NAME *name, GENERAL_NAMES *gens)
518
{
B
Ben Laurie 已提交
519
	STACK_OF(STRING) *ret = NULL;
520 521 522 523 524 525 526 527
	X509_NAME_ENTRY *ne;
	ASN1_IA5STRING *email;
	GENERAL_NAME *gen;
	int i;
	/* Now add any email address(es) to STACK */
	i = -1;
	/* First supplied X509_NAME */
	while((i = X509_NAME_get_index_by_NID(name,
528
					 NID_pkcs9_emailAddress, i)) >= 0) {
529 530 531 532 533 534 535 536 537 538 539 540 541
		ne = X509_NAME_get_entry(name, i);
		email = X509_NAME_ENTRY_get_data(ne);
		if(!append_ia5(&ret, email)) return NULL;
	}
	for(i = 0; i < sk_GENERAL_NAME_num(gens); i++)
	{
		gen = sk_GENERAL_NAME_value(gens, i);
		if(gen->type != GEN_EMAIL) continue;
		if(!append_ia5(&ret, gen->d.ia5)) return NULL;
	}
	return ret;
}

B
Ben Laurie 已提交
542
static void str_free(STRING str)
543 544 545 546
{
	OPENSSL_free(str);
}

B
Ben Laurie 已提交
547
static int append_ia5(STACK_OF(STRING) **sk, ASN1_IA5STRING *email)
548 549 550 551 552
{
	char *emtmp;
	/* First some sanity checks */
	if(email->type != V_ASN1_IA5STRING) return 1;
	if(!email->data || !email->length) return 1;
B
Ben Laurie 已提交
553
	if(!*sk) *sk = sk_STRING_new(sk_strcmp);
554 555
	if(!*sk) return 0;
	/* Don't add duplicates */
B
Ben Laurie 已提交
556
	if(sk_STRING_find(*sk, (char *)email->data) != -1) return 1;
557
	emtmp = BUF_strdup((char *)email->data);
B
Ben Laurie 已提交
558
	if(!emtmp || !sk_STRING_push(*sk, emtmp)) {
559 560 561 562 563 564 565
		X509_email_free(*sk);
		*sk = NULL;
		return 0;
	}
	return 1;
}

B
Ben Laurie 已提交
566
void X509_email_free(STACK_OF(STRING) *sk)
567
{
B
Ben Laurie 已提交
568
	sk_STRING_pop_free(sk, str_free);
569
}
570 571 572 573 574 575 576 577 578 579 580 581 582

/* Convert IP addresses both IPv4 and IPv6 into an 
 * OCTET STRING compatible with RFC3280.
 */

ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc)
	{
	unsigned char ipout[16];
	ASN1_OCTET_STRING *ret;
	int iplen;

	/* If string contains a ':' assume IPv6 */

583 584 585 586
	iplen = a2i_ipadd(ipout, ipasc);

	if (!iplen)
		return NULL;
587 588 589 590 591 592 593 594 595 596 597 598

	ret = ASN1_OCTET_STRING_new();
	if (!ret)
		return NULL;
	if (!ASN1_OCTET_STRING_set(ret, ipout, iplen))
		{
		ASN1_OCTET_STRING_free(ret);
		return NULL;
		}
	return ret;
	}

599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643
ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc)
	{
	ASN1_OCTET_STRING *ret = NULL;
	unsigned char ipout[32];
	char *iptmp = NULL, *p;
	int iplen1, iplen2;
	p = strchr(ipasc,'/');
	if (!p)
		return NULL;
	iptmp = BUF_strdup(ipasc);
	if (!iptmp)
		return NULL;
	p = iptmp + (p - ipasc);
	*p++ = 0;

	iplen1 = a2i_ipadd(ipout, iptmp);

	if (!iplen1)
		goto err;

	iplen2 = a2i_ipadd(ipout + iplen1, p);

	OPENSSL_free(iptmp);
	iptmp = NULL;

	if (!iplen2 || (iplen1 != iplen2))
		goto err;

	ret = ASN1_OCTET_STRING_new();
	if (!ret)
		goto err;
	if (!ASN1_OCTET_STRING_set(ret, ipout, iplen1 + iplen2))
		goto err;

	return ret;

	err:
	if (iptmp)
		OPENSSL_free(iptmp);
	if (ret)
		ASN1_OCTET_STRING_free(ret);
	return NULL;
	}
	

B
Ben Laurie 已提交
644
int a2i_ipadd(unsigned char *ipout, const char *ipasc)
645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661
	{
	/* If string contains a ':' assume IPv6 */

	if (strchr(ipasc, ':'))
		{
		if (!ipv6_from_asc(ipout, ipasc))
			return 0;
		return 16;
		}
	else
		{
		if (!ipv4_from_asc(ipout, ipasc))
			return 0;
		return 4;
		}
	}

662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825
static int ipv4_from_asc(unsigned char *v4, const char *in)
	{
	int a0, a1, a2, a3;
	if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
		return 0;
	if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255)
		|| (a2 < 0) || (a2 > 255) || (a3 < 0) || (a3 > 255))
		return 0;
	v4[0] = a0;
	v4[1] = a1;
	v4[2] = a2;
	v4[3] = a3;
	return 1;
	}

typedef struct {
		/* Temporary store for IPV6 output */
		unsigned char tmp[16];
		/* Total number of bytes in tmp */
		int total;
		/* The position of a zero (corresponding to '::') */
		int zero_pos;
		/* Number of zeroes */
		int zero_cnt;
	} IPV6_STAT;


static int ipv6_from_asc(unsigned char *v6, const char *in)
	{
	IPV6_STAT v6stat;
	v6stat.total = 0;
	v6stat.zero_pos = -1;
	v6stat.zero_cnt = 0;
	/* Treat the IPv6 representation as a list of values
	 * separated by ':'. The presence of a '::' will parse
 	 * as one, two or three zero length elements.
	 */
	if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
		return 0;

	/* Now for some sanity checks */

	if (v6stat.zero_pos == -1)
		{
		/* If no '::' must have exactly 16 bytes */
		if (v6stat.total != 16)
			return 0;
		}
	else 
		{
		/* If '::' must have less than 16 bytes */
		if (v6stat.total == 16)
			return 0;
		/* More than three zeroes is an error */
		if (v6stat.zero_cnt > 3)
			return 0;
		/* Can only have three zeroes if nothing else present */
		else if (v6stat.zero_cnt == 3)
			{
			if (v6stat.total > 0)
				return 0;
			}
		/* Can only have two zeroes if at start or end */
		else if (v6stat.zero_cnt == 2)
			{
			if ((v6stat.zero_pos != 0)
				&& (v6stat.zero_pos != v6stat.total))
				return 0;
			}
		else 
		/* Can only have one zero if *not* start or end */
			{
			if ((v6stat.zero_pos == 0)
				|| (v6stat.zero_pos == v6stat.total))
				return 0;
			}
		}

	/* Format result */

	/* Copy initial part */
	if (v6stat.zero_pos > 0)
		memcpy(v6, v6stat.tmp, v6stat.zero_pos);
	/* Zero middle */
	if (v6stat.total != 16)
		memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
	/* Copy final part */
	if (v6stat.total != v6stat.zero_pos)
		memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
			v6stat.tmp + v6stat.zero_pos,
			v6stat.total - v6stat.zero_pos);

	return 1;
	}

static int ipv6_cb(const char *elem, int len, void *usr)
	{
	IPV6_STAT *s = usr;
	/* Error if 16 bytes written */
	if (s->total == 16)
		return 0;
	if (len == 0)
		{
		/* Zero length element, corresponds to '::' */
		if (s->zero_pos == -1)
			s->zero_pos = s->total;
		/* If we've already got a :: its an error */
		else if (s->zero_pos != s->total)
			return 0;
		s->zero_cnt++;
		}
	else 
		{
		/* If more than 4 characters could be final a.b.c.d form */
		if (len > 4)
			{
			/* Need at least 4 bytes left */
			if (s->total > 12)
				return 0;
			/* Must be end of string */
			if (elem[len])
				return 0;
			if (!ipv4_from_asc(s->tmp + s->total, elem))
				return 0;
			s->total += 4;
			}
		else
			{
			if (!ipv6_hex(s->tmp + s->total, elem, len))
				return 0;
			s->total += 2;
			}
		}
	return 1;
	}

/* Convert a string of up to 4 hex digits into the corresponding
 * IPv6 form.
 */

static int ipv6_hex(unsigned char *out, const char *in, int inlen)
	{
	unsigned char c;
	unsigned int num = 0;
	if (inlen > 4)
		return 0;
	while(inlen--)
		{
		c = *in++;
		num <<= 4;
		if ((c >= '0') && (c <= '9'))
			num |= c - '0';
		else if ((c >= 'A') && (c <= 'F'))
			num |= c - 'A' + 10;
		else if ((c >= 'a') && (c <= 'f'))
			num |=  c - 'a' + 10;
		else
			return 0;
		}
	out[0] = num >> 8;
	out[1] = num & 0xff;
	return 1;
	}

826 827 828 829 830

int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
						unsigned long chtype)
	{
	CONF_VALUE *v;
D
Dr. Stephen Henson 已提交
831
	int i, mval;
832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853
	char *p, *type;
	if (!nm)
		return 0;

	for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
		{
		v=sk_CONF_VALUE_value(dn_sk,i);
		type=v->name;
		/* Skip past any leading X. X: X, etc to allow for
		 * multiple instances 
		 */
		for(p = type; *p ; p++) 
#ifndef CHARSET_EBCDIC
			if ((*p == ':') || (*p == ',') || (*p == '.'))
#else
			if ((*p == os_toascii[':']) || (*p == os_toascii[',']) || (*p == os_toascii['.']))
#endif
				{
				p++;
				if(*p) type = p;
				break;
				}
D
Dr. Stephen Henson 已提交
854
#ifndef CHARSET_EBCDIC
855
		if (*type == '+')
D
Dr. Stephen Henson 已提交
856
#else
857
		if (*type == os_toascii['+'])
D
Dr. Stephen Henson 已提交
858 859 860
#endif
			{
			mval = -1;
861
			type++;
D
Dr. Stephen Henson 已提交
862 863 864
			}
		else
			mval = 0;
865
		if (!X509_NAME_add_entry_by_txt(nm,type, chtype,
D
Dr. Stephen Henson 已提交
866
				(unsigned char *) v->value,-1,-1,mval))
867 868 869 870 871
					return 0;

		}
	return 1;
	}