/* * Written by Dr Stephen N Henson ([email protected]) for the OpenSSL * project. */ /* ==================================================================== * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * 3. All advertising materials mentioning features or use of this * software must display the following acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" * * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to * endorse or promote products derived from this software without * prior written permission. For written permission, please contact * [email protected]. * * 5. Products derived from this software may not be called "OpenSSL" * nor may "OpenSSL" appear in their names without prior written * permission of the OpenSSL Project. * * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" * * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * ==================================================================== * * This product includes cryptographic software written by Eric Young * ([email protected]). This product includes software written by Tim * Hudson ([email protected]). * */ /* X509 v3 extension utilities */ #include <ctype.h> #include <stdio.h> #include <string.h> #include <openssl/bn.h> #include <openssl/bytestring.h> #include <openssl/conf.h> #include <openssl/err.h> #include <openssl/mem.h> #include <openssl/obj.h> #include <openssl/x509.h> #include "../conf/internal.h" #include "../internal.h" #include "internal.h" static char *strip_spaces(char *name); static int sk_strcmp(const char *const *a, const char *const *b); static STACK_OF(OPENSSL_STRING) *get_email(const X509_NAME *name, const GENERAL_NAMES *gens); static void str_free(OPENSSL_STRING str); static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, const ASN1_IA5STRING *email); static int ipv4_from_asc(uint8_t v4[4], const char *in); static int ipv6_from_asc(uint8_t v6[16], const char *in); static int ipv6_cb(const char *elem, size_t len, void *usr); static int ipv6_hex(uint8_t *out, const char *in, size_t inlen); // Add a CONF_VALUE name value pair to stack static int x509V3_add_len_value(const char *name, const char *value, size_t value_len, int omit_value, STACK_OF(CONF_VALUE) **extlist) { … } int X509V3_add_value(const char *name, const char *value, STACK_OF(CONF_VALUE) **extlist) { … } int x509V3_add_value_asn1_string(const char *name, const ASN1_STRING *value, STACK_OF(CONF_VALUE) **extlist) { … } // Free function for STACK_OF(CONF_VALUE) void X509V3_conf_free(CONF_VALUE *conf) { … } int X509V3_add_value_bool(const char *name, int asn1_bool, STACK_OF(CONF_VALUE) **extlist) { … } static char *bignum_to_string(const BIGNUM *bn) { … } char *i2s_ASN1_ENUMERATED(const X509V3_EXT_METHOD *method, const ASN1_ENUMERATED *a) { … } char *i2s_ASN1_INTEGER(const X509V3_EXT_METHOD *method, const ASN1_INTEGER *a) { … } ASN1_INTEGER *s2i_ASN1_INTEGER(const X509V3_EXT_METHOD *method, const char *value) { … } int X509V3_add_value_int(const char *name, const ASN1_INTEGER *aint, STACK_OF(CONF_VALUE) **extlist) { … } int X509V3_bool_from_string(const char *str, ASN1_BOOLEAN *out_bool) { … } int X509V3_get_value_bool(const CONF_VALUE *value, ASN1_BOOLEAN *out_bool) { … } int X509V3_get_value_int(const CONF_VALUE *value, ASN1_INTEGER **aint) { … } #define HDR_NAME … #define HDR_VALUE … // #define DEBUG STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line) { … } // Delete leading and trailing spaces from a string static char *strip_spaces(char *name) { … } // hex string utilities char *x509v3_bytes_to_hex(const uint8_t *in, size_t len) { … } unsigned char *x509v3_hex_to_bytes(const char *str, size_t *len) { … } int x509v3_conf_name_matches(const char *name, const char *cmp) { … } static int sk_strcmp(const char *const *a, const char *const *b) { … } STACK_OF(OPENSSL_STRING) *X509_get1_email(const X509 *x) { … } STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(const X509 *x) { … } STACK_OF(OPENSSL_STRING) *X509_REQ_get1_email(const X509_REQ *x) { … } static STACK_OF(OPENSSL_STRING) *get_email(const X509_NAME *name, const GENERAL_NAMES *gens) { … } static void str_free(OPENSSL_STRING str) { … } static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, const ASN1_IA5STRING *email) { … } void X509_email_free(STACK_OF(OPENSSL_STRING) *sk) { … } equal_fn; // Compare while ASCII ignoring case. static int equal_nocase(const unsigned char *pattern, size_t pattern_len, const unsigned char *subject, size_t subject_len, unsigned int flags) { … } // Compare using OPENSSL_memcmp. static int equal_case(const unsigned char *pattern, size_t pattern_len, const unsigned char *subject, size_t subject_len, unsigned int flags) { … } // RFC 5280, section 7.5, requires that only the domain is compared in a // case-insensitive manner. static int equal_email(const unsigned char *a, size_t a_len, const unsigned char *b, size_t b_len, unsigned int unused_flags) { … } // Compare the prefix and suffix with the subject, and check that the // characters in-between are valid. static int wildcard_match(const unsigned char *prefix, size_t prefix_len, const unsigned char *suffix, size_t suffix_len, const unsigned char *subject, size_t subject_len, unsigned int flags) { … } #define LABEL_START … #define LABEL_END … #define LABEL_HYPHEN … #define LABEL_IDNA … static const unsigned char *valid_star(const unsigned char *p, size_t len, unsigned int flags) { … } // Compare using wildcards. static int equal_wildcard(const unsigned char *pattern, size_t pattern_len, const unsigned char *subject, size_t subject_len, unsigned int flags) { … } int x509v3_looks_like_dns_name(const unsigned char *in, size_t len) { … } // Compare an ASN1_STRING to a supplied string. If they match return 1. If // cmp_type > 0 only compare if string matches the type, otherwise convert it // to UTF8. static int do_check_string(const ASN1_STRING *a, int cmp_type, equal_fn equal, unsigned int flags, int check_type, const char *b, size_t blen, char **peername) { … } static int do_x509_check(const X509 *x, const char *chk, size_t chklen, unsigned int flags, int check_type, char **peername) { … } int X509_check_host(const X509 *x, const char *chk, size_t chklen, unsigned int flags, char **peername) { … } int X509_check_email(const X509 *x, const char *chk, size_t chklen, unsigned int flags) { … } int X509_check_ip(const X509 *x, const unsigned char *chk, size_t chklen, unsigned int flags) { … } int X509_check_ip_asc(const X509 *x, const char *ipasc, unsigned int flags) { … } // Convert IP addresses both IPv4 and IPv6 into an OCTET STRING compatible // with RFC 3280. ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc) { … } ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc) { … } int x509v3_a2i_ipadd(uint8_t ipout[16], const char *ipasc) { … } // get_ipv4_component consumes one IPv4 component, terminated by either '.' or // the end of the string, from |*str|. On success, it returns one, sets |*out| // to the component, and advances |*str| to the first unconsumed character. On // invalid input, it returns zero. static int get_ipv4_component(uint8_t *out_byte, const char **str) { … } // get_ipv4_dot consumes a '.' from |*str| and advances it. It returns one on // success and zero if |*str| does not point to a '.'. static int get_ipv4_dot(const char **str) { … } static int ipv4_from_asc(uint8_t v4[4], const char *in) { … } IPV6_STAT; static int ipv6_from_asc(uint8_t v6[16], const char *in) { … } static int ipv6_cb(const char *elem, size_t len, void *usr) { … } // Convert a string of up to 4 hex digits into the corresponding IPv6 form. static int ipv6_hex(uint8_t *out, const char *in, size_t inlen) { … } int X509V3_NAME_from_section(X509_NAME *nm, const STACK_OF(CONF_VALUE) *dn_sk, int chtype) { … }
Codebase Browser
chromium