// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.

//

// Licensed under the Apache License, Version 2.0 (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

//     https://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.

#include <openssl/asn1.h>

#include <openssl/asn1t.h>

#include <openssl/digest.h>

#include <openssl/err.h>

#include <openssl/mem.h>

#include <openssl/obj.h>

#include <openssl/stack.h>

#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <assert.h>

#include "../asn1/internal.h"

#include "../internal.h"

#include "internal.h"

using namespace bssl;

namespace {

int X509_REVOKED_cmp(const X509_REVOKED *const *a,

                     const X509_REVOKED *const *b) {

  return ASN1_STRING_cmp((*a)->serialNumber, (*b)->serialNumber);

}

// The X509_CRL_INFO structure needs a bit of customisation. Since we cache

// the original encoding the signature won't be affected by reordering of the

// revoked field.

int crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,

               void *exarg) {

  X509_CRL_INFO *a = asn1_load_ptr_as<X509_CRL_INFO>(pval);

  if (!a || !a->revoked) {

    return 1;

  }

  switch (operation) {

      // Just set cmp function here. We don't sort because that would

      // affect the output of X509_CRL_print().

    case ASN1_OP_D2I_POST:

      (void)sk_X509_REVOKED_set_cmp_func(a->revoked, X509_REVOKED_cmp);

      break;

  }

  return 1;

}

int crl_parse_entry_extensions(X509_CRL *crl) {

  long version = ASN1_INTEGER_get(crl->crl->version);

  STACK_OF(X509_REVOKED) *revoked = X509_CRL_get_REVOKED(crl);

  for (size_t i = 0; i < sk_X509_REVOKED_num(revoked); i++) {

    X509_REVOKED *rev = sk_X509_REVOKED_value(revoked, i);

    // Per RFC 5280, section 5.1, CRL entry extensions require v2.

    const STACK_OF(X509_EXTENSION) *exts = rev->extensions;

    if (version == X509_CRL_VERSION_1 && exts != nullptr) {

      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);

      return 0;

    }

    // Extensions is a SEQUENCE SIZE (1..MAX), so it cannot be empty. An empty

    // extensions list is encoded by omitting the OPTIONAL field.

    if (exts != nullptr && sk_X509_EXTENSION_num(exts) == 0) {

      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);

      return 0;

    }

    int crit;

    ASN1_ENUMERATED *reason = reinterpret_cast<ASN1_ENUMERATED *>(

        X509_REVOKED_get_ext_d2i(rev, NID_crl_reason, &crit, nullptr));

    if (!reason && crit != -1) {

      crl->flags |= EXFLAG_INVALID;

      return 1;

    }

    if (reason) {

      rev->reason = ASN1_ENUMERATED_get(reason);

      ASN1_ENUMERATED_free(reason);

    } else {

      rev->reason = CRL_REASON_NONE;

    }

    // We do not support any critical CRL entry extensions.

    for (size_t j = 0; j < sk_X509_EXTENSION_num(exts); j++) {

      const X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, j);

      if (X509_EXTENSION_get_critical(ext)) {

        crl->flags |= EXFLAG_CRITICAL;

        break;

      }

    }

  }

  return 1;

}

// The X509_CRL structure needs a bit of customisation. Cache some extensions

// and hash of the whole CRL.

int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) {

  X509_CRL *crl = asn1_load_ptr_as<X509_CRL>(pval);

  int i;

  switch (operation) {

    case ASN1_OP_NEW_POST:

      crl->idp = nullptr;

      crl->akid = nullptr;

      crl->flags = 0;

      break;

    case ASN1_OP_D2I_POST: {

      // The version must be one of v1(0) or v2(1).

      long version = X509_CRL_VERSION_1;

      if (crl->crl->version != nullptr) {

        version = ASN1_INTEGER_get(crl->crl->version);

        // Versions v1 and v2. v1 is DEFAULT, so cannot be encoded explicitly.

        if (version != X509_CRL_VERSION_2) {

          OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);

          return 0;

        }

      }

      // Per RFC 5280, section 5.1.2.1, extensions require v2.

      if (version != X509_CRL_VERSION_2 && crl->crl->extensions != nullptr) {

        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);

        return 0;

      }

      // Extensions is a SEQUENCE SIZE (1..MAX), so it cannot be empty. An empty

      // extensions list is encoded by omitting the OPTIONAL field.

      if (crl->crl->extensions != nullptr &&

          sk_X509_EXTENSION_num(crl->crl->extensions) == 0) {

        OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);

        return 0;

      }

      if (!X509_CRL_digest(crl, EVP_sha256(), crl->crl_hash, nullptr)) {

        return 0;

      }

      crl->idp = reinterpret_cast<ISSUING_DIST_POINT *>(X509_CRL_get_ext_d2i(

          crl, NID_issuing_distribution_point, &i, nullptr));

      if (crl->idp == nullptr && i != -1) {

        return 0;

      }

      crl->akid = reinterpret_cast<AUTHORITY_KEYID *>(

          X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, &i, nullptr));

      if (crl->akid == nullptr && i != -1) {

        return 0;

      }

      // See if we have any unhandled critical CRL extensions and indicate

      // this in a flag. We only currently handle IDP so anything else

      // critical sets the flag. This code accesses the X509_CRL structure

      // directly: applications shouldn't do this.

      const STACK_OF(X509_EXTENSION) *exts = crl->crl->extensions;

      for (size_t idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++) {

        const X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, idx);

        int nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext));

        if (X509_EXTENSION_get_critical(ext)) {

          if (nid == NID_issuing_distribution_point ||

              nid == NID_authority_key_identifier) {

            continue;

          }

          crl->flags |= EXFLAG_CRITICAL;

          break;

        }

      }

      if (!crl_parse_entry_extensions(crl)) {

        return 0;

      }

      break;

    }

    case ASN1_OP_FREE_POST:

      AUTHORITY_KEYID_free(crl->akid);

      ISSUING_DIST_POINT_free(crl->idp);

      break;

  }

  return 1;

}

int crl_revoked_issuer_match(const X509_CRL *crl, const X509_NAME *nm,

                             const X509_REVOKED *rev) {

  return nm == nullptr || X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)) == 0;

}

StaticMutex g_crl_sort_lock;

int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, const ASN1_INTEGER *serial,

               const X509_NAME *issuer) {

  // Use an assert, rather than a runtime error, because returning nothing for a

  // CRL is arguably failing open, rather than closed.

  assert(serial->type == V_ASN1_INTEGER || serial->type == V_ASN1_NEG_INTEGER);

  X509_REVOKED rtmp;

  size_t idx;

  rtmp.serialNumber = (ASN1_INTEGER *)serial;

  // Sort revoked into serial number order if not already sorted. Do this

  // under a lock to avoid race condition.

  g_crl_sort_lock.LockRead();

  const int is_sorted = sk_X509_REVOKED_is_sorted(crl->crl->revoked);

  g_crl_sort_lock.UnlockRead();

  if (!is_sorted) {

    MutexWriteLock lock(&g_crl_sort_lock);

    if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked)) {

      sk_X509_REVOKED_sort(crl->crl->revoked);

    }

  }

  if (!sk_X509_REVOKED_find(crl->crl->revoked, &idx, &rtmp)) {

    return 0;

  }

  // Need to look for matching name

  for (; idx < sk_X509_REVOKED_num(crl->crl->revoked); idx++) {

    X509_REVOKED *rev = sk_X509_REVOKED_value(crl->crl->revoked, idx);

    if (ASN1_INTEGER_cmp(rev->serialNumber, serial)) {

      return 0;

    }

    if (crl_revoked_issuer_match(crl, issuer, rev)) {

      if (ret) {

        *ret = rev;

      }

      return 1;

    }

  }

  return 0;

}

}  // namespace

BSSL_NAMESPACE_BEGIN

ASN1_SEQUENCE(X509_REVOKED) = {

    ASN1_SIMPLE(X509_REVOKED, serialNumber, ASN1_INTEGER),

    ASN1_SIMPLE(X509_REVOKED, revocationDate, ASN1_TIME),

    ASN1_SEQUENCE_OF_OPT(X509_REVOKED, extensions, X509_EXTENSION),

} ASN1_SEQUENCE_END(X509_REVOKED)

ASN1_SEQUENCE_enc(X509_CRL_INFO, enc, crl_inf_cb) = {

    ASN1_OPT(X509_CRL_INFO, version, ASN1_INTEGER),

    ASN1_SIMPLE(X509_CRL_INFO, sig_alg, X509_ALGOR),

    ASN1_SIMPLE(X509_CRL_INFO, issuer, X509_NAME),

    ASN1_SIMPLE(X509_CRL_INFO, lastUpdate, ASN1_TIME),

    ASN1_OPT(X509_CRL_INFO, nextUpdate, ASN1_TIME),

    ASN1_SEQUENCE_OF_OPT(X509_CRL_INFO, revoked, X509_REVOKED),

    ASN1_EXP_SEQUENCE_OF_OPT(X509_CRL_INFO, extensions, X509_EXTENSION, 0),

} ASN1_SEQUENCE_END_enc(X509_CRL_INFO, X509_CRL_INFO)

ASN1_SEQUENCE_ref(X509_CRL, crl_cb) = {

    ASN1_SIMPLE(X509_CRL, crl, X509_CRL_INFO),

    ASN1_SIMPLE(X509_CRL, sig_alg, X509_ALGOR),

    ASN1_SIMPLE(X509_CRL, signature, ASN1_BIT_STRING),

} ASN1_SEQUENCE_END_ref(X509_CRL, X509_CRL)

BSSL_NAMESPACE_END

IMPLEMENT_ASN1_FUNCTIONS_const(X509_REVOKED)

IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_REVOKED)

BSSL_NAMESPACE_BEGIN

IMPLEMENT_ASN1_FUNCTIONS_const(X509_CRL_INFO)

BSSL_NAMESPACE_END

IMPLEMENT_ASN1_FUNCTIONS_const(X509_CRL)

IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_CRL)

int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev) {

  X509_CRL_INFO *inf = crl->crl;

  if (!inf->revoked) {

    inf->revoked = sk_X509_REVOKED_new(X509_REVOKED_cmp);

  }

  if (!inf->revoked || !sk_X509_REVOKED_push(inf->revoked, rev)) {

    return 0;

  }

  asn1_encoding_clear(&inf->enc);

  return 1;

}

int X509_CRL_verify(const X509_CRL *crl, const EVP_PKEY *pkey) {

  if (X509_ALGOR_cmp(crl->sig_alg, crl->crl->sig_alg) != 0) {

    OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);

    return 0;

  }

  return ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO), crl->sig_alg,

                          crl->signature, crl->crl, pkey);

}

int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret,

                            const ASN1_INTEGER *serial) {

  return crl_lookup(crl, ret, serial, nullptr);

}

int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x) {

  return crl_lookup(crl, ret, X509_get0_serialNumber(x),

                    X509_get_issuer_name(x));

}