Coverage Report

Created: 2024-11-21 07:03

/src/openssl/crypto/x509/v3_lib.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
/* X509 v3 extension utilities */
11
12
#include <stdio.h>
13
#include "internal/cryptlib.h"
14
#include <openssl/conf.h>
15
#include <openssl/x509v3.h>
16
17
#include "ext_dat.h"
18
19
static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
20
21
static int ext_cmp(const X509V3_EXT_METHOD *const *a,
22
                   const X509V3_EXT_METHOD *const *b);
23
static void ext_list_free(X509V3_EXT_METHOD *ext);
24
25
int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
26
0
{
27
0
    if (ext_list == NULL
28
0
        && (ext_list = sk_X509V3_EXT_METHOD_new(ext_cmp)) == NULL) {
29
0
        ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
30
0
        return 0;
31
0
    }
32
0
    if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
33
0
        ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
34
0
        return 0;
35
0
    }
36
0
    return 1;
37
0
}
38
39
static int ext_cmp(const X509V3_EXT_METHOD *const *a,
40
                   const X509V3_EXT_METHOD *const *b)
41
0
{
42
0
    return ((*a)->ext_nid - (*b)->ext_nid);
43
0
}
44
45
DECLARE_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
46
                           const X509V3_EXT_METHOD *, ext);
47
IMPLEMENT_OBJ_BSEARCH_CMP_FN(const X509V3_EXT_METHOD *,
48
                             const X509V3_EXT_METHOD *, ext);
49
50
#include "standard_exts.h"
51
52
const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
53
0
{
54
0
    X509V3_EXT_METHOD tmp;
55
0
    const X509V3_EXT_METHOD *t = &tmp, *const *ret;
56
0
    int idx;
57
58
0
    if (nid < 0)
59
0
        return NULL;
60
0
    tmp.ext_nid = nid;
61
0
    ret = OBJ_bsearch_ext(&t, standard_exts, STANDARD_EXTENSION_COUNT);
62
0
    if (ret)
63
0
        return *ret;
64
0
    if (!ext_list)
65
0
        return NULL;
66
    /* Ideally, this would be done under a lock */
67
0
    sk_X509V3_EXT_METHOD_sort(ext_list);
68
0
    idx = sk_X509V3_EXT_METHOD_find(ext_list, &tmp);
69
    /* A failure to locate the item is handled by the value method */
70
0
    return sk_X509V3_EXT_METHOD_value(ext_list, idx);
71
0
}
72
73
const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
74
0
{
75
0
    int nid;
76
0
    if ((nid = OBJ_obj2nid(X509_EXTENSION_get_object(ext))) == NID_undef)
77
0
        return NULL;
78
0
    return X509V3_EXT_get_nid(nid);
79
0
}
80
81
int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
82
0
{
83
0
    for (; extlist->ext_nid != -1; extlist++)
84
0
        if (!X509V3_EXT_add(extlist))
85
0
            return 0;
86
0
    return 1;
87
0
}
88
89
int X509V3_EXT_add_alias(int nid_to, int nid_from)
90
0
{
91
0
    const X509V3_EXT_METHOD *ext;
92
0
    X509V3_EXT_METHOD *tmpext;
93
94
0
    if ((ext = X509V3_EXT_get_nid(nid_from)) == NULL) {
95
0
        ERR_raise(ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND);
96
0
        return 0;
97
0
    }
98
0
    if ((tmpext = OPENSSL_malloc(sizeof(*tmpext))) == NULL)
99
0
        return 0;
100
0
    *tmpext = *ext;
101
0
    tmpext->ext_nid = nid_to;
102
0
    tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
103
0
    return X509V3_EXT_add(tmpext);
104
0
}
105
106
void X509V3_EXT_cleanup(void)
107
0
{
108
0
    sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
109
0
    ext_list = NULL;
110
0
}
111
112
static void ext_list_free(X509V3_EXT_METHOD *ext)
113
0
{
114
0
    if (ext->ext_flags & X509V3_EXT_DYNAMIC)
115
0
        OPENSSL_free(ext);
116
0
}
117
118
/*
119
 * Legacy function: we don't need to add standard extensions any more because
120
 * they are now kept in ext_dat.h.
121
 */
122
123
int X509V3_add_standard_extensions(void)
124
0
{
125
0
    return 1;
126
0
}
127
128
/* Return an extension internal structure */
129
130
void *X509V3_EXT_d2i(X509_EXTENSION *ext)
131
0
{
132
0
    const X509V3_EXT_METHOD *method;
133
0
    const unsigned char *p;
134
0
    ASN1_STRING *extvalue;
135
0
    int extlen;
136
137
0
    if ((method = X509V3_EXT_get(ext)) == NULL)
138
0
        return NULL;
139
0
    extvalue = X509_EXTENSION_get_data(ext);
140
0
    p = ASN1_STRING_get0_data(extvalue);
141
0
    extlen = ASN1_STRING_length(extvalue);
142
0
    if (method->it)
143
0
        return ASN1_item_d2i(NULL, &p, extlen, ASN1_ITEM_ptr(method->it));
144
0
    return method->d2i(NULL, &p, extlen);
145
0
}
146
147
/*-
148
 * Get critical flag and decoded version of extension from a NID.
149
 * The "idx" variable returns the last found extension and can
150
 * be used to retrieve multiple extensions of the same NID.
151
 * However multiple extensions with the same NID is usually
152
 * due to a badly encoded certificate so if idx is NULL we
153
 * choke if multiple extensions exist.
154
 * The "crit" variable is set to the critical value.
155
 * The return value is the decoded extension or NULL on
156
 * error. The actual error can have several different causes,
157
 * the value of *crit reflects the cause:
158
 * >= 0, extension found but not decoded (reflects critical value).
159
 * -1 extension not found.
160
 * -2 extension occurs more than once.
161
 */
162
163
void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
164
                     int *idx)
165
0
{
166
0
    int lastpos, i;
167
0
    X509_EXTENSION *ex, *found_ex = NULL;
168
169
0
    if (!x) {
170
0
        if (idx)
171
0
            *idx = -1;
172
0
        if (crit)
173
0
            *crit = -1;
174
0
        return NULL;
175
0
    }
176
0
    if (idx)
177
0
        lastpos = *idx + 1;
178
0
    else
179
0
        lastpos = 0;
180
0
    if (lastpos < 0)
181
0
        lastpos = 0;
182
0
    for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
183
0
        ex = sk_X509_EXTENSION_value(x, i);
184
0
        if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == nid) {
185
0
            if (idx) {
186
0
                *idx = i;
187
0
                found_ex = ex;
188
0
                break;
189
0
            } else if (found_ex) {
190
                /* Found more than one */
191
0
                if (crit)
192
0
                    *crit = -2;
193
0
                return NULL;
194
0
            }
195
0
            found_ex = ex;
196
0
        }
197
0
    }
198
0
    if (found_ex) {
199
        /* Found it */
200
0
        if (crit)
201
0
            *crit = X509_EXTENSION_get_critical(found_ex);
202
0
        return X509V3_EXT_d2i(found_ex);
203
0
    }
204
205
    /* Extension not found */
206
0
    if (idx)
207
0
        *idx = -1;
208
0
    if (crit)
209
0
        *crit = -1;
210
0
    return NULL;
211
0
}
212
213
/*
214
 * This function is a general extension append, replace and delete utility.
215
 * The precise operation is governed by the 'flags' value. The 'crit' and
216
 * 'value' arguments (if relevant) are the extensions internal structure.
217
 */
218
219
int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
220
                    int crit, unsigned long flags)
221
0
{
222
0
    int errcode, extidx = -1;
223
0
    X509_EXTENSION *ext = NULL, *extmp;
224
0
    STACK_OF(X509_EXTENSION) *ret = NULL;
225
0
    unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
226
227
    /*
228
     * If appending we don't care if it exists, otherwise look for existing
229
     * extension.
230
     */
231
0
    if (ext_op != X509V3_ADD_APPEND)
232
0
        extidx = X509v3_get_ext_by_NID(*x, nid, -1);
233
234
    /* See if extension exists */
235
0
    if (extidx >= 0) {
236
        /* If keep existing, nothing to do */
237
0
        if (ext_op == X509V3_ADD_KEEP_EXISTING)
238
0
            return 1;
239
        /* If default then its an error */
240
0
        if (ext_op == X509V3_ADD_DEFAULT) {
241
0
            errcode = X509V3_R_EXTENSION_EXISTS;
242
0
            goto err;
243
0
        }
244
        /* If delete, just delete it */
245
0
        if (ext_op == X509V3_ADD_DELETE) {
246
0
            extmp = sk_X509_EXTENSION_delete(*x, extidx);
247
0
            if (extmp == NULL)
248
0
                return -1;
249
0
            X509_EXTENSION_free(extmp);
250
0
            return 1;
251
0
        }
252
0
    } else {
253
        /*
254
         * If replace existing or delete, error since extension must exist
255
         */
256
0
        if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
257
0
            (ext_op == X509V3_ADD_DELETE)) {
258
0
            errcode = X509V3_R_EXTENSION_NOT_FOUND;
259
0
            goto err;
260
0
        }
261
0
    }
262
263
    /*
264
     * If we get this far then we have to create an extension: could have
265
     * some flags for alternative encoding schemes...
266
     */
267
268
0
    ext = X509V3_EXT_i2d(nid, crit, value);
269
270
0
    if (!ext) {
271
0
        ERR_raise(ERR_LIB_X509V3, X509V3_R_ERROR_CREATING_EXTENSION);
272
0
        return 0;
273
0
    }
274
275
    /* If extension exists replace it.. */
276
0
    if (extidx >= 0) {
277
0
        extmp = sk_X509_EXTENSION_value(*x, extidx);
278
0
        X509_EXTENSION_free(extmp);
279
0
        if (!sk_X509_EXTENSION_set(*x, extidx, ext))
280
0
            return -1;
281
0
        return 1;
282
0
    }
283
284
0
    ret = *x;
285
0
    if (*x == NULL
286
0
        && (ret = sk_X509_EXTENSION_new_null()) == NULL)
287
0
        goto m_fail;
288
0
    if (!sk_X509_EXTENSION_push(ret, ext))
289
0
        goto m_fail;
290
291
0
    *x = ret;
292
0
    return 1;
293
294
0
 m_fail:
295
    /* ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB); */
296
0
    if (ret != *x)
297
0
        sk_X509_EXTENSION_free(ret);
298
0
    X509_EXTENSION_free(ext);
299
0
    return -1;
300
301
0
 err:
302
0
    if (!(flags & X509V3_ADD_SILENT))
303
0
        ERR_raise(ERR_LIB_X509V3, errcode);
304
0
    return 0;
305
0
}