Coverage Report

Created: 2024-11-21 07:03

/src/openssl/crypto/x509/x_name.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <stdio.h>
11
#include "crypto/ctype.h"
12
#include "internal/cryptlib.h"
13
#include <openssl/asn1t.h>
14
#include <openssl/x509.h>
15
#include "crypto/x509.h"
16
#include "crypto/asn1.h"
17
#include "x509_local.h"
18
19
/*
20
 * Maximum length of X509_NAME: much larger than anything we should
21
 * ever see in practice.
22
 */
23
24
0
#define X509_NAME_MAX (1024 * 1024)
25
26
static int x509_name_ex_d2i(ASN1_VALUE **val,
27
                            const unsigned char **in, long len,
28
                            const ASN1_ITEM *it,
29
                            int tag, int aclass, char opt, ASN1_TLC *ctx);
30
31
static int x509_name_ex_i2d(const ASN1_VALUE **val, unsigned char **out,
32
                            const ASN1_ITEM *it, int tag, int aclass);
33
static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it);
34
static void x509_name_ex_free(ASN1_VALUE **val, const ASN1_ITEM *it);
35
36
static int x509_name_encode(X509_NAME *a);
37
static int x509_name_canon(X509_NAME *a);
38
static int asn1_string_canon(ASN1_STRING *out, const ASN1_STRING *in);
39
static int i2d_name_canon(const STACK_OF(STACK_OF_X509_NAME_ENTRY) * intname,
40
                          unsigned char **in);
41
42
static int x509_name_ex_print(BIO *out, const ASN1_VALUE **pval,
43
                              int indent,
44
                              const char *fname, const ASN1_PCTX *pctx);
45
46
ASN1_SEQUENCE(X509_NAME_ENTRY) = {
47
        ASN1_SIMPLE(X509_NAME_ENTRY, object, ASN1_OBJECT),
48
        ASN1_SIMPLE(X509_NAME_ENTRY, value, ASN1_PRINTABLE)
49
} ASN1_SEQUENCE_END(X509_NAME_ENTRY)
50
51
IMPLEMENT_ASN1_FUNCTIONS(X509_NAME_ENTRY)
52
IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME_ENTRY)
53
54
/*
55
 * For the "Name" type we need a SEQUENCE OF { SET OF X509_NAME_ENTRY } so
56
 * declare two template wrappers for this
57
 */
58
59
ASN1_ITEM_TEMPLATE(X509_NAME_ENTRIES) =
60
        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_OF, 0, RDNS, X509_NAME_ENTRY)
61
static_ASN1_ITEM_TEMPLATE_END(X509_NAME_ENTRIES)
62
63
ASN1_ITEM_TEMPLATE(X509_NAME_INTERNAL) =
64
        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Name, X509_NAME_ENTRIES)
65
static_ASN1_ITEM_TEMPLATE_END(X509_NAME_INTERNAL)
66
67
/*
68
 * Normally that's where it would end: we'd have two nested STACK structures
69
 * representing the ASN1. Unfortunately X509_NAME uses a completely different
70
 * form and caches encodings so we have to process the internal form and
71
 * convert to the external form.
72
 */
73
74
static const ASN1_EXTERN_FUNCS x509_name_ff = {
75
    NULL,
76
    x509_name_ex_new,
77
    x509_name_ex_free,
78
    0,                          /* Default clear behaviour is OK */
79
    x509_name_ex_d2i,
80
    x509_name_ex_i2d,
81
    x509_name_ex_print
82
};
83
84
IMPLEMENT_EXTERN_ASN1(X509_NAME, V_ASN1_SEQUENCE, x509_name_ff)
85
86
IMPLEMENT_ASN1_FUNCTIONS(X509_NAME)
87
88
IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)
89
90
static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)
91
0
{
92
0
    X509_NAME *ret = OPENSSL_zalloc(sizeof(*ret));
93
94
0
    if (ret == NULL)
95
0
        return 0;
96
0
    if ((ret->entries = sk_X509_NAME_ENTRY_new_null()) == NULL) {
97
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB);
98
0
        goto err;
99
0
    }
100
0
    if ((ret->bytes = BUF_MEM_new()) == NULL) {
101
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
102
0
        goto err;
103
0
    }
104
0
    ret->modified = 1;
105
0
    *val = (ASN1_VALUE *)ret;
106
0
    return 1;
107
108
0
 err:
109
0
    if (ret) {
110
0
        sk_X509_NAME_ENTRY_free(ret->entries);
111
0
        OPENSSL_free(ret);
112
0
    }
113
0
    return 0;
114
0
}
115
116
static void x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
117
0
{
118
0
    X509_NAME *a;
119
120
0
    if (pval == NULL || *pval == NULL)
121
0
        return;
122
0
    a = (X509_NAME *)*pval;
123
124
0
    BUF_MEM_free(a->bytes);
125
0
    sk_X509_NAME_ENTRY_pop_free(a->entries, X509_NAME_ENTRY_free);
126
0
    OPENSSL_free(a->canon_enc);
127
0
    OPENSSL_free(a);
128
0
    *pval = NULL;
129
0
}
130
131
static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)
132
0
{
133
0
    sk_X509_NAME_ENTRY_free(ne);
134
0
}
135
136
static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)
137
0
{
138
0
    sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);
139
0
}
140
141
static int x509_name_ex_d2i(ASN1_VALUE **val,
142
                            const unsigned char **in, long len,
143
                            const ASN1_ITEM *it, int tag, int aclass,
144
                            char opt, ASN1_TLC *ctx)
145
0
{
146
0
    const unsigned char *p = *in, *q;
147
0
    union {
148
0
        STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
149
0
        ASN1_VALUE *a;
150
0
    } intname = {
151
0
        NULL
152
0
    };
153
0
    union {
154
0
        X509_NAME *x;
155
0
        ASN1_VALUE *a;
156
0
    } nm = {
157
0
        NULL
158
0
    };
159
0
    int i, j, ret;
160
0
    STACK_OF(X509_NAME_ENTRY) *entries;
161
0
    X509_NAME_ENTRY *entry;
162
163
0
    if (len > X509_NAME_MAX)
164
0
        len = X509_NAME_MAX;
165
0
    q = p;
166
167
    /* Get internal representation of Name */
168
0
    ret = ASN1_item_ex_d2i(&intname.a,
169
0
                           &p, len, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
170
0
                           tag, aclass, opt, ctx);
171
172
0
    if (ret <= 0)
173
0
        return ret;
174
175
0
    if (*val)
176
0
        x509_name_ex_free(val, NULL);
177
0
    if (!x509_name_ex_new(&nm.a, NULL))
178
0
        goto err;
179
    /* We've decoded it: now cache encoding */
180
0
    if (!BUF_MEM_grow(nm.x->bytes, p - q))
181
0
        goto err;
182
0
    memcpy(nm.x->bytes->data, q, p - q);
183
184
    /* Convert internal representation to X509_NAME structure */
185
0
    for (i = 0; i < sk_STACK_OF_X509_NAME_ENTRY_num(intname.s); i++) {
186
0
        entries = sk_STACK_OF_X509_NAME_ENTRY_value(intname.s, i);
187
0
        for (j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
188
0
            entry = sk_X509_NAME_ENTRY_value(entries, j);
189
0
            entry->set = i;
190
0
            if (!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
191
0
                goto err;
192
0
            (void)sk_X509_NAME_ENTRY_set(entries, j, NULL);
193
0
        }
194
0
    }
195
0
    ret = x509_name_canon(nm.x);
196
0
    if (!ret)
197
0
        goto err;
198
0
    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
199
0
                                         local_sk_X509_NAME_ENTRY_free);
200
0
    nm.x->modified = 0;
201
0
    *val = nm.a;
202
0
    *in = p;
203
0
    return ret;
204
205
0
 err:
206
0
    if (nm.x != NULL)
207
0
        X509_NAME_free(nm.x);
208
0
    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
209
0
                                         local_sk_X509_NAME_ENTRY_pop_free);
210
0
    ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
211
0
    return 0;
212
0
}
213
214
static int x509_name_ex_i2d(const ASN1_VALUE **val, unsigned char **out,
215
                            const ASN1_ITEM *it, int tag, int aclass)
216
0
{
217
0
    int ret;
218
0
    X509_NAME *a = (X509_NAME *)*val;
219
220
0
    if (a->modified) {
221
0
        ret = x509_name_encode(a);
222
0
        if (ret < 0)
223
0
            return ret;
224
0
        ret = x509_name_canon(a);
225
0
        if (!ret)
226
0
            return -1;
227
0
    }
228
0
    ret = a->bytes->length;
229
0
    if (out != NULL) {
230
0
        memcpy(*out, a->bytes->data, ret);
231
0
        *out += ret;
232
0
    }
233
0
    return ret;
234
0
}
235
236
static int x509_name_encode(X509_NAME *a)
237
0
{
238
0
    union {
239
0
        STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
240
0
        const ASN1_VALUE *a;
241
0
    } intname = {
242
0
        NULL
243
0
    };
244
0
    int len;
245
0
    unsigned char *p;
246
0
    STACK_OF(X509_NAME_ENTRY) *entries = NULL;
247
0
    X509_NAME_ENTRY *entry;
248
0
    int i, set = -1;
249
250
0
    intname.s = sk_STACK_OF_X509_NAME_ENTRY_new_null();
251
0
    if (!intname.s)
252
0
        goto cerr;
253
0
    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
254
0
        entry = sk_X509_NAME_ENTRY_value(a->entries, i);
255
0
        if (entry->set != set) {
256
0
            entries = sk_X509_NAME_ENTRY_new_null();
257
0
            if (!entries)
258
0
                goto cerr;
259
0
            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries)) {
260
0
                sk_X509_NAME_ENTRY_free(entries);
261
0
                goto cerr;
262
0
            }
263
0
            set = entry->set;
264
0
        }
265
0
        if (!sk_X509_NAME_ENTRY_push(entries, entry))
266
0
            goto cerr;
267
0
    }
268
0
    len = ASN1_item_ex_i2d(&intname.a, NULL,
269
0
                           ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
270
0
    if (!BUF_MEM_grow(a->bytes, len)) {
271
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
272
0
        goto err;
273
0
    }
274
0
    p = (unsigned char *)a->bytes->data;
275
0
    ASN1_item_ex_i2d(&intname.a,
276
0
                     &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
277
0
    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
278
0
                                         local_sk_X509_NAME_ENTRY_free);
279
0
    a->modified = 0;
280
0
    return len;
281
0
 cerr:
282
0
    ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB);
283
0
 err:
284
0
    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
285
0
                                         local_sk_X509_NAME_ENTRY_free);
286
0
    return -1;
287
0
}
288
289
static int x509_name_ex_print(BIO *out, const ASN1_VALUE **pval,
290
                              int indent,
291
                              const char *fname, const ASN1_PCTX *pctx)
292
0
{
293
0
    if (X509_NAME_print_ex(out, (const X509_NAME *)*pval,
294
0
                           indent, pctx->nm_flags) <= 0)
295
0
        return 0;
296
0
    return 2;
297
0
}
298
299
/*
300
 * This function generates the canonical encoding of the Name structure. In
301
 * it all strings are converted to UTF8, leading, trailing and multiple
302
 * spaces collapsed, converted to lower case and the leading SEQUENCE header
303
 * removed. In future we could also normalize the UTF8 too. By doing this
304
 * comparison of Name structures can be rapidly performed by just using
305
 * memcmp() of the canonical encoding. By omitting the leading SEQUENCE name
306
 * constraints of type dirName can also be checked with a simple memcmp().
307
 * NOTE: For empty X509_NAME (NULL-DN), canon_enclen == 0 && canon_enc == NULL
308
 */
309
310
static int x509_name_canon(X509_NAME *a)
311
0
{
312
0
    unsigned char *p;
313
0
    STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname;
314
0
    STACK_OF(X509_NAME_ENTRY) *entries = NULL;
315
0
    X509_NAME_ENTRY *entry, *tmpentry = NULL;
316
0
    int i, set = -1, ret = 0, len;
317
318
0
    OPENSSL_free(a->canon_enc);
319
0
    a->canon_enc = NULL;
320
    /* Special case: empty X509_NAME => null encoding */
321
0
    if (sk_X509_NAME_ENTRY_num(a->entries) == 0) {
322
0
        a->canon_enclen = 0;
323
0
        return 1;
324
0
    }
325
0
    intname = sk_STACK_OF_X509_NAME_ENTRY_new_null();
326
0
    if (intname == NULL) {
327
0
        ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
328
0
        goto err;
329
0
    }
330
0
    for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
331
0
        entry = sk_X509_NAME_ENTRY_value(a->entries, i);
332
0
        if (entry->set != set) {
333
0
            entries = sk_X509_NAME_ENTRY_new_null();
334
0
            if (entries == NULL)
335
0
                goto err;
336
0
            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries)) {
337
0
                sk_X509_NAME_ENTRY_free(entries);
338
0
                ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
339
0
                goto err;
340
0
            }
341
0
            set = entry->set;
342
0
        }
343
0
        tmpentry = X509_NAME_ENTRY_new();
344
0
        if (tmpentry == NULL) {
345
0
            ERR_raise(ERR_LIB_X509, ERR_R_ASN1_LIB);
346
0
            goto err;
347
0
        }
348
0
        tmpentry->object = OBJ_dup(entry->object);
349
0
        if (tmpentry->object == NULL) {
350
0
            ERR_raise(ERR_LIB_X509, ERR_R_OBJ_LIB);
351
0
            goto err;
352
0
        }
353
0
        if (!asn1_string_canon(tmpentry->value, entry->value))
354
0
            goto err;
355
0
        if (!sk_X509_NAME_ENTRY_push(entries, tmpentry)) {
356
0
            ERR_raise(ERR_LIB_X509, ERR_R_CRYPTO_LIB);
357
0
            goto err;
358
0
        }
359
0
        tmpentry = NULL;
360
0
    }
361
362
    /* Finally generate encoding */
363
0
    len = i2d_name_canon(intname, NULL);
364
0
    if (len < 0)
365
0
        goto err;
366
0
    a->canon_enclen = len;
367
368
0
    p = OPENSSL_malloc(a->canon_enclen);
369
0
    if (p == NULL)
370
0
        goto err;
371
372
0
    a->canon_enc = p;
373
374
0
    i2d_name_canon(intname, &p);
375
376
0
    ret = 1;
377
378
0
 err:
379
0
    X509_NAME_ENTRY_free(tmpentry);
380
0
    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname,
381
0
                                         local_sk_X509_NAME_ENTRY_pop_free);
382
0
    return ret;
383
0
}
384
385
/* Bitmap of all the types of string that will be canonicalized. */
386
387
#define ASN1_MASK_CANON \
388
0
        (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING \
389
0
        | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING \
390
0
        | B_ASN1_VISIBLESTRING)
391
392
static int asn1_string_canon(ASN1_STRING *out, const ASN1_STRING *in)
393
0
{
394
0
    unsigned char *to, *from;
395
0
    int len, i;
396
397
    /* If type not in bitmask just copy string across */
398
0
    if (!(ASN1_tag2bit(in->type) & ASN1_MASK_CANON)) {
399
0
        if (!ASN1_STRING_copy(out, in))
400
0
            return 0;
401
0
        return 1;
402
0
    }
403
404
0
    out->type = V_ASN1_UTF8STRING;
405
0
    out->length = ASN1_STRING_to_UTF8(&out->data, in);
406
0
    if (out->length == -1)
407
0
        return 0;
408
409
0
    to = out->data;
410
0
    from = to;
411
412
0
    len = out->length;
413
414
    /*
415
     * Convert string in place to canonical form. Ultimately we may need to
416
     * handle a wider range of characters but for now ignore anything with
417
     * MSB set and rely on the ossl_isspace() to fail on bad characters without
418
     * needing isascii or range checks as well.
419
     */
420
421
    /* Ignore leading spaces */
422
0
    while (len > 0 && ossl_isspace(*from)) {
423
0
        from++;
424
0
        len--;
425
0
    }
426
427
0
    to = from + len;
428
429
    /* Ignore trailing spaces */
430
0
    while (len > 0 && ossl_isspace(to[-1])) {
431
0
        to--;
432
0
        len--;
433
0
    }
434
435
0
    to = out->data;
436
437
0
    i = 0;
438
0
    while (i < len) {
439
        /* If not ASCII set just copy across */
440
0
        if (!ossl_isascii(*from)) {
441
0
            *to++ = *from++;
442
0
            i++;
443
0
        }
444
        /* Collapse multiple spaces */
445
0
        else if (ossl_isspace(*from)) {
446
            /* Copy one space across */
447
0
            *to++ = ' ';
448
            /*
449
             * Ignore subsequent spaces. Note: don't need to check len here
450
             * because we know the last character is a non-space so we can't
451
             * overflow.
452
             */
453
0
            do {
454
0
                from++;
455
0
                i++;
456
0
            }
457
0
            while (ossl_isspace(*from));
458
0
        } else {
459
0
            *to++ = ossl_tolower(*from);
460
0
            from++;
461
0
            i++;
462
0
        }
463
0
    }
464
465
0
    out->length = to - out->data;
466
467
0
    return 1;
468
469
0
}
470
471
static int i2d_name_canon(const STACK_OF(STACK_OF_X509_NAME_ENTRY) * _intname,
472
                          unsigned char **in)
473
0
{
474
0
    int i, len, ltmp;
475
0
    const ASN1_VALUE *v;
476
0
    STACK_OF(ASN1_VALUE) *intname = (STACK_OF(ASN1_VALUE) *)_intname;
477
478
0
    len = 0;
479
0
    for (i = 0; i < sk_ASN1_VALUE_num(intname); i++) {
480
0
        v = sk_ASN1_VALUE_value(intname, i);
481
0
        ltmp = ASN1_item_ex_i2d(&v, in,
482
0
                                ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1);
483
0
        if (ltmp < 0 || len > INT_MAX - ltmp)
484
0
            return -1;
485
0
        len += ltmp;
486
0
    }
487
0
    return len;
488
0
}
489
490
int X509_NAME_set(X509_NAME **xn, const X509_NAME *name)
491
0
{
492
0
    X509_NAME *name_copy;
493
494
0
    if (*xn == name)
495
0
        return *xn != NULL;
496
0
    if ((name_copy = X509_NAME_dup(name)) == NULL)
497
0
        return 0;
498
0
    X509_NAME_free(*xn);
499
0
    *xn = name_copy;
500
0
    return 1;
501
0
}
502
503
int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase)
504
0
{
505
0
    char *s, *c, *b;
506
0
    int i;
507
508
0
    b = X509_NAME_oneline(name, NULL, 0);
509
0
    if (b == NULL)
510
0
        return 0;
511
0
    if (*b == '\0') {
512
0
        OPENSSL_free(b);
513
0
        return 1;
514
0
    }
515
0
    s = b + 1;                  /* skip the first slash */
516
517
0
    c = s;
518
0
    for (;;) {
519
0
        if (((*s == '/') &&
520
0
             (ossl_isupper(s[1]) && ((s[2] == '=') ||
521
0
                                (ossl_isupper(s[2]) && (s[3] == '='))
522
0
              ))) || (*s == '\0'))
523
0
        {
524
0
            i = s - c;
525
0
            if (BIO_write(bp, c, i) != i)
526
0
                goto err;
527
0
            c = s + 1;          /* skip following slash */
528
0
            if (*s != '\0') {
529
0
                if (BIO_write(bp, ", ", 2) != 2)
530
0
                    goto err;
531
0
            }
532
0
        }
533
0
        if (*s == '\0')
534
0
            break;
535
0
        s++;
536
0
    }
537
538
0
    OPENSSL_free(b);
539
0
    return 1;
540
0
 err:
541
0
    ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB);
542
0
    OPENSSL_free(b);
543
0
    return 0;
544
0
}
545
546
int X509_NAME_get0_der(const X509_NAME *nm, const unsigned char **pder,
547
                       size_t *pderlen)
548
0
{
549
    /* Make sure encoding is valid */
550
0
    if (i2d_X509_NAME(nm, NULL) <= 0)
551
0
        return 0;
552
0
    if (pder != NULL)
553
0
        *pder = (unsigned char *)nm->bytes->data;
554
0
    if (pderlen != NULL)
555
0
        *pderlen = nm->bytes->length;
556
0
    return 1;
557
0
}