Coverage Report

Created: 2023-06-08 06:41

/src/openssl111/crypto/x509v3/v3_asid.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the OpenSSL license (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
/*
11
 * Implementation of RFC 3779 section 3.2.
12
 */
13
14
#include <assert.h>
15
#include <stdio.h>
16
#include <string.h>
17
#include "internal/cryptlib.h"
18
#include <openssl/conf.h>
19
#include <openssl/asn1.h>
20
#include <openssl/asn1t.h>
21
#include <openssl/x509v3.h>
22
#include <openssl/x509.h>
23
#include "crypto/x509.h"
24
#include <openssl/bn.h>
25
#include "ext_dat.h"
26
27
#ifndef OPENSSL_NO_RFC3779
28
29
/*
30
 * OpenSSL ASN.1 template translation of RFC 3779 3.2.3.
31
 */
32
33
ASN1_SEQUENCE(ASRange) = {
34
  ASN1_SIMPLE(ASRange, min, ASN1_INTEGER),
35
  ASN1_SIMPLE(ASRange, max, ASN1_INTEGER)
36
} ASN1_SEQUENCE_END(ASRange)
37
38
ASN1_CHOICE(ASIdOrRange) = {
39
  ASN1_SIMPLE(ASIdOrRange, u.id,    ASN1_INTEGER),
40
  ASN1_SIMPLE(ASIdOrRange, u.range, ASRange)
41
} ASN1_CHOICE_END(ASIdOrRange)
42
43
ASN1_CHOICE(ASIdentifierChoice) = {
44
  ASN1_SIMPLE(ASIdentifierChoice,      u.inherit,       ASN1_NULL),
45
  ASN1_SEQUENCE_OF(ASIdentifierChoice, u.asIdsOrRanges, ASIdOrRange)
46
} ASN1_CHOICE_END(ASIdentifierChoice)
47
48
ASN1_SEQUENCE(ASIdentifiers) = {
49
  ASN1_EXP_OPT(ASIdentifiers, asnum, ASIdentifierChoice, 0),
50
  ASN1_EXP_OPT(ASIdentifiers, rdi,   ASIdentifierChoice, 1)
51
} ASN1_SEQUENCE_END(ASIdentifiers)
52
53
IMPLEMENT_ASN1_FUNCTIONS(ASRange)
54
IMPLEMENT_ASN1_FUNCTIONS(ASIdOrRange)
55
IMPLEMENT_ASN1_FUNCTIONS(ASIdentifierChoice)
56
IMPLEMENT_ASN1_FUNCTIONS(ASIdentifiers)
57
58
/*
59
 * i2r method for an ASIdentifierChoice.
60
 */
61
static int i2r_ASIdentifierChoice(BIO *out,
62
                                  ASIdentifierChoice *choice,
63
                                  int indent, const char *msg)
64
0
{
65
0
    int i;
66
0
    char *s;
67
0
    if (choice == NULL)
68
0
        return 1;
69
0
    BIO_printf(out, "%*s%s:\n", indent, "", msg);
70
0
    switch (choice->type) {
71
0
    case ASIdentifierChoice_inherit:
72
0
        BIO_printf(out, "%*sinherit\n", indent + 2, "");
73
0
        break;
74
0
    case ASIdentifierChoice_asIdsOrRanges:
75
0
        for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges); i++) {
76
0
            ASIdOrRange *aor =
77
0
                sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
78
0
            switch (aor->type) {
79
0
            case ASIdOrRange_id:
80
0
                if ((s = i2s_ASN1_INTEGER(NULL, aor->u.id)) == NULL)
81
0
                    return 0;
82
0
                BIO_printf(out, "%*s%s\n", indent + 2, "", s);
83
0
                OPENSSL_free(s);
84
0
                break;
85
0
            case ASIdOrRange_range:
86
0
                if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->min)) == NULL)
87
0
                    return 0;
88
0
                BIO_printf(out, "%*s%s-", indent + 2, "", s);
89
0
                OPENSSL_free(s);
90
0
                if ((s = i2s_ASN1_INTEGER(NULL, aor->u.range->max)) == NULL)
91
0
                    return 0;
92
0
                BIO_printf(out, "%s\n", s);
93
0
                OPENSSL_free(s);
94
0
                break;
95
0
            default:
96
0
                return 0;
97
0
            }
98
0
        }
99
0
        break;
100
0
    default:
101
0
        return 0;
102
0
    }
103
0
    return 1;
104
0
}
105
106
/*
107
 * i2r method for an ASIdentifier extension.
108
 */
109
static int i2r_ASIdentifiers(const X509V3_EXT_METHOD *method,
110
                             void *ext, BIO *out, int indent)
111
0
{
112
0
    ASIdentifiers *asid = ext;
113
0
    return (i2r_ASIdentifierChoice(out, asid->asnum, indent,
114
0
                                   "Autonomous System Numbers") &&
115
0
            i2r_ASIdentifierChoice(out, asid->rdi, indent,
116
0
                                   "Routing Domain Identifiers"));
117
0
}
118
119
/*
120
 * Sort comparison function for a sequence of ASIdOrRange elements.
121
 */
122
static int ASIdOrRange_cmp(const ASIdOrRange *const *a_,
123
                           const ASIdOrRange *const *b_)
124
0
{
125
0
    const ASIdOrRange *a = *a_, *b = *b_;
126
127
0
    assert((a->type == ASIdOrRange_id && a->u.id != NULL) ||
128
0
           (a->type == ASIdOrRange_range && a->u.range != NULL &&
129
0
            a->u.range->min != NULL && a->u.range->max != NULL));
130
131
0
    assert((b->type == ASIdOrRange_id && b->u.id != NULL) ||
132
0
           (b->type == ASIdOrRange_range && b->u.range != NULL &&
133
0
            b->u.range->min != NULL && b->u.range->max != NULL));
134
135
0
    if (a->type == ASIdOrRange_id && b->type == ASIdOrRange_id)
136
0
        return ASN1_INTEGER_cmp(a->u.id, b->u.id);
137
138
0
    if (a->type == ASIdOrRange_range && b->type == ASIdOrRange_range) {
139
0
        int r = ASN1_INTEGER_cmp(a->u.range->min, b->u.range->min);
140
0
        return r != 0 ? r : ASN1_INTEGER_cmp(a->u.range->max,
141
0
                                             b->u.range->max);
142
0
    }
143
144
0
    if (a->type == ASIdOrRange_id)
145
0
        return ASN1_INTEGER_cmp(a->u.id, b->u.range->min);
146
0
    else
147
0
        return ASN1_INTEGER_cmp(a->u.range->min, b->u.id);
148
0
}
149
150
/*
151
 * Add an inherit element.
152
 */
153
int X509v3_asid_add_inherit(ASIdentifiers *asid, int which)
154
0
{
155
0
    ASIdentifierChoice **choice;
156
0
    if (asid == NULL)
157
0
        return 0;
158
0
    switch (which) {
159
0
    case V3_ASID_ASNUM:
160
0
        choice = &asid->asnum;
161
0
        break;
162
0
    case V3_ASID_RDI:
163
0
        choice = &asid->rdi;
164
0
        break;
165
0
    default:
166
0
        return 0;
167
0
    }
168
0
    if (*choice == NULL) {
169
0
        if ((*choice = ASIdentifierChoice_new()) == NULL)
170
0
            return 0;
171
0
        if (((*choice)->u.inherit = ASN1_NULL_new()) == NULL)
172
0
            return 0;
173
0
        (*choice)->type = ASIdentifierChoice_inherit;
174
0
    }
175
0
    return (*choice)->type == ASIdentifierChoice_inherit;
176
0
}
177
178
/*
179
 * Add an ID or range to an ASIdentifierChoice.
180
 */
181
int X509v3_asid_add_id_or_range(ASIdentifiers *asid,
182
                                int which, ASN1_INTEGER *min, ASN1_INTEGER *max)
183
0
{
184
0
    ASIdentifierChoice **choice;
185
0
    ASIdOrRange *aor;
186
0
    if (asid == NULL)
187
0
        return 0;
188
0
    switch (which) {
189
0
    case V3_ASID_ASNUM:
190
0
        choice = &asid->asnum;
191
0
        break;
192
0
    case V3_ASID_RDI:
193
0
        choice = &asid->rdi;
194
0
        break;
195
0
    default:
196
0
        return 0;
197
0
    }
198
0
    if (*choice != NULL && (*choice)->type == ASIdentifierChoice_inherit)
199
0
        return 0;
200
0
    if (*choice == NULL) {
201
0
        if ((*choice = ASIdentifierChoice_new()) == NULL)
202
0
            return 0;
203
0
        (*choice)->u.asIdsOrRanges = sk_ASIdOrRange_new(ASIdOrRange_cmp);
204
0
        if ((*choice)->u.asIdsOrRanges == NULL)
205
0
            return 0;
206
0
        (*choice)->type = ASIdentifierChoice_asIdsOrRanges;
207
0
    }
208
0
    if ((aor = ASIdOrRange_new()) == NULL)
209
0
        return 0;
210
0
    if (max == NULL) {
211
0
        aor->type = ASIdOrRange_id;
212
0
        aor->u.id = min;
213
0
    } else {
214
0
        aor->type = ASIdOrRange_range;
215
0
        if ((aor->u.range = ASRange_new()) == NULL)
216
0
            goto err;
217
0
        ASN1_INTEGER_free(aor->u.range->min);
218
0
        aor->u.range->min = min;
219
0
        ASN1_INTEGER_free(aor->u.range->max);
220
0
        aor->u.range->max = max;
221
0
    }
222
0
    if (!(sk_ASIdOrRange_push((*choice)->u.asIdsOrRanges, aor)))
223
0
        goto err;
224
0
    return 1;
225
226
0
 err:
227
0
    ASIdOrRange_free(aor);
228
0
    return 0;
229
0
}
230
231
/*
232
 * Extract min and max values from an ASIdOrRange.
233
 */
234
static int extract_min_max(ASIdOrRange *aor,
235
                           ASN1_INTEGER **min, ASN1_INTEGER **max)
236
0
{
237
0
    if (!ossl_assert(aor != NULL))
238
0
        return 0;
239
0
    switch (aor->type) {
240
0
    case ASIdOrRange_id:
241
0
        *min = aor->u.id;
242
0
        *max = aor->u.id;
243
0
        return 1;
244
0
    case ASIdOrRange_range:
245
0
        *min = aor->u.range->min;
246
0
        *max = aor->u.range->max;
247
0
        return 1;
248
0
    }
249
250
0
    return 0;
251
0
}
252
253
/*
254
 * Check whether an ASIdentifierChoice is in canonical form.
255
 */
256
static int ASIdentifierChoice_is_canonical(ASIdentifierChoice *choice)
257
0
{
258
0
    ASN1_INTEGER *a_max_plus_one = NULL;
259
0
    ASN1_INTEGER *orig;
260
0
    BIGNUM *bn = NULL;
261
0
    int i, ret = 0;
262
263
    /*
264
     * Empty element or inheritance is canonical.
265
     */
266
0
    if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
267
0
        return 1;
268
269
    /*
270
     * If not a list, or if empty list, it's broken.
271
     */
272
0
    if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
273
0
        sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0)
274
0
        return 0;
275
276
    /*
277
     * It's a list, check it.
278
     */
279
0
    for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
280
0
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
281
0
        ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
282
0
        ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
283
0
            NULL;
284
285
0
        if (!extract_min_max(a, &a_min, &a_max)
286
0
                || !extract_min_max(b, &b_min, &b_max))
287
0
            goto done;
288
289
        /*
290
         * Punt misordered list, overlapping start, or inverted range.
291
         */
292
0
        if (ASN1_INTEGER_cmp(a_min, b_min) >= 0 ||
293
0
            ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
294
0
            ASN1_INTEGER_cmp(b_min, b_max) > 0)
295
0
            goto done;
296
297
        /*
298
         * Calculate a_max + 1 to check for adjacency.
299
         */
300
0
        if ((bn == NULL && (bn = BN_new()) == NULL) ||
301
0
            ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
302
0
            !BN_add_word(bn, 1)) {
303
0
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
304
0
                      ERR_R_MALLOC_FAILURE);
305
0
            goto done;
306
0
        }
307
308
0
        if ((a_max_plus_one =
309
0
                BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
310
0
            a_max_plus_one = orig;
311
0
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL,
312
0
                      ERR_R_MALLOC_FAILURE);
313
0
            goto done;
314
0
        }
315
316
        /*
317
         * Punt if adjacent or overlapping.
318
         */
319
0
        if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) >= 0)
320
0
            goto done;
321
0
    }
322
323
    /*
324
     * Check for inverted range.
325
     */
326
0
    i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
327
0
    {
328
0
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
329
0
        ASN1_INTEGER *a_min, *a_max;
330
0
        if (a != NULL && a->type == ASIdOrRange_range) {
331
0
            if (!extract_min_max(a, &a_min, &a_max)
332
0
                    || ASN1_INTEGER_cmp(a_min, a_max) > 0)
333
0
                goto done;
334
0
        }
335
0
    }
336
337
0
    ret = 1;
338
339
0
 done:
340
0
    ASN1_INTEGER_free(a_max_plus_one);
341
0
    BN_free(bn);
342
0
    return ret;
343
0
}
344
345
/*
346
 * Check whether an ASIdentifier extension is in canonical form.
347
 */
348
int X509v3_asid_is_canonical(ASIdentifiers *asid)
349
0
{
350
0
    return (asid == NULL ||
351
0
            (ASIdentifierChoice_is_canonical(asid->asnum) &&
352
0
             ASIdentifierChoice_is_canonical(asid->rdi)));
353
0
}
354
355
/*
356
 * Whack an ASIdentifierChoice into canonical form.
357
 */
358
static int ASIdentifierChoice_canonize(ASIdentifierChoice *choice)
359
0
{
360
0
    ASN1_INTEGER *a_max_plus_one = NULL;
361
0
    ASN1_INTEGER *orig;
362
0
    BIGNUM *bn = NULL;
363
0
    int i, ret = 0;
364
365
    /*
366
     * Nothing to do for empty element or inheritance.
367
     */
368
0
    if (choice == NULL || choice->type == ASIdentifierChoice_inherit)
369
0
        return 1;
370
371
    /*
372
     * If not a list, or if empty list, it's broken.
373
     */
374
0
    if (choice->type != ASIdentifierChoice_asIdsOrRanges ||
375
0
        sk_ASIdOrRange_num(choice->u.asIdsOrRanges) == 0) {
376
0
        X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
377
0
                  X509V3_R_EXTENSION_VALUE_ERROR);
378
0
        return 0;
379
0
    }
380
381
    /*
382
     * We have a non-empty list.  Sort it.
383
     */
384
0
    sk_ASIdOrRange_sort(choice->u.asIdsOrRanges);
385
386
    /*
387
     * Now check for errors and suboptimal encoding, rejecting the
388
     * former and fixing the latter.
389
     */
390
0
    for (i = 0; i < sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1; i++) {
391
0
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
392
0
        ASIdOrRange *b = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i + 1);
393
0
        ASN1_INTEGER *a_min = NULL, *a_max = NULL, *b_min = NULL, *b_max =
394
0
            NULL;
395
396
0
        if (!extract_min_max(a, &a_min, &a_max)
397
0
                || !extract_min_max(b, &b_min, &b_max))
398
0
            goto done;
399
400
        /*
401
         * Make sure we're properly sorted (paranoia).
402
         */
403
0
        if (!ossl_assert(ASN1_INTEGER_cmp(a_min, b_min) <= 0))
404
0
            goto done;
405
406
        /*
407
         * Punt inverted ranges.
408
         */
409
0
        if (ASN1_INTEGER_cmp(a_min, a_max) > 0 ||
410
0
            ASN1_INTEGER_cmp(b_min, b_max) > 0)
411
0
            goto done;
412
413
        /*
414
         * Check for overlaps.
415
         */
416
0
        if (ASN1_INTEGER_cmp(a_max, b_min) >= 0) {
417
0
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
418
0
                      X509V3_R_EXTENSION_VALUE_ERROR);
419
0
            goto done;
420
0
        }
421
422
        /*
423
         * Calculate a_max + 1 to check for adjacency.
424
         */
425
0
        if ((bn == NULL && (bn = BN_new()) == NULL) ||
426
0
            ASN1_INTEGER_to_BN(a_max, bn) == NULL ||
427
0
            !BN_add_word(bn, 1)) {
428
0
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
429
0
                      ERR_R_MALLOC_FAILURE);
430
0
            goto done;
431
0
        }
432
433
0
        if ((a_max_plus_one =
434
0
                 BN_to_ASN1_INTEGER(bn, orig = a_max_plus_one)) == NULL) {
435
0
            a_max_plus_one = orig;
436
0
            X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
437
0
                      ERR_R_MALLOC_FAILURE);
438
0
            goto done;
439
0
        }
440
441
        /*
442
         * If a and b are adjacent, merge them.
443
         */
444
0
        if (ASN1_INTEGER_cmp(a_max_plus_one, b_min) == 0) {
445
0
            ASRange *r;
446
0
            switch (a->type) {
447
0
            case ASIdOrRange_id:
448
0
                if ((r = OPENSSL_malloc(sizeof(*r))) == NULL) {
449
0
                    X509V3err(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE,
450
0
                              ERR_R_MALLOC_FAILURE);
451
0
                    goto done;
452
0
                }
453
0
                r->min = a_min;
454
0
                r->max = b_max;
455
0
                a->type = ASIdOrRange_range;
456
0
                a->u.range = r;
457
0
                break;
458
0
            case ASIdOrRange_range:
459
0
                ASN1_INTEGER_free(a->u.range->max);
460
0
                a->u.range->max = b_max;
461
0
                break;
462
0
            }
463
0
            switch (b->type) {
464
0
            case ASIdOrRange_id:
465
0
                b->u.id = NULL;
466
0
                break;
467
0
            case ASIdOrRange_range:
468
0
                b->u.range->max = NULL;
469
0
                break;
470
0
            }
471
0
            ASIdOrRange_free(b);
472
0
            (void)sk_ASIdOrRange_delete(choice->u.asIdsOrRanges, i + 1);
473
0
            i--;
474
0
            continue;
475
0
        }
476
0
    }
477
478
    /*
479
     * Check for final inverted range.
480
     */
481
0
    i = sk_ASIdOrRange_num(choice->u.asIdsOrRanges) - 1;
482
0
    {
483
0
        ASIdOrRange *a = sk_ASIdOrRange_value(choice->u.asIdsOrRanges, i);
484
0
        ASN1_INTEGER *a_min, *a_max;
485
0
        if (a != NULL && a->type == ASIdOrRange_range) {
486
0
            if (!extract_min_max(a, &a_min, &a_max)
487
0
                    || ASN1_INTEGER_cmp(a_min, a_max) > 0)
488
0
                goto done;
489
0
        }
490
0
    }
491
492
    /* Paranoia */
493
0
    if (!ossl_assert(ASIdentifierChoice_is_canonical(choice)))
494
0
        goto done;
495
496
0
    ret = 1;
497
498
0
 done:
499
0
    ASN1_INTEGER_free(a_max_plus_one);
500
0
    BN_free(bn);
501
0
    return ret;
502
0
}
503
504
/*
505
 * Whack an ASIdentifier extension into canonical form.
506
 */
507
int X509v3_asid_canonize(ASIdentifiers *asid)
508
0
{
509
0
    return (asid == NULL ||
510
0
            (ASIdentifierChoice_canonize(asid->asnum) &&
511
0
             ASIdentifierChoice_canonize(asid->rdi)));
512
0
}
513
514
/*
515
 * v2i method for an ASIdentifier extension.
516
 */
517
static void *v2i_ASIdentifiers(const struct v3_ext_method *method,
518
                               struct v3_ext_ctx *ctx,
519
                               STACK_OF(CONF_VALUE) *values)
520
0
{
521
0
    ASN1_INTEGER *min = NULL, *max = NULL;
522
0
    ASIdentifiers *asid = NULL;
523
0
    int i;
524
525
0
    if ((asid = ASIdentifiers_new()) == NULL) {
526
0
        X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
527
0
        return NULL;
528
0
    }
529
530
0
    for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
531
0
        CONF_VALUE *val = sk_CONF_VALUE_value(values, i);
532
0
        int i1 = 0, i2 = 0, i3 = 0, is_range = 0, which = 0;
533
534
        /*
535
         * Figure out whether this is an AS or an RDI.
536
         */
537
0
        if (!name_cmp(val->name, "AS")) {
538
0
            which = V3_ASID_ASNUM;
539
0
        } else if (!name_cmp(val->name, "RDI")) {
540
0
            which = V3_ASID_RDI;
541
0
        } else {
542
0
            X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
543
0
                      X509V3_R_EXTENSION_NAME_ERROR);
544
0
            X509V3_conf_err(val);
545
0
            goto err;
546
0
        }
547
548
        /*
549
         * Handle inheritance.
550
         */
551
0
        if (strcmp(val->value, "inherit") == 0) {
552
0
            if (X509v3_asid_add_inherit(asid, which))
553
0
                continue;
554
0
            X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
555
0
                      X509V3_R_INVALID_INHERITANCE);
556
0
            X509V3_conf_err(val);
557
0
            goto err;
558
0
        }
559
560
        /*
561
         * Number, range, or mistake, pick it apart and figure out which.
562
         */
563
0
        i1 = strspn(val->value, "0123456789");
564
0
        if (val->value[i1] == '\0') {
565
0
            is_range = 0;
566
0
        } else {
567
0
            is_range = 1;
568
0
            i2 = i1 + strspn(val->value + i1, " \t");
569
0
            if (val->value[i2] != '-') {
570
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
571
0
                          X509V3_R_INVALID_ASNUMBER);
572
0
                X509V3_conf_err(val);
573
0
                goto err;
574
0
            }
575
0
            i2++;
576
0
            i2 = i2 + strspn(val->value + i2, " \t");
577
0
            i3 = i2 + strspn(val->value + i2, "0123456789");
578
0
            if (val->value[i3] != '\0') {
579
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
580
0
                          X509V3_R_INVALID_ASRANGE);
581
0
                X509V3_conf_err(val);
582
0
                goto err;
583
0
            }
584
0
        }
585
586
        /*
587
         * Syntax is ok, read and add it.
588
         */
589
0
        if (!is_range) {
590
0
            if (!X509V3_get_value_int(val, &min)) {
591
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
592
0
                goto err;
593
0
            }
594
0
        } else {
595
0
            char *s = OPENSSL_strdup(val->value);
596
0
            if (s == NULL) {
597
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
598
0
                goto err;
599
0
            }
600
0
            s[i1] = '\0';
601
0
            min = s2i_ASN1_INTEGER(NULL, s);
602
0
            max = s2i_ASN1_INTEGER(NULL, s + i2);
603
0
            OPENSSL_free(s);
604
0
            if (min == NULL || max == NULL) {
605
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
606
0
                goto err;
607
0
            }
608
0
            if (ASN1_INTEGER_cmp(min, max) > 0) {
609
0
                X509V3err(X509V3_F_V2I_ASIDENTIFIERS,
610
0
                          X509V3_R_EXTENSION_VALUE_ERROR);
611
0
                goto err;
612
0
            }
613
0
        }
614
0
        if (!X509v3_asid_add_id_or_range(asid, which, min, max)) {
615
0
            X509V3err(X509V3_F_V2I_ASIDENTIFIERS, ERR_R_MALLOC_FAILURE);
616
0
            goto err;
617
0
        }
618
0
        min = max = NULL;
619
0
    }
620
621
    /*
622
     * Canonize the result, then we're done.
623
     */
624
0
    if (!X509v3_asid_canonize(asid))
625
0
        goto err;
626
0
    return asid;
627
628
0
 err:
629
0
    ASIdentifiers_free(asid);
630
0
    ASN1_INTEGER_free(min);
631
0
    ASN1_INTEGER_free(max);
632
0
    return NULL;
633
0
}
634
635
/*
636
 * OpenSSL dispatch.
637
 */
638
const X509V3_EXT_METHOD v3_asid = {
639
    NID_sbgp_autonomousSysNum,  /* nid */
640
    0,                          /* flags */
641
    ASN1_ITEM_ref(ASIdentifiers), /* template */
642
    0, 0, 0, 0,                 /* old functions, ignored */
643
    0,                          /* i2s */
644
    0,                          /* s2i */
645
    0,                          /* i2v */
646
    v2i_ASIdentifiers,          /* v2i */
647
    i2r_ASIdentifiers,          /* i2r */
648
    0,                          /* r2i */
649
    NULL                        /* extension-specific data */
650
};
651
652
/*
653
 * Figure out whether extension uses inheritance.
654
 */
655
int X509v3_asid_inherits(ASIdentifiers *asid)
656
0
{
657
0
    return (asid != NULL &&
658
0
            ((asid->asnum != NULL &&
659
0
              asid->asnum->type == ASIdentifierChoice_inherit) ||
660
0
             (asid->rdi != NULL &&
661
0
              asid->rdi->type == ASIdentifierChoice_inherit)));
662
0
}
663
664
/*
665
 * Figure out whether parent contains child.
666
 */
667
static int asid_contains(ASIdOrRanges *parent, ASIdOrRanges *child)
668
0
{
669
0
    ASN1_INTEGER *p_min = NULL, *p_max = NULL, *c_min = NULL, *c_max = NULL;
670
0
    int p, c;
671
672
0
    if (child == NULL || parent == child)
673
0
        return 1;
674
0
    if (parent == NULL)
675
0
        return 0;
676
677
0
    p = 0;
678
0
    for (c = 0; c < sk_ASIdOrRange_num(child); c++) {
679
0
        if (!extract_min_max(sk_ASIdOrRange_value(child, c), &c_min, &c_max))
680
0
            return 0;
681
0
        for (;; p++) {
682
0
            if (p >= sk_ASIdOrRange_num(parent))
683
0
                return 0;
684
0
            if (!extract_min_max(sk_ASIdOrRange_value(parent, p), &p_min,
685
0
                                 &p_max))
686
0
                return 0;
687
0
            if (ASN1_INTEGER_cmp(p_max, c_max) < 0)
688
0
                continue;
689
0
            if (ASN1_INTEGER_cmp(p_min, c_min) > 0)
690
0
                return 0;
691
0
            break;
692
0
        }
693
0
    }
694
695
0
    return 1;
696
0
}
697
698
/*
699
 * Test whether a is a subset of b.
700
 */
701
int X509v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b)
702
0
{
703
0
    int subset;
704
705
0
    if (a == NULL || a == b)
706
0
        return 1;
707
708
0
    if (b == NULL)
709
0
        return 0;
710
711
0
    if (X509v3_asid_inherits(a) || X509v3_asid_inherits(b))
712
0
        return 0;
713
714
0
    subset = a->asnum == NULL
715
0
             || (b->asnum != NULL
716
0
                 && asid_contains(b->asnum->u.asIdsOrRanges,
717
0
                                  a->asnum->u.asIdsOrRanges));
718
0
    if (!subset)
719
0
        return 0;
720
721
0
    return a->rdi == NULL
722
0
           || (b->rdi != NULL
723
0
               && asid_contains(b->rdi->u.asIdsOrRanges,
724
0
                                a->rdi->u.asIdsOrRanges));
725
0
}
726
727
/*
728
 * Validation error handling via callback.
729
 */
730
#define validation_err(_err_)           \
731
0
  do {                                  \
732
0
    if (ctx != NULL) {                  \
733
0
      ctx->error = _err_;               \
734
0
      ctx->error_depth = i;             \
735
0
      ctx->current_cert = x;            \
736
0
      ret = ctx->verify_cb(0, ctx);     \
737
0
    } else {                            \
738
0
      ret = 0;                          \
739
0
    }                                   \
740
0
    if (!ret)                           \
741
0
      goto done;                        \
742
0
  } while (0)
743
744
/*
745
 * Core code for RFC 3779 3.3 path validation.
746
 */
747
static int asid_validate_path_internal(X509_STORE_CTX *ctx,
748
                                       STACK_OF(X509) *chain,
749
                                       ASIdentifiers *ext)
750
0
{
751
0
    ASIdOrRanges *child_as = NULL, *child_rdi = NULL;
752
0
    int i, ret = 1, inherit_as = 0, inherit_rdi = 0;
753
0
    X509 *x;
754
755
0
    if (!ossl_assert(chain != NULL && sk_X509_num(chain) > 0)
756
0
            || !ossl_assert(ctx != NULL || ext != NULL)
757
0
            || !ossl_assert(ctx == NULL || ctx->verify_cb != NULL)) {
758
0
        if (ctx != NULL)
759
0
            ctx->error = X509_V_ERR_UNSPECIFIED;
760
0
        return 0;
761
0
    }
762
763
764
    /*
765
     * Figure out where to start.  If we don't have an extension to
766
     * check, we're done.  Otherwise, check canonical form and
767
     * set up for walking up the chain.
768
     */
769
0
    if (ext != NULL) {
770
0
        i = -1;
771
0
        x = NULL;
772
0
    } else {
773
0
        i = 0;
774
0
        x = sk_X509_value(chain, i);
775
0
        if ((ext = x->rfc3779_asid) == NULL)
776
0
            goto done;
777
0
    }
778
0
    if (!X509v3_asid_is_canonical(ext))
779
0
        validation_err(X509_V_ERR_INVALID_EXTENSION);
780
0
    if (ext->asnum != NULL) {
781
0
        switch (ext->asnum->type) {
782
0
        case ASIdentifierChoice_inherit:
783
0
            inherit_as = 1;
784
0
            break;
785
0
        case ASIdentifierChoice_asIdsOrRanges:
786
0
            child_as = ext->asnum->u.asIdsOrRanges;
787
0
            break;
788
0
        }
789
0
    }
790
0
    if (ext->rdi != NULL) {
791
0
        switch (ext->rdi->type) {
792
0
        case ASIdentifierChoice_inherit:
793
0
            inherit_rdi = 1;
794
0
            break;
795
0
        case ASIdentifierChoice_asIdsOrRanges:
796
0
            child_rdi = ext->rdi->u.asIdsOrRanges;
797
0
            break;
798
0
        }
799
0
    }
800
801
    /*
802
     * Now walk up the chain.  Extensions must be in canonical form, no
803
     * cert may list resources that its parent doesn't list.
804
     */
805
0
    for (i++; i < sk_X509_num(chain); i++) {
806
0
        x = sk_X509_value(chain, i);
807
0
        if (!ossl_assert(x != NULL)) {
808
0
            if (ctx != NULL)
809
0
                ctx->error = X509_V_ERR_UNSPECIFIED;
810
0
            return 0;
811
0
        }
812
0
        if (x->rfc3779_asid == NULL) {
813
0
            if (child_as != NULL || child_rdi != NULL)
814
0
                validation_err(X509_V_ERR_UNNESTED_RESOURCE);
815
0
            continue;
816
0
        }
817
0
        if (!X509v3_asid_is_canonical(x->rfc3779_asid))
818
0
            validation_err(X509_V_ERR_INVALID_EXTENSION);
819
0
        if (x->rfc3779_asid->asnum == NULL && child_as != NULL) {
820
0
            validation_err(X509_V_ERR_UNNESTED_RESOURCE);
821
0
            child_as = NULL;
822
0
            inherit_as = 0;
823
0
        }
824
0
        if (x->rfc3779_asid->asnum != NULL &&
825
0
            x->rfc3779_asid->asnum->type ==
826
0
            ASIdentifierChoice_asIdsOrRanges) {
827
0
            if (inherit_as
828
0
                || asid_contains(x->rfc3779_asid->asnum->u.asIdsOrRanges,
829
0
                                 child_as)) {
830
0
                child_as = x->rfc3779_asid->asnum->u.asIdsOrRanges;
831
0
                inherit_as = 0;
832
0
            } else {
833
0
                validation_err(X509_V_ERR_UNNESTED_RESOURCE);
834
0
            }
835
0
        }
836
0
        if (x->rfc3779_asid->rdi == NULL && child_rdi != NULL) {
837
0
            validation_err(X509_V_ERR_UNNESTED_RESOURCE);
838
0
            child_rdi = NULL;
839
0
            inherit_rdi = 0;
840
0
        }
841
0
        if (x->rfc3779_asid->rdi != NULL &&
842
0
            x->rfc3779_asid->rdi->type == ASIdentifierChoice_asIdsOrRanges) {
843
0
            if (inherit_rdi ||
844
0
                asid_contains(x->rfc3779_asid->rdi->u.asIdsOrRanges,
845
0
                              child_rdi)) {
846
0
                child_rdi = x->rfc3779_asid->rdi->u.asIdsOrRanges;
847
0
                inherit_rdi = 0;
848
0
            } else {
849
0
                validation_err(X509_V_ERR_UNNESTED_RESOURCE);
850
0
            }
851
0
        }
852
0
    }
853
854
    /*
855
     * Trust anchor can't inherit.
856
     */
857
0
    if (!ossl_assert(x != NULL)) {
858
0
        if (ctx != NULL)
859
0
            ctx->error = X509_V_ERR_UNSPECIFIED;
860
0
        return 0;
861
0
    }
862
0
    if (x->rfc3779_asid != NULL) {
863
0
        if (x->rfc3779_asid->asnum != NULL &&
864
0
            x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)
865
0
            validation_err(X509_V_ERR_UNNESTED_RESOURCE);
866
0
        if (x->rfc3779_asid->rdi != NULL &&
867
0
            x->rfc3779_asid->rdi->type == ASIdentifierChoice_inherit)
868
0
            validation_err(X509_V_ERR_UNNESTED_RESOURCE);
869
0
    }
870
871
0
 done:
872
0
    return ret;
873
0
}
874
875
#undef validation_err
876
877
/*
878
 * RFC 3779 3.3 path validation -- called from X509_verify_cert().
879
 */
880
int X509v3_asid_validate_path(X509_STORE_CTX *ctx)
881
0
{
882
0
    if (ctx->chain == NULL
883
0
            || sk_X509_num(ctx->chain) == 0
884
0
            || ctx->verify_cb == NULL) {
885
0
        ctx->error = X509_V_ERR_UNSPECIFIED;
886
0
        return 0;
887
0
    }
888
0
    return asid_validate_path_internal(ctx, ctx->chain, NULL);
889
0
}
890
891
/*
892
 * RFC 3779 3.3 path validation of an extension.
893
 * Test whether chain covers extension.
894
 */
895
int X509v3_asid_validate_resource_set(STACK_OF(X509) *chain,
896
                                      ASIdentifiers *ext, int allow_inheritance)
897
0
{
898
0
    if (ext == NULL)
899
0
        return 1;
900
0
    if (chain == NULL || sk_X509_num(chain) == 0)
901
0
        return 0;
902
0
    if (!allow_inheritance && X509v3_asid_inherits(ext))
903
0
        return 0;
904
0
    return asid_validate_path_internal(NULL, chain, ext);
905
0
}
906
907
#endif                          /* OPENSSL_NO_RFC3779 */