Coverage Report

Created: 2025-06-13 06:55

/src/openssl/crypto/x509/v3_crld.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <stdio.h>
11
#include "internal/cryptlib.h"
12
#include <openssl/conf.h>
13
#include <openssl/asn1.h>
14
#include <openssl/asn1t.h>
15
#include <openssl/x509v3.h>
16
17
#include "crypto/x509.h"
18
#include "ext_dat.h"
19
#include "x509_local.h"
20
21
static void *v2i_crld(const X509V3_EXT_METHOD *method,
22
                      X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
23
static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
24
                     int indent);
25
26
const X509V3_EXT_METHOD ossl_v3_crld = {
27
    NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
28
    0, 0, 0, 0,
29
    0, 0,
30
    0,
31
    v2i_crld,
32
    i2r_crldp, 0,
33
    NULL
34
};
35
36
const X509V3_EXT_METHOD ossl_v3_freshest_crl = {
37
    NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
38
    0, 0, 0, 0,
39
    0, 0,
40
    0,
41
    v2i_crld,
42
    i2r_crldp, 0,
43
    NULL
44
};
45
46
static STACK_OF(GENERAL_NAME) *gnames_from_sectname(X509V3_CTX *ctx,
47
                                                    char *sect)
48
0
{
49
0
    STACK_OF(CONF_VALUE) *gnsect;
50
0
    STACK_OF(GENERAL_NAME) *gens;
51
0
    if (*sect == '@')
52
0
        gnsect = X509V3_get_section(ctx, sect + 1);
53
0
    else
54
0
        gnsect = X509V3_parse_list(sect);
55
0
    if (!gnsect) {
56
0
        ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
57
0
        return NULL;
58
0
    }
59
0
    gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
60
0
    if (*sect == '@')
61
0
        X509V3_section_free(ctx, gnsect);
62
0
    else
63
0
        sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
64
0
    return gens;
65
0
}
66
67
static int set_dist_point_name(DIST_POINT_NAME **pdp, X509V3_CTX *ctx,
68
                               CONF_VALUE *cnf)
69
0
{
70
0
    STACK_OF(GENERAL_NAME) *fnm = NULL;
71
0
    STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
72
73
0
    if (cnf->value == NULL) {
74
0
        ERR_raise(ERR_LIB_X509V3, X509V3_R_MISSING_VALUE);
75
0
        goto err;
76
0
    }
77
78
0
    if (HAS_PREFIX(cnf->name, "fullname")) {
79
0
        fnm = gnames_from_sectname(ctx, cnf->value);
80
0
        if (!fnm)
81
0
            goto err;
82
0
    } else if (strcmp(cnf->name, "relativename") == 0) {
83
0
        int ret;
84
0
        STACK_OF(CONF_VALUE) *dnsect;
85
0
        X509_NAME *nm;
86
0
        nm = X509_NAME_new();
87
0
        if (nm == NULL)
88
0
            return -1;
89
0
        dnsect = X509V3_get_section(ctx, cnf->value);
90
0
        if (!dnsect) {
91
0
            X509_NAME_free(nm);
92
0
            ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
93
0
            return -1;
94
0
        }
95
0
        ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
96
0
        X509V3_section_free(ctx, dnsect);
97
0
        rnm = nm->entries;
98
0
        nm->entries = NULL;
99
0
        X509_NAME_free(nm);
100
0
        if (!ret || sk_X509_NAME_ENTRY_num(rnm) <= 0)
101
0
            goto err;
102
        /*
103
         * Since its a name fragment can't have more than one RDNSequence
104
         */
105
0
        if (sk_X509_NAME_ENTRY_value(rnm,
106
0
                                     sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
107
0
            ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_MULTIPLE_RDNS);
108
0
            goto err;
109
0
        }
110
0
    } else
111
0
        return 0;
112
113
0
    if (*pdp) {
114
0
        ERR_raise(ERR_LIB_X509V3, X509V3_R_DISTPOINT_ALREADY_SET);
115
0
        goto err;
116
0
    }
117
118
0
    *pdp = DIST_POINT_NAME_new();
119
0
    if (*pdp == NULL)
120
0
        goto err;
121
0
    if (fnm) {
122
0
        (*pdp)->type = 0;
123
0
        (*pdp)->name.fullname = fnm;
124
0
    } else {
125
0
        (*pdp)->type = 1;
126
0
        (*pdp)->name.relativename = rnm;
127
0
    }
128
129
0
    return 1;
130
131
0
 err:
132
0
    sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
133
0
    sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
134
0
    return -1;
135
0
}
136
137
static const BIT_STRING_BITNAME reason_flags[] = {
138
    {0, "Unused", "unused"},
139
    {1, "Key Compromise", "keyCompromise"},
140
    {2, "CA Compromise", "CACompromise"},
141
    {3, "Affiliation Changed", "affiliationChanged"},
142
    {4, "Superseded", "superseded"},
143
    {5, "Cessation Of Operation", "cessationOfOperation"},
144
    {6, "Certificate Hold", "certificateHold"},
145
    {7, "Privilege Withdrawn", "privilegeWithdrawn"},
146
    {8, "AA Compromise", "AACompromise"},
147
    {-1, NULL, NULL}
148
};
149
150
static int set_reasons(ASN1_BIT_STRING **preas, char *value)
151
0
{
152
0
    STACK_OF(CONF_VALUE) *rsk = NULL;
153
0
    const BIT_STRING_BITNAME *pbn;
154
0
    const char *bnam;
155
0
    int i, ret = 0;
156
0
    rsk = X509V3_parse_list(value);
157
0
    if (rsk == NULL)
158
0
        return 0;
159
0
    if (*preas != NULL)
160
0
        goto err;
161
0
    for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
162
0
        bnam = sk_CONF_VALUE_value(rsk, i)->name;
163
0
        if (*preas == NULL) {
164
0
            *preas = ASN1_BIT_STRING_new();
165
0
            if (*preas == NULL)
166
0
                goto err;
167
0
        }
168
0
        for (pbn = reason_flags; pbn->lname; pbn++) {
169
0
            if (strcmp(pbn->sname, bnam) == 0) {
170
0
                if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
171
0
                    goto err;
172
0
                break;
173
0
            }
174
0
        }
175
0
        if (pbn->lname == NULL)
176
0
            goto err;
177
0
    }
178
0
    ret = 1;
179
180
0
 err:
181
0
    sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
182
0
    return ret;
183
0
}
184
185
static int print_reasons(BIO *out, const char *rname,
186
                         ASN1_BIT_STRING *rflags, int indent)
187
0
{
188
0
    int first = 1;
189
0
    const BIT_STRING_BITNAME *pbn;
190
0
    BIO_printf(out, "%*s%s:\n%*s", indent, "", rname, indent + 2, "");
191
0
    for (pbn = reason_flags; pbn->lname; pbn++) {
192
0
        if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
193
0
            if (first)
194
0
                first = 0;
195
0
            else
196
0
                BIO_puts(out, ", ");
197
0
            BIO_puts(out, pbn->lname);
198
0
        }
199
0
    }
200
0
    if (first)
201
0
        BIO_puts(out, "<EMPTY>\n");
202
0
    else
203
0
        BIO_puts(out, "\n");
204
0
    return 1;
205
0
}
206
207
static DIST_POINT *crldp_from_section(X509V3_CTX *ctx,
208
                                      STACK_OF(CONF_VALUE) *nval)
209
0
{
210
0
    int i;
211
0
    CONF_VALUE *cnf;
212
0
    DIST_POINT *point = DIST_POINT_new();
213
214
0
    if (point == NULL)
215
0
        goto err;
216
0
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
217
0
        int ret;
218
0
        cnf = sk_CONF_VALUE_value(nval, i);
219
0
        ret = set_dist_point_name(&point->distpoint, ctx, cnf);
220
0
        if (ret > 0)
221
0
            continue;
222
0
        if (ret < 0)
223
0
            goto err;
224
0
        if (strcmp(cnf->name, "reasons") == 0) {
225
0
            if (!set_reasons(&point->reasons, cnf->value))
226
0
                goto err;
227
0
        } else if (strcmp(cnf->name, "CRLissuer") == 0) {
228
0
            point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
229
0
            if (point->CRLissuer == NULL)
230
0
                goto err;
231
0
        }
232
0
    }
233
234
0
    return point;
235
236
0
 err:
237
0
    DIST_POINT_free(point);
238
0
    return NULL;
239
0
}
240
241
static void *v2i_crld(const X509V3_EXT_METHOD *method,
242
                      X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
243
0
{
244
0
    STACK_OF(DIST_POINT) *crld;
245
0
    GENERAL_NAMES *gens = NULL;
246
0
    GENERAL_NAME *gen = NULL;
247
0
    CONF_VALUE *cnf;
248
0
    const int num = sk_CONF_VALUE_num(nval);
249
0
    int i;
250
251
0
    crld = sk_DIST_POINT_new_reserve(NULL, num);
252
0
    if (crld == NULL) {
253
0
        ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
254
0
        goto err;
255
0
    }
256
0
    for (i = 0; i < num; i++) {
257
0
        DIST_POINT *point;
258
259
0
        cnf = sk_CONF_VALUE_value(nval, i);
260
0
        if (cnf->value == NULL) {
261
0
            STACK_OF(CONF_VALUE) *dpsect;
262
0
            dpsect = X509V3_get_section(ctx, cnf->name);
263
0
            if (!dpsect)
264
0
                goto err;
265
0
            point = crldp_from_section(ctx, dpsect);
266
0
            X509V3_section_free(ctx, dpsect);
267
0
            if (point == NULL)
268
0
                goto err;
269
0
            sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
270
0
        } else {
271
0
            if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
272
0
                goto err;
273
0
            if ((gens = GENERAL_NAMES_new()) == NULL) {
274
0
                ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
275
0
                goto err;
276
0
            }
277
0
            if (!sk_GENERAL_NAME_push(gens, gen)) {
278
0
                ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
279
0
                goto err;
280
0
            }
281
0
            gen = NULL;
282
0
            if ((point = DIST_POINT_new()) == NULL) {
283
0
                ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
284
0
                goto err;
285
0
            }
286
0
            sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
287
0
            if ((point->distpoint = DIST_POINT_NAME_new()) == NULL) {
288
0
                ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
289
0
                goto err;
290
0
            }
291
0
            point->distpoint->name.fullname = gens;
292
0
            point->distpoint->type = 0;
293
0
            gens = NULL;
294
0
        }
295
0
    }
296
0
    return crld;
297
298
0
 err:
299
0
    GENERAL_NAME_free(gen);
300
0
    GENERAL_NAMES_free(gens);
301
0
    sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
302
0
    return NULL;
303
0
}
304
305
static int dpn_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
306
                  void *exarg)
307
0
{
308
0
    DIST_POINT_NAME *dpn = (DIST_POINT_NAME *)*pval;
309
310
0
    switch (operation) {
311
0
    case ASN1_OP_NEW_POST:
312
0
        dpn->dpname = NULL;
313
0
        break;
314
315
0
    case ASN1_OP_FREE_POST:
316
0
        X509_NAME_free(dpn->dpname);
317
0
        break;
318
0
    }
319
0
    return 1;
320
0
}
321
322
323
ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
324
        ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
325
        ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
326
} ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
327
328
329
IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
330
IMPLEMENT_ASN1_DUP_FUNCTION(DIST_POINT_NAME)
331
332
ASN1_SEQUENCE(DIST_POINT) = {
333
        ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
334
        ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
335
        ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
336
} ASN1_SEQUENCE_END(DIST_POINT)
337
338
IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
339
340
ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
341
        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
342
ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
343
344
IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
345
346
ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
347
        ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
348
        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
349
        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
350
        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
351
        ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
352
        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
353
} ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
354
355
IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
356
357
static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
358
                   int indent);
359
static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
360
                     STACK_OF(CONF_VALUE) *nval);
361
362
const X509V3_EXT_METHOD ossl_v3_idp = {
363
    NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
364
    ASN1_ITEM_ref(ISSUING_DIST_POINT),
365
    0, 0, 0, 0,
366
    0, 0,
367
    0,
368
    v2i_idp,
369
    i2r_idp, 0,
370
    NULL
371
};
372
373
static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
374
                     STACK_OF(CONF_VALUE) *nval)
375
0
{
376
0
    ISSUING_DIST_POINT *idp = NULL;
377
0
    CONF_VALUE *cnf;
378
0
    char *name, *val;
379
0
    int i, ret;
380
0
    idp = ISSUING_DIST_POINT_new();
381
0
    if (idp == NULL) {
382
0
        ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
383
0
        goto err;
384
0
    }
385
0
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
386
0
        cnf = sk_CONF_VALUE_value(nval, i);
387
0
        name = cnf->name;
388
0
        val = cnf->value;
389
0
        ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
390
0
        if (ret > 0)
391
0
            continue;
392
0
        if (ret < 0)
393
0
            goto err;
394
0
        if (strcmp(name, "onlyuser") == 0) {
395
0
            if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
396
0
                goto err;
397
0
        } else if (strcmp(name, "onlyCA") == 0) {
398
0
            if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
399
0
                goto err;
400
0
        } else if (strcmp(name, "onlyAA") == 0) {
401
0
            if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
402
0
                goto err;
403
0
        } else if (strcmp(name, "indirectCRL") == 0) {
404
0
            if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
405
0
                goto err;
406
0
        } else if (strcmp(name, "onlysomereasons") == 0) {
407
0
            if (!set_reasons(&idp->onlysomereasons, val))
408
0
                goto err;
409
0
        } else {
410
0
            ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME);
411
0
            X509V3_conf_add_error_name_value(cnf);
412
0
            goto err;
413
0
        }
414
0
    }
415
0
    return idp;
416
417
0
 err:
418
0
    ISSUING_DIST_POINT_free(idp);
419
0
    return NULL;
420
0
}
421
422
static int print_distpoint(BIO *out, DIST_POINT_NAME *dpn, int indent)
423
0
{
424
0
    if (dpn->type == 0) {
425
0
        BIO_printf(out, "%*sFull Name:\n", indent, "");
426
0
        OSSL_GENERAL_NAMES_print(out, dpn->name.fullname, indent);
427
0
        BIO_puts(out, "\n");
428
0
    } else {
429
0
        X509_NAME ntmp;
430
0
        ntmp.entries = dpn->name.relativename;
431
0
        BIO_printf(out, "%*sRelative Name:\n%*s", indent, "", indent + 2, "");
432
0
        X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
433
0
        BIO_puts(out, "\n");
434
0
    }
435
0
    return 1;
436
0
}
437
438
static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
439
                   int indent)
440
0
{
441
0
    ISSUING_DIST_POINT *idp = pidp;
442
0
    if (idp->distpoint)
443
0
        print_distpoint(out, idp->distpoint, indent);
444
0
    if (idp->onlyuser > 0)
445
0
        BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
446
0
    if (idp->onlyCA > 0)
447
0
        BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
448
0
    if (idp->indirectCRL > 0)
449
0
        BIO_printf(out, "%*sIndirect CRL\n", indent, "");
450
0
    if (idp->onlysomereasons)
451
0
        print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
452
0
    if (idp->onlyattr > 0)
453
0
        BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
454
0
    if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
455
0
        && (idp->indirectCRL <= 0) && !idp->onlysomereasons
456
0
        && (idp->onlyattr <= 0))
457
0
        BIO_printf(out, "%*s<EMPTY>\n", indent, "");
458
459
0
    return 1;
460
0
}
461
462
static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
463
                     int indent)
464
0
{
465
0
    STACK_OF(DIST_POINT) *crld = pcrldp;
466
0
    DIST_POINT *point;
467
0
    int i;
468
0
    for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
469
0
        if (i > 0)
470
0
            BIO_puts(out, "\n");
471
0
        point = sk_DIST_POINT_value(crld, i);
472
0
        if (point->distpoint)
473
0
            print_distpoint(out, point->distpoint, indent);
474
0
        if (point->reasons)
475
0
            print_reasons(out, "Reasons", point->reasons, indent);
476
0
        if (point->CRLissuer) {
477
0
            BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
478
0
            OSSL_GENERAL_NAMES_print(out, point->CRLissuer, indent);
479
0
        }
480
0
    }
481
0
    return 1;
482
0
}
483
484
/* Append any nameRelativeToCRLIssuer in dpn to iname, set in dpn->dpname */
485
int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, const X509_NAME *iname)
486
0
{
487
0
    int i;
488
0
    STACK_OF(X509_NAME_ENTRY) *frag;
489
0
    X509_NAME_ENTRY *ne;
490
491
0
    if (dpn == NULL || dpn->type != 1)
492
0
        return 1;
493
0
    frag = dpn->name.relativename;
494
0
    X509_NAME_free(dpn->dpname); /* just in case it was already set */
495
0
    dpn->dpname = X509_NAME_dup(iname);
496
0
    if (dpn->dpname == NULL)
497
0
        return 0;
498
0
    for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
499
0
        ne = sk_X509_NAME_ENTRY_value(frag, i);
500
0
        if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1))
501
0
            goto err;
502
0
    }
503
    /* generate cached encoding of name */
504
0
    if (i2d_X509_NAME(dpn->dpname, NULL) >= 0)
505
0
        return 1;
506
507
0
 err:
508
0
    X509_NAME_free(dpn->dpname);
509
0
    dpn->dpname = NULL;
510
0
    return 0;
511
0
}
512
513
ASN1_SEQUENCE(OSSL_AA_DIST_POINT) = {
514
    ASN1_EXP_OPT(OSSL_AA_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
515
    ASN1_IMP_OPT(OSSL_AA_DIST_POINT, reasons, ASN1_BIT_STRING, 1),
516
    ASN1_IMP_OPT(OSSL_AA_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 2),
517
    ASN1_IMP_OPT(OSSL_AA_DIST_POINT, containsUserAttributeCerts, ASN1_TBOOLEAN, 3),
518
    ASN1_IMP_OPT(OSSL_AA_DIST_POINT, containsAACerts, ASN1_TBOOLEAN, 4),
519
    ASN1_IMP_OPT(OSSL_AA_DIST_POINT, containsSOAPublicKeyCerts, ASN1_TBOOLEAN, 5)
520
} ASN1_SEQUENCE_END(OSSL_AA_DIST_POINT)
521
522
IMPLEMENT_ASN1_FUNCTIONS(OSSL_AA_DIST_POINT)
523
524
static int print_boolean(BIO *out, ASN1_BOOLEAN b)
525
0
{
526
0
    return BIO_puts(out, b ? "TRUE" : "FALSE");
527
0
}
528
529
static OSSL_AA_DIST_POINT *aaidp_from_section(X509V3_CTX *ctx,
530
                                              STACK_OF(CONF_VALUE) *nval)
531
0
{
532
0
    int i, ret;
533
0
    CONF_VALUE *cnf;
534
0
    OSSL_AA_DIST_POINT *point = OSSL_AA_DIST_POINT_new();
535
536
0
    if (point == NULL)
537
0
        goto err;
538
0
    for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
539
0
        cnf = sk_CONF_VALUE_value(nval, i);
540
0
        ret = set_dist_point_name(&point->distpoint, ctx, cnf);
541
0
        if (ret > 0)
542
0
            continue;
543
0
        if (ret < 0)
544
0
            goto err;
545
0
        if (strcmp(cnf->name, "reasons") == 0) {
546
0
            if (!set_reasons(&point->reasons, cnf->value))
547
0
                goto err;
548
0
        } else if (strcmp(cnf->name, "indirectCRL") == 0) {
549
0
            if (!X509V3_get_value_bool(cnf, &point->indirectCRL))
550
0
                goto err;
551
0
        } else if (strcmp(cnf->name, "containsUserAttributeCerts") == 0) {
552
0
            if (!X509V3_get_value_bool(cnf, &point->containsUserAttributeCerts))
553
0
                goto err;
554
0
        } else if (strcmp(cnf->name, "containsAACerts") == 0) {
555
0
            if (!X509V3_get_value_bool(cnf, &point->containsAACerts))
556
0
                goto err;
557
0
        } else if (strcmp(cnf->name, "containsSOAPublicKeyCerts") == 0) {
558
0
            if (!X509V3_get_value_bool(cnf, &point->containsSOAPublicKeyCerts))
559
0
                goto err;
560
0
        }
561
0
    }
562
563
0
    return point;
564
565
0
 err:
566
0
    OSSL_AA_DIST_POINT_free(point);
567
0
    return NULL;
568
0
}
569
570
static void *v2i_aaidp(const X509V3_EXT_METHOD *method,
571
                       X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
572
0
{
573
0
    GENERAL_NAMES *gens = NULL;
574
0
    GENERAL_NAME *gen = NULL;
575
0
    CONF_VALUE *cnf;
576
0
    OSSL_AA_DIST_POINT *point = NULL;
577
0
    STACK_OF(CONF_VALUE) *dpsect;
578
579
0
    cnf = sk_CONF_VALUE_value(nval, 0);
580
0
    if (cnf == NULL)
581
0
        return NULL;
582
0
    if (cnf->value == NULL) {
583
0
        dpsect = X509V3_get_section(ctx, cnf->name);
584
0
        if (dpsect == NULL)
585
0
            goto err;
586
0
        point = aaidp_from_section(ctx, dpsect);
587
0
        X509V3_section_free(ctx, dpsect);
588
0
        if (point == NULL)
589
0
            goto err;
590
0
    } else {
591
0
        if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
592
0
            goto err;
593
0
        if ((gens = GENERAL_NAMES_new()) == NULL) {
594
0
            ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
595
0
            goto err;
596
0
        }
597
0
        if (!sk_GENERAL_NAME_push(gens, gen)) {
598
0
            ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
599
0
            goto err;
600
0
        }
601
0
        gen = NULL;
602
0
        if ((point = OSSL_AA_DIST_POINT_new()) == NULL) {
603
0
            ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
604
0
            goto err;
605
0
        }
606
0
        if ((point->distpoint = DIST_POINT_NAME_new()) == NULL) {
607
0
            ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
608
0
            goto err;
609
0
        }
610
0
        point->distpoint->name.fullname = gens;
611
0
        point->distpoint->type = 0;
612
0
        gens = NULL;
613
0
    }
614
0
    return point;
615
616
0
 err:
617
0
    OSSL_AA_DIST_POINT_free(point);
618
0
    GENERAL_NAME_free(gen);
619
0
    GENERAL_NAMES_free(gens);
620
0
    return NULL;
621
0
}
622
623
static int i2r_aaidp(const X509V3_EXT_METHOD *method, void *dp, BIO *out,
624
                     int indent)
625
0
{
626
0
    OSSL_AA_DIST_POINT *pdp = dp;
627
628
0
    if (pdp->distpoint)
629
0
        if (print_distpoint(out, pdp->distpoint, indent) <= 0)
630
0
            return 0;
631
0
    if (pdp->reasons)
632
0
        if (print_reasons(out, "Reasons", pdp->reasons, indent) <= 0)
633
0
            return 0;
634
0
    if (pdp->indirectCRL) {
635
0
        if (BIO_printf(out, "%*sIndirect CRL: ", indent, "") <= 0)
636
0
            return 0;
637
0
        if (print_boolean(out, pdp->indirectCRL) <= 0)
638
0
            return 0;
639
0
        if (BIO_puts(out, "\n") <= 0)
640
0
            return 0;
641
0
    }
642
0
    if (pdp->containsUserAttributeCerts) {
643
0
        if (BIO_printf(out, "%*sContains User Attribute Certificates: ", indent, "") <= 0)
644
0
            return 0;
645
0
        if (print_boolean(out, pdp->containsUserAttributeCerts) <= 0)
646
0
            return 0;
647
0
        if (BIO_puts(out, "\n") <= 0)
648
0
            return 0;
649
0
    }
650
0
    if (pdp->containsAACerts) {
651
0
        if (BIO_printf(out, "%*sContains Attribute Authority (AA) Certificates: ",
652
0
                       indent, "") <= 0)
653
0
            return 0;
654
0
        if (print_boolean(out, pdp->containsAACerts) <= 0)
655
0
            return 0;
656
0
        if (BIO_puts(out, "\n") <= 0)
657
0
            return 0;
658
0
    }
659
0
    if (pdp->containsSOAPublicKeyCerts) {
660
0
        if (BIO_printf(out,
661
0
                       "%*sContains Source Of Authority (SOA) Public Key Certificates: ",
662
0
                       indent, "") <= 0)
663
0
            return 0;
664
0
        if (print_boolean(out, pdp->containsSOAPublicKeyCerts) <= 0)
665
0
            return 0;
666
0
        if (BIO_puts(out, "\n") <= 0)
667
0
            return 0;
668
0
    }
669
0
    return 1;
670
0
}
671
672
const X509V3_EXT_METHOD ossl_v3_aa_issuing_dist_point = {
673
    NID_id_aa_issuing_distribution_point, 0,
674
    ASN1_ITEM_ref(OSSL_AA_DIST_POINT),
675
    0, 0, 0, 0,
676
    0, 0,
677
    0,
678
    v2i_aaidp,
679
    i2r_aaidp, 0,
680
    NULL
681
};