1 /* $OpenBSD: x509_akey.c,v 1.3 2024/08/31 10:03:03 tb Exp $ */ 2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3 * project 1999. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 1999 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <stdio.h> 60 #include <string.h> 61 62 #include <openssl/asn1.h> 63 #include <openssl/asn1t.h> 64 #include <openssl/conf.h> 65 #include <openssl/err.h> 66 #include <openssl/x509v3.h> 67 68 #include "x509_local.h" 69 70 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 71 AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist); 72 static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, 73 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values); 74 75 static const X509V3_EXT_METHOD x509v3_ext_authority_key_identifier = { 76 .ext_nid = NID_authority_key_identifier, 77 .ext_flags = X509V3_EXT_MULTILINE, 78 .it = &AUTHORITY_KEYID_it, 79 .ext_new = NULL, 80 .ext_free = NULL, 81 .d2i = NULL, 82 .i2d = NULL, 83 .i2s = NULL, 84 .s2i = NULL, 85 .i2v = (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID, 86 .v2i = (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID, 87 .i2r = NULL, 88 .r2i = NULL, 89 .usr_data = NULL, 90 }; 91 92 const X509V3_EXT_METHOD * 93 x509v3_ext_method_authority_key_identifier(void) 94 { 95 return &x509v3_ext_authority_key_identifier; 96 } 97 98 static STACK_OF(CONF_VALUE) * 99 i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, AUTHORITY_KEYID *akeyid, 100 STACK_OF(CONF_VALUE) *extlist) 101 { 102 STACK_OF(CONF_VALUE) *free_extlist = NULL; 103 char *tmpstr = NULL; 104 105 if (extlist == NULL) { 106 if ((free_extlist = extlist = sk_CONF_VALUE_new_null()) == NULL) 107 return NULL; 108 } 109 110 if (akeyid->keyid != NULL) { 111 if ((tmpstr = hex_to_string(akeyid->keyid->data, 112 akeyid->keyid->length)) == NULL) 113 goto err; 114 if (!X509V3_add_value("keyid", tmpstr, &extlist)) 115 goto err; 116 free(tmpstr); 117 tmpstr = NULL; 118 } 119 120 if (akeyid->issuer != NULL) { 121 if ((extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, 122 extlist)) == NULL) 123 goto err; 124 } 125 126 if (akeyid->serial != NULL) { 127 if ((tmpstr = hex_to_string(akeyid->serial->data, 128 akeyid->serial->length)) == NULL) 129 goto err; 130 if (!X509V3_add_value("serial", tmpstr, &extlist)) 131 goto err; 132 free(tmpstr); 133 tmpstr = NULL; 134 } 135 136 if (sk_CONF_VALUE_num(extlist) <= 0) 137 goto err; 138 139 return extlist; 140 141 err: 142 free(tmpstr); 143 sk_CONF_VALUE_pop_free(free_extlist, X509V3_conf_free); 144 145 return NULL; 146 } 147 148 /* 149 * Currently two options: 150 * keyid: use the issuers subject keyid, the value 'always' means its is 151 * an error if the issuer certificate doesn't have a key id. 152 * issuer: use the issuers cert issuer and serial number. The default is 153 * to only use this if keyid is not present. With the option 'always' 154 * this is always included. 155 */ 156 static AUTHORITY_KEYID * 157 v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, 158 STACK_OF(CONF_VALUE) *values) 159 { 160 char keyid = 0, issuer = 0; 161 int i; 162 CONF_VALUE *cnf; 163 ASN1_OCTET_STRING *ikeyid = NULL; 164 X509_NAME *isname = NULL; 165 STACK_OF(GENERAL_NAME) *gens = NULL; 166 GENERAL_NAME *gen = NULL; 167 ASN1_INTEGER *serial = NULL; 168 X509_EXTENSION *ext; 169 X509 *cert; 170 AUTHORITY_KEYID *akeyid = NULL; 171 172 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 173 cnf = sk_CONF_VALUE_value(values, i); 174 if (!strcmp(cnf->name, "keyid")) { 175 keyid = 1; 176 if (cnf->value && !strcmp(cnf->value, "always")) 177 keyid = 2; 178 } else if (!strcmp(cnf->name, "issuer")) { 179 issuer = 1; 180 if (cnf->value && !strcmp(cnf->value, "always")) 181 issuer = 2; 182 } else { 183 X509V3error(X509V3_R_UNKNOWN_OPTION); 184 ERR_asprintf_error_data("name=%s", cnf->name); 185 return NULL; 186 } 187 } 188 189 if (!ctx || !ctx->issuer_cert) { 190 if (ctx && (ctx->flags == CTX_TEST)) 191 return AUTHORITY_KEYID_new(); 192 X509V3error(X509V3_R_NO_ISSUER_CERTIFICATE); 193 return NULL; 194 } 195 196 cert = ctx->issuer_cert; 197 198 if (keyid) { 199 i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1); 200 if ((i >= 0) && (ext = X509_get_ext(cert, i))) 201 ikeyid = X509V3_EXT_d2i(ext); 202 if (keyid == 2 && !ikeyid) { 203 X509V3error(X509V3_R_UNABLE_TO_GET_ISSUER_KEYID); 204 return NULL; 205 } 206 } 207 208 if ((issuer && !ikeyid) || (issuer == 2)) { 209 isname = X509_NAME_dup(X509_get_issuer_name(cert)); 210 serial = ASN1_INTEGER_dup(X509_get_serialNumber(cert)); 211 if (!isname || !serial) { 212 X509V3error(X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS); 213 goto err; 214 } 215 } 216 217 if (!(akeyid = AUTHORITY_KEYID_new())) 218 goto err; 219 220 if (isname) { 221 if (!(gens = sk_GENERAL_NAME_new_null()) || 222 !(gen = GENERAL_NAME_new()) || 223 !sk_GENERAL_NAME_push(gens, gen)) { 224 X509V3error(ERR_R_MALLOC_FAILURE); 225 goto err; 226 } 227 gen->type = GEN_DIRNAME; 228 gen->d.dirn = isname; 229 } 230 231 akeyid->issuer = gens; 232 akeyid->serial = serial; 233 akeyid->keyid = ikeyid; 234 235 return akeyid; 236 237 err: 238 AUTHORITY_KEYID_free(akeyid); 239 GENERAL_NAME_free(gen); 240 sk_GENERAL_NAME_free(gens); 241 X509_NAME_free(isname); 242 ASN1_INTEGER_free(serial); 243 ASN1_OCTET_STRING_free(ikeyid); 244 return NULL; 245 } 246