Line data Source code
1 : /* crypto/asn1/x_name.c */
2 : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 : * All rights reserved.
4 : *
5 : * This package is an SSL implementation written
6 : * by Eric Young (eay@cryptsoft.com).
7 : * The implementation was written so as to conform with Netscapes SSL.
8 : *
9 : * This library is free for commercial and non-commercial use as long as
10 : * the following conditions are aheared to. The following conditions
11 : * apply to all code found in this distribution, be it the RC4, RSA,
12 : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 : * included with this distribution is covered by the same copyright terms
14 : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 : *
16 : * Copyright remains Eric Young's, and as such any Copyright notices in
17 : * the code are not to be removed.
18 : * If this package is used in a product, Eric Young should be given attribution
19 : * as the author of the parts of the library used.
20 : * This can be in the form of a textual message at program startup or
21 : * in documentation (online or textual) provided with the package.
22 : *
23 : * Redistribution and use in source and binary forms, with or without
24 : * modification, are permitted provided that the following conditions
25 : * are met:
26 : * 1. Redistributions of source code must retain the copyright
27 : * notice, this list of conditions and the following disclaimer.
28 : * 2. Redistributions in binary form must reproduce the above copyright
29 : * notice, this list of conditions and the following disclaimer in the
30 : * documentation and/or other materials provided with the distribution.
31 : * 3. All advertising materials mentioning features or use of this software
32 : * must display the following acknowledgement:
33 : * "This product includes cryptographic software written by
34 : * Eric Young (eay@cryptsoft.com)"
35 : * The word 'cryptographic' can be left out if the rouines from the library
36 : * being used are not cryptographic related :-).
37 : * 4. If you include any Windows specific code (or a derivative thereof) from
38 : * the apps directory (application code) you must include an acknowledgement:
39 : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 : *
41 : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 : * SUCH DAMAGE.
52 : *
53 : * The licence and distribution terms for any publically available version or
54 : * derivative of this code cannot be changed. i.e. this code cannot simply be
55 : * copied and put under another distribution licence
56 : * [including the GNU Public Licence.]
57 : */
58 :
59 : #include <stdio.h>
60 : #include <ctype.h>
61 : #include "cryptlib.h"
62 : #include <openssl/asn1t.h>
63 : #include <openssl/x509.h>
64 : #include "asn1_locl.h"
65 :
66 : typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY;
67 : DECLARE_STACK_OF(STACK_OF_X509_NAME_ENTRY)
68 :
69 : static int x509_name_ex_d2i(ASN1_VALUE **val,
70 : const unsigned char **in, long len,
71 : const ASN1_ITEM *it,
72 : int tag, int aclass, char opt, ASN1_TLC *ctx);
73 :
74 : static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out,
75 : const ASN1_ITEM *it, int tag, int aclass);
76 : static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it);
77 : static void x509_name_ex_free(ASN1_VALUE **val, const ASN1_ITEM *it);
78 :
79 : static int x509_name_encode(X509_NAME *a);
80 : static int x509_name_canon(X509_NAME *a);
81 : static int asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in);
82 : static int i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY) * intname,
83 : unsigned char **in);
84 :
85 : static int x509_name_ex_print(BIO *out, ASN1_VALUE **pval,
86 : int indent,
87 : const char *fname, const ASN1_PCTX *pctx);
88 :
89 : ASN1_SEQUENCE(X509_NAME_ENTRY) = {
90 : ASN1_SIMPLE(X509_NAME_ENTRY, object, ASN1_OBJECT),
91 : ASN1_SIMPLE(X509_NAME_ENTRY, value, ASN1_PRINTABLE)
92 : } ASN1_SEQUENCE_END(X509_NAME_ENTRY)
93 :
94 44076 : IMPLEMENT_ASN1_FUNCTIONS(X509_NAME_ENTRY)
95 0 : IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME_ENTRY)
96 :
97 : /*
98 : * For the "Name" type we need a SEQUENCE OF { SET OF X509_NAME_ENTRY } so
99 : * declare two template wrappers for this
100 : */
101 :
102 : ASN1_ITEM_TEMPLATE(X509_NAME_ENTRIES) =
103 : ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SET_OF, 0, RDNS, X509_NAME_ENTRY)
104 : ASN1_ITEM_TEMPLATE_END(X509_NAME_ENTRIES)
105 :
106 : ASN1_ITEM_TEMPLATE(X509_NAME_INTERNAL) =
107 : ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Name, X509_NAME_ENTRIES)
108 : ASN1_ITEM_TEMPLATE_END(X509_NAME_INTERNAL)
109 :
110 : /*
111 : * Normally that's where it would end: we'd have two nested STACK structures
112 : * representing the ASN1. Unfortunately X509_NAME uses a completely different
113 : * form and caches encodings so we have to process the internal form and
114 : * convert to the external form.
115 : */
116 :
117 : const ASN1_EXTERN_FUNCS x509_name_ff = {
118 : NULL,
119 : x509_name_ex_new,
120 : x509_name_ex_free,
121 : 0, /* Default clear behaviour is OK */
122 : x509_name_ex_d2i,
123 : x509_name_ex_i2d,
124 : x509_name_ex_print
125 : };
126 :
127 : IMPLEMENT_EXTERN_ASN1(X509_NAME, V_ASN1_SEQUENCE, x509_name_ff)
128 :
129 0 : IMPLEMENT_ASN1_FUNCTIONS(X509_NAME)
130 :
131 0 : IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME)
132 :
133 6724 : static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)
134 : {
135 : X509_NAME *ret = NULL;
136 6724 : ret = OPENSSL_malloc(sizeof(X509_NAME));
137 6724 : if (!ret)
138 : goto memerr;
139 6724 : if ((ret->entries = sk_X509_NAME_ENTRY_new_null()) == NULL)
140 : goto memerr;
141 6724 : if ((ret->bytes = BUF_MEM_new()) == NULL)
142 : goto memerr;
143 6724 : ret->canon_enc = NULL;
144 6724 : ret->canon_enclen = 0;
145 6724 : ret->modified = 1;
146 6724 : *val = (ASN1_VALUE *)ret;
147 6724 : return 1;
148 :
149 : memerr:
150 0 : ASN1err(ASN1_F_X509_NAME_EX_NEW, ERR_R_MALLOC_FAILURE);
151 0 : if (ret) {
152 0 : if (ret->entries)
153 0 : sk_X509_NAME_ENTRY_free(ret->entries);
154 0 : OPENSSL_free(ret);
155 : }
156 : return 0;
157 : }
158 :
159 6724 : static void x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
160 : {
161 : X509_NAME *a;
162 6724 : if (!pval || !*pval)
163 6724 : return;
164 : a = (X509_NAME *)*pval;
165 :
166 6724 : BUF_MEM_free(a->bytes);
167 6724 : sk_X509_NAME_ENTRY_pop_free(a->entries, X509_NAME_ENTRY_free);
168 6724 : if (a->canon_enc)
169 3362 : OPENSSL_free(a->canon_enc);
170 6724 : OPENSSL_free(a);
171 6724 : *pval = NULL;
172 : }
173 :
174 3362 : static int x509_name_ex_d2i(ASN1_VALUE **val,
175 : const unsigned char **in, long len,
176 : const ASN1_ITEM *it, int tag, int aclass,
177 : char opt, ASN1_TLC *ctx)
178 : {
179 3362 : const unsigned char *p = *in, *q;
180 : union {
181 : STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
182 : ASN1_VALUE *a;
183 3362 : } intname = {
184 : NULL
185 : };
186 : union {
187 : X509_NAME *x;
188 : ASN1_VALUE *a;
189 3362 : } nm = {
190 : NULL
191 : };
192 : int i, j, ret;
193 : STACK_OF(X509_NAME_ENTRY) *entries;
194 : X509_NAME_ENTRY *entry;
195 : q = p;
196 :
197 : /* Get internal representation of Name */
198 3362 : ret = ASN1_item_ex_d2i(&intname.a,
199 : &p, len, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
200 : tag, aclass, opt, ctx);
201 :
202 3362 : if (ret <= 0)
203 : return ret;
204 :
205 3362 : if (*val)
206 3362 : x509_name_ex_free(val, NULL);
207 3362 : if (!x509_name_ex_new(&nm.a, NULL))
208 : goto err;
209 : /* We've decoded it: now cache encoding */
210 3362 : if (!BUF_MEM_grow(nm.x->bytes, p - q))
211 : goto err;
212 3362 : memcpy(nm.x->bytes->data, q, p - q);
213 :
214 : /* Convert internal representation to X509_NAME structure */
215 18054 : for (i = 0; i < sk_STACK_OF_X509_NAME_ENTRY_num(intname.s); i++) {
216 14692 : entries = sk_STACK_OF_X509_NAME_ENTRY_value(intname.s, i);
217 29384 : for (j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
218 14692 : entry = sk_X509_NAME_ENTRY_value(entries, j);
219 14692 : entry->set = i;
220 14692 : if (!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
221 : goto err;
222 : }
223 14692 : sk_X509_NAME_ENTRY_free(entries);
224 : }
225 3362 : sk_STACK_OF_X509_NAME_ENTRY_free(intname.s);
226 3362 : ret = x509_name_canon(nm.x);
227 3362 : if (!ret)
228 : goto err;
229 3362 : nm.x->modified = 0;
230 3362 : *val = nm.a;
231 3362 : *in = p;
232 3362 : return ret;
233 : err:
234 0 : if (nm.x != NULL)
235 : X509_NAME_free(nm.x);
236 0 : ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
237 0 : return 0;
238 : }
239 :
240 0 : static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out,
241 : const ASN1_ITEM *it, int tag, int aclass)
242 : {
243 : int ret;
244 0 : X509_NAME *a = (X509_NAME *)*val;
245 0 : if (a->modified) {
246 0 : ret = x509_name_encode(a);
247 0 : if (ret < 0)
248 : return ret;
249 0 : ret = x509_name_canon(a);
250 0 : if (ret < 0)
251 : return ret;
252 : }
253 0 : ret = a->bytes->length;
254 0 : if (out != NULL) {
255 0 : memcpy(*out, a->bytes->data, ret);
256 0 : *out += ret;
257 : }
258 0 : return ret;
259 : }
260 :
261 0 : static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)
262 : {
263 0 : sk_X509_NAME_ENTRY_free(ne);
264 0 : }
265 :
266 14692 : static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)
267 : {
268 14692 : sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);
269 14692 : }
270 :
271 0 : static int x509_name_encode(X509_NAME *a)
272 : {
273 : union {
274 : STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
275 : ASN1_VALUE *a;
276 0 : } intname = {
277 : NULL
278 : };
279 : int len;
280 : unsigned char *p;
281 : STACK_OF(X509_NAME_ENTRY) *entries = NULL;
282 : X509_NAME_ENTRY *entry;
283 : int i, set = -1;
284 0 : intname.s = sk_STACK_OF_X509_NAME_ENTRY_new_null();
285 0 : if (!intname.s)
286 : goto memerr;
287 0 : for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
288 0 : entry = sk_X509_NAME_ENTRY_value(a->entries, i);
289 0 : if (entry->set != set) {
290 0 : entries = sk_X509_NAME_ENTRY_new_null();
291 0 : if (!entries)
292 : goto memerr;
293 0 : if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries))
294 : goto memerr;
295 0 : set = entry->set;
296 : }
297 0 : if (!sk_X509_NAME_ENTRY_push(entries, entry))
298 : goto memerr;
299 : }
300 0 : len = ASN1_item_ex_i2d(&intname.a, NULL,
301 : ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
302 0 : if (!BUF_MEM_grow(a->bytes, len))
303 : goto memerr;
304 0 : p = (unsigned char *)a->bytes->data;
305 0 : ASN1_item_ex_i2d(&intname.a,
306 : &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
307 0 : sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
308 : local_sk_X509_NAME_ENTRY_free);
309 0 : a->modified = 0;
310 0 : return len;
311 : memerr:
312 0 : sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
313 : local_sk_X509_NAME_ENTRY_free);
314 0 : ASN1err(ASN1_F_X509_NAME_ENCODE, ERR_R_MALLOC_FAILURE);
315 0 : return -1;
316 : }
317 :
318 0 : static int x509_name_ex_print(BIO *out, ASN1_VALUE **pval,
319 : int indent,
320 : const char *fname, const ASN1_PCTX *pctx)
321 : {
322 0 : if (X509_NAME_print_ex(out, (X509_NAME *)*pval,
323 : indent, pctx->nm_flags) <= 0)
324 : return 0;
325 0 : return 2;
326 : }
327 :
328 : /*
329 : * This function generates the canonical encoding of the Name structure. In
330 : * it all strings are converted to UTF8, leading, trailing and multiple
331 : * spaces collapsed, converted to lower case and the leading SEQUENCE header
332 : * removed. In future we could also normalize the UTF8 too. By doing this
333 : * comparison of Name structures can be rapidly perfomed by just using
334 : * memcmp() of the canonical encoding. By omitting the leading SEQUENCE name
335 : * constraints of type dirName can also be checked with a simple memcmp().
336 : */
337 :
338 3362 : static int x509_name_canon(X509_NAME *a)
339 : {
340 : unsigned char *p;
341 : STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL;
342 : STACK_OF(X509_NAME_ENTRY) *entries = NULL;
343 : X509_NAME_ENTRY *entry, *tmpentry = NULL;
344 : int i, set = -1, ret = 0;
345 :
346 3362 : if (a->canon_enc) {
347 0 : OPENSSL_free(a->canon_enc);
348 0 : a->canon_enc = NULL;
349 : }
350 : /* Special case: empty X509_NAME => null encoding */
351 3362 : if (sk_X509_NAME_ENTRY_num(a->entries) == 0) {
352 0 : a->canon_enclen = 0;
353 0 : return 1;
354 : }
355 3362 : intname = sk_STACK_OF_X509_NAME_ENTRY_new_null();
356 3362 : if (!intname)
357 : goto err;
358 14692 : for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
359 14692 : entry = sk_X509_NAME_ENTRY_value(a->entries, i);
360 14692 : if (entry->set != set) {
361 14692 : entries = sk_X509_NAME_ENTRY_new_null();
362 14692 : if (!entries)
363 : goto err;
364 14692 : if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries))
365 : goto err;
366 14692 : set = entry->set;
367 : }
368 : tmpentry = X509_NAME_ENTRY_new();
369 14692 : if (!tmpentry)
370 : goto err;
371 14692 : tmpentry->object = OBJ_dup(entry->object);
372 14692 : if (!asn1_string_canon(tmpentry->value, entry->value))
373 : goto err;
374 14692 : if (!sk_X509_NAME_ENTRY_push(entries, tmpentry))
375 : goto err;
376 : tmpentry = NULL;
377 : }
378 :
379 : /* Finally generate encoding */
380 :
381 3362 : a->canon_enclen = i2d_name_canon(intname, NULL);
382 :
383 3362 : p = OPENSSL_malloc(a->canon_enclen);
384 :
385 3362 : if (!p)
386 : goto err;
387 :
388 3362 : a->canon_enc = p;
389 :
390 3362 : i2d_name_canon(intname, &p);
391 :
392 : ret = 1;
393 :
394 : err:
395 :
396 3362 : if (tmpentry)
397 : X509_NAME_ENTRY_free(tmpentry);
398 3362 : if (intname)
399 3362 : sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname,
400 : local_sk_X509_NAME_ENTRY_pop_free);
401 3362 : return ret;
402 : }
403 :
404 : /* Bitmap of all the types of string that will be canonicalized. */
405 :
406 : #define ASN1_MASK_CANON \
407 : (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING \
408 : | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING \
409 : | B_ASN1_VISIBLESTRING)
410 :
411 14692 : static int asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in)
412 : {
413 : unsigned char *to, *from;
414 : int len, i;
415 :
416 : /* If type not in bitmask just copy string across */
417 14692 : if (!(ASN1_tag2bit(in->type) & ASN1_MASK_CANON)) {
418 0 : if (!ASN1_STRING_copy(out, in))
419 : return 0;
420 0 : return 1;
421 : }
422 :
423 14692 : out->type = V_ASN1_UTF8STRING;
424 14692 : out->length = ASN1_STRING_to_UTF8(&out->data, in);
425 14692 : if (out->length == -1)
426 : return 0;
427 :
428 14692 : to = out->data;
429 : from = to;
430 :
431 : len = out->length;
432 :
433 : /*
434 : * Convert string in place to canonical form. Ultimately we may need to
435 : * handle a wider range of characters but for now ignore anything with
436 : * MSB set and rely on the isspace() and tolower() functions.
437 : */
438 :
439 : /* Ignore leading spaces */
440 29384 : while ((len > 0) && !(*from & 0x80) && isspace(*from)) {
441 0 : from++;
442 0 : len--;
443 : }
444 :
445 14692 : to = from + len - 1;
446 :
447 : /* Ignore trailing spaces */
448 29384 : while ((len > 0) && !(*to & 0x80) && isspace(*to)) {
449 0 : to--;
450 0 : len--;
451 : }
452 :
453 : to = out->data;
454 :
455 : i = 0;
456 159622 : while (i < len) {
457 : /* If MSB set just copy across */
458 144930 : if (*from & 0x80) {
459 0 : *to++ = *from++;
460 0 : i++;
461 : }
462 : /* Collapse multiple spaces */
463 144930 : else if (isspace(*from)) {
464 : /* Copy one space across */
465 7594 : *to++ = ' ';
466 : /*
467 : * Ignore subsequent spaces. Note: don't need to check len here
468 : * because we know the last character is a non-space so we can't
469 : * overflow.
470 : */
471 : do {
472 7594 : from++;
473 7594 : i++;
474 : }
475 7594 : while (!(*from & 0x80) && isspace(*from));
476 : } else {
477 137336 : *to++ = tolower(*from);
478 137336 : from++;
479 137336 : i++;
480 : }
481 : }
482 :
483 14692 : out->length = to - out->data;
484 :
485 14692 : return 1;
486 :
487 : }
488 :
489 6724 : static int i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY) * _intname,
490 : unsigned char **in)
491 : {
492 : int i, len, ltmp;
493 : ASN1_VALUE *v;
494 : STACK_OF(ASN1_VALUE) *intname = (STACK_OF(ASN1_VALUE) *)_intname;
495 :
496 : len = 0;
497 36108 : for (i = 0; i < sk_ASN1_VALUE_num(intname); i++) {
498 29384 : v = sk_ASN1_VALUE_value(intname, i);
499 29384 : ltmp = ASN1_item_ex_i2d(&v, in,
500 : ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1);
501 29384 : if (ltmp < 0)
502 : return ltmp;
503 29384 : len += ltmp;
504 : }
505 : return len;
506 : }
507 :
508 0 : int X509_NAME_set(X509_NAME **xn, X509_NAME *name)
509 : {
510 : X509_NAME *in;
511 :
512 0 : if (!xn || !name)
513 : return (0);
514 :
515 0 : if (*xn != name) {
516 : in = X509_NAME_dup(name);
517 0 : if (in != NULL) {
518 0 : X509_NAME_free(*xn);
519 0 : *xn = in;
520 : }
521 : }
522 0 : return (*xn != NULL);
523 : }
524 :
525 : IMPLEMENT_STACK_OF(X509_NAME_ENTRY)
526 :
527 : IMPLEMENT_ASN1_SET_OF(X509_NAME_ENTRY)
|
