File: | src/lib/libcrypto/x509/x509_addr.c |
Warning: | line 1895, column 16 Access to field 'rfc3779_addr' results in a dereference of a null pointer (loaded from variable 'cert') |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: x509_addr.c,v 1.76 2022/01/06 14:08:15 tb Exp $ */ | |||
2 | /* | |||
3 | * Contributed to the OpenSSL Project by the American Registry for | |||
4 | * Internet Numbers ("ARIN"). | |||
5 | */ | |||
6 | /* ==================================================================== | |||
7 | * Copyright (c) 2006-2016 The OpenSSL Project. All rights reserved. | |||
8 | * | |||
9 | * Redistribution and use in source and binary forms, with or without | |||
10 | * modification, are permitted provided that the following conditions | |||
11 | * are met: | |||
12 | * | |||
13 | * 1. Redistributions of source code must retain the above copyright | |||
14 | * notice, this list of conditions and the following disclaimer. | |||
15 | * | |||
16 | * 2. Redistributions in binary form must reproduce the above copyright | |||
17 | * notice, this list of conditions and the following disclaimer in | |||
18 | * the documentation and/or other materials provided with the | |||
19 | * distribution. | |||
20 | * | |||
21 | * 3. All advertising materials mentioning features or use of this | |||
22 | * software must display the following acknowledgment: | |||
23 | * "This product includes software developed by the OpenSSL Project | |||
24 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" | |||
25 | * | |||
26 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | |||
27 | * endorse or promote products derived from this software without | |||
28 | * prior written permission. For written permission, please contact | |||
29 | * licensing@OpenSSL.org. | |||
30 | * | |||
31 | * 5. Products derived from this software may not be called "OpenSSL" | |||
32 | * nor may "OpenSSL" appear in their names without prior written | |||
33 | * permission of the OpenSSL Project. | |||
34 | * | |||
35 | * 6. Redistributions of any form whatsoever must retain the following | |||
36 | * acknowledgment: | |||
37 | * "This product includes software developed by the OpenSSL Project | |||
38 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" | |||
39 | * | |||
40 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | |||
41 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |||
42 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | |||
43 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | |||
44 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |||
45 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | |||
46 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |||
47 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |||
48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | |||
49 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | |||
50 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | |||
51 | * OF THE POSSIBILITY OF SUCH DAMAGE. | |||
52 | * ==================================================================== | |||
53 | * | |||
54 | * This product includes cryptographic software written by Eric Young | |||
55 | * (eay@cryptsoft.com). This product includes software written by Tim | |||
56 | * Hudson (tjh@cryptsoft.com). | |||
57 | */ | |||
58 | ||||
59 | /* | |||
60 | * Implementation of RFC 3779 section 2.2. | |||
61 | */ | |||
62 | ||||
63 | #include <limits.h> | |||
64 | #include <stdio.h> | |||
65 | #include <stdlib.h> | |||
66 | #include <string.h> | |||
67 | ||||
68 | #include <openssl/asn1.h> | |||
69 | #include <openssl/asn1t.h> | |||
70 | #include <openssl/buffer.h> | |||
71 | #include <openssl/conf.h> | |||
72 | #include <openssl/err.h> | |||
73 | #include <openssl/x509.h> | |||
74 | #include <openssl/x509v3.h> | |||
75 | ||||
76 | #include "bytestring.h" | |||
77 | #include "x509_lcl.h" | |||
78 | ||||
79 | #ifndef OPENSSL_NO_RFC3779 | |||
80 | ||||
81 | /* | |||
82 | * OpenSSL ASN.1 template translation of RFC 3779 2.2.3. | |||
83 | */ | |||
84 | ||||
85 | static const ASN1_TEMPLATE IPAddressRange_seq_tt[] = { | |||
86 | { | |||
87 | .flags = 0, | |||
88 | .tag = 0, | |||
89 | .offset = offsetof(IPAddressRange, min)__builtin_offsetof(IPAddressRange, min), | |||
90 | .field_name = "min", | |||
91 | .item = &ASN1_BIT_STRING_it, | |||
92 | }, | |||
93 | { | |||
94 | .flags = 0, | |||
95 | .tag = 0, | |||
96 | .offset = offsetof(IPAddressRange, max)__builtin_offsetof(IPAddressRange, max), | |||
97 | .field_name = "max", | |||
98 | .item = &ASN1_BIT_STRING_it, | |||
99 | }, | |||
100 | }; | |||
101 | ||||
102 | const ASN1_ITEM IPAddressRange_it = { | |||
103 | .itype = ASN1_ITYPE_SEQUENCE0x1, | |||
104 | .utype = V_ASN1_SEQUENCE16, | |||
105 | .templates = IPAddressRange_seq_tt, | |||
106 | .tcount = sizeof(IPAddressRange_seq_tt) / sizeof(ASN1_TEMPLATE), | |||
107 | .funcs = NULL((void*)0), | |||
108 | .size = sizeof(IPAddressRange), | |||
109 | .sname = "IPAddressRange", | |||
110 | }; | |||
111 | ||||
112 | static const ASN1_TEMPLATE IPAddressOrRange_ch_tt[] = { | |||
113 | { | |||
114 | .flags = 0, | |||
115 | .tag = 0, | |||
116 | .offset = offsetof(IPAddressOrRange, u.addressPrefix)__builtin_offsetof(IPAddressOrRange, u.addressPrefix), | |||
117 | .field_name = "u.addressPrefix", | |||
118 | .item = &ASN1_BIT_STRING_it, | |||
119 | }, | |||
120 | { | |||
121 | .flags = 0, | |||
122 | .tag = 0, | |||
123 | .offset = offsetof(IPAddressOrRange, u.addressRange)__builtin_offsetof(IPAddressOrRange, u.addressRange), | |||
124 | .field_name = "u.addressRange", | |||
125 | .item = &IPAddressRange_it, | |||
126 | }, | |||
127 | }; | |||
128 | ||||
129 | const ASN1_ITEM IPAddressOrRange_it = { | |||
130 | .itype = ASN1_ITYPE_CHOICE0x2, | |||
131 | .utype = offsetof(IPAddressOrRange, type)__builtin_offsetof(IPAddressOrRange, type), | |||
132 | .templates = IPAddressOrRange_ch_tt, | |||
133 | .tcount = sizeof(IPAddressOrRange_ch_tt) / sizeof(ASN1_TEMPLATE), | |||
134 | .funcs = NULL((void*)0), | |||
135 | .size = sizeof(IPAddressOrRange), | |||
136 | .sname = "IPAddressOrRange", | |||
137 | }; | |||
138 | ||||
139 | static const ASN1_TEMPLATE IPAddressChoice_ch_tt[] = { | |||
140 | { | |||
141 | .flags = 0, | |||
142 | .tag = 0, | |||
143 | .offset = offsetof(IPAddressChoice, u.inherit)__builtin_offsetof(IPAddressChoice, u.inherit), | |||
144 | .field_name = "u.inherit", | |||
145 | .item = &ASN1_NULL_it, | |||
146 | }, | |||
147 | { | |||
148 | .flags = ASN1_TFLG_SEQUENCE_OF(0x2 << 1), | |||
149 | .tag = 0, | |||
150 | .offset = offsetof(IPAddressChoice, u.addressesOrRanges)__builtin_offsetof(IPAddressChoice, u.addressesOrRanges), | |||
151 | .field_name = "u.addressesOrRanges", | |||
152 | .item = &IPAddressOrRange_it, | |||
153 | }, | |||
154 | }; | |||
155 | ||||
156 | const ASN1_ITEM IPAddressChoice_it = { | |||
157 | .itype = ASN1_ITYPE_CHOICE0x2, | |||
158 | .utype = offsetof(IPAddressChoice, type)__builtin_offsetof(IPAddressChoice, type), | |||
159 | .templates = IPAddressChoice_ch_tt, | |||
160 | .tcount = sizeof(IPAddressChoice_ch_tt) / sizeof(ASN1_TEMPLATE), | |||
161 | .funcs = NULL((void*)0), | |||
162 | .size = sizeof(IPAddressChoice), | |||
163 | .sname = "IPAddressChoice", | |||
164 | }; | |||
165 | ||||
166 | static const ASN1_TEMPLATE IPAddressFamily_seq_tt[] = { | |||
167 | { | |||
168 | .flags = 0, | |||
169 | .tag = 0, | |||
170 | .offset = offsetof(IPAddressFamily, addressFamily)__builtin_offsetof(IPAddressFamily, addressFamily), | |||
171 | .field_name = "addressFamily", | |||
172 | .item = &ASN1_OCTET_STRING_it, | |||
173 | }, | |||
174 | { | |||
175 | .flags = 0, | |||
176 | .tag = 0, | |||
177 | .offset = offsetof(IPAddressFamily, ipAddressChoice)__builtin_offsetof(IPAddressFamily, ipAddressChoice), | |||
178 | .field_name = "ipAddressChoice", | |||
179 | .item = &IPAddressChoice_it, | |||
180 | }, | |||
181 | }; | |||
182 | ||||
183 | const ASN1_ITEM IPAddressFamily_it = { | |||
184 | .itype = ASN1_ITYPE_SEQUENCE0x1, | |||
185 | .utype = V_ASN1_SEQUENCE16, | |||
186 | .templates = IPAddressFamily_seq_tt, | |||
187 | .tcount = sizeof(IPAddressFamily_seq_tt) / sizeof(ASN1_TEMPLATE), | |||
188 | .funcs = NULL((void*)0), | |||
189 | .size = sizeof(IPAddressFamily), | |||
190 | .sname = "IPAddressFamily", | |||
191 | }; | |||
192 | ||||
193 | static const ASN1_TEMPLATE IPAddrBlocks_item_tt = { | |||
194 | .flags = ASN1_TFLG_SEQUENCE_OF(0x2 << 1), | |||
195 | .tag = 0, | |||
196 | .offset = 0, | |||
197 | .field_name = "IPAddrBlocks", | |||
198 | .item = &IPAddressFamily_it, | |||
199 | }; | |||
200 | ||||
201 | static const ASN1_ITEM IPAddrBlocks_it = { | |||
202 | .itype = ASN1_ITYPE_PRIMITIVE0x0, | |||
203 | .utype = -1, | |||
204 | .templates = &IPAddrBlocks_item_tt, | |||
205 | .tcount = 0, | |||
206 | .funcs = NULL((void*)0), | |||
207 | .size = 0, | |||
208 | .sname = "IPAddrBlocks", | |||
209 | }; | |||
210 | ||||
211 | IPAddressRange * | |||
212 | d2i_IPAddressRange(IPAddressRange **a, const unsigned char **in, long len) | |||
213 | { | |||
214 | return (IPAddressRange *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
215 | &IPAddressRange_it); | |||
216 | } | |||
217 | ||||
218 | int | |||
219 | i2d_IPAddressRange(IPAddressRange *a, unsigned char **out) | |||
220 | { | |||
221 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressRange_it); | |||
222 | } | |||
223 | ||||
224 | IPAddressRange * | |||
225 | IPAddressRange_new(void) | |||
226 | { | |||
227 | return (IPAddressRange *)ASN1_item_new(&IPAddressRange_it); | |||
228 | } | |||
229 | ||||
230 | void | |||
231 | IPAddressRange_free(IPAddressRange *a) | |||
232 | { | |||
233 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressRange_it); | |||
234 | } | |||
235 | ||||
236 | IPAddressOrRange * | |||
237 | d2i_IPAddressOrRange(IPAddressOrRange **a, const unsigned char **in, long len) | |||
238 | { | |||
239 | return (IPAddressOrRange *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
240 | &IPAddressOrRange_it); | |||
241 | } | |||
242 | ||||
243 | int | |||
244 | i2d_IPAddressOrRange(IPAddressOrRange *a, unsigned char **out) | |||
245 | { | |||
246 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressOrRange_it); | |||
247 | } | |||
248 | ||||
249 | IPAddressOrRange * | |||
250 | IPAddressOrRange_new(void) | |||
251 | { | |||
252 | return (IPAddressOrRange *)ASN1_item_new(&IPAddressOrRange_it); | |||
253 | } | |||
254 | ||||
255 | void | |||
256 | IPAddressOrRange_free(IPAddressOrRange *a) | |||
257 | { | |||
258 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressOrRange_it); | |||
259 | } | |||
260 | ||||
261 | IPAddressChoice * | |||
262 | d2i_IPAddressChoice(IPAddressChoice **a, const unsigned char **in, long len) | |||
263 | { | |||
264 | return (IPAddressChoice *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
265 | &IPAddressChoice_it); | |||
266 | } | |||
267 | ||||
268 | int | |||
269 | i2d_IPAddressChoice(IPAddressChoice *a, unsigned char **out) | |||
270 | { | |||
271 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressChoice_it); | |||
272 | } | |||
273 | ||||
274 | IPAddressChoice * | |||
275 | IPAddressChoice_new(void) | |||
276 | { | |||
277 | return (IPAddressChoice *)ASN1_item_new(&IPAddressChoice_it); | |||
278 | } | |||
279 | ||||
280 | void | |||
281 | IPAddressChoice_free(IPAddressChoice *a) | |||
282 | { | |||
283 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressChoice_it); | |||
284 | } | |||
285 | ||||
286 | IPAddressFamily * | |||
287 | d2i_IPAddressFamily(IPAddressFamily **a, const unsigned char **in, long len) | |||
288 | { | |||
289 | return (IPAddressFamily *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
290 | &IPAddressFamily_it); | |||
291 | } | |||
292 | ||||
293 | int | |||
294 | i2d_IPAddressFamily(IPAddressFamily *a, unsigned char **out) | |||
295 | { | |||
296 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressFamily_it); | |||
297 | } | |||
298 | ||||
299 | IPAddressFamily * | |||
300 | IPAddressFamily_new(void) | |||
301 | { | |||
302 | return (IPAddressFamily *)ASN1_item_new(&IPAddressFamily_it); | |||
303 | } | |||
304 | ||||
305 | void | |||
306 | IPAddressFamily_free(IPAddressFamily *a) | |||
307 | { | |||
308 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressFamily_it); | |||
309 | } | |||
310 | ||||
311 | /* | |||
312 | * Convenience accessors for IPAddressFamily. | |||
313 | */ | |||
314 | ||||
315 | static int | |||
316 | IPAddressFamily_type(IPAddressFamily *af) | |||
317 | { | |||
318 | /* XXX - can af->ipAddressChoice == NULL actually happen? */ | |||
319 | if (af == NULL((void*)0) || af->ipAddressChoice == NULL((void*)0)) | |||
320 | return -1; | |||
321 | ||||
322 | switch (af->ipAddressChoice->type) { | |||
323 | case IPAddressChoice_inherit0: | |||
324 | case IPAddressChoice_addressesOrRanges1: | |||
325 | return af->ipAddressChoice->type; | |||
326 | default: | |||
327 | return -1; | |||
328 | } | |||
329 | } | |||
330 | ||||
331 | static IPAddressOrRanges * | |||
332 | IPAddressFamily_addressesOrRanges(IPAddressFamily *af) | |||
333 | { | |||
334 | if (IPAddressFamily_type(af) == IPAddressChoice_addressesOrRanges1) | |||
335 | return af->ipAddressChoice->u.addressesOrRanges; | |||
336 | ||||
337 | return NULL((void*)0); | |||
338 | } | |||
339 | ||||
340 | static ASN1_NULL * | |||
341 | IPAddressFamily_inheritance(IPAddressFamily *af) | |||
342 | { | |||
343 | if (IPAddressFamily_type(af) == IPAddressChoice_inherit0) | |||
344 | return af->ipAddressChoice->u.inherit; | |||
345 | ||||
346 | return NULL((void*)0); | |||
347 | } | |||
348 | ||||
349 | static int | |||
350 | IPAddressFamily_set_inheritance(IPAddressFamily *af) | |||
351 | { | |||
352 | if (IPAddressFamily_addressesOrRanges(af) != NULL((void*)0)) | |||
353 | return 0; | |||
354 | ||||
355 | if (IPAddressFamily_inheritance(af) != NULL((void*)0)) | |||
356 | return 1; | |||
357 | ||||
358 | if ((af->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL((void*)0)) | |||
359 | return 0; | |||
360 | af->ipAddressChoice->type = IPAddressChoice_inherit0; | |||
361 | ||||
362 | return 1; | |||
363 | } | |||
364 | ||||
365 | /* | |||
366 | * How much buffer space do we need for a raw address? | |||
367 | */ | |||
368 | #define ADDR_RAW_BUF_LEN16 16 | |||
369 | ||||
370 | /* | |||
371 | * What's the address length associated with this AFI? | |||
372 | */ | |||
373 | static int | |||
374 | length_from_afi(const unsigned afi) | |||
375 | { | |||
376 | switch (afi) { | |||
377 | case IANA_AFI_IPV41: | |||
378 | return 4; | |||
379 | case IANA_AFI_IPV62: | |||
380 | return 16; | |||
381 | default: | |||
382 | return 0; | |||
383 | } | |||
384 | } | |||
385 | ||||
386 | /* | |||
387 | * Get AFI and optional SAFI from an IPAddressFamily. All three out arguments | |||
388 | * are optional; if |out_safi| is non-NULL, |safi_is_set| must be non-NULL. | |||
389 | */ | |||
390 | static int | |||
391 | IPAddressFamily_afi_safi(const IPAddressFamily *af, uint16_t *out_afi, | |||
392 | uint8_t *out_safi, int *safi_is_set) | |||
393 | { | |||
394 | CBS cbs; | |||
395 | uint16_t afi; | |||
396 | uint8_t safi = 0; | |||
397 | int got_safi = 0; | |||
398 | ||||
399 | CBS_init(&cbs, af->addressFamily->data, af->addressFamily->length); | |||
400 | ||||
401 | if (!CBS_get_u16(&cbs, &afi)) | |||
402 | return 0; | |||
403 | ||||
404 | /* Fetch the optional SAFI. */ | |||
405 | if (CBS_len(&cbs) != 0) { | |||
406 | if (!CBS_get_u8(&cbs, &safi)) | |||
407 | return 0; | |||
408 | got_safi = 1; | |||
409 | } | |||
410 | ||||
411 | /* If there's anything left, it's garbage. */ | |||
412 | if (CBS_len(&cbs) != 0) | |||
413 | return 0; | |||
414 | ||||
415 | /* XXX - error on reserved AFI/SAFI? */ | |||
416 | ||||
417 | if (out_afi != NULL((void*)0)) | |||
418 | *out_afi = afi; | |||
419 | ||||
420 | if (out_safi != NULL((void*)0)) { | |||
421 | *out_safi = safi; | |||
422 | *safi_is_set = got_safi; | |||
423 | } | |||
424 | ||||
425 | return 1; | |||
426 | } | |||
427 | ||||
428 | static int | |||
429 | IPAddressFamily_afi(const IPAddressFamily *af, uint16_t *out_afi) | |||
430 | { | |||
431 | return IPAddressFamily_afi_safi(af, out_afi, NULL((void*)0), NULL((void*)0)); | |||
432 | } | |||
433 | ||||
434 | static int | |||
435 | IPAddressFamily_afi_is_valid(const IPAddressFamily *af) | |||
436 | { | |||
437 | return IPAddressFamily_afi_safi(af, NULL((void*)0), NULL((void*)0), NULL((void*)0)); | |||
438 | } | |||
439 | ||||
440 | static int | |||
441 | IPAddressFamily_afi_length(const IPAddressFamily *af, int *out_length) | |||
442 | { | |||
443 | uint16_t afi; | |||
444 | ||||
445 | *out_length = 0; | |||
446 | ||||
447 | if (!IPAddressFamily_afi(af, &afi)) | |||
448 | return 0; | |||
449 | ||||
450 | *out_length = length_from_afi(afi); | |||
451 | ||||
452 | return 1; | |||
453 | } | |||
454 | ||||
455 | #define MINIMUM(a, b)(((a) < (b)) ? (a) : (b)) (((a) < (b)) ? (a) : (b)) | |||
456 | ||||
457 | /* | |||
458 | * Sort comparison function for a sequence of IPAddressFamily. | |||
459 | * | |||
460 | * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about | |||
461 | * the ordering: I can read it as meaning that IPv6 without a SAFI | |||
462 | * comes before IPv4 with a SAFI, which seems pretty weird. The | |||
463 | * examples in appendix B suggest that the author intended the | |||
464 | * null-SAFI rule to apply only within a single AFI, which is what I | |||
465 | * would have expected and is what the following code implements. | |||
466 | */ | |||
467 | static int | |||
468 | IPAddressFamily_cmp(const IPAddressFamily *const *a_, | |||
469 | const IPAddressFamily *const *b_) | |||
470 | { | |||
471 | const ASN1_OCTET_STRING *a = (*a_)->addressFamily; | |||
472 | const ASN1_OCTET_STRING *b = (*b_)->addressFamily; | |||
473 | int len, cmp; | |||
474 | ||||
475 | len = MINIMUM(a->length, b->length)(((a->length) < (b->length)) ? (a->length) : (b-> length)); | |||
476 | ||||
477 | if ((cmp = memcmp(a->data, b->data, len)) != 0) | |||
478 | return cmp; | |||
479 | ||||
480 | return a->length - b->length; | |||
481 | } | |||
482 | ||||
483 | static IPAddressFamily * | |||
484 | IPAddressFamily_find_in_parent(IPAddrBlocks *parent, IPAddressFamily *child_af) | |||
485 | { | |||
486 | int index; | |||
487 | ||||
488 | sk_IPAddressFamily_set_cmp_func(parent, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
489 | ||||
490 | if ((index = sk_IPAddressFamily_find(parent, child_af)sk_find(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily *)0)), ((void*) (1 ? (child_af) : (IPAddressFamily*)0)))) < 0) | |||
491 | return NULL((void*)0); | |||
492 | ||||
493 | return sk_IPAddressFamily_value(parent, index)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), (index))); | |||
494 | } | |||
495 | ||||
496 | /* | |||
497 | * Extract the AFI from an IPAddressFamily. | |||
498 | * | |||
499 | * This is public API. It uses the reserved AFI 0 as an in-band error | |||
500 | * while it doesn't care about the reserved AFI 65535... | |||
501 | */ | |||
502 | unsigned int | |||
503 | X509v3_addr_get_afi(const IPAddressFamily *af) | |||
504 | { | |||
505 | uint16_t afi; | |||
506 | ||||
507 | /* | |||
508 | * XXX are these NULL checks really sensible? If af is non-NULL, it | |||
509 | * should have both addressFamily and ipAddressChoice... | |||
510 | */ | |||
511 | if (af == NULL((void*)0) || af->addressFamily == NULL((void*)0) || | |||
512 | af->addressFamily->data == NULL((void*)0)) | |||
513 | return 0; | |||
514 | ||||
515 | if (!IPAddressFamily_afi(af, &afi)) | |||
516 | return 0; | |||
517 | ||||
518 | return afi; | |||
519 | } | |||
520 | ||||
521 | /* | |||
522 | * Expand the bitstring form (RFC 3779, section 2.1.2) of an address into | |||
523 | * a raw byte array. At the moment this is coded for simplicity, not speed. | |||
524 | * | |||
525 | * Unused bits in the last octet of |bs| and all bits in subsequent bytes | |||
526 | * of |addr| are set to 0 or 1 depending on whether |fill| is 0 or not. | |||
527 | */ | |||
528 | static int | |||
529 | addr_expand(unsigned char *addr, const ASN1_BIT_STRING *bs, const int length, | |||
530 | uint8_t fill) | |||
531 | { | |||
532 | if (bs->length < 0 || bs->length > length) | |||
533 | return 0; | |||
534 | ||||
535 | if (fill != 0) | |||
536 | fill = 0xff; | |||
537 | ||||
538 | if (bs->length > 0) { | |||
539 | /* XXX - shouldn't this check ASN1_STRING_FLAG_BITS_LEFT? */ | |||
540 | uint8_t unused_bits = bs->flags & 7; | |||
541 | uint8_t mask = (1 << unused_bits) - 1; | |||
542 | ||||
543 | memcpy(addr, bs->data, bs->length); | |||
544 | ||||
545 | if (fill == 0) | |||
546 | addr[bs->length - 1] &= ~mask; | |||
547 | else | |||
548 | addr[bs->length - 1] |= mask; | |||
549 | } | |||
550 | ||||
551 | memset(addr + bs->length, fill, length - bs->length); | |||
552 | ||||
553 | return 1; | |||
554 | } | |||
555 | ||||
556 | /* | |||
557 | * Extract the prefix length from a bitstring: 8 * length - unused bits. | |||
558 | */ | |||
559 | #define addr_prefix_len(bs)((int) ((bs)->length * 8 - ((bs)->flags & 7))) ((int) ((bs)->length * 8 - ((bs)->flags & 7))) | |||
560 | ||||
561 | /* | |||
562 | * i2r handler for one address bitstring. | |||
563 | */ | |||
564 | static int | |||
565 | i2r_address(BIO *out, const unsigned afi, const unsigned char fill, | |||
566 | const ASN1_BIT_STRING *bs) | |||
567 | { | |||
568 | unsigned char addr[ADDR_RAW_BUF_LEN16]; | |||
569 | int i, n; | |||
570 | ||||
571 | if (bs->length < 0) | |||
572 | return 0; | |||
573 | switch (afi) { | |||
574 | case IANA_AFI_IPV41: | |||
575 | if (!addr_expand(addr, bs, 4, fill)) | |||
576 | return 0; | |||
577 | BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], | |||
578 | addr[3]); | |||
579 | break; | |||
580 | case IANA_AFI_IPV62: | |||
581 | if (!addr_expand(addr, bs, 16, fill)) | |||
582 | return 0; | |||
583 | for (n = 16; | |||
584 | n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00; n -= 2) | |||
585 | continue; | |||
586 | for (i = 0; i < n; i += 2) | |||
587 | BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i + 1], | |||
588 | (i < 14 ? ":" : "")); | |||
589 | if (i < 16) | |||
590 | BIO_puts(out, ":"); | |||
591 | if (i == 0) | |||
592 | BIO_puts(out, ":"); | |||
593 | break; | |||
594 | default: | |||
595 | for (i = 0; i < bs->length; i++) | |||
596 | BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), | |||
597 | bs->data[i]); | |||
598 | BIO_printf(out, "[%d]", (int)(bs->flags & 7)); | |||
599 | break; | |||
600 | } | |||
601 | return 1; | |||
602 | } | |||
603 | ||||
604 | /* | |||
605 | * i2r handler for a sequence of addresses and ranges. | |||
606 | */ | |||
607 | static int | |||
608 | i2r_IPAddressOrRanges(BIO *out, const int indent, | |||
609 | const IPAddressOrRanges *aors, const unsigned afi) | |||
610 | { | |||
611 | const IPAddressOrRange *aor; | |||
612 | const ASN1_BIT_STRING *prefix; | |||
613 | const IPAddressRange *range; | |||
614 | int i; | |||
615 | ||||
616 | for (i = 0; i < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))); i++) { | |||
617 | aor = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
618 | ||||
619 | BIO_printf(out, "%*s", indent, ""); | |||
620 | ||||
621 | switch (aor->type) { | |||
622 | case IPAddressOrRange_addressPrefix0: | |||
623 | prefix = aor->u.addressPrefix; | |||
624 | ||||
625 | if (!i2r_address(out, afi, 0x00, prefix)) | |||
626 | return 0; | |||
627 | BIO_printf(out, "/%d\n", addr_prefix_len(prefix)((int) ((prefix)->length * 8 - ((prefix)->flags & 7 )))); | |||
628 | continue; | |||
629 | case IPAddressOrRange_addressRange1: | |||
630 | range = aor->u.addressRange; | |||
631 | ||||
632 | if (!i2r_address(out, afi, 0x00, range->min)) | |||
633 | return 0; | |||
634 | BIO_puts(out, "-"); | |||
635 | if (!i2r_address(out, afi, 0xff, range->max)) | |||
636 | return 0; | |||
637 | BIO_puts(out, "\n"); | |||
638 | continue; | |||
639 | } | |||
640 | } | |||
641 | ||||
642 | return 1; | |||
643 | } | |||
644 | ||||
645 | /* | |||
646 | * i2r handler for an IPAddrBlocks extension. | |||
647 | */ | |||
648 | static int | |||
649 | i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, void *ext, BIO *out, | |||
650 | int indent) | |||
651 | { | |||
652 | const IPAddrBlocks *addr = ext; | |||
653 | IPAddressFamily *af; | |||
654 | uint16_t afi; | |||
655 | uint8_t safi; | |||
656 | int i, safi_is_set; | |||
657 | ||||
658 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
659 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
660 | ||||
661 | if (!IPAddressFamily_afi_safi(af, &afi, &safi, &safi_is_set)) | |||
662 | goto print_addresses; | |||
663 | ||||
664 | switch (afi) { | |||
665 | case IANA_AFI_IPV41: | |||
666 | BIO_printf(out, "%*sIPv4", indent, ""); | |||
667 | break; | |||
668 | case IANA_AFI_IPV62: | |||
669 | BIO_printf(out, "%*sIPv6", indent, ""); | |||
670 | break; | |||
671 | default: | |||
672 | BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi); | |||
673 | break; | |||
674 | } | |||
675 | if (safi_is_set) { | |||
676 | switch (safi) { | |||
677 | case 1: | |||
678 | BIO_puts(out, " (Unicast)"); | |||
679 | break; | |||
680 | case 2: | |||
681 | BIO_puts(out, " (Multicast)"); | |||
682 | break; | |||
683 | case 3: | |||
684 | BIO_puts(out, " (Unicast/Multicast)"); | |||
685 | break; | |||
686 | case 4: | |||
687 | BIO_puts(out, " (MPLS)"); | |||
688 | break; | |||
689 | case 64: | |||
690 | BIO_puts(out, " (Tunnel)"); | |||
691 | break; | |||
692 | case 65: | |||
693 | BIO_puts(out, " (VPLS)"); | |||
694 | break; | |||
695 | case 66: | |||
696 | BIO_puts(out, " (BGP MDT)"); | |||
697 | break; | |||
698 | case 128: | |||
699 | BIO_puts(out, " (MPLS-labeled VPN)"); | |||
700 | break; | |||
701 | default: | |||
702 | BIO_printf(out, " (Unknown SAFI %u)", safi); | |||
703 | break; | |||
704 | } | |||
705 | } | |||
706 | ||||
707 | print_addresses: | |||
708 | switch (IPAddressFamily_type(af)) { | |||
709 | case IPAddressChoice_inherit0: | |||
710 | BIO_puts(out, ": inherit\n"); | |||
711 | break; | |||
712 | case IPAddressChoice_addressesOrRanges1: | |||
713 | BIO_puts(out, ":\n"); | |||
714 | if (!i2r_IPAddressOrRanges(out, indent + 2, | |||
715 | IPAddressFamily_addressesOrRanges(af), afi)) | |||
716 | return 0; | |||
717 | break; | |||
718 | /* XXX - how should we handle -1 here? */ | |||
719 | } | |||
720 | } | |||
721 | return 1; | |||
722 | } | |||
723 | ||||
724 | /* | |||
725 | * Sort comparison function for a sequence of IPAddressOrRange | |||
726 | * elements. | |||
727 | * | |||
728 | * There's no sane answer we can give if addr_expand() fails, and an | |||
729 | * assertion failure on externally supplied data is seriously uncool, | |||
730 | * so we just arbitrarily declare that if given invalid inputs this | |||
731 | * function returns -1. If this messes up your preferred sort order | |||
732 | * for garbage input, tough noogies. | |||
733 | */ | |||
734 | static int | |||
735 | IPAddressOrRange_cmp(const IPAddressOrRange *a, const IPAddressOrRange *b, | |||
736 | const int length) | |||
737 | { | |||
738 | unsigned char addr_a[ADDR_RAW_BUF_LEN16], addr_b[ADDR_RAW_BUF_LEN16]; | |||
739 | int prefix_len_a = 0, prefix_len_b = 0; | |||
740 | int r; | |||
741 | ||||
742 | switch (a->type) { | |||
743 | case IPAddressOrRange_addressPrefix0: | |||
744 | if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00)) | |||
745 | return -1; | |||
746 | prefix_len_a = addr_prefix_len(a->u.addressPrefix)((int) ((a->u.addressPrefix)->length * 8 - ((a->u.addressPrefix )->flags & 7))); | |||
747 | break; | |||
748 | case IPAddressOrRange_addressRange1: | |||
749 | if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00)) | |||
750 | return -1; | |||
751 | prefix_len_a = length * 8; | |||
752 | break; | |||
753 | } | |||
754 | ||||
755 | switch (b->type) { | |||
756 | case IPAddressOrRange_addressPrefix0: | |||
757 | if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00)) | |||
758 | return -1; | |||
759 | prefix_len_b = addr_prefix_len(b->u.addressPrefix)((int) ((b->u.addressPrefix)->length * 8 - ((b->u.addressPrefix )->flags & 7))); | |||
760 | break; | |||
761 | case IPAddressOrRange_addressRange1: | |||
762 | if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00)) | |||
763 | return -1; | |||
764 | prefix_len_b = length * 8; | |||
765 | break; | |||
766 | } | |||
767 | ||||
768 | if ((r = memcmp(addr_a, addr_b, length)) != 0) | |||
769 | return r; | |||
770 | else | |||
771 | return prefix_len_a - prefix_len_b; | |||
772 | } | |||
773 | ||||
774 | /* | |||
775 | * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort() | |||
776 | * comparison routines are only allowed two arguments. | |||
777 | */ | |||
778 | static int | |||
779 | v4IPAddressOrRange_cmp(const IPAddressOrRange *const *a, | |||
780 | const IPAddressOrRange *const *b) | |||
781 | { | |||
782 | return IPAddressOrRange_cmp(*a, *b, 4); | |||
783 | } | |||
784 | ||||
785 | /* | |||
786 | * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort() | |||
787 | * comparison routines are only allowed two arguments. | |||
788 | */ | |||
789 | static int | |||
790 | v6IPAddressOrRange_cmp(const IPAddressOrRange *const *a, | |||
791 | const IPAddressOrRange *const *b) | |||
792 | { | |||
793 | return IPAddressOrRange_cmp(*a, *b, 16); | |||
794 | } | |||
795 | ||||
796 | /* | |||
797 | * Calculate whether a range collapses to a prefix. | |||
798 | * See last paragraph of RFC 3779 2.2.3.7. | |||
799 | * | |||
800 | * It's the caller's responsibility to ensure that min <= max. | |||
801 | */ | |||
802 | static int | |||
803 | range_should_be_prefix(const unsigned char *min, const unsigned char *max, | |||
804 | const int length) | |||
805 | { | |||
806 | unsigned char mask; | |||
807 | int i, j; | |||
808 | ||||
809 | for (i = 0; i < length && min[i] == max[i]; i++) | |||
810 | continue; | |||
811 | for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xff; j--) | |||
812 | continue; | |||
813 | if (i < j) | |||
814 | return -1; | |||
815 | if (i > j) | |||
816 | return i * 8; | |||
817 | mask = min[i] ^ max[i]; | |||
818 | switch (mask) { | |||
819 | case 0x01: | |||
820 | j = 7; | |||
821 | break; | |||
822 | case 0x03: | |||
823 | j = 6; | |||
824 | break; | |||
825 | case 0x07: | |||
826 | j = 5; | |||
827 | break; | |||
828 | case 0x0f: | |||
829 | j = 4; | |||
830 | break; | |||
831 | case 0x1f: | |||
832 | j = 3; | |||
833 | break; | |||
834 | case 0x3f: | |||
835 | j = 2; | |||
836 | break; | |||
837 | case 0x7f: | |||
838 | j = 1; | |||
839 | break; | |||
840 | default: | |||
841 | return -1; | |||
842 | } | |||
843 | if ((min[i] & mask) != 0 || (max[i] & mask) != mask) | |||
844 | return -1; | |||
845 | else | |||
846 | return i * 8 + j; | |||
847 | } | |||
848 | ||||
849 | /* | |||
850 | * Construct a prefix. | |||
851 | */ | |||
852 | static int | |||
853 | make_addressPrefix(IPAddressOrRange **result, unsigned char *addr, | |||
854 | unsigned int afi, int prefix_len) | |||
855 | { | |||
856 | IPAddressOrRange *aor; | |||
857 | int afi_len, byte_len, bit_len, max_len; | |||
858 | ||||
859 | if (prefix_len < 0) | |||
860 | return 0; | |||
861 | ||||
862 | max_len = 16; | |||
863 | if ((afi_len = length_from_afi(afi)) > 0) | |||
864 | max_len = afi_len; | |||
865 | if (prefix_len > 8 * max_len) | |||
866 | return 0; | |||
867 | ||||
868 | byte_len = (prefix_len + 7) / 8; | |||
869 | bit_len = prefix_len % 8; | |||
870 | ||||
871 | if ((aor = IPAddressOrRange_new()) == NULL((void*)0)) | |||
872 | return 0; | |||
873 | aor->type = IPAddressOrRange_addressPrefix0; | |||
874 | if ((aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL((void*)0)) | |||
875 | goto err; | |||
876 | ||||
877 | if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, byte_len)) | |||
878 | goto err; | |||
879 | ||||
880 | aor->u.addressPrefix->flags &= ~7; | |||
881 | aor->u.addressPrefix->flags |= ASN1_STRING_FLAG_BITS_LEFT0x08; | |||
882 | if (bit_len > 0) { | |||
883 | aor->u.addressPrefix->data[byte_len - 1] &= ~(0xff >> bit_len); | |||
884 | aor->u.addressPrefix->flags |= 8 - bit_len; | |||
885 | } | |||
886 | ||||
887 | *result = aor; | |||
888 | return 1; | |||
889 | ||||
890 | err: | |||
891 | IPAddressOrRange_free(aor); | |||
892 | return 0; | |||
893 | } | |||
894 | ||||
895 | /* | |||
896 | * Construct a range. If it can be expressed as a prefix, | |||
897 | * return a prefix instead. Doing this here simplifies | |||
898 | * the rest of the code considerably. | |||
899 | */ | |||
900 | static int | |||
901 | make_addressRange(IPAddressOrRange **result, unsigned char *min, | |||
902 | unsigned char *max, unsigned int afi, int length) | |||
903 | { | |||
904 | IPAddressOrRange *aor; | |||
905 | int i, prefix_len; | |||
906 | ||||
907 | if (memcmp(min, max, length) > 0) | |||
908 | return 0; | |||
909 | ||||
910 | if ((prefix_len = range_should_be_prefix(min, max, length)) >= 0) | |||
911 | return make_addressPrefix(result, min, afi, prefix_len); | |||
912 | ||||
913 | if ((aor = IPAddressOrRange_new()) == NULL((void*)0)) | |||
914 | return 0; | |||
915 | aor->type = IPAddressOrRange_addressRange1; | |||
916 | if ((aor->u.addressRange = IPAddressRange_new()) == NULL((void*)0)) | |||
917 | goto err; | |||
918 | ||||
919 | for (i = length; i > 0 && min[i - 1] == 0x00; --i) | |||
920 | continue; | |||
921 | if (!ASN1_BIT_STRING_set(aor->u.addressRange->min, min, i)) | |||
922 | goto err; | |||
923 | aor->u.addressRange->min->flags &= ~7; | |||
924 | aor->u.addressRange->min->flags |= ASN1_STRING_FLAG_BITS_LEFT0x08; | |||
925 | if (i > 0) { | |||
926 | unsigned char b = min[i - 1]; | |||
927 | int j = 1; | |||
928 | while ((b & (0xffU >> j)) != 0) | |||
929 | ++j; | |||
930 | aor->u.addressRange->min->flags |= 8 - j; | |||
931 | } | |||
932 | ||||
933 | for (i = length; i > 0 && max[i - 1] == 0xff; --i) | |||
934 | continue; | |||
935 | if (!ASN1_BIT_STRING_set(aor->u.addressRange->max, max, i)) | |||
936 | goto err; | |||
937 | aor->u.addressRange->max->flags &= ~7; | |||
938 | aor->u.addressRange->max->flags |= ASN1_STRING_FLAG_BITS_LEFT0x08; | |||
939 | if (i > 0) { | |||
940 | unsigned char b = max[i - 1]; | |||
941 | int j = 1; | |||
942 | while ((b & (0xffU >> j)) != (0xffU >> j)) | |||
943 | ++j; | |||
944 | aor->u.addressRange->max->flags |= 8 - j; | |||
945 | } | |||
946 | ||||
947 | *result = aor; | |||
948 | return 1; | |||
949 | ||||
950 | err: | |||
951 | IPAddressOrRange_free(aor); | |||
952 | return 0; | |||
953 | } | |||
954 | ||||
955 | /* | |||
956 | * Construct a new address family or find an existing one. | |||
957 | */ | |||
958 | static IPAddressFamily * | |||
959 | make_IPAddressFamily(IPAddrBlocks *addr, const unsigned afi, | |||
960 | const unsigned *safi) | |||
961 | { | |||
962 | IPAddressFamily *af = NULL((void*)0); | |||
963 | CBB cbb; | |||
964 | CBS cbs; | |||
965 | uint8_t *key = NULL((void*)0); | |||
966 | size_t keylen; | |||
967 | int i; | |||
968 | ||||
969 | if (!CBB_init(&cbb, 0)) | |||
970 | goto err; | |||
971 | ||||
972 | /* XXX - should afi <= 65535 and *safi <= 255 be checked here? */ | |||
973 | ||||
974 | if (!CBB_add_u16(&cbb, afi)) | |||
975 | goto err; | |||
976 | if (safi != NULL((void*)0)) { | |||
977 | if (!CBB_add_u8(&cbb, *safi)) | |||
978 | goto err; | |||
979 | } | |||
980 | ||||
981 | if (!CBB_finish(&cbb, &key, &keylen)) | |||
982 | goto err; | |||
983 | ||||
984 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
985 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
986 | ||||
987 | CBS_init(&cbs, af->addressFamily->data, | |||
988 | af->addressFamily->length); | |||
989 | if (CBS_mem_equal(&cbs, key, keylen)) | |||
990 | goto done; | |||
991 | } | |||
992 | ||||
993 | if ((af = IPAddressFamily_new()) == NULL((void*)0)) | |||
994 | goto err; | |||
995 | if (!ASN1_OCTET_STRING_set(af->addressFamily, key, keylen)) | |||
996 | goto err; | |||
997 | if (!sk_IPAddressFamily_push(addr, af)sk_push(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0)), ((void*) (1 ? (af) : (IPAddressFamily*)0)))) | |||
998 | goto err; | |||
999 | ||||
1000 | done: | |||
1001 | free(key); | |||
1002 | ||||
1003 | return af; | |||
1004 | ||||
1005 | err: | |||
1006 | CBB_cleanup(&cbb); | |||
1007 | free(key); | |||
1008 | IPAddressFamily_free(af); | |||
1009 | ||||
1010 | return NULL((void*)0); | |||
1011 | } | |||
1012 | ||||
1013 | /* | |||
1014 | * Add an inheritance element. | |||
1015 | */ | |||
1016 | int | |||
1017 | X509v3_addr_add_inherit(IPAddrBlocks *addr, const unsigned afi, | |||
1018 | const unsigned *safi) | |||
1019 | { | |||
1020 | IPAddressFamily *af; | |||
1021 | ||||
1022 | if ((af = make_IPAddressFamily(addr, afi, safi)) == NULL((void*)0)) | |||
1023 | return 0; | |||
1024 | ||||
1025 | return IPAddressFamily_set_inheritance(af); | |||
1026 | } | |||
1027 | ||||
1028 | /* | |||
1029 | * Construct an IPAddressOrRange sequence, or return an existing one. | |||
1030 | */ | |||
1031 | static IPAddressOrRanges * | |||
1032 | make_prefix_or_range(IPAddrBlocks *addr, const unsigned afi, | |||
1033 | const unsigned *safi) | |||
1034 | { | |||
1035 | IPAddressFamily *af; | |||
1036 | IPAddressOrRanges *aors = NULL((void*)0); | |||
1037 | ||||
1038 | if ((af = make_IPAddressFamily(addr, afi, safi)) == NULL((void*)0)) | |||
1039 | return NULL((void*)0); | |||
1040 | ||||
1041 | if (IPAddressFamily_inheritance(af) != NULL((void*)0)) | |||
1042 | return NULL((void*)0); | |||
1043 | ||||
1044 | if ((aors = IPAddressFamily_addressesOrRanges(af)) != NULL((void*)0)) | |||
1045 | return aors; | |||
1046 | ||||
1047 | if ((aors = sk_IPAddressOrRange_new_null()((struct stack_st_IPAddressOrRange *)sk_new_null())) == NULL((void*)0)) | |||
1048 | return NULL((void*)0); | |||
1049 | ||||
1050 | switch (afi) { | |||
1051 | case IANA_AFI_IPV41: | |||
1052 | sk_IPAddressOrRange_set_cmp_func(aors, v4IPAddressOrRange_cmp)((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v4IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))); | |||
1053 | break; | |||
1054 | case IANA_AFI_IPV62: | |||
1055 | sk_IPAddressOrRange_set_cmp_func(aors, v6IPAddressOrRange_cmp)((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v6IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))); | |||
1056 | break; | |||
1057 | } | |||
1058 | ||||
1059 | af->ipAddressChoice->type = IPAddressChoice_addressesOrRanges1; | |||
1060 | af->ipAddressChoice->u.addressesOrRanges = aors; | |||
1061 | ||||
1062 | return aors; | |||
1063 | } | |||
1064 | ||||
1065 | /* | |||
1066 | * Add a prefix. | |||
1067 | */ | |||
1068 | int | |||
1069 | X509v3_addr_add_prefix(IPAddrBlocks *addr, const unsigned afi, | |||
1070 | const unsigned *safi, unsigned char *a, const int prefix_len) | |||
1071 | { | |||
1072 | IPAddressOrRanges *aors; | |||
1073 | IPAddressOrRange *aor; | |||
1074 | ||||
1075 | if ((aors = make_prefix_or_range(addr, afi, safi)) == NULL((void*)0)) | |||
1076 | return 0; | |||
1077 | ||||
1078 | if (!make_addressPrefix(&aor, a, afi, prefix_len)) | |||
1079 | return 0; | |||
1080 | ||||
1081 | if (sk_IPAddressOrRange_push(aors, aor)sk_push(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), ((void*) (1 ? (aor) : (IPAddressOrRange*)0))) <= 0) { | |||
1082 | IPAddressOrRange_free(aor); | |||
1083 | return 0; | |||
1084 | } | |||
1085 | ||||
1086 | return 1; | |||
1087 | } | |||
1088 | ||||
1089 | /* | |||
1090 | * Add a range. | |||
1091 | */ | |||
1092 | int | |||
1093 | X509v3_addr_add_range(IPAddrBlocks *addr, const unsigned afi, | |||
1094 | const unsigned *safi, unsigned char *min, unsigned char *max) | |||
1095 | { | |||
1096 | IPAddressOrRanges *aors; | |||
1097 | IPAddressOrRange *aor; | |||
1098 | int length; | |||
1099 | ||||
1100 | if ((aors = make_prefix_or_range(addr, afi, safi)) == NULL((void*)0)) | |||
1101 | return 0; | |||
1102 | ||||
1103 | length = length_from_afi(afi); | |||
1104 | ||||
1105 | if (!make_addressRange(&aor, min, max, afi, length)) | |||
1106 | return 0; | |||
1107 | ||||
1108 | if (sk_IPAddressOrRange_push(aors, aor)sk_push(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), ((void*) (1 ? (aor) : (IPAddressOrRange*)0))) <= 0) { | |||
1109 | IPAddressOrRange_free(aor); | |||
1110 | return 0; | |||
1111 | } | |||
1112 | ||||
1113 | return 1; | |||
1114 | } | |||
1115 | ||||
1116 | static int | |||
1117 | extract_min_max_bitstr(IPAddressOrRange *aor, ASN1_BIT_STRING **out_min, | |||
1118 | ASN1_BIT_STRING **out_max) | |||
1119 | { | |||
1120 | switch (aor->type) { | |||
1121 | case IPAddressOrRange_addressPrefix0: | |||
1122 | *out_min = *out_max = aor->u.addressPrefix; | |||
1123 | return 1; | |||
1124 | case IPAddressOrRange_addressRange1: | |||
1125 | *out_min = aor->u.addressRange->min; | |||
1126 | *out_max = aor->u.addressRange->max; | |||
1127 | return 1; | |||
1128 | default: | |||
1129 | return 0; | |||
1130 | } | |||
1131 | } | |||
1132 | ||||
1133 | /* | |||
1134 | * Extract min and max values from an IPAddressOrRange. | |||
1135 | */ | |||
1136 | static int | |||
1137 | extract_min_max(IPAddressOrRange *aor, unsigned char *min, unsigned char *max, | |||
1138 | int length) | |||
1139 | { | |||
1140 | ASN1_BIT_STRING *min_bitstr, *max_bitstr; | |||
1141 | ||||
1142 | if (aor == NULL((void*)0) || min == NULL((void*)0) || max == NULL((void*)0)) | |||
1143 | return 0; | |||
1144 | ||||
1145 | if (!extract_min_max_bitstr(aor, &min_bitstr, &max_bitstr)) | |||
1146 | return 0; | |||
1147 | ||||
1148 | if (!addr_expand(min, min_bitstr, length, 0)) | |||
1149 | return 0; | |||
1150 | ||||
1151 | return addr_expand(max, max_bitstr, length, 1); | |||
1152 | } | |||
1153 | ||||
1154 | /* | |||
1155 | * Public wrapper for extract_min_max(). | |||
1156 | */ | |||
1157 | int | |||
1158 | X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi, | |||
1159 | unsigned char *min, unsigned char *max, const int length) | |||
1160 | { | |||
1161 | int afi_len; | |||
1162 | ||||
1163 | if ((afi_len = length_from_afi(afi)) == 0) | |||
1164 | return 0; | |||
1165 | ||||
1166 | if (length < afi_len) | |||
1167 | return 0; | |||
1168 | ||||
1169 | if (!extract_min_max(aor, min, max, afi_len)) | |||
1170 | return 0; | |||
1171 | ||||
1172 | return afi_len; | |||
1173 | } | |||
1174 | ||||
1175 | /* | |||
1176 | * Check whether an IPAddrBLocks is in canonical form. | |||
1177 | */ | |||
1178 | int | |||
1179 | X509v3_addr_is_canonical(IPAddrBlocks *addr) | |||
1180 | { | |||
1181 | unsigned char a_min[ADDR_RAW_BUF_LEN16], a_max[ADDR_RAW_BUF_LEN16]; | |||
1182 | unsigned char b_min[ADDR_RAW_BUF_LEN16], b_max[ADDR_RAW_BUF_LEN16]; | |||
1183 | IPAddressFamily *af; | |||
1184 | IPAddressOrRanges *aors; | |||
1185 | IPAddressOrRange *aor, *aor_a, *aor_b; | |||
1186 | int i, j, k, length; | |||
1187 | ||||
1188 | /* | |||
1189 | * Empty extension is canonical. | |||
1190 | */ | |||
1191 | if (addr
| |||
1192 | return 1; | |||
1193 | ||||
1194 | /* | |||
1195 | * Check whether the top-level list is in order. | |||
1196 | */ | |||
1197 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))) - 1; i++) { | |||
1198 | const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1199 | const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i + 1))); | |||
1200 | ||||
1201 | /* Check that both have valid AFIs before comparing them. */ | |||
1202 | if (!IPAddressFamily_afi_is_valid(a)) | |||
1203 | return 0; | |||
1204 | if (!IPAddressFamily_afi_is_valid(b)) | |||
1205 | return 0; | |||
1206 | ||||
1207 | if (IPAddressFamily_cmp(&a, &b) >= 0) | |||
1208 | return 0; | |||
1209 | } | |||
1210 | ||||
1211 | /* | |||
1212 | * Top level's ok, now check each address family. | |||
1213 | */ | |||
1214 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1215 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1216 | ||||
1217 | if (!IPAddressFamily_afi_length(af, &length)) | |||
1218 | return 0; | |||
1219 | ||||
1220 | /* | |||
1221 | * If this family has an inheritance element, it is canonical. | |||
1222 | */ | |||
1223 | if (IPAddressFamily_inheritance(af) != NULL((void*)0)) | |||
1224 | continue; | |||
1225 | ||||
1226 | /* | |||
1227 | * If this family has neither an inheritance element nor an | |||
1228 | * addressesOrRanges, we don't know what this is. | |||
1229 | */ | |||
1230 | if ((aors = IPAddressFamily_addressesOrRanges(af)) == NULL((void*)0)) | |||
1231 | return 0; | |||
1232 | ||||
1233 | if (sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) == 0) | |||
1234 | return 0; | |||
1235 | ||||
1236 | for (j = 0; j < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) - 1; j++) { | |||
1237 | aor_a = sk_IPAddressOrRange_value(aors, j)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j))); | |||
1238 | aor_b = sk_IPAddressOrRange_value(aors, j + 1)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j + 1))); | |||
1239 | ||||
1240 | /* | |||
1241 | * XXX - check that both are either a prefix or a range. | |||
1242 | */ | |||
1243 | ||||
1244 | if (!extract_min_max(aor_a, a_min, a_max, length) || | |||
1245 | !extract_min_max(aor_b, b_min, b_max, length)) | |||
1246 | return 0; | |||
1247 | ||||
1248 | /* | |||
1249 | * Punt misordered list, overlapping start, or inverted | |||
1250 | * range. | |||
1251 | */ | |||
1252 | if (memcmp(a_min, b_min, length) >= 0 || | |||
1253 | memcmp(a_min, a_max, length) > 0 || | |||
1254 | memcmp(b_min, b_max, length) > 0) | |||
1255 | return 0; | |||
1256 | ||||
1257 | /* | |||
1258 | * Punt if adjacent or overlapping. Check for adjacency | |||
1259 | * by subtracting one from b_min first. | |||
1260 | */ | |||
1261 | for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) | |||
1262 | continue; | |||
1263 | if (memcmp(a_max, b_min, length) >= 0) | |||
1264 | return 0; | |||
1265 | ||||
1266 | /* | |||
1267 | * Check for range that should be expressed as a prefix. | |||
1268 | */ | |||
1269 | if (aor_a->type == IPAddressOrRange_addressPrefix0) | |||
1270 | continue; | |||
1271 | ||||
1272 | if (range_should_be_prefix(a_min, a_max, length) >= 0) | |||
1273 | return 0; | |||
1274 | } | |||
1275 | ||||
1276 | /* | |||
1277 | * Check final range to see if it's inverted or should be a | |||
1278 | * prefix. | |||
1279 | */ | |||
1280 | aor = sk_IPAddressOrRange_value(aors, j)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j))); | |||
1281 | if (aor->type == IPAddressOrRange_addressRange1) { | |||
1282 | if (!extract_min_max(aor, a_min, a_max, length)) | |||
1283 | return 0; | |||
1284 | if (memcmp(a_min, a_max, length) > 0) | |||
1285 | return 0; | |||
1286 | if (range_should_be_prefix(a_min, a_max, length) >= 0) | |||
1287 | return 0; | |||
1288 | } | |||
1289 | } | |||
1290 | ||||
1291 | /* | |||
1292 | * If we made it through all that, we're happy. | |||
1293 | */ | |||
1294 | return 1; | |||
1295 | } | |||
1296 | ||||
1297 | /* | |||
1298 | * Whack an IPAddressOrRanges into canonical form. | |||
1299 | */ | |||
1300 | static int | |||
1301 | IPAddressOrRanges_canonize(IPAddressOrRanges *aors, const unsigned afi) | |||
1302 | { | |||
1303 | IPAddressOrRange *a, *b, *merged; | |||
1304 | unsigned char a_min[ADDR_RAW_BUF_LEN16], a_max[ADDR_RAW_BUF_LEN16]; | |||
1305 | unsigned char b_min[ADDR_RAW_BUF_LEN16], b_max[ADDR_RAW_BUF_LEN16]; | |||
1306 | int i, j, length; | |||
1307 | ||||
1308 | length = length_from_afi(afi); | |||
1309 | ||||
1310 | /* | |||
1311 | * Sort the IPAddressOrRanges sequence. | |||
1312 | */ | |||
1313 | sk_IPAddressOrRange_sort(aors)sk_sort(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))); | |||
1314 | ||||
1315 | /* | |||
1316 | * Clean up representation issues, punt on duplicates or overlaps. | |||
1317 | */ | |||
1318 | for (i = 0; i < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) - 1; i++) { | |||
1319 | a = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
1320 | b = sk_IPAddressOrRange_value(aors, i + 1)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i + 1))); | |||
1321 | ||||
1322 | if (!extract_min_max(a, a_min, a_max, length) || | |||
1323 | !extract_min_max(b, b_min, b_max, length)) | |||
1324 | return 0; | |||
1325 | ||||
1326 | /* | |||
1327 | * Punt inverted ranges. | |||
1328 | */ | |||
1329 | if (memcmp(a_min, a_max, length) > 0 || | |||
1330 | memcmp(b_min, b_max, length) > 0) | |||
1331 | return 0; | |||
1332 | ||||
1333 | /* | |||
1334 | * Punt overlaps. | |||
1335 | */ | |||
1336 | if (memcmp(a_max, b_min, length) >= 0) | |||
1337 | return 0; | |||
1338 | ||||
1339 | /* | |||
1340 | * Merge if a and b are adjacent. We check for | |||
1341 | * adjacency by subtracting one from b_min first. | |||
1342 | */ | |||
1343 | for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) | |||
1344 | continue; | |||
1345 | ||||
1346 | if (memcmp(a_max, b_min, length) != 0) | |||
1347 | continue; | |||
1348 | ||||
1349 | if (!make_addressRange(&merged, a_min, b_max, afi, length)) | |||
1350 | return 0; | |||
1351 | sk_IPAddressOrRange_set(aors, i, merged)sk_set(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), (i), ((void*) (1 ? (merged) : (IPAddressOrRange*)0))); | |||
1352 | sk_IPAddressOrRange_delete(aors, i + 1)(IPAddressOrRange *)sk_delete(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i + 1)); | |||
1353 | IPAddressOrRange_free(a); | |||
1354 | IPAddressOrRange_free(b); | |||
1355 | i--; | |||
1356 | } | |||
1357 | ||||
1358 | /* | |||
1359 | * Check for inverted final range. | |||
1360 | */ | |||
1361 | a = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
1362 | if (a != NULL((void*)0) && a->type == IPAddressOrRange_addressRange1) { | |||
1363 | if (!extract_min_max(a, a_min, a_max, length)) | |||
1364 | return 0; | |||
1365 | if (memcmp(a_min, a_max, length) > 0) | |||
1366 | return 0; | |||
1367 | } | |||
1368 | ||||
1369 | return 1; | |||
1370 | } | |||
1371 | ||||
1372 | /* | |||
1373 | * Whack an IPAddrBlocks extension into canonical form. | |||
1374 | */ | |||
1375 | int | |||
1376 | X509v3_addr_canonize(IPAddrBlocks *addr) | |||
1377 | { | |||
1378 | IPAddressFamily *af; | |||
1379 | IPAddressOrRanges *aors; | |||
1380 | uint16_t afi; | |||
1381 | int i; | |||
1382 | ||||
1383 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1384 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1385 | ||||
1386 | /* Check AFI/SAFI here - IPAddressFamily_cmp() can't error. */ | |||
1387 | if (!IPAddressFamily_afi(af, &afi)) | |||
1388 | return 0; | |||
1389 | ||||
1390 | if ((aors = IPAddressFamily_addressesOrRanges(af)) == NULL((void*)0)) | |||
1391 | continue; | |||
1392 | ||||
1393 | if (!IPAddressOrRanges_canonize(aors, afi)) | |||
1394 | return 0; | |||
1395 | } | |||
1396 | ||||
1397 | sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
1398 | sk_IPAddressFamily_sort(addr)sk_sort(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); | |||
1399 | ||||
1400 | return X509v3_addr_is_canonical(addr); | |||
1401 | } | |||
1402 | ||||
1403 | /* | |||
1404 | * v2i handler for the IPAddrBlocks extension. | |||
1405 | */ | |||
1406 | static void * | |||
1407 | v2i_IPAddrBlocks(const struct v3_ext_method *method, struct v3_ext_ctx *ctx, | |||
1408 | STACK_OF(CONF_VALUE)struct stack_st_CONF_VALUE*values) | |||
1409 | { | |||
1410 | static const char v4addr_chars[] = "0123456789."; | |||
1411 | static const char v6addr_chars[] = "0123456789.:abcdefABCDEF"; | |||
1412 | IPAddrBlocks *addr = NULL((void*)0); | |||
1413 | char *s = NULL((void*)0), *t; | |||
1414 | int i; | |||
1415 | ||||
1416 | if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)((struct stack_st_IPAddressFamily *)sk_new(((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *)) 0)))))) == NULL((void*)0)) { | |||
1417 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1417); | |||
1418 | return NULL((void*)0); | |||
1419 | } | |||
1420 | ||||
1421 | for (i = 0; i < sk_CONF_VALUE_num(values)sk_num(((_STACK*) (1 ? (values) : (struct stack_st_CONF_VALUE *)0))); i++) { | |||
1422 | CONF_VALUE *val = sk_CONF_VALUE_value(values, i)((CONF_VALUE *)sk_value(((_STACK*) (1 ? (values) : (struct stack_st_CONF_VALUE *)0)), (i))); | |||
1423 | unsigned char min[ADDR_RAW_BUF_LEN16], max[ADDR_RAW_BUF_LEN16]; | |||
1424 | unsigned afi, *safi = NULL((void*)0), safi_; | |||
1425 | const char *addr_chars = NULL((void*)0); | |||
1426 | const char *errstr; | |||
1427 | int prefix_len, i1, i2, delim, length; | |||
1428 | ||||
1429 | if (!name_cmp(val->name, "IPv4")) { | |||
1430 | afi = IANA_AFI_IPV41; | |||
1431 | } else if (!name_cmp(val->name, "IPv6")) { | |||
1432 | afi = IANA_AFI_IPV62; | |||
1433 | } else if (!name_cmp(val->name, "IPv4-SAFI")) { | |||
1434 | afi = IANA_AFI_IPV41; | |||
1435 | safi = &safi_; | |||
1436 | } else if (!name_cmp(val->name, "IPv6-SAFI")) { | |||
1437 | afi = IANA_AFI_IPV62; | |||
1438 | safi = &safi_; | |||
1439 | } else { | |||
1440 | X509V3error(X509V3_R_EXTENSION_NAME_ERROR)ERR_put_error(34,(0xfff),(115),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1440); | |||
1441 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1442 | goto err; | |||
1443 | } | |||
1444 | ||||
1445 | switch (afi) { | |||
1446 | case IANA_AFI_IPV41: | |||
1447 | addr_chars = v4addr_chars; | |||
1448 | break; | |||
1449 | case IANA_AFI_IPV62: | |||
1450 | addr_chars = v6addr_chars; | |||
1451 | break; | |||
1452 | } | |||
1453 | ||||
1454 | length = length_from_afi(afi); | |||
1455 | ||||
1456 | /* | |||
1457 | * Handle SAFI, if any, and strdup() so we can null-terminate | |||
1458 | * the other input values. | |||
1459 | */ | |||
1460 | if (safi != NULL((void*)0)) { | |||
1461 | unsigned long parsed_safi; | |||
1462 | int saved_errno = errno(*__errno()); | |||
1463 | ||||
1464 | errno(*__errno()) = 0; | |||
1465 | parsed_safi = strtoul(val->value, &t, 0); | |||
1466 | ||||
1467 | /* Value must be present, then a tab, space or colon. */ | |||
1468 | if (val->value[0] == '\0' || | |||
1469 | (*t != '\t' && *t != ' ' && *t != ':')) { | |||
1470 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1470); | |||
1471 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1472 | goto err; | |||
1473 | } | |||
1474 | /* Range and overflow check. */ | |||
1475 | if ((errno(*__errno()) == ERANGE34 && parsed_safi == ULONG_MAX(9223372036854775807L *2UL+1UL)) || | |||
1476 | parsed_safi > 0xff) { | |||
1477 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1477); | |||
1478 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1479 | goto err; | |||
1480 | } | |||
1481 | errno(*__errno()) = saved_errno; | |||
1482 | ||||
1483 | *safi = parsed_safi; | |||
1484 | ||||
1485 | /* Check possible whitespace is followed by a colon. */ | |||
1486 | t += strspn(t, " \t"); | |||
1487 | if (*t != ':') { | |||
1488 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1488); | |||
1489 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1490 | goto err; | |||
1491 | } | |||
1492 | ||||
1493 | /* Skip over colon. */ | |||
1494 | t++; | |||
1495 | ||||
1496 | /* Then over any trailing whitespace. */ | |||
1497 | t += strspn(t, " \t"); | |||
1498 | ||||
1499 | s = strdup(t); | |||
1500 | } else { | |||
1501 | s = strdup(val->value); | |||
1502 | } | |||
1503 | if (s == NULL((void*)0)) { | |||
1504 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1504); | |||
1505 | goto err; | |||
1506 | } | |||
1507 | ||||
1508 | /* | |||
1509 | * Check for inheritance. Not worth additional complexity to | |||
1510 | * optimize this (seldom-used) case. | |||
1511 | */ | |||
1512 | if (strcmp(s, "inherit") == 0) { | |||
1513 | if (!X509v3_addr_add_inherit(addr, afi, safi)) { | |||
1514 | X509V3error(X509V3_R_INVALID_INHERITANCE)ERR_put_error(34,(0xfff),(165),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1514); | |||
1515 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1516 | goto err; | |||
1517 | } | |||
1518 | free(s); | |||
1519 | s = NULL((void*)0); | |||
1520 | continue; | |||
1521 | } | |||
1522 | ||||
1523 | i1 = strspn(s, addr_chars); | |||
1524 | i2 = i1 + strspn(s + i1, " \t"); | |||
1525 | delim = s[i2++]; | |||
1526 | s[i1] = '\0'; | |||
1527 | ||||
1528 | if (a2i_ipadd(min, s) != length) { | |||
1529 | X509V3error(X509V3_R_INVALID_IPADDRESS)ERR_put_error(34,(0xfff),(166),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1529); | |||
1530 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1531 | goto err; | |||
1532 | } | |||
1533 | ||||
1534 | switch (delim) { | |||
1535 | case '/': | |||
1536 | /* length contains the size of the address in bytes. */ | |||
1537 | if (length != 4 && length != 16) | |||
1538 | goto err; | |||
1539 | prefix_len = strtonum(s + i2, 0, 8 * length, &errstr); | |||
1540 | if (errstr != NULL((void*)0)) { | |||
1541 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1541); | |||
1542 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1543 | goto err; | |||
1544 | } | |||
1545 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, | |||
1546 | prefix_len)) { | |||
1547 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1547); | |||
1548 | goto err; | |||
1549 | } | |||
1550 | break; | |||
1551 | case '-': | |||
1552 | i1 = i2 + strspn(s + i2, " \t"); | |||
1553 | i2 = i1 + strspn(s + i1, addr_chars); | |||
1554 | if (i1 == i2 || s[i2] != '\0') { | |||
1555 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1555); | |||
1556 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1557 | goto err; | |||
1558 | } | |||
1559 | if (a2i_ipadd(max, s + i1) != length) { | |||
1560 | X509V3error(X509V3_R_INVALID_IPADDRESS)ERR_put_error(34,(0xfff),(166),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1560); | |||
1561 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1562 | goto err; | |||
1563 | } | |||
1564 | if (memcmp(min, max, length_from_afi(afi)) > 0) { | |||
1565 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1565); | |||
1566 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1567 | goto err; | |||
1568 | } | |||
1569 | if (!X509v3_addr_add_range(addr, afi, safi, min, max)) { | |||
1570 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1570); | |||
1571 | goto err; | |||
1572 | } | |||
1573 | break; | |||
1574 | case '\0': | |||
1575 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, | |||
1576 | length * 8)) { | |||
1577 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1577); | |||
1578 | goto err; | |||
1579 | } | |||
1580 | break; | |||
1581 | default: | |||
1582 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1582); | |||
1583 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1584 | goto err; | |||
1585 | } | |||
1586 | ||||
1587 | free(s); | |||
1588 | s = NULL((void*)0); | |||
1589 | } | |||
1590 | ||||
1591 | /* | |||
1592 | * Canonize the result, then we're done. | |||
1593 | */ | |||
1594 | if (!X509v3_addr_canonize(addr)) | |||
1595 | goto err; | |||
1596 | return addr; | |||
1597 | ||||
1598 | err: | |||
1599 | free(s); | |||
1600 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free)sk_pop_free(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0)), ((void (*)(void *)) ((1 ? (IPAddressFamily_free) : (void (*)(IPAddressFamily *))0)))); | |||
1601 | return NULL((void*)0); | |||
1602 | } | |||
1603 | ||||
1604 | /* | |||
1605 | * OpenSSL dispatch | |||
1606 | */ | |||
1607 | const X509V3_EXT_METHOD v3_addr = { | |||
1608 | .ext_nid = NID_sbgp_ipAddrBlock290, | |||
1609 | .ext_flags = 0, | |||
1610 | .it = &IPAddrBlocks_it, | |||
1611 | .ext_new = NULL((void*)0), | |||
1612 | .ext_free = NULL((void*)0), | |||
1613 | .d2i = NULL((void*)0), | |||
1614 | .i2d = NULL((void*)0), | |||
1615 | .i2s = NULL((void*)0), | |||
1616 | .s2i = NULL((void*)0), | |||
1617 | .i2v = NULL((void*)0), | |||
1618 | .v2i = v2i_IPAddrBlocks, | |||
1619 | .i2r = i2r_IPAddrBlocks, | |||
1620 | .r2i = NULL((void*)0), | |||
1621 | .usr_data = NULL((void*)0), | |||
1622 | }; | |||
1623 | ||||
1624 | /* | |||
1625 | * Figure out whether extension uses inheritance. | |||
1626 | */ | |||
1627 | int | |||
1628 | X509v3_addr_inherits(IPAddrBlocks *addr) | |||
1629 | { | |||
1630 | IPAddressFamily *af; | |||
1631 | int i; | |||
1632 | ||||
1633 | if (addr == NULL((void*)0)) | |||
1634 | return 0; | |||
1635 | ||||
1636 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1637 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1638 | ||||
1639 | if (IPAddressFamily_inheritance(af) != NULL((void*)0)) | |||
1640 | return 1; | |||
1641 | } | |||
1642 | ||||
1643 | return 0; | |||
1644 | } | |||
1645 | ||||
1646 | /* | |||
1647 | * Figure out whether parent contains child. | |||
1648 | * | |||
1649 | * This only works correctly if both parent and child are in canonical form. | |||
1650 | */ | |||
1651 | static int | |||
1652 | addr_contains(IPAddressOrRanges *parent, IPAddressOrRanges *child, int length) | |||
1653 | { | |||
1654 | IPAddressOrRange *child_aor, *parent_aor; | |||
1655 | uint8_t parent_min[ADDR_RAW_BUF_LEN16], parent_max[ADDR_RAW_BUF_LEN16]; | |||
1656 | uint8_t child_min[ADDR_RAW_BUF_LEN16], child_max[ADDR_RAW_BUF_LEN16]; | |||
1657 | int p, c; | |||
1658 | ||||
1659 | if (child == NULL((void*)0) || parent == child) | |||
1660 | return 1; | |||
1661 | if (parent == NULL((void*)0)) | |||
1662 | return 0; | |||
1663 | ||||
1664 | p = 0; | |||
1665 | for (c = 0; c < sk_IPAddressOrRange_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressOrRange *)0))); c++) { | |||
1666 | child_aor = sk_IPAddressOrRange_value(child, c)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressOrRange*)0)), (c))); | |||
1667 | ||||
1668 | if (!extract_min_max(child_aor, child_min, child_max, length)) | |||
1669 | return 0; | |||
1670 | ||||
1671 | for (;; p++) { | |||
1672 | if (p >= sk_IPAddressOrRange_num(parent)sk_num(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressOrRange *)0)))) | |||
1673 | return 0; | |||
1674 | ||||
1675 | parent_aor = sk_IPAddressOrRange_value(parent, p)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressOrRange*)0)), (p))); | |||
1676 | ||||
1677 | if (!extract_min_max(parent_aor, parent_min, parent_max, | |||
1678 | length)) | |||
1679 | return 0; | |||
1680 | ||||
1681 | if (memcmp(parent_max, child_max, length) < 0) | |||
1682 | continue; | |||
1683 | if (memcmp(parent_min, child_min, length) > 0) | |||
1684 | return 0; | |||
1685 | break; | |||
1686 | } | |||
1687 | } | |||
1688 | ||||
1689 | return 1; | |||
1690 | } | |||
1691 | ||||
1692 | /* | |||
1693 | * Test whether |child| is a subset of |parent|. | |||
1694 | */ | |||
1695 | int | |||
1696 | X509v3_addr_subset(IPAddrBlocks *child, IPAddrBlocks *parent) | |||
1697 | { | |||
1698 | IPAddressFamily *child_af, *parent_af; | |||
1699 | IPAddressOrRanges *child_aor, *parent_aor; | |||
1700 | int i, length; | |||
1701 | ||||
1702 | if (child == NULL((void*)0) || child == parent) | |||
1703 | return 1; | |||
1704 | if (parent == NULL((void*)0)) | |||
1705 | return 0; | |||
1706 | ||||
1707 | if (X509v3_addr_inherits(child) || X509v3_addr_inherits(parent)) | |||
1708 | return 0; | |||
1709 | ||||
1710 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1711 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1712 | ||||
1713 | parent_af = IPAddressFamily_find_in_parent(parent, child_af); | |||
1714 | if (parent_af == NULL((void*)0)) | |||
1715 | return 0; | |||
1716 | ||||
1717 | if (!IPAddressFamily_afi_length(parent_af, &length)) | |||
1718 | return 0; | |||
1719 | ||||
1720 | child_aor = IPAddressFamily_addressesOrRanges(child_af); | |||
1721 | parent_aor = IPAddressFamily_addressesOrRanges(parent_af); | |||
1722 | ||||
1723 | if (!addr_contains(parent_aor, child_aor, length)) | |||
1724 | return 0; | |||
1725 | } | |||
1726 | return 1; | |||
1727 | } | |||
1728 | ||||
1729 | static int | |||
1730 | verify_error(X509_STORE_CTX *ctx, X509 *cert, int error, int depth) | |||
1731 | { | |||
1732 | if (ctx == NULL((void*)0)) | |||
1733 | return 0; | |||
1734 | ||||
1735 | ctx->current_cert = cert; | |||
1736 | ctx->error = error; | |||
1737 | ctx->error_depth = depth; | |||
1738 | ||||
1739 | return ctx->verify_cb(0, ctx); | |||
1740 | } | |||
1741 | ||||
1742 | /* | |||
1743 | * Core code for RFC 3779 2.3 path validation. | |||
1744 | * | |||
1745 | * Returns 1 for success, 0 on error. | |||
1746 | * | |||
1747 | * When returning 0, ctx->error MUST be set to an appropriate value other than | |||
1748 | * X509_V_OK. | |||
1749 | */ | |||
1750 | static int | |||
1751 | addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509)struct stack_st_X509 *chain, | |||
1752 | IPAddrBlocks *ext) | |||
1753 | { | |||
1754 | IPAddrBlocks *child = NULL((void*)0), *parent = NULL((void*)0); | |||
1755 | IPAddressFamily *child_af, *parent_af; | |||
1756 | IPAddressOrRanges *child_aor, *parent_aor; | |||
1757 | X509 *cert = NULL((void*)0); | |||
| ||||
1758 | int depth = -1; | |||
1759 | int i; | |||
1760 | unsigned int length; | |||
1761 | int ret = 1; | |||
1762 | ||||
1763 | /* We need a non-empty chain to test against. */ | |||
1764 | if (sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))) <= 0) | |||
1765 | goto err; | |||
1766 | /* We need either a store ctx or an extension to work with. */ | |||
1767 | if (ctx == NULL((void*)0) && ext == NULL((void*)0)) | |||
1768 | goto err; | |||
1769 | /* If there is a store ctx, it needs a verify_cb. */ | |||
1770 | if (ctx
| |||
1771 | goto err; | |||
1772 | ||||
1773 | /* | |||
1774 | * Figure out where to start. If we don't have an extension to check, | |||
1775 | * we're done. Otherwise, check canonical form and set up for walking | |||
1776 | * up the chain. | |||
1777 | */ | |||
1778 | if (ext
| |||
1779 | depth = 0; | |||
1780 | cert = sk_X509_value(chain, depth)((X509 *)sk_value(((_STACK*) (1 ? (chain) : (struct stack_st_X509 *)0)), (depth))); | |||
1781 | if ((ext = cert->rfc3779_addr) == NULL((void*)0)) | |||
1782 | goto done; | |||
1783 | } | |||
1784 | ||||
1785 | if (!X509v3_addr_is_canonical(ext)) { | |||
1786 | if ((ret = verify_error(ctx, cert, | |||
1787 | X509_V_ERR_INVALID_EXTENSION41, depth)) == 0) | |||
1788 | goto done; | |||
1789 | } | |||
1790 | ||||
1791 | (void)sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (ext) : (struct stack_st_IPAddressFamily *)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp ) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
1792 | if ((child = sk_IPAddressFamily_dup(ext)(struct stack_st_IPAddressFamily *)sk_dup(((_STACK*) (1 ? ext : (struct stack_st_IPAddressFamily*)0)))) == NULL((void*)0)) { | |||
1793 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1793); | |||
1794 | if (ctx != NULL((void*)0)) | |||
1795 | ctx->error = X509_V_ERR_OUT_OF_MEM17; | |||
1796 | ret = 0; | |||
1797 | goto done; | |||
1798 | } | |||
1799 | ||||
1800 | /* | |||
1801 | * Now walk up the chain. No cert may list resources that its parent | |||
1802 | * doesn't list. | |||
1803 | */ | |||
1804 | for (depth++; depth < sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))); depth++) { | |||
1805 | cert = sk_X509_value(chain, depth)((X509 *)sk_value(((_STACK*) (1 ? (chain) : (struct stack_st_X509 *)0)), (depth))); | |||
1806 | ||||
1807 | if ((parent = cert->rfc3779_addr) == NULL((void*)0)) { | |||
1808 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1809 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1810 | ||||
1811 | if (IPAddressFamily_inheritance(child_af) != | |||
1812 | NULL((void*)0)) | |||
1813 | continue; | |||
1814 | ||||
1815 | if ((ret = verify_error(ctx, cert, | |||
1816 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1817 | goto done; | |||
1818 | break; | |||
1819 | } | |||
1820 | continue; | |||
1821 | } | |||
1822 | ||||
1823 | if (!X509v3_addr_is_canonical(parent)) { | |||
1824 | if ((ret = verify_error(ctx, cert, | |||
1825 | X509_V_ERR_INVALID_EXTENSION41, depth)) == 0) | |||
1826 | goto done; | |||
1827 | } | |||
1828 | ||||
1829 | /* | |||
1830 | * Check that the child's resources are covered by the parent. | |||
1831 | * Each covered resource is replaced with the parent's resource | |||
1832 | * covering it, so the next iteration will check that the | |||
1833 | * parent's resources are covered by the grandparent. | |||
1834 | */ | |||
1835 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1836 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1837 | ||||
1838 | if ((parent_af = IPAddressFamily_find_in_parent(parent, | |||
1839 | child_af)) == NULL((void*)0)) { | |||
1840 | /* | |||
1841 | * If we have no match in the parent and the | |||
1842 | * child inherits, that's fine. | |||
1843 | */ | |||
1844 | if (IPAddressFamily_inheritance(child_af) != | |||
1845 | NULL((void*)0)) | |||
1846 | continue; | |||
1847 | ||||
1848 | /* Otherwise the child isn't covered. */ | |||
1849 | if ((ret = verify_error(ctx, cert, | |||
1850 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1851 | goto done; | |||
1852 | break; | |||
1853 | } | |||
1854 | ||||
1855 | /* Parent inherits, nothing to do. */ | |||
1856 | if (IPAddressFamily_inheritance(parent_af) != NULL((void*)0)) | |||
1857 | continue; | |||
1858 | ||||
1859 | /* Child inherits. Use parent's address family. */ | |||
1860 | if (IPAddressFamily_inheritance(child_af) != NULL((void*)0)) { | |||
1861 | sk_IPAddressFamily_set(child, i, parent_af)sk_set(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0)), (i), ((void*) (1 ? (parent_af) : (IPAddressFamily*)0)) ); | |||
1862 | continue; | |||
1863 | } | |||
1864 | ||||
1865 | child_aor = IPAddressFamily_addressesOrRanges(child_af); | |||
1866 | parent_aor = | |||
1867 | IPAddressFamily_addressesOrRanges(parent_af); | |||
1868 | ||||
1869 | /* | |||
1870 | * Child and parent are canonical and neither inherits. | |||
1871 | * If either addressesOrRanges is NULL, something's | |||
1872 | * very wrong. | |||
1873 | */ | |||
1874 | if (child_aor == NULL((void*)0) || parent_aor == NULL((void*)0)) | |||
1875 | goto err; | |||
1876 | ||||
1877 | if (!IPAddressFamily_afi_length(child_af, &length)) | |||
1878 | goto err; | |||
1879 | ||||
1880 | /* Now check containment and replace or error. */ | |||
1881 | if (addr_contains(parent_aor, child_aor, length)) { | |||
1882 | sk_IPAddressFamily_set(child, i, parent_af)sk_set(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0)), (i), ((void*) (1 ? (parent_af) : (IPAddressFamily*)0)) ); | |||
1883 | continue; | |||
1884 | } | |||
1885 | ||||
1886 | if ((ret = verify_error(ctx, cert, | |||
1887 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1888 | goto done; | |||
1889 | } | |||
1890 | } | |||
1891 | ||||
1892 | /* | |||
1893 | * Trust anchor can't inherit. | |||
1894 | */ | |||
1895 | if ((parent = cert->rfc3779_addr) != NULL((void*)0)) { | |||
| ||||
1896 | for (i = 0; i < sk_IPAddressFamily_num(parent)sk_num(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1897 | parent_af = sk_IPAddressFamily_value(parent, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1898 | ||||
1899 | if (IPAddressFamily_inheritance(parent_af) == NULL((void*)0)) | |||
1900 | continue; | |||
1901 | ||||
1902 | if (sk_IPAddressFamily_find(child, parent_af)sk_find(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0)), ((void*) (1 ? (parent_af) : (IPAddressFamily*)0))) < 0) | |||
1903 | continue; | |||
1904 | ||||
1905 | if ((ret = verify_error(ctx, cert, | |||
1906 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1907 | goto done; | |||
1908 | } | |||
1909 | } | |||
1910 | ||||
1911 | done: | |||
1912 | sk_IPAddressFamily_free(child)sk_free(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); | |||
1913 | return ret; | |||
1914 | ||||
1915 | err: | |||
1916 | sk_IPAddressFamily_free(child)sk_free(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); | |||
1917 | ||||
1918 | if (ctx != NULL((void*)0)) | |||
1919 | ctx->error = X509_V_ERR_UNSPECIFIED1; | |||
1920 | ||||
1921 | return 0; | |||
1922 | } | |||
1923 | ||||
1924 | /* | |||
1925 | * RFC 3779 2.3 path validation -- called from X509_verify_cert(). | |||
1926 | */ | |||
1927 | int | |||
1928 | X509v3_addr_validate_path(X509_STORE_CTX *ctx) | |||
1929 | { | |||
1930 | if (sk_X509_num(ctx->chain)sk_num(((_STACK*) (1 ? (ctx->chain) : (struct stack_st_X509 *)0))) <= 0 || ctx->verify_cb == NULL((void*)0)) { | |||
1931 | ctx->error = X509_V_ERR_UNSPECIFIED1; | |||
1932 | return 0; | |||
1933 | } | |||
1934 | return addr_validate_path_internal(ctx, ctx->chain, NULL((void*)0)); | |||
1935 | } | |||
1936 | ||||
1937 | /* | |||
1938 | * RFC 3779 2.3 path validation of an extension. | |||
1939 | * Test whether chain covers extension. | |||
1940 | */ | |||
1941 | int | |||
1942 | X509v3_addr_validate_resource_set(STACK_OF(X509)struct stack_st_X509 *chain, IPAddrBlocks *ext, | |||
1943 | int allow_inheritance) | |||
1944 | { | |||
1945 | if (ext == NULL((void*)0)) | |||
1946 | return 1; | |||
1947 | if (sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))) <= 0) | |||
1948 | return 0; | |||
1949 | if (!allow_inheritance && X509v3_addr_inherits(ext)) | |||
1950 | return 0; | |||
1951 | return addr_validate_path_internal(NULL((void*)0), chain, ext); | |||
1952 | } | |||
1953 | ||||
1954 | #endif /* OPENSSL_NO_RFC3779 */ |