File: | src/lib/libcrypto/x509/x509_addr.c |
Warning: | line 2006, column 16 Access to field 'rfc3779_addr' results in a dereference of a null pointer (loaded from variable 'cert') |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: x509_addr.c,v 1.91 2023/10/29 13:22:37 tb Exp $ */ | |||
2 | /* | |||
3 | * Contributed to the OpenSSL Project by the American Registry for | |||
4 | * Internet Numbers ("ARIN"). | |||
5 | */ | |||
6 | /* ==================================================================== | |||
7 | * Copyright (c) 2006-2016 The OpenSSL Project. All rights reserved. | |||
8 | * | |||
9 | * Redistribution and use in source and binary forms, with or without | |||
10 | * modification, are permitted provided that the following conditions | |||
11 | * are met: | |||
12 | * | |||
13 | * 1. Redistributions of source code must retain the above copyright | |||
14 | * notice, this list of conditions and the following disclaimer. | |||
15 | * | |||
16 | * 2. Redistributions in binary form must reproduce the above copyright | |||
17 | * notice, this list of conditions and the following disclaimer in | |||
18 | * the documentation and/or other materials provided with the | |||
19 | * distribution. | |||
20 | * | |||
21 | * 3. All advertising materials mentioning features or use of this | |||
22 | * software must display the following acknowledgment: | |||
23 | * "This product includes software developed by the OpenSSL Project | |||
24 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" | |||
25 | * | |||
26 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | |||
27 | * endorse or promote products derived from this software without | |||
28 | * prior written permission. For written permission, please contact | |||
29 | * licensing@OpenSSL.org. | |||
30 | * | |||
31 | * 5. Products derived from this software may not be called "OpenSSL" | |||
32 | * nor may "OpenSSL" appear in their names without prior written | |||
33 | * permission of the OpenSSL Project. | |||
34 | * | |||
35 | * 6. Redistributions of any form whatsoever must retain the following | |||
36 | * acknowledgment: | |||
37 | * "This product includes software developed by the OpenSSL Project | |||
38 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" | |||
39 | * | |||
40 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | |||
41 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |||
42 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | |||
43 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | |||
44 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |||
45 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | |||
46 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |||
47 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |||
48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | |||
49 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | |||
50 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | |||
51 | * OF THE POSSIBILITY OF SUCH DAMAGE. | |||
52 | * ==================================================================== | |||
53 | * | |||
54 | * This product includes cryptographic software written by Eric Young | |||
55 | * (eay@cryptsoft.com). This product includes software written by Tim | |||
56 | * Hudson (tjh@cryptsoft.com). | |||
57 | */ | |||
58 | ||||
59 | /* | |||
60 | * Implementation of RFC 3779 section 2.2. | |||
61 | */ | |||
62 | ||||
63 | #include <limits.h> | |||
64 | #include <stdio.h> | |||
65 | #include <stdlib.h> | |||
66 | #include <string.h> | |||
67 | ||||
68 | #include <openssl/asn1.h> | |||
69 | #include <openssl/asn1t.h> | |||
70 | #include <openssl/buffer.h> | |||
71 | #include <openssl/conf.h> | |||
72 | #include <openssl/err.h> | |||
73 | #include <openssl/x509.h> | |||
74 | #include <openssl/x509v3.h> | |||
75 | ||||
76 | #include "asn1_local.h" | |||
77 | #include "bytestring.h" | |||
78 | #include "x509_local.h" | |||
79 | ||||
80 | #ifndef OPENSSL_NO_RFC3779 | |||
81 | ||||
82 | /* | |||
83 | * OpenSSL ASN.1 template translation of RFC 3779 2.2.3. | |||
84 | */ | |||
85 | ||||
86 | static const ASN1_TEMPLATE IPAddressRange_seq_tt[] = { | |||
87 | { | |||
88 | .flags = 0, | |||
89 | .tag = 0, | |||
90 | .offset = offsetof(IPAddressRange, min)__builtin_offsetof(IPAddressRange, min), | |||
91 | .field_name = "min", | |||
92 | .item = &ASN1_BIT_STRING_it, | |||
93 | }, | |||
94 | { | |||
95 | .flags = 0, | |||
96 | .tag = 0, | |||
97 | .offset = offsetof(IPAddressRange, max)__builtin_offsetof(IPAddressRange, max), | |||
98 | .field_name = "max", | |||
99 | .item = &ASN1_BIT_STRING_it, | |||
100 | }, | |||
101 | }; | |||
102 | ||||
103 | const ASN1_ITEM IPAddressRange_it = { | |||
104 | .itype = ASN1_ITYPE_SEQUENCE0x1, | |||
105 | .utype = V_ASN1_SEQUENCE16, | |||
106 | .templates = IPAddressRange_seq_tt, | |||
107 | .tcount = sizeof(IPAddressRange_seq_tt) / sizeof(ASN1_TEMPLATE), | |||
108 | .funcs = NULL((void *)0), | |||
109 | .size = sizeof(IPAddressRange), | |||
110 | .sname = "IPAddressRange", | |||
111 | }; | |||
112 | ||||
113 | static const ASN1_TEMPLATE IPAddressOrRange_ch_tt[] = { | |||
114 | { | |||
115 | .flags = 0, | |||
116 | .tag = 0, | |||
117 | .offset = offsetof(IPAddressOrRange, u.addressPrefix)__builtin_offsetof(IPAddressOrRange, u.addressPrefix), | |||
118 | .field_name = "u.addressPrefix", | |||
119 | .item = &ASN1_BIT_STRING_it, | |||
120 | }, | |||
121 | { | |||
122 | .flags = 0, | |||
123 | .tag = 0, | |||
124 | .offset = offsetof(IPAddressOrRange, u.addressRange)__builtin_offsetof(IPAddressOrRange, u.addressRange), | |||
125 | .field_name = "u.addressRange", | |||
126 | .item = &IPAddressRange_it, | |||
127 | }, | |||
128 | }; | |||
129 | ||||
130 | const ASN1_ITEM IPAddressOrRange_it = { | |||
131 | .itype = ASN1_ITYPE_CHOICE0x2, | |||
132 | .utype = offsetof(IPAddressOrRange, type)__builtin_offsetof(IPAddressOrRange, type), | |||
133 | .templates = IPAddressOrRange_ch_tt, | |||
134 | .tcount = sizeof(IPAddressOrRange_ch_tt) / sizeof(ASN1_TEMPLATE), | |||
135 | .funcs = NULL((void *)0), | |||
136 | .size = sizeof(IPAddressOrRange), | |||
137 | .sname = "IPAddressOrRange", | |||
138 | }; | |||
139 | ||||
140 | static const ASN1_TEMPLATE IPAddressChoice_ch_tt[] = { | |||
141 | { | |||
142 | .flags = 0, | |||
143 | .tag = 0, | |||
144 | .offset = offsetof(IPAddressChoice, u.inherit)__builtin_offsetof(IPAddressChoice, u.inherit), | |||
145 | .field_name = "u.inherit", | |||
146 | .item = &ASN1_NULL_it, | |||
147 | }, | |||
148 | { | |||
149 | .flags = ASN1_TFLG_SEQUENCE_OF(0x2 << 1), | |||
150 | .tag = 0, | |||
151 | .offset = offsetof(IPAddressChoice, u.addressesOrRanges)__builtin_offsetof(IPAddressChoice, u.addressesOrRanges), | |||
152 | .field_name = "u.addressesOrRanges", | |||
153 | .item = &IPAddressOrRange_it, | |||
154 | }, | |||
155 | }; | |||
156 | ||||
157 | const ASN1_ITEM IPAddressChoice_it = { | |||
158 | .itype = ASN1_ITYPE_CHOICE0x2, | |||
159 | .utype = offsetof(IPAddressChoice, type)__builtin_offsetof(IPAddressChoice, type), | |||
160 | .templates = IPAddressChoice_ch_tt, | |||
161 | .tcount = sizeof(IPAddressChoice_ch_tt) / sizeof(ASN1_TEMPLATE), | |||
162 | .funcs = NULL((void *)0), | |||
163 | .size = sizeof(IPAddressChoice), | |||
164 | .sname = "IPAddressChoice", | |||
165 | }; | |||
166 | ||||
167 | static const ASN1_TEMPLATE IPAddressFamily_seq_tt[] = { | |||
168 | { | |||
169 | .flags = 0, | |||
170 | .tag = 0, | |||
171 | .offset = offsetof(IPAddressFamily, addressFamily)__builtin_offsetof(IPAddressFamily, addressFamily), | |||
172 | .field_name = "addressFamily", | |||
173 | .item = &ASN1_OCTET_STRING_it, | |||
174 | }, | |||
175 | { | |||
176 | .flags = 0, | |||
177 | .tag = 0, | |||
178 | .offset = offsetof(IPAddressFamily, ipAddressChoice)__builtin_offsetof(IPAddressFamily, ipAddressChoice), | |||
179 | .field_name = "ipAddressChoice", | |||
180 | .item = &IPAddressChoice_it, | |||
181 | }, | |||
182 | }; | |||
183 | ||||
184 | const ASN1_ITEM IPAddressFamily_it = { | |||
185 | .itype = ASN1_ITYPE_SEQUENCE0x1, | |||
186 | .utype = V_ASN1_SEQUENCE16, | |||
187 | .templates = IPAddressFamily_seq_tt, | |||
188 | .tcount = sizeof(IPAddressFamily_seq_tt) / sizeof(ASN1_TEMPLATE), | |||
189 | .funcs = NULL((void *)0), | |||
190 | .size = sizeof(IPAddressFamily), | |||
191 | .sname = "IPAddressFamily", | |||
192 | }; | |||
193 | ||||
194 | static const ASN1_TEMPLATE IPAddrBlocks_item_tt = { | |||
195 | .flags = ASN1_TFLG_SEQUENCE_OF(0x2 << 1), | |||
196 | .tag = 0, | |||
197 | .offset = 0, | |||
198 | .field_name = "IPAddrBlocks", | |||
199 | .item = &IPAddressFamily_it, | |||
200 | }; | |||
201 | ||||
202 | static const ASN1_ITEM IPAddrBlocks_it = { | |||
203 | .itype = ASN1_ITYPE_PRIMITIVE0x0, | |||
204 | .utype = -1, | |||
205 | .templates = &IPAddrBlocks_item_tt, | |||
206 | .tcount = 0, | |||
207 | .funcs = NULL((void *)0), | |||
208 | .size = 0, | |||
209 | .sname = "IPAddrBlocks", | |||
210 | }; | |||
211 | ||||
212 | IPAddressRange * | |||
213 | d2i_IPAddressRange(IPAddressRange **a, const unsigned char **in, long len) | |||
214 | { | |||
215 | return (IPAddressRange *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
216 | &IPAddressRange_it); | |||
217 | } | |||
218 | LCRYPTO_ALIAS(d2i_IPAddressRange)asm(""); | |||
219 | ||||
220 | int | |||
221 | i2d_IPAddressRange(IPAddressRange *a, unsigned char **out) | |||
222 | { | |||
223 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressRange_it); | |||
224 | } | |||
225 | LCRYPTO_ALIAS(i2d_IPAddressRange)asm(""); | |||
226 | ||||
227 | IPAddressRange * | |||
228 | IPAddressRange_new(void) | |||
229 | { | |||
230 | return (IPAddressRange *)ASN1_item_new(&IPAddressRange_it); | |||
231 | } | |||
232 | LCRYPTO_ALIAS(IPAddressRange_new)asm(""); | |||
233 | ||||
234 | void | |||
235 | IPAddressRange_free(IPAddressRange *a) | |||
236 | { | |||
237 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressRange_it); | |||
238 | } | |||
239 | LCRYPTO_ALIAS(IPAddressRange_free)asm(""); | |||
240 | ||||
241 | IPAddressOrRange * | |||
242 | d2i_IPAddressOrRange(IPAddressOrRange **a, const unsigned char **in, long len) | |||
243 | { | |||
244 | return (IPAddressOrRange *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
245 | &IPAddressOrRange_it); | |||
246 | } | |||
247 | LCRYPTO_ALIAS(d2i_IPAddressOrRange)asm(""); | |||
248 | ||||
249 | int | |||
250 | i2d_IPAddressOrRange(IPAddressOrRange *a, unsigned char **out) | |||
251 | { | |||
252 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressOrRange_it); | |||
253 | } | |||
254 | LCRYPTO_ALIAS(i2d_IPAddressOrRange)asm(""); | |||
255 | ||||
256 | IPAddressOrRange * | |||
257 | IPAddressOrRange_new(void) | |||
258 | { | |||
259 | return (IPAddressOrRange *)ASN1_item_new(&IPAddressOrRange_it); | |||
260 | } | |||
261 | LCRYPTO_ALIAS(IPAddressOrRange_new)asm(""); | |||
262 | ||||
263 | void | |||
264 | IPAddressOrRange_free(IPAddressOrRange *a) | |||
265 | { | |||
266 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressOrRange_it); | |||
267 | } | |||
268 | LCRYPTO_ALIAS(IPAddressOrRange_free)asm(""); | |||
269 | ||||
270 | IPAddressChoice * | |||
271 | d2i_IPAddressChoice(IPAddressChoice **a, const unsigned char **in, long len) | |||
272 | { | |||
273 | return (IPAddressChoice *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
274 | &IPAddressChoice_it); | |||
275 | } | |||
276 | LCRYPTO_ALIAS(d2i_IPAddressChoice)asm(""); | |||
277 | ||||
278 | int | |||
279 | i2d_IPAddressChoice(IPAddressChoice *a, unsigned char **out) | |||
280 | { | |||
281 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressChoice_it); | |||
282 | } | |||
283 | LCRYPTO_ALIAS(i2d_IPAddressChoice)asm(""); | |||
284 | ||||
285 | IPAddressChoice * | |||
286 | IPAddressChoice_new(void) | |||
287 | { | |||
288 | return (IPAddressChoice *)ASN1_item_new(&IPAddressChoice_it); | |||
289 | } | |||
290 | LCRYPTO_ALIAS(IPAddressChoice_new)asm(""); | |||
291 | ||||
292 | void | |||
293 | IPAddressChoice_free(IPAddressChoice *a) | |||
294 | { | |||
295 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressChoice_it); | |||
296 | } | |||
297 | LCRYPTO_ALIAS(IPAddressChoice_free)asm(""); | |||
298 | ||||
299 | IPAddressFamily * | |||
300 | d2i_IPAddressFamily(IPAddressFamily **a, const unsigned char **in, long len) | |||
301 | { | |||
302 | return (IPAddressFamily *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, | |||
303 | &IPAddressFamily_it); | |||
304 | } | |||
305 | LCRYPTO_ALIAS(d2i_IPAddressFamily)asm(""); | |||
306 | ||||
307 | int | |||
308 | i2d_IPAddressFamily(IPAddressFamily *a, unsigned char **out) | |||
309 | { | |||
310 | return ASN1_item_i2d((ASN1_VALUE *)a, out, &IPAddressFamily_it); | |||
311 | } | |||
312 | LCRYPTO_ALIAS(i2d_IPAddressFamily)asm(""); | |||
313 | ||||
314 | IPAddressFamily * | |||
315 | IPAddressFamily_new(void) | |||
316 | { | |||
317 | return (IPAddressFamily *)ASN1_item_new(&IPAddressFamily_it); | |||
318 | } | |||
319 | LCRYPTO_ALIAS(IPAddressFamily_new)asm(""); | |||
320 | ||||
321 | void | |||
322 | IPAddressFamily_free(IPAddressFamily *a) | |||
323 | { | |||
324 | ASN1_item_free((ASN1_VALUE *)a, &IPAddressFamily_it); | |||
325 | } | |||
326 | LCRYPTO_ALIAS(IPAddressFamily_free)asm(""); | |||
327 | ||||
328 | /* | |||
329 | * Convenience accessors for IPAddressFamily. | |||
330 | */ | |||
331 | ||||
332 | static int | |||
333 | IPAddressFamily_type(IPAddressFamily *af) | |||
334 | { | |||
335 | /* XXX - can af->ipAddressChoice == NULL actually happen? */ | |||
336 | if (af == NULL((void *)0) || af->ipAddressChoice == NULL((void *)0)) | |||
337 | return -1; | |||
338 | ||||
339 | switch (af->ipAddressChoice->type) { | |||
340 | case IPAddressChoice_inherit0: | |||
341 | case IPAddressChoice_addressesOrRanges1: | |||
342 | return af->ipAddressChoice->type; | |||
343 | default: | |||
344 | return -1; | |||
345 | } | |||
346 | } | |||
347 | ||||
348 | static IPAddressOrRanges * | |||
349 | IPAddressFamily_addressesOrRanges(IPAddressFamily *af) | |||
350 | { | |||
351 | if (IPAddressFamily_type(af) == IPAddressChoice_addressesOrRanges1) | |||
352 | return af->ipAddressChoice->u.addressesOrRanges; | |||
353 | ||||
354 | return NULL((void *)0); | |||
355 | } | |||
356 | ||||
357 | static ASN1_NULL * | |||
358 | IPAddressFamily_inheritance(IPAddressFamily *af) | |||
359 | { | |||
360 | if (IPAddressFamily_type(af) == IPAddressChoice_inherit0) | |||
361 | return af->ipAddressChoice->u.inherit; | |||
362 | ||||
363 | return NULL((void *)0); | |||
364 | } | |||
365 | ||||
366 | static int | |||
367 | IPAddressFamily_set_inheritance(IPAddressFamily *af) | |||
368 | { | |||
369 | if (IPAddressFamily_addressesOrRanges(af) != NULL((void *)0)) | |||
370 | return 0; | |||
371 | ||||
372 | if (IPAddressFamily_inheritance(af) != NULL((void *)0)) | |||
373 | return 1; | |||
374 | ||||
375 | if ((af->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL((void *)0)) | |||
376 | return 0; | |||
377 | af->ipAddressChoice->type = IPAddressChoice_inherit0; | |||
378 | ||||
379 | return 1; | |||
380 | } | |||
381 | ||||
382 | /* | |||
383 | * How much buffer space do we need for a raw address? | |||
384 | */ | |||
385 | #define ADDR_RAW_BUF_LEN16 16 | |||
386 | ||||
387 | /* | |||
388 | * What's the address length associated with this AFI? | |||
389 | */ | |||
390 | static int | |||
391 | length_from_afi(const unsigned afi, int *length) | |||
392 | { | |||
393 | switch (afi) { | |||
394 | case IANA_AFI_IPV41: | |||
395 | *length = 4; | |||
396 | return 1; | |||
397 | case IANA_AFI_IPV62: | |||
398 | *length = 16; | |||
399 | return 1; | |||
400 | default: | |||
401 | *length = 0; | |||
402 | return 0; | |||
403 | } | |||
404 | } | |||
405 | ||||
406 | /* | |||
407 | * Get AFI and optional SAFI from an IPAddressFamily. All three out arguments | |||
408 | * are optional; if |out_safi| is non-NULL, |safi_is_set| must be non-NULL. | |||
409 | */ | |||
410 | static int | |||
411 | IPAddressFamily_afi_safi(const IPAddressFamily *af, uint16_t *out_afi, | |||
412 | uint8_t *out_safi, int *safi_is_set) | |||
413 | { | |||
414 | CBS cbs; | |||
415 | uint16_t afi; | |||
416 | uint8_t safi = 0; | |||
417 | int got_safi = 0; | |||
418 | ||||
419 | if (out_afi != NULL((void *)0)) | |||
420 | *out_afi = 0; | |||
421 | if (out_safi != NULL((void *)0)) { | |||
422 | *out_safi = 0; | |||
423 | *safi_is_set = 0; | |||
424 | } | |||
425 | ||||
426 | CBS_init(&cbs, af->addressFamily->data, af->addressFamily->length); | |||
427 | ||||
428 | if (!CBS_get_u16(&cbs, &afi)) | |||
429 | return 0; | |||
430 | ||||
431 | if (afi != IANA_AFI_IPV41 && afi != IANA_AFI_IPV62) | |||
432 | return 0; | |||
433 | ||||
434 | /* Fetch the optional SAFI. */ | |||
435 | if (CBS_len(&cbs) != 0) { | |||
436 | if (!CBS_get_u8(&cbs, &safi)) | |||
437 | return 0; | |||
438 | got_safi = 1; | |||
439 | } | |||
440 | ||||
441 | /* If there's anything left, it's garbage. */ | |||
442 | if (CBS_len(&cbs) != 0) | |||
443 | return 0; | |||
444 | ||||
445 | /* XXX - error on reserved AFI/SAFI? */ | |||
446 | ||||
447 | if (out_afi != NULL((void *)0)) | |||
448 | *out_afi = afi; | |||
449 | ||||
450 | if (out_safi != NULL((void *)0)) { | |||
451 | *out_safi = safi; | |||
452 | *safi_is_set = got_safi; | |||
453 | } | |||
454 | ||||
455 | return 1; | |||
456 | } | |||
457 | ||||
458 | static int | |||
459 | IPAddressFamily_afi(const IPAddressFamily *af, uint16_t *out_afi) | |||
460 | { | |||
461 | return IPAddressFamily_afi_safi(af, out_afi, NULL((void *)0), NULL((void *)0)); | |||
462 | } | |||
463 | ||||
464 | static int | |||
465 | IPAddressFamily_afi_is_valid(const IPAddressFamily *af) | |||
466 | { | |||
467 | return IPAddressFamily_afi_safi(af, NULL((void *)0), NULL((void *)0), NULL((void *)0)); | |||
468 | } | |||
469 | ||||
470 | static int | |||
471 | IPAddressFamily_afi_length(const IPAddressFamily *af, int *out_length) | |||
472 | { | |||
473 | uint16_t afi; | |||
474 | ||||
475 | *out_length = 0; | |||
476 | ||||
477 | if (!IPAddressFamily_afi(af, &afi)) | |||
478 | return 0; | |||
479 | ||||
480 | return length_from_afi(afi, out_length); | |||
481 | } | |||
482 | ||||
483 | #define MINIMUM(a, b)(((a) < (b)) ? (a) : (b)) (((a) < (b)) ? (a) : (b)) | |||
484 | ||||
485 | /* | |||
486 | * Sort comparison function for a sequence of IPAddressFamily. | |||
487 | * | |||
488 | * The last paragraph of RFC 3779 2.2.3.3 is slightly ambiguous about | |||
489 | * the ordering: I can read it as meaning that IPv6 without a SAFI | |||
490 | * comes before IPv4 with a SAFI, which seems pretty weird. The | |||
491 | * examples in appendix B suggest that the author intended the | |||
492 | * null-SAFI rule to apply only within a single AFI, which is what I | |||
493 | * would have expected and is what the following code implements. | |||
494 | */ | |||
495 | static int | |||
496 | IPAddressFamily_cmp(const IPAddressFamily *const *a_, | |||
497 | const IPAddressFamily *const *b_) | |||
498 | { | |||
499 | const ASN1_OCTET_STRING *a = (*a_)->addressFamily; | |||
500 | const ASN1_OCTET_STRING *b = (*b_)->addressFamily; | |||
501 | int len, cmp; | |||
502 | ||||
503 | len = MINIMUM(a->length, b->length)(((a->length) < (b->length)) ? (a->length) : (b-> length)); | |||
504 | ||||
505 | if ((cmp = memcmp(a->data, b->data, len)) != 0) | |||
506 | return cmp; | |||
507 | ||||
508 | return a->length - b->length; | |||
509 | } | |||
510 | ||||
511 | static IPAddressFamily * | |||
512 | IPAddressFamily_find_in_parent(IPAddrBlocks *parent, IPAddressFamily *child_af) | |||
513 | { | |||
514 | int index; | |||
515 | ||||
516 | (void)sk_IPAddressFamily_set_cmp_func(parent, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
517 | ||||
518 | if ((index = sk_IPAddressFamily_find(parent, child_af)sk_find(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily *)0)), ((void*) (1 ? (child_af) : (IPAddressFamily*)0)))) < 0) | |||
519 | return NULL((void *)0); | |||
520 | ||||
521 | return sk_IPAddressFamily_value(parent, index)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), (index))); | |||
522 | } | |||
523 | ||||
524 | /* | |||
525 | * Extract the AFI from an IPAddressFamily. | |||
526 | * | |||
527 | * This is public API. It uses the reserved AFI 0 as an in-band error | |||
528 | * while it doesn't care about the reserved AFI 65535... | |||
529 | */ | |||
530 | unsigned int | |||
531 | X509v3_addr_get_afi(const IPAddressFamily *af) | |||
532 | { | |||
533 | uint16_t afi; | |||
534 | ||||
535 | /* | |||
536 | * XXX are these NULL checks really sensible? If af is non-NULL, it | |||
537 | * should have both addressFamily and ipAddressChoice... | |||
538 | */ | |||
539 | if (af == NULL((void *)0) || af->addressFamily == NULL((void *)0) || | |||
540 | af->addressFamily->data == NULL((void *)0)) | |||
541 | return 0; | |||
542 | ||||
543 | if (!IPAddressFamily_afi(af, &afi)) | |||
544 | return 0; | |||
545 | ||||
546 | return afi; | |||
547 | } | |||
548 | LCRYPTO_ALIAS(X509v3_addr_get_afi)asm(""); | |||
549 | ||||
550 | /* | |||
551 | * Expand the bitstring form (RFC 3779, section 2.1.2) of an address into | |||
552 | * a raw byte array. At the moment this is coded for simplicity, not speed. | |||
553 | * | |||
554 | * Unused bits in the last octet of |bs| and all bits in subsequent bytes | |||
555 | * of |addr| are set to 0 or 1 depending on whether |fill| is 0 or not. | |||
556 | */ | |||
557 | static int | |||
558 | addr_expand(unsigned char *addr, const ASN1_BIT_STRING *bs, const int length, | |||
559 | uint8_t fill) | |||
560 | { | |||
561 | if (bs->length < 0 || bs->length > length) | |||
562 | return 0; | |||
563 | ||||
564 | if (fill != 0) | |||
565 | fill = 0xff; | |||
566 | ||||
567 | if (bs->length > 0) { | |||
568 | /* XXX - shouldn't this check ASN1_STRING_FLAG_BITS_LEFT? */ | |||
569 | uint8_t unused_bits = bs->flags & 7; | |||
570 | uint8_t mask = (1 << unused_bits) - 1; | |||
571 | ||||
572 | memcpy(addr, bs->data, bs->length); | |||
573 | ||||
574 | if (fill == 0) | |||
575 | addr[bs->length - 1] &= ~mask; | |||
576 | else | |||
577 | addr[bs->length - 1] |= mask; | |||
578 | } | |||
579 | ||||
580 | memset(addr + bs->length, fill, length - bs->length); | |||
581 | ||||
582 | return 1; | |||
583 | } | |||
584 | ||||
585 | /* | |||
586 | * Extract the prefix length from a bitstring: 8 * length - unused bits. | |||
587 | */ | |||
588 | #define addr_prefix_len(bs)((int) ((bs)->length * 8 - ((bs)->flags & 7))) ((int) ((bs)->length * 8 - ((bs)->flags & 7))) | |||
589 | ||||
590 | /* | |||
591 | * i2r handler for one address bitstring. | |||
592 | */ | |||
593 | static int | |||
594 | i2r_address(BIO *out, const unsigned afi, const unsigned char fill, | |||
595 | const ASN1_BIT_STRING *bs) | |||
596 | { | |||
597 | unsigned char addr[ADDR_RAW_BUF_LEN16]; | |||
598 | int i, n; | |||
599 | ||||
600 | if (bs->length < 0) | |||
601 | return 0; | |||
602 | switch (afi) { | |||
603 | case IANA_AFI_IPV41: | |||
604 | if (!addr_expand(addr, bs, 4, fill)) | |||
605 | return 0; | |||
606 | BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], | |||
607 | addr[3]); | |||
608 | break; | |||
609 | case IANA_AFI_IPV62: | |||
610 | if (!addr_expand(addr, bs, 16, fill)) | |||
611 | return 0; | |||
612 | for (n = 16; | |||
613 | n > 1 && addr[n - 1] == 0x00 && addr[n - 2] == 0x00; n -= 2) | |||
614 | continue; | |||
615 | for (i = 0; i < n; i += 2) | |||
616 | BIO_printf(out, "%x%s", (addr[i] << 8) | addr[i + 1], | |||
617 | (i < 14 ? ":" : "")); | |||
618 | if (i < 16) | |||
619 | BIO_puts(out, ":"); | |||
620 | if (i == 0) | |||
621 | BIO_puts(out, ":"); | |||
622 | break; | |||
623 | default: | |||
624 | for (i = 0; i < bs->length; i++) | |||
625 | BIO_printf(out, "%s%02x", (i > 0 ? ":" : ""), | |||
626 | bs->data[i]); | |||
627 | BIO_printf(out, "[%d]", (int)(bs->flags & 7)); | |||
628 | break; | |||
629 | } | |||
630 | return 1; | |||
631 | } | |||
632 | ||||
633 | /* | |||
634 | * i2r handler for a sequence of addresses and ranges. | |||
635 | */ | |||
636 | static int | |||
637 | i2r_IPAddressOrRanges(BIO *out, const int indent, | |||
638 | const IPAddressOrRanges *aors, const unsigned afi) | |||
639 | { | |||
640 | const IPAddressOrRange *aor; | |||
641 | const ASN1_BIT_STRING *prefix; | |||
642 | const IPAddressRange *range; | |||
643 | int i; | |||
644 | ||||
645 | for (i = 0; i < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))); i++) { | |||
646 | aor = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
647 | ||||
648 | BIO_printf(out, "%*s", indent, ""); | |||
649 | ||||
650 | switch (aor->type) { | |||
651 | case IPAddressOrRange_addressPrefix0: | |||
652 | prefix = aor->u.addressPrefix; | |||
653 | ||||
654 | if (!i2r_address(out, afi, 0x00, prefix)) | |||
655 | return 0; | |||
656 | BIO_printf(out, "/%d\n", addr_prefix_len(prefix)((int) ((prefix)->length * 8 - ((prefix)->flags & 7 )))); | |||
657 | continue; | |||
658 | case IPAddressOrRange_addressRange1: | |||
659 | range = aor->u.addressRange; | |||
660 | ||||
661 | if (!i2r_address(out, afi, 0x00, range->min)) | |||
662 | return 0; | |||
663 | BIO_puts(out, "-"); | |||
664 | if (!i2r_address(out, afi, 0xff, range->max)) | |||
665 | return 0; | |||
666 | BIO_puts(out, "\n"); | |||
667 | continue; | |||
668 | } | |||
669 | } | |||
670 | ||||
671 | return 1; | |||
672 | } | |||
673 | ||||
674 | /* | |||
675 | * i2r handler for an IPAddrBlocks extension. | |||
676 | */ | |||
677 | static int | |||
678 | i2r_IPAddrBlocks(const X509V3_EXT_METHOD *method, void *ext, BIO *out, | |||
679 | int indent) | |||
680 | { | |||
681 | const IPAddrBlocks *addr = ext; | |||
682 | IPAddressFamily *af; | |||
683 | uint16_t afi; | |||
684 | uint8_t safi; | |||
685 | int i, safi_is_set; | |||
686 | ||||
687 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
688 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
689 | ||||
690 | if (!IPAddressFamily_afi_safi(af, &afi, &safi, &safi_is_set)) | |||
691 | goto print_addresses; | |||
692 | ||||
693 | switch (afi) { | |||
694 | case IANA_AFI_IPV41: | |||
695 | BIO_printf(out, "%*sIPv4", indent, ""); | |||
696 | break; | |||
697 | case IANA_AFI_IPV62: | |||
698 | BIO_printf(out, "%*sIPv6", indent, ""); | |||
699 | break; | |||
700 | default: | |||
701 | BIO_printf(out, "%*sUnknown AFI %u", indent, "", afi); | |||
702 | break; | |||
703 | } | |||
704 | if (safi_is_set) { | |||
705 | switch (safi) { | |||
706 | case 1: | |||
707 | BIO_puts(out, " (Unicast)"); | |||
708 | break; | |||
709 | case 2: | |||
710 | BIO_puts(out, " (Multicast)"); | |||
711 | break; | |||
712 | case 3: | |||
713 | BIO_puts(out, " (Unicast/Multicast)"); | |||
714 | break; | |||
715 | case 4: | |||
716 | BIO_puts(out, " (MPLS)"); | |||
717 | break; | |||
718 | case 64: | |||
719 | BIO_puts(out, " (Tunnel)"); | |||
720 | break; | |||
721 | case 65: | |||
722 | BIO_puts(out, " (VPLS)"); | |||
723 | break; | |||
724 | case 66: | |||
725 | BIO_puts(out, " (BGP MDT)"); | |||
726 | break; | |||
727 | case 128: | |||
728 | BIO_puts(out, " (MPLS-labeled VPN)"); | |||
729 | break; | |||
730 | default: | |||
731 | BIO_printf(out, " (Unknown SAFI %u)", safi); | |||
732 | break; | |||
733 | } | |||
734 | } | |||
735 | ||||
736 | print_addresses: | |||
737 | switch (IPAddressFamily_type(af)) { | |||
738 | case IPAddressChoice_inherit0: | |||
739 | BIO_puts(out, ": inherit\n"); | |||
740 | break; | |||
741 | case IPAddressChoice_addressesOrRanges1: | |||
742 | BIO_puts(out, ":\n"); | |||
743 | if (!i2r_IPAddressOrRanges(out, indent + 2, | |||
744 | IPAddressFamily_addressesOrRanges(af), afi)) | |||
745 | return 0; | |||
746 | break; | |||
747 | /* XXX - how should we handle -1 here? */ | |||
748 | } | |||
749 | } | |||
750 | return 1; | |||
751 | } | |||
752 | ||||
753 | /* | |||
754 | * Sort comparison function for a sequence of IPAddressOrRange | |||
755 | * elements. | |||
756 | * | |||
757 | * There's no sane answer we can give if addr_expand() fails, and an | |||
758 | * assertion failure on externally supplied data is seriously uncool, | |||
759 | * so we just arbitrarily declare that if given invalid inputs this | |||
760 | * function returns -1. If this messes up your preferred sort order | |||
761 | * for garbage input, tough noogies. | |||
762 | */ | |||
763 | static int | |||
764 | IPAddressOrRange_cmp(const IPAddressOrRange *a, const IPAddressOrRange *b, | |||
765 | const int length) | |||
766 | { | |||
767 | unsigned char addr_a[ADDR_RAW_BUF_LEN16], addr_b[ADDR_RAW_BUF_LEN16]; | |||
768 | int prefix_len_a = 0, prefix_len_b = 0; | |||
769 | int r; | |||
770 | ||||
771 | switch (a->type) { | |||
772 | case IPAddressOrRange_addressPrefix0: | |||
773 | if (!addr_expand(addr_a, a->u.addressPrefix, length, 0x00)) | |||
774 | return -1; | |||
775 | prefix_len_a = addr_prefix_len(a->u.addressPrefix)((int) ((a->u.addressPrefix)->length * 8 - ((a->u.addressPrefix )->flags & 7))); | |||
776 | break; | |||
777 | case IPAddressOrRange_addressRange1: | |||
778 | if (!addr_expand(addr_a, a->u.addressRange->min, length, 0x00)) | |||
779 | return -1; | |||
780 | prefix_len_a = length * 8; | |||
781 | break; | |||
782 | } | |||
783 | ||||
784 | switch (b->type) { | |||
785 | case IPAddressOrRange_addressPrefix0: | |||
786 | if (!addr_expand(addr_b, b->u.addressPrefix, length, 0x00)) | |||
787 | return -1; | |||
788 | prefix_len_b = addr_prefix_len(b->u.addressPrefix)((int) ((b->u.addressPrefix)->length * 8 - ((b->u.addressPrefix )->flags & 7))); | |||
789 | break; | |||
790 | case IPAddressOrRange_addressRange1: | |||
791 | if (!addr_expand(addr_b, b->u.addressRange->min, length, 0x00)) | |||
792 | return -1; | |||
793 | prefix_len_b = length * 8; | |||
794 | break; | |||
795 | } | |||
796 | ||||
797 | if ((r = memcmp(addr_a, addr_b, length)) != 0) | |||
798 | return r; | |||
799 | else | |||
800 | return prefix_len_a - prefix_len_b; | |||
801 | } | |||
802 | ||||
803 | /* | |||
804 | * IPv4-specific closure over IPAddressOrRange_cmp, since sk_sort() | |||
805 | * comparison routines are only allowed two arguments. | |||
806 | */ | |||
807 | static int | |||
808 | v4IPAddressOrRange_cmp(const IPAddressOrRange *const *a, | |||
809 | const IPAddressOrRange *const *b) | |||
810 | { | |||
811 | return IPAddressOrRange_cmp(*a, *b, 4); | |||
812 | } | |||
813 | ||||
814 | /* | |||
815 | * IPv6-specific closure over IPAddressOrRange_cmp, since sk_sort() | |||
816 | * comparison routines are only allowed two arguments. | |||
817 | */ | |||
818 | static int | |||
819 | v6IPAddressOrRange_cmp(const IPAddressOrRange *const *a, | |||
820 | const IPAddressOrRange *const *b) | |||
821 | { | |||
822 | return IPAddressOrRange_cmp(*a, *b, 16); | |||
823 | } | |||
824 | ||||
825 | /* | |||
826 | * Calculate whether a range collapses to a prefix. | |||
827 | * See last paragraph of RFC 3779 2.2.3.7. | |||
828 | * | |||
829 | * It's the caller's responsibility to ensure that min <= max. | |||
830 | */ | |||
831 | static int | |||
832 | range_should_be_prefix(const unsigned char *min, const unsigned char *max, | |||
833 | const int length) | |||
834 | { | |||
835 | unsigned char mask; | |||
836 | int i, j; | |||
837 | ||||
838 | for (i = 0; i < length && min[i] == max[i]; i++) | |||
839 | continue; | |||
840 | for (j = length - 1; j >= 0 && min[j] == 0x00 && max[j] == 0xff; j--) | |||
841 | continue; | |||
842 | if (i < j) | |||
843 | return -1; | |||
844 | if (i > j) | |||
845 | return i * 8; | |||
846 | mask = min[i] ^ max[i]; | |||
847 | switch (mask) { | |||
848 | case 0x01: | |||
849 | j = 7; | |||
850 | break; | |||
851 | case 0x03: | |||
852 | j = 6; | |||
853 | break; | |||
854 | case 0x07: | |||
855 | j = 5; | |||
856 | break; | |||
857 | case 0x0f: | |||
858 | j = 4; | |||
859 | break; | |||
860 | case 0x1f: | |||
861 | j = 3; | |||
862 | break; | |||
863 | case 0x3f: | |||
864 | j = 2; | |||
865 | break; | |||
866 | case 0x7f: | |||
867 | j = 1; | |||
868 | break; | |||
869 | default: | |||
870 | return -1; | |||
871 | } | |||
872 | if ((min[i] & mask) != 0 || (max[i] & mask) != mask) | |||
873 | return -1; | |||
874 | else | |||
875 | return i * 8 + j; | |||
876 | } | |||
877 | ||||
878 | /* | |||
879 | * Fill IPAddressOrRange with bit string encoding of a prefix - RFC 3779, 2.1.1. | |||
880 | */ | |||
881 | static int | |||
882 | make_addressPrefix(IPAddressOrRange **out_aor, uint8_t *addr, uint32_t afi, | |||
883 | int prefix_len) | |||
884 | { | |||
885 | IPAddressOrRange *aor = NULL((void *)0); | |||
886 | int afi_len, num_bits, num_octets; | |||
887 | uint8_t unused_bits; | |||
888 | ||||
889 | if (prefix_len < 0) | |||
890 | goto err; | |||
891 | ||||
892 | if (!length_from_afi(afi, &afi_len)) | |||
893 | goto err; | |||
894 | if (prefix_len > 8 * afi_len) | |||
895 | goto err; | |||
896 | ||||
897 | num_octets = (prefix_len + 7) / 8; | |||
898 | num_bits = prefix_len % 8; | |||
899 | ||||
900 | unused_bits = 0; | |||
901 | if (num_bits > 0) | |||
902 | unused_bits = 8 - num_bits; | |||
903 | ||||
904 | if ((aor = IPAddressOrRange_new()) == NULL((void *)0)) | |||
905 | goto err; | |||
906 | ||||
907 | aor->type = IPAddressOrRange_addressPrefix0; | |||
908 | ||||
909 | if ((aor->u.addressPrefix = ASN1_BIT_STRING_new()) == NULL((void *)0)) | |||
910 | goto err; | |||
911 | if (!ASN1_BIT_STRING_set(aor->u.addressPrefix, addr, num_octets)) | |||
912 | goto err; | |||
913 | if (!asn1_abs_set_unused_bits(aor->u.addressPrefix, unused_bits)) | |||
914 | goto err; | |||
915 | ||||
916 | *out_aor = aor; | |||
917 | return 1; | |||
918 | ||||
919 | err: | |||
920 | IPAddressOrRange_free(aor); | |||
921 | return 0; | |||
922 | } | |||
923 | ||||
924 | static uint8_t | |||
925 | count_trailing_zeroes(uint8_t octet) | |||
926 | { | |||
927 | uint8_t count = 0; | |||
928 | ||||
929 | if (octet == 0) | |||
930 | return 8; | |||
931 | ||||
932 | while ((octet & (1 << count)) == 0) | |||
933 | count++; | |||
934 | ||||
935 | return count; | |||
936 | } | |||
937 | ||||
938 | static int | |||
939 | trim_end_u8(CBS *cbs, uint8_t trim) | |||
940 | { | |||
941 | uint8_t octet; | |||
942 | ||||
943 | while (CBS_len(cbs) > 0) { | |||
944 | if (!CBS_peek_last_u8(cbs, &octet)) | |||
945 | return 0; | |||
946 | if (octet != trim) | |||
947 | return 1; | |||
948 | if (!CBS_get_last_u8(cbs, &octet)) | |||
949 | return 0; | |||
950 | } | |||
951 | ||||
952 | return 1; | |||
953 | } | |||
954 | ||||
955 | /* | |||
956 | * Populate IPAddressOrRange with bit string encoding of a range, see | |||
957 | * RFC 3779, 2.1.2. | |||
958 | */ | |||
959 | static int | |||
960 | make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max, | |||
961 | uint32_t afi, int length) | |||
962 | { | |||
963 | IPAddressOrRange *aor = NULL((void *)0); | |||
964 | IPAddressRange *range; | |||
965 | int prefix_len; | |||
966 | CBS cbs; | |||
967 | size_t max_len, min_len; | |||
968 | uint8_t unused_bits_min, unused_bits_max; | |||
969 | uint8_t octet; | |||
970 | ||||
971 | if (memcmp(min, max, length) > 0) | |||
972 | goto err; | |||
973 | ||||
974 | /* | |||
975 | * RFC 3779, 2.2.3.6 - a range that can be expressed as a prefix | |||
976 | * must be encoded as a prefix. | |||
977 | */ | |||
978 | ||||
979 | if ((prefix_len = range_should_be_prefix(min, max, length)) >= 0) | |||
980 | return make_addressPrefix(out_aor, min, afi, prefix_len); | |||
981 | ||||
982 | /* | |||
983 | * The bit string representing min is formed by removing all its | |||
984 | * trailing zero bits, so remove all trailing zero octets and count | |||
985 | * the trailing zero bits of the last octet. | |||
986 | */ | |||
987 | ||||
988 | CBS_init(&cbs, min, length); | |||
989 | ||||
990 | if (!trim_end_u8(&cbs, 0x00)) | |||
991 | goto err; | |||
992 | ||||
993 | unused_bits_min = 0; | |||
994 | if ((min_len = CBS_len(&cbs)) > 0) { | |||
995 | if (!CBS_peek_last_u8(&cbs, &octet)) | |||
996 | goto err; | |||
997 | ||||
998 | unused_bits_min = count_trailing_zeroes(octet); | |||
999 | } | |||
1000 | ||||
1001 | /* | |||
1002 | * The bit string representing max is formed by removing all its | |||
1003 | * trailing one bits, so remove all trailing 0xff octets and count | |||
1004 | * the trailing ones of the last octet. | |||
1005 | */ | |||
1006 | ||||
1007 | CBS_init(&cbs, max, length); | |||
1008 | ||||
1009 | if (!trim_end_u8(&cbs, 0xff)) | |||
1010 | goto err; | |||
1011 | ||||
1012 | unused_bits_max = 0; | |||
1013 | if ((max_len = CBS_len(&cbs)) > 0) { | |||
1014 | if (!CBS_peek_last_u8(&cbs, &octet)) | |||
1015 | goto err; | |||
1016 | ||||
1017 | unused_bits_max = count_trailing_zeroes(octet + 1); | |||
1018 | } | |||
1019 | ||||
1020 | /* | |||
1021 | * Populate IPAddressOrRange. | |||
1022 | */ | |||
1023 | ||||
1024 | if ((aor = IPAddressOrRange_new()) == NULL((void *)0)) | |||
1025 | goto err; | |||
1026 | ||||
1027 | aor->type = IPAddressOrRange_addressRange1; | |||
1028 | ||||
1029 | if ((range = aor->u.addressRange = IPAddressRange_new()) == NULL((void *)0)) | |||
1030 | goto err; | |||
1031 | ||||
1032 | if (!ASN1_BIT_STRING_set(range->min, min, min_len)) | |||
1033 | goto err; | |||
1034 | if (!asn1_abs_set_unused_bits(range->min, unused_bits_min)) | |||
1035 | goto err; | |||
1036 | ||||
1037 | if (!ASN1_BIT_STRING_set(range->max, max, max_len)) | |||
1038 | goto err; | |||
1039 | if (!asn1_abs_set_unused_bits(range->max, unused_bits_max)) | |||
1040 | goto err; | |||
1041 | ||||
1042 | *out_aor = aor; | |||
1043 | ||||
1044 | return 1; | |||
1045 | ||||
1046 | err: | |||
1047 | IPAddressOrRange_free(aor); | |||
1048 | return 0; | |||
1049 | } | |||
1050 | ||||
1051 | /* | |||
1052 | * Construct a new address family or find an existing one. | |||
1053 | */ | |||
1054 | static IPAddressFamily * | |||
1055 | make_IPAddressFamily(IPAddrBlocks *addr, const unsigned afi, | |||
1056 | const unsigned *safi) | |||
1057 | { | |||
1058 | IPAddressFamily *af = NULL((void *)0); | |||
1059 | CBB cbb; | |||
1060 | CBS cbs; | |||
1061 | uint8_t *key = NULL((void *)0); | |||
1062 | size_t keylen; | |||
1063 | int i; | |||
1064 | ||||
1065 | if (!CBB_init(&cbb, 0)) | |||
1066 | goto err; | |||
1067 | ||||
1068 | if (afi != IANA_AFI_IPV41 && afi != IANA_AFI_IPV62) | |||
1069 | goto err; | |||
1070 | if (!CBB_add_u16(&cbb, afi)) | |||
1071 | goto err; | |||
1072 | ||||
1073 | if (safi != NULL((void *)0)) { | |||
1074 | if (*safi > 255) | |||
1075 | goto err; | |||
1076 | if (!CBB_add_u8(&cbb, *safi)) | |||
1077 | goto err; | |||
1078 | } | |||
1079 | ||||
1080 | if (!CBB_finish(&cbb, &key, &keylen)) | |||
1081 | goto err; | |||
1082 | ||||
1083 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1084 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1085 | ||||
1086 | CBS_init(&cbs, af->addressFamily->data, | |||
1087 | af->addressFamily->length); | |||
1088 | if (CBS_mem_equal(&cbs, key, keylen)) | |||
1089 | goto done; | |||
1090 | } | |||
1091 | ||||
1092 | if ((af = IPAddressFamily_new()) == NULL((void *)0)) | |||
1093 | goto err; | |||
1094 | if (!ASN1_OCTET_STRING_set(af->addressFamily, key, keylen)) | |||
1095 | goto err; | |||
1096 | if (!sk_IPAddressFamily_push(addr, af)sk_push(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0)), ((void*) (1 ? (af) : (IPAddressFamily*)0)))) | |||
1097 | goto err; | |||
1098 | ||||
1099 | done: | |||
1100 | free(key); | |||
1101 | ||||
1102 | return af; | |||
1103 | ||||
1104 | err: | |||
1105 | CBB_cleanup(&cbb); | |||
1106 | free(key); | |||
1107 | IPAddressFamily_free(af); | |||
1108 | ||||
1109 | return NULL((void *)0); | |||
1110 | } | |||
1111 | ||||
1112 | /* | |||
1113 | * Add an inheritance element. | |||
1114 | */ | |||
1115 | int | |||
1116 | X509v3_addr_add_inherit(IPAddrBlocks *addr, const unsigned afi, | |||
1117 | const unsigned *safi) | |||
1118 | { | |||
1119 | IPAddressFamily *af; | |||
1120 | ||||
1121 | if ((af = make_IPAddressFamily(addr, afi, safi)) == NULL((void *)0)) | |||
1122 | return 0; | |||
1123 | ||||
1124 | return IPAddressFamily_set_inheritance(af); | |||
1125 | } | |||
1126 | LCRYPTO_ALIAS(X509v3_addr_add_inherit)asm(""); | |||
1127 | ||||
1128 | /* | |||
1129 | * Construct an IPAddressOrRange sequence, or return an existing one. | |||
1130 | */ | |||
1131 | static IPAddressOrRanges * | |||
1132 | make_prefix_or_range(IPAddrBlocks *addr, const unsigned afi, | |||
1133 | const unsigned *safi) | |||
1134 | { | |||
1135 | IPAddressFamily *af; | |||
1136 | IPAddressOrRanges *aors = NULL((void *)0); | |||
1137 | ||||
1138 | if ((af = make_IPAddressFamily(addr, afi, safi)) == NULL((void *)0)) | |||
1139 | return NULL((void *)0); | |||
1140 | ||||
1141 | if (IPAddressFamily_inheritance(af) != NULL((void *)0)) | |||
1142 | return NULL((void *)0); | |||
1143 | ||||
1144 | if ((aors = IPAddressFamily_addressesOrRanges(af)) != NULL((void *)0)) | |||
1145 | return aors; | |||
1146 | ||||
1147 | if ((aors = sk_IPAddressOrRange_new_null()((struct stack_st_IPAddressOrRange *)sk_new_null())) == NULL((void *)0)) | |||
1148 | return NULL((void *)0); | |||
1149 | ||||
1150 | switch (afi) { | |||
1151 | case IANA_AFI_IPV41: | |||
1152 | (void)sk_IPAddressOrRange_set_cmp_func(aors,((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v4IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))) | |||
1153 | v4IPAddressOrRange_cmp)((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v4IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))); | |||
1154 | break; | |||
1155 | case IANA_AFI_IPV62: | |||
1156 | (void)sk_IPAddressOrRange_set_cmp_func(aors,((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v6IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))) | |||
1157 | v6IPAddressOrRange_cmp)((int (*)(const IPAddressOrRange * const *,const IPAddressOrRange * const *)) sk_set_cmp_func(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), ((int (*)(const void *, const void *)) ((1 ? (v6IPAddressOrRange_cmp) : (int (*)(const IPAddressOrRange * const *, const IPAddressOrRange * const *))0))))); | |||
1158 | break; | |||
1159 | } | |||
1160 | ||||
1161 | af->ipAddressChoice->type = IPAddressChoice_addressesOrRanges1; | |||
1162 | af->ipAddressChoice->u.addressesOrRanges = aors; | |||
1163 | ||||
1164 | return aors; | |||
1165 | } | |||
1166 | ||||
1167 | /* | |||
1168 | * Add a prefix. | |||
1169 | */ | |||
1170 | int | |||
1171 | X509v3_addr_add_prefix(IPAddrBlocks *addr, const unsigned afi, | |||
1172 | const unsigned *safi, unsigned char *a, const int prefix_len) | |||
1173 | { | |||
1174 | IPAddressOrRanges *aors; | |||
1175 | IPAddressOrRange *aor; | |||
1176 | ||||
1177 | if ((aors = make_prefix_or_range(addr, afi, safi)) == NULL((void *)0)) | |||
1178 | return 0; | |||
1179 | ||||
1180 | if (!make_addressPrefix(&aor, a, afi, prefix_len)) | |||
1181 | return 0; | |||
1182 | ||||
1183 | if (sk_IPAddressOrRange_push(aors, aor)sk_push(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), ((void*) (1 ? (aor) : (IPAddressOrRange*)0))) <= 0) { | |||
1184 | IPAddressOrRange_free(aor); | |||
1185 | return 0; | |||
1186 | } | |||
1187 | ||||
1188 | return 1; | |||
1189 | } | |||
1190 | LCRYPTO_ALIAS(X509v3_addr_add_prefix)asm(""); | |||
1191 | ||||
1192 | /* | |||
1193 | * Add a range. | |||
1194 | */ | |||
1195 | int | |||
1196 | X509v3_addr_add_range(IPAddrBlocks *addr, const unsigned afi, | |||
1197 | const unsigned *safi, unsigned char *min, unsigned char *max) | |||
1198 | { | |||
1199 | IPAddressOrRanges *aors; | |||
1200 | IPAddressOrRange *aor; | |||
1201 | int length; | |||
1202 | ||||
1203 | if ((aors = make_prefix_or_range(addr, afi, safi)) == NULL((void *)0)) | |||
1204 | return 0; | |||
1205 | ||||
1206 | if (!length_from_afi(afi, &length)) | |||
1207 | return 0; | |||
1208 | ||||
1209 | if (!make_addressRange(&aor, min, max, afi, length)) | |||
1210 | return 0; | |||
1211 | ||||
1212 | if (sk_IPAddressOrRange_push(aors, aor)sk_push(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), ((void*) (1 ? (aor) : (IPAddressOrRange*)0))) <= 0) { | |||
1213 | IPAddressOrRange_free(aor); | |||
1214 | return 0; | |||
1215 | } | |||
1216 | ||||
1217 | return 1; | |||
1218 | } | |||
1219 | LCRYPTO_ALIAS(X509v3_addr_add_range)asm(""); | |||
1220 | ||||
1221 | static int | |||
1222 | extract_min_max_bitstr(IPAddressOrRange *aor, ASN1_BIT_STRING **out_min, | |||
1223 | ASN1_BIT_STRING **out_max) | |||
1224 | { | |||
1225 | switch (aor->type) { | |||
1226 | case IPAddressOrRange_addressPrefix0: | |||
1227 | *out_min = *out_max = aor->u.addressPrefix; | |||
1228 | return 1; | |||
1229 | case IPAddressOrRange_addressRange1: | |||
1230 | *out_min = aor->u.addressRange->min; | |||
1231 | *out_max = aor->u.addressRange->max; | |||
1232 | return 1; | |||
1233 | default: | |||
1234 | return 0; | |||
1235 | } | |||
1236 | } | |||
1237 | ||||
1238 | /* | |||
1239 | * Extract min and max values from an IPAddressOrRange. | |||
1240 | */ | |||
1241 | static int | |||
1242 | extract_min_max(IPAddressOrRange *aor, unsigned char *min, unsigned char *max, | |||
1243 | int length) | |||
1244 | { | |||
1245 | ASN1_BIT_STRING *min_bitstr, *max_bitstr; | |||
1246 | ||||
1247 | if (aor == NULL((void *)0) || min == NULL((void *)0) || max == NULL((void *)0)) | |||
1248 | return 0; | |||
1249 | ||||
1250 | if (!extract_min_max_bitstr(aor, &min_bitstr, &max_bitstr)) | |||
1251 | return 0; | |||
1252 | ||||
1253 | if (!addr_expand(min, min_bitstr, length, 0)) | |||
1254 | return 0; | |||
1255 | ||||
1256 | return addr_expand(max, max_bitstr, length, 1); | |||
1257 | } | |||
1258 | ||||
1259 | /* | |||
1260 | * Public wrapper for extract_min_max(). | |||
1261 | */ | |||
1262 | int | |||
1263 | X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi, | |||
1264 | unsigned char *min, unsigned char *max, const int length) | |||
1265 | { | |||
1266 | int afi_len; | |||
1267 | ||||
1268 | if (!length_from_afi(afi, &afi_len)) | |||
1269 | return 0; | |||
1270 | ||||
1271 | if (length < afi_len) | |||
1272 | return 0; | |||
1273 | ||||
1274 | if (!extract_min_max(aor, min, max, afi_len)) | |||
1275 | return 0; | |||
1276 | ||||
1277 | return afi_len; | |||
1278 | } | |||
1279 | LCRYPTO_ALIAS(X509v3_addr_get_range)asm(""); | |||
1280 | ||||
1281 | /* | |||
1282 | * Check whether an IPAddrBLocks is in canonical form. | |||
1283 | */ | |||
1284 | int | |||
1285 | X509v3_addr_is_canonical(IPAddrBlocks *addr) | |||
1286 | { | |||
1287 | unsigned char a_min[ADDR_RAW_BUF_LEN16], a_max[ADDR_RAW_BUF_LEN16]; | |||
1288 | unsigned char b_min[ADDR_RAW_BUF_LEN16], b_max[ADDR_RAW_BUF_LEN16]; | |||
1289 | IPAddressFamily *af; | |||
1290 | IPAddressOrRanges *aors; | |||
1291 | IPAddressOrRange *aor, *aor_a, *aor_b; | |||
1292 | int i, j, k, length; | |||
1293 | ||||
1294 | /* | |||
1295 | * Empty extension is canonical. | |||
1296 | */ | |||
1297 | if (addr == NULL((void *)0)) | |||
1298 | return 1; | |||
1299 | ||||
1300 | /* | |||
1301 | * Check whether the top-level list is in order. | |||
1302 | */ | |||
1303 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))) - 1; i++) { | |||
1304 | const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1305 | const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i + 1))); | |||
1306 | ||||
1307 | /* Check that both have valid AFIs before comparing them. */ | |||
1308 | if (!IPAddressFamily_afi_is_valid(a)) | |||
1309 | return 0; | |||
1310 | if (!IPAddressFamily_afi_is_valid(b)) | |||
1311 | return 0; | |||
1312 | ||||
1313 | if (IPAddressFamily_cmp(&a, &b) >= 0) | |||
1314 | return 0; | |||
1315 | } | |||
1316 | ||||
1317 | /* | |||
1318 | * Top level's ok, now check each address family. | |||
1319 | */ | |||
1320 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1321 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1322 | ||||
1323 | if (!IPAddressFamily_afi_length(af, &length)) | |||
1324 | return 0; | |||
1325 | ||||
1326 | /* | |||
1327 | * If this family has an inheritance element, it is canonical. | |||
1328 | */ | |||
1329 | if (IPAddressFamily_inheritance(af) != NULL((void *)0)) | |||
1330 | continue; | |||
1331 | ||||
1332 | /* | |||
1333 | * If this family has neither an inheritance element nor an | |||
1334 | * addressesOrRanges, we don't know what this is. | |||
1335 | */ | |||
1336 | if ((aors = IPAddressFamily_addressesOrRanges(af)) == NULL((void *)0)) | |||
1337 | return 0; | |||
1338 | ||||
1339 | if (sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) == 0) | |||
1340 | return 0; | |||
1341 | ||||
1342 | for (j = 0; j < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) - 1; j++) { | |||
1343 | aor_a = sk_IPAddressOrRange_value(aors, j)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j))); | |||
1344 | aor_b = sk_IPAddressOrRange_value(aors, j + 1)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j + 1))); | |||
1345 | ||||
1346 | if (!extract_min_max(aor_a, a_min, a_max, length) || | |||
1347 | !extract_min_max(aor_b, b_min, b_max, length)) | |||
1348 | return 0; | |||
1349 | ||||
1350 | /* | |||
1351 | * Punt misordered list, overlapping start, or inverted | |||
1352 | * range. | |||
1353 | */ | |||
1354 | if (memcmp(a_min, b_min, length) >= 0 || | |||
1355 | memcmp(a_min, a_max, length) > 0 || | |||
1356 | memcmp(b_min, b_max, length) > 0) | |||
1357 | return 0; | |||
1358 | ||||
1359 | /* | |||
1360 | * Punt if adjacent or overlapping. Check for adjacency | |||
1361 | * by subtracting one from b_min first. | |||
1362 | */ | |||
1363 | for (k = length - 1; k >= 0 && b_min[k]-- == 0x00; k--) | |||
1364 | continue; | |||
1365 | if (memcmp(a_max, b_min, length) >= 0) | |||
1366 | return 0; | |||
1367 | ||||
1368 | /* | |||
1369 | * Check for range that should be expressed as a prefix. | |||
1370 | */ | |||
1371 | if (aor_a->type == IPAddressOrRange_addressPrefix0) | |||
1372 | continue; | |||
1373 | ||||
1374 | if (range_should_be_prefix(a_min, a_max, length) >= 0) | |||
1375 | return 0; | |||
1376 | } | |||
1377 | ||||
1378 | /* | |||
1379 | * Check final range to see if it's inverted or should be a | |||
1380 | * prefix. | |||
1381 | */ | |||
1382 | aor = sk_IPAddressOrRange_value(aors, j)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (j))); | |||
1383 | if (aor->type == IPAddressOrRange_addressRange1) { | |||
1384 | if (!extract_min_max(aor, a_min, a_max, length)) | |||
1385 | return 0; | |||
1386 | if (memcmp(a_min, a_max, length) > 0) | |||
1387 | return 0; | |||
1388 | if (range_should_be_prefix(a_min, a_max, length) >= 0) | |||
1389 | return 0; | |||
1390 | } | |||
1391 | } | |||
1392 | ||||
1393 | /* | |||
1394 | * If we made it through all that, we're happy. | |||
1395 | */ | |||
1396 | return 1; | |||
1397 | } | |||
1398 | LCRYPTO_ALIAS(X509v3_addr_is_canonical)asm(""); | |||
1399 | ||||
1400 | /* | |||
1401 | * Whack an IPAddressOrRanges into canonical form. | |||
1402 | */ | |||
1403 | static int | |||
1404 | IPAddressOrRanges_canonize(IPAddressOrRanges *aors, const unsigned afi) | |||
1405 | { | |||
1406 | IPAddressOrRange *a, *b, *merged; | |||
1407 | unsigned char a_min[ADDR_RAW_BUF_LEN16], a_max[ADDR_RAW_BUF_LEN16]; | |||
1408 | unsigned char b_min[ADDR_RAW_BUF_LEN16], b_max[ADDR_RAW_BUF_LEN16]; | |||
1409 | int i, j, length; | |||
1410 | ||||
1411 | if (!length_from_afi(afi, &length)) | |||
1412 | return 0; | |||
1413 | ||||
1414 | /* | |||
1415 | * Sort the IPAddressOrRanges sequence. | |||
1416 | */ | |||
1417 | sk_IPAddressOrRange_sort(aors)sk_sort(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))); | |||
1418 | ||||
1419 | /* | |||
1420 | * Clean up representation issues, punt on duplicates or overlaps. | |||
1421 | */ | |||
1422 | for (i = 0; i < sk_IPAddressOrRange_num(aors)sk_num(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0))) - 1; i++) { | |||
1423 | a = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
1424 | b = sk_IPAddressOrRange_value(aors, i + 1)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i + 1))); | |||
1425 | ||||
1426 | if (!extract_min_max(a, a_min, a_max, length) || | |||
1427 | !extract_min_max(b, b_min, b_max, length)) | |||
1428 | return 0; | |||
1429 | ||||
1430 | /* | |||
1431 | * Punt inverted ranges. | |||
1432 | */ | |||
1433 | if (memcmp(a_min, a_max, length) > 0 || | |||
1434 | memcmp(b_min, b_max, length) > 0) | |||
1435 | return 0; | |||
1436 | ||||
1437 | /* | |||
1438 | * Punt overlaps. | |||
1439 | */ | |||
1440 | if (memcmp(a_max, b_min, length) >= 0) | |||
1441 | return 0; | |||
1442 | ||||
1443 | /* | |||
1444 | * Merge if a and b are adjacent. We check for | |||
1445 | * adjacency by subtracting one from b_min first. | |||
1446 | */ | |||
1447 | for (j = length - 1; j >= 0 && b_min[j]-- == 0x00; j--) | |||
1448 | continue; | |||
1449 | ||||
1450 | if (memcmp(a_max, b_min, length) != 0) | |||
1451 | continue; | |||
1452 | ||||
1453 | if (!make_addressRange(&merged, a_min, b_max, afi, length)) | |||
1454 | return 0; | |||
1455 | sk_IPAddressOrRange_set(aors, i, merged)sk_set(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange *)0)), (i), ((void*) (1 ? (merged) : (IPAddressOrRange*)0))); | |||
1456 | (void)sk_IPAddressOrRange_delete(aors, i + 1)(IPAddressOrRange *)sk_delete(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i + 1)); | |||
1457 | IPAddressOrRange_free(a); | |||
1458 | IPAddressOrRange_free(b); | |||
1459 | i--; | |||
1460 | } | |||
1461 | ||||
1462 | /* | |||
1463 | * Check for inverted final range. | |||
1464 | */ | |||
1465 | a = sk_IPAddressOrRange_value(aors, i)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (aors) : (struct stack_st_IPAddressOrRange*)0)), (i))); | |||
1466 | if (a != NULL((void *)0) && a->type == IPAddressOrRange_addressRange1) { | |||
1467 | if (!extract_min_max(a, a_min, a_max, length)) | |||
1468 | return 0; | |||
1469 | if (memcmp(a_min, a_max, length) > 0) | |||
1470 | return 0; | |||
1471 | } | |||
1472 | ||||
1473 | return 1; | |||
1474 | } | |||
1475 | ||||
1476 | /* | |||
1477 | * Whack an IPAddrBlocks extension into canonical form. | |||
1478 | */ | |||
1479 | int | |||
1480 | X509v3_addr_canonize(IPAddrBlocks *addr) | |||
1481 | { | |||
1482 | IPAddressFamily *af; | |||
1483 | IPAddressOrRanges *aors; | |||
1484 | uint16_t afi; | |||
1485 | int i; | |||
1486 | ||||
1487 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1488 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1489 | ||||
1490 | /* Check AFI/SAFI here - IPAddressFamily_cmp() can't error. */ | |||
1491 | if (!IPAddressFamily_afi(af, &afi)) | |||
1492 | return 0; | |||
1493 | ||||
1494 | if ((aors = IPAddressFamily_addressesOrRanges(af)) == NULL((void *)0)) | |||
1495 | continue; | |||
1496 | ||||
1497 | if (!IPAddressOrRanges_canonize(aors, afi)) | |||
1498 | return 0; | |||
1499 | } | |||
1500 | ||||
1501 | (void)sk_IPAddressFamily_set_cmp_func(addr, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
1502 | sk_IPAddressFamily_sort(addr)sk_sort(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); | |||
1503 | ||||
1504 | return X509v3_addr_is_canonical(addr); | |||
1505 | } | |||
1506 | LCRYPTO_ALIAS(X509v3_addr_canonize)asm(""); | |||
1507 | ||||
1508 | /* | |||
1509 | * v2i handler for the IPAddrBlocks extension. | |||
1510 | */ | |||
1511 | static void * | |||
1512 | v2i_IPAddrBlocks(const struct v3_ext_method *method, struct v3_ext_ctx *ctx, | |||
1513 | STACK_OF(CONF_VALUE)struct stack_st_CONF_VALUE*values) | |||
1514 | { | |||
1515 | static const char v4addr_chars[] = "0123456789."; | |||
1516 | static const char v6addr_chars[] = "0123456789.:abcdefABCDEF"; | |||
1517 | IPAddrBlocks *addr = NULL((void *)0); | |||
1518 | char *s = NULL((void *)0), *t; | |||
1519 | int i; | |||
1520 | ||||
1521 | if ((addr = sk_IPAddressFamily_new(IPAddressFamily_cmp)((struct stack_st_IPAddressFamily *)sk_new(((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *)) 0)))))) == NULL((void *)0)) { | |||
1522 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1522); | |||
1523 | return NULL((void *)0); | |||
1524 | } | |||
1525 | ||||
1526 | for (i = 0; i < sk_CONF_VALUE_num(values)sk_num(((_STACK*) (1 ? (values) : (struct stack_st_CONF_VALUE *)0))); i++) { | |||
1527 | CONF_VALUE *val = sk_CONF_VALUE_value(values, i)((CONF_VALUE *)sk_value(((_STACK*) (1 ? (values) : (struct stack_st_CONF_VALUE *)0)), (i))); | |||
1528 | unsigned char min[ADDR_RAW_BUF_LEN16], max[ADDR_RAW_BUF_LEN16]; | |||
1529 | unsigned afi, *safi = NULL((void *)0), safi_; | |||
1530 | const char *addr_chars = NULL((void *)0); | |||
1531 | const char *errstr; | |||
1532 | int prefix_len, i1, i2, delim, length; | |||
1533 | ||||
1534 | if (!name_cmp(val->name, "IPv4")) { | |||
1535 | afi = IANA_AFI_IPV41; | |||
1536 | } else if (!name_cmp(val->name, "IPv6")) { | |||
1537 | afi = IANA_AFI_IPV62; | |||
1538 | } else if (!name_cmp(val->name, "IPv4-SAFI")) { | |||
1539 | afi = IANA_AFI_IPV41; | |||
1540 | safi = &safi_; | |||
1541 | } else if (!name_cmp(val->name, "IPv6-SAFI")) { | |||
1542 | afi = IANA_AFI_IPV62; | |||
1543 | safi = &safi_; | |||
1544 | } else { | |||
1545 | X509V3error(X509V3_R_EXTENSION_NAME_ERROR)ERR_put_error(34,(0xfff),(115),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1545); | |||
1546 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1547 | goto err; | |||
1548 | } | |||
1549 | ||||
1550 | switch (afi) { | |||
1551 | case IANA_AFI_IPV41: | |||
1552 | addr_chars = v4addr_chars; | |||
1553 | break; | |||
1554 | case IANA_AFI_IPV62: | |||
1555 | addr_chars = v6addr_chars; | |||
1556 | break; | |||
1557 | } | |||
1558 | ||||
1559 | if (!length_from_afi(afi, &length)) | |||
1560 | goto err; | |||
1561 | ||||
1562 | /* | |||
1563 | * Handle SAFI, if any, and strdup() so we can null-terminate | |||
1564 | * the other input values. | |||
1565 | */ | |||
1566 | if (safi != NULL((void *)0)) { | |||
1567 | unsigned long parsed_safi; | |||
1568 | int saved_errno = errno(*__errno()); | |||
1569 | ||||
1570 | errno(*__errno()) = 0; | |||
1571 | parsed_safi = strtoul(val->value, &t, 0); | |||
1572 | ||||
1573 | /* Value must be present, then a tab, space or colon. */ | |||
1574 | if (val->value[0] == '\0' || | |||
1575 | (*t != '\t' && *t != ' ' && *t != ':')) { | |||
1576 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1576); | |||
1577 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1578 | goto err; | |||
1579 | } | |||
1580 | /* Range and overflow check. */ | |||
1581 | if ((errno(*__errno()) == ERANGE34 && parsed_safi == ULONG_MAX0xffffffffffffffffUL) || | |||
1582 | parsed_safi > 0xff) { | |||
1583 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1583); | |||
1584 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1585 | goto err; | |||
1586 | } | |||
1587 | errno(*__errno()) = saved_errno; | |||
1588 | ||||
1589 | *safi = parsed_safi; | |||
1590 | ||||
1591 | /* Check possible whitespace is followed by a colon. */ | |||
1592 | t += strspn(t, " \t"); | |||
1593 | if (*t != ':') { | |||
1594 | X509V3error(X509V3_R_INVALID_SAFI)ERR_put_error(34,(0xfff),(164),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1594); | |||
1595 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1596 | goto err; | |||
1597 | } | |||
1598 | ||||
1599 | /* Skip over colon. */ | |||
1600 | t++; | |||
1601 | ||||
1602 | /* Then over any trailing whitespace. */ | |||
1603 | t += strspn(t, " \t"); | |||
1604 | ||||
1605 | s = strdup(t); | |||
1606 | } else { | |||
1607 | s = strdup(val->value); | |||
1608 | } | |||
1609 | if (s == NULL((void *)0)) { | |||
1610 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1610); | |||
1611 | goto err; | |||
1612 | } | |||
1613 | ||||
1614 | /* | |||
1615 | * Check for inheritance. Not worth additional complexity to | |||
1616 | * optimize this (seldom-used) case. | |||
1617 | */ | |||
1618 | if (strcmp(s, "inherit") == 0) { | |||
1619 | if (!X509v3_addr_add_inherit(addr, afi, safi)) { | |||
1620 | X509V3error(X509V3_R_INVALID_INHERITANCE)ERR_put_error(34,(0xfff),(165),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1620); | |||
1621 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1622 | goto err; | |||
1623 | } | |||
1624 | free(s); | |||
1625 | s = NULL((void *)0); | |||
1626 | continue; | |||
1627 | } | |||
1628 | ||||
1629 | i1 = strspn(s, addr_chars); | |||
1630 | i2 = i1 + strspn(s + i1, " \t"); | |||
1631 | delim = s[i2++]; | |||
1632 | s[i1] = '\0'; | |||
1633 | ||||
1634 | if (a2i_ipadd(min, s) != length) { | |||
1635 | X509V3error(X509V3_R_INVALID_IPADDRESS)ERR_put_error(34,(0xfff),(166),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1635); | |||
1636 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1637 | goto err; | |||
1638 | } | |||
1639 | ||||
1640 | switch (delim) { | |||
1641 | case '/': | |||
1642 | /* length contains the size of the address in bytes. */ | |||
1643 | if (length != 4 && length != 16) | |||
1644 | goto err; | |||
1645 | prefix_len = strtonum(s + i2, 0, 8 * length, &errstr); | |||
1646 | if (errstr != NULL((void *)0)) { | |||
1647 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1647); | |||
1648 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1649 | goto err; | |||
1650 | } | |||
1651 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, | |||
1652 | prefix_len)) { | |||
1653 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1653); | |||
1654 | goto err; | |||
1655 | } | |||
1656 | break; | |||
1657 | case '-': | |||
1658 | i1 = i2 + strspn(s + i2, " \t"); | |||
1659 | i2 = i1 + strspn(s + i1, addr_chars); | |||
1660 | if (i1 == i2 || s[i2] != '\0') { | |||
1661 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1661); | |||
1662 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1663 | goto err; | |||
1664 | } | |||
1665 | if (a2i_ipadd(max, s + i1) != length) { | |||
1666 | X509V3error(X509V3_R_INVALID_IPADDRESS)ERR_put_error(34,(0xfff),(166),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1666); | |||
1667 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1668 | goto err; | |||
1669 | } | |||
1670 | if (memcmp(min, max, length) > 0) { | |||
1671 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1671); | |||
1672 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1673 | goto err; | |||
1674 | } | |||
1675 | if (!X509v3_addr_add_range(addr, afi, safi, min, max)) { | |||
1676 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1676); | |||
1677 | goto err; | |||
1678 | } | |||
1679 | break; | |||
1680 | case '\0': | |||
1681 | if (!X509v3_addr_add_prefix(addr, afi, safi, min, | |||
1682 | length * 8)) { | |||
1683 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1683); | |||
1684 | goto err; | |||
1685 | } | |||
1686 | break; | |||
1687 | default: | |||
1688 | X509V3error(X509V3_R_EXTENSION_VALUE_ERROR)ERR_put_error(34,(0xfff),(116),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1688); | |||
1689 | X509V3_conf_err(val)ERR_asprintf_error_data( "section:%s,name:%s,value:%s", val-> section, val->name, val->value);; | |||
1690 | goto err; | |||
1691 | } | |||
1692 | ||||
1693 | free(s); | |||
1694 | s = NULL((void *)0); | |||
1695 | } | |||
1696 | ||||
1697 | /* | |||
1698 | * Canonize the result, then we're done. | |||
1699 | */ | |||
1700 | if (!X509v3_addr_canonize(addr)) | |||
1701 | goto err; | |||
1702 | return addr; | |||
1703 | ||||
1704 | err: | |||
1705 | free(s); | |||
1706 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free)sk_pop_free(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0)), ((void (*)(void *)) ((1 ? (IPAddressFamily_free) : (void (*)(IPAddressFamily *))0)))); | |||
1707 | return NULL((void *)0); | |||
1708 | } | |||
1709 | ||||
1710 | /* | |||
1711 | * OpenSSL dispatch | |||
1712 | */ | |||
1713 | const X509V3_EXT_METHOD v3_addr = { | |||
1714 | .ext_nid = NID_sbgp_ipAddrBlock290, | |||
1715 | .ext_flags = 0, | |||
1716 | .it = &IPAddrBlocks_it, | |||
1717 | .ext_new = NULL((void *)0), | |||
1718 | .ext_free = NULL((void *)0), | |||
1719 | .d2i = NULL((void *)0), | |||
1720 | .i2d = NULL((void *)0), | |||
1721 | .i2s = NULL((void *)0), | |||
1722 | .s2i = NULL((void *)0), | |||
1723 | .i2v = NULL((void *)0), | |||
1724 | .v2i = v2i_IPAddrBlocks, | |||
1725 | .i2r = i2r_IPAddrBlocks, | |||
1726 | .r2i = NULL((void *)0), | |||
1727 | .usr_data = NULL((void *)0), | |||
1728 | }; | |||
1729 | ||||
1730 | /* | |||
1731 | * Figure out whether extension uses inheritance. | |||
1732 | */ | |||
1733 | int | |||
1734 | X509v3_addr_inherits(IPAddrBlocks *addr) | |||
1735 | { | |||
1736 | IPAddressFamily *af; | |||
1737 | int i; | |||
1738 | ||||
1739 | if (addr == NULL((void *)0)) | |||
1740 | return 0; | |||
1741 | ||||
1742 | for (i = 0; i < sk_IPAddressFamily_num(addr)sk_num(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1743 | af = sk_IPAddressFamily_value(addr, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (addr) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1744 | ||||
1745 | if (IPAddressFamily_inheritance(af) != NULL((void *)0)) | |||
1746 | return 1; | |||
1747 | } | |||
1748 | ||||
1749 | return 0; | |||
1750 | } | |||
1751 | LCRYPTO_ALIAS(X509v3_addr_inherits)asm(""); | |||
1752 | ||||
1753 | /* | |||
1754 | * Figure out whether parent contains child. | |||
1755 | * | |||
1756 | * This only works correctly if both parent and child are in canonical form. | |||
1757 | */ | |||
1758 | static int | |||
1759 | addr_contains(IPAddressOrRanges *parent, IPAddressOrRanges *child, int length) | |||
1760 | { | |||
1761 | IPAddressOrRange *child_aor, *parent_aor; | |||
1762 | uint8_t parent_min[ADDR_RAW_BUF_LEN16], parent_max[ADDR_RAW_BUF_LEN16]; | |||
1763 | uint8_t child_min[ADDR_RAW_BUF_LEN16], child_max[ADDR_RAW_BUF_LEN16]; | |||
1764 | int p, c; | |||
1765 | ||||
1766 | if (child == NULL((void *)0) || parent == child) | |||
1767 | return 1; | |||
1768 | if (parent == NULL((void *)0)) | |||
1769 | return 0; | |||
1770 | ||||
1771 | p = 0; | |||
1772 | for (c = 0; c < sk_IPAddressOrRange_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressOrRange *)0))); c++) { | |||
1773 | child_aor = sk_IPAddressOrRange_value(child, c)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressOrRange*)0)), (c))); | |||
1774 | ||||
1775 | if (!extract_min_max(child_aor, child_min, child_max, length)) | |||
1776 | return 0; | |||
1777 | ||||
1778 | for (;; p++) { | |||
1779 | if (p >= sk_IPAddressOrRange_num(parent)sk_num(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressOrRange *)0)))) | |||
1780 | return 0; | |||
1781 | ||||
1782 | parent_aor = sk_IPAddressOrRange_value(parent, p)((IPAddressOrRange *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressOrRange*)0)), (p))); | |||
1783 | ||||
1784 | if (!extract_min_max(parent_aor, parent_min, parent_max, | |||
1785 | length)) | |||
1786 | return 0; | |||
1787 | ||||
1788 | if (memcmp(parent_max, child_max, length) < 0) | |||
1789 | continue; | |||
1790 | if (memcmp(parent_min, child_min, length) > 0) | |||
1791 | return 0; | |||
1792 | break; | |||
1793 | } | |||
1794 | } | |||
1795 | ||||
1796 | return 1; | |||
1797 | } | |||
1798 | ||||
1799 | /* | |||
1800 | * Test whether |child| is a subset of |parent|. | |||
1801 | */ | |||
1802 | int | |||
1803 | X509v3_addr_subset(IPAddrBlocks *child, IPAddrBlocks *parent) | |||
1804 | { | |||
1805 | IPAddressFamily *child_af, *parent_af; | |||
1806 | IPAddressOrRanges *child_aor, *parent_aor; | |||
1807 | int i, length; | |||
1808 | ||||
1809 | if (child == NULL((void *)0) || child == parent) | |||
1810 | return 1; | |||
1811 | if (parent == NULL((void *)0)) | |||
1812 | return 0; | |||
1813 | ||||
1814 | if (X509v3_addr_inherits(child) || X509v3_addr_inherits(parent)) | |||
1815 | return 0; | |||
1816 | ||||
1817 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1818 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1819 | ||||
1820 | parent_af = IPAddressFamily_find_in_parent(parent, child_af); | |||
1821 | if (parent_af == NULL((void *)0)) | |||
1822 | return 0; | |||
1823 | ||||
1824 | if (!IPAddressFamily_afi_length(parent_af, &length)) | |||
1825 | return 0; | |||
1826 | ||||
1827 | child_aor = IPAddressFamily_addressesOrRanges(child_af); | |||
1828 | parent_aor = IPAddressFamily_addressesOrRanges(parent_af); | |||
1829 | ||||
1830 | if (!addr_contains(parent_aor, child_aor, length)) | |||
1831 | return 0; | |||
1832 | } | |||
1833 | return 1; | |||
1834 | } | |||
1835 | LCRYPTO_ALIAS(X509v3_addr_subset)asm(""); | |||
1836 | ||||
1837 | static int | |||
1838 | verify_error(X509_STORE_CTX *ctx, X509 *cert, int error, int depth) | |||
1839 | { | |||
1840 | if (ctx == NULL((void *)0)) | |||
1841 | return 0; | |||
1842 | ||||
1843 | ctx->current_cert = cert; | |||
1844 | ctx->error = error; | |||
1845 | ctx->error_depth = depth; | |||
1846 | ||||
1847 | return ctx->verify_cb(0, ctx); | |||
1848 | } | |||
1849 | ||||
1850 | /* | |||
1851 | * Core code for RFC 3779 2.3 path validation. | |||
1852 | * | |||
1853 | * Returns 1 for success, 0 on error. | |||
1854 | * | |||
1855 | * When returning 0, ctx->error MUST be set to an appropriate value other than | |||
1856 | * X509_V_OK. | |||
1857 | */ | |||
1858 | static int | |||
1859 | addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509)struct stack_st_X509 *chain, | |||
1860 | IPAddrBlocks *ext) | |||
1861 | { | |||
1862 | IPAddrBlocks *child = NULL((void *)0), *parent = NULL((void *)0); | |||
1863 | IPAddressFamily *child_af, *parent_af; | |||
1864 | IPAddressOrRanges *child_aor, *parent_aor; | |||
1865 | X509 *cert = NULL((void *)0); | |||
| ||||
1866 | int depth = -1; | |||
1867 | int i; | |||
1868 | unsigned int length; | |||
1869 | int ret = 1; | |||
1870 | ||||
1871 | /* We need a non-empty chain to test against. */ | |||
1872 | if (sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))) <= 0) | |||
1873 | goto err; | |||
1874 | /* We need either a store ctx or an extension to work with. */ | |||
1875 | if (ctx == NULL((void *)0) && ext == NULL((void *)0)) | |||
1876 | goto err; | |||
1877 | /* If there is a store ctx, it needs a verify_cb. */ | |||
1878 | if (ctx
| |||
1879 | goto err; | |||
1880 | ||||
1881 | /* | |||
1882 | * Figure out where to start. If we don't have an extension to check, | |||
1883 | * (either extracted from the leaf or passed by the caller), we're done. | |||
1884 | * Otherwise, check canonical form and set up for walking up the chain. | |||
1885 | */ | |||
1886 | if (ext == NULL((void *)0)) { | |||
1887 | depth = 0; | |||
1888 | cert = sk_X509_value(chain, depth)((X509 *)sk_value(((_STACK*) (1 ? (chain) : (struct stack_st_X509 *)0)), (depth))); | |||
1889 | if ((X509_get_extension_flags(cert) & EXFLAG_INVALID0x0080) != 0) { | |||
1890 | if ((ret = verify_error(ctx, cert, | |||
1891 | X509_V_ERR_INVALID_EXTENSION41, depth)) == 0) | |||
1892 | goto done; | |||
1893 | } | |||
1894 | if ((ext = cert->rfc3779_addr) == NULL((void *)0)) | |||
1895 | goto done; | |||
1896 | } else if (!X509v3_addr_is_canonical(ext)) { | |||
1897 | if ((ret = verify_error(ctx, cert, | |||
1898 | X509_V_ERR_INVALID_EXTENSION41, depth)) == 0) | |||
1899 | goto done; | |||
1900 | } | |||
1901 | ||||
1902 | (void)sk_IPAddressFamily_set_cmp_func(ext, IPAddressFamily_cmp)((int (*)(const IPAddressFamily * const *,const IPAddressFamily * const *)) sk_set_cmp_func(((_STACK*) (1 ? (ext) : (struct stack_st_IPAddressFamily *)0)), ((int (*)(const void *, const void *)) ((1 ? (IPAddressFamily_cmp ) : (int (*)(const IPAddressFamily * const *, const IPAddressFamily * const *))0))))); | |||
1903 | if ((child = sk_IPAddressFamily_dup(ext)(struct stack_st_IPAddressFamily *)sk_dup(((_STACK*) (1 ? ext : (struct stack_st_IPAddressFamily*)0)))) == NULL((void *)0)) { | |||
1904 | X509V3error(ERR_R_MALLOC_FAILURE)ERR_put_error(34,(0xfff),((1|64)),"/usr/src/lib/libcrypto/x509/x509_addr.c" ,1904); | |||
1905 | if (ctx != NULL((void *)0)) | |||
1906 | ctx->error = X509_V_ERR_OUT_OF_MEM17; | |||
1907 | ret = 0; | |||
1908 | goto done; | |||
1909 | } | |||
1910 | ||||
1911 | /* | |||
1912 | * Now walk up the chain. No cert may list resources that its parent | |||
1913 | * doesn't list. | |||
1914 | */ | |||
1915 | for (depth++; depth < sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))); depth++) { | |||
1916 | cert = sk_X509_value(chain, depth)((X509 *)sk_value(((_STACK*) (1 ? (chain) : (struct stack_st_X509 *)0)), (depth))); | |||
1917 | ||||
1918 | if ((X509_get_extension_flags(cert) & EXFLAG_INVALID0x0080) != 0) { | |||
1919 | if ((ret = verify_error(ctx, cert, | |||
1920 | X509_V_ERR_INVALID_EXTENSION41, depth)) == 0) | |||
1921 | goto done; | |||
1922 | } | |||
1923 | ||||
1924 | if ((parent = cert->rfc3779_addr) == NULL((void *)0)) { | |||
1925 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1926 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1927 | ||||
1928 | if (IPAddressFamily_inheritance(child_af) != | |||
1929 | NULL((void *)0)) | |||
1930 | continue; | |||
1931 | ||||
1932 | if ((ret = verify_error(ctx, cert, | |||
1933 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1934 | goto done; | |||
1935 | break; | |||
1936 | } | |||
1937 | continue; | |||
1938 | } | |||
1939 | ||||
1940 | /* | |||
1941 | * Check that the child's resources are covered by the parent. | |||
1942 | * Each covered resource is replaced with the parent's resource | |||
1943 | * covering it, so the next iteration will check that the | |||
1944 | * parent's resources are covered by the grandparent. | |||
1945 | */ | |||
1946 | for (i = 0; i < sk_IPAddressFamily_num(child)sk_num(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
1947 | child_af = sk_IPAddressFamily_value(child, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
1948 | ||||
1949 | if ((parent_af = IPAddressFamily_find_in_parent(parent, | |||
1950 | child_af)) == NULL((void *)0)) { | |||
1951 | /* | |||
1952 | * If we have no match in the parent and the | |||
1953 | * child inherits, that's fine. | |||
1954 | */ | |||
1955 | if (IPAddressFamily_inheritance(child_af) != | |||
1956 | NULL((void *)0)) | |||
1957 | continue; | |||
1958 | ||||
1959 | /* Otherwise the child isn't covered. */ | |||
1960 | if ((ret = verify_error(ctx, cert, | |||
1961 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1962 | goto done; | |||
1963 | break; | |||
1964 | } | |||
1965 | ||||
1966 | /* Parent inherits, nothing to do. */ | |||
1967 | if (IPAddressFamily_inheritance(parent_af) != NULL((void *)0)) | |||
1968 | continue; | |||
1969 | ||||
1970 | /* Child inherits. Use parent's address family. */ | |||
1971 | if (IPAddressFamily_inheritance(child_af) != NULL((void *)0)) { | |||
1972 | sk_IPAddressFamily_set(child, i, parent_af)sk_set(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0)), (i), ((void*) (1 ? (parent_af) : (IPAddressFamily*)0)) ); | |||
1973 | continue; | |||
1974 | } | |||
1975 | ||||
1976 | child_aor = IPAddressFamily_addressesOrRanges(child_af); | |||
1977 | parent_aor = | |||
1978 | IPAddressFamily_addressesOrRanges(parent_af); | |||
1979 | ||||
1980 | /* | |||
1981 | * Child and parent are canonical and neither inherits. | |||
1982 | * If either addressesOrRanges is NULL, something's | |||
1983 | * very wrong. | |||
1984 | */ | |||
1985 | if (child_aor == NULL((void *)0) || parent_aor == NULL((void *)0)) | |||
1986 | goto err; | |||
1987 | ||||
1988 | if (!IPAddressFamily_afi_length(child_af, &length)) | |||
1989 | goto err; | |||
1990 | ||||
1991 | /* Now check containment and replace or error. */ | |||
1992 | if (addr_contains(parent_aor, child_aor, length)) { | |||
1993 | sk_IPAddressFamily_set(child, i, parent_af)sk_set(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0)), (i), ((void*) (1 ? (parent_af) : (IPAddressFamily*)0)) ); | |||
1994 | continue; | |||
1995 | } | |||
1996 | ||||
1997 | if ((ret = verify_error(ctx, cert, | |||
1998 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
1999 | goto done; | |||
2000 | } | |||
2001 | } | |||
2002 | ||||
2003 | /* | |||
2004 | * Trust anchor can't inherit. | |||
2005 | */ | |||
2006 | if ((parent = cert->rfc3779_addr) != NULL((void *)0)) { | |||
| ||||
2007 | for (i = 0; i < sk_IPAddressFamily_num(parent)sk_num(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily *)0))); i++) { | |||
2008 | parent_af = sk_IPAddressFamily_value(parent, i)((IPAddressFamily *)sk_value(((_STACK*) (1 ? (parent) : (struct stack_st_IPAddressFamily*)0)), (i))); | |||
2009 | ||||
2010 | if (IPAddressFamily_inheritance(parent_af) == NULL((void *)0)) | |||
2011 | continue; | |||
2012 | ||||
2013 | if ((ret = verify_error(ctx, cert, | |||
2014 | X509_V_ERR_UNNESTED_RESOURCE46, depth)) == 0) | |||
2015 | goto done; | |||
2016 | } | |||
2017 | } | |||
2018 | ||||
2019 | done: | |||
2020 | sk_IPAddressFamily_free(child)sk_free(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); | |||
2021 | return ret; | |||
2022 | ||||
2023 | err: | |||
2024 | sk_IPAddressFamily_free(child)sk_free(((_STACK*) (1 ? (child) : (struct stack_st_IPAddressFamily *)0))); | |||
2025 | ||||
2026 | if (ctx != NULL((void *)0)) | |||
2027 | ctx->error = X509_V_ERR_UNSPECIFIED1; | |||
2028 | ||||
2029 | return 0; | |||
2030 | } | |||
2031 | ||||
2032 | /* | |||
2033 | * RFC 3779 2.3 path validation -- called from X509_verify_cert(). | |||
2034 | */ | |||
2035 | int | |||
2036 | X509v3_addr_validate_path(X509_STORE_CTX *ctx) | |||
2037 | { | |||
2038 | if (sk_X509_num(ctx->chain)sk_num(((_STACK*) (1 ? (ctx->chain) : (struct stack_st_X509 *)0))) <= 0 || ctx->verify_cb == NULL((void *)0)) { | |||
2039 | ctx->error = X509_V_ERR_UNSPECIFIED1; | |||
2040 | return 0; | |||
2041 | } | |||
2042 | return addr_validate_path_internal(ctx, ctx->chain, NULL((void *)0)); | |||
2043 | } | |||
2044 | LCRYPTO_ALIAS(X509v3_addr_validate_path)asm(""); | |||
2045 | ||||
2046 | /* | |||
2047 | * RFC 3779 2.3 path validation of an extension. | |||
2048 | * Test whether chain covers extension. | |||
2049 | */ | |||
2050 | int | |||
2051 | X509v3_addr_validate_resource_set(STACK_OF(X509)struct stack_st_X509 *chain, IPAddrBlocks *ext, | |||
2052 | int allow_inheritance) | |||
2053 | { | |||
2054 | if (ext == NULL((void *)0)) | |||
2055 | return 1; | |||
2056 | if (sk_X509_num(chain)sk_num(((_STACK*) (1 ? (chain) : (struct stack_st_X509*)0))) <= 0) | |||
2057 | return 0; | |||
2058 | if (!allow_inheritance && X509v3_addr_inherits(ext)) | |||
2059 | return 0; | |||
2060 | return addr_validate_path_internal(NULL((void *)0), chain, ext); | |||
2061 | } | |||
2062 | LCRYPTO_ALIAS(X509v3_addr_validate_resource_set)asm(""); | |||
2063 | ||||
2064 | #endif /* OPENSSL_NO_RFC3779 */ |