xref: /openssl/crypto/x509/v3_crld.c (revision e899361b) 
1 /*
2  * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <stdio.h>
11 #include "internal/cryptlib.h"
12 #include <openssl/conf.h>
13 #include <openssl/asn1.h>
14 #include <openssl/asn1t.h>
15 #include <openssl/x509v3.h>
16 
17 #include "crypto/x509.h"
18 #include "ext_dat.h"
19 #include "x509_local.h"
20 
21 static void *v2i_crld(const X509V3_EXT_METHOD *method,
22                       X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
23 static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
24                      int indent);
25 
26 const X509V3_EXT_METHOD ossl_v3_crld = {
27     NID_crl_distribution_points, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
28     0, 0, 0, 0,
29     0, 0,
30     0,
31     v2i_crld,
32     i2r_crldp, 0,
33     NULL
34 };
35 
36 const X509V3_EXT_METHOD ossl_v3_freshest_crl = {
37     NID_freshest_crl, 0, ASN1_ITEM_ref(CRL_DIST_POINTS),
38     0, 0, 0, 0,
39     0, 0,
40     0,
41     v2i_crld,
42     i2r_crldp, 0,
43     NULL
44 };
45 
STACK_OF(GENERAL_NAME)46 static STACK_OF(GENERAL_NAME) *gnames_from_sectname(X509V3_CTX *ctx,
47                                                     char *sect)
48 {
49     STACK_OF(CONF_VALUE) *gnsect;
50     STACK_OF(GENERAL_NAME) *gens;
51     if (*sect == '@')
52         gnsect = X509V3_get_section(ctx, sect + 1);
53     else
54         gnsect = X509V3_parse_list(sect);
55     if (!gnsect) {
56         ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
57         return NULL;
58     }
59     gens = v2i_GENERAL_NAMES(NULL, ctx, gnsect);
60     if (*sect == '@')
61         X509V3_section_free(ctx, gnsect);
62     else
63         sk_CONF_VALUE_pop_free(gnsect, X509V3_conf_free);
64     return gens;
65 }
66 
set_dist_point_name(DIST_POINT_NAME ** pdp,X509V3_CTX * ctx,CONF_VALUE * cnf)67 static int set_dist_point_name(DIST_POINT_NAME **pdp, X509V3_CTX *ctx,
68                                CONF_VALUE *cnf)
69 {
70     STACK_OF(GENERAL_NAME) *fnm = NULL;
71     STACK_OF(X509_NAME_ENTRY) *rnm = NULL;
72 
73     if (cnf->value == NULL) {
74         ERR_raise(ERR_LIB_X509V3, X509V3_R_MISSING_VALUE);
75         goto err;
76     }
77 
78     if (HAS_PREFIX(cnf->name, "fullname")) {
79         fnm = gnames_from_sectname(ctx, cnf->value);
80         if (!fnm)
81             goto err;
82     } else if (strcmp(cnf->name, "relativename") == 0) {
83         int ret;
84         STACK_OF(CONF_VALUE) *dnsect;
85         X509_NAME *nm;
86         nm = X509_NAME_new();
87         if (nm == NULL)
88             return -1;
89         dnsect = X509V3_get_section(ctx, cnf->value);
90         if (!dnsect) {
91             X509_NAME_free(nm);
92             ERR_raise(ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND);
93             return -1;
94         }
95         ret = X509V3_NAME_from_section(nm, dnsect, MBSTRING_ASC);
96         X509V3_section_free(ctx, dnsect);
97         rnm = nm->entries;
98         nm->entries = NULL;
99         X509_NAME_free(nm);
100         if (!ret || sk_X509_NAME_ENTRY_num(rnm) <= 0)
101             goto err;
102         /*
103          * Since its a name fragment can't have more than one RDNSequence
104          */
105         if (sk_X509_NAME_ENTRY_value(rnm,
106                                      sk_X509_NAME_ENTRY_num(rnm) - 1)->set) {
107             ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_MULTIPLE_RDNS);
108             goto err;
109         }
110     } else
111         return 0;
112 
113     if (*pdp) {
114         ERR_raise(ERR_LIB_X509V3, X509V3_R_DISTPOINT_ALREADY_SET);
115         goto err;
116     }
117 
118     *pdp = DIST_POINT_NAME_new();
119     if (*pdp == NULL)
120         goto err;
121     if (fnm) {
122         (*pdp)->type = 0;
123         (*pdp)->name.fullname = fnm;
124     } else {
125         (*pdp)->type = 1;
126         (*pdp)->name.relativename = rnm;
127     }
128 
129     return 1;
130 
131  err:
132     sk_GENERAL_NAME_pop_free(fnm, GENERAL_NAME_free);
133     sk_X509_NAME_ENTRY_pop_free(rnm, X509_NAME_ENTRY_free);
134     return -1;
135 }
136 
137 static const BIT_STRING_BITNAME reason_flags[] = {
138     {0, "Unused", "unused"},
139     {1, "Key Compromise", "keyCompromise"},
140     {2, "CA Compromise", "CACompromise"},
141     {3, "Affiliation Changed", "affiliationChanged"},
142     {4, "Superseded", "superseded"},
143     {5, "Cessation Of Operation", "cessationOfOperation"},
144     {6, "Certificate Hold", "certificateHold"},
145     {7, "Privilege Withdrawn", "privilegeWithdrawn"},
146     {8, "AA Compromise", "AACompromise"},
147     {-1, NULL, NULL}
148 };
149 
set_reasons(ASN1_BIT_STRING ** preas,char * value)150 static int set_reasons(ASN1_BIT_STRING **preas, char *value)
151 {
152     STACK_OF(CONF_VALUE) *rsk = NULL;
153     const BIT_STRING_BITNAME *pbn;
154     const char *bnam;
155     int i, ret = 0;
156     rsk = X509V3_parse_list(value);
157     if (rsk == NULL)
158         return 0;
159     if (*preas != NULL)
160         goto err;
161     for (i = 0; i < sk_CONF_VALUE_num(rsk); i++) {
162         bnam = sk_CONF_VALUE_value(rsk, i)->name;
163         if (*preas == NULL) {
164             *preas = ASN1_BIT_STRING_new();
165             if (*preas == NULL)
166                 goto err;
167         }
168         for (pbn = reason_flags; pbn->lname; pbn++) {
169             if (strcmp(pbn->sname, bnam) == 0) {
170                 if (!ASN1_BIT_STRING_set_bit(*preas, pbn->bitnum, 1))
171                     goto err;
172                 break;
173             }
174         }
175         if (pbn->lname == NULL)
176             goto err;
177     }
178     ret = 1;
179 
180  err:
181     sk_CONF_VALUE_pop_free(rsk, X509V3_conf_free);
182     return ret;
183 }
184 
print_reasons(BIO * out,const char * rname,ASN1_BIT_STRING * rflags,int indent)185 static int print_reasons(BIO *out, const char *rname,
186                          ASN1_BIT_STRING *rflags, int indent)
187 {
188     int first = 1;
189     const BIT_STRING_BITNAME *pbn;
190     BIO_printf(out, "%*s%s:\n%*s", indent, "", rname, indent + 2, "");
191     for (pbn = reason_flags; pbn->lname; pbn++) {
192         if (ASN1_BIT_STRING_get_bit(rflags, pbn->bitnum)) {
193             if (first)
194                 first = 0;
195             else
196                 BIO_puts(out, ", ");
197             BIO_puts(out, pbn->lname);
198         }
199     }
200     if (first)
201         BIO_puts(out, "<EMPTY>\n");
202     else
203         BIO_puts(out, "\n");
204     return 1;
205 }
206 
crldp_from_section(X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)207 static DIST_POINT *crldp_from_section(X509V3_CTX *ctx,
208                                       STACK_OF(CONF_VALUE) *nval)
209 {
210     int i;
211     CONF_VALUE *cnf;
212     DIST_POINT *point = DIST_POINT_new();
213 
214     if (point == NULL)
215         goto err;
216     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
217         int ret;
218         cnf = sk_CONF_VALUE_value(nval, i);
219         ret = set_dist_point_name(&point->distpoint, ctx, cnf);
220         if (ret > 0)
221             continue;
222         if (ret < 0)
223             goto err;
224         if (strcmp(cnf->name, "reasons") == 0) {
225             if (!set_reasons(&point->reasons, cnf->value))
226                 goto err;
227         } else if (strcmp(cnf->name, "CRLissuer") == 0) {
228             point->CRLissuer = gnames_from_sectname(ctx, cnf->value);
229             if (point->CRLissuer == NULL)
230                 goto err;
231         }
232     }
233 
234     return point;
235 
236  err:
237     DIST_POINT_free(point);
238     return NULL;
239 }
240 
v2i_crld(const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)241 static void *v2i_crld(const X509V3_EXT_METHOD *method,
242                       X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
243 {
244     STACK_OF(DIST_POINT) *crld;
245     GENERAL_NAMES *gens = NULL;
246     GENERAL_NAME *gen = NULL;
247     CONF_VALUE *cnf;
248     const int num = sk_CONF_VALUE_num(nval);
249     int i;
250 
251     crld = sk_DIST_POINT_new_reserve(NULL, num);
252     if (crld == NULL) {
253         ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
254         goto err;
255     }
256     for (i = 0; i < num; i++) {
257         DIST_POINT *point;
258 
259         cnf = sk_CONF_VALUE_value(nval, i);
260         if (cnf->value == NULL) {
261             STACK_OF(CONF_VALUE) *dpsect;
262             dpsect = X509V3_get_section(ctx, cnf->name);
263             if (!dpsect)
264                 goto err;
265             point = crldp_from_section(ctx, dpsect);
266             X509V3_section_free(ctx, dpsect);
267             if (point == NULL)
268                 goto err;
269             sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
270         } else {
271             if ((gen = v2i_GENERAL_NAME(method, ctx, cnf)) == NULL)
272                 goto err;
273             if ((gens = GENERAL_NAMES_new()) == NULL) {
274                 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
275                 goto err;
276             }
277             if (!sk_GENERAL_NAME_push(gens, gen)) {
278                 ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
279                 goto err;
280             }
281             gen = NULL;
282             if ((point = DIST_POINT_new()) == NULL) {
283                 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
284                 goto err;
285             }
286             sk_DIST_POINT_push(crld, point); /* no failure as it was reserved */
287             if ((point->distpoint = DIST_POINT_NAME_new()) == NULL) {
288                 ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
289                 goto err;
290             }
291             point->distpoint->name.fullname = gens;
292             point->distpoint->type = 0;
293             gens = NULL;
294         }
295     }
296     return crld;
297 
298  err:
299     GENERAL_NAME_free(gen);
300     GENERAL_NAMES_free(gens);
301     sk_DIST_POINT_pop_free(crld, DIST_POINT_free);
302     return NULL;
303 }
304 
dpn_cb(int operation,ASN1_VALUE ** pval,const ASN1_ITEM * it,void * exarg)305 static int dpn_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
306                   void *exarg)
307 {
308     DIST_POINT_NAME *dpn = (DIST_POINT_NAME *)*pval;
309 
310     switch (operation) {
311     case ASN1_OP_NEW_POST:
312         dpn->dpname = NULL;
313         break;
314 
315     case ASN1_OP_FREE_POST:
316         X509_NAME_free(dpn->dpname);
317         break;
318     }
319     return 1;
320 }
321 
322 
323 ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
324         ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
325         ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
326 } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
327 
328 
329 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
330 IMPLEMENT_ASN1_DUP_FUNCTION(DIST_POINT_NAME)
331 
332 ASN1_SEQUENCE(DIST_POINT) = {
333         ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
334         ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
335         ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
336 } ASN1_SEQUENCE_END(DIST_POINT)
337 
338 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
339 
340 ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) =
341         ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
342 ASN1_ITEM_TEMPLATE_END(CRL_DIST_POINTS)
343 
344 IMPLEMENT_ASN1_FUNCTIONS(CRL_DIST_POINTS)
345 
346 ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
347         ASN1_EXP_OPT(ISSUING_DIST_POINT, distpoint, DIST_POINT_NAME, 0),
348         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyuser, ASN1_FBOOLEAN, 1),
349         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
350         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
351         ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
352         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
353 } ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
354 
355 IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
356 
357 static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
358                    int indent);
359 static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
360                      STACK_OF(CONF_VALUE) *nval);
361 
362 const X509V3_EXT_METHOD ossl_v3_idp = {
363     NID_issuing_distribution_point, X509V3_EXT_MULTILINE,
364     ASN1_ITEM_ref(ISSUING_DIST_POINT),
365     0, 0, 0, 0,
366     0, 0,
367     0,
368     v2i_idp,
369     i2r_idp, 0,
370     NULL
371 };
372 
v2i_idp(const X509V3_EXT_METHOD * method,X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* nval)373 static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
374                      STACK_OF(CONF_VALUE) *nval)
375 {
376     ISSUING_DIST_POINT *idp = NULL;
377     CONF_VALUE *cnf;
378     char *name, *val;
379     int i, ret;
380     idp = ISSUING_DIST_POINT_new();
381     if (idp == NULL) {
382         ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
383         goto err;
384     }
385     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
386         cnf = sk_CONF_VALUE_value(nval, i);
387         name = cnf->name;
388         val = cnf->value;
389         ret = set_dist_point_name(&idp->distpoint, ctx, cnf);
390         if (ret > 0)
391             continue;
392         if (ret < 0)
393             goto err;
394         if (strcmp(name, "onlyuser") == 0) {
395             if (!X509V3_get_value_bool(cnf, &idp->onlyuser))
396                 goto err;
397         } else if (strcmp(name, "onlyCA") == 0) {
398             if (!X509V3_get_value_bool(cnf, &idp->onlyCA))
399                 goto err;
400         } else if (strcmp(name, "onlyAA") == 0) {
401             if (!X509V3_get_value_bool(cnf, &idp->onlyattr))
402                 goto err;
403         } else if (strcmp(name, "indirectCRL") == 0) {
404             if (!X509V3_get_value_bool(cnf, &idp->indirectCRL))
405                 goto err;
406         } else if (strcmp(name, "onlysomereasons") == 0) {
407             if (!set_reasons(&idp->onlysomereasons, val))
408                 goto err;
409         } else {
410             ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME);
411             X509V3_conf_add_error_name_value(cnf);
412             goto err;
413         }
414     }
415     return idp;
416 
417  err:
418     ISSUING_DIST_POINT_free(idp);
419     return NULL;
420 }
421 
print_distpoint(BIO * out,DIST_POINT_NAME * dpn,int indent)422 static int print_distpoint(BIO *out, DIST_POINT_NAME *dpn, int indent)
423 {
424     if (dpn->type == 0) {
425         BIO_printf(out, "%*sFull Name:\n", indent, "");
426         OSSL_GENERAL_NAMES_print(out, dpn->name.fullname, indent);
427         BIO_puts(out, "\n");
428     } else {
429         X509_NAME ntmp;
430         ntmp.entries = dpn->name.relativename;
431         BIO_printf(out, "%*sRelative Name:\n%*s", indent, "", indent + 2, "");
432         X509_NAME_print_ex(out, &ntmp, 0, XN_FLAG_ONELINE);
433         BIO_puts(out, "\n");
434     }
435     return 1;
436 }
437 
i2r_idp(const X509V3_EXT_METHOD * method,void * pidp,BIO * out,int indent)438 static int i2r_idp(const X509V3_EXT_METHOD *method, void *pidp, BIO *out,
439                    int indent)
440 {
441     ISSUING_DIST_POINT *idp = pidp;
442     if (idp->distpoint)
443         print_distpoint(out, idp->distpoint, indent);
444     if (idp->onlyuser > 0)
445         BIO_printf(out, "%*sOnly User Certificates\n", indent, "");
446     if (idp->onlyCA > 0)
447         BIO_printf(out, "%*sOnly CA Certificates\n", indent, "");
448     if (idp->indirectCRL > 0)
449         BIO_printf(out, "%*sIndirect CRL\n", indent, "");
450     if (idp->onlysomereasons)
451         print_reasons(out, "Only Some Reasons", idp->onlysomereasons, indent);
452     if (idp->onlyattr > 0)
453         BIO_printf(out, "%*sOnly Attribute Certificates\n", indent, "");
454     if (!idp->distpoint && (idp->onlyuser <= 0) && (idp->onlyCA <= 0)
455         && (idp->indirectCRL <= 0) && !idp->onlysomereasons
456         && (idp->onlyattr <= 0))
457         BIO_printf(out, "%*s<EMPTY>\n", indent, "");
458 
459     return 1;
460 }
461 
i2r_crldp(const X509V3_EXT_METHOD * method,void * pcrldp,BIO * out,int indent)462 static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
463                      int indent)
464 {
465     STACK_OF(DIST_POINT) *crld = pcrldp;
466     DIST_POINT *point;
467     int i;
468     for (i = 0; i < sk_DIST_POINT_num(crld); i++) {
469         if (i > 0)
470             BIO_puts(out, "\n");
471         point = sk_DIST_POINT_value(crld, i);
472         if (point->distpoint)
473             print_distpoint(out, point->distpoint, indent);
474         if (point->reasons)
475             print_reasons(out, "Reasons", point->reasons, indent);
476         if (point->CRLissuer) {
477             BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
478             OSSL_GENERAL_NAMES_print(out, point->CRLissuer, indent);
479         }
480     }
481     return 1;
482 }
483 
484 /* Append any nameRelativeToCRLIssuer in dpn to iname, set in dpn->dpname */
DIST_POINT_set_dpname(DIST_POINT_NAME * dpn,const X509_NAME * iname)485 int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, const X509_NAME *iname)
486 {
487     int i;
488     STACK_OF(X509_NAME_ENTRY) *frag;
489     X509_NAME_ENTRY *ne;
490 
491     if (dpn == NULL || dpn->type != 1)
492         return 1;
493     frag = dpn->name.relativename;
494     X509_NAME_free(dpn->dpname); /* just in case it was already set */
495     dpn->dpname = X509_NAME_dup(iname);
496     if (dpn->dpname == NULL)
497         return 0;
498     for (i = 0; i < sk_X509_NAME_ENTRY_num(frag); i++) {
499         ne = sk_X509_NAME_ENTRY_value(frag, i);
500         if (!X509_NAME_add_entry(dpn->dpname, ne, -1, i ? 0 : 1))
501             goto err;
502     }
503     /* generate cached encoding of name */
504     if (i2d_X509_NAME(dpn->dpname, NULL) >= 0)
505         return 1;
506 
507  err:
508     X509_NAME_free(dpn->dpname);
509     dpn->dpname = NULL;
510     return 0;
511 }
512