crypto/openssl/crypto/x509v3/v3_alt.c

   1 /* v3_alt.c */
   2 /*
   3  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   4  * project.
   5  */
   6 /* ====================================================================
   7  * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  *
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in
  18  *    the documentation and/or other materials provided with the
  19  *    distribution.
  20  *
  21  * 3. All advertising materials mentioning features or use of this
  22  *    software must display the following acknowledgment:
  23  *    "This product includes software developed by the OpenSSL Project
  24  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  25  *
  26  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  27  *    endorse or promote products derived from this software without
  28  *    prior written permission. For written permission, please contact
  29  *    licensing@OpenSSL.org.
  30  *
  31  * 5. Products derived from this software may not be called "OpenSSL"
  32  *    nor may "OpenSSL" appear in their names without prior written
  33  *    permission of the OpenSSL Project.
  34  *
  35  * 6. Redistributions of any form whatsoever must retain the following
  36  *    acknowledgment:
  37  *    "This product includes software developed by the OpenSSL Project
  38  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  39  *
  40  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  41  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  43  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  44  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  45  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  46  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  47  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  49  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  50  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  51  * OF THE POSSIBILITY OF SUCH DAMAGE.
  52  * ====================================================================
  53  *
  54  * This product includes cryptographic software written by Eric Young
  55  * (eay@cryptsoft.com).  This product includes software written by Tim
  56  * Hudson (tjh@cryptsoft.com).
  57  *
  58  */
  59
  60 #include <stdio.h>
  61 #include "cryptlib.h"
  62 #include <openssl/conf.h>
  63 #include <openssl/x509v3.h>
  64
  65 static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
  66                                       X509V3_CTX *ctx,
  67                                       STACK_OF(CONF_VALUE) *nval);
  68 static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
  69                                      X509V3_CTX *ctx,
  70                                      STACK_OF(CONF_VALUE) *nval);
  71 static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
  72 static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
  73 static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
  74 static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
  75
  76 const X509V3_EXT_METHOD v3_alt[] = {
  77     {NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
  78      0, 0, 0, 0,
  79      0, 0,
  80      (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
  81      (X509V3_EXT_V2I)v2i_subject_alt,
  82      NULL, NULL, NULL},
  83
  84     {NID_issuer_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
  85      0, 0, 0, 0,
  86      0, 0,
  87      (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
  88      (X509V3_EXT_V2I)v2i_issuer_alt,
  89      NULL, NULL, NULL},
  90
  91     {NID_certificate_issuer, 0, ASN1_ITEM_ref(GENERAL_NAMES),
  92      0, 0, 0, 0,
  93      0, 0,
  94      (X509V3_EXT_I2V) i2v_GENERAL_NAMES,
  95      NULL, NULL, NULL, NULL},
  96 };
  97
  98 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method,
  99                                         GENERAL_NAMES *gens,
 100                                         STACK_OF(CONF_VALUE) *ret)
 101 {
 102     int i;
 103     GENERAL_NAME *gen;
 104     for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
 105         gen = sk_GENERAL_NAME_value(gens, i);
 106         ret = i2v_GENERAL_NAME(method, gen, ret);
 107     }
 108     if (!ret)
 109         return sk_CONF_VALUE_new_null();
 110     return ret;
 111 }
 112
 113 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
 114                                        GENERAL_NAME *gen,
 115                                        STACK_OF(CONF_VALUE) *ret)
 116 {
 117     unsigned char *p;
 118     char oline[256], htmp[5];
 119     int i;
 120     switch (gen->type) {
 121     case GEN_OTHERNAME:
 122         X509V3_add_value("othername", "<unsupported>", &ret);
 123         break;
 124
 125     case GEN_X400:
 126         X509V3_add_value("X400Name", "<unsupported>", &ret);
 127         break;
 128
 129     case GEN_EDIPARTY:
 130         X509V3_add_value("EdiPartyName", "<unsupported>", &ret);
 131         break;
 132
 133     case GEN_EMAIL:
 134         X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);
 135         break;
 136
 137     case GEN_DNS:
 138         X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);
 139         break;
 140
 141     case GEN_URI:
 142         X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);
 143         break;
 144
 145     case GEN_DIRNAME:
 146         X509_NAME_oneline(gen->d.dirn, oline, 256);
 147         X509V3_add_value("DirName", oline, &ret);
 148         break;
 149
 150     case GEN_IPADD:
 151         p = gen->d.ip->data;
 152         if (gen->d.ip->length == 4)
 153             BIO_snprintf(oline, sizeof oline,
 154                          "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
 155         else if (gen->d.ip->length == 16) {
 156             oline[0] = 0;
 157             for (i = 0; i < 8; i++) {
 158                 BIO_snprintf(htmp, sizeof htmp, "%X", p[0] << 8 | p[1]);
 159                 p += 2;
 160                 strcat(oline, htmp);
 161                 if (i != 7)
 162                     strcat(oline, ":");
 163             }
 164         } else {
 165             X509V3_add_value("IP Address", "<invalid>", &ret);
 166             break;
 167         }
 168         X509V3_add_value("IP Address", oline, &ret);
 169         break;
 170
 171     case GEN_RID:
 172         i2t_ASN1_OBJECT(oline, 256, gen->d.rid);
 173         X509V3_add_value("Registered ID", oline, &ret);
 174         break;
 175     }
 176     return ret;
 177 }
 178
 179 int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
 180 {
 181     unsigned char *p;
 182     int i;
 183     switch (gen->type) {
 184     case GEN_OTHERNAME:
 185         BIO_printf(out, "othername:<unsupported>");
 186         break;
 187
 188     case GEN_X400:
 189         BIO_printf(out, "X400Name:<unsupported>");
 190         break;
 191
 192     case GEN_EDIPARTY:
 193         /* Maybe fix this: it is supported now */
 194         BIO_printf(out, "EdiPartyName:<unsupported>");
 195         break;
 196
 197     case GEN_EMAIL:
 198         BIO_printf(out, "email:%s", gen->d.ia5->data);
 199         break;
 200
 201     case GEN_DNS:
 202         BIO_printf(out, "DNS:%s", gen->d.ia5->data);
 203         break;
 204
 205     case GEN_URI:
 206         BIO_printf(out, "URI:%s", gen->d.ia5->data);
 207         break;
 208
 209     case GEN_DIRNAME:
 210         BIO_printf(out, "DirName: ");
 211         X509_NAME_print_ex(out, gen->d.dirn, 0, XN_FLAG_ONELINE);
 212         break;
 213
 214     case GEN_IPADD:
 215         p = gen->d.ip->data;
 216         if (gen->d.ip->length == 4)
 217             BIO_printf(out, "IP Address:%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
 218         else if (gen->d.ip->length == 16) {
 219             BIO_printf(out, "IP Address");
 220             for (i = 0; i < 8; i++) {
 221                 BIO_printf(out, ":%X", p[0] << 8 | p[1]);
 222                 p += 2;
 223             }
 224             BIO_puts(out, "\n");
 225         } else {
 226             BIO_printf(out, "IP Address:<invalid>");
 227             break;
 228         }
 229         break;
 230
 231     case GEN_RID:
 232         BIO_printf(out, "Registered ID");
 233         i2a_ASN1_OBJECT(out, gen->d.rid);
 234         break;
 235     }
 236     return 1;
 237 }
 238
 239 static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
 240                                      X509V3_CTX *ctx,
 241                                      STACK_OF(CONF_VALUE) *nval)
 242 {
 243     GENERAL_NAMES *gens = NULL;
 244     CONF_VALUE *cnf;
 245     int i;
 246     if (!(gens = sk_GENERAL_NAME_new_null())) {
 247         X509V3err(X509V3_F_V2I_ISSUER_ALT, ERR_R_MALLOC_FAILURE);
 248         return NULL;
 249     }
 250     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
 251         cnf = sk_CONF_VALUE_value(nval, i);
 252         if (!name_cmp(cnf->name, "issuer") && cnf->value &&
 253             !strcmp(cnf->value, "copy")) {
 254             if (!copy_issuer(ctx, gens))
 255                 goto err;
 256         } else {
 257             GENERAL_NAME *gen;
 258             if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
 259                 goto err;
 260             sk_GENERAL_NAME_push(gens, gen);
 261         }
 262     }
 263     return gens;
 264  err:
 265     sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
 266     return NULL;
 267 }
 268
 269 /* Append subject altname of issuer to issuer alt name of subject */
 270
 271 static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
 272 {
 273     GENERAL_NAMES *ialt;
 274     GENERAL_NAME *gen;
 275     X509_EXTENSION *ext;
 276     int i;
 277     if (ctx && (ctx->flags == CTX_TEST))
 278         return 1;
 279     if (!ctx || !ctx->issuer_cert) {
 280         X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_NO_ISSUER_DETAILS);
 281         goto err;
 282     }
 283     i = X509_get_ext_by_NID(ctx->issuer_cert, NID_subject_alt_name, -1);
 284     if (i < 0)
 285         return 1;
 286     if (!(ext = X509_get_ext(ctx->issuer_cert, i)) ||
 287         !(ialt = X509V3_EXT_d2i(ext))) {
 288         X509V3err(X509V3_F_COPY_ISSUER, X509V3_R_ISSUER_DECODE_ERROR);
 289         goto err;
 290     }
 291
 292     for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
 293         gen = sk_GENERAL_NAME_value(ialt, i);
 294         if (!sk_GENERAL_NAME_push(gens, gen)) {
 295             X509V3err(X509V3_F_COPY_ISSUER, ERR_R_MALLOC_FAILURE);
 296             goto err;
 297         }
 298     }
 299     sk_GENERAL_NAME_free(ialt);
 300
 301     return 1;
 302
 303  err:
 304     return 0;
 305
 306 }
 307
 308 static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
 309                                       X509V3_CTX *ctx,
 310                                       STACK_OF(CONF_VALUE) *nval)
 311 {
 312     GENERAL_NAMES *gens = NULL;
 313     CONF_VALUE *cnf;
 314     int i;
 315     if (!(gens = sk_GENERAL_NAME_new_null())) {
 316         X509V3err(X509V3_F_V2I_SUBJECT_ALT, ERR_R_MALLOC_FAILURE);
 317         return NULL;
 318     }
 319     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
 320         cnf = sk_CONF_VALUE_value(nval, i);
 321         if (!name_cmp(cnf->name, "email") && cnf->value &&
 322             !strcmp(cnf->value, "copy")) {
 323             if (!copy_email(ctx, gens, 0))
 324                 goto err;
 325         } else if (!name_cmp(cnf->name, "email") && cnf->value &&
 326                    !strcmp(cnf->value, "move")) {
 327             if (!copy_email(ctx, gens, 1))
 328                 goto err;
 329         } else {
 330             GENERAL_NAME *gen;
 331             if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
 332                 goto err;
 333             sk_GENERAL_NAME_push(gens, gen);
 334         }
 335     }
 336     return gens;
 337  err:
 338     sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
 339     return NULL;
 340 }
 341
 342 /*
 343  * Copy any email addresses in a certificate or request to GENERAL_NAMES
 344  */
 345
 346 static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
 347 {
 348     X509_NAME *nm;
 349     ASN1_IA5STRING *email = NULL;
 350     X509_NAME_ENTRY *ne;
 351     GENERAL_NAME *gen = NULL;
 352     int i;
 353     if (ctx != NULL && ctx->flags == CTX_TEST)
 354         return 1;
 355     if (!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
 356         X509V3err(X509V3_F_COPY_EMAIL, X509V3_R_NO_SUBJECT_DETAILS);
 357         goto err;
 358     }
 359     /* Find the subject name */
 360     if (ctx->subject_cert)
 361         nm = X509_get_subject_name(ctx->subject_cert);
 362     else
 363         nm = X509_REQ_get_subject_name(ctx->subject_req);
 364
 365     /* Now add any email address(es) to STACK */
 366     i = -1;
 367     while ((i = X509_NAME_get_index_by_NID(nm,
 368                                            NID_pkcs9_emailAddress, i)) >= 0) {
 369         ne = X509_NAME_get_entry(nm, i);
 370         email = M_ASN1_IA5STRING_dup(X509_NAME_ENTRY_get_data(ne));
 371         if (move_p) {
 372             X509_NAME_delete_entry(nm, i);
 373             X509_NAME_ENTRY_free(ne);
 374             i--;
 375         }
 376         if (!email || !(gen = GENERAL_NAME_new())) {
 377             X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
 378             goto err;
 379         }
 380         gen->d.ia5 = email;
 381         email = NULL;
 382         gen->type = GEN_EMAIL;
 383         if (!sk_GENERAL_NAME_push(gens, gen)) {
 384             X509V3err(X509V3_F_COPY_EMAIL, ERR_R_MALLOC_FAILURE);
 385             goto err;
 386         }
 387         gen = NULL;
 388     }
 389
 390     return 1;
 391
 392  err:
 393     GENERAL_NAME_free(gen);
 394     M_ASN1_IA5STRING_free(email);
 395     return 0;
 396
 397 }
 398
 399 GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method,
 400                                  X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
 401 {
 402     GENERAL_NAME *gen;
 403     GENERAL_NAMES *gens = NULL;
 404     CONF_VALUE *cnf;
 405     int i;
 406     if (!(gens = sk_GENERAL_NAME_new_null())) {
 407         X509V3err(X509V3_F_V2I_GENERAL_NAMES, ERR_R_MALLOC_FAILURE);
 408         return NULL;
 409     }
 410     for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
 411         cnf = sk_CONF_VALUE_value(nval, i);
 412         if (!(gen = v2i_GENERAL_NAME(method, ctx, cnf)))
 413             goto err;
 414         sk_GENERAL_NAME_push(gens, gen);
 415     }
 416     return gens;
 417  err:
 418     sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
 419     return NULL;
 420 }
 421
 422 GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method,
 423                                X509V3_CTX *ctx, CONF_VALUE *cnf)
 424 {
 425     return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
 426 }
 427
 428 GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out,
 429                                const X509V3_EXT_METHOD *method,
 430                                X509V3_CTX *ctx, int gen_type, char *value,
 431                                int is_nc)
 432 {
 433     char is_string = 0;
 434     GENERAL_NAME *gen = NULL;
 435
 436     if (!value) {
 437         X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_MISSING_VALUE);
 438         return NULL;
 439     }
 440
 441     if (out)
 442         gen = out;
 443     else {
 444         gen = GENERAL_NAME_new();
 445         if (gen == NULL) {
 446             X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
 447             return NULL;
 448         }
 449     }
 450
 451     switch (gen_type) {
 452     case GEN_URI:
 453     case GEN_EMAIL:
 454     case GEN_DNS:
 455         is_string = 1;
 456         break;
 457
 458     case GEN_RID:
 459         {
 460             ASN1_OBJECT *obj;
 461             if (!(obj = OBJ_txt2obj(value, 0))) {
 462                 X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_OBJECT);
 463                 ERR_add_error_data(2, "value=", value);
 464                 goto err;
 465             }
 466             gen->d.rid = obj;
 467         }
 468         break;
 469
 470     case GEN_IPADD:
 471         if (is_nc)
 472             gen->d.ip = a2i_IPADDRESS_NC(value);
 473         else
 474             gen->d.ip = a2i_IPADDRESS(value);
 475         if (gen->d.ip == NULL) {
 476             X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_BAD_IP_ADDRESS);
 477             ERR_add_error_data(2, "value=", value);
 478             goto err;
 479         }
 480         break;
 481
 482     case GEN_DIRNAME:
 483         if (!do_dirname(gen, value, ctx)) {
 484             X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_DIRNAME_ERROR);
 485             goto err;
 486         }
 487         break;
 488
 489     case GEN_OTHERNAME:
 490         if (!do_othername(gen, value, ctx)) {
 491             X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_OTHERNAME_ERROR);
 492             goto err;
 493         }
 494         break;
 495     default:
 496         X509V3err(X509V3_F_A2I_GENERAL_NAME, X509V3_R_UNSUPPORTED_TYPE);
 497         goto err;
 498     }
 499
 500     if (is_string) {
 501         if (!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
 502             !ASN1_STRING_set(gen->d.ia5, (unsigned char *)value,
 503                              strlen(value))) {
 504             X509V3err(X509V3_F_A2I_GENERAL_NAME, ERR_R_MALLOC_FAILURE);
 505             goto err;
 506         }
 507     }
 508
 509     gen->type = gen_type;
 510
 511     return gen;
 512
 513  err:
 514     if (!out)
 515         GENERAL_NAME_free(gen);
 516     return NULL;
 517 }
 518
 519 GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out,
 520                                   const X509V3_EXT_METHOD *method,
 521                                   X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc)
 522 {
 523     int type;
 524
 525     char *name, *value;
 526
 527     name = cnf->name;
 528     value = cnf->value;
 529
 530     if (!value) {
 531         X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_MISSING_VALUE);
 532         return NULL;
 533     }
 534
 535     if (!name_cmp(name, "email"))
 536         type = GEN_EMAIL;
 537     else if (!name_cmp(name, "URI"))
 538         type = GEN_URI;
 539     else if (!name_cmp(name, "DNS"))
 540         type = GEN_DNS;
 541     else if (!name_cmp(name, "RID"))
 542         type = GEN_RID;
 543     else if (!name_cmp(name, "IP"))
 544         type = GEN_IPADD;
 545     else if (!name_cmp(name, "dirName"))
 546         type = GEN_DIRNAME;
 547     else if (!name_cmp(name, "otherName"))
 548         type = GEN_OTHERNAME;
 549     else {
 550         X509V3err(X509V3_F_V2I_GENERAL_NAME_EX, X509V3_R_UNSUPPORTED_OPTION);
 551         ERR_add_error_data(2, "name=", name);
 552         return NULL;
 553     }
 554
 555     return a2i_GENERAL_NAME(out, method, ctx, type, value, is_nc);
 556
 557 }
 558
 559 static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
 560 {
 561     char *objtmp = NULL, *p;
 562     int objlen;
 563     if (!(p = strchr(value, ';')))
 564         return 0;
 565     if (!(gen->d.otherName = OTHERNAME_new()))
 566         return 0;
 567     /*
 568      * Free this up because we will overwrite it. no need to free type_id
 569      * because it is static
 570      */
 571     ASN1_TYPE_free(gen->d.otherName->value);
 572     if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
 573         return 0;
 574     objlen = p - value;
 575     objtmp = OPENSSL_malloc(objlen + 1);
 576     strncpy(objtmp, value, objlen);
 577     objtmp[objlen] = 0;
 578     gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
 579     OPENSSL_free(objtmp);
 580     if (!gen->d.otherName->type_id)
 581         return 0;
 582     return 1;
 583 }
 584
 585 static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
 586 {
 587     int ret = 0;
 588     STACK_OF(CONF_VALUE) *sk = NULL;
 589     X509_NAME *nm = NULL;
 590     if (!(nm = X509_NAME_new()))
 591         goto err;
 592     sk = X509V3_get_section(ctx, value);
 593     if (!sk) {
 594         X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
 595         ERR_add_error_data(2, "section=", value);
 596         goto err;
 597     }
 598     /* FIXME: should allow other character types... */
 599     ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
 600     if (!ret)
 601         goto err;
 602     gen->d.dirn = nm;
 603
 604 err:
 605     if (ret == 0)
 606         X509_NAME_free(nm);
 607     X509V3_section_free(ctx, sk);
 608     return ret;
 609 }