1 /* $OpenBSD: x_name.c,v 1.30 2015/07/15 17:41:56 miod Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
63 #include <openssl/asn1t.h>
64 #include <openssl/err.h>
65 #include <openssl/x509.h>
67 #include "asn1_locl.h"
69 typedef STACK_OF(X509_NAME_ENTRY
) STACK_OF_X509_NAME_ENTRY
;
70 DECLARE_STACK_OF(STACK_OF_X509_NAME_ENTRY
)
72 static int x509_name_ex_d2i(ASN1_VALUE
**val
, const unsigned char **in
,
73 long len
, const ASN1_ITEM
*it
, int tag
, int aclass
, char opt
,
76 static int x509_name_ex_i2d(ASN1_VALUE
**val
, unsigned char **out
,
77 const ASN1_ITEM
*it
, int tag
, int aclass
);
78 static int x509_name_ex_new(ASN1_VALUE
**val
, const ASN1_ITEM
*it
);
79 static void x509_name_ex_free(ASN1_VALUE
**val
, const ASN1_ITEM
*it
);
81 static int x509_name_encode(X509_NAME
*a
);
82 static int x509_name_canon(X509_NAME
*a
);
83 static int asn1_string_canon(ASN1_STRING
*out
, ASN1_STRING
*in
);
84 static int i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY
) *intname
,
87 static int x509_name_ex_print(BIO
*out
, ASN1_VALUE
**pval
, int indent
,
88 const char *fname
, const ASN1_PCTX
*pctx
);
90 static const ASN1_TEMPLATE X509_NAME_ENTRY_seq_tt
[] = {
92 .offset
= offsetof(X509_NAME_ENTRY
, object
),
93 .field_name
= "object",
94 .item
= &ASN1_OBJECT_it
,
97 .offset
= offsetof(X509_NAME_ENTRY
, value
),
98 .field_name
= "value",
99 .item
= &ASN1_PRINTABLE_it
,
103 const ASN1_ITEM X509_NAME_ENTRY_it
= {
104 .itype
= ASN1_ITYPE_SEQUENCE
,
105 .utype
= V_ASN1_SEQUENCE
,
106 .templates
= X509_NAME_ENTRY_seq_tt
,
107 .tcount
= sizeof(X509_NAME_ENTRY_seq_tt
) / sizeof(ASN1_TEMPLATE
),
108 .size
= sizeof(X509_NAME_ENTRY
),
109 .sname
= "X509_NAME_ENTRY",
114 d2i_X509_NAME_ENTRY(X509_NAME_ENTRY
**a
, const unsigned char **in
, long len
)
116 return (X509_NAME_ENTRY
*)ASN1_item_d2i((ASN1_VALUE
**)a
, in
, len
,
117 &X509_NAME_ENTRY_it
);
121 i2d_X509_NAME_ENTRY(X509_NAME_ENTRY
*a
, unsigned char **out
)
123 return ASN1_item_i2d((ASN1_VALUE
*)a
, out
, &X509_NAME_ENTRY_it
);
127 X509_NAME_ENTRY_new(void)
129 return (X509_NAME_ENTRY
*)ASN1_item_new(&X509_NAME_ENTRY_it
);
133 X509_NAME_ENTRY_free(X509_NAME_ENTRY
*a
)
135 ASN1_item_free((ASN1_VALUE
*)a
, &X509_NAME_ENTRY_it
);
139 X509_NAME_ENTRY_dup(X509_NAME_ENTRY
*x
)
141 return ASN1_item_dup(&X509_NAME_ENTRY_it
, x
);
144 /* For the "Name" type we need a SEQUENCE OF { SET OF X509_NAME_ENTRY }
145 * so declare two template wrappers for this
148 static const ASN1_TEMPLATE X509_NAME_ENTRIES_item_tt
= {
149 .flags
= ASN1_TFLG_SET_OF
,
152 .field_name
= "RDNS",
153 .item
= &X509_NAME_ENTRY_it
,
156 const ASN1_ITEM X509_NAME_ENTRIES_it
= {
157 .itype
= ASN1_ITYPE_PRIMITIVE
,
159 .templates
= &X509_NAME_ENTRIES_item_tt
,
163 .sname
= "X509_NAME_ENTRIES",
166 static const ASN1_TEMPLATE X509_NAME_INTERNAL_item_tt
= {
167 .flags
= ASN1_TFLG_SEQUENCE_OF
,
170 .field_name
= "Name",
171 .item
= &X509_NAME_ENTRIES_it
,
174 const ASN1_ITEM X509_NAME_INTERNAL_it
= {
175 .itype
= ASN1_ITYPE_PRIMITIVE
,
177 .templates
= &X509_NAME_INTERNAL_item_tt
,
181 .sname
= "X509_NAME_INTERNAL",
184 /* Normally that's where it would end: we'd have two nested STACK structures
185 * representing the ASN1. Unfortunately X509_NAME uses a completely different
186 * form and caches encodings so we have to process the internal form and convert
187 * to the external form.
190 const ASN1_EXTERN_FUNCS x509_name_ff
= {
194 0, /* Default clear behaviour is OK */
200 const ASN1_ITEM X509_NAME_it
= {
201 .itype
= ASN1_ITYPE_EXTERN
,
202 .utype
= V_ASN1_SEQUENCE
,
205 .funcs
= &x509_name_ff
,
207 .sname
= "X509_NAME",
211 d2i_X509_NAME(X509_NAME
**a
, const unsigned char **in
, long len
)
213 return (X509_NAME
*)ASN1_item_d2i((ASN1_VALUE
**)a
, in
, len
,
218 i2d_X509_NAME(X509_NAME
*a
, unsigned char **out
)
220 return ASN1_item_i2d((ASN1_VALUE
*)a
, out
, &X509_NAME_it
);
226 return (X509_NAME
*)ASN1_item_new(&X509_NAME_it
);
230 X509_NAME_free(X509_NAME
*a
)
232 ASN1_item_free((ASN1_VALUE
*)a
, &X509_NAME_it
);
236 X509_NAME_dup(X509_NAME
*x
)
238 return ASN1_item_dup(&X509_NAME_it
, x
);
242 x509_name_ex_new(ASN1_VALUE
**val
, const ASN1_ITEM
*it
)
244 X509_NAME
*ret
= NULL
;
246 ret
= malloc(sizeof(X509_NAME
));
249 if ((ret
->entries
= sk_X509_NAME_ENTRY_new_null()) == NULL
)
251 if ((ret
->bytes
= BUF_MEM_new()) == NULL
)
253 ret
->canon_enc
= NULL
;
254 ret
->canon_enclen
= 0;
256 *val
= (ASN1_VALUE
*)ret
;
260 ASN1err(ASN1_F_X509_NAME_EX_NEW
, ERR_R_MALLOC_FAILURE
);
263 sk_X509_NAME_ENTRY_free(ret
->entries
);
270 x509_name_ex_free(ASN1_VALUE
**pval
, const ASN1_ITEM
*it
)
276 a
= (X509_NAME
*)*pval
;
278 BUF_MEM_free(a
->bytes
);
279 sk_X509_NAME_ENTRY_pop_free(a
->entries
, X509_NAME_ENTRY_free
);
286 x509_name_ex_d2i(ASN1_VALUE
**val
, const unsigned char **in
, long len
,
287 const ASN1_ITEM
*it
, int tag
, int aclass
, char opt
, ASN1_TLC
*ctx
)
289 const unsigned char *p
= *in
, *q
;
291 STACK_OF(STACK_OF_X509_NAME_ENTRY
) *s
;
299 STACK_OF(X509_NAME_ENTRY
) *entries
;
300 X509_NAME_ENTRY
*entry
;
303 /* Get internal representation of Name */
304 ret
= ASN1_item_ex_d2i(&intname
.a
, &p
, len
,
305 ASN1_ITEM_rptr(X509_NAME_INTERNAL
), tag
, aclass
, opt
, ctx
);
311 x509_name_ex_free(val
, NULL
);
312 if (!x509_name_ex_new(&nm
.a
, NULL
))
314 /* We've decoded it: now cache encoding */
315 if (!BUF_MEM_grow(nm
.x
->bytes
, p
- q
))
317 memcpy(nm
.x
->bytes
->data
, q
, p
- q
);
319 /* Convert internal representation to X509_NAME structure */
320 for (i
= 0; i
< sk_STACK_OF_X509_NAME_ENTRY_num(intname
.s
); i
++) {
321 entries
= sk_STACK_OF_X509_NAME_ENTRY_value(intname
.s
, i
);
322 for (j
= 0; j
< sk_X509_NAME_ENTRY_num(entries
); j
++) {
323 entry
= sk_X509_NAME_ENTRY_value(entries
, j
);
325 if (!sk_X509_NAME_ENTRY_push(nm
.x
->entries
, entry
))
328 sk_X509_NAME_ENTRY_free(entries
);
330 sk_STACK_OF_X509_NAME_ENTRY_free(intname
.s
);
331 ret
= x509_name_canon(nm
.x
);
341 X509_NAME_free(nm
.x
);
342 ASN1err(ASN1_F_X509_NAME_EX_D2I
, ERR_R_NESTED_ASN1_ERROR
);
347 x509_name_ex_i2d(ASN1_VALUE
**val
, unsigned char **out
, const ASN1_ITEM
*it
,
351 X509_NAME
*a
= (X509_NAME
*)*val
;
354 ret
= x509_name_encode(a
);
357 ret
= x509_name_canon(a
);
361 ret
= a
->bytes
->length
;
363 memcpy(*out
, a
->bytes
->data
, ret
);
370 local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY
) *ne
)
372 sk_X509_NAME_ENTRY_free(ne
);
376 local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY
) *ne
)
378 sk_X509_NAME_ENTRY_pop_free(ne
, X509_NAME_ENTRY_free
);
382 x509_name_encode(X509_NAME
*a
)
385 STACK_OF(STACK_OF_X509_NAME_ENTRY
) *s
;
390 STACK_OF(X509_NAME_ENTRY
) *entries
= NULL
;
391 X509_NAME_ENTRY
*entry
;
394 intname
.s
= sk_STACK_OF_X509_NAME_ENTRY_new_null();
397 for (i
= 0; i
< sk_X509_NAME_ENTRY_num(a
->entries
); i
++) {
398 entry
= sk_X509_NAME_ENTRY_value(a
->entries
, i
);
399 if (entry
->set
!= set
) {
400 entries
= sk_X509_NAME_ENTRY_new_null();
403 if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname
.s
,
408 if (entries
== NULL
/* if entry->set is bogusly -1 */ ||
409 !sk_X509_NAME_ENTRY_push(entries
, entry
))
412 len
= ASN1_item_ex_i2d(&intname
.a
, NULL
,
413 ASN1_ITEM_rptr(X509_NAME_INTERNAL
), -1, -1);
414 if (!BUF_MEM_grow(a
->bytes
, len
))
416 p
= (unsigned char *)a
->bytes
->data
;
417 ASN1_item_ex_i2d(&intname
.a
, &p
, ASN1_ITEM_rptr(X509_NAME_INTERNAL
),
419 sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname
.s
,
420 local_sk_X509_NAME_ENTRY_free
);
425 sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname
.s
,
426 local_sk_X509_NAME_ENTRY_free
);
427 ASN1err(ASN1_F_X509_NAME_ENCODE
, ERR_R_MALLOC_FAILURE
);
432 x509_name_ex_print(BIO
*out
, ASN1_VALUE
**pval
, int indent
, const char *fname
,
433 const ASN1_PCTX
*pctx
)
435 if (X509_NAME_print_ex(out
, (X509_NAME
*)*pval
, indent
,
436 pctx
->nm_flags
) <= 0)
441 /* This function generates the canonical encoding of the Name structure.
442 * In it all strings are converted to UTF8, leading, trailing and
443 * multiple spaces collapsed, converted to lower case and the leading
444 * SEQUENCE header removed.
446 * In future we could also normalize the UTF8 too.
448 * By doing this comparison of Name structures can be rapidly
449 * performed by just using memcmp() of the canonical encoding.
450 * By omitting the leading SEQUENCE name constraints of type
451 * dirName can also be checked with a simple memcmp().
455 x509_name_canon(X509_NAME
*a
)
458 STACK_OF(STACK_OF_X509_NAME_ENTRY
) *intname
= NULL
;
459 STACK_OF(X509_NAME_ENTRY
) *entries
= NULL
;
460 X509_NAME_ENTRY
*entry
, *tmpentry
= NULL
;
461 int i
, len
, set
= -1, ret
= 0;
467 /* Special case: empty X509_NAME => null encoding */
468 if (sk_X509_NAME_ENTRY_num(a
->entries
) == 0) {
472 intname
= sk_STACK_OF_X509_NAME_ENTRY_new_null();
475 for (i
= 0; i
< sk_X509_NAME_ENTRY_num(a
->entries
); i
++) {
476 entry
= sk_X509_NAME_ENTRY_value(a
->entries
, i
);
477 if (entry
->set
!= set
) {
478 entries
= sk_X509_NAME_ENTRY_new_null();
481 if (sk_STACK_OF_X509_NAME_ENTRY_push(intname
,
483 sk_X509_NAME_ENTRY_free(entries
);
488 tmpentry
= X509_NAME_ENTRY_new();
489 if (tmpentry
== NULL
)
491 tmpentry
->object
= OBJ_dup(entry
->object
);
492 if (tmpentry
->object
== NULL
)
494 if (!asn1_string_canon(tmpentry
->value
, entry
->value
))
496 if (entries
== NULL
/* if entry->set is bogusly -1 */ ||
497 !sk_X509_NAME_ENTRY_push(entries
, tmpentry
))
502 /* Finally generate encoding */
503 len
= i2d_name_canon(intname
, NULL
);
510 a
->canon_enclen
= len
;
511 i2d_name_canon(intname
, &p
);
516 X509_NAME_ENTRY_free(tmpentry
);
518 sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname
,
519 local_sk_X509_NAME_ENTRY_pop_free
);
523 /* Bitmap of all the types of string that will be canonicalized. */
525 #define ASN1_MASK_CANON \
526 (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING \
527 | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING \
528 | B_ASN1_VISIBLESTRING)
532 asn1_string_canon(ASN1_STRING
*out
, ASN1_STRING
*in
)
534 unsigned char *to
, *from
;
537 /* If type not in bitmask just copy string across */
538 if (!(ASN1_tag2bit(in
->type
) & ASN1_MASK_CANON
)) {
539 if (!ASN1_STRING_copy(out
, in
))
544 out
->type
= V_ASN1_UTF8STRING
;
545 out
->length
= ASN1_STRING_to_UTF8(&out
->data
, in
);
546 if (out
->length
== -1)
554 /* Convert string in place to canonical form.
555 * Ultimately we may need to handle a wider range of characters
556 * but for now ignore anything with MSB set and rely on the
557 * isspace() and tolower() functions.
560 /* Ignore leading spaces */
561 while ((len
> 0) && !(*from
& 0x80) && isspace(*from
)) {
568 /* Ignore trailing spaces */
569 while ((len
> 0) && !(*to
& 0x80) && isspace(*to
)) {
578 /* If MSB set just copy across */
583 /* Collapse multiple spaces */
584 else if (isspace(*from
)) {
585 /* Copy one space across */
587 /* Ignore subsequent spaces. Note: don't need to
588 * check len here because we know the last
589 * character is a non-space so we can't overflow.
594 } while (!(*from
& 0x80) && isspace(*from
));
596 *to
++ = tolower(*from
);
602 out
->length
= to
- out
->data
;
608 i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY
) *_intname
, unsigned char **in
)
612 STACK_OF(ASN1_VALUE
) *intname
= (STACK_OF(ASN1_VALUE
) *)_intname
;
615 for (i
= 0; i
< sk_ASN1_VALUE_num(intname
); i
++) {
616 v
= sk_ASN1_VALUE_value(intname
, i
);
617 ltmp
= ASN1_item_ex_i2d(&v
, in
,
618 ASN1_ITEM_rptr(X509_NAME_ENTRIES
), -1, -1);
627 X509_NAME_set(X509_NAME
**xn
, X509_NAME
*name
)
635 in
= X509_NAME_dup(name
);
641 return (*xn
!= NULL
);