1d9e397b599b13d642138480a28c14db7a136bf0Adam Langley/* pcy_map.c */ 2d9e397b599b13d642138480a28c14db7a136bf0Adam Langley/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * project 2004. 4d9e397b599b13d642138480a28c14db7a136bf0Adam Langley */ 5d9e397b599b13d642138480a28c14db7a136bf0Adam Langley/* ==================================================================== 6d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * Copyright (c) 2004 The OpenSSL Project. All rights reserved. 7d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 8d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * Redistribution and use in source and binary forms, with or without 9d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * modification, are permitted provided that the following conditions 10d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * are met: 11d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 12d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 1. Redistributions of source code must retain the above copyright 13d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * notice, this list of conditions and the following disclaimer. 14d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 15d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 2. Redistributions in binary form must reproduce the above copyright 16d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * notice, this list of conditions and the following disclaimer in 17d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * the documentation and/or other materials provided with the 18d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * distribution. 19d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 20d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 3. All advertising materials mentioning features or use of this 21d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * software must display the following acknowledgment: 22d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * "This product includes software developed by the OpenSSL Project 23d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 25d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * endorse or promote products derived from this software without 27d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * prior written permission. For written permission, please contact 28d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * licensing@OpenSSL.org. 29d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 30d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 5. Products derived from this software may not be called "OpenSSL" 31d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * nor may "OpenSSL" appear in their names without prior written 32d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * permission of the OpenSSL Project. 33d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 34d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 6. Redistributions of any form whatsoever must retain the following 35d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * acknowledgment: 36d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * "This product includes software developed by the OpenSSL Project 37d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 39d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * OF THE POSSIBILITY OF SUCH DAMAGE. 51d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * ==================================================================== 52d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 53d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * This product includes cryptographic software written by Eric Young 54d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * (eay@cryptsoft.com). This product includes software written by Tim 55d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * Hudson (tjh@cryptsoft.com). 56d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * 57d9e397b599b13d642138480a28c14db7a136bf0Adam Langley */ 58d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 59d9e397b599b13d642138480a28c14db7a136bf0Adam Langley#include <openssl/obj.h> 60d9e397b599b13d642138480a28c14db7a136bf0Adam Langley#include <openssl/x509.h> 61d9e397b599b13d642138480a28c14db7a136bf0Adam Langley#include <openssl/x509v3.h> 62d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 63d9e397b599b13d642138480a28c14db7a136bf0Adam Langley#include "pcy_int.h" 64d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 65d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 66d9e397b599b13d642138480a28c14db7a136bf0Adam Langley/* Set policy mapping entries in cache. 67d9e397b599b13d642138480a28c14db7a136bf0Adam Langley * Note: this modifies the passed POLICY_MAPPINGS structure 68d9e397b599b13d642138480a28c14db7a136bf0Adam Langley */ 69d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 70d9e397b599b13d642138480a28c14db7a136bf0Adam Langleyint policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) 71d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 72d9e397b599b13d642138480a28c14db7a136bf0Adam Langley POLICY_MAPPING *map; 73d9e397b599b13d642138480a28c14db7a136bf0Adam Langley X509_POLICY_DATA *data; 74d9e397b599b13d642138480a28c14db7a136bf0Adam Langley X509_POLICY_CACHE *cache = x->policy_cache; 75d9e397b599b13d642138480a28c14db7a136bf0Adam Langley size_t i; 76d9e397b599b13d642138480a28c14db7a136bf0Adam Langley int ret = 0; 77d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (sk_POLICY_MAPPING_num(maps) == 0) 78d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 79d9e397b599b13d642138480a28c14db7a136bf0Adam Langley ret = -1; 80d9e397b599b13d642138480a28c14db7a136bf0Adam Langley goto bad_mapping; 81d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 82d9e397b599b13d642138480a28c14db7a136bf0Adam Langley for (i = 0; i < sk_POLICY_MAPPING_num(maps); i++) 83d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 84d9e397b599b13d642138480a28c14db7a136bf0Adam Langley map = sk_POLICY_MAPPING_value(maps, i); 85d9e397b599b13d642138480a28c14db7a136bf0Adam Langley /* Reject if map to or from anyPolicy */ 86d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if ((OBJ_obj2nid(map->subjectDomainPolicy) == NID_any_policy) 87d9e397b599b13d642138480a28c14db7a136bf0Adam Langley || (OBJ_obj2nid(map->issuerDomainPolicy) == NID_any_policy)) 88d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 89d9e397b599b13d642138480a28c14db7a136bf0Adam Langley ret = -1; 90d9e397b599b13d642138480a28c14db7a136bf0Adam Langley goto bad_mapping; 91d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 92d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 93d9e397b599b13d642138480a28c14db7a136bf0Adam Langley /* Attempt to find matching policy data */ 94d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data = policy_cache_find_data(cache, map->issuerDomainPolicy); 95d9e397b599b13d642138480a28c14db7a136bf0Adam Langley /* If we don't have anyPolicy can't map */ 96d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (!data && !cache->anyPolicy) 97d9e397b599b13d642138480a28c14db7a136bf0Adam Langley continue; 98d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 99d9e397b599b13d642138480a28c14db7a136bf0Adam Langley /* Create a NODE from anyPolicy */ 100d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (!data) 101d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 102d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data = policy_data_new(NULL, map->issuerDomainPolicy, 103d9e397b599b13d642138480a28c14db7a136bf0Adam Langley cache->anyPolicy->flags 104d9e397b599b13d642138480a28c14db7a136bf0Adam Langley & POLICY_DATA_FLAG_CRITICAL); 105d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (!data) 106d9e397b599b13d642138480a28c14db7a136bf0Adam Langley goto bad_mapping; 107d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data->qualifier_set = cache->anyPolicy->qualifier_set; 108d9e397b599b13d642138480a28c14db7a136bf0Adam Langley /*map->issuerDomainPolicy = NULL;*/ 109d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data->flags |= POLICY_DATA_FLAG_MAPPED_ANY; 110d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; 111d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (!sk_X509_POLICY_DATA_push(cache->data, data)) 112d9e397b599b13d642138480a28c14db7a136bf0Adam Langley { 113d9e397b599b13d642138480a28c14db7a136bf0Adam Langley policy_data_free(data); 114d9e397b599b13d642138480a28c14db7a136bf0Adam Langley goto bad_mapping; 115d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 116d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 117d9e397b599b13d642138480a28c14db7a136bf0Adam Langley else 118d9e397b599b13d642138480a28c14db7a136bf0Adam Langley data->flags |= POLICY_DATA_FLAG_MAPPED; 119d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (!sk_ASN1_OBJECT_push(data->expected_policy_set, 120d9e397b599b13d642138480a28c14db7a136bf0Adam Langley map->subjectDomainPolicy)) 121d9e397b599b13d642138480a28c14db7a136bf0Adam Langley goto bad_mapping; 122d9e397b599b13d642138480a28c14db7a136bf0Adam Langley map->subjectDomainPolicy = NULL; 123d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 124d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 125d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 126d9e397b599b13d642138480a28c14db7a136bf0Adam Langley ret = 1; 127d9e397b599b13d642138480a28c14db7a136bf0Adam Langley bad_mapping: 128d9e397b599b13d642138480a28c14db7a136bf0Adam Langley if (ret == -1) 129d9e397b599b13d642138480a28c14db7a136bf0Adam Langley x->ex_flags |= EXFLAG_INVALID_POLICY; 130d9e397b599b13d642138480a28c14db7a136bf0Adam Langley sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); 131d9e397b599b13d642138480a28c14db7a136bf0Adam Langley return ret; 132d9e397b599b13d642138480a28c14db7a136bf0Adam Langley 133d9e397b599b13d642138480a28c14db7a136bf0Adam Langley } 134