| // Copyright 2017 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "general_names.h" |
| |
| #include <openssl/base.h> |
| #include <openssl/bytestring.h> |
| |
| #include <climits> |
| #include <cstring> |
| |
| #include "cert_error_params.h" |
| #include "cert_errors.h" |
| #include "input.h" |
| #include "ip_util.h" |
| #include "parser.h" |
| #include "string_util.h" |
| |
| BSSL_NAMESPACE_BEGIN |
| |
| DEFINE_CERT_ERROR_ID(kFailedParsingGeneralName, "Failed parsing GeneralName"); |
| |
| namespace { |
| |
| DEFINE_CERT_ERROR_ID(kRFC822NameNotAscii, "rfc822Name is not ASCII"); |
| DEFINE_CERT_ERROR_ID(kDnsNameNotAscii, "dNSName is not ASCII"); |
| DEFINE_CERT_ERROR_ID(kURINotAscii, "uniformResourceIdentifier is not ASCII"); |
| DEFINE_CERT_ERROR_ID(kFailedParsingIp, "Failed parsing iPAddress"); |
| DEFINE_CERT_ERROR_ID(kUnknownGeneralNameType, "Unknown GeneralName type"); |
| DEFINE_CERT_ERROR_ID(kFailedReadingGeneralNames, |
| "Failed reading GeneralNames SEQUENCE"); |
| DEFINE_CERT_ERROR_ID(kGeneralNamesTrailingData, |
| "GeneralNames contains trailing data after the sequence"); |
| DEFINE_CERT_ERROR_ID(kGeneralNamesEmpty, |
| "GeneralNames is a sequence of 0 elements"); |
| DEFINE_CERT_ERROR_ID(kFailedReadingGeneralName, |
| "Failed reading GeneralName TLV"); |
| |
| } // namespace |
| |
| GeneralNames::GeneralNames() = default; |
| |
| GeneralNames::~GeneralNames() = default; |
| |
| // static |
| std::unique_ptr<GeneralNames> GeneralNames::Create(der::Input general_names_tlv, |
| CertErrors *errors) { |
| BSSL_CHECK(errors); |
| |
| // RFC 5280 section 4.2.1.6: |
| // GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName |
| der::Parser parser(general_names_tlv); |
| der::Input sequence_value; |
| if (!parser.ReadTag(CBS_ASN1_SEQUENCE, &sequence_value)) { |
| errors->AddError(kFailedReadingGeneralNames); |
| return nullptr; |
| } |
| // Should not have trailing data after GeneralNames sequence. |
| if (parser.HasMore()) { |
| errors->AddError(kGeneralNamesTrailingData); |
| return nullptr; |
| } |
| return CreateFromValue(sequence_value, errors); |
| } |
| |
| // static |
| std::unique_ptr<GeneralNames> GeneralNames::CreateFromValue( |
| der::Input general_names_value, CertErrors *errors) { |
| BSSL_CHECK(errors); |
| |
| auto general_names = std::make_unique<GeneralNames>(); |
| |
| der::Parser sequence_parser(general_names_value); |
| // The GeneralNames sequence should have at least 1 element. |
| if (!sequence_parser.HasMore()) { |
| errors->AddError(kGeneralNamesEmpty); |
| return nullptr; |
| } |
| |
| while (sequence_parser.HasMore()) { |
| der::Input raw_general_name; |
| if (!sequence_parser.ReadRawTLV(&raw_general_name)) { |
| errors->AddError(kFailedReadingGeneralName); |
| return nullptr; |
| } |
| |
| if (!ParseGeneralName(raw_general_name, IP_ADDRESS_ONLY, |
| general_names.get(), errors)) { |
| errors->AddError(kFailedParsingGeneralName); |
| return nullptr; |
| } |
| } |
| |
| return general_names; |
| } |
| |
| [[nodiscard]] bool ParseGeneralName( |
| der::Input input, |
| GeneralNames::ParseGeneralNameIPAddressType ip_address_type, |
| GeneralNames *subtrees, CertErrors *errors) { |
| BSSL_CHECK(errors); |
| der::Parser parser(input); |
| CBS_ASN1_TAG tag; |
| der::Input value; |
| if (!parser.ReadTagAndValue(&tag, &value)) { |
| return false; |
| } |
| GeneralNameTypes name_type = GENERAL_NAME_NONE; |
| if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0)) { |
| // otherName [0] OtherName, |
| name_type = GENERAL_NAME_OTHER_NAME; |
| subtrees->other_names.push_back(value); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | 1)) { |
| // rfc822Name [1] IA5String, |
| name_type = GENERAL_NAME_RFC822_NAME; |
| const std::string_view s = BytesAsStringView(value); |
| if (!bssl::string_util::IsAscii(s)) { |
| errors->AddError(kRFC822NameNotAscii); |
| return false; |
| } |
| subtrees->rfc822_names.push_back(s); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | 2)) { |
| // dNSName [2] IA5String, |
| name_type = GENERAL_NAME_DNS_NAME; |
| const std::string_view s = BytesAsStringView(value); |
| if (!bssl::string_util::IsAscii(s)) { |
| errors->AddError(kDnsNameNotAscii); |
| return false; |
| } |
| subtrees->dns_names.push_back(s); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 3)) { |
| // x400Address [3] ORAddress, |
| name_type = GENERAL_NAME_X400_ADDRESS; |
| subtrees->x400_addresses.push_back(value); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 4)) { |
| // directoryName [4] Name, |
| name_type = GENERAL_NAME_DIRECTORY_NAME; |
| // Name is a CHOICE { rdnSequence RDNSequence }, therefore the SEQUENCE |
| // tag is explicit. Remove it, since the name matching functions expect |
| // only the value portion. |
| der::Parser name_parser(value); |
| der::Input name_value; |
| if (!name_parser.ReadTag(CBS_ASN1_SEQUENCE, &name_value) || |
| parser.HasMore()) { |
| return false; |
| } |
| subtrees->directory_names.push_back(name_value); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 5)) { |
| // ediPartyName [5] EDIPartyName, |
| name_type = GENERAL_NAME_EDI_PARTY_NAME; |
| subtrees->edi_party_names.push_back(value); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | 6)) { |
| // uniformResourceIdentifier [6] IA5String, |
| name_type = GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER; |
| const std::string_view s = BytesAsStringView(value); |
| if (!bssl::string_util::IsAscii(s)) { |
| errors->AddError(kURINotAscii); |
| return false; |
| } |
| subtrees->uniform_resource_identifiers.push_back(s); |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | 7)) { |
| // iPAddress [7] OCTET STRING, |
| name_type = GENERAL_NAME_IP_ADDRESS; |
| if (ip_address_type == GeneralNames::IP_ADDRESS_ONLY) { |
| // RFC 5280 section 4.2.1.6: |
| // When the subjectAltName extension contains an iPAddress, the address |
| // MUST be stored in the octet string in "network byte order", as |
| // specified in [RFC791]. The least significant bit (LSB) of each octet |
| // is the LSB of the corresponding byte in the network address. For IP |
| // version 4, as specified in [RFC791], the octet string MUST contain |
| // exactly four octets. For IP version 6, as specified in [RFC2460], |
| // the octet string MUST contain exactly sixteen octets. |
| if ((value.size() != kIPv4AddressSize && |
| value.size() != kIPv6AddressSize)) { |
| errors->AddError(kFailedParsingIp); |
| return false; |
| } |
| subtrees->ip_addresses.push_back(value); |
| } else { |
| BSSL_CHECK(ip_address_type == GeneralNames::IP_ADDRESS_AND_NETMASK); |
| // RFC 5280 section 4.2.1.10: |
| // The syntax of iPAddress MUST be as described in Section 4.2.1.6 with |
| // the following additions specifically for name constraints. For IPv4 |
| // addresses, the iPAddress field of GeneralName MUST contain eight (8) |
| // octets, encoded in the style of RFC 4632 (CIDR) to represent an |
| // address range [RFC4632]. For IPv6 addresses, the iPAddress field |
| // MUST contain 32 octets similarly encoded. For example, a name |
| // constraint for "class C" subnet 192.0.2.0 is represented as the |
| // octets C0 00 02 00 FF FF FF 00, representing the CIDR notation |
| // 192.0.2.0/24 (mask 255.255.255.0). |
| if (value.size() != kIPv4AddressSize * 2 && |
| value.size() != kIPv6AddressSize * 2) { |
| errors->AddError(kFailedParsingIp); |
| return false; |
| } |
| der::Input addr = value.first(value.size() / 2); |
| der::Input mask = value.subspan(value.size() / 2); |
| if (!IsValidNetmask(mask)) { |
| errors->AddError(kFailedParsingIp); |
| return false; |
| } |
| subtrees->ip_address_ranges.emplace_back(addr, mask); |
| } |
| } else if (tag == (CBS_ASN1_CONTEXT_SPECIFIC | 8)) { |
| // registeredID [8] OBJECT IDENTIFIER } |
| name_type = GENERAL_NAME_REGISTERED_ID; |
| subtrees->registered_ids.push_back(value); |
| } else { |
| errors->AddError(kUnknownGeneralNameType, |
| CreateCertErrorParams1SizeT("tag", tag)); |
| return false; |
| } |
| BSSL_CHECK(GENERAL_NAME_NONE != name_type); |
| subtrees->present_name_types |= name_type; |
| return true; |
| } |
| |
| BSSL_NAMESPACE_END |
