sync code with last improvements from OpenBSD
This commit is contained in:
parent
f463301edc
commit
96ee847eba
GPG key ID:
F42C07F07E2E35B7
36 changed files with 904 additions and 117 deletions
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: e_aes.c,v 1.53 2023/07/07 19:37:53 beck Exp $ */
|
||||
/* $OpenBSD: e_aes.c,v 1.54 2023/09/28 11:29:10 tb Exp $ */
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2001-2011 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
|
|
@ -1305,7 +1305,11 @@ aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
|||
gctx->tls_aad_len = -1;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_GCM_SET_IVLEN:
|
||||
case EVP_CTRL_AEAD_GET_IVLEN:
|
||||
*(int *)ptr = gctx->ivlen;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_AEAD_SET_IVLEN:
|
||||
if (arg <= 0)
|
||||
return 0;
|
||||
/* Allocate memory for IV if needed */
|
||||
|
|
@ -1631,6 +1635,7 @@ aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
|||
|
||||
#define CUSTOM_FLAGS \
|
||||
( EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_CUSTOM_IV | \
|
||||
EVP_CIPH_FLAG_CUSTOM_IV_LENGTH | \
|
||||
EVP_CIPH_FLAG_CUSTOM_CIPHER | EVP_CIPH_ALWAYS_CALL_INIT | \
|
||||
EVP_CIPH_CTRL_INIT | EVP_CIPH_CUSTOM_COPY )
|
||||
|
||||
|
|
@ -1968,7 +1973,11 @@ aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
|
|||
cctx->len_set = 0;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_CCM_SET_IVLEN:
|
||||
case EVP_CTRL_AEAD_GET_IVLEN:
|
||||
*(int *)ptr = 15 - cctx->L;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_AEAD_SET_IVLEN:
|
||||
arg = 15 - arg;
|
||||
|
||||
case EVP_CTRL_CCM_SET_L:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: e_chacha20poly1305.c,v 1.31 2023/08/24 04:33:08 tb Exp $ */
|
||||
/* $OpenBSD: e_chacha20poly1305.c,v 1.32 2023/09/28 11:29:10 tb Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2022 Joel Sing <jsing@openbsd.org>
|
||||
|
|
@ -18,6 +18,7 @@
|
|||
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
#include <limits.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
|
|
@ -551,6 +552,12 @@ chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
|
|||
cpx->nonce_len = sizeof(cpx->nonce);
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_AEAD_GET_IVLEN:
|
||||
if (cpx->nonce_len > INT_MAX)
|
||||
return 0;
|
||||
*(int *)ptr = (int)cpx->nonce_len;
|
||||
return 1;
|
||||
|
||||
case EVP_CTRL_AEAD_SET_IVLEN:
|
||||
if (arg <= 0 || arg > sizeof(cpx->nonce))
|
||||
return 0;
|
||||
|
|
@ -592,8 +599,9 @@ static const EVP_CIPHER cipher_chacha20_poly1305 = {
|
|||
.key_len = 32,
|
||||
.iv_len = 12,
|
||||
.flags = EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
|
||||
EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_AEAD_CIPHER |
|
||||
EVP_CIPH_FLAG_CUSTOM_CIPHER | EVP_CIPH_FLAG_DEFAULT_ASN1,
|
||||
EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_IV_LENGTH |
|
||||
EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_FLAG_CUSTOM_CIPHER |
|
||||
EVP_CIPH_FLAG_DEFAULT_ASN1,
|
||||
.init = chacha20_poly1305_init,
|
||||
.do_cipher = chacha20_poly1305_cipher,
|
||||
.cleanup = chacha20_poly1305_cleanup,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: evp_lib.c,v 1.27 2023/07/07 19:37:53 beck Exp $ */
|
||||
/* $OpenBSD: evp_lib.c,v 1.28 2023/09/28 11:29:10 tb Exp $ */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -266,7 +266,20 @@ EVP_CIPHER_iv_length(const EVP_CIPHER *cipher)
|
|||
int
|
||||
EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
|
||||
{
|
||||
return ctx->cipher->iv_len;
|
||||
int iv_length = 0;
|
||||
|
||||
if ((ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_IV_LENGTH) == 0)
|
||||
return ctx->cipher->iv_len;
|
||||
|
||||
/*
|
||||
* XXX - sanity would suggest to pass the size of the pointer along,
|
||||
* but unfortunately we have to match the other crowd.
|
||||
*/
|
||||
if (EVP_CIPHER_CTX_ctrl((EVP_CIPHER_CTX *)ctx, EVP_CTRL_GET_IVLEN, 0,
|
||||
&iv_length) != 1)
|
||||
return -1;
|
||||
|
||||
return iv_length;
|
||||
}
|
||||
|
||||
unsigned char *
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: evp_local.h,v 1.4 2023/08/11 05:10:35 tb Exp $ */
|
||||
/* $OpenBSD: evp_local.h,v 1.5 2023/09/28 11:29:10 tb Exp $ */
|
||||
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
|
||||
* project 2000.
|
||||
*/
|
||||
|
|
@ -61,6 +61,12 @@
|
|||
|
||||
__BEGIN_HIDDEN_DECLS
|
||||
|
||||
/* XXX - move these to evp.h after unlock. */
|
||||
#define EVP_CTRL_GET_IVLEN 0x25
|
||||
#define EVP_CIPH_FLAG_CUSTOM_IV_LENGTH 0x400000
|
||||
|
||||
#define EVP_CTRL_AEAD_GET_IVLEN EVP_CTRL_GET_IVLEN
|
||||
|
||||
/*
|
||||
* Don't free md_ctx->pctx in EVP_MD_CTX_cleanup(). Needed for ownership
|
||||
* handling in EVP_MD_CTX_set_pkey_ctx().
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ASIdentifiers_new.3,v 1.7 2023/09/27 08:46:46 tb Exp $
|
||||
.\" $OpenBSD: ASIdentifiers_new.3,v 1.9 2023/09/29 08:57:49 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2021 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 27 2023 $
|
||||
.Dd $Mdocdate: September 29 2023 $
|
||||
.Dt ASIDENTIFIERS_NEW 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -47,7 +47,7 @@
|
|||
.Sh DESCRIPTION
|
||||
RFC 3779 defines two X.509v3 certificate extensions that allow the
|
||||
delegation of
|
||||
IP address blocks and autonomous system (AS) identifiers
|
||||
IP addresses and autonomous system (AS) identifiers
|
||||
from the issuer to the subject of the certificate.
|
||||
An
|
||||
.Vt ASIdentifiers
|
||||
|
|
@ -112,8 +112,12 @@ or a value <= 0 if an error occurs.
|
|||
.Xr crypto 3 ,
|
||||
.Xr IPAddressRange_new 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3 ,
|
||||
.Xr X509v3_asid_inherits 3
|
||||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_addr_get_range 3 ,
|
||||
.Xr X509v3_addr_inherits 3 ,
|
||||
.Xr X509v3_addr_subset 3 ,
|
||||
.Xr X509v3_addr_validate_path 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:
|
||||
.Bl -dash -compact
|
||||
|
|
@ -130,5 +134,5 @@ and have been available since
|
|||
.Ox 7.1 .
|
||||
.Sh BUGS
|
||||
There are no corresponding functions for the RFC 3779
|
||||
IP address blocks delegation extension represented by
|
||||
IP address delegation extension represented by
|
||||
.Vt IPAddrBlocks .
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ASRange_new.3,v 1.5 2023/09/27 08:46:46 tb Exp $
|
||||
.\" $OpenBSD: ASRange_new.3,v 1.6 2023/09/28 12:35:31 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 27 2023 $
|
||||
.Dd $Mdocdate: September 28 2023 $
|
||||
.Dt ASRANGE_NEW 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -90,7 +90,7 @@ autonomous system identifier delegation extension.
|
|||
.Pp
|
||||
All
|
||||
.Vt ASN1_INTEGER Ns s
|
||||
in this manual should be representable as unsigned 32-bit integers.
|
||||
in this manual must be representable as unsigned 32-bit integers.
|
||||
The API performs no corresponding checks.
|
||||
The library provides no convenient way of setting the value of an
|
||||
.Vt ASN1_INTEGER
|
||||
|
|
@ -358,6 +358,7 @@ or a value <= 0 if an error occurs.
|
|||
.Xr crypto 3 ,
|
||||
.Xr IPAddressRange_new 3 ,
|
||||
.Xr s2i_ASN1_INTEGER 3 ,
|
||||
.Xr STACK_OF 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3
|
||||
.Sh STANDARDS
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: IPAddressRange_new.3,v 1.4 2023/09/27 08:46:46 tb Exp $
|
||||
.\" $OpenBSD: IPAddressRange_new.3,v 1.5 2023/09/28 12:35:31 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 27 2023 $
|
||||
.Dd $Mdocdate: September 28 2023 $
|
||||
.Dt IPADDRESSRANGE_NEW 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -110,12 +110,12 @@ type representing the IP address delegation extension.
|
|||
Per RFC 3779, section 2.1.1,
|
||||
an IPv4 or an IPv6 address is encoded in network byte order in an
|
||||
ASN.1 BIT STRING of bit size 32 or 128 bits, respectively.
|
||||
The bit size of a prefix is its prefix length.
|
||||
In other words, all insignificant zero bits are omitted
|
||||
The bit size of a prefix is its prefix length;
|
||||
all insignificant zero bits are omitted
|
||||
from the encoding.
|
||||
An address range is expressed as a pair of BIT STRINGs
|
||||
where all least significant zero bits of the lower bound
|
||||
and the all least significant one bits of the upper bound are omitted.
|
||||
where all the least significant zero bits of the lower bound
|
||||
and all the least significant one bits of the upper bound are omitted.
|
||||
.Pp
|
||||
The library provides no API for directly converting an IP address or
|
||||
prefix (in any form) to and from an
|
||||
|
|
@ -127,8 +127,11 @@ internals are subtle and directly manipulating them in the
|
|||
context of the RFC 3779 API is discouraged.
|
||||
The bit size of an
|
||||
.Vt ASN1_BIT_STRING
|
||||
representing an IP address prefix or range is eight times its length
|
||||
member minus the lowest three bits of its flags, provided the
|
||||
representing an IP address prefix or range is eight times its
|
||||
.Fa length
|
||||
member minus the lowest three bits of its
|
||||
.Fa flags ,
|
||||
provided the
|
||||
.Dv ASN1_STRING_FLAG_BITS_LEFT
|
||||
flag is set.
|
||||
.Pp
|
||||
|
|
@ -460,7 +463,8 @@ or a value <= 0 if an error occurs.
|
|||
.Xr crypto 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_addr_inherits 3
|
||||
.Xr X509v3_addr_inherits 3 ,
|
||||
.Xr X509v3_addr_subset 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:
|
||||
.Bl -dash -compact
|
||||
|
|
@ -483,7 +487,7 @@ section 2.2.3.7: Type IPAddressOrRange
|
|||
.It
|
||||
section 2.2.3.8: Element addressPrefix and Type IPAddress
|
||||
.It
|
||||
section 2.2.3.9: Elements addressRange and Type IPAddressRange
|
||||
section 2.2.3.9: Element addressRange and Type IPAddressRange
|
||||
.El
|
||||
.Pp
|
||||
ITU-T Recommendation X.690, also known as ISO/IEC 8825-1:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# $OpenBSD: Makefile,v 1.274 2023/09/26 20:42:45 tb Exp $
|
||||
# $OpenBSD: Makefile,v 1.276 2023/09/29 08:57:49 tb Exp $
|
||||
|
||||
.include <bsd.own.mk>
|
||||
|
||||
|
|
@ -395,6 +395,8 @@ MAN= \
|
|||
X509v3_addr_add_inherit.3 \
|
||||
X509v3_addr_get_range.3 \
|
||||
X509v3_addr_inherits.3 \
|
||||
X509v3_addr_subset.3 \
|
||||
X509v3_addr_validate_path.3 \
|
||||
X509v3_asid_add_id_or_range.3 \
|
||||
X509v3_asid_add_id_or_range.3 \
|
||||
X509v3_get_ext_by_NID.3 \
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: X509_new.3,v 1.41 2023/09/26 20:42:45 tb Exp $
|
||||
.\" $OpenBSD: X509_new.3,v 1.43 2023/09/29 08:57:49 tb Exp $
|
||||
.\" full merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
|
||||
.\"
|
||||
.\" This file is a derived work.
|
||||
|
|
@ -66,7 +66,7 @@
|
|||
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
.\" OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 26 2023 $
|
||||
.Dd $Mdocdate: September 29 2023 $
|
||||
.Dt X509_NEW 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -245,6 +245,8 @@ if an error occurs.
|
|||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_addr_get_range 3 ,
|
||||
.Xr X509v3_addr_inherits 3 ,
|
||||
.Xr X509v3_addr_subset 3 ,
|
||||
.Xr X509v3_addr_validate_path 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3
|
||||
.Sh STANDARDS
|
||||
RFC 5280: Internet X.509 Public Key Infrastructure Certificate and
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: X509v3_addr_add_inherit.3,v 1.5 2023/09/27 08:46:46 tb Exp $
|
||||
.\" $OpenBSD: X509v3_addr_add_inherit.3,v 1.7 2023/09/29 08:57:49 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 27 2023 $
|
||||
.Dd $Mdocdate: September 29 2023 $
|
||||
.Dt X509V3_ADDR_ADD_INHERIT 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -60,7 +60,7 @@
|
|||
An
|
||||
.Vt IPAddrBlocks
|
||||
object represents the content of
|
||||
an X509v3 IP address blocks delegation extension
|
||||
an IP address delegation extension
|
||||
as defined in RFC 3779, section 2.2.3.1.
|
||||
It holds lists of IP address prefixes and IP address ranges
|
||||
delegated from the issuer to the subject of the certificate.
|
||||
|
|
@ -399,8 +399,9 @@ is desired.
|
|||
.Xr inet_ntop 3 ,
|
||||
.Xr IPAddressRange_new 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3 ,
|
||||
.Xr X509v3_addr_get_range 3
|
||||
.Xr X509v3_addr_get_range 3 ,
|
||||
.Xr X509v3_addr_validate_path 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:
|
||||
.Bl -dash -compact
|
||||
|
|
|
|||
176
lib/libcrypto/man/X509v3_addr_subset.3
Normal file
176
lib/libcrypto/man/X509v3_addr_subset.3
Normal file
|
|
@ -0,0 +1,176 @@
|
|||
.\" $OpenBSD: X509v3_addr_subset.3,v 1.1 2023/09/28 12:36:36 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\"
|
||||
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 28 2023 $
|
||||
.Dt X509V3_ADDR_SUBSET 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm X509v3_addr_subset ,
|
||||
.Nm X509v3_asid_subset
|
||||
.Nd RFC 3779 subset relationship
|
||||
.Sh SYNOPSIS
|
||||
.In openssl/x509v3.h
|
||||
.Ft int
|
||||
.Fn X509v3_addr_subset "IPAddrBlocks *child" "IPAddrBlocks *parent"
|
||||
.Ft int
|
||||
.Fn X509v3_asid_subset "ASIdentifiers *child" "ASIdentifiers *parent"
|
||||
.Sh DESCRIPTION
|
||||
.Fn X509v3_addr_subset
|
||||
determines if all IP address resources present in
|
||||
.Fa child
|
||||
are contained in the corresponding resources in
|
||||
.Fa parent .
|
||||
.Pp
|
||||
The implementation assumes but does not ensure that both
|
||||
.Fa child
|
||||
and
|
||||
.Fa parent
|
||||
are in canonical form as described in
|
||||
.Xr X509v3_addr_is_canonical 3 .
|
||||
In particular, both
|
||||
.Fa child
|
||||
and
|
||||
.Fa parent
|
||||
are sorted appropriately and they contain at most one
|
||||
.Vt IPAddressFamily
|
||||
object per address family identifier (AFI) and optional
|
||||
subsequent address family identifier (SAFI).
|
||||
.Pp
|
||||
The checks are, in order:
|
||||
.Bl -enum
|
||||
.It
|
||||
If
|
||||
.Fa child
|
||||
is
|
||||
.Dv NULL
|
||||
or identical to
|
||||
.Fa parent
|
||||
then
|
||||
.Fa child
|
||||
is a subset of
|
||||
.Fa parent .
|
||||
(In particular, a
|
||||
.Dv NULL
|
||||
.Fa parent
|
||||
is allowed for a
|
||||
.Dv NULL
|
||||
.Fa child Ns .)
|
||||
.It
|
||||
If
|
||||
.Fa parent
|
||||
is
|
||||
.Dv NULL
|
||||
then
|
||||
.Fa child
|
||||
is not a subset of
|
||||
.Fa parent .
|
||||
.It
|
||||
If
|
||||
.Xr X509v3_addr_inherits 3
|
||||
determines that
|
||||
.Fa child
|
||||
inherits or that
|
||||
.Fa parent
|
||||
inherits
|
||||
then
|
||||
.Fa child
|
||||
is not a subset of
|
||||
.Fa parent .
|
||||
.It
|
||||
Each address prefix or range in
|
||||
.Fa child
|
||||
must be a subset of an address prefix or range in the
|
||||
.Fa parent ,
|
||||
taking AFI and optional SAFI into account:
|
||||
.Bl -bullet -compact
|
||||
.It
|
||||
For each
|
||||
.Vt IPAddressFamily
|
||||
of
|
||||
.Fa child
|
||||
there must be an
|
||||
.Vt IPAddressFamily
|
||||
of
|
||||
.Fa parent
|
||||
with the same AFI and optional SAFI.
|
||||
.It
|
||||
Since the address prefixes and ranges in corresponding
|
||||
.Vt IPAddressFamily
|
||||
objects in
|
||||
.Fa child
|
||||
and
|
||||
.Fa parent
|
||||
are sorted in ascending order,
|
||||
and do not overlap,
|
||||
they can be traversed simultaneously in linear time.
|
||||
For each prefix or range in
|
||||
.Fa child
|
||||
there must be a prefix or range in
|
||||
.Fa parent
|
||||
whose minimal address is smaller
|
||||
and whose maximal address is larger.
|
||||
.El
|
||||
If any of these steps fails,
|
||||
.Fa child
|
||||
is not a subset of
|
||||
.Fa parent .
|
||||
.El
|
||||
.Pp
|
||||
.Fn X509v3_asid_subset
|
||||
determines if all AS identifier resources in
|
||||
.Fa child
|
||||
are contained in the corresponding resources in
|
||||
.Fa parent .
|
||||
.Pp
|
||||
The description for
|
||||
.Fn X509v3_addr_subset
|
||||
applies mutatis mutandis.
|
||||
In particular,
|
||||
.Fa child
|
||||
and
|
||||
.Fa parent
|
||||
must be in canonical form per
|
||||
.Xr X509v3_asid_is_canonical 3 ,
|
||||
but this is not enforced.
|
||||
.Sh RETURN VALUES
|
||||
.Fn X509v3_addr_subset
|
||||
and
|
||||
.Fn X509v3_asid_subset
|
||||
return 1 if and only if
|
||||
.Fa child
|
||||
is a subset of
|
||||
.Fa parent ,
|
||||
otherwise they return 0.
|
||||
If both
|
||||
.Fa child
|
||||
and
|
||||
.Fa parent
|
||||
are in canonical form,
|
||||
they cannot fail.
|
||||
.Sh SEE ALSO
|
||||
.Xr ASIdentifiers_new 3 ,
|
||||
.Xr ASRange_new 3 ,
|
||||
.Xr crypto 3 ,
|
||||
.Xr IPAddressRange_new 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_asid_add_inherit 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers.
|
||||
.Sh HISTORY
|
||||
These functions first appeared in OpenSSL 0.9.8e
|
||||
and have been available since
|
||||
.Ox 7.1 .
|
||||
204
lib/libcrypto/man/X509v3_addr_validate_path.3
Normal file
204
lib/libcrypto/man/X509v3_addr_validate_path.3
Normal file
|
|
@ -0,0 +1,204 @@
|
|||
.\" $OpenBSD: X509v3_addr_validate_path.3,v 1.3 2023/09/29 15:41:06 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\"
|
||||
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 29 2023 $
|
||||
.Dt X509V3_ADDR_VALIDATE_PATH 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm X509v3_addr_validate_path ,
|
||||
.Nm X509v3_addr_validate_resource_set ,
|
||||
.Nm X509v3_asid_validate_path ,
|
||||
.Nm X509v3_asid_validate_resource_set
|
||||
.Nd RFC 3779 path validation for IP address and AS number delegation
|
||||
.Sh SYNOPSIS
|
||||
.In openssl/x509v3.h
|
||||
.Ft int
|
||||
.Fn X509v3_addr_validate_path "X509_STORE_CTX *ctx"
|
||||
.Ft int
|
||||
.Fo X509v3_addr_validate_resource_set
|
||||
.Fa "STACK_OF(X509) *chain"
|
||||
.Fa "IPAddrBlocks *addrblocks"
|
||||
.Fa "int allow_inheritance"
|
||||
.Fc
|
||||
.Ft int
|
||||
.Fn X509v3_asid_validate_path "X509_STORE_CTX *ctx"
|
||||
.Ft int
|
||||
.Fo X509v3_asid_validate_resource_set
|
||||
.Fa "STACK_OF(X509) *chain"
|
||||
.Fa "ASIdentifiers *asid"
|
||||
.Fa "int allow_inheritance"
|
||||
.Fc
|
||||
.Sh DESCRIPTION
|
||||
Both RFC 3779 extensions require additional checking in the certification
|
||||
path validation.
|
||||
.Bl -enum
|
||||
.It
|
||||
The initial set of allowed IP address and AS number resources is defined in
|
||||
the trust anchor, where inheritance is not allowed.
|
||||
.It
|
||||
All IP address delegation or AS number delegation extensions
|
||||
appearing in the validation path must be in canonical form
|
||||
according to
|
||||
.Xr X509v3_addr_is_canonical 3
|
||||
and
|
||||
.Xr X509v3_asid_is_canonical 3 .
|
||||
.It
|
||||
If the IP address delegation extension is present in a certificate,
|
||||
it must also be present in its issuer.
|
||||
Similarly for the AS identifiers delegation extension.
|
||||
.It
|
||||
An issuer may only delegate subsets of resources present in its
|
||||
RFC 3779 extensions or subsets of resources inherited from its issuer.
|
||||
.El
|
||||
.Pp
|
||||
.Fn X509v3_addr_validate_path
|
||||
and
|
||||
.Fn X509v3_asid_validate_path
|
||||
are called from
|
||||
.Xr X509_verify_cert 3
|
||||
as part of the verification chain building.
|
||||
On encountering an error or a violation of the above rules,
|
||||
.Fa error ,
|
||||
.Fa error_depth ,
|
||||
and
|
||||
.Fa current_cert
|
||||
are set on
|
||||
.Fa ctx
|
||||
and the verify callback is called with
|
||||
.Fa ok
|
||||
set to 0.
|
||||
.Dv X509_V_ERR_INVALID_EXTENSION
|
||||
indicates a non-canonical resource,
|
||||
.Dv X509_V_ERR_UNNESTED_RESOURCE
|
||||
indicates a violation of the other rules above.
|
||||
In rare circumstances, the error can be
|
||||
.Dv X509_V_ERR_UNSPECIFIED
|
||||
and for IP address resources
|
||||
.Dv X509_V_ERR_OUT_OF_MEM
|
||||
is also possible.
|
||||
.Pp
|
||||
.Fn X509v3_addr_validate_resource_set
|
||||
validates the resources in
|
||||
.Fa addrblocks
|
||||
against a specific certificate
|
||||
.Fa chain .
|
||||
After checking that
|
||||
.Fa addrblocks
|
||||
is canonical, its IP addresses are checked to be covered in
|
||||
the certificate at depth 0,
|
||||
then the chain is walked all the way to the trust anchor
|
||||
until an error or a violation of the above rules is encountered.
|
||||
.Fa addrblocks
|
||||
is allowed to use inheritance according to
|
||||
.Xr X509v3_addr_inherits 3
|
||||
if and only if
|
||||
.Fa allow_inherit
|
||||
is non-zero.
|
||||
.Pp
|
||||
.Fn X509v3_asid_validate_resource_set
|
||||
performs similar checks as
|
||||
.Fn X509v3_addr_validate_resource_set
|
||||
for
|
||||
.Fa asid .
|
||||
.Sh RETURN VALUES
|
||||
All these functions return 1 on successful validation and 0 otherwise.
|
||||
.Pp
|
||||
For
|
||||
.Fn X509v3_addr_validate_path
|
||||
and
|
||||
.Fn X509v3_asid_validate_path
|
||||
a non-empty
|
||||
.Fa chain
|
||||
and a
|
||||
.Fa verify_cb
|
||||
must be present on
|
||||
.Fa ctx ,
|
||||
otherwise they fail and set the
|
||||
.Fa error
|
||||
on
|
||||
.Fa ctx
|
||||
to
|
||||
.Dv X509_V_ERR_UNSPECIFIED .
|
||||
The
|
||||
.Fa verify_cb
|
||||
is called with the error codes described above
|
||||
on most errors encountered during validation.
|
||||
Some malformed extensions can lead to an error
|
||||
that cannot be intercepted by the callback.
|
||||
With the exception of an allocation error,
|
||||
no error codes are set on the error stack.
|
||||
.Pp
|
||||
.Fn X509v3_addr_validate_resource_set
|
||||
accepts a
|
||||
.Dv NULL
|
||||
.Fa addrblocks
|
||||
and
|
||||
.Fn X509v3_asid_validate_resource_set
|
||||
accepts a
|
||||
.Dv NULL
|
||||
.Fa asid
|
||||
as valid.
|
||||
They fail if
|
||||
.Fa chain
|
||||
is
|
||||
.Dv NULL
|
||||
or empty.
|
||||
If
|
||||
.Fa allow_inheritance
|
||||
is 0 ,
|
||||
.Fa addrblocks
|
||||
or
|
||||
.Fa asid
|
||||
is checked for inheritance with
|
||||
.Xr X509v3_addr_inherits 3
|
||||
or
|
||||
.Xr X509v3_asid_inherits 3 .
|
||||
The remaining failure cases are the same as for
|
||||
.Fn X509v3_addr_validate_path
|
||||
and
|
||||
.Fn X509v3_asid_validate_path .
|
||||
They cannot and do not attempt to communicate
|
||||
the cause of the error to the caller.
|
||||
.Sh SEE ALSO
|
||||
.Xr ASIdentifiers_new 3 ,
|
||||
.Xr crypto 3 ,
|
||||
.Xr IPAddressRange_new 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509_STORE_CTX_get_error 3 ,
|
||||
.Xr X509_verify_cert 3 ,
|
||||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_addr_inherits 3 ,
|
||||
.Xr X509v3_asid_add_id_or_range 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers:
|
||||
.Bl -dash -compact
|
||||
.It
|
||||
section 2.3: IP Address Delegation Extension Certification Path Validation
|
||||
.It
|
||||
section 3.3: Autonomous System Identifier Delegation Extension Certification
|
||||
Path Validation
|
||||
.El
|
||||
.Pp
|
||||
RFC 5280: Internet X.509 Public Key Infrastructure Certificate
|
||||
and Certificate Revocation List (CRL) Profile
|
||||
.Bl -dash -compact
|
||||
.It
|
||||
section 6: Certification Path Validation
|
||||
.El
|
||||
.Sh HISTORY
|
||||
These functions first appeared in OpenSSL 0.9.8e
|
||||
and have been available since
|
||||
.Ox 7.1 .
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: X509v3_asid_add_id_or_range.3,v 1.5 2023/09/27 08:46:46 tb Exp $
|
||||
.\" $OpenBSD: X509v3_asid_add_id_or_range.3,v 1.7 2023/09/29 08:57:49 tb Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2021-2023 Theo Buehler <tb@openbsd.org>
|
||||
.\"
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: September 27 2023 $
|
||||
.Dd $Mdocdate: September 29 2023 $
|
||||
.Dt X509V3_ASID_ADD_ID_OR_RANGE 3
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -48,7 +48,7 @@
|
|||
.Sh DESCRIPTION
|
||||
An
|
||||
.Vt ASIdentifiers
|
||||
object represents the content of the X509v3 certificate extension
|
||||
object represents the content of the certificate extension
|
||||
defined in RFC 3779, section 3.2.3.1.
|
||||
It can be instantiated with
|
||||
.Xr ASIdentifiers_new 3
|
||||
|
|
@ -242,7 +242,8 @@ failure.
|
|||
.Xr crypto 3 ,
|
||||
.Xr s2i_ASN1_INTEGER 3 ,
|
||||
.Xr X509_new 3 ,
|
||||
.Xr X509v3_addr_add_inherit 3
|
||||
.Xr X509v3_addr_add_inherit 3 ,
|
||||
.Xr X509v3_addr_validate_path 3
|
||||
.Sh STANDARDS
|
||||
RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers,
|
||||
.Bl -dash -compact
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_constraints.c,v 1.31 2022/12/26 07:18:53 jmc Exp $ */
|
||||
/* $OpenBSD: x509_constraints.c,v 1.32 2023/09/29 15:53:59 beck Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2020 Bob Beck <beck@openbsd.org>
|
||||
*
|
||||
|
|
@ -38,23 +38,23 @@
|
|||
#define MAX_IP_ADDRESS_LENGTH (size_t)46
|
||||
|
||||
static int
|
||||
cbs_is_ip_address(CBS *cbs)
|
||||
cbs_is_ip_address(CBS *cbs, int *is_ip)
|
||||
{
|
||||
struct sockaddr_in6 sin6;
|
||||
struct sockaddr_in sin4;
|
||||
char *name = NULL;
|
||||
int ret = 0;
|
||||
|
||||
*is_ip = 0;
|
||||
if (CBS_len(cbs) > MAX_IP_ADDRESS_LENGTH)
|
||||
return 0;
|
||||
return 1;
|
||||
if (!CBS_strdup(cbs, &name))
|
||||
return 0;
|
||||
if (inet_pton(AF_INET, name, &sin4) == 1 ||
|
||||
inet_pton(AF_INET6, name, &sin6) == 1)
|
||||
ret = 1;
|
||||
*is_ip = 1;
|
||||
|
||||
free(name);
|
||||
return ret;
|
||||
return 1;
|
||||
}
|
||||
|
||||
struct x509_constraints_name *
|
||||
|
|
@ -264,16 +264,21 @@ x509_constraints_valid_domain_internal(CBS *cbs, int wildcards)
|
|||
}
|
||||
|
||||
int
|
||||
x509_constraints_valid_host(CBS *cbs)
|
||||
x509_constraints_valid_host(CBS *cbs, int permit_ip)
|
||||
{
|
||||
uint8_t first;
|
||||
int is_ip;
|
||||
|
||||
if (!CBS_peek_u8(cbs, &first))
|
||||
return 0;
|
||||
if (first == '.')
|
||||
return 0; /* leading . not allowed in a host name */
|
||||
if (cbs_is_ip_address(cbs))
|
||||
return 0;
|
||||
return 0; /* leading . not allowed in a host name or IP */
|
||||
if (!permit_ip) {
|
||||
if (!cbs_is_ip_address(cbs, &is_ip))
|
||||
return 0;
|
||||
if (is_ip)
|
||||
return 0;
|
||||
}
|
||||
|
||||
return x509_constraints_valid_domain_internal(cbs, 0);
|
||||
}
|
||||
|
|
@ -441,7 +446,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
|
|||
if (candidate_local == NULL || candidate_domain == NULL)
|
||||
goto bad;
|
||||
CBS_init(&domain_cbs, candidate_domain, strlen(candidate_domain));
|
||||
if (!x509_constraints_valid_host(&domain_cbs))
|
||||
if (!x509_constraints_valid_host(&domain_cbs, 0))
|
||||
goto bad;
|
||||
|
||||
if (name != NULL) {
|
||||
|
|
@ -558,7 +563,7 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
|
|||
if (host == NULL)
|
||||
host = authority;
|
||||
CBS_init(&host_cbs, host, hostlen);
|
||||
if (!x509_constraints_valid_host(&host_cbs))
|
||||
if (!x509_constraints_valid_host(&host_cbs, 1))
|
||||
return 0;
|
||||
if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
|
||||
return 0;
|
||||
|
|
@ -924,7 +929,7 @@ x509_constraints_extract_names(struct x509_constraints_names *names,
|
|||
goto err;
|
||||
}
|
||||
CBS_init(&cbs, aname->data, aname->length);
|
||||
if (!x509_constraints_valid_host(&cbs))
|
||||
if (!x509_constraints_valid_host(&cbs, 0))
|
||||
continue; /* ignore it if not a hostname */
|
||||
if ((vname = x509_constraints_name_new()) == NULL) {
|
||||
*error = X509_V_ERR_OUT_OF_MEM;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: x509_internal.h,v 1.25 2023/01/28 19:08:09 tb Exp $ */
|
||||
/* $OpenBSD: x509_internal.h,v 1.26 2023/09/29 15:53:59 beck Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2020 Bob Beck <beck@openbsd.org>
|
||||
*
|
||||
|
|
@ -111,7 +111,7 @@ struct x509_constraints_names *x509_constraints_names_new(size_t names_max);
|
|||
int x509_constraints_general_to_bytes(GENERAL_NAME *name, uint8_t **bytes,
|
||||
size_t *len);
|
||||
void x509_constraints_names_free(struct x509_constraints_names *names);
|
||||
int x509_constraints_valid_host(CBS *cbs);
|
||||
int x509_constraints_valid_host(CBS *cbs, int permit_ip);
|
||||
int x509_constraints_valid_sandns(CBS *cbs);
|
||||
int x509_constraints_domain(char *domain, size_t dlen, char *constraint,
|
||||
size_t len);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue