|
sl@0
|
1 |
/* pcy_int.h */
|
|
sl@0
|
2 |
/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
|
|
sl@0
|
3 |
* project 2004.
|
|
sl@0
|
4 |
*/
|
|
sl@0
|
5 |
/* ====================================================================
|
|
sl@0
|
6 |
* Copyright (c) 2004 The OpenSSL Project. All rights reserved.
|
|
sl@0
|
7 |
*
|
|
sl@0
|
8 |
* Redistribution and use in source and binary forms, with or without
|
|
sl@0
|
9 |
* modification, are permitted provided that the following conditions
|
|
sl@0
|
10 |
* are met:
|
|
sl@0
|
11 |
*
|
|
sl@0
|
12 |
* 1. Redistributions of source code must retain the above copyright
|
|
sl@0
|
13 |
* notice, this list of conditions and the following disclaimer.
|
|
sl@0
|
14 |
*
|
|
sl@0
|
15 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
sl@0
|
16 |
* notice, this list of conditions and the following disclaimer in
|
|
sl@0
|
17 |
* the documentation and/or other materials provided with the
|
|
sl@0
|
18 |
* distribution.
|
|
sl@0
|
19 |
*
|
|
sl@0
|
20 |
* 3. All advertising materials mentioning features or use of this
|
|
sl@0
|
21 |
* software must display the following acknowledgment:
|
|
sl@0
|
22 |
* "This product includes software developed by the OpenSSL Project
|
|
sl@0
|
23 |
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
|
sl@0
|
24 |
*
|
|
sl@0
|
25 |
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
sl@0
|
26 |
* endorse or promote products derived from this software without
|
|
sl@0
|
27 |
* prior written permission. For written permission, please contact
|
|
sl@0
|
28 |
* licensing@OpenSSL.org.
|
|
sl@0
|
29 |
*
|
|
sl@0
|
30 |
* 5. Products derived from this software may not be called "OpenSSL"
|
|
sl@0
|
31 |
* nor may "OpenSSL" appear in their names without prior written
|
|
sl@0
|
32 |
* permission of the OpenSSL Project.
|
|
sl@0
|
33 |
*
|
|
sl@0
|
34 |
* 6. Redistributions of any form whatsoever must retain the following
|
|
sl@0
|
35 |
* acknowledgment:
|
|
sl@0
|
36 |
* "This product includes software developed by the OpenSSL Project
|
|
sl@0
|
37 |
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
|
sl@0
|
38 |
*
|
|
sl@0
|
39 |
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
sl@0
|
40 |
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
sl@0
|
41 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
sl@0
|
42 |
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
sl@0
|
43 |
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
sl@0
|
44 |
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
sl@0
|
45 |
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
sl@0
|
46 |
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
sl@0
|
47 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
sl@0
|
48 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
sl@0
|
49 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
sl@0
|
50 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
sl@0
|
51 |
* ====================================================================
|
|
sl@0
|
52 |
*
|
|
sl@0
|
53 |
* This product includes cryptographic software written by Eric Young
|
|
sl@0
|
54 |
* (eay@cryptsoft.com). This product includes software written by Tim
|
|
sl@0
|
55 |
* Hudson (tjh@cryptsoft.com).
|
|
sl@0
|
56 |
*
|
|
sl@0
|
57 |
*/
|
|
sl@0
|
58 |
|
|
sl@0
|
59 |
DECLARE_STACK_OF(X509_POLICY_DATA)
|
|
sl@0
|
60 |
DECLARE_STACK_OF(X509_POLICY_REF)
|
|
sl@0
|
61 |
DECLARE_STACK_OF(X509_POLICY_NODE)
|
|
sl@0
|
62 |
|
|
sl@0
|
63 |
typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
|
|
sl@0
|
64 |
typedef struct X509_POLICY_REF_st X509_POLICY_REF;
|
|
sl@0
|
65 |
|
|
sl@0
|
66 |
/* Internal structures */
|
|
sl@0
|
67 |
|
|
sl@0
|
68 |
/* This structure and the field names correspond to the Policy 'node' of
|
|
sl@0
|
69 |
* RFC3280. NB this structure contains no pointers to parent or child
|
|
sl@0
|
70 |
* data: X509_POLICY_NODE contains that. This means that the main policy data
|
|
sl@0
|
71 |
* can be kept static and cached with the certificate.
|
|
sl@0
|
72 |
*/
|
|
sl@0
|
73 |
|
|
sl@0
|
74 |
struct X509_POLICY_DATA_st
|
|
sl@0
|
75 |
{
|
|
sl@0
|
76 |
unsigned int flags;
|
|
sl@0
|
77 |
/* Policy OID and qualifiers for this data */
|
|
sl@0
|
78 |
ASN1_OBJECT *valid_policy;
|
|
sl@0
|
79 |
STACK_OF(POLICYQUALINFO) *qualifier_set;
|
|
sl@0
|
80 |
STACK_OF(ASN1_OBJECT) *expected_policy_set;
|
|
sl@0
|
81 |
};
|
|
sl@0
|
82 |
|
|
sl@0
|
83 |
/* X509_POLICY_DATA flags values */
|
|
sl@0
|
84 |
|
|
sl@0
|
85 |
/* This flag indicates the structure has been mapped using a policy mapping
|
|
sl@0
|
86 |
* extension. If policy mapping is not active its references get deleted.
|
|
sl@0
|
87 |
*/
|
|
sl@0
|
88 |
|
|
sl@0
|
89 |
#define POLICY_DATA_FLAG_MAPPED 0x1
|
|
sl@0
|
90 |
|
|
sl@0
|
91 |
/* This flag indicates the data doesn't correspond to a policy in Certificate
|
|
sl@0
|
92 |
* Policies: it has been mapped to any policy.
|
|
sl@0
|
93 |
*/
|
|
sl@0
|
94 |
|
|
sl@0
|
95 |
#define POLICY_DATA_FLAG_MAPPED_ANY 0x2
|
|
sl@0
|
96 |
|
|
sl@0
|
97 |
/* AND with flags to see if any mapping has occurred */
|
|
sl@0
|
98 |
|
|
sl@0
|
99 |
#define POLICY_DATA_FLAG_MAP_MASK 0x3
|
|
sl@0
|
100 |
|
|
sl@0
|
101 |
/* qualifiers are shared and shouldn't be freed */
|
|
sl@0
|
102 |
|
|
sl@0
|
103 |
#define POLICY_DATA_FLAG_SHARED_QUALIFIERS 0x4
|
|
sl@0
|
104 |
|
|
sl@0
|
105 |
/* Parent node is an extra node and should be freed */
|
|
sl@0
|
106 |
|
|
sl@0
|
107 |
#define POLICY_DATA_FLAG_EXTRA_NODE 0x8
|
|
sl@0
|
108 |
|
|
sl@0
|
109 |
/* Corresponding CertificatePolicies is critical */
|
|
sl@0
|
110 |
|
|
sl@0
|
111 |
#define POLICY_DATA_FLAG_CRITICAL 0x10
|
|
sl@0
|
112 |
|
|
sl@0
|
113 |
/* This structure is an entry from a table of mapped policies which
|
|
sl@0
|
114 |
* cross reference the policy it refers to.
|
|
sl@0
|
115 |
*/
|
|
sl@0
|
116 |
|
|
sl@0
|
117 |
struct X509_POLICY_REF_st
|
|
sl@0
|
118 |
{
|
|
sl@0
|
119 |
ASN1_OBJECT *subjectDomainPolicy;
|
|
sl@0
|
120 |
const X509_POLICY_DATA *data;
|
|
sl@0
|
121 |
};
|
|
sl@0
|
122 |
|
|
sl@0
|
123 |
/* This structure is cached with a certificate */
|
|
sl@0
|
124 |
|
|
sl@0
|
125 |
struct X509_POLICY_CACHE_st {
|
|
sl@0
|
126 |
/* anyPolicy data or NULL if no anyPolicy */
|
|
sl@0
|
127 |
X509_POLICY_DATA *anyPolicy;
|
|
sl@0
|
128 |
/* other policy data */
|
|
sl@0
|
129 |
STACK_OF(X509_POLICY_DATA) *data;
|
|
sl@0
|
130 |
/* If policyMappings extension present a table of mapped policies */
|
|
sl@0
|
131 |
STACK_OF(X509_POLICY_REF) *maps;
|
|
sl@0
|
132 |
/* If InhibitAnyPolicy present this is its value or -1 if absent. */
|
|
sl@0
|
133 |
long any_skip;
|
|
sl@0
|
134 |
/* If policyConstraints and requireExplicitPolicy present this is its
|
|
sl@0
|
135 |
* value or -1 if absent.
|
|
sl@0
|
136 |
*/
|
|
sl@0
|
137 |
long explicit_skip;
|
|
sl@0
|
138 |
/* If policyConstraints and policyMapping present this is its
|
|
sl@0
|
139 |
* value or -1 if absent.
|
|
sl@0
|
140 |
*/
|
|
sl@0
|
141 |
long map_skip;
|
|
sl@0
|
142 |
};
|
|
sl@0
|
143 |
|
|
sl@0
|
144 |
/*#define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL*/
|
|
sl@0
|
145 |
|
|
sl@0
|
146 |
/* This structure represents the relationship between nodes */
|
|
sl@0
|
147 |
|
|
sl@0
|
148 |
struct X509_POLICY_NODE_st
|
|
sl@0
|
149 |
{
|
|
sl@0
|
150 |
/* node data this refers to */
|
|
sl@0
|
151 |
const X509_POLICY_DATA *data;
|
|
sl@0
|
152 |
/* Parent node */
|
|
sl@0
|
153 |
X509_POLICY_NODE *parent;
|
|
sl@0
|
154 |
/* Number of child nodes */
|
|
sl@0
|
155 |
int nchild;
|
|
sl@0
|
156 |
};
|
|
sl@0
|
157 |
|
|
sl@0
|
158 |
struct X509_POLICY_LEVEL_st
|
|
sl@0
|
159 |
{
|
|
sl@0
|
160 |
/* Cert for this level */
|
|
sl@0
|
161 |
X509 *cert;
|
|
sl@0
|
162 |
/* nodes at this level */
|
|
sl@0
|
163 |
STACK_OF(X509_POLICY_NODE) *nodes;
|
|
sl@0
|
164 |
/* anyPolicy node */
|
|
sl@0
|
165 |
X509_POLICY_NODE *anyPolicy;
|
|
sl@0
|
166 |
/* Extra data */
|
|
sl@0
|
167 |
/*STACK_OF(X509_POLICY_DATA) *extra_data;*/
|
|
sl@0
|
168 |
unsigned int flags;
|
|
sl@0
|
169 |
};
|
|
sl@0
|
170 |
|
|
sl@0
|
171 |
struct X509_POLICY_TREE_st
|
|
sl@0
|
172 |
{
|
|
sl@0
|
173 |
/* This is the tree 'level' data */
|
|
sl@0
|
174 |
X509_POLICY_LEVEL *levels;
|
|
sl@0
|
175 |
int nlevel;
|
|
sl@0
|
176 |
/* Extra policy data when additional nodes (not from the certificate)
|
|
sl@0
|
177 |
* are required.
|
|
sl@0
|
178 |
*/
|
|
sl@0
|
179 |
STACK_OF(X509_POLICY_DATA) *extra_data;
|
|
sl@0
|
180 |
/* This is the authority constained policy set */
|
|
sl@0
|
181 |
STACK_OF(X509_POLICY_NODE) *auth_policies;
|
|
sl@0
|
182 |
STACK_OF(X509_POLICY_NODE) *user_policies;
|
|
sl@0
|
183 |
unsigned int flags;
|
|
sl@0
|
184 |
};
|
|
sl@0
|
185 |
|
|
sl@0
|
186 |
/* Set if anyPolicy present in user policies */
|
|
sl@0
|
187 |
#define POLICY_FLAG_ANY_POLICY 0x2
|
|
sl@0
|
188 |
|
|
sl@0
|
189 |
/* Useful macros */
|
|
sl@0
|
190 |
|
|
sl@0
|
191 |
#define node_data_critical(data) (data->flags & POLICY_DATA_FLAG_CRITICAL)
|
|
sl@0
|
192 |
#define node_critical(node) node_data_critical(node->data)
|
|
sl@0
|
193 |
|
|
sl@0
|
194 |
/* Internal functions */
|
|
sl@0
|
195 |
|
|
sl@0
|
196 |
IMPORT_C X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, ASN1_OBJECT *id,
|
|
sl@0
|
197 |
int crit);
|
|
sl@0
|
198 |
IMPORT_C void policy_data_free(X509_POLICY_DATA *data);
|
|
sl@0
|
199 |
|
|
sl@0
|
200 |
IMPORT_C X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
|
|
sl@0
|
201 |
const ASN1_OBJECT *id);
|
|
sl@0
|
202 |
IMPORT_C int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
|
|
sl@0
|
203 |
|
|
sl@0
|
204 |
|
|
sl@0
|
205 |
IMPORT_C STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
|
|
sl@0
|
206 |
|
|
sl@0
|
207 |
void policy_cache_init(void);
|
|
sl@0
|
208 |
|
|
sl@0
|
209 |
IMPORT_C void policy_cache_free(X509_POLICY_CACHE *cache);
|
|
sl@0
|
210 |
|
|
sl@0
|
211 |
IMPORT_C X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
|
|
sl@0
|
212 |
const ASN1_OBJECT *id);
|
|
sl@0
|
213 |
|
|
sl@0
|
214 |
IMPORT_C X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
|
|
sl@0
|
215 |
const ASN1_OBJECT *id);
|
|
sl@0
|
216 |
|
|
sl@0
|
217 |
IMPORT_C X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
|
|
sl@0
|
218 |
X509_POLICY_DATA *data,
|
|
sl@0
|
219 |
X509_POLICY_NODE *parent,
|
|
sl@0
|
220 |
X509_POLICY_TREE *tree);
|
|
sl@0
|
221 |
IMPORT_C void policy_node_free(X509_POLICY_NODE *node);
|
|
sl@0
|
222 |
|
|
sl@0
|
223 |
IMPORT_C const X509_POLICY_CACHE *policy_cache_set(X509 *x);
|