2 * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 RCSID("$Id: name.c 22432 2008-01-13 14:08:03Z lha $");
38 * @page page_name PKIX/X.509 Names
40 * There are several names in PKIX/X.509, GeneralName and Name.
42 * A Name consists of an ordered list of Relative Distinguished Names
43 * (RDN). Each RDN consists of an unordered list of typed strings. The
44 * types are defined by OID and have long and short description. For
45 * example id-at-commonName (2.5.4.3) have the long name CommonName
46 * and short name CN. The string itself can be of serveral encoding,
47 * UTF8, UTF16, Teltex string, etc. The type limit what encoding
50 * GeneralName is a broader nametype that can contains al kind of
51 * stuff like Name, IP addresses, partial Name, etc.
53 * Name is mapped into a hx509_name object.
55 * Parse and string name into a hx509_name object with hx509_parse_name(),
56 * make it back into string representation with hx509_name_to_string().
58 * Name string are defined rfc2253, rfc1779 and X.501.
60 * See the library functions here: @ref hx509_name
65 const heim_oid *(*o)(void);
67 { "C", oid_id_at_countryName },
68 { "CN", oid_id_at_commonName },
69 { "DC", oid_id_domainComponent },
70 { "L", oid_id_at_localityName },
71 { "O", oid_id_at_organizationName },
72 { "OU", oid_id_at_organizationalUnitName },
73 { "S", oid_id_at_stateOrProvinceName },
74 { "STREET", oid_id_at_streetAddress },
75 { "UID", oid_id_Userid },
76 { "emailAddress", oid_id_pkcs9_emailAddress },
77 { "serialNumber", oid_id_at_serialNumber }
81 quote_string(const char *f, size_t len, size_t *rlen)
92 for (i = 0, j = 0; i < len; i++) {
93 if (from[i] == ' ' && i + 1 < len)
95 else if (from[i] == ',' || from[i] == '=' || from[i] == '+' ||
96 from[i] == '<' || from[i] == '>' || from[i] == '#' ||
97 from[i] == ';' || from[i] == ' ')
101 } else if (((unsigned char)from[i]) >= 32 && ((unsigned char)from[i]) <= 127) {
104 int l = snprintf(&to[j], tolen - j - 1,
105 "#%02x", (unsigned char)from[i]);
117 append_string(char **str, size_t *total_len, const char *ss,
118 size_t len, int quote)
123 qs = quote_string(ss, len, &len);
127 s = realloc(*str, len + *total_len + 1);
129 _hx509_abort("allocation failure"); /* XXX */
130 memcpy(s + *total_len, qs, len);
133 s[*total_len + len] = '\0';
140 oidtostring(const heim_oid *type)
145 for (i = 0; i < sizeof(no)/sizeof(no[0]); i++) {
146 if (der_heim_oid_cmp((*no[i].o)(), type) == 0)
147 return strdup(no[i].n);
149 if (der_print_heim_oid(type, '.', &s) != 0)
155 stringtooid(const char *name, size_t len, heim_oid *oid)
160 memset(oid, 0, sizeof(*oid));
162 for (i = 0; i < sizeof(no)/sizeof(no[0]); i++) {
163 if (strncasecmp(no[i].n, name, len) == 0)
164 return der_copy_oid((*no[i].o)(), oid);
169 memcpy(s, name, len);
171 ret = der_parse_heim_oid(s, ".", oid);
177 * Convert the hx509 name object into a printable string.
178 * The resulting string should be freed with free().
180 * @param name name to print
181 * @param str the string to return
183 * @return An hx509 error code, see hx509_get_error_string().
185 * @ingroup hx509_name
189 hx509_name_to_string(const hx509_name name, char **str)
191 return _hx509_Name_to_string(&name->der_name, str);
195 _hx509_Name_to_string(const Name *n, char **str)
197 size_t total_len = 0;
204 for (i = n->u.rdnSequence.len - 1 ; i >= 0 ; i--) {
207 for (j = 0; j < n->u.rdnSequence.val[i].len; j++) {
208 DirectoryString *ds = &n->u.rdnSequence.val[i].val[j].value;
212 oidname = oidtostring(&n->u.rdnSequence.val[i].val[j].type);
214 switch(ds->element) {
215 case choice_DirectoryString_ia5String:
216 ss = ds->u.ia5String;
218 case choice_DirectoryString_printableString:
219 ss = ds->u.printableString;
221 case choice_DirectoryString_utf8String:
222 ss = ds->u.utf8String;
224 case choice_DirectoryString_bmpString: {
225 uint16_t *bmp = ds->u.bmpString.data;
226 size_t bmplen = ds->u.bmpString.length;
229 ss = malloc(bmplen + 1);
231 _hx509_abort("allocation failure"); /* XXX */
232 for (k = 0; k < bmplen; k++)
233 ss[k] = bmp[k] & 0xff; /* XXX */
237 case choice_DirectoryString_teletexString:
238 ss = malloc(ds->u.teletexString.length + 1);
240 _hx509_abort("allocation failure"); /* XXX */
241 memcpy(ss, ds->u.teletexString.data, ds->u.teletexString.length);
242 ss[ds->u.teletexString.length] = '\0';
244 case choice_DirectoryString_universalString: {
245 uint32_t *uni = ds->u.universalString.data;
246 size_t unilen = ds->u.universalString.length;
249 ss = malloc(unilen + 1);
251 _hx509_abort("allocation failure"); /* XXX */
252 for (k = 0; k < unilen; k++)
253 ss[k] = uni[k] & 0xff; /* XXX */
258 _hx509_abort("unknown directory type: %d", ds->element);
261 append_string(str, &total_len, oidname, strlen(oidname), 0);
263 append_string(str, &total_len, "=", 1, 0);
265 append_string(str, &total_len, ss, len, 1);
266 if (ds->element == choice_DirectoryString_universalString ||
267 ds->element == choice_DirectoryString_bmpString ||
268 ds->element == choice_DirectoryString_teletexString)
272 if (j + 1 < n->u.rdnSequence.val[i].len)
273 append_string(str, &total_len, "+", 1, 0);
277 append_string(str, &total_len, ",", 1, 0);
283 * XXX this function is broken, it needs to compare code points, not
288 prune_space(const unsigned char **s)
295 _hx509_name_ds_cmp(const DirectoryString *ds1, const DirectoryString *ds2)
299 c = ds1->element - ds2->element;
303 switch(ds1->element) {
304 case choice_DirectoryString_ia5String:
305 c = strcmp(ds1->u.ia5String, ds2->u.ia5String);
307 case choice_DirectoryString_teletexString:
308 c = der_heim_octet_string_cmp(&ds1->u.teletexString,
309 &ds2->u.teletexString);
311 case choice_DirectoryString_printableString: {
312 const unsigned char *s1 = (unsigned char*)ds1->u.printableString;
313 const unsigned char *s2 = (unsigned char*)ds2->u.printableString;
314 prune_space(&s1); prune_space(&s2);
316 if (toupper(*s1) != toupper(*s2)) {
317 c = toupper(*s1) - toupper(*s2);
320 if (*s1 == ' ') { prune_space(&s1); prune_space(&s2); }
323 prune_space(&s1); prune_space(&s2);
327 case choice_DirectoryString_utf8String:
328 c = strcmp(ds1->u.utf8String, ds2->u.utf8String);
330 case choice_DirectoryString_universalString:
331 c = der_heim_universal_string_cmp(&ds1->u.universalString,
332 &ds2->u.universalString);
334 case choice_DirectoryString_bmpString:
335 c = der_heim_bmp_string_cmp(&ds1->u.bmpString,
346 _hx509_name_cmp(const Name *n1, const Name *n2)
350 c = n1->u.rdnSequence.len - n2->u.rdnSequence.len;
354 for (i = 0 ; i < n1->u.rdnSequence.len; i++) {
355 c = n1->u.rdnSequence.val[i].len - n2->u.rdnSequence.val[i].len;
359 for (j = 0; j < n1->u.rdnSequence.val[i].len; j++) {
360 c = der_heim_oid_cmp(&n1->u.rdnSequence.val[i].val[j].type,
361 &n1->u.rdnSequence.val[i].val[j].type);
365 c = _hx509_name_ds_cmp(&n1->u.rdnSequence.val[i].val[j].value,
366 &n2->u.rdnSequence.val[i].val[j].value);
375 * Compare to hx509 name object, useful for sorting.
377 * @param n1 a hx509 name object.
378 * @param n2 a hx509 name object.
380 * @return 0 the objects are the same, returns > 0 is n2 is "larger"
381 * then n2, < 0 if n1 is "smaller" then n2.
383 * @ingroup hx509_name
387 hx509_name_cmp(hx509_name n1, hx509_name n2)
389 return _hx509_name_cmp(&n1->der_name, &n2->der_name);
394 _hx509_name_from_Name(const Name *n, hx509_name *name)
397 *name = calloc(1, sizeof(**name));
400 ret = copy_Name(n, &(*name)->der_name);
409 _hx509_name_modify(hx509_context context,
415 RelativeDistinguishedName *rdn;
419 ptr = realloc(name->u.rdnSequence.val,
420 sizeof(name->u.rdnSequence.val[0]) *
421 (name->u.rdnSequence.len + 1));
423 hx509_set_error_string(context, 0, ENOMEM, "Out of memory");
426 name->u.rdnSequence.val = ptr;
429 rdn = &name->u.rdnSequence.val[name->u.rdnSequence.len];
431 memmove(&name->u.rdnSequence.val[1],
432 &name->u.rdnSequence.val[0],
433 name->u.rdnSequence.len *
434 sizeof(name->u.rdnSequence.val[0]));
436 rdn = &name->u.rdnSequence.val[0];
438 rdn->val = malloc(sizeof(rdn->val[0]));
439 if (rdn->val == NULL)
442 ret = der_copy_oid(oid, &rdn->val[0].type);
445 rdn->val[0].value.element = choice_DirectoryString_utf8String;
446 rdn->val[0].value.u.utf8String = strdup(str);
447 if (rdn->val[0].value.u.utf8String == NULL)
449 name->u.rdnSequence.len += 1;
455 * Parse a string into a hx509 name object.
457 * @param context A hx509 context.
458 * @param str a string to parse.
459 * @param name the resulting object, NULL in case of error.
461 * @return An hx509 error code, see hx509_get_error_string().
463 * @ingroup hx509_name
467 hx509_parse_name(hx509_context context, const char *str, hx509_name *name)
476 n = calloc(1, sizeof(*n));
478 hx509_set_error_string(context, 0, ENOMEM, "out of memory");
482 n->der_name.element = choice_Name_rdnSequence;
486 while (p != NULL && *p != '\0') {
501 ret = HX509_PARSING_NAME_FAILED;
502 hx509_set_error_string(context, 0, ret, "missing = in %s", p);
506 ret = HX509_PARSING_NAME_FAILED;
507 hx509_set_error_string(context, 0, ret,
508 "missing name before = in %s", p);
513 ret = HX509_PARSING_NAME_FAILED;
514 hx509_set_error_string(context, 0, ret, " = after , in %s", p);
518 ret = stringtooid(p, q - p, &oid);
520 ret = HX509_PARSING_NAME_FAILED;
521 hx509_set_error_string(context, 0, ret,
522 "unknown type: %.*s", (int)(q - p), p);
527 size_t pstr_len = len - (q - p) - 1;
528 const char *pstr = p + (q - p) + 1;
531 r = malloc(pstr_len + 1);
535 hx509_set_error_string(context, 0, ret, "out of memory");
538 memcpy(r, pstr, pstr_len);
541 ret = _hx509_name_modify(context, &n->der_name, 0, &oid, r);
555 return HX509_NAME_MALFORMED;
559 * Copy a hx509 name object.
561 * @param context A hx509 cotext.
562 * @param from the name to copy from
563 * @param to the name to copy to
565 * @return An hx509 error code, see hx509_get_error_string().
567 * @ingroup hx509_name
571 hx509_name_copy(hx509_context context, const hx509_name from, hx509_name *to)
575 *to = calloc(1, sizeof(**to));
578 ret = copy_Name(&from->der_name, &(*to)->der_name);
588 * Convert a hx509_name into a Name.
590 * @param from the name to copy from
591 * @param to the name to copy to
593 * @return An hx509 error code, see hx509_get_error_string().
595 * @ingroup hx509_name
599 hx509_name_to_Name(const hx509_name from, Name *to)
601 return copy_Name(&from->der_name, to);
605 hx509_name_normalize(hx509_context context, hx509_name name)
611 * Expands variables in the name using env. Variables are on the form
612 * ${name}. Useful when dealing with certificate templates.
614 * @param context A hx509 cotext.
615 * @param name the name to expand.
616 * @param env environment variable to expand.
618 * @return An hx509 error code, see hx509_get_error_string().
620 * @ingroup hx509_name
624 hx509_name_expand(hx509_context context,
628 Name *n = &name->der_name;
634 if (n->element != choice_Name_rdnSequence) {
635 hx509_set_error_string(context, 0, EINVAL, "RDN not of supported type");
639 for (i = 0 ; i < n->u.rdnSequence.len; i++) {
640 for (j = 0; j < n->u.rdnSequence.val[i].len; j++) {
641 /** Only UTF8String rdnSequence names are allowed */
643 THIS SHOULD REALLY BE:
644 COMP = n->u.rdnSequence.val[i].val[j];
645 normalize COMP to utf8
646 check if there are variables
648 convert back to orignal format, store in COMP
649 free normalized utf8 string
651 DirectoryString *ds = &n->u.rdnSequence.val[i].val[j].value;
653 struct rk_strpool *strpool = NULL;
655 if (ds->element != choice_DirectoryString_utf8String) {
656 hx509_set_error_string(context, 0, EINVAL, "unsupported type");
659 p = strstr(ds->u.utf8String, "${");
661 strpool = rk_strpoolprintf(strpool, "%.*s",
662 (int)(p - ds->u.utf8String),
664 if (strpool == NULL) {
665 hx509_set_error_string(context, 0, ENOMEM, "out of memory");
670 /* expand variables */
674 hx509_set_error_string(context, 0, EINVAL, "missing }");
675 rk_strpoolfree(strpool);
679 value = hx509_env_lfind(context, env, p, p2 - p);
681 hx509_set_error_string(context, 0, EINVAL,
682 "variable %.*s missing",
684 rk_strpoolfree(strpool);
687 strpool = rk_strpoolprintf(strpool, "%s", value);
688 if (strpool == NULL) {
689 hx509_set_error_string(context, 0, ENOMEM, "out of memory");
694 p = strstr(p2, "${");
696 strpool = rk_strpoolprintf(strpool, "%.*s",
699 strpool = rk_strpoolprintf(strpool, "%s", p2);
700 if (strpool == NULL) {
701 hx509_set_error_string(context, 0, ENOMEM, "out of memory");
706 free(ds->u.utf8String);
707 ds->u.utf8String = rk_strpoolcollect(strpool);
708 if (ds->u.utf8String == NULL) {
709 hx509_set_error_string(context, 0, ENOMEM, "out of memory");
719 * Free a hx509 name object, upond return *name will be NULL.
721 * @param name a hx509 name object to be freed.
723 * @ingroup hx509_name
727 hx509_name_free(hx509_name *name)
729 free_Name(&(*name)->der_name);
730 memset(*name, 0, sizeof(**name));
736 * Convert a DER encoded name info a string.
738 * @param data data to a DER/BER encoded name
739 * @param length length of data
740 * @param str the resulting string, is NULL on failure.
742 * @return An hx509 error code, see hx509_get_error_string().
744 * @ingroup hx509_name
748 hx509_unparse_der_name(const void *data, size_t length, char **str)
755 ret = decode_Name(data, length, &name, NULL);
758 ret = _hx509_Name_to_string(&name, str);
764 * Convert a hx509_name object to DER encoded name.
766 * @param name name to concert
767 * @param os data to a DER encoded name, free the resulting octet
768 * string with hx509_xfree(os->data).
770 * @return An hx509 error code, see hx509_get_error_string().
772 * @ingroup hx509_name
776 hx509_name_binary(const hx509_name name, heim_octet_string *os)
781 ASN1_MALLOC_ENCODE(Name, os->data, os->length, &name->der_name, &size, ret);
784 if (os->length != size)
785 _hx509_abort("internal ASN.1 encoder error");
791 _hx509_unparse_Name(const Name *aname, char **str)
796 ret = _hx509_name_from_Name(aname, &name);
800 ret = hx509_name_to_string(name, str);
801 hx509_name_free(&name);
806 * Unparse the hx509 name in name into a string.
808 * @param name the name to check if its empty/null.
810 * @return non zero if the name is empty/null.
812 * @ingroup hx509_name
816 hx509_name_is_null_p(const hx509_name name)
818 return name->der_name.u.rdnSequence.len == 0;
822 * Unparse the hx509 name in name into a string.
824 * @param name the name to print
825 * @param str an allocated string returns the name in string form
827 * @return An hx509 error code, see krb5_get_error_string().
829 * @ingroup hx509_name
833 hx509_general_name_unparse(GeneralName *name, char **str)
835 struct rk_strpool *strpool = NULL;
839 switch (name->element) {
840 case choice_GeneralName_otherName: {
842 hx509_oid_sprint(&name->u.otherName.type_id, &str);
845 strpool = rk_strpoolprintf(strpool, "otherName: %s", str);
849 case choice_GeneralName_rfc822Name:
850 strpool = rk_strpoolprintf(strpool, "rfc822Name: %s\n",
853 case choice_GeneralName_dNSName:
854 strpool = rk_strpoolprintf(strpool, "dNSName: %s\n",
857 case choice_GeneralName_directoryName: {
861 memset(&dir, 0, sizeof(dir));
862 dir.element = name->u.directoryName.element;
863 dir.u.rdnSequence = name->u.directoryName.u.rdnSequence;
864 ret = _hx509_unparse_Name(&dir, &s);
867 strpool = rk_strpoolprintf(strpool, "directoryName: %s", s);
871 case choice_GeneralName_uniformResourceIdentifier:
872 strpool = rk_strpoolprintf(strpool, "URI: %s",
873 name->u.uniformResourceIdentifier);
875 case choice_GeneralName_iPAddress: {
876 unsigned char *a = name->u.iPAddress.data;
878 strpool = rk_strpoolprintf(strpool, "IPAddress: ");
881 if (name->u.iPAddress.length == 4)
882 strpool = rk_strpoolprintf(strpool, "%d.%d.%d.%d",
883 a[0], a[1], a[2], a[3]);
884 else if (name->u.iPAddress.length == 16)
885 strpool = rk_strpoolprintf(strpool,
886 "%02X:%02X:%02X:%02X:"
887 "%02X:%02X:%02X:%02X:"
888 "%02X:%02X:%02X:%02X:"
889 "%02X:%02X:%02X:%02X",
890 a[0], a[1], a[2], a[3],
891 a[4], a[5], a[6], a[7],
892 a[8], a[9], a[10], a[11],
893 a[12], a[13], a[14], a[15]);
895 strpool = rk_strpoolprintf(strpool,
896 "unknown IP address of length %lu",
897 (unsigned long)name->u.iPAddress.length);
900 case choice_GeneralName_registeredID: {
902 hx509_oid_sprint(&name->u.registeredID, &str);
905 strpool = rk_strpoolprintf(strpool, "registeredID: %s", str);
915 *str = rk_strpoolcollect(strpool);