2 * Copyright 2003-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/cryptlib.h"
11 #include "internal/numbers.h"
13 #include "crypto/asn1.h"
14 #include <openssl/asn1t.h>
15 #include <openssl/conf.h>
16 #include <openssl/x509v3.h>
17 #include <openssl/bn.h>
19 #include "crypto/x509.h"
20 #include "crypto/punycode.h"
23 static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
25 STACK_OF(CONF_VALUE) *nval);
26 static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
28 static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
29 STACK_OF(GENERAL_SUBTREE) *trees, BIO *bp,
30 int ind, const char *name);
31 static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip);
33 static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc);
34 static int nc_match_single(int effective_type, GENERAL_NAME *sub,
36 static int nc_dn(const X509_NAME *sub, const X509_NAME *nm);
37 static int nc_dns(ASN1_IA5STRING *sub, ASN1_IA5STRING *dns);
38 static int nc_email(ASN1_IA5STRING *sub, ASN1_IA5STRING *eml);
39 static int nc_email_eai(ASN1_TYPE *emltype, ASN1_IA5STRING *base);
40 static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base);
41 static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base);
43 const X509V3_EXT_METHOD ossl_v3_name_constraints = {
44 NID_name_constraints, 0,
45 ASN1_ITEM_ref(NAME_CONSTRAINTS),
48 0, v2i_NAME_CONSTRAINTS,
49 i2r_NAME_CONSTRAINTS, 0,
53 ASN1_SEQUENCE(GENERAL_SUBTREE) = {
54 ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
55 ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
56 ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1)
57 } ASN1_SEQUENCE_END(GENERAL_SUBTREE)
59 ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
60 ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, permittedSubtrees,
62 ASN1_IMP_SEQUENCE_OF_OPT(NAME_CONSTRAINTS, excludedSubtrees,
64 } ASN1_SEQUENCE_END(NAME_CONSTRAINTS)
67 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
68 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
71 #define IA5_OFFSET_LEN(ia5base, offset) \
72 ((ia5base)->length - ((unsigned char *)(offset) - (ia5base)->data))
74 /* Like memchr but for ASN1_IA5STRING. Additionally you can specify the
75 * starting point to search from
77 # define ia5memchr(str, start, c) memchr(start, c, IA5_OFFSET_LEN(str, start))
79 /* Like memrrchr but for ASN1_IA5STRING */
80 static char *ia5memrchr(ASN1_IA5STRING *str, int c)
84 for (i = str->length; i > 0 && str->data[i - 1] != c; i--);
89 return (char *)&str->data[i - 1];
93 * We cannot use strncasecmp here because that applies locale specific rules. It
94 * also doesn't work with ASN1_STRINGs that may have embedded NUL characters.
95 * For example in Turkish 'I' is not the uppercase character for 'i'. We need to
96 * do a simple ASCII case comparison ignoring the locale (that is why we use
97 * numeric constants below).
99 static int ia5ncasecmp(const char *s1, const char *s2, size_t n)
101 for (; n > 0; n--, s1++, s2++) {
103 unsigned char c1 = (unsigned char)*s1, c2 = (unsigned char)*s2;
105 /* Convert to lower case */
106 if (c1 >= 0x41 /* A */ && c1 <= 0x5A /* Z */)
108 if (c2 >= 0x41 /* A */ && c2 <= 0x5A /* Z */)
125 static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
126 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
129 CONF_VALUE tval, *val;
130 STACK_OF(GENERAL_SUBTREE) **ptree = NULL;
131 NAME_CONSTRAINTS *ncons = NULL;
132 GENERAL_SUBTREE *sub = NULL;
134 ncons = NAME_CONSTRAINTS_new();
137 for (i = 0; i < sk_CONF_VALUE_num(nval); i++) {
138 val = sk_CONF_VALUE_value(nval, i);
139 if (strncmp(val->name, "permitted", 9) == 0 && val->name[9]) {
140 ptree = &ncons->permittedSubtrees;
141 tval.name = val->name + 10;
142 } else if (strncmp(val->name, "excluded", 8) == 0 && val->name[8]) {
143 ptree = &ncons->excludedSubtrees;
144 tval.name = val->name + 9;
146 ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_SYNTAX);
149 tval.value = val->value;
150 sub = GENERAL_SUBTREE_new();
153 if (!v2i_GENERAL_NAME_ex(sub->base, method, ctx, &tval, 1))
156 *ptree = sk_GENERAL_SUBTREE_new_null();
157 if (*ptree == NULL || !sk_GENERAL_SUBTREE_push(*ptree, sub))
165 ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
167 NAME_CONSTRAINTS_free(ncons);
168 GENERAL_SUBTREE_free(sub);
173 static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
176 NAME_CONSTRAINTS *ncons = a;
177 do_i2r_name_constraints(method, ncons->permittedSubtrees,
178 bp, ind, "Permitted");
179 if (ncons->permittedSubtrees && ncons->excludedSubtrees)
181 do_i2r_name_constraints(method, ncons->excludedSubtrees,
182 bp, ind, "Excluded");
186 static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
187 STACK_OF(GENERAL_SUBTREE) *trees,
188 BIO *bp, int ind, const char *name)
190 GENERAL_SUBTREE *tree;
192 if (sk_GENERAL_SUBTREE_num(trees) > 0)
193 BIO_printf(bp, "%*s%s:\n", ind, "", name);
194 for (i = 0; i < sk_GENERAL_SUBTREE_num(trees); i++) {
197 tree = sk_GENERAL_SUBTREE_value(trees, i);
198 BIO_printf(bp, "%*s", ind + 2, "");
199 if (tree->base->type == GEN_IPADD)
200 print_nc_ipadd(bp, tree->base->d.ip);
202 GENERAL_NAME_print(bp, tree->base);
207 static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
209 /* ip->length should be 8 or 32 and len1 == len2 == 4 or len1 == len2 == 16 */
210 int len1 = ip->length >= 16 ? 16 : ip->length >= 4 ? 4 : ip->length;
211 int len2 = ip->length - len1;
212 char *ip1 = ossl_ipaddr_to_asc(ip->data, len1);
213 char *ip2 = ossl_ipaddr_to_asc(ip->data + len1, len2);
214 int ret = ip1 != NULL && ip2 != NULL
215 && BIO_printf(bp, "IP:%s/%s", ip1, ip2) > 0;
222 #define NAME_CHECK_MAX (1 << 20)
224 static int add_lengths(int *out, int a, int b)
226 /* sk_FOO_num(NULL) returns -1 but is effectively 0 when iterating. */
239 * Check a certificate conforms to a specified set of constraints.
241 * X509_V_OK: All constraints obeyed.
242 * X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation.
243 * X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation.
244 * X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type.
245 * X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: Unsupported constraint type.
246 * X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax.
247 * X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name
250 int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc)
252 int r, i, name_count, constraint_count;
255 nm = X509_get_subject_name(x);
258 * Guard against certificates with an excessive number of names or
259 * constraints causing a computationally expensive name constraints check.
261 if (!add_lengths(&name_count, X509_NAME_entry_count(nm),
262 sk_GENERAL_NAME_num(x->altname))
263 || !add_lengths(&constraint_count,
264 sk_GENERAL_SUBTREE_num(nc->permittedSubtrees),
265 sk_GENERAL_SUBTREE_num(nc->excludedSubtrees))
266 || (name_count > 0 && constraint_count > NAME_CHECK_MAX / name_count))
267 return X509_V_ERR_UNSPECIFIED;
269 if (X509_NAME_entry_count(nm) > 0) {
271 gntmp.type = GEN_DIRNAME;
272 gntmp.d.directoryName = nm;
274 r = nc_match(&gntmp, nc);
279 gntmp.type = GEN_EMAIL;
281 /* Process any email address attributes in subject name */
284 const X509_NAME_ENTRY *ne;
286 i = X509_NAME_get_index_by_NID(nm, NID_pkcs9_emailAddress, i);
289 ne = X509_NAME_get_entry(nm, i);
290 gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne);
291 if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING)
292 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
294 r = nc_match(&gntmp, nc);
302 for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++) {
303 GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i);
304 r = nc_match(gen, nc);
313 static int cn2dnsid(ASN1_STRING *cn, unsigned char **dnsid, size_t *idlen)
316 unsigned char *utf8_value;
320 /* Don't leave outputs uninitialized */
325 * Per RFC 6125, DNS-IDs representing internationalized domain names appear
326 * in certificates in A-label encoded form:
328 * https://tools.ietf.org/html/rfc6125#section-6.4.2
330 * The same applies to CNs which are intended to represent DNS names.
331 * However, while in the SAN DNS-IDs are IA5Strings, as CNs they may be
332 * needlessly encoded in 16-bit Unicode. We perform a conversion to UTF-8
333 * to ensure that we get an ASCII representation of any CNs that are
334 * representable as ASCII, but just not encoded as ASCII. The UTF-8 form
335 * may contain some non-ASCII octets, and that's fine, such CNs are not
336 * valid legacy DNS names.
338 * Note, 'int' is the return type of ASN1_STRING_to_UTF8() so that's what
339 * we must use for 'utf8_length'.
341 if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, cn)) < 0)
342 return X509_V_ERR_OUT_OF_MEM;
345 * Some certificates have had names that include a *trailing* NUL byte.
346 * Remove these harmless NUL characters. They would otherwise yield false
347 * alarms with the following embedded NUL check.
349 while (utf8_length > 0 && utf8_value[utf8_length - 1] == '\0')
352 /* Reject *embedded* NULs */
353 if (memchr(utf8_value, 0, utf8_length) != NULL) {
354 OPENSSL_free(utf8_value);
355 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
359 * XXX: Deviation from strict DNS name syntax, also check names with '_'
360 * Check DNS name syntax, any '-' or '.' must be internal,
361 * and on either side of each '.' we can't have a '-' or '.'.
363 * If the name has just one label, we don't consider it a DNS name. This
364 * means that "CN=sometld" cannot be precluded by DNS name constraints, but
365 * that is not a problem.
367 for (i = 0; i < utf8_length; ++i) {
368 unsigned char c = utf8_value[i];
370 if ((c >= 'a' && c <= 'z')
371 || (c >= 'A' && c <= 'Z')
372 || (c >= '0' && c <= '9')
376 /* Dot and hyphen cannot be first or last. */
377 if (i > 0 && i < utf8_length - 1) {
381 * Next to a dot the preceding and following characters must not be
382 * another dot or a hyphen. Otherwise, record that the name is
383 * plausible, since it has two or more labels.
386 && utf8_value[i + 1] != '.'
387 && utf8_value[i - 1] != '-'
388 && utf8_value[i + 1] != '-') {
399 *idlen = (size_t)utf8_length;
402 OPENSSL_free(utf8_value);
407 * Check CN against DNS-ID name constraints.
409 int NAME_CONSTRAINTS_check_CN(X509 *x, NAME_CONSTRAINTS *nc)
412 const X509_NAME *nm = X509_get_subject_name(x);
417 stmp.type = V_ASN1_IA5STRING;
418 gntmp.type = GEN_DNS;
419 gntmp.d.dNSName = &stmp;
421 /* Process any commonName attributes in subject name */
426 unsigned char *idval;
429 i = X509_NAME_get_index_by_NID(nm, NID_commonName, i);
432 ne = X509_NAME_get_entry(nm, i);
433 cn = X509_NAME_ENTRY_get_data(ne);
435 /* Only process attributes that look like host names */
436 if ((r = cn2dnsid(cn, &idval, &idlen)) != X509_V_OK)
443 r = nc_match(&gntmp, nc);
452 * Return nonzero if the GeneralSubtree has valid 'minimum' field
453 * (must be absent or 0) and valid 'maximum' field (must be absent).
455 static int nc_minmax_valid(GENERAL_SUBTREE *sub) {
463 bn = ASN1_INTEGER_to_BN(sub->minimum, NULL);
464 if (bn == NULL || !BN_is_zero(bn))
472 static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc)
474 GENERAL_SUBTREE *sub;
476 int effective_type = gen->type;
479 * We need to compare not gen->type field but an "effective" type because
480 * the otherName field may contain EAI email address treated specially
481 * according to RFC 8398, section 6
483 if (effective_type == GEN_OTHERNAME &&
484 (OBJ_obj2nid(gen->d.otherName->type_id) == NID_id_on_SmtpUTF8Mailbox)) {
485 effective_type = GEN_EMAIL;
489 * Permitted subtrees: if any subtrees exist of matching the type at
490 * least one subtree must match.
493 for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) {
494 sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
495 if (effective_type != sub->base->type
496 || (effective_type == GEN_OTHERNAME &&
497 OBJ_cmp(gen->d.otherName->type_id,
498 sub->base->d.otherName->type_id) != 0))
500 if (!nc_minmax_valid(sub))
501 return X509_V_ERR_SUBTREE_MINMAX;
502 /* If we already have a match don't bother trying any more */
507 r = nc_match_single(effective_type, gen, sub->base);
510 else if (r != X509_V_ERR_PERMITTED_VIOLATION)
515 return X509_V_ERR_PERMITTED_VIOLATION;
517 /* Excluded subtrees: must not match any of these */
519 for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++) {
520 sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i);
521 if (effective_type != sub->base->type
522 || (effective_type == GEN_OTHERNAME &&
523 OBJ_cmp(gen->d.otherName->type_id,
524 sub->base->d.otherName->type_id) != 0))
526 if (!nc_minmax_valid(sub))
527 return X509_V_ERR_SUBTREE_MINMAX;
529 r = nc_match_single(effective_type, gen, sub->base);
531 return X509_V_ERR_EXCLUDED_VIOLATION;
532 else if (r != X509_V_ERR_PERMITTED_VIOLATION)
541 static int nc_match_single(int effective_type, GENERAL_NAME *gen,
546 switch (effective_type) {
549 * We are here only when we have SmtpUTF8 name,
550 * so we match the value of othername with base->d.rfc822Name
552 return nc_email_eai(gen->d.otherName->value, base->d.rfc822Name);
555 return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
559 return nc_dn(gen->d.directoryName, base->d.directoryName);
562 return nc_dns(gen->d.dNSName, base->d.dNSName);
565 return nc_email(gen->d.rfc822Name, base->d.rfc822Name);
568 return nc_uri(gen->d.uniformResourceIdentifier,
569 base->d.uniformResourceIdentifier);
572 return nc_ip(gen->d.iPAddress, base->d.iPAddress);
575 return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
581 * directoryName name constraint matching. The canonical encoding of
582 * X509_NAME makes this comparison easy. It is matched if the subtree is a
583 * subset of the name.
586 static int nc_dn(const X509_NAME *nm, const X509_NAME *base)
588 /* Ensure canonical encodings are up to date. */
589 if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
590 return X509_V_ERR_OUT_OF_MEM;
591 if (base->modified && i2d_X509_NAME(base, NULL) < 0)
592 return X509_V_ERR_OUT_OF_MEM;
593 if (base->canon_enclen > nm->canon_enclen)
594 return X509_V_ERR_PERMITTED_VIOLATION;
595 if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
596 return X509_V_ERR_PERMITTED_VIOLATION;
600 static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
602 char *baseptr = (char *)base->data;
603 char *dnsptr = (char *)dns->data;
605 /* Empty matches everything */
606 if (base->length == 0)
609 if (dns->length < base->length)
610 return X509_V_ERR_PERMITTED_VIOLATION;
613 * Otherwise can add zero or more components on the left so compare RHS
614 * and if dns is longer and expect '.' as preceding character.
616 if (dns->length > base->length) {
617 dnsptr += dns->length - base->length;
618 if (*baseptr != '.' && dnsptr[-1] != '.')
619 return X509_V_ERR_PERMITTED_VIOLATION;
622 if (ia5ncasecmp(baseptr, dnsptr, base->length))
623 return X509_V_ERR_PERMITTED_VIOLATION;
630 * This function implements comparison between ASCII/U-label in emltype
631 * and A-label in base according to RFC 8398, section 6.
632 * Convert base to U-label and ASCII-parts of domain names, for base
633 * Octet-to-octet comparison of `emltype` and `base` hostname parts
634 * (ASCII-parts should be compared in case-insensitive manner)
636 static int nc_email_eai(ASN1_TYPE *emltype, ASN1_IA5STRING *base)
638 ASN1_UTF8STRING *eml;
639 char *baseptr = NULL;
643 size_t size = sizeof(ulabel) - 1;
647 /* We do not accept embedded NUL characters */
648 if (base->length > 0 && memchr(base->data, 0, base->length) != NULL)
649 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
651 /* 'base' may not be NUL terminated. Create a copy that is */
652 baseptr = OPENSSL_strndup((char *)base->data, base->length);
654 return X509_V_ERR_OUT_OF_MEM;
656 if (emltype->type != V_ASN1_UTF8STRING) {
657 ret = X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
661 eml = emltype->value.utf8string;
662 emlptr = (char *)eml->data;
663 emlat = ia5memrchr(eml, '@');
666 ret = X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
670 memset(ulabel, 0, sizeof(ulabel));
671 /* Special case: initial '.' is RHS match */
672 if (*baseptr == '.') {
675 if (ossl_a2ulabel(baseptr, ulabel + 1, &size) <= 0) {
676 ret = X509_V_ERR_UNSPECIFIED;
680 if ((size_t)eml->length > strlen(ulabel)) {
681 emlptr += eml->length - (strlen(ulabel));
683 if (ia5ncasecmp(ulabel, emlptr, strlen(ulabel)) == 0)
686 ret = X509_V_ERR_PERMITTED_VIOLATION;
690 if (ossl_a2ulabel(baseptr, ulabel, &size) <= 0) {
691 ret = X509_V_ERR_UNSPECIFIED;
694 /* Just have hostname left to match: case insensitive */
696 emlhostlen = IA5_OFFSET_LEN(eml, emlptr);
697 if (emlhostlen != strlen(ulabel)
698 || ia5ncasecmp(ulabel, emlptr, emlhostlen) != 0) {
699 ret = X509_V_ERR_PERMITTED_VIOLATION;
704 OPENSSL_free(baseptr);
708 static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
710 const char *baseptr = (char *)base->data;
711 const char *emlptr = (char *)eml->data;
712 const char *baseat = ia5memrchr(base, '@');
713 const char *emlat = ia5memrchr(eml, '@');
714 size_t basehostlen, emlhostlen;
717 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
718 /* Special case: initial '.' is RHS match */
719 if (!baseat && base->length > 0 && (*baseptr == '.')) {
720 if (eml->length > base->length) {
721 emlptr += eml->length - base->length;
722 if (ia5ncasecmp(baseptr, emlptr, base->length) == 0)
725 return X509_V_ERR_PERMITTED_VIOLATION;
728 /* If we have anything before '@' match local part */
731 if (baseat != baseptr) {
732 if ((baseat - baseptr) != (emlat - emlptr))
733 return X509_V_ERR_PERMITTED_VIOLATION;
734 if (memchr(baseptr, 0, baseat - baseptr) ||
735 memchr(emlptr, 0, emlat - emlptr))
736 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
737 /* Case sensitive match of local part */
738 if (strncmp(baseptr, emlptr, emlat - emlptr))
739 return X509_V_ERR_PERMITTED_VIOLATION;
741 /* Position base after '@' */
742 baseptr = baseat + 1;
745 basehostlen = IA5_OFFSET_LEN(base, baseptr);
746 emlhostlen = IA5_OFFSET_LEN(eml, emlptr);
747 /* Just have hostname left to match: case insensitive */
748 if (basehostlen != emlhostlen || ia5ncasecmp(baseptr, emlptr, emlhostlen))
749 return X509_V_ERR_PERMITTED_VIOLATION;
755 static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
757 const char *baseptr = (char *)base->data;
758 const char *hostptr = (char *)uri->data;
759 const char *p = ia5memchr(uri, (char *)uri->data, ':');
762 /* Check for foo:// and skip past it */
764 || IA5_OFFSET_LEN(uri, p) < 3
767 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
770 /* Determine length of hostname part of URI */
772 /* Look for a port indicator as end of hostname first */
774 p = ia5memchr(uri, hostptr, ':');
775 /* Otherwise look for trailing slash */
777 p = ia5memchr(uri, hostptr, '/');
780 hostlen = IA5_OFFSET_LEN(uri, hostptr);
782 hostlen = p - hostptr;
785 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
787 /* Special case: initial '.' is RHS match */
788 if (base->length > 0 && *baseptr == '.') {
789 if (hostlen > base->length) {
790 p = hostptr + hostlen - base->length;
791 if (ia5ncasecmp(p, baseptr, base->length) == 0)
794 return X509_V_ERR_PERMITTED_VIOLATION;
797 if ((base->length != (int)hostlen)
798 || ia5ncasecmp(hostptr, baseptr, hostlen))
799 return X509_V_ERR_PERMITTED_VIOLATION;
805 static int nc_ip(ASN1_OCTET_STRING *ip, ASN1_OCTET_STRING *base)
807 int hostlen, baselen, i;
808 unsigned char *hostptr, *baseptr, *maskptr;
810 hostlen = ip->length;
811 baseptr = base->data;
812 baselen = base->length;
814 /* Invalid if not IPv4 or IPv6 */
815 if (!((hostlen == 4) || (hostlen == 16)))
816 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
817 if (!((baselen == 8) || (baselen == 32)))
818 return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
820 /* Do not match IPv4 with IPv6 */
821 if (hostlen * 2 != baselen)
822 return X509_V_ERR_PERMITTED_VIOLATION;
824 maskptr = base->data + hostlen;
826 /* Considering possible not aligned base ipAddress */
827 /* Not checking for wrong mask definition: i.e.: 255.0.255.0 */
828 for (i = 0; i < hostlen; i++)
829 if ((hostptr[i] & maskptr[i]) != (baseptr[i] & maskptr[i]))
830 return X509_V_ERR_PERMITTED_VIOLATION;