Add targetingInformation and auditIdentity attribute certificate extensions

crypto/asn1/asn1_item_list.h

@@ -8,7 +8,7 @@
  */
 
 static ASN1_ITEM_EXP *asn1_item_list[] = {
-
+    ASN1_ITEM_ref(TARGETING_INFORMATION),
     ASN1_ITEM_ref(ACCESS_DESCRIPTION),
 #ifndef OPENSSL_NO_RFC3779
     ASN1_ITEM_ref(ASIdOrRange),

crypto/objects/obj_dat.h

@@ -1460,7 +1460,7 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"id-mod-cmp2000", "id-mod-cmp2000", NID_id_mod_cmp2000, 8, &so[2075]},
     {"biometricInfo", "Biometric Info", NID_biometricInfo, 8, &so[2083]},
     {"qcStatements", "qcStatements", NID_qcStatements, 8, &so[2091]},
-    {"ac-auditEntity", "ac-auditEntity", NID_ac_auditEntity, 8, &so[2099]},
+    {"ac-auditEntity", "Audit Identity", NID_ac_auditEntity, 8, &so[2099]},
     {"ac-targeting", "ac-targeting", NID_ac_targeting, 8, &so[2107]},
     {"aaControls", "aaControls", NID_aaControls, 8, &so[2115]},
     {"sbgp-ipAddrBlock", "sbgp-ipAddrBlock", NID_sbgp_ipAddrBlock, 8, &so[2123]},
@@ -3781,6 +3781,7 @@ static const unsigned int ln_objs[NUM_LN] = {
      368,    /* "Acceptable OCSP Responses" */
      910,    /* "Any Extended Key Usage" */
      664,    /* "Any language" */
+     287,    /* "Audit Identity" */
      177,    /* "Authority Information Access" */
     1220,    /* "BGPsec Router" */
      365,    /* "Basic OCSP Response" */
@@ -4023,7 +4024,6 @@ static const unsigned int ln_objs[NUM_LN] = {
     1209,    /* "XmppAddr" */
      478,    /* "aRecord" */
      289,    /* "aaControls" */
-     287,    /* "ac-auditEntity" */
      397,    /* "ac-proxying" */
      288,    /* "ac-targeting" */
      446,    /* "account" */

crypto/objects/objects.txt

@@ -511,7 +511,7 @@ id-pkix-mod 100		: id-mod-cmp2021-02
 id-pe 1			: authorityInfoAccess	: Authority Information Access
 id-pe 2			: biometricInfo		: Biometric Info
 id-pe 3			: qcStatements
-id-pe 4			: ac-auditEntity
+id-pe 4			: ac-auditEntity	: Audit Identity
 id-pe 5			: ac-targeting
 id-pe 6			: aaControls
 id-pe 7			: sbgp-ipAddrBlock

crypto/x509/build.info

@@ -16,7 +16,8 @@ SOURCE[../../libcrypto]=\
         pcy_cache.c pcy_node.c pcy_data.c pcy_map.c pcy_tree.c pcy_lib.c \
         v3_asid.c v3_addr.c v3_tlsf.c v3_admis.c \
         x509_acert.c t_acert.c x509aset.c x_ietfatt.c \
-        v3_no_rev_avail.c v3_soa_id.c v3_no_ass.c v3_group_ac.c v3_single_use.c
+        v3_no_rev_avail.c v3_soa_id.c v3_no_ass.c v3_group_ac.c \
+        v3_single_use.c v3_ac_tgt.c v3_audit_id.c
 
 IF[{- !$disabled{'deprecated-3.0'} -}]
   SOURCE[../../libcrypto]=x509type.c

crypto/x509/ext_dat.h

@@ -30,3 +30,5 @@ extern const X509V3_EXT_METHOD ossl_v3_soa_identifier;
 extern const X509V3_EXT_METHOD ossl_v3_no_assertion;
 extern const X509V3_EXT_METHOD ossl_v3_no_rev_avail;
 extern const X509V3_EXT_METHOD ossl_v3_single_use;
+extern const X509V3_EXT_METHOD ossl_v3_targeting_information;
+extern const X509V3_EXT_METHOD ossl_v3_audit_identity;

crypto/x509/standard_exts.h

@@ -39,6 +39,7 @@ static const X509V3_EXT_METHOD *standard_exts[] = {
 #endif
     &ossl_v3_sxnet,
     &ossl_v3_info,
+    &ossl_v3_audit_identity,
 #ifndef OPENSSL_NO_RFC3779
     &ossl_v3_addr,
     &ossl_v3_asid,
@@ -53,6 +54,7 @@ static const X509V3_EXT_METHOD *standard_exts[] = {
 #endif
     &ossl_v3_sinfo,
     &ossl_v3_policy_constraints,
+    &ossl_v3_targeting_information,
     &ossl_v3_no_rev_avail,
 #ifndef OPENSSL_NO_OCSP
     &ossl_v3_crl_hold,
@@ -75,8 +77,8 @@ static const X509V3_EXT_METHOD *standard_exts[] = {
     &ossl_v3_ext_admission,
     &ossl_v3_soa_identifier,
     &ossl_v3_no_assertion,
+    &ossl_v3_single_use,
     &ossl_v3_group_ac,
-    &ossl_v3_single_use
 };
 
 /* Number of standard extensions */

crypto/x509/v3_ac_tgt.c

@@ -0,0 +1,242 @@
+/*
+ * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+#include "ext_dat.h"
+#include "x509_local.h"
+#include "crypto/asn1.h"
+
+static int i2r_ISSUER_SERIAL(X509V3_EXT_METHOD *method,
+                             ISSUER_SERIAL *iss,
+                             BIO *out, int indent);
+static int i2r_OBJECT_DIGEST_INFO(X509V3_EXT_METHOD *method,
+                                  OBJECT_DIGEST_INFO *odi,
+                                  BIO *out, int indent);
+static int i2r_TARGET_CERT(X509V3_EXT_METHOD *method,
+                           TARGET_CERT *tc,
+                           BIO *out, int indent);
+static int i2r_TARGET(X509V3_EXT_METHOD *method,
+                      TARGET *target,
+                      BIO *out, int indent);
+static int i2r_TARGETING_INFORMATION(X509V3_EXT_METHOD *method,
+                                     TARGETING_INFORMATION *tinfo,
+                                     BIO *out, int indent);
+
+ASN1_SEQUENCE(ISSUER_SERIAL) = {
+    ASN1_SIMPLE(ISSUER_SERIAL, issuer, GENERAL_NAMES),
+    ASN1_SIMPLE(ISSUER_SERIAL, serial, ASN1_INTEGER),
+    ASN1_OPT(ISSUER_SERIAL, issuerUID, ASN1_BIT_STRING),
+} ASN1_SEQUENCE_END(ISSUER_SERIAL)
+
+ASN1_SEQUENCE(OBJECT_DIGEST_INFO) = {
+    ASN1_SIMPLE(OBJECT_DIGEST_INFO, digestedObjectType, ASN1_ENUMERATED),
+    ASN1_OPT(OBJECT_DIGEST_INFO, otherObjectTypeID, ASN1_OBJECT),
+    ASN1_SIMPLE(OBJECT_DIGEST_INFO, digestAlgorithm, X509_ALGOR),
+    ASN1_SIMPLE(OBJECT_DIGEST_INFO, objectDigest, ASN1_BIT_STRING),
+} ASN1_SEQUENCE_END(OBJECT_DIGEST_INFO)
+
+ASN1_SEQUENCE(TARGET_CERT) = {
+    ASN1_SIMPLE(TARGET_CERT, targetCertificate, ISSUER_SERIAL),
+    ASN1_OPT(TARGET_CERT, targetName, GENERAL_NAME),
+    ASN1_OPT(TARGET_CERT, certDigestInfo, OBJECT_DIGEST_INFO),
+} ASN1_SEQUENCE_END(TARGET_CERT)
+
+ASN1_CHOICE(TARGET) = {
+    ASN1_EXP(TARGET, choice.targetName, GENERAL_NAME, 0),
+    ASN1_EXP(TARGET, choice.targetGroup, GENERAL_NAME, 1),
+    ASN1_IMP(TARGET, choice.targetCert, TARGET_CERT, 2),
+} ASN1_CHOICE_END(TARGET)
+
+ASN1_ITEM_TEMPLATE(TARGETS) =
+    ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Targets, TARGET)
+ASN1_ITEM_TEMPLATE_END(TARGETS)
+
+ASN1_ITEM_TEMPLATE(TARGETING_INFORMATION) =
+    ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, TargetingInformation, TARGETS)
+ASN1_ITEM_TEMPLATE_END(TARGETING_INFORMATION)
+
+IMPLEMENT_ASN1_FUNCTIONS(ISSUER_SERIAL)
+IMPLEMENT_ASN1_FUNCTIONS(OBJECT_DIGEST_INFO)
+IMPLEMENT_ASN1_FUNCTIONS(TARGET_CERT)
+IMPLEMENT_ASN1_FUNCTIONS(TARGET)
+IMPLEMENT_ASN1_FUNCTIONS(TARGETS)
+IMPLEMENT_ASN1_FUNCTIONS(TARGETING_INFORMATION)
+
+static int i2r_ISSUER_SERIAL(X509V3_EXT_METHOD *method,
+                             ISSUER_SERIAL *iss,
+                             BIO *out, int indent)
+{
+    if (iss->issuer != NULL) {
+        BIO_printf(out, "%*sIssuer Names:\n", indent, "");
+        ossl_print_gens(out, iss->issuer, indent);
+        BIO_puts(out, "\n");
+    }
+    if (iss->serial != NULL) {
+        BIO_printf(out, "%*sIssuer Serial: ", indent, "");
+        if (i2a_ASN1_INTEGER(out, iss->serial) <= 0)
+            return 0;
+        BIO_puts(out, "\n");
+    }
+    if (iss->issuerUID != NULL) {
+        BIO_printf(out, "%*sIssuer UID: ", indent, "");
+        if (i2a_ASN1_STRING(out, iss->issuerUID, V_ASN1_BIT_STRING) <= 0)
+            return 0;
+        BIO_puts(out, "\n");
+    }
+    return 1;
+}
+
+static int i2r_OBJECT_DIGEST_INFO(X509V3_EXT_METHOD *method,
+                           OBJECT_DIGEST_INFO *odi,
+                           BIO *out, int indent)
+{
+    int64_t dot = 0;
+    int sig_nid;
+    X509_ALGOR *digalg;
+    ASN1_STRING *sig;
+
+    if (odi == NULL) {
+        ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
+    digalg = odi->digestAlgorithm;
+    sig = odi->objectDigest;
+    if (!ASN1_ENUMERATED_get_int64(&dot, odi->digestedObjectType)) {
+        return 0;
+    }
+    switch (dot) {
+    case (ODI_TYPE_PUBLIC_KEY):
+        BIO_printf(out, "%*sDigest Type: Public Key\n", indent, "");
+        break;
+    case (ODI_TYPE_PUBLIC_KEY_CERT):
+        BIO_printf(out, "%*sDigest Type: Public Key Certificate\n", indent, "");
+        break;
+    case (ODI_TYPE_OTHER): {
+        BIO_printf(out, "%*sDigest Type: Other\n", indent, "");
+        break;
+    }
+    }
+    if (odi->otherObjectTypeID != NULL) {
+        BIO_printf(out, "%*sDigest Type Identifier: ", indent, "");
+        i2a_ASN1_OBJECT(out, odi->otherObjectTypeID);
+        BIO_puts(out, "\n");
+    }
+    if (BIO_printf(out, "%*sSignature Algorithm: ", indent, "") <= 0)
+        return 0;
+    if (i2a_ASN1_OBJECT(out, odi->digestAlgorithm->algorithm) <= 0)
+        return 0;
+    BIO_puts(out, "\n");
+    if (BIO_printf(out, "\n%*sSignature Value: ", indent, "") <= 0)
+        return 0;
+    sig_nid = OBJ_obj2nid(odi->digestAlgorithm->algorithm);
+    if (sig_nid != NID_undef) {
+        int pkey_nid, dig_nid;
+        const EVP_PKEY_ASN1_METHOD *ameth;
+        if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) {
+            ameth = EVP_PKEY_asn1_find(NULL, pkey_nid);
+            if (ameth && ameth->sig_print)
+                return ameth->sig_print(out, digalg, sig, indent + 4, 0);
+        }
+    }
+    if (BIO_write(out, "\n", 1) != 1)
+        return 0;
+    if (sig)
+        return X509_signature_dump(out, sig, indent + 4);
+    return 1;
+}
+
+static int i2r_TARGET_CERT(X509V3_EXT_METHOD *method,
+                           TARGET_CERT *tc,
+                           BIO *out, int indent)
+{
+    BIO_printf(out, "%*s", indent, "");
+    if (tc->targetCertificate != NULL) {
+        BIO_puts(out, "Target Certificate:\n");
+        i2r_ISSUER_SERIAL(method, tc->targetCertificate, out, indent + 2);
+    }
+    if (tc->targetName != NULL) {
+        // BIO_puts(out, "Target Name: ");
+        BIO_printf(out, "%*sTarget Name: ", indent, "");
+        GENERAL_NAME_print(out, tc->targetName);
+        BIO_puts(out, "\n");
+    }
+    if (tc->certDigestInfo != NULL) {
+        BIO_printf(out, "%*sCertificate Digest Info:\n", indent, "");
+        i2r_OBJECT_DIGEST_INFO(method, tc->certDigestInfo, out, indent + 2);
+    }
+    BIO_puts(out, "\n");
+    return 1;
+}
+
+static int i2r_TARGET(X509V3_EXT_METHOD *method,
+                      TARGET *target,
+                      BIO *out, int indent)
+{
+    switch (target->type) {
+    case (TGT_TARGET_NAME):
+        BIO_printf(out, "%*sTarget Name: ", indent, "");
+        GENERAL_NAME_print(out, target->choice.targetName);
+        BIO_puts(out, "\n");
+        break;
+    case (TGT_TARGET_GROUP):
+        BIO_printf(out, "%*sTarget Group: ", indent, "");
+        GENERAL_NAME_print(out, target->choice.targetGroup);
+        BIO_puts(out, "\n");
+        break;
+    case (TGT_TARGET_CERT):
+        BIO_printf(out, "%*sTarget Cert:\n", indent, "");
+        i2r_TARGET_CERT(method, target->choice.targetCert, out, indent + 2);
+        break;
+    }
+    return 1;
+}
+
+static int i2r_TARGETS(X509V3_EXT_METHOD *method,
+                      TARGETS *targets,
+                      BIO *out, int indent)
+{
+    int i;
+    TARGET *target;
+    for (i = 0; i < sk_TARGET_num(targets); i++) {
+        BIO_printf(out, "%*sTarget:\n", indent, "");
+        target = sk_TARGET_value(targets, i);
+        i2r_TARGET(method, target, out, indent + 2);
+    }
+    return 1;
+}
+
+static int i2r_TARGETING_INFORMATION(X509V3_EXT_METHOD *method,
+                                     TARGETING_INFORMATION *tinfo,
+                                     BIO *out, int indent)
+{
+    int i;
+    TARGETS *targets;
+    for (i = 0; i < sk_TARGETS_num(tinfo); i++) {
+        BIO_printf(out, "%*sTargets:\n", indent, "");
+        targets = sk_TARGETS_value(tinfo, i);
+        i2r_TARGETS(method, targets, out, indent + 2);
+    }
+    return 1;
+}
+
+const X509V3_EXT_METHOD ossl_v3_targeting_information = {
+    NID_target_information, 0, ASN1_ITEM_ref(TARGETING_INFORMATION),
+    0, 0, 0, 0,
+    0,
+    0,
+    0, 0,
+    (X509V3_EXT_I2R)i2r_TARGETING_INFORMATION,
+    0,
+    NULL
+};

crypto/x509/v3_audit_id.c

@@ -0,0 +1,24 @@
+/*
+ * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <stdio.h>
+#include "internal/cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/x509v3.h>
+#include "ext_dat.h"
+
+const X509V3_EXT_METHOD ossl_v3_audit_identity = {
+    NID_ac_auditEntity, 0, ASN1_ITEM_ref(ASN1_OCTET_STRING),
+    0, 0, 0, 0,
+    (X509V3_EXT_I2S)i2s_ASN1_OCTET_STRING,
+    (X509V3_EXT_S2I)s2i_ASN1_OCTET_STRING,
+    0, 0, 0, 0,
+    NULL
+};

crypto/x509/v3_crld.c

@@ -405,23 +405,11 @@ static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
     return NULL;
 }
 
-static int print_gens(BIO *out, STACK_OF(GENERAL_NAME) *gens, int indent)
-{
-    int i;
-    for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
-        if (i > 0)
-            BIO_puts(out, "\n");
-        BIO_printf(out, "%*s", indent + 2, "");
-        GENERAL_NAME_print(out, sk_GENERAL_NAME_value(gens, i));
-    }
-    return 1;
-}
-
 static int print_distpoint(BIO *out, DIST_POINT_NAME *dpn, int indent)
 {
     if (dpn->type == 0) {
         BIO_printf(out, "%*sFull Name:\n", indent, "");
-        print_gens(out, dpn->name.fullname, indent);
+        ossl_print_gens(out, dpn->name.fullname, indent);
     } else {
         X509_NAME ntmp;
         ntmp.entries = dpn->name.relativename;
@@ -472,7 +460,7 @@ static int i2r_crldp(const X509V3_EXT_METHOD *method, void *pcrldp, BIO *out,
             print_reasons(out, "Reasons", point->reasons, indent);
         if (point->CRLissuer) {
             BIO_printf(out, "%*sCRL Issuer:\n", indent, "");
-            print_gens(out, point->CRLissuer, indent);
+            ossl_print_gens(out, point->CRLissuer, indent);
         }
     }
     return 1;