feat: support the basicAttConstraints X.509v3 extension

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24847)

crypto/x509/build.info

@@ -17,7 +17,7 @@ SOURCE[../../libcrypto]=\
         v3_asid.c v3_addr.c v3_tlsf.c v3_admis.c v3_no_rev_avail.c \
         v3_soa_id.c v3_no_ass.c v3_group_ac.c v3_single_use.c v3_ind_iss.c \
         x509_acert.c x509aset.c t_acert.c x_ietfatt.c v3_ac_tgt.c v3_sda.c \
-        v3_usernotice.c
+        v3_usernotice.c v3_battcons.c
 
 IF[{- !$disabled{'deprecated-3.0'} -}]
   SOURCE[../../libcrypto]=x509type.c

crypto/x509/ext_dat.h

@@ -39,3 +39,4 @@ extern const X509V3_EXT_METHOD ossl_v3_associated_info;
 extern const X509V3_EXT_METHOD ossl_v3_acc_cert_policies;
 extern const X509V3_EXT_METHOD ossl_v3_acc_priv_policies;
 extern const X509V3_EXT_METHOD ossl_v3_user_notice;
+extern const X509V3_EXT_METHOD ossl_v3_battcons;

crypto/x509/standard_exts.h

@@ -75,6 +75,7 @@ static const X509V3_EXT_METHOD *standard_exts[] = {
     &ossl_v3_issuer_sign_tool,
     &ossl_v3_tls_feature,
     &ossl_v3_ext_admission,
+    &ossl_v3_battcons,
     &ossl_v3_delegated_name_constraints,
     &ossl_v3_user_notice,
     &ossl_v3_soa_identifier,

crypto/x509/v3_battcons.c

@@ -0,0 +1,85 @@
+/*
+ * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "internal/cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+#include "x509_local.h"
+
+static STACK_OF(CONF_VALUE) *i2v_OSSL_BASIC_ATTR_CONSTRAINTS(
+    X509V3_EXT_METHOD *method,
+    OSSL_BASIC_ATTR_CONSTRAINTS *battcons,
+    STACK_OF(CONF_VALUE)
+    *extlist);
+static OSSL_BASIC_ATTR_CONSTRAINTS *v2i_OSSL_BASIC_ATTR_CONSTRAINTS(
+    X509V3_EXT_METHOD *method,
+    X509V3_CTX *ctx,
+    STACK_OF(CONF_VALUE) *values);
+
+const X509V3_EXT_METHOD ossl_v3_battcons = {
+    NID_basic_att_constraints, 0,
+    ASN1_ITEM_ref(OSSL_BASIC_ATTR_CONSTRAINTS),
+    0, 0, 0, 0,
+    0, 0,
+    (X509V3_EXT_I2V) i2v_OSSL_BASIC_ATTR_CONSTRAINTS,
+    (X509V3_EXT_V2I)v2i_OSSL_BASIC_ATTR_CONSTRAINTS,
+    NULL, NULL,
+    NULL
+};
+
+ASN1_SEQUENCE(OSSL_BASIC_ATTR_CONSTRAINTS) = {
+    ASN1_OPT(OSSL_BASIC_ATTR_CONSTRAINTS, authority, ASN1_FBOOLEAN),
+    ASN1_OPT(OSSL_BASIC_ATTR_CONSTRAINTS, pathlen, ASN1_INTEGER)
+} ASN1_SEQUENCE_END(OSSL_BASIC_ATTR_CONSTRAINTS)
+
+IMPLEMENT_ASN1_FUNCTIONS(OSSL_BASIC_ATTR_CONSTRAINTS)
+
+static STACK_OF(CONF_VALUE) *i2v_OSSL_BASIC_ATTR_CONSTRAINTS(
+    X509V3_EXT_METHOD *method,
+    OSSL_BASIC_ATTR_CONSTRAINTS *battcons,
+    STACK_OF(CONF_VALUE) *extlist)
+{
+    X509V3_add_value_bool("authority", battcons->authority, &extlist);
+    X509V3_add_value_int("pathlen", battcons->pathlen, &extlist);
+    return extlist;
+}
+
+static OSSL_BASIC_ATTR_CONSTRAINTS *v2i_OSSL_BASIC_ATTR_CONSTRAINTS(
+    X509V3_EXT_METHOD *method,
+    X509V3_CTX *ctx,
+    STACK_OF(CONF_VALUE) *values)
+{
+    OSSL_BASIC_ATTR_CONSTRAINTS *battcons = NULL;
+    CONF_VALUE *val;
+    int i;
+
+    if ((battcons = OSSL_BASIC_ATTR_CONSTRAINTS_new()) == NULL) {
+        ERR_raise(ERR_LIB_X509V3, ERR_R_ASN1_LIB);
+        return NULL;
+    }
+    for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
+        val = sk_CONF_VALUE_value(values, i);
+        if (strcmp(val->name, "authority") == 0) {
+            if (!X509V3_get_value_bool(val, &battcons->authority))
+                goto err;
+        } else if (strcmp(val->name, "pathlen") == 0) {
+            if (!X509V3_get_value_int(val, &battcons->pathlen))
+                goto err;
+        } else {
+            ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME);
+            X509V3_conf_add_error_name_value(val);
+            goto err;
+        }
+    }
+    return battcons;
+ err:
+    OSSL_BASIC_ATTR_CONSTRAINTS_free(battcons);
+    return NULL;
+}

include/openssl/x509v3.h.in

@@ -126,6 +126,11 @@ typedef struct BASIC_CONSTRAINTS_st {
     ASN1_INTEGER *pathlen;
 } BASIC_CONSTRAINTS;
 
+typedef struct OSSL_BASIC_ATTR_CONSTRAINTS_st {
+    int authority;
+    ASN1_INTEGER *pathlen;
+} OSSL_BASIC_ATTR_CONSTRAINTS;
+
 typedef struct PKEY_USAGE_PERIOD_st {
     ASN1_GENERALIZEDTIME *notBefore;
     ASN1_GENERALIZEDTIME *notAfter;
@@ -511,6 +516,7 @@ typedef struct x509_purpose_st {
 # define X509V3_ADD_SILENT               0x10
 
 DECLARE_ASN1_FUNCTIONS(BASIC_CONSTRAINTS)
+DECLARE_ASN1_FUNCTIONS(OSSL_BASIC_ATTR_CONSTRAINTS)
 
 DECLARE_ASN1_FUNCTIONS(SXNET)
 DECLARE_ASN1_FUNCTIONS(SXNETID)