Arcola / mbedtls

mbed TLS upgraded to 2.6.0

Fork of mbedtls by Mark Radbourne

library/x509.c@1:9ebc941037d5, 2017-09-29 (annotated)

Committer:
Jasper Wallace
Date:
Fri Sep 29 18:41:59 2017 +0100
Revision:
1:9ebc941037d5
Parent:
0:cdf462088d13
Child:
2:bbdeda018a3c
Update to mbedtls 2.4.2, security fixes



Changes to mbedtls sources made:



in include/mbedtls/config.h comment out:



#define MBEDTLS_FS_IO

#define MBEDTLS_NET_C

#define MBEDTLS_TIMING_C



uncomment:



#define MBEDTLS_NO_PLATFORM_ENTROPY

Who changed what in which revision?

UserRevisionLine numberNew contents of line
markrad 0:cdf462088d13 1 /*
markrad 0:cdf462088d13 2 * X.509 common functions for parsing and verification
markrad 0:cdf462088d13 3 *
markrad 0:cdf462088d13 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
markrad 0:cdf462088d13 5 * SPDX-License-Identifier: Apache-2.0
markrad 0:cdf462088d13 6 *
markrad 0:cdf462088d13 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
markrad 0:cdf462088d13 8 * not use this file except in compliance with the License.
markrad 0:cdf462088d13 9 * You may obtain a copy of the License at
markrad 0:cdf462088d13 10 *
markrad 0:cdf462088d13 11 * http://www.apache.org/licenses/LICENSE-2.0
markrad 0:cdf462088d13 12 *
markrad 0:cdf462088d13 13 * Unless required by applicable law or agreed to in writing, software
markrad 0:cdf462088d13 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
markrad 0:cdf462088d13 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
markrad 0:cdf462088d13 16 * See the License for the specific language governing permissions and
markrad 0:cdf462088d13 17 * limitations under the License.
markrad 0:cdf462088d13 18 *
markrad 0:cdf462088d13 19 * This file is part of mbed TLS (https://tls.mbed.org)
markrad 0:cdf462088d13 20 */
markrad 0:cdf462088d13 21 /*
markrad 0:cdf462088d13 22 * The ITU-T X.509 standard defines a certificate format for PKI.
markrad 0:cdf462088d13 23 *
markrad 0:cdf462088d13 24 * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
markrad 0:cdf462088d13 25 * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
markrad 0:cdf462088d13 26 * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
markrad 0:cdf462088d13 27 *
markrad 0:cdf462088d13 28 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
markrad 0:cdf462088d13 29 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
markrad 0:cdf462088d13 30 */
markrad 0:cdf462088d13 31
markrad 0:cdf462088d13 32 #if !defined(MBEDTLS_CONFIG_FILE)
markrad 0:cdf462088d13 33 #include "mbedtls/config.h"
markrad 0:cdf462088d13 34 #else
markrad 0:cdf462088d13 35 #include MBEDTLS_CONFIG_FILE
markrad 0:cdf462088d13 36 #endif
markrad 0:cdf462088d13 37
markrad 0:cdf462088d13 38 #if defined(MBEDTLS_X509_USE_C)
markrad 0:cdf462088d13 39
markrad 0:cdf462088d13 40 #include "mbedtls/x509.h"
markrad 0:cdf462088d13 41 #include "mbedtls/asn1.h"
markrad 0:cdf462088d13 42 #include "mbedtls/oid.h"
markrad 0:cdf462088d13 43
markrad 0:cdf462088d13 44 #include <stdio.h>
markrad 0:cdf462088d13 45 #include <string.h>
markrad 0:cdf462088d13 46
markrad 0:cdf462088d13 47 #if defined(MBEDTLS_PEM_PARSE_C)
markrad 0:cdf462088d13 48 #include "mbedtls/pem.h"
markrad 0:cdf462088d13 49 #endif
markrad 0:cdf462088d13 50
markrad 0:cdf462088d13 51 #if defined(MBEDTLS_PLATFORM_C)
markrad 0:cdf462088d13 52 #include "mbedtls/platform.h"
markrad 0:cdf462088d13 53 #else
markrad 0:cdf462088d13 54 #include <stdio.h>
markrad 0:cdf462088d13 55 #include <stdlib.h>
markrad 0:cdf462088d13 56 #define mbedtls_free free
markrad 0:cdf462088d13 57 #define mbedtls_calloc calloc
markrad 0:cdf462088d13 58 #define mbedtls_printf printf
markrad 0:cdf462088d13 59 #define mbedtls_snprintf snprintf
markrad 0:cdf462088d13 60 #endif
markrad 0:cdf462088d13 61
markrad 0:cdf462088d13 62
markrad 0:cdf462088d13 63 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 64 #include "mbedtls/platform_time.h"
markrad 0:cdf462088d13 65 #endif
markrad 0:cdf462088d13 66
markrad 0:cdf462088d13 67 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
markrad 0:cdf462088d13 68 #include <windows.h>
markrad 0:cdf462088d13 69 #else
markrad 0:cdf462088d13 70 #include <time.h>
markrad 0:cdf462088d13 71 #endif
markrad 0:cdf462088d13 72
markrad 0:cdf462088d13 73 #if defined(MBEDTLS_FS_IO)
markrad 0:cdf462088d13 74 #include <stdio.h>
markrad 0:cdf462088d13 75 #if !defined(_WIN32)
markrad 0:cdf462088d13 76 #include <sys/types.h>
markrad 0:cdf462088d13 77 #include <sys/stat.h>
markrad 0:cdf462088d13 78 #include <dirent.h>
markrad 0:cdf462088d13 79 #endif
markrad 0:cdf462088d13 80 #endif
markrad 0:cdf462088d13 81
markrad 0:cdf462088d13 82 #define CHECK(code) if( ( ret = code ) != 0 ){ return( ret ); }
markrad 0:cdf462088d13 83 #define CHECK_RANGE(min, max, val) if( val < min || val > max ){ return( ret ); }
markrad 0:cdf462088d13 84
markrad 0:cdf462088d13 85 /*
markrad 0:cdf462088d13 86 * CertificateSerialNumber ::= INTEGER
markrad 0:cdf462088d13 87 */
markrad 0:cdf462088d13 88 int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 89 mbedtls_x509_buf *serial )
markrad 0:cdf462088d13 90 {
markrad 0:cdf462088d13 91 int ret;
markrad 0:cdf462088d13 92
markrad 0:cdf462088d13 93 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 94 return( MBEDTLS_ERR_X509_INVALID_SERIAL +
markrad 0:cdf462088d13 95 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 96
markrad 0:cdf462088d13 97 if( **p != ( MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_PRIMITIVE | 2 ) &&
markrad 0:cdf462088d13 98 **p != MBEDTLS_ASN1_INTEGER )
markrad 0:cdf462088d13 99 return( MBEDTLS_ERR_X509_INVALID_SERIAL +
markrad 0:cdf462088d13 100 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 101
markrad 0:cdf462088d13 102 serial->tag = *(*p)++;
markrad 0:cdf462088d13 103
markrad 0:cdf462088d13 104 if( ( ret = mbedtls_asn1_get_len( p, end, &serial->len ) ) != 0 )
markrad 0:cdf462088d13 105 return( MBEDTLS_ERR_X509_INVALID_SERIAL + ret );
markrad 0:cdf462088d13 106
markrad 0:cdf462088d13 107 serial->p = *p;
markrad 0:cdf462088d13 108 *p += serial->len;
markrad 0:cdf462088d13 109
markrad 0:cdf462088d13 110 return( 0 );
markrad 0:cdf462088d13 111 }
markrad 0:cdf462088d13 112
markrad 0:cdf462088d13 113 /* Get an algorithm identifier without parameters (eg for signatures)
markrad 0:cdf462088d13 114 *
markrad 0:cdf462088d13 115 * AlgorithmIdentifier ::= SEQUENCE {
markrad 0:cdf462088d13 116 * algorithm OBJECT IDENTIFIER,
markrad 0:cdf462088d13 117 * parameters ANY DEFINED BY algorithm OPTIONAL }
markrad 0:cdf462088d13 118 */
markrad 0:cdf462088d13 119 int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 120 mbedtls_x509_buf *alg )
markrad 0:cdf462088d13 121 {
markrad 0:cdf462088d13 122 int ret;
markrad 0:cdf462088d13 123
markrad 0:cdf462088d13 124 if( ( ret = mbedtls_asn1_get_alg_null( p, end, alg ) ) != 0 )
markrad 0:cdf462088d13 125 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 126
markrad 0:cdf462088d13 127 return( 0 );
markrad 0:cdf462088d13 128 }
markrad 0:cdf462088d13 129
markrad 0:cdf462088d13 130 /*
markrad 0:cdf462088d13 131 * Parse an algorithm identifier with (optional) paramaters
markrad 0:cdf462088d13 132 */
markrad 0:cdf462088d13 133 int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 134 mbedtls_x509_buf *alg, mbedtls_x509_buf *params )
markrad 0:cdf462088d13 135 {
markrad 0:cdf462088d13 136 int ret;
markrad 0:cdf462088d13 137
markrad 0:cdf462088d13 138 if( ( ret = mbedtls_asn1_get_alg( p, end, alg, params ) ) != 0 )
markrad 0:cdf462088d13 139 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 140
markrad 0:cdf462088d13 141 return( 0 );
markrad 0:cdf462088d13 142 }
markrad 0:cdf462088d13 143
markrad 0:cdf462088d13 144 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 145 /*
markrad 0:cdf462088d13 146 * HashAlgorithm ::= AlgorithmIdentifier
markrad 0:cdf462088d13 147 *
markrad 0:cdf462088d13 148 * AlgorithmIdentifier ::= SEQUENCE {
markrad 0:cdf462088d13 149 * algorithm OBJECT IDENTIFIER,
markrad 0:cdf462088d13 150 * parameters ANY DEFINED BY algorithm OPTIONAL }
markrad 0:cdf462088d13 151 *
markrad 0:cdf462088d13 152 * For HashAlgorithm, parameters MUST be NULL or absent.
markrad 0:cdf462088d13 153 */
markrad 0:cdf462088d13 154 static int x509_get_hash_alg( const mbedtls_x509_buf *alg, mbedtls_md_type_t *md_alg )
markrad 0:cdf462088d13 155 {
markrad 0:cdf462088d13 156 int ret;
markrad 0:cdf462088d13 157 unsigned char *p;
markrad 0:cdf462088d13 158 const unsigned char *end;
markrad 0:cdf462088d13 159 mbedtls_x509_buf md_oid;
markrad 0:cdf462088d13 160 size_t len;
markrad 0:cdf462088d13 161
markrad 0:cdf462088d13 162 /* Make sure we got a SEQUENCE and setup bounds */
markrad 0:cdf462088d13 163 if( alg->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
markrad 0:cdf462088d13 164 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 165 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 166
markrad 0:cdf462088d13 167 p = (unsigned char *) alg->p;
markrad 0:cdf462088d13 168 end = p + alg->len;
markrad 0:cdf462088d13 169
markrad 0:cdf462088d13 170 if( p >= end )
markrad 0:cdf462088d13 171 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 172 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 173
markrad 0:cdf462088d13 174 /* Parse md_oid */
markrad 0:cdf462088d13 175 md_oid.tag = *p;
markrad 0:cdf462088d13 176
markrad 0:cdf462088d13 177 if( ( ret = mbedtls_asn1_get_tag( &p, end, &md_oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
markrad 0:cdf462088d13 178 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 179
markrad 0:cdf462088d13 180 md_oid.p = p;
markrad 0:cdf462088d13 181 p += md_oid.len;
markrad 0:cdf462088d13 182
markrad 0:cdf462088d13 183 /* Get md_alg from md_oid */
markrad 0:cdf462088d13 184 if( ( ret = mbedtls_oid_get_md_alg( &md_oid, md_alg ) ) != 0 )
markrad 0:cdf462088d13 185 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 186
markrad 0:cdf462088d13 187 /* Make sure params is absent of NULL */
markrad 0:cdf462088d13 188 if( p == end )
markrad 0:cdf462088d13 189 return( 0 );
markrad 0:cdf462088d13 190
markrad 0:cdf462088d13 191 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_NULL ) ) != 0 || len != 0 )
markrad 0:cdf462088d13 192 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 193
markrad 0:cdf462088d13 194 if( p != end )
markrad 0:cdf462088d13 195 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 196 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 197
markrad 0:cdf462088d13 198 return( 0 );
markrad 0:cdf462088d13 199 }
markrad 0:cdf462088d13 200
markrad 0:cdf462088d13 201 /*
markrad 0:cdf462088d13 202 * RSASSA-PSS-params ::= SEQUENCE {
markrad 0:cdf462088d13 203 * hashAlgorithm [0] HashAlgorithm DEFAULT sha1Identifier,
markrad 0:cdf462088d13 204 * maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
markrad 0:cdf462088d13 205 * saltLength [2] INTEGER DEFAULT 20,
markrad 0:cdf462088d13 206 * trailerField [3] INTEGER DEFAULT 1 }
markrad 0:cdf462088d13 207 * -- Note that the tags in this Sequence are explicit.
markrad 0:cdf462088d13 208 *
markrad 0:cdf462088d13 209 * RFC 4055 (which defines use of RSASSA-PSS in PKIX) states that the value
markrad 0:cdf462088d13 210 * of trailerField MUST be 1, and PKCS#1 v2.2 doesn't even define any other
markrad 0:cdf462088d13 211 * option. Enfore this at parsing time.
markrad 0:cdf462088d13 212 */
markrad 0:cdf462088d13 213 int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params,
markrad 0:cdf462088d13 214 mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md,
markrad 0:cdf462088d13 215 int *salt_len )
markrad 0:cdf462088d13 216 {
markrad 0:cdf462088d13 217 int ret;
markrad 0:cdf462088d13 218 unsigned char *p;
markrad 0:cdf462088d13 219 const unsigned char *end, *end2;
markrad 0:cdf462088d13 220 size_t len;
markrad 0:cdf462088d13 221 mbedtls_x509_buf alg_id, alg_params;
markrad 0:cdf462088d13 222
markrad 0:cdf462088d13 223 /* First set everything to defaults */
markrad 0:cdf462088d13 224 *md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 225 *mgf_md = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 226 *salt_len = 20;
markrad 0:cdf462088d13 227
markrad 0:cdf462088d13 228 /* Make sure params is a SEQUENCE and setup bounds */
markrad 0:cdf462088d13 229 if( params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
markrad 0:cdf462088d13 230 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 231 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 232
markrad 0:cdf462088d13 233 p = (unsigned char *) params->p;
markrad 0:cdf462088d13 234 end = p + params->len;
markrad 0:cdf462088d13 235
markrad 0:cdf462088d13 236 if( p == end )
markrad 0:cdf462088d13 237 return( 0 );
markrad 0:cdf462088d13 238
markrad 0:cdf462088d13 239 /*
markrad 0:cdf462088d13 240 * HashAlgorithm
markrad 0:cdf462088d13 241 */
markrad 0:cdf462088d13 242 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 243 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0 ) ) == 0 )
markrad 0:cdf462088d13 244 {
markrad 0:cdf462088d13 245 end2 = p + len;
markrad 0:cdf462088d13 246
markrad 0:cdf462088d13 247 /* HashAlgorithm ::= AlgorithmIdentifier (without parameters) */
markrad 0:cdf462088d13 248 if( ( ret = mbedtls_x509_get_alg_null( &p, end2, &alg_id ) ) != 0 )
markrad 0:cdf462088d13 249 return( ret );
markrad 0:cdf462088d13 250
markrad 0:cdf462088d13 251 if( ( ret = mbedtls_oid_get_md_alg( &alg_id, md_alg ) ) != 0 )
markrad 0:cdf462088d13 252 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 253
markrad 0:cdf462088d13 254 if( p != end2 )
markrad 0:cdf462088d13 255 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 256 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 257 }
markrad 0:cdf462088d13 258 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 259 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 260
markrad 0:cdf462088d13 261 if( p == end )
markrad 0:cdf462088d13 262 return( 0 );
markrad 0:cdf462088d13 263
markrad 0:cdf462088d13 264 /*
markrad 0:cdf462088d13 265 * MaskGenAlgorithm
markrad 0:cdf462088d13 266 */
markrad 0:cdf462088d13 267 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 268 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1 ) ) == 0 )
markrad 0:cdf462088d13 269 {
markrad 0:cdf462088d13 270 end2 = p + len;
markrad 0:cdf462088d13 271
markrad 0:cdf462088d13 272 /* MaskGenAlgorithm ::= AlgorithmIdentifier (params = HashAlgorithm) */
markrad 0:cdf462088d13 273 if( ( ret = mbedtls_x509_get_alg( &p, end2, &alg_id, &alg_params ) ) != 0 )
markrad 0:cdf462088d13 274 return( ret );
markrad 0:cdf462088d13 275
markrad 0:cdf462088d13 276 /* Only MFG1 is recognised for now */
markrad 0:cdf462088d13 277 if( MBEDTLS_OID_CMP( MBEDTLS_OID_MGF1, &alg_id ) != 0 )
markrad 0:cdf462088d13 278 return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE +
markrad 0:cdf462088d13 279 MBEDTLS_ERR_OID_NOT_FOUND );
markrad 0:cdf462088d13 280
markrad 0:cdf462088d13 281 /* Parse HashAlgorithm */
markrad 0:cdf462088d13 282 if( ( ret = x509_get_hash_alg( &alg_params, mgf_md ) ) != 0 )
markrad 0:cdf462088d13 283 return( ret );
markrad 0:cdf462088d13 284
markrad 0:cdf462088d13 285 if( p != end2 )
markrad 0:cdf462088d13 286 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 287 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 288 }
markrad 0:cdf462088d13 289 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 290 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 291
markrad 0:cdf462088d13 292 if( p == end )
markrad 0:cdf462088d13 293 return( 0 );
markrad 0:cdf462088d13 294
markrad 0:cdf462088d13 295 /*
markrad 0:cdf462088d13 296 * salt_len
markrad 0:cdf462088d13 297 */
markrad 0:cdf462088d13 298 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 299 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2 ) ) == 0 )
markrad 0:cdf462088d13 300 {
markrad 0:cdf462088d13 301 end2 = p + len;
markrad 0:cdf462088d13 302
markrad 0:cdf462088d13 303 if( ( ret = mbedtls_asn1_get_int( &p, end2, salt_len ) ) != 0 )
markrad 0:cdf462088d13 304 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 305
markrad 0:cdf462088d13 306 if( p != end2 )
markrad 0:cdf462088d13 307 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 308 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 309 }
markrad 0:cdf462088d13 310 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 311 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 312
markrad 0:cdf462088d13 313 if( p == end )
markrad 0:cdf462088d13 314 return( 0 );
markrad 0:cdf462088d13 315
markrad 0:cdf462088d13 316 /*
markrad 0:cdf462088d13 317 * trailer_field (if present, must be 1)
markrad 0:cdf462088d13 318 */
markrad 0:cdf462088d13 319 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 320 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 3 ) ) == 0 )
markrad 0:cdf462088d13 321 {
markrad 0:cdf462088d13 322 int trailer_field;
markrad 0:cdf462088d13 323
markrad 0:cdf462088d13 324 end2 = p + len;
markrad 0:cdf462088d13 325
markrad 0:cdf462088d13 326 if( ( ret = mbedtls_asn1_get_int( &p, end2, &trailer_field ) ) != 0 )
markrad 0:cdf462088d13 327 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 328
markrad 0:cdf462088d13 329 if( p != end2 )
markrad 0:cdf462088d13 330 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 331 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 332
markrad 0:cdf462088d13 333 if( trailer_field != 1 )
markrad 0:cdf462088d13 334 return( MBEDTLS_ERR_X509_INVALID_ALG );
markrad 0:cdf462088d13 335 }
markrad 0:cdf462088d13 336 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 337 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 338
markrad 0:cdf462088d13 339 if( p != end )
markrad 0:cdf462088d13 340 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 341 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 342
markrad 0:cdf462088d13 343 return( 0 );
markrad 0:cdf462088d13 344 }
markrad 0:cdf462088d13 345 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 346
markrad 0:cdf462088d13 347 /*
markrad 0:cdf462088d13 348 * AttributeTypeAndValue ::= SEQUENCE {
markrad 0:cdf462088d13 349 * type AttributeType,
markrad 0:cdf462088d13 350 * value AttributeValue }
markrad 0:cdf462088d13 351 *
markrad 0:cdf462088d13 352 * AttributeType ::= OBJECT IDENTIFIER
markrad 0:cdf462088d13 353 *
markrad 0:cdf462088d13 354 * AttributeValue ::= ANY DEFINED BY AttributeType
markrad 0:cdf462088d13 355 */
markrad 0:cdf462088d13 356 static int x509_get_attr_type_value( unsigned char **p,
markrad 0:cdf462088d13 357 const unsigned char *end,
markrad 0:cdf462088d13 358 mbedtls_x509_name *cur )
markrad 0:cdf462088d13 359 {
markrad 0:cdf462088d13 360 int ret;
markrad 0:cdf462088d13 361 size_t len;
markrad 0:cdf462088d13 362 mbedtls_x509_buf *oid;
markrad 0:cdf462088d13 363 mbedtls_x509_buf *val;
markrad 0:cdf462088d13 364
markrad 0:cdf462088d13 365 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 366 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 367 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 368
markrad 0:cdf462088d13 369 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 370 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 371 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 372
markrad 0:cdf462088d13 373 oid = &cur->oid;
markrad 0:cdf462088d13 374 oid->tag = **p;
markrad 0:cdf462088d13 375
markrad 0:cdf462088d13 376 if( ( ret = mbedtls_asn1_get_tag( p, end, &oid->len, MBEDTLS_ASN1_OID ) ) != 0 )
markrad 0:cdf462088d13 377 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 378
markrad 0:cdf462088d13 379 oid->p = *p;
markrad 0:cdf462088d13 380 *p += oid->len;
markrad 0:cdf462088d13 381
markrad 0:cdf462088d13 382 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 383 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 384 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 385
markrad 0:cdf462088d13 386 if( **p != MBEDTLS_ASN1_BMP_STRING && **p != MBEDTLS_ASN1_UTF8_STRING &&
markrad 0:cdf462088d13 387 **p != MBEDTLS_ASN1_T61_STRING && **p != MBEDTLS_ASN1_PRINTABLE_STRING &&
markrad 0:cdf462088d13 388 **p != MBEDTLS_ASN1_IA5_STRING && **p != MBEDTLS_ASN1_UNIVERSAL_STRING &&
markrad 0:cdf462088d13 389 **p != MBEDTLS_ASN1_BIT_STRING )
markrad 0:cdf462088d13 390 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 391 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 392
markrad 0:cdf462088d13 393 val = &cur->val;
markrad 0:cdf462088d13 394 val->tag = *(*p)++;
markrad 0:cdf462088d13 395
markrad 0:cdf462088d13 396 if( ( ret = mbedtls_asn1_get_len( p, end, &val->len ) ) != 0 )
markrad 0:cdf462088d13 397 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 398
markrad 0:cdf462088d13 399 val->p = *p;
markrad 0:cdf462088d13 400 *p += val->len;
markrad 0:cdf462088d13 401
markrad 0:cdf462088d13 402 cur->next = NULL;
markrad 0:cdf462088d13 403
markrad 0:cdf462088d13 404 return( 0 );
markrad 0:cdf462088d13 405 }
markrad 0:cdf462088d13 406
markrad 0:cdf462088d13 407 /*
markrad 0:cdf462088d13 408 * Name ::= CHOICE { -- only one possibility for now --
markrad 0:cdf462088d13 409 * rdnSequence RDNSequence }
markrad 0:cdf462088d13 410 *
markrad 0:cdf462088d13 411 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
markrad 0:cdf462088d13 412 *
markrad 0:cdf462088d13 413 * RelativeDistinguishedName ::=
markrad 0:cdf462088d13 414 * SET OF AttributeTypeAndValue
markrad 0:cdf462088d13 415 *
markrad 0:cdf462088d13 416 * AttributeTypeAndValue ::= SEQUENCE {
markrad 0:cdf462088d13 417 * type AttributeType,
markrad 0:cdf462088d13 418 * value AttributeValue }
markrad 0:cdf462088d13 419 *
markrad 0:cdf462088d13 420 * AttributeType ::= OBJECT IDENTIFIER
markrad 0:cdf462088d13 421 *
markrad 0:cdf462088d13 422 * AttributeValue ::= ANY DEFINED BY AttributeType
markrad 0:cdf462088d13 423 *
markrad 0:cdf462088d13 424 * The data structure is optimized for the common case where each RDN has only
markrad 0:cdf462088d13 425 * one element, which is represented as a list of AttributeTypeAndValue.
markrad 0:cdf462088d13 426 * For the general case we still use a flat list, but we mark elements of the
markrad 0:cdf462088d13 427 * same set so that they are "merged" together in the functions that consume
markrad 0:cdf462088d13 428 * this list, eg mbedtls_x509_dn_gets().
markrad 0:cdf462088d13 429 */
markrad 0:cdf462088d13 430 int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 431 mbedtls_x509_name *cur )
markrad 0:cdf462088d13 432 {
markrad 0:cdf462088d13 433 int ret;
markrad 0:cdf462088d13 434 size_t set_len;
markrad 0:cdf462088d13 435 const unsigned char *end_set;
markrad 0:cdf462088d13 436
markrad 0:cdf462088d13 437 /* don't use recursion, we'd risk stack overflow if not optimized */
markrad 0:cdf462088d13 438 while( 1 )
markrad 0:cdf462088d13 439 {
markrad 0:cdf462088d13 440 /*
markrad 0:cdf462088d13 441 * parse SET
markrad 0:cdf462088d13 442 */
markrad 0:cdf462088d13 443 if( ( ret = mbedtls_asn1_get_tag( p, end, &set_len,
markrad 0:cdf462088d13 444 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET ) ) != 0 )
markrad 0:cdf462088d13 445 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 446
markrad 0:cdf462088d13 447 end_set = *p + set_len;
markrad 0:cdf462088d13 448
markrad 0:cdf462088d13 449 while( 1 )
markrad 0:cdf462088d13 450 {
markrad 0:cdf462088d13 451 if( ( ret = x509_get_attr_type_value( p, end_set, cur ) ) != 0 )
markrad 0:cdf462088d13 452 return( ret );
markrad 0:cdf462088d13 453
markrad 0:cdf462088d13 454 if( *p == end_set )
markrad 0:cdf462088d13 455 break;
markrad 0:cdf462088d13 456
markrad 0:cdf462088d13 457 /* Mark this item as being no the only one in a set */
markrad 0:cdf462088d13 458 cur->next_merged = 1;
markrad 0:cdf462088d13 459
markrad 0:cdf462088d13 460 cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
markrad 0:cdf462088d13 461
markrad 0:cdf462088d13 462 if( cur->next == NULL )
markrad 0:cdf462088d13 463 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 464
markrad 0:cdf462088d13 465 cur = cur->next;
markrad 0:cdf462088d13 466 }
markrad 0:cdf462088d13 467
markrad 0:cdf462088d13 468 /*
markrad 0:cdf462088d13 469 * continue until end of SEQUENCE is reached
markrad 0:cdf462088d13 470 */
markrad 0:cdf462088d13 471 if( *p == end )
markrad 0:cdf462088d13 472 return( 0 );
markrad 0:cdf462088d13 473
markrad 0:cdf462088d13 474 cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
markrad 0:cdf462088d13 475
markrad 0:cdf462088d13 476 if( cur->next == NULL )
markrad 0:cdf462088d13 477 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 478
markrad 0:cdf462088d13 479 cur = cur->next;
markrad 0:cdf462088d13 480 }
markrad 0:cdf462088d13 481 }
markrad 0:cdf462088d13 482
Jasper Wallace 1:9ebc941037d5 483 static int x509_parse_int( unsigned char **p, size_t n, int *res )
Jasper Wallace 1:9ebc941037d5 484 {
markrad 0:cdf462088d13 485 *res = 0;
Jasper Wallace 1:9ebc941037d5 486
Jasper Wallace 1:9ebc941037d5 487 for( ; n > 0; --n )
Jasper Wallace 1:9ebc941037d5 488 {
Jasper Wallace 1:9ebc941037d5 489 if( ( **p < '0') || ( **p > '9' ) )
Jasper Wallace 1:9ebc941037d5 490 return ( MBEDTLS_ERR_X509_INVALID_DATE );
Jasper Wallace 1:9ebc941037d5 491
markrad 0:cdf462088d13 492 *res *= 10;
Jasper Wallace 1:9ebc941037d5 493 *res += ( *(*p)++ - '0' );
markrad 0:cdf462088d13 494 }
Jasper Wallace 1:9ebc941037d5 495
Jasper Wallace 1:9ebc941037d5 496 return( 0 );
markrad 0:cdf462088d13 497 }
markrad 0:cdf462088d13 498
markrad 0:cdf462088d13 499 static int x509_date_is_valid(const mbedtls_x509_time *time)
markrad 0:cdf462088d13 500 {
markrad 0:cdf462088d13 501 int ret = MBEDTLS_ERR_X509_INVALID_DATE;
markrad 0:cdf462088d13 502
markrad 0:cdf462088d13 503 CHECK_RANGE( 0, 9999, time->year );
markrad 0:cdf462088d13 504 CHECK_RANGE( 0, 23, time->hour );
markrad 0:cdf462088d13 505 CHECK_RANGE( 0, 59, time->min );
markrad 0:cdf462088d13 506 CHECK_RANGE( 0, 59, time->sec );
markrad 0:cdf462088d13 507
markrad 0:cdf462088d13 508 switch( time->mon )
markrad 0:cdf462088d13 509 {
markrad 0:cdf462088d13 510 case 1: case 3: case 5: case 7: case 8: case 10: case 12:
markrad 0:cdf462088d13 511 CHECK_RANGE( 1, 31, time->day );
markrad 0:cdf462088d13 512 break;
markrad 0:cdf462088d13 513 case 4: case 6: case 9: case 11:
markrad 0:cdf462088d13 514 CHECK_RANGE( 1, 30, time->day );
markrad 0:cdf462088d13 515 break;
markrad 0:cdf462088d13 516 case 2:
markrad 0:cdf462088d13 517 CHECK_RANGE( 1, 28 + (time->year % 4 == 0), time->day );
markrad 0:cdf462088d13 518 break;
markrad 0:cdf462088d13 519 default:
markrad 0:cdf462088d13 520 return( ret );
markrad 0:cdf462088d13 521 }
markrad 0:cdf462088d13 522
markrad 0:cdf462088d13 523 return( 0 );
markrad 0:cdf462088d13 524 }
markrad 0:cdf462088d13 525
markrad 0:cdf462088d13 526 /*
Jasper Wallace 1:9ebc941037d5 527 * Parse an ASN1_UTC_TIME (yearlen=2) or ASN1_GENERALIZED_TIME (yearlen=4)
Jasper Wallace 1:9ebc941037d5 528 * field.
Jasper Wallace 1:9ebc941037d5 529 */
Jasper Wallace 1:9ebc941037d5 530 static int x509_parse_time( unsigned char **p, size_t len, size_t yearlen,
Jasper Wallace 1:9ebc941037d5 531 mbedtls_x509_time *time )
Jasper Wallace 1:9ebc941037d5 532 {
Jasper Wallace 1:9ebc941037d5 533 int ret;
Jasper Wallace 1:9ebc941037d5 534
Jasper Wallace 1:9ebc941037d5 535 /*
Jasper Wallace 1:9ebc941037d5 536 * Minimum length is 10 or 12 depending on yearlen
Jasper Wallace 1:9ebc941037d5 537 */
Jasper Wallace 1:9ebc941037d5 538 if ( len < yearlen + 8 )
Jasper Wallace 1:9ebc941037d5 539 return ( MBEDTLS_ERR_X509_INVALID_DATE );
Jasper Wallace 1:9ebc941037d5 540 len -= yearlen + 8;
Jasper Wallace 1:9ebc941037d5 541
Jasper Wallace 1:9ebc941037d5 542 /*
Jasper Wallace 1:9ebc941037d5 543 * Parse year, month, day, hour, minute
Jasper Wallace 1:9ebc941037d5 544 */
Jasper Wallace 1:9ebc941037d5 545 CHECK( x509_parse_int( p, yearlen, &time->year ) );
Jasper Wallace 1:9ebc941037d5 546 if ( 2 == yearlen )
Jasper Wallace 1:9ebc941037d5 547 {
Jasper Wallace 1:9ebc941037d5 548 if ( time->year < 50 )
Jasper Wallace 1:9ebc941037d5 549 time->year += 100;
Jasper Wallace 1:9ebc941037d5 550
Jasper Wallace 1:9ebc941037d5 551 time->year += 1900;
Jasper Wallace 1:9ebc941037d5 552 }
Jasper Wallace 1:9ebc941037d5 553
Jasper Wallace 1:9ebc941037d5 554 CHECK( x509_parse_int( p, 2, &time->mon ) );
Jasper Wallace 1:9ebc941037d5 555 CHECK( x509_parse_int( p, 2, &time->day ) );
Jasper Wallace 1:9ebc941037d5 556 CHECK( x509_parse_int( p, 2, &time->hour ) );
Jasper Wallace 1:9ebc941037d5 557 CHECK( x509_parse_int( p, 2, &time->min ) );
Jasper Wallace 1:9ebc941037d5 558
Jasper Wallace 1:9ebc941037d5 559 /*
Jasper Wallace 1:9ebc941037d5 560 * Parse seconds if present
Jasper Wallace 1:9ebc941037d5 561 */
Jasper Wallace 1:9ebc941037d5 562 if ( len >= 2 )
Jasper Wallace 1:9ebc941037d5 563 {
Jasper Wallace 1:9ebc941037d5 564 CHECK( x509_parse_int( p, 2, &time->sec ) );
Jasper Wallace 1:9ebc941037d5 565 len -= 2;
Jasper Wallace 1:9ebc941037d5 566 }
Jasper Wallace 1:9ebc941037d5 567 else
Jasper Wallace 1:9ebc941037d5 568 return ( MBEDTLS_ERR_X509_INVALID_DATE );
Jasper Wallace 1:9ebc941037d5 569
Jasper Wallace 1:9ebc941037d5 570 /*
Jasper Wallace 1:9ebc941037d5 571 * Parse trailing 'Z' if present
Jasper Wallace 1:9ebc941037d5 572 */
Jasper Wallace 1:9ebc941037d5 573 if ( 1 == len && 'Z' == **p )
Jasper Wallace 1:9ebc941037d5 574 {
Jasper Wallace 1:9ebc941037d5 575 (*p)++;
Jasper Wallace 1:9ebc941037d5 576 len--;
Jasper Wallace 1:9ebc941037d5 577 }
Jasper Wallace 1:9ebc941037d5 578
Jasper Wallace 1:9ebc941037d5 579 /*
Jasper Wallace 1:9ebc941037d5 580 * We should have parsed all characters at this point
Jasper Wallace 1:9ebc941037d5 581 */
Jasper Wallace 1:9ebc941037d5 582 if ( 0 != len )
Jasper Wallace 1:9ebc941037d5 583 return ( MBEDTLS_ERR_X509_INVALID_DATE );
Jasper Wallace 1:9ebc941037d5 584
Jasper Wallace 1:9ebc941037d5 585 CHECK( x509_date_is_valid( time ) );
Jasper Wallace 1:9ebc941037d5 586
Jasper Wallace 1:9ebc941037d5 587 return ( 0 );
Jasper Wallace 1:9ebc941037d5 588 }
Jasper Wallace 1:9ebc941037d5 589
Jasper Wallace 1:9ebc941037d5 590 /*
markrad 0:cdf462088d13 591 * Time ::= CHOICE {
markrad 0:cdf462088d13 592 * utcTime UTCTime,
markrad 0:cdf462088d13 593 * generalTime GeneralizedTime }
markrad 0:cdf462088d13 594 */
markrad 0:cdf462088d13 595 int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 596 mbedtls_x509_time *time )
markrad 0:cdf462088d13 597 {
markrad 0:cdf462088d13 598 int ret;
Jasper Wallace 1:9ebc941037d5 599 size_t len, year_len;
markrad 0:cdf462088d13 600 unsigned char tag;
markrad 0:cdf462088d13 601
markrad 0:cdf462088d13 602 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 603 return( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 604 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 605
markrad 0:cdf462088d13 606 tag = **p;
markrad 0:cdf462088d13 607
markrad 0:cdf462088d13 608 if( tag == MBEDTLS_ASN1_UTC_TIME )
Jasper Wallace 1:9ebc941037d5 609 year_len = 2;
markrad 0:cdf462088d13 610 else if( tag == MBEDTLS_ASN1_GENERALIZED_TIME )
Jasper Wallace 1:9ebc941037d5 611 year_len = 4;
markrad 0:cdf462088d13 612 else
markrad 0:cdf462088d13 613 return( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 614 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
Jasper Wallace 1:9ebc941037d5 615
Jasper Wallace 1:9ebc941037d5 616 (*p)++;
Jasper Wallace 1:9ebc941037d5 617 ret = mbedtls_asn1_get_len( p, end, &len );
Jasper Wallace 1:9ebc941037d5 618
Jasper Wallace 1:9ebc941037d5 619 if( ret != 0 )
Jasper Wallace 1:9ebc941037d5 620 return( MBEDTLS_ERR_X509_INVALID_DATE + ret );
Jasper Wallace 1:9ebc941037d5 621
Jasper Wallace 1:9ebc941037d5 622 return x509_parse_time( p, len, year_len, time );
markrad 0:cdf462088d13 623 }
markrad 0:cdf462088d13 624
markrad 0:cdf462088d13 625 int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig )
markrad 0:cdf462088d13 626 {
markrad 0:cdf462088d13 627 int ret;
markrad 0:cdf462088d13 628 size_t len;
markrad 0:cdf462088d13 629 int tag_type;
markrad 0:cdf462088d13 630
markrad 0:cdf462088d13 631 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 632 return( MBEDTLS_ERR_X509_INVALID_SIGNATURE +
markrad 0:cdf462088d13 633 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 634
markrad 0:cdf462088d13 635 tag_type = **p;
markrad 0:cdf462088d13 636
markrad 0:cdf462088d13 637 if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
markrad 0:cdf462088d13 638 return( MBEDTLS_ERR_X509_INVALID_SIGNATURE + ret );
markrad 0:cdf462088d13 639
markrad 0:cdf462088d13 640 sig->tag = tag_type;
markrad 0:cdf462088d13 641 sig->len = len;
markrad 0:cdf462088d13 642 sig->p = *p;
markrad 0:cdf462088d13 643
markrad 0:cdf462088d13 644 *p += len;
markrad 0:cdf462088d13 645
markrad 0:cdf462088d13 646 return( 0 );
markrad 0:cdf462088d13 647 }
markrad 0:cdf462088d13 648
markrad 0:cdf462088d13 649 /*
markrad 0:cdf462088d13 650 * Get signature algorithm from alg OID and optional parameters
markrad 0:cdf462088d13 651 */
markrad 0:cdf462088d13 652 int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params,
markrad 0:cdf462088d13 653 mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg,
markrad 0:cdf462088d13 654 void **sig_opts )
markrad 0:cdf462088d13 655 {
markrad 0:cdf462088d13 656 int ret;
markrad 0:cdf462088d13 657
markrad 0:cdf462088d13 658 if( *sig_opts != NULL )
markrad 0:cdf462088d13 659 return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
markrad 0:cdf462088d13 660
markrad 0:cdf462088d13 661 if( ( ret = mbedtls_oid_get_sig_alg( sig_oid, md_alg, pk_alg ) ) != 0 )
markrad 0:cdf462088d13 662 return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + ret );
markrad 0:cdf462088d13 663
markrad 0:cdf462088d13 664 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 665 if( *pk_alg == MBEDTLS_PK_RSASSA_PSS )
markrad 0:cdf462088d13 666 {
markrad 0:cdf462088d13 667 mbedtls_pk_rsassa_pss_options *pss_opts;
markrad 0:cdf462088d13 668
markrad 0:cdf462088d13 669 pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
markrad 0:cdf462088d13 670 if( pss_opts == NULL )
markrad 0:cdf462088d13 671 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 672
markrad 0:cdf462088d13 673 ret = mbedtls_x509_get_rsassa_pss_params( sig_params,
markrad 0:cdf462088d13 674 md_alg,
markrad 0:cdf462088d13 675 &pss_opts->mgf1_hash_id,
markrad 0:cdf462088d13 676 &pss_opts->expected_salt_len );
markrad 0:cdf462088d13 677 if( ret != 0 )
markrad 0:cdf462088d13 678 {
markrad 0:cdf462088d13 679 mbedtls_free( pss_opts );
markrad 0:cdf462088d13 680 return( ret );
markrad 0:cdf462088d13 681 }
markrad 0:cdf462088d13 682
markrad 0:cdf462088d13 683 *sig_opts = (void *) pss_opts;
markrad 0:cdf462088d13 684 }
markrad 0:cdf462088d13 685 else
markrad 0:cdf462088d13 686 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 687 {
markrad 0:cdf462088d13 688 /* Make sure parameters are absent or NULL */
markrad 0:cdf462088d13 689 if( ( sig_params->tag != MBEDTLS_ASN1_NULL && sig_params->tag != 0 ) ||
markrad 0:cdf462088d13 690 sig_params->len != 0 )
markrad 0:cdf462088d13 691 return( MBEDTLS_ERR_X509_INVALID_ALG );
markrad 0:cdf462088d13 692 }
markrad 0:cdf462088d13 693
markrad 0:cdf462088d13 694 return( 0 );
markrad 0:cdf462088d13 695 }
markrad 0:cdf462088d13 696
markrad 0:cdf462088d13 697 /*
markrad 0:cdf462088d13 698 * X.509 Extensions (No parsing of extensions, pointer should
markrad 0:cdf462088d13 699 * be either manually updated or extensions should be parsed!)
markrad 0:cdf462088d13 700 */
markrad 0:cdf462088d13 701 int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 702 mbedtls_x509_buf *ext, int tag )
markrad 0:cdf462088d13 703 {
markrad 0:cdf462088d13 704 int ret;
markrad 0:cdf462088d13 705 size_t len;
markrad 0:cdf462088d13 706
markrad 0:cdf462088d13 707 if( *p == end )
markrad 0:cdf462088d13 708 return( 0 );
markrad 0:cdf462088d13 709
markrad 0:cdf462088d13 710 ext->tag = **p;
markrad 0:cdf462088d13 711
markrad 0:cdf462088d13 712 if( ( ret = mbedtls_asn1_get_tag( p, end, &ext->len,
markrad 0:cdf462088d13 713 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag ) ) != 0 )
markrad 0:cdf462088d13 714 return( ret );
markrad 0:cdf462088d13 715
markrad 0:cdf462088d13 716 ext->p = *p;
markrad 0:cdf462088d13 717 end = *p + ext->len;
markrad 0:cdf462088d13 718
markrad 0:cdf462088d13 719 /*
markrad 0:cdf462088d13 720 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
markrad 0:cdf462088d13 721 *
markrad 0:cdf462088d13 722 * Extension ::= SEQUENCE {
markrad 0:cdf462088d13 723 * extnID OBJECT IDENTIFIER,
markrad 0:cdf462088d13 724 * critical BOOLEAN DEFAULT FALSE,
markrad 0:cdf462088d13 725 * extnValue OCTET STRING }
markrad 0:cdf462088d13 726 */
markrad 0:cdf462088d13 727 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 728 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 729 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
markrad 0:cdf462088d13 730
markrad 0:cdf462088d13 731 if( end != *p + len )
markrad 0:cdf462088d13 732 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
markrad 0:cdf462088d13 733 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 734
markrad 0:cdf462088d13 735 return( 0 );
markrad 0:cdf462088d13 736 }
markrad 0:cdf462088d13 737
markrad 0:cdf462088d13 738 /*
markrad 0:cdf462088d13 739 * Store the name in printable form into buf; no more
markrad 0:cdf462088d13 740 * than size characters will be written
markrad 0:cdf462088d13 741 */
markrad 0:cdf462088d13 742 int mbedtls_x509_dn_gets( char *buf, size_t size, const mbedtls_x509_name *dn )
markrad 0:cdf462088d13 743 {
markrad 0:cdf462088d13 744 int ret;
markrad 0:cdf462088d13 745 size_t i, n;
markrad 0:cdf462088d13 746 unsigned char c, merge = 0;
markrad 0:cdf462088d13 747 const mbedtls_x509_name *name;
markrad 0:cdf462088d13 748 const char *short_name = NULL;
markrad 0:cdf462088d13 749 char s[MBEDTLS_X509_MAX_DN_NAME_SIZE], *p;
markrad 0:cdf462088d13 750
markrad 0:cdf462088d13 751 memset( s, 0, sizeof( s ) );
markrad 0:cdf462088d13 752
markrad 0:cdf462088d13 753 name = dn;
markrad 0:cdf462088d13 754 p = buf;
markrad 0:cdf462088d13 755 n = size;
markrad 0:cdf462088d13 756
markrad 0:cdf462088d13 757 while( name != NULL )
markrad 0:cdf462088d13 758 {
markrad 0:cdf462088d13 759 if( !name->oid.p )
markrad 0:cdf462088d13 760 {
markrad 0:cdf462088d13 761 name = name->next;
markrad 0:cdf462088d13 762 continue;
markrad 0:cdf462088d13 763 }
markrad 0:cdf462088d13 764
markrad 0:cdf462088d13 765 if( name != dn )
markrad 0:cdf462088d13 766 {
markrad 0:cdf462088d13 767 ret = mbedtls_snprintf( p, n, merge ? " + " : ", " );
markrad 0:cdf462088d13 768 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 769 }
markrad 0:cdf462088d13 770
markrad 0:cdf462088d13 771 ret = mbedtls_oid_get_attr_short_name( &name->oid, &short_name );
markrad 0:cdf462088d13 772
markrad 0:cdf462088d13 773 if( ret == 0 )
markrad 0:cdf462088d13 774 ret = mbedtls_snprintf( p, n, "%s=", short_name );
markrad 0:cdf462088d13 775 else
markrad 0:cdf462088d13 776 ret = mbedtls_snprintf( p, n, "\?\?=" );
markrad 0:cdf462088d13 777 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 778
markrad 0:cdf462088d13 779 for( i = 0; i < name->val.len; i++ )
markrad 0:cdf462088d13 780 {
markrad 0:cdf462088d13 781 if( i >= sizeof( s ) - 1 )
markrad 0:cdf462088d13 782 break;
markrad 0:cdf462088d13 783
markrad 0:cdf462088d13 784 c = name->val.p[i];
markrad 0:cdf462088d13 785 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
markrad 0:cdf462088d13 786 s[i] = '?';
markrad 0:cdf462088d13 787 else s[i] = c;
markrad 0:cdf462088d13 788 }
markrad 0:cdf462088d13 789 s[i] = '\0';
markrad 0:cdf462088d13 790 ret = mbedtls_snprintf( p, n, "%s", s );
markrad 0:cdf462088d13 791 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 792
markrad 0:cdf462088d13 793 merge = name->next_merged;
markrad 0:cdf462088d13 794 name = name->next;
markrad 0:cdf462088d13 795 }
markrad 0:cdf462088d13 796
markrad 0:cdf462088d13 797 return( (int) ( size - n ) );
markrad 0:cdf462088d13 798 }
markrad 0:cdf462088d13 799
markrad 0:cdf462088d13 800 /*
markrad 0:cdf462088d13 801 * Store the serial in printable form into buf; no more
markrad 0:cdf462088d13 802 * than size characters will be written
markrad 0:cdf462088d13 803 */
markrad 0:cdf462088d13 804 int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *serial )
markrad 0:cdf462088d13 805 {
markrad 0:cdf462088d13 806 int ret;
markrad 0:cdf462088d13 807 size_t i, n, nr;
markrad 0:cdf462088d13 808 char *p;
markrad 0:cdf462088d13 809
markrad 0:cdf462088d13 810 p = buf;
markrad 0:cdf462088d13 811 n = size;
markrad 0:cdf462088d13 812
markrad 0:cdf462088d13 813 nr = ( serial->len <= 32 )
markrad 0:cdf462088d13 814 ? serial->len : 28;
markrad 0:cdf462088d13 815
markrad 0:cdf462088d13 816 for( i = 0; i < nr; i++ )
markrad 0:cdf462088d13 817 {
markrad 0:cdf462088d13 818 if( i == 0 && nr > 1 && serial->p[i] == 0x0 )
markrad 0:cdf462088d13 819 continue;
markrad 0:cdf462088d13 820
markrad 0:cdf462088d13 821 ret = mbedtls_snprintf( p, n, "%02X%s",
markrad 0:cdf462088d13 822 serial->p[i], ( i < nr - 1 ) ? ":" : "" );
markrad 0:cdf462088d13 823 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 824 }
markrad 0:cdf462088d13 825
markrad 0:cdf462088d13 826 if( nr != serial->len )
markrad 0:cdf462088d13 827 {
markrad 0:cdf462088d13 828 ret = mbedtls_snprintf( p, n, "...." );
markrad 0:cdf462088d13 829 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 830 }
markrad 0:cdf462088d13 831
markrad 0:cdf462088d13 832 return( (int) ( size - n ) );
markrad 0:cdf462088d13 833 }
markrad 0:cdf462088d13 834
markrad 0:cdf462088d13 835 /*
markrad 0:cdf462088d13 836 * Helper for writing signature algorithms
markrad 0:cdf462088d13 837 */
markrad 0:cdf462088d13 838 int mbedtls_x509_sig_alg_gets( char *buf, size_t size, const mbedtls_x509_buf *sig_oid,
markrad 0:cdf462088d13 839 mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg,
markrad 0:cdf462088d13 840 const void *sig_opts )
markrad 0:cdf462088d13 841 {
markrad 0:cdf462088d13 842 int ret;
markrad 0:cdf462088d13 843 char *p = buf;
markrad 0:cdf462088d13 844 size_t n = size;
markrad 0:cdf462088d13 845 const char *desc = NULL;
markrad 0:cdf462088d13 846
markrad 0:cdf462088d13 847 ret = mbedtls_oid_get_sig_alg_desc( sig_oid, &desc );
markrad 0:cdf462088d13 848 if( ret != 0 )
markrad 0:cdf462088d13 849 ret = mbedtls_snprintf( p, n, "???" );
markrad 0:cdf462088d13 850 else
markrad 0:cdf462088d13 851 ret = mbedtls_snprintf( p, n, "%s", desc );
markrad 0:cdf462088d13 852 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 853
markrad 0:cdf462088d13 854 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 855 if( pk_alg == MBEDTLS_PK_RSASSA_PSS )
markrad 0:cdf462088d13 856 {
markrad 0:cdf462088d13 857 const mbedtls_pk_rsassa_pss_options *pss_opts;
markrad 0:cdf462088d13 858 const mbedtls_md_info_t *md_info, *mgf_md_info;
markrad 0:cdf462088d13 859
markrad 0:cdf462088d13 860 pss_opts = (const mbedtls_pk_rsassa_pss_options *) sig_opts;
markrad 0:cdf462088d13 861
markrad 0:cdf462088d13 862 md_info = mbedtls_md_info_from_type( md_alg );
markrad 0:cdf462088d13 863 mgf_md_info = mbedtls_md_info_from_type( pss_opts->mgf1_hash_id );
markrad 0:cdf462088d13 864
markrad 0:cdf462088d13 865 ret = mbedtls_snprintf( p, n, " (%s, MGF1-%s, 0x%02X)",
markrad 0:cdf462088d13 866 md_info ? mbedtls_md_get_name( md_info ) : "???",
markrad 0:cdf462088d13 867 mgf_md_info ? mbedtls_md_get_name( mgf_md_info ) : "???",
markrad 0:cdf462088d13 868 pss_opts->expected_salt_len );
markrad 0:cdf462088d13 869 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 870 }
markrad 0:cdf462088d13 871 #else
markrad 0:cdf462088d13 872 ((void) pk_alg);
markrad 0:cdf462088d13 873 ((void) md_alg);
markrad 0:cdf462088d13 874 ((void) sig_opts);
markrad 0:cdf462088d13 875 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 876
markrad 0:cdf462088d13 877 return( (int)( size - n ) );
markrad 0:cdf462088d13 878 }
markrad 0:cdf462088d13 879
markrad 0:cdf462088d13 880 /*
markrad 0:cdf462088d13 881 * Helper for writing "RSA key size", "EC key size", etc
markrad 0:cdf462088d13 882 */
markrad 0:cdf462088d13 883 int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name )
markrad 0:cdf462088d13 884 {
markrad 0:cdf462088d13 885 char *p = buf;
markrad 0:cdf462088d13 886 size_t n = buf_size;
markrad 0:cdf462088d13 887 int ret;
markrad 0:cdf462088d13 888
markrad 0:cdf462088d13 889 ret = mbedtls_snprintf( p, n, "%s key size", name );
markrad 0:cdf462088d13 890 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 891
markrad 0:cdf462088d13 892 return( 0 );
markrad 0:cdf462088d13 893 }
markrad 0:cdf462088d13 894
markrad 0:cdf462088d13 895 #if defined(MBEDTLS_HAVE_TIME_DATE)
markrad 0:cdf462088d13 896 /*
markrad 0:cdf462088d13 897 * Set the time structure to the current time.
markrad 0:cdf462088d13 898 * Return 0 on success, non-zero on failure.
markrad 0:cdf462088d13 899 */
markrad 0:cdf462088d13 900 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
markrad 0:cdf462088d13 901 static int x509_get_current_time( mbedtls_x509_time *now )
markrad 0:cdf462088d13 902 {
markrad 0:cdf462088d13 903 SYSTEMTIME st;
markrad 0:cdf462088d13 904
markrad 0:cdf462088d13 905 GetSystemTime( &st );
markrad 0:cdf462088d13 906
markrad 0:cdf462088d13 907 now->year = st.wYear;
markrad 0:cdf462088d13 908 now->mon = st.wMonth;
markrad 0:cdf462088d13 909 now->day = st.wDay;
markrad 0:cdf462088d13 910 now->hour = st.wHour;
markrad 0:cdf462088d13 911 now->min = st.wMinute;
markrad 0:cdf462088d13 912 now->sec = st.wSecond;
markrad 0:cdf462088d13 913
markrad 0:cdf462088d13 914 return( 0 );
markrad 0:cdf462088d13 915 }
markrad 0:cdf462088d13 916 #else
markrad 0:cdf462088d13 917 static int x509_get_current_time( mbedtls_x509_time *now )
markrad 0:cdf462088d13 918 {
markrad 0:cdf462088d13 919 struct tm *lt;
markrad 0:cdf462088d13 920 mbedtls_time_t tt;
markrad 0:cdf462088d13 921 int ret = 0;
markrad 0:cdf462088d13 922
markrad 0:cdf462088d13 923 #if defined(MBEDTLS_THREADING_C)
markrad 0:cdf462088d13 924 if( mbedtls_mutex_lock( &mbedtls_threading_gmtime_mutex ) != 0 )
markrad 0:cdf462088d13 925 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
markrad 0:cdf462088d13 926 #endif
markrad 0:cdf462088d13 927
markrad 0:cdf462088d13 928 tt = mbedtls_time( NULL );
markrad 0:cdf462088d13 929 lt = gmtime( &tt );
markrad 0:cdf462088d13 930
markrad 0:cdf462088d13 931 if( lt == NULL )
markrad 0:cdf462088d13 932 ret = -1;
markrad 0:cdf462088d13 933 else
markrad 0:cdf462088d13 934 {
markrad 0:cdf462088d13 935 now->year = lt->tm_year + 1900;
markrad 0:cdf462088d13 936 now->mon = lt->tm_mon + 1;
markrad 0:cdf462088d13 937 now->day = lt->tm_mday;
markrad 0:cdf462088d13 938 now->hour = lt->tm_hour;
markrad 0:cdf462088d13 939 now->min = lt->tm_min;
markrad 0:cdf462088d13 940 now->sec = lt->tm_sec;
markrad 0:cdf462088d13 941 }
markrad 0:cdf462088d13 942
markrad 0:cdf462088d13 943 #if defined(MBEDTLS_THREADING_C)
markrad 0:cdf462088d13 944 if( mbedtls_mutex_unlock( &mbedtls_threading_gmtime_mutex ) != 0 )
markrad 0:cdf462088d13 945 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
markrad 0:cdf462088d13 946 #endif
markrad 0:cdf462088d13 947
markrad 0:cdf462088d13 948 return( ret );
markrad 0:cdf462088d13 949 }
markrad 0:cdf462088d13 950 #endif /* _WIN32 && !EFIX64 && !EFI32 */
markrad 0:cdf462088d13 951
markrad 0:cdf462088d13 952 /*
markrad 0:cdf462088d13 953 * Return 0 if before <= after, 1 otherwise
markrad 0:cdf462088d13 954 */
markrad 0:cdf462088d13 955 static int x509_check_time( const mbedtls_x509_time *before, const mbedtls_x509_time *after )
markrad 0:cdf462088d13 956 {
markrad 0:cdf462088d13 957 if( before->year > after->year )
markrad 0:cdf462088d13 958 return( 1 );
markrad 0:cdf462088d13 959
markrad 0:cdf462088d13 960 if( before->year == after->year &&
markrad 0:cdf462088d13 961 before->mon > after->mon )
markrad 0:cdf462088d13 962 return( 1 );
markrad 0:cdf462088d13 963
markrad 0:cdf462088d13 964 if( before->year == after->year &&
markrad 0:cdf462088d13 965 before->mon == after->mon &&
markrad 0:cdf462088d13 966 before->day > after->day )
markrad 0:cdf462088d13 967 return( 1 );
markrad 0:cdf462088d13 968
markrad 0:cdf462088d13 969 if( before->year == after->year &&
markrad 0:cdf462088d13 970 before->mon == after->mon &&
markrad 0:cdf462088d13 971 before->day == after->day &&
markrad 0:cdf462088d13 972 before->hour > after->hour )
markrad 0:cdf462088d13 973 return( 1 );
markrad 0:cdf462088d13 974
markrad 0:cdf462088d13 975 if( before->year == after->year &&
markrad 0:cdf462088d13 976 before->mon == after->mon &&
markrad 0:cdf462088d13 977 before->day == after->day &&
markrad 0:cdf462088d13 978 before->hour == after->hour &&
markrad 0:cdf462088d13 979 before->min > after->min )
markrad 0:cdf462088d13 980 return( 1 );
markrad 0:cdf462088d13 981
markrad 0:cdf462088d13 982 if( before->year == after->year &&
markrad 0:cdf462088d13 983 before->mon == after->mon &&
markrad 0:cdf462088d13 984 before->day == after->day &&
markrad 0:cdf462088d13 985 before->hour == after->hour &&
markrad 0:cdf462088d13 986 before->min == after->min &&
markrad 0:cdf462088d13 987 before->sec > after->sec )
markrad 0:cdf462088d13 988 return( 1 );
markrad 0:cdf462088d13 989
markrad 0:cdf462088d13 990 return( 0 );
markrad 0:cdf462088d13 991 }
markrad 0:cdf462088d13 992
markrad 0:cdf462088d13 993 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
markrad 0:cdf462088d13 994 {
markrad 0:cdf462088d13 995 mbedtls_x509_time now;
markrad 0:cdf462088d13 996
markrad 0:cdf462088d13 997 if( x509_get_current_time( &now ) != 0 )
markrad 0:cdf462088d13 998 return( 1 );
markrad 0:cdf462088d13 999
markrad 0:cdf462088d13 1000 return( x509_check_time( &now, to ) );
markrad 0:cdf462088d13 1001 }
markrad 0:cdf462088d13 1002
markrad 0:cdf462088d13 1003 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
markrad 0:cdf462088d13 1004 {
markrad 0:cdf462088d13 1005 mbedtls_x509_time now;
markrad 0:cdf462088d13 1006
markrad 0:cdf462088d13 1007 if( x509_get_current_time( &now ) != 0 )
markrad 0:cdf462088d13 1008 return( 1 );
markrad 0:cdf462088d13 1009
markrad 0:cdf462088d13 1010 return( x509_check_time( from, &now ) );
markrad 0:cdf462088d13 1011 }
markrad 0:cdf462088d13 1012
markrad 0:cdf462088d13 1013 #else /* MBEDTLS_HAVE_TIME_DATE */
markrad 0:cdf462088d13 1014
markrad 0:cdf462088d13 1015 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
markrad 0:cdf462088d13 1016 {
markrad 0:cdf462088d13 1017 ((void) to);
markrad 0:cdf462088d13 1018 return( 0 );
markrad 0:cdf462088d13 1019 }
markrad 0:cdf462088d13 1020
markrad 0:cdf462088d13 1021 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
markrad 0:cdf462088d13 1022 {
markrad 0:cdf462088d13 1023 ((void) from);
markrad 0:cdf462088d13 1024 return( 0 );
markrad 0:cdf462088d13 1025 }
markrad 0:cdf462088d13 1026 #endif /* MBEDTLS_HAVE_TIME_DATE */
markrad 0:cdf462088d13 1027
markrad 0:cdf462088d13 1028 #if defined(MBEDTLS_SELF_TEST)
markrad 0:cdf462088d13 1029
markrad 0:cdf462088d13 1030 #include "mbedtls/x509_crt.h"
markrad 0:cdf462088d13 1031 #include "mbedtls/certs.h"
markrad 0:cdf462088d13 1032
markrad 0:cdf462088d13 1033 /*
markrad 0:cdf462088d13 1034 * Checkup routine
markrad 0:cdf462088d13 1035 */
markrad 0:cdf462088d13 1036 int mbedtls_x509_self_test( int verbose )
markrad 0:cdf462088d13 1037 {
markrad 0:cdf462088d13 1038 #if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_SHA1_C)
markrad 0:cdf462088d13 1039 int ret;
markrad 0:cdf462088d13 1040 uint32_t flags;
markrad 0:cdf462088d13 1041 mbedtls_x509_crt cacert;
markrad 0:cdf462088d13 1042 mbedtls_x509_crt clicert;
markrad 0:cdf462088d13 1043
markrad 0:cdf462088d13 1044 if( verbose != 0 )
markrad 0:cdf462088d13 1045 mbedtls_printf( " X.509 certificate load: " );
markrad 0:cdf462088d13 1046
markrad 0:cdf462088d13 1047 mbedtls_x509_crt_init( &clicert );
markrad 0:cdf462088d13 1048
markrad 0:cdf462088d13 1049 ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt,
markrad 0:cdf462088d13 1050 mbedtls_test_cli_crt_len );
markrad 0:cdf462088d13 1051 if( ret != 0 )
markrad 0:cdf462088d13 1052 {
markrad 0:cdf462088d13 1053 if( verbose != 0 )
markrad 0:cdf462088d13 1054 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1055
markrad 0:cdf462088d13 1056 return( ret );
markrad 0:cdf462088d13 1057 }
markrad 0:cdf462088d13 1058
markrad 0:cdf462088d13 1059 mbedtls_x509_crt_init( &cacert );
markrad 0:cdf462088d13 1060
markrad 0:cdf462088d13 1061 ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_ca_crt,
markrad 0:cdf462088d13 1062 mbedtls_test_ca_crt_len );
markrad 0:cdf462088d13 1063 if( ret != 0 )
markrad 0:cdf462088d13 1064 {
markrad 0:cdf462088d13 1065 if( verbose != 0 )
markrad 0:cdf462088d13 1066 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1067
markrad 0:cdf462088d13 1068 return( ret );
markrad 0:cdf462088d13 1069 }
markrad 0:cdf462088d13 1070
markrad 0:cdf462088d13 1071 if( verbose != 0 )
markrad 0:cdf462088d13 1072 mbedtls_printf( "passed\n X.509 signature verify: ");
markrad 0:cdf462088d13 1073
markrad 0:cdf462088d13 1074 ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
markrad 0:cdf462088d13 1075 if( ret != 0 )
markrad 0:cdf462088d13 1076 {
markrad 0:cdf462088d13 1077 if( verbose != 0 )
markrad 0:cdf462088d13 1078 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1079
markrad 0:cdf462088d13 1080 return( ret );
markrad 0:cdf462088d13 1081 }
markrad 0:cdf462088d13 1082
markrad 0:cdf462088d13 1083 if( verbose != 0 )
markrad 0:cdf462088d13 1084 mbedtls_printf( "passed\n\n");
markrad 0:cdf462088d13 1085
markrad 0:cdf462088d13 1086 mbedtls_x509_crt_free( &cacert );
markrad 0:cdf462088d13 1087 mbedtls_x509_crt_free( &clicert );
markrad 0:cdf462088d13 1088
markrad 0:cdf462088d13 1089 return( 0 );
markrad 0:cdf462088d13 1090 #else
markrad 0:cdf462088d13 1091 ((void) verbose);
markrad 0:cdf462088d13 1092 return( 0 );
markrad 0:cdf462088d13 1093 #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
markrad 0:cdf462088d13 1094 }
markrad 0:cdf462088d13 1095
markrad 0:cdf462088d13 1096 #endif /* MBEDTLS_SELF_TEST */
markrad 0:cdf462088d13 1097
markrad 0:cdf462088d13 1098 #endif /* MBEDTLS_X509_USE_C */