BA / SerialCom

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Fork of OmniWheels by Gustav Atmel

mbed-os/features/mbedtls/src/x509write_csr.c@1:9c5af431a1f1, 2018-05-01 (annotated)

Committer:
gustavatmel
Date:
Tue May 01 15:47:08 2018 +0000
Revision:
1:9c5af431a1f1
sdf

Who changed what in which revision?

UserRevisionLine numberNew contents of line
gustavatmel 1:9c5af431a1f1 1 /*
gustavatmel 1:9c5af431a1f1 2 * X.509 Certificate Signing Request writing
gustavatmel 1:9c5af431a1f1 3 *
gustavatmel 1:9c5af431a1f1 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
gustavatmel 1:9c5af431a1f1 5 * SPDX-License-Identifier: Apache-2.0
gustavatmel 1:9c5af431a1f1 6 *
gustavatmel 1:9c5af431a1f1 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
gustavatmel 1:9c5af431a1f1 8 * not use this file except in compliance with the License.
gustavatmel 1:9c5af431a1f1 9 * You may obtain a copy of the License at
gustavatmel 1:9c5af431a1f1 10 *
gustavatmel 1:9c5af431a1f1 11 * http://www.apache.org/licenses/LICENSE-2.0
gustavatmel 1:9c5af431a1f1 12 *
gustavatmel 1:9c5af431a1f1 13 * Unless required by applicable law or agreed to in writing, software
gustavatmel 1:9c5af431a1f1 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
gustavatmel 1:9c5af431a1f1 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
gustavatmel 1:9c5af431a1f1 16 * See the License for the specific language governing permissions and
gustavatmel 1:9c5af431a1f1 17 * limitations under the License.
gustavatmel 1:9c5af431a1f1 18 *
gustavatmel 1:9c5af431a1f1 19 * This file is part of mbed TLS (https://tls.mbed.org)
gustavatmel 1:9c5af431a1f1 20 */
gustavatmel 1:9c5af431a1f1 21 /*
gustavatmel 1:9c5af431a1f1 22 * References:
gustavatmel 1:9c5af431a1f1 23 * - CSRs: PKCS#10 v1.7 aka RFC 2986
gustavatmel 1:9c5af431a1f1 24 * - attributes: PKCS#9 v2.0 aka RFC 2985
gustavatmel 1:9c5af431a1f1 25 */
gustavatmel 1:9c5af431a1f1 26
gustavatmel 1:9c5af431a1f1 27 #if !defined(MBEDTLS_CONFIG_FILE)
gustavatmel 1:9c5af431a1f1 28 #include "mbedtls/config.h"
gustavatmel 1:9c5af431a1f1 29 #else
gustavatmel 1:9c5af431a1f1 30 #include MBEDTLS_CONFIG_FILE
gustavatmel 1:9c5af431a1f1 31 #endif
gustavatmel 1:9c5af431a1f1 32
gustavatmel 1:9c5af431a1f1 33 #if defined(MBEDTLS_X509_CSR_WRITE_C)
gustavatmel 1:9c5af431a1f1 34
gustavatmel 1:9c5af431a1f1 35 #include "mbedtls/x509_csr.h"
gustavatmel 1:9c5af431a1f1 36 #include "mbedtls/oid.h"
gustavatmel 1:9c5af431a1f1 37 #include "mbedtls/asn1write.h"
gustavatmel 1:9c5af431a1f1 38
gustavatmel 1:9c5af431a1f1 39 #include <string.h>
gustavatmel 1:9c5af431a1f1 40 #include <stdlib.h>
gustavatmel 1:9c5af431a1f1 41
gustavatmel 1:9c5af431a1f1 42 #if defined(MBEDTLS_PEM_WRITE_C)
gustavatmel 1:9c5af431a1f1 43 #include "mbedtls/pem.h"
gustavatmel 1:9c5af431a1f1 44 #endif
gustavatmel 1:9c5af431a1f1 45
gustavatmel 1:9c5af431a1f1 46 /* Implementation that should never be optimized out by the compiler */
gustavatmel 1:9c5af431a1f1 47 static void mbedtls_zeroize( void *v, size_t n ) {
gustavatmel 1:9c5af431a1f1 48 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
gustavatmel 1:9c5af431a1f1 49 }
gustavatmel 1:9c5af431a1f1 50
gustavatmel 1:9c5af431a1f1 51 void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
gustavatmel 1:9c5af431a1f1 52 {
gustavatmel 1:9c5af431a1f1 53 memset( ctx, 0, sizeof( mbedtls_x509write_csr ) );
gustavatmel 1:9c5af431a1f1 54 }
gustavatmel 1:9c5af431a1f1 55
gustavatmel 1:9c5af431a1f1 56 void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
gustavatmel 1:9c5af431a1f1 57 {
gustavatmel 1:9c5af431a1f1 58 mbedtls_asn1_free_named_data_list( &ctx->subject );
gustavatmel 1:9c5af431a1f1 59 mbedtls_asn1_free_named_data_list( &ctx->extensions );
gustavatmel 1:9c5af431a1f1 60
gustavatmel 1:9c5af431a1f1 61 mbedtls_zeroize( ctx, sizeof( mbedtls_x509write_csr ) );
gustavatmel 1:9c5af431a1f1 62 }
gustavatmel 1:9c5af431a1f1 63
gustavatmel 1:9c5af431a1f1 64 void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
gustavatmel 1:9c5af431a1f1 65 {
gustavatmel 1:9c5af431a1f1 66 ctx->md_alg = md_alg;
gustavatmel 1:9c5af431a1f1 67 }
gustavatmel 1:9c5af431a1f1 68
gustavatmel 1:9c5af431a1f1 69 void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key )
gustavatmel 1:9c5af431a1f1 70 {
gustavatmel 1:9c5af431a1f1 71 ctx->key = key;
gustavatmel 1:9c5af431a1f1 72 }
gustavatmel 1:9c5af431a1f1 73
gustavatmel 1:9c5af431a1f1 74 int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx,
gustavatmel 1:9c5af431a1f1 75 const char *subject_name )
gustavatmel 1:9c5af431a1f1 76 {
gustavatmel 1:9c5af431a1f1 77 return mbedtls_x509_string_to_names( &ctx->subject, subject_name );
gustavatmel 1:9c5af431a1f1 78 }
gustavatmel 1:9c5af431a1f1 79
gustavatmel 1:9c5af431a1f1 80 int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx,
gustavatmel 1:9c5af431a1f1 81 const char *oid, size_t oid_len,
gustavatmel 1:9c5af431a1f1 82 const unsigned char *val, size_t val_len )
gustavatmel 1:9c5af431a1f1 83 {
gustavatmel 1:9c5af431a1f1 84 return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len,
gustavatmel 1:9c5af431a1f1 85 0, val, val_len );
gustavatmel 1:9c5af431a1f1 86 }
gustavatmel 1:9c5af431a1f1 87
gustavatmel 1:9c5af431a1f1 88 int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage )
gustavatmel 1:9c5af431a1f1 89 {
gustavatmel 1:9c5af431a1f1 90 unsigned char buf[4];
gustavatmel 1:9c5af431a1f1 91 unsigned char *c;
gustavatmel 1:9c5af431a1f1 92 int ret;
gustavatmel 1:9c5af431a1f1 93
gustavatmel 1:9c5af431a1f1 94 c = buf + 4;
gustavatmel 1:9c5af431a1f1 95
gustavatmel 1:9c5af431a1f1 96 if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &key_usage, 7 ) ) != 4 )
gustavatmel 1:9c5af431a1f1 97 return( ret );
gustavatmel 1:9c5af431a1f1 98
gustavatmel 1:9c5af431a1f1 99 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
gustavatmel 1:9c5af431a1f1 100 MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
gustavatmel 1:9c5af431a1f1 101 buf, 4 );
gustavatmel 1:9c5af431a1f1 102 if( ret != 0 )
gustavatmel 1:9c5af431a1f1 103 return( ret );
gustavatmel 1:9c5af431a1f1 104
gustavatmel 1:9c5af431a1f1 105 return( 0 );
gustavatmel 1:9c5af431a1f1 106 }
gustavatmel 1:9c5af431a1f1 107
gustavatmel 1:9c5af431a1f1 108 int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
gustavatmel 1:9c5af431a1f1 109 unsigned char ns_cert_type )
gustavatmel 1:9c5af431a1f1 110 {
gustavatmel 1:9c5af431a1f1 111 unsigned char buf[4];
gustavatmel 1:9c5af431a1f1 112 unsigned char *c;
gustavatmel 1:9c5af431a1f1 113 int ret;
gustavatmel 1:9c5af431a1f1 114
gustavatmel 1:9c5af431a1f1 115 c = buf + 4;
gustavatmel 1:9c5af431a1f1 116
gustavatmel 1:9c5af431a1f1 117 if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &ns_cert_type, 8 ) ) != 4 )
gustavatmel 1:9c5af431a1f1 118 return( ret );
gustavatmel 1:9c5af431a1f1 119
gustavatmel 1:9c5af431a1f1 120 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
gustavatmel 1:9c5af431a1f1 121 MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
gustavatmel 1:9c5af431a1f1 122 buf, 4 );
gustavatmel 1:9c5af431a1f1 123 if( ret != 0 )
gustavatmel 1:9c5af431a1f1 124 return( ret );
gustavatmel 1:9c5af431a1f1 125
gustavatmel 1:9c5af431a1f1 126 return( 0 );
gustavatmel 1:9c5af431a1f1 127 }
gustavatmel 1:9c5af431a1f1 128
gustavatmel 1:9c5af431a1f1 129 int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
gustavatmel 1:9c5af431a1f1 130 int (*f_rng)(void *, unsigned char *, size_t),
gustavatmel 1:9c5af431a1f1 131 void *p_rng )
gustavatmel 1:9c5af431a1f1 132 {
gustavatmel 1:9c5af431a1f1 133 int ret;
gustavatmel 1:9c5af431a1f1 134 const char *sig_oid;
gustavatmel 1:9c5af431a1f1 135 size_t sig_oid_len = 0;
gustavatmel 1:9c5af431a1f1 136 unsigned char *c, *c2;
gustavatmel 1:9c5af431a1f1 137 unsigned char hash[64];
gustavatmel 1:9c5af431a1f1 138 unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
gustavatmel 1:9c5af431a1f1 139 unsigned char tmp_buf[2048];
gustavatmel 1:9c5af431a1f1 140 size_t pub_len = 0, sig_and_oid_len = 0, sig_len;
gustavatmel 1:9c5af431a1f1 141 size_t len = 0;
gustavatmel 1:9c5af431a1f1 142 mbedtls_pk_type_t pk_alg;
gustavatmel 1:9c5af431a1f1 143
gustavatmel 1:9c5af431a1f1 144 /*
gustavatmel 1:9c5af431a1f1 145 * Prepare data to be signed in tmp_buf
gustavatmel 1:9c5af431a1f1 146 */
gustavatmel 1:9c5af431a1f1 147 c = tmp_buf + sizeof( tmp_buf );
gustavatmel 1:9c5af431a1f1 148
gustavatmel 1:9c5af431a1f1 149 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
gustavatmel 1:9c5af431a1f1 150
gustavatmel 1:9c5af431a1f1 151 if( len )
gustavatmel 1:9c5af431a1f1 152 {
gustavatmel 1:9c5af431a1f1 153 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
gustavatmel 1:9c5af431a1f1 154 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 155 MBEDTLS_ASN1_SEQUENCE ) );
gustavatmel 1:9c5af431a1f1 156
gustavatmel 1:9c5af431a1f1 157 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
gustavatmel 1:9c5af431a1f1 158 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 159 MBEDTLS_ASN1_SET ) );
gustavatmel 1:9c5af431a1f1 160
gustavatmel 1:9c5af431a1f1 161 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, tmp_buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
gustavatmel 1:9c5af431a1f1 162 MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) );
gustavatmel 1:9c5af431a1f1 163
gustavatmel 1:9c5af431a1f1 164 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
gustavatmel 1:9c5af431a1f1 165 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 166 MBEDTLS_ASN1_SEQUENCE ) );
gustavatmel 1:9c5af431a1f1 167 }
gustavatmel 1:9c5af431a1f1 168
gustavatmel 1:9c5af431a1f1 169 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
gustavatmel 1:9c5af431a1f1 170 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 171 MBEDTLS_ASN1_CONTEXT_SPECIFIC ) );
gustavatmel 1:9c5af431a1f1 172
gustavatmel 1:9c5af431a1f1 173 MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key,
gustavatmel 1:9c5af431a1f1 174 tmp_buf, c - tmp_buf ) );
gustavatmel 1:9c5af431a1f1 175 c -= pub_len;
gustavatmel 1:9c5af431a1f1 176 len += pub_len;
gustavatmel 1:9c5af431a1f1 177
gustavatmel 1:9c5af431a1f1 178 /*
gustavatmel 1:9c5af431a1f1 179 * Subject ::= Name
gustavatmel 1:9c5af431a1f1 180 */
gustavatmel 1:9c5af431a1f1 181 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, tmp_buf, ctx->subject ) );
gustavatmel 1:9c5af431a1f1 182
gustavatmel 1:9c5af431a1f1 183 /*
gustavatmel 1:9c5af431a1f1 184 * Version ::= INTEGER { v1(0), v2(1), v3(2) }
gustavatmel 1:9c5af431a1f1 185 */
gustavatmel 1:9c5af431a1f1 186 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, tmp_buf, 0 ) );
gustavatmel 1:9c5af431a1f1 187
gustavatmel 1:9c5af431a1f1 188 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
gustavatmel 1:9c5af431a1f1 189 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 190 MBEDTLS_ASN1_SEQUENCE ) );
gustavatmel 1:9c5af431a1f1 191
gustavatmel 1:9c5af431a1f1 192 /*
gustavatmel 1:9c5af431a1f1 193 * Prepare signature
gustavatmel 1:9c5af431a1f1 194 */
gustavatmel 1:9c5af431a1f1 195 mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
gustavatmel 1:9c5af431a1f1 196
gustavatmel 1:9c5af431a1f1 197 if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
gustavatmel 1:9c5af431a1f1 198 f_rng, p_rng ) ) != 0 )
gustavatmel 1:9c5af431a1f1 199 {
gustavatmel 1:9c5af431a1f1 200 return( ret );
gustavatmel 1:9c5af431a1f1 201 }
gustavatmel 1:9c5af431a1f1 202
gustavatmel 1:9c5af431a1f1 203 if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) )
gustavatmel 1:9c5af431a1f1 204 pk_alg = MBEDTLS_PK_RSA;
gustavatmel 1:9c5af431a1f1 205 else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) )
gustavatmel 1:9c5af431a1f1 206 pk_alg = MBEDTLS_PK_ECDSA;
gustavatmel 1:9c5af431a1f1 207 else
gustavatmel 1:9c5af431a1f1 208 return( MBEDTLS_ERR_X509_INVALID_ALG );
gustavatmel 1:9c5af431a1f1 209
gustavatmel 1:9c5af431a1f1 210 if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
gustavatmel 1:9c5af431a1f1 211 &sig_oid, &sig_oid_len ) ) != 0 )
gustavatmel 1:9c5af431a1f1 212 {
gustavatmel 1:9c5af431a1f1 213 return( ret );
gustavatmel 1:9c5af431a1f1 214 }
gustavatmel 1:9c5af431a1f1 215
gustavatmel 1:9c5af431a1f1 216 /*
gustavatmel 1:9c5af431a1f1 217 * Write data to output buffer
gustavatmel 1:9c5af431a1f1 218 */
gustavatmel 1:9c5af431a1f1 219 c2 = buf + size;
gustavatmel 1:9c5af431a1f1 220 MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, buf,
gustavatmel 1:9c5af431a1f1 221 sig_oid, sig_oid_len, sig, sig_len ) );
gustavatmel 1:9c5af431a1f1 222
gustavatmel 1:9c5af431a1f1 223 if( len > (size_t)( c2 - buf ) )
gustavatmel 1:9c5af431a1f1 224 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
gustavatmel 1:9c5af431a1f1 225
gustavatmel 1:9c5af431a1f1 226 c2 -= len;
gustavatmel 1:9c5af431a1f1 227 memcpy( c2, c, len );
gustavatmel 1:9c5af431a1f1 228
gustavatmel 1:9c5af431a1f1 229 len += sig_and_oid_len;
gustavatmel 1:9c5af431a1f1 230 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) );
gustavatmel 1:9c5af431a1f1 231 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, MBEDTLS_ASN1_CONSTRUCTED |
gustavatmel 1:9c5af431a1f1 232 MBEDTLS_ASN1_SEQUENCE ) );
gustavatmel 1:9c5af431a1f1 233
gustavatmel 1:9c5af431a1f1 234 return( (int) len );
gustavatmel 1:9c5af431a1f1 235 }
gustavatmel 1:9c5af431a1f1 236
gustavatmel 1:9c5af431a1f1 237 #define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n"
gustavatmel 1:9c5af431a1f1 238 #define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n"
gustavatmel 1:9c5af431a1f1 239
gustavatmel 1:9c5af431a1f1 240 #if defined(MBEDTLS_PEM_WRITE_C)
gustavatmel 1:9c5af431a1f1 241 int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
gustavatmel 1:9c5af431a1f1 242 int (*f_rng)(void *, unsigned char *, size_t),
gustavatmel 1:9c5af431a1f1 243 void *p_rng )
gustavatmel 1:9c5af431a1f1 244 {
gustavatmel 1:9c5af431a1f1 245 int ret;
gustavatmel 1:9c5af431a1f1 246 unsigned char output_buf[4096];
gustavatmel 1:9c5af431a1f1 247 size_t olen = 0;
gustavatmel 1:9c5af431a1f1 248
gustavatmel 1:9c5af431a1f1 249 if( ( ret = mbedtls_x509write_csr_der( ctx, output_buf, sizeof(output_buf),
gustavatmel 1:9c5af431a1f1 250 f_rng, p_rng ) ) < 0 )
gustavatmel 1:9c5af431a1f1 251 {
gustavatmel 1:9c5af431a1f1 252 return( ret );
gustavatmel 1:9c5af431a1f1 253 }
gustavatmel 1:9c5af431a1f1 254
gustavatmel 1:9c5af431a1f1 255 if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
gustavatmel 1:9c5af431a1f1 256 output_buf + sizeof(output_buf) - ret,
gustavatmel 1:9c5af431a1f1 257 ret, buf, size, &olen ) ) != 0 )
gustavatmel 1:9c5af431a1f1 258 {
gustavatmel 1:9c5af431a1f1 259 return( ret );
gustavatmel 1:9c5af431a1f1 260 }
gustavatmel 1:9c5af431a1f1 261
gustavatmel 1:9c5af431a1f1 262 return( 0 );
gustavatmel 1:9c5af431a1f1 263 }
gustavatmel 1:9c5af431a1f1 264 #endif /* MBEDTLS_PEM_WRITE_C */
gustavatmel 1:9c5af431a1f1 265
gustavatmel 1:9c5af431a1f1 266 #endif /* MBEDTLS_X509_CSR_WRITE_C */