x509_create.c

00001 /*
00002  *  X.509 base functions for creating certificates / CSRs
00003  *
00004  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
00005  *  SPDX-License-Identifier: Apache-2.0
00006  *
00007  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
00008  *  not use this file except in compliance with the License.
00009  *  You may obtain a copy of the License at
00010  *
00011  *  http://www.apache.org/licenses/LICENSE-2.0
00012  *
00013  *  Unless required by applicable law or agreed to in writing, software
00014  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
00015  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00016  *  See the License for the specific language governing permissions and
00017  *  limitations under the License.
00018  *
00019  *  This file is part of mbed TLS (https://tls.mbed.org)
00020  */
00021 
00022 #if !defined(MBEDTLS_CONFIG_FILE)
00023 #include "mbedtls/config.h"
00024 #else
00025 #include MBEDTLS_CONFIG_FILE
00026 #endif
00027 
00028 #if defined(MBEDTLS_X509_CREATE_C)
00029 
00030 #include "mbedtls/x509.h"
00031 #include "mbedtls/asn1write.h"
00032 #include "mbedtls/oid.h"
00033 
00034 #include <string.h>
00035 
00036 /* Structure linking OIDs for X.509 DN AttributeTypes to their
00037  * string representations and default string encodings used by Mbed TLS. */
00038 typedef struct {
00039    const char *name; /* String representation of AttributeType, e.g.
00040                       * "CN" or "emailAddress". */
00041    size_t name_len;  /* Length of 'name', without trailing 0 byte. */
00042    const char *oid;  /* String representation of OID of AttributeType,
00043                       * as per RFC 5280, Appendix A.1. */
00044    int default_tag;  /* The default character encoding used for the
00045                       * given attribute type, e.g.
00046                       * MBEDTLS_ASN1_UTF8_STRING for UTF-8. */
00047 } x509_attr_descriptor_t;
00048 
00049 #define ADD_STRLEN( s )     s, sizeof( s ) - 1
00050 
00051 /* X.509 DN attributes from RFC 5280, Appendix A.1. */
00052 static const x509_attr_descriptor_t x509_attrs[] =
00053 {
00054     { ADD_STRLEN( "CN" ),
00055       MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
00056     { ADD_STRLEN( "commonName" ),
00057       MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
00058     { ADD_STRLEN( "C" ),
00059       MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
00060     { ADD_STRLEN( "countryName" ),
00061       MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
00062     { ADD_STRLEN( "O" ),
00063       MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
00064     { ADD_STRLEN( "organizationName" ),
00065       MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
00066     { ADD_STRLEN( "L" ),
00067       MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
00068     { ADD_STRLEN( "locality" ),
00069       MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
00070     { ADD_STRLEN( "R" ),
00071       MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
00072     { ADD_STRLEN( "OU" ),
00073       MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
00074     { ADD_STRLEN( "organizationalUnitName" ),
00075       MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
00076     { ADD_STRLEN( "ST" ),
00077       MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
00078     { ADD_STRLEN( "stateOrProvinceName" ),
00079       MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
00080     { ADD_STRLEN( "emailAddress" ),
00081       MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
00082     { ADD_STRLEN( "serialNumber" ),
00083       MBEDTLS_OID_AT_SERIAL_NUMBER, MBEDTLS_ASN1_PRINTABLE_STRING },
00084     { ADD_STRLEN( "postalAddress" ),
00085       MBEDTLS_OID_AT_POSTAL_ADDRESS, MBEDTLS_ASN1_PRINTABLE_STRING },
00086     { ADD_STRLEN( "postalCode" ),
00087       MBEDTLS_OID_AT_POSTAL_CODE, MBEDTLS_ASN1_PRINTABLE_STRING },
00088     { ADD_STRLEN( "dnQualifier" ),
00089       MBEDTLS_OID_AT_DN_QUALIFIER, MBEDTLS_ASN1_PRINTABLE_STRING },
00090     { ADD_STRLEN( "title" ),
00091       MBEDTLS_OID_AT_TITLE, MBEDTLS_ASN1_UTF8_STRING },
00092     { ADD_STRLEN( "surName" ),
00093       MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
00094     { ADD_STRLEN( "SN" ),
00095       MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
00096     { ADD_STRLEN( "givenName" ),
00097       MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
00098     { ADD_STRLEN( "GN" ),
00099       MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
00100     { ADD_STRLEN( "initials" ),
00101       MBEDTLS_OID_AT_INITIALS, MBEDTLS_ASN1_UTF8_STRING },
00102     { ADD_STRLEN( "pseudonym" ),
00103       MBEDTLS_OID_AT_PSEUDONYM, MBEDTLS_ASN1_UTF8_STRING },
00104     { ADD_STRLEN( "generationQualifier" ),
00105       MBEDTLS_OID_AT_GENERATION_QUALIFIER, MBEDTLS_ASN1_UTF8_STRING },
00106     { ADD_STRLEN( "domainComponent" ),
00107       MBEDTLS_OID_DOMAIN_COMPONENT, MBEDTLS_ASN1_IA5_STRING },
00108     { ADD_STRLEN( "DC" ),
00109       MBEDTLS_OID_DOMAIN_COMPONENT,   MBEDTLS_ASN1_IA5_STRING },
00110     { NULL, 0, NULL, MBEDTLS_ASN1_NULL }
00111 };
00112 
00113 static const x509_attr_descriptor_t *x509_attr_descr_from_name( const char *name, size_t name_len )
00114 {
00115     const x509_attr_descriptor_t *cur;
00116 
00117     for( cur = x509_attrs; cur->name != NULL; cur++ )
00118         if( cur->name_len == name_len &&
00119             strncmp( cur->name, name, name_len ) == 0 )
00120             break;
00121 
00122     if ( cur->name == NULL )
00123         return( NULL );
00124 
00125     return( cur );
00126 }
00127 
00128 int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name )
00129 {
00130     int ret = 0;
00131     const char *s = name, *c = s;
00132     const char *end = s + strlen( s );
00133     const char *oid = NULL;
00134     const x509_attr_descriptor_t* attr_descr = NULL;
00135     int in_tag = 1;
00136     char data[MBEDTLS_X509_MAX_DN_NAME_SIZE];
00137     char *d = data;
00138 
00139     /* Clear existing chain if present */
00140     mbedtls_asn1_free_named_data_list( head );
00141 
00142     while( c <= end )
00143     {
00144         if( in_tag && *c == '=' )
00145         {
00146             if( ( attr_descr = x509_attr_descr_from_name( s, c - s ) ) == NULL )
00147             {
00148                 ret = MBEDTLS_ERR_X509_UNKNOWN_OID;
00149                 goto exit;
00150             }
00151 
00152             oid = attr_descr->oid;
00153             s = c + 1;
00154             in_tag = 0;
00155             d = data;
00156         }
00157 
00158         if( !in_tag && *c == '\\' && c != end )
00159         {
00160             c++;
00161 
00162             /* Check for valid escaped characters */
00163             if( c == end || *c != ',' )
00164             {
00165                 ret = MBEDTLS_ERR_X509_INVALID_NAME;
00166                 goto exit;
00167             }
00168         }
00169         else if( !in_tag && ( *c == ',' || c == end ) )
00170         {
00171             mbedtls_asn1_named_data* cur =
00172                 mbedtls_asn1_store_named_data( head, oid, strlen( oid ),
00173                                                (unsigned char *) data,
00174                                                d - data );
00175 
00176             if(cur == NULL )
00177             {
00178                 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
00179             }
00180 
00181             // set tagType
00182             cur->val.tag = attr_descr->default_tag;
00183 
00184             while( c < end && *(c + 1) == ' ' )
00185                 c++;
00186 
00187             s = c + 1;
00188             in_tag = 1;
00189         }
00190 
00191         if( !in_tag && s != c + 1 )
00192         {
00193             *(d++) = *c;
00194 
00195             if( d - data == MBEDTLS_X509_MAX_DN_NAME_SIZE )
00196             {
00197                 ret = MBEDTLS_ERR_X509_INVALID_NAME;
00198                 goto exit;
00199             }
00200         }
00201 
00202         c++;
00203     }
00204 
00205 exit:
00206 
00207     return( ret );
00208 }
00209 
00210 /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved
00211  * to store the critical boolean for us
00212  */
00213 int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len,
00214                         int critical, const unsigned char *val, size_t val_len )
00215 {
00216     mbedtls_asn1_named_data *cur;
00217 
00218     if( ( cur = mbedtls_asn1_store_named_data( head, oid, oid_len,
00219                                        NULL, val_len + 1 ) ) == NULL )
00220     {
00221         return( MBEDTLS_ERR_X509_ALLOC_FAILED );
00222     }
00223 
00224     cur->val.p[0] = critical;
00225     memcpy( cur->val.p + 1, val, val_len );
00226 
00227     return( 0 );
00228 }
00229 
00230 /*
00231  *  RelativeDistinguishedName ::=
00232  *    SET OF AttributeTypeAndValue
00233  *
00234  *  AttributeTypeAndValue ::= SEQUENCE {
00235  *    type     AttributeType,
00236  *    value    AttributeValue }
00237  *
00238  *  AttributeType ::= OBJECT IDENTIFIER
00239  *
00240  *  AttributeValue ::= ANY DEFINED BY AttributeType
00241  */
00242 static int x509_write_name( unsigned char **p, unsigned char *start, mbedtls_asn1_named_data* cur_name)
00243 {
00244     int ret;
00245     size_t len = 0;
00246     const char *oid             = (const char*)cur_name->oid.p;
00247     size_t oid_len              = cur_name->oid.len;
00248     const unsigned char *name   = cur_name->val.p;
00249     size_t name_len             = cur_name->val.len;
00250 
00251     // Write correct string tag and value
00252     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tagged_string( p, start,
00253                                                        cur_name->val.tag,
00254                                                        (const char *) name,
00255                                                        name_len ) );
00256     // Write OID
00257     //
00258     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( p, start, oid,
00259                                                        oid_len ) );
00260 
00261     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
00262     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
00263                                                     MBEDTLS_ASN1_CONSTRUCTED |
00264                                                     MBEDTLS_ASN1_SEQUENCE ) );
00265 
00266     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
00267     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
00268                                                  MBEDTLS_ASN1_CONSTRUCTED |
00269                                                  MBEDTLS_ASN1_SET ) );
00270 
00271     return( (int) len );
00272 }
00273 
00274 int mbedtls_x509_write_names( unsigned char **p, unsigned char *start,
00275                               mbedtls_asn1_named_data *first )
00276 {
00277     int ret;
00278     size_t len = 0;
00279     mbedtls_asn1_named_data *cur = first;
00280 
00281     while( cur != NULL )
00282     {
00283         MBEDTLS_ASN1_CHK_ADD( len, x509_write_name( p, start, cur ) );
00284         cur = cur->next;
00285     }
00286 
00287     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
00288     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
00289                                                  MBEDTLS_ASN1_SEQUENCE ) );
00290 
00291     return( (int) len );
00292 }
00293 
00294 int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start,
00295                     const char *oid, size_t oid_len,
00296                     unsigned char *sig, size_t size )
00297 {
00298     int ret;
00299     size_t len = 0;
00300 
00301     if( *p < start || (size_t)( *p - start ) < size )
00302         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
00303 
00304     len = size;
00305     (*p) -= len;
00306     memcpy( *p, sig, len );
00307 
00308     if( *p - start < 1 )
00309         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
00310 
00311     *--(*p) = 0;
00312     len += 1;
00313 
00314     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
00315     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_BIT_STRING ) );
00316 
00317     // Write OID
00318     //
00319     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_algorithm_identifier( p, start, oid,
00320                                                         oid_len, 0 ) );
00321 
00322     return( (int) len );
00323 }
00324 
00325 static int x509_write_extension( unsigned char **p, unsigned char *start,
00326                                  mbedtls_asn1_named_data *ext )
00327 {
00328     int ret;
00329     size_t len = 0;
00330 
00331     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_raw_buffer( p, start, ext->val.p + 1,
00332                                               ext->val.len - 1 ) );
00333     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, ext->val.len - 1 ) );
00334     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OCTET_STRING ) );
00335 
00336     if( ext->val.p[0] != 0 )
00337     {
00338         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_bool( p, start, 1 ) );
00339     }
00340 
00341     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_raw_buffer( p, start, ext->oid.p,
00342                                               ext->oid.len ) );
00343     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, ext->oid.len ) );
00344     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OID ) );
00345 
00346     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
00347     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
00348                                                  MBEDTLS_ASN1_SEQUENCE ) );
00349 
00350     return( (int) len );
00351 }
00352 
00353 /*
00354  * Extension  ::=  SEQUENCE  {
00355  *     extnID      OBJECT IDENTIFIER,
00356  *     critical    BOOLEAN DEFAULT FALSE,
00357  *     extnValue   OCTET STRING
00358  *                 -- contains the DER encoding of an ASN.1 value
00359  *                 -- corresponding to the extension type identified
00360  *                 -- by extnID
00361  *     }
00362  */
00363 int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start,
00364                            mbedtls_asn1_named_data *first )
00365 {
00366     int ret;
00367     size_t len = 0;
00368     mbedtls_asn1_named_data *cur_ext = first;
00369 
00370     while( cur_ext != NULL )
00371     {
00372         MBEDTLS_ASN1_CHK_ADD( len, x509_write_extension( p, start, cur_ext ) );
00373         cur_ext = cur_ext->next;
00374     }
00375 
00376     return( (int) len );
00377 }
00378 
00379 #endif /* MBEDTLS_X509_CREATE_C */