mbed TLS Build
Dependents: Encrypt_Decrypt1 mbed_blink_tls encrypt encrypt
library/x509_csr.c@0:cdf462088d13, 2017-01-05 (annotated)
- Committer:
- markrad
- Date:
- Thu Jan 05 00:18:44 2017 +0000
- Revision:
- 0:cdf462088d13
Initial commit
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
markrad | 0:cdf462088d13 | 1 | /* |
markrad | 0:cdf462088d13 | 2 | * X.509 Certificate Signing Request (CSR) parsing |
markrad | 0:cdf462088d13 | 3 | * |
markrad | 0:cdf462088d13 | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
markrad | 0:cdf462088d13 | 5 | * SPDX-License-Identifier: Apache-2.0 |
markrad | 0:cdf462088d13 | 6 | * |
markrad | 0:cdf462088d13 | 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
markrad | 0:cdf462088d13 | 8 | * not use this file except in compliance with the License. |
markrad | 0:cdf462088d13 | 9 | * You may obtain a copy of the License at |
markrad | 0:cdf462088d13 | 10 | * |
markrad | 0:cdf462088d13 | 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
markrad | 0:cdf462088d13 | 12 | * |
markrad | 0:cdf462088d13 | 13 | * Unless required by applicable law or agreed to in writing, software |
markrad | 0:cdf462088d13 | 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
markrad | 0:cdf462088d13 | 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
markrad | 0:cdf462088d13 | 16 | * See the License for the specific language governing permissions and |
markrad | 0:cdf462088d13 | 17 | * limitations under the License. |
markrad | 0:cdf462088d13 | 18 | * |
markrad | 0:cdf462088d13 | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
markrad | 0:cdf462088d13 | 20 | */ |
markrad | 0:cdf462088d13 | 21 | /* |
markrad | 0:cdf462088d13 | 22 | * The ITU-T X.509 standard defines a certificate format for PKI. |
markrad | 0:cdf462088d13 | 23 | * |
markrad | 0:cdf462088d13 | 24 | * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs) |
markrad | 0:cdf462088d13 | 25 | * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs) |
markrad | 0:cdf462088d13 | 26 | * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10) |
markrad | 0:cdf462088d13 | 27 | * |
markrad | 0:cdf462088d13 | 28 | * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf |
markrad | 0:cdf462088d13 | 29 | * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf |
markrad | 0:cdf462088d13 | 30 | */ |
markrad | 0:cdf462088d13 | 31 | |
markrad | 0:cdf462088d13 | 32 | #if !defined(MBEDTLS_CONFIG_FILE) |
markrad | 0:cdf462088d13 | 33 | #include "mbedtls/config.h" |
markrad | 0:cdf462088d13 | 34 | #else |
markrad | 0:cdf462088d13 | 35 | #include MBEDTLS_CONFIG_FILE |
markrad | 0:cdf462088d13 | 36 | #endif |
markrad | 0:cdf462088d13 | 37 | |
markrad | 0:cdf462088d13 | 38 | #if defined(MBEDTLS_X509_CSR_PARSE_C) |
markrad | 0:cdf462088d13 | 39 | |
markrad | 0:cdf462088d13 | 40 | #include "mbedtls/x509_csr.h" |
markrad | 0:cdf462088d13 | 41 | #include "mbedtls/oid.h" |
markrad | 0:cdf462088d13 | 42 | |
markrad | 0:cdf462088d13 | 43 | #include <string.h> |
markrad | 0:cdf462088d13 | 44 | |
markrad | 0:cdf462088d13 | 45 | #if defined(MBEDTLS_PEM_PARSE_C) |
markrad | 0:cdf462088d13 | 46 | #include "mbedtls/pem.h" |
markrad | 0:cdf462088d13 | 47 | #endif |
markrad | 0:cdf462088d13 | 48 | |
markrad | 0:cdf462088d13 | 49 | #if defined(MBEDTLS_PLATFORM_C) |
markrad | 0:cdf462088d13 | 50 | #include "mbedtls/platform.h" |
markrad | 0:cdf462088d13 | 51 | #else |
markrad | 0:cdf462088d13 | 52 | #include <stdlib.h> |
markrad | 0:cdf462088d13 | 53 | #include <stdio.h> |
markrad | 0:cdf462088d13 | 54 | #define mbedtls_free free |
markrad | 0:cdf462088d13 | 55 | #define mbedtls_calloc calloc |
markrad | 0:cdf462088d13 | 56 | #define mbedtls_snprintf snprintf |
markrad | 0:cdf462088d13 | 57 | #endif |
markrad | 0:cdf462088d13 | 58 | |
markrad | 0:cdf462088d13 | 59 | #if defined(MBEDTLS_FS_IO) || defined(EFIX64) || defined(EFI32) |
markrad | 0:cdf462088d13 | 60 | #include <stdio.h> |
markrad | 0:cdf462088d13 | 61 | #endif |
markrad | 0:cdf462088d13 | 62 | |
markrad | 0:cdf462088d13 | 63 | /* Implementation that should never be optimized out by the compiler */ |
markrad | 0:cdf462088d13 | 64 | static void mbedtls_zeroize( void *v, size_t n ) { |
markrad | 0:cdf462088d13 | 65 | volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
markrad | 0:cdf462088d13 | 66 | } |
markrad | 0:cdf462088d13 | 67 | |
markrad | 0:cdf462088d13 | 68 | /* |
markrad | 0:cdf462088d13 | 69 | * Version ::= INTEGER { v1(0) } |
markrad | 0:cdf462088d13 | 70 | */ |
markrad | 0:cdf462088d13 | 71 | static int x509_csr_get_version( unsigned char **p, |
markrad | 0:cdf462088d13 | 72 | const unsigned char *end, |
markrad | 0:cdf462088d13 | 73 | int *ver ) |
markrad | 0:cdf462088d13 | 74 | { |
markrad | 0:cdf462088d13 | 75 | int ret; |
markrad | 0:cdf462088d13 | 76 | |
markrad | 0:cdf462088d13 | 77 | if( ( ret = mbedtls_asn1_get_int( p, end, ver ) ) != 0 ) |
markrad | 0:cdf462088d13 | 78 | { |
markrad | 0:cdf462088d13 | 79 | if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) |
markrad | 0:cdf462088d13 | 80 | { |
markrad | 0:cdf462088d13 | 81 | *ver = 0; |
markrad | 0:cdf462088d13 | 82 | return( 0 ); |
markrad | 0:cdf462088d13 | 83 | } |
markrad | 0:cdf462088d13 | 84 | |
markrad | 0:cdf462088d13 | 85 | return( MBEDTLS_ERR_X509_INVALID_VERSION + ret ); |
markrad | 0:cdf462088d13 | 86 | } |
markrad | 0:cdf462088d13 | 87 | |
markrad | 0:cdf462088d13 | 88 | return( 0 ); |
markrad | 0:cdf462088d13 | 89 | } |
markrad | 0:cdf462088d13 | 90 | |
markrad | 0:cdf462088d13 | 91 | /* |
markrad | 0:cdf462088d13 | 92 | * Parse a CSR in DER format |
markrad | 0:cdf462088d13 | 93 | */ |
markrad | 0:cdf462088d13 | 94 | int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr, |
markrad | 0:cdf462088d13 | 95 | const unsigned char *buf, size_t buflen ) |
markrad | 0:cdf462088d13 | 96 | { |
markrad | 0:cdf462088d13 | 97 | int ret; |
markrad | 0:cdf462088d13 | 98 | size_t len; |
markrad | 0:cdf462088d13 | 99 | unsigned char *p, *end; |
markrad | 0:cdf462088d13 | 100 | mbedtls_x509_buf sig_params; |
markrad | 0:cdf462088d13 | 101 | |
markrad | 0:cdf462088d13 | 102 | memset( &sig_params, 0, sizeof( mbedtls_x509_buf ) ); |
markrad | 0:cdf462088d13 | 103 | |
markrad | 0:cdf462088d13 | 104 | /* |
markrad | 0:cdf462088d13 | 105 | * Check for valid input |
markrad | 0:cdf462088d13 | 106 | */ |
markrad | 0:cdf462088d13 | 107 | if( csr == NULL || buf == NULL || buflen == 0 ) |
markrad | 0:cdf462088d13 | 108 | return( MBEDTLS_ERR_X509_BAD_INPUT_DATA ); |
markrad | 0:cdf462088d13 | 109 | |
markrad | 0:cdf462088d13 | 110 | mbedtls_x509_csr_init( csr ); |
markrad | 0:cdf462088d13 | 111 | |
markrad | 0:cdf462088d13 | 112 | /* |
markrad | 0:cdf462088d13 | 113 | * first copy the raw DER data |
markrad | 0:cdf462088d13 | 114 | */ |
markrad | 0:cdf462088d13 | 115 | p = mbedtls_calloc( 1, len = buflen ); |
markrad | 0:cdf462088d13 | 116 | |
markrad | 0:cdf462088d13 | 117 | if( p == NULL ) |
markrad | 0:cdf462088d13 | 118 | return( MBEDTLS_ERR_X509_ALLOC_FAILED ); |
markrad | 0:cdf462088d13 | 119 | |
markrad | 0:cdf462088d13 | 120 | memcpy( p, buf, buflen ); |
markrad | 0:cdf462088d13 | 121 | |
markrad | 0:cdf462088d13 | 122 | csr->raw.p = p; |
markrad | 0:cdf462088d13 | 123 | csr->raw.len = len; |
markrad | 0:cdf462088d13 | 124 | end = p + len; |
markrad | 0:cdf462088d13 | 125 | |
markrad | 0:cdf462088d13 | 126 | /* |
markrad | 0:cdf462088d13 | 127 | * CertificationRequest ::= SEQUENCE { |
markrad | 0:cdf462088d13 | 128 | * certificationRequestInfo CertificationRequestInfo, |
markrad | 0:cdf462088d13 | 129 | * signatureAlgorithm AlgorithmIdentifier, |
markrad | 0:cdf462088d13 | 130 | * signature BIT STRING |
markrad | 0:cdf462088d13 | 131 | * } |
markrad | 0:cdf462088d13 | 132 | */ |
markrad | 0:cdf462088d13 | 133 | if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, |
markrad | 0:cdf462088d13 | 134 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 ) |
markrad | 0:cdf462088d13 | 135 | { |
markrad | 0:cdf462088d13 | 136 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 137 | return( MBEDTLS_ERR_X509_INVALID_FORMAT ); |
markrad | 0:cdf462088d13 | 138 | } |
markrad | 0:cdf462088d13 | 139 | |
markrad | 0:cdf462088d13 | 140 | if( len != (size_t) ( end - p ) ) |
markrad | 0:cdf462088d13 | 141 | { |
markrad | 0:cdf462088d13 | 142 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 143 | return( MBEDTLS_ERR_X509_INVALID_FORMAT + |
markrad | 0:cdf462088d13 | 144 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ); |
markrad | 0:cdf462088d13 | 145 | } |
markrad | 0:cdf462088d13 | 146 | |
markrad | 0:cdf462088d13 | 147 | /* |
markrad | 0:cdf462088d13 | 148 | * CertificationRequestInfo ::= SEQUENCE { |
markrad | 0:cdf462088d13 | 149 | */ |
markrad | 0:cdf462088d13 | 150 | csr->cri.p = p; |
markrad | 0:cdf462088d13 | 151 | |
markrad | 0:cdf462088d13 | 152 | if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, |
markrad | 0:cdf462088d13 | 153 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 ) |
markrad | 0:cdf462088d13 | 154 | { |
markrad | 0:cdf462088d13 | 155 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 156 | return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret ); |
markrad | 0:cdf462088d13 | 157 | } |
markrad | 0:cdf462088d13 | 158 | |
markrad | 0:cdf462088d13 | 159 | end = p + len; |
markrad | 0:cdf462088d13 | 160 | csr->cri.len = end - csr->cri.p; |
markrad | 0:cdf462088d13 | 161 | |
markrad | 0:cdf462088d13 | 162 | /* |
markrad | 0:cdf462088d13 | 163 | * Version ::= INTEGER { v1(0) } |
markrad | 0:cdf462088d13 | 164 | */ |
markrad | 0:cdf462088d13 | 165 | if( ( ret = x509_csr_get_version( &p, end, &csr->version ) ) != 0 ) |
markrad | 0:cdf462088d13 | 166 | { |
markrad | 0:cdf462088d13 | 167 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 168 | return( ret ); |
markrad | 0:cdf462088d13 | 169 | } |
markrad | 0:cdf462088d13 | 170 | |
markrad | 0:cdf462088d13 | 171 | csr->version++; |
markrad | 0:cdf462088d13 | 172 | |
markrad | 0:cdf462088d13 | 173 | if( csr->version != 1 ) |
markrad | 0:cdf462088d13 | 174 | { |
markrad | 0:cdf462088d13 | 175 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 176 | return( MBEDTLS_ERR_X509_UNKNOWN_VERSION ); |
markrad | 0:cdf462088d13 | 177 | } |
markrad | 0:cdf462088d13 | 178 | |
markrad | 0:cdf462088d13 | 179 | /* |
markrad | 0:cdf462088d13 | 180 | * subject Name |
markrad | 0:cdf462088d13 | 181 | */ |
markrad | 0:cdf462088d13 | 182 | csr->subject_raw.p = p; |
markrad | 0:cdf462088d13 | 183 | |
markrad | 0:cdf462088d13 | 184 | if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, |
markrad | 0:cdf462088d13 | 185 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 ) |
markrad | 0:cdf462088d13 | 186 | { |
markrad | 0:cdf462088d13 | 187 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 188 | return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret ); |
markrad | 0:cdf462088d13 | 189 | } |
markrad | 0:cdf462088d13 | 190 | |
markrad | 0:cdf462088d13 | 191 | if( ( ret = mbedtls_x509_get_name( &p, p + len, &csr->subject ) ) != 0 ) |
markrad | 0:cdf462088d13 | 192 | { |
markrad | 0:cdf462088d13 | 193 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 194 | return( ret ); |
markrad | 0:cdf462088d13 | 195 | } |
markrad | 0:cdf462088d13 | 196 | |
markrad | 0:cdf462088d13 | 197 | csr->subject_raw.len = p - csr->subject_raw.p; |
markrad | 0:cdf462088d13 | 198 | |
markrad | 0:cdf462088d13 | 199 | /* |
markrad | 0:cdf462088d13 | 200 | * subjectPKInfo SubjectPublicKeyInfo |
markrad | 0:cdf462088d13 | 201 | */ |
markrad | 0:cdf462088d13 | 202 | if( ( ret = mbedtls_pk_parse_subpubkey( &p, end, &csr->pk ) ) != 0 ) |
markrad | 0:cdf462088d13 | 203 | { |
markrad | 0:cdf462088d13 | 204 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 205 | return( ret ); |
markrad | 0:cdf462088d13 | 206 | } |
markrad | 0:cdf462088d13 | 207 | |
markrad | 0:cdf462088d13 | 208 | /* |
markrad | 0:cdf462088d13 | 209 | * attributes [0] Attributes |
markrad | 0:cdf462088d13 | 210 | * |
markrad | 0:cdf462088d13 | 211 | * The list of possible attributes is open-ended, though RFC 2985 |
markrad | 0:cdf462088d13 | 212 | * (PKCS#9) defines a few in section 5.4. We currently don't support any, |
markrad | 0:cdf462088d13 | 213 | * so we just ignore them. This is a safe thing to do as the worst thing |
markrad | 0:cdf462088d13 | 214 | * that could happen is that we issue a certificate that does not match |
markrad | 0:cdf462088d13 | 215 | * the requester's expectations - this cannot cause a violation of our |
markrad | 0:cdf462088d13 | 216 | * signature policies. |
markrad | 0:cdf462088d13 | 217 | */ |
markrad | 0:cdf462088d13 | 218 | if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, |
markrad | 0:cdf462088d13 | 219 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC ) ) != 0 ) |
markrad | 0:cdf462088d13 | 220 | { |
markrad | 0:cdf462088d13 | 221 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 222 | return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret ); |
markrad | 0:cdf462088d13 | 223 | } |
markrad | 0:cdf462088d13 | 224 | |
markrad | 0:cdf462088d13 | 225 | p += len; |
markrad | 0:cdf462088d13 | 226 | |
markrad | 0:cdf462088d13 | 227 | end = csr->raw.p + csr->raw.len; |
markrad | 0:cdf462088d13 | 228 | |
markrad | 0:cdf462088d13 | 229 | /* |
markrad | 0:cdf462088d13 | 230 | * signatureAlgorithm AlgorithmIdentifier, |
markrad | 0:cdf462088d13 | 231 | * signature BIT STRING |
markrad | 0:cdf462088d13 | 232 | */ |
markrad | 0:cdf462088d13 | 233 | if( ( ret = mbedtls_x509_get_alg( &p, end, &csr->sig_oid, &sig_params ) ) != 0 ) |
markrad | 0:cdf462088d13 | 234 | { |
markrad | 0:cdf462088d13 | 235 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 236 | return( ret ); |
markrad | 0:cdf462088d13 | 237 | } |
markrad | 0:cdf462088d13 | 238 | |
markrad | 0:cdf462088d13 | 239 | if( ( ret = mbedtls_x509_get_sig_alg( &csr->sig_oid, &sig_params, |
markrad | 0:cdf462088d13 | 240 | &csr->sig_md, &csr->sig_pk, |
markrad | 0:cdf462088d13 | 241 | &csr->sig_opts ) ) != 0 ) |
markrad | 0:cdf462088d13 | 242 | { |
markrad | 0:cdf462088d13 | 243 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 244 | return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG ); |
markrad | 0:cdf462088d13 | 245 | } |
markrad | 0:cdf462088d13 | 246 | |
markrad | 0:cdf462088d13 | 247 | if( ( ret = mbedtls_x509_get_sig( &p, end, &csr->sig ) ) != 0 ) |
markrad | 0:cdf462088d13 | 248 | { |
markrad | 0:cdf462088d13 | 249 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 250 | return( ret ); |
markrad | 0:cdf462088d13 | 251 | } |
markrad | 0:cdf462088d13 | 252 | |
markrad | 0:cdf462088d13 | 253 | if( p != end ) |
markrad | 0:cdf462088d13 | 254 | { |
markrad | 0:cdf462088d13 | 255 | mbedtls_x509_csr_free( csr ); |
markrad | 0:cdf462088d13 | 256 | return( MBEDTLS_ERR_X509_INVALID_FORMAT + |
markrad | 0:cdf462088d13 | 257 | MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ); |
markrad | 0:cdf462088d13 | 258 | } |
markrad | 0:cdf462088d13 | 259 | |
markrad | 0:cdf462088d13 | 260 | return( 0 ); |
markrad | 0:cdf462088d13 | 261 | } |
markrad | 0:cdf462088d13 | 262 | |
markrad | 0:cdf462088d13 | 263 | /* |
markrad | 0:cdf462088d13 | 264 | * Parse a CSR, allowing for PEM or raw DER encoding |
markrad | 0:cdf462088d13 | 265 | */ |
markrad | 0:cdf462088d13 | 266 | int mbedtls_x509_csr_parse( mbedtls_x509_csr *csr, const unsigned char *buf, size_t buflen ) |
markrad | 0:cdf462088d13 | 267 | { |
markrad | 0:cdf462088d13 | 268 | int ret; |
markrad | 0:cdf462088d13 | 269 | #if defined(MBEDTLS_PEM_PARSE_C) |
markrad | 0:cdf462088d13 | 270 | size_t use_len; |
markrad | 0:cdf462088d13 | 271 | mbedtls_pem_context pem; |
markrad | 0:cdf462088d13 | 272 | #endif |
markrad | 0:cdf462088d13 | 273 | |
markrad | 0:cdf462088d13 | 274 | /* |
markrad | 0:cdf462088d13 | 275 | * Check for valid input |
markrad | 0:cdf462088d13 | 276 | */ |
markrad | 0:cdf462088d13 | 277 | if( csr == NULL || buf == NULL || buflen == 0 ) |
markrad | 0:cdf462088d13 | 278 | return( MBEDTLS_ERR_X509_BAD_INPUT_DATA ); |
markrad | 0:cdf462088d13 | 279 | |
markrad | 0:cdf462088d13 | 280 | #if defined(MBEDTLS_PEM_PARSE_C) |
markrad | 0:cdf462088d13 | 281 | mbedtls_pem_init( &pem ); |
markrad | 0:cdf462088d13 | 282 | |
markrad | 0:cdf462088d13 | 283 | /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */ |
markrad | 0:cdf462088d13 | 284 | if( buf[buflen - 1] != '\0' ) |
markrad | 0:cdf462088d13 | 285 | ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT; |
markrad | 0:cdf462088d13 | 286 | else |
markrad | 0:cdf462088d13 | 287 | ret = mbedtls_pem_read_buffer( &pem, |
markrad | 0:cdf462088d13 | 288 | "-----BEGIN CERTIFICATE REQUEST-----", |
markrad | 0:cdf462088d13 | 289 | "-----END CERTIFICATE REQUEST-----", |
markrad | 0:cdf462088d13 | 290 | buf, NULL, 0, &use_len ); |
markrad | 0:cdf462088d13 | 291 | |
markrad | 0:cdf462088d13 | 292 | if( ret == 0 ) |
markrad | 0:cdf462088d13 | 293 | { |
markrad | 0:cdf462088d13 | 294 | /* |
markrad | 0:cdf462088d13 | 295 | * Was PEM encoded, parse the result |
markrad | 0:cdf462088d13 | 296 | */ |
markrad | 0:cdf462088d13 | 297 | if( ( ret = mbedtls_x509_csr_parse_der( csr, pem.buf, pem.buflen ) ) != 0 ) |
markrad | 0:cdf462088d13 | 298 | return( ret ); |
markrad | 0:cdf462088d13 | 299 | |
markrad | 0:cdf462088d13 | 300 | mbedtls_pem_free( &pem ); |
markrad | 0:cdf462088d13 | 301 | return( 0 ); |
markrad | 0:cdf462088d13 | 302 | } |
markrad | 0:cdf462088d13 | 303 | else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ) |
markrad | 0:cdf462088d13 | 304 | { |
markrad | 0:cdf462088d13 | 305 | mbedtls_pem_free( &pem ); |
markrad | 0:cdf462088d13 | 306 | return( ret ); |
markrad | 0:cdf462088d13 | 307 | } |
markrad | 0:cdf462088d13 | 308 | else |
markrad | 0:cdf462088d13 | 309 | #endif /* MBEDTLS_PEM_PARSE_C */ |
markrad | 0:cdf462088d13 | 310 | return( mbedtls_x509_csr_parse_der( csr, buf, buflen ) ); |
markrad | 0:cdf462088d13 | 311 | } |
markrad | 0:cdf462088d13 | 312 | |
markrad | 0:cdf462088d13 | 313 | #if defined(MBEDTLS_FS_IO) |
markrad | 0:cdf462088d13 | 314 | /* |
markrad | 0:cdf462088d13 | 315 | * Load a CSR into the structure |
markrad | 0:cdf462088d13 | 316 | */ |
markrad | 0:cdf462088d13 | 317 | int mbedtls_x509_csr_parse_file( mbedtls_x509_csr *csr, const char *path ) |
markrad | 0:cdf462088d13 | 318 | { |
markrad | 0:cdf462088d13 | 319 | int ret; |
markrad | 0:cdf462088d13 | 320 | size_t n; |
markrad | 0:cdf462088d13 | 321 | unsigned char *buf; |
markrad | 0:cdf462088d13 | 322 | |
markrad | 0:cdf462088d13 | 323 | if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 ) |
markrad | 0:cdf462088d13 | 324 | return( ret ); |
markrad | 0:cdf462088d13 | 325 | |
markrad | 0:cdf462088d13 | 326 | ret = mbedtls_x509_csr_parse( csr, buf, n ); |
markrad | 0:cdf462088d13 | 327 | |
markrad | 0:cdf462088d13 | 328 | mbedtls_zeroize( buf, n ); |
markrad | 0:cdf462088d13 | 329 | mbedtls_free( buf ); |
markrad | 0:cdf462088d13 | 330 | |
markrad | 0:cdf462088d13 | 331 | return( ret ); |
markrad | 0:cdf462088d13 | 332 | } |
markrad | 0:cdf462088d13 | 333 | #endif /* MBEDTLS_FS_IO */ |
markrad | 0:cdf462088d13 | 334 | |
markrad | 0:cdf462088d13 | 335 | #define BEFORE_COLON 14 |
markrad | 0:cdf462088d13 | 336 | #define BC "14" |
markrad | 0:cdf462088d13 | 337 | /* |
markrad | 0:cdf462088d13 | 338 | * Return an informational string about the CSR. |
markrad | 0:cdf462088d13 | 339 | */ |
markrad | 0:cdf462088d13 | 340 | int mbedtls_x509_csr_info( char *buf, size_t size, const char *prefix, |
markrad | 0:cdf462088d13 | 341 | const mbedtls_x509_csr *csr ) |
markrad | 0:cdf462088d13 | 342 | { |
markrad | 0:cdf462088d13 | 343 | int ret; |
markrad | 0:cdf462088d13 | 344 | size_t n; |
markrad | 0:cdf462088d13 | 345 | char *p; |
markrad | 0:cdf462088d13 | 346 | char key_size_str[BEFORE_COLON]; |
markrad | 0:cdf462088d13 | 347 | |
markrad | 0:cdf462088d13 | 348 | p = buf; |
markrad | 0:cdf462088d13 | 349 | n = size; |
markrad | 0:cdf462088d13 | 350 | |
markrad | 0:cdf462088d13 | 351 | ret = mbedtls_snprintf( p, n, "%sCSR version : %d", |
markrad | 0:cdf462088d13 | 352 | prefix, csr->version ); |
markrad | 0:cdf462088d13 | 353 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 354 | |
markrad | 0:cdf462088d13 | 355 | ret = mbedtls_snprintf( p, n, "\n%ssubject name : ", prefix ); |
markrad | 0:cdf462088d13 | 356 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 357 | ret = mbedtls_x509_dn_gets( p, n, &csr->subject ); |
markrad | 0:cdf462088d13 | 358 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 359 | |
markrad | 0:cdf462088d13 | 360 | ret = mbedtls_snprintf( p, n, "\n%ssigned using : ", prefix ); |
markrad | 0:cdf462088d13 | 361 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 362 | |
markrad | 0:cdf462088d13 | 363 | ret = mbedtls_x509_sig_alg_gets( p, n, &csr->sig_oid, csr->sig_pk, csr->sig_md, |
markrad | 0:cdf462088d13 | 364 | csr->sig_opts ); |
markrad | 0:cdf462088d13 | 365 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 366 | |
markrad | 0:cdf462088d13 | 367 | if( ( ret = mbedtls_x509_key_size_helper( key_size_str, BEFORE_COLON, |
markrad | 0:cdf462088d13 | 368 | mbedtls_pk_get_name( &csr->pk ) ) ) != 0 ) |
markrad | 0:cdf462088d13 | 369 | { |
markrad | 0:cdf462088d13 | 370 | return( ret ); |
markrad | 0:cdf462088d13 | 371 | } |
markrad | 0:cdf462088d13 | 372 | |
markrad | 0:cdf462088d13 | 373 | ret = mbedtls_snprintf( p, n, "\n%s%-" BC "s: %d bits\n", prefix, key_size_str, |
markrad | 0:cdf462088d13 | 374 | (int) mbedtls_pk_get_bitlen( &csr->pk ) ); |
markrad | 0:cdf462088d13 | 375 | MBEDTLS_X509_SAFE_SNPRINTF; |
markrad | 0:cdf462088d13 | 376 | |
markrad | 0:cdf462088d13 | 377 | return( (int) ( size - n ) ); |
markrad | 0:cdf462088d13 | 378 | } |
markrad | 0:cdf462088d13 | 379 | |
markrad | 0:cdf462088d13 | 380 | /* |
markrad | 0:cdf462088d13 | 381 | * Initialize a CSR |
markrad | 0:cdf462088d13 | 382 | */ |
markrad | 0:cdf462088d13 | 383 | void mbedtls_x509_csr_init( mbedtls_x509_csr *csr ) |
markrad | 0:cdf462088d13 | 384 | { |
markrad | 0:cdf462088d13 | 385 | memset( csr, 0, sizeof(mbedtls_x509_csr) ); |
markrad | 0:cdf462088d13 | 386 | } |
markrad | 0:cdf462088d13 | 387 | |
markrad | 0:cdf462088d13 | 388 | /* |
markrad | 0:cdf462088d13 | 389 | * Unallocate all CSR data |
markrad | 0:cdf462088d13 | 390 | */ |
markrad | 0:cdf462088d13 | 391 | void mbedtls_x509_csr_free( mbedtls_x509_csr *csr ) |
markrad | 0:cdf462088d13 | 392 | { |
markrad | 0:cdf462088d13 | 393 | mbedtls_x509_name *name_cur; |
markrad | 0:cdf462088d13 | 394 | mbedtls_x509_name *name_prv; |
markrad | 0:cdf462088d13 | 395 | |
markrad | 0:cdf462088d13 | 396 | if( csr == NULL ) |
markrad | 0:cdf462088d13 | 397 | return; |
markrad | 0:cdf462088d13 | 398 | |
markrad | 0:cdf462088d13 | 399 | mbedtls_pk_free( &csr->pk ); |
markrad | 0:cdf462088d13 | 400 | |
markrad | 0:cdf462088d13 | 401 | #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) |
markrad | 0:cdf462088d13 | 402 | mbedtls_free( csr->sig_opts ); |
markrad | 0:cdf462088d13 | 403 | #endif |
markrad | 0:cdf462088d13 | 404 | |
markrad | 0:cdf462088d13 | 405 | name_cur = csr->subject.next; |
markrad | 0:cdf462088d13 | 406 | while( name_cur != NULL ) |
markrad | 0:cdf462088d13 | 407 | { |
markrad | 0:cdf462088d13 | 408 | name_prv = name_cur; |
markrad | 0:cdf462088d13 | 409 | name_cur = name_cur->next; |
markrad | 0:cdf462088d13 | 410 | mbedtls_zeroize( name_prv, sizeof( mbedtls_x509_name ) ); |
markrad | 0:cdf462088d13 | 411 | mbedtls_free( name_prv ); |
markrad | 0:cdf462088d13 | 412 | } |
markrad | 0:cdf462088d13 | 413 | |
markrad | 0:cdf462088d13 | 414 | if( csr->raw.p != NULL ) |
markrad | 0:cdf462088d13 | 415 | { |
markrad | 0:cdf462088d13 | 416 | mbedtls_zeroize( csr->raw.p, csr->raw.len ); |
markrad | 0:cdf462088d13 | 417 | mbedtls_free( csr->raw.p ); |
markrad | 0:cdf462088d13 | 418 | } |
markrad | 0:cdf462088d13 | 419 | |
markrad | 0:cdf462088d13 | 420 | mbedtls_zeroize( csr, sizeof( mbedtls_x509_csr ) ); |
markrad | 0:cdf462088d13 | 421 | } |
markrad | 0:cdf462088d13 | 422 | |
markrad | 0:cdf462088d13 | 423 | #endif /* MBEDTLS_X509_CSR_PARSE_C */ |