wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

wolfcrypt/src/asn.c@11:cee25a834751, 2017-05-30 (annotated)

Committer:
wolfSSL
Date:
Tue May 30 01:44:10 2017 +0000
Revision:
11:cee25a834751
wolfSSL 3.11.0

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 11:cee25a834751 1 /* asn.c
wolfSSL 11:cee25a834751 2 *
wolfSSL 11:cee25a834751 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 11:cee25a834751 4 *
wolfSSL 11:cee25a834751 5 * This file is part of wolfSSL.
wolfSSL 11:cee25a834751 6 *
wolfSSL 11:cee25a834751 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 11:cee25a834751 8 * it under the terms of the GNU General Public License as published by
wolfSSL 11:cee25a834751 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 11:cee25a834751 10 * (at your option) any later version.
wolfSSL 11:cee25a834751 11 *
wolfSSL 11:cee25a834751 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 11:cee25a834751 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 11:cee25a834751 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 11:cee25a834751 15 * GNU General Public License for more details.
wolfSSL 11:cee25a834751 16 *
wolfSSL 11:cee25a834751 17 * You should have received a copy of the GNU General Public License
wolfSSL 11:cee25a834751 18 * along with this program; if not, write to the Free Software
wolfSSL 11:cee25a834751 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 11:cee25a834751 20 */
wolfSSL 11:cee25a834751 21
wolfSSL 11:cee25a834751 22
wolfSSL 11:cee25a834751 23 #ifdef HAVE_CONFIG_H
wolfSSL 11:cee25a834751 24 #include <config.h>
wolfSSL 11:cee25a834751 25 #endif
wolfSSL 11:cee25a834751 26
wolfSSL 11:cee25a834751 27 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 11:cee25a834751 28
wolfSSL 11:cee25a834751 29 /*
wolfSSL 11:cee25a834751 30 ASN Options:
wolfSSL 11:cee25a834751 31 * NO_ASN_TIME: Disables time parts of the ASN code for systems without an RTC
wolfSSL 11:cee25a834751 32 or wishing to save space.
wolfSSL 11:cee25a834751 33 * IGNORE_NAME_CONSTRAINTS: Skip ASN name checks.
wolfSSL 11:cee25a834751 34 * ASN_DUMP_OID: Allows dump of OID information for debugging.
wolfSSL 11:cee25a834751 35 * RSA_DECODE_EXTRA: Decodes extra information in RSA public key.
wolfSSL 11:cee25a834751 36 * WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName.
wolfSSL 11:cee25a834751 37 */
wolfSSL 11:cee25a834751 38
wolfSSL 11:cee25a834751 39 #ifndef NO_ASN
wolfSSL 11:cee25a834751 40
wolfSSL 11:cee25a834751 41 #ifdef HAVE_RTP_SYS
wolfSSL 11:cee25a834751 42 #include "os.h" /* dc_rtc_api needs */
wolfSSL 11:cee25a834751 43 #include "dc_rtc_api.h" /* to get current time */
wolfSSL 11:cee25a834751 44 #endif
wolfSSL 11:cee25a834751 45
wolfSSL 11:cee25a834751 46 #include <wolfssl/wolfcrypt/asn.h>
wolfSSL 11:cee25a834751 47 #include <wolfssl/wolfcrypt/coding.h>
wolfSSL 11:cee25a834751 48 #include <wolfssl/wolfcrypt/md2.h>
wolfSSL 11:cee25a834751 49 #include <wolfssl/wolfcrypt/hmac.h>
wolfSSL 11:cee25a834751 50 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 11:cee25a834751 51 #include <wolfssl/wolfcrypt/pwdbased.h>
wolfSSL 11:cee25a834751 52 #include <wolfssl/wolfcrypt/des3.h>
wolfSSL 11:cee25a834751 53 #include <wolfssl/wolfcrypt/logging.h>
wolfSSL 11:cee25a834751 54
wolfSSL 11:cee25a834751 55 #include <wolfssl/wolfcrypt/random.h>
wolfSSL 11:cee25a834751 56 #include <wolfssl/wolfcrypt/hash.h>
wolfSSL 11:cee25a834751 57 #ifdef NO_INLINE
wolfSSL 11:cee25a834751 58 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 11:cee25a834751 59 #else
wolfSSL 11:cee25a834751 60 #define WOLFSSL_MISC_INCLUDED
wolfSSL 11:cee25a834751 61 #include <wolfcrypt/src/misc.c>
wolfSSL 11:cee25a834751 62 #endif
wolfSSL 11:cee25a834751 63
wolfSSL 11:cee25a834751 64 #ifndef NO_RC4
wolfSSL 11:cee25a834751 65 #include <wolfssl/wolfcrypt/arc4.h>
wolfSSL 11:cee25a834751 66 #endif
wolfSSL 11:cee25a834751 67
wolfSSL 11:cee25a834751 68 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 69 #include "libntruencrypt/ntru_crypto.h"
wolfSSL 11:cee25a834751 70 #endif
wolfSSL 11:cee25a834751 71
wolfSSL 11:cee25a834751 72 #if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
wolfSSL 11:cee25a834751 73 #include <wolfssl/wolfcrypt/sha512.h>
wolfSSL 11:cee25a834751 74 #endif
wolfSSL 11:cee25a834751 75
wolfSSL 11:cee25a834751 76 #ifndef NO_SHA256
wolfSSL 11:cee25a834751 77 #include <wolfssl/wolfcrypt/sha256.h>
wolfSSL 11:cee25a834751 78 #endif
wolfSSL 11:cee25a834751 79
wolfSSL 11:cee25a834751 80 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 81 #include <wolfssl/wolfcrypt/ecc.h>
wolfSSL 11:cee25a834751 82 #endif
wolfSSL 11:cee25a834751 83
wolfSSL 11:cee25a834751 84 #ifndef NO_RSA
wolfSSL 11:cee25a834751 85 #include <wolfssl/wolfcrypt/rsa.h>
wolfSSL 11:cee25a834751 86 #endif
wolfSSL 11:cee25a834751 87
wolfSSL 11:cee25a834751 88 #ifdef WOLFSSL_DEBUG_ENCODING
wolfSSL 11:cee25a834751 89 #if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
wolfSSL 11:cee25a834751 90 #if MQX_USE_IO_OLD
wolfSSL 11:cee25a834751 91 #include <fio.h>
wolfSSL 11:cee25a834751 92 #else
wolfSSL 11:cee25a834751 93 #include <nio.h>
wolfSSL 11:cee25a834751 94 #endif
wolfSSL 11:cee25a834751 95 #else
wolfSSL 11:cee25a834751 96 #include <stdio.h>
wolfSSL 11:cee25a834751 97 #endif
wolfSSL 11:cee25a834751 98 #endif
wolfSSL 11:cee25a834751 99
wolfSSL 11:cee25a834751 100 #ifdef _MSC_VER
wolfSSL 11:cee25a834751 101 /* 4996 warning to use MS extensions e.g., strcpy_s instead of XSTRNCPY */
wolfSSL 11:cee25a834751 102 #pragma warning(disable: 4996)
wolfSSL 11:cee25a834751 103 #endif
wolfSSL 11:cee25a834751 104
wolfSSL 11:cee25a834751 105 #define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
wolfSSL 11:cee25a834751 106
wolfSSL 11:cee25a834751 107 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 108 #if defined(USER_TIME)
wolfSSL 11:cee25a834751 109 /* Use our gmtime and time_t/struct tm types.
wolfSSL 11:cee25a834751 110 Only needs seconds since EPOCH using XTIME function.
wolfSSL 11:cee25a834751 111 time_t XTIME(time_t * timer) {}
wolfSSL 11:cee25a834751 112 */
wolfSSL 11:cee25a834751 113 #define WOLFSSL_GMTIME
wolfSSL 11:cee25a834751 114 #define USE_WOLF_TM
wolfSSL 11:cee25a834751 115 #define USE_WOLF_TIME_T
wolfSSL 11:cee25a834751 116
wolfSSL 11:cee25a834751 117 #elif defined(TIME_OVERRIDES)
wolfSSL 11:cee25a834751 118 /* Override XTIME() and XGMTIME() functionality.
wolfSSL 11:cee25a834751 119 Requires user to provide these functions:
wolfSSL 11:cee25a834751 120 time_t XTIME(time_t * timer) {}
wolfSSL 11:cee25a834751 121 struct tm* XGMTIME(const time_t* timer, struct tm* tmp) {}
wolfSSL 11:cee25a834751 122 */
wolfSSL 11:cee25a834751 123 #ifndef HAVE_TIME_T_TYPE
wolfSSL 11:cee25a834751 124 #define USE_WOLF_TIME_T
wolfSSL 11:cee25a834751 125 #endif
wolfSSL 11:cee25a834751 126 #ifndef HAVE_TM_TYPE
wolfSSL 11:cee25a834751 127 #define USE_WOLF_TM
wolfSSL 11:cee25a834751 128 #endif
wolfSSL 11:cee25a834751 129 #define NEED_TMP_TIME
wolfSSL 11:cee25a834751 130
wolfSSL 11:cee25a834751 131 #elif defined(HAVE_RTP_SYS)
wolfSSL 11:cee25a834751 132 /* uses parital <time.h> structures */
wolfSSL 11:cee25a834751 133 #define XTIME(tl) (0)
wolfSSL 11:cee25a834751 134 #define XGMTIME(c, t) rtpsys_gmtime((c))
wolfSSL 11:cee25a834751 135
wolfSSL 11:cee25a834751 136 #elif defined(MICRIUM)
wolfSSL 11:cee25a834751 137 #if (NET_SECURE_MGR_CFG_EN == DEF_ENABLED)
wolfSSL 11:cee25a834751 138 #define XVALIDATE_DATE(d, f, t) NetSecure_ValidateDateHandler((d), (f), (t))
wolfSSL 11:cee25a834751 139 #else
wolfSSL 11:cee25a834751 140 #define XVALIDATE_DATE(d, f, t) (0)
wolfSSL 11:cee25a834751 141 #endif
wolfSSL 11:cee25a834751 142 #define NO_TIME_H
wolfSSL 11:cee25a834751 143 /* since Micrium not defining XTIME or XGMTIME, CERT_GEN not available */
wolfSSL 11:cee25a834751 144
wolfSSL 11:cee25a834751 145 #elif defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
wolfSSL 11:cee25a834751 146 #include <time.h>
wolfSSL 11:cee25a834751 147 #define XTIME(t1) pic32_time((t1))
wolfSSL 11:cee25a834751 148 #define XGMTIME(c, t) gmtime((c))
wolfSSL 11:cee25a834751 149
wolfSSL 11:cee25a834751 150 #elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
wolfSSL 11:cee25a834751 151 #define XTIME(t1) mqx_time((t1))
wolfSSL 11:cee25a834751 152 #define HAVE_GMTIME_R
wolfSSL 11:cee25a834751 153
wolfSSL 11:cee25a834751 154 #elif defined(FREESCALE_KSDK_BM) || defined(FREESCALE_FREE_RTOS) || defined(FREESCALE_KSDK_FREERTOS)
wolfSSL 11:cee25a834751 155 #include <time.h>
wolfSSL 11:cee25a834751 156 #ifndef XTIME
wolfSSL 11:cee25a834751 157 #define XTIME(t1) ksdk_time((t1))
wolfSSL 11:cee25a834751 158 #endif
wolfSSL 11:cee25a834751 159 #define XGMTIME(c, t) gmtime((c))
wolfSSL 11:cee25a834751 160
wolfSSL 11:cee25a834751 161 #elif defined(WOLFSSL_ATMEL)
wolfSSL 11:cee25a834751 162 #define XTIME(t1) atmel_get_curr_time_and_date((t1))
wolfSSL 11:cee25a834751 163 #define WOLFSSL_GMTIME
wolfSSL 11:cee25a834751 164 #define USE_WOLF_TM
wolfSSL 11:cee25a834751 165 #define USE_WOLF_TIME_T
wolfSSL 11:cee25a834751 166
wolfSSL 11:cee25a834751 167 #elif defined(IDIRECT_DEV_TIME)
wolfSSL 11:cee25a834751 168 /*Gets the timestamp from cloak software owned by VT iDirect
wolfSSL 11:cee25a834751 169 in place of time() from <time.h> */
wolfSSL 11:cee25a834751 170 #include <time.h>
wolfSSL 11:cee25a834751 171 #define XTIME(t1) idirect_time((t1))
wolfSSL 11:cee25a834751 172 #define XGMTIME(c, t) gmtime((c))
wolfSSL 11:cee25a834751 173
wolfSSL 11:cee25a834751 174 #elif defined(_WIN32_WCE)
wolfSSL 11:cee25a834751 175 #include <windows.h>
wolfSSL 11:cee25a834751 176 #define XTIME(t1) windows_time((t1))
wolfSSL 11:cee25a834751 177 #define WOLFSSL_GMTIME
wolfSSL 11:cee25a834751 178
wolfSSL 11:cee25a834751 179 #else
wolfSSL 11:cee25a834751 180 /* default */
wolfSSL 11:cee25a834751 181 /* uses complete <time.h> facility */
wolfSSL 11:cee25a834751 182 #include <time.h>
wolfSSL 11:cee25a834751 183 #endif
wolfSSL 11:cee25a834751 184
wolfSSL 11:cee25a834751 185
wolfSSL 11:cee25a834751 186 /* Map default time functions */
wolfSSL 11:cee25a834751 187 #if !defined(XTIME) && !defined(TIME_OVERRIDES) && !defined(USER_TIME)
wolfSSL 11:cee25a834751 188 #define XTIME(tl) time((tl))
wolfSSL 11:cee25a834751 189 #endif
wolfSSL 11:cee25a834751 190 #if !defined(XGMTIME) && !defined(TIME_OVERRIDES)
wolfSSL 11:cee25a834751 191 #if defined(WOLFSSL_GMTIME) || !defined(HAVE_GMTIME_R)
wolfSSL 11:cee25a834751 192 #define XGMTIME(c, t) gmtime((c))
wolfSSL 11:cee25a834751 193 #else
wolfSSL 11:cee25a834751 194 #define XGMTIME(c, t) gmtime_r((c), (t))
wolfSSL 11:cee25a834751 195 #define NEED_TMP_TIME
wolfSSL 11:cee25a834751 196 #endif
wolfSSL 11:cee25a834751 197 #endif
wolfSSL 11:cee25a834751 198 #if !defined(XVALIDATE_DATE) && !defined(HAVE_VALIDATE_DATE)
wolfSSL 11:cee25a834751 199 #define USE_WOLF_VALIDDATE
wolfSSL 11:cee25a834751 200 #define XVALIDATE_DATE(d, f, t) ValidateDate((d), (f), (t))
wolfSSL 11:cee25a834751 201 #endif
wolfSSL 11:cee25a834751 202
wolfSSL 11:cee25a834751 203 /* wolf struct tm and time_t */
wolfSSL 11:cee25a834751 204 #if defined(USE_WOLF_TM)
wolfSSL 11:cee25a834751 205 struct tm {
wolfSSL 11:cee25a834751 206 int tm_sec; /* seconds after the minute [0-60] */
wolfSSL 11:cee25a834751 207 int tm_min; /* minutes after the hour [0-59] */
wolfSSL 11:cee25a834751 208 int tm_hour; /* hours since midnight [0-23] */
wolfSSL 11:cee25a834751 209 int tm_mday; /* day of the month [1-31] */
wolfSSL 11:cee25a834751 210 int tm_mon; /* months since January [0-11] */
wolfSSL 11:cee25a834751 211 int tm_year; /* years since 1900 */
wolfSSL 11:cee25a834751 212 int tm_wday; /* days since Sunday [0-6] */
wolfSSL 11:cee25a834751 213 int tm_yday; /* days since January 1 [0-365] */
wolfSSL 11:cee25a834751 214 int tm_isdst; /* Daylight Savings Time flag */
wolfSSL 11:cee25a834751 215 long tm_gmtoff; /* offset from CUT in seconds */
wolfSSL 11:cee25a834751 216 char *tm_zone; /* timezone abbreviation */
wolfSSL 11:cee25a834751 217 };
wolfSSL 11:cee25a834751 218 #endif /* USE_WOLF_TM */
wolfSSL 11:cee25a834751 219 #if defined(USE_WOLF_TIME_T)
wolfSSL 11:cee25a834751 220 typedef long time_t;
wolfSSL 11:cee25a834751 221 #endif
wolfSSL 11:cee25a834751 222
wolfSSL 11:cee25a834751 223 /* forward declarations */
wolfSSL 11:cee25a834751 224 #if defined(USER_TIME)
wolfSSL 11:cee25a834751 225 struct tm* gmtime(const time_t* timer);
wolfSSL 11:cee25a834751 226 extern time_t XTIME(time_t * timer);
wolfSSL 11:cee25a834751 227
wolfSSL 11:cee25a834751 228 #ifdef STACK_TRAP
wolfSSL 11:cee25a834751 229 /* for stack trap tracking, don't call os gmtime on OS X/linux,
wolfSSL 11:cee25a834751 230 uses a lot of stack spce */
wolfSSL 11:cee25a834751 231 extern time_t time(time_t * timer);
wolfSSL 11:cee25a834751 232 #define XTIME(tl) time((tl))
wolfSSL 11:cee25a834751 233 #endif /* STACK_TRAP */
wolfSSL 11:cee25a834751 234
wolfSSL 11:cee25a834751 235 #elif defined(TIME_OVERRIDES)
wolfSSL 11:cee25a834751 236 extern time_t XTIME(time_t * timer);
wolfSSL 11:cee25a834751 237 extern struct tm* XGMTIME(const time_t* timer, struct tm* tmp);
wolfSSL 11:cee25a834751 238 #elif defined(WOLFSSL_GMTIME)
wolfSSL 11:cee25a834751 239 struct tm* gmtime(const time_t* timer);
wolfSSL 11:cee25a834751 240 #endif
wolfSSL 11:cee25a834751 241
wolfSSL 11:cee25a834751 242 #if defined(FREESCALE_KSDK_BM) || defined(FREESCALE_FREE_RTOS)
wolfSSL 11:cee25a834751 243 /* extern time_t ksdk_time(time_t* timer); */
wolfSSL 11:cee25a834751 244 #endif /* FREESCALE_KSDK_BM || FREESCALE_FREE_RTOS */
wolfSSL 11:cee25a834751 245
wolfSSL 11:cee25a834751 246
wolfSSL 11:cee25a834751 247 #if defined(_WIN32_WCE)
wolfSSL 11:cee25a834751 248 time_t windows_time(time_t* timer)
wolfSSL 11:cee25a834751 249 {
wolfSSL 11:cee25a834751 250 SYSTEMTIME sysTime;
wolfSSL 11:cee25a834751 251 FILETIME fTime;
wolfSSL 11:cee25a834751 252 ULARGE_INTEGER intTime;
wolfSSL 11:cee25a834751 253 time_t localTime;
wolfSSL 11:cee25a834751 254
wolfSSL 11:cee25a834751 255 if (timer == NULL)
wolfSSL 11:cee25a834751 256 timer = &localTime;
wolfSSL 11:cee25a834751 257
wolfSSL 11:cee25a834751 258 GetSystemTime(&sysTime);
wolfSSL 11:cee25a834751 259 SystemTimeToFileTime(&sysTime, &fTime);
wolfSSL 11:cee25a834751 260
wolfSSL 11:cee25a834751 261 XMEMCPY(&intTime, &fTime, sizeof(FILETIME));
wolfSSL 11:cee25a834751 262 /* subtract EPOCH */
wolfSSL 11:cee25a834751 263 intTime.QuadPart -= 0x19db1ded53e8000;
wolfSSL 11:cee25a834751 264 /* to secs */
wolfSSL 11:cee25a834751 265 intTime.QuadPart /= 10000000;
wolfSSL 11:cee25a834751 266 *timer = (time_t)intTime.QuadPart;
wolfSSL 11:cee25a834751 267
wolfSSL 11:cee25a834751 268 return *timer;
wolfSSL 11:cee25a834751 269 }
wolfSSL 11:cee25a834751 270 #endif /* _WIN32_WCE */
wolfSSL 11:cee25a834751 271
wolfSSL 11:cee25a834751 272 #if defined(WOLFSSL_GMTIME)
wolfSSL 11:cee25a834751 273 struct tm* gmtime(const time_t* timer)
wolfSSL 11:cee25a834751 274 {
wolfSSL 11:cee25a834751 275 #define YEAR0 1900
wolfSSL 11:cee25a834751 276 #define EPOCH_YEAR 1970
wolfSSL 11:cee25a834751 277 #define SECS_DAY (24L * 60L * 60L)
wolfSSL 11:cee25a834751 278 #define LEAPYEAR(year) (!((year) % 4) && (((year) % 100) || !((year) %400)))
wolfSSL 11:cee25a834751 279 #define YEARSIZE(year) (LEAPYEAR(year) ? 366 : 365)
wolfSSL 11:cee25a834751 280
wolfSSL 11:cee25a834751 281 static const int _ytab[2][12] =
wolfSSL 11:cee25a834751 282 {
wolfSSL 11:cee25a834751 283 {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},
wolfSSL 11:cee25a834751 284 {31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}
wolfSSL 11:cee25a834751 285 };
wolfSSL 11:cee25a834751 286
wolfSSL 11:cee25a834751 287 static struct tm st_time;
wolfSSL 11:cee25a834751 288 struct tm* ret = &st_time;
wolfSSL 11:cee25a834751 289 time_t secs = *timer;
wolfSSL 11:cee25a834751 290 unsigned long dayclock, dayno;
wolfSSL 11:cee25a834751 291 int year = EPOCH_YEAR;
wolfSSL 11:cee25a834751 292
wolfSSL 11:cee25a834751 293 dayclock = (unsigned long)secs % SECS_DAY;
wolfSSL 11:cee25a834751 294 dayno = (unsigned long)secs / SECS_DAY;
wolfSSL 11:cee25a834751 295
wolfSSL 11:cee25a834751 296 ret->tm_sec = (int) dayclock % 60;
wolfSSL 11:cee25a834751 297 ret->tm_min = (int)(dayclock % 3600) / 60;
wolfSSL 11:cee25a834751 298 ret->tm_hour = (int) dayclock / 3600;
wolfSSL 11:cee25a834751 299 ret->tm_wday = (int) (dayno + 4) % 7; /* day 0 a Thursday */
wolfSSL 11:cee25a834751 300
wolfSSL 11:cee25a834751 301 while(dayno >= (unsigned long)YEARSIZE(year)) {
wolfSSL 11:cee25a834751 302 dayno -= YEARSIZE(year);
wolfSSL 11:cee25a834751 303 year++;
wolfSSL 11:cee25a834751 304 }
wolfSSL 11:cee25a834751 305
wolfSSL 11:cee25a834751 306 ret->tm_year = year - YEAR0;
wolfSSL 11:cee25a834751 307 ret->tm_yday = (int)dayno;
wolfSSL 11:cee25a834751 308 ret->tm_mon = 0;
wolfSSL 11:cee25a834751 309
wolfSSL 11:cee25a834751 310 while(dayno >= (unsigned long)_ytab[LEAPYEAR(year)][ret->tm_mon]) {
wolfSSL 11:cee25a834751 311 dayno -= _ytab[LEAPYEAR(year)][ret->tm_mon];
wolfSSL 11:cee25a834751 312 ret->tm_mon++;
wolfSSL 11:cee25a834751 313 }
wolfSSL 11:cee25a834751 314
wolfSSL 11:cee25a834751 315 ret->tm_mday = (int)++dayno;
wolfSSL 11:cee25a834751 316 ret->tm_isdst = 0;
wolfSSL 11:cee25a834751 317
wolfSSL 11:cee25a834751 318 return ret;
wolfSSL 11:cee25a834751 319 }
wolfSSL 11:cee25a834751 320 #endif /* WOLFSSL_GMTIME */
wolfSSL 11:cee25a834751 321
wolfSSL 11:cee25a834751 322
wolfSSL 11:cee25a834751 323 #if defined(HAVE_RTP_SYS)
wolfSSL 11:cee25a834751 324 #define YEAR0 1900
wolfSSL 11:cee25a834751 325
wolfSSL 11:cee25a834751 326 struct tm* rtpsys_gmtime(const time_t* timer) /* has a gmtime() but hangs */
wolfSSL 11:cee25a834751 327 {
wolfSSL 11:cee25a834751 328 static struct tm st_time;
wolfSSL 11:cee25a834751 329 struct tm* ret = &st_time;
wolfSSL 11:cee25a834751 330
wolfSSL 11:cee25a834751 331 DC_RTC_CALENDAR cal;
wolfSSL 11:cee25a834751 332 dc_rtc_time_get(&cal, TRUE);
wolfSSL 11:cee25a834751 333
wolfSSL 11:cee25a834751 334 ret->tm_year = cal.year - YEAR0; /* gm starts at 1900 */
wolfSSL 11:cee25a834751 335 ret->tm_mon = cal.month - 1; /* gm starts at 0 */
wolfSSL 11:cee25a834751 336 ret->tm_mday = cal.day;
wolfSSL 11:cee25a834751 337 ret->tm_hour = cal.hour;
wolfSSL 11:cee25a834751 338 ret->tm_min = cal.minute;
wolfSSL 11:cee25a834751 339 ret->tm_sec = cal.second;
wolfSSL 11:cee25a834751 340
wolfSSL 11:cee25a834751 341 return ret;
wolfSSL 11:cee25a834751 342 }
wolfSSL 11:cee25a834751 343
wolfSSL 11:cee25a834751 344 #endif /* HAVE_RTP_SYS */
wolfSSL 11:cee25a834751 345
wolfSSL 11:cee25a834751 346
wolfSSL 11:cee25a834751 347 #if defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
wolfSSL 11:cee25a834751 348
wolfSSL 11:cee25a834751 349 /*
wolfSSL 11:cee25a834751 350 * time() is just a stub in Microchip libraries. We need our own
wolfSSL 11:cee25a834751 351 * implementation. Use SNTP client to get seconds since epoch.
wolfSSL 11:cee25a834751 352 */
wolfSSL 11:cee25a834751 353 time_t pic32_time(time_t* timer)
wolfSSL 11:cee25a834751 354 {
wolfSSL 11:cee25a834751 355 #ifdef MICROCHIP_TCPIP_V5
wolfSSL 11:cee25a834751 356 DWORD sec = 0;
wolfSSL 11:cee25a834751 357 #else
wolfSSL 11:cee25a834751 358 uint32_t sec = 0;
wolfSSL 11:cee25a834751 359 #endif
wolfSSL 11:cee25a834751 360 time_t localTime;
wolfSSL 11:cee25a834751 361
wolfSSL 11:cee25a834751 362 if (timer == NULL)
wolfSSL 11:cee25a834751 363 timer = &localTime;
wolfSSL 11:cee25a834751 364
wolfSSL 11:cee25a834751 365 #ifdef MICROCHIP_MPLAB_HARMONY
wolfSSL 11:cee25a834751 366 sec = TCPIP_SNTP_UTCSecondsGet();
wolfSSL 11:cee25a834751 367 #else
wolfSSL 11:cee25a834751 368 sec = SNTPGetUTCSeconds();
wolfSSL 11:cee25a834751 369 #endif
wolfSSL 11:cee25a834751 370 *timer = (time_t) sec;
wolfSSL 11:cee25a834751 371
wolfSSL 11:cee25a834751 372 return *timer;
wolfSSL 11:cee25a834751 373 }
wolfSSL 11:cee25a834751 374
wolfSSL 11:cee25a834751 375 #endif /* MICROCHIP_TCPIP || MICROCHIP_TCPIP_V5 */
wolfSSL 11:cee25a834751 376
wolfSSL 11:cee25a834751 377
wolfSSL 11:cee25a834751 378 #if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
wolfSSL 11:cee25a834751 379
wolfSSL 11:cee25a834751 380 time_t mqx_time(time_t* timer)
wolfSSL 11:cee25a834751 381 {
wolfSSL 11:cee25a834751 382 time_t localTime;
wolfSSL 11:cee25a834751 383 TIME_STRUCT time_s;
wolfSSL 11:cee25a834751 384
wolfSSL 11:cee25a834751 385 if (timer == NULL)
wolfSSL 11:cee25a834751 386 timer = &localTime;
wolfSSL 11:cee25a834751 387
wolfSSL 11:cee25a834751 388 _time_get(&time_s);
wolfSSL 11:cee25a834751 389 *timer = (time_t) time_s.SECONDS;
wolfSSL 11:cee25a834751 390
wolfSSL 11:cee25a834751 391 return *timer;
wolfSSL 11:cee25a834751 392 }
wolfSSL 11:cee25a834751 393
wolfSSL 11:cee25a834751 394 #endif /* FREESCALE_MQX || FREESCALE_KSDK_MQX */
wolfSSL 11:cee25a834751 395
wolfSSL 11:cee25a834751 396
wolfSSL 11:cee25a834751 397 #if defined(WOLFSSL_TIRTOS)
wolfSSL 11:cee25a834751 398
wolfSSL 11:cee25a834751 399 time_t XTIME(time_t * timer)
wolfSSL 11:cee25a834751 400 {
wolfSSL 11:cee25a834751 401 time_t sec = 0;
wolfSSL 11:cee25a834751 402
wolfSSL 11:cee25a834751 403 sec = (time_t) Seconds_get();
wolfSSL 11:cee25a834751 404
wolfSSL 11:cee25a834751 405 if (timer != NULL)
wolfSSL 11:cee25a834751 406 *timer = sec;
wolfSSL 11:cee25a834751 407
wolfSSL 11:cee25a834751 408 return sec;
wolfSSL 11:cee25a834751 409 }
wolfSSL 11:cee25a834751 410
wolfSSL 11:cee25a834751 411 #endif /* WOLFSSL_TIRTOS */
wolfSSL 11:cee25a834751 412
wolfSSL 11:cee25a834751 413
wolfSSL 11:cee25a834751 414 static INLINE word32 btoi(byte b)
wolfSSL 11:cee25a834751 415 {
wolfSSL 11:cee25a834751 416 return (word32)(b - 0x30);
wolfSSL 11:cee25a834751 417 }
wolfSSL 11:cee25a834751 418
wolfSSL 11:cee25a834751 419
wolfSSL 11:cee25a834751 420 /* two byte date/time, add to value */
wolfSSL 11:cee25a834751 421 static INLINE void GetTime(int* value, const byte* date, int* idx)
wolfSSL 11:cee25a834751 422 {
wolfSSL 11:cee25a834751 423 int i = *idx;
wolfSSL 11:cee25a834751 424
wolfSSL 11:cee25a834751 425 *value += btoi(date[i++]) * 10;
wolfSSL 11:cee25a834751 426 *value += btoi(date[i++]);
wolfSSL 11:cee25a834751 427
wolfSSL 11:cee25a834751 428 *idx = i;
wolfSSL 11:cee25a834751 429 }
wolfSSL 11:cee25a834751 430
wolfSSL 11:cee25a834751 431
wolfSSL 11:cee25a834751 432 #if defined(MICRIUM)
wolfSSL 11:cee25a834751 433
wolfSSL 11:cee25a834751 434 CPU_INT32S NetSecure_ValidateDateHandler(CPU_INT08U *date, CPU_INT08U format,
wolfSSL 11:cee25a834751 435 CPU_INT08U dateType)
wolfSSL 11:cee25a834751 436 {
wolfSSL 11:cee25a834751 437 CPU_BOOLEAN rtn_code;
wolfSSL 11:cee25a834751 438 CPU_INT32S i;
wolfSSL 11:cee25a834751 439 CPU_INT32S val;
wolfSSL 11:cee25a834751 440 CPU_INT16U year;
wolfSSL 11:cee25a834751 441 CPU_INT08U month;
wolfSSL 11:cee25a834751 442 CPU_INT16U day;
wolfSSL 11:cee25a834751 443 CPU_INT08U hour;
wolfSSL 11:cee25a834751 444 CPU_INT08U min;
wolfSSL 11:cee25a834751 445 CPU_INT08U sec;
wolfSSL 11:cee25a834751 446
wolfSSL 11:cee25a834751 447 i = 0;
wolfSSL 11:cee25a834751 448 year = 0u;
wolfSSL 11:cee25a834751 449
wolfSSL 11:cee25a834751 450 if (format == ASN_UTC_TIME) {
wolfSSL 11:cee25a834751 451 if (btoi(date[0]) >= 5)
wolfSSL 11:cee25a834751 452 year = 1900;
wolfSSL 11:cee25a834751 453 else
wolfSSL 11:cee25a834751 454 year = 2000;
wolfSSL 11:cee25a834751 455 }
wolfSSL 11:cee25a834751 456 else { /* format == GENERALIZED_TIME */
wolfSSL 11:cee25a834751 457 year += btoi(date[i++]) * 1000;
wolfSSL 11:cee25a834751 458 year += btoi(date[i++]) * 100;
wolfSSL 11:cee25a834751 459 }
wolfSSL 11:cee25a834751 460
wolfSSL 11:cee25a834751 461 val = year;
wolfSSL 11:cee25a834751 462 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 463 year = (CPU_INT16U)val;
wolfSSL 11:cee25a834751 464
wolfSSL 11:cee25a834751 465 val = 0;
wolfSSL 11:cee25a834751 466 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 467 month = (CPU_INT08U)val;
wolfSSL 11:cee25a834751 468
wolfSSL 11:cee25a834751 469 val = 0;
wolfSSL 11:cee25a834751 470 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 471 day = (CPU_INT16U)val;
wolfSSL 11:cee25a834751 472
wolfSSL 11:cee25a834751 473 val = 0;
wolfSSL 11:cee25a834751 474 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 475 hour = (CPU_INT08U)val;
wolfSSL 11:cee25a834751 476
wolfSSL 11:cee25a834751 477 val = 0;
wolfSSL 11:cee25a834751 478 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 479 min = (CPU_INT08U)val;
wolfSSL 11:cee25a834751 480
wolfSSL 11:cee25a834751 481 val = 0;
wolfSSL 11:cee25a834751 482 GetTime(&val, date, &i);
wolfSSL 11:cee25a834751 483 sec = (CPU_INT08U)val;
wolfSSL 11:cee25a834751 484
wolfSSL 11:cee25a834751 485 return NetSecure_ValidateDate(year, month, day, hour, min, sec, dateType);
wolfSSL 11:cee25a834751 486 }
wolfSSL 11:cee25a834751 487
wolfSSL 11:cee25a834751 488 #endif /* MICRIUM */
wolfSSL 11:cee25a834751 489
wolfSSL 11:cee25a834751 490
wolfSSL 11:cee25a834751 491 #if defined(IDIRECT_DEV_TIME)
wolfSSL 11:cee25a834751 492
wolfSSL 11:cee25a834751 493 extern time_t getTimestamp();
wolfSSL 11:cee25a834751 494
wolfSSL 11:cee25a834751 495 time_t idirect_time(time_t * timer)
wolfSSL 11:cee25a834751 496 {
wolfSSL 11:cee25a834751 497 time_t sec = getTimestamp();
wolfSSL 11:cee25a834751 498
wolfSSL 11:cee25a834751 499 if (timer != NULL)
wolfSSL 11:cee25a834751 500 *timer = sec;
wolfSSL 11:cee25a834751 501
wolfSSL 11:cee25a834751 502 return sec;
wolfSSL 11:cee25a834751 503 }
wolfSSL 11:cee25a834751 504
wolfSSL 11:cee25a834751 505 #endif /* IDIRECT_DEV_TIME */
wolfSSL 11:cee25a834751 506
wolfSSL 11:cee25a834751 507 #endif /* !NO_ASN_TIME */
wolfSSL 11:cee25a834751 508
wolfSSL 11:cee25a834751 509
wolfSSL 11:cee25a834751 510 WOLFSSL_LOCAL int GetLength(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 511 word32 maxIdx)
wolfSSL 11:cee25a834751 512 {
wolfSSL 11:cee25a834751 513 int length = 0;
wolfSSL 11:cee25a834751 514 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 515 byte b;
wolfSSL 11:cee25a834751 516
wolfSSL 11:cee25a834751 517 *len = 0; /* default length */
wolfSSL 11:cee25a834751 518
wolfSSL 11:cee25a834751 519 if ((idx + 1) > maxIdx) { /* for first read */
wolfSSL 11:cee25a834751 520 WOLFSSL_MSG("GetLength bad index on input");
wolfSSL 11:cee25a834751 521 return BUFFER_E;
wolfSSL 11:cee25a834751 522 }
wolfSSL 11:cee25a834751 523
wolfSSL 11:cee25a834751 524 b = input[idx++];
wolfSSL 11:cee25a834751 525 if (b >= ASN_LONG_LENGTH) {
wolfSSL 11:cee25a834751 526 word32 bytes = b & 0x7F;
wolfSSL 11:cee25a834751 527
wolfSSL 11:cee25a834751 528 if ((idx + bytes) > maxIdx) { /* for reading bytes */
wolfSSL 11:cee25a834751 529 WOLFSSL_MSG("GetLength bad long length");
wolfSSL 11:cee25a834751 530 return BUFFER_E;
wolfSSL 11:cee25a834751 531 }
wolfSSL 11:cee25a834751 532
wolfSSL 11:cee25a834751 533 while (bytes--) {
wolfSSL 11:cee25a834751 534 b = input[idx++];
wolfSSL 11:cee25a834751 535 length = (length << 8) | b;
wolfSSL 11:cee25a834751 536 }
wolfSSL 11:cee25a834751 537 }
wolfSSL 11:cee25a834751 538 else
wolfSSL 11:cee25a834751 539 length = b;
wolfSSL 11:cee25a834751 540
wolfSSL 11:cee25a834751 541 if ((idx + length) > maxIdx) { /* for user of length */
wolfSSL 11:cee25a834751 542 WOLFSSL_MSG("GetLength value exceeds buffer length");
wolfSSL 11:cee25a834751 543 return BUFFER_E;
wolfSSL 11:cee25a834751 544 }
wolfSSL 11:cee25a834751 545
wolfSSL 11:cee25a834751 546 *inOutIdx = idx;
wolfSSL 11:cee25a834751 547 if (length > 0)
wolfSSL 11:cee25a834751 548 *len = length;
wolfSSL 11:cee25a834751 549
wolfSSL 11:cee25a834751 550 return length;
wolfSSL 11:cee25a834751 551 }
wolfSSL 11:cee25a834751 552
wolfSSL 11:cee25a834751 553
wolfSSL 11:cee25a834751 554 /* Get the DER/BER encoding of an ASN.1 header.
wolfSSL 11:cee25a834751 555 *
wolfSSL 11:cee25a834751 556 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 557 * tag ASN.1 tag value expected in header.
wolfSSL 11:cee25a834751 558 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 559 * len The number of bytes in the ASN.1 data.
wolfSSL 11:cee25a834751 560 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 561 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 562 * ASN_PARSE_E when the expected tag is not found or length is invalid.
wolfSSL 11:cee25a834751 563 * Otherwise, the number of bytes in the ASN.1 data.
wolfSSL 11:cee25a834751 564 */
wolfSSL 11:cee25a834751 565 static int GetASNHeader(const byte* input, byte tag, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 566 word32 maxIdx)
wolfSSL 11:cee25a834751 567 {
wolfSSL 11:cee25a834751 568 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 569 byte b;
wolfSSL 11:cee25a834751 570 int length;
wolfSSL 11:cee25a834751 571
wolfSSL 11:cee25a834751 572 if ((idx + 1) > maxIdx)
wolfSSL 11:cee25a834751 573 return BUFFER_E;
wolfSSL 11:cee25a834751 574
wolfSSL 11:cee25a834751 575 b = input[idx++];
wolfSSL 11:cee25a834751 576 if (b != tag)
wolfSSL 11:cee25a834751 577 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 578
wolfSSL 11:cee25a834751 579 if (GetLength(input, &idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 580 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 581
wolfSSL 11:cee25a834751 582 *len = length;
wolfSSL 11:cee25a834751 583 *inOutIdx = idx;
wolfSSL 11:cee25a834751 584 return length;
wolfSSL 11:cee25a834751 585 }
wolfSSL 11:cee25a834751 586
wolfSSL 11:cee25a834751 587 WOLFSSL_LOCAL int GetSequence(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 588 word32 maxIdx)
wolfSSL 11:cee25a834751 589 {
wolfSSL 11:cee25a834751 590 return GetASNHeader(input, ASN_SEQUENCE | ASN_CONSTRUCTED, inOutIdx, len,
wolfSSL 11:cee25a834751 591 maxIdx);
wolfSSL 11:cee25a834751 592 }
wolfSSL 11:cee25a834751 593
wolfSSL 11:cee25a834751 594
wolfSSL 11:cee25a834751 595 WOLFSSL_LOCAL int GetSet(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 596 word32 maxIdx)
wolfSSL 11:cee25a834751 597 {
wolfSSL 11:cee25a834751 598 return GetASNHeader(input, ASN_SET | ASN_CONSTRUCTED, inOutIdx, len,
wolfSSL 11:cee25a834751 599 maxIdx);
wolfSSL 11:cee25a834751 600 }
wolfSSL 11:cee25a834751 601
wolfSSL 11:cee25a834751 602 /* Get the DER/BER encoded ASN.1 NULL element.
wolfSSL 11:cee25a834751 603 * Ensure that the all fields are as expected and move index past the element.
wolfSSL 11:cee25a834751 604 *
wolfSSL 11:cee25a834751 605 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 606 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 607 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 608 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 609 * ASN_TAG_NULL_E when the NULL tag is not found.
wolfSSL 11:cee25a834751 610 * ASN_EXPECT_0_E when the length is not zero.
wolfSSL 11:cee25a834751 611 * Otherwise, 0 to indicate success.
wolfSSL 11:cee25a834751 612 */
wolfSSL 11:cee25a834751 613 static int GetASNNull(const byte* input, word32* inOutIdx, word32 maxIdx)
wolfSSL 11:cee25a834751 614 {
wolfSSL 11:cee25a834751 615 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 616 byte b;
wolfSSL 11:cee25a834751 617
wolfSSL 11:cee25a834751 618 if ((idx + 2) > maxIdx)
wolfSSL 11:cee25a834751 619 return BUFFER_E;
wolfSSL 11:cee25a834751 620
wolfSSL 11:cee25a834751 621 b = input[idx++];
wolfSSL 11:cee25a834751 622 if (b != ASN_TAG_NULL)
wolfSSL 11:cee25a834751 623 return ASN_TAG_NULL_E;
wolfSSL 11:cee25a834751 624
wolfSSL 11:cee25a834751 625 if (input[idx++] != 0)
wolfSSL 11:cee25a834751 626 return ASN_EXPECT_0_E;
wolfSSL 11:cee25a834751 627
wolfSSL 11:cee25a834751 628 *inOutIdx = idx;
wolfSSL 11:cee25a834751 629 return 0;
wolfSSL 11:cee25a834751 630 }
wolfSSL 11:cee25a834751 631
wolfSSL 11:cee25a834751 632 /* Set the DER/BER encoding of the ASN.1 NULL element.
wolfSSL 11:cee25a834751 633 *
wolfSSL 11:cee25a834751 634 * output Buffer to write into.
wolfSSL 11:cee25a834751 635 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 636 */
wolfSSL 11:cee25a834751 637 static int SetASNNull(byte* output)
wolfSSL 11:cee25a834751 638 {
wolfSSL 11:cee25a834751 639 output[0] = ASN_TAG_NULL;
wolfSSL 11:cee25a834751 640 output[1] = 0;
wolfSSL 11:cee25a834751 641
wolfSSL 11:cee25a834751 642 return 2;
wolfSSL 11:cee25a834751 643 }
wolfSSL 11:cee25a834751 644
wolfSSL 11:cee25a834751 645 /* Get the DER/BER encoding of an ASN.1 BOOLEAN.
wolfSSL 11:cee25a834751 646 *
wolfSSL 11:cee25a834751 647 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 648 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 649 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 650 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 651 * ASN_PARSE_E when the BOOLEAN tag is not found or length is not 1.
wolfSSL 11:cee25a834751 652 * Otherwise, 0 to indicate the value was false and 1 to indicate true.
wolfSSL 11:cee25a834751 653 */
wolfSSL 11:cee25a834751 654 static int GetBoolean(const byte* input, word32* inOutIdx, word32 maxIdx)
wolfSSL 11:cee25a834751 655 {
wolfSSL 11:cee25a834751 656 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 657 byte b;
wolfSSL 11:cee25a834751 658
wolfSSL 11:cee25a834751 659 if ((idx + 3) > maxIdx)
wolfSSL 11:cee25a834751 660 return BUFFER_E;
wolfSSL 11:cee25a834751 661
wolfSSL 11:cee25a834751 662 b = input[idx++];
wolfSSL 11:cee25a834751 663 if (b != ASN_BOOLEAN)
wolfSSL 11:cee25a834751 664 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 665
wolfSSL 11:cee25a834751 666 if (input[idx++] != 1)
wolfSSL 11:cee25a834751 667 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 668
wolfSSL 11:cee25a834751 669 b = input[idx++] != 0;
wolfSSL 11:cee25a834751 670
wolfSSL 11:cee25a834751 671 *inOutIdx = idx;
wolfSSL 11:cee25a834751 672 return b;
wolfSSL 11:cee25a834751 673 }
wolfSSL 11:cee25a834751 674
wolfSSL 11:cee25a834751 675 #ifdef ASN1_SET_BOOLEAN
wolfSSL 11:cee25a834751 676 /* Set the DER/BER encoding of the ASN.1 NULL element.
wolfSSL 11:cee25a834751 677 * Note: Function not required as yet.
wolfSSL 11:cee25a834751 678 *
wolfSSL 11:cee25a834751 679 * val Boolean value to encode.
wolfSSL 11:cee25a834751 680 * output Buffer to write into.
wolfSSL 11:cee25a834751 681 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 682 */
wolfSSL 11:cee25a834751 683 static int SetBoolean(int val, byte* output)
wolfSSL 11:cee25a834751 684 {
wolfSSL 11:cee25a834751 685 output[0] = ASN_BOOLEAN;
wolfSSL 11:cee25a834751 686 output[1] = 1;
wolfSSL 11:cee25a834751 687 output[2] = val ? -1 : 0;
wolfSSL 11:cee25a834751 688
wolfSSL 11:cee25a834751 689 return 3;
wolfSSL 11:cee25a834751 690 }
wolfSSL 11:cee25a834751 691 #endif
wolfSSL 11:cee25a834751 692
wolfSSL 11:cee25a834751 693 /* Get the DER/BER encoding of an ASN.1 OCTET_STRING header.
wolfSSL 11:cee25a834751 694 *
wolfSSL 11:cee25a834751 695 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 696 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 697 * len The number of bytes in the ASN.1 data.
wolfSSL 11:cee25a834751 698 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 699 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 700 * ASN_PARSE_E when the OCTET_STRING tag is not found or length is
wolfSSL 11:cee25a834751 701 * invalid.
wolfSSL 11:cee25a834751 702 * Otherwise, the number of bytes in the ASN.1 data.
wolfSSL 11:cee25a834751 703 */
wolfSSL 11:cee25a834751 704 static int GetOctetString(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 705 word32 maxIdx)
wolfSSL 11:cee25a834751 706 {
wolfSSL 11:cee25a834751 707 return GetASNHeader(input, ASN_OCTET_STRING, inOutIdx, len, maxIdx);
wolfSSL 11:cee25a834751 708 }
wolfSSL 11:cee25a834751 709
wolfSSL 11:cee25a834751 710 /* Get the DER/BER encoding of an ASN.1 INTEGER header.
wolfSSL 11:cee25a834751 711 * Removes the leading zero byte when found.
wolfSSL 11:cee25a834751 712 *
wolfSSL 11:cee25a834751 713 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 714 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 715 * len The number of bytes in the ASN.1 data (excluding any leading zero).
wolfSSL 11:cee25a834751 716 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 717 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 718 * ASN_PARSE_E when the INTEGER tag is not found, length is invalid,
wolfSSL 11:cee25a834751 719 * or invalid use of or missing leading zero.
wolfSSL 11:cee25a834751 720 * Otherwise, 0 to indicate success.
wolfSSL 11:cee25a834751 721 */
wolfSSL 11:cee25a834751 722 static int GetASNInt(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 723 word32 maxIdx)
wolfSSL 11:cee25a834751 724 {
wolfSSL 11:cee25a834751 725 int ret;
wolfSSL 11:cee25a834751 726
wolfSSL 11:cee25a834751 727 ret = GetASNHeader(input, ASN_INTEGER, inOutIdx, len, maxIdx);
wolfSSL 11:cee25a834751 728 if (ret < 0)
wolfSSL 11:cee25a834751 729 return ret;
wolfSSL 11:cee25a834751 730
wolfSSL 11:cee25a834751 731 if (*len > 0) {
wolfSSL 11:cee25a834751 732 /* remove leading zero, unless there is only one 0x00 byte */
wolfSSL 11:cee25a834751 733 if ((input[*inOutIdx] == 0x00) && (*len > 1)) {
wolfSSL 11:cee25a834751 734 (*inOutIdx)++;
wolfSSL 11:cee25a834751 735 (*len)--;
wolfSSL 11:cee25a834751 736
wolfSSL 11:cee25a834751 737 if (*len > 0 && (input[*inOutIdx] & 0x80) == 0)
wolfSSL 11:cee25a834751 738 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 739 }
wolfSSL 11:cee25a834751 740 else if ((input[*inOutIdx] & 0x80) == 0x80)
wolfSSL 11:cee25a834751 741 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 742 }
wolfSSL 11:cee25a834751 743
wolfSSL 11:cee25a834751 744 return 0;
wolfSSL 11:cee25a834751 745 }
wolfSSL 11:cee25a834751 746
wolfSSL 11:cee25a834751 747 /* Get the DER/BER encoding of an ASN.1 INTEGER that has a value of no more than
wolfSSL 11:cee25a834751 748 * 7 bits.
wolfSSL 11:cee25a834751 749 *
wolfSSL 11:cee25a834751 750 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 751 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 752 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 753 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 754 * ASN_PARSE_E when the INTEGER tag is not found or length is invalid.
wolfSSL 11:cee25a834751 755 * Otherwise, the 7-bit value.
wolfSSL 11:cee25a834751 756 */
wolfSSL 11:cee25a834751 757 static int GetInteger7Bit(const byte* input, word32* inOutIdx, word32 maxIdx)
wolfSSL 11:cee25a834751 758 {
wolfSSL 11:cee25a834751 759 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 760 byte b;
wolfSSL 11:cee25a834751 761
wolfSSL 11:cee25a834751 762 if ((idx + 3) > maxIdx)
wolfSSL 11:cee25a834751 763 return BUFFER_E;
wolfSSL 11:cee25a834751 764
wolfSSL 11:cee25a834751 765 if (input[idx++] != ASN_INTEGER)
wolfSSL 11:cee25a834751 766 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 767 if (input[idx++] != 1)
wolfSSL 11:cee25a834751 768 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 769 b = input[idx++];
wolfSSL 11:cee25a834751 770
wolfSSL 11:cee25a834751 771 *inOutIdx = idx;
wolfSSL 11:cee25a834751 772 return b;
wolfSSL 11:cee25a834751 773 }
wolfSSL 11:cee25a834751 774
wolfSSL 11:cee25a834751 775 #if !defined(NO_DSA) || defined(HAVE_ECC) || (!defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || (defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA))))
wolfSSL 11:cee25a834751 776 /* Set the DER/BER encoding of the ASN.1 INTEGER header.
wolfSSL 11:cee25a834751 777 *
wolfSSL 11:cee25a834751 778 * len Length of data to encode.
wolfSSL 11:cee25a834751 779 * firstByte First byte of data, most significant byte of integer, to encode.
wolfSSL 11:cee25a834751 780 * output Buffer to write into.
wolfSSL 11:cee25a834751 781 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 782 */
wolfSSL 11:cee25a834751 783 static int SetASNInt(int len, byte firstByte, byte* output)
wolfSSL 11:cee25a834751 784 {
wolfSSL 11:cee25a834751 785 word32 idx = 0;
wolfSSL 11:cee25a834751 786
wolfSSL 11:cee25a834751 787 output[idx++] = ASN_INTEGER;
wolfSSL 11:cee25a834751 788 if (firstByte & 0x80)
wolfSSL 11:cee25a834751 789 len++;
wolfSSL 11:cee25a834751 790 idx += SetLength(len, output + idx);
wolfSSL 11:cee25a834751 791 if (firstByte & 0x80)
wolfSSL 11:cee25a834751 792 output[idx++] = 0x00;
wolfSSL 11:cee25a834751 793
wolfSSL 11:cee25a834751 794 return idx;
wolfSSL 11:cee25a834751 795 }
wolfSSL 11:cee25a834751 796 #endif
wolfSSL 11:cee25a834751 797
wolfSSL 11:cee25a834751 798 #if !defined(NO_DSA) || defined(HAVE_ECC) || (defined(WOLFSSL_KEY_GEN) && !defined(NO_RSA) && !defined(HAVE_USER_RSA))
wolfSSL 11:cee25a834751 799 /* Set the DER/BER encoding of the ASN.1 INTEGER element with an mp_int.
wolfSSL 11:cee25a834751 800 * The number is assumed to be positive.
wolfSSL 11:cee25a834751 801 *
wolfSSL 11:cee25a834751 802 * n Multi-precision integer to encode.
wolfSSL 11:cee25a834751 803 * maxSz Maximum size of the encoded integer.
wolfSSL 11:cee25a834751 804 * A negative value indicates no check of length requested.
wolfSSL 11:cee25a834751 805 * output Buffer to write into.
wolfSSL 11:cee25a834751 806 * returns BUFFER_E when the data is too long for the buffer.
wolfSSL 11:cee25a834751 807 * MP_TO_E when encoding the integer fails.
wolfSSL 11:cee25a834751 808 * Otherwise, the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 809 */
wolfSSL 11:cee25a834751 810 static int SetASNIntMP(mp_int* n, int maxSz, byte* output)
wolfSSL 11:cee25a834751 811 {
wolfSSL 11:cee25a834751 812 int idx = 0;
wolfSSL 11:cee25a834751 813 int leadingBit;
wolfSSL 11:cee25a834751 814 int length;
wolfSSL 11:cee25a834751 815 int err;
wolfSSL 11:cee25a834751 816
wolfSSL 11:cee25a834751 817 leadingBit = mp_leading_bit(n);
wolfSSL 11:cee25a834751 818 length = mp_unsigned_bin_size(n);
wolfSSL 11:cee25a834751 819 idx = SetASNInt(length, leadingBit ? 0x80 : 0x00, output);
wolfSSL 11:cee25a834751 820 if (maxSz >= 0 && (idx + length) > maxSz)
wolfSSL 11:cee25a834751 821 return BUFFER_E;
wolfSSL 11:cee25a834751 822
wolfSSL 11:cee25a834751 823 err = mp_to_unsigned_bin(n, output + idx);
wolfSSL 11:cee25a834751 824 if (err != MP_OKAY)
wolfSSL 11:cee25a834751 825 return MP_TO_E;
wolfSSL 11:cee25a834751 826 idx += length;
wolfSSL 11:cee25a834751 827
wolfSSL 11:cee25a834751 828 return idx;
wolfSSL 11:cee25a834751 829 }
wolfSSL 11:cee25a834751 830 #endif
wolfSSL 11:cee25a834751 831
wolfSSL 11:cee25a834751 832 #if !defined(NO_RSA) && defined(HAVE_USER_RSA) && defined(WOLFSSL_CERT_GEN)
wolfSSL 11:cee25a834751 833 /* Set the DER/BER encoding of the ASN.1 INTEGER element with an mp_int from
wolfSSL 11:cee25a834751 834 * an RSA key.
wolfSSL 11:cee25a834751 835 * The number is assumed to be positive.
wolfSSL 11:cee25a834751 836 *
wolfSSL 11:cee25a834751 837 * n Multi-precision integer to encode.
wolfSSL 11:cee25a834751 838 * output Buffer to write into.
wolfSSL 11:cee25a834751 839 * returns BUFFER_E when the data is too long for the buffer.
wolfSSL 11:cee25a834751 840 * MP_TO_E when encoding the integer fails.
wolfSSL 11:cee25a834751 841 * Otherwise, the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 842 */
wolfSSL 11:cee25a834751 843 static int SetASNIntRSA(mp_int* n, byte* output)
wolfSSL 11:cee25a834751 844 {
wolfSSL 11:cee25a834751 845 int idx = 0;
wolfSSL 11:cee25a834751 846 int leadingBit;
wolfSSL 11:cee25a834751 847 int length;
wolfSSL 11:cee25a834751 848 int err;
wolfSSL 11:cee25a834751 849
wolfSSL 11:cee25a834751 850 leadingBit = wc_Rsa_leading_bit(n);
wolfSSL 11:cee25a834751 851 length = wc_Rsa_unsigned_bin_size(n);
wolfSSL 11:cee25a834751 852 idx = SetASNInt(length, leadingBit ? 0x80 : 0x00, output);
wolfSSL 11:cee25a834751 853 if ((idx + length) > MAX_RSA_INT_SZ)
wolfSSL 11:cee25a834751 854 return BUFFER_E;
wolfSSL 11:cee25a834751 855
wolfSSL 11:cee25a834751 856 err = wc_Rsa_to_unsigned_bin(n, output + idx, length);
wolfSSL 11:cee25a834751 857 if (err != MP_OKAY)
wolfSSL 11:cee25a834751 858 return MP_TO_E;
wolfSSL 11:cee25a834751 859 idx += length;
wolfSSL 11:cee25a834751 860
wolfSSL 11:cee25a834751 861 return idx;
wolfSSL 11:cee25a834751 862 }
wolfSSL 11:cee25a834751 863 #endif /* !NO_RSA && (WOLFSSL_CERT_GEN || (WOLFSSL_KEY_GEN &&
wolfSSL 11:cee25a834751 864 !HAVE_USER_RSA))) */
wolfSSL 11:cee25a834751 865
wolfSSL 11:cee25a834751 866 /* Windows header clash for WinCE using GetVersion */
wolfSSL 11:cee25a834751 867 WOLFSSL_LOCAL int GetMyVersion(const byte* input, word32* inOutIdx,
wolfSSL 11:cee25a834751 868 int* version, word32 maxIdx)
wolfSSL 11:cee25a834751 869 {
wolfSSL 11:cee25a834751 870 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 871
wolfSSL 11:cee25a834751 872 if ((idx + MIN_VERSION_SZ) > maxIdx)
wolfSSL 11:cee25a834751 873 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 874
wolfSSL 11:cee25a834751 875 if (input[idx++] != ASN_INTEGER)
wolfSSL 11:cee25a834751 876 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 877
wolfSSL 11:cee25a834751 878 if (input[idx++] != 0x01)
wolfSSL 11:cee25a834751 879 return ASN_VERSION_E;
wolfSSL 11:cee25a834751 880
wolfSSL 11:cee25a834751 881 *version = input[idx++];
wolfSSL 11:cee25a834751 882 *inOutIdx = idx;
wolfSSL 11:cee25a834751 883
wolfSSL 11:cee25a834751 884 return *version;
wolfSSL 11:cee25a834751 885 }
wolfSSL 11:cee25a834751 886
wolfSSL 11:cee25a834751 887
wolfSSL 11:cee25a834751 888 #ifndef NO_PWDBASED
wolfSSL 11:cee25a834751 889 /* Get small count integer, 32 bits or less */
wolfSSL 11:cee25a834751 890 int GetShortInt(const byte* input, word32* inOutIdx, int* number, word32 maxIdx)
wolfSSL 11:cee25a834751 891 {
wolfSSL 11:cee25a834751 892 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 893 word32 len;
wolfSSL 11:cee25a834751 894
wolfSSL 11:cee25a834751 895 *number = 0;
wolfSSL 11:cee25a834751 896
wolfSSL 11:cee25a834751 897 /* check for type and length bytes */
wolfSSL 11:cee25a834751 898 if ((idx + 2) > maxIdx)
wolfSSL 11:cee25a834751 899 return BUFFER_E;
wolfSSL 11:cee25a834751 900
wolfSSL 11:cee25a834751 901 if (input[idx++] != ASN_INTEGER)
wolfSSL 11:cee25a834751 902 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 903
wolfSSL 11:cee25a834751 904 len = input[idx++];
wolfSSL 11:cee25a834751 905 if (len > 4)
wolfSSL 11:cee25a834751 906 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 907
wolfSSL 11:cee25a834751 908 if (len + idx > maxIdx)
wolfSSL 11:cee25a834751 909 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 910
wolfSSL 11:cee25a834751 911 while (len--) {
wolfSSL 11:cee25a834751 912 *number = *number << 8 | input[idx++];
wolfSSL 11:cee25a834751 913 }
wolfSSL 11:cee25a834751 914
wolfSSL 11:cee25a834751 915 *inOutIdx = idx;
wolfSSL 11:cee25a834751 916
wolfSSL 11:cee25a834751 917 return *number;
wolfSSL 11:cee25a834751 918 }
wolfSSL 11:cee25a834751 919 #endif /* !NO_PWDBASED */
wolfSSL 11:cee25a834751 920
wolfSSL 11:cee25a834751 921 /* May not have one, not an error */
wolfSSL 11:cee25a834751 922 static int GetExplicitVersion(const byte* input, word32* inOutIdx, int* version,
wolfSSL 11:cee25a834751 923 word32 maxIdx)
wolfSSL 11:cee25a834751 924 {
wolfSSL 11:cee25a834751 925 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 926
wolfSSL 11:cee25a834751 927 WOLFSSL_ENTER("GetExplicitVersion");
wolfSSL 11:cee25a834751 928
wolfSSL 11:cee25a834751 929 if ((idx + 1) > maxIdx)
wolfSSL 11:cee25a834751 930 return BUFFER_E;
wolfSSL 11:cee25a834751 931
wolfSSL 11:cee25a834751 932 if (input[idx++] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) {
wolfSSL 11:cee25a834751 933 *inOutIdx = ++idx; /* skip header */
wolfSSL 11:cee25a834751 934 return GetMyVersion(input, inOutIdx, version, maxIdx);
wolfSSL 11:cee25a834751 935 }
wolfSSL 11:cee25a834751 936
wolfSSL 11:cee25a834751 937 /* go back as is */
wolfSSL 11:cee25a834751 938 *version = 0;
wolfSSL 11:cee25a834751 939
wolfSSL 11:cee25a834751 940 return 0;
wolfSSL 11:cee25a834751 941 }
wolfSSL 11:cee25a834751 942
wolfSSL 11:cee25a834751 943 int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx, word32 maxIdx)
wolfSSL 11:cee25a834751 944 {
wolfSSL 11:cee25a834751 945 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 946 int ret;
wolfSSL 11:cee25a834751 947 int length;
wolfSSL 11:cee25a834751 948
wolfSSL 11:cee25a834751 949 ret = GetASNInt(input, &idx, &length, maxIdx);
wolfSSL 11:cee25a834751 950 if (ret != 0)
wolfSSL 11:cee25a834751 951 return ret;
wolfSSL 11:cee25a834751 952
wolfSSL 11:cee25a834751 953 if (mp_init(mpi) != MP_OKAY)
wolfSSL 11:cee25a834751 954 return MP_INIT_E;
wolfSSL 11:cee25a834751 955
wolfSSL 11:cee25a834751 956 if (mp_read_unsigned_bin(mpi, (byte*)input + idx, length) != 0) {
wolfSSL 11:cee25a834751 957 mp_clear(mpi);
wolfSSL 11:cee25a834751 958 return ASN_GETINT_E;
wolfSSL 11:cee25a834751 959 }
wolfSSL 11:cee25a834751 960
wolfSSL 11:cee25a834751 961 #ifdef HAVE_WOLF_BIGINT
wolfSSL 11:cee25a834751 962 if (wc_bigint_from_unsigned_bin(&mpi->raw, input + idx, length) != 0) {
wolfSSL 11:cee25a834751 963 mp_clear(mpi);
wolfSSL 11:cee25a834751 964 return ASN_GETINT_E;
wolfSSL 11:cee25a834751 965 }
wolfSSL 11:cee25a834751 966 #endif /* HAVE_WOLF_BIGINT */
wolfSSL 11:cee25a834751 967
wolfSSL 11:cee25a834751 968 *inOutIdx = idx + length;
wolfSSL 11:cee25a834751 969
wolfSSL 11:cee25a834751 970 return 0;
wolfSSL 11:cee25a834751 971 }
wolfSSL 11:cee25a834751 972
wolfSSL 11:cee25a834751 973 static int CheckBitString(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 974 word32 maxIdx, int zeroBits, byte* unusedBits)
wolfSSL 11:cee25a834751 975 {
wolfSSL 11:cee25a834751 976 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 977 int length;
wolfSSL 11:cee25a834751 978 byte b;
wolfSSL 11:cee25a834751 979
wolfSSL 11:cee25a834751 980 if ((idx + 1) > maxIdx)
wolfSSL 11:cee25a834751 981 return BUFFER_E;
wolfSSL 11:cee25a834751 982
wolfSSL 11:cee25a834751 983 if (input[idx++] != ASN_BIT_STRING)
wolfSSL 11:cee25a834751 984 return ASN_BITSTR_E;
wolfSSL 11:cee25a834751 985
wolfSSL 11:cee25a834751 986 if (GetLength(input, &idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 987 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 988
wolfSSL 11:cee25a834751 989 /* extra sanity check that length is greater than 0 */
wolfSSL 11:cee25a834751 990 if (length <= 0) {
wolfSSL 11:cee25a834751 991 WOLFSSL_MSG("Error length was 0 in CheckBitString");
wolfSSL 11:cee25a834751 992 return BUFFER_E;
wolfSSL 11:cee25a834751 993 }
wolfSSL 11:cee25a834751 994
wolfSSL 11:cee25a834751 995 if (idx + 1 > maxIdx) {
wolfSSL 11:cee25a834751 996 WOLFSSL_MSG("Attempted buffer read larger than input buffer");
wolfSSL 11:cee25a834751 997 return BUFFER_E;
wolfSSL 11:cee25a834751 998 }
wolfSSL 11:cee25a834751 999
wolfSSL 11:cee25a834751 1000 b = input[idx];
wolfSSL 11:cee25a834751 1001 if (zeroBits && b != 0x00)
wolfSSL 11:cee25a834751 1002 return ASN_EXPECT_0_E;
wolfSSL 11:cee25a834751 1003 if (b >= 0x08)
wolfSSL 11:cee25a834751 1004 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1005 if (b != 0) {
wolfSSL 11:cee25a834751 1006 if ((byte)(input[idx + length - 1] << (8 - b)) != 0)
wolfSSL 11:cee25a834751 1007 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1008 if (((input[idx + length - 1] >> b) & 0x01) != 0x01)
wolfSSL 11:cee25a834751 1009 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1010 }
wolfSSL 11:cee25a834751 1011 idx++;
wolfSSL 11:cee25a834751 1012 length--; /* length has been checked for greater than 0 */
wolfSSL 11:cee25a834751 1013
wolfSSL 11:cee25a834751 1014 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1015 if (len != NULL)
wolfSSL 11:cee25a834751 1016 *len = length;
wolfSSL 11:cee25a834751 1017 if (unusedBits != NULL)
wolfSSL 11:cee25a834751 1018 *unusedBits = b;
wolfSSL 11:cee25a834751 1019
wolfSSL 11:cee25a834751 1020 return 0;
wolfSSL 11:cee25a834751 1021 }
wolfSSL 11:cee25a834751 1022
wolfSSL 11:cee25a834751 1023 #if (!defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \
wolfSSL 11:cee25a834751 1024 (defined(WOLFSSL_KEY_GEN) && \
wolfSSL 11:cee25a834751 1025 !defined(HAVE_USER_RSA)))) || \
wolfSSL 11:cee25a834751 1026 (defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || \
wolfSSL 11:cee25a834751 1027 defined(WOLFSSL_KEY_GEN)))
wolfSSL 11:cee25a834751 1028 /* Set the DER/BER encoding of the ASN.1 BIT_STRING header.
wolfSSL 11:cee25a834751 1029 *
wolfSSL 11:cee25a834751 1030 * len Length of data to encode.
wolfSSL 11:cee25a834751 1031 * unusedBits The number of unused bits in the last byte of data.
wolfSSL 11:cee25a834751 1032 * That is, the number of least significant zero bits before a one.
wolfSSL 11:cee25a834751 1033 * The last byte is the most-significant non-zero byte of a number.
wolfSSL 11:cee25a834751 1034 * output Buffer to write into.
wolfSSL 11:cee25a834751 1035 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 1036 */
wolfSSL 11:cee25a834751 1037 static word32 SetBitString(word32 len, byte unusedBits, byte* output)
wolfSSL 11:cee25a834751 1038 {
wolfSSL 11:cee25a834751 1039 word32 idx = 0;
wolfSSL 11:cee25a834751 1040
wolfSSL 11:cee25a834751 1041 output[idx++] = ASN_BIT_STRING;
wolfSSL 11:cee25a834751 1042 idx += SetLength(len + 1, output + idx);
wolfSSL 11:cee25a834751 1043 output[idx++] = unusedBits;
wolfSSL 11:cee25a834751 1044
wolfSSL 11:cee25a834751 1045 return idx;
wolfSSL 11:cee25a834751 1046 }
wolfSSL 11:cee25a834751 1047
wolfSSL 11:cee25a834751 1048 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 1049 /* Set the DER/BER encoding of the ASN.1 BIT_STRING with a 16-bit value.
wolfSSL 11:cee25a834751 1050 *
wolfSSL 11:cee25a834751 1051 * val 16-bit value to encode.
wolfSSL 11:cee25a834751 1052 * output Buffer to write into.
wolfSSL 11:cee25a834751 1053 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 1054 */
wolfSSL 11:cee25a834751 1055 static word32 SetBitString16Bit(word16 val, byte* output)
wolfSSL 11:cee25a834751 1056 {
wolfSSL 11:cee25a834751 1057 word32 idx;
wolfSSL 11:cee25a834751 1058 int len;
wolfSSL 11:cee25a834751 1059 byte lastByte;
wolfSSL 11:cee25a834751 1060 byte unusedBits = 0;
wolfSSL 11:cee25a834751 1061
wolfSSL 11:cee25a834751 1062 if ((val >> 8) != 0) {
wolfSSL 11:cee25a834751 1063 len = 2;
wolfSSL 11:cee25a834751 1064 lastByte = (byte)(val >> 8);
wolfSSL 11:cee25a834751 1065 }
wolfSSL 11:cee25a834751 1066 else {
wolfSSL 11:cee25a834751 1067 len = 1;
wolfSSL 11:cee25a834751 1068 lastByte = (byte)val;
wolfSSL 11:cee25a834751 1069 }
wolfSSL 11:cee25a834751 1070
wolfSSL 11:cee25a834751 1071 while (((lastByte >> unusedBits) & 0x01) == 0x00)
wolfSSL 11:cee25a834751 1072 unusedBits++;
wolfSSL 11:cee25a834751 1073
wolfSSL 11:cee25a834751 1074 idx = SetBitString(len, unusedBits, output);
wolfSSL 11:cee25a834751 1075 output[idx++] = (byte)val;
wolfSSL 11:cee25a834751 1076 output[idx++] = (byte)(val >> 8);
wolfSSL 11:cee25a834751 1077
wolfSSL 11:cee25a834751 1078 return idx;
wolfSSL 11:cee25a834751 1079 }
wolfSSL 11:cee25a834751 1080 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 1081 #endif /* !NO_RSA && (WOLFSSL_CERT_GEN || (WOLFSSL_KEY_GEN &&
wolfSSL 11:cee25a834751 1082 !HAVE_USER_RSA)) */
wolfSSL 11:cee25a834751 1083
wolfSSL 11:cee25a834751 1084
wolfSSL 11:cee25a834751 1085
wolfSSL 11:cee25a834751 1086 /* hashType */
wolfSSL 11:cee25a834751 1087 static const byte hashMd2hOid[] = {42, 134, 72, 134, 247, 13, 2, 2};
wolfSSL 11:cee25a834751 1088 static const byte hashMd5hOid[] = {42, 134, 72, 134, 247, 13, 2, 5};
wolfSSL 11:cee25a834751 1089 static const byte hashSha1hOid[] = {43, 14, 3, 2, 26};
wolfSSL 11:cee25a834751 1090 static const byte hashSha224hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 4};
wolfSSL 11:cee25a834751 1091 static const byte hashSha256hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 1};
wolfSSL 11:cee25a834751 1092 static const byte hashSha384hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 2};
wolfSSL 11:cee25a834751 1093 static const byte hashSha512hOid[] = {96, 134, 72, 1, 101, 3, 4, 2, 3};
wolfSSL 11:cee25a834751 1094
wolfSSL 11:cee25a834751 1095 /* sigType */
wolfSSL 11:cee25a834751 1096 #ifndef NO_DSA
wolfSSL 11:cee25a834751 1097 static const byte sigSha1wDsaOid[] = {42, 134, 72, 206, 56, 4, 3};
wolfSSL 11:cee25a834751 1098 #endif /* NO_DSA */
wolfSSL 11:cee25a834751 1099 #ifndef NO_RSA
wolfSSL 11:cee25a834751 1100 static const byte sigMd2wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 2};
wolfSSL 11:cee25a834751 1101 static const byte sigMd5wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 4};
wolfSSL 11:cee25a834751 1102 static const byte sigSha1wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 5};
wolfSSL 11:cee25a834751 1103 static const byte sigSha224wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,14};
wolfSSL 11:cee25a834751 1104 static const byte sigSha256wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,11};
wolfSSL 11:cee25a834751 1105 static const byte sigSha384wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,12};
wolfSSL 11:cee25a834751 1106 static const byte sigSha512wRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1,13};
wolfSSL 11:cee25a834751 1107 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 1108 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1109 static const byte sigSha1wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 1};
wolfSSL 11:cee25a834751 1110 static const byte sigSha224wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 1};
wolfSSL 11:cee25a834751 1111 static const byte sigSha256wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 2};
wolfSSL 11:cee25a834751 1112 static const byte sigSha384wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 3};
wolfSSL 11:cee25a834751 1113 static const byte sigSha512wEcdsaOid[] = {42, 134, 72, 206, 61, 4, 3, 4};
wolfSSL 11:cee25a834751 1114 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1115
wolfSSL 11:cee25a834751 1116 /* keyType */
wolfSSL 11:cee25a834751 1117 #ifndef NO_DSA
wolfSSL 11:cee25a834751 1118 static const byte keyDsaOid[] = {42, 134, 72, 206, 56, 4, 1};
wolfSSL 11:cee25a834751 1119 #endif /* NO_DSA */
wolfSSL 11:cee25a834751 1120 #ifndef NO_RSA
wolfSSL 11:cee25a834751 1121 static const byte keyRsaOid[] = {42, 134, 72, 134, 247, 13, 1, 1, 1};
wolfSSL 11:cee25a834751 1122 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 1123 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 1124 static const byte keyNtruOid[] = {43, 6, 1, 4, 1, 193, 22, 1, 1, 1, 1};
wolfSSL 11:cee25a834751 1125 #endif /* HAVE_NTRU */
wolfSSL 11:cee25a834751 1126 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1127 static const byte keyEcdsaOid[] = {42, 134, 72, 206, 61, 2, 1};
wolfSSL 11:cee25a834751 1128 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1129
wolfSSL 11:cee25a834751 1130 /* curveType */
wolfSSL 11:cee25a834751 1131 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1132 /* See "ecc_sets" table in ecc.c */
wolfSSL 11:cee25a834751 1133 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1134
wolfSSL 11:cee25a834751 1135 /* blkType */
wolfSSL 11:cee25a834751 1136 static const byte blkAes128CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 2};
wolfSSL 11:cee25a834751 1137 static const byte blkAes192CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 22};
wolfSSL 11:cee25a834751 1138 static const byte blkAes256CbcOid[] = {96, 134, 72, 1, 101, 3, 4, 1, 42};
wolfSSL 11:cee25a834751 1139 static const byte blkDesCbcOid[] = {43, 14, 3, 2, 7};
wolfSSL 11:cee25a834751 1140 static const byte blkDes3CbcOid[] = {42, 134, 72, 134, 247, 13, 3, 7};
wolfSSL 11:cee25a834751 1141
wolfSSL 11:cee25a834751 1142 /* keyWrapType */
wolfSSL 11:cee25a834751 1143 static const byte wrapAes128Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 5};
wolfSSL 11:cee25a834751 1144 static const byte wrapAes192Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 25};
wolfSSL 11:cee25a834751 1145 static const byte wrapAes256Oid[] = {96, 134, 72, 1, 101, 3, 4, 1, 45};
wolfSSL 11:cee25a834751 1146
wolfSSL 11:cee25a834751 1147 /* cmsKeyAgreeType */
wolfSSL 11:cee25a834751 1148 static const byte dhSinglePass_stdDH_sha1kdf_Oid[] =
wolfSSL 11:cee25a834751 1149 {43, 129, 5, 16, 134, 72, 63, 0, 2};
wolfSSL 11:cee25a834751 1150 static const byte dhSinglePass_stdDH_sha224kdf_Oid[] = {43, 129, 4, 1, 11, 0};
wolfSSL 11:cee25a834751 1151 static const byte dhSinglePass_stdDH_sha256kdf_Oid[] = {43, 129, 4, 1, 11, 1};
wolfSSL 11:cee25a834751 1152 static const byte dhSinglePass_stdDH_sha384kdf_Oid[] = {43, 129, 4, 1, 11, 2};
wolfSSL 11:cee25a834751 1153 static const byte dhSinglePass_stdDH_sha512kdf_Oid[] = {43, 129, 4, 1, 11, 3};
wolfSSL 11:cee25a834751 1154
wolfSSL 11:cee25a834751 1155 /* ocspType */
wolfSSL 11:cee25a834751 1156 #ifdef HAVE_OCSP
wolfSSL 11:cee25a834751 1157 static const byte ocspBasicOid[] = {43, 6, 1, 5, 5, 7, 48, 1, 1};
wolfSSL 11:cee25a834751 1158 static const byte ocspNonceOid[] = {43, 6, 1, 5, 5, 7, 48, 1, 2};
wolfSSL 11:cee25a834751 1159 #endif /* HAVE_OCSP */
wolfSSL 11:cee25a834751 1160
wolfSSL 11:cee25a834751 1161 /* certExtType */
wolfSSL 11:cee25a834751 1162 static const byte extBasicCaOid[] = {85, 29, 19};
wolfSSL 11:cee25a834751 1163 static const byte extAltNamesOid[] = {85, 29, 17};
wolfSSL 11:cee25a834751 1164 static const byte extCrlDistOid[] = {85, 29, 31};
wolfSSL 11:cee25a834751 1165 static const byte extAuthInfoOid[] = {43, 6, 1, 5, 5, 7, 1, 1};
wolfSSL 11:cee25a834751 1166 static const byte extAuthKeyOid[] = {85, 29, 35};
wolfSSL 11:cee25a834751 1167 static const byte extSubjKeyOid[] = {85, 29, 14};
wolfSSL 11:cee25a834751 1168 static const byte extCertPolicyOid[] = {85, 29, 32};
wolfSSL 11:cee25a834751 1169 static const byte extKeyUsageOid[] = {85, 29, 15};
wolfSSL 11:cee25a834751 1170 static const byte extInhibitAnyOid[] = {85, 29, 54};
wolfSSL 11:cee25a834751 1171 static const byte extExtKeyUsageOid[] = {85, 29, 37};
wolfSSL 11:cee25a834751 1172 static const byte extNameConsOid[] = {85, 29, 30};
wolfSSL 11:cee25a834751 1173
wolfSSL 11:cee25a834751 1174 /* certAuthInfoType */
wolfSSL 11:cee25a834751 1175 static const byte extAuthInfoOcspOid[] = {43, 6, 1, 5, 5, 7, 48, 1};
wolfSSL 11:cee25a834751 1176 static const byte extAuthInfoCaIssuerOid[] = {43, 6, 1, 5, 5, 7, 48, 2};
wolfSSL 11:cee25a834751 1177
wolfSSL 11:cee25a834751 1178 /* certPolicyType */
wolfSSL 11:cee25a834751 1179 static const byte extCertPolicyAnyOid[] = {85, 29, 32, 0};
wolfSSL 11:cee25a834751 1180
wolfSSL 11:cee25a834751 1181 /* certKeyUseType */
wolfSSL 11:cee25a834751 1182 static const byte extAltNamesHwNameOid[] = {43, 6, 1, 5, 5, 7, 8, 4};
wolfSSL 11:cee25a834751 1183
wolfSSL 11:cee25a834751 1184 /* certKeyUseType */
wolfSSL 11:cee25a834751 1185 static const byte extExtKeyUsageAnyOid[] = {85, 29, 37, 0};
wolfSSL 11:cee25a834751 1186 static const byte extExtKeyUsageServerAuthOid[] = {43, 6, 1, 5, 5, 7, 3, 1};
wolfSSL 11:cee25a834751 1187 static const byte extExtKeyUsageClientAuthOid[] = {43, 6, 1, 5, 5, 7, 3, 2};
wolfSSL 11:cee25a834751 1188 static const byte extExtKeyUsageOcspSignOid[] = {43, 6, 1, 5, 5, 7, 3, 9};
wolfSSL 11:cee25a834751 1189
wolfSSL 11:cee25a834751 1190 /* kdfType */
wolfSSL 11:cee25a834751 1191 static const byte pbkdf2Oid[] = {42, 134, 72, 134, 247, 13, 1, 5, 12};
wolfSSL 11:cee25a834751 1192
wolfSSL 11:cee25a834751 1193 static const byte* OidFromId(word32 id, word32 type, word32* oidSz)
wolfSSL 11:cee25a834751 1194 {
wolfSSL 11:cee25a834751 1195 const byte* oid = NULL;
wolfSSL 11:cee25a834751 1196
wolfSSL 11:cee25a834751 1197 *oidSz = 0;
wolfSSL 11:cee25a834751 1198
wolfSSL 11:cee25a834751 1199 switch (type) {
wolfSSL 11:cee25a834751 1200
wolfSSL 11:cee25a834751 1201 case oidHashType:
wolfSSL 11:cee25a834751 1202 switch (id) {
wolfSSL 11:cee25a834751 1203 case MD2h:
wolfSSL 11:cee25a834751 1204 oid = hashMd2hOid;
wolfSSL 11:cee25a834751 1205 *oidSz = sizeof(hashMd2hOid);
wolfSSL 11:cee25a834751 1206 break;
wolfSSL 11:cee25a834751 1207 case MD5h:
wolfSSL 11:cee25a834751 1208 oid = hashMd5hOid;
wolfSSL 11:cee25a834751 1209 *oidSz = sizeof(hashMd5hOid);
wolfSSL 11:cee25a834751 1210 break;
wolfSSL 11:cee25a834751 1211 case SHAh:
wolfSSL 11:cee25a834751 1212 oid = hashSha1hOid;
wolfSSL 11:cee25a834751 1213 *oidSz = sizeof(hashSha1hOid);
wolfSSL 11:cee25a834751 1214 break;
wolfSSL 11:cee25a834751 1215 case SHA224h:
wolfSSL 11:cee25a834751 1216 oid = hashSha224hOid;
wolfSSL 11:cee25a834751 1217 *oidSz = sizeof(hashSha224hOid);
wolfSSL 11:cee25a834751 1218 break;
wolfSSL 11:cee25a834751 1219 case SHA256h:
wolfSSL 11:cee25a834751 1220 oid = hashSha256hOid;
wolfSSL 11:cee25a834751 1221 *oidSz = sizeof(hashSha256hOid);
wolfSSL 11:cee25a834751 1222 break;
wolfSSL 11:cee25a834751 1223 case SHA384h:
wolfSSL 11:cee25a834751 1224 oid = hashSha384hOid;
wolfSSL 11:cee25a834751 1225 *oidSz = sizeof(hashSha384hOid);
wolfSSL 11:cee25a834751 1226 break;
wolfSSL 11:cee25a834751 1227 case SHA512h:
wolfSSL 11:cee25a834751 1228 oid = hashSha512hOid;
wolfSSL 11:cee25a834751 1229 *oidSz = sizeof(hashSha512hOid);
wolfSSL 11:cee25a834751 1230 break;
wolfSSL 11:cee25a834751 1231 }
wolfSSL 11:cee25a834751 1232 break;
wolfSSL 11:cee25a834751 1233
wolfSSL 11:cee25a834751 1234 case oidSigType:
wolfSSL 11:cee25a834751 1235 switch (id) {
wolfSSL 11:cee25a834751 1236 #ifndef NO_DSA
wolfSSL 11:cee25a834751 1237 case CTC_SHAwDSA:
wolfSSL 11:cee25a834751 1238 oid = sigSha1wDsaOid;
wolfSSL 11:cee25a834751 1239 *oidSz = sizeof(sigSha1wDsaOid);
wolfSSL 11:cee25a834751 1240 break;
wolfSSL 11:cee25a834751 1241 #endif /* NO_DSA */
wolfSSL 11:cee25a834751 1242 #ifndef NO_RSA
wolfSSL 11:cee25a834751 1243 case CTC_MD2wRSA:
wolfSSL 11:cee25a834751 1244 oid = sigMd2wRsaOid;
wolfSSL 11:cee25a834751 1245 *oidSz = sizeof(sigMd2wRsaOid);
wolfSSL 11:cee25a834751 1246 break;
wolfSSL 11:cee25a834751 1247 case CTC_MD5wRSA:
wolfSSL 11:cee25a834751 1248 oid = sigMd5wRsaOid;
wolfSSL 11:cee25a834751 1249 *oidSz = sizeof(sigMd5wRsaOid);
wolfSSL 11:cee25a834751 1250 break;
wolfSSL 11:cee25a834751 1251 case CTC_SHAwRSA:
wolfSSL 11:cee25a834751 1252 oid = sigSha1wRsaOid;
wolfSSL 11:cee25a834751 1253 *oidSz = sizeof(sigSha1wRsaOid);
wolfSSL 11:cee25a834751 1254 break;
wolfSSL 11:cee25a834751 1255 case CTC_SHA224wRSA:
wolfSSL 11:cee25a834751 1256 oid = sigSha224wRsaOid;
wolfSSL 11:cee25a834751 1257 *oidSz = sizeof(sigSha224wRsaOid);
wolfSSL 11:cee25a834751 1258 break;
wolfSSL 11:cee25a834751 1259 case CTC_SHA256wRSA:
wolfSSL 11:cee25a834751 1260 oid = sigSha256wRsaOid;
wolfSSL 11:cee25a834751 1261 *oidSz = sizeof(sigSha256wRsaOid);
wolfSSL 11:cee25a834751 1262 break;
wolfSSL 11:cee25a834751 1263 case CTC_SHA384wRSA:
wolfSSL 11:cee25a834751 1264 oid = sigSha384wRsaOid;
wolfSSL 11:cee25a834751 1265 *oidSz = sizeof(sigSha384wRsaOid);
wolfSSL 11:cee25a834751 1266 break;
wolfSSL 11:cee25a834751 1267 case CTC_SHA512wRSA:
wolfSSL 11:cee25a834751 1268 oid = sigSha512wRsaOid;
wolfSSL 11:cee25a834751 1269 *oidSz = sizeof(sigSha512wRsaOid);
wolfSSL 11:cee25a834751 1270 break;
wolfSSL 11:cee25a834751 1271 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 1272 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1273 case CTC_SHAwECDSA:
wolfSSL 11:cee25a834751 1274 oid = sigSha1wEcdsaOid;
wolfSSL 11:cee25a834751 1275 *oidSz = sizeof(sigSha1wEcdsaOid);
wolfSSL 11:cee25a834751 1276 break;
wolfSSL 11:cee25a834751 1277 case CTC_SHA224wECDSA:
wolfSSL 11:cee25a834751 1278 oid = sigSha224wEcdsaOid;
wolfSSL 11:cee25a834751 1279 *oidSz = sizeof(sigSha224wEcdsaOid);
wolfSSL 11:cee25a834751 1280 break;
wolfSSL 11:cee25a834751 1281 case CTC_SHA256wECDSA:
wolfSSL 11:cee25a834751 1282 oid = sigSha256wEcdsaOid;
wolfSSL 11:cee25a834751 1283 *oidSz = sizeof(sigSha256wEcdsaOid);
wolfSSL 11:cee25a834751 1284 break;
wolfSSL 11:cee25a834751 1285 case CTC_SHA384wECDSA:
wolfSSL 11:cee25a834751 1286 oid = sigSha384wEcdsaOid;
wolfSSL 11:cee25a834751 1287 *oidSz = sizeof(sigSha384wEcdsaOid);
wolfSSL 11:cee25a834751 1288 break;
wolfSSL 11:cee25a834751 1289 case CTC_SHA512wECDSA:
wolfSSL 11:cee25a834751 1290 oid = sigSha512wEcdsaOid;
wolfSSL 11:cee25a834751 1291 *oidSz = sizeof(sigSha512wEcdsaOid);
wolfSSL 11:cee25a834751 1292 break;
wolfSSL 11:cee25a834751 1293 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1294 default:
wolfSSL 11:cee25a834751 1295 break;
wolfSSL 11:cee25a834751 1296 }
wolfSSL 11:cee25a834751 1297 break;
wolfSSL 11:cee25a834751 1298
wolfSSL 11:cee25a834751 1299 case oidKeyType:
wolfSSL 11:cee25a834751 1300 switch (id) {
wolfSSL 11:cee25a834751 1301 #ifndef NO_DSA
wolfSSL 11:cee25a834751 1302 case DSAk:
wolfSSL 11:cee25a834751 1303 oid = keyDsaOid;
wolfSSL 11:cee25a834751 1304 *oidSz = sizeof(keyDsaOid);
wolfSSL 11:cee25a834751 1305 break;
wolfSSL 11:cee25a834751 1306 #endif /* NO_DSA */
wolfSSL 11:cee25a834751 1307 #ifndef NO_RSA
wolfSSL 11:cee25a834751 1308 case RSAk:
wolfSSL 11:cee25a834751 1309 oid = keyRsaOid;
wolfSSL 11:cee25a834751 1310 *oidSz = sizeof(keyRsaOid);
wolfSSL 11:cee25a834751 1311 break;
wolfSSL 11:cee25a834751 1312 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 1313 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 1314 case NTRUk:
wolfSSL 11:cee25a834751 1315 oid = keyNtruOid;
wolfSSL 11:cee25a834751 1316 *oidSz = sizeof(keyNtruOid);
wolfSSL 11:cee25a834751 1317 break;
wolfSSL 11:cee25a834751 1318 #endif /* HAVE_NTRU */
wolfSSL 11:cee25a834751 1319 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1320 case ECDSAk:
wolfSSL 11:cee25a834751 1321 oid = keyEcdsaOid;
wolfSSL 11:cee25a834751 1322 *oidSz = sizeof(keyEcdsaOid);
wolfSSL 11:cee25a834751 1323 break;
wolfSSL 11:cee25a834751 1324 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1325 default:
wolfSSL 11:cee25a834751 1326 break;
wolfSSL 11:cee25a834751 1327 }
wolfSSL 11:cee25a834751 1328 break;
wolfSSL 11:cee25a834751 1329
wolfSSL 11:cee25a834751 1330 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 1331 case oidCurveType:
wolfSSL 11:cee25a834751 1332 if (wc_ecc_get_oid(id, &oid, oidSz) < 0) {
wolfSSL 11:cee25a834751 1333 WOLFSSL_MSG("ECC OID not found");
wolfSSL 11:cee25a834751 1334 }
wolfSSL 11:cee25a834751 1335 break;
wolfSSL 11:cee25a834751 1336 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 1337
wolfSSL 11:cee25a834751 1338 case oidBlkType:
wolfSSL 11:cee25a834751 1339 switch (id) {
wolfSSL 11:cee25a834751 1340 case AES128CBCb:
wolfSSL 11:cee25a834751 1341 oid = blkAes128CbcOid;
wolfSSL 11:cee25a834751 1342 *oidSz = sizeof(blkAes128CbcOid);
wolfSSL 11:cee25a834751 1343 break;
wolfSSL 11:cee25a834751 1344 case AES192CBCb:
wolfSSL 11:cee25a834751 1345 oid = blkAes192CbcOid;
wolfSSL 11:cee25a834751 1346 *oidSz = sizeof(blkAes192CbcOid);
wolfSSL 11:cee25a834751 1347 break;
wolfSSL 11:cee25a834751 1348 case AES256CBCb:
wolfSSL 11:cee25a834751 1349 oid = blkAes256CbcOid;
wolfSSL 11:cee25a834751 1350 *oidSz = sizeof(blkAes256CbcOid);
wolfSSL 11:cee25a834751 1351 break;
wolfSSL 11:cee25a834751 1352 case DESb:
wolfSSL 11:cee25a834751 1353 oid = blkDesCbcOid;
wolfSSL 11:cee25a834751 1354 *oidSz = sizeof(blkDesCbcOid);
wolfSSL 11:cee25a834751 1355 break;
wolfSSL 11:cee25a834751 1356 case DES3b:
wolfSSL 11:cee25a834751 1357 oid = blkDes3CbcOid;
wolfSSL 11:cee25a834751 1358 *oidSz = sizeof(blkDes3CbcOid);
wolfSSL 11:cee25a834751 1359 break;
wolfSSL 11:cee25a834751 1360 }
wolfSSL 11:cee25a834751 1361 break;
wolfSSL 11:cee25a834751 1362
wolfSSL 11:cee25a834751 1363 #ifdef HAVE_OCSP
wolfSSL 11:cee25a834751 1364 case oidOcspType:
wolfSSL 11:cee25a834751 1365 switch (id) {
wolfSSL 11:cee25a834751 1366 case OCSP_BASIC_OID:
wolfSSL 11:cee25a834751 1367 oid = ocspBasicOid;
wolfSSL 11:cee25a834751 1368 *oidSz = sizeof(ocspBasicOid);
wolfSSL 11:cee25a834751 1369 break;
wolfSSL 11:cee25a834751 1370 case OCSP_NONCE_OID:
wolfSSL 11:cee25a834751 1371 oid = ocspNonceOid;
wolfSSL 11:cee25a834751 1372 *oidSz = sizeof(ocspNonceOid);
wolfSSL 11:cee25a834751 1373 break;
wolfSSL 11:cee25a834751 1374 }
wolfSSL 11:cee25a834751 1375 break;
wolfSSL 11:cee25a834751 1376 #endif /* HAVE_OCSP */
wolfSSL 11:cee25a834751 1377
wolfSSL 11:cee25a834751 1378 case oidCertExtType:
wolfSSL 11:cee25a834751 1379 switch (id) {
wolfSSL 11:cee25a834751 1380 case BASIC_CA_OID:
wolfSSL 11:cee25a834751 1381 oid = extBasicCaOid;
wolfSSL 11:cee25a834751 1382 *oidSz = sizeof(extBasicCaOid);
wolfSSL 11:cee25a834751 1383 break;
wolfSSL 11:cee25a834751 1384 case ALT_NAMES_OID:
wolfSSL 11:cee25a834751 1385 oid = extAltNamesOid;
wolfSSL 11:cee25a834751 1386 *oidSz = sizeof(extAltNamesOid);
wolfSSL 11:cee25a834751 1387 break;
wolfSSL 11:cee25a834751 1388 case CRL_DIST_OID:
wolfSSL 11:cee25a834751 1389 oid = extCrlDistOid;
wolfSSL 11:cee25a834751 1390 *oidSz = sizeof(extCrlDistOid);
wolfSSL 11:cee25a834751 1391 break;
wolfSSL 11:cee25a834751 1392 case AUTH_INFO_OID:
wolfSSL 11:cee25a834751 1393 oid = extAuthInfoOid;
wolfSSL 11:cee25a834751 1394 *oidSz = sizeof(extAuthInfoOid);
wolfSSL 11:cee25a834751 1395 break;
wolfSSL 11:cee25a834751 1396 case AUTH_KEY_OID:
wolfSSL 11:cee25a834751 1397 oid = extAuthKeyOid;
wolfSSL 11:cee25a834751 1398 *oidSz = sizeof(extAuthKeyOid);
wolfSSL 11:cee25a834751 1399 break;
wolfSSL 11:cee25a834751 1400 case SUBJ_KEY_OID:
wolfSSL 11:cee25a834751 1401 oid = extSubjKeyOid;
wolfSSL 11:cee25a834751 1402 *oidSz = sizeof(extSubjKeyOid);
wolfSSL 11:cee25a834751 1403 break;
wolfSSL 11:cee25a834751 1404 case CERT_POLICY_OID:
wolfSSL 11:cee25a834751 1405 oid = extCertPolicyOid;
wolfSSL 11:cee25a834751 1406 *oidSz = sizeof(extCertPolicyOid);
wolfSSL 11:cee25a834751 1407 break;
wolfSSL 11:cee25a834751 1408 case KEY_USAGE_OID:
wolfSSL 11:cee25a834751 1409 oid = extKeyUsageOid;
wolfSSL 11:cee25a834751 1410 *oidSz = sizeof(extKeyUsageOid);
wolfSSL 11:cee25a834751 1411 break;
wolfSSL 11:cee25a834751 1412 case INHIBIT_ANY_OID:
wolfSSL 11:cee25a834751 1413 oid = extInhibitAnyOid;
wolfSSL 11:cee25a834751 1414 *oidSz = sizeof(extInhibitAnyOid);
wolfSSL 11:cee25a834751 1415 break;
wolfSSL 11:cee25a834751 1416 case EXT_KEY_USAGE_OID:
wolfSSL 11:cee25a834751 1417 oid = extExtKeyUsageOid;
wolfSSL 11:cee25a834751 1418 *oidSz = sizeof(extExtKeyUsageOid);
wolfSSL 11:cee25a834751 1419 break;
wolfSSL 11:cee25a834751 1420 case NAME_CONS_OID:
wolfSSL 11:cee25a834751 1421 oid = extNameConsOid;
wolfSSL 11:cee25a834751 1422 *oidSz = sizeof(extNameConsOid);
wolfSSL 11:cee25a834751 1423 break;
wolfSSL 11:cee25a834751 1424 }
wolfSSL 11:cee25a834751 1425 break;
wolfSSL 11:cee25a834751 1426
wolfSSL 11:cee25a834751 1427 case oidCertAuthInfoType:
wolfSSL 11:cee25a834751 1428 switch (id) {
wolfSSL 11:cee25a834751 1429 case AIA_OCSP_OID:
wolfSSL 11:cee25a834751 1430 oid = extAuthInfoOcspOid;
wolfSSL 11:cee25a834751 1431 *oidSz = sizeof(extAuthInfoOcspOid);
wolfSSL 11:cee25a834751 1432 break;
wolfSSL 11:cee25a834751 1433 case AIA_CA_ISSUER_OID:
wolfSSL 11:cee25a834751 1434 oid = extAuthInfoCaIssuerOid;
wolfSSL 11:cee25a834751 1435 *oidSz = sizeof(extAuthInfoCaIssuerOid);
wolfSSL 11:cee25a834751 1436 break;
wolfSSL 11:cee25a834751 1437 }
wolfSSL 11:cee25a834751 1438 break;
wolfSSL 11:cee25a834751 1439
wolfSSL 11:cee25a834751 1440 case oidCertPolicyType:
wolfSSL 11:cee25a834751 1441 switch (id) {
wolfSSL 11:cee25a834751 1442 case CP_ANY_OID:
wolfSSL 11:cee25a834751 1443 oid = extCertPolicyAnyOid;
wolfSSL 11:cee25a834751 1444 *oidSz = sizeof(extCertPolicyAnyOid);
wolfSSL 11:cee25a834751 1445 break;
wolfSSL 11:cee25a834751 1446 }
wolfSSL 11:cee25a834751 1447 break;
wolfSSL 11:cee25a834751 1448
wolfSSL 11:cee25a834751 1449 case oidCertAltNameType:
wolfSSL 11:cee25a834751 1450 switch (id) {
wolfSSL 11:cee25a834751 1451 case HW_NAME_OID:
wolfSSL 11:cee25a834751 1452 oid = extAltNamesHwNameOid;
wolfSSL 11:cee25a834751 1453 *oidSz = sizeof(extAltNamesHwNameOid);
wolfSSL 11:cee25a834751 1454 break;
wolfSSL 11:cee25a834751 1455 }
wolfSSL 11:cee25a834751 1456 break;
wolfSSL 11:cee25a834751 1457
wolfSSL 11:cee25a834751 1458 case oidCertKeyUseType:
wolfSSL 11:cee25a834751 1459 switch (id) {
wolfSSL 11:cee25a834751 1460 case EKU_ANY_OID:
wolfSSL 11:cee25a834751 1461 oid = extExtKeyUsageAnyOid;
wolfSSL 11:cee25a834751 1462 *oidSz = sizeof(extExtKeyUsageAnyOid);
wolfSSL 11:cee25a834751 1463 break;
wolfSSL 11:cee25a834751 1464 case EKU_SERVER_AUTH_OID:
wolfSSL 11:cee25a834751 1465 oid = extExtKeyUsageServerAuthOid;
wolfSSL 11:cee25a834751 1466 *oidSz = sizeof(extExtKeyUsageServerAuthOid);
wolfSSL 11:cee25a834751 1467 break;
wolfSSL 11:cee25a834751 1468 case EKU_CLIENT_AUTH_OID:
wolfSSL 11:cee25a834751 1469 oid = extExtKeyUsageClientAuthOid;
wolfSSL 11:cee25a834751 1470 *oidSz = sizeof(extExtKeyUsageClientAuthOid);
wolfSSL 11:cee25a834751 1471 break;
wolfSSL 11:cee25a834751 1472 case EKU_OCSP_SIGN_OID:
wolfSSL 11:cee25a834751 1473 oid = extExtKeyUsageOcspSignOid;
wolfSSL 11:cee25a834751 1474 *oidSz = sizeof(extExtKeyUsageOcspSignOid);
wolfSSL 11:cee25a834751 1475 break;
wolfSSL 11:cee25a834751 1476 }
wolfSSL 11:cee25a834751 1477 break;
wolfSSL 11:cee25a834751 1478
wolfSSL 11:cee25a834751 1479 case oidKdfType:
wolfSSL 11:cee25a834751 1480 switch (id) {
wolfSSL 11:cee25a834751 1481 case PBKDF2_OID:
wolfSSL 11:cee25a834751 1482 oid = pbkdf2Oid;
wolfSSL 11:cee25a834751 1483 *oidSz = sizeof(pbkdf2Oid);
wolfSSL 11:cee25a834751 1484 break;
wolfSSL 11:cee25a834751 1485 }
wolfSSL 11:cee25a834751 1486 break;
wolfSSL 11:cee25a834751 1487
wolfSSL 11:cee25a834751 1488 case oidKeyWrapType:
wolfSSL 11:cee25a834751 1489 switch (id) {
wolfSSL 11:cee25a834751 1490 case AES128_WRAP:
wolfSSL 11:cee25a834751 1491 oid = wrapAes128Oid;
wolfSSL 11:cee25a834751 1492 *oidSz = sizeof(wrapAes128Oid);
wolfSSL 11:cee25a834751 1493 break;
wolfSSL 11:cee25a834751 1494 case AES192_WRAP:
wolfSSL 11:cee25a834751 1495 oid = wrapAes192Oid;
wolfSSL 11:cee25a834751 1496 *oidSz = sizeof(wrapAes192Oid);
wolfSSL 11:cee25a834751 1497 break;
wolfSSL 11:cee25a834751 1498 case AES256_WRAP:
wolfSSL 11:cee25a834751 1499 oid = wrapAes256Oid;
wolfSSL 11:cee25a834751 1500 *oidSz = sizeof(wrapAes256Oid);
wolfSSL 11:cee25a834751 1501 break;
wolfSSL 11:cee25a834751 1502 }
wolfSSL 11:cee25a834751 1503 break;
wolfSSL 11:cee25a834751 1504
wolfSSL 11:cee25a834751 1505 case oidCmsKeyAgreeType:
wolfSSL 11:cee25a834751 1506 switch (id) {
wolfSSL 11:cee25a834751 1507 case dhSinglePass_stdDH_sha1kdf_scheme:
wolfSSL 11:cee25a834751 1508 oid = dhSinglePass_stdDH_sha1kdf_Oid;
wolfSSL 11:cee25a834751 1509 *oidSz = sizeof(dhSinglePass_stdDH_sha1kdf_Oid);
wolfSSL 11:cee25a834751 1510 break;
wolfSSL 11:cee25a834751 1511 case dhSinglePass_stdDH_sha224kdf_scheme:
wolfSSL 11:cee25a834751 1512 oid = dhSinglePass_stdDH_sha224kdf_Oid;
wolfSSL 11:cee25a834751 1513 *oidSz = sizeof(dhSinglePass_stdDH_sha224kdf_Oid);
wolfSSL 11:cee25a834751 1514 break;
wolfSSL 11:cee25a834751 1515 case dhSinglePass_stdDH_sha256kdf_scheme:
wolfSSL 11:cee25a834751 1516 oid = dhSinglePass_stdDH_sha256kdf_Oid;
wolfSSL 11:cee25a834751 1517 *oidSz = sizeof(dhSinglePass_stdDH_sha256kdf_Oid);
wolfSSL 11:cee25a834751 1518 break;
wolfSSL 11:cee25a834751 1519 case dhSinglePass_stdDH_sha384kdf_scheme:
wolfSSL 11:cee25a834751 1520 oid = dhSinglePass_stdDH_sha384kdf_Oid;
wolfSSL 11:cee25a834751 1521 *oidSz = sizeof(dhSinglePass_stdDH_sha384kdf_Oid);
wolfSSL 11:cee25a834751 1522 break;
wolfSSL 11:cee25a834751 1523 case dhSinglePass_stdDH_sha512kdf_scheme:
wolfSSL 11:cee25a834751 1524 oid = dhSinglePass_stdDH_sha512kdf_Oid;
wolfSSL 11:cee25a834751 1525 *oidSz = sizeof(dhSinglePass_stdDH_sha512kdf_Oid);
wolfSSL 11:cee25a834751 1526 break;
wolfSSL 11:cee25a834751 1527 }
wolfSSL 11:cee25a834751 1528 break;
wolfSSL 11:cee25a834751 1529
wolfSSL 11:cee25a834751 1530 case oidIgnoreType:
wolfSSL 11:cee25a834751 1531 default:
wolfSSL 11:cee25a834751 1532 break;
wolfSSL 11:cee25a834751 1533 }
wolfSSL 11:cee25a834751 1534
wolfSSL 11:cee25a834751 1535 return oid;
wolfSSL 11:cee25a834751 1536 }
wolfSSL 11:cee25a834751 1537
wolfSSL 11:cee25a834751 1538 #ifdef HAVE_OID_ENCODING
wolfSSL 11:cee25a834751 1539 int EncodeObjectId(const word16* in, word32 inSz, byte* out, word32* outSz)
wolfSSL 11:cee25a834751 1540 {
wolfSSL 11:cee25a834751 1541 int i, x, len;
wolfSSL 11:cee25a834751 1542 word32 d, t;
wolfSSL 11:cee25a834751 1543
wolfSSL 11:cee25a834751 1544 /* check args */
wolfSSL 11:cee25a834751 1545 if (in == NULL || outSz == NULL) {
wolfSSL 11:cee25a834751 1546 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1547 }
wolfSSL 11:cee25a834751 1548
wolfSSL 11:cee25a834751 1549 /* compute length of encoded OID */
wolfSSL 11:cee25a834751 1550 d = (in[0] * 40) + in[1];
wolfSSL 11:cee25a834751 1551 len = 0;
wolfSSL 11:cee25a834751 1552 for (i = 1; i < (int)inSz; i++) {
wolfSSL 11:cee25a834751 1553 x = 0;
wolfSSL 11:cee25a834751 1554 t = d;
wolfSSL 11:cee25a834751 1555 while (t) {
wolfSSL 11:cee25a834751 1556 x++;
wolfSSL 11:cee25a834751 1557 t >>= 1;
wolfSSL 11:cee25a834751 1558 }
wolfSSL 11:cee25a834751 1559 len += (x / 7) + ((x % 7) ? 1 : 0) + (d == 0 ? 1 : 0);
wolfSSL 11:cee25a834751 1560
wolfSSL 11:cee25a834751 1561 if (i < (int)inSz - 1) {
wolfSSL 11:cee25a834751 1562 d = in[i + 1];
wolfSSL 11:cee25a834751 1563 }
wolfSSL 11:cee25a834751 1564 }
wolfSSL 11:cee25a834751 1565
wolfSSL 11:cee25a834751 1566 if (out) {
wolfSSL 11:cee25a834751 1567 /* verify length */
wolfSSL 11:cee25a834751 1568 if ((int)*outSz < len) {
wolfSSL 11:cee25a834751 1569 return BUFFER_E; /* buffer provided is not large enough */
wolfSSL 11:cee25a834751 1570 }
wolfSSL 11:cee25a834751 1571
wolfSSL 11:cee25a834751 1572 /* calc first byte */
wolfSSL 11:cee25a834751 1573 d = (in[0] * 40) + in[1];
wolfSSL 11:cee25a834751 1574
wolfSSL 11:cee25a834751 1575 /* encode bytes */
wolfSSL 11:cee25a834751 1576 x = 0;
wolfSSL 11:cee25a834751 1577 for (i = 1; i < (int)inSz; i++) {
wolfSSL 11:cee25a834751 1578 if (d) {
wolfSSL 11:cee25a834751 1579 int y = x, z;
wolfSSL 11:cee25a834751 1580 byte mask = 0;
wolfSSL 11:cee25a834751 1581 while (d) {
wolfSSL 11:cee25a834751 1582 out[x++] = (byte)((d & 0x7F) | mask);
wolfSSL 11:cee25a834751 1583 d >>= 7;
wolfSSL 11:cee25a834751 1584 mask |= 0x80; /* upper bit is set on all but the last byte */
wolfSSL 11:cee25a834751 1585 }
wolfSSL 11:cee25a834751 1586 /* now swap bytes y...x-1 */
wolfSSL 11:cee25a834751 1587 z = x - 1;
wolfSSL 11:cee25a834751 1588 while (y < z) {
wolfSSL 11:cee25a834751 1589 mask = out[y];
wolfSSL 11:cee25a834751 1590 out[y] = out[z];
wolfSSL 11:cee25a834751 1591 out[z] = mask;
wolfSSL 11:cee25a834751 1592 ++y;
wolfSSL 11:cee25a834751 1593 --z;
wolfSSL 11:cee25a834751 1594 }
wolfSSL 11:cee25a834751 1595 }
wolfSSL 11:cee25a834751 1596 else {
wolfSSL 11:cee25a834751 1597 out[x++] = 0x00; /* zero value */
wolfSSL 11:cee25a834751 1598 }
wolfSSL 11:cee25a834751 1599
wolfSSL 11:cee25a834751 1600 /* next word */
wolfSSL 11:cee25a834751 1601 if (i < (int)inSz - 1) {
wolfSSL 11:cee25a834751 1602 d = in[i + 1];
wolfSSL 11:cee25a834751 1603 }
wolfSSL 11:cee25a834751 1604 }
wolfSSL 11:cee25a834751 1605 }
wolfSSL 11:cee25a834751 1606
wolfSSL 11:cee25a834751 1607 /* return length */
wolfSSL 11:cee25a834751 1608 *outSz = len;
wolfSSL 11:cee25a834751 1609
wolfSSL 11:cee25a834751 1610 return 0;
wolfSSL 11:cee25a834751 1611 }
wolfSSL 11:cee25a834751 1612 #endif /* HAVE_OID_ENCODING */
wolfSSL 11:cee25a834751 1613
wolfSSL 11:cee25a834751 1614 #ifdef HAVE_OID_DECODING
wolfSSL 11:cee25a834751 1615 int DecodeObjectId(const byte* in, word32 inSz, word16* out, word32* outSz)
wolfSSL 11:cee25a834751 1616 {
wolfSSL 11:cee25a834751 1617 int x = 0, y = 0;
wolfSSL 11:cee25a834751 1618 word32 t = 0;
wolfSSL 11:cee25a834751 1619
wolfSSL 11:cee25a834751 1620 /* check args */
wolfSSL 11:cee25a834751 1621 if (in == NULL || outSz == NULL) {
wolfSSL 11:cee25a834751 1622 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1623 }
wolfSSL 11:cee25a834751 1624
wolfSSL 11:cee25a834751 1625 /* decode bytes */
wolfSSL 11:cee25a834751 1626 while (inSz--) {
wolfSSL 11:cee25a834751 1627 t = (t << 7) | (in[x] & 0x7F);
wolfSSL 11:cee25a834751 1628 if (!(in[x] & 0x80)) {
wolfSSL 11:cee25a834751 1629 if (y >= (int)*outSz) {
wolfSSL 11:cee25a834751 1630 return BUFFER_E;
wolfSSL 11:cee25a834751 1631 }
wolfSSL 11:cee25a834751 1632 if (y == 0) {
wolfSSL 11:cee25a834751 1633 out[0] = (t / 40);
wolfSSL 11:cee25a834751 1634 out[1] = (t % 40);
wolfSSL 11:cee25a834751 1635 y = 2;
wolfSSL 11:cee25a834751 1636 }
wolfSSL 11:cee25a834751 1637 else {
wolfSSL 11:cee25a834751 1638 out[y++] = t;
wolfSSL 11:cee25a834751 1639 }
wolfSSL 11:cee25a834751 1640 t = 0; /* reset tmp */
wolfSSL 11:cee25a834751 1641 }
wolfSSL 11:cee25a834751 1642 x++;
wolfSSL 11:cee25a834751 1643 }
wolfSSL 11:cee25a834751 1644
wolfSSL 11:cee25a834751 1645 /* return length */
wolfSSL 11:cee25a834751 1646 *outSz = y;
wolfSSL 11:cee25a834751 1647
wolfSSL 11:cee25a834751 1648 return 0;
wolfSSL 11:cee25a834751 1649 }
wolfSSL 11:cee25a834751 1650 #endif /* HAVE_OID_DECODING */
wolfSSL 11:cee25a834751 1651
wolfSSL 11:cee25a834751 1652 /* Get the DER/BER encoding of an ASN.1 OBJECT_ID header.
wolfSSL 11:cee25a834751 1653 *
wolfSSL 11:cee25a834751 1654 * input Buffer holding DER/BER encoded data.
wolfSSL 11:cee25a834751 1655 * inOutIdx Current index into buffer to parse.
wolfSSL 11:cee25a834751 1656 * len The number of bytes in the ASN.1 data.
wolfSSL 11:cee25a834751 1657 * maxIdx Length of data in buffer.
wolfSSL 11:cee25a834751 1658 * returns BUFFER_E when there is not enough data to parse.
wolfSSL 11:cee25a834751 1659 * ASN_OBJECt_ID_E when the OBJECT_ID tag is not found.
wolfSSL 11:cee25a834751 1660 * ASN_PARSE_E when length is invalid.
wolfSSL 11:cee25a834751 1661 * Otherwise, 0 to indicate success.
wolfSSL 11:cee25a834751 1662 */
wolfSSL 11:cee25a834751 1663 static int GetASNObjectId(const byte* input, word32* inOutIdx, int* len,
wolfSSL 11:cee25a834751 1664 word32 maxIdx)
wolfSSL 11:cee25a834751 1665 {
wolfSSL 11:cee25a834751 1666 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 1667 byte b;
wolfSSL 11:cee25a834751 1668 int length;
wolfSSL 11:cee25a834751 1669
wolfSSL 11:cee25a834751 1670 if ((idx + 1) > maxIdx)
wolfSSL 11:cee25a834751 1671 return BUFFER_E;
wolfSSL 11:cee25a834751 1672
wolfSSL 11:cee25a834751 1673 b = input[idx++];
wolfSSL 11:cee25a834751 1674 if (b != ASN_OBJECT_ID)
wolfSSL 11:cee25a834751 1675 return ASN_OBJECT_ID_E;
wolfSSL 11:cee25a834751 1676
wolfSSL 11:cee25a834751 1677 if (GetLength(input, &idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 1678 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1679
wolfSSL 11:cee25a834751 1680 *len = length;
wolfSSL 11:cee25a834751 1681 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1682 return 0;
wolfSSL 11:cee25a834751 1683 }
wolfSSL 11:cee25a834751 1684
wolfSSL 11:cee25a834751 1685 /* Set the DER/BER encoding of the ASN.1 OBJECT_ID header.
wolfSSL 11:cee25a834751 1686 *
wolfSSL 11:cee25a834751 1687 * len Length of the OBJECT_ID data.
wolfSSL 11:cee25a834751 1688 * output Buffer to write into.
wolfSSL 11:cee25a834751 1689 * returns the number of bytes added to the buffer.
wolfSSL 11:cee25a834751 1690 */
wolfSSL 11:cee25a834751 1691 static int SetObjectId(int len, byte* output)
wolfSSL 11:cee25a834751 1692 {
wolfSSL 11:cee25a834751 1693 int idx = 0;
wolfSSL 11:cee25a834751 1694
wolfSSL 11:cee25a834751 1695 output[idx++] = ASN_OBJECT_ID;
wolfSSL 11:cee25a834751 1696 idx += SetLength(len, output + idx);
wolfSSL 11:cee25a834751 1697
wolfSSL 11:cee25a834751 1698 return idx;
wolfSSL 11:cee25a834751 1699 }
wolfSSL 11:cee25a834751 1700
wolfSSL 11:cee25a834751 1701 int GetObjectId(const byte* input, word32* inOutIdx, word32* oid,
wolfSSL 11:cee25a834751 1702 word32 oidType, word32 maxIdx)
wolfSSL 11:cee25a834751 1703 {
wolfSSL 11:cee25a834751 1704 int ret = 0, length;
wolfSSL 11:cee25a834751 1705 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 1706 #ifndef NO_VERIFY_OID
wolfSSL 11:cee25a834751 1707 word32 actualOidSz = 0;
wolfSSL 11:cee25a834751 1708 const byte* actualOid;
wolfSSL 11:cee25a834751 1709 #endif /* NO_VERIFY_OID */
wolfSSL 11:cee25a834751 1710
wolfSSL 11:cee25a834751 1711 (void)oidType;
wolfSSL 11:cee25a834751 1712 WOLFSSL_ENTER("GetObjectId()");
wolfSSL 11:cee25a834751 1713 *oid = 0;
wolfSSL 11:cee25a834751 1714
wolfSSL 11:cee25a834751 1715 ret = GetASNObjectId(input, &idx, &length, maxIdx);
wolfSSL 11:cee25a834751 1716 if (ret != 0)
wolfSSL 11:cee25a834751 1717 return ret;
wolfSSL 11:cee25a834751 1718
wolfSSL 11:cee25a834751 1719 #ifndef NO_VERIFY_OID
wolfSSL 11:cee25a834751 1720 actualOid = &input[idx];
wolfSSL 11:cee25a834751 1721 if (length > 0)
wolfSSL 11:cee25a834751 1722 actualOidSz = (word32)length;
wolfSSL 11:cee25a834751 1723 #endif /* NO_VERIFY_OID */
wolfSSL 11:cee25a834751 1724
wolfSSL 11:cee25a834751 1725 while (length--) {
wolfSSL 11:cee25a834751 1726 /* odd HC08 compiler behavior here when input[idx++] */
wolfSSL 11:cee25a834751 1727 *oid += (word32)input[idx];
wolfSSL 11:cee25a834751 1728 idx++;
wolfSSL 11:cee25a834751 1729 }
wolfSSL 11:cee25a834751 1730 /* just sum it up for now */
wolfSSL 11:cee25a834751 1731
wolfSSL 11:cee25a834751 1732 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1733
wolfSSL 11:cee25a834751 1734 #ifndef NO_VERIFY_OID
wolfSSL 11:cee25a834751 1735 {
wolfSSL 11:cee25a834751 1736 const byte* checkOid = NULL;
wolfSSL 11:cee25a834751 1737 word32 checkOidSz;
wolfSSL 11:cee25a834751 1738 #ifdef ASN_DUMP_OID
wolfSSL 11:cee25a834751 1739 int i;
wolfSSL 11:cee25a834751 1740 #endif
wolfSSL 11:cee25a834751 1741
wolfSSL 11:cee25a834751 1742 if (oidType != oidIgnoreType) {
wolfSSL 11:cee25a834751 1743 checkOid = OidFromId(*oid, oidType, &checkOidSz);
wolfSSL 11:cee25a834751 1744
wolfSSL 11:cee25a834751 1745 #ifdef ASN_DUMP_OID
wolfSSL 11:cee25a834751 1746 /* support for dumping OID information */
wolfSSL 11:cee25a834751 1747 printf("OID (Type %d, Sz %d, Sum %d): ", oidType, actualOidSz, *oid);
wolfSSL 11:cee25a834751 1748 for (i=0; i<actualOidSz; i++) {
wolfSSL 11:cee25a834751 1749 printf("%d, ", actualOid[i]);
wolfSSL 11:cee25a834751 1750 }
wolfSSL 11:cee25a834751 1751 printf("\n");
wolfSSL 11:cee25a834751 1752 #ifdef HAVE_OID_DECODING
wolfSSL 11:cee25a834751 1753 {
wolfSSL 11:cee25a834751 1754 word16 decOid[16];
wolfSSL 11:cee25a834751 1755 word32 decOidSz = sizeof(decOid);
wolfSSL 11:cee25a834751 1756 ret = DecodeObjectId(actualOid, actualOidSz, decOid, &decOidSz);
wolfSSL 11:cee25a834751 1757 if (ret == 0) {
wolfSSL 11:cee25a834751 1758 printf(" Decoded (Sz %d): ", decOidSz);
wolfSSL 11:cee25a834751 1759 for (i=0; i<decOidSz; i++) {
wolfSSL 11:cee25a834751 1760 printf("%d.", decOid[i]);
wolfSSL 11:cee25a834751 1761 }
wolfSSL 11:cee25a834751 1762 printf("\n");
wolfSSL 11:cee25a834751 1763 }
wolfSSL 11:cee25a834751 1764 else {
wolfSSL 11:cee25a834751 1765 printf("DecodeObjectId failed: %d\n", ret);
wolfSSL 11:cee25a834751 1766 }
wolfSSL 11:cee25a834751 1767 }
wolfSSL 11:cee25a834751 1768 #endif /* HAVE_OID_DECODING */
wolfSSL 11:cee25a834751 1769 #endif /* ASN_DUMP_OID */
wolfSSL 11:cee25a834751 1770
wolfSSL 11:cee25a834751 1771 if (checkOid != NULL &&
wolfSSL 11:cee25a834751 1772 (checkOidSz != actualOidSz ||
wolfSSL 11:cee25a834751 1773 XMEMCMP(actualOid, checkOid, checkOidSz) != 0)) {
wolfSSL 11:cee25a834751 1774 WOLFSSL_MSG("OID Check Failed");
wolfSSL 11:cee25a834751 1775 return ASN_UNKNOWN_OID_E;
wolfSSL 11:cee25a834751 1776 }
wolfSSL 11:cee25a834751 1777 }
wolfSSL 11:cee25a834751 1778 }
wolfSSL 11:cee25a834751 1779 #endif /* NO_VERIFY_OID */
wolfSSL 11:cee25a834751 1780
wolfSSL 11:cee25a834751 1781 return ret;
wolfSSL 11:cee25a834751 1782 }
wolfSSL 11:cee25a834751 1783
wolfSSL 11:cee25a834751 1784
wolfSSL 11:cee25a834751 1785 #if defined(HAVE_ECC) || (!defined(NO_RSA) && !defined(HAVE_USER_RSA) && (defined(OPENSSL_EXTRA) || defined(RSA_DECODE_EXTRA)))
wolfSSL 11:cee25a834751 1786 static int SkipObjectId(const byte* input, word32* inOutIdx, word32 maxIdx)
wolfSSL 11:cee25a834751 1787 {
wolfSSL 11:cee25a834751 1788 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 1789 int length;
wolfSSL 11:cee25a834751 1790 int ret;
wolfSSL 11:cee25a834751 1791
wolfSSL 11:cee25a834751 1792 ret = GetASNObjectId(input, &idx, &length, maxIdx);
wolfSSL 11:cee25a834751 1793 if (ret != 0)
wolfSSL 11:cee25a834751 1794 return ret;
wolfSSL 11:cee25a834751 1795
wolfSSL 11:cee25a834751 1796 idx += length;
wolfSSL 11:cee25a834751 1797 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1798
wolfSSL 11:cee25a834751 1799 return 0;
wolfSSL 11:cee25a834751 1800 }
wolfSSL 11:cee25a834751 1801 #endif
wolfSSL 11:cee25a834751 1802
wolfSSL 11:cee25a834751 1803 WOLFSSL_LOCAL int GetAlgoId(const byte* input, word32* inOutIdx, word32* oid,
wolfSSL 11:cee25a834751 1804 word32 oidType, word32 maxIdx)
wolfSSL 11:cee25a834751 1805 {
wolfSSL 11:cee25a834751 1806 int length;
wolfSSL 11:cee25a834751 1807 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 1808 int ret;
wolfSSL 11:cee25a834751 1809 *oid = 0;
wolfSSL 11:cee25a834751 1810
wolfSSL 11:cee25a834751 1811 WOLFSSL_ENTER("GetAlgoId");
wolfSSL 11:cee25a834751 1812
wolfSSL 11:cee25a834751 1813 if (GetSequence(input, &idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 1814 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1815
wolfSSL 11:cee25a834751 1816 if (GetObjectId(input, &idx, oid, oidType, maxIdx) < 0)
wolfSSL 11:cee25a834751 1817 return ASN_OBJECT_ID_E;
wolfSSL 11:cee25a834751 1818
wolfSSL 11:cee25a834751 1819 /* could have NULL tag and 0 terminator, but may not */
wolfSSL 11:cee25a834751 1820 if (input[idx] == ASN_TAG_NULL) {
wolfSSL 11:cee25a834751 1821 ret = GetASNNull(input, &idx, maxIdx);
wolfSSL 11:cee25a834751 1822 if (ret != 0)
wolfSSL 11:cee25a834751 1823 return ret;
wolfSSL 11:cee25a834751 1824 }
wolfSSL 11:cee25a834751 1825
wolfSSL 11:cee25a834751 1826 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1827
wolfSSL 11:cee25a834751 1828 return 0;
wolfSSL 11:cee25a834751 1829 }
wolfSSL 11:cee25a834751 1830
wolfSSL 11:cee25a834751 1831 #ifndef NO_RSA
wolfSSL 11:cee25a834751 1832
wolfSSL 11:cee25a834751 1833 #ifndef HAVE_USER_RSA
wolfSSL 11:cee25a834751 1834 int wc_RsaPrivateKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
wolfSSL 11:cee25a834751 1835 word32 inSz)
wolfSSL 11:cee25a834751 1836 {
wolfSSL 11:cee25a834751 1837 int version, length;
wolfSSL 11:cee25a834751 1838
wolfSSL 11:cee25a834751 1839 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 1840 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1841
wolfSSL 11:cee25a834751 1842 if (GetMyVersion(input, inOutIdx, &version, inSz) < 0)
wolfSSL 11:cee25a834751 1843 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1844
wolfSSL 11:cee25a834751 1845 key->type = RSA_PRIVATE;
wolfSSL 11:cee25a834751 1846
wolfSSL 11:cee25a834751 1847 if (GetInt(&key->n, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1848 GetInt(&key->e, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1849 GetInt(&key->d, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1850 GetInt(&key->p, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1851 GetInt(&key->q, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1852 GetInt(&key->dP, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1853 GetInt(&key->dQ, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 1854 GetInt(&key->u, input, inOutIdx, inSz) < 0 ) return ASN_RSA_KEY_E;
wolfSSL 11:cee25a834751 1855
wolfSSL 11:cee25a834751 1856 return 0;
wolfSSL 11:cee25a834751 1857 }
wolfSSL 11:cee25a834751 1858 #endif /* HAVE_USER_RSA */
wolfSSL 11:cee25a834751 1859 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 1860
wolfSSL 11:cee25a834751 1861 /* Remove PKCS8 header, place inOutIdx at beginning of traditional,
wolfSSL 11:cee25a834751 1862 * return traditional length on success, negative on error */
wolfSSL 11:cee25a834751 1863 int ToTraditionalInline(const byte* input, word32* inOutIdx, word32 sz)
wolfSSL 11:cee25a834751 1864 {
wolfSSL 11:cee25a834751 1865 word32 idx, oid;
wolfSSL 11:cee25a834751 1866 int version, length;
wolfSSL 11:cee25a834751 1867 int ret;
wolfSSL 11:cee25a834751 1868
wolfSSL 11:cee25a834751 1869 if (input == NULL || inOutIdx == NULL)
wolfSSL 11:cee25a834751 1870 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1871
wolfSSL 11:cee25a834751 1872 idx = *inOutIdx;
wolfSSL 11:cee25a834751 1873
wolfSSL 11:cee25a834751 1874 if (GetSequence(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 1875 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1876
wolfSSL 11:cee25a834751 1877 if (GetMyVersion(input, &idx, &version, sz) < 0)
wolfSSL 11:cee25a834751 1878 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1879
wolfSSL 11:cee25a834751 1880 if (GetAlgoId(input, &idx, &oid, oidKeyType, sz) < 0)
wolfSSL 11:cee25a834751 1881 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1882
wolfSSL 11:cee25a834751 1883 if (input[idx] == ASN_OBJECT_ID) {
wolfSSL 11:cee25a834751 1884 if (SkipObjectId(input, &idx, sz) < 0)
wolfSSL 11:cee25a834751 1885 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 1886 }
wolfSSL 11:cee25a834751 1887
wolfSSL 11:cee25a834751 1888 ret = GetOctetString(input, &idx, &length, sz);
wolfSSL 11:cee25a834751 1889 if (ret < 0)
wolfSSL 11:cee25a834751 1890 return ret;
wolfSSL 11:cee25a834751 1891
wolfSSL 11:cee25a834751 1892 *inOutIdx = idx;
wolfSSL 11:cee25a834751 1893
wolfSSL 11:cee25a834751 1894 return length;
wolfSSL 11:cee25a834751 1895 }
wolfSSL 11:cee25a834751 1896
wolfSSL 11:cee25a834751 1897 /* Remove PKCS8 header, move beginning of traditional to beginning of input */
wolfSSL 11:cee25a834751 1898 int ToTraditional(byte* input, word32 sz)
wolfSSL 11:cee25a834751 1899 {
wolfSSL 11:cee25a834751 1900 word32 inOutIdx = 0;
wolfSSL 11:cee25a834751 1901 int length;
wolfSSL 11:cee25a834751 1902
wolfSSL 11:cee25a834751 1903 if (input == NULL)
wolfSSL 11:cee25a834751 1904 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1905
wolfSSL 11:cee25a834751 1906 length = ToTraditionalInline(input, &inOutIdx, sz);
wolfSSL 11:cee25a834751 1907 if (length < 0)
wolfSSL 11:cee25a834751 1908 return length;
wolfSSL 11:cee25a834751 1909
wolfSSL 11:cee25a834751 1910 XMEMMOVE(input, input + inOutIdx, length);
wolfSSL 11:cee25a834751 1911
wolfSSL 11:cee25a834751 1912 return length;
wolfSSL 11:cee25a834751 1913 }
wolfSSL 11:cee25a834751 1914
wolfSSL 11:cee25a834751 1915
wolfSSL 11:cee25a834751 1916 /* find beginning of traditional key inside PKCS#8 unencrypted buffer
wolfSSL 11:cee25a834751 1917 * return traditional length on success, with inOutIdx at beginning of
wolfSSL 11:cee25a834751 1918 * traditional
wolfSSL 11:cee25a834751 1919 * return negative on failure/error */
wolfSSL 11:cee25a834751 1920 int wc_GetPkcs8TraditionalOffset(byte* input, word32* inOutIdx, word32 sz)
wolfSSL 11:cee25a834751 1921 {
wolfSSL 11:cee25a834751 1922 int length;
wolfSSL 11:cee25a834751 1923
wolfSSL 11:cee25a834751 1924 if (input == NULL || inOutIdx == NULL || (*inOutIdx > sz))
wolfSSL 11:cee25a834751 1925 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1926
wolfSSL 11:cee25a834751 1927 length = ToTraditionalInline(input, inOutIdx, sz);
wolfSSL 11:cee25a834751 1928
wolfSSL 11:cee25a834751 1929 return length;
wolfSSL 11:cee25a834751 1930 }
wolfSSL 11:cee25a834751 1931
wolfSSL 11:cee25a834751 1932
wolfSSL 11:cee25a834751 1933 /* PKCS#8 from RFC 5208
wolfSSL 11:cee25a834751 1934 * This function takes in a DER key and converts it to PKCS#8 format. Used
wolfSSL 11:cee25a834751 1935 * in creating PKCS#12 shrouded key bags.
wolfSSL 11:cee25a834751 1936 * Reverse of ToTraditional
wolfSSL 11:cee25a834751 1937 *
wolfSSL 11:cee25a834751 1938 * PrivateKeyInfo ::= SEQUENCE {
wolfSSL 11:cee25a834751 1939 * version Version,
wolfSSL 11:cee25a834751 1940 * privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
wolfSSL 11:cee25a834751 1941 * privateKey PrivateKey,
wolfSSL 11:cee25a834751 1942 * attributes optional
wolfSSL 11:cee25a834751 1943 * }
wolfSSL 11:cee25a834751 1944 * Version ::= INTEGER
wolfSSL 11:cee25a834751 1945 * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
wolfSSL 11:cee25a834751 1946 * PrivateKey ::= OCTET STRING
wolfSSL 11:cee25a834751 1947 *
wolfSSL 11:cee25a834751 1948 * out buffer to place result in
wolfSSL 11:cee25a834751 1949 * outSz size of out buffer
wolfSSL 11:cee25a834751 1950 * key buffer with DER key
wolfSSL 11:cee25a834751 1951 * keySz size of key buffer
wolfSSL 11:cee25a834751 1952 * algoID algorithm ID i.e. RSAk
wolfSSL 11:cee25a834751 1953 * curveOID ECC curve oid if used. Should be NULL for RSA keys.
wolfSSL 11:cee25a834751 1954 * oidSz size of curve oid. Is set to 0 if curveOID is NULL.
wolfSSL 11:cee25a834751 1955 *
wolfSSL 11:cee25a834751 1956 * Returns the size of PKCS#8 placed into out. In error cases returns negative
wolfSSL 11:cee25a834751 1957 * values.
wolfSSL 11:cee25a834751 1958 */
wolfSSL 11:cee25a834751 1959 int wc_CreatePKCS8Key(byte* out, word32* outSz, byte* key, word32 keySz,
wolfSSL 11:cee25a834751 1960 int algoID, const byte* curveOID, word32 oidSz)
wolfSSL 11:cee25a834751 1961 {
wolfSSL 11:cee25a834751 1962 word32 keyIdx = 0;
wolfSSL 11:cee25a834751 1963 word32 tmpSz = 0;
wolfSSL 11:cee25a834751 1964 word32 sz;
wolfSSL 11:cee25a834751 1965
wolfSSL 11:cee25a834751 1966
wolfSSL 11:cee25a834751 1967 /* If out is NULL then return the max size needed
wolfSSL 11:cee25a834751 1968 * + 2 for ASN_OBJECT_ID and ASN_OCTET_STRING tags */
wolfSSL 11:cee25a834751 1969 if (out == NULL && outSz != NULL) {
wolfSSL 11:cee25a834751 1970 *outSz = keySz + MAX_SEQ_SZ + MAX_VERSION_SZ + MAX_ALGO_SZ
wolfSSL 11:cee25a834751 1971 + MAX_LENGTH_SZ + MAX_LENGTH_SZ + 2;
wolfSSL 11:cee25a834751 1972
wolfSSL 11:cee25a834751 1973 if (curveOID != NULL)
wolfSSL 11:cee25a834751 1974 *outSz += oidSz + MAX_LENGTH_SZ + 1;
wolfSSL 11:cee25a834751 1975
wolfSSL 11:cee25a834751 1976 WOLFSSL_MSG("Checking size of PKCS8");
wolfSSL 11:cee25a834751 1977
wolfSSL 11:cee25a834751 1978 return LENGTH_ONLY_E;
wolfSSL 11:cee25a834751 1979 }
wolfSSL 11:cee25a834751 1980
wolfSSL 11:cee25a834751 1981 WOLFSSL_ENTER("wc_CreatePKCS8Key()");
wolfSSL 11:cee25a834751 1982
wolfSSL 11:cee25a834751 1983 if (key == NULL || out == NULL || outSz == NULL) {
wolfSSL 11:cee25a834751 1984 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 1985 }
wolfSSL 11:cee25a834751 1986
wolfSSL 11:cee25a834751 1987 /* check the buffer has enough room for largest possible size */
wolfSSL 11:cee25a834751 1988 if (curveOID != NULL) {
wolfSSL 11:cee25a834751 1989 if (*outSz < (keySz + MAX_SEQ_SZ + MAX_VERSION_SZ + MAX_ALGO_SZ
wolfSSL 11:cee25a834751 1990 + MAX_LENGTH_SZ + MAX_LENGTH_SZ + 3 + oidSz + MAX_LENGTH_SZ))
wolfSSL 11:cee25a834751 1991 return BUFFER_E;
wolfSSL 11:cee25a834751 1992 }
wolfSSL 11:cee25a834751 1993 else {
wolfSSL 11:cee25a834751 1994 oidSz = 0; /* with no curveOID oid size must be 0 */
wolfSSL 11:cee25a834751 1995 if (*outSz < (keySz + MAX_SEQ_SZ + MAX_VERSION_SZ + MAX_ALGO_SZ
wolfSSL 11:cee25a834751 1996 + MAX_LENGTH_SZ + MAX_LENGTH_SZ + 2))
wolfSSL 11:cee25a834751 1997 return BUFFER_E;
wolfSSL 11:cee25a834751 1998 }
wolfSSL 11:cee25a834751 1999
wolfSSL 11:cee25a834751 2000 /* PrivateKeyInfo ::= SEQUENCE */
wolfSSL 11:cee25a834751 2001 keyIdx += MAX_SEQ_SZ; /* save room for sequence */
wolfSSL 11:cee25a834751 2002
wolfSSL 11:cee25a834751 2003 /* version Version
wolfSSL 11:cee25a834751 2004 * no header information just INTEGER */
wolfSSL 11:cee25a834751 2005 sz = SetMyVersion(PKCS8v0, out + keyIdx, 0);
wolfSSL 11:cee25a834751 2006 tmpSz += sz; keyIdx += sz;
wolfSSL 11:cee25a834751 2007
wolfSSL 11:cee25a834751 2008 /* privateKeyAlgorithm PrivateKeyAlgorithmIdentifier */
wolfSSL 11:cee25a834751 2009 sz = 0; /* set sz to 0 and get privateKey oid buffer size needed */
wolfSSL 11:cee25a834751 2010 if (curveOID != NULL && oidSz > 0) {
wolfSSL 11:cee25a834751 2011 byte buf[MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 2012 sz = SetLength(oidSz, buf);
wolfSSL 11:cee25a834751 2013 sz += 1; /* plus one for ASN object id */
wolfSSL 11:cee25a834751 2014 }
wolfSSL 11:cee25a834751 2015 sz = SetAlgoID(algoID, out + keyIdx, oidKeyType, oidSz + sz);
wolfSSL 11:cee25a834751 2016 tmpSz += sz; keyIdx += sz;
wolfSSL 11:cee25a834751 2017
wolfSSL 11:cee25a834751 2018 /* privateKey PrivateKey *
wolfSSL 11:cee25a834751 2019 * pkcs8 ecc uses slightly different format. Places curve oid in
wolfSSL 11:cee25a834751 2020 * buffer */
wolfSSL 11:cee25a834751 2021 if (curveOID != NULL && oidSz > 0) {
wolfSSL 11:cee25a834751 2022 sz = SetObjectId(oidSz, out + keyIdx);
wolfSSL 11:cee25a834751 2023 keyIdx += sz; tmpSz += sz;
wolfSSL 11:cee25a834751 2024 XMEMCPY(out + keyIdx, curveOID, oidSz);
wolfSSL 11:cee25a834751 2025 keyIdx += oidSz; tmpSz += oidSz;
wolfSSL 11:cee25a834751 2026 }
wolfSSL 11:cee25a834751 2027
wolfSSL 11:cee25a834751 2028 sz = SetOctetString(keySz, out + keyIdx);
wolfSSL 11:cee25a834751 2029 keyIdx += sz; tmpSz += sz;
wolfSSL 11:cee25a834751 2030 XMEMCPY(out + keyIdx, key, keySz);
wolfSSL 11:cee25a834751 2031 tmpSz += keySz;
wolfSSL 11:cee25a834751 2032
wolfSSL 11:cee25a834751 2033 /* attributes optional
wolfSSL 11:cee25a834751 2034 * No attributes currently added */
wolfSSL 11:cee25a834751 2035
wolfSSL 11:cee25a834751 2036 /* rewind and add sequence */
wolfSSL 11:cee25a834751 2037 sz = SetSequence(tmpSz, out);
wolfSSL 11:cee25a834751 2038 XMEMMOVE(out + sz, out + MAX_SEQ_SZ, tmpSz);
wolfSSL 11:cee25a834751 2039
wolfSSL 11:cee25a834751 2040 return tmpSz + sz;
wolfSSL 11:cee25a834751 2041 }
wolfSSL 11:cee25a834751 2042
wolfSSL 11:cee25a834751 2043
wolfSSL 11:cee25a834751 2044 /* check that the private key is a pair for the public key in certificate
wolfSSL 11:cee25a834751 2045 * return 1 (true) on match
wolfSSL 11:cee25a834751 2046 * return 0 or negative value on failure/error
wolfSSL 11:cee25a834751 2047 *
wolfSSL 11:cee25a834751 2048 * key : buffer holding DER fromat key
wolfSSL 11:cee25a834751 2049 * keySz : size of key buffer
wolfSSL 11:cee25a834751 2050 * der : a initialized and parsed DecodedCert holding a certificate */
wolfSSL 11:cee25a834751 2051 int wc_CheckPrivateKey(byte* key, word32 keySz, DecodedCert* der)
wolfSSL 11:cee25a834751 2052 {
wolfSSL 11:cee25a834751 2053 if (key == NULL || der == NULL) {
wolfSSL 11:cee25a834751 2054 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2055 }
wolfSSL 11:cee25a834751 2056
wolfSSL 11:cee25a834751 2057 #if !defined(NO_RSA)
wolfSSL 11:cee25a834751 2058 {
wolfSSL 11:cee25a834751 2059 RsaKey a, b;
wolfSSL 11:cee25a834751 2060 word32 keyIdx = 0;
wolfSSL 11:cee25a834751 2061 int ret = 0;
wolfSSL 11:cee25a834751 2062
wolfSSL 11:cee25a834751 2063 /* test if RSA key */
wolfSSL 11:cee25a834751 2064 if (der->keyOID == RSAk) {
wolfSSL 11:cee25a834751 2065 if (wc_InitRsaKey(&a, NULL) == 0 &&
wolfSSL 11:cee25a834751 2066 wc_RsaPrivateKeyDecode(key, &keyIdx, &a, keySz) == 0) {
wolfSSL 11:cee25a834751 2067 WOLFSSL_MSG("Checking RSA key pair");
wolfSSL 11:cee25a834751 2068 keyIdx = 0; /* reset to 0 for parsing public key */
wolfSSL 11:cee25a834751 2069
wolfSSL 11:cee25a834751 2070 if (wc_InitRsaKey(&b, NULL) == 0) {
wolfSSL 11:cee25a834751 2071 if ((ret = wc_RsaPublicKeyDecode(der->publicKey, &keyIdx,
wolfSSL 11:cee25a834751 2072 &b, der->pubKeySize)) == 0) {
wolfSSL 11:cee25a834751 2073 /* limit for user RSA crypto because of RsaKey
wolfSSL 11:cee25a834751 2074 * dereference. */
wolfSSL 11:cee25a834751 2075 #if defined(HAVE_USER_RSA)
wolfSSL 11:cee25a834751 2076 WOLFSSL_MSG("Cannot verify RSA pair with user RSA");
wolfSSL 11:cee25a834751 2077 wc_FreeRsaKey(&b);
wolfSSL 11:cee25a834751 2078 wc_FreeRsaKey(&a);
wolfSSL 11:cee25a834751 2079 return 1; /* return first RSA cert as match */
wolfSSL 11:cee25a834751 2080 #else
wolfSSL 11:cee25a834751 2081 /* both keys extracted successfully now check n and e
wolfSSL 11:cee25a834751 2082 * values are the same. This is dereferencing RsaKey */
wolfSSL 11:cee25a834751 2083 if (mp_cmp(&(a.n), &(b.n)) != MP_EQ ||
wolfSSL 11:cee25a834751 2084 mp_cmp(&(a.e), &(b.e)) != MP_EQ) {
wolfSSL 11:cee25a834751 2085 ret = MP_CMP_E;
wolfSSL 11:cee25a834751 2086 }
wolfSSL 11:cee25a834751 2087 else {
wolfSSL 11:cee25a834751 2088 /* match found, free keys and return success */
wolfSSL 11:cee25a834751 2089 wc_FreeRsaKey(&b);
wolfSSL 11:cee25a834751 2090 wc_FreeRsaKey(&a);
wolfSSL 11:cee25a834751 2091 return 1;
wolfSSL 11:cee25a834751 2092 }
wolfSSL 11:cee25a834751 2093 #endif
wolfSSL 11:cee25a834751 2094 }
wolfSSL 11:cee25a834751 2095 wc_FreeRsaKey(&b);
wolfSSL 11:cee25a834751 2096 }
wolfSSL 11:cee25a834751 2097 }
wolfSSL 11:cee25a834751 2098 wc_FreeRsaKey(&a);
wolfSSL 11:cee25a834751 2099 }
wolfSSL 11:cee25a834751 2100
wolfSSL 11:cee25a834751 2101 /* if ret is not 0 then there was a failed comparision attempt */
wolfSSL 11:cee25a834751 2102 if (ret != 0) {
wolfSSL 11:cee25a834751 2103 return ret;
wolfSSL 11:cee25a834751 2104 }
wolfSSL 11:cee25a834751 2105 }
wolfSSL 11:cee25a834751 2106 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 2107
wolfSSL 11:cee25a834751 2108 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 2109 {
wolfSSL 11:cee25a834751 2110 int ret = 0;
wolfSSL 11:cee25a834751 2111 word32 keyIdx = 0;
wolfSSL 11:cee25a834751 2112 ecc_key key_pair;
wolfSSL 11:cee25a834751 2113
wolfSSL 11:cee25a834751 2114 if (der->keyOID == ECDSAk) {
wolfSSL 11:cee25a834751 2115 if ((ret = wc_ecc_init(&key_pair)) == 0 &&
wolfSSL 11:cee25a834751 2116 wc_EccPrivateKeyDecode(key, &keyIdx, &key_pair, keySz) == 0) {
wolfSSL 11:cee25a834751 2117 WOLFSSL_MSG("Checking ECC key pair");
wolfSSL 11:cee25a834751 2118 keyIdx = 0;
wolfSSL 11:cee25a834751 2119 if ((ret = wc_ecc_import_x963(der->publicKey, der->pubKeySize,
wolfSSL 11:cee25a834751 2120 &key_pair)) == 0) {
wolfSSL 11:cee25a834751 2121 /* public and private extracted successfuly no check if is
wolfSSL 11:cee25a834751 2122 * a pair and also do sanity checks on key. wc_ecc_check_key
wolfSSL 11:cee25a834751 2123 * checks that private * base generator equals pubkey */
wolfSSL 11:cee25a834751 2124 if ((ret = wc_ecc_check_key(&key_pair)) == 0) {
wolfSSL 11:cee25a834751 2125 /* found a match */
wolfSSL 11:cee25a834751 2126 wc_ecc_free(&key_pair);
wolfSSL 11:cee25a834751 2127 return 1;
wolfSSL 11:cee25a834751 2128 }
wolfSSL 11:cee25a834751 2129
wolfSSL 11:cee25a834751 2130 }
wolfSSL 11:cee25a834751 2131 }
wolfSSL 11:cee25a834751 2132 wc_ecc_free(&key_pair);
wolfSSL 11:cee25a834751 2133 }
wolfSSL 11:cee25a834751 2134
wolfSSL 11:cee25a834751 2135 /* error on attempt to match */
wolfSSL 11:cee25a834751 2136 if (ret != 0) {
wolfSSL 11:cee25a834751 2137 return ret;
wolfSSL 11:cee25a834751 2138 }
wolfSSL 11:cee25a834751 2139 }
wolfSSL 11:cee25a834751 2140 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 2141
wolfSSL 11:cee25a834751 2142 /* no match found */
wolfSSL 11:cee25a834751 2143 return 0;
wolfSSL 11:cee25a834751 2144 }
wolfSSL 11:cee25a834751 2145
wolfSSL 11:cee25a834751 2146 #ifndef NO_PWDBASED
wolfSSL 11:cee25a834751 2147
wolfSSL 11:cee25a834751 2148 /* Check To see if PKCS version algo is supported, set id if it is return 0
wolfSSL 11:cee25a834751 2149 < 0 on error */
wolfSSL 11:cee25a834751 2150 static int CheckAlgo(int first, int second, int* id, int* version)
wolfSSL 11:cee25a834751 2151 {
wolfSSL 11:cee25a834751 2152 *id = ALGO_ID_E;
wolfSSL 11:cee25a834751 2153 *version = PKCS5; /* default */
wolfSSL 11:cee25a834751 2154
wolfSSL 11:cee25a834751 2155 if (first == 1) {
wolfSSL 11:cee25a834751 2156 switch (second) {
wolfSSL 11:cee25a834751 2157 case 1:
wolfSSL 11:cee25a834751 2158 *id = PBE_SHA1_RC4_128;
wolfSSL 11:cee25a834751 2159 *version = PKCS12v1;
wolfSSL 11:cee25a834751 2160 return 0;
wolfSSL 11:cee25a834751 2161 case 3:
wolfSSL 11:cee25a834751 2162 *id = PBE_SHA1_DES3;
wolfSSL 11:cee25a834751 2163 *version = PKCS12v1;
wolfSSL 11:cee25a834751 2164 return 0;
wolfSSL 11:cee25a834751 2165 default:
wolfSSL 11:cee25a834751 2166 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2167 }
wolfSSL 11:cee25a834751 2168 }
wolfSSL 11:cee25a834751 2169
wolfSSL 11:cee25a834751 2170 if (first != PKCS5)
wolfSSL 11:cee25a834751 2171 return ASN_INPUT_E; /* VERSION ERROR */
wolfSSL 11:cee25a834751 2172
wolfSSL 11:cee25a834751 2173 if (second == PBES2) {
wolfSSL 11:cee25a834751 2174 *version = PKCS5v2;
wolfSSL 11:cee25a834751 2175 return 0;
wolfSSL 11:cee25a834751 2176 }
wolfSSL 11:cee25a834751 2177
wolfSSL 11:cee25a834751 2178 switch (second) {
wolfSSL 11:cee25a834751 2179 case 3: /* see RFC 2898 for ids */
wolfSSL 11:cee25a834751 2180 *id = PBE_MD5_DES;
wolfSSL 11:cee25a834751 2181 return 0;
wolfSSL 11:cee25a834751 2182 case 10:
wolfSSL 11:cee25a834751 2183 *id = PBE_SHA1_DES;
wolfSSL 11:cee25a834751 2184 return 0;
wolfSSL 11:cee25a834751 2185 default:
wolfSSL 11:cee25a834751 2186 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2187
wolfSSL 11:cee25a834751 2188 }
wolfSSL 11:cee25a834751 2189 }
wolfSSL 11:cee25a834751 2190
wolfSSL 11:cee25a834751 2191
wolfSSL 11:cee25a834751 2192 /* Check To see if PKCS v2 algo is supported, set id if it is return 0
wolfSSL 11:cee25a834751 2193 < 0 on error */
wolfSSL 11:cee25a834751 2194 static int CheckAlgoV2(int oid, int* id)
wolfSSL 11:cee25a834751 2195 {
wolfSSL 11:cee25a834751 2196 switch (oid) {
wolfSSL 11:cee25a834751 2197 case 69:
wolfSSL 11:cee25a834751 2198 *id = PBE_SHA1_DES;
wolfSSL 11:cee25a834751 2199 return 0;
wolfSSL 11:cee25a834751 2200 case 652:
wolfSSL 11:cee25a834751 2201 *id = PBE_SHA1_DES3;
wolfSSL 11:cee25a834751 2202 return 0;
wolfSSL 11:cee25a834751 2203 default:
wolfSSL 11:cee25a834751 2204 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2205
wolfSSL 11:cee25a834751 2206 }
wolfSSL 11:cee25a834751 2207 }
wolfSSL 11:cee25a834751 2208
wolfSSL 11:cee25a834751 2209
wolfSSL 11:cee25a834751 2210 /* Decrypt input in place from parameters based on id */
wolfSSL 11:cee25a834751 2211 static int DecryptKey(const char* password, int passwordSz, byte* salt,
wolfSSL 11:cee25a834751 2212 int saltSz, int iterations, int id, byte* input,
wolfSSL 11:cee25a834751 2213 int length, int version, byte* cbcIv)
wolfSSL 11:cee25a834751 2214 {
wolfSSL 11:cee25a834751 2215 int typeH;
wolfSSL 11:cee25a834751 2216 int derivedLen;
wolfSSL 11:cee25a834751 2217 int decryptionType;
wolfSSL 11:cee25a834751 2218 int ret = 0;
wolfSSL 11:cee25a834751 2219 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2220 byte* key;
wolfSSL 11:cee25a834751 2221 #else
wolfSSL 11:cee25a834751 2222 byte key[MAX_KEY_SIZE];
wolfSSL 11:cee25a834751 2223 #endif
wolfSSL 11:cee25a834751 2224
wolfSSL 11:cee25a834751 2225 (void)input;
wolfSSL 11:cee25a834751 2226 (void)length;
wolfSSL 11:cee25a834751 2227
wolfSSL 11:cee25a834751 2228 switch (id) {
wolfSSL 11:cee25a834751 2229 case PBE_MD5_DES:
wolfSSL 11:cee25a834751 2230 typeH = MD5;
wolfSSL 11:cee25a834751 2231 derivedLen = 16; /* may need iv for v1.5 */
wolfSSL 11:cee25a834751 2232 decryptionType = DES_TYPE;
wolfSSL 11:cee25a834751 2233 break;
wolfSSL 11:cee25a834751 2234
wolfSSL 11:cee25a834751 2235 case PBE_SHA1_DES:
wolfSSL 11:cee25a834751 2236 typeH = SHA;
wolfSSL 11:cee25a834751 2237 derivedLen = 16; /* may need iv for v1.5 */
wolfSSL 11:cee25a834751 2238 decryptionType = DES_TYPE;
wolfSSL 11:cee25a834751 2239 break;
wolfSSL 11:cee25a834751 2240
wolfSSL 11:cee25a834751 2241 case PBE_SHA1_DES3:
wolfSSL 11:cee25a834751 2242 typeH = SHA;
wolfSSL 11:cee25a834751 2243 derivedLen = 32; /* may need iv for v1.5 */
wolfSSL 11:cee25a834751 2244 decryptionType = DES3_TYPE;
wolfSSL 11:cee25a834751 2245 break;
wolfSSL 11:cee25a834751 2246
wolfSSL 11:cee25a834751 2247 case PBE_SHA1_RC4_128:
wolfSSL 11:cee25a834751 2248 typeH = SHA;
wolfSSL 11:cee25a834751 2249 derivedLen = 16;
wolfSSL 11:cee25a834751 2250 decryptionType = RC4_TYPE;
wolfSSL 11:cee25a834751 2251 break;
wolfSSL 11:cee25a834751 2252
wolfSSL 11:cee25a834751 2253 default:
wolfSSL 11:cee25a834751 2254 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2255 }
wolfSSL 11:cee25a834751 2256
wolfSSL 11:cee25a834751 2257 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2258 key = (byte*)XMALLOC(MAX_KEY_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2259 if (key == NULL)
wolfSSL 11:cee25a834751 2260 return MEMORY_E;
wolfSSL 11:cee25a834751 2261 #endif
wolfSSL 11:cee25a834751 2262
wolfSSL 11:cee25a834751 2263 if (version == PKCS5v2)
wolfSSL 11:cee25a834751 2264 ret = wc_PBKDF2(key, (byte*)password, passwordSz,
wolfSSL 11:cee25a834751 2265 salt, saltSz, iterations, derivedLen, typeH);
wolfSSL 11:cee25a834751 2266 #ifndef NO_SHA
wolfSSL 11:cee25a834751 2267 else if (version == PKCS5)
wolfSSL 11:cee25a834751 2268 ret = wc_PBKDF1(key, (byte*)password, passwordSz,
wolfSSL 11:cee25a834751 2269 salt, saltSz, iterations, derivedLen, typeH);
wolfSSL 11:cee25a834751 2270 #endif
wolfSSL 11:cee25a834751 2271 else if (version == PKCS12v1) {
wolfSSL 11:cee25a834751 2272 int i, idx = 0;
wolfSSL 11:cee25a834751 2273 byte unicodePasswd[MAX_UNICODE_SZ];
wolfSSL 11:cee25a834751 2274
wolfSSL 11:cee25a834751 2275 if ( (passwordSz * 2 + 2) > (int)sizeof(unicodePasswd)) {
wolfSSL 11:cee25a834751 2276 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2277 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2278 #endif
wolfSSL 11:cee25a834751 2279 return UNICODE_SIZE_E;
wolfSSL 11:cee25a834751 2280 }
wolfSSL 11:cee25a834751 2281
wolfSSL 11:cee25a834751 2282 for (i = 0; i < passwordSz; i++) {
wolfSSL 11:cee25a834751 2283 unicodePasswd[idx++] = 0x00;
wolfSSL 11:cee25a834751 2284 unicodePasswd[idx++] = (byte)password[i];
wolfSSL 11:cee25a834751 2285 }
wolfSSL 11:cee25a834751 2286 /* add trailing NULL */
wolfSSL 11:cee25a834751 2287 unicodePasswd[idx++] = 0x00;
wolfSSL 11:cee25a834751 2288 unicodePasswd[idx++] = 0x00;
wolfSSL 11:cee25a834751 2289
wolfSSL 11:cee25a834751 2290 ret = wc_PKCS12_PBKDF(key, unicodePasswd, idx, salt, saltSz,
wolfSSL 11:cee25a834751 2291 iterations, derivedLen, typeH, 1);
wolfSSL 11:cee25a834751 2292 if (decryptionType != RC4_TYPE)
wolfSSL 11:cee25a834751 2293 ret += wc_PKCS12_PBKDF(cbcIv, unicodePasswd, idx, salt, saltSz,
wolfSSL 11:cee25a834751 2294 iterations, 8, typeH, 2);
wolfSSL 11:cee25a834751 2295 }
wolfSSL 11:cee25a834751 2296 else {
wolfSSL 11:cee25a834751 2297 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2298 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2299 #endif
wolfSSL 11:cee25a834751 2300 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2301 }
wolfSSL 11:cee25a834751 2302
wolfSSL 11:cee25a834751 2303 if (ret != 0) {
wolfSSL 11:cee25a834751 2304 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2305 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2306 #endif
wolfSSL 11:cee25a834751 2307 return ret;
wolfSSL 11:cee25a834751 2308 }
wolfSSL 11:cee25a834751 2309
wolfSSL 11:cee25a834751 2310 switch (decryptionType) {
wolfSSL 11:cee25a834751 2311 #ifndef NO_DES3
wolfSSL 11:cee25a834751 2312 case DES_TYPE:
wolfSSL 11:cee25a834751 2313 {
wolfSSL 11:cee25a834751 2314 Des dec;
wolfSSL 11:cee25a834751 2315 byte* desIv = key + 8;
wolfSSL 11:cee25a834751 2316
wolfSSL 11:cee25a834751 2317 if (version == PKCS5v2 || version == PKCS12v1)
wolfSSL 11:cee25a834751 2318 desIv = cbcIv;
wolfSSL 11:cee25a834751 2319
wolfSSL 11:cee25a834751 2320 ret = wc_Des_SetKey(&dec, key, desIv, DES_DECRYPTION);
wolfSSL 11:cee25a834751 2321 if (ret != 0) {
wolfSSL 11:cee25a834751 2322 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2323 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2324 #endif
wolfSSL 11:cee25a834751 2325 return ret;
wolfSSL 11:cee25a834751 2326 }
wolfSSL 11:cee25a834751 2327
wolfSSL 11:cee25a834751 2328 wc_Des_CbcDecrypt(&dec, input, input, length);
wolfSSL 11:cee25a834751 2329 break;
wolfSSL 11:cee25a834751 2330 }
wolfSSL 11:cee25a834751 2331
wolfSSL 11:cee25a834751 2332 case DES3_TYPE:
wolfSSL 11:cee25a834751 2333 {
wolfSSL 11:cee25a834751 2334 Des3 dec;
wolfSSL 11:cee25a834751 2335 byte* desIv = key + 24;
wolfSSL 11:cee25a834751 2336
wolfSSL 11:cee25a834751 2337 if (version == PKCS5v2 || version == PKCS12v1)
wolfSSL 11:cee25a834751 2338 desIv = cbcIv;
wolfSSL 11:cee25a834751 2339 ret = wc_Des3_SetKey(&dec, key, desIv, DES_DECRYPTION);
wolfSSL 11:cee25a834751 2340 if (ret != 0) {
wolfSSL 11:cee25a834751 2341 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2342 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2343 #endif
wolfSSL 11:cee25a834751 2344 return ret;
wolfSSL 11:cee25a834751 2345 }
wolfSSL 11:cee25a834751 2346 ret = wc_Des3_CbcDecrypt(&dec, input, input, length);
wolfSSL 11:cee25a834751 2347 if (ret != 0) {
wolfSSL 11:cee25a834751 2348 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2349 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2350 #endif
wolfSSL 11:cee25a834751 2351 return ret;
wolfSSL 11:cee25a834751 2352 }
wolfSSL 11:cee25a834751 2353 break;
wolfSSL 11:cee25a834751 2354 }
wolfSSL 11:cee25a834751 2355 #endif
wolfSSL 11:cee25a834751 2356 #ifndef NO_RC4
wolfSSL 11:cee25a834751 2357 case RC4_TYPE:
wolfSSL 11:cee25a834751 2358 {
wolfSSL 11:cee25a834751 2359 Arc4 dec;
wolfSSL 11:cee25a834751 2360
wolfSSL 11:cee25a834751 2361 wc_Arc4SetKey(&dec, key, derivedLen);
wolfSSL 11:cee25a834751 2362 wc_Arc4Process(&dec, input, input, length);
wolfSSL 11:cee25a834751 2363 break;
wolfSSL 11:cee25a834751 2364 }
wolfSSL 11:cee25a834751 2365 #endif
wolfSSL 11:cee25a834751 2366
wolfSSL 11:cee25a834751 2367 default:
wolfSSL 11:cee25a834751 2368 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2369 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2370 #endif
wolfSSL 11:cee25a834751 2371 return ALGO_ID_E;
wolfSSL 11:cee25a834751 2372 }
wolfSSL 11:cee25a834751 2373
wolfSSL 11:cee25a834751 2374 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2375 XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2376 #endif
wolfSSL 11:cee25a834751 2377
wolfSSL 11:cee25a834751 2378 return 0;
wolfSSL 11:cee25a834751 2379 }
wolfSSL 11:cee25a834751 2380
wolfSSL 11:cee25a834751 2381
wolfSSL 11:cee25a834751 2382 int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
wolfSSL 11:cee25a834751 2383 int* algoID, void* heap)
wolfSSL 11:cee25a834751 2384 {
wolfSSL 11:cee25a834751 2385 word32 tmpIdx = 0;
wolfSSL 11:cee25a834751 2386 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 2387 ecc_key ecc;
wolfSSL 11:cee25a834751 2388 #endif
wolfSSL 11:cee25a834751 2389 #ifndef NO_RSA
wolfSSL 11:cee25a834751 2390 RsaKey rsa;
wolfSSL 11:cee25a834751 2391 #endif
wolfSSL 11:cee25a834751 2392
wolfSSL 11:cee25a834751 2393 if (algoID == NULL) {
wolfSSL 11:cee25a834751 2394 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2395 }
wolfSSL 11:cee25a834751 2396 *algoID = 0;
wolfSSL 11:cee25a834751 2397
wolfSSL 11:cee25a834751 2398 #ifndef NO_RSA
wolfSSL 11:cee25a834751 2399 if (wc_InitRsaKey(&rsa, heap) == 0) {
wolfSSL 11:cee25a834751 2400 if (wc_RsaPrivateKeyDecode(key, &tmpIdx, &rsa, keySz) == 0) {
wolfSSL 11:cee25a834751 2401 *algoID = RSAk;
wolfSSL 11:cee25a834751 2402 }
wolfSSL 11:cee25a834751 2403 else {
wolfSSL 11:cee25a834751 2404 WOLFSSL_MSG("Not RSA DER key");
wolfSSL 11:cee25a834751 2405 }
wolfSSL 11:cee25a834751 2406 wc_FreeRsaKey(&rsa);
wolfSSL 11:cee25a834751 2407 }
wolfSSL 11:cee25a834751 2408 else {
wolfSSL 11:cee25a834751 2409 WOLFSSL_MSG("GetKeyOID wc_InitRsaKey failed");
wolfSSL 11:cee25a834751 2410 }
wolfSSL 11:cee25a834751 2411 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 2412 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 2413 if (*algoID != RSAk) {
wolfSSL 11:cee25a834751 2414 tmpIdx = 0;
wolfSSL 11:cee25a834751 2415 if (wc_ecc_init_ex(&ecc, heap, INVALID_DEVID) == 0) {
wolfSSL 11:cee25a834751 2416 if (wc_EccPrivateKeyDecode(key, &tmpIdx, &ecc, keySz) == 0) {
wolfSSL 11:cee25a834751 2417 *algoID = ECDSAk;
wolfSSL 11:cee25a834751 2418
wolfSSL 11:cee25a834751 2419 /* sanity check on arguments */
wolfSSL 11:cee25a834751 2420 if (curveOID == NULL || oidSz == NULL) {
wolfSSL 11:cee25a834751 2421 WOLFSSL_MSG("Error getting ECC curve OID");
wolfSSL 11:cee25a834751 2422 wc_ecc_free(&ecc);
wolfSSL 11:cee25a834751 2423 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2424 }
wolfSSL 11:cee25a834751 2425
wolfSSL 11:cee25a834751 2426 /* now find oid */
wolfSSL 11:cee25a834751 2427 if (wc_ecc_get_oid(ecc.dp->oidSum, curveOID, oidSz) < 0) {
wolfSSL 11:cee25a834751 2428 WOLFSSL_MSG("Error getting ECC curve OID");
wolfSSL 11:cee25a834751 2429 wc_ecc_free(&ecc);
wolfSSL 11:cee25a834751 2430 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2431 }
wolfSSL 11:cee25a834751 2432 }
wolfSSL 11:cee25a834751 2433 else {
wolfSSL 11:cee25a834751 2434 WOLFSSL_MSG("Not ECC DER key either");
wolfSSL 11:cee25a834751 2435 }
wolfSSL 11:cee25a834751 2436 wc_ecc_free(&ecc);
wolfSSL 11:cee25a834751 2437 }
wolfSSL 11:cee25a834751 2438 else {
wolfSSL 11:cee25a834751 2439 WOLFSSL_MSG("GetKeyOID wc_ecc_init_ex failed");
wolfSSL 11:cee25a834751 2440 }
wolfSSL 11:cee25a834751 2441 }
wolfSSL 11:cee25a834751 2442 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 2443
wolfSSL 11:cee25a834751 2444 /* if flag is not set then is neither RSA or ECC key that could be
wolfSSL 11:cee25a834751 2445 * found */
wolfSSL 11:cee25a834751 2446 if (*algoID == 0) {
wolfSSL 11:cee25a834751 2447 WOLFSSL_MSG("Bad key DER or compile options");
wolfSSL 11:cee25a834751 2448 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2449 }
wolfSSL 11:cee25a834751 2450
wolfSSL 11:cee25a834751 2451 (void)curveOID;
wolfSSL 11:cee25a834751 2452 (void)oidSz;
wolfSSL 11:cee25a834751 2453
wolfSSL 11:cee25a834751 2454 return 1;
wolfSSL 11:cee25a834751 2455 }
wolfSSL 11:cee25a834751 2456
wolfSSL 11:cee25a834751 2457
wolfSSL 11:cee25a834751 2458 /* Remove Encrypted PKCS8 header, move beginning of traditional to beginning
wolfSSL 11:cee25a834751 2459 of input */
wolfSSL 11:cee25a834751 2460 int ToTraditionalEnc(byte* input, word32 sz,const char* password,int passwordSz)
wolfSSL 11:cee25a834751 2461 {
wolfSSL 11:cee25a834751 2462 word32 inOutIdx = 0, oid;
wolfSSL 11:cee25a834751 2463 int ret = 0, first, second, length = 0, version, saltSz, id;
wolfSSL 11:cee25a834751 2464 int iterations = 0;
wolfSSL 11:cee25a834751 2465 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2466 byte* salt = NULL;
wolfSSL 11:cee25a834751 2467 byte* cbcIv = NULL;
wolfSSL 11:cee25a834751 2468 #else
wolfSSL 11:cee25a834751 2469 byte salt[MAX_SALT_SIZE];
wolfSSL 11:cee25a834751 2470 byte cbcIv[MAX_IV_SIZE];
wolfSSL 11:cee25a834751 2471 #endif
wolfSSL 11:cee25a834751 2472
wolfSSL 11:cee25a834751 2473 if (GetSequence(input, &inOutIdx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 2474 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2475 }
wolfSSL 11:cee25a834751 2476
wolfSSL 11:cee25a834751 2477 if (GetAlgoId(input, &inOutIdx, &oid, oidSigType, sz) < 0) {
wolfSSL 11:cee25a834751 2478 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2479 }
wolfSSL 11:cee25a834751 2480
wolfSSL 11:cee25a834751 2481 first = input[inOutIdx - 2]; /* PKCS version always 2nd to last byte */
wolfSSL 11:cee25a834751 2482 second = input[inOutIdx - 1]; /* version.algo, algo id last byte */
wolfSSL 11:cee25a834751 2483
wolfSSL 11:cee25a834751 2484 if (CheckAlgo(first, second, &id, &version) < 0) {
wolfSSL 11:cee25a834751 2485 ERROR_OUT(ASN_INPUT_E, exit_tte); /* Algo ID error */
wolfSSL 11:cee25a834751 2486 }
wolfSSL 11:cee25a834751 2487
wolfSSL 11:cee25a834751 2488 if (version == PKCS5v2) {
wolfSSL 11:cee25a834751 2489 if (GetSequence(input, &inOutIdx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 2490 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2491 }
wolfSSL 11:cee25a834751 2492
wolfSSL 11:cee25a834751 2493 if (GetAlgoId(input, &inOutIdx, &oid, oidKdfType, sz) < 0) {
wolfSSL 11:cee25a834751 2494 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2495 }
wolfSSL 11:cee25a834751 2496
wolfSSL 11:cee25a834751 2497 if (oid != PBKDF2_OID) {
wolfSSL 11:cee25a834751 2498 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2499 }
wolfSSL 11:cee25a834751 2500 }
wolfSSL 11:cee25a834751 2501
wolfSSL 11:cee25a834751 2502 if (GetSequence(input, &inOutIdx, &length, sz) <= 0) {
wolfSSL 11:cee25a834751 2503 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2504 }
wolfSSL 11:cee25a834751 2505
wolfSSL 11:cee25a834751 2506 ret = GetOctetString(input, &inOutIdx, &saltSz, sz);
wolfSSL 11:cee25a834751 2507 if (ret < 0)
wolfSSL 11:cee25a834751 2508 goto exit_tte;
wolfSSL 11:cee25a834751 2509
wolfSSL 11:cee25a834751 2510 if (saltSz > MAX_SALT_SIZE) {
wolfSSL 11:cee25a834751 2511 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2512 }
wolfSSL 11:cee25a834751 2513
wolfSSL 11:cee25a834751 2514 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2515 salt = (byte*)XMALLOC(MAX_SALT_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2516 if (salt == NULL) {
wolfSSL 11:cee25a834751 2517 ERROR_OUT(MEMORY_E, exit_tte);
wolfSSL 11:cee25a834751 2518 }
wolfSSL 11:cee25a834751 2519 #endif
wolfSSL 11:cee25a834751 2520
wolfSSL 11:cee25a834751 2521 XMEMCPY(salt, &input[inOutIdx], saltSz);
wolfSSL 11:cee25a834751 2522 inOutIdx += saltSz;
wolfSSL 11:cee25a834751 2523
wolfSSL 11:cee25a834751 2524 if (GetShortInt(input, &inOutIdx, &iterations, sz) < 0) {
wolfSSL 11:cee25a834751 2525 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2526 }
wolfSSL 11:cee25a834751 2527
wolfSSL 11:cee25a834751 2528 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2529 cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2530 if (cbcIv == NULL) {
wolfSSL 11:cee25a834751 2531 ERROR_OUT(MEMORY_E, exit_tte);
wolfSSL 11:cee25a834751 2532 }
wolfSSL 11:cee25a834751 2533 #endif
wolfSSL 11:cee25a834751 2534
wolfSSL 11:cee25a834751 2535 if (version == PKCS5v2) {
wolfSSL 11:cee25a834751 2536 /* get encryption algo */
wolfSSL 11:cee25a834751 2537 /* JOHN: New type. Need a little more research. */
wolfSSL 11:cee25a834751 2538 if (GetAlgoId(input, &inOutIdx, &oid, oidBlkType, sz) < 0) {
wolfSSL 11:cee25a834751 2539 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2540 }
wolfSSL 11:cee25a834751 2541
wolfSSL 11:cee25a834751 2542 if (CheckAlgoV2(oid, &id) < 0) {
wolfSSL 11:cee25a834751 2543 ERROR_OUT(ASN_PARSE_E, exit_tte); /* PKCS v2 algo id error */
wolfSSL 11:cee25a834751 2544 }
wolfSSL 11:cee25a834751 2545
wolfSSL 11:cee25a834751 2546 ret = GetOctetString(input, &inOutIdx, &length, sz);
wolfSSL 11:cee25a834751 2547 if (ret < 0)
wolfSSL 11:cee25a834751 2548 goto exit_tte;
wolfSSL 11:cee25a834751 2549
wolfSSL 11:cee25a834751 2550 if (length > MAX_IV_SIZE) {
wolfSSL 11:cee25a834751 2551 ERROR_OUT(ASN_PARSE_E, exit_tte);
wolfSSL 11:cee25a834751 2552 }
wolfSSL 11:cee25a834751 2553
wolfSSL 11:cee25a834751 2554 XMEMCPY(cbcIv, &input[inOutIdx], length);
wolfSSL 11:cee25a834751 2555 inOutIdx += length;
wolfSSL 11:cee25a834751 2556 }
wolfSSL 11:cee25a834751 2557
wolfSSL 11:cee25a834751 2558 ret = GetOctetString(input, &inOutIdx, &length, sz);
wolfSSL 11:cee25a834751 2559 if (ret < 0)
wolfSSL 11:cee25a834751 2560 goto exit_tte;
wolfSSL 11:cee25a834751 2561
wolfSSL 11:cee25a834751 2562 ret = DecryptKey(password, passwordSz, salt, saltSz, iterations, id,
wolfSSL 11:cee25a834751 2563 input + inOutIdx, length, version, cbcIv);
wolfSSL 11:cee25a834751 2564
wolfSSL 11:cee25a834751 2565 exit_tte:
wolfSSL 11:cee25a834751 2566 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2567 XFREE(salt, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2568 XFREE(cbcIv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2569 #endif
wolfSSL 11:cee25a834751 2570
wolfSSL 11:cee25a834751 2571 if (ret == 0) {
wolfSSL 11:cee25a834751 2572 XMEMMOVE(input, input + inOutIdx, length);
wolfSSL 11:cee25a834751 2573 ret = ToTraditional(input, length);
wolfSSL 11:cee25a834751 2574 }
wolfSSL 11:cee25a834751 2575
wolfSSL 11:cee25a834751 2576 return ret;
wolfSSL 11:cee25a834751 2577 }
wolfSSL 11:cee25a834751 2578
wolfSSL 11:cee25a834751 2579 /* decrypt PKCS */
wolfSSL 11:cee25a834751 2580 int DecryptContent(byte* input, word32 sz,const char* password,int passwordSz)
wolfSSL 11:cee25a834751 2581 {
wolfSSL 11:cee25a834751 2582 word32 inOutIdx = 0, oid;
wolfSSL 11:cee25a834751 2583 int ret = 0;
wolfSSL 11:cee25a834751 2584 int first, second, length = 0, version, saltSz, id;
wolfSSL 11:cee25a834751 2585 int iterations = 0;
wolfSSL 11:cee25a834751 2586 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2587 byte* salt = NULL;
wolfSSL 11:cee25a834751 2588 byte* cbcIv = NULL;
wolfSSL 11:cee25a834751 2589 #else
wolfSSL 11:cee25a834751 2590 byte salt[MAX_SALT_SIZE];
wolfSSL 11:cee25a834751 2591 byte cbcIv[MAX_IV_SIZE];
wolfSSL 11:cee25a834751 2592 #endif
wolfSSL 11:cee25a834751 2593
wolfSSL 11:cee25a834751 2594 if (GetAlgoId(input, &inOutIdx, &oid, oidSigType, sz) < 0) {
wolfSSL 11:cee25a834751 2595 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2596 }
wolfSSL 11:cee25a834751 2597
wolfSSL 11:cee25a834751 2598 first = input[inOutIdx - 2]; /* PKCS version always 2nd to last byte */
wolfSSL 11:cee25a834751 2599 second = input[inOutIdx - 1]; /* version.algo, algo id last byte */
wolfSSL 11:cee25a834751 2600
wolfSSL 11:cee25a834751 2601 if (CheckAlgo(first, second, &id, &version) < 0) {
wolfSSL 11:cee25a834751 2602 ERROR_OUT(ASN_INPUT_E, exit_dc); /* Algo ID error */
wolfSSL 11:cee25a834751 2603 }
wolfSSL 11:cee25a834751 2604
wolfSSL 11:cee25a834751 2605 if (version == PKCS5v2) {
wolfSSL 11:cee25a834751 2606 if (GetSequence(input, &inOutIdx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 2607 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2608 }
wolfSSL 11:cee25a834751 2609
wolfSSL 11:cee25a834751 2610 if (GetAlgoId(input, &inOutIdx, &oid, oidKdfType, sz) < 0) {
wolfSSL 11:cee25a834751 2611 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2612 }
wolfSSL 11:cee25a834751 2613
wolfSSL 11:cee25a834751 2614 if (oid != PBKDF2_OID) {
wolfSSL 11:cee25a834751 2615 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2616 }
wolfSSL 11:cee25a834751 2617 }
wolfSSL 11:cee25a834751 2618
wolfSSL 11:cee25a834751 2619 if (GetSequence(input, &inOutIdx, &length, sz) <= 0) {
wolfSSL 11:cee25a834751 2620 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2621 }
wolfSSL 11:cee25a834751 2622
wolfSSL 11:cee25a834751 2623 ret = GetOctetString(input, &inOutIdx, &saltSz, sz);
wolfSSL 11:cee25a834751 2624 if (ret < 0)
wolfSSL 11:cee25a834751 2625 goto exit_dc;
wolfSSL 11:cee25a834751 2626
wolfSSL 11:cee25a834751 2627 if (saltSz > MAX_SALT_SIZE) {
wolfSSL 11:cee25a834751 2628 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2629 }
wolfSSL 11:cee25a834751 2630
wolfSSL 11:cee25a834751 2631 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2632 salt = (byte*)XMALLOC(MAX_SALT_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2633 if (salt == NULL) {
wolfSSL 11:cee25a834751 2634 ERROR_OUT(MEMORY_E, exit_dc);
wolfSSL 11:cee25a834751 2635 }
wolfSSL 11:cee25a834751 2636 #endif
wolfSSL 11:cee25a834751 2637
wolfSSL 11:cee25a834751 2638 XMEMCPY(salt, &input[inOutIdx], saltSz);
wolfSSL 11:cee25a834751 2639 inOutIdx += saltSz;
wolfSSL 11:cee25a834751 2640
wolfSSL 11:cee25a834751 2641 if (GetShortInt(input, &inOutIdx, &iterations, sz) < 0) {
wolfSSL 11:cee25a834751 2642 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2643 }
wolfSSL 11:cee25a834751 2644
wolfSSL 11:cee25a834751 2645 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2646 cbcIv = (byte*)XMALLOC(MAX_IV_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2647 if (cbcIv == NULL) {
wolfSSL 11:cee25a834751 2648 ERROR_OUT(MEMORY_E, exit_dc);
wolfSSL 11:cee25a834751 2649 }
wolfSSL 11:cee25a834751 2650 #endif
wolfSSL 11:cee25a834751 2651
wolfSSL 11:cee25a834751 2652 if (version == PKCS5v2) {
wolfSSL 11:cee25a834751 2653 /* get encryption algo */
wolfSSL 11:cee25a834751 2654 /* JOHN: New type. Need a little more research. */
wolfSSL 11:cee25a834751 2655 if (GetAlgoId(input, &inOutIdx, &oid, oidBlkType, sz) < 0) {
wolfSSL 11:cee25a834751 2656 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2657 }
wolfSSL 11:cee25a834751 2658
wolfSSL 11:cee25a834751 2659 if (CheckAlgoV2(oid, &id) < 0) {
wolfSSL 11:cee25a834751 2660 ERROR_OUT(ASN_PARSE_E, exit_dc); /* PKCS v2 algo id error */
wolfSSL 11:cee25a834751 2661 }
wolfSSL 11:cee25a834751 2662
wolfSSL 11:cee25a834751 2663 ret = GetOctetString(input, &inOutIdx, &length, sz);
wolfSSL 11:cee25a834751 2664 if (ret < 0)
wolfSSL 11:cee25a834751 2665 goto exit_dc;
wolfSSL 11:cee25a834751 2666
wolfSSL 11:cee25a834751 2667 XMEMCPY(cbcIv, &input[inOutIdx], length);
wolfSSL 11:cee25a834751 2668 inOutIdx += length;
wolfSSL 11:cee25a834751 2669 }
wolfSSL 11:cee25a834751 2670
wolfSSL 11:cee25a834751 2671 if (input[inOutIdx++] != (ASN_CONTEXT_SPECIFIC | 0)) {
wolfSSL 11:cee25a834751 2672 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2673 }
wolfSSL 11:cee25a834751 2674
wolfSSL 11:cee25a834751 2675 if (GetLength(input, &inOutIdx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 2676 ERROR_OUT(ASN_PARSE_E, exit_dc);
wolfSSL 11:cee25a834751 2677 }
wolfSSL 11:cee25a834751 2678
wolfSSL 11:cee25a834751 2679 ret = DecryptKey(password, passwordSz, salt, saltSz, iterations, id,
wolfSSL 11:cee25a834751 2680 input + inOutIdx, length, version, cbcIv);
wolfSSL 11:cee25a834751 2681
wolfSSL 11:cee25a834751 2682 exit_dc:
wolfSSL 11:cee25a834751 2683
wolfSSL 11:cee25a834751 2684 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 2685 XFREE(salt, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2686 XFREE(cbcIv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 2687 #endif
wolfSSL 11:cee25a834751 2688
wolfSSL 11:cee25a834751 2689 if (ret == 0) {
wolfSSL 11:cee25a834751 2690 XMEMMOVE(input, input + inOutIdx, length);
wolfSSL 11:cee25a834751 2691 ret = length;
wolfSSL 11:cee25a834751 2692 }
wolfSSL 11:cee25a834751 2693
wolfSSL 11:cee25a834751 2694 return ret;
wolfSSL 11:cee25a834751 2695 }
wolfSSL 11:cee25a834751 2696 #endif /* NO_PWDBASED */
wolfSSL 11:cee25a834751 2697
wolfSSL 11:cee25a834751 2698 #ifndef NO_RSA
wolfSSL 11:cee25a834751 2699
wolfSSL 11:cee25a834751 2700 #ifndef HAVE_USER_RSA
wolfSSL 11:cee25a834751 2701 int wc_RsaPublicKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
wolfSSL 11:cee25a834751 2702 word32 inSz)
wolfSSL 11:cee25a834751 2703 {
wolfSSL 11:cee25a834751 2704 int length;
wolfSSL 11:cee25a834751 2705 #if defined(OPENSSL_EXTRA) || defined(RSA_DECODE_EXTRA)
wolfSSL 11:cee25a834751 2706 byte b;
wolfSSL 11:cee25a834751 2707 #endif
wolfSSL 11:cee25a834751 2708 int ret;
wolfSSL 11:cee25a834751 2709
wolfSSL 11:cee25a834751 2710 if (input == NULL || inOutIdx == NULL || key == NULL)
wolfSSL 11:cee25a834751 2711 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2712
wolfSSL 11:cee25a834751 2713 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2714 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2715
wolfSSL 11:cee25a834751 2716 key->type = RSA_PUBLIC;
wolfSSL 11:cee25a834751 2717
wolfSSL 11:cee25a834751 2718 #if defined(OPENSSL_EXTRA) || defined(RSA_DECODE_EXTRA)
wolfSSL 11:cee25a834751 2719 if ((*inOutIdx + 1) > inSz)
wolfSSL 11:cee25a834751 2720 return BUFFER_E;
wolfSSL 11:cee25a834751 2721
wolfSSL 11:cee25a834751 2722 b = input[*inOutIdx];
wolfSSL 11:cee25a834751 2723 if (b != ASN_INTEGER) {
wolfSSL 11:cee25a834751 2724 /* not from decoded cert, will have algo id, skip past */
wolfSSL 11:cee25a834751 2725 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2726 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2727
wolfSSL 11:cee25a834751 2728 if (SkipObjectId(input, inOutIdx, inSz) < 0)
wolfSSL 11:cee25a834751 2729 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2730
wolfSSL 11:cee25a834751 2731 /* Option NULL ASN.1 tag */
wolfSSL 11:cee25a834751 2732 if (input[*inOutIdx] == ASN_TAG_NULL) {
wolfSSL 11:cee25a834751 2733 ret = GetASNNull(input, inOutIdx, inSz);
wolfSSL 11:cee25a834751 2734 if (ret != 0)
wolfSSL 11:cee25a834751 2735 return ret;
wolfSSL 11:cee25a834751 2736 }
wolfSSL 11:cee25a834751 2737
wolfSSL 11:cee25a834751 2738 /* should have bit tag length and seq next */
wolfSSL 11:cee25a834751 2739 ret = CheckBitString(input, inOutIdx, NULL, inSz, 1, NULL);
wolfSSL 11:cee25a834751 2740 if (ret != 0)
wolfSSL 11:cee25a834751 2741 return ret;
wolfSSL 11:cee25a834751 2742
wolfSSL 11:cee25a834751 2743 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2744 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2745 }
wolfSSL 11:cee25a834751 2746 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 2747
wolfSSL 11:cee25a834751 2748 if (GetInt(&key->n, input, inOutIdx, inSz) < 0)
wolfSSL 11:cee25a834751 2749 return ASN_RSA_KEY_E;
wolfSSL 11:cee25a834751 2750 if (GetInt(&key->e, input, inOutIdx, inSz) < 0) {
wolfSSL 11:cee25a834751 2751 mp_clear(&key->n);
wolfSSL 11:cee25a834751 2752 return ASN_RSA_KEY_E;
wolfSSL 11:cee25a834751 2753 }
wolfSSL 11:cee25a834751 2754
wolfSSL 11:cee25a834751 2755 return 0;
wolfSSL 11:cee25a834751 2756 }
wolfSSL 11:cee25a834751 2757
wolfSSL 11:cee25a834751 2758 /* import RSA public key elements (n, e) into RsaKey structure (key) */
wolfSSL 11:cee25a834751 2759 int wc_RsaPublicKeyDecodeRaw(const byte* n, word32 nSz, const byte* e,
wolfSSL 11:cee25a834751 2760 word32 eSz, RsaKey* key)
wolfSSL 11:cee25a834751 2761 {
wolfSSL 11:cee25a834751 2762 if (n == NULL || e == NULL || key == NULL)
wolfSSL 11:cee25a834751 2763 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2764
wolfSSL 11:cee25a834751 2765 key->type = RSA_PUBLIC;
wolfSSL 11:cee25a834751 2766
wolfSSL 11:cee25a834751 2767 if (mp_init(&key->n) != MP_OKAY)
wolfSSL 11:cee25a834751 2768 return MP_INIT_E;
wolfSSL 11:cee25a834751 2769
wolfSSL 11:cee25a834751 2770 if (mp_read_unsigned_bin(&key->n, n, nSz) != 0) {
wolfSSL 11:cee25a834751 2771 mp_clear(&key->n);
wolfSSL 11:cee25a834751 2772 return ASN_GETINT_E;
wolfSSL 11:cee25a834751 2773 }
wolfSSL 11:cee25a834751 2774
wolfSSL 11:cee25a834751 2775 if (mp_init(&key->e) != MP_OKAY) {
wolfSSL 11:cee25a834751 2776 mp_clear(&key->n);
wolfSSL 11:cee25a834751 2777 return MP_INIT_E;
wolfSSL 11:cee25a834751 2778 }
wolfSSL 11:cee25a834751 2779
wolfSSL 11:cee25a834751 2780 if (mp_read_unsigned_bin(&key->e, e, eSz) != 0) {
wolfSSL 11:cee25a834751 2781 mp_clear(&key->n);
wolfSSL 11:cee25a834751 2782 mp_clear(&key->e);
wolfSSL 11:cee25a834751 2783 return ASN_GETINT_E;
wolfSSL 11:cee25a834751 2784 }
wolfSSL 11:cee25a834751 2785
wolfSSL 11:cee25a834751 2786 return 0;
wolfSSL 11:cee25a834751 2787 }
wolfSSL 11:cee25a834751 2788 #endif /* HAVE_USER_RSA */
wolfSSL 11:cee25a834751 2789 #endif
wolfSSL 11:cee25a834751 2790
wolfSSL 11:cee25a834751 2791 #ifndef NO_DH
wolfSSL 11:cee25a834751 2792
wolfSSL 11:cee25a834751 2793 int wc_DhKeyDecode(const byte* input, word32* inOutIdx, DhKey* key, word32 inSz)
wolfSSL 11:cee25a834751 2794 {
wolfSSL 11:cee25a834751 2795 int length;
wolfSSL 11:cee25a834751 2796
wolfSSL 11:cee25a834751 2797 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2798 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2799
wolfSSL 11:cee25a834751 2800 if (GetInt(&key->p, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2801 GetInt(&key->g, input, inOutIdx, inSz) < 0) {
wolfSSL 11:cee25a834751 2802 return ASN_DH_KEY_E;
wolfSSL 11:cee25a834751 2803 }
wolfSSL 11:cee25a834751 2804
wolfSSL 11:cee25a834751 2805 return 0;
wolfSSL 11:cee25a834751 2806 }
wolfSSL 11:cee25a834751 2807
wolfSSL 11:cee25a834751 2808
wolfSSL 11:cee25a834751 2809 int wc_DhParamsLoad(const byte* input, word32 inSz, byte* p, word32* pInOutSz,
wolfSSL 11:cee25a834751 2810 byte* g, word32* gInOutSz)
wolfSSL 11:cee25a834751 2811 {
wolfSSL 11:cee25a834751 2812 word32 idx = 0;
wolfSSL 11:cee25a834751 2813 int ret;
wolfSSL 11:cee25a834751 2814 int length;
wolfSSL 11:cee25a834751 2815
wolfSSL 11:cee25a834751 2816 if (GetSequence(input, &idx, &length, inSz) <= 0)
wolfSSL 11:cee25a834751 2817 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2818
wolfSSL 11:cee25a834751 2819 ret = GetASNInt(input, &idx, &length, inSz);
wolfSSL 11:cee25a834751 2820 if (ret != 0)
wolfSSL 11:cee25a834751 2821 return ret;
wolfSSL 11:cee25a834751 2822
wolfSSL 11:cee25a834751 2823 if (length <= (int)*pInOutSz) {
wolfSSL 11:cee25a834751 2824 XMEMCPY(p, &input[idx], length);
wolfSSL 11:cee25a834751 2825 *pInOutSz = length;
wolfSSL 11:cee25a834751 2826 }
wolfSSL 11:cee25a834751 2827 else {
wolfSSL 11:cee25a834751 2828 return BUFFER_E;
wolfSSL 11:cee25a834751 2829 }
wolfSSL 11:cee25a834751 2830 idx += length;
wolfSSL 11:cee25a834751 2831
wolfSSL 11:cee25a834751 2832 ret = GetASNInt(input, &idx, &length, inSz);
wolfSSL 11:cee25a834751 2833 if (ret != 0)
wolfSSL 11:cee25a834751 2834 return ret;
wolfSSL 11:cee25a834751 2835
wolfSSL 11:cee25a834751 2836 if (length <= (int)*gInOutSz) {
wolfSSL 11:cee25a834751 2837 XMEMCPY(g, &input[idx], length);
wolfSSL 11:cee25a834751 2838 *gInOutSz = length;
wolfSSL 11:cee25a834751 2839 }
wolfSSL 11:cee25a834751 2840 else {
wolfSSL 11:cee25a834751 2841 return BUFFER_E;
wolfSSL 11:cee25a834751 2842 }
wolfSSL 11:cee25a834751 2843
wolfSSL 11:cee25a834751 2844 return 0;
wolfSSL 11:cee25a834751 2845 }
wolfSSL 11:cee25a834751 2846
wolfSSL 11:cee25a834751 2847 #endif /* NO_DH */
wolfSSL 11:cee25a834751 2848
wolfSSL 11:cee25a834751 2849
wolfSSL 11:cee25a834751 2850 #ifndef NO_DSA
wolfSSL 11:cee25a834751 2851
wolfSSL 11:cee25a834751 2852 int DsaPublicKeyDecode(const byte* input, word32* inOutIdx, DsaKey* key,
wolfSSL 11:cee25a834751 2853 word32 inSz)
wolfSSL 11:cee25a834751 2854 {
wolfSSL 11:cee25a834751 2855 int length;
wolfSSL 11:cee25a834751 2856
wolfSSL 11:cee25a834751 2857 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2858 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2859
wolfSSL 11:cee25a834751 2860 if (GetInt(&key->p, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2861 GetInt(&key->q, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2862 GetInt(&key->g, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2863 GetInt(&key->y, input, inOutIdx, inSz) < 0 )
wolfSSL 11:cee25a834751 2864 return ASN_DH_KEY_E;
wolfSSL 11:cee25a834751 2865
wolfSSL 11:cee25a834751 2866 key->type = DSA_PUBLIC;
wolfSSL 11:cee25a834751 2867 return 0;
wolfSSL 11:cee25a834751 2868 }
wolfSSL 11:cee25a834751 2869
wolfSSL 11:cee25a834751 2870
wolfSSL 11:cee25a834751 2871 int DsaPrivateKeyDecode(const byte* input, word32* inOutIdx, DsaKey* key,
wolfSSL 11:cee25a834751 2872 word32 inSz)
wolfSSL 11:cee25a834751 2873 {
wolfSSL 11:cee25a834751 2874 int length, version;
wolfSSL 11:cee25a834751 2875
wolfSSL 11:cee25a834751 2876 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 2877 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2878
wolfSSL 11:cee25a834751 2879 if (GetMyVersion(input, inOutIdx, &version, inSz) < 0)
wolfSSL 11:cee25a834751 2880 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 2881
wolfSSL 11:cee25a834751 2882 if (GetInt(&key->p, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2883 GetInt(&key->q, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2884 GetInt(&key->g, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2885 GetInt(&key->y, input, inOutIdx, inSz) < 0 ||
wolfSSL 11:cee25a834751 2886 GetInt(&key->x, input, inOutIdx, inSz) < 0 )
wolfSSL 11:cee25a834751 2887 return ASN_DH_KEY_E;
wolfSSL 11:cee25a834751 2888
wolfSSL 11:cee25a834751 2889 key->type = DSA_PRIVATE;
wolfSSL 11:cee25a834751 2890 return 0;
wolfSSL 11:cee25a834751 2891 }
wolfSSL 11:cee25a834751 2892
wolfSSL 11:cee25a834751 2893 static mp_int* GetDsaInt(DsaKey* key, int idx)
wolfSSL 11:cee25a834751 2894 {
wolfSSL 11:cee25a834751 2895 if (idx == 0)
wolfSSL 11:cee25a834751 2896 return &key->p;
wolfSSL 11:cee25a834751 2897 if (idx == 1)
wolfSSL 11:cee25a834751 2898 return &key->q;
wolfSSL 11:cee25a834751 2899 if (idx == 2)
wolfSSL 11:cee25a834751 2900 return &key->g;
wolfSSL 11:cee25a834751 2901 if (idx == 3)
wolfSSL 11:cee25a834751 2902 return &key->y;
wolfSSL 11:cee25a834751 2903 if (idx == 4)
wolfSSL 11:cee25a834751 2904 return &key->x;
wolfSSL 11:cee25a834751 2905
wolfSSL 11:cee25a834751 2906 return NULL;
wolfSSL 11:cee25a834751 2907 }
wolfSSL 11:cee25a834751 2908
wolfSSL 11:cee25a834751 2909 /* Release Tmp DSA resources */
wolfSSL 11:cee25a834751 2910 static INLINE void FreeTmpDsas(byte** tmps, void* heap)
wolfSSL 11:cee25a834751 2911 {
wolfSSL 11:cee25a834751 2912 int i;
wolfSSL 11:cee25a834751 2913
wolfSSL 11:cee25a834751 2914 for (i = 0; i < DSA_INTS; i++)
wolfSSL 11:cee25a834751 2915 XFREE(tmps[i], heap, DYNAMIC_TYPE_DSA);
wolfSSL 11:cee25a834751 2916
wolfSSL 11:cee25a834751 2917 (void)heap;
wolfSSL 11:cee25a834751 2918 }
wolfSSL 11:cee25a834751 2919
wolfSSL 11:cee25a834751 2920 /* Convert DsaKey key to DER format, write to output (inLen), return bytes
wolfSSL 11:cee25a834751 2921 written */
wolfSSL 11:cee25a834751 2922 int wc_DsaKeyToDer(DsaKey* key, byte* output, word32 inLen)
wolfSSL 11:cee25a834751 2923 {
wolfSSL 11:cee25a834751 2924 word32 seqSz, verSz, rawLen, intTotalLen = 0;
wolfSSL 11:cee25a834751 2925 word32 sizes[DSA_INTS];
wolfSSL 11:cee25a834751 2926 int i, j, outLen, ret = 0, mpSz;
wolfSSL 11:cee25a834751 2927
wolfSSL 11:cee25a834751 2928 byte seq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 2929 byte ver[MAX_VERSION_SZ];
wolfSSL 11:cee25a834751 2930 byte* tmps[DSA_INTS];
wolfSSL 11:cee25a834751 2931
wolfSSL 11:cee25a834751 2932 if (!key || !output)
wolfSSL 11:cee25a834751 2933 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2934
wolfSSL 11:cee25a834751 2935 if (key->type != DSA_PRIVATE)
wolfSSL 11:cee25a834751 2936 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2937
wolfSSL 11:cee25a834751 2938 for (i = 0; i < DSA_INTS; i++)
wolfSSL 11:cee25a834751 2939 tmps[i] = NULL;
wolfSSL 11:cee25a834751 2940
wolfSSL 11:cee25a834751 2941 /* write all big ints from key to DER tmps */
wolfSSL 11:cee25a834751 2942 for (i = 0; i < DSA_INTS; i++) {
wolfSSL 11:cee25a834751 2943 mp_int* keyInt = GetDsaInt(key, i);
wolfSSL 11:cee25a834751 2944
wolfSSL 11:cee25a834751 2945 rawLen = mp_unsigned_bin_size(keyInt) + 1;
wolfSSL 11:cee25a834751 2946 tmps[i] = (byte*)XMALLOC(rawLen + MAX_SEQ_SZ, key->heap,
wolfSSL 11:cee25a834751 2947 DYNAMIC_TYPE_DSA);
wolfSSL 11:cee25a834751 2948 if (tmps[i] == NULL) {
wolfSSL 11:cee25a834751 2949 ret = MEMORY_E;
wolfSSL 11:cee25a834751 2950 break;
wolfSSL 11:cee25a834751 2951 }
wolfSSL 11:cee25a834751 2952
wolfSSL 11:cee25a834751 2953 mpSz = SetASNIntMP(keyInt, -1, tmps[i]);
wolfSSL 11:cee25a834751 2954 if (mpSz < 0) {
wolfSSL 11:cee25a834751 2955 ret = mpSz;
wolfSSL 11:cee25a834751 2956 break;
wolfSSL 11:cee25a834751 2957 }
wolfSSL 11:cee25a834751 2958 intTotalLen += (sizes[i] = mpSz);
wolfSSL 11:cee25a834751 2959 }
wolfSSL 11:cee25a834751 2960
wolfSSL 11:cee25a834751 2961 if (ret != 0) {
wolfSSL 11:cee25a834751 2962 FreeTmpDsas(tmps, key->heap);
wolfSSL 11:cee25a834751 2963 return ret;
wolfSSL 11:cee25a834751 2964 }
wolfSSL 11:cee25a834751 2965
wolfSSL 11:cee25a834751 2966 /* make headers */
wolfSSL 11:cee25a834751 2967 verSz = SetMyVersion(0, ver, FALSE);
wolfSSL 11:cee25a834751 2968 seqSz = SetSequence(verSz + intTotalLen, seq);
wolfSSL 11:cee25a834751 2969
wolfSSL 11:cee25a834751 2970 outLen = seqSz + verSz + intTotalLen;
wolfSSL 11:cee25a834751 2971 if (outLen > (int)inLen)
wolfSSL 11:cee25a834751 2972 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 2973
wolfSSL 11:cee25a834751 2974 /* write to output */
wolfSSL 11:cee25a834751 2975 XMEMCPY(output, seq, seqSz);
wolfSSL 11:cee25a834751 2976 j = seqSz;
wolfSSL 11:cee25a834751 2977 XMEMCPY(output + j, ver, verSz);
wolfSSL 11:cee25a834751 2978 j += verSz;
wolfSSL 11:cee25a834751 2979
wolfSSL 11:cee25a834751 2980 for (i = 0; i < DSA_INTS; i++) {
wolfSSL 11:cee25a834751 2981 XMEMCPY(output + j, tmps[i], sizes[i]);
wolfSSL 11:cee25a834751 2982 j += sizes[i];
wolfSSL 11:cee25a834751 2983 }
wolfSSL 11:cee25a834751 2984 FreeTmpDsas(tmps, key->heap);
wolfSSL 11:cee25a834751 2985
wolfSSL 11:cee25a834751 2986 return outLen;
wolfSSL 11:cee25a834751 2987 }
wolfSSL 11:cee25a834751 2988
wolfSSL 11:cee25a834751 2989 #endif /* NO_DSA */
wolfSSL 11:cee25a834751 2990
wolfSSL 11:cee25a834751 2991
wolfSSL 11:cee25a834751 2992 void InitDecodedCert(DecodedCert* cert, byte* source, word32 inSz, void* heap)
wolfSSL 11:cee25a834751 2993 {
wolfSSL 11:cee25a834751 2994 cert->publicKey = 0;
wolfSSL 11:cee25a834751 2995 cert->pubKeySize = 0;
wolfSSL 11:cee25a834751 2996 cert->pubKeyStored = 0;
wolfSSL 11:cee25a834751 2997 cert->keyOID = 0;
wolfSSL 11:cee25a834751 2998 cert->version = 0;
wolfSSL 11:cee25a834751 2999 cert->signature = 0;
wolfSSL 11:cee25a834751 3000 cert->subjectCN = 0;
wolfSSL 11:cee25a834751 3001 cert->subjectCNLen = 0;
wolfSSL 11:cee25a834751 3002 cert->subjectCNEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3003 cert->subjectCNStored = 0;
wolfSSL 11:cee25a834751 3004 cert->weOwnAltNames = 0;
wolfSSL 11:cee25a834751 3005 cert->altNames = NULL;
wolfSSL 11:cee25a834751 3006 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 3007 cert->altEmailNames = NULL;
wolfSSL 11:cee25a834751 3008 cert->permittedNames = NULL;
wolfSSL 11:cee25a834751 3009 cert->excludedNames = NULL;
wolfSSL 11:cee25a834751 3010 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 3011 cert->issuer[0] = '\0';
wolfSSL 11:cee25a834751 3012 cert->subject[0] = '\0';
wolfSSL 11:cee25a834751 3013 cert->source = source; /* don't own */
wolfSSL 11:cee25a834751 3014 cert->srcIdx = 0;
wolfSSL 11:cee25a834751 3015 cert->maxIdx = inSz; /* can't go over this index */
wolfSSL 11:cee25a834751 3016 cert->heap = heap;
wolfSSL 11:cee25a834751 3017 XMEMSET(cert->serial, 0, EXTERNAL_SERIAL_SIZE);
wolfSSL 11:cee25a834751 3018 cert->serialSz = 0;
wolfSSL 11:cee25a834751 3019 cert->extensions = 0;
wolfSSL 11:cee25a834751 3020 cert->extensionsSz = 0;
wolfSSL 11:cee25a834751 3021 cert->extensionsIdx = 0;
wolfSSL 11:cee25a834751 3022 cert->extAuthInfo = NULL;
wolfSSL 11:cee25a834751 3023 cert->extAuthInfoSz = 0;
wolfSSL 11:cee25a834751 3024 cert->extCrlInfo = NULL;
wolfSSL 11:cee25a834751 3025 cert->extCrlInfoSz = 0;
wolfSSL 11:cee25a834751 3026 XMEMSET(cert->extSubjKeyId, 0, KEYID_SIZE);
wolfSSL 11:cee25a834751 3027 cert->extSubjKeyIdSet = 0;
wolfSSL 11:cee25a834751 3028 XMEMSET(cert->extAuthKeyId, 0, KEYID_SIZE);
wolfSSL 11:cee25a834751 3029 cert->extAuthKeyIdSet = 0;
wolfSSL 11:cee25a834751 3030 cert->extKeyUsageSet = 0;
wolfSSL 11:cee25a834751 3031 cert->extKeyUsage = 0;
wolfSSL 11:cee25a834751 3032 cert->extExtKeyUsageSet = 0;
wolfSSL 11:cee25a834751 3033 cert->extExtKeyUsage = 0;
wolfSSL 11:cee25a834751 3034 cert->isCA = 0;
wolfSSL 11:cee25a834751 3035 cert->pathLengthSet = 0;
wolfSSL 11:cee25a834751 3036 cert->pathLength = 0;
wolfSSL 11:cee25a834751 3037 #ifdef HAVE_PKCS7
wolfSSL 11:cee25a834751 3038 cert->issuerRaw = NULL;
wolfSSL 11:cee25a834751 3039 cert->issuerRawLen = 0;
wolfSSL 11:cee25a834751 3040 #endif
wolfSSL 11:cee25a834751 3041 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3042 cert->subjectSN = 0;
wolfSSL 11:cee25a834751 3043 cert->subjectSNLen = 0;
wolfSSL 11:cee25a834751 3044 cert->subjectSNEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3045 cert->subjectC = 0;
wolfSSL 11:cee25a834751 3046 cert->subjectCLen = 0;
wolfSSL 11:cee25a834751 3047 cert->subjectCEnc = CTC_PRINTABLE;
wolfSSL 11:cee25a834751 3048 cert->subjectL = 0;
wolfSSL 11:cee25a834751 3049 cert->subjectLLen = 0;
wolfSSL 11:cee25a834751 3050 cert->subjectLEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3051 cert->subjectST = 0;
wolfSSL 11:cee25a834751 3052 cert->subjectSTLen = 0;
wolfSSL 11:cee25a834751 3053 cert->subjectSTEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3054 cert->subjectO = 0;
wolfSSL 11:cee25a834751 3055 cert->subjectOLen = 0;
wolfSSL 11:cee25a834751 3056 cert->subjectOEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3057 cert->subjectOU = 0;
wolfSSL 11:cee25a834751 3058 cert->subjectOULen = 0;
wolfSSL 11:cee25a834751 3059 cert->subjectOUEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 3060 cert->subjectEmail = 0;
wolfSSL 11:cee25a834751 3061 cert->subjectEmailLen = 0;
wolfSSL 11:cee25a834751 3062 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3063 cert->beforeDate = NULL;
wolfSSL 11:cee25a834751 3064 cert->beforeDateLen = 0;
wolfSSL 11:cee25a834751 3065 cert->afterDate = NULL;
wolfSSL 11:cee25a834751 3066 cert->afterDateLen = 0;
wolfSSL 11:cee25a834751 3067 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3068 XMEMSET(&cert->issuerName, 0, sizeof(DecodedName));
wolfSSL 11:cee25a834751 3069 XMEMSET(&cert->subjectName, 0, sizeof(DecodedName));
wolfSSL 11:cee25a834751 3070 cert->extCRLdistSet = 0;
wolfSSL 11:cee25a834751 3071 cert->extCRLdistCrit = 0;
wolfSSL 11:cee25a834751 3072 cert->extAuthInfoSet = 0;
wolfSSL 11:cee25a834751 3073 cert->extAuthInfoCrit = 0;
wolfSSL 11:cee25a834751 3074 cert->extBasicConstSet = 0;
wolfSSL 11:cee25a834751 3075 cert->extBasicConstCrit = 0;
wolfSSL 11:cee25a834751 3076 cert->extSubjAltNameSet = 0;
wolfSSL 11:cee25a834751 3077 cert->extSubjAltNameCrit = 0;
wolfSSL 11:cee25a834751 3078 cert->extAuthKeyIdCrit = 0;
wolfSSL 11:cee25a834751 3079 cert->extSubjKeyIdCrit = 0;
wolfSSL 11:cee25a834751 3080 cert->extKeyUsageCrit = 0;
wolfSSL 11:cee25a834751 3081 cert->extExtKeyUsageCrit = 0;
wolfSSL 11:cee25a834751 3082 cert->extExtKeyUsageSrc = NULL;
wolfSSL 11:cee25a834751 3083 cert->extExtKeyUsageSz = 0;
wolfSSL 11:cee25a834751 3084 cert->extExtKeyUsageCount = 0;
wolfSSL 11:cee25a834751 3085 cert->extAuthKeyIdSrc = NULL;
wolfSSL 11:cee25a834751 3086 cert->extAuthKeyIdSz = 0;
wolfSSL 11:cee25a834751 3087 cert->extSubjKeyIdSrc = NULL;
wolfSSL 11:cee25a834751 3088 cert->extSubjKeyIdSz = 0;
wolfSSL 11:cee25a834751 3089 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3090 #if defined(OPENSSL_EXTRA) || !defined(IGNORE_NAME_CONSTRAINTS)
wolfSSL 11:cee25a834751 3091 cert->extNameConstraintSet = 0;
wolfSSL 11:cee25a834751 3092 #endif /* OPENSSL_EXTRA || !IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 3093 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 3094 cert->pkCurveOID = 0;
wolfSSL 11:cee25a834751 3095 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 3096 #ifdef WOLFSSL_SEP
wolfSSL 11:cee25a834751 3097 cert->deviceTypeSz = 0;
wolfSSL 11:cee25a834751 3098 cert->deviceType = NULL;
wolfSSL 11:cee25a834751 3099 cert->hwTypeSz = 0;
wolfSSL 11:cee25a834751 3100 cert->hwType = NULL;
wolfSSL 11:cee25a834751 3101 cert->hwSerialNumSz = 0;
wolfSSL 11:cee25a834751 3102 cert->hwSerialNum = NULL;
wolfSSL 11:cee25a834751 3103 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3104 cert->extCertPolicySet = 0;
wolfSSL 11:cee25a834751 3105 cert->extCertPolicyCrit = 0;
wolfSSL 11:cee25a834751 3106 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3107 #endif /* WOLFSSL_SEP */
wolfSSL 11:cee25a834751 3108 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 3109 XMEMSET(cert->extCertPolicies, 0, MAX_CERTPOL_NB*MAX_CERTPOL_SZ);
wolfSSL 11:cee25a834751 3110 cert->extCertPoliciesNb = 0;
wolfSSL 11:cee25a834751 3111 #endif
wolfSSL 11:cee25a834751 3112
wolfSSL 11:cee25a834751 3113 cert->ca = NULL;
wolfSSL 11:cee25a834751 3114 InitSignatureCtx(&cert->sigCtx, heap, INVALID_DEVID);
wolfSSL 11:cee25a834751 3115 }
wolfSSL 11:cee25a834751 3116
wolfSSL 11:cee25a834751 3117
wolfSSL 11:cee25a834751 3118 void FreeAltNames(DNS_entry* altNames, void* heap)
wolfSSL 11:cee25a834751 3119 {
wolfSSL 11:cee25a834751 3120 (void)heap;
wolfSSL 11:cee25a834751 3121
wolfSSL 11:cee25a834751 3122 while (altNames) {
wolfSSL 11:cee25a834751 3123 DNS_entry* tmp = altNames->next;
wolfSSL 11:cee25a834751 3124
wolfSSL 11:cee25a834751 3125 XFREE(altNames->name, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3126 XFREE(altNames, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3127 altNames = tmp;
wolfSSL 11:cee25a834751 3128 }
wolfSSL 11:cee25a834751 3129 }
wolfSSL 11:cee25a834751 3130
wolfSSL 11:cee25a834751 3131 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 3132
wolfSSL 11:cee25a834751 3133 void FreeNameSubtrees(Base_entry* names, void* heap)
wolfSSL 11:cee25a834751 3134 {
wolfSSL 11:cee25a834751 3135 (void)heap;
wolfSSL 11:cee25a834751 3136
wolfSSL 11:cee25a834751 3137 while (names) {
wolfSSL 11:cee25a834751 3138 Base_entry* tmp = names->next;
wolfSSL 11:cee25a834751 3139
wolfSSL 11:cee25a834751 3140 XFREE(names->name, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3141 XFREE(names, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3142 names = tmp;
wolfSSL 11:cee25a834751 3143 }
wolfSSL 11:cee25a834751 3144 }
wolfSSL 11:cee25a834751 3145
wolfSSL 11:cee25a834751 3146 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 3147
wolfSSL 11:cee25a834751 3148 void FreeDecodedCert(DecodedCert* cert)
wolfSSL 11:cee25a834751 3149 {
wolfSSL 11:cee25a834751 3150 if (cert->subjectCNStored == 1)
wolfSSL 11:cee25a834751 3151 XFREE(cert->subjectCN, cert->heap, DYNAMIC_TYPE_SUBJECT_CN);
wolfSSL 11:cee25a834751 3152 if (cert->pubKeyStored == 1)
wolfSSL 11:cee25a834751 3153 XFREE(cert->publicKey, cert->heap, DYNAMIC_TYPE_PUBLIC_KEY);
wolfSSL 11:cee25a834751 3154 if (cert->weOwnAltNames && cert->altNames)
wolfSSL 11:cee25a834751 3155 FreeAltNames(cert->altNames, cert->heap);
wolfSSL 11:cee25a834751 3156 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 3157 if (cert->altEmailNames)
wolfSSL 11:cee25a834751 3158 FreeAltNames(cert->altEmailNames, cert->heap);
wolfSSL 11:cee25a834751 3159 if (cert->permittedNames)
wolfSSL 11:cee25a834751 3160 FreeNameSubtrees(cert->permittedNames, cert->heap);
wolfSSL 11:cee25a834751 3161 if (cert->excludedNames)
wolfSSL 11:cee25a834751 3162 FreeNameSubtrees(cert->excludedNames, cert->heap);
wolfSSL 11:cee25a834751 3163 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 3164 #ifdef WOLFSSL_SEP
wolfSSL 11:cee25a834751 3165 XFREE(cert->deviceType, cert->heap, DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 3166 XFREE(cert->hwType, cert->heap, DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 3167 XFREE(cert->hwSerialNum, cert->heap, DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 3168 #endif /* WOLFSSL_SEP */
wolfSSL 11:cee25a834751 3169 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3170 if (cert->issuerName.fullName != NULL)
wolfSSL 11:cee25a834751 3171 XFREE(cert->issuerName.fullName, cert->heap, DYNAMIC_TYPE_X509);
wolfSSL 11:cee25a834751 3172 if (cert->subjectName.fullName != NULL)
wolfSSL 11:cee25a834751 3173 XFREE(cert->subjectName.fullName, cert->heap, DYNAMIC_TYPE_X509);
wolfSSL 11:cee25a834751 3174 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3175 FreeSignatureCtx(&cert->sigCtx);
wolfSSL 11:cee25a834751 3176 }
wolfSSL 11:cee25a834751 3177
wolfSSL 11:cee25a834751 3178 static int GetCertHeader(DecodedCert* cert)
wolfSSL 11:cee25a834751 3179 {
wolfSSL 11:cee25a834751 3180 int ret = 0, len;
wolfSSL 11:cee25a834751 3181
wolfSSL 11:cee25a834751 3182 if (GetSequence(cert->source, &cert->srcIdx, &len, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3183 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3184
wolfSSL 11:cee25a834751 3185 cert->certBegin = cert->srcIdx;
wolfSSL 11:cee25a834751 3186
wolfSSL 11:cee25a834751 3187 if (GetSequence(cert->source, &cert->srcIdx, &len, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3188 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3189 cert->sigIndex = len + cert->srcIdx;
wolfSSL 11:cee25a834751 3190
wolfSSL 11:cee25a834751 3191 if (GetExplicitVersion(cert->source, &cert->srcIdx, &cert->version,
wolfSSL 11:cee25a834751 3192 cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3193 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3194
wolfSSL 11:cee25a834751 3195 if (GetSerialNumber(cert->source, &cert->srcIdx, cert->serial,
wolfSSL 11:cee25a834751 3196 &cert->serialSz, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3197 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3198
wolfSSL 11:cee25a834751 3199 return ret;
wolfSSL 11:cee25a834751 3200 }
wolfSSL 11:cee25a834751 3201
wolfSSL 11:cee25a834751 3202 #if !defined(NO_RSA)
wolfSSL 11:cee25a834751 3203 /* Store Rsa Key, may save later, Dsa could use in future */
wolfSSL 11:cee25a834751 3204 static int StoreRsaKey(DecodedCert* cert)
wolfSSL 11:cee25a834751 3205 {
wolfSSL 11:cee25a834751 3206 int length;
wolfSSL 11:cee25a834751 3207 word32 recvd = cert->srcIdx;
wolfSSL 11:cee25a834751 3208
wolfSSL 11:cee25a834751 3209 if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3210 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3211
wolfSSL 11:cee25a834751 3212 recvd = cert->srcIdx - recvd;
wolfSSL 11:cee25a834751 3213 length += recvd;
wolfSSL 11:cee25a834751 3214
wolfSSL 11:cee25a834751 3215 while (recvd--)
wolfSSL 11:cee25a834751 3216 cert->srcIdx--;
wolfSSL 11:cee25a834751 3217
wolfSSL 11:cee25a834751 3218 cert->pubKeySize = length;
wolfSSL 11:cee25a834751 3219 cert->publicKey = cert->source + cert->srcIdx;
wolfSSL 11:cee25a834751 3220 cert->srcIdx += length;
wolfSSL 11:cee25a834751 3221
wolfSSL 11:cee25a834751 3222 return 0;
wolfSSL 11:cee25a834751 3223 }
wolfSSL 11:cee25a834751 3224 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 3225
wolfSSL 11:cee25a834751 3226 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 3227
wolfSSL 11:cee25a834751 3228 /* return 0 on success if the ECC curve oid sum is supported */
wolfSSL 11:cee25a834751 3229 static int CheckCurve(word32 oid)
wolfSSL 11:cee25a834751 3230 {
wolfSSL 11:cee25a834751 3231 int ret = 0;
wolfSSL 11:cee25a834751 3232 word32 oidSz = 0;
wolfSSL 11:cee25a834751 3233
wolfSSL 11:cee25a834751 3234 ret = wc_ecc_get_oid(oid, NULL, &oidSz);
wolfSSL 11:cee25a834751 3235 if (ret < 0 || oidSz <= 0) {
wolfSSL 11:cee25a834751 3236 WOLFSSL_MSG("CheckCurve not found");
wolfSSL 11:cee25a834751 3237 ret = ALGO_ID_E;
wolfSSL 11:cee25a834751 3238 }
wolfSSL 11:cee25a834751 3239
wolfSSL 11:cee25a834751 3240 return ret;
wolfSSL 11:cee25a834751 3241 }
wolfSSL 11:cee25a834751 3242
wolfSSL 11:cee25a834751 3243 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 3244
wolfSSL 11:cee25a834751 3245 static int GetKey(DecodedCert* cert)
wolfSSL 11:cee25a834751 3246 {
wolfSSL 11:cee25a834751 3247 int length;
wolfSSL 11:cee25a834751 3248 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 3249 int tmpIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3250 #endif
wolfSSL 11:cee25a834751 3251
wolfSSL 11:cee25a834751 3252 if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3253 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3254
wolfSSL 11:cee25a834751 3255 if (GetAlgoId(cert->source, &cert->srcIdx,
wolfSSL 11:cee25a834751 3256 &cert->keyOID, oidKeyType, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3257 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3258
wolfSSL 11:cee25a834751 3259 switch (cert->keyOID) {
wolfSSL 11:cee25a834751 3260 #ifndef NO_RSA
wolfSSL 11:cee25a834751 3261 case RSAk:
wolfSSL 11:cee25a834751 3262 {
wolfSSL 11:cee25a834751 3263 int ret;
wolfSSL 11:cee25a834751 3264 ret = CheckBitString(cert->source, &cert->srcIdx, NULL,
wolfSSL 11:cee25a834751 3265 cert->maxIdx, 1, NULL);
wolfSSL 11:cee25a834751 3266 if (ret != 0)
wolfSSL 11:cee25a834751 3267 return ret;
wolfSSL 11:cee25a834751 3268
wolfSSL 11:cee25a834751 3269 return StoreRsaKey(cert);
wolfSSL 11:cee25a834751 3270 }
wolfSSL 11:cee25a834751 3271
wolfSSL 11:cee25a834751 3272 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 3273 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 3274 case NTRUk:
wolfSSL 11:cee25a834751 3275 {
wolfSSL 11:cee25a834751 3276 const byte* key = &cert->source[tmpIdx];
wolfSSL 11:cee25a834751 3277 byte* next = (byte*)key;
wolfSSL 11:cee25a834751 3278 word16 keyLen;
wolfSSL 11:cee25a834751 3279 word32 rc;
wolfSSL 11:cee25a834751 3280 word32 remaining = cert->maxIdx - cert->srcIdx;
wolfSSL 11:cee25a834751 3281 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3282 byte* keyBlob = NULL;
wolfSSL 11:cee25a834751 3283 #else
wolfSSL 11:cee25a834751 3284 byte keyBlob[MAX_NTRU_KEY_SZ];
wolfSSL 11:cee25a834751 3285 #endif
wolfSSL 11:cee25a834751 3286 rc = ntru_crypto_ntru_encrypt_subjectPublicKeyInfo2PublicKey(key,
wolfSSL 11:cee25a834751 3287 &keyLen, NULL, &next, &remaining);
wolfSSL 11:cee25a834751 3288 if (rc != NTRU_OK)
wolfSSL 11:cee25a834751 3289 return ASN_NTRU_KEY_E;
wolfSSL 11:cee25a834751 3290 if (keyLen > MAX_NTRU_KEY_SZ)
wolfSSL 11:cee25a834751 3291 return ASN_NTRU_KEY_E;
wolfSSL 11:cee25a834751 3292
wolfSSL 11:cee25a834751 3293 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3294 keyBlob = (byte*)XMALLOC(MAX_NTRU_KEY_SZ, NULL,
wolfSSL 11:cee25a834751 3295 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 3296 if (keyBlob == NULL)
wolfSSL 11:cee25a834751 3297 return MEMORY_E;
wolfSSL 11:cee25a834751 3298 #endif
wolfSSL 11:cee25a834751 3299
wolfSSL 11:cee25a834751 3300 rc = ntru_crypto_ntru_encrypt_subjectPublicKeyInfo2PublicKey(key,
wolfSSL 11:cee25a834751 3301 &keyLen, keyBlob, &next, &remaining);
wolfSSL 11:cee25a834751 3302 if (rc != NTRU_OK) {
wolfSSL 11:cee25a834751 3303 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3304 XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 3305 #endif
wolfSSL 11:cee25a834751 3306 return ASN_NTRU_KEY_E;
wolfSSL 11:cee25a834751 3307 }
wolfSSL 11:cee25a834751 3308
wolfSSL 11:cee25a834751 3309 if ( (next - key) < 0) {
wolfSSL 11:cee25a834751 3310 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3311 XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 3312 #endif
wolfSSL 11:cee25a834751 3313 return ASN_NTRU_KEY_E;
wolfSSL 11:cee25a834751 3314 }
wolfSSL 11:cee25a834751 3315
wolfSSL 11:cee25a834751 3316 cert->srcIdx = tmpIdx + (int)(next - key);
wolfSSL 11:cee25a834751 3317
wolfSSL 11:cee25a834751 3318 cert->publicKey = (byte*) XMALLOC(keyLen, cert->heap,
wolfSSL 11:cee25a834751 3319 DYNAMIC_TYPE_PUBLIC_KEY);
wolfSSL 11:cee25a834751 3320 if (cert->publicKey == NULL) {
wolfSSL 11:cee25a834751 3321 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3322 XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 3323 #endif
wolfSSL 11:cee25a834751 3324 return MEMORY_E;
wolfSSL 11:cee25a834751 3325 }
wolfSSL 11:cee25a834751 3326 XMEMCPY(cert->publicKey, keyBlob, keyLen);
wolfSSL 11:cee25a834751 3327 cert->pubKeyStored = 1;
wolfSSL 11:cee25a834751 3328 cert->pubKeySize = keyLen;
wolfSSL 11:cee25a834751 3329
wolfSSL 11:cee25a834751 3330 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 3331 XFREE(keyBlob, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 3332 #endif
wolfSSL 11:cee25a834751 3333
wolfSSL 11:cee25a834751 3334 return 0;
wolfSSL 11:cee25a834751 3335 }
wolfSSL 11:cee25a834751 3336 #endif /* HAVE_NTRU */
wolfSSL 11:cee25a834751 3337 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 3338 case ECDSAk:
wolfSSL 11:cee25a834751 3339 {
wolfSSL 11:cee25a834751 3340 int ret;
wolfSSL 11:cee25a834751 3341
wolfSSL 11:cee25a834751 3342 if (GetObjectId(cert->source, &cert->srcIdx,
wolfSSL 11:cee25a834751 3343 &cert->pkCurveOID, oidCurveType, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3344 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3345
wolfSSL 11:cee25a834751 3346 if (CheckCurve(cert->pkCurveOID) < 0)
wolfSSL 11:cee25a834751 3347 return ECC_CURVE_OID_E;
wolfSSL 11:cee25a834751 3348
wolfSSL 11:cee25a834751 3349 /* key header */
wolfSSL 11:cee25a834751 3350 ret = CheckBitString(cert->source, &cert->srcIdx, &length,
wolfSSL 11:cee25a834751 3351 cert->maxIdx, 1, NULL);
wolfSSL 11:cee25a834751 3352 if (ret != 0)
wolfSSL 11:cee25a834751 3353 return ret;
wolfSSL 11:cee25a834751 3354
wolfSSL 11:cee25a834751 3355 cert->publicKey = (byte*) XMALLOC(length, cert->heap,
wolfSSL 11:cee25a834751 3356 DYNAMIC_TYPE_PUBLIC_KEY);
wolfSSL 11:cee25a834751 3357 if (cert->publicKey == NULL)
wolfSSL 11:cee25a834751 3358 return MEMORY_E;
wolfSSL 11:cee25a834751 3359 XMEMCPY(cert->publicKey, &cert->source[cert->srcIdx], length);
wolfSSL 11:cee25a834751 3360 cert->pubKeyStored = 1;
wolfSSL 11:cee25a834751 3361 cert->pubKeySize = length;
wolfSSL 11:cee25a834751 3362
wolfSSL 11:cee25a834751 3363 cert->srcIdx += length;
wolfSSL 11:cee25a834751 3364
wolfSSL 11:cee25a834751 3365 return 0;
wolfSSL 11:cee25a834751 3366 }
wolfSSL 11:cee25a834751 3367 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 3368 default:
wolfSSL 11:cee25a834751 3369 return ASN_UNKNOWN_OID_E;
wolfSSL 11:cee25a834751 3370 }
wolfSSL 11:cee25a834751 3371 }
wolfSSL 11:cee25a834751 3372
wolfSSL 11:cee25a834751 3373 /* process NAME, either issuer or subject */
wolfSSL 11:cee25a834751 3374 static int GetName(DecodedCert* cert, int nameType)
wolfSSL 11:cee25a834751 3375 {
wolfSSL 11:cee25a834751 3376 int length; /* length of all distinguished names */
wolfSSL 11:cee25a834751 3377 int dummy;
wolfSSL 11:cee25a834751 3378 int ret;
wolfSSL 11:cee25a834751 3379 char* full;
wolfSSL 11:cee25a834751 3380 byte* hash;
wolfSSL 11:cee25a834751 3381 word32 idx;
wolfSSL 11:cee25a834751 3382 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3383 DecodedName* dName =
wolfSSL 11:cee25a834751 3384 (nameType == ISSUER) ? &cert->issuerName : &cert->subjectName;
wolfSSL 11:cee25a834751 3385 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3386
wolfSSL 11:cee25a834751 3387 WOLFSSL_MSG("Getting Cert Name");
wolfSSL 11:cee25a834751 3388
wolfSSL 11:cee25a834751 3389 if (nameType == ISSUER) {
wolfSSL 11:cee25a834751 3390 full = cert->issuer;
wolfSSL 11:cee25a834751 3391 hash = cert->issuerHash;
wolfSSL 11:cee25a834751 3392 }
wolfSSL 11:cee25a834751 3393 else {
wolfSSL 11:cee25a834751 3394 full = cert->subject;
wolfSSL 11:cee25a834751 3395 hash = cert->subjectHash;
wolfSSL 11:cee25a834751 3396 }
wolfSSL 11:cee25a834751 3397
wolfSSL 11:cee25a834751 3398 if (cert->source[cert->srcIdx] == ASN_OBJECT_ID) {
wolfSSL 11:cee25a834751 3399 WOLFSSL_MSG("Trying optional prefix...");
wolfSSL 11:cee25a834751 3400
wolfSSL 11:cee25a834751 3401 if (SkipObjectId(cert->source, &cert->srcIdx, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3402 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3403 WOLFSSL_MSG("Got optional prefix");
wolfSSL 11:cee25a834751 3404 }
wolfSSL 11:cee25a834751 3405
wolfSSL 11:cee25a834751 3406 /* For OCSP, RFC2560 section 4.1.1 states the issuer hash should be
wolfSSL 11:cee25a834751 3407 * calculated over the entire DER encoding of the Name field, including
wolfSSL 11:cee25a834751 3408 * the tag and length. */
wolfSSL 11:cee25a834751 3409 idx = cert->srcIdx;
wolfSSL 11:cee25a834751 3410 if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3411 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3412
wolfSSL 11:cee25a834751 3413 #ifdef NO_SHA
wolfSSL 11:cee25a834751 3414 ret = wc_Sha256Hash(&cert->source[idx], length + cert->srcIdx - idx, hash);
wolfSSL 11:cee25a834751 3415 #else
wolfSSL 11:cee25a834751 3416 ret = wc_ShaHash(&cert->source[idx], length + cert->srcIdx - idx, hash);
wolfSSL 11:cee25a834751 3417 #endif
wolfSSL 11:cee25a834751 3418 if (ret != 0)
wolfSSL 11:cee25a834751 3419 return ret;
wolfSSL 11:cee25a834751 3420
wolfSSL 11:cee25a834751 3421 length += cert->srcIdx;
wolfSSL 11:cee25a834751 3422 idx = 0;
wolfSSL 11:cee25a834751 3423
wolfSSL 11:cee25a834751 3424 #ifdef HAVE_PKCS7
wolfSSL 11:cee25a834751 3425 /* store pointer to raw issuer */
wolfSSL 11:cee25a834751 3426 if (nameType == ISSUER) {
wolfSSL 11:cee25a834751 3427 cert->issuerRaw = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3428 cert->issuerRawLen = length - cert->srcIdx;
wolfSSL 11:cee25a834751 3429 }
wolfSSL 11:cee25a834751 3430 #endif
wolfSSL 11:cee25a834751 3431 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 3432 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3433 cert->subjectRaw = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3434 cert->subjectRawLen = length - cert->srcIdx;
wolfSSL 11:cee25a834751 3435 }
wolfSSL 11:cee25a834751 3436 #endif
wolfSSL 11:cee25a834751 3437
wolfSSL 11:cee25a834751 3438 while (cert->srcIdx < (word32)length) {
wolfSSL 11:cee25a834751 3439 byte b;
wolfSSL 11:cee25a834751 3440 byte joint[2];
wolfSSL 11:cee25a834751 3441 byte tooBig = FALSE;
wolfSSL 11:cee25a834751 3442 int oidSz;
wolfSSL 11:cee25a834751 3443
wolfSSL 11:cee25a834751 3444 if (GetSet(cert->source, &cert->srcIdx, &dummy, cert->maxIdx) < 0) {
wolfSSL 11:cee25a834751 3445 WOLFSSL_MSG("Cert name lacks set header, trying sequence");
wolfSSL 11:cee25a834751 3446 }
wolfSSL 11:cee25a834751 3447
wolfSSL 11:cee25a834751 3448 if (GetSequence(cert->source, &cert->srcIdx, &dummy, cert->maxIdx) <= 0)
wolfSSL 11:cee25a834751 3449 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3450
wolfSSL 11:cee25a834751 3451 ret = GetASNObjectId(cert->source, &cert->srcIdx, &oidSz, cert->maxIdx);
wolfSSL 11:cee25a834751 3452 if (ret != 0)
wolfSSL 11:cee25a834751 3453 return ret;
wolfSSL 11:cee25a834751 3454
wolfSSL 11:cee25a834751 3455 /* make sure there is room for joint */
wolfSSL 11:cee25a834751 3456 if ((cert->srcIdx + sizeof(joint)) > cert->maxIdx)
wolfSSL 11:cee25a834751 3457 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3458
wolfSSL 11:cee25a834751 3459 XMEMCPY(joint, &cert->source[cert->srcIdx], sizeof(joint));
wolfSSL 11:cee25a834751 3460
wolfSSL 11:cee25a834751 3461 /* v1 name types */
wolfSSL 11:cee25a834751 3462 if (joint[0] == 0x55 && joint[1] == 0x04) {
wolfSSL 11:cee25a834751 3463 byte id;
wolfSSL 11:cee25a834751 3464 byte copy = FALSE;
wolfSSL 11:cee25a834751 3465 int strLen;
wolfSSL 11:cee25a834751 3466
wolfSSL 11:cee25a834751 3467 cert->srcIdx += 2;
wolfSSL 11:cee25a834751 3468 id = cert->source[cert->srcIdx++];
wolfSSL 11:cee25a834751 3469 b = cert->source[cert->srcIdx++]; /* encoding */
wolfSSL 11:cee25a834751 3470
wolfSSL 11:cee25a834751 3471 if (GetLength(cert->source, &cert->srcIdx, &strLen,
wolfSSL 11:cee25a834751 3472 cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3473 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3474
wolfSSL 11:cee25a834751 3475 if ( (strLen + 14) > (int)(ASN_NAME_MAX - idx)) {
wolfSSL 11:cee25a834751 3476 /* include biggest pre fix header too 4 = "/serialNumber=" */
wolfSSL 11:cee25a834751 3477 WOLFSSL_MSG("ASN Name too big, skipping");
wolfSSL 11:cee25a834751 3478 tooBig = TRUE;
wolfSSL 11:cee25a834751 3479 }
wolfSSL 11:cee25a834751 3480
wolfSSL 11:cee25a834751 3481 if (id == ASN_COMMON_NAME) {
wolfSSL 11:cee25a834751 3482 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3483 cert->subjectCN = (char *)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3484 cert->subjectCNLen = strLen;
wolfSSL 11:cee25a834751 3485 cert->subjectCNEnc = b;
wolfSSL 11:cee25a834751 3486 }
wolfSSL 11:cee25a834751 3487
wolfSSL 11:cee25a834751 3488 if (!tooBig) {
wolfSSL 11:cee25a834751 3489 XMEMCPY(&full[idx], "/CN=", 4);
wolfSSL 11:cee25a834751 3490 idx += 4;
wolfSSL 11:cee25a834751 3491 copy = TRUE;
wolfSSL 11:cee25a834751 3492 }
wolfSSL 11:cee25a834751 3493 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3494 dName->cnIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3495 dName->cnLen = strLen;
wolfSSL 11:cee25a834751 3496 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3497 }
wolfSSL 11:cee25a834751 3498 else if (id == ASN_SUR_NAME) {
wolfSSL 11:cee25a834751 3499 if (!tooBig) {
wolfSSL 11:cee25a834751 3500 XMEMCPY(&full[idx], "/SN=", 4);
wolfSSL 11:cee25a834751 3501 idx += 4;
wolfSSL 11:cee25a834751 3502 copy = TRUE;
wolfSSL 11:cee25a834751 3503 }
wolfSSL 11:cee25a834751 3504 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3505 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3506 cert->subjectSN = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3507 cert->subjectSNLen = strLen;
wolfSSL 11:cee25a834751 3508 cert->subjectSNEnc = b;
wolfSSL 11:cee25a834751 3509 }
wolfSSL 11:cee25a834751 3510 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3511 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3512 dName->snIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3513 dName->snLen = strLen;
wolfSSL 11:cee25a834751 3514 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3515 }
wolfSSL 11:cee25a834751 3516 else if (id == ASN_COUNTRY_NAME) {
wolfSSL 11:cee25a834751 3517 if (!tooBig) {
wolfSSL 11:cee25a834751 3518 XMEMCPY(&full[idx], "/C=", 3);
wolfSSL 11:cee25a834751 3519 idx += 3;
wolfSSL 11:cee25a834751 3520 copy = TRUE;
wolfSSL 11:cee25a834751 3521 }
wolfSSL 11:cee25a834751 3522 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3523 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3524 cert->subjectC = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3525 cert->subjectCLen = strLen;
wolfSSL 11:cee25a834751 3526 cert->subjectCEnc = b;
wolfSSL 11:cee25a834751 3527 }
wolfSSL 11:cee25a834751 3528 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3529 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3530 dName->cIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3531 dName->cLen = strLen;
wolfSSL 11:cee25a834751 3532 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3533 }
wolfSSL 11:cee25a834751 3534 else if (id == ASN_LOCALITY_NAME) {
wolfSSL 11:cee25a834751 3535 if (!tooBig) {
wolfSSL 11:cee25a834751 3536 XMEMCPY(&full[idx], "/L=", 3);
wolfSSL 11:cee25a834751 3537 idx += 3;
wolfSSL 11:cee25a834751 3538 copy = TRUE;
wolfSSL 11:cee25a834751 3539 }
wolfSSL 11:cee25a834751 3540 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3541 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3542 cert->subjectL = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3543 cert->subjectLLen = strLen;
wolfSSL 11:cee25a834751 3544 cert->subjectLEnc = b;
wolfSSL 11:cee25a834751 3545 }
wolfSSL 11:cee25a834751 3546 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3547 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3548 dName->lIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3549 dName->lLen = strLen;
wolfSSL 11:cee25a834751 3550 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3551 }
wolfSSL 11:cee25a834751 3552 else if (id == ASN_STATE_NAME) {
wolfSSL 11:cee25a834751 3553 if (!tooBig) {
wolfSSL 11:cee25a834751 3554 XMEMCPY(&full[idx], "/ST=", 4);
wolfSSL 11:cee25a834751 3555 idx += 4;
wolfSSL 11:cee25a834751 3556 copy = TRUE;
wolfSSL 11:cee25a834751 3557 }
wolfSSL 11:cee25a834751 3558 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3559 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3560 cert->subjectST = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3561 cert->subjectSTLen = strLen;
wolfSSL 11:cee25a834751 3562 cert->subjectSTEnc = b;
wolfSSL 11:cee25a834751 3563 }
wolfSSL 11:cee25a834751 3564 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3565 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3566 dName->stIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3567 dName->stLen = strLen;
wolfSSL 11:cee25a834751 3568 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3569 }
wolfSSL 11:cee25a834751 3570 else if (id == ASN_ORG_NAME) {
wolfSSL 11:cee25a834751 3571 if (!tooBig) {
wolfSSL 11:cee25a834751 3572 XMEMCPY(&full[idx], "/O=", 3);
wolfSSL 11:cee25a834751 3573 idx += 3;
wolfSSL 11:cee25a834751 3574 copy = TRUE;
wolfSSL 11:cee25a834751 3575 }
wolfSSL 11:cee25a834751 3576 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3577 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3578 cert->subjectO = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3579 cert->subjectOLen = strLen;
wolfSSL 11:cee25a834751 3580 cert->subjectOEnc = b;
wolfSSL 11:cee25a834751 3581 }
wolfSSL 11:cee25a834751 3582 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3583 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3584 dName->oIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3585 dName->oLen = strLen;
wolfSSL 11:cee25a834751 3586 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3587 }
wolfSSL 11:cee25a834751 3588 else if (id == ASN_ORGUNIT_NAME) {
wolfSSL 11:cee25a834751 3589 if (!tooBig) {
wolfSSL 11:cee25a834751 3590 XMEMCPY(&full[idx], "/OU=", 4);
wolfSSL 11:cee25a834751 3591 idx += 4;
wolfSSL 11:cee25a834751 3592 copy = TRUE;
wolfSSL 11:cee25a834751 3593 }
wolfSSL 11:cee25a834751 3594 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3595 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3596 cert->subjectOU = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3597 cert->subjectOULen = strLen;
wolfSSL 11:cee25a834751 3598 cert->subjectOUEnc = b;
wolfSSL 11:cee25a834751 3599 }
wolfSSL 11:cee25a834751 3600 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3601 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3602 dName->ouIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3603 dName->ouLen = strLen;
wolfSSL 11:cee25a834751 3604 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3605 }
wolfSSL 11:cee25a834751 3606 else if (id == ASN_SERIAL_NUMBER) {
wolfSSL 11:cee25a834751 3607 if (!tooBig) {
wolfSSL 11:cee25a834751 3608 XMEMCPY(&full[idx], "/serialNumber=", 14);
wolfSSL 11:cee25a834751 3609 idx += 14;
wolfSSL 11:cee25a834751 3610 copy = TRUE;
wolfSSL 11:cee25a834751 3611 }
wolfSSL 11:cee25a834751 3612 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3613 dName->snIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3614 dName->snLen = strLen;
wolfSSL 11:cee25a834751 3615 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3616 }
wolfSSL 11:cee25a834751 3617
wolfSSL 11:cee25a834751 3618 if (copy && !tooBig) {
wolfSSL 11:cee25a834751 3619 XMEMCPY(&full[idx], &cert->source[cert->srcIdx], strLen);
wolfSSL 11:cee25a834751 3620 idx += strLen;
wolfSSL 11:cee25a834751 3621 }
wolfSSL 11:cee25a834751 3622
wolfSSL 11:cee25a834751 3623 cert->srcIdx += strLen;
wolfSSL 11:cee25a834751 3624 }
wolfSSL 11:cee25a834751 3625 else {
wolfSSL 11:cee25a834751 3626 /* skip */
wolfSSL 11:cee25a834751 3627 byte email = FALSE;
wolfSSL 11:cee25a834751 3628 byte uid = FALSE;
wolfSSL 11:cee25a834751 3629 int adv;
wolfSSL 11:cee25a834751 3630
wolfSSL 11:cee25a834751 3631 if (joint[0] == 0x2a && joint[1] == 0x86) /* email id hdr */
wolfSSL 11:cee25a834751 3632 email = TRUE;
wolfSSL 11:cee25a834751 3633
wolfSSL 11:cee25a834751 3634 if (joint[0] == 0x9 && joint[1] == 0x92) /* uid id hdr */
wolfSSL 11:cee25a834751 3635 uid = TRUE;
wolfSSL 11:cee25a834751 3636
wolfSSL 11:cee25a834751 3637 cert->srcIdx += oidSz + 1;
wolfSSL 11:cee25a834751 3638
wolfSSL 11:cee25a834751 3639 if (GetLength(cert->source, &cert->srcIdx, &adv, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 3640 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 3641
wolfSSL 11:cee25a834751 3642 if (adv > (int)(ASN_NAME_MAX - idx)) {
wolfSSL 11:cee25a834751 3643 WOLFSSL_MSG("ASN name too big, skipping");
wolfSSL 11:cee25a834751 3644 tooBig = TRUE;
wolfSSL 11:cee25a834751 3645 }
wolfSSL 11:cee25a834751 3646
wolfSSL 11:cee25a834751 3647 if (email) {
wolfSSL 11:cee25a834751 3648 if ( (14 + adv) > (int)(ASN_NAME_MAX - idx)) {
wolfSSL 11:cee25a834751 3649 WOLFSSL_MSG("ASN name too big, skipping");
wolfSSL 11:cee25a834751 3650 tooBig = TRUE;
wolfSSL 11:cee25a834751 3651 }
wolfSSL 11:cee25a834751 3652 if (!tooBig) {
wolfSSL 11:cee25a834751 3653 XMEMCPY(&full[idx], "/emailAddress=", 14);
wolfSSL 11:cee25a834751 3654 idx += 14;
wolfSSL 11:cee25a834751 3655 }
wolfSSL 11:cee25a834751 3656
wolfSSL 11:cee25a834751 3657 #ifdef WOLFSSL_CERT_GEN
wolfSSL 11:cee25a834751 3658 if (nameType == SUBJECT) {
wolfSSL 11:cee25a834751 3659 cert->subjectEmail = (char*)&cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 3660 cert->subjectEmailLen = adv;
wolfSSL 11:cee25a834751 3661 }
wolfSSL 11:cee25a834751 3662 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 3663 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3664 dName->emailIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3665 dName->emailLen = adv;
wolfSSL 11:cee25a834751 3666 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3667 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 3668 {
wolfSSL 11:cee25a834751 3669 DNS_entry* emailName = NULL;
wolfSSL 11:cee25a834751 3670
wolfSSL 11:cee25a834751 3671 emailName = (DNS_entry*)XMALLOC(sizeof(DNS_entry),
wolfSSL 11:cee25a834751 3672 cert->heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3673 if (emailName == NULL) {
wolfSSL 11:cee25a834751 3674 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 3675 return MEMORY_E;
wolfSSL 11:cee25a834751 3676 }
wolfSSL 11:cee25a834751 3677 emailName->name = (char*)XMALLOC(adv + 1,
wolfSSL 11:cee25a834751 3678 cert->heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3679 if (emailName->name == NULL) {
wolfSSL 11:cee25a834751 3680 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 3681 XFREE(emailName, cert->heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 3682 return MEMORY_E;
wolfSSL 11:cee25a834751 3683 }
wolfSSL 11:cee25a834751 3684 XMEMCPY(emailName->name,
wolfSSL 11:cee25a834751 3685 &cert->source[cert->srcIdx], adv);
wolfSSL 11:cee25a834751 3686 emailName->name[adv] = 0;
wolfSSL 11:cee25a834751 3687
wolfSSL 11:cee25a834751 3688 emailName->next = cert->altEmailNames;
wolfSSL 11:cee25a834751 3689 cert->altEmailNames = emailName;
wolfSSL 11:cee25a834751 3690 }
wolfSSL 11:cee25a834751 3691 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 3692 if (!tooBig) {
wolfSSL 11:cee25a834751 3693 XMEMCPY(&full[idx], &cert->source[cert->srcIdx], adv);
wolfSSL 11:cee25a834751 3694 idx += adv;
wolfSSL 11:cee25a834751 3695 }
wolfSSL 11:cee25a834751 3696 }
wolfSSL 11:cee25a834751 3697
wolfSSL 11:cee25a834751 3698 if (uid) {
wolfSSL 11:cee25a834751 3699 if ( (5 + adv) > (int)(ASN_NAME_MAX - idx)) {
wolfSSL 11:cee25a834751 3700 WOLFSSL_MSG("ASN name too big, skipping");
wolfSSL 11:cee25a834751 3701 tooBig = TRUE;
wolfSSL 11:cee25a834751 3702 }
wolfSSL 11:cee25a834751 3703 if (!tooBig) {
wolfSSL 11:cee25a834751 3704 XMEMCPY(&full[idx], "/UID=", 5);
wolfSSL 11:cee25a834751 3705 idx += 5;
wolfSSL 11:cee25a834751 3706
wolfSSL 11:cee25a834751 3707 XMEMCPY(&full[idx], &cert->source[cert->srcIdx], adv);
wolfSSL 11:cee25a834751 3708 idx += adv;
wolfSSL 11:cee25a834751 3709 }
wolfSSL 11:cee25a834751 3710 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3711 dName->uidIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 3712 dName->uidLen = adv;
wolfSSL 11:cee25a834751 3713 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3714 }
wolfSSL 11:cee25a834751 3715
wolfSSL 11:cee25a834751 3716 cert->srcIdx += adv;
wolfSSL 11:cee25a834751 3717 }
wolfSSL 11:cee25a834751 3718 }
wolfSSL 11:cee25a834751 3719 full[idx++] = 0;
wolfSSL 11:cee25a834751 3720
wolfSSL 11:cee25a834751 3721 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 3722 {
wolfSSL 11:cee25a834751 3723 int totalLen = 0;
wolfSSL 11:cee25a834751 3724
wolfSSL 11:cee25a834751 3725 if (dName->cnLen != 0)
wolfSSL 11:cee25a834751 3726 totalLen += dName->cnLen + 4;
wolfSSL 11:cee25a834751 3727 if (dName->snLen != 0)
wolfSSL 11:cee25a834751 3728 totalLen += dName->snLen + 4;
wolfSSL 11:cee25a834751 3729 if (dName->cLen != 0)
wolfSSL 11:cee25a834751 3730 totalLen += dName->cLen + 3;
wolfSSL 11:cee25a834751 3731 if (dName->lLen != 0)
wolfSSL 11:cee25a834751 3732 totalLen += dName->lLen + 3;
wolfSSL 11:cee25a834751 3733 if (dName->stLen != 0)
wolfSSL 11:cee25a834751 3734 totalLen += dName->stLen + 4;
wolfSSL 11:cee25a834751 3735 if (dName->oLen != 0)
wolfSSL 11:cee25a834751 3736 totalLen += dName->oLen + 3;
wolfSSL 11:cee25a834751 3737 if (dName->ouLen != 0)
wolfSSL 11:cee25a834751 3738 totalLen += dName->ouLen + 4;
wolfSSL 11:cee25a834751 3739 if (dName->emailLen != 0)
wolfSSL 11:cee25a834751 3740 totalLen += dName->emailLen + 14;
wolfSSL 11:cee25a834751 3741 if (dName->uidLen != 0)
wolfSSL 11:cee25a834751 3742 totalLen += dName->uidLen + 5;
wolfSSL 11:cee25a834751 3743 if (dName->serialLen != 0)
wolfSSL 11:cee25a834751 3744 totalLen += dName->serialLen + 14;
wolfSSL 11:cee25a834751 3745
wolfSSL 11:cee25a834751 3746 dName->fullName = (char*)XMALLOC(totalLen + 1, cert->heap,
wolfSSL 11:cee25a834751 3747 DYNAMIC_TYPE_X509);
wolfSSL 11:cee25a834751 3748 if (dName->fullName != NULL) {
wolfSSL 11:cee25a834751 3749 idx = 0;
wolfSSL 11:cee25a834751 3750
wolfSSL 11:cee25a834751 3751 if (dName->cnLen != 0) {
wolfSSL 11:cee25a834751 3752 dName->entryCount++;
wolfSSL 11:cee25a834751 3753 XMEMCPY(&dName->fullName[idx], "/CN=", 4);
wolfSSL 11:cee25a834751 3754 idx += 4;
wolfSSL 11:cee25a834751 3755 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3756 &cert->source[dName->cnIdx], dName->cnLen);
wolfSSL 11:cee25a834751 3757 dName->cnIdx = idx;
wolfSSL 11:cee25a834751 3758 idx += dName->cnLen;
wolfSSL 11:cee25a834751 3759 }
wolfSSL 11:cee25a834751 3760 if (dName->snLen != 0) {
wolfSSL 11:cee25a834751 3761 dName->entryCount++;
wolfSSL 11:cee25a834751 3762 XMEMCPY(&dName->fullName[idx], "/SN=", 4);
wolfSSL 11:cee25a834751 3763 idx += 4;
wolfSSL 11:cee25a834751 3764 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3765 &cert->source[dName->snIdx], dName->snLen);
wolfSSL 11:cee25a834751 3766 dName->snIdx = idx;
wolfSSL 11:cee25a834751 3767 idx += dName->snLen;
wolfSSL 11:cee25a834751 3768 }
wolfSSL 11:cee25a834751 3769 if (dName->cLen != 0) {
wolfSSL 11:cee25a834751 3770 dName->entryCount++;
wolfSSL 11:cee25a834751 3771 XMEMCPY(&dName->fullName[idx], "/C=", 3);
wolfSSL 11:cee25a834751 3772 idx += 3;
wolfSSL 11:cee25a834751 3773 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3774 &cert->source[dName->cIdx], dName->cLen);
wolfSSL 11:cee25a834751 3775 dName->cIdx = idx;
wolfSSL 11:cee25a834751 3776 idx += dName->cLen;
wolfSSL 11:cee25a834751 3777 }
wolfSSL 11:cee25a834751 3778 if (dName->lLen != 0) {
wolfSSL 11:cee25a834751 3779 dName->entryCount++;
wolfSSL 11:cee25a834751 3780 XMEMCPY(&dName->fullName[idx], "/L=", 3);
wolfSSL 11:cee25a834751 3781 idx += 3;
wolfSSL 11:cee25a834751 3782 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3783 &cert->source[dName->lIdx], dName->lLen);
wolfSSL 11:cee25a834751 3784 dName->lIdx = idx;
wolfSSL 11:cee25a834751 3785 idx += dName->lLen;
wolfSSL 11:cee25a834751 3786 }
wolfSSL 11:cee25a834751 3787 if (dName->stLen != 0) {
wolfSSL 11:cee25a834751 3788 dName->entryCount++;
wolfSSL 11:cee25a834751 3789 XMEMCPY(&dName->fullName[idx], "/ST=", 4);
wolfSSL 11:cee25a834751 3790 idx += 4;
wolfSSL 11:cee25a834751 3791 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3792 &cert->source[dName->stIdx], dName->stLen);
wolfSSL 11:cee25a834751 3793 dName->stIdx = idx;
wolfSSL 11:cee25a834751 3794 idx += dName->stLen;
wolfSSL 11:cee25a834751 3795 }
wolfSSL 11:cee25a834751 3796 if (dName->oLen != 0) {
wolfSSL 11:cee25a834751 3797 dName->entryCount++;
wolfSSL 11:cee25a834751 3798 XMEMCPY(&dName->fullName[idx], "/O=", 3);
wolfSSL 11:cee25a834751 3799 idx += 3;
wolfSSL 11:cee25a834751 3800 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3801 &cert->source[dName->oIdx], dName->oLen);
wolfSSL 11:cee25a834751 3802 dName->oIdx = idx;
wolfSSL 11:cee25a834751 3803 idx += dName->oLen;
wolfSSL 11:cee25a834751 3804 }
wolfSSL 11:cee25a834751 3805 if (dName->ouLen != 0) {
wolfSSL 11:cee25a834751 3806 dName->entryCount++;
wolfSSL 11:cee25a834751 3807 XMEMCPY(&dName->fullName[idx], "/OU=", 4);
wolfSSL 11:cee25a834751 3808 idx += 4;
wolfSSL 11:cee25a834751 3809 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3810 &cert->source[dName->ouIdx], dName->ouLen);
wolfSSL 11:cee25a834751 3811 dName->ouIdx = idx;
wolfSSL 11:cee25a834751 3812 idx += dName->ouLen;
wolfSSL 11:cee25a834751 3813 }
wolfSSL 11:cee25a834751 3814 if (dName->emailLen != 0) {
wolfSSL 11:cee25a834751 3815 dName->entryCount++;
wolfSSL 11:cee25a834751 3816 XMEMCPY(&dName->fullName[idx], "/emailAddress=", 14);
wolfSSL 11:cee25a834751 3817 idx += 14;
wolfSSL 11:cee25a834751 3818 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3819 &cert->source[dName->emailIdx], dName->emailLen);
wolfSSL 11:cee25a834751 3820 dName->emailIdx = idx;
wolfSSL 11:cee25a834751 3821 idx += dName->emailLen;
wolfSSL 11:cee25a834751 3822 }
wolfSSL 11:cee25a834751 3823 if (dName->uidLen != 0) {
wolfSSL 11:cee25a834751 3824 dName->entryCount++;
wolfSSL 11:cee25a834751 3825 XMEMCPY(&dName->fullName[idx], "/UID=", 5);
wolfSSL 11:cee25a834751 3826 idx += 5;
wolfSSL 11:cee25a834751 3827 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3828 &cert->source[dName->uidIdx], dName->uidLen);
wolfSSL 11:cee25a834751 3829 dName->uidIdx = idx;
wolfSSL 11:cee25a834751 3830 idx += dName->uidLen;
wolfSSL 11:cee25a834751 3831 }
wolfSSL 11:cee25a834751 3832 if (dName->serialLen != 0) {
wolfSSL 11:cee25a834751 3833 dName->entryCount++;
wolfSSL 11:cee25a834751 3834 XMEMCPY(&dName->fullName[idx], "/serialNumber=", 14);
wolfSSL 11:cee25a834751 3835 idx += 14;
wolfSSL 11:cee25a834751 3836 XMEMCPY(&dName->fullName[idx],
wolfSSL 11:cee25a834751 3837 &cert->source[dName->serialIdx], dName->serialLen);
wolfSSL 11:cee25a834751 3838 dName->serialIdx = idx;
wolfSSL 11:cee25a834751 3839 idx += dName->serialLen;
wolfSSL 11:cee25a834751 3840 }
wolfSSL 11:cee25a834751 3841 dName->fullName[idx] = '\0';
wolfSSL 11:cee25a834751 3842 dName->fullNameLen = totalLen;
wolfSSL 11:cee25a834751 3843 }
wolfSSL 11:cee25a834751 3844 }
wolfSSL 11:cee25a834751 3845 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 3846
wolfSSL 11:cee25a834751 3847 return 0;
wolfSSL 11:cee25a834751 3848 }
wolfSSL 11:cee25a834751 3849
wolfSSL 11:cee25a834751 3850
wolfSSL 11:cee25a834751 3851 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 3852 #if !defined(NO_TIME_H) && defined(USE_WOLF_VALIDDATE)
wolfSSL 11:cee25a834751 3853
wolfSSL 11:cee25a834751 3854 /* to the second */
wolfSSL 11:cee25a834751 3855 static int DateGreaterThan(const struct tm* a, const struct tm* b)
wolfSSL 11:cee25a834751 3856 {
wolfSSL 11:cee25a834751 3857 if (a->tm_year > b->tm_year)
wolfSSL 11:cee25a834751 3858 return 1;
wolfSSL 11:cee25a834751 3859
wolfSSL 11:cee25a834751 3860 if (a->tm_year == b->tm_year && a->tm_mon > b->tm_mon)
wolfSSL 11:cee25a834751 3861 return 1;
wolfSSL 11:cee25a834751 3862
wolfSSL 11:cee25a834751 3863 if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
wolfSSL 11:cee25a834751 3864 a->tm_mday > b->tm_mday)
wolfSSL 11:cee25a834751 3865 return 1;
wolfSSL 11:cee25a834751 3866
wolfSSL 11:cee25a834751 3867 if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
wolfSSL 11:cee25a834751 3868 a->tm_mday == b->tm_mday && a->tm_hour > b->tm_hour)
wolfSSL 11:cee25a834751 3869 return 1;
wolfSSL 11:cee25a834751 3870
wolfSSL 11:cee25a834751 3871 if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
wolfSSL 11:cee25a834751 3872 a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
wolfSSL 11:cee25a834751 3873 a->tm_min > b->tm_min)
wolfSSL 11:cee25a834751 3874 return 1;
wolfSSL 11:cee25a834751 3875
wolfSSL 11:cee25a834751 3876 if (a->tm_year == b->tm_year && a->tm_mon == b->tm_mon &&
wolfSSL 11:cee25a834751 3877 a->tm_mday == b->tm_mday && a->tm_hour == b->tm_hour &&
wolfSSL 11:cee25a834751 3878 a->tm_min == b->tm_min && a->tm_sec > b->tm_sec)
wolfSSL 11:cee25a834751 3879 return 1;
wolfSSL 11:cee25a834751 3880
wolfSSL 11:cee25a834751 3881 return 0; /* false */
wolfSSL 11:cee25a834751 3882 }
wolfSSL 11:cee25a834751 3883
wolfSSL 11:cee25a834751 3884
wolfSSL 11:cee25a834751 3885 static INLINE int DateLessThan(const struct tm* a, const struct tm* b)
wolfSSL 11:cee25a834751 3886 {
wolfSSL 11:cee25a834751 3887 return DateGreaterThan(b,a);
wolfSSL 11:cee25a834751 3888 }
wolfSSL 11:cee25a834751 3889
wolfSSL 11:cee25a834751 3890
wolfSSL 11:cee25a834751 3891 #if defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
wolfSSL 11:cee25a834751 3892 int GetTimeString(byte* date, int format, char* buf, int len)
wolfSSL 11:cee25a834751 3893 {
wolfSSL 11:cee25a834751 3894 struct tm t;
wolfSSL 11:cee25a834751 3895 int idx = 0;
wolfSSL 11:cee25a834751 3896
wolfSSL 11:cee25a834751 3897 if (!ExtractDate(date, format, &t, &idx)) {
wolfSSL 11:cee25a834751 3898 return 0;
wolfSSL 11:cee25a834751 3899 }
wolfSSL 11:cee25a834751 3900
wolfSSL 11:cee25a834751 3901 if (date[idx] != 'Z') {
wolfSSL 11:cee25a834751 3902 WOLFSSL_MSG("UTCtime, not Zulu") ;
wolfSSL 11:cee25a834751 3903 return 0;
wolfSSL 11:cee25a834751 3904 }
wolfSSL 11:cee25a834751 3905
wolfSSL 11:cee25a834751 3906 /* place month in buffer */
wolfSSL 11:cee25a834751 3907 buf[0] = '\0';
wolfSSL 11:cee25a834751 3908 switch(t.tm_mon) {
wolfSSL 11:cee25a834751 3909 case 0: XSTRNCAT(buf, "Jan ", 4); break;
wolfSSL 11:cee25a834751 3910 case 1: XSTRNCAT(buf, "Feb ", 4); break;
wolfSSL 11:cee25a834751 3911 case 2: XSTRNCAT(buf, "Mar ", 4); break;
wolfSSL 11:cee25a834751 3912 case 3: XSTRNCAT(buf, "Apr ", 4); break;
wolfSSL 11:cee25a834751 3913 case 4: XSTRNCAT(buf, "May ", 4); break;
wolfSSL 11:cee25a834751 3914 case 5: XSTRNCAT(buf, "Jun ", 4); break;
wolfSSL 11:cee25a834751 3915 case 6: XSTRNCAT(buf, "Jul ", 4); break;
wolfSSL 11:cee25a834751 3916 case 7: XSTRNCAT(buf, "Aug ", 4); break;
wolfSSL 11:cee25a834751 3917 case 8: XSTRNCAT(buf, "Sep ", 4); break;
wolfSSL 11:cee25a834751 3918 case 9: XSTRNCAT(buf, "Oct ", 4); break;
wolfSSL 11:cee25a834751 3919 case 10: XSTRNCAT(buf, "Nov ", 4); break;
wolfSSL 11:cee25a834751 3920 case 11: XSTRNCAT(buf, "Dec ", 4); break;
wolfSSL 11:cee25a834751 3921 default:
wolfSSL 11:cee25a834751 3922 return 0;
wolfSSL 11:cee25a834751 3923
wolfSSL 11:cee25a834751 3924 }
wolfSSL 11:cee25a834751 3925 idx = 4; /* use idx now for char buffer */
wolfSSL 11:cee25a834751 3926 buf[idx] = ' ';
wolfSSL 11:cee25a834751 3927
wolfSSL 11:cee25a834751 3928 XSNPRINTF(buf + idx, len - idx, "%2d %02d:%02d:%02d %d GMT",
wolfSSL 11:cee25a834751 3929 t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, t.tm_year + 1900);
wolfSSL 11:cee25a834751 3930
wolfSSL 11:cee25a834751 3931 return 1;
wolfSSL 11:cee25a834751 3932 }
wolfSSL 11:cee25a834751 3933 #endif /* WOLFSSL_MYSQL_COMPATIBLE */
wolfSSL 11:cee25a834751 3934
wolfSSL 11:cee25a834751 3935 int ExtractDate(const unsigned char* date, unsigned char format,
wolfSSL 11:cee25a834751 3936 struct tm* certTime, int* idx)
wolfSSL 11:cee25a834751 3937 {
wolfSSL 11:cee25a834751 3938 XMEMSET(certTime, 0, sizeof(struct tm));
wolfSSL 11:cee25a834751 3939
wolfSSL 11:cee25a834751 3940 if (format == ASN_UTC_TIME) {
wolfSSL 11:cee25a834751 3941 if (btoi(date[0]) >= 5)
wolfSSL 11:cee25a834751 3942 certTime->tm_year = 1900;
wolfSSL 11:cee25a834751 3943 else
wolfSSL 11:cee25a834751 3944 certTime->tm_year = 2000;
wolfSSL 11:cee25a834751 3945 }
wolfSSL 11:cee25a834751 3946 else { /* format == GENERALIZED_TIME */
wolfSSL 11:cee25a834751 3947 certTime->tm_year += btoi(date[*idx]) * 1000; *idx = *idx + 1;
wolfSSL 11:cee25a834751 3948 certTime->tm_year += btoi(date[*idx]) * 100; *idx = *idx + 1;
wolfSSL 11:cee25a834751 3949 }
wolfSSL 11:cee25a834751 3950
wolfSSL 11:cee25a834751 3951 /* adjust tm_year, tm_mon */
wolfSSL 11:cee25a834751 3952 GetTime((int*)&certTime->tm_year, date, idx); certTime->tm_year -= 1900;
wolfSSL 11:cee25a834751 3953 GetTime((int*)&certTime->tm_mon, date, idx); certTime->tm_mon -= 1;
wolfSSL 11:cee25a834751 3954 GetTime((int*)&certTime->tm_mday, date, idx);
wolfSSL 11:cee25a834751 3955 GetTime((int*)&certTime->tm_hour, date, idx);
wolfSSL 11:cee25a834751 3956 GetTime((int*)&certTime->tm_min, date, idx);
wolfSSL 11:cee25a834751 3957 GetTime((int*)&certTime->tm_sec, date, idx);
wolfSSL 11:cee25a834751 3958
wolfSSL 11:cee25a834751 3959 return 1;
wolfSSL 11:cee25a834751 3960 }
wolfSSL 11:cee25a834751 3961
wolfSSL 11:cee25a834751 3962
wolfSSL 11:cee25a834751 3963 /* like atoi but only use first byte */
wolfSSL 11:cee25a834751 3964 /* Make sure before and after dates are valid */
wolfSSL 11:cee25a834751 3965 int ValidateDate(const byte* date, byte format, int dateType)
wolfSSL 11:cee25a834751 3966 {
wolfSSL 11:cee25a834751 3967 time_t ltime;
wolfSSL 11:cee25a834751 3968 struct tm certTime;
wolfSSL 11:cee25a834751 3969 struct tm* localTime;
wolfSSL 11:cee25a834751 3970 struct tm* tmpTime = NULL;
wolfSSL 11:cee25a834751 3971 int i = 0;
wolfSSL 11:cee25a834751 3972 int timeDiff = 0 ;
wolfSSL 11:cee25a834751 3973 int diffHH = 0 ; int diffMM = 0 ;
wolfSSL 11:cee25a834751 3974 int diffSign = 0 ;
wolfSSL 11:cee25a834751 3975
wolfSSL 11:cee25a834751 3976 #if defined(NEED_TMP_TIME)
wolfSSL 11:cee25a834751 3977 struct tm tmpTimeStorage;
wolfSSL 11:cee25a834751 3978 tmpTime = &tmpTimeStorage;
wolfSSL 11:cee25a834751 3979 #else
wolfSSL 11:cee25a834751 3980 (void)tmpTime;
wolfSSL 11:cee25a834751 3981 #endif
wolfSSL 11:cee25a834751 3982
wolfSSL 11:cee25a834751 3983 ltime = XTIME(0);
wolfSSL 11:cee25a834751 3984
wolfSSL 11:cee25a834751 3985 #ifdef WOLFSSL_BEFORE_DATE_CLOCK_SKEW
wolfSSL 11:cee25a834751 3986 if (dateType == BEFORE) {
wolfSSL 11:cee25a834751 3987 WOLFSSL_MSG("Skewing local time for before date check");
wolfSSL 11:cee25a834751 3988 ltime += WOLFSSL_BEFORE_DATE_CLOCK_SKEW;
wolfSSL 11:cee25a834751 3989 }
wolfSSL 11:cee25a834751 3990 #endif
wolfSSL 11:cee25a834751 3991
wolfSSL 11:cee25a834751 3992 #ifdef WOLFSSL_AFTER_DATE_CLOCK_SKEW
wolfSSL 11:cee25a834751 3993 if (dateType == AFTER) {
wolfSSL 11:cee25a834751 3994 WOLFSSL_MSG("Skewing local time for after date check");
wolfSSL 11:cee25a834751 3995 ltime -= WOLFSSL_AFTER_DATE_CLOCK_SKEW;
wolfSSL 11:cee25a834751 3996 }
wolfSSL 11:cee25a834751 3997 #endif
wolfSSL 11:cee25a834751 3998
wolfSSL 11:cee25a834751 3999 if (!ExtractDate(date, format, &certTime, &i)) {
wolfSSL 11:cee25a834751 4000 WOLFSSL_MSG("Error extracting the date");
wolfSSL 11:cee25a834751 4001 return 0;
wolfSSL 11:cee25a834751 4002 }
wolfSSL 11:cee25a834751 4003
wolfSSL 11:cee25a834751 4004 if ((date[i] == '+') || (date[i] == '-')) {
wolfSSL 11:cee25a834751 4005 WOLFSSL_MSG("Using time differential, not Zulu") ;
wolfSSL 11:cee25a834751 4006 diffSign = date[i++] == '+' ? 1 : -1 ;
wolfSSL 11:cee25a834751 4007 GetTime(&diffHH, date, &i);
wolfSSL 11:cee25a834751 4008 GetTime(&diffMM, date, &i);
wolfSSL 11:cee25a834751 4009 timeDiff = diffSign * (diffHH*60 + diffMM) * 60 ;
wolfSSL 11:cee25a834751 4010 } else if (date[i] != 'Z') {
wolfSSL 11:cee25a834751 4011 WOLFSSL_MSG("UTCtime, niether Zulu or time differential") ;
wolfSSL 11:cee25a834751 4012 return 0;
wolfSSL 11:cee25a834751 4013 }
wolfSSL 11:cee25a834751 4014
wolfSSL 11:cee25a834751 4015 ltime -= (time_t)timeDiff ;
wolfSSL 11:cee25a834751 4016 localTime = XGMTIME(&ltime, tmpTime);
wolfSSL 11:cee25a834751 4017
wolfSSL 11:cee25a834751 4018 if (localTime == NULL) {
wolfSSL 11:cee25a834751 4019 WOLFSSL_MSG("XGMTIME failed");
wolfSSL 11:cee25a834751 4020 return 0;
wolfSSL 11:cee25a834751 4021 }
wolfSSL 11:cee25a834751 4022
wolfSSL 11:cee25a834751 4023 if (dateType == BEFORE) {
wolfSSL 11:cee25a834751 4024 if (DateLessThan(localTime, &certTime)) {
wolfSSL 11:cee25a834751 4025 WOLFSSL_MSG("Date BEFORE check failed");
wolfSSL 11:cee25a834751 4026 return 0;
wolfSSL 11:cee25a834751 4027 }
wolfSSL 11:cee25a834751 4028 }
wolfSSL 11:cee25a834751 4029 else { /* dateType == AFTER */
wolfSSL 11:cee25a834751 4030 if (DateGreaterThan(localTime, &certTime)) {
wolfSSL 11:cee25a834751 4031 WOLFSSL_MSG("Date AFTER check failed");
wolfSSL 11:cee25a834751 4032 return 0;
wolfSSL 11:cee25a834751 4033 }
wolfSSL 11:cee25a834751 4034 }
wolfSSL 11:cee25a834751 4035
wolfSSL 11:cee25a834751 4036 return 1;
wolfSSL 11:cee25a834751 4037 }
wolfSSL 11:cee25a834751 4038 #endif /* !NO_TIME_H && USE_WOLF_VALIDDATE */
wolfSSL 11:cee25a834751 4039
wolfSSL 11:cee25a834751 4040 int wc_GetTime(void* timePtr, word32 timeSize)
wolfSSL 11:cee25a834751 4041 {
wolfSSL 11:cee25a834751 4042 time_t* ltime = (time_t*)timePtr;
wolfSSL 11:cee25a834751 4043
wolfSSL 11:cee25a834751 4044 if (timePtr == NULL) {
wolfSSL 11:cee25a834751 4045 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 4046 }
wolfSSL 11:cee25a834751 4047
wolfSSL 11:cee25a834751 4048 if ((word32)sizeof(time_t) > timeSize) {
wolfSSL 11:cee25a834751 4049 return BUFFER_E;
wolfSSL 11:cee25a834751 4050 }
wolfSSL 11:cee25a834751 4051
wolfSSL 11:cee25a834751 4052 *ltime = XTIME(0);
wolfSSL 11:cee25a834751 4053
wolfSSL 11:cee25a834751 4054 return 0;
wolfSSL 11:cee25a834751 4055 }
wolfSSL 11:cee25a834751 4056
wolfSSL 11:cee25a834751 4057 #endif /* !NO_ASN_TIME */
wolfSSL 11:cee25a834751 4058
wolfSSL 11:cee25a834751 4059 static int GetDate(DecodedCert* cert, int dateType)
wolfSSL 11:cee25a834751 4060 {
wolfSSL 11:cee25a834751 4061 int length;
wolfSSL 11:cee25a834751 4062 byte date[MAX_DATE_SIZE];
wolfSSL 11:cee25a834751 4063 byte b;
wolfSSL 11:cee25a834751 4064 word32 startIdx = 0;
wolfSSL 11:cee25a834751 4065
wolfSSL 11:cee25a834751 4066 XMEMSET(date, 0, MAX_DATE_SIZE);
wolfSSL 11:cee25a834751 4067
wolfSSL 11:cee25a834751 4068 if (dateType == BEFORE)
wolfSSL 11:cee25a834751 4069 cert->beforeDate = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 4070 else
wolfSSL 11:cee25a834751 4071 cert->afterDate = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 4072 startIdx = cert->srcIdx;
wolfSSL 11:cee25a834751 4073
wolfSSL 11:cee25a834751 4074 b = cert->source[cert->srcIdx++];
wolfSSL 11:cee25a834751 4075 if (b != ASN_UTC_TIME && b != ASN_GENERALIZED_TIME)
wolfSSL 11:cee25a834751 4076 return ASN_TIME_E;
wolfSSL 11:cee25a834751 4077
wolfSSL 11:cee25a834751 4078 if (GetLength(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 4079 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 4080
wolfSSL 11:cee25a834751 4081 if (length > MAX_DATE_SIZE || length < MIN_DATE_SIZE)
wolfSSL 11:cee25a834751 4082 return ASN_DATE_SZ_E;
wolfSSL 11:cee25a834751 4083
wolfSSL 11:cee25a834751 4084 XMEMCPY(date, &cert->source[cert->srcIdx], length);
wolfSSL 11:cee25a834751 4085 cert->srcIdx += length;
wolfSSL 11:cee25a834751 4086
wolfSSL 11:cee25a834751 4087 if (dateType == BEFORE)
wolfSSL 11:cee25a834751 4088 cert->beforeDateLen = cert->srcIdx - startIdx;
wolfSSL 11:cee25a834751 4089 else
wolfSSL 11:cee25a834751 4090 cert->afterDateLen = cert->srcIdx - startIdx;
wolfSSL 11:cee25a834751 4091
wolfSSL 11:cee25a834751 4092 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 4093 if (!XVALIDATE_DATE(date, b, dateType)) {
wolfSSL 11:cee25a834751 4094 if (dateType == BEFORE)
wolfSSL 11:cee25a834751 4095 return ASN_BEFORE_DATE_E;
wolfSSL 11:cee25a834751 4096 else
wolfSSL 11:cee25a834751 4097 return ASN_AFTER_DATE_E;
wolfSSL 11:cee25a834751 4098 }
wolfSSL 11:cee25a834751 4099 #endif
wolfSSL 11:cee25a834751 4100
wolfSSL 11:cee25a834751 4101 return 0;
wolfSSL 11:cee25a834751 4102 }
wolfSSL 11:cee25a834751 4103
wolfSSL 11:cee25a834751 4104 static int GetValidity(DecodedCert* cert, int verify)
wolfSSL 11:cee25a834751 4105 {
wolfSSL 11:cee25a834751 4106 int length;
wolfSSL 11:cee25a834751 4107 int badDate = 0;
wolfSSL 11:cee25a834751 4108
wolfSSL 11:cee25a834751 4109 if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
wolfSSL 11:cee25a834751 4110 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 4111
wolfSSL 11:cee25a834751 4112 if (GetDate(cert, BEFORE) < 0 && verify)
wolfSSL 11:cee25a834751 4113 badDate = ASN_BEFORE_DATE_E; /* continue parsing */
wolfSSL 11:cee25a834751 4114
wolfSSL 11:cee25a834751 4115 if (GetDate(cert, AFTER) < 0 && verify)
wolfSSL 11:cee25a834751 4116 return ASN_AFTER_DATE_E;
wolfSSL 11:cee25a834751 4117
wolfSSL 11:cee25a834751 4118 if (badDate != 0)
wolfSSL 11:cee25a834751 4119 return badDate;
wolfSSL 11:cee25a834751 4120
wolfSSL 11:cee25a834751 4121 return 0;
wolfSSL 11:cee25a834751 4122 }
wolfSSL 11:cee25a834751 4123
wolfSSL 11:cee25a834751 4124
wolfSSL 11:cee25a834751 4125 int DecodeToKey(DecodedCert* cert, int verify)
wolfSSL 11:cee25a834751 4126 {
wolfSSL 11:cee25a834751 4127 int badDate = 0;
wolfSSL 11:cee25a834751 4128 int ret;
wolfSSL 11:cee25a834751 4129
wolfSSL 11:cee25a834751 4130 if ( (ret = GetCertHeader(cert)) < 0)
wolfSSL 11:cee25a834751 4131 return ret;
wolfSSL 11:cee25a834751 4132
wolfSSL 11:cee25a834751 4133 WOLFSSL_MSG("Got Cert Header");
wolfSSL 11:cee25a834751 4134
wolfSSL 11:cee25a834751 4135 if ( (ret = GetAlgoId(cert->source, &cert->srcIdx, &cert->signatureOID,
wolfSSL 11:cee25a834751 4136 oidSigType, cert->maxIdx)) < 0)
wolfSSL 11:cee25a834751 4137 return ret;
wolfSSL 11:cee25a834751 4138
wolfSSL 11:cee25a834751 4139 WOLFSSL_MSG("Got Algo ID");
wolfSSL 11:cee25a834751 4140
wolfSSL 11:cee25a834751 4141 if ( (ret = GetName(cert, ISSUER)) < 0)
wolfSSL 11:cee25a834751 4142 return ret;
wolfSSL 11:cee25a834751 4143
wolfSSL 11:cee25a834751 4144 if ( (ret = GetValidity(cert, verify)) < 0)
wolfSSL 11:cee25a834751 4145 badDate = ret;
wolfSSL 11:cee25a834751 4146
wolfSSL 11:cee25a834751 4147 if ( (ret = GetName(cert, SUBJECT)) < 0)
wolfSSL 11:cee25a834751 4148 return ret;
wolfSSL 11:cee25a834751 4149
wolfSSL 11:cee25a834751 4150 WOLFSSL_MSG("Got Subject Name");
wolfSSL 11:cee25a834751 4151
wolfSSL 11:cee25a834751 4152 if ( (ret = GetKey(cert)) < 0)
wolfSSL 11:cee25a834751 4153 return ret;
wolfSSL 11:cee25a834751 4154
wolfSSL 11:cee25a834751 4155 WOLFSSL_MSG("Got Key");
wolfSSL 11:cee25a834751 4156
wolfSSL 11:cee25a834751 4157 if (badDate != 0)
wolfSSL 11:cee25a834751 4158 return badDate;
wolfSSL 11:cee25a834751 4159
wolfSSL 11:cee25a834751 4160 return ret;
wolfSSL 11:cee25a834751 4161 }
wolfSSL 11:cee25a834751 4162
wolfSSL 11:cee25a834751 4163 static int GetSignature(DecodedCert* cert)
wolfSSL 11:cee25a834751 4164 {
wolfSSL 11:cee25a834751 4165 int length;
wolfSSL 11:cee25a834751 4166 int ret;
wolfSSL 11:cee25a834751 4167 ret = CheckBitString(cert->source, &cert->srcIdx, &length, cert->maxIdx, 1,
wolfSSL 11:cee25a834751 4168 NULL);
wolfSSL 11:cee25a834751 4169 if (ret != 0)
wolfSSL 11:cee25a834751 4170 return ret;
wolfSSL 11:cee25a834751 4171
wolfSSL 11:cee25a834751 4172 cert->sigLength = length;
wolfSSL 11:cee25a834751 4173 cert->signature = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 4174 cert->srcIdx += cert->sigLength;
wolfSSL 11:cee25a834751 4175
wolfSSL 11:cee25a834751 4176 return 0;
wolfSSL 11:cee25a834751 4177 }
wolfSSL 11:cee25a834751 4178
wolfSSL 11:cee25a834751 4179 static word32 SetOctetString8Bit(word32 len, byte* output)
wolfSSL 11:cee25a834751 4180 {
wolfSSL 11:cee25a834751 4181 output[0] = ASN_OCTET_STRING;
wolfSSL 11:cee25a834751 4182 output[1] = (byte)len;
wolfSSL 11:cee25a834751 4183 return 2;
wolfSSL 11:cee25a834751 4184 }
wolfSSL 11:cee25a834751 4185
wolfSSL 11:cee25a834751 4186 static word32 SetDigest(const byte* digest, word32 digSz, byte* output)
wolfSSL 11:cee25a834751 4187 {
wolfSSL 11:cee25a834751 4188 word32 idx = SetOctetString8Bit(digSz, output);
wolfSSL 11:cee25a834751 4189 XMEMCPY(&output[idx], digest, digSz);
wolfSSL 11:cee25a834751 4190
wolfSSL 11:cee25a834751 4191 return idx + digSz;
wolfSSL 11:cee25a834751 4192 }
wolfSSL 11:cee25a834751 4193
wolfSSL 11:cee25a834751 4194
wolfSSL 11:cee25a834751 4195 static word32 BytePrecision(word32 value)
wolfSSL 11:cee25a834751 4196 {
wolfSSL 11:cee25a834751 4197 word32 i;
wolfSSL 11:cee25a834751 4198 for (i = sizeof(value); i; --i)
wolfSSL 11:cee25a834751 4199 if (value >> ((i - 1) * WOLFSSL_BIT_SIZE))
wolfSSL 11:cee25a834751 4200 break;
wolfSSL 11:cee25a834751 4201
wolfSSL 11:cee25a834751 4202 return i;
wolfSSL 11:cee25a834751 4203 }
wolfSSL 11:cee25a834751 4204
wolfSSL 11:cee25a834751 4205
wolfSSL 11:cee25a834751 4206 WOLFSSL_LOCAL word32 SetLength(word32 length, byte* output)
wolfSSL 11:cee25a834751 4207 {
wolfSSL 11:cee25a834751 4208 word32 i = 0, j;
wolfSSL 11:cee25a834751 4209
wolfSSL 11:cee25a834751 4210 if (length < ASN_LONG_LENGTH)
wolfSSL 11:cee25a834751 4211 output[i++] = (byte)length;
wolfSSL 11:cee25a834751 4212 else {
wolfSSL 11:cee25a834751 4213 output[i++] = (byte)(BytePrecision(length) | ASN_LONG_LENGTH);
wolfSSL 11:cee25a834751 4214
wolfSSL 11:cee25a834751 4215 for (j = BytePrecision(length); j; --j) {
wolfSSL 11:cee25a834751 4216 output[i] = (byte)(length >> ((j - 1) * WOLFSSL_BIT_SIZE));
wolfSSL 11:cee25a834751 4217 i++;
wolfSSL 11:cee25a834751 4218 }
wolfSSL 11:cee25a834751 4219 }
wolfSSL 11:cee25a834751 4220
wolfSSL 11:cee25a834751 4221 return i;
wolfSSL 11:cee25a834751 4222 }
wolfSSL 11:cee25a834751 4223
wolfSSL 11:cee25a834751 4224
wolfSSL 11:cee25a834751 4225 WOLFSSL_LOCAL word32 SetSequence(word32 len, byte* output)
wolfSSL 11:cee25a834751 4226 {
wolfSSL 11:cee25a834751 4227 output[0] = ASN_SEQUENCE | ASN_CONSTRUCTED;
wolfSSL 11:cee25a834751 4228 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 4229 }
wolfSSL 11:cee25a834751 4230
wolfSSL 11:cee25a834751 4231 WOLFSSL_LOCAL word32 SetOctetString(word32 len, byte* output)
wolfSSL 11:cee25a834751 4232 {
wolfSSL 11:cee25a834751 4233 output[0] = ASN_OCTET_STRING;
wolfSSL 11:cee25a834751 4234 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 4235 }
wolfSSL 11:cee25a834751 4236
wolfSSL 11:cee25a834751 4237 /* Write a set header to output */
wolfSSL 11:cee25a834751 4238 WOLFSSL_LOCAL word32 SetSet(word32 len, byte* output)
wolfSSL 11:cee25a834751 4239 {
wolfSSL 11:cee25a834751 4240 output[0] = ASN_SET | ASN_CONSTRUCTED;
wolfSSL 11:cee25a834751 4241 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 4242 }
wolfSSL 11:cee25a834751 4243
wolfSSL 11:cee25a834751 4244 WOLFSSL_LOCAL word32 SetImplicit(byte tag, byte number, word32 len, byte* output)
wolfSSL 11:cee25a834751 4245 {
wolfSSL 11:cee25a834751 4246
wolfSSL 11:cee25a834751 4247 output[0] = ((tag == ASN_SEQUENCE || tag == ASN_SET) ? ASN_CONSTRUCTED : 0)
wolfSSL 11:cee25a834751 4248 | ASN_CONTEXT_SPECIFIC | number;
wolfSSL 11:cee25a834751 4249 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 4250 }
wolfSSL 11:cee25a834751 4251
wolfSSL 11:cee25a834751 4252 WOLFSSL_LOCAL word32 SetExplicit(byte number, word32 len, byte* output)
wolfSSL 11:cee25a834751 4253 {
wolfSSL 11:cee25a834751 4254 output[0] = ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | number;
wolfSSL 11:cee25a834751 4255 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 4256 }
wolfSSL 11:cee25a834751 4257
wolfSSL 11:cee25a834751 4258
wolfSSL 11:cee25a834751 4259 #if defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
wolfSSL 11:cee25a834751 4260
wolfSSL 11:cee25a834751 4261 static int SetCurve(ecc_key* key, byte* output)
wolfSSL 11:cee25a834751 4262 {
wolfSSL 11:cee25a834751 4263 #ifdef HAVE_OID_ENCODING
wolfSSL 11:cee25a834751 4264 int ret;
wolfSSL 11:cee25a834751 4265 #endif
wolfSSL 11:cee25a834751 4266 int idx = 0;
wolfSSL 11:cee25a834751 4267 word32 oidSz = 0;
wolfSSL 11:cee25a834751 4268
wolfSSL 11:cee25a834751 4269 /* validate key */
wolfSSL 11:cee25a834751 4270 if (key == NULL || key->dp == NULL) {
wolfSSL 11:cee25a834751 4271 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 4272 }
wolfSSL 11:cee25a834751 4273
wolfSSL 11:cee25a834751 4274 #ifdef HAVE_OID_ENCODING
wolfSSL 11:cee25a834751 4275 ret = EncodeObjectId(key->dp->oid, key->dp->oidSz, NULL, &oidSz);
wolfSSL 11:cee25a834751 4276 if (ret != 0) {
wolfSSL 11:cee25a834751 4277 return ret;
wolfSSL 11:cee25a834751 4278 }
wolfSSL 11:cee25a834751 4279 #else
wolfSSL 11:cee25a834751 4280 oidSz = key->dp->oidSz;
wolfSSL 11:cee25a834751 4281 #endif
wolfSSL 11:cee25a834751 4282
wolfSSL 11:cee25a834751 4283 idx += SetObjectId(oidSz, output);
wolfSSL 11:cee25a834751 4284
wolfSSL 11:cee25a834751 4285 #ifdef HAVE_OID_ENCODING
wolfSSL 11:cee25a834751 4286 ret = EncodeObjectId(key->dp->oid, key->dp->oidSz, output+idx, &oidSz);
wolfSSL 11:cee25a834751 4287 if (ret != 0) {
wolfSSL 11:cee25a834751 4288 return ret;
wolfSSL 11:cee25a834751 4289 }
wolfSSL 11:cee25a834751 4290 #else
wolfSSL 11:cee25a834751 4291 XMEMCPY(output+idx, key->dp->oid, oidSz);
wolfSSL 11:cee25a834751 4292 #endif
wolfSSL 11:cee25a834751 4293 idx += oidSz;
wolfSSL 11:cee25a834751 4294
wolfSSL 11:cee25a834751 4295 return idx;
wolfSSL 11:cee25a834751 4296 }
wolfSSL 11:cee25a834751 4297
wolfSSL 11:cee25a834751 4298 #endif /* HAVE_ECC && WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 4299
wolfSSL 11:cee25a834751 4300
wolfSSL 11:cee25a834751 4301 static INLINE int IsSigAlgoECDSA(int algoOID)
wolfSSL 11:cee25a834751 4302 {
wolfSSL 11:cee25a834751 4303 /* ECDSA sigAlgo must not have ASN1 NULL parameters */
wolfSSL 11:cee25a834751 4304 if (algoOID == CTC_SHAwECDSA || algoOID == CTC_SHA256wECDSA ||
wolfSSL 11:cee25a834751 4305 algoOID == CTC_SHA384wECDSA || algoOID == CTC_SHA512wECDSA) {
wolfSSL 11:cee25a834751 4306 return 1;
wolfSSL 11:cee25a834751 4307 }
wolfSSL 11:cee25a834751 4308
wolfSSL 11:cee25a834751 4309 return 0;
wolfSSL 11:cee25a834751 4310 }
wolfSSL 11:cee25a834751 4311
wolfSSL 11:cee25a834751 4312 WOLFSSL_LOCAL word32 SetAlgoID(int algoOID, byte* output, int type, int curveSz)
wolfSSL 11:cee25a834751 4313 {
wolfSSL 11:cee25a834751 4314 word32 tagSz, idSz, seqSz, algoSz = 0;
wolfSSL 11:cee25a834751 4315 const byte* algoName = 0;
wolfSSL 11:cee25a834751 4316 byte ID_Length[1 + MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 4317 byte seqArray[MAX_SEQ_SZ + 1]; /* add object_id to end */
wolfSSL 11:cee25a834751 4318
wolfSSL 11:cee25a834751 4319 tagSz = (type == oidHashType ||
wolfSSL 11:cee25a834751 4320 (type == oidSigType && !IsSigAlgoECDSA(algoOID)) ||
wolfSSL 11:cee25a834751 4321 (type == oidKeyType && algoOID == RSAk)) ? 2 : 0;
wolfSSL 11:cee25a834751 4322
wolfSSL 11:cee25a834751 4323 algoName = OidFromId(algoOID, type, &algoSz);
wolfSSL 11:cee25a834751 4324
wolfSSL 11:cee25a834751 4325 if (algoName == NULL) {
wolfSSL 11:cee25a834751 4326 WOLFSSL_MSG("Unknown Algorithm");
wolfSSL 11:cee25a834751 4327 return 0;
wolfSSL 11:cee25a834751 4328 }
wolfSSL 11:cee25a834751 4329
wolfSSL 11:cee25a834751 4330 idSz = SetObjectId(algoSz, ID_Length);
wolfSSL 11:cee25a834751 4331 seqSz = SetSequence(idSz + algoSz + tagSz + curveSz, seqArray);
wolfSSL 11:cee25a834751 4332
wolfSSL 11:cee25a834751 4333 XMEMCPY(output, seqArray, seqSz);
wolfSSL 11:cee25a834751 4334 XMEMCPY(output + seqSz, ID_Length, idSz);
wolfSSL 11:cee25a834751 4335 XMEMCPY(output + seqSz + idSz, algoName, algoSz);
wolfSSL 11:cee25a834751 4336 if (tagSz == 2)
wolfSSL 11:cee25a834751 4337 SetASNNull(&output[seqSz + idSz + algoSz]);
wolfSSL 11:cee25a834751 4338
wolfSSL 11:cee25a834751 4339 return seqSz + idSz + algoSz + tagSz;
wolfSSL 11:cee25a834751 4340
wolfSSL 11:cee25a834751 4341 }
wolfSSL 11:cee25a834751 4342
wolfSSL 11:cee25a834751 4343
wolfSSL 11:cee25a834751 4344 word32 wc_EncodeSignature(byte* out, const byte* digest, word32 digSz,
wolfSSL 11:cee25a834751 4345 int hashOID)
wolfSSL 11:cee25a834751 4346 {
wolfSSL 11:cee25a834751 4347 byte digArray[MAX_ENCODED_DIG_SZ];
wolfSSL 11:cee25a834751 4348 byte algoArray[MAX_ALGO_SZ];
wolfSSL 11:cee25a834751 4349 byte seqArray[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 4350 word32 encDigSz, algoSz, seqSz;
wolfSSL 11:cee25a834751 4351
wolfSSL 11:cee25a834751 4352 encDigSz = SetDigest(digest, digSz, digArray);
wolfSSL 11:cee25a834751 4353 algoSz = SetAlgoID(hashOID, algoArray, oidHashType, 0);
wolfSSL 11:cee25a834751 4354 seqSz = SetSequence(encDigSz + algoSz, seqArray);
wolfSSL 11:cee25a834751 4355
wolfSSL 11:cee25a834751 4356 XMEMCPY(out, seqArray, seqSz);
wolfSSL 11:cee25a834751 4357 XMEMCPY(out + seqSz, algoArray, algoSz);
wolfSSL 11:cee25a834751 4358 XMEMCPY(out + seqSz + algoSz, digArray, encDigSz);
wolfSSL 11:cee25a834751 4359
wolfSSL 11:cee25a834751 4360 return encDigSz + algoSz + seqSz;
wolfSSL 11:cee25a834751 4361 }
wolfSSL 11:cee25a834751 4362
wolfSSL 11:cee25a834751 4363
wolfSSL 11:cee25a834751 4364 int wc_GetCTC_HashOID(int type)
wolfSSL 11:cee25a834751 4365 {
wolfSSL 11:cee25a834751 4366 switch (type) {
wolfSSL 11:cee25a834751 4367 #ifdef WOLFSSL_MD2
wolfSSL 11:cee25a834751 4368 case MD2:
wolfSSL 11:cee25a834751 4369 return MD2h;
wolfSSL 11:cee25a834751 4370 #endif
wolfSSL 11:cee25a834751 4371 #ifndef NO_MD5
wolfSSL 11:cee25a834751 4372 case MD5:
wolfSSL 11:cee25a834751 4373 return MD5h;
wolfSSL 11:cee25a834751 4374 #endif
wolfSSL 11:cee25a834751 4375 #ifndef NO_SHA
wolfSSL 11:cee25a834751 4376 case SHA:
wolfSSL 11:cee25a834751 4377 return SHAh;
wolfSSL 11:cee25a834751 4378 #endif
wolfSSL 11:cee25a834751 4379 #ifdef WOLFSSL_SHA224
wolfSSL 11:cee25a834751 4380 case SHA224:
wolfSSL 11:cee25a834751 4381 return SHA224h;
wolfSSL 11:cee25a834751 4382 #endif
wolfSSL 11:cee25a834751 4383 #ifndef NO_SHA256
wolfSSL 11:cee25a834751 4384 case SHA256:
wolfSSL 11:cee25a834751 4385 return SHA256h;
wolfSSL 11:cee25a834751 4386 #endif
wolfSSL 11:cee25a834751 4387 #ifdef WOLFSSL_SHA384
wolfSSL 11:cee25a834751 4388 case SHA384:
wolfSSL 11:cee25a834751 4389 return SHA384h;
wolfSSL 11:cee25a834751 4390 #endif
wolfSSL 11:cee25a834751 4391 #ifdef WOLFSSL_SHA512
wolfSSL 11:cee25a834751 4392 case SHA512:
wolfSSL 11:cee25a834751 4393 return SHA512h;
wolfSSL 11:cee25a834751 4394 #endif
wolfSSL 11:cee25a834751 4395 default:
wolfSSL 11:cee25a834751 4396 return 0;
wolfSSL 11:cee25a834751 4397 };
wolfSSL 11:cee25a834751 4398 }
wolfSSL 11:cee25a834751 4399
wolfSSL 11:cee25a834751 4400 void InitSignatureCtx(SignatureCtx* sigCtx, void* heap, int devId)
wolfSSL 11:cee25a834751 4401 {
wolfSSL 11:cee25a834751 4402 if (sigCtx) {
wolfSSL 11:cee25a834751 4403 XMEMSET(sigCtx, 0, sizeof(SignatureCtx));
wolfSSL 11:cee25a834751 4404 sigCtx->devId = devId;
wolfSSL 11:cee25a834751 4405 sigCtx->heap = heap;
wolfSSL 11:cee25a834751 4406 }
wolfSSL 11:cee25a834751 4407 }
wolfSSL 11:cee25a834751 4408
wolfSSL 11:cee25a834751 4409 void FreeSignatureCtx(SignatureCtx* sigCtx)
wolfSSL 11:cee25a834751 4410 {
wolfSSL 11:cee25a834751 4411 if (sigCtx == NULL)
wolfSSL 11:cee25a834751 4412 return;
wolfSSL 11:cee25a834751 4413
wolfSSL 11:cee25a834751 4414 if (sigCtx->digest) {
wolfSSL 11:cee25a834751 4415 XFREE(sigCtx->digest, sigCtx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4416 sigCtx->digest = NULL;
wolfSSL 11:cee25a834751 4417 }
wolfSSL 11:cee25a834751 4418 #ifndef NO_RSA
wolfSSL 11:cee25a834751 4419 if (sigCtx->plain) {
wolfSSL 11:cee25a834751 4420 XFREE(sigCtx->plain, sigCtx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4421 sigCtx->plain = NULL;
wolfSSL 11:cee25a834751 4422 }
wolfSSL 11:cee25a834751 4423 #endif
wolfSSL 11:cee25a834751 4424 if (sigCtx->key.ptr) {
wolfSSL 11:cee25a834751 4425 switch (sigCtx->keyOID) {
wolfSSL 11:cee25a834751 4426 #ifndef NO_RSA
wolfSSL 11:cee25a834751 4427 case RSAk:
wolfSSL 11:cee25a834751 4428 wc_FreeRsaKey(sigCtx->key.rsa);
wolfSSL 11:cee25a834751 4429 XFREE(sigCtx->key.ptr, sigCtx->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 4430 break;
wolfSSL 11:cee25a834751 4431 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 4432 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 4433 case ECDSAk:
wolfSSL 11:cee25a834751 4434 wc_ecc_free(sigCtx->key.ecc);
wolfSSL 11:cee25a834751 4435 XFREE(sigCtx->key.ecc, sigCtx->heap, DYNAMIC_TYPE_ECC);
wolfSSL 11:cee25a834751 4436 break;
wolfSSL 11:cee25a834751 4437 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 4438 default:
wolfSSL 11:cee25a834751 4439 break;
wolfSSL 11:cee25a834751 4440 } /* switch (keyOID) */
wolfSSL 11:cee25a834751 4441 sigCtx->key.ptr = NULL;
wolfSSL 11:cee25a834751 4442 }
wolfSSL 11:cee25a834751 4443
wolfSSL 11:cee25a834751 4444 /* reset state, we are done */
wolfSSL 11:cee25a834751 4445 sigCtx->state = SIG_STATE_BEGIN;
wolfSSL 11:cee25a834751 4446 }
wolfSSL 11:cee25a834751 4447
wolfSSL 11:cee25a834751 4448 /* Return codes: 0=Success, Negative (see error-crypt.h), ASN_SIG_CONFIRM_E */
wolfSSL 11:cee25a834751 4449 static int ConfirmSignature(SignatureCtx* sigCtx,
wolfSSL 11:cee25a834751 4450 const byte* buf, word32 bufSz,
wolfSSL 11:cee25a834751 4451 const byte* key, word32 keySz, word32 keyOID,
wolfSSL 11:cee25a834751 4452 const byte* sig, word32 sigSz, word32 sigOID)
wolfSSL 11:cee25a834751 4453 {
wolfSSL 11:cee25a834751 4454 int ret = 0;
wolfSSL 11:cee25a834751 4455
wolfSSL 11:cee25a834751 4456 if (sigCtx == NULL || buf == NULL || bufSz == 0 || key == NULL ||
wolfSSL 11:cee25a834751 4457 keySz == 0 || sig == NULL || sigSz == 0) {
wolfSSL 11:cee25a834751 4458 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 4459 }
wolfSSL 11:cee25a834751 4460
wolfSSL 11:cee25a834751 4461 (void)key;
wolfSSL 11:cee25a834751 4462 (void)keySz;
wolfSSL 11:cee25a834751 4463 (void)sig;
wolfSSL 11:cee25a834751 4464 (void)sigSz;
wolfSSL 11:cee25a834751 4465
wolfSSL 11:cee25a834751 4466 WOLFSSL_ENTER("ConfirmSignature");
wolfSSL 11:cee25a834751 4467
wolfSSL 11:cee25a834751 4468 switch (sigCtx->state) {
wolfSSL 11:cee25a834751 4469 case SIG_STATE_BEGIN:
wolfSSL 11:cee25a834751 4470 {
wolfSSL 11:cee25a834751 4471 sigCtx->digest = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, sigCtx->heap,
wolfSSL 11:cee25a834751 4472 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4473 if (sigCtx->digest == NULL) {
wolfSSL 11:cee25a834751 4474 ERROR_OUT(MEMORY_E, exit_cs);
wolfSSL 11:cee25a834751 4475 }
wolfSSL 11:cee25a834751 4476
wolfSSL 11:cee25a834751 4477 /* fall through */
wolfSSL 11:cee25a834751 4478 sigCtx->state = SIG_STATE_HASH;
wolfSSL 11:cee25a834751 4479 } /* SIG_STATE_BEGIN */
wolfSSL 11:cee25a834751 4480
wolfSSL 11:cee25a834751 4481 case SIG_STATE_HASH:
wolfSSL 11:cee25a834751 4482 {
wolfSSL 11:cee25a834751 4483 switch (sigOID) {
wolfSSL 11:cee25a834751 4484 #ifndef NO_MD5
wolfSSL 11:cee25a834751 4485 case CTC_MD5wRSA:
wolfSSL 11:cee25a834751 4486 if ((ret = wc_Md5Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4487 sigCtx->typeH = MD5h;
wolfSSL 11:cee25a834751 4488 sigCtx->digestSz = MD5_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4489 }
wolfSSL 11:cee25a834751 4490 break;
wolfSSL 11:cee25a834751 4491 #endif
wolfSSL 11:cee25a834751 4492 #if defined(WOLFSSL_MD2)
wolfSSL 11:cee25a834751 4493 case CTC_MD2wRSA:
wolfSSL 11:cee25a834751 4494 if ((ret = wc_Md2Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4495 sigCtx->typeH = MD2h;
wolfSSL 11:cee25a834751 4496 sigCtx->digestSz = MD2_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4497 }
wolfSSL 11:cee25a834751 4498 break;
wolfSSL 11:cee25a834751 4499 #endif
wolfSSL 11:cee25a834751 4500 #ifndef NO_SHA
wolfSSL 11:cee25a834751 4501 case CTC_SHAwRSA:
wolfSSL 11:cee25a834751 4502 case CTC_SHAwDSA:
wolfSSL 11:cee25a834751 4503 case CTC_SHAwECDSA:
wolfSSL 11:cee25a834751 4504 if ((ret = wc_ShaHash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4505 sigCtx->typeH = SHAh;
wolfSSL 11:cee25a834751 4506 sigCtx->digestSz = SHA_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4507 }
wolfSSL 11:cee25a834751 4508 break;
wolfSSL 11:cee25a834751 4509 #endif
wolfSSL 11:cee25a834751 4510 #ifdef WOLFSSL_SHA224
wolfSSL 11:cee25a834751 4511 case CTC_SHA224wRSA:
wolfSSL 11:cee25a834751 4512 case CTC_SHA224wECDSA:
wolfSSL 11:cee25a834751 4513 if ((ret = wc_Sha224Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4514 sigCtx->typeH = SHA224h;
wolfSSL 11:cee25a834751 4515 sigCtx->digestSz = SHA224_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4516 }
wolfSSL 11:cee25a834751 4517 break;
wolfSSL 11:cee25a834751 4518 #endif
wolfSSL 11:cee25a834751 4519 #ifndef NO_SHA256
wolfSSL 11:cee25a834751 4520 case CTC_SHA256wRSA:
wolfSSL 11:cee25a834751 4521 case CTC_SHA256wECDSA:
wolfSSL 11:cee25a834751 4522 if ((ret = wc_Sha256Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4523 sigCtx->typeH = SHA256h;
wolfSSL 11:cee25a834751 4524 sigCtx->digestSz = SHA256_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4525 }
wolfSSL 11:cee25a834751 4526 break;
wolfSSL 11:cee25a834751 4527 #endif
wolfSSL 11:cee25a834751 4528 #ifdef WOLFSSL_SHA512
wolfSSL 11:cee25a834751 4529 case CTC_SHA512wRSA:
wolfSSL 11:cee25a834751 4530 case CTC_SHA512wECDSA:
wolfSSL 11:cee25a834751 4531 if ((ret = wc_Sha512Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4532 sigCtx->typeH = SHA512h;
wolfSSL 11:cee25a834751 4533 sigCtx->digestSz = SHA512_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4534 }
wolfSSL 11:cee25a834751 4535 break;
wolfSSL 11:cee25a834751 4536 #endif
wolfSSL 11:cee25a834751 4537 #ifdef WOLFSSL_SHA384
wolfSSL 11:cee25a834751 4538 case CTC_SHA384wRSA:
wolfSSL 11:cee25a834751 4539 case CTC_SHA384wECDSA:
wolfSSL 11:cee25a834751 4540 if ((ret = wc_Sha384Hash(buf, bufSz, sigCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 4541 sigCtx->typeH = SHA384h;
wolfSSL 11:cee25a834751 4542 sigCtx->digestSz = SHA384_DIGEST_SIZE;
wolfSSL 11:cee25a834751 4543 }
wolfSSL 11:cee25a834751 4544 break;
wolfSSL 11:cee25a834751 4545 #endif
wolfSSL 11:cee25a834751 4546 default:
wolfSSL 11:cee25a834751 4547 ret = HASH_TYPE_E;
wolfSSL 11:cee25a834751 4548 WOLFSSL_MSG("Verify Signature has unsupported type");
wolfSSL 11:cee25a834751 4549 }
wolfSSL 11:cee25a834751 4550
wolfSSL 11:cee25a834751 4551 if (ret != 0) {
wolfSSL 11:cee25a834751 4552 goto exit_cs;
wolfSSL 11:cee25a834751 4553 }
wolfSSL 11:cee25a834751 4554
wolfSSL 11:cee25a834751 4555 /* fall through */
wolfSSL 11:cee25a834751 4556 sigCtx->state = SIG_STATE_KEY;
wolfSSL 11:cee25a834751 4557 } /* SIG_STATE_HASH */
wolfSSL 11:cee25a834751 4558
wolfSSL 11:cee25a834751 4559 case SIG_STATE_KEY:
wolfSSL 11:cee25a834751 4560 {
wolfSSL 11:cee25a834751 4561 sigCtx->keyOID = keyOID;
wolfSSL 11:cee25a834751 4562
wolfSSL 11:cee25a834751 4563 switch (keyOID) {
wolfSSL 11:cee25a834751 4564 #ifndef NO_RSA
wolfSSL 11:cee25a834751 4565 case RSAk:
wolfSSL 11:cee25a834751 4566 {
wolfSSL 11:cee25a834751 4567 word32 idx = 0;
wolfSSL 11:cee25a834751 4568
wolfSSL 11:cee25a834751 4569 sigCtx->key.rsa = (RsaKey*)XMALLOC(sizeof(RsaKey),
wolfSSL 11:cee25a834751 4570 sigCtx->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 4571 sigCtx->plain = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ,
wolfSSL 11:cee25a834751 4572 sigCtx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4573 if (sigCtx->key.rsa == NULL || sigCtx->plain == NULL) {
wolfSSL 11:cee25a834751 4574 ERROR_OUT(MEMORY_E, exit_cs);
wolfSSL 11:cee25a834751 4575 }
wolfSSL 11:cee25a834751 4576
wolfSSL 11:cee25a834751 4577 if ((ret = wc_InitRsaKey_ex(sigCtx->key.rsa, sigCtx->heap,
wolfSSL 11:cee25a834751 4578 sigCtx->devId)) != 0) {
wolfSSL 11:cee25a834751 4579 goto exit_cs;
wolfSSL 11:cee25a834751 4580 }
wolfSSL 11:cee25a834751 4581
wolfSSL 11:cee25a834751 4582 if (sigSz > MAX_ENCODED_SIG_SZ) {
wolfSSL 11:cee25a834751 4583 WOLFSSL_MSG("Verify Signature is too big");
wolfSSL 11:cee25a834751 4584 ERROR_OUT(BUFFER_E, exit_cs);
wolfSSL 11:cee25a834751 4585 }
wolfSSL 11:cee25a834751 4586
wolfSSL 11:cee25a834751 4587 if ((ret = wc_RsaPublicKeyDecode(key, &idx, sigCtx->key.rsa,
wolfSSL 11:cee25a834751 4588 keySz)) != 0) {
wolfSSL 11:cee25a834751 4589 WOLFSSL_MSG("ASN Key decode error RSA");
wolfSSL 11:cee25a834751 4590 goto exit_cs;
wolfSSL 11:cee25a834751 4591 }
wolfSSL 11:cee25a834751 4592
wolfSSL 11:cee25a834751 4593 XMEMCPY(sigCtx->plain, sig, sigSz);
wolfSSL 11:cee25a834751 4594 sigCtx->out = NULL;
wolfSSL 11:cee25a834751 4595 break;
wolfSSL 11:cee25a834751 4596 }
wolfSSL 11:cee25a834751 4597 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 4598 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 4599 case ECDSAk:
wolfSSL 11:cee25a834751 4600 {
wolfSSL 11:cee25a834751 4601 sigCtx->verify = 0;
wolfSSL 11:cee25a834751 4602 sigCtx->key.ecc = (ecc_key*)XMALLOC(sizeof(ecc_key),
wolfSSL 11:cee25a834751 4603 sigCtx->heap, DYNAMIC_TYPE_ECC);
wolfSSL 11:cee25a834751 4604 if (sigCtx->key.ecc == NULL) {
wolfSSL 11:cee25a834751 4605 ERROR_OUT(MEMORY_E, exit_cs);
wolfSSL 11:cee25a834751 4606 }
wolfSSL 11:cee25a834751 4607
wolfSSL 11:cee25a834751 4608 if ((ret = wc_ecc_init_ex(sigCtx->key.ecc, sigCtx->heap,
wolfSSL 11:cee25a834751 4609 sigCtx->devId)) < 0) {
wolfSSL 11:cee25a834751 4610 goto exit_cs;
wolfSSL 11:cee25a834751 4611 }
wolfSSL 11:cee25a834751 4612 if ((ret = wc_ecc_import_x963(key, keySz,
wolfSSL 11:cee25a834751 4613 sigCtx->key.ecc)) < 0) {
wolfSSL 11:cee25a834751 4614 WOLFSSL_MSG("ASN Key import error ECC");
wolfSSL 11:cee25a834751 4615 goto exit_cs;
wolfSSL 11:cee25a834751 4616 }
wolfSSL 11:cee25a834751 4617 break;
wolfSSL 11:cee25a834751 4618 }
wolfSSL 11:cee25a834751 4619 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 4620 default:
wolfSSL 11:cee25a834751 4621 WOLFSSL_MSG("Verify Key type unknown");
wolfSSL 11:cee25a834751 4622 ret = ASN_UNKNOWN_OID_E;
wolfSSL 11:cee25a834751 4623 break;
wolfSSL 11:cee25a834751 4624 } /* switch (keyOID) */
wolfSSL 11:cee25a834751 4625
wolfSSL 11:cee25a834751 4626 if (ret != 0) {
wolfSSL 11:cee25a834751 4627 goto exit_cs;
wolfSSL 11:cee25a834751 4628 }
wolfSSL 11:cee25a834751 4629
wolfSSL 11:cee25a834751 4630 /* fall through */
wolfSSL 11:cee25a834751 4631 sigCtx->state = SIG_STATE_DO;
wolfSSL 11:cee25a834751 4632 } /* SIG_STATE_KEY */
wolfSSL 11:cee25a834751 4633
wolfSSL 11:cee25a834751 4634 case SIG_STATE_DO:
wolfSSL 11:cee25a834751 4635 {
wolfSSL 11:cee25a834751 4636 switch (keyOID) {
wolfSSL 11:cee25a834751 4637 #ifndef NO_RSA
wolfSSL 11:cee25a834751 4638 case RSAk:
wolfSSL 11:cee25a834751 4639 {
wolfSSL 11:cee25a834751 4640 ret = wc_RsaSSL_VerifyInline(sigCtx->plain, sigSz,
wolfSSL 11:cee25a834751 4641 &sigCtx->out, sigCtx->key.rsa);
wolfSSL 11:cee25a834751 4642 #ifdef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 4643 if (ret == WC_PENDING_E)
wolfSSL 11:cee25a834751 4644 sigCtx->asyncDev = &sigCtx->key.rsa->asyncDev;
wolfSSL 11:cee25a834751 4645 #endif
wolfSSL 11:cee25a834751 4646 break;
wolfSSL 11:cee25a834751 4647 }
wolfSSL 11:cee25a834751 4648 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 4649 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 4650 case ECDSAk:
wolfSSL 11:cee25a834751 4651 {
wolfSSL 11:cee25a834751 4652 ret = wc_ecc_verify_hash(sig, sigSz, sigCtx->digest,
wolfSSL 11:cee25a834751 4653 sigCtx->digestSz, &sigCtx->verify, sigCtx->key.ecc);
wolfSSL 11:cee25a834751 4654 #ifdef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 4655 if (ret == WC_PENDING_E)
wolfSSL 11:cee25a834751 4656 sigCtx->asyncDev = &sigCtx->key.ecc->asyncDev;
wolfSSL 11:cee25a834751 4657 #endif
wolfSSL 11:cee25a834751 4658 break;
wolfSSL 11:cee25a834751 4659 }
wolfSSL 11:cee25a834751 4660 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 4661 default:
wolfSSL 11:cee25a834751 4662 break;
wolfSSL 11:cee25a834751 4663 } /* switch (keyOID) */
wolfSSL 11:cee25a834751 4664
wolfSSL 11:cee25a834751 4665 if (ret < 0) {
wolfSSL 11:cee25a834751 4666 /* treat all non async RSA errors as ASN_SIG_CONFIRM_E */
wolfSSL 11:cee25a834751 4667 if (ret != WC_PENDING_E)
wolfSSL 11:cee25a834751 4668 ret = ASN_SIG_CONFIRM_E;
wolfSSL 11:cee25a834751 4669 goto exit_cs;
wolfSSL 11:cee25a834751 4670 }
wolfSSL 11:cee25a834751 4671
wolfSSL 11:cee25a834751 4672 /* fall through */
wolfSSL 11:cee25a834751 4673 sigCtx->state = SIG_STATE_CHECK;
wolfSSL 11:cee25a834751 4674 } /* SIG_STATE_DO */
wolfSSL 11:cee25a834751 4675
wolfSSL 11:cee25a834751 4676 case SIG_STATE_CHECK:
wolfSSL 11:cee25a834751 4677 {
wolfSSL 11:cee25a834751 4678 switch (keyOID) {
wolfSSL 11:cee25a834751 4679 #ifndef NO_RSA
wolfSSL 11:cee25a834751 4680 case RSAk:
wolfSSL 11:cee25a834751 4681 {
wolfSSL 11:cee25a834751 4682 int encodedSigSz, verifySz;
wolfSSL 11:cee25a834751 4683 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 4684 byte* encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ,
wolfSSL 11:cee25a834751 4685 sigCtx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4686 if (encodedSig == NULL) {
wolfSSL 11:cee25a834751 4687 ERROR_OUT(MEMORY_E, exit_cs);
wolfSSL 11:cee25a834751 4688 }
wolfSSL 11:cee25a834751 4689 #else
wolfSSL 11:cee25a834751 4690 byte encodedSig[MAX_ENCODED_SIG_SZ];
wolfSSL 11:cee25a834751 4691 #endif
wolfSSL 11:cee25a834751 4692
wolfSSL 11:cee25a834751 4693 verifySz = ret;
wolfSSL 11:cee25a834751 4694
wolfSSL 11:cee25a834751 4695 /* make sure we're right justified */
wolfSSL 11:cee25a834751 4696 encodedSigSz = wc_EncodeSignature(encodedSig,
wolfSSL 11:cee25a834751 4697 sigCtx->digest, sigCtx->digestSz, sigCtx->typeH);
wolfSSL 11:cee25a834751 4698 if (encodedSigSz == verifySz &&
wolfSSL 11:cee25a834751 4699 XMEMCMP(sigCtx->out, encodedSig, encodedSigSz) == 0) {
wolfSSL 11:cee25a834751 4700 ret = 0;
wolfSSL 11:cee25a834751 4701 }
wolfSSL 11:cee25a834751 4702 else {
wolfSSL 11:cee25a834751 4703 WOLFSSL_MSG("RSA SSL verify match encode error");
wolfSSL 11:cee25a834751 4704 ret = ASN_SIG_CONFIRM_E;
wolfSSL 11:cee25a834751 4705 }
wolfSSL 11:cee25a834751 4706
wolfSSL 11:cee25a834751 4707 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 4708 XFREE(encodedSig, sigCtx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 4709 #endif
wolfSSL 11:cee25a834751 4710 break;
wolfSSL 11:cee25a834751 4711 }
wolfSSL 11:cee25a834751 4712 #endif /* NO_RSA */
wolfSSL 11:cee25a834751 4713 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 4714 case ECDSAk:
wolfSSL 11:cee25a834751 4715 {
wolfSSL 11:cee25a834751 4716 if (sigCtx->verify == 1) {
wolfSSL 11:cee25a834751 4717 ret = 0;
wolfSSL 11:cee25a834751 4718 }
wolfSSL 11:cee25a834751 4719 else {
wolfSSL 11:cee25a834751 4720 WOLFSSL_MSG("ECC Verify didn't match");
wolfSSL 11:cee25a834751 4721 ret = ASN_SIG_CONFIRM_E;
wolfSSL 11:cee25a834751 4722 }
wolfSSL 11:cee25a834751 4723 break;
wolfSSL 11:cee25a834751 4724 }
wolfSSL 11:cee25a834751 4725 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 4726 default:
wolfSSL 11:cee25a834751 4727 break;
wolfSSL 11:cee25a834751 4728 } /* switch (keyOID) */
wolfSSL 11:cee25a834751 4729
wolfSSL 11:cee25a834751 4730 break;
wolfSSL 11:cee25a834751 4731 } /* SIG_STATE_CHECK */
wolfSSL 11:cee25a834751 4732 } /* switch (sigCtx->state) */
wolfSSL 11:cee25a834751 4733
wolfSSL 11:cee25a834751 4734 exit_cs:
wolfSSL 11:cee25a834751 4735
wolfSSL 11:cee25a834751 4736 WOLFSSL_LEAVE("ConfirmSignature", ret);
wolfSSL 11:cee25a834751 4737
wolfSSL 11:cee25a834751 4738 if (ret != WC_PENDING_E) {
wolfSSL 11:cee25a834751 4739 FreeSignatureCtx(sigCtx);
wolfSSL 11:cee25a834751 4740 }
wolfSSL 11:cee25a834751 4741
wolfSSL 11:cee25a834751 4742 return ret;
wolfSSL 11:cee25a834751 4743 }
wolfSSL 11:cee25a834751 4744
wolfSSL 11:cee25a834751 4745
wolfSSL 11:cee25a834751 4746 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 4747
wolfSSL 11:cee25a834751 4748 static int MatchBaseName(int type, const char* name, int nameSz,
wolfSSL 11:cee25a834751 4749 const char* base, int baseSz)
wolfSSL 11:cee25a834751 4750 {
wolfSSL 11:cee25a834751 4751 if (base == NULL || baseSz <= 0 || name == NULL || nameSz <= 0 ||
wolfSSL 11:cee25a834751 4752 name[0] == '.' || nameSz < baseSz ||
wolfSSL 11:cee25a834751 4753 (type != ASN_RFC822_TYPE && type != ASN_DNS_TYPE))
wolfSSL 11:cee25a834751 4754 return 0;
wolfSSL 11:cee25a834751 4755
wolfSSL 11:cee25a834751 4756 /* If an email type, handle special cases where the base is only
wolfSSL 11:cee25a834751 4757 * a domain, or is an email address itself. */
wolfSSL 11:cee25a834751 4758 if (type == ASN_RFC822_TYPE) {
wolfSSL 11:cee25a834751 4759 const char* p = NULL;
wolfSSL 11:cee25a834751 4760 int count = 0;
wolfSSL 11:cee25a834751 4761
wolfSSL 11:cee25a834751 4762 if (base[0] != '.') {
wolfSSL 11:cee25a834751 4763 p = base;
wolfSSL 11:cee25a834751 4764 count = 0;
wolfSSL 11:cee25a834751 4765
wolfSSL 11:cee25a834751 4766 /* find the '@' in the base */
wolfSSL 11:cee25a834751 4767 while (*p != '@' && count < baseSz) {
wolfSSL 11:cee25a834751 4768 count++;
wolfSSL 11:cee25a834751 4769 p++;
wolfSSL 11:cee25a834751 4770 }
wolfSSL 11:cee25a834751 4771
wolfSSL 11:cee25a834751 4772 /* No '@' in base, reset p to NULL */
wolfSSL 11:cee25a834751 4773 if (count >= baseSz)
wolfSSL 11:cee25a834751 4774 p = NULL;
wolfSSL 11:cee25a834751 4775 }
wolfSSL 11:cee25a834751 4776
wolfSSL 11:cee25a834751 4777 if (p == NULL) {
wolfSSL 11:cee25a834751 4778 /* Base isn't an email address, it is a domain name,
wolfSSL 11:cee25a834751 4779 * wind the name forward one character past its '@'. */
wolfSSL 11:cee25a834751 4780 p = name;
wolfSSL 11:cee25a834751 4781 count = 0;
wolfSSL 11:cee25a834751 4782 while (*p != '@' && count < baseSz) {
wolfSSL 11:cee25a834751 4783 count++;
wolfSSL 11:cee25a834751 4784 p++;
wolfSSL 11:cee25a834751 4785 }
wolfSSL 11:cee25a834751 4786
wolfSSL 11:cee25a834751 4787 if (count < baseSz && *p == '@') {
wolfSSL 11:cee25a834751 4788 name = p + 1;
wolfSSL 11:cee25a834751 4789 nameSz -= count + 1;
wolfSSL 11:cee25a834751 4790 }
wolfSSL 11:cee25a834751 4791 }
wolfSSL 11:cee25a834751 4792 }
wolfSSL 11:cee25a834751 4793
wolfSSL 11:cee25a834751 4794 if ((type == ASN_DNS_TYPE || type == ASN_RFC822_TYPE) && base[0] == '.') {
wolfSSL 11:cee25a834751 4795 int szAdjust = nameSz - baseSz;
wolfSSL 11:cee25a834751 4796 name += szAdjust;
wolfSSL 11:cee25a834751 4797 nameSz -= szAdjust;
wolfSSL 11:cee25a834751 4798 }
wolfSSL 11:cee25a834751 4799
wolfSSL 11:cee25a834751 4800 while (nameSz > 0) {
wolfSSL 11:cee25a834751 4801 if (XTOLOWER((unsigned char)*name++) !=
wolfSSL 11:cee25a834751 4802 XTOLOWER((unsigned char)*base++))
wolfSSL 11:cee25a834751 4803 return 0;
wolfSSL 11:cee25a834751 4804 nameSz--;
wolfSSL 11:cee25a834751 4805 }
wolfSSL 11:cee25a834751 4806
wolfSSL 11:cee25a834751 4807 return 1;
wolfSSL 11:cee25a834751 4808 }
wolfSSL 11:cee25a834751 4809
wolfSSL 11:cee25a834751 4810
wolfSSL 11:cee25a834751 4811 static int ConfirmNameConstraints(Signer* signer, DecodedCert* cert)
wolfSSL 11:cee25a834751 4812 {
wolfSSL 11:cee25a834751 4813 if (signer == NULL || cert == NULL)
wolfSSL 11:cee25a834751 4814 return 0;
wolfSSL 11:cee25a834751 4815
wolfSSL 11:cee25a834751 4816 /* Check against the excluded list */
wolfSSL 11:cee25a834751 4817 if (signer->excludedNames) {
wolfSSL 11:cee25a834751 4818 Base_entry* base = signer->excludedNames;
wolfSSL 11:cee25a834751 4819
wolfSSL 11:cee25a834751 4820 while (base != NULL) {
wolfSSL 11:cee25a834751 4821 if (base->type == ASN_DNS_TYPE) {
wolfSSL 11:cee25a834751 4822 DNS_entry* name = cert->altNames;
wolfSSL 11:cee25a834751 4823 while (name != NULL) {
wolfSSL 11:cee25a834751 4824 if (MatchBaseName(ASN_DNS_TYPE,
wolfSSL 11:cee25a834751 4825 name->name, (int)XSTRLEN(name->name),
wolfSSL 11:cee25a834751 4826 base->name, base->nameSz))
wolfSSL 11:cee25a834751 4827 return 0;
wolfSSL 11:cee25a834751 4828 name = name->next;
wolfSSL 11:cee25a834751 4829 }
wolfSSL 11:cee25a834751 4830 }
wolfSSL 11:cee25a834751 4831 else if (base->type == ASN_RFC822_TYPE) {
wolfSSL 11:cee25a834751 4832 DNS_entry* name = cert->altEmailNames;
wolfSSL 11:cee25a834751 4833 while (name != NULL) {
wolfSSL 11:cee25a834751 4834 if (MatchBaseName(ASN_RFC822_TYPE,
wolfSSL 11:cee25a834751 4835 name->name, (int)XSTRLEN(name->name),
wolfSSL 11:cee25a834751 4836 base->name, base->nameSz))
wolfSSL 11:cee25a834751 4837 return 0;
wolfSSL 11:cee25a834751 4838
wolfSSL 11:cee25a834751 4839 name = name->next;
wolfSSL 11:cee25a834751 4840 }
wolfSSL 11:cee25a834751 4841 }
wolfSSL 11:cee25a834751 4842 else if (base->type == ASN_DIR_TYPE) {
wolfSSL 11:cee25a834751 4843 if (cert->subjectRawLen == base->nameSz &&
wolfSSL 11:cee25a834751 4844 XMEMCMP(cert->subjectRaw, base->name, base->nameSz) == 0) {
wolfSSL 11:cee25a834751 4845
wolfSSL 11:cee25a834751 4846 return 0;
wolfSSL 11:cee25a834751 4847 }
wolfSSL 11:cee25a834751 4848 }
wolfSSL 11:cee25a834751 4849 base = base->next;
wolfSSL 11:cee25a834751 4850 }
wolfSSL 11:cee25a834751 4851 }
wolfSSL 11:cee25a834751 4852
wolfSSL 11:cee25a834751 4853 /* Check against the permitted list */
wolfSSL 11:cee25a834751 4854 if (signer->permittedNames != NULL) {
wolfSSL 11:cee25a834751 4855 int needDns = 0;
wolfSSL 11:cee25a834751 4856 int matchDns = 0;
wolfSSL 11:cee25a834751 4857 int needEmail = 0;
wolfSSL 11:cee25a834751 4858 int matchEmail = 0;
wolfSSL 11:cee25a834751 4859 int needDir = 0;
wolfSSL 11:cee25a834751 4860 int matchDir = 0;
wolfSSL 11:cee25a834751 4861 Base_entry* base = signer->permittedNames;
wolfSSL 11:cee25a834751 4862
wolfSSL 11:cee25a834751 4863 while (base != NULL) {
wolfSSL 11:cee25a834751 4864 if (base->type == ASN_DNS_TYPE) {
wolfSSL 11:cee25a834751 4865 DNS_entry* name = cert->altNames;
wolfSSL 11:cee25a834751 4866
wolfSSL 11:cee25a834751 4867 if (name != NULL)
wolfSSL 11:cee25a834751 4868 needDns = 1;
wolfSSL 11:cee25a834751 4869
wolfSSL 11:cee25a834751 4870 while (name != NULL) {
wolfSSL 11:cee25a834751 4871 matchDns = MatchBaseName(ASN_DNS_TYPE,
wolfSSL 11:cee25a834751 4872 name->name, (int)XSTRLEN(name->name),
wolfSSL 11:cee25a834751 4873 base->name, base->nameSz);
wolfSSL 11:cee25a834751 4874 name = name->next;
wolfSSL 11:cee25a834751 4875 }
wolfSSL 11:cee25a834751 4876 }
wolfSSL 11:cee25a834751 4877 else if (base->type == ASN_RFC822_TYPE) {
wolfSSL 11:cee25a834751 4878 DNS_entry* name = cert->altEmailNames;
wolfSSL 11:cee25a834751 4879
wolfSSL 11:cee25a834751 4880 if (name != NULL)
wolfSSL 11:cee25a834751 4881 needEmail = 1;
wolfSSL 11:cee25a834751 4882
wolfSSL 11:cee25a834751 4883 while (name != NULL) {
wolfSSL 11:cee25a834751 4884 matchEmail = MatchBaseName(ASN_DNS_TYPE,
wolfSSL 11:cee25a834751 4885 name->name, (int)XSTRLEN(name->name),
wolfSSL 11:cee25a834751 4886 base->name, base->nameSz);
wolfSSL 11:cee25a834751 4887 name = name->next;
wolfSSL 11:cee25a834751 4888 }
wolfSSL 11:cee25a834751 4889 }
wolfSSL 11:cee25a834751 4890 else if (base->type == ASN_DIR_TYPE) {
wolfSSL 11:cee25a834751 4891 needDir = 1;
wolfSSL 11:cee25a834751 4892 if (cert->subjectRaw != NULL &&
wolfSSL 11:cee25a834751 4893 cert->subjectRawLen == base->nameSz &&
wolfSSL 11:cee25a834751 4894 XMEMCMP(cert->subjectRaw, base->name, base->nameSz) == 0) {
wolfSSL 11:cee25a834751 4895
wolfSSL 11:cee25a834751 4896 matchDir = 1;
wolfSSL 11:cee25a834751 4897 }
wolfSSL 11:cee25a834751 4898 }
wolfSSL 11:cee25a834751 4899 base = base->next;
wolfSSL 11:cee25a834751 4900 }
wolfSSL 11:cee25a834751 4901
wolfSSL 11:cee25a834751 4902 if ((needDns && !matchDns) || (needEmail && !matchEmail) ||
wolfSSL 11:cee25a834751 4903 (needDir && !matchDir)) {
wolfSSL 11:cee25a834751 4904
wolfSSL 11:cee25a834751 4905 return 0;
wolfSSL 11:cee25a834751 4906 }
wolfSSL 11:cee25a834751 4907 }
wolfSSL 11:cee25a834751 4908
wolfSSL 11:cee25a834751 4909 return 1;
wolfSSL 11:cee25a834751 4910 }
wolfSSL 11:cee25a834751 4911
wolfSSL 11:cee25a834751 4912 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 4913
wolfSSL 11:cee25a834751 4914 static int DecodeAltNames(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 4915 {
wolfSSL 11:cee25a834751 4916 word32 idx = 0;
wolfSSL 11:cee25a834751 4917 int length = 0;
wolfSSL 11:cee25a834751 4918
wolfSSL 11:cee25a834751 4919 WOLFSSL_ENTER("DecodeAltNames");
wolfSSL 11:cee25a834751 4920
wolfSSL 11:cee25a834751 4921 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 4922 WOLFSSL_MSG("\tBad Sequence");
wolfSSL 11:cee25a834751 4923 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 4924 }
wolfSSL 11:cee25a834751 4925
wolfSSL 11:cee25a834751 4926 cert->weOwnAltNames = 1;
wolfSSL 11:cee25a834751 4927
wolfSSL 11:cee25a834751 4928 while (length > 0) {
wolfSSL 11:cee25a834751 4929 byte b = input[idx++];
wolfSSL 11:cee25a834751 4930
wolfSSL 11:cee25a834751 4931 length--;
wolfSSL 11:cee25a834751 4932
wolfSSL 11:cee25a834751 4933 /* Save DNS Type names in the altNames list. */
wolfSSL 11:cee25a834751 4934 /* Save Other Type names in the cert's OidMap */
wolfSSL 11:cee25a834751 4935 if (b == (ASN_CONTEXT_SPECIFIC | ASN_DNS_TYPE)) {
wolfSSL 11:cee25a834751 4936 DNS_entry* dnsEntry;
wolfSSL 11:cee25a834751 4937 int strLen;
wolfSSL 11:cee25a834751 4938 word32 lenStartIdx = idx;
wolfSSL 11:cee25a834751 4939
wolfSSL 11:cee25a834751 4940 if (GetLength(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 4941 WOLFSSL_MSG("\tfail: str length");
wolfSSL 11:cee25a834751 4942 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 4943 }
wolfSSL 11:cee25a834751 4944 length -= (idx - lenStartIdx);
wolfSSL 11:cee25a834751 4945
wolfSSL 11:cee25a834751 4946 dnsEntry = (DNS_entry*)XMALLOC(sizeof(DNS_entry), cert->heap,
wolfSSL 11:cee25a834751 4947 DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4948 if (dnsEntry == NULL) {
wolfSSL 11:cee25a834751 4949 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 4950 return MEMORY_E;
wolfSSL 11:cee25a834751 4951 }
wolfSSL 11:cee25a834751 4952
wolfSSL 11:cee25a834751 4953 dnsEntry->name = (char*)XMALLOC(strLen + 1, cert->heap,
wolfSSL 11:cee25a834751 4954 DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4955 if (dnsEntry->name == NULL) {
wolfSSL 11:cee25a834751 4956 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 4957 XFREE(dnsEntry, cert->heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4958 return MEMORY_E;
wolfSSL 11:cee25a834751 4959 }
wolfSSL 11:cee25a834751 4960
wolfSSL 11:cee25a834751 4961 XMEMCPY(dnsEntry->name, &input[idx], strLen);
wolfSSL 11:cee25a834751 4962 dnsEntry->name[strLen] = '\0';
wolfSSL 11:cee25a834751 4963
wolfSSL 11:cee25a834751 4964 dnsEntry->next = cert->altNames;
wolfSSL 11:cee25a834751 4965 cert->altNames = dnsEntry;
wolfSSL 11:cee25a834751 4966
wolfSSL 11:cee25a834751 4967 length -= strLen;
wolfSSL 11:cee25a834751 4968 idx += strLen;
wolfSSL 11:cee25a834751 4969 }
wolfSSL 11:cee25a834751 4970 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 4971 else if (b == (ASN_CONTEXT_SPECIFIC | ASN_RFC822_TYPE)) {
wolfSSL 11:cee25a834751 4972 DNS_entry* emailEntry;
wolfSSL 11:cee25a834751 4973 int strLen;
wolfSSL 11:cee25a834751 4974 word32 lenStartIdx = idx;
wolfSSL 11:cee25a834751 4975
wolfSSL 11:cee25a834751 4976 if (GetLength(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 4977 WOLFSSL_MSG("\tfail: str length");
wolfSSL 11:cee25a834751 4978 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 4979 }
wolfSSL 11:cee25a834751 4980 length -= (idx - lenStartIdx);
wolfSSL 11:cee25a834751 4981
wolfSSL 11:cee25a834751 4982 emailEntry = (DNS_entry*)XMALLOC(sizeof(DNS_entry), cert->heap,
wolfSSL 11:cee25a834751 4983 DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4984 if (emailEntry == NULL) {
wolfSSL 11:cee25a834751 4985 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 4986 return MEMORY_E;
wolfSSL 11:cee25a834751 4987 }
wolfSSL 11:cee25a834751 4988
wolfSSL 11:cee25a834751 4989 emailEntry->name = (char*)XMALLOC(strLen + 1, cert->heap,
wolfSSL 11:cee25a834751 4990 DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4991 if (emailEntry->name == NULL) {
wolfSSL 11:cee25a834751 4992 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 4993 XFREE(emailEntry, cert->heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 4994 return MEMORY_E;
wolfSSL 11:cee25a834751 4995 }
wolfSSL 11:cee25a834751 4996
wolfSSL 11:cee25a834751 4997 XMEMCPY(emailEntry->name, &input[idx], strLen);
wolfSSL 11:cee25a834751 4998 emailEntry->name[strLen] = '\0';
wolfSSL 11:cee25a834751 4999
wolfSSL 11:cee25a834751 5000 emailEntry->next = cert->altEmailNames;
wolfSSL 11:cee25a834751 5001 cert->altEmailNames = emailEntry;
wolfSSL 11:cee25a834751 5002
wolfSSL 11:cee25a834751 5003 length -= strLen;
wolfSSL 11:cee25a834751 5004 idx += strLen;
wolfSSL 11:cee25a834751 5005 }
wolfSSL 11:cee25a834751 5006 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 5007 #ifdef WOLFSSL_SEP
wolfSSL 11:cee25a834751 5008 else if (b == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | ASN_OTHER_TYPE))
wolfSSL 11:cee25a834751 5009 {
wolfSSL 11:cee25a834751 5010 int strLen;
wolfSSL 11:cee25a834751 5011 word32 lenStartIdx = idx;
wolfSSL 11:cee25a834751 5012 word32 oid = 0;
wolfSSL 11:cee25a834751 5013 int ret;
wolfSSL 11:cee25a834751 5014
wolfSSL 11:cee25a834751 5015 if (GetLength(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 5016 WOLFSSL_MSG("\tfail: other name length");
wolfSSL 11:cee25a834751 5017 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5018 }
wolfSSL 11:cee25a834751 5019 /* Consume the rest of this sequence. */
wolfSSL 11:cee25a834751 5020 length -= (strLen + idx - lenStartIdx);
wolfSSL 11:cee25a834751 5021
wolfSSL 11:cee25a834751 5022 if (GetObjectId(input, &idx, &oid, oidCertAltNameType, sz) < 0) {
wolfSSL 11:cee25a834751 5023 WOLFSSL_MSG("\tbad OID");
wolfSSL 11:cee25a834751 5024 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5025 }
wolfSSL 11:cee25a834751 5026
wolfSSL 11:cee25a834751 5027 if (oid != HW_NAME_OID) {
wolfSSL 11:cee25a834751 5028 WOLFSSL_MSG("\tincorrect OID");
wolfSSL 11:cee25a834751 5029 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5030 }
wolfSSL 11:cee25a834751 5031
wolfSSL 11:cee25a834751 5032 if (input[idx++] != (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) {
wolfSSL 11:cee25a834751 5033 WOLFSSL_MSG("\twrong type");
wolfSSL 11:cee25a834751 5034 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5035 }
wolfSSL 11:cee25a834751 5036
wolfSSL 11:cee25a834751 5037 if (GetLength(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 5038 WOLFSSL_MSG("\tfail: str len");
wolfSSL 11:cee25a834751 5039 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5040 }
wolfSSL 11:cee25a834751 5041
wolfSSL 11:cee25a834751 5042 if (GetSequence(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 5043 WOLFSSL_MSG("\tBad Sequence");
wolfSSL 11:cee25a834751 5044 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5045 }
wolfSSL 11:cee25a834751 5046
wolfSSL 11:cee25a834751 5047 ret = GetASNObjectId(input, &idx, &strLen, sz);
wolfSSL 11:cee25a834751 5048 if (ret != 0) {
wolfSSL 11:cee25a834751 5049 WOLFSSL_MSG("\tbad OID");
wolfSSL 11:cee25a834751 5050 return ret;
wolfSSL 11:cee25a834751 5051 }
wolfSSL 11:cee25a834751 5052
wolfSSL 11:cee25a834751 5053 cert->hwType = (byte*)XMALLOC(strLen, cert->heap,
wolfSSL 11:cee25a834751 5054 DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 5055 if (cert->hwType == NULL) {
wolfSSL 11:cee25a834751 5056 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 5057 return MEMORY_E;
wolfSSL 11:cee25a834751 5058 }
wolfSSL 11:cee25a834751 5059
wolfSSL 11:cee25a834751 5060 XMEMCPY(cert->hwType, &input[idx], strLen);
wolfSSL 11:cee25a834751 5061 cert->hwTypeSz = strLen;
wolfSSL 11:cee25a834751 5062 idx += strLen;
wolfSSL 11:cee25a834751 5063
wolfSSL 11:cee25a834751 5064 ret = GetOctetString(input, &idx, &strLen, sz);
wolfSSL 11:cee25a834751 5065 if (ret < 0)
wolfSSL 11:cee25a834751 5066 return ret;
wolfSSL 11:cee25a834751 5067
wolfSSL 11:cee25a834751 5068 cert->hwSerialNum = (byte*)XMALLOC(strLen + 1, cert->heap,
wolfSSL 11:cee25a834751 5069 DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 5070 if (cert->hwSerialNum == NULL) {
wolfSSL 11:cee25a834751 5071 WOLFSSL_MSG("\tOut of Memory");
wolfSSL 11:cee25a834751 5072 return MEMORY_E;
wolfSSL 11:cee25a834751 5073 }
wolfSSL 11:cee25a834751 5074
wolfSSL 11:cee25a834751 5075 XMEMCPY(cert->hwSerialNum, &input[idx], strLen);
wolfSSL 11:cee25a834751 5076 cert->hwSerialNum[strLen] = '\0';
wolfSSL 11:cee25a834751 5077 cert->hwSerialNumSz = strLen;
wolfSSL 11:cee25a834751 5078 idx += strLen;
wolfSSL 11:cee25a834751 5079 }
wolfSSL 11:cee25a834751 5080 #endif /* WOLFSSL_SEP */
wolfSSL 11:cee25a834751 5081 else {
wolfSSL 11:cee25a834751 5082 int strLen;
wolfSSL 11:cee25a834751 5083 word32 lenStartIdx = idx;
wolfSSL 11:cee25a834751 5084
wolfSSL 11:cee25a834751 5085 WOLFSSL_MSG("\tUnsupported name type, skipping");
wolfSSL 11:cee25a834751 5086
wolfSSL 11:cee25a834751 5087 if (GetLength(input, &idx, &strLen, sz) < 0) {
wolfSSL 11:cee25a834751 5088 WOLFSSL_MSG("\tfail: unsupported name length");
wolfSSL 11:cee25a834751 5089 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5090 }
wolfSSL 11:cee25a834751 5091 length -= (strLen + idx - lenStartIdx);
wolfSSL 11:cee25a834751 5092 idx += strLen;
wolfSSL 11:cee25a834751 5093 }
wolfSSL 11:cee25a834751 5094 }
wolfSSL 11:cee25a834751 5095 return 0;
wolfSSL 11:cee25a834751 5096 }
wolfSSL 11:cee25a834751 5097
wolfSSL 11:cee25a834751 5098 static int DecodeBasicCaConstraint(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5099 {
wolfSSL 11:cee25a834751 5100 word32 idx = 0;
wolfSSL 11:cee25a834751 5101 int length = 0;
wolfSSL 11:cee25a834751 5102 int ret;
wolfSSL 11:cee25a834751 5103
wolfSSL 11:cee25a834751 5104 WOLFSSL_ENTER("DecodeBasicCaConstraint");
wolfSSL 11:cee25a834751 5105
wolfSSL 11:cee25a834751 5106 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5107 WOLFSSL_MSG("\tfail: bad SEQUENCE");
wolfSSL 11:cee25a834751 5108 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5109 }
wolfSSL 11:cee25a834751 5110
wolfSSL 11:cee25a834751 5111 if (length == 0)
wolfSSL 11:cee25a834751 5112 return 0;
wolfSSL 11:cee25a834751 5113
wolfSSL 11:cee25a834751 5114 /* If the basic ca constraint is false, this extension may be named, but
wolfSSL 11:cee25a834751 5115 * left empty. So, if the length is 0, just return. */
wolfSSL 11:cee25a834751 5116
wolfSSL 11:cee25a834751 5117 ret = GetBoolean(input, &idx, sz);
wolfSSL 11:cee25a834751 5118 if (ret < 0) {
wolfSSL 11:cee25a834751 5119 WOLFSSL_MSG("\tfail: constraint not valid BOOLEAN");
wolfSSL 11:cee25a834751 5120 return ret;
wolfSSL 11:cee25a834751 5121 }
wolfSSL 11:cee25a834751 5122
wolfSSL 11:cee25a834751 5123 cert->isCA = (byte)ret;
wolfSSL 11:cee25a834751 5124
wolfSSL 11:cee25a834751 5125 /* If there isn't any more data, return. */
wolfSSL 11:cee25a834751 5126 if (idx >= (word32)sz)
wolfSSL 11:cee25a834751 5127 return 0;
wolfSSL 11:cee25a834751 5128
wolfSSL 11:cee25a834751 5129 ret = GetInteger7Bit(input, &idx, sz);
wolfSSL 11:cee25a834751 5130 if (ret < 0)
wolfSSL 11:cee25a834751 5131 return ret;
wolfSSL 11:cee25a834751 5132
wolfSSL 11:cee25a834751 5133 cert->pathLength = (byte)ret;
wolfSSL 11:cee25a834751 5134 cert->pathLengthSet = 1;
wolfSSL 11:cee25a834751 5135
wolfSSL 11:cee25a834751 5136 return 0;
wolfSSL 11:cee25a834751 5137 }
wolfSSL 11:cee25a834751 5138
wolfSSL 11:cee25a834751 5139
wolfSSL 11:cee25a834751 5140 #define CRLDP_FULL_NAME 0
wolfSSL 11:cee25a834751 5141 /* From RFC3280 SS4.2.1.14, Distribution Point Name*/
wolfSSL 11:cee25a834751 5142 #define GENERALNAME_URI 6
wolfSSL 11:cee25a834751 5143 /* From RFC3280 SS4.2.1.7, GeneralName */
wolfSSL 11:cee25a834751 5144
wolfSSL 11:cee25a834751 5145 static int DecodeCrlDist(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5146 {
wolfSSL 11:cee25a834751 5147 word32 idx = 0;
wolfSSL 11:cee25a834751 5148 int length = 0;
wolfSSL 11:cee25a834751 5149
wolfSSL 11:cee25a834751 5150 WOLFSSL_ENTER("DecodeCrlDist");
wolfSSL 11:cee25a834751 5151
wolfSSL 11:cee25a834751 5152 /* Unwrap the list of Distribution Points*/
wolfSSL 11:cee25a834751 5153 if (GetSequence(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5154 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5155
wolfSSL 11:cee25a834751 5156 /* Unwrap a single Distribution Point */
wolfSSL 11:cee25a834751 5157 if (GetSequence(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5158 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5159
wolfSSL 11:cee25a834751 5160 /* The Distribution Point has three explicit optional members
wolfSSL 11:cee25a834751 5161 * First check for a DistributionPointName
wolfSSL 11:cee25a834751 5162 */
wolfSSL 11:cee25a834751 5163 if (input[idx] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 0))
wolfSSL 11:cee25a834751 5164 {
wolfSSL 11:cee25a834751 5165 idx++;
wolfSSL 11:cee25a834751 5166 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5167 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5168
wolfSSL 11:cee25a834751 5169 if (input[idx] ==
wolfSSL 11:cee25a834751 5170 (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | CRLDP_FULL_NAME))
wolfSSL 11:cee25a834751 5171 {
wolfSSL 11:cee25a834751 5172 idx++;
wolfSSL 11:cee25a834751 5173 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5174 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5175
wolfSSL 11:cee25a834751 5176 if (input[idx] == (ASN_CONTEXT_SPECIFIC | GENERALNAME_URI))
wolfSSL 11:cee25a834751 5177 {
wolfSSL 11:cee25a834751 5178 idx++;
wolfSSL 11:cee25a834751 5179 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5180 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5181
wolfSSL 11:cee25a834751 5182 cert->extCrlInfoSz = length;
wolfSSL 11:cee25a834751 5183 cert->extCrlInfo = input + idx;
wolfSSL 11:cee25a834751 5184 idx += length;
wolfSSL 11:cee25a834751 5185 }
wolfSSL 11:cee25a834751 5186 else
wolfSSL 11:cee25a834751 5187 /* This isn't a URI, skip it. */
wolfSSL 11:cee25a834751 5188 idx += length;
wolfSSL 11:cee25a834751 5189 }
wolfSSL 11:cee25a834751 5190 else {
wolfSSL 11:cee25a834751 5191 /* This isn't a FULLNAME, skip it. */
wolfSSL 11:cee25a834751 5192 idx += length;
wolfSSL 11:cee25a834751 5193 }
wolfSSL 11:cee25a834751 5194 }
wolfSSL 11:cee25a834751 5195
wolfSSL 11:cee25a834751 5196 /* Check for reasonFlags */
wolfSSL 11:cee25a834751 5197 if (idx < (word32)sz &&
wolfSSL 11:cee25a834751 5198 input[idx] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 1))
wolfSSL 11:cee25a834751 5199 {
wolfSSL 11:cee25a834751 5200 idx++;
wolfSSL 11:cee25a834751 5201 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5202 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5203 idx += length;
wolfSSL 11:cee25a834751 5204 }
wolfSSL 11:cee25a834751 5205
wolfSSL 11:cee25a834751 5206 /* Check for cRLIssuer */
wolfSSL 11:cee25a834751 5207 if (idx < (word32)sz &&
wolfSSL 11:cee25a834751 5208 input[idx] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 2))
wolfSSL 11:cee25a834751 5209 {
wolfSSL 11:cee25a834751 5210 idx++;
wolfSSL 11:cee25a834751 5211 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5212 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5213 idx += length;
wolfSSL 11:cee25a834751 5214 }
wolfSSL 11:cee25a834751 5215
wolfSSL 11:cee25a834751 5216 if (idx < (word32)sz)
wolfSSL 11:cee25a834751 5217 {
wolfSSL 11:cee25a834751 5218 WOLFSSL_MSG("\tThere are more CRL Distribution Point records, "
wolfSSL 11:cee25a834751 5219 "but we only use the first one.");
wolfSSL 11:cee25a834751 5220 }
wolfSSL 11:cee25a834751 5221
wolfSSL 11:cee25a834751 5222 return 0;
wolfSSL 11:cee25a834751 5223 }
wolfSSL 11:cee25a834751 5224
wolfSSL 11:cee25a834751 5225
wolfSSL 11:cee25a834751 5226 static int DecodeAuthInfo(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5227 /*
wolfSSL 11:cee25a834751 5228 * Read the first of the Authority Information Access records. If there are
wolfSSL 11:cee25a834751 5229 * any issues, return without saving the record.
wolfSSL 11:cee25a834751 5230 */
wolfSSL 11:cee25a834751 5231 {
wolfSSL 11:cee25a834751 5232 word32 idx = 0;
wolfSSL 11:cee25a834751 5233 int length = 0;
wolfSSL 11:cee25a834751 5234 byte b;
wolfSSL 11:cee25a834751 5235 word32 oid;
wolfSSL 11:cee25a834751 5236
wolfSSL 11:cee25a834751 5237 WOLFSSL_ENTER("DecodeAuthInfo");
wolfSSL 11:cee25a834751 5238
wolfSSL 11:cee25a834751 5239 /* Unwrap the list of AIAs */
wolfSSL 11:cee25a834751 5240 if (GetSequence(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5241 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5242
wolfSSL 11:cee25a834751 5243 while (idx < (word32)sz) {
wolfSSL 11:cee25a834751 5244 /* Unwrap a single AIA */
wolfSSL 11:cee25a834751 5245 if (GetSequence(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5246 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5247
wolfSSL 11:cee25a834751 5248 oid = 0;
wolfSSL 11:cee25a834751 5249 if (GetObjectId(input, &idx, &oid, oidCertAuthInfoType, sz) < 0)
wolfSSL 11:cee25a834751 5250 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5251
wolfSSL 11:cee25a834751 5252
wolfSSL 11:cee25a834751 5253 /* Only supporting URIs right now. */
wolfSSL 11:cee25a834751 5254 b = input[idx++];
wolfSSL 11:cee25a834751 5255 if (GetLength(input, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 5256 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5257
wolfSSL 11:cee25a834751 5258 if (b == (ASN_CONTEXT_SPECIFIC | GENERALNAME_URI) &&
wolfSSL 11:cee25a834751 5259 oid == AIA_OCSP_OID)
wolfSSL 11:cee25a834751 5260 {
wolfSSL 11:cee25a834751 5261 cert->extAuthInfoSz = length;
wolfSSL 11:cee25a834751 5262 cert->extAuthInfo = input + idx;
wolfSSL 11:cee25a834751 5263 break;
wolfSSL 11:cee25a834751 5264 }
wolfSSL 11:cee25a834751 5265 idx += length;
wolfSSL 11:cee25a834751 5266 }
wolfSSL 11:cee25a834751 5267
wolfSSL 11:cee25a834751 5268 return 0;
wolfSSL 11:cee25a834751 5269 }
wolfSSL 11:cee25a834751 5270
wolfSSL 11:cee25a834751 5271
wolfSSL 11:cee25a834751 5272 static int DecodeAuthKeyId(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5273 {
wolfSSL 11:cee25a834751 5274 word32 idx = 0;
wolfSSL 11:cee25a834751 5275 int length = 0, ret = 0;
wolfSSL 11:cee25a834751 5276
wolfSSL 11:cee25a834751 5277 WOLFSSL_ENTER("DecodeAuthKeyId");
wolfSSL 11:cee25a834751 5278
wolfSSL 11:cee25a834751 5279 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5280 WOLFSSL_MSG("\tfail: should be a SEQUENCE\n");
wolfSSL 11:cee25a834751 5281 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5282 }
wolfSSL 11:cee25a834751 5283
wolfSSL 11:cee25a834751 5284 if (input[idx++] != (ASN_CONTEXT_SPECIFIC | 0)) {
wolfSSL 11:cee25a834751 5285 WOLFSSL_MSG("\tinfo: OPTIONAL item 0, not available\n");
wolfSSL 11:cee25a834751 5286 return 0;
wolfSSL 11:cee25a834751 5287 }
wolfSSL 11:cee25a834751 5288
wolfSSL 11:cee25a834751 5289 if (GetLength(input, &idx, &length, sz) <= 0) {
wolfSSL 11:cee25a834751 5290 WOLFSSL_MSG("\tfail: extension data length");
wolfSSL 11:cee25a834751 5291 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5292 }
wolfSSL 11:cee25a834751 5293
wolfSSL 11:cee25a834751 5294 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5295 cert->extAuthKeyIdSrc = &input[idx];
wolfSSL 11:cee25a834751 5296 cert->extAuthKeyIdSz = length;
wolfSSL 11:cee25a834751 5297 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 5298
wolfSSL 11:cee25a834751 5299 if (length == KEYID_SIZE) {
wolfSSL 11:cee25a834751 5300 XMEMCPY(cert->extAuthKeyId, input + idx, length);
wolfSSL 11:cee25a834751 5301 }
wolfSSL 11:cee25a834751 5302 else {
wolfSSL 11:cee25a834751 5303 #ifdef NO_SHA
wolfSSL 11:cee25a834751 5304 ret = wc_Sha256Hash(input + idx, length, cert->extAuthKeyId);
wolfSSL 11:cee25a834751 5305 #else
wolfSSL 11:cee25a834751 5306 ret = wc_ShaHash(input + idx, length, cert->extAuthKeyId);
wolfSSL 11:cee25a834751 5307 #endif
wolfSSL 11:cee25a834751 5308 }
wolfSSL 11:cee25a834751 5309
wolfSSL 11:cee25a834751 5310 return ret;
wolfSSL 11:cee25a834751 5311 }
wolfSSL 11:cee25a834751 5312
wolfSSL 11:cee25a834751 5313
wolfSSL 11:cee25a834751 5314 static int DecodeSubjKeyId(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5315 {
wolfSSL 11:cee25a834751 5316 word32 idx = 0;
wolfSSL 11:cee25a834751 5317 int length = 0, ret = 0;
wolfSSL 11:cee25a834751 5318
wolfSSL 11:cee25a834751 5319 WOLFSSL_ENTER("DecodeSubjKeyId");
wolfSSL 11:cee25a834751 5320
wolfSSL 11:cee25a834751 5321 if (sz <= 0)
wolfSSL 11:cee25a834751 5322 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5323
wolfSSL 11:cee25a834751 5324 ret = GetOctetString(input, &idx, &length, sz);
wolfSSL 11:cee25a834751 5325 if (ret < 0)
wolfSSL 11:cee25a834751 5326 return ret;
wolfSSL 11:cee25a834751 5327
wolfSSL 11:cee25a834751 5328 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5329 cert->extSubjKeyIdSrc = &input[idx];
wolfSSL 11:cee25a834751 5330 cert->extSubjKeyIdSz = length;
wolfSSL 11:cee25a834751 5331 #endif /* OPENSSL_EXTRA */
wolfSSL 11:cee25a834751 5332
wolfSSL 11:cee25a834751 5333 if (length == SIGNER_DIGEST_SIZE) {
wolfSSL 11:cee25a834751 5334 XMEMCPY(cert->extSubjKeyId, input + idx, length);
wolfSSL 11:cee25a834751 5335 }
wolfSSL 11:cee25a834751 5336 else {
wolfSSL 11:cee25a834751 5337 #ifdef NO_SHA
wolfSSL 11:cee25a834751 5338 ret = wc_Sha256Hash(input + idx, length, cert->extSubjKeyId);
wolfSSL 11:cee25a834751 5339 #else
wolfSSL 11:cee25a834751 5340 ret = wc_ShaHash(input + idx, length, cert->extSubjKeyId);
wolfSSL 11:cee25a834751 5341 #endif
wolfSSL 11:cee25a834751 5342 }
wolfSSL 11:cee25a834751 5343
wolfSSL 11:cee25a834751 5344 return ret;
wolfSSL 11:cee25a834751 5345 }
wolfSSL 11:cee25a834751 5346
wolfSSL 11:cee25a834751 5347
wolfSSL 11:cee25a834751 5348 static int DecodeKeyUsage(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5349 {
wolfSSL 11:cee25a834751 5350 word32 idx = 0;
wolfSSL 11:cee25a834751 5351 int length;
wolfSSL 11:cee25a834751 5352 int ret;
wolfSSL 11:cee25a834751 5353 WOLFSSL_ENTER("DecodeKeyUsage");
wolfSSL 11:cee25a834751 5354
wolfSSL 11:cee25a834751 5355 ret = CheckBitString(input, &idx, &length, sz, 0, NULL);
wolfSSL 11:cee25a834751 5356 if (ret != 0)
wolfSSL 11:cee25a834751 5357 return ret;
wolfSSL 11:cee25a834751 5358
wolfSSL 11:cee25a834751 5359 cert->extKeyUsage = (word16)(input[idx]);
wolfSSL 11:cee25a834751 5360 if (length == 2)
wolfSSL 11:cee25a834751 5361 cert->extKeyUsage |= (word16)(input[idx+1] << 8);
wolfSSL 11:cee25a834751 5362
wolfSSL 11:cee25a834751 5363 return 0;
wolfSSL 11:cee25a834751 5364 }
wolfSSL 11:cee25a834751 5365
wolfSSL 11:cee25a834751 5366
wolfSSL 11:cee25a834751 5367 static int DecodeExtKeyUsage(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5368 {
wolfSSL 11:cee25a834751 5369 word32 idx = 0, oid;
wolfSSL 11:cee25a834751 5370 int length;
wolfSSL 11:cee25a834751 5371
wolfSSL 11:cee25a834751 5372 WOLFSSL_ENTER("DecodeExtKeyUsage");
wolfSSL 11:cee25a834751 5373
wolfSSL 11:cee25a834751 5374 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5375 WOLFSSL_MSG("\tfail: should be a SEQUENCE");
wolfSSL 11:cee25a834751 5376 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5377 }
wolfSSL 11:cee25a834751 5378
wolfSSL 11:cee25a834751 5379 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5380 cert->extExtKeyUsageSrc = input + idx;
wolfSSL 11:cee25a834751 5381 cert->extExtKeyUsageSz = length;
wolfSSL 11:cee25a834751 5382 #endif
wolfSSL 11:cee25a834751 5383
wolfSSL 11:cee25a834751 5384 while (idx < (word32)sz) {
wolfSSL 11:cee25a834751 5385 if (GetObjectId(input, &idx, &oid, oidCertKeyUseType, sz) < 0)
wolfSSL 11:cee25a834751 5386 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5387
wolfSSL 11:cee25a834751 5388 switch (oid) {
wolfSSL 11:cee25a834751 5389 case EKU_ANY_OID:
wolfSSL 11:cee25a834751 5390 cert->extExtKeyUsage |= EXTKEYUSE_ANY;
wolfSSL 11:cee25a834751 5391 break;
wolfSSL 11:cee25a834751 5392 case EKU_SERVER_AUTH_OID:
wolfSSL 11:cee25a834751 5393 cert->extExtKeyUsage |= EXTKEYUSE_SERVER_AUTH;
wolfSSL 11:cee25a834751 5394 break;
wolfSSL 11:cee25a834751 5395 case EKU_CLIENT_AUTH_OID:
wolfSSL 11:cee25a834751 5396 cert->extExtKeyUsage |= EXTKEYUSE_CLIENT_AUTH;
wolfSSL 11:cee25a834751 5397 break;
wolfSSL 11:cee25a834751 5398 case EKU_OCSP_SIGN_OID:
wolfSSL 11:cee25a834751 5399 cert->extExtKeyUsage |= EXTKEYUSE_OCSP_SIGN;
wolfSSL 11:cee25a834751 5400 break;
wolfSSL 11:cee25a834751 5401 }
wolfSSL 11:cee25a834751 5402
wolfSSL 11:cee25a834751 5403 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5404 cert->extExtKeyUsageCount++;
wolfSSL 11:cee25a834751 5405 #endif
wolfSSL 11:cee25a834751 5406 }
wolfSSL 11:cee25a834751 5407
wolfSSL 11:cee25a834751 5408 return 0;
wolfSSL 11:cee25a834751 5409 }
wolfSSL 11:cee25a834751 5410
wolfSSL 11:cee25a834751 5411
wolfSSL 11:cee25a834751 5412 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 5413 static int DecodeSubtree(byte* input, int sz, Base_entry** head, void* heap)
wolfSSL 11:cee25a834751 5414 {
wolfSSL 11:cee25a834751 5415 word32 idx = 0;
wolfSSL 11:cee25a834751 5416
wolfSSL 11:cee25a834751 5417 (void)heap;
wolfSSL 11:cee25a834751 5418
wolfSSL 11:cee25a834751 5419 while (idx < (word32)sz) {
wolfSSL 11:cee25a834751 5420 int seqLength, strLength;
wolfSSL 11:cee25a834751 5421 word32 nameIdx;
wolfSSL 11:cee25a834751 5422 byte b;
wolfSSL 11:cee25a834751 5423
wolfSSL 11:cee25a834751 5424 if (GetSequence(input, &idx, &seqLength, sz) < 0) {
wolfSSL 11:cee25a834751 5425 WOLFSSL_MSG("\tfail: should be a SEQUENCE");
wolfSSL 11:cee25a834751 5426 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5427 }
wolfSSL 11:cee25a834751 5428
wolfSSL 11:cee25a834751 5429 nameIdx = idx;
wolfSSL 11:cee25a834751 5430 b = input[nameIdx++];
wolfSSL 11:cee25a834751 5431 if (GetLength(input, &nameIdx, &strLength, sz) <= 0) {
wolfSSL 11:cee25a834751 5432 WOLFSSL_MSG("\tinvalid length");
wolfSSL 11:cee25a834751 5433 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5434 }
wolfSSL 11:cee25a834751 5435
wolfSSL 11:cee25a834751 5436 if (b == (ASN_CONTEXT_SPECIFIC | ASN_DNS_TYPE) ||
wolfSSL 11:cee25a834751 5437 b == (ASN_CONTEXT_SPECIFIC | ASN_RFC822_TYPE) ||
wolfSSL 11:cee25a834751 5438 b == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | ASN_DIR_TYPE)) {
wolfSSL 11:cee25a834751 5439
wolfSSL 11:cee25a834751 5440 Base_entry* entry = (Base_entry*)XMALLOC(sizeof(Base_entry),
wolfSSL 11:cee25a834751 5441 heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 5442
wolfSSL 11:cee25a834751 5443 if (entry == NULL) {
wolfSSL 11:cee25a834751 5444 WOLFSSL_MSG("allocate error");
wolfSSL 11:cee25a834751 5445 return MEMORY_E;
wolfSSL 11:cee25a834751 5446 }
wolfSSL 11:cee25a834751 5447
wolfSSL 11:cee25a834751 5448 entry->name = (char*)XMALLOC(strLength, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 5449 if (entry->name == NULL) {
wolfSSL 11:cee25a834751 5450 WOLFSSL_MSG("allocate error");
wolfSSL 11:cee25a834751 5451 XFREE(entry, heap, DYNAMIC_TYPE_ALTNAME);
wolfSSL 11:cee25a834751 5452 return MEMORY_E;
wolfSSL 11:cee25a834751 5453 }
wolfSSL 11:cee25a834751 5454
wolfSSL 11:cee25a834751 5455 XMEMCPY(entry->name, &input[nameIdx], strLength);
wolfSSL 11:cee25a834751 5456 entry->nameSz = strLength;
wolfSSL 11:cee25a834751 5457 entry->type = b & 0x0F;
wolfSSL 11:cee25a834751 5458
wolfSSL 11:cee25a834751 5459 entry->next = *head;
wolfSSL 11:cee25a834751 5460 *head = entry;
wolfSSL 11:cee25a834751 5461 }
wolfSSL 11:cee25a834751 5462
wolfSSL 11:cee25a834751 5463 idx += seqLength;
wolfSSL 11:cee25a834751 5464 }
wolfSSL 11:cee25a834751 5465
wolfSSL 11:cee25a834751 5466 return 0;
wolfSSL 11:cee25a834751 5467 }
wolfSSL 11:cee25a834751 5468
wolfSSL 11:cee25a834751 5469
wolfSSL 11:cee25a834751 5470 static int DecodeNameConstraints(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5471 {
wolfSSL 11:cee25a834751 5472 word32 idx = 0;
wolfSSL 11:cee25a834751 5473 int length = 0;
wolfSSL 11:cee25a834751 5474
wolfSSL 11:cee25a834751 5475 WOLFSSL_ENTER("DecodeNameConstraints");
wolfSSL 11:cee25a834751 5476
wolfSSL 11:cee25a834751 5477 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5478 WOLFSSL_MSG("\tfail: should be a SEQUENCE");
wolfSSL 11:cee25a834751 5479 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5480 }
wolfSSL 11:cee25a834751 5481
wolfSSL 11:cee25a834751 5482 while (idx < (word32)sz) {
wolfSSL 11:cee25a834751 5483 byte b = input[idx++];
wolfSSL 11:cee25a834751 5484 Base_entry** subtree = NULL;
wolfSSL 11:cee25a834751 5485
wolfSSL 11:cee25a834751 5486 if (GetLength(input, &idx, &length, sz) <= 0) {
wolfSSL 11:cee25a834751 5487 WOLFSSL_MSG("\tinvalid length");
wolfSSL 11:cee25a834751 5488 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5489 }
wolfSSL 11:cee25a834751 5490
wolfSSL 11:cee25a834751 5491 if (b == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 0))
wolfSSL 11:cee25a834751 5492 subtree = &cert->permittedNames;
wolfSSL 11:cee25a834751 5493 else if (b == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 1))
wolfSSL 11:cee25a834751 5494 subtree = &cert->excludedNames;
wolfSSL 11:cee25a834751 5495 else {
wolfSSL 11:cee25a834751 5496 WOLFSSL_MSG("\tinvalid subtree");
wolfSSL 11:cee25a834751 5497 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5498 }
wolfSSL 11:cee25a834751 5499
wolfSSL 11:cee25a834751 5500 DecodeSubtree(input + idx, length, subtree, cert->heap);
wolfSSL 11:cee25a834751 5501
wolfSSL 11:cee25a834751 5502 idx += length;
wolfSSL 11:cee25a834751 5503 }
wolfSSL 11:cee25a834751 5504
wolfSSL 11:cee25a834751 5505 return 0;
wolfSSL 11:cee25a834751 5506 }
wolfSSL 11:cee25a834751 5507 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 5508
wolfSSL 11:cee25a834751 5509
wolfSSL 11:cee25a834751 5510 #if defined(WOLFSSL_CERT_EXT) && !defined(WOLFSSL_SEP)
wolfSSL 11:cee25a834751 5511
wolfSSL 11:cee25a834751 5512 static int Word32ToString(char* d, word32 number)
wolfSSL 11:cee25a834751 5513 {
wolfSSL 11:cee25a834751 5514 int i = 0;
wolfSSL 11:cee25a834751 5515
wolfSSL 11:cee25a834751 5516 if (d != NULL) {
wolfSSL 11:cee25a834751 5517 word32 order = 1000000000;
wolfSSL 11:cee25a834751 5518 word32 digit;
wolfSSL 11:cee25a834751 5519
wolfSSL 11:cee25a834751 5520 if (number == 0) {
wolfSSL 11:cee25a834751 5521 d[i++] = '0';
wolfSSL 11:cee25a834751 5522 }
wolfSSL 11:cee25a834751 5523 else {
wolfSSL 11:cee25a834751 5524 while (order) {
wolfSSL 11:cee25a834751 5525 digit = number / order;
wolfSSL 11:cee25a834751 5526 if (i > 0 || digit != 0) {
wolfSSL 11:cee25a834751 5527 d[i++] = (char)digit + '0';
wolfSSL 11:cee25a834751 5528 }
wolfSSL 11:cee25a834751 5529 if (digit != 0)
wolfSSL 11:cee25a834751 5530 number %= digit * order;
wolfSSL 11:cee25a834751 5531 if (order > 1)
wolfSSL 11:cee25a834751 5532 order /= 10;
wolfSSL 11:cee25a834751 5533 else
wolfSSL 11:cee25a834751 5534 order = 0;
wolfSSL 11:cee25a834751 5535 }
wolfSSL 11:cee25a834751 5536 }
wolfSSL 11:cee25a834751 5537 d[i] = 0;
wolfSSL 11:cee25a834751 5538 }
wolfSSL 11:cee25a834751 5539
wolfSSL 11:cee25a834751 5540 return i;
wolfSSL 11:cee25a834751 5541 }
wolfSSL 11:cee25a834751 5542
wolfSSL 11:cee25a834751 5543
wolfSSL 11:cee25a834751 5544 /* Decode ITU-T X.690 OID format to a string representation
wolfSSL 11:cee25a834751 5545 * return string length */
wolfSSL 11:cee25a834751 5546 static int DecodePolicyOID(char *out, word32 outSz, byte *in, word32 inSz)
wolfSSL 11:cee25a834751 5547 {
wolfSSL 11:cee25a834751 5548 word32 val, idx = 0, nb_bytes;
wolfSSL 11:cee25a834751 5549 size_t w_bytes = 0;
wolfSSL 11:cee25a834751 5550
wolfSSL 11:cee25a834751 5551 if (out == NULL || in == NULL || outSz < 4 || inSz < 2)
wolfSSL 11:cee25a834751 5552 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 5553
wolfSSL 11:cee25a834751 5554 /* first two byte must be interpreted as : 40 * int1 + int2 */
wolfSSL 11:cee25a834751 5555 val = (word16)in[idx++];
wolfSSL 11:cee25a834751 5556
wolfSSL 11:cee25a834751 5557 w_bytes = Word32ToString(out, val / 40);
wolfSSL 11:cee25a834751 5558 out[w_bytes++] = '.';
wolfSSL 11:cee25a834751 5559 w_bytes += Word32ToString(out+w_bytes, val % 40);
wolfSSL 11:cee25a834751 5560
wolfSSL 11:cee25a834751 5561 while (idx < inSz) {
wolfSSL 11:cee25a834751 5562 /* init value */
wolfSSL 11:cee25a834751 5563 val = 0;
wolfSSL 11:cee25a834751 5564 nb_bytes = 0;
wolfSSL 11:cee25a834751 5565
wolfSSL 11:cee25a834751 5566 /* check that output size is ok */
wolfSSL 11:cee25a834751 5567 if (w_bytes > (outSz - 3))
wolfSSL 11:cee25a834751 5568 return BUFFER_E;
wolfSSL 11:cee25a834751 5569
wolfSSL 11:cee25a834751 5570 /* first bit is used to set if value is coded on 1 or multiple bytes */
wolfSSL 11:cee25a834751 5571 while ((in[idx+nb_bytes] & 0x80))
wolfSSL 11:cee25a834751 5572 nb_bytes++;
wolfSSL 11:cee25a834751 5573
wolfSSL 11:cee25a834751 5574 if (!nb_bytes)
wolfSSL 11:cee25a834751 5575 val = (word32)(in[idx++] & 0x7f);
wolfSSL 11:cee25a834751 5576 else {
wolfSSL 11:cee25a834751 5577 word32 base = 1, tmp = nb_bytes;
wolfSSL 11:cee25a834751 5578
wolfSSL 11:cee25a834751 5579 while (tmp != 0) {
wolfSSL 11:cee25a834751 5580 val += (word32)(in[idx+tmp] & 0x7f) * base;
wolfSSL 11:cee25a834751 5581 base *= 128;
wolfSSL 11:cee25a834751 5582 tmp--;
wolfSSL 11:cee25a834751 5583 }
wolfSSL 11:cee25a834751 5584 val += (word32)(in[idx++] & 0x7f) * base;
wolfSSL 11:cee25a834751 5585
wolfSSL 11:cee25a834751 5586 idx += nb_bytes;
wolfSSL 11:cee25a834751 5587 }
wolfSSL 11:cee25a834751 5588
wolfSSL 11:cee25a834751 5589 out[w_bytes++] = '.';
wolfSSL 11:cee25a834751 5590 w_bytes += Word32ToString(out+w_bytes, val);
wolfSSL 11:cee25a834751 5591 }
wolfSSL 11:cee25a834751 5592
wolfSSL 11:cee25a834751 5593 return 0;
wolfSSL 11:cee25a834751 5594 }
wolfSSL 11:cee25a834751 5595 #endif /* WOLFSSL_CERT_EXT && !WOLFSSL_SEP */
wolfSSL 11:cee25a834751 5596
wolfSSL 11:cee25a834751 5597 #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
wolfSSL 11:cee25a834751 5598 /* Reference: https://tools.ietf.org/html/rfc5280#section-4.2.1.4 */
wolfSSL 11:cee25a834751 5599 static int DecodeCertPolicy(byte* input, int sz, DecodedCert* cert)
wolfSSL 11:cee25a834751 5600 {
wolfSSL 11:cee25a834751 5601 word32 idx = 0;
wolfSSL 11:cee25a834751 5602 word32 oldIdx;
wolfSSL 11:cee25a834751 5603 int ret;
wolfSSL 11:cee25a834751 5604 int total_length = 0, policy_length = 0, length = 0;
wolfSSL 11:cee25a834751 5605 #if !defined(WOLFSSL_SEP) && defined(WOLFSSL_CERT_EXT) && \
wolfSSL 11:cee25a834751 5606 !defined(WOLFSSL_DUP_CERTPOL)
wolfSSL 11:cee25a834751 5607 int i;
wolfSSL 11:cee25a834751 5608 #endif
wolfSSL 11:cee25a834751 5609
wolfSSL 11:cee25a834751 5610 WOLFSSL_ENTER("DecodeCertPolicy");
wolfSSL 11:cee25a834751 5611
wolfSSL 11:cee25a834751 5612 if (GetSequence(input, &idx, &total_length, sz) < 0) {
wolfSSL 11:cee25a834751 5613 WOLFSSL_MSG("\tGet CertPolicy total seq failed");
wolfSSL 11:cee25a834751 5614 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5615 }
wolfSSL 11:cee25a834751 5616
wolfSSL 11:cee25a834751 5617 /* Validate total length (2 is the CERT_POLICY_OID+SEQ) */
wolfSSL 11:cee25a834751 5618 if ((total_length + 2) != sz) {
wolfSSL 11:cee25a834751 5619 WOLFSSL_MSG("\tCertPolicy length mismatch");
wolfSSL 11:cee25a834751 5620 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5621 }
wolfSSL 11:cee25a834751 5622
wolfSSL 11:cee25a834751 5623 /* Unwrap certificatePolicies */
wolfSSL 11:cee25a834751 5624 do {
wolfSSL 11:cee25a834751 5625 if (GetSequence(input, &idx, &policy_length, sz) < 0) {
wolfSSL 11:cee25a834751 5626 WOLFSSL_MSG("\tGet CertPolicy seq failed");
wolfSSL 11:cee25a834751 5627 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5628 }
wolfSSL 11:cee25a834751 5629
wolfSSL 11:cee25a834751 5630 oldIdx = idx;
wolfSSL 11:cee25a834751 5631 ret = GetASNObjectId(input, &idx, &length, sz);
wolfSSL 11:cee25a834751 5632 if (ret != 0)
wolfSSL 11:cee25a834751 5633 return ret;
wolfSSL 11:cee25a834751 5634 policy_length -= idx - oldIdx;
wolfSSL 11:cee25a834751 5635
wolfSSL 11:cee25a834751 5636 if (length > 0) {
wolfSSL 11:cee25a834751 5637 /* Verify length won't overrun buffer */
wolfSSL 11:cee25a834751 5638 if (length > (sz - (int)idx)) {
wolfSSL 11:cee25a834751 5639 WOLFSSL_MSG("\tCertPolicy length exceeds input buffer");
wolfSSL 11:cee25a834751 5640 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5641 }
wolfSSL 11:cee25a834751 5642
wolfSSL 11:cee25a834751 5643 #if defined(WOLFSSL_SEP)
wolfSSL 11:cee25a834751 5644 cert->deviceType = (byte*)XMALLOC(length, cert->heap,
wolfSSL 11:cee25a834751 5645 DYNAMIC_TYPE_X509_EXT);
wolfSSL 11:cee25a834751 5646 if (cert->deviceType == NULL) {
wolfSSL 11:cee25a834751 5647 WOLFSSL_MSG("\tCouldn't alloc memory for deviceType");
wolfSSL 11:cee25a834751 5648 return MEMORY_E;
wolfSSL 11:cee25a834751 5649 }
wolfSSL 11:cee25a834751 5650 cert->deviceTypeSz = length;
wolfSSL 11:cee25a834751 5651 XMEMCPY(cert->deviceType, input + idx, length);
wolfSSL 11:cee25a834751 5652 break;
wolfSSL 11:cee25a834751 5653 #elif defined(WOLFSSL_CERT_EXT)
wolfSSL 11:cee25a834751 5654 /* decode cert policy */
wolfSSL 11:cee25a834751 5655 if (DecodePolicyOID(cert->extCertPolicies[cert->extCertPoliciesNb], MAX_CERTPOL_SZ,
wolfSSL 11:cee25a834751 5656 input + idx, length) != 0) {
wolfSSL 11:cee25a834751 5657 WOLFSSL_MSG("\tCouldn't decode CertPolicy");
wolfSSL 11:cee25a834751 5658 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5659 }
wolfSSL 11:cee25a834751 5660 #ifndef WOLFSSL_DUP_CERTPOL
wolfSSL 11:cee25a834751 5661 /* From RFC 5280 section 4.2.1.3 "A certificate policy OID MUST
wolfSSL 11:cee25a834751 5662 * NOT appear more than once in a certificate policies
wolfSSL 11:cee25a834751 5663 * extension". This is a sanity check for duplicates.
wolfSSL 11:cee25a834751 5664 * extCertPolicies should only have OID values, additional
wolfSSL 11:cee25a834751 5665 * qualifiers need to be stored in a seperate array. */
wolfSSL 11:cee25a834751 5666 for (i = 0; i < cert->extCertPoliciesNb; i++) {
wolfSSL 11:cee25a834751 5667 if (XMEMCMP(cert->extCertPolicies[i],
wolfSSL 11:cee25a834751 5668 cert->extCertPolicies[cert->extCertPoliciesNb],
wolfSSL 11:cee25a834751 5669 MAX_CERTPOL_SZ) == 0) {
wolfSSL 11:cee25a834751 5670 WOLFSSL_MSG("Duplicate policy OIDs not allowed");
wolfSSL 11:cee25a834751 5671 WOLFSSL_MSG("Use WOLFSSL_DUP_CERTPOL if wanted");
wolfSSL 11:cee25a834751 5672 return CERTPOLICIES_E;
wolfSSL 11:cee25a834751 5673 }
wolfSSL 11:cee25a834751 5674 }
wolfSSL 11:cee25a834751 5675 #endif /* !defined(WOLFSSL_DUP_CERTPOL) */
wolfSSL 11:cee25a834751 5676 cert->extCertPoliciesNb++;
wolfSSL 11:cee25a834751 5677 #else
wolfSSL 11:cee25a834751 5678 WOLFSSL_LEAVE("DecodeCertPolicy : unsupported mode", 0);
wolfSSL 11:cee25a834751 5679 return 0;
wolfSSL 11:cee25a834751 5680 #endif
wolfSSL 11:cee25a834751 5681 }
wolfSSL 11:cee25a834751 5682 idx += policy_length;
wolfSSL 11:cee25a834751 5683 } while((int)idx < total_length
wolfSSL 11:cee25a834751 5684 #if defined(WOLFSSL_CERT_EXT)
wolfSSL 11:cee25a834751 5685 && cert->extCertPoliciesNb < MAX_CERTPOL_NB
wolfSSL 11:cee25a834751 5686 #endif
wolfSSL 11:cee25a834751 5687 );
wolfSSL 11:cee25a834751 5688
wolfSSL 11:cee25a834751 5689 WOLFSSL_LEAVE("DecodeCertPolicy", 0);
wolfSSL 11:cee25a834751 5690 return 0;
wolfSSL 11:cee25a834751 5691 }
wolfSSL 11:cee25a834751 5692 #endif /* WOLFSSL_SEP */
wolfSSL 11:cee25a834751 5693
wolfSSL 11:cee25a834751 5694 static int DecodeCertExtensions(DecodedCert* cert)
wolfSSL 11:cee25a834751 5695 /*
wolfSSL 11:cee25a834751 5696 * Processing the Certificate Extensions. This does not modify the current
wolfSSL 11:cee25a834751 5697 * index. It is works starting with the recorded extensions pointer.
wolfSSL 11:cee25a834751 5698 */
wolfSSL 11:cee25a834751 5699 {
wolfSSL 11:cee25a834751 5700 int ret;
wolfSSL 11:cee25a834751 5701 word32 idx = 0;
wolfSSL 11:cee25a834751 5702 int sz = cert->extensionsSz;
wolfSSL 11:cee25a834751 5703 byte* input = cert->extensions;
wolfSSL 11:cee25a834751 5704 int length;
wolfSSL 11:cee25a834751 5705 word32 oid;
wolfSSL 11:cee25a834751 5706 byte critical = 0;
wolfSSL 11:cee25a834751 5707 byte criticalFail = 0;
wolfSSL 11:cee25a834751 5708
wolfSSL 11:cee25a834751 5709 WOLFSSL_ENTER("DecodeCertExtensions");
wolfSSL 11:cee25a834751 5710
wolfSSL 11:cee25a834751 5711 if (input == NULL || sz == 0)
wolfSSL 11:cee25a834751 5712 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 5713
wolfSSL 11:cee25a834751 5714 if (input[idx++] != ASN_EXTENSIONS) {
wolfSSL 11:cee25a834751 5715 WOLFSSL_MSG("\tfail: should be an EXTENSIONS");
wolfSSL 11:cee25a834751 5716 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5717 }
wolfSSL 11:cee25a834751 5718
wolfSSL 11:cee25a834751 5719 if (GetLength(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5720 WOLFSSL_MSG("\tfail: invalid length");
wolfSSL 11:cee25a834751 5721 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5722 }
wolfSSL 11:cee25a834751 5723
wolfSSL 11:cee25a834751 5724 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5725 WOLFSSL_MSG("\tfail: should be a SEQUENCE (1)");
wolfSSL 11:cee25a834751 5726 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5727 }
wolfSSL 11:cee25a834751 5728
wolfSSL 11:cee25a834751 5729 while (idx < (word32)sz) {
wolfSSL 11:cee25a834751 5730 if (GetSequence(input, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 5731 WOLFSSL_MSG("\tfail: should be a SEQUENCE");
wolfSSL 11:cee25a834751 5732 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5733 }
wolfSSL 11:cee25a834751 5734
wolfSSL 11:cee25a834751 5735 oid = 0;
wolfSSL 11:cee25a834751 5736 if ((ret = GetObjectId(input, &idx, &oid, oidCertExtType, sz)) < 0) {
wolfSSL 11:cee25a834751 5737 WOLFSSL_MSG("\tfail: OBJECT ID");
wolfSSL 11:cee25a834751 5738 return ret;
wolfSSL 11:cee25a834751 5739 }
wolfSSL 11:cee25a834751 5740
wolfSSL 11:cee25a834751 5741 /* check for critical flag */
wolfSSL 11:cee25a834751 5742 critical = 0;
wolfSSL 11:cee25a834751 5743 if (input[idx] == ASN_BOOLEAN) {
wolfSSL 11:cee25a834751 5744 ret = GetBoolean(input, &idx, sz);
wolfSSL 11:cee25a834751 5745 if (ret < 0) {
wolfSSL 11:cee25a834751 5746 WOLFSSL_MSG("\tfail: critical boolean");
wolfSSL 11:cee25a834751 5747 return ret;
wolfSSL 11:cee25a834751 5748 }
wolfSSL 11:cee25a834751 5749
wolfSSL 11:cee25a834751 5750 critical = (byte)ret;
wolfSSL 11:cee25a834751 5751 }
wolfSSL 11:cee25a834751 5752
wolfSSL 11:cee25a834751 5753 /* process the extension based on the OID */
wolfSSL 11:cee25a834751 5754 ret = GetOctetString(input, &idx, &length, sz);
wolfSSL 11:cee25a834751 5755 if (ret < 0) {
wolfSSL 11:cee25a834751 5756 WOLFSSL_MSG("\tfail: bad OCTET STRING");
wolfSSL 11:cee25a834751 5757 return ret;
wolfSSL 11:cee25a834751 5758 }
wolfSSL 11:cee25a834751 5759
wolfSSL 11:cee25a834751 5760 switch (oid) {
wolfSSL 11:cee25a834751 5761 case BASIC_CA_OID:
wolfSSL 11:cee25a834751 5762 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5763 cert->extBasicConstSet = 1;
wolfSSL 11:cee25a834751 5764 cert->extBasicConstCrit = critical;
wolfSSL 11:cee25a834751 5765 #endif
wolfSSL 11:cee25a834751 5766 if (DecodeBasicCaConstraint(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5767 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5768 break;
wolfSSL 11:cee25a834751 5769
wolfSSL 11:cee25a834751 5770 case CRL_DIST_OID:
wolfSSL 11:cee25a834751 5771 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5772 cert->extCRLdistSet = 1;
wolfSSL 11:cee25a834751 5773 cert->extCRLdistCrit = critical;
wolfSSL 11:cee25a834751 5774 #endif
wolfSSL 11:cee25a834751 5775 if (DecodeCrlDist(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5776 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5777 break;
wolfSSL 11:cee25a834751 5778
wolfSSL 11:cee25a834751 5779 case AUTH_INFO_OID:
wolfSSL 11:cee25a834751 5780 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5781 cert->extAuthInfoSet = 1;
wolfSSL 11:cee25a834751 5782 cert->extAuthInfoCrit = critical;
wolfSSL 11:cee25a834751 5783 #endif
wolfSSL 11:cee25a834751 5784 if (DecodeAuthInfo(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5785 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5786 break;
wolfSSL 11:cee25a834751 5787
wolfSSL 11:cee25a834751 5788 case ALT_NAMES_OID:
wolfSSL 11:cee25a834751 5789 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5790 cert->extSubjAltNameSet = 1;
wolfSSL 11:cee25a834751 5791 cert->extSubjAltNameCrit = critical;
wolfSSL 11:cee25a834751 5792 #endif
wolfSSL 11:cee25a834751 5793 if (DecodeAltNames(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5794 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5795 break;
wolfSSL 11:cee25a834751 5796
wolfSSL 11:cee25a834751 5797 case AUTH_KEY_OID:
wolfSSL 11:cee25a834751 5798 cert->extAuthKeyIdSet = 1;
wolfSSL 11:cee25a834751 5799 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5800 cert->extAuthKeyIdCrit = critical;
wolfSSL 11:cee25a834751 5801 #endif
wolfSSL 11:cee25a834751 5802 if (DecodeAuthKeyId(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5803 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5804 break;
wolfSSL 11:cee25a834751 5805
wolfSSL 11:cee25a834751 5806 case SUBJ_KEY_OID:
wolfSSL 11:cee25a834751 5807 cert->extSubjKeyIdSet = 1;
wolfSSL 11:cee25a834751 5808 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5809 cert->extSubjKeyIdCrit = critical;
wolfSSL 11:cee25a834751 5810 #endif
wolfSSL 11:cee25a834751 5811 #ifndef WOLFSSL_ALLOW_CRIT_SKID
wolfSSL 11:cee25a834751 5812 /* This check is added due to RFC 5280 section 4.2.1.2
wolfSSL 11:cee25a834751 5813 * stating that conforming CA's must mark this extension
wolfSSL 11:cee25a834751 5814 * as non-critical. When parsing extensions check that
wolfSSL 11:cee25a834751 5815 * certificate was made in compliance with this. */
wolfSSL 11:cee25a834751 5816 if (critical) {
wolfSSL 11:cee25a834751 5817 WOLFSSL_MSG("Critical Subject Key ID is not allowed");
wolfSSL 11:cee25a834751 5818 WOLFSSL_MSG("Use macro WOLFSSL_ALLOW_CRIT_SKID if wanted");
wolfSSL 11:cee25a834751 5819 return ASN_CRIT_EXT_E;
wolfSSL 11:cee25a834751 5820 }
wolfSSL 11:cee25a834751 5821 #endif
wolfSSL 11:cee25a834751 5822
wolfSSL 11:cee25a834751 5823 if (DecodeSubjKeyId(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5824 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5825 break;
wolfSSL 11:cee25a834751 5826
wolfSSL 11:cee25a834751 5827 case CERT_POLICY_OID:
wolfSSL 11:cee25a834751 5828 #ifdef WOLFSSL_SEP
wolfSSL 11:cee25a834751 5829 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5830 cert->extCertPolicySet = 1;
wolfSSL 11:cee25a834751 5831 cert->extCertPolicyCrit = critical;
wolfSSL 11:cee25a834751 5832 #endif
wolfSSL 11:cee25a834751 5833 #endif
wolfSSL 11:cee25a834751 5834 #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
wolfSSL 11:cee25a834751 5835 if (DecodeCertPolicy(&input[idx], length, cert) < 0) {
wolfSSL 11:cee25a834751 5836 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5837 }
wolfSSL 11:cee25a834751 5838 #else
wolfSSL 11:cee25a834751 5839 WOLFSSL_MSG("Certificate Policy extension not supported yet.");
wolfSSL 11:cee25a834751 5840 #endif
wolfSSL 11:cee25a834751 5841 break;
wolfSSL 11:cee25a834751 5842
wolfSSL 11:cee25a834751 5843 case KEY_USAGE_OID:
wolfSSL 11:cee25a834751 5844 cert->extKeyUsageSet = 1;
wolfSSL 11:cee25a834751 5845 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5846 cert->extKeyUsageCrit = critical;
wolfSSL 11:cee25a834751 5847 #endif
wolfSSL 11:cee25a834751 5848 if (DecodeKeyUsage(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5849 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5850 break;
wolfSSL 11:cee25a834751 5851
wolfSSL 11:cee25a834751 5852 case EXT_KEY_USAGE_OID:
wolfSSL 11:cee25a834751 5853 cert->extExtKeyUsageSet = 1;
wolfSSL 11:cee25a834751 5854 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5855 cert->extExtKeyUsageCrit = critical;
wolfSSL 11:cee25a834751 5856 #endif
wolfSSL 11:cee25a834751 5857 if (DecodeExtKeyUsage(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5858 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5859 break;
wolfSSL 11:cee25a834751 5860
wolfSSL 11:cee25a834751 5861 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 5862 case NAME_CONS_OID:
wolfSSL 11:cee25a834751 5863 cert->extNameConstraintSet = 1;
wolfSSL 11:cee25a834751 5864 #ifdef OPENSSL_EXTRA
wolfSSL 11:cee25a834751 5865 cert->extNameConstraintCrit = critical;
wolfSSL 11:cee25a834751 5866 #endif
wolfSSL 11:cee25a834751 5867 if (DecodeNameConstraints(&input[idx], length, cert) < 0)
wolfSSL 11:cee25a834751 5868 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 5869 break;
wolfSSL 11:cee25a834751 5870 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 5871
wolfSSL 11:cee25a834751 5872 case INHIBIT_ANY_OID:
wolfSSL 11:cee25a834751 5873 WOLFSSL_MSG("Inhibit anyPolicy extension not supported yet.");
wolfSSL 11:cee25a834751 5874 break;
wolfSSL 11:cee25a834751 5875
wolfSSL 11:cee25a834751 5876 default:
wolfSSL 11:cee25a834751 5877 /* While it is a failure to not support critical extensions,
wolfSSL 11:cee25a834751 5878 * still parse the certificate ignoring the unsupported
wolfSSL 11:cee25a834751 5879 * extension to allow caller to accept it with the verify
wolfSSL 11:cee25a834751 5880 * callback. */
wolfSSL 11:cee25a834751 5881 if (critical)
wolfSSL 11:cee25a834751 5882 criticalFail = 1;
wolfSSL 11:cee25a834751 5883 break;
wolfSSL 11:cee25a834751 5884 }
wolfSSL 11:cee25a834751 5885 idx += length;
wolfSSL 11:cee25a834751 5886 }
wolfSSL 11:cee25a834751 5887
wolfSSL 11:cee25a834751 5888 return criticalFail ? ASN_CRIT_EXT_E : 0;
wolfSSL 11:cee25a834751 5889 }
wolfSSL 11:cee25a834751 5890
wolfSSL 11:cee25a834751 5891 int ParseCert(DecodedCert* cert, int type, int verify, void* cm)
wolfSSL 11:cee25a834751 5892 {
wolfSSL 11:cee25a834751 5893 int ret;
wolfSSL 11:cee25a834751 5894 char* ptr;
wolfSSL 11:cee25a834751 5895
wolfSSL 11:cee25a834751 5896 ret = ParseCertRelative(cert, type, verify, cm);
wolfSSL 11:cee25a834751 5897 if (ret < 0)
wolfSSL 11:cee25a834751 5898 return ret;
wolfSSL 11:cee25a834751 5899
wolfSSL 11:cee25a834751 5900 if (cert->subjectCNLen > 0) {
wolfSSL 11:cee25a834751 5901 ptr = (char*) XMALLOC(cert->subjectCNLen + 1, cert->heap,
wolfSSL 11:cee25a834751 5902 DYNAMIC_TYPE_SUBJECT_CN);
wolfSSL 11:cee25a834751 5903 if (ptr == NULL)
wolfSSL 11:cee25a834751 5904 return MEMORY_E;
wolfSSL 11:cee25a834751 5905 XMEMCPY(ptr, cert->subjectCN, cert->subjectCNLen);
wolfSSL 11:cee25a834751 5906 ptr[cert->subjectCNLen] = '\0';
wolfSSL 11:cee25a834751 5907 cert->subjectCN = ptr;
wolfSSL 11:cee25a834751 5908 cert->subjectCNStored = 1;
wolfSSL 11:cee25a834751 5909 }
wolfSSL 11:cee25a834751 5910
wolfSSL 11:cee25a834751 5911 if (cert->keyOID == RSAk &&
wolfSSL 11:cee25a834751 5912 cert->publicKey != NULL && cert->pubKeySize > 0) {
wolfSSL 11:cee25a834751 5913 ptr = (char*) XMALLOC(cert->pubKeySize, cert->heap,
wolfSSL 11:cee25a834751 5914 DYNAMIC_TYPE_PUBLIC_KEY);
wolfSSL 11:cee25a834751 5915 if (ptr == NULL)
wolfSSL 11:cee25a834751 5916 return MEMORY_E;
wolfSSL 11:cee25a834751 5917 XMEMCPY(ptr, cert->publicKey, cert->pubKeySize);
wolfSSL 11:cee25a834751 5918 cert->publicKey = (byte *)ptr;
wolfSSL 11:cee25a834751 5919 cert->pubKeyStored = 1;
wolfSSL 11:cee25a834751 5920 }
wolfSSL 11:cee25a834751 5921
wolfSSL 11:cee25a834751 5922 return ret;
wolfSSL 11:cee25a834751 5923 }
wolfSSL 11:cee25a834751 5924
wolfSSL 11:cee25a834751 5925 /* from SSL proper, for locking can't do find here anymore */
wolfSSL 11:cee25a834751 5926 #ifdef __cplusplus
wolfSSL 11:cee25a834751 5927 extern "C" {
wolfSSL 11:cee25a834751 5928 #endif
wolfSSL 11:cee25a834751 5929 WOLFSSL_LOCAL Signer* GetCA(void* signers, byte* hash);
wolfSSL 11:cee25a834751 5930 #ifndef NO_SKID
wolfSSL 11:cee25a834751 5931 WOLFSSL_LOCAL Signer* GetCAByName(void* signers, byte* hash);
wolfSSL 11:cee25a834751 5932 #endif
wolfSSL 11:cee25a834751 5933 #ifdef __cplusplus
wolfSSL 11:cee25a834751 5934 }
wolfSSL 11:cee25a834751 5935 #endif
wolfSSL 11:cee25a834751 5936
wolfSSL 11:cee25a834751 5937
wolfSSL 11:cee25a834751 5938 #if defined(WOLFCRYPT_ONLY) || defined(NO_CERTS)
wolfSSL 11:cee25a834751 5939
wolfSSL 11:cee25a834751 5940 /* dummy functions, not using wolfSSL so don't need actual ones */
wolfSSL 11:cee25a834751 5941 Signer* GetCA(void* signers, byte* hash)
wolfSSL 11:cee25a834751 5942 {
wolfSSL 11:cee25a834751 5943 (void)hash;
wolfSSL 11:cee25a834751 5944
wolfSSL 11:cee25a834751 5945 return (Signer*)signers;
wolfSSL 11:cee25a834751 5946 }
wolfSSL 11:cee25a834751 5947
wolfSSL 11:cee25a834751 5948 #ifndef NO_SKID
wolfSSL 11:cee25a834751 5949 Signer* GetCAByName(void* signers, byte* hash)
wolfSSL 11:cee25a834751 5950 {
wolfSSL 11:cee25a834751 5951 (void)hash;
wolfSSL 11:cee25a834751 5952
wolfSSL 11:cee25a834751 5953 return (Signer*)signers;
wolfSSL 11:cee25a834751 5954 }
wolfSSL 11:cee25a834751 5955 #endif /* NO_SKID */
wolfSSL 11:cee25a834751 5956
wolfSSL 11:cee25a834751 5957 #endif /* WOLFCRYPT_ONLY || NO_CERTS */
wolfSSL 11:cee25a834751 5958
wolfSSL 11:cee25a834751 5959 int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
wolfSSL 11:cee25a834751 5960 {
wolfSSL 11:cee25a834751 5961 int ret = 0;
wolfSSL 11:cee25a834751 5962 int badDate = 0;
wolfSSL 11:cee25a834751 5963 int criticalExt = 0;
wolfSSL 11:cee25a834751 5964 word32 confirmOID;
wolfSSL 11:cee25a834751 5965
wolfSSL 11:cee25a834751 5966 if (cert == NULL) {
wolfSSL 11:cee25a834751 5967 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 5968 }
wolfSSL 11:cee25a834751 5969
wolfSSL 11:cee25a834751 5970 if (cert->sigCtx.state == SIG_STATE_BEGIN) {
wolfSSL 11:cee25a834751 5971 if ((ret = DecodeToKey(cert, verify)) < 0) {
wolfSSL 11:cee25a834751 5972 if (ret == ASN_BEFORE_DATE_E || ret == ASN_AFTER_DATE_E)
wolfSSL 11:cee25a834751 5973 badDate = ret;
wolfSSL 11:cee25a834751 5974 else
wolfSSL 11:cee25a834751 5975 return ret;
wolfSSL 11:cee25a834751 5976 }
wolfSSL 11:cee25a834751 5977
wolfSSL 11:cee25a834751 5978 WOLFSSL_MSG("Parsed Past Key");
wolfSSL 11:cee25a834751 5979
wolfSSL 11:cee25a834751 5980 if (cert->srcIdx < cert->sigIndex) {
wolfSSL 11:cee25a834751 5981 #ifndef ALLOW_V1_EXTENSIONS
wolfSSL 11:cee25a834751 5982 if (cert->version < 2) {
wolfSSL 11:cee25a834751 5983 WOLFSSL_MSG("\tv1 and v2 certs not allowed extensions");
wolfSSL 11:cee25a834751 5984 return ASN_VERSION_E;
wolfSSL 11:cee25a834751 5985 }
wolfSSL 11:cee25a834751 5986 #endif
wolfSSL 11:cee25a834751 5987
wolfSSL 11:cee25a834751 5988 /* save extensions */
wolfSSL 11:cee25a834751 5989 cert->extensions = &cert->source[cert->srcIdx];
wolfSSL 11:cee25a834751 5990 cert->extensionsSz = cert->sigIndex - cert->srcIdx;
wolfSSL 11:cee25a834751 5991 cert->extensionsIdx = cert->srcIdx; /* for potential later use */
wolfSSL 11:cee25a834751 5992
wolfSSL 11:cee25a834751 5993 if ((ret = DecodeCertExtensions(cert)) < 0) {
wolfSSL 11:cee25a834751 5994 if (ret == ASN_CRIT_EXT_E)
wolfSSL 11:cee25a834751 5995 criticalExt = ret;
wolfSSL 11:cee25a834751 5996 else
wolfSSL 11:cee25a834751 5997 return ret;
wolfSSL 11:cee25a834751 5998 }
wolfSSL 11:cee25a834751 5999
wolfSSL 11:cee25a834751 6000 /* advance past extensions */
wolfSSL 11:cee25a834751 6001 cert->srcIdx = cert->sigIndex;
wolfSSL 11:cee25a834751 6002 }
wolfSSL 11:cee25a834751 6003
wolfSSL 11:cee25a834751 6004 if ((ret = GetAlgoId(cert->source, &cert->srcIdx, &confirmOID,
wolfSSL 11:cee25a834751 6005 oidSigType, cert->maxIdx)) < 0)
wolfSSL 11:cee25a834751 6006 return ret;
wolfSSL 11:cee25a834751 6007
wolfSSL 11:cee25a834751 6008 if ((ret = GetSignature(cert)) < 0)
wolfSSL 11:cee25a834751 6009 return ret;
wolfSSL 11:cee25a834751 6010
wolfSSL 11:cee25a834751 6011 if (confirmOID != cert->signatureOID)
wolfSSL 11:cee25a834751 6012 return ASN_SIG_OID_E;
wolfSSL 11:cee25a834751 6013
wolfSSL 11:cee25a834751 6014 #ifndef NO_SKID
wolfSSL 11:cee25a834751 6015 if (cert->extSubjKeyIdSet == 0 && cert->publicKey != NULL &&
wolfSSL 11:cee25a834751 6016 cert->pubKeySize > 0) {
wolfSSL 11:cee25a834751 6017 #ifdef NO_SHA
wolfSSL 11:cee25a834751 6018 ret = wc_Sha256Hash(cert->publicKey, cert->pubKeySize,
wolfSSL 11:cee25a834751 6019 cert->extSubjKeyId);
wolfSSL 11:cee25a834751 6020 #else
wolfSSL 11:cee25a834751 6021 ret = wc_ShaHash(cert->publicKey, cert->pubKeySize,
wolfSSL 11:cee25a834751 6022 cert->extSubjKeyId);
wolfSSL 11:cee25a834751 6023 #endif /* NO_SHA */
wolfSSL 11:cee25a834751 6024 if (ret != 0)
wolfSSL 11:cee25a834751 6025 return ret;
wolfSSL 11:cee25a834751 6026 }
wolfSSL 11:cee25a834751 6027 #endif /* !NO_SKID */
wolfSSL 11:cee25a834751 6028
wolfSSL 11:cee25a834751 6029 if (verify != NO_VERIFY && type != CA_TYPE && type != TRUSTED_PEER_TYPE) {
wolfSSL 11:cee25a834751 6030 cert->ca = NULL;
wolfSSL 11:cee25a834751 6031 #ifndef NO_SKID
wolfSSL 11:cee25a834751 6032 if (cert->extAuthKeyIdSet)
wolfSSL 11:cee25a834751 6033 cert->ca = GetCA(cm, cert->extAuthKeyId);
wolfSSL 11:cee25a834751 6034 if (cert->ca == NULL)
wolfSSL 11:cee25a834751 6035 cert->ca = GetCAByName(cm, cert->issuerHash);
wolfSSL 11:cee25a834751 6036 #else
wolfSSL 11:cee25a834751 6037 cert->ca = GetCA(cm, cert->issuerHash);
wolfSSL 11:cee25a834751 6038 #endif /* !NO_SKID */
wolfSSL 11:cee25a834751 6039
wolfSSL 11:cee25a834751 6040 WOLFSSL_MSG("About to verify certificate signature");
wolfSSL 11:cee25a834751 6041 if (cert->ca) {
wolfSSL 11:cee25a834751 6042 if (cert->isCA) {
wolfSSL 11:cee25a834751 6043 if (cert->ca->pathLengthSet) {
wolfSSL 11:cee25a834751 6044 if (cert->ca->pathLength == 0) {
wolfSSL 11:cee25a834751 6045 WOLFSSL_MSG("CA with path length 0 signing a CA");
wolfSSL 11:cee25a834751 6046 return ASN_PATHLEN_INV_E;
wolfSSL 11:cee25a834751 6047 }
wolfSSL 11:cee25a834751 6048 if (cert->pathLengthSet &&
wolfSSL 11:cee25a834751 6049 cert->pathLength >= cert->ca->pathLength) {
wolfSSL 11:cee25a834751 6050
wolfSSL 11:cee25a834751 6051 WOLFSSL_MSG("CA signing CA with longer path length");
wolfSSL 11:cee25a834751 6052 return ASN_PATHLEN_INV_E;
wolfSSL 11:cee25a834751 6053 }
wolfSSL 11:cee25a834751 6054 }
wolfSSL 11:cee25a834751 6055 }
wolfSSL 11:cee25a834751 6056
wolfSSL 11:cee25a834751 6057 #ifdef HAVE_OCSP
wolfSSL 11:cee25a834751 6058 /* Need the CA's public key hash for OCSP */
wolfSSL 11:cee25a834751 6059 #ifdef NO_SHA
wolfSSL 11:cee25a834751 6060 ret = wc_Sha256Hash(cert->ca->publicKey, cert->ca->pubKeySize,
wolfSSL 11:cee25a834751 6061 cert->issuerKeyHash);
wolfSSL 11:cee25a834751 6062 #else
wolfSSL 11:cee25a834751 6063 ret = wc_ShaHash(cert->ca->publicKey, cert->ca->pubKeySize,
wolfSSL 11:cee25a834751 6064 cert->issuerKeyHash);
wolfSSL 11:cee25a834751 6065 #endif /* NO_SHA */
wolfSSL 11:cee25a834751 6066 if (ret != 0)
wolfSSL 11:cee25a834751 6067 return ret;
wolfSSL 11:cee25a834751 6068 #endif /* HAVE_OCSP */
wolfSSL 11:cee25a834751 6069 }
wolfSSL 11:cee25a834751 6070 }
wolfSSL 11:cee25a834751 6071 }
wolfSSL 11:cee25a834751 6072
wolfSSL 11:cee25a834751 6073 if (verify != NO_VERIFY && type != CA_TYPE && type != TRUSTED_PEER_TYPE) {
wolfSSL 11:cee25a834751 6074 if (cert->ca) {
wolfSSL 11:cee25a834751 6075 if (verify == VERIFY) {
wolfSSL 11:cee25a834751 6076 /* try to confirm/verify signature */
wolfSSL 11:cee25a834751 6077 if ((ret = ConfirmSignature(&cert->sigCtx,
wolfSSL 11:cee25a834751 6078 cert->source + cert->certBegin,
wolfSSL 11:cee25a834751 6079 cert->sigIndex - cert->certBegin,
wolfSSL 11:cee25a834751 6080 cert->ca->publicKey, cert->ca->pubKeySize,
wolfSSL 11:cee25a834751 6081 cert->ca->keyOID, cert->signature,
wolfSSL 11:cee25a834751 6082 cert->sigLength, cert->signatureOID)) != 0) {
wolfSSL 11:cee25a834751 6083 if (ret != WC_PENDING_E) {
wolfSSL 11:cee25a834751 6084 WOLFSSL_MSG("Confirm signature failed");
wolfSSL 11:cee25a834751 6085 }
wolfSSL 11:cee25a834751 6086 return ret;
wolfSSL 11:cee25a834751 6087 }
wolfSSL 11:cee25a834751 6088 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 6089 /* check that this cert's name is permitted by the signer's
wolfSSL 11:cee25a834751 6090 * name constraints */
wolfSSL 11:cee25a834751 6091 if (!ConfirmNameConstraints(cert->ca, cert)) {
wolfSSL 11:cee25a834751 6092 WOLFSSL_MSG("Confirm name constraint failed");
wolfSSL 11:cee25a834751 6093 return ASN_NAME_INVALID_E;
wolfSSL 11:cee25a834751 6094 }
wolfSSL 11:cee25a834751 6095 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 6096 }
wolfSSL 11:cee25a834751 6097 }
wolfSSL 11:cee25a834751 6098 else {
wolfSSL 11:cee25a834751 6099 /* no signer */
wolfSSL 11:cee25a834751 6100 WOLFSSL_MSG("No CA signer to verify with");
wolfSSL 11:cee25a834751 6101 return ASN_NO_SIGNER_E;
wolfSSL 11:cee25a834751 6102 }
wolfSSL 11:cee25a834751 6103 }
wolfSSL 11:cee25a834751 6104
wolfSSL 11:cee25a834751 6105 if (badDate != 0)
wolfSSL 11:cee25a834751 6106 return badDate;
wolfSSL 11:cee25a834751 6107
wolfSSL 11:cee25a834751 6108 if (criticalExt != 0)
wolfSSL 11:cee25a834751 6109 return criticalExt;
wolfSSL 11:cee25a834751 6110
wolfSSL 11:cee25a834751 6111 return ret;
wolfSSL 11:cee25a834751 6112 }
wolfSSL 11:cee25a834751 6113
wolfSSL 11:cee25a834751 6114 /* Create and init an new signer */
wolfSSL 11:cee25a834751 6115 Signer* MakeSigner(void* heap)
wolfSSL 11:cee25a834751 6116 {
wolfSSL 11:cee25a834751 6117 Signer* signer = (Signer*) XMALLOC(sizeof(Signer), heap,
wolfSSL 11:cee25a834751 6118 DYNAMIC_TYPE_SIGNER);
wolfSSL 11:cee25a834751 6119 if (signer) {
wolfSSL 11:cee25a834751 6120 signer->pubKeySize = 0;
wolfSSL 11:cee25a834751 6121 signer->keyOID = 0;
wolfSSL 11:cee25a834751 6122 signer->publicKey = NULL;
wolfSSL 11:cee25a834751 6123 signer->nameLen = 0;
wolfSSL 11:cee25a834751 6124 signer->name = NULL;
wolfSSL 11:cee25a834751 6125 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 6126 signer->permittedNames = NULL;
wolfSSL 11:cee25a834751 6127 signer->excludedNames = NULL;
wolfSSL 11:cee25a834751 6128 #endif /* IGNORE_NAME_CONSTRAINTS */
wolfSSL 11:cee25a834751 6129 signer->pathLengthSet = 0;
wolfSSL 11:cee25a834751 6130 signer->pathLength = 0;
wolfSSL 11:cee25a834751 6131 signer->next = NULL;
wolfSSL 11:cee25a834751 6132 }
wolfSSL 11:cee25a834751 6133 (void)heap;
wolfSSL 11:cee25a834751 6134
wolfSSL 11:cee25a834751 6135 return signer;
wolfSSL 11:cee25a834751 6136 }
wolfSSL 11:cee25a834751 6137
wolfSSL 11:cee25a834751 6138
wolfSSL 11:cee25a834751 6139 /* Free an individual signer */
wolfSSL 11:cee25a834751 6140 void FreeSigner(Signer* signer, void* heap)
wolfSSL 11:cee25a834751 6141 {
wolfSSL 11:cee25a834751 6142 XFREE(signer->name, heap, DYNAMIC_TYPE_SUBJECT_CN);
wolfSSL 11:cee25a834751 6143 XFREE(signer->publicKey, heap, DYNAMIC_TYPE_PUBLIC_KEY);
wolfSSL 11:cee25a834751 6144 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 6145 if (signer->permittedNames)
wolfSSL 11:cee25a834751 6146 FreeNameSubtrees(signer->permittedNames, heap);
wolfSSL 11:cee25a834751 6147 if (signer->excludedNames)
wolfSSL 11:cee25a834751 6148 FreeNameSubtrees(signer->excludedNames, heap);
wolfSSL 11:cee25a834751 6149 #endif
wolfSSL 11:cee25a834751 6150 XFREE(signer, heap, DYNAMIC_TYPE_SIGNER);
wolfSSL 11:cee25a834751 6151
wolfSSL 11:cee25a834751 6152 (void)heap;
wolfSSL 11:cee25a834751 6153 }
wolfSSL 11:cee25a834751 6154
wolfSSL 11:cee25a834751 6155
wolfSSL 11:cee25a834751 6156 /* Free the whole singer table with number of rows */
wolfSSL 11:cee25a834751 6157 void FreeSignerTable(Signer** table, int rows, void* heap)
wolfSSL 11:cee25a834751 6158 {
wolfSSL 11:cee25a834751 6159 int i;
wolfSSL 11:cee25a834751 6160
wolfSSL 11:cee25a834751 6161 for (i = 0; i < rows; i++) {
wolfSSL 11:cee25a834751 6162 Signer* signer = table[i];
wolfSSL 11:cee25a834751 6163 while (signer) {
wolfSSL 11:cee25a834751 6164 Signer* next = signer->next;
wolfSSL 11:cee25a834751 6165 FreeSigner(signer, heap);
wolfSSL 11:cee25a834751 6166 signer = next;
wolfSSL 11:cee25a834751 6167 }
wolfSSL 11:cee25a834751 6168 table[i] = NULL;
wolfSSL 11:cee25a834751 6169 }
wolfSSL 11:cee25a834751 6170 }
wolfSSL 11:cee25a834751 6171
wolfSSL 11:cee25a834751 6172 #ifdef WOLFSSL_TRUST_PEER_CERT
wolfSSL 11:cee25a834751 6173 /* Free an individual trusted peer cert */
wolfSSL 11:cee25a834751 6174 void FreeTrustedPeer(TrustedPeerCert* tp, void* heap)
wolfSSL 11:cee25a834751 6175 {
wolfSSL 11:cee25a834751 6176 if (tp == NULL) {
wolfSSL 11:cee25a834751 6177 return;
wolfSSL 11:cee25a834751 6178 }
wolfSSL 11:cee25a834751 6179
wolfSSL 11:cee25a834751 6180 if (tp->name) {
wolfSSL 11:cee25a834751 6181 XFREE(tp->name, heap, DYNAMIC_TYPE_SUBJECT_CN);
wolfSSL 11:cee25a834751 6182 }
wolfSSL 11:cee25a834751 6183
wolfSSL 11:cee25a834751 6184 if (tp->sig) {
wolfSSL 11:cee25a834751 6185 XFREE(tp->sig, heap, DYNAMIC_TYPE_SIGNATURE);
wolfSSL 11:cee25a834751 6186 }
wolfSSL 11:cee25a834751 6187 #ifndef IGNORE_NAME_CONSTRAINTS
wolfSSL 11:cee25a834751 6188 if (tp->permittedNames)
wolfSSL 11:cee25a834751 6189 FreeNameSubtrees(tp->permittedNames, heap);
wolfSSL 11:cee25a834751 6190 if (tp->excludedNames)
wolfSSL 11:cee25a834751 6191 FreeNameSubtrees(tp->excludedNames, heap);
wolfSSL 11:cee25a834751 6192 #endif
wolfSSL 11:cee25a834751 6193 XFREE(tp, heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 6194
wolfSSL 11:cee25a834751 6195 (void)heap;
wolfSSL 11:cee25a834751 6196 }
wolfSSL 11:cee25a834751 6197
wolfSSL 11:cee25a834751 6198 /* Free the whole Trusted Peer linked list */
wolfSSL 11:cee25a834751 6199 void FreeTrustedPeerTable(TrustedPeerCert** table, int rows, void* heap)
wolfSSL 11:cee25a834751 6200 {
wolfSSL 11:cee25a834751 6201 int i;
wolfSSL 11:cee25a834751 6202
wolfSSL 11:cee25a834751 6203 for (i = 0; i < rows; i++) {
wolfSSL 11:cee25a834751 6204 TrustedPeerCert* tp = table[i];
wolfSSL 11:cee25a834751 6205 while (tp) {
wolfSSL 11:cee25a834751 6206 TrustedPeerCert* next = tp->next;
wolfSSL 11:cee25a834751 6207 FreeTrustedPeer(tp, heap);
wolfSSL 11:cee25a834751 6208 tp = next;
wolfSSL 11:cee25a834751 6209 }
wolfSSL 11:cee25a834751 6210 table[i] = NULL;
wolfSSL 11:cee25a834751 6211 }
wolfSSL 11:cee25a834751 6212 }
wolfSSL 11:cee25a834751 6213 #endif /* WOLFSSL_TRUST_PEER_CERT */
wolfSSL 11:cee25a834751 6214
wolfSSL 11:cee25a834751 6215 WOLFSSL_LOCAL int SetMyVersion(word32 version, byte* output, int header)
wolfSSL 11:cee25a834751 6216 {
wolfSSL 11:cee25a834751 6217 int i = 0;
wolfSSL 11:cee25a834751 6218
wolfSSL 11:cee25a834751 6219 if (output == NULL)
wolfSSL 11:cee25a834751 6220 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6221
wolfSSL 11:cee25a834751 6222 if (header) {
wolfSSL 11:cee25a834751 6223 output[i++] = ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED;
wolfSSL 11:cee25a834751 6224 output[i++] = 3;
wolfSSL 11:cee25a834751 6225 }
wolfSSL 11:cee25a834751 6226 output[i++] = ASN_INTEGER;
wolfSSL 11:cee25a834751 6227 output[i++] = 0x01;
wolfSSL 11:cee25a834751 6228 output[i++] = (byte)version;
wolfSSL 11:cee25a834751 6229
wolfSSL 11:cee25a834751 6230 return i;
wolfSSL 11:cee25a834751 6231 }
wolfSSL 11:cee25a834751 6232
wolfSSL 11:cee25a834751 6233
wolfSSL 11:cee25a834751 6234 WOLFSSL_LOCAL int SetSerialNumber(const byte* sn, word32 snSz, byte* output)
wolfSSL 11:cee25a834751 6235 {
wolfSSL 11:cee25a834751 6236 int result = 0;
wolfSSL 11:cee25a834751 6237
wolfSSL 11:cee25a834751 6238 WOLFSSL_ENTER("SetSerialNumber");
wolfSSL 11:cee25a834751 6239
wolfSSL 11:cee25a834751 6240 if (sn == NULL || output == NULL)
wolfSSL 11:cee25a834751 6241 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6242
wolfSSL 11:cee25a834751 6243 if (snSz <= EXTERNAL_SERIAL_SIZE) {
wolfSSL 11:cee25a834751 6244 output[0] = ASN_INTEGER;
wolfSSL 11:cee25a834751 6245 /* The serial number is always positive. When encoding the
wolfSSL 11:cee25a834751 6246 * INTEGER, if the MSB is 1, add a padding zero to keep the
wolfSSL 11:cee25a834751 6247 * number positive. */
wolfSSL 11:cee25a834751 6248 if (sn[0] & 0x80) {
wolfSSL 11:cee25a834751 6249 output[1] = (byte)snSz + 1;
wolfSSL 11:cee25a834751 6250 output[2] = 0;
wolfSSL 11:cee25a834751 6251 XMEMCPY(&output[3], sn, snSz);
wolfSSL 11:cee25a834751 6252 result = snSz + 3;
wolfSSL 11:cee25a834751 6253 }
wolfSSL 11:cee25a834751 6254 else {
wolfSSL 11:cee25a834751 6255 output[1] = (byte)snSz;
wolfSSL 11:cee25a834751 6256 XMEMCPY(&output[2], sn, snSz);
wolfSSL 11:cee25a834751 6257 result = snSz + 2;
wolfSSL 11:cee25a834751 6258 }
wolfSSL 11:cee25a834751 6259 }
wolfSSL 11:cee25a834751 6260 return result;
wolfSSL 11:cee25a834751 6261 }
wolfSSL 11:cee25a834751 6262
wolfSSL 11:cee25a834751 6263 WOLFSSL_LOCAL int GetSerialNumber(const byte* input, word32* inOutIdx,
wolfSSL 11:cee25a834751 6264 byte* serial, int* serialSz, word32 maxIdx)
wolfSSL 11:cee25a834751 6265 {
wolfSSL 11:cee25a834751 6266 int result = 0;
wolfSSL 11:cee25a834751 6267 int ret;
wolfSSL 11:cee25a834751 6268
wolfSSL 11:cee25a834751 6269 WOLFSSL_ENTER("GetSerialNumber");
wolfSSL 11:cee25a834751 6270
wolfSSL 11:cee25a834751 6271 if (serial == NULL || input == NULL || serialSz == NULL) {
wolfSSL 11:cee25a834751 6272 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6273 }
wolfSSL 11:cee25a834751 6274
wolfSSL 11:cee25a834751 6275 /* First byte is ASN type */
wolfSSL 11:cee25a834751 6276 if ((*inOutIdx+1) > maxIdx) {
wolfSSL 11:cee25a834751 6277 WOLFSSL_MSG("Bad idx first");
wolfSSL 11:cee25a834751 6278 return BUFFER_E;
wolfSSL 11:cee25a834751 6279 }
wolfSSL 11:cee25a834751 6280
wolfSSL 11:cee25a834751 6281 ret = GetASNInt(input, inOutIdx, serialSz, maxIdx);
wolfSSL 11:cee25a834751 6282 if (ret != 0)
wolfSSL 11:cee25a834751 6283 return ret;
wolfSSL 11:cee25a834751 6284
wolfSSL 11:cee25a834751 6285 if (*serialSz > EXTERNAL_SERIAL_SIZE) {
wolfSSL 11:cee25a834751 6286 WOLFSSL_MSG("Serial size bad");
wolfSSL 11:cee25a834751 6287 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 6288 }
wolfSSL 11:cee25a834751 6289
wolfSSL 11:cee25a834751 6290 /* return serial */
wolfSSL 11:cee25a834751 6291 XMEMCPY(serial, &input[*inOutIdx], *serialSz);
wolfSSL 11:cee25a834751 6292 *inOutIdx += *serialSz;
wolfSSL 11:cee25a834751 6293
wolfSSL 11:cee25a834751 6294 return result;
wolfSSL 11:cee25a834751 6295 }
wolfSSL 11:cee25a834751 6296
wolfSSL 11:cee25a834751 6297
wolfSSL 11:cee25a834751 6298
wolfSSL 11:cee25a834751 6299 const char* BEGIN_CERT = "-----BEGIN CERTIFICATE-----";
wolfSSL 11:cee25a834751 6300 const char* END_CERT = "-----END CERTIFICATE-----";
wolfSSL 11:cee25a834751 6301 const char* BEGIN_CERT_REQ = "-----BEGIN CERTIFICATE REQUEST-----";
wolfSSL 11:cee25a834751 6302 const char* END_CERT_REQ = "-----END CERTIFICATE REQUEST-----";
wolfSSL 11:cee25a834751 6303 const char* BEGIN_DH_PARAM = "-----BEGIN DH PARAMETERS-----";
wolfSSL 11:cee25a834751 6304 const char* END_DH_PARAM = "-----END DH PARAMETERS-----";
wolfSSL 11:cee25a834751 6305 const char* BEGIN_DSA_PARAM = "-----BEGIN DSA PARAMETERS-----";
wolfSSL 11:cee25a834751 6306 const char* END_DSA_PARAM = "-----END DSA PARAMETERS-----";
wolfSSL 11:cee25a834751 6307 const char* BEGIN_X509_CRL = "-----BEGIN X509 CRL-----";
wolfSSL 11:cee25a834751 6308 const char* END_X509_CRL = "-----END X509 CRL-----";
wolfSSL 11:cee25a834751 6309 const char* BEGIN_RSA_PRIV = "-----BEGIN RSA PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6310 const char* END_RSA_PRIV = "-----END RSA PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6311 const char* BEGIN_PRIV_KEY = "-----BEGIN PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6312 const char* END_PRIV_KEY = "-----END PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6313 const char* BEGIN_ENC_PRIV_KEY = "-----BEGIN ENCRYPTED PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6314 const char* END_ENC_PRIV_KEY = "-----END ENCRYPTED PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6315 const char* BEGIN_EC_PRIV = "-----BEGIN EC PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6316 const char* END_EC_PRIV = "-----END EC PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6317 const char* BEGIN_DSA_PRIV = "-----BEGIN DSA PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6318 const char* END_DSA_PRIV = "-----END DSA PRIVATE KEY-----";
wolfSSL 11:cee25a834751 6319 const char* BEGIN_PUB_KEY = "-----BEGIN PUBLIC KEY-----";
wolfSSL 11:cee25a834751 6320 const char* END_PUB_KEY = "-----END PUBLIC KEY-----";
wolfSSL 11:cee25a834751 6321
wolfSSL 11:cee25a834751 6322 #if defined(WOLFSSL_KEY_GEN) || defined(WOLFSSL_CERT_GEN) || defined(OPENSSL_EXTRA)
wolfSSL 11:cee25a834751 6323
wolfSSL 11:cee25a834751 6324 /* Used for compatibility API */
wolfSSL 11:cee25a834751 6325 int wc_DerToPem(const byte* der, word32 derSz,
wolfSSL 11:cee25a834751 6326 byte* output, word32 outSz, int type)
wolfSSL 11:cee25a834751 6327 {
wolfSSL 11:cee25a834751 6328 return wc_DerToPemEx(der, derSz, output, outSz, NULL, type);
wolfSSL 11:cee25a834751 6329 }
wolfSSL 11:cee25a834751 6330
wolfSSL 11:cee25a834751 6331 /* convert der buffer to pem into output, can't do inplace, der and output
wolfSSL 11:cee25a834751 6332 need to be different */
wolfSSL 11:cee25a834751 6333 int wc_DerToPemEx(const byte* der, word32 derSz, byte* output, word32 outSz,
wolfSSL 11:cee25a834751 6334 byte *cipher_info, int type)
wolfSSL 11:cee25a834751 6335 {
wolfSSL 11:cee25a834751 6336 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6337 char* header = NULL;
wolfSSL 11:cee25a834751 6338 char* footer = NULL;
wolfSSL 11:cee25a834751 6339 #else
wolfSSL 11:cee25a834751 6340 char header[40 + HEADER_ENCRYPTED_KEY_SIZE];
wolfSSL 11:cee25a834751 6341 char footer[40];
wolfSSL 11:cee25a834751 6342 #endif
wolfSSL 11:cee25a834751 6343
wolfSSL 11:cee25a834751 6344 int headerLen = 40 + HEADER_ENCRYPTED_KEY_SIZE;
wolfSSL 11:cee25a834751 6345 int footerLen = 40;
wolfSSL 11:cee25a834751 6346 int i;
wolfSSL 11:cee25a834751 6347 int err;
wolfSSL 11:cee25a834751 6348 int outLen; /* return length or error */
wolfSSL 11:cee25a834751 6349
wolfSSL 11:cee25a834751 6350 if (der == output) /* no in place conversion */
wolfSSL 11:cee25a834751 6351 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6352
wolfSSL 11:cee25a834751 6353 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6354 header = (char*)XMALLOC(headerLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6355 if (header == NULL)
wolfSSL 11:cee25a834751 6356 return MEMORY_E;
wolfSSL 11:cee25a834751 6357
wolfSSL 11:cee25a834751 6358 footer = (char*)XMALLOC(footerLen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6359 if (footer == NULL) {
wolfSSL 11:cee25a834751 6360 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6361 return MEMORY_E;
wolfSSL 11:cee25a834751 6362 }
wolfSSL 11:cee25a834751 6363 #endif
wolfSSL 11:cee25a834751 6364 if (type == CERT_TYPE) {
wolfSSL 11:cee25a834751 6365 XSTRNCPY(header, BEGIN_CERT, headerLen);
wolfSSL 11:cee25a834751 6366 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6367
wolfSSL 11:cee25a834751 6368 XSTRNCPY(footer, END_CERT, footerLen);
wolfSSL 11:cee25a834751 6369 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6370 }
wolfSSL 11:cee25a834751 6371 else if (type == PRIVATEKEY_TYPE) {
wolfSSL 11:cee25a834751 6372 XSTRNCPY(header, BEGIN_RSA_PRIV, headerLen);
wolfSSL 11:cee25a834751 6373 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6374
wolfSSL 11:cee25a834751 6375 XSTRNCPY(footer, END_RSA_PRIV, footerLen);
wolfSSL 11:cee25a834751 6376 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6377 }
wolfSSL 11:cee25a834751 6378 #ifndef NO_DSA
wolfSSL 11:cee25a834751 6379 else if (type == DSA_PRIVATEKEY_TYPE) {
wolfSSL 11:cee25a834751 6380 XSTRNCPY(header, BEGIN_DSA_PRIV, headerLen);
wolfSSL 11:cee25a834751 6381 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6382
wolfSSL 11:cee25a834751 6383 XSTRNCPY(footer, END_DSA_PRIV, footerLen);
wolfSSL 11:cee25a834751 6384 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6385 }
wolfSSL 11:cee25a834751 6386 #endif
wolfSSL 11:cee25a834751 6387 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 6388 else if (type == ECC_PRIVATEKEY_TYPE) {
wolfSSL 11:cee25a834751 6389 XSTRNCPY(header, BEGIN_EC_PRIV, headerLen);
wolfSSL 11:cee25a834751 6390 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6391
wolfSSL 11:cee25a834751 6392 XSTRNCPY(footer, END_EC_PRIV, footerLen);
wolfSSL 11:cee25a834751 6393 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6394 }
wolfSSL 11:cee25a834751 6395 #endif
wolfSSL 11:cee25a834751 6396 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 6397 else if (type == CERTREQ_TYPE)
wolfSSL 11:cee25a834751 6398 {
wolfSSL 11:cee25a834751 6399 XSTRNCPY(header, BEGIN_CERT_REQ, headerLen);
wolfSSL 11:cee25a834751 6400 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6401
wolfSSL 11:cee25a834751 6402 XSTRNCPY(footer, END_CERT_REQ, footerLen);
wolfSSL 11:cee25a834751 6403 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6404 }
wolfSSL 11:cee25a834751 6405 #endif
wolfSSL 11:cee25a834751 6406 #ifdef HAVE_CRL
wolfSSL 11:cee25a834751 6407 else if (type == CRL_TYPE)
wolfSSL 11:cee25a834751 6408 {
wolfSSL 11:cee25a834751 6409 XSTRNCPY(header, BEGIN_X509_CRL, headerLen);
wolfSSL 11:cee25a834751 6410 XSTRNCAT(header, "\n", 1);
wolfSSL 11:cee25a834751 6411
wolfSSL 11:cee25a834751 6412 XSTRNCPY(footer, END_X509_CRL, footerLen);
wolfSSL 11:cee25a834751 6413 XSTRNCAT(footer, "\n", 1);
wolfSSL 11:cee25a834751 6414 }
wolfSSL 11:cee25a834751 6415 #endif
wolfSSL 11:cee25a834751 6416 else {
wolfSSL 11:cee25a834751 6417 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6418 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6419 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6420 #endif
wolfSSL 11:cee25a834751 6421 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6422 }
wolfSSL 11:cee25a834751 6423
wolfSSL 11:cee25a834751 6424 /* extra header information for encrypted key */
wolfSSL 11:cee25a834751 6425 if (cipher_info != NULL) {
wolfSSL 11:cee25a834751 6426 size_t cipherInfoStrLen = XSTRLEN((char*)cipher_info);
wolfSSL 11:cee25a834751 6427 if (cipherInfoStrLen > HEADER_ENCRYPTED_KEY_SIZE - (23+10+2))
wolfSSL 11:cee25a834751 6428 cipherInfoStrLen = HEADER_ENCRYPTED_KEY_SIZE - (23+10+2);
wolfSSL 11:cee25a834751 6429
wolfSSL 11:cee25a834751 6430 XSTRNCAT(header, "Proc-Type: 4,ENCRYPTED\n", 23);
wolfSSL 11:cee25a834751 6431 XSTRNCAT(header, "DEK-Info: ", 10);
wolfSSL 11:cee25a834751 6432 XSTRNCAT(header, (char*)cipher_info, cipherInfoStrLen);
wolfSSL 11:cee25a834751 6433 XSTRNCAT(header, "\n\n", 2);
wolfSSL 11:cee25a834751 6434 }
wolfSSL 11:cee25a834751 6435
wolfSSL 11:cee25a834751 6436 headerLen = (int)XSTRLEN(header);
wolfSSL 11:cee25a834751 6437 footerLen = (int)XSTRLEN(footer);
wolfSSL 11:cee25a834751 6438
wolfSSL 11:cee25a834751 6439 /* if null output and 0 size passed in then return size needed */
wolfSSL 11:cee25a834751 6440 if (!output && outSz == 0) {
wolfSSL 11:cee25a834751 6441 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6442 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6443 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6444 #endif
wolfSSL 11:cee25a834751 6445 outLen = 0;
wolfSSL 11:cee25a834751 6446 if ((err = Base64_Encode(der, derSz, NULL, (word32*)&outLen))
wolfSSL 11:cee25a834751 6447 != LENGTH_ONLY_E) {
wolfSSL 11:cee25a834751 6448 return err;
wolfSSL 11:cee25a834751 6449 }
wolfSSL 11:cee25a834751 6450 return headerLen + footerLen + outLen;
wolfSSL 11:cee25a834751 6451 }
wolfSSL 11:cee25a834751 6452
wolfSSL 11:cee25a834751 6453 if (!der || !output) {
wolfSSL 11:cee25a834751 6454 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6455 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6456 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6457 #endif
wolfSSL 11:cee25a834751 6458 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6459 }
wolfSSL 11:cee25a834751 6460
wolfSSL 11:cee25a834751 6461 /* don't even try if outSz too short */
wolfSSL 11:cee25a834751 6462 if (outSz < headerLen + footerLen + derSz) {
wolfSSL 11:cee25a834751 6463 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6464 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6465 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6466 #endif
wolfSSL 11:cee25a834751 6467 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6468 }
wolfSSL 11:cee25a834751 6469
wolfSSL 11:cee25a834751 6470 /* header */
wolfSSL 11:cee25a834751 6471 XMEMCPY(output, header, headerLen);
wolfSSL 11:cee25a834751 6472 i = headerLen;
wolfSSL 11:cee25a834751 6473
wolfSSL 11:cee25a834751 6474 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6475 XFREE(header, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6476 #endif
wolfSSL 11:cee25a834751 6477
wolfSSL 11:cee25a834751 6478 /* body */
wolfSSL 11:cee25a834751 6479 outLen = outSz - (headerLen + footerLen); /* input to Base64_Encode */
wolfSSL 11:cee25a834751 6480 if ( (err = Base64_Encode(der, derSz, output + i, (word32*)&outLen)) < 0) {
wolfSSL 11:cee25a834751 6481 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6482 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6483 #endif
wolfSSL 11:cee25a834751 6484 return err;
wolfSSL 11:cee25a834751 6485 }
wolfSSL 11:cee25a834751 6486 i += outLen;
wolfSSL 11:cee25a834751 6487
wolfSSL 11:cee25a834751 6488 /* footer */
wolfSSL 11:cee25a834751 6489 if ( (i + footerLen) > (int)outSz) {
wolfSSL 11:cee25a834751 6490 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6491 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6492 #endif
wolfSSL 11:cee25a834751 6493 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6494 }
wolfSSL 11:cee25a834751 6495 XMEMCPY(output + i, footer, footerLen);
wolfSSL 11:cee25a834751 6496
wolfSSL 11:cee25a834751 6497 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6498 XFREE(footer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6499 #endif
wolfSSL 11:cee25a834751 6500
wolfSSL 11:cee25a834751 6501 return outLen + headerLen + footerLen;
wolfSSL 11:cee25a834751 6502 }
wolfSSL 11:cee25a834751 6503
wolfSSL 11:cee25a834751 6504 #endif /* WOLFSSL_KEY_GEN || WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 6505
wolfSSL 11:cee25a834751 6506 #if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || (defined(WOLFSSL_KEY_GEN) && !defined(HAVE_USER_RSA)))
wolfSSL 11:cee25a834751 6507 /* USER RSA ifdef portions used instead of refactor in consideration for
wolfSSL 11:cee25a834751 6508 possible fips build */
wolfSSL 11:cee25a834751 6509 /* Write a public RSA key to output */
wolfSSL 11:cee25a834751 6510 static int SetRsaPublicKey(byte* output, RsaKey* key,
wolfSSL 11:cee25a834751 6511 int outLen, int with_header)
wolfSSL 11:cee25a834751 6512 {
wolfSSL 11:cee25a834751 6513 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6514 byte* n = NULL;
wolfSSL 11:cee25a834751 6515 byte* e = NULL;
wolfSSL 11:cee25a834751 6516 #else
wolfSSL 11:cee25a834751 6517 byte n[MAX_RSA_INT_SZ];
wolfSSL 11:cee25a834751 6518 byte e[MAX_RSA_E_SZ];
wolfSSL 11:cee25a834751 6519 #endif
wolfSSL 11:cee25a834751 6520 byte seq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 6521 byte bitString[1 + MAX_LENGTH_SZ + 1];
wolfSSL 11:cee25a834751 6522 int nSz;
wolfSSL 11:cee25a834751 6523 int eSz;
wolfSSL 11:cee25a834751 6524 int seqSz;
wolfSSL 11:cee25a834751 6525 int bitStringSz;
wolfSSL 11:cee25a834751 6526 int idx;
wolfSSL 11:cee25a834751 6527
wolfSSL 11:cee25a834751 6528 if (output == NULL || key == NULL || outLen < MAX_SEQ_SZ)
wolfSSL 11:cee25a834751 6529 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6530
wolfSSL 11:cee25a834751 6531 /* n */
wolfSSL 11:cee25a834751 6532 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6533 n = (byte*)XMALLOC(MAX_RSA_INT_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6534 if (n == NULL)
wolfSSL 11:cee25a834751 6535 return MEMORY_E;
wolfSSL 11:cee25a834751 6536 #endif
wolfSSL 11:cee25a834751 6537
wolfSSL 11:cee25a834751 6538 #ifdef HAVE_USER_RSA
wolfSSL 11:cee25a834751 6539 nSz = SetASNIntRSA(key->n, n);
wolfSSL 11:cee25a834751 6540 #else
wolfSSL 11:cee25a834751 6541 nSz = SetASNIntMP(&key->n, MAX_RSA_INT_SZ, n);
wolfSSL 11:cee25a834751 6542 #endif
wolfSSL 11:cee25a834751 6543 if (nSz < 0) {
wolfSSL 11:cee25a834751 6544 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6545 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6546 #endif
wolfSSL 11:cee25a834751 6547 return nSz;
wolfSSL 11:cee25a834751 6548 }
wolfSSL 11:cee25a834751 6549
wolfSSL 11:cee25a834751 6550 /* e */
wolfSSL 11:cee25a834751 6551 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6552 e = (byte*)XMALLOC(MAX_RSA_E_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6553 if (e == NULL) {
wolfSSL 11:cee25a834751 6554 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6555 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6556 #endif
wolfSSL 11:cee25a834751 6557 return MEMORY_E;
wolfSSL 11:cee25a834751 6558 }
wolfSSL 11:cee25a834751 6559 #endif
wolfSSL 11:cee25a834751 6560
wolfSSL 11:cee25a834751 6561 #ifdef HAVE_USER_RSA
wolfSSL 11:cee25a834751 6562 eSz = SetASNIntRSA(key->e, e);
wolfSSL 11:cee25a834751 6563 #else
wolfSSL 11:cee25a834751 6564 eSz = SetASNIntMP(&key->e, MAX_RSA_INT_SZ, e);
wolfSSL 11:cee25a834751 6565 #endif
wolfSSL 11:cee25a834751 6566 if (eSz < 0) {
wolfSSL 11:cee25a834751 6567 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6568 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6569 XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6570 #endif
wolfSSL 11:cee25a834751 6571 return eSz;
wolfSSL 11:cee25a834751 6572 }
wolfSSL 11:cee25a834751 6573
wolfSSL 11:cee25a834751 6574 seqSz = SetSequence(nSz + eSz, seq);
wolfSSL 11:cee25a834751 6575
wolfSSL 11:cee25a834751 6576 /* check output size */
wolfSSL 11:cee25a834751 6577 if ( (seqSz + nSz + eSz) > outLen) {
wolfSSL 11:cee25a834751 6578 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6579 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6580 XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6581 #endif
wolfSSL 11:cee25a834751 6582 return BUFFER_E;
wolfSSL 11:cee25a834751 6583 }
wolfSSL 11:cee25a834751 6584
wolfSSL 11:cee25a834751 6585 /* headers */
wolfSSL 11:cee25a834751 6586 if (with_header) {
wolfSSL 11:cee25a834751 6587 int algoSz;
wolfSSL 11:cee25a834751 6588 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6589 byte* algo = NULL;
wolfSSL 11:cee25a834751 6590
wolfSSL 11:cee25a834751 6591 algo = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6592 if (algo == NULL) {
wolfSSL 11:cee25a834751 6593 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6594 XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6595 return MEMORY_E;
wolfSSL 11:cee25a834751 6596 }
wolfSSL 11:cee25a834751 6597 #else
wolfSSL 11:cee25a834751 6598 byte algo[MAX_ALGO_SZ];
wolfSSL 11:cee25a834751 6599 #endif
wolfSSL 11:cee25a834751 6600 algoSz = SetAlgoID(RSAk, algo, oidKeyType, 0);
wolfSSL 11:cee25a834751 6601 bitStringSz = SetBitString(seqSz + nSz + eSz, 0, bitString);
wolfSSL 11:cee25a834751 6602
wolfSSL 11:cee25a834751 6603 idx = SetSequence(nSz + eSz + seqSz + bitStringSz + algoSz, output);
wolfSSL 11:cee25a834751 6604
wolfSSL 11:cee25a834751 6605 /* check output size */
wolfSSL 11:cee25a834751 6606 if ( (idx + algoSz + bitStringSz + seqSz + nSz + eSz) > outLen) {
wolfSSL 11:cee25a834751 6607 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6608 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6609 XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6610 XFREE(algo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6611 #endif
wolfSSL 11:cee25a834751 6612
wolfSSL 11:cee25a834751 6613 return BUFFER_E;
wolfSSL 11:cee25a834751 6614 }
wolfSSL 11:cee25a834751 6615
wolfSSL 11:cee25a834751 6616 /* algo */
wolfSSL 11:cee25a834751 6617 XMEMCPY(output + idx, algo, algoSz);
wolfSSL 11:cee25a834751 6618 idx += algoSz;
wolfSSL 11:cee25a834751 6619 /* bit string */
wolfSSL 11:cee25a834751 6620 XMEMCPY(output + idx, bitString, bitStringSz);
wolfSSL 11:cee25a834751 6621 idx += bitStringSz;
wolfSSL 11:cee25a834751 6622 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6623 XFREE(algo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6624 #endif
wolfSSL 11:cee25a834751 6625 }
wolfSSL 11:cee25a834751 6626 else
wolfSSL 11:cee25a834751 6627 idx = 0;
wolfSSL 11:cee25a834751 6628
wolfSSL 11:cee25a834751 6629 /* seq */
wolfSSL 11:cee25a834751 6630 XMEMCPY(output + idx, seq, seqSz);
wolfSSL 11:cee25a834751 6631 idx += seqSz;
wolfSSL 11:cee25a834751 6632 /* n */
wolfSSL 11:cee25a834751 6633 XMEMCPY(output + idx, n, nSz);
wolfSSL 11:cee25a834751 6634 idx += nSz;
wolfSSL 11:cee25a834751 6635 /* e */
wolfSSL 11:cee25a834751 6636 XMEMCPY(output + idx, e, eSz);
wolfSSL 11:cee25a834751 6637 idx += eSz;
wolfSSL 11:cee25a834751 6638
wolfSSL 11:cee25a834751 6639 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6640 XFREE(n, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6641 XFREE(e, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6642 #endif
wolfSSL 11:cee25a834751 6643
wolfSSL 11:cee25a834751 6644 return idx;
wolfSSL 11:cee25a834751 6645 }
wolfSSL 11:cee25a834751 6646 #endif /* !NO_RSA && (WOLFSSL_CERT_GEN || (WOLFSSL_KEY_GEN &&
wolfSSL 11:cee25a834751 6647 !HAVE_USER_RSA))) */
wolfSSL 11:cee25a834751 6648
wolfSSL 11:cee25a834751 6649
wolfSSL 11:cee25a834751 6650 #if defined(WOLFSSL_KEY_GEN) && !defined(NO_RSA) && !defined(HAVE_USER_RSA)
wolfSSL 11:cee25a834751 6651
wolfSSL 11:cee25a834751 6652
wolfSSL 11:cee25a834751 6653 static mp_int* GetRsaInt(RsaKey* key, int idx)
wolfSSL 11:cee25a834751 6654 {
wolfSSL 11:cee25a834751 6655 if (idx == 0)
wolfSSL 11:cee25a834751 6656 return &key->n;
wolfSSL 11:cee25a834751 6657 if (idx == 1)
wolfSSL 11:cee25a834751 6658 return &key->e;
wolfSSL 11:cee25a834751 6659 if (idx == 2)
wolfSSL 11:cee25a834751 6660 return &key->d;
wolfSSL 11:cee25a834751 6661 if (idx == 3)
wolfSSL 11:cee25a834751 6662 return &key->p;
wolfSSL 11:cee25a834751 6663 if (idx == 4)
wolfSSL 11:cee25a834751 6664 return &key->q;
wolfSSL 11:cee25a834751 6665 if (idx == 5)
wolfSSL 11:cee25a834751 6666 return &key->dP;
wolfSSL 11:cee25a834751 6667 if (idx == 6)
wolfSSL 11:cee25a834751 6668 return &key->dQ;
wolfSSL 11:cee25a834751 6669 if (idx == 7)
wolfSSL 11:cee25a834751 6670 return &key->u;
wolfSSL 11:cee25a834751 6671
wolfSSL 11:cee25a834751 6672 return NULL;
wolfSSL 11:cee25a834751 6673 }
wolfSSL 11:cee25a834751 6674
wolfSSL 11:cee25a834751 6675
wolfSSL 11:cee25a834751 6676 /* Release Tmp RSA resources */
wolfSSL 11:cee25a834751 6677 static INLINE void FreeTmpRsas(byte** tmps, void* heap)
wolfSSL 11:cee25a834751 6678 {
wolfSSL 11:cee25a834751 6679 int i;
wolfSSL 11:cee25a834751 6680
wolfSSL 11:cee25a834751 6681 (void)heap;
wolfSSL 11:cee25a834751 6682
wolfSSL 11:cee25a834751 6683 for (i = 0; i < RSA_INTS; i++)
wolfSSL 11:cee25a834751 6684 XFREE(tmps[i], heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 6685 }
wolfSSL 11:cee25a834751 6686
wolfSSL 11:cee25a834751 6687
wolfSSL 11:cee25a834751 6688 /* Convert RsaKey key to DER format, write to output (inLen), return bytes
wolfSSL 11:cee25a834751 6689 written */
wolfSSL 11:cee25a834751 6690 int wc_RsaKeyToDer(RsaKey* key, byte* output, word32 inLen)
wolfSSL 11:cee25a834751 6691 {
wolfSSL 11:cee25a834751 6692 word32 seqSz, verSz, rawLen, intTotalLen = 0;
wolfSSL 11:cee25a834751 6693 word32 sizes[RSA_INTS];
wolfSSL 11:cee25a834751 6694 int i, j, outLen, ret = 0, mpSz;
wolfSSL 11:cee25a834751 6695
wolfSSL 11:cee25a834751 6696 byte seq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 6697 byte ver[MAX_VERSION_SZ];
wolfSSL 11:cee25a834751 6698 byte* tmps[RSA_INTS];
wolfSSL 11:cee25a834751 6699
wolfSSL 11:cee25a834751 6700 if (!key || !output)
wolfSSL 11:cee25a834751 6701 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6702
wolfSSL 11:cee25a834751 6703 if (key->type != RSA_PRIVATE)
wolfSSL 11:cee25a834751 6704 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6705
wolfSSL 11:cee25a834751 6706 for (i = 0; i < RSA_INTS; i++)
wolfSSL 11:cee25a834751 6707 tmps[i] = NULL;
wolfSSL 11:cee25a834751 6708
wolfSSL 11:cee25a834751 6709 /* write all big ints from key to DER tmps */
wolfSSL 11:cee25a834751 6710 for (i = 0; i < RSA_INTS; i++) {
wolfSSL 11:cee25a834751 6711 mp_int* keyInt = GetRsaInt(key, i);
wolfSSL 11:cee25a834751 6712
wolfSSL 11:cee25a834751 6713 rawLen = mp_unsigned_bin_size(keyInt) + 1;
wolfSSL 11:cee25a834751 6714 tmps[i] = (byte*)XMALLOC(rawLen + MAX_SEQ_SZ, key->heap,
wolfSSL 11:cee25a834751 6715 DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 6716 if (tmps[i] == NULL) {
wolfSSL 11:cee25a834751 6717 ret = MEMORY_E;
wolfSSL 11:cee25a834751 6718 break;
wolfSSL 11:cee25a834751 6719 }
wolfSSL 11:cee25a834751 6720
wolfSSL 11:cee25a834751 6721 mpSz = SetASNIntMP(keyInt, MAX_RSA_INT_SZ, tmps[i]);
wolfSSL 11:cee25a834751 6722 if (mpSz < 0) {
wolfSSL 11:cee25a834751 6723 ret = mpSz;
wolfSSL 11:cee25a834751 6724 break;
wolfSSL 11:cee25a834751 6725 }
wolfSSL 11:cee25a834751 6726 intTotalLen += (sizes[i] = mpSz);
wolfSSL 11:cee25a834751 6727 }
wolfSSL 11:cee25a834751 6728
wolfSSL 11:cee25a834751 6729 if (ret != 0) {
wolfSSL 11:cee25a834751 6730 FreeTmpRsas(tmps, key->heap);
wolfSSL 11:cee25a834751 6731 return ret;
wolfSSL 11:cee25a834751 6732 }
wolfSSL 11:cee25a834751 6733
wolfSSL 11:cee25a834751 6734 /* make headers */
wolfSSL 11:cee25a834751 6735 verSz = SetMyVersion(0, ver, FALSE);
wolfSSL 11:cee25a834751 6736 seqSz = SetSequence(verSz + intTotalLen, seq);
wolfSSL 11:cee25a834751 6737
wolfSSL 11:cee25a834751 6738 outLen = seqSz + verSz + intTotalLen;
wolfSSL 11:cee25a834751 6739 if (outLen > (int)inLen)
wolfSSL 11:cee25a834751 6740 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 6741
wolfSSL 11:cee25a834751 6742 /* write to output */
wolfSSL 11:cee25a834751 6743 XMEMCPY(output, seq, seqSz);
wolfSSL 11:cee25a834751 6744 j = seqSz;
wolfSSL 11:cee25a834751 6745 XMEMCPY(output + j, ver, verSz);
wolfSSL 11:cee25a834751 6746 j += verSz;
wolfSSL 11:cee25a834751 6747
wolfSSL 11:cee25a834751 6748 for (i = 0; i < RSA_INTS; i++) {
wolfSSL 11:cee25a834751 6749 XMEMCPY(output + j, tmps[i], sizes[i]);
wolfSSL 11:cee25a834751 6750 j += sizes[i];
wolfSSL 11:cee25a834751 6751 }
wolfSSL 11:cee25a834751 6752 FreeTmpRsas(tmps, key->heap);
wolfSSL 11:cee25a834751 6753
wolfSSL 11:cee25a834751 6754 return outLen;
wolfSSL 11:cee25a834751 6755 }
wolfSSL 11:cee25a834751 6756
wolfSSL 11:cee25a834751 6757
wolfSSL 11:cee25a834751 6758 /* Convert Rsa Public key to DER format, write to output (inLen), return bytes
wolfSSL 11:cee25a834751 6759 written */
wolfSSL 11:cee25a834751 6760 int wc_RsaKeyToPublicDer(RsaKey* key, byte* output, word32 inLen)
wolfSSL 11:cee25a834751 6761 {
wolfSSL 11:cee25a834751 6762 return SetRsaPublicKey(output, key, inLen, 1);
wolfSSL 11:cee25a834751 6763 }
wolfSSL 11:cee25a834751 6764
wolfSSL 11:cee25a834751 6765 #endif /* WOLFSSL_KEY_GEN && !NO_RSA && !HAVE_USER_RSA */
wolfSSL 11:cee25a834751 6766
wolfSSL 11:cee25a834751 6767
wolfSSL 11:cee25a834751 6768 #if defined(WOLFSSL_CERT_GEN) && !defined(NO_RSA)
wolfSSL 11:cee25a834751 6769
wolfSSL 11:cee25a834751 6770 /* Initialize and Set Certificate defaults:
wolfSSL 11:cee25a834751 6771 version = 3 (0x2)
wolfSSL 11:cee25a834751 6772 serial = 0
wolfSSL 11:cee25a834751 6773 sigType = SHA_WITH_RSA
wolfSSL 11:cee25a834751 6774 issuer = blank
wolfSSL 11:cee25a834751 6775 daysValid = 500
wolfSSL 11:cee25a834751 6776 selfSigned = 1 (true) use subject as issuer
wolfSSL 11:cee25a834751 6777 subject = blank
wolfSSL 11:cee25a834751 6778 */
wolfSSL 11:cee25a834751 6779 void wc_InitCert(Cert* cert)
wolfSSL 11:cee25a834751 6780 {
wolfSSL 11:cee25a834751 6781 cert->version = 2; /* version 3 is hex 2 */
wolfSSL 11:cee25a834751 6782 cert->sigType = CTC_SHAwRSA;
wolfSSL 11:cee25a834751 6783 cert->daysValid = 500;
wolfSSL 11:cee25a834751 6784 cert->selfSigned = 1;
wolfSSL 11:cee25a834751 6785 cert->isCA = 0;
wolfSSL 11:cee25a834751 6786 cert->bodySz = 0;
wolfSSL 11:cee25a834751 6787 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 6788 cert->altNamesSz = 0;
wolfSSL 11:cee25a834751 6789 cert->beforeDateSz = 0;
wolfSSL 11:cee25a834751 6790 cert->afterDateSz = 0;
wolfSSL 11:cee25a834751 6791 #endif
wolfSSL 11:cee25a834751 6792 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 6793 cert->skidSz = 0;
wolfSSL 11:cee25a834751 6794 cert->akidSz = 0;
wolfSSL 11:cee25a834751 6795 cert->keyUsage = 0;
wolfSSL 11:cee25a834751 6796 cert->certPoliciesNb = 0;
wolfSSL 11:cee25a834751 6797 XMEMSET(cert->akid, 0, CTC_MAX_AKID_SIZE);
wolfSSL 11:cee25a834751 6798 XMEMSET(cert->skid, 0, CTC_MAX_SKID_SIZE);
wolfSSL 11:cee25a834751 6799 XMEMSET(cert->certPolicies, 0, CTC_MAX_CERTPOL_NB*CTC_MAX_CERTPOL_SZ);
wolfSSL 11:cee25a834751 6800 #endif
wolfSSL 11:cee25a834751 6801 cert->keyType = RSA_KEY;
wolfSSL 11:cee25a834751 6802 XMEMSET(cert->serial, 0, CTC_SERIAL_SIZE);
wolfSSL 11:cee25a834751 6803
wolfSSL 11:cee25a834751 6804 cert->issuer.country[0] = '\0';
wolfSSL 11:cee25a834751 6805 cert->issuer.countryEnc = CTC_PRINTABLE;
wolfSSL 11:cee25a834751 6806 cert->issuer.state[0] = '\0';
wolfSSL 11:cee25a834751 6807 cert->issuer.stateEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6808 cert->issuer.locality[0] = '\0';
wolfSSL 11:cee25a834751 6809 cert->issuer.localityEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6810 cert->issuer.sur[0] = '\0';
wolfSSL 11:cee25a834751 6811 cert->issuer.surEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6812 cert->issuer.org[0] = '\0';
wolfSSL 11:cee25a834751 6813 cert->issuer.orgEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6814 cert->issuer.unit[0] = '\0';
wolfSSL 11:cee25a834751 6815 cert->issuer.unitEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6816 cert->issuer.commonName[0] = '\0';
wolfSSL 11:cee25a834751 6817 cert->issuer.commonNameEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6818 cert->issuer.email[0] = '\0';
wolfSSL 11:cee25a834751 6819
wolfSSL 11:cee25a834751 6820 cert->subject.country[0] = '\0';
wolfSSL 11:cee25a834751 6821 cert->subject.countryEnc = CTC_PRINTABLE;
wolfSSL 11:cee25a834751 6822 cert->subject.state[0] = '\0';
wolfSSL 11:cee25a834751 6823 cert->subject.stateEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6824 cert->subject.locality[0] = '\0';
wolfSSL 11:cee25a834751 6825 cert->subject.localityEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6826 cert->subject.sur[0] = '\0';
wolfSSL 11:cee25a834751 6827 cert->subject.surEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6828 cert->subject.org[0] = '\0';
wolfSSL 11:cee25a834751 6829 cert->subject.orgEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6830 cert->subject.unit[0] = '\0';
wolfSSL 11:cee25a834751 6831 cert->subject.unitEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6832 cert->subject.commonName[0] = '\0';
wolfSSL 11:cee25a834751 6833 cert->subject.commonNameEnc = CTC_UTF8;
wolfSSL 11:cee25a834751 6834 cert->subject.email[0] = '\0';
wolfSSL 11:cee25a834751 6835
wolfSSL 11:cee25a834751 6836 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 6837 cert->challengePw[0] ='\0';
wolfSSL 11:cee25a834751 6838 #endif
wolfSSL 11:cee25a834751 6839 #ifdef WOLFSSL_HEAP_TEST
wolfSSL 11:cee25a834751 6840 cert->heap = (void*)WOLFSSL_HEAP_TEST;
wolfSSL 11:cee25a834751 6841 #else
wolfSSL 11:cee25a834751 6842 cert->heap = NULL;
wolfSSL 11:cee25a834751 6843 #endif
wolfSSL 11:cee25a834751 6844 }
wolfSSL 11:cee25a834751 6845
wolfSSL 11:cee25a834751 6846
wolfSSL 11:cee25a834751 6847 /* DER encoded x509 Certificate */
wolfSSL 11:cee25a834751 6848 typedef struct DerCert {
wolfSSL 11:cee25a834751 6849 byte size[MAX_LENGTH_SZ]; /* length encoded */
wolfSSL 11:cee25a834751 6850 byte version[MAX_VERSION_SZ]; /* version encoded */
wolfSSL 11:cee25a834751 6851 byte serial[CTC_SERIAL_SIZE + MAX_LENGTH_SZ]; /* serial number encoded */
wolfSSL 11:cee25a834751 6852 byte sigAlgo[MAX_ALGO_SZ]; /* signature algo encoded */
wolfSSL 11:cee25a834751 6853 byte issuer[ASN_NAME_MAX]; /* issuer encoded */
wolfSSL 11:cee25a834751 6854 byte subject[ASN_NAME_MAX]; /* subject encoded */
wolfSSL 11:cee25a834751 6855 byte validity[MAX_DATE_SIZE*2 + MAX_SEQ_SZ*2]; /* before and after dates */
wolfSSL 11:cee25a834751 6856 byte publicKey[MAX_PUBLIC_KEY_SZ]; /* rsa / ntru public key encoded */
wolfSSL 11:cee25a834751 6857 byte ca[MAX_CA_SZ]; /* basic constraint CA true size */
wolfSSL 11:cee25a834751 6858 byte extensions[MAX_EXTENSIONS_SZ]; /* all extensions */
wolfSSL 11:cee25a834751 6859 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 6860 byte skid[MAX_KID_SZ]; /* Subject Key Identifier extension */
wolfSSL 11:cee25a834751 6861 byte akid[MAX_KID_SZ]; /* Authority Key Identifier extension */
wolfSSL 11:cee25a834751 6862 byte keyUsage[MAX_KEYUSAGE_SZ]; /* Key Usage extension */
wolfSSL 11:cee25a834751 6863 byte certPolicies[MAX_CERTPOL_NB*MAX_CERTPOL_SZ]; /* Certificate Policies */
wolfSSL 11:cee25a834751 6864 #endif
wolfSSL 11:cee25a834751 6865 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 6866 byte attrib[MAX_ATTRIB_SZ]; /* Cert req attributes encoded */
wolfSSL 11:cee25a834751 6867 #endif
wolfSSL 11:cee25a834751 6868 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 6869 byte altNames[CTC_MAX_ALT_SIZE]; /* Alternative Names encoded */
wolfSSL 11:cee25a834751 6870 #endif
wolfSSL 11:cee25a834751 6871 int sizeSz; /* encoded size length */
wolfSSL 11:cee25a834751 6872 int versionSz; /* encoded version length */
wolfSSL 11:cee25a834751 6873 int serialSz; /* encoded serial length */
wolfSSL 11:cee25a834751 6874 int sigAlgoSz; /* encoded sig alog length */
wolfSSL 11:cee25a834751 6875 int issuerSz; /* encoded issuer length */
wolfSSL 11:cee25a834751 6876 int subjectSz; /* encoded subject length */
wolfSSL 11:cee25a834751 6877 int validitySz; /* encoded validity length */
wolfSSL 11:cee25a834751 6878 int publicKeySz; /* encoded public key length */
wolfSSL 11:cee25a834751 6879 int caSz; /* encoded CA extension length */
wolfSSL 11:cee25a834751 6880 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 6881 int skidSz; /* encoded SKID extension length */
wolfSSL 11:cee25a834751 6882 int akidSz; /* encoded SKID extension length */
wolfSSL 11:cee25a834751 6883 int keyUsageSz; /* encoded KeyUsage extension length */
wolfSSL 11:cee25a834751 6884 int certPoliciesSz; /* encoded CertPolicies extension length*/
wolfSSL 11:cee25a834751 6885 #endif
wolfSSL 11:cee25a834751 6886 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 6887 int altNamesSz; /* encoded AltNames extension length */
wolfSSL 11:cee25a834751 6888 #endif
wolfSSL 11:cee25a834751 6889 int extensionsSz; /* encoded extensions total length */
wolfSSL 11:cee25a834751 6890 int total; /* total encoded lengths */
wolfSSL 11:cee25a834751 6891 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 6892 int attribSz;
wolfSSL 11:cee25a834751 6893 #endif
wolfSSL 11:cee25a834751 6894 } DerCert;
wolfSSL 11:cee25a834751 6895
wolfSSL 11:cee25a834751 6896
wolfSSL 11:cee25a834751 6897 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 6898
wolfSSL 11:cee25a834751 6899 /* Write a set header to output */
wolfSSL 11:cee25a834751 6900 static word32 SetUTF8String(word32 len, byte* output)
wolfSSL 11:cee25a834751 6901 {
wolfSSL 11:cee25a834751 6902 output[0] = ASN_UTF8STRING;
wolfSSL 11:cee25a834751 6903 return SetLength(len, output + 1) + 1;
wolfSSL 11:cee25a834751 6904 }
wolfSSL 11:cee25a834751 6905
wolfSSL 11:cee25a834751 6906 #endif /* WOLFSSL_CERT_REQ */
wolfSSL 11:cee25a834751 6907
wolfSSL 11:cee25a834751 6908
wolfSSL 11:cee25a834751 6909 /* Write a serial number to output */
wolfSSL 11:cee25a834751 6910 static int SetSerial(const byte* serial, byte* output)
wolfSSL 11:cee25a834751 6911 {
wolfSSL 11:cee25a834751 6912 int length = 0;
wolfSSL 11:cee25a834751 6913
wolfSSL 11:cee25a834751 6914 output[length++] = ASN_INTEGER;
wolfSSL 11:cee25a834751 6915 length += SetLength(CTC_SERIAL_SIZE, &output[length]);
wolfSSL 11:cee25a834751 6916 XMEMCPY(&output[length], serial, CTC_SERIAL_SIZE);
wolfSSL 11:cee25a834751 6917
wolfSSL 11:cee25a834751 6918 return length + CTC_SERIAL_SIZE;
wolfSSL 11:cee25a834751 6919 }
wolfSSL 11:cee25a834751 6920
wolfSSL 11:cee25a834751 6921 #endif /* defined(WOLFSSL_CERT_GEN) && !defined(NO_RSA) */
wolfSSL 11:cee25a834751 6922 #if defined(HAVE_ECC) && (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
wolfSSL 11:cee25a834751 6923
wolfSSL 11:cee25a834751 6924 /* Write a public ECC key to output */
wolfSSL 11:cee25a834751 6925 static int SetEccPublicKey(byte* output, ecc_key* key, int with_header)
wolfSSL 11:cee25a834751 6926 {
wolfSSL 11:cee25a834751 6927 byte bitString[1 + MAX_LENGTH_SZ + 1];
wolfSSL 11:cee25a834751 6928 int algoSz;
wolfSSL 11:cee25a834751 6929 int curveSz;
wolfSSL 11:cee25a834751 6930 int bitStringSz;
wolfSSL 11:cee25a834751 6931 int idx;
wolfSSL 11:cee25a834751 6932 word32 pubSz = ECC_BUFSIZE;
wolfSSL 11:cee25a834751 6933 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6934 byte* algo = NULL;
wolfSSL 11:cee25a834751 6935 byte* curve = NULL;
wolfSSL 11:cee25a834751 6936 byte* pub = NULL;
wolfSSL 11:cee25a834751 6937 #else
wolfSSL 11:cee25a834751 6938 byte algo[MAX_ALGO_SZ];
wolfSSL 11:cee25a834751 6939 byte curve[MAX_ALGO_SZ];
wolfSSL 11:cee25a834751 6940 byte pub[ECC_BUFSIZE];
wolfSSL 11:cee25a834751 6941 #endif
wolfSSL 11:cee25a834751 6942
wolfSSL 11:cee25a834751 6943 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6944 pub = (byte*)XMALLOC(ECC_BUFSIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6945 if (pub == NULL)
wolfSSL 11:cee25a834751 6946 return MEMORY_E;
wolfSSL 11:cee25a834751 6947 #endif
wolfSSL 11:cee25a834751 6948
wolfSSL 11:cee25a834751 6949 int ret = wc_ecc_export_x963(key, pub, &pubSz);
wolfSSL 11:cee25a834751 6950 if (ret != 0) {
wolfSSL 11:cee25a834751 6951 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6952 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6953 #endif
wolfSSL 11:cee25a834751 6954 return ret;
wolfSSL 11:cee25a834751 6955 }
wolfSSL 11:cee25a834751 6956
wolfSSL 11:cee25a834751 6957 /* headers */
wolfSSL 11:cee25a834751 6958 if (with_header) {
wolfSSL 11:cee25a834751 6959 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6960 curve = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6961 if (curve == NULL) {
wolfSSL 11:cee25a834751 6962 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6963 return MEMORY_E;
wolfSSL 11:cee25a834751 6964 }
wolfSSL 11:cee25a834751 6965 #endif
wolfSSL 11:cee25a834751 6966 curveSz = SetCurve(key, curve);
wolfSSL 11:cee25a834751 6967 if (curveSz <= 0) {
wolfSSL 11:cee25a834751 6968 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6969 XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6970 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6971 #endif
wolfSSL 11:cee25a834751 6972 return curveSz;
wolfSSL 11:cee25a834751 6973 }
wolfSSL 11:cee25a834751 6974
wolfSSL 11:cee25a834751 6975 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 6976 algo = (byte*)XMALLOC(MAX_ALGO_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6977 if (algo == NULL) {
wolfSSL 11:cee25a834751 6978 XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6979 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 6980 return MEMORY_E;
wolfSSL 11:cee25a834751 6981 }
wolfSSL 11:cee25a834751 6982 #endif
wolfSSL 11:cee25a834751 6983 algoSz = SetAlgoID(ECDSAk, algo, oidKeyType, curveSz);
wolfSSL 11:cee25a834751 6984
wolfSSL 11:cee25a834751 6985 bitStringSz = SetBitString(pubSz, 0, bitString);
wolfSSL 11:cee25a834751 6986
wolfSSL 11:cee25a834751 6987 idx = SetSequence(pubSz + curveSz + bitStringSz + algoSz, output);
wolfSSL 11:cee25a834751 6988 /* algo */
wolfSSL 11:cee25a834751 6989 XMEMCPY(output + idx, algo, algoSz);
wolfSSL 11:cee25a834751 6990 idx += algoSz;
wolfSSL 11:cee25a834751 6991 /* curve */
wolfSSL 11:cee25a834751 6992 XMEMCPY(output + idx, curve, curveSz);
wolfSSL 11:cee25a834751 6993 idx += curveSz;
wolfSSL 11:cee25a834751 6994 /* bit string */
wolfSSL 11:cee25a834751 6995 XMEMCPY(output + idx, bitString, bitStringSz);
wolfSSL 11:cee25a834751 6996 idx += bitStringSz;
wolfSSL 11:cee25a834751 6997 }
wolfSSL 11:cee25a834751 6998 else
wolfSSL 11:cee25a834751 6999 idx = 0;
wolfSSL 11:cee25a834751 7000
wolfSSL 11:cee25a834751 7001 /* pub */
wolfSSL 11:cee25a834751 7002 XMEMCPY(output + idx, pub, pubSz);
wolfSSL 11:cee25a834751 7003 idx += pubSz;
wolfSSL 11:cee25a834751 7004
wolfSSL 11:cee25a834751 7005 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7006 if (with_header) {
wolfSSL 11:cee25a834751 7007 XFREE(algo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7008 XFREE(curve, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7009 }
wolfSSL 11:cee25a834751 7010 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7011 #endif
wolfSSL 11:cee25a834751 7012
wolfSSL 11:cee25a834751 7013 return idx;
wolfSSL 11:cee25a834751 7014 }
wolfSSL 11:cee25a834751 7015
wolfSSL 11:cee25a834751 7016
wolfSSL 11:cee25a834751 7017 /* returns the size of buffer used, the public ECC key in DER format is stored
wolfSSL 11:cee25a834751 7018 in output buffer
wolfSSL 11:cee25a834751 7019 with_AlgCurve is a flag for when to include a header that has the Algorithm
wolfSSL 11:cee25a834751 7020 and Curve infromation */
wolfSSL 11:cee25a834751 7021 int wc_EccPublicKeyToDer(ecc_key* key, byte* output, word32 inLen,
wolfSSL 11:cee25a834751 7022 int with_AlgCurve)
wolfSSL 11:cee25a834751 7023 {
wolfSSL 11:cee25a834751 7024 word32 infoSz = 0;
wolfSSL 11:cee25a834751 7025 word32 keySz = 0;
wolfSSL 11:cee25a834751 7026 int ret;
wolfSSL 11:cee25a834751 7027
wolfSSL 11:cee25a834751 7028 if (output == NULL || key == NULL) {
wolfSSL 11:cee25a834751 7029 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7030 }
wolfSSL 11:cee25a834751 7031
wolfSSL 11:cee25a834751 7032 if (with_AlgCurve) {
wolfSSL 11:cee25a834751 7033 /* buffer space for algorithm/curve */
wolfSSL 11:cee25a834751 7034 infoSz += MAX_SEQ_SZ;
wolfSSL 11:cee25a834751 7035 infoSz += 2 * MAX_ALGO_SZ;
wolfSSL 11:cee25a834751 7036
wolfSSL 11:cee25a834751 7037 /* buffer space for public key sequence */
wolfSSL 11:cee25a834751 7038 infoSz += MAX_SEQ_SZ;
wolfSSL 11:cee25a834751 7039 infoSz += TRAILING_ZERO;
wolfSSL 11:cee25a834751 7040 }
wolfSSL 11:cee25a834751 7041
wolfSSL 11:cee25a834751 7042 if ((ret = wc_ecc_export_x963(key, NULL, &keySz)) != LENGTH_ONLY_E) {
wolfSSL 11:cee25a834751 7043 WOLFSSL_MSG("Error in getting ECC public key size");
wolfSSL 11:cee25a834751 7044 return ret;
wolfSSL 11:cee25a834751 7045 }
wolfSSL 11:cee25a834751 7046
wolfSSL 11:cee25a834751 7047 if (inLen < keySz + infoSz) {
wolfSSL 11:cee25a834751 7048 return BUFFER_E;
wolfSSL 11:cee25a834751 7049 }
wolfSSL 11:cee25a834751 7050
wolfSSL 11:cee25a834751 7051 return SetEccPublicKey(output, key, with_AlgCurve);
wolfSSL 11:cee25a834751 7052 }
wolfSSL 11:cee25a834751 7053 #endif /* HAVE_ECC && (WOLFSSL_CERT_GEN || WOLFSSL_KEY_GEN) */
wolfSSL 11:cee25a834751 7054 #if defined(WOLFSSL_CERT_GEN) && !defined(NO_RSA)
wolfSSL 11:cee25a834751 7055
wolfSSL 11:cee25a834751 7056 static INLINE byte itob(int number)
wolfSSL 11:cee25a834751 7057 {
wolfSSL 11:cee25a834751 7058 return (byte)number + 0x30;
wolfSSL 11:cee25a834751 7059 }
wolfSSL 11:cee25a834751 7060
wolfSSL 11:cee25a834751 7061
wolfSSL 11:cee25a834751 7062 /* write time to output, format */
wolfSSL 11:cee25a834751 7063 static void SetTime(struct tm* date, byte* output)
wolfSSL 11:cee25a834751 7064 {
wolfSSL 11:cee25a834751 7065 int i = 0;
wolfSSL 11:cee25a834751 7066
wolfSSL 11:cee25a834751 7067 output[i++] = itob((date->tm_year % 10000) / 1000);
wolfSSL 11:cee25a834751 7068 output[i++] = itob((date->tm_year % 1000) / 100);
wolfSSL 11:cee25a834751 7069 output[i++] = itob((date->tm_year % 100) / 10);
wolfSSL 11:cee25a834751 7070 output[i++] = itob( date->tm_year % 10);
wolfSSL 11:cee25a834751 7071
wolfSSL 11:cee25a834751 7072 output[i++] = itob(date->tm_mon / 10);
wolfSSL 11:cee25a834751 7073 output[i++] = itob(date->tm_mon % 10);
wolfSSL 11:cee25a834751 7074
wolfSSL 11:cee25a834751 7075 output[i++] = itob(date->tm_mday / 10);
wolfSSL 11:cee25a834751 7076 output[i++] = itob(date->tm_mday % 10);
wolfSSL 11:cee25a834751 7077
wolfSSL 11:cee25a834751 7078 output[i++] = itob(date->tm_hour / 10);
wolfSSL 11:cee25a834751 7079 output[i++] = itob(date->tm_hour % 10);
wolfSSL 11:cee25a834751 7080
wolfSSL 11:cee25a834751 7081 output[i++] = itob(date->tm_min / 10);
wolfSSL 11:cee25a834751 7082 output[i++] = itob(date->tm_min % 10);
wolfSSL 11:cee25a834751 7083
wolfSSL 11:cee25a834751 7084 output[i++] = itob(date->tm_sec / 10);
wolfSSL 11:cee25a834751 7085 output[i++] = itob(date->tm_sec % 10);
wolfSSL 11:cee25a834751 7086
wolfSSL 11:cee25a834751 7087 output[i] = 'Z'; /* Zulu profile */
wolfSSL 11:cee25a834751 7088 }
wolfSSL 11:cee25a834751 7089
wolfSSL 11:cee25a834751 7090
wolfSSL 11:cee25a834751 7091 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 7092
wolfSSL 11:cee25a834751 7093 /* Copy Dates from cert, return bytes written */
wolfSSL 11:cee25a834751 7094 static int CopyValidity(byte* output, Cert* cert)
wolfSSL 11:cee25a834751 7095 {
wolfSSL 11:cee25a834751 7096 int seqSz;
wolfSSL 11:cee25a834751 7097
wolfSSL 11:cee25a834751 7098 WOLFSSL_ENTER("CopyValidity");
wolfSSL 11:cee25a834751 7099
wolfSSL 11:cee25a834751 7100 /* headers and output */
wolfSSL 11:cee25a834751 7101 seqSz = SetSequence(cert->beforeDateSz + cert->afterDateSz, output);
wolfSSL 11:cee25a834751 7102 XMEMCPY(output + seqSz, cert->beforeDate, cert->beforeDateSz);
wolfSSL 11:cee25a834751 7103 XMEMCPY(output + seqSz + cert->beforeDateSz, cert->afterDate,
wolfSSL 11:cee25a834751 7104 cert->afterDateSz);
wolfSSL 11:cee25a834751 7105 return seqSz + cert->beforeDateSz + cert->afterDateSz;
wolfSSL 11:cee25a834751 7106 }
wolfSSL 11:cee25a834751 7107
wolfSSL 11:cee25a834751 7108 #endif
wolfSSL 11:cee25a834751 7109
wolfSSL 11:cee25a834751 7110
wolfSSL 11:cee25a834751 7111 /* for systems where mktime() doesn't normalize fully */
wolfSSL 11:cee25a834751 7112 static void RebuildTime(time_t* in, struct tm* out)
wolfSSL 11:cee25a834751 7113 {
wolfSSL 11:cee25a834751 7114 #if defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
wolfSSL 11:cee25a834751 7115 out = localtime_r(in, out);
wolfSSL 11:cee25a834751 7116 #else
wolfSSL 11:cee25a834751 7117 (void)in;
wolfSSL 11:cee25a834751 7118 (void)out;
wolfSSL 11:cee25a834751 7119 #endif
wolfSSL 11:cee25a834751 7120 }
wolfSSL 11:cee25a834751 7121
wolfSSL 11:cee25a834751 7122
wolfSSL 11:cee25a834751 7123 /* Set Date validity from now until now + daysValid
wolfSSL 11:cee25a834751 7124 * return size in bytes written to output, 0 on error */
wolfSSL 11:cee25a834751 7125 static int SetValidity(byte* output, int daysValid)
wolfSSL 11:cee25a834751 7126 {
wolfSSL 11:cee25a834751 7127 byte before[MAX_DATE_SIZE];
wolfSSL 11:cee25a834751 7128 byte after[MAX_DATE_SIZE];
wolfSSL 11:cee25a834751 7129
wolfSSL 11:cee25a834751 7130 int beforeSz;
wolfSSL 11:cee25a834751 7131 int afterSz;
wolfSSL 11:cee25a834751 7132 int seqSz;
wolfSSL 11:cee25a834751 7133
wolfSSL 11:cee25a834751 7134 time_t ticks;
wolfSSL 11:cee25a834751 7135 time_t normalTime;
wolfSSL 11:cee25a834751 7136 struct tm* now;
wolfSSL 11:cee25a834751 7137 struct tm* tmpTime = NULL;
wolfSSL 11:cee25a834751 7138 struct tm local;
wolfSSL 11:cee25a834751 7139
wolfSSL 11:cee25a834751 7140 #if defined(NEED_TMP_TIME)
wolfSSL 11:cee25a834751 7141 /* for use with gmtime_r */
wolfSSL 11:cee25a834751 7142 struct tm tmpTimeStorage;
wolfSSL 11:cee25a834751 7143 tmpTime = &tmpTimeStorage;
wolfSSL 11:cee25a834751 7144 #else
wolfSSL 11:cee25a834751 7145 (void)tmpTime;
wolfSSL 11:cee25a834751 7146 #endif
wolfSSL 11:cee25a834751 7147
wolfSSL 11:cee25a834751 7148 ticks = XTIME(0);
wolfSSL 11:cee25a834751 7149 now = XGMTIME(&ticks, tmpTime);
wolfSSL 11:cee25a834751 7150
wolfSSL 11:cee25a834751 7151 if (now == NULL) {
wolfSSL 11:cee25a834751 7152 WOLFSSL_MSG("XGMTIME failed");
wolfSSL 11:cee25a834751 7153 return 0; /* error */
wolfSSL 11:cee25a834751 7154 }
wolfSSL 11:cee25a834751 7155
wolfSSL 11:cee25a834751 7156 /* before now */
wolfSSL 11:cee25a834751 7157 local = *now;
wolfSSL 11:cee25a834751 7158 before[0] = ASN_GENERALIZED_TIME;
wolfSSL 11:cee25a834751 7159 beforeSz = SetLength(ASN_GEN_TIME_SZ, before + 1) + 1; /* gen tag */
wolfSSL 11:cee25a834751 7160
wolfSSL 11:cee25a834751 7161 /* subtract 1 day for more compliance */
wolfSSL 11:cee25a834751 7162 local.tm_mday -= 1;
wolfSSL 11:cee25a834751 7163 normalTime = mktime(&local);
wolfSSL 11:cee25a834751 7164 RebuildTime(&normalTime, &local);
wolfSSL 11:cee25a834751 7165
wolfSSL 11:cee25a834751 7166 /* adjust */
wolfSSL 11:cee25a834751 7167 local.tm_year += 1900;
wolfSSL 11:cee25a834751 7168 local.tm_mon += 1;
wolfSSL 11:cee25a834751 7169
wolfSSL 11:cee25a834751 7170 SetTime(&local, before + beforeSz);
wolfSSL 11:cee25a834751 7171 beforeSz += ASN_GEN_TIME_SZ;
wolfSSL 11:cee25a834751 7172
wolfSSL 11:cee25a834751 7173 /* after now + daysValid */
wolfSSL 11:cee25a834751 7174 local = *now;
wolfSSL 11:cee25a834751 7175 after[0] = ASN_GENERALIZED_TIME;
wolfSSL 11:cee25a834751 7176 afterSz = SetLength(ASN_GEN_TIME_SZ, after + 1) + 1; /* gen tag */
wolfSSL 11:cee25a834751 7177
wolfSSL 11:cee25a834751 7178 /* add daysValid */
wolfSSL 11:cee25a834751 7179 local.tm_mday += daysValid;
wolfSSL 11:cee25a834751 7180 normalTime = mktime(&local);
wolfSSL 11:cee25a834751 7181 RebuildTime(&normalTime, &local);
wolfSSL 11:cee25a834751 7182
wolfSSL 11:cee25a834751 7183 /* adjust */
wolfSSL 11:cee25a834751 7184 local.tm_year += 1900;
wolfSSL 11:cee25a834751 7185 local.tm_mon += 1;
wolfSSL 11:cee25a834751 7186
wolfSSL 11:cee25a834751 7187 SetTime(&local, after + afterSz);
wolfSSL 11:cee25a834751 7188 afterSz += ASN_GEN_TIME_SZ;
wolfSSL 11:cee25a834751 7189
wolfSSL 11:cee25a834751 7190 /* headers and output */
wolfSSL 11:cee25a834751 7191 seqSz = SetSequence(beforeSz + afterSz, output);
wolfSSL 11:cee25a834751 7192 XMEMCPY(output + seqSz, before, beforeSz);
wolfSSL 11:cee25a834751 7193 XMEMCPY(output + seqSz + beforeSz, after, afterSz);
wolfSSL 11:cee25a834751 7194
wolfSSL 11:cee25a834751 7195 return seqSz + beforeSz + afterSz;
wolfSSL 11:cee25a834751 7196 }
wolfSSL 11:cee25a834751 7197
wolfSSL 11:cee25a834751 7198
wolfSSL 11:cee25a834751 7199 /* ASN Encoded Name field */
wolfSSL 11:cee25a834751 7200 typedef struct EncodedName {
wolfSSL 11:cee25a834751 7201 int nameLen; /* actual string value length */
wolfSSL 11:cee25a834751 7202 int totalLen; /* total encoded length */
wolfSSL 11:cee25a834751 7203 int type; /* type of name */
wolfSSL 11:cee25a834751 7204 int used; /* are we actually using this one */
wolfSSL 11:cee25a834751 7205 byte encoded[CTC_NAME_SIZE * 2]; /* encoding */
wolfSSL 11:cee25a834751 7206 } EncodedName;
wolfSSL 11:cee25a834751 7207
wolfSSL 11:cee25a834751 7208
wolfSSL 11:cee25a834751 7209 /* Get Which Name from index */
wolfSSL 11:cee25a834751 7210 static const char* GetOneName(CertName* name, int idx)
wolfSSL 11:cee25a834751 7211 {
wolfSSL 11:cee25a834751 7212 switch (idx) {
wolfSSL 11:cee25a834751 7213 case 0:
wolfSSL 11:cee25a834751 7214 return name->country;
wolfSSL 11:cee25a834751 7215
wolfSSL 11:cee25a834751 7216 case 1:
wolfSSL 11:cee25a834751 7217 return name->state;
wolfSSL 11:cee25a834751 7218
wolfSSL 11:cee25a834751 7219 case 2:
wolfSSL 11:cee25a834751 7220 return name->locality;
wolfSSL 11:cee25a834751 7221
wolfSSL 11:cee25a834751 7222 case 3:
wolfSSL 11:cee25a834751 7223 return name->sur;
wolfSSL 11:cee25a834751 7224
wolfSSL 11:cee25a834751 7225 case 4:
wolfSSL 11:cee25a834751 7226 return name->org;
wolfSSL 11:cee25a834751 7227
wolfSSL 11:cee25a834751 7228 case 5:
wolfSSL 11:cee25a834751 7229 return name->unit;
wolfSSL 11:cee25a834751 7230
wolfSSL 11:cee25a834751 7231 case 6:
wolfSSL 11:cee25a834751 7232 return name->commonName;
wolfSSL 11:cee25a834751 7233
wolfSSL 11:cee25a834751 7234 case 7:
wolfSSL 11:cee25a834751 7235 return name->email;
wolfSSL 11:cee25a834751 7236
wolfSSL 11:cee25a834751 7237 default:
wolfSSL 11:cee25a834751 7238 return 0;
wolfSSL 11:cee25a834751 7239 }
wolfSSL 11:cee25a834751 7240 }
wolfSSL 11:cee25a834751 7241
wolfSSL 11:cee25a834751 7242
wolfSSL 11:cee25a834751 7243 /* Get Which Name Encoding from index */
wolfSSL 11:cee25a834751 7244 static char GetNameType(CertName* name, int idx)
wolfSSL 11:cee25a834751 7245 {
wolfSSL 11:cee25a834751 7246 switch (idx) {
wolfSSL 11:cee25a834751 7247 case 0:
wolfSSL 11:cee25a834751 7248 return name->countryEnc;
wolfSSL 11:cee25a834751 7249
wolfSSL 11:cee25a834751 7250 case 1:
wolfSSL 11:cee25a834751 7251 return name->stateEnc;
wolfSSL 11:cee25a834751 7252
wolfSSL 11:cee25a834751 7253 case 2:
wolfSSL 11:cee25a834751 7254 return name->localityEnc;
wolfSSL 11:cee25a834751 7255
wolfSSL 11:cee25a834751 7256 case 3:
wolfSSL 11:cee25a834751 7257 return name->surEnc;
wolfSSL 11:cee25a834751 7258
wolfSSL 11:cee25a834751 7259 case 4:
wolfSSL 11:cee25a834751 7260 return name->orgEnc;
wolfSSL 11:cee25a834751 7261
wolfSSL 11:cee25a834751 7262 case 5:
wolfSSL 11:cee25a834751 7263 return name->unitEnc;
wolfSSL 11:cee25a834751 7264
wolfSSL 11:cee25a834751 7265 case 6:
wolfSSL 11:cee25a834751 7266 return name->commonNameEnc;
wolfSSL 11:cee25a834751 7267
wolfSSL 11:cee25a834751 7268 default:
wolfSSL 11:cee25a834751 7269 return 0;
wolfSSL 11:cee25a834751 7270 }
wolfSSL 11:cee25a834751 7271 }
wolfSSL 11:cee25a834751 7272
wolfSSL 11:cee25a834751 7273
wolfSSL 11:cee25a834751 7274 /* Get ASN Name from index */
wolfSSL 11:cee25a834751 7275 static byte GetNameId(int idx)
wolfSSL 11:cee25a834751 7276 {
wolfSSL 11:cee25a834751 7277 switch (idx) {
wolfSSL 11:cee25a834751 7278 case 0:
wolfSSL 11:cee25a834751 7279 return ASN_COUNTRY_NAME;
wolfSSL 11:cee25a834751 7280
wolfSSL 11:cee25a834751 7281 case 1:
wolfSSL 11:cee25a834751 7282 return ASN_STATE_NAME;
wolfSSL 11:cee25a834751 7283
wolfSSL 11:cee25a834751 7284 case 2:
wolfSSL 11:cee25a834751 7285 return ASN_LOCALITY_NAME;
wolfSSL 11:cee25a834751 7286
wolfSSL 11:cee25a834751 7287 case 3:
wolfSSL 11:cee25a834751 7288 return ASN_SUR_NAME;
wolfSSL 11:cee25a834751 7289
wolfSSL 11:cee25a834751 7290 case 4:
wolfSSL 11:cee25a834751 7291 return ASN_ORG_NAME;
wolfSSL 11:cee25a834751 7292
wolfSSL 11:cee25a834751 7293 case 5:
wolfSSL 11:cee25a834751 7294 return ASN_ORGUNIT_NAME;
wolfSSL 11:cee25a834751 7295
wolfSSL 11:cee25a834751 7296 case 6:
wolfSSL 11:cee25a834751 7297 return ASN_COMMON_NAME;
wolfSSL 11:cee25a834751 7298
wolfSSL 11:cee25a834751 7299 case 7:
wolfSSL 11:cee25a834751 7300 /* email uses different id type */
wolfSSL 11:cee25a834751 7301 return 0;
wolfSSL 11:cee25a834751 7302
wolfSSL 11:cee25a834751 7303 default:
wolfSSL 11:cee25a834751 7304 return 0;
wolfSSL 11:cee25a834751 7305 }
wolfSSL 11:cee25a834751 7306 }
wolfSSL 11:cee25a834751 7307
wolfSSL 11:cee25a834751 7308 /*
wolfSSL 11:cee25a834751 7309 Extensions ::= SEQUENCE OF Extension
wolfSSL 11:cee25a834751 7310
wolfSSL 11:cee25a834751 7311 Extension ::= SEQUENCE {
wolfSSL 11:cee25a834751 7312 extnId OBJECT IDENTIFIER,
wolfSSL 11:cee25a834751 7313 critical BOOLEAN DEFAULT FALSE,
wolfSSL 11:cee25a834751 7314 extnValue OCTET STRING }
wolfSSL 11:cee25a834751 7315 */
wolfSSL 11:cee25a834751 7316
wolfSSL 11:cee25a834751 7317 /* encode all extensions, return total bytes written */
wolfSSL 11:cee25a834751 7318 static int SetExtensions(byte* out, word32 outSz, int *IdxInOut,
wolfSSL 11:cee25a834751 7319 const byte* ext, int extSz)
wolfSSL 11:cee25a834751 7320 {
wolfSSL 11:cee25a834751 7321 if (out == NULL || IdxInOut == NULL || ext == NULL)
wolfSSL 11:cee25a834751 7322 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7323
wolfSSL 11:cee25a834751 7324 if (outSz < (word32)(*IdxInOut+extSz))
wolfSSL 11:cee25a834751 7325 return BUFFER_E;
wolfSSL 11:cee25a834751 7326
wolfSSL 11:cee25a834751 7327 XMEMCPY(&out[*IdxInOut], ext, extSz); /* extensions */
wolfSSL 11:cee25a834751 7328 *IdxInOut += extSz;
wolfSSL 11:cee25a834751 7329
wolfSSL 11:cee25a834751 7330 return *IdxInOut;
wolfSSL 11:cee25a834751 7331 }
wolfSSL 11:cee25a834751 7332
wolfSSL 11:cee25a834751 7333 /* encode extensions header, return total bytes written */
wolfSSL 11:cee25a834751 7334 static int SetExtensionsHeader(byte* out, word32 outSz, int extSz)
wolfSSL 11:cee25a834751 7335 {
wolfSSL 11:cee25a834751 7336 byte sequence[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 7337 byte len[MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 7338 int seqSz, lenSz, idx = 0;
wolfSSL 11:cee25a834751 7339
wolfSSL 11:cee25a834751 7340 if (out == NULL)
wolfSSL 11:cee25a834751 7341 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7342
wolfSSL 11:cee25a834751 7343 if (outSz < 3)
wolfSSL 11:cee25a834751 7344 return BUFFER_E;
wolfSSL 11:cee25a834751 7345
wolfSSL 11:cee25a834751 7346 seqSz = SetSequence(extSz, sequence);
wolfSSL 11:cee25a834751 7347
wolfSSL 11:cee25a834751 7348 /* encode extensions length provided */
wolfSSL 11:cee25a834751 7349 lenSz = SetLength(extSz+seqSz, len);
wolfSSL 11:cee25a834751 7350
wolfSSL 11:cee25a834751 7351 if (outSz < (word32)(lenSz+seqSz+1))
wolfSSL 11:cee25a834751 7352 return BUFFER_E;
wolfSSL 11:cee25a834751 7353
wolfSSL 11:cee25a834751 7354 out[idx++] = ASN_EXTENSIONS; /* extensions id */
wolfSSL 11:cee25a834751 7355 XMEMCPY(&out[idx], len, lenSz); /* length */
wolfSSL 11:cee25a834751 7356 idx += lenSz;
wolfSSL 11:cee25a834751 7357
wolfSSL 11:cee25a834751 7358 XMEMCPY(&out[idx], sequence, seqSz); /* sequence */
wolfSSL 11:cee25a834751 7359 idx += seqSz;
wolfSSL 11:cee25a834751 7360
wolfSSL 11:cee25a834751 7361 return idx;
wolfSSL 11:cee25a834751 7362 }
wolfSSL 11:cee25a834751 7363
wolfSSL 11:cee25a834751 7364
wolfSSL 11:cee25a834751 7365 /* encode CA basic constraint true, return total bytes written */
wolfSSL 11:cee25a834751 7366 static int SetCa(byte* out, word32 outSz)
wolfSSL 11:cee25a834751 7367 {
wolfSSL 11:cee25a834751 7368 static const byte ca[] = { 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04,
wolfSSL 11:cee25a834751 7369 0x05, 0x30, 0x03, 0x01, 0x01, 0xff };
wolfSSL 11:cee25a834751 7370
wolfSSL 11:cee25a834751 7371 if (out == NULL)
wolfSSL 11:cee25a834751 7372 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7373
wolfSSL 11:cee25a834751 7374 if (outSz < sizeof(ca))
wolfSSL 11:cee25a834751 7375 return BUFFER_E;
wolfSSL 11:cee25a834751 7376
wolfSSL 11:cee25a834751 7377 XMEMCPY(out, ca, sizeof(ca));
wolfSSL 11:cee25a834751 7378
wolfSSL 11:cee25a834751 7379 return (int)sizeof(ca);
wolfSSL 11:cee25a834751 7380 }
wolfSSL 11:cee25a834751 7381
wolfSSL 11:cee25a834751 7382
wolfSSL 11:cee25a834751 7383 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 7384 /* encode OID and associated value, return total bytes written */
wolfSSL 11:cee25a834751 7385 static int SetOidValue(byte* out, word32 outSz, const byte *oid, word32 oidSz,
wolfSSL 11:cee25a834751 7386 byte *in, word32 inSz)
wolfSSL 11:cee25a834751 7387 {
wolfSSL 11:cee25a834751 7388 int idx = 0;
wolfSSL 11:cee25a834751 7389
wolfSSL 11:cee25a834751 7390 if (out == NULL || oid == NULL || in == NULL)
wolfSSL 11:cee25a834751 7391 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7392
wolfSSL 11:cee25a834751 7393 if (outSz < 3)
wolfSSL 11:cee25a834751 7394 return BUFFER_E;
wolfSSL 11:cee25a834751 7395
wolfSSL 11:cee25a834751 7396 /* sequence, + 1 => byte to put value size */
wolfSSL 11:cee25a834751 7397 idx = SetSequence(inSz + oidSz + 1, out);
wolfSSL 11:cee25a834751 7398
wolfSSL 11:cee25a834751 7399 if ((idx + inSz + oidSz + 1) > outSz)
wolfSSL 11:cee25a834751 7400 return BUFFER_E;
wolfSSL 11:cee25a834751 7401
wolfSSL 11:cee25a834751 7402 XMEMCPY(out+idx, oid, oidSz);
wolfSSL 11:cee25a834751 7403 idx += oidSz;
wolfSSL 11:cee25a834751 7404 out[idx++] = (byte)inSz;
wolfSSL 11:cee25a834751 7405 XMEMCPY(out+idx, in, inSz);
wolfSSL 11:cee25a834751 7406
wolfSSL 11:cee25a834751 7407 return (idx+inSz);
wolfSSL 11:cee25a834751 7408 }
wolfSSL 11:cee25a834751 7409
wolfSSL 11:cee25a834751 7410 /* encode Subject Key Identifier, return total bytes written
wolfSSL 11:cee25a834751 7411 * RFC5280 : non-critical */
wolfSSL 11:cee25a834751 7412 static int SetSKID(byte* output, word32 outSz, const byte *input, word32 length)
wolfSSL 11:cee25a834751 7413 {
wolfSSL 11:cee25a834751 7414 byte skid_len[1 + MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 7415 byte skid_enc_len[MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 7416 int idx = 0, skid_lenSz, skid_enc_lenSz;
wolfSSL 11:cee25a834751 7417 static const byte skid_oid[] = { 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04 };
wolfSSL 11:cee25a834751 7418
wolfSSL 11:cee25a834751 7419 if (output == NULL || input == NULL)
wolfSSL 11:cee25a834751 7420 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7421
wolfSSL 11:cee25a834751 7422 /* Octet String header */
wolfSSL 11:cee25a834751 7423 skid_lenSz = SetOctetString(length, skid_len);
wolfSSL 11:cee25a834751 7424
wolfSSL 11:cee25a834751 7425 /* length of encoded value */
wolfSSL 11:cee25a834751 7426 skid_enc_lenSz = SetLength(length + skid_lenSz, skid_enc_len);
wolfSSL 11:cee25a834751 7427
wolfSSL 11:cee25a834751 7428 if (outSz < 3)
wolfSSL 11:cee25a834751 7429 return BUFFER_E;
wolfSSL 11:cee25a834751 7430
wolfSSL 11:cee25a834751 7431 idx = SetSequence(length + sizeof(skid_oid) + skid_lenSz + skid_enc_lenSz,
wolfSSL 11:cee25a834751 7432 output);
wolfSSL 11:cee25a834751 7433
wolfSSL 11:cee25a834751 7434 if ((length + sizeof(skid_oid) + skid_lenSz + skid_enc_lenSz) > outSz)
wolfSSL 11:cee25a834751 7435 return BUFFER_E;
wolfSSL 11:cee25a834751 7436
wolfSSL 11:cee25a834751 7437 /* put oid */
wolfSSL 11:cee25a834751 7438 XMEMCPY(output+idx, skid_oid, sizeof(skid_oid));
wolfSSL 11:cee25a834751 7439 idx += sizeof(skid_oid);
wolfSSL 11:cee25a834751 7440
wolfSSL 11:cee25a834751 7441 /* put encoded len */
wolfSSL 11:cee25a834751 7442 XMEMCPY(output+idx, skid_enc_len, skid_enc_lenSz);
wolfSSL 11:cee25a834751 7443 idx += skid_enc_lenSz;
wolfSSL 11:cee25a834751 7444
wolfSSL 11:cee25a834751 7445 /* put octet header */
wolfSSL 11:cee25a834751 7446 XMEMCPY(output+idx, skid_len, skid_lenSz);
wolfSSL 11:cee25a834751 7447 idx += skid_lenSz;
wolfSSL 11:cee25a834751 7448
wolfSSL 11:cee25a834751 7449 /* put value */
wolfSSL 11:cee25a834751 7450 XMEMCPY(output+idx, input, length);
wolfSSL 11:cee25a834751 7451 idx += length;
wolfSSL 11:cee25a834751 7452
wolfSSL 11:cee25a834751 7453 return idx;
wolfSSL 11:cee25a834751 7454 }
wolfSSL 11:cee25a834751 7455
wolfSSL 11:cee25a834751 7456 /* encode Authority Key Identifier, return total bytes written
wolfSSL 11:cee25a834751 7457 * RFC5280 : non-critical */
wolfSSL 11:cee25a834751 7458 static int SetAKID(byte* output, word32 outSz,
wolfSSL 11:cee25a834751 7459 byte *input, word32 length, void* heap)
wolfSSL 11:cee25a834751 7460 {
wolfSSL 11:cee25a834751 7461 byte *enc_val;
wolfSSL 11:cee25a834751 7462 int ret, enc_valSz;
wolfSSL 11:cee25a834751 7463 static const byte akid_oid[] = { 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04 };
wolfSSL 11:cee25a834751 7464 static const byte akid_cs[] = { 0x80 };
wolfSSL 11:cee25a834751 7465
wolfSSL 11:cee25a834751 7466 if (output == NULL || input == NULL)
wolfSSL 11:cee25a834751 7467 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7468
wolfSSL 11:cee25a834751 7469 enc_valSz = length + 3 + sizeof(akid_cs);
wolfSSL 11:cee25a834751 7470 enc_val = (byte *)XMALLOC(enc_valSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7471 if (enc_val == NULL)
wolfSSL 11:cee25a834751 7472 return MEMORY_E;
wolfSSL 11:cee25a834751 7473
wolfSSL 11:cee25a834751 7474 /* sequence for ContentSpec & value */
wolfSSL 11:cee25a834751 7475 ret = SetOidValue(enc_val, enc_valSz, akid_cs, sizeof(akid_cs),
wolfSSL 11:cee25a834751 7476 input, length);
wolfSSL 11:cee25a834751 7477 if (ret > 0) {
wolfSSL 11:cee25a834751 7478 enc_valSz = ret;
wolfSSL 11:cee25a834751 7479
wolfSSL 11:cee25a834751 7480 ret = SetOidValue(output, outSz, akid_oid, sizeof(akid_oid),
wolfSSL 11:cee25a834751 7481 enc_val, enc_valSz);
wolfSSL 11:cee25a834751 7482 }
wolfSSL 11:cee25a834751 7483
wolfSSL 11:cee25a834751 7484 XFREE(enc_val, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7485 return ret;
wolfSSL 11:cee25a834751 7486 }
wolfSSL 11:cee25a834751 7487
wolfSSL 11:cee25a834751 7488 /* encode Key Usage, return total bytes written
wolfSSL 11:cee25a834751 7489 * RFC5280 : critical */
wolfSSL 11:cee25a834751 7490 static int SetKeyUsage(byte* output, word32 outSz, word16 input)
wolfSSL 11:cee25a834751 7491 {
wolfSSL 11:cee25a834751 7492 byte ku[5];
wolfSSL 11:cee25a834751 7493 int idx;
wolfSSL 11:cee25a834751 7494 static const byte keyusage_oid[] = { 0x06, 0x03, 0x55, 0x1d, 0x0f,
wolfSSL 11:cee25a834751 7495 0x01, 0x01, 0xff, 0x04};
wolfSSL 11:cee25a834751 7496
wolfSSL 11:cee25a834751 7497 if (output == NULL)
wolfSSL 11:cee25a834751 7498 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7499
wolfSSL 11:cee25a834751 7500 idx = SetBitString16Bit(input, ku);
wolfSSL 11:cee25a834751 7501 return SetOidValue(output, outSz, keyusage_oid, sizeof(keyusage_oid),
wolfSSL 11:cee25a834751 7502 ku, idx);
wolfSSL 11:cee25a834751 7503 }
wolfSSL 11:cee25a834751 7504
wolfSSL 11:cee25a834751 7505 /* Encode OID string representation to ITU-T X.690 format */
wolfSSL 11:cee25a834751 7506 static int EncodePolicyOID(byte *out, word32 *outSz, const char *in, void* heap)
wolfSSL 11:cee25a834751 7507 {
wolfSSL 11:cee25a834751 7508 word32 val, idx = 0, nb_val;
wolfSSL 11:cee25a834751 7509 char *token, *str, *ptr;
wolfSSL 11:cee25a834751 7510 word32 len;
wolfSSL 11:cee25a834751 7511
wolfSSL 11:cee25a834751 7512 if (out == NULL || outSz == NULL || *outSz < 2 || in == NULL)
wolfSSL 11:cee25a834751 7513 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7514
wolfSSL 11:cee25a834751 7515 len = (word32)XSTRLEN(in);
wolfSSL 11:cee25a834751 7516
wolfSSL 11:cee25a834751 7517 str = (char *)XMALLOC(len+1, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7518 if (str == NULL)
wolfSSL 11:cee25a834751 7519 return MEMORY_E;
wolfSSL 11:cee25a834751 7520
wolfSSL 11:cee25a834751 7521 XSTRNCPY(str, in, len);
wolfSSL 11:cee25a834751 7522 str[len] = 0x00;
wolfSSL 11:cee25a834751 7523
wolfSSL 11:cee25a834751 7524 nb_val = 0;
wolfSSL 11:cee25a834751 7525
wolfSSL 11:cee25a834751 7526 /* parse value, and set corresponding Policy OID value */
wolfSSL 11:cee25a834751 7527 token = XSTRTOK(str, ".", &ptr);
wolfSSL 11:cee25a834751 7528 while (token != NULL)
wolfSSL 11:cee25a834751 7529 {
wolfSSL 11:cee25a834751 7530 val = (word32)atoi(token);
wolfSSL 11:cee25a834751 7531
wolfSSL 11:cee25a834751 7532 if (nb_val == 0) {
wolfSSL 11:cee25a834751 7533 if (val > 2) {
wolfSSL 11:cee25a834751 7534 XFREE(str, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7535 return ASN_OBJECT_ID_E;
wolfSSL 11:cee25a834751 7536 }
wolfSSL 11:cee25a834751 7537
wolfSSL 11:cee25a834751 7538 out[idx] = (byte)(40 * val);
wolfSSL 11:cee25a834751 7539 }
wolfSSL 11:cee25a834751 7540 else if (nb_val == 1) {
wolfSSL 11:cee25a834751 7541 if (val > 127) {
wolfSSL 11:cee25a834751 7542 XFREE(str, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7543 return ASN_OBJECT_ID_E;
wolfSSL 11:cee25a834751 7544 }
wolfSSL 11:cee25a834751 7545
wolfSSL 11:cee25a834751 7546 if (idx > *outSz) {
wolfSSL 11:cee25a834751 7547 XFREE(str, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7548 return BUFFER_E;
wolfSSL 11:cee25a834751 7549 }
wolfSSL 11:cee25a834751 7550
wolfSSL 11:cee25a834751 7551 out[idx++] += (byte)val;
wolfSSL 11:cee25a834751 7552 }
wolfSSL 11:cee25a834751 7553 else {
wolfSSL 11:cee25a834751 7554 word32 tb = 0, x;
wolfSSL 11:cee25a834751 7555 int i = 0;
wolfSSL 11:cee25a834751 7556 byte oid[MAX_OID_SZ];
wolfSSL 11:cee25a834751 7557
wolfSSL 11:cee25a834751 7558 while (val >= 128) {
wolfSSL 11:cee25a834751 7559 x = val % 128;
wolfSSL 11:cee25a834751 7560 val /= 128;
wolfSSL 11:cee25a834751 7561 oid[i++] = (byte) (((tb++) ? 0x80 : 0) | x);
wolfSSL 11:cee25a834751 7562 }
wolfSSL 11:cee25a834751 7563
wolfSSL 11:cee25a834751 7564 if ((idx+(word32)i) > *outSz) {
wolfSSL 11:cee25a834751 7565 XFREE(str, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7566 return BUFFER_E;
wolfSSL 11:cee25a834751 7567 }
wolfSSL 11:cee25a834751 7568
wolfSSL 11:cee25a834751 7569 oid[i] = (byte) (((tb++) ? 0x80 : 0) | val);
wolfSSL 11:cee25a834751 7570
wolfSSL 11:cee25a834751 7571 /* push value in the right order */
wolfSSL 11:cee25a834751 7572 while (i >= 0)
wolfSSL 11:cee25a834751 7573 out[idx++] = oid[i--];
wolfSSL 11:cee25a834751 7574 }
wolfSSL 11:cee25a834751 7575
wolfSSL 11:cee25a834751 7576 token = XSTRTOK(NULL, ".", &ptr);
wolfSSL 11:cee25a834751 7577 nb_val++;
wolfSSL 11:cee25a834751 7578 }
wolfSSL 11:cee25a834751 7579
wolfSSL 11:cee25a834751 7580 *outSz = idx;
wolfSSL 11:cee25a834751 7581
wolfSSL 11:cee25a834751 7582 XFREE(str, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7583 return 0;
wolfSSL 11:cee25a834751 7584 }
wolfSSL 11:cee25a834751 7585
wolfSSL 11:cee25a834751 7586 /* encode Certificate Policies, return total bytes written
wolfSSL 11:cee25a834751 7587 * each input value must be ITU-T X.690 formatted : a.b.c...
wolfSSL 11:cee25a834751 7588 * input must be an array of values with a NULL terminated for the latest
wolfSSL 11:cee25a834751 7589 * RFC5280 : non-critical */
wolfSSL 11:cee25a834751 7590 static int SetCertificatePolicies(byte *output,
wolfSSL 11:cee25a834751 7591 word32 outputSz,
wolfSSL 11:cee25a834751 7592 char input[MAX_CERTPOL_NB][MAX_CERTPOL_SZ],
wolfSSL 11:cee25a834751 7593 word16 nb_certpol,
wolfSSL 11:cee25a834751 7594 void* heap)
wolfSSL 11:cee25a834751 7595 {
wolfSSL 11:cee25a834751 7596 byte oid[MAX_OID_SZ],
wolfSSL 11:cee25a834751 7597 der_oid[MAX_CERTPOL_NB][MAX_OID_SZ],
wolfSSL 11:cee25a834751 7598 out[MAX_CERTPOL_SZ];
wolfSSL 11:cee25a834751 7599 word32 oidSz;
wolfSSL 11:cee25a834751 7600 word32 outSz, i = 0, der_oidSz[MAX_CERTPOL_NB];
wolfSSL 11:cee25a834751 7601 int ret;
wolfSSL 11:cee25a834751 7602
wolfSSL 11:cee25a834751 7603 static const byte certpol_oid[] = { 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04 };
wolfSSL 11:cee25a834751 7604 static const byte oid_oid[] = { 0x06 };
wolfSSL 11:cee25a834751 7605
wolfSSL 11:cee25a834751 7606 if (output == NULL || input == NULL || nb_certpol > MAX_CERTPOL_NB)
wolfSSL 11:cee25a834751 7607 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7608
wolfSSL 11:cee25a834751 7609 for (i = 0; i < nb_certpol; i++) {
wolfSSL 11:cee25a834751 7610 oidSz = sizeof(oid);
wolfSSL 11:cee25a834751 7611 XMEMSET(oid, 0, oidSz);
wolfSSL 11:cee25a834751 7612
wolfSSL 11:cee25a834751 7613 ret = EncodePolicyOID(oid, &oidSz, input[i], heap);
wolfSSL 11:cee25a834751 7614 if (ret != 0)
wolfSSL 11:cee25a834751 7615 return ret;
wolfSSL 11:cee25a834751 7616
wolfSSL 11:cee25a834751 7617 /* compute sequence value for the oid */
wolfSSL 11:cee25a834751 7618 ret = SetOidValue(der_oid[i], MAX_OID_SZ, oid_oid,
wolfSSL 11:cee25a834751 7619 sizeof(oid_oid), oid, oidSz);
wolfSSL 11:cee25a834751 7620 if (ret <= 0)
wolfSSL 11:cee25a834751 7621 return ret;
wolfSSL 11:cee25a834751 7622 else
wolfSSL 11:cee25a834751 7623 der_oidSz[i] = (word32)ret;
wolfSSL 11:cee25a834751 7624 }
wolfSSL 11:cee25a834751 7625
wolfSSL 11:cee25a834751 7626 /* concatenate oid, keep two byte for sequence/size of the created value */
wolfSSL 11:cee25a834751 7627 for (i = 0, outSz = 2; i < nb_certpol; i++) {
wolfSSL 11:cee25a834751 7628 XMEMCPY(out+outSz, der_oid[i], der_oidSz[i]);
wolfSSL 11:cee25a834751 7629 outSz += der_oidSz[i];
wolfSSL 11:cee25a834751 7630 }
wolfSSL 11:cee25a834751 7631
wolfSSL 11:cee25a834751 7632 /* add sequence */
wolfSSL 11:cee25a834751 7633 ret = SetSequence(outSz-2, out);
wolfSSL 11:cee25a834751 7634 if (ret <= 0)
wolfSSL 11:cee25a834751 7635 return ret;
wolfSSL 11:cee25a834751 7636
wolfSSL 11:cee25a834751 7637 /* add Policy OID to compute final value */
wolfSSL 11:cee25a834751 7638 return SetOidValue(output, outputSz, certpol_oid, sizeof(certpol_oid),
wolfSSL 11:cee25a834751 7639 out, outSz);
wolfSSL 11:cee25a834751 7640 }
wolfSSL 11:cee25a834751 7641 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 7642
wolfSSL 11:cee25a834751 7643 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 7644 /* encode Alternative Names, return total bytes written */
wolfSSL 11:cee25a834751 7645 static int SetAltNames(byte *out, word32 outSz, byte *input, word32 length)
wolfSSL 11:cee25a834751 7646 {
wolfSSL 11:cee25a834751 7647 if (out == NULL || input == NULL)
wolfSSL 11:cee25a834751 7648 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7649
wolfSSL 11:cee25a834751 7650 if (outSz < length)
wolfSSL 11:cee25a834751 7651 return BUFFER_E;
wolfSSL 11:cee25a834751 7652
wolfSSL 11:cee25a834751 7653 /* Alternative Names come from certificate or computed by
wolfSSL 11:cee25a834751 7654 * external function, so already encoded. Just copy value */
wolfSSL 11:cee25a834751 7655 XMEMCPY(out, input, length);
wolfSSL 11:cee25a834751 7656 return length;
wolfSSL 11:cee25a834751 7657 }
wolfSSL 11:cee25a834751 7658 #endif /* WOLFSL_ALT_NAMES */
wolfSSL 11:cee25a834751 7659
wolfSSL 11:cee25a834751 7660
wolfSSL 11:cee25a834751 7661 /* encode CertName into output, return total bytes written */
wolfSSL 11:cee25a834751 7662 int SetName(byte* output, word32 outputSz, CertName* name)
wolfSSL 11:cee25a834751 7663 {
wolfSSL 11:cee25a834751 7664 int totalBytes = 0, i, idx;
wolfSSL 11:cee25a834751 7665 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7666 EncodedName* names = NULL;
wolfSSL 11:cee25a834751 7667 #else
wolfSSL 11:cee25a834751 7668 EncodedName names[NAME_ENTRIES];
wolfSSL 11:cee25a834751 7669 #endif
wolfSSL 11:cee25a834751 7670
wolfSSL 11:cee25a834751 7671 if (output == NULL || name == NULL)
wolfSSL 11:cee25a834751 7672 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7673
wolfSSL 11:cee25a834751 7674 if (outputSz < 3)
wolfSSL 11:cee25a834751 7675 return BUFFER_E;
wolfSSL 11:cee25a834751 7676
wolfSSL 11:cee25a834751 7677 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7678 names = (EncodedName*)XMALLOC(sizeof(EncodedName) * NAME_ENTRIES, NULL,
wolfSSL 11:cee25a834751 7679 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7680 if (names == NULL)
wolfSSL 11:cee25a834751 7681 return MEMORY_E;
wolfSSL 11:cee25a834751 7682 #endif
wolfSSL 11:cee25a834751 7683
wolfSSL 11:cee25a834751 7684 for (i = 0; i < NAME_ENTRIES; i++) {
wolfSSL 11:cee25a834751 7685 const char* nameStr = GetOneName(name, i);
wolfSSL 11:cee25a834751 7686 if (nameStr) {
wolfSSL 11:cee25a834751 7687 /* bottom up */
wolfSSL 11:cee25a834751 7688 byte firstLen[1 + MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 7689 byte secondLen[MAX_LENGTH_SZ];
wolfSSL 11:cee25a834751 7690 byte sequence[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 7691 byte set[MAX_SET_SZ];
wolfSSL 11:cee25a834751 7692
wolfSSL 11:cee25a834751 7693 int email = i == (NAME_ENTRIES - 1) ? 1 : 0;
wolfSSL 11:cee25a834751 7694 int strLen = (int)XSTRLEN(nameStr);
wolfSSL 11:cee25a834751 7695 int thisLen = strLen;
wolfSSL 11:cee25a834751 7696 int firstSz, secondSz, seqSz, setSz;
wolfSSL 11:cee25a834751 7697
wolfSSL 11:cee25a834751 7698 if (strLen == 0) { /* no user data for this item */
wolfSSL 11:cee25a834751 7699 names[i].used = 0;
wolfSSL 11:cee25a834751 7700 continue;
wolfSSL 11:cee25a834751 7701 }
wolfSSL 11:cee25a834751 7702
wolfSSL 11:cee25a834751 7703 /* Restrict country code size */
wolfSSL 11:cee25a834751 7704 if (i == 0 && strLen != CTC_COUNTRY_SIZE) {
wolfSSL 11:cee25a834751 7705 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7706 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7707 #endif
wolfSSL 11:cee25a834751 7708 return ASN_COUNTRY_SIZE_E;
wolfSSL 11:cee25a834751 7709 }
wolfSSL 11:cee25a834751 7710
wolfSSL 11:cee25a834751 7711 secondSz = SetLength(strLen, secondLen);
wolfSSL 11:cee25a834751 7712 thisLen += secondSz;
wolfSSL 11:cee25a834751 7713 if (email) {
wolfSSL 11:cee25a834751 7714 thisLen += EMAIL_JOINT_LEN;
wolfSSL 11:cee25a834751 7715 thisLen ++; /* id type */
wolfSSL 11:cee25a834751 7716 firstSz = SetObjectId(EMAIL_JOINT_LEN, firstLen);
wolfSSL 11:cee25a834751 7717 }
wolfSSL 11:cee25a834751 7718 else {
wolfSSL 11:cee25a834751 7719 thisLen++; /* str type */
wolfSSL 11:cee25a834751 7720 thisLen++; /* id type */
wolfSSL 11:cee25a834751 7721 thisLen += JOINT_LEN;
wolfSSL 11:cee25a834751 7722 firstSz = SetObjectId(JOINT_LEN + 1, firstLen);
wolfSSL 11:cee25a834751 7723 }
wolfSSL 11:cee25a834751 7724 thisLen += firstSz;
wolfSSL 11:cee25a834751 7725
wolfSSL 11:cee25a834751 7726 seqSz = SetSequence(thisLen, sequence);
wolfSSL 11:cee25a834751 7727 thisLen += seqSz;
wolfSSL 11:cee25a834751 7728 setSz = SetSet(thisLen, set);
wolfSSL 11:cee25a834751 7729 thisLen += setSz;
wolfSSL 11:cee25a834751 7730
wolfSSL 11:cee25a834751 7731 if (thisLen > (int)sizeof(names[i].encoded)) {
wolfSSL 11:cee25a834751 7732 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7733 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7734 #endif
wolfSSL 11:cee25a834751 7735 return BUFFER_E;
wolfSSL 11:cee25a834751 7736 }
wolfSSL 11:cee25a834751 7737
wolfSSL 11:cee25a834751 7738 /* store it */
wolfSSL 11:cee25a834751 7739 idx = 0;
wolfSSL 11:cee25a834751 7740 /* set */
wolfSSL 11:cee25a834751 7741 XMEMCPY(names[i].encoded, set, setSz);
wolfSSL 11:cee25a834751 7742 idx += setSz;
wolfSSL 11:cee25a834751 7743 /* seq */
wolfSSL 11:cee25a834751 7744 XMEMCPY(names[i].encoded + idx, sequence, seqSz);
wolfSSL 11:cee25a834751 7745 idx += seqSz;
wolfSSL 11:cee25a834751 7746 /* asn object id */
wolfSSL 11:cee25a834751 7747 XMEMCPY(names[i].encoded + idx, firstLen, firstSz);
wolfSSL 11:cee25a834751 7748 idx += firstSz;
wolfSSL 11:cee25a834751 7749 if (email) {
wolfSSL 11:cee25a834751 7750 const byte EMAIL_OID[] = { 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
wolfSSL 11:cee25a834751 7751 0x01, 0x09, 0x01, 0x16 };
wolfSSL 11:cee25a834751 7752 /* email joint id */
wolfSSL 11:cee25a834751 7753 XMEMCPY(names[i].encoded + idx, EMAIL_OID, sizeof(EMAIL_OID));
wolfSSL 11:cee25a834751 7754 idx += (int)sizeof(EMAIL_OID);
wolfSSL 11:cee25a834751 7755 }
wolfSSL 11:cee25a834751 7756 else {
wolfSSL 11:cee25a834751 7757 /* joint id */
wolfSSL 11:cee25a834751 7758 byte bType = GetNameId(i);
wolfSSL 11:cee25a834751 7759 names[i].encoded[idx++] = 0x55;
wolfSSL 11:cee25a834751 7760 names[i].encoded[idx++] = 0x04;
wolfSSL 11:cee25a834751 7761 /* id type */
wolfSSL 11:cee25a834751 7762 names[i].encoded[idx++] = bType;
wolfSSL 11:cee25a834751 7763 /* str type */
wolfSSL 11:cee25a834751 7764 names[i].encoded[idx++] = GetNameType(name, i);
wolfSSL 11:cee25a834751 7765 }
wolfSSL 11:cee25a834751 7766 /* second length */
wolfSSL 11:cee25a834751 7767 XMEMCPY(names[i].encoded + idx, secondLen, secondSz);
wolfSSL 11:cee25a834751 7768 idx += secondSz;
wolfSSL 11:cee25a834751 7769 /* str value */
wolfSSL 11:cee25a834751 7770 XMEMCPY(names[i].encoded + idx, nameStr, strLen);
wolfSSL 11:cee25a834751 7771 idx += strLen;
wolfSSL 11:cee25a834751 7772
wolfSSL 11:cee25a834751 7773 totalBytes += idx;
wolfSSL 11:cee25a834751 7774 names[i].totalLen = idx;
wolfSSL 11:cee25a834751 7775 names[i].used = 1;
wolfSSL 11:cee25a834751 7776 }
wolfSSL 11:cee25a834751 7777 else
wolfSSL 11:cee25a834751 7778 names[i].used = 0;
wolfSSL 11:cee25a834751 7779 }
wolfSSL 11:cee25a834751 7780
wolfSSL 11:cee25a834751 7781 /* header */
wolfSSL 11:cee25a834751 7782 idx = SetSequence(totalBytes, output);
wolfSSL 11:cee25a834751 7783 totalBytes += idx;
wolfSSL 11:cee25a834751 7784 if (totalBytes > ASN_NAME_MAX) {
wolfSSL 11:cee25a834751 7785 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7786 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7787 #endif
wolfSSL 11:cee25a834751 7788 return BUFFER_E;
wolfSSL 11:cee25a834751 7789 }
wolfSSL 11:cee25a834751 7790
wolfSSL 11:cee25a834751 7791 for (i = 0; i < NAME_ENTRIES; i++) {
wolfSSL 11:cee25a834751 7792 if (names[i].used) {
wolfSSL 11:cee25a834751 7793 if (outputSz < (word32)(idx+names[i].totalLen)) {
wolfSSL 11:cee25a834751 7794 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7795 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7796 #endif
wolfSSL 11:cee25a834751 7797 return BUFFER_E;
wolfSSL 11:cee25a834751 7798 }
wolfSSL 11:cee25a834751 7799
wolfSSL 11:cee25a834751 7800 XMEMCPY(output + idx, names[i].encoded, names[i].totalLen);
wolfSSL 11:cee25a834751 7801 idx += names[i].totalLen;
wolfSSL 11:cee25a834751 7802 }
wolfSSL 11:cee25a834751 7803 }
wolfSSL 11:cee25a834751 7804
wolfSSL 11:cee25a834751 7805 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 7806 XFREE(names, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 7807 #endif
wolfSSL 11:cee25a834751 7808
wolfSSL 11:cee25a834751 7809 return totalBytes;
wolfSSL 11:cee25a834751 7810 }
wolfSSL 11:cee25a834751 7811
wolfSSL 11:cee25a834751 7812 /* encode info from cert into DER encoded format */
wolfSSL 11:cee25a834751 7813 static int EncodeCert(Cert* cert, DerCert* der, RsaKey* rsaKey, ecc_key* eccKey,
wolfSSL 11:cee25a834751 7814 WC_RNG* rng, const byte* ntruKey, word16 ntruSz)
wolfSSL 11:cee25a834751 7815 {
wolfSSL 11:cee25a834751 7816 int ret;
wolfSSL 11:cee25a834751 7817
wolfSSL 11:cee25a834751 7818 (void)eccKey;
wolfSSL 11:cee25a834751 7819 (void)ntruKey;
wolfSSL 11:cee25a834751 7820 (void)ntruSz;
wolfSSL 11:cee25a834751 7821
wolfSSL 11:cee25a834751 7822 if (cert == NULL || der == NULL || rng == NULL)
wolfSSL 11:cee25a834751 7823 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 7824
wolfSSL 11:cee25a834751 7825 /* init */
wolfSSL 11:cee25a834751 7826 XMEMSET(der, 0, sizeof(DerCert));
wolfSSL 11:cee25a834751 7827
wolfSSL 11:cee25a834751 7828 /* version */
wolfSSL 11:cee25a834751 7829 der->versionSz = SetMyVersion(cert->version, der->version, TRUE);
wolfSSL 11:cee25a834751 7830
wolfSSL 11:cee25a834751 7831 /* serial number */
wolfSSL 11:cee25a834751 7832 ret = wc_RNG_GenerateBlock(rng, cert->serial, CTC_SERIAL_SIZE);
wolfSSL 11:cee25a834751 7833 if (ret != 0)
wolfSSL 11:cee25a834751 7834 return ret;
wolfSSL 11:cee25a834751 7835
wolfSSL 11:cee25a834751 7836 cert->serial[0] = 0x01; /* ensure positive */
wolfSSL 11:cee25a834751 7837 der->serialSz = SetSerial(cert->serial, der->serial);
wolfSSL 11:cee25a834751 7838
wolfSSL 11:cee25a834751 7839 /* signature algo */
wolfSSL 11:cee25a834751 7840 der->sigAlgoSz = SetAlgoID(cert->sigType, der->sigAlgo, oidSigType, 0);
wolfSSL 11:cee25a834751 7841 if (der->sigAlgoSz <= 0)
wolfSSL 11:cee25a834751 7842 return ALGO_ID_E;
wolfSSL 11:cee25a834751 7843
wolfSSL 11:cee25a834751 7844 /* public key */
wolfSSL 11:cee25a834751 7845 if (cert->keyType == RSA_KEY) {
wolfSSL 11:cee25a834751 7846 if (rsaKey == NULL)
wolfSSL 11:cee25a834751 7847 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7848 der->publicKeySz = SetRsaPublicKey(der->publicKey, rsaKey,
wolfSSL 11:cee25a834751 7849 sizeof(der->publicKey), 1);
wolfSSL 11:cee25a834751 7850 if (der->publicKeySz <= 0)
wolfSSL 11:cee25a834751 7851 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7852 }
wolfSSL 11:cee25a834751 7853
wolfSSL 11:cee25a834751 7854 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 7855 if (cert->keyType == ECC_KEY) {
wolfSSL 11:cee25a834751 7856 if (eccKey == NULL)
wolfSSL 11:cee25a834751 7857 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7858 der->publicKeySz = SetEccPublicKey(der->publicKey, eccKey, 1);
wolfSSL 11:cee25a834751 7859 if (der->publicKeySz <= 0)
wolfSSL 11:cee25a834751 7860 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7861 }
wolfSSL 11:cee25a834751 7862 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 7863
wolfSSL 11:cee25a834751 7864 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 7865 if (cert->keyType == NTRU_KEY) {
wolfSSL 11:cee25a834751 7866 word32 rc;
wolfSSL 11:cee25a834751 7867 word16 encodedSz;
wolfSSL 11:cee25a834751 7868
wolfSSL 11:cee25a834751 7869 rc = ntru_crypto_ntru_encrypt_publicKey2SubjectPublicKeyInfo( ntruSz,
wolfSSL 11:cee25a834751 7870 ntruKey, &encodedSz, NULL);
wolfSSL 11:cee25a834751 7871 if (rc != NTRU_OK)
wolfSSL 11:cee25a834751 7872 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7873 if (encodedSz > MAX_PUBLIC_KEY_SZ)
wolfSSL 11:cee25a834751 7874 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7875
wolfSSL 11:cee25a834751 7876 rc = ntru_crypto_ntru_encrypt_publicKey2SubjectPublicKeyInfo( ntruSz,
wolfSSL 11:cee25a834751 7877 ntruKey, &encodedSz, der->publicKey);
wolfSSL 11:cee25a834751 7878 if (rc != NTRU_OK)
wolfSSL 11:cee25a834751 7879 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 7880
wolfSSL 11:cee25a834751 7881 der->publicKeySz = encodedSz;
wolfSSL 11:cee25a834751 7882 }
wolfSSL 11:cee25a834751 7883 #endif /* HAVE_NTRU */
wolfSSL 11:cee25a834751 7884
wolfSSL 11:cee25a834751 7885 der->validitySz = 0;
wolfSSL 11:cee25a834751 7886 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 7887 /* date validity copy ? */
wolfSSL 11:cee25a834751 7888 if (cert->beforeDateSz && cert->afterDateSz) {
wolfSSL 11:cee25a834751 7889 der->validitySz = CopyValidity(der->validity, cert);
wolfSSL 11:cee25a834751 7890 if (der->validitySz <= 0)
wolfSSL 11:cee25a834751 7891 return DATE_E;
wolfSSL 11:cee25a834751 7892 }
wolfSSL 11:cee25a834751 7893 #endif
wolfSSL 11:cee25a834751 7894
wolfSSL 11:cee25a834751 7895 /* date validity */
wolfSSL 11:cee25a834751 7896 if (der->validitySz == 0) {
wolfSSL 11:cee25a834751 7897 der->validitySz = SetValidity(der->validity, cert->daysValid);
wolfSSL 11:cee25a834751 7898 if (der->validitySz <= 0)
wolfSSL 11:cee25a834751 7899 return DATE_E;
wolfSSL 11:cee25a834751 7900 }
wolfSSL 11:cee25a834751 7901
wolfSSL 11:cee25a834751 7902 /* subject name */
wolfSSL 11:cee25a834751 7903 der->subjectSz = SetName(der->subject, sizeof(der->subject), &cert->subject);
wolfSSL 11:cee25a834751 7904 if (der->subjectSz <= 0)
wolfSSL 11:cee25a834751 7905 return SUBJECT_E;
wolfSSL 11:cee25a834751 7906
wolfSSL 11:cee25a834751 7907 /* issuer name */
wolfSSL 11:cee25a834751 7908 der->issuerSz = SetName(der->issuer, sizeof(der->issuer), cert->selfSigned ?
wolfSSL 11:cee25a834751 7909 &cert->subject : &cert->issuer);
wolfSSL 11:cee25a834751 7910 if (der->issuerSz <= 0)
wolfSSL 11:cee25a834751 7911 return ISSUER_E;
wolfSSL 11:cee25a834751 7912
wolfSSL 11:cee25a834751 7913 /* set the extensions */
wolfSSL 11:cee25a834751 7914 der->extensionsSz = 0;
wolfSSL 11:cee25a834751 7915
wolfSSL 11:cee25a834751 7916 /* CA */
wolfSSL 11:cee25a834751 7917 if (cert->isCA) {
wolfSSL 11:cee25a834751 7918 der->caSz = SetCa(der->ca, sizeof(der->ca));
wolfSSL 11:cee25a834751 7919 if (der->caSz <= 0)
wolfSSL 11:cee25a834751 7920 return CA_TRUE_E;
wolfSSL 11:cee25a834751 7921
wolfSSL 11:cee25a834751 7922 der->extensionsSz += der->caSz;
wolfSSL 11:cee25a834751 7923 }
wolfSSL 11:cee25a834751 7924 else
wolfSSL 11:cee25a834751 7925 der->caSz = 0;
wolfSSL 11:cee25a834751 7926
wolfSSL 11:cee25a834751 7927 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 7928 /* Alternative Name */
wolfSSL 11:cee25a834751 7929 if (cert->altNamesSz) {
wolfSSL 11:cee25a834751 7930 der->altNamesSz = SetAltNames(der->altNames, sizeof(der->altNames),
wolfSSL 11:cee25a834751 7931 cert->altNames, cert->altNamesSz);
wolfSSL 11:cee25a834751 7932 if (der->altNamesSz <= 0)
wolfSSL 11:cee25a834751 7933 return ALT_NAME_E;
wolfSSL 11:cee25a834751 7934
wolfSSL 11:cee25a834751 7935 der->extensionsSz += der->altNamesSz;
wolfSSL 11:cee25a834751 7936 }
wolfSSL 11:cee25a834751 7937 else
wolfSSL 11:cee25a834751 7938 der->altNamesSz = 0;
wolfSSL 11:cee25a834751 7939 #endif
wolfSSL 11:cee25a834751 7940
wolfSSL 11:cee25a834751 7941 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 7942 /* SKID */
wolfSSL 11:cee25a834751 7943 if (cert->skidSz) {
wolfSSL 11:cee25a834751 7944 /* check the provided SKID size */
wolfSSL 11:cee25a834751 7945 if (cert->skidSz > (int)sizeof(der->skid))
wolfSSL 11:cee25a834751 7946 return SKID_E;
wolfSSL 11:cee25a834751 7947
wolfSSL 11:cee25a834751 7948 /* Note: different skid buffers sizes for der (MAX_KID_SZ) and
wolfSSL 11:cee25a834751 7949 cert (CTC_MAX_SKID_SIZE). */
wolfSSL 11:cee25a834751 7950 der->skidSz = SetSKID(der->skid, sizeof(der->skid),
wolfSSL 11:cee25a834751 7951 cert->skid, cert->skidSz);
wolfSSL 11:cee25a834751 7952 if (der->skidSz <= 0)
wolfSSL 11:cee25a834751 7953 return SKID_E;
wolfSSL 11:cee25a834751 7954
wolfSSL 11:cee25a834751 7955 der->extensionsSz += der->skidSz;
wolfSSL 11:cee25a834751 7956 }
wolfSSL 11:cee25a834751 7957 else
wolfSSL 11:cee25a834751 7958 der->skidSz = 0;
wolfSSL 11:cee25a834751 7959
wolfSSL 11:cee25a834751 7960 /* AKID */
wolfSSL 11:cee25a834751 7961 if (cert->akidSz) {
wolfSSL 11:cee25a834751 7962 /* check the provided AKID size */
wolfSSL 11:cee25a834751 7963 if (cert->akidSz > (int)sizeof(der->akid))
wolfSSL 11:cee25a834751 7964 return AKID_E;
wolfSSL 11:cee25a834751 7965
wolfSSL 11:cee25a834751 7966 der->akidSz = SetAKID(der->akid, sizeof(der->akid),
wolfSSL 11:cee25a834751 7967 cert->akid, cert->akidSz, cert->heap);
wolfSSL 11:cee25a834751 7968 if (der->akidSz <= 0)
wolfSSL 11:cee25a834751 7969 return AKID_E;
wolfSSL 11:cee25a834751 7970
wolfSSL 11:cee25a834751 7971 der->extensionsSz += der->akidSz;
wolfSSL 11:cee25a834751 7972 }
wolfSSL 11:cee25a834751 7973 else
wolfSSL 11:cee25a834751 7974 der->akidSz = 0;
wolfSSL 11:cee25a834751 7975
wolfSSL 11:cee25a834751 7976 /* Key Usage */
wolfSSL 11:cee25a834751 7977 if (cert->keyUsage != 0){
wolfSSL 11:cee25a834751 7978 der->keyUsageSz = SetKeyUsage(der->keyUsage, sizeof(der->keyUsage),
wolfSSL 11:cee25a834751 7979 cert->keyUsage);
wolfSSL 11:cee25a834751 7980 if (der->keyUsageSz <= 0)
wolfSSL 11:cee25a834751 7981 return KEYUSAGE_E;
wolfSSL 11:cee25a834751 7982
wolfSSL 11:cee25a834751 7983 der->extensionsSz += der->keyUsageSz;
wolfSSL 11:cee25a834751 7984 }
wolfSSL 11:cee25a834751 7985 else
wolfSSL 11:cee25a834751 7986 der->keyUsageSz = 0;
wolfSSL 11:cee25a834751 7987
wolfSSL 11:cee25a834751 7988 /* Certificate Policies */
wolfSSL 11:cee25a834751 7989 if (cert->certPoliciesNb != 0) {
wolfSSL 11:cee25a834751 7990 der->certPoliciesSz = SetCertificatePolicies(der->certPolicies,
wolfSSL 11:cee25a834751 7991 sizeof(der->certPolicies),
wolfSSL 11:cee25a834751 7992 cert->certPolicies,
wolfSSL 11:cee25a834751 7993 cert->certPoliciesNb,
wolfSSL 11:cee25a834751 7994 cert->heap);
wolfSSL 11:cee25a834751 7995 if (der->certPoliciesSz <= 0)
wolfSSL 11:cee25a834751 7996 return CERTPOLICIES_E;
wolfSSL 11:cee25a834751 7997
wolfSSL 11:cee25a834751 7998 der->extensionsSz += der->certPoliciesSz;
wolfSSL 11:cee25a834751 7999 }
wolfSSL 11:cee25a834751 8000 else
wolfSSL 11:cee25a834751 8001 der->certPoliciesSz = 0;
wolfSSL 11:cee25a834751 8002 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 8003
wolfSSL 11:cee25a834751 8004 /* put extensions */
wolfSSL 11:cee25a834751 8005 if (der->extensionsSz > 0) {
wolfSSL 11:cee25a834751 8006
wolfSSL 11:cee25a834751 8007 /* put the start of extensions sequence (ID, Size) */
wolfSSL 11:cee25a834751 8008 der->extensionsSz = SetExtensionsHeader(der->extensions,
wolfSSL 11:cee25a834751 8009 sizeof(der->extensions),
wolfSSL 11:cee25a834751 8010 der->extensionsSz);
wolfSSL 11:cee25a834751 8011 if (der->extensionsSz <= 0)
wolfSSL 11:cee25a834751 8012 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8013
wolfSSL 11:cee25a834751 8014 /* put CA */
wolfSSL 11:cee25a834751 8015 if (der->caSz) {
wolfSSL 11:cee25a834751 8016 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8017 &der->extensionsSz,
wolfSSL 11:cee25a834751 8018 der->ca, der->caSz);
wolfSSL 11:cee25a834751 8019 if (ret == 0)
wolfSSL 11:cee25a834751 8020 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8021 }
wolfSSL 11:cee25a834751 8022
wolfSSL 11:cee25a834751 8023 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 8024 /* put Alternative Names */
wolfSSL 11:cee25a834751 8025 if (der->altNamesSz) {
wolfSSL 11:cee25a834751 8026 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8027 &der->extensionsSz,
wolfSSL 11:cee25a834751 8028 der->altNames, der->altNamesSz);
wolfSSL 11:cee25a834751 8029 if (ret <= 0)
wolfSSL 11:cee25a834751 8030 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8031 }
wolfSSL 11:cee25a834751 8032 #endif
wolfSSL 11:cee25a834751 8033
wolfSSL 11:cee25a834751 8034 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 8035 /* put SKID */
wolfSSL 11:cee25a834751 8036 if (der->skidSz) {
wolfSSL 11:cee25a834751 8037 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8038 &der->extensionsSz,
wolfSSL 11:cee25a834751 8039 der->skid, der->skidSz);
wolfSSL 11:cee25a834751 8040 if (ret <= 0)
wolfSSL 11:cee25a834751 8041 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8042 }
wolfSSL 11:cee25a834751 8043
wolfSSL 11:cee25a834751 8044 /* put AKID */
wolfSSL 11:cee25a834751 8045 if (der->akidSz) {
wolfSSL 11:cee25a834751 8046 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8047 &der->extensionsSz,
wolfSSL 11:cee25a834751 8048 der->akid, der->akidSz);
wolfSSL 11:cee25a834751 8049 if (ret <= 0)
wolfSSL 11:cee25a834751 8050 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8051 }
wolfSSL 11:cee25a834751 8052
wolfSSL 11:cee25a834751 8053 /* put KeyUsage */
wolfSSL 11:cee25a834751 8054 if (der->keyUsageSz) {
wolfSSL 11:cee25a834751 8055 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8056 &der->extensionsSz,
wolfSSL 11:cee25a834751 8057 der->keyUsage, der->keyUsageSz);
wolfSSL 11:cee25a834751 8058 if (ret <= 0)
wolfSSL 11:cee25a834751 8059 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8060 }
wolfSSL 11:cee25a834751 8061
wolfSSL 11:cee25a834751 8062 /* put Certificate Policies */
wolfSSL 11:cee25a834751 8063 if (der->certPoliciesSz) {
wolfSSL 11:cee25a834751 8064 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8065 &der->extensionsSz,
wolfSSL 11:cee25a834751 8066 der->certPolicies, der->certPoliciesSz);
wolfSSL 11:cee25a834751 8067 if (ret <= 0)
wolfSSL 11:cee25a834751 8068 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8069 }
wolfSSL 11:cee25a834751 8070 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 8071 }
wolfSSL 11:cee25a834751 8072
wolfSSL 11:cee25a834751 8073 der->total = der->versionSz + der->serialSz + der->sigAlgoSz +
wolfSSL 11:cee25a834751 8074 der->publicKeySz + der->validitySz + der->subjectSz + der->issuerSz +
wolfSSL 11:cee25a834751 8075 der->extensionsSz;
wolfSSL 11:cee25a834751 8076
wolfSSL 11:cee25a834751 8077 return 0;
wolfSSL 11:cee25a834751 8078 }
wolfSSL 11:cee25a834751 8079
wolfSSL 11:cee25a834751 8080
wolfSSL 11:cee25a834751 8081 /* write DER encoded cert to buffer, size already checked */
wolfSSL 11:cee25a834751 8082 static int WriteCertBody(DerCert* der, byte* buffer)
wolfSSL 11:cee25a834751 8083 {
wolfSSL 11:cee25a834751 8084 int idx;
wolfSSL 11:cee25a834751 8085
wolfSSL 11:cee25a834751 8086 /* signed part header */
wolfSSL 11:cee25a834751 8087 idx = SetSequence(der->total, buffer);
wolfSSL 11:cee25a834751 8088 /* version */
wolfSSL 11:cee25a834751 8089 XMEMCPY(buffer + idx, der->version, der->versionSz);
wolfSSL 11:cee25a834751 8090 idx += der->versionSz;
wolfSSL 11:cee25a834751 8091 /* serial */
wolfSSL 11:cee25a834751 8092 XMEMCPY(buffer + idx, der->serial, der->serialSz);
wolfSSL 11:cee25a834751 8093 idx += der->serialSz;
wolfSSL 11:cee25a834751 8094 /* sig algo */
wolfSSL 11:cee25a834751 8095 XMEMCPY(buffer + idx, der->sigAlgo, der->sigAlgoSz);
wolfSSL 11:cee25a834751 8096 idx += der->sigAlgoSz;
wolfSSL 11:cee25a834751 8097 /* issuer */
wolfSSL 11:cee25a834751 8098 XMEMCPY(buffer + idx, der->issuer, der->issuerSz);
wolfSSL 11:cee25a834751 8099 idx += der->issuerSz;
wolfSSL 11:cee25a834751 8100 /* validity */
wolfSSL 11:cee25a834751 8101 XMEMCPY(buffer + idx, der->validity, der->validitySz);
wolfSSL 11:cee25a834751 8102 idx += der->validitySz;
wolfSSL 11:cee25a834751 8103 /* subject */
wolfSSL 11:cee25a834751 8104 XMEMCPY(buffer + idx, der->subject, der->subjectSz);
wolfSSL 11:cee25a834751 8105 idx += der->subjectSz;
wolfSSL 11:cee25a834751 8106 /* public key */
wolfSSL 11:cee25a834751 8107 XMEMCPY(buffer + idx, der->publicKey, der->publicKeySz);
wolfSSL 11:cee25a834751 8108 idx += der->publicKeySz;
wolfSSL 11:cee25a834751 8109 if (der->extensionsSz) {
wolfSSL 11:cee25a834751 8110 /* extensions */
wolfSSL 11:cee25a834751 8111 XMEMCPY(buffer + idx, der->extensions, min(der->extensionsSz,
wolfSSL 11:cee25a834751 8112 (int)sizeof(der->extensions)));
wolfSSL 11:cee25a834751 8113 idx += der->extensionsSz;
wolfSSL 11:cee25a834751 8114 }
wolfSSL 11:cee25a834751 8115
wolfSSL 11:cee25a834751 8116 return idx;
wolfSSL 11:cee25a834751 8117 }
wolfSSL 11:cee25a834751 8118
wolfSSL 11:cee25a834751 8119
wolfSSL 11:cee25a834751 8120 /* Make RSA signature from buffer (sz), write to sig (sigSz) */
wolfSSL 11:cee25a834751 8121 static int MakeSignature(CertSignCtx* certSignCtx, const byte* buffer, int sz,
wolfSSL 11:cee25a834751 8122 byte* sig, int sigSz, RsaKey* rsaKey, ecc_key* eccKey, WC_RNG* rng,
wolfSSL 11:cee25a834751 8123 int sigAlgoType, void* heap)
wolfSSL 11:cee25a834751 8124 {
wolfSSL 11:cee25a834751 8125 int digestSz = 0, typeH = 0, ret = 0;
wolfSSL 11:cee25a834751 8126
wolfSSL 11:cee25a834751 8127 (void)digestSz;
wolfSSL 11:cee25a834751 8128 (void)typeH;
wolfSSL 11:cee25a834751 8129 (void)buffer;
wolfSSL 11:cee25a834751 8130 (void)sz;
wolfSSL 11:cee25a834751 8131 (void)sig;
wolfSSL 11:cee25a834751 8132 (void)sigSz;
wolfSSL 11:cee25a834751 8133 (void)rsaKey;
wolfSSL 11:cee25a834751 8134 (void)eccKey;
wolfSSL 11:cee25a834751 8135 (void)rng;
wolfSSL 11:cee25a834751 8136
wolfSSL 11:cee25a834751 8137 switch (certSignCtx->state) {
wolfSSL 11:cee25a834751 8138 case CERTSIGN_STATE_BEGIN:
wolfSSL 11:cee25a834751 8139 case CERTSIGN_STATE_DIGEST:
wolfSSL 11:cee25a834751 8140
wolfSSL 11:cee25a834751 8141 certSignCtx->state = CERTSIGN_STATE_DIGEST;
wolfSSL 11:cee25a834751 8142 certSignCtx->digest = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, heap,
wolfSSL 11:cee25a834751 8143 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8144 if (certSignCtx->digest == NULL) {
wolfSSL 11:cee25a834751 8145 ret = MEMORY_E; goto exit_ms;
wolfSSL 11:cee25a834751 8146 }
wolfSSL 11:cee25a834751 8147
wolfSSL 11:cee25a834751 8148 switch (sigAlgoType) {
wolfSSL 11:cee25a834751 8149 #ifndef NO_MD5
wolfSSL 11:cee25a834751 8150 case CTC_MD5wRSA:
wolfSSL 11:cee25a834751 8151 if ((ret = wc_Md5Hash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8152 typeH = MD5h;
wolfSSL 11:cee25a834751 8153 digestSz = MD5_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8154 }
wolfSSL 11:cee25a834751 8155 break;
wolfSSL 11:cee25a834751 8156 #endif
wolfSSL 11:cee25a834751 8157 #ifndef NO_SHA
wolfSSL 11:cee25a834751 8158 case CTC_SHAwRSA:
wolfSSL 11:cee25a834751 8159 case CTC_SHAwECDSA:
wolfSSL 11:cee25a834751 8160 if ((ret = wc_ShaHash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8161 typeH = SHAh;
wolfSSL 11:cee25a834751 8162 digestSz = SHA_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8163 }
wolfSSL 11:cee25a834751 8164 break;
wolfSSL 11:cee25a834751 8165 #endif
wolfSSL 11:cee25a834751 8166 #ifdef WOLFSSL_SHA224
wolfSSL 11:cee25a834751 8167 case CTC_SHA224wRSA:
wolfSSL 11:cee25a834751 8168 case CTC_SHA224wECDSA:
wolfSSL 11:cee25a834751 8169 if ((ret = wc_Sha224Hash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8170 typeH = SHA224h;
wolfSSL 11:cee25a834751 8171 digestSz = SHA224_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8172 }
wolfSSL 11:cee25a834751 8173 break;
wolfSSL 11:cee25a834751 8174 #endif
wolfSSL 11:cee25a834751 8175 #ifndef NO_SHA256
wolfSSL 11:cee25a834751 8176 case CTC_SHA256wRSA:
wolfSSL 11:cee25a834751 8177 case CTC_SHA256wECDSA:
wolfSSL 11:cee25a834751 8178 if ((ret = wc_Sha256Hash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8179 typeH = SHA256h;
wolfSSL 11:cee25a834751 8180 digestSz = SHA256_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8181 }
wolfSSL 11:cee25a834751 8182 break;
wolfSSL 11:cee25a834751 8183 #endif
wolfSSL 11:cee25a834751 8184 #ifdef WOLFSSL_SHA384
wolfSSL 11:cee25a834751 8185 case CTC_SHA384wRSA:
wolfSSL 11:cee25a834751 8186 case CTC_SHA384wECDSA:
wolfSSL 11:cee25a834751 8187 if ((ret = wc_Sha384Hash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8188 typeH = SHA384h;
wolfSSL 11:cee25a834751 8189 digestSz = SHA384_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8190 }
wolfSSL 11:cee25a834751 8191 break;
wolfSSL 11:cee25a834751 8192 #endif
wolfSSL 11:cee25a834751 8193 #ifdef WOLFSSL_SHA512
wolfSSL 11:cee25a834751 8194 case CTC_SHA512wRSA:
wolfSSL 11:cee25a834751 8195 case CTC_SHA512wECDSA:
wolfSSL 11:cee25a834751 8196 if ((ret = wc_Sha512Hash(buffer, sz, certSignCtx->digest)) == 0) {
wolfSSL 11:cee25a834751 8197 typeH = SHA512h;
wolfSSL 11:cee25a834751 8198 digestSz = SHA512_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8199 }
wolfSSL 11:cee25a834751 8200 break;
wolfSSL 11:cee25a834751 8201 #endif
wolfSSL 11:cee25a834751 8202 default:
wolfSSL 11:cee25a834751 8203 WOLFSSL_MSG("MakeSignautre called with unsupported type");
wolfSSL 11:cee25a834751 8204 ret = ALGO_ID_E;
wolfSSL 11:cee25a834751 8205 }
wolfSSL 11:cee25a834751 8206
wolfSSL 11:cee25a834751 8207 /* set next state, since WC_PENDING rentry for these are not "call again" */
wolfSSL 11:cee25a834751 8208 certSignCtx->state = CERTSIGN_STATE_ENCODE;
wolfSSL 11:cee25a834751 8209 if (ret != 0) {
wolfSSL 11:cee25a834751 8210 goto exit_ms;
wolfSSL 11:cee25a834751 8211 }
wolfSSL 11:cee25a834751 8212
wolfSSL 11:cee25a834751 8213 /* fall-through */
wolfSSL 11:cee25a834751 8214 case CERTSIGN_STATE_ENCODE:
wolfSSL 11:cee25a834751 8215 #ifndef NO_RSA
wolfSSL 11:cee25a834751 8216 if (rsaKey) {
wolfSSL 11:cee25a834751 8217 certSignCtx->encSig = (byte*)XMALLOC(MAX_DER_DIGEST_SZ, heap,
wolfSSL 11:cee25a834751 8218 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8219 if (certSignCtx->encSig == NULL) {
wolfSSL 11:cee25a834751 8220 ret = MEMORY_E; goto exit_ms;
wolfSSL 11:cee25a834751 8221 }
wolfSSL 11:cee25a834751 8222
wolfSSL 11:cee25a834751 8223 /* signature */
wolfSSL 11:cee25a834751 8224 certSignCtx->encSigSz = wc_EncodeSignature(certSignCtx->encSig,
wolfSSL 11:cee25a834751 8225 certSignCtx->digest, digestSz, typeH);
wolfSSL 11:cee25a834751 8226 }
wolfSSL 11:cee25a834751 8227 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 8228
wolfSSL 11:cee25a834751 8229 /* fall-through */
wolfSSL 11:cee25a834751 8230 case CERTSIGN_STATE_DO:
wolfSSL 11:cee25a834751 8231 certSignCtx->state = CERTSIGN_STATE_DO;
wolfSSL 11:cee25a834751 8232 ret = ALGO_ID_E; /* default to error */
wolfSSL 11:cee25a834751 8233
wolfSSL 11:cee25a834751 8234 #ifndef NO_RSA
wolfSSL 11:cee25a834751 8235 if (rsaKey) {
wolfSSL 11:cee25a834751 8236 /* signature */
wolfSSL 11:cee25a834751 8237 ret = wc_RsaSSL_Sign(certSignCtx->encSig, certSignCtx->encSigSz,
wolfSSL 11:cee25a834751 8238 sig, sigSz, rsaKey, rng);
wolfSSL 11:cee25a834751 8239 }
wolfSSL 11:cee25a834751 8240 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 8241
wolfSSL 11:cee25a834751 8242 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 8243 if (!rsaKey && eccKey) {
wolfSSL 11:cee25a834751 8244 word32 outSz = sigSz;
wolfSSL 11:cee25a834751 8245
wolfSSL 11:cee25a834751 8246 ret = wc_ecc_sign_hash(certSignCtx->digest, digestSz,
wolfSSL 11:cee25a834751 8247 sig, &outSz, rng, eccKey);
wolfSSL 11:cee25a834751 8248 if (ret == 0)
wolfSSL 11:cee25a834751 8249 ret = outSz;
wolfSSL 11:cee25a834751 8250 }
wolfSSL 11:cee25a834751 8251 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 8252 break;
wolfSSL 11:cee25a834751 8253 }
wolfSSL 11:cee25a834751 8254
wolfSSL 11:cee25a834751 8255 exit_ms:
wolfSSL 11:cee25a834751 8256
wolfSSL 11:cee25a834751 8257 if (ret == WC_PENDING_E) {
wolfSSL 11:cee25a834751 8258 return ret;
wolfSSL 11:cee25a834751 8259 }
wolfSSL 11:cee25a834751 8260
wolfSSL 11:cee25a834751 8261 #ifndef NO_RSA
wolfSSL 11:cee25a834751 8262 if (rsaKey) {
wolfSSL 11:cee25a834751 8263 XFREE(certSignCtx->encSig, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8264 }
wolfSSL 11:cee25a834751 8265 #endif /* !NO_RSA */
wolfSSL 11:cee25a834751 8266
wolfSSL 11:cee25a834751 8267 XFREE(certSignCtx->digest, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8268 certSignCtx->digest = NULL;
wolfSSL 11:cee25a834751 8269
wolfSSL 11:cee25a834751 8270 /* reset state */
wolfSSL 11:cee25a834751 8271 certSignCtx->state = CERTSIGN_STATE_BEGIN;
wolfSSL 11:cee25a834751 8272
wolfSSL 11:cee25a834751 8273 return ret;
wolfSSL 11:cee25a834751 8274 }
wolfSSL 11:cee25a834751 8275
wolfSSL 11:cee25a834751 8276
wolfSSL 11:cee25a834751 8277 /* add signature to end of buffer, size of buffer assumed checked, return
wolfSSL 11:cee25a834751 8278 new length */
wolfSSL 11:cee25a834751 8279 static int AddSignature(byte* buffer, int bodySz, const byte* sig, int sigSz,
wolfSSL 11:cee25a834751 8280 int sigAlgoType)
wolfSSL 11:cee25a834751 8281 {
wolfSSL 11:cee25a834751 8282 byte seq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 8283 int idx = bodySz, seqSz;
wolfSSL 11:cee25a834751 8284
wolfSSL 11:cee25a834751 8285 /* algo */
wolfSSL 11:cee25a834751 8286 idx += SetAlgoID(sigAlgoType, buffer + idx, oidSigType, 0);
wolfSSL 11:cee25a834751 8287 /* bit string */
wolfSSL 11:cee25a834751 8288 idx += SetBitString(sigSz, 0, buffer + idx);
wolfSSL 11:cee25a834751 8289 /* signature */
wolfSSL 11:cee25a834751 8290 XMEMCPY(buffer + idx, sig, sigSz);
wolfSSL 11:cee25a834751 8291 idx += sigSz;
wolfSSL 11:cee25a834751 8292
wolfSSL 11:cee25a834751 8293 /* make room for overall header */
wolfSSL 11:cee25a834751 8294 seqSz = SetSequence(idx, seq);
wolfSSL 11:cee25a834751 8295 XMEMMOVE(buffer + seqSz, buffer, idx);
wolfSSL 11:cee25a834751 8296 XMEMCPY(buffer, seq, seqSz);
wolfSSL 11:cee25a834751 8297
wolfSSL 11:cee25a834751 8298 return idx + seqSz;
wolfSSL 11:cee25a834751 8299 }
wolfSSL 11:cee25a834751 8300
wolfSSL 11:cee25a834751 8301
wolfSSL 11:cee25a834751 8302 /* Make an x509 Certificate v3 any key type from cert input, write to buffer */
wolfSSL 11:cee25a834751 8303 static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
wolfSSL 11:cee25a834751 8304 RsaKey* rsaKey, ecc_key* eccKey, WC_RNG* rng,
wolfSSL 11:cee25a834751 8305 const byte* ntruKey, word16 ntruSz)
wolfSSL 11:cee25a834751 8306 {
wolfSSL 11:cee25a834751 8307 int ret;
wolfSSL 11:cee25a834751 8308 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8309 DerCert* der;
wolfSSL 11:cee25a834751 8310 #else
wolfSSL 11:cee25a834751 8311 DerCert der[1];
wolfSSL 11:cee25a834751 8312 #endif
wolfSSL 11:cee25a834751 8313
wolfSSL 11:cee25a834751 8314 cert->keyType = eccKey ? ECC_KEY : (rsaKey ? RSA_KEY : NTRU_KEY);
wolfSSL 11:cee25a834751 8315
wolfSSL 11:cee25a834751 8316 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8317 der = (DerCert*)XMALLOC(sizeof(DerCert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8318 if (der == NULL)
wolfSSL 11:cee25a834751 8319 return MEMORY_E;
wolfSSL 11:cee25a834751 8320 #endif
wolfSSL 11:cee25a834751 8321
wolfSSL 11:cee25a834751 8322 ret = EncodeCert(cert, der, rsaKey, eccKey, rng, ntruKey, ntruSz);
wolfSSL 11:cee25a834751 8323 if (ret == 0) {
wolfSSL 11:cee25a834751 8324 if (der->total + MAX_SEQ_SZ * 2 > (int)derSz)
wolfSSL 11:cee25a834751 8325 ret = BUFFER_E;
wolfSSL 11:cee25a834751 8326 else
wolfSSL 11:cee25a834751 8327 ret = cert->bodySz = WriteCertBody(der, derBuffer);
wolfSSL 11:cee25a834751 8328 }
wolfSSL 11:cee25a834751 8329
wolfSSL 11:cee25a834751 8330 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8331 XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8332 #endif
wolfSSL 11:cee25a834751 8333
wolfSSL 11:cee25a834751 8334 return ret;
wolfSSL 11:cee25a834751 8335 }
wolfSSL 11:cee25a834751 8336
wolfSSL 11:cee25a834751 8337
wolfSSL 11:cee25a834751 8338 /* Make an x509 Certificate v3 RSA or ECC from cert input, write to buffer */
wolfSSL 11:cee25a834751 8339 int wc_MakeCert(Cert* cert, byte* derBuffer, word32 derSz, RsaKey* rsaKey,
wolfSSL 11:cee25a834751 8340 ecc_key* eccKey, WC_RNG* rng)
wolfSSL 11:cee25a834751 8341 {
wolfSSL 11:cee25a834751 8342 return MakeAnyCert(cert, derBuffer, derSz, rsaKey, eccKey, rng, NULL, 0);
wolfSSL 11:cee25a834751 8343 }
wolfSSL 11:cee25a834751 8344
wolfSSL 11:cee25a834751 8345
wolfSSL 11:cee25a834751 8346 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 8347
wolfSSL 11:cee25a834751 8348 int wc_MakeNtruCert(Cert* cert, byte* derBuffer, word32 derSz,
wolfSSL 11:cee25a834751 8349 const byte* ntruKey, word16 keySz, WC_RNG* rng)
wolfSSL 11:cee25a834751 8350 {
wolfSSL 11:cee25a834751 8351 return MakeAnyCert(cert, derBuffer, derSz, NULL, NULL, rng, ntruKey, keySz);
wolfSSL 11:cee25a834751 8352 }
wolfSSL 11:cee25a834751 8353
wolfSSL 11:cee25a834751 8354 #endif /* HAVE_NTRU */
wolfSSL 11:cee25a834751 8355
wolfSSL 11:cee25a834751 8356
wolfSSL 11:cee25a834751 8357 #ifdef WOLFSSL_CERT_REQ
wolfSSL 11:cee25a834751 8358
wolfSSL 11:cee25a834751 8359 static int SetReqAttrib(byte* output, char* pw, int extSz)
wolfSSL 11:cee25a834751 8360 {
wolfSSL 11:cee25a834751 8361 static const byte cpOid[] =
wolfSSL 11:cee25a834751 8362 { ASN_OBJECT_ID, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
wolfSSL 11:cee25a834751 8363 0x09, 0x07 };
wolfSSL 11:cee25a834751 8364 static const byte erOid[] =
wolfSSL 11:cee25a834751 8365 { ASN_OBJECT_ID, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
wolfSSL 11:cee25a834751 8366 0x09, 0x0e };
wolfSSL 11:cee25a834751 8367
wolfSSL 11:cee25a834751 8368 int sz = 0; /* overall size */
wolfSSL 11:cee25a834751 8369 int cpSz = 0; /* Challenge Password section size */
wolfSSL 11:cee25a834751 8370 int cpSeqSz = 0;
wolfSSL 11:cee25a834751 8371 int cpSetSz = 0;
wolfSSL 11:cee25a834751 8372 int cpStrSz = 0;
wolfSSL 11:cee25a834751 8373 int pwSz = 0;
wolfSSL 11:cee25a834751 8374 int erSz = 0; /* Extension Request section size */
wolfSSL 11:cee25a834751 8375 int erSeqSz = 0;
wolfSSL 11:cee25a834751 8376 int erSetSz = 0;
wolfSSL 11:cee25a834751 8377 byte cpSeq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 8378 byte cpSet[MAX_SET_SZ];
wolfSSL 11:cee25a834751 8379 byte cpStr[MAX_PRSTR_SZ];
wolfSSL 11:cee25a834751 8380 byte erSeq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 8381 byte erSet[MAX_SET_SZ];
wolfSSL 11:cee25a834751 8382
wolfSSL 11:cee25a834751 8383 output[0] = 0xa0;
wolfSSL 11:cee25a834751 8384 sz++;
wolfSSL 11:cee25a834751 8385
wolfSSL 11:cee25a834751 8386 if (pw && pw[0]) {
wolfSSL 11:cee25a834751 8387 pwSz = (int)XSTRLEN(pw);
wolfSSL 11:cee25a834751 8388 cpStrSz = SetUTF8String(pwSz, cpStr);
wolfSSL 11:cee25a834751 8389 cpSetSz = SetSet(cpStrSz + pwSz, cpSet);
wolfSSL 11:cee25a834751 8390 cpSeqSz = SetSequence(sizeof(cpOid) + cpSetSz + cpStrSz + pwSz, cpSeq);
wolfSSL 11:cee25a834751 8391 cpSz = cpSeqSz + sizeof(cpOid) + cpSetSz + cpStrSz + pwSz;
wolfSSL 11:cee25a834751 8392 }
wolfSSL 11:cee25a834751 8393
wolfSSL 11:cee25a834751 8394 if (extSz) {
wolfSSL 11:cee25a834751 8395 erSetSz = SetSet(extSz, erSet);
wolfSSL 11:cee25a834751 8396 erSeqSz = SetSequence(erSetSz + sizeof(erOid) + extSz, erSeq);
wolfSSL 11:cee25a834751 8397 erSz = extSz + erSetSz + erSeqSz + sizeof(erOid);
wolfSSL 11:cee25a834751 8398 }
wolfSSL 11:cee25a834751 8399
wolfSSL 11:cee25a834751 8400 /* Put the pieces together. */
wolfSSL 11:cee25a834751 8401 sz += SetLength(cpSz + erSz, &output[sz]);
wolfSSL 11:cee25a834751 8402
wolfSSL 11:cee25a834751 8403 if (cpSz) {
wolfSSL 11:cee25a834751 8404 XMEMCPY(&output[sz], cpSeq, cpSeqSz);
wolfSSL 11:cee25a834751 8405 sz += cpSeqSz;
wolfSSL 11:cee25a834751 8406 XMEMCPY(&output[sz], cpOid, sizeof(cpOid));
wolfSSL 11:cee25a834751 8407 sz += sizeof(cpOid);
wolfSSL 11:cee25a834751 8408 XMEMCPY(&output[sz], cpSet, cpSetSz);
wolfSSL 11:cee25a834751 8409 sz += cpSetSz;
wolfSSL 11:cee25a834751 8410 XMEMCPY(&output[sz], cpStr, cpStrSz);
wolfSSL 11:cee25a834751 8411 sz += cpStrSz;
wolfSSL 11:cee25a834751 8412 XMEMCPY(&output[sz], pw, pwSz);
wolfSSL 11:cee25a834751 8413 sz += pwSz;
wolfSSL 11:cee25a834751 8414 }
wolfSSL 11:cee25a834751 8415
wolfSSL 11:cee25a834751 8416 if (erSz) {
wolfSSL 11:cee25a834751 8417 XMEMCPY(&output[sz], erSeq, erSeqSz);
wolfSSL 11:cee25a834751 8418 sz += erSeqSz;
wolfSSL 11:cee25a834751 8419 XMEMCPY(&output[sz], erOid, sizeof(erOid));
wolfSSL 11:cee25a834751 8420 sz += sizeof(erOid);
wolfSSL 11:cee25a834751 8421 XMEMCPY(&output[sz], erSet, erSetSz);
wolfSSL 11:cee25a834751 8422 sz += erSetSz;
wolfSSL 11:cee25a834751 8423 /* The actual extension data will be tacked onto the output later. */
wolfSSL 11:cee25a834751 8424 }
wolfSSL 11:cee25a834751 8425
wolfSSL 11:cee25a834751 8426 return sz;
wolfSSL 11:cee25a834751 8427 }
wolfSSL 11:cee25a834751 8428
wolfSSL 11:cee25a834751 8429
wolfSSL 11:cee25a834751 8430 /* encode info from cert into DER encoded format */
wolfSSL 11:cee25a834751 8431 static int EncodeCertReq(Cert* cert, DerCert* der,
wolfSSL 11:cee25a834751 8432 RsaKey* rsaKey, ecc_key* eccKey)
wolfSSL 11:cee25a834751 8433 {
wolfSSL 11:cee25a834751 8434 (void)eccKey;
wolfSSL 11:cee25a834751 8435
wolfSSL 11:cee25a834751 8436 if (cert == NULL || der == NULL)
wolfSSL 11:cee25a834751 8437 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8438
wolfSSL 11:cee25a834751 8439 /* init */
wolfSSL 11:cee25a834751 8440 XMEMSET(der, 0, sizeof(DerCert));
wolfSSL 11:cee25a834751 8441
wolfSSL 11:cee25a834751 8442 /* version */
wolfSSL 11:cee25a834751 8443 der->versionSz = SetMyVersion(cert->version, der->version, FALSE);
wolfSSL 11:cee25a834751 8444
wolfSSL 11:cee25a834751 8445 /* subject name */
wolfSSL 11:cee25a834751 8446 der->subjectSz = SetName(der->subject, sizeof(der->subject), &cert->subject);
wolfSSL 11:cee25a834751 8447 if (der->subjectSz <= 0)
wolfSSL 11:cee25a834751 8448 return SUBJECT_E;
wolfSSL 11:cee25a834751 8449
wolfSSL 11:cee25a834751 8450 /* public key */
wolfSSL 11:cee25a834751 8451 if (cert->keyType == RSA_KEY) {
wolfSSL 11:cee25a834751 8452 if (rsaKey == NULL)
wolfSSL 11:cee25a834751 8453 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8454 der->publicKeySz = SetRsaPublicKey(der->publicKey, rsaKey,
wolfSSL 11:cee25a834751 8455 sizeof(der->publicKey), 1);
wolfSSL 11:cee25a834751 8456 if (der->publicKeySz <= 0)
wolfSSL 11:cee25a834751 8457 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8458 }
wolfSSL 11:cee25a834751 8459
wolfSSL 11:cee25a834751 8460 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 8461 if (cert->keyType == ECC_KEY) {
wolfSSL 11:cee25a834751 8462 if (eccKey == NULL)
wolfSSL 11:cee25a834751 8463 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8464 der->publicKeySz = SetEccPublicKey(der->publicKey, eccKey, 1);
wolfSSL 11:cee25a834751 8465 if (der->publicKeySz <= 0)
wolfSSL 11:cee25a834751 8466 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8467 }
wolfSSL 11:cee25a834751 8468 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 8469
wolfSSL 11:cee25a834751 8470 /* set the extensions */
wolfSSL 11:cee25a834751 8471 der->extensionsSz = 0;
wolfSSL 11:cee25a834751 8472
wolfSSL 11:cee25a834751 8473 /* CA */
wolfSSL 11:cee25a834751 8474 if (cert->isCA) {
wolfSSL 11:cee25a834751 8475 der->caSz = SetCa(der->ca, sizeof(der->ca));
wolfSSL 11:cee25a834751 8476 if (der->caSz <= 0)
wolfSSL 11:cee25a834751 8477 return CA_TRUE_E;
wolfSSL 11:cee25a834751 8478
wolfSSL 11:cee25a834751 8479 der->extensionsSz += der->caSz;
wolfSSL 11:cee25a834751 8480 }
wolfSSL 11:cee25a834751 8481 else
wolfSSL 11:cee25a834751 8482 der->caSz = 0;
wolfSSL 11:cee25a834751 8483
wolfSSL 11:cee25a834751 8484 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 8485 /* SKID */
wolfSSL 11:cee25a834751 8486 if (cert->skidSz) {
wolfSSL 11:cee25a834751 8487 /* check the provided SKID size */
wolfSSL 11:cee25a834751 8488 if (cert->skidSz > (int)sizeof(der->skid))
wolfSSL 11:cee25a834751 8489 return SKID_E;
wolfSSL 11:cee25a834751 8490
wolfSSL 11:cee25a834751 8491 der->skidSz = SetSKID(der->skid, sizeof(der->skid),
wolfSSL 11:cee25a834751 8492 cert->skid, cert->skidSz);
wolfSSL 11:cee25a834751 8493 if (der->skidSz <= 0)
wolfSSL 11:cee25a834751 8494 return SKID_E;
wolfSSL 11:cee25a834751 8495
wolfSSL 11:cee25a834751 8496 der->extensionsSz += der->skidSz;
wolfSSL 11:cee25a834751 8497 }
wolfSSL 11:cee25a834751 8498 else
wolfSSL 11:cee25a834751 8499 der->skidSz = 0;
wolfSSL 11:cee25a834751 8500
wolfSSL 11:cee25a834751 8501 /* Key Usage */
wolfSSL 11:cee25a834751 8502 if (cert->keyUsage != 0){
wolfSSL 11:cee25a834751 8503 der->keyUsageSz = SetKeyUsage(der->keyUsage, sizeof(der->keyUsage),
wolfSSL 11:cee25a834751 8504 cert->keyUsage);
wolfSSL 11:cee25a834751 8505 if (der->keyUsageSz <= 0)
wolfSSL 11:cee25a834751 8506 return KEYUSAGE_E;
wolfSSL 11:cee25a834751 8507
wolfSSL 11:cee25a834751 8508 der->extensionsSz += der->keyUsageSz;
wolfSSL 11:cee25a834751 8509 }
wolfSSL 11:cee25a834751 8510 else
wolfSSL 11:cee25a834751 8511 der->keyUsageSz = 0;
wolfSSL 11:cee25a834751 8512 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 8513
wolfSSL 11:cee25a834751 8514 /* put extensions */
wolfSSL 11:cee25a834751 8515 if (der->extensionsSz > 0) {
wolfSSL 11:cee25a834751 8516 int ret;
wolfSSL 11:cee25a834751 8517
wolfSSL 11:cee25a834751 8518 /* put the start of sequence (ID, Size) */
wolfSSL 11:cee25a834751 8519 der->extensionsSz = SetSequence(der->extensionsSz, der->extensions);
wolfSSL 11:cee25a834751 8520 if (der->extensionsSz <= 0)
wolfSSL 11:cee25a834751 8521 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8522
wolfSSL 11:cee25a834751 8523 /* put CA */
wolfSSL 11:cee25a834751 8524 if (der->caSz) {
wolfSSL 11:cee25a834751 8525 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8526 &der->extensionsSz,
wolfSSL 11:cee25a834751 8527 der->ca, der->caSz);
wolfSSL 11:cee25a834751 8528 if (ret <= 0)
wolfSSL 11:cee25a834751 8529 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8530 }
wolfSSL 11:cee25a834751 8531
wolfSSL 11:cee25a834751 8532 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 8533 /* put SKID */
wolfSSL 11:cee25a834751 8534 if (der->skidSz) {
wolfSSL 11:cee25a834751 8535 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8536 &der->extensionsSz,
wolfSSL 11:cee25a834751 8537 der->skid, der->skidSz);
wolfSSL 11:cee25a834751 8538 if (ret <= 0)
wolfSSL 11:cee25a834751 8539 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8540 }
wolfSSL 11:cee25a834751 8541
wolfSSL 11:cee25a834751 8542 /* put AKID */
wolfSSL 11:cee25a834751 8543 if (der->akidSz) {
wolfSSL 11:cee25a834751 8544 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8545 &der->extensionsSz,
wolfSSL 11:cee25a834751 8546 der->akid, der->akidSz);
wolfSSL 11:cee25a834751 8547 if (ret <= 0)
wolfSSL 11:cee25a834751 8548 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8549 }
wolfSSL 11:cee25a834751 8550
wolfSSL 11:cee25a834751 8551 /* put KeyUsage */
wolfSSL 11:cee25a834751 8552 if (der->keyUsageSz) {
wolfSSL 11:cee25a834751 8553 ret = SetExtensions(der->extensions, sizeof(der->extensions),
wolfSSL 11:cee25a834751 8554 &der->extensionsSz,
wolfSSL 11:cee25a834751 8555 der->keyUsage, der->keyUsageSz);
wolfSSL 11:cee25a834751 8556 if (ret <= 0)
wolfSSL 11:cee25a834751 8557 return EXTENSIONS_E;
wolfSSL 11:cee25a834751 8558 }
wolfSSL 11:cee25a834751 8559
wolfSSL 11:cee25a834751 8560 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 8561 }
wolfSSL 11:cee25a834751 8562
wolfSSL 11:cee25a834751 8563 der->attribSz = SetReqAttrib(der->attrib,
wolfSSL 11:cee25a834751 8564 cert->challengePw, der->extensionsSz);
wolfSSL 11:cee25a834751 8565 if (der->attribSz <= 0)
wolfSSL 11:cee25a834751 8566 return REQ_ATTRIBUTE_E;
wolfSSL 11:cee25a834751 8567
wolfSSL 11:cee25a834751 8568 der->total = der->versionSz + der->subjectSz + der->publicKeySz +
wolfSSL 11:cee25a834751 8569 der->extensionsSz + der->attribSz;
wolfSSL 11:cee25a834751 8570
wolfSSL 11:cee25a834751 8571 return 0;
wolfSSL 11:cee25a834751 8572 }
wolfSSL 11:cee25a834751 8573
wolfSSL 11:cee25a834751 8574
wolfSSL 11:cee25a834751 8575 /* write DER encoded cert req to buffer, size already checked */
wolfSSL 11:cee25a834751 8576 static int WriteCertReqBody(DerCert* der, byte* buffer)
wolfSSL 11:cee25a834751 8577 {
wolfSSL 11:cee25a834751 8578 int idx;
wolfSSL 11:cee25a834751 8579
wolfSSL 11:cee25a834751 8580 /* signed part header */
wolfSSL 11:cee25a834751 8581 idx = SetSequence(der->total, buffer);
wolfSSL 11:cee25a834751 8582 /* version */
wolfSSL 11:cee25a834751 8583 XMEMCPY(buffer + idx, der->version, der->versionSz);
wolfSSL 11:cee25a834751 8584 idx += der->versionSz;
wolfSSL 11:cee25a834751 8585 /* subject */
wolfSSL 11:cee25a834751 8586 XMEMCPY(buffer + idx, der->subject, der->subjectSz);
wolfSSL 11:cee25a834751 8587 idx += der->subjectSz;
wolfSSL 11:cee25a834751 8588 /* public key */
wolfSSL 11:cee25a834751 8589 XMEMCPY(buffer + idx, der->publicKey, der->publicKeySz);
wolfSSL 11:cee25a834751 8590 idx += der->publicKeySz;
wolfSSL 11:cee25a834751 8591 /* attributes */
wolfSSL 11:cee25a834751 8592 XMEMCPY(buffer + idx, der->attrib, der->attribSz);
wolfSSL 11:cee25a834751 8593 idx += der->attribSz;
wolfSSL 11:cee25a834751 8594 /* extensions */
wolfSSL 11:cee25a834751 8595 if (der->extensionsSz) {
wolfSSL 11:cee25a834751 8596 XMEMCPY(buffer + idx, der->extensions, min(der->extensionsSz,
wolfSSL 11:cee25a834751 8597 (int)sizeof(der->extensions)));
wolfSSL 11:cee25a834751 8598 idx += der->extensionsSz;
wolfSSL 11:cee25a834751 8599 }
wolfSSL 11:cee25a834751 8600
wolfSSL 11:cee25a834751 8601 return idx;
wolfSSL 11:cee25a834751 8602 }
wolfSSL 11:cee25a834751 8603
wolfSSL 11:cee25a834751 8604
wolfSSL 11:cee25a834751 8605 int wc_MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
wolfSSL 11:cee25a834751 8606 RsaKey* rsaKey, ecc_key* eccKey)
wolfSSL 11:cee25a834751 8607 {
wolfSSL 11:cee25a834751 8608 int ret;
wolfSSL 11:cee25a834751 8609 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8610 DerCert* der;
wolfSSL 11:cee25a834751 8611 #else
wolfSSL 11:cee25a834751 8612 DerCert der[1];
wolfSSL 11:cee25a834751 8613 #endif
wolfSSL 11:cee25a834751 8614
wolfSSL 11:cee25a834751 8615 cert->keyType = eccKey ? ECC_KEY : RSA_KEY;
wolfSSL 11:cee25a834751 8616
wolfSSL 11:cee25a834751 8617 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8618 der = (DerCert*)XMALLOC(sizeof(DerCert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8619 if (der == NULL)
wolfSSL 11:cee25a834751 8620 return MEMORY_E;
wolfSSL 11:cee25a834751 8621 #endif
wolfSSL 11:cee25a834751 8622
wolfSSL 11:cee25a834751 8623 ret = EncodeCertReq(cert, der, rsaKey, eccKey);
wolfSSL 11:cee25a834751 8624
wolfSSL 11:cee25a834751 8625 if (ret == 0) {
wolfSSL 11:cee25a834751 8626 if (der->total + MAX_SEQ_SZ * 2 > (int)derSz)
wolfSSL 11:cee25a834751 8627 ret = BUFFER_E;
wolfSSL 11:cee25a834751 8628 else
wolfSSL 11:cee25a834751 8629 ret = cert->bodySz = WriteCertReqBody(der, derBuffer);
wolfSSL 11:cee25a834751 8630 }
wolfSSL 11:cee25a834751 8631
wolfSSL 11:cee25a834751 8632 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8633 XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8634 #endif
wolfSSL 11:cee25a834751 8635
wolfSSL 11:cee25a834751 8636 return ret;
wolfSSL 11:cee25a834751 8637 }
wolfSSL 11:cee25a834751 8638
wolfSSL 11:cee25a834751 8639 #endif /* WOLFSSL_CERT_REQ */
wolfSSL 11:cee25a834751 8640
wolfSSL 11:cee25a834751 8641
wolfSSL 11:cee25a834751 8642 int wc_SignCert(int requestSz, int sType, byte* buffer, word32 buffSz,
wolfSSL 11:cee25a834751 8643 RsaKey* rsaKey, ecc_key* eccKey, WC_RNG* rng)
wolfSSL 11:cee25a834751 8644 {
wolfSSL 11:cee25a834751 8645 int sigSz = 0;
wolfSSL 11:cee25a834751 8646 void* heap = NULL;
wolfSSL 11:cee25a834751 8647 CertSignCtx* certSignCtx = NULL;
wolfSSL 11:cee25a834751 8648 #ifndef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 8649 CertSignCtx certSignCtx_lcl;
wolfSSL 11:cee25a834751 8650 certSignCtx = &certSignCtx_lcl;
wolfSSL 11:cee25a834751 8651 XMEMSET(certSignCtx, 0, sizeof(CertSignCtx));
wolfSSL 11:cee25a834751 8652 #endif
wolfSSL 11:cee25a834751 8653
wolfSSL 11:cee25a834751 8654 if (requestSz < 0)
wolfSSL 11:cee25a834751 8655 return requestSz;
wolfSSL 11:cee25a834751 8656
wolfSSL 11:cee25a834751 8657 /* locate ctx */
wolfSSL 11:cee25a834751 8658 if (rsaKey) {
wolfSSL 11:cee25a834751 8659 #ifdef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 8660 certSignCtx = &rsaKey->certSignCtx;
wolfSSL 11:cee25a834751 8661 #endif
wolfSSL 11:cee25a834751 8662 heap = rsaKey->heap;
wolfSSL 11:cee25a834751 8663 }
wolfSSL 11:cee25a834751 8664 else if (eccKey) {
wolfSSL 11:cee25a834751 8665 #ifdef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 8666 certSignCtx = &eccKey->certSignCtx;
wolfSSL 11:cee25a834751 8667 #endif
wolfSSL 11:cee25a834751 8668 heap = eccKey->heap;
wolfSSL 11:cee25a834751 8669 }
wolfSSL 11:cee25a834751 8670
wolfSSL 11:cee25a834751 8671 #ifdef WOLFSSL_ASYNC_CRYPT
wolfSSL 11:cee25a834751 8672 if (certSignCtx == NULL) {
wolfSSL 11:cee25a834751 8673 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8674 }
wolfSSL 11:cee25a834751 8675 #endif
wolfSSL 11:cee25a834751 8676
wolfSSL 11:cee25a834751 8677 if (certSignCtx->sig == NULL) {
wolfSSL 11:cee25a834751 8678 certSignCtx->sig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, heap,
wolfSSL 11:cee25a834751 8679 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8680 if (certSignCtx->sig == NULL)
wolfSSL 11:cee25a834751 8681 return MEMORY_E;
wolfSSL 11:cee25a834751 8682 }
wolfSSL 11:cee25a834751 8683
wolfSSL 11:cee25a834751 8684 sigSz = MakeSignature(certSignCtx, buffer, requestSz, certSignCtx->sig,
wolfSSL 11:cee25a834751 8685 MAX_ENCODED_SIG_SZ, rsaKey, eccKey, rng, sType, heap);
wolfSSL 11:cee25a834751 8686 if (sigSz == WC_PENDING_E)
wolfSSL 11:cee25a834751 8687 return sigSz;
wolfSSL 11:cee25a834751 8688
wolfSSL 11:cee25a834751 8689 if (sigSz >= 0) {
wolfSSL 11:cee25a834751 8690 if (requestSz + MAX_SEQ_SZ * 2 + sigSz > (int)buffSz)
wolfSSL 11:cee25a834751 8691 sigSz = BUFFER_E;
wolfSSL 11:cee25a834751 8692 else
wolfSSL 11:cee25a834751 8693 sigSz = AddSignature(buffer, requestSz, certSignCtx->sig, sigSz, sType);
wolfSSL 11:cee25a834751 8694 }
wolfSSL 11:cee25a834751 8695
wolfSSL 11:cee25a834751 8696 XFREE(certSignCtx->sig, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8697 certSignCtx->sig = NULL;
wolfSSL 11:cee25a834751 8698
wolfSSL 11:cee25a834751 8699 return sigSz;
wolfSSL 11:cee25a834751 8700 }
wolfSSL 11:cee25a834751 8701
wolfSSL 11:cee25a834751 8702
wolfSSL 11:cee25a834751 8703 int wc_MakeSelfCert(Cert* cert, byte* buffer, word32 buffSz,
wolfSSL 11:cee25a834751 8704 RsaKey* key, WC_RNG* rng)
wolfSSL 11:cee25a834751 8705 {
wolfSSL 11:cee25a834751 8706 int ret;
wolfSSL 11:cee25a834751 8707
wolfSSL 11:cee25a834751 8708 ret = wc_MakeCert(cert, buffer, buffSz, key, NULL, rng);
wolfSSL 11:cee25a834751 8709 if (ret < 0)
wolfSSL 11:cee25a834751 8710 return ret;
wolfSSL 11:cee25a834751 8711
wolfSSL 11:cee25a834751 8712 return wc_SignCert(cert->bodySz, cert->sigType,
wolfSSL 11:cee25a834751 8713 buffer, buffSz, key, NULL, rng);
wolfSSL 11:cee25a834751 8714 }
wolfSSL 11:cee25a834751 8715
wolfSSL 11:cee25a834751 8716
wolfSSL 11:cee25a834751 8717 #ifdef WOLFSSL_CERT_EXT
wolfSSL 11:cee25a834751 8718
wolfSSL 11:cee25a834751 8719 /* Set KID from RSA or ECC public key */
wolfSSL 11:cee25a834751 8720 static int SetKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey,
wolfSSL 11:cee25a834751 8721 byte *ntruKey, word16 ntruKeySz, int kid_type)
wolfSSL 11:cee25a834751 8722 {
wolfSSL 11:cee25a834751 8723 byte *buffer;
wolfSSL 11:cee25a834751 8724 int bufferSz, ret;
wolfSSL 11:cee25a834751 8725
wolfSSL 11:cee25a834751 8726 #ifndef HAVE_NTRU
wolfSSL 11:cee25a834751 8727 (void)ntruKeySz;
wolfSSL 11:cee25a834751 8728 #endif
wolfSSL 11:cee25a834751 8729
wolfSSL 11:cee25a834751 8730 if (cert == NULL || (rsakey == NULL && eckey == NULL && ntruKey == NULL) ||
wolfSSL 11:cee25a834751 8731 (rsakey != NULL && eckey != NULL) ||
wolfSSL 11:cee25a834751 8732 (rsakey != NULL && ntruKey != NULL) ||
wolfSSL 11:cee25a834751 8733 (ntruKey != NULL && eckey != NULL) ||
wolfSSL 11:cee25a834751 8734 (kid_type != SKID_TYPE && kid_type != AKID_TYPE))
wolfSSL 11:cee25a834751 8735 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8736
wolfSSL 11:cee25a834751 8737 buffer = (byte *)XMALLOC(MAX_PUBLIC_KEY_SZ, cert->heap,
wolfSSL 11:cee25a834751 8738 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8739 if (buffer == NULL)
wolfSSL 11:cee25a834751 8740 return MEMORY_E;
wolfSSL 11:cee25a834751 8741
wolfSSL 11:cee25a834751 8742 /* RSA public key */
wolfSSL 11:cee25a834751 8743 if (rsakey != NULL)
wolfSSL 11:cee25a834751 8744 bufferSz = SetRsaPublicKey(buffer, rsakey, MAX_PUBLIC_KEY_SZ, 0);
wolfSSL 11:cee25a834751 8745 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 8746 /* ECC public key */
wolfSSL 11:cee25a834751 8747 else if (eckey != NULL)
wolfSSL 11:cee25a834751 8748 bufferSz = SetEccPublicKey(buffer, eckey, 0);
wolfSSL 11:cee25a834751 8749 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 8750 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 8751 /* NTRU public key */
wolfSSL 11:cee25a834751 8752 else if (ntruKey != NULL) {
wolfSSL 11:cee25a834751 8753 bufferSz = MAX_PUBLIC_KEY_SZ;
wolfSSL 11:cee25a834751 8754 ret = ntru_crypto_ntru_encrypt_publicKey2SubjectPublicKeyInfo(
wolfSSL 11:cee25a834751 8755 ntruKeySz, ntruKey, (word16 *)(&bufferSz), buffer);
wolfSSL 11:cee25a834751 8756 if (ret != NTRU_OK)
wolfSSL 11:cee25a834751 8757 bufferSz = -1;
wolfSSL 11:cee25a834751 8758 }
wolfSSL 11:cee25a834751 8759 #endif
wolfSSL 11:cee25a834751 8760 else
wolfSSL 11:cee25a834751 8761 bufferSz = -1;
wolfSSL 11:cee25a834751 8762
wolfSSL 11:cee25a834751 8763 if (bufferSz <= 0) {
wolfSSL 11:cee25a834751 8764 XFREE(buffer, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8765 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8766 }
wolfSSL 11:cee25a834751 8767
wolfSSL 11:cee25a834751 8768 /* Compute SKID by hashing public key */
wolfSSL 11:cee25a834751 8769 #ifdef NO_SHA
wolfSSL 11:cee25a834751 8770 if (kid_type == SKID_TYPE) {
wolfSSL 11:cee25a834751 8771 ret = wc_Sha256Hash(buffer, bufferSz, cert->skid);
wolfSSL 11:cee25a834751 8772 cert->skidSz = SHA256_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8773 }
wolfSSL 11:cee25a834751 8774 else if (kid_type == AKID_TYPE) {
wolfSSL 11:cee25a834751 8775 ret = wc_Sha256Hash(buffer, bufferSz, cert->akid);
wolfSSL 11:cee25a834751 8776 cert->akidSz = SHA256_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8777 }
wolfSSL 11:cee25a834751 8778 else
wolfSSL 11:cee25a834751 8779 ret = BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8780 #else /* NO_SHA */
wolfSSL 11:cee25a834751 8781 if (kid_type == SKID_TYPE) {
wolfSSL 11:cee25a834751 8782 ret = wc_ShaHash(buffer, bufferSz, cert->skid);
wolfSSL 11:cee25a834751 8783 cert->skidSz = SHA_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8784 }
wolfSSL 11:cee25a834751 8785 else if (kid_type == AKID_TYPE) {
wolfSSL 11:cee25a834751 8786 ret = wc_ShaHash(buffer, bufferSz, cert->akid);
wolfSSL 11:cee25a834751 8787 cert->akidSz = SHA_DIGEST_SIZE;
wolfSSL 11:cee25a834751 8788 }
wolfSSL 11:cee25a834751 8789 else
wolfSSL 11:cee25a834751 8790 ret = BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8791 #endif /* NO_SHA */
wolfSSL 11:cee25a834751 8792
wolfSSL 11:cee25a834751 8793 XFREE(buffer, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8794 return ret;
wolfSSL 11:cee25a834751 8795 }
wolfSSL 11:cee25a834751 8796
wolfSSL 11:cee25a834751 8797 /* Set SKID from RSA or ECC public key */
wolfSSL 11:cee25a834751 8798 int wc_SetSubjectKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey)
wolfSSL 11:cee25a834751 8799 {
wolfSSL 11:cee25a834751 8800 return SetKeyIdFromPublicKey(cert, rsakey, eckey, NULL, 0, SKID_TYPE);
wolfSSL 11:cee25a834751 8801 }
wolfSSL 11:cee25a834751 8802
wolfSSL 11:cee25a834751 8803 #ifdef HAVE_NTRU
wolfSSL 11:cee25a834751 8804 /* Set SKID from NTRU public key */
wolfSSL 11:cee25a834751 8805 int wc_SetSubjectKeyIdFromNtruPublicKey(Cert *cert,
wolfSSL 11:cee25a834751 8806 byte *ntruKey, word16 ntruKeySz)
wolfSSL 11:cee25a834751 8807 {
wolfSSL 11:cee25a834751 8808 return SetKeyIdFromPublicKey(cert, NULL,NULL,ntruKey, ntruKeySz, SKID_TYPE);
wolfSSL 11:cee25a834751 8809 }
wolfSSL 11:cee25a834751 8810 #endif
wolfSSL 11:cee25a834751 8811
wolfSSL 11:cee25a834751 8812 /* Set SKID from RSA or ECC public key */
wolfSSL 11:cee25a834751 8813 int wc_SetAuthKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey)
wolfSSL 11:cee25a834751 8814 {
wolfSSL 11:cee25a834751 8815 return SetKeyIdFromPublicKey(cert, rsakey, eckey, NULL, 0, AKID_TYPE);
wolfSSL 11:cee25a834751 8816 }
wolfSSL 11:cee25a834751 8817
wolfSSL 11:cee25a834751 8818
wolfSSL 11:cee25a834751 8819 #ifndef NO_FILESYSTEM
wolfSSL 11:cee25a834751 8820
wolfSSL 11:cee25a834751 8821 /* Set SKID from public key file in PEM */
wolfSSL 11:cee25a834751 8822 int wc_SetSubjectKeyId(Cert *cert, const char* file)
wolfSSL 11:cee25a834751 8823 {
wolfSSL 11:cee25a834751 8824 int ret, derSz;
wolfSSL 11:cee25a834751 8825 byte* der;
wolfSSL 11:cee25a834751 8826 word32 idx;
wolfSSL 11:cee25a834751 8827 RsaKey *rsakey = NULL;
wolfSSL 11:cee25a834751 8828 ecc_key *eckey = NULL;
wolfSSL 11:cee25a834751 8829
wolfSSL 11:cee25a834751 8830 if (cert == NULL || file == NULL)
wolfSSL 11:cee25a834751 8831 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8832
wolfSSL 11:cee25a834751 8833 der = (byte*)XMALLOC(MAX_PUBLIC_KEY_SZ, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8834 if (der == NULL) {
wolfSSL 11:cee25a834751 8835 WOLFSSL_MSG("wc_SetSubjectKeyId memory Problem");
wolfSSL 11:cee25a834751 8836 return MEMORY_E;
wolfSSL 11:cee25a834751 8837 }
wolfSSL 11:cee25a834751 8838
wolfSSL 11:cee25a834751 8839 derSz = wolfSSL_PemPubKeyToDer(file, der, MAX_PUBLIC_KEY_SZ);
wolfSSL 11:cee25a834751 8840 if (derSz <= 0)
wolfSSL 11:cee25a834751 8841 {
wolfSSL 11:cee25a834751 8842 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8843 return derSz;
wolfSSL 11:cee25a834751 8844 }
wolfSSL 11:cee25a834751 8845
wolfSSL 11:cee25a834751 8846 /* Load PubKey in internal structure */
wolfSSL 11:cee25a834751 8847 rsakey = (RsaKey*) XMALLOC(sizeof(RsaKey), cert->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 8848 if (rsakey == NULL) {
wolfSSL 11:cee25a834751 8849 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8850 return MEMORY_E;
wolfSSL 11:cee25a834751 8851 }
wolfSSL 11:cee25a834751 8852
wolfSSL 11:cee25a834751 8853 if (wc_InitRsaKey(rsakey, cert->heap) != 0) {
wolfSSL 11:cee25a834751 8854 WOLFSSL_MSG("wc_InitRsaKey failure");
wolfSSL 11:cee25a834751 8855 XFREE(rsakey, cert->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 8856 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8857 return MEMORY_E;
wolfSSL 11:cee25a834751 8858 }
wolfSSL 11:cee25a834751 8859
wolfSSL 11:cee25a834751 8860 idx = 0;
wolfSSL 11:cee25a834751 8861 ret = wc_RsaPublicKeyDecode(der, &idx, rsakey, derSz);
wolfSSL 11:cee25a834751 8862 if (ret != 0) {
wolfSSL 11:cee25a834751 8863 WOLFSSL_MSG("wc_RsaPublicKeyDecode failed");
wolfSSL 11:cee25a834751 8864 wc_FreeRsaKey(rsakey);
wolfSSL 11:cee25a834751 8865 XFREE(rsakey, cert->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 8866 rsakey = NULL;
wolfSSL 11:cee25a834751 8867 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 8868 /* Check to load ecc public key */
wolfSSL 11:cee25a834751 8869 eckey = (ecc_key*) XMALLOC(sizeof(ecc_key), cert->heap,
wolfSSL 11:cee25a834751 8870 DYNAMIC_TYPE_ECC);
wolfSSL 11:cee25a834751 8871 if (eckey == NULL) {
wolfSSL 11:cee25a834751 8872 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8873 return MEMORY_E;
wolfSSL 11:cee25a834751 8874 }
wolfSSL 11:cee25a834751 8875
wolfSSL 11:cee25a834751 8876 if (wc_ecc_init(eckey) != 0) {
wolfSSL 11:cee25a834751 8877 WOLFSSL_MSG("wc_ecc_init failure");
wolfSSL 11:cee25a834751 8878 wc_ecc_free(eckey);
wolfSSL 11:cee25a834751 8879 XFREE(eckey, cert->heap, DYNAMIC_TYPE_ECC);
wolfSSL 11:cee25a834751 8880 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8881 return MEMORY_E;
wolfSSL 11:cee25a834751 8882 }
wolfSSL 11:cee25a834751 8883
wolfSSL 11:cee25a834751 8884 idx = 0;
wolfSSL 11:cee25a834751 8885 ret = wc_EccPublicKeyDecode(der, &idx, eckey, derSz);
wolfSSL 11:cee25a834751 8886 if (ret != 0) {
wolfSSL 11:cee25a834751 8887 WOLFSSL_MSG("wc_EccPublicKeyDecode failed");
wolfSSL 11:cee25a834751 8888 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8889 wc_ecc_free(eckey);
wolfSSL 11:cee25a834751 8890 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8891 }
wolfSSL 11:cee25a834751 8892 #else
wolfSSL 11:cee25a834751 8893 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8894 return PUBLIC_KEY_E;
wolfSSL 11:cee25a834751 8895 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 8896 }
wolfSSL 11:cee25a834751 8897
wolfSSL 11:cee25a834751 8898 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8899
wolfSSL 11:cee25a834751 8900 ret = wc_SetSubjectKeyIdFromPublicKey(cert, rsakey, eckey);
wolfSSL 11:cee25a834751 8901
wolfSSL 11:cee25a834751 8902 wc_FreeRsaKey(rsakey);
wolfSSL 11:cee25a834751 8903 XFREE(rsakey, cert->heap, DYNAMIC_TYPE_RSA);
wolfSSL 11:cee25a834751 8904 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 8905 wc_ecc_free(eckey);
wolfSSL 11:cee25a834751 8906 XFREE(eckey, cert->heap, DYNAMIC_TYPE_ECC);
wolfSSL 11:cee25a834751 8907 #endif
wolfSSL 11:cee25a834751 8908 return ret;
wolfSSL 11:cee25a834751 8909 }
wolfSSL 11:cee25a834751 8910
wolfSSL 11:cee25a834751 8911 #endif /* NO_FILESYSTEM */
wolfSSL 11:cee25a834751 8912
wolfSSL 11:cee25a834751 8913 /* Set AKID from certificate contains in buffer (DER encoded) */
wolfSSL 11:cee25a834751 8914 int wc_SetAuthKeyIdFromCert(Cert *cert, const byte *der, int derSz)
wolfSSL 11:cee25a834751 8915 {
wolfSSL 11:cee25a834751 8916 int ret;
wolfSSL 11:cee25a834751 8917
wolfSSL 11:cee25a834751 8918 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8919 DecodedCert* decoded;
wolfSSL 11:cee25a834751 8920 #else
wolfSSL 11:cee25a834751 8921 DecodedCert decoded[1];
wolfSSL 11:cee25a834751 8922 #endif
wolfSSL 11:cee25a834751 8923
wolfSSL 11:cee25a834751 8924 if (cert == NULL || der == NULL || derSz <= 0)
wolfSSL 11:cee25a834751 8925 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8926
wolfSSL 11:cee25a834751 8927 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8928 decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert),
wolfSSL 11:cee25a834751 8929 NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8930 if (decoded == NULL)
wolfSSL 11:cee25a834751 8931 return MEMORY_E;
wolfSSL 11:cee25a834751 8932 #endif
wolfSSL 11:cee25a834751 8933
wolfSSL 11:cee25a834751 8934 /* decode certificate and get SKID that will be AKID of current cert */
wolfSSL 11:cee25a834751 8935 InitDecodedCert(decoded, (byte*)der, derSz, NULL);
wolfSSL 11:cee25a834751 8936 ret = ParseCert(decoded, CERT_TYPE, NO_VERIFY, 0);
wolfSSL 11:cee25a834751 8937 if (ret != 0) {
wolfSSL 11:cee25a834751 8938 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 8939 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8940 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8941 #endif
wolfSSL 11:cee25a834751 8942 return ret;
wolfSSL 11:cee25a834751 8943 }
wolfSSL 11:cee25a834751 8944
wolfSSL 11:cee25a834751 8945 /* Subject Key Id not found !! */
wolfSSL 11:cee25a834751 8946 if (decoded->extSubjKeyIdSet == 0) {
wolfSSL 11:cee25a834751 8947 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 8948 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8949 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8950 #endif
wolfSSL 11:cee25a834751 8951 return ASN_NO_SKID;
wolfSSL 11:cee25a834751 8952 }
wolfSSL 11:cee25a834751 8953
wolfSSL 11:cee25a834751 8954 /* SKID invalid size */
wolfSSL 11:cee25a834751 8955 if (sizeof(cert->akid) < sizeof(decoded->extSubjKeyId)) {
wolfSSL 11:cee25a834751 8956 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 8957 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8958 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8959 #endif
wolfSSL 11:cee25a834751 8960 return MEMORY_E;
wolfSSL 11:cee25a834751 8961 }
wolfSSL 11:cee25a834751 8962
wolfSSL 11:cee25a834751 8963 /* Put the SKID of CA to AKID of certificate */
wolfSSL 11:cee25a834751 8964 XMEMCPY(cert->akid, decoded->extSubjKeyId, KEYID_SIZE);
wolfSSL 11:cee25a834751 8965 cert->akidSz = KEYID_SIZE;
wolfSSL 11:cee25a834751 8966
wolfSSL 11:cee25a834751 8967 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 8968 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 8969 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 8970 #endif
wolfSSL 11:cee25a834751 8971
wolfSSL 11:cee25a834751 8972 return 0;
wolfSSL 11:cee25a834751 8973 }
wolfSSL 11:cee25a834751 8974
wolfSSL 11:cee25a834751 8975
wolfSSL 11:cee25a834751 8976 #ifndef NO_FILESYSTEM
wolfSSL 11:cee25a834751 8977
wolfSSL 11:cee25a834751 8978 /* Set AKID from certificate file in PEM */
wolfSSL 11:cee25a834751 8979 int wc_SetAuthKeyId(Cert *cert, const char* file)
wolfSSL 11:cee25a834751 8980 {
wolfSSL 11:cee25a834751 8981 int ret;
wolfSSL 11:cee25a834751 8982 int derSz;
wolfSSL 11:cee25a834751 8983 byte* der;
wolfSSL 11:cee25a834751 8984
wolfSSL 11:cee25a834751 8985 if (cert == NULL || file == NULL)
wolfSSL 11:cee25a834751 8986 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 8987
wolfSSL 11:cee25a834751 8988 der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8989 if (der == NULL) {
wolfSSL 11:cee25a834751 8990 WOLFSSL_MSG("wc_SetAuthKeyId OOF Problem");
wolfSSL 11:cee25a834751 8991 return MEMORY_E;
wolfSSL 11:cee25a834751 8992 }
wolfSSL 11:cee25a834751 8993
wolfSSL 11:cee25a834751 8994 derSz = wolfSSL_PemCertToDer(file, der, EIGHTK_BUF);
wolfSSL 11:cee25a834751 8995 if (derSz <= 0)
wolfSSL 11:cee25a834751 8996 {
wolfSSL 11:cee25a834751 8997 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 8998 return derSz;
wolfSSL 11:cee25a834751 8999 }
wolfSSL 11:cee25a834751 9000
wolfSSL 11:cee25a834751 9001 ret = wc_SetAuthKeyIdFromCert(cert, der, derSz);
wolfSSL 11:cee25a834751 9002 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9003
wolfSSL 11:cee25a834751 9004 return ret;
wolfSSL 11:cee25a834751 9005 }
wolfSSL 11:cee25a834751 9006
wolfSSL 11:cee25a834751 9007 #endif /* NO_FILESYSTEM */
wolfSSL 11:cee25a834751 9008
wolfSSL 11:cee25a834751 9009 /* Set KeyUsage from human readable string */
wolfSSL 11:cee25a834751 9010 int wc_SetKeyUsage(Cert *cert, const char *value)
wolfSSL 11:cee25a834751 9011 {
wolfSSL 11:cee25a834751 9012 int ret = 0;
wolfSSL 11:cee25a834751 9013 char *token, *str, *ptr;
wolfSSL 11:cee25a834751 9014 word32 len;
wolfSSL 11:cee25a834751 9015
wolfSSL 11:cee25a834751 9016 if (cert == NULL || value == NULL)
wolfSSL 11:cee25a834751 9017 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 9018
wolfSSL 11:cee25a834751 9019 cert->keyUsage = 0;
wolfSSL 11:cee25a834751 9020
wolfSSL 11:cee25a834751 9021 str = (char *)XMALLOC(XSTRLEN(value)+1, cert->heap,
wolfSSL 11:cee25a834751 9022 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9023 if (str == NULL)
wolfSSL 11:cee25a834751 9024 return MEMORY_E;
wolfSSL 11:cee25a834751 9025
wolfSSL 11:cee25a834751 9026 XMEMSET(str, 0, XSTRLEN(value)+1);
wolfSSL 11:cee25a834751 9027 XSTRNCPY(str, value, XSTRLEN(value));
wolfSSL 11:cee25a834751 9028
wolfSSL 11:cee25a834751 9029 /* parse value, and set corresponding Key Usage value */
wolfSSL 11:cee25a834751 9030 token = XSTRTOK(str, ",", &ptr);
wolfSSL 11:cee25a834751 9031 while (token != NULL)
wolfSSL 11:cee25a834751 9032 {
wolfSSL 11:cee25a834751 9033 len = (word32)XSTRLEN(token);
wolfSSL 11:cee25a834751 9034
wolfSSL 11:cee25a834751 9035 if (!XSTRNCASECMP(token, "digitalSignature", len))
wolfSSL 11:cee25a834751 9036 cert->keyUsage |= KEYUSE_DIGITAL_SIG;
wolfSSL 11:cee25a834751 9037 else if (!XSTRNCASECMP(token, "nonRepudiation", len) ||
wolfSSL 11:cee25a834751 9038 !XSTRNCASECMP(token, "contentCommitment", len))
wolfSSL 11:cee25a834751 9039 cert->keyUsage |= KEYUSE_CONTENT_COMMIT;
wolfSSL 11:cee25a834751 9040 else if (!XSTRNCASECMP(token, "keyEncipherment", len))
wolfSSL 11:cee25a834751 9041 cert->keyUsage |= KEYUSE_KEY_ENCIPHER;
wolfSSL 11:cee25a834751 9042 else if (!XSTRNCASECMP(token, "dataEncipherment", len))
wolfSSL 11:cee25a834751 9043 cert->keyUsage |= KEYUSE_DATA_ENCIPHER;
wolfSSL 11:cee25a834751 9044 else if (!XSTRNCASECMP(token, "keyAgreement", len))
wolfSSL 11:cee25a834751 9045 cert->keyUsage |= KEYUSE_KEY_AGREE;
wolfSSL 11:cee25a834751 9046 else if (!XSTRNCASECMP(token, "keyCertSign", len))
wolfSSL 11:cee25a834751 9047 cert->keyUsage |= KEYUSE_KEY_CERT_SIGN;
wolfSSL 11:cee25a834751 9048 else if (!XSTRNCASECMP(token, "cRLSign", len))
wolfSSL 11:cee25a834751 9049 cert->keyUsage |= KEYUSE_CRL_SIGN;
wolfSSL 11:cee25a834751 9050 else if (!XSTRNCASECMP(token, "encipherOnly", len))
wolfSSL 11:cee25a834751 9051 cert->keyUsage |= KEYUSE_ENCIPHER_ONLY;
wolfSSL 11:cee25a834751 9052 else if (!XSTRNCASECMP(token, "decipherOnly", len))
wolfSSL 11:cee25a834751 9053 cert->keyUsage |= KEYUSE_DECIPHER_ONLY;
wolfSSL 11:cee25a834751 9054 else {
wolfSSL 11:cee25a834751 9055 ret = KEYUSAGE_E;
wolfSSL 11:cee25a834751 9056 break;
wolfSSL 11:cee25a834751 9057 }
wolfSSL 11:cee25a834751 9058
wolfSSL 11:cee25a834751 9059 token = XSTRTOK(NULL, ",", &ptr);
wolfSSL 11:cee25a834751 9060 }
wolfSSL 11:cee25a834751 9061
wolfSSL 11:cee25a834751 9062 XFREE(str, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9063 return ret;
wolfSSL 11:cee25a834751 9064 }
wolfSSL 11:cee25a834751 9065 #endif /* WOLFSSL_CERT_EXT */
wolfSSL 11:cee25a834751 9066
wolfSSL 11:cee25a834751 9067
wolfSSL 11:cee25a834751 9068 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 9069
wolfSSL 11:cee25a834751 9070 /* Set Alt Names from der cert, return 0 on success */
wolfSSL 11:cee25a834751 9071 static int SetAltNamesFromCert(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9072 {
wolfSSL 11:cee25a834751 9073 int ret;
wolfSSL 11:cee25a834751 9074 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9075 DecodedCert* decoded;
wolfSSL 11:cee25a834751 9076 #else
wolfSSL 11:cee25a834751 9077 DecodedCert decoded[1];
wolfSSL 11:cee25a834751 9078 #endif
wolfSSL 11:cee25a834751 9079
wolfSSL 11:cee25a834751 9080 if (derSz < 0)
wolfSSL 11:cee25a834751 9081 return derSz;
wolfSSL 11:cee25a834751 9082
wolfSSL 11:cee25a834751 9083 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9084 decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
wolfSSL 11:cee25a834751 9085 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9086 if (decoded == NULL)
wolfSSL 11:cee25a834751 9087 return MEMORY_E;
wolfSSL 11:cee25a834751 9088 #endif
wolfSSL 11:cee25a834751 9089
wolfSSL 11:cee25a834751 9090 InitDecodedCert(decoded, (byte*)der, derSz, NULL);
wolfSSL 11:cee25a834751 9091 ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
wolfSSL 11:cee25a834751 9092
wolfSSL 11:cee25a834751 9093 if (ret < 0) {
wolfSSL 11:cee25a834751 9094 WOLFSSL_MSG("ParseCertRelative error");
wolfSSL 11:cee25a834751 9095 }
wolfSSL 11:cee25a834751 9096 else if (decoded->extensions) {
wolfSSL 11:cee25a834751 9097 byte b;
wolfSSL 11:cee25a834751 9098 int length;
wolfSSL 11:cee25a834751 9099 word32 maxExtensionsIdx;
wolfSSL 11:cee25a834751 9100
wolfSSL 11:cee25a834751 9101 decoded->srcIdx = decoded->extensionsIdx;
wolfSSL 11:cee25a834751 9102 b = decoded->source[decoded->srcIdx++];
wolfSSL 11:cee25a834751 9103
wolfSSL 11:cee25a834751 9104 if (b != ASN_EXTENSIONS) {
wolfSSL 11:cee25a834751 9105 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9106 }
wolfSSL 11:cee25a834751 9107 else if (GetLength(decoded->source, &decoded->srcIdx, &length,
wolfSSL 11:cee25a834751 9108 decoded->maxIdx) < 0) {
wolfSSL 11:cee25a834751 9109 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9110 }
wolfSSL 11:cee25a834751 9111 else if (GetSequence(decoded->source, &decoded->srcIdx, &length,
wolfSSL 11:cee25a834751 9112 decoded->maxIdx) < 0) {
wolfSSL 11:cee25a834751 9113 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9114 }
wolfSSL 11:cee25a834751 9115 else {
wolfSSL 11:cee25a834751 9116 maxExtensionsIdx = decoded->srcIdx + length;
wolfSSL 11:cee25a834751 9117
wolfSSL 11:cee25a834751 9118 while (decoded->srcIdx < maxExtensionsIdx) {
wolfSSL 11:cee25a834751 9119 word32 oid;
wolfSSL 11:cee25a834751 9120 word32 startIdx = decoded->srcIdx;
wolfSSL 11:cee25a834751 9121 word32 tmpIdx;
wolfSSL 11:cee25a834751 9122
wolfSSL 11:cee25a834751 9123 if (GetSequence(decoded->source, &decoded->srcIdx, &length,
wolfSSL 11:cee25a834751 9124 decoded->maxIdx) < 0) {
wolfSSL 11:cee25a834751 9125 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9126 break;
wolfSSL 11:cee25a834751 9127 }
wolfSSL 11:cee25a834751 9128
wolfSSL 11:cee25a834751 9129 tmpIdx = decoded->srcIdx;
wolfSSL 11:cee25a834751 9130 decoded->srcIdx = startIdx;
wolfSSL 11:cee25a834751 9131
wolfSSL 11:cee25a834751 9132 if (GetAlgoId(decoded->source, &decoded->srcIdx, &oid,
wolfSSL 11:cee25a834751 9133 oidCertExtType, decoded->maxIdx) < 0) {
wolfSSL 11:cee25a834751 9134 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9135 break;
wolfSSL 11:cee25a834751 9136 }
wolfSSL 11:cee25a834751 9137
wolfSSL 11:cee25a834751 9138 if (oid == ALT_NAMES_OID) {
wolfSSL 11:cee25a834751 9139 cert->altNamesSz = length + (tmpIdx - startIdx);
wolfSSL 11:cee25a834751 9140
wolfSSL 11:cee25a834751 9141 if (cert->altNamesSz < (int)sizeof(cert->altNames))
wolfSSL 11:cee25a834751 9142 XMEMCPY(cert->altNames, &decoded->source[startIdx],
wolfSSL 11:cee25a834751 9143 cert->altNamesSz);
wolfSSL 11:cee25a834751 9144 else {
wolfSSL 11:cee25a834751 9145 cert->altNamesSz = 0;
wolfSSL 11:cee25a834751 9146 WOLFSSL_MSG("AltNames extensions too big");
wolfSSL 11:cee25a834751 9147 ret = ALT_NAME_E;
wolfSSL 11:cee25a834751 9148 break;
wolfSSL 11:cee25a834751 9149 }
wolfSSL 11:cee25a834751 9150 }
wolfSSL 11:cee25a834751 9151 decoded->srcIdx = tmpIdx + length;
wolfSSL 11:cee25a834751 9152 }
wolfSSL 11:cee25a834751 9153 }
wolfSSL 11:cee25a834751 9154 }
wolfSSL 11:cee25a834751 9155
wolfSSL 11:cee25a834751 9156 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 9157 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9158 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9159 #endif
wolfSSL 11:cee25a834751 9160
wolfSSL 11:cee25a834751 9161 return ret < 0 ? ret : 0;
wolfSSL 11:cee25a834751 9162 }
wolfSSL 11:cee25a834751 9163
wolfSSL 11:cee25a834751 9164
wolfSSL 11:cee25a834751 9165 /* Set Dates from der cert, return 0 on success */
wolfSSL 11:cee25a834751 9166 static int SetDatesFromCert(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9167 {
wolfSSL 11:cee25a834751 9168 int ret;
wolfSSL 11:cee25a834751 9169 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9170 DecodedCert* decoded;
wolfSSL 11:cee25a834751 9171 #else
wolfSSL 11:cee25a834751 9172 DecodedCert decoded[1];
wolfSSL 11:cee25a834751 9173 #endif
wolfSSL 11:cee25a834751 9174
wolfSSL 11:cee25a834751 9175 WOLFSSL_ENTER("SetDatesFromCert");
wolfSSL 11:cee25a834751 9176 if (derSz < 0)
wolfSSL 11:cee25a834751 9177 return derSz;
wolfSSL 11:cee25a834751 9178
wolfSSL 11:cee25a834751 9179 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9180 decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
wolfSSL 11:cee25a834751 9181 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9182 if (decoded == NULL)
wolfSSL 11:cee25a834751 9183 return MEMORY_E;
wolfSSL 11:cee25a834751 9184 #endif
wolfSSL 11:cee25a834751 9185
wolfSSL 11:cee25a834751 9186 InitDecodedCert(decoded, (byte*)der, derSz, NULL);
wolfSSL 11:cee25a834751 9187 ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
wolfSSL 11:cee25a834751 9188
wolfSSL 11:cee25a834751 9189 if (ret < 0) {
wolfSSL 11:cee25a834751 9190 WOLFSSL_MSG("ParseCertRelative error");
wolfSSL 11:cee25a834751 9191 }
wolfSSL 11:cee25a834751 9192 else if (decoded->beforeDate == NULL || decoded->afterDate == NULL) {
wolfSSL 11:cee25a834751 9193 WOLFSSL_MSG("Couldn't extract dates");
wolfSSL 11:cee25a834751 9194 ret = -1;
wolfSSL 11:cee25a834751 9195 }
wolfSSL 11:cee25a834751 9196 else if (decoded->beforeDateLen > MAX_DATE_SIZE ||
wolfSSL 11:cee25a834751 9197 decoded->afterDateLen > MAX_DATE_SIZE) {
wolfSSL 11:cee25a834751 9198 WOLFSSL_MSG("Bad date size");
wolfSSL 11:cee25a834751 9199 ret = -1;
wolfSSL 11:cee25a834751 9200 }
wolfSSL 11:cee25a834751 9201 else {
wolfSSL 11:cee25a834751 9202 XMEMCPY(cert->beforeDate, decoded->beforeDate, decoded->beforeDateLen);
wolfSSL 11:cee25a834751 9203 XMEMCPY(cert->afterDate, decoded->afterDate, decoded->afterDateLen);
wolfSSL 11:cee25a834751 9204
wolfSSL 11:cee25a834751 9205 cert->beforeDateSz = decoded->beforeDateLen;
wolfSSL 11:cee25a834751 9206 cert->afterDateSz = decoded->afterDateLen;
wolfSSL 11:cee25a834751 9207 }
wolfSSL 11:cee25a834751 9208
wolfSSL 11:cee25a834751 9209 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 9210
wolfSSL 11:cee25a834751 9211 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9212 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9213 #endif
wolfSSL 11:cee25a834751 9214
wolfSSL 11:cee25a834751 9215 return ret < 0 ? ret : 0;
wolfSSL 11:cee25a834751 9216 }
wolfSSL 11:cee25a834751 9217
wolfSSL 11:cee25a834751 9218
wolfSSL 11:cee25a834751 9219 #endif /* WOLFSSL_ALT_NAMES && !NO_RSA */
wolfSSL 11:cee25a834751 9220
wolfSSL 11:cee25a834751 9221
wolfSSL 11:cee25a834751 9222 /* Set cn name from der buffer, return 0 on success */
wolfSSL 11:cee25a834751 9223 static int SetNameFromCert(CertName* cn, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9224 {
wolfSSL 11:cee25a834751 9225 int ret, sz;
wolfSSL 11:cee25a834751 9226 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9227 DecodedCert* decoded;
wolfSSL 11:cee25a834751 9228 #else
wolfSSL 11:cee25a834751 9229 DecodedCert decoded[1];
wolfSSL 11:cee25a834751 9230 #endif
wolfSSL 11:cee25a834751 9231
wolfSSL 11:cee25a834751 9232 if (derSz < 0)
wolfSSL 11:cee25a834751 9233 return derSz;
wolfSSL 11:cee25a834751 9234
wolfSSL 11:cee25a834751 9235 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9236 decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
wolfSSL 11:cee25a834751 9237 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9238 if (decoded == NULL)
wolfSSL 11:cee25a834751 9239 return MEMORY_E;
wolfSSL 11:cee25a834751 9240 #endif
wolfSSL 11:cee25a834751 9241
wolfSSL 11:cee25a834751 9242 InitDecodedCert(decoded, (byte*)der, derSz, NULL);
wolfSSL 11:cee25a834751 9243 ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
wolfSSL 11:cee25a834751 9244
wolfSSL 11:cee25a834751 9245 if (ret < 0) {
wolfSSL 11:cee25a834751 9246 WOLFSSL_MSG("ParseCertRelative error");
wolfSSL 11:cee25a834751 9247 }
wolfSSL 11:cee25a834751 9248 else {
wolfSSL 11:cee25a834751 9249 if (decoded->subjectCN) {
wolfSSL 11:cee25a834751 9250 sz = (decoded->subjectCNLen < CTC_NAME_SIZE) ? decoded->subjectCNLen
wolfSSL 11:cee25a834751 9251 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9252 strncpy(cn->commonName, decoded->subjectCN, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9253 cn->commonName[sz] = 0;
wolfSSL 11:cee25a834751 9254 cn->commonNameEnc = decoded->subjectCNEnc;
wolfSSL 11:cee25a834751 9255 }
wolfSSL 11:cee25a834751 9256 if (decoded->subjectC) {
wolfSSL 11:cee25a834751 9257 sz = (decoded->subjectCLen < CTC_NAME_SIZE) ? decoded->subjectCLen
wolfSSL 11:cee25a834751 9258 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9259 strncpy(cn->country, decoded->subjectC, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9260 cn->country[sz] = 0;
wolfSSL 11:cee25a834751 9261 cn->countryEnc = decoded->subjectCEnc;
wolfSSL 11:cee25a834751 9262 }
wolfSSL 11:cee25a834751 9263 if (decoded->subjectST) {
wolfSSL 11:cee25a834751 9264 sz = (decoded->subjectSTLen < CTC_NAME_SIZE) ? decoded->subjectSTLen
wolfSSL 11:cee25a834751 9265 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9266 strncpy(cn->state, decoded->subjectST, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9267 cn->state[sz] = 0;
wolfSSL 11:cee25a834751 9268 cn->stateEnc = decoded->subjectSTEnc;
wolfSSL 11:cee25a834751 9269 }
wolfSSL 11:cee25a834751 9270 if (decoded->subjectL) {
wolfSSL 11:cee25a834751 9271 sz = (decoded->subjectLLen < CTC_NAME_SIZE) ? decoded->subjectLLen
wolfSSL 11:cee25a834751 9272 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9273 strncpy(cn->locality, decoded->subjectL, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9274 cn->locality[sz] = 0;
wolfSSL 11:cee25a834751 9275 cn->localityEnc = decoded->subjectLEnc;
wolfSSL 11:cee25a834751 9276 }
wolfSSL 11:cee25a834751 9277 if (decoded->subjectO) {
wolfSSL 11:cee25a834751 9278 sz = (decoded->subjectOLen < CTC_NAME_SIZE) ? decoded->subjectOLen
wolfSSL 11:cee25a834751 9279 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9280 strncpy(cn->org, decoded->subjectO, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9281 cn->org[sz] = 0;
wolfSSL 11:cee25a834751 9282 cn->orgEnc = decoded->subjectOEnc;
wolfSSL 11:cee25a834751 9283 }
wolfSSL 11:cee25a834751 9284 if (decoded->subjectOU) {
wolfSSL 11:cee25a834751 9285 sz = (decoded->subjectOULen < CTC_NAME_SIZE) ? decoded->subjectOULen
wolfSSL 11:cee25a834751 9286 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9287 strncpy(cn->unit, decoded->subjectOU, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9288 cn->unit[sz] = 0;
wolfSSL 11:cee25a834751 9289 cn->unitEnc = decoded->subjectOUEnc;
wolfSSL 11:cee25a834751 9290 }
wolfSSL 11:cee25a834751 9291 if (decoded->subjectSN) {
wolfSSL 11:cee25a834751 9292 sz = (decoded->subjectSNLen < CTC_NAME_SIZE) ? decoded->subjectSNLen
wolfSSL 11:cee25a834751 9293 : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9294 strncpy(cn->sur, decoded->subjectSN, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9295 cn->sur[sz] = 0;
wolfSSL 11:cee25a834751 9296 cn->surEnc = decoded->subjectSNEnc;
wolfSSL 11:cee25a834751 9297 }
wolfSSL 11:cee25a834751 9298 if (decoded->subjectEmail) {
wolfSSL 11:cee25a834751 9299 sz = (decoded->subjectEmailLen < CTC_NAME_SIZE)
wolfSSL 11:cee25a834751 9300 ? decoded->subjectEmailLen : CTC_NAME_SIZE - 1;
wolfSSL 11:cee25a834751 9301 strncpy(cn->email, decoded->subjectEmail, CTC_NAME_SIZE);
wolfSSL 11:cee25a834751 9302 cn->email[sz] = 0;
wolfSSL 11:cee25a834751 9303 }
wolfSSL 11:cee25a834751 9304 }
wolfSSL 11:cee25a834751 9305
wolfSSL 11:cee25a834751 9306 FreeDecodedCert(decoded);
wolfSSL 11:cee25a834751 9307
wolfSSL 11:cee25a834751 9308 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9309 XFREE(decoded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9310 #endif
wolfSSL 11:cee25a834751 9311
wolfSSL 11:cee25a834751 9312 return ret < 0 ? ret : 0;
wolfSSL 11:cee25a834751 9313 }
wolfSSL 11:cee25a834751 9314
wolfSSL 11:cee25a834751 9315
wolfSSL 11:cee25a834751 9316 #ifndef NO_FILESYSTEM
wolfSSL 11:cee25a834751 9317
wolfSSL 11:cee25a834751 9318 /* Set cert issuer from issuerFile in PEM */
wolfSSL 11:cee25a834751 9319 int wc_SetIssuer(Cert* cert, const char* issuerFile)
wolfSSL 11:cee25a834751 9320 {
wolfSSL 11:cee25a834751 9321 int ret;
wolfSSL 11:cee25a834751 9322 int derSz;
wolfSSL 11:cee25a834751 9323 byte* der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9324
wolfSSL 11:cee25a834751 9325 if (der == NULL) {
wolfSSL 11:cee25a834751 9326 WOLFSSL_MSG("wc_SetIssuer OOF Problem");
wolfSSL 11:cee25a834751 9327 return MEMORY_E;
wolfSSL 11:cee25a834751 9328 }
wolfSSL 11:cee25a834751 9329 derSz = wolfSSL_PemCertToDer(issuerFile, der, EIGHTK_BUF);
wolfSSL 11:cee25a834751 9330 cert->selfSigned = 0;
wolfSSL 11:cee25a834751 9331 ret = SetNameFromCert(&cert->issuer, der, derSz);
wolfSSL 11:cee25a834751 9332 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9333
wolfSSL 11:cee25a834751 9334 return ret;
wolfSSL 11:cee25a834751 9335 }
wolfSSL 11:cee25a834751 9336
wolfSSL 11:cee25a834751 9337
wolfSSL 11:cee25a834751 9338 /* Set cert subject from subjectFile in PEM */
wolfSSL 11:cee25a834751 9339 int wc_SetSubject(Cert* cert, const char* subjectFile)
wolfSSL 11:cee25a834751 9340 {
wolfSSL 11:cee25a834751 9341 int ret;
wolfSSL 11:cee25a834751 9342 int derSz;
wolfSSL 11:cee25a834751 9343 byte* der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9344
wolfSSL 11:cee25a834751 9345 if (der == NULL) {
wolfSSL 11:cee25a834751 9346 WOLFSSL_MSG("wc_SetSubject OOF Problem");
wolfSSL 11:cee25a834751 9347 return MEMORY_E;
wolfSSL 11:cee25a834751 9348 }
wolfSSL 11:cee25a834751 9349 derSz = wolfSSL_PemCertToDer(subjectFile, der, EIGHTK_BUF);
wolfSSL 11:cee25a834751 9350 ret = SetNameFromCert(&cert->subject, der, derSz);
wolfSSL 11:cee25a834751 9351 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9352
wolfSSL 11:cee25a834751 9353 return ret;
wolfSSL 11:cee25a834751 9354 }
wolfSSL 11:cee25a834751 9355
wolfSSL 11:cee25a834751 9356
wolfSSL 11:cee25a834751 9357 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 9358
wolfSSL 11:cee25a834751 9359 /* Set atl names from file in PEM */
wolfSSL 11:cee25a834751 9360 int wc_SetAltNames(Cert* cert, const char* file)
wolfSSL 11:cee25a834751 9361 {
wolfSSL 11:cee25a834751 9362 int ret;
wolfSSL 11:cee25a834751 9363 int derSz;
wolfSSL 11:cee25a834751 9364 byte* der = (byte*)XMALLOC(EIGHTK_BUF, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9365
wolfSSL 11:cee25a834751 9366 if (der == NULL) {
wolfSSL 11:cee25a834751 9367 WOLFSSL_MSG("wc_SetAltNames OOF Problem");
wolfSSL 11:cee25a834751 9368 return MEMORY_E;
wolfSSL 11:cee25a834751 9369 }
wolfSSL 11:cee25a834751 9370 derSz = wolfSSL_PemCertToDer(file, der, EIGHTK_BUF);
wolfSSL 11:cee25a834751 9371 ret = SetAltNamesFromCert(cert, der, derSz);
wolfSSL 11:cee25a834751 9372 XFREE(der, cert->heap, DYNAMIC_TYPE_CERT);
wolfSSL 11:cee25a834751 9373
wolfSSL 11:cee25a834751 9374 return ret;
wolfSSL 11:cee25a834751 9375 }
wolfSSL 11:cee25a834751 9376
wolfSSL 11:cee25a834751 9377 #endif /* WOLFSSL_ALT_NAMES */
wolfSSL 11:cee25a834751 9378
wolfSSL 11:cee25a834751 9379 #endif /* NO_FILESYSTEM */
wolfSSL 11:cee25a834751 9380
wolfSSL 11:cee25a834751 9381 /* Set cert issuer from DER buffer */
wolfSSL 11:cee25a834751 9382 int wc_SetIssuerBuffer(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9383 {
wolfSSL 11:cee25a834751 9384 cert->selfSigned = 0;
wolfSSL 11:cee25a834751 9385 return SetNameFromCert(&cert->issuer, der, derSz);
wolfSSL 11:cee25a834751 9386 }
wolfSSL 11:cee25a834751 9387
wolfSSL 11:cee25a834751 9388
wolfSSL 11:cee25a834751 9389 /* Set cert subject from DER buffer */
wolfSSL 11:cee25a834751 9390 int wc_SetSubjectBuffer(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9391 {
wolfSSL 11:cee25a834751 9392 return SetNameFromCert(&cert->subject, der, derSz);
wolfSSL 11:cee25a834751 9393 }
wolfSSL 11:cee25a834751 9394
wolfSSL 11:cee25a834751 9395
wolfSSL 11:cee25a834751 9396 #ifdef WOLFSSL_ALT_NAMES
wolfSSL 11:cee25a834751 9397
wolfSSL 11:cee25a834751 9398 /* Set cert alt names from DER buffer */
wolfSSL 11:cee25a834751 9399 int wc_SetAltNamesBuffer(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9400 {
wolfSSL 11:cee25a834751 9401 return SetAltNamesFromCert(cert, der, derSz);
wolfSSL 11:cee25a834751 9402 }
wolfSSL 11:cee25a834751 9403
wolfSSL 11:cee25a834751 9404 /* Set cert dates from DER buffer */
wolfSSL 11:cee25a834751 9405 int wc_SetDatesBuffer(Cert* cert, const byte* der, int derSz)
wolfSSL 11:cee25a834751 9406 {
wolfSSL 11:cee25a834751 9407 return SetDatesFromCert(cert, der, derSz);
wolfSSL 11:cee25a834751 9408 }
wolfSSL 11:cee25a834751 9409
wolfSSL 11:cee25a834751 9410 #endif /* WOLFSSL_ALT_NAMES */
wolfSSL 11:cee25a834751 9411
wolfSSL 11:cee25a834751 9412 #endif /* WOLFSSL_CERT_GEN */
wolfSSL 11:cee25a834751 9413
wolfSSL 11:cee25a834751 9414
wolfSSL 11:cee25a834751 9415 #ifdef HAVE_ECC
wolfSSL 11:cee25a834751 9416
wolfSSL 11:cee25a834751 9417 /* Der Encode r & s ints into out, outLen is (in/out) size */
wolfSSL 11:cee25a834751 9418 int StoreECC_DSA_Sig(byte* out, word32* outLen, mp_int* r, mp_int* s)
wolfSSL 11:cee25a834751 9419 {
wolfSSL 11:cee25a834751 9420 word32 idx = 0;
wolfSSL 11:cee25a834751 9421 int rSz; /* encoding size */
wolfSSL 11:cee25a834751 9422 int sSz;
wolfSSL 11:cee25a834751 9423 word32 headerSz = 4; /* 2*ASN_TAG + 2*LEN(ENUM) */
wolfSSL 11:cee25a834751 9424
wolfSSL 11:cee25a834751 9425 /* If the leading bit on the INTEGER is a 1, add a leading zero */
wolfSSL 11:cee25a834751 9426 int rLeadingZero = mp_leading_bit(r);
wolfSSL 11:cee25a834751 9427 int sLeadingZero = mp_leading_bit(s);
wolfSSL 11:cee25a834751 9428 int rLen = mp_unsigned_bin_size(r); /* big int size */
wolfSSL 11:cee25a834751 9429 int sLen = mp_unsigned_bin_size(s);
wolfSSL 11:cee25a834751 9430
wolfSSL 11:cee25a834751 9431 if (*outLen < (rLen + rLeadingZero + sLen + sLeadingZero +
wolfSSL 11:cee25a834751 9432 headerSz + 2)) /* SEQ_TAG + LEN(ENUM) */
wolfSSL 11:cee25a834751 9433 return BUFFER_E;
wolfSSL 11:cee25a834751 9434
wolfSSL 11:cee25a834751 9435 idx = SetSequence(rLen + rLeadingZero + sLen+sLeadingZero + headerSz, out);
wolfSSL 11:cee25a834751 9436
wolfSSL 11:cee25a834751 9437 /* store r */
wolfSSL 11:cee25a834751 9438 rSz = SetASNIntMP(r, -1, &out[idx]);
wolfSSL 11:cee25a834751 9439 if (rSz < 0)
wolfSSL 11:cee25a834751 9440 return rSz;
wolfSSL 11:cee25a834751 9441 idx += rSz;
wolfSSL 11:cee25a834751 9442
wolfSSL 11:cee25a834751 9443 /* store s */
wolfSSL 11:cee25a834751 9444 sSz = SetASNIntMP(s, -1, &out[idx]);
wolfSSL 11:cee25a834751 9445 if (sSz < 0)
wolfSSL 11:cee25a834751 9446 return sSz;
wolfSSL 11:cee25a834751 9447 idx += sSz;
wolfSSL 11:cee25a834751 9448
wolfSSL 11:cee25a834751 9449 *outLen = idx;
wolfSSL 11:cee25a834751 9450
wolfSSL 11:cee25a834751 9451 return 0;
wolfSSL 11:cee25a834751 9452 }
wolfSSL 11:cee25a834751 9453
wolfSSL 11:cee25a834751 9454
wolfSSL 11:cee25a834751 9455 /* Der Decode ECC-DSA Signature, r & s stored as big ints */
wolfSSL 11:cee25a834751 9456 int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen, mp_int* r, mp_int* s)
wolfSSL 11:cee25a834751 9457 {
wolfSSL 11:cee25a834751 9458 word32 idx = 0;
wolfSSL 11:cee25a834751 9459 int len = 0;
wolfSSL 11:cee25a834751 9460
wolfSSL 11:cee25a834751 9461 if (GetSequence(sig, &idx, &len, sigLen) < 0) {
wolfSSL 11:cee25a834751 9462 return ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9463 }
wolfSSL 11:cee25a834751 9464
wolfSSL 11:cee25a834751 9465 if ((word32)len > (sigLen - idx)) {
wolfSSL 11:cee25a834751 9466 return ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9467 }
wolfSSL 11:cee25a834751 9468
wolfSSL 11:cee25a834751 9469 if (GetInt(r, sig, &idx, sigLen) < 0) {
wolfSSL 11:cee25a834751 9470 return ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9471 }
wolfSSL 11:cee25a834751 9472
wolfSSL 11:cee25a834751 9473 if (GetInt(s, sig, &idx, sigLen) < 0) {
wolfSSL 11:cee25a834751 9474 return ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9475 }
wolfSSL 11:cee25a834751 9476
wolfSSL 11:cee25a834751 9477 return 0;
wolfSSL 11:cee25a834751 9478 }
wolfSSL 11:cee25a834751 9479
wolfSSL 11:cee25a834751 9480
wolfSSL 11:cee25a834751 9481 int wc_EccPrivateKeyDecode(const byte* input, word32* inOutIdx, ecc_key* key,
wolfSSL 11:cee25a834751 9482 word32 inSz)
wolfSSL 11:cee25a834751 9483 {
wolfSSL 11:cee25a834751 9484 word32 oidSum;
wolfSSL 11:cee25a834751 9485 int version, length;
wolfSSL 11:cee25a834751 9486 int privSz, pubSz;
wolfSSL 11:cee25a834751 9487 byte b;
wolfSSL 11:cee25a834751 9488 int ret = 0;
wolfSSL 11:cee25a834751 9489 int curve_id = ECC_CURVE_DEF;
wolfSSL 11:cee25a834751 9490 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9491 byte* priv;
wolfSSL 11:cee25a834751 9492 byte* pub;
wolfSSL 11:cee25a834751 9493 #else
wolfSSL 11:cee25a834751 9494 byte priv[ECC_MAXSIZE+1];
wolfSSL 11:cee25a834751 9495 byte pub[2*(ECC_MAXSIZE+1)]; /* public key has two parts plus header */
wolfSSL 11:cee25a834751 9496 #endif
wolfSSL 11:cee25a834751 9497
wolfSSL 11:cee25a834751 9498 if (input == NULL || inOutIdx == NULL || key == NULL || inSz == 0)
wolfSSL 11:cee25a834751 9499 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 9500
wolfSSL 11:cee25a834751 9501 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 9502 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9503
wolfSSL 11:cee25a834751 9504 if (GetMyVersion(input, inOutIdx, &version, inSz) < 0)
wolfSSL 11:cee25a834751 9505 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9506
wolfSSL 11:cee25a834751 9507 b = input[*inOutIdx];
wolfSSL 11:cee25a834751 9508 *inOutIdx += 1;
wolfSSL 11:cee25a834751 9509
wolfSSL 11:cee25a834751 9510 /* priv type */
wolfSSL 11:cee25a834751 9511 if (b != 4 && b != 6 && b != 7)
wolfSSL 11:cee25a834751 9512 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9513
wolfSSL 11:cee25a834751 9514 if (GetLength(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 9515 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9516
wolfSSL 11:cee25a834751 9517 if (length > ECC_MAXSIZE)
wolfSSL 11:cee25a834751 9518 return BUFFER_E;
wolfSSL 11:cee25a834751 9519
wolfSSL 11:cee25a834751 9520 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9521 priv = (byte*)XMALLOC(ECC_MAXSIZE+1, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9522 if (priv == NULL)
wolfSSL 11:cee25a834751 9523 return MEMORY_E;
wolfSSL 11:cee25a834751 9524
wolfSSL 11:cee25a834751 9525 pub = (byte*)XMALLOC(2*(ECC_MAXSIZE+1), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9526 if (pub == NULL) {
wolfSSL 11:cee25a834751 9527 XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9528 return MEMORY_E;
wolfSSL 11:cee25a834751 9529 }
wolfSSL 11:cee25a834751 9530 #endif
wolfSSL 11:cee25a834751 9531
wolfSSL 11:cee25a834751 9532 /* priv key */
wolfSSL 11:cee25a834751 9533 privSz = length;
wolfSSL 11:cee25a834751 9534 XMEMCPY(priv, &input[*inOutIdx], privSz);
wolfSSL 11:cee25a834751 9535 *inOutIdx += length;
wolfSSL 11:cee25a834751 9536
wolfSSL 11:cee25a834751 9537 if ((*inOutIdx + 1) > inSz)
wolfSSL 11:cee25a834751 9538 return BUFFER_E;
wolfSSL 11:cee25a834751 9539
wolfSSL 11:cee25a834751 9540 /* prefix 0, may have */
wolfSSL 11:cee25a834751 9541 b = input[*inOutIdx];
wolfSSL 11:cee25a834751 9542 if (b == ECC_PREFIX_0) {
wolfSSL 11:cee25a834751 9543 *inOutIdx += 1;
wolfSSL 11:cee25a834751 9544
wolfSSL 11:cee25a834751 9545 if (GetLength(input, inOutIdx, &length, inSz) <= 0)
wolfSSL 11:cee25a834751 9546 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9547 else {
wolfSSL 11:cee25a834751 9548 ret = GetObjectId(input, inOutIdx, &oidSum, oidIgnoreType, inSz);
wolfSSL 11:cee25a834751 9549 if (ret == 0) {
wolfSSL 11:cee25a834751 9550 if ((ret = CheckCurve(oidSum)) < 0)
wolfSSL 11:cee25a834751 9551 ret = ECC_CURVE_OID_E;
wolfSSL 11:cee25a834751 9552 else {
wolfSSL 11:cee25a834751 9553 curve_id = ret;
wolfSSL 11:cee25a834751 9554 ret = 0;
wolfSSL 11:cee25a834751 9555 }
wolfSSL 11:cee25a834751 9556 }
wolfSSL 11:cee25a834751 9557 }
wolfSSL 11:cee25a834751 9558 }
wolfSSL 11:cee25a834751 9559
wolfSSL 11:cee25a834751 9560 if (ret == 0) {
wolfSSL 11:cee25a834751 9561 /* prefix 1 */
wolfSSL 11:cee25a834751 9562 b = input[*inOutIdx];
wolfSSL 11:cee25a834751 9563 *inOutIdx += 1;
wolfSSL 11:cee25a834751 9564
wolfSSL 11:cee25a834751 9565 if (b != ECC_PREFIX_1) {
wolfSSL 11:cee25a834751 9566 ret = ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9567 }
wolfSSL 11:cee25a834751 9568 else if (GetLength(input, inOutIdx, &length, inSz) <= 0) {
wolfSSL 11:cee25a834751 9569 ret = ASN_PARSE_E;
wolfSSL 11:cee25a834751 9570 }
wolfSSL 11:cee25a834751 9571 else {
wolfSSL 11:cee25a834751 9572 /* key header */
wolfSSL 11:cee25a834751 9573 ret = CheckBitString(input, inOutIdx, &length, inSz, 0, NULL);
wolfSSL 11:cee25a834751 9574 if (ret == 0) {
wolfSSL 11:cee25a834751 9575 /* pub key */
wolfSSL 11:cee25a834751 9576 pubSz = length;
wolfSSL 11:cee25a834751 9577 if (pubSz < 2*(ECC_MAXSIZE+1)) {
wolfSSL 11:cee25a834751 9578 XMEMCPY(pub, &input[*inOutIdx], pubSz);
wolfSSL 11:cee25a834751 9579 *inOutIdx += length;
wolfSSL 11:cee25a834751 9580 ret = wc_ecc_import_private_key_ex(priv, privSz, pub,
wolfSSL 11:cee25a834751 9581 pubSz, key, curve_id);
wolfSSL 11:cee25a834751 9582 }
wolfSSL 11:cee25a834751 9583 else
wolfSSL 11:cee25a834751 9584 ret = BUFFER_E;
wolfSSL 11:cee25a834751 9585 }
wolfSSL 11:cee25a834751 9586 }
wolfSSL 11:cee25a834751 9587 }
wolfSSL 11:cee25a834751 9588
wolfSSL 11:cee25a834751 9589 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 9590 XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9591 XFREE(pub, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9592 #endif
wolfSSL 11:cee25a834751 9593
wolfSSL 11:cee25a834751 9594 return ret;
wolfSSL 11:cee25a834751 9595 }
wolfSSL 11:cee25a834751 9596
wolfSSL 11:cee25a834751 9597
wolfSSL 11:cee25a834751 9598 int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx,
wolfSSL 11:cee25a834751 9599 ecc_key* key, word32 inSz)
wolfSSL 11:cee25a834751 9600 {
wolfSSL 11:cee25a834751 9601 int length;
wolfSSL 11:cee25a834751 9602 int ret;
wolfSSL 11:cee25a834751 9603 #ifdef ECC_CHECK_PUBLIC_KEY_OID
wolfSSL 11:cee25a834751 9604 word32 oidSum;
wolfSSL 11:cee25a834751 9605 #endif
wolfSSL 11:cee25a834751 9606
wolfSSL 11:cee25a834751 9607 if (input == NULL || inOutIdx == NULL || key == NULL || inSz == 0)
wolfSSL 11:cee25a834751 9608 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 9609
wolfSSL 11:cee25a834751 9610 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 9611 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9612
wolfSSL 11:cee25a834751 9613 if (GetSequence(input, inOutIdx, &length, inSz) < 0)
wolfSSL 11:cee25a834751 9614 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9615
wolfSSL 11:cee25a834751 9616 ret = SkipObjectId(input, inOutIdx, inSz);
wolfSSL 11:cee25a834751 9617 if (ret != 0)
wolfSSL 11:cee25a834751 9618 return ret;
wolfSSL 11:cee25a834751 9619
wolfSSL 11:cee25a834751 9620 /* ecc params information */
wolfSSL 11:cee25a834751 9621 #ifdef ECC_CHECK_PUBLIC_KEY_OID
wolfSSL 11:cee25a834751 9622 ret = GetObjectId(input, inOutIdx, &oidSum, oidIgnoreType, inSz);
wolfSSL 11:cee25a834751 9623 if (ret != 0)
wolfSSL 11:cee25a834751 9624 return ret;
wolfSSL 11:cee25a834751 9625 if (CheckCurve(oidSum) < 0)
wolfSSL 11:cee25a834751 9626 return ECC_CURVE_OID_E;
wolfSSL 11:cee25a834751 9627 #else
wolfSSL 11:cee25a834751 9628 ret = SkipObjectId(input, inOutIdx, inSz);
wolfSSL 11:cee25a834751 9629 if (ret != 0)
wolfSSL 11:cee25a834751 9630 return ret;
wolfSSL 11:cee25a834751 9631 #endif
wolfSSL 11:cee25a834751 9632
wolfSSL 11:cee25a834751 9633 /* key header */
wolfSSL 11:cee25a834751 9634 ret = CheckBitString(input, inOutIdx, NULL, inSz, 1, NULL);
wolfSSL 11:cee25a834751 9635 if (ret != 0)
wolfSSL 11:cee25a834751 9636 return ret;
wolfSSL 11:cee25a834751 9637
wolfSSL 11:cee25a834751 9638 /* This is the raw point data compressed or uncompressed. */
wolfSSL 11:cee25a834751 9639 if (wc_ecc_import_x963(input + *inOutIdx, inSz - *inOutIdx, key) != 0)
wolfSSL 11:cee25a834751 9640 return ASN_ECC_KEY_E;
wolfSSL 11:cee25a834751 9641
wolfSSL 11:cee25a834751 9642 return 0;
wolfSSL 11:cee25a834751 9643 }
wolfSSL 11:cee25a834751 9644
wolfSSL 11:cee25a834751 9645
wolfSSL 11:cee25a834751 9646 #ifdef WOLFSSL_KEY_GEN
wolfSSL 11:cee25a834751 9647
wolfSSL 11:cee25a834751 9648 /* build DER formatted ECC key, include optional public key if requested,
wolfSSL 11:cee25a834751 9649 * return length on success, negative on error */
wolfSSL 11:cee25a834751 9650 static int wc_BuildEccKeyDer(ecc_key* key, byte* output, word32 inLen,
wolfSSL 11:cee25a834751 9651 int pubIn)
wolfSSL 11:cee25a834751 9652 {
wolfSSL 11:cee25a834751 9653 byte curve[MAX_ALGO_SZ+2];
wolfSSL 11:cee25a834751 9654 byte ver[MAX_VERSION_SZ];
wolfSSL 11:cee25a834751 9655 byte seq[MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 9656 byte *prv = NULL, *pub = NULL;
wolfSSL 11:cee25a834751 9657 int ret, totalSz, curveSz, verSz;
wolfSSL 11:cee25a834751 9658 int privHdrSz = ASN_ECC_HEADER_SZ;
wolfSSL 11:cee25a834751 9659 int pubHdrSz = ASN_ECC_CONTEXT_SZ + ASN_ECC_HEADER_SZ;
wolfSSL 11:cee25a834751 9660
wolfSSL 11:cee25a834751 9661 word32 idx = 0, prvidx = 0, pubidx = 0, curveidx = 0;
wolfSSL 11:cee25a834751 9662 word32 seqSz, privSz, pubSz = ECC_BUFSIZE;
wolfSSL 11:cee25a834751 9663
wolfSSL 11:cee25a834751 9664 if (key == NULL || output == NULL || inLen == 0)
wolfSSL 11:cee25a834751 9665 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 9666
wolfSSL 11:cee25a834751 9667 /* curve */
wolfSSL 11:cee25a834751 9668 curve[curveidx++] = ECC_PREFIX_0;
wolfSSL 11:cee25a834751 9669 curveidx++ /* to put the size after computation */;
wolfSSL 11:cee25a834751 9670 curveSz = SetCurve(key, curve+curveidx);
wolfSSL 11:cee25a834751 9671 if (curveSz < 0)
wolfSSL 11:cee25a834751 9672 return curveSz;
wolfSSL 11:cee25a834751 9673 /* set computed size */
wolfSSL 11:cee25a834751 9674 curve[1] = (byte)curveSz;
wolfSSL 11:cee25a834751 9675 curveidx += curveSz;
wolfSSL 11:cee25a834751 9676
wolfSSL 11:cee25a834751 9677 /* private */
wolfSSL 11:cee25a834751 9678 privSz = key->dp->size;
wolfSSL 11:cee25a834751 9679 prv = (byte*)XMALLOC(privSz + privHdrSz + MAX_SEQ_SZ,
wolfSSL 11:cee25a834751 9680 key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9681 if (prv == NULL) {
wolfSSL 11:cee25a834751 9682 return MEMORY_E;
wolfSSL 11:cee25a834751 9683 }
wolfSSL 11:cee25a834751 9684 prvidx += SetOctetString8Bit(key->dp->size, &prv[prvidx]);
wolfSSL 11:cee25a834751 9685 ret = wc_ecc_export_private_only(key, prv + prvidx, &privSz);
wolfSSL 11:cee25a834751 9686 if (ret < 0) {
wolfSSL 11:cee25a834751 9687 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9688 return ret;
wolfSSL 11:cee25a834751 9689 }
wolfSSL 11:cee25a834751 9690 prvidx += privSz;
wolfSSL 11:cee25a834751 9691
wolfSSL 11:cee25a834751 9692 /* pubIn */
wolfSSL 11:cee25a834751 9693 if (pubIn) {
wolfSSL 11:cee25a834751 9694 ret = wc_ecc_export_x963(key, NULL, &pubSz);
wolfSSL 11:cee25a834751 9695 if (ret != LENGTH_ONLY_E) {
wolfSSL 11:cee25a834751 9696 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9697 return ret;
wolfSSL 11:cee25a834751 9698 }
wolfSSL 11:cee25a834751 9699
wolfSSL 11:cee25a834751 9700 pub = (byte*)XMALLOC(pubSz + pubHdrSz + MAX_SEQ_SZ,
wolfSSL 11:cee25a834751 9701 key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9702 if (pub == NULL) {
wolfSSL 11:cee25a834751 9703 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9704 return MEMORY_E;
wolfSSL 11:cee25a834751 9705 }
wolfSSL 11:cee25a834751 9706
wolfSSL 11:cee25a834751 9707 pub[pubidx++] = ECC_PREFIX_1;
wolfSSL 11:cee25a834751 9708 if (pubSz > 128) /* leading zero + extra size byte */
wolfSSL 11:cee25a834751 9709 pubidx += SetLength(pubSz + ASN_ECC_CONTEXT_SZ + 2, pub+pubidx);
wolfSSL 11:cee25a834751 9710 else /* leading zero */
wolfSSL 11:cee25a834751 9711 pubidx += SetLength(pubSz + ASN_ECC_CONTEXT_SZ + 1, pub+pubidx);
wolfSSL 11:cee25a834751 9712
wolfSSL 11:cee25a834751 9713 /* SetBitString adds leading zero */
wolfSSL 11:cee25a834751 9714 pubidx += SetBitString(pubSz, 0, pub + pubidx);
wolfSSL 11:cee25a834751 9715 ret = wc_ecc_export_x963(key, pub + pubidx, &pubSz);
wolfSSL 11:cee25a834751 9716 if (ret != 0) {
wolfSSL 11:cee25a834751 9717 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9718 XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9719 return ret;
wolfSSL 11:cee25a834751 9720 }
wolfSSL 11:cee25a834751 9721 pubidx += pubSz;
wolfSSL 11:cee25a834751 9722 }
wolfSSL 11:cee25a834751 9723
wolfSSL 11:cee25a834751 9724 /* make headers */
wolfSSL 11:cee25a834751 9725 verSz = SetMyVersion(1, ver, FALSE);
wolfSSL 11:cee25a834751 9726 seqSz = SetSequence(verSz + prvidx + pubidx + curveidx, seq);
wolfSSL 11:cee25a834751 9727
wolfSSL 11:cee25a834751 9728 totalSz = prvidx + pubidx + curveidx + verSz + seqSz;
wolfSSL 11:cee25a834751 9729 if (totalSz > (int)inLen) {
wolfSSL 11:cee25a834751 9730 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9731 if (pubIn) {
wolfSSL 11:cee25a834751 9732 XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9733 }
wolfSSL 11:cee25a834751 9734 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 9735 }
wolfSSL 11:cee25a834751 9736
wolfSSL 11:cee25a834751 9737 /* write out */
wolfSSL 11:cee25a834751 9738 /* seq */
wolfSSL 11:cee25a834751 9739 XMEMCPY(output + idx, seq, seqSz);
wolfSSL 11:cee25a834751 9740 idx = seqSz;
wolfSSL 11:cee25a834751 9741
wolfSSL 11:cee25a834751 9742 /* ver */
wolfSSL 11:cee25a834751 9743 XMEMCPY(output + idx, ver, verSz);
wolfSSL 11:cee25a834751 9744 idx += verSz;
wolfSSL 11:cee25a834751 9745
wolfSSL 11:cee25a834751 9746 /* private */
wolfSSL 11:cee25a834751 9747 XMEMCPY(output + idx, prv, prvidx);
wolfSSL 11:cee25a834751 9748 idx += prvidx;
wolfSSL 11:cee25a834751 9749 XFREE(prv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9750
wolfSSL 11:cee25a834751 9751 /* curve */
wolfSSL 11:cee25a834751 9752 XMEMCPY(output + idx, curve, curveidx);
wolfSSL 11:cee25a834751 9753 idx += curveidx;
wolfSSL 11:cee25a834751 9754
wolfSSL 11:cee25a834751 9755 /* pubIn */
wolfSSL 11:cee25a834751 9756 if (pubIn) {
wolfSSL 11:cee25a834751 9757 XMEMCPY(output + idx, pub, pubidx);
wolfSSL 11:cee25a834751 9758 /* idx += pubidx; not used after write, if more data remove comment */
wolfSSL 11:cee25a834751 9759 XFREE(pub, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 9760 }
wolfSSL 11:cee25a834751 9761
wolfSSL 11:cee25a834751 9762 return totalSz;
wolfSSL 11:cee25a834751 9763 }
wolfSSL 11:cee25a834751 9764
wolfSSL 11:cee25a834751 9765
wolfSSL 11:cee25a834751 9766 /* Write a Private ecc key, including public to DER format,
wolfSSL 11:cee25a834751 9767 * length on success else < 0 */
wolfSSL 11:cee25a834751 9768 int wc_EccKeyToDer(ecc_key* key, byte* output, word32 inLen)
wolfSSL 11:cee25a834751 9769 {
wolfSSL 11:cee25a834751 9770 return wc_BuildEccKeyDer(key, output, inLen, 1);
wolfSSL 11:cee25a834751 9771 }
wolfSSL 11:cee25a834751 9772
wolfSSL 11:cee25a834751 9773
wolfSSL 11:cee25a834751 9774 /* Write only private ecc key to DER format,
wolfSSL 11:cee25a834751 9775 * length on success else < 0 */
wolfSSL 11:cee25a834751 9776 int wc_EccPrivateKeyToDer(ecc_key* key, byte* output, word32 inLen)
wolfSSL 11:cee25a834751 9777 {
wolfSSL 11:cee25a834751 9778 return wc_BuildEccKeyDer(key, output, inLen, 0);
wolfSSL 11:cee25a834751 9779 }
wolfSSL 11:cee25a834751 9780
wolfSSL 11:cee25a834751 9781 #endif /* WOLFSSL_KEY_GEN */
wolfSSL 11:cee25a834751 9782
wolfSSL 11:cee25a834751 9783 #endif /* HAVE_ECC */
wolfSSL 11:cee25a834751 9784
wolfSSL 11:cee25a834751 9785
wolfSSL 11:cee25a834751 9786 #if defined(HAVE_OCSP) || defined(HAVE_CRL)
wolfSSL 11:cee25a834751 9787
wolfSSL 11:cee25a834751 9788 /* Get raw Date only, no processing, 0 on success */
wolfSSL 11:cee25a834751 9789 static int GetBasicDate(const byte* source, word32* idx, byte* date,
wolfSSL 11:cee25a834751 9790 byte* format, int maxIdx)
wolfSSL 11:cee25a834751 9791 {
wolfSSL 11:cee25a834751 9792 int length;
wolfSSL 11:cee25a834751 9793
wolfSSL 11:cee25a834751 9794 WOLFSSL_ENTER("GetBasicDate");
wolfSSL 11:cee25a834751 9795
wolfSSL 11:cee25a834751 9796 *format = source[*idx];
wolfSSL 11:cee25a834751 9797 *idx += 1;
wolfSSL 11:cee25a834751 9798 if (*format != ASN_UTC_TIME && *format != ASN_GENERALIZED_TIME)
wolfSSL 11:cee25a834751 9799 return ASN_TIME_E;
wolfSSL 11:cee25a834751 9800
wolfSSL 11:cee25a834751 9801 if (GetLength(source, idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 9802 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9803
wolfSSL 11:cee25a834751 9804 if (length > MAX_DATE_SIZE || length < MIN_DATE_SIZE)
wolfSSL 11:cee25a834751 9805 return ASN_DATE_SZ_E;
wolfSSL 11:cee25a834751 9806
wolfSSL 11:cee25a834751 9807 XMEMCPY(date, &source[*idx], length);
wolfSSL 11:cee25a834751 9808 *idx += length;
wolfSSL 11:cee25a834751 9809
wolfSSL 11:cee25a834751 9810 return 0;
wolfSSL 11:cee25a834751 9811 }
wolfSSL 11:cee25a834751 9812
wolfSSL 11:cee25a834751 9813 #endif
wolfSSL 11:cee25a834751 9814
wolfSSL 11:cee25a834751 9815
wolfSSL 11:cee25a834751 9816 #ifdef HAVE_OCSP
wolfSSL 11:cee25a834751 9817
wolfSSL 11:cee25a834751 9818 static int GetEnumerated(const byte* input, word32* inOutIdx, int *value)
wolfSSL 11:cee25a834751 9819 {
wolfSSL 11:cee25a834751 9820 word32 idx = *inOutIdx;
wolfSSL 11:cee25a834751 9821 word32 len;
wolfSSL 11:cee25a834751 9822
wolfSSL 11:cee25a834751 9823 WOLFSSL_ENTER("GetEnumerated");
wolfSSL 11:cee25a834751 9824
wolfSSL 11:cee25a834751 9825 *value = 0;
wolfSSL 11:cee25a834751 9826
wolfSSL 11:cee25a834751 9827 if (input[idx++] != ASN_ENUMERATED)
wolfSSL 11:cee25a834751 9828 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9829
wolfSSL 11:cee25a834751 9830 len = input[idx++];
wolfSSL 11:cee25a834751 9831 if (len > 4)
wolfSSL 11:cee25a834751 9832 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9833
wolfSSL 11:cee25a834751 9834 while (len--) {
wolfSSL 11:cee25a834751 9835 *value = *value << 8 | input[idx++];
wolfSSL 11:cee25a834751 9836 }
wolfSSL 11:cee25a834751 9837
wolfSSL 11:cee25a834751 9838 *inOutIdx = idx;
wolfSSL 11:cee25a834751 9839
wolfSSL 11:cee25a834751 9840 return *value;
wolfSSL 11:cee25a834751 9841 }
wolfSSL 11:cee25a834751 9842
wolfSSL 11:cee25a834751 9843
wolfSSL 11:cee25a834751 9844 static int DecodeSingleResponse(byte* source,
wolfSSL 11:cee25a834751 9845 word32* ioIndex, OcspResponse* resp, word32 size)
wolfSSL 11:cee25a834751 9846 {
wolfSSL 11:cee25a834751 9847 word32 idx = *ioIndex, prevIndex, oid;
wolfSSL 11:cee25a834751 9848 int length, wrapperSz;
wolfSSL 11:cee25a834751 9849 CertStatus* cs = resp->status;
wolfSSL 11:cee25a834751 9850 int ret;
wolfSSL 11:cee25a834751 9851
wolfSSL 11:cee25a834751 9852 WOLFSSL_ENTER("DecodeSingleResponse");
wolfSSL 11:cee25a834751 9853
wolfSSL 11:cee25a834751 9854 /* Outer wrapper of the SEQUENCE OF Single Responses. */
wolfSSL 11:cee25a834751 9855 if (GetSequence(source, &idx, &wrapperSz, size) < 0)
wolfSSL 11:cee25a834751 9856 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9857
wolfSSL 11:cee25a834751 9858 prevIndex = idx;
wolfSSL 11:cee25a834751 9859
wolfSSL 11:cee25a834751 9860 /* When making a request, we only request one status on one certificate
wolfSSL 11:cee25a834751 9861 * at a time. There should only be one SingleResponse */
wolfSSL 11:cee25a834751 9862
wolfSSL 11:cee25a834751 9863 /* Wrapper around the Single Response */
wolfSSL 11:cee25a834751 9864 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 9865 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9866
wolfSSL 11:cee25a834751 9867 /* Wrapper around the CertID */
wolfSSL 11:cee25a834751 9868 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 9869 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9870 /* Skip the hash algorithm */
wolfSSL 11:cee25a834751 9871 if (GetAlgoId(source, &idx, &oid, oidIgnoreType, size) < 0)
wolfSSL 11:cee25a834751 9872 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9873 /* Save reference to the hash of CN */
wolfSSL 11:cee25a834751 9874 ret = GetOctetString(source, &idx, &length, size);
wolfSSL 11:cee25a834751 9875 if (ret < 0)
wolfSSL 11:cee25a834751 9876 return ret;
wolfSSL 11:cee25a834751 9877 resp->issuerHash = source + idx;
wolfSSL 11:cee25a834751 9878 idx += length;
wolfSSL 11:cee25a834751 9879 /* Save reference to the hash of the issuer public key */
wolfSSL 11:cee25a834751 9880 ret = GetOctetString(source, &idx, &length, size);
wolfSSL 11:cee25a834751 9881 if (ret < 0)
wolfSSL 11:cee25a834751 9882 return ret;
wolfSSL 11:cee25a834751 9883 resp->issuerKeyHash = source + idx;
wolfSSL 11:cee25a834751 9884 idx += length;
wolfSSL 11:cee25a834751 9885
wolfSSL 11:cee25a834751 9886 /* Get serial number */
wolfSSL 11:cee25a834751 9887 if (GetSerialNumber(source, &idx, cs->serial, &cs->serialSz, size) < 0)
wolfSSL 11:cee25a834751 9888 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9889
wolfSSL 11:cee25a834751 9890 /* CertStatus */
wolfSSL 11:cee25a834751 9891 switch (source[idx++])
wolfSSL 11:cee25a834751 9892 {
wolfSSL 11:cee25a834751 9893 case (ASN_CONTEXT_SPECIFIC | CERT_GOOD):
wolfSSL 11:cee25a834751 9894 cs->status = CERT_GOOD;
wolfSSL 11:cee25a834751 9895 idx++;
wolfSSL 11:cee25a834751 9896 break;
wolfSSL 11:cee25a834751 9897 case (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | CERT_REVOKED):
wolfSSL 11:cee25a834751 9898 cs->status = CERT_REVOKED;
wolfSSL 11:cee25a834751 9899 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 9900 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9901 idx += length;
wolfSSL 11:cee25a834751 9902 break;
wolfSSL 11:cee25a834751 9903 case (ASN_CONTEXT_SPECIFIC | CERT_UNKNOWN):
wolfSSL 11:cee25a834751 9904 cs->status = CERT_UNKNOWN;
wolfSSL 11:cee25a834751 9905 idx++;
wolfSSL 11:cee25a834751 9906 break;
wolfSSL 11:cee25a834751 9907 default:
wolfSSL 11:cee25a834751 9908 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9909 }
wolfSSL 11:cee25a834751 9910
wolfSSL 11:cee25a834751 9911 #if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
wolfSSL 11:cee25a834751 9912 cs->thisDateAsn = source + idx;
wolfSSL 11:cee25a834751 9913 #endif
wolfSSL 11:cee25a834751 9914 if (GetBasicDate(source, &idx, cs->thisDate,
wolfSSL 11:cee25a834751 9915 &cs->thisDateFormat, size) < 0)
wolfSSL 11:cee25a834751 9916 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9917
wolfSSL 11:cee25a834751 9918 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 9919 if (!XVALIDATE_DATE(cs->thisDate, cs->thisDateFormat, BEFORE))
wolfSSL 11:cee25a834751 9920 return ASN_BEFORE_DATE_E;
wolfSSL 11:cee25a834751 9921 #endif
wolfSSL 11:cee25a834751 9922
wolfSSL 11:cee25a834751 9923 /* The following items are optional. Only check for them if there is more
wolfSSL 11:cee25a834751 9924 * unprocessed data in the singleResponse wrapper. */
wolfSSL 11:cee25a834751 9925
wolfSSL 11:cee25a834751 9926 if (((int)(idx - prevIndex) < wrapperSz) &&
wolfSSL 11:cee25a834751 9927 (source[idx] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 0)))
wolfSSL 11:cee25a834751 9928 {
wolfSSL 11:cee25a834751 9929 idx++;
wolfSSL 11:cee25a834751 9930 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 9931 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9932 #if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
wolfSSL 11:cee25a834751 9933 cs->nextDateAsn = source + idx;
wolfSSL 11:cee25a834751 9934 #endif
wolfSSL 11:cee25a834751 9935 if (GetBasicDate(source, &idx, cs->nextDate,
wolfSSL 11:cee25a834751 9936 &cs->nextDateFormat, size) < 0)
wolfSSL 11:cee25a834751 9937 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9938
wolfSSL 11:cee25a834751 9939 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 9940 if (!XVALIDATE_DATE(cs->nextDate, cs->nextDateFormat, AFTER))
wolfSSL 11:cee25a834751 9941 return ASN_AFTER_DATE_E;
wolfSSL 11:cee25a834751 9942 #endif
wolfSSL 11:cee25a834751 9943 }
wolfSSL 11:cee25a834751 9944 if (((int)(idx - prevIndex) < wrapperSz) &&
wolfSSL 11:cee25a834751 9945 (source[idx] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 1)))
wolfSSL 11:cee25a834751 9946 {
wolfSSL 11:cee25a834751 9947 idx++;
wolfSSL 11:cee25a834751 9948 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 9949 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9950 idx += length;
wolfSSL 11:cee25a834751 9951 }
wolfSSL 11:cee25a834751 9952
wolfSSL 11:cee25a834751 9953 *ioIndex = idx;
wolfSSL 11:cee25a834751 9954
wolfSSL 11:cee25a834751 9955 return 0;
wolfSSL 11:cee25a834751 9956 }
wolfSSL 11:cee25a834751 9957
wolfSSL 11:cee25a834751 9958 static int DecodeOcspRespExtensions(byte* source,
wolfSSL 11:cee25a834751 9959 word32* ioIndex, OcspResponse* resp, word32 sz)
wolfSSL 11:cee25a834751 9960 {
wolfSSL 11:cee25a834751 9961 word32 idx = *ioIndex;
wolfSSL 11:cee25a834751 9962 int length;
wolfSSL 11:cee25a834751 9963 int ext_bound; /* boundary index for the sequence of extensions */
wolfSSL 11:cee25a834751 9964 word32 oid;
wolfSSL 11:cee25a834751 9965 int ret;
wolfSSL 11:cee25a834751 9966
wolfSSL 11:cee25a834751 9967 WOLFSSL_ENTER("DecodeOcspRespExtensions");
wolfSSL 11:cee25a834751 9968
wolfSSL 11:cee25a834751 9969 if ((idx + 1) > sz)
wolfSSL 11:cee25a834751 9970 return BUFFER_E;
wolfSSL 11:cee25a834751 9971
wolfSSL 11:cee25a834751 9972 if (source[idx++] != (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC | 1))
wolfSSL 11:cee25a834751 9973 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9974
wolfSSL 11:cee25a834751 9975 if (GetLength(source, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 9976 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9977
wolfSSL 11:cee25a834751 9978 if (GetSequence(source, &idx, &length, sz) < 0)
wolfSSL 11:cee25a834751 9979 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9980
wolfSSL 11:cee25a834751 9981 ext_bound = idx + length;
wolfSSL 11:cee25a834751 9982
wolfSSL 11:cee25a834751 9983 while (idx < (word32)ext_bound) {
wolfSSL 11:cee25a834751 9984 if (GetSequence(source, &idx, &length, sz) < 0) {
wolfSSL 11:cee25a834751 9985 WOLFSSL_MSG("\tfail: should be a SEQUENCE");
wolfSSL 11:cee25a834751 9986 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9987 }
wolfSSL 11:cee25a834751 9988
wolfSSL 11:cee25a834751 9989 oid = 0;
wolfSSL 11:cee25a834751 9990 if (GetObjectId(source, &idx, &oid, oidOcspType, sz) < 0) {
wolfSSL 11:cee25a834751 9991 WOLFSSL_MSG("\tfail: OBJECT ID");
wolfSSL 11:cee25a834751 9992 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 9993 }
wolfSSL 11:cee25a834751 9994
wolfSSL 11:cee25a834751 9995 /* check for critical flag */
wolfSSL 11:cee25a834751 9996 if (source[idx] == ASN_BOOLEAN) {
wolfSSL 11:cee25a834751 9997 WOLFSSL_MSG("\tfound optional critical flag, moving past");
wolfSSL 11:cee25a834751 9998 ret = GetBoolean(source, &idx, sz);
wolfSSL 11:cee25a834751 9999 if (ret < 0)
wolfSSL 11:cee25a834751 10000 return ret;
wolfSSL 11:cee25a834751 10001 }
wolfSSL 11:cee25a834751 10002
wolfSSL 11:cee25a834751 10003 ret = GetOctetString(source, &idx, &length, sz);
wolfSSL 11:cee25a834751 10004 if (ret < 0)
wolfSSL 11:cee25a834751 10005 return ret;
wolfSSL 11:cee25a834751 10006
wolfSSL 11:cee25a834751 10007 if (oid == OCSP_NONCE_OID) {
wolfSSL 11:cee25a834751 10008 /* get data inside extra OCTET_STRING */
wolfSSL 11:cee25a834751 10009 ret = GetOctetString(source, &idx, &length, sz);
wolfSSL 11:cee25a834751 10010 if (ret < 0)
wolfSSL 11:cee25a834751 10011 return ret;
wolfSSL 11:cee25a834751 10012
wolfSSL 11:cee25a834751 10013 resp->nonce = source + idx;
wolfSSL 11:cee25a834751 10014 resp->nonceSz = length;
wolfSSL 11:cee25a834751 10015 }
wolfSSL 11:cee25a834751 10016
wolfSSL 11:cee25a834751 10017 idx += length;
wolfSSL 11:cee25a834751 10018 }
wolfSSL 11:cee25a834751 10019
wolfSSL 11:cee25a834751 10020 *ioIndex = idx;
wolfSSL 11:cee25a834751 10021 return 0;
wolfSSL 11:cee25a834751 10022 }
wolfSSL 11:cee25a834751 10023
wolfSSL 11:cee25a834751 10024
wolfSSL 11:cee25a834751 10025 static int DecodeResponseData(byte* source,
wolfSSL 11:cee25a834751 10026 word32* ioIndex, OcspResponse* resp, word32 size)
wolfSSL 11:cee25a834751 10027 {
wolfSSL 11:cee25a834751 10028 word32 idx = *ioIndex, prev_idx;
wolfSSL 11:cee25a834751 10029 int length;
wolfSSL 11:cee25a834751 10030 int version;
wolfSSL 11:cee25a834751 10031 word32 responderId = 0;
wolfSSL 11:cee25a834751 10032
wolfSSL 11:cee25a834751 10033 WOLFSSL_ENTER("DecodeResponseData");
wolfSSL 11:cee25a834751 10034
wolfSSL 11:cee25a834751 10035 resp->response = source + idx;
wolfSSL 11:cee25a834751 10036 prev_idx = idx;
wolfSSL 11:cee25a834751 10037 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10038 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10039 resp->responseSz = length + idx - prev_idx;
wolfSSL 11:cee25a834751 10040
wolfSSL 11:cee25a834751 10041 /* Get version. It is an EXPLICIT[0] DEFAULT(0) value. If this
wolfSSL 11:cee25a834751 10042 * item isn't an EXPLICIT[0], then set version to zero and move
wolfSSL 11:cee25a834751 10043 * onto the next item.
wolfSSL 11:cee25a834751 10044 */
wolfSSL 11:cee25a834751 10045 if (source[idx] == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED))
wolfSSL 11:cee25a834751 10046 {
wolfSSL 11:cee25a834751 10047 idx += 2; /* Eat the value and length */
wolfSSL 11:cee25a834751 10048 if (GetMyVersion(source, &idx, &version, size) < 0)
wolfSSL 11:cee25a834751 10049 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10050 } else
wolfSSL 11:cee25a834751 10051 version = 0;
wolfSSL 11:cee25a834751 10052
wolfSSL 11:cee25a834751 10053 responderId = source[idx++];
wolfSSL 11:cee25a834751 10054 if ((responderId == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 1)) ||
wolfSSL 11:cee25a834751 10055 (responderId == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 2)))
wolfSSL 11:cee25a834751 10056 {
wolfSSL 11:cee25a834751 10057 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10058 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10059 idx += length;
wolfSSL 11:cee25a834751 10060 }
wolfSSL 11:cee25a834751 10061 else
wolfSSL 11:cee25a834751 10062 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10063
wolfSSL 11:cee25a834751 10064 /* save pointer to the producedAt time */
wolfSSL 11:cee25a834751 10065 if (GetBasicDate(source, &idx, resp->producedDate,
wolfSSL 11:cee25a834751 10066 &resp->producedDateFormat, size) < 0)
wolfSSL 11:cee25a834751 10067 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10068
wolfSSL 11:cee25a834751 10069 if (DecodeSingleResponse(source, &idx, resp, size) < 0)
wolfSSL 11:cee25a834751 10070 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10071
wolfSSL 11:cee25a834751 10072 /*
wolfSSL 11:cee25a834751 10073 * Check the length of the ResponseData against the current index to
wolfSSL 11:cee25a834751 10074 * see if there are extensions, they are optional.
wolfSSL 11:cee25a834751 10075 */
wolfSSL 11:cee25a834751 10076 if (idx - prev_idx < resp->responseSz)
wolfSSL 11:cee25a834751 10077 if (DecodeOcspRespExtensions(source, &idx, resp, size) < 0)
wolfSSL 11:cee25a834751 10078 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10079
wolfSSL 11:cee25a834751 10080 *ioIndex = idx;
wolfSSL 11:cee25a834751 10081 return 0;
wolfSSL 11:cee25a834751 10082 }
wolfSSL 11:cee25a834751 10083
wolfSSL 11:cee25a834751 10084
wolfSSL 11:cee25a834751 10085 #ifndef WOLFSSL_NO_OCSP_OPTIONAL_CERTS
wolfSSL 11:cee25a834751 10086
wolfSSL 11:cee25a834751 10087 static int DecodeCerts(byte* source,
wolfSSL 11:cee25a834751 10088 word32* ioIndex, OcspResponse* resp, word32 size)
wolfSSL 11:cee25a834751 10089 {
wolfSSL 11:cee25a834751 10090 word32 idx = *ioIndex;
wolfSSL 11:cee25a834751 10091
wolfSSL 11:cee25a834751 10092 WOLFSSL_ENTER("DecodeCerts");
wolfSSL 11:cee25a834751 10093
wolfSSL 11:cee25a834751 10094 if (source[idx++] == (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC))
wolfSSL 11:cee25a834751 10095 {
wolfSSL 11:cee25a834751 10096 int length;
wolfSSL 11:cee25a834751 10097
wolfSSL 11:cee25a834751 10098 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10099 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10100
wolfSSL 11:cee25a834751 10101 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10102 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10103
wolfSSL 11:cee25a834751 10104 resp->cert = source + idx;
wolfSSL 11:cee25a834751 10105 resp->certSz = length;
wolfSSL 11:cee25a834751 10106
wolfSSL 11:cee25a834751 10107 idx += length;
wolfSSL 11:cee25a834751 10108 }
wolfSSL 11:cee25a834751 10109 *ioIndex = idx;
wolfSSL 11:cee25a834751 10110 return 0;
wolfSSL 11:cee25a834751 10111 }
wolfSSL 11:cee25a834751 10112
wolfSSL 11:cee25a834751 10113 #endif /* WOLFSSL_NO_OCSP_OPTIONAL_CERTS */
wolfSSL 11:cee25a834751 10114
wolfSSL 11:cee25a834751 10115
wolfSSL 11:cee25a834751 10116 static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
wolfSSL 11:cee25a834751 10117 OcspResponse* resp, word32 size, void* cm, void* heap, int noVerify)
wolfSSL 11:cee25a834751 10118 {
wolfSSL 11:cee25a834751 10119 int length;
wolfSSL 11:cee25a834751 10120 word32 idx = *ioIndex;
wolfSSL 11:cee25a834751 10121 word32 end_index;
wolfSSL 11:cee25a834751 10122 int ret;
wolfSSL 11:cee25a834751 10123 int sigLength;
wolfSSL 11:cee25a834751 10124
wolfSSL 11:cee25a834751 10125 WOLFSSL_ENTER("DecodeBasicOcspResponse");
wolfSSL 11:cee25a834751 10126 (void)heap;
wolfSSL 11:cee25a834751 10127
wolfSSL 11:cee25a834751 10128 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10129 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10130
wolfSSL 11:cee25a834751 10131 if (idx + length > size)
wolfSSL 11:cee25a834751 10132 return ASN_INPUT_E;
wolfSSL 11:cee25a834751 10133 end_index = idx + length;
wolfSSL 11:cee25a834751 10134
wolfSSL 11:cee25a834751 10135 if (DecodeResponseData(source, &idx, resp, size) < 0)
wolfSSL 11:cee25a834751 10136 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10137
wolfSSL 11:cee25a834751 10138 /* Get the signature algorithm */
wolfSSL 11:cee25a834751 10139 if (GetAlgoId(source, &idx, &resp->sigOID, oidSigType, size) < 0)
wolfSSL 11:cee25a834751 10140 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10141
wolfSSL 11:cee25a834751 10142 ret = CheckBitString(source, &idx, &sigLength, size, 1, NULL);
wolfSSL 11:cee25a834751 10143 if (ret != 0)
wolfSSL 11:cee25a834751 10144 return ret;
wolfSSL 11:cee25a834751 10145
wolfSSL 11:cee25a834751 10146 resp->sigSz = sigLength;
wolfSSL 11:cee25a834751 10147 resp->sig = source + idx;
wolfSSL 11:cee25a834751 10148 idx += sigLength;
wolfSSL 11:cee25a834751 10149
wolfSSL 11:cee25a834751 10150 /*
wolfSSL 11:cee25a834751 10151 * Check the length of the BasicOcspResponse against the current index to
wolfSSL 11:cee25a834751 10152 * see if there are certificates, they are optional.
wolfSSL 11:cee25a834751 10153 */
wolfSSL 11:cee25a834751 10154 #ifndef WOLFSSL_NO_OCSP_OPTIONAL_CERTS
wolfSSL 11:cee25a834751 10155 if (idx < end_index)
wolfSSL 11:cee25a834751 10156 {
wolfSSL 11:cee25a834751 10157 DecodedCert cert;
wolfSSL 11:cee25a834751 10158
wolfSSL 11:cee25a834751 10159 if (DecodeCerts(source, &idx, resp, size) < 0)
wolfSSL 11:cee25a834751 10160 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10161
wolfSSL 11:cee25a834751 10162 InitDecodedCert(&cert, resp->cert, resp->certSz, heap);
wolfSSL 11:cee25a834751 10163 /* Don't verify if we don't have access to Cert Manager. */
wolfSSL 11:cee25a834751 10164 ret = ParseCertRelative(&cert, CERT_TYPE, noVerify ? NO_VERIFY : VERIFY,
wolfSSL 11:cee25a834751 10165 cm);
wolfSSL 11:cee25a834751 10166 if (ret < 0) {
wolfSSL 11:cee25a834751 10167 WOLFSSL_MSG("\tOCSP Responder certificate parsing failed");
wolfSSL 11:cee25a834751 10168 FreeDecodedCert(&cert);
wolfSSL 11:cee25a834751 10169 return ret;
wolfSSL 11:cee25a834751 10170 }
wolfSSL 11:cee25a834751 10171
wolfSSL 11:cee25a834751 10172 /* ConfirmSignature is blocking here */
wolfSSL 11:cee25a834751 10173 ret = ConfirmSignature(&cert.sigCtx,
wolfSSL 11:cee25a834751 10174 resp->response, resp->responseSz,
wolfSSL 11:cee25a834751 10175 cert.publicKey, cert.pubKeySize, cert.keyOID,
wolfSSL 11:cee25a834751 10176 resp->sig, resp->sigSz, resp->sigOID);
wolfSSL 11:cee25a834751 10177 FreeDecodedCert(&cert);
wolfSSL 11:cee25a834751 10178
wolfSSL 11:cee25a834751 10179 if (ret != 0) {
wolfSSL 11:cee25a834751 10180 WOLFSSL_MSG("\tOCSP Confirm signature failed");
wolfSSL 11:cee25a834751 10181 return ASN_OCSP_CONFIRM_E;
wolfSSL 11:cee25a834751 10182 }
wolfSSL 11:cee25a834751 10183 }
wolfSSL 11:cee25a834751 10184 else
wolfSSL 11:cee25a834751 10185 #endif /* WOLFSSL_NO_OCSP_OPTIONAL_CERTS */
wolfSSL 11:cee25a834751 10186 {
wolfSSL 11:cee25a834751 10187 Signer* ca = NULL;
wolfSSL 11:cee25a834751 10188 int sigValid = -1;
wolfSSL 11:cee25a834751 10189
wolfSSL 11:cee25a834751 10190 #ifndef NO_SKID
wolfSSL 11:cee25a834751 10191 ca = GetCA(cm, resp->issuerKeyHash);
wolfSSL 11:cee25a834751 10192 #else
wolfSSL 11:cee25a834751 10193 ca = GetCA(cm, resp->issuerHash);
wolfSSL 11:cee25a834751 10194 #endif
wolfSSL 11:cee25a834751 10195
wolfSSL 11:cee25a834751 10196 if (ca) {
wolfSSL 11:cee25a834751 10197 SignatureCtx sigCtx;
wolfSSL 11:cee25a834751 10198 InitSignatureCtx(&sigCtx, heap, INVALID_DEVID);
wolfSSL 11:cee25a834751 10199
wolfSSL 11:cee25a834751 10200 /* ConfirmSignature is blocking here */
wolfSSL 11:cee25a834751 10201 sigValid = ConfirmSignature(&sigCtx, resp->response,
wolfSSL 11:cee25a834751 10202 resp->responseSz, ca->publicKey, ca->pubKeySize, ca->keyOID,
wolfSSL 11:cee25a834751 10203 resp->sig, resp->sigSz, resp->sigOID);
wolfSSL 11:cee25a834751 10204 }
wolfSSL 11:cee25a834751 10205 if (ca == NULL || sigValid != 0) {
wolfSSL 11:cee25a834751 10206 WOLFSSL_MSG("\tOCSP Confirm signature failed");
wolfSSL 11:cee25a834751 10207 return ASN_OCSP_CONFIRM_E;
wolfSSL 11:cee25a834751 10208 }
wolfSSL 11:cee25a834751 10209 }
wolfSSL 11:cee25a834751 10210
wolfSSL 11:cee25a834751 10211 *ioIndex = idx;
wolfSSL 11:cee25a834751 10212 return 0;
wolfSSL 11:cee25a834751 10213 }
wolfSSL 11:cee25a834751 10214
wolfSSL 11:cee25a834751 10215
wolfSSL 11:cee25a834751 10216 void InitOcspResponse(OcspResponse* resp, CertStatus* status,
wolfSSL 11:cee25a834751 10217 byte* source, word32 inSz)
wolfSSL 11:cee25a834751 10218 {
wolfSSL 11:cee25a834751 10219 WOLFSSL_ENTER("InitOcspResponse");
wolfSSL 11:cee25a834751 10220
wolfSSL 11:cee25a834751 10221 XMEMSET(status, 0, sizeof(CertStatus));
wolfSSL 11:cee25a834751 10222 XMEMSET(resp, 0, sizeof(OcspResponse));
wolfSSL 11:cee25a834751 10223
wolfSSL 11:cee25a834751 10224 resp->responseStatus = -1;
wolfSSL 11:cee25a834751 10225 resp->status = status;
wolfSSL 11:cee25a834751 10226 resp->source = source;
wolfSSL 11:cee25a834751 10227 resp->maxIdx = inSz;
wolfSSL 11:cee25a834751 10228 }
wolfSSL 11:cee25a834751 10229
wolfSSL 11:cee25a834751 10230
wolfSSL 11:cee25a834751 10231 int OcspResponseDecode(OcspResponse* resp, void* cm, void* heap, int noVerify)
wolfSSL 11:cee25a834751 10232 {
wolfSSL 11:cee25a834751 10233 int ret;
wolfSSL 11:cee25a834751 10234 int length = 0;
wolfSSL 11:cee25a834751 10235 word32 idx = 0;
wolfSSL 11:cee25a834751 10236 byte* source = resp->source;
wolfSSL 11:cee25a834751 10237 word32 size = resp->maxIdx;
wolfSSL 11:cee25a834751 10238 word32 oid;
wolfSSL 11:cee25a834751 10239
wolfSSL 11:cee25a834751 10240 WOLFSSL_ENTER("OcspResponseDecode");
wolfSSL 11:cee25a834751 10241
wolfSSL 11:cee25a834751 10242 /* peel the outer SEQUENCE wrapper */
wolfSSL 11:cee25a834751 10243 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10244 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10245
wolfSSL 11:cee25a834751 10246 /* First get the responseStatus, an ENUMERATED */
wolfSSL 11:cee25a834751 10247 if (GetEnumerated(source, &idx, &resp->responseStatus) < 0)
wolfSSL 11:cee25a834751 10248 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10249
wolfSSL 11:cee25a834751 10250 if (resp->responseStatus != OCSP_SUCCESSFUL)
wolfSSL 11:cee25a834751 10251 return 0;
wolfSSL 11:cee25a834751 10252
wolfSSL 11:cee25a834751 10253 /* Next is an EXPLICIT record called ResponseBytes, OPTIONAL */
wolfSSL 11:cee25a834751 10254 if (idx >= size)
wolfSSL 11:cee25a834751 10255 return ASN_INPUT_E;
wolfSSL 11:cee25a834751 10256 if (source[idx++] != (ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC))
wolfSSL 11:cee25a834751 10257 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10258 if (GetLength(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10259 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10260
wolfSSL 11:cee25a834751 10261 /* Get the responseBytes SEQUENCE */
wolfSSL 11:cee25a834751 10262 if (GetSequence(source, &idx, &length, size) < 0)
wolfSSL 11:cee25a834751 10263 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10264
wolfSSL 11:cee25a834751 10265 /* Check ObjectID for the resposeBytes */
wolfSSL 11:cee25a834751 10266 if (GetObjectId(source, &idx, &oid, oidOcspType, size) < 0)
wolfSSL 11:cee25a834751 10267 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10268 if (oid != OCSP_BASIC_OID)
wolfSSL 11:cee25a834751 10269 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10270 ret = GetOctetString(source, &idx, &length, size);
wolfSSL 11:cee25a834751 10271 if (ret < 0)
wolfSSL 11:cee25a834751 10272 return ret;
wolfSSL 11:cee25a834751 10273
wolfSSL 11:cee25a834751 10274 ret = DecodeBasicOcspResponse(source, &idx, resp, size, cm, heap, noVerify);
wolfSSL 11:cee25a834751 10275 if (ret < 0)
wolfSSL 11:cee25a834751 10276 return ret;
wolfSSL 11:cee25a834751 10277
wolfSSL 11:cee25a834751 10278 return 0;
wolfSSL 11:cee25a834751 10279 }
wolfSSL 11:cee25a834751 10280
wolfSSL 11:cee25a834751 10281
wolfSSL 11:cee25a834751 10282 word32 EncodeOcspRequestExtensions(OcspRequest* req, byte* output, word32 size)
wolfSSL 11:cee25a834751 10283 {
wolfSSL 11:cee25a834751 10284 static const byte NonceObjId[] = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
wolfSSL 11:cee25a834751 10285 0x30, 0x01, 0x02 };
wolfSSL 11:cee25a834751 10286 byte seqArray[5][MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 10287 word32 seqSz[5], totalSz = (word32)sizeof(NonceObjId);
wolfSSL 11:cee25a834751 10288
wolfSSL 11:cee25a834751 10289 WOLFSSL_ENTER("SetOcspReqExtensions");
wolfSSL 11:cee25a834751 10290
wolfSSL 11:cee25a834751 10291 if (!req || !output || !req->nonceSz)
wolfSSL 11:cee25a834751 10292 return 0;
wolfSSL 11:cee25a834751 10293
wolfSSL 11:cee25a834751 10294 totalSz += req->nonceSz;
wolfSSL 11:cee25a834751 10295 totalSz += seqSz[0] = SetOctetString(req->nonceSz, seqArray[0]);
wolfSSL 11:cee25a834751 10296 totalSz += seqSz[1] = SetOctetString(req->nonceSz + seqSz[0], seqArray[1]);
wolfSSL 11:cee25a834751 10297 totalSz += seqSz[2] = SetObjectId(sizeof(NonceObjId), seqArray[2]);
wolfSSL 11:cee25a834751 10298 totalSz += seqSz[3] = SetSequence(totalSz, seqArray[3]);
wolfSSL 11:cee25a834751 10299 totalSz += seqSz[4] = SetSequence(totalSz, seqArray[4]);
wolfSSL 11:cee25a834751 10300
wolfSSL 11:cee25a834751 10301 if (totalSz > size)
wolfSSL 11:cee25a834751 10302 return 0;
wolfSSL 11:cee25a834751 10303
wolfSSL 11:cee25a834751 10304 totalSz = 0;
wolfSSL 11:cee25a834751 10305
wolfSSL 11:cee25a834751 10306 XMEMCPY(output + totalSz, seqArray[4], seqSz[4]);
wolfSSL 11:cee25a834751 10307 totalSz += seqSz[4];
wolfSSL 11:cee25a834751 10308
wolfSSL 11:cee25a834751 10309 XMEMCPY(output + totalSz, seqArray[3], seqSz[3]);
wolfSSL 11:cee25a834751 10310 totalSz += seqSz[3];
wolfSSL 11:cee25a834751 10311
wolfSSL 11:cee25a834751 10312 XMEMCPY(output + totalSz, seqArray[2], seqSz[2]);
wolfSSL 11:cee25a834751 10313 totalSz += seqSz[2];
wolfSSL 11:cee25a834751 10314
wolfSSL 11:cee25a834751 10315 XMEMCPY(output + totalSz, NonceObjId, sizeof(NonceObjId));
wolfSSL 11:cee25a834751 10316 totalSz += (word32)sizeof(NonceObjId);
wolfSSL 11:cee25a834751 10317
wolfSSL 11:cee25a834751 10318 XMEMCPY(output + totalSz, seqArray[1], seqSz[1]);
wolfSSL 11:cee25a834751 10319 totalSz += seqSz[1];
wolfSSL 11:cee25a834751 10320
wolfSSL 11:cee25a834751 10321 XMEMCPY(output + totalSz, seqArray[0], seqSz[0]);
wolfSSL 11:cee25a834751 10322 totalSz += seqSz[0];
wolfSSL 11:cee25a834751 10323
wolfSSL 11:cee25a834751 10324 XMEMCPY(output + totalSz, req->nonce, req->nonceSz);
wolfSSL 11:cee25a834751 10325 totalSz += req->nonceSz;
wolfSSL 11:cee25a834751 10326
wolfSSL 11:cee25a834751 10327 return totalSz;
wolfSSL 11:cee25a834751 10328 }
wolfSSL 11:cee25a834751 10329
wolfSSL 11:cee25a834751 10330
wolfSSL 11:cee25a834751 10331 int EncodeOcspRequest(OcspRequest* req, byte* output, word32 size)
wolfSSL 11:cee25a834751 10332 {
wolfSSL 11:cee25a834751 10333 byte seqArray[5][MAX_SEQ_SZ];
wolfSSL 11:cee25a834751 10334 /* The ASN.1 of the OCSP Request is an onion of sequences */
wolfSSL 11:cee25a834751 10335 byte algoArray[MAX_ALGO_SZ];
wolfSSL 11:cee25a834751 10336 byte issuerArray[MAX_ENCODED_DIG_SZ];
wolfSSL 11:cee25a834751 10337 byte issuerKeyArray[MAX_ENCODED_DIG_SZ];
wolfSSL 11:cee25a834751 10338 byte snArray[MAX_SN_SZ];
wolfSSL 11:cee25a834751 10339 byte extArray[MAX_OCSP_EXT_SZ];
wolfSSL 11:cee25a834751 10340 word32 seqSz[5], algoSz, issuerSz, issuerKeySz, snSz, extSz, totalSz;
wolfSSL 11:cee25a834751 10341 int i;
wolfSSL 11:cee25a834751 10342
wolfSSL 11:cee25a834751 10343 WOLFSSL_ENTER("EncodeOcspRequest");
wolfSSL 11:cee25a834751 10344
wolfSSL 11:cee25a834751 10345 #ifdef NO_SHA
wolfSSL 11:cee25a834751 10346 algoSz = SetAlgoID(SHA256h, algoArray, oidHashType, 0);
wolfSSL 11:cee25a834751 10347 #else
wolfSSL 11:cee25a834751 10348 algoSz = SetAlgoID(SHAh, algoArray, oidHashType, 0);
wolfSSL 11:cee25a834751 10349 #endif
wolfSSL 11:cee25a834751 10350
wolfSSL 11:cee25a834751 10351 issuerSz = SetDigest(req->issuerHash, KEYID_SIZE, issuerArray);
wolfSSL 11:cee25a834751 10352 issuerKeySz = SetDigest(req->issuerKeyHash, KEYID_SIZE, issuerKeyArray);
wolfSSL 11:cee25a834751 10353 snSz = SetSerialNumber(req->serial, req->serialSz, snArray);
wolfSSL 11:cee25a834751 10354 extSz = 0;
wolfSSL 11:cee25a834751 10355
wolfSSL 11:cee25a834751 10356 if (req->nonceSz) {
wolfSSL 11:cee25a834751 10357 /* TLS Extensions use this function too - put extensions after
wolfSSL 11:cee25a834751 10358 * ASN.1: Context Specific [2].
wolfSSL 11:cee25a834751 10359 */
wolfSSL 11:cee25a834751 10360 extSz = EncodeOcspRequestExtensions(req, extArray + 2,
wolfSSL 11:cee25a834751 10361 OCSP_NONCE_EXT_SZ);
wolfSSL 11:cee25a834751 10362 extSz += SetExplicit(2, extSz, extArray);
wolfSSL 11:cee25a834751 10363 }
wolfSSL 11:cee25a834751 10364
wolfSSL 11:cee25a834751 10365 totalSz = algoSz + issuerSz + issuerKeySz + snSz;
wolfSSL 11:cee25a834751 10366 for (i = 4; i >= 0; i--) {
wolfSSL 11:cee25a834751 10367 seqSz[i] = SetSequence(totalSz, seqArray[i]);
wolfSSL 11:cee25a834751 10368 totalSz += seqSz[i];
wolfSSL 11:cee25a834751 10369 if (i == 2) totalSz += extSz;
wolfSSL 11:cee25a834751 10370 }
wolfSSL 11:cee25a834751 10371
wolfSSL 11:cee25a834751 10372 if (output == NULL)
wolfSSL 11:cee25a834751 10373 return totalSz;
wolfSSL 11:cee25a834751 10374 if (totalSz > size)
wolfSSL 11:cee25a834751 10375 return BUFFER_E;
wolfSSL 11:cee25a834751 10376
wolfSSL 11:cee25a834751 10377 totalSz = 0;
wolfSSL 11:cee25a834751 10378 for (i = 0; i < 5; i++) {
wolfSSL 11:cee25a834751 10379 XMEMCPY(output + totalSz, seqArray[i], seqSz[i]);
wolfSSL 11:cee25a834751 10380 totalSz += seqSz[i];
wolfSSL 11:cee25a834751 10381 }
wolfSSL 11:cee25a834751 10382
wolfSSL 11:cee25a834751 10383 XMEMCPY(output + totalSz, algoArray, algoSz);
wolfSSL 11:cee25a834751 10384 totalSz += algoSz;
wolfSSL 11:cee25a834751 10385
wolfSSL 11:cee25a834751 10386 XMEMCPY(output + totalSz, issuerArray, issuerSz);
wolfSSL 11:cee25a834751 10387 totalSz += issuerSz;
wolfSSL 11:cee25a834751 10388
wolfSSL 11:cee25a834751 10389 XMEMCPY(output + totalSz, issuerKeyArray, issuerKeySz);
wolfSSL 11:cee25a834751 10390 totalSz += issuerKeySz;
wolfSSL 11:cee25a834751 10391
wolfSSL 11:cee25a834751 10392 XMEMCPY(output + totalSz, snArray, snSz);
wolfSSL 11:cee25a834751 10393 totalSz += snSz;
wolfSSL 11:cee25a834751 10394
wolfSSL 11:cee25a834751 10395 if (extSz != 0) {
wolfSSL 11:cee25a834751 10396 XMEMCPY(output + totalSz, extArray, extSz);
wolfSSL 11:cee25a834751 10397 totalSz += extSz;
wolfSSL 11:cee25a834751 10398 }
wolfSSL 11:cee25a834751 10399
wolfSSL 11:cee25a834751 10400 return totalSz;
wolfSSL 11:cee25a834751 10401 }
wolfSSL 11:cee25a834751 10402
wolfSSL 11:cee25a834751 10403
wolfSSL 11:cee25a834751 10404 int InitOcspRequest(OcspRequest* req, DecodedCert* cert, byte useNonce,
wolfSSL 11:cee25a834751 10405 void* heap)
wolfSSL 11:cee25a834751 10406 {
wolfSSL 11:cee25a834751 10407 int ret;
wolfSSL 11:cee25a834751 10408
wolfSSL 11:cee25a834751 10409 WOLFSSL_ENTER("InitOcspRequest");
wolfSSL 11:cee25a834751 10410
wolfSSL 11:cee25a834751 10411 if (req == NULL)
wolfSSL 11:cee25a834751 10412 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 10413
wolfSSL 11:cee25a834751 10414 ForceZero(req, sizeof(OcspRequest));
wolfSSL 11:cee25a834751 10415 req->heap = heap;
wolfSSL 11:cee25a834751 10416
wolfSSL 11:cee25a834751 10417 if (cert) {
wolfSSL 11:cee25a834751 10418 XMEMCPY(req->issuerHash, cert->issuerHash, KEYID_SIZE);
wolfSSL 11:cee25a834751 10419 XMEMCPY(req->issuerKeyHash, cert->issuerKeyHash, KEYID_SIZE);
wolfSSL 11:cee25a834751 10420
wolfSSL 11:cee25a834751 10421 req->serial = (byte*)XMALLOC(cert->serialSz, req->heap,
wolfSSL 11:cee25a834751 10422 DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 11:cee25a834751 10423 if (req->serial == NULL)
wolfSSL 11:cee25a834751 10424 return MEMORY_E;
wolfSSL 11:cee25a834751 10425
wolfSSL 11:cee25a834751 10426 XMEMCPY(req->serial, cert->serial, cert->serialSz);
wolfSSL 11:cee25a834751 10427 req->serialSz = cert->serialSz;
wolfSSL 11:cee25a834751 10428
wolfSSL 11:cee25a834751 10429 if (cert->extAuthInfoSz != 0 && cert->extAuthInfo != NULL) {
wolfSSL 11:cee25a834751 10430 req->url = (byte*)XMALLOC(cert->extAuthInfoSz, req->heap,
wolfSSL 11:cee25a834751 10431 DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 11:cee25a834751 10432 if (req->url == NULL) {
wolfSSL 11:cee25a834751 10433 XFREE(req->serial, req->heap, DYNAMIC_TYPE_OCSP);
wolfSSL 11:cee25a834751 10434 return MEMORY_E;
wolfSSL 11:cee25a834751 10435 }
wolfSSL 11:cee25a834751 10436
wolfSSL 11:cee25a834751 10437 XMEMCPY(req->url, cert->extAuthInfo, cert->extAuthInfoSz);
wolfSSL 11:cee25a834751 10438 req->urlSz = cert->extAuthInfoSz;
wolfSSL 11:cee25a834751 10439 }
wolfSSL 11:cee25a834751 10440 }
wolfSSL 11:cee25a834751 10441
wolfSSL 11:cee25a834751 10442 if (useNonce) {
wolfSSL 11:cee25a834751 10443 WC_RNG rng;
wolfSSL 11:cee25a834751 10444
wolfSSL 11:cee25a834751 10445 #ifndef HAVE_FIPS
wolfSSL 11:cee25a834751 10446 ret = wc_InitRng_ex(&rng, req->heap, INVALID_DEVID);
wolfSSL 11:cee25a834751 10447 #else
wolfSSL 11:cee25a834751 10448 ret = wc_InitRng(&rng);
wolfSSL 11:cee25a834751 10449 #endif
wolfSSL 11:cee25a834751 10450 if (ret != 0) {
wolfSSL 11:cee25a834751 10451 WOLFSSL_MSG("\tCannot initialize RNG. Skipping the OSCP Nonce.");
wolfSSL 11:cee25a834751 10452 } else {
wolfSSL 11:cee25a834751 10453 if (wc_RNG_GenerateBlock(&rng, req->nonce, MAX_OCSP_NONCE_SZ) != 0)
wolfSSL 11:cee25a834751 10454 WOLFSSL_MSG("\tCannot run RNG. Skipping the OSCP Nonce.");
wolfSSL 11:cee25a834751 10455 else
wolfSSL 11:cee25a834751 10456 req->nonceSz = MAX_OCSP_NONCE_SZ;
wolfSSL 11:cee25a834751 10457
wolfSSL 11:cee25a834751 10458 wc_FreeRng(&rng);
wolfSSL 11:cee25a834751 10459 }
wolfSSL 11:cee25a834751 10460 }
wolfSSL 11:cee25a834751 10461
wolfSSL 11:cee25a834751 10462 return 0;
wolfSSL 11:cee25a834751 10463 }
wolfSSL 11:cee25a834751 10464
wolfSSL 11:cee25a834751 10465 void FreeOcspRequest(OcspRequest* req)
wolfSSL 11:cee25a834751 10466 {
wolfSSL 11:cee25a834751 10467 WOLFSSL_ENTER("FreeOcspRequest");
wolfSSL 11:cee25a834751 10468
wolfSSL 11:cee25a834751 10469 if (req) {
wolfSSL 11:cee25a834751 10470 if (req->serial)
wolfSSL 11:cee25a834751 10471 XFREE(req->serial, req->heap, DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 11:cee25a834751 10472
wolfSSL 11:cee25a834751 10473 if (req->url)
wolfSSL 11:cee25a834751 10474 XFREE(req->url, req->heap, DYNAMIC_TYPE_OCSP_REQUEST);
wolfSSL 11:cee25a834751 10475 }
wolfSSL 11:cee25a834751 10476 }
wolfSSL 11:cee25a834751 10477
wolfSSL 11:cee25a834751 10478
wolfSSL 11:cee25a834751 10479 int CompareOcspReqResp(OcspRequest* req, OcspResponse* resp)
wolfSSL 11:cee25a834751 10480 {
wolfSSL 11:cee25a834751 10481 int cmp;
wolfSSL 11:cee25a834751 10482
wolfSSL 11:cee25a834751 10483 WOLFSSL_ENTER("CompareOcspReqResp");
wolfSSL 11:cee25a834751 10484
wolfSSL 11:cee25a834751 10485 if (req == NULL)
wolfSSL 11:cee25a834751 10486 {
wolfSSL 11:cee25a834751 10487 WOLFSSL_MSG("\tReq missing");
wolfSSL 11:cee25a834751 10488 return -1;
wolfSSL 11:cee25a834751 10489 }
wolfSSL 11:cee25a834751 10490
wolfSSL 11:cee25a834751 10491 if (resp == NULL)
wolfSSL 11:cee25a834751 10492 {
wolfSSL 11:cee25a834751 10493 WOLFSSL_MSG("\tResp missing");
wolfSSL 11:cee25a834751 10494 return 1;
wolfSSL 11:cee25a834751 10495 }
wolfSSL 11:cee25a834751 10496
wolfSSL 11:cee25a834751 10497 /* Nonces are not critical. The responder may not necessarily add
wolfSSL 11:cee25a834751 10498 * the nonce to the response. */
wolfSSL 11:cee25a834751 10499 if (resp->nonceSz != 0) {
wolfSSL 11:cee25a834751 10500 cmp = req->nonceSz - resp->nonceSz;
wolfSSL 11:cee25a834751 10501 if (cmp != 0)
wolfSSL 11:cee25a834751 10502 {
wolfSSL 11:cee25a834751 10503 WOLFSSL_MSG("\tnonceSz mismatch");
wolfSSL 11:cee25a834751 10504 return cmp;
wolfSSL 11:cee25a834751 10505 }
wolfSSL 11:cee25a834751 10506
wolfSSL 11:cee25a834751 10507 cmp = XMEMCMP(req->nonce, resp->nonce, req->nonceSz);
wolfSSL 11:cee25a834751 10508 if (cmp != 0)
wolfSSL 11:cee25a834751 10509 {
wolfSSL 11:cee25a834751 10510 WOLFSSL_MSG("\tnonce mismatch");
wolfSSL 11:cee25a834751 10511 return cmp;
wolfSSL 11:cee25a834751 10512 }
wolfSSL 11:cee25a834751 10513 }
wolfSSL 11:cee25a834751 10514
wolfSSL 11:cee25a834751 10515 cmp = XMEMCMP(req->issuerHash, resp->issuerHash, KEYID_SIZE);
wolfSSL 11:cee25a834751 10516 if (cmp != 0)
wolfSSL 11:cee25a834751 10517 {
wolfSSL 11:cee25a834751 10518 WOLFSSL_MSG("\tissuerHash mismatch");
wolfSSL 11:cee25a834751 10519 return cmp;
wolfSSL 11:cee25a834751 10520 }
wolfSSL 11:cee25a834751 10521
wolfSSL 11:cee25a834751 10522 cmp = XMEMCMP(req->issuerKeyHash, resp->issuerKeyHash, KEYID_SIZE);
wolfSSL 11:cee25a834751 10523 if (cmp != 0)
wolfSSL 11:cee25a834751 10524 {
wolfSSL 11:cee25a834751 10525 WOLFSSL_MSG("\tissuerKeyHash mismatch");
wolfSSL 11:cee25a834751 10526 return cmp;
wolfSSL 11:cee25a834751 10527 }
wolfSSL 11:cee25a834751 10528
wolfSSL 11:cee25a834751 10529 cmp = req->serialSz - resp->status->serialSz;
wolfSSL 11:cee25a834751 10530 if (cmp != 0)
wolfSSL 11:cee25a834751 10531 {
wolfSSL 11:cee25a834751 10532 WOLFSSL_MSG("\tserialSz mismatch");
wolfSSL 11:cee25a834751 10533 return cmp;
wolfSSL 11:cee25a834751 10534 }
wolfSSL 11:cee25a834751 10535
wolfSSL 11:cee25a834751 10536 cmp = XMEMCMP(req->serial, resp->status->serial, req->serialSz);
wolfSSL 11:cee25a834751 10537 if (cmp != 0)
wolfSSL 11:cee25a834751 10538 {
wolfSSL 11:cee25a834751 10539 WOLFSSL_MSG("\tserial mismatch");
wolfSSL 11:cee25a834751 10540 return cmp;
wolfSSL 11:cee25a834751 10541 }
wolfSSL 11:cee25a834751 10542
wolfSSL 11:cee25a834751 10543 return 0;
wolfSSL 11:cee25a834751 10544 }
wolfSSL 11:cee25a834751 10545
wolfSSL 11:cee25a834751 10546 #endif
wolfSSL 11:cee25a834751 10547
wolfSSL 11:cee25a834751 10548
wolfSSL 11:cee25a834751 10549 /* store SHA hash of NAME */
wolfSSL 11:cee25a834751 10550 WOLFSSL_LOCAL int GetNameHash(const byte* source, word32* idx, byte* hash,
wolfSSL 11:cee25a834751 10551 int maxIdx)
wolfSSL 11:cee25a834751 10552 {
wolfSSL 11:cee25a834751 10553 int length; /* length of all distinguished names */
wolfSSL 11:cee25a834751 10554 int ret;
wolfSSL 11:cee25a834751 10555 word32 dummy;
wolfSSL 11:cee25a834751 10556
wolfSSL 11:cee25a834751 10557 WOLFSSL_ENTER("GetNameHash");
wolfSSL 11:cee25a834751 10558
wolfSSL 11:cee25a834751 10559 if (source[*idx] == ASN_OBJECT_ID) {
wolfSSL 11:cee25a834751 10560 WOLFSSL_MSG("Trying optional prefix...");
wolfSSL 11:cee25a834751 10561
wolfSSL 11:cee25a834751 10562 if (GetLength(source, idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 10563 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10564
wolfSSL 11:cee25a834751 10565 *idx += length;
wolfSSL 11:cee25a834751 10566 WOLFSSL_MSG("Got optional prefix");
wolfSSL 11:cee25a834751 10567 }
wolfSSL 11:cee25a834751 10568
wolfSSL 11:cee25a834751 10569 /* For OCSP, RFC2560 section 4.1.1 states the issuer hash should be
wolfSSL 11:cee25a834751 10570 * calculated over the entire DER encoding of the Name field, including
wolfSSL 11:cee25a834751 10571 * the tag and length. */
wolfSSL 11:cee25a834751 10572 dummy = *idx;
wolfSSL 11:cee25a834751 10573 if (GetSequence(source, idx, &length, maxIdx) < 0)
wolfSSL 11:cee25a834751 10574 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10575
wolfSSL 11:cee25a834751 10576 #ifdef NO_SHA
wolfSSL 11:cee25a834751 10577 ret = wc_Sha256Hash(source + dummy, length + *idx - dummy, hash);
wolfSSL 11:cee25a834751 10578 #else
wolfSSL 11:cee25a834751 10579 ret = wc_ShaHash(source + dummy, length + *idx - dummy, hash);
wolfSSL 11:cee25a834751 10580 #endif
wolfSSL 11:cee25a834751 10581
wolfSSL 11:cee25a834751 10582 *idx += length;
wolfSSL 11:cee25a834751 10583
wolfSSL 11:cee25a834751 10584 return ret;
wolfSSL 11:cee25a834751 10585 }
wolfSSL 11:cee25a834751 10586
wolfSSL 11:cee25a834751 10587
wolfSSL 11:cee25a834751 10588 #ifdef HAVE_CRL
wolfSSL 11:cee25a834751 10589
wolfSSL 11:cee25a834751 10590 /* initialize decoded CRL */
wolfSSL 11:cee25a834751 10591 void InitDecodedCRL(DecodedCRL* dcrl, void* heap)
wolfSSL 11:cee25a834751 10592 {
wolfSSL 11:cee25a834751 10593 WOLFSSL_MSG("InitDecodedCRL");
wolfSSL 11:cee25a834751 10594
wolfSSL 11:cee25a834751 10595 dcrl->certBegin = 0;
wolfSSL 11:cee25a834751 10596 dcrl->sigIndex = 0;
wolfSSL 11:cee25a834751 10597 dcrl->sigLength = 0;
wolfSSL 11:cee25a834751 10598 dcrl->signatureOID = 0;
wolfSSL 11:cee25a834751 10599 dcrl->certs = NULL;
wolfSSL 11:cee25a834751 10600 dcrl->totalCerts = 0;
wolfSSL 11:cee25a834751 10601 dcrl->heap = heap;
wolfSSL 11:cee25a834751 10602 #ifdef WOLFSSL_HEAP_TEST
wolfSSL 11:cee25a834751 10603 dcrl->heap = (void*)WOLFSSL_HEAP_TEST;
wolfSSL 11:cee25a834751 10604 #endif
wolfSSL 11:cee25a834751 10605 }
wolfSSL 11:cee25a834751 10606
wolfSSL 11:cee25a834751 10607
wolfSSL 11:cee25a834751 10608 /* free decoded CRL resources */
wolfSSL 11:cee25a834751 10609 void FreeDecodedCRL(DecodedCRL* dcrl)
wolfSSL 11:cee25a834751 10610 {
wolfSSL 11:cee25a834751 10611 RevokedCert* tmp = dcrl->certs;
wolfSSL 11:cee25a834751 10612
wolfSSL 11:cee25a834751 10613 WOLFSSL_MSG("FreeDecodedCRL");
wolfSSL 11:cee25a834751 10614
wolfSSL 11:cee25a834751 10615 while(tmp) {
wolfSSL 11:cee25a834751 10616 RevokedCert* next = tmp->next;
wolfSSL 11:cee25a834751 10617 XFREE(tmp, dcrl->heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 11:cee25a834751 10618 tmp = next;
wolfSSL 11:cee25a834751 10619 }
wolfSSL 11:cee25a834751 10620 }
wolfSSL 11:cee25a834751 10621
wolfSSL 11:cee25a834751 10622
wolfSSL 11:cee25a834751 10623 /* Get Revoked Cert list, 0 on success */
wolfSSL 11:cee25a834751 10624 static int GetRevoked(const byte* buff, word32* idx, DecodedCRL* dcrl,
wolfSSL 11:cee25a834751 10625 int maxIdx)
wolfSSL 11:cee25a834751 10626 {
wolfSSL 11:cee25a834751 10627 int len;
wolfSSL 11:cee25a834751 10628 word32 end;
wolfSSL 11:cee25a834751 10629 byte b;
wolfSSL 11:cee25a834751 10630 RevokedCert* rc;
wolfSSL 11:cee25a834751 10631
wolfSSL 11:cee25a834751 10632 WOLFSSL_ENTER("GetRevoked");
wolfSSL 11:cee25a834751 10633
wolfSSL 11:cee25a834751 10634 if (GetSequence(buff, idx, &len, maxIdx) < 0)
wolfSSL 11:cee25a834751 10635 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10636
wolfSSL 11:cee25a834751 10637 end = *idx + len;
wolfSSL 11:cee25a834751 10638
wolfSSL 11:cee25a834751 10639 rc = (RevokedCert*)XMALLOC(sizeof(RevokedCert), dcrl->heap,
wolfSSL 11:cee25a834751 10640 DYNAMIC_TYPE_CRL);
wolfSSL 11:cee25a834751 10641 if (rc == NULL) {
wolfSSL 11:cee25a834751 10642 WOLFSSL_MSG("Alloc Revoked Cert failed");
wolfSSL 11:cee25a834751 10643 return MEMORY_E;
wolfSSL 11:cee25a834751 10644 }
wolfSSL 11:cee25a834751 10645
wolfSSL 11:cee25a834751 10646 if (GetSerialNumber(buff, idx, rc->serialNumber, &rc->serialSz,
wolfSSL 11:cee25a834751 10647 maxIdx) < 0) {
wolfSSL 11:cee25a834751 10648 XFREE(rc, dcrl->heap, DYNAMIC_TYPE_CRL);
wolfSSL 11:cee25a834751 10649 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10650 }
wolfSSL 11:cee25a834751 10651
wolfSSL 11:cee25a834751 10652 /* add to list */
wolfSSL 11:cee25a834751 10653 rc->next = dcrl->certs;
wolfSSL 11:cee25a834751 10654 dcrl->certs = rc;
wolfSSL 11:cee25a834751 10655 dcrl->totalCerts++;
wolfSSL 11:cee25a834751 10656
wolfSSL 11:cee25a834751 10657
wolfSSL 11:cee25a834751 10658 /* get date */
wolfSSL 11:cee25a834751 10659 b = buff[*idx];
wolfSSL 11:cee25a834751 10660 *idx += 1;
wolfSSL 11:cee25a834751 10661
wolfSSL 11:cee25a834751 10662 if (b != ASN_UTC_TIME && b != ASN_GENERALIZED_TIME) {
wolfSSL 11:cee25a834751 10663 WOLFSSL_MSG("Expecting Date");
wolfSSL 11:cee25a834751 10664 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10665 }
wolfSSL 11:cee25a834751 10666
wolfSSL 11:cee25a834751 10667 if (GetLength(buff, idx, &len, maxIdx) < 0)
wolfSSL 11:cee25a834751 10668 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10669
wolfSSL 11:cee25a834751 10670 /* skip for now */
wolfSSL 11:cee25a834751 10671 *idx += len;
wolfSSL 11:cee25a834751 10672
wolfSSL 11:cee25a834751 10673 if (*idx != end) /* skip extensions */
wolfSSL 11:cee25a834751 10674 *idx = end;
wolfSSL 11:cee25a834751 10675
wolfSSL 11:cee25a834751 10676 return 0;
wolfSSL 11:cee25a834751 10677 }
wolfSSL 11:cee25a834751 10678
wolfSSL 11:cee25a834751 10679
wolfSSL 11:cee25a834751 10680 /* Get CRL Signature, 0 on success */
wolfSSL 11:cee25a834751 10681 static int GetCRL_Signature(const byte* source, word32* idx, DecodedCRL* dcrl,
wolfSSL 11:cee25a834751 10682 int maxIdx)
wolfSSL 11:cee25a834751 10683 {
wolfSSL 11:cee25a834751 10684 int length;
wolfSSL 11:cee25a834751 10685 int ret;
wolfSSL 11:cee25a834751 10686
wolfSSL 11:cee25a834751 10687 WOLFSSL_ENTER("GetCRL_Signature");
wolfSSL 11:cee25a834751 10688
wolfSSL 11:cee25a834751 10689 ret = CheckBitString(source, idx, &length, maxIdx, 1, NULL);
wolfSSL 11:cee25a834751 10690 if (ret != 0)
wolfSSL 11:cee25a834751 10691 return ret;
wolfSSL 11:cee25a834751 10692 dcrl->sigLength = length;
wolfSSL 11:cee25a834751 10693
wolfSSL 11:cee25a834751 10694 dcrl->signature = (byte*)&source[*idx];
wolfSSL 11:cee25a834751 10695 *idx += dcrl->sigLength;
wolfSSL 11:cee25a834751 10696
wolfSSL 11:cee25a834751 10697 return 0;
wolfSSL 11:cee25a834751 10698 }
wolfSSL 11:cee25a834751 10699
wolfSSL 11:cee25a834751 10700
wolfSSL 11:cee25a834751 10701 /* prase crl buffer into decoded state, 0 on success */
wolfSSL 11:cee25a834751 10702 int ParseCRL(DecodedCRL* dcrl, const byte* buff, word32 sz, void* cm)
wolfSSL 11:cee25a834751 10703 {
wolfSSL 11:cee25a834751 10704 int ret = 0, version, len, doNextDate = 1;
wolfSSL 11:cee25a834751 10705 word32 oid, idx = 0, dateIdx;
wolfSSL 11:cee25a834751 10706 Signer* ca = NULL;
wolfSSL 11:cee25a834751 10707
wolfSSL 11:cee25a834751 10708 WOLFSSL_MSG("ParseCRL");
wolfSSL 11:cee25a834751 10709
wolfSSL 11:cee25a834751 10710 /* raw crl hash */
wolfSSL 11:cee25a834751 10711 /* hash here if needed for optimized comparisons
wolfSSL 11:cee25a834751 10712 * Sha sha;
wolfSSL 11:cee25a834751 10713 * wc_InitSha(&sha);
wolfSSL 11:cee25a834751 10714 * wc_ShaUpdate(&sha, buff, sz);
wolfSSL 11:cee25a834751 10715 * wc_ShaFinal(&sha, dcrl->crlHash); */
wolfSSL 11:cee25a834751 10716
wolfSSL 11:cee25a834751 10717 if (GetSequence(buff, &idx, &len, sz) < 0)
wolfSSL 11:cee25a834751 10718 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10719
wolfSSL 11:cee25a834751 10720 dcrl->certBegin = idx;
wolfSSL 11:cee25a834751 10721
wolfSSL 11:cee25a834751 10722 if (GetSequence(buff, &idx, &len, sz) < 0)
wolfSSL 11:cee25a834751 10723 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10724 dcrl->sigIndex = len + idx;
wolfSSL 11:cee25a834751 10725
wolfSSL 11:cee25a834751 10726 /* may have version */
wolfSSL 11:cee25a834751 10727 if (buff[idx] == ASN_INTEGER) {
wolfSSL 11:cee25a834751 10728 if (GetMyVersion(buff, &idx, &version, sz) < 0)
wolfSSL 11:cee25a834751 10729 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10730 }
wolfSSL 11:cee25a834751 10731
wolfSSL 11:cee25a834751 10732 if (GetAlgoId(buff, &idx, &oid, oidIgnoreType, sz) < 0)
wolfSSL 11:cee25a834751 10733 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10734
wolfSSL 11:cee25a834751 10735 if (GetNameHash(buff, &idx, dcrl->issuerHash, sz) < 0)
wolfSSL 11:cee25a834751 10736 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10737
wolfSSL 11:cee25a834751 10738 if (GetBasicDate(buff, &idx, dcrl->lastDate, &dcrl->lastDateFormat, sz) < 0)
wolfSSL 11:cee25a834751 10739 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10740
wolfSSL 11:cee25a834751 10741 dateIdx = idx;
wolfSSL 11:cee25a834751 10742
wolfSSL 11:cee25a834751 10743 if (GetBasicDate(buff, &idx, dcrl->nextDate, &dcrl->nextDateFormat, sz) < 0)
wolfSSL 11:cee25a834751 10744 {
wolfSSL 11:cee25a834751 10745 #ifndef WOLFSSL_NO_CRL_NEXT_DATE
wolfSSL 11:cee25a834751 10746 (void)dateIdx;
wolfSSL 11:cee25a834751 10747 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10748 #else
wolfSSL 11:cee25a834751 10749 dcrl->nextDateFormat = ASN_OTHER_TYPE; /* skip flag */
wolfSSL 11:cee25a834751 10750 doNextDate = 0;
wolfSSL 11:cee25a834751 10751 idx = dateIdx;
wolfSSL 11:cee25a834751 10752 #endif
wolfSSL 11:cee25a834751 10753 }
wolfSSL 11:cee25a834751 10754
wolfSSL 11:cee25a834751 10755 if (doNextDate) {
wolfSSL 11:cee25a834751 10756 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 10757 if (!XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, AFTER)) {
wolfSSL 11:cee25a834751 10758 WOLFSSL_MSG("CRL after date is no longer valid");
wolfSSL 11:cee25a834751 10759 return ASN_AFTER_DATE_E;
wolfSSL 11:cee25a834751 10760 }
wolfSSL 11:cee25a834751 10761 #endif
wolfSSL 11:cee25a834751 10762 }
wolfSSL 11:cee25a834751 10763
wolfSSL 11:cee25a834751 10764 if (idx != dcrl->sigIndex && buff[idx] != CRL_EXTENSIONS) {
wolfSSL 11:cee25a834751 10765 if (GetSequence(buff, &idx, &len, sz) < 0)
wolfSSL 11:cee25a834751 10766 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10767
wolfSSL 11:cee25a834751 10768 len += idx;
wolfSSL 11:cee25a834751 10769
wolfSSL 11:cee25a834751 10770 while (idx < (word32)len) {
wolfSSL 11:cee25a834751 10771 if (GetRevoked(buff, &idx, dcrl, sz) < 0)
wolfSSL 11:cee25a834751 10772 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10773 }
wolfSSL 11:cee25a834751 10774 }
wolfSSL 11:cee25a834751 10775
wolfSSL 11:cee25a834751 10776 if (idx != dcrl->sigIndex)
wolfSSL 11:cee25a834751 10777 idx = dcrl->sigIndex; /* skip extensions */
wolfSSL 11:cee25a834751 10778
wolfSSL 11:cee25a834751 10779 if (GetAlgoId(buff, &idx, &dcrl->signatureOID, oidSigType, sz) < 0)
wolfSSL 11:cee25a834751 10780 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10781
wolfSSL 11:cee25a834751 10782 if (GetCRL_Signature(buff, &idx, dcrl, sz) < 0)
wolfSSL 11:cee25a834751 10783 return ASN_PARSE_E;
wolfSSL 11:cee25a834751 10784
wolfSSL 11:cee25a834751 10785 /* openssl doesn't add skid by default for CRLs cause firefox chokes
wolfSSL 11:cee25a834751 10786 we're not assuming it's available yet */
wolfSSL 11:cee25a834751 10787 #if !defined(NO_SKID) && defined(CRL_SKID_READY)
wolfSSL 11:cee25a834751 10788 if (dcrl->extAuthKeyIdSet)
wolfSSL 11:cee25a834751 10789 ca = GetCA(cm, dcrl->extAuthKeyId);
wolfSSL 11:cee25a834751 10790 if (ca == NULL)
wolfSSL 11:cee25a834751 10791 ca = GetCAByName(cm, dcrl->issuerHash);
wolfSSL 11:cee25a834751 10792 #else
wolfSSL 11:cee25a834751 10793 ca = GetCA(cm, dcrl->issuerHash);
wolfSSL 11:cee25a834751 10794 #endif /* !NO_SKID && CRL_SKID_READY */
wolfSSL 11:cee25a834751 10795 WOLFSSL_MSG("About to verify CRL signature");
wolfSSL 11:cee25a834751 10796
wolfSSL 11:cee25a834751 10797 if (ca) {
wolfSSL 11:cee25a834751 10798 SignatureCtx sigCtx;
wolfSSL 11:cee25a834751 10799
wolfSSL 11:cee25a834751 10800 WOLFSSL_MSG("Found CRL issuer CA");
wolfSSL 11:cee25a834751 10801 /* try to confirm/verify signature */
wolfSSL 11:cee25a834751 10802 #ifndef IGNORE_KEY_EXTENSIONS
wolfSSL 11:cee25a834751 10803 if ((ca->keyUsage & KEYUSE_CRL_SIGN) == 0) {
wolfSSL 11:cee25a834751 10804 WOLFSSL_MSG("CA cannot sign CRLs");
wolfSSL 11:cee25a834751 10805 return ASN_CRL_NO_SIGNER_E;
wolfSSL 11:cee25a834751 10806 }
wolfSSL 11:cee25a834751 10807 #endif /* IGNORE_KEY_EXTENSIONS */
wolfSSL 11:cee25a834751 10808
wolfSSL 11:cee25a834751 10809 InitSignatureCtx(&sigCtx, dcrl->heap, INVALID_DEVID);
wolfSSL 11:cee25a834751 10810 if (ConfirmSignature(&sigCtx, buff + dcrl->certBegin,
wolfSSL 11:cee25a834751 10811 dcrl->sigIndex - dcrl->certBegin,
wolfSSL 11:cee25a834751 10812 ca->publicKey, ca->pubKeySize, ca->keyOID,
wolfSSL 11:cee25a834751 10813 dcrl->signature, dcrl->sigLength, dcrl->signatureOID) != 0) {
wolfSSL 11:cee25a834751 10814 WOLFSSL_MSG("CRL Confirm signature failed");
wolfSSL 11:cee25a834751 10815 return ASN_CRL_CONFIRM_E;
wolfSSL 11:cee25a834751 10816 }
wolfSSL 11:cee25a834751 10817 }
wolfSSL 11:cee25a834751 10818 else {
wolfSSL 11:cee25a834751 10819 WOLFSSL_MSG("Did NOT find CRL issuer CA");
wolfSSL 11:cee25a834751 10820 return ASN_CRL_NO_SIGNER_E;
wolfSSL 11:cee25a834751 10821 }
wolfSSL 11:cee25a834751 10822
wolfSSL 11:cee25a834751 10823 return ret;
wolfSSL 11:cee25a834751 10824 }
wolfSSL 11:cee25a834751 10825
wolfSSL 11:cee25a834751 10826 #endif /* HAVE_CRL */
wolfSSL 11:cee25a834751 10827
wolfSSL 11:cee25a834751 10828 #undef ERROR_OUT
wolfSSL 11:cee25a834751 10829
wolfSSL 11:cee25a834751 10830 #endif /* !NO_ASN */
wolfSSL 11:cee25a834751 10831
wolfSSL 11:cee25a834751 10832 #ifdef WOLFSSL_SEP
wolfSSL 11:cee25a834751 10833
wolfSSL 11:cee25a834751 10834
wolfSSL 11:cee25a834751 10835 #endif /* WOLFSSL_SEP */
wolfSSL 11:cee25a834751 10836