1 /*
2 * X.509 base functions for creating certificates / CSRs
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
12 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
24 *
25 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 */
46
47 #if !defined(MBEDTLS_CONFIG_FILE)
48 #include "mbedtls/config.h"
49 #else
50 #include MBEDTLS_CONFIG_FILE
51 #endif
52
53 #if defined(MBEDTLS_X509_CREATE_C)
54
55 #include "mbedtls/x509.h"
56 #include "mbedtls/asn1write.h"
57 #include "mbedtls/oid.h"
58
59 #include <string.h>
60
61 /* Structure linking OIDs for X.509 DN AttributeTypes to their
62 * string representations and default string encodings used by Mbed TLS. */
63 typedef struct {
64 const char *name; /* String representation of AttributeType, e.g.
65 * "CN" or "emailAddress". */
66 size_t name_len; /* Length of 'name', without trailing 0 byte. */
67 const char *oid; /* String representation of OID of AttributeType,
68 * as per RFC 5280, Appendix A.1. */
69 int default_tag; /* The default character encoding used for the
70 * given attribute type, e.g.
71 * MBEDTLS_ASN1_UTF8_STRING for UTF-8. */
72 } x509_attr_descriptor_t;
73
74 #define ADD_STRLEN( s ) s, sizeof( s ) - 1
75
76 /* X.509 DN attributes from RFC 5280, Appendix A.1. */
77 static const x509_attr_descriptor_t x509_attrs[] =
78 {
79 { ADD_STRLEN( "CN" ),
80 MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
81 { ADD_STRLEN( "commonName" ),
82 MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
83 { ADD_STRLEN( "C" ),
84 MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
85 { ADD_STRLEN( "countryName" ),
86 MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
87 { ADD_STRLEN( "O" ),
88 MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
89 { ADD_STRLEN( "organizationName" ),
90 MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
91 { ADD_STRLEN( "L" ),
92 MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
93 { ADD_STRLEN( "locality" ),
94 MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
95 { ADD_STRLEN( "R" ),
96 MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
97 { ADD_STRLEN( "OU" ),
98 MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
99 { ADD_STRLEN( "organizationalUnitName" ),
100 MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
101 { ADD_STRLEN( "ST" ),
102 MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
103 { ADD_STRLEN( "stateOrProvinceName" ),
104 MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
105 { ADD_STRLEN( "emailAddress" ),
106 MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
107 { ADD_STRLEN( "serialNumber" ),
108 MBEDTLS_OID_AT_SERIAL_NUMBER, MBEDTLS_ASN1_PRINTABLE_STRING },
109 { ADD_STRLEN( "postalAddress" ),
110 MBEDTLS_OID_AT_POSTAL_ADDRESS, MBEDTLS_ASN1_PRINTABLE_STRING },
111 { ADD_STRLEN( "postalCode" ),
112 MBEDTLS_OID_AT_POSTAL_CODE, MBEDTLS_ASN1_PRINTABLE_STRING },
113 { ADD_STRLEN( "dnQualifier" ),
114 MBEDTLS_OID_AT_DN_QUALIFIER, MBEDTLS_ASN1_PRINTABLE_STRING },
115 { ADD_STRLEN( "title" ),
116 MBEDTLS_OID_AT_TITLE, MBEDTLS_ASN1_UTF8_STRING },
117 { ADD_STRLEN( "surName" ),
118 MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
119 { ADD_STRLEN( "SN" ),
120 MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
121 { ADD_STRLEN( "givenName" ),
122 MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
123 { ADD_STRLEN( "GN" ),
124 MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
125 { ADD_STRLEN( "initials" ),
126 MBEDTLS_OID_AT_INITIALS, MBEDTLS_ASN1_UTF8_STRING },
127 { ADD_STRLEN( "pseudonym" ),
128 MBEDTLS_OID_AT_PSEUDONYM, MBEDTLS_ASN1_UTF8_STRING },
129 { ADD_STRLEN( "generationQualifier" ),
130 MBEDTLS_OID_AT_GENERATION_QUALIFIER, MBEDTLS_ASN1_UTF8_STRING },
131 { ADD_STRLEN( "domainComponent" ),
132 MBEDTLS_OID_DOMAIN_COMPONENT, MBEDTLS_ASN1_IA5_STRING },
133 { ADD_STRLEN( "DC" ),
134 MBEDTLS_OID_DOMAIN_COMPONENT, MBEDTLS_ASN1_IA5_STRING },
135 { NULL, 0, NULL, MBEDTLS_ASN1_NULL }
136 };
137
x509_attr_descr_from_name(const char * name,size_t name_len)138 static const x509_attr_descriptor_t *x509_attr_descr_from_name( const char *name, size_t name_len )
139 {
140 const x509_attr_descriptor_t *cur;
141
142 for( cur = x509_attrs; cur->name != NULL; cur++ )
143 if( cur->name_len == name_len &&
144 strncmp( cur->name, name, name_len ) == 0 )
145 break;
146
147 if ( cur->name == NULL )
148 return( NULL );
149
150 return( cur );
151 }
152
mbedtls_x509_string_to_names(mbedtls_asn1_named_data ** head,const char * name)153 int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name )
154 {
155 int ret = 0;
156 const char *s = name, *c = s;
157 const char *end = s + strlen( s );
158 const char *oid = NULL;
159 const x509_attr_descriptor_t* attr_descr = NULL;
160 int in_tag = 1;
161 char data[MBEDTLS_X509_MAX_DN_NAME_SIZE];
162 char *d = data;
163
164 /* Clear existing chain if present */
165 mbedtls_asn1_free_named_data_list( head );
166
167 while( c <= end )
168 {
169 if( in_tag && *c == '=' )
170 {
171 if( ( attr_descr = x509_attr_descr_from_name( s, c - s ) ) == NULL )
172 {
173 ret = MBEDTLS_ERR_X509_UNKNOWN_OID;
174 goto exit;
175 }
176
177 oid = attr_descr->oid;
178 s = c + 1;
179 in_tag = 0;
180 d = data;
181 }
182
183 if( !in_tag && *c == '\\' && c != end )
184 {
185 c++;
186
187 /* Check for valid escaped characters */
188 if( c == end || *c != ',' )
189 {
190 ret = MBEDTLS_ERR_X509_INVALID_NAME;
191 goto exit;
192 }
193 }
194 else if( !in_tag && ( *c == ',' || c == end ) )
195 {
196 mbedtls_asn1_named_data* cur =
197 mbedtls_asn1_store_named_data( head, oid, strlen( oid ),
198 (unsigned char *) data,
199 d - data );
200
201 if(cur == NULL )
202 {
203 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
204 }
205
206 // set tagType
207 cur->val.tag = attr_descr->default_tag;
208
209 while( c < end && *(c + 1) == ' ' )
210 c++;
211
212 s = c + 1;
213 in_tag = 1;
214 }
215
216 if( !in_tag && s != c + 1 )
217 {
218 *(d++) = *c;
219
220 if( d - data == MBEDTLS_X509_MAX_DN_NAME_SIZE )
221 {
222 ret = MBEDTLS_ERR_X509_INVALID_NAME;
223 goto exit;
224 }
225 }
226
227 c++;
228 }
229
230 exit:
231
232 return( ret );
233 }
234
235 /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved
236 * to store the critical boolean for us
237 */
mbedtls_x509_set_extension(mbedtls_asn1_named_data ** head,const char * oid,size_t oid_len,int critical,const unsigned char * val,size_t val_len)238 int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len,
239 int critical, const unsigned char *val, size_t val_len )
240 {
241 mbedtls_asn1_named_data *cur;
242
243 if( ( cur = mbedtls_asn1_store_named_data( head, oid, oid_len,
244 NULL, val_len + 1 ) ) == NULL )
245 {
246 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
247 }
248
249 cur->val.p[0] = critical;
250 memcpy( cur->val.p + 1, val, val_len );
251
252 return( 0 );
253 }
254
255 /*
256 * RelativeDistinguishedName ::=
257 * SET OF AttributeTypeAndValue
258 *
259 * AttributeTypeAndValue ::= SEQUENCE {
260 * type AttributeType,
261 * value AttributeValue }
262 *
263 * AttributeType ::= OBJECT IDENTIFIER
264 *
265 * AttributeValue ::= ANY DEFINED BY AttributeType
266 */
x509_write_name(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * cur_name)267 static int x509_write_name( unsigned char **p, unsigned char *start, mbedtls_asn1_named_data* cur_name)
268 {
269 int ret;
270 size_t len = 0;
271 const char *oid = (const char*)cur_name->oid.p;
272 size_t oid_len = cur_name->oid.len;
273 const unsigned char *name = cur_name->val.p;
274 size_t name_len = cur_name->val.len;
275
276 // Write correct string tag and value
277 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tagged_string( p, start,
278 cur_name->val.tag,
279 (const char *) name,
280 name_len ) );
281 // Write OID
282 //
283 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( p, start, oid,
284 oid_len ) );
285
286 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
287 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
288 MBEDTLS_ASN1_CONSTRUCTED |
289 MBEDTLS_ASN1_SEQUENCE ) );
290
291 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
292 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
293 MBEDTLS_ASN1_CONSTRUCTED |
294 MBEDTLS_ASN1_SET ) );
295
296 return( (int) len );
297 }
298
mbedtls_x509_write_names(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * first)299 int mbedtls_x509_write_names( unsigned char **p, unsigned char *start,
300 mbedtls_asn1_named_data *first )
301 {
302 int ret;
303 size_t len = 0;
304 mbedtls_asn1_named_data *cur = first;
305
306 while( cur != NULL )
307 {
308 MBEDTLS_ASN1_CHK_ADD( len, x509_write_name( p, start, cur ) );
309 cur = cur->next;
310 }
311
312 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
313 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
314 MBEDTLS_ASN1_SEQUENCE ) );
315
316 return( (int) len );
317 }
318
mbedtls_x509_write_sig(unsigned char ** p,unsigned char * start,const char * oid,size_t oid_len,unsigned char * sig,size_t size)319 int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start,
320 const char *oid, size_t oid_len,
321 unsigned char *sig, size_t size )
322 {
323 int ret;
324 size_t len = 0;
325
326 if( *p < start || (size_t)( *p - start ) < size )
327 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
328
329 len = size;
330 (*p) -= len;
331 memcpy( *p, sig, len );
332
333 if( *p - start < 1 )
334 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
335
336 *--(*p) = 0;
337 len += 1;
338
339 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
340 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_BIT_STRING ) );
341
342 // Write OID
343 //
344 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_algorithm_identifier( p, start, oid,
345 oid_len, 0 ) );
346
347 return( (int) len );
348 }
349
x509_write_extension(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * ext)350 static int x509_write_extension( unsigned char **p, unsigned char *start,
351 mbedtls_asn1_named_data *ext )
352 {
353 int ret;
354 size_t len = 0;
355
356 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_raw_buffer( p, start, ext->val.p + 1,
357 ext->val.len - 1 ) );
358 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, ext->val.len - 1 ) );
359 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OCTET_STRING ) );
360
361 if( ext->val.p[0] != 0 )
362 {
363 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_bool( p, start, 1 ) );
364 }
365
366 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_raw_buffer( p, start, ext->oid.p,
367 ext->oid.len ) );
368 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, ext->oid.len ) );
369 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OID ) );
370
371 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
372 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
373 MBEDTLS_ASN1_SEQUENCE ) );
374
375 return( (int) len );
376 }
377
378 /*
379 * Extension ::= SEQUENCE {
380 * extnID OBJECT IDENTIFIER,
381 * critical BOOLEAN DEFAULT FALSE,
382 * extnValue OCTET STRING
383 * -- contains the DER encoding of an ASN.1 value
384 * -- corresponding to the extension type identified
385 * -- by extnID
386 * }
387 */
mbedtls_x509_write_extensions(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * first)388 int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start,
389 mbedtls_asn1_named_data *first )
390 {
391 int ret;
392 size_t len = 0;
393 mbedtls_asn1_named_data *cur_ext = first;
394
395 while( cur_ext != NULL )
396 {
397 MBEDTLS_ASN1_CHK_ADD( len, x509_write_extension( p, start, cur_ext ) );
398 cur_ext = cur_ext->next;
399 }
400
401 return( (int) len );
402 }
403
404 #endif /* MBEDTLS_X509_CREATE_C */
405