1 /*
2 * X.509 base functions for creating certificates / CSRs
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_X509_CREATE_C)
11
12 #include "mbedtls/x509.h"
13 #include "mbedtls/asn1write.h"
14 #include "mbedtls/error.h"
15 #include "mbedtls/oid.h"
16
17 #include <string.h>
18
19 /* Structure linking OIDs for X.509 DN AttributeTypes to their
20 * string representations and default string encodings used by Mbed TLS. */
21 typedef struct {
22 const char *name; /* String representation of AttributeType, e.g.
23 * "CN" or "emailAddress". */
24 size_t name_len; /* Length of 'name', without trailing 0 byte. */
25 const char *oid; /* String representation of OID of AttributeType,
26 * as per RFC 5280, Appendix A.1. */
27 int default_tag; /* The default character encoding used for the
28 * given attribute type, e.g.
29 * MBEDTLS_ASN1_UTF8_STRING for UTF-8. */
30 } x509_attr_descriptor_t;
31
32 #define ADD_STRLEN(s) s, sizeof(s) - 1
33
34 /* X.509 DN attributes from RFC 5280, Appendix A.1. */
35 static const x509_attr_descriptor_t x509_attrs[] =
36 {
37 { ADD_STRLEN("CN"),
38 MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
39 { ADD_STRLEN("commonName"),
40 MBEDTLS_OID_AT_CN, MBEDTLS_ASN1_UTF8_STRING },
41 { ADD_STRLEN("C"),
42 MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
43 { ADD_STRLEN("countryName"),
44 MBEDTLS_OID_AT_COUNTRY, MBEDTLS_ASN1_PRINTABLE_STRING },
45 { ADD_STRLEN("O"),
46 MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
47 { ADD_STRLEN("organizationName"),
48 MBEDTLS_OID_AT_ORGANIZATION, MBEDTLS_ASN1_UTF8_STRING },
49 { ADD_STRLEN("L"),
50 MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
51 { ADD_STRLEN("locality"),
52 MBEDTLS_OID_AT_LOCALITY, MBEDTLS_ASN1_UTF8_STRING },
53 { ADD_STRLEN("R"),
54 MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
55 { ADD_STRLEN("OU"),
56 MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
57 { ADD_STRLEN("organizationalUnitName"),
58 MBEDTLS_OID_AT_ORG_UNIT, MBEDTLS_ASN1_UTF8_STRING },
59 { ADD_STRLEN("ST"),
60 MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
61 { ADD_STRLEN("stateOrProvinceName"),
62 MBEDTLS_OID_AT_STATE, MBEDTLS_ASN1_UTF8_STRING },
63 { ADD_STRLEN("emailAddress"),
64 MBEDTLS_OID_PKCS9_EMAIL, MBEDTLS_ASN1_IA5_STRING },
65 { ADD_STRLEN("serialNumber"),
66 MBEDTLS_OID_AT_SERIAL_NUMBER, MBEDTLS_ASN1_PRINTABLE_STRING },
67 { ADD_STRLEN("postalAddress"),
68 MBEDTLS_OID_AT_POSTAL_ADDRESS, MBEDTLS_ASN1_PRINTABLE_STRING },
69 { ADD_STRLEN("postalCode"),
70 MBEDTLS_OID_AT_POSTAL_CODE, MBEDTLS_ASN1_PRINTABLE_STRING },
71 { ADD_STRLEN("dnQualifier"),
72 MBEDTLS_OID_AT_DN_QUALIFIER, MBEDTLS_ASN1_PRINTABLE_STRING },
73 { ADD_STRLEN("title"),
74 MBEDTLS_OID_AT_TITLE, MBEDTLS_ASN1_UTF8_STRING },
75 { ADD_STRLEN("surName"),
76 MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
77 { ADD_STRLEN("SN"),
78 MBEDTLS_OID_AT_SUR_NAME, MBEDTLS_ASN1_UTF8_STRING },
79 { ADD_STRLEN("givenName"),
80 MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
81 { ADD_STRLEN("GN"),
82 MBEDTLS_OID_AT_GIVEN_NAME, MBEDTLS_ASN1_UTF8_STRING },
83 { ADD_STRLEN("initials"),
84 MBEDTLS_OID_AT_INITIALS, MBEDTLS_ASN1_UTF8_STRING },
85 { ADD_STRLEN("pseudonym"),
86 MBEDTLS_OID_AT_PSEUDONYM, MBEDTLS_ASN1_UTF8_STRING },
87 { ADD_STRLEN("generationQualifier"),
88 MBEDTLS_OID_AT_GENERATION_QUALIFIER, MBEDTLS_ASN1_UTF8_STRING },
89 { ADD_STRLEN("domainComponent"),
90 MBEDTLS_OID_DOMAIN_COMPONENT, MBEDTLS_ASN1_IA5_STRING },
91 { ADD_STRLEN("DC"),
92 MBEDTLS_OID_DOMAIN_COMPONENT, MBEDTLS_ASN1_IA5_STRING },
93 { NULL, 0, NULL, MBEDTLS_ASN1_NULL }
94 };
95
x509_attr_descr_from_name(const char * name,size_t name_len)96 static const x509_attr_descriptor_t *x509_attr_descr_from_name(const char *name, size_t name_len)
97 {
98 const x509_attr_descriptor_t *cur;
99
100 for (cur = x509_attrs; cur->name != NULL; cur++) {
101 if (cur->name_len == name_len &&
102 strncmp(cur->name, name, name_len) == 0) {
103 break;
104 }
105 }
106
107 if (cur->name == NULL) {
108 return NULL;
109 }
110
111 return cur;
112 }
113
mbedtls_x509_string_to_names(mbedtls_asn1_named_data ** head,const char * name)114 int mbedtls_x509_string_to_names(mbedtls_asn1_named_data **head, const char *name)
115 {
116 int ret = MBEDTLS_ERR_X509_INVALID_NAME;
117 const char *s = name, *c = s;
118 const char *end = s + strlen(s);
119 const char *oid = NULL;
120 const x509_attr_descriptor_t *attr_descr = NULL;
121 int in_tag = 1;
122 char data[MBEDTLS_X509_MAX_DN_NAME_SIZE];
123 char *d = data;
124
125 /* Clear existing chain if present */
126 mbedtls_asn1_free_named_data_list(head);
127
128 while (c <= end) {
129 if (in_tag && *c == '=') {
130 if ((attr_descr = x509_attr_descr_from_name(s, c - s)) == NULL) {
131 ret = MBEDTLS_ERR_X509_UNKNOWN_OID;
132 goto exit;
133 }
134
135 oid = attr_descr->oid;
136 s = c + 1;
137 in_tag = 0;
138 d = data;
139 }
140
141 if (!in_tag && *c == '\\' && c != end) {
142 c++;
143
144 /* Check for valid escaped characters */
145 if (c == end || *c != ',') {
146 ret = MBEDTLS_ERR_X509_INVALID_NAME;
147 goto exit;
148 }
149 } else if (!in_tag && (*c == ',' || c == end)) {
150 mbedtls_asn1_named_data *cur =
151 mbedtls_asn1_store_named_data(head, oid, strlen(oid),
152 (unsigned char *) data,
153 d - data);
154
155 if (cur == NULL) {
156 return MBEDTLS_ERR_X509_ALLOC_FAILED;
157 }
158
159 // set tagType
160 cur->val.tag = attr_descr->default_tag;
161
162 while (c < end && *(c + 1) == ' ') {
163 c++;
164 }
165
166 s = c + 1;
167 in_tag = 1;
168
169 /* Successfully parsed one name, update ret to success */
170 ret = 0;
171 }
172
173 if (!in_tag && s != c + 1) {
174 *(d++) = *c;
175
176 if (d - data == MBEDTLS_X509_MAX_DN_NAME_SIZE) {
177 ret = MBEDTLS_ERR_X509_INVALID_NAME;
178 goto exit;
179 }
180 }
181
182 c++;
183 }
184
185 exit:
186
187 return ret;
188 }
189
190 /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved
191 * to store the critical boolean for us
192 */
mbedtls_x509_set_extension(mbedtls_asn1_named_data ** head,const char * oid,size_t oid_len,int critical,const unsigned char * val,size_t val_len)193 int mbedtls_x509_set_extension(mbedtls_asn1_named_data **head, const char *oid, size_t oid_len,
194 int critical, const unsigned char *val, size_t val_len)
195 {
196 mbedtls_asn1_named_data *cur;
197
198 if (val_len > (SIZE_MAX - 1)) {
199 return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
200 }
201
202 if ((cur = mbedtls_asn1_store_named_data(head, oid, oid_len,
203 NULL, val_len + 1)) == NULL) {
204 return MBEDTLS_ERR_X509_ALLOC_FAILED;
205 }
206
207 cur->val.p[0] = critical;
208 memcpy(cur->val.p + 1, val, val_len);
209
210 return 0;
211 }
212
213 /*
214 * RelativeDistinguishedName ::=
215 * SET OF AttributeTypeAndValue
216 *
217 * AttributeTypeAndValue ::= SEQUENCE {
218 * type AttributeType,
219 * value AttributeValue }
220 *
221 * AttributeType ::= OBJECT IDENTIFIER
222 *
223 * AttributeValue ::= ANY DEFINED BY AttributeType
224 */
x509_write_name(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * cur_name)225 static int x509_write_name(unsigned char **p,
226 unsigned char *start,
227 mbedtls_asn1_named_data *cur_name)
228 {
229 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
230 size_t len = 0;
231 const char *oid = (const char *) cur_name->oid.p;
232 size_t oid_len = cur_name->oid.len;
233 const unsigned char *name = cur_name->val.p;
234 size_t name_len = cur_name->val.len;
235
236 // Write correct string tag and value
237 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tagged_string(p, start,
238 cur_name->val.tag,
239 (const char *) name,
240 name_len));
241 // Write OID
242 //
243 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_oid(p, start, oid,
244 oid_len));
245
246 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
247 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start,
248 MBEDTLS_ASN1_CONSTRUCTED |
249 MBEDTLS_ASN1_SEQUENCE));
250
251 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
252 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start,
253 MBEDTLS_ASN1_CONSTRUCTED |
254 MBEDTLS_ASN1_SET));
255
256 return (int) len;
257 }
258
mbedtls_x509_write_names(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * first)259 int mbedtls_x509_write_names(unsigned char **p, unsigned char *start,
260 mbedtls_asn1_named_data *first)
261 {
262 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
263 size_t len = 0;
264 mbedtls_asn1_named_data *cur = first;
265
266 while (cur != NULL) {
267 MBEDTLS_ASN1_CHK_ADD(len, x509_write_name(p, start, cur));
268 cur = cur->next;
269 }
270
271 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
272 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, MBEDTLS_ASN1_CONSTRUCTED |
273 MBEDTLS_ASN1_SEQUENCE));
274
275 return (int) len;
276 }
277
mbedtls_x509_write_sig(unsigned char ** p,unsigned char * start,const char * oid,size_t oid_len,unsigned char * sig,size_t size,mbedtls_pk_type_t pk_alg)278 int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
279 const char *oid, size_t oid_len,
280 unsigned char *sig, size_t size,
281 mbedtls_pk_type_t pk_alg)
282 {
283 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
284 int write_null_par;
285 size_t len = 0;
286
287 if (*p < start || (size_t) (*p - start) < size) {
288 return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
289 }
290
291 len = size;
292 (*p) -= len;
293 memcpy(*p, sig, len);
294
295 if (*p - start < 1) {
296 return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
297 }
298
299 *--(*p) = 0;
300 len += 1;
301
302 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
303 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, MBEDTLS_ASN1_BIT_STRING));
304
305 // Write OID
306 //
307 if (pk_alg == MBEDTLS_PK_ECDSA) {
308 /*
309 * The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature
310 * algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and
311 * https://www.rfc-editor.org/rfc/rfc5758#section-3.
312 */
313 write_null_par = 0;
314 } else {
315 write_null_par = 1;
316 }
317 MBEDTLS_ASN1_CHK_ADD(len,
318 mbedtls_asn1_write_algorithm_identifier_ext(p, start, oid, oid_len,
319 0, write_null_par));
320
321 return (int) len;
322 }
323
x509_write_extension(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * ext)324 static int x509_write_extension(unsigned char **p, unsigned char *start,
325 mbedtls_asn1_named_data *ext)
326 {
327 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
328 size_t len = 0;
329
330 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_raw_buffer(p, start, ext->val.p + 1,
331 ext->val.len - 1));
332 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, ext->val.len - 1));
333 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, MBEDTLS_ASN1_OCTET_STRING));
334
335 if (ext->val.p[0] != 0) {
336 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_bool(p, start, 1));
337 }
338
339 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_raw_buffer(p, start, ext->oid.p,
340 ext->oid.len));
341 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, ext->oid.len));
342 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, MBEDTLS_ASN1_OID));
343
344 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
345 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, MBEDTLS_ASN1_CONSTRUCTED |
346 MBEDTLS_ASN1_SEQUENCE));
347
348 return (int) len;
349 }
350
351 /*
352 * Extension ::= SEQUENCE {
353 * extnID OBJECT IDENTIFIER,
354 * critical BOOLEAN DEFAULT FALSE,
355 * extnValue OCTET STRING
356 * -- contains the DER encoding of an ASN.1 value
357 * -- corresponding to the extension type identified
358 * -- by extnID
359 * }
360 */
mbedtls_x509_write_extensions(unsigned char ** p,unsigned char * start,mbedtls_asn1_named_data * first)361 int mbedtls_x509_write_extensions(unsigned char **p, unsigned char *start,
362 mbedtls_asn1_named_data *first)
363 {
364 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
365 size_t len = 0;
366 mbedtls_asn1_named_data *cur_ext = first;
367
368 while (cur_ext != NULL) {
369 MBEDTLS_ASN1_CHK_ADD(len, x509_write_extension(p, start, cur_ext));
370 cur_ext = cur_ext->next;
371 }
372
373 return (int) len;
374 }
375
376 #endif /* MBEDTLS_X509_CREATE_C */
377