blob: 760ff5fe0303b98856bc31126c47f4bd0e0e4c41 [file] [log] [blame]
Paul Bakker33b43f12013-08-20 11:48:36 +02001/* BEGIN_HEADER */
Anton Matkinbc487252025-06-16 13:37:03 +02002#include "mbedtls/private/bignum.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00003#include "mbedtls/x509_crt.h"
4#include "mbedtls/x509_csr.h"
Valerio Setti25b282e2024-01-17 10:55:32 +01005#include "x509_internal.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00006#include "mbedtls/pem.h"
Anton Matkin7a65ce62025-06-16 23:23:36 +02007#include "mbedtls/oid.h"
Gilles Peskine86a47f82025-05-07 20:20:12 +02008#include "x509_oid.h"
Anton Matkinbc487252025-06-16 13:37:03 +02009#include "mbedtls/private/rsa.h"
Sam Berry2bb3f4d2024-07-19 15:14:27 +010010#include "mbedtls/asn1.h"
Valerio Setti48e8fc72022-10-19 15:14:29 +020011#include "mbedtls/asn1write.h"
Valerio Setti178b5bd2023-02-13 10:04:28 +010012#include "mbedtls/pk.h"
Ben Taylorc801d322025-07-03 15:01:39 +010013#if defined(MBEDTLS_PK_HAVE_PRIVATE_HEADER)
14#include <mbedtls/private/pk_private.h>
15#endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */
Valerio Setti384fbde2024-01-02 13:26:40 +010016#include "mbedtls/psa_util.h"
Manuel Pégourié-Gonnardfeb03962020-08-20 09:59:33 +020017
Ben Taylor90204262025-06-09 11:51:28 +010018#if defined(MBEDTLS_PEM_WRITE_C) && defined(MBEDTLS_X509_CSR_WRITE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +010019static int x509_crt_verifycsr(const unsigned char *buf, size_t buflen)
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050020{
Przemek Stekiel54a54462022-08-01 13:59:12 +020021 unsigned char hash[PSA_HASH_MAX_SIZE];
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050022 mbedtls_x509_csr csr;
Hanno Beckerbf2dacb2019-06-03 16:28:24 +010023 int ret = 0;
24
Gilles Peskine449bd832023-01-11 14:50:10 +010025 mbedtls_x509_csr_init(&csr);
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050026
Gilles Peskine449bd832023-01-11 14:50:10 +010027 if (mbedtls_x509_csr_parse(&csr, buf, buflen) != 0) {
Hanno Beckerbf2dacb2019-06-03 16:28:24 +010028 ret = MBEDTLS_ERR_X509_BAD_INPUT_DATA;
29 goto cleanup;
30 }
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050031
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +020032 psa_algorithm_t psa_alg = mbedtls_md_psa_alg_from_type(csr.sig_md);
Przemek Stekiel54a54462022-08-01 13:59:12 +020033 size_t hash_size = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +010034 psa_status_t status = psa_hash_compute(psa_alg, csr.cri.p, csr.cri.len,
35 hash, PSA_HASH_MAX_SIZE, &hash_size);
Przemek Stekiel54a54462022-08-01 13:59:12 +020036
Gilles Peskine449bd832023-01-11 14:50:10 +010037 if (status != PSA_SUCCESS) {
Andrzej Kurek4b114072018-11-19 18:04:01 -050038 /* Note: this can't happen except after an internal error */
Hanno Beckerbf2dacb2019-06-03 16:28:24 +010039 ret = MBEDTLS_ERR_X509_BAD_INPUT_DATA;
40 goto cleanup;
Andrzej Kurek4b114072018-11-19 18:04:01 -050041 }
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050042
Ben Taylor8b3b7e52025-08-06 15:23:33 +010043 if (mbedtls_pk_verify_ext(csr.sig_pk, &csr.pk,
Manuel Pégourié-Gonnard9b41eb82023-03-28 11:14:24 +020044 csr.sig_md, hash, mbedtls_md_get_size_from_type(csr.sig_md),
Gilles Peskine449bd832023-01-11 14:50:10 +010045 csr.sig.p, csr.sig.len) != 0) {
Hanno Beckerbf2dacb2019-06-03 16:28:24 +010046 ret = MBEDTLS_ERR_X509_CERT_VERIFY_FAILED;
47 goto cleanup;
Andrzej Kurek4b114072018-11-19 18:04:01 -050048 }
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050049
Hanno Beckerbf2dacb2019-06-03 16:28:24 +010050cleanup:
51
Gilles Peskine449bd832023-01-11 14:50:10 +010052 mbedtls_x509_csr_free(&csr);
53 return ret;
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050054}
Ben Taylor90204262025-06-09 11:51:28 +010055#endif /* MBEDTLS_PEM_WRITE_C && MBEDTLS_X509_CSR_WRITE_C */
Andrzej Kurek5f7bad32018-11-19 10:12:37 -050056
Valerio Setti48e8fc72022-10-19 15:14:29 +020057#if defined(MBEDTLS_X509_CSR_WRITE_C)
58
59/*
60 * The size of this temporary buffer is given by the sequence of functions
61 * called hereinafter:
62 * - mbedtls_asn1_write_oid()
63 * - 8 bytes for MBEDTLS_OID_EXTENDED_KEY_USAGE raw value
64 * - 1 byte for MBEDTLS_OID_EXTENDED_KEY_USAGE length
65 * - 1 byte for MBEDTLS_ASN1_OID tag
66 * - mbedtls_asn1_write_len()
67 * - 1 byte since we're dealing with sizes which are less than 0x80
68 * - mbedtls_asn1_write_tag()
69 * - 1 byte
70 *
71 * This length is fine as long as this function is called using the
72 * MBEDTLS_OID_SERVER_AUTH OID. If this is changed in the future, then this
73 * buffer's length should be adjusted accordingly.
74 * Unfortunately there's no predefined max size for OIDs which can be used
75 * to set an overall upper boundary which is always guaranteed.
76 */
77#define EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH 12
78
Gilles Peskine449bd832023-01-11 14:50:10 +010079static int csr_set_extended_key_usage(mbedtls_x509write_csr *ctx,
80 const char *oid, size_t oid_len)
Valerio Setti48e8fc72022-10-19 15:14:29 +020081{
82 unsigned char buf[EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH] = { 0 };
Gilles Peskine449bd832023-01-11 14:50:10 +010083 unsigned char *p = buf + sizeof(buf);
Valerio Setti48e8fc72022-10-19 15:14:29 +020084 int ret;
85 size_t len = 0;
86
87 /*
88 * Following functions fail anyway if the temporary buffer is not large,
89 * but we set an extra check here to emphasize a possible source of errors
90 */
Gilles Peskine449bd832023-01-11 14:50:10 +010091 if (oid_len > EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH) {
Valerio Setti48e8fc72022-10-19 15:14:29 +020092 return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
93 }
94
Gilles Peskine449bd832023-01-11 14:50:10 +010095 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_oid(&p, buf, oid, oid_len));
96 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, buf, ret));
97 MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, buf,
98 MBEDTLS_ASN1_CONSTRUCTED |
99 MBEDTLS_ASN1_SEQUENCE));
Valerio Setti48e8fc72022-10-19 15:14:29 +0200100
Gilles Peskine449bd832023-01-11 14:50:10 +0100101 ret = mbedtls_x509write_csr_set_extension(ctx,
102 MBEDTLS_OID_EXTENDED_KEY_USAGE,
103 MBEDTLS_OID_SIZE(MBEDTLS_OID_EXTENDED_KEY_USAGE),
104 0,
105 p,
106 len);
Valerio Setti48e8fc72022-10-19 15:14:29 +0200107
108 return ret;
109}
110#endif /* MBEDTLS_X509_CSR_WRITE_C */
Gilles Peskinec94500b2023-09-21 18:01:05 +0200111
112/* Due to inconsistencies in the input size limits applied by different
113 * library functions, some write-parse tests may fail. */
114#define MAY_FAIL_GET_NAME 0x0001
115#define MAY_FAIL_DN_GETS 0x0002
116
Paul Bakker33b43f12013-08-20 11:48:36 +0200117/* END_HEADER */
Paul Bakker6d620502012-02-16 14:09:13 +0000118
Paul Bakker33b43f12013-08-20 11:48:36 +0200119/* BEGIN_DEPENDENCIES
Valerio Setti3580f442023-07-27 10:19:53 +0200120 * depends_on:MBEDTLS_FS_IO:MBEDTLS_PK_PARSE_C
Paul Bakker33b43f12013-08-20 11:48:36 +0200121 * END_DEPENDENCIES
122 */
Paul Bakker6d620502012-02-16 14:09:13 +0000123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200124/* BEGIN_CASE depends_on:MBEDTLS_PEM_WRITE_C:MBEDTLS_X509_CSR_WRITE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100125void x509_csr_check(char *key_file, char *cert_req_check_file, int md_type,
126 int key_usage, int set_key_usage, int cert_type,
127 int set_cert_type, int set_extension)
Paul Bakker6d620502012-02-16 14:09:13 +0000128{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200129 mbedtls_pk_context key;
130 mbedtls_x509write_csr req;
Andres AGe0af9952016-09-07 11:09:44 +0100131 unsigned char buf[4096];
Paul Bakker6d620502012-02-16 14:09:13 +0000132 int ret;
Ben Taylor1e2e2ea2025-07-29 13:19:27 +0100133 unsigned char check_buf[4000];
134 FILE *f;
135 size_t olen = 0;
Neil Armstrongc23d2e32022-03-18 15:31:59 +0100136 size_t pem_len = 0, buf_index;
137 int der_len = -1;
Paul Bakker3a8cb6f2013-12-30 20:41:54 +0100138 const char *subject_name = "C=NL,O=PolarSSL,CN=PolarSSL Server 1";
Ronald Cron351f0ee2020-06-10 12:12:18 +0200139 mbedtls_test_rnd_pseudo_info rnd_info;
Przemek Stekiel8e83d3a2023-02-14 12:01:16 +0100140 mbedtls_x509_san_list san_ip;
141 mbedtls_x509_san_list san_dns;
142 mbedtls_x509_san_list san_uri;
Andrzej Kurek34ccd8d2023-07-07 06:32:17 -0400143 mbedtls_x509_san_list san_mail;
144 mbedtls_x509_san_list san_dn;
Przemek Stekiel8e83d3a2023-02-14 12:01:16 +0100145 mbedtls_x509_san_list *san_list = NULL;
Andrzej Kurek34ccd8d2023-07-07 06:32:17 -0400146 mbedtls_asn1_named_data *ext_san_dirname = NULL;
147
148 const char san_ip_name[] = { 0x7f, 0x00, 0x00, 0x01 }; // 127.0.0.1
Przemek Stekiel8e83d3a2023-02-14 12:01:16 +0100149 const char *san_dns_name = "example.com";
Andrzej Kurek34ccd8d2023-07-07 06:32:17 -0400150 const char *san_dn_name = "C=UK,O=Mbed TLS,CN=Mbed TLS directoryName SAN";
151 const char *san_mail_name = "mail@example.com";
152 const char *san_uri_name = "http://pki.example.com";
153
154 san_mail.node.type = MBEDTLS_X509_SAN_RFC822_NAME;
155 san_mail.node.san.unstructured_name.p = (unsigned char *) san_mail_name;
156 san_mail.node.san.unstructured_name.len = strlen(san_mail_name);
157 san_mail.next = NULL;
158
159 san_dns.node.type = MBEDTLS_X509_SAN_DNS_NAME;
160 san_dns.node.san.unstructured_name.p = (unsigned char *) san_dns_name;
161 san_dns.node.san.unstructured_name.len = strlen(san_dns_name);
162 san_dns.next = &san_mail;
163
164 san_dn.node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
165 TEST_ASSERT(mbedtls_x509_string_to_names(&ext_san_dirname,
166 san_dn_name) == 0);
167 san_dn.node.san.directory_name = *ext_san_dirname;
168 san_dn.next = &san_dns;
169
170 san_ip.node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
171 san_ip.node.san.unstructured_name.p = (unsigned char *) san_ip_name;
172 san_ip.node.san.unstructured_name.len = sizeof(san_ip_name);
173 san_ip.next = &san_dn;
Przemek Stekiel8e83d3a2023-02-14 12:01:16 +0100174
175 san_uri.node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
Przemek Stekiel5a49d3c2023-02-24 13:12:55 +0100176 san_uri.node.san.unstructured_name.p = (unsigned char *) san_uri_name;
177 san_uri.node.san.unstructured_name.len = strlen(san_uri_name);
Andrzej Kurek34ccd8d2023-07-07 06:32:17 -0400178 san_uri.next = &san_ip;
179
180 san_list = &san_uri;
Paul Bakker6d620502012-02-16 14:09:13 +0000181
Gilles Peskine449bd832023-01-11 14:50:10 +0100182 memset(&rnd_info, 0x2a, sizeof(mbedtls_test_rnd_pseudo_info));
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200183
Gilles Peskine449bd832023-01-11 14:50:10 +0100184 mbedtls_x509write_csr_init(&req);
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 mbedtls_pk_init(&key);
valerio32f2ac92023-04-20 11:59:52 +0200186 MD_OR_USE_PSA_INIT();
187
Ben Taylor440cb2a2025-03-05 09:40:08 +0000188 TEST_ASSERT(mbedtls_pk_parse_keyfile(&key, key_file, NULL) == 0);
Paul Bakker6d620502012-02-16 14:09:13 +0000189
Gilles Peskine449bd832023-01-11 14:50:10 +0100190 mbedtls_x509write_csr_set_md_alg(&req, md_type);
191 mbedtls_x509write_csr_set_key(&req, &key);
192 TEST_ASSERT(mbedtls_x509write_csr_set_subject_name(&req, subject_name) == 0);
193 if (set_key_usage != 0) {
194 TEST_ASSERT(mbedtls_x509write_csr_set_key_usage(&req, key_usage) == 0);
195 }
196 if (set_cert_type != 0) {
197 TEST_ASSERT(mbedtls_x509write_csr_set_ns_cert_type(&req, cert_type) == 0);
198 }
199 if (set_extension != 0) {
200 TEST_ASSERT(csr_set_extended_key_usage(&req, MBEDTLS_OID_SERVER_AUTH,
201 MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) == 0);
Przemek Stekiel8e83d3a2023-02-14 12:01:16 +0100202
203 TEST_ASSERT(mbedtls_x509write_csr_set_subject_alternative_name(&req, san_list) == 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 }
Paul Bakker8eabfc12013-08-25 10:18:25 +0200205
Ben Taylor440cb2a2025-03-05 09:40:08 +0000206 ret = mbedtls_x509write_csr_pem(&req, buf, sizeof(buf));
Gilles Peskine449bd832023-01-11 14:50:10 +0100207 TEST_ASSERT(ret == 0);
Paul Bakker6d620502012-02-16 14:09:13 +0000208
Gilles Peskine449bd832023-01-11 14:50:10 +0100209 pem_len = strlen((char *) buf);
Paul Bakker6d620502012-02-16 14:09:13 +0000210
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 for (buf_index = pem_len; buf_index < sizeof(buf); ++buf_index) {
212 TEST_ASSERT(buf[buf_index] == 0);
Paul Elliott557b8d62020-11-19 09:46:56 +0000213 }
214
Ben Taylor1e2e2ea2025-07-29 13:19:27 +0100215 f = fopen(cert_req_check_file, "r"); //open the file
216 TEST_ASSERT(f != NULL); //check the file has been opened.
217 olen = fread(check_buf, 1, sizeof(check_buf), f); // read the file
218 fclose(f); // close the file
219
Ben Taylor4df61d42025-07-29 15:03:55 +0100220 TEST_ASSERT(olen >= pem_len - 1);
221 TEST_ASSERT(memcmp(buf, check_buf, pem_len - 1) == 0);
Ben Taylor1e2e2ea2025-07-29 13:19:27 +0100222
Paul Bakker58ef6ec2013-01-03 11:33:48 +0100223
Ben Taylor440cb2a2025-03-05 09:40:08 +0000224 der_len = mbedtls_x509write_csr_der(&req, buf, sizeof(buf));
Gilles Peskine449bd832023-01-11 14:50:10 +0100225 TEST_ASSERT(der_len >= 0);
Andres AGe0af9952016-09-07 11:09:44 +0100226
Gilles Peskine449bd832023-01-11 14:50:10 +0100227 if (der_len == 0) {
Andres AGe0af9952016-09-07 11:09:44 +0100228 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 }
Andres AGe0af9952016-09-07 11:09:44 +0100230
Ben Taylor1e2e2ea2025-07-29 13:19:27 +0100231 der_len -= 1;
Ben Taylor440cb2a2025-03-05 09:40:08 +0000232 ret = mbedtls_x509write_csr_der(&req, buf, (size_t) (der_len));
Gilles Peskine449bd832023-01-11 14:50:10 +0100233 TEST_ASSERT(ret == MBEDTLS_ERR_ASN1_BUF_TOO_SMALL);
Andres AGe0af9952016-09-07 11:09:44 +0100234
Paul Bakkerbd51b262014-07-10 15:26:12 +0200235exit:
Andrzej Kurekbdb41dd2023-07-10 08:09:50 -0400236 mbedtls_asn1_free_named_data_list(&ext_san_dirname);
Gilles Peskine449bd832023-01-11 14:50:10 +0100237 mbedtls_x509write_csr_free(&req);
238 mbedtls_pk_free(&key);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +0100239 MD_OR_USE_PSA_DONE();
Paul Bakker6d620502012-02-16 14:09:13 +0000240}
Paul Bakker33b43f12013-08-20 11:48:36 +0200241/* END_CASE */
Paul Bakker2397cf32013-09-08 15:58:15 +0200242
Ben Taylor90204262025-06-09 11:51:28 +0100243/* BEGIN_CASE depends_on:MBEDTLS_PEM_WRITE_C:MBEDTLS_X509_CSR_WRITE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100244void x509_csr_check_opaque(char *key_file, int md_type, int key_usage,
245 int cert_type)
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500246{
247 mbedtls_pk_context key;
Paul Elliott9a209b82024-10-25 12:41:28 +0100248 mbedtls_pk_init(&key);
249
Ronald Cron5425a212020-08-04 14:58:35 +0200250 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100251 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
Paul Elliott9a209b82024-10-25 12:41:28 +0100252
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500253 mbedtls_x509write_csr req;
Paul Elliott9a209b82024-10-25 12:41:28 +0100254 mbedtls_x509write_csr_init(&req);
255
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500256 unsigned char buf[4096];
257 int ret;
258 size_t pem_len = 0;
259 const char *subject_name = "C=NL,O=PolarSSL,CN=PolarSSL Server 1";
Ronald Cron351f0ee2020-06-10 12:12:18 +0200260 mbedtls_test_rnd_pseudo_info rnd_info;
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500261
Valerio Setti569c1712023-04-19 14:53:36 +0200262 MD_OR_USE_PSA_INIT();
263
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 memset(&rnd_info, 0x2a, sizeof(mbedtls_test_rnd_pseudo_info));
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500265
Ben Taylor440cb2a2025-03-05 09:40:08 +0000266 TEST_ASSERT(mbedtls_pk_parse_keyfile(&key, key_file, NULL) == 0);
Neil Armstrong95974972022-04-22 13:57:44 +0200267
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100268 /* Turn the PK context into an opaque one. */
269 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&key, PSA_KEY_USAGE_SIGN_HASH, &key_attr), 0);
270 TEST_EQUAL(mbedtls_pk_import_into_psa(&key, &key_attr, &key_id), 0);
271 mbedtls_pk_free(&key);
272 mbedtls_pk_init(&key);
Ben Taylor361ce2b2025-07-04 10:36:53 +0100273 TEST_EQUAL(mbedtls_pk_wrap_psa(&key, key_id), 0);
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500274
Gilles Peskine449bd832023-01-11 14:50:10 +0100275 mbedtls_x509write_csr_set_md_alg(&req, md_type);
276 mbedtls_x509write_csr_set_key(&req, &key);
277 TEST_ASSERT(mbedtls_x509write_csr_set_subject_name(&req, subject_name) == 0);
278 if (key_usage != 0) {
279 TEST_ASSERT(mbedtls_x509write_csr_set_key_usage(&req, key_usage) == 0);
280 }
281 if (cert_type != 0) {
282 TEST_ASSERT(mbedtls_x509write_csr_set_ns_cert_type(&req, cert_type) == 0);
283 }
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500284
Ben Taylor440cb2a2025-03-05 09:40:08 +0000285 ret = mbedtls_x509write_csr_pem(&req, buf, sizeof(buf) - 1);
Ronald Cron6c5bd7f2020-06-10 14:08:26 +0200286
Gilles Peskine449bd832023-01-11 14:50:10 +0100287 TEST_ASSERT(ret == 0);
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500288
Gilles Peskine449bd832023-01-11 14:50:10 +0100289 pem_len = strlen((char *) buf);
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500290 buf[pem_len] = '\0';
Gilles Peskine449bd832023-01-11 14:50:10 +0100291 TEST_ASSERT(x509_crt_verifycsr(buf, pem_len + 1) == 0);
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500292
Manuel Pégourié-Gonnardfeb03962020-08-20 09:59:33 +0200293
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500294exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100295 mbedtls_x509write_csr_free(&req);
296 mbedtls_pk_free(&key);
297 psa_destroy_key(key_id);
Valerio Setti569c1712023-04-19 14:53:36 +0200298 MD_OR_USE_PSA_DONE();
Andrzej Kurek5f7bad32018-11-19 10:12:37 -0500299}
300/* END_CASE */
301
Elena Uziunaite9fc5be02024-09-04 18:12:59 +0100302/* BEGIN_CASE depends_on:MBEDTLS_PEM_WRITE_C:MBEDTLS_X509_CRT_WRITE_C:MBEDTLS_X509_CRT_PARSE_C:PSA_WANT_ALG_SHA_1 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100303void x509_crt_check(char *subject_key_file, char *subject_pwd,
304 char *subject_name, char *issuer_key_file,
305 char *issuer_pwd, char *issuer_name,
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100306 data_t *serial_arg, char *not_before, char *not_after,
Gilles Peskine449bd832023-01-11 14:50:10 +0100307 int md_type, int key_usage, int set_key_usage,
308 char *ext_key_usage,
309 int cert_type, int set_cert_type, int auth_ident,
310 int ver, char *cert_check_file, int pk_wrap, int is_ca,
Andrzej Kurek76c96622023-04-04 06:57:08 -0400311 char *cert_verify_file, int set_subjectAltNames)
Paul Bakker2397cf32013-09-08 15:58:15 +0200312{
Hanno Becker418a6222017-09-14 07:51:28 +0100313 mbedtls_pk_context subject_key, issuer_key, issuer_key_alt;
314 mbedtls_pk_context *key = &issuer_key;
315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200316 mbedtls_x509write_cert crt;
Andres AGe0af9952016-09-07 11:09:44 +0100317 unsigned char buf[4096];
Paul Bakker2397cf32013-09-08 15:58:15 +0200318 unsigned char check_buf[5000];
Werner Lewisacd01e52022-05-10 12:23:13 +0100319 unsigned char *p, *end;
320 unsigned char tag, sz;
Werner Lewisacd01e52022-05-10 12:23:13 +0100321 int ret, before_tag, after_tag;
Paul Elliott557b8d62020-11-19 09:46:56 +0000322 size_t olen = 0, pem_len = 0, buf_index = 0;
Andres AGe0af9952016-09-07 11:09:44 +0100323 int der_len = -1;
Paul Bakker2397cf32013-09-08 15:58:15 +0200324 FILE *f;
Ronald Cron351f0ee2020-06-10 12:12:18 +0200325 mbedtls_test_rnd_pseudo_info rnd_info;
Neil Armstrong98f899c2022-03-16 17:42:42 +0100326 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100327 psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100328 mbedtls_pk_type_t issuer_key_type;
Andrzej Kurek76c96622023-04-04 06:57:08 -0400329 mbedtls_x509_san_list san_ip;
330 mbedtls_x509_san_list san_dns;
331 mbedtls_x509_san_list san_uri;
332 mbedtls_x509_san_list san_mail;
333 mbedtls_x509_san_list san_dn;
334 mbedtls_asn1_named_data *ext_san_dirname = NULL;
335 const char san_ip_name[] = { 0x01, 0x02, 0x03, 0x04 };
336 const char *san_dns_name = "example.com";
337 const char *san_dn_name = "C=UK,O=Mbed TLS,CN=SubjectAltName test";
338 const char *san_mail_name = "mail@example.com";
339 const char *san_uri_name = "http://pki.example.com";
340 mbedtls_x509_san_list *san_list = NULL;
341
342 if (set_subjectAltNames) {
343 san_mail.node.type = MBEDTLS_X509_SAN_RFC822_NAME;
344 san_mail.node.san.unstructured_name.p = (unsigned char *) san_mail_name;
Andrzej Kurek13c43f62023-04-04 10:43:38 -0400345 san_mail.node.san.unstructured_name.len = strlen(san_mail_name);
Andrzej Kurek76c96622023-04-04 06:57:08 -0400346 san_mail.next = NULL;
347
348 san_dns.node.type = MBEDTLS_X509_SAN_DNS_NAME;
349 san_dns.node.san.unstructured_name.p = (unsigned char *) san_dns_name;
350 san_dns.node.san.unstructured_name.len = strlen(san_dns_name);
351 san_dns.next = &san_mail;
352
353 san_dn.node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
354 TEST_ASSERT(mbedtls_x509_string_to_names(&ext_san_dirname,
355 san_dn_name) == 0);
356 san_dn.node.san.directory_name = *ext_san_dirname;
357 san_dn.next = &san_dns;
358
359 san_ip.node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
360 san_ip.node.san.unstructured_name.p = (unsigned char *) san_ip_name;
361 san_ip.node.san.unstructured_name.len = sizeof(san_ip_name);
362 san_ip.next = &san_dn;
363
364 san_uri.node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
365 san_uri.node.san.unstructured_name.p = (unsigned char *) san_uri_name;
366 san_uri.node.san.unstructured_name.len = strlen(san_uri_name);
367 san_uri.next = &san_ip;
368
369 san_list = &san_uri;
370 }
Paul Bakker2397cf32013-09-08 15:58:15 +0200371
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 memset(&rnd_info, 0x2a, sizeof(mbedtls_test_rnd_pseudo_info));
Hanno Becker418a6222017-09-14 07:51:28 +0100373
Gilles Peskine449bd832023-01-11 14:50:10 +0100374 mbedtls_pk_init(&subject_key);
375 mbedtls_pk_init(&issuer_key);
376 mbedtls_pk_init(&issuer_key_alt);
Gilles Peskine449bd832023-01-11 14:50:10 +0100377 mbedtls_x509write_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200378 MD_OR_USE_PSA_INIT();
Paul Bakker2397cf32013-09-08 15:58:15 +0200379
Gilles Peskine449bd832023-01-11 14:50:10 +0100380 TEST_ASSERT(mbedtls_pk_parse_keyfile(&subject_key, subject_key_file,
Ben Taylor440cb2a2025-03-05 09:40:08 +0000381 subject_pwd) == 0);
Hanno Becker418a6222017-09-14 07:51:28 +0100382
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 TEST_ASSERT(mbedtls_pk_parse_keyfile(&issuer_key, issuer_key_file,
Ben Taylor440cb2a2025-03-05 09:40:08 +0000384 issuer_pwd) == 0);
Hanno Becker418a6222017-09-14 07:51:28 +0100385
Gilles Peskine449bd832023-01-11 14:50:10 +0100386 issuer_key_type = mbedtls_pk_get_type(&issuer_key);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100387
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100388 /* Turn the issuer PK context into an opaque one. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100389 if (pk_wrap == 2) {
Valerio Setti1fa2f6e2024-02-27 08:11:25 +0100390 TEST_EQUAL(mbedtls_pk_get_psa_attributes(&issuer_key, PSA_KEY_USAGE_SIGN_HASH,
391 &key_attr), 0);
392 TEST_EQUAL(mbedtls_pk_import_into_psa(&issuer_key, &key_attr, &key_id), 0);
393 mbedtls_pk_free(&issuer_key);
394 mbedtls_pk_init(&issuer_key);
Ben Taylor361ce2b2025-07-04 10:36:53 +0100395 TEST_EQUAL(mbedtls_pk_wrap_psa(&issuer_key, key_id), 0);
Neil Armstrong98f899c2022-03-16 17:42:42 +0100396 }
Neil Armstrong98f899c2022-03-16 17:42:42 +0100397
Gilles Peskine449bd832023-01-11 14:50:10 +0100398 if (pk_wrap == 2) {
399 TEST_ASSERT(mbedtls_pk_get_type(&issuer_key) == MBEDTLS_PK_OPAQUE);
400 }
Neil Armstrong98f899c2022-03-16 17:42:42 +0100401
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 if (ver != -1) {
403 mbedtls_x509write_crt_set_version(&crt, ver);
404 }
Hanno Becker418a6222017-09-14 07:51:28 +0100405
Valerio Settiaf4815c2023-01-26 17:43:09 +0100406 TEST_ASSERT(mbedtls_x509write_crt_set_serial_raw(&crt, serial_arg->x,
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100407 serial_arg->len) == 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100408 TEST_ASSERT(mbedtls_x509write_crt_set_validity(&crt, not_before,
409 not_after) == 0);
410 mbedtls_x509write_crt_set_md_alg(&crt, md_type);
411 TEST_ASSERT(mbedtls_x509write_crt_set_issuer_name(&crt, issuer_name) == 0);
412 TEST_ASSERT(mbedtls_x509write_crt_set_subject_name(&crt, subject_name) == 0);
413 mbedtls_x509write_crt_set_subject_key(&crt, &subject_key);
Hanno Becker418a6222017-09-14 07:51:28 +0100414
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 mbedtls_x509write_crt_set_issuer_key(&crt, key);
Paul Bakker2397cf32013-09-08 15:58:15 +0200416
Gilles Peskine449bd832023-01-11 14:50:10 +0100417 if (crt.version >= MBEDTLS_X509_CRT_VERSION_3) {
Darren Krahn9c134ce2021-01-13 22:04:45 -0800418 /* For the CA case, a path length of -1 means unlimited. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100419 TEST_ASSERT(mbedtls_x509write_crt_set_basic_constraints(&crt, is_ca,
420 (is_ca ? -1 : 0)) == 0);
421 TEST_ASSERT(mbedtls_x509write_crt_set_subject_key_identifier(&crt) == 0);
422 if (auth_ident) {
423 TEST_ASSERT(mbedtls_x509write_crt_set_authority_key_identifier(&crt) == 0);
424 }
425 if (set_key_usage != 0) {
426 TEST_ASSERT(mbedtls_x509write_crt_set_key_usage(&crt, key_usage) == 0);
427 }
428 if (set_cert_type != 0) {
429 TEST_ASSERT(mbedtls_x509write_crt_set_ns_cert_type(&crt, cert_type) == 0);
430 }
431 if (strcmp(ext_key_usage, "NULL") != 0) {
Dave Rodgmanec9f6b42022-07-27 14:34:58 +0100432 mbedtls_asn1_sequence exts[2];
Gilles Peskine449bd832023-01-11 14:50:10 +0100433 memset(exts, 0, sizeof(exts));
Dave Rodgman5f3f0d02022-08-11 14:38:26 +0100434
435#define SET_OID(x, oid) \
436 do { \
437 x.len = MBEDTLS_OID_SIZE(oid); \
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 x.p = (unsigned char *) oid; \
Dave Rodgman5f3f0d02022-08-11 14:38:26 +0100439 x.tag = MBEDTLS_ASN1_OID; \
Dave Rodgmane2b772d2022-08-11 16:04:13 +0100440 } \
Gilles Peskine449bd832023-01-11 14:50:10 +0100441 while (0)
Dave Rodgman5f3f0d02022-08-11 14:38:26 +0100442
Gilles Peskine449bd832023-01-11 14:50:10 +0100443 if (strcmp(ext_key_usage, "serverAuth") == 0) {
444 SET_OID(exts[0].buf, MBEDTLS_OID_SERVER_AUTH);
445 } else if (strcmp(ext_key_usage, "codeSigning,timeStamping") == 0) {
446 SET_OID(exts[0].buf, MBEDTLS_OID_CODE_SIGNING);
Dave Rodgman5f3f0d02022-08-11 14:38:26 +0100447 exts[0].next = &exts[1];
Gilles Peskine449bd832023-01-11 14:50:10 +0100448 SET_OID(exts[1].buf, MBEDTLS_OID_TIME_STAMPING);
Nicholas Wilsonca841d32015-11-13 14:22:36 +0000449 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100450 TEST_ASSERT(mbedtls_x509write_crt_set_ext_key_usage(&crt, exts) == 0);
Nicholas Wilsonca841d32015-11-13 14:22:36 +0000451 }
Manuel Pégourié-Gonnard6c1a73e2014-03-28 14:03:22 +0100452 }
Paul Bakker2397cf32013-09-08 15:58:15 +0200453
Andrzej Kurek76c96622023-04-04 06:57:08 -0400454 if (set_subjectAltNames) {
455 TEST_ASSERT(mbedtls_x509write_crt_set_subject_alternative_name(&crt, san_list) == 0);
456 }
Ben Taylor440cb2a2025-03-05 09:40:08 +0000457 ret = mbedtls_x509write_crt_pem(&crt, buf, sizeof(buf));
Gilles Peskine449bd832023-01-11 14:50:10 +0100458 TEST_ASSERT(ret == 0);
Paul Bakker2397cf32013-09-08 15:58:15 +0200459
Gilles Peskine449bd832023-01-11 14:50:10 +0100460 pem_len = strlen((char *) buf);
Paul Bakker2397cf32013-09-08 15:58:15 +0200461
Paul Elliott557b8d62020-11-19 09:46:56 +0000462 // check that the rest of the buffer remains clear
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 for (buf_index = pem_len; buf_index < sizeof(buf); ++buf_index) {
464 TEST_ASSERT(buf[buf_index] == 0);
Paul Elliott557b8d62020-11-19 09:46:56 +0000465 }
466
Gilles Peskine449bd832023-01-11 14:50:10 +0100467 if (issuer_key_type != MBEDTLS_PK_RSA) {
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100468 mbedtls_x509_crt crt_parse, trusted;
469 uint32_t flags;
Paul Bakker2397cf32013-09-08 15:58:15 +0200470
Gilles Peskine449bd832023-01-11 14:50:10 +0100471 mbedtls_x509_crt_init(&crt_parse);
472 mbedtls_x509_crt_init(&trusted);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100473
Gilles Peskine449bd832023-01-11 14:50:10 +0100474 TEST_ASSERT(mbedtls_x509_crt_parse_file(&trusted,
475 cert_verify_file) == 0);
476 TEST_ASSERT(mbedtls_x509_crt_parse(&crt_parse,
477 buf, sizeof(buf)) == 0);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100478
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 ret = mbedtls_x509_crt_verify(&crt_parse, &trusted, NULL, NULL, &flags,
480 NULL, NULL);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100481
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 mbedtls_x509_crt_free(&crt_parse);
483 mbedtls_x509_crt_free(&trusted);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100484
Gilles Peskine449bd832023-01-11 14:50:10 +0100485 TEST_EQUAL(flags, 0);
486 TEST_EQUAL(ret, 0);
487 } else if (*cert_check_file != '\0') {
488 f = fopen(cert_check_file, "r");
489 TEST_ASSERT(f != NULL);
490 olen = fread(check_buf, 1, sizeof(check_buf), f);
491 fclose(f);
492 TEST_ASSERT(olen < sizeof(check_buf));
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100493
Gilles Peskine449bd832023-01-11 14:50:10 +0100494 TEST_EQUAL(olen, pem_len);
495 TEST_ASSERT(olen >= pem_len - 1);
496 TEST_ASSERT(memcmp(buf, check_buf, pem_len - 1) == 0);
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100497 }
Paul Bakker2397cf32013-09-08 15:58:15 +0200498
Ben Taylor440cb2a2025-03-05 09:40:08 +0000499 der_len = mbedtls_x509write_crt_der(&crt, buf, sizeof(buf));
Gilles Peskine449bd832023-01-11 14:50:10 +0100500 TEST_ASSERT(der_len >= 0);
Andres AGe0af9952016-09-07 11:09:44 +0100501
Gilles Peskine449bd832023-01-11 14:50:10 +0100502 if (der_len == 0) {
Andres AGe0af9952016-09-07 11:09:44 +0100503 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100504 }
Andres AGe0af9952016-09-07 11:09:44 +0100505
Werner Lewisacd01e52022-05-10 12:23:13 +0100506 // Not testing against file, check date format
Gilles Peskine449bd832023-01-11 14:50:10 +0100507 if (*cert_check_file == '\0') {
Werner Lewisacd01e52022-05-10 12:23:13 +0100508 // UTC tag if before 2050, 2 digits less for year
Gilles Peskine449bd832023-01-11 14:50:10 +0100509 if (not_before[0] == '2' && (not_before[1] > '0' || not_before[2] > '4')) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100510 before_tag = MBEDTLS_ASN1_GENERALIZED_TIME;
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 } else {
Werner Lewisacd01e52022-05-10 12:23:13 +0100512 before_tag = MBEDTLS_ASN1_UTC_TIME;
513 not_before += 2;
514 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100515 if (not_after[0] == '2' && (not_after[1] > '0' || not_after[2] > '4')) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100516 after_tag = MBEDTLS_ASN1_GENERALIZED_TIME;
Gilles Peskine449bd832023-01-11 14:50:10 +0100517 } else {
Werner Lewisacd01e52022-05-10 12:23:13 +0100518 after_tag = MBEDTLS_ASN1_UTC_TIME;
519 not_after += 2;
520 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100521 end = buf + sizeof(buf);
522 for (p = end - der_len; p < end;) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100523 tag = *p++;
524 sz = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 if (tag == MBEDTLS_ASN1_UTC_TIME || tag == MBEDTLS_ASN1_GENERALIZED_TIME) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100526 // Check correct tag and time written
Gilles Peskine449bd832023-01-11 14:50:10 +0100527 TEST_ASSERT(before_tag == tag);
528 TEST_ASSERT(memcmp(p, not_before, sz - 1) == 0);
Werner Lewisacd01e52022-05-10 12:23:13 +0100529 p += sz;
530 tag = *p++;
531 sz = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100532 TEST_ASSERT(after_tag == tag);
533 TEST_ASSERT(memcmp(p, not_after, sz - 1) == 0);
Werner Lewisacd01e52022-05-10 12:23:13 +0100534 break;
535 }
536 // Increment if long form ASN1 length
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 if (sz & 0x80) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100538 p += sz & 0x0F;
Gilles Peskine449bd832023-01-11 14:50:10 +0100539 }
540 if (tag != (MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) {
Werner Lewisacd01e52022-05-10 12:23:13 +0100541 p += sz;
Gilles Peskine449bd832023-01-11 14:50:10 +0100542 }
Werner Lewisacd01e52022-05-10 12:23:13 +0100543 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100544 TEST_ASSERT(p < end);
Werner Lewisacd01e52022-05-10 12:23:13 +0100545 }
546
Ben Taylordbea0a92025-07-29 13:27:39 +0100547 der_len -= 1;
Neil Armstrong6ce6dd92022-03-17 09:38:50 +0100548
Ben Taylor440cb2a2025-03-05 09:40:08 +0000549 ret = mbedtls_x509write_crt_der(&crt, buf, (size_t) (der_len));
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 TEST_ASSERT(ret == MBEDTLS_ERR_ASN1_BUF_TOO_SMALL);
Andres AGe0af9952016-09-07 11:09:44 +0100551
Paul Bakkerbd51b262014-07-10 15:26:12 +0200552exit:
Andrzej Kurek5da1d752023-04-05 08:30:59 -0400553 mbedtls_asn1_free_named_data_list(&ext_san_dirname);
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 mbedtls_x509write_crt_free(&crt);
555 mbedtls_pk_free(&issuer_key_alt);
556 mbedtls_pk_free(&subject_key);
557 mbedtls_pk_free(&issuer_key);
Gilles Peskine449bd832023-01-11 14:50:10 +0100558 psa_destroy_key(key_id);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +0100559 MD_OR_USE_PSA_DONE();
Paul Bakker2397cf32013-09-08 15:58:15 +0200560}
561/* END_CASE */
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200562
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100563/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_WRITE_C */
564void x509_set_serial_check()
565{
566 mbedtls_x509write_cert ctx;
567 uint8_t invalid_serial[MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN + 1];
568
Valerio Setti569c1712023-04-19 14:53:36 +0200569 USE_PSA_INIT();
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100570 memset(invalid_serial, 0x01, sizeof(invalid_serial));
571
Valerio Settiaf4815c2023-01-26 17:43:09 +0100572 TEST_EQUAL(mbedtls_x509write_crt_set_serial_raw(&ctx, invalid_serial,
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100573 sizeof(invalid_serial)),
574 MBEDTLS_ERR_X509_BAD_INPUT_DATA);
575
Valerio Settia87f8392023-01-26 18:00:50 +0100576exit:
Valerio Settia87f8392023-01-26 18:00:50 +0100577 ;
Valerio Setti569c1712023-04-19 14:53:36 +0200578 USE_PSA_DONE();
Valerio Settiaad8dbd2023-01-09 17:20:25 +0100579}
580/* END_CASE */
581
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200582/* BEGIN_CASE depends_on:MBEDTLS_X509_CREATE_C:MBEDTLS_X509_USE_C */
Gilles Peskinec94500b2023-09-21 18:01:05 +0200583void mbedtls_x509_string_to_names(char *name, char *parsed_name,
584 int result, int may_fail)
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200585{
586 int ret;
587 size_t len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588 mbedtls_asn1_named_data *names = NULL;
Gilles Peskine21e46b32023-10-17 16:35:20 +0200589 mbedtls_x509_name parsed;
590 memset(&parsed, 0, sizeof(parsed));
591 mbedtls_x509_name *parsed_cur = NULL;
592 mbedtls_x509_name *parsed_prv = NULL;
Gilles Peskinef2574202023-10-18 17:39:48 +0200593 unsigned char buf[1024] = { 0 };
594 unsigned char out[1024] = { 0 };
Gilles Peskine21e46b32023-10-17 16:35:20 +0200595 unsigned char *c = buf + sizeof(buf);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200596
Valerio Setti569c1712023-04-19 14:53:36 +0200597 USE_PSA_INIT();
598
Gilles Peskine449bd832023-01-11 14:50:10 +0100599 ret = mbedtls_x509_string_to_names(&names, name);
Gilles Peskine1c7223b2023-09-21 14:02:05 +0200600 TEST_EQUAL(ret, result);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200601
Gilles Peskine449bd832023-01-11 14:50:10 +0100602 if (ret != 0) {
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200603 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100604 }
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200605
Gilles Peskine449bd832023-01-11 14:50:10 +0100606 ret = mbedtls_x509_write_names(&c, buf, names);
Gilles Peskine1c7223b2023-09-21 14:02:05 +0200607 TEST_LE_S(1, ret);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200608
Gilles Peskine1c7223b2023-09-21 14:02:05 +0200609 TEST_EQUAL(mbedtls_asn1_get_tag(&c, buf + sizeof(buf), &len,
Gilles Peskineaa01a032023-09-21 15:57:30 +0200610 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE), 0);
Gilles Peskinec94500b2023-09-21 18:01:05 +0200611 ret = mbedtls_x509_get_name(&c, buf + sizeof(buf), &parsed);
612 if ((may_fail & MAY_FAIL_GET_NAME) && ret < 0) {
613 /* Validation inconsistency between mbedtls_x509_string_to_names() and
614 * mbedtls_x509_get_name(). Accept it for now. */
615 goto exit;
616 }
617 TEST_EQUAL(ret, 0);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200618
Gilles Peskine449bd832023-01-11 14:50:10 +0100619 ret = mbedtls_x509_dn_gets((char *) out, sizeof(out), &parsed);
Gilles Peskinec94500b2023-09-21 18:01:05 +0200620 if ((may_fail & MAY_FAIL_DN_GETS) && ret < 0) {
621 /* Validation inconsistency between mbedtls_x509_string_to_names() and
622 * mbedtls_x509_dn_gets(). Accept it for now. */
623 goto exit;
624 }
Gilles Peskine1c7223b2023-09-21 14:02:05 +0200625 TEST_LE_S(1, ret);
Gilles Peskine449bd832023-01-11 14:50:10 +0100626 TEST_ASSERT(strcmp((char *) out, parsed_name) == 0);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200627
Manuel Pégourié-Gonnardbda3ab92025-05-05 18:25:26 +0200628 /* Check that calling a 2nd time with the same param (now non-NULL)
629 * returns an error as expected. */
630 ret = mbedtls_x509_string_to_names(&names, name);
631 TEST_EQUAL(ret, MBEDTLS_ERR_X509_BAD_INPUT_DATA);
632
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200633exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100634 mbedtls_asn1_free_named_data_list(&names);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200635
636 parsed_cur = parsed.next;
Gilles Peskine449bd832023-01-11 14:50:10 +0100637 while (parsed_cur != 0) {
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200638 parsed_prv = parsed_cur;
639 parsed_cur = parsed_cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +0100640 mbedtls_free(parsed_prv);
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200641 }
Valerio Setti569c1712023-04-19 14:53:36 +0200642 USE_PSA_DONE();
Paul Bakker8dcb2d72014-08-08 12:22:30 +0200643}
644/* END_CASE */
Jonathan Winzig2bd2b782024-01-09 15:19:42 +0100645
Jonathan Winzig315c3ca2024-01-09 18:31:11 +0100646/* BEGIN_CASE depends_on:MBEDTLS_X509_CSR_WRITE_C */
Jonathan Winzig6c9779f2024-01-09 17:47:10 +0100647void x509_set_extension_length_check()
Jonathan Winzig2bd2b782024-01-09 15:19:42 +0100648{
649 int ret = 0;
650
651 mbedtls_x509write_csr ctx;
652 mbedtls_x509write_csr_init(&ctx);
653
654 unsigned char buf[EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH] = { 0 };
655 unsigned char *p = buf + sizeof(buf);
656
657 ret = mbedtls_x509_set_extension(&(ctx.MBEDTLS_PRIVATE(extensions)),
658 MBEDTLS_OID_EXTENDED_KEY_USAGE,
659 MBEDTLS_OID_SIZE(MBEDTLS_OID_EXTENDED_KEY_USAGE),
660 0,
661 p,
Jonathan Winzig6c9779f2024-01-09 17:47:10 +0100662 SIZE_MAX);
663 TEST_ASSERT(MBEDTLS_ERR_X509_BAD_INPUT_DATA == ret);
Jonathan Winzig2bd2b782024-01-09 15:19:42 +0100664}
665/* END_CASE */
Sam Berry2bb3f4d2024-07-19 15:14:27 +0100666
Gilles Peskineb8288202025-05-12 21:07:47 +0200667/* BEGIN_CASE depends_on:MBEDTLS_X509_CREATE_C */
Sam Berry2bb3f4d2024-07-19 15:14:27 +0100668void oid_from_numeric_string(char *oid_str, int error_ret,
669 data_t *exp_oid_buf)
670{
671 mbedtls_asn1_buf oid = { 0, 0, NULL };
672 mbedtls_asn1_buf exp_oid = { 0, 0, NULL };
673 int ret;
674
675 exp_oid.tag = MBEDTLS_ASN1_OID;
676 exp_oid.p = exp_oid_buf->x;
677 exp_oid.len = exp_oid_buf->len;
678
679 ret = mbedtls_oid_from_numeric_string(&oid, oid_str, strlen(oid_str));
680
681 if (error_ret == 0) {
682 TEST_EQUAL(oid.len, exp_oid.len);
683 TEST_ASSERT(memcmp(oid.p, exp_oid.p, oid.len) == 0);
684 mbedtls_free(oid.p);
685 oid.p = NULL;
686 oid.len = 0;
687 } else {
688 TEST_EQUAL(ret, error_ret);
689 }
690}
691/* END_CASE */