Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 1 | /* |
| 2 | * X.509 Certificate Signing Request writing |
| 3 | * |
Manuel Pégourié-Gonnard | 6fb8187 | 2015-07-27 11:11:48 +0200 | [diff] [blame] | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 18 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 20 | */ |
| 21 | /* |
| 22 | * References: |
| 23 | * - CSRs: PKCS#10 v1.7 aka RFC 2986 |
| 24 | * - attributes: PKCS#9 v2.0 aka RFC 2985 |
| 25 | */ |
| 26 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 27 | #include "common.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 28 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 29 | #if defined(MBEDTLS_X509_CSR_WRITE_C) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 30 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 31 | #include "mbedtls/x509_csr.h" |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 32 | #include "mbedtls/asn1write.h" |
Janos Follath | 73c616b | 2019-12-18 15:07:04 +0000 | [diff] [blame] | 33 | #include "mbedtls/error.h" |
| 34 | #include "mbedtls/oid.h" |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 35 | #include "mbedtls/platform_util.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 36 | |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 37 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 38 | #include "psa/crypto.h" |
| 39 | #include "mbedtls/psa_util.h" |
| 40 | #endif |
| 41 | |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 42 | #include <string.h> |
| 43 | #include <stdlib.h> |
| 44 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 45 | #if defined(MBEDTLS_PEM_WRITE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 46 | #include "mbedtls/pem.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 47 | #endif |
| 48 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 49 | #if defined(MBEDTLS_PLATFORM_C) |
| 50 | #include "mbedtls/platform.h" |
| 51 | #else |
| 52 | #include <stdlib.h> |
| 53 | #define mbedtls_calloc calloc |
| 54 | #define mbedtls_free free |
| 55 | #endif |
| 56 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 57 | void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 58 | { |
Hanno Becker | 81535d0 | 2017-09-13 15:39:59 +0100 | [diff] [blame] | 59 | memset( ctx, 0, sizeof( mbedtls_x509write_csr ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 60 | } |
| 61 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 62 | void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 63 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 64 | mbedtls_asn1_free_named_data_list( &ctx->subject ); |
| 65 | mbedtls_asn1_free_named_data_list( &ctx->extensions ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 66 | |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 67 | mbedtls_platform_zeroize( ctx, sizeof( mbedtls_x509write_csr ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 68 | } |
| 69 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 70 | void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 71 | { |
| 72 | ctx->md_alg = md_alg; |
| 73 | } |
| 74 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 75 | void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 76 | { |
| 77 | ctx->key = key; |
| 78 | } |
| 79 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 80 | int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx, |
Paul Bakker | 50dc850 | 2013-10-28 21:19:10 +0100 | [diff] [blame] | 81 | const char *subject_name ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 82 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 83 | return mbedtls_x509_string_to_names( &ctx->subject, subject_name ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 84 | } |
| 85 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 86 | int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 87 | const char *oid, size_t oid_len, |
| 88 | const unsigned char *val, size_t val_len ) |
| 89 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 90 | return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 91 | 0, val, val_len ); |
| 92 | } |
| 93 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 94 | int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 95 | { |
| 96 | unsigned char buf[4]; |
| 97 | unsigned char *c; |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 98 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 99 | |
| 100 | c = buf + 4; |
| 101 | |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 102 | ret = mbedtls_asn1_write_named_bitstring( &c, buf, &key_usage, 8 ); |
| 103 | if( ret < 3 || ret > 4 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 104 | return( ret ); |
| 105 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 106 | ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE, |
| 107 | MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ), |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 108 | c, (size_t)ret ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 109 | if( ret != 0 ) |
| 110 | return( ret ); |
| 111 | |
| 112 | return( 0 ); |
| 113 | } |
| 114 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 115 | int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 116 | unsigned char ns_cert_type ) |
| 117 | { |
| 118 | unsigned char buf[4]; |
| 119 | unsigned char *c; |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 120 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 121 | |
| 122 | c = buf + 4; |
| 123 | |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 124 | ret = mbedtls_asn1_write_named_bitstring( &c, buf, &ns_cert_type, 8 ); |
| 125 | if( ret < 3 || ret > 4 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 126 | return( ret ); |
| 127 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 128 | ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE, |
| 129 | MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ), |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 130 | c, (size_t)ret ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 131 | if( ret != 0 ) |
| 132 | return( ret ); |
| 133 | |
| 134 | return( 0 ); |
| 135 | } |
| 136 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 137 | static int x509write_csr_der_internal( mbedtls_x509write_csr *ctx, |
| 138 | unsigned char *buf, |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 139 | size_t size, |
| 140 | unsigned char *sig, |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 141 | int (*f_rng)(void *, unsigned char *, size_t), |
| 142 | void *p_rng ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 143 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 144 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 145 | const char *sig_oid; |
| 146 | size_t sig_oid_len = 0; |
| 147 | unsigned char *c, *c2; |
| 148 | unsigned char hash[64]; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 149 | size_t pub_len = 0, sig_and_oid_len = 0, sig_len; |
| 150 | size_t len = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 151 | mbedtls_pk_type_t pk_alg; |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 152 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Jaeden Amero | 3497323 | 2019-02-20 10:32:28 +0000 | [diff] [blame] | 153 | psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT; |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 154 | size_t hash_len; |
| 155 | psa_algorithm_t hash_alg = mbedtls_psa_translate_md( ctx->md_alg ); |
| 156 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 157 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 158 | /* Write the CSR backwards starting from the end of buf */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 159 | c = buf + size; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 160 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 161 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, buf, |
| 162 | ctx->extensions ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 163 | |
| 164 | if( len ) |
| 165 | { |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 166 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 167 | MBEDTLS_ASN1_CHK_ADD( len, |
| 168 | mbedtls_asn1_write_tag( |
| 169 | &c, buf, |
| 170 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 171 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 172 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 173 | MBEDTLS_ASN1_CHK_ADD( len, |
| 174 | mbedtls_asn1_write_tag( |
| 175 | &c, buf, |
| 176 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 177 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 178 | MBEDTLS_ASN1_CHK_ADD( len, |
| 179 | mbedtls_asn1_write_oid( |
| 180 | &c, buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ, |
| 181 | MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 182 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 183 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 184 | MBEDTLS_ASN1_CHK_ADD( len, |
| 185 | mbedtls_asn1_write_tag( |
| 186 | &c, buf, |
| 187 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 188 | } |
| 189 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 190 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 191 | MBEDTLS_ASN1_CHK_ADD( len, |
| 192 | mbedtls_asn1_write_tag( |
| 193 | &c, buf, |
| 194 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 195 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 196 | MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key, |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 197 | buf, c - buf ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 198 | c -= pub_len; |
| 199 | len += pub_len; |
| 200 | |
| 201 | /* |
| 202 | * Subject ::= Name |
| 203 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 204 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, buf, |
| 205 | ctx->subject ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 206 | |
| 207 | /* |
| 208 | * Version ::= INTEGER { v1(0), v2(1), v3(2) } |
| 209 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 210 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, buf, 0 ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 211 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 212 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 213 | MBEDTLS_ASN1_CHK_ADD( len, |
| 214 | mbedtls_asn1_write_tag( |
| 215 | &c, buf, |
| 216 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 217 | |
| 218 | /* |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 219 | * Sign the written CSR data into the sig buffer |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 220 | * Note: hash errors can happen only after an internal error |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 221 | */ |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 222 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 223 | if( psa_hash_setup( &hash_operation, hash_alg ) != PSA_SUCCESS ) |
| 224 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 225 | |
Andrzej Kurek | a609337 | 2018-11-19 13:57:58 -0500 | [diff] [blame] | 226 | if( psa_hash_update( &hash_operation, c, len ) != PSA_SUCCESS ) |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 227 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
Andrzej Kurek | a609337 | 2018-11-19 13:57:58 -0500 | [diff] [blame] | 228 | |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 229 | if( psa_hash_finish( &hash_operation, hash, sizeof( hash ), &hash_len ) |
| 230 | != PSA_SUCCESS ) |
| 231 | { |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 232 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
| 233 | } |
| 234 | #else /* MBEDTLS_USE_PSA_CRYPTO */ |
Gilles Peskine | b08e44f | 2020-01-21 16:56:03 +0100 | [diff] [blame] | 235 | ret = mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash ); |
| 236 | if( ret != 0 ) |
| 237 | return( ret ); |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 238 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 239 | if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len, |
Hanno Becker | fc77144 | 2017-09-13 08:45:48 +0100 | [diff] [blame] | 240 | f_rng, p_rng ) ) != 0 ) |
| 241 | { |
| 242 | return( ret ); |
| 243 | } |
| 244 | |
| 245 | if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) ) |
| 246 | pk_alg = MBEDTLS_PK_RSA; |
| 247 | else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) ) |
| 248 | pk_alg = MBEDTLS_PK_ECDSA; |
| 249 | else |
Hanno Becker | d8a6f7c | 2017-09-22 16:05:43 +0100 | [diff] [blame] | 250 | return( MBEDTLS_ERR_X509_INVALID_ALG ); |
Hanno Becker | fc77144 | 2017-09-13 08:45:48 +0100 | [diff] [blame] | 251 | |
| 252 | if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg, |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 253 | &sig_oid, &sig_oid_len ) ) != 0 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 254 | { |
| 255 | return( ret ); |
| 256 | } |
| 257 | |
| 258 | /* |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 259 | * Move the written CSR data to the start of buf to create space for |
| 260 | * writing the signature into buf. |
| 261 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 262 | memmove( buf, c, len ); |
| 263 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 264 | /* |
| 265 | * Write sig and its OID into buf backwards from the end of buf. |
| 266 | * Note: mbedtls_x509_write_sig will check for c2 - ( buf + len ) < sig_len |
| 267 | * and return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if needed. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 268 | */ |
| 269 | c2 = buf + size; |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 270 | MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, |
| 271 | mbedtls_x509_write_sig( &c2, buf + len, sig_oid, sig_oid_len, |
| 272 | sig, sig_len ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 273 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 274 | /* |
| 275 | * Compact the space between the CSR data and signature by moving the |
| 276 | * CSR data to the start of the signature. |
| 277 | */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 278 | c2 -= len; |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 279 | memmove( c2, buf, len ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 280 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 281 | /* ASN encode the total size and tag the CSR data with it. */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 282 | len += sig_and_oid_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 283 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) ); |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 284 | MBEDTLS_ASN1_CHK_ADD( len, |
| 285 | mbedtls_asn1_write_tag( |
| 286 | &c2, buf, |
| 287 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
| 288 | |
| 289 | /* Zero the unused bytes at the start of buf */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 290 | memset( buf, 0, c2 - buf); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 291 | |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 292 | return( (int) len ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 293 | } |
| 294 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 295 | int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, |
| 296 | size_t size, |
| 297 | int (*f_rng)(void *, unsigned char *, size_t), |
| 298 | void *p_rng ) |
| 299 | { |
| 300 | int ret; |
| 301 | unsigned char *sig; |
| 302 | |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 303 | if( ( sig = mbedtls_calloc( 1, MBEDTLS_PK_SIGNATURE_MAX_SIZE ) ) == NULL ) |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 304 | { |
Simon Leet | 40ca54a | 2020-06-26 21:23:32 +0000 | [diff] [blame] | 305 | return( MBEDTLS_ERR_X509_ALLOC_FAILED ); |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame] | 306 | } |
| 307 | |
| 308 | ret = x509write_csr_der_internal( ctx, buf, size, sig, f_rng, p_rng ); |
| 309 | |
| 310 | mbedtls_free( sig ); |
| 311 | |
| 312 | return( ret ); |
| 313 | } |
| 314 | |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 315 | #define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n" |
| 316 | #define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n" |
| 317 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 318 | #if defined(MBEDTLS_PEM_WRITE_C) |
| 319 | int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 320 | int (*f_rng)(void *, unsigned char *, size_t), |
| 321 | void *p_rng ) |
| 322 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 323 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 324 | size_t olen = 0; |
| 325 | |
Jaeden Amero | 6ffac75 | 2019-10-18 16:02:07 +0100 | [diff] [blame] | 326 | if( ( ret = mbedtls_x509write_csr_der( ctx, buf, size, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 327 | f_rng, p_rng ) ) < 0 ) |
| 328 | { |
| 329 | return( ret ); |
| 330 | } |
| 331 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 332 | if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR, |
Jaeden Amero | 6ffac75 | 2019-10-18 16:02:07 +0100 | [diff] [blame] | 333 | buf + size - ret, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 334 | ret, buf, size, &olen ) ) != 0 ) |
| 335 | { |
| 336 | return( ret ); |
| 337 | } |
| 338 | |
| 339 | return( 0 ); |
| 340 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 341 | #endif /* MBEDTLS_PEM_WRITE_C */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 342 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 343 | #endif /* MBEDTLS_X509_CSR_WRITE_C */ |