blob: d70ba0ed9277d06d49e310cdde99a2f63bbca9e3 [file] [log] [blame]
Paul Bakker7c6b2c32013-09-16 13:49:26 +02001/*
2 * X.509 Certificate Signing Request writing
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker7c6b2c32013-09-16 13:49:26 +020018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020020 */
21/*
22 * References:
23 * - CSRs: PKCS#10 v1.7 aka RFC 2986
24 * - attributes: PKCS#9 v2.0 aka RFC 2985
25 */
26
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020027#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000028#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020029#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020031#endif
Paul Bakker7c6b2c32013-09-16 13:49:26 +020032
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#if defined(MBEDTLS_X509_CSR_WRITE_C)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020034
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000035#include "mbedtls/x509_csr.h"
36#include "mbedtls/oid.h"
37#include "mbedtls/asn1write.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050038#include "mbedtls/platform_util.h"
Paul Bakker7c6b2c32013-09-16 13:49:26 +020039
Rich Evans00ab4702015-02-06 13:43:58 +000040#include <string.h>
41#include <stdlib.h>
42
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043#if defined(MBEDTLS_PEM_WRITE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000044#include "mbedtls/pem.h"
Paul Bakker7c6b2c32013-09-16 13:49:26 +020045#endif
46
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020047void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020048{
Hanno Becker81535d02017-09-13 15:39:59 +010049 memset( ctx, 0, sizeof( mbedtls_x509write_csr ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +020050}
51
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020053{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020054 mbedtls_asn1_free_named_data_list( &ctx->subject );
55 mbedtls_asn1_free_named_data_list( &ctx->extensions );
Paul Bakker7c6b2c32013-09-16 13:49:26 +020056
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050057 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_x509write_csr ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +020058}
59
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020061{
62 ctx->md_alg = md_alg;
63}
64
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020065void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020066{
67 ctx->key = key;
68}
69
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020070int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx,
Paul Bakker50dc8502013-10-28 21:19:10 +010071 const char *subject_name )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020072{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073 return mbedtls_x509_string_to_names( &ctx->subject, subject_name );
Paul Bakker7c6b2c32013-09-16 13:49:26 +020074}
75
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020076int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx,
Paul Bakker7c6b2c32013-09-16 13:49:26 +020077 const char *oid, size_t oid_len,
78 const unsigned char *val, size_t val_len )
79{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020080 return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len,
Paul Bakker7c6b2c32013-09-16 13:49:26 +020081 0, val, val_len );
82}
83
Andres Amaya Garciad60e3782018-09-26 10:48:24 +010084static size_t csr_get_unused_bits_for_named_bitstring( unsigned char bitstring,
85 size_t bit_offset )
86{
87 size_t unused_bits;
88
89 /* Count the unused bits removing trailing 0s */
90 for( unused_bits = bit_offset; unused_bits < 8; unused_bits++ )
91 if( ( ( bitstring >> unused_bits ) & 0x1 ) != 0 )
92 break;
93
94 return( unused_bits );
95}
96
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020097int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage )
Paul Bakker7c6b2c32013-09-16 13:49:26 +020098{
99 unsigned char buf[4];
100 unsigned char *c;
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100101 size_t unused_bits;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200102 int ret;
103
104 c = buf + 4;
105
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100106 unused_bits = csr_get_unused_bits_for_named_bitstring( key_usage, 0 );
107 ret = mbedtls_asn1_write_bitstring( &c, buf, &key_usage, 8 - unused_bits );
108
109 if( ret < 0 )
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200110 return( ret );
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100111 else if( ret < 3 || ret > 4 )
112 return( MBEDTLS_ERR_X509_INVALID_FORMAT );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200114 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
115 MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100116 c, (size_t)ret );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200117 if( ret != 0 )
118 return( ret );
119
120 return( 0 );
121}
122
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200123int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200124 unsigned char ns_cert_type )
125{
126 unsigned char buf[4];
127 unsigned char *c;
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100128 size_t unused_bits;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200129 int ret;
130
131 c = buf + 4;
132
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100133 unused_bits = csr_get_unused_bits_for_named_bitstring( ns_cert_type, 0 );
134 ret = mbedtls_asn1_write_bitstring( &c,
135 buf,
136 &ns_cert_type,
137 8 - unused_bits );
138
139 if( ret < 0 )
140 return( ret );
141 else if( ret < 3 || ret > 4 )
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200142 return( ret );
143
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200144 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
145 MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
Andres Amaya Garciad60e3782018-09-26 10:48:24 +0100146 c, (size_t)ret );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200147 if( ret != 0 )
148 return( ret );
149
150 return( 0 );
151}
152
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200153int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200154 int (*f_rng)(void *, unsigned char *, size_t),
155 void *p_rng )
156{
157 int ret;
158 const char *sig_oid;
159 size_t sig_oid_len = 0;
160 unsigned char *c, *c2;
161 unsigned char hash[64];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200163 unsigned char tmp_buf[2048];
164 size_t pub_len = 0, sig_and_oid_len = 0, sig_len;
165 size_t len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200166 mbedtls_pk_type_t pk_alg;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200167
168 /*
169 * Prepare data to be signed in tmp_buf
170 */
171 c = tmp_buf + sizeof( tmp_buf );
172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200173 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200174
175 if( len )
176 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200177 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
178 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
179 MBEDTLS_ASN1_SEQUENCE ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200180
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200181 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
182 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
183 MBEDTLS_ASN1_SET ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200185 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, tmp_buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
186 MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
189 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
190 MBEDTLS_ASN1_SEQUENCE ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200191 }
192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200193 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
194 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
195 MBEDTLS_ASN1_CONTEXT_SPECIFIC ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200197 MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200198 tmp_buf, c - tmp_buf ) );
199 c -= pub_len;
200 len += pub_len;
201
202 /*
203 * Subject ::= Name
204 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200205 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, tmp_buf, ctx->subject ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200206
207 /*
208 * Version ::= INTEGER { v1(0), v2(1), v3(2) }
209 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200210 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, tmp_buf, 0 ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200212 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
213 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
214 MBEDTLS_ASN1_SEQUENCE ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200215
216 /*
217 * Prepare signature
218 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200219 mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200221 if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
Hanno Beckerfc771442017-09-13 08:45:48 +0100222 f_rng, p_rng ) ) != 0 )
223 {
224 return( ret );
225 }
226
227 if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) )
228 pk_alg = MBEDTLS_PK_RSA;
229 else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) )
230 pk_alg = MBEDTLS_PK_ECDSA;
231 else
Hanno Beckerd8a6f7c2017-09-22 16:05:43 +0100232 return( MBEDTLS_ERR_X509_INVALID_ALG );
Hanno Beckerfc771442017-09-13 08:45:48 +0100233
234 if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
235 &sig_oid, &sig_oid_len ) ) != 0 )
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200236 {
237 return( ret );
238 }
239
240 /*
241 * Write data to output buffer
242 */
243 c2 = buf + size;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244 MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, buf,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200245 sig_oid, sig_oid_len, sig, sig_len ) );
246
Andres AG60dbc932016-09-02 15:23:48 +0100247 if( len > (size_t)( c2 - buf ) )
248 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
249
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200250 c2 -= len;
251 memcpy( c2, c, len );
252
253 len += sig_and_oid_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200254 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) );
255 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, MBEDTLS_ASN1_CONSTRUCTED |
256 MBEDTLS_ASN1_SEQUENCE ) );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200257
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200258 return( (int) len );
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200259}
260
261#define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n"
262#define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n"
263
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200264#if defined(MBEDTLS_PEM_WRITE_C)
265int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200266 int (*f_rng)(void *, unsigned char *, size_t),
267 void *p_rng )
268{
269 int ret;
270 unsigned char output_buf[4096];
271 size_t olen = 0;
272
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273 if( ( ret = mbedtls_x509write_csr_der( ctx, output_buf, sizeof(output_buf),
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200274 f_rng, p_rng ) ) < 0 )
275 {
276 return( ret );
277 }
278
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200279 if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200280 output_buf + sizeof(output_buf) - ret,
281 ret, buf, size, &olen ) ) != 0 )
282 {
283 return( ret );
284 }
285
286 return( 0 );
287}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200288#endif /* MBEDTLS_PEM_WRITE_C */
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200289
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200290#endif /* MBEDTLS_X509_CSR_WRITE_C */