Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 1 | /* |
| 2 | * X.509 Certificate Signing Request writing |
| 3 | * |
Manuel Pégourié-Gonnard | 6fb8187 | 2015-07-27 11:11:48 +0200 | [diff] [blame] | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 18 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 20 | */ |
| 21 | /* |
| 22 | * References: |
| 23 | * - CSRs: PKCS#10 v1.7 aka RFC 2986 |
| 24 | * - attributes: PKCS#9 v2.0 aka RFC 2985 |
| 25 | */ |
| 26 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 27 | #if !defined(MBEDTLS_CONFIG_FILE) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 28 | #include "mbedtls/config.h" |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 29 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 30 | #include MBEDTLS_CONFIG_FILE |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 31 | #endif |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 32 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 33 | #if defined(MBEDTLS_X509_CSR_WRITE_C) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 34 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 35 | #include "mbedtls/x509_csr.h" |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 36 | #include "mbedtls/asn1write.h" |
Janos Follath | 73c616b | 2019-12-18 15:07:04 +0000 | [diff] [blame] | 37 | #include "mbedtls/error.h" |
| 38 | #include "mbedtls/oid.h" |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 39 | #include "mbedtls/platform_util.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 40 | |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 41 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 42 | #include "psa/crypto.h" |
| 43 | #include "mbedtls/psa_util.h" |
| 44 | #endif |
| 45 | |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 46 | #include <string.h> |
| 47 | #include <stdlib.h> |
| 48 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 49 | #if defined(MBEDTLS_PEM_WRITE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 50 | #include "mbedtls/pem.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 51 | #endif |
| 52 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 53 | #if defined(MBEDTLS_PLATFORM_C) |
| 54 | #include "mbedtls/platform.h" |
| 55 | #else |
| 56 | #include <stdlib.h> |
| 57 | #define mbedtls_calloc calloc |
| 58 | #define mbedtls_free free |
| 59 | #endif |
| 60 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 61 | void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 62 | { |
Hanno Becker | 81535d0 | 2017-09-13 15:39:59 +0100 | [diff] [blame] | 63 | memset( ctx, 0, sizeof( mbedtls_x509write_csr ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 64 | } |
| 65 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 66 | void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 67 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 68 | mbedtls_asn1_free_named_data_list( &ctx->subject ); |
| 69 | mbedtls_asn1_free_named_data_list( &ctx->extensions ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 70 | |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 71 | mbedtls_platform_zeroize( ctx, sizeof( mbedtls_x509write_csr ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 72 | } |
| 73 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 74 | void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 75 | { |
| 76 | ctx->md_alg = md_alg; |
| 77 | } |
| 78 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 79 | void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 80 | { |
| 81 | ctx->key = key; |
| 82 | } |
| 83 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 84 | int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx, |
Paul Bakker | 50dc850 | 2013-10-28 21:19:10 +0100 | [diff] [blame] | 85 | const char *subject_name ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 86 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 87 | return mbedtls_x509_string_to_names( &ctx->subject, subject_name ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 88 | } |
| 89 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 90 | int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 91 | const char *oid, size_t oid_len, |
| 92 | const unsigned char *val, size_t val_len ) |
| 93 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 94 | return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 95 | 0, val, val_len ); |
| 96 | } |
| 97 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 98 | int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 99 | { |
| 100 | unsigned char buf[4]; |
| 101 | unsigned char *c; |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 102 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 103 | |
| 104 | c = buf + 4; |
| 105 | |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 106 | ret = mbedtls_asn1_write_named_bitstring( &c, buf, &key_usage, 8 ); |
| 107 | if( ret < 3 || ret > 4 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 108 | return( ret ); |
| 109 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 110 | ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE, |
| 111 | MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ), |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 112 | c, (size_t)ret ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 113 | if( ret != 0 ) |
| 114 | return( ret ); |
| 115 | |
| 116 | return( 0 ); |
| 117 | } |
| 118 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 119 | int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 120 | unsigned char ns_cert_type ) |
| 121 | { |
| 122 | unsigned char buf[4]; |
| 123 | unsigned char *c; |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 124 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 125 | |
| 126 | c = buf + 4; |
| 127 | |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 128 | ret = mbedtls_asn1_write_named_bitstring( &c, buf, &ns_cert_type, 8 ); |
| 129 | if( ret < 3 || ret > 4 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 130 | return( ret ); |
| 131 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 132 | ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE, |
| 133 | MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ), |
Andres Amaya Garcia | 6e95914 | 2018-09-26 10:48:24 +0100 | [diff] [blame] | 134 | c, (size_t)ret ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 135 | if( ret != 0 ) |
| 136 | return( ret ); |
| 137 | |
| 138 | return( 0 ); |
| 139 | } |
| 140 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 141 | static int x509write_csr_der_internal( mbedtls_x509write_csr *ctx, |
| 142 | unsigned char *buf, |
| 143 | size_t size, unsigned char *sig, |
| 144 | int (*f_rng)(void *, unsigned char *, size_t), |
| 145 | void *p_rng ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 146 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 147 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 148 | const char *sig_oid; |
| 149 | size_t sig_oid_len = 0; |
| 150 | unsigned char *c, *c2; |
| 151 | unsigned char hash[64]; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 152 | size_t pub_len = 0, sig_and_oid_len = 0, sig_len; |
| 153 | size_t len = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 154 | mbedtls_pk_type_t pk_alg; |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 155 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Jaeden Amero | 3497323 | 2019-02-20 10:32:28 +0000 | [diff] [blame] | 156 | psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT; |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 157 | size_t hash_len; |
| 158 | psa_algorithm_t hash_alg = mbedtls_psa_translate_md( ctx->md_alg ); |
| 159 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 160 | /* |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 161 | * Writing strategy: |
| 162 | * 1. start writing from the back of buf |
| 163 | * 2. sign the written data and place the signature at the start of buf |
| 164 | * 3. compact memory locations by moving the signature towards right |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 165 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 166 | c = buf + size; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 167 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 168 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, buf, |
| 169 | ctx->extensions ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 170 | |
| 171 | if( len ) |
| 172 | { |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 173 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
| 174 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, |
| 175 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 176 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 177 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
| 178 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, |
| 179 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 180 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 181 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, buf, |
| 182 | MBEDTLS_OID_PKCS9_CSR_EXT_REQ, |
| 183 | MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 184 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 185 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
| 186 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, |
| 187 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 188 | } |
| 189 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 190 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
| 191 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, |
| 192 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 193 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 194 | MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key, |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 195 | buf, c - buf ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 196 | c -= pub_len; |
| 197 | len += pub_len; |
| 198 | |
| 199 | /* |
| 200 | * Subject ::= Name |
| 201 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 202 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, buf, |
| 203 | ctx->subject ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 204 | |
| 205 | /* |
| 206 | * Version ::= INTEGER { v1(0), v2(1), v3(2) } |
| 207 | */ |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 208 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, buf, 0 ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 209 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 210 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); |
| 211 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, |
| 212 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 213 | |
| 214 | /* |
| 215 | * Prepare signature |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 216 | * Note: hash errors can happen only after an internal error |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 217 | */ |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 218 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 219 | if( psa_hash_setup( &hash_operation, hash_alg ) != PSA_SUCCESS ) |
| 220 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 221 | |
Andrzej Kurek | a609337 | 2018-11-19 13:57:58 -0500 | [diff] [blame] | 222 | if( psa_hash_update( &hash_operation, c, len ) != PSA_SUCCESS ) |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 223 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
Andrzej Kurek | a609337 | 2018-11-19 13:57:58 -0500 | [diff] [blame] | 224 | |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 225 | if( psa_hash_finish( &hash_operation, hash, sizeof( hash ), &hash_len ) |
| 226 | != PSA_SUCCESS ) |
| 227 | { |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 228 | return( MBEDTLS_ERR_X509_FATAL_ERROR ); |
| 229 | } |
| 230 | #else /* MBEDTLS_USE_PSA_CRYPTO */ |
Gilles Peskine | b08e44f | 2020-01-21 16:56:03 +0100 | [diff] [blame] | 231 | ret = mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash ); |
| 232 | if( ret != 0 ) |
| 233 | return( ret ); |
Andrzej Kurek | d4a6553 | 2018-10-31 06:18:39 -0400 | [diff] [blame] | 234 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 235 | if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len, |
Hanno Becker | fc77144 | 2017-09-13 08:45:48 +0100 | [diff] [blame] | 236 | f_rng, p_rng ) ) != 0 ) |
| 237 | { |
| 238 | return( ret ); |
| 239 | } |
| 240 | |
| 241 | if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) ) |
| 242 | pk_alg = MBEDTLS_PK_RSA; |
| 243 | else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) ) |
| 244 | pk_alg = MBEDTLS_PK_ECDSA; |
| 245 | else |
Hanno Becker | d8a6f7c | 2017-09-22 16:05:43 +0100 | [diff] [blame] | 246 | return( MBEDTLS_ERR_X509_INVALID_ALG ); |
Hanno Becker | fc77144 | 2017-09-13 08:45:48 +0100 | [diff] [blame] | 247 | |
| 248 | if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg, |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 249 | &sig_oid, &sig_oid_len ) ) != 0 ) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 250 | { |
| 251 | return( ret ); |
| 252 | } |
| 253 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 254 | /* reserve space for the signature at the end of buf */ |
| 255 | memmove( buf, c, len ); |
| 256 | |
| 257 | /* copy the signature */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 258 | c2 = buf + size; |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 259 | MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, |
| 260 | buf + len, sig_oid, sig_oid_len, sig, sig_len ) ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 261 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 262 | /* compact oids and signature memory locations */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 263 | c2 -= len; |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 264 | memmove( c2, buf, len ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 265 | |
| 266 | len += sig_and_oid_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 267 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) ); |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 268 | MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, |
| 269 | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); |
| 270 | memset( buf, 0, c2 - buf); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 271 | |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 272 | return( (int) len ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 273 | } |
| 274 | |
Doru Gucea | 2957b35 | 2018-12-14 21:08:35 +0200 | [diff] [blame^] | 275 | int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, |
| 276 | size_t size, |
| 277 | int (*f_rng)(void *, unsigned char *, size_t), |
| 278 | void *p_rng ) |
| 279 | { |
| 280 | int ret; |
| 281 | unsigned char *sig; |
| 282 | |
| 283 | if( ( sig = mbedtls_calloc( 1, MBEDTLS_MPI_MAX_SIZE ) ) == NULL ) |
| 284 | { |
| 285 | return( MBEDTLS_ERR_ASN1_ALLOC_FAILED ); |
| 286 | } |
| 287 | |
| 288 | ret = x509write_csr_der_internal( ctx, buf, size, sig, f_rng, p_rng ); |
| 289 | |
| 290 | mbedtls_free( sig ); |
| 291 | |
| 292 | return( ret ); |
| 293 | } |
| 294 | |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 295 | #define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n" |
| 296 | #define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n" |
| 297 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 298 | #if defined(MBEDTLS_PEM_WRITE_C) |
| 299 | int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 300 | int (*f_rng)(void *, unsigned char *, size_t), |
| 301 | void *p_rng ) |
| 302 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 303 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 304 | size_t olen = 0; |
| 305 | |
Jaeden Amero | 6ffac75 | 2019-10-18 16:02:07 +0100 | [diff] [blame] | 306 | if( ( ret = mbedtls_x509write_csr_der( ctx, buf, size, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 307 | f_rng, p_rng ) ) < 0 ) |
| 308 | { |
| 309 | return( ret ); |
| 310 | } |
| 311 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 312 | if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR, |
Jaeden Amero | 6ffac75 | 2019-10-18 16:02:07 +0100 | [diff] [blame] | 313 | buf + size - ret, |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 314 | ret, buf, size, &olen ) ) != 0 ) |
| 315 | { |
| 316 | return( ret ); |
| 317 | } |
| 318 | |
| 319 | return( 0 ); |
| 320 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 321 | #endif /* MBEDTLS_PEM_WRITE_C */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 322 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 323 | #endif /* MBEDTLS_X509_CSR_WRITE_C */ |