blob: 9fc0e55dffef2a6cde547f82e640625e554da86b [file] [log] [blame]
Paul Bakker33b43f12013-08-20 11:48:36 +02001/* BEGIN_HEADER */
Azim Khand30ca132017-06-09 04:32:58 +01002#include "mbedtls/bignum.h"
Andres AG4b76aec2016-09-23 13:16:02 +01003#include "mbedtls/x509.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00004#include "mbedtls/x509_crt.h"
5#include "mbedtls/x509_crl.h"
6#include "mbedtls/x509_csr.h"
Valerio Setti25b282e2024-01-17 10:55:32 +01007#include "x509_internal.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00008#include "mbedtls/pem.h"
9#include "mbedtls/oid.h"
10#include "mbedtls/base64.h"
Chris Jones9f7a6932021-04-14 12:12:09 +010011#include "mbedtls/error.h"
Valerio Setti178b5bd2023-02-13 10:04:28 +010012#include "mbedtls/pk.h"
Mohammad Azim Khan67735d52017-04-06 11:55:43 +010013#include "string.h"
Paul Bakkerb63b0af2011-01-13 17:54:59 +000014
Simon Butcher9e24b512017-07-28 12:15:13 +010015#if MBEDTLS_X509_MAX_INTERMEDIATE_CA > 19
Hanno Becker3b1422e2017-07-26 13:38:02 +010016#error "The value of MBEDTLS_X509_MAX_INTERMEDIATE_C is larger \
Gilles Peskine449bd832023-01-11 14:50:10 +010017 than the current threshold 19. To test larger values, please \
David Horstmann441b66c2024-07-01 16:39:39 +010018 adapt the script framework/data_files/dir-max/long.sh."
Hanno Becker3b1422e2017-07-26 13:38:02 +010019#endif
20
Hanno Becker20a4ade2019-06-03 14:27:03 +010021/* Test-only profile allowing all digests, PK algorithms, and curves. */
22const mbedtls_x509_crt_profile profile_all =
23{
24 0xFFFFFFFF, /* Any MD */
25 0xFFFFFFFF, /* Any PK alg */
26 0xFFFFFFFF, /* Any curve */
27 1024,
28};
29
Gilles Peskineef86ab22017-05-05 18:59:02 +020030/* Profile for backward compatibility. Allows SHA-1, unlike the default
31 profile. */
Manuel Pégourié-Gonnard65eefc82015-10-23 14:08:48 +020032const mbedtls_x509_crt_profile compat_profile =
33{
Gilles Peskine449bd832023-01-11 14:50:10 +010034 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
35 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_RIPEMD160) |
36 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) |
37 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
38 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
39 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
Thomas Daubney28015e12022-04-21 08:12:59 +010040 0xFFFFFFFF, /* Any PK alg */
41 0xFFFFFFFF, /* Any curve */
Manuel Pégourié-Gonnard65eefc82015-10-23 14:08:48 +020042 1024,
43};
44
Manuel Pégourié-Gonnard6622fed2017-05-23 11:29:29 +020045const mbedtls_x509_crt_profile profile_rsa3072 =
46{
Gilles Peskine449bd832023-01-11 14:50:10 +010047 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
48 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
49 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
50 MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_RSA),
Manuel Pégourié-Gonnard6622fed2017-05-23 11:29:29 +020051 0,
52 3072,
53};
54
55const mbedtls_x509_crt_profile profile_sha512 =
56{
Gilles Peskine449bd832023-01-11 14:50:10 +010057 MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
Thomas Daubney28015e12022-04-21 08:12:59 +010058 0xFFFFFFFF, /* Any PK alg */
59 0xFFFFFFFF, /* Any curve */
Manuel Pégourié-Gonnard6622fed2017-05-23 11:29:29 +020060 1024,
61};
62
Michael Schustera3cc4632024-06-07 01:51:54 +020063#if defined(MBEDTLS_X509_CRT_PARSE_C)
64
65#if defined(MBEDTLS_FS_IO)
Michael Schuster54300d42024-06-04 02:30:22 +020066static int verify_none(void *data, mbedtls_x509_crt *crt, int certificate_depth, uint32_t *flags)
Paul Bakkerb63b0af2011-01-13 17:54:59 +000067{
Paul Bakker5a624082011-01-18 16:31:52 +000068 ((void) data);
69 ((void) crt);
70 ((void) certificate_depth);
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010071 *flags |= MBEDTLS_X509_BADCERT_OTHER;
Paul Bakkerddf26b42013-09-18 13:46:23 +020072
Paul Bakker915275b2012-09-28 07:10:55 +000073 return 0;
Paul Bakkerb63b0af2011-01-13 17:54:59 +000074}
75
Michael Schuster54300d42024-06-04 02:30:22 +020076static int verify_all(void *data, mbedtls_x509_crt *crt, int certificate_depth, uint32_t *flags)
Paul Bakkerb63b0af2011-01-13 17:54:59 +000077{
Paul Bakker5a624082011-01-18 16:31:52 +000078 ((void) data);
79 ((void) crt);
80 ((void) certificate_depth);
Paul Bakker915275b2012-09-28 07:10:55 +000081 *flags = 0;
Paul Bakker5a624082011-01-18 16:31:52 +000082
Paul Bakkerb63b0af2011-01-13 17:54:59 +000083 return 0;
84}
85
Michael Schustera3cc4632024-06-07 01:51:54 +020086#if defined(MBEDTLS_X509_CRL_PARSE_C) && \
87 defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Michael Schusterf828f042024-06-07 06:47:31 +020088static int ca_callback_fail(void *data, mbedtls_x509_crt const *child,
89 mbedtls_x509_crt **candidates)
Jarno Lamsa557426a2019-03-27 17:08:29 +020090{
91 ((void) data);
92 ((void) child);
93 ((void) candidates);
94
95 return -1;
96}
Michael Schustera3cc4632024-06-07 01:51:54 +020097
Michael Schuster54300d42024-06-04 02:30:22 +020098static int ca_callback(void *data, mbedtls_x509_crt const *child,
Michael Schusterbd89b792024-06-04 02:41:10 +020099 mbedtls_x509_crt **candidates)
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200100{
Hanno Beckercbb59032019-03-28 14:14:22 +0000101 int ret = 0;
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200102 mbedtls_x509_crt *ca = (mbedtls_x509_crt *) data;
Hanno Beckercbb59032019-03-28 14:14:22 +0000103 mbedtls_x509_crt *first;
104
105 /* This is a test-only implementation of the CA callback
106 * which always returns the entire list of trusted certificates.
107 * Production implementations managing a large number of CAs
108 * should use an efficient presentation and lookup for the
109 * set of trusted certificates (such as a hashtable) and only
110 * return those trusted certificates which satisfy basic
111 * parental checks, such as the matching of child `Issuer`
112 * and parent `Subject` field. */
113 ((void) child);
114
Gilles Peskine449bd832023-01-11 14:50:10 +0100115 first = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
116 if (first == NULL) {
Hanno Beckercbb59032019-03-28 14:14:22 +0000117 ret = -1;
118 goto exit;
119 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100120 mbedtls_x509_crt_init(first);
Hanno Beckercbb59032019-03-28 14:14:22 +0000121
Gilles Peskine449bd832023-01-11 14:50:10 +0100122 if (mbedtls_x509_crt_parse_der(first, ca->raw.p, ca->raw.len) != 0) {
Hanno Beckercbb59032019-03-28 14:14:22 +0000123 ret = -1;
124 goto exit;
125 }
126
Gilles Peskine449bd832023-01-11 14:50:10 +0100127 while (ca->next != NULL) {
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200128 ca = ca->next;
Gilles Peskine449bd832023-01-11 14:50:10 +0100129 if (mbedtls_x509_crt_parse_der(first, ca->raw.p, ca->raw.len) != 0) {
Hanno Beckercbb59032019-03-28 14:14:22 +0000130 ret = -1;
131 goto exit;
132 }
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200133 }
Hanno Beckercbb59032019-03-28 14:14:22 +0000134
135exit:
136
Gilles Peskine449bd832023-01-11 14:50:10 +0100137 if (ret != 0) {
138 mbedtls_x509_crt_free(first);
139 mbedtls_free(first);
Hanno Beckercbb59032019-03-28 14:14:22 +0000140 first = NULL;
141 }
142
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200143 *candidates = first;
Gilles Peskine449bd832023-01-11 14:50:10 +0100144 return ret;
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200145}
Michael Schustera3cc4632024-06-07 01:51:54 +0200146#endif /* MBEDTLS_X509_CRL_PARSE_C && MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200147
Michael Schuster54300d42024-06-04 02:30:22 +0200148static int verify_fatal(void *data, mbedtls_x509_crt *crt, int certificate_depth, uint32_t *flags)
Manuel Pégourié-Gonnard6b9d53f2017-05-23 12:26:58 +0200149{
150 int *levels = (int *) data;
151
152 ((void) crt);
153 ((void) certificate_depth);
154
155 /* Simulate a fatal error in the callback */
Gilles Peskine449bd832023-01-11 14:50:10 +0100156 if (*levels & (1 << certificate_depth)) {
157 *flags |= (1 << certificate_depth);
158 return -1 - certificate_depth;
Manuel Pégourié-Gonnard6b9d53f2017-05-23 12:26:58 +0200159 }
160
Gilles Peskine449bd832023-01-11 14:50:10 +0100161 return 0;
Manuel Pégourié-Gonnard6b9d53f2017-05-23 12:26:58 +0200162}
163
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900164/* strsep() not available on Windows */
Michael Schuster54300d42024-06-04 02:30:22 +0200165static char *mystrsep(char **stringp, const char *delim)
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900166{
167 const char *p;
168 char *ret = *stringp;
169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 if (*stringp == NULL) {
171 return NULL;
172 }
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900173
Gilles Peskine449bd832023-01-11 14:50:10 +0100174 for (;; (*stringp)++) {
175 if (**stringp == '\0') {
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900176 *stringp = NULL;
177 goto done;
178 }
179
Gilles Peskine449bd832023-01-11 14:50:10 +0100180 for (p = delim; *p != '\0'; p++) {
181 if (**stringp == *p) {
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900182 **stringp = '\0';
183 (*stringp)++;
184 goto done;
185 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100186 }
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900187 }
188
189done:
Gilles Peskine449bd832023-01-11 14:50:10 +0100190 return ret;
Manuel Pégourié-Gonnarda8838af2015-11-02 06:34:46 +0900191}
192
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200193typedef struct {
194 char buf[512];
195 char *p;
196} verify_print_context;
197
Michael Schuster54300d42024-06-04 02:30:22 +0200198static void verify_print_init(verify_print_context *ctx)
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200199{
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 memset(ctx, 0, sizeof(verify_print_context));
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200201 ctx->p = ctx->buf;
202}
203
Michael Schuster54300d42024-06-04 02:30:22 +0200204static int verify_print(void *data, mbedtls_x509_crt *crt, int certificate_depth, uint32_t *flags)
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200205{
206 int ret;
207 verify_print_context *ctx = (verify_print_context *) data;
208 char *p = ctx->p;
Gilles Peskine449bd832023-01-11 14:50:10 +0100209 size_t n = ctx->buf + sizeof(ctx->buf) - ctx->p;
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200210 ((void) flags);
211
Gilles Peskine449bd832023-01-11 14:50:10 +0100212 ret = mbedtls_snprintf(p, n, "depth %d - serial ", certificate_depth);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200213 MBEDTLS_X509_SAFE_SNPRINTF;
214
Gilles Peskine449bd832023-01-11 14:50:10 +0100215 ret = mbedtls_x509_serial_gets(p, n, &crt->serial);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200216 MBEDTLS_X509_SAFE_SNPRINTF;
217
Gilles Peskine449bd832023-01-11 14:50:10 +0100218 ret = mbedtls_snprintf(p, n, " - subject ");
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200219 MBEDTLS_X509_SAFE_SNPRINTF;
220
Gilles Peskine449bd832023-01-11 14:50:10 +0100221 ret = mbedtls_x509_dn_gets(p, n, &crt->subject);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200222 MBEDTLS_X509_SAFE_SNPRINTF;
223
Gilles Peskine449bd832023-01-11 14:50:10 +0100224 ret = mbedtls_snprintf(p, n, " - flags 0x%08x\n", *flags);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200225 MBEDTLS_X509_SAFE_SNPRINTF;
226
227 ctx->p = p;
228
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 return 0;
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200230}
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200231
Michael Schuster54300d42024-06-04 02:30:22 +0200232static int verify_parse_san(mbedtls_x509_subject_alternative_name *san,
Michael Schusterbd89b792024-06-04 02:41:10 +0200233 char **buf, size_t *size)
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200234{
235 int ret;
236 size_t i;
237 char *p = *buf;
238 size_t n = *size;
239
Gilles Peskine449bd832023-01-11 14:50:10 +0100240 ret = mbedtls_snprintf(p, n, "type : %d", san->type);
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200241 MBEDTLS_X509_SAFE_SNPRINTF;
242
Gilles Peskine449bd832023-01-11 14:50:10 +0100243 switch (san->type) {
244 case (MBEDTLS_X509_SAN_OTHER_NAME):
245 ret = mbedtls_snprintf(p, n, "\notherName :");
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300246 MBEDTLS_X509_SAFE_SNPRINTF;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200247
Gilles Peskine449bd832023-01-11 14:50:10 +0100248 if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME,
David Horstmanncfae6a12023-08-18 19:12:59 +0100249 &san->san.other_name.type_id) == 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100250 ret = mbedtls_snprintf(p, n, " hardware module name :");
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300251 MBEDTLS_X509_SAFE_SNPRINTF;
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 ret = mbedtls_snprintf(p, n, " hardware type : ");
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300253 MBEDTLS_X509_SAFE_SNPRINTF;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200254
Gilles Peskine449bd832023-01-11 14:50:10 +0100255 ret = mbedtls_oid_get_numeric_string(p,
256 n,
Matthias Schulzedc32ea2023-10-19 16:09:08 +0200257 &san->san.other_name.value.hardware_module_name
258 .oid);
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300259 MBEDTLS_X509_SAFE_SNPRINTF;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200260
Gilles Peskine449bd832023-01-11 14:50:10 +0100261 ret = mbedtls_snprintf(p, n, ", hardware serial number : ");
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300262 MBEDTLS_X509_SAFE_SNPRINTF;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200263
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 for (i = 0; i < san->san.other_name.value.hardware_module_name.val.len; i++) {
265 ret = mbedtls_snprintf(p,
266 n,
267 "%02X",
268 san->san.other_name.value.hardware_module_name.val.p[i]);
Victor Barpp Gomes47c7a732022-09-29 11:34:23 -0300269 MBEDTLS_X509_SAFE_SNPRINTF;
270 }
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200271 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100272 break;/* MBEDTLS_OID_ON_HW_MODULE_NAME */
273 case (MBEDTLS_X509_SAN_DNS_NAME):
274 ret = mbedtls_snprintf(p, n, "\ndNSName : ");
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200275 MBEDTLS_X509_SAFE_SNPRINTF;
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 if (san->san.unstructured_name.len >= n) {
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200277 *p = '\0';
Gilles Peskine449bd832023-01-11 14:50:10 +0100278 return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200279 }
280 n -= san->san.unstructured_name.len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 for (i = 0; i < san->san.unstructured_name.len; i++) {
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200282 *p++ = san->san.unstructured_name.p[i];
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 }
284 break;/* MBEDTLS_X509_SAN_DNS_NAME */
Przemek Stekiel608e3ef2023-02-09 14:47:50 +0100285 case (MBEDTLS_X509_SAN_RFC822_NAME):
286 ret = mbedtls_snprintf(p, n, "\nrfc822Name : ");
287 MBEDTLS_X509_SAFE_SNPRINTF;
288 if (san->san.unstructured_name.len >= n) {
289 *p = '\0';
290 return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL;
291 }
292 n -= san->san.unstructured_name.len;
293 for (i = 0; i < san->san.unstructured_name.len; i++) {
294 *p++ = san->san.unstructured_name.p[i];
295 }
296 break;/* MBEDTLS_X509_SAN_RFC822_NAME */
Andrzej Kureke12b01d2023-01-10 06:47:38 -0500297 case (MBEDTLS_X509_SAN_DIRECTORY_NAME):
298 ret = mbedtls_snprintf(p, n, "\ndirectoryName : ");
299 MBEDTLS_X509_SAFE_SNPRINTF;
300 ret = mbedtls_x509_dn_gets(p, n, &san->san.directory_name);
301 if (ret < 0) {
302 return ret;
303 }
304
305 p += ret;
306 n -= ret;
307 break;/* MBEDTLS_X509_SAN_DIRECTORY_NAME */
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200308 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100309 /*
310 * Should not happen.
311 */
312 return -1;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200313 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100314 ret = mbedtls_snprintf(p, n, "\n");
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200315 MBEDTLS_X509_SAFE_SNPRINTF;
316
317 *size = n;
318 *buf = p;
319
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 return 0;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200321}
Michael Schustera3cc4632024-06-07 01:51:54 +0200322#endif /* MBEDTLS_FS_IO */
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +0200323
Michael Schuster54300d42024-06-04 02:30:22 +0200324static int parse_crt_ext_cb(void *p_ctx, mbedtls_x509_crt const *crt, mbedtls_x509_buf const *oid,
Michael Schusterbd89b792024-06-04 02:41:10 +0200325 int critical, const unsigned char *cp, const unsigned char *end)
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +0200326{
Gilles Peskine449bd832023-01-11 14:50:10 +0100327 (void) crt;
328 (void) critical;
329 mbedtls_x509_buf *new_oid = (mbedtls_x509_buf *) p_ctx;
330 if (oid->tag == MBEDTLS_ASN1_OID &&
331 MBEDTLS_OID_CMP(MBEDTLS_OID_CERTIFICATE_POLICIES, oid) == 0) {
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200332 /* Handle unknown certificate policy */
333 int ret, parse_ret = 0;
334 size_t len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100335 unsigned char **p = (unsigned char **) &cp;
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200336
337 /* Get main sequence tag */
Gilles Peskine449bd832023-01-11 14:50:10 +0100338 ret = mbedtls_asn1_get_tag(p, end, &len,
339 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
340 if (ret != 0) {
341 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
342 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200343
Gilles Peskine449bd832023-01-11 14:50:10 +0100344 if (*p + len != end) {
345 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
346 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
347 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200348
349 /*
350 * Cannot be an empty sequence.
351 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100352 if (len == 0) {
353 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
354 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
355 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200356
Gilles Peskine449bd832023-01-11 14:50:10 +0100357 while (*p < end) {
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200358 const unsigned char *policy_end;
359
360 /*
361 * Get the policy sequence
362 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100363 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
364 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) !=
365 0) {
366 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
367 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200368
369 policy_end = *p + len;
370
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 if ((ret = mbedtls_asn1_get_tag(p, policy_end, &len,
372 MBEDTLS_ASN1_OID)) != 0) {
373 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
374 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200375
Nicola Di Lietob77fad82020-06-17 17:57:36 +0200376 /*
377 * Recognize exclusively the policy with OID 1
378 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100379 if (len != 1 || *p[0] != 1) {
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200380 parse_ret = MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE;
Gilles Peskine449bd832023-01-11 14:50:10 +0100381 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200382
383 *p += len;
384
Gilles Peskine449bd832023-01-11 14:50:10 +0100385 /*
386 * If there is an optional qualifier, then *p < policy_end
387 * Check the Qualifier len to verify it doesn't exceed policy_end.
388 */
389 if (*p < policy_end) {
390 if ((ret = mbedtls_asn1_get_tag(p, policy_end, &len,
391 MBEDTLS_ASN1_CONSTRUCTED |
392 MBEDTLS_ASN1_SEQUENCE)) != 0) {
393 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
394 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200395 /*
396 * Skip the optional policy qualifiers.
397 */
398 *p += len;
399 }
400
Gilles Peskine449bd832023-01-11 14:50:10 +0100401 if (*p != policy_end) {
402 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
403 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
404 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200405 }
406
Gilles Peskine449bd832023-01-11 14:50:10 +0100407 if (*p != end) {
408 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
409 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
410 }
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200411
Gilles Peskine449bd832023-01-11 14:50:10 +0100412 return parse_ret;
413 } else if (new_oid != NULL && new_oid->tag == oid->tag && new_oid->len == oid->len &&
414 memcmp(new_oid->p, oid->p, oid->len) == 0) {
415 return 0;
416 } else {
417 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
418 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
Nicola Di Lietoc84b1e62020-06-13 11:08:16 +0200419 }
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +0200420}
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200421#endif /* MBEDTLS_X509_CRT_PARSE_C */
Matthias Schulzab408222023-10-18 13:20:59 +0200422
Michael Schustera3cc4632024-06-07 01:51:54 +0200423#if defined(MBEDTLS_X509_CSR_PARSE_C) && \
424 !defined(MBEDTLS_X509_REMOVE_INFO)
Michael Schusterf828f042024-06-07 06:47:31 +0200425static int parse_csr_ext_accept_cb(void *p_ctx,
426 mbedtls_x509_csr const *csr,
427 mbedtls_x509_buf const *oid,
428 int critical,
429 const unsigned char *cp,
430 const unsigned char *end)
Matthias Schulzab408222023-10-18 13:20:59 +0200431{
432 (void) p_ctx;
433 (void) csr;
434 (void) oid;
435 (void) critical;
436 (void) cp;
437 (void) end;
438
439 return 0;
440}
441
Michael Schusterf828f042024-06-07 06:47:31 +0200442static int parse_csr_ext_reject_cb(void *p_ctx,
443 mbedtls_x509_csr const *csr,
444 mbedtls_x509_buf const *oid,
445 int critical,
446 const unsigned char *cp,
447 const unsigned char *end)
Matthias Schulzab408222023-10-18 13:20:59 +0200448{
449 (void) p_ctx;
450 (void) csr;
451 (void) oid;
452 (void) critical;
453 (void) cp;
454 (void) end;
455
456 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
457 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
458}
Michael Schustera3cc4632024-06-07 01:51:54 +0200459#endif /* MBEDTLS_X509_CSR_PARSE_C && !MBEDTLS_X509_REMOVE_INFO */
Paul Bakker33b43f12013-08-20 11:48:36 +0200460/* END_HEADER */
Paul Bakker37940d9f2009-07-10 22:38:58 +0000461
Thomas Daubney5c9c2ce2022-06-06 16:36:43 +0100462/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100463void x509_accessor_ext_types(int ext_type, int has_ext_type)
Thomas Daubneybd5466a2022-05-31 14:16:42 +0100464{
465 mbedtls_x509_crt crt;
466 int expected_result = ext_type & has_ext_type;
467
Gilles Peskine449bd832023-01-11 14:50:10 +0100468 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200469 USE_PSA_INIT();
Thomas Daubneybd5466a2022-05-31 14:16:42 +0100470
471 crt.ext_types = ext_type;
472
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500473 TEST_EQUAL(mbedtls_x509_crt_has_ext_type(&crt, has_ext_type), expected_result);
Thomas Daubneybd5466a2022-05-31 14:16:42 +0100474
valerio32f2ac92023-04-20 11:59:52 +0200475exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100476 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +0200477 USE_PSA_DONE();
Thomas Daubneybd5466a2022-05-31 14:16:42 +0100478}
479/* END_CASE */
480
Glenn Strauss6f545ac2022-10-25 15:02:14 -0400481/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_TEST_HOOKS */
482void x509_crt_parse_cn_inet_pton(const char *cn, data_t *exp, int ref_ret)
483{
484 uint32_t addr[4];
485 size_t addrlen = mbedtls_x509_crt_parse_cn_inet_pton(cn, addr);
486 TEST_EQUAL(addrlen, (size_t) ref_ret);
487
488 if (addrlen) {
Tom Cosgrovee4e9e7d2023-07-21 11:40:20 +0100489 TEST_MEMORY_COMPARE(exp->x, exp->len, addr, addrlen);
Glenn Strauss6f545ac2022-10-25 15:02:14 -0400490 }
491}
492/* END_CASE */
493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200494/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Andrzej Kurekd90376e2023-01-20 07:08:57 -0500495void x509_parse_san(char *crt_file, char *result_str, int parse_result)
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200496{
Ron Eldor890819a2019-05-13 19:03:04 +0300497 int ret;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200498 mbedtls_x509_crt crt;
Ron Eldor890819a2019-05-13 19:03:04 +0300499 mbedtls_x509_subject_alternative_name san;
500 mbedtls_x509_sequence *cur = NULL;
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200501 char buf[2000];
502 char *p = buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100503 size_t n = sizeof(buf);
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200504
Gilles Peskine449bd832023-01-11 14:50:10 +0100505 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200506 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100507 memset(buf, 0, 2000);
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200508
Andrzej Kurekd90376e2023-01-20 07:08:57 -0500509 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), parse_result);
Ron Eldor890819a2019-05-13 19:03:04 +0300510
Andrzej Kurekd90376e2023-01-20 07:08:57 -0500511 if (parse_result != 0) {
512 goto exit;
513 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100514 if (crt.ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
Ron Eldor890819a2019-05-13 19:03:04 +0300515 cur = &crt.subject_alt_names;
Gilles Peskine449bd832023-01-11 14:50:10 +0100516 while (cur != NULL) {
517 ret = mbedtls_x509_parse_subject_alt_name(&cur->buf, &san);
518 TEST_ASSERT(ret == 0 || ret == MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE);
Ron Eldor890819a2019-05-13 19:03:04 +0300519 /*
520 * If san type not supported, ignore.
521 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 if (ret == 0) {
Andrzej Kurekd40c2b62023-02-13 07:01:59 -0500523 ret = verify_parse_san(&san, &p, &n);
524 mbedtls_x509_free_subject_alt_name(&san);
525 TEST_EQUAL(ret, 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100526 }
Ron Eldor890819a2019-05-13 19:03:04 +0300527 cur = cur->next;
528 }
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200529 }
530
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500531 TEST_EQUAL(strcmp(buf, result_str), 0);
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200532
533exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100534 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +0200535 USE_PSA_DONE();
Ron Eldorb2dc3fa2019-03-21 13:40:13 +0200536}
537/* END_CASE */
538
Hanno Becker612a2f12020-10-09 09:19:39 +0100539/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:!MBEDTLS_X509_REMOVE_INFO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100540void x509_cert_info(char *crt_file, char *result_str)
Paul Bakker37940d9f2009-07-10 22:38:58 +0000541{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542 mbedtls_x509_crt crt;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000543 char buf[2000];
Paul Bakker69998dd2009-07-11 19:15:20 +0000544 int res;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000545
Gilles Peskine449bd832023-01-11 14:50:10 +0100546 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200547 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100548 memset(buf, 0, 2000);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000549
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500550 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100551 res = mbedtls_x509_crt_info(buf, 2000, "", &crt);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000552
Gilles Peskine449bd832023-01-11 14:50:10 +0100553 TEST_ASSERT(res != -1);
554 TEST_ASSERT(res != -2);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000555
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500556 TEST_EQUAL(strcmp(buf, result_str), 0);
Paul Bakkerbd51b262014-07-10 15:26:12 +0200557
558exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100559 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +0200560 USE_PSA_DONE();
Paul Bakker37940d9f2009-07-10 22:38:58 +0000561}
Paul Bakker33b43f12013-08-20 11:48:36 +0200562/* END_CASE */
Paul Bakker37940d9f2009-07-10 22:38:58 +0000563
Hanno Becker612a2f12020-10-09 09:19:39 +0100564/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRL_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100565void mbedtls_x509_crl_info(char *crl_file, char *result_str)
Paul Bakker37940d9f2009-07-10 22:38:58 +0000566{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200567 mbedtls_x509_crl crl;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000568 char buf[2000];
Paul Bakker69998dd2009-07-11 19:15:20 +0000569 int res;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000570
Gilles Peskine449bd832023-01-11 14:50:10 +0100571 mbedtls_x509_crl_init(&crl);
valerio32f2ac92023-04-20 11:59:52 +0200572 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100573 memset(buf, 0, 2000);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000574
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500575 TEST_EQUAL(mbedtls_x509_crl_parse_file(&crl, crl_file), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 res = mbedtls_x509_crl_info(buf, 2000, "", &crl);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000577
Gilles Peskine449bd832023-01-11 14:50:10 +0100578 TEST_ASSERT(res != -1);
579 TEST_ASSERT(res != -2);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000580
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500581 TEST_EQUAL(strcmp(buf, result_str), 0);
Paul Bakkerbd51b262014-07-10 15:26:12 +0200582
583exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100584 mbedtls_x509_crl_free(&crl);
Valerio Setti569c1712023-04-19 14:53:36 +0200585 USE_PSA_DONE();
Paul Bakker37940d9f2009-07-10 22:38:58 +0000586}
Paul Bakker33b43f12013-08-20 11:48:36 +0200587/* END_CASE */
Paul Bakker37940d9f2009-07-10 22:38:58 +0000588
Andres AGa39db392016-12-08 17:10:38 +0000589/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRL_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100590void mbedtls_x509_crl_parse(char *crl_file, int result)
Andres AGa39db392016-12-08 17:10:38 +0000591{
592 mbedtls_x509_crl crl;
593 char buf[2000];
594
Gilles Peskine449bd832023-01-11 14:50:10 +0100595 mbedtls_x509_crl_init(&crl);
valerio32f2ac92023-04-20 11:59:52 +0200596 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100597 memset(buf, 0, 2000);
Andres AGa39db392016-12-08 17:10:38 +0000598
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500599 TEST_EQUAL(mbedtls_x509_crl_parse_file(&crl, crl_file), result);
Andres AGa39db392016-12-08 17:10:38 +0000600
601exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100602 mbedtls_x509_crl_free(&crl);
Valerio Setti569c1712023-04-19 14:53:36 +0200603 USE_PSA_DONE();
Andres AGa39db392016-12-08 17:10:38 +0000604}
605/* END_CASE */
606
Hanno Becker612a2f12020-10-09 09:19:39 +0100607/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CSR_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100608void mbedtls_x509_csr_info(char *csr_file, char *result_str)
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100609{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200610 mbedtls_x509_csr csr;
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100611 char buf[2000];
612 int res;
613
Gilles Peskine449bd832023-01-11 14:50:10 +0100614 mbedtls_x509_csr_init(&csr);
valerio32f2ac92023-04-20 11:59:52 +0200615 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100616 memset(buf, 0, 2000);
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100617
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500618 TEST_EQUAL(mbedtls_x509_csr_parse_file(&csr, csr_file), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100619 res = mbedtls_x509_csr_info(buf, 2000, "", &csr);
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100620
Gilles Peskine449bd832023-01-11 14:50:10 +0100621 TEST_ASSERT(res != -1);
622 TEST_ASSERT(res != -2);
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100623
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500624 TEST_EQUAL(strcmp(buf, result_str), 0);
Paul Bakkerbd51b262014-07-10 15:26:12 +0200625
626exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100627 mbedtls_x509_csr_free(&csr);
Valerio Setti569c1712023-04-19 14:53:36 +0200628 USE_PSA_DONE();
Manuel Pégourié-Gonnard2a8d7fd2014-01-24 17:34:26 +0100629}
630/* END_CASE */
631
Hanno Becker612a2f12020-10-09 09:19:39 +0100632/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100633void x509_verify_info(int flags, char *prefix, char *result_str)
Manuel Pégourié-Gonnardb5f48ad2015-04-20 10:38:13 +0100634{
635 char buf[2000];
636 int res;
637
Valerio Setti569c1712023-04-19 14:53:36 +0200638 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100639 memset(buf, 0, sizeof(buf));
Manuel Pégourié-Gonnardb5f48ad2015-04-20 10:38:13 +0100640
Gilles Peskine449bd832023-01-11 14:50:10 +0100641 res = mbedtls_x509_crt_verify_info(buf, sizeof(buf), prefix, flags);
Manuel Pégourié-Gonnardb5f48ad2015-04-20 10:38:13 +0100642
Gilles Peskine449bd832023-01-11 14:50:10 +0100643 TEST_ASSERT(res >= 0);
Manuel Pégourié-Gonnardb5f48ad2015-04-20 10:38:13 +0100644
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500645 TEST_EQUAL(strcmp(buf, result_str), 0);
valerio32f2ac92023-04-20 11:59:52 +0200646
647exit:
Valerio Setti569c1712023-04-19 14:53:36 +0200648 USE_PSA_DONE();
Manuel Pégourié-Gonnardb5f48ad2015-04-20 10:38:13 +0100649}
650/* END_CASE */
651
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200652/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_X509_CRL_PARSE_C:MBEDTLS_ECP_RESTARTABLE:MBEDTLS_ECDSA_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100653void x509_verify_restart(char *crt_file, char *ca_file,
654 int result, int flags_result,
655 int max_ops, int min_restart, int max_restart)
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200656{
657 int ret, cnt_restart;
658 mbedtls_x509_crt_restart_ctx rs_ctx;
659 mbedtls_x509_crt crt;
660 mbedtls_x509_crt ca;
661 uint32_t flags = 0;
662
Manuel Pégourié-Gonnard8b590492017-08-14 18:04:19 +0200663 /*
664 * See comments on ecp_test_vect_restart() for op count precision.
665 *
Gilles Peskinee820c0a2023-08-03 17:45:20 +0200666 * For reference, with Mbed TLS 2.6 and default settings:
Manuel Pégourié-Gonnard8b590492017-08-14 18:04:19 +0200667 * - ecdsa_verify() for P-256: ~ 6700
668 * - ecdsa_verify() for P-384: ~ 18800
669 * - x509_verify() for server5 -> test-ca2: ~ 18800
670 * - x509_verify() for server10 -> int-ca3 -> int-ca2: ~ 25500
671 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100672 mbedtls_x509_crt_restart_init(&rs_ctx);
673 mbedtls_x509_crt_init(&crt);
674 mbedtls_x509_crt_init(&ca);
valerio32f2ac92023-04-20 11:59:52 +0200675 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200676
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500677 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
678 TEST_EQUAL(mbedtls_x509_crt_parse_file(&ca, ca_file), 0);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200679
Gilles Peskine449bd832023-01-11 14:50:10 +0100680 mbedtls_ecp_set_max_ops(max_ops);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200681
682 cnt_restart = 0;
683 do {
Gilles Peskine449bd832023-01-11 14:50:10 +0100684 ret = mbedtls_x509_crt_verify_restartable(&crt, &ca, NULL,
685 &mbedtls_x509_crt_profile_default, NULL, &flags,
686 NULL, NULL, &rs_ctx);
687 } while (ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restart);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200688
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500689 TEST_EQUAL(ret, result);
690 TEST_EQUAL(flags, (uint32_t) flags_result);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200691
Gilles Peskine449bd832023-01-11 14:50:10 +0100692 TEST_ASSERT(cnt_restart >= min_restart);
693 TEST_ASSERT(cnt_restart <= max_restart);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200694
695 /* Do we leak memory when aborting? */
Gilles Peskine449bd832023-01-11 14:50:10 +0100696 ret = mbedtls_x509_crt_verify_restartable(&crt, &ca, NULL,
697 &mbedtls_x509_crt_profile_default, NULL, &flags,
698 NULL, NULL, &rs_ctx);
699 TEST_ASSERT(ret == result || ret == MBEDTLS_ERR_ECP_IN_PROGRESS);
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200700
701exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100702 mbedtls_x509_crt_restart_free(&rs_ctx);
703 mbedtls_x509_crt_free(&crt);
704 mbedtls_x509_crt_free(&ca);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +0100705 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnardd19a41d2017-07-14 11:05:59 +0200706}
707/* END_CASE */
708
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200709/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_X509_CRL_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100710void x509_verify(char *crt_file, char *ca_file, char *crl_file,
711 char *cn_name_str, int result, int flags_result,
712 char *profile_str,
713 char *verify_callback)
Paul Bakker37940d9f2009-07-10 22:38:58 +0000714{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200715 mbedtls_x509_crt crt;
716 mbedtls_x509_crt ca;
717 mbedtls_x509_crl crl;
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200718 uint32_t flags = 0;
Paul Bakker69998dd2009-07-11 19:15:20 +0000719 int res;
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200720 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *) = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100721 char *cn_name = NULL;
Gilles Peskineef86ab22017-05-05 18:59:02 +0200722 const mbedtls_x509_crt_profile *profile;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000723
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 mbedtls_x509_crt_init(&crt);
725 mbedtls_x509_crt_init(&ca);
726 mbedtls_x509_crl_init(&crl);
valerio32f2ac92023-04-20 11:59:52 +0200727 MD_OR_USE_PSA_INIT();
Paul Bakker37940d9f2009-07-10 22:38:58 +0000728
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 if (strcmp(cn_name_str, "NULL") != 0) {
Paul Bakker33b43f12013-08-20 11:48:36 +0200730 cn_name = cn_name_str;
Gilles Peskine449bd832023-01-11 14:50:10 +0100731 }
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200732
Gilles Peskine449bd832023-01-11 14:50:10 +0100733 if (strcmp(profile_str, "") == 0) {
Gilles Peskineef86ab22017-05-05 18:59:02 +0200734 profile = &mbedtls_x509_crt_profile_default;
Gilles Peskine449bd832023-01-11 14:50:10 +0100735 } else if (strcmp(profile_str, "next") == 0) {
Ron Eldorc1539982018-02-06 18:47:17 +0200736 profile = &mbedtls_x509_crt_profile_next;
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 } else if (strcmp(profile_str, "suite_b") == 0) {
Ron Eldorc1539982018-02-06 18:47:17 +0200738 profile = &mbedtls_x509_crt_profile_suiteb;
Gilles Peskine449bd832023-01-11 14:50:10 +0100739 } else if (strcmp(profile_str, "compat") == 0) {
Gilles Peskineef86ab22017-05-05 18:59:02 +0200740 profile = &compat_profile;
Gilles Peskine449bd832023-01-11 14:50:10 +0100741 } else if (strcmp(profile_str, "all") == 0) {
Hanno Becker20a4ade2019-06-03 14:27:03 +0100742 profile = &profile_all;
Gilles Peskine449bd832023-01-11 14:50:10 +0100743 } else {
Agathiyan Bragadeesh763b3532023-07-27 13:52:31 +0100744 TEST_FAIL("Unknown algorithm profile");
Gilles Peskine449bd832023-01-11 14:50:10 +0100745 }
Gilles Peskineef86ab22017-05-05 18:59:02 +0200746
Gilles Peskine449bd832023-01-11 14:50:10 +0100747 if (strcmp(verify_callback, "NULL") == 0) {
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200748 f_vrfy = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100749 } else if (strcmp(verify_callback, "verify_none") == 0) {
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200750 f_vrfy = verify_none;
Gilles Peskine449bd832023-01-11 14:50:10 +0100751 } else if (strcmp(verify_callback, "verify_all") == 0) {
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200752 f_vrfy = verify_all;
Gilles Peskine449bd832023-01-11 14:50:10 +0100753 } else {
Agathiyan Bragadeesh763b3532023-07-27 13:52:31 +0100754 TEST_FAIL("No known verify callback selected");
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 }
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200756
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500757 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
758 TEST_EQUAL(mbedtls_x509_crt_parse_file(&ca, ca_file), 0);
759 TEST_EQUAL(mbedtls_x509_crl_parse_file(&crl, crl_file), 0);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000760
Gilles Peskine449bd832023-01-11 14:50:10 +0100761 res = mbedtls_x509_crt_verify_with_profile(&crt,
762 &ca,
763 &crl,
764 profile,
765 cn_name,
766 &flags,
767 f_vrfy,
768 NULL);
Manuel Pégourié-Gonnard65eefc82015-10-23 14:08:48 +0200769
Gilles Peskine449bd832023-01-11 14:50:10 +0100770 TEST_EQUAL(res, result);
771 TEST_EQUAL(flags, (uint32_t) flags_result);
Paul Bakkerbd51b262014-07-10 15:26:12 +0200772
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200773#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Hanno Becker0350d562019-03-28 14:23:36 +0000774 /* CRLs aren't supported with CA callbacks, so skip the CA callback
Jarno Lamsadfd22c42019-04-01 15:18:53 +0300775 * version of the test if CRLs are in use. */
Gilles Peskinebb7d92c2023-10-17 17:26:44 +0200776 if (strcmp(crl_file, "") == 0) {
Hanno Becker0350d562019-03-28 14:23:36 +0000777 flags = 0;
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200778
Gilles Peskine449bd832023-01-11 14:50:10 +0100779 res = mbedtls_x509_crt_verify_with_ca_cb(&crt,
780 ca_callback,
781 &ca,
782 profile,
783 cn_name,
784 &flags,
785 f_vrfy,
786 NULL);
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200787
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500788 TEST_EQUAL(res, result);
789 TEST_EQUAL(flags, (uint32_t) (flags_result));
Hanno Becker0350d562019-03-28 14:23:36 +0000790 }
Jarno Lamsa03cd1202019-03-27 15:45:04 +0200791#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakkerbd51b262014-07-10 15:26:12 +0200792exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100793 mbedtls_x509_crt_free(&crt);
794 mbedtls_x509_crt_free(&ca);
795 mbedtls_x509_crl_free(&crl);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +0100796 MD_OR_USE_PSA_DONE();
Paul Bakker37940d9f2009-07-10 22:38:58 +0000797}
Paul Bakker33b43f12013-08-20 11:48:36 +0200798/* END_CASE */
Paul Bakker37940d9f2009-07-10 22:38:58 +0000799
Jarno Lamsa557426a2019-03-27 17:08:29 +0200800/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_X509_CRL_PARSE_C:MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Gilles Peskine449bd832023-01-11 14:50:10 +0100801void x509_verify_ca_cb_failure(char *crt_file, char *ca_file, char *name,
802 int exp_ret)
Jarno Lamsa557426a2019-03-27 17:08:29 +0200803{
804 int ret;
805 mbedtls_x509_crt crt;
806 mbedtls_x509_crt ca;
807 uint32_t flags = 0;
Hanno Becker3f932bb2019-03-28 17:06:47 +0000808
Gilles Peskine449bd832023-01-11 14:50:10 +0100809 mbedtls_x509_crt_init(&crt);
810 mbedtls_x509_crt_init(&ca);
valerio32f2ac92023-04-20 11:59:52 +0200811 USE_PSA_INIT();
Jarno Lamsa557426a2019-03-27 17:08:29 +0200812
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500813 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
814 TEST_EQUAL(mbedtls_x509_crt_parse_file(&ca, ca_file), 0);
Jarno Lamsa557426a2019-03-27 17:08:29 +0200815
Gilles Peskine449bd832023-01-11 14:50:10 +0100816 if (strcmp(name, "NULL") == 0) {
Jarno Lamsa557426a2019-03-27 17:08:29 +0200817 name = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100818 }
Hanno Beckercbb59032019-03-28 14:14:22 +0000819
Gilles Peskine449bd832023-01-11 14:50:10 +0100820 ret = mbedtls_x509_crt_verify_with_ca_cb(&crt, ca_callback_fail, &ca,
821 &compat_profile, name, &flags,
822 NULL, NULL);
Jarno Lamsa557426a2019-03-27 17:08:29 +0200823
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500824 TEST_EQUAL(ret, exp_ret);
825 TEST_EQUAL(flags, (uint32_t) (-1));
Jarno Lamsa557426a2019-03-27 17:08:29 +0200826exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100827 mbedtls_x509_crt_free(&crt);
828 mbedtls_x509_crt_free(&ca);
Valerio Setti569c1712023-04-19 14:53:36 +0200829 USE_PSA_DONE();
Jarno Lamsa557426a2019-03-27 17:08:29 +0200830}
831/* END_CASE */
832
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200833/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100834void x509_verify_callback(char *crt_file, char *ca_file, char *name,
835 int exp_ret, char *exp_vrfy_out)
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200836{
837 int ret;
838 mbedtls_x509_crt crt;
839 mbedtls_x509_crt ca;
840 uint32_t flags = 0;
841 verify_print_context vrfy_ctx;
842
Gilles Peskine449bd832023-01-11 14:50:10 +0100843 mbedtls_x509_crt_init(&crt);
844 mbedtls_x509_crt_init(&ca);
valerio32f2ac92023-04-20 11:59:52 +0200845 MD_OR_USE_PSA_INIT();
846
Gilles Peskine449bd832023-01-11 14:50:10 +0100847 verify_print_init(&vrfy_ctx);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200848
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500849 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
850 TEST_EQUAL(mbedtls_x509_crt_parse_file(&ca, ca_file), 0);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200851
Gilles Peskine449bd832023-01-11 14:50:10 +0100852 if (strcmp(name, "NULL") == 0) {
Manuel Pégourié-Gonnarda6568252017-07-05 18:14:38 +0200853 name = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100854 }
Manuel Pégourié-Gonnarda6568252017-07-05 18:14:38 +0200855
Gilles Peskine449bd832023-01-11 14:50:10 +0100856 ret = mbedtls_x509_crt_verify_with_profile(&crt, &ca, NULL,
857 &compat_profile,
858 name, &flags,
859 verify_print, &vrfy_ctx);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200860
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500861 TEST_EQUAL(ret, exp_ret);
862 TEST_EQUAL(strcmp(vrfy_ctx.buf, exp_vrfy_out), 0);
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200863
864exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100865 mbedtls_x509_crt_free(&crt);
866 mbedtls_x509_crt_free(&ca);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +0100867 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnard560fea32015-09-01 11:59:24 +0200868}
869/* END_CASE */
870
Hanno Becker612a2f12020-10-09 09:19:39 +0100871/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100872void mbedtls_x509_dn_gets_subject_replace(char *crt_file,
873 char *new_subject_ou,
874 char *result_str,
875 int ret)
Werner Lewis31ecb962022-06-17 15:51:55 +0100876{
877 mbedtls_x509_crt crt;
878 char buf[2000];
879 int res = 0;
880
Gilles Peskine449bd832023-01-11 14:50:10 +0100881 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200882 USE_PSA_INIT();
883
Gilles Peskine449bd832023-01-11 14:50:10 +0100884 memset(buf, 0, 2000);
Werner Lewis31ecb962022-06-17 15:51:55 +0100885
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500886 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Werner Lewis31ecb962022-06-17 15:51:55 +0100887 crt.subject.next->val.p = (unsigned char *) new_subject_ou;
Gilles Peskine449bd832023-01-11 14:50:10 +0100888 crt.subject.next->val.len = strlen(new_subject_ou);
Werner Lewis31ecb962022-06-17 15:51:55 +0100889
Gilles Peskine449bd832023-01-11 14:50:10 +0100890 res = mbedtls_x509_dn_gets(buf, 2000, &crt.subject);
Werner Lewis31ecb962022-06-17 15:51:55 +0100891
Gilles Peskine449bd832023-01-11 14:50:10 +0100892 if (ret != 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500893 TEST_EQUAL(res, ret);
Gilles Peskine449bd832023-01-11 14:50:10 +0100894 } else {
895 TEST_ASSERT(res != -1);
896 TEST_ASSERT(res != -2);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500897 TEST_EQUAL(strcmp(buf, result_str), 0);
Werner Lewis31ecb962022-06-17 15:51:55 +0100898 }
899exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100900 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +0200901 USE_PSA_DONE();
Werner Lewis31ecb962022-06-17 15:51:55 +0100902}
903/* END_CASE */
904
905/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100906void mbedtls_x509_dn_gets(char *crt_file, char *entity, char *result_str)
Paul Bakker37940d9f2009-07-10 22:38:58 +0000907{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200908 mbedtls_x509_crt crt;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000909 char buf[2000];
Paul Bakkerdbd443d2013-08-16 13:38:47 +0200910 int res = 0;
Paul Bakker37940d9f2009-07-10 22:38:58 +0000911
Gilles Peskine449bd832023-01-11 14:50:10 +0100912 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +0200913 USE_PSA_INIT();
914
Gilles Peskine449bd832023-01-11 14:50:10 +0100915 memset(buf, 0, 2000);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000916
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500917 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +0100918 if (strcmp(entity, "subject") == 0) {
919 res = mbedtls_x509_dn_gets(buf, 2000, &crt.subject);
920 } else if (strcmp(entity, "issuer") == 0) {
921 res = mbedtls_x509_dn_gets(buf, 2000, &crt.issuer);
922 } else {
Agathiyan Bragadeesh763b3532023-07-27 13:52:31 +0100923 TEST_FAIL("Unknown entity");
Gilles Peskine449bd832023-01-11 14:50:10 +0100924 }
Paul Bakker37940d9f2009-07-10 22:38:58 +0000925
Gilles Peskine449bd832023-01-11 14:50:10 +0100926 TEST_ASSERT(res != -1);
927 TEST_ASSERT(res != -2);
Paul Bakker37940d9f2009-07-10 22:38:58 +0000928
Demi Marie Obenour16442cc2022-11-26 22:19:48 -0500929 TEST_EQUAL(strcmp(buf, result_str), 0);
Paul Bakkerbd51b262014-07-10 15:26:12 +0200930
931exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100932 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +0200933 USE_PSA_DONE();
Paul Bakker37940d9f2009-07-10 22:38:58 +0000934}
Paul Bakker33b43f12013-08-20 11:48:36 +0200935/* END_CASE */
Paul Bakker37940d9f2009-07-10 22:38:58 +0000936
David Horstmanndb73d3b2022-10-04 16:49:16 +0100937/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100938void mbedtls_x509_get_name(char *rdn_sequence, int exp_ret)
David Horstmanndb73d3b2022-10-04 16:49:16 +0100939{
valerioe50831c2023-04-20 14:48:19 +0200940 unsigned char *name = NULL;
David Horstmanndb73d3b2022-10-04 16:49:16 +0100941 unsigned char *p;
942 size_t name_len;
David Horstmann2bb9c8a2022-10-20 10:18:37 +0100943 mbedtls_x509_name head;
David Horstmann3cd67582022-10-17 17:59:10 +0100944 int ret;
David Horstmanndb73d3b2022-10-04 16:49:16 +0100945
Valerio Setti569c1712023-04-19 14:53:36 +0200946 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +0100947 memset(&head, 0, sizeof(head));
David Horstmann2bb9c8a2022-10-20 10:18:37 +0100948
Gilles Peskine449bd832023-01-11 14:50:10 +0100949 name = mbedtls_test_unhexify_alloc(rdn_sequence, &name_len);
David Horstmanndb73d3b2022-10-04 16:49:16 +0100950 p = name;
951
Gilles Peskine449bd832023-01-11 14:50:10 +0100952 ret = mbedtls_x509_get_name(&p, (name + name_len), &head);
953 if (ret == 0) {
954 mbedtls_asn1_free_named_data_list_shallow(head.next);
955 }
David Horstmanndb73d3b2022-10-04 16:49:16 +0100956
Gilles Peskine449bd832023-01-11 14:50:10 +0100957 TEST_EQUAL(ret, exp_ret);
David Horstmanndb73d3b2022-10-04 16:49:16 +0100958
valerio32f2ac92023-04-20 11:59:52 +0200959exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100960 mbedtls_free(name);
Valerio Setti569c1712023-04-19 14:53:36 +0200961 USE_PSA_DONE();
David Horstmanndb73d3b2022-10-04 16:49:16 +0100962}
963/* END_CASE */
964
Werner Lewisb3acb052022-06-17 15:59:58 +0100965/* BEGIN_CASE depends_on:MBEDTLS_X509_CREATE_C:MBEDTLS_X509_USE_C:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +0100966void mbedtls_x509_dn_get_next(char *name_str,
967 int next_merged,
968 char *expected_oids,
969 int exp_count,
970 char *exp_dn_gets)
Werner Lewisb3acb052022-06-17 15:59:58 +0100971{
972 int ret = 0, i;
Werner Lewisac80a662022-06-23 11:58:02 +0100973 size_t len = 0, out_size;
Werner Lewisb3acb052022-06-17 15:59:58 +0100974 mbedtls_asn1_named_data *names = NULL;
Gilles Peskine21e46b32023-10-17 16:35:20 +0200975 mbedtls_x509_name parsed;
976 memset(&parsed, 0, sizeof(parsed));
977 mbedtls_x509_name *parsed_cur;
Werner Lewisac80a662022-06-23 11:58:02 +0100978 // Size of buf is maximum required for test cases
Gilles Peskinef2574202023-10-18 17:39:48 +0200979 unsigned char buf[80] = { 0 };
Gilles Peskine21e46b32023-10-17 16:35:20 +0200980 unsigned char *out = NULL;
981 unsigned char *c = buf + sizeof(buf);
Werner Lewisb3acb052022-06-17 15:59:58 +0100982 const char *short_name;
983
Valerio Setti569c1712023-04-19 14:53:36 +0200984 USE_PSA_INIT();
Gilles Peskine21e46b32023-10-17 16:35:20 +0200985
Werner Lewisac80a662022-06-23 11:58:02 +0100986 // Additional size required for trailing space
Gilles Peskine449bd832023-01-11 14:50:10 +0100987 out_size = strlen(expected_oids) + 2;
Tom Cosgrove05b2a872023-07-21 11:31:13 +0100988 TEST_CALLOC(out, out_size);
Werner Lewisb3acb052022-06-17 15:59:58 +0100989
Gilles Peskine449bd832023-01-11 14:50:10 +0100990 TEST_EQUAL(mbedtls_x509_string_to_names(&names, name_str), 0);
Werner Lewisb3acb052022-06-17 15:59:58 +0100991
Gilles Peskine449bd832023-01-11 14:50:10 +0100992 ret = mbedtls_x509_write_names(&c, buf, names);
993 TEST_LE_S(0, ret);
Werner Lewisb3acb052022-06-17 15:59:58 +0100994
Gilles Peskine449bd832023-01-11 14:50:10 +0100995 TEST_EQUAL(mbedtls_asn1_get_tag(&c, buf + sizeof(buf), &len,
996 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE), 0);
997 TEST_EQUAL(mbedtls_x509_get_name(&c, buf + sizeof(buf), &parsed), 0);
Werner Lewisb3acb052022-06-17 15:59:58 +0100998
999 // Iterate over names and set next_merged nodes
1000 parsed_cur = &parsed;
Gilles Peskine449bd832023-01-11 14:50:10 +01001001 for (; next_merged != 0 && parsed_cur != NULL; next_merged = next_merged >> 1) {
Werner Lewis12657cd2022-06-20 11:47:57 +01001002 parsed_cur->next_merged = next_merged & 0x01;
Werner Lewisb3acb052022-06-17 15:59:58 +01001003 parsed_cur = parsed_cur->next;
1004 }
1005
1006 // Iterate over RDN nodes and print OID of first element to buffer
1007 parsed_cur = &parsed;
1008 len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001009 for (i = 0; parsed_cur != NULL; i++) {
1010 TEST_EQUAL(mbedtls_oid_get_attr_short_name(&parsed_cur->oid,
1011 &short_name), 0);
1012 len += mbedtls_snprintf((char *) out + len, out_size - len, "%s ", short_name);
1013 parsed_cur = mbedtls_x509_dn_get_next(parsed_cur);
Werner Lewisb3acb052022-06-17 15:59:58 +01001014 }
1015 out[len-1] = 0;
1016
Gilles Peskine449bd832023-01-11 14:50:10 +01001017 TEST_EQUAL(exp_count, i);
1018 TEST_EQUAL(strcmp((char *) out, expected_oids), 0);
1019 mbedtls_free(out);
Werner Lewisac80a662022-06-23 11:58:02 +01001020 out = NULL;
Werner Lewisb3acb052022-06-17 15:59:58 +01001021
Gilles Peskine449bd832023-01-11 14:50:10 +01001022 out_size = strlen(exp_dn_gets) + 1;
Tom Cosgrove05b2a872023-07-21 11:31:13 +01001023 TEST_CALLOC(out, out_size);
Werner Lewisac80a662022-06-23 11:58:02 +01001024
Gilles Peskine449bd832023-01-11 14:50:10 +01001025 TEST_LE_S(0, mbedtls_x509_dn_gets((char *) out, out_size, &parsed));
1026 TEST_EQUAL(strcmp((char *) out, exp_dn_gets), 0);
Werner Lewisb3acb052022-06-17 15:59:58 +01001027exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001028 mbedtls_free(out);
1029 mbedtls_asn1_free_named_data_list(&names);
1030 mbedtls_asn1_free_named_data_list_shallow(parsed.next);
Valerio Setti569c1712023-04-19 14:53:36 +02001031 USE_PSA_DONE();
Werner Lewisb3acb052022-06-17 15:59:58 +01001032}
Werner Lewisb3acb052022-06-17 15:59:58 +01001033/* END_CASE */
1034
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001035/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001036void mbedtls_x509_time_is_past(char *crt_file, char *entity, int result)
Paul Bakker37940d9f2009-07-10 22:38:58 +00001037{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038 mbedtls_x509_crt crt;
Paul Bakker37940d9f2009-07-10 22:38:58 +00001039
Gilles Peskine449bd832023-01-11 14:50:10 +01001040 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001041 USE_PSA_INIT();
Paul Bakker37940d9f2009-07-10 22:38:58 +00001042
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001043 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Paul Bakkerdbd443d2013-08-16 13:38:47 +02001044
Gilles Peskine449bd832023-01-11 14:50:10 +01001045 if (strcmp(entity, "valid_from") == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001046 TEST_EQUAL(mbedtls_x509_time_is_past(&crt.valid_from), result);
Gilles Peskine449bd832023-01-11 14:50:10 +01001047 } else if (strcmp(entity, "valid_to") == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001048 TEST_EQUAL(mbedtls_x509_time_is_past(&crt.valid_to), result);
Gilles Peskine449bd832023-01-11 14:50:10 +01001049 } else {
Agathiyan Bragadeesh763b3532023-07-27 13:52:31 +01001050 TEST_FAIL("Unknown entity");
Gilles Peskine449bd832023-01-11 14:50:10 +01001051 }
Paul Bakkerb08e6842012-02-11 18:43:20 +00001052
Paul Bakkerbd51b262014-07-10 15:26:12 +02001053exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001054 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001055 USE_PSA_DONE();
Paul Bakker37940d9f2009-07-10 22:38:58 +00001056}
Paul Bakker33b43f12013-08-20 11:48:36 +02001057/* END_CASE */
Paul Bakker37940d9f2009-07-10 22:38:58 +00001058
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001059/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001060void mbedtls_x509_time_is_future(char *crt_file, char *entity, int result)
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001061{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001062 mbedtls_x509_crt crt;
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001063
Gilles Peskine449bd832023-01-11 14:50:10 +01001064 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001065 USE_PSA_INIT();
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001066
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001067 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001068
Gilles Peskine449bd832023-01-11 14:50:10 +01001069 if (strcmp(entity, "valid_from") == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001070 TEST_EQUAL(mbedtls_x509_time_is_future(&crt.valid_from), result);
Gilles Peskine449bd832023-01-11 14:50:10 +01001071 } else if (strcmp(entity, "valid_to") == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001072 TEST_EQUAL(mbedtls_x509_time_is_future(&crt.valid_to), result);
Gilles Peskine449bd832023-01-11 14:50:10 +01001073 } else {
Agathiyan Bragadeesh763b3532023-07-27 13:52:31 +01001074 TEST_FAIL("Unknown entity");
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 }
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001076
Paul Bakkerbd51b262014-07-10 15:26:12 +02001077exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001078 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001079 USE_PSA_DONE();
Manuel Pégourié-Gonnard6304f782014-03-10 12:26:11 +01001080}
1081/* END_CASE */
1082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001083/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_FS_IO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001084void x509parse_crt_file(char *crt_file, int result)
Paul Bakker5a5fa922014-09-26 14:53:04 +02001085{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001086 mbedtls_x509_crt crt;
Paul Bakker5a5fa922014-09-26 14:53:04 +02001087
Gilles Peskine449bd832023-01-11 14:50:10 +01001088 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001089 USE_PSA_INIT();
Paul Bakker5a5fa922014-09-26 14:53:04 +02001090
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001091 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), result);
Paul Bakker5a5fa922014-09-26 14:53:04 +02001092
1093exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001094 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001095 USE_PSA_DONE();
Paul Bakker5a5fa922014-09-26 14:53:04 +02001096}
1097/* END_CASE */
1098
Minos Galanakisa83ada42024-01-19 10:59:07 +00001099/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_FS_IO */
1100void mbedtls_x509_get_ca_istrue(char *crt_file, int result)
1101{
1102 mbedtls_x509_crt crt;
1103 mbedtls_x509_crt_init(&crt);
1104 USE_PSA_INIT();
1105
1106 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
1107 TEST_EQUAL(mbedtls_x509_crt_get_ca_istrue(&crt), result);
1108exit:
1109 mbedtls_x509_crt_free(&crt);
1110 USE_PSA_DONE();
1111}
1112/* END_CASE */
1113
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001114/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001115void x509parse_crt(data_t *buf, char *result_str, int result)
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001116{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001117 mbedtls_x509_crt crt;
Hanno Becker612a2f12020-10-09 09:19:39 +01001118#if !defined(MBEDTLS_X509_REMOVE_INFO)
Hanno Beckerfff2d572020-10-09 09:45:19 +01001119 unsigned char output[2000] = { 0 };
Azim Khanf1aaec92017-05-30 14:23:15 +01001120 int res;
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001121#else
1122 ((void) result_str);
Peter Kolbus9a969b62018-12-11 13:55:56 -06001123#endif
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001124
Gilles Peskine449bd832023-01-11 14:50:10 +01001125 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001126 USE_PSA_INIT();
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001127
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001128 TEST_EQUAL(mbedtls_x509_crt_parse_der(&crt, buf->x, buf->len), result);
Hanno Becker612a2f12020-10-09 09:19:39 +01001129#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 if ((result) == 0) {
1131 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
1132 TEST_ASSERT(res != -1);
1133 TEST_ASSERT(res != -2);
Hanno Becker2d8a2c02019-01-31 09:15:53 +00001134
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001135 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Hanno Becker2d8a2c02019-01-31 09:15:53 +00001136 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001137 memset(output, 0, 2000);
Peter Kolbus9a969b62018-12-11 13:55:56 -06001138#endif
Hanno Becker2d8a2c02019-01-31 09:15:53 +00001139
Gilles Peskine449bd832023-01-11 14:50:10 +01001140 mbedtls_x509_crt_free(&crt);
1141 mbedtls_x509_crt_init(&crt);
Hanno Becker2d8a2c02019-01-31 09:15:53 +00001142
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001143 TEST_EQUAL(mbedtls_x509_crt_parse_der_nocopy(&crt, buf->x, buf->len), result);
Hanno Becker612a2f12020-10-09 09:19:39 +01001144#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001145 if ((result) == 0) {
1146 memset(output, 0, 2000);
Peter Kolbus9a969b62018-12-11 13:55:56 -06001147
Gilles Peskine449bd832023-01-11 14:50:10 +01001148 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
Paul Bakker33b43f12013-08-20 11:48:36 +02001149
Gilles Peskine449bd832023-01-11 14:50:10 +01001150 TEST_ASSERT(res != -1);
1151 TEST_ASSERT(res != -2);
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001152
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001153 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001154 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001155 memset(output, 0, 2000);
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001156#endif /* !MBEDTLS_X509_REMOVE_INFO */
Paul Bakkerb08e6842012-02-11 18:43:20 +00001157
Gilles Peskine449bd832023-01-11 14:50:10 +01001158 mbedtls_x509_crt_free(&crt);
1159 mbedtls_x509_crt_init(&crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001160
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001161 TEST_EQUAL(mbedtls_x509_crt_parse_der_with_ext_cb(&crt, buf->x, buf->len, 0, NULL, NULL),
1162 result);
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001163#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 if ((result) == 0) {
1165 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001166
Gilles Peskine449bd832023-01-11 14:50:10 +01001167 TEST_ASSERT(res != -1);
1168 TEST_ASSERT(res != -2);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001169
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001170 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001171 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001172 memset(output, 0, 2000);
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001173#endif /* !MBEDTLS_X509_REMOVE_INFO */
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001174
Gilles Peskine449bd832023-01-11 14:50:10 +01001175 mbedtls_x509_crt_free(&crt);
1176 mbedtls_x509_crt_init(&crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001177
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001178 TEST_EQUAL(mbedtls_x509_crt_parse_der_with_ext_cb(&crt, buf->x, buf->len, 1, NULL, NULL),
1179 result);
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001180#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001181 if ((result) == 0) {
1182 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001183
Gilles Peskine449bd832023-01-11 14:50:10 +01001184 TEST_ASSERT(res != -1);
1185 TEST_ASSERT(res != -2);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001186
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001187 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001188 }
Hanno Beckerb4e5ddc2020-10-09 09:36:01 +01001189#endif /* !MBEDTLS_X509_REMOVE_INFO */
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001190
1191exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001192 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001193 USE_PSA_DONE();
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001194}
1195/* END_CASE */
1196
1197/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001198void x509parse_crt_cb(data_t *buf, char *result_str, int result)
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001199{
1200 mbedtls_x509_crt crt;
Nicola Di Lietoe58b4632020-05-29 22:58:25 +02001201 mbedtls_x509_buf oid;
Hanno Beckerfff2d572020-10-09 09:45:19 +01001202
1203#if !defined(MBEDTLS_X509_REMOVE_INFO)
1204 unsigned char output[2000] = { 0 };
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001205 int res;
Hanno Beckerfff2d572020-10-09 09:45:19 +01001206#else
1207 ((void) result_str);
1208#endif
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001209
Nicola Di Lietoe58b4632020-05-29 22:58:25 +02001210 oid.tag = MBEDTLS_ASN1_OID;
1211 oid.len = MBEDTLS_OID_SIZE(MBEDTLS_OID_PKIX "\x01\x1F");
Gilles Peskine449bd832023-01-11 14:50:10 +01001212 oid.p = (unsigned char *) MBEDTLS_OID_PKIX "\x01\x1F";
Nicola Di Lietoe58b4632020-05-29 22:58:25 +02001213
Gilles Peskine449bd832023-01-11 14:50:10 +01001214 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001215 USE_PSA_INIT();
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001216
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001217 TEST_EQUAL(mbedtls_x509_crt_parse_der_with_ext_cb(&crt, buf->x, buf->len, 0, parse_crt_ext_cb,
1218 &oid), result);
Hanno Beckerfff2d572020-10-09 09:45:19 +01001219#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001220 if ((result) == 0) {
1221 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001222
Gilles Peskine449bd832023-01-11 14:50:10 +01001223 TEST_ASSERT(res != -1);
1224 TEST_ASSERT(res != -2);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001225
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001226 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001227 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001228 memset(output, 0, 2000);
Hanno Beckerfff2d572020-10-09 09:45:19 +01001229#endif /* !MBEDTLS_X509_REMOVE_INFO */
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001230
Gilles Peskine449bd832023-01-11 14:50:10 +01001231 mbedtls_x509_crt_free(&crt);
1232 mbedtls_x509_crt_init(&crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001233
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001234 TEST_EQUAL(mbedtls_x509_crt_parse_der_with_ext_cb(&crt, buf->x, buf->len, 1, parse_crt_ext_cb,
1235 &oid), (result));
Hanno Beckerfff2d572020-10-09 09:45:19 +01001236#if !defined(MBEDTLS_X509_REMOVE_INFO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001237 if ((result) == 0) {
1238 res = mbedtls_x509_crt_info((char *) output, 2000, "", &crt);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001239
Gilles Peskine449bd832023-01-11 14:50:10 +01001240 TEST_ASSERT(res != -1);
1241 TEST_ASSERT(res != -2);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001242
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001243 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001244 }
Hanno Beckerfff2d572020-10-09 09:45:19 +01001245#endif /* !MBEDTLS_X509_REMOVE_INFO */
Nicola Di Lieto17bb60c2020-05-28 23:04:15 +02001246
Paul Bakkerbd51b262014-07-10 15:26:12 +02001247exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001248 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001249 USE_PSA_DONE();
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001250}
Paul Bakker33b43f12013-08-20 11:48:36 +02001251/* END_CASE */
Paul Bakkerb2c38f52009-07-19 19:36:15 +00001252
Hanno Becker612a2f12020-10-09 09:19:39 +01001253/* BEGIN_CASE depends_on:MBEDTLS_X509_CRL_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001254void x509parse_crl(data_t *buf, char *result_str, int result)
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001255{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256 mbedtls_x509_crl crl;
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001257 unsigned char output[2000];
Azim Khanf1aaec92017-05-30 14:23:15 +01001258 int res;
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001259
Gilles Peskine449bd832023-01-11 14:50:10 +01001260 mbedtls_x509_crl_init(&crl);
valerio32f2ac92023-04-20 11:59:52 +02001261 USE_PSA_INIT();
1262
Gilles Peskine449bd832023-01-11 14:50:10 +01001263 memset(output, 0, 2000);
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001264
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001265
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001266 TEST_EQUAL(mbedtls_x509_crl_parse(&crl, buf->x, buf->len), (result));
Gilles Peskine449bd832023-01-11 14:50:10 +01001267 if ((result) == 0) {
1268 res = mbedtls_x509_crl_info((char *) output, 2000, "", &crl);
Paul Bakker33b43f12013-08-20 11:48:36 +02001269
Gilles Peskine449bd832023-01-11 14:50:10 +01001270 TEST_ASSERT(res != -1);
1271 TEST_ASSERT(res != -2);
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001272
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001273 TEST_EQUAL(strcmp((char *) output, result_str), 0);
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001274 }
Paul Bakkerb08e6842012-02-11 18:43:20 +00001275
Paul Bakkerbd51b262014-07-10 15:26:12 +02001276exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001277 mbedtls_x509_crl_free(&crl);
Valerio Setti569c1712023-04-19 14:53:36 +02001278 USE_PSA_DONE();
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001279}
Paul Bakker33b43f12013-08-20 11:48:36 +02001280/* END_CASE */
Paul Bakker6b0fa4f2009-07-20 20:35:41 +00001281
Hanno Becker612a2f12020-10-09 09:19:39 +01001282/* BEGIN_CASE depends_on:MBEDTLS_X509_CSR_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001283void mbedtls_x509_csr_parse(data_t *csr_der, char *ref_out, int ref_ret)
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001284{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001285 mbedtls_x509_csr csr;
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001286 char my_out[1000];
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001287 int my_ret;
1288
Gilles Peskine449bd832023-01-11 14:50:10 +01001289 mbedtls_x509_csr_init(&csr);
valerio32f2ac92023-04-20 11:59:52 +02001290 USE_PSA_INIT();
1291
Gilles Peskine449bd832023-01-11 14:50:10 +01001292 memset(my_out, 0, sizeof(my_out));
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001293
Gilles Peskine449bd832023-01-11 14:50:10 +01001294 my_ret = mbedtls_x509_csr_parse_der(&csr, csr_der->x, csr_der->len);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001295 TEST_EQUAL(my_ret, ref_ret);
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001296
Gilles Peskine449bd832023-01-11 14:50:10 +01001297 if (ref_ret == 0) {
1298 size_t my_out_len = mbedtls_x509_csr_info(my_out, sizeof(my_out), "", &csr);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001299 TEST_EQUAL(my_out_len, strlen(ref_out));
1300 TEST_EQUAL(strcmp(my_out, ref_out), 0);
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001301 }
1302
Paul Bakkerbd51b262014-07-10 15:26:12 +02001303exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001304 mbedtls_x509_csr_free(&csr);
Valerio Setti569c1712023-04-19 14:53:36 +02001305 USE_PSA_DONE();
Manuel Pégourié-Gonnardd77cd5d2014-06-13 11:13:15 +02001306}
1307/* END_CASE */
1308
Matthias Schulzab408222023-10-18 13:20:59 +02001309/* BEGIN_CASE depends_on:MBEDTLS_X509_CSR_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
1310void mbedtls_x509_csr_parse_with_ext_cb(data_t *csr_der, char *ref_out, int ref_ret, int accept)
1311{
1312 mbedtls_x509_csr csr;
1313 char my_out[1000];
1314 int my_ret;
1315
1316 mbedtls_x509_csr_init(&csr);
1317 USE_PSA_INIT();
1318
1319 memset(my_out, 0, sizeof(my_out));
1320
1321 my_ret = mbedtls_x509_csr_parse_der_with_ext_cb(&csr, csr_der->x, csr_der->len,
1322 accept ? parse_csr_ext_accept_cb :
Matthias Schulzedc32ea2023-10-19 16:09:08 +02001323 parse_csr_ext_reject_cb,
Matthias Schulzab408222023-10-18 13:20:59 +02001324 NULL);
1325 TEST_EQUAL(my_ret, ref_ret);
1326
1327 if (ref_ret == 0) {
1328 size_t my_out_len = mbedtls_x509_csr_info(my_out, sizeof(my_out), "", &csr);
1329 TEST_EQUAL(my_out_len, strlen(ref_out));
1330 TEST_EQUAL(strcmp(my_out, ref_out), 0);
1331 }
1332
1333exit:
1334 mbedtls_x509_csr_free(&csr);
1335 USE_PSA_DONE();
1336}
1337/* END_CASE */
1338
Przemek Stekield7992df2023-01-25 16:19:50 +01001339/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CSR_PARSE_C:!MBEDTLS_X509_REMOVE_INFO */
1340void mbedtls_x509_csr_parse_file(char *csr_file, char *ref_out, int ref_ret)
1341{
1342 mbedtls_x509_csr csr;
1343 char my_out[1000];
1344 int my_ret;
1345
1346 mbedtls_x509_csr_init(&csr);
valerio32f2ac92023-04-20 11:59:52 +02001347 USE_PSA_INIT();
1348
Przemek Stekield7992df2023-01-25 16:19:50 +01001349 memset(my_out, 0, sizeof(my_out));
1350
1351 my_ret = mbedtls_x509_csr_parse_file(&csr, csr_file);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001352 TEST_EQUAL(my_ret, ref_ret);
Przemek Stekield7992df2023-01-25 16:19:50 +01001353
1354 if (ref_ret == 0) {
1355 size_t my_out_len = mbedtls_x509_csr_info(my_out, sizeof(my_out), "", &csr);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001356 TEST_EQUAL(my_out_len, strlen(ref_out));
1357 TEST_EQUAL(strcmp(my_out, ref_out), 0);
Przemek Stekield7992df2023-01-25 16:19:50 +01001358 }
1359
1360exit:
1361 mbedtls_x509_csr_free(&csr);
Valerio Setti569c1712023-04-19 14:53:36 +02001362 USE_PSA_DONE();
Przemek Stekield7992df2023-01-25 16:19:50 +01001363}
1364/* END_CASE */
1365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001366/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine1e5fec62023-04-13 18:13:48 +02001367void mbedtls_x509_crt_parse_file(char *crt_path, int ret, int nb_crt)
1368{
1369 mbedtls_x509_crt chain, *cur;
1370 int i;
1371
1372 mbedtls_x509_crt_init(&chain);
1373 USE_PSA_INIT();
1374
1375 TEST_EQUAL(mbedtls_x509_crt_parse_file(&chain, crt_path), ret);
1376
1377 /* Check how many certs we got */
1378 for (i = 0, cur = &chain; cur != NULL; cur = cur->next) {
1379 if (cur->raw.p != NULL) {
1380 i++;
1381 }
1382 }
1383
1384 TEST_EQUAL(i, nb_crt);
1385
1386exit:
1387 mbedtls_x509_crt_free(&chain);
1388 USE_PSA_DONE();
1389}
1390/* END_CASE */
1391
1392/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001393void mbedtls_x509_crt_parse_path(char *crt_path, int ret, int nb_crt)
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001394{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001395 mbedtls_x509_crt chain, *cur;
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001396 int i;
1397
Gilles Peskine449bd832023-01-11 14:50:10 +01001398 mbedtls_x509_crt_init(&chain);
valerio32f2ac92023-04-20 11:59:52 +02001399 USE_PSA_INIT();
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001400
Gilles Peskine55ad28a2023-04-13 18:14:45 +02001401 TEST_EQUAL(mbedtls_x509_crt_parse_path(&chain, crt_path), ret);
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001402
1403 /* Check how many certs we got */
Gilles Peskine449bd832023-01-11 14:50:10 +01001404 for (i = 0, cur = &chain; cur != NULL; cur = cur->next) {
1405 if (cur->raw.p != NULL) {
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001406 i++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001407 }
1408 }
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001409
Gilles Peskine55ad28a2023-04-13 18:14:45 +02001410 TEST_EQUAL(i, nb_crt);
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001411
Paul Bakkerbd51b262014-07-10 15:26:12 +02001412exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001413 mbedtls_x509_crt_free(&chain);
Valerio Setti569c1712023-04-19 14:53:36 +02001414 USE_PSA_DONE();
Manuel Pégourié-Gonnardfbae2a12013-11-26 16:43:39 +01001415}
1416/* END_CASE */
1417
Janos Follath822b2c32015-10-11 10:25:22 +02001418/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001419void mbedtls_x509_crt_verify_max(char *ca_file, char *chain_dir, int nb_int,
1420 int ret_chk, int flags_chk)
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001421{
1422 char file_buf[128];
1423 int ret;
1424 uint32_t flags;
1425 mbedtls_x509_crt trusted, chain;
1426
1427 /*
1428 * We expect chain_dir to contain certificates 00.crt, 01.crt, etc.
1429 * with NN.crt signed by NN-1.crt
1430 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001431 mbedtls_x509_crt_init(&trusted);
1432 mbedtls_x509_crt_init(&chain);
valerio32f2ac92023-04-20 11:59:52 +02001433 MD_OR_USE_PSA_INIT();
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001434
1435 /* Load trusted root */
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001436 TEST_EQUAL(mbedtls_x509_crt_parse_file(&trusted, ca_file), 0);
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001437
1438 /* Load a chain with nb_int intermediates (from 01 to nb_int),
1439 * plus one "end-entity" cert (nb_int + 1) */
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001440 ret = mbedtls_snprintf(file_buf, sizeof(file_buf), "%s/c%02d.pem", chain_dir,
Gilles Peskine449bd832023-01-11 14:50:10 +01001441 nb_int + 1);
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001442 TEST_ASSERT(ret > 0 && (size_t) ret < sizeof(file_buf));
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001443 TEST_EQUAL(mbedtls_x509_crt_parse_file(&chain, file_buf), 0);
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001444
1445 /* Try to verify that chain */
Gilles Peskine449bd832023-01-11 14:50:10 +01001446 ret = mbedtls_x509_crt_verify(&chain, &trusted, NULL, NULL, &flags,
1447 NULL, NULL);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001448 TEST_EQUAL(ret, ret_chk);
1449 TEST_EQUAL(flags, (uint32_t) flags_chk);
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001450
1451exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001452 mbedtls_x509_crt_free(&chain);
1453 mbedtls_x509_crt_free(&trusted);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +01001454 MD_OR_USE_PSA_DONE();
Manuel Pégourié-Gonnard1beb0482017-06-05 13:49:44 +02001455}
1456/* END_CASE */
1457
1458/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001459void mbedtls_x509_crt_verify_chain(char *chain_paths, char *trusted_ca,
1460 int flags_result, int result,
1461 char *profile_name, int vrfy_fatal_lvls)
Janos Follath822b2c32015-10-11 10:25:22 +02001462{
Gilles Peskine449bd832023-01-11 14:50:10 +01001463 char *act;
Janos Follath822b2c32015-10-11 10:25:22 +02001464 uint32_t flags;
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001465 int res;
Manuel Pégourié-Gonnarde670f902015-10-30 09:23:19 +01001466 mbedtls_x509_crt trusted, chain;
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001467 const mbedtls_x509_crt_profile *profile = NULL;
Janos Follathef4f2582015-10-11 16:17:27 +02001468
Gilles Peskine449bd832023-01-11 14:50:10 +01001469 mbedtls_x509_crt_init(&chain);
1470 mbedtls_x509_crt_init(&trusted);
valerio32f2ac92023-04-20 11:59:52 +02001471 MD_OR_USE_PSA_INIT();
Janos Follath822b2c32015-10-11 10:25:22 +02001472
Gilles Peskine449bd832023-01-11 14:50:10 +01001473 while ((act = mystrsep(&chain_paths, " ")) != NULL) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001474 TEST_EQUAL(mbedtls_x509_crt_parse_file(&chain, act), 0);
Gilles Peskine449bd832023-01-11 14:50:10 +01001475 }
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001476 TEST_EQUAL(mbedtls_x509_crt_parse_file(&trusted, trusted_ca), 0);
Janos Follath822b2c32015-10-11 10:25:22 +02001477
Gilles Peskine449bd832023-01-11 14:50:10 +01001478 if (strcmp(profile_name, "") == 0) {
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001479 profile = &mbedtls_x509_crt_profile_default;
Gilles Peskine449bd832023-01-11 14:50:10 +01001480 } else if (strcmp(profile_name, "next") == 0) {
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001481 profile = &mbedtls_x509_crt_profile_next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001482 } else if (strcmp(profile_name, "suiteb") == 0) {
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001483 profile = &mbedtls_x509_crt_profile_suiteb;
Gilles Peskine449bd832023-01-11 14:50:10 +01001484 } else if (strcmp(profile_name, "rsa3072") == 0) {
Manuel Pégourié-Gonnard6622fed2017-05-23 11:29:29 +02001485 profile = &profile_rsa3072;
Gilles Peskine449bd832023-01-11 14:50:10 +01001486 } else if (strcmp(profile_name, "sha512") == 0) {
Manuel Pégourié-Gonnard6622fed2017-05-23 11:29:29 +02001487 profile = &profile_sha512;
Gilles Peskine449bd832023-01-11 14:50:10 +01001488 }
Manuel Pégourié-Gonnarde54931f2017-05-22 12:04:25 +02001489
Gilles Peskine449bd832023-01-11 14:50:10 +01001490 res = mbedtls_x509_crt_verify_with_profile(&chain, &trusted, NULL, profile,
1491 NULL, &flags, verify_fatal, &vrfy_fatal_lvls);
Janos Follathef4f2582015-10-11 16:17:27 +02001492
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001493 TEST_EQUAL(res, (result));
1494 TEST_EQUAL(flags, (uint32_t) (flags_result));
Janos Follath822b2c32015-10-11 10:25:22 +02001495
1496exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 mbedtls_x509_crt_free(&trusted);
1498 mbedtls_x509_crt_free(&chain);
Manuel Pégourié-Gonnard33a13022023-03-17 14:02:49 +01001499 MD_OR_USE_PSA_DONE();
Janos Follath822b2c32015-10-11 10:25:22 +02001500}
1501/* END_CASE */
1502
Hanno Becker612a2f12020-10-09 09:19:39 +01001503/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C:!MBEDTLS_X509_REMOVE_INFO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001504void x509_oid_desc(data_t *buf, char *ref_desc)
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001505{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001506 mbedtls_x509_buf oid;
Manuel Pégourié-Gonnard48d3cef2015-03-20 18:14:26 +00001507 const char *desc = NULL;
Manuel Pégourié-Gonnard48d3cef2015-03-20 18:14:26 +00001508 int ret;
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001509
Valerio Setti569c1712023-04-19 14:53:36 +02001510 USE_PSA_INIT();
valerio32f2ac92023-04-20 11:59:52 +02001511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001512 oid.tag = MBEDTLS_ASN1_OID;
Azim Khand30ca132017-06-09 04:32:58 +01001513 oid.p = buf->x;
1514 oid.len = buf->len;
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001515
Gilles Peskine449bd832023-01-11 14:50:10 +01001516 ret = mbedtls_oid_get_extended_key_usage(&oid, &desc);
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001517
Gilles Peskine449bd832023-01-11 14:50:10 +01001518 if (strcmp(ref_desc, "notfound") == 0) {
1519 TEST_ASSERT(ret != 0);
1520 TEST_ASSERT(desc == NULL);
1521 } else {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001522 TEST_EQUAL(ret, 0);
Gilles Peskine449bd832023-01-11 14:50:10 +01001523 TEST_ASSERT(desc != NULL);
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001524 TEST_EQUAL(strcmp(desc, ref_desc), 0);
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001525 }
valerio32f2ac92023-04-20 11:59:52 +02001526
1527exit:
Valerio Setti569c1712023-04-19 14:53:36 +02001528 USE_PSA_DONE();
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001529}
1530/* END_CASE */
1531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001532/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001533void x509_oid_numstr(data_t *oid_buf, char *numstr, int blen, int ret)
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001534{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001535 mbedtls_x509_buf oid;
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001536 char num_buf[100];
1537
Valerio Setti569c1712023-04-19 14:53:36 +02001538 USE_PSA_INIT();
valerio32f2ac92023-04-20 11:59:52 +02001539
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001540 memset(num_buf, 0x2a, sizeof(num_buf));
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001542 oid.tag = MBEDTLS_ASN1_OID;
Azim Khand30ca132017-06-09 04:32:58 +01001543 oid.p = oid_buf->x;
1544 oid.len = oid_buf->len;
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001545
Dave Rodgman6dd757a2023-02-02 12:40:50 +00001546 TEST_ASSERT((size_t) blen <= sizeof(num_buf));
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001547
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001548 TEST_EQUAL(mbedtls_oid_get_numeric_string(num_buf, blen, &oid), ret);
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001549
Gilles Peskine449bd832023-01-11 14:50:10 +01001550 if (ret >= 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001551 TEST_EQUAL(num_buf[ret], 0);
1552 TEST_EQUAL(strcmp(num_buf, numstr), 0);
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001553 }
valerio32f2ac92023-04-20 11:59:52 +02001554
1555exit:
Valerio Setti569c1712023-04-19 14:53:36 +02001556 USE_PSA_DONE();
Manuel Pégourié-Gonnard7afdb882014-03-28 16:06:35 +01001557}
1558/* END_CASE */
1559
TRodziewicz442fdc22021-06-07 13:52:23 +02001560/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001561void x509_check_key_usage(char *crt_file, int usage, int ret)
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001562{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001563 mbedtls_x509_crt crt;
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001564
Gilles Peskine449bd832023-01-11 14:50:10 +01001565 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001566 USE_PSA_INIT();
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001567
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001568 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001569
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001570 TEST_EQUAL(mbedtls_x509_crt_check_key_usage(&crt, usage), ret);
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001571
Paul Bakkerbd51b262014-07-10 15:26:12 +02001572exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001573 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001574 USE_PSA_DONE();
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001575}
1576/* END_CASE */
1577
TRodziewicz442fdc22021-06-07 13:52:23 +02001578/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001579void x509_check_extended_key_usage(char *crt_file, data_t *oid, int ret
1580 )
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001581{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582 mbedtls_x509_crt crt;
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001583
Gilles Peskine449bd832023-01-11 14:50:10 +01001584 mbedtls_x509_crt_init(&crt);
valerio32f2ac92023-04-20 11:59:52 +02001585 USE_PSA_INIT();
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001586
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001587 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, crt_file), 0);
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001588
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001589 TEST_EQUAL(mbedtls_x509_crt_check_extended_key_usage(&crt, (const char *) oid->x, oid->len),
1590 ret);
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001591
Paul Bakkerbd51b262014-07-10 15:26:12 +02001592exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01001593 mbedtls_x509_crt_free(&crt);
Valerio Setti569c1712023-04-19 14:53:36 +02001594 USE_PSA_DONE();
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001595}
1596/* END_CASE */
1597
Andres AG4b76aec2016-09-23 13:16:02 +01001598/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01001599void x509_get_time(int tag, char *time_str, int ret, int year, int mon,
1600 int day, int hour, int min, int sec)
Andres AG4b76aec2016-09-23 13:16:02 +01001601{
1602 mbedtls_x509_time time;
Janos Follathea7054a2017-02-08 14:13:02 +00001603 unsigned char buf[21];
Gilles Peskine449bd832023-01-11 14:50:10 +01001604 unsigned char *start = buf;
1605 unsigned char *end = buf;
Andres AG4b76aec2016-09-23 13:16:02 +01001606
Valerio Setti569c1712023-04-19 14:53:36 +02001607 USE_PSA_INIT();
Gilles Peskine449bd832023-01-11 14:50:10 +01001608 memset(&time, 0x00, sizeof(time));
1609 *end = (unsigned char) tag; end++;
1610 *end = strlen(time_str);
1611 TEST_ASSERT(*end < 20);
Andres AG4b76aec2016-09-23 13:16:02 +01001612 end++;
Gilles Peskine449bd832023-01-11 14:50:10 +01001613 memcpy(end, time_str, (size_t) *(end - 1));
Andres AG4b76aec2016-09-23 13:16:02 +01001614 end += *(end - 1);
1615
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001616 TEST_EQUAL(mbedtls_x509_get_time(&start, end, &time), ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001617 if (ret == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001618 TEST_EQUAL(year, time.year);
1619 TEST_EQUAL(mon, time.mon);
1620 TEST_EQUAL(day, time.day);
1621 TEST_EQUAL(hour, time.hour);
1622 TEST_EQUAL(min, time.min);
1623 TEST_EQUAL(sec, time.sec);
Andres AG4b76aec2016-09-23 13:16:02 +01001624 }
valerio32f2ac92023-04-20 11:59:52 +02001625exit:
Valerio Setti569c1712023-04-19 14:53:36 +02001626 USE_PSA_DONE();
Andres AG4b76aec2016-09-23 13:16:02 +01001627}
1628/* END_CASE */
1629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001630/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gilles Peskine449bd832023-01-11 14:50:10 +01001631void x509_parse_rsassa_pss_params(data_t *params, int params_tag,
1632 int ref_msg_md, int ref_mgf_md,
1633 int ref_salt_len, int ref_ret)
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001634{
1635 int my_ret;
Ronald Cronac6ae352020-06-26 14:33:03 +02001636 mbedtls_x509_buf buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637 mbedtls_md_type_t my_msg_md, my_mgf_md;
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001638 int my_salt_len;
1639
Valerio Setti569c1712023-04-19 14:53:36 +02001640 USE_PSA_INIT();
1641
Ronald Cronac6ae352020-06-26 14:33:03 +02001642 buf.p = params->x;
1643 buf.len = params->len;
1644 buf.tag = params_tag;
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001645
Gilles Peskine449bd832023-01-11 14:50:10 +01001646 my_ret = mbedtls_x509_get_rsassa_pss_params(&buf, &my_msg_md, &my_mgf_md,
1647 &my_salt_len);
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001648
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001649 TEST_EQUAL(my_ret, ref_ret);
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001650
Gilles Peskine449bd832023-01-11 14:50:10 +01001651 if (ref_ret == 0) {
Demi Marie Obenour16442cc2022-11-26 22:19:48 -05001652 TEST_EQUAL(my_msg_md, (mbedtls_md_type_t) ref_msg_md);
1653 TEST_EQUAL(my_mgf_md, (mbedtls_md_type_t) ref_mgf_md);
1654 TEST_EQUAL(my_salt_len, ref_salt_len);
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001655 }
1656
Paul Bakkerbd51b262014-07-10 15:26:12 +02001657exit:
Valerio Setti569c1712023-04-19 14:53:36 +02001658 USE_PSA_DONE();
Manuel Pégourié-Gonnard85403692014-06-06 14:48:38 +02001659}
1660/* END_CASE */
toth92ga41954d2021-02-12 16:11:17 +01001661
Przemek Stekiel05d5c3e2023-05-16 16:24:44 +02001662/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_FS_IO */
Przemek Stekiel0ad10062023-04-06 11:11:58 +02001663void x509_crt_parse_subjectkeyid(char *file, data_t *subjectKeyId, int ref_ret)
toth92ga41954d2021-02-12 16:11:17 +01001664{
1665 mbedtls_x509_crt crt;
toth92ga41954d2021-02-12 16:11:17 +01001666
1667 mbedtls_x509_crt_init(&crt);
1668
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001669 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, file), ref_ret);
toth92ga41954d2021-02-12 16:11:17 +01001670
toth92g357b2972021-05-04 15:41:35 +02001671 if (ref_ret == 0) {
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001672 TEST_EQUAL(crt.subject_key_id.tag, MBEDTLS_ASN1_OCTET_STRING);
1673 TEST_EQUAL(memcmp(crt.subject_key_id.p, subjectKeyId->x, subjectKeyId->len), 0);
1674 TEST_EQUAL(crt.subject_key_id.len, subjectKeyId->len);
toth92g357b2972021-05-04 15:41:35 +02001675 } else {
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001676 TEST_EQUAL(crt.subject_key_id.tag, 0);
1677 TEST_EQUAL(crt.subject_key_id.len, 0);
toth92ga41954d2021-02-12 16:11:17 +01001678 }
1679
1680exit:
1681 mbedtls_x509_crt_free(&crt);
1682}
1683/* END_CASE */
1684
Przemek Stekiel05d5c3e2023-05-16 16:24:44 +02001685/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_FS_IO */
Przemek Stekiel2568d472023-04-06 09:23:25 +02001686void x509_crt_parse_authoritykeyid(char *file,
Przemek Stekielff9c2992023-05-16 19:14:19 +02001687 data_t *keyId,
toth92g5042b102021-05-06 08:22:17 +02001688 char *authorityKeyId_issuer,
Przemek Stekielff9c2992023-05-16 19:14:19 +02001689 data_t *serial,
toth92g5042b102021-05-06 08:22:17 +02001690 int ref_ret)
toth92ga41954d2021-02-12 16:11:17 +01001691{
1692 mbedtls_x509_crt crt;
Przemek Stekiel39dbe232023-04-03 10:19:22 +02001693 mbedtls_x509_subject_alternative_name san;
David Horstmann9a3a1a62023-06-22 16:59:09 +01001694 char name_buf[128];
toth92ga41954d2021-02-12 16:11:17 +01001695
1696 mbedtls_x509_crt_init(&crt);
1697
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001698 TEST_EQUAL(mbedtls_x509_crt_parse_file(&crt, file), ref_ret);
toth92ga41954d2021-02-12 16:11:17 +01001699
toth92g357b2972021-05-04 15:41:35 +02001700 if (ref_ret == 0) {
toth92ga41954d2021-02-12 16:11:17 +01001701 /* KeyId test */
Przemek Stekielff9c2992023-05-16 19:14:19 +02001702 if (keyId->len > 0) {
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001703 TEST_EQUAL(crt.authority_key_id.keyIdentifier.tag, MBEDTLS_ASN1_OCTET_STRING);
1704 TEST_EQUAL(memcmp(crt.authority_key_id.keyIdentifier.p, keyId->x, keyId->len), 0);
1705 TEST_EQUAL(crt.authority_key_id.keyIdentifier.len, keyId->len);
Przemek Stekiel05d5c3e2023-05-16 16:24:44 +02001706 } else {
1707 TEST_EQUAL(crt.authority_key_id.keyIdentifier.tag, 0);
1708 TEST_EQUAL(crt.authority_key_id.keyIdentifier.len, 0);
Przemek Stekiel1969f6a2023-04-18 08:38:16 +02001709 }
toth92ga41954d2021-02-12 16:11:17 +01001710
Przemek Stekiel05d5c3e2023-05-16 16:24:44 +02001711
toth92ga41954d2021-02-12 16:11:17 +01001712 /* Issuer test */
Przemek Stekielff9c2992023-05-16 19:14:19 +02001713 if (strlen(authorityKeyId_issuer) > 0) {
Przemek Stekiel1969f6a2023-04-18 08:38:16 +02001714 mbedtls_x509_sequence *issuerPtr = &crt.authority_key_id.authorityCertIssuer;
Przemek Stekiel01984212023-02-09 09:29:34 +01001715
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001716 TEST_EQUAL(mbedtls_x509_parse_subject_alt_name(&issuerPtr->buf, &san), 0);
Przemek Stekiel01984212023-02-09 09:29:34 +01001717
David Horstmann9a3a1a62023-06-22 16:59:09 +01001718 TEST_ASSERT(mbedtls_x509_dn_gets(name_buf, sizeof(name_buf),
1719 &san.san.directory_name)
1720 > 0);
1721 TEST_EQUAL(strcmp(name_buf, authorityKeyId_issuer), 0);
Przemek Stekiel01984212023-02-09 09:29:34 +01001722
Przemek Stekiel1969f6a2023-04-18 08:38:16 +02001723 mbedtls_x509_free_subject_alt_name(&san);
toth92ga41954d2021-02-12 16:11:17 +01001724 }
1725
1726 /* Serial test */
Przemek Stekielff9c2992023-05-16 19:14:19 +02001727 if (serial->len > 0) {
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001728 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.tag,
Przemek Stekielff9c2992023-05-16 19:14:19 +02001729 MBEDTLS_ASN1_INTEGER);
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001730 TEST_EQUAL(memcmp(crt.authority_key_id.authorityCertSerialNumber.p,
Przemek Stekielff9c2992023-05-16 19:14:19 +02001731 serial->x, serial->len), 0);
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001732 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.len, serial->len);
Przemek Stekiel05d5c3e2023-05-16 16:24:44 +02001733 } else {
1734 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.tag, 0);
1735 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.len, 0);
Przemek Stekiel1969f6a2023-04-18 08:38:16 +02001736 }
Przemek Stekiel0ad10062023-04-06 11:11:58 +02001737
toth92g357b2972021-05-04 15:41:35 +02001738 } else {
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001739 TEST_EQUAL(crt.authority_key_id.keyIdentifier.tag, 0);
1740 TEST_EQUAL(crt.authority_key_id.keyIdentifier.len, 0);
toth92ga41954d2021-02-12 16:11:17 +01001741
Przemek Stekiela6a0a792023-04-24 10:18:52 +02001742 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.tag, 0);
1743 TEST_EQUAL(crt.authority_key_id.authorityCertSerialNumber.len, 0);
toth92ga41954d2021-02-12 16:11:17 +01001744 }
1745
1746exit:
1747 mbedtls_x509_crt_free(&crt);
1748}
1749/* END_CASE */