blob: f1c4c6654e6754d916cb84eda61ba2cd1b558efc [file] [log] [blame]
Paul Bakker7c6b2c32013-09-16 13:49:26 +02001/*
2 * X.509 Certificate Signing Request (CSR) parsing
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker7c6b2c32013-09-16 13:49:26 +020018 */
19/*
20 * The ITU-T X.509 standard defines a certificate format for PKI.
21 *
Manuel Pégourié-Gonnard1c082f32014-06-12 22:34:55 +020022 * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
23 * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
24 * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020025 *
26 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
27 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
28 */
29
Gilles Peskinedb09ef62020-06-03 01:43:33 +020030#include "common.h"
Paul Bakker7c6b2c32013-09-16 13:49:26 +020031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_X509_CSR_PARSE_C)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020033
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000034#include "mbedtls/x509_csr.h"
Janos Follath73c616b2019-12-18 15:07:04 +000035#include "mbedtls/error.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000036#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050037#include "mbedtls/platform_util.h"
Rich Evans00ab4702015-02-06 13:43:58 +000038
39#include <string.h>
40
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020041#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000042#include "mbedtls/pem.h"
Paul Bakker7c6b2c32013-09-16 13:49:26 +020043#endif
Paul Bakker7c6b2c32013-09-16 13:49:26 +020044
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/platform.h"
Paul Bakker7c6b2c32013-09-16 13:49:26 +020046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020047#if defined(MBEDTLS_FS_IO) || defined(EFIX64) || defined(EFI32)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020048#include <stdio.h>
49#endif
50
51/*
52 * Version ::= INTEGER { v1(0) }
53 */
Gilles Peskine449bd832023-01-11 14:50:10 +010054static int x509_csr_get_version(unsigned char **p,
55 const unsigned char *end,
56 int *ver)
Paul Bakker7c6b2c32013-09-16 13:49:26 +020057{
Janos Follath865b3eb2019-12-16 11:46:15 +000058 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020059
Gilles Peskine449bd832023-01-11 14:50:10 +010060 if ((ret = mbedtls_asn1_get_int(p, end, ver)) != 0) {
61 if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
Paul Bakker7c6b2c32013-09-16 13:49:26 +020062 *ver = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +010063 return 0;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020064 }
65
Gilles Peskine449bd832023-01-11 14:50:10 +010066 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_VERSION, ret);
Paul Bakker7c6b2c32013-09-16 13:49:26 +020067 }
68
Gilles Peskine449bd832023-01-11 14:50:10 +010069 return 0;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020070}
71
72/*
Jens Alfke2d9e3592019-10-29 15:03:37 -070073 * Parse CSR extension requests in DER format
74 */
75static int x509_csr_parse_extensions(mbedtls_x509_csr *csr,
76 unsigned char **p, const unsigned char *end)
77{
78 int ret;
79 size_t len;
80 unsigned char *end_ext_data;
81
82 while (*p < end) {
83 mbedtls_x509_buf extn_oid = { 0, 0, NULL };
84 int ext_type = 0;
85
86 /* Read sequence tag */
87 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
88 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
89 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
90 }
91
92 end_ext_data = *p + len;
93
94 /* Get extension ID */
95 if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &extn_oid.len,
96 MBEDTLS_ASN1_OID)) != 0) {
97 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
98 }
99
100 extn_oid.tag = MBEDTLS_ASN1_OID;
101 extn_oid.p = *p;
102 *p += extn_oid.len;
103
104 /* Data should be octet string type */
105 if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
106 MBEDTLS_ASN1_OCTET_STRING)) != 0) {
107 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
108 }
109 if (*p + len != end_ext_data) {
110 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
111 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
112 }
113
Przemek Stekielcbaf3162023-01-12 12:58:02 +0100114 /*
115 * Detect supported extensions
116 */
117 ret = mbedtls_oid_get_x509_ext_type(&extn_oid, &ext_type);
118
119 if (ret == 0) {
120 /* Forbid repeated extensions */
121 if ((csr->ext_types & ext_type) != 0) {
122 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS;
123 }
124
125 csr->ext_types |= ext_type;
126
Jens Alfke2d9e3592019-10-29 15:03:37 -0700127 switch (ext_type) {
128 case MBEDTLS_X509_EXT_KEY_USAGE:
129 /* Parse key usage */
130 if ((ret = x509_get_key_usage(p, end_ext_data,
131 &csr->key_usage)) != 0) {
132 return ret;
133 }
134 break;
135
136 case MBEDTLS_X509_EXT_SUBJECT_ALT_NAME:
137 /* Parse subject alt name */
138 if ((ret = x509_get_subject_alt_name(p, end_ext_data,
139 &csr->subject_alt_names)) != 0) {
140 return ret;
141 }
142 break;
143
144 case MBEDTLS_X509_EXT_NS_CERT_TYPE:
145 /* Parse netscape certificate type */
146 if ((ret = x509_get_ns_cert_type(p, end_ext_data,
147 &csr->ns_cert_type)) != 0) {
148 return ret;
149 }
150 break;
151 default:
152 break;
153 }
154 }
155
156 *p = end_ext_data;
157 }
158
159 if (*p != end) {
160 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
161 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
162 }
163
164 return 0;
165}
166
167/*
168 * Parse CSR attributes in DER format
169 */
170static int x509_csr_parse_attributes(mbedtls_x509_csr *csr,
171 const unsigned char *start, const unsigned char *end)
172{
173 int ret;
174 size_t len;
175 unsigned char *end_attr_data;
176 unsigned char **p = (unsigned char **) &start;
177
178 while (*p < end) {
179 mbedtls_x509_buf attr_oid = { 0, 0, NULL };
180
181 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
182 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
183 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
184 }
185 end_attr_data = *p + len;
186
187 /* Get attribute ID */
188 if ((ret = mbedtls_asn1_get_tag(p, end_attr_data, &attr_oid.len,
189 MBEDTLS_ASN1_OID)) != 0) {
190 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
191 }
192
193 attr_oid.tag = MBEDTLS_ASN1_OID;
194 attr_oid.p = *p;
195 *p += attr_oid.len;
196
197 /* Check that this is an extension-request attribute */
198 if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS9_CSR_EXT_REQ, &attr_oid) == 0) {
199 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
200 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET)) != 0) {
201 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
202 }
203
204 if ((ret = mbedtls_asn1_get_tag(p, end, &len,
205 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) !=
206 0) {
207 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
208 }
209
210 if ((ret = x509_csr_parse_extensions(csr, p, *p + len)) != 0) {
211 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret;
212 }
213
214 if (*p != end_attr_data) {
215 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
216 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
217 }
218 }
219
220 *p = end_attr_data;
221 }
222
223 if (*p != end) {
224 return MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
225 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
226 }
227
228 return 0;
229}
230
231/*
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200232 * Parse a CSR in DER format
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200233 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100234int mbedtls_x509_csr_parse_der(mbedtls_x509_csr *csr,
235 const unsigned char *buf, size_t buflen)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200236{
Janos Follath865b3eb2019-12-16 11:46:15 +0000237 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200238 size_t len;
239 unsigned char *p, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200240 mbedtls_x509_buf sig_params;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200241
Gilles Peskine449bd832023-01-11 14:50:10 +0100242 memset(&sig_params, 0, sizeof(mbedtls_x509_buf));
Manuel Pégourié-Gonnarddddbb1d2014-06-05 17:02:24 +0200243
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200244 /*
245 * Check for valid input
246 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 if (csr == NULL || buf == NULL || buflen == 0) {
248 return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
249 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200250
Gilles Peskine449bd832023-01-11 14:50:10 +0100251 mbedtls_x509_csr_init(csr);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200252
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200253 /*
254 * first copy the raw DER data
255 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 p = mbedtls_calloc(1, len = buflen);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200257
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 if (p == NULL) {
259 return MBEDTLS_ERR_X509_ALLOC_FAILED;
260 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200261
Gilles Peskine449bd832023-01-11 14:50:10 +0100262 memcpy(p, buf, buflen);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200263
264 csr->raw.p = p;
265 csr->raw.len = len;
266 end = p + len;
267
268 /*
269 * CertificationRequest ::= SEQUENCE {
270 * certificationRequestInfo CertificationRequestInfo,
271 * signatureAlgorithm AlgorithmIdentifier,
272 * signature BIT STRING
273 * }
274 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100275 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
276 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
277 mbedtls_x509_csr_free(csr);
278 return MBEDTLS_ERR_X509_INVALID_FORMAT;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200279 }
280
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 if (len != (size_t) (end - p)) {
282 mbedtls_x509_csr_free(csr);
283 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
284 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200285 }
286
287 /*
288 * CertificationRequestInfo ::= SEQUENCE {
289 */
290 csr->cri.p = p;
291
Gilles Peskine449bd832023-01-11 14:50:10 +0100292 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
293 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
294 mbedtls_x509_csr_free(csr);
295 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200296 }
297
298 end = p + len;
299 csr->cri.len = end - csr->cri.p;
300
301 /*
302 * Version ::= INTEGER { v1(0) }
303 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 if ((ret = x509_csr_get_version(&p, end, &csr->version)) != 0) {
305 mbedtls_x509_csr_free(csr);
306 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200307 }
308
Gilles Peskine449bd832023-01-11 14:50:10 +0100309 if (csr->version != 0) {
310 mbedtls_x509_csr_free(csr);
311 return MBEDTLS_ERR_X509_UNKNOWN_VERSION;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200312 }
313
Andres AG2e3ddfa2017-02-17 13:54:43 +0000314 csr->version++;
315
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200316 /*
317 * subject Name
318 */
319 csr->subject_raw.p = p;
320
Gilles Peskine449bd832023-01-11 14:50:10 +0100321 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
322 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
323 mbedtls_x509_csr_free(csr);
324 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200325 }
326
Gilles Peskine449bd832023-01-11 14:50:10 +0100327 if ((ret = mbedtls_x509_get_name(&p, p + len, &csr->subject)) != 0) {
328 mbedtls_x509_csr_free(csr);
329 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200330 }
331
332 csr->subject_raw.len = p - csr->subject_raw.p;
333
334 /*
335 * subjectPKInfo SubjectPublicKeyInfo
336 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 if ((ret = mbedtls_pk_parse_subpubkey(&p, end, &csr->pk)) != 0) {
338 mbedtls_x509_csr_free(csr);
339 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200340 }
341
342 /*
343 * attributes [0] Attributes
Manuel Pégourié-Gonnard986bbf22016-02-24 14:36:05 +0000344 *
345 * The list of possible attributes is open-ended, though RFC 2985
346 * (PKCS#9) defines a few in section 5.4. We currently don't support any,
347 * so we just ignore them. This is a safe thing to do as the worst thing
348 * that could happen is that we issue a certificate that does not match
349 * the requester's expectations - this cannot cause a violation of our
350 * signature policies.
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200351 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100352 if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
353 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC)) !=
354 0) {
355 mbedtls_x509_csr_free(csr);
356 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200357 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200358
Jens Alfke2d9e3592019-10-29 15:03:37 -0700359 if ((ret = x509_csr_parse_attributes(csr, p, p + len)) != 0) {
360 mbedtls_x509_csr_free(csr);
361 return ret;
362 }
363
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200364 p += len;
365
366 end = csr->raw.p + csr->raw.len;
367
368 /*
369 * signatureAlgorithm AlgorithmIdentifier,
370 * signature BIT STRING
371 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 if ((ret = mbedtls_x509_get_alg(&p, end, &csr->sig_oid, &sig_params)) != 0) {
373 mbedtls_x509_csr_free(csr);
374 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200375 }
376
Gilles Peskine449bd832023-01-11 14:50:10 +0100377 if ((ret = mbedtls_x509_get_sig_alg(&csr->sig_oid, &sig_params,
378 &csr->sig_md, &csr->sig_pk,
379 &csr->sig_opts)) != 0) {
380 mbedtls_x509_csr_free(csr);
381 return MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200382 }
383
Gilles Peskine449bd832023-01-11 14:50:10 +0100384 if ((ret = mbedtls_x509_get_sig(&p, end, &csr->sig)) != 0) {
385 mbedtls_x509_csr_free(csr);
386 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200387 }
388
Gilles Peskine449bd832023-01-11 14:50:10 +0100389 if (p != end) {
390 mbedtls_x509_csr_free(csr);
391 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
392 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200393 }
394
Gilles Peskine449bd832023-01-11 14:50:10 +0100395 return 0;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200396}
397
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200398/*
399 * Parse a CSR, allowing for PEM or raw DER encoding
400 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100401int mbedtls_x509_csr_parse(mbedtls_x509_csr *csr, const unsigned char *buf, size_t buflen)
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200402{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200403#if defined(MBEDTLS_PEM_PARSE_C)
Janos Follath865b3eb2019-12-16 11:46:15 +0000404 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200405 size_t use_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200406 mbedtls_pem_context pem;
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200407#endif
408
409 /*
410 * Check for valid input
411 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100412 if (csr == NULL || buf == NULL || buflen == 0) {
413 return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
414 }
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200416#if defined(MBEDTLS_PEM_PARSE_C)
Manuel Pégourié-Gonnard43b37cb2015-05-12 11:20:10 +0200417 /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
Gilles Peskine449bd832023-01-11 14:50:10 +0100418 if (buf[buflen - 1] == '\0') {
419 mbedtls_pem_init(&pem);
420 ret = mbedtls_pem_read_buffer(&pem,
421 "-----BEGIN CERTIFICATE REQUEST-----",
422 "-----END CERTIFICATE REQUEST-----",
423 buf, NULL, 0, &use_len);
424 if (ret == MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
425 ret = mbedtls_pem_read_buffer(&pem,
426 "-----BEGIN NEW CERTIFICATE REQUEST-----",
427 "-----END NEW CERTIFICATE REQUEST-----",
428 buf, NULL, 0, &use_len);
Simon Butcher0488ce62018-09-30 15:36:50 +0100429 }
Simon Butchere1660af2018-10-07 17:48:37 +0100430
Gilles Peskine449bd832023-01-11 14:50:10 +0100431 if (ret == 0) {
Philippe Antoinec03059d2018-06-14 07:35:11 +0200432 /*
433 * Was PEM encoded, parse the result
434 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100435 ret = mbedtls_x509_csr_parse_der(csr, pem.buf, pem.buflen);
Simon Butcher0488ce62018-09-30 15:36:50 +0100436 }
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 mbedtls_pem_free(&pem);
439 if (ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT) {
440 return ret;
441 }
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200442 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200443#endif /* MBEDTLS_PEM_PARSE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +0100444 return mbedtls_x509_csr_parse_der(csr, buf, buflen);
Manuel Pégourié-Gonnardf3b47242014-06-16 18:06:48 +0200445}
446
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200447#if defined(MBEDTLS_FS_IO)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200448/*
449 * Load a CSR into the structure
450 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100451int mbedtls_x509_csr_parse_file(mbedtls_x509_csr *csr, const char *path)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200452{
Janos Follath865b3eb2019-12-16 11:46:15 +0000453 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200454 size_t n;
455 unsigned char *buf;
456
Gilles Peskine449bd832023-01-11 14:50:10 +0100457 if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) {
458 return ret;
459 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200460
Gilles Peskine449bd832023-01-11 14:50:10 +0100461 ret = mbedtls_x509_csr_parse(csr, buf, n);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200462
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 mbedtls_platform_zeroize(buf, n);
464 mbedtls_free(buf);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200465
Gilles Peskine449bd832023-01-11 14:50:10 +0100466 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200467}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468#endif /* MBEDTLS_FS_IO */
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200469
Hanno Becker612a2f12020-10-09 09:19:39 +0100470#if !defined(MBEDTLS_X509_REMOVE_INFO)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200471#define BEFORE_COLON 14
472#define BC "14"
473/*
474 * Return an informational string about the CSR.
475 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100476int mbedtls_x509_csr_info(char *buf, size_t size, const char *prefix,
477 const mbedtls_x509_csr *csr)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200478{
Janos Follath865b3eb2019-12-16 11:46:15 +0000479 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200480 size_t n;
481 char *p;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200482 char key_size_str[BEFORE_COLON];
483
484 p = buf;
485 n = size;
486
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 ret = mbedtls_snprintf(p, n, "%sCSR version : %d",
488 prefix, csr->version);
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200489 MBEDTLS_X509_SAFE_SNPRINTF;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200490
Gilles Peskine449bd832023-01-11 14:50:10 +0100491 ret = mbedtls_snprintf(p, n, "\n%ssubject name : ", prefix);
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200492 MBEDTLS_X509_SAFE_SNPRINTF;
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 ret = mbedtls_x509_dn_gets(p, n, &csr->subject);
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200494 MBEDTLS_X509_SAFE_SNPRINTF;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200495
Gilles Peskine449bd832023-01-11 14:50:10 +0100496 ret = mbedtls_snprintf(p, n, "\n%ssigned using : ", prefix);
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200497 MBEDTLS_X509_SAFE_SNPRINTF;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200498
Gilles Peskine449bd832023-01-11 14:50:10 +0100499 ret = mbedtls_x509_sig_alg_gets(p, n, &csr->sig_oid, csr->sig_pk, csr->sig_md,
500 csr->sig_opts);
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200501 MBEDTLS_X509_SAFE_SNPRINTF;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200502
Gilles Peskine449bd832023-01-11 14:50:10 +0100503 if ((ret = mbedtls_x509_key_size_helper(key_size_str, BEFORE_COLON,
504 mbedtls_pk_get_name(&csr->pk))) != 0) {
505 return ret;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200506 }
507
Gilles Peskine449bd832023-01-11 14:50:10 +0100508 ret = mbedtls_snprintf(p, n, "\n%s%-" BC "s: %d bits\n", prefix, key_size_str,
509 (int) mbedtls_pk_get_bitlen(&csr->pk));
Manuel Pégourié-Gonnard16853682015-06-22 11:12:02 +0200510 MBEDTLS_X509_SAFE_SNPRINTF;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200511
Przemek Stekielcbaf3162023-01-12 12:58:02 +0100512 /*
513 * Optional extensions
514 */
515
516 if (csr->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
517 ret = mbedtls_snprintf(p, n, "\n%ssubject alt name :", prefix);
518 MBEDTLS_X509_SAFE_SNPRINTF;
519
520 if ((ret = x509_info_subject_alt_name(&p, &n,
521 &csr->subject_alt_names,
522 prefix)) != 0) {
523 return ret;
524 }
525 }
526
527 if (csr->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE) {
528 ret = mbedtls_snprintf(p, n, "\n%scert. type : ", prefix);
529 MBEDTLS_X509_SAFE_SNPRINTF;
530
531 if ((ret = x509_info_cert_type(&p, &n, csr->ns_cert_type)) != 0) {
532 return ret;
533 }
534 }
535
536 if (csr->ext_types & MBEDTLS_X509_EXT_KEY_USAGE) {
537 ret = mbedtls_snprintf(p, n, "\n%skey usage : ", prefix);
538 MBEDTLS_X509_SAFE_SNPRINTF;
539
540 if ((ret = x509_info_key_usage(&p, &n, csr->key_usage)) != 0) {
541 return ret;
542 }
543 }
544
545 if (csr->ext_types != 0) {
546 ret = mbedtls_snprintf(p, n, "\n");
547 MBEDTLS_X509_SAFE_SNPRINTF;
548 }
549
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 return (int) (size - n);
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200551}
Hanno Becker612a2f12020-10-09 09:19:39 +0100552#endif /* MBEDTLS_X509_REMOVE_INFO */
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200553
554/*
Paul Bakker369d2eb2013-09-18 11:58:25 +0200555 * Initialize a CSR
556 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100557void mbedtls_x509_csr_init(mbedtls_x509_csr *csr)
Paul Bakker369d2eb2013-09-18 11:58:25 +0200558{
Gilles Peskine449bd832023-01-11 14:50:10 +0100559 memset(csr, 0, sizeof(mbedtls_x509_csr));
Paul Bakker369d2eb2013-09-18 11:58:25 +0200560}
561
562/*
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200563 * Unallocate all CSR data
564 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100565void mbedtls_x509_csr_free(mbedtls_x509_csr *csr)
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200566{
Gilles Peskine449bd832023-01-11 14:50:10 +0100567 if (csr == NULL) {
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200568 return;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200569 }
570
Gilles Peskine449bd832023-01-11 14:50:10 +0100571 mbedtls_pk_free(&csr->pk);
572
573#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
574 mbedtls_free(csr->sig_opts);
575#endif
576
577 mbedtls_asn1_free_named_data_list_shallow(csr->subject.next);
578
579 if (csr->raw.p != NULL) {
580 mbedtls_platform_zeroize(csr->raw.p, csr->raw.len);
581 mbedtls_free(csr->raw.p);
582 }
583
584 mbedtls_platform_zeroize(csr, sizeof(mbedtls_x509_csr));
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200585}
586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200587#endif /* MBEDTLS_X509_CSR_PARSE_C */