x509write_csr.c 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259
  1. /*
  2. * X.509 Certificate Signing Request writing
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. /*
  22. * References:
  23. * - CSRs: PKCS#10 v1.7 aka RFC 2986
  24. * - attributes: PKCS#9 v2.0 aka RFC 2985
  25. */
  26. #if !defined(MBEDTLS_CONFIG_FILE)
  27. #include "mbedtls/config.h"
  28. #else
  29. #include MBEDTLS_CONFIG_FILE
  30. #endif
  31. #if defined(MBEDTLS_X509_CSR_WRITE_C)
  32. #include "mbedtls/x509_csr.h"
  33. #include "mbedtls/oid.h"
  34. #include "mbedtls/asn1write.h"
  35. #include <string.h>
  36. #include <stdlib.h>
  37. #if defined(MBEDTLS_PEM_WRITE_C)
  38. #include "mbedtls/pem.h"
  39. #endif
  40. /* Implementation that should never be optimized out by the compiler */
  41. static void mbedtls_zeroize( void *v, size_t n ) {
  42. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  43. }
  44. void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
  45. {
  46. memset( ctx, 0, sizeof(mbedtls_x509write_csr) );
  47. }
  48. void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
  49. {
  50. mbedtls_asn1_free_named_data_list( &ctx->subject );
  51. mbedtls_asn1_free_named_data_list( &ctx->extensions );
  52. mbedtls_zeroize( ctx, sizeof(mbedtls_x509write_csr) );
  53. }
  54. void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
  55. {
  56. ctx->md_alg = md_alg;
  57. }
  58. void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key )
  59. {
  60. ctx->key = key;
  61. }
  62. int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx,
  63. const char *subject_name )
  64. {
  65. return mbedtls_x509_string_to_names( &ctx->subject, subject_name );
  66. }
  67. int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx,
  68. const char *oid, size_t oid_len,
  69. const unsigned char *val, size_t val_len )
  70. {
  71. return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len,
  72. 0, val, val_len );
  73. }
  74. int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage )
  75. {
  76. unsigned char buf[4];
  77. unsigned char *c;
  78. int ret;
  79. c = buf + 4;
  80. if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &key_usage, 7 ) ) != 4 )
  81. return( ret );
  82. ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
  83. MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
  84. buf, 4 );
  85. if( ret != 0 )
  86. return( ret );
  87. return( 0 );
  88. }
  89. int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
  90. unsigned char ns_cert_type )
  91. {
  92. unsigned char buf[4];
  93. unsigned char *c;
  94. int ret;
  95. c = buf + 4;
  96. if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &ns_cert_type, 8 ) ) != 4 )
  97. return( ret );
  98. ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
  99. MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
  100. buf, 4 );
  101. if( ret != 0 )
  102. return( ret );
  103. return( 0 );
  104. }
  105. int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
  106. int (*f_rng)(void *, unsigned char *, size_t),
  107. void *p_rng )
  108. {
  109. int ret;
  110. const char *sig_oid;
  111. size_t sig_oid_len = 0;
  112. unsigned char *c, *c2;
  113. unsigned char hash[64];
  114. unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
  115. unsigned char tmp_buf[2048];
  116. size_t pub_len = 0, sig_and_oid_len = 0, sig_len;
  117. size_t len = 0;
  118. mbedtls_pk_type_t pk_alg;
  119. /*
  120. * Prepare data to be signed in tmp_buf
  121. */
  122. c = tmp_buf + sizeof( tmp_buf );
  123. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
  124. if( len )
  125. {
  126. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
  127. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
  128. MBEDTLS_ASN1_SEQUENCE ) );
  129. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
  130. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
  131. MBEDTLS_ASN1_SET ) );
  132. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, tmp_buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
  133. MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) );
  134. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
  135. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
  136. MBEDTLS_ASN1_SEQUENCE ) );
  137. }
  138. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
  139. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
  140. MBEDTLS_ASN1_CONTEXT_SPECIFIC ) );
  141. MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key,
  142. tmp_buf, c - tmp_buf ) );
  143. c -= pub_len;
  144. len += pub_len;
  145. /*
  146. * Subject ::= Name
  147. */
  148. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, tmp_buf, ctx->subject ) );
  149. /*
  150. * Version ::= INTEGER { v1(0), v2(1), v3(2) }
  151. */
  152. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, tmp_buf, 0 ) );
  153. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
  154. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
  155. MBEDTLS_ASN1_SEQUENCE ) );
  156. /*
  157. * Prepare signature
  158. */
  159. mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
  160. pk_alg = mbedtls_pk_get_type( ctx->key );
  161. if( pk_alg == MBEDTLS_PK_ECKEY )
  162. pk_alg = MBEDTLS_PK_ECDSA;
  163. if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
  164. f_rng, p_rng ) ) != 0 ||
  165. ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
  166. &sig_oid, &sig_oid_len ) ) != 0 )
  167. {
  168. return( ret );
  169. }
  170. /*
  171. * Write data to output buffer
  172. */
  173. c2 = buf + size;
  174. MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, buf,
  175. sig_oid, sig_oid_len, sig, sig_len ) );
  176. if( len > (size_t)( c2 - buf ) )
  177. return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
  178. c2 -= len;
  179. memcpy( c2, c, len );
  180. len += sig_and_oid_len;
  181. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) );
  182. MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, MBEDTLS_ASN1_CONSTRUCTED |
  183. MBEDTLS_ASN1_SEQUENCE ) );
  184. return( (int) len );
  185. }
  186. #define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n"
  187. #define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n"
  188. #if defined(MBEDTLS_PEM_WRITE_C)
  189. int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
  190. int (*f_rng)(void *, unsigned char *, size_t),
  191. void *p_rng )
  192. {
  193. int ret;
  194. unsigned char output_buf[4096];
  195. size_t olen = 0;
  196. if( ( ret = mbedtls_x509write_csr_der( ctx, output_buf, sizeof(output_buf),
  197. f_rng, p_rng ) ) < 0 )
  198. {
  199. return( ret );
  200. }
  201. if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
  202. output_buf + sizeof(output_buf) - ret,
  203. ret, buf, size, &olen ) ) != 0 )
  204. {
  205. return( ret );
  206. }
  207. return( 0 );
  208. }
  209. #endif /* MBEDTLS_PEM_WRITE_C */
  210. #endif /* MBEDTLS_X509_CSR_WRITE_C */