reactos/dll/3rdparty/mbedtls/x509write_csr.c

   1 /*
   2  *  X.509 Certificate Signing Request writing
   3  *
   4  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
   5  *  SPDX-License-Identifier: GPL-2.0
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License along
  18  *  with this program; if not, write to the Free Software Foundation, Inc.,
  19  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  *  This file is part of mbed TLS (https://tls.mbed.org)
  22  */
  23 /*
  24  * References:
  25  * - CSRs: PKCS#10 v1.7 aka RFC 2986
  26  * - attributes: PKCS#9 v2.0 aka RFC 2985
  27  */
  28
  29 #if !defined(MBEDTLS_CONFIG_FILE)
  30 #include "mbedtls/config.h"
  31 #else
  32 #include MBEDTLS_CONFIG_FILE
  33 #endif
  34
  35 #if defined(MBEDTLS_X509_CSR_WRITE_C)
  36
  37 #include "mbedtls/x509_csr.h"
  38 #include "mbedtls/oid.h"
  39 #include "mbedtls/asn1write.h"
  40
  41 #include <string.h>
  42 #include <stdlib.h>
  43
  44 #if defined(MBEDTLS_PEM_WRITE_C)
  45 #include "mbedtls/pem.h"
  46 #endif
  47
  48 /* Implementation that should never be optimized out by the compiler */
  49 static void mbedtls_zeroize( void *v, size_t n ) {
  50     volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  51 }
  52
  53 void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
  54 {
  55     memset( ctx, 0, sizeof(mbedtls_x509write_csr) );
  56 }
  57
  58 void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
  59 {
  60     mbedtls_asn1_free_named_data_list( &ctx->subject );
  61     mbedtls_asn1_free_named_data_list( &ctx->extensions );
  62
  63     mbedtls_zeroize( ctx, sizeof(mbedtls_x509write_csr) );
  64 }
  65
  66 void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
  67 {
  68     ctx->md_alg = md_alg;
  69 }
  70
  71 void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key )
  72 {
  73     ctx->key = key;
  74 }
  75
  76 int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx,
  77                                     const char *subject_name )
  78 {
  79     return mbedtls_x509_string_to_names( &ctx->subject, subject_name );
  80 }
  81
  82 int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx,
  83                                  const char *oid, size_t oid_len,
  84                                  const unsigned char *val, size_t val_len )
  85 {
  86     return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len,
  87                                0, val, val_len );
  88 }
  89
  90 int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage )
  91 {
  92     unsigned char buf[4];
  93     unsigned char *c;
  94     int ret;
  95
  96     c = buf + 4;
  97
  98     if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &key_usage, 7 ) ) != 4 )
  99         return( ret );
 100
 101     ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
 102                                        MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
 103                                        buf, 4 );
 104     if( ret != 0 )
 105         return( ret );
 106
 107     return( 0 );
 108 }
 109
 110 int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
 111                                     unsigned char ns_cert_type )
 112 {
 113     unsigned char buf[4];
 114     unsigned char *c;
 115     int ret;
 116
 117     c = buf + 4;
 118
 119     if( ( ret = mbedtls_asn1_write_bitstring( &c, buf, &ns_cert_type, 8 ) ) != 4 )
 120         return( ret );
 121
 122     ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
 123                                        MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
 124                                        buf, 4 );
 125     if( ret != 0 )
 126         return( ret );
 127
 128     return( 0 );
 129 }
 130
 131 int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
 132                        int (*f_rng)(void *, unsigned char *, size_t),
 133                        void *p_rng )
 134 {
 135     int ret;
 136     const char *sig_oid;
 137     size_t sig_oid_len = 0;
 138     unsigned char *c, *c2;
 139     unsigned char hash[64];
 140     unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
 141     unsigned char tmp_buf[2048];
 142     size_t pub_len = 0, sig_and_oid_len = 0, sig_len;
 143     size_t len = 0;
 144     mbedtls_pk_type_t pk_alg;
 145
 146     /*
 147      * Prepare data to be signed in tmp_buf
 148      */
 149     c = tmp_buf + sizeof( tmp_buf );
 150
 151     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
 152
 153     if( len )
 154     {
 155         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
 156         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
 157                                                         MBEDTLS_ASN1_SEQUENCE ) );
 158
 159         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
 160         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
 161                                                         MBEDTLS_ASN1_SET ) );
 162
 163         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, tmp_buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
 164                                           MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) );
 165
 166         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
 167         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
 168                                                         MBEDTLS_ASN1_SEQUENCE ) );
 169     }
 170
 171     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
 172     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
 173                                                     MBEDTLS_ASN1_CONTEXT_SPECIFIC ) );
 174
 175     MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key,
 176                                                 tmp_buf, c - tmp_buf ) );
 177     c -= pub_len;
 178     len += pub_len;
 179
 180     /*
 181      *  Subject  ::=  Name
 182      */
 183     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, tmp_buf, ctx->subject ) );
 184
 185     /*
 186      *  Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
 187      */
 188     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, tmp_buf, 0 ) );
 189
 190     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
 191     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
 192                                                     MBEDTLS_ASN1_SEQUENCE ) );
 193
 194     /*
 195      * Prepare signature
 196      */
 197     mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
 198
 199     pk_alg = mbedtls_pk_get_type( ctx->key );
 200     if( pk_alg == MBEDTLS_PK_ECKEY )
 201         pk_alg = MBEDTLS_PK_ECDSA;
 202
 203     if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
 204                          f_rng, p_rng ) ) != 0 ||
 205         ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
 206                                         &sig_oid, &sig_oid_len ) ) != 0 )
 207     {
 208         return( ret );
 209     }
 210
 211     /*
 212      * Write data to output buffer
 213      */
 214     c2 = buf + size;
 215     MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, buf,
 216                                         sig_oid, sig_oid_len, sig, sig_len ) );
 217
 218     if( len > (size_t)( c2 - buf ) )
 219         return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
 220
 221     c2 -= len;
 222     memcpy( c2, c, len );
 223
 224     len += sig_and_oid_len;
 225     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) );
 226     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, MBEDTLS_ASN1_CONSTRUCTED |
 227                                                  MBEDTLS_ASN1_SEQUENCE ) );
 228
 229     return( (int) len );
 230 }
 231
 232 #define PEM_BEGIN_CSR           "-----BEGIN CERTIFICATE REQUEST-----\n"
 233 #define PEM_END_CSR             "-----END CERTIFICATE REQUEST-----\n"
 234
 235 #if defined(MBEDTLS_PEM_WRITE_C)
 236 int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
 237                        int (*f_rng)(void *, unsigned char *, size_t),
 238                        void *p_rng )
 239 {
 240     int ret;
 241     unsigned char output_buf[4096];
 242     size_t olen = 0;
 243
 244     if( ( ret = mbedtls_x509write_csr_der( ctx, output_buf, sizeof(output_buf),
 245                                    f_rng, p_rng ) ) < 0 )
 246     {
 247         return( ret );
 248     }
 249
 250     if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
 251                                   output_buf + sizeof(output_buf) - ret,
 252                                   ret, buf, size, &olen ) ) != 0 )
 253     {
 254         return( ret );
 255     }
 256
 257     return( 0 );
 258 }
 259 #endif /* MBEDTLS_PEM_WRITE_C */
 260
 261 #endif /* MBEDTLS_X509_CSR_WRITE_C */