PolarSSL v1.3.8
x509_csr.c
Go to the documentation of this file.
1 /*
2  * X.509 Certificate Signing Request (CSR) parsing
3  *
4  * Copyright (C) 2006-2014, Brainspark B.V.
5  *
6  * This file is part of PolarSSL (http://www.polarssl.org)
7  * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8  *
9  * All rights reserved.
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, write to the Free Software Foundation, Inc.,
23  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24  */
25 /*
26  * The ITU-T X.509 standard defines a certificate format for PKI.
27  *
28  * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
29  * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
30  * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
31  *
32  * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
33  * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
34  */
35 
36 #if !defined(POLARSSL_CONFIG_FILE)
37 #include "polarssl/config.h"
38 #else
39 #include POLARSSL_CONFIG_FILE
40 #endif
41 
42 #if defined(POLARSSL_X509_CSR_PARSE_C)
43 
44 #include "polarssl/x509_csr.h"
45 #include "polarssl/oid.h"
46 #if defined(POLARSSL_PEM_PARSE_C)
47 #include "polarssl/pem.h"
48 #endif
49 
50 #if defined(POLARSSL_PLATFORM_C)
51 #include "polarssl/platform.h"
52 #else
53 #define polarssl_malloc malloc
54 #define polarssl_free free
55 #endif
56 
57 #include <string.h>
58 #include <stdlib.h>
59 
60 #if defined(POLARSSL_FS_IO) || defined(EFIX64) || defined(EFI32)
61 #include <stdio.h>
62 #endif
63 
64 /* Implementation that should never be optimized out by the compiler */
65 static void polarssl_zeroize( void *v, size_t n ) {
66  volatile unsigned char *p = v; while( n-- ) *p++ = 0;
67 }
68 
69 /*
70  * Version ::= INTEGER { v1(0) }
71  */
72 static int x509_csr_get_version( unsigned char **p,
73  const unsigned char *end,
74  int *ver )
75 {
76  int ret;
77 
78  if( ( ret = asn1_get_int( p, end, ver ) ) != 0 )
79  {
81  {
82  *ver = 0;
83  return( 0 );
84  }
85 
86  return( POLARSSL_ERR_X509_INVALID_VERSION + ret );
87  }
88 
89  return( 0 );
90 }
91 
92 /*
93  * Parse a CSR in DER format
94  */
96  const unsigned char *buf, size_t buflen )
97 {
98  int ret;
99  size_t len;
100  unsigned char *p, *end;
101  x509_buf sig_params;
102 
103  memset( &sig_params, 0, sizeof( x509_buf ) );
104 
105  /*
106  * Check for valid input
107  */
108  if( csr == NULL || buf == NULL )
110 
111  x509_csr_init( csr );
112 
113  /*
114  * first copy the raw DER data
115  */
116  p = (unsigned char *) polarssl_malloc( len = buflen );
117 
118  if( p == NULL )
120 
121  memcpy( p, buf, buflen );
122 
123  csr->raw.p = p;
124  csr->raw.len = len;
125  end = p + len;
126 
127  /*
128  * CertificationRequest ::= SEQUENCE {
129  * certificationRequestInfo CertificationRequestInfo,
130  * signatureAlgorithm AlgorithmIdentifier,
131  * signature BIT STRING
132  * }
133  */
134  if( ( ret = asn1_get_tag( &p, end, &len,
135  ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
136  {
137  x509_csr_free( csr );
139  }
140 
141  if( len != (size_t) ( end - p ) )
142  {
143  x509_csr_free( csr );
146  }
147 
148  /*
149  * CertificationRequestInfo ::= SEQUENCE {
150  */
151  csr->cri.p = p;
152 
153  if( ( ret = asn1_get_tag( &p, end, &len,
154  ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
155  {
156  x509_csr_free( csr );
157  return( POLARSSL_ERR_X509_INVALID_FORMAT + ret );
158  }
159 
160  end = p + len;
161  csr->cri.len = end - csr->cri.p;
162 
163  /*
164  * Version ::= INTEGER { v1(0) }
165  */
166  if( ( ret = x509_csr_get_version( &p, end, &csr->version ) ) != 0 )
167  {
168  x509_csr_free( csr );
169  return( ret );
170  }
171 
172  csr->version++;
173 
174  if( csr->version != 1 )
175  {
176  x509_csr_free( csr );
178  }
179 
180  /*
181  * subject Name
182  */
183  csr->subject_raw.p = p;
184 
185  if( ( ret = asn1_get_tag( &p, end, &len,
186  ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
187  {
188  x509_csr_free( csr );
189  return( POLARSSL_ERR_X509_INVALID_FORMAT + ret );
190  }
191 
192  if( ( ret = x509_get_name( &p, p + len, &csr->subject ) ) != 0 )
193  {
194  x509_csr_free( csr );
195  return( ret );
196  }
197 
198  csr->subject_raw.len = p - csr->subject_raw.p;
199 
200  /*
201  * subjectPKInfo SubjectPublicKeyInfo
202  */
203  if( ( ret = pk_parse_subpubkey( &p, end, &csr->pk ) ) != 0 )
204  {
205  x509_csr_free( csr );
206  return( ret );
207  }
208 
209  /*
210  * attributes [0] Attributes
211  */
212  if( ( ret = asn1_get_tag( &p, end, &len,
214  {
215  x509_csr_free( csr );
216  return( POLARSSL_ERR_X509_INVALID_FORMAT + ret );
217  }
218  // TODO Parse Attributes / extension requests
219 
220  p += len;
221 
222  end = csr->raw.p + csr->raw.len;
223 
224  /*
225  * signatureAlgorithm AlgorithmIdentifier,
226  * signature BIT STRING
227  */
228  if( ( ret = x509_get_alg( &p, end, &csr->sig_oid, &sig_params ) ) != 0 )
229  {
230  x509_csr_free( csr );
231  return( ret );
232  }
233 
234  if( ( ret = x509_get_sig_alg( &csr->sig_oid, &sig_params,
235  &csr->sig_md, &csr->sig_pk,
236  &csr->sig_opts ) ) != 0 )
237  {
238  x509_csr_free( csr );
240  }
241 
242  if( ( ret = x509_get_sig( &p, end, &csr->sig ) ) != 0 )
243  {
244  x509_csr_free( csr );
245  return( ret );
246  }
247 
248  if( p != end )
249  {
250  x509_csr_free( csr );
253  }
254 
255  return( 0 );
256 }
257 
258 /*
259  * Parse a CSR, allowing for PEM or raw DER encoding
260  */
261 int x509_csr_parse( x509_csr *csr, const unsigned char *buf, size_t buflen )
262 {
263  int ret;
264 #if defined(POLARSSL_PEM_PARSE_C)
265  size_t use_len;
266  pem_context pem;
267 #endif
268 
269  /*
270  * Check for valid input
271  */
272  if( csr == NULL || buf == NULL )
274 
275 #if defined(POLARSSL_PEM_PARSE_C)
276  pem_init( &pem );
277  ret = pem_read_buffer( &pem,
278  "-----BEGIN CERTIFICATE REQUEST-----",
279  "-----END CERTIFICATE REQUEST-----",
280  buf, NULL, 0, &use_len );
281 
282  if( ret == 0 )
283  {
284  /*
285  * Was PEM encoded, parse the result
286  */
287  if( ( ret = x509_csr_parse_der( csr, pem.buf, pem.buflen ) ) != 0 )
288  return( ret );
289 
290  pem_free( &pem );
291  return( 0 );
292  }
294  {
295  pem_free( &pem );
296  return( ret );
297  }
298  else
299 #endif /* POLARSSL_PEM_PARSE_C */
300  return( x509_csr_parse_der( csr, buf, buflen ) );
301 }
302 
303 #if defined(POLARSSL_FS_IO)
304 /*
305  * Load a CSR into the structure
306  */
307 int x509_csr_parse_file( x509_csr *csr, const char *path )
308 {
309  int ret;
310  size_t n;
311  unsigned char *buf;
312 
313  if( ( ret = x509_load_file( path, &buf, &n ) ) != 0 )
314  return( ret );
315 
316  ret = x509_csr_parse( csr, buf, n );
317 
318  polarssl_zeroize( buf, n + 1 );
319  polarssl_free( buf );
320 
321  return( ret );
322 }
323 #endif /* POLARSSL_FS_IO */
324 
325 #if defined(_MSC_VER) && !defined snprintf && !defined(EFIX64) && \
326  !defined(EFI32)
327 #include <stdarg.h>
328 
329 #if !defined vsnprintf
330 #define vsnprintf _vsnprintf
331 #endif // vsnprintf
332 
333 /*
334  * Windows _snprintf and _vsnprintf are not compatible to linux versions.
335  * Result value is not size of buffer needed, but -1 if no fit is possible.
336  *
337  * This fuction tries to 'fix' this by at least suggesting enlarging the
338  * size by 20.
339  */
340 static int compat_snprintf( char *str, size_t size, const char *format, ... )
341 {
342  va_list ap;
343  int res = -1;
344 
345  va_start( ap, format );
346 
347  res = vsnprintf( str, size, format, ap );
348 
349  va_end( ap );
350 
351  // No quick fix possible
352  if( res < 0 )
353  return( (int) size + 20 );
354 
355  return( res );
356 }
357 
358 #define snprintf compat_snprintf
359 #endif /* _MSC_VER && !snprintf && !EFIX64 && !EFI32 */
360 
361 #define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
362 
363 #define SAFE_SNPRINTF() \
364 { \
365  if( ret == -1 ) \
366  return( -1 ); \
367  \
368  if( (unsigned int) ret > n ) { \
369  p[n - 1] = '\0'; \
370  return( POLARSSL_ERR_DEBUG_BUF_TOO_SMALL ); \
371  } \
372  \
373  n -= (unsigned int) ret; \
374  p += (unsigned int) ret; \
375 }
376 
377 #define BEFORE_COLON 14
378 #define BC "14"
379 /*
380  * Return an informational string about the CSR.
381  */
382 int x509_csr_info( char *buf, size_t size, const char *prefix,
383  const x509_csr *csr )
384 {
385  int ret;
386  size_t n;
387  char *p;
388  char key_size_str[BEFORE_COLON];
389 
390  p = buf;
391  n = size;
392 
393  ret = snprintf( p, n, "%sCSR version : %d",
394  prefix, csr->version );
395  SAFE_SNPRINTF();
396 
397  ret = snprintf( p, n, "\n%ssubject name : ", prefix );
398  SAFE_SNPRINTF();
399  ret = x509_dn_gets( p, n, &csr->subject );
400  SAFE_SNPRINTF();
401 
402  ret = snprintf( p, n, "\n%ssigned using : ", prefix );
403  SAFE_SNPRINTF();
404 
405  ret = x509_sig_alg_gets( p, n, &csr->sig_oid, csr->sig_pk, csr->sig_md,
406  csr->sig_opts );
407  SAFE_SNPRINTF();
408 
409  if( ( ret = x509_key_size_helper( key_size_str, BEFORE_COLON,
410  pk_get_name( &csr->pk ) ) ) != 0 )
411  {
412  return( ret );
413  }
414 
415  ret = snprintf( p, n, "\n%s%-" BC "s: %d bits\n", prefix, key_size_str,
416  (int) pk_get_size( &csr->pk ) );
417  SAFE_SNPRINTF();
418 
419  return( (int) ( size - n ) );
420 }
421 
422 /*
423  * Initialize a CSR
424  */
425 void x509_csr_init( x509_csr *csr )
426 {
427  memset( csr, 0, sizeof(x509_csr) );
428 }
429 
430 /*
431  * Unallocate all CSR data
432  */
433 void x509_csr_free( x509_csr *csr )
434 {
435  x509_name *name_cur;
436  x509_name *name_prv;
437 
438  if( csr == NULL )
439  return;
440 
441  pk_free( &csr->pk );
442 
443 #if defined(POLARSSL_X509_RSASSA_PSS_SUPPORT)
444  polarssl_free( csr->sig_opts );
445 #endif
446 
447  name_cur = csr->subject.next;
448  while( name_cur != NULL )
449  {
450  name_prv = name_cur;
451  name_cur = name_cur->next;
452  polarssl_zeroize( name_prv, sizeof( x509_name ) );
453  polarssl_free( name_prv );
454  }
455 
456  if( csr->raw.p != NULL )
457  {
458  polarssl_zeroize( csr->raw.p, csr->raw.len );
459  polarssl_free( csr->raw.p );
460  }
461 
462  polarssl_zeroize( csr, sizeof( x509_csr ) );
463 }
464 
465 #endif /* POLARSSL_X509_CSR_PARSE_C */
int x509_csr_parse_der(x509_csr *csr, const unsigned char *buf, size_t buflen)
Load a Certificate Signing Request (CSR) in DER format.
int x509_get_name(unsigned char **p, const unsigned char *end, x509_name *cur)
#define POLARSSL_ERR_ASN1_LENGTH_MISMATCH
Actual length differs from expected length.
Definition: asn1.h:57
#define polarssl_malloc
size_t pk_get_size(const pk_context *ctx)
Get the size in bits of the underlying key.
#define polarssl_free
int x509_get_sig_alg(const x509_buf *sig_oid, const x509_buf *sig_params, md_type_t *md_alg, pk_type_t *pk_alg, void **sig_opts)
#define POLARSSL_ERR_X509_INVALID_FORMAT
The CRT/CRL/CSR format is invalid, e.g.
Definition: x509.h:54
int x509_key_size_helper(char *buf, size_t size, const char *name)
int asn1_get_int(unsigned char **p, const unsigned char *end, int *val)
Retrieve an integer ASN.1 tag and its value.
#define ASN1_SEQUENCE
Definition: asn1.h:82
Configuration options (set of defines)
#define POLARSSL_ERR_X509_UNKNOWN_SIG_ALG
Signature algorithm (oid) is unsupported.
Definition: x509.h:63
#define ASN1_CONSTRUCTED
Definition: asn1.h:92
PolarSSL Platform abstraction layer.
int x509_get_sig(unsigned char **p, const unsigned char *end, x509_buf *sig)
const char * pk_get_name(const pk_context *ctx)
Access the type name.
#define POLARSSL_ERR_X509_UNKNOWN_VERSION
CRT/CRL/CSR has an unsupported version number.
Definition: x509.h:62
x509_name subject
The parsed subject data (named information object).
Definition: x509_csr.h:62
Object Identifier (OID) database.
void * sig_opts
Signature options to be passed to pk_verify_ext(), e.g.
Definition: x509_csr.h:70
int x509_get_alg(unsigned char **p, const unsigned char *end, x509_buf *alg, x509_buf *params)
x509_buf cri
The raw CertificateRequestInfo body (DER).
Definition: x509_csr.h:57
x509_buf sig_oid
Definition: x509_csr.h:66
Privacy Enhanced Mail (PEM) decoding.
int x509_dn_gets(char *buf, size_t size, const x509_name *dn)
Store the certificate DN in printable form into buf; no more than size characters will be written...
x509_buf sig
Definition: x509_csr.h:67
unsigned char * p
ASN1 data, e.g.
Definition: asn1.h:128
X.509 certificate signing request parsing and writing.
void x509_csr_free(x509_csr *csr)
Unallocate all CSR data.
int x509_sig_alg_gets(char *buf, size_t size, const x509_buf *sig_oid, pk_type_t pk_alg, md_type_t md_alg, const void *sig_opts)
int pk_parse_subpubkey(unsigned char **p, const unsigned char *end, pk_context *pk)
Parse a SubjectPublicKeyInfo DER structure.
int x509_load_file(const char *path, unsigned char **buf, size_t *n)
#define ASN1_CONTEXT_SPECIFIC
Definition: asn1.h:93
pk_type_t sig_pk
Internal representation of the Public Key algorithm of the signature algorithm, e.g.
Definition: x509_csr.h:69
pk_context pk
Container for the public key context.
Definition: x509_csr.h:64
int x509_csr_parse(x509_csr *csr, const unsigned char *buf, size_t buflen)
Load a Certificate Signing Request (CSR), DER or PEM format.
Container for a sequence or list of &#39;named&#39; ASN.1 data items.
Definition: asn1.h:156
Type-length-value structure that allows for ASN1 using DER.
Definition: asn1.h:124
size_t len
ASN1 length, e.g.
Definition: asn1.h:127
x509_buf raw
The raw CSR data (DER).
Definition: x509_csr.h:56
void pk_free(pk_context *ctx)
Free a pk_context.
int asn1_get_tag(unsigned char **p, const unsigned char *end, size_t *len, int tag)
Get the tag and length of the tag.
#define POLARSSL_ERR_X509_INVALID_VERSION
The CRT/CRL/CSR version element is invalid.
Definition: x509.h:55
int x509_csr_info(char *buf, size_t size, const char *prefix, const x509_csr *csr)
Returns an informational string about the CSR.
int version
CSR version (1=v1).
Definition: x509_csr.h:59
struct _asn1_named_data * next
The next entry in the sequence.
Definition: asn1.h:160
Certificate Signing Request (CSR) structure.
Definition: x509_csr.h:54
#define POLARSSL_ERR_X509_BAD_INPUT_DATA
Input invalid.
Definition: x509.h:67
int x509_csr_parse_file(x509_csr *csr, const char *path)
Load a Certificate Signing Request (CSR)
#define POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT
No PEM header or footer found.
Definition: pem.h:38
md_type_t sig_md
Internal representation of the MD algorithm of the signature algorithm, e.g.
Definition: x509_csr.h:68
#define POLARSSL_ERR_X509_MALLOC_FAILED
Allocation of memory failed.
Definition: x509.h:68
void x509_csr_init(x509_csr *csr)
Initialize a CSR.
#define POLARSSL_ERR_ASN1_UNEXPECTED_TAG
ASN1 tag was of an unexpected value.
Definition: asn1.h:55
x509_buf subject_raw
The raw subject data (DER).
Definition: x509_csr.h:61