mirror of
https://git.suyu.dev/suyu/mbedtls.git
synced 2026-01-05 05:59:23 +01:00
Merge branch 'development' into iotssl-1619
This commit is contained in:
Hanno Becker
commit
32297e8314
211 changed files with 6908 additions and 983 deletions
|
|
@ -79,7 +79,9 @@ int main( int argc, char *argv[] )
|
|||
FILE *fkey, *fin = NULL, *fout = NULL;
|
||||
|
||||
char *p;
|
||||
|
||||
unsigned char IV[16];
|
||||
unsigned char tmp[16];
|
||||
unsigned char key[512];
|
||||
unsigned char digest[32];
|
||||
unsigned char buffer[1024];
|
||||
|
|
@ -123,10 +125,10 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
|
||||
mode = atoi( argv[1] );
|
||||
memset(IV, 0, sizeof(IV));
|
||||
memset(key, 0, sizeof(key));
|
||||
memset(digest, 0, sizeof(digest));
|
||||
memset(buffer, 0, sizeof(buffer));
|
||||
memset( IV, 0, sizeof( IV ) );
|
||||
memset( key, 0, sizeof( key ) );
|
||||
memset( digest, 0, sizeof( digest ) );
|
||||
memset( buffer, 0, sizeof( buffer ) );
|
||||
|
||||
if( mode != MODE_ENCRYPT && mode != MODE_DECRYPT )
|
||||
{
|
||||
|
|
@ -153,7 +155,7 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
|
||||
/*
|
||||
* Read the secret key and clean the command line.
|
||||
* Read the secret key from file or command line
|
||||
*/
|
||||
if( ( fkey = fopen( argv[4], "rb" ) ) != NULL )
|
||||
{
|
||||
|
|
@ -185,8 +187,6 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
}
|
||||
|
||||
memset( argv[4], 0, strlen( argv[4] ) );
|
||||
|
||||
#if defined(_WIN32_WCE)
|
||||
filesize = fseek( fin, 0L, SEEK_END );
|
||||
#else
|
||||
|
|
@ -272,7 +272,6 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_md_finish( &sha_ctx, digest );
|
||||
}
|
||||
|
||||
memset( key, 0, sizeof( key ) );
|
||||
mbedtls_aes_setkey_enc( &aes_ctx, digest, 256 );
|
||||
mbedtls_md_hmac_starts( &sha_ctx, digest, 32 );
|
||||
|
||||
|
|
@ -319,8 +318,6 @@ int main( int argc, char *argv[] )
|
|||
|
||||
if( mode == MODE_DECRYPT )
|
||||
{
|
||||
unsigned char tmp[16];
|
||||
|
||||
/*
|
||||
* The encrypted file must be structured as follows:
|
||||
*
|
||||
|
|
@ -374,7 +371,6 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_md_finish( &sha_ctx, digest );
|
||||
}
|
||||
|
||||
memset( key, 0, sizeof( key ) );
|
||||
mbedtls_aes_setkey_dec( &aes_ctx, digest, 256 );
|
||||
mbedtls_md_hmac_starts( &sha_ctx, digest, 32 );
|
||||
|
||||
|
|
@ -441,6 +437,15 @@ exit:
|
|||
if( fout )
|
||||
fclose( fout );
|
||||
|
||||
/* Zeroize all command line arguments to also cover
|
||||
the case when the user has missed or reordered some,
|
||||
in which case the key might not be in argv[4]. */
|
||||
for( i = 0; i < (unsigned int) argc; i++ )
|
||||
memset( argv[i], 0, strlen( argv[i] ) );
|
||||
|
||||
memset( IV, 0, sizeof( IV ) );
|
||||
memset( key, 0, sizeof( key ) );
|
||||
memset( tmp, 0, sizeof( tmp ) );
|
||||
memset( buffer, 0, sizeof( buffer ) );
|
||||
memset( digest, 0, sizeof( digest ) );
|
||||
|
||||
|
|
|
|||
|
|
@ -192,7 +192,7 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
|
||||
/*
|
||||
* Read the secret key and clean the command line.
|
||||
* Read the secret key from file or command line
|
||||
*/
|
||||
if( ( fkey = fopen( argv[6], "rb" ) ) != NULL )
|
||||
{
|
||||
|
|
@ -224,8 +224,6 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
}
|
||||
|
||||
memset( argv[6], 0, strlen( argv[6] ) );
|
||||
|
||||
#if defined(_WIN32_WCE)
|
||||
filesize = fseek( fin, 0L, SEEK_END );
|
||||
#else
|
||||
|
|
@ -303,8 +301,6 @@ int main( int argc, char *argv[] )
|
|||
|
||||
}
|
||||
|
||||
memset( key, 0, sizeof( key ) );
|
||||
|
||||
if( mbedtls_cipher_setkey( &cipher_ctx, digest, cipher_info->key_bitlen,
|
||||
MBEDTLS_ENCRYPT ) != 0 )
|
||||
{
|
||||
|
|
@ -444,8 +440,6 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_md_finish( &md_ctx, digest );
|
||||
}
|
||||
|
||||
memset( key, 0, sizeof( key ) );
|
||||
|
||||
if( mbedtls_cipher_setkey( &cipher_ctx, digest, cipher_info->key_bitlen,
|
||||
MBEDTLS_DECRYPT ) != 0 )
|
||||
{
|
||||
|
|
@ -540,7 +534,16 @@ exit:
|
|||
if( fout )
|
||||
fclose( fout );
|
||||
|
||||
/* Zeroize all command line arguments to also cover
|
||||
the case when the user has missed or reordered some,
|
||||
in which case the key might not be in argv[6]. */
|
||||
for( i = 0; i < argc; i++ )
|
||||
memset( argv[i], 0, strlen( argv[i] ) );
|
||||
|
||||
memset( IV, 0, sizeof( IV ) );
|
||||
memset( key, 0, sizeof( key ) );
|
||||
memset( buffer, 0, sizeof( buffer ) );
|
||||
memset( output, 0, sizeof( output ) );
|
||||
memset( digest, 0, sizeof( digest ) );
|
||||
|
||||
mbedtls_cipher_free( &cipher_ctx );
|
||||
|
|
|
|||
|
|
@ -203,7 +203,7 @@ int main( int argc, char *argv[] )
|
|||
/*
|
||||
* 4. Handshake
|
||||
*/
|
||||
mbedtls_printf( " . Performing the SSL/TLS handshake..." );
|
||||
mbedtls_printf( " . Performing the DTLS handshake..." );
|
||||
fflush( stdout );
|
||||
|
||||
do ret = mbedtls_ssl_handshake( &ssl );
|
||||
|
|
|
|||
|
|
@ -63,6 +63,9 @@ int main( void )
|
|||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#define MAX_REQUEST_SIZE 20000
|
||||
#define MAX_REQUEST_SIZE_STR "20000"
|
||||
|
||||
#define DFL_SERVER_NAME "localhost"
|
||||
#define DFL_SERVER_ADDR NULL
|
||||
#define DFL_SERVER_PORT "4433"
|
||||
|
|
@ -242,8 +245,8 @@ int main( void )
|
|||
" server_addr=%%s default: given by name\n" \
|
||||
" server_port=%%d default: 4433\n" \
|
||||
" request_page=%%s default: \".\"\n" \
|
||||
" request_size=%%d default: about 34 (basic request)\n" \
|
||||
" (minimum: 0, max: 16384)\n" \
|
||||
" request_size=%%d default: about 34 (basic request)\n" \
|
||||
" (minimum: 0, max: " MAX_REQUEST_SIZE_STR " )\n" \
|
||||
" debug_level=%%d default: 0 (disabled)\n" \
|
||||
" nbio=%%d default: 0 (blocking I/O)\n" \
|
||||
" options: 1 (non-blocking), 2 (added delays)\n" \
|
||||
|
|
@ -437,7 +440,9 @@ int main( int argc, char *argv[] )
|
|||
{
|
||||
int ret = 0, len, tail_len, i, written, frags, retry_left;
|
||||
mbedtls_net_context server_fd;
|
||||
unsigned char buf[MBEDTLS_SSL_MAX_CONTENT_LEN + 1];
|
||||
|
||||
unsigned char buf[MAX_REQUEST_SIZE + 1];
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
|
||||
unsigned char psk[MBEDTLS_PSK_MAX_LEN];
|
||||
size_t psk_len = 0;
|
||||
|
|
@ -602,7 +607,8 @@ int main( int argc, char *argv[] )
|
|||
else if( strcmp( p, "request_size" ) == 0 )
|
||||
{
|
||||
opt.request_size = atoi( q );
|
||||
if( opt.request_size < 0 || opt.request_size > MBEDTLS_SSL_MAX_CONTENT_LEN )
|
||||
if( opt.request_size < 0 ||
|
||||
opt.request_size > MAX_REQUEST_SIZE )
|
||||
goto usage;
|
||||
}
|
||||
else if( strcmp( p, "ca_file" ) == 0 )
|
||||
|
|
@ -1494,8 +1500,8 @@ send_request:
|
|||
mbedtls_printf( " > Write to server:" );
|
||||
fflush( stdout );
|
||||
|
||||
len = mbedtls_snprintf( (char *) buf, sizeof(buf) - 1, GET_REQUEST,
|
||||
opt.request_page );
|
||||
len = mbedtls_snprintf( (char *) buf, sizeof( buf ) - 1, GET_REQUEST,
|
||||
opt.request_page );
|
||||
tail_len = (int) strlen( GET_REQUEST_END );
|
||||
|
||||
/* Add padding to GET request to reach opt.request_size in length */
|
||||
|
|
@ -1506,7 +1512,7 @@ send_request:
|
|||
len += opt.request_size - len - tail_len;
|
||||
}
|
||||
|
||||
strncpy( (char *) buf + len, GET_REQUEST_END, sizeof(buf) - len - 1 );
|
||||
strncpy( (char *) buf + len, GET_REQUEST_END, sizeof( buf ) - len - 1 );
|
||||
len += tail_len;
|
||||
|
||||
/* Truncate if request size is smaller than the "natural" size */
|
||||
|
|
@ -1550,6 +1556,12 @@ send_request:
|
|||
|
||||
frags = 1;
|
||||
written = ret;
|
||||
|
||||
if( written < len )
|
||||
{
|
||||
mbedtls_printf( " warning\n ! request didn't fit into single datagram and "
|
||||
"was truncated to size %u", (unsigned) written );
|
||||
}
|
||||
}
|
||||
|
||||
buf[written] = '\0';
|
||||
|
|
|
|||
|
|
@ -326,7 +326,7 @@ int main( void )
|
|||
#define USAGE \
|
||||
"\n usage: ssl_server2 param=<>...\n" \
|
||||
"\n acceptable parameters:\n" \
|
||||
" server_addr=%%d default: (all interfaces)\n" \
|
||||
" server_addr=%%s default: (all interfaces)\n" \
|
||||
" server_port=%%d default: 4433\n" \
|
||||
" debug_level=%%d default: 0 (disabled)\n" \
|
||||
" nbio=%%d default: 0 (blocking I/O)\n" \
|
||||
|
|
|
|||
|
|
@ -126,7 +126,7 @@ do { \
|
|||
CODE; \
|
||||
} \
|
||||
\
|
||||
mbedtls_printf( "%9lu Kb/s, %9lu cycles/byte\n", \
|
||||
mbedtls_printf( "%9lu KiB/s, %9lu cycles/byte\n", \
|
||||
ii * BUFSIZE / 1024, \
|
||||
( mbedtls_timing_hardclock() - tsc ) / ( jj * BUFSIZE ) ); \
|
||||
} while( 0 )
|
||||
|
|
|
|||
|
|
@ -51,6 +51,7 @@ int main( void )
|
|||
#include "mbedtls/x509_csr.h"
|
||||
#include "mbedtls/entropy.h"
|
||||
#include "mbedtls/ctr_drbg.h"
|
||||
#include "mbedtls/md.h"
|
||||
#include "mbedtls/error.h"
|
||||
|
||||
#include <stdio.h>
|
||||
|
|
@ -59,9 +60,9 @@ int main( void )
|
|||
|
||||
#if defined(MBEDTLS_X509_CSR_PARSE_C)
|
||||
#define USAGE_CSR \
|
||||
" request_file=%%s default: (empty)\n" \
|
||||
" If request_file is specified, subject_key,\n" \
|
||||
" subject_pwd and subject_name are ignored!\n"
|
||||
" request_file=%%s default: (empty)\n" \
|
||||
" If request_file is specified, subject_key,\n" \
|
||||
" subject_pwd and subject_name are ignored!\n"
|
||||
#else
|
||||
#define USAGE_CSR ""
|
||||
#endif /* MBEDTLS_X509_CSR_PARSE_C */
|
||||
|
|
@ -83,50 +84,70 @@ int main( void )
|
|||
#define DFL_MAX_PATHLEN -1
|
||||
#define DFL_KEY_USAGE 0
|
||||
#define DFL_NS_CERT_TYPE 0
|
||||
#define DFL_VERSION 3
|
||||
#define DFL_AUTH_IDENT 1
|
||||
#define DFL_SUBJ_IDENT 1
|
||||
#define DFL_CONSTRAINTS 1
|
||||
#define DFL_DIGEST MBEDTLS_MD_SHA256
|
||||
|
||||
#define USAGE \
|
||||
"\n usage: cert_write param=<>...\n" \
|
||||
"\n acceptable parameters:\n" \
|
||||
USAGE_CSR \
|
||||
" subject_key=%%s default: subject.key\n" \
|
||||
" subject_pwd=%%s default: (empty)\n" \
|
||||
" subject_name=%%s default: CN=Cert,O=mbed TLS,C=UK\n" \
|
||||
" subject_key=%%s default: subject.key\n" \
|
||||
" subject_pwd=%%s default: (empty)\n" \
|
||||
" subject_name=%%s default: CN=Cert,O=mbed TLS,C=UK\n" \
|
||||
"\n" \
|
||||
" issuer_crt=%%s default: (empty)\n" \
|
||||
" If issuer_crt is specified, issuer_name is\n" \
|
||||
" ignored!\n" \
|
||||
" issuer_name=%%s default: CN=CA,O=mbed TLS,C=UK\n" \
|
||||
" issuer_crt=%%s default: (empty)\n" \
|
||||
" If issuer_crt is specified, issuer_name is\n" \
|
||||
" ignored!\n" \
|
||||
" issuer_name=%%s default: CN=CA,O=mbed TLS,C=UK\n" \
|
||||
"\n" \
|
||||
" selfsign=%%d default: 0 (false)\n" \
|
||||
" If selfsign is enabled, issuer_name and\n" \
|
||||
" issuer_key are required (issuer_crt and\n" \
|
||||
" subject_* are ignored\n" \
|
||||
" issuer_key=%%s default: ca.key\n" \
|
||||
" issuer_pwd=%%s default: (empty)\n" \
|
||||
" output_file=%%s default: cert.crt\n" \
|
||||
" serial=%%s default: 1\n" \
|
||||
" not_before=%%s default: 20010101000000\n"\
|
||||
" not_after=%%s default: 20301231235959\n"\
|
||||
" is_ca=%%d default: 0 (disabled)\n" \
|
||||
" max_pathlen=%%d default: -1 (none)\n" \
|
||||
" key_usage=%%s default: (empty)\n" \
|
||||
" Comma-separated-list of values:\n" \
|
||||
" digital_signature\n" \
|
||||
" non_repudiation\n" \
|
||||
" key_encipherment\n" \
|
||||
" data_encipherment\n" \
|
||||
" key_agreement\n" \
|
||||
" key_cert_sign\n" \
|
||||
" crl_sign\n" \
|
||||
" ns_cert_type=%%s default: (empty)\n" \
|
||||
" Comma-separated-list of values:\n" \
|
||||
" ssl_client\n" \
|
||||
" ssl_server\n" \
|
||||
" email\n" \
|
||||
" object_signing\n" \
|
||||
" ssl_ca\n" \
|
||||
" email_ca\n" \
|
||||
" object_signing_ca\n" \
|
||||
" selfsign=%%d default: 0 (false)\n" \
|
||||
" If selfsign is enabled, issuer_name and\n" \
|
||||
" issuer_key are required (issuer_crt and\n" \
|
||||
" subject_* are ignored\n" \
|
||||
" issuer_key=%%s default: ca.key\n" \
|
||||
" issuer_pwd=%%s default: (empty)\n" \
|
||||
" output_file=%%s default: cert.crt\n" \
|
||||
" serial=%%s default: 1\n" \
|
||||
" not_before=%%s default: 20010101000000\n"\
|
||||
" not_after=%%s default: 20301231235959\n"\
|
||||
" is_ca=%%d default: 0 (disabled)\n" \
|
||||
" max_pathlen=%%d default: -1 (none)\n" \
|
||||
" md=%%s default: SHA256\n" \
|
||||
" Supported values:\n" \
|
||||
" MD5, SHA1, SHA256, SHA512\n"\
|
||||
" version=%%d default: 3\n" \
|
||||
" Possible values: 1, 2, 3\n"\
|
||||
" subject_identifier=%%s default: 1\n" \
|
||||
" Possible values: 0, 1\n" \
|
||||
" (Considered for v3 only)\n"\
|
||||
" authority_identifier=%%s default: 1\n" \
|
||||
" Possible values: 0, 1\n" \
|
||||
" (Considered for v3 only)\n"\
|
||||
" basic_constraints=%%d default: 1\n" \
|
||||
" Possible values: 0, 1\n" \
|
||||
" (Considered for v3 only)\n"\
|
||||
" key_usage=%%s default: (empty)\n" \
|
||||
" Comma-separated-list of values:\n" \
|
||||
" digital_signature\n" \
|
||||
" non_repudiation\n" \
|
||||
" key_encipherment\n" \
|
||||
" data_encipherment\n" \
|
||||
" key_agreement\n" \
|
||||
" key_cert_sign\n" \
|
||||
" crl_sign\n" \
|
||||
" (Considered for v3 only)\n"\
|
||||
" ns_cert_type=%%s default: (empty)\n" \
|
||||
" Comma-separated-list of values:\n" \
|
||||
" ssl_client\n" \
|
||||
" ssl_server\n" \
|
||||
" email\n" \
|
||||
" object_signing\n" \
|
||||
" ssl_ca\n" \
|
||||
" email_ca\n" \
|
||||
" object_signing_ca\n" \
|
||||
"\n"
|
||||
|
||||
/*
|
||||
|
|
@ -149,6 +170,11 @@ struct options
|
|||
int selfsign; /* selfsign the certificate */
|
||||
int is_ca; /* is a CA certificate */
|
||||
int max_pathlen; /* maximum CA path length */
|
||||
int authority_identifier; /* add authority identifier to CRT */
|
||||
int subject_identifier; /* add subject identifier to CRT */
|
||||
int basic_constraints; /* add basic constraints ext to CRT */
|
||||
int version; /* CRT version */
|
||||
mbedtls_md_type_t md; /* Hash used for signing */
|
||||
unsigned char key_usage; /* key usage flags */
|
||||
unsigned char ns_cert_type; /* NS cert type */
|
||||
} opt;
|
||||
|
|
@ -163,7 +189,8 @@ int write_certificate( mbedtls_x509write_cert *crt, const char *output_file,
|
|||
size_t len = 0;
|
||||
|
||||
memset( output_buf, 0, 4096 );
|
||||
if( ( ret = mbedtls_x509write_crt_pem( crt, output_buf, 4096, f_rng, p_rng ) ) < 0 )
|
||||
if( ( ret = mbedtls_x509write_crt_pem( crt, output_buf, 4096,
|
||||
f_rng, p_rng ) ) < 0 )
|
||||
return( ret );
|
||||
|
||||
len = strlen( (char *) output_buf );
|
||||
|
|
@ -207,7 +234,6 @@ int main( int argc, char *argv[] )
|
|||
* Set to sane values
|
||||
*/
|
||||
mbedtls_x509write_crt_init( &crt );
|
||||
mbedtls_x509write_crt_set_md_alg( &crt, MBEDTLS_MD_SHA256 );
|
||||
mbedtls_pk_init( &loaded_issuer_key );
|
||||
mbedtls_pk_init( &loaded_subject_key );
|
||||
mbedtls_mpi_init( &serial );
|
||||
|
|
@ -243,6 +269,11 @@ int main( int argc, char *argv[] )
|
|||
opt.max_pathlen = DFL_MAX_PATHLEN;
|
||||
opt.key_usage = DFL_KEY_USAGE;
|
||||
opt.ns_cert_type = DFL_NS_CERT_TYPE;
|
||||
opt.version = DFL_VERSION - 1;
|
||||
opt.md = DFL_DIGEST;
|
||||
opt.subject_identifier = DFL_SUBJ_IDENT;
|
||||
opt.authority_identifier = DFL_AUTH_IDENT;
|
||||
opt.basic_constraints = DFL_CONSTRAINTS;
|
||||
|
||||
for( i = 1; i < argc; i++ )
|
||||
{
|
||||
|
|
@ -286,23 +317,88 @@ int main( int argc, char *argv[] )
|
|||
{
|
||||
opt.serial = q;
|
||||
}
|
||||
else if( strcmp( p, "authority_identifier" ) == 0 )
|
||||
{
|
||||
opt.authority_identifier = atoi( q );
|
||||
if( opt.authority_identifier != 0 &&
|
||||
opt.authority_identifier != 1 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "subject_identifier" ) == 0 )
|
||||
{
|
||||
opt.subject_identifier = atoi( q );
|
||||
if( opt.subject_identifier != 0 &&
|
||||
opt.subject_identifier != 1 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "basic_constraints" ) == 0 )
|
||||
{
|
||||
opt.basic_constraints = atoi( q );
|
||||
if( opt.basic_constraints != 0 &&
|
||||
opt.basic_constraints != 1 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "md" ) == 0 )
|
||||
{
|
||||
if( strcmp( q, "SHA1" ) == 0 )
|
||||
opt.md = MBEDTLS_MD_SHA1;
|
||||
else if( strcmp( q, "SHA256" ) == 0 )
|
||||
opt.md = MBEDTLS_MD_SHA256;
|
||||
else if( strcmp( q, "SHA512" ) == 0 )
|
||||
opt.md = MBEDTLS_MD_SHA512;
|
||||
else if( strcmp( q, "MD5" ) == 0 )
|
||||
opt.md = MBEDTLS_MD_MD5;
|
||||
else
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "version" ) == 0 )
|
||||
{
|
||||
opt.version = atoi( q );
|
||||
if( opt.version < 1 || opt.version > 3 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
opt.version--;
|
||||
}
|
||||
else if( strcmp( p, "selfsign" ) == 0 )
|
||||
{
|
||||
opt.selfsign = atoi( q );
|
||||
if( opt.selfsign < 0 || opt.selfsign > 1 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "is_ca" ) == 0 )
|
||||
{
|
||||
opt.is_ca = atoi( q );
|
||||
if( opt.is_ca < 0 || opt.is_ca > 1 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "max_pathlen" ) == 0 )
|
||||
{
|
||||
opt.max_pathlen = atoi( q );
|
||||
if( opt.max_pathlen < -1 || opt.max_pathlen > 127 )
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
}
|
||||
else if( strcmp( p, "key_usage" ) == 0 )
|
||||
{
|
||||
|
|
@ -326,7 +422,10 @@ int main( int argc, char *argv[] )
|
|||
else if( strcmp( q, "crl_sign" ) == 0 )
|
||||
opt.key_usage |= MBEDTLS_X509_KU_CRL_SIGN;
|
||||
else
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
|
||||
q = r;
|
||||
}
|
||||
|
|
@ -353,7 +452,10 @@ int main( int argc, char *argv[] )
|
|||
else if( strcmp( q, "object_signing_ca" ) == 0 )
|
||||
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA;
|
||||
else
|
||||
{
|
||||
mbedtls_printf( "Invalid argument for option %s\n", p );
|
||||
goto usage;
|
||||
}
|
||||
|
||||
q = r;
|
||||
}
|
||||
|
|
@ -376,7 +478,8 @@ int main( int argc, char *argv[] )
|
|||
strlen( pers ) ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d - %s\n", ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d - %s\n",
|
||||
ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -390,7 +493,8 @@ int main( int argc, char *argv[] )
|
|||
if( ( ret = mbedtls_mpi_read_string( &serial, 10, opt.serial ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_mpi_read_string returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_mpi_read_string "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -409,7 +513,8 @@ int main( int argc, char *argv[] )
|
|||
if( ( ret = mbedtls_x509_crt_parse_file( &issuer_crt, opt.issuer_crt ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -418,7 +523,8 @@ int main( int argc, char *argv[] )
|
|||
if( ret < 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_dn_gets "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -441,7 +547,8 @@ int main( int argc, char *argv[] )
|
|||
if( ( ret = mbedtls_x509_csr_parse_file( &csr, opt.request_file ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_csr_parse_file returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_csr_parse_file "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -450,7 +557,8 @@ int main( int argc, char *argv[] )
|
|||
if( ret < 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509_dn_gets "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -474,7 +582,8 @@ int main( int argc, char *argv[] )
|
|||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -489,7 +598,8 @@ int main( int argc, char *argv[] )
|
|||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile "
|
||||
"returned -x%02x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -503,7 +613,8 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_mpi_cmp_mpi( &mbedtls_pk_rsa( issuer_crt.pk )->E,
|
||||
&mbedtls_pk_rsa( *issuer_key )->E ) != 0 )
|
||||
{
|
||||
mbedtls_printf( " failed\n ! issuer_key does not match issuer certificate\n\n" );
|
||||
mbedtls_printf( " failed\n ! issuer_key does not match "
|
||||
"issuer certificate\n\n" );
|
||||
ret = -1;
|
||||
goto exit;
|
||||
}
|
||||
|
|
@ -526,25 +637,31 @@ int main( int argc, char *argv[] )
|
|||
if( ( ret = mbedtls_x509write_crt_set_subject_name( &crt, opt.subject_name ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_subject_name returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_subject_name "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if( ( ret = mbedtls_x509write_crt_set_issuer_name( &crt, opt.issuer_name ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_issuer_name returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_issuer_name "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " . Setting certificate values ..." );
|
||||
fflush( stdout );
|
||||
|
||||
mbedtls_x509write_crt_set_version( &crt, opt.version );
|
||||
mbedtls_x509write_crt_set_md_alg( &crt, opt.md );
|
||||
|
||||
ret = mbedtls_x509write_crt_set_serial( &crt, &serial );
|
||||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_serial returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_serial "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -552,55 +669,74 @@ int main( int argc, char *argv[] )
|
|||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_validity returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_validity "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
|
||||
mbedtls_printf( " . Adding the Basic Constraints extension ..." );
|
||||
fflush( stdout );
|
||||
|
||||
ret = mbedtls_x509write_crt_set_basic_constraints( &crt, opt.is_ca,
|
||||
opt.max_pathlen );
|
||||
if( ret != 0 )
|
||||
if( opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
|
||||
opt.basic_constraints != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! x509write_crt_set_basic_contraints returned -0x%02x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
mbedtls_printf( " . Adding the Basic Constraints extension ..." );
|
||||
fflush( stdout );
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
ret = mbedtls_x509write_crt_set_basic_constraints( &crt, opt.is_ca,
|
||||
opt.max_pathlen );
|
||||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! x509write_crt_set_basic_contraints "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SHA1_C)
|
||||
mbedtls_printf( " . Adding the Subject Key Identifier ..." );
|
||||
fflush( stdout );
|
||||
|
||||
ret = mbedtls_x509write_crt_set_subject_key_identifier( &crt );
|
||||
if( ret != 0 )
|
||||
if( opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
|
||||
opt.subject_identifier != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_subject_key_identifier returned -0x%02x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
mbedtls_printf( " . Adding the Subject Key Identifier ..." );
|
||||
fflush( stdout );
|
||||
|
||||
ret = mbedtls_x509write_crt_set_subject_key_identifier( &crt );
|
||||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_subject"
|
||||
"_key_identifier returned -0x%04x - %s\n\n",
|
||||
-ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
|
||||
mbedtls_printf( " . Adding the Authority Key Identifier ..." );
|
||||
fflush( stdout );
|
||||
|
||||
ret = mbedtls_x509write_crt_set_authority_key_identifier( &crt );
|
||||
if( ret != 0 )
|
||||
if( opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
|
||||
opt.authority_identifier != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_authority_key_identifier returned -0x%02x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
mbedtls_printf( " . Adding the Authority Key Identifier ..." );
|
||||
fflush( stdout );
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
ret = mbedtls_x509write_crt_set_authority_key_identifier( &crt );
|
||||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_authority_"
|
||||
"key_identifier returned -0x%04x - %s\n\n",
|
||||
-ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
}
|
||||
#endif /* MBEDTLS_SHA1_C */
|
||||
|
||||
if( opt.key_usage )
|
||||
if( opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
|
||||
opt.key_usage != 0 )
|
||||
{
|
||||
mbedtls_printf( " . Adding the Key Usage extension ..." );
|
||||
fflush( stdout );
|
||||
|
|
@ -609,14 +745,16 @@ int main( int argc, char *argv[] )
|
|||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_key_usage returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_key_usage "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
mbedtls_printf( " ok\n" );
|
||||
}
|
||||
|
||||
if( opt.ns_cert_type )
|
||||
if( opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
|
||||
opt.ns_cert_type != 0 )
|
||||
{
|
||||
mbedtls_printf( " . Adding the NS Cert Type extension ..." );
|
||||
fflush( stdout );
|
||||
|
|
@ -625,7 +763,8 @@ int main( int argc, char *argv[] )
|
|||
if( ret != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_ns_cert_type returned -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! mbedtls_x509write_crt_set_ns_cert_type "
|
||||
"returned -0x%04x - %s\n\n", -ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
@ -642,7 +781,8 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
|
||||
{
|
||||
mbedtls_strerror( ret, buf, 1024 );
|
||||
mbedtls_printf( " failed\n ! write_certifcate -0x%02x - %s\n\n", -ret, buf );
|
||||
mbedtls_printf( " failed\n ! write_certificate -0x%04x - %s\n\n",
|
||||
-ret, buf );
|
||||
goto exit;
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue