mirror of
https://git.suyu.dev/suyu/mbedtls.git
synced 2025-12-24 00:06:32 +01:00
Merge remote-tracking branch 'upstream-public/pr/1089' into development
Resolve trivial conflict due to additions in the same place in tests/data_files/Makefile; minor comment/whitespace presentation improvements.
This commit is contained in:
Gilles Peskine
commit
ea8d697fa2
17 changed files with 604 additions and 163 deletions
|
|
@ -51,7 +51,7 @@ static void mbedtls_zeroize( void *v, size_t n ) {
|
|||
|
||||
void mbedtls_x509write_crt_init( mbedtls_x509write_cert *ctx )
|
||||
{
|
||||
memset( ctx, 0, sizeof(mbedtls_x509write_cert) );
|
||||
memset( ctx, 0, sizeof( mbedtls_x509write_cert ) );
|
||||
|
||||
mbedtls_mpi_init( &ctx->serial );
|
||||
ctx->version = MBEDTLS_X509_CRT_VERSION_3;
|
||||
|
|
@ -65,7 +65,7 @@ void mbedtls_x509write_crt_free( mbedtls_x509write_cert *ctx )
|
|||
mbedtls_asn1_free_named_data_list( &ctx->issuer );
|
||||
mbedtls_asn1_free_named_data_list( &ctx->extensions );
|
||||
|
||||
mbedtls_zeroize( ctx, sizeof(mbedtls_x509write_cert) );
|
||||
mbedtls_zeroize( ctx, sizeof( mbedtls_x509write_cert ) );
|
||||
}
|
||||
|
||||
void mbedtls_x509write_crt_set_version( mbedtls_x509write_cert *ctx, int version )
|
||||
|
|
@ -193,14 +193,14 @@ int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *
|
|||
{
|
||||
int ret;
|
||||
unsigned char buf[MBEDTLS_MPI_MAX_SIZE * 2 + 20]; /* tag, length + 2xMPI */
|
||||
unsigned char *c = buf + sizeof(buf);
|
||||
unsigned char *c = buf + sizeof( buf );
|
||||
size_t len = 0;
|
||||
|
||||
memset( buf, 0, sizeof(buf) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_pk_write_pubkey( &c, buf, ctx->issuer_key ) );
|
||||
|
||||
mbedtls_sha1( buf + sizeof(buf) - len, len, buf + sizeof(buf) - 20 );
|
||||
c = buf + sizeof(buf) - 20;
|
||||
mbedtls_sha1( buf + sizeof( buf ) - len, len, buf + sizeof( buf ) - 20 );
|
||||
c = buf + sizeof( buf ) - 20;
|
||||
len = 20;
|
||||
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) );
|
||||
|
|
@ -212,7 +212,7 @@ int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *
|
|||
|
||||
return mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER,
|
||||
MBEDTLS_OID_SIZE( MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER ),
|
||||
0, buf + sizeof(buf) - len, len );
|
||||
0, buf + sizeof( buf ) - len, len );
|
||||
}
|
||||
#endif /* MBEDTLS_SHA1_C */
|
||||
|
||||
|
|
@ -313,12 +313,18 @@ int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf,
|
|||
c = tmp_buf + sizeof( tmp_buf );
|
||||
|
||||
/* Signature algorithm needed in TBS, and later for actual signature */
|
||||
pk_alg = mbedtls_pk_get_type( ctx->issuer_key );
|
||||
if( pk_alg == MBEDTLS_PK_ECKEY )
|
||||
|
||||
/* There's no direct way of extracting a signature algorithm
|
||||
* (represented as an element of mbedtls_pk_type_t) from a PK instance. */
|
||||
if( mbedtls_pk_can_do( ctx->issuer_key, MBEDTLS_PK_RSA ) )
|
||||
pk_alg = MBEDTLS_PK_RSA;
|
||||
else if( mbedtls_pk_can_do( ctx->issuer_key, MBEDTLS_PK_ECDSA ) )
|
||||
pk_alg = MBEDTLS_PK_ECDSA;
|
||||
else
|
||||
return( MBEDTLS_ERR_X509_INVALID_ALG );
|
||||
|
||||
if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
|
||||
&sig_oid, &sig_oid_len ) ) != 0 )
|
||||
&sig_oid, &sig_oid_len ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
|
@ -326,13 +332,18 @@ int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf,
|
|||
/*
|
||||
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
||||
*/
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
|
||||
MBEDTLS_ASN1_SEQUENCE ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONTEXT_SPECIFIC |
|
||||
MBEDTLS_ASN1_CONSTRUCTED | 3 ) );
|
||||
|
||||
/* Only for v3 */
|
||||
if( ctx->version == MBEDTLS_X509_CRT_VERSION_3 )
|
||||
{
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
|
||||
MBEDTLS_ASN1_SEQUENCE ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONTEXT_SPECIFIC |
|
||||
MBEDTLS_ASN1_CONSTRUCTED | 3 ) );
|
||||
}
|
||||
|
||||
/*
|
||||
* SubjectPublicKeyInfo
|
||||
|
|
@ -384,16 +395,21 @@ int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf,
|
|||
/*
|
||||
* Version ::= INTEGER { v1(0), v2(1), v3(2) }
|
||||
*/
|
||||
sub_len = 0;
|
||||
MBEDTLS_ASN1_CHK_ADD( sub_len, mbedtls_asn1_write_int( &c, tmp_buf, ctx->version ) );
|
||||
len += sub_len;
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, sub_len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONTEXT_SPECIFIC |
|
||||
MBEDTLS_ASN1_CONSTRUCTED | 0 ) );
|
||||
|
||||
/* Can be omitted for v1 */
|
||||
if( ctx->version != MBEDTLS_X509_CRT_VERSION_1 )
|
||||
{
|
||||
sub_len = 0;
|
||||
MBEDTLS_ASN1_CHK_ADD( sub_len, mbedtls_asn1_write_int( &c, tmp_buf, ctx->version ) );
|
||||
len += sub_len;
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, sub_len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONTEXT_SPECIFIC |
|
||||
MBEDTLS_ASN1_CONSTRUCTED | 0 ) );
|
||||
}
|
||||
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
|
||||
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
|
||||
MBEDTLS_ASN1_SEQUENCE ) );
|
||||
MBEDTLS_ASN1_SEQUENCE ) );
|
||||
|
||||
/*
|
||||
* Make signature
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ static void mbedtls_zeroize( void *v, size_t n ) {
|
|||
|
||||
void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
|
||||
{
|
||||
memset( ctx, 0, sizeof(mbedtls_x509write_csr) );
|
||||
memset( ctx, 0, sizeof( mbedtls_x509write_csr ) );
|
||||
}
|
||||
|
||||
void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
|
||||
|
|
@ -58,7 +58,7 @@ void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
|
|||
mbedtls_asn1_free_named_data_list( &ctx->subject );
|
||||
mbedtls_asn1_free_named_data_list( &ctx->extensions );
|
||||
|
||||
mbedtls_zeroize( ctx, sizeof(mbedtls_x509write_csr) );
|
||||
mbedtls_zeroize( ctx, sizeof( mbedtls_x509write_csr ) );
|
||||
}
|
||||
|
||||
void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
|
||||
|
|
@ -194,14 +194,21 @@ int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, s
|
|||
*/
|
||||
mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
|
||||
|
||||
pk_alg = mbedtls_pk_get_type( ctx->key );
|
||||
if( pk_alg == MBEDTLS_PK_ECKEY )
|
||||
pk_alg = MBEDTLS_PK_ECDSA;
|
||||
|
||||
if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
|
||||
f_rng, p_rng ) ) != 0 ||
|
||||
( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
|
||||
&sig_oid, &sig_oid_len ) ) != 0 )
|
||||
f_rng, p_rng ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
||||
if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) )
|
||||
pk_alg = MBEDTLS_PK_RSA;
|
||||
else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) )
|
||||
pk_alg = MBEDTLS_PK_ECDSA;
|
||||
else
|
||||
return( MBEDTLS_ERR_X509_INVALID_ALG );
|
||||
|
||||
if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
|
||||
&sig_oid, &sig_oid_len ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue