Skip to content

Support challenge password attribute in CSR #7444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: development
Choose a base branch
from
Open

Support challenge password attribute in CSR #7444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions include/mbedtls/oid.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,7 @@
/*
* PKCS#8 OIDs
*/
#define MBEDTLS_OID_PKCS9_CSR_CHAL_PW MBEDTLS_OID_PKCS9 "\x07" /**< challenge password OBJECT IDENTIFIER ::= {pkcs-9 7 } */
#define MBEDTLS_OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9 "\x0e" /**< extensionRequest OBJECT IDENTIFIER ::= {pkcs-9 14} */

/*
Expand Down
3 changes: 3 additions & 0 deletions include/mbedtls/x509.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@
#define MBEDTLS_X509_FORMAT_PEM 2

#define MBEDTLS_X509_MAX_DN_NAME_SIZE 256 /**< Maximum value size of a DN entry */
#define MBEDTLS_X509_MAX_PKCS9_STR 255 /** pkcs-9-ub-pkcs9String INTEGER ::= 255 */

#ifdef __cplusplus
extern "C" {
Expand Down Expand Up @@ -461,6 +462,8 @@ int mbedtls_x509_write_names(unsigned char **p, unsigned char *start,
int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
const char *oid, size_t oid_len,
unsigned char *sig, size_t size);
int mbedtls_x509_write_challenge_password(unsigned char **p, unsigned char *start,
mbedtls_asn1_buf *chal_pw);
int mbedtls_x509_get_ns_cert_type(unsigned char **p,
const unsigned char *end,
unsigned char *ns_cert_type);
Expand Down
14 changes: 14 additions & 0 deletions include/mbedtls/x509_csr.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ typedef struct mbedtls_x509write_csr {
mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject);
mbedtls_md_type_t MBEDTLS_PRIVATE(md_alg);
mbedtls_asn1_named_data *MBEDTLS_PRIVATE(extensions);
mbedtls_asn1_buf MBEDTLS_PRIVATE(chal_pw);
}
mbedtls_x509write_csr;

Expand Down Expand Up @@ -278,6 +279,19 @@ int mbedtls_x509write_csr_set_extension(mbedtls_x509write_csr *ctx,
int critical,
const unsigned char *val, size_t val_len);

/**
* \brief Set a CSR challenge password
*
* \param ctx CSR context to use
* \param chal_pw challenge password OCTET STRING
* \param chal_pw_len length of the challenge password data
* \param printable tag as printable string (\c 1) or UTF8 string (\c 0)
*
* \return 0 if successful, or a MBEDTLS_ERR_X509_BAD_INPUT_DATA
*/
int mbedtls_x509write_csr_set_challenge_password(mbedtls_x509write_csr *ctx,
unsigned char *chal_pw, size_t chal_pw_len,
int printable);
/**
* \brief Free the contents of a CSR context
*
Expand Down
31 changes: 31 additions & 0 deletions library/x509_create.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,6 +362,37 @@ int mbedtls_x509_write_extensions(unsigned char **p, unsigned char *start,
cur_ext = cur_ext->next;
}

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(p, start,
MBEDTLS_ASN1_CONSTRUCTED |
MBEDTLS_ASN1_SEQUENCE));

return (int) len;
}

/*
* challengePassword ATTRIBUTE ::= {
* WITH SYNTAX PKCS9String
* EQUALITY MATCHING RULE caseExactMatch
* SINGLE VALUE TRUE
* ID pkcs-9-at-challengePassword
*/
int mbedtls_x509_write_challenge_password(unsigned char **p, unsigned char *start,
mbedtls_asn1_buf *chal_pw)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t len = 0;
int (*str_writer)(unsigned char **, const unsigned char *,
const char *, size_t) = &mbedtls_asn1_write_printable_string;

if (chal_pw->tag == MBEDTLS_ASN1_UTF8_STRING) {
str_writer = &mbedtls_asn1_write_utf8_string;
}

MBEDTLS_ASN1_CHK_ADD(len,
(*str_writer)(p, start, (const char *) chal_pw->p, chal_pw->len));

return (int) len;
}

Expand Down
5 changes: 0 additions & 5 deletions library/x509write_crt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,11 +468,6 @@ int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx,
mbedtls_x509_write_extensions(&c,
buf, ctx->extensions));
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(&c, buf,
MBEDTLS_ASN1_CONSTRUCTED |
MBEDTLS_ASN1_SEQUENCE));
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(&c, buf,
MBEDTLS_ASN1_CONTEXT_SPECIFIC |
Expand Down
107 changes: 87 additions & 20 deletions library/x509write_csr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,71 @@ int mbedtls_x509write_csr_set_ns_cert_type(mbedtls_x509write_csr *ctx,
return 0;
}

int mbedtls_x509write_csr_set_challenge_password(mbedtls_x509write_csr *ctx,
unsigned char *chal_pw,
size_t chal_pw_len,
int printable)
{
if (chal_pw_len == 0 || chal_pw == NULL) {
return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
}

/* pkcs-9-ub-challengePassword INTEGER ::= pkcs-9-ub-pkcs9String */
if (chal_pw_len > MBEDTLS_X509_MAX_PKCS9_STR) {
return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
}

if (printable == 0) {
ctx->chal_pw.tag = MBEDTLS_ASN1_UTF8_STRING;
} else {
ctx->chal_pw.tag = MBEDTLS_ASN1_PRINTABLE_STRING;
}

ctx->chal_pw.len = chal_pw_len;
ctx->chal_pw.p = chal_pw;

return 0;
}

/*
* RFC 2986 - 4.1 CertificationRequestInfo
*
* Attributes { ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}
*
* CRIAttributes ATTRIBUTE ::= {
* ... -- add any locally defined attributes here -- }
*
* Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
* type ATTRIBUTE.&id({IOSet}),
* values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type})
* }
*
*/
static int x509write_csr_attribute(unsigned char **p,
unsigned char *start,
const char *oid, size_t oid_len,
size_t val_len)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t len = val_len;

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(
p, start,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET));

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_oid(p, start, oid, oid_len));

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(
p, start,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));

return (int) (len - val_len);
}

static int x509write_csr_der_internal(mbedtls_x509write_csr *ctx,
unsigned char *buf,
size_t size,
Expand All @@ -255,32 +320,34 @@ static int x509write_csr_der_internal(mbedtls_x509write_csr *ctx,
/* Write the CSR backwards starting from the end of buf */
c = buf + size;

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_x509_write_extensions(&c, buf,
ctx->extensions));
if (ctx->extensions != NULL) {
size_t attr_len = 0;

if (len) {
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(
MBEDTLS_ASN1_CHK_ADD(attr_len,
mbedtls_x509_write_extensions(&c, buf, ctx->extensions));
MBEDTLS_ASN1_CHK_ADD(attr_len,
x509write_csr_attribute(
&c, buf,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
MBEDTLS_OID_SIZE(MBEDTLS_OID_PKCS9_CSR_EXT_REQ),
attr_len));

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(
&c, buf,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET));
len += attr_len;
}

MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_oid(
&c, buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
MBEDTLS_OID_SIZE(MBEDTLS_OID_PKCS9_CSR_EXT_REQ)));
if (ctx->chal_pw.p != NULL) {
size_t attr_len = 0;

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_tag(
MBEDTLS_ASN1_CHK_ADD(attr_len,
mbedtls_x509_write_challenge_password(&c, buf, &(ctx->chal_pw)));
MBEDTLS_ASN1_CHK_ADD(attr_len,
x509write_csr_attribute(
&c, buf,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
MBEDTLS_OID_PKCS9_CSR_CHAL_PW,
MBEDTLS_OID_SIZE(MBEDTLS_OID_PKCS9_CSR_CHAL_PW),
attr_len));

len += attr_len;
}

MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&c, buf, len));
Expand Down