source: azure_iot_hub_mbedtls/trunk/mbedtls-2.16.1/library/x509write_csr.c@ 398

Last change on this file since 398 was 398, checked in by coas-nagasima, 5 years ago

mbedTLS版Azure IoT Hub接続サンプルのソースコードを追加
  • Property svn:eol-style set to native
  • Property svn:mime-type set to text/x-csrc;charset=UTF-8
File size: 9.3 KB
Line 
1/*
2 * X.509 Certificate Signing Request writing
3 *
4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21/*
22 * References:
23 * - CSRs: PKCS#10 v1.7 aka RFC 2986
24 * - attributes: PKCS#9 v2.0 aka RFC 2985
25 */
26
27#if !defined(MBEDTLS_CONFIG_FILE)
28#include "mbedtls/config.h"
29#else
30#include MBEDTLS_CONFIG_FILE
31#endif
32
33#if defined(MBEDTLS_X509_CSR_WRITE_C)
34
35#include "mbedtls/x509_csr.h"
36#include "mbedtls/oid.h"
37#include "mbedtls/asn1write.h"
38#include "mbedtls/platform_util.h"
39
40#include <string.h>
41#include <stdlib.h>
42
43#if defined(MBEDTLS_PEM_WRITE_C)
44#include "mbedtls/pem.h"
45#endif
46
47void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx )
48{
49 memset( ctx, 0, sizeof( mbedtls_x509write_csr ) );
50}
51
52void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx )
53{
54 mbedtls_asn1_free_named_data_list( &ctx->subject );
55 mbedtls_asn1_free_named_data_list( &ctx->extensions );
56
57 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_x509write_csr ) );
58}
59
60void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg )
61{
62 ctx->md_alg = md_alg;
63}
64
65void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key )
66{
67 ctx->key = key;
68}
69
70int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx,
71 const char *subject_name )
72{
73 return mbedtls_x509_string_to_names( &ctx->subject, subject_name );
74}
75
76int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx,
77 const char *oid, size_t oid_len,
78 const unsigned char *val, size_t val_len )
79{
80 return mbedtls_x509_set_extension( &ctx->extensions, oid, oid_len,
81 0, val, val_len );
82}
83
84static size_t csr_get_unused_bits_for_named_bitstring( unsigned char bitstring,
85 size_t bit_offset )
86{
87 size_t unused_bits;
88
89 /* Count the unused bits removing trailing 0s */
90 for( unused_bits = bit_offset; unused_bits < 8; unused_bits++ )
91 if( ( ( bitstring >> unused_bits ) & 0x1 ) != 0 )
92 break;
93
94 return( unused_bits );
95}
96
97int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage )
98{
99 unsigned char buf[4];
100 unsigned char *c;
101 size_t unused_bits;
102 int ret;
103
104 c = buf + 4;
105
106 unused_bits = csr_get_unused_bits_for_named_bitstring( key_usage, 0 );
107 ret = mbedtls_asn1_write_bitstring( &c, buf, &key_usage, 8 - unused_bits );
108
109 if( ret < 0 )
110 return( ret );
111 else if( ret < 3 || ret > 4 )
112 return( MBEDTLS_ERR_X509_INVALID_FORMAT );
113
114 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
115 MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
116 c, (size_t)ret );
117 if( ret != 0 )
118 return( ret );
119
120 return( 0 );
121}
122
123int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
124 unsigned char ns_cert_type )
125{
126 unsigned char buf[4];
127 unsigned char *c;
128 size_t unused_bits;
129 int ret;
130
131 c = buf + 4;
132
133 unused_bits = csr_get_unused_bits_for_named_bitstring( ns_cert_type, 0 );
134 ret = mbedtls_asn1_write_bitstring( &c,
135 buf,
136 &ns_cert_type,
137 8 - unused_bits );
138
139 if( ret < 0 )
140 return( ret );
141 else if( ret < 3 || ret > 4 )
142 return( ret );
143
144 ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
145 MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
146 c, (size_t)ret );
147 if( ret != 0 )
148 return( ret );
149
150 return( 0 );
151}
152
153int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
154 int (*f_rng)(void *, unsigned char *, size_t),
155 void *p_rng )
156{
157 int ret;
158 const char *sig_oid;
159 size_t sig_oid_len = 0;
160 unsigned char *c, *c2;
161 unsigned char hash[64];
162 unsigned char sig[MBEDTLS_MPI_MAX_SIZE];
163 unsigned char tmp_buf[2048];
164 size_t pub_len = 0, sig_and_oid_len = 0, sig_len;
165 size_t len = 0;
166 mbedtls_pk_type_t pk_alg;
167
168 /*
169 * Prepare data to be signed in tmp_buf
170 */
171 c = tmp_buf + sizeof( tmp_buf );
172
173 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_extensions( &c, tmp_buf, ctx->extensions ) );
174
175 if( len )
176 {
177 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
178 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
179 MBEDTLS_ASN1_SEQUENCE ) );
180
181 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
182 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
183 MBEDTLS_ASN1_SET ) );
184
185 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &c, tmp_buf, MBEDTLS_OID_PKCS9_CSR_EXT_REQ,
186 MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_CSR_EXT_REQ ) ) );
187
188 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
189 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
190 MBEDTLS_ASN1_SEQUENCE ) );
191 }
192
193 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
194 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
195 MBEDTLS_ASN1_CONTEXT_SPECIFIC ) );
196
197 MBEDTLS_ASN1_CHK_ADD( pub_len, mbedtls_pk_write_pubkey_der( ctx->key,
198 tmp_buf, c - tmp_buf ) );
199 c -= pub_len;
200 len += pub_len;
201
202 /*
203 * Subject ::= Name
204 */
205 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_x509_write_names( &c, tmp_buf, ctx->subject ) );
206
207 /*
208 * Version ::= INTEGER { v1(0), v2(1), v3(2) }
209 */
210 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, tmp_buf, 0 ) );
211
212 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, tmp_buf, len ) );
213 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, tmp_buf, MBEDTLS_ASN1_CONSTRUCTED |
214 MBEDTLS_ASN1_SEQUENCE ) );
215
216 /*
217 * Prepare signature
218 */
219 mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
220
221 if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0, sig, &sig_len,
222 f_rng, p_rng ) ) != 0 )
223 {
224 return( ret );
225 }
226
227 if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) )
228 pk_alg = MBEDTLS_PK_RSA;
229 else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) )
230 pk_alg = MBEDTLS_PK_ECDSA;
231 else
232 return( MBEDTLS_ERR_X509_INVALID_ALG );
233
234 if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
235 &sig_oid, &sig_oid_len ) ) != 0 )
236 {
237 return( ret );
238 }
239
240 /*
241 * Write data to output buffer
242 */
243 c2 = buf + size;
244 MBEDTLS_ASN1_CHK_ADD( sig_and_oid_len, mbedtls_x509_write_sig( &c2, buf,
245 sig_oid, sig_oid_len, sig, sig_len ) );
246
247 if( len > (size_t)( c2 - buf ) )
248 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
249
250 c2 -= len;
251 memcpy( c2, c, len );
252
253 len += sig_and_oid_len;
254 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c2, buf, len ) );
255 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c2, buf, MBEDTLS_ASN1_CONSTRUCTED |
256 MBEDTLS_ASN1_SEQUENCE ) );
257
258 return( (int) len );
259}
260
261#define PEM_BEGIN_CSR "-----BEGIN CERTIFICATE REQUEST-----\n"
262#define PEM_END_CSR "-----END CERTIFICATE REQUEST-----\n"
263
264#if defined(MBEDTLS_PEM_WRITE_C)
265int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size,
266 int (*f_rng)(void *, unsigned char *, size_t),
267 void *p_rng )
268{
269 int ret;
270 unsigned char output_buf[4096];
271 size_t olen = 0;
272
273 if( ( ret = mbedtls_x509write_csr_der( ctx, output_buf, sizeof(output_buf),
274 f_rng, p_rng ) ) < 0 )
275 {
276 return( ret );
277 }
278
279 if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
280 output_buf + sizeof(output_buf) - ret,
281 ret, buf, size, &olen ) ) != 0 )
282 {
283 return( ret );
284 }
285
286 return( 0 );
287}
288#endif /* MBEDTLS_PEM_WRITE_C */
289
290#endif /* MBEDTLS_X509_CSR_WRITE_C */
Note: See TracBrowser for help on using the repository browser.