mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-03-22 13:20:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add support for x509 SAN RCF822 and DirectoryName for csr generation

Browse Source 
Unify the code with the x509 crt counterpart.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
This commit is contained in:
Andrzej Kurek 2023-07-07 05:12:52 -04:00
parent 9967f11066
commit 1c8ecbef64
2 changed files with 64 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
library/x509write_crt.c
View File

@ -288,6 +288,11 @@ int mbedtls_x509write_crt_set_subject_alternative_name(mbedtls_x509write_cert *c
buf + buflen - len, buf + buflen - len,
len); len);
/* If we exceeded the allocated buffer it means that maximum size of the SubjectAltName list
* was incorrectly calculated and memory is corrupted. */
if (p < buf) {
ret = MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
}
cleanup: cleanup:
mbedtls_free(buf); mbedtls_free(buf);
return ret; return ret;

71
library/x509write_csr.c
View File

@ -48,6 +48,16 @@
#include "mbedtls/platform.h" #include "mbedtls/platform.h"
#define CHECK_OVERFLOW_ADD(a, b) \
do \
{ \
if (a > SIZE_MAX - (b)) \
{ \
return MBEDTLS_ERR_X509_BAD_INPUT_DATA; \
} \
a += b; \
} while (0)
void mbedtls_x509write_csr_init(mbedtls_x509write_csr *ctx) void mbedtls_x509write_csr_init(mbedtls_x509write_csr *ctx)
{ {
memset(ctx, 0, sizeof(mbedtls_x509write_csr)); memset(ctx, 0, sizeof(mbedtls_x509write_csr));
@ -103,37 +113,53 @@ int mbedtls_x509write_csr_set_subject_alternative_name(mbedtls_x509write_csr *ct
case MBEDTLS_X509_SAN_DNS_NAME: case MBEDTLS_X509_SAN_DNS_NAME:
case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
case MBEDTLS_X509_SAN_IP_ADDRESS: case MBEDTLS_X509_SAN_IP_ADDRESS:
case MBEDTLS_X509_SAN_RFC822_NAME:
/* length of value for each name entry, /* length of value for each name entry,
* maximum 4 bytes for the length field, * maximum 4 bytes for the length field,
* 1 byte for the tag/type. * 1 byte for the tag/type.
*/ */
buflen += cur->node.san.unstructured_name.len + 4 + 1; CHECK_OVERFLOW_ADD(buflen, cur->node.san.unstructured_name.len);
CHECK_OVERFLOW_ADD(buflen, 4 + 1);
break; break;
case MBEDTLS_X509_SAN_DIRECTORY_NAME:
{
const mbedtls_asn1_named_data *chunk = &cur->node.san.directory_name;
while (chunk != NULL) {
// Max 4 bytes for length, +1 for tag,
// additional 4 max for length, +1 for tag.
// See x509_write_name for more information.
CHECK_OVERFLOW_ADD(buflen, 4 + 1 + 4 + 1);
CHECK_OVERFLOW_ADD(buflen, chunk->oid.len);
CHECK_OVERFLOW_ADD(buflen, chunk->val.len);
chunk = chunk->next;
}
CHECK_OVERFLOW_ADD(buflen, 4 + 1);
break;
}
default: default:
/* Not supported - skip. */ /* Not supported - return. */
break; return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE;
} }
} }
/* Add the extra length field and tag */ /* Add the extra length field and tag */
buflen += 4 + 1; CHECK_OVERFLOW_ADD(buflen, 4 + 1);
/* Allocate buffer */ /* Allocate buffer */
buf = mbedtls_calloc(1, buflen); buf = mbedtls_calloc(1, buflen);
if (buf == NULL) { if (buf == NULL) {
return MBEDTLS_ERR_ASN1_ALLOC_FAILED; return MBEDTLS_ERR_ASN1_ALLOC_FAILED;
} }
mbedtls_platform_zeroize(buf, buflen);
p = buf + buflen; p = buf + buflen;
/* Write ASN.1-based structure */ /* Write ASN.1-based structure */
cur = san_list; cur = san_list;
len = 0; len = 0;
while (cur != NULL) { while (cur != NULL) {
size_t single_san_len = 0;
switch (cur->node.type) { switch (cur->node.type) {
case MBEDTLS_X509_SAN_DNS_NAME: case MBEDTLS_X509_SAN_DNS_NAME:
case MBEDTLS_X509_SAN_RFC822_NAME:
case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
case MBEDTLS_X509_SAN_IP_ADDRESS: case MBEDTLS_X509_SAN_IP_ADDRESS:
{ {
@ -141,23 +167,44 @@ int mbedtls_x509write_csr_set_subject_alternative_name(mbedtls_x509write_csr *ct
(const unsigned char *) cur->node.san.unstructured_name.p; (const unsigned char *) cur->node.san.unstructured_name.p;
size_t unstructured_name_len = cur->node.san.unstructured_name.len; size_t unstructured_name_len = cur->node.san.unstructured_name.len;
MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len,
mbedtls_asn1_write_raw_buffer( mbedtls_asn1_write_raw_buffer(
&p, buf, &p, buf,
unstructured_name, unstructured_name_len)); unstructured_name, unstructured_name_len));
MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, mbedtls_asn1_write_len( MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len, mbedtls_asn1_write_len(
&p, buf, unstructured_name_len)); &p, buf, unstructured_name_len));
MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len,
mbedtls_asn1_write_tag( mbedtls_asn1_write_tag(
&p, buf, &p, buf,
MBEDTLS_ASN1_CONTEXT_SPECIFIC | cur->node.type)); MBEDTLS_ASN1_CONTEXT_SPECIFIC | cur->node.type));
} }
break; break;
default: case MBEDTLS_X509_SAN_DIRECTORY_NAME:
/* Skip unsupported names. */ MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len,
mbedtls_x509_write_names(&p, buf,
(mbedtls_asn1_named_data *) &
cur->node
.san.directory_name));
MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len,
mbedtls_asn1_write_len(&p, buf, single_san_len));
MBEDTLS_ASN1_CHK_CLEANUP_ADD(single_san_len,
mbedtls_asn1_write_tag(&p, buf,
MBEDTLS_ASN1_CONTEXT_SPECIFIC |
MBEDTLS_ASN1_CONSTRUCTED |
MBEDTLS_X509_SAN_DIRECTORY_NAME));
break; break;
default:
/* Error out on an unsupported SAN */
ret = MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE;
goto cleanup;
} }
cur = cur->next; cur = cur->next;
/* check for overflow */
if (len > SIZE_MAX - single_san_len) {
ret = MBEDTLS_ERR_X509_BAD_INPUT_DATA;
goto cleanup;
}
len += single_san_len;
} }
MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, mbedtls_asn1_write_len(&p, buf, len)); MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, mbedtls_asn1_write_len(&p, buf, len));