From 5314e08e087a3fe57e2c7e8f9db577b5b1138a7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 17 Jun 2021 10:32:01 +0200 Subject: [PATCH 1/3] Make the fields of mbedtls_x509_crt_profile public MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These fields are supposed to be manipulated directly, that's how people create custom profiles. Signed-off-by: Manuel Pégourié-Gonnard --- include/mbedtls/x509_crt.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index d383168d25..e6a9f7ad7c 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -159,10 +159,10 @@ mbedtls_x509_subject_alternative_name; */ typedef struct mbedtls_x509_crt_profile { - uint32_t MBEDTLS_PRIVATE(allowed_mds); /**< MDs for signatures */ - uint32_t MBEDTLS_PRIVATE(allowed_pks); /**< PK algs for signatures */ - uint32_t MBEDTLS_PRIVATE(allowed_curves); /**< Elliptic curves for ECDSA */ - uint32_t MBEDTLS_PRIVATE(rsa_min_bitlen); /**< Minimum size for RSA keys */ + uint32_t allowed_mds; /**< MDs for signatures */ + uint32_t allowed_pks; /**< PK algs for signatures */ + uint32_t allowed_curves; /**< Elliptic curves for ECDSA */ + uint32_t rsa_min_bitlen; /**< Minimum size for RSA keys */ } mbedtls_x509_crt_profile; From 55a7fb8322f10d9a2b53d59ac9eff72a83c88d8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 17 Jun 2021 10:39:39 +0200 Subject: [PATCH 2/3] Improve documentation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- include/mbedtls/x509_crt.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index e6a9f7ad7c..3d64a4c937 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -156,6 +156,10 @@ mbedtls_x509_subject_alternative_name; * Security profile for certificate verification. * * All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG(). + * + * The fields of this structure are part of the public API and can be + * manipulated directly by applications. Future versions of the library may + * add extra fields or reorder existing fields. */ typedef struct mbedtls_x509_crt_profile { From 9d4c2c4e42c1a05618899c3df1d506182f6d37a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 18 Jun 2021 09:48:27 +0200 Subject: [PATCH 3/3] Clarify how to create custom profiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- include/mbedtls/x509_crt.h | 22 ++++++++++++++++++++++ library/x509_crt.c | 11 +++++++++++ 2 files changed, 33 insertions(+) diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index 3d64a4c937..f81218ae51 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -160,6 +160,22 @@ mbedtls_x509_subject_alternative_name; * The fields of this structure are part of the public API and can be * manipulated directly by applications. Future versions of the library may * add extra fields or reorder existing fields. + * + * You can create custom profiles by starting from a copy of + * an existing profile, such as mbedtls_x509_crt_profile_default or + * mbedtls_x509_ctr_profile_none and then tune it to your needs. + * + * For example to allow SHA-224 in addition to the default: + * + * mbedtls_x509_crt_profile my_profile = mbedtls_x509_crt_profile_default; + * my_profile.allowed_mds |= MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA224 ); + * + * Or to allow only RSA-3072+ with SHA-256: + * + * mbedtls_x509_crt_profile my_profile = mbedtls_x509_crt_profile_none; + * my_profile.allowed_mds = MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA256 ); + * my_profile.allowed_pks = MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_RSA ); + * my_profile.rsa_min_bitlen = 3072; */ typedef struct mbedtls_x509_crt_profile { @@ -350,6 +366,12 @@ extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next; */ extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb; +/** + * Empty profile that allows nothing. Useful as a basis for constructing + * custom profiles. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none; + /** * \brief Parse a single DER formatted certificate and add it * to the end of the provided chained list. diff --git a/library/x509_crt.c b/library/x509_crt.c index d4e0ffd404..fdddbd3b09 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -156,6 +156,17 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb = 0, }; +/* + * Empty / all-forbidden profile + */ +const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none = +{ + 0, + 0, + 0, + (uint32_t) -1, +}; + /* * Check md_alg against profile * Return 0 if md_alg is acceptable for this profile, -1 otherwise