Skip to content

Commit ce1cf18

Browse files
BrianSiposBrianSipos
committed
Add parsing of Name Constraints extension, allow handling raw Other Name data
Signed-off-by: Brian Sipos <[email protected]>
1 parent 5a77c23 commit ce1cf18

File tree

9 files changed

+366
-35
lines changed

9 files changed

+366
-35
lines changed

‎ChangeLog.d/register-name-constraints.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Features
2+
* Decode Name Constraints extension.
3+
* Show info for Name Constraints for a certificate.
4+
* Handle Other Name type of General Name as opaque data.
5+
* Show info for BundleEID Other Name for a certificate.

‎framework‎

‎include/mbedtls/x509.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,9 @@
134134
#define MBEDTLS_X509_SAN_IP_ADDRESS 7
135135
#define MBEDTLS_X509_SAN_REGISTERED_ID 8
136136

137+
#define MBEDTLS_X509_NAME_CONST_INCL 0
138+
#define MBEDTLS_X509_NAME_CONST_EXCL 1
139+
137140
/*
138141
* X.509 v3 Key Usage Extension flags
139142
* Reminder: update mbedtls_x509_info_key_usage() when adding new flags.
@@ -277,6 +280,9 @@ typedef struct mbedtls_x509_san_other_name {
277280
mbedtls_x509_buf val; /**< The named value. */
278281
}
279282
hardware_module_name;
283+
/** Raw source value for non-constructed types.
284+
*/
285+
mbedtls_x509_buf raw;
280286
}
281287
value;
282288
}

‎include/mbedtls/x509_crt.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ typedef struct mbedtls_x509_crt {
6767
mbedtls_x509_buf subject_key_id; /**< Optional X.509 v3 extension subject key identifier. */
6868
mbedtls_x509_authority authority_key_id; /**< Optional X.509 v3 extension authority key identifier. */
6969

70+
mbedtls_x509_sequence name_constraints_incl; /**< Optional list of raw entries of Name Constraints extension (currently only dNSName and OtherName are listed). */
71+
mbedtls_x509_sequence name_constraints_excl; /**< Optional list of raw entries of Name Constraints extension (currently only dNSName and OtherName are listed). */
72+
7073
mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */
7174

7275
int MBEDTLS_PRIVATE(ext_types); /**< Bit string containing detected and parsed extensions */

‎library/x509.c‎

Lines changed: 87 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1190,6 +1190,7 @@ int mbedtls_x509_time_is_future(const mbedtls_x509_time *from)
11901190
*
11911191
* NOTE: we currently only parse and use otherName of type HwModuleName,
11921192
* as defined in RFC 4108.
1193+
* Other type-ids are kept as raw, undecoded ASN.1 bytes.
11931194
*/
11941195
static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name,
11951196
mbedtls_x509_san_other_name *other_name)
@@ -1218,12 +1219,7 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name,
12181219
cur_oid.p = p;
12191220
cur_oid.len = len;
12201221

1221-
/*
1222-
* Only HwModuleName is currently supported.
1223-
*/
1224-
if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME, &cur_oid) != 0) {
1225-
return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE;
1226-
}
1222+
/* Value context-specific tag */
12271223
other_name->type_id = cur_oid;
12281224

12291225
p += len;
@@ -1238,38 +1234,64 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name,
12381234
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
12391235
}
12401236

1241-
if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1242-
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1243-
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1244-
}
1237+
/*
1238+
* HwModuleName
1239+
*/
1240+
if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME, &cur_oid) == 0) {
1241+
if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1242+
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
1243+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1244+
}
12451245

1246-
if (end != p + len) {
1247-
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1248-
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1249-
}
1246+
if (end != p + len) {
1247+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1248+
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1249+
}
12501250

1251-
if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID)) != 0) {
1252-
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1253-
}
1251+
if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID)) != 0) {
1252+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1253+
}
12541254

1255-
other_name->value.hardware_module_name.oid.tag = MBEDTLS_ASN1_OID;
1256-
other_name->value.hardware_module_name.oid.p = p;
1257-
other_name->value.hardware_module_name.oid.len = len;
1255+
other_name->value.hardware_module_name.oid.tag = MBEDTLS_ASN1_OID;
1256+
other_name->value.hardware_module_name.oid.p = p;
1257+
other_name->value.hardware_module_name.oid.len = len;
12581258

1259-
p += len;
1260-
if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1261-
MBEDTLS_ASN1_OCTET_STRING)) != 0) {
1262-
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1259+
p += len;
1260+
if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
1261+
MBEDTLS_ASN1_OCTET_STRING)) != 0) {
1262+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1263+
}
1264+
1265+
other_name->value.hardware_module_name.val.tag = MBEDTLS_ASN1_OCTET_STRING;
1266+
other_name->value.hardware_module_name.val.p = p;
1267+
other_name->value.hardware_module_name.val.len = len;
1268+
p += len;
1269+
if (p != end) {
1270+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1271+
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1272+
}
12631273
}
1274+
/* Arbitrary raw value */
1275+
else {
1276+
if (p >= end) {
1277+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1278+
MBEDTLS_ERR_ASN1_OUT_OF_DATA);
1279+
}
1280+
other_name->value.raw.tag = *p;
1281+
p++;
12641282

1265-
other_name->value.hardware_module_name.val.tag = MBEDTLS_ASN1_OCTET_STRING;
1266-
other_name->value.hardware_module_name.val.p = p;
1267-
other_name->value.hardware_module_name.val.len = len;
1268-
p += len;
1269-
if (p != end) {
1270-
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1271-
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1283+
if ((ret = mbedtls_asn1_get_len(&p, end, &len)) != 0) {
1284+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
1285+
}
1286+
other_name->value.raw.p = p;
1287+
other_name->value.raw.len = len;
1288+
p += len;
1289+
if (p != end) {
1290+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
1291+
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
1292+
}
12721293
}
1294+
12731295
return 0;
12741296
}
12751297

@@ -1640,6 +1662,40 @@ int mbedtls_x509_info_subject_alt_name(char **buf, size_t *size,
16401662
MBEDTLS_X509_SAFE_SNPRINTF;
16411663
}
16421664
}/* MBEDTLS_OID_ON_HW_MODULE_NAME */
1665+
else if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_BUNDLE_EID,
1666+
&other_name->type_id) == 0) {
1667+
int len = 0;
1668+
const char *str = NULL;
1669+
if (other_name->value.raw.tag == MBEDTLS_ASN1_IA5_STRING) {
1670+
len = other_name->value.raw.len;
1671+
str = (char*)other_name->value.raw.p;
1672+
}
1673+
1674+
ret = mbedtls_snprintf(p, n, "\n%s BundleEID : %.*s", prefix,
1675+
len, str);
1676+
MBEDTLS_X509_SAFE_SNPRINTF;
1677+
}/* MBEDTLS_OID_ON_BUNDLE_EID */
1678+
else {
1679+
/* Show type OID */
1680+
ret = mbedtls_snprintf(p, n, "\n%s type-id : ", prefix);
1681+
MBEDTLS_X509_SAFE_SNPRINTF;
1682+
1683+
ret = mbedtls_oid_get_numeric_string(p,
1684+
n,
1685+
&other_name->type_id);
1686+
MBEDTLS_X509_SAFE_SNPRINTF;
1687+
1688+
ret = mbedtls_snprintf(p, n, "\n%s value : ", prefix);
1689+
MBEDTLS_X509_SAFE_SNPRINTF;
1690+
1691+
for (i = 0; i < other_name->value.raw.len; i++) {
1692+
ret = mbedtls_snprintf(p,
1693+
n,
1694+
"%02X",
1695+
other_name->value.raw.p[i]);
1696+
MBEDTLS_X509_SAFE_SNPRINTF;
1697+
}
1698+
}
16431699
}
16441700
break;
16451701
/*

0 commit comments

Comments
 (0)