Skip to content

Commit 20f7d6f

Browse files
dgarskedgarske
committed
ASN macro simplification. Added new --enable-asn=all and WOLFSSL_ASN_ALL option. Added granular macros for ASN features like: WOLFSSL_ASN_CA_ISSUER, WOLFSSL_ASN_PARSE_KEYUSAGE, WOLFSSL_ASN_TIME_STRING, WOLFSSL_OCSP_PARSE_STATUS.
1 parent 7da6149 commit 20f7d6f

11 files changed

Lines changed: 504 additions & 418 deletions

File tree

‎configure.ac‎

Lines changed: 37 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1992,7 +1992,7 @@ AC_ARG_ENABLE([ffmpeg],
19921992
)
19931993

19941994

1995-
#IP alternative name Support
1995+
# IP alternative name Support
19961996
AC_ARG_ENABLE([ip-alt-name],
19971997
[AS_HELP_STRING([--enable-ip-alt-name],[Enable IP subject alternative name (default: disabled)])],
19981998
[ ENABLE_IP_ALT_NAME=$enableval ],
@@ -2004,7 +2004,7 @@ then
20042004
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_IP_ALT_NAME"
20052005
fi
20062006

2007-
#Qt Support
2007+
# QT Support
20082008
AC_ARG_ENABLE([qt],
20092009
[AS_HELP_STRING([--enable-qt],[Enable qt (default: disabled)])],
20102010
[ ENABLED_QT=$enableval ],
@@ -4744,43 +4744,52 @@ fi
47444744

47454745

47464746
# ASN
4747+
47474748
# turn off asn, which means no certs, no rsa, no dsa, no ecc,
47484749
# and no big int (unless dh is on)
4750+
4751+
# turn off ASN if leanpsk on
4752+
if test "$ENABLED_LEANPSK" = "yes"
4753+
then
4754+
enable_asn=no
4755+
fi
4756+
47494757
AC_ARG_ENABLE([asn],
47504758
[AS_HELP_STRING([--enable-asn],[Enable ASN (default: enabled)])],
47514759
[ ENABLED_ASN=$enableval ],
47524760
[ ENABLED_ASN=yes ]
47534761
)
47544762

4755-
if test "$ENABLED_ASN" = "no"
4756-
then
4757-
AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_ASN_CRYPT"
4758-
enable_pwdbased=no
4759-
else
4760-
if test "$ENABLED_ASN" = "template"; then
4761-
ENABLED_ASN="yes"
4762-
fi
4763-
if test "$ENABLED_ASN" = "yes"; then
4763+
for v in `echo $ENABLED_ASN | tr "," " "`
4764+
do
4765+
case $v in
4766+
all)
4767+
# Enable all ASN features
4768+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_ALL"
4769+
ENABLED_ASN=yes
4770+
;;
4771+
template | yes)
47644772
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_TEMPLATE"
4765-
elif test "$ENABLED_ASN" = "original"; then
4773+
ENABLED_ASN=yes
4774+
;;
4775+
original)
47664776
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_ORIGINAL"
4767-
else
4768-
AC_MSG_ERROR([Invalid asn option. Valid are: template or original. Seen: $ENABLED_ASN.])
4769-
fi
4770-
4771-
# turn off ASN if leanpsk on
4772-
if test "$ENABLED_LEANPSK" = "yes"
4773-
then
4774-
AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_BIG_INT"
4777+
ENABLED_ASN=yes
4778+
;;
4779+
nocrypt)
4780+
AM_CFLAGS="$AM_CFLAGS -DNO_ASN_CRYPT"
4781+
enable_pwdbased=no
4782+
;;
4783+
no)
4784+
AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_ASN_CRYPT"
4785+
enable_pwdbased=no
47754786
ENABLED_ASN=no
4776-
else
4777-
if test "$ENABLED_ASN" = "nocrypt"
4778-
then
4779-
AM_CFLAGS="$AM_CFLAGS -DNO_ASN_CRYPT"
4780-
enable_pwdbased=no
4781-
fi
4782-
fi
4783-
fi
4787+
;;
4788+
*)
4789+
AC_MSG_ERROR([Invalid asn option. Valid are: all, template/yes, original, nocrypt or no. Seen: $ENABLED_ASN.])
4790+
break;;
4791+
esac
4792+
done
47844793

47854794
if test "$ENABLED_RSA" = "yes" && test "$ENABLED_RSAVFY" = "no" && \
47864795
test "$ENABLED_ASN" = "no" && test "$ENABLED_LOWRESOURCE" = "no"

‎src/internal.c‎

Lines changed: 42 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -12540,13 +12540,13 @@ int CheckForAltNames(DecodedCert* dCert, const char* domain, word32 domainLen,
1254012540
while (altName) {
1254112541
WOLFSSL_MSG("\tindividual AltName check");
1254212542

12543-
#if defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
12543+
#ifdef WOLFSSL_IP_ALT_NAME
1254412544
if (altName->type == ASN_IP_TYPE) {
1254512545
buf = altName->ipString;
1254612546
len = (word32)XSTRLEN(buf);
1254712547
}
1254812548
else
12549-
#endif /* OPENSSL_ALL || WOLFSSL_IP_ALT_NAME */
12549+
#endif /* WOLFSSL_IP_ALT_NAME */
1255012550
{
1255112551
buf = altName->name;
1255212552
len = (word32)altName->len;
@@ -12817,6 +12817,7 @@ static int CopyREQAttributes(WOLFSSL_X509* x509, DecodedCert* dCert)
1281712817
int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1281812818
{
1281912819
int ret = 0;
12820+
int minSz;
1282012821

1282112822
if (x509 == NULL || dCert == NULL ||
1282212823
dCert->subjectCNLen < 0)
@@ -12866,49 +12867,45 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1286612867
#endif /* WOLFSSL_CERT_REQ */
1286712868

1286812869
#ifdef WOLFSSL_SEP
12869-
{
12870-
int minSz = min(dCert->deviceTypeSz, EXTERNAL_SERIAL_SIZE);
12871-
if (minSz > 0) {
12872-
x509->deviceTypeSz = minSz;
12873-
XMEMCPY(x509->deviceType, dCert->deviceType, minSz);
12874-
}
12875-
else
12876-
x509->deviceTypeSz = 0;
12877-
minSz = min(dCert->hwTypeSz, EXTERNAL_SERIAL_SIZE);
12878-
if (minSz > 0) {
12879-
x509->hwTypeSz = minSz;
12880-
XMEMCPY(x509->hwType, dCert->hwType, minSz);
12881-
}
12882-
else
12883-
x509->hwTypeSz = 0;
12884-
minSz = min(dCert->hwSerialNumSz, EXTERNAL_SERIAL_SIZE);
12885-
if (minSz > 0) {
12886-
x509->hwSerialNumSz = minSz;
12887-
XMEMCPY(x509->hwSerialNum, dCert->hwSerialNum, minSz);
12888-
}
12889-
else
12890-
x509->hwSerialNumSz = 0;
12870+
minSz = min(dCert->deviceTypeSz, EXTERNAL_SERIAL_SIZE);
12871+
if (minSz > 0) {
12872+
x509->deviceTypeSz = minSz;
12873+
XMEMCPY(x509->deviceType, dCert->deviceType, minSz);
12874+
}
12875+
else
12876+
x509->deviceTypeSz = 0;
12877+
minSz = min(dCert->hwTypeSz, EXTERNAL_SERIAL_SIZE);
12878+
if (minSz > 0) {
12879+
x509->hwTypeSz = minSz;
12880+
XMEMCPY(x509->hwType, dCert->hwType, minSz);
12881+
}
12882+
else
12883+
x509->hwTypeSz = 0;
12884+
minSz = min(dCert->hwSerialNumSz, EXTERNAL_SERIAL_SIZE);
12885+
if (minSz > 0) {
12886+
x509->hwSerialNumSz = minSz;
12887+
XMEMCPY(x509->hwSerialNum, dCert->hwSerialNum, minSz);
1289112888
}
12889+
else
12890+
x509->hwSerialNumSz = 0;
1289212891
#endif /* WOLFSSL_SEP */
12893-
{
12894-
int minSz;
12895-
if (dCert->beforeDateLen > 0) {
12896-
minSz = (int)min(dCert->beforeDate[1], MAX_DATE_SZ);
12897-
x509->notBefore.type = dCert->beforeDate[0];
12898-
x509->notBefore.length = minSz;
12899-
XMEMCPY(x509->notBefore.data, &dCert->beforeDate[2], minSz);
12900-
}
12901-
else
12902-
x509->notBefore.length = 0;
12903-
if (dCert->afterDateLen > 0) {
12904-
minSz = (int)min(dCert->afterDate[1], MAX_DATE_SZ);
12905-
x509->notAfter.type = dCert->afterDate[0];
12906-
x509->notAfter.length = minSz;
12907-
XMEMCPY(x509->notAfter.data, &dCert->afterDate[2], minSz);
12908-
}
12909-
else
12910-
x509->notAfter.length = 0;
12892+
12893+
if (dCert->beforeDateLen > 0) {
12894+
minSz = (int)min(dCert->beforeDate[1], MAX_DATE_SZ);
12895+
x509->notBefore.type = dCert->beforeDate[0];
12896+
x509->notBefore.length = minSz;
12897+
XMEMCPY(x509->notBefore.data, &dCert->beforeDate[2], minSz);
12898+
}
12899+
else
12900+
x509->notBefore.length = 0;
12901+
if (dCert->afterDateLen > 0) {
12902+
minSz = (int)min(dCert->afterDate[1], MAX_DATE_SZ);
12903+
x509->notAfter.type = dCert->afterDate[0];
12904+
x509->notAfter.length = minSz;
12905+
XMEMCPY(x509->notAfter.data, &dCert->afterDate[2], minSz);
1291112906
}
12907+
else
12908+
x509->notAfter.length = 0;
1291212909

1291312910
if (dCert->publicKey != NULL && dCert->pubKeySize != 0) {
1291412911
x509->pubKey.buffer = (byte*)XMALLOC(
@@ -13047,7 +13044,7 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1304713044
ret = MEMORY_E;
1304813045
}
1304913046
}
13050-
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
13047+
#ifdef WOLFSSL_ASN_CA_ISSUER
1305113048
if (dCert->extAuthInfoCaIssuer != NULL && dCert->extAuthInfoCaIssuerSz > 0) {
1305213049
x509->authInfoCaIssuer = (byte*)XMALLOC(dCert->extAuthInfoCaIssuerSz, x509->heap,
1305313050
DYNAMIC_TYPE_X509_EXT);
@@ -13133,10 +13130,10 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
1313313130
#ifndef IGNORE_NETSCAPE_CERT_TYPE
1313413131
x509->nsCertType = dCert->nsCertType;
1313513132
#endif
13136-
#if defined(WOLFSSL_SEP) || defined(WOLFSSL_QT)
13133+
#ifdef WOLFSSL_SEP
1313713134
x509->certPolicySet = dCert->extCertPolicySet;
1313813135
x509->certPolicyCrit = dCert->extCertPolicyCrit;
13139-
#endif /* WOLFSSL_SEP || WOLFSSL_QT */
13136+
#endif
1314013137
#ifdef WOLFSSL_CERT_EXT
1314113138
{
1314213139
int i;

‎src/ocsp.c‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -668,8 +668,9 @@ int CheckOcspResponder(OcspResponse *bs, DecodedCert *cert, void* vp)
668668
return ret;
669669
}
670670

671-
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
672-
defined(WOLFSSL_APACHE_HTTPD) || defined(HAVE_LIGHTY)
671+
672+
/* compatibility layer OCSP functions */
673+
#ifdef OPENSSL_EXTRA
673674
int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
674675
WOLFSSL_OCSP_CERTID* id, int* status, int* reason,
675676
WOLFSSL_ASN1_TIME** revtime, WOLFSSL_ASN1_TIME** thisupd,
@@ -695,10 +696,15 @@ int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
695696

696697
if (status != NULL)
697698
*status = single->status->status;
699+
#ifdef WOLFSSL_OCSP_PARSE_STATUS
698700
if (thisupd != NULL)
699701
*thisupd = &single->status->thisDateParsed;
700702
if (nextupd != NULL)
701703
*nextupd = &single->status->nextDateParsed;
704+
#else
705+
(void)thisupd;
706+
(void)nextupd;
707+
#endif
702708

703709
/* TODO: Not needed for Nginx or httpd */
704710
if (reason != NULL)
@@ -1191,9 +1197,7 @@ WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_CERTID_dup(WOLFSSL_OCSP_CERTID* id)
11911197
}
11921198
return certId;
11931199
}
1194-
#endif
11951200

1196-
#if defined(OPENSSL_ALL) || defined(APACHE_HTTPD) || defined(WOLFSSL_HAPROXY)
11971201
#ifndef NO_BIO
11981202
int wolfSSL_i2d_OCSP_REQUEST_bio(WOLFSSL_BIO* out,
11991203
WOLFSSL_OCSP_REQUEST *req)
@@ -1295,7 +1299,8 @@ WOLFSSL_OCSP_CERTID* wolfSSL_d2i_OCSP_CERTID(WOLFSSL_OCSP_CERTID** cidOut,
12951299
return NULL;
12961300
}
12971301

1298-
const WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_SINGLERESP_get0_id(const WOLFSSL_OCSP_SINGLERESP *single)
1302+
const WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_SINGLERESP_get0_id(
1303+
const WOLFSSL_OCSP_SINGLERESP *single)
12991304
{
13001305
return single;
13011306
}
@@ -1392,9 +1397,6 @@ WOLFSSL_OCSP_SINGLERESP* wolfSSL_OCSP_resp_get0(WOLFSSL_OCSP_BASICRESP *bs, int
13921397
return single;
13931398
}
13941399

1395-
#endif /* OPENSSL_ALL || APACHE_HTTPD || WOLFSSL_HAPROXY */
1396-
1397-
#ifdef OPENSSL_EXTRA
13981400
#ifndef NO_WOLFSSL_STUB
13991401
int wolfSSL_OCSP_REQUEST_add_ext(OcspRequest* req, WOLFSSL_X509_EXTENSION* ext,
14001402
int idx)
@@ -1467,12 +1469,14 @@ int wolfSSL_OCSP_id_get0_info(WOLFSSL_ASN1_STRING **name,
14671469

14681470
#if defined(WOLFSSL_QT) || defined(WOLFSSL_HAPROXY)
14691471
/* Serial number starts at 0 index of ser->data */
1470-
XMEMCPY(&ser->data[i], cid->status->serial, (size_t)cid->status->serialSz);
1472+
XMEMCPY(&ser->data[i], cid->status->serial,
1473+
(size_t)cid->status->serialSz);
14711474
ser->length = cid->status->serialSz;
14721475
#else
14731476
ser->data[i++] = ASN_INTEGER;
14741477
i += SetLength(cid->status->serialSz, ser->data + i);
1475-
XMEMCPY(&ser->data[i], cid->status->serial, (size_t)cid->status->serialSz);
1478+
XMEMCPY(&ser->data[i], cid->status->serial,
1479+
(size_t)cid->status->serialSz);
14761480
ser->length = i + cid->status->serialSz;
14771481
#endif
14781482

‎src/ssl.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22731,7 +22731,7 @@ void wolfSSL_ERR_remove_state(unsigned long id)
2273122731
}
2273222732
}
2273322733

22734-
#endif /* OPENSSL_EXTRA */
22734+
#endif /* OPENSSL_EXTRA */
2273522735

2273622736
#ifdef OPENSSL_ALL
2273722737

‎src/x509.c‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,7 +1067,9 @@ WOLFSSL_X509_EXTENSION* wolfSSL_X509_set_ext(WOLFSSL_X509* x509, int loc)
10671067
case CERT_POLICY_OID:
10681068
if (!isSet)
10691069
break;
1070+
#ifdef WOLFSSL_SEP
10701071
ext->crit = x509->certPolicyCrit;
1072+
#endif
10711073
break;
10721074

10731075
case KEY_USAGE_OID:
@@ -2504,7 +2506,8 @@ void* wolfSSL_X509_get_ext_d2i(const WOLFSSL_X509* x509, int nid, int* c,
25042506
else {
25052507
WOLFSSL_MSG("No Cert Policy set");
25062508
}
2507-
#elif defined(WOLFSSL_SEP)
2509+
#endif /* WOLFSSL_CERT_EXT */
2510+
#ifdef WOLFSSL_SEP
25082511
if (x509->certPolicySet) {
25092512
if (c != NULL) {
25102513
*c = x509->certPolicyCrit;
@@ -2520,8 +2523,6 @@ void* wolfSSL_X509_get_ext_d2i(const WOLFSSL_X509* x509, int nid, int* c,
25202523
else {
25212524
WOLFSSL_MSG("No Cert Policy set");
25222525
}
2523-
#else
2524-
WOLFSSL_MSG("wolfSSL not built with WOLFSSL_SEP or WOLFSSL_CERT_EXT");
25252526
#endif
25262527
break;
25272528
}
@@ -3711,7 +3712,7 @@ char* wolfSSL_X509_get_next_altname(WOLFSSL_X509* cert)
37113712
}
37123713

37133714
ret = cert->altNamesNext->name;
3714-
#if defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
3715+
#ifdef WOLFSSL_IP_ALT_NAME
37153716
/* return the IP address as a string */
37163717
if (cert->altNamesNext->type == ASN_IP_TYPE) {
37173718
ret = cert->altNamesNext->ipString;
@@ -5668,9 +5669,9 @@ int wolfSSL_X509_cmp(const WOLFSSL_X509 *a, const WOLFSSL_X509 *b)
56685669
case NID_key_usage: crit = x509->keyUsageCrit; break;
56695670
case NID_crl_distribution_points: crit= x509->CRLdistCrit; break;
56705671
case NID_ext_key_usage: crit= x509->extKeyUsageCrit; break;
5671-
#if defined(WOLFSSL_SEP) || defined(WOLFSSL_QT)
5672-
case NID_certificate_policies: crit = x509->certPolicyCrit; break;
5673-
#endif /* WOLFSSL_SEP || WOLFSSL_QT */
5672+
#ifdef WOLFSSL_SEP
5673+
case NID_certificate_policies: crit = x509->certPolicyCrit; break;
5674+
#endif /* WOLFSSL_SEP */
56745675
}
56755676
}
56765677

@@ -5873,7 +5874,7 @@ static int X509PrintSubjAltName(WOLFSSL_BIO* bio, WOLFSSL_X509* x509,
58735874
break;
58745875
}
58755876
}
5876-
#if defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
5877+
#ifdef WOLFSSL_IP_ALT_NAME
58775878
else if (entry->type == ASN_IP_TYPE) {
58785879
len = XSNPRINTF(scratch, MAX_WIDTH, "IP Address:%s",
58795880
entry->ipString);

0 commit comments

Comments
 (0)