Skip to content

Commit 4bbb0e3

Browse files
SKlimaRASKlimaRA
committed
drafted ca false
1 parent 1a3f3aa commit 4bbb0e3

4 files changed

Lines changed: 117 additions & 5 deletions

File tree

‎tests/api.c‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49915,6 +49915,64 @@ static int test_MakeCertWithPathLen(void)
4991549915
return EXPECT_RESULT();
4991649916
}
4991749917

49918+
static int test_MakeCertWithCaFalse(void)
49919+
{
49920+
EXPECT_DECLS;
49921+
#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \
49922+
defined(WOLFSSL_CERT_REQ) && !defined(NO_ASN_TIME) && \
49923+
defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC)
49924+
const byte expectedIsCaSet = 1;
49925+
const byte expectedIsCa = 0;
49926+
Cert cert;
49927+
DecodedCert decodedCert;
49928+
byte der[FOURK_BUF];
49929+
int derSize = 0;
49930+
WC_RNG rng;
49931+
ecc_key key;
49932+
int ret;
49933+
49934+
XMEMSET(&rng, 0, sizeof(WC_RNG));
49935+
XMEMSET(&key, 0, sizeof(ecc_key));
49936+
XMEMSET(&cert, 0, sizeof(Cert));
49937+
XMEMSET(&decodedCert, 0, sizeof(DecodedCert));
49938+
49939+
ExpectIntEQ(wc_InitRng(&rng), 0);
49940+
ExpectIntEQ(wc_ecc_init(&key), 0);
49941+
ExpectIntEQ(wc_ecc_make_key(&rng, 32, &key), 0);
49942+
ExpectIntEQ(wc_InitCert(&cert), 0);
49943+
49944+
(void)XSTRNCPY(cert.subject.country, "US", CTC_NAME_SIZE);
49945+
(void)XSTRNCPY(cert.subject.state, "state", CTC_NAME_SIZE);
49946+
(void)XSTRNCPY(cert.subject.locality, "Bozeman", CTC_NAME_SIZE);
49947+
(void)XSTRNCPY(cert.subject.org, "yourOrgNameHere", CTC_NAME_SIZE);
49948+
(void)XSTRNCPY(cert.subject.unit, "yourUnitNameHere", CTC_NAME_SIZE);
49949+
(void)XSTRNCPY(cert.subject.commonName, "www.yourDomain.com",
49950+
CTC_NAME_SIZE);
49951+
(void)XSTRNCPY(cert.subject.email, "yourEmail@yourDomain.com",
49952+
CTC_NAME_SIZE);
49953+
49954+
cert.selfSigned = 1;
49955+
cert.isCA = expectedIsCa;
49956+
cert.isCaSet = expectedIsCaSet;
49957+
cert.sigType = CTC_SHA256wECDSA;
49958+
49959+
ExpectIntGE(wc_MakeCert(&cert, der, FOURK_BUF, NULL, &key, &rng), 0);
49960+
ExpectIntGE(derSize = wc_SignCert(cert.bodySz, cert.sigType, der,
49961+
FOURK_BUF, NULL, &key, &rng), 0);
49962+
49963+
wc_InitDecodedCert(&decodedCert, der, derSize, NULL);
49964+
ExpectIntEQ(wc_ParseCert(&decodedCert, CERT_TYPE, NO_VERIFY, NULL), 0);
49965+
ExpectIntEQ(decodedCert.isCA, expectedIsCa);
49966+
49967+
wc_FreeDecodedCert(&decodedCert);
49968+
ret = wc_ecc_free(&key);
49969+
ExpectIntEQ(ret, 0);
49970+
ret = wc_FreeRng(&rng);
49971+
ExpectIntEQ(ret, 0);
49972+
#endif
49973+
return EXPECT_RESULT();
49974+
}
49975+
4991849976
/*----------------------------------------------------------------------------*
4991949977
| wolfCrypt ECC
4992049978
*----------------------------------------------------------------------------*/
@@ -67760,6 +67818,7 @@ TEST_CASE testCases[] = {
6776067818
TEST_DECL(test_wc_ParseCert),
6776167819
TEST_DECL(test_wc_ParseCert_Error),
6776267820
TEST_DECL(test_MakeCertWithPathLen),
67821+
TEST_DECL(test_MakeCertWithCaFalse),
6776367822
TEST_DECL(test_wc_SetKeyUsage),
6776467823
TEST_DECL(test_wc_SetAuthKeyIdFromPublicKey_ex),
6776567824
TEST_DECL(test_wc_SetSubjectBuffer),

‎wolfcrypt/src/asn.c‎

Lines changed: 52 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18548,6 +18548,12 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
1854818548
WOLFSSL_MSG("\tfail: constraint not valid BOOLEAN, set default FALSE");
1854918549
ret = 0;
1855018550
}
18551+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
18552+
else {
18553+
/* CA Boolean asserted, GetBoolean didn't return error. */
18554+
cert->isCaSet = 1;
18555+
}
18556+
#endif
1855118557

1855218558
cert->isCA = ret ? 1 : 0;
1855318559

@@ -18584,14 +18590,18 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
1858418590

1858518591
/* Empty SEQUENCE is OK - nothing to store. */
1858618592
if ((ret == 0) && (dataASN[BASICCONSASN_IDX_SEQ].length != 0)) {
18593+
#if !defined(OPENSSL_EXTRA) && !defined(OPENSSL_EXTRA_X509_SMALL)
1858718594
/* Bad encoding when CA Boolean is false
1858818595
* (default when not present). */
18589-
#ifndef ASN_TEMPLATE_SKIP_ISCA_CHECK
1859018596
if ((dataASN[BASICCONSASN_IDX_CA].length != 0) && (!isCA)) {
1859118597
WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
1859218598
ret = ASN_PARSE_E;
1859318599
}
18594-
#endif
18600+
#else
18601+
if (dataASN[BASICCONSASN_IDX_CA].length != 0) {
18602+
cert->isCaSet = 1;
18603+
}
18604+
#endif
1859518605
/* Path length must be a 7-bit value. */
1859618606
if ((ret == 0) && (cert->pathLength >= (1 << 7))) {
1859718607
WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
@@ -26019,10 +26029,9 @@ static int SetCaWithPathLen(byte* out, word32 outSz, byte pathLen)
2601926029
return (int)sizeof(caPathLenBasicConstASN1);
2602026030
}
2602126031

26022-
26023-
/* encode CA basic constraints true
26032+
/* encode CA basic constraints
2602426033
* return total bytes written */
26025-
static int SetCa(byte* out, word32 outSz)
26034+
static int SetCaEx(byte* out, word32 outSz, byte isCa)
2602626035
{
2602726036
/* ASN1->DER sequence for Basic Constraints True */
2602826037
const byte caBasicConstASN1[] = {
@@ -26038,9 +26047,20 @@ static int SetCa(byte* out, word32 outSz)
2603826047

2603926048
XMEMCPY(out, caBasicConstASN1, sizeof(caBasicConstASN1));
2604026049

26050+
if (!isCa) {
26051+
XMEMCPY(out + (sizeof(caBasicConstASN1) - 1U), &isCa, sizeof(isCa));
26052+
}
26053+
2604126054
return (int)sizeof(caBasicConstASN1);
2604226055
}
2604326056

26057+
/* encode CA basic constraints true
26058+
* return total bytes written */
26059+
static int SetCa(byte* out, word32 outSz)
26060+
{
26061+
return SetCaEx(out, outSz, 1);
26062+
}
26063+
2604426064
/* encode basic constraints without CA Boolean
2604526065
* return total bytes written */
2604626066
static int SetBC(byte* out, word32 outSz)
@@ -27791,6 +27811,13 @@ static int EncodeExtensions(Cert* cert, byte* output, word32 maxSz,
2779127811
dataASN[CERTEXTSASN_IDX_BC_PATHLEN].noOut = 1;
2779227812
}
2779327813
}
27814+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
27815+
else if (cert->isCaSet) {
27816+
SetASN_Boolean(&dataASN[CERTEXTSASN_IDX_BC_CA], 0);
27817+
SetASN_Buffer(&dataASN[CERTEXTSASN_IDX_BC_OID], bcOID, sizeof(bcOID));
27818+
dataASN[CERTEXTSASN_IDX_BC_PATHLEN].noOut = 1;
27819+
}
27820+
#endif
2779427821
else if (cert->basicConstSet) {
2779527822
/* Set Basic Constraints to be a non Certificate Authority. */
2779627823
SetASN_Buffer(&dataASN[CERTEXTSASN_IDX_BC_OID], bcOID, sizeof(bcOID));
@@ -28439,7 +28466,17 @@ static int EncodeCert(Cert* cert, DerCert* der, RsaKey* rsaKey, ecc_key* eccKey,
2843928466

2844028467
der->extensionsSz += der->caSz;
2844128468
}
28469+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
2844228470
/* Set CA */
28471+
else if (cert->isCaSet) {
28472+
der->caSz = SetCaEx(der->ca, sizeof(der->ca), cert->isCA);
28473+
if (der->caSz <= 0)
28474+
return EXTENSIONS_E;
28475+
28476+
der->extensionsSz += der->caSz;
28477+
}
28478+
#endif
28479+
/* Set CA true */
2844328480
else if (cert->isCA) {
2844428481
der->caSz = SetCa(der->ca, sizeof(der->ca));
2844528482
if (der->caSz <= 0)
@@ -29837,7 +29874,17 @@ static int EncodeCertReq(Cert* cert, DerCert* der, RsaKey* rsaKey,
2983729874

2983829875
der->extensionsSz += der->caSz;
2983929876
}
29877+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
2984029878
/* Set CA */
29879+
else if (cert->isCaSet) {
29880+
der->caSz = SetCaEx(der->ca, sizeof(der->ca), cert->isCA);
29881+
if (der->caSz <= 0)
29882+
return EXTENSIONS_E;
29883+
29884+
der->extensionsSz += der->caSz;
29885+
}
29886+
#endif
29887+
/* Set CA true */
2984129888
else if (cert->isCA) {
2984229889
der->caSz = SetCa(der->ca, sizeof(der->ca));
2984329890
if (der->caSz <= 0)

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1882,6 +1882,9 @@ struct DecodedCert {
18821882
byte extNameConstraintSet : 1;
18831883
#endif
18841884
byte isCA : 1; /* CA basic constraint true */
1885+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
1886+
byte isCaSet : 1; /* CA basic constraint set */
1887+
#endif
18851888
byte pathLengthSet : 1; /* CA basic const path length set */
18861889
byte weOwnAltNames : 1; /* altNames haven't been given to copy */
18871890
byte extKeyUsageSet : 1;

‎wolfssl/wolfcrypt/asn_public.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,9 @@ typedef struct Cert {
530530
byte* der; /* Pointer to buffer of current DecodedCert cache */
531531
void* heap; /* heap hint */
532532
byte basicConstSet:1; /* Indicator for when Basic Constraint is set */
533+
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
534+
byte isCaSet:1; /* Indicator for when isCA is set */
535+
#endif
533536
byte pathLenSet:1; /* Indicator for when path length is set */
534537
#ifdef WOLFSSL_ALT_NAMES
535538
byte altNamesCrit:1; /* Indicator of criticality of SAN extension */

0 commit comments

Comments
 (0)