new build flag WOLFSSL_ALLOW_ENCODING_CA_FALSE

Author: SKlimaRA

tests/api.c

@@ -49918,9 +49918,8 @@ static int test_MakeCertWithPathLen(void)
 static int test_MakeCertWithCaFalse(void)
 {
     EXPECT_DECLS;
-#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \
-    defined(WOLFSSL_CERT_REQ) && !defined(NO_ASN_TIME) && \
-    defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC)
+#if defined(WOLFSSL_ALLOW_ENCODING_CA_FALSE) && defined(WOLFSSL_CERT_REQ) && \
+    !defined(NO_ASN_TIME) && defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC)
     const byte expectedIsCaSet = 1;
     const byte expectedIsCa = 0;
     Cert cert;

wolfcrypt/src/asn.c

@@ -96,6 +96,9 @@ ASN Options:
     cost of taking up more memory. Adds initials, givenname, dnQualifer for
     example.
  * WC_ASN_HASH_SHA256: Force use of SHA2-256 for the internal hash ID calcs.
+ * WOLFSSL_ALLOW_ENCODING_CA_FALSE: Allow encoding BasicConstraints CA:FALSE
+ *  which is discouraged by X.690 (DER) specification - default values shall not
+ *  be encoded.
 */
 
 #include <wolfssl/wolfcrypt/error-crypt.h>
@@ -18548,7 +18551,7 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
         WOLFSSL_MSG("\tfail: constraint not valid BOOLEAN, set default FALSE");
         ret = 0;
     }
-#if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
+#ifdef WOLFSSL_ALLOW_ENCODING_CA_FALSE
     else {
         /* CA Boolean asserted, GetBoolean didn't return error. */
         cert->isCaSet = 1;
@@ -18590,18 +18593,15 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
 
     /* Empty SEQUENCE is OK - nothing to store. */
     if ((ret == 0) && (dataASN[BASICCONSASN_IDX_SEQ].length != 0)) {
-    #if !defined(OPENSSL_EXTRA) && !defined(OPENSSL_EXTRA_X509_SMALL)
         /* Bad encoding when CA Boolean is false
          * (default when not present). */
+#if !defined(ASN_TEMPLATE_SKIP_ISCA_CHECK) && \
+    !defined(WOLFSSL_ALLOW_ENCODING_CA_FALSE)
         if ((dataASN[BASICCONSASN_IDX_CA].length != 0) && (!isCA)) {
             WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
             ret = ASN_PARSE_E;
         }
-    #else
-        if (dataASN[BASICCONSASN_IDX_CA].length != 0) {
-            cert->isCaSet = 1;
-        }
-    #endif
+#endif
         /* Path length must be a 7-bit value. */
         if ((ret == 0) && (cert->pathLength >= (1 << 7))) {
             WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
@@ -27811,7 +27811,7 @@ static int EncodeExtensions(Cert* cert, byte* output, word32 maxSz,
                 dataASN[CERTEXTSASN_IDX_BC_PATHLEN].noOut = 1;
             }
         }
-    #if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
+    #ifdef WOLFSSL_ALLOW_ENCODING_CA_FALSE
         else if (cert->isCaSet) {
             SetASN_Boolean(&dataASN[CERTEXTSASN_IDX_BC_CA], 0);
             SetASN_Buffer(&dataASN[CERTEXTSASN_IDX_BC_OID], bcOID, sizeof(bcOID));
@@ -28466,7 +28466,7 @@ static int EncodeCert(Cert* cert, DerCert* der, RsaKey* rsaKey, ecc_key* eccKey,
 
         der->extensionsSz += der->caSz;
     }
-#if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
+#ifdef WOLFSSL_ALLOW_ENCODING_CA_FALSE
     /* Set CA */
     else if (cert->isCaSet) {
         der->caSz = SetCaEx(der->ca, sizeof(der->ca), cert->isCA);
@@ -29874,7 +29874,7 @@ static int EncodeCertReq(Cert* cert, DerCert* der, RsaKey* rsaKey,
 
         der->extensionsSz += der->caSz;
     }
-#if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
+#ifdef WOLFSSL_ALLOW_ENCODING_CA_FALSE
     /* Set CA */
     else if (cert->isCaSet) {
         der->caSz = SetCaEx(der->ca, sizeof(der->ca), cert->isCA);

wolfssl/wolfcrypt/asn.h

@@ -1882,9 +1882,6 @@ struct DecodedCert {
     byte extNameConstraintSet : 1;
 #endif
     byte isCA : 1;                 /* CA basic constraint true */
-#if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
-    byte isCaSet : 1;              /* CA basic constraint set */
-#endif
     byte pathLengthSet : 1;        /* CA basic const path length set */
     byte weOwnAltNames : 1;        /* altNames haven't been given to copy */
     byte extKeyUsageSet : 1;

wolfssl/wolfcrypt/asn_public.h

@@ -530,7 +530,7 @@ typedef struct Cert {
     byte*   der;              /* Pointer to buffer of current DecodedCert cache */
     void*   heap;             /* heap hint */
     byte    basicConstSet:1;  /* Indicator for when Basic Constraint is set */
-#if defined(OPENSSL_EXTRA)  || defined(OPENSSL_EXTRA_X509_SMALL)
+#ifdef WOLFSSL_ALLOW_ENCODING_CA_FALSE
     byte    isCaSet:1;        /* Indicator for when isCA is set */
 #endif
     byte    pathLenSet:1;     /* Indicator for when path length is set */