mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-11 14:01:25 +02:00
Add WOLFSSL_X509_TINY minimal-extension profile + WOLFSSL_X509_VERIFY_ONLY
This commit is contained in:
aidan garske
+100
-14
@@ -156,6 +156,12 @@ ASN Options:
|
||||
* WOLFSSL_ALLOW_CRIT_AKID: Allow critical Auth Key Identifier
|
||||
* WOLFSSL_ALLOW_CRIT_SKID: Allow critical Subject Key Identifier
|
||||
* WC_ASN_UNKNOWN_EXT_CB: Callback for unknown extensions
|
||||
* WOLFSSL_X509_VERIFY_ONLY: Verify-only profile. Drops cert/key generation and
|
||||
forces WOLFSSL_NO_PEM unless a gen add-back (WOLFSSL_X509_CERT_GEN /
|
||||
WOLFSSL_X509_KEY_GEN) or WOLFSSL_X509_PEM is set.
|
||||
* WOLFSSL_X509_TINY: Minimal-extension profile. Compiles out optional
|
||||
X.509 extension decoders behind per-feature WOLFSSL_X509_TINY_<F> add-back
|
||||
macros. Requires WOLFSSL_ASN_TEMPLATE (enforced with #error).
|
||||
*
|
||||
* ASN.1 Parsing:
|
||||
* WOLFSSL_ASN_ALL: Enable all ASN.1 features
|
||||
@@ -4494,9 +4500,14 @@ static int GetSignature(DecodedCert* cert);
|
||||
static word32 SetAlgoIDImpl(int algoOID, byte* output, int type, int curveSz, byte absentParams);
|
||||
#ifndef NO_CERTS
|
||||
static int DecodeAltNames(const byte* input, word32 sz, DecodedCert* cert);
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
|
||||
static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert);
|
||||
#endif
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
|
||||
static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert);
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
#endif
|
||||
#if !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
static int DecodeSubtree(const byte* input, word32 sz, Base_entry** head,
|
||||
word32 limit, byte* hasUnsupported, void* heap);
|
||||
static int DecodeNameConstraints(const byte* input, word32 sz, DecodedCert* cert);
|
||||
@@ -19255,6 +19266,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
}
|
||||
}
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_DIR)
|
||||
/* GeneralName choice: directoryName */
|
||||
else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | ASN_DIR_TYPE)) {
|
||||
int strLen;
|
||||
@@ -19273,6 +19285,8 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
idx += (word32)len;
|
||||
}
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_DIR */
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_EMAIL)
|
||||
/* GeneralName choice: rfc822Name */
|
||||
else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_RFC822_TYPE)) {
|
||||
ret = SetDNSEntry(cert->heap, (const char*)(input + idx), len,
|
||||
@@ -19281,6 +19295,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
idx += (word32)len;
|
||||
}
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_EMAIL */
|
||||
/* GeneralName choice: uniformResourceIdentifier */
|
||||
else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_URI_TYPE)) {
|
||||
WOLFSSL_MSG("\tPutting URI into list but not using");
|
||||
@@ -19354,6 +19369,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
* surface the raw octets as OCTET_STRING already (see the
|
||||
* ASN_IP_TYPE case under WOLFSSL_GEN_IPADD in src/x509.c).
|
||||
*/
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_IP)
|
||||
else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_IP_TYPE)) {
|
||||
ret = SetDNSEntry(cert->heap, (const char*)(input + idx), len,
|
||||
ASN_IP_TYPE, &cert->altNames);
|
||||
@@ -19361,6 +19377,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
idx += (word32)len;
|
||||
}
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_IP */
|
||||
/* GeneralName choice: registeredID
|
||||
*
|
||||
* Always parse registeredID into cert->altNames so
|
||||
@@ -19386,6 +19403,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
* - X509_print_name_entry: emits "Registered ID:<unavailable>"
|
||||
* when ridString is not generated, instead of failing the
|
||||
* whole print operation. */
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_RID)
|
||||
else if (tag == (ASN_CONTEXT_SPECIFIC | ASN_RID_TYPE)) {
|
||||
ret = SetDNSEntry(cert->heap, (const char*)(input + idx), len,
|
||||
ASN_RID_TYPE, &cert->altNames);
|
||||
@@ -19393,6 +19411,7 @@ static int DecodeGeneralName(const byte* input, word32* inOutIdx, byte tag,
|
||||
idx += (word32)len;
|
||||
}
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SAN_RID */
|
||||
#endif /* IGNORE_NAME_CONSTRAINTS */
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
/* GeneralName choice: otherName.
|
||||
@@ -19681,6 +19700,7 @@ static int DecodeBasicCaConstraintInternal(const byte* input, int sz,
|
||||
}
|
||||
|
||||
|
||||
#ifndef WOLFSSL_X509_TINY
|
||||
static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
|
||||
{
|
||||
word32 idx = 0;
|
||||
@@ -19734,6 +19754,7 @@ static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
|
||||
|
||||
return 0;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY */
|
||||
|
||||
|
||||
/* Context-Specific value for: DistributionPoint.distributionPoint
|
||||
@@ -19746,7 +19767,8 @@ static int DecodePolicyConstraints(const byte* input, int sz, DecodedCert* cert)
|
||||
* From RFC3280 SS4.2.1.7, GeneralName */
|
||||
#define GENERALNAME_URI (ASN_CONTEXT_SPECIFIC | 6)
|
||||
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP))
|
||||
/* ASN.1 template for CRL distribution points.
|
||||
* X.509: RFC 5280, 4.2.1.13 - CRL Distribution Points.
|
||||
*/
|
||||
@@ -19797,6 +19819,7 @@ enum {
|
||||
* @return BUFFER_E when data in buffer is too small.
|
||||
*/
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
|
||||
static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert)
|
||||
{
|
||||
DECL_ASNGETDATA(dataASN, crlDistASN_Length);
|
||||
@@ -19854,8 +19877,10 @@ static int DecodeCrlDist(const byte* input, word32 sz, DecodedCert* cert)
|
||||
FREE_ASNGETDATA(dataASN, cert->heap);
|
||||
return ret;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_CRL_DP */
|
||||
#endif /* WOLFSSL_ASN_TEMPLATE */
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA))
|
||||
/* ASN.1 template for the access description.
|
||||
* X.509: RFC 5280, 4.2.2.1 - Authority Information Access.
|
||||
*/
|
||||
@@ -19892,6 +19917,7 @@ enum {
|
||||
* @return ASN_UNKNOWN_OID_E when the OID cannot be verified.
|
||||
*/
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
|
||||
static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert)
|
||||
{
|
||||
word32 idx = 0;
|
||||
@@ -19960,6 +19986,7 @@ static int DecodeAuthInfo(const byte* input, word32 sz, DecodedCert* cert)
|
||||
|
||||
return ret;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AIA */
|
||||
#endif /* WOLFSSL_ASN_TEMPLATE */
|
||||
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
@@ -20100,6 +20127,7 @@ int DecodeAuthKeyId(const byte* input, word32 sz, const byte **extAuthKeyId,
|
||||
* is invalid.
|
||||
* @return BUFFER_E when data in buffer is too small.
|
||||
*/
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AKI)
|
||||
static int DecodeAuthKeyIdInternal(const byte* input, word32 sz,
|
||||
DecodedCert* cert)
|
||||
{
|
||||
@@ -20157,6 +20185,7 @@ static int DecodeAuthKeyIdInternal(const byte* input, word32 sz,
|
||||
|
||||
return ret;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AKI */
|
||||
|
||||
/* Decode subject key id extension.
|
||||
*
|
||||
@@ -20201,6 +20230,7 @@ int DecodeSubjKeyId(const byte* input, word32 sz, const byte **extSubjKeyId,
|
||||
* invalid.
|
||||
* @return MEMORY_E on dynamic memory allocation failure.
|
||||
*/
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SKI)
|
||||
static int DecodeSubjKeyIdInternal(const byte* input, word32 sz,
|
||||
DecodedCert* cert)
|
||||
{
|
||||
@@ -20224,6 +20254,7 @@ static int DecodeSubjKeyIdInternal(const byte* input, word32 sz,
|
||||
|
||||
return ret;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SKI */
|
||||
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
/* ASN.1 template for KeyUsage.
|
||||
@@ -20504,6 +20535,7 @@ static int DecodeExtKeyUsageInternal(const byte* input, word32 sz,
|
||||
|
||||
#ifndef IGNORE_NETSCAPE_CERT_TYPE
|
||||
|
||||
#ifndef WOLFSSL_X509_TINY
|
||||
static int DecodeNsCertType(const byte* input, int sz, DecodedCert* cert)
|
||||
{
|
||||
word32 idx = 0;
|
||||
@@ -20523,11 +20555,13 @@ static int DecodeNsCertType(const byte* input, int sz, DecodedCert* cert)
|
||||
|
||||
return 0;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY (DecodeNsCertType) */
|
||||
#endif
|
||||
|
||||
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
/* ASN.1 template for GeneralSubtree.
|
||||
* X.509: RFC 5280, 4.2.1.10 - Name Constraints.
|
||||
*/
|
||||
@@ -20551,7 +20585,8 @@ enum {
|
||||
#define subTreeASN_Length (sizeof(subTreeASN) / sizeof(ASNItem))
|
||||
#endif
|
||||
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
/* Decode the Subtree's GeneralName.
|
||||
*
|
||||
* @param [in] input Buffer holding data.
|
||||
@@ -20639,7 +20674,8 @@ static int DecodeSubtreeGeneralName(const byte* input, word32 sz, byte tag,
|
||||
* @return MEMORY_E when dynamic memory allocation fails.
|
||||
* @return ASN_PARSE_E when SEQUENCE is not found as expected.
|
||||
*/
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
/* Decode a sub-tree of name constraints.
|
||||
*
|
||||
* @param [out] hasUnsupported Set to 1 when an entry with a GeneralName
|
||||
@@ -20732,7 +20768,8 @@ static int DecodeSubtree(const byte* input, word32 sz, Base_entry** head,
|
||||
return ret;
|
||||
}
|
||||
#endif /* WOLFSSL_ASN_TEMPLATE */
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if defined(WOLFSSL_ASN_TEMPLATE) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
/* ASN.1 template for NameConstraints.
|
||||
* X.509: RFC 5280, 4.2.1.10 - Name Constraints.
|
||||
*/
|
||||
@@ -20766,6 +20803,7 @@ enum {
|
||||
* @return MEMORY_E on dynamic memory allocation failure.
|
||||
*/
|
||||
#ifdef WOLFSSL_ASN_TEMPLATE
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS)
|
||||
static int DecodeNameConstraints(const byte* input, word32 sz,
|
||||
DecodedCert* cert)
|
||||
{
|
||||
@@ -20810,6 +20848,7 @@ static int DecodeNameConstraints(const byte* input, word32 sz,
|
||||
|
||||
return ret;
|
||||
}
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_NAME_CONSTRAINTS */
|
||||
#endif /* WOLFSSL_ASN_TEMPLATE */
|
||||
#endif /* IGNORE_NAME_CONSTRAINTS */
|
||||
|
||||
@@ -21379,6 +21418,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
int ret = 0;
|
||||
word32 idx = 0;
|
||||
|
||||
(void)idx; /* unused when optional extension cases are gated out (X509_TINY) */
|
||||
if (isUnknownExt != NULL)
|
||||
*isUnknownExt = 0;
|
||||
|
||||
@@ -21392,6 +21432,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
}
|
||||
break;
|
||||
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_CRL_DP)
|
||||
/* CRL Distribution point. */
|
||||
case CRL_DIST_OID:
|
||||
VERIFY_AND_SET_OID(cert->extCRLdistSet);
|
||||
@@ -21400,7 +21441,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_CRL_DP */
|
||||
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AIA)
|
||||
/* Authority information access. */
|
||||
case AUTH_INFO_OID:
|
||||
VERIFY_AND_SET_OID(cert->extAuthInfoSet);
|
||||
@@ -21421,6 +21464,15 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#elif defined(WOLFSSL_X509_TINY)
|
||||
/* Stripped: reject critical even under ALLOW_CRIT_AIA - can't honor an
|
||||
* undecoded extension (RFC 5280 4.2.2.1). No SET_OID, bit means decoded. */
|
||||
case AUTH_INFO_OID:
|
||||
if (critical) {
|
||||
ret = ASN_CRIT_EXT_E;
|
||||
}
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AIA */
|
||||
|
||||
/* Subject alternative name. */
|
||||
case ALT_NAMES_OID:
|
||||
@@ -21429,6 +21481,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = DecodeAltNames(input, length, cert);
|
||||
break;
|
||||
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_AKI)
|
||||
/* Authority Key Identifier. */
|
||||
case AUTH_KEY_OID:
|
||||
VERIFY_AND_SET_OID(cert->extAuthKeyIdSet);
|
||||
@@ -21449,7 +21502,17 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#elif defined(WOLFSSL_X509_TINY)
|
||||
/* Stripped: reject critical even under ALLOW_CRIT_AKID - can't honor an
|
||||
* undecoded extension (RFC 5280 4.2.1.1). No SET_OID, bit means decoded. */
|
||||
case AUTH_KEY_OID:
|
||||
if (critical) {
|
||||
ret = ASN_CRIT_EXT_E;
|
||||
}
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_AKI */
|
||||
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SKI)
|
||||
/* Subject Key Identifier. */
|
||||
case SUBJ_KEY_OID:
|
||||
VERIFY_AND_SET_OID(cert->extSubjKeyIdSet);
|
||||
@@ -21471,7 +21534,17 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#elif defined(WOLFSSL_X509_TINY)
|
||||
/* Stripped: reject critical even under ALLOW_CRIT_SKID - can't honor an
|
||||
* undecoded extension (RFC 5280 4.2.1.2). No SET_OID, bit means decoded. */
|
||||
case SUBJ_KEY_OID:
|
||||
if (critical) {
|
||||
ret = ASN_CRIT_EXT_E;
|
||||
}
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_SKI */
|
||||
|
||||
#if !defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_POLICIES)
|
||||
/* Certificate policies. */
|
||||
case CERT_POLICY_OID:
|
||||
#if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
|
||||
@@ -21498,6 +21571,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
#endif
|
||||
#endif
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY || WOLFSSL_X509_TINY_POLICIES */
|
||||
|
||||
/* Key usage. */
|
||||
case KEY_USAGE_OID:
|
||||
@@ -21517,7 +21591,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
}
|
||||
break;
|
||||
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
#if !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
(!defined(WOLFSSL_X509_TINY) || \
|
||||
defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
|
||||
/* Name constraints. */
|
||||
case NAME_CONS_OID:
|
||||
#ifndef WOLFSSL_NO_ASN_STRICT
|
||||
@@ -21536,22 +21612,29 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#endif /* IGNORE_NAME_CONSTRAINTS */
|
||||
#elif !defined(IGNORE_NAME_CONSTRAINTS)
|
||||
/* TINY can't enforce name constraints; fail closed rather than ignore. */
|
||||
case NAME_CONS_OID:
|
||||
WOLFSSL_ERROR_VERBOSE(ASN_NAME_INVALID_E);
|
||||
ret = ASN_NAME_INVALID_E;
|
||||
break;
|
||||
#endif /* NAME_CONS_OID (name constraints / TINY) */
|
||||
|
||||
#ifndef WOLFSSL_X509_TINY
|
||||
/* Inhibit anyPolicy. */
|
||||
case INHIBIT_ANY_OID:
|
||||
VERIFY_AND_SET_OID(cert->inhibitAnyOidSet);
|
||||
WOLFSSL_MSG("Inhibit anyPolicy extension not supported yet.");
|
||||
break;
|
||||
|
||||
#ifndef IGNORE_NETSCAPE_CERT_TYPE
|
||||
#ifndef IGNORE_NETSCAPE_CERT_TYPE
|
||||
/* Netscape's certificate type. */
|
||||
case NETSCAPE_CT_OID:
|
||||
if (DecodeNsCertType(input, (int)length, cert) < 0)
|
||||
ret = ASN_PARSE_E;
|
||||
break;
|
||||
#endif
|
||||
#ifdef HAVE_OCSP
|
||||
#endif
|
||||
#ifdef HAVE_OCSP
|
||||
/* OCSP no check. */
|
||||
case OCSP_NOCHECK_OID:
|
||||
VERIFY_AND_SET_OID(cert->ocspNoCheckSet);
|
||||
@@ -21560,13 +21643,14 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
break;
|
||||
#endif
|
||||
#endif
|
||||
case POLICY_CONST_OID:
|
||||
VERIFY_AND_SET_OID(cert->extPolicyConstSet);
|
||||
cert->extPolicyConstCrit = critical ? 1 : 0;
|
||||
if (DecodePolicyConstraints(&input[idx], (int)length, cert) < 0)
|
||||
return ASN_PARSE_E;
|
||||
break;
|
||||
#endif /* !WOLFSSL_X509_TINY (inhibitAny/netscape/ocsp/policyConst) */
|
||||
#ifdef WOLFSSL_SUBJ_DIR_ATTR
|
||||
case SUBJ_DIR_ATTR_OID:
|
||||
VERIFY_AND_SET_OID(cert->extSubjDirAttrSet);
|
||||
@@ -21612,7 +21696,9 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
|
||||
default:
|
||||
if (isUnknownExt != NULL)
|
||||
*isUnknownExt = 1;
|
||||
#ifndef WOLFSSL_NO_ASN_STRICT
|
||||
/* TINY reaches default: for stripped extensions too, so reject a
|
||||
* critical one even under NO_ASN_STRICT to stay fail-closed. */
|
||||
#if !defined(WOLFSSL_NO_ASN_STRICT) || defined(WOLFSSL_X509_TINY)
|
||||
/* While it is a failure to not support critical extensions,
|
||||
* still parse the certificate ignoring the unsupported
|
||||
* extension to allow caller to accept it with the verify
|
||||
|
||||
@@ -1032,6 +1032,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t scrypt_test(void);
|
||||
defined(WOLFSSL_TSP_RESPONDER)
|
||||
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t tsp_test(void);
|
||||
#endif
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
|
||||
!defined(NO_ECC256) && !defined(NO_ECC_SECP)
|
||||
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_x509_tiny_test(void);
|
||||
#endif
|
||||
#if !defined(NO_ASN_TIME) && !defined(NO_RSA) && defined(WOLFSSL_TEST_CERT) && \
|
||||
!defined(NO_FILESYSTEM)
|
||||
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_test(void);
|
||||
@@ -3095,6 +3099,14 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
|
||||
TEST_PASS("FILL SIGNER test passed!\n");
|
||||
#endif
|
||||
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
|
||||
!defined(NO_ECC256) && !defined(NO_ECC_SECP)
|
||||
if ( (ret = cert_x509_tiny_test()) != 0)
|
||||
TEST_FAIL("X509 TINY test failed!\n", ret);
|
||||
else
|
||||
TEST_PASS("X509 TINY test passed!\n");
|
||||
#endif
|
||||
|
||||
#if defined(WOLFSSL_CERT_EXT) && defined(WOLFSSL_TEST_CERT) && \
|
||||
!defined(NO_FILESYSTEM) && !defined(NO_RSA) && defined(WOLFSSL_GEN_CERT)
|
||||
if ( (ret = certext_test()) != 0)
|
||||
@@ -26377,6 +26389,172 @@ done:
|
||||
}
|
||||
#endif /* WOLFSSL_TEST_CERT */
|
||||
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(HAVE_ECC) && \
|
||||
!defined(NO_ECC256) && !defined(NO_ECC_SECP)
|
||||
static const byte tinyCert_plain[] = {
|
||||
0x30, 0x82, 0x01, 0xBA, 0x30, 0x82, 0x01, 0x60, 0xA0, 0x03, 0x02, 0x01,
|
||||
0x02, 0x02, 0x14, 0x16, 0x9B, 0xFB, 0x03, 0x89, 0xD8, 0xB5, 0x62, 0x72,
|
||||
0xAA, 0xD5, 0x32, 0x9C, 0x7A, 0x26, 0xEE, 0x3F, 0x74, 0xED, 0x5B, 0x30,
|
||||
0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
|
||||
0x11, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x06,
|
||||
0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1E, 0x17, 0x0D, 0x32, 0x36,
|
||||
0x30, 0x36, 0x32, 0x39, 0x32, 0x31, 0x35, 0x34, 0x32, 0x37, 0x5A, 0x17,
|
||||
0x0D, 0x32, 0x37, 0x30, 0x36, 0x32, 0x39, 0x32, 0x31, 0x35, 0x34, 0x32,
|
||||
0x37, 0x5A, 0x30, 0x11, 0x31, 0x0F, 0x30, 0x0D, 0x06, 0x03, 0x55, 0x04,
|
||||
0x03, 0x0C, 0x06, 0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30,
|
||||
0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08,
|
||||
0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04,
|
||||
0x92, 0x60, 0x0B, 0x46, 0xDF, 0x03, 0xD7, 0x55, 0xE2, 0xA5, 0x9A, 0xE3,
|
||||
0xC3, 0x0A, 0x7F, 0xC7, 0x4A, 0x3D, 0xA2, 0x78, 0xB5, 0xB9, 0x17, 0xD8,
|
||||
0x11, 0x59, 0x20, 0x86, 0x2B, 0x71, 0x09, 0x6B, 0x47, 0x35, 0xAA, 0xB0,
|
||||
0xCA, 0x48, 0x0E, 0x39, 0x2D, 0x01, 0x1C, 0xD7, 0x32, 0x17, 0x58, 0xBF,
|
||||
0x20, 0x29, 0xDE, 0x88, 0xA7, 0xDD, 0x28, 0xED, 0xC5, 0x51, 0x32, 0x6F,
|
||||
0x01, 0x76, 0x5C, 0xF7, 0xA3, 0x81, 0x95, 0x30, 0x81, 0x92, 0x30, 0x1D,
|
||||
0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0x6F, 0x14, 0xF7,
|
||||
0xBC, 0xA8, 0x12, 0x67, 0x5E, 0xA5, 0xCF, 0x94, 0x87, 0xD8, 0x0C, 0x98,
|
||||
0xFE, 0xF4, 0x8C, 0xE7, 0x35, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23,
|
||||
0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x6F, 0x14, 0xF7, 0xBC, 0xA8, 0x12,
|
||||
0x67, 0x5E, 0xA5, 0xCF, 0x94, 0x87, 0xD8, 0x0C, 0x98, 0xFE, 0xF4, 0x8C,
|
||||
0xE7, 0x35, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF,
|
||||
0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xFF, 0x30, 0x1D, 0x06, 0x03, 0x55,
|
||||
0x1D, 0x11, 0x04, 0x16, 0x30, 0x14, 0x82, 0x06, 0x61, 0x2E, 0x74, 0x65,
|
||||
0x73, 0x74, 0x82, 0x0A, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x2E, 0x74, 0x65,
|
||||
0x73, 0x74, 0x30, 0x0B, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x04, 0x04, 0x03,
|
||||
0x02, 0x07, 0x80, 0x30, 0x13, 0x06, 0x03, 0x55, 0x1D, 0x25, 0x04, 0x0C,
|
||||
0x30, 0x0A, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01,
|
||||
0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02,
|
||||
0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x56, 0xC4, 0x82, 0x42, 0x72,
|
||||
0x00, 0xF0, 0x9C, 0x9D, 0xA3, 0x08, 0x7D, 0xA1, 0xB1, 0x02, 0x73, 0x9C,
|
||||
0x1C, 0x1D, 0x09, 0xB5, 0x0B, 0x64, 0xEA, 0xA8, 0xD3, 0x6F, 0x20, 0x63,
|
||||
0xCD, 0xEF, 0x69, 0x02, 0x21, 0x00, 0x88, 0x9C, 0xBF, 0xF2, 0xC5, 0x7F,
|
||||
0xD0, 0x76, 0xFD, 0x77, 0x22, 0xA7, 0xE1, 0xA5, 0xA0, 0xF2, 0x17, 0x4D,
|
||||
0x47, 0xAF, 0x90, 0x70, 0x03, 0x82, 0x8D, 0xCA, 0xEA, 0x38, 0x8F, 0x5E,
|
||||
0x37, 0xCA,
|
||||
};
|
||||
#ifndef WOLFSSL_NO_ASN_STRICT
|
||||
static const byte tinyCert_critUnknown[] = {
|
||||
0x30, 0x82, 0x01, 0x9B, 0x30, 0x82, 0x01, 0x40, 0xA0, 0x03, 0x02, 0x01,
|
||||
0x02, 0x02, 0x14, 0x11, 0xBD, 0xBB, 0x2B, 0x6D, 0x81, 0x95, 0xCF, 0xD1,
|
||||
0x84, 0x74, 0xE2, 0x45, 0xF1, 0x4B, 0x1B, 0xEA, 0xC2, 0xBC, 0xD6, 0x30,
|
||||
0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
|
||||
0x17, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0C,
|
||||
0x63, 0x72, 0x69, 0x74, 0x65, 0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74,
|
||||
0x30, 0x1E, 0x17, 0x0D, 0x32, 0x36, 0x30, 0x36, 0x33, 0x30, 0x32, 0x30,
|
||||
0x31, 0x31, 0x32, 0x34, 0x5A, 0x17, 0x0D, 0x33, 0x36, 0x30, 0x36, 0x32,
|
||||
0x37, 0x32, 0x30, 0x31, 0x31, 0x32, 0x34, 0x5A, 0x30, 0x17, 0x31, 0x15,
|
||||
0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0C, 0x63, 0x72, 0x69,
|
||||
0x74, 0x65, 0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30,
|
||||
0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08,
|
||||
0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04,
|
||||
0x9D, 0xE8, 0xE5, 0xCA, 0x7A, 0x56, 0x38, 0xC6, 0x2F, 0x03, 0xA9, 0x26,
|
||||
0x6A, 0x4A, 0x39, 0xFC, 0xC4, 0x99, 0xAD, 0xCE, 0x41, 0x17, 0xBE, 0x2C,
|
||||
0xB9, 0x3E, 0xAB, 0x5F, 0x07, 0x77, 0x93, 0x8C, 0x3F, 0x9C, 0xF2, 0x95,
|
||||
0x97, 0xE5, 0x01, 0x52, 0x30, 0x08, 0x2A, 0x19, 0x2B, 0x15, 0x68, 0xA3,
|
||||
0x88, 0x79, 0x9D, 0xA2, 0x87, 0x69, 0x68, 0x85, 0x4F, 0x77, 0x2A, 0x1B,
|
||||
0x06, 0xF6, 0xAD, 0x6A, 0xA3, 0x6A, 0x30, 0x68, 0x30, 0x1D, 0x06, 0x03,
|
||||
0x55, 0x1D, 0x0E, 0x04, 0x16, 0x04, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40,
|
||||
0x91, 0x80, 0x56, 0xF4, 0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F,
|
||||
0xCA, 0xAD, 0x5C, 0x30, 0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18,
|
||||
0x30, 0x16, 0x80, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56,
|
||||
0xF4, 0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C,
|
||||
0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05,
|
||||
0x30, 0x03, 0x01, 0x01, 0xFF, 0x30, 0x15, 0x06, 0x09, 0x2B, 0x06, 0x01,
|
||||
0x04, 0x01, 0x86, 0x8D, 0x1F, 0x01, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x04,
|
||||
0x03, 0x01, 0x02, 0x03, 0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE,
|
||||
0x3D, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00, 0x30, 0x46, 0x02, 0x21, 0x00,
|
||||
0xD8, 0x78, 0x6A, 0x3F, 0xFC, 0x03, 0x1B, 0x7D, 0x8F, 0x8C, 0x2F, 0xC9,
|
||||
0x80, 0x4B, 0x85, 0x5C, 0x2B, 0xF1, 0x52, 0x82, 0x94, 0x37, 0xE0, 0xA5,
|
||||
0x49, 0x3F, 0x30, 0xBB, 0xC2, 0xBE, 0xC7, 0xE0, 0x02, 0x21, 0x00, 0xF5,
|
||||
0xDD, 0x14, 0x04, 0xC8, 0xA2, 0xC0, 0x78, 0x13, 0x43, 0xE8, 0x97, 0xE1,
|
||||
0xEB, 0xAE, 0x2A, 0x13, 0x3D, 0x46, 0xF3, 0x1D, 0x5D, 0xAA, 0x26, 0x95,
|
||||
0x18, 0x71, 0x77, 0xF7, 0x46, 0x62, 0xD0,
|
||||
};
|
||||
#endif
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
static const byte tinyCert_nameConstr[] = {
|
||||
0x30, 0x82, 0x01, 0xA0, 0x30, 0x82, 0x01, 0x45, 0xA0, 0x03, 0x02, 0x01,
|
||||
0x02, 0x02, 0x14, 0x41, 0x1A, 0x20, 0xA6, 0xAB, 0xF3, 0x59, 0x86, 0x30,
|
||||
0xC2, 0x9A, 0xF6, 0x3F, 0x2B, 0x3D, 0x53, 0x46, 0x5B, 0x01, 0x41, 0x30,
|
||||
0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
|
||||
0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0A,
|
||||
0x6E, 0x63, 0x2D, 0x63, 0x61, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1E,
|
||||
0x17, 0x0D, 0x32, 0x36, 0x30, 0x36, 0x33, 0x30, 0x32, 0x30, 0x31, 0x31,
|
||||
0x32, 0x34, 0x5A, 0x17, 0x0D, 0x33, 0x36, 0x30, 0x36, 0x32, 0x37, 0x32,
|
||||
0x30, 0x31, 0x31, 0x32, 0x34, 0x5A, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11,
|
||||
0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0A, 0x6E, 0x63, 0x2D, 0x63, 0x61,
|
||||
0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A,
|
||||
0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE,
|
||||
0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x9D, 0xE8, 0xE5, 0xCA,
|
||||
0x7A, 0x56, 0x38, 0xC6, 0x2F, 0x03, 0xA9, 0x26, 0x6A, 0x4A, 0x39, 0xFC,
|
||||
0xC4, 0x99, 0xAD, 0xCE, 0x41, 0x17, 0xBE, 0x2C, 0xB9, 0x3E, 0xAB, 0x5F,
|
||||
0x07, 0x77, 0x93, 0x8C, 0x3F, 0x9C, 0xF2, 0x95, 0x97, 0xE5, 0x01, 0x52,
|
||||
0x30, 0x08, 0x2A, 0x19, 0x2B, 0x15, 0x68, 0xA3, 0x88, 0x79, 0x9D, 0xA2,
|
||||
0x87, 0x69, 0x68, 0x85, 0x4F, 0x77, 0x2A, 0x1B, 0x06, 0xF6, 0xAD, 0x6A,
|
||||
0xA3, 0x73, 0x30, 0x71, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04,
|
||||
0x16, 0x04, 0x14, 0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56, 0xF4,
|
||||
0xD1, 0xCB, 0x16, 0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C, 0x30,
|
||||
0x1F, 0x06, 0x03, 0x55, 0x1D, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14,
|
||||
0x4B, 0x5C, 0x3E, 0xD2, 0x40, 0x91, 0x80, 0x56, 0xF4, 0xD1, 0xCB, 0x16,
|
||||
0x56, 0x8B, 0x4F, 0xBC, 0x4F, 0xCA, 0xAD, 0x5C, 0x30, 0x0F, 0x06, 0x03,
|
||||
0x55, 0x1D, 0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01,
|
||||
0xFF, 0x30, 0x1E, 0x06, 0x03, 0x55, 0x1D, 0x1E, 0x01, 0x01, 0xFF, 0x04,
|
||||
0x14, 0x30, 0x12, 0xA0, 0x10, 0x30, 0x0E, 0x82, 0x0C, 0x2E, 0x65, 0x78,
|
||||
0x61, 0x6D, 0x70, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x30, 0x0A, 0x06,
|
||||
0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00,
|
||||
0x30, 0x46, 0x02, 0x21, 0x00, 0xE8, 0xA6, 0xDE, 0xE4, 0x18, 0x4E, 0x7B,
|
||||
0x04, 0x4F, 0xA4, 0xBE, 0x7B, 0x31, 0x97, 0x36, 0x9A, 0x2B, 0xF8, 0x21,
|
||||
0x4E, 0xBD, 0xDB, 0x1A, 0x65, 0x3C, 0xEB, 0xCC, 0xF3, 0x01, 0xB8, 0xBD,
|
||||
0xF6, 0x02, 0x21, 0x00, 0x83, 0xAE, 0x5E, 0x31, 0xE7, 0xF3, 0x7A, 0x70,
|
||||
0x18, 0x05, 0xAC, 0xAD, 0x49, 0x88, 0x28, 0x39, 0xBD, 0xCD, 0x73, 0xFE,
|
||||
0x0A, 0x74, 0x98, 0x11, 0x3F, 0xFA, 0xF1, 0x18, 0xCF, 0x4E, 0x4E, 0x93,
|
||||
};
|
||||
#endif
|
||||
|
||||
/* Exercise the WOLFSSL_X509_TINY profile: a normal cert still parses, a
|
||||
* critical unknown extension is rejected, and nameConstraints fails closed
|
||||
* unless the add-back is enabled. Self-signed P-256, parsed with NO_VERIFY. */
|
||||
WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_x509_tiny_test(void)
|
||||
{
|
||||
wc_test_ret_t ret;
|
||||
DecodedCert cert;
|
||||
|
||||
InitDecodedCert(&cert, tinyCert_plain, (word32)sizeof(tinyCert_plain), NULL);
|
||||
ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
|
||||
FreeDecodedCert(&cert);
|
||||
if (ret != 0)
|
||||
return WC_TEST_RET_ENC_EC(ret);
|
||||
|
||||
#ifndef WOLFSSL_NO_ASN_STRICT
|
||||
InitDecodedCert(&cert, tinyCert_critUnknown,
|
||||
(word32)sizeof(tinyCert_critUnknown), NULL);
|
||||
ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
|
||||
FreeDecodedCert(&cert);
|
||||
if (ret == 0) /* expected rejection, got accept */
|
||||
return WC_TEST_RET_ENC_NC;
|
||||
if (ret != WC_NO_ERR_TRACE(ASN_CRIT_EXT_E))
|
||||
return WC_TEST_RET_ENC_EC(ret);
|
||||
#endif
|
||||
|
||||
#ifndef IGNORE_NAME_CONSTRAINTS
|
||||
InitDecodedCert(&cert, tinyCert_nameConstr,
|
||||
(word32)sizeof(tinyCert_nameConstr), NULL);
|
||||
ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
|
||||
FreeDecodedCert(&cert);
|
||||
#ifdef WOLFSSL_X509_TINY_NAME_CONSTRAINTS
|
||||
if (ret != 0)
|
||||
return WC_TEST_RET_ENC_EC(ret);
|
||||
#else
|
||||
if (ret == 0) /* expected rejection, got accept */
|
||||
return WC_TEST_RET_ENC_NC;
|
||||
if (ret != WC_NO_ERR_TRACE(ASN_NAME_INVALID_E))
|
||||
return WC_TEST_RET_ENC_EC(ret);
|
||||
#endif
|
||||
#endif
|
||||
|
||||
return 0;
|
||||
}
|
||||
#endif /* WOLFSSL_X509_TINY && HAVE_ECC */
|
||||
|
||||
#if !defined(NO_ASN_TIME) && !defined(NO_RSA) && defined(WOLFSSL_TEST_CERT) && \
|
||||
!defined(NO_FILESYSTEM)
|
||||
/* Test that FillSigner clears pubKeyStored/subjectCNStored after transferring
|
||||
|
||||
@@ -4675,6 +4675,57 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
|
||||
#define OPENSSL_EXTRA_X509_SMALL
|
||||
#endif /* OPENSSL_EXTRA */
|
||||
|
||||
/* X.509 verify-only profile. Define WOLFSSL_X509_PEM (or a gen add-back) to keep
|
||||
* PEM parsing, else WOLFSSL_NO_PEM below also disables PEM-to-DER trust anchors. */
|
||||
#ifdef WOLFSSL_X509_VERIFY_ONLY
|
||||
#if !defined(WOLFSSL_X509_PEM) && !defined(WOLFSSL_NO_PEM) && \
|
||||
!defined(WOLFSSL_X509_CERT_GEN) && !defined(WOLFSSL_X509_KEY_GEN)
|
||||
#define WOLFSSL_NO_PEM
|
||||
#endif
|
||||
#if !defined(WOLFSSL_X509_CERT_GEN)
|
||||
#undef WOLFSSL_CERT_GEN
|
||||
#endif
|
||||
#if !defined(WOLFSSL_X509_KEY_GEN)
|
||||
#undef WOLFSSL_KEY_GEN
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* TINY gates live only in the template decoder; asn_orig.c would silently
|
||||
* ignore the profile. */
|
||||
#if defined(WOLFSSL_X509_TINY) && !defined(WOLFSSL_ASN_TEMPLATE)
|
||||
#error "WOLFSSL_X509_TINY requires WOLFSSL_ASN_TEMPLATE"
|
||||
#endif
|
||||
|
||||
/* TINY name-constraint enforcement needs the SAN forms it checks to be parsed;
|
||||
* force those SAN add-backs on so enforcement is never silently partial. */
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS)
|
||||
#ifndef WOLFSSL_X509_TINY_SAN_EMAIL
|
||||
#define WOLFSSL_X509_TINY_SAN_EMAIL
|
||||
#endif
|
||||
#ifndef WOLFSSL_X509_TINY_SAN_IP
|
||||
#define WOLFSSL_X509_TINY_SAN_IP
|
||||
#endif
|
||||
#ifndef WOLFSSL_X509_TINY_SAN_DIR
|
||||
#define WOLFSSL_X509_TINY_SAN_DIR
|
||||
#endif
|
||||
#ifndef WOLFSSL_X509_TINY_SAN_RID
|
||||
#define WOLFSSL_X509_TINY_SAN_RID
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* Revocation consumers need the locator extensions parsed, else they fail open
|
||||
* (OCSP would assume CERT_GOOD) or silently lose CDP auto-fetch. */
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(HAVE_OCSP)
|
||||
#ifndef WOLFSSL_X509_TINY_AIA
|
||||
#define WOLFSSL_X509_TINY_AIA
|
||||
#endif
|
||||
#endif
|
||||
#if defined(WOLFSSL_X509_TINY) && defined(HAVE_CRL_IO)
|
||||
#ifndef WOLFSSL_X509_TINY_CRL_DP
|
||||
#define WOLFSSL_X509_TINY_CRL_DP
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* support for converting DER to PEM */
|
||||
#if (defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_DER_TO_PEM)) || \
|
||||
defined(WOLFSSL_CERT_GEN) || defined(OPENSSL_EXTRA)
|
||||
|
||||
Reference in New Issue
Block a user