From 7a05fab716d798275f8815faa193e080773fde19 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Mon, 13 Feb 2023 10:03:07 -0500 Subject: [PATCH 1/6] Added the uniformResourceIdentifier subtype for the subjectAltName. Co-authored-by: Hannes Tschofenig Signed-off-by: Andrzej Kurek --- include/mbedtls/x509.h | 6 ++--- include/mbedtls/x509_crt.h | 2 +- library/x509.c | 32 +++++++++++++++++++++-- tests/data_files/Makefile | 6 +++++ tests/data_files/rsa_multiple_san_uri.crt | 22 ++++++++++++++++ tests/data_files/rsa_single_san_uri.crt | 21 +++++++++++++++ tests/suites/test_suite_x509parse.data | 8 ++++++ 7 files changed, 91 insertions(+), 6 deletions(-) create mode 100644 tests/data_files/rsa_multiple_san_uri.crt create mode 100644 tests/data_files/rsa_single_san_uri.crt diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h index aa1cd084e..bf1f94a73 100644 --- a/include/mbedtls/x509.h +++ b/include/mbedtls/x509.h @@ -294,7 +294,7 @@ typedef struct mbedtls_x509_subject_alternative_name { int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */ union { mbedtls_x509_san_other_name other_name; /**< The otherName supported type. */ - mbedtls_x509_buf unstructured_name; /**< The buffer for the un constructed types. Only dnsName currently supported */ + mbedtls_x509_buf unstructured_name; /**< The buffer for the unconstructed types. Only dnsName and uniformResourceIdentifier currently supported */ */ } san; /**< A union of the supported SAN types */ } @@ -385,8 +385,8 @@ int mbedtls_x509_time_is_future(const mbedtls_x509_time *from); * \param san The target structure to populate with the parsed presentation * of the subject alternative name encoded in \p san_raw. * - * \note Only "dnsName" and "otherName" of type hardware_module_name - * as defined in RFC 4180 is supported. + * \note Only "dnsName", "uniformResourceIdentifier" and "otherName", + * as defined in RFC 5280, is supported. * * \note This function should be called on a single raw data of * subject alternative name. For example, after successful diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index 187e60aac..036282f7c 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -76,7 +76,7 @@ typedef struct mbedtls_x509_crt { mbedtls_x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */ mbedtls_x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */ mbedtls_x509_buf v3_ext; /**< Optional X.509 v3 extensions. */ - mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). */ + mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). */ mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */ diff --git a/library/x509.c b/library/x509.c index 2865c2ef1..9f0dc6253 100644 --- a/library/x509.c +++ b/library/x509.c @@ -1227,8 +1227,8 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name, * nameAssigner [0] DirectoryString OPTIONAL, * partyName [1] DirectoryString } * - * NOTE: we list all types, but only use dNSName and otherName - * of type HwModuleName, as defined in RFC 4108, at this point. + * NOTE: we list all types, but only use "dnsName", "otherName" and + * "uniformResourceIdentifier", as defined in RFC 5280, at this point. */ int mbedtls_x509_get_subject_alt_name(unsigned char **p, const unsigned char *end, @@ -1397,7 +1397,19 @@ int mbedtls_x509_parse_subject_alt_name(const mbedtls_x509_buf *san_buf, } break; + /* + * uniformResourceIdentifier + */ + case (MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER): + { + memset(san, 0, sizeof(mbedtls_x509_subject_alternative_name)); + san->type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER; + memcpy(&san->san.unstructured_name, + san_buf, sizeof(*san_buf)); + + } + break; /* * dNSName */ @@ -1488,7 +1500,23 @@ int mbedtls_x509_info_subject_alt_name(char **buf, size_t *size, }/* MBEDTLS_OID_ON_HW_MODULE_NAME */ } break; + /* + * uniformResourceIdentifier + */ + case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: + { + ret = mbedtls_snprintf(p, n, "\n%s uniformResourceIdentifier : ", prefix); + MBEDTLS_X509_SAFE_SNPRINTF; + if (san.san.unstructured_name.len >= n) { + *p = '\0'; + return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL; + } + memcpy(p, san.san.unstructured_name.p, san.san.unstructured_name.len); + p += san.san.unstructured_name.len; + n -= san.san.unstructured_name.len; + } + break; /* * dNSName */ diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 070f538fe..7b97eea72 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -365,6 +365,12 @@ rsa_pkcs8_2048_public.der: rsa_pkcs8_2048_public.pem $(OPENSSL) rsa -pubin -in $< -outform DER -pubout -out $@ all_final += rsa_pkcs8_2048_public.der +rsa_single_san_uri.crt: rsa_single_san_uri.key + $(OPENSSL) req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" + +rsa_multiple_san_uri.crt: rsa_multiple_san_uri.key + $(OPENSSL) req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c, URI:urn:example.com:5ff40f78-9210-494f-8206-abcde1234567" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" + ################################################################ #### Generate various RSA keys ################################################################ diff --git a/tests/data_files/rsa_multiple_san_uri.crt b/tests/data_files/rsa_multiple_san_uri.crt new file mode 100644 index 000000000..ceda8f2c5 --- /dev/null +++ b/tests/data_files/rsa_multiple_san_uri.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDtjCCAp6gAwIBAgIULxROma15QuBZpLSG3KZTtcrOX0AwDQYJKoZIhvcNAQEL +BQAwOzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBN +YmVkIFRMUyBVUkkgU0FOMB4XDTIyMTIyODA4Mzc0NloXDTQyMTIyMzA4Mzc0Nlow +OzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBNYmVk +IFRMUyBVUkkgU0FOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3poS +TQijviHqJNAdKXN0FJMfgLsP9JZuLJczG0MAQsLaB6jHEdH/mrL3Q/1qZv6I6+5E +O5mN0fe8V9THT+OzAaxg8SwWvbog94iReK4OvNqbHEHSKZ0Ej2UHsAYBc/y/xzvJ +UD5QcbjF4g6udumddqA4/MqOSM9KUDufD6rbGhTW2zW8Z/teFW6Y7ucIcyYbS10E +T+P00ZoQbXGSzdddMy/sF+1YxsENniKUQhooIpNxX/lSCHe/CHMFfaj9HPyJE3ke +4rZtUAK1rfSmltfbRl7XQdaB1HLQA/oP+sPWp231mp9jhO2DEMYmHQcRREl/0Zrg +6RKyyIWJabtaF0pPCQIDAQABo4GxMIGuMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXg +MHUGA1UdEQRuMGyGNHVybjpleGFtcGxlLmNvbTo1ZmY0MGY3OC05MjEwLTQ5NGYt +ODIwNi1jMmMwODJmMDYwOWOGNHVybjpleGFtcGxlLmNvbTo1ZmY0MGY3OC05MjEw +LTQ5NGYtODIwNi1hYmNkZTEyMzQ1NjcwHQYDVR0OBBYEFKmGzddKZIFyozb1WrKj +2GXUOg3WMA0GCSqGSIb3DQEBCwUAA4IBAQAV3+vEBnTFcvxSnMSQmNXuSWPaomed +eoT7p5mbdKBiHGv/XoAaAF/WJUGz3dLKtfg0fPOIDPI/Diuyx2eaVHHzPYRW++W0 +wdx1VyAEfTnPexutol5hYMaSonr6wp6V509utwfXAYm8iMMAcHOpljgiGznY5DoB +5qykEAt1Y9jsjhf1Ih/7Q6rVc3I+w8AG5nrJ56MZQBjdOa6xV+8++RJwzuhiSb8E +iDEccpYkfrOOsMl5UZIsSm2BtWp4CRSigWgmN+LSpIfm/zYVYoQYrkjdWx3YhGVB ++xWW1Q/UQhQYtJ8vw9xw/vYWTVWaQDdA22d9XNxLakzwhPDX1OOCJJNy +-----END CERTIFICATE----- diff --git a/tests/data_files/rsa_single_san_uri.crt b/tests/data_files/rsa_single_san_uri.crt new file mode 100644 index 000000000..0c5b1ca6e --- /dev/null +++ b/tests/data_files/rsa_single_san_uri.crt @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDfjCCAmagAwIBAgIUWWuPuKBmp/e7Jt4G3JAjp97z0NkwDQYJKoZIhvcNAQEL +BQAwOzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBN +YmVkIFRMUyBVUkkgU0FOMB4XDTIyMTIyNzE3MDUwMVoXDTQyMTIyMjE3MDUwMVow +OzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBNYmVk +IFRMUyBVUkkgU0FOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAigYQ +brVSGf/AyTscC8GSiXPnl0PpJzwvQe0c2oVhX/GB8F++m9FT4msoc6i50KNmcuCO +l52w0lY1+XWkm6+FoqeOm5Vfj2fLrsDed2jomI6T5n68QOtbWZNluCbBbDpnAZbo +QCUwHHjrPSc8h76kxEbX7luPOUaG6cyN/eG+HPY6XLRxDUbqFl9q/WsVkAfm5jO5 +7Oa3j4NfnIbFyuHbQXCmCdBq+4sLW3eKAvp2PyKvB601evOMtmUoX4SrWBTI/rfS +8Z6DqJN+V2afOameP/JiuQbc8GvKwOYLRKjdH8bJZ3GUdxTdOAvFhxfUxQIo7aup +nlLGHLdJUPUurV6dywIDAQABo3oweDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DA/ +BgNVHREEODA2hjR1cm46ZXhhbXBsZS5jb206NWZmNDBmNzgtOTIxMC00OTRmLTgy +MDYtYzJjMDgyZjA2MDljMB0GA1UdDgQWBBSDgDX0Y5xPkSAbqVeJ491MzU9jZDAN +BgkqhkiG9w0BAQsFAAOCAQEAFYXiBh3La7vmEj3uTpzGvNBMtJdiXK6C5IgRnARI +5jye0m3AMK9EJEKrE0144PWOKahirxgznCbPPxL86xfC552Wzu2+ARlXBs+XVQnh +c/IQ7NzCw6Pwtg8hFP0Qhjmp4rMvVjbHH8uPBaefx0wDO80f/VOC3xIPqVHA8U9X +Q8+dBPcv1iHaZ8gBx+lTZVaRSzAciNkPFRv5X/GAcnhIWQFBJD0XTlH4SgdsW4O6 +0Oqo4qbHPxPf5zx3ZtX0zG13+/wiPAMvZyjemCMtsentiJt0+a5n+9X3b2lhEq58 +yy5d8aax9EXT5TAguKP7kV1sglSlJcIzmKXb4MCdTYfdfg== +-----END CERTIFICATE----- diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index 98c2ae352..6edb43b3d 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -122,6 +122,14 @@ X509 CRT information, Subject Alt Name + Key Usage depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA x509_cert_info:"data_files/cert_example_multi_nocn.crt":"cert. version \: 3\nserial number \: F7\:C6\:7F\:F8\:E9\:A9\:63\:F9\nissuer name \: C=NL\nsubject name \: C=NL\nissued on \: 2014-01-22 10\:04\:33\nexpires on \: 2024-01-22 10\:04\:33\nsigned using \: RSA with SHA1\nRSA key size \: 1024 bits\nbasic constraints \: CA=false\nsubject alt name \:\n dNSName \: www.shotokan-braunschweig.de\n dNSName \: www.massimo-abate.eu\n \n \nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" +X509 CRT information, Subject Alt Name with uniformResourceIdentifier +depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA +x509_cert_info:"data_files/rsa_single_san_uri.crt":"cert. version \: 3\nserial number \: 59\:6B\:8F\:B8\:A0\:66\:A7\:F7\:BB\:26\:DE\:06\:DC\:90\:23\:A7\:DE\:F3\:D0\:D9\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-27 17\:05\:01\nexpires on \: 2042-12-22 17\:05\:01\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" + +X509 CRT information, Subject Alt Name with two uniformResourceIdentifiers +depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA +x509_cert_info:"data_files/rsa_multiple_san_uri.crt":"cert. version \: 3\nserial number \: 2F\:14\:4E\:99\:AD\:79\:42\:E0\:59\:A4\:B4\:86\:DC\:A6\:53\:B5\:CA\:CE\:5F\:40\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-28 08\:37\:46\nexpires on \: 2042-12-23 08\:37\:46\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-abcde1234567\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" + X509 CRT information, RSA Certificate Policy any depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA x509_cert_info:"data_files/test-ca-any_policy.crt":"cert. version \: 3\nserial number \: 00\nissuer name \: C=NL, O=PolarSSL, CN=PolarSSL Test CA\nsubject name \: C=NL, O=PolarSSL, CN=PolarSSL Test CA\nissued on \: 2019-03-21 16\:40\:59\nexpires on \: 2029-03-21 16\:40\:59\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=true\ncertificate policies \: Any Policy\n" From 4077372b980ee73203b4d4d7cdec342c7c1565fc Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 5 Jan 2023 10:41:59 -0500 Subject: [PATCH 2/6] Fix SHA requirement for SAN URI tests Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_x509parse.data | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index 6edb43b3d..4e6c55dbe 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -123,11 +123,11 @@ depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA x509_cert_info:"data_files/cert_example_multi_nocn.crt":"cert. version \: 3\nserial number \: F7\:C6\:7F\:F8\:E9\:A9\:63\:F9\nissuer name \: C=NL\nsubject name \: C=NL\nissued on \: 2014-01-22 10\:04\:33\nexpires on \: 2024-01-22 10\:04\:33\nsigned using \: RSA with SHA1\nRSA key size \: 1024 bits\nbasic constraints \: CA=false\nsubject alt name \:\n dNSName \: www.shotokan-braunschweig.de\n dNSName \: www.massimo-abate.eu\n \n \nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, Subject Alt Name with uniformResourceIdentifier -depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA +depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA x509_cert_info:"data_files/rsa_single_san_uri.crt":"cert. version \: 3\nserial number \: 59\:6B\:8F\:B8\:A0\:66\:A7\:F7\:BB\:26\:DE\:06\:DC\:90\:23\:A7\:DE\:F3\:D0\:D9\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-27 17\:05\:01\nexpires on \: 2042-12-22 17\:05\:01\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, Subject Alt Name with two uniformResourceIdentifiers -depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA +depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA x509_cert_info:"data_files/rsa_multiple_san_uri.crt":"cert. version \: 3\nserial number \: 2F\:14\:4E\:99\:AD\:79\:42\:E0\:59\:A4\:B4\:86\:DC\:A6\:53\:B5\:CA\:CE\:5F\:40\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-28 08\:37\:46\nexpires on \: 2042-12-23 08\:37\:46\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-abcde1234567\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, RSA Certificate Policy any From 50836c4dfb31fce11638300ae5dfa2f833d5a0d8 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Mon, 13 Feb 2023 10:19:49 -0500 Subject: [PATCH 3/6] Fix a comment in x509_crt.h Signed-off-by: Andrzej Kurek --- include/mbedtls/x509.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h index bf1f94a73..40b75a2b9 100644 --- a/include/mbedtls/x509.h +++ b/include/mbedtls/x509.h @@ -294,7 +294,7 @@ typedef struct mbedtls_x509_subject_alternative_name { int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */ union { mbedtls_x509_san_other_name other_name; /**< The otherName supported type. */ - mbedtls_x509_buf unstructured_name; /**< The buffer for the unconstructed types. Only dnsName and uniformResourceIdentifier currently supported */ */ + mbedtls_x509_buf unstructured_name; /**< The buffer for the unconstructed types. Only dnsName and uniformResourceIdentifier are currently supported */ } san; /**< A union of the supported SAN types */ } From 3e8f65a7e2a9860552206182cd99b2dade41a15e Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 2 Feb 2023 07:06:19 -0500 Subject: [PATCH 4/6] Add a changelog entry for URI SAN parsing Signed-off-by: Andrzej Kurek --- ChangeLog.d/add-uri-san.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/add-uri-san.txt diff --git a/ChangeLog.d/add-uri-san.txt b/ChangeLog.d/add-uri-san.txt new file mode 100644 index 000000000..5184e8f5d --- /dev/null +++ b/ChangeLog.d/add-uri-san.txt @@ -0,0 +1,3 @@ +Features + * Add parsing of uniformResourceIdentifier subtype for subjectAltName + extension in x509 certificates. From 570a0f808bc2e099b927f8981bea64ba130fbd3f Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 14 Feb 2023 05:52:49 -0500 Subject: [PATCH 5/6] Move to DER certificates for new x509 tests Signed-off-by: Andrzej Kurek --- tests/data_files/Makefile | 12 ++++---- tests/data_files/rsa_multiple_san_uri.crt | 22 -------------- tests/data_files/rsa_multiple_san_uri.crt.der | Bin 0 -> 954 bytes tests/data_files/rsa_multiple_san_uri.key | 28 ++++++++++++++++++ tests/data_files/rsa_single_san_uri.crt | 21 ------------- tests/data_files/rsa_single_san_uri.crt.der | Bin 0 -> 898 bytes tests/data_files/rsa_single_san_uri.key | 28 ++++++++++++++++++ tests/suites/test_suite_x509parse.data | 8 ++--- 8 files changed, 66 insertions(+), 53 deletions(-) delete mode 100644 tests/data_files/rsa_multiple_san_uri.crt create mode 100644 tests/data_files/rsa_multiple_san_uri.crt.der create mode 100644 tests/data_files/rsa_multiple_san_uri.key delete mode 100644 tests/data_files/rsa_single_san_uri.crt create mode 100644 tests/data_files/rsa_single_san_uri.crt.der create mode 100644 tests/data_files/rsa_single_san_uri.key diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 7b97eea72..f3165101a 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -336,6 +336,12 @@ server5-tricky-ip-san.crt: server5.key $(OPENSSL) req -x509 -new -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS Tricky IP SAN" -set_serial 77 -config $(test_ca_config_file) -extensions tricky_ip_san -days 3650 -sha256 -key server5.key -out $@ all_final += server5-tricky-ip-san.crt +rsa_single_san_uri.crt.der: rsa_single_san_uri.key + $(OPENSSL) req -x509 -outform der -nodes -days 7300 -newkey rsa:2048 -key $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" + +rsa_multiple_san_uri.crt.der: rsa_multiple_san_uri.key + $(OPENSSL) req -x509 -outform der -nodes -days 7300 -newkey rsa:2048 -key $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c, URI:urn:example.com:5ff40f78-9210-494f-8206-abcde1234567" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" + server10-badsign.crt: server10.crt { head -n-2 $<; tail -n-2 $< | sed -e '1s/0\(=*\)$$/_\1/' -e '1s/[^_=]\(=*\)$$/0\1/' -e '1s/_/1/'; } > $@ all_final += server10-badsign.crt @@ -365,12 +371,6 @@ rsa_pkcs8_2048_public.der: rsa_pkcs8_2048_public.pem $(OPENSSL) rsa -pubin -in $< -outform DER -pubout -out $@ all_final += rsa_pkcs8_2048_public.der -rsa_single_san_uri.crt: rsa_single_san_uri.key - $(OPENSSL) req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" - -rsa_multiple_san_uri.crt: rsa_multiple_san_uri.key - $(OPENSSL) req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout $< -out $@ -addext "subjectAltName = URI:urn:example.com:5ff40f78-9210-494f-8206-c2c082f0609c, URI:urn:example.com:5ff40f78-9210-494f-8206-abcde1234567" -extensions 'v3_req' -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS URI SAN" - ################################################################ #### Generate various RSA keys ################################################################ diff --git a/tests/data_files/rsa_multiple_san_uri.crt b/tests/data_files/rsa_multiple_san_uri.crt deleted file mode 100644 index ceda8f2c5..000000000 --- a/tests/data_files/rsa_multiple_san_uri.crt +++ /dev/null @@ -1,22 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDtjCCAp6gAwIBAgIULxROma15QuBZpLSG3KZTtcrOX0AwDQYJKoZIhvcNAQEL -BQAwOzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBN -YmVkIFRMUyBVUkkgU0FOMB4XDTIyMTIyODA4Mzc0NloXDTQyMTIyMzA4Mzc0Nlow -OzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBNYmVk -IFRMUyBVUkkgU0FOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3poS -TQijviHqJNAdKXN0FJMfgLsP9JZuLJczG0MAQsLaB6jHEdH/mrL3Q/1qZv6I6+5E -O5mN0fe8V9THT+OzAaxg8SwWvbog94iReK4OvNqbHEHSKZ0Ej2UHsAYBc/y/xzvJ -UD5QcbjF4g6udumddqA4/MqOSM9KUDufD6rbGhTW2zW8Z/teFW6Y7ucIcyYbS10E -T+P00ZoQbXGSzdddMy/sF+1YxsENniKUQhooIpNxX/lSCHe/CHMFfaj9HPyJE3ke -4rZtUAK1rfSmltfbRl7XQdaB1HLQA/oP+sPWp231mp9jhO2DEMYmHQcRREl/0Zrg -6RKyyIWJabtaF0pPCQIDAQABo4GxMIGuMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXg -MHUGA1UdEQRuMGyGNHVybjpleGFtcGxlLmNvbTo1ZmY0MGY3OC05MjEwLTQ5NGYt -ODIwNi1jMmMwODJmMDYwOWOGNHVybjpleGFtcGxlLmNvbTo1ZmY0MGY3OC05MjEw -LTQ5NGYtODIwNi1hYmNkZTEyMzQ1NjcwHQYDVR0OBBYEFKmGzddKZIFyozb1WrKj -2GXUOg3WMA0GCSqGSIb3DQEBCwUAA4IBAQAV3+vEBnTFcvxSnMSQmNXuSWPaomed -eoT7p5mbdKBiHGv/XoAaAF/WJUGz3dLKtfg0fPOIDPI/Diuyx2eaVHHzPYRW++W0 -wdx1VyAEfTnPexutol5hYMaSonr6wp6V509utwfXAYm8iMMAcHOpljgiGznY5DoB -5qykEAt1Y9jsjhf1Ih/7Q6rVc3I+w8AG5nrJ56MZQBjdOa6xV+8++RJwzuhiSb8E -iDEccpYkfrOOsMl5UZIsSm2BtWp4CRSigWgmN+LSpIfm/zYVYoQYrkjdWx3YhGVB -+xWW1Q/UQhQYtJ8vw9xw/vYWTVWaQDdA22d9XNxLakzwhPDX1OOCJJNy ------END CERTIFICATE----- diff --git a/tests/data_files/rsa_multiple_san_uri.crt.der b/tests/data_files/rsa_multiple_san_uri.crt.der new file mode 100644 index 0000000000000000000000000000000000000000..ac5fab2932aacc7c232d5a78c69c5203ba2f6041 GIT binary patch literal 954 zcmXqLV%}!Z#58XKGZP~dlL*J7$r2OQZn$+!5b)pHcKS%gvsb(Zylk9WZ60mkc^MhG zSs4th4Y>_C*_cCF*o2uvy$uBo_(2>l9uD86)D(pfpI}2t196ZLGmijFNFg-HQz6*V z&p=L`*T~qw$k4>lz}Vc>AWEFq1jse8gmNh}yopf>*|ChQ49rc8{0s(7j9g4jjEoE$ zi)ZaQfAr$3kKeAWGW&AUyyVeJk5|{fn*Ef!+2nAFOIh-AAlKQ6;eAdwCTw4NbFp7c z4&ThrJH_}IJMI5@A8UVoJoe)9n8>s9w=gi@-|H~r*`1q*GUhmDzx#H&N}c6X#+E~8 zwMz=VT-iMFQOoRFcav!^Ql30vPVVE9JMdWXkX-!drocd)X{S%#v(46>r~Y*d zGgS$#II7R_AU4kBEfX^%1LNYxjRuYDz%eK*%)(^AV89KGELnaQ7G@^a2L`1ejvz~( zK~9@VX;Ge4YDHphK~Ab(a(=FrXB0;T3ML-XUwe)}$RX=kqf9QBGWYf3k~fJ=iVhr0rq6T86J6t% z#qugIeD9h`d~XzgonwqV_$q*{Z_DDZio5r{N>sPGF#Eu+EV-lw0w*8)uj~Are15O^ zRqh+RbzF>Xu1Q^q*4wk`8%8$11^?Z1VWy6BzCr^*qe5g5*7qrYoi_9UY@k^nOFbbF8>wEOL)~+eX0NF>o$E$)Zw(OqM~J+ WcvstKeF;9*e0W*?%#B-4UjhK9SbH@9 literal 0 HcmV?d00001 diff --git a/tests/data_files/rsa_multiple_san_uri.key b/tests/data_files/rsa_multiple_san_uri.key new file mode 100644 index 000000000..c8c3492bb --- /dev/null +++ b/tests/data_files/rsa_multiple_san_uri.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCxc5q8z8XR6vH2 +1Ko29Mk3dOKpSOrX9Tb5HtmCQMoKIxnTUQrNkVeOQtiQt6XZo05cbA6Z87kWDgGJ +P/5Lxofrx13Rp1xZzZ+0AAPfvUCY5tzZwmicQWvu9st6JwTyaLTCzSt0cPTUs5Hi +hJt9RzSW6GTk5ANjjgoewOMhwh5f84JRURJ2INZjz4namBGe/9f14ZHxKWuxl5in ++z582rSEhLXrPLbaKjT3Jphff51xsusC+pP0xNqkAcrGJ+/Jk0Vk6ClRCd40ZcTB +4SkOqsZ8/uGWnradkrN74PoMMnSKKOuxlsVMPfzMkrlMbuazO4nK/osTAnoSqMUv +COBdXkTtAgMBAAECggEANVlTIQa6K3UeD546GlGXmQOcDVbtu8VuJJFgxScjVs7c +uco4nDrg/tUb9M4xn2/YZDLcZO6AK6BEV/YURsXGIV2L2DcfraQDKoOCpqZoIE/v +/8vR1YBZqbsqy2ulshdGmPZD5Tr8cGIYLui9MnnQ1rnBc4sVdb3DTyGgZ4rLxP6X +0BoHw+LQA0wwSbE/NW71qmeDSEDkSkUQISVg6Rp06U0PZaJAWtYoBNKGAsDGAhjc +vVTXE5B9d+3yOM0InCWFsM/bUvaUv/yxxTcZnVq9Lji3KwDhy63F99pUaFnV6Rf2 +3CKO3VHegWSwMcnYaBbufDqWPHuEDSlZ0nRhrbrKRQKBgQD6dQd0xPHfxIz5l+AC +1kPHIsUKPEirrJKTVHlxQwT0yVpD+yUkF95HY6NgHVHKnRP9qicqr3raIfA01VQc +y+lhXo6xUAqYsKvB9m4njERFWMTCVSVU30Klhic/s4R/1abKlvkax1SiQFIRStqC +onsZ0M1Isw69/I8Yha3mzv/gvwKBgQC1YPXnd5dZmdbe0UibBWjU5X6AQGt+oxL+ ++6EP3EfuRmYI3i3r2bdbB3ELd95f8tgV0UagmjQfFoigBsuRfbhrQEPSHMBWYpAV ++TZKxUvmpJXwLEgxcPv7VTTvxw0qL1u1s/dX6WBfEOUgVzPgcp+IJGEr1MZekTqt +P65coDpZUwKBgAmrLuiBGd1Lly2jgVBauS8c1oJ4pU2LUfVCE5Ydwjk49LUfIuXr +zfbvj8UMHLY3rifiw7RQJev5124StjaOYKoTnmqV7nLKjzbjroj0T0ZmEOJ3qwNF +wyrkrOs2oOzWcKPthBxWiZvh48krHJhicWIjv2kJEI6hC10k+/unDhW9AoGAZyRg +MeRb+OP2wHaapy0IVCi9Kwl3F2h8oOtOx8ooTWNTGq/dxUTlc6pjqnXbyww5vQ5o +72NBSHxz7SxwDqhDexnsd0tKRNV/wj8ZlKNlah8l9JH568OoR2BI3iF/ZwHPUSCq +Ax//YZAl+6IbKgOEnNKzP02cEKLdjy+rY5jqFWkCgYEAmEl4mg1IGoVDM6d3iIPP +JLz5DghV8kP++99vFrJx07D6e/uhzojR73Ye+fq69Vy0yjGXpaRPwwHfvPzDA1hm +ir7rJWsbbskR+iTn2yKvIpB1wBI1u0SQ4lnJ1ZIVJPVlh4yA29JvPT7/7/2nQ/s6 +v0N2oKrfaiKc7BjCz3eYW4Q= +-----END PRIVATE KEY----- diff --git a/tests/data_files/rsa_single_san_uri.crt b/tests/data_files/rsa_single_san_uri.crt deleted file mode 100644 index 0c5b1ca6e..000000000 --- a/tests/data_files/rsa_single_san_uri.crt +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDfjCCAmagAwIBAgIUWWuPuKBmp/e7Jt4G3JAjp97z0NkwDQYJKoZIhvcNAQEL -BQAwOzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBN -YmVkIFRMUyBVUkkgU0FOMB4XDTIyMTIyNzE3MDUwMVoXDTQyMTIyMjE3MDUwMVow -OzELMAkGA1UEBhMCVUsxETAPBgNVBAoMCE1iZWQgVExTMRkwFwYDVQQDDBBNYmVk -IFRMUyBVUkkgU0FOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAigYQ -brVSGf/AyTscC8GSiXPnl0PpJzwvQe0c2oVhX/GB8F++m9FT4msoc6i50KNmcuCO -l52w0lY1+XWkm6+FoqeOm5Vfj2fLrsDed2jomI6T5n68QOtbWZNluCbBbDpnAZbo -QCUwHHjrPSc8h76kxEbX7luPOUaG6cyN/eG+HPY6XLRxDUbqFl9q/WsVkAfm5jO5 -7Oa3j4NfnIbFyuHbQXCmCdBq+4sLW3eKAvp2PyKvB601evOMtmUoX4SrWBTI/rfS -8Z6DqJN+V2afOameP/JiuQbc8GvKwOYLRKjdH8bJZ3GUdxTdOAvFhxfUxQIo7aup -nlLGHLdJUPUurV6dywIDAQABo3oweDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DA/ -BgNVHREEODA2hjR1cm46ZXhhbXBsZS5jb206NWZmNDBmNzgtOTIxMC00OTRmLTgy -MDYtYzJjMDgyZjA2MDljMB0GA1UdDgQWBBSDgDX0Y5xPkSAbqVeJ491MzU9jZDAN -BgkqhkiG9w0BAQsFAAOCAQEAFYXiBh3La7vmEj3uTpzGvNBMtJdiXK6C5IgRnARI -5jye0m3AMK9EJEKrE0144PWOKahirxgznCbPPxL86xfC552Wzu2+ARlXBs+XVQnh -c/IQ7NzCw6Pwtg8hFP0Qhjmp4rMvVjbHH8uPBaefx0wDO80f/VOC3xIPqVHA8U9X -Q8+dBPcv1iHaZ8gBx+lTZVaRSzAciNkPFRv5X/GAcnhIWQFBJD0XTlH4SgdsW4O6 -0Oqo4qbHPxPf5zx3ZtX0zG13+/wiPAMvZyjemCMtsentiJt0+a5n+9X3b2lhEq58 -yy5d8aax9EXT5TAguKP7kV1sglSlJcIzmKXb4MCdTYfdfg== ------END CERTIFICATE----- diff --git a/tests/data_files/rsa_single_san_uri.crt.der b/tests/data_files/rsa_single_san_uri.crt.der new file mode 100644 index 0000000000000000000000000000000000000000..22308c6f45d82f7ed64c5a4224ae63a56aada704 GIT binary patch literal 898 zcmXqLVy-i2VoF=U%*4pVB$8kH`em-_o{pxZ#Sb!;n_Isr?Vn@7%f_kI=F#?@mywa1 zmBGN;klTQhjX9KsO_(Xv+fdMeAH?C};qXmLO;HH(2{x285C;h{^9aC%6hebM6@nf8 z4CKUljf@S93{4CTj4cdIqr`blfLsGhD3>zBn;4al9m~kdz}&>h&tTBR$i>ve$jGp~ z*>7`Mq+*hS*WDKY7tn-np}0 z=M+y{+4{p^^_p9ky}LF<%wH6e%OuhMd2z`;iv~5Ho9<`du?3lZo~``+p|RWUc3q%a~4n7KfT9s+n#gF zsu~S``Wg51^w_L9xBGPMU)!YK^mTvE>vxBTUS9ZNvc&_@59y}M(qBb}uQ+JBut>ye zmfqQiQ*UP+>9%_RPRNWeEJ>4Te&4zt=kP+KYq^h}?5f$f_hIyr|K5^sZz)ZTZf9G) zMwj)D^!pH%s@+PPe!a{5bRyy>&#B4fN~>8;pGZvjC1l1Ll`iYaUb<_uKZ|OF=5xjE zJiTl8t0#q670oGP`QfO(WQB#crbywkza@`9yG`5irkL><%Z>Z9Rz_FK{+D&)PW$h3 y(?|G|?z+{PoXQG!rIe%|?)N+CcBw)wQ2O_WlcD1G_^n>@iS3v+zac)Orvv~P1yK?J literal 0 HcmV?d00001 diff --git a/tests/data_files/rsa_single_san_uri.key b/tests/data_files/rsa_single_san_uri.key new file mode 100644 index 000000000..bb6c0ca6b --- /dev/null +++ b/tests/data_files/rsa_single_san_uri.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCng06zdlkhYiBK +43H+cK+vkHYvvRA2RtWbLMw+9rV9IrdGQ+iQQ/X1SZfDl2hWUiKTpabcuGYzY38H +lXW4UXwTB36KEe7G3yF/fbvYzNsdUCAVOzNs/0EMvXJeD/Dm5CBMEsG6V0ovHmkc +c80fQYQiSxgjpWyRpKdP+z/2imGph9onuu7EWOpAXGArozlLL5OixQ2dmutsc5ap +hfgwq6za00uKsFifolRtAhiH86N0vjiAJkzZR83uBlI285sj5+EzRrtjVv+kgsLW +gLDlj3bgsuKQDfxWhe+mpy2PIJ41kqktCz1qew3wyHI2ysE+6htHYQMNbCtkRMdX +/4t1yx95AgMBAAECggEAIIhn6IK7nLgp/WFe6kOIW1h7G5pkY6YuJgz1PeU8Kilr +3sGhkSMhyZmZV+s34EvjWzl4xrUpZCGWsipcyodIyYlTEg2ZihYbs17/9IMUqwS8 +tmLhAfIw+ABzDcGaz7zOaPfbmA0L40rMrzHuTHu05dQfxAyEoWSQ+f+Z1I/bl8jy +GdXQVtqZzqJcWXbXt+3+B4f2/d7K5xzb7lv/8zhAf/zoG9srMByPa6/Do5rVas5Q +NmzJPwXngxE5dJcHsWU4FkHbSbJj0khW858MJ4o5Ddw5ZOPimqlcmpClb01wCdXf +13o2ozKGE/xq3InU7MA4ad0tLMdEM8R7yhUZ9Xe/gQKBgQDYXt4BhiamnSl1tHR8 +MiiyzkcZuVH04/A6FsnUhcbQF9iCqO9szw50k0z7DVIGS9dSY9kmMdEcpsX6m2XC +XfEsxHBm0wmJqLUGq3UzM6oDsyZG1fkTg+eMzbVO0sv4xdhJLPpmsck5yJ8t0TxB +8gIS9yNEw7+w6rZhgSRsMT+WhQKBgQDGMZ0qIdFi1Ae7ueTcBCe+cjgmTG9nXq6+ +qRokU63rPP9y8XTVD6hRmviMRl4skt0F39yGJ7janIQnOBrf2DVEX4Mcf0sY4vDJ +msDV5jkbzgbAEas0ejO4h+dpRqa4mUiU1JR/Pb1jZHNOg7ZfTw45WPqBGsLTEpAt +OsKVUgbZZQKBgCIe+8WjwS6fNC2SspfvVQm1i/Lbjbgfxf9zHor8ObkROZyJRZCU +KoRpwkcI97l0dlVQ16q1SnPJPQljPi3joKfdppggia2CxGFz4nybliEVPGEJV0kj +kP1cZ04x4eauVIhdpnNRcBlDsQ6Jo4YGwxr4jEBI2k7tBKvlsLe7IHr9AoGAeJmi +IAwaBIAvAH16lKL2qD2Ki0uBkq4buSrfHHHK59TjQEdLJ4byjk21pm3/SjJHyhZR +c1TieCw7gj3ypHlE2IkiGAohYVBe4t6HLuF7qL6yfteBjVo69LPGDdqPAs9LSj0c +61xfTQbH32PoapCJgD3zmPH20Ud/cfZKh2A1iL0CgYEAwQgGxHVo+/d3BhLQvQHt +64fE+qrZA5oWWwBh8EzR+98eOnDCF3Gm6chrEs9boOzlwxr9LU4TgiBnpyYrQCEw +AdOA9dhYz91d+chJZjKo635Y9byN9rutr3/EfqZLxWL73k1y5LNAYL+jyAab0Jsw +l2xG6PNj5rItkgO3j50qA7s= +-----END PRIVATE KEY----- diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index 4e6c55dbe..28ba0776b 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -123,12 +123,12 @@ depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA x509_cert_info:"data_files/cert_example_multi_nocn.crt":"cert. version \: 3\nserial number \: F7\:C6\:7F\:F8\:E9\:A9\:63\:F9\nissuer name \: C=NL\nsubject name \: C=NL\nissued on \: 2014-01-22 10\:04\:33\nexpires on \: 2024-01-22 10\:04\:33\nsigned using \: RSA with SHA1\nRSA key size \: 1024 bits\nbasic constraints \: CA=false\nsubject alt name \:\n dNSName \: www.shotokan-braunschweig.de\n dNSName \: www.massimo-abate.eu\n \n \nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, Subject Alt Name with uniformResourceIdentifier -depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA -x509_cert_info:"data_files/rsa_single_san_uri.crt":"cert. version \: 3\nserial number \: 59\:6B\:8F\:B8\:A0\:66\:A7\:F7\:BB\:26\:DE\:06\:DC\:90\:23\:A7\:DE\:F3\:D0\:D9\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-27 17\:05\:01\nexpires on \: 2042-12-22 17\:05\:01\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" +depends_on:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA +x509_cert_info:"data_files/rsa_single_san_uri.crt.der":"cert. version \: 3\nserial number \: 6F\:75\:EB\:E9\:6D\:25\:BC\:88\:82\:62\:A3\:E0\:68\:A7\:37\:3B\:EC\:75\:8F\:9C\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2023-02-14 10\:38\:05\nexpires on \: 2043-02-09 10\:38\:05\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, Subject Alt Name with two uniformResourceIdentifiers -depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA -x509_cert_info:"data_files/rsa_multiple_san_uri.crt":"cert. version \: 3\nserial number \: 2F\:14\:4E\:99\:AD\:79\:42\:E0\:59\:A4\:B4\:86\:DC\:A6\:53\:B5\:CA\:CE\:5F\:40\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2022-12-28 08\:37\:46\nexpires on \: 2042-12-23 08\:37\:46\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-abcde1234567\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" +depends_on:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA +x509_cert_info:"data_files/rsa_multiple_san_uri.crt.der":"cert. version \: 3\nserial number \: 08\:E2\:93\:18\:91\:26\:D8\:46\:88\:90\:10\:4F\:B5\:86\:CB\:C4\:78\:E6\:EA\:0D\nissuer name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nsubject name \: C=UK, O=Mbed TLS, CN=Mbed TLS URI SAN\nissued on \: 2023-02-14 10\:37\:50\nexpires on \: 2043-02-09 10\:37\:50\nsigned using \: RSA with SHA-256\nRSA key size \: 2048 bits\nbasic constraints \: CA=false\nsubject alt name \:\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-c2c082f0609c\n uniformResourceIdentifier \: urn\:example.com\:5ff40f78-9210-494f-8206-abcde1234567\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n" X509 CRT information, RSA Certificate Policy any depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA From 81b0b89a34eed11d7e5c3136d1f620d24e41e6f8 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 16 Feb 2023 06:55:10 -0500 Subject: [PATCH 6/6] Clarify comments on subjectAltName types Signed-off-by: Andrzej Kurek --- include/mbedtls/x509.h | 5 +++-- library/x509.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h index 40b75a2b9..9f92ed6ac 100644 --- a/include/mbedtls/x509.h +++ b/include/mbedtls/x509.h @@ -385,8 +385,9 @@ int mbedtls_x509_time_is_future(const mbedtls_x509_time *from); * \param san The target structure to populate with the parsed presentation * of the subject alternative name encoded in \p san_raw. * - * \note Only "dnsName", "uniformResourceIdentifier" and "otherName", - * as defined in RFC 5280, is supported. + * \note Supported GeneralName types, as defined in RFC 5280: + * "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + * of type "otherName", as defined in RFC 4108. * * \note This function should be called on a single raw data of * subject alternative name. For example, after successful diff --git a/library/x509.c b/library/x509.c index 9f0dc6253..b859df9d3 100644 --- a/library/x509.c +++ b/library/x509.c @@ -1227,8 +1227,9 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name, * nameAssigner [0] DirectoryString OPTIONAL, * partyName [1] DirectoryString } * - * NOTE: we list all types, but only use "dnsName", "otherName" and - * "uniformResourceIdentifier", as defined in RFC 5280, at this point. + * We list all types, but use the following GeneralName types from RFC 5280: + * "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + * of type "otherName", as defined in RFC 4108. */ int mbedtls_x509_get_subject_alt_name(unsigned char **p, const unsigned char *end,