eden-emu/mbedtls
19
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #6883 from valeriosetti/issue6843

Browse source 
Improve X.509 cert writing serial number management
This commit is contained in:
Manuel Pégourié-Gonnard 2023-01-30 13:08:57 +01:00 • committed by GitHub
commit aae61257d1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 368 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

35
include/mbedtls/x509_crt.h
View file

@ -197,7 +197,7 @@ mbedtls_x509_crt_profile;
#define MBEDTLS_X509_CRT_VERSION_2 1
#define MBEDTLS_X509_CRT_VERSION_3 2
#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32
#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 20
#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15
#if !defined(MBEDTLS_X509_MAX_FILE_PATH_LEN)
@ -277,7 +277,8 @@ mbedtls_x509_crt_profile;
*/
typedef struct mbedtls_x509write_cert {
int MBEDTLS_PRIVATE(version);
mbedtls_mpi MBEDTLS_PRIVATE(serial);
unsigned char MBEDTLS_PRIVATE(serial)[MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN];
size_t MBEDTLS_PRIVATE(serial_len);
mbedtls_pk_context *MBEDTLS_PRIVATE(subject_key);
mbedtls_pk_context *MBEDTLS_PRIVATE(issuer_key);
mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject);
@ -986,15 +987,43 @@ void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx);
*/
void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx, int version);
#if defined(MBEDTLS_BIGNUM_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
/**
* \brief Set the serial number for a Certificate.
*
* \deprecated This function is deprecated and will be removed in a
* future version of the library. Please use
* mbedtls_x509write_crt_set_serial_raw() instead.
*
* \note Even though the MBEDTLS_BIGNUM_C guard looks redundant since
* X509 depends on PK and PK depends on BIGNUM, this emphasizes
* a direct dependency between X509 and BIGNUM which is going
* to be deprecated in the future.
*
* \param ctx CRT context to use
* \param serial serial number to set
*
* \return 0 if successful
*/
int mbedtls_x509write_crt_set_serial(mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial);
int MBEDTLS_DEPRECATED mbedtls_x509write_crt_set_serial(
mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial);
#endif // MBEDTLS_BIGNUM_C && !MBEDTLS_DEPRECATED_REMOVED
/**
* \brief Set the serial number for a Certificate.
*
* \param ctx CRT context to use
* \param serial A raw array of bytes containing the serial number in big
* endian format
* \param serial_len Length of valid bytes (expressed in bytes) in \p serial
* input buffer
*
* \return 0 if successful, or
* MBEDTLS_ERR_X509_BAD_INPUT_DATA if the provided input buffer
* is too big (longer than MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN)
*/
int mbedtls_x509write_crt_set_serial_raw(mbedtls_x509write_cert *ctx,
unsigned char *serial, size_t serial_len);
/**
* \brief Set the validity period for a Certificate