mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add restriction to excluded DIR name constraint

Browse Source
This commit is contained in:
Jacob Barthelmeh 2020-12-11 10:00:11 +07:00
parent f00263889b
commit 04e22b0747
6 changed files with 112 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
certs/test/cert-ext-ndir-exc.cfg Normal file
View File

@ -0,0 +1,24 @@
[ req ]
distinguished_name = req_distinguished_name
prompt = no
x509_extensions = constraints
[ req_distinguished_name ]
C = US
ST = Montana
L = Bozeman
O = Sawtooth
OU = Consulting
CN = www.wolfssl.com
emailAddress = info@wolfsssl.com
[constraints]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints=CA:TRUE
nameConstraints=critical,excluded;dirName:dir_name_exclude
[dir_name_exclude]
countryName = US
stateOrProvinceName = California

BIN
certs/test/cert-ext-ndir-exc.der Normal file
View File

Binary file not shown.

32
certs/test/gen-ext-certs.sh
View File

@ -128,3 +128,35 @@ countryName = US
EOF
gen_cert
OUT=certs/test/cert-ext-ndir-exc.der
KEYFILE=certs/ca-key.der
CONFIG=certs/test/cert-ext-ndir-exc.cfg
tee >$CONFIG <<EOF
[ req ]
distinguished_name = req_distinguished_name
prompt = no
x509_extensions = constraints
[ req_distinguished_name ]
C = US
ST = Montana
L = Bozeman
O = Sawtooth
OU = Consulting
CN = www.wolfssl.com
emailAddress = info@wolfsssl.com
[constraints]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints=CA:TRUE
nameConstraints=critical,excluded;dirName:dir_name_exclude
[dir_name_exclude]
countryName = US
stateOrProvinceName = California
EOF
gen_cert

2
certs/test/include.am
View File

@ -12,6 +12,8 @@ EXTRA_DIST += \
certs/test/cert-ext-ndir.cfg \
certs/test/cert-ext-ndir.der \
certs/test/cert-ext-ns.der \
certs/test/cert-ext-ndir-exc.cfg \
certs/test/cert-ext-ndir-exc.der \
certs/test/gen-ext-certs.sh \
certs/test/server-duplicate-policy.pem \
certs/test/cert-ext-joi.pem

38
tests/api.c
View File

@ -1274,7 +1274,8 @@ static void test_wolfSSL_CertManagerNameConstraint2(void)
!defined(NO_WOLFSSL_CM_VERIFY) && !defined(NO_RSA) && \
defined(OPENSSL_EXTRA) && defined(WOLFSSL_CERT_GEN) && \
defined(WOLFSSL_CERT_EXT) && defined(WOLFSSL_ALT_NAMES)
const char* ca_cert = "./certs/test/cert-ext-ndir.der";
const char* ca_cert = "./certs/test/cert-ext-ndir.der";
const char* ca_cert2 = "./certs/test/cert-ext-ndir-exc.der";
const char* server_cert = "./certs/server-cert.pem";
WOLFSSL_CERT_MANAGER* cm;
WOLFSSL_X509 *x509, *ca;
@ -1297,6 +1298,15 @@ static void test_wolfSSL_CertManagerNameConstraint2(void)
0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x49, 0x44
};
/* C=US ST=California*/
char altNameExc[] = {
0x30, 0x22,
0x31, 0x0B,
0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53,
0x31, 0x13,
0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0C, 0x0A,
0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61
};
/* load in CA private key for signing */
pt = ca_key_der_2048;
AssertNotNull(priv = wolfSSL_d2i_PrivateKey(EVP_PKEY_RSA, NULL, &pt,
@ -1337,7 +1347,6 @@ static void test_wolfSSL_CertManagerNameConstraint2(void)
wolfSSL_X509_add_altname_ex(x509, altNameFail, sizeof(altNameFail),
ASN_DIR_TYPE);
wolfSSL_X509_sign(x509, priv, EVP_sha256());
AssertNotNull((der = wolfSSL_X509_get_der(x509, &derSz)));
AssertIntEQ(wolfSSL_CertManagerVerifyBuffer(cm, der, derSz,
@ -1346,7 +1355,30 @@ static void test_wolfSSL_CertManagerNameConstraint2(void)
wolfSSL_X509_free(x509);
wolfSSL_X509_free(ca);
wolfSSL_X509_MAME_free(name);
/* now test with excluded name constraint */
AssertNotNull(cm = wolfSSL_CertManagerNew());
AssertNotNull(ca = wolfSSL_X509_load_certificate_file(ca_cert2,
WOLFSSL_FILETYPE_ASN1));
AssertNotNull((der = wolfSSL_X509_get_der(ca, &derSz)));
AssertIntEQ(wolfSSL_CertManagerLoadCABuffer(cm, der, derSz,
WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
AssertNotNull(x509 = wolfSSL_X509_load_certificate_file(server_cert,
WOLFSSL_FILETYPE_PEM));
wolfSSL_X509_add_altname_ex(x509, altNameExc, sizeof(altNameExc),
ASN_DIR_TYPE);
AssertNotNull(name = wolfSSL_X509_get_subject_name(ca));
AssertIntEQ(wolfSSL_X509_set_issuer_name(x509, name), WOLFSSL_SUCCESS);
wolfSSL_X509_sign(x509, priv, EVP_sha256());
AssertNotNull((der = wolfSSL_X509_get_der(x509, &derSz)));
AssertIntEQ(wolfSSL_CertManagerVerifyBuffer(cm, der, derSz,
WOLFSSL_FILETYPE_ASN1), ASN_NAME_INVALID_E);
wolfSSL_CertManagerFree(cm);
wolfSSL_X509_free(x509);
wolfSSL_X509_free(ca);
wolfSSL_EVP_PKEY_free(priv);
#endif
}

19
wolfcrypt/src/asn.c
View File

@ -7628,6 +7628,25 @@ static int ConfirmNameConstraints(Signer* signer, DecodedCert* cert)
base->nameSz) == 0) {
return 0;
}
#ifndef WOLFSSL_NO_ASN_STRICT
/* RFC 5280 section 4.2.1.10
"Restrictions of the form directoryName MUST be
applied to the subject field .... and to any names
of type directoryName in the subjectAltName
extension"
*/
if (cert->altDirNames != NULL) {
DNS_entry* cur = cert->altDirNames;
while (cur != NULL) {
if (XMEMCMP(cur->name, base->name, base->nameSz)
== 0) {
WOLFSSL_MSG("DIR alt name constraint err");
return 0;
}
cur = cur->next;
}
}
#endif /* !WOLFSSL_NO_ASN_STRICT */
break;
}
}; /* switch */