From 2363012f9fa5e9115ed4b8c569a9d686515abbe2 Mon Sep 17 00:00:00 2001 From: Evgeny Margolis Date: Fri, 28 Jul 2023 06:19:23 -1000 Subject: [PATCH] Implemented ExtractCDPExtensionCRLIssuerFromX509Cert() Helper Function (#28345) * Implemented ExtractCDPExtensionCRLIssuerFromX509Cert() Helper Function - Extracts the cRLIssuer Name from the CDP extension pf the X509 ASN.1 Encoded Certificate - Only a single cRLIssuer DirectoryName is supported - The result is copied into buffer in a raw ASN.1 X.509 format - The result should be directly comparable with teh result of ExtractSubjectFromX509Cert() - Added OpenSSL, mbedTLS, TinyCrypt, and other implementations - Added CRLIssuer support to the CDP extension in the chip-cert tool - Generated new test vectors * Restyled by clang-format --------- Co-authored-by: Restyled.io --- ...hip-Test-DAC-FFF1-8000-0000-2CDPs-Cert.der | Bin 596 -> 600 bytes ...hip-Test-DAC-FFF1-8000-0000-2CDPs-Cert.pem | 18 +- ...1-8000-0000-2CDPs-Issuer-PAA-FFF1-Cert.der | Bin 0 -> 667 bytes ...1-8000-0000-2CDPs-Issuer-PAA-FFF1-Cert.pem | 16 + ...F1-8000-0000-2CDPs-Issuer-PAA-FFF1-Key.der | Bin 0 -> 121 bytes ...F1-8000-0000-2CDPs-Issuer-PAA-FFF1-Key.pem | 5 + ...0-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.der | Bin 0 -> 719 bytes ...0-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.pem | 17 + ...00-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.der | Bin 0 -> 121 bytes ...00-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.pem | 5 + ...Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.der | Bin 121 -> 121 bytes ...Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.pem | 6 +- ...000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.der | Bin 0 -> 674 bytes ...000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.pem | 17 + ...8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.der | Bin 0 -> 121 bytes ...8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.pem | 5 + ...-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.der | Bin 0 -> 594 bytes ...-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.pem | 15 + ...p-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.der | Bin 0 -> 121 bytes ...p-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.pem | 5 + ...Test-DAC-FFF1-8000-0000-CDP-2URIs-Cert.der | Bin 590 -> 585 bytes ...Test-DAC-FFF1-8000-0000-CDP-2URIs-Cert.pem | 18 +- ...-Test-DAC-FFF1-8000-0000-CDP-2URIs-Key.der | Bin 121 -> 121 bytes ...-Test-DAC-FFF1-8000-0000-CDP-2URIs-Key.pem | 6 +- ...0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Cert.der | Bin 0 -> 718 bytes ...0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Cert.pem | 17 + ...-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Key.der | Bin 0 -> 121 bytes ...-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Key.pem | 5 + .../Chip-Test-DAC-FFF1-8000-0000-CDP-Cert.der | Bin 551 -> 552 bytes .../Chip-Test-DAC-FFF1-8000-0000-CDP-Cert.pem | 16 +- ...Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.der | Bin 553 -> 552 bytes ...Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.pem | 14 +- ...-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.der | Bin 121 -> 121 bytes ...-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.pem | 6 +- ...FF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.der | Bin 0 -> 616 bytes ...FF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.pem | 15 + ...FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Key.der | Bin 0 -> 121 bytes ...FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Key.pem | 5 + ...F1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.der | Bin 0 -> 594 bytes ...F1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.pem | 15 + ...FF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.der | Bin 0 -> 121 bytes ...FF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.pem | 5 + ...000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.der | Bin 0 -> 618 bytes ...000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.pem | 15 + ...8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.der | Bin 0 -> 121 bytes ...8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.pem | 5 + ...000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.der | Bin 0 -> 656 bytes ...000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.pem | 16 + ...0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.der | Bin 0 -> 121 bytes ...0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.pem | 5 + .../Chip-Test-DAC-FFF1-8000-0000-CDP-Key.der | Bin 121 -> 121 bytes .../Chip-Test-DAC-FFF1-8000-0000-CDP-Key.pem | 6 +- ...-Test-DAC-FFF1-8000-0000-CDP-Long-Cert.der | Bin 599 -> 599 bytes ...-Test-DAC-FFF1-8000-0000-CDP-Long-Cert.pem | 14 +- ...p-Test-DAC-FFF1-8000-0000-CDP-Long-Key.der | Bin 121 -> 121 bytes ...p-Test-DAC-FFF1-8000-0000-CDP-Long-Key.pem | 6 +- ...C-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.der | Bin 521 -> 555 bytes ...C-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.pem | 21 +- ...AC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.der | Bin 121 -> 121 bytes ...AC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.pem | 6 +- .../Chip-Test-DAC-FFF1-8000-000A-Key.der | Bin 121 -> 0 bytes .../test/gen-test-attestation-certs.sh | 89 +- .../tests/CHIPAttCert_test_vectors.cpp | 865 +++++++++++++++--- .../tests/CHIPAttCert_test_vectors.h | 45 + src/crypto/CHIPCryptoPAL.h | 10 + src/crypto/CHIPCryptoPALOpenSSL.cpp | 80 +- src/crypto/CHIPCryptoPALPSA.cpp | 123 ++- src/crypto/CHIPCryptoPALmbedTLS.cpp | 123 ++- src/crypto/tests/CHIPCryptoPALTest.cpp | 97 +- .../common/crypto/CHIPCryptoPALTinyCrypt.cpp | 123 ++- .../crypto/CHIPCryptoPALNXPUltrafastP256.cpp | 123 ++- .../silabs/SiWx917/CHIPCryptoPALTinyCrypt.cpp | 123 ++- .../silabs/efr32/CHIPCryptoPALPsaEfr32.cpp | 123 ++- src/tools/chip-cert/CertUtils.cpp | 14 +- src/tools/chip-cert/Cmd_GenAttCert.cpp | 183 +++- src/tools/chip-cert/chip-cert.h | 53 +- 76 files changed, 2198 insertions(+), 301 deletions(-) create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAA-FFF1-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAA-FFF1-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAA-FFF1-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAA-FFF1-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-CRL-Issuer-PAA-FFF1-2DPs-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.pem create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.der create mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.pem delete mode 100644 credentials/test/attestation/Chip-Test-DAC-FFF1-8000-000A-Key.der diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Cert.der index 880b441bd42cc6ca50f5790b0ad817706dc771c6..298ff89c7b2b448c565e0082144bfee5a74bf3b0 100644 GIT binary patch delta 268 zcmV+n0rURU1lR-@FoFV9FoFU4paTK{0s;t9(5z>&4BnNI7w1N-fFYr=6LpAEu`JY= z9@-Uf-kxn!w@Vr&e4!jxmv2b0^l=rs+9Gu>W*Ecp-WUk*Dqb$7<<6}T-P=K7NN(Q% delta 245 zcmVZ53pyG4NNFP`EybdS2>TiGLqb* zfxR$+x|2i!DHKKA{58rMC~>3i7P1wKXdC0{ij0$i0Z=I{1_MZBQPPLAD|tE z8)$TNa5^t9Wq4t2aBO8RV{dIQV{&XVll}o0Ln=4`y*mIMNx-Rb7`Sl#O9@nK24M%U v?UkDE3|j#!j{+e8;fYb`j-G}h210CH+H8z0j7^Jbm>79j+}zv@(L|YeSS$>HKtY_>$k4#d z$imRX$k@aykfymU-)H2E-(a_ky5Mq-SvP~|I&I(`?jGSEpiWNMIi%Wry z2yk>%z+xSKM?@M3v$2D{#>5EqBQqmAvl9bLr}4-0*Q$5FUfFeW{tQXUXu-l2_MXb$ zrf_}uq)@#q;(k{h#OGrXV-XQp-;IZq{y(DLHg5grO!Sh$}A5f0%m+Pd7*x<C&c5pk$LNh9`@3h?qEd!|_5T4ryPwfO8_ by6ue2BJ^t!P(>#sieD)JkHs&Ff$pr8A=$4u`!3TF!S*H zCYF?>7Ab_J7MCalIC>h27znX(X|pl1Fg7i!VPfQAadUGsL=$D=VX-g(0tIniBSQl- zBMUEw9FkIOi3}iukJ{B<+5#6GoH(w4P zn7;9)#F4A|uct@`-YYPW2T3cl07Jh)WWCdNPT$v8Mc?F|H{KyAsuXV&)M3!L6Qn|( zrE#M{<2r-T1@a4I+oUr}N(zdt^z~CK5_1c3QuUJabM=#pa`XyPa~BycF)+|G)G^Qk z>H|inGIAh;0@SxGGsOxVs=ft47ARo;j{IwOWzy>uyPbzhACQJ2mZ6-Xghu6W{5a Ho?Qe0A12or literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.pem new file mode 100644 index 00000000000000..2fa675509e0c06 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Cert.pem @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE----- +MIICyzCCAnGgAwIBAgIIbAFKueTP2kwwCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMG0x +PzA9BgNVBAMMNk1hdHRlciBUZXN0IERBQyAwMDAwIENEUCBJc3N1ZXIgUEFJIEZG +RjIgODAwNCBUd28gQ0RQczEUMBIGCisGAQQBgqJ8AgEMBEZGRjExFDASBgorBgEE +AYKifAICDAQ4MDAwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKslrxdoASyp +DelJX4WlTkznPxn5a3Aef7B/b6Jixb2uyAibJ65CCU+4b2EX/8/y2qX9pV3gEuKj +SucVzXGGK6OCAR4wggEaMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0G +A1UdDgQWBBQtclLs9MPAl7HpGMTVL+uUGVHecDAfBgNVHSMEGDAWgBSvQrcJTevV +FexuzzO4ERUiXzJSiDCBuQYDVR0fBIGxMIGuMFWgH6AdhhtodHRwczovL2V4YW1w +bGUuY29tL2NybC5wZW2iMqQwMC4xLDAqBgNVBAMMI01hdHRlciBUZXN0IFBBSSBN +dmlkOkZGRjIgTXBpZDo4MDA0MFWgH6AdhhtodHRwczovL2V4YW1wbGUuY29tL2Ny +bC5wZW2iMqQwMC4xLDAqBgNVBAMMI01hdHRlciBUZXN0IFBBSSBNdmlkOkZGRjIg +TXBpZDo4MDA0MAoGCCqGSM49BAMCA0gAMEUCIHrNu003uNEQbzYy5BaEjmTKustw +FMMxGLEhtknEGk5fAiEAkIOUuczHJpV7IQ71uxkQ/fTUlsqW0m6iHr6R7izLm3I= +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Issuer-PAI-FFF2-8004-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..0a87f1aac2ea43b45f309546a559a3781420a68d GIT binary patch literal 121 zcmV-<0EYiCcLD(c1RxYehn7Na69}R+XS~OUkfjVL_A(!uE^3;-qZ@0#&WfN41_&yK zNX|V20SBQ(13~}A^L}+32O9!T*tP`-w*fDur)N(5hs$^oB`hxw-o{M#06-Q boA{f%C=ak_lMPHLLiux25?48owlb335lu9W diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.pem index 39a7c256c79722..db0e8adfd47fac 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-2CDPs-Key.pem @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIJj6QtgPRpxFxnBqp0m+IYABttjI2ijEbkXYSlxoqN9+oAoGCCqGSM49 -AwEHoUQDQgAESq1e9CH6h6IJavSAXMe2yt8P99CwNTTTESeS2JwB3xO3FQHyxAVo -kpv4m7soD7Bnkw1MKEL5c1ISVzmPtjKS3A== +MHcCAQEEIDlWdRYuYEI4U1YxR0HpbMhxoA2xXiV2oVil2MILNzLioAoGCCqGSM49 +AwEHoUQDQgAErIAhobETdYhSsSzUlx7aFXDenm1Tt0saJXyhHFaXb0iw9HEVutoi +dS5mGMPw3hgI8CpeLqXlzq0Q3dtBo4HX8w== -----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.der new file mode 100644 index 0000000000000000000000000000000000000000..4118bf261aab7795ee799d15c048ca8641492ba4 GIT binary patch literal 674 zcmXqLVwz{r#N@JonTe5!iG#;(=ZRyF`=SiE*f_M>JkHs&Ff$pr8A=$4u`!3TF!S*H zCYF?>7Ab_J7MCalIC>h27znX(X|pl1Fg7i!VPfQAadUGsL=$D=VX-g(0tIniBSQl- zBMU8@ChxrQ4na|+c%z^WgT|R474j^N6Ac>s3>v!^$S;s> zlg=n9DJZtm*H5iT%q_@C)l1IL)lV+U(JM&JU6irJ$iM(+6gr|s7Buk4(Sw|5m^~N_ zT$vPN8Vufx?t1sfqS@;a=fbyB0#oi!zo$D*Uf|l#uTMA4p24KZFeQGLRp05(Q$A(O am>Dbh*>>*jQ<%r@Z1pWlku~w(a!vrpH^8O< literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.pem new file mode 100644 index 00000000000000..0b0ec0b21ba4bd --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Cert.pem @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE----- +MIICnjCCAkSgAwIBAgIIDD65yMbjjlowCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMGIx +NDAyBgNVBAMMK01hdHRlciBUZXN0IERBQyAwMDAwIENEUCAyIElzc3VlcnMgUEFB +IEZGRjExFDASBgorBgEEAYKifAIBDARGRkYxMRQwEgYKKwYBBAGConwCAgwEODAw +MDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHdENpq382J8M7KbpUCO6AbDdjGD +C+j2vO+k9Vm/ZhvgsV5ZK8myxnGahJ7qFFESbyl7pi9AbwNFMsYngor+ZrWjgf0w +gfowDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFGDqR8k9 ++Qj4XKPNUyASa2H1CgW9MB8GA1UdIwQYMBaAFK9CtwlN69UV7G7PM7gRFSJfMlKI +MIGZBgNVHR8EgZEwgY4wgYugH6AdhhtodHRwczovL2V4YW1wbGUuY29tL2NybC5w +ZW2iaKQyMDAxGDAWBgNVBAMMD01hdHRlciBUZXN0IFBBQTEUMBIGCisGAQQBgqJ8 +AgEMBEZGRjGkMjAwMRgwFgYDVQQDDA9NYXR0ZXIgVGVzdCBQQUExFDASBgorBgEE +AYKifAIBDARGRkYxMAoGCCqGSM49BAMCA0gAMEUCIFyAMO8Vuu78OINK4gmh7ZRR +ZN+X3i2WHxDW+fXlspuYAiEAlF+aOo7LicpMdqYDAXgPBrm9jiCeB0M69lohBWH+ +pwk= +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2CRLIssuers-PAA-FFF1-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..4804d20a9b02c996a6e589260b0627e1642a8610 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1R!=gZY>asb2d-VThM`<F&0^L@@6U4KkH F0RRQ)v1$MS literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.pem new file mode 100644 index 00000000000000..5a900044e8eb34 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Cert.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICTjCCAfSgAwIBAgIIHF6aHFFi4O8wCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMF0x +LzAtBgNVBAMMJk1hdHRlciBUZXN0IERBQyAwMDAwIFR3byBDRFAgKFR3byBEUHMp +MRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQBgqJ8AgIMBDgwMDAwWTAT +BgcqhkjOPQIBBggqhkjOPQMBBwNCAASb9ykSyJRWBjmlO0LzR0CmtUjsLsrdWAOu +uHNvMsCbNvmsFiTplPL5JEMSA2svQywlpLnTCrVJdZuJORjf2zygo4GyMIGvMAwG +A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBSMKnIYf3kO1sth +4tJPGfpXzzCXYDAfBgNVHSMEGDAWgBSvQrcJTevVFexuzzO4ERUiXzJSiDBPBgNV +HR8ESDBGMCGgH6AdhhtodHRwczovL2V4YW1wbGUuY29tL2NybC5wZW0wIaAfoB2G +G2h0dHBzOi8vZXhhbXBsZS5jb20vY3JsLnBlbTAKBggqhkjOPQQDAgNIADBFAiEA +5tWf3JRbqaBa0Iu3U13jFO1alfhfqQpU7uTfa0gZns0CIDUdAZUHKdNtQG3tf/cW +VNJ5r5PNSIMDs8+OQ7FF+JXI +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..7ec21313ce8a161104bbd795bb139391fb85b8b8 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1Ry&wt4(y5acV)a@#X^uHCB9RLpq;o$}L=NzD~$|OgEqk1_&yK zNX|V20SBQ(13~}6G&M bBtsGdYcE4AC8W923bjdfn~6CX-`hN(mew#e literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.pem new file mode 100644 index 00000000000000..ec6200464d4953 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2DPs-Key.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIDswq010l3FqQbHx5gMHNVZ8aEM6n2rKLVxtvk7IfEw3oAoGCCqGSM49 +AwEHoUQDQgAEm/cpEsiUVgY5pTtC80dAprVI7C7K3VgDrrhzbzLAmzb5rBYk6ZTy ++SRDEgNrL0MsJaS50wq1SXWbiTkY39s8oA== +-----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2URIs-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-2URIs-Cert.der index 3e725cc85cd818fade063a80fae48781c44d7d53..d33c10b313a0652d0d22cc791c4a623cc402274c 100644 GIT binary patch delta 257 zcmV+c0sj8Z1jz&!FoFU_FoFT=paTK{0s;tm-04mEBOk_*7wtyHmz6HFEMSWc@nchQ zow}@2gX|iPipoHYlJKHdMql8!Hpk*?z(DX=!k`p4cw683Qrm6!ebtATmso`;@wX+T zfvhlrsgp_pDHJ{!gB6@AbId3t7VU$O67h##W(Sjp0U{Sk1_M;UvSNHf*p`;PV~oN+dSGosOVVH;pheH H&lTyouitKy delta 263 zcmV+i0r>vO1kMB(FoFU~FoFT_paTK{0s;tMJQSsNnpG{47wtycMnZPVidzq#NXw=N z|Lv0Ys1p=tVfcHw0Pk!=Yv=*yr^U$WVhPI;1ZwZEjw=J1wkh=>146WnG9Ox7|IB>kWY1_&yK zNX|V20SBQ(13~}<#g~;Xvn*hX4)J4CahHP(YrsJ8 bSi+zbH+Wm$`BK|$_kGoemzP+DDDk%?e@`|g literal 121 zcmV-<0EYiCcLD(c1R%Y|%srch4HOG*9qRScx65PvarRDZsG9RMxtK$KZO5Pr1_&yK zNX|V20SBQ(13~}<+D1Zl%8FYLpGeE52mkGo_NWsSXJPnzxd88MLu=>(=BLHT>0$}X b5d>=QuZ}ANnYJnQAOk|Qj5Kj-G}h210CH+H8z0j7^Jbm>79j+}zv@(L|YeSS$>HKtY_>$k4#d z$imRX$k@aykfymU-)H2E-)6m+$5@M4PvP~|I&I(`?oLvGGJd2A)FQ~5%qrSwzWpi%;H}s86Z1<^L|00z@wGZVy{K|&+71t$+r}&_@VtW zd~p+_l0g%roBXafKs-U$dZP+$-GAV>VX!H9a g)_Zbez}M&tZ#Qx+5}y{9=buoyb*C)H%l5fkT)lY;?UN=X1PMgk!KgQEI~upz3w{=x{a=8gU5 zD>@4}FxX_yPA)Y;x zKmjilXhX;|qdA|LLKQx-tj{l%SYH}YlY;?UNk{-NMFJpYN=y?w$=Xd6cr~m1B-JeJ zqo9wX^yccqu3$kQHua;rm0C1SlY{|WNJjuLL;@fx$7)vBq`7`}ER|4*LE_a^ zRT>75$T9}lvVY~SRd!wiARxP?Nyp8dzGMsNENG+rHn6bm^UUW)u=RrIw;IX1GmK$eiWWws(1yH zK>;rmqXIMdZ$Qx+#b1D>z^N)wZ|a{hlY{|WNk{-NMFJpG?CRP)T}!u6%jfvf30V@< z$mRPV?=U1E&y|BIK+u{3Apo^kUc9FpgnoC`)zLu)yNACwosy)T>WvVf;fqKRE+5(D BR(b#c diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.pem index 1cc3bfe2334852..039ba4be4caec0 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Cert.pem @@ -1,14 +1,14 @@ -----BEGIN CERTIFICATE----- -MIICJTCCAcugAwIBAgIINKhBW30/Kx4wCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +MIICJDCCAcugAwIBAgIIF/5ta+m+0hMwCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMFcx KTAnBgNVBAMMIE1hdHRlciBUZXN0IERBQyAwMDAwIENEUCAoSFRUUFMpMRQwEgYK KwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQBgqJ8AgIMBDgwMDAwWTATBgcqhkjO -PQIBBggqhkjOPQMBBwNCAATZKyTeUWuOzT5oYt6H/Dv3fnARcccLWYz/XwJ/Argg -5/oHutTk2L4mHAj7MZXVqDSCOijMRwO3xRV+FJ5eqngFo4GPMIGMMAwGA1UdEwEB -/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBSjAjP4b0DRGsVfgKXAqSpQ -b+qfMTAfBgNVHSMEGDAWgBSvQrcJTevVFexuzzO4ERUiXzJSiDAsBgNVHR8EJTAj +PQIBBggqhkjOPQMBBwNCAATquEbdfR+IT+cXiiJBp99dMfS5G8a7egh0CbmZNSrP +A67ITJJb9sIBIu7oTX6BErvOwjHjtCIanWEY3HlLbr2Ho4GPMIGMMAwGA1UdEwEB +/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBTjvqcpltz3a7mw8R0ZK7oX +6Vwy+DAfBgNVHSMEGDAWgBSvQrcJTevVFexuzzO4ERUiXzJSiDAsBgNVHR8EJTAj MCGgH6AdhhtodHRwczovL2V4YW1wbGUuY29tL2NybC5wZW0wCgYIKoZIzj0EAwID -SAAwRQIgU+zq2jxdS7dQy+f40QlZEtTI5fsf7zAkH8+VgylA0JoCIQC1V168pxuE -fnfV1dFBBruHvzedkqSd6o0QoOGLSBAuHw== +RwAwRAIgKsdqVtekuX52LJVQiEHi1VRVGgaPyDIG2LJ/5a5Vdl4CICC7pUnHzZ2+ +ZAvoLGij/DawsO31X3D9sXyyRYEAg9Z1 -----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.der index 1c41899873d8c2a1116df4bcc95e42d297aeaa22..7dfce53143d887feb3b4a7af2f620c2086ddf255 100644 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1R!@tC(=04+B*2u<&CB_X?bnE`HB4M)`14%?HbOSTeIJNV=NF11L8sqcG4#0`#=Ck5bP2hcH7d^ouEp> literal 121 zcmV-<0EYiCcLD(c1Rw;Y6$6Gj(N1ELZ$=toRo9~n3*4+~n9cZ$7H}$ZpF5xm1_&yK zNX|V20SBQ(13~}<*()U8QEQIPK4@azhx|MDesB?S#|v4E|6c-s0=OXO`Ukqya{mDQ*;f;uS7M+3LT6@C<+UaEKnvjQ;2 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.pem index ccd6216112c5e8..06aa1bcc785316 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-HTTPS-Key.pem @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIASkFQOGOdFOYpJvRhpiVdejCwvcrGqYzfiLFnAqcp87oAoGCCqGSM49 -AwEHoUQDQgAE2Ssk3lFrjs0+aGLeh/w7935wEXHHC1mM/18CfwK4IOf6B7rU5Ni+ -JhwI+zGV1ag0gjoozEcDt8UVfhSeXqp4BQ== +MHcCAQEEIHdGJ9I40do6+NTljaY1aXltvfmJ/OrWgQbi7R7KPCj3oAoGCCqGSM49 +AwEHoUQDQgAE6rhG3X0fiE/nF4oiQaffXTH0uRvGu3oIdAm5mTUqzwOuyEySW/bC +ASLu6E1+gRK7zsIx47QiGp1hGNx5S269hw== -----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-FFF1-Cert.der new file mode 100644 index 0000000000000000000000000000000000000000..86107412c50400d26fda3e2ae5c9d9452cdd2dcd GIT binary patch literal 616 zcmXqLVoEV+V&YuD%*4pV#39afM8J3Jl=B8$Y#dr`9_MUXn3)XR3?&T2*qB3En0fep z6H7``ixfgqi%S#&96b$1420OYwAmP07@HQ=FfsD5xVgC*qKPu`uvi!Xfr2=%k)eT^ zk%gg&k+F$!lmx#e5EvR61Cgnvsb!QwyrH3iKEx&sWSd+ZofW_)IJ*QWcor9z0-X@x z=%|3jGW<@6G!SNE2YZZ(5$Z!`Ms{W=1{Sl+YInDOc>HYFS!?6pp{(zBo?3k1{oFv= zzDh;C%p=Q_cNknN46v*^yU6d@zo2uyr4`%yOS^BXX)ki&e*7cOeZ}I&qXvzK40wR9 zmlbAY{LjKXp6v(qg8$=p}FOXj#+a{e+Qc_TC zrLUh_k(gVMld6}TpR1o-l%rRWn!CtkiIIT;&bV_#izR5lA;&zkCxd|-lOn^b3r)=q z>QBTc>+#-Ed&(pB^RHUNv^mDV9M1eWqV)0jcc7Bx92?@Eb*tUVO>s%w<1~L!e3UL7m5Bu9X7Z2q?U=PFfMz&dl&sh>E1&Yz$P1_&yK zNX|V20SBQ(13~}gnP&s1%%#7^JP7Ewr+Ha4GZB0(8OS?VGPWP~ zjR6nP`Le={jQ?4f3>XafKs&*E| RHx4}DOOu?-!KM)8000sTuPgun literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.pem new file mode 100644 index 00000000000000..03a69bccb767b6 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Cert.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICTjCCAfSgAwIBAgIISpgV1Lndz3MwCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMGAx +MjAwBgNVBAMMKU1hdHRlciBUZXN0IERBQyAwMDAwIENEUCBJc3N1ZXIgUEFBIE5v +VklEMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQBgqJ8AgIMBDgwMDAw +WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqK+3HFrVjZH5m25o+Lc1F8L9YTYWn +0t/4/7F0tdVefxxUlL59e8TinBGAmiA3YVVuORV1Hh0gGquWfjzsvPsho4GvMIGs +MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBQgqFG1WVqL +MShpA6Y/yTYAFznAPjAfBgNVHSMEGDAWgBSvQrcJTevVFexuzzO4ERUiXzJSiDBM +BgNVHR8ERTBDMEGgH6AdhhtodHRwczovL2V4YW1wbGUuY29tL2NybC5wZW2iHqQc +MBoxGDAWBgNVBAMMD01hdHRlciBUZXN0IFBBQTAKBggqhkjOPQQDAgNIADBFAiEA +g9PU5fUk6hZsFEXtQgil4yb4/9238aG4z7nyOAbC5R8CIH9YZoySudmq+rGTtzCC +4jmFmZ8i2MDgDmYZnQgGIFJA +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..e52705cea55248b1edf60d1d5c56607b4feb931a GIT binary patch literal 121 zcmV-<0EYiCcLD(c1RzG)pB;^5piOVDo9BBnY7PVt!erDU6J}u2f@V{71g{RWr`2VqVwbfpK98{FPeS5^> boDqPUAU9!EZaEco9vvVWtCoH|?7aISxui5N literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.pem new file mode 100644 index 00000000000000..361e6d28861455 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAA-NoVID-Key.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIEbZnx2NZaBNb6+b53sybHtOZR+F0JsAvwIDixLl9viJoAoGCCqGSM49 +AwEHoUQDQgAEaivtxxa1Y2R+ZtuaPi3NRfC/WE2Fp9Lf+P+xdLXVXn8cVJS+fXvE +4pwRgJogN2FVbjkVdR4dIBqrln487Lz7IQ== +-----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.der new file mode 100644 index 0000000000000000000000000000000000000000..5bc8d661076a02073293a0889bb769705e679d78 GIT binary patch literal 618 zcmXqLVoEb;V&YlA%*4pV#1a4X7|Wgo#fb)7Y#dr`9_MUXn3)XR3?&T2*qB3En0fep z6H7``ixfgqi%S#&96b$1420OYwAmP07@HQ=FfsD5xVgC*qKPu`uvi!Xfr2=%k)eT^ zk%gg&k+F$!lmx#e5EvR61Cgnvsb!QwilLc-3B)E{WSd+ZofW_)IJ*QWcor9z0-XS~ zT>)sBkpj?c6Eqv~yCc#-n2jCmJ0?b`H<=mPnVlF|(z<^LsOX;c>gPG!TjZ;RS#ykA1y&kx%d>prmC3wlSm8`5E!w&^z{`23yxbd(- z;{gL6pciC?85#exFc~ly@PT;zARaI<*&7UGL3}#L$~^3EIY5ENC4Hwx-7NB}92XNfcjHwaxIzd*K4 zI-{hdpx8=ZKeZw;w;(4~FF8L~Ke;GJuOKydk11+E~U<4{72P-HDeakXa ztia*uTL5H%0uwp%nLQW`T$vO&dM?lAes5sF9{2A22Aj3Z-W+%9ejYx%G<)r%dYuEd qicE?OEzfMv9M<0FTTrf@_5aO5Em@OGhaY;L+qknsRcw!m^mzcPCb!N2 literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.pem new file mode 100644 index 00000000000000..983259f524e460 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Cert.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICZjCCAgygAwIBAgIIX/XGBLygc2EwCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMGQx +NjA0BgNVBAMMLU1hdHRlciBUZXN0IERBQyAwMDAwIENEUCBJc3N1ZXIgUEFJIEZG +RjIgODAwNDEUMBIGCisGAQQBgqJ8AgEMBEZGRjExFDASBgorBgEEAYKifAICDAQ4 +MDAwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZov4ECQtzUqPDMONcUCCtZ9E +++knHOZqXRv043j2gbwZ9Kt6y4ozuE47SuBEqeNeqgRTpJapBQXxV8JSaf5Pt6OB +wzCBwDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4EFgQUzoDA +AjObxgDU+Urwle5k8ClCMuIwHwYDVR0jBBgwFoAUr0K3CU3r1RXsbs8zuBEVIl8y +UogwYAYDVR0fBFkwVzBVoB+gHYYbaHR0cHM6Ly9leGFtcGxlLmNvbS9jcmwucGVt +ojKkMDAuMSwwKgYDVQQDDCNNYXR0ZXIgVGVzdCBQQUkgTXZpZDpGRkYyIE1waWQ6 +ODAwNDAKBggqhkjOPQQDAgNIADBFAiAIjNObC+8wMAde7s+wPK2m7MdGi+dXm3Vr +reJ/LMA9IQIhAITmPczDK75NcHcrav/swSodNNLD4UnOsbmIJRa8NBvP +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..a67c3deb440a4e0bc54064d11de4a51aec9f68b9 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1R(x&&?317*f@S~zakQv-rCyd$#@LAQ4|*4TIq&1q0FEP1_&yK zNX|V20SBQ(13~}JkHs&Ff$pr8A=$4u`!3TF!S*H zCYF?>7Ab_J7MCalIC>h27znX(X|pl1Fg7i!VPfQAadUGsL=$D=VX-g(0tIniBSQl- zBMUbjMs?eNFGNX=CPIBaSFjjk}AR7=;X)82Jo%fNql&W@P-&!eqc;zz5>-gLuGD zVs9{z1@ZY<#8^aRKL!(&E<`(3n>Lusr z>X&3>7V830VxBHkST{dSH@PTBHzl*Uq$o3~v?Mb>Pq!dHGp_`wq9ir17{o8n$V|=v z=`%Di)J@JvEGpIq>d`Am&0S=)#K1t$P{%+E=mcOqE2G7;f^S)7iWM+!jTC$ffGl8q znjohUW_Jby7bXQ^jnBWV7H7Qn?=9Bf&98BuclD8%E`AI)EiJ7(3##}2XHtmenQ@g- hBzBS2tNb^&Hh;M^XTM#+mf&W$J?9#wRZ5;%005C!#l`>t literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.pem new file mode 100644 index 00000000000000..3e232f154bdfe4 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Cert.pem @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICjDCCAjOgAwIBAgIIerMwp8ofkZUwCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMDsx +DTALBgNVBAMMBExvbmcxFDASBgorBgEEAYKifAIBDARGRkYxMRQwEgYKKwYBBAGC +onwCAgwEODAwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABH3QCDBDf/vXBwk4 +STGEtLxWRk99gQDN7zP4kpk5vryNUzaV1x9MDam/HI6Ef91wi1zTq9Yu4zWBab0y +CFo1KN2jggESMIIBDjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDAdBgNV +HQ4EFgQUHfNSWZ1B4LBsEwIG/8FXpzLM96QwHwYDVR0jBBgwFoAUr0K3CU3r1RXs +bs8zuBEVIl8yUogwga0GA1UdHwSBpTCBojCBn6BpoGeGZWh0dHBzOi8vZXhhbXBs +ZS5jb20vdGhpcy1pcy1hbi1leGFtcGxlLW9mLWNybC1kaXN0cmlidXRpb24tcG9p +bnQtZXh0ZW5zaW9uLXdoaWNoLWlzLTEwMS1jaGFycy9jcmwucGVtojKkMDAuMSww +KgYDVQQDDCNNYXR0ZXIgVGVzdCBQQUkgTXZpZDpGRkYyIE1waWQ6ODAwNDAKBggq +hkjOPQQDAgNHADBEAiATKPP6OqNo60+Ncy+7DyjPDavE6UROADyEhIW5cHu9/wIg +XQyY1QEUXaI66m/s2rP00py/PnC0U4NGvM6BGyR05Dg= +-----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.der new file mode 100644 index 0000000000000000000000000000000000000000..d0d68ddb316e08aafcc19f5204c6aa262236dc60 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1R#WA8N|5!Sp->_Tp31cuuBe`|FV*O`Oa_aM}lh|&N!e71_&yK zNX|V20SBQ(13~}KfdI|#Gx(C3IljD&Q#O^?A50CY bzZ{N)f8B74T+^%8F5@+UX}vNCS~V!$OpY>G literal 0 HcmV?d00001 diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.pem new file mode 100644 index 00000000000000..6c4c6ed8fa1805 --- /dev/null +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Issuer-PAI-FFF2-8004-Long-Key.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIIRhGcS4/FkEWZhcGUZqsEsOm/+ykn35zm/rR4JrHc44oAoGCCqGSM49 +AwEHoUQDQgAEfdAIMEN/+9cHCThJMYS0vFZGT32BAM3vM/iSmTm+vI1TNpXXH0wN +qb8cjoR/3XCLXNOr1i7jNYFpvTIIWjUo3Q== +-----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.der index 7d63f00c9bcfa480b6624c9304cdffeee1be57f2..1a2b0e85953ccc03e4f7aa5f096e367ea1e9d080 100644 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1Ry2&z*5wXYKQJk&UM=JW7c5#0XA68FjYPwxLcySz5}2N1_&yK zNX|V20SBQ(13~}0U+1_&yK zNX|V20SBQ(13~}<;{hJtpHW(~>AI68{_;DP&2d~h>Nw7U9*F#H=d3U$Bm1WYi#`d{ b{#2V0%wG;!Y);$GK6|1kAGpw(^dX)-&PX)- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.pem index 48fe09ad29812d..2a870d125cd900 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Key.pem @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIAZZ8hZ3GOkPEiO670Qo8bDOxHK1X7sH6ofXOYmc9zFqoAoGCCqGSM49 -AwEHoUQDQgAE4wEe3p9RWrPpupMl/vI7ls1xXDrqOM6BHoj8beesMCYj+6cGiz4J -0/5UmxHMXw5ZbE7bzj57oicfuNCa9CGePQ== +MHcCAQEEICX4wFLUjmqH7k3OddrzY9Zg+QE2WM0wVT4huFuiur4DoAoGCCqGSM49 +AwEHoUQDQgAEQa52t3zeq4BcRXfSV7aeqeYkTyixwXmP0D3sVNwOhKULkp7dKb4x +04ZxJe8VZp69kxHvZlx0IThoxK2crgRUyQ== -----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Cert.der index 1ece300335a5fe455a5ab9cc6c3805be3d67b412..66fd52a1409ef8c720a4205b02a822ffc4340147 100644 GIT binary patch delta 194 zcmV;z06qWL1lI%?FoFV8FoFU3paTK{0s;svjVwj3Xj4Uz7tTO$y)hH>Z*?R43q?1(~rNGve`aZb`@iLlJyPaL-mrVMo#qh<%FpRDm#^HC9 zB>^uKs5Hy${clG@2IYN_eoXYOKYjd9lV|~}L?Hn1Rbe{I5zBVpbi?6tu4BufFSBeO w1uGaN>Vsy+6cyS6AOR(>KXh+mk0$GF{>e!G`Zd+k=>%i(^NQB*klVKAgHDxPEdT%j delta 194 zcmV;z06qWL1lI%?FoFV8FoFU3paTK{0s;sfZf#IOh5!eV7tTOKDEqi^LX0)yB(r~> zfMf$-vdnV$@o^YaM#CWCsD-uU2?<{8g^uK_Dp;6sJ7s`5RSd;PvQ1=e90^+lV|~}L?A;$VsuqSxDe|zJy|V3MuI$3^er{s&2zxSXD1_&yK zNX|V20SBQ(13~}R2t*(QqeneSr*i)y-+5qtsZiDX6v8|1_&yK zNX|V20SBQ(13~}bx&~J8eY=<^}8HmoI8P?bIB`e1-3>-Cd diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Key.pem index d868b79ee31833..c39f44e59c369a 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Key.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Long-Key.pem @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEINFUmafW3jhThp3mpGxLUtE7c1kW1Kq9UCaqrR5yeWbroAoGCCqGSM49 -AwEHoUQDQgAEQyj7uHFCjDXiJLN/noBkA1+yzHL48XEYU0bDIOGohbXkCQle7IVf -fVKvl6HQb3ZxbIc2fhmIzqEZ1tf0JSvHLw== +MHcCAQEEIKEE7TjXp337hySJtfM1UeZefmg2BDNOe26ap+SLlL/3oAoGCCqGSM49 +AwEHoUQDQgAEb70xE/FOALVUGuUmOkfhaxl3dekSFKQg9Nl67Wukk1UcpcDWlfo+ +uQjxMppUu51d5ZdM+qjF8MXEMIyuGsbhdw== -----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.der index 2ad2f7c7190a4dec4d7f1a22d134ac6d24ce157d..2315cfa58c79bfe7653be7bbba0b5096ae3fb312 100644 GIT binary patch delta 256 zcmV+b0ssDq1giuWFoFUnFoFThpaTK{0s;tc*Z&LEq?kXE7k4pSF)lDH1_M%gFfcG6Lqt#@S8{J|XCP2=WoBu3kv}bw%Nju5%o5<-JsUZo z|Hfv8{Te;m^w4zRvuabQy(}EF?fv+BaXiG1av61rxpCiLSsuvEPQG*cPv3B&2T8(& zlG#6#B>^uKSV2DI?X53Frp*Scz-*&PUgp8^lV|~0N=X1PMgk!KwJ()ZMx6mTo36SK zg{>*9iJp%X8XYZc_tXDZTm`u+0wDm`)!JT*>ox>iH4^wXJ+q*!j2#qwExSLJSjqK^ G<$!^zjcUvQ delta 219 zcmV<103`pb1c?L}FoFUFFoFTApaTK{0s;td1_-L5*R5@l7k3alF%2*a1_M;`SQ6H_#;e* z;-fqD=UH~(PHNCSg$vPSIrGnxMgcDr2QVD(i=IR#(&TQ&`a09ML>=$FlZgRXNk{-N zMFJrJ=D3I+?GC1Jg1}&YM)t~t1Tm}Nk=7SofebjI diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.pem index c53dbb8fbd6498..8cecc4118bc767 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Cert.pem @@ -1,13 +1,14 @@ -----BEGIN CERTIFICATE----- -MIICBTCCAaugAwIBAgIIcAYIqqHXrW0wCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP +MIICJzCCAcygAwIBAgIIb9f/C9WkmD8wCgYIKoZIzj0EAwIwRjEYMBYGA1UEAwwP TWF0dGVyIFRlc3QgUEFJMRQwEgYKKwYBBAGConwCAQwERkZGMTEUMBIGCisGAQQB -gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMDsx -DTALBgNVBAMMBExvbmcxFDASBgorBgEEAYKifAIBDARGRkYxMRQwEgYKKwYBBAGC -onwCAgwEODAwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPzNyCm6Yjd8xsez -bqfBr3bNFcMovEtujQd4ull/u/MK5xK2V9L58rkV+CNMh+KjO/XnWXbgTmrQPYUL -0WQ588+jgYswgYgwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0O -BBYEFAcwHO+LnkQm0uRuxvo607dEHe+9MB8GA1UdIwQYMBaAFK9CtwlN69UV7G7P -M7gRFSJfMlKIMCgGA1UdHwQhMB8wHaAboBmGF3d3dy5leGFtcGxlLmNvbS9jcmwu -cGVtMAoGCCqGSM49BAMCA0gAMEUCIQDmuIge7Q6mcILAYH5G9sqEBDGr4JHWF12B -DDih5PBFdwIgOQZfvvn9pBs3r8ux9t8JDhpEO6xuZSw72sED9NOsTnY= +gqJ8AgIMBDgwMDAwIBcNMjEwNjI4MTQyMzQzWhgPOTk5OTEyMzEyMzU5NTlaMFwx +LjAsBgNVBAMMJU1hdHRlciBUZXN0IERBQyAwMDAwIENEUCBXcm9uZyBQcmVmaXgx +FDASBgorBgEEAYKifAIBDARGRkYxMRQwEgYKKwYBBAGConwCAgwEODAwMDBZMBMG +ByqGSM49AgEGCCqGSM49AwEHA0IABN7MEuDcPRs5oP/GZoX9Gj3a9NB04LNqU6i9 +LByz7f34e3E8xI5yGXWJuXHfX1keyM1OvnP6T99wogdJwoSS2T+jgYswgYgwDAYD +VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFFhBPuTtrS9Eps0G +q8Bso0he5sHxMB8GA1UdIwQYMBaAFK9CtwlN69UV7G7PM7gRFSJfMlKIMCgGA1Ud +HwQhMB8wHaAboBmGF3d3dy5leGFtcGxlLmNvbS9jcmwucGVtMAoGCCqGSM49BAMC +A0kAMEYCIQC1L5VTRp0BOJuuug+FrSmsiZ6PFBodLWz30/9XXAW5KwIhANfV2l6L +6zYEWzUS+DY9s6CsjB0UfC27P5VYyfWL5YCB -----END CERTIFICATE----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.der index ab268e2e51f69e06e65019182f0e583d09a0dfcf..938339c0443c9ec9b26958de64a74b3554f4e7b7 100644 GIT binary patch literal 121 zcmV-<0EYiCcLD(c1R%@HXVQDS&c1XP!{x5N5VOV-08R*n?ml2W;@r2M&dQ()1_&yK zNX|V20SBQ(13~}<-pmr<+&vpPp#R2Zh5Z^m+Vs$L;InE|sJ$#4v+e!(dvQF(j&d1w biMes#Us)c=%}%~^`cL0*q6bOBgp%1mEPgtl literal 121 zcmV-<0EYiCcLD(c1R$jy&HUL_+lM4IY=;sWki8QaQ+TJTjB)gEM53nK>)W6T1_&yK zNX|V20SBQ(13~}<{LRQIx?(qc#>ca6r@^mw%@xBayi0D42Y9+!f4lPv=MuJ8()sea b75F1ehvK6<_2*f3;7)4LJ%tO=WI6NCdHOjc diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.pem b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.pem index f9c33a94072281..930bf855c472d0 100644 --- a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.pem +++ b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-0000-CDP-Wrong-Prefix-Key.pem @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIKUdzfzZVduHJDVshxIakL0TGFN4p6mMcfRwRKKm2+vboAoGCCqGSM49 -AwEHoUQDQgAE/M3IKbpiN3zGx7Nup8Gvds0Vwyi8S26NB3i6WX+78wrnErZX0vny -uRX4I0yH4qM79edZduBOatA9hQvRZDnzzw== +MHcCAQEEIMvLZ9J7u86+dBfD5a6+ELPGEgBOCIXuPmA94ty3ns7KoAoGCCqGSM49 +AwEHoUQDQgAE3swS4Nw9Gzmg/8Zmhf0aPdr00HTgs2pTqL0sHLPt/fh7cTzEjnIZ +dYm5cd9fWR7IzU6+c/pP33CiB0nChJLZPw== -----END EC PRIVATE KEY----- diff --git a/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-000A-Key.der b/credentials/test/attestation/Chip-Test-DAC-FFF1-8000-000A-Key.der deleted file mode 100644 index 287b7d0e23a2ce7848613466f5b8ad5db823dce3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 121 zcmV-<0EYiCcLD(c1Rw>*!>CQh1BWS*c31_&yK zNX|V20SBQ(13~}#c$6F-3Qb^#M7kCE|O bp!fKBG6_%SpSLJzs2(Pln>LFxwNx(certificate.size())); VerifyOrExit(x509certificate != nullptr, err = CHIP_ERROR_NO_MEMORY); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1) @@ -2052,6 +2052,79 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return err; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ + CHIP_ERROR err = CHIP_NO_ERROR; + int result = 1; + X509 * x509certificate = nullptr; + const unsigned char * pCertificate = certificate.data(); + const unsigned char ** ppCertificate = &pCertificate; + STACK_OF(DIST_POINT) * crldp = nullptr; + DIST_POINT * dp = nullptr; + GENERAL_NAMES * gens = nullptr; + GENERAL_NAME * gen = nullptr; + X509_NAME * dirName = nullptr; + const uint8_t * pDirName = nullptr; + size_t dirNameLen = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + x509certificate = d2i_X509(nullptr, ppCertificate, static_cast(certificate.size())); + VerifyOrExit(x509certificate != nullptr, err = CHIP_ERROR_NO_MEMORY); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1) + crldp = + reinterpret_cast(X509_get_ext_d2i(x509certificate, NID_crl_distribution_points, nullptr, nullptr)); + VerifyOrExit(crldp != nullptr, err = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(sk_DIST_POINT_num(crldp) == 1, err = CHIP_ERROR_NOT_FOUND); + + dp = sk_DIST_POINT_value(crldp, 0); + VerifyOrExit(dp != nullptr, err = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + // + // the cRLIssuer is encoded as a GeneralNames, where: + // GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName + // This implementation only supports a single GeneralName element in the cRLIssuer sequence: + gens = dp->CRLissuer; + VerifyOrExit(sk_GENERAL_NAME_num(gens) == 1, err = CHIP_ERROR_NOT_FOUND); + + // In this implementation the cRLIssuer is expected to be encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + gen = sk_GENERAL_NAME_value(gens, 0); + VerifyOrExit(gen->type == GEN_DIRNAME, err = CHIP_ERROR_NOT_FOUND); + + dirName = reinterpret_cast(GENERAL_NAME_get0_value(gen, nullptr)); + VerifyOrExit(dirName != nullptr, err = CHIP_ERROR_NOT_FOUND); + + // Extract directoryName as a raw DER Encoded data + result = X509_NAME_get0_der(dirName, &pDirName, &dirNameLen); + VerifyOrExit(result == 1, err = CHIP_ERROR_INTERNAL); + err = CopySpanToMutableSpan(ByteSpan(pDirName, dirNameLen), crlIssuer); + +exit: + sk_DIST_POINT_pop_free(crldp, DIST_POINT_free); + X509_free(x509certificate); + + return err; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { CHIP_ERROR err = CHIP_NO_ERROR; @@ -2112,10 +2185,7 @@ CHIP_ERROR ExtractRawDNFromX509Cert(bool extractSubject, const ByteSpan & certif result = X509_NAME_get0_der(distinguishedName, &pDistinguishedName, &distinguishedNameLen); VerifyOrExit(result == 1, err = CHIP_ERROR_INTERNAL); - VerifyOrExit(distinguishedNameLen <= dn.size(), err = CHIP_ERROR_BUFFER_TOO_SMALL); - - memcpy(dn.data(), pDistinguishedName, distinguishedNameLen); - dn.reduce_size(distinguishedNameLen); + err = CopySpanToMutableSpan(ByteSpan(pDistinguishedName, distinguishedNameLen), dn); exit: X509_free(x509certificate); diff --git a/src/crypto/CHIPCryptoPALPSA.cpp b/src/crypto/CHIPCryptoPALPSA.cpp index d1afbf1dbb05e3..5f21030eb69a72 100644 --- a/src/crypto/CHIPCryptoPALPSA.cpp +++ b/src/crypto/CHIPCryptoPALPSA.cpp @@ -1734,7 +1734,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -1765,6 +1765,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -1780,6 +1782,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -1807,6 +1812,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + logMbedTLSError(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/crypto/CHIPCryptoPALmbedTLS.cpp b/src/crypto/CHIPCryptoPALmbedTLS.cpp index 195bd56cf745a2..c903d984f57e08 100644 --- a/src/crypto/CHIPCryptoPALmbedTLS.cpp +++ b/src/crypto/CHIPCryptoPALmbedTLS.cpp @@ -1826,7 +1826,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -1857,6 +1857,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -1872,6 +1874,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -1899,6 +1904,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + _log_mbedTLS_error(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/crypto/tests/CHIPCryptoPALTest.cpp b/src/crypto/tests/CHIPCryptoPALTest.cpp index 9eb01b6723dabb..bcf858d8b53e10 100644 --- a/src/crypto/tests/CHIPCryptoPALTest.cpp +++ b/src/crypto/tests/CHIPCryptoPALTest.cpp @@ -2122,21 +2122,32 @@ static void TestCDPExtension_x509Extraction(nlTestSuite * inSuite, void * inCont constexpr const char * exampleHttpURI = "http://example.com/crl.pem"; constexpr const char * exampleHttpsURI = "https://example.com/crl.pem"; + CharSpan httpSpan = CharSpan::fromCharString(exampleHttpURI); + CharSpan httpsSpan = CharSpan::fromCharString(exampleHttpsURI); // clang-format off static CDPTestCase sCDPTestCases[] = { - // Cert Expected Error Expected Output - // =============================================================================================== - { ByteSpan(), CHIP_ERROR_INVALID_ARGUMENT, CharSpan() }, - { sTestCert_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_PAI_FFF2_8001_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_DAC_FFF2_8003_0019_FB_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_DAC_FFF1_8000_0000_CDP_Cert, CHIP_NO_ERROR, CharSpan::fromCharString(exampleHttpURI) }, - { sTestCert_DAC_FFF1_8000_0000_CDP_HTTPS_Cert, CHIP_NO_ERROR, CharSpan::fromCharString(exampleHttpsURI) }, - { sTestCert_DAC_FFF1_8000_0000_2CDPs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_DAC_FFF1_8000_0000_CDP_2URIs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_DAC_FFF1_8000_0000_CDP_Wrong_Prefix_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, - { sTestCert_DAC_FFF1_8000_0000_CDP_Long_Cert, CHIP_ERROR_BUFFER_TOO_SMALL, CharSpan() }, + // Cert Expected Error Expected Output + // ============================================================================================================== + { ByteSpan(), CHIP_ERROR_INVALID_ARGUMENT, CharSpan() }, + { sTestCert_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_PAI_FFF2_8001_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF2_8003_0019_FB_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Cert, CHIP_NO_ERROR, httpSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_HTTPS_Cert, CHIP_NO_ERROR, httpsSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2URIs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2DPs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Wrong_Prefix_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Long_Cert, CHIP_ERROR_BUFFER_TOO_SMALL, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Issuer_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Issuer_PAI_FFF2_8004_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_CRL_Issuer_PAA_FFF1_2DPs_Cert, CHIP_ERROR_NOT_FOUND, CharSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2CRLIssuers_PAA_FFF1_Cert, CHIP_NO_ERROR, httpsSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAA_FFF1_Cert, CHIP_NO_ERROR, httpsSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAA_NoVID_Cert, CHIP_NO_ERROR, httpsSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAI_FFF2_8004_Cert, CHIP_NO_ERROR, httpsSpan }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAI_FFF2_8004_Long_Cert, CHIP_ERROR_BUFFER_TOO_SMALL, CharSpan() }, }; // clang-format on @@ -2146,7 +2157,7 @@ static void TestCDPExtension_x509Extraction(nlTestSuite * inSuite, void * inCont MutableCharSpan cdp(cdpBuf); err = ExtractCRLDistributionPointURIFromX509Cert(testCase.Cert, cdp); NL_TEST_ASSERT(inSuite, err == testCase.mExpectedError); - if (err == CHIP_NO_ERROR) + if (testCase.mExpectedError == CHIP_NO_ERROR) { NL_TEST_ASSERT(inSuite, cdp.size() == testCase.mExpectedResult.size()); NL_TEST_ASSERT(inSuite, cdp.data_equal(testCase.mExpectedResult)); @@ -2154,6 +2165,65 @@ static void TestCDPExtension_x509Extraction(nlTestSuite * inSuite, void * inCont } } +static void TestCDPCRLIssuerExtension_x509Extraction(nlTestSuite * inSuite, void * inContext) +{ + using namespace TestCerts; + + HeapChecker heapChecker(inSuite); + CHIP_ERROR err = CHIP_NO_ERROR; + + struct CDPTestCase + { + ByteSpan Cert; + CHIP_ERROR mExpectedError; + ByteSpan mCRLIssuerCert; + }; + + // clang-format off + static CDPTestCase sCDPTestCases[] = { + // Cert Expected Error Expected CRL Issuer Cert + // ======================================================================================================================= + { ByteSpan(), CHIP_ERROR_INVALID_ARGUMENT, ByteSpan() }, + { sTestCert_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_PAI_FFF2_8001_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF2_8003_0019_FB_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_HTTPS_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2URIs_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2DPs_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Wrong_Prefix_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Long_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Issuer_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_2CDPs_Issuer_PAI_FFF2_8004_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_CRL_Issuer_PAA_FFF1_2DPs_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_2CRLIssuers_PAA_FFF1_Cert, CHIP_ERROR_NOT_FOUND, ByteSpan() }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAA_FFF1_Cert, CHIP_NO_ERROR, sTestCert_PAA_FFF1_Cert }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAA_NoVID_Cert, CHIP_NO_ERROR, sTestCert_PAA_NoVID_Cert }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAI_FFF2_8004_Cert, CHIP_NO_ERROR, sTestCert_PAI_FFF2_8004_FB_Cert }, + { sTestCert_DAC_FFF1_8000_0000_CDP_Issuer_PAI_FFF2_8004_Long_Cert, CHIP_NO_ERROR, sTestCert_PAI_FFF2_8004_FB_Cert }, + }; + // clang-format on + + for (auto & testCase : sCDPTestCases) + { + uint8_t crlIssuerBuf[kMaxCertificateDistinguishedNameLength] = { 0 }; + MutableByteSpan crlIssuer(crlIssuerBuf); + err = ExtractCDPExtensionCRLIssuerFromX509Cert(testCase.Cert, crlIssuer); + NL_TEST_ASSERT(inSuite, err == testCase.mExpectedError); + if (testCase.mExpectedError == CHIP_NO_ERROR) + { + uint8_t crlIssuerSubjectBuf[kMaxCertificateDistinguishedNameLength] = { 0 }; + MutableByteSpan crlIssuerSubject(crlIssuerSubjectBuf); + + err = ExtractSubjectFromX509Cert(testCase.mCRLIssuerCert, crlIssuerSubject); + NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR); + + NL_TEST_ASSERT(inSuite, crlIssuer.data_equal(crlIssuerSubject)); + } + } +} + static void TestSerialNumber_x509Extraction(nlTestSuite * inSuite, void * inContext) { using namespace TestCerts; @@ -2752,6 +2822,7 @@ static const nlTest sTests[] = { NL_TEST_DEF("Test Subject Key Id Extraction from x509 Certificate", TestSKID_x509Extraction), NL_TEST_DEF("Test Authority Key Id Extraction from x509 Certificate", TestAKID_x509Extraction), NL_TEST_DEF("Test CRL Distribution Point Extension Extraction from x509 Certificate", TestCDPExtension_x509Extraction), + NL_TEST_DEF("Test CDP Extension CRL Issuer Extraction from x509 Certificate", TestCDPCRLIssuerExtension_x509Extraction), NL_TEST_DEF("Test Serial Number Extraction from x509 Certificate", TestSerialNumber_x509Extraction), NL_TEST_DEF("Test Subject Extraction from x509 Certificate", TestSubject_x509Extraction), NL_TEST_DEF("Test Issuer Extraction from x509 Certificate", TestIssuer_x509Extraction), diff --git a/src/platform/nxp/common/crypto/CHIPCryptoPALTinyCrypt.cpp b/src/platform/nxp/common/crypto/CHIPCryptoPALTinyCrypt.cpp index 96973dcf12046d..e53d793f2ee770 100644 --- a/src/platform/nxp/common/crypto/CHIPCryptoPALTinyCrypt.cpp +++ b/src/platform/nxp/common/crypto/CHIPCryptoPALTinyCrypt.cpp @@ -1662,7 +1662,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -1693,6 +1693,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -1708,6 +1710,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -1735,6 +1740,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + _log_mbedTLS_error(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/platform/nxp/k32w/k32w0/crypto/CHIPCryptoPALNXPUltrafastP256.cpp b/src/platform/nxp/k32w/k32w0/crypto/CHIPCryptoPALNXPUltrafastP256.cpp index b7d49c4fdb2e66..378cbb7e408914 100644 --- a/src/platform/nxp/k32w/k32w0/crypto/CHIPCryptoPALNXPUltrafastP256.cpp +++ b/src/platform/nxp/k32w/k32w0/crypto/CHIPCryptoPALNXPUltrafastP256.cpp @@ -1631,7 +1631,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -1662,6 +1662,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -1677,6 +1679,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -1704,6 +1709,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + _log_mbedTLS_error(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/platform/silabs/SiWx917/CHIPCryptoPALTinyCrypt.cpp b/src/platform/silabs/SiWx917/CHIPCryptoPALTinyCrypt.cpp index 1bcfbdc59edaa5..15e8abf27ea76d 100644 --- a/src/platform/silabs/SiWx917/CHIPCryptoPALTinyCrypt.cpp +++ b/src/platform/silabs/SiWx917/CHIPCryptoPALTinyCrypt.cpp @@ -1662,7 +1662,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -1693,6 +1693,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -1708,6 +1710,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -1735,6 +1740,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + _log_mbedTLS_error(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/platform/silabs/efr32/CHIPCryptoPALPsaEfr32.cpp b/src/platform/silabs/efr32/CHIPCryptoPALPsaEfr32.cpp index e0b5906c1a816b..9948017c4d3f94 100644 --- a/src/platform/silabs/efr32/CHIPCryptoPALPsaEfr32.cpp +++ b/src/platform/silabs/efr32/CHIPCryptoPALPsaEfr32.cpp @@ -2023,7 +2023,7 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica cdpExtCount++; VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); - // CRL Distribution Point Extension is encoded as a secuense of DistributionPoint: + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint // // This implementation only supports a single DistributionPoint (sequence of size 1), @@ -2054,6 +2054,8 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + unsigned char * end_of_general_names = p + len; + // The CDP URI is encoded as a uniformResourceIdentifier field of the GeneralName: // GeneralName ::= CHOICE { // otherName [0] OtherName, @@ -2069,6 +2071,9 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER); VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + // Only single URI instance in the GeneralNames is supported + VerifyOrExit(p + len == end_of_general_names, error = CHIP_ERROR_NOT_FOUND); + const char * urlptr = reinterpret_cast(p); VerifyOrExit((len > strlen(kValidCDPURIHttpPrefix) && strncmp(urlptr, kValidCDPURIHttpPrefix, strlen(kValidCDPURIHttpPrefix)) == 0) || @@ -2096,6 +2101,122 @@ CHIP_ERROR ExtractCRLDistributionPointURIFromX509Cert(const ByteSpan & certifica return error; } +CHIP_ERROR ExtractCDPExtensionCRLIssuerFromX509Cert(const ByteSpan & certificate, MutableByteSpan & crlIssuer) +{ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + CHIP_ERROR error = CHIP_ERROR_NOT_FOUND; + mbedtls_x509_crt mbed_cert; + unsigned char * p = nullptr; + const unsigned char * end = nullptr; + size_t len = 0; + size_t cdpExtCount = 0; + + VerifyOrReturnError(!certificate.empty() && CanCastTo(certificate.size()), CHIP_ERROR_INVALID_ARGUMENT); + + mbedtls_x509_crt_init(&mbed_cert); + + int result = mbedtls_x509_crt_parse(&mbed_cert, Uint8::to_const_uchar(certificate.data()), certificate.size()); + VerifyOrExit(result == 0, error = CHIP_ERROR_INTERNAL); + + p = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p); + end = mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(p) + + mbed_cert.CHIP_CRYPTO_PAL_PRIVATE_X509(v3_ext).CHIP_CRYPTO_PAL_PRIVATE_X509(len); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + while (p < end) + { + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OID); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + mbedtls_x509_buf extOID = { MBEDTLS_ASN1_OID, len, p }; + bool isCurrentExtCDP = OID_CMP(sOID_Extension_CRLDistributionPoint, extOID); + p += len; + + int is_critical = 0; + result = mbedtls_asn1_get_bool(&p, end, &is_critical); + VerifyOrExit(result == 0 || result == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, error = CHIP_ERROR_WRONG_CERT_TYPE); + + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + VerifyOrExit(result == 0, error = CHIP_ERROR_WRONG_CERT_TYPE); + + unsigned char * end_of_ext = p + len; + + if (isCurrentExtCDP) + { + // Only one CRL Distribution Point Extension is allowed. + cdpExtCount++; + VerifyOrExit(cdpExtCount <= 1, error = CHIP_ERROR_NOT_FOUND); + + // CRL Distribution Point Extension is encoded as a sequence of DistributionPoint: + // CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint + // + // This implementation only supports a single DistributionPoint (sequence of size 1), + // which is verified by comparing (p + len == end_of_ext) + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // The DistributionPoint is a sequence of three optional elements: + // DistributionPoint ::= SEQUENCE { + // distributionPoint [0] DistributionPointName OPTIONAL, + // reasons [1] ReasonFlags OPTIONAL, + // cRLIssuer [2] GeneralNames OPTIONAL } + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + // If distributionPoint element presents, ignore it + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0); + if (result == 0) + { + p += len; + VerifyOrExit(p < end_of_ext, error = CHIP_ERROR_NOT_FOUND); + } + + // Check if cRLIssuer element present + result = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + + // The CRL Issuer is encoded as a directoryName field of the GeneralName: + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER } + result = mbedtls_asn1_get_tag( + &p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_X509_SAN_DIRECTORY_NAME); + VerifyOrExit(result == 0, error = CHIP_ERROR_NOT_FOUND); + VerifyOrExit(p + len == end_of_ext, error = CHIP_ERROR_NOT_FOUND); + + error = CopySpanToMutableSpan(ByteSpan(p, len), crlIssuer); + SuccessOrExit(error); + } + p = end_of_ext; + } + + VerifyOrExit(cdpExtCount == 1, error = CHIP_ERROR_NOT_FOUND); + +exit: + _log_mbedTLS_error(result); + mbedtls_x509_crt_free(&mbed_cert); + +#else + (void) certificate; + (void) crlIssuer; + CHIP_ERROR error = CHIP_ERROR_NOT_IMPLEMENTED; +#endif // defined(MBEDTLS_X509_CRT_PARSE_C) + + return error; +} + CHIP_ERROR ExtractSerialNumberFromX509Cert(const ByteSpan & certificate, MutableByteSpan & serialNumber) { #if defined(MBEDTLS_X509_CRT_PARSE_C) diff --git a/src/tools/chip-cert/CertUtils.cpp b/src/tools/chip-cert/CertUtils.cpp index 3fcf474e9abba8..db880f75f3c5dc 100644 --- a/src/tools/chip-cert/CertUtils.cpp +++ b/src/tools/chip-cert/CertUtils.cpp @@ -1284,8 +1284,7 @@ bool ResignCert(X509 * cert, X509 * caCert, EVP_PKEY * caKey) bool MakeAttCert(AttCertType attCertType, const char * subjectCN, uint16_t subjectVID, uint16_t subjectPID, bool encodeVIDandPIDasCN, X509 * caCert, EVP_PKEY * caKey, const struct tm & validFrom, uint32_t validDays, - X509 * newCert, EVP_PKEY * newKey, CertStructConfig & certConfig, const FutureExtensionWithNID * exts, - uint8_t extsCount) + X509 * newCert, EVP_PKEY * newKey, CertStructConfig & certConfig, X509_EXTENSION * cdpExt) { bool res = true; uint16_t vid = certConfig.IsSubjectVIDMismatch() ? static_cast(subjectVID + 1) : subjectVID; @@ -1469,9 +1468,16 @@ bool MakeAttCert(AttCertType attCertType, const char * subjectCN, uint16_t subje VerifyTrueOrExit(res); } - for (uint8_t i = 0; i < extsCount; i++) + if (cdpExt != nullptr) { - res = AddExtension(newCert, exts[i].nid, exts[i].info); + int result = X509_add_ext(newCert, cdpExt, -1); + VerifyTrueOrExit(result == 1); + } + + if (certConfig.IsExtensionCDPPresent()) + { + // Add second CDP extension. + res = AddExtension(newCert, NID_crl_distribution_points, "URI:http://example.com/test_crl.pem"); VerifyTrueOrExit(res); } diff --git a/src/tools/chip-cert/Cmd_GenAttCert.cpp b/src/tools/chip-cert/Cmd_GenAttCert.cpp index 7f57e1df20542d..3c30991dc9e8dc 100644 --- a/src/tools/chip-cert/Cmd_GenAttCert.cpp +++ b/src/tools/chip-cert/Cmd_GenAttCert.cpp @@ -31,6 +31,8 @@ #include +#include + namespace { using namespace chip; @@ -45,22 +47,23 @@ bool HandleOption(const char * progName, OptionSet * optSet, int id, const char // clang-format off OptionDef gCmdOptionDefs[] = { - { "type", kArgumentRequired, 't' }, - { "subject-cn", kArgumentRequired, 'c' }, - { "subject-vid", kArgumentRequired, 'V' }, - { "subject-pid", kArgumentRequired, 'P' }, - { "vid-pid-as-cn", kNoArgument, 'a' }, - { "key", kArgumentRequired, 'k' }, - { "ca-cert", kArgumentRequired, 'C' }, - { "ca-key", kArgumentRequired, 'K' }, - { "out", kArgumentRequired, 'o' }, - { "out-key", kArgumentRequired, 'O' }, - { "valid-from", kArgumentRequired, 'f' }, - { "lifetime", kArgumentRequired, 'l' }, - { "cpd-ext", kArgumentRequired, 'x' }, -#if CHIP_CONFIG_INTERNAL_FLAG_GENERATE_DA_TEST_CASES - { "ignore-error", kNoArgument, 'I' }, - { "error-type", kArgumentRequired, 'E' }, + { "type", kArgumentRequired, 't' }, + { "subject-cn", kArgumentRequired, 'c' }, + { "subject-vid", kArgumentRequired, 'V' }, + { "subject-pid", kArgumentRequired, 'P' }, + { "vid-pid-as-cn", kNoArgument, 'a' }, + { "key", kArgumentRequired, 'k' }, + { "ca-cert", kArgumentRequired, 'C' }, + { "ca-key", kArgumentRequired, 'K' }, + { "out", kArgumentRequired, 'o' }, + { "out-key", kArgumentRequired, 'O' }, + { "valid-from", kArgumentRequired, 'f' }, + { "lifetime", kArgumentRequired, 'l' }, + { "cdp-uri", kArgumentRequired, 'x' }, + { "crl-issuer-cert", kArgumentRequired, 'L' }, + #if CHIP_CONFIG_INTERNAL_FLAG_GENERATE_DA_TEST_CASES + { "ignore-error", kNoArgument, 'I' }, + { "error-type", kArgumentRequired, 'E' }, #endif { } }; @@ -126,11 +129,17 @@ const char * const gCmdOptionHelp = " 4294967295 to indicate that certificate doesn't have well defined\n" " expiration date\n" "\n" - " -x, --cpd-ext \n" + " -x, --cdp-uri \n" "\n" " CRL Distribution Points (CDP) extension (NID_crl_distribution_points) extension to be added to the list\n" " of certificate extensions.\n" "\n" + " -L, --crl-issuer-cert \n" + "\n" + " File or string containing the CRL Issuer certificate (in an X.509 PEM format).\n" + " The Subject name will be extracted from this certificate to be included in the\n" + " cRLIssuer field of the CRL Distribution Point (CDP) extension.\n" + "\n" #if CHIP_CONFIG_INTERNAL_FLAG_GENERATE_DA_TEST_CASES " -I, --ignore-error\n" "\n" @@ -180,6 +189,10 @@ const char * const gCmdOptionHelp = " ext-extended-key-usage - Certificate will include optional Extended Key Usage extension.\n" " ext-authority-info-access - Certificate will include optional Authority Information Access extension.\n" " ext-subject-alt-name - Certificate will include optional Subject Alternative Name extension.\n" + " ext-cdp-uri-duplicate - Certificate will include additional URI Field in the CDP extension.\n" + " ext-cdp-crl-issuer-duplicate - Certificate will include additional CRL Issuer Field in the CDP extension.\n" + " ext-cdp-dist-point-duplicate - Certificate will include additional CRL Distribution Point Field in the CDP extension.\n" + " ext-cdp-add - Certificate will include additional CDP extension.\n" "\n" #endif // CHIP_CONFIG_INTERNAL_FLAG_GENERATE_DA_TEST_CASES ; @@ -207,19 +220,19 @@ OptionSet *gCmdOptionSets[] = }; // clang-format on -AttCertType gAttCertType = kAttCertType_NotSpecified; -const char * gSubjectCN = nullptr; -uint16_t gSubjectVID = VendorId::NotSpecified; -uint16_t gSubjectPID = 0; -bool gEncodeVIDandPIDasCN = false; -const char * gCACertFileNameOrStr = nullptr; -const char * gCAKeyFileNameOrStr = nullptr; -const char * gInKeyFileNameOrStr = nullptr; -const char * gOutCertFileName = nullptr; -const char * gOutKeyFileName = nullptr; -uint32_t gValidDays = kCertValidDays_Undefined; -FutureExtensionWithNID gCPDExtensions[3] = { { 0, nullptr } }; -uint8_t gCPDExtensionsCount = 0; +AttCertType gAttCertType = kAttCertType_NotSpecified; +const char * gSubjectCN = nullptr; +uint16_t gSubjectVID = VendorId::NotSpecified; +uint16_t gSubjectPID = 0; +bool gEncodeVIDandPIDasCN = false; +const char * gCACertFileNameOrStr = nullptr; +const char * gCAKeyFileNameOrStr = nullptr; +const char * gInKeyFileNameOrStr = nullptr; +const char * gOutCertFileName = nullptr; +const char * gOutKeyFileName = nullptr; +uint32_t gValidDays = kCertValidDays_Undefined; +const char * gCDPURI = nullptr; +const char * gCRLIssuerCertFileName = nullptr; struct tm gValidFrom; CertStructConfig gCertConfig; @@ -300,9 +313,10 @@ bool HandleOption(const char * progName, OptionSet * optSet, int id, const char } break; case 'x': - gCPDExtensions[gCPDExtensionsCount].nid = NID_crl_distribution_points; - gCPDExtensions[gCPDExtensionsCount].info = arg; - gCPDExtensionsCount++; + gCDPURI = arg; + break; + case 'L': + gCRLIssuerCertFileName = arg; break; #if CHIP_CONFIG_INTERNAL_FLAG_GENERATE_DA_TEST_CASES case 'I': @@ -409,6 +423,22 @@ bool HandleOption(const char * progName, OptionSet * optSet, int id, const char { gCertConfig.SetExtensionSubjectAltNamePresent(); } + else if (strcmp(arg, "ext-cdp-uri-duplicate") == 0) + { + gCertConfig.SetExtensionCDPURIDuplicate(); + } + else if (strcmp(arg, "ext-cdp-crl-issuer-duplicate") == 0) + { + gCertConfig.SetExtensionCDPCRLIssuerDuplicate(); + } + else if (strcmp(arg, "ext-cdp-dist-point-duplicate") == 0) + { + gCertConfig.SetExtensionCDPDistPointDuplicate(); + } + else if (strcmp(arg, "ext-cdp-add") == 0) + { + gCertConfig.SetExtensionCDPPresent(); + } else if (strcmp(arg, "no-error") != 0) { PrintArgError("%s: Invalid value specified for the error type: %s\n", progName, arg); @@ -432,6 +462,17 @@ bool Cmd_GenAttCert(int argc, char * argv[]) std::unique_ptr newCert(X509_new(), &X509_free); std::unique_ptr newKey(EVP_PKEY_new(), &EVP_PKEY_free); + // Declarations related to the CRL Distribution Points (CDP) Extention + std::unique_ptr cRLIssuerCert(nullptr, &X509_free); + std::unique_ptr cdpExtension(nullptr, &X509_EXTENSION_free); + STACK_OF(DIST_POINT) * distPoints = nullptr; + DIST_POINT * distPoint = nullptr; + ASN1_IA5STRING * uri = nullptr; + GENERAL_NAME * distPointName = nullptr; + GENERAL_NAME * crlIssuerName = nullptr; + + std::unique_ptr cdpExtension2(nullptr, &X509_EXTENSION_free); + { time_t now = time(nullptr); gValidFrom = *gmtime(&now); @@ -565,10 +606,82 @@ bool Cmd_GenAttCert(int argc, char * argv[]) } } + if (gCRLIssuerCertFileName != nullptr || gCDPURI != nullptr) + { + int result; + + // Create a DIST_POINT object + distPoint = DIST_POINT_new(); + VerifyOrReturnError(distPoint != nullptr, false); + + if (gCDPURI != nullptr) + { + // Set the distribution point name + distPoint->distpoint = DIST_POINT_NAME_new(); + VerifyOrReturnError(distPoint->distpoint != nullptr, false); + + distPoint->distpoint->type = 0; // fullName + distPoint->distpoint->name.fullname = GENERAL_NAMES_new(); + VerifyOrReturnError(distPoint->distpoint->name.fullname != nullptr, false); + + // Create and set URI string + uri = ASN1_IA5STRING_new(); + VerifyOrReturnError(uri != nullptr, false); + result = ASN1_STRING_set(uri, gCDPURI, -1); + VerifyOrReturnError(result != 0, false); + + // Set fullName as a URI + distPointName = GENERAL_NAME_new(); + VerifyOrReturnError(distPointName != nullptr, false); + distPointName->type = GEN_URI; + distPointName->d.uniformResourceIdentifier = uri; + sk_GENERAL_NAME_push(distPoint->distpoint->name.fullname, distPointName); + + if (gCertConfig.IsExtensionCDPURIDuplicate()) + { + // Add second instance of CDP URI - invalid configuration + sk_GENERAL_NAME_push(distPoint->distpoint->name.fullname, distPointName); + } + } + + if (gCRLIssuerCertFileName != nullptr) + { + // Extract Subject from the CRL Issuer Certificate + res = ReadCert(gCRLIssuerCertFileName, cRLIssuerCert); + VerifyTrueOrExit(res); + + crlIssuerName = GENERAL_NAME_new(); + VerifyOrReturnError(crlIssuerName != nullptr, false); + crlIssuerName->type = GEN_DIRNAME; + crlIssuerName->d.directoryName = X509_get_subject_name(cRLIssuerCert.get()); + distPoint->CRLissuer = GENERAL_NAMES_new(); + sk_GENERAL_NAME_push(distPoint->CRLissuer, crlIssuerName); + + if (gCertConfig.IsExtensionCDPCRLIssuerDuplicate()) + { + // Add second instance of CDP CRL Issuer - invalid configuration + sk_GENERAL_NAME_push(distPoint->CRLissuer, crlIssuerName); + } + } + + // Push single DIST_POINT into array of CRL Distribution Points + distPoints = sk_DIST_POINT_new_null(); + sk_DIST_POINT_push(distPoints, distPoint); + + if (gCertConfig.IsExtensionCDPDistPointDuplicate()) + { + // Add second instance of CDP URI - invalid configuration + sk_DIST_POINT_push(distPoints, distPoint); + } + + cdpExtension.reset(X509V3_EXT_i2d(NID_crl_distribution_points, 0, distPoints)); + VerifyOrReturnError(cdpExtension.get() != nullptr, false); + } + if (gAttCertType == kAttCertType_PAA) { res = MakeAttCert(gAttCertType, gSubjectCN, gSubjectVID, gSubjectPID, gEncodeVIDandPIDasCN, newCert.get(), newKey.get(), - gValidFrom, gValidDays, newCert.get(), newKey.get(), gCertConfig, gCPDExtensions, gCPDExtensionsCount); + gValidFrom, gValidDays, newCert.get(), newKey.get(), gCertConfig, cdpExtension.get()); VerifyTrueOrExit(res); } else @@ -583,7 +696,7 @@ bool Cmd_GenAttCert(int argc, char * argv[]) VerifyTrueOrExit(res); res = MakeAttCert(gAttCertType, gSubjectCN, gSubjectVID, gSubjectPID, gEncodeVIDandPIDasCN, caCert.get(), caKey.get(), - gValidFrom, gValidDays, newCert.get(), newKey.get(), gCertConfig, gCPDExtensions, gCPDExtensionsCount); + gValidFrom, gValidDays, newCert.get(), newKey.get(), gCertConfig, cdpExtension.get()); VerifyTrueOrExit(res); } diff --git a/src/tools/chip-cert/chip-cert.h b/src/tools/chip-cert/chip-cert.h index 2f203193e38e44..82d4d8e4c8190b 100644 --- a/src/tools/chip-cert/chip-cert.h +++ b/src/tools/chip-cert/chip-cert.h @@ -1,6 +1,6 @@ /* * - * Copyright (c) 2021-2022 Project CHIP Authors + * Copyright (c) 2021-2023 Project CHIP Authors * Copyright (c) 2013-2017 Nest Labs, Inc. * All rights reserved. * @@ -185,6 +185,10 @@ class CertStructConfig void SetExtensionExtendedKeyUsagePresent() { mFlags.Set(CertErrorFlags::kExtExtendedKeyUsage); } void SetExtensionAuthorityInfoAccessPresent() { mFlags.Set(CertErrorFlags::kExtAuthorityInfoAccess); } void SetExtensionSubjectAltNamePresent() { mFlags.Set(CertErrorFlags::kExtSubjectAltName); } + void SetExtensionCDPPresent() { mFlags.Set(CertErrorFlags::kExtCRLDistributionPoints); } + void SetExtensionCDPURIDuplicate() { mFlags.Set(CertErrorFlags::kExtCDPURIDuplicate); } + void SetExtensionCDPCRLIssuerDuplicate() { mFlags.Set(CertErrorFlags::kExtCDPCRLIssuerDuplicate); } + void SetExtensionCDPDistPointDuplicate() { mFlags.Set(CertErrorFlags::kExtCDPDistPointDuplicate); } void SetSignatureError() { mFlags.Set(CertErrorFlags::kSignature); } void SetCertOversized() { mFlags.Set(CertErrorFlags::kCertOversized); } @@ -314,6 +318,10 @@ class CertStructConfig bool IsExtensionExtendedKeyUsagePresent() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtExtendedKeyUsage)); } bool IsExtensionAuthorityInfoAccessPresent() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtAuthorityInfoAccess)); } bool IsExtensionSubjectAltNamePresent() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtSubjectAltName)); } + bool IsExtensionCDPPresent() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtCRLDistributionPoints)); } + bool IsExtensionCDPURIDuplicate() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtCDPURIDuplicate)); } + bool IsExtensionCDPCRLIssuerDuplicate() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtCDPCRLIssuerDuplicate)); } + bool IsExtensionCDPDistPointDuplicate() { return (mEnabled && mFlags.Has(CertErrorFlags::kExtCDPDistPointDuplicate)); } bool IsSignatureError() { return (mEnabled && mFlags.Has(CertErrorFlags::kSignature)); } bool IsCertOversized() { return (mEnabled && mFlags.Has(CertErrorFlags::kCertOversized)); } @@ -368,26 +376,30 @@ class CertStructConfig kExtExtendedKeyUsage = 0x0000000002000000, // DA specific kExtAuthorityInfoAccess = 0x0000000004000000, // DA specific kExtSubjectAltName = 0x0000000008000000, // DA specific - kSignature = 0x0000000010000000, + kExtCRLDistributionPoints = 0x0000000010000000, // DA specific + kExtCDPURIDuplicate = 0x0000000020000000, // DA specific + kExtCDPCRLIssuerDuplicate = 0x0000000040000000, // DA specific + kExtCDPDistPointDuplicate = 0x0000000080000000, // DA specific + kSignature = 0x0000000100000000, // Op Cert Specific Flags: - kCertOversized = 0x0000000100000000, - kSerialNumberMissing = 0x0000000200000000, - kIssuerMissing = 0x0000000400000000, - kValidityNotBeforeMissing = 0x0000000800000000, - kValidityNotAfterMissing = 0x0000001000000000, - kValidityWrong = 0x0000002000000000, - kSubjectMissing = 0x0000004000000000, - kSubjectMatterIdMissing = 0x0000008000000000, - kSubjectNodeIdInvalid = 0x0000010000000000, - kSubjectMatterIdTwice = 0x0000020000000000, - kSubjectFabricIdMissing = 0x0000040000000000, - kSubjectFabricIdInvalid = 0x0000080000000000, - kSubjectFabricIdTwice = 0x0000100000000000, - kSubjectFabricIdMismatch = 0x0000200000000000, - kSubjectCATInvalid = 0x0000400000000000, - kSubjectCATTwice = 0x0000800000000000, - kExtExtendedKeyUsageMissing = 0x0001000000000000, + kCertOversized = 0x0000001000000000, + kSerialNumberMissing = 0x0000002000000000, + kIssuerMissing = 0x0000004000000000, + kValidityNotBeforeMissing = 0x0000008000000000, + kValidityNotAfterMissing = 0x0000010000000000, + kValidityWrong = 0x0000020000000000, + kSubjectMissing = 0x0000040000000000, + kSubjectMatterIdMissing = 0x0000080000000000, + kSubjectNodeIdInvalid = 0x0000100000000000, + kSubjectMatterIdTwice = 0x0000200000000000, + kSubjectFabricIdMissing = 0x0000400000000000, + kSubjectFabricIdInvalid = 0x0000800000000000, + kSubjectFabricIdTwice = 0x0001000000000000, + kSubjectFabricIdMismatch = 0x0002000000000000, + kSubjectCATInvalid = 0x0004000000000000, + kSubjectCATTwice = 0x0008000000000000, + kExtExtendedKeyUsageMissing = 0x0010000000000000, }; static constexpr uint32_t kExtraBufferLengthForOvesizedCert = 300; @@ -437,8 +449,7 @@ extern bool ResignCert(X509 * cert, X509 * caCert, EVP_PKEY * caKey); extern bool MakeAttCert(AttCertType attCertType, const char * subjectCN, uint16_t subjectVID, uint16_t subjectPID, bool encodeVIDandPIDasCN, X509 * caCert, EVP_PKEY * caKey, const struct tm & validFrom, uint32_t validDays, - X509 * newCert, EVP_PKEY * newKey, CertStructConfig & certConfig, const FutureExtensionWithNID * exts, - uint8_t extsCount); + X509 * newCert, EVP_PKEY * newKey, CertStructConfig & certConfig, X509_EXTENSION * cdpExt); extern bool GenerateKeyPair(EVP_PKEY * key); extern bool GenerateKeyPair_Secp256k1(EVP_PKEY * key); extern bool ReadKey(const char * fileNameOrStr, std::unique_ptr & key,