55#include "mbedtls/pem.h"
66#include "mbedtls/oid.h"
77#include "mbedtls/rsa.h"
8+ #include "mbedtls/asn1write.h"
89
910#if defined(MBEDTLS_RSA_C)
1011int mbedtls_rsa_decrypt_func( void *ctx, int mode, size_t *olen,
@@ -68,6 +69,56 @@ cleanup:
6869}
6970#endif /* MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_PEM_WRITE_C && MBEDTLS_X509_CSR_WRITE_C */
7071
72+ #if defined(MBEDTLS_X509_CSR_WRITE_C)
73+
74+ /*
75+ * The size of this temporary buffer is given by the sequence of functions
76+ * called hereinafter:
77+ * - mbedtls_asn1_write_oid()
78+ * - 8 bytes for MBEDTLS_OID_EXTENDED_KEY_USAGE raw value
79+ * - 1 byte for MBEDTLS_OID_EXTENDED_KEY_USAGE length
80+ * - 1 byte for MBEDTLS_ASN1_OID tag
81+ * - mbedtls_asn1_write_len()
82+ * - 1 byte since we're dealing with sizes which are less than 0x80
83+ * - mbedtls_asn1_write_tag()
84+ * - 1 byte
85+ *
86+ * This length is fine as long as this function is called using the
87+ * MBEDTLS_OID_SERVER_AUTH OID. If this is changed in the future, then this
88+ * buffer's length should be adjusted accordingly.
89+ * Unfortunately there's no predefined max size for OIDs which can be used
90+ * to set an overall upper boundary which is always guaranteed.
91+ */
92+ #define EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH 12
93+
94+ static int csr_set_extended_key_usage( mbedtls_x509write_csr *ctx,
95+ const char *oid, size_t oid_len )
96+ {
97+ unsigned char buf[EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH] = { 0 };
98+ unsigned char *p = buf + sizeof( buf );
99+ int ret;
100+ size_t len = 0;
101+
102+ /*
103+ * Following functions fail anyway if the temporary buffer is not large,
104+ * but we set an extra check here to emphasize a possible source of errors
105+ */
106+ if ( oid_len > EXT_KEY_USAGE_TMP_BUF_MAX_LENGTH )
107+ {
108+ return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
109+ }
110+
111+ MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( &p, buf, oid, oid_len ) );
112+ MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, ret ) );
113+ MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
114+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
115+
116+ ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_EXTENDED_KEY_USAGE,
117+ MBEDTLS_OID_SIZE( MBEDTLS_OID_EXTENDED_KEY_USAGE ), p, len );
118+
119+ return ret;
120+ }
121+ #endif /* MBEDTLS_X509_CSR_WRITE_C */
71122/* END_HEADER */
72123
73124/* BEGIN_DEPENDENCIES
@@ -78,7 +129,7 @@ cleanup:
78129/* BEGIN_CASE depends_on:MBEDTLS_PEM_WRITE_C:MBEDTLS_X509_CSR_WRITE_C */
79130void x509_csr_check( char * key_file, char * cert_req_check_file, int md_type,
80131 int key_usage, int set_key_usage, int cert_type,
81- int set_cert_type )
132+ int set_cert_type, int set_extension )
82133{
83134 mbedtls_pk_context key;
84135 mbedtls_x509write_csr req;
@@ -105,6 +156,9 @@ void x509_csr_check( char * key_file, char * cert_req_check_file, int md_type,
105156 TEST_ASSERT( mbedtls_x509write_csr_set_key_usage( &req, key_usage ) == 0 );
106157 if( set_cert_type != 0 )
107158 TEST_ASSERT( mbedtls_x509write_csr_set_ns_cert_type( &req, cert_type ) == 0 );
159+ if ( set_extension != 0 )
160+ TEST_ASSERT( csr_set_extended_key_usage( &req, MBEDTLS_OID_SERVER_AUTH,
161+ MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH ) ) == 0 );
108162
109163 ret = mbedtls_x509write_csr_pem( &req, buf, sizeof( buf ),
110164 mbedtls_test_rnd_pseudo_rand, &rnd_info );
0 commit comments