crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Merge pull request #11400 from julek-wolfssl/ca-store-loading-fixes

Browse Source 
Thread the caller's verify setting into trusted-peer loads and parse multi-valued RDNs
This commit is contained in:
Tobias Frauenschläger
2026-10-15 11:03:36 +02:00
committed by GitHub
parent 2a5d2ec5eb 57313b9e19
commit f46cdde15b
7 changed files with 1040 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

115
src/ssl_load.c
View File

@@ -3093,6 +3093,37 @@ int ProcessFile(WOLFSSL_CTX* ctx, const char* fname, int format, int type,
return ret;
}
#if defined(WOLFSSL_TRUST_PEER_CERT)
/* Load a trusted peer certificate from a file with the caller's verification
* setting.
*
* @param [in, out] ctx SSL context object.
* @param [in] file Name of peer certificate file.
* @param [in] format Format of data: WOLFSSL_FILETYPE_PEM or
* WOLFSSL_FILETYPE_ASN1.
* @param [in] verify How to verify the certificate.
* @return 1 on success.
* @return 0 when ctx or file is NULL.
* @return Negative on error.
*/
static int TrustPeerCertFile(WOLFSSL_CTX* ctx, const char* file, int format,
int verify)
{
int ret;
/* Validate parameters. */
if ((ctx == NULL) || (file == NULL)) {
ret = 0;
}
else {
ret = ProcessFile(ctx, file, format, TRUSTED_PEER_TYPE, NULL, 0, NULL,
verify);
}
return ret;
}
#endif /* WOLFSSL_TRUST_PEER_CERT */
#ifndef NO_WOLFSSL_DIR
/* Load file when filename is in the path.
*
@@ -3133,8 +3164,9 @@ static int wolfssl_ctx_load_path_file(WOLFSSL_CTX* ctx, const char* name,
}
else {
#if defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
/* Try loading as a trusted peer certificate. */
ret = wolfSSL_CTX_trust_peer_cert(ctx, name, WOLFSSL_FILETYPE_PEM);
/* Try loading as a trusted peer certificate with the same
* verification setting as the CA load. */
ret = TrustPeerCertFile(ctx, name, WOLFSSL_FILETYPE_PEM, verify);
if (ret != 1) {
WOLFSSL_MSG("wolfSSL_CTX_trust_peer_cert error. "
"Ignoring this error.");
@@ -3298,14 +3330,21 @@ int wolfSSL_CTX_load_verify_locations_ex(WOLFSSL_CTX* ctx, const char* file,
}
#endif
#if defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
/* Load CA as a trusted peer certificate. */
if (ret == 1) {
/* Load CA as a trusted peer certificate. The verification
* setting computed above, including
* WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY, applies to the trusted
* peer copy too. */
#ifdef WOLFSSL_PEM_TO_DER
ret = wolfSSL_CTX_trust_peer_cert(ctx, file, WOLFSSL_FILETYPE_PEM);
ret = TrustPeerCertFile(ctx, file, WOLFSSL_FILETYPE_PEM,
verify);
#else
ret = wolfSSL_CTX_trust_peer_cert(ctx, file, WOLFSSL_FILETYPE_ASN1);
ret = TrustPeerCertFile(ctx, file, WOLFSSL_FILETYPE_ASN1,
verify);
#endif
if (ret != 1) {
WOLFSSL_MSG("wolfSSL_CTX_trust_peer_cert error");
if (ret != 1) {
WOLFSSL_MSG("wolfSSL_CTX_trust_peer_cert error");
}
}
#endif
}
@@ -3404,8 +3443,7 @@ int wolfSSL_CTX_trust_peer_cert(WOLFSSL_CTX* ctx, const char* file, int format)
ret = 0;
}
else {
ret = ProcessFile(ctx, file, format, TRUSTED_PEER_TYPE, NULL, 0, NULL,
GET_VERIFY_SETTING_CTX(ctx));
ret = TrustPeerCertFile(ctx, file, format, GET_VERIFY_SETTING_CTX(ctx));
}
return ret;
@@ -4262,6 +4300,48 @@ int wolfSSL_use_RSAPrivateKey_file(WOLFSSL* ssl, const char* file, int format)
#endif /* OPENSSL_EXTRA */
#if defined(WOLFSSL_TRUST_PEER_CERT)
/* Load a buffer of certificate/s as trusted peer certificates with the
* caller's verification setting.
*
* @param [in, out] ctx SSL context object.
* @param [in] in Buffer holding certificate/s.
* @param [in] sz Length of data in buffer in bytes.
* @param [in] format Format of data: WOLFSSL_FILETYPE_PEM or
* WOLFSSL_FILETYPE_ASN1.
* @param [in] verify How to verify the certificate/s.
* @return 1 on success.
* @return 0 on failure.
* @return BAD_FUNC_ARG when ctx or in is NULL, or sz is less than zero.
* @return Negative on error.
*/
static int TrustPeerCertBuffer(WOLFSSL_CTX* ctx, const unsigned char* in,
long sz, int format, int verify)
{
int ret;
/* Validate parameters. */
if ((ctx == NULL) || (in == NULL) || (sz < 0)) {
ret = BAD_FUNC_ARG;
}
else {
/* When PEM, treat as certificate chain of trusted peer
* certificates. */
if (format == WOLFSSL_FILETYPE_PEM) {
ret = ProcessChainBuffer(ctx, NULL, in, sz, TRUSTED_PEER_TYPE,
verify, "peer");
}
/* When DER, load the trusted peer certificate. */
else {
ret = ProcessBuffer(ctx, in, sz, format, TRUSTED_PEER_TYPE, NULL,
NULL, 0, verify, "peer");
}
}
return ret;
}
#endif /* WOLFSSL_TRUST_PEER_CERT */
/* Load a buffer of certificate/s into SSL context.
*
* @param [in, out] ctx SSL context object.
@@ -4310,8 +4390,10 @@ int wolfSSL_CTX_load_verify_buffer_ex(WOLFSSL_CTX* ctx, const unsigned char* in,
}
#if defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
if (ret == 1) {
/* Load certificate/s as trusted peer certificate. */
ret = wolfSSL_CTX_trust_peer_buffer(ctx, in, sz, format);
/* Load certificate/s as trusted peer certificate. The verification
* setting computed above, including WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY,
* applies to the trusted peer copy too. */
ret = TrustPeerCertBuffer(ctx, in, sz, format, verify);
}
#endif
@@ -4387,16 +4469,7 @@ int wolfSSL_CTX_trust_peer_buffer(WOLFSSL_CTX* ctx, const unsigned char* in,
verify = GET_VERIFY_SETTING_CTX(ctx);
#endif
/* When PEM, treat as certificate chain of trusted peer certificates. */
if (format == WOLFSSL_FILETYPE_PEM) {
ret = ProcessChainBuffer(ctx, NULL, in, sz, TRUSTED_PEER_TYPE,
verify, "peer");
}
/* When DER, load the trusted peer certificate. */
else {
ret = ProcessBuffer(ctx, in, sz, format, TRUSTED_PEER_TYPE, NULL,
NULL, 0, verify, "peer");
}
ret = TrustPeerCertBuffer(ctx, in, sz, format, verify);
}
return ret;

17
tests/api.c
View File

@@ -4600,6 +4600,23 @@ static int test_wolfSSL_CTX_load_verify_locations_ex(void)
ExpectIntEQ(wolfSSL_CTX_load_verify_locations_ex(ctx, ca_expired_cert, NULL,
WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY), WOLFSSL_SUCCESS);
#ifndef NO_ASN_TIME
/* A context that verifies peers must not defeat the flag: the
* effective verify setting, including skip-date, applies to the
* trusted-peer copy loaded for OpenSSL compatibility too. The
* trusted-peer copy is only attempted when built with
* WOLFSSL_TRUST_PEER_CERT and OPENSSL_COMPATIBLE_DEFAULTS; other
* builds exercise the CA copy only. */
wolfSSL_CTX_free(ctx);
ctx = NULL;
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL);
ExpectIntNE(wolfSSL_CTX_load_verify_locations_ex(ctx, ca_expired_cert, NULL,
WOLFSSL_LOAD_FLAG_NONE), WOLFSSL_SUCCESS);
ExpectIntEQ(wolfSSL_CTX_load_verify_locations_ex(ctx, ca_expired_cert, NULL,
WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY), WOLFSSL_SUCCESS);
#endif
wolfSSL_CTX_free(ctx);
#endif

764
tests/api/test_asn.c
View File

@@ -4926,6 +4926,770 @@ int test_wc_MakeCert_serial_encoding(void)
return EXPECT_RESULT();
}
/* Certificate fixtures for the parser tests below. Guarded like the tests
* that use them so builds without them do not carry unused data. */
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA)
static const byte sig_oid_base[] = {
0x30, 0x82, 0x03, 0x17, 0x30, 0x82, 0x01, 0xff, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x0a, 0x91, 0x99, 0x9c, 0xbb, 0xa9, 0x20, 0x1f, 0xcb,
0xdd, 0xcf, 0xa5, 0xf0, 0x0b, 0x46, 0xe1, 0xcb, 0x1a, 0x18, 0x52, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x1b, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x10, 0x73, 0x69, 0x67, 0x6f, 0x69, 0x64, 0x2d, 0x62, 0x61,
0x73, 0x65, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x32,
0x36, 0x30, 0x39, 0x30, 0x37, 0x31, 0x36, 0x34, 0x30, 0x30, 0x33, 0x5a,
0x17, 0x0d, 0x33, 0x36, 0x30, 0x39, 0x30, 0x34, 0x31, 0x36, 0x34, 0x30,
0x30, 0x33, 0x5a, 0x30, 0x1b, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55,
0x04, 0x03, 0x0c, 0x10, 0x73, 0x69, 0x67, 0x6f, 0x69, 0x64, 0x2d, 0x62,
0x61, 0x73, 0x65, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x82, 0x01, 0x22,
0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a,
0x02, 0x82, 0x01, 0x01, 0x00, 0x8e, 0x40, 0x98, 0x0c, 0x0b, 0xff, 0xa5,
0x4f, 0x1d, 0x7f, 0x2c, 0x1e, 0xfa, 0xa1, 0x40, 0xd8, 0xfc, 0xc6, 0x86,
0xcc, 0x42, 0x39, 0x84, 0xf1, 0xc7, 0x6a, 0x92, 0xba, 0xd9, 0x0d, 0x78,
0xa8, 0x1a, 0xcd, 0x75, 0xeb, 0xe6, 0x18, 0x49, 0x85, 0x4b, 0x5d, 0x8d,
0xb6, 0x23, 0x1d, 0xc2, 0x53, 0x47, 0x48, 0x9c, 0xce, 0x47, 0xeb, 0x18,
0x2a, 0xa1, 0x0b, 0x90, 0x4a, 0x31, 0x86, 0x0b, 0xb3, 0xf0, 0x31, 0xa5,
0xa2, 0xad, 0x98, 0x0e, 0xf3, 0xe4, 0x7f, 0x86, 0x16, 0x39, 0x1b, 0xe6,
0x1f, 0xd9, 0xdb, 0xc0, 0x3e, 0x1b, 0x4d, 0x7c, 0x5c, 0x2d, 0xd2, 0xe0,
0xdd, 0x34, 0x0c, 0x2b, 0x24, 0x49, 0x88, 0xca, 0x8d, 0x46, 0x12, 0x7a,
0xaa, 0x94, 0x0a, 0x6e, 0xaf, 0x90, 0x02, 0x5d, 0xe8, 0x42, 0xd7, 0x3d,
0x18, 0x54, 0x0a, 0x10, 0xec, 0xe1, 0x4e, 0x83, 0x3d, 0xba, 0xc6, 0x83,
0x05, 0x65, 0xd5, 0xfc, 0xfc, 0x89, 0x67, 0xae, 0x06, 0x44, 0x44, 0x19,
0xf8, 0xaa, 0x4c, 0x15, 0xbc, 0xc4, 0x62, 0x50, 0x93, 0xc8, 0xce, 0x38,
0x50, 0x20, 0x06, 0x02, 0x24, 0xd5, 0x5a, 0x39, 0xa6, 0x64, 0x1f, 0x61,
0x03, 0xba, 0x6b, 0x7e, 0xf1, 0xd0, 0x76, 0xab, 0xc1, 0xcc, 0xce, 0x6f,
0x2a, 0x6d, 0x41, 0x96, 0xe1, 0x68, 0x29, 0x83, 0x9d, 0x4e, 0xa1, 0x7e,
0xef, 0x75, 0x8a, 0xdc, 0x3a, 0x28, 0xcf, 0xd9, 0xfd, 0x9c, 0x87, 0xbe,
0x2d, 0x9b, 0x52, 0x79, 0x70, 0x0e, 0xac, 0x5d, 0x44, 0x4f, 0xb9, 0x0d,
0x61, 0x11, 0x87, 0xd4, 0xd3, 0x1f, 0x76, 0xc5, 0x5c, 0xc7, 0xa5, 0x82,
0x72, 0xa9, 0x8e, 0x40, 0xe3, 0x95, 0x21, 0xf0, 0xb6, 0x65, 0x04, 0x53,
0x28, 0x54, 0xfd, 0x41, 0x98, 0x7b, 0xe5, 0xf0, 0xf1, 0x82, 0x0a, 0x0f,
0xcb, 0xef, 0x52, 0x5c, 0x47, 0xb4, 0x84, 0x2f, 0x87, 0x02, 0x03, 0x01,
0x00, 0x01, 0xa3, 0x53, 0x30, 0x51, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
0x0e, 0x04, 0x16, 0x04, 0x14, 0x63, 0x4c, 0x6f, 0x89, 0xa0, 0x7a, 0xe5,
0x62, 0x54, 0x33, 0x14, 0x25, 0xe6, 0xa0, 0xfe, 0x87, 0xb5, 0x80, 0xc3,
0x9e, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16,
0x80, 0x14, 0x63, 0x4c, 0x6f, 0x89, 0xa0, 0x7a, 0xe5, 0x62, 0x54, 0x33,
0x14, 0x25, 0xe6, 0xa0, 0xfe, 0x87, 0xb5, 0x80, 0xc3, 0x9e, 0x30, 0x0f,
0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03,
0x01, 0x01, 0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x8d,
0xf4, 0x79, 0x72, 0xc4, 0xc6, 0xae, 0x8f, 0x9a, 0x8c, 0x69, 0x06, 0x30,
0x53, 0x15, 0x47, 0x90, 0x97, 0x1d, 0x9e, 0xad, 0x38, 0xf8, 0x51, 0x34,
0x23, 0x4e, 0x9e, 0x11, 0x33, 0x6a, 0x7b, 0x51, 0xcf, 0x2f, 0x7f, 0x37,
0x85, 0xc9, 0xb4, 0x73, 0xc8, 0x2a, 0x90, 0x0e, 0x1e, 0xe7, 0xb6, 0x75,
0xf0, 0x82, 0x98, 0x02, 0x07, 0x5c, 0x8a, 0xf7, 0x19, 0x2d, 0x53, 0x09,
0x64, 0xc5, 0xbd, 0x2e, 0x3a, 0xa5, 0x28, 0x72, 0xaf, 0x2d, 0x19, 0x64,
0x3c, 0xcb, 0xe3, 0x0b, 0x49, 0xd0, 0x6e, 0x2b, 0x0a, 0xf1, 0x5e, 0xfe,
0xf4, 0xce, 0xde, 0x7d, 0xef, 0x5a, 0x53, 0xe9, 0xcb, 0x64, 0xa3, 0x90,
0x96, 0xbd, 0x0f, 0x43, 0x74, 0x68, 0x05, 0x73, 0xd4, 0xe6, 0x59, 0xca,
0x4e, 0x12, 0x7f, 0x6d, 0x78, 0x89, 0x11, 0xaf, 0xca, 0x16, 0x1c, 0x69,
0x8a, 0xed, 0xee, 0x59, 0x04, 0x9c, 0x23, 0xd1, 0x60, 0x53, 0x43, 0xb9,
0x17, 0xd4, 0x1b, 0xc3, 0x71, 0xd4, 0xd5, 0xb0, 0x8f, 0xb6, 0xf8, 0x1b,
0xd3, 0x2e, 0x7a, 0x4f, 0x04, 0xbd, 0x3d, 0xf1, 0x27, 0x31, 0xa5, 0xe5,
0xb2, 0xe5, 0x7f, 0xb0, 0x86, 0x2e, 0xdc, 0x20, 0x50, 0x1e, 0xcf, 0x3a,
0xe8, 0x84, 0xb1, 0xb3, 0x76, 0x38, 0x8b, 0xdb, 0x4c, 0x1f, 0x4b, 0x0e,
0x24, 0x7f, 0xbe, 0x2a, 0xa6, 0xde, 0xa1, 0xb4, 0x08, 0x4d, 0x28, 0x25,
0x49, 0x85, 0xfe, 0xaa, 0x4c, 0xb0, 0x88, 0x38, 0x3b, 0xeb, 0x55, 0xee,
0xfb, 0x37, 0x58, 0x45, 0xac, 0xc7, 0x3b, 0xa1, 0x18, 0xe6, 0xb5, 0xbb,
0x4c, 0x59, 0x6d, 0xb3, 0xe6, 0xf2, 0xfa, 0x14, 0x1a, 0x48, 0x52, 0x3e,
0xab, 0xe0, 0x74, 0xeb, 0x22, 0x92, 0x90, 0x0d, 0x2a, 0x03, 0x8b, 0xfd,
0x77, 0x9c, 0x2d, 0x7b, 0xb7, 0x03, 0x57, 0x39, 0xc1, 0xa7, 0x60, 0xe3,
0x7d, 0x58, 0x9d,
};
/* The same certificate with the tbs signatureAlgorithm patched to
* sha384WithRSAEncryption and the sha256 signature re-made over the
* patched encoding: the tbs and outer algorithms disagree while the
* signature is valid for the outer one. */
static const byte sig_oid_mismatch[] = {
0x30, 0x82, 0x03, 0x17, 0x30, 0x82, 0x01, 0xff, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x0a, 0x91, 0x99, 0x9c, 0xbb, 0xa9, 0x20, 0x1f, 0xcb,
0xdd, 0xcf, 0xa5, 0xf0, 0x0b, 0x46, 0xe1, 0xcb, 0x1a, 0x18, 0x52, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0c,
0x05, 0x00, 0x30, 0x1b, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x10, 0x73, 0x69, 0x67, 0x6f, 0x69, 0x64, 0x2d, 0x62, 0x61,
0x73, 0x65, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x32,
0x36, 0x30, 0x39, 0x30, 0x37, 0x31, 0x36, 0x34, 0x30, 0x30, 0x33, 0x5a,
0x17, 0x0d, 0x33, 0x36, 0x30, 0x39, 0x30, 0x34, 0x31, 0x36, 0x34, 0x30,
0x30, 0x33, 0x5a, 0x30, 0x1b, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55,
0x04, 0x03, 0x0c, 0x10, 0x73, 0x69, 0x67, 0x6f, 0x69, 0x64, 0x2d, 0x62,
0x61, 0x73, 0x65, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x82, 0x01, 0x22,
0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a,
0x02, 0x82, 0x01, 0x01, 0x00, 0x8e, 0x40, 0x98, 0x0c, 0x0b, 0xff, 0xa5,
0x4f, 0x1d, 0x7f, 0x2c, 0x1e, 0xfa, 0xa1, 0x40, 0xd8, 0xfc, 0xc6, 0x86,
0xcc, 0x42, 0x39, 0x84, 0xf1, 0xc7, 0x6a, 0x92, 0xba, 0xd9, 0x0d, 0x78,
0xa8, 0x1a, 0xcd, 0x75, 0xeb, 0xe6, 0x18, 0x49, 0x85, 0x4b, 0x5d, 0x8d,
0xb6, 0x23, 0x1d, 0xc2, 0x53, 0x47, 0x48, 0x9c, 0xce, 0x47, 0xeb, 0x18,
0x2a, 0xa1, 0x0b, 0x90, 0x4a, 0x31, 0x86, 0x0b, 0xb3, 0xf0, 0x31, 0xa5,
0xa2, 0xad, 0x98, 0x0e, 0xf3, 0xe4, 0x7f, 0x86, 0x16, 0x39, 0x1b, 0xe6,
0x1f, 0xd9, 0xdb, 0xc0, 0x3e, 0x1b, 0x4d, 0x7c, 0x5c, 0x2d, 0xd2, 0xe0,
0xdd, 0x34, 0x0c, 0x2b, 0x24, 0x49, 0x88, 0xca, 0x8d, 0x46, 0x12, 0x7a,
0xaa, 0x94, 0x0a, 0x6e, 0xaf, 0x90, 0x02, 0x5d, 0xe8, 0x42, 0xd7, 0x3d,
0x18, 0x54, 0x0a, 0x10, 0xec, 0xe1, 0x4e, 0x83, 0x3d, 0xba, 0xc6, 0x83,
0x05, 0x65, 0xd5, 0xfc, 0xfc, 0x89, 0x67, 0xae, 0x06, 0x44, 0x44, 0x19,
0xf8, 0xaa, 0x4c, 0x15, 0xbc, 0xc4, 0x62, 0x50, 0x93, 0xc8, 0xce, 0x38,
0x50, 0x20, 0x06, 0x02, 0x24, 0xd5, 0x5a, 0x39, 0xa6, 0x64, 0x1f, 0x61,
0x03, 0xba, 0x6b, 0x7e, 0xf1, 0xd0, 0x76, 0xab, 0xc1, 0xcc, 0xce, 0x6f,
0x2a, 0x6d, 0x41, 0x96, 0xe1, 0x68, 0x29, 0x83, 0x9d, 0x4e, 0xa1, 0x7e,
0xef, 0x75, 0x8a, 0xdc, 0x3a, 0x28, 0xcf, 0xd9, 0xfd, 0x9c, 0x87, 0xbe,
0x2d, 0x9b, 0x52, 0x79, 0x70, 0x0e, 0xac, 0x5d, 0x44, 0x4f, 0xb9, 0x0d,
0x61, 0x11, 0x87, 0xd4, 0xd3, 0x1f, 0x76, 0xc5, 0x5c, 0xc7, 0xa5, 0x82,
0x72, 0xa9, 0x8e, 0x40, 0xe3, 0x95, 0x21, 0xf0, 0xb6, 0x65, 0x04, 0x53,
0x28, 0x54, 0xfd, 0x41, 0x98, 0x7b, 0xe5, 0xf0, 0xf1, 0x82, 0x0a, 0x0f,
0xcb, 0xef, 0x52, 0x5c, 0x47, 0xb4, 0x84, 0x2f, 0x87, 0x02, 0x03, 0x01,
0x00, 0x01, 0xa3, 0x53, 0x30, 0x51, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
0x0e, 0x04, 0x16, 0x04, 0x14, 0x63, 0x4c, 0x6f, 0x89, 0xa0, 0x7a, 0xe5,
0x62, 0x54, 0x33, 0x14, 0x25, 0xe6, 0xa0, 0xfe, 0x87, 0xb5, 0x80, 0xc3,
0x9e, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16,
0x80, 0x14, 0x63, 0x4c, 0x6f, 0x89, 0xa0, 0x7a, 0xe5, 0x62, 0x54, 0x33,
0x14, 0x25, 0xe6, 0xa0, 0xfe, 0x87, 0xb5, 0x80, 0xc3, 0x9e, 0x30, 0x0f,
0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03,
0x01, 0x01, 0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x54,
0xa1, 0xc7, 0xde, 0xf4, 0x09, 0x98, 0xfe, 0xcb, 0x46, 0xb8, 0x5a, 0x43,
0xf7, 0x1d, 0x0a, 0x1f, 0xa7, 0xec, 0x8d, 0x84, 0x77, 0xcf, 0x23, 0xdb,
0xa8, 0x07, 0xaa, 0x7d, 0x33, 0x3a, 0xd0, 0x07, 0x42, 0x77, 0x48, 0x6e,
0xa3, 0xf0, 0xb2, 0x4a, 0xec, 0x52, 0x7c, 0x3f, 0x92, 0xc0, 0x27, 0xde,
0x75, 0xd8, 0x72, 0xf9, 0x51, 0x57, 0x08, 0xa4, 0xde, 0x33, 0x8a, 0xf3,
0xdf, 0x35, 0x29, 0xc7, 0x23, 0xd4, 0xcf, 0x05, 0x39, 0x97, 0x3a, 0xc7,
0x28, 0xa0, 0x6b, 0x25, 0x3c, 0xe7, 0x50, 0x0d, 0xca, 0x4a, 0xd3, 0xf4,
0xe5, 0x47, 0xcd, 0xc8, 0x97, 0xbe, 0x67, 0x11, 0x5f, 0x1e, 0x43, 0xed,
0x9d, 0x95, 0x10, 0xf0, 0x43, 0x1c, 0xbd, 0x57, 0x31, 0x4b, 0x5e, 0xe9,
0x63, 0x84, 0x8b, 0xba, 0xf4, 0xfe, 0x70, 0xe6, 0xa6, 0x5f, 0x0b, 0x8f,
0x47, 0x9a, 0x72, 0x2f, 0x51, 0x91, 0x66, 0xd8, 0xa4, 0xf9, 0xcc, 0x6d,
0x14, 0xf5, 0x3b, 0xd7, 0xa3, 0xd8, 0xbf, 0xb0, 0x14, 0x9d, 0x5e, 0x14,
0x5e, 0xc1, 0x78, 0x78, 0xdc, 0xca, 0x8c, 0xc8, 0x06, 0x45, 0x06, 0x4a,
0xf0, 0x5d, 0x63, 0xa8, 0x96, 0x24, 0x44, 0xcb, 0xf4, 0x0a, 0xaa, 0x38,
0x00, 0xbd, 0xf2, 0xdc, 0xa9, 0xd0, 0x0f, 0x59, 0x74, 0xc2, 0xbe, 0x8a,
0x27, 0xe5, 0x7d, 0x3f, 0x53, 0xac, 0xcc, 0x63, 0x13, 0xe9, 0x8c, 0x7c,
0x09, 0xe3, 0x84, 0x42, 0xfe, 0xc6, 0x2b, 0x59, 0x00, 0x02, 0x6b, 0xaa,
0x32, 0x5e, 0x6a, 0x29, 0x75, 0x0d, 0x3a, 0x12, 0x5e, 0x73, 0x5b, 0x22,
0x1d, 0xaf, 0x14, 0x6e, 0x9c, 0x0a, 0x72, 0xab, 0x09, 0xc4, 0xe3, 0xb6,
0xda, 0x1d, 0xfa, 0xb8, 0x3d, 0xff, 0x41, 0x5a, 0x1c, 0x62, 0xf2, 0xdb,
0x5b, 0x9c, 0x1b, 0x25, 0xc4, 0x35, 0x55, 0xa3, 0x74, 0xec, 0x0b, 0x17,
0xc7, 0x94, 0xe6,
};
static const byte empty_san_cert[] = {
0x30, 0x82, 0x02, 0xfd, 0x30, 0x82, 0x01, 0xe5, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x79, 0x26, 0x41, 0x29, 0xa5, 0x03, 0xff, 0x71, 0x75,
0x8e, 0xdd, 0x4b, 0x0c, 0xc6, 0x77, 0xf4, 0x59, 0x01, 0x2b, 0x4f, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x19, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x0e, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2d, 0x73, 0x61, 0x6e,
0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30,
0x39, 0x30, 0x37, 0x31, 0x36, 0x33, 0x39, 0x32, 0x38, 0x5a, 0x17, 0x0d,
0x33, 0x36, 0x30, 0x39, 0x30, 0x34, 0x31, 0x36, 0x33, 0x39, 0x32, 0x38,
0x5a, 0x30, 0x19, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x03,
0x0c, 0x0e, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2d, 0x73, 0x61, 0x6e, 0x2d,
0x74, 0x65, 0x73, 0x74, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09,
0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03,
0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01,
0x00, 0xc6, 0x5a, 0xe5, 0xb3, 0x07, 0xcf, 0x1c, 0xf4, 0xe5, 0xba, 0x5a,
0xc3, 0xc9, 0x29, 0x88, 0x01, 0x48, 0xdb, 0xfd, 0xaf, 0x19, 0x8c, 0x1b,
0xaf, 0xd4, 0xf7, 0xde, 0x33, 0xd7, 0xf2, 0x13, 0x82, 0x1a, 0xe1, 0x05,
0xa7, 0x0e, 0xe6, 0x9a, 0xd2, 0x02, 0xaa, 0x01, 0x40, 0xfc, 0x33, 0x49,
0x95, 0x1c, 0xe4, 0xc5, 0x7c, 0xea, 0x42, 0x57, 0x2e, 0x33, 0x5f, 0x99,
0xb5, 0xae, 0xb2, 0xc9, 0xe0, 0xc8, 0x24, 0xdf, 0x61, 0xa5, 0x3d, 0x8d,
0x39, 0x65, 0xaa, 0x67, 0xca, 0x9e, 0x2a, 0xe2, 0x5b, 0x61, 0xe7, 0xb1,
0xea, 0x09, 0x38, 0xce, 0xfa, 0x69, 0x56, 0x00, 0x4f, 0xff, 0xb0, 0xb1,
0x98, 0x29, 0xce, 0xeb, 0x18, 0x2b, 0xcc, 0x19, 0xda, 0x47, 0xb7, 0x6e,
0xd4, 0x9a, 0xac, 0xb0, 0xb5, 0x05, 0x16, 0x03, 0xdc, 0xc4, 0x34, 0xb5,
0xb5, 0x2e, 0xd2, 0xf4, 0x50, 0xb3, 0xfb, 0xe6, 0xe1, 0xe8, 0x61, 0x62,
0xd2, 0x53, 0x85, 0x9d, 0x99, 0x09, 0xd0, 0x3b, 0xa3, 0x45, 0x59, 0x07,
0x48, 0xf8, 0x42, 0x17, 0xac, 0xcb, 0x8f, 0xed, 0x2e, 0xf3, 0x10, 0x54,
0xff, 0x6e, 0x3d, 0x86, 0x73, 0xfa, 0x4d, 0x12, 0x03, 0x58, 0x52, 0x3e,
0x54, 0xf9, 0xea, 0xa1, 0x47, 0xb3, 0x9f, 0x4c, 0x1e, 0x58, 0x78, 0x7f,
0x2b, 0xd2, 0xce, 0xd3, 0xd2, 0xb0, 0x43, 0xaf, 0x97, 0x2e, 0x66, 0xfd,
0xbb, 0x1d, 0xfa, 0x42, 0x7b, 0x78, 0xeb, 0xa0, 0x99, 0xa8, 0x79, 0xb8,
0x71, 0x19, 0x11, 0x89, 0x2c, 0x44, 0x8e, 0x2d, 0x6a, 0x1b, 0x32, 0xe3,
0xda, 0x0d, 0xb1, 0x16, 0xe4, 0x61, 0x25, 0x23, 0x74, 0x1c, 0x46, 0xb1,
0x6f, 0x67, 0x44, 0x5a, 0xf6, 0xd9, 0x9d, 0xf0, 0x95, 0x2b, 0x08, 0xb2,
0xca, 0x79, 0x45, 0x17, 0x76, 0x6c, 0xe0, 0x1c, 0x7d, 0x76, 0x52, 0x4b,
0x50, 0xb1, 0x20, 0x42, 0x2b, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x3d,
0x30, 0x3b, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x09, 0x06, 0x03, 0x55,
0x1d, 0x11, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
0x0e, 0x04, 0x16, 0x04, 0x14, 0x71, 0xcf, 0x04, 0xd3, 0x4b, 0x5f, 0x79,
0x6d, 0x27, 0x77, 0x48, 0x79, 0x02, 0xa5, 0xe4, 0x5b, 0x6f, 0x59, 0x94,
0xe4, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x2a, 0x01, 0xee,
0x6d, 0x7d, 0xd5, 0x84, 0x17, 0x62, 0x92, 0x91, 0x51, 0x88, 0xcc, 0x41,
0xe6, 0xe2, 0x0c, 0x22, 0x73, 0xfa, 0x1a, 0x72, 0x29, 0x18, 0x13, 0x5b,
0xbd, 0x22, 0x27, 0xa7, 0x6d, 0x24, 0x01, 0x5f, 0xcf, 0x46, 0x72, 0xf5,
0x7d, 0x54, 0xf9, 0x7c, 0x0c, 0x3e, 0x38, 0xae, 0x10, 0x03, 0x28, 0x38,
0x3d, 0xb7, 0x83, 0xea, 0x93, 0xb0, 0x4b, 0x4a, 0x69, 0x7b, 0xee, 0xa3,
0x3d, 0xae, 0x86, 0xa2, 0x0a, 0xd0, 0x14, 0x91, 0x4d, 0x0e, 0x9e, 0xbd,
0xc5, 0xed, 0x69, 0xef, 0x4c, 0xf0, 0x9d, 0x9d, 0x66, 0xd8, 0xe4, 0x8f,
0x35, 0xbb, 0xef, 0xd6, 0xa4, 0x2f, 0x8f, 0xda, 0x36, 0xf4, 0xe8, 0xb9,
0xa4, 0x4d, 0x71, 0xe7, 0x38, 0xca, 0xc2, 0x41, 0x4a, 0xa6, 0x17, 0xb3,
0xa2, 0xbd, 0x2d, 0x4c, 0xd5, 0xec, 0xe7, 0xf8, 0x91, 0x9a, 0xe3, 0x01,
0x01, 0x26, 0x53, 0x19, 0xbe, 0x52, 0x57, 0xe7, 0xf3, 0xec, 0x8c, 0xed,
0xac, 0xf7, 0x6b, 0x1e, 0xbf, 0xa5, 0x52, 0x3b, 0x2d, 0x38, 0xc1, 0xce,
0x34, 0x9e, 0xad, 0x1b, 0x44, 0xe9, 0xe8, 0x57, 0x2b, 0x16, 0x9b, 0x69,
0x45, 0xda, 0xd1, 0xc9, 0x48, 0xaf, 0xa0, 0xc1, 0xfd, 0x4b, 0x0a, 0xc5,
0x8a, 0x52, 0xbf, 0x55, 0xa0, 0x99, 0x58, 0x14, 0x46, 0x89, 0x3e, 0x56,
0xe6, 0xcd, 0xec, 0xc4, 0x35, 0x24, 0x8e, 0x34, 0xfe, 0xe1, 0xbb, 0x0f,
0x76, 0x46, 0x0f, 0xdd, 0x98, 0x1f, 0x3a, 0x8e, 0x5c, 0x06, 0xee, 0x46,
0xce, 0x5a, 0x13, 0x9b, 0xee, 0x18, 0xad, 0xbf, 0x21, 0xcb, 0x53, 0x66,
0x0b, 0xbc, 0x60, 0x89, 0xf0, 0x32, 0x8e, 0x60, 0x5c, 0x69, 0x23, 0x38,
0xc7, 0xe9, 0x8d, 0xf1, 0x5e, 0xfe, 0x8b, 0x09, 0x2b, 0x9c, 0x29, 0xbe,
0x35, 0x13, 0x3f, 0x69, 0xf9, 0x40, 0xb9, 0x5b, 0xc2, 0x95, 0x8b, 0x98,
0xe8,
};
/* Offset of the subject RDN SET's length byte in mv_rdn_cert. */
#define MV_RDN_SET_LEN_IDX 151
/* Offset of the length byte of the subject RDN's first AttributeTypeAndValue
* SEQUENCE in mv_rdn_cert. */
#define MV_RDN_AVA_LEN_IDX 153
static const byte mv_rdn_cert[] = {
0x30, 0x82, 0x03, 0x61, 0x30, 0x82, 0x02, 0x49, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x15, 0xba, 0x38, 0x65, 0xcf, 0xf2, 0xa7, 0xe5, 0xa0,
0x39, 0x7e, 0x9b, 0x94, 0xdf, 0xb6, 0xf5, 0x77, 0x4a, 0x19, 0xf1, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x40, 0x31, 0x3e, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
0x06, 0x13, 0x02, 0x42, 0x47, 0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x0a,
0x0c, 0x0f, 0x49, 0x6e, 0x66, 0x6f, 0x4e, 0x6f, 0x74, 0x61, 0x72, 0x79,
0x20, 0x54, 0x65, 0x73, 0x74, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03,
0x0c, 0x12, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x20, 0x56, 0x61, 0x6c, 0x75,
0x65, 0x20, 0x52, 0x44, 0x4e, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d,
0x32, 0x36, 0x30, 0x39, 0x30, 0x37, 0x31, 0x36, 0x33, 0x39, 0x30, 0x33,
0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x39, 0x30, 0x34, 0x31, 0x36, 0x33,
0x39, 0x30, 0x33, 0x5a, 0x30, 0x40, 0x31, 0x3e, 0x30, 0x09, 0x06, 0x03,
0x55, 0x04, 0x06, 0x13, 0x02, 0x42, 0x47, 0x30, 0x16, 0x06, 0x03, 0x55,
0x04, 0x0a, 0x0c, 0x0f, 0x49, 0x6e, 0x66, 0x6f, 0x4e, 0x6f, 0x74, 0x61,
0x72, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74, 0x30, 0x19, 0x06, 0x03, 0x55,
0x04, 0x03, 0x0c, 0x12, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x20, 0x56, 0x61,
0x6c, 0x75, 0x65, 0x20, 0x52, 0x44, 0x4e, 0x20, 0x43, 0x41, 0x30, 0x82,
0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xdd, 0xe7, 0x98, 0x94, 0xbc,
0x75, 0xfd, 0xae, 0x97, 0xaa, 0xc6, 0x6c, 0x09, 0x9f, 0x80, 0x8b, 0x6a,
0x6b, 0x6c, 0x37, 0x59, 0x19, 0x04, 0x88, 0x3d, 0xf9, 0xcf, 0x96, 0x69,
0x14, 0x79, 0xe9, 0x00, 0x99, 0x09, 0x94, 0xc1, 0xf4, 0xe1, 0xfe, 0x35,
0x23, 0xd2, 0x17, 0x09, 0x77, 0x36, 0x64, 0xda, 0x44, 0x0c, 0xb3, 0x6f,
0xb3, 0xe4, 0xbd, 0x3e, 0xba, 0x32, 0x51, 0xbd, 0xc2, 0x76, 0x00, 0x2e,
0x08, 0xfc, 0x41, 0xc6, 0xfd, 0xe8, 0x59, 0xf7, 0x04, 0x38, 0x03, 0x62,
0x07, 0xa0, 0x19, 0x7c, 0xb8, 0x7b, 0xa6, 0xc5, 0x45, 0xd8, 0x6e, 0x35,
0x50, 0xbd, 0x85, 0xf3, 0x78, 0x29, 0xb0, 0x2e, 0x77, 0x57, 0x88, 0xa0,
0x50, 0x1f, 0x1e, 0x16, 0x76, 0xfd, 0xa0, 0x83, 0xbf, 0xc9, 0xc3, 0x09,
0x7f, 0x05, 0x97, 0xa3, 0xeb, 0xeb, 0x98, 0x3e, 0x98, 0xf7, 0x39, 0x87,
0xe5, 0xd5, 0xeb, 0x0f, 0x0f, 0x1e, 0xa9, 0x3c, 0x40, 0xcd, 0xa4, 0x89,
0xa1, 0x9f, 0x14, 0x91, 0xbe, 0x97, 0x88, 0xda, 0xaf, 0xff, 0xea, 0xf5,
0xb4, 0x49, 0x87, 0xff, 0x75, 0x94, 0x61, 0x70, 0xec, 0xaa, 0x9c, 0xde,
0x70, 0xc0, 0xa1, 0x5b, 0xbb, 0x3c, 0xd5, 0x52, 0xd7, 0xea, 0x22, 0xb1,
0xe1, 0x06, 0x28, 0xc6, 0xcf, 0x8a, 0x0c, 0x6f, 0xb7, 0x94, 0x54, 0xe0,
0x42, 0x66, 0xb9, 0x37, 0x37, 0xe0, 0x86, 0x88, 0x10, 0x6f, 0xa2, 0xa5,
0x69, 0xcb, 0x25, 0x91, 0x25, 0xae, 0xae, 0x70, 0xf9, 0x6f, 0x3a, 0xe8,
0xa4, 0xf4, 0x91, 0x5b, 0xb0, 0xca, 0x54, 0xf0, 0x30, 0xc7, 0x6d, 0x88,
0x0d, 0x6a, 0x94, 0xe5, 0xd6, 0x4d, 0x30, 0xff, 0xa4, 0xd2, 0x55, 0x1a,
0xb0, 0x48, 0x73, 0xd1, 0x46, 0x02, 0x6c, 0x5a, 0x79, 0x2f, 0xb4, 0xfb,
0x01, 0x63, 0xef, 0x3c, 0xb8, 0x2e, 0x68, 0x35, 0xf5, 0x97, 0xdd, 0x02,
0x03, 0x01, 0x00, 0x01, 0xa3, 0x53, 0x30, 0x51, 0x30, 0x1d, 0x06, 0x03,
0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xfc, 0x7e, 0xb4, 0x94, 0x34,
0xa8, 0x05, 0xd7, 0xac, 0x7c, 0x88, 0x5c, 0xec, 0x46, 0x3f, 0x39, 0xb5,
0x23, 0x4c, 0x32, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18,
0x30, 0x16, 0x80, 0x14, 0xfc, 0x7e, 0xb4, 0x94, 0x34, 0xa8, 0x05, 0xd7,
0xac, 0x7c, 0x88, 0x5c, 0xec, 0x46, 0x3f, 0x39, 0xb5, 0x23, 0x4c, 0x32,
0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05,
0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01,
0x00, 0x8e, 0xa2, 0xa9, 0x08, 0xfe, 0xc6, 0x57, 0xd2, 0x3e, 0xd6, 0x30,
0x14, 0x12, 0x88, 0x5d, 0x65, 0x9f, 0xfd, 0x21, 0xac, 0x2e, 0x93, 0x70,
0x1f, 0xd3, 0x7c, 0x29, 0x92, 0x60, 0x3b, 0xcc, 0xb3, 0xaf, 0xe5, 0xc5,
0x18, 0x1d, 0x8c, 0x83, 0x49, 0xf2, 0xa1, 0xcd, 0x71, 0x6f, 0x66, 0xc1,
0x41, 0x9a, 0xbf, 0x82, 0xe8, 0xaa, 0x53, 0x70, 0x9e, 0xaa, 0xfa, 0x0e,
0x08, 0x8f, 0x53, 0x6f, 0x63, 0x39, 0x12, 0x0c, 0x1a, 0x0f, 0x44, 0x33,
0xa0, 0x06, 0xf9, 0xb6, 0x15, 0xb4, 0x79, 0x66, 0x75, 0x7d, 0x83, 0x4b,
0xe9, 0xf4, 0xf6, 0xff, 0xac, 0xe2, 0x23, 0x84, 0xdc, 0x8e, 0x50, 0xd9,
0x8d, 0x50, 0xfb, 0xbf, 0x80, 0xdd, 0x9d, 0xb9, 0xd8, 0x34, 0x11, 0x29,
0x27, 0xfe, 0x00, 0xf3, 0xfa, 0xf6, 0xc9, 0x69, 0xdb, 0xa2, 0xee, 0xd3,
0xdb, 0x23, 0x19, 0x25, 0x9b, 0x00, 0xa5, 0x4f, 0x36, 0x4f, 0xae, 0x10,
0x4f, 0x5a, 0x4c, 0xe2, 0x43, 0x25, 0xad, 0x57, 0x83, 0x39, 0xcf, 0xb1,
0x89, 0x89, 0x8b, 0x4e, 0xde, 0xab, 0xd8, 0x90, 0x16, 0x77, 0xd1, 0x2f,
0xcc, 0x0c, 0xf6, 0x0c, 0xbe, 0xd4, 0x98, 0x44, 0x65, 0x5e, 0x0e, 0x66,
0x12, 0x62, 0x27, 0xd6, 0x9e, 0x4b, 0x72, 0x7a, 0xf6, 0xdf, 0xd7, 0xe5,
0xa0, 0x41, 0xaa, 0x21, 0x8f, 0xa8, 0x4e, 0xa0, 0xf0, 0x6a, 0x6c, 0xa2,
0x37, 0xf3, 0xec, 0x0d, 0xe6, 0xf3, 0xd9, 0xeb, 0xa1, 0x6f, 0x56, 0x6c,
0x08, 0x46, 0x5b, 0x49, 0x2f, 0x2f, 0x8b, 0x0e, 0xda, 0xb1, 0xd1, 0x9c,
0xc0, 0x14, 0xb2, 0xfb, 0x80, 0x45, 0x06, 0x33, 0x13, 0x18, 0x99, 0x22,
0xeb, 0x7a, 0x0d, 0x07, 0x87, 0x52, 0x72, 0x7f, 0x92, 0x31, 0x57, 0x0a,
0x73, 0x94, 0x48, 0xe9, 0x92, 0x21, 0xc1, 0x5a, 0x36, 0xdf, 0xef, 0xa5,
0x50, 0x33, 0xa4, 0x99, 0x86,
};
static const byte qc_statements_cert[] = {
0x30, 0x82, 0x03, 0x13, 0x30, 0x82, 0x01, 0xfb, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x35, 0xa4, 0x48, 0x33, 0x48, 0xea, 0x7c, 0x36, 0xbc,
0x16, 0x85, 0x72, 0x09, 0x08, 0xbf, 0x3f, 0xa9, 0x08, 0x70, 0x8d, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x1d, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x12, 0x71, 0x63, 0x2d, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d,
0x65, 0x6e, 0x74, 0x73, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x30, 0x1e, 0x17,
0x0d, 0x32, 0x36, 0x30, 0x39, 0x30, 0x37, 0x31, 0x36, 0x33, 0x39, 0x32,
0x33, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x39, 0x30, 0x34, 0x31, 0x36,
0x33, 0x39, 0x32, 0x33, 0x5a, 0x30, 0x1d, 0x31, 0x1b, 0x30, 0x19, 0x06,
0x03, 0x55, 0x04, 0x03, 0x0c, 0x12, 0x71, 0x63, 0x2d, 0x73, 0x74, 0x61,
0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2d, 0x74, 0x65, 0x73, 0x74,
0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00,
0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xc4, 0x83, 0x7a,
0x84, 0x1a, 0xc5, 0xf8, 0x6d, 0x84, 0x05, 0xff, 0x6d, 0xb7, 0x40, 0xae,
0x9c, 0x72, 0x27, 0xab, 0x32, 0x70, 0xfa, 0xa6, 0x6e, 0xe6, 0xe7, 0x19,
0xdc, 0xf6, 0xf2, 0xaa, 0xd7, 0x40, 0x21, 0xbe, 0x04, 0x36, 0xea, 0xf0,
0x28, 0x87, 0xab, 0x87, 0x97, 0xc2, 0xc3, 0x5f, 0xf3, 0x2e, 0x0d, 0xc1,
0x2a, 0x95, 0x49, 0xfe, 0x64, 0xd3, 0xb3, 0x6b, 0xd8, 0x31, 0xa1, 0xf4,
0x26, 0xf5, 0x3c, 0x42, 0x3b, 0x69, 0x36, 0xda, 0x41, 0x80, 0xfc, 0x04,
0xe7, 0xf7, 0x9c, 0x77, 0x75, 0x41, 0x01, 0xb3, 0xd6, 0x2e, 0x80, 0x60,
0x90, 0x30, 0xbd, 0x4a, 0xa7, 0x0e, 0xa8, 0x8b, 0xa8, 0x29, 0x0b, 0x33,
0x56, 0x02, 0x5f, 0x5c, 0x17, 0xeb, 0xa4, 0x0f, 0xe3, 0x8e, 0x6c, 0x93,
0x85, 0xff, 0x3b, 0xd2, 0x29, 0x83, 0x32, 0x49, 0xf3, 0xfa, 0x1d, 0xa0,
0x45, 0x45, 0x68, 0x25, 0xa9, 0xa6, 0x99, 0x63, 0xed, 0xa9, 0xdc, 0xe8,
0xc4, 0xf4, 0x3d, 0x42, 0xb9, 0x65, 0xd1, 0x4e, 0x8e, 0x50, 0x3a, 0xc1,
0xf1, 0xae, 0xbe, 0xdf, 0x94, 0x65, 0x68, 0x7e, 0x3a, 0x45, 0xca, 0xb4,
0x81, 0x16, 0x24, 0x23, 0xbd, 0xf1, 0xe1, 0x7a, 0x1b, 0xe1, 0x58, 0xb3,
0x14, 0xc9, 0x27, 0x1d, 0x9e, 0xe5, 0xd5, 0x2c, 0x04, 0xf6, 0x7a, 0xba,
0x82, 0xb2, 0x8e, 0x2b, 0xd7, 0x86, 0x2e, 0x4b, 0x99, 0x35, 0xb5, 0x33,
0xe5, 0x03, 0x04, 0x94, 0x16, 0xe9, 0xf0, 0xfc, 0xb1, 0x84, 0xa3, 0xf7,
0x72, 0x10, 0x05, 0x72, 0xb6, 0xcd, 0xab, 0x07, 0x1a, 0xf1, 0xe5, 0x52,
0xc0, 0x74, 0xfa, 0x7d, 0x3e, 0xf8, 0x3d, 0xa6, 0xc6, 0xd1, 0xe1, 0xf3,
0x09, 0xc3, 0x47, 0x60, 0x10, 0x7c, 0xb7, 0x6e, 0x04, 0x61, 0xea, 0x92,
0xff, 0xf4, 0x06, 0x60, 0xe3, 0x98, 0xe0, 0xf1, 0x0a, 0xb4, 0xb6, 0x57,
0x29, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x4b, 0x30, 0x49, 0x30, 0x0f,
0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03,
0x01, 0x01, 0xff, 0x30, 0x17, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
0x07, 0x01, 0x03, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x02, 0x01,
0x00, 0x0c, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04,
0x16, 0x04, 0x14, 0x94, 0x4c, 0xfb, 0x92, 0x28, 0x3c, 0x1a, 0x0b, 0x0f,
0x3d, 0x7c, 0x95, 0x3b, 0x55, 0xce, 0x40, 0x39, 0x26, 0x48, 0xf2, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x3b, 0x7c, 0xc3, 0xf1, 0x85,
0x06, 0x51, 0x6a, 0x37, 0xaf, 0xc2, 0xc6, 0x9c, 0x28, 0x4e, 0xff, 0x01,
0x8e, 0x8a, 0xf4, 0xdd, 0xf4, 0x02, 0x1a, 0xd4, 0x67, 0x57, 0x76, 0xf4,
0x09, 0x70, 0x1a, 0xca, 0x7a, 0x8b, 0x52, 0x8d, 0x69, 0x7b, 0xcc, 0x54,
0xec, 0xf5, 0xb8, 0x45, 0xa7, 0xac, 0x12, 0x22, 0xf4, 0x26, 0x69, 0xb8,
0x52, 0xf5, 0x35, 0x13, 0xce, 0x8e, 0x8d, 0xf3, 0xdd, 0xf8, 0xd1, 0x56,
0xa1, 0x70, 0x81, 0xd4, 0x7b, 0xdd, 0x33, 0x35, 0xbc, 0x2b, 0xf7, 0x68,
0x3d, 0x57, 0xf8, 0xea, 0x18, 0x72, 0xe9, 0x48, 0x4a, 0x07, 0x41, 0x3e,
0x89, 0xd8, 0x13, 0xe8, 0x86, 0x84, 0x25, 0x94, 0x6b, 0x8d, 0x76, 0xfa,
0x1f, 0xe4, 0x58, 0xef, 0x9c, 0x7d, 0x32, 0xde, 0x19, 0xd8, 0xf1, 0xe0,
0xe4, 0x2c, 0x1b, 0x61, 0x3b, 0x31, 0xe7, 0x92, 0x1f, 0xc4, 0x80, 0x1c,
0xcd, 0x54, 0x71, 0xd3, 0x95, 0xfd, 0x14, 0xf4, 0xbc, 0x7b, 0xc1, 0x0b,
0xd4, 0x54, 0xbc, 0xc9, 0x7a, 0x08, 0xb4, 0x5c, 0x8f, 0xab, 0x62, 0x16,
0x08, 0x8e, 0x8d, 0xb5, 0xec, 0x06, 0x68, 0xa5, 0x28, 0x3a, 0x97, 0xc3,
0x9b, 0xe7, 0x27, 0x7a, 0x69, 0x56, 0xb5, 0xd3, 0x3c, 0x36, 0xf4, 0x66,
0x11, 0xf1, 0xe2, 0xb5, 0xa8, 0xc7, 0xf2, 0x35, 0xdc, 0x8b, 0x37, 0xfb,
0xbe, 0x01, 0xd4, 0xf3, 0xb9, 0xbc, 0x77, 0x00, 0x7f, 0x29, 0x6f, 0xe8,
0xca, 0x2c, 0x30, 0x00, 0xa8, 0x81, 0xe1, 0x98, 0xf0, 0x8d, 0xe3, 0x2e,
0x74, 0x78, 0x06, 0x98, 0x6d, 0x62, 0xb5, 0xb6, 0x2c, 0xb4, 0x5f, 0xe9,
0xf8, 0x94, 0xce, 0x07, 0x73, 0xfa, 0xc8, 0xed, 0xf9, 0xcd, 0x9e, 0x63,
0xd0, 0x55, 0x0e, 0x68, 0xf0, 0xbf, 0xbd, 0x2a, 0x22, 0xd8, 0xf6, 0x14,
0x26, 0xbc, 0x54, 0x5d, 0x3f, 0x85, 0xae, 0xb8, 0xb4, 0x88, 0xfe,
};
#if !defined(IGNORE_NAME_CONSTRAINTS) && \
(!defined(WOLFSSL_X509_TINY) || \
defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
/* CA certificate whose DER orders Name Constraints before Basic
* Constraints. RFC 5280 4.2.1.10 allows name constraints in a CA
* certificate; the encoding order of the two extensions is not
* significant. */
static const byte nc_before_bc_ca_cert[] = {
0x30, 0x82, 0x03, 0x99, 0x30, 0x82, 0x02, 0x81, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x53, 0x66, 0x44, 0xc3, 0x8f, 0x51, 0x14, 0xf2, 0x1d,
0xff, 0x88, 0x4d, 0x61, 0xa3, 0x3e, 0x4d, 0x1b, 0x87, 0x3c, 0x41, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x5b, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55,
0x04, 0x0a, 0x0c, 0x0c, 0x77, 0x6f, 0x6c, 0x66, 0x53, 0x53, 0x4c, 0x20,
0x54, 0x65, 0x73, 0x74, 0x31, 0x35, 0x30, 0x33, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x2c, 0x4e, 0x61, 0x6d, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x73,
0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x20, 0x42, 0x65, 0x66, 0x6f,
0x72, 0x65, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 0x20, 0x43, 0x6f, 0x6e,
0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x20, 0x43, 0x41, 0x30,
0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x39, 0x30, 0x39, 0x31, 0x30, 0x30,
0x35, 0x30, 0x38, 0x5a, 0x17, 0x0d, 0x34, 0x36, 0x30, 0x39, 0x30, 0x34,
0x31, 0x30, 0x30, 0x35, 0x30, 0x38, 0x5a, 0x30, 0x5b, 0x31, 0x0b, 0x30,
0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x15,
0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0c, 0x77, 0x6f, 0x6c,
0x66, 0x53, 0x53, 0x4c, 0x20, 0x54, 0x65, 0x73, 0x74, 0x31, 0x35, 0x30,
0x33, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x2c, 0x4e, 0x61, 0x6d, 0x65,
0x20, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73,
0x20, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x20, 0x42, 0x61, 0x73, 0x69,
0x63, 0x20, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74,
0x73, 0x20, 0x43, 0x41, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09,
0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03,
0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01,
0x00, 0xdc, 0x98, 0xdd, 0x37, 0x11, 0xe0, 0x8b, 0xac, 0x3b, 0xdc, 0x7c,
0xb4, 0xd5, 0x6d, 0x12, 0x9d, 0xbd, 0x36, 0x5b, 0x7d, 0x11, 0xaf, 0x08,
0x54, 0x0e, 0x89, 0x26, 0x21, 0xbb, 0xc0, 0xaf, 0xd4, 0x83, 0xa2, 0x6a,
0x4f, 0x43, 0xf6, 0x00, 0x51, 0x87, 0xfa, 0x32, 0x82, 0xb5, 0xe9, 0x1b,
0x9b, 0x43, 0x19, 0x85, 0x91, 0xbc, 0xfc, 0xa3, 0x56, 0x77, 0x3f, 0x53,
0x0f, 0x5a, 0x7f, 0x77, 0x6f, 0xb4, 0xc9, 0x4d, 0x30, 0xcf, 0x53, 0x63,
0x09, 0x1b, 0x53, 0x46, 0x88, 0xa4, 0x34, 0x71, 0x31, 0x50, 0xa0, 0x6e,
0xd3, 0x57, 0x85, 0xf6, 0xd3, 0x7b, 0xe6, 0xe7, 0xea, 0xbd, 0x60, 0x13,
0xcb, 0xfb, 0x1e, 0xe6, 0x87, 0x3f, 0x12, 0x5f, 0x8c, 0x0f, 0x49, 0x55,
0x9d, 0x6f, 0xa7, 0xe6, 0x53, 0xa0, 0xc6, 0x53, 0x33, 0x6a, 0x38, 0x1a,
0x8a, 0x81, 0x60, 0x1f, 0x0c, 0xde, 0x16, 0xbf, 0x2b, 0x6d, 0xe6, 0xce,
0x73, 0x85, 0xf9, 0x2c, 0x83, 0xa6, 0x25, 0xc1, 0xa5, 0x98, 0x86, 0x05,
0x34, 0xfa, 0xe7, 0xb5, 0x0a, 0x57, 0x5d, 0x9f, 0x8f, 0xb8, 0x05, 0x62,
0x4f, 0xd2, 0x93, 0x13, 0x2c, 0x0c, 0x46, 0xa4, 0x1d, 0x68, 0x6d, 0xbf,
0xea, 0xa5, 0x70, 0xe7, 0xd7, 0x58, 0xc8, 0xc6, 0x25, 0xb9, 0xc4, 0x08,
0x37, 0xfc, 0xb4, 0x9c, 0xc6, 0x2e, 0x31, 0x37, 0x90, 0xde, 0xdf, 0xfa,
0x37, 0x94, 0xbc, 0x5b, 0x48, 0x4e, 0x89, 0x45, 0xd7, 0xd7, 0x72, 0x39,
0x11, 0x14, 0xa0, 0x7e, 0xd2, 0xdf, 0xa2, 0xdf, 0xd8, 0xc1, 0x20, 0x30,
0xd0, 0x80, 0x48, 0x6f, 0x98, 0x48, 0xc0, 0x92, 0x3d, 0xd3, 0xb8, 0x66,
0xfc, 0x09, 0xcc, 0x0e, 0x26, 0x1d, 0xed, 0xd4, 0x2a, 0xb3, 0x4e, 0x50,
0x05, 0xe7, 0x2a, 0x4c, 0xfe, 0x0f, 0xfb, 0x7a, 0x50, 0xae, 0xf3, 0xed,
0x9d, 0x61, 0xd1, 0xb4, 0xcf, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x55,
0x30, 0x53, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x1d, 0x1e, 0x01, 0x01, 0xff,
0x04, 0x14, 0x30, 0x12, 0xa0, 0x10, 0x30, 0x0e, 0x82, 0x0c, 0x2e, 0x65,
0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x12,
0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06,
0x01, 0x01, 0xff, 0x02, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
0x0e, 0x04, 0x16, 0x04, 0x14, 0x26, 0xba, 0xc0, 0x83, 0xcb, 0x42, 0x42,
0x50, 0xf0, 0xc6, 0x0c, 0x10, 0xfa, 0x6e, 0x6c, 0x1e, 0x7e, 0xa2, 0xe5,
0x9c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xb6, 0x88, 0xfe,
0x2e, 0x22, 0xfb, 0xb1, 0xd6, 0xbe, 0x81, 0xa4, 0x81, 0xba, 0xb6, 0xac,
0x5d, 0x3d, 0x61, 0x4f, 0x1b, 0xc0, 0x9f, 0x02, 0xa0, 0x04, 0x49, 0x89,
0x6e, 0x1a, 0x45, 0x5d, 0x33, 0x7f, 0x5b, 0x2f, 0x74, 0x7c, 0xb1, 0x23,
0xec, 0x21, 0x3a, 0xef, 0xea, 0xd1, 0x91, 0xaf, 0xae, 0x17, 0x0b, 0xde,
0xe9, 0x1e, 0x4e, 0xb7, 0x6a, 0x52, 0xb7, 0xdb, 0xb5, 0x9d, 0x4b, 0x16,
0x2c, 0xd8, 0x7a, 0x8e, 0x81, 0xb4, 0xa9, 0x3a, 0x82, 0x19, 0x25, 0xc2,
0x0f, 0x30, 0xaf, 0x1c, 0xcc, 0xe3, 0x51, 0xd5, 0xa3, 0xb7, 0xc7, 0x88,
0xd9, 0x46, 0x64, 0x9c, 0x93, 0x02, 0x8e, 0x46, 0x6e, 0x6b, 0x35, 0x70,
0x3d, 0x4d, 0xec, 0x7c, 0x07, 0x95, 0x1f, 0xc2, 0x76, 0x0e, 0x1d, 0xcd,
0xa3, 0x39, 0xe6, 0x16, 0x0c, 0x1b, 0xda, 0x36, 0xd1, 0xcb, 0xf5, 0x0b,
0xb8, 0xbb, 0x68, 0x49, 0x54, 0xaf, 0x60, 0xec, 0xdb, 0xaf, 0x0e, 0x58,
0xcd, 0x4e, 0xf2, 0xe6, 0x8b, 0x52, 0x7d, 0xd4, 0xa5, 0x8e, 0x90, 0x43,
0x46, 0xe4, 0x44, 0x62, 0xed, 0xad, 0x95, 0x79, 0x19, 0x04, 0x33, 0x47,
0x3f, 0xf7, 0xad, 0x90, 0xb4, 0xb2, 0xc2, 0x3e, 0xdd, 0x46, 0x0f, 0x60,
0xcc, 0x84, 0x51, 0xcb, 0x46, 0x85, 0xf8, 0x12, 0x0e, 0xac, 0xfd, 0x50,
0xb3, 0x30, 0x0b, 0x96, 0x45, 0x69, 0xad, 0x8e, 0x7c, 0x9d, 0xb0, 0x3a,
0x64, 0xef, 0x50, 0x41, 0x99, 0xd0, 0x97, 0x2f, 0x56, 0x60, 0xa1, 0x41,
0x7f, 0xd8, 0x0a, 0x16, 0x0e, 0xb2, 0xbf, 0x8c, 0xe7, 0xb8, 0x8a, 0xbc,
0xa3, 0xc3, 0x1d, 0x73, 0x5b, 0xda, 0x8b, 0x02, 0x81, 0x47, 0xbc, 0x7a,
0xa2, 0xf3, 0x2d, 0x9d, 0x0a, 0x24, 0x7f, 0x1f, 0xa6, 0x44, 0xe3, 0x93,
0xb5, 0x21, 0x63, 0x71, 0xcf, 0xd5, 0xe2, 0x95, 0x6b, 0xbc, 0xfb, 0x36,
0x54,
};
#ifndef WOLFSSL_NO_ASN_STRICT
/* Same shape but CA:FALSE: name constraints in a non-CA certificate,
* which RFC 5280 4.2.1.10 forbids. */
static const byte nc_before_bc_non_ca_cert[] = {
0x30, 0x82, 0x03, 0x69, 0x30, 0x82, 0x02, 0x51, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x34, 0x7e, 0x45, 0xe9, 0x01, 0x42, 0x86, 0xda, 0x87,
0x76, 0x00, 0xd8, 0xe7, 0x9d, 0xf2, 0x20, 0x74, 0x8a, 0xa8, 0x41, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x46, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55,
0x04, 0x0a, 0x0c, 0x0c, 0x77, 0x6f, 0x6c, 0x66, 0x53, 0x53, 0x4c, 0x20,
0x54, 0x65, 0x73, 0x74, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x17, 0x4e, 0x61, 0x6d, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x73,
0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x20, 0x4e, 0x6f, 0x6e, 0x20,
0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x39, 0x30, 0x39,
0x31, 0x30, 0x30, 0x35, 0x30, 0x38, 0x5a, 0x17, 0x0d, 0x34, 0x36, 0x30,
0x39, 0x30, 0x34, 0x31, 0x30, 0x30, 0x35, 0x30, 0x38, 0x5a, 0x30, 0x46,
0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
0x53, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0c,
0x77, 0x6f, 0x6c, 0x66, 0x53, 0x53, 0x4c, 0x20, 0x54, 0x65, 0x73, 0x74,
0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x17, 0x4e,
0x61, 0x6d, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69,
0x6e, 0x74, 0x73, 0x20, 0x4e, 0x6f, 0x6e, 0x20, 0x43, 0x41, 0x30, 0x82,
0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xdc, 0x98, 0xdd, 0x37, 0x11,
0xe0, 0x8b, 0xac, 0x3b, 0xdc, 0x7c, 0xb4, 0xd5, 0x6d, 0x12, 0x9d, 0xbd,
0x36, 0x5b, 0x7d, 0x11, 0xaf, 0x08, 0x54, 0x0e, 0x89, 0x26, 0x21, 0xbb,
0xc0, 0xaf, 0xd4, 0x83, 0xa2, 0x6a, 0x4f, 0x43, 0xf6, 0x00, 0x51, 0x87,
0xfa, 0x32, 0x82, 0xb5, 0xe9, 0x1b, 0x9b, 0x43, 0x19, 0x85, 0x91, 0xbc,
0xfc, 0xa3, 0x56, 0x77, 0x3f, 0x53, 0x0f, 0x5a, 0x7f, 0x77, 0x6f, 0xb4,
0xc9, 0x4d, 0x30, 0xcf, 0x53, 0x63, 0x09, 0x1b, 0x53, 0x46, 0x88, 0xa4,
0x34, 0x71, 0x31, 0x50, 0xa0, 0x6e, 0xd3, 0x57, 0x85, 0xf6, 0xd3, 0x7b,
0xe6, 0xe7, 0xea, 0xbd, 0x60, 0x13, 0xcb, 0xfb, 0x1e, 0xe6, 0x87, 0x3f,
0x12, 0x5f, 0x8c, 0x0f, 0x49, 0x55, 0x9d, 0x6f, 0xa7, 0xe6, 0x53, 0xa0,
0xc6, 0x53, 0x33, 0x6a, 0x38, 0x1a, 0x8a, 0x81, 0x60, 0x1f, 0x0c, 0xde,
0x16, 0xbf, 0x2b, 0x6d, 0xe6, 0xce, 0x73, 0x85, 0xf9, 0x2c, 0x83, 0xa6,
0x25, 0xc1, 0xa5, 0x98, 0x86, 0x05, 0x34, 0xfa, 0xe7, 0xb5, 0x0a, 0x57,
0x5d, 0x9f, 0x8f, 0xb8, 0x05, 0x62, 0x4f, 0xd2, 0x93, 0x13, 0x2c, 0x0c,
0x46, 0xa4, 0x1d, 0x68, 0x6d, 0xbf, 0xea, 0xa5, 0x70, 0xe7, 0xd7, 0x58,
0xc8, 0xc6, 0x25, 0xb9, 0xc4, 0x08, 0x37, 0xfc, 0xb4, 0x9c, 0xc6, 0x2e,
0x31, 0x37, 0x90, 0xde, 0xdf, 0xfa, 0x37, 0x94, 0xbc, 0x5b, 0x48, 0x4e,
0x89, 0x45, 0xd7, 0xd7, 0x72, 0x39, 0x11, 0x14, 0xa0, 0x7e, 0xd2, 0xdf,
0xa2, 0xdf, 0xd8, 0xc1, 0x20, 0x30, 0xd0, 0x80, 0x48, 0x6f, 0x98, 0x48,
0xc0, 0x92, 0x3d, 0xd3, 0xb8, 0x66, 0xfc, 0x09, 0xcc, 0x0e, 0x26, 0x1d,
0xed, 0xd4, 0x2a, 0xb3, 0x4e, 0x50, 0x05, 0xe7, 0x2a, 0x4c, 0xfe, 0x0f,
0xfb, 0x7a, 0x50, 0xae, 0xf3, 0xed, 0x9d, 0x61, 0xd1, 0xb4, 0xcf, 0x02,
0x03, 0x01, 0x00, 0x01, 0xa3, 0x4f, 0x30, 0x4d, 0x30, 0x1e, 0x06, 0x03,
0x55, 0x1d, 0x1e, 0x01, 0x01, 0xff, 0x04, 0x14, 0x30, 0x12, 0xa0, 0x10,
0x30, 0x0e, 0x82, 0x0c, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d,
0x0e, 0x04, 0x16, 0x04, 0x14, 0x26, 0xba, 0xc0, 0x83, 0xcb, 0x42, 0x42,
0x50, 0xf0, 0xc6, 0x0c, 0x10, 0xfa, 0x6e, 0x6c, 0x1e, 0x7e, 0xa2, 0xe5,
0x9c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xa6, 0xc0, 0xf7,
0xed, 0x0a, 0x7c, 0x56, 0xa9, 0xc4, 0xdc, 0xc1, 0xb2, 0x33, 0xff, 0x1e,
0x88, 0x3c, 0xc3, 0x86, 0x79, 0x5a, 0x6a, 0xba, 0x73, 0xb1, 0xc8, 0x53,
0x18, 0x01, 0x54, 0xcc, 0x83, 0xb3, 0xe1, 0xde, 0x2c, 0x69, 0xa4, 0x45,
0x35, 0x0a, 0xdd, 0xc3, 0xe6, 0x8e, 0xe0, 0xf8, 0xba, 0xd6, 0xbc, 0xbd,
0xf6, 0xad, 0x02, 0x35, 0xd3, 0xd9, 0xe4, 0xb0, 0x7c, 0x65, 0x13, 0x1c,
0xad, 0x29, 0x7d, 0xbd, 0x49, 0x0c, 0x81, 0xa3, 0xf5, 0xcb, 0xc2, 0x3c,
0x43, 0x42, 0x9c, 0x3d, 0xd6, 0x15, 0xa4, 0x8d, 0x8d, 0x19, 0x15, 0xae,
0x84, 0x0f, 0xbc, 0x58, 0x85, 0xb7, 0x03, 0xd1, 0xb3, 0x81, 0xfc, 0xed,
0xed, 0x10, 0x71, 0x07, 0xe5, 0x98, 0xb6, 0xca, 0x71, 0x6d, 0xfe, 0xb7,
0xbe, 0x78, 0x8d, 0x16, 0xe9, 0x64, 0xc1, 0x20, 0xb9, 0x6a, 0xf7, 0xdc,
0x88, 0x75, 0xdf, 0x0f, 0x90, 0xf7, 0x61, 0xcd, 0x15, 0x58, 0xe5, 0x38,
0xae, 0x2d, 0x4e, 0x18, 0x29, 0xc9, 0xbc, 0x6a, 0xd6, 0x44, 0xed, 0x58,
0x59, 0x3b, 0x78, 0xaf, 0x23, 0xa0, 0x82, 0x10, 0xcc, 0x43, 0xdc, 0x1c,
0xe0, 0x38, 0xf6, 0x73, 0xcd, 0xe9, 0xc1, 0x72, 0xb6, 0xd4, 0xb8, 0x49,
0x4b, 0x8e, 0x39, 0x26, 0x8d, 0xac, 0x13, 0x69, 0x02, 0x04, 0xbf, 0xfd,
0x97, 0x2b, 0xc4, 0x55, 0xa6, 0xf7, 0x84, 0x4a, 0x72, 0xb4, 0x3c, 0x11,
0x74, 0x86, 0xc1, 0xd3, 0xb9, 0xd1, 0x97, 0x63, 0x92, 0x63, 0x5f, 0x5b,
0xf8, 0x68, 0xc1, 0x8c, 0x71, 0xa8, 0xf9, 0xef, 0x85, 0xc9, 0x59, 0x44,
0x50, 0x09, 0xa4, 0xe6, 0x6c, 0x31, 0xfd, 0xe2, 0x46, 0x74, 0x80, 0x85,
0x72, 0x53, 0x5a, 0x1d, 0x0d, 0xad, 0x17, 0x24, 0xaa, 0xb0, 0x50, 0xd6,
0x1b, 0xe6, 0xd4, 0x03, 0x9e, 0x01, 0x67, 0x83, 0x74, 0x80, 0x7c, 0xd6,
0x84,
};
#endif /* !WOLFSSL_NO_ASN_STRICT */
#endif /* !IGNORE_NAME_CONSTRAINTS && name constraints supported */
#endif /* !NO_ASN && !NO_CERTS && !NO_RSA */
/*
* A tbs signatureAlgorithm that differs from the outer signatureAlgorithm.
* RFC 5280 4.1.1.2 and 4.1.2.3 require the two to match. Only the tbs copy
* is covered by the signature, so a mismatch must be rejected rather than
* resolved in favour of either field. The variant below claims
* sha384WithRSAEncryption inside the tbs while the certificate is really
* signed with the outer sha256WithRSAEncryption.
*/
int test_ParseCert_tbs_sig_oid_mismatch(void)
{
EXPECT_DECLS;
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA)
DecodedCert cert;
WOLFSSL_CERT_MANAGER* cm;
/* Control: the original certificate parses and keeps the signature
* algorithm. */
wc_InitDecodedCert(&cert, sig_oid_base, (word32)sizeof(sig_oid_base),
NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL), 0);
ExpectIntEQ(cert.signatureOID, CTC_SHA256wRSA);
wc_FreeDecodedCert(&cert);
/* Mismatch variant: tbs says sha384, outer (and the real signature)
* say sha256. RFC 5280 4.1.1.2 and 4.1.2.3 require the two to match.
* Only the tbs copy is covered by the signature, so a mismatch must be
* rejected rather than resolved in favour of either field. */
wc_InitDecodedCert(&cert, sig_oid_mismatch,
(word32)sizeof(sig_oid_mismatch), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_SIG_OID_E));
wc_FreeDecodedCert(&cert);
/* The mismatch is rejected on load too, so it can never reach
* signature verification. */
cm = wolfSSL_CertManagerNew();
ExpectNotNull(cm);
if (cm != NULL) {
ExpectIntNE(wolfSSL_CertManagerLoadCABuffer_ex(cm, sig_oid_mismatch,
(long)sizeof(sig_oid_mismatch), WOLFSSL_FILETYPE_ASN1, 0,
WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY), WOLFSSL_SUCCESS);
wolfSSL_CertManagerFree(cm);
}
#endif
return EXPECT_RESULT();
}
/*
* A certificate with an empty subjectAltName (SEQUENCE OF with no members).
* RFC 5280 4.2.1.6 requires at least one entry and GeneralNames is
* SEQUENCE SIZE (1..MAX), so parsing must fail.
*/
int test_ParseCert_empty_san(void)
{
EXPECT_DECLS;
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA)
DecodedCert cert;
/* RFC 5280 4.2.1.6: if the subjectAltName extension is present the
* sequence MUST contain at least one entry, and GeneralNames is
* SEQUENCE SIZE (1..MAX). An empty one is rejected. */
wc_InitDecodedCert(&cert, empty_san_cert, (word32)sizeof(empty_san_cert),
NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_PARSE_E));
wc_FreeDecodedCert(&cert);
#ifdef OPENSSL_EXTRA
/* Rejected on load, so it never reaches name checking. */
ExpectNull(wolfSSL_X509_d2i(NULL, empty_san_cert,
(int)sizeof(empty_san_cert)));
#endif
#endif
return EXPECT_RESULT();
}
/*
* A certificate whose subject packs several AttributeTypeAndValues into one
* SET (multi-valued RDN). RFC 5280 4.1.2.4 defines a
* RelativeDistinguishedName as SET SIZE (1..MAX) OF AttributeTypeAndValue,
* so parsing must succeed with every attribute stored, while an
* AttributeTypeAndValue outside the SET must be rejected.
*/
int test_ParseCert_multi_valued_rdn(void)
{
EXPECT_DECLS;
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA)
DecodedCert cert;
/* RFC 5280 4.1.2.4: RelativeDistinguishedName is
* SET SIZE (1..MAX) OF AttributeTypeAndValue, so one SET may hold
* several attributes. */
wc_InitDecodedCert(&cert, mv_rdn_cert, (word32)sizeof(mv_rdn_cert), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL), 0);
/* All three attributes of the packed RDN were stored. */
ExpectNotNull(XSTRSTR(cert.subject, "InfoNotary Test"));
ExpectNotNull(XSTRSTR(cert.subject, "Multi Value RDN CA"));
ExpectNotNull(XSTRSTR(cert.subject, "BG"));
ExpectNotNull(XSTRSTR(cert.issuer, "InfoNotary Test"));
wc_FreeDecodedCert(&cert);
/* Negative: same certificate with the subject RDN's SET length reduced
* so its third AttributeTypeAndValue sits after the SET ends, where
* RDNSequence requires a SET. Parsing must stop at the SET boundary and
* reject it, not absorb the stray attribute into the RDN.
*
* Template parser only. The original parser retries an
* AttributeTypeAndValue that lacks a SET header as a bare SEQUENCE, so
* it accepts this encoding. */
#ifdef WOLFSSL_ASN_TEMPLATE
{
byte bad[sizeof(mv_rdn_cert)];
XMEMCPY(bad, mv_rdn_cert, sizeof(mv_rdn_cert));
/* Subject RDN SET content length: 3 attributes -> 2. */
ExpectIntEQ(bad[MV_RDN_SET_LEN_IDX], 0x3e);
bad[MV_RDN_SET_LEN_IDX] = 0x23;
wc_InitDecodedCert(&cert, bad, (word32)sizeof(bad), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_PARSE_E));
wc_FreeDecodedCert(&cert);
/* Negative: first AttributeTypeAndValue SEQUENCE extended to hold
* the second one. The nested AttributeTypeAndValue is trailing data
* of the first, not a member of the SET. */
XMEMCPY(bad, mv_rdn_cert, sizeof(mv_rdn_cert));
ExpectIntEQ(bad[MV_RDN_AVA_LEN_IDX], 0x09);
ExpectIntEQ(bad[MV_RDN_AVA_LEN_IDX + 11], 0x16);
bad[MV_RDN_AVA_LEN_IDX] = 0x09 + 2 + 0x16;
wc_InitDecodedCert(&cert, bad, (word32)sizeof(bad), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_PARSE_E));
wc_FreeDecodedCert(&cert);
}
#endif
#endif
return EXPECT_RESULT();
}
/*
* Name constraints are valid in a CA certificate regardless of where the
* Basic Constraints extension sits in the DER. RFC 5280 4.2.1.10 restricts
* the extension to CA certificates, so the decision needs isCA, which comes
* from Basic Constraints and may be encoded later.
*/
int test_ParseCert_nc_before_basic_constraints(void)
{
EXPECT_DECLS;
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA) && \
!defined(IGNORE_NAME_CONSTRAINTS) && \
(!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
DecodedCert cert;
/* CA certificate: name constraints precede basic constraints. */
wc_InitDecodedCert(&cert, nc_before_bc_ca_cert,
(word32)sizeof(nc_before_bc_ca_cert), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL), 0);
ExpectIntEQ(cert.isCA, 1);
ExpectIntEQ(cert.extNameConstraintSet, 1);
wc_FreeDecodedCert(&cert);
/* It also loads as a CA. The load needs a TLS method for its
* temporary context. */
#if !defined(NO_TLS) && \
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER))
{
WOLFSSL_CERT_MANAGER* cm = wolfSSL_CertManagerNew();
ExpectNotNull(cm);
if (cm != NULL) {
ExpectIntEQ(wolfSSL_CertManagerLoadCABuffer_ex(cm,
nc_before_bc_ca_cert, (long)sizeof(nc_before_bc_ca_cert),
WOLFSSL_FILETYPE_ASN1, 0, WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY),
WOLFSSL_SUCCESS);
wolfSSL_CertManagerFree(cm);
}
}
#endif
/* Same ordering but CA:FALSE is still rejected. */
#ifndef WOLFSSL_NO_ASN_STRICT
wc_InitDecodedCert(&cert, nc_before_bc_non_ca_cert,
(word32)sizeof(nc_before_bc_non_ca_cert), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_NAME_INVALID_E));
wc_FreeDecodedCert(&cert);
#endif
#endif
return EXPECT_RESULT();
}
/*
* A certificate with a critical qcStatements extension (1.3.6.1.5.5.7.1.3,
* RFC 3739 3.2.6). The statements are not processed, and RFC 5280 4.2
* requires rejecting a critical extension whose information cannot be
* processed, so parsing must fail.
*/
int test_ParseCert_critical_qc_statements(void)
{
EXPECT_DECLS;
#if !defined(NO_ASN) && !defined(NO_CERTS) && !defined(NO_RSA)
DecodedCert cert;
/* RFC 5280 4.2: a critical extension whose information cannot be
* processed must be rejected. RFC 3739 3.2.6 makes every statement in a
* critical qcStatements critical, and the statements are not processed,
* so the certificate is flagged. */
wc_InitDecodedCert(&cert, qc_statements_cert,
(word32)sizeof(qc_statements_cert), NULL);
ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
WC_NO_ERR_TRACE(ASN_CRIT_EXT_E));
wc_FreeDecodedCert(&cert);
#endif
return EXPECT_RESULT();
}
/*
* MC/DC wave 2 - decision-targeted negative paths for PKCS#8 wrap/parse
* and RSA key decode. Targets argument-check, short-buffer, and

10
tests/api/test_asn.h
View File

@@ -46,6 +46,11 @@ int test_ParseCert_SM3wSM2_short_pubkey(void);
int test_ParseCert_dnBufferBoundary(void);
int test_ParseCert_nameComponentIds(void);
int test_ParseCert_issuerNameNoField(void);
int test_ParseCert_tbs_sig_oid_mismatch(void);
int test_ParseCert_empty_san(void);
int test_ParseCert_multi_valued_rdn(void);
int test_ParseCert_critical_qc_statements(void);
int test_ParseCert_nc_before_basic_constraints(void);
int test_wc_DecodeObjectId(void);
int test_SetCertificatePolicies_no_empty_qualifiers(void);
int test_ToTraditional_ex_handcrafted(void);
@@ -86,6 +91,11 @@ int test_wc_AltNameNewEx(void);
TEST_DECL_GROUP("asn", test_ParseCert_dnBufferBoundary), \
TEST_DECL_GROUP("asn", test_ParseCert_nameComponentIds), \
TEST_DECL_GROUP("asn", test_ParseCert_issuerNameNoField), \
TEST_DECL_GROUP("asn", test_ParseCert_tbs_sig_oid_mismatch), \
TEST_DECL_GROUP("asn", test_ParseCert_empty_san), \
TEST_DECL_GROUP("asn", test_ParseCert_multi_valued_rdn), \
TEST_DECL_GROUP("asn", test_ParseCert_critical_qc_statements), \
TEST_DECL_GROUP("asn", test_ParseCert_nc_before_basic_constraints), \
TEST_DECL_GROUP("asn", test_wc_DecodeObjectId), \
TEST_DECL_GROUP("asn", test_SetCertificatePolicies_no_empty_qualifiers), \
TEST_DECL_GROUP("asn", test_ToTraditional_ex_handcrafted), \

6
tests/api/test_certman.c
View File

@@ -442,11 +442,9 @@ int test_wolfSSL_CertManagerLoadCABuffer_ex(void)
ExpectIntEQ(ret, WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
#elif defined(NO_RSA)
ExpectIntEQ(ret, WC_NO_ERR_TRACE(ASN_UNKNOWN_OID_E));
#elif !(WOLFSSL_LOAD_VERIFY_DEFAULT_FLAGS && \
WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY) && !defined(NO_ASN_TIME) && \
defined(WOLFSSL_TRUST_PEER_CERT) && defined(OPENSSL_COMPATIBLE_DEFAULTS)
ExpectIntEQ(ret, WC_NO_ERR_TRACE(ASN_AFTER_DATE_E));
#else
/* The flag applies to the trusted-peer copy loaded for OpenSSL
* compatibility too: no date re-check. */
ExpectIntEQ(ret, WOLFSSL_SUCCESS);
#endif

203
wolfcrypt/src/asn.c
View File

@@ -15149,6 +15149,22 @@ enum {
/* Number of items in ASN.1 template for an RDN. */
#define rdnASN_Length (sizeof(rdnASN) / sizeof(ASNItem))
/* ASN.1 template for an AttributeTypeAndValue parsed on its own.
* Used for the extra AVAs of a multi-valued RDN, where one SET holds
* several AttributeTypeAndValues. Items are aligned onto rdnASN data at
* RDNASN_IDX_ATTR_SEQ by passing dataASN + RDNASN_IDX_ATTR_SEQ.
*/
static const ASNItem avaASN[] = {
/* ATTR_SEQ */ { 0, ASN_SEQUENCE, 1, 1, 0 },
/* AttributeType */
/* ATTR_TYPE */ { 1, ASN_OBJECT_ID, 0, 0, 0 },
/* AttributeValue: Choice of tags - rdnChoice. */
/* ATTR_VAL */ { 1, 0, 0, 0, 0 },
};
/* Number of items in ASN.1 template for an AttributeTypeAndValue. */
#define avaASN_Length (sizeof(avaASN) / sizeof(ASNItem))
/* Supported types of encodings (tags) for RDN strings.
* X.509: RFC 5280, 4.1.2.4 - DirectoryString
* (IA5 String not listed in RFC but required for alternative types)
@@ -15820,6 +15836,73 @@ static int GetRDN(DecodedCert* cert, char* full, word32* idx, int* nid,
return ret;
}
/* Add the attribute value last parsed into an X509_NAME.
*
* @param [in, out] dName X509_NAME to add to. NULL is ignored.
* @param [in] nid OpenSSL NID of the attribute type. 0 when unknown,
* in which case nothing is added.
* @param [in] val Parsed attribute value (rdnChoice data).
* @return 0 on success.
* @return ASN_PARSE_E when the string is empty or the entry could not be
* added.
*/
#ifdef WOLFSSL_X509_NAME_AVAILABLE
static int AddRDNToName(WOLFSSL_X509_NAME* dName, int nid, ASNGetData* val)
{
int ret = 0;
int enc;
const byte* str;
word32 strLen;
byte tag = val->tag;
/* Get string reference. */
GetASN_GetRef(val, &str, &strLen);
/* Strip the BIT STRING unused-bits count octet before the length check
* below. GetRDN() has already validated the tag and that the value is
* byte aligned. */
if ((tag == ASN_BIT_STRING) && (strLen > 0)) {
str++;
strLen--;
}
#ifndef WOLFSSL_NO_ASN_STRICT
/* RFC 5280 section 4.1.2.4 lists a DirectoryString as being
* 1..MAX in length */
if (strLen < 1) {
WOLFSSL_MSG("Non conforming DirectoryString of length 0 was found");
WOLFSSL_MSG("Use WOLFSSL_NO_ASN_STRICT if wanting to allow empty "
"DirectoryString's");
return ASN_PARSE_E;
}
#endif
/* Convert BER tag to a OpenSSL type. */
switch (tag) {
case CTC_UTF8:
enc = WOLFSSL_MBSTRING_UTF8;
break;
case CTC_PRINTABLE:
enc = WOLFSSL_V_ASN1_PRINTABLESTRING;
break;
case ASN_BIT_STRING:
enc = WOLFSSL_V_ASN1_BIT_STRING;
break;
default:
WOLFSSL_MSG("Unknown encoding type, default UTF8");
enc = WOLFSSL_MBSTRING_UTF8;
}
if ((nid != 0) && (dName != NULL)) {
/* Add an entry to the X509_NAME. */
if (wolfSSL_X509_NAME_add_entry_by_NID(dName, nid, enc, str,
(int)strLen, -1, -1) != WOLFSSL_SUCCESS) {
ret = ASN_PARSE_E;
}
}
return ret;
}
#endif /* WOLFSSL_X509_NAME_AVAILABLE */
#endif /* WOLFSSL_ASN_TEMPLATE */
/* Get a certificate name into the certificate object.
@@ -15905,14 +15988,30 @@ static int GetCertName(DecodedCert* cert, char* full, byte* hash, int nameType,
/* Process all RDNs in name. */
while ((ret == 0) && (srcIdx < maxIdx)) {
int nid = 0;
/* End of the SET holding this RDN's AttributeTypeAndValues. */
word32 setEnd = 0;
/* Initialize for data and setup RDN choice. */
GetASN_Choice(&dataASN[RDNASN_IDX_ATTR_VAL], rdnChoice);
/* Ignore type OID as too many to store in table. */
GetASN_OID(&dataASN[RDNASN_IDX_ATTR_TYPE], oidIgnoreType);
/* Parse RDN. */
ret = GetASN_Items(rdnASN, dataASN, rdnASN_Length, 1, input,
/* Parse the SET and its first AttributeTypeAndValue. The SET is
* not required to be fully used: RFC 5280 4.1.2.4 defines an RDN
* as SET SIZE (1..MAX) OF AttributeTypeAndValue, so a
* multi-valued RDN holds more than one. */
ret = GetASN_Items(rdnASN, dataASN, rdnASN_Length, 0, input,
&srcIdx, maxIdx);
if (ret == 0) {
/* SET contents start at its first member. */
setEnd = dataASN[RDNASN_IDX_ATTR_SEQ].offset +
dataASN[RDNASN_IDX_SET].length;
/* Not parsing completely, so check the first
* AttributeTypeAndValue has no trailing data. */
if (srcIdx != dataASN[RDNASN_IDX_ATTR_TYPE].offset +
dataASN[RDNASN_IDX_ATTR_SEQ].length) {
ret = ASN_PARSE_E;
}
}
if (ret == 0) {
/* Put RDN data into certificate. */
ret = GetRDN(cert, full, &idx, &nid, nameType == ASN_SUBJECT,
@@ -15922,58 +16021,34 @@ static int GetCertName(DecodedCert* cert, char* full, byte* hash, int nameType,
/* TODO: push this back up to ssl.c
* (do parsing for WOLFSSL_X509_NAME on demand) */
if (ret == 0) {
int enc;
const byte* str;
word32 strLen;
byte tag = dataASN[RDNASN_IDX_ATTR_VAL].tag;
/* Get string reference. */
GetASN_GetRef(&dataASN[RDNASN_IDX_ATTR_VAL], &str, &strLen);
/* Strip the BIT STRING unused-bits count octet before the
* length check below. GetRDN() has already validated the tag
* and that the value is byte aligned. */
if ((tag == ASN_BIT_STRING) && (strLen > 0)) {
str++;
strLen--;
}
#ifndef WOLFSSL_NO_ASN_STRICT
/* RFC 5280 section 4.1.2.4 lists a DirectoryString as being
* 1..MAX in length */
if (ret == 0 && strLen < 1) {
WOLFSSL_MSG("Non conforming DirectoryString of length 0 was"
" found");
WOLFSSL_MSG("Use WOLFSSL_NO_ASN_STRICT if wanting to allow"
" empty DirectoryString's");
ret = ASN_PARSE_E;
}
#endif
/* Convert BER tag to a OpenSSL type. */
switch (tag) {
case CTC_UTF8:
enc = WOLFSSL_MBSTRING_UTF8;
break;
case CTC_PRINTABLE:
enc = WOLFSSL_V_ASN1_PRINTABLESTRING;
break;
case ASN_BIT_STRING:
enc = WOLFSSL_V_ASN1_BIT_STRING;
break;
default:
WOLFSSL_MSG("Unknown encoding type, default UTF8");
enc = WOLFSSL_MBSTRING_UTF8;
}
if ((ret == 0) && (nid != 0)) {
/* Add an entry to the X509_NAME. */
if (wolfSSL_X509_NAME_add_entry_by_NID(dName, nid, enc, str,
(int)strLen, -1, -1) != WOLFSSL_SUCCESS) {
ret = ASN_PARSE_E;
}
}
ret = AddRDNToName(dName, nid, &dataASN[RDNASN_IDX_ATTR_VAL]);
}
#endif
/* Remaining AttributeTypeAndValues of a multi-valued RDN. Bound
* by the SET so an AttributeTypeAndValue outside it is not
* folded into this RDN. */
while ((ret == 0) && (srcIdx < setEnd)) {
/* Each AttributeTypeAndValue starts with no NID: an unknown
* type OID must not be filed under the previous entry's
* NID. */
nid = 0;
GetASN_Choice(&dataASN[RDNASN_IDX_ATTR_VAL], rdnChoice);
GetASN_OID(&dataASN[RDNASN_IDX_ATTR_TYPE], oidIgnoreType);
/* avaASN items align onto the rdnASN data items. */
ret = GetASN_Items(avaASN, dataASN + RDNASN_IDX_ATTR_SEQ,
avaASN_Length, 1, input, &srcIdx, setEnd);
if (ret == 0) {
ret = GetRDN(cert, full, &idx, &nid,
nameType == ASN_SUBJECT, dataASN);
}
#ifdef WOLFSSL_X509_NAME_AVAILABLE
if (ret == 0) {
ret = AddRDNToName(dName, nid,
&dataASN[RDNASN_IDX_ATTR_VAL]);
}
#endif
}
}
}
if (ret == 0) {
@@ -23201,16 +23276,10 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
defined(WOLFSSL_X509_TINY_NAME_CONSTRAINTS))
/* Name constraints. */
case NAME_CONS_OID:
#ifndef WOLFSSL_NO_ASN_STRICT
/* Verify RFC 5280 Sec 4.2.1.10 rule:
"The name constraints extension,
which MUST be used only in a CA certificate" */
if (!cert->isCA) {
WOLFSSL_MSG("Name constraints allowed only for CA certs");
WOLFSSL_ERROR_VERBOSE(ASN_NAME_INVALID_E);
ret = ASN_NAME_INVALID_E;
}
#endif
/* RFC 5280 Sec 4.2.1.10 requires name constraints only in a CA
* certificate. Checked after all extensions are decoded: isCA
* comes from basic constraints, which may be encoded after this
* extension. */
VERIFY_AND_SET_OID(cert->extNameConstraintSet);
cert->extNameConstraintCrit = critical ? 1 : 0;
if (DecodeNameConstraints(input, length, cert) < 0) {
@@ -23493,6 +23562,16 @@ static int DecodeCertExtensions(DecodedCert* cert)
}
}
#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(IGNORE_NAME_CONSTRAINTS)
/* RFC 5280 Sec 4.2.1.10: "The name constraints extension, which MUST be
* used only in a CA certificate". */
if ((ret == 0) && cert->extNameConstraintSet && (!cert->isCA)) {
WOLFSSL_MSG("Name constraints allowed only for CA certs");
WOLFSSL_ERROR_VERBOSE(ASN_NAME_INVALID_E);
ret = ASN_NAME_INVALID_E;
}
#endif
if (ret == 0) {
/* Use criticality return. */
ret = criticalRet;

12
wolfcrypt/src/asn_orig.c
View File

@@ -4510,6 +4510,18 @@ static int DecodeCertExtensions(DecodedCert* cert)
}
ret = criticalFail ? ASN_CRIT_EXT_E : 0;
#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(IGNORE_NAME_CONSTRAINTS)
/* RFC 5280 Sec 4.2.1.10: "The name constraints extension, which MUST be
* used only in a CA certificate". Checked here rather than while walking
* the extensions: isCA comes from basic constraints, which may be encoded
* after name constraints. */
if (cert->extNameConstraintSet && (!cert->isCA)) {
WOLFSSL_MSG("Name constraints allowed only for CA certs");
WOLFSSL_ERROR_VERBOSE(ASN_NAME_INVALID_E);
ret = ASN_NAME_INVALID_E;
}
#endif
end:
return ret;
}