Skip to content

Commit dc421a0

Browse files
SparkiDevSparkiDev
authored
Merge pull request #9164 from dgarske/keytoder
Add support for enabling RSA private key to DER without keygen
2 parents a17b10e + 3e63bc6 commit dc421a0

File tree

9 files changed

+130
-66
lines changed

9 files changed

+130
-66
lines changed

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,7 @@ WOLFSSL_IMXRT_DCP
737737
WOLFSSL_ISOTP
738738
WOLFSSL_KEIL
739739
WOLFSSL_KEIL_NET
740+
WOLFSSL_KEY_TO_DER
740741
WOLFSSL_KYBER_NO_DECAPSULATE
741742
WOLFSSL_KYBER_NO_ENCAPSULATE
742743
WOLFSSL_KYBER_NO_MAKE_KEY

‎tests/api.c‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12963,18 +12963,16 @@ static int test_tls_bad_legacy_version(void)
1296312963
static int test_wolfSSL_X509_NAME_get_entry(void)
1296412964
{
1296512965
EXPECT_DECLS;
12966-
#if !defined(NO_CERTS) && !defined(NO_RSA)
12966+
#if !defined(NO_CERTS) && !defined(NO_RSA) && !defined(NO_FILESYSTEM)
1296712967
#if defined(OPENSSL_ALL) || \
1296812968
(defined(OPENSSL_EXTRA) && \
1296912969
(defined(KEEP_PEER_CERT) || defined(SESSION_CERTS)))
1297012970
/* use openssl like name to test mapping */
1297112971
X509_NAME_ENTRY* ne = NULL;
1297212972
X509_NAME* name = NULL;
1297312973
X509* x509 = NULL;
12974-
#ifndef NO_FILESYSTEM
1297512974
ASN1_STRING* asn = NULL;
1297612975
char* subCN = NULL;
12977-
#endif
1297812976
int idx = 0;
1297912977
ASN1_OBJECT *object = NULL;
1298012978
#if defined(WOLFSSL_APACHE_HTTPD) || defined(OPENSSL_ALL) || \
@@ -12984,7 +12982,6 @@ static int test_wolfSSL_X509_NAME_get_entry(void)
1298412982
#endif
1298512983
#endif
1298612984

12987-
#ifndef NO_FILESYSTEM
1298812985
ExpectNotNull(x509 = wolfSSL_X509_load_certificate_file(cliCertFile,
1298912986
WOLFSSL_FILETYPE_PEM));
1299012987
ExpectNotNull(name = X509_get_subject_name(x509));
@@ -12995,7 +12992,6 @@ static int test_wolfSSL_X509_NAME_get_entry(void)
1299512992
ExpectNotNull(subCN = (char*)ASN1_STRING_data(asn));
1299612993
wolfSSL_FreeX509(x509);
1299712994
x509 = NULL;
12998-
#endif
1299912995

1300012996
ExpectNotNull(x509 = wolfSSL_X509_load_certificate_file(cliCertFile,
1300112997
WOLFSSL_FILETYPE_PEM));
@@ -13020,7 +13016,7 @@ static int test_wolfSSL_X509_NAME_get_entry(void)
1302013016
ExpectNotNull(object = X509_NAME_ENTRY_get_object(ne));
1302113017
wolfSSL_FreeX509(x509);
1302213018
#endif /* OPENSSL_ALL || (OPENSSL_EXTRA && (KEEP_PEER_CERT || SESSION_CERTS) */
13023-
#endif /* !NO_CERTS && !NO_RSA */
13019+
#endif /* !NO_CERTS && !NO_RSA && !NO_FILESYSTEM */
1302413020

1302513021
return EXPECT_RESULT();
1302613022
}
@@ -16953,7 +16949,8 @@ static int test_wolfSSL_X509_check_private_key(void)
1695316949
{
1695416950
EXPECT_DECLS;
1695516951
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA) && \
16956-
defined(USE_CERT_BUFFERS_2048) && !defined(NO_CHECK_PRIVATE_KEY)
16952+
defined(USE_CERT_BUFFERS_2048) && !defined(NO_CHECK_PRIVATE_KEY) && \
16953+
!defined(NO_FILESYSTEM)
1695716954
X509* x509 = NULL;
1695816955
EVP_PKEY* pkey = NULL;
1695916956
const byte* key;
@@ -19943,7 +19940,7 @@ static int test_wolfSSL_X509_STORE_CTX_trusted_stack_cleanup(void)
1994319940
static int test_wolfSSL_X509_STORE_CTX_get_issuer(void)
1994419941
{
1994519942
EXPECT_DECLS;
19946-
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA)
19943+
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_FILESYSTEM)
1994719944
X509_STORE_CTX* ctx = NULL;
1994819945
X509_STORE* str = NULL;
1994919946
X509* x509Ca = NULL;
@@ -20612,7 +20609,7 @@ static int test_wolfSSL_X509_STORE_CTX_ex(void)
2061220609
}
2061320610

2061420611

20615-
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA)
20612+
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_FILESYSTEM)
2061620613
static int test_X509_STORE_untrusted_load_cert_to_stack(const char* filename,
2061720614
STACK_OF(X509)* chain)
2061820615
{
@@ -20751,7 +20748,7 @@ static int test_X509_STORE_untrusted_certs(const char** filenames, int ret,
2075120748
static int test_X509_STORE_untrusted(void)
2075220749
{
2075320750
EXPECT_DECLS;
20754-
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA)
20751+
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_FILESYSTEM)
2075520752
const char* untrusted1[] = {
2075620753
"./certs/intermediate/ca-int2-cert.pem",
2075720754
NULL
@@ -20934,7 +20931,8 @@ static int test_wolfSSL_get0_param(void)
2093420931
{
2093520932
EXPECT_DECLS;
2093620933
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_TLS) && \
20937-
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER))
20934+
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
20935+
!defined(NO_FILESYSTEM)
2093820936
SSL_CTX* ctx = NULL;
2093920937
SSL* ssl = NULL;
2094020938

@@ -20989,7 +20987,8 @@ static int test_wolfSSL_set1_host(void)
2098920987
{
2099020988
EXPECT_DECLS;
2099120989
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_TLS) && \
20992-
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER))
20990+
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
20991+
!defined(NO_FILESYSTEM)
2099320992
const char host[] = "www.test_wolfSSL_set1_host.com";
2099420993
const char emptyStr[] = "";
2099520994
SSL_CTX* ctx = NULL;
@@ -21033,7 +21032,7 @@ static int test_wolfSSL_set1_host(void)
2103321032
static int test_wolfSSL_X509_VERIFY_PARAM_set1_ip(void)
2103421033
{
2103521034
EXPECT_DECLS;
21036-
#if defined(OPENSSL_EXTRA)
21035+
#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM)
2103721036
unsigned char buf[16] = {0};
2103821037
WOLFSSL_X509_VERIFY_PARAM* param = NULL;
2103921038

@@ -21336,7 +21335,7 @@ static int test_wolfSSL_CTX_add_client_CA(void)
2133621335
EXPECT_DECLS;
2133721336
#if !defined(WOLFSSL_NO_CA_NAMES) && defined(OPENSSL_EXTRA) && \
2133821337
!defined(NO_RSA) && !defined(NO_CERTS) && \
21339-
!defined(NO_TLS) && !defined(NO_WOLFSSL_CLIENT)
21338+
!defined(NO_TLS) && !defined(NO_WOLFSSL_CLIENT) && !defined(NO_FILESYSTEM)
2134021339
WOLFSSL_CTX* ctx = NULL;
2134121340
WOLFSSL_X509* x509 = NULL;
2134221341
WOLFSSL_X509* x509_a = NULL;
@@ -22062,7 +22061,8 @@ static int test_wolfSSL_CTX_set_srp_password(void)
2206222061
static int test_wolfSSL_X509_STORE(void)
2206322062
{
2206422063
EXPECT_DECLS;
22065-
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_TLS)
22064+
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_TLS) && \
22065+
!defined(NO_FILESYSTEM)
2206622066
X509_STORE *store = NULL;
2206722067

2206822068
#ifdef HAVE_CRL
@@ -22130,7 +22130,7 @@ static int test_wolfSSL_X509_STORE(void)
2213022130

2213122131

2213222132

22133-
#ifndef WOLFCRYPT_ONLY
22133+
#if !defined(WOLFCRYPT_ONLY) && !defined(NO_FILESYSTEM)
2213422134
{
2213522135
#if !defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)
2213622136
SSL_CTX* ctx = NULL;
@@ -22772,7 +22772,8 @@ static int test_wolfSSL_set1_curves_list(void)
2277222772
{
2277322773
EXPECT_DECLS;
2277422774
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC) && !defined(NO_TLS) && \
22775-
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER))
22775+
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
22776+
!defined(NO_FILESYSTEM)
2277622777
SSL* ssl = NULL;
2277722778
SSL_CTX* ctx = NULL;
2277822779

@@ -22930,7 +22931,8 @@ static int test_wolfSSL_set1_sigalgs_list(void)
2293022931
EXPECT_DECLS;
2293122932
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA) && \
2293222933
!defined(NO_TLS) && \
22933-
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER))
22934+
(!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
22935+
!defined(NO_FILESYSTEM)
2293422936
SSL* ssl = NULL;
2293522937
SSL_CTX* ctx = NULL;
2293622938

@@ -29355,7 +29357,8 @@ static int test_wolfSSL_EVP_Cipher_extra(void)
2935529357
static int test_wolfSSL_X509_get_serialNumber(void)
2935629358
{
2935729359
EXPECT_DECLS;
29358-
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA)
29360+
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA) && \
29361+
!defined(NO_FILESYSTEM)
2935929362
ASN1_INTEGER* a = NULL;
2936029363
BIGNUM* bn = NULL;
2936129364
X509* x509 = NULL;
@@ -29489,7 +29492,8 @@ static int test_wolfSSL_X509_ext_get_critical_by_NID(void)
2948929492
static int test_wolfSSL_X509_CRL_distribution_points(void)
2949029493
{
2949129494
EXPECT_DECLS;
29492-
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA)
29495+
#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_RSA) && \
29496+
!defined(NO_FILESYSTEM)
2949329497
WOLFSSL_X509* x509 = NULL;
2949429498
const char* file = "./certs/client-crl-dist.pem";
2949529499

‎tests/api/test_ossl_bio.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ int test_wolfSSL_BIO_puts(void)
255255
int test_wolfSSL_BIO_dump(void)
256256
{
257257
EXPECT_DECLS;
258-
#if defined(OPENSSL_EXTRA)
258+
#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM)
259259
BIO* bio;
260260
static const unsigned char data[] = {
261261
0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE,
@@ -1136,7 +1136,7 @@ int test_wolfSSL_BIO_reset(void)
11361136
int test_wolfSSL_BIO_get_len(void)
11371137
{
11381138
EXPECT_DECLS;
1139-
#if defined(OPENSSL_EXTRA) && !defined(NO_BIO)
1139+
#if defined(OPENSSL_EXTRA) && !defined(NO_BIO) && !defined(NO_FILESYSTEM)
11401140
BIO *bio = NULL;
11411141
const char txt[] = "Some example text to push to the BIO.";
11421142

‎tests/api/test_ossl_ec.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1237,7 +1237,8 @@ int test_wolfSSL_EC_KEY_set_group(void)
12371237
int test_wolfSSL_EC_KEY_set_conv_form(void)
12381238
{
12391239
EXPECT_DECLS;
1240-
#if defined(HAVE_ECC) && defined(OPENSSL_EXTRA) && !defined(NO_BIO)
1240+
#if defined(HAVE_ECC) && defined(OPENSSL_EXTRA) && !defined(NO_BIO) && \
1241+
!defined(NO_FILESYSTEM)
12411242
BIO* bio = NULL;
12421243
EC_KEY* key = NULL;
12431244

‎tests/api/test_rsa.c‎

Lines changed: 73 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -616,53 +616,100 @@ int test_wc_RsaPSS_VerifyCheckInline(void)
616616
int test_wc_RsaKeyToDer(void)
617617
{
618618
EXPECT_DECLS;
619-
#if !defined(NO_RSA) && defined(WOLFSSL_KEY_GEN)
620-
RsaKey genKey;
621-
WC_RNG rng;
619+
#if !defined(NO_RSA) && \
620+
(defined(WOLFSSL_KEY_GEN) || defined(WOLFSSL_KEY_TO_DER))
621+
RsaKey key;
622622
byte* der = NULL;
623+
word32 derSz = 0;
624+
#if defined(WOLFSSL_KEY_GEN)
625+
WC_RNG rng;
623626
#if (!defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \
624627
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 4)) && \
625628
(defined(RSA_MIN_SIZE) && (RSA_MIN_SIZE <= 1024))
626-
int bits = 1024;
627-
word32 derSz = 611;
628-
/* (2 x 128) + 2 (possible leading 00) + (5 x 64) + 5 (possible leading 00)
629-
+ 3 (e) + 8 (ASN tag) + 10 (ASN length) + 4 seqSz + 3 version */
629+
int bits = 1024;
630+
#else
631+
int bits = 2048;
632+
#endif
630633
#else
631-
int bits = 2048;
632-
word32 derSz = 1196;
633-
/* (2 x 256) + 2 (possible leading 00) + (5 x 128) + 5 (possible leading 00)
634-
+ 3 (e) + 8 (ASN tag) + 17 (ASN length) + 4 seqSz + 3 version */
634+
word32 idx = 0;
635+
byte* key_der = NULL;
636+
#if !defined(NO_FILESYSTEM)
637+
const char* key_fname = "./certs/client-key.der";
638+
XFILE file = XBADFILE;
635639
#endif
640+
#endif /* WOLFSSL_KEY_GEN */
636641

642+
#if defined(WOLFSSL_KEY_GEN)
637643
XMEMSET(&rng, 0, sizeof(rng));
638-
XMEMSET(&genKey, 0, sizeof(genKey));
644+
#endif
645+
XMEMSET(&key, 0, sizeof(key));
639646

640-
ExpectNotNull(der = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_TMP_BUFFER));
641-
/* Init structures. */
642-
ExpectIntEQ(wc_InitRsaKey(&genKey, HEAP_HINT), 0);
647+
/* Init RSA structure */
648+
ExpectIntEQ(wc_InitRsaKey(&key, HEAP_HINT), 0);
649+
650+
#if defined(WOLFSSL_KEY_GEN)
651+
/* Init RMG */
643652
ExpectIntEQ(wc_InitRng(&rng), 0);
644-
/* Make key. */
645-
ExpectIntEQ(MAKE_RSA_KEY(&genKey, bits, WC_RSA_EXPONENT, &rng), 0);
653+
/* Make key */
654+
ExpectIntEQ(MAKE_RSA_KEY(&key, bits, WC_RSA_EXPONENT, &rng), 0);
655+
#else
656+
/* Import a key */
657+
#if !defined(NO_FILESYSTEM)
658+
ExpectTrue((file = XFOPEN(key_fname, "rb")) != XBADFILE);
659+
ExpectIntEQ(XFSEEK(file, 0, XSEEK_END), 0);
660+
ExpectIntGT(derSz = (word32)XFTELL(file), 0);
661+
ExpectIntEQ(XFSEEK(file, 0, XSEEK_SET), 0);
662+
ExpectNotNull(key_der = (byte*)XMALLOC(derSz, NULL,
663+
DYNAMIC_TYPE_TMP_BUFFER));
664+
ExpectIntEQ((int)XFREAD(key_der, 1, derSz, file), derSz);
665+
XFCLOSE(file);
666+
#elif defined(USE_CERT_BUFFERS_1024) && \
667+
(defined(RSA_MIN_SIZE) && (RSA_MIN_SIZE <= 1024))
668+
key_der = (byte*)client_key_der_1024;
669+
derSz = (word32)sizeof_client_key_der_1024;
670+
#elif defined(USE_CERT_BUFFERS_2048)
671+
key_der = (byte*)client_key_der_2048;
672+
derSz = (word32)sizeof_client_key_der_2048;
673+
#elif defined(USE_CERT_BUFFERS_3072)
674+
key_der = (byte*)client_key_der_3072;
675+
derSz = (word32)sizeof_client_key_der_3072;
676+
#elif defined(USE_CERT_BUFFERS_4096)
677+
key_der = (byte*)client_key_der_4096;
678+
derSz = (word32)sizeof_client_key_der_4096;
679+
#endif
646680

647-
ExpectIntGT(wc_RsaKeyToDer(&genKey, der, derSz), 0);
681+
/* Import private key */
682+
ExpectIntEQ(wc_RsaPrivateKeyDecode(key_der, &idx, &key, derSz), 0);
683+
684+
#if !defined(NO_FILESYSTEM)
685+
XFREE(key_der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
686+
#endif
687+
#endif /* WOLFSSL_KEY_GEN */
688+
689+
/* Get output length */
690+
ExpectIntGT((derSz = wc_RsaKeyToDer(&key, NULL, 0)), 0);
691+
ExpectNotNull(der = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_TMP_BUFFER));
692+
693+
/* Test exporting private key to DER */
694+
ExpectIntGT(wc_RsaKeyToDer(&key, der, derSz), 0);
648695

649696
/* Pass good/bad args. */
650-
ExpectIntEQ(wc_RsaKeyToDer(NULL, der, FOURK_BUF),
697+
ExpectIntEQ(wc_RsaKeyToDer(NULL, der, derSz),
651698
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
652-
/* Get just the output length */
653-
ExpectIntGT(wc_RsaKeyToDer(&genKey, NULL, 0), 0);
654699
/* Try Public Key. */
655-
genKey.type = 0;
656-
ExpectIntEQ(wc_RsaKeyToDer(&genKey, der, FOURK_BUF),
700+
key.type = 0;
701+
ExpectIntEQ(wc_RsaKeyToDer(&key, der, derSz),
657702
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
658703
#ifdef WOLFSSL_CHECK_MEM_ZERO
659704
/* Put back to Private Key */
660-
genKey.type = 1;
705+
key.type = 1;
661706
#endif
662707

663708
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
664-
DoExpectIntEQ(wc_FreeRsaKey(&genKey), 0);
665-
DoExpectIntEQ(wc_FreeRng(&rng), 0);
709+
DoExpectIntEQ(wc_FreeRsaKey(&key), 0);
710+
#if defined(WOLFSSL_KEY_GEN)
711+
DoExpectIntEQ(wc_FreeRng(&rng), 0);
712+
#endif
666713
#endif
667714
return EXPECT_RESULT();
668715
} /* END test_wc_RsaKeyToDer */

‎wolfcrypt/src/asn.c‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28249,9 +28249,8 @@ int wc_GetFASCNFromCert(struct DecodedCert* cert, byte* fascn, word32* fascnSz)
2824928249
}
2825028250
#endif /* WOLFSSL_FPKI */
2825128251

28252-
#if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || \
28253-
defined(WOLFSSL_KCAPI_RSA) || \
28254-
((defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA))))
28252+
#if !defined(NO_RSA) && \
28253+
(defined(WOLFSSL_KEY_TO_DER) || defined(WOLFSSL_CERT_GEN))
2825528254
/* USER RSA ifdef portions used instead of refactor in consideration for
2825628255
possible fips build */
2825728256
/* Encode a public RSA key to output.
@@ -28433,13 +28432,10 @@ int wc_RsaKeyToPublicDer_ex(RsaKey* key, byte* output, word32 inLen,
2843328432
return SetRsaPublicKey(output, key, (int)inLen, with_header);
2843428433
}
2843528434

28436-
#endif /* !NO_RSA && (WOLFSSL_CERT_GEN || WOLFSSL_KCAPI_RSA ||
28437-
((OPENSSL_EXTRA || WOLFSSL_KEY_GEN))) */
28435+
#endif /* !NO_RSA && WOLFSSL_KEY_TO_DER */
2843828436
#endif /* NO_CERTS */
2843928437

28440-
#if (defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || \
28441-
defined(WOLFSSL_KCAPI_RSA) || defined(WOLFSSL_SE050)) && \
28442-
!defined(NO_RSA)
28438+
#if !defined(NO_RSA) && defined(WOLFSSL_KEY_TO_DER)
2844328439

2844428440
/* Encode private RSA key in DER format.
2844528441
*
@@ -28606,7 +28602,7 @@ int wc_RsaKeyToDer(RsaKey* key, byte* output, word32 inLen)
2860628602
#endif
2860728603
}
2860828604

28609-
#endif /* (WOLFSSL_KEY_GEN || OPENSSL_EXTRA) && !NO_RSA */
28605+
#endif /* !NO_RSA && WOLFSSL_KEY_TO_DER */
2861028606

2861128607
#ifndef NO_CERTS
2861228608

0 commit comments

Comments
 (0)