Outline ![]()
Files ![]()
loading...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/**************************************************************************/
/* */
/* Copyright (c) Microsoft Corporation. All rights reserved. */
/* */
/* This software is licensed under the Microsoft Software License */
/* Terms for Microsoft Azure RTOS. Full text of the license can be */
/* found in the LICENSE file at https://aka.ms/AzureRTOS_EULA */
/* and in the root directory of this software. */
/* */
/**************************************************************************/
/**************************************************************************/
/**************************************************************************/
/** */
/** NetX Secure Component */
/** */
/** X.509 Digital Certificates */
/** */
/**************************************************************************/
/**************************************************************************/
#define NX_SECURE_SOURCE_CODE
#include "nx_secure_x509.h"
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _nx_secure_x509_key_usage_extension_parse PORTABLE C */
/* 6.1.6 */
/* AUTHOR */
/* */
/* Timothy Stapko, Microsoft Corporation */
/* */
/* DESCRIPTION */
/* */
/* This function parses through an X.509 certificate keyUsage */
/* extension and returns the Authentication Key Usage bitfield for use */
/* by the application. */
/* */
/* INPUT */
/* */
/* certificate Pointer to X.509 certificate */
/* bitfield keyUsage bitfield return */
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* */
/* CALLS */
/* */
/* _nx_secure_x509_asn1_tlv_block_parse Parse ASN.1 block */
/* _nx_secure_x509_extension_find Find extension in certificate */
/* */
/* CALLED BY */
/* */
/* Application Code */
/* */
/* RELEASE HISTORY */
/* */
/* DATE NAME DESCRIPTION */
/* */
/* 05-19-2020 Timothy Stapko Initial Version 6.0 */
/* 09-30-2020 Timothy Stapko Modified comment(s), */
/* fixed parsing issue, */
/* resulting in version 6.1 */
/* 04-02-2021 Timothy Stapko Modified comment(s), */
/* removed dependency on TLS, */
/* resulting in version 6.1.6 */
/* */
/**************************************************************************/
UINT _nx_secure_x509_key_usage_extension_parse(NX_SECURE_X509_CERT *certificate, USHORT *bitfield)
{
USHORT tlv_type;
USHORT tlv_type_class;
ULONG tlv_length;
const UCHAR *tlv_data;
const UCHAR *current_buffer;
ULONG length;
ULONG header_length;
UINT status;
NX_SECURE_X509_EXTENSION key_usage_extension;
/* Find and parse the keyUsage extension. */
/* keyUsage ASN.1 format:
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1), -- recent editions of X.509 have
-- renamed this bit to contentCommitment
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
*/
/* Find the KeyUsage extension in the certificate. */
status = _nx_secure_x509_extension_find(certificate, &key_usage_extension, NX_SECURE_TLS_X509_TYPE_KEY_USAGE);
/* See if extension present - it is OK if not present! */
if (status != NX_SECURE_X509_SUCCESS)
{
return(status);
}
/* The length of our extensions is the length of the sequence. */
current_buffer = key_usage_extension.nx_secure_x509_extension_data;
length = key_usage_extension.nx_secure_x509_extension_data_length;
/* Parse the bit string. */
status = _nx_secure_x509_asn1_tlv_block_parse(current_buffer, &length, &tlv_type, &tlv_type_class, &tlv_length, &tlv_data, &header_length);
/* Make sure we parsed the block alright. */
if (status != 0)
{
return(status);
}
/* If the next item up is not a sequence, then it isn't an extensions block. */
if (!(tlv_type_class == NX_SECURE_ASN_TAG_CLASS_UNIVERSAL && tlv_type == NX_SECURE_ASN_TAG_BIT_STRING))
{
/* We were expecting a bitfield but got something else. */
return(NX_SECURE_X509_INVALID_EXTENSION_SEQUENCE);
}
/* Check the bit string length. */
if (tlv_length > sizeof(USHORT) || tlv_length < 2)
{
return(NX_SECURE_X509_INVALID_EXTENSION_SEQUENCE);
}
/* DER-encoding of a BIT STRING with flag values uses the top octet of the 2 byte string
to encode the number of 0 bits at the end of the lower octet. Thus, we need to extract
the top byte and shift the bottom byte to get the actual bitfield value. */
*bitfield = (USHORT)((tlv_data[1] << 8) + tlv_data[0]);
return(NX_SECURE_X509_SUCCESS);
}