san inline paring support added

Author: Emma Stensland

src/x509/clu_config.c

@@ -543,6 +543,76 @@ static int wolfCLU_setAltNames(WOLFSSL_X509* x509, WOLFSSL_CONF* conf,
 }
 
 
+#ifdef WOLFSSL_ALT_NAMES
+/* Apply an inline subjectAltName list to x509, e.g.
+ * "DNS:example.com,IP:10.0.0.1". Leading whitespace per entry is skipped.
+ * Buffer is tokenized in place, so callers pass a writable string. Returns
+ * WOLFCLU_SUCCESS, or WOLFCLU_FATAL_ERROR on a malformed entry so a bad SAN is
+ * never silently ignored. */
+static int wolfCLU_setInlineAltNames(WOLFSSL_X509* x509, char* val)
+{
+    int ret = WOLFCLU_SUCCESS;
+    char* token;
+    char* ptr = NULL;
+
+    if (x509 == NULL || val == NULL) {
+        return WOLFCLU_FATAL_ERROR;
+    }
+
+    token = XSTRTOK(val, ",", &ptr);
+    while (token != NULL) {
+        char* colon;
+        char* value;
+        size_t len;
+
+        /* trim whitespace around entries and trailing whitespace */
+        while (*token == ' ' || *token == '\t' || *token == '\r' || *token == '\n') {
+            token++;
+        }
+        len = XSTRLEN(token);
+        while (len > 0 && (token[len - 1] == ' ' || token[len - 1] == '\t' ||
+                           token[len - 1] == '\r' || token[len - 1] == '\n')) {
+            token[--len] = '\0';
+        }
+        colon = XSTRSTR(token, ":");
+        if (colon == NULL) {
+            wolfCLU_LogError("bad subjectAltName entry \"%s\", expected "
+                    "TYPE:value", token);
+            ret = WOLFCLU_FATAL_ERROR;
+            break;
+        }
+        *colon = '\0';
+        /* The trailing-whitespace trim above already NUL-terminated the token
+         * at the correct boundary, so value needs no second trailing trim. */
+        /* drop whitespace between the colon and the value */
+        value = colon + 1;
+        while (*value == ' ' || *value == '\t' || *value == '\r' || *value == '\n') {
+            value++;
+        }
+
+        /* Check for empty type or value after trimming */
+        if (XSTRLEN(token) == 0) {
+            wolfCLU_LogError("bad subjectAltName entry: empty type prefix");
+            ret = WOLFCLU_FATAL_ERROR;
+            break;
+        }
+        if (XSTRLEN(value) == 0) {
+            wolfCLU_LogError("bad subjectAltName entry: empty value for type \"%s\"", token);
+            ret = WOLFCLU_FATAL_ERROR;
+            break;
+        }
+
+        ret = wolfCLU_addAltName(x509, token, value);
+        if (ret != WOLFCLU_SUCCESS) {
+            break;
+        }
+        token = XSTRTOK(NULL, ",", &ptr);
+    }
+    return ret;
+}
+#endif /* WOLFSSL_ALT_NAMES */
+
+
 /* return WOLFCLU_SUCCESS on success */
 int wolfCLU_setExtensions(WOLFSSL_X509* x509, WOLFSSL_CONF* conf, char* sect)
 {
@@ -576,9 +646,40 @@ int wolfCLU_setExtensions(WOLFSSL_X509* x509, WOLFSSL_CONF* conf, char* sect)
     }
 
     current = wolfSSL_NCONF_get_string(conf, sect, "subjectAltName");
-    if (current != NULL && current[0] == '@') {
-        current = current+1;
-        ret = wolfCLU_setAltNames(x509, conf, current);
+    if (current != NULL) {
+        if (current[0] == '@') {
+            ret = wolfCLU_setAltNames(x509, conf, current + 1);
+        }
+        else {
+            /* Accept inline form for config compatibility. */
+#ifndef WOLFSSL_ALT_NAMES
+            /* Intentional: mirror the pre-existing silent-skip behaviour of
+             * the @section form (wolfCLU_setAltNames is also a no-op when
+             * WOLFSSL_ALT_NAMES is not defined).  We log the skip but do NOT
+             * promote ret to WOLFCLU_FATAL_ERROR so that a config containing
+             * a subjectAltName line is still usable in builds where alt-name
+             * support was compiled out. */
+            WOLFCLU_LOG(WOLFCLU_L0, "Skipping alt names, recompile wolfSSL "
+                    "with WOLFSSL_ALT_NAMES...");
+#else
+            {
+                int   len = (int)XSTRLEN(current);
+                char* dup = (char*)XMALLOC(len + 1, NULL,
+                        DYNAMIC_TYPE_TMP_BUFFER);
+
+                if (dup == NULL) {
+                    wolfCLU_LogError("out of memory duplicating "
+                            "subjectAltName value");
+                    ret = WOLFCLU_FATAL_ERROR;
+                }
+                else {
+                    XMEMCPY(dup, current, len + 1);
+                    ret = wolfCLU_setInlineAltNames(x509, dup);
+                    XFREE(dup, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                }
+            }
+#endif
+        }
     }
     return ret;
 }
@@ -621,26 +722,8 @@ int wolfCLU_parseAddExt(WOLFSSL_X509* x509, char* addExt)
         (void)val;
         WOLFCLU_LOG(WOLFCLU_L0, "Skipping alt names, recompile wolfSSL with WOLFSSL_ALT_NAMES...");
 #else
-        char* token;
-        char* ptr = NULL;
-
         /* value is a comma separated list of TYPE:value pairs */
-        token = XSTRTOK(val, ",", &ptr);
-        while (token != NULL) {
-            char* colon = XSTRSTR(token, ":");
-            if (colon == NULL) {
-                wolfCLU_LogError("bad subjectAltName entry \"%s\", expected "
-                        "TYPE:value", token);
-                ret = WOLFCLU_FATAL_ERROR;
-                break;
-            }
-            *colon = '\0';
-            ret = wolfCLU_addAltName(x509, token, colon + 1);
-            if (ret != WOLFCLU_SUCCESS) {
-                break;
-            }
-            token = XSTRTOK(NULL, ",", &ptr);
-        }
+        ret = wolfCLU_setInlineAltNames(x509, val);
 #endif
     }
     else {
@@ -656,9 +739,18 @@ int wolfCLU_setExtensions(WOLFSSL_X509* x509, WOLFSSL_CONF* conf, char* sect)
 {
     (void)x509;
     (void)conf;
-    (void)sect;
 
-    wolfCLU_LogError("wolfSSL not compiled with cert extensions");
+    /* No extension section requested, so not having WOLFSSL_CERT_EXT
+     * can be ignored. (Coupled with `ret = ` in wolfCLU_readConfig) */
+    if (sect == NULL) {
+        return WOLFCLU_SUCCESS;
+    }
+
+    /* If not compiled with WOLFSSL_CERT_EXT, fail so certs can be built as
+     * intended by user. */
+    wolfCLU_LogError("wolfSSL not compiled with cert extensions "
+            "(WOLFSSL_CERT_EXT); cannot apply requested x509_extensions "
+            "section \"%s\"", sect);
     return NOT_COMPILED_IN;
 }
 
@@ -918,7 +1010,11 @@ int wolfCLU_readConfig(WOLFSSL_X509* x509, char* config, char* sect, char* ext)
     wolfCLU_setAttributes(x509, conf,
             wolfSSL_NCONF_get_string(conf, sect, "attributes"));
     if (ext == NULL) {
-        (void)wolfCLU_setExtensions(x509, conf,
+        /* Note: we capture this return code because the !WOLFSSL_CERT_EXT stub
+         * of wolfCLU_setExtensions gracefully returns SUCCESS when the string
+         * is NULL, but fails loudly if an extension section IS requested and
+         * WOLFSSL_CERT_EXT is disabled. These two behaviors are coupled. */
+        ret = wolfCLU_setExtensions(x509, conf,
             wolfSSL_NCONF_get_string(conf, sect, "x509_extensions"));
     }
     else {

tests/x509/x509-ca-test.py

@@ -412,6 +412,36 @@ def test_create_and_verify(self):
         self.assertEqual(r2.returncode, 0, r2.stderr)
 
 
+    def test_create_der_outform(self):
+        """Conventional (RSA/ECDSA) CA signing honors -outform der.
+
+        Passes the relative ``out_name`` to ``-out`` (matching
+        ``test_create_and_verify``) so that the ``new_certs_dir``
+        path-prepending logic inside ``wolfCLU_CertSign`` is exercised even
+        when ``-outform der`` is in effect.
+        """
+        out_name = "test_ca_cv.der"
+        out = _tmp(out_name)
+        self._clean(out)
+        r = run_wolfssl("ca", "-config", self.conf,
+                        "-in", self.csr, "-out", out_name,
+                        "-outform", "der")
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertTrue(os.path.isfile(out),
+                        "Signed cert not written to {}".format(out))
+        self.assertGreater(os.path.getsize(out), 0, "Signed cert file is empty")
+
+        r2 = run_wolfssl("x509", "-in", out, "-inform", "der",
+                         "-text", "-noout")
+        self.assertEqual(r2.returncode, 0,
+                         "DER signed cert not parseable: " + r2.stderr)
+
+        r3 = run_wolfssl("verify", "-CAfile",
+                         os.path.join(CERTS_DIR, "ca-cert.pem"),
+                         "-inform", "der", out)
+        self.assertEqual(r3.returncode, 0, r3.stderr)
+
+
 class TestCAOverrideConfig(unittest.TestCase):
     """Override config options with command-line flags."""
 
@@ -1365,5 +1395,118 @@ def test_mldsa_verify_partial_chain_intermediate(self):
 
 
 
+    @unittest.skipUnless(_has_ed25519(), "Ed25519 not available")
+    def test_config_unsupported_private_key_fails(self):
+        """Config private_key with unsupported type must not emit unsigned cert.
+
+        The assertion block below is intentionally similar to
+        ``TestCAUnsupportedConfigKey.test_read_sign_config_unsupported_key_fails``.
+        Both tests verify that an Ed25519 ``private_key`` in the config is
+        rejected before any output is written, but they differ in the signing
+        CA used: this test uses the ML-DSA CA cert (exercises
+        ``wolfCLU_readSignConfig`` via the ML-DSA code path), while
+        ``TestCAUnsupportedConfigKey`` uses the default RSA CA cert.  Keep
+        both tests in sync if the assertion logic changes.
+        """
+        ed_key = _tmp("ca_mldsa_badconf_ed")
+        bad_conf = _tmp("ca_mldsa_bad_key.conf")
+        out = _tmp("tmp_mldsa_badconf.pem")
+        self._clean(ed_key + ".priv", ed_key + ".pub", bad_conf, out)
+
+        r = run_wolfssl("-genkey", "ed25519", "-out", ed_key,
+                        "-output", "keypair", "-outform", "PEM")
+        if r.returncode != 0:
+            self.skipTest("Ed25519 keygen failed: " + r.stderr)
+
+        bad_conf_body = CA_CONF.replace(
+            f"private_key = {_CERTS}/ca-key.pem",
+            f"private_key = {ed_key}.priv")
+        with open(bad_conf, "w", encoding="utf-8", newline="\n") as f:
+            f.write(bad_conf_body)
+
+        r = run_wolfssl("ca", "-config", bad_conf,
+                        "-in", self.rsa_csr, "-out", out,
+                        "-cert", self.mldsa_ca_cert)
+        self.assertNotEqual(r.returncode, 0,
+                           "unsupported config private_key should fail")
+        msg = (r.stdout + r.stderr).lower()
+        self.assertTrue(
+            "unsupported" in msg or "signing key" in msg
+            or "unable to load private key" in msg,
+            "expected unsupported-key error, got: " + msg)
+        self.assertFalse(
+            os.path.isfile(out) and os.path.getsize(out) > 0,
+            "no unsigned certificate should be written")
+
+
+@unittest.skipUnless(_has_ed25519(), "Ed25519 not available")
+class TestCAUnsupportedConfigKey(unittest.TestCase):
+    """Regression: wolfCLU_readSignConfig must reject unsupported private_key."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.ed_key = _tmp("ca_ed25519_key")
+        r = run_wolfssl("-genkey", "ed25519", "-out", cls.ed_key,
+                        "-output", "keypair", "-outform", "PEM")
+        assert r.returncode == 0, "Ed25519 keygen failed: " + r.stderr
+
+        cls.conf = _tmp("ca_ed25519_bad.conf")
+        bad_conf_body = CA_CONF.replace(
+            f"private_key = {_CERTS}/ca-key.pem",
+            f"private_key = {cls.ed_key}.priv")
+        with open(cls.conf, "w", encoding="utf-8", newline="\n") as f:
+            f.write(bad_conf_body)
+
+        cls.csr = _tmp("ca_ed25519_bad.csr")
+        r = run_wolfssl("req", "-key",
+                        os.path.join(CERTS_DIR, "server-key.pem"),
+                        "-subj", "/O=wolfSSL/C=US/ST=MT/L=Bozeman/CN=server",
+                        "-out", cls.csr)
+        assert r.returncode == 0, "CSR creation failed: " + r.stderr
+
+    @classmethod
+    def tearDownClass(cls):
+        _cleanup(cls.ed_key + ".priv", cls.ed_key + ".pub",
+                 cls.conf, cls.csr, _tmp("index.txt"))
+
+    def setUp(self):
+        _cleanup(_tmp("index.txt"))
+        _touch(_tmp("index.txt"))
+
+    def tearDown(self):
+        _cleanup(_tmp("index.txt"))
+
+    def _clean(self, *files):
+        for f in files:
+            self.addCleanup(lambda p=f: _cleanup(p))
+
+    def test_read_sign_config_unsupported_key_fails(self):
+        """ca -config with Ed25519 private_key must fail without writing cert.
+
+        The assertion block below mirrors
+        ``TestCAMLDSA.test_config_unsupported_private_key_fails``.  Both
+        tests verify that an Ed25519 ``private_key`` in the config is
+        rejected before any output is written, but the signing CA differs:
+        this test uses the default RSA CA cert (exercises the
+        ``wolfCLU_readSignConfig`` RSA code path), while ``TestCAMLDSA``
+        uses the ML-DSA CA cert.  Keep both tests in sync if the assertion
+        logic changes.
+        """
+        out = _tmp("tmp_ed25519_bad_ca.pem")
+        self._clean(out)
+        r = run_wolfssl("ca", "-config", self.conf,
+                        "-in", self.csr, "-out", out)
+        self.assertNotEqual(r.returncode, 0,
+                           "Ed25519 config private_key should fail")
+        msg = (r.stdout + r.stderr).lower()
+        self.assertTrue(
+            "unsupported" in msg or "signing key" in msg
+            or "unable to load private key" in msg,
+            "expected unsupported-key error, got: " + msg)
+        self.assertFalse(
+            os.path.isfile(out) and os.path.getsize(out) > 0,
+            "no unsigned certificate should be written")
+
+
 if __name__ == "__main__":
     test_main()

tests/x509/x509-process-test.py

@@ -492,13 +492,13 @@ def test_4d_pem_inform_with_der_file(self):
                          "output file should not be created on error")
 
     def test_4e_nonexistent_file_der(self):
-        r = run_wolfssl("x509", "-inform", "der", "-in", "ca-cert.pem",
+        r = run_wolfssl("x509", "-inform", "der", "-in", "nonexistent-file.pem",
                         "-outform", "der", "-out", "out.txt")
         self._clean("out.txt")
         self.assertNotEqual(r.returncode, 0)
 
     def test_4f_nonexistent_file_pem(self):
-        r = run_wolfssl("x509", "-inform", "pem", "-in", "ca-cert.pem",
+        r = run_wolfssl("x509", "-inform", "pem", "-in", "nonexistent-file.pem",
                         "-outform", "pem", "-out", "out.txt")
         self._clean("out.txt")
         self.assertNotEqual(r.returncode, 0)