1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
/***************************************************************************
* Copyright (c) 2024 Microsoft Corporation
* Copyright (c) 2025-present Eclipse ThreadX Contributors
*
* This program and the accompanying materials are made available under the
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* SPDX-License-Identifier: MIT
**************************************************************************/
/**************************************************************************/
/**************************************************************************/
/** */
/** NetX Secure Component */
/** */
/** X.509 Digital Certificates */
/** */
/**************************************************************************/
/**************************************************************************/
#define NX_SECURE_SOURCE_CODE
#include "nx_secure_x509.h"
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _nx_secure_x509_key_usage_extension_parse PORTABLE C */
/* 6.4.3 */
/* AUTHOR */
/* */
/* Timothy Stapko, Microsoft Corporation */
/* */
/* DESCRIPTION */
/* */
/* This function parses through an X.509 certificate keyUsage */
/* extension and returns the Authentication Key Usage bitfield for use */
/* by the application. */
/* */
/* INPUT */
/* */
/* certificate Pointer to X.509 certificate */
/* bitfield keyUsage bitfield return */
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* */
/* CALLS */
/* */
/* _nx_secure_x509_asn1_tlv_block_parse Parse ASN.1 block */
/* _nx_secure_x509_extension_find Find extension in certificate */
/* */
/* CALLED BY */
/* */
/* Application Code */
/* */
/**************************************************************************/
UINT _nx_secure_x509_key_usage_extension_parse(NX_SECURE_X509_CERT *certificate, USHORT *bitfield)
{
USHORT tlv_type;
USHORT tlv_type_class;
ULONG tlv_length;
const UCHAR *tlv_data;
const UCHAR *current_buffer;
ULONG length;
ULONG header_length;
UINT status;
NX_SECURE_X509_EXTENSION key_usage_extension;
/* Find and parse the keyUsage extension. */
/* keyUsage ASN.1 format:
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1), -- recent editions of X.509 have
-- renamed this bit to contentCommitment
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
*/
/* Find the KeyUsage extension in the certificate. */
status = _nx_secure_x509_extension_find(certificate, &key_usage_extension, NX_SECURE_TLS_X509_TYPE_KEY_USAGE);
/* See if extension present - it is OK if not present! */
if (status != NX_SECURE_X509_SUCCESS)
{
return(status);
}
/* The length of our extensions is the length of the sequence. */
current_buffer = key_usage_extension.nx_secure_x509_extension_data;
length = key_usage_extension.nx_secure_x509_extension_data_length;
/* Parse the bit string. */
status = _nx_secure_x509_asn1_tlv_block_parse(current_buffer, &length, &tlv_type, &tlv_type_class, &tlv_length, &tlv_data, &header_length);
/* Make sure we parsed the block alright. */
if (status != 0)
{
return(status);
}
/* If the next item up is not a sequence, then it isn't an extensions block. */
if (!(tlv_type_class == NX_SECURE_ASN_TAG_CLASS_UNIVERSAL && tlv_type == NX_SECURE_ASN_TAG_BIT_STRING))
{
/* We were expecting a bitfield but got something else. */
return(NX_SECURE_X509_INVALID_EXTENSION_SEQUENCE);
}
/* Check the bit string length. */
if (tlv_length > sizeof(USHORT) || tlv_length < 2)
{
return(NX_SECURE_X509_INVALID_EXTENSION_SEQUENCE);
}
/* DER-encoding of a BIT STRING with flag values uses the top octet of the 2 byte string
to encode the number of 0 bits at the end of the lower octet. Thus, we need to extract
the top byte and shift the bottom byte to get the actual bitfield value. */
*bitfield = (USHORT)((tlv_data[1] << 8) + tlv_data[0]);
return(NX_SECURE_X509_SUCCESS);
}
|
