Add test certificate with basicConstraints containing only an INTEGER The basicConstraints extension contains only an INTEGER. According to RFC 5280, this should be cA=FALSE and a pathLenConstraint value which is effectively ignored. But Mbed TLS parses it as cA=TRUE if the integer value is nonzero. This certificate is syntactically valid, but RFC 5280 forbids CAs from emitting it. Compliant X.509 parsers treat it as cA=FALSE. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/data_files/Makefile b/data_files/Makefile index 4a1b03f..5a379a9 100644 --- a/data_files/Makefile +++ b/data_files/Makefile
@@ -2328,6 +2328,22 @@ -inform DER -in $< -outform DER -out $@ all_final += parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt +# Replace a well-formed basicConstraints extension containing CA:TRUE with +# a malformed extension that is empty with trailing junk. The trailing +# junk is a boolean with the value true, thus it would be interpreted as +# CA:TRUE if it was properly inside the basicConstraints extension. +parse_input/server5.basic-constraints-integer-first.badsign.crt: server5-ca.der + perl -0777 -pe '$$n = s/\x04\x05\x30\x03\x01\x01\xff/\x04\x05\x30\x03\x02\x01\x01/g; die "More substitutions than expected" if $$n > 1; die "Substitution not found" if $$n < 1' <$< >$@.tmp + mv $@.tmp $@ +all_final += parse_input/server5.basic-constraints-integer-first.badsign.crt + +parse_input/server5.basic-constraints-integer-first.selfsigned.crt: parse_input/server5.basic-constraints-integer-first.badsign.crt server5.key + $(OPENSSL) x509 -subj '/CN=Eve/' \ + -key server5.key \ + -days 3653 \ + -inform DER -in $< -outform DER -out $@ +all_final += parse_input/server5.basic-constraints-integer-first.selfsigned.crt + # MD5 test certificate cert_md_test_key = $(cli_crt_key_file_rsa)
diff --git a/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt b/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt new file mode 100644 index 0000000..75d734a --- /dev/null +++ b/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt Binary files differ
diff --git a/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt b/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt new file mode 100644 index 0000000..d57fe4a --- /dev/null +++ b/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt Binary files differ