luna - wolfssl/tests/api/test

   1/* test_x509.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/wolfcrypt/types.h>
  32#include <tests/api/api.h>
  33#include <tests/api/test_x509.h>
  34#include <tests/utils.h>
  35#include <wolfssl/openssl/ssl.h>
  36#include <wolfssl/openssl/x509.h>
  37#include <wolfssl/openssl/x509v3.h>
  38
  39#include <wolfssl/internal.h>
  40#include <wolfssl/wolfcrypt/asn.h>
  41#include <wolfssl/wolfcrypt/asn_public.h>
  42
  43#if defined(OPENSSL_ALL) && \
  44    defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
  45#define HAVE_TEST_X509_RFC2818_VERIFICATION_CALLBACK
  46/* callback taken and simplified from
  47 * include/boost/asio/ssl/impl/rfc2818_verification.ipp
  48 * version: boost-1.84.0 */
  49static int rfc2818_verification_callback(int preverify,
  50        WOLFSSL_X509_STORE_CTX* store)
  51{
  52    EXPECT_DECLS;
  53    int depth;
  54    X509* cert;
  55    GENERAL_NAMES* gens;
  56    byte address_bytes[] = { 127, 0, 0, 1 };
  57    X509_NAME* name;
  58    int i;
  59    ASN1_STRING* common_name = 0;
  60    int matches = 0;
  61
  62    /* Don't bother looking at certificates that have
  63     * failed pre-verification. */
  64    if (!preverify)
  65        return 0;
  66
  67    /* We're only interested in checking the certificate at
  68     * the end of the chain. */
  69    depth = X509_STORE_CTX_get_error_depth(store);
  70    if (depth > 0)
  71        return 1;
  72
  73    /* Try converting the host name to an address. If it is an address then we
  74     * need to look for an IP address in the certificate rather than a
  75     * host name. */
  76
  77    cert = X509_STORE_CTX_get_current_cert(store);
  78
  79    /* Go through the alternate names in the certificate looking for matching
  80     * DNS or IP address entries. */
  81    gens = (GENERAL_NAMES*)X509_get_ext_d2i(
  82            cert, NID_subject_alt_name, NULL, NULL);
  83    for (i = 0; i < sk_GENERAL_NAME_num(gens); ++i) {
  84        GENERAL_NAME* gen = sk_GENERAL_NAME_value(gens, i);
  85        if (gen->type == GEN_DNS) {
  86            ASN1_IA5STRING* domain = gen->d.dNSName;
  87            if (domain->type == V_ASN1_IA5STRING && domain->data &&
  88                    domain->length &&
  89                    XSTRCMP(domain->data, "example.com") == 0)
  90                matches++;
  91        }
  92        else if (gen->type == GEN_IPADD)
  93        {
  94            ASN1_OCTET_STRING* ip_address = gen->d.iPAddress;
  95            if (ip_address->type == V_ASN1_OCTET_STRING && ip_address->data &&
  96                    ip_address->length == sizeof(address_bytes) &&
  97                    XMEMCMP(address_bytes, ip_address->data, 4) == 0)
  98                matches++;
  99        }
 100    }
 101    GENERAL_NAMES_free(gens);
 102
 103    /* No match in the alternate names, so try the common names. We should only
 104     * use the "most specific" common name, which is the last one in
 105     * the list. */
 106    name = X509_get_subject_name(cert);
 107    i = -1;
 108    while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0)
 109    {
 110        X509_NAME_ENTRY* name_entry = X509_NAME_get_entry(name, i);
 111        common_name = X509_NAME_ENTRY_get_data(name_entry);
 112    }
 113    if (common_name && common_name->data && common_name->length)
 114    {
 115        if (XSTRCMP(common_name->data, "www.wolfssl.com") == 0)
 116            matches++;
 117    }
 118
 119    ExpectIntEQ(matches, 3);
 120    return matches == 3;
 121}
 122#endif
 123
 124int test_x509_rfc2818_verification_callback(void)
 125{
 126    EXPECT_DECLS;
 127#ifdef HAVE_TEST_X509_RFC2818_VERIFICATION_CALLBACK
 128    struct test_memio_ctx test_ctx;
 129    WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
 130    WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
 131
 132    XMEMSET(&test_ctx, 0, sizeof(test_ctx));
 133
 134    ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
 135            wolfTLS_client_method, wolfTLS_server_method), 0);
 136
 137    ExpectIntEQ(wolfSSL_use_certificate_file(ssl_c, cliCertFile,
 138            WOLFSSL_FILETYPE_PEM), 1);
 139    ExpectIntEQ(wolfSSL_use_PrivateKey_file(ssl_c, cliKeyFile,
 140            WOLFSSL_FILETYPE_PEM), 1);
 141
 142    ExpectIntEQ(wolfSSL_CTX_load_verify_locations(ctx_s, cliCertFile, NULL), 1);
 143    wolfSSL_set_verify(ssl_s, WOLFSSL_VERIFY_PEER,
 144            rfc2818_verification_callback);
 145
 146    ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
 147
 148    wolfSSL_free(ssl_s);
 149    wolfSSL_free(ssl_c);
 150    wolfSSL_CTX_free(ctx_s);
 151    wolfSSL_CTX_free(ctx_c);
 152#endif
 153    return EXPECT_RESULT();
 154}
 155
 156/* Basic unit coverage for GetCAByAKID.
 157 *
 158 * These tests construct a minimal WOLFSSL_CERT_MANAGER and Signer objects in
 159 * memory and then call GetCAByAKID directly, verifying that:
 160 *  - a NULL or incomplete input returns NULL,
 161 *  - a matching issuer/serial pair returns the expected Signer, and
 162 *  - a non-matching pair returns NULL.
 163 *
 164 * These tests are intended to check the behaviour of the lookup logic itself;
 165 * they do not exercise certificate parsing or real CA loading.
 166 */
 167int test_x509_GetCAByAKID(void)
 168{
 169    EXPECT_DECLS;
 170#ifdef WOLFSSL_AKID_NAME
 171    WOLFSSL_CERT_MANAGER cm;
 172    Signer signerA;
 173    Signer signerB;
 174    Signer* found;
 175    byte issuerBuf[]  = { 0x01, 0x02, 0x03, 0x04 };
 176    byte serialBuf[]  = { 0x0a, 0x0b, 0x0c, 0x0d };
 177    byte wrongSerial[] = { 0x07, 0x07, 0x07, 0x07 };
 178    byte issuerHash[SIGNER_DIGEST_SIZE];
 179    byte serialHash[SIGNER_DIGEST_SIZE];
 180    word32 row;
 181
 182    XMEMSET(&cm, 0, sizeof(cm));
 183    XMEMSET(&signerA, 0, sizeof(signerA));
 184    XMEMSET(&signerB, 0, sizeof(signerB));
 185    XMEMSET(issuerHash, 0, sizeof(issuerHash));
 186    XMEMSET(serialHash, 0, sizeof(serialHash));
 187
 188    /* Initialize CA mutex so GetCAByAKID can lock/unlock it. */
 189    ExpectIntEQ(wc_InitMutex(&cm.caLock), 0);
 190
 191    /* Place both signers into the same CA table bucket. */
 192    row = 0;
 193    cm.caTable[row] = &signerA;
 194    signerA.next = &signerB;
 195    signerB.next = NULL;
 196
 197    /* Pre-compute the expected name and serial hashes using the same helper
 198     * that GetCAByAKID uses internally. */
 199    ExpectIntEQ(CalcHashId(issuerBuf, sizeof(issuerBuf), issuerHash), 0);
 200    ExpectIntEQ(CalcHashId(serialBuf, sizeof(serialBuf), serialHash), 0);
 201
 202    /* Configure signerA as the matching signer. */
 203    XMEMCPY(signerA.issuerNameHash, issuerHash, SIGNER_DIGEST_SIZE);
 204    XMEMCPY(signerA.serialHash,     serialHash, SIGNER_DIGEST_SIZE);
 205
 206    /* Configure signerB with different hashes so it should not match. */
 207    XMEMSET(signerB.issuerNameHash, 0x11, SIGNER_DIGEST_SIZE);
 208    XMEMSET(signerB.serialHash,     0x22, SIGNER_DIGEST_SIZE);
 209
 210    /* 1) NULL manager should yield NULL. */
 211    found = GetCAByAKID(NULL, issuerBuf, (word32)sizeof(issuerBuf),
 212                        serialBuf, (word32)sizeof(serialBuf));
 213    ExpectNull(found);
 214
 215    /* 2) NULL issuer should yield NULL. */
 216    found = GetCAByAKID(&cm, NULL, (word32)sizeof(issuerBuf),
 217                        serialBuf, (word32)sizeof(serialBuf));
 218    ExpectNull(found);
 219
 220    /* 3) NULL serial should yield NULL. */
 221    found = GetCAByAKID(&cm, issuerBuf, (word32)sizeof(issuerBuf),
 222                        NULL, (word32)sizeof(serialBuf));
 223    ExpectNull(found);
 224
 225    /* 4) Zero-length issuer/serial should yield NULL. */
 226    found = GetCAByAKID(&cm, issuerBuf, 0, serialBuf, (word32)sizeof(serialBuf));
 227    ExpectNull(found);
 228    found = GetCAByAKID(&cm, issuerBuf, (word32)sizeof(issuerBuf),
 229                        serialBuf, 0);
 230    ExpectNull(found);
 231
 232    /* 5) Non-matching serial should yield NULL. */
 233    found = GetCAByAKID(&cm, issuerBuf, (word32)sizeof(issuerBuf),
 234                        wrongSerial, (word32)sizeof(wrongSerial));
 235    ExpectNull(found);
 236
 237    /* 6) Matching issuer/serial should return signerA. */
 238    found = GetCAByAKID(&cm, issuerBuf, (word32)sizeof(issuerBuf),
 239                        serialBuf, (word32)sizeof(serialBuf));
 240    ExpectPtrEq(found, &signerA);
 241
 242    wc_FreeMutex(&cm.caLock);
 243
 244#endif /* WOLFSSL_AKID_NAME */
 245    return EXPECT_RESULT();
 246}
 247
 248/* Regression test: wolfSSL_X509_verify_cert() must honour the hostname set via
 249 * X509_VERIFY_PARAM_set1_host().  Before the fix the hostname was stored in
 250 * ctx->param->hostName but never consulted, so any chain-valid certificate
 251 * would pass regardless of hostname mismatch (RFC 6125 sec. 6.4.1 violation).
 252 *
 253 * Uses existing PEM fixtures:
 254 *   svrCertFile  - CN=www.wolfssl.com, SAN DNS=example.com, SAN IP=127.0.0.1
 255 *   caCertFile   - CA that signed svrCertFile
 256 */
 257int test_x509_verify_cert_hostname_check(void)
 258{
 259    EXPECT_DECLS;
 260#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_RSA)
 261    WOLFSSL_X509_STORE*        store = NULL;
 262    WOLFSSL_X509_STORE_CTX*    ctx   = NULL;
 263    WOLFSSL_X509*              ca    = NULL;
 264    WOLFSSL_X509*              leaf  = NULL;
 265    WOLFSSL_X509_VERIFY_PARAM* param = NULL;
 266
 267    ExpectNotNull(store = wolfSSL_X509_STORE_new());
 268    ExpectNotNull(ca    = wolfSSL_X509_load_certificate_file(caCertFile,
 269                                                         SSL_FILETYPE_PEM));
 270    ExpectIntEQ(wolfSSL_X509_STORE_add_cert(store, ca), WOLFSSL_SUCCESS);
 271
 272    ExpectNotNull(leaf = wolfSSL_X509_load_certificate_file(svrCertFile,
 273                                                        SSL_FILETYPE_PEM));
 274
 275    /* Case 1: no hostname constraint - must succeed. */
 276    ExpectNotNull(ctx = wolfSSL_X509_STORE_CTX_new());
 277    ExpectIntEQ(wolfSSL_X509_STORE_CTX_init(ctx, store, leaf, NULL),
 278                WOLFSSL_SUCCESS);
 279    ExpectIntEQ(wolfSSL_X509_verify_cert(ctx), WOLFSSL_SUCCESS);
 280    wolfSSL_X509_STORE_CTX_free(ctx);
 281    ctx = NULL;
 282
 283    /* Case 2: hostname matches a SAN DNS entry - must succeed. */
 284    ExpectNotNull(ctx = wolfSSL_X509_STORE_CTX_new());
 285    ExpectIntEQ(wolfSSL_X509_STORE_CTX_init(ctx, store, leaf, NULL),
 286                WOLFSSL_SUCCESS);
 287    param = wolfSSL_X509_STORE_CTX_get0_param(ctx);
 288    ExpectNotNull(param);
 289    ExpectIntEQ(wolfSSL_X509_VERIFY_PARAM_set1_host(param, "example.com",
 290                XSTRLEN("example.com")), WOLFSSL_SUCCESS);
 291    ExpectIntEQ(wolfSSL_X509_verify_cert(ctx), WOLFSSL_SUCCESS);
 292    wolfSSL_X509_STORE_CTX_free(ctx);
 293    ctx = NULL;
 294
 295    /* Case 3: hostname does not match - must FAIL with the right error code. */
 296    ExpectNotNull(ctx = wolfSSL_X509_STORE_CTX_new());
 297    ExpectIntEQ(wolfSSL_X509_STORE_CTX_init(ctx, store, leaf, NULL),
 298                WOLFSSL_SUCCESS);
 299    param = wolfSSL_X509_STORE_CTX_get0_param(ctx);
 300    ExpectNotNull(param);
 301    ExpectIntEQ(wolfSSL_X509_VERIFY_PARAM_set1_host(param, "wrong.com",
 302                XSTRLEN("wrong.com")), WOLFSSL_SUCCESS);
 303    ExpectIntNE(wolfSSL_X509_verify_cert(ctx), WOLFSSL_SUCCESS);
 304    ExpectIntEQ(wolfSSL_X509_STORE_CTX_get_error(ctx),
 305                X509_V_ERR_HOSTNAME_MISMATCH);
 306    ExpectIntEQ(wolfSSL_X509_STORE_CTX_get_error_depth(ctx), 0);
 307    wolfSSL_X509_STORE_CTX_free(ctx);
 308    ctx = NULL;
 309
 310#ifdef WOLFSSL_IP_ALT_NAME
 311    /* Case 4: IP matches a SAN IP entry - must succeed. */
 312    ExpectNotNull(ctx = wolfSSL_X509_STORE_CTX_new());
 313    ExpectIntEQ(wolfSSL_X509_STORE_CTX_init(ctx, store, leaf, NULL),
 314                WOLFSSL_SUCCESS);
 315    param = wolfSSL_X509_STORE_CTX_get0_param(ctx);
 316    ExpectNotNull(param);
 317    ExpectIntEQ(wolfSSL_X509_VERIFY_PARAM_set1_ip_asc(param, "127.0.0.1"),
 318                WOLFSSL_SUCCESS);
 319    ExpectIntEQ(wolfSSL_X509_verify_cert(ctx), WOLFSSL_SUCCESS);
 320    wolfSSL_X509_STORE_CTX_free(ctx);
 321    ctx = NULL;
 322
 323    /* Case 5: IP does not match - must FAIL with the right error code. */
 324    ExpectNotNull(ctx = wolfSSL_X509_STORE_CTX_new());
 325    ExpectIntEQ(wolfSSL_X509_STORE_CTX_init(ctx, store, leaf, NULL),
 326                WOLFSSL_SUCCESS);
 327    param = wolfSSL_X509_STORE_CTX_get0_param(ctx);
 328    ExpectNotNull(param);
 329    ExpectIntEQ(wolfSSL_X509_VERIFY_PARAM_set1_ip_asc(param, "192.168.1.1"),
 330                WOLFSSL_SUCCESS);
 331    ExpectIntNE(wolfSSL_X509_verify_cert(ctx), WOLFSSL_SUCCESS);
 332    ExpectIntEQ(wolfSSL_X509_STORE_CTX_get_error(ctx),
 333                X509_V_ERR_IP_ADDRESS_MISMATCH);
 334    ExpectIntEQ(wolfSSL_X509_STORE_CTX_get_error_depth(ctx), 0);
 335    wolfSSL_X509_STORE_CTX_free(ctx);
 336    ctx = NULL;
 337#endif /* WOLFSSL_IP_ALT_NAME */
 338
 339    wolfSSL_X509_free(leaf);
 340    wolfSSL_X509_free(ca);
 341    wolfSSL_X509_STORE_free(store);
 342#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_RSA */
 343    return EXPECT_RESULT();
 344}
 345
 346int test_x509_set_serialNumber(void)
 347{
 348#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
 349    EXPECT_DECLS;
 350    WOLFSSL_X509*         x509 = NULL;
 351    WOLFSSL_ASN1_INTEGER* s    = NULL;
 352#if defined(OPENSSL_EXTRA_X509_SMALL)
 353    WOLFSSL_ASN1_INTEGER  asnInt;
 354#endif
 355
 356    ExpectNotNull(x509 = wolfSSL_X509_new());
 357#if defined(OPENSSL_EXTRA_X509_SMALL)
 358    XMEMSET(&asnInt, 0, sizeof(asnInt));
 359    asnInt.data = asnInt.intData;
 360    asnInt.isDynamic = 0;
 361    asnInt.dataMax = (unsigned int)sizeof(asnInt.intData);
 362    s = &asnInt;
 363#else
 364    ExpectNotNull(s = wolfSSL_ASN1_INTEGER_new());
 365#endif
 366
 367    /* --- invalid inputs that must be rejected --- */
 368
 369    /* NULL x509 */
 370    ExpectIntEQ(X509_set_serialNumber(NULL, s), WOLFSSL_FAILURE);
 371    /* NULL s */
 372    ExpectIntEQ(X509_set_serialNumber(x509, NULL), WOLFSSL_FAILURE);
 373
 374    if (s != NULL) {
 375        /* length == 0: too short */
 376        s->length  = 0;
 377        s->data[0] = ASN_INTEGER;
 378        s->data[1] = 0;
 379        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 380                    WOLFSSL_FAILURE);
 381
 382        /* length == 1: still too short */
 383        s->length  = 1;
 384        s->data[0] = ASN_INTEGER;
 385        s->data[1] = 0;
 386        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 387                    WOLFSSL_FAILURE);
 388
 389        /* length == 2: still rejected - the guard requires length >= 3 */
 390        s->length  = 2;
 391        s->data[0] = ASN_INTEGER;
 392        s->data[1] = 0;
 393        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 394                    WOLFSSL_FAILURE);
 395
 396        /* wrong type byte */
 397        s->length  = 4;
 398        s->data[0] = 0x00; /* not ASN_INTEGER */
 399        s->data[1] = 2;    /* length field */
 400        s->data[2] = 0x01;
 401        s->data[3] = 0x02;
 402        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 403                    WOLFSSL_FAILURE);
 404
 405        /* mismatched length byte (data[1] != s->length - 2) */
 406        s->length  = 4;
 407        s->data[0] = ASN_INTEGER;
 408        s->data[1] = 99; /* claims 99 bytes but s->length - 2 == 2 */
 409        s->data[2] = 0x01;
 410        s->data[3] = 0x02;
 411        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 412                    WOLFSSL_FAILURE);
 413
 414        /* --- valid two-byte serial number --- */
 415        s->length  = 4;
 416        s->data[0] = ASN_INTEGER;
 417        s->data[1] = 2;
 418        s->data[2] = 0x01;
 419        s->data[3] = 0x02;
 420        ExpectIntEQ(wolfSSL_X509_set_serialNumber(x509, s),
 421                    WOLFSSL_SUCCESS);
 422        ExpectIntEQ(x509->serialSz, 2);
 423        /* NUL terminator must be placed right after the copied data */
 424        ExpectIntEQ(x509->serial[x509->serialSz], 0);
 425        ExpectIntEQ(x509->serial[0], 0x01);
 426        ExpectIntEQ(x509->serial[1], 0x02);
 427    }
 428
 429#if !defined(OPENSSL_EXTRA_X509_SMALL)
 430    wolfSSL_ASN1_INTEGER_free(s);
 431#endif
 432    wolfSSL_X509_free(x509);
 433    return EXPECT_RESULT();
 434#else
 435    return TEST_SKIPPED;
 436#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
 437}
 438
 439/*
 440 * Test: CopyDateToASN1_TIME clamps attacker-controlled time field length.
 441 *
 442 * Attack chain:
 443 *   1. Attacker crafts a DER certificate with notBefore UTCTime length byte
 444 *      set to 0x1F (31) instead of 0x0D (13). The first 13 bytes are a valid
 445 *      "YYMMDDHHMMSSZ" string (passes ExtractDate 'Z'-at-position-12 check),
 446 *      followed by 18 sentinel bytes (0xDE). Parent SEQUENCE lengths are
 447 *      adjusted so the DER is structurally valid.
 448 *   2. The malicious cert is presented as the server cert in a TLS handshake
 449 *      (via memio -- no sockets needed).
 450 *   3. The client parses the cert. CopyDateToASN1_TIME() in internal.c must
 451 *      clamp the length to CTC_DATE_SIZE - 2 (30) so that downstream code
 452 *      in wolfSSL_X509_notBefore() can safely prepend type+length at offset
 453 *      0-1 of the 32-byte notBeforeData without overflowing.
 454 *
 455 * The test verifies that notBefore.length <= CTC_DATE_SIZE - 2 (30),
 456 * regardless of the attacker's wire value (31).
 457 */
 458
 459#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && \
 460    (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
 461    !defined(NO_RSA) && !defined(NO_WOLFSSL_CLIENT) && \
 462    !defined(NO_WOLFSSL_SERVER)
 463
 464/* Verify callback that accepts all certificates regardless of errors. */
 465static int accept_all_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store)
 466{
 467    (void)preverify;
 468    (void)store;
 469    return 1;
 470}
 471
 472/*
 473 * Craft a malicious DER certificate by inflating the notBefore UTCTime length.
 474 *
 475 * Scans for the Validity SEQUENCE (pattern: 0x30 XX 0x17 0x0D), inflates the
 476 * notBefore length by 'inflate' bytes, inserts sentinel bytes (0xDE), and
 477 * adjusts all parent SEQUENCE lengths.
 478 *
 479 * out:      caller-supplied buffer, must be at least origSz + inflate bytes.
 480 * outSz:   set to the new cert size on success.
 481 * Returns 0 on success, -1 on failure.
 482 */
 483static int craft_malicious_time_cert(const byte* orig, int origSz,
 484    byte* out, int* outSz, int inflate)
 485{
 486    int i;
 487    int validityOff = -1;
 488    int notBeforeLenOff;  /* offset of the notBefore length byte */
 489    int notBeforeDataEnd; /* offset just past the 13-byte time data */
 490    word16 seqLen;
 491
 492    /* Scan for Validity SEQUENCE: 0x30 XX 0x17 0x0D */
 493    for (i = 0; i < origSz - 3; i++) {
 494        if (orig[i] == 0x30 && orig[i + 2] == 0x17 && orig[i + 3] == 0x0D) {
 495            validityOff = i;
 496            break;
 497        }
 498    }
 499    if (validityOff < 0) {
 500        return -1;
 501    }
 502
 503    notBeforeLenOff = validityOff + 3; /* the 0x0D byte */
 504    notBeforeDataEnd = notBeforeLenOff + 1 + 13; /* tag(1) was at +2, data starts at +4 */
 505    if (notBeforeDataEnd >= origSz) {
 506        return -1;
 507    }
 508
 509    /* Build the new buffer:
 510     *   [0 .. notBeforeLenOff-1]  unchanged prefix
 511     *   [notBeforeLenOff]         inflated length byte
 512     *   [notBeforeLenOff+1 .. notBeforeDataEnd-1]  original 13 time bytes
 513     *   <insert 'inflate' sentinel bytes here>
 514     *   [notBeforeDataEnd .. origSz-1]  remainder of cert
 515     */
 516
 517    /* Copy prefix including the length byte position */
 518    XMEMCPY(out, orig, notBeforeDataEnd);
 519
 520    /* Patch the notBefore UTCTime length byte */
 521    out[notBeforeLenOff] = (byte)(0x0D + inflate);
 522
 523    /* Insert sentinel bytes */
 524    XMEMSET(out + notBeforeDataEnd, 0xDE, inflate);
 525
 526    /* Copy the rest of the cert (notAfter field onward) */
 527    XMEMCPY(out + notBeforeDataEnd + inflate,
 528             orig + notBeforeDataEnd,
 529             origSz - notBeforeDataEnd);
 530
 531    /* Fix Validity SEQUENCE length (single-byte encoding at validityOff+1) */
 532    out[validityOff + 1] = (byte)(orig[validityOff + 1] + inflate);
 533
 534    /* Fix TBSCertificate SEQUENCE length (2-byte big-endian at offset 6-7,
 535     * format: 30 82 XX XX) */
 536    seqLen = ((word16)orig[6] << 8) | orig[7];
 537    seqLen += (word16)inflate;
 538    out[6] = (byte)(seqLen >> 8);
 539    out[7] = (byte)(seqLen & 0xFF);
 540
 541    /* Fix Certificate SEQUENCE length (2-byte big-endian at offset 2-3,
 542     * format: 30 82 XX XX) */
 543    seqLen = ((word16)orig[2] << 8) | orig[3];
 544    seqLen += (word16)inflate;
 545    out[2] = (byte)(seqLen >> 8);
 546    out[3] = (byte)(seqLen & 0xFF);
 547
 548    *outSz = origSz + inflate;
 549    return 0;
 550}
 551
 552#endif /* HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES && ... */
 553
 554int test_x509_time_field_overread_via_tls(void)
 555{
 556    EXPECT_DECLS;
 557#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && \
 558    (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
 559    !defined(NO_RSA) && !defined(NO_WOLFSSL_CLIENT) && \
 560    !defined(NO_WOLFSSL_SERVER)
 561    struct test_memio_ctx test_ctx;
 562    WOLFSSL_CTX* ctx_c = NULL;
 563    WOLFSSL_CTX* ctx_s = NULL;
 564    WOLFSSL* ssl_c = NULL;
 565    WOLFSSL* ssl_s = NULL;
 566    WOLFSSL_X509* peer = NULL;
 567    WOLFSSL_ASN1_TIME* notBefore = NULL;
 568    /*
 569     * Inflate notBefore length by 18 bytes: 13 + 18 = 31.
 570     * CopyDecodedToX509() sets notBefore.length = min(31, MAX_DATE_SZ) = 31
 571     * because it trusts the raw ASN.1 length byte from the wire.
 572     * A valid UTCTime is only 13 bytes.
 573     */
 574    const int INFLATE = 18;
 575    byte malicious_der[sizeof_server_cert_der_2048 + 18];
 576    int malicious_der_sz = 0;
 577
 578    /* --- Step 1: Craft malicious certificate --- */
 579    ExpectIntEQ(craft_malicious_time_cert(
 580        server_cert_der_2048, (int)sizeof_server_cert_der_2048,
 581        malicious_der, &malicious_der_sz, INFLATE), 0);
 582    ExpectIntEQ(malicious_der_sz,
 583                (int)sizeof_server_cert_der_2048 + INFLATE);
 584
 585    /* --- Step 2: Set up TLS via memio --- */
 586    XMEMSET(&test_ctx, 0, sizeof(test_ctx));
 587
 588    ExpectIntEQ(test_memio_setup_ex(&test_ctx, &ctx_c, &ctx_s,
 589        &ssl_c, &ssl_s,
 590        wolfTLSv1_2_client_method, wolfTLSv1_2_server_method,
 591        (byte*)ca_cert_der_2048, (int)sizeof_ca_cert_der_2048,
 592        malicious_der, malicious_der_sz,
 593        (byte*)server_key_der_2048, (int)sizeof_server_key_der_2048), 0);
 594
 595    /* Client verify callback accepts all errors (signature is broken
 596     * because we modified the TBSCertificate without re-signing).
 597     * Must be set on ssl_c (not ctx_c) because the SSL object was already
 598     * created from ctx_c inside test_memio_setup_ex(). */
 599    if (ssl_c != NULL) {
 600        wolfSSL_set_verify(ssl_c, WOLFSSL_VERIFY_PEER,
 601                           accept_all_verify_cb);
 602    }
 603
 604    /* --- Step 3: Perform TLS handshake --- */
 605    ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
 606
 607    /* --- Step 4: Verify CopyDecodedToX509 does not trust wire length --- */
 608#ifdef KEEP_PEER_CERT
 609    ExpectNotNull(peer = wolfSSL_get_peer_certificate(ssl_c));
 610
 611    /*
 612     * X509_get_notBefore returns &x509->notBefore directly (no copy).
 613     * CopyDecodedToX509() set notBefore.length = min(wireLength, 32) = 31
 614     * because it trusts the raw ASN.1 length byte from the attacker's cert.
 615     *
 616     * The data buffer is CTC_DATE_SIZE (32) bytes, and the notBeforeData
 617     * encoding prepends type+length at offset 0-1, leaving 30 bytes for
 618     * content. So the maximum safe length is CTC_DATE_SIZE - 2 = 30.
 619     *
 620     * This assertion FAILS on the buggy code (length > 30) and will PASS
 621     * once CopyDateToASN1_TIME clamps to the buffer capacity.
 622     */
 623    if (peer != NULL) {
 624        notBefore = wolfSSL_X509_get_notBefore(peer);
 625    }
 626    ExpectNotNull(notBefore);
 627    ExpectIntLE(notBefore->length, CTC_DATE_SIZE - 2); /* max: 30 */
 628
 629    wolfSSL_X509_free(peer);
 630#endif /* KEEP_PEER_CERT */
 631
 632    wolfSSL_free(ssl_s);
 633    wolfSSL_free(ssl_c);
 634    wolfSSL_CTX_free(ctx_s);
 635    wolfSSL_CTX_free(ctx_c);
 636#endif /* compile guards */
 637    return EXPECT_RESULT();
 638}
 639
 640
 641/* Test that CertFromX509 rejects an oversized raw AuthorityKeyIdentifier
 642 * extension. Before the fix, the guard checked authKeyIdSz (the [0]
 643 * keyIdentifier sub-field) but the WOLFSSL_AKID_NAME branch copied
 644 * authKeyIdSrcSz (the full extension) bytes, causing a heap overflow. */
 645int test_x509_CertFromX509_akid_overflow(void)
 646{
 647    EXPECT_DECLS;
 648#if defined(WOLFSSL_AKID_NAME) && defined(WOLFSSL_CERT_GEN) && \
 649    defined(WOLFSSL_CERT_EXT) && !defined(NO_BIO) && \
 650    (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL))
 651    /* DER builder helpers -- write into a flat buffer */
 652#ifdef WOLFSSL_SMALL_STACK
 653    unsigned char* buf = NULL;
 654#else
 655    unsigned char buf[16384];
 656#endif
 657    size_t pos = 0;
 658    size_t akid_val_len;
 659    unsigned char* akid_val = NULL;
 660    WOLFSSL_X509* x = NULL;
 661    WOLFSSL_BIO* bio = NULL;
 662
 663#ifdef WOLFSSL_SMALL_STACK
 664    buf = (unsigned char*)XMALLOC(16384, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 665    ExpectNotNull(buf);
 666    if (buf == NULL)
 667        return EXPECT_RESULT();
 668#endif
 669
 670    #define PUT1(b) do { buf[pos++] = (b); } while(0)
 671    #define PUTN(p, n) do { XMEMCPY(buf + pos, (p), (n)); pos += (n); } while(0)
 672
 673    /* Emit tag + definite-length header, return header size */
 674    #define TLV_HDR(tag, n, out, hlen) do {                          \
 675        size_t _i = 0;                                               \
 676        (out)[_i++] = (tag);                                         \
 677        if ((n) < 0x80u)       { (out)[_i++] = (unsigned char)(n); } \
 678        else if ((n) < 0x100u) { (out)[_i++] = 0x81;                \
 679            (out)[_i++] = (unsigned char)(n); }                      \
 680        else if ((n) < 0x10000u) { (out)[_i++] = 0x82;              \
 681            (out)[_i++] = (unsigned char)((n)>>8);                   \
 682            (out)[_i++] = (unsigned char)(n); }                      \
 683        (hlen) = _i;                                                 \
 684    } while(0)
 685
 686    /* Wrap [start, pos) in-place with a TLV header */
 687    #define WRAP(start, tag) do {                                    \
 688        size_t _len = pos - (start);                                 \
 689        unsigned char _hdr[6]; size_t _hlen;                         \
 690        TLV_HDR((tag), _len, _hdr, _hlen);                          \
 691        XMEMMOVE(buf + (start) + _hlen, buf + (start), _len);       \
 692        XMEMCPY(buf + (start), _hdr, _hlen);                        \
 693        pos += _hlen;                                                \
 694    } while(0)
 695
 696    /* ---- Build AKID extension value ---- */
 697    {
 698        size_t akid_start = pos;
 699        size_t s;
 700        int i;
 701
 702        /* [0] keyIdentifier: 20 bytes (small, passes old check) */
 703        s = pos;
 704        for (i = 0; i < 20; i++) PUT1(0x41);
 705        WRAP(s, 0x80);
 706
 707        /* [1] authorityCertIssuer: one URI of ~4000 bytes
 708         * This makes authKeyIdSrcSz >> sizeof(cert->akid) (~1628) */
 709        s = pos;
 710        {
 711            const char* pfx = "http://e/";
 712            PUTN(pfx, (size_t)XSTRLEN(pfx));
 713            for (i = 0; i < 4000; i++) PUT1('Z');
 714        }
 715        WRAP(s, 0x86); /* GeneralName [6] URI */
 716        WRAP(s, 0xA1); /* [1] IMPLICIT */
 717
 718        /* [2] authorityCertSerialNumber */
 719        s = pos;
 720        PUT1(0x01);
 721        WRAP(s, 0x82);
 722
 723        WRAP(akid_start, 0x30); /* SEQUENCE */
 724        akid_val_len = pos - akid_start;
 725        akid_val = (unsigned char*)XMALLOC(akid_val_len, NULL,
 726                                           DYNAMIC_TYPE_TMP_BUFFER);
 727        ExpectNotNull(akid_val);
 728        if (akid_val != NULL)
 729            XMEMCPY(akid_val, buf + akid_start, akid_val_len);
 730    }
 731
 732    /* ---- Build minimal self-signed v3 certificate ---- */
 733    pos = 0;
 734    {
 735        size_t tbs_start = pos;
 736        size_t s;
 737
 738        /* version [0] EXPLICIT INTEGER 2 (v3) */
 739        PUT1(0xA0); PUT1(0x03); PUT1(0x02); PUT1(0x01); PUT1(0x02);
 740
 741        /* serialNumber INTEGER 1 */
 742        PUT1(0x02); PUT1(0x01); PUT1(0x01);
 743
 744        /* signature: ecdsa-with-SHA256 */
 745        s = pos;
 746        {
 747            unsigned char oid[] = {0x06,0x08,0x2A,0x86,0x48,0xCE,
 748                                   0x3D,0x04,0x03,0x02};
 749            PUTN(oid, sizeof(oid));
 750        }
 751        WRAP(s, 0x30);
 752
 753        /* issuer: CN=A */
 754        s = pos;
 755        {
 756            size_t rdn = pos, atv = pos;
 757            unsigned char cn[] = {0x06,0x03,0x55,0x04,0x03};
 758            PUTN(cn, sizeof(cn));
 759            PUT1(0x0C); PUT1(0x01); PUT1('A');
 760            WRAP(atv, 0x30); WRAP(rdn, 0x31); WRAP(s, 0x30);
 761        }
 762
 763        /* validity */
 764        s = pos;
 765        {
 766            unsigned char t1[] = {0x17,0x0D,'2','5','0','1','0','1',
 767                                  '0','0','0','0','0','0','Z'};
 768            unsigned char t2[] = {0x17,0x0D,'3','5','0','1','0','1',
 769                                  '0','0','0','0','0','0','Z'};
 770            PUTN(t1, sizeof(t1)); PUTN(t2, sizeof(t2));
 771        }
 772        WRAP(s, 0x30);
 773
 774        /* subject: CN=A */
 775        s = pos;
 776        {
 777            size_t rdn = pos, atv = pos;
 778            unsigned char cn[] = {0x06,0x03,0x55,0x04,0x03};
 779            PUTN(cn, sizeof(cn));
 780            PUT1(0x0C); PUT1(0x01); PUT1('A');
 781            WRAP(atv, 0x30); WRAP(rdn, 0x31); WRAP(s, 0x30);
 782        }
 783
 784        /* subjectPublicKeyInfo: EC P-256 with dummy point */
 785        s = pos;
 786        {
 787            size_t alg = pos, bs;
 788            unsigned char ecpk[] = {0x06,0x07,0x2A,0x86,0x48,0xCE,
 789                                    0x3D,0x02,0x01};
 790            unsigned char p256[] = {0x06,0x08,0x2A,0x86,0x48,0xCE,
 791                                    0x3D,0x03,0x01,0x07};
 792            PUTN(ecpk, sizeof(ecpk));
 793            PUTN(p256, sizeof(p256));
 794            WRAP(alg, 0x30);
 795            bs = pos;
 796            PUT1(0x00); PUT1(0x04);
 797            /* Use P-256 generator point (valid on-curve point) so that
 798             * builds with WOLFSSL_VALIDATE_ECC_IMPORT accept the key. */
 799            {
 800                static const unsigned char p256G[64] = {
 801                    0x6B,0x17,0xD1,0xF2,0xE1,0x2C,0x42,0x47,
 802                    0xF8,0xBC,0xE6,0xE5,0x63,0xA4,0x40,0xF2,
 803                    0x77,0x03,0x7D,0x81,0x2D,0xEB,0x33,0xA0,
 804                    0xF4,0xA1,0x39,0x45,0xD8,0x98,0xC2,0x96,
 805                    0x4F,0xE3,0x42,0xE2,0xFE,0x1A,0x7F,0x9B,
 806                    0x8E,0xE7,0xEB,0x4A,0x7C,0x0F,0x9E,0x16,
 807                    0x2B,0xCE,0x33,0x57,0x6B,0x31,0x5E,0xCE,
 808                    0xCB,0xB6,0x40,0x68,0x37,0xBF,0x51,0xF5
 809                };
 810                PUTN(p256G, sizeof(p256G));
 811            }
 812            WRAP(bs, 0x03);
 813        }
 814        WRAP(s, 0x30);
 815
 816        /* extensions [3] */
 817        {
 818            size_t exts_outer = pos, exts_seq = pos, ext = pos, ev;
 819            unsigned char akid_oid[] = {0x06,0x03,0x55,0x1D,0x23};
 820            PUTN(akid_oid, sizeof(akid_oid));
 821            ev = pos;
 822            if (akid_val != NULL)
 823                PUTN(akid_val, akid_val_len);
 824            WRAP(ev, 0x04);
 825            WRAP(ext, 0x30);
 826            WRAP(exts_seq, 0x30);
 827            WRAP(exts_outer, 0xA3);
 828        }
 829
 830        WRAP(tbs_start, 0x30);
 831
 832        /* signatureAlgorithm */
 833        s = pos;
 834        {
 835            unsigned char oid[] = {0x06,0x08,0x2A,0x86,0x48,0xCE,
 836                                   0x3D,0x04,0x03,0x02};
 837            PUTN(oid, sizeof(oid));
 838        }
 839        WRAP(s, 0x30);
 840
 841        /* signatureValue: dummy */
 842        s = pos;
 843        {
 844            size_t sig;
 845            PUT1(0x00);
 846            sig = pos;
 847            PUT1(0x02); PUT1(0x01); PUT1(0x01);
 848            PUT1(0x02); PUT1(0x01); PUT1(0x01);
 849            WRAP(sig, 0x30);
 850        }
 851        WRAP(s, 0x03);
 852
 853        WRAP(0, 0x30); /* outer Certificate SEQUENCE */
 854    }
 855
 856    /* Parse the crafted certificate */
 857    x = wolfSSL_X509_d2i(NULL, buf, (int)pos);
 858    ExpectNotNull(x);
 859
 860    /* Attempt re-encode via i2d_X509_bio -- must fail gracefully, not
 861     * overflow. Before the fix this would write ~4000 bytes past the
 862     * end of cert->akid[]. */
 863    bio = wolfSSL_BIO_new(wolfSSL_BIO_s_mem());
 864    ExpectNotNull(bio);
 865    ExpectIntEQ(wolfSSL_i2d_X509_bio(bio, x), 0);
 866
 867    wolfSSL_BIO_free(bio);
 868    wolfSSL_X509_free(x);
 869    XFREE(akid_val, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 870#ifdef WOLFSSL_SMALL_STACK
 871    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 872#endif
 873
 874    #undef PUT1
 875    #undef PUTN
 876    #undef TLV_HDR
 877    #undef WRAP
 878#endif
 879    return EXPECT_RESULT();
 880}
 881
 882/* Test that ReqCertFromX509() rejects a CSR with an oversized
 883 * SubjectKeyIdentifier (> CTC_MAX_SKID_SIZE = 32 bytes). Before the fix
 884 * this would cause a heap buffer overflow into cert->skid[32]. */
 885int test_x509_ReqCertFromX509_skid_overflow(void)
 886{
 887    EXPECT_DECLS;
 888#if defined(WOLFSSL_CERT_REQ) && defined(WOLFSSL_CERT_GEN) && \
 889    defined(WOLFSSL_CERT_EXT) && !defined(NO_BIO) && \
 890    (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
 891    defined(HAVE_ECC)
 892
 893    /* Minimal DER-encoded CSR (PKCS#10) containing a SubjectKeyIdentifier
 894     * extension with a 64-byte value -- double the 32-byte CTC_MAX_SKID_SIZE
 895     * destination buffer.
 896     *
 897     * Structure:
 898     *   SEQUENCE {
 899     *     CertificationRequestInfo SEQUENCE {
 900     *       version INTEGER 0
 901     *       subject: CN=Test
 902     *       subjectPKInfo: EC P-256 (generator point)
 903     *       attributes [0] {
 904     *         SEQUENCE {
 905     *           OID 1.2.840.113549.1.9.14 (extensionRequest)
 906     *           SET { SEQUENCE { -- Extensions
 907     *             SEQUENCE { -- Extension
 908     *               OID 2.5.29.14 (subjectKeyIdentifier)
 909     *               OCTET STRING { OCTET STRING (64 bytes of 0x41) }
 910     *             }
 911     *           }}
 912     *         }
 913     *       }
 914     *     }
 915     *     signatureAlgorithm: ecdsa-with-SHA256
 916     *     signatureValue: dummy
 917     *   }
 918     */
 919    static const unsigned char crafted_csr_der[] = {
 920        0x30, 0x81, 0xE7, 0x30, 0x81, 0xCD, 0x02, 0x01,
 921        0x00, 0x30, 0x0F, 0x31, 0x0D, 0x30, 0x0B, 0x06,
 922        0x03, 0x55, 0x04, 0x03, 0x0C, 0x04, 0x54, 0x65,
 923        0x73, 0x74, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07,
 924        0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06,
 925        0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01,
 926        0x07, 0x03, 0x42, 0x00, 0x04, 0x6B, 0x17, 0xD1,
 927        0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC, 0xE6,
 928        0xE5, 0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D,
 929        0x81, 0x2D, 0xEB, 0x33, 0xA0, 0xF4, 0xA1, 0x39,
 930        0x45, 0xD8, 0x98, 0xC2, 0x96, 0x4F, 0xE3, 0x42,
 931        0xE2, 0xFE, 0x1A, 0x7F, 0x9B, 0x8E, 0xE7, 0xEB,
 932        0x4A, 0x7C, 0x0F, 0x9E, 0x16, 0x2B, 0xCE, 0x33,
 933        0x57, 0x6B, 0x31, 0x5E, 0xCE, 0xCB, 0xB6, 0x40,
 934        0x68, 0x37, 0xBF, 0x51, 0xF5, 0xA0, 0x5C, 0x30,
 935        0x5A, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7,
 936        0x0D, 0x01, 0x09, 0x0E, 0x31, 0x4D, 0x30, 0x4B,
 937        0x30, 0x49, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04,
 938        0x42, 0x04, 0x40,
 939        /* 64 bytes of 0x41 -- oversized SKID value */
 940        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 941        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 942        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 943        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 944        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 945        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 946        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 947        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
 948        /* end of SKID payload */
 949        0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE,
 950        0x3D, 0x04, 0x03, 0x02, 0x03, 0x09, 0x00, 0x30,
 951        0x06, 0x02, 0x01, 0x01, 0x02, 0x01, 0x01
 952    };
 953
 954    WOLFSSL_X509* req = NULL;
 955    WOLFSSL_BIO* bio = NULL;
 956
 957    /* Step 1: Parse the crafted CSR -- this should succeed (the parser
 958     * dynamically allocates subjKeyId to the parsed size). */
 959    req = wolfSSL_X509_REQ_d2i(NULL, crafted_csr_der,
 960                                (int)sizeof(crafted_csr_der));
 961    ExpectNotNull(req);
 962
 963    /* Step 2: Attempt to re-encode. Before the fix, this triggered a
 964     * heap buffer overflow in ReqCertFromX509() writing 64 bytes into
 965     * cert->skid[32]. With the fix, it must return failure. */
 966    bio = wolfSSL_BIO_new(wolfSSL_BIO_s_mem());
 967    ExpectNotNull(bio);
 968    ExpectIntNE(wolfSSL_i2d_X509_REQ_bio(bio, req), WOLFSSL_SUCCESS);
 969
 970    wolfSSL_BIO_free(bio);
 971    wolfSSL_X509_free(req);
 972#endif
 973    return EXPECT_RESULT();
 974}
 975
 976/* Positive / boundary companion to test_x509_ReqCertFromX509_skid_overflow.
 977 * Verifies that a CSR with a SubjectKeyIdentifier of exactly
 978 * CTC_MAX_SKID_SIZE (32) bytes -- the boundary of the bounds check in
 979 * ReqCertFromX509() -- is accepted and that the SKID round-trips with the
 980 * correct length and bytes through the sign / re-encode / re-parse path.
 981 * This kills boundary mutations (">" -> ">=") and copy-size mutations on
 982 * the XMEMCPY into cert->skid that the negative test alone cannot catch. */
 983int test_x509_ReqCertFromX509_skid_boundary(void)
 984{
 985    EXPECT_DECLS;
 986#if defined(WOLFSSL_CERT_REQ) && defined(WOLFSSL_CERT_GEN) && \
 987    defined(WOLFSSL_CERT_EXT) && !defined(NO_BIO) && \
 988    (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
 989    defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)
 990
 991    WOLFSSL_EVP_PKEY* priv = NULL;
 992    WOLFSSL_EVP_PKEY* pub  = NULL;
 993    WOLFSSL_X509*     req  = NULL;
 994    WOLFSSL_X509*     parsed = NULL;
 995    WOLFSSL_X509_NAME* name = NULL;
 996    unsigned char*    der  = NULL;
 997    int               derSz = 0;
 998    const unsigned char* ecPriv = ecc_clikey_der_256;
 999    const unsigned char* ecPub  = ecc_clikeypub_der_256;
1000    unsigned char     expected_skid[CTC_MAX_SKID_SIZE];
1001
1002    XMEMSET(expected_skid, 0x41, sizeof(expected_skid));
1003
1004    /* Load a real ECC keypair so that the CSR can actually be signed
1005     * (ReqCertFromX509() is invoked from the signing path). */
1006    ExpectNotNull(priv = wolfSSL_d2i_PrivateKey(EVP_PKEY_EC, NULL, &ecPriv,
1007                    (long)sizeof_ecc_clikey_der_256));
1008    ExpectNotNull(pub = wolfSSL_d2i_PUBKEY(NULL, &ecPub,
1009                    (long)sizeof_ecc_clikeypub_der_256));
1010
1011    ExpectNotNull(req = wolfSSL_X509_REQ_new());
1012    ExpectNotNull(name = wolfSSL_X509_NAME_new());
1013    ExpectIntEQ(wolfSSL_X509_NAME_add_entry_by_txt(name, "commonName",
1014                    MBSTRING_UTF8, (const byte*)"Test", 4, -1, 0),
1015                WOLFSSL_SUCCESS);
1016    ExpectIntEQ(wolfSSL_X509_REQ_set_subject_name(req, name), WOLFSSL_SUCCESS);
1017    ExpectIntEQ(wolfSSL_X509_REQ_set_pubkey(req, pub), WOLFSSL_SUCCESS);
1018
1019    /* Inject exactly CTC_MAX_SKID_SIZE bytes of SKID directly on the req
1020     * (tests/api/test_x509.c already includes <wolfssl/internal.h>). This
1021     * is the boundary value of the bounds check in ReqCertFromX509(). */
1022    if (EXPECT_SUCCESS() && req != NULL) {
1023        req->subjKeyId = (byte*)XMALLOC(sizeof(expected_skid), NULL,
1024                                        DYNAMIC_TYPE_X509_EXT);
1025        ExpectNotNull(req->subjKeyId);
1026        if (req->subjKeyId != NULL) {
1027            XMEMCPY(req->subjKeyId, expected_skid, sizeof(expected_skid));
1028            req->subjKeyIdSz = (word32)sizeof(expected_skid);
1029        }
1030    }
1031
1032    /* Signing invokes wolfssl_x509_make_der() -> ReqCertFromX509(), which
1033     * executes the bounds check and the XMEMCPY into cert->skid. A
1034     * ">=" boundary mutation would make this step fail for a 32-byte
1035     * SKID. */
1036    ExpectIntEQ(wolfSSL_X509_REQ_sign(req, priv, wolfSSL_EVP_sha256()),
1037                WOLFSSL_SUCCESS);
1038
1039    /* Re-encode the now-signed CSR and parse it back to verify the SKID
1040     * round-trips with the correct length and bytes. This verifies the
1041     * output of the XMEMCPY in ReqCertFromX509(). */
1042    ExpectIntGT((derSz = wolfSSL_i2d_X509_REQ(req, &der)), 0);
1043    ExpectNotNull(der);
1044
1045    ExpectNotNull(parsed = wolfSSL_X509_REQ_d2i(NULL, der, derSz));
1046    if (parsed != NULL) {
1047        ExpectIntEQ((int)parsed->subjKeyIdSz, CTC_MAX_SKID_SIZE);
1048        ExpectNotNull(parsed->subjKeyId);
1049        if (parsed->subjKeyId != NULL) {
1050            ExpectIntEQ(XMEMCMP(parsed->subjKeyId, expected_skid,
1051                                CTC_MAX_SKID_SIZE), 0);
1052        }
1053    }
1054
1055    wolfSSL_X509_free(parsed);
1056    XFREE(der, NULL, DYNAMIC_TYPE_OPENSSL);
1057    wolfSSL_X509_NAME_free(name);
1058    wolfSSL_X509_free(req);
1059    wolfSSL_EVP_PKEY_free(pub);
1060    wolfSSL_EVP_PKEY_free(priv);
1061#endif
1062    return EXPECT_RESULT();
1063}