Merge pull request #54 from lealem47/F7846

F7846: wolfx509: pass the signer's RNG to wc_MakeCert

Author: mattia-moffa

handles/ecc_handles.go

@@ -149,7 +149,13 @@ func (k *EccKey) Rng() *wolfSSL.WC_RNG { return &k.rng }
 
 func (k *EccKey) Algorithm() Algorithm    { return AlgECDSAP256 }
 func (k *EccKey) CKeyPtr() unsafe.Pointer { return unsafe.Pointer(&k.raw) }
-func (k *EccKey) CRngPtr() unsafe.Pointer { return unsafe.Pointer(&k.rng) }
+
+func (k *EccKey) CRngPtr() unsafe.Pointer {
+	if k == nil || !k.hasRng {
+		return nil
+	}
+	return unsafe.Pointer(&k.rng)
+}
 
 // -----------------------------------------------------------------------------
 // EccKey marshal/parse helpers

wolfx509/certgen_test.go

@@ -231,6 +231,71 @@ func TestCreateCASignedCert(t *testing.T) {
 	}
 }
 
+func TestCASignParsedPublicKeySerialGeneration(t *testing.T) {
+	caKey, err := GenerateP256Key()
+	if err != nil {
+		t.Fatalf("GenerateP256Key: %v", err)
+	}
+	defer caKey.Free()
+
+	caTmpl := &Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               Name{CommonName: "auto serial CA"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              KeyUsageCertSign,
+	}
+	caDER, err := CreateCertificate(caTmpl, caTmpl, caKey, caKey)
+	if err != nil {
+		t.Fatalf("CreateCertificate(CA): %v", err)
+	}
+	caCert, err := ParseCertificate(caDER)
+	if err != nil {
+		t.Fatalf("ParseCertificate(CA): %v", err)
+	}
+	defer caCert.Free()
+
+	// The subject key as a CA sees it: parsed from a certificate, so
+	// public-key-only and carrying no RNG.
+	subjectDER, err := CreateCertificate(caTmpl, caTmpl, caKey, caKey)
+	if err != nil {
+		t.Fatalf("CreateCertificate(subject): %v", err)
+	}
+	subject, err := ParseCertificate(subjectDER)
+	if err != nil {
+		t.Fatalf("ParseCertificate(subject): %v", err)
+	}
+	defer subject.Free()
+	if subject.PublicKey == nil {
+		t.Fatal("parsed certificate carries no PublicKey")
+	}
+	if subject.PublicKey.CRngPtr() != nil {
+		t.Error("a parsed public key should report no RNG")
+	}
+
+	leafTmpl := &Certificate{
+		// No SerialNumber here: CreateCertificate has to generates one.
+		Subject:   Name{CommonName: "auto serial leaf"},
+		NotBefore: time.Now().Add(-time.Hour),
+		NotAfter:  time.Now().Add(24 * time.Hour),
+	}
+	leafDER, err := CreateCertificate(leafTmpl, caCert, subject.PublicKey, caKey)
+	if err != nil {
+		t.Fatalf("CA-signing a parsed public key with an auto serial: %v", err)
+	}
+
+	leaf, err := ParseCertificate(leafDER)
+	if err != nil {
+		t.Fatalf("ParseCertificate(leaf): %v", err)
+	}
+	defer leaf.Free()
+	if leaf.SerialNumber == nil || leaf.SerialNumber.Sign() == 0 {
+		t.Errorf("expected a generated serial, got %v", leaf.SerialNumber)
+	}
+}
+
 func TestCreateCertificateRequest(t *testing.T) {
 	k, err := GenerateP256Key()
 	if err != nil {

wolfx509/certgen_wolfcrypt.go

@@ -157,6 +157,9 @@ func buildAndSignCert(opts certBuildOpts, parentDER []byte, pubKey, signerKey Ke
 	if signerKey == nil {
 		return nil, errors.New("wolfx509: signerKey is nil")
 	}
+	if signerKey.CRngPtr() == nil {
+		return nil, errors.New("wolfx509: signerKey has no RNG, and cannot sign")
+	}
 	if pubKey.Algorithm() != signerKey.Algorithm() {
 		return nil, fmt.Errorf("wolfx509: pubKey algorithm %d does not match signerKey algorithm %d",
 			pubKey.Algorithm(), signerKey.Algorithm())
@@ -258,8 +261,7 @@ func buildAndSignCert(opts certBuildOpts, parentDER []byte, pubKey, signerKey Ke
 		if isCSR {
 			bodySz = int(C.wc_MakeCertReq(&cert, derPtr, derCap, nil, pubEcc))
 		} else {
-			pubRng := (*C.WC_RNG)(pubKey.CRngPtr())
-			bodySz = int(C.wc_MakeCert(&cert, derPtr, derCap, nil, pubEcc, pubRng))
+			bodySz = int(C.wc_MakeCert(&cert, derPtr, derCap, nil, pubEcc, signerRng))
 		}
 		if bodySz < 0 {
 			return nil, fmt.Errorf("wolfCrypt: body build failed: %d", bodySz)