Algorithm: allow the parameter field of RSA Signature Algorithm to be…

… not present

this fixes mirleft#108 - though ECC support is still lacking

lib/algorithm.ml

@@ -108,6 +108,13 @@ and[@ocaml.warning "-8"] of_signature_algorithm public_key_algorithm digest =
  * PKCS1/RFC5280 allows params to be `ANY', depending on the algorithm.  I don't
  * know of one that uses anything other than NULL and OID, however, so we accept
  * only that.
+
+   RFC 3279 Section 2.2.1 defines for RSA Signature Algorithms SHALL have null
+   as parameter, but certificates in the wild don't contain the parameter field
+   at all (it is optional). We accept both, and output a null paramter.
+   Section 2.2.2 specifies DSA to have a null parameter,
+   Section 2.2.3 specifies ECDSA to have a null parameter,
+   Section 2.3.1 specifies rsaEncryption (for RSA public keys) requires null.
  *)
 
 let identifier =
@@ -120,6 +127,9 @@ let identifier =
     and null x = function
       | Some (`C1 ()) -> x
       | _             -> parse_error "Algorithm: expected null parameters"
+    and null_or_none x = function
+      | None | Some (`C1 ()) -> x
+      | _                    -> parse_error "Algorithm: expected null or none parameter"
     and oid f = function
       | Some (`C2 id) -> f id
       | _             -> parse_error "Algorithm: expected parameter OID"
@@ -129,16 +139,16 @@ let identifier =
 
       (ANSI_X9_62.ec_pub_key, oid (fun id -> EC_pub id)) ;
 
-      (PKCS1.rsa_encryption          , null RSA          ) ;
-      (PKCS1.md2_rsa_encryption      , null MD2_RSA      ) ;
-      (PKCS1.md4_rsa_encryption      , null MD4_RSA      ) ;
-      (PKCS1.md5_rsa_encryption      , null MD5_RSA      ) ;
-      (PKCS1.ripemd160_rsa_encryption, null RIPEMD160_RSA) ;
-      (PKCS1.sha1_rsa_encryption     , null SHA1_RSA     ) ;
-      (PKCS1.sha256_rsa_encryption   , null SHA256_RSA   ) ;
-      (PKCS1.sha384_rsa_encryption   , null SHA384_RSA   ) ;
-      (PKCS1.sha512_rsa_encryption   , null SHA512_RSA   ) ;
-      (PKCS1.sha224_rsa_encryption   , null SHA224_RSA   ) ;
+      (PKCS1.rsa_encryption          , null RSA                  ) ;
+      (PKCS1.md2_rsa_encryption      , null_or_none MD2_RSA      ) ;
+      (PKCS1.md4_rsa_encryption      , null_or_none MD4_RSA      ) ;
+      (PKCS1.md5_rsa_encryption      , null_or_none MD5_RSA      ) ;
+      (PKCS1.ripemd160_rsa_encryption, null_or_none RIPEMD160_RSA) ;
+      (PKCS1.sha1_rsa_encryption     , null_or_none SHA1_RSA     ) ;
+      (PKCS1.sha256_rsa_encryption   , null_or_none SHA256_RSA   ) ;
+      (PKCS1.sha384_rsa_encryption   , null_or_none SHA384_RSA   ) ;
+      (PKCS1.sha512_rsa_encryption   , null_or_none SHA512_RSA   ) ;
+      (PKCS1.sha224_rsa_encryption   , null_or_none SHA224_RSA   ) ;
 
       (ANSI_X9_62.ecdsa_sha1         , none ECDSA_SHA1   ) ;
       (ANSI_X9_62.ecdsa_sha224       , none ECDSA_SHA224 ) ;

tests/regression.ml

@@ -111,6 +111,9 @@ let test_distinguished_name_pp () =
   check pp4 dn2 {|/O=\ Escapist/CN=\# 2/CN=\ \"\+,;\/\<\>\\ \ |} ;
   check pp5 dn1 "CN=John Doe+\nInitials=J.D.+\nInitials=N.N.,\nO=Blanc"
 
+let test_yubico () =
+  ignore (cert "yubico")
+
 let regression_tests = [
   "RSA: key too small (jc_jc)", `Quick, test_jc_jc ;
   "jc_ca", `Quick, test_jc_ca_fail ;
@@ -121,6 +124,7 @@ let regression_tests = [
   "name constraint parsing (DNS: .gr)", `Quick, test_name_constraints ;
   "complex distinguished name", `Quick, test_distinguished_name ;
   "distinguished name pp", `Quick, test_distinguished_name_pp ;
+  "algorithm without null", `Quick, test_yubico ;
 ]
 
 let host_set_test =

tests/regression/yubico.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICGzCCAQWgAwIBAgIEQMQSJTALBgkqhkiG9w0BAQswLjEsMCoGA1UEAxMjWXVi
+aWNvIFUyRiBSb290IENBIFNlcmlhbCA0NTcyMDA2MzEwIBcNMTQwODAxMDAwMDAw
+WhgPMjA1MDA5MDQwMDAwMDBaMCoxKDAmBgNVBAMMH1l1YmljbyBVMkYgRUUgU2Vy
+aWFsIDEwODY1OTE1MjUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAStoklVeyhj
+RHTxPqBxr6GzZx1cOmWerwd4zSGAdQuLd9jrnB8zMHh6jOQgDEjAx7X6db7iWGok
+EpO42+jOPFrXoxIwEDAOBgorBgEEAYLECgEBBAAwCwYJKoZIhvcNAQELA4IBAQFY
+NAaBBxBKeCyS2D2BQAkRkvFmYl5AgPHK2C4Bp873yl8D8MiiZVM2Mcb+caEa5ec4
+5CFF4WeJpx2VbJ4/RGP1Rg7kUcyl+2LcU2aRWZ+3o92m4y4XJE5JEPwIVJJj+1bi
+tgFi4GLEvHoxlKroIQbCr4f/OLsUwBK+QUvjhoNsou1CI3fFtJzgnOhDfHf/MAoj
+zo7dmP/kyqSy01yrM5OFJ1jc0XcQU4ZgQaayQWWxdVclUbyZuckSwabYdxvCjL67
+eDbtxHKI/0NeeCCaVntQ6dbqQxSzhvZ1gkUJNuWNuuJPQQyEn6rPsB71IyKNog5y
+peVFaGrk1mk+zOirhMJe
+-----END CERTIFICATE-----