Sanity check for valid certificate in xProvisionCertificate
Add JITR cert unspecified check in vAlternateKeyProvisioning
@@ -571,6 +571,7 @@ CK_RV xProvisionCertificate( CK_SESSION_HANDLE xSession,
CK_BYTE xSubject[] = "TestSubject";
+
/* Initialize the client certificate template. */
xCertificateTemplate.xObjectClass.type = CKA_CLASS;
xCertificateTemplate.xObjectClass.pValue = &xCertificateClass;
@@ -593,6 +594,12 @@ CK_RV xProvisionCertificate( CK_SESSION_HANDLE xSession,
xResult = C_GetFunctionList( &pxFunctionList );
+ /* Litmus test for valid certificiate. 0x2d is '-' as in ----- BEGIN CERTIFICATE ----- */
+ if( ( pucCertificate == NULL ) || ( pucCertificate[ 0 ] != 0x2d ) )
+ {
+ xResult = CKR_ATTRIBUTE_VALUE_INVALID;
+ }
+
if( xResult == CKR_OK )
{
/* Convert the certificate to DER format if it was in PEM. */
@@ -789,6 +796,20 @@ void vAlternateKeyProvisioning( ProvisioningParams_t * xParams )
CK_FUNCTION_LIST_PTR pxFunctionList = NULL;
CK_SESSION_HANDLE xSession = 0;
+
+ /* If using a JITR flow, a JITR certificate must be supplied. If using credentials generated by
+ * AWS, this certificate is not needed. */
+ if( ( NULL == xParams->pucJITPCertificate ) ||
+ ( 0 == strcmp( "", ( const char * ) xParams->pucJITPCertificate ) ) )
+ {
+ xParams->ulJITPCertifiateLength = 0;
+ configPRINTF( ( "No JITP certificate supplied (JITP certificate is not necessary when using AWS issued credentials). \r\n" ) );
+ }
+ else
+ {
+ xParams->ulJITPCertifiateLength = 1 + strlen( ( const char * ) xParams->pucJITPCertificate );
+ }
+
xResult = C_GetFunctionList( &pxFunctionList );
/* Initialize the PKCS Module */
@@ -818,19 +839,6 @@ void vDevModeKeyProvisioning( void )
xParams.pucClientCertificate = ( uint8_t * ) keyCLIENT_CERTIFICATE_PEM;
xParams.pucJITPCertificate = ( uint8_t * ) keyJITR_DEVICE_CERTIFICATE_AUTHORITY_PEM;
- /* If using a JITR flow, a JITR certificate must be supplied. If using credentials generated by
- * AWS, this certificate is not needed. */
- if( ( NULL == xParams.pucJITPCertificate ) ||
- ( 0 == strcmp( "", ( const char * ) xParams.pucJITPCertificate ) ) )
- {
- xParams.ulJITPCertifiateLength = 0;
- configPRINTF( ( "No JITP certificate supplied (JITP certificate is not necessary when using AWS issued credentials). \r\n" ) );
- }
- else
- {
- xParams.ulJITPCertifiateLength = 1 + strlen( ( const char * ) xParams.pucJITPCertificate );
- }
-
if( ( NULL == xParams.pucClientPrivateKey ) ||
( 0 == strcmp( "", ( const char * ) xParams.pucClientPrivateKey ) ) ||
( NULL == xParams.pucClientCertificate ) ||
