Add X509 name match

CMakeLists.txt

@@ -820,7 +820,7 @@ endif()
 #
 set(CPACK_PACKAGE_NAME "GmSSL")
 set(CPACK_PACKAGE_VENDOR "GmSSL develop team")
-set(CPACK_PACKAGE_VERSION "3.2.0-dev.1093")
+set(CPACK_PACKAGE_VERSION "3.2.0-dev.1094")
 set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md)
 set(CPACK_NSIS_MODIFY_PATH ON)
 include(CPack)

include/gmssl/asn1.h

@@ -214,6 +214,7 @@ int asn1_oid_info_from_der(const ASN1_OID_INFO **info,
 #define asn1_implicit_enumerated_from_der(i,val,in,inlen) asn1_int_from_der_ex(ASN1_TAG_IMPLICIT(i),val,in,inlen)
 
 int asn1_string_is_utf8_string(const char *d, size_t dlen);
+int asn1_utf8_string_next_code_point(const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point);
 int asn1_utf8_string_to_der_ex(int tag, const char *d, size_t dlen, uint8_t **out, size_t *outlen);
 int asn1_utf8_string_from_der_ex(int tag, const char **d, size_t *dlen, const uint8_t **in, size_t *inlen);
 #define asn1_utf8_string_to_der(d,dlen,out,outlen) asn1_utf8_string_to_der_ex(ASN1_TAG_UTF8String,d,dlen,out,outlen)
@@ -222,6 +223,7 @@ int asn1_utf8_string_from_der_ex(int tag, const char **d, size_t *dlen, const ui
 #define asn1_implicit_utf8_string_from_der(i,d,dlen,in,inlen) asn1_utf8_string_from_der_ex(ASN1_TAG_IMPLICIT(i),d,dlen,in,inlen)
 
 int asn1_string_is_printable_string(const char *d, size_t dlen);
+int asn1_printable_string_next_code_point(const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point);
 int asn1_printable_string_case_ignore_match(const char *a, size_t alen, const char *b, size_t blen);
 int asn1_printable_string_to_der_ex(int tag, const char *d, size_t dlen, uint8_t **out, size_t *outlen);
 int asn1_printable_string_from_der_ex(int tag, const char **d, size_t *dlen, const uint8_t **in, size_t *inlen);
@@ -231,6 +233,7 @@ int asn1_printable_string_from_der_ex(int tag, const char **d, size_t *dlen, con
 #define asn1_implicit_printable_string_from_der(i,d,dlen,in,inlen) asn1_printable_string_from_der_ex(ASN1_TAG_IMPLICIT(i),d,dlen,in,inlen)
 
 int asn1_string_is_ia5_string(const char *d, size_t dlen);
+int asn1_ia5_string_next_code_point(const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point);
 int asn1_ia5_string_to_der_ex(int tag, const char *d, size_t dlen, uint8_t **out, size_t *outlen);
 int asn1_ia5_string_from_der_ex(int tag, const char **d, size_t *dlen, const uint8_t **in, size_t *inlen);
 #define asn1_ia5_string_to_der(d,dlen,out,outlen) asn1_ia5_string_to_der_ex(ASN1_TAG_IA5String,d,dlen,out,outlen)
@@ -238,6 +241,9 @@ int asn1_ia5_string_from_der_ex(int tag, const char **d, size_t *dlen, const uin
 #define asn1_implicit_ia5_string_to_der(i,d,dlen,out,outlen) asn1_ia5_string_to_der_ex(ASN1_TAG_IMPLICIT(i),d,dlen,out,outlen)
 #define asn1_implicit_ia5_string_from_der(i,d,dlen,in,inlen) asn1_ia5_string_from_der_ex(ASN1_TAG_IMPLICIT(i),d,dlen,in,inlen)
 
+int asn1_bmp_string_next_code_point(const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point);
+int asn1_universal_string_next_code_point(const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point);
+
 int asn1_string_print(FILE *fp, int fmt, int ind, const char *label, int tag, const uint8_t *d, size_t dlen);
 
 #define ASN1_UTC_TIME_STRLEN		(sizeof("YYMMDDHHMMSSZ")-1)

include/gmssl/version.h

@@ -18,7 +18,7 @@ extern "C" {
 
 
 #define GMSSL_VERSION_NUM	30200
-#define GMSSL_VERSION_STR	"GmSSL 3.2.0-dev.1093"
+#define GMSSL_VERSION_STR	"GmSSL 3.2.0-dev.1094"
 
 int gmssl_version_num(void);
 const char *gmssl_version_str(void);

include/gmssl/x509_cer.h

@@ -153,6 +153,7 @@ int x509_name_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t
 int x509_name_get_value_by_type(const uint8_t *d, size_t dlen, int oid, int *tag, const uint8_t **val, size_t *vlen);
 int x509_name_get_common_name(const uint8_t *d, size_t dlen, int *tag, const uint8_t **val, size_t *vlen);
 int x509_name_equ(const uint8_t *a, size_t alen, const uint8_t *b, size_t blen);
+int x509_name_normalized_equ(const uint8_t *a, size_t alen, const uint8_t *b, size_t blen);
 
 int x509_names_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *d, size_t dlen);
 

src/x509_vrf.c

@@ -12,6 +12,7 @@
 #include <string.h>
 #include <stdint.h>
 #include <gmssl/asn1.h>
+#include <gmssl/endian.h>
 #include <gmssl/oid.h>
 #include <gmssl/x509_ext.h>
 #include <gmssl/x509_cer.h>
@@ -441,3 +442,634 @@ int x509_cert_check_subject(const uint8_t *cert, size_t certlen, int cert_type)
 
 	return 1;
 }
+
+static int x509_name_string_char_from_bytes(int tag, const uint8_t **in, size_t *inlen, uint32_t *ch)
+{
+	int ret = 1;
+	const uint8_t *p;
+	size_t len;
+
+	if (!in || !*in || !inlen || !ch) {
+		error_print();
+		return -1;
+	}
+	p = *in;
+	len = *inlen;
+
+	if (len == 0) {
+		ret = 0;
+	} else {
+		switch (tag) {
+		case ASN1_TAG_TeletexString:
+			*ch = p[0];
+			p++;
+			len--;
+			break;
+		case ASN1_TAG_PrintableString:
+			if (asn1_printable_string_next_code_point(*in, *inlen, &p, ch) != 1) {
+				error_print();
+				return -1;
+			}
+			len = *inlen - (size_t)(p - *in);
+			break;
+		case ASN1_TAG_IA5String:
+			if (asn1_ia5_string_next_code_point(*in, *inlen, &p, ch) != 1) {
+				error_print();
+				return -1;
+			}
+			len = *inlen - (size_t)(p - *in);
+			break;
+		case ASN1_TAG_UTF8String:
+			if (asn1_utf8_string_next_code_point(*in, *inlen, &p, ch) != 1) {
+				error_print();
+				return -1;
+			}
+			len = *inlen - (size_t)(p - *in);
+			break;
+		case ASN1_TAG_BMPString:
+			if (asn1_bmp_string_next_code_point(*in, *inlen, &p, ch) != 1) {
+				error_print();
+				return -1;
+			}
+			len = *inlen - (size_t)(p - *in);
+			break;
+		case ASN1_TAG_UniversalString:
+			if (asn1_universal_string_next_code_point(*in, *inlen, &p, ch) != 1) {
+				error_print();
+				return -1;
+			}
+			len = *inlen - (size_t)(p - *in);
+			break;
+		default:
+			ret = 0;
+			break;
+		}
+	}
+
+	if (ret == 1) {
+		*in = p;
+		*inlen = len;
+	}
+	return ret;
+}
+
+static int x509_name_string_next_normalized_code_point(int tag,
+	const uint8_t *str, size_t len, const uint8_t **ptr, uint32_t *code_point)
+{
+	int ret;
+	const uint8_t *p;
+	const uint8_t *q;
+	const uint8_t *end;
+	size_t qlen;
+	uint32_t ch;
+
+	if (!ptr || !code_point || (!str && len)) {
+		error_print();
+		return -1;
+	}
+	if (!str) {
+		if (*ptr) {
+			error_print();
+			return -1;
+		}
+		return 0;
+	}
+
+	end = str + len;
+	p = *ptr ? *ptr : str;
+	if (p < str || p > end) {
+		error_print();
+		return -1;
+	}
+
+	while (p < end) {
+		q = p;
+		qlen = (size_t)(end - q);
+		if ((ret = x509_name_string_char_from_bytes(tag, &q, &qlen, &ch)) != 1) {
+			if (ret == 0) error_print();
+			return -1;
+		}
+		if ('A' <= ch && ch <= 'Z') {
+			ch += 'a' - 'A';
+		}
+		if (ch != ' ') {
+			*code_point = ch;
+			*ptr = q;
+			return 1;
+		}
+
+		/* Skip leading spaces and collapse repeated spaces. */
+		while (q < end) {
+			const uint8_t *r = q;
+			size_t rlen = (size_t)(end - r);
+
+			if ((ret = x509_name_string_char_from_bytes(tag, &r, &rlen, &ch)) != 1) {
+				if (ret == 0) error_print();
+				return -1;
+			}
+			if ('A' <= ch && ch <= 'Z') {
+				ch += 'a' - 'A';
+			}
+			if (ch != ' ') {
+				break;
+			}
+			q = r;
+		}
+		if (q == end) {
+			*ptr = end;
+			return 0;
+		}
+		if (p == str) {
+			p = q;
+			continue;
+		}
+		*code_point = ' ';
+		*ptr = q;
+		return 1;
+	}
+
+	*ptr = end;
+	return 0;
+}
+
+static int x509_name_string_normalized_equ(int a_tag, const uint8_t *a, size_t alen,
+	int b_tag, const uint8_t *b, size_t blen)
+{
+	int a_ret;
+	int b_ret;
+	const uint8_t *a_ptr = NULL;
+	const uint8_t *b_ptr = NULL;
+	uint32_t a_ch;
+	uint32_t b_ch;
+
+	for (;;) {
+		a_ret = x509_name_string_next_normalized_code_point(a_tag, a, alen, &a_ptr, &a_ch);
+		b_ret = x509_name_string_next_normalized_code_point(b_tag, b, blen, &b_ptr, &b_ch);
+		if (a_ret < 0 || b_ret < 0) {
+			error_print();
+			return -1;
+		}
+		if (a_ret == 0 || b_ret == 0) {
+			return a_ret == b_ret ? 1 : 0;
+		}
+		if (a_ch != b_ch) {
+			return 0;
+		}
+	}
+}
+
+static int x509_name_string_tag(int tag)
+{
+	int ret = 0;
+
+	switch (tag) {
+	case ASN1_TAG_TeletexString:
+	case ASN1_TAG_PrintableString:
+	case ASN1_TAG_UniversalString:
+	case ASN1_TAG_UTF8String:
+	case ASN1_TAG_BMPString:
+	case ASN1_TAG_IA5String:
+		ret = 1;
+		break;
+	default:
+		break;
+	}
+	return ret;
+}
+
+/*
+ * 这个 _ex 版本和 x509_attr_type_and_value_from_der() 的区别是：
+ * 1. 保留 type 的原始 OBJECT IDENTIFIER DER 编码，因此未知 OID 也可以参与比较；
+ * 2. 保留 value 的完整 DER 编码，因此未知或非字符串类型的 value 可以退化为严格 DER 比较；
+ * 3. 不调用 x509_attr_type_and_value_check()，避免证书验证时因为本库暂未内置的
+ *    AttributeTypeAndValue 类型而提前失败。
+ *
+ * TODO: 以后可以让 x509_attr_type_and_value_from_der() 基于这个 _ex 版本实现，
+ *       在通用解析结果之上再做已知 OID 映射和属性值检查。
+ */
+static int x509_attr_type_and_value_from_der_ex(const uint8_t **oid, size_t *oid_len,
+	int *val_tag, const uint8_t **val, size_t *val_len,
+	const uint8_t **val_der, size_t *val_der_len,
+	const uint8_t **in, size_t *inlen)
+{
+	int ret = -1;
+	const uint8_t *d;
+	size_t dlen;
+	const uint8_t *p;
+	size_t len;
+	const uint8_t *oid_val;
+	size_t oid_val_len;
+
+	if (!oid || !oid_len || !val_tag || !val || !val_len || !val_der || !val_der_len
+		|| !in || !*in || !inlen) {
+		error_print();
+		return -1;
+	}
+	if (asn1_sequence_from_der(&d, &dlen, in, inlen) != 1) {
+		error_print();
+		goto end;
+	}
+	if (asn1_any_from_der(oid, oid_len, &d, &dlen) != 1) {
+		error_print();
+		goto end;
+	}
+	p = *oid;
+	len = *oid_len;
+	if (asn1_type_from_der(ASN1_TAG_OBJECT_IDENTIFIER, &oid_val, &oid_val_len, &p, &len) != 1
+		|| asn1_length_is_zero(len) != 1) {
+		error_print();
+		goto end;
+	}
+	*val_der = d;
+	*val_der_len = dlen;
+	if (asn1_any_type_from_der(val_tag, val, val_len, &d, &dlen) != 1) {
+		error_print();
+		goto end;
+	}
+	*val_der_len -= dlen;
+	if (asn1_length_is_zero(dlen) != 1) {
+		error_print();
+		goto end;
+	}
+	ret = 1;
+end:
+	return ret;
+}
+
+static int x509_attr_type_and_value_normalized_equ(const uint8_t *a, size_t alen,
+	const uint8_t *b, size_t blen)
+{
+	int ret = 0;
+	const uint8_t *a_oid;
+	const uint8_t *b_oid;
+	size_t a_oid_len;
+	size_t b_oid_len;
+	int a_tag;
+	int b_tag;
+	const uint8_t *a_val;
+	const uint8_t *b_val;
+	size_t a_val_len;
+	size_t b_val_len;
+	const uint8_t *a_val_der;
+	const uint8_t *b_val_der;
+	size_t a_val_der_len;
+	size_t b_val_der_len;
+
+	if (x509_attr_type_and_value_from_der_ex(&a_oid, &a_oid_len, &a_tag,
+			&a_val, &a_val_len, &a_val_der, &a_val_der_len, &a, &alen) != 1
+		|| asn1_length_is_zero(alen) != 1
+		|| x509_attr_type_and_value_from_der_ex(&b_oid, &b_oid_len, &b_tag,
+			&b_val, &b_val_len, &b_val_der, &b_val_der_len, &b, &blen) != 1
+		|| asn1_length_is_zero(blen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (a_oid_len != b_oid_len || memcmp(a_oid, b_oid, a_oid_len) != 0) {
+		ret = 0;
+	} else if (a_val_der_len == b_val_der_len
+		&& memcmp(a_val_der, b_val_der, a_val_der_len) == 0) {
+		ret = 1;
+	} else if (x509_name_string_tag(a_tag) && x509_name_string_tag(b_tag)) {
+		ret = x509_name_string_normalized_equ(a_tag, a_val, a_val_len, b_tag, b_val, b_val_len);
+		if (ret < 0) error_print();
+	}
+	return ret;
+}
+
+static int x509_rdn_count(const uint8_t *d, size_t dlen, size_t *count)
+{
+	int ret = -1;
+	const uint8_t *p;
+	size_t len;
+	size_t n = 0;
+
+	if (!count) {
+		error_print();
+		return -1;
+	}
+	while (dlen) {
+		if (asn1_sequence_from_der(&p, &len, &d, &dlen) != 1) {
+			error_print();
+			goto end;
+		}
+		n++;
+	}
+	*count = n;
+	ret = 1;
+end:
+	return ret;
+}
+
+static int x509_rdn_count_attr_type_and_value(const uint8_t *rdn, size_t rdnlen,
+	const uint8_t *ava, size_t avalen, size_t *count)
+{
+	int ret;
+	const uint8_t *p;
+	size_t len;
+	size_t n = 0;
+
+	if (!count) {
+		error_print();
+		return -1;
+	}
+	while (rdnlen) {
+		if (asn1_any_from_der(&p, &len, &rdn, &rdnlen) != 1) {
+			error_print();
+			return -1;
+		}
+		if ((ret = x509_attr_type_and_value_normalized_equ(ava, avalen, p, len)) < 0) {
+			error_print();
+			return -1;
+		}
+		if (ret) {
+			n++;
+		}
+	}
+	*count = n;
+	return 1;
+}
+
+static int x509_rdn_normalized_equ(const uint8_t *a, size_t alen, const uint8_t *b, size_t blen)
+{
+	int ret = 0;
+	const uint8_t *a_orig = a;
+	size_t a_orig_len = alen;
+	const uint8_t *a_ava;
+	size_t a_ava_len;
+	size_t a_count = 0;
+	size_t b_count = 0;
+	size_t a_ava_count;
+	size_t b_ava_count;
+	size_t prev_len;
+
+	if (x509_rdn_count(a, alen, &a_count) != 1
+		|| x509_rdn_count(b, blen, &b_count) != 1) {
+		error_print();
+		ret = -1;
+		goto end;
+	}
+	if (a_count != b_count) {
+		goto end;
+	}
+
+	while (alen) {
+		if (asn1_any_from_der(&a_ava, &a_ava_len, &a, &alen) != 1) {
+			error_print();
+			ret = -1;
+			goto end;
+		}
+		prev_len = (size_t)(a_ava - a_orig);
+		if (prev_len) {
+			if (x509_rdn_count_attr_type_and_value(a_orig, prev_len, a_ava, a_ava_len, &a_ava_count) != 1) {
+				error_print();
+				ret = -1;
+				goto end;
+			}
+			if (a_ava_count) {
+				continue;
+			}
+		}
+		if (x509_rdn_count_attr_type_and_value(a_orig, a_orig_len, a_ava, a_ava_len, &a_ava_count) != 1
+			|| x509_rdn_count_attr_type_and_value(b, blen, a_ava, a_ava_len, &b_ava_count) != 1) {
+			error_print();
+			ret = -1;
+			goto end;
+		}
+		if (a_ava_count != b_ava_count) {
+			goto end;
+		}
+	}
+	ret = 1;
+end:
+	return ret;
+}
+
+int x509_name_normalized_equ(const uint8_t *a, size_t alen, const uint8_t *b, size_t blen)
+{
+	int ret = 0;
+	const uint8_t *a_rdn;
+	const uint8_t *b_rdn;
+	size_t a_rdn_len;
+	size_t b_rdn_len;
+
+	if ((!a && alen) || (!b && blen)) {
+		error_print();
+		return -1;
+	}
+	while (alen && blen) {
+		if (asn1_set_from_der(&a_rdn, &a_rdn_len, &a, &alen) != 1
+			|| asn1_set_from_der(&b_rdn, &b_rdn_len, &b, &blen) != 1) {
+			error_print();
+			ret = -1;
+			goto end;
+		}
+		ret = x509_rdn_normalized_equ(a_rdn, a_rdn_len, b_rdn, b_rdn_len);
+		if (ret != 1) {
+			goto end;
+		}
+	}
+	if (alen || blen) {
+		ret = 0;
+	} else {
+		ret = 1;
+	}
+end:
+	return ret;
+}
+
+int asn1_utf8_string_next_code_point(const uint8_t *str, size_t len,
+	const uint8_t **ptr, uint32_t *code_point)
+{
+	const uint8_t *p;
+	const uint8_t *end;
+	size_t rem;
+	uint32_t cp;
+
+	if (!ptr || !code_point || (!str && len)) {
+		error_print();
+		return -1;
+	}
+	if (!str) {
+		if (*ptr) {
+			error_print();
+			return -1;
+		}
+		return 0;
+	}
+
+	end = str + len;
+	p = *ptr ? *ptr : str;
+	if (p < str || p > end) {
+		error_print();
+		return -1;
+	}
+	if (p == end) {
+		return 0;
+	}
+
+	rem = (size_t)(end - p);
+	if (p[0] < 0x80) {
+		cp = p[0];
+		p++;
+	} else if ((p[0] & 0xe0) == 0xc0) {
+		if (rem < 2 || (p[1] & 0xc0) != 0x80 || p[0] < 0xc2) {
+			error_print();
+			return -1;
+		}
+		cp = ((uint32_t)(p[0] & 0x1f) << 6) | (p[1] & 0x3f);
+		p += 2;
+	} else if ((p[0] & 0xf0) == 0xe0) {
+		if (rem < 3
+			|| (p[1] & 0xc0) != 0x80
+			|| (p[2] & 0xc0) != 0x80
+			|| (p[0] == 0xe0 && p[1] < 0xa0)
+			|| (p[0] == 0xed && p[1] >= 0xa0)) {
+			error_print();
+			return -1;
+		}
+		cp = ((uint32_t)(p[0] & 0x0f) << 12)
+			| ((uint32_t)(p[1] & 0x3f) << 6)
+			| (p[2] & 0x3f);
+		p += 3;
+	} else if ((p[0] & 0xf8) == 0xf0) {
+		if (rem < 4
+			|| (p[1] & 0xc0) != 0x80
+			|| (p[2] & 0xc0) != 0x80
+			|| (p[3] & 0xc0) != 0x80
+			|| (p[0] == 0xf0 && p[1] < 0x90)
+			|| p[0] > 0xf4
+			|| (p[0] == 0xf4 && p[1] >= 0x90)) {
+			error_print();
+			return -1;
+		}
+		cp = ((uint32_t)(p[0] & 0x07) << 18)
+			| ((uint32_t)(p[1] & 0x3f) << 12)
+			| ((uint32_t)(p[2] & 0x3f) << 6)
+			| (p[3] & 0x3f);
+		p += 4;
+	} else {
+		error_print();
+		return -1;
+	}
+
+	*code_point = cp;
+	*ptr = p;
+	return 1;
+}
+
+static int asn1_string_next_code_point_ptr(const uint8_t *str, size_t len,
+	const uint8_t **ptr, const uint8_t **p, size_t code_point_len)
+{
+	const uint8_t *end;
+
+	if (!ptr || !p || !code_point_len || (!str && len)) {
+		error_print();
+		return -1;
+	}
+	if (!str) {
+		if (*ptr) {
+			error_print();
+			return -1;
+		}
+		return 0;
+	}
+
+	end = str + len;
+	*p = *ptr ? *ptr : str;
+	if (*p < str || *p > end) {
+		error_print();
+		return -1;
+	}
+	if (*p == end) {
+		return 0;
+	}
+	if ((size_t)(end - *p) < code_point_len) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int asn1_printable_string_next_code_point(const uint8_t *str, size_t len,
+	const uint8_t **ptr, uint32_t *code_point)
+{
+	int ret;
+	const uint8_t *p;
+
+	if (!code_point) {
+		error_print();
+		return -1;
+	}
+	if ((ret = asn1_string_next_code_point_ptr(str, len, ptr, &p, 1)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (asn1_string_is_printable_string((const char *)p, 1) != 1) {
+		error_print();
+		return -1;
+	}
+	*code_point = p[0];
+	*ptr = p + 1;
+	return 1;
+}
+
+int asn1_ia5_string_next_code_point(const uint8_t *str, size_t len,
+	const uint8_t **ptr, uint32_t *code_point)
+{
+	int ret;
+	const uint8_t *p;
+
+	if (!code_point) {
+		error_print();
+		return -1;
+	}
+	if ((ret = asn1_string_next_code_point_ptr(str, len, ptr, &p, 1)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	if (asn1_string_is_ia5_string((const char *)p, 1) != 1) {
+		error_print();
+		return -1;
+	}
+	*code_point = p[0];
+	*ptr = p + 1;
+	return 1;
+}
+
+int asn1_bmp_string_next_code_point(const uint8_t *str, size_t len,
+	const uint8_t **ptr, uint32_t *code_point)
+{
+	int ret;
+	const uint8_t *p;
+
+	if (!code_point || len % 2) {
+		error_print();
+		return -1;
+	}
+	if ((ret = asn1_string_next_code_point_ptr(str, len, ptr, &p, 2)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	*code_point = GETU16(p);
+	*ptr = p + 2;
+	return 1;
+}
+
+int asn1_universal_string_next_code_point(const uint8_t *str, size_t len,
+	const uint8_t **ptr, uint32_t *code_point)
+{
+	int ret;
+	const uint8_t *p;
+
+	if (!code_point || len % 4) {
+		error_print();
+		return -1;
+	}
+	if ((ret = asn1_string_next_code_point_ptr(str, len, ptr, &p, 4)) != 1) {
+		if (ret < 0) error_print();
+		return ret;
+	}
+	*code_point = GETU32(p);
+	*ptr = p + 4;
+	return 1;
+}

tests/asn1test.c

@@ -541,6 +541,92 @@ static int test_asn1_utf8_string(void)
 	return 1;
 }
 
+static int test_asn1_string_next_code_point(void)
+{
+	const uint8_t utf8[] = {
+		0x41, 0xe4, 0xb8, 0xad, 0xf0, 0x9f, 0x98, 0x80
+	};
+	const uint8_t invalid_utf8[] = { 0xc3, 0x41 };
+	const uint8_t printable[] = "Az 09?";
+	const uint8_t invalid_printable[] = "*";
+	const uint8_t ia5[] = "abc@example.com";
+	const uint8_t invalid_ia5[] = { 0x80 };
+	const uint8_t bmp[] = { 0x00, 0x41, 0x4e, 0x2d };
+	const uint8_t invalid_bmp[] = { 0x00 };
+	const uint8_t universal[] = {
+		0x00, 0x00, 0x00, 0x41,
+		0x00, 0x00, 0x4e, 0x2d,
+	};
+	const uint8_t invalid_universal[] = { 0x00, 0x00, 0x00 };
+	const uint8_t *p = NULL;
+	uint32_t cp;
+
+	if (asn1_utf8_string_next_code_point(utf8, sizeof(utf8), &p, &cp) != 1 || cp != 0x41
+		|| asn1_utf8_string_next_code_point(utf8, sizeof(utf8), &p, &cp) != 1 || cp != 0x4e2d
+		|| asn1_utf8_string_next_code_point(utf8, sizeof(utf8), &p, &cp) != 1 || cp != 0x1f600
+		|| asn1_utf8_string_next_code_point(utf8, sizeof(utf8), &p, &cp) != 0) {
+		error_print();
+		return -1;
+	}
+	p = NULL;
+	if (asn1_utf8_string_next_code_point(invalid_utf8, sizeof(invalid_utf8), &p, &cp) != -1) {
+		error_print();
+		return -1;
+	}
+
+	p = NULL;
+	if (asn1_printable_string_next_code_point(printable, sizeof(printable) - 1, &p, &cp) != 1 || cp != 'A'
+		|| asn1_printable_string_next_code_point(printable, sizeof(printable) - 1, &p, &cp) != 1 || cp != 'z') {
+		error_print();
+		return -1;
+	}
+	p = NULL;
+	if (asn1_printable_string_next_code_point(invalid_printable, sizeof(invalid_printable) - 1, &p, &cp) != -1) {
+		error_print();
+		return -1;
+	}
+
+	p = NULL;
+	if (asn1_ia5_string_next_code_point(ia5, sizeof(ia5) - 1, &p, &cp) != 1 || cp != 'a') {
+		error_print();
+		return -1;
+	}
+	p = NULL;
+	if (asn1_ia5_string_next_code_point(invalid_ia5, sizeof(invalid_ia5), &p, &cp) != -1) {
+		error_print();
+		return -1;
+	}
+
+	p = NULL;
+	if (asn1_bmp_string_next_code_point(bmp, sizeof(bmp), &p, &cp) != 1 || cp != 0x41
+		|| asn1_bmp_string_next_code_point(bmp, sizeof(bmp), &p, &cp) != 1 || cp != 0x4e2d
+		|| asn1_bmp_string_next_code_point(bmp, sizeof(bmp), &p, &cp) != 0) {
+		error_print();
+		return -1;
+	}
+	p = NULL;
+	if (asn1_bmp_string_next_code_point(invalid_bmp, sizeof(invalid_bmp), &p, &cp) != -1) {
+		error_print();
+		return -1;
+	}
+
+	p = NULL;
+	if (asn1_universal_string_next_code_point(universal, sizeof(universal), &p, &cp) != 1 || cp != 0x41
+		|| asn1_universal_string_next_code_point(universal, sizeof(universal), &p, &cp) != 1 || cp != 0x4e2d
+		|| asn1_universal_string_next_code_point(universal, sizeof(universal), &p, &cp) != 0) {
+		error_print();
+		return -1;
+	}
+	p = NULL;
+	if (asn1_universal_string_next_code_point(invalid_universal, sizeof(invalid_universal), &p, &cp) != -1) {
+		error_print();
+		return -1;
+	}
+
+	printf("%s() ok\n", __FUNCTION__);
+	return 1;
+}
+
 static int test_asn1_ia5_string(void)
 {
 	char *tests[] = {
@@ -849,6 +935,7 @@ int main(void)
 {
 	if (test_asn1_tag() != 1) goto err;
 	if (test_asn1_utf8_string() != 1) goto err;
+	if (test_asn1_string_next_code_point() != 1) goto err;
 /*
 	if (test_asn1_length() != 1) goto err;
 	if (test_asn1_length_from_ber() != 1) goto err;

tests/x509test.c

@@ -217,6 +217,72 @@ static int test_x509_name(void)
 	return 1;
 }
 
+static int test_x509_name_normalized_equ(void)
+{
+	uint8_t name_a[512];
+	uint8_t name_b[512];
+	uint8_t name_c[512];
+	uint8_t ava_a[128];
+	uint8_t ava_b[128];
+	uint8_t rdn_a[256];
+	uint8_t rdn_b[256];
+	uint8_t *p;
+	size_t name_a_len = 0;
+	size_t name_b_len = 0;
+	size_t name_c_len = 0;
+	size_t ava_a_len = 0;
+	size_t ava_b_len = 0;
+	size_t rdn_a_len = 0;
+	size_t rdn_b_len = 0;
+
+	if (x509_name_add_common_name(name_a, &name_a_len, sizeof(name_a),
+			ASN1_TAG_PrintableString, (uint8_t *)"  CA  Test  ", strlen("  CA  Test  ")) != 1
+		|| x509_name_add_common_name(name_b, &name_b_len, sizeof(name_b),
+			ASN1_TAG_UTF8String, (uint8_t *)"ca test", strlen("ca test")) != 1
+		|| x509_name_add_common_name(name_c, &name_c_len, sizeof(name_c),
+			ASN1_TAG_UTF8String, (uint8_t *)"ca test 2", strlen("ca test 2")) != 1) {
+		error_print();
+		return -1;
+	}
+	if (x509_name_normalized_equ(name_a, name_a_len, name_b, name_b_len) != 1
+		|| x509_name_normalized_equ(name_a, name_a_len, name_c, name_c_len) != 0) {
+		error_print();
+		return -1;
+	}
+
+	p = ava_a;
+	if (x509_attr_type_and_value_to_der(OID_at_organization_name, ASN1_TAG_UTF8String,
+			(uint8_t *)"GmSSL", strlen("GmSSL"), &p, &ava_a_len) != 1) {
+		error_print();
+		return -1;
+	}
+	p = ava_b;
+	if (x509_attr_type_and_value_to_der(OID_at_organizational_unit_name, ASN1_TAG_PrintableString,
+			(uint8_t *)"Test", strlen("Test"), &p, &ava_b_len) != 1) {
+		error_print();
+		return -1;
+	}
+	p = rdn_a;
+	if (x509_rdn_to_der(OID_at_organization_name, ASN1_TAG_UTF8String,
+			(uint8_t *)"GmSSL", strlen("GmSSL"), ava_b, ava_b_len, &p, &rdn_a_len) != 1) {
+		error_print();
+		return -1;
+	}
+	p = rdn_b;
+	if (x509_rdn_to_der(OID_at_organizational_unit_name, ASN1_TAG_PrintableString,
+			(uint8_t *)"Test", strlen("Test"), ava_a, ava_a_len, &p, &rdn_b_len) != 1) {
+		error_print();
+		return -1;
+	}
+	if (x509_name_normalized_equ(rdn_a, rdn_a_len, rdn_b, rdn_b_len) != 1) {
+		error_print();
+		return -1;
+	}
+
+	printf("%s() ok\n", __FUNCTION__);
+	return 1;
+}
+
 static int test_x509_public_key_info(void)
 {
 	int algor = OID_ec_public_key;
@@ -445,6 +511,7 @@ int main(void)
 	if (test_x509_attr_type_and_value() != 1) goto err;
 	if (test_x509_rdn() != 1) goto err;
 	if (test_x509_name() != 1) goto err;
+	if (test_x509_name_normalized_equ() != 1) goto err;
 	if (test_x509_public_key_info() != 1) {
 		error_print();
 		goto err;