mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

restrict the cert version allowed

Browse Source
This commit is contained in:
Jacob Barthelmeh 2020-06-25 15:45:18 -06:00
parent e2afbae6aa
commit 0c7b851bd3
3 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tests/api.c
View File

@ -24157,6 +24157,16 @@ static void test_wolfSSL_X509_sign(void)
XFCLOSE(tmpFile); XFCLOSE(tmpFile);
#endif #endif
/* test invalid version number */
#if defined(OPENSSL_ALL)
AssertIntEQ(X509_get_ext_count(x509), 1);
AssertIntNE(X509_set_version(x509, 6L), 0);
AssertIntGT(X509_sign(x509, priv, EVP_sha256()), 0);
/* uses ParseCert which fails on bad version number */
AssertIntEQ(X509_get_ext_count(x509), SSL_FAILURE);
#endif
#ifndef WOLFSSL_ALT_NAMES #ifndef WOLFSSL_ALT_NAMES
/* Valid case - size should be 798 */ /* Valid case - size should be 798 */
AssertIntEQ(ret, 798); AssertIntEQ(ret, 798);

12
wolfcrypt/src/asn.c
View File

@ -841,8 +841,18 @@ static int GetExplicitVersion(const byte* input, word32* inOutIdx, int* version,
return ASN_PARSE_E; return ASN_PARSE_E;
if (tag == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) { if (tag == (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) {
int ret;
*inOutIdx = ++idx; /* skip header */ *inOutIdx = ++idx; /* skip header */
return GetMyVersion(input, inOutIdx, version, maxIdx); ret = GetMyVersion(input, inOutIdx, version, maxIdx);
if (ret >= 0) {
/* check if version is expected value rfc 5280 4.1 {0, 1, 2} */
if (*version > MAX_X509_VERSION || *version < MIN_X509_VERSION) {
WOLFSSL_MSG("Unexpected certificate version");
ret = ASN_VERSION_E;
}
}
return ret;
} }
/* go back as is */ /* go back as is */

2
wolfssl/wolfcrypt/asn.h
View File

@ -371,6 +371,8 @@ enum Misc_ASN {
TRAILING_ZERO = 1, /* Used for size of zero pad */ TRAILING_ZERO = 1, /* Used for size of zero pad */
ASN_TAG_SZ = 1, /* single byte ASN.1 tag */ ASN_TAG_SZ = 1, /* single byte ASN.1 tag */
MIN_VERSION_SZ = 3, /* Min bytes needed for GetMyVersion */ MIN_VERSION_SZ = 3, /* Min bytes needed for GetMyVersion */
MAX_X509_VERSION = 3, /* Max X509 version allowed */
MIN_X509_VERSION = 0, /* Min X509 version allowed */
#if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || \ #if defined(OPENSSL_ALL) || defined(WOLFSSL_MYSQL_COMPATIBLE) || \
defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \ defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
defined(OPENSSL_EXTRA) || defined(HAVE_PKCS7) defined(OPENSSL_EXTRA) || defined(HAVE_PKCS7)