feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #8630 from kojiws/kojiws/more_strict_key_format_check

Browse Source 
Detect unknown key format on ProcessBufferTryDecode()
This commit is contained in:
JacobBarthelmeh
2025-04-03 10:31:16 -06:00
committed by GitHub
parent 05ac52085d 71ebad1fc7
commit 50ef56ab7a
2 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/ssl_load.c
View File

@@ -1090,6 +1090,7 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
int devId = wolfSSL_CTX_GetDevId(ctx, ssl);
byte* keyType = NULL;
int* keySz = NULL;
int matchAnyKey = 0;
(void)heap;
(void)devId;
@@ -1141,8 +1142,19 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
ret = ProcessBufferTryDecodeRsa(ctx, ssl, der, keyFormat, heap, devId,
keyType, keySz);
#endif
matchAnyKey = 1;
}
#endif
#ifdef WC_RSA_PSS
if(*keyFormat == RSAPSSk) {
/*
Require logic to verify that the der is RSAPSSk (when *keyFormat == RSAPSSK),
and to detect that the der is RSAPSSk (when *keyFormat == 0).
*/
matchAnyKey = 1;
}
#endif /* WC_RSA_PSS */
#endif /* NO_RSA */
#ifdef HAVE_ECC
/* Try ECC if key format is ECDSA or SM2, or yet unknown. */
if ((ret == 0) && ((*keyFormat == 0) || (*keyFormat == ECDSAk)
@@ -1152,6 +1164,7 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
)) {
ret = ProcessBufferTryDecodeEcc(ctx, ssl, der, keyFormat, heap, devId,
keyType, keySz);
matchAnyKey = 1;
}
#endif /* HAVE_ECC */
#if defined(HAVE_ED25519) && defined(HAVE_ED25519_KEY_IMPORT)
@@ -1159,6 +1172,7 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
if ((ret == 0) && ((*keyFormat == 0 || *keyFormat == ED25519k))) {
ret = ProcessBufferTryDecodeEd25519(ctx, ssl, der, keyFormat, heap,
devId, keyType, keySz);
matchAnyKey = 1;
}
#endif /* HAVE_ED25519 && HAVE_ED25519_KEY_IMPORT */
#if defined(HAVE_ED448) && defined(HAVE_ED448_KEY_IMPORT)
@@ -1166,6 +1180,7 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
if ((ret == 0) && ((*keyFormat == 0 || *keyFormat == ED448k))) {
ret = ProcessBufferTryDecodeEd448(ctx, ssl, der, keyFormat, heap, devId,
keyType, keySz);
matchAnyKey = 1;
}
#endif /* HAVE_ED448 && HAVE_ED448_KEY_IMPORT */
#if defined(HAVE_FALCON)
@@ -1174,6 +1189,7 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
(*keyFormat == FALCON_LEVEL5k))) {
ret = ProcessBufferTryDecodeFalcon(ctx, ssl, der, keyFormat, heap,
keyType, keySz);
matchAnyKey = 1;
}
#endif /* HAVE_FALCON */
#if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
@@ -1193,11 +1209,13 @@ static int ProcessBufferTryDecode(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
)) {
ret = ProcessBufferTryDecodeDilithium(ctx, ssl, der, keyFormat, heap,
keyType, keySz);
matchAnyKey = 1;
}
#endif /* HAVE_DILITHIUM */
/* Check we know the format. */
if ((ret == 0) && (*keyFormat == 0)) {
if ((ret == 0) &&
((*keyFormat == 0) || ((*keyFormat != 0) && (matchAnyKey == 0)))) {
WOLFSSL_MSG("Not a supported key type");
/* Not supported key format. */
ret = WOLFSSL_BAD_FILE;

4
tests/api.c
View File

@@ -2312,6 +2312,10 @@ static int test_wolfSSL_CTX_use_PrivateKey_file(void)
/* invalid key type */
ExpectFalse(wolfSSL_CTX_use_PrivateKey_file(ctx, svrKeyFile, 9999));
/* invalid key format */
ExpectFalse(wolfSSL_CTX_use_PrivateKey_file(ctx, "./certs/dh-priv-2048.pem",
WOLFSSL_FILETYPE_PEM));
/* success */
#ifdef NO_RSA
/* rsa needed */