feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #938 from dgarske/fix_asn_noocspoptcert

Browse Source 
Fixes for OCSP workaround for incomplete cert chain
This commit is contained in:
toddouska
2017-05-26 17:02:31 -07:00
committed by GitHub
parent a44df73151 a0345f6ba9
commit c0408aebb4
1 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
wolfcrypt/src/asn.c
View File

@ -39,6 +39,7 @@ ASN Options:
* WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for sitatuon where entire cert * WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for sitatuon where entire cert
chain is not loaded. This only matches on subject and public key and chain is not loaded. This only matches on subject and public key and
does not perform a PKI validation, so it is not a secure solution. does not perform a PKI validation, so it is not a secure solution.
Only enabled for OCSP.
*/ */
#ifndef NO_ASN #ifndef NO_ASN
@ -4109,10 +4110,10 @@ static int GetValidity(DecodedCert* cert, int verify)
if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0) if (GetSequence(cert->source, &cert->srcIdx, &length, cert->maxIdx) < 0)
return ASN_PARSE_E; return ASN_PARSE_E;
if (GetDate(cert, BEFORE) < 0 && verify) if (GetDate(cert, BEFORE) < 0 && verify != NO_VERIFY)
badDate = ASN_BEFORE_DATE_E; /* continue parsing */ badDate = ASN_BEFORE_DATE_E; /* continue parsing */
if (GetDate(cert, AFTER) < 0 && verify) if (GetDate(cert, AFTER) < 0 && verify != NO_VERIFY)
return ASN_AFTER_DATE_E; return ASN_AFTER_DATE_E;
if (badDate != 0) if (badDate != 0)
@ -6066,7 +6067,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
/* alternate lookup method using subject and match on public key */ /* alternate lookup method using subject and match on public key */
#ifdef WOLFSSL_NO_TRUSTED_CERTS_VERIFY #ifdef WOLFSSL_NO_TRUSTED_CERTS_VERIFY
if (cert->ca == NULL) { if (cert->ca == NULL && verify == VERIFY_OCSP) {
if (cert->extSubjKeyIdSet) { if (cert->extSubjKeyIdSet) {
cert->ca = GetCA(cm, cert->extSubjKeyId); cert->ca = GetCA(cm, cert->extSubjKeyId);
} }
@ -6077,7 +6078,8 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
if ((cert->ca->pubKeySize == cert->pubKeySize) && if ((cert->ca->pubKeySize == cert->pubKeySize) &&
(XMEMCMP(cert->ca->publicKey, cert->publicKey, (XMEMCMP(cert->ca->publicKey, cert->publicKey,
cert->ca->pubKeySize) == 0)) { cert->ca->pubKeySize) == 0)) {
return 0; ret = 0; /* success */
goto exit_pcr;
} }
} }
} }
@ -6121,7 +6123,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
if (verify != NO_VERIFY && type != CA_TYPE && type != TRUSTED_PEER_TYPE) { if (verify != NO_VERIFY && type != CA_TYPE && type != TRUSTED_PEER_TYPE) {
if (cert->ca) { if (cert->ca) {
if (verify == VERIFY) { if (verify == VERIFY || verify == VERIFY_OCSP) {
/* try to confirm/verify signature */ /* try to confirm/verify signature */
if ((ret = ConfirmSignature(&cert->sigCtx, if ((ret = ConfirmSignature(&cert->sigCtx,
cert->source + cert->certBegin, cert->source + cert->certBegin,
@ -6151,6 +6153,10 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
} }
} }
#ifdef WOLFSSL_NO_TRUSTED_CERTS_VERIFY
exit_pcr:
#endif
if (badDate != 0) if (badDate != 0)
return badDate; return badDate;
@ -10219,8 +10225,8 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
InitDecodedCert(&cert, resp->cert, resp->certSz, heap); InitDecodedCert(&cert, resp->cert, resp->certSz, heap);
/* Don't verify if we don't have access to Cert Manager. */ /* Don't verify if we don't have access to Cert Manager. */
ret = ParseCertRelative(&cert, CERT_TYPE, noVerify ? NO_VERIFY : VERIFY, ret = ParseCertRelative(&cert, CERT_TYPE,
cm); noVerify ? NO_VERIFY : VERIFY_OCSP, cm);
if (ret < 0) { if (ret < 0) {
WOLFSSL_MSG("\tOCSP Responder certificate parsing failed"); WOLFSSL_MSG("\tOCSP Responder certificate parsing failed");
FreeDecodedCert(&cert); FreeDecodedCert(&cert);
@ -10264,6 +10270,8 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
WOLFSSL_MSG("\tOCSP Confirm signature failed"); WOLFSSL_MSG("\tOCSP Confirm signature failed");
return ASN_OCSP_CONFIRM_E; return ASN_OCSP_CONFIRM_E;
} }
(void)noVerify;
} }
*ioIndex = idx; *ioIndex = idx;