wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Introduce WOLFSSL_ASN_ALLOW_0_SERIAL

Browse Source
This commit is contained in:
gojimmypi
2024-08-22 12:30:15 -07:00
parent e99bbf9429
commit 8baf39310f
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
wolfcrypt/src/asn.c
View File

@ -56,6 +56,8 @@ ASN Options:
* WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName. * WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName.
* WOLFSSL_NO_ASN_STRICT: Disable strict RFC compliance checks to * WOLFSSL_NO_ASN_STRICT: Disable strict RFC compliance checks to
restore 3.13.0 behavior. restore 3.13.0 behavior.
* WOLFSSL_ASN_ALLOW_0_SERIAL: Even if WOLFSSL_NO_ASN_STRICT is not defined,
allow a length=1, but zero value serial numnber.
* WOLFSSL_NO_OCSP_OPTIONAL_CERTS: Skip optional OCSP certs (responder issuer * WOLFSSL_NO_OCSP_OPTIONAL_CERTS: Skip optional OCSP certs (responder issuer
must still be trusted) must still be trusted)
* WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for situation where entire cert * WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for situation where entire cert
@ -13987,7 +13989,7 @@ static int GetCertName(DecodedCert* cert, char* full, byte* hash, int nameType,
} }
#ifndef WOLFSSL_NO_ASN_STRICT #ifndef WOLFSSL_NO_ASN_STRICT
/* RFC 5280 section 4.1.2.4 lists a DirecotryString as being /* RFC 5280 section 4.1.2.4 lists a DirectoryString as being
* 1..MAX in length */ * 1..MAX in length */
if (strLen < 1) { if (strLen < 1) {
WOLFSSL_MSG("Non conforming DirectoryString of length 0 was" WOLFSSL_MSG("Non conforming DirectoryString of length 0 was"
@ -14629,7 +14631,7 @@ static int GetCertName(DecodedCert* cert, char* full, byte* hash, int nameType,
GetASN_GetRef(&dataASN[RDNASN_IDX_ATTR_VAL], &str, &strLen); GetASN_GetRef(&dataASN[RDNASN_IDX_ATTR_VAL], &str, &strLen);
#ifndef WOLFSSL_NO_ASN_STRICT #ifndef WOLFSSL_NO_ASN_STRICT
/* RFC 5280 section 4.1.2.4 lists a DirecotryString as being /* RFC 5280 section 4.1.2.4 lists a DirectoryString as being
* 1..MAX in length */ * 1..MAX in length */
if (ret == 0 && strLen < 1) { if (ret == 0 && strLen < 1) {
WOLFSSL_MSG("Non conforming DirectoryString of length 0 was" WOLFSSL_MSG("Non conforming DirectoryString of length 0 was"
@ -21895,8 +21897,8 @@ static int CheckDate(ASNGetData *dataASN, int dateType)
* @param [in] verify Whether to verify dates before and after now. * @param [in] verify Whether to verify dates before and after now.
* @param [out] criticalExt Critical extension return code. * @param [out] criticalExt Critical extension return code.
* @param [out] badDateRet Bad date return code. * @param [out] badDateRet Bad date return code.
* @param [in] stopAtPubKey Stop parsing before subkectPublicKeyInfo. * @param [in] stopAtPubKey Stop parsing before subjectPublicKeyInfo.
* @param [in] stopAfterPubKey Stop parsing after subkectPublicKeyInfo. * @param [in] stopAfterPubKey Stop parsing after subjectPublicKeyInfo.
* @return 0 on success. * @return 0 on success.
* @return ASN_CRIT_EXT_E when a critical extension was not recognized. * @return ASN_CRIT_EXT_E when a critical extension was not recognized.
* @return ASN_TIME_E when date BER tag is nor UTC or GENERALIZED time. * @return ASN_TIME_E when date BER tag is nor UTC or GENERALIZED time.
@ -22005,7 +22007,8 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt,
cert->version = version; cert->version = version;
cert->serialSz = (int)serialSz; cert->serialSz = (int)serialSz;
#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(WOLFSSL_PYTHON) #if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(WOLFSSL_PYTHON) && \
!defined(WOLFSSL_ASN_ALLOW_0_SERIAL)
/* RFC 5280 section 4.1.2.2 states that non-conforming CAs may issue /* RFC 5280 section 4.1.2.2 states that non-conforming CAs may issue
* a negative or zero serial number and should be handled gracefully. * a negative or zero serial number and should be handled gracefully.
* Since it is a non-conforming CA that issues a serial of 0 then we * Since it is a non-conforming CA that issues a serial of 0 then we
@ -22016,6 +22019,11 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt,
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
} }
#endif #endif
if (cert->serialSz == 0) {
WOLFSSL_MSG("Error serial size is zero. Should be at least one "
"even with no serial number.");
ret = ASN_PARSE_E;
}
cert->signatureOID = dataASN[X509CERTASN_IDX_TBS_ALGOID_OID].data.oid.sum; cert->signatureOID = dataASN[X509CERTASN_IDX_TBS_ALGOID_OID].data.oid.sum;
cert->keyOID = dataASN[X509CERTASN_IDX_TBS_SPUBKEYINFO_ALGO_OID].data.oid.sum; cert->keyOID = dataASN[X509CERTASN_IDX_TBS_SPUBKEYINFO_ALGO_OID].data.oid.sum;