wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-03 20:54:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8890 from kareem-wolfssl/zd20022

Browse Source 
Allow larger pathLen values in Basic Constraints.
This commit is contained in:
Sean Parkinson
2025-07-22 17:16:27 +10:00
committed by GitHub
parent cd7256ae63 9fa1d2e75f
commit 8f00fc2594
2 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
wolfcrypt/src/asn.c
View File

@@ -2768,7 +2768,7 @@ int GetASNInt(const byte* input, word32* inOutIdx, int* len,
} }
#ifndef WOLFSSL_ASN_TEMPLATE #ifndef WOLFSSL_ASN_TEMPLATE
#ifndef NO_CERTS #if !defined(NO_CERTS) && defined(WOLFSSL_CUSTOM_CURVES)
/* Get the DER/BER encoding of an ASN.1 INTEGER that has a value of no more than /* Get the DER/BER encoding of an ASN.1 INTEGER that has a value of no more than
* 7 bits. * 7 bits.
* *
@@ -2800,7 +2800,7 @@ static int GetInteger7Bit(const byte* input, word32* inOutIdx, word32 maxIdx)
} }
#endif /* !NO_CERTS */ #endif /* !NO_CERTS */
#if defined(WC_RSA_PSS) && !defined(NO_RSA) #if ((defined(WC_RSA_PSS) && !defined(NO_RSA)) || !defined(NO_CERTS))
/* Get the DER/BER encoding of an ASN.1 INTEGER that has a value of no more than /* Get the DER/BER encoding of an ASN.1 INTEGER that has a value of no more than
* 16 bits. * 16 bits.
* *
@@ -20640,10 +20640,15 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
return 0; return 0;
} }
ret = GetInteger7Bit(input, &idx, (word32)sz); ret = GetInteger16Bit(input, &idx, (word32)sz);
if (ret < 0) if (ret < 0)
return ret; return ret;
cert->pathLength = (byte)ret; else if (ret > WOLFSSL_MAX_PATH_LEN) {
WOLFSSL_ERROR_VERBOSE(ASN_PATHLEN_SIZE_E);
return ASN_PATHLEN_SIZE_E;
}
cert->pathLength = (word16)ret;
cert->pathLengthSet = 1; cert->pathLengthSet = 1;
return 0; return 0;
@@ -20660,7 +20665,7 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
if (ret == 0) { if (ret == 0) {
/* Get the CA boolean and path length when present. */ /* Get the CA boolean and path length when present. */
GetASN_Boolean(&dataASN[BASICCONSASN_IDX_CA], &isCA); GetASN_Boolean(&dataASN[BASICCONSASN_IDX_CA], &isCA);
GetASN_Int8Bit(&dataASN[BASICCONSASN_IDX_PLEN], &cert->pathLength); GetASN_Int16Bit(&dataASN[BASICCONSASN_IDX_PLEN], &cert->pathLength);
ret = GetASN_Items(basicConsASN, dataASN, basicConsASN_Length, 1, input, ret = GetASN_Items(basicConsASN, dataASN, basicConsASN_Length, 1, input,
&idx, (word32)sz); &idx, (word32)sz);
@@ -20677,11 +20682,6 @@ static int DecodeBasicCaConstraint(const byte* input, int sz, DecodedCert* cert)
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
} }
#endif #endif
/* Path length must be a 7-bit value. */
if ((ret == 0) && (cert->pathLength >= (1 << 7))) {
WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
ret = ASN_PARSE_E;
}
if ((ret == 0) && cert->pathLength > WOLFSSL_MAX_PATH_LEN) { if ((ret == 0) && cert->pathLength > WOLFSSL_MAX_PATH_LEN) {
WOLFSSL_ERROR_VERBOSE(ASN_PATHLEN_SIZE_E); WOLFSSL_ERROR_VERBOSE(ASN_PATHLEN_SIZE_E);
ret = ASN_PATHLEN_SIZE_E; ret = ASN_PATHLEN_SIZE_E;

6
wolfssl/wolfcrypt/asn.h
View File

@@ -1642,8 +1642,8 @@ struct DecodedCert {
const byte* extAuthKeyIdIssuerSN; /* Authority Key ID authorityCertSerialNumber */ const byte* extAuthKeyIdIssuerSN; /* Authority Key ID authorityCertSerialNumber */
word32 extAuthKeyIdIssuerSNSz; /* Authority Key ID authorityCertSerialNumber length */ word32 extAuthKeyIdIssuerSNSz; /* Authority Key ID authorityCertSerialNumber length */
#endif #endif
byte pathLength; /* CA basic constraint path length */ word16 pathLength; /* CA basic constraint path length */
byte maxPathLen; /* max_path_len see RFC 5280 section word16 maxPathLen; /* max_path_len see RFC 5280 section
* 6.1.2 "Initialization" - (k) for * 6.1.2 "Initialization" - (k) for
* description of max_path_len */ * description of max_path_len */
byte policyConstSkip; /* Policy Constraints skip certs value */ byte policyConstSkip; /* Policy Constraints skip certs value */
@@ -1943,7 +1943,7 @@ struct Signer {
word32 pubKeySize; word32 pubKeySize;
word32 keyOID; /* key type */ word32 keyOID; /* key type */
word16 keyUsage; word16 keyUsage;
byte maxPathLen; word16 maxPathLen;
WC_BITFIELD selfSigned:1; WC_BITFIELD selfSigned:1;
const byte* publicKey; const byte* publicKey;
int nameLen; int nameLen;