6822 - Reject duplicate cert extensions under WOLFSSL_NO_ASN_STRICT

2026-08-10 11:01:24 +02:00 · 2026-07-15 16:33:55 -07:00
parent 8e9af5c4b8
commit 92d5375e77
3 changed files with 76 additions and 19 deletions
@@ -1540,16 +1540,15 @@ int test_DecodeAltNames_length_underflow(void)

 /* A certificate must not carry two certificatePolicies extensions
 * (non-repeatable per RFC 5280 4.2). DecodeCertExtensions calls
- * DecodeExtensionType once per extension; with strict ASN.1 (the default) a
- * second certificatePolicies extension must be rejected (ASN_OBJECT_ID_E)
- * rather than silently overwriting the first - which happened in
- * WOLFSSL_CERT_EXT builds without WOLFSSL_SEP before the duplicate guard was
- * extended to cover them. */
+ * DecodeExtensionType once per extension; a second certificatePolicies
+ * extension must be rejected (ASN_OBJECT_ID_E) rather than silently
+ * overwriting the first - which happened in WOLFSSL_CERT_EXT builds without
+ * WOLFSSL_SEP before the duplicate guard was extended to cover them. */
 int test_DecodeCertExtensions_dup_certpol(void)
 {
    EXPECT_DECLS;
 #if (defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)) && \
-    !defined(WOLFSSL_NO_ASN_STRICT) && !defined(NO_CERTS) && !defined(NO_ASN)
+    !defined(NO_CERTS) && !defined(NO_ASN)
    /* Minimal certificatePolicies extnValue: SEQUENCE OF PolicyInformation
     * with one policyIdentifier OID 1.2.3.4 (encoded 2A 03 04). */
    static const byte policy[] = {
@@ -21465,16 +21465,13 @@ static int DecodeAltSigVal(const byte* input, int sz, DecodedCert* cert)
 /* Macro to check if bit is set, if not sets and return success.
    Otherwise returns failure */
 /* Macro required here because bit-field operation */
-#ifndef WOLFSSL_NO_ASN_STRICT
-    #define VERIFY_AND_SET_OID(bit) \
-        if ((bit) == 0) \
-            (bit) = 1; \
-        else \
-            return ASN_OBJECT_ID_E;
-#else
-    /* With no strict defined, the verify is skipped */
-#define VERIFY_AND_SET_OID(bit) bit = 1;
-#endif
+/* RFC 5280 4.2 forbids a repeated extension, so a duplicate is rejected even
+ * under WOLFSSL_NO_ASN_STRICT. */
+#define VERIFY_AND_SET_OID(bit) \
+    if ((bit) == 0) \
+        (bit) = 1; \
+    else \
+        return ASN_OBJECT_ID_E;

 /* Parse extension type specific data based on OID sum.
 *
@@ -21647,9 +21644,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length,
        /* Certificate policies. */
        case CERT_POLICY_OID:
        #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT)
-            /* certificatePolicies is non-repeatable (RFC 5280 4.2). In strict
-             * mode (the default; VERIFY_AND_SET_OID is a no-op under
-             * WOLFSSL_NO_ASN_STRICT, like every other extension) reject a
+            /* certificatePolicies is non-repeatable (RFC 5280 4.2). Reject a
             * duplicate regardless of WOLFSSL_SEP - otherwise the second one
             * silently overwrites the first (DecodeCertPolicy resets
             * extCertPoliciesNb), a policy-authorization confusion. */
@@ -1042,6 +1042,7 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_x509_tiny_test(void);
 #if defined(WOLFSSL_TEST_CERT) && defined(HAVE_ECC) && \
    !defined(NO_ECC256) && !defined(NO_ECC_SECP)
 WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_crit_unknown_ext_test(void);
+WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_dup_ext_test(void);
 #endif
 #if !defined(NO_ASN_TIME) && !defined(NO_RSA) && defined(WOLFSSL_TEST_CERT) && \
    !defined(NO_FILESYSTEM)
@@ -3124,6 +3125,11 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
        TEST_FAIL("CERT CRIT EXT test failed!\n", ret);
    else
        TEST_PASS("CERT CRIT EXT test passed!\n");
+
+    if ( (ret = cert_dup_ext_test()) != 0)
+        TEST_FAIL("CERT DUP EXT test failed!\n", ret);
+    else
+        TEST_PASS("CERT DUP EXT test passed!\n");
 #endif

 #if defined(WOLFSSL_TEST_CERT) && defined(USE_CERT_BUFFERS_2048) && \
@@ -30516,6 +30522,63 @@ static const byte critUnknownExtCert[] = {
    0x18, 0x71, 0x77, 0xF7, 0x46, 0x62, 0xD0,
 };

+/* Self-signed P-256 cert carrying keyUsage twice: digitalSignature first, then
+ * keyCertSign. A last-wins parse would hand back keyCertSign. */
+static const byte dupKeyUsageCert[] = {
+    0x30, 0x82, 0x01, 0x80, 0x30, 0x82, 0x01, 0x26, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x4D, 0x16, 0x79, 0x22, 0x7D, 0xA3, 0x8F, 0x66, 0xC2,
+    0x8B, 0x22, 0x26, 0x3E, 0x8A, 0x17, 0x98, 0x8F, 0xCE, 0xDD, 0x6D, 0x30,
+    0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x30,
+    0x16, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0B,
+    0x64, 0x75, 0x70, 0x65, 0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30,
+    0x1E, 0x17, 0x0D, 0x32, 0x36, 0x30, 0x37, 0x31, 0x35, 0x31, 0x37, 0x33,
+    0x31, 0x32, 0x36, 0x5A, 0x17, 0x0D, 0x33, 0x36, 0x30, 0x37, 0x31, 0x32,
+    0x31, 0x37, 0x33, 0x31, 0x32, 0x36, 0x5A, 0x30, 0x16, 0x31, 0x14, 0x30,
+    0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C, 0x0B, 0x64, 0x75, 0x70, 0x65,
+    0x78, 0x74, 0x2E, 0x74, 0x65, 0x73, 0x74, 0x30, 0x59, 0x30, 0x13, 0x06,
+    0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A, 0x86,
+    0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xEE, 0x55,
+    0xE4, 0x63, 0x53, 0x3F, 0x25, 0x93, 0x33, 0xA1, 0xD3, 0xD6, 0x65, 0xD7,
+    0xE4, 0x39, 0x87, 0x34, 0x3E, 0x72, 0xB5, 0xE7, 0x20, 0xA9, 0xBE, 0x39,
+    0x23, 0xE0, 0x6B, 0xD5, 0xE2, 0xEB, 0x52, 0x86, 0x2A, 0x1F, 0x54, 0x2A,
+    0x31, 0x50, 0x1A, 0xE2, 0x4B, 0xC3, 0x3E, 0x09, 0x0A, 0x65, 0x9D, 0x3B,
+    0xB2, 0xC8, 0x36, 0x56, 0x7C, 0x1A, 0x48, 0x39, 0xD3, 0xAA, 0x74, 0x65,
+    0x0F, 0xC0, 0xA3, 0x52, 0x30, 0x50, 0x30, 0x0F, 0x06, 0x03, 0x55, 0x1D,
+    0x13, 0x01, 0x01, 0xFF, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xFF, 0x30,
+    0x0E, 0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04, 0x03,
+    0x02, 0x07, 0x80, 0x30, 0x1D, 0x06, 0x03, 0x55, 0x1D, 0x0E, 0x04, 0x16,
+    0x04, 0x14, 0x27, 0xE6, 0x35, 0x0E, 0x0F, 0xE5, 0xCA, 0xC3, 0xE8, 0x79,
+    0x8C, 0x07, 0xB7, 0x2B, 0x61, 0xB4, 0x8F, 0xEC, 0x5A, 0xBB, 0x30, 0x0E,
+    0x06, 0x03, 0x55, 0x1D, 0x0F, 0x01, 0x01, 0xFF, 0x04, 0x04, 0x03, 0x02,
+    0x02, 0x04, 0x30, 0x0A, 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04,
+    0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x21, 0x00, 0xCC, 0x2F,
+    0xA2, 0x32, 0x8F, 0x36, 0x54, 0xFB, 0xEC, 0xAF, 0x68, 0x83, 0x29, 0x02,
+    0x13, 0x87, 0x13, 0x59, 0x38, 0xB0, 0xFB, 0xB4, 0x8F, 0x0F, 0xF7, 0x78,
+    0xF2, 0xD0, 0x73, 0xA6, 0x33, 0x34, 0x02, 0x20, 0x65, 0x11, 0x64, 0x82,
+    0x3F, 0x02, 0x06, 0x0B, 0x70, 0xB5, 0x6D, 0x60, 0xA0, 0xF0, 0x84, 0x0E,
+    0x27, 0x60, 0xF6, 0x88, 0xFD, 0x50, 0xC5, 0xBE, 0x78, 0x6D, 0x90, 0x1A,
+    0x14, 0x7B, 0x42, 0xE7,
+};
+
+/* RFC 5280 4.2 forbids a repeated extension, and WOLFSSL_NO_ASN_STRICT does not
+ * relax that MUST. */
+WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_dup_ext_test(void)
+{
+    wc_test_ret_t ret;
+    DecodedCert cert;
+
+    InitDecodedCert(&cert, dupKeyUsageCert, (word32)sizeof(dupKeyUsageCert),
+                    NULL);
+    ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL);
+    FreeDecodedCert(&cert);
+    if (ret == 0)                    /* expected rejection, got accept */
+        return WC_TEST_RET_ENC_NC;
+    if (ret != WC_NO_ERR_TRACE(ASN_OBJECT_ID_E))
+        return WC_TEST_RET_ENC_EC(ret);
+
+    return 0;
+}
+
 /* RFC 5280 4.2 makes rejecting an unrecognized critical extension a MUST that
 * WOLFSSL_NO_ASN_STRICT does not relax. */
 WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cert_crit_unknown_ext_test(void)