wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-02-01 06:59:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

Parsing of custom extensions in X.509 certificates.

Browse Source
This commit is contained in:
Anthony Hu
2022-02-18 16:55:11 -05:00
parent c22282a8aa
commit cb95aed41b
2 changed files with 59 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
wolfcrypt/src/asn.c
View File

@@ -16565,11 +16565,14 @@ exit:
* @return Other -ve value on error.
*/
static int DecodeExtensionType(const byte* input, int length, word32 oid,
byte critical, DecodedCert* cert)
byte critical, DecodedCert* cert, int *unknown)
{
int ret = 0;
word32 idx = 0;
if (unknown != NULL)
*unknown = 0;
switch (oid) {
/* Basic Constraints. */
case BASIC_CA_OID:
@@ -16753,6 +16756,8 @@ static int DecodeExtensionType(const byte* input, int length, word32 oid,
return ASN_PARSE_E;
break;
default:
if (unknown != NULL)
*unknown = 1;
#ifndef WOLFSSL_NO_ASN_STRICT
/* While it is a failure to not support critical extensions,
* still parse the certificate ignoring the unsupported
@@ -16806,6 +16811,16 @@ enum {
#define certExtASN_Length (sizeof(certExtASN) / sizeof(ASNItem))
#endif
#if defined(WOLFSSL_CUSTOM_OID) && defined(WOLFSSL_ASN_TEMPLATE) \
&& defined(HAVE_OID_DECODING)
WOLFSSL_ASN_API void SetUnknownExtCallback(DecodedCert* cert,
wc_UnknownExtCallback cb) {
if (cert != NULL) {
cert->unknownExtCallback = cb;
}
}
#endif
/*
* Processing the Certificate Extensions. This does not modify the current
* index. It is works starting with the recorded extensions pointer.
@@ -16893,7 +16908,8 @@ static int DecodeCertExtensions(DecodedCert* cert)
return ret;
}
ret = DecodeExtensionType(input + idx, length, oid, critical, cert);
ret = DecodeExtensionType(input + idx, length, oid, critical, cert,
NULL);
if (ret == ASN_CRIT_EXT_E) {
ret = 0;
criticalFail = 1;
@@ -16938,6 +16954,7 @@ end:
/* Parse each extension. */
while ((ret == 0) && (idx < (word32)sz)) {
byte critical = 0;
int unknown = 0;
/* Clear dynamic data. */
XMEMSET(dataASN, 0, sizeof(*dataASN) * certExtASN_Length);
@@ -16953,7 +16970,30 @@ end:
int length = dataASN[CERTEXTASN_IDX_VAL].length;
/* Decode the extension by type. */
ret = DecodeExtensionType(input + idx, length, oid, critical, cert);
ret = DecodeExtensionType(input + idx, length, oid, critical, cert,
&unknown);
#if defined(WOLFSSL_CUSTOM_OID) && defined(WOLFSSL_ASN_TEMPLATE) \
&& defined(HAVE_OID_DECODING)
if (unknown && (cert->unknownExtCallback != NULL)) {
word16 decOid[16];
word32 decOidSz = sizeof(decOid);
ret = DecodeObjectId(
dataASN[CERTEXTASN_IDX_OID].data.oid.data,
dataASN[CERTEXTASN_IDX_OID].data.oid.length,
decOid, &decOidSz);
if (ret != 0) {
/* Should never get here as the extension was successfully
* decoded earlier. */
printf("DecodeObjectId failed: %d\n", ret);
}
ret = cert->unknownExtCallback(decOid, decOidSz, critical,
dataASN[CERTEXTASN_IDX_VAL].data.buffer.data,
dataASN[CERTEXTASN_IDX_VAL].length);
}
#endif
(void)unknown;
/* Move index on to next extension. */
idx += length;
}