From ba20f54b5b36fdc7247f23b5feaf33ecdffa8fce Mon Sep 17 00:00:00 2001 From: Jacob Barthelmeh Date: Thu, 9 Jun 2022 21:32:55 -0600 Subject: [PATCH] add UPN other name parsing and updating skip --- certs/fpki-cert.der | Bin 1327 -> 1363 bytes certs/renewcerts/wolfssl.cnf | 3 +- wolfcrypt/src/asn.c | 170 ++++++++++++++++++++++++----------- wolfssl/wolfcrypt/asn.h | 3 +- 4 files changed, 124 insertions(+), 52 deletions(-) diff --git a/certs/fpki-cert.der b/certs/fpki-cert.der index 9d35ad9d5132816e2d173fa025bfae698476ff4c..2b88caf247f8583bf37266876ff46bb8a3898074 100644 GIT binary patch delta 365 zcmV-z0h0c&3eyS*FoFe7FoFa(kqEUIHZVCcGBYMKCLwr1KxP@XmrdN?|I)3GNe464s)GDYbEzBFy_vBV1{Wd-MKeq%O8ZAYb}If3@Uo0ipk9Ggopxa;a64 zN~c+=cQK^DvZg5?PIF{;a1KtE&?6OM1aGxP9P?3;q7qp?j#l4mUiwg0{BZ+KLMCTu L)9lt1kpjV;6ak=9 delta 329 zcmV-P0k;0r3a<(XFoFduFoFaVkqEUIH8L|XH8e6bH(D1BGBq$VF*Y$ZG%_?dvDLZ( z1&c6(0f&>60+tG41_MN=Sd&--`+r)Yds8)V5Tej$F9Q_VGBG!eJ38JXscZ>k zJ_a5XQ<8ZbTl`k@*9Vvz!L34L#O#V+m(%D;{N(sFxCbO0UJx(WT0|@y4SRC@o%mwp zJK{27P2Mt`A4&!l?Kpch#H$$eFApNH_j#sB`z?8TS6sIHA+ZP$ct=EAnc b71Of--bHQ)?lUsn%4iqpsdOq*sRAoidSum = FASCN_OID; - AddDNSEntryToList(&cert->altNames, entry); + switch (oid) { + case FASCN_OID: + bufLen = dataASN[OTHERNAMEASN_IDX_FASCN].data.ref.length; + buf = (const char*)dataASN[OTHERNAMEASN_IDX_FASCN].data.ref.data; + break; + case UPN_OID: + bufLen = dataASN[OTHERNAMEASN_IDX_UPN].data.ref.length; + buf = (const char*)dataASN[OTHERNAMEASN_IDX_UPN].data.ref.data; + break; } + ret = SetDNSEntry(cert, buf, bufLen, ASN_OTHER_TYPE, &entry); + if (ret == 0) { + entry->oidSum = oid; + AddDNSEntryToList(&cert->altNames, entry); + } return ret; } #endif /* WOLFSSL_FPKI */ @@ -14718,7 +14727,9 @@ static int DecodeOtherName(DecodedCert* cert, const byte* input, #endif /* WOLFSSL_SEP */ #ifdef WOLFSSL_FPKI case FASCN_OID: - ret = DecodeFASCN(dataASN, cert); + case UPN_OID: + ret = DecodeOtherHelper(dataASN, cert, + dataASN[OTHERNAMEASN_IDX_TYPEID].data.oid.sum); break; #endif /* WOLFSSL_FPKI */ default: @@ -14962,54 +14973,101 @@ static int DecodeSepHwAltName(DecodedCert* cert, const byte* input, } #endif /* WOLFSSL_SEP */ -#if defined(WOLFSSL_FPKI) && !defined(WOLFSSL_ASN_TEMPLATE) +#if !defined(WOLFSSL_ASN_TEMPLATE) /* return 0 on success */ -static int DecodeFascNAltName(DecodedCert* cert, const byte* input, word32* idx, - int sz) +static int DecodeConstructedOtherName(DecodedCert* cert, const byte* input, + word32* idx, int sz, int oid) { - int ret; + int ret = 0; int strLen; - DNS_entry* dnsEntry; byte tag; + DNS_entry* dnsEntry = NULL; if (GetASNTag(input, idx, &tag, sz) < 0) { - return ASN_PARSE_E; + ret = ASN_PARSE_E; } - if (tag != (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED)) { - return ASN_PARSE_E; + if (ret == 0 && (tag != (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED))) { + ret = ASN_PARSE_E; } - if (GetLength(input, idx, &strLen, sz) < 0) - return ASN_PARSE_E; - - ret = GetOctetString(input, idx, &strLen, sz); - if (ret < 0) - return ret; - - dnsEntry = AltNameNew(cert->heap); - if (dnsEntry == NULL) { - WOLFSSL_MSG("\tOut of Memory"); - return MEMORY_E; + if (ret == 0 && (GetLength(input, idx, &strLen, sz) < 0)) { + ret = ASN_PARSE_E; } - dnsEntry->type = ASN_OTHER_TYPE; - dnsEntry->name = (char*)XMALLOC(strLen + 1, cert->heap, - DYNAMIC_TYPE_ALTNAME); - if (dnsEntry->name == NULL) { - WOLFSSL_MSG("\tOut of Memory"); + if (ret == 0) { + dnsEntry = AltNameNew(cert->heap); + if (dnsEntry == NULL) { + WOLFSSL_MSG("\tOut of Memory"); + return MEMORY_E; + } + } + + if (ret == 0) { + switch (oid) { + #ifdef WOLFSSL_FPKI + case FASCN_OID: + ret = GetOctetString(input, idx, &strLen, sz); + if (ret > 0) { + ret = 0; + } + break; + #endif /* WOLFSSL_FPKI */ + case UPN_OID: + if (GetASNTag(input, idx, &tag, sz) < 0) { + ret = ASN_PARSE_E; + } + + if (ret == 0 && + tag != ASN_PRINTABLE_STRING && tag != ASN_UTF8STRING && + tag != ASN_IA5_STRING) { + WOLFSSL_MSG("Was expecting a string for UPN"); + ret = ASN_PARSE_E; + } + + if (ret == 0 && (GetLength(input, idx, &strLen, sz) < 0)) { + WOLFSSL_MSG("Was expecting a string for UPN"); + ret = ASN_PARSE_E; + } + break; + + default: + WOLFSSL_MSG("Unknown constructed other name, skipping"); + *idx += strLen; + XFREE(dnsEntry, cert->heap, DYNAMIC_TYPE_ALTNAME); + dnsEntry = NULL; + } + } + + if (ret == 0 && dnsEntry != NULL) { + dnsEntry->type = ASN_OTHER_TYPE; + dnsEntry->len = strLen; + dnsEntry->name = (char*)XMALLOC(strLen + 1, cert->heap, + DYNAMIC_TYPE_ALTNAME); + #ifdef WOLFSSL_FPKI + dnsEntry->oidSum = oid; + #endif /* WOLFSSL_FPKI */ + if (dnsEntry->name == NULL) { + WOLFSSL_MSG("\tOut of Memory"); + ret = MEMORY_E; + } + else { + XMEMCPY(dnsEntry->name, &input[*idx], strLen); + dnsEntry->name[strLen] = '\0'; + AddAltName(cert, dnsEntry); + } + } + + if (ret == 0) { + *idx += strLen; + } + else { XFREE(dnsEntry, cert->heap, DYNAMIC_TYPE_ALTNAME); - return MEMORY_E; } - dnsEntry->len = strLen; - XMEMCPY(dnsEntry->name, &input[*idx], strLen); - dnsEntry->name[strLen] = '\0'; - dnsEntry->oidSum = FASCN_OID; - AddAltName(cert, dnsEntry); - *idx += strLen; - return 0; + + return ret; } -#endif /* WOLFSSL_FPKI */ +#endif /* Decode subject alternative names extension. * @@ -15316,7 +15374,9 @@ static int DecodeAltNames(const byte* input, int sz, DecodedCert* cert) #endif /* WOLFSSL_SEP */ #ifdef WOLFSSL_FPKI case FASCN_OID: - ret = DecodeFascNAltName(cert, input, &idx, sz); + case UPN_OID: + ret = DecodeConstructedOtherName(cert, input, &idx, sz, + oid); if (ret != 0) return ret; break; @@ -15325,11 +15385,21 @@ static int DecodeAltNames(const byte* input, int sz, DecodedCert* cert) default: WOLFSSL_MSG("\tUnsupported other name type, skipping"); if (GetLength(input, &idx, &strLen, sz) < 0) { - WOLFSSL_MSG("\tfail: unsupported other name length"); - return ASN_PARSE_E; + /* check to skip constructed other names too */ + if (DecodeConstructedOtherName(cert, input, &idx, sz, + oid) != 0) { + WOLFSSL_MSG("\tfail: unsupported other name length"); + return ASN_PARSE_E; + } + else { + /* idx will have been advanced to end of alt name */ + length -= (idx - lenStartIdx); + } + } + else { + length -= (strLen + idx - lenStartIdx); + idx += strLen; } - length -= (strLen + idx - lenStartIdx); - idx += strLen; } (void)ret; } diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h index 6c053e8fc..3995f3b19 100644 --- a/wolfssl/wolfcrypt/asn.h +++ b/wolfssl/wolfcrypt/asn.h @@ -1145,7 +1145,8 @@ enum Extensions_Sum { AKEY_PACKAGE_OID = 1048, /* 2.16.840.1.101.2.1.2.78.5 RFC 5958 - Asymmetric Key Packages */ - FASCN_OID = 419 /* 2.16.840.1.101.3.6.6 Federal PKI Policy FASC-N */ + FASCN_OID = 419, /* 2.16.840.1.101.3.6.6 Federal PKI Policy FASC-N */ + UPN_OID = 265 /* 1.3.6.1.4.1.311.20.2.3 UPN */ }; enum CertificatePolicy_Sum {