denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check rng return value when generating SCEP sender nonce

Browse Source
This commit is contained in:
Tobias Brunner
2012-07-16 14:53:35 +02:00
committed by Martin Willi
parent ae56e1eb97
commit 392a9b1109
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scepclient/scep.c
+13 -3
View File
@@ -183,7 +183,7 @@ void scep_generate_transaction_id(public_key_t *key, chunk_t *transID,
/** /**
* Adds a senderNonce attribute to the given pkcs9 attribute list * Adds a senderNonce attribute to the given pkcs9 attribute list
*/ */
static void add_senderNonce_attribute(pkcs9_t *pkcs9) static bool add_senderNonce_attribute(pkcs9_t *pkcs9)
{ {
const size_t nonce_len = 16; const size_t nonce_len = 16;
u_char nonce_buf[nonce_len]; u_char nonce_buf[nonce_len];
@@ -191,10 +191,15 @@ static void add_senderNonce_attribute(pkcs9_t *pkcs9)
rng_t *rng; rng_t *rng;
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
rng->get_bytes(rng, nonce_len, nonce_buf); if (!rng || !rng->get_bytes(rng, nonce_len, nonce_buf))
{
DESTROY_IF(rng);
return FALSE;
}
rng->destroy(rng); rng->destroy(rng);
pkcs9->set_attribute(pkcs9, OID_PKI_SENDER_NONCE, senderNonce); pkcs9->set_attribute(pkcs9, OID_PKI_SENDER_NONCE, senderNonce);
return TRUE;
} }
/** /**
@@ -222,7 +227,12 @@ chunk_t scep_build_request(chunk_t data, chunk_t transID, scep_msg_t msg,
pkcs9 = pkcs9_create(); pkcs9 = pkcs9_create();
pkcs9->set_attribute(pkcs9, OID_PKI_TRANS_ID, transID); pkcs9->set_attribute(pkcs9, OID_PKI_TRANS_ID, transID);
pkcs9->set_attribute(pkcs9, OID_PKI_MESSAGE_TYPE, msgType); pkcs9->set_attribute(pkcs9, OID_PKI_MESSAGE_TYPE, msgType);
add_senderNonce_attribute(pkcs9); if (!add_senderNonce_attribute(pkcs9))
{
pkcs9->destroy(pkcs9);
pkcs7->destroy(pkcs7);
return chunk_empty;
}
pkcs7->set_attributes(pkcs7, pkcs9); pkcs7->set_attributes(pkcs7, pkcs9);
pkcs7->set_certificate(pkcs7, signer_cert->get_ref(signer_cert)); pkcs7->set_certificate(pkcs7, signer_cert->get_ref(signer_cert));