denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed certificate verification bug!

Browse Source
This commit is contained in:
Martin Willi
2006-09-14 12:22:08 +00:00
parent 567e2a7822
commit 8a95c322c5
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/rsa/rsa_public_key.c
+17 -4
View File
@@ -93,6 +93,8 @@ const u_int8_t sha512_oid[] = {
0x04,0x40
};
#define LARGEST_HASH_OID_SIZE sizeof(sha512_oid)
/* ASN.1 definition public key */
static const asn1Object_t pubkey_objects[] = {
{ 0, "RSAPublicKey", ASN1_SEQUENCE, ASN1_OBJ }, /* 0 */
@@ -192,8 +194,17 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
u_int8_t *pos;
status_t res = FAILED;
/* remove any preceding 0-bytes from signature */
while (signature.len && *(signature.ptr) == 0x00)
{
signature.len -= 1;
signature.ptr++;
}
if (signature.len > this->k)
return INVALID_ARG;
{
return INVALID_ARG;
}
/* unpack signature */
em = this->rsavp1(this, signature);
@@ -202,11 +213,13 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
* EM = 0x00 || 0x01 || PS || 0x00 || T.
* PS = 0xFF padding, with length to fill em
* T = oid || hash
*/
*/
/* check magic bytes */
if ((*(em.ptr) != 0x00) || (*(em.ptr+1) != 0x01))
{
goto end;
}
/* find magic 0x00 */
pos = em.ptr + 2;
@@ -226,7 +239,7 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
pos++;
}
if (pos + 20 > em.ptr + em.len)
if (pos + LARGEST_HASH_OID_SIZE > em.ptr + em.len)
{
/* not enought room for oid compare */
goto end;
@@ -282,7 +295,7 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
hasher->destroy(hasher);
/* compare the hashes */
res = memeq(hash.ptr, pos, hash.len)? SUCCESS : FAILED;
res = memeq(hash.ptr, pos, hash.len) ? SUCCESS : FAILED;
free(hash.ptr);
end:
src/libstrongswan/crypto/x509.c
+2 -1
View File
@@ -1045,7 +1045,8 @@ static cert_status_t get_status(const private_x509_t *this)
*/
static bool verify(const private_x509_t *this, const rsa_public_key_t *signer)
{
return signer->verify_emsa_pkcs1_signature(signer, this->tbsCertificate, this->signature);
return (signer->verify_emsa_pkcs1_signature(signer, this->tbsCertificate,
this->signature) == SUCCESS);
}
/**