denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed certificate verification bug!

Browse Source
This commit is contained in:
Martin Willi
2006-09-14 12:22:08 +00:00
parent 567e2a7822
commit 8a95c322c5
2 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/rsa/rsa_public_key.c
+15 -2
View File
@@ -93,6 +93,8 @@ const u_int8_t sha512_oid[] = {
0x04,0x40 0x04,0x40
}; };
#define LARGEST_HASH_OID_SIZE sizeof(sha512_oid)
/* ASN.1 definition public key */ /* ASN.1 definition public key */
static const asn1Object_t pubkey_objects[] = { static const asn1Object_t pubkey_objects[] = {
{ 0, "RSAPublicKey", ASN1_SEQUENCE, ASN1_OBJ }, /* 0 */ { 0, "RSAPublicKey", ASN1_SEQUENCE, ASN1_OBJ }, /* 0 */
@@ -192,8 +194,17 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
u_int8_t *pos; u_int8_t *pos;
status_t res = FAILED; status_t res = FAILED;
/* remove any preceding 0-bytes from signature */
while (signature.len && *(signature.ptr) == 0x00)
{
signature.len -= 1;
signature.ptr++;
}
if (signature.len > this->k) if (signature.len > this->k)
{
return INVALID_ARG; return INVALID_ARG;
}
/* unpack signature */ /* unpack signature */
em = this->rsavp1(this, signature); em = this->rsavp1(this, signature);
@@ -206,7 +217,9 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
/* check magic bytes */ /* check magic bytes */
if ((*(em.ptr) != 0x00) || (*(em.ptr+1) != 0x01)) if ((*(em.ptr) != 0x00) || (*(em.ptr+1) != 0x01))
{
goto end; goto end;
}
/* find magic 0x00 */ /* find magic 0x00 */
pos = em.ptr + 2; pos = em.ptr + 2;
@@ -226,7 +239,7 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
pos++; pos++;
} }
if (pos + 20 > em.ptr + em.len) if (pos + LARGEST_HASH_OID_SIZE > em.ptr + em.len)
{ {
/* not enought room for oid compare */ /* not enought room for oid compare */
goto end; goto end;
@@ -282,7 +295,7 @@ static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this
hasher->destroy(hasher); hasher->destroy(hasher);
/* compare the hashes */ /* compare the hashes */
res = memeq(hash.ptr, pos, hash.len)? SUCCESS : FAILED; res = memeq(hash.ptr, pos, hash.len) ? SUCCESS : FAILED;
free(hash.ptr); free(hash.ptr);
end: end:
src/libstrongswan/crypto/x509.c
+2 -1
View File
@@ -1045,7 +1045,8 @@ static cert_status_t get_status(const private_x509_t *this)
*/ */
static bool verify(const private_x509_t *this, const rsa_public_key_t *signer) static bool verify(const private_x509_t *this, const rsa_public_key_t *signer)
{ {
return signer->verify_emsa_pkcs1_signature(signer, this->tbsCertificate, this->signature); return (signer->verify_emsa_pkcs1_signature(signer, this->tbsCertificate,
this->signature) == SUCCESS);
} }
/** /**