denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Evaluate return codes of parsing functions

Browse Source
This commit is contained in:
Andreas Steffen
2017-05-08 16:44:25 +02:00
parent a4b3f1454b
commit b0dcf33f0f
4 changed files with 149 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ac.c
+7 -4
View File
@@ -1,9 +1,8 @@
/* /*
* Copyright (C) 2002 Ueli Galizzi, Ariane Seiler * Copyright (C) 2002 Ueli Galizzi, Ariane Seiler
* Copyright (C) 2003 Martin Berner, Lukas Suter * Copyright (C) 2003 Martin Berner, Lukas Suter
* Copyright (C) 2002-2014 Andreas Steffen * Copyright (C) 2002-2017 Andreas Steffen
* Copyright (C) 2009 Martin Willi * Copyright (C) 2009 Martin Willi
*
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -177,7 +176,7 @@ static chunk_t ASN1_noRevAvail_ext = chunk_from_chars(
/** /**
* declaration of function implemented in x509_cert.c * declaration of function implemented in x509_cert.c
*/ */
extern void x509_parse_generalNames(chunk_t blob, int level0, bool implicit, extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
linked_list_t *list); linked_list_t *list);
/** /**
* parses a directoryName * parses a directoryName
@@ -191,7 +190,11 @@ static bool parse_directoryName(chunk_t blob, int level, bool implicit,
linked_list_t *list; linked_list_t *list;
list = linked_list_create(); list = linked_list_create();
x509_parse_generalNames(blob, level, implicit, list); if (!x509_parse_generalNames(blob, level, implicit, list))
{
list->destroy(list);
return FALSE;
}
enumerator = list->create_enumerator(list); enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &directoryName)) while (enumerator->enumerate(enumerator, &directoryName))
src/libstrongswan/plugins/x509/x509_cert.c
+123 -39
View File
@@ -280,13 +280,14 @@ static const asn1Object_t basicConstraintsObjects[] = {
/** /**
* Extracts the basicConstraints extension * Extracts the basicConstraints extension
*/ */
static void parse_basicConstraints(chunk_t blob, int level0, static bool parse_basicConstraints(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool isCA = FALSE; bool isCA = FALSE;
bool success;
parser = asn1_parser_create(basicConstraintsObjects, blob); parser = asn1_parser_create(basicConstraintsObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -313,7 +314,10 @@ static void parse_basicConstraints(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -502,11 +506,14 @@ static const asn1Object_t generalNamesObjects[] = {
/** /**
* Extracts one or several GNs and puts them into a chained list * Extracts one or several GNs and puts them into a chained list
*/ */
void x509_parse_generalNames(chunk_t blob, int level0, bool implicit, linked_list_t *list) bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
linked_list_t *list)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
identification_t *gn;
int objectID; int objectID;
bool success = FALSE;
parser = asn1_parser_create(generalNamesObjects, blob); parser = asn1_parser_create(generalNamesObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -516,16 +523,20 @@ void x509_parse_generalNames(chunk_t blob, int level0, bool implicit, linked_lis
{ {
if (objectID == GENERAL_NAMES_GN) if (objectID == GENERAL_NAMES_GN)
{ {
identification_t *gn = parse_generalName(object, gn = parse_generalName(object, parser->get_level(parser)+1);
parser->get_level(parser)+1); if (!gn)
if (gn)
{ {
list->insert_last(list, (void *)gn); goto end;
} }
list->insert_last(list, (void *)gn);
} }
} }
success = parser->success(parser);
end:
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -579,6 +590,7 @@ chunk_t x509_parse_authorityKeyIdentifier(chunk_t blob, int level0,
} }
} }
parser->destroy(parser); parser->destroy(parser);
return authKeyIdentifier; return authKeyIdentifier;
} }
@@ -599,13 +611,14 @@ static const asn1Object_t authInfoAccessObjects[] = {
/** /**
* Extracts an authorityInfoAcess location * Extracts an authorityInfoAcess location
*/ */
static void parse_authorityInfoAccess(chunk_t blob, int level0, static bool parse_authorityInfoAccess(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
int accessMethod = OID_UNKNOWN; int accessMethod = OID_UNKNOWN;
bool success = FALSE;
parser = asn1_parser_create(authInfoAccessObjects, blob); parser = asn1_parser_create(authInfoAccessObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -653,9 +666,12 @@ static void parse_authorityInfoAccess(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
end: end:
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -726,12 +742,13 @@ static const asn1Object_t extendedKeyUsageObjects[] = {
/** /**
* Extracts extendedKeyUsage OIDs * Extracts extendedKeyUsage OIDs
*/ */
static void parse_extendedKeyUsage(chunk_t blob, int level0, static bool parse_extendedKeyUsage(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool success;
parser = asn1_parser_create(extendedKeyUsageObjects, blob); parser = asn1_parser_create(extendedKeyUsageObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -762,7 +779,10 @@ static void parse_extendedKeyUsage(chunk_t blob, int level0,
} }
} }
} }
success = parser->success(parser);
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -836,13 +856,14 @@ static void add_cdps(linked_list_t *list, linked_list_t *uris,
/** /**
* Extracts one or several crlDistributionPoints into a list * Extracts one or several crlDistributionPoints into a list
*/ */
void x509_parse_crlDistributionPoints(chunk_t blob, int level0, bool x509_parse_crlDistributionPoints(chunk_t blob, int level0,
linked_list_t *list) linked_list_t *list)
{ {
linked_list_t *uris, *issuers; linked_list_t *uris, *issuers;
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool success = FALSE;
uris = linked_list_create(); uris = linked_list_create();
issuers = linked_list_create(); issuers = linked_list_create();
@@ -857,23 +878,32 @@ void x509_parse_crlDistributionPoints(chunk_t blob, int level0,
add_cdps(list, uris, issuers); add_cdps(list, uris, issuers);
break; break;
case CRL_DIST_POINTS_FULLNAME: case CRL_DIST_POINTS_FULLNAME:
x509_parse_generalNames(object, parser->get_level(parser) + 1, if (!x509_parse_generalNames(object,
TRUE, uris); parser->get_level(parser) + 1, TRUE, uris))
{
goto end;
}
break; break;
case CRL_DIST_POINTS_ISSUER: case CRL_DIST_POINTS_ISSUER:
x509_parse_generalNames(object, parser->get_level(parser) + 1, if (!x509_parse_generalNames(object,
TRUE, issuers); parser->get_level(parser) + 1, TRUE, issuers))
{
goto end;
}
break; break;
default: default:
break; break;
} }
} }
parser->destroy(parser); success = parser->success(parser);
add_cdps(list, uris, issuers); add_cdps(list, uris, issuers);
end:
parser->destroy(parser);
uris->destroy(uris); uris->destroy(uris);
issuers->destroy(issuers); issuers->destroy(issuers);
return success;
} }
/** /**
@@ -896,13 +926,14 @@ static const asn1Object_t nameConstraintsObjects[] = {
/** /**
* Parse permitted/excluded nameConstraints * Parse permitted/excluded nameConstraints
*/ */
static void parse_nameConstraints(chunk_t blob, int level0, static bool parse_nameConstraints(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
identification_t *id; identification_t *id;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool success = FALSE;
parser = asn1_parser_create(nameConstraintsObjects, blob); parser = asn1_parser_create(nameConstraintsObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -913,23 +944,30 @@ static void parse_nameConstraints(chunk_t blob, int level0,
{ {
case NAME_CONSTRAINT_PERMITTED: case NAME_CONSTRAINT_PERMITTED:
id = parse_generalName(object, parser->get_level(parser) + 1); id = parse_generalName(object, parser->get_level(parser) + 1);
if (id) if (!id)
{ {
this->permitted_names->insert_last(this->permitted_names, id); goto end;
} }
this->permitted_names->insert_last(this->permitted_names, id);
break; break;
case NAME_CONSTRAINT_EXCLUDED: case NAME_CONSTRAINT_EXCLUDED:
id = parse_generalName(object, parser->get_level(parser) + 1); id = parse_generalName(object, parser->get_level(parser) + 1);
if (id) if (!id)
{ {
this->excluded_names->insert_last(this->excluded_names, id); goto end;
} }
this->excluded_names->insert_last(this->excluded_names, id);
break; break;
default: default:
break; break;
} }
} }
success = parser->success(parser);
end:
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -959,13 +997,14 @@ static const asn1Object_t certificatePoliciesObject[] = {
/** /**
* Parse certificatePolicies * Parse certificatePolicies
*/ */
static void parse_certificatePolicies(chunk_t blob, int level0, static bool parse_certificatePolicies(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
x509_cert_policy_t *policy = NULL; x509_cert_policy_t *policy = NULL;
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID, qualifier = OID_UNKNOWN; int objectID, qualifier = OID_UNKNOWN;
bool success;
parser = asn1_parser_create(certificatePoliciesObject, blob); parser = asn1_parser_create(certificatePoliciesObject, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -998,7 +1037,10 @@ static void parse_certificatePolicies(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -1019,13 +1061,14 @@ static const asn1Object_t policyMappingsObjects[] = {
/** /**
* Parse policyMappings * Parse policyMappings
*/ */
static void parse_policyMappings(chunk_t blob, int level0, static bool parse_policyMappings(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
x509_policy_mapping_t *map = NULL; x509_policy_mapping_t *map = NULL;
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool success;
parser = asn1_parser_create(policyMappingsObjects, blob); parser = asn1_parser_create(policyMappingsObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -1054,7 +1097,10 @@ static void parse_policyMappings(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -1076,12 +1122,13 @@ static const asn1Object_t policyConstraintsObjects[] = {
/** /**
* Parse policyConstraints * Parse policyConstraints
*/ */
static void parse_policyConstraints(chunk_t blob, int level0, static bool parse_policyConstraints(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
int objectID; int objectID;
bool success;
parser = asn1_parser_create(policyConstraintsObjects, blob); parser = asn1_parser_create(policyConstraintsObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -1100,7 +1147,10 @@ static void parse_policyConstraints(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -1171,7 +1221,7 @@ static bool check_address_object(ts_type_t ts_type, chunk_t object)
return TRUE; return TRUE;
} }
static void parse_ipAddrBlocks(chunk_t blob, int level0, static bool parse_ipAddrBlocks(chunk_t blob, int level0,
private_x509_cert_t *this) private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
@@ -1179,6 +1229,7 @@ static void parse_ipAddrBlocks(chunk_t blob, int level0,
ts_type_t ts_type = 0; ts_type_t ts_type = 0;
traffic_selector_t *ts; traffic_selector_t *ts;
int objectID; int objectID;
bool success = FALSE;
parser = asn1_parser_create(ipAddrBlocksObjects, blob); parser = asn1_parser_create(ipAddrBlocksObjects, blob);
parser->set_top_level(parser, level0); parser->set_top_level(parser, level0);
@@ -1240,10 +1291,13 @@ static void parse_ipAddrBlocks(chunk_t blob, int level0,
break; break;
} }
} }
success = parser->success(parser);
this->flags |= X509_IP_ADDR_BLOCKS; this->flags |= X509_IP_ADDR_BLOCKS;
end: end:
parser->destroy(parser); parser->destroy(parser);
return success;
} }
/** /**
@@ -1387,43 +1441,73 @@ static bool parse_certificate(private_x509_cert_t *this)
this->subjectKeyIdentifier = object; this->subjectKeyIdentifier = object;
break; break;
case OID_SUBJECT_ALT_NAME: case OID_SUBJECT_ALT_NAME:
x509_parse_generalNames(object, level, FALSE, if (!x509_parse_generalNames(object, level, FALSE,
this->subjectAltNames); this->subjectAltNames))
{
goto end;
}
break; break;
case OID_BASIC_CONSTRAINTS: case OID_BASIC_CONSTRAINTS:
parse_basicConstraints(object, level, this); if (!parse_basicConstraints(object, level, this))
{
goto end;
}
break; break;
case OID_CRL_DISTRIBUTION_POINTS: case OID_CRL_DISTRIBUTION_POINTS:
x509_parse_crlDistributionPoints(object, level, if (!x509_parse_crlDistributionPoints(object, level,
this->crl_uris); this->crl_uris))
{
goto end;
}
break; break;
case OID_AUTHORITY_KEY_ID: case OID_AUTHORITY_KEY_ID:
this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(object, this->authKeyIdentifier = x509_parse_authorityKeyIdentifier(
level, &this->authKeySerialNumber); object, level, &this->authKeySerialNumber);
break; break;
case OID_AUTHORITY_INFO_ACCESS: case OID_AUTHORITY_INFO_ACCESS:
parse_authorityInfoAccess(object, level, this); if (!parse_authorityInfoAccess(object, level, this))
{
goto end;
}
break; break;
case OID_KEY_USAGE: case OID_KEY_USAGE:
parse_keyUsage(object, this); parse_keyUsage(object, this);
break; break;
case OID_EXTENDED_KEY_USAGE: case OID_EXTENDED_KEY_USAGE:
parse_extendedKeyUsage(object, level, this); if (!parse_extendedKeyUsage(object, level, this))
{
goto end;
}
break; break;
case OID_IP_ADDR_BLOCKS: case OID_IP_ADDR_BLOCKS:
parse_ipAddrBlocks(object, level, this); if (!parse_ipAddrBlocks(object, level, this))
{
goto end;
}
break; break;
case OID_NAME_CONSTRAINTS: case OID_NAME_CONSTRAINTS:
parse_nameConstraints(object, level, this); if (!parse_nameConstraints(object, level, this))
{
goto end;
}
break; break;
case OID_CERTIFICATE_POLICIES: case OID_CERTIFICATE_POLICIES:
parse_certificatePolicies(object, level, this); if (!parse_certificatePolicies(object, level, this))
{
goto end;
}
break; break;
case OID_POLICY_MAPPINGS: case OID_POLICY_MAPPINGS:
parse_policyMappings(object, level, this); if (!parse_policyMappings(object, level, this))
{
goto end;
}
break; break;
case OID_POLICY_CONSTRAINTS: case OID_POLICY_CONSTRAINTS:
parse_policyConstraints(object, level, this); if (!parse_policyConstraints(object, level, this))
{
goto end;
}
break; break;
case OID_INHIBIT_ANY_POLICY: case OID_INHIBIT_ANY_POLICY:
if (!asn1_parse_simple_object(&object, ASN1_INTEGER, if (!asn1_parse_simple_object(&object, ASN1_INTEGER,
src/libstrongswan/plugins/x509/x509_crl.c
+8 -4
View File
@@ -1,6 +1,7 @@
/* /*
* Copyright (C) 2008-2009 Martin Willi * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil * Copyright (C) 2017 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the * under the terms of the GNU General Public License as published by the
@@ -149,7 +150,7 @@ extern chunk_t x509_parse_authorityKeyIdentifier(chunk_t blob, int level0,
/** /**
* from x509_cert * from x509_cert
*/ */
extern void x509_parse_crlDistributionPoints(chunk_t blob, int level0, extern bool x509_parse_crlDistributionPoints(chunk_t blob, int level0,
linked_list_t *list); linked_list_t *list);
/** /**
@@ -309,8 +310,11 @@ static bool parse(private_x509_crl_t *this)
this->crlNumber = object; this->crlNumber = object;
break; break;
case OID_FRESHEST_CRL: case OID_FRESHEST_CRL:
x509_parse_crlDistributionPoints(object, level, if (!x509_parse_crlDistributionPoints(object, level,
this->crl_uris); this->crl_uris))
{
goto end;
}
break; break;
case OID_DELTA_CRL_INDICATOR: case OID_DELTA_CRL_INDICATOR:
if (!asn1_parse_simple_object(&object, ASN1_INTEGER, if (!asn1_parse_simple_object(&object, ASN1_INTEGER,
src/libstrongswan/plugins/x509/x509_pkcs10.c
+11 -5
View File
@@ -1,7 +1,6 @@
/* /*
* Copyright (C) 2005 Jan Hutter, Martin Willi * Copyright (C) 2005 Jan Hutter, Martin Willi
* Copyright (C) 2009 Andreas Steffen * Copyright (C) 2009-2017 Andreas Steffen
*
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -101,7 +100,8 @@ struct private_x509_pkcs10_t {
/** /**
* Imported from x509_cert.c * Imported from x509_cert.c
*/ */
extern void x509_parse_generalNames(chunk_t blob, int level0, bool implicit, linked_list_t *list); extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
linked_list_t *list);
extern chunk_t x509_build_subjectAltNames(linked_list_t *list); extern chunk_t x509_build_subjectAltNames(linked_list_t *list);
METHOD(certificate_t, get_type, certificate_type_t, METHOD(certificate_t, get_type, certificate_type_t,
@@ -290,8 +290,11 @@ static bool parse_extension_request(private_x509_pkcs10_t *this, chunk_t blob, i
switch (extn_oid) switch (extn_oid)
{ {
case OID_SUBJECT_ALT_NAME: case OID_SUBJECT_ALT_NAME:
x509_parse_generalNames(object, level, FALSE, if (!x509_parse_generalNames(object, level, FALSE,
this->subjectAltNames); this->subjectAltNames))
{
goto end;
}
break; break;
default: default:
break; break;
@@ -303,7 +306,10 @@ static bool parse_extension_request(private_x509_pkcs10_t *this, chunk_t blob, i
} }
} }
success = parser->success(parser); success = parser->success(parser);
end:
parser->destroy(parser); parser->destroy(parser);
return success; return success;
} }