denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

verify correctness of X.509 versions

Browse Source
This commit is contained in:
Andreas Steffen
2009-10-02 17:49:51 +02:00
parent 6f2f08fb8d
commit daaedcb9c2
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_cert.c
+18 -2
View File
@@ -668,6 +668,7 @@ static const asn1Object_t certObjects[] = {
#define X509_OBJ_NOT_AFTER 9 #define X509_OBJ_NOT_AFTER 9
#define X509_OBJ_SUBJECT 10 #define X509_OBJ_SUBJECT 10
#define X509_OBJ_SUBJECT_PUBLIC_KEY_INFO 11 #define X509_OBJ_SUBJECT_PUBLIC_KEY_INFO 11
#define X509_OBJ_OPTIONAL_EXTENSIONS 16
#define X509_OBJ_EXTN_ID 19 #define X509_OBJ_EXTN_ID 19
#define X509_OBJ_CRITICAL 20 #define X509_OBJ_CRITICAL 20
#define X509_OBJ_EXTN_VALUE 21 #define X509_OBJ_EXTN_VALUE 21
@@ -705,7 +706,15 @@ static bool parse_certificate(private_x509_cert_t *this)
break; break;
case X509_OBJ_VERSION: case X509_OBJ_VERSION:
this->version = (object.len) ? (1+(u_int)*object.ptr) : 1; this->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
DBG2(" v%d", this->version); if (this->version < 1 || this->version > 3)
{
DBG1("X.509v%d not supported", this->version);
goto end;
}
else
{
DBG2(" X.509v%d", this->version);
}
break; break;
case X509_OBJ_SERIAL_NUMBER: case X509_OBJ_SERIAL_NUMBER:
this->serialNumber = object; this->serialNumber = object;
@@ -735,6 +744,13 @@ static bool parse_certificate(private_x509_cert_t *this)
goto end; goto end;
} }
break; break;
case X509_OBJ_OPTIONAL_EXTENSIONS:
if (this->version != 3)
{
DBG1("Only X.509v3 certificates have extensions");
goto end;
}
break;
case X509_OBJ_EXTN_ID: case X509_OBJ_EXTN_ID:
extn_oid = asn1_known_oid(object); extn_oid = asn1_known_oid(object);
break; break;
@@ -1169,7 +1185,7 @@ static private_x509_cert_t* create_empty(void)
this->encoding = chunk_empty; this->encoding = chunk_empty;
this->encoding_hash = chunk_empty; this->encoding_hash = chunk_empty;
this->tbsCertificate = chunk_empty; this->tbsCertificate = chunk_empty;
this->version = 3; this->version = 1;
this->serialNumber = chunk_empty; this->serialNumber = chunk_empty;
this->notBefore = 0; this->notBefore = 0;
this->notAfter = 0; this->notAfter = 0;