denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Correctly parse responderId as ASN.1 CHOICE in OCSP response

Browse Source 
The two OPTs that were used previously allowed to omit it completely (hence
the fallback to ID_ANY), but that's invalid, so it's better to fail
parsing.
This commit is contained in:
Tobias Brunner
2023-11-24 17:41:18 +01:00
parent 585c40095a
commit e7a58f46f9
1 changed files with 40 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ocsp_response.c
+40 -45
View File
@@ -612,49 +612,49 @@ static bool build_basicOCSPResponse(private_x509_ocsp_response_t *this,
* ASN.1 definition of basicResponse * ASN.1 definition of basicResponse
*/ */
static const asn1Object_t basicResponseObjects[] = { static const asn1Object_t basicResponseObjects[] = {
{ 0, "BasicOCSPResponse", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ { 0, "BasicOCSPResponse", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
{ 1, "tbsResponseData", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */ { 1, "tbsResponseData", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */
{ 2, "versionContext", ASN1_CONTEXT_C_0, ASN1_NONE | { 2, "versionContext", ASN1_CONTEXT_C_0, ASN1_NONE|ASN1_DEF }, /* 2 */
ASN1_DEF }, /* 2 */ { 3, "version", ASN1_INTEGER, ASN1_BODY }, /* 3 */
{ 3, "version", ASN1_INTEGER, ASN1_BODY }, /* 3 */ { 2, "responderId", ASN1_EOC, ASN1_CHOICE }, /* 4 */
{ 2, "responderIdContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 4 */ { 3, "responderIdContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 5 */
{ 3, "responderIdByName", ASN1_SEQUENCE, ASN1_OBJ }, /* 5 */ { 4, "responderIdByName", ASN1_SEQUENCE, ASN1_OBJ }, /* 6 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 6 */ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 7 */
{ 2, "responderIdContext", ASN1_CONTEXT_C_2, ASN1_OPT }, /* 7 */ { 3, "responderIdContext", ASN1_CONTEXT_C_2, ASN1_OPT }, /* 8 */
{ 3, "responderIdByKey", ASN1_OCTET_STRING, ASN1_BODY }, /* 8 */ { 4, "responderIdByKey", ASN1_OCTET_STRING, ASN1_BODY }, /* 9 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */
{ 2, "producedAt", ASN1_GENERALIZEDTIME, ASN1_BODY }, /* 10 */ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */
{ 2, "responses", ASN1_SEQUENCE, ASN1_OBJ }, /* 11 */ { 2, "producedAt", ASN1_GENERALIZEDTIME, ASN1_BODY }, /* 12 */
{ 2, "responseExtensionsContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 12 */ { 2, "responses", ASN1_SEQUENCE, ASN1_OBJ }, /* 13 */
{ 3, "responseExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 13 */ { 2, "responseExtensionsContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 14 */
{ 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 14 */ { 3, "responseExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 15 */
{ 5, "extnID", ASN1_OID, ASN1_BODY }, /* 15 */ { 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 16 */
{ 5, "critical", ASN1_BOOLEAN, ASN1_BODY | { 5, "extnID", ASN1_OID, ASN1_BODY }, /* 17 */
ASN1_DEF }, /* 16 */ { 5, "critical", ASN1_BOOLEAN, ASN1_BODY | ASN1_DEF }, /* 18 */
{ 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 17 */ { 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 19 */
{ 3, "end loop", ASN1_EOC, ASN1_END }, /* 18 */ { 3, "end loop", ASN1_EOC, ASN1_END }, /* 20 */
{ 2, "end opt", ASN1_EOC, ASN1_END }, /* 19 */ { 2, "end opt", ASN1_EOC, ASN1_END }, /* 21 */
{ 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 20 */ { 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 22 */
{ 1, "signature", ASN1_BIT_STRING, ASN1_BODY }, /* 21 */ { 1, "signature", ASN1_BIT_STRING, ASN1_BODY }, /* 23 */
{ 1, "certsContext", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 22 */ { 1, "certsContext", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 24 */
{ 2, "certs", ASN1_SEQUENCE, ASN1_LOOP }, /* 23 */ { 2, "certs", ASN1_SEQUENCE, ASN1_LOOP }, /* 25 */
{ 3, "certificate", ASN1_SEQUENCE, ASN1_RAW }, /* 24 */ { 3, "certificate", ASN1_SEQUENCE, ASN1_RAW }, /* 26 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 25 */ { 2, "end loop", ASN1_EOC, ASN1_END }, /* 27 */
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 26 */ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 28 */
{ 0, "exit", ASN1_EOC, ASN1_EXIT } { 0, "exit", ASN1_EOC, ASN1_EXIT }
}; };
#define BASIC_RESPONSE_TBS_DATA 1 #define BASIC_RESPONSE_TBS_DATA 1
#define BASIC_RESPONSE_VERSION 3 #define BASIC_RESPONSE_VERSION 3
#define BASIC_RESPONSE_ID_BY_NAME 5 #define BASIC_RESPONSE_ID_BY_NAME 6
#define BASIC_RESPONSE_ID_BY_KEY 8 #define BASIC_RESPONSE_ID_BY_KEY 9
#define BASIC_RESPONSE_PRODUCED_AT 10 #define BASIC_RESPONSE_PRODUCED_AT 12
#define BASIC_RESPONSE_RESPONSES 11 #define BASIC_RESPONSE_RESPONSES 13
#define BASIC_RESPONSE_EXT_ID 15 #define BASIC_RESPONSE_EXT_ID 17
#define BASIC_RESPONSE_CRITICAL 16 #define BASIC_RESPONSE_CRITICAL 18
#define BASIC_RESPONSE_EXT_VALUE 17 #define BASIC_RESPONSE_EXT_VALUE 19
#define BASIC_RESPONSE_ALGORITHM 20 #define BASIC_RESPONSE_ALGORITHM 22
#define BASIC_RESPONSE_SIGNATURE 21 #define BASIC_RESPONSE_SIGNATURE 23
#define BASIC_RESPONSE_CERTIFICATE 24 #define BASIC_RESPONSE_CERTIFICATE 26
/** /**
* Parse a basicOCSPResponse * Parse a basicOCSPResponse
@@ -756,11 +756,6 @@ end:
parser->destroy(parser); parser->destroy(parser);
if (success) if (success)
{ {
if (!this->responderId)
{
this->responderId = identification_create_from_encoding(ID_ANY,
chunk_empty);
}
success = parse_responses(this, responses, responses_level); success = parse_responses(this, responses, responses_level);
} }
return success; return success;