denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

identification: Validate ASN.1 DN in from_data() constructor

Browse Source 
The DN is otherwise not parsed until compared/printed.  This avoids
false detections as ASN.1 DN if e.g. an email address starts with "0",
which is 0x30 = ASN.1 sequence tag, and the next character denotes
the exact length of the rest of the string (see the unit tests for an
example).
This commit is contained in:
Tobias Brunner
2020-12-03 08:23:54 +01:00
parent 4c61d7aedc
commit e8fae43768
2 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/tests/suites/test_identification.c
+17
View File
@@ -62,6 +62,23 @@ START_TEST(test_from_data)
ck_assert(chunk_equals(expected, encoding));
a->destroy(a);
/* this is not actually ASN.1, even though it starts with 0x30 and the
* correct length (0x31=49) */
expected = chunk_from_str("[email protected]");
a = identification_create_from_data(chunk_from_chars(
0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,
0x2d,0x61,0x61,0x61,0x61,0x2d,0x62,0x62,
0x62,0x62,0x2d,0x63,0x63,0x63,0x63,0x2d,
0x64,0x64,0x64,0x64,0x65,0x65,0x65,0x65,
0x66,0x66,0x66,0x66,0x40,0x73,0x74,0x72,
0x6f,0x6e,0x67,0x73,0x77,0x61,0x6e,0x2e,
0x6f,0x72,0x67));
ck_assert(ID_RFC822_ADDR == a->get_type(a));
encoding = a->get_encoding(a);
ck_assert(expected.ptr != encoding.ptr);
ck_assert(chunk_equals(expected, encoding));
a->destroy(a);
/* everything else is handled by the string parser */
expected = chunk_from_str("[email protected]");
a = identification_create_from_data(expected);