Nevar pievienot vairāk kā 25 tēmas Tēmai ir jāsākas ar burtu vai ciparu, tā var saturēt domu zīmes ('-') un var būt līdz 35 simboliem gara.

Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 (Imported from upstream's 85cfc188c06bd046420ae70dd6e302f9efe022a9 and 4c52816d35681c0533c25fdd3abb4b7c6962302d) Change-Id: Ic901aea8ea6457df27dc542a11c30464561e322b Reviewed-on: https://boringssl-review.googlesource.com/2783 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
pirms 9 gadiem
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  2. * project 2000. */
  3. /* ====================================================================
  4. * Copyright (c) 2000 The OpenSSL Project. All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. *
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. *
  13. * 2. Redistributions in binary form must reproduce the above copyright
  14. * notice, this list of conditions and the following disclaimer in
  15. * the documentation and/or other materials provided with the
  16. * distribution.
  17. *
  18. * 3. All advertising materials mentioning features or use of this
  19. * software must display the following acknowledgment:
  20. * "This product includes software developed by the OpenSSL Project
  21. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  22. *
  23. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  24. * endorse or promote products derived from this software without
  25. * prior written permission. For written permission, please contact
  26. * licensing@OpenSSL.org.
  27. *
  28. * 5. Products derived from this software may not be called "OpenSSL"
  29. * nor may "OpenSSL" appear in their names without prior written
  30. * permission of the OpenSSL Project.
  31. *
  32. * 6. Redistributions of any form whatsoever must retain the following
  33. * acknowledgment:
  34. * "This product includes software developed by the OpenSSL Project
  35. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  36. *
  37. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  38. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  39. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  40. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  41. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  42. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  43. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  44. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  45. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  46. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  47. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  48. * OF THE POSSIBILITY OF SUCH DAMAGE.
  49. * ====================================================================
  50. *
  51. * This product includes cryptographic software written by Eric Young
  52. * (eay@cryptsoft.com). This product includes software written by Tim
  53. * Hudson (tjh@cryptsoft.com). */
  54. #include <openssl/x509.h>
  55. #include <openssl/asn1.h>
  56. #include <openssl/asn1t.h>
  57. #include <openssl/digest.h>
  58. #include <openssl/obj.h>
  59. ASN1_SEQUENCE(X509_ALGOR) = {
  60. ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT),
  61. ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY)
  62. } ASN1_SEQUENCE_END(X509_ALGOR)
  63. ASN1_ITEM_TEMPLATE(X509_ALGORS) =
  64. ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, algorithms, X509_ALGOR)
  65. ASN1_ITEM_TEMPLATE_END(X509_ALGORS)
  66. IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
  67. IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
  68. IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
  69. IMPLEMENT_ASN1_SET_OF(X509_ALGOR)
  70. int X509_ALGOR_set0(X509_ALGOR *alg, const ASN1_OBJECT *aobj, int ptype, void *pval)
  71. {
  72. if (!alg)
  73. return 0;
  74. if (ptype != V_ASN1_UNDEF)
  75. {
  76. if (alg->parameter == NULL)
  77. alg->parameter = ASN1_TYPE_new();
  78. if (alg->parameter == NULL)
  79. return 0;
  80. }
  81. if (alg)
  82. {
  83. if (alg->algorithm)
  84. ASN1_OBJECT_free(alg->algorithm);
  85. alg->algorithm = (ASN1_OBJECT*) aobj;
  86. }
  87. if (ptype == 0)
  88. return 1;
  89. if (ptype == V_ASN1_UNDEF)
  90. {
  91. if (alg->parameter)
  92. {
  93. ASN1_TYPE_free(alg->parameter);
  94. alg->parameter = NULL;
  95. }
  96. }
  97. else
  98. ASN1_TYPE_set(alg->parameter, ptype, pval);
  99. return 1;
  100. }
  101. void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
  102. X509_ALGOR *algor)
  103. {
  104. if (paobj)
  105. *paobj = algor->algorithm;
  106. if (pptype)
  107. {
  108. if (algor->parameter == NULL)
  109. {
  110. *pptype = V_ASN1_UNDEF;
  111. return;
  112. }
  113. else
  114. *pptype = algor->parameter->type;
  115. if (ppval)
  116. *ppval = algor->parameter->value.ptr;
  117. }
  118. }
  119. /* Set up an X509_ALGOR DigestAlgorithmIdentifier from an EVP_MD */
  120. void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md)
  121. {
  122. int param_type;
  123. if (EVP_MD_flags(md) & EVP_MD_FLAG_DIGALGID_ABSENT)
  124. param_type = V_ASN1_UNDEF;
  125. else
  126. param_type = V_ASN1_NULL;
  127. X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
  128. }
  129. /* X509_ALGOR_cmp returns 0 if |a| and |b| are equal and non-zero otherwise. */
  130. int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b)
  131. {
  132. int rv;
  133. rv = OBJ_cmp(a->algorithm, b->algorithm);
  134. if (rv)
  135. return rv;
  136. if (!a->parameter && !b->parameter)
  137. return 0;
  138. return ASN1_TYPE_cmp(a->parameter, b->parameter);
  139. }