jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

TLS: Support longer X.509 serialNumber values

Browse source 
This extends the old support from 32 or 64 bit value to full 20 octets
maximum (RFC 5280, 4.1.2.2).

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-12-17 01:41:45 +02:00
parent 58a406202a
commit b72a36718f
2 changed files with 16 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
src/tls/x509v3.c
View file

@ -1401,21 +1401,23 @@ static int x509_parse_tbs_certificate(const u8 *buf, size_t len,
/* serialNumber CertificateSerialNumber ::= INTEGER */ /* serialNumber CertificateSerialNumber ::= INTEGER */
if (hdr.class != ASN1_CLASS_UNIVERSAL || if (hdr.class != ASN1_CLASS_UNIVERSAL ||
hdr.tag != ASN1_TAG_INTEGER) { hdr.tag != ASN1_TAG_INTEGER ||
hdr.length < 1 || hdr.length > X509_MAX_SERIAL_NUM_LEN) {
wpa_printf(MSG_DEBUG, "X509: No INTEGER tag found for " wpa_printf(MSG_DEBUG, "X509: No INTEGER tag found for "
"serialNumber; class=%d tag=0x%x", "serialNumber; class=%d tag=0x%x length=%u",
hdr.class, hdr.tag); hdr.class, hdr.tag, hdr.length);
return -1; return -1;
} }
pos = hdr.payload; pos = hdr.payload + hdr.length;
left = hdr.length; while (hdr.length > 0 && hdr.payload[0] == 0) {
while (left) { hdr.payload++;
cert->serial_number <<= 8; hdr.length--;
cert->serial_number |= *pos++;
left--;
} }
wpa_printf(MSG_MSGDUMP, "X509: serialNumber %lu", cert->serial_number); os_memcpy(cert->serial_number, hdr.payload, hdr.length);
cert->serial_number_len = hdr.length;
wpa_hexdump(MSG_MSGDUMP, "X509: serialNumber", cert->serial_number,
cert->serial_number_len);
/* signature AlgorithmIdentifier */ /* signature AlgorithmIdentifier */
if (x509_parse_algorithm_identifier(pos, end - pos, &cert->signature, if (x509_parse_algorithm_identifier(pos, end - pos, &cert->signature,

5
src/tls/x509v3.h
View file

@ -45,10 +45,13 @@ struct x509_name {
struct asn1_oid rid; /* registeredID */ struct asn1_oid rid; /* registeredID */
}; };
#define X509_MAX_SERIAL_NUM_LEN 20
struct x509_certificate { struct x509_certificate {
struct x509_certificate *next; struct x509_certificate *next;
enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version; enum { X509_CERT_V1 = 0, X509_CERT_V2 = 1, X509_CERT_V3 = 2 } version;
unsigned long serial_number; u8 serial_number[X509_MAX_SERIAL_NUM_LEN];
size_t serial_number_len;
struct x509_algorithm_identifier signature; struct x509_algorithm_identifier signature;
struct x509_name issuer; struct x509_name issuer;
struct x509_name subject; struct x509_name subject;