sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-23 21:41:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Validate path length constraint in certificate chain

Browse Source 
Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2012-03-21 19:18:38 +00:00
parent 94cdbd76d6
commit b1316ef276
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/crypto/x509.c
View File

@@ -89,6 +89,10 @@ FILE_LICENCE ( GPL2_OR_LATER );
__einfo_error ( EINFO_EACCES_EXPIRED ) __einfo_error ( EINFO_EACCES_EXPIRED )
#define EINFO_EACCES_EXPIRED \ #define EINFO_EACCES_EXPIRED \
__einfo_uniqify ( EINFO_EACCES, 0x04, "Expired (or not yet valid)" ) __einfo_uniqify ( EINFO_EACCES, 0x04, "Expired (or not yet valid)" )
#define EACCES_PATH_LEN \
__einfo_error ( EINFO_EACCES_PATH_LEN )
#define EINFO_EACCES_PATH_LEN \
__einfo_uniqify ( EINFO_EACCES, 0x05, "Maximum path length exceeded" )
/** "commonName" object identifier */ /** "commonName" object identifier */
static uint8_t oid_common_name[] = { ASN1_OID_COMMON_NAME }; static uint8_t oid_common_name[] = { ASN1_OID_COMMON_NAME };
@@ -1187,6 +1191,7 @@ int x509_validate_chain ( int ( * parse_next ) ( struct x509_certificate *cert,
struct x509_certificate *current = &temp[0]; struct x509_certificate *current = &temp[0];
struct x509_certificate *next = &temp[1]; struct x509_certificate *next = &temp[1];
struct x509_certificate *swap; struct x509_certificate *swap;
unsigned int path_len = 0;
int rc; int rc;
/* Use default root certificate store if none specified */ /* Use default root certificate store if none specified */
@@ -1226,6 +1231,15 @@ int x509_validate_chain ( int ( * parse_next ) ( struct x509_certificate *cert,
if ( ( rc = x509_validate_issuer ( current, next ) ) != 0 ) if ( ( rc = x509_validate_issuer ( current, next ) ) != 0 )
return rc; return rc;
/* Validate path length constraint */
if ( path_len > next->extensions.basic.path_len ) {
DBGC ( context, "X509 chain %p path length %d exceeds "
"maximum %d\n", context, path_len,
next->extensions.basic.path_len );
return -EACCES_PATH_LEN;
}
path_len++;
/* Move to next certificate in chain */ /* Move to next certificate in chain */
swap = current; swap = current;
current = next; current = next;