Skip to content

Commit ccb9bdd

Browse files
JacobBarthelmehJacobBarthelmeh
authored
set dev ID with signature check (#6318)
* set dev ID with signature check * refactor devId use and add API to set devId in WOLFSSL_CERT_MANAGER structure * add api.c call to set devid with WOLFSSL_CERT_MANAGER * resolving devID CRL issue and CM pointer * add device find callback * add simple test case
1 parent 3556b7a commit ccb9bdd

6 files changed

Lines changed: 135 additions & 60 deletions

File tree

‎src/ssl.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7590,7 +7590,7 @@ int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
75907590
#endif
75917591

75927592
WOLFSSL_MSG("Checking cert signature type");
7593-
InitDecodedCert(cert, der->buffer, der->length, heap);
7593+
InitDecodedCert_ex(cert, der->buffer, der->length, heap, devId);
75947594

75957595
if (DecodeToKey(cert, 0) < 0) {
75967596
WOLFSSL_MSG("Decode to key failed");
@@ -9831,7 +9831,7 @@ static int check_cert_key(DerBuffer* cert, DerBuffer* key, void* heap,
98319831

98329832
size = cert->length;
98339833
buff = cert->buffer;
9834-
InitDecodedCert(der, buff, size, heap);
9834+
InitDecodedCert_ex(der, buff, size, heap, devId);
98359835
if (ParseCertRelative(der, CERT_TYPE, NO_VERIFY, NULL) != 0) {
98369836
FreeDecodedCert(der);
98379837
#ifdef WOLFSSL_SMALL_STACK
@@ -20619,7 +20619,8 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out,
2061920619
ret = wolfSSL_X509_dup(&ssl->peerCert);
2062020620
#ifdef SESSION_CERTS
2062120621
else if (ssl->session->chain.count > 0) {
20622-
if (DecodeToX509(&ssl->peerCert, ssl->session->chain.certs[0].buffer,
20622+
if (DecodeToX509(&ssl->peerCert,
20623+
ssl->session->chain.certs[0].buffer,
2062320624
ssl->session->chain.certs[0].length) == 0) {
2062420625
ret = wolfSSL_X509_dup(&ssl->peerCert);
2062520626
}

‎wolfcrypt/src/asn.c‎

Lines changed: 40 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11117,6 +11117,21 @@ int wc_DsaKeyToParamsDer_ex(DsaKey* key, byte* output, word32* inLen)
1111711117
*/
1111811118
void InitDecodedCert(DecodedCert* cert,
1111911119
const byte* source, word32 inSz, void* heap)
11120+
{
11121+
InitDecodedCert_ex(cert, source, inSz, heap, INVALID_DEVID);
11122+
}
11123+
11124+
11125+
/* Initialize decoded certificate object with buffer of DER encoding.
11126+
*
11127+
* @param [in, out] cert Decoded certificate object.
11128+
* @param [in] source Buffer containing DER encoded certificate.
11129+
* @param [in] inSz Size of DER data in buffer in bytes.
11130+
* @param [in] heap Dynamic memory hint.
11131+
* @param [in] devId Crypto callback ID to use.
11132+
*/
11133+
void InitDecodedCert_ex(DecodedCert* cert,
11134+
const byte* source, word32 inSz, void* heap, int devId)
1112011135
{
1112111136
if (cert != NULL) {
1112211137
XMEMSET(cert, 0, sizeof(DecodedCert));
@@ -11152,7 +11167,7 @@ void InitDecodedCert(DecodedCert* cert,
1115211167
#endif /* WOLFSSL_CERT_GEN || WOLFSSL_CERT_EXT */
1115311168

1115411169
#ifndef NO_CERTS
11155-
InitSignatureCtx(&cert->sigCtx, heap, INVALID_DEVID);
11170+
InitSignatureCtx(&cert->sigCtx, heap, devId);
1115611171
#endif
1115711172
}
1115811173
}
@@ -20958,6 +20973,7 @@ static int CheckCertSignature_ex(const byte* cert, word32 certSz, void* heap,
2095820973
if (sigCtx == NULL)
2095920974
return MEMORY_E;
2096020975
#endif
20976+
2096120977
InitSignatureCtx(sigCtx, heap, INVALID_DEVID);
2096220978

2096320979
/* Certificate SEQUENCE */
@@ -24653,7 +24669,8 @@ void wc_SetCert_Free(Cert* cert)
2465324669
}
2465424670
}
2465524671

24656-
static int wc_SetCert_LoadDer(Cert* cert, const byte* der, word32 derSz)
24672+
static int wc_SetCert_LoadDer(Cert* cert, const byte* der, word32 derSz,
24673+
int devId)
2465724674
{
2465824675
int ret;
2465924676

@@ -24671,8 +24688,8 @@ static int wc_SetCert_LoadDer(Cert* cert, const byte* der, word32 derSz)
2467124688
else {
2467224689
XMEMSET(cert->decodedCert, 0, sizeof(DecodedCert));
2467324690

24674-
InitDecodedCert((DecodedCert*)cert->decodedCert, der, derSz,
24675-
cert->heap);
24691+
InitDecodedCert_ex((DecodedCert*)cert->decodedCert, der, derSz,
24692+
cert->heap, devId);
2467624693
ret = ParseCertRelative((DecodedCert*)cert->decodedCert,
2467724694
CERT_TYPE, 0, NULL);
2467824695
if (ret >= 0) {
@@ -30226,7 +30243,7 @@ int wc_SetAuthKeyIdFromCert(Cert *cert, const byte *der, int derSz)
3022630243
/* Check if decodedCert is cached */
3022730244
if (cert->der != der) {
3022830245
/* Allocate cache for the decoded cert */
30229-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30246+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3023030247
}
3023130248

3023230249
if (ret >= 0) {
@@ -30467,7 +30484,8 @@ static int SetAltNamesFromDcert(Cert* cert, DecodedCert* decoded)
3046730484
#ifndef NO_FILESYSTEM
3046830485

3046930486
/* Set Alt Names from der cert, return 0 on success */
30470-
static int SetAltNamesFromCert(Cert* cert, const byte* der, int derSz)
30487+
static int SetAltNamesFromCert(Cert* cert, const byte* der, int derSz,
30488+
int devId)
3047130489
{
3047230490
int ret;
3047330491
#ifdef WOLFSSL_SMALL_STACK
@@ -30486,7 +30504,7 @@ static int SetAltNamesFromCert(Cert* cert, const byte* der, int derSz)
3048630504
return MEMORY_E;
3048730505
#endif
3048830506

30489-
InitDecodedCert(decoded, der, (word32)derSz, NULL);
30507+
InitDecodedCert_ex(decoded, der, (word32)derSz, NULL, devId);
3049030508
ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
3049130509

3049230510
if (ret < 0) {
@@ -30666,7 +30684,7 @@ static void SetNameFromDcert(CertName* cn, DecodedCert* decoded)
3066630684
#ifndef NO_FILESYSTEM
3066730685

3066830686
/* Set cn name from der buffer, return 0 on success */
30669-
static int SetNameFromCert(CertName* cn, const byte* der, int derSz)
30687+
static int SetNameFromCert(CertName* cn, const byte* der, int derSz, int devId)
3067030688
{
3067130689
int ret;
3067230690
#ifdef WOLFSSL_SMALL_STACK
@@ -30685,7 +30703,7 @@ static int SetNameFromCert(CertName* cn, const byte* der, int derSz)
3068530703
return MEMORY_E;
3068630704
#endif
3068730705

30688-
InitDecodedCert(decoded, der, (word32)derSz, NULL);
30706+
InitDecodedCert_ex(decoded, der, (word32)derSz, NULL, devId);
3068930707
ret = ParseCertRelative(decoded, CA_TYPE, NO_VERIFY, 0);
3069030708

3069130709
if (ret < 0) {
@@ -30717,7 +30735,8 @@ int wc_SetIssuer(Cert* cert, const char* issuerFile)
3071730735
ret = wc_PemCertToDer_ex(issuerFile, &der);
3071830736
if (ret == 0) {
3071930737
cert->selfSigned = 0;
30720-
ret = SetNameFromCert(&cert->issuer, der->buffer, (int)der->length);
30738+
ret = SetNameFromCert(&cert->issuer, der->buffer, (int)der->length,
30739+
INVALID_DEVID);
3072130740

3072230741
FreeDer(&der);
3072330742
}
@@ -30738,7 +30757,8 @@ int wc_SetSubject(Cert* cert, const char* subjectFile)
3073830757

3073930758
ret = wc_PemCertToDer_ex(subjectFile, &der);
3074030759
if (ret == 0) {
30741-
ret = SetNameFromCert(&cert->subject, der->buffer, (int)der->length);
30760+
ret = SetNameFromCert(&cert->subject, der->buffer, (int)der->length,
30761+
INVALID_DEVID);
3074230762

3074330763
FreeDer(&der);
3074430764
}
@@ -30761,7 +30781,8 @@ int wc_SetAltNames(Cert* cert, const char* file)
3076130781

3076230782
ret = wc_PemCertToDer_ex(file, &der);
3076330783
if (ret == 0) {
30764-
ret = SetAltNamesFromCert(cert, der->buffer, (int)der->length);
30784+
ret = SetAltNamesFromCert(cert, der->buffer, (int)der->length,
30785+
INVALID_DEVID);
3076530786

3076630787
FreeDer(&der);
3076730788
}
@@ -30788,7 +30809,7 @@ int wc_SetIssuerBuffer(Cert* cert, const byte* der, int derSz)
3078830809
/* Check if decodedCert is cached */
3078930810
if (cert->der != der) {
3079030811
/* Allocate cache for the decoded cert */
30791-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30812+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3079230813
}
3079330814

3079430815
if (ret >= 0) {
@@ -30815,7 +30836,7 @@ int wc_SetSubjectBuffer(Cert* cert, const byte* der, int derSz)
3081530836
/* Check if decodedCert is cached */
3081630837
if (cert->der != der) {
3081730838
/* Allocate cache for the decoded cert */
30818-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30839+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3081930840
}
3082030841

3082130842
if (ret >= 0) {
@@ -30842,7 +30863,7 @@ int wc_SetSubjectRaw(Cert* cert, const byte* der, int derSz)
3084230863
/* Check if decodedCert is cached */
3084330864
if (cert->der != der) {
3084430865
/* Allocate cache for the decoded cert */
30845-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30866+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3084630867
}
3084730868

3084830869
if (ret >= 0) {
@@ -30876,7 +30897,7 @@ int wc_SetIssuerRaw(Cert* cert, const byte* der, int derSz)
3087630897
/* Check if decodedCert is cached */
3087730898
if (cert->der != der) {
3087830899
/* Allocate cache for the decoded cert */
30879-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30900+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3088030901
}
3088130902

3088230903
if (ret >= 0) {
@@ -30913,7 +30934,7 @@ int wc_SetAltNamesBuffer(Cert* cert, const byte* der, int derSz)
3091330934
/* Check if decodedCert is cached */
3091430935
if (cert->der != der) {
3091530936
/* Allocate cache for the decoded cert */
30916-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30937+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3091730938
}
3091830939

3091930940
if (ret >= 0) {
@@ -30940,7 +30961,7 @@ int wc_SetDatesBuffer(Cert* cert, const byte* der, int derSz)
3094030961
/* Check if decodedCert is cached */
3094130962
if (cert->der != der) {
3094230963
/* Allocate cache for the decoded cert */
30943-
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz);
30964+
ret = wc_SetCert_LoadDer(cert, der, (word32)derSz, INVALID_DEVID);
3094430965
}
3094530966

3094630967
if (ret >= 0) {
@@ -34440,7 +34461,6 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
3444034461
int sigLength;
3444134462
const byte* sigParams = NULL;
3444234463
word32 sigParamsSz = 0;
34443-
3444434464
WOLFSSL_ENTER("DecodeBasicOcspResponse");
3444534465
(void)heap;
3444634466

@@ -34708,6 +34728,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
3470834728
#endif
3470934729
if (ca) {
3471034730
SignatureCtx sigCtx;
34731+
3471134732
/* Initialize he signature context. */
3471234733
InitSignatureCtx(&sigCtx, heap, INVALID_DEVID);
3471334734

0 commit comments

Comments
 (0)