mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-27 12:40:19 +00:00
wolfssl: patch CVE-2026-6450
Also backport follow-up PR[1] to the initial PR mentioned in the NVD. Details: https://nvd.nist.gov/vuln/detail/cve-2026-6450 [1]https://github.com/wolfSSL/wolfssl/pull/10274 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
@@ -0,0 +1,456 @@
|
||||
From b60e4b6fc0d757f5983a803ad02a1a57c0d0a463 Mon Sep 17 00:00:00 2001
|
||||
From: Reda Chouk <reda@wolfssl.com>
|
||||
Date: Thu, 16 Apr 2026 19:45:09 +0200
|
||||
Subject: [PATCH] reject crls with unrecognized critical extensions per rfc
|
||||
5280 section 5.2
|
||||
|
||||
(cherry picked from commit 857141da35b67a14a580fb26ec57af1efa68a1d9)
|
||||
|
||||
CVE: CVE-2026-6450
|
||||
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/857141da35b67a14a580fb26ec57af1efa68a1d9]
|
||||
|
||||
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
||||
---
|
||||
tests/api/test_certman.c | 342 +++++++++++++++++++++++++++++++++++++++
|
||||
tests/api/test_certman.h | 4 +
|
||||
wolfcrypt/src/asn.c | 7 +-
|
||||
wolfcrypt/src/asn_orig.c | 9 +-
|
||||
4 files changed, 359 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/tests/api/test_certman.c b/tests/api/test_certman.c
|
||||
index 6c5875dc5..7405f4bff 100644
|
||||
--- a/tests/api/test_certman.c
|
||||
+++ b/tests/api/test_certman.c
|
||||
@@ -1964,6 +1964,348 @@ int test_wolfSSL_CRL_duplicate_extensions(void)
|
||||
return EXPECT_RESULT();
|
||||
}
|
||||
|
||||
+int test_wolfSSL_CRL_critical_idp(void)
|
||||
+{
|
||||
+ EXPECT_DECLS;
|
||||
+#if !defined(NO_CERTS) && defined(HAVE_CRL) && !defined(NO_RSA)
|
||||
+
|
||||
+ /* CA cert (CN=claim-root), self-signed, 799 bytes DER */
|
||||
+ static const unsigned char ca_cert_idp[] = {
|
||||
+ 0x30, 0x82, 0x03, 0x1b, 0x30, 0x82, 0x02, 0x03, 0xa0, 0x03, 0x02,
|
||||
+ 0x01, 0x02, 0x02, 0x14, 0x1e, 0x25, 0xc1, 0x5d, 0x6f, 0x02, 0x21,
|
||||
+ 0xa0, 0xf0, 0x14, 0x15, 0x9c, 0x3b, 0x4d, 0x1d, 0x73, 0x16, 0x00,
|
||||
+ 0xe4, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
|
||||
+ 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30,
|
||||
+ 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61,
|
||||
+ 0x69, 0x6d, 0x2d, 0x72, 0x6f, 0x6f, 0x74, 0x30, 0x1e, 0x17, 0x0d,
|
||||
+ 0x32, 0x36, 0x30, 0x34, 0x31, 0x36, 0x31, 0x31, 0x33, 0x38, 0x35,
|
||||
+ 0x35, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x34, 0x31, 0x33, 0x31,
|
||||
+ 0x31, 0x33, 0x38, 0x35, 0x35, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
|
||||
+ 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61,
|
||||
+ 0x69, 0x6d, 0x2d, 0x72, 0x6f, 0x6f, 0x74, 0x30, 0x82, 0x01, 0x22,
|
||||
+ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
|
||||
+ 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
|
||||
+ 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xba, 0x49, 0x8c, 0xb5,
|
||||
+ 0x17, 0xc1, 0x01, 0x24, 0x6f, 0x56, 0x1a, 0xa9, 0x3b, 0x03, 0xe2,
|
||||
+ 0x9f, 0x24, 0xb1, 0x25, 0x98, 0xfb, 0x38, 0x82, 0x78, 0x54, 0xa7,
|
||||
+ 0x1f, 0x69, 0x87, 0xe4, 0x96, 0x1b, 0x81, 0x18, 0x10, 0xb0, 0xc0,
|
||||
+ 0x5b, 0x4b, 0xbf, 0xb8, 0x1d, 0xf4, 0xee, 0x75, 0x0f, 0xb5, 0x45,
|
||||
+ 0x72, 0x70, 0xce, 0x65, 0x84, 0x44, 0x3e, 0x30, 0x78, 0xc4, 0xf3,
|
||||
+ 0xec, 0xba, 0x96, 0x78, 0xa4, 0x65, 0xfc, 0x62, 0x8d, 0xf5, 0x29,
|
||||
+ 0xf9, 0x7c, 0x3d, 0x78, 0x6c, 0x1d, 0x4a, 0x4c, 0xc9, 0x15, 0x2d,
|
||||
+ 0x22, 0x10, 0xea, 0x93, 0x26, 0xb8, 0xa6, 0x17, 0xd3, 0x0e, 0xbc,
|
||||
+ 0x0c, 0xab, 0x83, 0x63, 0xf6, 0x1c, 0xcc, 0x83, 0x73, 0x29, 0x7e,
|
||||
+ 0x7f, 0x83, 0x7f, 0xbd, 0x63, 0xaa, 0x8d, 0xfa, 0x78, 0x85, 0xd2,
|
||||
+ 0x3e, 0x60, 0x95, 0x5a, 0x8d, 0xfa, 0x8f, 0xcd, 0x94, 0x3f, 0x13,
|
||||
+ 0x28, 0xd9, 0xd0, 0x87, 0x28, 0x17, 0x78, 0xe2, 0x61, 0x8d, 0x79,
|
||||
+ 0x97, 0x01, 0xa9, 0x7c, 0x84, 0xc0, 0x1c, 0xbe, 0x5f, 0x5d, 0xca,
|
||||
+ 0x28, 0x6b, 0x5e, 0xdd, 0x83, 0xa5, 0x55, 0x34, 0x11, 0xba, 0xfa,
|
||||
+ 0x8b, 0x92, 0xa3, 0xde, 0xb6, 0xf3, 0xba, 0xab, 0x7f, 0x1a, 0x67,
|
||||
+ 0xfd, 0x6f, 0x20, 0x85, 0x4c, 0x77, 0xa7, 0x8e, 0xbe, 0xb8, 0xf8,
|
||||
+ 0x8f, 0x70, 0xe3, 0x5a, 0xd3, 0x77, 0xc9, 0x9e, 0x10, 0x60, 0xb4,
|
||||
+ 0xdb, 0x0c, 0xc5, 0x05, 0xe1, 0x1f, 0xbd, 0xe6, 0x79, 0xee, 0x82,
|
||||
+ 0x3f, 0x51, 0x76, 0xe2, 0x7f, 0x5c, 0x11, 0x6d, 0xd3, 0x21, 0x69,
|
||||
+ 0xec, 0x05, 0x11, 0x8b, 0xc8, 0x39, 0xb3, 0x2c, 0xa6, 0x83, 0xb4,
|
||||
+ 0x6f, 0xac, 0x19, 0xd6, 0x6a, 0x65, 0x0d, 0x08, 0x94, 0x58, 0xde,
|
||||
+ 0x3d, 0xc9, 0x0c, 0x54, 0x03, 0x73, 0x0c, 0x8d, 0x24, 0x09, 0xf3,
|
||||
+ 0xb1, 0x5d, 0xd2, 0xe3, 0xeb, 0x56, 0xd6, 0x28, 0x66, 0x5b, 0x02,
|
||||
+ 0x03, 0x01, 0x00, 0x01, 0xa3, 0x63, 0x30, 0x61, 0x30, 0x0f, 0x06,
|
||||
+ 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03,
|
||||
+ 0x01, 0x01, 0xff, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01,
|
||||
+ 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x1d, 0x06,
|
||||
+ 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x52, 0x97, 0x58,
|
||||
+ 0x47, 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e,
|
||||
+ 0xea, 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x1f, 0x06, 0x03, 0x55,
|
||||
+ 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x52, 0x97, 0x58,
|
||||
+ 0x47, 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e,
|
||||
+ 0xea, 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x0d, 0x06, 0x09, 0x2a,
|
||||
+ 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03,
|
||||
+ 0x82, 0x01, 0x01, 0x00, 0x7d, 0x30, 0xd4, 0x6a, 0x01, 0x89, 0x3b,
|
||||
+ 0x62, 0xed, 0x16, 0x46, 0x59, 0x0f, 0xf2, 0x3b, 0xb5, 0xde, 0x89,
|
||||
+ 0x08, 0x17, 0x68, 0xcb, 0x46, 0xdc, 0x39, 0xa6, 0xcb, 0x56, 0xb0,
|
||||
+ 0x91, 0xeb, 0x03, 0xb2, 0x15, 0xc4, 0x3b, 0x4d, 0x63, 0x55, 0x22,
|
||||
+ 0x0a, 0x26, 0xe6, 0x64, 0x46, 0xe8, 0x0f, 0xa8, 0xf3, 0xde, 0xe1,
|
||||
+ 0x43, 0x54, 0xe6, 0xd7, 0x8a, 0xf4, 0x4f, 0xab, 0x56, 0x93, 0x12,
|
||||
+ 0x71, 0x4b, 0x25, 0x71, 0x0a, 0x31, 0x18, 0x79, 0xee, 0x45, 0xa4,
|
||||
+ 0xf5, 0x72, 0x67, 0xfa, 0x41, 0xd9, 0x87, 0x97, 0x09, 0xef, 0x55,
|
||||
+ 0xad, 0x6f, 0x47, 0x1d, 0x5a, 0xb2, 0xe9, 0xf7, 0x22, 0x05, 0x2d,
|
||||
+ 0x5a, 0x81, 0xa8, 0xe8, 0x53, 0xb0, 0x94, 0xf6, 0x63, 0xff, 0x3f,
|
||||
+ 0x51, 0x7a, 0x08, 0xac, 0x27, 0x9a, 0x57, 0x11, 0x22, 0xa4, 0x00,
|
||||
+ 0x84, 0x70, 0x86, 0x76, 0x39, 0x0f, 0x4f, 0x57, 0xcf, 0x8e, 0x94,
|
||||
+ 0xd2, 0x8e, 0x43, 0xc0, 0xd5, 0x34, 0x7d, 0xf5, 0xa1, 0x45, 0x1e,
|
||||
+ 0xb7, 0xc8, 0x7e, 0x7c, 0xfe, 0x5d, 0x4d, 0x53, 0x43, 0x25, 0x15,
|
||||
+ 0x9e, 0x08, 0x01, 0x56, 0xa4, 0xff, 0x79, 0x59, 0x25, 0xc9, 0x23,
|
||||
+ 0x98, 0xaf, 0x05, 0xaf, 0xc1, 0x0b, 0x29, 0xf1, 0xe2, 0xc4, 0x36,
|
||||
+ 0x31, 0x91, 0xfa, 0xf2, 0xbb, 0x12, 0xe8, 0x67, 0xf9, 0xc7, 0xa1,
|
||||
+ 0x5e, 0x8c, 0xed, 0x92, 0x12, 0xa3, 0x2b, 0xe1, 0xc2, 0xe1, 0xa0,
|
||||
+ 0xb0, 0x0e, 0x12, 0xa7, 0xd0, 0xa2, 0xae, 0xd6, 0xfa, 0x30, 0x21,
|
||||
+ 0x0f, 0x73, 0xfe, 0x24, 0x21, 0x5f, 0x03, 0x86, 0x69, 0xcd, 0xec,
|
||||
+ 0x76, 0x18, 0xe1, 0xfd, 0xb6, 0x64, 0x90, 0xa6, 0x06, 0x2e, 0x19,
|
||||
+ 0x40, 0x93, 0x50, 0x37, 0xe4, 0x90, 0xe3, 0x1f, 0x07, 0xae, 0xfb,
|
||||
+ 0x89, 0xc3, 0xf6, 0xc4, 0x90, 0xab, 0x40, 0x67, 0x4c, 0x43, 0x2c,
|
||||
+ 0xa2, 0xb0, 0x3e, 0x61, 0x16, 0x69, 0x8f
|
||||
+ };
|
||||
+
|
||||
+ /* CRL with critical IDP onlyuser=TRUE, revokes serial 0x1000, 480 bytes */
|
||||
+ static const unsigned char crl_user_idp[] = {
|
||||
+ 0x30, 0x82, 0x01, 0xdc, 0x30, 0x81, 0xc5, 0x02, 0x01, 0x01, 0x30,
|
||||
+ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
|
||||
+ 0x0b, 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
|
||||
+ 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x2d,
|
||||
+ 0x72, 0x6f, 0x6f, 0x74, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x34, 0x31,
|
||||
+ 0x36, 0x31, 0x31, 0x33, 0x38, 0x35, 0x35, 0x5a, 0x17, 0x0d, 0x33,
|
||||
+ 0x36, 0x30, 0x34, 0x31, 0x33, 0x31, 0x31, 0x33, 0x38, 0x35, 0x35,
|
||||
+ 0x5a, 0x30, 0x15, 0x30, 0x13, 0x02, 0x02, 0x10, 0x00, 0x17, 0x0d,
|
||||
+ 0x32, 0x36, 0x30, 0x34, 0x31, 0x36, 0x31, 0x31, 0x33, 0x38, 0x35,
|
||||
+ 0x35, 0x5a, 0xa0, 0x65, 0x30, 0x63, 0x30, 0x1f, 0x06, 0x03, 0x55,
|
||||
+ 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x52, 0x97, 0x58,
|
||||
+ 0x47, 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e,
|
||||
+ 0xea, 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x33, 0x06, 0x03, 0x55,
|
||||
+ 0x1d, 0x1c, 0x01, 0x01, 0xff, 0x04, 0x29, 0x30, 0x27, 0xa0, 0x22,
|
||||
+ 0xa0, 0x20, 0x86, 0x1e, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f,
|
||||
+ 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2f,
|
||||
+ 0x63, 0x72, 0x6c, 0x2d, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x65,
|
||||
+ 0x6d, 0x81, 0x01, 0xff, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x14,
|
||||
+ 0x04, 0x04, 0x02, 0x02, 0x20, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a,
|
||||
+ 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03,
|
||||
+ 0x82, 0x01, 0x01, 0x00, 0x9b, 0x1a, 0x70, 0xba, 0xf8, 0x38, 0xff,
|
||||
+ 0xc6, 0x36, 0x59, 0x6e, 0xab, 0x87, 0x74, 0x04, 0xe3, 0x17, 0xb3,
|
||||
+ 0xdd, 0x62, 0x03, 0x25, 0x9e, 0xff, 0x53, 0xf7, 0xde, 0x48, 0xb0,
|
||||
+ 0x56, 0x0c, 0x19, 0xea, 0x86, 0x30, 0x21, 0x01, 0x63, 0xd6, 0xd2,
|
||||
+ 0xef, 0xd1, 0x0e, 0x1d, 0xde, 0xc1, 0x18, 0x33, 0xd2, 0x1b, 0x79,
|
||||
+ 0x2e, 0xa1, 0xd5, 0x51, 0xcc, 0x31, 0x35, 0x28, 0xa6, 0x6f, 0xc0,
|
||||
+ 0xcf, 0x78, 0xbf, 0x5d, 0xdd, 0x66, 0x81, 0x71, 0xa3, 0x52, 0xb5,
|
||||
+ 0x48, 0x81, 0x1a, 0x34, 0xf1, 0x03, 0x37, 0x3a, 0x97, 0x02, 0xd6,
|
||||
+ 0x56, 0x4a, 0x24, 0xeb, 0x93, 0x47, 0xb6, 0xc3, 0x69, 0xc6, 0x2b,
|
||||
+ 0xd8, 0xfc, 0xf9, 0x9f, 0x85, 0xab, 0xe2, 0x81, 0x66, 0x8f, 0xcf,
|
||||
+ 0x7a, 0x81, 0xd7, 0x46, 0xb4, 0x8d, 0x44, 0x05, 0x40, 0xd2, 0x3b,
|
||||
+ 0x1c, 0xb8, 0x4a, 0x88, 0xb8, 0x65, 0x69, 0x5e, 0x7f, 0x6c, 0x43,
|
||||
+ 0x1c, 0x4f, 0xbf, 0x48, 0x55, 0x6b, 0xb0, 0xb3, 0x70, 0x49, 0x1a,
|
||||
+ 0xfa, 0xd1, 0x55, 0xe7, 0xb9, 0x5d, 0x4f, 0x2d, 0x7e, 0xc1, 0xa5,
|
||||
+ 0x5f, 0x5e, 0x38, 0xef, 0x74, 0xe8, 0x72, 0x89, 0x9c, 0x86, 0x24,
|
||||
+ 0x65, 0x2d, 0x38, 0x88, 0x53, 0x81, 0x48, 0x8a, 0x7d, 0xc3, 0x0d,
|
||||
+ 0x87, 0xaf, 0xd3, 0xf7, 0x39, 0xeb, 0xac, 0x36, 0xc2, 0xc9, 0x1f,
|
||||
+ 0x78, 0xa9, 0x53, 0x1c, 0x4a, 0xa6, 0xba, 0x63, 0xd1, 0xc2, 0x62,
|
||||
+ 0x81, 0x00, 0x39, 0xb1, 0x1c, 0x1c, 0xad, 0x96, 0x83, 0xf7, 0x99,
|
||||
+ 0x34, 0xc6, 0x9c, 0x93, 0xbb, 0x6a, 0x7c, 0xf5, 0x18, 0xed, 0xbd,
|
||||
+ 0x29, 0xe4, 0x29, 0x50, 0x3c, 0xcb, 0x94, 0x72, 0x8f, 0xad, 0x15,
|
||||
+ 0x91, 0x38, 0x4a, 0xb4, 0xde, 0x98, 0x3e, 0xd6, 0xb2, 0xd1, 0x2a,
|
||||
+ 0x8c, 0xa2, 0xc9, 0x0f, 0x2f, 0x7c, 0x4a, 0xd6, 0x56, 0x02, 0x9f,
|
||||
+ 0x6c, 0xda, 0xa9, 0x4c, 0x04, 0x64, 0x7c
|
||||
+ };
|
||||
+
|
||||
+ /* CRL with critical IDP onlyCA=TRUE, empty revocation list, 459 bytes */
|
||||
+ static const unsigned char crl_caonly_idp[] = {
|
||||
+ 0x30, 0x82, 0x01, 0xc7, 0x30, 0x81, 0xb0, 0x02, 0x01, 0x01, 0x30,
|
||||
+ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
|
||||
+ 0x0b, 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
|
||||
+ 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x2d,
|
||||
+ 0x72, 0x6f, 0x6f, 0x74, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x34, 0x31,
|
||||
+ 0x36, 0x31, 0x31, 0x33, 0x38, 0x35, 0x35, 0x5a, 0x17, 0x0d, 0x33,
|
||||
+ 0x36, 0x30, 0x34, 0x31, 0x33, 0x31, 0x31, 0x33, 0x38, 0x35, 0x35,
|
||||
+ 0x5a, 0xa0, 0x67, 0x30, 0x65, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x52, 0x97, 0x58, 0x47,
|
||||
+ 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e, 0xea,
|
||||
+ 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x35, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x1c, 0x01, 0x01, 0xff, 0x04, 0x2b, 0x30, 0x29, 0xa0, 0x24, 0xa0,
|
||||
+ 0x22, 0x86, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63,
|
||||
+ 0x6c, 0x61, 0x69, 0x6d, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2f, 0x63,
|
||||
+ 0x72, 0x6c, 0x2d, 0x63, 0x61, 0x6f, 0x6e, 0x6c, 0x79, 0x2e, 0x70,
|
||||
+ 0x65, 0x6d, 0x82, 0x01, 0xff, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x14, 0x04, 0x04, 0x02, 0x02, 0x20, 0x01, 0x30, 0x0d, 0x06, 0x09,
|
||||
+ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
|
||||
+ 0x03, 0x82, 0x01, 0x01, 0x00, 0x9d, 0x6e, 0x0d, 0x93, 0x89, 0xab,
|
||||
+ 0x6e, 0x74, 0x52, 0x2c, 0xe6, 0x89, 0xcb, 0x72, 0x49, 0x90, 0x0d,
|
||||
+ 0x91, 0x80, 0xb5, 0xca, 0x7b, 0x95, 0x0d, 0xa8, 0x05, 0x31, 0x04,
|
||||
+ 0x50, 0xb8, 0xf3, 0xce, 0x9c, 0xbb, 0x05, 0x38, 0x0a, 0x64, 0x1a,
|
||||
+ 0x61, 0x68, 0xa7, 0xa8, 0xa0, 0x69, 0x2a, 0x79, 0x01, 0x42, 0x67,
|
||||
+ 0xf5, 0x72, 0xdf, 0x37, 0x5b, 0x42, 0x6d, 0x3c, 0x59, 0x95, 0x09,
|
||||
+ 0x34, 0xb3, 0xb6, 0x8b, 0x2b, 0xd8, 0xab, 0xb6, 0x8b, 0xff, 0x8e,
|
||||
+ 0xae, 0xd0, 0xc6, 0x9a, 0xbe, 0x7e, 0x29, 0xbc, 0x4d, 0xfb, 0xe1,
|
||||
+ 0xac, 0xd8, 0x23, 0x1a, 0xec, 0x0d, 0xa1, 0xa0, 0xf6, 0x52, 0x8e,
|
||||
+ 0x64, 0xc4, 0x11, 0x0f, 0x7c, 0x5b, 0x9f, 0x65, 0x4f, 0x5a, 0xd6,
|
||||
+ 0x64, 0xe0, 0x64, 0xf6, 0xac, 0x9d, 0xdc, 0x21, 0x3f, 0xa8, 0x5c,
|
||||
+ 0xd2, 0xf5, 0x87, 0xec, 0x49, 0x19, 0xff, 0x01, 0x9e, 0x8d, 0x83,
|
||||
+ 0x08, 0xd2, 0xdc, 0x83, 0xf6, 0x03, 0xc4, 0x6f, 0xf6, 0xa2, 0x13,
|
||||
+ 0x41, 0xfe, 0x66, 0xcd, 0xeb, 0xe8, 0x0f, 0x28, 0x7d, 0xd2, 0xcd,
|
||||
+ 0xfa, 0x7a, 0xd7, 0xae, 0x08, 0xa1, 0x31, 0x17, 0x60, 0x59, 0x39,
|
||||
+ 0x98, 0x85, 0xe1, 0xa4, 0xd2, 0x35, 0x70, 0xb7, 0xff, 0xf3, 0x2f,
|
||||
+ 0xee, 0x45, 0x9c, 0xbe, 0xcc, 0x18, 0x49, 0x94, 0xe9, 0xf6, 0xd0,
|
||||
+ 0x45, 0x54, 0x6f, 0xe4, 0xe8, 0x3a, 0x0d, 0x5b, 0x05, 0xe8, 0x02,
|
||||
+ 0x51, 0x5b, 0x63, 0xb5, 0xf2, 0x47, 0x86, 0x9b, 0xf3, 0x07, 0xc2,
|
||||
+ 0x49, 0x26, 0xa0, 0x77, 0x94, 0xe7, 0x4f, 0xbc, 0x5f, 0x9f, 0xf9,
|
||||
+ 0x06, 0x0e, 0xcb, 0x45, 0x9c, 0x02, 0x11, 0xfc, 0xcb, 0x12, 0x7f,
|
||||
+ 0xba, 0x7d, 0x93, 0x5b, 0x57, 0x6a, 0x15, 0x5e, 0xd2, 0xc1, 0x97,
|
||||
+ 0xb2, 0xbb, 0x00, 0x2c, 0xdd, 0x41, 0x97, 0x2a, 0xe4, 0x53, 0x40,
|
||||
+ 0xf8, 0xb5, 0x56, 0xf2, 0x9a, 0x04, 0xe6, 0x89
|
||||
+ };
|
||||
+
|
||||
+ WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
+
|
||||
+ ExpectNotNull(cm = wolfSSL_CertManagerNew());
|
||||
+
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerLoadCABuffer(cm, ca_cert_idp,
|
||||
+ sizeof(ca_cert_idp), WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerEnableCRL(cm, WOLFSSL_CRL_CHECKALL),
|
||||
+ WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ /* User-scope CRL has a critical IDP extension, must be rejected */
|
||||
+ ExpectIntNE(wolfSSL_CertManagerLoadCRLBuffer(cm, crl_user_idp,
|
||||
+ sizeof(crl_user_idp), WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ /* CA-only CRL also has a critical IDP extension, must be rejected */
|
||||
+ ExpectIntNE(wolfSSL_CertManagerLoadCRLBuffer(cm, crl_caonly_idp,
|
||||
+ sizeof(crl_caonly_idp), WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ wolfSSL_CertManagerFree(cm);
|
||||
+#endif
|
||||
+ return EXPECT_RESULT();
|
||||
+}
|
||||
+
|
||||
+int test_wolfSSL_CRL_unknown_critical_ext(void)
|
||||
+{
|
||||
+ EXPECT_DECLS;
|
||||
+#if !defined(NO_CERTS) && defined(HAVE_CRL) && !defined(NO_RSA)
|
||||
+
|
||||
+ static const unsigned char ca_cert[] = {
|
||||
+ 0x30, 0x82, 0x03, 0x1b, 0x30, 0x82, 0x02, 0x03, 0xa0, 0x03, 0x02,
|
||||
+ 0x01, 0x02, 0x02, 0x14, 0x1e, 0x25, 0xc1, 0x5d, 0x6f, 0x02, 0x21,
|
||||
+ 0xa0, 0xf0, 0x14, 0x15, 0x9c, 0x3b, 0x4d, 0x1d, 0x73, 0x16, 0x00,
|
||||
+ 0xe4, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
|
||||
+ 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30,
|
||||
+ 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61,
|
||||
+ 0x69, 0x6d, 0x2d, 0x72, 0x6f, 0x6f, 0x74, 0x30, 0x1e, 0x17, 0x0d,
|
||||
+ 0x32, 0x36, 0x30, 0x34, 0x31, 0x36, 0x31, 0x31, 0x33, 0x38, 0x35,
|
||||
+ 0x35, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x34, 0x31, 0x33, 0x31,
|
||||
+ 0x31, 0x33, 0x38, 0x35, 0x35, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
|
||||
+ 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61,
|
||||
+ 0x69, 0x6d, 0x2d, 0x72, 0x6f, 0x6f, 0x74, 0x30, 0x82, 0x01, 0x22,
|
||||
+ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
|
||||
+ 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
|
||||
+ 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xba, 0x49, 0x8c, 0xb5,
|
||||
+ 0x17, 0xc1, 0x01, 0x24, 0x6f, 0x56, 0x1a, 0xa9, 0x3b, 0x03, 0xe2,
|
||||
+ 0x9f, 0x24, 0xb1, 0x25, 0x98, 0xfb, 0x38, 0x82, 0x78, 0x54, 0xa7,
|
||||
+ 0x1f, 0x69, 0x87, 0xe4, 0x96, 0x1b, 0x81, 0x18, 0x10, 0xb0, 0xc0,
|
||||
+ 0x5b, 0x4b, 0xbf, 0xb8, 0x1d, 0xf4, 0xee, 0x75, 0x0f, 0xb5, 0x45,
|
||||
+ 0x72, 0x70, 0xce, 0x65, 0x84, 0x44, 0x3e, 0x30, 0x78, 0xc4, 0xf3,
|
||||
+ 0xec, 0xba, 0x96, 0x78, 0xa4, 0x65, 0xfc, 0x62, 0x8d, 0xf5, 0x29,
|
||||
+ 0xf9, 0x7c, 0x3d, 0x78, 0x6c, 0x1d, 0x4a, 0x4c, 0xc9, 0x15, 0x2d,
|
||||
+ 0x22, 0x10, 0xea, 0x93, 0x26, 0xb8, 0xa6, 0x17, 0xd3, 0x0e, 0xbc,
|
||||
+ 0x0c, 0xab, 0x83, 0x63, 0xf6, 0x1c, 0xcc, 0x83, 0x73, 0x29, 0x7e,
|
||||
+ 0x7f, 0x83, 0x7f, 0xbd, 0x63, 0xaa, 0x8d, 0xfa, 0x78, 0x85, 0xd2,
|
||||
+ 0x3e, 0x60, 0x95, 0x5a, 0x8d, 0xfa, 0x8f, 0xcd, 0x94, 0x3f, 0x13,
|
||||
+ 0x28, 0xd9, 0xd0, 0x87, 0x28, 0x17, 0x78, 0xe2, 0x61, 0x8d, 0x79,
|
||||
+ 0x97, 0x01, 0xa9, 0x7c, 0x84, 0xc0, 0x1c, 0xbe, 0x5f, 0x5d, 0xca,
|
||||
+ 0x28, 0x6b, 0x5e, 0xdd, 0x83, 0xa5, 0x55, 0x34, 0x11, 0xba, 0xfa,
|
||||
+ 0x8b, 0x92, 0xa3, 0xde, 0xb6, 0xf3, 0xba, 0xab, 0x7f, 0x1a, 0x67,
|
||||
+ 0xfd, 0x6f, 0x20, 0x85, 0x4c, 0x77, 0xa7, 0x8e, 0xbe, 0xb8, 0xf8,
|
||||
+ 0x8f, 0x70, 0xe3, 0x5a, 0xd3, 0x77, 0xc9, 0x9e, 0x10, 0x60, 0xb4,
|
||||
+ 0xdb, 0x0c, 0xc5, 0x05, 0xe1, 0x1f, 0xbd, 0xe6, 0x79, 0xee, 0x82,
|
||||
+ 0x3f, 0x51, 0x76, 0xe2, 0x7f, 0x5c, 0x11, 0x6d, 0xd3, 0x21, 0x69,
|
||||
+ 0xec, 0x05, 0x11, 0x8b, 0xc8, 0x39, 0xb3, 0x2c, 0xa6, 0x83, 0xb4,
|
||||
+ 0x6f, 0xac, 0x19, 0xd6, 0x6a, 0x65, 0x0d, 0x08, 0x94, 0x58, 0xde,
|
||||
+ 0x3d, 0xc9, 0x0c, 0x54, 0x03, 0x73, 0x0c, 0x8d, 0x24, 0x09, 0xf3,
|
||||
+ 0xb1, 0x5d, 0xd2, 0xe3, 0xeb, 0x56, 0xd6, 0x28, 0x66, 0x5b, 0x02,
|
||||
+ 0x03, 0x01, 0x00, 0x01, 0xa3, 0x63, 0x30, 0x61, 0x30, 0x0f, 0x06,
|
||||
+ 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03,
|
||||
+ 0x01, 0x01, 0xff, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01,
|
||||
+ 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x1d, 0x06,
|
||||
+ 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x52, 0x97, 0x58,
|
||||
+ 0x47, 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e,
|
||||
+ 0xea, 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x1f, 0x06, 0x03, 0x55,
|
||||
+ 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x52, 0x97, 0x58,
|
||||
+ 0x47, 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e,
|
||||
+ 0xea, 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x0d, 0x06, 0x09, 0x2a,
|
||||
+ 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03,
|
||||
+ 0x82, 0x01, 0x01, 0x00, 0x7d, 0x30, 0xd4, 0x6a, 0x01, 0x89, 0x3b,
|
||||
+ 0x62, 0xed, 0x16, 0x46, 0x59, 0x0f, 0xf2, 0x3b, 0xb5, 0xde, 0x89,
|
||||
+ 0x08, 0x17, 0x68, 0xcb, 0x46, 0xdc, 0x39, 0xa6, 0xcb, 0x56, 0xb0,
|
||||
+ 0x91, 0xeb, 0x03, 0xb2, 0x15, 0xc4, 0x3b, 0x4d, 0x63, 0x55, 0x22,
|
||||
+ 0x0a, 0x26, 0xe6, 0x64, 0x46, 0xe8, 0x0f, 0xa8, 0xf3, 0xde, 0xe1,
|
||||
+ 0x43, 0x54, 0xe6, 0xd7, 0x8a, 0xf4, 0x4f, 0xab, 0x56, 0x93, 0x12,
|
||||
+ 0x71, 0x4b, 0x25, 0x71, 0x0a, 0x31, 0x18, 0x79, 0xee, 0x45, 0xa4,
|
||||
+ 0xf5, 0x72, 0x67, 0xfa, 0x41, 0xd9, 0x87, 0x97, 0x09, 0xef, 0x55,
|
||||
+ 0xad, 0x6f, 0x47, 0x1d, 0x5a, 0xb2, 0xe9, 0xf7, 0x22, 0x05, 0x2d,
|
||||
+ 0x5a, 0x81, 0xa8, 0xe8, 0x53, 0xb0, 0x94, 0xf6, 0x63, 0xff, 0x3f,
|
||||
+ 0x51, 0x7a, 0x08, 0xac, 0x27, 0x9a, 0x57, 0x11, 0x22, 0xa4, 0x00,
|
||||
+ 0x84, 0x70, 0x86, 0x76, 0x39, 0x0f, 0x4f, 0x57, 0xcf, 0x8e, 0x94,
|
||||
+ 0xd2, 0x8e, 0x43, 0xc0, 0xd5, 0x34, 0x7d, 0xf5, 0xa1, 0x45, 0x1e,
|
||||
+ 0xb7, 0xc8, 0x7e, 0x7c, 0xfe, 0x5d, 0x4d, 0x53, 0x43, 0x25, 0x15,
|
||||
+ 0x9e, 0x08, 0x01, 0x56, 0xa4, 0xff, 0x79, 0x59, 0x25, 0xc9, 0x23,
|
||||
+ 0x98, 0xaf, 0x05, 0xaf, 0xc1, 0x0b, 0x29, 0xf1, 0xe2, 0xc4, 0x36,
|
||||
+ 0x31, 0x91, 0xfa, 0xf2, 0xbb, 0x12, 0xe8, 0x67, 0xf9, 0xc7, 0xa1,
|
||||
+ 0x5e, 0x8c, 0xed, 0x92, 0x12, 0xa3, 0x2b, 0xe1, 0xc2, 0xe1, 0xa0,
|
||||
+ 0xb0, 0x0e, 0x12, 0xa7, 0xd0, 0xa2, 0xae, 0xd6, 0xfa, 0x30, 0x21,
|
||||
+ 0x0f, 0x73, 0xfe, 0x24, 0x21, 0x5f, 0x03, 0x86, 0x69, 0xcd, 0xec,
|
||||
+ 0x76, 0x18, 0xe1, 0xfd, 0xb6, 0x64, 0x90, 0xa6, 0x06, 0x2e, 0x19,
|
||||
+ 0x40, 0x93, 0x50, 0x37, 0xe4, 0x90, 0xe3, 0x1f, 0x07, 0xae, 0xfb,
|
||||
+ 0x89, 0xc3, 0xf6, 0xc4, 0x90, 0xab, 0x40, 0x67, 0x4c, 0x43, 0x2c,
|
||||
+ 0xa2, 0xb0, 0x3e, 0x61, 0x16, 0x69, 0x8f
|
||||
+ };
|
||||
+
|
||||
+ /* CRL with critical obsolete extension OID 2.5.29.1, 422 bytes DER.
|
||||
+ * OID 2.5.29.1 is the old X.509v2 Authority Key Identifier, permanently
|
||||
+ * superseded by 2.5.29.35. No implementation will ever support it. */
|
||||
+ static const unsigned char crl_obsolete_critical[] = {
|
||||
+ 0x30, 0x82, 0x01, 0xa6, 0x30, 0x81, 0x8f, 0x02, 0x01, 0x01, 0x30,
|
||||
+ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
|
||||
+ 0x0b, 0x05, 0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
|
||||
+ 0x55, 0x04, 0x03, 0x0c, 0x0a, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x2d,
|
||||
+ 0x72, 0x6f, 0x6f, 0x74, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x34, 0x31,
|
||||
+ 0x36, 0x31, 0x35, 0x32, 0x31, 0x30, 0x37, 0x5a, 0x17, 0x0d, 0x33,
|
||||
+ 0x36, 0x30, 0x34, 0x31, 0x33, 0x31, 0x35, 0x32, 0x31, 0x30, 0x37,
|
||||
+ 0x5a, 0xa0, 0x46, 0x30, 0x44, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x52, 0x97, 0x58, 0x47,
|
||||
+ 0x98, 0xca, 0xf8, 0x99, 0xa0, 0x7e, 0x8e, 0x1c, 0x38, 0x2e, 0xea,
|
||||
+ 0xbb, 0xea, 0x9b, 0x74, 0x30, 0x30, 0x14, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x01, 0x01, 0x01, 0xff, 0x04, 0x0a, 0x0c, 0x08, 0x6f, 0x62, 0x73,
|
||||
+ 0x6f, 0x6c, 0x65, 0x74, 0x65, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d,
|
||||
+ 0x14, 0x04, 0x04, 0x02, 0x02, 0x20, 0x02, 0x30, 0x0d, 0x06, 0x09,
|
||||
+ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
|
||||
+ 0x03, 0x82, 0x01, 0x01, 0x00, 0x05, 0xf3, 0x8f, 0xdb, 0x7f, 0x75,
|
||||
+ 0x2c, 0x34, 0x4b, 0x7e, 0x70, 0x17, 0x5e, 0x34, 0xc6, 0xdb, 0xcb,
|
||||
+ 0x54, 0x33, 0x06, 0x58, 0x6d, 0xae, 0x9c, 0xc8, 0xe3, 0xaf, 0x82,
|
||||
+ 0xe5, 0xf6, 0x86, 0x42, 0xb3, 0x01, 0x72, 0x1a, 0xca, 0xf9, 0x10,
|
||||
+ 0x5d, 0x14, 0xe6, 0x84, 0x34, 0x56, 0x55, 0x74, 0xb5, 0x06, 0x64,
|
||||
+ 0x49, 0x1d, 0xb3, 0xb0, 0x13, 0xff, 0x1c, 0x05, 0x4f, 0x43, 0x29,
|
||||
+ 0xbc, 0xfe, 0xb5, 0x92, 0x54, 0xf6, 0x9b, 0x81, 0x07, 0x5e, 0x2e,
|
||||
+ 0x75, 0xd8, 0xfd, 0x9b, 0x5b, 0xc9, 0xd3, 0xc2, 0x15, 0xa7, 0x6e,
|
||||
+ 0x2f, 0x4b, 0x3a, 0x27, 0x57, 0xef, 0x40, 0x61, 0x8c, 0x11, 0x9d,
|
||||
+ 0x0a, 0xb1, 0x2b, 0x0e, 0xed, 0x5d, 0xf2, 0xf5, 0x1a, 0xce, 0xdc,
|
||||
+ 0xd7, 0x75, 0xc6, 0x25, 0x22, 0xe4, 0x70, 0xad, 0x93, 0xff, 0x36,
|
||||
+ 0xa1, 0xa2, 0xa0, 0xd9, 0x82, 0x23, 0x6e, 0xc8, 0x3a, 0x80, 0x82,
|
||||
+ 0xbf, 0x12, 0xac, 0xa1, 0xf9, 0x03, 0x9c, 0xb9, 0x20, 0x91, 0x33,
|
||||
+ 0x80, 0x7b, 0xb7, 0x6e, 0xa5, 0x32, 0x98, 0xd6, 0x2c, 0x5d, 0x9d,
|
||||
+ 0x3b, 0x64, 0x3b, 0xb4, 0xea, 0x03, 0x2d, 0x65, 0xcf, 0x7f, 0x0f,
|
||||
+ 0x97, 0xef, 0x5b, 0x17, 0x8c, 0xcf, 0x98, 0x69, 0xba, 0x2d, 0x62,
|
||||
+ 0xe9, 0x40, 0xe2, 0x3d, 0xbd, 0xd2, 0x0f, 0x4a, 0xf8, 0xb0, 0xa7,
|
||||
+ 0xdb, 0x80, 0xa3, 0x47, 0x56, 0xe5, 0xe6, 0x6f, 0x93, 0x5c, 0x6f,
|
||||
+ 0xdd, 0x62, 0x43, 0x28, 0x5c, 0xe5, 0x8f, 0x0e, 0x11, 0xa6, 0x1f,
|
||||
+ 0x61, 0xaf, 0x39, 0x15, 0x40, 0xf4, 0x6e, 0x79, 0x40, 0xf6, 0x28,
|
||||
+ 0xf3, 0xd4, 0x30, 0x3b, 0x25, 0xb6, 0xf0, 0x4a, 0x51, 0xc3, 0x18,
|
||||
+ 0xff, 0xad, 0x4d, 0x6e, 0x10, 0x73, 0x68, 0xfa, 0x54, 0x9e, 0xdc,
|
||||
+ 0x34, 0x70, 0xe4, 0x5d, 0x9e, 0x7c, 0xfa, 0x59, 0x97, 0xde, 0x35,
|
||||
+ 0x17, 0xbb, 0xaf, 0xa0, 0x28, 0x78, 0x13, 0xbf
|
||||
+ };
|
||||
+
|
||||
+ WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
+
|
||||
+ ExpectNotNull(cm = wolfSSL_CertManagerNew());
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerLoadCABuffer(cm, ca_cert,
|
||||
+ sizeof(ca_cert), WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerEnableCRL(cm, WOLFSSL_CRL_CHECKALL),
|
||||
+ WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ ExpectIntNE(wolfSSL_CertManagerLoadCRLBuffer(cm, crl_obsolete_critical,
|
||||
+ sizeof(crl_obsolete_critical), WOLFSSL_FILETYPE_ASN1),
|
||||
+ WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ wolfSSL_CertManagerFree(cm);
|
||||
+#endif
|
||||
+ return EXPECT_RESULT();
|
||||
+}
|
||||
+
|
||||
int test_wolfSSL_CertManagerCheckOCSPResponse(void)
|
||||
{
|
||||
EXPECT_DECLS;
|
||||
diff --git a/tests/api/test_certman.h b/tests/api/test_certman.h
|
||||
index a0b5d9548..3b6afd0fc 100644
|
||||
--- a/tests/api/test_certman.h
|
||||
+++ b/tests/api/test_certman.h
|
||||
@@ -39,6 +39,8 @@ int test_wolfSSL_CertManagerCRL(void);
|
||||
int test_wolfSSL_CRL_reason_extensions_cleanup(void);
|
||||
int test_wolfSSL_CRL_static_revoked_list(void);
|
||||
int test_wolfSSL_CRL_duplicate_extensions(void);
|
||||
+int test_wolfSSL_CRL_critical_idp(void);
|
||||
+int test_wolfSSL_CRL_unknown_critical_ext(void);
|
||||
int test_wolfSSL_CertManagerCheckOCSPResponse(void);
|
||||
int test_various_pathlen_chains(void);
|
||||
int test_wolfSSL_CertManagerRejectMD5Cert(void);
|
||||
@@ -59,6 +61,8 @@ int test_wolfSSL_CertManagerRejectMD5Cert(void);
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_reason_extensions_cleanup), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_static_revoked_list), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_duplicate_extensions), \
|
||||
+ TEST_DECL_GROUP("certman", test_wolfSSL_CRL_critical_idp), \
|
||||
+ TEST_DECL_GROUP("certman", test_wolfSSL_CRL_unknown_critical_ext), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CertManagerCheckOCSPResponse), \
|
||||
TEST_DECL_GROUP("certman", test_various_pathlen_chains), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CertManagerRejectMD5Cert)
|
||||
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
|
||||
index 8d4f40a70..f8db5c457 100644
|
||||
--- a/wolfcrypt/src/asn.c
|
||||
+++ b/wolfcrypt/src/asn.c
|
||||
@@ -34497,14 +34497,17 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
|
||||
mp_free(m);
|
||||
FREE_MP_INT_SIZE(m, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
}
|
||||
+ else if (critical) {
|
||||
+ WOLFSSL_MSG("Unknown critical CRL extension");
|
||||
+ ret = ASN_CRIT_EXT_E;
|
||||
+ }
|
||||
}
|
||||
- /* TODO: check criticality */
|
||||
/* Move index on to next extension. */
|
||||
idx += (word32)length;
|
||||
}
|
||||
}
|
||||
|
||||
- if (ret < 0) {
|
||||
+ if (ret < 0 && ret != WC_NO_ERR_TRACE(ASN_CRIT_EXT_E)) {
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
|
||||
diff --git a/wolfcrypt/src/asn_orig.c b/wolfcrypt/src/asn_orig.c
|
||||
index 9ecb821d3..d6568aa5d 100644
|
||||
--- a/wolfcrypt/src/asn_orig.c
|
||||
+++ b/wolfcrypt/src/asn_orig.c
|
||||
@@ -9327,6 +9327,7 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
|
||||
while (idx < (word32)ext_bound) {
|
||||
word32 localIdx;
|
||||
int ret;
|
||||
+ int critical = 0;
|
||||
|
||||
if (GetSequence(buf, &idx, &length, sz) < 0) {
|
||||
WOLFSSL_MSG("\tfail: should be a SEQUENCE");
|
||||
@@ -9346,11 +9347,13 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
|
||||
}
|
||||
|
||||
localIdx = idx;
|
||||
- if (GetASNTag(buf, &localIdx, &tag, sz) == 0 && tag == ASN_BOOLEAN) {
|
||||
+ if (GetASNTag(buf, &localIdx, &tag, sz) == 0 &&
|
||||
+ tag == ASN_BOOLEAN) {
|
||||
WOLFSSL_MSG("\tfound optional critical flag, moving past");
|
||||
ret = GetBoolean(buf, &idx, sz);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
+ critical = ret;
|
||||
}
|
||||
|
||||
ret = GetOctetString(buf, &idx, &length, sz);
|
||||
@@ -9428,6 +9431,10 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
|
||||
}
|
||||
}
|
||||
}
|
||||
+ else if (critical) {
|
||||
+ WOLFSSL_MSG("Unknown critical CRL extension");
|
||||
+ return ASN_CRIT_EXT_E;
|
||||
+ }
|
||||
|
||||
idx += length;
|
||||
}
|
||||
@@ -0,0 +1,404 @@
|
||||
From 501762b4913f744f42605f8cdb3e3ac6dd37916e Mon Sep 17 00:00:00 2001
|
||||
From: Reda Chouk <reda@wolfssl.com>
|
||||
Date: Tue, 21 Apr 2026 16:53:59 +0200
|
||||
Subject: [PATCH] reject crls with unrecognized critical entry extensions per
|
||||
rfc 5280 section 5.3
|
||||
|
||||
(cherry picked from commit 6111c60ea69fa02e1a74cf432c20bd6b789eae67)
|
||||
|
||||
CVE: CVE-2026-6450
|
||||
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/6111c60ea69fa02e1a74cf432c20bd6b789eae67]
|
||||
|
||||
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
||||
---
|
||||
certs/crl/extra-crls/claim-root.pem | 19 +++
|
||||
certs/crl/extra-crls/crl_critical_entry.pem | 11 ++
|
||||
certs/crl/include.am | 4 +-
|
||||
tests/api/test_certman.c | 25 ++++
|
||||
tests/api/test_certman.h | 2 +
|
||||
wolfcrypt/src/asn.c | 133 +++++++++++++-------
|
||||
wolfcrypt/src/asn_orig.c | 28 ++++-
|
||||
7 files changed, 171 insertions(+), 51 deletions(-)
|
||||
create mode 100644 certs/crl/extra-crls/claim-root.pem
|
||||
create mode 100644 certs/crl/extra-crls/crl_critical_entry.pem
|
||||
|
||||
diff --git a/certs/crl/extra-crls/claim-root.pem b/certs/crl/extra-crls/claim-root.pem
|
||||
new file mode 100644
|
||||
index 000000000..a212501aa
|
||||
--- /dev/null
|
||||
+++ b/certs/crl/extra-crls/claim-root.pem
|
||||
@@ -0,0 +1,19 @@
|
||||
+-----BEGIN CERTIFICATE-----
|
||||
+MIIDGzCCAgOgAwIBAgIUHiXBXW8CIaDwFBWcO00dcxYA5FEwDQYJKoZIhvcNAQEL
|
||||
+BQAwFTETMBEGA1UEAwwKY2xhaW0tcm9vdDAeFw0yNjA0MTYxMTM4NTVaFw0zNjA0
|
||||
+MTMxMTM4NTVaMBUxEzARBgNVBAMMCmNsYWltLXJvb3QwggEiMA0GCSqGSIb3DQEB
|
||||
+AQUAA4IBDwAwggEKAoIBAQC6SYy1F8EBJG9WGqk7A+KfJLElmPs4gnhUpx9ph+SW
|
||||
+G4EYELDAW0u/uB307nUPtUVycM5lhEQ+MHjE8+y6lnikZfxijfUp+Xw9eGwdSkzJ
|
||||
+FS0iEOqTJrimF9MOvAyrg2P2HMyDcyl+f4N/vWOqjfp4hdI+YJVajfqPzZQ/EyjZ
|
||||
+0IcoF3jiYY15lwGpfITAHL5fXcooa17dg6VVNBG6+ouSo96287qrfxpn/W8ghUx3
|
||||
+p46+uPiPcONa03fJnhBgtNsMxQXhH73mee6CP1F24n9cEW3TIWnsBRGLyDmzLKaD
|
||||
+tG+sGdZqZQ0IlFjePckMVANzDI0kCfOxXdLj61bWKGZbAgMBAAGjYzBhMA8GA1Ud
|
||||
+EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRSl1hHmMr4maB+
|
||||
+jhw4Luq76pt0MDAfBgNVHSMEGDAWgBRSl1hHmMr4maB+jhw4Luq76pt0MDANBgkq
|
||||
+hkiG9w0BAQsFAAOCAQEAfTDUagGJO2LtFkZZD/I7td6JCBdoy0bcOabLVrCR6wOy
|
||||
+FcQ7TWNVIgom5mRG6A+o897hQ1Tm14r0T6tWkxJxSyVxCjEYee5FpPVyZ/pB2YeX
|
||||
+Ce9VrW9HHVqy6fciBS1agajoU7CU9mP/P1F6CKwnmlcRIqQAhHCGdjkPT1fPjpTS
|
||||
+jkPA1TR99aFFHrfIfnz+XU1TQyUVnggBVqT/eVklySOYrwWvwQsp8eLENjGR+vK7
|
||||
+Euhn+cehXoztkhKjK+HC4aCwDhKn0KKu1vowIQ9z/iQhXwOGac3sdhjh/bZkkKYG
|
||||
+LhlAk1A35JDjHweu+4nD9sSQq0BnTEMsorA+YRZpjw==
|
||||
+-----END CERTIFICATE-----
|
||||
diff --git a/certs/crl/extra-crls/crl_critical_entry.pem b/certs/crl/extra-crls/crl_critical_entry.pem
|
||||
new file mode 100644
|
||||
index 000000000..11d9d31ab
|
||||
--- /dev/null
|
||||
+++ b/certs/crl/extra-crls/crl_critical_entry.pem
|
||||
@@ -0,0 +1,11 @@
|
||||
+-----BEGIN X509 CRL-----
|
||||
+MIIBjDB2AgEBMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNVBAMMCmNsYWltLXJvb3QX
|
||||
+DTI2MDQyMTEyMzM0OFoXDTM2MDQxODEyMzM0OFowLTArAgIQABcNMjYwNDIxMTIz
|
||||
+MzQ4WjAWMBQGA1UdAQEB/wQKDAhvYnNvbGV0ZTANBgkqhkiG9w0BAQsFAAOCAQEA
|
||||
+PPG5bodrM2jK+6KcqRh9vEkWhLyxCkJij1om7R8BMO5bpvxZFOSqdN9GvIqYANYT
|
||||
+ZNQzZZOer9DSXc1I9Cha179dyGnBsX33geSdhF99JxA/kZUVynfOn56El7iywkPQ
|
||||
+yEpuY7uQQRfcp7D7tGz8S7mNhOMAeaN+jR2Psmn8q1Yc3W01vwYZos3qjHG1xDZ6
|
||||
+97QVFX6tbnbeu/hBsF87oiAyCbXnhRQOvrVsKqjrZXGkfRKfJ1deHc1vWgio7fhr
|
||||
+A1/Hb4sdfTWZUwtduTRI9Vyaw1IL41d+0ExdzTshIHbddB/dyByrRqlIzJdeiigt
|
||||
+d1Gcf1EYSoWiV8Xaj9SFng==
|
||||
+-----END X509 CRL-----
|
||||
diff --git a/certs/crl/include.am b/certs/crl/include.am
|
||||
index 46d0ed3e7..a0c526d91 100644
|
||||
--- a/certs/crl/include.am
|
||||
+++ b/certs/crl/include.am
|
||||
@@ -27,7 +27,9 @@ EXTRA_DIST += \
|
||||
certs/crl/extra-crls/large_crlnum.pem \
|
||||
certs/crl/extra-crls/large_crlnum2.pem \
|
||||
certs/crl/extra-crls/crlnum_57oct.pem \
|
||||
- certs/crl/extra-crls/crlnum_64oct.pem
|
||||
+ certs/crl/extra-crls/crlnum_64oct.pem \
|
||||
+ certs/crl/extra-crls/claim-root.pem \
|
||||
+ certs/crl/extra-crls/crl_critical_entry.pem
|
||||
|
||||
# Intermediate cert CRL's
|
||||
EXTRA_DIST += \
|
||||
diff --git a/tests/api/test_certman.c b/tests/api/test_certman.c
|
||||
index 7405f4bff..d9000c7cf 100644
|
||||
--- a/tests/api/test_certman.c
|
||||
+++ b/tests/api/test_certman.c
|
||||
@@ -2306,6 +2306,31 @@ int test_wolfSSL_CRL_unknown_critical_ext(void)
|
||||
return EXPECT_RESULT();
|
||||
}
|
||||
|
||||
+int test_wolfSSL_CRL_unknown_critical_entry_ext(void)
|
||||
+{
|
||||
+ EXPECT_DECLS;
|
||||
+#if !defined(NO_CERTS) && defined(HAVE_CRL) && !defined(NO_RSA) && \
|
||||
+ !defined(NO_FILESYSTEM)
|
||||
+ WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
+
|
||||
+ ExpectNotNull(cm = wolfSSL_CertManagerNew());
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerLoadCA(cm,
|
||||
+ "./certs/crl/extra-crls/claim-root.pem", NULL), WOLFSSL_SUCCESS);
|
||||
+ ExpectIntEQ(wolfSSL_CertManagerEnableCRL(cm, WOLFSSL_CRL_CHECKALL),
|
||||
+ WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ /* CRL with a revoked entry that carries a critical unknown extension
|
||||
+ * (OID 2.5.29.1, old X.509v2 AKI, permanently superseded).
|
||||
+ * Per RFC 5280 Section 5.3, the CRL must not be used. */
|
||||
+ ExpectIntNE(wolfSSL_CertManagerLoadCRLFile(cm,
|
||||
+ "./certs/crl/extra-crls/crl_critical_entry.pem", WOLFSSL_FILETYPE_PEM),
|
||||
+ WOLFSSL_SUCCESS);
|
||||
+
|
||||
+ wolfSSL_CertManagerFree(cm);
|
||||
+#endif
|
||||
+ return EXPECT_RESULT();
|
||||
+}
|
||||
+
|
||||
int test_wolfSSL_CertManagerCheckOCSPResponse(void)
|
||||
{
|
||||
EXPECT_DECLS;
|
||||
diff --git a/tests/api/test_certman.h b/tests/api/test_certman.h
|
||||
index 3b6afd0fc..0962b0228 100644
|
||||
--- a/tests/api/test_certman.h
|
||||
+++ b/tests/api/test_certman.h
|
||||
@@ -41,6 +41,7 @@ int test_wolfSSL_CRL_static_revoked_list(void);
|
||||
int test_wolfSSL_CRL_duplicate_extensions(void);
|
||||
int test_wolfSSL_CRL_critical_idp(void);
|
||||
int test_wolfSSL_CRL_unknown_critical_ext(void);
|
||||
+int test_wolfSSL_CRL_unknown_critical_entry_ext(void);
|
||||
int test_wolfSSL_CertManagerCheckOCSPResponse(void);
|
||||
int test_various_pathlen_chains(void);
|
||||
int test_wolfSSL_CertManagerRejectMD5Cert(void);
|
||||
@@ -63,6 +64,7 @@ int test_wolfSSL_CertManagerRejectMD5Cert(void);
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_duplicate_extensions), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_critical_idp), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_unknown_critical_ext), \
|
||||
+ TEST_DECL_GROUP("certman", test_wolfSSL_CRL_unknown_critical_entry_ext), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CertManagerCheckOCSPResponse), \
|
||||
TEST_DECL_GROUP("certman", test_various_pathlen_chains), \
|
||||
TEST_DECL_GROUP("certman", test_wolfSSL_CertManagerRejectMD5Cert)
|
||||
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
|
||||
index f8db5c457..1dc27cfd0 100644
|
||||
--- a/wolfcrypt/src/asn.c
|
||||
+++ b/wolfcrypt/src/asn.c
|
||||
@@ -34039,16 +34039,22 @@ enum {
|
||||
/* CRL Reason Code OID: 2.5.29.21 */
|
||||
static const byte crlReasonOid[] = { 0x55, 0x1d, 0x15 };
|
||||
|
||||
-/* Parse CRL entry extensions to extract the reason code.
|
||||
- * Sets *reasonCode if found, otherwise leaves it unchanged. */
|
||||
-static void ParseCRL_ReasonCode(const byte* buff, word32 idx, word32 maxIdx,
|
||||
- int* reasonCode)
|
||||
+/* Parse CRL entry extensions.
|
||||
+ * Extracts the reason code into *reasonCode if the CRL Reason extension
|
||||
+ * is present. Per RFC 5280 Section 5.3, returns ASN_CRIT_EXT_E if any
|
||||
+ * unknown extension is marked critical. Returns 0 on success. */
|
||||
+static int ParseCRL_EntryExtensions(const byte* buff, word32 idx, word32 maxIdx,
|
||||
+ int* reasonCode)
|
||||
{
|
||||
while (idx < maxIdx) {
|
||||
int len;
|
||||
+ int oidLen;
|
||||
word32 end;
|
||||
word32 localIdx;
|
||||
+ word32 oidContent;
|
||||
byte tag;
|
||||
+ int critical = 0;
|
||||
+ int isReasonOid = 0;
|
||||
|
||||
/* Each extension is a SEQUENCE */
|
||||
if (GetSequence(buff, &idx, &len, maxIdx) < 0) {
|
||||
@@ -34056,23 +34062,39 @@ static void ParseCRL_ReasonCode(const byte* buff, word32 idx, word32 maxIdx,
|
||||
}
|
||||
end = idx + (word32)len;
|
||||
|
||||
- /* Check for CRL Reason OID: 2.5.29.21 */
|
||||
- if (end - idx >= (word32)(2 + sizeof(crlReasonOid)) &&
|
||||
- buff[idx] == ASN_OBJECT_ID &&
|
||||
- buff[idx + 1] == sizeof(crlReasonOid) &&
|
||||
- XMEMCMP(buff + idx + 2, crlReasonOid,
|
||||
+ /* Parse OID: tag, length (short or long form), content */
|
||||
+ if (GetASNTag(buff, &idx, &tag, end) < 0 ||
|
||||
+ tag != ASN_OBJECT_ID) {
|
||||
+ break;
|
||||
+ }
|
||||
+ if (GetLength(buff, &idx, &oidLen, end) < 0) {
|
||||
+ break;
|
||||
+ }
|
||||
+ oidContent = idx;
|
||||
+ if (idx + (word32)oidLen > end) {
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ /* Check if it's the CRL Reason OID: 2.5.29.21 */
|
||||
+ if ((word32)oidLen == sizeof(crlReasonOid) &&
|
||||
+ XMEMCMP(buff + oidContent, crlReasonOid,
|
||||
sizeof(crlReasonOid)) == 0) {
|
||||
- /* Skip past the OID */
|
||||
- idx += 2 + (word32)sizeof(crlReasonOid);
|
||||
- /* Skip optional critical BOOLEAN */
|
||||
- localIdx = idx;
|
||||
- if (GetASNTag(buff, &localIdx, &tag, end) == 0 &&
|
||||
- tag == ASN_BOOLEAN) {
|
||||
- /* Consume full BOOLEAN TLV (tag + length + value). */
|
||||
- if (GetBoolean(buff, &idx, end) < 0) {
|
||||
- break;
|
||||
- }
|
||||
+ isReasonOid = 1;
|
||||
+ }
|
||||
+ idx = oidContent + (word32)oidLen;
|
||||
+
|
||||
+ /* Parse optional critical BOOLEAN */
|
||||
+ localIdx = idx;
|
||||
+ if (GetASNTag(buff, &localIdx, &tag, end) == 0 &&
|
||||
+ tag == ASN_BOOLEAN) {
|
||||
+ int ret = GetBoolean(buff, &idx, end);
|
||||
+ if (ret < 0) {
|
||||
+ break;
|
||||
}
|
||||
+ critical = ret;
|
||||
+ }
|
||||
+
|
||||
+ if (isReasonOid) {
|
||||
/* Get OCTET STRING wrapping the ENUMERATED */
|
||||
if (GetOctetString(buff, &idx, &len, end) >= 0) {
|
||||
/* Parse ENUMERATED reason value */
|
||||
@@ -34088,8 +34110,15 @@ static void ParseCRL_ReasonCode(const byte* buff, word32 idx, word32 maxIdx,
|
||||
}
|
||||
}
|
||||
}
|
||||
+ else if (critical) {
|
||||
+ /* RFC 5280 Section 5.3: reject CRL with unknown critical
|
||||
+ * entry extension. */
|
||||
+ WOLFSSL_MSG("Unknown critical CRL entry extension");
|
||||
+ return ASN_CRIT_EXT_E;
|
||||
+ }
|
||||
idx = end;
|
||||
}
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
#ifdef HAVE_CRL
|
||||
@@ -34102,8 +34131,7 @@ WOLFSSL_TEST_VIS int wc_ParseCRLReasonFromExtensions(const byte* ext,
|
||||
return BAD_FUNC_ARG;
|
||||
}
|
||||
|
||||
- ParseCRL_ReasonCode(ext, 0, extSz, reasonCode);
|
||||
- return 0;
|
||||
+ return ParseCRL_EntryExtensions(ext, 0, extSz, reasonCode);
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -34166,49 +34194,58 @@ static int GetRevoked(RevokedCert* rcert, const byte* buff, word32* idx,
|
||||
/* Parse CRL entry extensions (v2 only) */
|
||||
if (dataASN[REVOKEDASN_IDX_TIME_EXT].length > 0) {
|
||||
word32 extOff = dataASN[REVOKEDASN_IDX_TIME_EXT].offset;
|
||||
- word32 extLen = dataASN[REVOKEDASN_IDX_TIME_EXT].length;
|
||||
- word32 extEnd = extOff + extLen;
|
||||
- word32 extIdx2 = extOff;
|
||||
+ word32 extTagEnd = extOff +
|
||||
+ dataASN[REVOKEDASN_IDX_TIME_EXT].length + 6;
|
||||
+ int extLen;
|
||||
+
|
||||
+ /* .offset points at the outer SEQUENCE tag. Re-parse the
|
||||
+ * SEQUENCE header to locate the content start (list of
|
||||
+ * Extension SEQUENCEs), which handles long-form length.
|
||||
+ * extTagEnd adds 6 to cover the worst-case tag+long-form-length
|
||||
+ * header for the outer SEQUENCE. */
|
||||
+ if (GetSequence(buff, &extOff, &extLen, extTagEnd) < 0) {
|
||||
+ ret = ASN_PARSE_E;
|
||||
+ }
|
||||
+ else {
|
||||
+ word32 extEnd = extOff + (word32)extLen;
|
||||
|
||||
#if defined(OPENSSL_EXTRA)
|
||||
- /* Store raw DER of extensions for OpenSSL compat API.
|
||||
- * Include the outer SEQUENCE tag+length. */
|
||||
- {
|
||||
- /* Back up to include the SEQUENCE header. We know the
|
||||
- * content starts at extOff, so the header is just before.
|
||||
- * Use the raw buffer start from before GetASN_Items. */
|
||||
- word32 seqHdrSz = 0;
|
||||
- /* The outer SEQUENCE header is at most 4 bytes before
|
||||
- * content. Rather than guess, store just the content. */
|
||||
- rc->extensions = (byte*)XMALLOC(extLen, dcrl->heap,
|
||||
+ /* Store raw DER of extension contents for OpenSSL compat. */
|
||||
+ rc->extensions = (byte*)XMALLOC((size_t)extLen, dcrl->heap,
|
||||
DYNAMIC_TYPE_REVOKED);
|
||||
if (rc->extensions != NULL) {
|
||||
- XMEMCPY(rc->extensions, buff + extOff, extLen);
|
||||
- rc->extensionsSz = extLen;
|
||||
+ XMEMCPY(rc->extensions, buff + extOff, (size_t)extLen);
|
||||
+ rc->extensionsSz = (word32)extLen;
|
||||
}
|
||||
- (void)seqHdrSz;
|
||||
- }
|
||||
#endif
|
||||
|
||||
- ParseCRL_ReasonCode(buff, extIdx2, extEnd, &rc->reasonCode);
|
||||
+ ret = ParseCRL_EntryExtensions(buff, extOff, extEnd,
|
||||
+ &rc->reasonCode);
|
||||
+ }
|
||||
}
|
||||
|
||||
- /* Add revoked certificate to chain. */
|
||||
+ if (ret == 0) {
|
||||
+ /* Add revoked certificate to chain. */
|
||||
#ifndef CRL_STATIC_REVOKED_LIST
|
||||
- rc->next = dcrl->certs;
|
||||
- dcrl->certs = rc;
|
||||
+ rc->next = dcrl->certs;
|
||||
+ dcrl->certs = rc;
|
||||
#endif
|
||||
- dcrl->totalCerts++;
|
||||
+ dcrl->totalCerts++;
|
||||
+ }
|
||||
}
|
||||
|
||||
FREE_ASNGETDATA(dataASN, dcrl->heap);
|
||||
-#ifndef CRL_STATIC_REVOKED_LIST
|
||||
if ((ret != 0) && (rc != NULL)) {
|
||||
#if defined(OPENSSL_EXTRA)
|
||||
XFREE(rc->extensions, dcrl->heap, DYNAMIC_TYPE_REVOKED);
|
||||
+ rc->extensions = NULL;
|
||||
+ rc->extensionsSz = 0;
|
||||
#endif
|
||||
+#ifndef CRL_STATIC_REVOKED_LIST
|
||||
XFREE(rc, dcrl->heap, DYNAMIC_TYPE_CRL);
|
||||
+#endif
|
||||
}
|
||||
+#ifndef CRL_STATIC_REVOKED_LIST
|
||||
(void)rcert;
|
||||
#endif
|
||||
return ret;
|
||||
@@ -34232,7 +34269,13 @@ static int ParseCRL_RevokedCerts(RevokedCert* rcert, DecodedCRL* dcrl,
|
||||
/* Parse each revoked certificate. */
|
||||
while ((ret == 0) && (idx < maxIdx)) {
|
||||
/* Parse a revoked certificate. */
|
||||
- if (GetRevoked(rcert, buff, &idx, dcrl, maxIdx) < 0) {
|
||||
+ int r = GetRevoked(rcert, buff, &idx, dcrl, maxIdx);
|
||||
+ if (r == WC_NO_ERR_TRACE(ASN_CRIT_EXT_E)) {
|
||||
+ /* Preserve the specific error so callers can distinguish a
|
||||
+ * rejected critical extension from a generic parse failure. */
|
||||
+ ret = r;
|
||||
+ }
|
||||
+ else if (r < 0) {
|
||||
ret = ASN_PARSE_E;
|
||||
}
|
||||
}
|
||||
diff --git a/wolfcrypt/src/asn_orig.c b/wolfcrypt/src/asn_orig.c
|
||||
index d6568aa5d..bb58eb6d4 100644
|
||||
--- a/wolfcrypt/src/asn_orig.c
|
||||
+++ b/wolfcrypt/src/asn_orig.c
|
||||
@@ -9061,18 +9061,17 @@ static int GetRevoked(RevokedCert* rcert, const byte* buff, word32* idx,
|
||||
XFREE(rc, dcrl->heap, DYNAMIC_TYPE_REVOKED);
|
||||
return ret;
|
||||
}
|
||||
- /* add to list */
|
||||
- rc->next = dcrl->certs;
|
||||
- dcrl->certs = rc;
|
||||
|
||||
(void)rcert;
|
||||
#endif /* CRL_STATIC_REVOKED_LIST */
|
||||
- dcrl->totalCerts++;
|
||||
/* get date */
|
||||
#ifndef NO_ASN_TIME
|
||||
ret = GetBasicDate(buff, idx, rc->revDate, &rc->revDateFormat, maxIdx);
|
||||
if (ret < 0) {
|
||||
WOLFSSL_MSG("Expecting Date");
|
||||
+#ifndef CRL_STATIC_REVOKED_LIST
|
||||
+ XFREE(rc, dcrl->heap, DYNAMIC_TYPE_REVOKED);
|
||||
+#endif
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
@@ -9106,11 +9105,30 @@ static int GetRevoked(RevokedCert* rcert, const byte* buff, word32* idx,
|
||||
}
|
||||
#endif
|
||||
|
||||
- ParseCRL_ReasonCode(buff, seqIdx, extEnd, &rc->reasonCode);
|
||||
+ ret = ParseCRL_EntryExtensions(buff, seqIdx, extEnd,
|
||||
+ &rc->reasonCode);
|
||||
+ if (ret != 0) {
|
||||
+#if defined(OPENSSL_EXTRA)
|
||||
+ XFREE(rc->extensions, dcrl->heap, DYNAMIC_TYPE_REVOKED);
|
||||
+ rc->extensions = NULL;
|
||||
+ rc->extensionsSz = 0;
|
||||
+#endif
|
||||
+#ifndef CRL_STATIC_REVOKED_LIST
|
||||
+ XFREE(rc, dcrl->heap, DYNAMIC_TYPE_REVOKED);
|
||||
+#endif
|
||||
+ return ret;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+#ifndef CRL_STATIC_REVOKED_LIST
|
||||
+ /* add to list only after all parsing succeeded */
|
||||
+ rc->next = dcrl->certs;
|
||||
+ dcrl->certs = rc;
|
||||
+#endif
|
||||
+ dcrl->totalCerts++;
|
||||
+
|
||||
*idx = end;
|
||||
|
||||
return 0;
|
||||
@@ -32,6 +32,8 @@ SRC_URI = " \
|
||||
file://CVE-2026-6325.patch \
|
||||
file://CVE-2026-6412-1.patch \
|
||||
file://CVE-2026-6412-2.patch \
|
||||
file://CVE-2026-6450-1.patch \
|
||||
file://CVE-2026-6450-2.patch \
|
||||
"
|
||||
|
||||
SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"
|
||||
|
||||
Reference in New Issue
Block a user