set and enforce minimum sizes

for a number of dictinary attributes

diff --git a/share/dictionary/der/dictionary.crl b/share/dictionary/der/dictionary.crl
index 68bf4c024b2b8f09b58ce23f8366b557aae69a7f..55ca89579703f0fa0e4c1d76ceb5c4ede730e928 100644 (file)
--- a/share/dictionary/der/dictionary.crl
+++ b/share/dictionary/der/dictionary.crl
@@ -3,7 +3,7 @@
 # This work is licensed under CC-BY version 4.0 https://creativecommons.org/licenses/by/4.0
 # Version $Id$
 
-DEFINE distributionPoint                               sequence
+DEFINE distributionPoint                               sequence size=1..
 BEGIN   distributionPoint
 DEFINE distributionPointName                           sequence  option=0
 BEGIN     distributionPointName

diff --git a/share/dictionary/der/dictionary.extensions b/share/dictionary/der/dictionary.extensions
index f8e6b4c04e4c2c85eb562dd671ead18faabd1e11..d59b54b313123ceb303f3577f332cf40eca4f0a9 100644 (file)
--- a/share/dictionary/der/dictionary.extensions
+++ b/share/dictionary/der/dictionary.extensions
@@ -72,7 +72,7 @@ MEMBER                decipherOnly                            bit[1]
 MEMBER         unused_bits                             bit[7]
 END 2.5.29.15
 
-ATTRIBUTE      subjectAltName                          2.5.29.17       group ref=GeneralName,der_type=sequence,sequence_of=choice,is_oid_leaf
+ATTRIBUTE      subjectAltName                          2.5.29.17       group ref=GeneralName,der_type=sequence,sequence_of=choice,is_oid_leaf,size=1..
 
 ATTRIBUTE      basicConstraints                        2.5.29.19       sequence is_oid_leaf
 BEGIN 2.5.29.19
@@ -92,13 +92,13 @@ BEGIN 2.5.29.31
 $INCLUDE dictionary.crl
 END 2.5.29.31
 
-ATTRIBUTE      certificatePolicies                     2.5.29.32       sequence        sequence_of=sequence,is_oid_leaf
+ATTRIBUTE      certificatePolicies                     2.5.29.32       sequence        sequence_of=sequence,is_oid_leaf,size=1..
 BEGIN 2.5.29.32
 DEFINE policyInformation                               sequence
 BEGIN policyInformation
 DEFINE policyIdentifier                                oid
 
-DEFINE policyQualifiers                                sequence        sequence_of=sequence
+DEFINE policyQualifiers                                sequence        sequence_of=sequence,size=1..
 BEGIN policyQualifiers
 DEFINE policyQualifierInfo                             sequence        sequence_of=oid_and_value,ref=OID-Tree
 END policyQualifiers
@@ -106,7 +106,7 @@ END policyQualifiers
 END policyInformation
 END 2.5.29.32
 
-ATTRIBUTE      policyMappings                          2.5.29.33       sequence        is_oid_leaf
+ATTRIBUTE      policyMappings                          2.5.29.33       sequence        is_oid_leaf,size=1..
 BEGIN 2.5.29.33
 DEFINE issuerDomainPolicy                              oid
 DEFINE subjectDomainPolicy                             oid
@@ -125,7 +125,7 @@ DEFINE      requireExplicitPolicy                           octetstring option=0
 DEFINE inhibitPolicyMapping                            octetstring option=1
 END 2.5.29.36
 
-ATTRIBUTE      extKeyUsage                             2.5.29.37       sequence        sequence_of=oid,is_oid_leaf
+ATTRIBUTE      extKeyUsage                             2.5.29.37       sequence        sequence_of=oid,size=1..,is_oid_leaf
 #DEFINE extKeyUsageSyntax        sequence
 BEGIN 2.5.29.37
 DEFINE keyPurposeId                                    oid

diff --git a/share/dictionary/der/dictionary.rfc5280 b/share/dictionary/der/dictionary.rfc5280
index d6039939bc0fff025e1b3bfb3aa330fa64cb6abb..1a9cd628d784d1436d9833d62d61528b4110a988 100644 (file)
--- a/share/dictionary/der/dictionary.rfc5280
+++ b/share/dictionary/der/dictionary.rfc5280
@@ -30,7 +30,7 @@ END validity
 
 DEFINE subject                                         sequence sequence_of=set
 BEGIN subject
-DEFINE RelativeDistinguishedName                       set
+DEFINE RelativeDistinguishedName                       set size=1..
 BEGIN RelativeDistinguishedName
 DEFINE AttributeTypeandValue                           sequence sequence_of=oid_and_value,ref=OID-Tree
 END RelativeDistinguishedName
@@ -42,7 +42,7 @@ DEFINE        algorithm                                       sequence sequence_of=oid_and_value,ref=OID-Tree
 DEFINE subjectPublicKey                                bitstring
 END subjectPublicKeyInfo
 
-DEFINE extensions                                      x509_extensions ref=OID-Tree
+DEFINE extensions                                      x509_extensions ref=OID-Tree,size=1..
 
 END tbsCertificate
 

diff --git a/src/protocols/der/decode.c b/src/protocols/der/decode.c
index d36b39126a71e8ecd9fc7af3db8f43183c9089aa..f7bbf56725953649a7369575ded8bff3904a6e2f 100644 (file)
--- a/src/protocols/der/decode.c
+++ b/src/protocols/der/decode.c
@@ -818,8 +818,9 @@ static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_d
        fr_pair_t            *vp;
        fr_dict_attr_t const *child  = NULL;
        fr_dbuff_t            our_in = FR_DBUFF(in);
+       fr_der_attr_flags_t const *flags = fr_der_attr_flags(parent);
 
-       fr_assert(fr_type_is_struct(parent->type) || fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
+       fr_assert(fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
 
        /*
         *      ISO/IEC 8825-1:2021
@@ -838,13 +839,18 @@ static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_d
         *              value which is equal to its default value.
         */
 
+       if (flags->min && !fr_dbuff_remaining(&our_in)) {
+               fr_strerror_printf("Expected at last %d elements in %s, got 0", flags->min, parent->name);
+               return -1;
+       }
+
        vp = fr_pair_afrom_da(ctx, parent);
        if (unlikely(!vp)) {
                fr_strerror_const("Out of memory");
                return -1;
        }
 
-       if (unlikely(fr_der_flag_is_pair(parent))) {
+       if (unlikely(flags->is_pair)) {
                fr_assert(fr_type_is_group(parent->type));
 
                if (unlikely(fr_der_decode_oid_value_pair(vp, &vp->vp_group, &our_in, vp->da, decode_ctx) <= 0)) {
@@ -857,25 +863,26 @@ static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_d
                return fr_dbuff_set(in, &our_in);
        }
 
-       if (unlikely(fr_der_flag_is_sequence_of(parent))) {
-               /*
-                *      This is a sequence-of, meaning there are restrictions on the types which can be present
-                */
-
+       /*
+        *      This is a sequence-of, meaning there are restrictions on the types which can be present
+        */
+       if (unlikely(flags->is_sequence_of)) {
                bool restriction_types[FR_DER_TAG_MAX] = { };
 
-               if (fr_der_flag_sequence_of(parent) != FR_DER_TAG_CHOICE) {
-                       restriction_types[fr_der_flag_sequence_of(parent)] = true;
+               if (flags->sequence_of != FR_DER_TAG_CHOICE) {
+                       restriction_types[flags->sequence_of] = true;
 
                } else {
                        /*
-                        *      If it is a seuqnec of choices, then we must construct the list of restriction_types.
+                        *      If it is a sequence of choices, then we must construct the list of restriction_types.
                         *      This will be a list of the number of choices, starting at 0.
                         */
                        fr_dict_attr_t const *choices = NULL;
 
                        if (fr_type_is_group(parent->type)) {
-                               while ((choices = fr_dict_attr_iterate_children(fr_dict_attr_ref(parent), &choices))) {
+                               fr_dict_attr_t const *ref = fr_dict_attr_ref(parent);
+
+                               while ((choices = fr_dict_attr_iterate_children(ref, &choices))) {
                                        restriction_types[choices->attr] = true;
                                }
                        } else {
@@ -904,7 +911,7 @@ static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_d
 
                        }
 
-                       if (unlikely(fr_der_flag_sequence_of(parent) == FR_DER_TAG_CHOICE)) {
+                       if (unlikely(flags->sequence_of == FR_DER_TAG_CHOICE)) {
                                child = fr_dict_attr_child_by_num(parent, current_tag);
                                if (unlikely(!child)) {
                                        fr_strerror_printf(
@@ -971,8 +978,9 @@ static ssize_t fr_der_decode_set(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_a
        fr_dbuff_marker_t     previous_marker;
        uint8_t               previous_tag = 0x00;
        size_t                previous_len = 0;
+       fr_der_attr_flags_t const *flags = fr_der_attr_flags(parent);
 
-       fr_assert(fr_type_is_struct(parent->type) || fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
+       fr_assert(fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
 
        /*
         *      ISO/IEC 8825-1:2021
@@ -989,13 +997,18 @@ static ssize_t fr_der_decode_set(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_a
         *              value which is equal to its default value.
         */
 
+       if (flags->min && !fr_dbuff_remaining(&our_in)) {
+               fr_strerror_printf("Expected at last %d elements in %s, got 0", flags->min, parent->name);
+               return -1;
+       }
+
        vp = fr_pair_afrom_da(ctx, parent);
        if (unlikely(!vp)) {
                fr_strerror_const("Out of memory");
                return -1;
        }
 
-       if (fr_der_flag_is_pair(parent)) {
+       if (flags->is_pair) {
                fr_assert(fr_type_is_group(parent->type));
 
                if (unlikely(fr_der_decode_oid_value_pair(vp, &vp->vp_group, &our_in, vp->da, decode_ctx) <= 0)) {
@@ -1008,11 +1021,11 @@ static ssize_t fr_der_decode_set(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_a
                return fr_dbuff_set(in, &our_in);
        }
 
-       if (fr_der_flag_is_set_of(parent)) {
+       if (flags->is_set_of) {
                /*
                 *      This is a set-of, meaning there are restrictions on the types which can be present
                 */
-               fr_der_tag_t restriction_type = fr_der_flag_set_of(parent);
+               fr_der_tag_t restriction_type = flags->set_of;
 
                while (fr_dbuff_remaining(&our_in) > 0) {
                        fr_dbuff_marker_t current_value_marker;