From: Nikos Mavrogiannopoulos Date: Tue, 5 Mar 2002 09:04:03 +0000 (+0000) Subject: Added the error UNIX_TIME_LIMIT_EXCEEDED, and corrected bugs in X.509 certificate... X-Git-Tag: gnutls_0_3_92~54 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ac0edfe2201181e353cf9f9dc0a02639ed2828d;p=thirdparty%2Fgnutls.git Added the error UNIX_TIME_LIMIT_EXCEEDED, and corrected bugs in X.509 certificate parsing. --- diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c index c5a95f8753..823c6e1c57 100644 --- a/lib/gnutls_errors.c +++ b/lib/gnutls_errors.c @@ -102,6 +102,7 @@ static gnutls_error_entry error_algorithms[] = { GNUTLS_ERROR_ENTRY( GNUTLS_E_ILLEGAL_PARAMETER, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_FILE, 1), GNUTLS_ERROR_ENTRY( GNUTLS_E_ASCII_ARMOR, 1), + GNUTLS_ERROR_ENTRY( GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED, 1), {0} }; diff --git a/lib/gnutls_errors_int.h b/lib/gnutls_errors_int.h index c1fd368719..f90f87ce84 100644 --- a/lib/gnutls_errors_int.h +++ b/lib/gnutls_errors_int.h @@ -65,6 +65,7 @@ #define GNUTLS_E_DH_PRIME_UNACCEPTABLE -63 #define GNUTLS_E_FILE -64 #define GNUTLS_E_ASCII_ARMOR -65 +#define GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED -66 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -250 diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c index 400d9b6097..1b2b2f472d 100644 --- a/lib/gnutls_x509.c +++ b/lib/gnutls_x509.c @@ -284,6 +284,10 @@ time_t _gnutls_x509_get_time(node_asn * c2, char *root, char *when) ctime = _gnutls_utcTime2gtime(ttime); } + /* We cannot handle dates after 2031 in 32 bit machines. + * a time_t of 64bits has to be used. + */ + if (result != ASN_OK) { gnutls_assert(); return (time_t) (-1); @@ -303,7 +307,7 @@ int _gnutls_x509_get_version(node_asn * c2, char *root) len = sizeof(gversion) - 1; if ((result = asn1_read_value(c2, name, gversion, &len)) < 0) { gnutls_assert(); - return (-1); + return GNUTLS_E_ASN1_PARSING_ERROR; } return (int) gversion[0] + 1; } @@ -1747,7 +1751,20 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert) _gnutls_x509_get_time(c2, "certificate2", "notAfter"); gCert->activation_time = _gnutls_x509_get_time(c2, "certificate2", "notBefore"); + + if (gCert->expiration_time == (time_t)(-1) || + gCert->activation_time == (time_t)(-1)) { + gnutls_assert(); + asn1_delete_structure(c2); + return GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED; + } + gCert->version = _gnutls_x509_get_version(c2, "certificate2"); + if (gCert->version < 0) { + gnutls_assert(); + asn1_delete_structure(c2); + return GNUTLS_E_ASN1_PARSING_ERROR; + } if ((result = _gnutls_get_ext_type(c2, diff --git a/lib/x509_ASN.c b/lib/x509_ASN.c index 4dd4765a54..f5fa45abdc 100644 --- a/lib/x509_ASN.c +++ b/lib/x509_ASN.c @@ -1864,10 +1864,13 @@ yylex() * * Returns: * - * ASN_OK: the file has a correct syntax and every identifier is known. - * ASN_FILE_NOT_FOUND: an error occured while opening FILE_NAME. - * ASN_SYNTAX_ERROR: the syntax is not correct. - * ASN_IDENTIFIER_NOT_FOUND: in the file there is an identifier that is not defined. + * ASN_OK\: the file has a correct syntax and every identifier is known. + * + * ASN_FILE_NOT_FOUND\: an error occured while opening FILE_NAME. + * + * ASN_SYNTAX_ERROR\: the syntax is not correct. + * + * ASN_IDENTIFIER_NOT_FOUND\: in the file there is an identifier that is not defined. **/ int asn1_parser_asn1(char *file_name,node_asn **pointer){ p_tree=NULL; @@ -1916,10 +1919,13 @@ int asn1_parser_asn1(char *file_name,node_asn **pointer){ * * Returns: * - * ASN_OK: the file has a correct syntax and every identifier is known. - * ASN_FILE_NOT_FOUND: an error occured while opening FILE_NAME. - * ASN_SYNTAX_ERROR: the syntax is not correct. - * ASN_IDENTIFIER_NOT_FOUND: in the file there is an identifier that is not defined. + * ASN_OK\: the file has a correct syntax and every identifier is known. + * + * ASN_FILE_NOT_FOUND\: an error occured while opening FILE_NAME. + * + * ASN_SYNTAX_ERROR\: the syntax is not correct. + * + * ASN_IDENTIFIER_NOT_FOUND\: in the file there is an identifier that is not defined. **/ int asn1_parser_asn1_file_c(char *file_name){ int result; diff --git a/lib/x509_asn1.c b/lib/x509_asn1.c index 999cbddf15..a70510b705 100755 --- a/lib/x509_asn1.c +++ b/lib/x509_asn1.c @@ -30,7 +30,7 @@ #include "x509_asn1.h" #include "x509_der.h" #include - +#include /* define used for visiting trees */ #define UP 1 @@ -436,7 +436,10 @@ _asn1_convert_integer(char *value,unsigned char *value_out,int value_out_size, i (!negative && (val[k]&0x80))) k--; for(k2=k;k2<4;k2++) { - if (k2-k > value_out_size-1) return ASN_MEM_ERROR; + if (k2-k > value_out_size-1) { + gnutls_assert(); + return ASN_MEM_ERROR; + } /* VALUE_OUT is too short to contain the value convertion */ value_out[k2-k]=val[k2]; } @@ -1299,6 +1302,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len) #define PUT_VALUE( ptr, ptr_size, data, data_size) \ *len = data_size; \ if (ptr_size < data_size) { \ + gnutls_assert(); \ return ASN_MEM_ERROR; \ } else { \ memcpy( ptr, data, data_size); \ @@ -1307,6 +1311,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len) #define PUT_STR_VALUE( ptr, ptr_size, data) \ *len = strlen(data) + 1; \ if (ptr_size < *len) { \ + gnutls_assert(); \ return ASN_MEM_ERROR; \ } else { \ /* this strcpy is checked */ \ @@ -1316,6 +1321,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len) #define ADD_STR_VALUE( ptr, ptr_size, data) \ *len = strlen(data) + 1; \ if (ptr_size < strlen(ptr)+(*len)) { \ + gnutls_assert(); \ return ASN_MEM_ERROR; \ } else { \ /* this strcat is checked */ \ diff --git a/lib/x509_der.c b/lib/x509_der.c index e966c96626..8c41ae5fcb 100644 --- a/lib/x509_der.c +++ b/lib/x509_der.c @@ -29,7 +29,7 @@ #include "x509_der.h" #include "x509_asn1.h" #include - +#include #define TAG_BOOLEAN 0x01 #define TAG_INTEGER 0x02 @@ -192,9 +192,12 @@ _asn1_get_octet_der(unsigned char *der,int *der_len,unsigned char *str,int str_s if(str==NULL) return ASN_OK; *str_len=_asn1_get_length_der(der,&len_len); - if ( str_size > *str_len) + if ( str_size >= *str_len) memcpy(str,der+len_len,*str_len); - else return ASN_MEM_ERROR; + else { + gnutls_assert(); + return ASN_MEM_ERROR; + } *der_len=*str_len+len_len; return ASN_OK; @@ -369,10 +372,12 @@ _asn1_get_bit_der(unsigned char *der,int *der_len,unsigned char *str, int str_si if(str==NULL) return ASN_OK; len_byte=_asn1_get_length_der(der,&len_len)-1; - if (str_size > len_byte) + if (str_size >= len_byte) memcpy(str,der+len_len+1,len_byte); - else return ASN_MEM_ERROR; - + else { + gnutls_assert(); + return ASN_MEM_ERROR; + } *bit_len=len_byte*8-der[len_len]; *der_len=len_byte+len_len+1; diff --git a/lib/x509_verify.c b/lib/x509_verify.c index ec62abedaa..f0d99070eb 100644 --- a/lib/x509_verify.c +++ b/lib/x509_verify.c @@ -149,7 +149,6 @@ static int check_if_expired(gnutls_cert * cert) /* get the issuer of 'cert' */ - if (time(NULL) < cert->expiration_time) ret = 0; @@ -330,7 +329,7 @@ int gnutls_verify_certificate2(gnutls_cert * cert, gnutls_cert * trusted_cas, in ret = check_if_expired( issuer); if (ret != 0) { gnutls_assert(); - return ret_else|GNUTLS_CERT_EXPIRED; + return ret_else | GNUTLS_CERT_EXPIRED; } ret = gnutls_x509_verify_signature(cert, issuer);