yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 19:05:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove 'CRT fallback' during X.509 CRT verification if !TIME_DATE

Browse source
This commit is contained in:
Hanno Becker 2019-06-10 11:12:33 +01:00
parent c00cceaa3f
commit 6f61b7bb5c
2 changed files with 26 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
include/mbedtls/x509_crt.h
View file

@ -235,8 +235,11 @@ typedef struct
/* for find_parent_in() */ /* for find_parent_in() */
mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */ mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */
#if defined(MBEDTLS_HAVE_TIME_DATE)
mbedtls_x509_crt *fallback_parent; mbedtls_x509_crt *fallback_parent;
int fallback_signature_is_good; int fallback_signature_is_good;
#endif /* MBEDTLS_HAVE_TIME_DATE */
/* for find_parent() */ /* for find_parent() */
int parent_is_trusted; /* -1 if find_parent is not in progress */ int parent_is_trusted; /* -1 if find_parent is not in progress */

25
library/x509_crt.c
View file

@ -2844,8 +2844,13 @@ static int x509_crt_find_parent_in(
mbedtls_x509_crt_restart_ctx *rs_ctx ) mbedtls_x509_crt_restart_ctx *rs_ctx )
{ {
int ret; int ret;
mbedtls_x509_crt *parent_crt, *fallback_parent; mbedtls_x509_crt *parent_crt;
int signature_is_good, fallback_signature_is_good; int signature_is_good;
#if defined(MBEDTLS_HAVE_TIME_DATE)
mbedtls_x509_crt *fallback_parent;
int fallback_signature_is_good;
#endif /* MBEDTLS_HAVE_TIME_DATE */
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
/* did we have something in progress? */ /* did we have something in progress? */
@ -2853,21 +2858,27 @@ static int x509_crt_find_parent_in(
{ {
/* restore saved state */ /* restore saved state */
parent_crt = rs_ctx->parent; parent_crt = rs_ctx->parent;
#if defined(MBEDTLS_HAVE_TIME_DATE)
fallback_parent = rs_ctx->fallback_parent; fallback_parent = rs_ctx->fallback_parent;
fallback_signature_is_good = rs_ctx->fallback_signature_is_good; fallback_signature_is_good = rs_ctx->fallback_signature_is_good;
#endif /* MBEDTLS_HAVE_TIME_DATE */
/* clear saved state */ /* clear saved state */
rs_ctx->parent = NULL; rs_ctx->parent = NULL;
#if defined(MBEDTLS_HAVE_TIME_DATE)
rs_ctx->fallback_parent = NULL; rs_ctx->fallback_parent = NULL;
rs_ctx->fallback_signature_is_good = 0; rs_ctx->fallback_signature_is_good = 0;
#endif /* MBEDTLS_HAVE_TIME_DATE */
/* resume where we left */ /* resume where we left */
goto check_signature; goto check_signature;
} }
#endif #endif
#if defined(MBEDTLS_HAVE_TIME_DATE)
fallback_parent = NULL; fallback_parent = NULL;
fallback_signature_is_good = 0; fallback_signature_is_good = 0;
#endif /* MBEDTLS_HAVE_TIME_DATE */
for( parent_crt = candidates; parent_crt != NULL; for( parent_crt = candidates; parent_crt != NULL;
parent_crt = parent_crt->next ) parent_crt = parent_crt->next )
@ -2918,8 +2929,10 @@ check_signature:
{ {
/* save state */ /* save state */
rs_ctx->parent = parent_crt; rs_ctx->parent = parent_crt;
#if defined(MBEDTLS_HAVE_TIME_DATE)
rs_ctx->fallback_parent = fallback_parent; rs_ctx->fallback_parent = fallback_parent;
rs_ctx->fallback_signature_is_good = fallback_signature_is_good; rs_ctx->fallback_signature_is_good = fallback_signature_is_good;
#endif /* MBEDTLS_HAVE_TIME_DATE */
return( ret ); return( ret );
} }
@ -2934,11 +2947,13 @@ check_signature:
/* optional time check */ /* optional time check */
if( !parent_valid ) if( !parent_valid )
{ {
#if defined(MBEDTLS_HAVE_TIME_DATE)
if( fallback_parent == NULL ) if( fallback_parent == NULL )
{ {
fallback_parent = parent_crt; fallback_parent = parent_crt;
fallback_signature_is_good = signature_is_good; fallback_signature_is_good = signature_is_good;
} }
#endif /* MBEDTLS_HAVE_TIME_DATE */
continue; continue;
} }
@ -2953,8 +2968,12 @@ check_signature:
} }
else else
{ {
#if defined(MBEDTLS_HAVE_TIME_DATE)
*r_parent = fallback_parent; *r_parent = fallback_parent;
*r_signature_is_good = fallback_signature_is_good; *r_signature_is_good = fallback_signature_is_good;
#else /* MBEDTLS_HAVE_TIME_DATE */
*r_parent = NULL;
#endif /* !MBEDTLS_HAVE_TIME_DATE */
} }
return( 0 ); return( 0 );
@ -3643,8 +3662,10 @@ void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx )
mbedtls_pk_restart_init( &ctx->pk ); mbedtls_pk_restart_init( &ctx->pk );
ctx->parent = NULL; ctx->parent = NULL;
#if defined(MBEDTLS_HAVE_TIME_DATE)
ctx->fallback_parent = NULL; ctx->fallback_parent = NULL;
ctx->fallback_signature_is_good = 0; ctx->fallback_signature_is_good = 0;
#endif /* MBEDTLS_HAVE_TIME_DATE */
ctx->parent_is_trusted = -1; ctx->parent_is_trusted = -1;