From 8a5e3d4a4011f3f2142e15a23ad98fa7c7753b6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Wed, 12 Nov 2014 17:47:28 +0100 Subject: [PATCH] Forbid repeated X.509 extensions --- ChangeLog | 1 + library/x509_crt.c | 4 ++++ tests/suites/test_suite_x509parse.data | 4 ++++ 3 files changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index a8cb94a20..6f55c3297 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,7 @@ Changes switch back to random with POLARSSL_SSL_AEAD_RANDOM_IV in config.h). * Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined. * ssl_set_own_cert() now returns an error on key-certificate mismatch. + * Forbid repeated extensions in X.509 certificates. = PolarSSL 1.3.9 released 2014-10-20 Security diff --git a/library/x509_crt.c b/library/x509_crt.c index 525d250fb..5273c3a57 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -481,6 +481,10 @@ static int x509_get_crt_ext( unsigned char **p, continue; } + /* Forbid repeated extensions */ + if( ( crt->ext_types & ext_type ) != 0 ) + return( POLARSSL_ERR_X509_INVALID_EXTENSIONS ); + crt->ext_types |= ext_type; switch( ext_type ) diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index b7f6791af..097a86171 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -877,6 +877,10 @@ X509 Certificate ASN1 (SubjectAltName repeated) depends_on:POLARSSL_ECP_C:POLARSSL_ECP_DP_SECP256R1_ENABLED x509parse_crt:"3081fd3081faa003020102020900a8b31ff37d09a37f300906072a8648ce3d0401300f310d300b0603550403130454657374301e170d3134313131313231333731365a170d3234313130383231333731365a300f310d300b06035504031304546573743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa321301f301d0603551d11041630148208666f6f2e7465737482086261722e74657374301d0603551d11041630148208666f6f2e7465737482086261722e74657374":"":POLARSSL_ERR_X509_INVALID_EXTENSIONS +X509 Certificate ASN1 (ExtKeyUsage repeated) +depends_on:POLARSSL_ECP_C:POLARSSL_ECP_DP_SECP256R1_ENABLED +x509parse_crt:"3081fd3081faa003020102020900ebdbcd14105e1839300906072a8648ce3d0401300f310d300b0603550403130454657374301e170d3134313131313230353935345a170d3234313130383230353935345a300f310d300b06035504031304546573743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa340303e301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d250416301406082b0601050507030106082b06010505070302":"":POLARSSL_ERR_X509_INVALID_EXTENSIONS + X509 Certificate ASN1 (correct pubkey, no sig_alg) depends_on:POLARSSL_RSA_C x509parse_crt:"308183308180a0030201008204deadbeef300d06092a864886f70d0101020500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffff":"":POLARSSL_ERR_X509_INVALID_ALG + POLARSSL_ERR_ASN1_OUT_OF_DATA