mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-12-25 03:15:28 +00:00
19557c2078
Some functions within the X.509 module return an ASN.1 low level error code where instead this error code should be wrapped by a high-level X.509 error code as in the bulk of the module. Specifically, the following functions are affected: - mbedtls_x509_get_ext() - x509_get_version() - x509_get_uid() This commit modifies these functions to always return an X.509 high level error code. Care has to be taken when adapting `mbetls_x509_get_ext()`: Currently, the callers `mbedtls_x509_crt_ext()` treat the return code `MBEDTLS_ERR_ASN1_UNEXPECTED_TAG` specially to gracefully detect and continue if the extension structure is not present. Wrapping the ASN.1 error with `MBEDTLS_ERR_X509_INVALID_EXTENSIONS` and adapting the check accordingly would mean that an unexpected tag somewhere down the extension parsing would be ignored by the caller. The way out of this is the following: Luckily, the extension structure is always the last field in the surrounding structure, so if there is some data remaining, it must be an Extension structure, so we don't need to deal with a tag mismatch gracefully in the first place. We may therefore wrap the return code from the initial call to `mbedtls_asn1_get_tag()` in `mbedtls_x509_get_ext()` by `MBEDTLS_ERR_X509_INVALID_EXTENSIONS` and simply remove the special treatment of `MBEDTLS_ERR_ASN1_UNEXPECTED_TAG` in the callers `x509_crl_get_ext()` and `x509_crt_get_ext()`. This renders `mbedtls_x509_get_ext()` unsuitable if it ever happened that an Extension structure is optional and does not occur at the end of its surrounding structure, but for CRTs and CRLs, it's fine. The following tests need to be adapted: - "TBSCertificate v3, issuerID wrong tag" The issuerID is optional, so if we look for its presence but find a different tag, we silently continue and try parsing the subjectID, and then the extensions. The tag '00' used in this test doesn't match either of these, and the previous code would hence return LENGTH_MISMATCH after unsucessfully trying issuerID, subjectID and Extensions. With the new code, any data remaining after issuerID and subjectID _must_ be Extension data, so we fail with UNEXPECTED_TAG when trying to parse the Extension data. - "TBSCertificate v3, UIDs, invalid length" The test hardcodes the expectation of MBEDTLS_ERR_ASN1_INVALID_LENGTH, which needs to be wrapped in MBEDTLS_ERR_X509_INVALID_FORMAT now. Fixes #2431. |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| aes.c | ||
| aesni.c | ||
| arc4.c | ||
| asn1parse.c | ||
| asn1write.c | ||
| base64.c | ||
| bignum.c | ||
| blowfish.c | ||
| camellia.c | ||
| ccm.c | ||
| certs.c | ||
| cipher.c | ||
| cipher_wrap.c | ||
| cmac.c | ||
| CMakeLists.txt | ||
| ctr_drbg.c | ||
| debug.c | ||
| des.c | ||
| dhm.c | ||
| ecdh.c | ||
| ecdsa.c | ||
| ecjpake.c | ||
| ecp.c | ||
| ecp_curves.c | ||
| entropy.c | ||
| entropy_poll.c | ||
| error.c | ||
| gcm.c | ||
| havege.c | ||
| hmac_drbg.c | ||
| Makefile | ||
| md.c | ||
| md2.c | ||
| md4.c | ||
| md5.c | ||
| md_wrap.c | ||
| memory_buffer_alloc.c | ||
| net_sockets.c | ||
| oid.c | ||
| padlock.c | ||
| pem.c | ||
| pk.c | ||
| pk_wrap.c | ||
| pkcs5.c | ||
| pkcs11.c | ||
| pkcs12.c | ||
| pkparse.c | ||
| pkwrite.c | ||
| platform.c | ||
| ripemd160.c | ||
| rsa.c | ||
| rsa_internal.c | ||
| sha1.c | ||
| sha256.c | ||
| sha512.c | ||
| ssl_cache.c | ||
| ssl_ciphersuites.c | ||
| ssl_cli.c | ||
| ssl_cookie.c | ||
| ssl_srv.c | ||
| ssl_ticket.c | ||
| ssl_tls.c | ||
| threading.c | ||
| timing.c | ||
| version.c | ||
| version_features.c | ||
| x509.c | ||
| x509_create.c | ||
| x509_crl.c | ||
| x509_crt.c | ||
| x509_csr.c | ||
| x509write_crt.c | ||
| x509write_csr.c | ||
| xtea.c | ||