x509 crt verify SAN iPAddress

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
This commit is contained in:
Glenn Strauss 2022-10-23 19:48:18 -04:00 committed by Andrzej Kurek
parent 6a327a5fdc
commit c26bd76020
2 changed files with 103 additions and 25 deletions
include/mbedtls
library

@ -638,7 +638,7 @@ int mbedtls_x509_crt_verify_info(char *buf, size_t size, const char *prefix,
* \param cn The expected Common Name. This will be checked to be
* present in the certificate's subjectAltNames extension or,
* if this extension is absent, as a CN component in its
* Subject name. Currently only DNS names are supported. This
* Subject name. DNS names and IP addresses are supported. This
* may be \c NULL if the CN need not be verified.
* \param flags The address at which to store the result of the verification.
* If the verification couldn't be completed, the flag value is

@ -58,6 +58,10 @@
#if defined(MBEDTLS_HAVE_TIME)
#if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
#define WIN32_LEAN_AND_MEAN
#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0600
#endif
#include <windows.h>
#else
#include <time.h>
@ -2524,6 +2528,61 @@ find_parent:
}
}
#ifdef _WIN32
#ifdef _MSC_VER
#pragma comment(lib, "ws2_32.lib")
#include <winsock2.h>
#include <ws2tcpip.h>
#elif (defined(__MINGW32__) || defined(__MINGW64__)) && _WIN32_WINNT >= 0x0600
#include <winsock2.h>
#include <ws2tcpip.h>
#endif
#elif defined(__sun)
/* Solaris requires -lsocket -lnsl for inet_pton() */
#elif defined(__has_include)
#if __has_include(<sys/socket.h>)
#include <sys/socket.h>
#endif
#if __has_include(<arpa/inet.h>)
#include <arpa/inet.h>
#endif
#endif
/* Use whether or not AF_INET6 is defined to indicate whether or not to use
* the platform inet_pton() or a local implementation (below). The local
* implementation may be used even in cases where the platform provides
* inet_pton(), e.g. when there are different includes required and/or the
* platform implementation requires dependencies on additional libraries.
* Specifically, Windows requires custom includes and additional link
* dependencies, and Solaris requires additional link dependencies.
* Also, as a coarse heuristic, use the local implementation if the compiler
* does not support __has_include(), or if the definition of AF_INET6 is not
* provided by headers included (or not) via __has_include() above. */
#ifndef AF_INET6
#define x509_cn_inet_pton(cn, dst) (0)
#else
static int x509_inet_pton_ipv6(const char *src, void *dst)
{
return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
}
static int x509_inet_pton_ipv4(const char *src, void *dst)
{
return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
}
#endif /* AF_INET6 */
static size_t x509_cn_inet_pton(const char *cn, void *dst)
{
return strchr(cn, ':') == NULL
? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
: x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
}
/*
* Check for CN match
*/
@ -2544,24 +2603,51 @@ static int x509_crt_check_cn(const mbedtls_x509_buf *name,
return -1;
}
static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
const char *cn, size_t cn_len)
{
uint32_t ip[4];
cn_len = x509_cn_inet_pton(cn, ip);
if (cn_len == 0) {
return -1;
}
for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
const unsigned char san_type = (unsigned char) cur->buf.tag &
MBEDTLS_ASN1_TAG_VALUE_MASK;
if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
return 0;
}
}
return -1;
}
/*
* Check for SAN match, see RFC 5280 Section 4.2.1.6
*/
static int x509_crt_check_san(const mbedtls_x509_buf *name,
static int x509_crt_check_san(const mbedtls_x509_sequence *san,
const char *cn, size_t cn_len)
{
const unsigned char san_type = (unsigned char) name->tag &
MBEDTLS_ASN1_TAG_VALUE_MASK;
/* dNSName */
if (san_type == MBEDTLS_X509_SAN_DNS_NAME) {
return x509_crt_check_cn(name, cn, cn_len);
int san_ip = 0;
for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
case MBEDTLS_X509_SAN_DNS_NAME: /* dNSName */
if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
return 0;
}
break;
case MBEDTLS_X509_SAN_IP_ADDRESS: /* iPAddress */
san_ip = 1;
break;
/* (We may handle other types here later.) */
default: /* Unrecognized type */
break;
}
}
/* (We may handle other types here later.) */
/* Unrecognized type */
return -1;
return san_ip ? x509_crt_check_san_ip(san, cn, cn_len) : -1;
}
/*
@ -2572,31 +2658,23 @@ static void x509_crt_verify_name(const mbedtls_x509_crt *crt,
uint32_t *flags)
{
const mbedtls_x509_name *name;
const mbedtls_x509_sequence *cur;
size_t cn_len = strlen(cn);
if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
for (cur = &crt->subject_alt_names; cur != NULL; cur = cur->next) {
if (x509_crt_check_san(&cur->buf, cn, cn_len) == 0) {
break;
}
}
if (cur == NULL) {
*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
if (x509_crt_check_san(&crt->subject_alt_names, cn, cn_len) == 0) {
return;
}
} else {
for (name = &crt->subject; name != NULL; name = name->next) {
if (MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0 &&
x509_crt_check_cn(&name->val, cn, cn_len) == 0) {
break;
return;
}
}
if (name == NULL) {
*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
}
}
*flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
}
/*