narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[crypto] Validate path length constraint in certificate chain 

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/6/head
Michael Brown 2012-03-21 19:18:38 +00:00
parent 94cdbd76d6
commit b1316ef276
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/crypto/x509.c
View File

@ -89,6 +89,10 @@ FILE_LICENCE ( GPL2_OR_LATER );
__einfo_error ( EINFO_EACCES_EXPIRED )
#define EINFO_EACCES_EXPIRED \
__einfo_uniqify ( EINFO_EACCES, 0x04, "Expired (or not yet valid)" )
#define EACCES_PATH_LEN \
__einfo_error ( EINFO_EACCES_PATH_LEN )
#define EINFO_EACCES_PATH_LEN \
__einfo_uniqify ( EINFO_EACCES, 0x05, "Maximum path length exceeded" )
/** "commonName" object identifier */
static uint8_t oid_common_name[] = { ASN1_OID_COMMON_NAME };
@ -1187,6 +1191,7 @@ int x509_validate_chain ( int ( * parse_next ) ( struct x509_certificate *cert,
struct x509_certificate *current = &temp[0];
struct x509_certificate *next = &temp[1];
struct x509_certificate *swap;
unsigned int path_len = 0;
int rc;
/* Use default root certificate store if none specified */
@ -1226,6 +1231,15 @@ int x509_validate_chain ( int ( * parse_next ) ( struct x509_certificate *cert,
if ( ( rc = x509_validate_issuer ( current, next ) ) != 0 )
return rc;
/* Validate path length constraint */
if ( path_len > next->extensions.basic.path_len ) {
DBGC ( context, "X509 chain %p path length %d exceeds "
"maximum %d\n", context, path_len,
next->extensions.basic.path_len );
return -EACCES_PATH_LEN;
}
path_len++;
/* Move to next certificate in chain */
swap = current;
current = next;