WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

adds OCSP Responder extKeyUsage validation

pull/731/head
Moisés Guimarães 2017-01-30 15:07:38 -03:00 committed by David Garske
parent 9ead657723
commit 42a2f5858e
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wolfcrypt/src/asn.c
View File

@ -10757,6 +10757,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
return ASN_PARSE_E; return ASN_PARSE_E;
InitDecodedCert(&cert, resp->cert, resp->certSz, heap); InitDecodedCert(&cert, resp->cert, resp->certSz, heap);
/* Don't verify if we don't have access to Cert Manager. */ /* Don't verify if we don't have access to Cert Manager. */
ret = ParseCertRelative(&cert, CERT_TYPE, ret = ParseCertRelative(&cert, CERT_TYPE,
noVerify ? NO_VERIFY : VERIFY_OCSP, cm); noVerify ? NO_VERIFY : VERIFY_OCSP, cm);
@ -10766,6 +10767,13 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
return ret; return ret;
} }
if ((cert.extExtKeyUsage & EXTKEYUSE_OCSP_SIGN) == 0) {
WOLFSSL_MSG("\tOCSP Responder key usage check failed");
FreeDecodedCert(&cert);
return BAD_OCSP_RESPONDER;
}
/* ConfirmSignature is blocking here */ /* ConfirmSignature is blocking here */
ret = ConfirmSignature(&cert.sigCtx, ret = ConfirmSignature(&cert.sigCtx,
resp->response, resp->responseSz, resp->response, resp->responseSz,

3
wolfcrypt/src/error.c
View File

@ -425,6 +425,9 @@ const char* wc_GetErrorString(int error)
case ASYNC_OP_E: case ASYNC_OP_E:
return "Async operation error"; return "Async operation error";
case BAD_OCSP_RESPONDER:
return "Invalid OCSP Responder, missing specific key usage extensions";
default: default:
return "unknown error number"; return "unknown error number";

1
wolfssl/wolfcrypt/error-crypt.h
View File

@ -106,6 +106,7 @@ enum {
UNICODE_SIZE_E = -175, /* Unicode password too big */ UNICODE_SIZE_E = -175, /* Unicode password too big */
NO_PASSWORD = -176, /* no password provided by user */ NO_PASSWORD = -176, /* no password provided by user */
ALT_NAME_E = -177, /* alt name size problem, too big */ ALT_NAME_E = -177, /* alt name size problem, too big */
BAD_OCSP_RESPONDER = -178, /* missing key usage extensions */
AES_GCM_AUTH_E = -180, /* AES-GCM Authentication check failure */ AES_GCM_AUTH_E = -180, /* AES-GCM Authentication check failure */
AES_CCM_AUTH_E = -181, /* AES-CCM Authentication check failure */ AES_CCM_AUTH_E = -181, /* AES-CCM Authentication check failure */