abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-11 16:33:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update X.509 validation and fix TLS 1.3 chain verify

Browse Source
This commit is contained in:
Zhi Guan
2023-01-11 15:29:22 +08:00
parent 167f2c0c33
commit 2f19fc3067
5 changed files with 101 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/x509_cer.c
View File

@@ -1586,16 +1586,23 @@ int x509_cert_validate(const uint8_t *cert, size_t certlen, int cert_type,
int tbs_sig_algor;
int sig_algor;
const uint8_t *serial;
size_t serial_len;
const uint8_t *issuer_uniq_id;
size_t issuer_uniq_id_len;
const uint8_t *subj_uniq_id;
size_t subj_uniq_id_len;
x509_cert_get_details(cert, certlen,
&version, // version
NULL, NULL, // serial
&serial, &serial_len, // serial
&tbs_sig_algor, // signature_algor
&issuer, &issuer_len, // issuer
&not_before, &not_after, // validity
&subject, &subject_len, // subject
NULL, // subject_public_key
NULL, NULL, // issuer_unique_id
NULL, NULL, // subject_unique_id
&issuer_uniq_id, &issuer_uniq_id_len, // issuer_unique_id
&subj_uniq_id, &subj_uniq_id_len, // subject_unique_id
&exts, &extslen, // extensions
&sig_algor, // signature_algor
NULL, NULL); // signature
@@ -1605,6 +1612,14 @@ int x509_cert_validate(const uint8_t *cert, size_t certlen, int cert_type,
return -1;
}
if (!serial || !serial_len) {
error_print();
return -1;
}
if (serial_len < 4) {
error_print(); // not enough randomness
}
time(&now);
if (x509_validity_validate(not_before, not_after, now, X509_VALIDITY_MAX_SECONDS) != 1) {
error_print();
@@ -1621,9 +1636,10 @@ int x509_cert_validate(const uint8_t *cert, size_t certlen, int cert_type,
return -1;
}
if (!exts || !extslen) {
// CAs conforming to RFC 5280 MUST NOT generate certificates with unique identifiers
if (issuer_uniq_id || subj_uniq_id) {
error_print();
return -1;
//return -1;
}
if (x509_exts_validate(exts, extslen, cert_type, path_len_constraints) != 1) {