Commit d88926f1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

PR: 2909 

Contributed by: Florian Weimer <fweimer@redhat.com>

Fixes to X509 hostname and email address checking. Wildcard matching support.
New test program and manual page.
parent 24f77b34

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 1.0.x and 1.1.0  [xx XXX xxxx]



  *) Fixes and wildcard matching support to hostname and email checking

     functions. Add manual page.

     [Florian Weimer (Red Hat Product Security Team)]



  *) New experimental SSL_CONF* functions. These provide a common framework

     for application configuration using configuration files or command lines.

     [Steve Henson]

crypto/x509v3/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ AR= ar r 
CFLAGS= $(INCLUDES) $(CFLAG)



GENERAL=Makefile README

TEST=

TEST=v3nametest.c

APPS=



LIB=$(TOP)/libcrypto.a

crypto/x509v3/v3_utl.c

+190 −14
Original line number Diff line number Diff line
@@ -568,12 +568,177 @@ void X509_email_free(STACK_OF(OPENSSL_STRING) *sk) 
	sk_OPENSSL_STRING_pop_free(sk, str_free);

}



typedef int (*equal_fn)(const unsigned char *pattern, size_t pattern_len,

			const unsigned char *subject, size_t subject_len);



/* Compare while ASCII ignoring case. */

static int equal_nocase(const unsigned char *pattern, size_t pattern_len,

			const unsigned char *subject, size_t subject_len)

	{

	if (pattern_len != subject_len)

		return 0;

	while (pattern_len)

		{

		unsigned char l = *pattern;

		unsigned char r = *subject;

		/* The pattern must not contain NUL characters. */

		if (l == 0)

			return 0;

		if (l != r)

			{

			if ('A' <= l && l <= 'Z')

				l = (l - 'A') + 'a';

			if ('A' <= r && r <= 'Z')

				r = (r - 'A') + 'a';

			if (l != r)

				return 0;

			}

		++pattern;

		++subject;

		--pattern_len;

		}

	return 1;

	}



/* Compare using memcmp. */

static int equal_case(const unsigned char *pattern, size_t pattern_len,

		      const unsigned char *subject, size_t subject_len)

{

	/* The pattern must not contain NUL characters. */

	if (memchr(pattern, '\0', pattern_len) != NULL)

		return 0;

	if (pattern_len != subject_len)

		return 0;

	return !memcmp(pattern, subject, pattern_len);

}



/* RFC 5280, section 7.5, requires that only the domain is compared in

   a case-insensitive manner. */

static int equal_email(const unsigned char *a, size_t a_len,

		       const unsigned char *b, size_t b_len)

	{

	size_t i = a_len;

	if (a_len != b_len)

		return 0;

	/* We search backwards for the '@' character, so that we do

	   not have to deal with quoted local-parts.  The domain part

	   is compared in a case-insensitive manner. */

	while (i > 0)

		{

		--i;

		if (a[i] == '@' || b[i] == '@')

			{

			if (!equal_nocase(a + i, a_len - i,

					  b + i, a_len - i))

				return 0;

			break;

			}

		}

	if (i == 0)

		i = a_len;

	return equal_case(a, i, b, i);

	}



/* Compare the prefix and suffix with the subject, and check that the

   characters in-between are valid. */

static int wildcard_match(const unsigned char *prefix, size_t prefix_len,

			  const unsigned char *suffix, size_t suffix_len,

			  const unsigned char *subject, size_t subject_len)

	{

	const unsigned char *wildcard_start;

	const unsigned char *wildcard_end;

	const unsigned char *p;

	if (subject_len < prefix_len + suffix_len)

		return 0;

	if (!equal_nocase(prefix, prefix_len, subject, prefix_len))

		return 0;

	wildcard_start = subject + prefix_len;

	wildcard_end = subject + (subject_len - suffix_len);

	if (!equal_nocase(wildcard_end, suffix_len, suffix, suffix_len))

		return 0;

	/* The wildcard must match at least one character. */

	if (wildcard_start == wildcard_end)

		return 0;

	/* Check that the part matched by the wildcard contains only

	   permitted characters and only matches a single label. */

	for (p = wildcard_start; p != wildcard_end; ++p)

		if (!(('0' <= *p && *p <= '9') ||

		      ('A' <= *p && *p <= 'Z') ||

		      ('a' <= *p && *p <= 'z') ||

		      *p == '-'))

			return 0;

	return 1;

	}



/* Checks if the memory region consistens of [0-9A-Za-z.-]. */

static int valid_domain_characters(const unsigned char *p, size_t len)

	{

	while (len)

		{

		if (!(('0' <= *p && *p <= '9') ||

		      ('A' <= *p && *p <= 'Z') ||

		      ('a' <= *p && *p <= 'z') ||

		      *p == '-' || *p == '.'))

			return 0;

		++p;

		--len;

		}

	return 1;

	}



/* Find the '*' in a wildcard pattern.  If no such character is found

   or the pattern is otherwise invalid, returns NULL. */

static const unsigned char *wildcard_find_star(const unsigned char *pattern,

					       size_t pattern_len)

	{

	const unsigned char *star = memchr(pattern, '*', pattern_len);

	size_t dot_count = 0;

	const unsigned char *suffix_start;

	size_t suffix_length;

	if (star == NULL)

		return NULL;

	suffix_start = star + 1;

	suffix_length = (pattern + pattern_len) - (star + 1);

	if (!(valid_domain_characters(pattern, star - pattern) &&

	      valid_domain_characters(suffix_start, suffix_length)))

		return NULL;

	/* Check that the suffix matches at least two labels. */

	while (suffix_length)

		{

		if (*suffix_start == '.')

			++dot_count;

		++suffix_start;

		--suffix_length;

		}

	if (dot_count < 2)

		return NULL;

	return star;

	}



/* Compare using wildcards. */

static int equal_wildcard(const unsigned char *pattern, size_t pattern_len,

			  const unsigned char *subject, size_t subject_len)

	{

	const unsigned char *star;

	/* Do not match IDNA names. */

	if (subject_len >=4 && memcmp(subject, "xn--", 4) == 0)

		star = NULL;

	else

		star = wildcard_find_star(pattern, pattern_len);

	if (star == NULL)

		return equal_nocase(pattern, pattern_len,

				    subject, subject_len);

	return wildcard_match(pattern, star - pattern,

			      star + 1, (pattern + pattern_len) - star - 1,

			      subject, subject_len);

	}



/* Compare an ASN1_STRING to a supplied string. If they match

 * return 1. If cmp_type > 0 only compare if string matches the

 * type, otherwise convert it to UTF8.

 */



static int do_check_string(ASN1_STRING *a, int cmp_type,

static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal,

				const unsigned char *b, size_t blen)

	{

	if (!a->data || !a->length)
@@ -582,6 +747,8 @@ static int do_check_string(ASN1_STRING *a, int cmp_type, 
		{

		if (cmp_type != a->type)

			return 0;

		if (cmp_type == V_ASN1_IA5STRING)

			return equal(a->data, a->length, b, blen);

		if (a->length == (int)blen && !memcmp(a->data, b, blen))

			return 1;

		else
@@ -593,11 +760,8 @@ static int do_check_string(ASN1_STRING *a, int cmp_type, 
		unsigned char *astr;

		astrlen = ASN1_STRING_to_UTF8(&astr, a);

		if (astrlen < 0)

			return 0;

		if (astrlen == (int)blen && !memcmp(astr, b, blen))

			rv = 1;

		else

			rv = 0;

			return -1;

		rv = equal(astr, astrlen, b, blen);

		OPENSSL_free(astr);

		return rv;

		}
@@ -610,12 +774,29 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
	X509_NAME *name = NULL;

	int i;

	int cnid;

	int alt_type;

	equal_fn equal;

	if (check_type == GEN_EMAIL)

		{

		cnid = NID_pkcs9_emailAddress;

		alt_type = V_ASN1_IA5STRING;

		equal = equal_email;

		}

	else if (check_type == GEN_DNS)

		{

		cnid = NID_commonName;

		alt_type = V_ASN1_IA5STRING;

		if (flags & X509_CHECK_FLAG_NO_WILDCARDS)

			equal = equal_nocase;

		else

			equal = equal_wildcard;

		}

	else

		{

		cnid = 0;

		alt_type = V_ASN1_OCTET_STRING;

		equal = equal_case;

		}



	if (chklen == 0)

		chklen = strlen((const char *)chk);
@@ -624,11 +805,6 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
	if (gens)

		{

		int rv = 0;

		int alt_type;

		if (cnid)

			alt_type = V_ASN1_IA5STRING;

		else

			alt_type = V_ASN1_OCTET_STRING;

		for (i = 0; i < sk_GENERAL_NAME_num(gens); i++)

			{

			GENERAL_NAME *gen;
@@ -642,7 +818,7 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
				cstr = gen->d.dNSName;

			else

				cstr = gen->d.iPAddress;

			if (do_check_string(cstr, alt_type, chk, chklen))

			if (do_check_string(cstr, alt_type, equal, chk, chklen))

				{

				rv = 1;

				break;
@@ -662,7 +838,7 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
		ASN1_STRING *str;

		ne = X509_NAME_get_entry(name, i);

		str = X509_NAME_ENTRY_get_data(ne);

		if (do_check_string(str, -1, chk, chklen))

		if (do_check_string(str, -1, equal, chk, chklen))

			return 1;

		}

	return 0;
@@ -692,7 +868,7 @@ int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags) 
	int iplen;

	iplen = a2i_ipadd(ipout, ipasc);

	if (iplen == 0)

		return 0;

		return -2;

	return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD);

	}

crypto/x509v3/v3nametest.c

0 → 100644
+346 −0
Original line number Diff line number Diff line 
#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <string.h>



static const char *const names[] =

	{

	"a", "b", ".", "*", "@",

	".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",

	"@@", "**",

	"*.com", "*com", "*.*.com", "*com", "com*", "*example.com",

	"*@example.com", "test@*.example.com",

	"example.com", "www.example.com", "test.www.example.com",

	"*.example.com", "*.www.example.com", "test.*.example.com", "www.*.com",

	"example.net", "xn--rger-koa.example.com",

	"a.example.com", "b.example.com",

	"postmaster@example.com", "Postmaster@example.com",

	"postmaster@EXAMPLE.COM",

	NULL

	};



static const char *const exceptions[] =

	{

	"set CN: host: [*.example.com] does not match [*.example.com]",

	"set CN: host: [*.example.com] matches [a.example.com]",

	"set CN: host: [*.example.com] matches [b.example.com]",

	"set CN: host: [*.example.com] matches [www.example.com]",

	"set CN: host: [test.*.example.com] does not match [test.*.example.com]",

	"set CN: host: [test.*.example.com] matches [test.www.example.com]",

	"set CN: host: [*.www.example.com] does not match [*.www.example.com]",

	"set CN: host: [*.www.example.com] matches [test.www.example.com]",

	"set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",

	"set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",

	"set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",

	"set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",

	"set dnsName: host: [*.example.com] matches [www.example.com]",

	"set dnsName: host: [*.example.com] does not match [*.example.com]",

	"set dnsName: host: [*.example.com] matches [a.example.com]",

	"set dnsName: host: [*.example.com] matches [b.example.com]",

	"set dnsName: host: [*.www.example.com] matches [test.www.example.com]",

	"set dnsName: host: [*.www.example.com] does not match [*.www.example.com]",

	"set dnsName: host: [test.*.example.com] matches [test.www.example.com]",

	"set dnsName: host: [test.*.example.com] does not match [test.*.example.com]",

	"set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",

	"set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",

	"set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",

	"set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",

	NULL

	};



static int is_exception(const char *msg)

	{

	const char *const *p;

	for (p = exceptions; *p; ++p)

		if (strcmp(msg, *p) == 0)

			return 1;

	return 0;

	}



static int set_cn(X509 *crt, ...)

	{

	int ret = 0;

	X509_NAME *n = NULL;

	va_list ap;

	va_start(ap, crt);

	n = X509_NAME_new();

	if (n == NULL)

		goto out;

	while (1) {

		int nid;

		const char *name;

		nid = va_arg(ap, int);

		if (nid == 0)

			break;

		name = va_arg(ap, const char *);

		if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,

							(unsigned char *)name,

						-1, -1, 1))

			goto out;

	}

	if (!X509_set_subject_name(crt, n))

		goto out;

	ret = 1;

 out:

	X509_NAME_free(n);

	va_end(ap);

	return ret;

	}



/*

int		X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);

X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,

			int nid, int crit, ASN1_OCTET_STRING *data);

int		X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);

*/



static int set_altname(X509 *crt, ...)

	{

	int ret = 0;

	GENERAL_NAMES *gens = NULL;

	GENERAL_NAME *gen = NULL;

	ASN1_IA5STRING *ia5 = NULL;

	va_list ap;

	va_start(ap, crt);

	gens = sk_GENERAL_NAME_new_null();

	if (gens == NULL)

		goto out;

	while (1) {

		int type;

		const char *name;

		type = va_arg(ap, int);

		if (type == 0)

			break;

		name = va_arg(ap, const char *);



		gen = GENERAL_NAME_new();

		if (gen == NULL)

			goto out;

		ia5 = ASN1_IA5STRING_new();

		if (ia5 == NULL)

			goto out;

		if (!ASN1_STRING_set(ia5, name, -1))

			goto out;

		switch (type)

			{

			case GEN_EMAIL:

			case GEN_DNS:

				GENERAL_NAME_set0_value(gen, type, ia5);

				ia5 = NULL;

				break;

			default:

				abort();

			}

		sk_GENERAL_NAME_push(gens, gen);

		gen = NULL;

	}

	if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))

		goto out;

	ret = 1;

 out:

	ASN1_IA5STRING_free(ia5);

	GENERAL_NAME_free(gen);

	GENERAL_NAMES_free(gens);

	va_end(ap);

	return ret;

	}



static int set_cn1(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_commonName, name, 0);

	}





static int set_cn_and_email(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_commonName, name,

		      NID_pkcs9_emailAddress, "dummy@example.com", 0);

	}



static int set_cn2(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_commonName, "dummy value",

		      NID_commonName, name, 0);

	}



static int set_cn3(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_commonName, name,

		      NID_commonName, "dummy value", 0);

	}



static int set_email1(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_pkcs9_emailAddress, name, 0);

	}



static int set_email2(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",

		      NID_pkcs9_emailAddress, name, 0);

	}



static int set_email3(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_pkcs9_emailAddress, name,

		      NID_pkcs9_emailAddress, "dummy@example.com", 0);

	}



static int set_email_and_cn(X509 *crt, const char *name)

	{

	return set_cn(crt, NID_pkcs9_emailAddress, name,

		      NID_commonName, "www.example.org", 0);

	}



static int set_altname_dns(X509 *crt, const char *name)

	{

	return set_altname(crt, GEN_DNS, name, 0);

	}



static int set_altname_email(X509 *crt, const char *name)

	{

	return set_altname(crt, GEN_EMAIL, name, 0);

	}



struct set_name_fn

	{

	int (*fn)(X509 *, const char *);

	const char *name;

	int host;

	int email;

	};



static const struct set_name_fn name_fns[] =

	{

	{set_cn1, "set CN", 1, 0},

	{set_cn2, "set CN", 1, 0},

	{set_cn3, "set CN", 1, 0},

	{set_cn_and_email, "set CN", 1, 0},

	{set_email1, "set emailAddress", 0, 1},

	{set_email2, "set emailAddress", 0, 1},

	{set_email3, "set emailAddress", 0, 1},

	{set_email_and_cn, "set emailAddress", 0, 1},

	{set_altname_dns, "set dnsName", 1, 0},

	{set_altname_email, "set rfc822Name", 0, 1},

	{NULL, NULL, 0}

	};



static X509 *make_cert()

	{

	X509 *ret = NULL;

	X509 *crt = NULL;

	X509_NAME *issuer = NULL;

	crt = X509_new();

	if (crt == NULL)

		goto out;

	if (!X509_set_version(crt, 3))

		goto out;

	ret = crt;

	crt = NULL;

 out:

	X509_NAME_free(issuer);

	return ret;

	}



static int errors;



static void check_message(const struct set_name_fn *fn, const char *op,

			  const char *nameincert, int match, const char *name)

	{

	char msg[1024];

	if (match < 0)

		return;

	snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",

		 fn->name, op, nameincert,

		 match ? "matches" : "does not match", name);

	if (is_exception(msg))

		return;

	puts(msg);

	++errors;

	}



static void run_cert(X509 *crt, const char *nameincert,

		     const struct set_name_fn *fn)

	{

	const char *const *pname = names;

	while (*pname)

		{

		int samename = strcasecmp(nameincert, *pname) == 0;

		size_t namelen = strlen(*pname);

		char *name = malloc(namelen);

		int match, ret;

		memcpy(name, *pname, namelen);



		ret = X509_check_host(crt, (const unsigned char *)name,

				      namelen, 0);

		match = -1;

		if (fn->host)

			{

			if (ret && !samename)

				match = 1;

			if (!ret && samename)

				match = 0;

			}

		else if (ret)

			match = 1;

		check_message(fn, "host", nameincert, match, *pname);



		ret = X509_check_host(crt, (const unsigned char *)name,

				      namelen, X509_CHECK_FLAG_NO_WILDCARDS);

		match = -1;

		if (fn->host)

			{

			if (ret && !samename)

				match = 1;

			if (!ret && samename)

				match = 0;

			}

		else if (ret)

			match = 1;

		check_message(fn, "host-no-wildcards",

			      nameincert, match, *pname);



		ret = X509_check_email(crt, (const unsigned char *)name,

				       namelen, 0);

		match = -1;

		if (fn->email)

			{

			if (ret && !samename)

				match = 1;

			if (!ret && samename && strchr(nameincert, '@') != NULL)

				match = 0;

			}

		else if (ret)

			match = 1;

		check_message(fn, "email", nameincert, match, *pname);

		++pname;

		free(name);

		}

	}



int

main(void)

	{

	const struct set_name_fn *pfn = name_fns;

	while (pfn->name) {

		const char *const *pname = names;

		while (*pname)

			{

			X509 *crt = make_cert();

			if (crt == NULL)

				{

				fprintf(stderr, "make_cert failed\n");

				return 1;

				}

			if (!pfn->fn(crt, *pname))

				{

				fprintf(stderr, "X509 name setting failed\n");

				return 1;

				}

			run_cert(crt, *pname, pfn);

			X509_free(crt);

			++pname;

			}

		++pfn;

	}

	return errors > 0 ? 1 : 0;

	}

crypto/x509v3/x509v3.h

+2 −0
Original line number Diff line number Diff line
@@ -704,6 +704,8 @@ STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x); 


/* Always check subject name for host match even if subject alt names present */

#define X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT	0x1

/* Disable wild-card matching for dnsName fields and common name. */

#define X509_CHECK_FLAG_NO_WILDCARDS	0x2



int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,

					unsigned int flags);