From fc5c6fe4789b7726cefb7eef42e54c62ca51c1dc Mon Sep 17 00:00:00 2001 From: beck <> Date: Sun, 28 May 2023 09:02:01 +0000 Subject: Refactor tls_check_common_name to use lower level API. X509_NAME_get_text_by_NID is kind of a bad interface that we wish to make safer, and does not give us the visibility we really want here to detect hostile things. Instead call the lower level functions to do some better checking that should be done by X509_NAME_get_text_by_NID, but is not in the OpenSSL version. Specifically we will treat the input as hostile and fail if: 1) The certificate contains more than one CN in the subject. 2) The CN does not decode as UTF-8 3) The CN is of invalid length (must be between 1 and 64 bytes) 4) The CN contains a 0 byte 4) matches the existing logic, 1 and 2, and 3 are new checks. ok tb@ --- src/regress/lib/libtls/verify/verifytest.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/regress') diff --git a/src/regress/lib/libtls/verify/verifytest.c b/src/regress/lib/libtls/verify/verifytest.c index b41b62fcfb..57aa992149 100644 --- a/src/regress/lib/libtls/verify/verifytest.c +++ b/src/regress/lib/libtls/verify/verifytest.c @@ -1,4 +1,4 @@ -/* $OpenBSD: verifytest.c,v 1.7 2017/04/30 03:53:31 jsing Exp $ */ +/* $OpenBSD: verifytest.c,v 1.8 2023/05/28 09:02:01 beck Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -40,6 +40,7 @@ struct verify_test { const char name[128]; int want_return; int want_match; + int name_type; }; struct verify_test verify_tests[] = { @@ -474,7 +475,8 @@ do_verify_test(int test_no, struct verify_test *vt) if ((name = X509_NAME_new()) == NULL) errx(1, "failed to malloc X509_NAME"); if (X509_NAME_add_entry_by_NID(name, NID_commonName, - MBSTRING_ASC, (unsigned char *)vt->common_name, + vt->name_type ? vt->name_type : MBSTRING_ASC, + (unsigned char *)vt->common_name, vt->common_name_len, -1, 0) == 0) errx(1, "failed to add name entry"); if (X509_set_subject_name(cert, name) == 0) -- cgit v1.2.3-55-g6feb