upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-09 00:42:51 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

mbedtls: correctly check return value in pkcs11_certificate_dn()

Browse source 
mbedtls_x509_dn_gets() would not always return -1 error, which could cause
us to incorrectly continue after the function call failed.  To fix this,
just call our own x509_get_subject(), which does all the neccesary error
checking correctly.

pkcs11_certificate_dn() is only called by show_pkcs11_ids(), to list the
certificates on the pkcs11 token.  Therefor, this mistake did not have a
security impact.

This issue was found by Quarkslab during the OSTIF-founded security audit
(issue 5.3).

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1494317563-6303-1-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14591.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
This commit is contained in:
Steffan Karger 2017-05-09 10:12:43 +02:00 committed by David Sommerseth
parent 81ba70b39b
commit 423bb16e8a
1 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/openvpn/pkcs11_mbedtls.c
View file

@ -39,6 +39,7 @@
#include "errlevel.h"
#include "pkcs11_backend.h"
#include "ssl_verify_backend.h"
#include <mbedtls/pkcs11.h>
#include <mbedtls/x509.h>
@ -82,8 +83,6 @@ char *
pkcs11_certificate_dn(pkcs11h_certificate_t cert, struct gc_arena *gc)
{
char *ret = NULL;
char dn[1024] = {0};
mbedtls_x509_crt mbed_crt = {0};
if (mbedtls_pkcs11_x509_cert_bind(&mbed_crt, cert))
@ -92,14 +91,12 @@ pkcs11_certificate_dn(pkcs11h_certificate_t cert, struct gc_arena *gc)
goto cleanup;
}
if (-1 == mbedtls_x509_dn_gets(dn, sizeof(dn), &mbed_crt.subject))
if (!(ret = x509_get_subject(&mbed_crt, gc)))
{
msg(M_FATAL, "PKCS#11: mbed TLS cannot parse subject");
goto cleanup;
}
ret = string_alloc(dn, gc);
cleanup:
mbedtls_x509_crt_free(&mbed_crt);