githubmirror/gnutls

lib/pcert.c
565 строк15 KB
Daiki Ueno
build: avoid potential integer overflow in array allocation
29 мар 2021, 14:09
29 мар 2021, 14:09584783a
/*
 * Copyright (C) 2011-2012 Free Software Foundation, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

#include "gnutls_int.h"
#include "errors.h"
#include <auth/cert.h>
#include <x509/common.h>
#include <x509.h>
#include "x509/x509_int.h"
#include <gnutls/x509.h>
#include "x509_b64.h"

/**
 * gnutls_pcert_import_x509:
 * @pcert: The pcert structure
 * @crt: The certificate to be imported
 * @flags: zero for now
 *
 * This convenience function will import the given certificate to a
 * #gnutls_pcert_st structure. The structure must be deinitialized
 * afterwards using gnutls_pcert_deinit();
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.0
 **/
int gnutls_pcert_import_x509(gnutls_pcert_st * pcert,
			     gnutls_x509_crt_t crt, unsigned int flags)
{
	int ret;

	memset(pcert, 0, sizeof(*pcert));

	pcert->type = GNUTLS_CRT_X509;
	pcert->cert.data = NULL;

	ret =
	    gnutls_x509_crt_export2(crt, GNUTLS_X509_FMT_DER,
				    &pcert->cert);
	if (ret < 0) {
		ret = gnutls_assert_val(ret);
		goto cleanup;
	}

	ret = gnutls_pubkey_init(&pcert->pubkey);
	if (ret < 0) {
		ret = gnutls_assert_val(ret);
		goto cleanup;
	}

	ret = gnutls_pubkey_import_x509(pcert->pubkey, crt, 0);
	if (ret < 0) {
		gnutls_pubkey_deinit(pcert->pubkey);
		pcert->pubkey = NULL;
		ret = gnutls_assert_val(ret);
		goto cleanup;
	}

	return 0;

      cleanup:
	_gnutls_free_datum(&pcert->cert);

	return ret;
}

/**
 * gnutls_pcert_import_x509_list:
 * @pcert_list: The structures to store the certificates; must not contain initialized #gnutls_pcert_st structures.
 * @crt: The certificates to be imported
 * @ncrt: The number of certificates in @crt; will be updated if necessary
 * @flags: zero or %GNUTLS_X509_CRT_LIST_SORT
 *
 * This convenience function will import the given certificates to an
 * already allocated set of #gnutls_pcert_st structures. The structures must
 * be deinitialized afterwards using gnutls_pcert_deinit(). @pcert_list
 * should contain space for at least @ncrt elements.
 *
 * In the case %GNUTLS_X509_CRT_LIST_SORT is specified and that
 * function cannot sort the list, %GNUTLS_E_CERTIFICATE_LIST_UNSORTED
 * will be returned. Currently sorting can fail if the list size
 * exceeds an internal constraint (16).
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.4.0
 **/
int gnutls_pcert_import_x509_list(gnutls_pcert_st * pcert_list,
				  gnutls_x509_crt_t *crt, unsigned *ncrt,
				  unsigned int flags)
{
	int ret;
	unsigned i;
	unsigned current = 0;
	gnutls_x509_crt_t sorted[DEFAULT_MAX_VERIFY_DEPTH];
	gnutls_x509_crt_t *s;

	s = crt;

	if (flags & GNUTLS_X509_CRT_LIST_SORT && *ncrt > 1) {
		if (*ncrt > DEFAULT_MAX_VERIFY_DEPTH) {
			ret = _gnutls_check_if_sorted(s, *ncrt);
			if (ret < 0) {
				gnutls_assert();
				return GNUTLS_E_CERTIFICATE_LIST_UNSORTED;
			}
		} else {
			for (i = 0; i < *ncrt; i++) {
				sorted[i] = s[i];
			}
			s = sorted;
			*ncrt = _gnutls_sort_clist(s, *ncrt);
		}
	}

	for (i=0;i<*ncrt;i++) {
		ret = gnutls_pcert_import_x509(&pcert_list[i], s[i], 0);
		if (ret < 0) {
			current = i;
			goto cleanup;
		}
	}

	return 0;

 cleanup:
	for (i=0;i<current;i++) {
		gnutls_pcert_deinit(&pcert_list[i]);
	}
	return ret;

}

/**
 * gnutls_pcert_list_import_x509_raw:
 * @pcert_list: The structures to store the certificates; must not contain initialized #gnutls_pcert_st structures.
 * @pcert_list_size: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
 * @data: The certificates.
 * @format: One of DER or PEM.
 * @flags: must be (0) or an OR'd sequence of gnutls_certificate_import_flags.
 *
 * This function will import the provided DER or PEM encoded certificates to an
 * already allocated set of #gnutls_pcert_st structures. The structures must
 * be deinitialized afterwards using gnutls_pcert_deinit(). @pcert_list
 * should contain space for at least @pcert_list_size elements.
 *
 * If the Certificate is PEM encoded it should have a header of "X509
 * CERTIFICATE", or "CERTIFICATE".
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value; if the @pcert list doesn't have enough space
 *   %GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
 *
 * Since: 3.0
 **/
int
gnutls_pcert_list_import_x509_raw(gnutls_pcert_st *pcert_list,
				  unsigned int *pcert_list_size,
				  const gnutls_datum_t *data,
				  gnutls_x509_crt_fmt_t format,
				  unsigned int flags)
{
	int ret;
	unsigned int i = 0, j;
	gnutls_x509_crt_t *crt;

	crt = _gnutls_reallocarray(NULL, *pcert_list_size,
				   sizeof(gnutls_x509_crt_t));

	if (crt == NULL)
		return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

	ret =
	    gnutls_x509_crt_list_import(crt, pcert_list_size, data, format,
					flags);
	if (ret < 0) {
		ret = gnutls_assert_val(ret);
		goto cleanup_crt;
	}

	for (i = 0; i < *pcert_list_size; i++) {
		ret = gnutls_pcert_import_x509(&pcert_list[i], crt[i], flags);
		if (ret < 0) {
			ret = gnutls_assert_val(ret);
			goto cleanup_pcert;
		}
	}

	ret = 0;
	goto cleanup;

 cleanup_pcert:
	for (j = 0; j < i; j++)
		gnutls_pcert_deinit(&pcert_list[j]);

 cleanup:
	for (i = 0; i < *pcert_list_size; i++)
		gnutls_x509_crt_deinit(crt[i]);

 cleanup_crt:
	gnutls_free(crt);
	return ret;

}

/**
 * gnutls_pcert_list_import_x509_url:
 * @pcert_list: The structures to store the certificates; must not contain initialized #gnutls_pcert_st structures.
 * @pcert_list_size: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
 * @file: A file or supported URI with the certificates to load
 * @format: %GNUTLS_X509_FMT_DER or %GNUTLS_X509_FMT_PEM if a file is given
 * @pin_fn: a PIN callback if not globally set
 * @pin_fn_userdata: parameter for the PIN callback
 * @flags: zero or flags from %gnutls_certificate_import_flags
 *
 * This convenience function will import a certificate chain from the given
 * file or supported URI to #gnutls_pcert_st structures. The structures
 * must be deinitialized afterwards using gnutls_pcert_deinit().
 *
 * This function will always return a sorted certificate chain.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value; if the @pcert list doesn't have enough space
 *   %GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
 *
 * Since: 3.6.3
 **/
int gnutls_pcert_list_import_x509_file(gnutls_pcert_st *pcert_list,
				       unsigned *pcert_list_size,
				       const char *file,
				       gnutls_x509_crt_fmt_t format,
				       gnutls_pin_callback_t pin_fn,
				       void *pin_fn_userdata,
				       unsigned int flags)
{
	int ret, ret2;
	unsigned i;
	gnutls_x509_crt_t *crts = NULL;
	unsigned crts_size = 0;
	gnutls_datum_t data = {NULL, 0};

	if (gnutls_url_is_supported(file) != 0) {
		ret = gnutls_x509_crt_list_import_url(&crts, &crts_size, file, pin_fn, pin_fn_userdata, 0);
		if (ret < 0) {
			ret2 = gnutls_x509_crt_list_import_url(&crts, &crts_size, file, pin_fn, pin_fn_userdata, GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
			if (ret2 >= 0) ret = ret2;
		}

		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

	} else { /* file */
		ret = gnutls_load_file(file, &data);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret = gnutls_x509_crt_list_import2(&crts, &crts_size, &data, format, flags|GNUTLS_X509_CRT_LIST_SORT);
		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}
	}

	if (crts_size > *pcert_list_size) {
		gnutls_assert();
		ret = GNUTLS_E_SHORT_MEMORY_BUFFER;
		goto cleanup;
	}

	ret = gnutls_pcert_import_x509_list(pcert_list, crts, &crts_size, flags);
	if (ret < 0) {
		gnutls_assert();
		goto cleanup;
	}
	*pcert_list_size = crts_size;

	ret = 0;
cleanup:
	for (i=0;i<crts_size;i++)
		gnutls_x509_crt_deinit(crts[i]);
	gnutls_free(crts);
	gnutls_free(data.data);
	return ret;
}


/**
 * gnutls_pcert_import_x509_raw:
 * @pcert: The pcert structure
 * @cert: The raw certificate to be imported
 * @format: The format of the certificate
 * @flags: zero for now
 *
 * This convenience function will import the given certificate to a
 * #gnutls_pcert_st structure. The structure must be deinitialized
 * afterwards using gnutls_pcert_deinit();
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.0
 **/
int gnutls_pcert_import_x509_raw(gnutls_pcert_st * pcert,
				 const gnutls_datum_t * cert,
				 gnutls_x509_crt_fmt_t format,
				 unsigned int flags)
{
	int ret;
	gnutls_x509_crt_t crt;

	memset(pcert, 0, sizeof(*pcert));

	ret = gnutls_x509_crt_init(&crt);
	if (ret < 0)
		return gnutls_assert_val(ret);

	ret = gnutls_x509_crt_import(crt, cert, format);
	if (ret < 0) {
		ret = gnutls_assert_val(ret);
		goto cleanup;
	}

	ret = gnutls_pcert_import_x509(pcert, crt, flags);
	if (ret < 0) {
		ret = gnutls_assert_val(ret);
		goto cleanup;
	}

	ret = 0;

      cleanup:
	gnutls_x509_crt_deinit(crt);

	return ret;
}

/**
 * gnutls_pcert_import_rawpk:
 * @pcert: The pcert structure to import the data into.
 * @pubkey: The raw public-key in #gnutls_pubkey_t format to be imported
 * @flags: zero for now
 *
 * This convenience function will import (i.e. convert) the given raw
 * public key @pubkey into a #gnutls_pcert_st structure. The structure
 * must be deinitialized afterwards using gnutls_pcert_deinit(). The
 * given @pubkey must not be deinitialized because it will be associated
 * with the given @pcert structure and will be deinitialized with it.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.6.6
 **/
int gnutls_pcert_import_rawpk(gnutls_pcert_st* pcert,
			     gnutls_pubkey_t pubkey, unsigned int flags)
{
	int ret;

	if (pubkey == NULL) {
		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_CREDENTIALS);
	}

	memset(pcert, 0, sizeof(*pcert));

	/* A pcert struct holds a raw copy of the certificate data.
	 * Therefore we convert our gnutls_pubkey_t to its raw DER
	 * representation and copy it into our pcert. It is this raw data
	 * that will be transferred to the peer via a Certificate msg.
	 * According to the spec (RFC7250) a DER representation must be used.
	 */
	ret = gnutls_pubkey_export2(pubkey, GNUTLS_X509_FMT_DER, &pcert->cert);
	if (ret < 0) {
		return gnutls_assert_val(ret);
	}

	pcert->pubkey = pubkey;

	pcert->type = GNUTLS_CRT_RAWPK;

	return GNUTLS_E_SUCCESS;
}

/**
 * gnutls_pcert_import_rawpk_raw:
 * @pcert: The pcert structure to import the data into.
 * @rawpubkey: The raw public-key in #gnutls_datum_t format to be imported.
 * @format: The format of the raw public-key. DER or PEM.
 * @key_usage: An ORed sequence of %GNUTLS_KEY_* flags.
 * @flags: zero for now
 *
 * This convenience function will import (i.e. convert) the given raw
 * public key @rawpubkey into a #gnutls_pcert_st structure. The structure
 * must be deinitialized afterwards using gnutls_pcert_deinit().
 * Note that the caller is responsible for freeing @rawpubkey. All necessary
 * values will be copied into @pcert.
 *
 * Key usage (as defined by X.509 extension (2.5.29.15)) can be explicitly
 * set because there is no certificate structure around the key to define
 * this value. See for more info gnutls_x509_crt_get_key_usage().
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.6.6
 **/
int gnutls_pcert_import_rawpk_raw(gnutls_pcert_st* pcert,
				    const gnutls_datum_t* rawpubkey,
				    gnutls_x509_crt_fmt_t format,
				    unsigned int key_usage, unsigned int flags)
{
	int ret;

	if (rawpubkey == NULL) {
		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_CREDENTIALS);
	}

	memset(pcert, 0, sizeof(*pcert));

	ret = gnutls_pubkey_init(&pcert->pubkey);
	if (ret < 0) {
		return gnutls_assert_val(ret);
	}

	// Convert our raw public-key to a gnutls_pubkey_t structure
	ret = gnutls_pubkey_import(pcert->pubkey, rawpubkey, format);
	if (ret < 0) {
		return gnutls_assert_val(ret);
	}

	pcert->pubkey->key_usage = key_usage;

	/* A pcert struct holds a raw copy of the certificate data.
	 * It is this raw data that will be transferred to the peer via a
	 * Certificate message. According to the spec (RFC7250) a DER
	 * representation must be used. Therefore we check the format and
	 * convert if necessary.
	 */
	if (format == GNUTLS_X509_FMT_PEM) {
		ret = _gnutls_fbase64_decode(PEM_PK,
					rawpubkey->data, rawpubkey->size,
					&pcert->cert);

		if (ret < 0) {
			gnutls_pubkey_deinit(pcert->pubkey);

			return gnutls_assert_val(ret);
		}
	} else {
		// Directly copy the raw DER data to our pcert
		ret = _gnutls_set_datum(&pcert->cert, rawpubkey->data, rawpubkey->size);

		if (ret < 0) {
			gnutls_pubkey_deinit(pcert->pubkey);

			return gnutls_assert_val(ret);
		}
	}

	pcert->type = GNUTLS_CRT_RAWPK;

	return GNUTLS_E_SUCCESS;
}

/**
 * gnutls_pcert_export_x509:
 * @pcert: The pcert structure.
 * @crt: An initialized #gnutls_x509_crt_t.
 *
 * Converts the given #gnutls_pcert_t type into a #gnutls_x509_crt_t.
 * This function only works if the type of @pcert is %GNUTLS_CRT_X509.
 * When successful, the value written to @crt must be freed with
 * gnutls_x509_crt_deinit() when no longer needed.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 * negative error value.
 *
 * Since: 3.4.0
 */
int gnutls_pcert_export_x509(gnutls_pcert_st * pcert,
			     gnutls_x509_crt_t * crt)
{
	int ret;

	if (pcert->type != GNUTLS_CRT_X509) {
		gnutls_assert();
		return GNUTLS_E_INVALID_REQUEST;
	}

	ret = gnutls_x509_crt_init(crt);
	if (ret < 0)
		return gnutls_assert_val(ret);

	ret = gnutls_x509_crt_import(*crt, &pcert->cert, GNUTLS_X509_FMT_DER);
	if (ret < 0) {
		gnutls_x509_crt_deinit(*crt);
		*crt = NULL;

		return gnutls_assert_val(ret);
	}

	return 0;
}

/**
 * gnutls_pcert_deinit:
 * @pcert: The structure to be deinitialized
 *
 * This function will deinitialize a pcert structure.
 *
 * Since: 3.0
 **/
void gnutls_pcert_deinit(gnutls_pcert_st * pcert)
{
	if (pcert->pubkey)
		gnutls_pubkey_deinit(pcert->pubkey);
	pcert->pubkey = NULL;
	_gnutls_free_datum(&pcert->cert);
}

/* Converts the first certificate for the cert_auth_info structure
 * to a pcert.
 */
int
_gnutls_get_auth_info_pcert(gnutls_pcert_st * pcert,
			    gnutls_certificate_type_t type,
			    cert_auth_info_t info)
{
	switch (type) {
		case GNUTLS_CRT_X509:
			return gnutls_pcert_import_x509_raw(pcert,
							&info->raw_certificate_list[0],
							GNUTLS_X509_FMT_DER,
							0);
		case GNUTLS_CRT_RAWPK:
			return gnutls_pcert_import_rawpk_raw(pcert,
							&info->raw_certificate_list[0],
							GNUTLS_X509_FMT_DER,
							0, 0);
		default:
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
	}
}