package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch

   1 From eb9d4fdf1846e688d51d86a9a50f0312aca2af25 Mon Sep 17 00:00:00 2001
   2 From: Glenn Strauss <gstrauss@gluelogic.com>
   3 Date: Sun, 23 Oct 2022 19:48:18 -0400
   4 Subject: [PATCH] x509 crt verify SAN iPAddress
   5
   6 Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
   7 ---
   8  include/mbedtls/x509_crt.h |   2 +-
   9  library/x509_crt.c         | 126 ++++++++++++++++++++++++++++++-------
  10  2 files changed, 103 insertions(+), 25 deletions(-)
  11
  12 --- a/include/mbedtls/x509_crt.h
  13 +++ b/include/mbedtls/x509_crt.h
  14 @@ -608,7 +608,7 @@ int mbedtls_x509_crt_verify_info(char *b
  15   * \param cn       The expected Common Name. This will be checked to be
  16   *                 present in the certificate's subjectAltNames extension or,
  17   *                 if this extension is absent, as a CN component in its
  18 - *                 Subject name. Currently only DNS names are supported. This
  19 + *                 Subject name. DNS names and IP addresses are supported. This
  20   *                 may be \c NULL if the CN need not be verified.
  21   * \param flags    The address at which to store the result of the verification.
  22   *                 If the verification couldn't be completed, the flag value is
  23 --- a/library/x509_crt.c
  24 +++ b/library/x509_crt.c
  25 @@ -57,6 +57,10 @@
  26
  27  #if defined(MBEDTLS_HAVE_TIME)
  28  #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
  29 +#define WIN32_LEAN_AND_MEAN
  30 +#ifndef _WIN32_WINNT
  31 +#define _WIN32_WINNT 0x0600
  32 +#endif
  33  #include <windows.h>
  34  #else
  35  #include <time.h>
  36 @@ -3002,6 +3006,61 @@ find_parent:
  37      }
  38  }
  39
  40 +#ifdef _WIN32
  41 +#ifdef _MSC_VER
  42 +#pragma comment(lib, "ws2_32.lib")
  43 +#include <winsock2.h>
  44 +#include <ws2tcpip.h>
  45 +#elif (defined(__MINGW32__) || defined(__MINGW64__)) && _WIN32_WINNT >= 0x0600
  46 +#include <winsock2.h>
  47 +#include <ws2tcpip.h>
  48 +#endif
  49 +#elif defined(__sun)
  50 +/* Solaris requires -lsocket -lnsl for inet_pton() */
  51 +#elif defined(__has_include)
  52 +#if __has_include(<sys/socket.h>)
  53 +#include <sys/socket.h>
  54 +#endif
  55 +#if __has_include(<arpa/inet.h>)
  56 +#include <arpa/inet.h>
  57 +#endif
  58 +#endif
  59 +
  60 +/* Use whether or not AF_INET6 is defined to indicate whether or not to use
  61 + * the platform inet_pton() or a local implementation (below).  The local
  62 + * implementation may be used even in cases where the platform provides
  63 + * inet_pton(), e.g. when there are different includes required and/or the
  64 + * platform implementation requires dependencies on additional libraries.
  65 + * Specifically, Windows requires custom includes and additional link
  66 + * dependencies, and Solaris requires additional link dependencies.
  67 + * Also, as a coarse heuristic, use the local implementation if the compiler
  68 + * does not support __has_include(), or if the definition of AF_INET6 is not
  69 + * provided by headers included (or not) via __has_include() above. */
  70 +#ifndef AF_INET6
  71 +
  72 +#define x509_cn_inet_pton(cn, dst) (0)
  73 +
  74 +#else
  75 +
  76 +static int x509_inet_pton_ipv6(const char *src, void *dst)
  77 +{
  78 +    return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
  79 +}
  80 +
  81 +static int x509_inet_pton_ipv4(const char *src, void *dst)
  82 +{
  83 +    return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
  84 +}
  85 +
  86 +#endif /* AF_INET6 */
  87 +
  88 +static size_t x509_cn_inet_pton(const char *cn, void *dst)
  89 +{
  90 +    return strchr(cn, ':') == NULL
  91 +            ? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
  92 +            : x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
  93 +}
  94 +
  95  /*
  96   * Check for CN match
  97   */
  98 @@ -3022,24 +3081,51 @@ static int x509_crt_check_cn(const mbedt
  99      return -1;
 100  }
 101
 102 +static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
 103 +                                 const char *cn, size_t cn_len)
 104 +{
 105 +    uint32_t ip[4];
 106 +    cn_len = x509_cn_inet_pton(cn, ip);
 107 +    if (cn_len == 0) {
 108 +        return -1;
 109 +    }
 110 +
 111 +    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
 112 +        const unsigned char san_type = (unsigned char) cur->buf.tag &
 113 +                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
 114 +        if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
 115 +            cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
 116 +            return 0;
 117 +        }
 118 +    }
 119 +
 120 +    return -1;
 121 +}
 122 +
 123  /*
 124   * Check for SAN match, see RFC 5280 Section 4.2.1.6
 125   */
 126 -static int x509_crt_check_san(const mbedtls_x509_buf *name,
 127 +static int x509_crt_check_san(const mbedtls_x509_sequence *san,
 128                                const char *cn, size_t cn_len)
 129  {
 130 -    const unsigned char san_type = (unsigned char) name->tag &
 131 -                                   MBEDTLS_ASN1_TAG_VALUE_MASK;
 132 -
 133 -    /* dNSName */
 134 -    if (san_type == MBEDTLS_X509_SAN_DNS_NAME) {
 135 -        return x509_crt_check_cn(name, cn, cn_len);
 136 +    int san_ip = 0;
 137 +    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
 138 +        switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
 139 +            case MBEDTLS_X509_SAN_DNS_NAME:                /* dNSName */
 140 +                if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
 141 +                    return 0;
 142 +                }
 143 +                break;
 144 +            case MBEDTLS_X509_SAN_IP_ADDRESS:              /* iPAddress */
 145 +                san_ip = 1;
 146 +                break;
 147 +            /* (We may handle other types here later.) */
 148 +            default: /* Unrecognized type */
 149 +                break;
 150 +        }
 151      }
 152
 153 -    /* (We may handle other types here later.) */
 154 -
 155 -    /* Unrecognized type */
 156 -    return -1;
 157 +    return san_ip ? x509_crt_check_san_ip(san, cn, cn_len) : -1;
 158  }
 159
 160  /*
 161 @@ -3050,31 +3136,23 @@ static void x509_crt_verify_name(const m
 162                                   uint32_t *flags)
 163  {
 164      const mbedtls_x509_name *name;
 165 -    const mbedtls_x509_sequence *cur;
 166      size_t cn_len = strlen(cn);
 167
 168      if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
 169 -        for (cur = &crt->subject_alt_names; cur != NULL; cur = cur->next) {
 170 -            if (x509_crt_check_san(&cur->buf, cn, cn_len) == 0) {
 171 -                break;
 172 -            }
 173 -        }
 174 -
 175 -        if (cur == NULL) {
 176 -            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
 177 +        if (x509_crt_check_san(&crt->subject_alt_names, cn, cn_len) == 0) {
 178 +            return;
 179          }
 180      } else {
 181          for (name = &crt->subject; name != NULL; name = name->next) {
 182              if (MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0 &&
 183                  x509_crt_check_cn(&name->val, cn, cn_len) == 0) {
 184 -                break;
 185 +                return;
 186              }
 187          }
 188
 189 -        if (name == NULL) {
 190 -            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
 191 -        }
 192      }
 193 +
 194 +    *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
 195  }
 196
 197  /*