Skip to contentSkip to conversation

Fix bug that incorrectly refuses oid representation eku's in polar builds

PATCH In review Steffan Karger 3 participants 3 messages Apr 25, 2014 – Jun 24, 2014

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/1 Fix bug that incorrectly refuses oid representation eku's in polar builds

The return value of x509_get_numeric_string() was interpreted incorrectly by ssl_verify_polarssl.c's x509_verify_cert_eku(). This patch enables the usage of oid represenation in --remote-cert-eku options.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl_verify_polarssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
src/openvpn/ssl_verify_polarssl.c +1 -1
index 5db4f02..f2b0574 100644
@@ -340,7 +340,7 @@ x509_verify_cert_eku (x509_cert *cert, const char * const expected_oid)
 		}
 	    }
 
-	  if (0 == x509_oid_get_numeric_string( oid_num_str,
+	  if (0 < x509_oid_get_numeric_string( oid_num_str,
 	      sizeof (oid_num_str), oid))
 	    {
 	      msg (D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
Signature · 1 line
1.8.3.2
#1 lore raw
Quoted 15 lines · Steffan Karger

The return value of x509_get_numeric_string() was interpreted incorrectly by ssl_verify_polarssl.c's x509_verify_cert_eku(). This patch enables the usage of oid represenation in --remote-cert-eku options.

Signed-off-by Steffan Karger <[email protected]...>
---
  src/openvpn/ssl_verify_polarssl.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
src/openvpn/ssl_verify_polarssl.c +0 -0
index 5db4f02..f2b0574 100644

src/openvpn/ssl_verify_polarssl.c x509_verify_cert_eku (x509_cert *cert, const char * const expected_oid) · line 346

Quoted 8 lines
src/openvpn/ssl_verify_polarssl.c +1 -1
@@ -340,7 +340,7 @@ x509_verify_cert_eku (x509_cert *cert, const char * const expected_oid)
  		}
  	    }
 
-	  if (0 == x509_oid_get_numeric_string( oid_num_str,
+	  if (0 < x509_oid_get_numeric_string( oid_num_str,
  	      sizeof (oid_num_str), oid))
  	    {
  	      msg (D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",

ACK.

I've only glared at the code, and read the PolarSSL source code. x509_oid_get_numeric_string() is just calling oid_get_numeric_string() which says:

* \return Length of the string written (excluding final NULL) or
* POLARSSL_ERR_OID_BUF_TO_SMALL in case of error

So returning 0 is not necessarily a failure at all, and POLARSSL_ERR_OID_BUF_TO_SMALL is a negative number (-0x00B).

Signature · 3 lines
kind regards,

David Sommerseth
#2 lore raw
In reply to Steffan Karger

Your patch has been applied to the master and release/2.3 branches.

commit e238b806f5f3843b80d5b1b2b269679210faa7f6 (master) commit 991e3574dd9d11dac61b302377b29d24a46b89b1 (release/2.3)

Author: Steffan Karger
Date:   Fri Apr 25 10:41:17 2014 +0200
     Fix bug that incorrectly refuses oid representation eku's in polar builds

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: David Sommerseth <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8627
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering