diff options
Diffstat (limited to 'Libraries')
| -rw-r--r-- | Libraries/LibTLS/Certificate.h | 3 | ||||
| -rw-r--r-- | Libraries/LibTLS/TLSv12.cpp | 32 |
2 files changed, 31 insertions, 4 deletions
diff --git a/Libraries/LibTLS/Certificate.h b/Libraries/LibTLS/Certificate.h index 2f2de40d87..22953092d4 100644 --- a/Libraries/LibTLS/Certificate.h +++ b/Libraries/LibTLS/Certificate.h @@ -66,8 +66,7 @@ struct Certificate { String entity; String subject; String unit; - u8** SAN; - u16 SAN_length; + Vector<String> SAN; u8* ocsp; Crypto::UnsignedBigInteger serial_number; ByteBuffer sign_key; diff --git a/Libraries/LibTLS/TLSv12.cpp b/Libraries/LibTLS/TLSv12.cpp index cf823f58c8..634f3c7b7f 100644 --- a/Libraries/LibTLS/TLSv12.cpp +++ b/Libraries/LibTLS/TLSv12.cpp @@ -41,7 +41,7 @@ namespace { struct OIDChain { - void* root { nullptr }; + OIDChain* root { nullptr }; u8* oid { nullptr }; }; } @@ -73,6 +73,25 @@ static bool _asn1_is_oid(const u8* oid, const u8* compare, size_t length = 3) return true; } +static bool _asn1_is_oid_in_chain(OIDChain* reference_chain, const u8* lookup, size_t lookup_length = 3) +{ + auto is_oid = [](const u8* oid, size_t oid_length, const u8* compare, size_t compare_length) { + if (oid_length < compare_length) + compare_length = oid_length; + for (size_t i = 0; i < compare_length; i++) { + if (oid[i] != compare[i]) + return false; + } + return true; + }; + for (; reference_chain; reference_chain = reference_chain->root) { + if (reference_chain->oid) + if (is_oid(reference_chain->oid, 16, lookup, lookup_length)) + return true; + } + return false; +} + static bool _set_algorithm(CertificateKeyAlgorithm& algorithm, const u8* value, size_t length) { if (length == 7) { @@ -267,6 +286,12 @@ static ssize_t _parse_asn1(const Context& context, Certificate& cert, const u8* if (length == 1) cert.version = buffer[position]; } + if (chain && length > 2) { + if (_asn1_is_oid_in_chain(chain, Constants::san_oid)) { + StringView alt_name { &buffer[position], length }; + cert.SAN.append(alt_name); + } + } // print_buffer(ByteBuffer::wrap(const_cast<u8*>(buffer) + position, length)); break; case 0x03: @@ -788,9 +813,12 @@ Optional<size_t> TLSv12::verify_chain_and_get_matching_certificate(const StringV for (size_t i = 0; i < m_context.certificates.size(); ++i) { auto& cert = m_context.certificates[i]; - // FIXME: Also check against SAN (oid 2.5.29.17). if (wildcard_matches(host, cert.subject)) return i; + for (auto& san : cert.SAN) { + if (wildcard_matches(host, san)) + return i; + } } return {}; |