Skip to content

Commit 3372701

Browse files
lealem47lealem47
committed
Store crlNumber as a byte array
1 parent 8a93883 commit 3372701

File tree

6 files changed

+74
-53
lines changed

6 files changed

+74
-53
lines changed

‎src/crl.c

+26-4
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,8 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
139139
#endif
140140
dcrl->certs = NULL;
141141
crle->totalCerts = dcrl->totalCerts;
142-
crle->crlNumber = dcrl->crlNumber;
142+
XMEMCPY(crle->crlNumber, dcrl->crlNumber, CRL_MAX_NUM_SZ);
143+
crle->crlNumberSet = dcrl->crlNumberSet;
143144
crle->verified = verified;
144145
if (!verified) {
145146
crle->tbsSz = dcrl->sigIndex - dcrl->certBegin;
@@ -590,7 +591,8 @@ static void SetCrlInfo(CRL_Entry* entry, CrlInfo *info)
590591
info->nextDate = (byte *)entry->nextDate;
591592
info->nextDateMaxLen = MAX_DATE_SIZE;
592593
info->nextDateFormat = entry->nextDateFormat;
593-
info->crlNumber = (sword32)entry->crlNumber;
594+
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
595+
info->crlNumberSet = entry->crlNumberSet;
594596
}
595597

596598
static void SetCrlInfoFromDecoded(DecodedCRL* entry, CrlInfo *info)
@@ -603,10 +605,30 @@ static void SetCrlInfoFromDecoded(DecodedCRL* entry, CrlInfo *info)
603605
info->nextDate = (byte *)entry->nextDate;
604606
info->nextDateMaxLen = MAX_DATE_SIZE;
605607
info->nextDateFormat = entry->nextDateFormat;
606-
info->crlNumber = (sword32)entry->crlNumber;
608+
XMEMCPY(info->crlNumber, entry->crlNumber, CRL_MAX_NUM_SZ);
609+
info->crlNumberSet = entry->crlNumberSet;
607610
}
608611
#endif
609612

613+
/* Returns 1 if prev crlNumber is smaller, 0 otherwise */
614+
static int CompareCRLnumber(CRL_Entry* prev, CRL_Entry* curr) {
615+
word32 i;
616+
word32 prevCrlNumLen = (word32)XSTRLEN((char*)prev->crlNumber);
617+
word32 currCrlNumLen = (word32)XSTRLEN((char*)curr->crlNumber);
618+
619+
if (prevCrlNumLen != currCrlNumLen) {
620+
return (prevCrlNumLen < currCrlNumLen);
621+
}
622+
623+
for (i = 0; i < currCrlNumLen; i++) {
624+
if (prev->crlNumber[i] != curr->crlNumber[i]) {
625+
return prev->crlNumber[i] < curr->crlNumber[i];
626+
}
627+
}
628+
629+
return 1;
630+
}
631+
610632
/* Add Decoded CRL, 0 on success */
611633
static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
612634
int verified)
@@ -648,7 +670,7 @@ static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
648670

649671
for (curr = crl->crlList; curr != NULL; curr = curr->next) {
650672
if (XMEMCMP(curr->issuerHash, crle->issuerHash, CRL_DIGEST_SIZE) == 0) {
651-
if (crle->crlNumber <= curr->crlNumber) {
673+
if (CompareCRLnumber(crle, curr)) {
652674
WOLFSSL_MSG("Same or newer CRL entry already exists");
653675
CRL_Entry_free(crle, crl->heap);
654676
wc_UnLockRwLock(&crl->crlLock);

‎src/x509.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -8951,7 +8951,7 @@ static int X509CRLPrintExtensions(WOLFSSL_BIO* bio, WOLFSSL_X509_CRL* crl,
89518951
return WOLFSSL_FAILURE;
89528952
}
89538953

8954-
if (crl->crlList->crlNumber) {
8954+
if (crl->crlList->crlNumberSet) {
89558955
if (XSNPRINTF(tmp, MAX_WIDTH, "%*s%s\n", indent + 4, "",
89568956
"X509v3 CRL Number:") >= MAX_WIDTH) {
89578957
return WOLFSSL_FAILURE;
@@ -8961,11 +8961,11 @@ static int X509CRLPrintExtensions(WOLFSSL_BIO* bio, WOLFSSL_X509_CRL* crl,
89618961
return WOLFSSL_FAILURE;
89628962
}
89638963

8964-
if (XSNPRINTF(tmp, MAX_WIDTH, "%*s%d\n", indent + 8, "",
8965-
crl->crlList->crlNumber) >= MAX_WIDTH)
8966-
{
8964+
if (XSNPRINTF(tmp, MAX_WIDTH, "%*s%s\n", indent + 8, "",
8965+
crl->crlList->crlNumber) >= MAX_WIDTH) {
89678966
return WOLFSSL_FAILURE;
89688967
}
8968+
89698969
if (wolfSSL_BIO_write(bio, tmp, (int)XSTRLEN(tmp)) <= 0) {
89708970
return WOLFSSL_FAILURE;
89718971
}

‎wolfcrypt/src/asn.c

+33-42
Original file line numberDiff line numberDiff line change
@@ -39077,50 +39077,38 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf,
3907739077
return ret;
3907839078
}
3907939079
else {
39080-
if (length > 1) {
39081-
int i;
39082-
#ifdef WOLFSSL_SMALL_STACK
39083-
mp_int* m = (mp_int*)XMALLOC(sizeof(*m), NULL,
39084-
DYNAMIC_TYPE_BIGINT);
39085-
if (m == NULL) {
39086-
return MEMORY_E;
39087-
}
39088-
#else
39089-
mp_int m[1];
39090-
#endif
39080+
#ifdef WOLFSSL_SMALL_STACK
39081+
mp_int* m = (mp_int*)XMALLOC(sizeof(*m), NULL,
39082+
DYNAMIC_TYPE_BIGINT);
39083+
if (m == NULL) {
39084+
return MEMORY_E;
39085+
}
39086+
#else
39087+
mp_int m[1];
39088+
#endif
3909139089

39092-
if (mp_init(m) != MP_OKAY) {
39093-
ret = MP_INIT_E;
39094-
}
39090+
if (mp_init(m) != MP_OKAY) {
39091+
ret = MP_INIT_E;
39092+
}
3909539093

39096-
if (ret == 0)
39097-
ret = mp_read_unsigned_bin(m, buf + idx, length);
39098-
if (ret != MP_OKAY)
39099-
ret = BUFFER_E;
39094+
if (ret == 0)
39095+
ret = mp_read_unsigned_bin(m, buf + idx, length);
39096+
if (ret != MP_OKAY)
39097+
ret = BUFFER_E;
3910039098

39101-
if (ret == 0) {
39102-
dcrl->crlNumber = 0;
39103-
for (i = 0; i < (int)(*m).used; ++i) {
39104-
if (i > (CHAR_BIT *
39105-
(int)sizeof(word32) / DIGIT_BIT)) {
39106-
break;
39107-
}
39108-
dcrl->crlNumber |= ((word32)(*m).dp[i]) <<
39109-
(DIGIT_BIT * i);
39110-
}
39111-
}
39099+
if (ret == 0 && mp_toradix(m, (char*)dcrl->crlNumber, MP_RADIX_DEC)
39100+
!= MP_OKAY)
39101+
ret = BUFFER_E;
3911239102

39113-
mp_free(m);
39114-
#ifdef WOLFSSL_SMALL_STACK
39115-
XFREE(m, NULL, DYNAMIC_TYPE_BIGINT);
39116-
#endif
39103+
dcrl->crlNumberSet = 1;
3911739104

39118-
if (ret != 0)
39119-
return ret;
39120-
}
39121-
else if (length == 1) {
39122-
dcrl->crlNumber = buf[idx];
39123-
}
39105+
mp_free(m);
39106+
#ifdef WOLFSSL_SMALL_STACK
39107+
XFREE(m, NULL, DYNAMIC_TYPE_BIGINT);
39108+
#endif
39109+
39110+
if (ret != 0)
39111+
return ret;
3912439112
}
3912539113
}
3912639114
}
@@ -39198,9 +39186,12 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32 idx,
3919839186
if (ret == 0) {
3919939187
ret = GetInt(m, buf, &localIdx, maxIdx);
3920039188
}
39201-
if (ret == 0) {
39202-
dcrl->crlNumber = (int)m->dp[0];
39203-
}
39189+
39190+
if (ret == 0 && mp_toradix(m, (char*)dcrl->crlNumber, MP_RADIX_DEC)
39191+
!= MP_OKAY)
39192+
ret = BUFFER_E;
39193+
39194+
dcrl->crlNumberSet = 1;
3920439195

3920539196
mp_free(m);
3920639197
#ifdef WOLFSSL_SMALL_STACK

‎wolfssl/internal.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -2560,6 +2560,8 @@ struct CRL_Entry {
25602560
/* DupCRL_Entry copies data after the `verifyMutex` member. Using the mutex
25612561
* as the marker because clang-tidy doesn't like taking the sizeof a
25622562
* pointer. */
2563+
byte crlNumber[CRL_MAX_NUM_SZ]; /* CRL number extension */
2564+
byte crlNumberSet; /* CRL number set indicator */
25632565
byte issuerHash[CRL_DIGEST_SIZE]; /* issuer hash */
25642566
/* byte crlHash[CRL_DIGEST_SIZE]; raw crl data hash */
25652567
/* restore the hash here if needed for optimized comparisons */
@@ -2590,7 +2592,6 @@ struct CRL_Entry {
25902592
byte extAuthKeyIdSet;
25912593
byte extAuthKeyId[KEYID_SIZE];
25922594
#endif
2593-
int crlNumber; /* CRL number extension */
25942595
};
25952596

25962597

‎wolfssl/ssl.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -3748,6 +3748,8 @@ typedef int (*CbCrlIO)(WOLFSSL_CRL* crl, const char* url, int urlSz);
37483748

37493749
#ifdef HAVE_CRL_UPDATE_CB
37503750
typedef struct CrlInfo {
3751+
byte crlNumber[CRL_MAX_NUM_SZ];
3752+
byte crlNumberSet;
37513753
byte *issuerHash;
37523754
word32 issuerHashLen;
37533755
byte *lastDate;
@@ -3756,7 +3758,6 @@ typedef struct CrlInfo {
37563758
byte *nextDate;
37573759
word32 nextDateMaxLen;
37583760
byte nextDateFormat;
3759-
sword32 crlNumber;
37603761
} CrlInfo;
37613762

37623763
typedef void (*CbUpdateCRL)(CrlInfo* old, CrlInfo* cnew);

‎wolfssl/wolfcrypt/asn.h

+7-1
Original file line numberDiff line numberDiff line change
@@ -2852,6 +2852,11 @@ struct RevokedCert {
28522852
byte revDateFormat;
28532853
};
28542854

2855+
#ifndef CRL_MAX_NUM_SZ
2856+
#define CRL_MAX_NUM_SZ 49 /* RFC5280 states that CRL number can be up to 20 */
2857+
#endif /* octets long i.e 49 digits */
2858+
2859+
28552860
typedef struct DecodedCRL DecodedCRL;
28562861

28572862
struct DecodedCRL {
@@ -2864,6 +2869,8 @@ struct DecodedCRL {
28642869
word32 sigParamsLength; /* length of signature parameters */
28652870
#endif
28662871
byte* signature; /* pointer into raw source, not owned */
2872+
byte crlNumber[CRL_MAX_NUM_SZ]; /* CRL number extension */
2873+
byte crlNumberSet; /* CRL number set indicator */
28672874
byte issuerHash[SIGNER_DIGEST_SIZE]; /* issuer name hash */
28682875
byte crlHash[SIGNER_DIGEST_SIZE]; /* raw crl data hash */
28692876
byte lastDate[MAX_DATE_SIZE]; /* last date updated */
@@ -2882,7 +2889,6 @@ struct DecodedCRL {
28822889
byte extAuthKeyIdSet;
28832890
byte extAuthKeyId[SIGNER_DIGEST_SIZE]; /* Authority Key ID */
28842891
#endif
2885-
int crlNumber; /* CRL number extension */
28862892
};
28872893

28882894
WOLFSSL_LOCAL void InitDecodedCRL(DecodedCRL* dcrl, void* heap);

0 commit comments

Comments
 (0)