Skip to content

Commit e1373f0

Browse files
ColtonWilleyColtonWilley
committed
Fix X509 load locations to handle PEM files with multiple certs
Adds X509LoadPemFile to walk multi-cert PEM files when loading via wolfSSL_X509_STORE_load_locations and X509_LOOKUP_load_file, replacing the single-cert helpers X509StoreReadFile/X509StoreLoadFile which only read the first cert from a file. Rebased fresh onto current upstream master (was 2209 commits behind); test additions deferred to a follow-up since the test file layout has been reorganized in master.
1 parent 5074cf3 commit e1373f0

3 files changed

Lines changed: 34 additions & 102 deletions

File tree

‎src/x509.c‎

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8289,19 +8289,7 @@ const char* wolfSSL_X509_verify_cert_error_string(long err)
82898289

82908290
#ifdef OPENSSL_EXTRA
82918291

8292-
/* Add directory path that will be used for loading certs and CRLs
8293-
* which have the <hash>.rn name format.
8294-
* type may be WOLFSSL_FILETYPE_PEM or WOLFSSL_FILETYPE_ASN1.
8295-
* returns WOLFSSL_SUCCESS on successful, otherwise negative or zero. */
8296-
int wolfSSL_X509_LOOKUP_add_dir(WOLFSSL_X509_LOOKUP* lookup, const char* dir,
8297-
long type)
8298-
{
8299-
return wolfSSL_X509_LOOKUP_ctrl(lookup, WOLFSSL_X509_L_ADD_DIR, dir, type,
8300-
NULL);
8301-
}
8302-
8303-
int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
8304-
const char* file, long type)
8292+
int X509LoadPemFile(WOLFSSL_X509_STORE *store, const char* file)
83058293
{
83068294
#if !defined(NO_FILESYSTEM) && \
83078295
(defined(WOLFSSL_PEM_TO_DER) || defined(WOLFSSL_DER_TO_PEM))
@@ -8314,9 +8302,6 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
83148302
const char* header = NULL;
83158303
const char* footer = NULL;
83168304

8317-
if (type != WOLFSSL_FILETYPE_PEM)
8318-
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
8319-
83208305
fp = XFOPEN(file, "rb");
83218306
if (fp == XBADFILE)
83228307
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
@@ -8352,7 +8337,7 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
83528337
if (wc_PemGetHeaderFooter(CRL_TYPE, &header, &footer) == 0 &&
83538338
XSTRNSTR((char*)curr, header, sz) != NULL) {
83548339
#ifdef HAVE_CRL
8355-
WOLFSSL_CERT_MANAGER* cm = lookup->store->cm;
8340+
WOLFSSL_CERT_MANAGER* cm = store->cm;
83568341

83578342
if (cm->crl == NULL) {
83588343
if (wolfSSL_CertManagerEnableCRL(cm, WOLFSSL_CRL_CHECK)
@@ -8370,7 +8355,7 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
83708355
curr = (byte*)XSTRNSTR((char*)curr, footer, sz);
83718356
}
83728357
else if (wc_PemGetHeaderFooter(CERT_TYPE, &header, &footer) == 0 &&
8373-
XSTRNSTR((char*)curr, header, sz) != NULL) {
8358+
XSTRNSTR((char*)curr, header, (unsigned int)sz) != NULL) {
83748359
ret = X509StoreLoadCertBuffer(lookup->store, curr,
83758360
(word32)sz, WOLFSSL_FILETYPE_PEM);
83768361
if (ret != WOLFSSL_SUCCESS)
@@ -8393,6 +8378,34 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
83938378
XFREE(pem, 0, DYNAMIC_TYPE_PEM);
83948379
XFCLOSE(fp);
83958380
return WS_RETURN_CODE(ret, (int)WOLFSSL_FAILURE);
8381+
#else
8382+
(void)store;
8383+
(void)file;
8384+
return WS_RETURN_CODE(WOLFSSL_FAILURE,WOLFSSL_FAILURE);
8385+
#endif
8386+
}
8387+
8388+
/* Add directory path that will be used for loading certs and CRLs
8389+
* which have the <hash>.rn name format.
8390+
* type may be WOLFSSL_FILETYPE_PEM or WOLFSSL_FILETYPE_ASN1.
8391+
* returns WOLFSSL_SUCCESS on successful, otherwise negative or zero. */
8392+
int wolfSSL_X509_LOOKUP_add_dir(WOLFSSL_X509_LOOKUP* lookup, const char* dir,
8393+
long type)
8394+
{
8395+
return wolfSSL_X509_LOOKUP_ctrl(lookup, WOLFSSL_X509_L_ADD_DIR, dir, type,
8396+
NULL);
8397+
}
8398+
8399+
int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
8400+
const char* file, long type)
8401+
{
8402+
#if !defined(NO_FILESYSTEM) && \
8403+
(defined(WOLFSSL_PEM_TO_DER) || defined(WOLFSSL_DER_TO_PEM))
8404+
8405+
if (type != WOLFSSL_FILETYPE_PEM)
8406+
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
8407+
8408+
return X509LoadPemFile(lookup->store, file);
83968409
#else
83978410
(void)lookup;
83988411
(void)file;

‎src/x509_str.c‎

Lines changed: 2 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1891,74 +1891,6 @@ int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str,
18911891

18921892
#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
18931893

1894-
static int X509StoreReadFile(const char *fname,
1895-
StaticBuffer *content, word32 *bytesRead, int *type)
1896-
{
1897-
int ret = -1;
1898-
long sz = 0;
1899-
#ifdef HAVE_CRL
1900-
const char* header = NULL;
1901-
const char* footer = NULL;
1902-
#endif
1903-
1904-
ret = wolfssl_read_file_static(fname, content, NULL, DYNAMIC_TYPE_FILE,
1905-
&sz);
1906-
if (ret == 0) {
1907-
*type = CERT_TYPE;
1908-
*bytesRead = (word32)sz;
1909-
#ifdef HAVE_CRL
1910-
/* Look for CRL header and footer. */
1911-
if (wc_PemGetHeaderFooter(CRL_TYPE, &header, &footer) == 0 &&
1912-
(XSTRNSTR((char*)content->buffer, header, sz) !=
1913-
NULL)) {
1914-
*type = CRL_TYPE;
1915-
}
1916-
#endif
1917-
}
1918-
1919-
return (ret == 0 ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE);
1920-
}
1921-
1922-
static int X509StoreLoadFile(WOLFSSL_X509_STORE *str,
1923-
const char *fname)
1924-
{
1925-
int ret = WOLFSSL_SUCCESS;
1926-
int type = 0;
1927-
#ifndef WOLFSSL_SMALL_STACK
1928-
byte stackBuffer[FILE_BUFFER_SIZE];
1929-
#endif
1930-
StaticBuffer content;
1931-
word32 contentLen = 0;
1932-
1933-
#ifdef WOLFSSL_SMALL_STACK
1934-
static_buffer_init(&content);
1935-
#else
1936-
static_buffer_init(&content, stackBuffer, FILE_BUFFER_SIZE);
1937-
#endif
1938-
1939-
WOLFSSL_MSG_EX("X509StoreLoadFile: Loading file: %s", fname);
1940-
1941-
ret = X509StoreReadFile(fname, &content, &contentLen, &type);
1942-
if (ret != WOLFSSL_SUCCESS) {
1943-
WOLFSSL_MSG("Failed to load file");
1944-
ret = WOLFSSL_FAILURE;
1945-
}
1946-
1947-
if ((ret == WOLFSSL_SUCCESS) && (type == CERT_TYPE)) {
1948-
ret = X509StoreLoadCertBuffer(str, content.buffer,
1949-
contentLen, WOLFSSL_FILETYPE_PEM);
1950-
}
1951-
#ifdef HAVE_CRL
1952-
else if ((ret == WOLFSSL_SUCCESS) && (type == CRL_TYPE)) {
1953-
ret = BufferLoadCRL(str->cm->crl, content.buffer, contentLen,
1954-
WOLFSSL_FILETYPE_PEM, 0);
1955-
}
1956-
#endif
1957-
1958-
static_buffer_free(&content, NULL, DYNAMIC_TYPE_FILE);
1959-
return ret;
1960-
}
1961-
19621894
/* Loads certificate(s) files in pem format into X509_STORE struct from either
19631895
* a file or directory.
19641896
* Returns WOLFSSL_SUCCESS on success or WOLFSSL_FAILURE if an error occurs.
@@ -1984,23 +1916,9 @@ int wolfSSL_X509_STORE_load_locations(WOLFSSL_X509_STORE *str,
19841916
wolfSSL_CertManagerFree(ctx->cm);
19851917
ctx->cm = str->cm;
19861918

1987-
#ifdef HAVE_CRL
1988-
if (str->cm->crl == NULL) {
1989-
/* Workaround to allocate the internals to load CRL's but don't enable
1990-
* CRL checking by default */
1991-
if (wolfSSL_CertManagerEnableCRL(str->cm, WOLFSSL_CRL_CHECK)
1992-
!= WOLFSSL_SUCCESS ||
1993-
wolfSSL_CertManagerDisableCRL(str->cm) != WOLFSSL_SUCCESS) {
1994-
WOLFSSL_MSG("Enable CRL failed");
1995-
wolfSSL_CTX_free(ctx);
1996-
return WOLFSSL_FAILURE;
1997-
}
1998-
}
1999-
#endif
2000-
20011919
/* Load individual file */
20021920
if (file) {
2003-
ret = X509StoreLoadFile(str, file);
1921+
ret = X509LoadPemFile(str, file);
20041922
if (ret != WOLFSSL_SUCCESS) {
20051923
WOLFSSL_MSG("Failed to load file");
20061924
ret = WOLFSSL_FAILURE;
@@ -2026,7 +1944,7 @@ int wolfSSL_X509_STORE_load_locations(WOLFSSL_X509_STORE *str,
20261944
while (ret == 0 && name) {
20271945
WOLFSSL_MSG(name);
20281946

2029-
ret = X509StoreLoadFile(str, name);
1947+
ret = X509LoadPemFile(str, name);
20301948
/* Not failing on load errors */
20311949
if (ret != WOLFSSL_SUCCESS)
20321950
WOLFSSL_MSG("Failed to load file in path, continuing");

‎wolfssl/internal.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2748,6 +2748,7 @@ WOLFSSL_LOCAL void CleanupStoreCtxCallback(WOLFSSL_X509_STORE_CTX* store,
27482748
WOLFSSL_LOCAL int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str,
27492749
byte *buf, word32 bufLen, int type);
27502750
WOLFSSL_LOCAL int X509StorePushCertsToCM(WOLFSSL_X509_STORE* store);
2751+
WOLFSSL_LOCAL int X509LoadPemFile(WOLFSSL_X509_STORE *str, const char* file);
27512752
#endif /* !defined NO_CERTS */
27522753

27532754
/* wolfSSL Sock Addr */

0 commit comments

Comments
 (0)