oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

just mark sig algs as weak instead of expiration date

Browse Source
This commit is contained in:
Love Hornquist Astrand
2012-06-08 18:08:23 +02:00
parent d2c37acf7c
commit 671c91fd5f
2 changed files with 10 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/hx509/cert.c
View File

@@ -2353,20 +2353,12 @@ hx509_verify_path(hx509_context context,
goto out; goto out;
} }
/* /*
* Verify that the sigature algorithm "best-before" date is * Verify that the sigature algorithm is not weak. Ignore
* before the creation date of the certificate, do this for * trust anchors since they are provisioned by the user.
* trust anchors too, since any trust anchor that is created
* after a algorithm is known to be bad deserved to be invalid.
*
* Skip the leaf certificate for now...
*/ */
if (i != 0 && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) { if (i + 1 != path.len && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) {
time_t notBefore = ret = _hx509_signature_is_weak(context, &c->signatureAlgorithm);
_hx509_Time2time_t(&c->tbsCertificate.validity.notBefore);
ret = _hx509_signature_best_before(context,
&c->signatureAlgorithm,
notBefore);
if (ret) if (ret)
goto out; goto out;
} }

14
lib/hx509/crypto.c
View File

@@ -92,6 +92,7 @@ struct signature_alg {
#define PROVIDE_CONF 0x1 #define PROVIDE_CONF 0x1
#define REQUIRE_SIGNER 0x2 #define REQUIRE_SIGNER 0x2
#define SELF_SIGNED_OK 0x4 #define SELF_SIGNED_OK 0x4
#define WEAK_SIG_ALG 0x8
#define SIG_DIGEST 0x100 #define SIG_DIGEST 0x100
#define SIG_PUBLIC_SIG 0x200 #define SIG_PUBLIC_SIG 0x200
@@ -1350,7 +1351,7 @@ static const struct signature_alg rsa_with_md5_alg = {
&_hx509_signature_rsa_with_md5_data, &_hx509_signature_rsa_with_md5_data,
ASN1_OID_ID_PKCS1_RSAENCRYPTION, ASN1_OID_ID_PKCS1_RSAENCRYPTION,
&_hx509_signature_md5_data, &_hx509_signature_md5_data,
PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG, PROVIDE_CONF|REQUIRE_SIGNER|RA_RSA_USES_DIGEST_INFO|SIG_PUBLIC_SIG|WEAK_SIG_ALG,
1230739889, 1230739889,
NULL, NULL,
rsa_verify_signature, rsa_verify_signature,
@@ -1434,7 +1435,7 @@ static const struct signature_alg md5_alg = {
&_hx509_signature_md5_data, &_hx509_signature_md5_data,
NULL, NULL,
NULL, NULL,
SIG_DIGEST, SIG_DIGEST|WEAK_SIG_ALG,
0, 0,
EVP_md5, EVP_md5,
evp_md_verify_signature, evp_md_verify_signature,
@@ -1539,9 +1540,7 @@ hx509_find_private_alg(const heim_oid *oid)
*/ */
int int
_hx509_signature_best_before(hx509_context context, _hx509_signature_is_weak(hx509_context context, const AlgorithmIdentifier *alg)
const AlgorithmIdentifier *alg,
time_t t)
{ {
const struct signature_alg *md; const struct signature_alg *md;
@@ -1550,10 +1549,9 @@ _hx509_signature_best_before(hx509_context context,
hx509_clear_error_string(context); hx509_clear_error_string(context);
return HX509_SIG_ALG_NO_SUPPORTED; return HX509_SIG_ALG_NO_SUPPORTED;
} }
if (md->best_before && md->best_before < t) { if (md->flags & WEAK_SIG_ALG) {
hx509_set_error_string(context, 0, HX509_CRYPTO_ALGORITHM_BEST_BEFORE, hx509_set_error_string(context, 0, HX509_CRYPTO_ALGORITHM_BEST_BEFORE,
"Algorithm %s has passed it best before date", "Algorithm %s is weak", md->name);
md->name);
return HX509_CRYPTO_ALGORITHM_BEST_BEFORE; return HX509_CRYPTO_ALGORITHM_BEST_BEFORE;
} }
return 0; return 0;