oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Revert "make sure that serial number is valid DER when done ..."

Browse Source 
A simpler fix will be the next commit.

This reverts commit 35add96d37.
This commit is contained in:
Viktor Dukhovni
2015-03-05 03:56:04 -05:00
parent 35add96d37
commit b7ca6bbc7a
1 changed files with 3 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
lib/hx509/ca.c
View File

@@ -1126,36 +1126,16 @@ ca_sign(hx509_context context,
goto out; goto out;
} }
} else { } else {
uint8_t *p; tbsc->serialNumber.length = 20;
tbsc->serialNumber.length = 30;
tbsc->serialNumber.data = malloc(tbsc->serialNumber.length); tbsc->serialNumber.data = malloc(tbsc->serialNumber.length);
if (tbsc->serialNumber.data == NULL){ if (tbsc->serialNumber.data == NULL){
ret = ENOMEM; ret = ENOMEM;
hx509_set_error_string(context, 0, ret, "Out of memory"); hx509_set_error_string(context, 0, ret, "Out of memory");
goto out; goto out;
} }
/* XXX diffrent */
RAND_bytes(tbsc->serialNumber.data, tbsc->serialNumber.length); RAND_bytes(tbsc->serialNumber.data, tbsc->serialNumber.length);
/* ((unsigned char *)tbsc->serialNumber.data)[0] &= 0x7f;
* Trim of leading 0x80 bit and make sure that top most byte
* are not zero, this introduces a bias, but that fine since
* since this is a serial number and just really need to be
* unique enough.
*/
#define MINIUM_SERIAL_NUMBER_LEN 10
p = tbsc->serialNumber.data;
while ((p[0] & 0x7f) == 0 && tbsc->serialNumber.length > MINIUM_SERIAL_NUMBER_LEN) {
tbsc->serialNumber.length--;
memmove(&p[0], &p[1], tbsc->serialNumber.length);
}
if (tbsc->serialNumber.length <= MINIUM_SERIAL_NUMBER_LEN) {
ret = EINVAL;
hx509_set_error_string(context, 0, ret,
"Serial number too short (shorter then 2^%d",
MINIUM_SERIAL_NUMBER_LEN);
goto out;
}
p[0] &= 0x7f;
} }
/* signature AlgorithmIdentifier, */ /* signature AlgorithmIdentifier, */
ret = copy_AlgorithmIdentifier(sigalg, &tbsc->signature); ret = copy_AlgorithmIdentifier(sigalg, &tbsc->signature);