|
 |
167778 |
From e427a9c2027446f1d0883ced077caf3515116b10 Mon Sep 17 00:00:00 2001
|
|
|
167778 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
167778 |
Date: Fri, 26 Jan 2018 11:47:50 -0500
|
|
|
167778 |
Subject: [PATCH] Fix hex conversion of PKINIT certid strings
|
|
|
167778 |
|
|
|
167778 |
When parsing a PKCS11 token specification, correctly convert from hex
|
|
|
167778 |
to binary instead of using OpenSSL bignum functions (which would strip
|
|
|
167778 |
leading zeros).
|
|
|
167778 |
|
|
|
167778 |
[ghudson@mit.edu: made hex_string_to_bin() a bit less verbose; wrote
|
|
|
167778 |
commit message]
|
|
|
167778 |
|
|
|
167778 |
ticket: 8636
|
|
|
167778 |
(cherry picked from commit 63e8b8142fd7b3931a7bf2d6448978ca536bafc0)
|
|
|
167778 |
---
|
|
|
167778 |
.../preauth/pkinit/pkinit_crypto_openssl.c | 55 +++++++++++++++----
|
|
|
167778 |
1 file changed, 44 insertions(+), 11 deletions(-)
|
|
|
167778 |
|
|
|
167778 |
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
|
|
167778 |
index 7fa2efd21..6a95f8035 100644
|
|
|
167778 |
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
|
|
167778 |
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
|
|
167778 |
@@ -4640,6 +4640,43 @@ reassemble_pkcs11_name(pkinit_identity_opts *idopts)
|
|
|
167778 |
return ret;
|
|
|
167778 |
}
|
|
|
167778 |
|
|
|
167778 |
+static int
|
|
|
167778 |
+hex_string_to_bin(const char *str, int *bin_len_out, CK_BYTE **bin_out)
|
|
|
167778 |
+{
|
|
|
167778 |
+ size_t str_len, i;
|
|
|
167778 |
+ CK_BYTE *bin;
|
|
|
167778 |
+ char *endptr, tmp[3] = { '\0', '\0', '\0' };
|
|
|
167778 |
+ long val;
|
|
|
167778 |
+
|
|
|
167778 |
+ *bin_len_out = 0;
|
|
|
167778 |
+ *bin_out = NULL;
|
|
|
167778 |
+
|
|
|
167778 |
+ str_len = strlen(str);
|
|
|
167778 |
+ if (str_len % 2 != 0)
|
|
|
167778 |
+ return EINVAL;
|
|
|
167778 |
+ bin = malloc(str_len / 2);
|
|
|
167778 |
+ if (bin == NULL)
|
|
|
167778 |
+ return ENOMEM;
|
|
|
167778 |
+
|
|
|
167778 |
+ errno = 0;
|
|
|
167778 |
+ for (i = 0; i < str_len / 2; i++) {
|
|
|
167778 |
+ tmp[0] = str[i * 2];
|
|
|
167778 |
+ tmp[1] = str[i * 2 + 1];
|
|
|
167778 |
+
|
|
|
167778 |
+ val = strtol(tmp, &endptr, 16);
|
|
|
167778 |
+ if (val < 0 || val > 255 || errno != 0 || endptr != &tmp[2]) {
|
|
|
167778 |
+ free(bin);
|
|
|
167778 |
+ return EINVAL;
|
|
|
167778 |
+ }
|
|
|
167778 |
+
|
|
|
167778 |
+ bin[i] = (CK_BYTE)val;
|
|
|
167778 |
+ }
|
|
|
167778 |
+
|
|
|
167778 |
+ *bin_len_out = str_len / 2;
|
|
|
167778 |
+ *bin_out = bin;
|
|
|
167778 |
+ return 0;
|
|
|
167778 |
+}
|
|
|
167778 |
+
|
|
|
167778 |
static krb5_error_code
|
|
|
167778 |
pkinit_get_certs_pkcs11(krb5_context context,
|
|
|
167778 |
pkinit_plg_crypto_context plg_cryptoctx,
|
|
|
167778 |
@@ -4682,18 +4719,14 @@ pkinit_get_certs_pkcs11(krb5_context context,
|
|
|
167778 |
}
|
|
|
167778 |
/* Convert the ascii cert_id string into a binary blob */
|
|
|
167778 |
if (idopts->cert_id_string != NULL) {
|
|
|
167778 |
- BIGNUM *bn = NULL;
|
|
|
167778 |
- BN_hex2bn(&bn, idopts->cert_id_string);
|
|
|
167778 |
- if (bn == NULL)
|
|
|
167778 |
- return ENOMEM;
|
|
|
167778 |
- id_cryptoctx->cert_id_len = BN_num_bytes(bn);
|
|
|
167778 |
- id_cryptoctx->cert_id = malloc((size_t) id_cryptoctx->cert_id_len);
|
|
|
167778 |
- if (id_cryptoctx->cert_id == NULL) {
|
|
|
167778 |
- BN_free(bn);
|
|
|
167778 |
- return ENOMEM;
|
|
|
167778 |
+ r = hex_string_to_bin(idopts->cert_id_string,
|
|
|
167778 |
+ &id_cryptoctx->cert_id_len,
|
|
|
167778 |
+ &id_cryptoctx->cert_id);
|
|
|
167778 |
+ if (r != 0) {
|
|
|
167778 |
+ pkiDebug("Failed to convert certid string [%s]\n",
|
|
|
167778 |
+ idopts->cert_id_string);
|
|
|
167778 |
+ return r;
|
|
|
167778 |
}
|
|
|
167778 |
- BN_bn2bin(bn, id_cryptoctx->cert_id);
|
|
|
167778 |
- BN_free(bn);
|
|
|
167778 |
}
|
|
|
167778 |
id_cryptoctx->slotid = idopts->slotid;
|
|
|
167778 |
id_cryptoctx->pkcs11_method = 1;
|