Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Improve error handling in x509_ocsp_verify function

Browse source
This commit is contained in:
Jon Siwek 2018-11-05 17:10:21 -06:00
parent 03f42fabf3
commit 2d82fe7e2e
1 changed files with 32 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

37
src/file_analysis/analyzer/x509/functions.bif
View file

@ -303,7 +303,12 @@ function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_c
int result = -1; int result = -1;
X509* issuer_certificate = 0; X509* issuer_certificate = 0;
X509* signer = 0; X509* signer = 0;
ASN1_GENERALIZEDTIME* thisUpdate = nullptr;
ASN1_GENERALIZEDTIME* nextUpdate = nullptr;
int type = -1;
OCSP_RESPONSE *resp = d2i_OCSP_RESPONSE(NULL, &start, ocsp_reply->Len()); OCSP_RESPONSE *resp = d2i_OCSP_RESPONSE(NULL, &start, ocsp_reply->Len());
if ( ! resp ) if ( ! resp )
{ {
rval = x509_result_record(-1, "Could not parse OCSP response"); rval = x509_result_record(-1, "Could not parse OCSP response");
@ -441,13 +446,35 @@ function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_c
return x509_result_record(-1, "OCSP reply is not for host certificate"); return x509_result_record(-1, "OCSP reply is not for host certificate");
// next - check freshness of proof... // next - check freshness of proof...
ASN1_GENERALIZEDTIME *thisUpdate;
ASN1_GENERALIZEDTIME *nextUpdate;
int type;
type = OCSP_single_get0_status(single, NULL, NULL, &thisUpdate, &nextUpdate); type = OCSP_single_get0_status(single, NULL, NULL, &thisUpdate, &nextUpdate);
if ( ! ASN1_GENERALIZEDTIME_check(thisUpdate) || ! ASN1_GENERALIZEDTIME_check(nextUpdate) )
if ( type == -1 )
{ {
rval = x509_result_record(-1, "OCSP reply contains invalid dates"); rval = x509_result_record(-1, "OCSP reply failed to retrieve update times");
goto x509_ocsp_cleanup;
}
if ( ! thisUpdate )
{
rval = x509_result_record(-1, "OCSP reply missing thisUpdate field");
goto x509_ocsp_cleanup;
}
if ( ! nextUpdate )
{
rval = x509_result_record(-1, "OCSP reply missing nextUpdate field");
goto x509_ocsp_cleanup;
}
if ( ! ASN1_GENERALIZEDTIME_check(thisUpdate) )
{
rval = x509_result_record(-1, "OCSP reply contains invalid thisUpdate field");
goto x509_ocsp_cleanup;
}
if ( ! ASN1_GENERALIZEDTIME_check(nextUpdate) )
{
rval = x509_result_record(-1, "OCSP reply contains invalid nextUpdate field");
goto x509_ocsp_cleanup; goto x509_ocsp_cleanup;
} }