Skip to content

Commit 09bb8d5

Browse files
ColtonWilleyColtonWilley
committed
Fix X509 load locations to handle PEM files with multiple certs
Adds X509LoadPemFile to walk multi-cert PEM files when loading via wolfSSL_X509_STORE_load_locations and X509_LOOKUP_load_file, replacing the single-cert helpers X509StoreReadFile/X509StoreLoadFile which only read the first cert from a file. Rebased fresh onto current upstream master (was 2209 commits behind); test additions deferred to a follow-up since the test file layout has been reorganized in master.
1 parent 4e491ed commit 09bb8d5

3 files changed

Lines changed: 34 additions & 102 deletions

File tree

‎src/x509.c‎

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8371,19 +8371,7 @@ const char* wolfSSL_X509_verify_cert_error_string(long err)
83718371

83728372
#ifdef OPENSSL_EXTRA
83738373

8374-
/* Add directory path that will be used for loading certs and CRLs
8375-
* which have the <hash>.rn name format.
8376-
* type may be WOLFSSL_FILETYPE_PEM or WOLFSSL_FILETYPE_ASN1.
8377-
* returns WOLFSSL_SUCCESS on successful, otherwise negative or zero. */
8378-
int wolfSSL_X509_LOOKUP_add_dir(WOLFSSL_X509_LOOKUP* lookup, const char* dir,
8379-
long type)
8380-
{
8381-
return wolfSSL_X509_LOOKUP_ctrl(lookup, WOLFSSL_X509_L_ADD_DIR, dir, type,
8382-
NULL);
8383-
}
8384-
8385-
int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
8386-
const char* file, long type)
8374+
int X509LoadPemFile(WOLFSSL_X509_STORE *store, const char* file)
83878375
{
83888376
#if !defined(NO_FILESYSTEM) && \
83898377
(defined(WOLFSSL_PEM_TO_DER) || defined(WOLFSSL_DER_TO_PEM))
@@ -8396,9 +8384,6 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
83968384
const char* header = NULL;
83978385
const char* footer = NULL;
83988386

8399-
if (type != WOLFSSL_FILETYPE_PEM)
8400-
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
8401-
84028387
fp = XFOPEN(file, "rb");
84038388
if (fp == XBADFILE)
84048389
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
@@ -8434,7 +8419,7 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
84348419
if (wc_PemGetHeaderFooter(CRL_TYPE, &header, &footer) == 0 &&
84358420
XSTRNSTR((char*)curr, header, sz) != NULL) {
84368421
#ifdef HAVE_CRL
8437-
WOLFSSL_CERT_MANAGER* cm = lookup->store->cm;
8422+
WOLFSSL_CERT_MANAGER* cm = store->cm;
84388423

84398424
if (cm->crl == NULL) {
84408425
if (wolfSSL_CertManagerEnableCRL(cm, WOLFSSL_CRL_CHECK)
@@ -8452,7 +8437,7 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
84528437
curr = (byte*)XSTRNSTR((char*)curr, footer, sz);
84538438
}
84548439
else if (wc_PemGetHeaderFooter(CERT_TYPE, &header, &footer) == 0 &&
8455-
XSTRNSTR((char*)curr, header, sz) != NULL) {
8440+
XSTRNSTR((char*)curr, header, (unsigned int)sz) != NULL) {
84568441
ret = X509StoreLoadCertBuffer(lookup->store, curr,
84578442
(word32)sz, WOLFSSL_FILETYPE_PEM);
84588443
if (ret != WOLFSSL_SUCCESS)
@@ -8475,6 +8460,34 @@ int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
84758460
XFREE(pem, 0, DYNAMIC_TYPE_PEM);
84768461
XFCLOSE(fp);
84778462
return WS_RETURN_CODE(ret, (int)WOLFSSL_FAILURE);
8463+
#else
8464+
(void)store;
8465+
(void)file;
8466+
return WS_RETURN_CODE(WOLFSSL_FAILURE,WOLFSSL_FAILURE);
8467+
#endif
8468+
}
8469+
8470+
/* Add directory path that will be used for loading certs and CRLs
8471+
* which have the <hash>.rn name format.
8472+
* type may be WOLFSSL_FILETYPE_PEM or WOLFSSL_FILETYPE_ASN1.
8473+
* returns WOLFSSL_SUCCESS on successful, otherwise negative or zero. */
8474+
int wolfSSL_X509_LOOKUP_add_dir(WOLFSSL_X509_LOOKUP* lookup, const char* dir,
8475+
long type)
8476+
{
8477+
return wolfSSL_X509_LOOKUP_ctrl(lookup, WOLFSSL_X509_L_ADD_DIR, dir, type,
8478+
NULL);
8479+
}
8480+
8481+
int wolfSSL_X509_LOOKUP_load_file(WOLFSSL_X509_LOOKUP* lookup,
8482+
const char* file, long type)
8483+
{
8484+
#if !defined(NO_FILESYSTEM) && \
8485+
(defined(WOLFSSL_PEM_TO_DER) || defined(WOLFSSL_DER_TO_PEM))
8486+
8487+
if (type != WOLFSSL_FILETYPE_PEM)
8488+
return WS_RETURN_CODE(BAD_FUNC_ARG, (int)WOLFSSL_FAILURE);
8489+
8490+
return X509LoadPemFile(lookup->store, file);
84788491
#else
84798492
(void)lookup;
84808493
(void)file;

‎src/x509_str.c‎

Lines changed: 2 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1878,74 +1878,6 @@ int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str,
18781878

18791879
#if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
18801880

1881-
static int X509StoreReadFile(const char *fname,
1882-
StaticBuffer *content, word32 *bytesRead, int *type)
1883-
{
1884-
int ret = -1;
1885-
long sz = 0;
1886-
#ifdef HAVE_CRL
1887-
const char* header = NULL;
1888-
const char* footer = NULL;
1889-
#endif
1890-
1891-
ret = wolfssl_read_file_static(fname, content, NULL, DYNAMIC_TYPE_FILE,
1892-
&sz);
1893-
if (ret == 0) {
1894-
*type = CERT_TYPE;
1895-
*bytesRead = (word32)sz;
1896-
#ifdef HAVE_CRL
1897-
/* Look for CRL header and footer. */
1898-
if (wc_PemGetHeaderFooter(CRL_TYPE, &header, &footer) == 0 &&
1899-
(XSTRNSTR((char*)content->buffer, header, sz) !=
1900-
NULL)) {
1901-
*type = CRL_TYPE;
1902-
}
1903-
#endif
1904-
}
1905-
1906-
return (ret == 0 ? WOLFSSL_SUCCESS : WOLFSSL_FAILURE);
1907-
}
1908-
1909-
static int X509StoreLoadFile(WOLFSSL_X509_STORE *str,
1910-
const char *fname)
1911-
{
1912-
int ret = WOLFSSL_SUCCESS;
1913-
int type = 0;
1914-
#ifndef WOLFSSL_SMALL_STACK
1915-
byte stackBuffer[FILE_BUFFER_SIZE];
1916-
#endif
1917-
StaticBuffer content;
1918-
word32 contentLen = 0;
1919-
1920-
#ifdef WOLFSSL_SMALL_STACK
1921-
static_buffer_init(&content);
1922-
#else
1923-
static_buffer_init(&content, stackBuffer, FILE_BUFFER_SIZE);
1924-
#endif
1925-
1926-
WOLFSSL_MSG_EX("X509StoreLoadFile: Loading file: %s", fname);
1927-
1928-
ret = X509StoreReadFile(fname, &content, &contentLen, &type);
1929-
if (ret != WOLFSSL_SUCCESS) {
1930-
WOLFSSL_MSG("Failed to load file");
1931-
ret = WOLFSSL_FAILURE;
1932-
}
1933-
1934-
if ((ret == WOLFSSL_SUCCESS) && (type == CERT_TYPE)) {
1935-
ret = X509StoreLoadCertBuffer(str, content.buffer,
1936-
contentLen, WOLFSSL_FILETYPE_PEM);
1937-
}
1938-
#ifdef HAVE_CRL
1939-
else if ((ret == WOLFSSL_SUCCESS) && (type == CRL_TYPE)) {
1940-
ret = BufferLoadCRL(str->cm->crl, content.buffer, contentLen,
1941-
WOLFSSL_FILETYPE_PEM, 0);
1942-
}
1943-
#endif
1944-
1945-
static_buffer_free(&content, NULL, DYNAMIC_TYPE_FILE);
1946-
return ret;
1947-
}
1948-
19491881
/* Loads certificate(s) files in pem format into X509_STORE struct from either
19501882
* a file or directory.
19511883
* Returns WOLFSSL_SUCCESS on success or WOLFSSL_FAILURE if an error occurs.
@@ -1971,23 +1903,9 @@ int wolfSSL_X509_STORE_load_locations(WOLFSSL_X509_STORE *str,
19711903
wolfSSL_CertManagerFree(ctx->cm);
19721904
ctx->cm = str->cm;
19731905

1974-
#ifdef HAVE_CRL
1975-
if (str->cm->crl == NULL) {
1976-
/* Workaround to allocate the internals to load CRL's but don't enable
1977-
* CRL checking by default */
1978-
if (wolfSSL_CertManagerEnableCRL(str->cm, WOLFSSL_CRL_CHECK)
1979-
!= WOLFSSL_SUCCESS ||
1980-
wolfSSL_CertManagerDisableCRL(str->cm) != WOLFSSL_SUCCESS) {
1981-
WOLFSSL_MSG("Enable CRL failed");
1982-
wolfSSL_CTX_free(ctx);
1983-
return WOLFSSL_FAILURE;
1984-
}
1985-
}
1986-
#endif
1987-
19881906
/* Load individual file */
19891907
if (file) {
1990-
ret = X509StoreLoadFile(str, file);
1908+
ret = X509LoadPemFile(str, file);
19911909
if (ret != WOLFSSL_SUCCESS) {
19921910
WOLFSSL_MSG("Failed to load file");
19931911
ret = WOLFSSL_FAILURE;
@@ -2013,7 +1931,7 @@ int wolfSSL_X509_STORE_load_locations(WOLFSSL_X509_STORE *str,
20131931
while (ret == 0 && name) {
20141932
WOLFSSL_MSG(name);
20151933

2016-
ret = X509StoreLoadFile(str, name);
1934+
ret = X509LoadPemFile(str, name);
20171935
/* Not failing on load errors */
20181936
if (ret != WOLFSSL_SUCCESS)
20191937
WOLFSSL_MSG("Failed to load file in path, continuing");

‎wolfssl/internal.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2758,6 +2758,7 @@ WOLFSSL_LOCAL void CleanupStoreCtxCallback(WOLFSSL_X509_STORE_CTX* store,
27582758
WOLFSSL_LOCAL int X509StoreLoadCertBuffer(WOLFSSL_X509_STORE *str,
27592759
byte *buf, word32 bufLen, int type);
27602760
WOLFSSL_LOCAL int X509StorePushCertsToCM(WOLFSSL_X509_STORE* store);
2761+
WOLFSSL_LOCAL int X509LoadPemFile(WOLFSSL_X509_STORE *str, const char* file);
27612762
#endif /* !defined NO_CERTS */
27622763

27632764
/* wolfSSL Sock Addr */

0 commit comments

Comments
 (0)