mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-13 02:28:43 +04:00
Josef Schlehofer
54d2eb96a1
The subjectAltName support added in commit efca89daef ("px5g-mbedtls:
add subjectAltName and extendedKeyUsage to SSL certs") has these bugs:
- Every IP entry is written with a length of 16 bytes. An IPv4 address
ends up as a zero padded IPv6 address, so 192.168.1.1 becomes
C0A8:101:: and clients reject the certificate for that address.
- All IP entries share one buffer, so each of them carries the address
given last.
- An invalid IP address is not rejected but written as :: or as the
address of an earlier IP entry.
- The list is linked after every option instead of only after a new
entry. If any other option follows the last subjectAltName, that
entry points to itself. Adding the extension then loops until the
size counter overflows, which never ends on 64-bit targets and drops
the whole extension on 32-bit targets.
- An unknown entry type only prints a warning. It stays in the list
with type 0, which mbedtls cannot write, so the whole extension is
dropped while px5g still exits with 0.
- Without any subjectAltName, the extension is written with an empty
list, which RFC 5280 does not allow. Chrome rejects such a
certificate with ERR_CERT_INVALID and, unlike for other self-signed
certificates, does not offer to proceed.
Use the length returned by mbedtls_x509_crt_parse_cn_inet_pton(),
allocate a buffer for each IP entry and link only new entries. Reject
invalid IP addresses and unknown entry types with an error. Add the
extension only if there are entries and fail with an error if mbedtls
refuses it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25604
Signed-off-by: Robert Marko <robimarko@gmail.com>