X509 fix minor

certs/test/cert-ext-dirsan.cfg

@@ -0,0 +1,23 @@
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_req
+
+[ req_distinguished_name ]
+C             = US
+ST            = Montana
+L             = Bozeman
+O             = wolfSSL
+OU            = Engineering
+CN            = www.wolfssl.com
+
+[ v3_req ]
+subjectKeyIdentifier = hash
+basicConstraints     = critical, CA:FALSE
+subjectAltName       = DNS:example.com, dirName:dir_san
+
+[ dir_san ]
+C  = US
+O  = wolfSSL
+CN = Dir Name SAN
+

certs/test/cert-ext-dirsan.pem

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID9jCCAt6gAwIBAgIUDmlsBGkManChA/BK5bZmTYDqmDgwDQYJKoZIhvcNAQEL
+BQAwczELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgw
+FgYDVQQDDA93d3cud29sZnNzbC5jb20wHhcNMjYxMTEwMTkwNjU1WhcNMjkwODA2
+MTkwNjU1WjBzMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UE
+BwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRW5naW5lZXJp
+bmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf
++6hnf/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5
+Xz/XGQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ
+48bMQLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5
+ZMMq0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBp
+QkIJ6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaOBgTB/MB0GA1UdDgQW
+BBSzETLJkpiE4sn40DtuA0LKHw6OPDAMBgNVHRMBAf8EAjAAMFAGA1UdEQRJMEeC
+C2V4YW1wbGUuY29tpDgwNjELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB3dvbGZTU0wx
+FTATBgNVBAMMDERpciBOYW1lIFNBTjANBgkqhkiG9w0BAQsFAAOCAQEAKR8pc0yI
+SI9455y1arQmuw8wn+osqSjQpRzOlh8Jqh3Rx5ZQgBPYa0g0JMwcq/rib2RvVWUe
+YNW9CN7Zf+YUqPsPnnhc3xVXTF3gzDJYSFyQHB2nPGqeXZ0r+ctIbZVxWsMoMmxs
+t1Q8fVWLSl1NG7UcowN4I42Ux5lEzx86KmIA0hWbWvqKknyMtlaWFUhds3nHtB5C
+/I7JI2gJmzZaDl9C4ElXNRYEH/dZ2Ou53CqripYAiqo39VfIeJm1bgB2Siqe2ChB
+vq1kGpUArJ5WUjbC/WH96mfYpEv8p85ce3wED8rz6dj8Cn5oDeEKXyzqtGEJjlDL
+TO+zlKWmaVOztA==
+-----END CERTIFICATE-----

certs/test/gen-ext-certs.sh

@@ -1607,3 +1607,32 @@ CN = www.wolfssl.com
 basicConstraints = critical, CA:TRUE
 EOF
 gen_cert
+
+KEY=certs/server-key.der
+OUT=certs/test/cert-ext-dirsan
+CONFIG=certs/test/cert-ext-dirsan.cfg
+tee >$CONFIG <<EOF
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_req
+
+[ req_distinguished_name ]
+C             = US
+ST            = Montana
+L             = Bozeman
+O             = wolfSSL
+OU            = Engineering
+CN            = www.wolfssl.com
+
+[ v3_req ]
+subjectKeyIdentifier = hash
+basicConstraints     = critical, CA:FALSE
+subjectAltName       = DNS:example.com, dirName:dir_san
+
+[ dir_san ]
+C  = US
+O  = wolfSSL
+CN = Dir Name SAN
+EOF
+gen_cert

certs/test/include.am

@@ -3,6 +3,9 @@
 #
 
 EXTRA_DIST += \
+         certs/test/cert-ext-dirsan.cfg \
+         certs/test/cert-ext-dirsan.der \
+         certs/test/cert-ext-dirsan.pem \
          certs/test/cert-ext-ia.cfg \
          certs/test/cert-ext-ia.der \
          certs/test/cert-ext-ia.pem \

src/x509.c

@@ -2030,6 +2030,10 @@ static WOLFSSL_AUTHORITY_INFO_ACCESS* wolfssl_x509v3_ext_aia_d2i(
 
         /* Get ASN.1 Object from the stack entry's data. */
         aiaEntry = sk->data.obj;
+        if (aiaEntry == NULL) {
+            sk = sk->next;
+            continue;
+        }
 
         /* ACCESS_DESCRIPTION has two members: method and location.
          *  method: ASN1_OBJECT as either AIA_OCSP_OID or AIA_CA_ISSUER_OID
@@ -2218,8 +2222,8 @@ void* wolfSSL_X509V3_EXT_d2i(WOLFSSL_X509_EXTENSION* ext)
                 WOLFSSL_MSG("Failed to malloc ASN1_STRING");
                 break;
             }
-            ret = wolfSSL_ASN1_STRING_set(newString, cert->extSubjKeyId,
-                                          cert->extSubjKeyIdSz);
+            ret = wolfSSL_ASN1_STRING_set(newString, cert->extSubjKeyIdSrc,
+                                          (int)cert->extSubjKeyIdSz);
             if (ret != WOLFSSL_SUCCESS) {
                 WOLFSSL_MSG("ASN1_STRING_set() failed");
                 wolfSSL_ASN1_STRING_free(newString);
@@ -2253,8 +2257,8 @@ void* wolfSSL_X509V3_EXT_d2i(WOLFSSL_X509_EXTENSION* ext)
                 break;
             }
 
-            ret = wolfSSL_ASN1_STRING_set(akey->keyid, cert->extAuthKeyId,
-                                          cert->extAuthKeyIdSz);
+            ret = wolfSSL_ASN1_STRING_set(akey->keyid, cert->extAuthKeyIdSrc,
+                                          (int)cert->extAuthKeyIdSz);
             if (ret != WOLFSSL_SUCCESS) {
                 WOLFSSL_MSG("ASN1_STRING_set() failed");
                 wolfSSL_AUTHORITY_KEYID_free(akey);
@@ -2733,6 +2737,9 @@ void* wolfSSL_X509_get_ext_d2i(const WOLFSSL_X509* x509, int nid, int* c,
                     switch (dns->type) {
                         case ASN_DIR_TYPE:
                             gn->type = dns->type;
+                            /* Free ia5 before using union for dirn */
+                            wolfSSL_ASN1_STRING_free(gn->d.ia5);
+                            gn->d.ia5 = NULL;
                             {
                                 int localIdx = 0;
                                 unsigned char* n = (unsigned char*)XMALLOC(

tests/api/test_ossl_x509_ext.c

@@ -1358,6 +1358,94 @@ int test_wolfSSL_X509_get_ext_d2i_basic_constraints(void)
     return EXPECT_RESULT();
 }
 
+/* wolfSSL_X509_get_ext_d2i(NID_subject_alt_name) on a certificate whose SAN
+ * carries a directoryName entry. GENERAL_NAME_new() pre-allocates d.ia5, which
+ * shares the union slot with d.dirn; the ASN_DIR_TYPE arm must release it
+ * before storing the parsed X509_NAME, otherwise one ASN1_STRING leaks per
+ * directoryName entry (caught by the memory checkers under make check). */
+int test_wolfSSL_X509_get_ext_d2i_dirname_san(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_FILESYSTEM) && (defined(OPENSSL_EXTRA) || \
+    defined(OPENSSL_ALL)) && !defined(NO_RSA) && \
+    !defined(IGNORE_NAME_CONSTRAINTS) && \
+    (!defined(WOLFSSL_X509_TINY) || defined(WOLFSSL_X509_TINY_SAN_DIR))
+    XFILE f = XBADFILE;
+    WOLFSSL_X509* x509 = NULL;
+    WOLFSSL_GENERAL_NAMES* gns = NULL;
+    WOLFSSL_GENERAL_NAME* gn = NULL;
+    char buf[64];
+    int crit = 0;
+    int i;
+    int dnsCount = 0;
+    int dirCount = 0;
+
+    /* SAN = DNS:example.com, dirName:{C=US, O=wolfSSL, CN=Dir Name SAN} */
+    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-dirsan.pem", "rb")) !=
+        XBADFILE);
+    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
+    if (f != XBADFILE) {
+        XFCLOSE(f);
+        f = XBADFILE;
+    }
+
+    ExpectNotNull(gns = (WOLFSSL_GENERAL_NAMES*)wolfSSL_X509_get_ext_d2i(x509,
+        NID_subject_alt_name, &crit, NULL));
+    ExpectIntEQ(wolfSSL_sk_GENERAL_NAME_num(gns), 2);
+    /* More than one SAN entry is reported as -2. */
+    ExpectIntEQ(crit, -2);
+
+    for (i = 0; i < wolfSSL_sk_GENERAL_NAME_num(gns); i++) {
+        ExpectNotNull(gn = wolfSSL_sk_GENERAL_NAME_value(gns, i));
+        if (gn == NULL)
+            break;
+        if (gn->type == WOLFSSL_GEN_DNS) {
+            dnsCount++;
+            ExpectNotNull(gn->d.dNSName);
+            ExpectIntEQ(wolfSSL_ASN1_STRING_length(gn->d.dNSName), 11);
+            ExpectIntEQ(XMEMCMP(wolfSSL_ASN1_STRING_data(gn->d.dNSName),
+                "example.com", 11), 0);
+        }
+        else if (gn->type == WOLFSSL_GEN_DIRNAME) {
+            dirCount++;
+            ExpectNotNull(gn->d.dirn);
+            XMEMSET(buf, 0, sizeof(buf));
+            ExpectIntGT(wolfSSL_X509_NAME_get_text_by_NID(gn->d.dirn,
+                NID_commonName, buf, (int)sizeof(buf)), 0);
+            ExpectStrEQ(buf, "Dir Name SAN");
+            XMEMSET(buf, 0, sizeof(buf));
+            ExpectIntGT(wolfSSL_X509_NAME_get_text_by_NID(gn->d.dirn,
+                NID_organizationName, buf, (int)sizeof(buf)), 0);
+            ExpectStrEQ(buf, "wolfSSL");
+            XMEMSET(buf, 0, sizeof(buf));
+            ExpectIntGT(wolfSSL_X509_NAME_get_text_by_NID(gn->d.dirn,
+                NID_countryName, buf, (int)sizeof(buf)), 0);
+            ExpectStrEQ(buf, "US");
+        }
+        else {
+            ExpectIntEQ(gn->type, -1); /* unexpected entry type */
+        }
+    }
+    ExpectIntEQ(dnsCount, 1);
+    ExpectIntEQ(dirCount, 1);
+
+    wolfSSL_GENERAL_NAMES_free(gns);
+    gns = NULL;
+
+    /* Repeated calls must each produce independent, fully-owned results. */
+    for (i = 0; i < 3; i++) {
+        ExpectNotNull(gns = (WOLFSSL_GENERAL_NAMES*)wolfSSL_X509_get_ext_d2i(
+            x509, NID_subject_alt_name, NULL, NULL));
+        ExpectIntEQ(wolfSSL_sk_GENERAL_NAME_num(gns), 2);
+        wolfSSL_GENERAL_NAMES_free(gns);
+        gns = NULL;
+    }
+
+    wolfSSL_X509_free(x509);
+#endif
+    return EXPECT_RESULT();
+}
+
 int test_wolfSSL_X509V3_EXT_san(void)
 {
     EXPECT_DECLS;
@@ -1429,6 +1517,21 @@ int test_wolfSSL_X509V3_EXT_aia(void)
     wolfSSL_AUTHORITY_INFO_ACCESS_free(aia);
     aia = NULL;
 
+    if (ext != NULL) {
+        wolfSSL_sk_free(ext->ext_sk);
+        ext->ext_sk = NULL;
+    }
+    ExpectNotNull(sk = wolfSSL_sk_new_asn1_obj());
+    if (ext != NULL) {
+        ext->ext_sk = sk;
+        sk = NULL;
+    }
+    ExpectNotNull(aia = (WOLFSSL_AUTHORITY_INFO_ACCESS *)
+        wolfSSL_X509V3_EXT_d2i(ext));
+    ExpectIntEQ(wolfSSL_sk_num(aia), 0);
+    wolfSSL_AUTHORITY_INFO_ACCESS_free(aia);
+    aia = NULL;
+
     ExpectNotNull(entry = wolfSSL_ASN1_OBJECT_new());
     if (entry != NULL) {
         entry->nid = WC_NID_ad_OCSP;
@@ -1459,6 +1562,95 @@ int test_wolfSSL_X509V3_EXT_aia(void)
     return EXPECT_RESULT();
 }
 
+#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
+    !defined(WOLFSSL_X509_TINY)
+static int test_X509V3_EXT_d2i_keyid(int nid, const byte* der, int derSz,
+    const byte* keyId, int keyIdSz)
+{
+    EXPECT_DECLS;
+    WOLFSSL_X509_EXTENSION* ext = NULL;
+    WOLFSSL_ASN1_OBJECT* obj = NULL;
+    WOLFSSL_ASN1_STRING* val = NULL;
+    WOLFSSL_ASN1_STRING* str = NULL;
+    WOLFSSL_AUTHORITY_KEYID* akey = NULL;
+    void* d2i = NULL;
+
+    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
+    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
+    if (obj != NULL) {
+        obj->type = nid;
+        obj->nid = nid;
+    }
+    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
+    ExpectNotNull(val = wolfSSL_ASN1_STRING_new());
+    ExpectIntEQ(wolfSSL_ASN1_STRING_set(val, der, derSz), WOLFSSL_SUCCESS);
+    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, val), WOLFSSL_SUCCESS);
+
+    ExpectNotNull(d2i = wolfSSL_X509V3_EXT_d2i(ext));
+    if (nid == NID_authority_key_identifier) {
+        akey = (WOLFSSL_AUTHORITY_KEYID*)d2i;
+        str = (akey != NULL) ? akey->keyid : NULL;
+    }
+    else {
+        str = (WOLFSSL_ASN1_STRING*)d2i;
+    }
+    ExpectNotNull(str);
+    ExpectIntEQ(wolfSSL_ASN1_STRING_length(str), keyIdSz);
+    ExpectBufEQ(wolfSSL_ASN1_STRING_data(str), keyId, keyIdSz);
+
+    if (akey != NULL)
+        wolfSSL_AUTHORITY_KEYID_free(akey);
+    else
+        wolfSSL_ASN1_STRING_free((WOLFSSL_ASN1_STRING*)d2i);
+    wolfSSL_ASN1_STRING_free(val);
+    wolfSSL_ASN1_OBJECT_free(obj);
+    wolfSSL_X509_EXTENSION_free(ext);
+    return EXPECT_RESULT();
+}
+#endif
+
+int test_wolfSSL_X509V3_EXT_d2i_keyid(void)
+{
+    EXPECT_DECLS;
+#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)) && \
+    !defined(WOLFSSL_X509_TINY)
+    static const byte id8[8] = {
+        0x41, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08
+    };
+    static const byte id33[33] = {
+        0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+        0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+        0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+        0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
+        0x21
+    };
+    byte der[2 + 2 + sizeof(id33)];
+    word32 i;
+    const byte* ids[2];
+    word32 idSzs[2];
+
+    ids[0] = id8;  idSzs[0] = (word32)sizeof(id8);
+    ids[1] = id33; idSzs[1] = (word32)sizeof(id33);
+
+    for (i = 0; i < 2; i++) {
+        der[0] = ASN_OCTET_STRING;
+        der[1] = (byte)idSzs[i];
+        XMEMCPY(der + 2, ids[i], idSzs[i]);
+        ExpectIntEQ(test_X509V3_EXT_d2i_keyid(NID_subject_key_identifier,
+            der, (int)(2 + idSzs[i]), ids[i], (int)idSzs[i]), TEST_SUCCESS);
+
+        der[0] = ASN_SEQUENCE | ASN_CONSTRUCTED;
+        der[1] = (byte)(2 + idSzs[i]);
+        der[2] = ASN_CONTEXT_SPECIFIC | 0;
+        der[3] = (byte)idSzs[i];
+        XMEMCPY(der + 4, ids[i], idSzs[i]);
+        ExpectIntEQ(test_X509V3_EXT_d2i_keyid(NID_authority_key_identifier,
+            der, (int)(4 + idSzs[i]), ids[i], (int)idSzs[i]), TEST_SUCCESS);
+    }
+#endif
+    return EXPECT_RESULT();
+}
+
 int test_wolfSSL_X509V3_EXT(void)
 {
     EXPECT_DECLS;

tests/api/test_ossl_x509_ext.h

@@ -45,8 +45,10 @@ int test_wolfSSL_X509V3_EXT_get(void);
 int test_wolfSSL_X509V3_EXT_nconf(void);
 int test_wolfSSL_X509V3_EXT_bc(void);
 int test_wolfSSL_X509_get_ext_d2i_basic_constraints(void);
+int test_wolfSSL_X509_get_ext_d2i_dirname_san(void);
 int test_wolfSSL_X509V3_EXT_san(void);
 int test_wolfSSL_X509V3_EXT_aia(void);
+int test_wolfSSL_X509V3_EXT_d2i_keyid(void);
 int test_wolfSSL_X509V3_EXT(void);
 int test_wolfSSL_X509V3_EXT_print(void);
 int test_wolfSSL_X509_get_ext_d2i_name_constraints(void);
@@ -86,8 +88,11 @@ int test_wolfSSL_X509_set_ext_oid_collision(void);
     TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_bc),              \
     TEST_DECL_GROUP("ossl_x509_ext",                                           \
                           test_wolfSSL_X509_get_ext_d2i_basic_constraints),    \
+    TEST_DECL_GROUP("ossl_x509_ext",                                           \
+                          test_wolfSSL_X509_get_ext_d2i_dirname_san),          \
     TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_san),             \
     TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_aia),             \
+    TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_d2i_keyid),       \
     TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT),                 \
     TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_print),           \
     TEST_DECL_GROUP("ossl_x509_ext",                                           \