8000 Thanks to Christoph Scrauth for helping me find these issues. · DevEdocs/openssl-net@d22d807 · GitHub
[go: up one dir, main page]
Skip to content

Commit d22d807

Browse files
author
friedric
committed
Thanks to Christoph Scrauth for helping me find these issues.
* Adding a testcase that just creates a SelfSigned CA to illuminate some bugs. * Adding a parameter to the DSA ctor to force users to decide whether to generate keys or not. If keys are not generated and this object is used in some openssl functions you'll get undefined behavior and hard to track down AVs. * Making the X509CertificateAuthority disposable * Native.ExpectSuccess() now checks ret <= 0 instead of ret < 0. This properly catches all (hopefully) all error cases. git-svn-id: https://openssl-net.svn.sourceforge.net/svnroot/openssl-net/trunk@49 e5482c99-4a0f-0410-8b6a-bb65b18b6982
1 parent 3e1ec9f commit d22d807

File tree

11 files changed

+205
-78
lines changed

11 files changed

+205
-78
lines changed

‎ManagedOpenSsl.XML

Lines changed: 6 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
< 10000 div class="Diff-module__diffHeaderWrapper--rsdD4" style="--header-sticky-offset:0px">

‎ManagedOpenSsl/DSA.cs

Lines changed: 4 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2006-2007 Frank Laub
1+
// Copyright (c) 2006-2008 Frank Laub
22
// All rights reserved.
33

44
// Redistribution and use in source and binary forms, with or without
@@ -30,69 +30,6 @@
3030

3131
namespace OpenSSL
3232
{
33-
//#region DSAParameters
34-
//public class DSAParameters : Base, IDisposable
35-
//{
36-
// public DSAParameters(BIO bio)
37-
// : base(Native.ExpectNonNull(Native.PEM_read_bio_DSAparams(bio.Handle, IntPtr.Zero, null, IntPtr.Zero)), true)
38-
// {
39-
// }
40-
41-
// public DSAParameters(string pem)
42-
// : this(new BIO(pem))
43-
// {
44-
// }
45-
46-
// public DSAParameters(int bits)
47-
// : base(Native.ExpectNonNull(Native.DSA_generate_parameters(
48-
// bits,
49-
// null,
50-
// 0,
51-
// IntPtr.Zero,
52-
// IntPtr.Zero,
53-
// IntPtr.Zero,
54-
// IntPtr.Zero)), true)
55-
// {
56-
// }
57-
58-
// internal IntPtr TakeOwnership()
59-
// {
60-
// IntPtr ptr = this.ptr;
61-
// this.ptr = IntPtr.Zero;
62-
// return ptr;
63-
// }
64-
65-
// public string PEM
66-
// {
67-
// get
68-
// {
69-
// using (BIO bio = BIO.MemoryBuffer())
70-
// {
71-
// this.Write(bio);
72-
// return bio.ReadString();
73-
// }
74-
// }
75-
// }
76-
77-
// public void Write(BIO bio)
78-
// {
79-
// Native.ExpectSuccess(Native.PEM_write_bio_DSAparams(bio.Handle, this.ptr));
80-
// }
81-
82-
// public override void Print(BIO bio)
83-
// {
84-
// Native.ExpectSuccess(Native.DSAparams_print(bio.Handle, this.ptr));
85-
// }
86-
87-
// #region IDisposable Members
88-
// public override void OnDispose()
89-
// {
90-
// Native.DSA_free(this.ptr);
91-
// }
92-
// #endregion
93-
//}
94-
//#endregion
95-
9633
/// <summary>
9734
/// Wraps the DSA_* functions
9835
/// </summary>
@@ -141,7 +78,7 @@ internal DSA(IntPtr ptr, bool owner) : base(ptr, owner) {}
14178
/// <summary>
14279
/// Calls DSA_new() then DSA_generate_parameters_ex()
14380
/// </summary>
144-
public DSA()
81+
public DSA(bool generateKeys)
14582
: base(Native.ExpectNonNull(Native.DSA_new()), true)
14683
{
14784
Native.ExpectSuccess(Native.DSA_generate_parameters_ex(
@@ -152,6 +89,8 @@ public DSA()
15289
out this.h,
15390
null)
15491
);
92+
if (generateKeys)
93+
this.GenerateKeys();
15594
}
15695

15796
/// <summary>

‎ManagedOpenSsl/Native.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2006-2007 Frank Laub
1+
// Copyright (c) 2006-2008 Frank Laub
22
// All rights reserved.
33

44
// Redistribution and use in source and binary forms, with or without
@@ -1479,7 +1479,7 @@ public static IntPtr ExpectNonNull(IntPtr ptr)
14791479

14801480
public static int ExpectSuccess(int ret)
14811481
{
1482-
if (ret < 0)
1482+
if (ret <= 0)
14831483
throw new OpenSslException();
14841484
return ret;
14851485
}

‎ManagedOpenSsl/X509CertificateAuthority.cs

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2006-2007 Frank Laub
1+
// Copyright (c) 2006-2008 Frank Laub
22
// All rights reserved.
33

44
// Redistribution and use in source and binary forms, with or without
@@ -135,7 +135,7 @@ public int Next()
135135
/// Duties include processing incoming X509 requests and responding
136136
/// with signed X509 certificates, signed by this CA's private key.
137137
/// </summary>
138-
public class X509CertificateAuthority
138+
public class X509CertificateAuthority : IDisposable
139139
{
140140
private X509Certificate caCert;
141141
private CryptoKey caKey;
@@ -156,16 +156,16 @@ public static X509CertificateAuthority SelfSigned(
156156
Configuration cfg,
157157
ISequenceNumber seq,
158158
X509Name subject,
159-
DateTime start,
159+
DateTime start,
160160
TimeSpan validity)
161161
{
162-
CryptoKey key = new CryptoKey(new DSA());
162+
CryptoKey key = new CryptoKey(new DSA(true));
163163
X509Certificate cert = new X509Certificate(
164164
seq.Next(),
165165
subject,
166166
subject,
167167
key,
168-
start,
168+
start,
169169
start + validity);
170170

171171
if(cfg != null)
@@ -240,5 +240,22 @@ public X509Certificate ProcessRequest(X509Request request, DateTime startTime, D
240240

241241
return cert;
242242
}
243+
244+
#region IDisposable Members
245+
246+
/// <summary>
247+
/// Dispose the key, certificate, and the configuration
248+
/// </summary>
249+
public void Dispose()
250+
{
251+
if (this.caKey != null)
252+
this.caKey.Dispose();
253+
if (this.caCert != null)
254+
this.caCert.Dispose();
255+
if (this.cfg != null)
256+
this.cfg.Dispose();
257+
}
258+
259+
#endregion
243260
}
244261
}

‎bin/Debug/openssl.cnf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#
2+
# OpenSSL configuration file.
3+
# This is mostly being used for generation of certificate requests.
4+
#
5+
6+
# Extra OBJECT IDENTIFIER info:
7+
#oid_file = $ENV::HOME/.oid
8+
oid_section = new_oids
9+
10+
[ new_oids ]
11+
# We can add new OIDs in here for use by 'ca' and 'req'.
12+
# Add a simple OID like this:
13+
# testoid1=1.2.3.4
14+
# Or use config file substitution like this:
15+
# testoid2=${testoid1}.5.6
16+
17+
[ usr_cert ]
18+
# These extensions are added when 'ca' signs a request.
19+
keyUsage = nonRepudiation, digitalSignature
20+
#nsComment = "OpenSSL Generated Certificate"
21+
# PKIX recommendations harmless if included in all certificates.
22+
subjectKeyIdentifier=hash
23+
authorityKeyIdentifier=keyid,issuer:always
24+
25+
[ v3_req ]
26+
# Extensions to add to a certificate request
27+
#basicConstraints = CA:FALSE
28+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
29+
30+
[ v3_ca ]
31+
# Extensions for a typical CA
32+
# PKIX recommendation.
33+
subjectKeyIdentifier=hash
34+
authorityKeyIdentifier=keyid:always,issuer:always
35+
basicConstraints = critical,CA:true
36+
keyUsage = cRLSign, keyCertSign
37+
38+
[ crl_ext ]
39+
# CRL extensions.
40+
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
41+
# issuerAltName=issuer:copy
42+
authorityKeyIdentifier=keyid:always,issuer:always
43+
44+
#[ proxy_cert_ext ]
45+
# These extensions should be added when creating a proxy certificate
46+
# PKIX recommendations harmless if included in all certificates.
47+
#subjectKeyIdentifier=hash
48+
#authorityKeyIdentifier=keyid,issuer:always
49+
50+
# This really needs to be in place for it to be a proxy certificate.
51+
#proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

‎sandbox/Program.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2006-2007 Frank Laub
1+
// Copyright (c) 2006-2008 Frank Laub
22
// All rights reserved.
33

44
// Redistribution and use in source and binary forms, with or without
@@ -48,7 +48,7 @@ static void Main(string[] args)
4848
DateTime.Now,
4949
TimeSpan.FromDays(365));
5050

51-
Identity comId = new Identity(new CryptoKey(new DSA()));
51+
Identity comId = new Identity(new CryptoKey(new DSA(true)));
5252
X509Request comReq = comId.CreateRequest("com");
5353
X509Certificate comCert = root.ProcessRequest(comReq, DateTime.Now, DateTime.Now + TimeSpan.FromDays(365));
5454

@@ -60,14 +60,14 @@ static void Main(string[] args)
6060
new SimpleSerialNumber(),
6161
cfg);
6262

63-
Identity id1 = new Identity(new CryptoKey(new DSA()));
63+
Identity id1 = new Identity(new CryptoKey(new DSA(true)));
6464
X509Request req1 = id1.CreateRequest("1");
6565
X509Certificate cert1 = com.ProcessRequest(
6666
req1,
6767
DateTime.Now,
6868
DateTime.Now + TimeSpan.FromDays(365));
6969

70-
Identity id2 = new Identity(new CryptoKey(new DSA()));
70+
Identity id2 = new Identity(new CryptoKey(new DSA(true)));
7171
X509Request req2 = id2.CreateRequest("2");
7272
X509Certificate cert2 = rogue.ProcessRequest(
7373
req2,

‎test/Program.cs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2006-2007 Frank Laub
1+
// Copyright (c) 2006-2008 Frank Laub
22
// All rights reserved.
33

44
// Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
2727
using System.Collections.Generic;
2828
using System.Text;
2929
using OpenSSL;
30+
using System.Threading;
3031

3132
namespace test
3233
{
@@ -78,6 +79,7 @@ void AddNullCommand(SortedDictionary<string, ICommand> map, string name)
7879
tests.Add("sha512", new TestSHA512());
7980
tests.Add("rsa", new TestRSA());
8081
tests.Add("rand", new TestRandom());
82+
tests.Add("x509", new TestX509());
8183

8284
AddNullCommand(tests, "bf");
8385
AddNullCommand(tests, "bn");

‎test/TestX509.cs

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// Copyright (c) 2006-2008 Frank Laub
2+
// All rights reserved.
3+
4+
// Redistribution and use in source and binary forms, with or without
5+
// modification, are permitted provided that the following conditions
6+
// are met:
7+
// 1. Redistributions of source code must retain the above copyright
8+
// notice, this list of conditions and the following disclaimer.
9+
// 2. Redistributions in binary form must reproduce the above copyright
10+
// notice, this list of conditions and t 10000 he following disclaimer in the
11+
// documentation and/or other materials provided with the distribution.
12+
// 3. The name of the author may not be used to endorse or promote products
13+
// derived from this software without specific prior written permission.
14+
//
15+
// THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16+
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17+
// OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18+
// IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19+
// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20+
// NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21+
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22+
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23+
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24+
// THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25+
26+
using System;
27+
using System.Collections.Generic;
28+
using System.Text;
29+
using OpenSSL;
30+
31+
namespace test
32+
{
33+
class TestX509 : ICommand
34+
{
35+
#region ICommand Members
36+
37+
public void Execute(string[] args)
38+
{
39+
using (Configuration cfg = new Configuration("openssl.cnf"))
40+
{
41+
using (X509CertificateAuthority root = X509CertificateAuthority.SelfSigned(
42+
cfg,
43+
new SimpleSerialNumber(),
44+
"Root1",
45+
DateTime.Now,
46+
TimeSpan.FromDays(365)))
47+
{
48+
Console.WriteLine(root.Certificate);
49+
}
50+
}
51+
}
52+
53+
#endregion
54+
}
55+
}

0 commit comments

Comments
 (0)
0