From 4d7b40aacbf59278ea30e7f4ece9e9a253d6231f Mon Sep 17 00:00:00 2001 From: Bhanu Prakash <35184675+BhanuPrakash-P@users.noreply.github.com> Date: Thu, 25 Jul 2024 13:25:12 +0530 Subject: [PATCH 1/4] Fix pkcs8 unencrypted private key parsing with Attributes field Signed-off-by: Bhanu Prakash <35184675+BhanuPrakash-P@users.noreply.github.com> Signed-off-by: Bhanu Prakash Pathi --- library/pkparse.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/library/pkparse.c b/library/pkparse.c index e1422df771..96da19789c 100644 --- a/library/pkparse.c +++ b/library/pkparse.c @@ -1417,7 +1417,18 @@ static int pk_parse_key_pkcs8_unencrypted_der( #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; - end = p + len; + p = p+len; + if (p != end) { + /* + * Is 'attributes' present? + */ + if ((ret = mbedtls_asn1_get_tag(&p, end, &len, + MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | + 0)) != 0) { + return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret); + } + } + if (end != (key + keylen)) { return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); From ddc44563aab1c0497f5fa7adb1accf28d3ff500e Mon Sep 17 00:00:00 2001 From: Bhanu Prakash <35184675+BhanuPrakash-P@users.noreply.github.com> Date: Fri, 26 Jul 2024 11:37:16 +0530 Subject: [PATCH 2/4] Remove whitespaces causing CI failures Signed-off-by: Bhanu Prakash <35184675+BhanuPrakash-P@users.noreply.github.com> Signed-off-by: Bhanu Prakash Pathi --- library/pkparse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/pkparse.c b/library/pkparse.c index 96da19789c..2fb84a378a 100644 --- a/library/pkparse.c +++ b/library/pkparse.c @@ -1417,7 +1417,7 @@ static int pk_parse_key_pkcs8_unencrypted_der( #endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG; - p = p+len; + p = p + len; if (p != end) { /* * Is 'attributes' present? From 609960ad55b44595775e601ef2323fc33c2a119c Mon Sep 17 00:00:00 2001 From: Bhanu Prakash Pathi Date: Fri, 26 Jul 2024 15:13:07 +0530 Subject: [PATCH 3/4] Update changelog with bugfix details Signed-off-by: Bhanu Prakash Pathi --- ...s8-unencrypted-privatekey-parsing-with-Attributes-field.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/fix-pkcs8-unencrypted-privatekey-parsing-with-Attributes-field.txt diff --git a/ChangeLog.d/fix-pkcs8-unencrypted-privatekey-parsing-with-Attributes-field.txt b/ChangeLog.d/fix-pkcs8-unencrypted-privatekey-parsing-with-Attributes-field.txt new file mode 100644 index 0000000000..b18b3c798c --- /dev/null +++ b/ChangeLog.d/fix-pkcs8-unencrypted-privatekey-parsing-with-Attributes-field.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix a bug in pk_parse_key_pkcs8_unencrypted_der() where parsing of a pkcs8 + unencrypted private key with Attributes field is failing. Fixes #9422. From 6d575df0c4899d1317eb5517268e7509e6e33c78 Mon Sep 17 00:00:00 2001 From: Bhanu Prakash Pathi Date: Wed, 31 Jul 2024 18:33:40 +0530 Subject: [PATCH 4/4] Add testcases Signed-off-by: BhanuPrakash-P --- tests/suites/test_suite_pkparse.data | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/suites/test_suite_pkparse.data b/tests/suites/test_suite_pkparse.data index f82dcb5e23..5dcc216175 100644 --- a/tests/suites/test_suite_pkparse.data +++ b/tests/suites/test_suite_pkparse.data @@ -1227,6 +1227,10 @@ Key ASN1 (Encrypted key PKCS12, trailing garbage data) depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_ECP_HAVE_CURVE25519:MBEDTLS_MD_CAN_SHA1:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_CIPHER_PADDING_PKCS7:MBEDTLS_PKCS12_C pk_parse_key_encrypted:"3058301C060A2A864886F70D010C0103300E0409CCCCCCCCCCCCCCCCCC02010A04380A8CAF39C4FA001884D0583B323C5E70942444FBE1F650B92F8ADF4AD7BD5049B4748F53A2531139EBF253FE01E8FC925C82C759C944B4D0":"AAAAAAAAAAAAAAAAAA":MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +Key ASN1 (EC Private Key secp521r1, with attributes) +depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_PEM_PARSE_C:MBEDTLS_ECP_HAVE_SECP521R1 +pk_parse_key:"30820106020100301006072A8648CE3D020106052B810400230481DF3081DC0201010442007C669151F76D243A587CC4DD7CFF90B3C8E857CB2C323590FAF44E543762A0A31EFDD237BA698B7DB97EF33C7FDD52FE9A34E58152260809FE70B667F85B370E25A00706052B81040023A18189038186000400C98AA844DA0749858F8C0A7912842E6DD6DE64107ED626429FD808BDBF32A1914352097C25F3C4AB028F45485F382AC2F956972028EB2F552498CF3D0618B631F00069C8611227C6144C50F889D47BC558943A28FF357C0B8FC24D417BC7697DDED76E5525E8BCBEEBD9F2B0D299B120E5359DFB2825ACFBB30517D00F71E772B9D9C7A00D300B0603551D0F310403020080":0 + # From RFC8410 Appendix A but made into version 0 OneAsymmetricKey X25519, doesn't match masking requirements #1 depends_on:MBEDTLS_ECP_HAVE_CURVE25519