Codebase list certmonger / 803ac63
MS cert template: validate argument Update the server to validate the MS V2 certificate template option argument when adding or updating a request. Fixes: https://pagure.io/certmonger/issue/78 Fraser Tweedale 6 years ago
4 changed file(s) with 44 addition(s) and 3 deletion(s). Raw diff Collapse all Expand all
+3
-1
src/Makefile.am less more
185185 tdbusm_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(POPT_LIBS)
186186 serial_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LTLIBICONV)
187187 nl_check_LDADD = libcm.a $(CERTMONGER_LIBS)
188 submit_x_CFLAGS = $(AM_CFLAGS) -DCM_SUBMIT_X_MAIN
188 submit_x_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS) -DCM_SUBMIT_X_MAIN
189189 submit_x_SOURCES = submit-x.c submit-x.h submit-u.c submit-u.h log.c log.h \
190190 tm.c tm.h
191191 submit_x_LDADD = $(XMLRPC_LIBS) $(KRB5_LIBS) $(TALLOC_LIBS) \
204204 pkglibexec_PROGRAMS += scep-submit
205205 endif
206206 noinst_PROGRAMS += submit-h submit-d
207 ipa_submit_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS)
207208 ipa_submit_SOURCES = ipa.c srvloc.c srvloc.h store.h store-gen.c \
208209 submit-x.c submit-x.h submit-u.c submit-u.h \
209210 submit-e.h util.c util.h log.c log.h tm.c tm.h
210211 ipa_submit_LDADD = $(XMLRPC_LIBS) $(LDAP_LIBS) $(KRB5_LIBS) $(TALLOC_LIBS) \
211212 $(GMP_LIBS) $(IDN_LIBS) $(OPENSSL_LIBS) $(UUID_LIBS) \
212213 $(RESOLV_LIBS) $(LTLIBICONV) $(POPT_LIBS)
214 certmaster_submit_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS)
213215 certmaster_submit_SOURCES = certmaster.c submit-x.c submit-x.h \
214216 submit-e.h submit-u.c submit-u.h util.c util.h log.c log.h \
215217 tm.c tm.h
+13
-0
src/certext.c less more
16701670 return SECITEM_ArenaDupItem(arena, &encoded);
16711671 }
16721672
1673 /* Validate a V2 template spec */
1674 PRBool cm_ms_template_valid(char *template_spec) {
1675 PLArenaPool *arena = PORT_NewArena(sizeof(double));
1676 if (arena == NULL)
1677 return PR_FALSE;
1678 SECItem *result =
1679 cm_certext_build_certificate_template(arena, template_spec);
1680 PORT_FreeArena(arena, PR_FALSE);
1681 // *result has been freed, but we don't read it;
1682 // we only need to know whether the parse succeeded
1683 return result != NULL;
1684 }
1685
16731686 /* Build a Netscape certtype extension value. */
16741687 static SECItem *
16751688 cm_certext_build_ns_certtype(struct cm_store_entry *entry,
+5
-0
src/certext.h less more
1414 * along with this program. If not, see <http://www.gnu.org/licenses/>.
1515 */
1616
17 #include <prtypes.h>
18
1719 #ifndef cmcertext_h
1820 #define cmcertext_h
1921
2426 struct NSSInitContextStr *ctx,
2527 unsigned char **encoded, size_t *length);
2628
29 /* Validate a V2 template spec */
30 PRBool cm_ms_template_valid(char *template_spec);
31
2732 #endif
+23
-2
src/tdbush.c less more
3131
3232 #include "log.h"
3333 #include "cm.h"
34 #include "certext.h"
3435 #include "prefs.h"
3536 #include "store.h"
3637 #include "store-int.h"
15711572 CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE,
15721573 cm_tdbusm_dict_s);
15731574 if (param != NULL) {
1574 // TODO check validity
1575 if (param->value.s != NULL
1576 && strlen(param->value.s) > 0
1577 && !cm_ms_template_valid(param->value.s)) {
1578 cm_log(1, "Invalid V2 certificate template specifier: %s", param->value.s);
1579 ret = send_internal_base_bad_arg_error(
1580 conn, msg,
1581 _("Invalid V2 certificate template specifier: %s"),
1582 param->value.s,
1583 CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE);
1584 talloc_free(parent);
1585 return ret;
1586 }
15751587 new_entry->cm_template_certificate_template = maybe_strdup(new_entry,
15761588 param->value.s);
15771589 }
33673379 } else
33683380 if ((param->value_type == cm_tdbusm_dict_s) &&
33693381 (strcasecmp(param->key, CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE) == 0)) {
3382 if (param->value.s != NULL
3383 && strlen(param->value.s) > 0
3384 && !cm_ms_template_valid(param->value.s)) {
3385 cm_log(1, "Invalid V2 certificate template specifier: %s", param->value.s);
3386 return send_internal_base_bad_arg_error(
3387 conn, msg,
3388 _("Invalid V2 certificate template specifier: %s"),
3389 param->value.s,
3390 CM_DBUS_PROP_TEMPLATE_MS_CERTIFICATE_TEMPLATE);
3391 }
33703392 talloc_free(entry->cm_template_certificate_template);
3371 // TODO check validity
33723393 entry->cm_template_certificate_template =
33733394 maybe_strdup(entry, param->value.s);
33743395 if (n_propname + 2 < sizeof(propname) / sizeof(propname[0])) {