mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
91 lines
3.2 KiB
C
91 lines
3.2 KiB
C
/* Provenance: openssl/openssl check_policy (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: b013765abfa80036dc779dd0e50602c57bb3bf95
|
|
* parent: f675d164e5d9648c3537a0f5efe1cc2fd232b4a9
|
|
* commit_url: https://github.com/openssl/openssl/commit/b013765abfa80036dc779dd0e50602c57bb3bf95
|
|
* cve: CVE-2023-0465
|
|
* license: Apache-2.0
|
|
* function: check_policy
|
|
* relpath: crypto/x509/x509_vfy.c
|
|
*/
|
|
|
|
static int check_policy(X509_STORE_CTX *ctx)
|
|
{
|
|
int ret;
|
|
|
|
if (ctx->parent)
|
|
return 1;
|
|
/*
|
|
* With DANE, the trust anchor might be a bare public key, not a
|
|
* certificate! In that case our chain does not have the trust anchor
|
|
* certificate as a top-most element. This comports well with RFC5280
|
|
* chain verification, since there too, the trust anchor is not part of the
|
|
* chain to be verified. In particular, X509_policy_check() does not look
|
|
* at the TA cert, but assumes that it is present as the top-most chain
|
|
* element. We therefore temporarily push a NULL cert onto the chain if it
|
|
* was verified via a bare public key, and pop it off right after the
|
|
* X509_policy_check() call.
|
|
*/
|
|
if (ctx->bare_ta_signed && !sk_X509_push(ctx->chain, NULL)) {
|
|
X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
|
|
ctx->error = X509_V_ERR_OUT_OF_MEM;
|
|
return 0;
|
|
}
|
|
ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
|
|
ctx->param->policies, ctx->param->flags);
|
|
if (ctx->bare_ta_signed)
|
|
sk_X509_pop(ctx->chain);
|
|
|
|
if (ret == X509_PCY_TREE_INTERNAL) {
|
|
X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE);
|
|
ctx->error = X509_V_ERR_OUT_OF_MEM;
|
|
return 0;
|
|
}
|
|
/* Invalid or inconsistent extensions */
|
|
if (ret == X509_PCY_TREE_INVALID) {
|
|
int i, cbcalled = 0;
|
|
|
|
/* Locate certificates with bad extensions and notify callback. */
|
|
for (i = 0; i < sk_X509_num(ctx->chain); i++) {
|
|
X509 *x = sk_X509_value(ctx->chain, i);
|
|
|
|
if (!(x->ex_flags & EXFLAG_INVALID_POLICY))
|
|
continue;
|
|
cbcalled = 1;
|
|
if (!verify_cb_cert(ctx, x, i,
|
|
X509_V_ERR_INVALID_POLICY_EXTENSION))
|
|
return 0;
|
|
}
|
|
if (!cbcalled) {
|
|
/* Should not be able to get here */
|
|
X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR);
|
|
return 0;
|
|
}
|
|
/* The callback ignored the error so we return success */
|
|
return 1;
|
|
}
|
|
if (ret == X509_PCY_TREE_FAILURE) {
|
|
ctx->current_cert = NULL;
|
|
ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY;
|
|
return ctx->verify_cb(0, ctx);
|
|
}
|
|
if (ret != X509_PCY_TREE_VALID) {
|
|
X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR);
|
|
return 0;
|
|
}
|
|
|
|
if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) {
|
|
ctx->current_cert = NULL;
|
|
/*
|
|
* Verification errors need to be "sticky", a callback may have allowed
|
|
* an SSL handshake to continue despite an error, and we must then
|
|
* remain in an error state. Therefore, we MUST NOT clear earlier
|
|
* verification errors by setting the error to X509_V_OK.
|
|
*/
|
|
if (!ctx->verify_cb(2, ctx))
|
|
return 0;
|
|
}
|
|
|
|
return 1;
|
|
}
|