francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
85 lines
3.6 KiB
Diff
85 lines
3.6 KiB
Diff
From e6c0d1ac7b480c0b5e36f660dd3c0f2b45e4c3ab Mon Sep 17 00:00:00 2001
|
|
From: Ruby Martin <ruby@wolfssl.com>
|
|
Date: Mon, 2 Jun 2025 16:38:32 -0600
|
|
Subject: [PATCH] create policy for WOLFSSL_APPLE_NATIVE_CERT_VALIDATION,
|
|
domain name checking
|
|
|
|
CVE: CVE-2025-7395
|
|
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/9864959e41bd9259f258c09171ae2ec1c43fbc7f]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
src/internal.c | 25 ++++++++++++++++++++-----
|
|
1 file changed, 20 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/internal.c b/src/internal.c
|
|
index 6bbd38fa8..2b090382f 100644
|
|
--- a/src/internal.c
|
|
+++ b/src/internal.c
|
|
@@ -221,7 +221,7 @@ WOLFSSL_CALLBACKS needs LARGE_STATIC_BUFFERS, please add LARGE_STATIC_BUFFERS
|
|
#include <Security/SecCertificate.h>
|
|
#include <Security/SecTrust.h>
|
|
#include <Security/SecPolicy.h>
|
|
-static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
|
|
+static int DoAppleNativeCertValidation(WOLFSSL* ssl, const WOLFSSL_BUFFER_INFO* certs,
|
|
int totalCerts);
|
|
#endif /* #if defined(__APPLE__) && defined(WOLFSSL_SYS_CA_CERTS) */
|
|
|
|
@@ -15992,7 +15992,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
* into wolfSSL, try to validate against the system certificates
|
|
* using Apple's native trust APIs */
|
|
if ((ret != 0) && (ssl->ctx->doAppleNativeCertValidationFlag)) {
|
|
- if (DoAppleNativeCertValidation(args->certs,
|
|
+ if (DoAppleNativeCertValidation(ssl, args->certs,
|
|
args->totalCerts)) {
|
|
WOLFSSL_MSG("Apple native cert chain validation SUCCESS");
|
|
ret = 0;
|
|
@@ -41246,7 +41246,8 @@ cleanup:
|
|
* wolfSSL's built-in certificate validation mechanisms anymore. We instead
|
|
* must call into the Security Framework APIs to authenticate peer certificates
|
|
*/
|
|
-static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
|
|
+static int DoAppleNativeCertValidation(WOLFSSL* ssl,
|
|
+ const WOLFSSL_BUFFER_INFO* certs,
|
|
int totalCerts)
|
|
{
|
|
int i;
|
|
@@ -41255,7 +41256,8 @@ static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
|
|
CFMutableArrayRef certArray = NULL;
|
|
SecCertificateRef secCert = NULL;
|
|
SecTrustRef trust = NULL;
|
|
- SecPolicyRef policy = NULL ;
|
|
+ SecPolicyRef policy = NULL;
|
|
+ CFStringRef hostname = NULL;
|
|
|
|
WOLFSSL_ENTER("DoAppleNativeCertValidation");
|
|
|
|
@@ -41283,7 +41285,17 @@ static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
|
|
}
|
|
|
|
/* Create trust object for SecCertifiate Ref */
|
|
- policy = SecPolicyCreateSSL(true, NULL);
|
|
+ if (ssl->buffers.domainName.buffer &&
|
|
+ ssl->buffers.domainName.length > 0) {
|
|
+ /* Create policy with specified value to require host name match */
|
|
+ hostname = CFStringCreateWithCString(kCFAllocatorDefault,
|
|
+ (const char*)ssl->buffers.domainName.buffer, kCFStringEncodingUTF8);
|
|
+ }
|
|
+ if (hostname != NULL) {
|
|
+ policy = SecPolicyCreateSSL(true, hostname);
|
|
+ } else {
|
|
+ policy = SecPolicyCreateSSL(true, NULL);
|
|
+ }
|
|
status = SecTrustCreateWithCertificates(certArray, policy, &trust);
|
|
if (status != errSecSuccess) {
|
|
WOLFSSL_MSG_EX("Error creating trust object, "
|
|
@@ -41314,6 +41326,9 @@ cleanup:
|
|
if (policy) {
|
|
CFRelease(policy);
|
|
}
|
|
+ if (hostname) {
|
|
+ CFRelease(hostname);
|
|
+ }
|
|
|
|
WOLFSSL_LEAVE("DoAppleNativeCertValidation", ret);
|
|
|