diff options
| author |  Vladimir Panteleev | 2018-04-11 14:01:32 +0300 |
|---|---|---|
| committer |  Benjamin Staneck | 2018-04-11 13:01:32 +0200 |
| commit | bbe89482c2c3e91bd5cbe196470a44656ab86295 (patch) | |
| tree | c8037e8b6ff7db8201de4cb54d4817e8a8b3fe75 /src/kvilib/net/KviSSL.cpp | |
| parent | use the StdUtils NSIS plugin (#2369) (diff) | |
| download | KVIrc-bbe89482c2c3e91bd5cbe196470a44656ab86295.tar.gz KVIrc-bbe89482c2c3e91bd5cbe196470a44656ab86295.tar.bz2 KVIrc-bbe89482c2c3e91bd5cbe196470a44656ab86295.zip | |
Support 64-bit X509 certificate serial numbers (#2363)
Support 64-bit X509 certificate serial numbers
Avoid "too large" errors when querying the serial number of a
certificate when it doesn't fit in a 32-bit integer. Use strings to query and store certificate serial numbers
Diffstat (limited to 'src/kvilib/net/KviSSL.cpp')
| -rw-r--r-- | src/kvilib/net/KviSSL.cpp | 28 |
1 files changed, 19 insertions, 9 deletions
diff --git a/src/kvilib/net/KviSSL.cpp b/src/kvilib/net/KviSSL.cpp index c310d5427..0da0cb286 100644 --- a/src/kvilib/net/KviSSL.cpp +++ b/src/kvilib/net/KviSSL.cpp @@ -322,8 +322,8 @@ void KviSSL::shutdown() { if(m_pSSL) { -//avoid to die on a SIGPIPE if the connection has close (SSL_shutdown can call send()) -//see bug #440 + //avoid to die on a SIGPIPE if the connection has close (SSL_shutdown can call send()) + //see bug #440 #if !(defined(COMPILE_ON_WINDOWS) || defined(COMPILE_ON_MINGW)) // ignore SIGPIPE @@ -704,7 +704,7 @@ int KviSSLCertificate::fingerprintDigestId() if(!m_pX509) return -1; - const X509_ALGOR *alg; + const X509_ALGOR * alg; #if OPENSSL_VERSION_NUMBER >= 0x10100005L X509_get0_signature(nullptr, &alg, m_pX509); #else @@ -715,7 +715,6 @@ int KviSSLCertificate::fingerprintDigestId() if(NID == NID_undef) { return 0; // unknown digest function: it means the signature can't be verified: the certificate can't be trusted - } const EVP_MD * mdType = nullptr; @@ -863,19 +862,30 @@ void KviSSLCertificate::extractPubKeyInfo() void KviSSLCertificate::extractSerialNumber() { + m_szSerialNumber.clear(); ASN1_INTEGER * i = X509_get_serialNumber(m_pX509); if(i) - m_iSerialNumber = ASN1_INTEGER_get(i); - else - m_iSerialNumber = -1; + { + BIGNUM * bn = ASN1_INTEGER_to_BN(i, nullptr); + if(bn) + { + char * str = BN_bn2dec(bn); + if(str) + { + m_szSerialNumber = KviCString(str); + OPENSSL_free(str); + } + BN_free(bn); + } + } } void KviSSLCertificate::extractSignature() { static char hexdigits[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' }; - const ASN1_BIT_STRING *sig; - const X509_ALGOR *alg; + const ASN1_BIT_STRING * sig; + const X509_ALGOR * alg; #if OPENSSL_VERSION_NUMBER >= 0x10100005L X509_get0_signature(&sig, &alg, m_pX509); #else |