From f7927683f240e25d586c6ef7d7f19b934fef640f Mon Sep 17 00:00:00 2001 From: "i.metelytsia" Date: Mon, 22 Apr 2019 15:52:26 +0300 Subject: [PATCH] Algorithm for obtaining uuid from TLS data changed https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/487 (cherry picked from d42e96b2cea21f6c5ffa623d3a89f88789fdc260 Change-Id: I533bda62a54e3bad053764aaa99ac564b32e947e Signed-off-by: DoHyun Pyun --- .../src/adapter_util/ca_adapter_net_ssl.c | 126 +++++++++++++++------ 1 file changed, 89 insertions(+), 37 deletions(-) diff --git a/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c b/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c index af3a839..47e2199 100644 --- a/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c +++ b/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c @@ -125,6 +125,13 @@ */ #define UUID_LENGTH (128/8) /** + * @def UUID_STR_SIZE + * @brief Size of string representation RFC4122 based UUID. + * 32 chars for hex data and 4 '-' symbols. + */ +#define UUID_STR_SIZE (36) + +/** * @def MASTER_SECRET_LEN * @brief TLS master secret length */ @@ -2357,6 +2364,83 @@ void CAsetSslHandshakeCallback(CAErrorCallback tlsHandshakeCallback) OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__); } +/** + * Check RFC4122 based UUID + * + * @param uuidString string representation of UUID + * @return true for success, otherwise false + */ +static bool CheckUuidFormat(const char uuidString[UUID_STR_SIZE]) +{ + // Indexes of '-' symbols in string representation of UUID + static const int dash_idxs[4] = {8,13,18,23}; + + VERIFY_NON_NULL_RET(uuidString, NET_SSL_TAG, "uuidString is NULL" , false); + + // Check for '-' symbols + for (int i = 0; i < 4; i++) + { + if (uuidString[dash_idxs[i]] != '-') + { + return false; + } + } + + for (int i = 0; i < UUID_STR_SIZE; i++) + { + // Skip '-' symbols + if (i == dash_idxs[0] || i == dash_idxs[1] || i == dash_idxs[2] || i == dash_idxs[3]) + { + continue; + } + + if ((uuidString[i] >= 'a' && uuidString[i] <= 'f') + || (uuidString[i] >= 'A' && uuidString[i] <= 'F') + || (uuidString[i] >= '0' && uuidString[i] <= '9') ) + { + continue; + } + + return false; + } + + return true; +} + +/** + * FindUuid function finds the first entry of RFC4122 based UUID + * + * @param data pointer to unformatted data + * @param size data size + * + * @return pointer to string representation of the found UUID if success, otherwise NULL + */ +static const char* FindUuid(const char* data, size_t size) +{ + const char* result = NULL; + + VERIFY_NON_NULL_RET(data, NET_SSL_TAG, "data is NULL" , NULL); + if (size < UUID_STR_SIZE) + { + OIC_LOG(ERROR, NET_SSL_TAG, "Buffer size is too small"); + return NULL; + } + + const char* currentPtr = data; + int currentSize = size; + while (!result + && (currentPtr = (const char*)memchr((const void*)++currentPtr, '-', currentSize - 1)) + && ((currentSize = (size - (currentPtr - data))) >= (UUID_STR_SIZE - 8))) + { + if (currentPtr - data >= 8 && CheckUuidFormat(currentPtr - 8)) + { + result = currentPtr - 8; + } + } + + return result; +} + /* Read data from TLS connection */ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t dataLen) @@ -2454,9 +2538,6 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d if (MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 != selectedCipher && MBEDTLS_TLS_ECDH_ANON_WITH_AES_128_CBC_SHA256 != selectedCipher) { - char uuid[UUID_LENGTH * 2 + 5] = {0}; - void * uuidPos = NULL; - void * userIdPos = NULL; const mbedtls_x509_crt * peerCert = mbedtls_ssl_get_peer_cert(&peer->ssl); ret = (NULL == peerCert ? -1 : 0); if (g_CertificateVerificationCallback) @@ -2479,27 +2560,12 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d // CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_NO_CERT); if (0 == ret) { - uuidPos = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len, - UUID_PREFIX, sizeof(UUID_PREFIX) - 1); - - if (NULL == uuidPos) - { - void * posLeftBrace = NULL; - void * posRightBrace = NULL; - posLeftBrace = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len, "(", 1); - if (NULL != posLeftBrace) - { - posRightBrace = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len, ")", 1); - if (NULL != posRightBrace && posRightBrace - posLeftBrace - 1 == UUID_LENGTH * 2 + 4) - { - uuidPos = posLeftBrace; - } - } - } - - if (NULL != uuidPos) + const char* uuidptr = FindUuid((const char*)peerCert->subject_raw.p, peerCert->subject_raw.len); + if (uuidptr) { - memcpy(uuid, (char*) uuidPos + sizeof(UUID_PREFIX) - 1, UUID_LENGTH * 2 + 4); + char uuid[UUID_STR_SIZE + 1] = {0}; + strncpy(uuid, uuidptr, UUID_STR_SIZE); + uuid[UUID_STR_SIZE] = '\0'; OIC_LOG_V(DEBUG, NET_SSL_TAG, "certificate uuid string: %s" , uuid); ret = OCConvertStringToUuid(uuid, peer->sep.identity.id); SSL_CHECK_FAIL(peer, ret, "Failed to convert subject", 1, @@ -2509,20 +2575,6 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d { OIC_LOG(WARNING, NET_SSL_TAG, "uuid not found"); } - - userIdPos = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len, - USERID_PREFIX, sizeof(USERID_PREFIX) - 1); - if (NULL != userIdPos) - { - memcpy(uuid, (char*) userIdPos + sizeof(USERID_PREFIX) - 1, UUID_LENGTH * 2 + 4); - ret = OCConvertStringToUuid(uuid, peer->sep.userId.id); - SSL_CHECK_FAIL(peer, ret, "Failed to convert subject alt name", 1, - CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT); - } - else - { - OIC_LOG(WARNING, NET_SSL_TAG, "Subject alternative name not found"); - } } } -- 2.7.4