Fix for setting wrong version in CSRs. #8136
Conversation
src/x509.c
Outdated
| @@ -14840,6 +14842,23 @@ void wolfSSL_X509_REQ_free(WOLFSSL_X509* req) | |||
| wolfSSL_X509_free(req); | |||
| } | |||
|
|
|||
| int wolfSSL_X509_REQ_set_version(WOLFSSL_X509 *x, long version) { | |||
There was a problem hiding this comment.
NIT: Functions use brace on new line.
src/x509.c
Outdated
| long wolfSSL_X509_REQ_get_version(const WOLFSSL_X509 *req) { | ||
| WOLFSSL_ENTER("wolfSSL_X509_REQ_get_version"); | ||
| if (req == NULL) { | ||
| return WOLFSSL_FAILURE; |
There was a problem hiding this comment.
Would prefer return return 0; /* invalid arg */ here instead of WOLFSSL_FAILURE = 0.
| @@ -14840,6 +14842,25 @@ void wolfSSL_X509_REQ_free(WOLFSSL_X509* req) | |||
| wolfSSL_X509_free(req); | |||
| } | |||
|
|
|||
| int wolfSSL_X509_REQ_set_version(WOLFSSL_X509 *x, long version) | |||
There was a problem hiding this comment.
See wolfSSL_X509_set_version -> x509->version = (int) v + 1;
| /* print version of cert. Note that we increment by 1 because for REQs, | ||
| * the value stored in x509->version is the actual value of the field; not | ||
| * the version. */ | ||
| if (X509PrintVersion(bio, (int)wolfSSL_X509_REQ_get_version(x509) + 1, 8) |
There was a problem hiding this comment.
Is this really the right way/place to adjust the version? The wolfSSL_X509_get_version and wolfSSL_X509_set_version do it differently.
There was a problem hiding this comment.
Yes, I think the reason this is correct is because this is specific for REQs; not certificates.
There was a problem hiding this comment.
Shouldn’t the +1 be inside the get function? Or is this the same way openssl does it?
There was a problem hiding this comment.
If the +1 was in the wolfSSL_X509_REQ_get_version() then it would return the wrong value. This behaviour matches OpenSSL.
|
retest this please |
Fixes ZD 18873
Testing