mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow a wider range of characters to be used in certificate fields, as laid out by RFC 4514. Fixes #7540

Browse Source
This commit is contained in:
jim-p 2017-05-11 16:38:53 -04:00
parent d777679c95
commit 83d2b83af9
3 changed files with 49 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/etc/inc/certs.inc
View File

@ -995,4 +995,20 @@ function cert_get_cn($crt, $isref = false) {
return "";
}
function cert_escape_x509_chars($str, $reverse = false) {
/* Characters which need escaped when present in x.509 fields.
* See https://www.ietf.org/rfc/rfc4514.txt
*
* The backslash (\) must be listed first in these arrays!
*/
$cert_directory_string_special_chars = array('\\', '"', '#', '+', ',', ';', '<', '=', '>');
$cert_directory_string_special_chars_esc = array('\\\\', '\"', '\#', '\+', '\,', '\;', '\<', '\=', '\>');
if ($reverse) {
return str_replace($cert_directory_string_special_chars_esc, $cert_directory_string_special_chars, $str);
} else {
/* First unescape and then escape again, to prevent possible double escaping. */
return str_replace($cert_directory_string_special_chars, $cert_directory_string_special_chars_esc, cert_escape_x509_chars($str, true));
}
}
?>

32
src/usr/local/www/system_camanager.php
View File

@ -220,12 +220,6 @@ if ($_POST['save']) {
if (preg_match("/[\!\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST["dn_email"])) {
array_push($input_errors, gettext("The field 'Distinguished name Email Address' contains invalid characters."));
}
} else if ($reqdfields[$i] == 'dn_commonname') {
if (preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST["dn_commonname"])) {
array_push($input_errors, gettext("The field 'Distinguished name Common Name' contains invalid characters."));
}
} else if (($reqdfields[$i] != "descr") && preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\.\"\']/", $_POST["$reqdfields[$i]"])) {
array_push($input_errors, sprintf(gettext("The field '%s' contains invalid characters."), $reqdfieldsn[$i]));
}
}
if (!in_array($_POST["keylen"], $ca_keylens)) {
@ -266,13 +260,13 @@ if ($_POST['save']) {
} else if ($pconfig['method'] == "internal") {
$dn = array(
'countryName' => $pconfig['dn_country'],
'stateOrProvinceName' => $pconfig['dn_state'],
'localityName' => $pconfig['dn_city'],
'organizationName' => $pconfig['dn_organization'],
'emailAddress' => $pconfig['dn_email'],
'commonName' => $pconfig['dn_commonname']);
'stateOrProvinceName' => cert_escape_x509_chars($pconfig['dn_state']),
'localityName' => cert_escape_x509_chars($pconfig['dn_city']),
'organizationName' => cert_escape_x509_chars($pconfig['dn_organization']),
'emailAddress' => cert_escape_x509_chars($pconfig['dn_email']),
'commonName' => cert_escape_x509_chars($pconfig['dn_commonname']));
if (!empty($pconfig['dn_organizationalunit'])) {
$dn['organizationalUnitName'] = $pconfig['dn_organizationalunit'];
$dn['organizationalUnitName'] = cert_escape_x509_chars($pconfig['dn_organizationalunit']);
}
if (!ca_create($ca, $pconfig['keylen'], $pconfig['lifetime'], $dn, $pconfig['digest_alg'])) {
$input_errors = array();
@ -285,13 +279,13 @@ if ($_POST['save']) {
} else if ($pconfig['method'] == "intermediate") {
$dn = array(
'countryName' => $pconfig['dn_country'],
'stateOrProvinceName' => $pconfig['dn_state'],
'localityName' => $pconfig['dn_city'],
'organizationName' => $pconfig['dn_organization'],
'emailAddress' => $pconfig['dn_email'],
'commonName' => $pconfig['dn_commonname']);
'stateOrProvinceName' => cert_escape_x509_chars($pconfig['dn_state']),
'localityName' => cert_escape_x509_chars($pconfig['dn_city']),
'organizationName' => cert_escape_x509_chars($pconfig['dn_organization']),
'emailAddress' => cert_escape_x509_chars($pconfig['dn_email']),
'commonName' => cert_escape_x509_chars($pconfig['dn_commonname']));
if (!empty($pconfig['dn_organizationalunit'])) {
$dn['organizationalUnitName'] = $pconfig['dn_organizationalunit'];
$dn['organizationalUnitName'] = cert_escape_x509_chars($pconfig['dn_organizationalunit']);
}
if (!ca_inter_create($ca, $pconfig['keylen'], $pconfig['lifetime'], $dn, $pconfig['caref'], $pconfig['digest_alg'])) {
$input_errors = array();
@ -387,7 +381,7 @@ foreach ($a_ca as $i => $ca):
} else {
$issuer_name = gettext("external");
}
$subj = htmlspecialchars($subj);
$subj = htmlspecialchars(cert_escape_x509_chars($subj, true));
$issuer = htmlspecialchars($issuer);
$certcount = 0;

46
src/usr/local/www/system_certmanager.php
View File

@ -351,12 +351,6 @@ if ($_POST['save']) {
if (preg_match("/[\!\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST[$reqdfields[$i]])) {
array_push($input_errors, gettext("The field 'Distinguished name Email Address' contains invalid characters."));
}
} else if (preg_match('/commonname/', $reqdfields[$i])) { /* dn_commonname or csr_dn_commonname */
if (preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST[$reqdfields[$i]])) {
array_push($input_errors, gettext("The field 'Distinguished name Common Name' contains invalid characters."));
}
} else if (($reqdfields[$i] != "descr") && preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\.\"\']/", $_POST[$reqdfields[$i]])) {
array_push($input_errors, sprintf(gettext("The field '%s' contains invalid characters."), $reqdfieldsn[$i]));
}
}
@ -443,13 +437,13 @@ if ($_POST['save']) {
if ($pconfig['method'] == "internal") {
$dn = array(
'countryName' => $pconfig['dn_country'],
'stateOrProvinceName' => $pconfig['dn_state'],
'localityName' => $pconfig['dn_city'],
'organizationName' => $pconfig['dn_organization'],
'emailAddress' => $pconfig['dn_email'],
'commonName' => $pconfig['dn_commonname']);
'stateOrProvinceName' => cert_escape_x509_chars($pconfig['dn_state']),
'localityName' => cert_escape_x509_chars($pconfig['dn_city']),
'organizationName' => cert_escape_x509_chars($pconfig['dn_organization']),
'emailAddress' => cert_escape_x509_chars($pconfig['dn_email']),
'commonName' => cert_escape_x509_chars($pconfig['dn_commonname']));
if (!empty($pconfig['dn_organizationalunit'])) {
$dn['organizationalUnitName'] = $pconfig['dn_organizationalunit'];
$dn['organizationalUnitName'] = cert_escape_x509_chars($pconfig['dn_organizationalunit']);
}
if (is_ipaddr($pconfig['dn_commonname'])) {
$altnames_tmp = array("IP:{$pconfig['dn_commonname']}");
@ -481,13 +475,13 @@ if ($_POST['save']) {
if ($pconfig['method'] == "external") {
$dn = array(
'countryName' => $pconfig['csr_dn_country'],
'stateOrProvinceName' => $pconfig['csr_dn_state'],
'localityName' => $pconfig['csr_dn_city'],
'organizationName' => $pconfig['csr_dn_organization'],
'emailAddress' => $pconfig['csr_dn_email'],
'commonName' => $pconfig['csr_dn_commonname']);
'stateOrProvinceName' => cert_escape_x509_chars($pconfig['csr_dn_state']),
'localityName' => cert_escape_x509_chars($pconfig['csr_dn_city']),
'organizationName' => cert_escape_x509_chars($pconfig['csr_dn_organization']),
'emailAddress' => cert_escape_x509_chars($pconfig['csr_dn_email']),
'commonName' => cert_escape_x509_chars($pconfig['csr_dn_commonname']));
if (!empty($pconfig['csr_dn_organizationalunit'])) {
$dn['organizationalUnitName'] = $pconfig['csr_dn_organizationalunit'];
$dn['organizationalUnitName'] = cert_escape_x509_chars($pconfig['csr_dn_organizationalunit']);
}
if (count($altnames)) {
$altnames_tmp = "";
@ -1119,7 +1113,7 @@ foreach ($a_cert as $i => $cert):
$caname = '<i>'. gettext("external").'</i>';
}
$subj = htmlspecialchars($subj);
$subj = htmlspecialchars(cert_escape_x509_chars($subj, true));
} else {
$subj = "";
$issuer = "";
@ -1130,7 +1124,7 @@ foreach ($a_cert as $i => $cert):
}
if ($cert['csr']) {
$subj = htmlspecialchars(csr_get_subject($cert['csr']));
$subj = htmlspecialchars(cert_escape_x509_chars(csr_get_subject($cert['csr']), true));
$sans = cert_get_sans($cert['crt']);
$caname = "<em>" . gettext("external - signature pending") . "</em>";
}
@ -1266,12 +1260,12 @@ events.push(function() {
$subject = cert_get_subject_array($ca['crt']);
?>
case "<?=$ca['refid'];?>":
$('#dn_country').val("<?=$subject[0]['v'];?>");
$('#dn_state').val("<?=$subject[1]['v'];?>");
$('#dn_city').val("<?=$subject[2]['v'];?>");
$('#dn_organization').val("<?=$subject[3]['v'];?>");
$('#dn_email').val("<?=$subject[4]['v'];?>");
$('#dn_organizationalunit').val("<?=$subject[6]['v'];?>");
$('#dn_country').val(<?=json_encode(cert_escape_x509_chars($subject[0]['v'], true));?>);
$('#dn_state').val(<?=json_encode(cert_escape_x509_chars($subject[1]['v'], true));?>);
$('#dn_city').val(<?=json_encode(cert_escape_x509_chars($subject[2]['v'], true));?>);
$('#dn_organization').val(<?=json_encode(cert_escape_x509_chars($subject[3]['v'], true));?>);
$('#dn_email').val(<?=json_encode(cert_escape_x509_chars($subject[4]['v'], true));?>);
$('#dn_organizationalunit').val(<?=json_encode(cert_escape_x509_chars($subject[6]['v'], true));?>);
break;
<?php
endforeach;