1945248 - rsclientcerts rejects certificates without an explicit version

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) [:keeler]]

In rsclientcerts::util we have:

pub fn read_encoded_certificate_identifiers(
    certificate: &[u8],
) -> Result<(Vec<u8>, Vec<u8>, Vec<u8>), Error> {
    let mut certificate_sequence = Sequence::new(certificate)?;
    let mut tbs_certificate_sequence = certificate_sequence.read_sequence()?;
    let _version = tbs_certificate_sequence.read_tagged_value(0)?;
    let serial_number = tbs_certificate_sequence.read_encoded_sequence_component(INTEGER)?;
    let _signature = tbs_certificate_sequence.read_sequence()?;
    let issuer =
        tbs_certificate_sequence.read_encoded_sequence_component(SEQUENCE | CONSTRUCTED)?;
    let _validity = tbs_certificate_sequence.read_sequence()?;
    let subject =
        tbs_certificate_sequence.read_encoded_sequence_component(SEQUENCE | CONSTRUCTED)?;
    Ok((serial_number, issuer, subject))
}

Since _version may be the default of 1, it may not be present. rsclientcerts needs to handle this.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1945248 - rsclientcerts: handle certificates with default version r?nkulatova

In rsclientcerts::read_encoded_certificate_identifiers, the code that reads the
version field assumed it will always be present. However, since it is defined
to have a default value (see e.g. RFC 5280), it may not be present. This patch
updates the implementation to take this into account.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/492d57b8c50d
rsclientcerts: handle certificates with default version r=nkulatova

Comment 3

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/492d57b8c50d