RE: [openssl-dev] Adding GET support to ocsp app

2014-09-29 Thread Salz, Rich
The decoder does not correctly NUL terminate p when it shrinks by replacing '%xx' with the corresponding octet. Arrgh. Thanks. -- Principal Security Engineer, Akamai Technologies IM: rs...@jabber.me Twitter: RichSalz __

Re: [openssl-dev] Adding GET support to ocsp app

2014-09-26 Thread Erwann Abalea
Bonjour Rich, +static char* urldecode(char* p) + { + unsigned char* out = (unsigned char *)p; + char* save = p; + + for ( ; *p; p++) + { + if (*p == '+') + *out++ = ' '; You're doing HTML-entity decoding here. URL

Re: [openssl-dev] Adding GET support to ocsp app

2014-09-26 Thread Viktor Dukhovni
On Thu, Sep 25, 2014 at 09:56:30PM -0500, Salz, Rich wrote: +static int tohex(char c) + { + switch (c) + { + case '0': return 0; + case '1': return 1; + case '2': return 2; + case '3': return 3; + case '4':

RE: [openssl-dev] Adding GET support to ocsp app

2014-09-26 Thread Salz, Rich
This code treats non-hex characters as zero, they should trigger an error. Be liberal in what you accept :) If there's a problem with it, the base64 decode or the DER parse will fail later. If there's not a problem with it, then there.. is no problem. + if (strchr(p, '+') !=

RE: [openssl-dev] Adding GET support to ocsp app

2014-09-26 Thread Salz, Rich
You're doing HTML-entity decoding here. URL decoding uses only the %xx stuff. See RFC3986. + else if (*p != '%') + *out++ = *p; Yes, I was treating it as an HTML form, not just a strict URI encoding. + /* URL decode? Really shouldn't be needed.

Re: [openssl-dev] Adding GET support to ocsp app

2014-09-26 Thread Viktor Dukhovni
On Fri, Sep 26, 2014 at 08:12:37PM -0500, Salz, Rich wrote: You're doing HTML-entity decoding here. URL decoding uses only the %xx stuff. See RFC3986. + else if (*p != '%') + *out++ = *p; Yes, I was treating it as an HTML form, not just a strict URI

RE: [openssl-dev] Adding GET support to ocsp app

2014-09-25 Thread Salz, Rich
I don't see where the OCSP request is de-base64-ified, and URL-decoded. In both cases, d2i_OCSP_REQUEST_bio is called to get the request, but it's done directly on the HTTP request line for a GET. I forgot to post the updated patch. Thanks Erwann. -- Principal Security Engineer, Akamai

Re: [openssl-dev] Adding GET support to ocsp app

2014-09-13 Thread Erwann Abalea
Le 11/09/2014 19:45, Salz, Rich a écrit : The attached diff adds GET support to ocsp. I'd appreciate any feedback. I don't see where the OCSP request is de-base64-ified, and URL-decoded. In both cases, d2i_OCSP_REQUEST_bio is called to get the request, but it's done directly on the HTTP

Re: [openssl-dev] Adding GET support to ocsp app

2014-09-12 Thread Erwann Abalea
(trying a resend, my email address has changed) Le 11/09/2014 19:45, Salz, Rich a écrit : The attached diff adds GET support to ocsp. I'd appreciate any feedback. I don't see where the OCSP request is de-base64-ified, and URL-decoded. In both cases, d2i_OCSP_REQUEST_bio is called to get

RE: [openssl-dev] Adding GET support to ocsp app

2014-09-12 Thread Salz, Rich
I don't see where the OCSP request is de-base64-ified, and URL-decoded. In both cases, d2i_OCSP_REQUEST_bio is called to get the request, but it's done directly on the HTTP request line for a GET. Doh! Right :( __ OpenSSL