From ab2adeb411b2aaeb4b295d75092173467e26c26d Mon Sep 17 00:00:00 2001
From: Philipp Maier <pmaier@sysmocom.de>
Date: Tue, 6 Feb 2024 13:08:56 +0100
Subject: [PATCH] PKIX1Explicit88: remove broken constraint check in
 CertificateSerialNumber

The specificaton models the CertificateSerialNumber as an INTEGER.
Unfortunately certificate serial numbers can be quite long and easily
exceed long or unsigned long, which asn1c uses by default to implement
INTEGER values. However, we can force asn1c to use INTEGER_t, which
supports a wider value range by constraining a wide enough number range
for CertificateSerialNumber.

The ASN.1 spec was modified in commit: b819a133963ca31a39590f62c70987ee9930ae29

Unfortunately asn1c seems to have a problem to implement a constraint
that uses large integer numbers since it still uses long in the code
that checks the constraint. Fortunately we may remove this code manually
since we do not need the constraint check anyway. Since this affects the
generated code we must do this each time after we run asn1c.
---
 src/ipa/libasn/CertificateSerialNumber.c | 29 ++----------------------
 1 file changed, 2 insertions(+), 27 deletions(-)

diff --git a/src/ipa/libasn/CertificateSerialNumber.c b/src/ipa/libasn/CertificateSerialNumber.c
index 792c033..2a62b78 100644
--- a/src/ipa/libasn/CertificateSerialNumber.c
+++ b/src/ipa/libasn/CertificateSerialNumber.c
@@ -10,32 +10,7 @@
 int
 CertificateSerialNumber_constraint(const asn_TYPE_descriptor_t *td, const void *sptr,
 			asn_app_constraint_failed_f *ctfailcb, void *app_key) {
-	const INTEGER_t *st = (const INTEGER_t *)sptr;
-	long value;
-	
-	if(!sptr) {
-		ASN__CTFAIL(app_key, td, sptr,
-			"%s: value not given (%s:%d)",
-			td->name, __FILE__, __LINE__);
-		return -1;
-	}
-	
-	if(asn_INTEGER2long(st, &value)) {
-		ASN__CTFAIL(app_key, td, sptr,
-			"%s: value too large (%s:%d)",
-			td->name, __FILE__, __LINE__);
-		return -1;
-	}
-	
-	if((value >= 0 && value <= 999999999999999999999999999999999999)) {
-		/* Constraint check succeeded */
-		return 0;
-	} else {
-		ASN__CTFAIL(app_key, td, sptr,
-			"%s: constraint failed (%s:%d)",
-			td->name, __FILE__, __LINE__);
-		return -1;
-	}
+	return 0;
 }
 
 /*
@@ -46,7 +21,7 @@ static asn_oer_constraints_t asn_OER_type_CertificateSerialNumber_constr_1 CC_NO
 	{ 8, 1 }	/* (0..999999999999999999999999999999999999) */,
 	-1};
 asn_per_constraints_t asn_PER_type_CertificateSerialNumber_constr_1 CC_NOTUSED = {
-	{ APC_CONSTRAINED,	 120, -1,  0,  999999999999999999999999999999999999 }	/* (0..999999999999999999999999999999999999) */,
+	{ APC_CONSTRAINED,	 120, -1,  0,  0 },
 	{ APC_UNCONSTRAINED,	-1, -1,  0,  0 },
 	0, 0	/* No PER value map */
 };
-- 
2.20.1

