denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

certificates: Retrieve serial numbers in canonical form

Browse Source 
The x509 plugin retrieves serial numbers with two's complement
encoding whereas the openssl plugin partially returns them without
leading zeroes.

Serial numbers in X.509 certificates, X.509 CRL, X.509 attribute
certificates, OCSP Requests and OCSP responses are now returned in
canonical form without prepended zero octets.
This commit is contained in:
Andreas Steffen
2022-12-05 20:18:24 +01:00
parent cb5ae75ac1
commit 18082ce2b0
10 changed files with 90 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/certificates/certificate_printer.c
+5 -8
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2015 Andreas Steffen
* Copyright (C) 2015-2022 Andreas Steffen
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
@@ -85,7 +85,7 @@ static void print_x509(private_certificate_printer_t *this, x509_t *x509)
x509_policy_mapping_t *mapping;
FILE *f = this->f;
chunk = chunk_skip_zero(x509->get_serial(x509));
chunk = x509->get_serial(x509);
fprintf(f, " serial: %#B\n", &chunk);
first = TRUE;
@@ -341,12 +341,11 @@ static void print_crl(private_certificate_printer_t *this, crl_t *crl)
x509_cdp_t *cdp;
FILE *f = this->f;
chunk = chunk_skip_zero(crl->get_serial(crl));
chunk = crl->get_serial(crl);
fprintf(f, " serial: %#B\n", &chunk);
if (crl->is_delta_crl(crl, &chunk))
{
chunk = chunk_skip_zero(chunk);
fprintf(f, " delta CRL: for serial %#B\n", &chunk);
}
chunk = crl->get_authKeyIdentifier(crl);
@@ -388,7 +387,6 @@ static void print_crl(private_certificate_printer_t *this, crl_t *crl)
enumerator = crl->create_enumerator(crl);
while (enumerator->enumerate(enumerator, &chunk, &ts, &reason))
{
chunk = chunk_skip_zero(chunk);
fprintf(f, " %#B: %T, %N\n", &chunk, &ts, this->utc,
crl_reason_names, reason);
}
@@ -408,7 +406,7 @@ static void print_ac(private_certificate_printer_t *this, ac_t *ac)
bool first = TRUE;
FILE *f = this->f;
chunk = chunk_skip_zero(ac->get_serial(ac));
chunk = ac->get_serial(ac);
fprintf(f, " serial: %#B\n", &chunk);
id = ac->get_holderIssuer(ac);
@@ -416,7 +414,7 @@ static void print_ac(private_certificate_printer_t *this, ac_t *ac)
{
fprintf(f, " hissuer: \"%Y\"\n", id);
}
chunk = chunk_skip_zero(ac->get_holderSerial(ac));
chunk = ac->get_holderSerial(ac);
if (chunk.ptr)
{
fprintf(f, " hserial: %#B\n", &chunk);
@@ -507,7 +505,6 @@ static void print_ocsp_response(private_certificate_printer_t *this,
{
fprintf(f, " ");
}
serialNumber = chunk_skip_zero(serialNumber);
switch (status)
{
src/libstrongswan/credentials/certificates/crl.h
+23 -1
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008 Martin Willi
* Copyright (C) 2006 Andreas Steffen
* Copyright (C) 2006-2022 Andreas Steffen
*
* Copyright (C) secunet Security Networks AG
*
@@ -24,6 +24,7 @@
#define CRL_H_
typedef struct crl_t crl_t;
typedef struct crl_revoked_t crl_revoked_t;
typedef enum crl_reason_t crl_reason_t;
#include <library.h>
@@ -61,6 +62,27 @@ enum crl_reason_t {
*/
extern enum_name_t *crl_reason_names;
/**
* Entry for a revoked certificate
*/
struct crl_revoked_t {
/**
* Serial of the revoked certificate
*/
chunk_t serial;
/**
* Date of revocation
*/
time_t date;
/**
* Reason for revocation
*/
crl_reason_t reason;
};
/**
* X509 certificate revocation list (CRL) interface definition.
*/