denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pki: Choose default digest based on the signature key

Browse Source
This commit is contained in:
Tobias Brunner
2015-03-23 17:22:31 +01:00
parent ae0604f583
commit 2872f77829
12 changed files with 69 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pki/commands/acert.c
+6 -2
View File
@@ -32,7 +32,7 @@
static int acert()
{
cred_encoding_type_t form = CERT_ASN1_DER;
hash_algorithm_t digest = HASH_SHA256;
hash_algorithm_t digest = HASH_UNKNOWN;
certificate_t *ac = NULL, *cert = NULL, *issuer =NULL;
private_key_t *private = NULL;
public_key_t *public = NULL;
@@ -162,6 +162,10 @@ static int acert()
error = "loading issuer private key failed";
goto end;
}
if (digest == HASH_UNKNOWN)
{
digest = get_default_digest(private);
}
if (!private->belongs_to(private, public))
{
error = "issuer private key does not match issuer certificate";
@@ -287,7 +291,7 @@ static void __attribute__ ((constructor))reg()
{"not-before", 'F', 1, "date/time the validity of the AC starts"},
{"not-after", 'T', 1, "date/time the validity of the AC ends"},
{"dateform", 'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
{"digest", 'g', 1, "digest for signature creation, default: sha256"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"outform", 'f', 1, "encoding of generated cert, default: der"},
}
});
src/pki/commands/issue.c
+6 -2
View File
@@ -60,7 +60,7 @@ static void destroy_cdp(x509_cdp_t *this)
static int issue()
{
cred_encoding_type_t form = CERT_ASN1_DER;
hash_algorithm_t digest = HASH_SHA256;
hash_algorithm_t digest = HASH_UNKNOWN;
certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
private_key_t *private = NULL;
public_key_t *public = NULL;
@@ -357,6 +357,10 @@ static int issue()
error = "loading CA private key failed";
goto end;
}
if (digest == HASH_UNKNOWN)
{
digest = get_default_digest(private);
}
if (!private->belongs_to(private, public))
{
error = "CA private key does not match CA certificate";
@@ -591,7 +595,7 @@ static void __attribute__ ((constructor))reg()
{"crl", 'u', 1, "CRL distribution point URI to include"},
{"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
{"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
{"digest", 'g', 1, "digest for signature creation, default: sha256"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"outform", 'f', 1, "encoding of generated cert, default: der"},
}
});
src/pki/commands/req.c
+6 -2
View File
@@ -31,7 +31,7 @@ static int req()
{
cred_encoding_type_t form = CERT_ASN1_DER;
key_type_t type = KEY_RSA;
hash_algorithm_t digest = HASH_SHA256;
hash_algorithm_t digest = HASH_UNKNOWN;
certificate_t *cert = NULL;
private_key_t *private = NULL;
char *file = NULL, *dn = NULL, *error = NULL;
@@ -139,6 +139,10 @@ static int req()
error = "parsing private key failed";
goto end;
}
if (digest == HASH_UNKNOWN)
{
digest = get_default_digest(private);
}
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_PKCS10_REQUEST,
BUILD_SIGNING_KEY, private,
BUILD_SUBJECT, id,
@@ -200,7 +204,7 @@ static void __attribute__ ((constructor))reg()
{"dn", 'd', 1, "subject distinguished name"},
{"san", 'a', 1, "subjectAltName to include in cert request"},
{"password",'p', 1, "challengePassword to include in cert request"},
{"digest", 'g', 1, "digest for signature creation, default: sha256"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"outform", 'f', 1, "encoding of generated request, default: der"},
}
});
src/pki/commands/self.c
+6 -2
View File
@@ -50,7 +50,7 @@ static int self()
{
cred_encoding_type_t form = CERT_ASN1_DER;
key_type_t type = KEY_RSA;
hash_algorithm_t digest = HASH_SHA256;
hash_algorithm_t digest = HASH_UNKNOWN;
certificate_t *cert = NULL;
private_key_t *private = NULL;
public_key_t *public = NULL;
@@ -314,6 +314,10 @@ static int self()
error = "loading private key failed";
goto end;
}
if (digest == HASH_UNKNOWN)
{
digest = get_default_digest(private);
}
public = private->get_public_key(private);
if (!public)
{
@@ -447,7 +451,7 @@ static void __attribute__ ((constructor))reg()
{"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
{"flag", 'e', 1, "include extendedKeyUsage flag"},
{"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
{"digest", 'g', 1, "digest for signature creation, default: sha256"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"outform", 'f', 1, "encoding of generated cert, default: der"},
}
});
src/pki/commands/signcrl.c
+6 -2
View File
@@ -117,7 +117,7 @@ static int sign_crl()
certificate_t *ca = NULL, *crl = NULL;
crl_t *lastcrl = NULL;
x509_t *x509;
hash_algorithm_t digest = HASH_SHA256;
hash_algorithm_t digest = HASH_UNKNOWN;
char *arg, *cacert = NULL, *cakey = NULL, *lastupdate = NULL, *error = NULL;
char *basecrl = NULL;
char serial[512], *keyid = NULL;
@@ -330,6 +330,10 @@ static int sign_crl()
error = "loading CA private key failed";
goto error;
}
if (digest == HASH_UNKNOWN)
{
digest = get_default_digest(private);
}
if (!private->belongs_to(private, public))
{
error = "CA private key does not match CA certificate";
@@ -465,7 +469,7 @@ static void __attribute__ ((constructor))reg()
{"serial", 's', 1, "hex encoded certificate serial number to revoke"},
{"reason", 'r', 1, "reason for certificate revocation"},
{"date", 'd', 1, "revocation date as unix timestamp, default: now"},
{"digest", 'g', 1, "digest for signature creation, default: sha256"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"outform", 'f', 1, "encoding of generated crl, default: der"},
}
});