denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec pki --self|issue supports --pathlen option setting a path length constraint

Browse Source
This commit is contained in:
Andreas Steffen
2009-12-31 15:13:35 +01:00
parent 7eaec999ca
commit 3e33ae1004
5 changed files with 35 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_cert.c
+18 -2
View File
@@ -1582,14 +1582,23 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
/* build CA basicConstraint for CA certificates */
if (cert->flags & X509_CA)
{
chunk_t pathLenConstraint = chunk_empty;
if (cert->pathLenConstraint != X509_NO_PATH_LEN_CONSTRAINT)
{
char pathlen = (char)cert->pathLenConstraint;
pathLenConstraint = asn1_integer("c", chunk_from_thing(pathlen));
}
basicConstraints = asn1_wrap(ASN1_SEQUENCE, "mmm",
asn1_build_known_oid(OID_BASIC_CONSTRAINTS),
asn1_wrap(ASN1_BOOLEAN, "c",
chunk_from_chars(0xFF)),
asn1_wrap(ASN1_OCTET_STRING, "m",
asn1_wrap(ASN1_SEQUENCE, "m",
asn1_wrap(ASN1_SEQUENCE, "mm",
asn1_wrap(ASN1_BOOLEAN, "c",
chunk_from_chars(0xFF)))));
chunk_from_chars(0xFF)),
pathLenConstraint)));
}
/* add serverAuth extendedKeyUsage flag */
@@ -1802,6 +1811,13 @@ x509_cert_t *x509_cert_gen(certificate_type_t type, va_list args)
enumerator->destroy(enumerator);
continue;
}
case BUILD_PATHLEN:
cert->pathLenConstraint = va_arg(args, int);
if (cert->pathLenConstraint < 0 || cert->pathLenConstraint > 127)
{
cert->pathLenConstraint = X509_NO_PATH_LEN_CONSTRAINT;
}
continue;
case BUILD_NOT_BEFORE_TIME:
cert->notBefore = va_arg(args, time_t);
continue;