denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Set IKE compliance flag depending on keyUsage

Browse Source
This commit is contained in:
Tobias Brunner
2018-05-22 09:50:47 +02:00
parent 920366e688
commit 504e12326d
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_x509.c
+11
View File
@@ -668,6 +668,9 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this,
{ {
ASN1_BIT_STRING *usage; ASN1_BIT_STRING *usage;
/* to be compliant with RFC 4945 specific KUs have to be included */
this->flags &= ~X509_IKE_COMPLIANT;
usage = X509V3_EXT_d2i(ext); usage = X509V3_EXT_d2i(ext);
if (usage) if (usage)
{ {
@@ -682,6 +685,11 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this,
{ {
this->flags |= X509_CRL_SIGN; this->flags |= X509_CRL_SIGN;
} }
if (flags & X509v3_KU_DIGITAL_SIGNATURE ||
flags & X509v3_KU_NON_REPUDIATION)
{
this->flags |= X509_IKE_COMPLIANT;
}
if (flags & X509v3_KU_KEY_CERT_SIGN) if (flags & X509v3_KU_KEY_CERT_SIGN)
{ {
/* we use the caBasicContraint, MUST be set */ /* we use the caBasicContraint, MUST be set */
@@ -988,6 +996,9 @@ static bool parse_extensions(private_openssl_x509_t *this)
STACK_OF(X509_EXTENSION) *extensions; STACK_OF(X509_EXTENSION) *extensions;
int i, num; int i, num;
/* unless we see a keyUsage extension we are compliant with RFC 4945 */
this->flags |= X509_IKE_COMPLIANT;
extensions = X509_get0_extensions(this->x509); extensions = X509_get0_extensions(this->x509);
if (extensions) if (extensions)
{ {