denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Set X509_CRL_SIGN for CA certificates without keyUsage extension

Browse Source
This commit is contained in:
Tobias Brunner
2023-03-21 16:34:14 +01:00
parent 8bb772a9fa
commit 7414c06669
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_cert.c
+13 -7
View File
@@ -715,9 +715,6 @@ static void parse_keyUsage(chunk_t blob, private_x509_cert_t *this)
KU_DECIPHER_ONLY = 8, KU_DECIPHER_ONLY = 8,
}; };
/* to be compliant with RFC 4945 specific KUs have to be included */
this->flags &= ~X509_IKE_COMPLIANT;
if (asn1_unwrap(&blob, &blob) == ASN1_BIT_STRING && blob.len) if (asn1_unwrap(&blob, &blob) == ASN1_BIT_STRING && blob.len)
{ {
int bit, byte, unused = blob.ptr[0]; int bit, byte, unused = blob.ptr[0];
@@ -1391,14 +1388,11 @@ static bool parse_certificate(private_x509_cert_t *this)
int objectID; int objectID;
int extn_oid = OID_UNKNOWN; int extn_oid = OID_UNKNOWN;
signature_params_t sig_alg = {}; signature_params_t sig_alg = {};
bool critical = FALSE, key_usage_parsed = FALSE;
bool success = FALSE; bool success = FALSE;
bool critical = FALSE;
parser = asn1_parser_create(certObjects, this->encoding); parser = asn1_parser_create(certObjects, this->encoding);
/* unless we see a keyUsage extension we are compliant with RFC 4945 */
this->flags |= X509_IKE_COMPLIANT;
while (parser->iterate(parser, &objectID, &object)) while (parser->iterate(parser, &objectID, &object))
{ {
u_int level = parser->get_level(parser)+1; u_int level = parser->get_level(parser)+1;
@@ -1513,6 +1507,7 @@ static bool parse_certificate(private_x509_cert_t *this)
break; break;
case OID_KEY_USAGE: case OID_KEY_USAGE:
parse_keyUsage(object, this); parse_keyUsage(object, this);
key_usage_parsed = TRUE;
break; break;
case OID_EXTENDED_KEY_USAGE: case OID_EXTENDED_KEY_USAGE:
if (!x509_parse_eku_extension(object, level, &this->flags)) if (!x509_parse_eku_extension(object, level, &this->flags))
@@ -1610,6 +1605,17 @@ end:
{ {
hasher_t *hasher; hasher_t *hasher;
if (!key_usage_parsed)
{
/* we are compliant with RFC 4945 without keyUsage extension */
this->flags |= X509_IKE_COMPLIANT;
/* allow CA certificates without keyUsage extension to sign CRLs */
if (this->flags & X509_CA)
{
this->flags |= X509_CRL_SIGN;
}
}
/* check if the certificate is self-signed */ /* check if the certificate is self-signed */
if (this->public.interface.interface.issued_by( if (this->public.interface.interface.issued_by(
&this->public.interface.interface, &this->public.interface.interface,