From 7414c0666996efe00545d8cf2966e8e23fe3852e Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Feb 2023 17:18:14 +0100 Subject: [PATCH 1/4] x509: Set X509_CRL_SIGN for CA certificates without keyUsage extension --- src/libstrongswan/plugins/x509/x509_cert.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c index 6ff3f086e..3cb7a5363 100644 --- a/src/libstrongswan/plugins/x509/x509_cert.c +++ b/src/libstrongswan/plugins/x509/x509_cert.c @@ -715,9 +715,6 @@ static void parse_keyUsage(chunk_t blob, private_x509_cert_t *this) KU_DECIPHER_ONLY = 8, }; - /* to be compliant with RFC 4945 specific KUs have to be included */ - this->flags &= ~X509_IKE_COMPLIANT; - if (asn1_unwrap(&blob, &blob) == ASN1_BIT_STRING && blob.len) { int bit, byte, unused = blob.ptr[0]; @@ -1391,14 +1388,11 @@ static bool parse_certificate(private_x509_cert_t *this) int objectID; int extn_oid = OID_UNKNOWN; signature_params_t sig_alg = {}; + bool critical = FALSE, key_usage_parsed = FALSE; bool success = FALSE; - bool critical = FALSE; parser = asn1_parser_create(certObjects, this->encoding); - /* unless we see a keyUsage extension we are compliant with RFC 4945 */ - this->flags |= X509_IKE_COMPLIANT; - while (parser->iterate(parser, &objectID, &object)) { u_int level = parser->get_level(parser)+1; @@ -1513,6 +1507,7 @@ static bool parse_certificate(private_x509_cert_t *this) break; case OID_KEY_USAGE: parse_keyUsage(object, this); + key_usage_parsed = TRUE; break; case OID_EXTENDED_KEY_USAGE: if (!x509_parse_eku_extension(object, level, &this->flags)) @@ -1610,6 +1605,17 @@ end: { hasher_t *hasher; + if (!key_usage_parsed) + { + /* we are compliant with RFC 4945 without keyUsage extension */ + this->flags |= X509_IKE_COMPLIANT; + /* allow CA certificates without keyUsage extension to sign CRLs */ + if (this->flags & X509_CA) + { + this->flags |= X509_CRL_SIGN; + } + } + /* check if the certificate is self-signed */ if (this->public.interface.interface.issued_by( &this->public.interface.interface, From d12a4f5d2328ec34ed023aea09ce5ffaf0466ce4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Feb 2023 17:18:36 +0100 Subject: [PATCH 2/4] openssl: Set X509_CRL_SIGN for CA certificates without keyUsage extension --- .../plugins/openssl/openssl_x509.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c index 4b331ad4f..832cec4b4 100644 --- a/src/libstrongswan/plugins/openssl/openssl_x509.c +++ b/src/libstrongswan/plugins/openssl/openssl_x509.c @@ -687,9 +687,6 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this, { ASN1_BIT_STRING *usage; - /* to be compliant with RFC 4945 specific KUs have to be included */ - this->flags &= ~X509_IKE_COMPLIANT; - usage = X509V3_EXT_d2i(ext); if (usage) { @@ -1013,11 +1010,9 @@ static bool parse_subjectKeyIdentifier_ext(private_openssl_x509_t *this, static bool parse_extensions(private_openssl_x509_t *this) { const STACK_OF(X509_EXTENSION) *extensions; + bool key_usage_parsed = FALSE; int i, num; - /* unless we see a keyUsage extension we are compliant with RFC 4945 */ - this->flags |= X509_IKE_COMPLIANT; - extensions = X509_get0_extensions(this->x509); if (extensions) { @@ -1051,6 +1046,7 @@ static bool parse_extensions(private_openssl_x509_t *this) break; case NID_key_usage: ok = parse_keyUsage_ext(this, ext); + key_usage_parsed = TRUE; break; case NID_ext_key_usage: ok = parse_extKeyUsage_ext(this, ext); @@ -1084,6 +1080,16 @@ static bool parse_extensions(private_openssl_x509_t *this) } } } + if (!key_usage_parsed) + { + /* we are compliant with RFC 4945 without keyUsage extension */ + this->flags |= X509_IKE_COMPLIANT; + /* allow CA certificates without keyUsage extension to sign CRLs */ + if (this->flags & X509_CA) + { + this->flags |= X509_CRL_SIGN; + } + } return TRUE; } From 7d1f2212119e6cc4bde26993d85370215c6daf73 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Feb 2023 17:20:07 +0100 Subject: [PATCH 3/4] x509: Only allow certificates with cRLSign keyUsage to sign CRLs --- src/libstrongswan/plugins/x509/x509_crl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c index d5221ed4a..9dbb7b5f2 100644 --- a/src/libstrongswan/plugins/x509/x509_crl.c +++ b/src/libstrongswan/plugins/x509/x509_crl.c @@ -462,12 +462,12 @@ METHOD(certificate_t, issued_by, bool, x509_t *x509 = (x509_t*)issuer; chunk_t keyid = chunk_empty; - /* check if issuer is an X.509 CA certificate */ + /* check if issuer is an X.509 certificate with cRLSign keyUsage bit set */ if (issuer->get_type(issuer) != CERT_X509) { return FALSE; } - if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN))) + if (!(x509->get_flags(x509) & X509_CRL_SIGN)) { return FALSE; } From 01ec54afc9a5ac8d96d1bfdc95765d5c739c2183 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Feb 2023 17:21:15 +0100 Subject: [PATCH 4/4] openssl: Only allow certificates with cRLSign keyUsage to sign CRLs --- src/libstrongswan/plugins/openssl/openssl_crl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c index 92f0ab481..907a5fb2a 100644 --- a/src/libstrongswan/plugins/openssl/openssl_crl.c +++ b/src/libstrongswan/plugins/openssl/openssl_crl.c @@ -303,7 +303,7 @@ METHOD(certificate_t, issued_by, bool, return FALSE; } x509 = (x509_t*)issuer; - if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN))) + if (!(x509->get_flags(x509) & X509_CRL_SIGN)) { return FALSE; }