denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Bring CRL issued_by() in line with x509 plugin

Browse Source
This commit is contained in:
Adrian-Ken Rueegsegger
2021-05-07 14:29:24 +02:00
committed by Tobias Brunner
parent 9f468f454a
commit 97c9158378
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_crl.c
+14 -10
View File
@@ -288,9 +288,10 @@ METHOD(certificate_t, issued_by, bool,
private_openssl_crl_t *this, certificate_t *issuer,
signature_params_t **scheme)
{
chunk_t fingerprint, tbs;
chunk_t tbs;
public_key_t *key;
x509_t *x509;
chunk_t keyid = chunk_empty;
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
const ASN1_BIT_STRING *sig;
#else
@@ -307,26 +308,29 @@ METHOD(certificate_t, issued_by, bool,
{
return FALSE;
}
key = issuer->get_public_key(issuer);
if (!key)
/* compare keyIdentifiers if available, otherwise use DNs */
if (this->authKeyIdentifier.ptr)
{
return FALSE;
}
if (this->authKeyIdentifier.ptr && key)
{
if (!key->get_fingerprint(key, KEYID_PUBKEY_SHA1, &fingerprint) ||
!chunk_equals(fingerprint, this->authKeyIdentifier))
keyid = x509->get_subjectKeyIdentifier(x509);
if (keyid.len && !chunk_equals(keyid, this->authKeyIdentifier))
{
return FALSE;
}
}
else
if (!keyid.len)
{
if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
{
return FALSE;
}
}
key = issuer->get_public_key(issuer);
if (!key)
{
return FALSE;
}
/* i2d_re_X509_CRL_tbs() was added with 1.1.0 when X509_CRL became opaque */
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
tbs = openssl_i2chunk(re_X509_CRL_tbs, this->crl);