denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Bring CRL issued_by() in line with x509 plugin

Browse Source
This commit is contained in:
Adrian-Ken Rueegsegger
2021-05-07 14:29:24 +02:00
committed by Tobias Brunner
parent 9f468f454a
commit 97c9158378
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_crl.c
+14 -10
View File
@@ -288,9 +288,10 @@ METHOD(certificate_t, issued_by, bool,
private_openssl_crl_t *this, certificate_t *issuer, private_openssl_crl_t *this, certificate_t *issuer,
signature_params_t **scheme) signature_params_t **scheme)
{ {
chunk_t fingerprint, tbs; chunk_t tbs;
public_key_t *key; public_key_t *key;
x509_t *x509; x509_t *x509;
chunk_t keyid = chunk_empty;
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
const ASN1_BIT_STRING *sig; const ASN1_BIT_STRING *sig;
#else #else
@@ -307,26 +308,29 @@ METHOD(certificate_t, issued_by, bool,
{ {
return FALSE; return FALSE;
} }
key = issuer->get_public_key(issuer);
if (!key) /* compare keyIdentifiers if available, otherwise use DNs */
if (this->authKeyIdentifier.ptr)
{ {
return FALSE; keyid = x509->get_subjectKeyIdentifier(x509);
} if (keyid.len && !chunk_equals(keyid, this->authKeyIdentifier))
if (this->authKeyIdentifier.ptr && key)
{
if (!key->get_fingerprint(key, KEYID_PUBKEY_SHA1, &fingerprint) ||
!chunk_equals(fingerprint, this->authKeyIdentifier))
{ {
return FALSE; return FALSE;
} }
} }
else if (!keyid.len)
{ {
if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer))) if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
{ {
return FALSE; return FALSE;
} }
} }
key = issuer->get_public_key(issuer);
if (!key)
{
return FALSE;
}
/* i2d_re_X509_CRL_tbs() was added with 1.1.0 when X509_CRL became opaque */ /* i2d_re_X509_CRL_tbs() was added with 1.1.0 when X509_CRL became opaque */
#if OPENSSL_VERSION_NUMBER >= 0x10100000L #if OPENSSL_VERSION_NUMBER >= 0x10100000L
tbs = openssl_i2chunk(re_X509_CRL_tbs, this->crl); tbs = openssl_i2chunk(re_X509_CRL_tbs, this->crl);