denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: parse X.509 extended key usage from extension parsing loop

Browse Source 
Otherwise parsing gets aborted if unknown critical extensions are handled as
error.
This commit is contained in:
Martin Willi
2013-07-18 12:17:53 +02:00
parent 3f55f203ee
commit c3e7b3de0b
1 changed files with 38 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_x509.c
+38 -33
View File
@@ -678,6 +678,41 @@ static bool parse_keyUsage_ext(private_openssl_x509_t *this,
return FALSE;
}
/**
* Parse ExtendedKeyUsage
*/
static bool parse_extKeyUsage_ext(private_openssl_x509_t *this,
X509_EXTENSION *ext)
{
EXTENDED_KEY_USAGE *usage;
int i;
usage = X509V3_EXT_d2i(ext);
if (usage)
{
for (i = 0; i < sk_ASN1_OBJECT_num(usage); i++)
{
switch (OBJ_obj2nid(sk_ASN1_OBJECT_value(usage, i)))
{
case NID_server_auth:
this->flags |= X509_SERVER_AUTH;
break;
case NID_client_auth:
this->flags |= X509_CLIENT_AUTH;
break;
case NID_OCSP_sign:
this->flags |= X509_OCSP_SIGNER;
break;
default:
break;
}
}
sk_ASN1_OBJECT_pop_free(usage, ASN1_OBJECT_free);
return TRUE;
}
return FALSE;
}
/**
* Parse CRL distribution points
*/
@@ -963,6 +998,9 @@ static bool parse_extensions(private_openssl_x509_t *this)
case NID_key_usage:
ok = parse_keyUsage_ext(this, ext);
break;
case NID_ext_key_usage:
ok = parse_extKeyUsage_ext(this, ext);
break;
case NID_crl_distribution_points:
ok = parse_crlDistributionPoints_ext(this, ext);
break;
@@ -995,38 +1033,6 @@ static bool parse_extensions(private_openssl_x509_t *this)
return TRUE;
}
/**
* Parse ExtendedKeyUsage
*/
static void parse_extKeyUsage(private_openssl_x509_t *this)
{
EXTENDED_KEY_USAGE *usage;
int i;
usage = X509_get_ext_d2i(this->x509, NID_ext_key_usage, NULL, NULL);
if (usage)
{
for (i = 0; i < sk_ASN1_OBJECT_num(usage); i++)
{
switch (OBJ_obj2nid(sk_ASN1_OBJECT_value(usage, i)))
{
case NID_server_auth:
this->flags |= X509_SERVER_AUTH;
break;
case NID_client_auth:
this->flags |= X509_CLIENT_AUTH;
break;
case NID_OCSP_sign:
this->flags |= X509_OCSP_SIGNER;
break;
default:
break;
}
}
sk_ASN1_OBJECT_pop_free(usage, ASN1_OBJECT_free);
}
}
/**
* Parse a DER encoded x509 certificate
*/
@@ -1093,7 +1099,6 @@ static bool parse_certificate(private_openssl_x509_t *this)
{
return FALSE;
}
parse_extKeyUsage(this);
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher || !hasher->allocate_hash(hasher, this->encoding, &this->hash))