denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pki: Allow inclusion of [unsupported] critical X.509 extension

Browse Source
This commit is contained in:
Andreas Steffen
2019-05-08 14:56:48 +02:00
committed by Tobias Brunner
parent b213204b3b
commit df6441a13f
10 changed files with 96 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pki/commands/issue.c
+11 -2
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2009 Martin Willi
* Copyright (C) 2015-2017 Andreas Steffen
* Copyright (C) 2015-2019 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -77,6 +77,7 @@ static int issue()
int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
chunk_t serial = chunk_empty;
chunk_t encoding = chunk_empty;
chunk_t critical_extension_oid = chunk_empty;
time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
char *datenb = NULL, *datena = NULL, *dateform = NULL;
x509_flag_t flags = 0;
@@ -333,6 +334,10 @@ static int issue()
case 'o':
ocsp->insert_last(ocsp, arg);
continue;
case 'X':
chunk_free(&critical_extension_oid);
critical_extension_oid = asn1_oid_from_string(arg);
continue;
case EOF:
break;
default:
@@ -558,6 +563,7 @@ static int issue()
BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
BUILD_POLICY_INHIBIT_ANY, inhibit_any,
BUILD_CRITICAL_EXTENSION, critical_extension_oid,
BUILD_SIGNATURE_SCHEME, scheme,
BUILD_END);
if (!cert)
@@ -593,6 +599,7 @@ end:
cdps->destroy_function(cdps, (void*)destroy_cdp);
ocsp->destroy(ocsp);
signature_params_destroy(scheme);
free(critical_extension_oid.ptr);
free(encoding.ptr);
free(serial.ptr);
@@ -612,6 +619,7 @@ usage:
mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
cdps->destroy_function(cdps, (void*)destroy_cdp);
ocsp->destroy(ocsp);
free(critical_extension_oid.ptr);
return command_usage(error);
}
@@ -632,7 +640,7 @@ static void __attribute__ ((constructor))reg()
"[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
"[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
"[--rsa-padding pkcs1|pss]",
"[--rsa-padding pkcs1|pss] [--critical oid]",
"[--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
@@ -666,6 +674,7 @@ static void __attribute__ ((constructor))reg()
{"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"rsa-padding", 'R', 1, "padding for RSA signatures, default: pkcs1"},
{"critical", 'X', 1, "critical extension OID to include"},
{"outform", 'f', 1, "encoding of generated cert, default: der"},
}
});
src/pki/commands/self.c
+11 -2
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2009 Martin Willi
* Copyright (C) 2015-2017 Andreas Steffen
* Copyright (C) 2015-2019 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -65,6 +65,7 @@ static int self()
int require_explicit = X509_NO_CONSTRAINT;
chunk_t serial = chunk_empty;
chunk_t encoding = chunk_empty;
chunk_t critical_extension_oid = chunk_empty;
time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
char *datenb = NULL, *datena = NULL, *dateform = NULL;
x509_flag_t flags = 0;
@@ -289,6 +290,10 @@ static int self()
case 'o':
ocsp->insert_last(ocsp, arg);
continue;
case 'X':
chunk_free(&critical_extension_oid);
critical_extension_oid = asn1_oid_from_string(arg);
continue;
case EOF:
break;
default:
@@ -399,6 +404,7 @@ static int self()
BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
BUILD_POLICY_INHIBIT_ANY, inhibit_any,
BUILD_CRITICAL_EXTENSION, critical_extension_oid,
BUILD_END);
if (!cert)
{
@@ -430,6 +436,7 @@ end:
mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
ocsp->destroy(ocsp);
signature_params_destroy(scheme);
free(critical_extension_oid.ptr);
free(encoding.ptr);
free(serial.ptr);
@@ -448,6 +455,7 @@ usage:
policies->destroy_function(policies, (void*)destroy_cert_policy);
mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
ocsp->destroy(ocsp);
free(critical_extension_oid.ptr);
return command_usage(error);
}
@@ -468,7 +476,7 @@ static void __attribute__ ((constructor))reg()
"[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
"[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
"[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
"[--rsa-padding pkcs1|pss]",
"[--rsa-padding pkcs1|pss] [--critical oid]",
"[--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
@@ -498,6 +506,7 @@ static void __attribute__ ((constructor))reg()
{"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"rsa-padding", 'R', 1, "padding for RSA signatures, default: pkcs1"},
{"critical", 'X', 1, "critical extension OID to include for test purposes"},
{"outform", 'f', 1, "encoding of generated cert, default: der"},
}
});
src/pki/commands/signcrl.c
+12 -2
View File
@@ -2,7 +2,7 @@
* Copyright (C) 2010 Martin Willi
* Copyright (C) 2010 revosec AG
*
* Copyright (C) 2017 Andreas Steffen
* Copyright (C) 2017-2019 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@
#include <credentials/certificates/certificate.h>
#include <credentials/certificates/x509.h>
#include <credentials/certificates/crl.h>
#include <asn1/asn1.h>
/**
@@ -133,6 +134,7 @@ static int sign_crl()
enumerator_t *enumerator, *lastenum = NULL;
x509_cdp_t *cdp;
chunk_t crl_serial = chunk_empty, baseCrlNumber = chunk_empty;
chunk_t critical_extension_oid = chunk_empty;
chunk_t encoding = chunk_empty;
bool pss = lib->settings->get_bool(lib->settings, "%s.rsa_pss", FALSE,
lib->ns);
@@ -279,6 +281,10 @@ static int sign_crl()
goto usage;
}
continue;
case 'X':
chunk_free(&critical_extension_oid);
critical_extension_oid = asn1_oid_from_string(arg);
continue;
case EOF:
break;
default:
@@ -414,6 +420,7 @@ static int sign_crl()
BUILD_REVOKED_ENUMERATOR, enumerator,
BUILD_REVOKED_ENUMERATOR, lastenum, BUILD_SIGNATURE_SCHEME, scheme,
BUILD_CRL_DISTRIBUTION_POINTS, cdps, BUILD_BASE_CRL, baseCrlNumber,
BUILD_CRITICAL_EXTENSION, critical_extension_oid,
BUILD_END);
enumerator->destroy(enumerator);
@@ -442,6 +449,7 @@ error:
DESTROY_IF(lastenum);
DESTROY_IF((certificate_t*)lastcrl);
signature_params_destroy(scheme);
free(critical_extension_oid.ptr);
free(encoding.ptr);
free(baseCrlNumber.ptr);
free(crl_serial.ptr);
@@ -457,6 +465,7 @@ error:
usage:
list->destroy_function(list, (void*)revoked_destroy);
cdps->destroy_function(cdps, (void*)x509_cdp_destroy);
free(critical_extension_oid.ptr);
return command_usage(error);
}
@@ -474,7 +483,7 @@ static void __attribute__ ((constructor))reg()
" superseded|cessation-of-operation|certificate-hold]",
" [--date timestamp] --cert file|--serial hex]*",
"[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
"[--rsa-padding pkcs1|pss]",
"[--rsa-padding pkcs1|pss] [--critical oid]",
"[--outform der|pem]"},
{
{"help", 'h', 0, "show usage information"},
@@ -494,6 +503,7 @@ static void __attribute__ ((constructor))reg()
{"date", 'd', 1, "revocation date as unix timestamp, default: now"},
{"digest", 'g', 1, "digest for signature creation, default: key-specific"},
{"rsa-padding", 'R', 1, "padding for RSA signatures, default: pkcs1"},
{"critical", 'X', 1, "critical extension OID to include for test purposes"},
{"outform", 'f', 1, "encoding of generated crl, default: der"},
}
});
src/pki/man/pki---issue.1.in
+6 -2
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-ISSUE" 1 "2016-12-13" "@PACKAGE_VERSION@" "strongSwan"
.TH "PKI \-\-ISSUE" 1 "2019-05-06" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
@@ -24,9 +24,10 @@ pki \-\-issue \- Issue a certificate using a CA certificate and key
.OP \-\-crl uri\ \fR[\fB\-\-crlissuer\ \fIissuer\fR]
.OP \-\-ocsp uri
.OP \-\-pathlen len
.OP \-\-nc-permitted name
.OP \-\-addrblock block
.OP \-\-nc-permitted name
.OP \-\-nc-excluded name
.OP \-\-critical oid
.OP \-\-policy\-mapping mapping
.OP \-\-policy\-explicit len
.OP \-\-policy\-inhibit len
@@ -181,6 +182,9 @@ or
.B email:
prefix to force a constraint type.
.TP
.BI "\-X, \-\-critical " oid
Add a critical extension with the given OID.
.TP
.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid
Add policyMapping from issuer to subject OID.
.TP
src/pki/man/pki---self.1.in
+5 -1
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-SELF" 1 "2016-12-13" "@PACKAGE_VERSION@" "strongSwan"
.TH "PKI \-\-SELF" 1 "2019-05-06" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
@@ -26,6 +26,7 @@ pki \-\-self \- Create a self-signed certificate
.OP \-\-addrblock block
.OP \-\-nc-permitted name
.OP \-\-nc-excluded name
.OP \-\-critical oid
.OP \-\-policy\-mapping mapping
.OP \-\-policy\-explicit len
.OP \-\-policy\-inhibit len
@@ -160,6 +161,9 @@ or
.B email:
prefix to force a constraint type.
.TP
.BI "\-X, \-\-critical " oid
Add a critical extension with the given OID.
.TP
.BI "\-M, \-\-policy-mapping " issuer-oid:subject-oid
Add policyMapping from issuer to subject OID.
.TP
src/pki/man/pki---signcrl.1.in
+5 -1
View File
@@ -1,4 +1,4 @@
.TH "PKI \-\-SIGNCRL" 1 "2013-08-12" "@PACKAGE_VERSION@" "strongSwan"
.TH "PKI \-\-SIGNCRL" 1 "2019-05-06" "@PACKAGE_VERSION@" "strongSwan"
.
.SH "NAME"
.
@@ -18,6 +18,7 @@ pki \-\-signcrl \- Issue a Certificate Revocation List (CRL) using a CA certific
.OP \-\-digest digest
.OP \-\-rsa\-padding padding
.OP \fR[\fB\-\-reason\ \fIreason\fR]\ \fR[\fB\-\-date\ \fIts\fR]\ \fB\-\-cert\ \fIfile\fB|\-\-serial\ \fIhex\fR
.OP \-\-critical oid
.OP \-\-outform encoding
.OP \-\-debug level
.YS
@@ -107,6 +108,9 @@ determined based on the type and size of the signature key.
Padding to use for RSA signatures. Either \fIpkcs1\fR or \fIpss\fR, defaults
to \fIpkcs1\fR.
.TP
.BI "\-X, \-\-critical " oid
Add a critical extension with the given OID.
.TP
.BI "\-f, \-\-outform " encoding
Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or
\fIpem\fR (Base64 PEM), defaults to \fIder\fR.