denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added support for iKEIntermediate X.509 extended key usage flag.

Browse Source 
Mac OS X requires server certificates to have this flag set.
This commit is contained in:
Tobias Brunner
2012-03-20 17:31:24 +01:00
parent 00cc2188d4
commit f29a4f1c64
4 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_list.c
+2 -2
View File
@@ -799,8 +799,8 @@ static void stroke_list_certs(linked_list_t *list, char *label,
x509_flag_t flag_mask; x509_flag_t flag_mask;
/* mask all auxiliary flags */ /* mask all auxiliary flags */
flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH | flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH | X509_IKE_INTERMEDIATE |
X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS ); X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS);
enumerator = list->create_enumerator(list); enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, (void**)&cert)) while (enumerator->enumerate(enumerator, (void**)&cert))
src/libstrongswan/asn1/oid.txt
+3
View File
@@ -226,6 +226,9 @@
0x02 "caIssuers" OID_CA_ISSUERS 0x02 "caIssuers" OID_CA_ISSUERS
0x03 "timeStamping" 0x03 "timeStamping"
0x05 "caRepository" 0x05 "caRepository"
0x08 "ipsec"
0x02 "certificate"
0x02 "iKEIntermediate" OID_IKE_INTERMEDIATE
0x0E "oiw" 0x0E "oiw"
0x03 "secsig" 0x03 "secsig"
0x02 "algorithms" 0x02 "algorithms"
src/libstrongswan/credentials/certificates/x509.h
+2
View File
@@ -56,6 +56,8 @@ enum x509_flag_t {
X509_IP_ADDR_BLOCKS = (1<<6), X509_IP_ADDR_BLOCKS = (1<<6),
/** cert has CRL sign key usage */ /** cert has CRL sign key usage */
X509_CRL_SIGN = (1<<7), X509_CRL_SIGN = (1<<7),
/** cert has iKEIntermediate key usage */
X509_IKE_INTERMEDIATE = (1<<8),
}; };
/** /**
src/libstrongswan/plugins/x509/x509_cert.c
+14 -6
View File
@@ -752,6 +752,9 @@ static void parse_extendedKeyUsage(chunk_t blob, int level0,
case OID_CLIENT_AUTH: case OID_CLIENT_AUTH:
this->flags |= X509_CLIENT_AUTH; this->flags |= X509_CLIENT_AUTH;
break; break;
case OID_IKE_INTERMEDIATE:
this->flags |= X509_IKE_INTERMEDIATE;
break;
case OID_OCSP_SIGNING: case OID_OCSP_SIGNING:
this->flags |= X509_OCSP_SIGNER; this->flags |= X509_OCSP_SIGNER;
break; break;
@@ -1994,6 +1997,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
chunk_t subjectKeyIdentifier = chunk_empty, authKeyIdentifier = chunk_empty; chunk_t subjectKeyIdentifier = chunk_empty, authKeyIdentifier = chunk_empty;
chunk_t crlDistributionPoints = chunk_empty, authorityInfoAccess = chunk_empty; chunk_t crlDistributionPoints = chunk_empty, authorityInfoAccess = chunk_empty;
chunk_t policyConstraints = chunk_empty, inhibitAnyPolicy = chunk_empty; chunk_t policyConstraints = chunk_empty, inhibitAnyPolicy = chunk_empty;
chunk_t ikeIntermediate = chunk_empty;
identification_t *issuer, *subject; identification_t *issuer, *subject;
chunk_t key_info; chunk_t key_info;
signature_scheme_t scheme; signature_scheme_t scheme;
@@ -2107,7 +2111,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
asn1_wrap(ASN1_BIT_STRING, "c", keyUsageBits))); asn1_wrap(ASN1_BIT_STRING, "c", keyUsageBits)));
} }
/* add serverAuth extendedKeyUsage flag */ /* add extendedKeyUsage flags */
if (cert->flags & X509_SERVER_AUTH) if (cert->flags & X509_SERVER_AUTH)
{ {
serverAuth = asn1_build_known_oid(OID_SERVER_AUTH); serverAuth = asn1_build_known_oid(OID_SERVER_AUTH);
@@ -2116,20 +2120,24 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
{ {
clientAuth = asn1_build_known_oid(OID_CLIENT_AUTH); clientAuth = asn1_build_known_oid(OID_CLIENT_AUTH);
} }
if (cert->flags & X509_IKE_INTERMEDIATE)
/* add ocspSigning extendedKeyUsage flag */ {
ikeIntermediate = asn1_build_known_oid(OID_IKE_INTERMEDIATE);
}
if (cert->flags & X509_OCSP_SIGNER) if (cert->flags & X509_OCSP_SIGNER)
{ {
ocspSigning = asn1_build_known_oid(OID_OCSP_SIGNING); ocspSigning = asn1_build_known_oid(OID_OCSP_SIGNING);
} }
if (serverAuth.ptr || clientAuth.ptr || ocspSigning.ptr) if (serverAuth.ptr || clientAuth.ptr || ikeIntermediate.ptr ||
ocspSigning.ptr)
{ {
extendedKeyUsage = asn1_wrap(ASN1_SEQUENCE, "mm", extendedKeyUsage = asn1_wrap(ASN1_SEQUENCE, "mm",
asn1_build_known_oid(OID_EXTENDED_KEY_USAGE), asn1_build_known_oid(OID_EXTENDED_KEY_USAGE),
asn1_wrap(ASN1_OCTET_STRING, "m", asn1_wrap(ASN1_OCTET_STRING, "m",
asn1_wrap(ASN1_SEQUENCE, "mmm", asn1_wrap(ASN1_SEQUENCE, "mmmm",
serverAuth, clientAuth, ocspSigning))); serverAuth, clientAuth, ikeIntermediate,
ocspSigning)));
} }
/* add subjectKeyIdentifier to CA and OCSP signer certificates */ /* add subjectKeyIdentifier to CA and OCSP signer certificates */