sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-03 00:00:24 -04:00
Code Issues Projects Releases Wiki Activity

x509: Set X509_CRL_SIGN for CA certificates without keyUsage extension

Browse Source
This commit is contained in:
Tobias Brunner 2023-02-22 17:18:14 +01:00
parent 8bb772a9fa
commit 7414c06669
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/libstrongswan/plugins/x509/x509_cert.c
View File

@ -715,9 +715,6 @@ static void parse_keyUsage(chunk_t blob, private_x509_cert_t *this)
KU_DECIPHER_ONLY = 8,
};
/* to be compliant with RFC 4945 specific KUs have to be included */
this->flags &= ~X509_IKE_COMPLIANT;
if (asn1_unwrap(&blob, &blob) == ASN1_BIT_STRING && blob.len)
{
int bit, byte, unused = blob.ptr[0];
@ -1391,14 +1388,11 @@ static bool parse_certificate(private_x509_cert_t *this)
int objectID;
int extn_oid = OID_UNKNOWN;
signature_params_t sig_alg = {};
bool critical = FALSE, key_usage_parsed = FALSE;
bool success = FALSE;
bool critical = FALSE;
parser = asn1_parser_create(certObjects, this->encoding);
/* unless we see a keyUsage extension we are compliant with RFC 4945 */
this->flags |= X509_IKE_COMPLIANT;
while (parser->iterate(parser, &objectID, &object))
{
u_int level = parser->get_level(parser)+1;
@ -1513,6 +1507,7 @@ static bool parse_certificate(private_x509_cert_t *this)
break;
case OID_KEY_USAGE:
parse_keyUsage(object, this);
key_usage_parsed = TRUE;
break;
case OID_EXTENDED_KEY_USAGE:
if (!x509_parse_eku_extension(object, level, &this->flags))
@ -1610,6 +1605,17 @@ end:
{
hasher_t *hasher;
if (!key_usage_parsed)
{
/* we are compliant with RFC 4945 without keyUsage extension */
this->flags |= X509_IKE_COMPLIANT;
/* allow CA certificates without keyUsage extension to sign CRLs */
if (this->flags & X509_CA)
{
this->flags |= X509_CRL_SIGN;
}
}
/* check if the certificate is self-signed */
if (this->public.interface.interface.issued_by(
&this->public.interface.interface,