EKU: Extract raw EKU OIDs into attributes

This helps with matching a single OID regardless of its name.

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 30baba16c345e64f1142e22eb1cc52983e19e3fd..88810fb97d5ad479c7f93791854f4999a2379d07 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -533,8 +533,9 @@ ATTRIBUTE   TLS-Client-Cert-X509v3-Basic-Constraints 1930   string
 ATTRIBUTE      TLS-Client-Cert-Subject-Alt-Name-Dns    1931    string
 ATTRIBUTE      TLS-Client-Cert-Subject-Alt-Name-Upn    1932    string
 ATTRIBUTE      TLS-PSK-Identity                        1933    string
+ATTRIBUTE      TLS-Client-Cert-X509v3-Extended-Key-Usage-OID 1936      string
 
-# 1934 - 1939: reserved for future cert attributes
+# 1937 - 1939: reserved for future cert attributes
 
 # 1940 - 1949: reserved for TLS session caching, mostly in 3.1
 

diff --git a/src/main/tls.c b/src/main/tls.c
index 51435a7819030cd7ab58ace66a79137e83da35e2..dfaa5e6a048a66afe974acf5f03ca9d49038e0ce 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2274,6 +2274,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
         */
        if (certs && (sk_X509_EXTENSION_num(ext_list) > 0)) {
                int i, len;
+               EXTENDED_KEY_USAGE *eku;
                char *p;
                BIO *out;
 
@@ -2319,6 +2320,24 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
                }
 
                BIO_free_all(out);
+
+               /* Export raw EKU OIDs to allow matching a single OID regardless of its name */
+               eku = X509_get_ext_d2i(client_cert, NID_ext_key_usage, NULL, NULL);
+               if (eku != NULL) {
+                       for (i = 0; i < sk_ASN1_OBJECT_num(eku); i++) {
+                               len = OBJ_obj2txt(value, sizeof(value), sk_ASN1_OBJECT_value(eku, i), 1);
+                               if ((len > 0) && ((unsigned) len < sizeof(value))) {
+                                       vp = fr_pair_make(talloc_ctx, certs,
+                                                         "TLS-Client-Cert-X509v3-Extended-Key-Usage-OID",
+                                                         value, T_OP_ADD);
+                                       rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
+                               }
+                               else {
+                                       RDEBUG("Failed to get EKU OID at index %d", i);
+                               }
+                       }
+                       EXTENDED_KEY_USAGE_free(eku);
+               }
        }
 
        REXDENT();