From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 4 Apr 2018 12:00:35 +0000 (+0300)
Subject: EKU: Extract raw EKU OIDs into attributes
X-Git-Tag: release_3_0_17~18^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2e892f7aeedbe6d7c8cb75ec6a6355c1d669adc5;p=thirdparty%2Ffreeradius-server.git

EKU: Extract raw EKU OIDs into attributes

This helps with matching a single OID regardless of its name.
---

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 30baba16c34..88810fb97d5 100644
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -533,8 +533,9 @@ ATTRIBUTE	TLS-Client-Cert-X509v3-Basic-Constraints 1930	string
 ATTRIBUTE	TLS-Client-Cert-Subject-Alt-Name-Dns	1931	string
 ATTRIBUTE	TLS-Client-Cert-Subject-Alt-Name-Upn	1932	string
 ATTRIBUTE	TLS-PSK-Identity			1933	string
+ATTRIBUTE	TLS-Client-Cert-X509v3-Extended-Key-Usage-OID 1936	string
 
-# 1934 - 1939: reserved for future cert attributes
+# 1937 - 1939: reserved for future cert attributes
 
 # 1940 - 1949: reserved for TLS session caching, mostly in 3.1
 
diff --git a/src/main/tls.c b/src/main/tls.c
index 51435a78190..dfaa5e6a048 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2274,6 +2274,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
 	 */
 	if (certs && (sk_X509_EXTENSION_num(ext_list) > 0)) {
 		int i, len;
+		EXTENDED_KEY_USAGE *eku;
 		char *p;
 		BIO *out;
 
@@ -2319,6 +2320,24 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
 		}
 
 		BIO_free_all(out);
+
+		/* Export raw EKU OIDs to allow matching a single OID regardless of its name */
+		eku = X509_get_ext_d2i(client_cert, NID_ext_key_usage, NULL, NULL);
+		if (eku != NULL) {
+			for (i = 0; i < sk_ASN1_OBJECT_num(eku); i++) {
+				len = OBJ_obj2txt(value, sizeof(value), sk_ASN1_OBJECT_value(eku, i), 1);
+				if ((len > 0) && ((unsigned) len < sizeof(value))) {
+					vp = fr_pair_make(talloc_ctx, certs,
+							  "TLS-Client-Cert-X509v3-Extended-Key-Usage-OID",
+							  value, T_OP_ADD);
+					rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
+				}
+				else {
+					RDEBUG("Failed to get EKU OID at index %d", i);
+				}
+			}
+			EXTENDED_KEY_USAGE_free(eku);
+		}
 	}
 
 	REXDENT();