Added support for the URI type of subject alternative name in certtool.

diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index d47ef764ef88237af4998884f4e278261e6f9539..d4aeefad0505f8c7f4ab2d405deb9e12c40309a5 100644 (file)
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -63,6 +63,7 @@ typedef struct _cfg_ctx
   char *country;
   char **dc;
   char **dns_name;
+  char **uri;
   char **ip_addr;
   char **email;
   char **dn_oid;
@@ -233,6 +234,8 @@ template_parse (const char *template)
   
   READ_MULTI_LINE("dc", cfg.dc);
   READ_MULTI_LINE("dns_name", cfg.dns_name);
+  READ_MULTI_LINE("uri", cfg.uri);
+
   READ_MULTI_LINE("ip_address", cfg.ip_addr);
   READ_MULTI_LINE("email", cfg.email);
   READ_MULTI_LINE("key_purpose_oid", cfg.key_purpose_oids);
@@ -1208,6 +1211,64 @@ get_dns_name_set (int type, void *crt)
     }
 }
 
+void
+get_uri_set (int type, void *crt)
+{
+  int ret = 0, i;
+
+  if (batch)
+    {
+      if (!cfg.uri)
+        return;
+
+      for (i = 0; cfg.uri[i] != NULL; i++)
+        {
+          if (type == TYPE_CRT)
+            ret =
+              gnutls_x509_crt_set_subject_alt_name (crt, GNUTLS_SAN_URI,
+                                                    cfg.uri[i],
+                                                    strlen (cfg.uri[i]),
+                                                    GNUTLS_FSAN_APPEND);
+          else
+            ret =
+              gnutls_x509_crq_set_subject_alt_name (crt, GNUTLS_SAN_URI,
+                                                    cfg.uri[i],
+                                                    strlen (cfg.uri[i]),
+                                                    GNUTLS_FSAN_APPEND);
+
+          if (ret < 0)
+            break;
+        }
+    }
+  else
+    {
+      const char *p;
+
+      do
+        {
+          p =
+            read_str ("Enter a URI of the subject of the certificate: ");
+          if (!p)
+            return;
+
+          if (type == TYPE_CRT)
+            ret = gnutls_x509_crt_set_subject_alt_name
+              (crt, GNUTLS_SAN_URI, p, strlen (p), GNUTLS_FSAN_APPEND);
+          else
+            ret = gnutls_x509_crq_set_subject_alt_name
+              (crt, GNUTLS_SAN_URI, p, strlen (p), GNUTLS_FSAN_APPEND);
+        }
+      while (p);
+    }
+
+  if (ret < 0)
+    {
+      fprintf (stderr, "set_subject_alt_name: %s\n", gnutls_strerror (ret));
+      exit (1);
+    }
+}
+
+
 
 int
 get_sign_status (int server)

diff --git a/src/certtool-cfg.h b/src/certtool-cfg.h
index 5181425ae242fbcd700a286bc6151b4a0ee359e0..878ecac34f73be2ee7d0740a39528f275f2868d2 100644 (file)
--- a/src/certtool-cfg.h
+++ b/src/certtool-cfg.h
@@ -67,6 +67,7 @@ int get_encrypt_status (int server);
 int get_sign_status (int server);
 void get_ip_addr_set (int type, void *crt);
 void get_dns_name_set (int type, void *crt);
+void get_uri_set (int type, void *crt);
 void get_email_set (int type, void *crt);
 int get_ipsec_ike_status (void);
 void get_dc_set (int type, void *crt);

diff --git a/src/certtool.c b/src/certtool.c
index 58ebcd19fecca0957896f3e42fa955c5c0ae6129..59d6155d9ae87422b87b26285cb6de3ae14a4926 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -484,11 +484,10 @@ generate_certificate (gnutls_privkey_t * ret_key,
 
       is_ike = get_ipsec_ike_status ();
       server = get_tls_server_status ();
-      if ((server != 0 && !proxy) || is_ike)
-        {
-          get_dns_name_set (TYPE_CRT, crt);
-          get_ip_addr_set (TYPE_CRT, crt);
-        }
+
+      get_dns_name_set (TYPE_CRT, crt);
+      get_uri_set (TYPE_CRT, crt);
+      get_ip_addr_set (TYPE_CRT, crt);
 
       if (server != 0)
         {
@@ -1864,6 +1863,7 @@ generate_request (common_info_st * cinfo)
   get_oid_crq_set (crq);
 
   get_dns_name_set (TYPE_CRQ, crq);
+  get_uri_set (TYPE_CRQ, crq);
   get_ip_addr_set (TYPE_CRQ, crq);
   get_email_set (TYPE_CRQ, crq);
 

diff --git a/tests/cert-tests/template-test.pem b/tests/cert-tests/template-test.pem
index 30ddd8a21905c6622801911a5177ece872b56bad..0b0866fe4bf7b7b474334d799516b0b373b52da4 100644 (file)
--- a/tests/cert-tests/template-test.pem
+++ b/tests/cert-tests/template-test.pem
@@ -1,5 +1,5 @@
 -----BEGIN CERTIFICATE-----
-MIIDoDCCAwmgAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBuDELMAkGA1UEBhMCR1Ix
+MIID4jCCA0ugAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBuDELMAkGA1UEBhMCR1Ix
 EjAQBgNVBAoTCUtva28gaW5jLjEXMBUGA1UECxMOc2xlZXBpbmcgZGVwdC4xDzAN
 BgNVBAgTBkF0dGlraTEVMBMGA1UEAxMMQ2luZHkgTGF1cGVyMRcwFQYKCZImiZPy
 LGQBARMHY2xhdXBlcjEMMAoGA1UEDBMDRHIuMQ8wDQYDVQRBEwZqYWNrYWwxHDAa
@@ -11,12 +11,13 @@ BgNVBAwTA0RyLjEPMA0GA1UEQRMGamFja2FsMRwwGgYJKoZIhvcNAQkBFg1ub25l
 QG5vbmUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClxs51Q4S/ZJ4C
 JxPxA1n3eS2S7XwvUKQD8S15uYaLBX46u0Sqr4TPE5geHEo49zMtep9y1GttJrAx
 N3AQ+0Lp2J0YZX4ZSfwFlgRogx53hr/t9eUSOxP+MxicGnodaa9HAmB6H7noz9vI
-NDBRlj2MllwAvGHeCA+xNiF/qQDjBQIDAQABo4GzMIGwMA8GA1UdEwEB/wQFMAMB
-Af8wKAYDVR0RBCEwH4ENbm9uZUBub25lLm9yZ4EOd2hlcmVAbm9uZS5vcmcwEwYD
-VR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUDAwcEADAdBgNVHQ4EFgQUXUCt
-8M6UQJWLfpmUHZJUIspyNl8wLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3d3dy5n
-ZXRjcmwuY3JsL2dldGNybC8wDQYJKoZIhvcNAQELBQADgYEASd+38D+lbUJIcDCK
-s8QbRpsfw3aRrgIjxY0kSpPeeJ6t+zttbUkdl3xVqZkldJHWZihdY1h0Nqh3W3An
-I6yr+Uex8az0LUrimc3EwYh4QWNUq142Dy2IXlmE3WOipjOatXeMZFj4mruJbYqZ
-psMUofmkNLXu8fEFauBU5jQ2SEA=
+NDBRlj2MllwAvGHeCA+xNiF/qQDjBQIDAQABo4H1MIHyMA8GA1UdEwEB/wQFMAMB
+Af8wagYDVR0RBGMwYYIMd3d3Lm5vbmUub3JnghN3d3cubW9yZXRoYW5vbmUub3Jn
+ghd3d3cuZXZlbm1vcmV0aGFub25lLm9yZ4cEwKgBAYENbm9uZUBub25lLm9yZ4EO
+d2hlcmVAbm9uZS5vcmcwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYDVR0PAQH/BAUD
+AwcEADAdBgNVHQ4EFgQUXUCt8M6UQJWLfpmUHZJUIspyNl8wLgYDVR0fBCcwJTAj
+oCGgH4YdaHR0cDovL3d3dy5nZXRjcmwuY3JsL2dldGNybC8wDQYJKoZIhvcNAQEL
+BQADgYEAkRe0HlWiwWEWV815XYU7IBWD+e7hVnpyTNaFrS2zn1vQfi0XQ1eX8DjH
+AEWFB5qKppkdXTP0MihieFvUbmgybuc/ep7JRu3l2MBly2latSJViqiHoo9GHqbi
+lX9KX8XUx1+ONbBy3rYqUATq+z7WEdN9iN8wNXMVMTv0hD5GnuM=
 -----END CERTIFICATE-----