From: Nikos Mavrogiannopoulos Date: Fri, 7 Feb 2003 21:03:28 +0000 (+0000) Subject: Criticality of an X.509 extension can now be extracted. X-Git-Tag: gnutls_0_8_3~68 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29909c3ecbcd8f6e042550bffd67aa0777bedefe;p=thirdparty%2Fgnutls.git Criticality of an X.509 extension can now be extracted. --- diff --git a/includes/gnutls/x509.h b/includes/gnutls/x509.h index 95fd84a84c..6acc72748d 100644 --- a/includes/gnutls/x509.h +++ b/includes/gnutls/x509.h @@ -73,10 +73,11 @@ int gnutls_x509_certificate_get_serial(gnutls_x509_certificate cert, char* resul int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int* bits); int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, - int seq, char *ret, int *ret_size); -int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert); + int seq, char *ret, int *ret_size, int* critical); +int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert, int* critical); -int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigned int* key_usage); +int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigned int* key_usage, + int* critical); /* key_usage will be an OR of the following values: */ @@ -91,7 +92,7 @@ int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigne #define GNUTLS_KEY_DECIPHER_ONLY 1 int gnutls_x509_certificate_get_extension_by_oid(gnutls_x509_certificate cert, const char* oid, - unsigned char* buf, int * sizeof_buf); + unsigned char* buf, int * sizeof_buf, int * critical); int gnutls_x509_certificate_to_xml(gnutls_x509_certificate cert, gnutls_datum* res, int detail); diff --git a/lib/x509/compat.c b/lib/x509/compat.c index 739643da47..7a7bd37ae5 100644 --- a/lib/x509/compat.c +++ b/lib/x509/compat.c @@ -243,7 +243,7 @@ int gnutls_x509_extract_certificate_subject_alt_name(const gnutls_datum * cert, return result; } - result = gnutls_x509_certificate_get_subject_alt_name( xcert, seq, ret, ret_size); + result = gnutls_x509_certificate_get_subject_alt_name( xcert, seq, ret, ret_size, NULL); gnutls_x509_certificate_deinit( xcert); @@ -278,7 +278,7 @@ int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert) return result; } - result = gnutls_x509_certificate_get_ca_status( xcert); + result = gnutls_x509_certificate_get_ca_status( xcert, NULL); gnutls_x509_certificate_deinit( xcert); diff --git a/lib/x509/extensions.c b/lib/x509/extensions.c index f1724e83b6..5036cfd476 100644 --- a/lib/x509/extensions.c +++ b/lib/x509/extensions.c @@ -32,14 +32,17 @@ /* This function will attempt to return the requested extension found in * the given X509v3 certificate. The return value is allocated and stored into * ret. + * + * Critical will be either 0 or 1. */ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const char* extension_id, - gnutls_datum* ret) + gnutls_datum* ret, int * _critical) { int k, result, len; char name[128], name2[128], counter[MAX_INT_DIGITS]; char str[1024]; - char critical[10]; + char str_critical[10]; + int critical = 0; char extnID[128]; char extnValue[256]; @@ -85,9 +88,9 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const _gnutls_str_cpy(name2, sizeof(name2), name); _gnutls_str_cat(name2, sizeof(name2), ".critical"); - len = sizeof(critical) - 1; + len = sizeof(str_critical); result = - asn1_read_value(cert->cert, name2, critical, &len); + asn1_read_value(cert->cert, name2, str_critical, &len); if (result == ASN1_ELEMENT_NOT_FOUND) { gnutls_assert(); @@ -97,6 +100,10 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const return _gnutls_asn2err(result); } + if (strcmp( str_critical, "TRUE")==0) + critical = 1; + else critical = 0; + _gnutls_str_cpy(name2, sizeof(name2), name); _gnutls_str_cat(name2, sizeof(name2), ".extnValue"); @@ -108,7 +115,7 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const break; else { if (result == ASN1_MEM_ERROR - && strcmp(critical, "FALSE") == 0) { + && critical == 0) { _gnutls_x509_log ("X509_EXT: Cannot parse extension: %s. Too small buffer.", @@ -131,6 +138,9 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const ret->size = len; memcpy( ret->data, extnValue, len); + if (_critical) + *_critical = critical; + return 0; } diff --git a/lib/x509/extensions.h b/lib/x509/extensions.h index 73c5c98787..b14c828b2b 100644 --- a/lib/x509/extensions.h +++ b/lib/x509/extensions.h @@ -1,5 +1,5 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const char* extension_id, - gnutls_datum* ret); + gnutls_datum* ret, int* critical); int _gnutls_x509_ext_extract_keyUsage(uint16 *keyUsage, opaque * extnValue, int extnValueLen); int _gnutls_x509_ext_extract_basicConstraints(int *CA, opaque * extnValue, diff --git a/lib/x509/rfc2818_hostname.c b/lib/x509/rfc2818_hostname.c index ba95634569..669dfafb59 100644 --- a/lib/x509/rfc2818_hostname.c +++ b/lib/x509/rfc2818_hostname.c @@ -179,8 +179,7 @@ int gnutls_x509_certificate_check_hostname(gnutls_x509_certificate cert, dnsnamesize = sizeof(dnsname); ret = gnutls_x509_certificate_get_subject_alt_name(cert, i, - dnsname, - &dnsnamesize); + dnsname, &dnsnamesize, NULL); if (ret == GNUTLS_SAN_DNSNAME) { found_dnsname = 1; diff --git a/lib/x509/x509.c b/lib/x509/x509.c index 407bb0b632..db89b4512c 100644 --- a/lib/x509/x509.c +++ b/lib/x509/x509.c @@ -561,6 +561,7 @@ int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int* * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.) * @ret: is the place where the alternative name will be copied to * @ret_size: holds the size of ret. + * @critical: will be non zero if the extension is marked as critical (may be null) * * This function will return the alternative names, contained in the * given certificate. @@ -577,7 +578,7 @@ int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int* * **/ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, - int seq, char *ret, int *ret_size) + int seq, char *ret, int *ret_size, int *critical) { int result; gnutls_datum dnsname; @@ -591,7 +592,7 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, memset(ret, 0, *ret_size); if ((result = - _gnutls_x509_certificate_get_extension(cert, "2 5 29 17", &dnsname)) < 0) { + _gnutls_x509_certificate_get_extension(cert, "2 5 29 17", &dnsname, critical)) < 0) { gnutls_assert(); return result; } @@ -671,6 +672,7 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, /** * gnutls_x509_certificate_get_ca_status - This function returns the certificate CA status * @cert: should contain a gnutls_x509_certificate structure + * @critical: will be non zero if the extension is marked as critical * * This function will return certificates CA status, by reading the * basicConstraints X.509 extension. If the certificate is a CA a positive @@ -682,14 +684,14 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned. * **/ -int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert) +int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert, int* critical) { int result; gnutls_datum basicConstraints; int ca; if ((result = - _gnutls_x509_certificate_get_extension(cert, "2 5 29 19", &basicConstraints)) < 0) { + _gnutls_x509_certificate_get_extension(cert, "2 5 29 19", &basicConstraints, critical)) < 0) { gnutls_assert(); return result; } @@ -715,6 +717,7 @@ int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert) * gnutls_x509_certificate_get_key_usage - This function returns the certificate's key usage * @cert: should contain a gnutls_x509_certificate structure * @key_usage: where the key usage bits will be stored + * @critical: will be non zero if the extension is marked as critical * * This function will return certificate's key usage, by reading the * keyUsage X.509 extension. The key usage value will ORed values of the: @@ -729,14 +732,15 @@ int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert) * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned. * **/ -int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned int *key_usage) +int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned int *key_usage, + int *critical) { int result; gnutls_datum keyUsage; uint16 _usage; if ((result = - _gnutls_x509_certificate_get_extension(cert, "2 5 29 15", &keyUsage)) < 0) { + _gnutls_x509_certificate_get_extension(cert, "2 5 29 15", &keyUsage, critical)) < 0) { gnutls_assert(); return result; } @@ -766,6 +770,7 @@ int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned * @oid: holds an Object Identified in null terminated string * @buf: a pointer to a structure to hold the name (may be null) * @sizeof_buf: initialy holds the size of 'buf' + * @critical: will be non zero if the extension is marked as critical * * This function will return the extension specified by the OID in the certificate. * The extensions will be returned as binary data DER encoded, in the provided @@ -777,13 +782,13 @@ int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned * **/ int gnutls_x509_certificate_get_extension_by_oid(gnutls_x509_certificate cert, const char* oid, - unsigned char* buf, int * sizeof_buf) + unsigned char* buf, int * sizeof_buf, int * critical) { int result; gnutls_datum output; if ((result = - _gnutls_x509_certificate_get_extension(cert, oid, &output)) < 0) { + _gnutls_x509_certificate_get_extension(cert, oid, &output, critical)) < 0) { gnutls_assert(); return result; } diff --git a/lib/x509/x509.h b/lib/x509/x509.h index 0dfbb57d68..c4bce3652d 100644 --- a/lib/x509/x509.h +++ b/lib/x509/x509.h @@ -12,6 +12,6 @@ typedef struct gnutls_x509_certificate_int *gnutls_x509_certificate; int gnutls_x509_certificate_get_issuer_dn_by_oid(gnutls_x509_certificate cert, const char* oid, char *buf, int *sizeof_buf); int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, - int seq, char *ret, int *ret_size); + int seq, char *ret, int *ret_size, int* critical); int gnutls_x509_certificate_get_dn_by_oid(gnutls_x509_certificate cert, const char* oid, char *buf, int *sizeof_buf);